joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405650
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0xc
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 1
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], 0
push eax
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x4056fb
xor eax, eax
nop
mov byte [ebp + eax - 0x7c], 0
inc eax
cmp eax, 0x44
jb 0x405690
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x7c], 0x44
mov dword [ebp - 0x50], 0x101
mov word [ebp - 0x4c], ax
nop dword [eax + eax]
mov byte [ebp + eax - 0x30], 0
inc eax
cmp eax, 0x10
jb 0x4056c0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0
push 0x10
push 1
push 0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405704
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xea60
push dword [ebp - 0x30]
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x40580a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 0x400
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40580a
push 0
cmp eax, 0x400
lea ecx, [ebp - 8]
push ecx
cmova eax, edx
push eax
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40580a
mov eax, dword [ebp - 8]
test eax, eax
je 0x40580a
inc eax
add eax, ebx
cmp ebx, eax
ja 0x40580a
push eax
test edi, edi
jne 0x40579a
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x4057a6
push edi
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, eax
test edi, edi
je 0x4057da
mov edx, dword [ebp - 8]
lea esi, [ebx + edi]
test esi, esi
je 0x4057d2
xor eax, eax
test edx, edx
je 0x4057d2
nop dword [eax]
mov cl, byte [ebp + eax - 0x47c]
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jb 0x4057c0
mov edx, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add ebx, edx
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov edx, 0x400
test eax, eax
jne 0x405740
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
test edi, edi
je 0x405822
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406450
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
xor eax, eax
push esi
mov esi, edx
nop dword [eax + eax]
mov byte [ebp + eax - 0x44], 0
inc eax
cmp eax, 0x3c
jb 0x406460
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], 1
nop dword [eax]
mov byte [eax + esi], 0
inc eax
cmp eax, 0x10
jb 0x406490
xor eax, eax
test ecx, ecx
je 0x4064ad
cmp word [ecx], ax
je 0x4064ad
inc eax
cmp word [ecx + eax*2], 0
jne 0x4064a5
lea edx, [ebp - 0x44]
push edx
push 0
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x4065fd
mov eax, dword [ebp - 0x30]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [eax*2 + 2]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x4065fc
push edi
mov edi, dword [ebp - 0x34]
test edi, edi
je 0x40651a
mov eax, dword [ebp - 0x30]
xor ecx, ecx
lea ebx, [eax + eax]
test ebx, ebx
je 0x40650e
mov al, byte [ecx + edi]
mov byte [ecx + edx], al
inc ecx
cmp ecx, ebx
jb 0x406500
mov eax, dword [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x406538
mov eax, dword [ebp - 0x18]
cmp word [eax], 0x2f
jne 0x406538
dec ecx
add eax, 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
test ecx, ecx
jne 0x406524
mov eax, dword [ebp - 0xc]
inc eax
add eax, ecx
add eax, eax
mov dword [ebp - 8], eax
add eax, 2
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 4], ecx
mov dword [esi + 4], ecx
test ecx, ecx
je 0x4065c7
mov eax, 0x2f
mov word [ecx], ax
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x40658e
mov eax, dword [ebp - 0x14]
lea ebx, [ecx + 2]
lea edi, [eax + eax]
test ebx, ebx
je 0x40658e
xor ecx, ecx
test edi, edi
je 0x40658b
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x406580
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x4065bb
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
inc ebx
lea ebx, [ecx + ebx*2]
lea edi, [eax + eax]
test ebx, ebx
je 0x4065bb
xor ecx, ecx
test edi, edi
je 0x4065bb
nop dword [eax]
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x4065b0
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp - 8]
mov word [ecx + eax], dx
mov eax, dword [ebp - 0x14]
inc eax
mov dword [esi + 8], eax
mov ax, word [ebp - 0x2c]
mov word [esi + 0xc], ax
mov eax, dword [ebp - 0x38]
pop edi
sub eax, 3
je 0x4065f8
sub eax, 1
je 0x4065ee
pop ebx
mov byte [esi + 0xe], 0
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
mov byte [esi + 0xe], 2
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xe], 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push edi
mov dword [ebp - 0x14], ecx
mov edi, 1
mov dword [ebp - 8], 0
mov dword [ebp - 4], reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 4]
xor esi, esi
push eax
push edi
push esi
push 0x401520
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407038
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push 0x401508
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x40701d
mov eax, dword [ebp - 0xc]
add eax, 2
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40701d
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
push 0x401508
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 0xc]
jmp 0x407020
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov ebx, esi
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x40704b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test edi, 0x100
jne 0x40707b
or edi, 0x100
jmp 0x406fae
mov eax, dword [ebp - 8]
mov esi, ebx
test eax, eax
je 0x40707b
test al, 1
jne 0x40707b
mov ecx, dword [ebp - 0x10]
cmp ecx, 1
je 0x407065
cmp ecx, 2
jne 0x40707b
shr eax, 1
mov esi, ebx
cmp word [ebx + eax*2 - 2], 0
je 0x40707b
xor ecx, ecx
mov word [ebx + eax*2], cx
xor eax, eax
jmp 0x407081
xor eax, eax
test esi, esi
je 0x40709e
cmp word [esi], 0
je 0x40709e
inc eax
cmp word [esi + eax*2], 0
jne 0x407087
cmp eax, 0x3c
jbe 0x40709e
xor eax, eax
xor edx, edx
mov word [esi + 0x78], ax
jmp 0x4070a4
xor edx, edx
test esi, esi
je 0x4070b8
cmp word [esi], 0
je 0x4070b8
nop word [eax + eax]
inc edx
cmp word [esi + edx*2], 0
jne 0x4070b0
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4070db
test esi, esi
je 0x4070db
lea edi, [edx + edx]
xor ecx, ecx
test edi, edi
je 0x4070db
nop dword [eax]
mov al, byte [esi + ecx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jb 0x4070d0
pop edi
xor eax, eax
mov word [ebx + edx*2], ax
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4070f0
Capabilities:
Get common file path
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
lea eax, [ebp - 0x208]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
push eax
push 0x401560
call esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x407137
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x401580
call esi
push 0x104
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x407153
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
lea eax, [ebp - 0x410]
push eax
push 0x4015a0
call esi
lea eax, [ebp - 0x410]
push eax
push 0x4015d0
lea eax, [ebp - 0xa18]
push 0x200
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 4
lea edx, [ebp - 0xa18]
call fcn.00406b30
add esp, 0xc
lea eax, [ebp - 0x410]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4073c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
xor esi, esi
mov al, byte [esi + 0x4090a4]
mov byte [ebp + esi - 0xd8], al
inc esi
cmp esi, 0x20
jb 0x4073d2
test edi, edi
je 0x407400
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + edi]
mov byte [ebp + ecx - 0xb8], al
inc ecx
cmp ecx, 0x10
jb 0x4073f0
xor ecx, ecx
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
xor esi, esi
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x68], 0x30
mov dword [ebp - 0x64], ecx
nop word [eax + eax]
mov al, byte [ebp + esi - 0xd8]
mov byte [ebp + ecx - 0x50], al
inc ecx
test cl, 0x3f
jne 0x407485
xor eax, eax
movzx edx, byte [ebp + eax - 0x4d]
movzx ecx, byte [ebp + eax - 0x4e]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebp + eax - 0x4f]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebp + eax - 0x50]
shl edx, 8
or edx, ecx
mov dword [ebp + eax - 0xa8], edx
add eax, 4
cmp eax, 0x40
jb 0x407443
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x60]
call fcn.00405460
xor ecx, ecx
inc esi
cmp esi, 0x30
jb 0x407430
mov ecx, dword [ebp - 0x68]
mov eax, 0x78
and ecx, 0x3f
mov esi, 0x38
sub eax, ecx
sub esi, ecx
cmp ecx, 0x38
mov edx, 0x409020
lea ecx, [ebp - 0x68]
cmovae esi, eax
push esi
call fcn.004053e0
mov edi, dword [ebp - 0x68]
add esp, 4
sub edi, esi
mov esi, dword [ebp - 0x64]
mov dword [ebp - 0x68], edi
sbb esi, 0
xor edx, edx
mov dword [ebp - 0x64], esi
nop dword [eax]
movzx ecx, byte [ebp + edx - 0x4d]
movzx eax, byte [ebp + edx - 0x4e]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + edx - 0x4f]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + edx - 0x50]
shl ecx, 8
or ecx, eax
mov dword [ebp + edx - 0xa8], ecx
add edx, 4
cmp edx, 0x38
jb 0x4074d0
lea eax, [edi*8]
shld esi, edi, 3
lea edx, [ebp - 0xa8]
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x6c], esi
call fcn.00405460
movzx eax, byte [ebp - 0x60]
mov ecx, dword [ebp - 0x60]
mov byte [ebp - 0x10], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xf], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 0x5c]
mov byte [ebp - 0xc], al
shr ecx, 0x18
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp - 0x5c]
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0x58]
shr ecx, 0x18
mov byte [ebp - 8], al
mov byte [ebp - 9], cl
mov ecx, dword [ebp - 0x58]
mov eax, ecx
shr eax, 8
mov byte [ebp - 7], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 6], al
movzx eax, byte [ebp - 0x54]
shr ecx, 0x18
mov byte [ebp - 4], al
mov byte [ebp - 5], cl
mov ecx, dword [ebp - 0x54]
mov eax, ecx
shr eax, 8
mov byte [ebp - 3], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp - 2], al
mov byte [ebp - 1], cl
test ebx, ebx
je 0x4075b4
xor ecx, ecx
mov al, byte [ebp + ecx - 0x10]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, 0x10
jb 0x4075a7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4084b0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query environment variable
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb00
lea eax, [ebp - 0x510]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
push eax
push 0x401d20
call esi
push 0x104
lea eax, [ebp - 0x308]
push eax
push 0x401d90
call esi
push 0x104
lea eax, [ebp - 0x718]
push eax
push 0x401bf0
call esi
xor eax, eax
nop dword [eax + eax]
mov byte [ebp + eax - 0x100], 0
inc eax
cmp eax, 0x100
jb 0x408500
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x308]
push eax
call esi
cmp eax, 0xffffffff
je 0x40852f
test al, 0x10
jne 0x40852f
push 0x401e00
jmp 0x408546
lea eax, [ebp - 0x510]
push eax
call esi
cmp eax, 0xffffffff
je 0x408553
test al, 0x10
jne 0x408553
push 0x401e10
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x100]
push eax
push 0x401e20
push 0x401e70
lea eax, [ebp - 0xb00]
push 0x1f4
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea eax, [ebp - 0xb00]
push 0
push 0
push eax
lea eax, [ebp - 0x718]
push eax
push 0x401c78
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408b90
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, 0x419
cmp ax, cx
je 0x408c3c
mov ecx, 0x42b
cmp ax, cx
je 0x408c3c
mov ecx, 0x82c
cmp ax, cx
je 0x408c3c
mov ecx, 0x42c
cmp ax, cx
je 0x408c3c
mov ecx, 0x423
cmp ax, cx
je 0x408c3c
mov ecx, 0x43f
cmp ax, cx
je 0x408c3c
mov ecx, 0x428
cmp ax, cx
je 0x408c3c
mov ecx, 0x442
cmp ax, cx
je 0x408c3c
mov ecx, 0x843
cmp ax, cx
je 0x408c3c
mov ecx, 0x443
cmp ax, cx
je 0x408c3c
mov ecx, 0x422
cmp ax, cx
je 0x408c3c
call fcn.004085a0
test al, al
jne 0x408c3c
call fcn.004082c0
call fcn.004070f0
call fcn.00408cf0
call fcn.004075d0
call fcn.004084b0
jmp fcn.00407cd0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x408cf0
Capabilities:
Encrypt data using curve25519
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
push eax
push 0x20
push dword [0x4094ec]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov al, byte [ebp - 0x29]
lea edx, [ebp - 0x48]
and byte [ebp - 0x48], 0xf8
lea ecx, [ebp - 0x28]
and al, 0x3f
or al, 0x40
push 0x401114
mov byte [ebp - 0x29], al
call fcn.00405310
add esp, 4
lea edx, [ebp - 0x48]
mov ecx, 0x4090a4
push section..data
call fcn.00405310
add esp, 4
mov edx, 0x20
mov ecx, 0x4090a4
push 0
call fcn.004025b0
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 4
test eax, eax
je 0x408d6e
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
push 0
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.004025b0
mov edi, eax
add esp, 4
test edi, edi
je 0x408de5
push edi
push 0x401b68
push 0x4090c4
push 0x65
lea eax, [ebp - 0x248]
push 0x4022b0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov dword [ebp - 4], 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x248]
push eax
push ecx
mov ecx, 0x409104
call fcn.00406610
add esp, 0x10
test eax, eax
je 0x408db1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408e03
test al, 0x10
jne 0x408e03
mov al, 1
ret
xor al, al
ret
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x402b18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x402b27
pop dword [ebp - 0x44]
mov eax, 0x402b27
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xe3a3d237
sub dword [ebp - 0x54], 0x95518cec
mov dword [ebp - 0x50], 0xfff14a1b
sub dword [ebp - 0x50], 0xcdbdfdd6
mov dword [ebp - 0x4c], 0xaec21454
add dword [ebp - 0x4c], 0x9d8a2fda
mov dword [ebp - 0x48], 0xb440be30
add dword [ebp - 0x48], 0x4bbf41d0
lea eax, [ebp - 0x54]
push eax
mov eax, 0xe18ca225
sub eax, 0xe14a71b1
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xb837e6ab
add dword [ebp - 0x54], 0xbc3a82ab
mov dword [ebp - 0x50], 0xcf59f65c
sub dword [ebp - 0x50], 0x8ded94e7
mov dword [ebp - 0x4c], 0xdf661f9c
add dword [ebp - 0x4c], 0x84094cd0
mov dword [ebp - 0x48], 0xad52bf90
sub dword [ebp - 0x48], 0xad52bf90
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x36dc8066
sub eax, 0x369a4f42
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3d694
push 0
call eax
mov ecx, 0x46ee6980
add ecx, 0xb911dd52
xor ebx, ebx
add ebx, eax
mov esi, 0xd967f8ec
sub esi, 0xd924b4ec
add esi, dword [ebp - 0x44]
mov edx, 0xdc48b15f
add edx, 0xfba92661
mov dword [ebp - 0xc], 0xfaaef6e6
mov edi, dword [esi]
sub edi, edx
xor dword [ebp - 0xc], 0xabb26d6
mov dword [ebx], edi
xor dword [ebp - 0x10], 0x4c602d06
add ebx, 4
add esi, 4
loop 0x402c46
add eax, 0x10e1b
mov ebx, eax
add eax, 0x76f58b46
add eax, 0x890a74bf
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x4ac1c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.0047d7f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4ac1f0
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x63be8c], 0
mov edi, dword [ebp + 8]
je 0x4ac23a
mov eax, dword [0x63bf8c]
test eax, eax
je 0x4ac213
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x4ac23a
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x480790
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.00576f9c
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4ac247
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x4ac260
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b8ac0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.004bd8a0
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x4b8afb
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.004bd8a0
add esp, 0x10
pop edi
pop ebx
pop ebp
ret

Function at 0x4bd9b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [ecx + 0x14], esi
jle 0x4bda4b
jmp 0x4bd9d4
mov eax, dword [ebp + 8]
mov edi, esi
xor edi, 1
cmp esi, 2
cmovge edi, esi
test eax, eax
je 0x4bda05
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov ebx, dword [ecx + edx*8]
sub ebx, dword [ebp + 8]
movzx edx, byte [eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x4bda2a
test edx, edx
jne 0x4bda3c
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x10]
add edi, edi
push 0
mov edx, ebx
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.00482640
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x4bdaaf
jmp 0x4bda42
movzx ecx, byte [ecx + 0x6182a0]
movzx edx, byte [edx + 0x6182a0]
sub edx, ecx
jne 0x4bda3f
inc eax
jmp 0x4bd9f0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
inc esi
cmp esi, dword [ecx + 0x14]
jl 0x4bd9d1
mov edx, str.sqlite_master
sub edx, ebx
movzx ecx, byte [ebx]
movzx eax, byte [edx + ebx]
cmp ecx, eax
jne 0x4bda77
test ecx, ecx
jne 0x4bda89
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 0x10]
test ebx, ebx
jne 0x4bda8c
neg eax
sbb eax, eax
jmp 0x4bda9c
movzx eax, byte [eax + 0x6182a0]
movzx ecx, byte [ecx + 0x6182a0]
sub ecx, eax
jne 0x4bdaad
inc ebx
jmp 0x4bda52
test eax, eax
je 0x4bdaad
mov edx, eax
mov ecx, ebx
call fcn.00481170
mov ecx, dword [ebp - 4]
test eax, eax
jne 0x4bdaad
mov ebx, str.sqlite_temp_master
mov dword [ebp - 8], ebx
jmp 0x4bd9c1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bdde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov dword [ebp - 8], edx
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [eax + 0x14], ebx
jle 0x4bde76
mov edx, dword [ebp + 8]
push esi
nop dword [eax]
mov eax, dword [eax + 0x10]
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
shl esi, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
test edx, edx
je 0x4bde35
mov esi, dword [esi]
mov eax, edx
sub esi, edx
movzx edx, byte [eax]
movzx ecx, byte [esi + eax]
cmp edx, ecx
jne 0x4bde61
test edx, edx
jne 0x4bde73
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea ecx, [eax + 0x18]
push 0
call fcn.00482640
add esp, 4
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x4bde58
mov eax, dword [ebp - 0xc]
inc edi
mov edx, dword [ebp + 8]
cmp edi, dword [eax + 0x14]
jl 0x4bde00
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ecx + 0x6182a0]
movzx edx, byte [edx + 0x6182a0]
sub edx, ecx
jne 0x4bde4c
inc eax
jmp 0x4bde23
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret