joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443af1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x46a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x120]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x11c
push ebx
push 0
push eax
call fcn.0042f8e0
mov eax, dword [0x46b6d4]
add esp, 0xc
test eax, eax
jne 0x443bd5
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx ecx, word [ebp - 0xc]
movzx eax, word [ebp - 0xa]
shl ecx, 0x10
or ecx, eax
cmp dword [ebp - 0x11c], 4
mov dword [0x46b6d8], ecx
jne 0x443b65
xor eax, eax
inc eax
jmp 0x443bd0
cmp dword [ebp - 0x11c], 5
jne 0x443b96
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x443b7c
push 2
jmp 0x443bcf
cmp ecx, 1
jne 0x443b85
push 3
jmp 0x443bcf
xor eax, eax
cmp ecx, 2
setne al
dec eax
and eax, 0xfffffffb
add eax, 9
jmp 0x443bd0
cmp dword [ebp - 0x11c], 6
jne 0x443bcd
cmp dword [ebp - 0x118], 0
jne 0x443bb6
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 5
jmp 0x443bd0
cmp dword [ebp - 0x118], 1
jne 0x443bcd
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 7
jmp 0x443bd0
push 9
pop eax
mov dword [0x46b6d4], eax
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
mov eax, dword [0x46b6d8]
mov dword [edi], eax
pop edi
pop esi
pop ebx
call fcn.0042e06f
mov esp, ebp
pop ebp
ret 8

Function at 0x444019
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test ebx, ebx
sete al
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4440f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x44405f
cmp eax, 0x50
je 0x444057
cmp eax, 0xb7
jne 0x44405f
xor esi, esi
inc esi
jmp 0x4440f9
cmp eax, 3
jne 0x4440e8
movzx ecx, word [edi]
mov ebx, esi
mov eax, edi
test cx, cx
je 0x4440e1
push 0x5c
pop edx
cmp cx, dx
jne 0x44407e
mov ebx, eax
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x444077
test ebx, ebx
je 0x4440e1
push esi
xor eax, eax
push edi
mov word [ebx], ax
call fcn.00404115
mov esi, eax
push 0x5c
pop eax
mov word [ebx], ax
test esi, esi
js 0x4440f9
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4440f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4440cd
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x4440f9
push esi
push 0x454
push str.fileutil.cpp
call fcn.00403821
jmp 0x4440f9
mov esi, 0x80070003
jmp 0x4440f9
test eax, eax
jg 0x4440f0
mov esi, eax
jmp 0x4440f9
movzx esi, ax
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x444153
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 8]
xor esi, esi
call fcn.00444440
test eax, eax
je 0x4441dc
test byte [ebp - 4], 7
push ebx
mov ebx, 0x80070000
je 0x4441a9
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4441a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44419f
movzx esi, si
or esi, ebx
test esi, esi
jns 0x4441a9
push esi
push 0x5c4
jmp 0x4441d1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4441db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4441c9
movzx esi, si
or esi, ebx
test esi, esi
jns 0x4441db
push esi
push 0x5ca
push str.fileutil.cpp
call fcn.00403821
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4441e5
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
xor esi, esi
cmp dword [ebp + 0x10], ebx
setne bl
cmp dword [ebp + 0x14], esi
je 0x4441fc
or ebx, 2
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4442f4
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp dword [ebp + 0x10], esi
jne 0x444234
cmp edi, 0x50
je 0x44422c
cmp edi, 0xb7
jne 0x444234
xor esi, esi
inc esi
jmp 0x4442f3
cmp edi, 2
jne 0x44424d
push esi
push dword [ebp + 8]
call fcn.00444440
test eax, eax
je 0x4442ea
push 3
pop edi
cmp edi, 3
jne 0x4442e2
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov eax, edi
movzx edx, word [edi]
test dx, dx
je 0x4442db
mov dword [ebp + 0xc], 0x5c
cmp dx, word [ebp + 0xc]
jne 0x444274
mov ecx, eax
add eax, 2
movzx edx, word [eax]
test dx, dx
jne 0x44426c
mov dword [ebp + 0x10], ecx
test ecx, ecx
je 0x4442db
push esi
xor eax, eax
push edi
mov word [ecx], ax
call fcn.00404115
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov eax, dword [ebp + 0x10]
mov word [eax], cx
test esi, esi
js 0x4442f3
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4442f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4442c7
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x4442f3
push esi
push 0x4d4
push str.fileutil.cpp
call fcn.00403821
jmp 0x4442f3
mov esi, 0x80070003
jmp 0x4442f3
test edi, edi
jg 0x4442ea
mov esi, edi
jmp 0x4442f3
movzx esi, di
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x401330
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004a06f0
lea eax, [ebp - 4]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x40135f
mov eax, 1
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 4]
push edi
shr ebx, 2
xor edi, edi
test ebx, ebx
je 0x4013b5
push esi
nop
mov eax, dword [ebp + edi*4 - 0x1004]
test eax, eax
je 0x4013af
push eax
call fcn.004013c0
add esp, 4
cmp eax, 1
jne 0x4013af
push dword [ebp + edi*4 - 0x1004]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, ebx
jb 0x401370
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4056c0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x1d
push str.Mozilla_5.0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
call fcn.004032f0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0
push 0
push 1
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edx, dword [ebp - 0x18]
mov ebx, eax
cmp edx, 8
jb 0x405743
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405739
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40585a
push edx
push ecx
call fcn.004a06de
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
test ebx, ebx
je 0x40585f
push eax
push 0x84000100
push eax
push eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
jne 0x405788
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.Couldnt_open_URL_
jmp 0x405864
lea eax, [ebp - 1]
mov dword [ebp - 0x14], 0
push eax
push 0x400
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00405420
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x400
push dword [ebp - 0x14]
mov dword [edi], 0
push esi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x405815
mov eax, dword [ebp - 8]
test eax, eax
je 0x405815
push dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
add eax, ecx
push eax
push ecx
push dword [edi + 4]
mov ecx, edi
call fcn.00405180
lea eax, [ebp - 8]
push eax
push 0x400
push dword [ebp - 0x14]
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4057e3
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x405851
mov edx, dword [ebp - 0xc]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x405847
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40588a
push edx
push ecx
call fcn.004a06de
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004a514f
push str.Couldnt_open_Internet_
lea ecx, [ebp - 0x44]
call fcn.00404740
mov ecx, eax
call fcn.004062e0
push eax
lea ecx, [ebp - 0x20]
call fcn.00405620
push 0x4d747c
lea eax, [ebp - 0x20]
push eax
call fcn.004a1ad0
call fcn.004a514f
int3
Function at 0x409ee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0x100
cmp dword [ecx + 0x14], 0x10
push esi
mov esi, dword [ebp + 8]
jb 0x409ef8
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push 0x20019
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409f4b
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], 0xff
cmp dword [eax + 0x14], 0x10
jb 0x409f25
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x100]
push ecx
push 0
push 0
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x10]
test eax, eax
je 0x409f66
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
mov eax, esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x100]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409f90
sub ecx, edx
lea eax, [ebp - 0x100]
push ecx
push eax
mov ecx, esi
call fcn.00401820
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409fb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
jb 0x409fbe
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push 2
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a00c
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x409fe4
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x14], 0x10
jb 0x409fef
mov ecx, dword [ecx]
push edx
push eax
push 1
push 0
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0xc]
test eax, eax
je 0x40a010
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ebp
ret
Function at 0x429920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x429970
mov eax, dword [ebp + 0xc]
mov esi, eax
mov al, byte [eax]
test al, al
je 0x42995e
nop dword [eax]
movzx eax, al
lea esi, [esi + 1]
movzx ecx, byte [eax + 0x4c1ab8]
lea eax, [edx*8]
xor ecx, eax
mov al, byte [esi]
xor edx, ecx
test al, al
jne 0x429940
mov ecx, dword [ebp + 8]
mov eax, edx
xor edx, edx
div dword [ecx]
mov edi, dword [ebx + edx*8 + 4]
mov ecx, dword [ebx + edx*8]
jmp 0x429976
mov edi, dword [eax + 8]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
test ecx, ecx
je 0x4299d8
nop
mov esi, dword [edi + 0xc]
dec ecx
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0xc]
mov edx, ecx
mov bl, byte [esi]
test bl, bl
je 0x4299b7
mov al, bl
sub esi, ecx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x4c1ab8]
cmp al, byte [ecx + 0x4c1ab8]
jne 0x4299b7
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x429996
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x4c1ab8]
movzx eax, bl
movzx eax, byte [eax + 0x4c1ab8]
sub eax, ecx
je 0x4299df
mov ecx, dword [ebp + 8]
mov edi, dword [edi]
test ecx, ecx
jne 0x429980
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43b9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
test eax, eax
je 0x43ba07
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
cmp eax, edx
je 0x43ba00
test ecx, ecx
je 0x43ba0b
cmp dword [eax + 0x3c], ecx
je 0x43ba0b
mov eax, dword [eax + 8]
test eax, eax
jne 0x43b9f3
xor eax, eax
pop ebp
ret
test eax, eax
je 0x43ba07
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0043ba20
Function at 0x43ba20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
cmp esi, ecx
je 0x43bc3a
test eax, eax
je 0x43ba44
cmp dword [esi + 0x3c], eax
jne 0x43bc3a
cmp byte [esi + 0x49], 1
jne 0x43bbfe
cmp word [esi + 0x2c], 0
jne 0x43ba90
movsx eax, word [esi + 0x4c]
mov edi, dword [esi + eax*4 + 0x78]
movzx ecx, word [esi + eax*2 + 0x4e]
mov eax, dword [edi + 0x40]
movzx edx, byte [eax + ecx*2 + 1]
lea ecx, [eax + ecx*2]
lea eax, [esi + 0x18]
push eax
movzx eax, byte [ecx]
shl eax, 8
or edx, eax
movzx eax, word [edi + 0x14]
and edx, eax
add edx, dword [edi + 0x38]
push edx
push edi
call fcn.0041e9e0
add esp, 0xc
or byte [esi + 0x48], 2
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov eax, dword [esi + 0x78]
cmp byte [eax + 2], 0
jne 0x43bbeb
mov edi, dword [esi + 0x30]
mov eax, edi
or eax, ecx
je 0x43bc60
test ecx, ecx
ja 0x43bc60
jb 0x43bacc
cmp edi, 0x7fffff00
jae 0x43bc60
cmp dword [0x4da008], 0
je 0x43bbbd
mov eax, dword [0x4dc480]
test eax, eax
je 0x43baec
push eax
call dword [0x4da05c]
add esp, 4
push edi
call dword [0x4da03c]
mov ecx, dword [0x4dc35c]
add esp, 4
cmp edi, ecx
mov dword [0x4dc334], edi
mov ebx, eax
cmovg ecx, edi
cmp dword [0x4dc490], 0
mov dword [0x4dc35c], ecx
je 0x43bb58
mov edi, dword [0x4dc488]
mov ecx, dword [0x4dc48c]
cdq
sub edi, eax
mov eax, dword [0x4dc320]
sbb ecx, edx
cdq
cmp edx, ecx
jl 0x43bb4e
jg 0x43bb39
cmp eax, edi
jb 0x43bb4e
push ebx
mov dword [0x4dc4a4], 1
call fcn.00457280
add esp, 4
jmp 0x43bb58
mov dword [0x4dc4a4], 0
push ebx
call dword [0x4da02c]
mov edi, eax
add esp, 4
test edi, edi
je 0x43bbab
push edi
call dword [0x4da038]
mov ecx, dword [0x4dc320]
add esp, 4
add ecx, eax
mov eax, dword [0x4dc348]
cmp ecx, eax
mov dword [0x4dc320], ecx
cmovg eax, ecx
mov ecx, dword [0x4dc344]
inc ecx
mov dword [0x4dc348], eax
mov eax, dword [0x4dc36c]
cmp ecx, eax
mov dword [0x4dc344], ecx
cmovg eax, ecx
mov dword [0x4dc36c], eax
mov eax, dword [0x4dc480]
test eax, eax
je 0x43bbc9
push eax
call dword [0x4da064]
jmp 0x43bbc6
push edi
call dword [0x4da02c]
mov edi, eax
add esp, 4
test edi, edi
je 0x43bc60
push 0
push edi
push dword [esi + 0x30]
push 0
push esi
call fcn.00419400
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x43bc4c
mov dword [esi + 0x38], edi
push esi
call fcn.0041ec80
add esp, 4
mov byte [esi + 0x49], 3
and byte [esi + 0x48], 0xfb
jmp 0x43bc3a
xor eax, eax
xor ebx, ebx
cmp ax, word [esi + 0x4c]
jg 0x43bc33
lea edi, [esi + 0x78]
nop dword [eax + eax]
mov eax, dword [edi]
test eax, eax
je 0x43bc21
push dword [eax + 0x44]
call fcn.00459d20
add esp, 4
mov dword [edi], 0
inc ebx
movsx eax, word [esi + 0x4c]
add edi, 4
cmp ebx, eax
jle 0x43bc10
or eax, 0xffffffff
mov word [esi + 0x4c], ax
mov esi, dword [esi + 8]
test esi, esi
jne 0x43ba29
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push edi
call fcn.004134b0
add esp, 4
mov eax, ebx
and byte [esi + 0x48], 0xfb
pop edi
pop esi
pop ebx
pop ebp
ret
and byte [esi + 0x48], 0xfb
mov ebx, 7
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x445490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
add ecx, ecx
push edi
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + ecx*8]
mov eax, 1
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x10], eax
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x28]
push eax
push 0x18
call fcn.00413120
mov eax, dword [esi]
add esp, 0x10
xor esi, esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], esi
cmp dword [eax + 0x14], esi
jg 0x4454f7
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 4
jle 0x4454b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov edi, esi
xor edi, 1
cmp esi, 2
cmovge edi, esi
test ebx, ebx
je 0x44555c
mov eax, dword [eax + 0x10]
mov ecx, edi
mov bl, byte [ebx]
add ecx, ecx
mov edx, dword [eax + ecx*8]
test bl, bl
je 0x445544
mov esi, dword [ebp + 0xc]
mov al, bl
sub esi, edx
nop dword [eax]
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x4c1ab8]
cmp al, byte [ecx + 0x4c1ab8]
jne 0x445541
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x445520
mov esi, dword [ebp - 0xc]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x4c1ab8]
movzx eax, bl
movzx eax, byte [eax + 0x4c1ab8]
sub eax, ecx
jne 0x445593
mov ebx, dword [ebp - 8]
lea ecx, [ebp - 0xc]
add edi, edi
push ecx
lea ecx, [ebp - 0x28]
mov eax, dword [ebx + 0x10]
push ecx
mov eax, dword [eax + edi*8 + 0xc]
add eax, 8
push eax
call fcn.00429920
add esp, 0xc
test eax, eax
je 0x44558c
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4455b1
jmp 0x445599
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x445599
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
inc esi
cmp esi, dword [ebx + 0x14]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
jl 0x4454f4
test eax, eax
je 0x4454de
push dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push eax
push ebx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push esi
call fcn.00457790
add esp, 0x18
jmp 0x4454e1
Function at 0x44e9b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [esi + 0x14], edx
jle 0x44ea82
push ebx
mov ebx, dword [ebp + 0x10]
nop
mov eax, dword [esi + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
test ebx, ebx
je 0x44ea42
mov edx, dword [eax + ecx*8]
mov ecx, dword [ebp + 0x10]
mov bl, byte [ecx]
test bl, bl
je 0x44ea24
mov esi, ecx
mov al, bl
sub esi, edx
nop dword [eax]
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x4c1ab8]
cmp al, byte [ecx + 0x4c1ab8]
jne 0x44ea21
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x44ea00
mov esi, dword [ebp + 8]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x4c1ab8]
movzx eax, bl
mov ebx, dword [ebp + 0x10]
movzx eax, byte [eax + 0x4c1ab8]
sub eax, ecx
jne 0x44ea6c
mov edx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [edx + 0x18]
push eax
call fcn.00429920
add esp, 0xc
test eax, eax
je 0x44ea65
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x44ea79
jmp 0x44ea6f
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x44ea6f
mov edx, dword [ebp - 4]
inc edi
cmp edi, dword [esi + 0x14]
jl 0x44e9d0
pop ebx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44ea90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
xor eax, eax
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
cmp dword [edx + 0x14], eax
jle 0x44eb6a
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
test ebx, ebx
je 0x44eb22
mov eax, dword [edx + 0x10]
mov ecx, esi
add ecx, ecx
mov edx, dword [eax + ecx*8]
mov ecx, dword [ebp + 0x10]
mov bl, byte [ecx]
test bl, bl
je 0x44eb04
sub ecx, edx
mov al, bl
mov dword [ebp - 0xc], ecx
mov edi, ecx
nop dword [eax]
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x4c1ab8]
cmp al, byte [ecx + 0x4c1ab8]
jne 0x44eb01
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x44eae0
mov edi, dword [ebp - 8]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x4c1ab8]
movzx eax, bl
mov ebx, dword [ebp + 0x10]
movzx eax, byte [eax + 0x4c1ab8]
sub eax, ecx
jne 0x44eb55
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
lea ecx, [ebp - 0xc]
add esi, esi
push ecx
push dword [ebp + 0xc]
mov eax, dword [eax + esi*8 + 0xc]
add eax, 8
push eax
call fcn.00429920
add esp, 0xc
test eax, eax
je 0x44eb4e
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x44eb68
jmp 0x44eb58
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x44eb58
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [edx + 0x14]
jl 0x44eab2
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x477a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x477a4e
nop
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x4c1ab8]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x477a30
pop esi
pop ebp
ret

Function at 0x47d060
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x14
mov dword [edi], 0
call fcn.00457140
mov esi, eax
add esp, 8
test esi, esi
jne 0x47d087
pop edi
lea eax, [esi + 7]
pop esi
pop ebp
ret
cmp dword [0x4da00c], 0
push ebx
mov ebx, dword [ebp + 0x10]
je 0x47d0bb
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x464ac0
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.004a72fe
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x47d0c8
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x47d0e1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebp
ret