joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bbcd6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, eax
sub esp, 0x3c
mov dword [esp + 4], 0x507267
mov dword [esp], edx
call sub.msvcrt.dll_fopen
test eax, eax
je 0x4bbe0d
mov ebx, eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [esp], ebx
mov dword [ebp - 0x20], eax
mov esi, eax
sar eax, 0x1f
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll_rewind
mov dword [esp], edi
call fcn.00403bd4
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004060d3
mov ecx, eax
sar ecx, 0x1f
cmp dword [ebp - 0x1c], ecx
jl 0x4bbd73
jg 0x4bbd5e
cmp esi, eax
jbe 0x4bbd73
mov dword [esp + 4], 0x12
mov dword [esp], edi
call fcn.00421b55
jmp 0x4bbe05
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, 1
or ecx, esi
je 0x4bbd84
mov eax, esi
cdq
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00436e2c
test eax, eax
jne 0x4bbd9e
mov dword [esp], edi
call fcn.004212e3
jmp 0x4bbe05
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x24], eax
call sub.msvcrt.dll_fread
cmp dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x24]
jne 0x4bbde7
cmp esi, eax
jne 0x4bbde7
mov dword [esp + 8], esi
sar esi, 0x1f
mov dword [esp + 0x10], fcn.0040b268
mov dword [esp + 0xc], esi
mov dword [esp + 4], edx
mov dword [esp], edi
call fcn.00421ddf
jmp 0x4bbe05
mov dword [esp + 4], 0xa
mov dword [esp], edi
mov dword [ebp - 0x20], edx
call fcn.00421b55
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
call fcn.0040b268
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4bd836
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edi, eax
sub esp, 0x2c
mov dword [ebp - 0x1c], edx
mov dword [esp + 4], 0x507267
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
je 0x4bd94c
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp], eax
call sub.msvcrt.dll_fseek
test eax, eax
je 0x4bd898
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edi
mov dword [esp + 4], str.Error:__s_not_seekable_n
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4bd8d8
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_rewind
lea eax, [esi + 1]
mov dword [esp], eax
sar eax, 0x1f
mov dword [esp + 4], eax
call fcn.00436e2c
test eax, eax
jne 0x4bd8e2
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], str.Error:_out_of_memory_n
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x4bd94c
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [ebp - 0x24], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebx
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_fclose
cmp dword [ebp - 0x20], 1
mov edx, dword [ebp - 0x24]
je 0x4bd937
mov dword [esp], edx
call fcn.0040b268
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edi
mov dword [esp + 4], str.Error:_cannot_read__s_n
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4bd94c
cmp dword [ebp - 0x1c], 0
mov byte [edx + esi], 0
mov eax, edx
je 0x4bd94e
mov eax, dword [ebp - 0x1c]
mov dword [eax], esi
mov eax, edx
jmp 0x4bd94e
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4c0a5d
Capabilities:
Write file on windows

Disassembly:
test ecx, ecx
jle 0x4c0acc
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
mov esi, ecx
mov edi, edx
sub esp, 0x1c
mov dword [esp + 8], 0
mov eax, dword [eax + 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebx + 0x30]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp esi, eax
je 0x4c0abf
mov dword [esp], str.error_in_fwrite__
call fcn.004440e8
mov dword [ebx + 8], eax
mov eax, 1
jmp 0x4c0acf
mov eax, esi
cdq
add dword [ebx + 0x38], esi
adc dword [ebx + 0x3c], edx
xor eax, eax
jmp 0x4c0acf
xor eax, eax
ret
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4c0a61
Capabilities:
Write file on windows

Disassembly:
test ecx, ecx
jle 0x4c0acc
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
mov esi, ecx
mov edi, edx
sub esp, 0x1c
mov dword [esp + 8], 0
mov eax, dword [eax + 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov eax, dword [ebx + 0x30]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp esi, eax
je 0x4c0abf
mov dword [esp], str.error_in_fwrite__
call fcn.004440e8
mov dword [ebx + 8], eax
mov eax, 1
jmp 0x4c0acf
mov eax, esi
cdq
add dword [ebx + 0x38], esi
adc dword [ebx + 0x3c], edx
xor eax, eax
jmp 0x4c0acf
xor eax, eax
ret
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4c0ad7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, eax
mov ebx, ecx
mov edi, edx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fread
cmp ebx, eax
je 0x4c0b31
mov dword [esp], str.error_in_fread__
call fcn.004440e8
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, 1
jmp 0x4c0b33
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4c28f1
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
cmp dword [0x51a3a0], 0
jne 0x4c2914
mov dword [esp], str.HOME
call sub.msvcrt.dll_getenv
mov dword [0x51a3a0], eax
mov esi, dword [0x51a3a0]
test esi, esi
jne 0x4c2995
mov dword [esp], str.HOMEDRIVE
call sub.msvcrt.dll_getenv
mov dword [esp], str.HOMEPATH
mov ebx, eax
call sub.msvcrt.dll_getenv
test ebx, ebx
mov edi, eax
je 0x4c298b
test eax, eax
je 0x4c298b
mov eax, ebx
call fcn.004b442b
mov ecx, eax
mov eax, edi
call fcn.004b442b
lea edx, [ecx + eax + 1]
mov dword [esp], edx
mov dword [ebp - 0x1c], edx
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [0x51a3a0], eax
je 0x4c29c9
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x5088ed
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0042a3d9
jmp 0x4c29c3
mov dword [0x51a3a0], 0x5088f2
mov esi, dword [0x51a3a0]
test esi, esi
je 0x4c29c3
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
mov ebx, ecx
not ebx
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
test eax, eax
je 0x4c29be
mov edi, eax
mov ecx, ebx
rep movsb byte es:[edi], byte [esi]
mov dword [0x51a3a0], eax
mov esi, dword [0x51a3a0]
add esp, 0x3c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4ca025
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x1c
cmp byte [eax + 0x118], 0x7c
mov eax, dword [eax + 0x38]
jne 0x4ca04a
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__pclose]
jmp 0x4ca0f1
call fcn.004bba57
cmp byte [ebx + 0xa], 0
je 0x4ca0f1
mov eax, dword [ebx + 0x84]
mov dword [esp + 4], str.start
mov dword [esp], 0x50983c
mov dword [esp + 8], eax
call fcn.004440e8
mov dword [esp], eax
mov esi, eax
call sub.msvcrt.dll_system
test eax, eax
je 0x4ca0a3
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Failed:___s__n
add eax, 0x40
mov dword [esp], eax
call fcn.004c5d3a
jmp 0x4ca0af
mov dword [esp], 0x7d0
call fcn.00435c07
mov dword [esp], esi
lea esi, [ebx + 0xce]
call fcn.0040b268
mov eax, dword [ebx + 0x48]
mov ecx, 5
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x70]
mov dword [ebx + 0x6c], eax
lea eax, [ebx + 0xa6]
mov edi, eax
lea eax, [ebx + 0xba]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0xe2]
mov ecx, 5
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx + 0xa], 0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov byte [ebx + 0x118], 0
add eax, 0x20
mov dword [ebx + 0x38], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4cf901
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov edi, dword [ebp + 8]
mov dword [esp + 4], 0x507267
mov dword [esp], edi
call sub.msvcrt.dll_fopen
test eax, eax
jne 0x4cf951
cmp dword [ebp + 0xc], 0
je 0x4cf999
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], str._.zip
call fcn.0040ae9f
test eax, eax
mov edx, 3
je 0x4cfa93
jmp 0x4cf999
lea esi, [ebp - 0x7c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_fread
dec eax
jne 0x4cf9a3
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x50ba26
mov dword [esp], esi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4cf9a3
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov edx, 1
jmp 0x4cfa93
mov dword [esp + 8], 2
mov dword [esp + 4], 0xffffffe7
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x19
mov dword [esp], esi
call sub.msvcrt.dll_fread
dec eax
jne 0x4cf9ff
mov dword [esp + 8], 0x11
mov dword [esp + 4], str.Start_Of_SQLite3_
mov dword [esp], esi
call sub.msvcrt.dll_memcmp
test eax, eax
mov edx, 2
je 0x4cfa7f
mov dword [esp + 8], 2
mov dword [esp + 4], 0xffffffea
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x16
mov dword [esp], esi
call sub.msvcrt.dll_fread
cmp eax, 1
jne 0x4cfa50
cmp byte [ebp - 0x7c], 0x50
jne 0x4cfa50
cmp byte [ebp - 0x7b], 0x4b
jne 0x4cfa50
cmp byte [ebp - 0x7a], 5
jne 0x4cfa50
cmp byte [ebp - 0x79], 6
je 0x4cfa7a
test eax, eax
jne 0x4cfa5a
cmp dword [ebp + 0xc], 0
jne 0x4cfa5e
xor edx, edx
jmp 0x4cfa7f
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], str._.zip
call fcn.0040ae9f
test eax, eax
jne 0x4cfa5a
mov edx, 3
mov dword [esp], ebx
mov dword [ebp - 0x8c], edx
call sub.msvcrt.dll_fclose
mov edx, dword [ebp - 0x8c]
add esp, 0x9c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4d05df
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [eax + 8], 0
mov dword [ebp - 0x20], 0
je 0x4d0723
cmp byte [eax + 5], 0
mov edi, eax
mov ecx, str.SELECT_name_FROM__s_WHERE_name_name
mov eax, str.SELECT_name_FROM__s_WHERE_glob__name_name_
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
cmove eax, ecx
mov ecx, dword [edi + 0xc]
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1c]
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x20]
mov dword [esp], eax
call fcn.004d0465
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str._name
mov dword [esp], eax
call fcn.004160f2
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
cmp ebx, dword [edi + 8]
jge 0x4d0711
cmp dword [ebp - 0x20], 0
jne 0x4d0711
mov eax, dword [edi + 0x18]
mov esi, dword [eax + ebx*4]
mov eax, esi
call fcn.004b442b
test eax, eax
jg 0x4d06fa
mov byte [esi + eax], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.0042e1f2
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.0047778f
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.004d0587
mov eax, dword [ebp - 0x34]
cmp eax, 0x64
sete al
movzx eax, al
or eax, dword [ebp - 0x20]
jne 0x4d070b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], esi
mov dword [esp + 4], str.not_found_in_archive:__s_n
add eax, 0x40
mov dword [esp], eax
call fcn.004c5d3a
mov dword [ebp - 0x20], 1
jmp 0x4d070b
cmp byte [esi + eax - 1], 0x2f
jne 0x4d067a
dec eax
jmp 0x4d0672
inc ebx
jmp 0x4d0652
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.004d0529
mov eax, dword [ebp - 0x20]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4e9380
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004e93e0

Function at 0x4e93e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x51a800]
test esi, esi
jle 0x4e94cd
mov edi, dword [0x51a804]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4e9414
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4e94c6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x4e9400
mov dword [esp], eax
mov ebx, eax
call fcn.004e9d00
test eax, eax
mov edi, eax
je 0x4e950a
lea ebx, [esi + esi*2]
mov esi, dword [0x51a804]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.004e9e30
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x51a804]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4e94ea
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x4e94bf
sub eax, 0x40
and eax, 0xffffffbf
je 0x4e94bf
mov eax, dword [esp + 0x20]
add ebx, dword [0x51a804]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4e94d4
add dword [0x51a800], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x4e941e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004e9380
mov eax, dword [0x51a804]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004e9380
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004e9380
lea esi, [esi]
Function at 0x4e9970
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x51a818
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x51a810]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4e99c5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4e99be
test esi, esi
je 0x4e99be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4e99a0
mov dword [esp], 0x51a818
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4ea620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x4ea7ae
cmp byte [ebx], 0
je 0x4ea770
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x4ea790
test al, 0x10
je 0x4ea770
lea edi, [esp + 0x2c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], edi
mov esi, edi
call sub.msvcrt.dll__fullpath
mov edx, dword [esi]
add esi, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4ea684
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [esi + 2]
cmove esi, edx
add al, al
sbb esi, 3
sub esi, edi
lea eax, [esi + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x4ea79f
lea edx, [esi + 1]
lea ebp, [eax + 0x22c]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], ebp
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
cmp byte [ebx + 0x22c], 0
je 0x4ea712
movzx eax, byte [ebx + esi + 0x22b]
cmp al, 0x2f
je 0x4ea712
cmp al, 0x5c
je 0x4ea712
mov edx, dword [esp + 0x1c]
mov edi, 0x5c
mov word [ebp + esi], di
mov esi, edx
mov eax, 0x2a
xor edx, edx
xor ecx, ecx
mov word [ebp + esi], ax
mov word [ebx + 0x11c], dx
lea edx, [ebx + 0x120]
mov word [ebx + 0x11e], cx
xor eax, eax
mov ecx, 0x41
mov edi, edx
mov dword [ebx + 0x224], 0xffffffff
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
rep stosd dword es:[edi], eax
mov eax, ebx
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
add esp, 0x13c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x4ea75f
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x4ea75f
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x4ea75f
Function at 0x4ed501
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov byte [eax + 0x10], 1
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 4], str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [esp], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
call fcn.0048c2f8
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x4ed566
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov dword [esp], ebx
call fcn.0048c2f8
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4edf4e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x30
call fcn.004d0422
mov eax, dword [ebx + 0x84]
mov dword [esp], eax
call fcn.0040b268
mov eax, dword [ebx]
mov dword [ebx + 0x84], 0
test eax, eax
je 0x4edf9f
lea edx, [ebx + 0x84]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0xc], edx
call fcn.00416192
mov eax, dword [ebx + 0x84]
test eax, eax
jne 0x4ee006
lea eax, [ebp - 0x10]
mov dword [esp], 8
mov dword [esp + 4], eax
call fcn.00449f7b
mov dword [esp], str.TEMP
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x4edfe2
mov dword [esp], 0x50bc50
call sub.msvcrt.dll_getenv
mov edx, str._tmp
test eax, eax
cmove eax, edx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [esp + 0x10], esi
mov dword [esp + 4], eax
mov dword [esp], str._s_temp_llx._s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.004440e8
jmp 0x4ee01a
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], str._z._s
call fcn.004440e8
mov dword [ebx + 0x84], eax
mov eax, dword [ebx + 0x84]
call fcn.004bd956
add esp, 0x30
pop ebx
pop esi
pop ebp
ret
Function at 0x403f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c623
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x42a018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [0x41d020]
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.00403e80
mov edi, eax
mov dword [ebp - 4], 0
call dword [0x41d020]
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.00403d80
push eax
mov edx, 0x42789c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00406a90
push 0x42788c
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.00406b00
push edi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.00406cc0
push 0x427880
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.00406b00
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.00402cd0
lea ecx, [ebp - 0x58]
call fcn.00402cd0
lea ecx, [ebp - 0x70]
call fcn.00402cd0
lea ecx, [ebp - 0x88]
call fcn.00402cd0
lea ecx, [ebp - 0xa0]
call fcn.00402cd0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00402cc0
push eax
push 0x4278b0
push 0
push 0
call dword [0x41d15c]
push 0
call fcn.0040d37f
int3
Function at 0x406370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xb], 0
je 0x406382
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xc
jb 0x406378
mov eax, ecx
ret

Function at 0x402278
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x404608
call fcn.004029fb
push 1
call fcn.00402540
pop ecx
test al, al
jne 0x40212f
push 7
call fcn.004027bd
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040250b
mov byte [ebp - 0x24], al
mov eax, dword [0x4063c4]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x402128
test eax, eax
jne 0x402199
mov dword [0x4063c4], ecx
push 0x404164
push 0x404154
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40217c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402272
push 0x404150
push 0x404148
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4063c4], 2
jmp 0x40219e
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004026ad
pop ecx
call fcn.004027b1
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4021ce
push esi
call fcn.00402623
pop ecx
test al, al
je 0x4021ce
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004029f5
call esi
call fcn.004027b7
mov esi, eax
cmp dword [esi], edi
je 0x4021ec
push esi
call fcn.00402623
pop ecx
test al, al
je 0x4021ec
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.004028d3
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00402906
test al, al
jne 0x402217
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x402220
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004026ca
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x402272
call fcn.00402a40
ret
call fcn.00401fc1
jmp 0x402110

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1b9a39ee
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6cee5b1e
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219