joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428902
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x428915
xor eax, eax
jmp 0x4289b8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x428954
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x4289b6
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.004288b2
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4289b4
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4289b8
jmp 0x42894b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42bc0d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042b88a

Function at 0x686422
Capabilities:
Check for trap flag exception

Disassembly:
clc
mov byte [esp], ah
rol dl, 3
push dword [esp]
bt sp, bp
stc
xor dl, 0xdb
stc
clc
push word [esp + 8]
popf
call fcn.007bd925
push edi
pushfd
bts esi, 8
mov dword [esp], ebx
xor edi, 0x9f5aa022
btr di, sp
mov esi, dword [esp + 0x14]
pushal
mov edi, dword [esp + 0x38]
rcr dl, cl
xadd dl, al
call fcn.006b7a08
mov byte es:[0xbc069e06], al
mov ch, 0x4f
jno 0x68649c
nop
ret
pop es
rol byte [0x921cca74], 0x4d
sti
in al, 0x43
mov ebp, 0x7311d730
dec edi
sub al, 0xc
outsb dx, byte [esi]
cmp dword [esp + eax - 0x41], esi
wait
and bh, byte [eax + 0x6fb4c1f7]
mov edi, 0xfa5cb806
salc
push ss
pop ebx
mov bh, 0x4c
mov cl, 0xbe
xor dword [ebp + edi - 0x1cb6ca1b], esi
mov ah, 0xa9
sub dword [ebp + 0x5a5f453e], esp
sbb al, byte [ecx]
jle 0x68654b
push edi
in eax, 0xe1
ret 0xde93
aad 0xb4
invalid

Function at 0x6ade20
Capabilities:
Encode data using xor

Disassembly:
stc
push dword [edi]
pop dword [esp + 0x28]
stc
cmc
test cx, dx
cmp edi, ebx
push dword [esp + 0xc]
jmp 0x7bd62c
push dword [esp + 4]
pushfd
lea esp, [esp + 0x34]
ja 0x6b2bd4
push edx
push ebx
neg al
sub ebx, edi
lea edi, [edx*4 - 0x37f097b2]
add esp, 8
add ebx, esp
mov di, 0x8983
add di, ax
adc di, 0x6473
mov edi, ebx
shr al, 3
mov al, 0x2e
bt bx, 0xb
cmc
call fcn.006b72ec
pop es
xor esi, dword [ebx + ebx*2 + 0x4a]
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
adc al, 0x44
invalid
Function at 0x8ddee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x64e00d
lea edi, [esi - 0x24d00d]
push edi
or ebp, 0xffffffff
jmp 0x8ddf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8ddf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8ddef8
mov eax, 1
add ebx, ebx
jne 0x8ddf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8ddf10
jne 0x8ddf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8ddf10
xor ecx, ecx
sub eax, 3
jb 0x8ddf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8ddfb2
mov ebp, eax
add ebx, ebx
jne 0x8ddf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x8ddf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x8ddf7c
inc ecx
add ebx, ebx
jne 0x8ddf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8ddf5d
jne 0x8ddf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8ddf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8ddf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8ddf8d
jmp 0x8ddefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8ddf9c
add edi, ecx
jmp 0x8ddefe
pop esi
mov edi, esi
mov ecx, 0x1740
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8ddfba
cmp byte [edi], 0x11
jne 0x8ddfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8ddfbf
lea edi, [esi + 0x4d9000]
mov eax, dword [edi]
or eax, eax
je 0x8de02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4e60d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4e612c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8ddfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4e6134]
or eax, eax
je 0x8de028
mov dword [ebx], eax
add ebx, 4
jmp 0x8de009
call dword [esi + 0x4e6130]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x8de05f
cmp al, 0xef
ja 0x8de052
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x8de034
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x8de041
mov ebp, dword [esi + 0x4e6138]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8de093
sub esp, 0xffffff80
jmp 0x406c9c
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
mov ecx, 0x4b5a524b
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1bed4bc6
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x100f0b0c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101bd540]
jne 0x100f0b16
repz ret
jmp fcn.100f0dbd

Function at 0x100f1fc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.100f1fc0]
mov dword [0x101bd514], 0x83f
mov dword [ebp - 4], eax
mov dword [0x101bd514], 0x19e4
jmp 0x100f2015
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 4]
cmp dword [edx + ecx], 0x4550
je 0x100f2024
jmp 0x100f202c
mov al, 1
test al, 1
jne 0x100f2015
jmp 0x100f204a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100f1fe5
jmp 0x100f202e
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x100f2007
jmp 0x100f202e
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov dword [0x101bd518], 0x773
jmp 0x100f1fff
mov dword [0x101bd514], 0x24f
mov dword [ebp - 8], 0
jmp 0x100f2007
Function at 0x100f2060
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x101bd518], 0x3cb
mov dword [ebp - 8], 0
mov dword [0x101bd518], 0x4f5
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x101bd514], 0x650
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x100f20ea
mov dword [0x101bd518], 0xab6
jmp 0x100f2106
jmp 0x100f21c6
jmp 0x100f21cf
mov eax, dword [0x101bd518]
sub eax, 0x21b9
mov dword [0x101bd518], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
je 0x100f2113
jmp 0x100f21d1
jmp 0x100f20c2
cmp dword [ebp - 0x10], 0x104
jge 0x100f20c2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x100f20e8
jmp 0x100f20ac
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100f20ea
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
jne 0x100f21cf
mov eax, dword [0x101bd518]
add eax, 0x20dc
mov dword [0x101bd514], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x100f20bd
mov dword [0x101bd514], 0xe50
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x100f21ca
mov eax, dword [0x101bd514]
add eax, 0x5c9
mov dword [0x101bd514], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x100f21c8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
jne 0x100f21c6
mov dword [0x101bd518], 0x7a0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x100f20b8
mov dword [ebp - 4], 1
jmp 0x100f21e2
jmp 0x100f21c8
jmp 0x100f21ca
jmp 0x100f20bd
jmp 0x100f21d1
mov dword [0x101bd518], 0x1280
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret
Function at 0x44e5d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404914
mov edi, dword [ebp + 8]
add edi, 0xffffff00
xor eax, eax
push ebp
push 0x44e6ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x5a
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00404724
test eax, eax
jle 0x44e6bc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
add eax, 0xa6
xor edx, edx
push edx
push eax
lea eax, [ebx + 1]
cdq
call fcn.00405230
mov ebx, eax
mov eax, dword [ebp - 0x18]
add eax, 0xa6
xor edx, edx
push edx
push eax
xor eax, eax
mov al, byte [edi + ebx]
add eax, esi
cdq
call fcn.00405230
mov esi, eax
mov al, byte [edi + ebx]
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
mov byte [edi + esi], al
xor eax, eax
mov al, byte [edi + ebx]
xor edx, edx
mov dl, byte [edi + esi]
add eax, edx
mov edx, dword [ebp - 0x18]
add edx, 0xa6
mov ecx, edx
xor edx, edx
div ecx
mov al, byte [edi + edx]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dl, byte [edx + ecx - 1]
mov cl, byte [ebp - 0xd]
xor dl, cl
call fcn.0040464c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
call fcn.0040472c
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x44e62f
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004044b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e6f4
lea eax, [ebp - 0x20]
call fcn.00404464
lea eax, [ebp - 0x14]
call fcn.00404464
lea eax, [ebp - 4]
call fcn.00404464
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x7c711f2
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
mov ecx, 0x90d2ef7
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x6090750c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor ebx, ebx
test edx, edx
jle 0x60907535
mov eax, ebx
shl eax, 3
xor ebx, eax
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x6090105c]
xor ebx, eax
inc ecx
dec edx
test edx, edx
jg 0x6090751c
mov eax, ebx
pop ebx
leave
ret

Function at 0x60908298
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
and eax, 0x7fffffff
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push edx
push dword [esi + 4]
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
jne 0x609082e0
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x609082e0
mov dword [esi + 0xc], eax
mov eax, 0xd
jmp 0x6090832e
add esp, 0xfffffff4
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edi
push dword [esi + 4]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
jne 0x6090830c
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0xc], eax
mov eax, 0x10a
jmp 0x6090832e
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x6090832c
add esp, 0xfffffffc
sub ebx, eax
push ebx
push 0
add eax, edi
push eax
call sym._memset
mov eax, 0x20a
jmp 0x6090832e
xor eax, eax
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x60908338
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
and eax, 0x7fffffff
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 4]
push eax
push edx
mov edx, dword [ebp + 8]
push dword [edx + 4]
call sub.KERNEL32.dll_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x60908384
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x60908384
jmp 0x609083bc
sub esi, eax
add edi, eax
test esi, esi
jle 0x609083ae
add esp, 0xfffffff4
push 0
lea eax, [ebp - 8]
push eax
push esi
push edi
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x609083b7
mov eax, dword [ebp - 8]
test eax, eax
jne 0x60908380
test ebx, ebx
je 0x609083b7
cmp esi, dword [ebp - 8]
jle 0x609083cc
call sub.KERNEL32.dll_GetLastError
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov eax, 0xd
jmp 0x609083ce
xor eax, eax
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x6090846c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push ebx
mov esi, dword [ebp + 8]
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
jne 0x609084a4
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x609084a4
mov dword [esi + 0xc], eax
mov eax, 0x70a
jmp 0x609084bd
mov eax, dword [ebp - 4]
xor edx, edx
mov edx, eax
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
add dword [ecx], ebx
adc dword [ecx + 4], 0
xor eax, eax
lea esp, [ebp - 0x28]
pop ebx
pop esi
leave
ret

Function at 0x60908960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push edi
push esi
push ebx
mov esi, dword [ebp + 0xc]
mov eax, dword [0x60962a54]
test eax, eax
je 0x60908994
push eax
push 0x60908952
lea eax, [ebp - 0x110]
push eax
push 0xe6
call sym.sqlite3.dll_sqlite3_snprintf
add esp, 0x10
jmp 0x60908a0f
call sym._isNT
test eax, eax
je 0x609089bc
add esp, 0xfffffff8
lea ebx, [ebp - 0x320]
push ebx
push 0xe6
call sub.KERNEL32.dll_GetTempPathW
add esp, 0xfffffffc
push ebx
call sym._unicodeToUtf8
jmp 0x609089d9
add esp, 0xfffffff8
lea ebx, [ebp - 0x430]
push ebx
push 0xe6
call sub.KERNEL32.dll_GetTempPathA
add esp, 0xfffffffc
push ebx
call sym.sqlite3.dll_sqlite3_win32_mbcs_to_utf8
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x609089ec
mov eax, 7
jmp 0x60908aa2
push ebx
push 0x60908952
lea eax, [ebp - 0x110]
push eax
push 0xe6
call sym.sqlite3.dll_sqlite3_snprintf
add esp, 0xfffffff4
push ebx
call sym._free
add esp, 0x20
add esp, 0xfffffff4
lea ebx, [ebp - 0x110]
push ebx
call sym._sqlite3Strlen30
mov edi, eax
add esp, 0x10
test edi, edi
je 0x60908a34
cmp byte [ebx + edi - 1], 0x5c
jne 0x60908a34
dec edi
jne 0x60908a27
lea esi, [esi]
lea eax, [ebp - 0x110]
mov byte [edi + eax], 0
push eax
push 0x60908955
push esi
mov eax, dword [ebp + 8]
add eax, 0xffffffe2
push eax
call sym.sqlite3.dll_sqlite3_snprintf
add esp, 0xfffffff4
push esi
call sym._sqlite3Strlen30
mov ebx, eax
add esp, 0x20
add esp, 0xfffffff8
lea eax, [ebx + esi]
push eax
push 0x14
call sym.sqlite3.dll_sqlite3_randomness
xor edi, edi
nop
movzx ax, byte [ebx + esi]
mov word [ebp - 0x442], ax
mov ecx, 0x3e
xor dx, dx
div cx
mov al, dl
movzx eax, al
mov al, byte [eax + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ebx + esi], al
inc edi
inc ebx
cmp edi, 0x13
jbe 0x60908a70
mov byte [ebx + esi], 0
xor eax, eax
lea esp, [ebp - 0x468]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x60908d80
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
xor edi, edi
mov dword [ebp - 4], 0
add esp, 0xfffffff4
push dword [ebp + 0xc]
call sym._convertUtf8Filename
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x60908db0
mov eax, 7
jmp 0x60908e62
call sym._isNT
test eax, eax
je 0x60908e00
lea esi, [esi]
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_DeleteFileW
add esp, 0xc
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_GetFileAttributesW
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x60908de8
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
cmp eax, 5
jne 0x60908e44
inc edi
cmp edi, 4
jg 0x60908e44
add esp, 0xfffffff4
push 0x64
call sub.KERNEL32.dll_Sleep
add esp, 0xc
jmp 0x60908dbc
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
add esp, 0xfffffff4
push esi
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x60908e2c
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
cmp eax, 5
jne 0x60908e44
inc edi
cmp edi, 4
jg 0x60908e44
add esp, 0xfffffff4
push 0x64
call sub.KERNEL32.dll_Sleep
add esp, 0xc
jmp 0x60908e00
add esp, 0xfffffff4
push esi
call sym._free
cmp ebx, 0xffffffff
jne 0x60908e58
cmp dword [ebp - 4], 2
je 0x60908e60
mov eax, 0xa0a
jmp 0x60908e62
xor eax, eax
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x60908e6c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], 0
add esp, 0xfffffff4
push dword [ebp + 0xc]
call sym._convertUtf8Filename
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x60908e9c
mov eax, 7
jmp 0x60908efc
call sym._isNT
test eax, eax
je 0x60908eb0
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_GetFileAttributesW
jmp 0x60908eb9
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
mov esi, eax
add esp, 0xc
add esp, 0xfffffff4
push ebx
call sym._free
cmp edi, 1
je 0x60908ee8
jg 0x60908ed4
test edi, edi
je 0x60908ed9
jmp 0x60908ef2
cmp edi, 2
jne 0x60908ef2
cmp esi, 0xffffffff
setne al
movzx eax, al
mov dword [ebp - 4], eax
jmp 0x60908ef2
xor esi, 1
mov dword [ebp - 4], esi
and dword [ebp - 4], 1
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x60909000
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push esi
push ebx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x118], 0x200
xor esi, esi
lea ebx, [ebp - 0x110]
push ebx
push 0x104
push eax
push edx
call sym._winFullPathname
add esp, 0x10
test eax, eax
jne 0x609090ff
add esp, 0xfffffff4
push ebx
call sym._convertUtf8Filename
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x609090f1
call sym._isNT
test eax, eax
je 0x609090a8
mov edx, ebx
movzx eax, word [ebx]
test ax, ax
je 0x6090908a
cmp ax, 0x5c
jne 0x60909074
mov word [ebx], 0
jmp 0x6090908a
add edx, 2
movzx eax, word [edx]
test ax, ax
je 0x6090908a
cmp ax, 0x5c
jne 0x60909074
mov word [edx], 0
add esp, 0xfffffff4
lea edx, [ebp - 0x114]
push edx
push edx
lea eax, [ebp - 0x118]
push eax
push edx
push ebx
call sub.KERNEL32.dll_GetDiskFreeSpaceW
jmp 0x609090e3
mov edx, ebx
mov al, byte [ebx]
test al, al
je 0x609090ca
cmp al, 0x5c
jne 0x609090bc
mov byte [ebx], 0
jmp 0x609090ca
inc edx
mov al, byte [edx]
test al, al
je 0x609090ca
cmp al, 0x5c
jne 0x609090bc
mov byte [edx], 0
add esp, 0xfffffff4
lea edx, [ebp - 0x114]
push edx
push edx
lea eax, [ebp - 0x118]
push eax
push edx
push ebx
call sub.KERNEL32.dll_GetDiskFreeSpaceA
mov esi, eax
add esp, 0xc
add esp, 0xfffffff4
push ebx
call sym._free
test esi, esi
jne 0x609090ff
mov dword [ebp - 0x118], 0x200
mov eax, dword [ebp - 0x118]
lea esp, [ebp - 0x138]
pop ebx
pop esi
leave
ret
Function at 0x6094a470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x79b5b], al
inc dword [eax]
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], pe_nt_image_headers32
mov byte [ebp - 0x795], 0x81
mov byte [ebp - 0x794], 0x9d
Function at 0x6095457c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x60954530
lea ebx, [ebp - 8]
mov dword [ebx + 4], 0x6095455e
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
add esp, 0xfffffff4
push dword [esi + 8]
call sym.sqlite3.dll_sqlite3_finalize
add esp, 0xfffffff4
push dword [esi + 0x1c]
call sym.sqlite3.dll_sqlite3_free
add esp, 0x20
add esp, 0xfffffff4
push dword [esi + 0xc]
call sym._sqlite3Fts3ExprFree
lea edi, [esi + 4]
xor eax, eax
cld
mov ecx, 0xb
rep stosd dword es:[edi], eax
add esp, 0xfffffffc
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
push dword [eax + 0x10]
cmp dword [ebp + 0xc], 0
sete al
movzx eax, al
push dword [ebx + eax*4]
call sym.sqlite3.dll_sqlite3_mprintf
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x60954608
mov ebx, 7
jmp 0x60954710
add esp, 0xfffffff4
push 0
lea eax, [esi + 8]
push eax
push 0xffffffffffffffff
push edi
mov ecx, dword [ebp - 0xc]
push dword [ecx + 0xc]
call sym.sqlite3.dll_sqlite3_prepare_v2
mov ebx, eax
add esp, 0x20
add esp, 0xfffffff4
push edi
call sym.sqlite3.dll_sqlite3_free
add esp, 0x10
test ebx, ebx
jne 0x60954710
mov eax, dword [ebp + 0xc]
mov word [esi + 4], ax
cmp dword [ebp + 0xc], 1
jne 0x60954664
add esp, 0xfffffffc
mov ecx, dword [ebp + 0x18]
push dword [ecx]
push 1
push dword [esi + 8]
call sym.sqlite3.dll_sqlite3_bind_value
mov ebx, eax
add esp, 0x10
jmp 0x609546ff
cmp dword [ebp + 0xc], 0
je 0x609546ff
mov edi, dword [ebp + 0xc]
add edi, 0xfffffffe
add esp, 0xfffffff4
mov eax, dword [ebp + 0x18]
push dword [eax]
call sym.sqlite3.dll_sqlite3_value_text
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x609546a8
add esp, 0xfffffff4
mov ecx, dword [ebp + 0x18]
push dword [ecx]
call sym.sqlite3.dll_sqlite3_value_type
add esp, 0x10
cmp eax, 5
je 0x609546a8
mov eax, 7
jmp 0x60954712
add esp, 0xfffffffc
lea eax, [esi + 0xc]
push eax
push 0xffffffffffffffff
push ebx
push edi
mov eax, dword [ebp - 0xc]
push dword [eax + 0x18]
push dword [eax + 0x1c]
push dword [eax + 0x20]
call sym._sqlite3Fts3ExprParse
mov ebx, eax
add esp, 0x20
test ebx, ebx
jne 0x60954712
add esp, 0xfffffff4
push 0
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x1c]
push eax
push dword [esi + 0xc]
mov ecx, dword [ebp - 0xc]
push ecx
call sym._evalFts3Expr
mov ebx, eax
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
add esp, 0x20
test ebx, ebx
jne 0x60954710
add esp, 0xfffffff4
push esi
call sym._fts3NextMethod
jmp 0x60954712
mov eax, ebx
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret