joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411a50
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e18f0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x66a074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x673629], 0
je 0x411a91
push 0x61e3d4
call fcn.00407e20
add esp, 4
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.0040ef40
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x34]
cmp esi, edi
jne 0x411ae0
cmp byte [0x673629], 0
je 0x411ad5
push 0x61e400
call fcn.00407e20
add esp, 4
xor bl, bl
jmp 0x411bdc
mov ecx, esi
call fcn.004c6ba0
test al, al
je 0x411af2
mov ecx, esi
call fcn.004c6f40
add esi, 0x18
cmp esi, edi
jne 0x411ae0
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.004c0ca0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004c6ba0
test al, al
je 0x411bd4
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
mov dword [ebp - 0x2c], 0
call edi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x411bca
push eax
call fcn.005b79a5
push dword [ebp - 0x2c]
mov esi, eax
push 0
push esi
call fcn.005b9c20
add esp, 0x10
lea eax, [ebp - 0x2c]
push eax
push esi
push 0
call edi
mov edi, eax
test edi, edi
je 0x411bca
mov ebx, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test dword [esi + 0xc], 0x100000
jne 0x411b76
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push edi
call ebx
cmp dword [ebp - 0x2c], 0
je 0x411bb6
push esi
call fcn.005b79a0
push dword [ebp - 0x2c]
call fcn.005b79a5
push dword [ebp - 0x2c]
mov esi, eax
push 0
push esi
call fcn.005b9c20
add esp, 0x14
lea eax, [ebp - 0x2c]
push eax
push esi
push edi
call ebx
test eax, eax
jne 0x411b64
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
test esi, esi
je 0x411bca
push esi
call fcn.005b79a0
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.0040fe60
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00408ff0
lea ecx, [ebp - 0x38]
call fcn.004143b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b75ab
mov esp, ebp
pop ebp
ret
Function at 0x412190
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1a17
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x66a074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x84], edi
cmp byte [0x673629], 0
je 0x4121d9
push 0x61e700
call fcn.00407e20
add esp, 4
lea ecx, [ebp - 0x40]
call fcn.004acab0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.004c6ba0
test al, al
je 0x412324
mov esi, 0x66b1d0
mov ebx, 0x25
lea ecx, [ebp - 0x80]
call fcn.004cc450
push esi
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.004c7af0
add esp, 4
lea edx, [ebp - 0x80]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.004cc8d0
test al, al
jne 0x41223e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.00408ff0
jmp 0x41226c
mov eax, dword [ebp - 0x60]
and eax, 1
or eax, 0
je 0x412260
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x80
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
call fcn.00408ff0
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0
call fcn.004cc4e0
add esi, 0x18
sub ebx, 1
jne 0x412202
mov esi, 0x66b558
mov ebx, 3
nop word [eax + eax]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
or edi, 2
mov eax, dword [ebp - 0x30]
add eax, dword [esi]
mov dword [ebp - 0x14], 0
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
call fcn.00408d90
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
call fcn.00409220
cmp dword [esi + 4], 8
lea eax, [esi - 0x10]
jb 0x4122e9
mov eax, dword [eax]
push dword [esi]
lea ecx, [ebp - 0x28]
push eax
call fcn.00409220
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0040f6d0
and edi, 0xfffffffd
mov dword [ebp - 0x84], edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
call fcn.00408ff0
add esi, 0x18
mov byte [ebp - 4], 0
sub ebx, 1
jne 0x412290
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0x14
call fcn.00408ff0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b75ab
mov esp, ebp
pop ebp
ret
Function at 0x4163c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2020
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x66a074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x164]
call fcn.004cb990
call fcn.004cb900
test al, al
je 0x416593
mov ecx, edi
call fcn.004c6ca0
test al, al
je case.default.0x41659b
push 0x66b590
lea ecx, [ebp - 0x2c]
call fcn.0040aa10
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.004162f0
mov byte [ebp - 4], 1
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x416445
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00409220
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00408ff0
push 1
push 0x6139f8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00409220
cmp dword [0x66b5bc], 8
lea ecx, [ebp - 0x2c]
push dword [0x66b5b8]
mov eax, 0x66b5a8
cmovae eax, dword [0x66b5a8]
push eax
call fcn.00409220
push 1
push str._234
lea ecx, [ebp - 0x2c]
call fcn.00409220
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4164ab
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x2c]
push eax
call fcn.00409220
push 1
push str._234
lea ecx, [ebp - 0x2c]
call fcn.00409220
cmp dword [edi + 0x14], 8
xorps xmm0, xmm0
mov dword [ebp - 0x188], 0
movlpd qword [ebp - 0x180], xmm0
movlpd qword [ebp - 0x178], xmm0
movlpd qword [ebp - 0x170], xmm0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x1a0], 0x3c
mov dword [ebp - 0x19c], 0x40
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x194], str.open
jb 0x416525
mov edi, dword [edi]
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x190], edi
cmovae eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x1a0]
push eax
mov dword [ebp - 0x184], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
jne 0x41657b
cmp dword [ebp + 8], 2
je 0x41657b
push 0xbb8
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x168]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 6
call fcn.00408ff0
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x41659b
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x41659b
jmp dword [eax*4 + 0x41660c]
mov ecx, esi
call fcn.004c6ca0
test al, al
je case.default.0x41659b
mov edx, 0x150a
jmp 0x4165e8
mov ecx, esi
call fcn.004c6ca0
test al, al
je case.default.0x41659b
mov edx, 0x150b
jmp 0x4165e8
mov ecx, esi
call fcn.004c6ca0
test al, al
je case.default.0x41659b
mov edx, 0xc801
jmp 0x4165e8
mov ecx, esi
call fcn.004c6ca0
test al, al
je case.default.0x41659b
mov edx, 0xc8c2
mov ecx, esi
call fcn.004dee90
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b75ab
mov esp, ebp
pop ebp
ret
Function at 0x416680
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
mov dword [esi], vtable.RepairAction.0
test eax, eax
je 0x4166a3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x24], 0
lea ecx, [esi + 0x18]
call fcn.00416830
lea ecx, [esi + 0xc]
call fcn.00416830
test byte [ebp + 8], 1
je 0x4166c4
push 0x2c
push esi
call fcn.005b7992
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x417330
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e21c3
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x66a074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x44], vtable.RepairAction.0
mov eax, dword [ebx]
lea esi, [ebx + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 4]
push esi
mov dword [ebp - 0x3c], eax
call fcn.00416770
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00416770
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x64]
mov eax, dword [ebx]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x70]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x70], vtable.RepairAction.0
call fcn.00416770
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x58]
call fcn.00416770
mov al, byte [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x4c], esi
mov byte [ebp - 0x48], al
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00417e20
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00417ee0
mov eax, dword [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 0x70], vtable.RepairAction.0
test eax, eax
je 0x417426
push 0
push eax
call edi
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x58]
call fcn.00416830
lea ecx, [ebp - 0x64]
call fcn.00416830
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x44], vtable.RepairAction.0
test esi, esi
je 0x417454
push 0
push esi
call edi
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x2c]
call fcn.00416830
lea ecx, [ebp - 0x38]
call fcn.00416830
mov eax, dword [ebx]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 8]
call fcn.00418040
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 8]
call fcn.00418060
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417560
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
mov dword [ebp - 4], eax
mov edi, esi
cmp byte [esi + 0xd], 0
jne 0x4175cd
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
nop dword [eax]
push dword [edi + 8]
mov ecx, eax
call fcn.00417560
mov eax, dword [esi + 0x38]
mov edi, dword [edi]
mov dword [esi + 0x14], vtable.RepairAction.0
test eax, eax
je 0x4175a6
push 0
push eax
call ebx
mov dword [esi + 0x38], 0
lea ecx, [esi + 0x2c]
call fcn.00416830
lea ecx, [esi + 0x20]
call fcn.00416830
push 0x40
push esi
call fcn.005b7992
mov eax, dword [ebp - 4]
add esp, 8
cmp byte [edi + 0xd], 0
mov esi, edi
je 0x417580
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x417670
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0620
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x66a074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
cmp eax, dword [esi]
jne 0x4176e8
cmp edx, esi
jne 0x4176e8
mov dword [ebp - 4], 0
push dword [esi + 4]
call fcn.00417560
mov eax, dword [ebx]
mov dword [eax + 4], esi
mov eax, dword [ebx]
mov dword [eax], esi
mov eax, dword [ebx]
mov dword [eax + 8], esi
mov dword [ebx + 4], 0
mov eax, dword [ebx]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, edx
je 0x4177c9
mov esi, dword [eax + 8]
lea edi, [eax + 8]
mov ecx, eax
cmp byte [esi + 0xd], 0
je 0x41771f
mov edx, dword [eax + 4]
cmp byte [edx + 0xd], 0
jne 0x41771a
cmp eax, dword [edx + 8]
jne 0x41771a
mov eax, edx
mov dword [ebp + 0xc], eax
mov edx, dword [edx + 4]
cmp byte [edx + 0xd], 0
je 0x417707
mov dword [ebp + 0xc], edx
jmp 0x417736
mov edx, dword [esi]
cmp byte [edx + 0xd], 0
jne 0x417733
mov eax, dword [edx]
mov esi, edx
mov edx, eax
cmp byte [eax + 0xd], 0
je 0x417727
mov dword [ebp + 0xc], esi
mov edx, dword [edi]
mov eax, ecx
cmp byte [edx + 0xd], 0
je 0x417762
mov edx, dword [ecx + 4]
cmp byte [edx + 0xd], 0
jne 0x41777a
nop dword [eax]
cmp eax, dword [edx + 8]
jne 0x41777a
mov eax, edx
mov edx, dword [edx + 4]
cmp byte [edx + 0xd], 0
je 0x417750
jmp 0x41777a
mov edx, dword [edx]
cmp byte [edx + 0xd], 0
jne 0x41777a
nop word [eax + eax]
mov eax, dword [edx]
mov edx, eax
cmp byte [eax + 0xd], 0
je 0x417770
push ecx
mov ecx, ebx
call fcn.00417850
mov esi, eax
mov eax, dword [esi + 0x38]
mov dword [esi + 0x14], vtable.RepairAction.0
test eax, eax
je 0x4177a2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x38], 0
lea ecx, [esi + 0x2c]
call fcn.00416830
lea ecx, [esi + 0x20]
call fcn.00416830
push 0x40
push esi
call fcn.005b7992
mov eax, dword [ebp + 0xc]
add esp, 8
cmp eax, dword [ebp + 0x10]
jne 0x4176f0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418250
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x38]
mov dword [esi + 0x14], vtable.RepairAction.0
test eax, eax
je 0x418275
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x38], 0
lea ecx, [esi + 0x2c]
call fcn.00416830
lea ecx, [esi + 0x20]
call fcn.00416830
push 0x40
push esi
call fcn.005b7992
add esp, 8
pop esi
pop ebp
ret 4
Function at 0x448b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.0041b100
mov esi, eax
add esp, 8
test esi, esi
jne 0x448bc0
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x66aa3c], 0
mov edi, dword [ebp + 8]
je 0x448c0a
mov eax, dword [0x66ab3c]
test eax, eax
je 0x448be3
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x448c0a
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x41dc10
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.005c05b0
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x448c17
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x448c30
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4585e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
mov edx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], edx
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [edx + 0x14], eax
jle 0x458679
mov ebx, eax
xor ebx, 1
cmp eax, 2
cmovge ebx, eax
test edi, edi
je 0x4586c4
mov eax, dword [edx + 0x10]
mov ecx, ebx
add ecx, ecx
mov esi, edi
mov edx, dword [eax + ecx*8]
mov al, byte [edi]
movzx ecx, al
movzx edi, byte [ecx + 0x616258]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x616258]
sub edi, ecx
jne 0x458664
sub edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
nop
test al, al
je 0x4586ba
movzx ecx, byte [edx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x616258]
mov al, byte [esi]
movzx ecx, al
movzx edi, byte [ecx + 0x616258]
sub edi, edx
mov edx, dword [ebp - 0x10]
je 0x458640
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
inc eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 0x14]
jl 0x458600
mov dl, byte [esi]
movzx eax, dl
cmp byte [eax + 0x616258], 0x73
jne 0x4586b1
mov edi, str.sqlite_master
sub edi, esi
nop
test dl, dl
je 0x4586e5
movzx eax, byte [edi + esi + 1]
inc esi
movzx ecx, byte [eax + 0x616258]
mov dl, byte [esi]
movzx eax, dl
movzx eax, byte [eax + 0x616258]
sub eax, ecx
je 0x458690
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x458664
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
add ebx, ebx
push 0
mov edx, esi
mov ecx, dword [eax + ebx*8 + 0xc]
add ecx, 8
call fcn.0041fa30
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x4586b3
jmp 0x458667
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov eax, dword [eax + 0x10]
test edi, edi
jne 0x4586fb
neg eax
sbb eax, eax
jmp 0x45870b
test eax, eax
je 0x4586b1
mov edx, eax
mov ecx, edi
call fcn.0041e5d0
mov edx, dword [ebp - 8]
test eax, eax
jne 0x4586b1
mov esi, str.sqlite_temp_master
mov dword [ebp - 4], esi
jmp 0x4585f6
Function at 0x458a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov dword [ebp - 0xc], edx
xor edx, edx
mov dword [ebp - 0x10], eax
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x458ac9
push ebx
push esi
mov eax, dword [eax + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x458aaa
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x616258]
movzx ecx, al
movzx ecx, byte [ecx + 0x616258]
sub ecx, edx
jne 0x458a91
sub ebx, esi
test al, al
je 0x458aa6
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x616258]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x616258]
sub ecx, edx
je 0x458a70
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x458a31
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x458a91
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add ecx, 0x18
push 0
call fcn.0041fa30
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x458a9d
jmp 0x458a94
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x496d80
Capabilities:
Hide graphical window
Terminate process
Terminate thread

Disassembly:
cmp dword [0x673634], 0
push esi
mov esi, ecx
je 0x496dd5
mov eax, dword [0x673638]
test eax, eax
je 0x496dd5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push dword [0x673634]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push dword [esi + 4]
mov dword [0x673638], 0
mov dword [0x673634], 0
mov dword [esi + 0xfc], 4
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
pop esi
ret
Function at 0x49a5a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2cb3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x66a074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x30]
mov edi, dword [eax]
test edi, edi
je 0x49a6e2
mov ecx, dword [edi + 0xb8]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], 0x3ea
push eax
add ecx, 0x40
call fcn.00540ca0
mov ecx, dword [edi + 0xb8]
mov eax, dword [eax]
cmp eax, dword [ecx + 0x40]
je 0x49a60a
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x49a621
mov eax, dword [esi + 0x30]
push 0x3ea
mov ecx, dword [eax]
call fcn.0053fd50
test eax, eax
je 0x49a6e2
mov eax, dword [eax + 0xbc]
test eax, eax
jne 0x49a6a3
push 5
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], eax
push str.YS_06
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00409060
mov dword [ebp - 4], 0
mov eax, dword [0x674ec0]
test al, 1
jne 0x49a684
or eax, 1
mov dword [0x674ec0], eax
mov byte [ebp - 4], 1
call fcn.004e5d70
push 0x602870
mov byte [ebp - 4], 1
call fcn.005b797d
add esp, 4
mov byte [ebp - 4], 0
lea eax, [ebp - 0x2c]
mov ecx, 0x674ec4
push eax
call fcn.00492680
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 3
call fcn.00408ff0
jmp 0x49a6db
cmp eax, 1
jne 0x49a6e2
push str.YS_11
lea ecx, [ebp - 0x2c]
call fcn.00408ef0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 7
push eax
call fcn.00492230
mov ecx, eax
call fcn.00492680
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 8
call fcn.00408ff0
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0x17c], 0
je 0x49a716
call fcn.004acf20
push 0
push dword [esi + 4]
mov byte [esi + 0xed], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.00496d80
jmp 0x49a72b
push 2
mov ecx, esi
call fcn.00496de0
call fcn.004acf20
mov byte [esi + 0xed], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b75ab
mov esp, ebp
pop ebp
ret