joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcfacc5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0xd17f06
call fcn.00cd4307
sub esp, 0xf4
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
xor eax, eax
push 0xee
push eax
mov word [ebp - 0x100], ax
lea eax, [ebp - 0xfe]
push eax
call fcn.00cd1c8d
mov esi, dword [0xd2a7f8]
mov ecx, dword [0xd2a828]
xor esi, 0x4ea78be4
or esi, 0x18ffef24
add esp, 0xc
inc esi
mov eax, 0x46b9cfc
cmove esi, eax
movzx eax, byte [ebp + 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x100]
xor edi, edi
movzx eax, ax
cdq
idiv dword [ebp + 0x10]
movzx edx, dx
movzx eax, ax
mov dword [ebp + 0xc], eax
lea eax, [edx + 0x57]
cmp edx, 9
ja 0xcfad48
lea eax, [edx + 0x30]
mov word [ebx], ax
add ebx, 2
test esi, esi
push 1
pop eax
cmove esi, eax
mov eax, dword [ebp + 0xc]
xor ecx, 0x44150754
or ecx, 0x216d6200
inc edi
test ax, ax
jne 0xcfad2d
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x10], edi
cmp edi, eax
mov dword [0xd2a7f8], esi
mov dword [0xd2a828], ecx
lea edi, [ebp - 0x100]
jge 0xcfadc4
sub eax, dword [ebp + 0x10]
push 0x30
mov ecx, eax
mov dword [ebp + 0x14], eax
pop eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp + 0x14]
xor ecx, ecx
lea ebx, [ebx + eax*2]
inc ecx
test esi, esi
cmove esi, ecx
dec eax
jne 0xcfadb0
mov dword [0xd2a7f8], esi
lea edi, [ebp - 0x100]
mov esi, dword [0xd2a800]
mov edx, dword [0xd2a804]
xor eax, eax
mov word [ebx], ax
sub ebx, 2
movzx ecx, word [ebx]
mov ax, word [edi]
mov word [ebx], ax
or edx, esi
mov word [edi], cx
sub ebx, 2
add edi, 2
or edx, esi
cmp edi, ebx
jb 0xcfadd8
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
lea eax, [ebp - 0x100]
push eax
mov dword [0xd2a804], edx
call fcn.00ce5800
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
xor eax, eax
inc eax
pop edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xcfae25
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0xd18530
call fcn.00cd4307
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x24]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 3
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 5
xor edi, edi
lea ecx, [esi + 0x4c]
mov dword [esi + 0x48], edi
call fcn.00cfb2c1
mov byte [ebp - 4], 6
lea ecx, [esi + 0x90]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 8
lea ecx, [esi + 0x9c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0xa8]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0xb4]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0xc0]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0xcc]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0xd8]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x14
lea ecx, [esi + 0xe4]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x16
lea ecx, [esi + 0xf0]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0x18
lea ecx, [esi + 0xfc]
call fcn.00ce58e3
mov byte [ebp - 4], 0x19
lea ecx, [esi + 0x114]
mov dword [ebp - 0x14], ecx
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
add ecx, 0xc
call fcn.00cfb2c1
mov byte [ebp - 4], 0x1b
mov eax, dword [0xd2a7f8]
push ebx
mov ecx, 0xe761d60
cmp eax, 0x2fb0f020
push ebx
cmove eax, ecx
push edi
mov dword [0xd2a7f8], eax
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
add esp, 0xc
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xd09d75
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0xd19ee4
call fcn.00cd4307
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00ce58b5
xor edi, edi
inc edi
mov dword [ebp - 4], edi
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 3
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 5
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 7
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 9
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x48]
mov dword [ebp - 0x14], ecx
call fcn.00ce58b5
mov byte [ebp - 4], 0xd
push edi
push 3
push 0
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
mov eax, dword [0xd2a870]
shl eax, 0x10
or eax, edi
add esp, 0xc
mov dword [0xd2a870], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0xd09fb0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xd1a0b9
call fcn.00cd4307
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 6
mov eax, dword [0xd2a840]
inc eax
mov ecx, 0x45dfd148
cmove eax, ecx
xor ebx, ebx
push ebx
push 3
push ebx
mov dword [0xd2a840], eax
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [esi + 0x48]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
call fcn.00ce5d79
mov byte [ebp - 4], 4
lea ecx, [esi + 0x3c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
call fcn.00ce5d79
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
call fcn.00ce5d79
mov byte [ebp - 4], 2
lea ecx, [esi + 0x24]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.00ce5d79
mov byte [ebp - 4], 1
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
call fcn.00ce5d79
mov byte [ebp - 4], bl
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], bl
call fcn.00ce5d79
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00ce5d79
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0xd0a082
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0xd1a202
call fcn.00cd4307
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xf
push 0xd200b0
xor ebx, ebx
push ebx
call fcn.00d13663
pop ecx
pop ecx
push ebx
push 3
push ebx
call dword [0xd1b0a4]
push eax
call fcn.00ce0b03
push ebx
push 0xd200f8
push ebx
call fcn.00d13663
mov eax, dword [0xd2a860]
mov edx, dword [str.EmptyClipboard]
shl eax, 0x10
or eax, 1
mov dword [0xd2a860], eax
add esp, 0x18
mov eax, edx
not eax
test al, 0xfa
push ebx
pop ecx
setne cl
lea eax, [edx + edx]
or eax, ecx
mov dword [str.EmptyClipboard], eax
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0xb8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xe
call fcn.00ce5d79
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0xac]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xd
call fcn.00ce5d79
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0xa0]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
call fcn.00ce5d79
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x94]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xb
call fcn.00ce5d79
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x88]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xa
call fcn.00ce5d79
mov byte [ebp - 4], 9
lea ecx, [esi + 0x7c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 9
call fcn.00ce5d79
mov byte [ebp - 4], 8
lea ecx, [esi + 0x70]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
call fcn.00ce5d79
mov byte [ebp - 4], 7
lea ecx, [esi + 0x64]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
call fcn.00ce5d79
mov byte [ebp - 4], 6
lea ecx, [esi + 0x58]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
call fcn.00ce5d79
mov byte [ebp - 4], 5
lea ecx, [esi + 0x4c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
call fcn.00ce5d79
mov byte [ebp - 4], 4
lea ecx, [esi + 0x40]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
call fcn.00ce5d79
mov byte [ebp - 4], 3
lea ecx, [esi + 0x34]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
call fcn.00ce5d79
mov byte [ebp - 4], 2
lea ecx, [esi + 0x28]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.00ce5d79
mov byte [ebp - 4], 1
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
call fcn.00ce5d79
mov byte [ebp - 4], bl
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], bl
call fcn.00ce5d79
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 4]
mov dword [ebp - 0x14], ecx
or dword [ebp - 4], 0xffffffff
call fcn.00ce5d79
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x404190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdf68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4ec070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4042cd
cmp byte [ebx + 0x3d], 0
je 0x4042cd
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x4041e9
xor al, al
jmp 0x4042cf
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40425e
sub eax, 1
je 0x404262
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x4042b5
xor bl, bl
jmp 0x4042b7
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x404297
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004b80f1
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x40425a
cmp byte [ebx + 0x3d], 0
je 0x4042b5
test esi, esi
jne 0x404220
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00403d40
jmp 0x404219
mov bl, 1
cmp ecx, 0x10
jb 0x4042c9
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.004045c0
mov al, bl
jmp 0x4042cf
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae965
mov esp, ebp
pop ebp
ret
Function at 0x404720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cde36
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ec070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004aedb6
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004ad5e0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cdf68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4ec070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x408584
cmp byte [ebx + 0x3e], 0
je 0x408584
mov eax, dword [ebx]
push 0xffff
call dword [eax + 0xc]
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
sete al
test al, al
je 0x4084a4
xor al, al
jmp 0x408586
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x408515
sub eax, 1
je 0x408519
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x40856c
xor bl, bl
jmp 0x40856e
mov byte [ebx + 0x3e], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x40854e
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004b80f1
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x408511
cmp byte [ebx + 0x3e], 0
je 0x40856c
test esi, esi
jne 0x4084d7
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00403d40
jmp 0x4084d4
mov bl, 1
cmp ecx, 0x10
jb 0x408580
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.004045c0
mov al, bl
jmp 0x408586
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ae965
mov esp, ebp
pop ebp
ret
Function at 0x4089e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cde36
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ec070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004aedb6
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004ad5e0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4149c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x4ed248], 0
je 0x414a17
mov eax, dword [0x4ef5d0]
test eax, eax
je 0x4149f0
push eax
call dword [0x4ed298]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.00411ae0
mov eax, dword [0x4ef5d0]
test eax, eax
je 0x414a12
push eax
call dword [0x4ed2a0]
mov esi, dword [ebp - 4]
jmp 0x414a21
mov esi, dword [ebp - 4]
jmp 0x414a24
push 0x14
call dword [0x4ed268]
mov esi, eax
add esp, 4
test esi, esi
jne 0x414a32
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x4ed24c], 0
mov ebx, dword [ebp + 8]
je 0x414a7c
mov eax, dword [0x4ed33c]
test eax, eax
je 0x414a55
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x414a7c
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x414990
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.004ba698
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x414a89
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x414aa2
call 0x61e345
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f9d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push esi
push edi
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x41fa0e
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0
movq qword [eax], xmm0
jmp 0x41fa92
movzx eax, word [ebx + 0x8c]
cdq
mov edi, eax
add edi, 0x28
mov ecx, edi
adc edx, 0
or ecx, edx
je 0x41fa42
push edx
push edi
call fcn.00411c10
mov esi, eax
add esp, 8
test esi, esi
je 0x41fa44
push edi
push 0
push esi
call fcn.004b1740
add esp, 0xc
jmp 0x41fa44
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test esi, esi
jne 0x41fa82
push dword [ebp + 8]
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 0x98]
dec ecx
mov esi, dword [ebx + 0x3c]
push 0
cdq
push ecx
mov edi, dword [esi]
push edx
push eax
call fcn.004af380
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x28]
mov dword [esi + 0x1c], 0x10020
mov dword [esi + 8], eax
mov dword [esi + 0x14], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
pop edi
mov dword [esi + 0x18], ecx
inc dword [ebx + 0x78]
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4538a0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push edi
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.004599a0
add esp, 0x14
cmp dword [ebp + 8], 0
jne 0x4538d1
push edi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.004599a0
add esp, 0xc
pop edi
pop ebx
pop ebp
ret

Function at 0x459f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 8], eax
push ebx
xor ebx, ebx
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x459fe4
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, ebx
mov edi, ebx
xor eax, 1
cmp ebx, 2
cmovl edi, eax
mov eax, dword [ebp - 8]
mov ecx, edi
add ecx, ecx
mov eax, dword [eax + 0x10]
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 0xc], edx
test esi, esi
je 0x459f5f
mov edx, dword [eax + ecx*8]
sub esi, edx
nop dword [eax + eax]
movzx ecx, byte [edx]
movzx eax, byte [esi + edx]
cmp ecx, eax
jne 0x459f7e
test ecx, ecx
jne 0x459f90
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push 0
lea ecx, [ecx + 0x18]
call fcn.00416df0
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x459fdb
jmp 0x459fcb
movzx eax, byte [eax + 0x4dd0c0]
movzx ecx, byte [ecx + 0x4dd0c0]
sub ecx, eax
jne 0x459f93
inc edx
jmp 0x459f50
test edi, edi
jne 0x459fc8
mov esi, dword [ebp + 8]
mov eax, str.main
sub esi, eax
movzx edx, byte [eax]
movzx ecx, byte [esi + eax]
cmp edx, ecx
jne 0x459fb3
test edx, edx
je 0x459f5f
inc eax
jmp 0x459fa1
movzx ecx, byte [ecx + 0x4dd0c0]
movzx edx, byte [edx + 0x4dd0c0]
sub edx, ecx
jne 0x459fc8
inc eax
jmp 0x459fa1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc ebx
mov esi, dword [ebp + 8]
cmp ebx, dword [eax + 0x14]
jl 0x459f24
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ab790
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push 0
mov edi, edx
mov esi, ecx
push 0
push str.sqlite_stat1
xorps xmm0, xmm0
push dword [edi + 0x20]
movlpd qword [ebp - 0x10], xmm0
push esi
call fcn.004a53c0
add esp, 0x24
test eax, eax
je 0x4ab7e3
xor ecx, ecx
mov dword [edi + 0x30], 0x100000
cmp eax, 1
mov dword [edi + 0x34], 0
cmove eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0x24]
push dword [edi + 0x20]
push str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
call fcn.004145d0
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
jne 0x4ab80b
mov esi, 7
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 4]
mov edx, eax
push ecx
push 0
push pe_nt_image_headers32
push 0xffffffffffffffff
mov ecx, esi
call fcn.004745e0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x4ab865
mov esi, dword [ebp - 4]
push esi
call fcn.0043a700
add esp, 4
cmp eax, 0x64
jne 0x4ab84c
push 0
push esi
call fcn.0043af90
add esp, 8
mov ebx, eax
jmp 0x4ab852
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
push esi
mov dword [ebp - 4], edx
call fcn.004395b0
mov ecx, dword [ebp - 4]
add esp, 4
mov esi, eax
jmp 0x4ab890
cmp esi, 7
je 0x4ab88a
push dword [ebp - 8]
xor esi, esi
mov dword [edi + 0x30], 0x100000
mov dword [edi + 0x34], esi
call fcn.00411d50
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
test esi, esi
jne 0x4ab8d0
mov eax, ebx
or eax, ecx
jne 0x4ab8b8
push dword [ebp - 8]
mov dword [edi + 0x30], 0x100000
mov dword [edi + 0x34], eax
call fcn.00411d50
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jl 0x4ab8c3
jg 0x4ab8ca
cmp ebx, 0x64
ja 0x4ab8ca
mov ebx, 0x64
xor ecx, ecx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ecx
push dword [ebp - 8]
call fcn.00411d50
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret