joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x4617f1
test edi, edi
je 0x4617f1
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x461795
sub ecx, edx
je 0x4617f1
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.00460ed0
add esp, 8
test eax, eax
jne 0x4617f1
mov eax, dword [ebp - 0x20]
xor ecx, ecx
add eax, 1
push 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0058738b
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x4617f1
push 0x6888a8
push edi
call fcn.00460c10
mov edi, eax
add esp, 8
test edi, edi
jne 0x461804
push dword [esi]
call fcn.00587396
add esp, 4
mov dword [esi], edi
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d371
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x20]
push 1
push dword [esi]
call fcn.0057c310
push edi
mov esi, eax
call fcn.0057bf1b
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.0055d371
mov esp, ebp
pop ebp
ret
Function at 0x461fc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 4
call fcn.0055d382
mov esi, eax
add esp, 4
test esi, esi
je 0x461fec
mov dword [esi], 0
jmp 0x461fee
xor esi, esi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x418], 0xf
push 0
push eax
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x42c], 0
call fcn.00572a10
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00572a10
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x462066
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00587ca9
add esp, 0xc
cmp byte [ebp - 0x20c], 0
jne 0x462073
xor ecx, ecx
jmp 0x462089
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x462080
sub ecx, edx
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0043f550
push 0x630858
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00461410
push str.AdobeGCData
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00461410
push 0x630858
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00461410
push str.AdobeNGLAppIDMap.db
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00461410
add esp, 0x30
cmp byte [ebp - 0x108], 0
jne 0x462104
xor ecx, ecx
jmp 0x462119
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x462110
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0043f550
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
push esi
cmovae eax, dword [ebp - 0x42c]
push eax
call fcn.00468953
add esp, 8
test eax, eax
je 0x46215b
push 4
push esi
call fcn.0055d3b2
add esp, 8
xor esi, esi
mov ecx, dword [ebp - 0x418]
cmp ecx, 0x10
jb 0x462179
inc ecx
push ecx
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x42c]
call fcn.00439220
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0055d371
mov esp, ebp
pop ebp
ret

Function at 0x481e69
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x481ea4
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x481e8b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x481e9c
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x481ea6
inc edi
add eax, 0x28
cmp edi, esi
jb 0x481e81
xor eax, eax
pop edi
pop esi
ret
Function at 0x48226f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x4822c4
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00481e39
push eax
push esi
push dword [ebp + 8]
call fcn.00481dee
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00481e29
pop esp
stc
ret
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
inc ebp
and byte [edx - 0x3a], 0x45
sbb dword [ebx - 0x3a], 0x45
test byte [ecx - 0x3a], bh
inc ebp
test dword [edx - 0x3a], esi
inc ebp
xchg byte [ebx - 0x3a], ah
inc ebp
xchg dword [edx - 0x3a], edi
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x4822bf
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x4822c7
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
call fcn.00481e29
add eax, 0x8d83f6d0
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x482716
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, 0
add byte [eax], al
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
inc dword [edx]
Function at 0x48a10b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x48a120
xor eax, eax
jmp 0x48a1ff
push ebx
mov ebx, dword [ebp + 8]
push edi
push 8
push ebx
call fcn.004869f6
mov edi, eax
mov dword [ebp - 0x10], edi
pop ecx
pop ecx
test edi, edi
je 0x48a16b
test byte [ebp + 0x10], 1
mov eax, dword [esi]
mov dword [edi], eax
jne 0x48a14f
xor eax, eax
inc eax
cmp dword [esi], eax
jle 0x48a14f
add eax, eax
cmp eax, dword [esi]
jl 0x48a149
imul eax, eax, 0x18
push eax
push ebx
call fcn.004869f6
mov dword [edi + 4], eax
pop ecx
pop ecx
test eax, eax
jne 0x48a172
push edi
push ebx
call fcn.00486999
pop ecx
pop ecx
xor eax, eax
jmp 0x48a1fd
and dword [ebp - 8], 0
cmp dword [esi], 0
mov ecx, dword [esi + 4]
mov dword [ebp + 0xc], ecx
jle 0x48a1fb
lea edx, [eax + 0x10]
sub eax, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov dword [ebp - 0xc], eax
push 0
push dword [ebp + 0x10]
push dword [ecx]
push ebx
call fcn.00474371
mov ecx, dword [ebp + 0xc]
mov dword [edi + ecx], eax
push dword [ecx + 4]
push ebx
call fcn.00486be0
mov ecx, dword [ebp - 4]
mov dword [ecx - 0xc], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 8]
push ebx
call fcn.00486be0
mov edx, dword [ebp - 4]
add esp, 0x20
mov ecx, dword [ebp + 0xc]
mov dword [edx - 8], eax
mov al, byte [ecx + 0xc]
and dword [edx], 0xfffffffe
mov byte [edx - 4], al
mov eax, dword [ecx + 0x10]
xor eax, dword [edx]
and eax, 2
xor dword [edx], eax
mov eax, dword [ecx + 0x14]
add ecx, 0x18
mov dword [edx + 4], eax
add edx, 0x18
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov dword [ebp + 0xc], ecx
cmp eax, dword [esi]
jl 0x48a18e
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a49fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
test esi, esi
jle 0x4a4a29
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
mov ecx, edi
shl ecx, 3
movzx edx, byte [eax + 0x631f98]
xor edx, ecx
xor edi, edx
inc ebx
dec esi
test esi, esi
jg 0x4a4a0f
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4ae4f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0055d950
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call fcn.00439950
push ebx
push 0
push edi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
test esi, esi
jne 0x4ae582
push 0xffd
lea edx, [ebp - 0x1004]
or ecx, 1
push edx
push eax
push ecx
call fcn.00580f23
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
jle 0x4ae553
lea eax, [ebp + eax - 0x1004]
jmp 0x4ae55b
cmp eax, 0xffffffff
jne 0x4ae593
lea eax, [ebp - 7]
mov word [eax], 0xa0d
mov byte [eax + 2], 0
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d371
mov esp, ebp
pop ebp
ret
push esi
push eax
push ecx
call fcn.00580dcf
push esi
call fcn.0058ab4f
add esp, 0x1c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055d371
mov esp, ebp
pop ebp
ret
Function at 0x4b10d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5febb7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6c2d9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x10], 0
je 0x4b1125
mov dword [ebx], 0x639ba8
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
lea esi, [ebx + 0x10]
mov ecx, ebx
push 0
push esi
mov dword [ebp + 0xc], esi
call fcn.004b0ef0
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + ebx - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0055d382
mov esi, eax
add esp, 4
test esi, esi
je 0x4b1182
push 1
mov byte [ebp - 4], 2
call fcn.0055f0fe
add esp, 4
mov dword [esi + 4], eax
jmp 0x4b1184
xor esi, esi
lea eax, [ebx + 0x10]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x10]
mov dword [esi], 0
mov esi, dword [ebp + 0xc]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [edi], 0
not ecx
mov dword [edx], 0
and ecx, 2
mov eax, ebx
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov edx, ecx
mov dword [esi + 0x38], 0
or edx, 8
and al, 8
cmove edx, ecx
mov eax, edx
or eax, 0x10
and bl, 4
cmove eax, edx
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c1900
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x600528
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6c2d9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x4c193a
mov byte [esi + 0xc], 1
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea edi, [esi + 8]
push edi
push 0x639d00
push 1
push 0
push 0x639cf0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
js 0x4c1a3d
cmp dword [edi], 0
je 0x4c1a17
push 0x63ae88
lea ecx, [ebp - 0x10]
call fcn.004c1640
mov eax, dword [eax]
mov dword [ebp - 4], 0
test eax, eax
je 0x4c199b
mov ebx, dword [eax]
jmp 0x4c199d
xor ebx, ebx
mov ecx, dword [edi]
lea eax, [esi + 4]
push eax
push 0
push 0
mov edx, dword [ecx]
push 0
push 0
push 0
push 0
push ebx
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp - 0x10]
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4c1a14
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4c1a0d
test edi, edi
je 0x4c1a0d
mov eax, dword [edi]
test eax, eax
je 0x4c19eb
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x4c1a02
push eax
call fcn.0055d36c
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.0055d3b2
add esp, 8
mov dword [ebp - 0x10], 0
lea edi, [esi + 8]
test ebx, ebx
js 0x4c1a3d
mov eax, dword [esi + 4]
test eax, eax
je 0x4c1a39
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test ebx, ebx
jns 0x4c1a73
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c1a4a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x4c1a56
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp byte [esi + 0xc], 0
je 0x4c1a62
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [esi + 4], 0
mov dword [edi], 0
mov byte [esi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c32e0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 8
mov word [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4c335e
call esi
cmp eax, 0x3f0
jne 0x4c333f
lea eax, [ebp - 0x14]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4c335e
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d371
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x4c3348
call esi
cmp eax, 0x7a
jne 0x4c3348
mov esi, dword [ebp - 0x18]
mov eax, esi
call fcn.0055e5e0
mov ebx, esp
test ebx, ebx
je 0x4c3348
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x4c3348
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x222
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4c3348
xor esi, esi
mov byte [ebp - 0xd], 0
cmp dword [ebx], esi
jbe 0x4c33f0
lea edi, [ebx + 4]
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4c33ec
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x4c33d3
jmp 0x4c33f0
mov byte [ebp - 0xd], 1
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0xd]
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d371
mov esp, ebp
pop ebp
ret
Function at 0x4d03b1
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d03ea
cmp dword [ebp + 0x10], 0
je 0x4d03ea
cmp dword [ebp + 0x14], 0
je 0x4d03ea
cmp dword [ebp + 0x18], 0
je 0x4d03ea
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.SELECT_value_FROM_domain_data_WHERE_domain___d_AND_subdomain___q_AND_key___q
push dword [ebp + 0x18]
push dword [eax]
call fcn.004dc673
add esp, 0x18
pop ebp
ret
push 0xa
pop eax
pop ebp
ret

Function at 0x4d03ef
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d041f
cmp dword [ebp + 0x10], 0
je 0x4d041f
cmp dword [ebp + 0x14], 0
je 0x4d041f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.SELECT_key_FROM_domain_data_WHERE_domain___d_AND_subdomain___q
push dword [ebp + 0x14]
push dword [eax]
call fcn.004dc4a3
add esp, 0x14
pop ebp
ret
push 0xa
pop eax
pop ebp
ret

Function at 0x4d0424
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d044b
cmp dword [ebp + 0x10], 0
je 0x4d044b
push dword [ebp + 0xc]
push str.SELECT_DISTINCT_subdomain_FROM_domain_data_WHERE_domain___d
push dword [ebp + 0x10]
push dword [eax]
call fcn.004dc4a3
add esp, 0x10
pop ebp
ret
push 0xa
pop eax
pop ebp
ret
Function at 0x4d1320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push 1
mov dword [ebp - 0x18], eax
mov esi, ecx
lea eax, [ebp - 0x14]
push 0xe
push eax
call fcn.0057c310
add esp, 0x10
cmp eax, 1
jne 0x4d14b0
mov edx, dword [ebp - 0x14]
mov di, word [ebp - 0xe]
mov bx, word [ebp - 0xc]
mov ecx, dword [ebp - 0x12]
mov eax, dword [ebp - 0xa]
mov byte [esi], dl
mov byte [esi + 1], dh
mov dword [esi + 4], ecx
mov word [esi + 8], di
mov word [esi + 0xa], bx
mov dword [esi + 0xc], eax
cmp dl, 0x42
jne 0x4d14b0
cmp dh, 0x4d
jne 0x4d14b0
test di, di
jne 0x4d14b0
test bx, bx
jne 0x4d14b0
lea eax, [ecx - 0x37]
cmp eax, 0x1e8449
ja 0x4d14b0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4d13be
push eax
call fcn.00587396
mov ecx, dword [esi + 4]
add esp, 4
push ecx
call fcn.005873b1
add esp, 4
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x4d13e6
pop edi
pop esi
mov eax, 0xfffffff9
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d371
mov esp, ebp
pop ebp
ret 4
xor edx, edx
nop dword [eax + eax]
mov ecx, dword [esi + 0x3c]
movzx eax, byte [ebp + edx - 0x14]
mov byte [edx + ecx], al
mov ecx, dword [esi + 0x3c]
movzx eax, byte [ebp + edx - 0x13]
mov byte [ecx + edx + 1], al
add edx, 2
cmp edx, 0xe
jl 0x4d13f0
push dword [ebp - 0x18]
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 4]
sub eax, 0xe
push 1
push eax
lea eax, [ecx + 0xe]
push eax
call fcn.0057c310
mov edx, dword [esi + 0x3c]
add esp, 0x10
cmp eax, 1
jne 0x4d14a0
mov eax, dword [edx + 0xe]
mov dword [esi + 0x10], eax
mov eax, dword [edx + 0x12]
mov dword [esi + 0x14], eax
mov eax, dword [edx + 0x16]
mov dword [esi + 0x18], eax
movzx ecx, word [edx + 0x1a]
mov dword [esi + 0x1c], ecx
movzx eax, word [edx + 0x1c]
mov dword [esi + 0x20], eax
mov edi, eax
mov ebx, dword [edx + 0x1e]
mov dword [esi + 0x24], ebx
mov eax, dword [edx + 0x22]
mov dword [esi + 0x28], eax
mov eax, dword [edx + 0x26]
mov dword [esi + 0x2c], eax
mov eax, dword [edx + 0x2a]
mov dword [esi + 0x30], eax
mov eax, dword [edx + 0x2e]
mov dword [esi + 0x34], eax
mov eax, dword [edx + 0x32]
mov dword [esi + 0x38], eax
cmp ecx, 1
jne 0x4d14a0
test ebx, ebx
jne 0x4d14a0
cmp edi, 0x18
je 0x4d148b
cmp edi, 0x20
jne 0x4d14a0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d371
mov esp, ebp
pop ebp
ret 4
push edx
call fcn.00587396
mov dword [esi + 0x3c], 0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffe
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055d371
mov esp, ebp
pop ebp
ret 4
Function at 0x4d1520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6c2d9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
push 0x63b0a8
push eax
mov dword [ebp - 0x20], ebx
call fcn.00460c10
mov esi, eax
add esp, 8
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x4d1566
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055d371
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebx + 0x3c]
push edi
test esi, esi
jne 0x4d157a
mov esi, 0xfffffffd
mov edi, eax
jmp 0x4d1676
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4d158c
mov edi, dword [ebp - 0x14]
lea esi, [eax - 4]
jmp 0x4d1676
mov ecx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d1591
mov eax, dword [ebx + 0x18]
sub ecx, edx
imul eax, dword [ebx + 0x14]
inc ecx
mov dword [ebp - 0x18], ecx
lea eax, [eax + eax*2]
cmp ecx, eax
jbe 0x4d15b9
mov edi, dword [ebp - 0x14]
mov esi, 0xfffffffb
jmp 0x4d1676
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0xc]
xor edi, edi
shr ecx, 3
add eax, esi
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x8040201
mov dword [ebp - 8], 0x80402010
cmp dword [ebp - 0x18], edx
jbe 0x4d1657
mov esi, dword [ebp + 0xc]
mov al, byte [ebx + esi]
test byte [ebp + edi - 0xc], al
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edx]
jne 0x4d1606
test al, 1
je 0x4d1615
mov ecx, dword [ebp - 0x10]
dec al
mov byte [ecx + edx], al
mov ecx, dword [ebp - 0x1c]
jmp 0x4d1615
test al, 1
jne 0x4d1615
mov esi, dword [ebp - 0x10]
inc al
mov byte [esi + edx], al
mov esi, dword [ebp + 0xc]
inc edx
cmp ecx, 4
jne 0x4d162f
mov eax, edx
and eax, 0x80000003
jns 0x4d1629
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
jne 0x4d162f
inc edx
cmp edi, 7
lea eax, [ebx + 1]
cmovne eax, ebx
xor ecx, ecx
cmp edi, 7
mov ebx, eax
lea eax, [edi + 1]
cmovne ecx, eax
mov edi, ecx
mov ecx, dword [ebp - 0x1c]
cmp ebx, dword [ebp - 0x18]
jb 0x4d15e6
mov eax, dword [ebp - 0x20]
mov esi, dword [eax + 0x3c]
jmp 0x4d165a
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
push edi
push 1
push dword [eax + 4]
push esi
call fcn.0058d9f7
add esp, 0x10
lea esi, [eax - 1]
neg esi
sbb esi, esi
and esi, 0xfffffffa
push edi
call fcn.0057bf1b
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0055d371
mov esp, ebp
pop ebp
ret 8

Function at 0x4d16c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
mov esi, ecx
xor bh, bh
push edi
mov dword [esi + 0x204], 9
movq xmm0, qword [str.Adobe_ALM]
movq qword [esi + 0x102], xmm0
mov al, byte [0x63e504]
mov byte [esi + 0x10a], al
xor eax, eax
mov word [esi + 0x100], 0
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x4d16f7
xor edi, edi
mov eax, edi
mov bl, byte [edi + esi]
cdq
idiv dword [esi + 0x204]
movzx eax, byte [edx + esi + 0x102]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x4d1704
pop edi
mov eax, esi
pop esi
pop ebx
ret