joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466de0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x466e0f
jle 0x466e5a
and eax, 0xffff
or eax, 0x80070000
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push esi
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x466e4b
jle 0x466e38
and eax, 0xffff
or eax, 0x80070000
mov edx, dword [ebp - 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x466e60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x466e93
jle 0x466ef7
and eax, 0xffff
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
lea edx, [eax + 2]
jmp 0x466ea0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x466ea0
mov ecx, dword [ebp - 4]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
push edx
push esi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x466ee9
jle 0x466ed6
and eax, 0xffff
or eax, 0x80070000
mov edx, dword [ebp - 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46ba10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517583
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 0x10]
cmp edi, eax
jge 0x46bb7b
sub eax, edi
push 0
cmp eax, 0xfff
jle 0x46ba7e
push 0xfff
mov eax, dword [ebp + 0xc]
lea ecx, [edi + eax]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4c]
push eax
call ebx
mov esi, eax
mov ecx, dword [0x56fef0]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x46ba91
push eax
mov edx, dword [ebp + 0xc]
lea eax, [edi + edx]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x4c]
push edx
call ebx
mov esi, eax
test esi, esi
jg 0x46bb71
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004ef520
mov edi, eax
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x50]
push ecx
call fcn.004ef520
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x6c]
push edx
mov edx, str.::send_failed_:
call fcn.00413910
mov byte [ebp - 4], 3
push str.__:
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.004139a0
add esp, 0x24
mov bl, 4
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x88]
push ecx
mov edx, edi
mov ecx, eax
call fcn.00413a30
add esp, 4
mov byte [ebp - 4], 5
push 0x10
push 0x20000000
push eax
push 0x145
push str.Socket::send
call fcn.0044d970
add esp, 0x14
mov byte [ebp - 4], bl
lea esi, [ebp - 0x88]
call fcn.004150b0
mov byte [ebp - 4], 3
lea esi, [ebp - 0xa4]
call fcn.004150b0
mov byte [ebp - 4], 2
lea esi, [ebp - 0x6c]
call fcn.004150b0
mov byte [ebp - 4], 1
lea esi, [ebp - 0x50]
call fcn.004150b0
mov byte [ebp - 4], 0
lea esi, [ebp - 0x34]
call fcn.004150b0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add edi, esi
mov dword [ebp - 0x14], edi
jmp 0x46ba42
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46c2c0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51a8ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
wait
cmp dword [esi + 0x4c], 0xffffffff
jne 0x46c308
xor al, al
wait
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00451990
fstp qword [ebp - 0x20]
mov ecx, dword [esi + 0x4c]
test byte [esi + 0x104], 1
je 0x46c323
push 0x10
lea eax, [esi + 0x50]
jmp 0x46c328
push 0x1c
lea eax, [esi + 0x60]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov byte [esi + 0x48], dl
test dl, dl
je 0x46c353
mov al, 1
wait
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.00451990
fsub qword [ebp - 0x20]
sub esp, 8
fstp qword [esp]
lea eax, [ebp - 0x3c]
push eax
call fcn.004efc70
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x74]
push ecx
call fcn.004ef520
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x58]
push edx
mov edx, str.::connect_failed_:
call fcn.00413910
mov byte [ebp - 4], 3
push str._after
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.004139a0
add esp, 0x1c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc8]
push ecx
mov edx, edi
mov ecx, eax
call fcn.00413a30
add esp, 4
mov bl, 5
mov byte [ebp - 4], bl
push str._sec
push eax
lea edx, [ebp - 0xac]
push edx
call fcn.004139a0
add esp, 0xc
mov byte [ebp - 4], 6
push 0x10
push 0x20000000
push eax
push 0x21d
push str.Socket::connect
call fcn.0044d970
add esp, 0x14
mov byte [ebp - 4], bl
lea esi, [ebp - 0xac]
call fcn.004150b0
mov byte [ebp - 4], 4
lea esi, [ebp - 0xc8]
call fcn.004150b0
mov byte [ebp - 4], 3
lea esi, [ebp - 0x90]
call fcn.004150b0
mov byte [ebp - 4], 2
lea esi, [ebp - 0x58]
call fcn.004150b0
mov byte [ebp - 4], 1
lea esi, [ebp - 0x74]
call fcn.004150b0
mov byte [ebp - 4], 0
lea esi, [ebp - 0x3c]
call fcn.004150b0
wait
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c610
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x513c80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov eax, dword [ebp + 8]
push ebx
imul eax, eax, 0x3e8
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push esi
push edi
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0x1006
mov edi, edx
mov esi, ecx
mov ecx, dword [edi + 0x4c]
push 0xffff
push ecx
call ebx
test eax, eax
jns 0x46c71f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea edx, [esp + 0x30]
push edx
call fcn.004ef520
xor ebx, ebx
mov dword [esp + 0x5c], ebx
push eax
lea eax, [esp + 0x1c]
push eax
mov edx, str.::setsockopt_SO_RCVTIMEO_failed_:
call fcn.00413910
mov byte [esp + 0x64], 1
push 0x10
push 0x20000000
push eax
push 0x24a
push str.Socket::SetTimeout
call fcn.0044d970
add esp, 0x24
mov byte [esp + 0x54], bl
mov esi, 8
cmp dword [esp + 0x24], esi
jb 0x46c6ca
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov edi, 7
xor edx, edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebx
mov word [esp + 0x10], dx
mov dword [esp + 0x54], 0xffffffff
cmp dword [esp + 0x40], esi
jb 0x46c6fa
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], cx
xor al, al
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x4c]
imul esi, esi, 0x3e8
push 4
lea edx, [esp + 0x10]
push edx
push 0x1005
push 0xffff
push eax
mov dword [esp + 0x20], esi
call ebx
test eax, eax
jns 0x46c805
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004ef520
mov ebx, 2
mov dword [esp + 0x5c], ebx
push eax
lea edx, [esp + 0x38]
push edx
mov edx, str.::setsockopt_SO_SNDTIMEO_failed_:
call fcn.00413910
mov byte [esp + 0x64], 3
push 0x10
push 0x20000000
push eax
push 0x253
push str.Socket::SetTimeout
call fcn.0044d970
add esp, 0x24
mov byte [esp + 0x54], bl
mov esi, 8
cmp dword [esp + 0x40], esi
jb 0x46c7ae
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov edi, 7
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], cx
mov dword [esp + 0x54], 0xffffffff
cmp dword [esp + 0x24], esi
jb 0x46c7e0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov word [esp + 0x10], ax
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebx
xor al, al
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4719e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [0x56f040], 0
push esi
je 0x471a3d
mov eax, dword [0x15799b8]
test eax, eax
je 0x471a0d
push eax
call dword [0x56f098]
add esp, 4
lea ebx, [ebp - 4]
mov eax, 0x14
call fcn.0046f410
mov eax, dword [0x15799b8]
test eax, eax
je 0x471a2d
push eax
call dword [0x56f0a0]
add esp, 4
mov esi, dword [ebp - 4]
test esi, esi
jne 0x471a4c
lea eax, [esi + 7]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x14
call dword [0x56f068]
add esp, 4
mov esi, eax
jmp 0x471a30
cmp dword [0x56f044], 0
je 0x471a94
mov eax, dword [0x56f148]
test eax, eax
je 0x471a6c
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x471a94
mov ecx, dword [ebp + 0xc]
lea edx, [esi + 4]
push edx
push 0
push esi
push 0x4719b0
push 0
push 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x471aa4
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x471abd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0ec0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0xc], edi
test eax, eax
je 0x4a0f4b
mov edx, dword [eax + 4]
movzx ecx, byte [eax]
test edx, 0x200
jne 0x4a0f4b
cmp ecx, 0x25
je 0x4a0fda
cmp ecx, 0x9c
je 0x4a0fda
cmp ecx, 0x5e
je 0x4a0f0a
cmp ecx, 0x9d
jne 0x4a0f54
cmp byte [eax + 0x26], 0x5e
jne 0x4a0f69
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
movzx ecx, byte [ecx + 0x42]
mov ebx, dword [eax + 8]
push ecx
push edx
xor eax, eax
call fcn.004b2ef0
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
test edi, edi
je 0x4a0f4b
cmp dword [edi + 0xc], 0
jne 0x4a0f4b
mov eax, dword [esi]
movzx edx, byte [eax + 0x42]
mov ebx, dword [edi]
push edx
push esi
mov eax, edi
call fcn.004b2ef0
add esp, 8
test eax, eax
jne 0x4a0f4b
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 0x9a
je 0x4a0f69
cmp ecx, 0x98
je 0x4a0f69
cmp ecx, 0x3d
jne 0x4a0f6f
cmp dword [eax + 0x2c], 0
jne 0x4a0fee
test edx, 0x100
je 0x4a0f4b
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x4a0f8b
test dword [ecx + 4], 0x100
je 0x4a0f8b
mov eax, ecx
jmp 0x4a0fdd
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x4a0fd6
test edx, 0x800
jne 0x4a0fd6
mov esi, dword [eax]
xor ecx, ecx
test esi, esi
jle 0x4a0fd6
lea edx, [eax + 8]
jmp 0x4a0fb0
mov edi, dword [edx]
test dword [edi + 4], 0x100
jne 0x4a0fcb
inc ecx
add edx, 0x18
cmp ecx, esi
jl 0x4a0fb0
mov edi, dword [esp + 0xc]
mov eax, ebx
jmp 0x4a0fdd
mov edi, dword [esp + 0xc]
lea ecx, [ecx + ecx*2]
mov ebx, dword [eax + ecx*8 + 8]
mov eax, ebx
jmp 0x4a0fdd
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4a0ed4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsx ecx, word [eax + 0x20]
test ecx, ecx
js 0x4a0f4b
mov edx, dword [eax + 0x2c]
mov eax, dword [edx + 4]
mov esi, dword [ebp + 8]
add ecx, ecx
mov ecx, dword [eax + ecx*8 + 8]
mov eax, dword [esi]
mov bl, byte [eax + 0x42]
test ecx, ecx
je 0x4a1022
push 0
push ecx
add eax, 0x16c
call fcn.00473b30
add esp, 8
mov eax, dword [eax + 8]
test eax, eax
je 0x4a0f25
movzx ecx, bl
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*4 - 0x14]
jmp 0x4a0f25
Function at 0x4ac250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [eax + 0x14], esi
jle 0x4ac2e7
lea ebx, [ebx]
cmp esi, 2
jge 0x4ac278
xor esi, 1
test ebx, ebx
je 0x4ac332
mov eax, dword [eax + 0x10]
mov edx, esi
shl edx, 4
mov edi, dword [edx + eax]
mov dl, byte [ebx]
mov ecx, ebx
movzx ebx, byte [edi]
movzx ebx, byte [ebx + 0x53b6b0]
movzx eax, dl
movzx eax, byte [eax + 0x53b6b0]
sub eax, ebx
jne 0x4ac2d2
sub edi, dword [ebp + 0x10]
lea ebx, [ebx]
test dl, dl
je 0x4ac32b
movzx eax, byte [edi + ecx + 1]
movzx ebx, byte [eax + 0x53b6b0]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x53b6b0]
sub eax, ebx
je 0x4ac2b0
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
inc esi
mov dword [ebp - 4], esi
cmp esi, dword [eax + 0x14]
jl 0x4ac270
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx]
movzx edx, al
movzx edx, byte [edx + 0x53b6b0]
sub edx, 0x73
jne 0x4ac322
mov edx, str.sqlite_master
sub edx, ecx
nop
test al, al
je 0x4ac35b
mov al, byte [ecx + 1]
movzx esi, byte [edx + ecx + 1]
movzx esi, byte [esi + 0x53b6b0]
inc ecx
movzx edi, al
movzx edi, byte [edi + 0x53b6b0]
sub edi, esi
je 0x4ac300
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0x10]
test eax, eax
jne 0x4ac2d5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov ecx, dword [ebp + 0xc]
add esi, esi
mov eax, dword [edx + esi*8 + 0xc]
push 0
add eax, 8
push ecx
call fcn.00473b30
mov eax, dword [eax + 8]
add esp, 8
test eax, eax
jne 0x4ac324
jmp 0x4ac2d5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov esi, dword [ecx + 0x10]
test ebx, ebx
jne 0x4ac370
neg esi
sbb esi, esi
mov eax, esi
jmp 0x4ac3b4
test esi, esi
je 0x4ac322
movzx eax, byte [esi]
movzx edi, byte [eax + 0x53b6b0]
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x53b6b0]
sub eax, edi
mov ecx, ebx
jne 0x4ac3b4
sub esi, ebx
test dl, dl
je 0x4ac3b4
movzx eax, byte [esi + ecx + 1]
movzx edi, byte [eax + 0x53b6b0]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x53b6b0]
sub eax, edi
je 0x4ac392
test eax, eax
jne 0x4ac322
mov eax, dword [ebp + 8]
mov ecx, str.sqlite_temp_master
mov dword [ebp + 0xc], ecx
jmp 0x4ac260
Function at 0x4ac560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
xor eax, eax
push esi
xor esi, esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
cmp dword [edx + 0x14], eax
jle 0x4ac5f5
push ebx
lea ebx, [ebx]
mov ecx, esi
cmp esi, 2
jge 0x4ac58a
xor ecx, 1
mov eax, dword [edx + 0x10]
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 0xc], edx
test edi, edi
je 0x4ac601
mov esi, dword [eax + ecx*8]
mov bl, byte [edi]
movzx eax, byte [esi]
movzx eax, byte [eax + 0x53b6b0]
movzx ecx, bl
movzx ecx, byte [ecx + 0x53b6b0]
sub ecx, eax
mov edx, edi
jne 0x4ac5e2
sub esi, edi
jmp 0x4ac5c0
test bl, bl
je 0x4ac5fa
mov bl, byte [edx + 1]
movzx eax, byte [esi + edx + 1]
movzx eax, byte [eax + 0x53b6b0]
inc edx
movzx ecx, bl
movzx ecx, byte [ecx + 0x53b6b0]
sub ecx, eax
je 0x4ac5c0
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
inc esi
mov dword [ebp - 4], esi
cmp esi, dword [edx + 0x14]
jl 0x4ac580
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x4ac5e2
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
push 0
push edx
add eax, 0x18
call fcn.00473b30
mov eax, dword [eax + 8]
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x4ac5f4
jmp 0x4ac5e8
Function at 0x4af6b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [edx + 0x10]
push ebx
add eax, eax
mov ebx, dword [ecx + eax*8]
push esi
mov eax, 1
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
push eax
push str.sqlite_stat_d
lea edx, [ebp - 0x30]
push edx
push 0x18
call fcn.00471700
mov eax, dword [ebp + 8]
mov edx, dword [eax]
add esp, 0x10
lea ecx, [ebp - 0x30]
mov dword [ebp - 0xc], edx
xor esi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], esi
cmp dword [edx + 0x14], esi
jle 0x4af76d
cmp esi, 2
jge 0x4af705
xor esi, 1
test ebx, ebx
je 0x4af7b0
mov edx, dword [edx + 0x10]
mov eax, esi
add eax, eax
mov edi, dword [edx + eax*8]
mov dl, byte [ebx]
mov ecx, ebx
movzx ebx, byte [edi]
movzx ebx, byte [ebx + 0x53b6b0]
movzx eax, dl
movzx eax, byte [eax + 0x53b6b0]
sub eax, ebx
jne 0x4af758
sub edi, dword [ebp - 8]
test dl, dl
je 0x4af7a9
movzx eax, byte [edi + ecx + 1]
movzx ebx, byte [eax + 0x53b6b0]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x53b6b0]
sub eax, ebx
je 0x4af736
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, dword [edx + 0x14]
jl 0x4af6fd
mov ecx, dword [ebp - 0x10]
mov al, byte [ecx]
movzx edx, al
movzx edx, byte [edx + 0x53b6b0]
sub edx, 0x73
jne 0x4af7f1
mov edx, str.sqlite_master
sub edx, ecx
test al, al
je 0x4af808
mov al, byte [ecx + 1]
movzx esi, byte [edx + ecx + 1]
movzx esi, byte [esi + 0x53b6b0]
inc ecx
movzx edi, al
movzx edi, byte [edi + 0x53b6b0]
sub edi, esi
je 0x4af785
jmp 0x4af7f1
mov ebx, dword [ebp - 8]
test eax, eax
jne 0x4af75b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
mov ecx, dword [ebp - 0x10]
add esi, esi
mov eax, dword [edx + esi*8 + 0xc]
push 0
add eax, 8
push ecx
call fcn.00473b30
add esp, 8
cmp dword [eax + 8], 0
je 0x4af75b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x30]
push eax
push ebx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ecx
call fcn.004ac1b0
add esp, 0x18
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 4
jle 0x4af6d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x10]
mov esi, dword [eax + 0x10]
test ebx, ebx
jne 0x4af81d
neg esi
sbb esi, esi
mov eax, esi
jmp 0x4af864
test esi, esi
je 0x4af7f1
movzx eax, byte [esi]
movzx edi, byte [eax + 0x53b6b0]
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x53b6b0]
sub eax, edi
mov ecx, ebx
jne 0x4af861
sub esi, ebx
test dl, dl
je 0x4af861
movzx eax, byte [esi + ecx + 1]
movzx edi, byte [eax + 0x53b6b0]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x53b6b0]
sub eax, edi
je 0x4af83f
mov edx, dword [ebp - 0xc]
test eax, eax
jne 0x4af7f1
mov ecx, str.sqlite_temp_master
jmp 0x4af6f0
Function at 0x4e6fd0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5225a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
mov edi, 8
cmp dword [esi + 0x14], edi
jb 0x4e700b
mov eax, dword [esi]
jmp 0x4e700d
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x4e702f
cmp dword [esi + 0x14], edi
jb 0x4e7021
mov eax, dword [esi]
jmp 0x4e7023
mov eax, esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push esi
or eax, 0xffffffff
mov ecx, 0x1579c6c
call fcn.00411b10
cmp dword [0x1579c80], edi
mov eax, dword [0x1579c6c]
jae 0x4e7051
mov eax, 0x1579c6c
mov ebx, 0x1579c5c
call fcn.004197a0
push ebx
call fcn.00419880
test al, al
jne 0x4e70b1
push esi
push str.Database_not_exist:
lea eax, [ebp - 0x30]
push eax
call fcn.00414000
mov byte [ebp - 4], 1
push 0
push 0x20000000
push eax
push 0xf2
push str.SqlMng::Init
call fcn.0044d970
add esp, 0x20
mov byte [ebp - 4], 0
lea esi, [ebp - 0x30]
call fcn.004150b0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, str.PRAGMA_locking_mode__EXCLUSIVE
mov eax, 0x1579c5c
call fcn.004198d0
mov ebx, str.BEGIN_EXCLUSIVE
mov eax, 0x1579c5c
call fcn.004198d0
mov ebx, str.COMMIT
mov eax, 0x1579c5c
call fcn.004198d0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f1f20
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x517198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.MSVCR100.dll__time64]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.004ee870
add esp, 0xc
xor esi, esi
mov dword [esp + 0x74], esi
cmp dword [esp + 0x38], 0xa
mov eax, dword [esp + 0x28]
jbe 0x4f1fa7
cmp dword [esp + 0x3c], 0x10
jae 0x4f1f78
lea eax, [esp + 0x28]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push str._4d__2d__2d__2d:_2d:_2d
push eax
call dword [sym.imp.MSVCR100.dll_sscanf_s]
add esp, 0x20
jmp 0x4f1fdc
cmp dword [esp + 0x3c], 0x10
jae 0x4f1fb2
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push str._4d__2d__2d
push eax
call dword [sym.imp.MSVCR100.dll_sscanf_s]
add esp, 0x14
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add edx, 0xfffff894
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x14]
dec eax
mov dword [esp + 0x4c], edx
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
call dword [sym.imp.MSVCR100.dll__mktime64]
add esp, 4
mov esi, eax
mov edi, edx
mov dword [esp + 0x74], 0xffffffff
cmp dword [esp + 0x3c], 0x10
jb 0x4f2042
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x6c]
mov edx, edi
pop edi
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret