joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a10f8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x6a1149
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x6a1130
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x6a1120
jmp 0x6a1149
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x6a1131
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6af208
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor edx, edx
push ebp
push 0x6af38e
push dword fs:[edx]
mov dword fs:[edx], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5a8534]
call fcn.005a8da8
mov ebx, eax
mov dword [esi + 0x37c], ebx
mov byte [ebx + 0x948], 1
mov eax, ebx
call fcn.005aa204
mov eax, dword [0x715b40]
mov eax, dword [eax]
call fcn.0046c980
mov edx, eax
mov eax, dword [esi + 0x37c]
call fcn.0044def0
mov eax, dword [0x715b40]
mov eax, dword [eax]
call fcn.0046c974
mov edx, eax
mov eax, dword [esi + 0x37c]
call fcn.0044df14
mov eax, dword [esi + 0x37c]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x15c]
mov ebx, dword [esi + 0x37c]
mov byte [ebx + 0x92c], 0
mov eax, ebx
or edx, 0xffffffff
call fcn.005ab170
mov dword [eax + 0x10], 5
mov eax, dword [esi + 0x37c]
or edx, 0xffffffff
call fcn.005ab170
mov dword [eax + 0x14], 5
mov eax, dword [esi + 0x37c]
or edx, 0xffffffff
call fcn.005ab170
xor edx, edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], 0x40100000
mov eax, dword [esi + 0x37c]
mov byte [eax + 0x922], 1
mov byte [eax + 0x920], 1
mov dx, word [0x6af3a0]
call fcn.005aa438
mov eax, dword [esi + 0x37c]
xor edx, edx
call fcn.0062e540
mov eax, dword [esi + 0x37c]
xor edx, edx
call fcn.005c6180
mov eax, dword [esi + 0x37c]
call fcn.0062bafc
xor edx, edx
call fcn.00609870
mov eax, dword [esi + 0x37c]
call fcn.0062bafc
mov byte [eax + 0x30], 0
mov eax, dword [esi + 0x37c]
xor edx, edx
call fcn.0062b9b8
mov eax, dword [esi + 0x37c]
mov dl, 8
call fcn.005bf208
mov eax, dword [esi + 0x37c]
mov byte [eax + 0x921], 0
mov dword [eax + 0x4c0], 3
push 0x40590000
push 0
call fcn.006228b4
mov eax, dword [esi + 0x37c]
xor edx, edx
call fcn.0044e67c
mov eax, dword [esi + 0x37c]
mov edx, dword [eax]
call dword [edx + 0xe0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6af398
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x6c4520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6c455b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xf1], 0x80
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6c4565
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c88d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6c8a39
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5a8534]
call fcn.005a8da8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x948], 1
mov eax, dword [ebp - 4]
call fcn.005aa204
mov eax, dword [0x715b40]
mov eax, dword [eax]
call fcn.0046c980
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0044def0
mov eax, dword [0x715b40]
mov eax, dword [eax]
call fcn.0046c974
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0044df14
mov dl, 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x15c]
mov eax, dword [ebp - 4]
mov byte [eax + 0x92c], 0
or edx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.005ab170
mov dword [eax + 0x10], 5
or edx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.005ab170
mov dword [eax + 0x14], 5
or edx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.005ab170
xor edx, edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], 0x40100000
mov eax, dword [ebp - 4]
mov byte [eax + 0x922], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x920], 1
mov dx, word [0x6c8a4c]
mov eax, dword [ebp - 4]
call fcn.005aa438
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0062e540
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005c6180
mov eax, dword [ebp - 4]
call fcn.0062bafc
xor edx, edx
call fcn.00609870
mov eax, dword [ebp - 4]
call fcn.0062bafc
mov byte [eax + 0x30], 0
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0062b9b8
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.005bf208
mov eax, dword [ebp - 4]
mov byte [eax + 0x921], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x4c0], 3
push 0x40590000
push 0
mov eax, dword [ebp - 4]
call fcn.006228b4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0044e67c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xe0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6c8a43
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6dad84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040529c
mov eax, dword [ebp - 8]
call fcn.0040529c
xor eax, eax
push ebp
push 0x6dae63
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6dae3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x6dae7c
call fcn.00404e68
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404e68
mov eax, dword [ebp - 0x10]
call fcn.0040b654
test al, al
je 0x6dae34
cmp dword [ebp - 8], 0
je 0x6dae09
push dword [ebp - 0x10]
push 0x6dae8c
push dword [ebp - 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405174
push 3
push 0
mov eax, dword [ebp - 0x10]
call fcn.004052ac
push eax
mov eax, dword [ebp - 0xc]
call fcn.004052ac
push eax
push 0x6dae90
mov eax, dword [0x7158ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6dae48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6dae6a
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404df4
ret

Function at 0x6dccbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x715b68]
cmp dword [eax], 1
jne 0x6dccd2
mov eax, ebx
call fcn.004aca74
pop ebx
ret
mov eax, ebx
call fcn.00405774
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6dcce8
test al, 0x10
je 0x6dccec
xor eax, eax
jmp 0x6dccee
mov al, 1
pop ebx
ret
Function at 0x6dd050
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x6dd188
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x6dd07b
push 9
push ebx
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
jne 0x6dd08d
mov byte [ebp - 1], 1
jmp 0x6dd17e
mov eax, dword [0x715b68]
cmp dword [eax], 2
jne 0x6dd0a1
mov eax, dword [0x715650]
cmp dword [eax], 4
jg 0x6dd0d5
mov eax, dword [0x715b68]
cmp dword [eax], 1
jne 0x6dd167
mov eax, dword [0x715650]
cmp dword [eax], 4
jg 0x6dd0d5
mov eax, dword [0x715650]
cmp dword [eax], 4
jne 0x6dd167
mov eax, dword [0x715948]
cmp dword [eax], 0
jle 0x6dd167
mov byte [ebp - 1], 0
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0xffffffffffffffff
push esi
push edi
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x6dd11f
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 0
push esi
push edi
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x6dd173
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoA
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [ebp - 8]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
jmp 0x6dd173
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6dd192
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x6dd890
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6dd904
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x6dd918]
mov byte [ebp - 1], al
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetKeyboardState
test byte [ebp - 0xf0], 0x80
je 0x6dd8d2
mov al, byte [0x6dd91c]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
test byte [ebp - 0xf1], 0x80
je 0x6dd8e6
mov al, byte [0x6dd920]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
test byte [ebp - 0xef], 0x80
je 0x6dd8fa
mov al, byte [0x6dd924]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6dd90e
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6dde1c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00404dd0
xor eax, eax
push ebp
push 0x6dde64
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15]
push eax
call sub.kernel32.dll_GetComputerNameA
mov edx, ebx
lea eax, [ebp - 0x15]
call fcn.0040bd34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6dde6e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6dde78
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404dd0
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 4]
call fcn.0040bd48
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6ddee2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x6ddecc
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0040bd34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ddee9
mov eax, dword [ebp - 8]
call fcn.0040bd94
ret

Function at 0x6ddf50
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x6ddf98
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.0041d104
push 0
push 0x6ddfa8
call sub.user32.dll_FindWindowA
test eax, eax
je 0x6ddf8e
push ebx
push eax
call sub.user32.dll_GetWindowRect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ddfa2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6de5f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405b2c
xor eax, eax
push ebp
push 0x6de72c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6de6f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
mov edx, 0x6de740
call fcn.00405580
mov eax, dword [0x71591c]
mov eax, dword [eax]
cmp dword [eax + 0x4a0], 6
jl 0x6de6ae
lea eax, [ebp - 0x10]
mov edx, 0x6de750
call fcn.00405580
lea eax, [ebp - 8]
mov edx, 0x6de774
call fcn.00405580
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0x6de794
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405854
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405774
push eax
mov eax, dword [ebp - 8]
call fcn.00405774
push eax
mov eax, dword [ebp - 0x14]
call fcn.00405774
push eax
mov eax, dword [0x71591c]
mov eax, dword [eax]
call fcn.00454ec4
push eax
call sub.shell32.dll_ShellExecuteW
mov bl, 1
test bl, bl
jne 0x6de6ed
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004ac878
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.0040507c
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.004052ac
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x71591c]
mov eax, dword [eax]
call fcn.00454ec4
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6de701
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6de733
lea eax, [ebp - 0x1c]
call fcn.00405520
lea eax, [ebp - 0x18]
call fcn.00404dd0
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405538
ret
Function at 0x6df150
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405b2c
xor eax, eax
push ebp
push 0x6df27a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x6df24d
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 1
mov eax, dword [0x715b68]
cmp dword [eax], 1
jne 0x6df1a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6df257
mov byte [ebp - 5], 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040b100
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040aedc
mov eax, dword [ebp - 0xc]
call fcn.00405784
cmp eax, 3
jge 0x6df1d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6df257
mov eax, dword [ebp - 0xc]
cmp word [eax + 2], 0x3a
jne 0x6df1fd
mov eax, dword [ebp - 0xc]
cmp word [eax + 4], 0x5c
jne 0x6df1fd
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x41
jb 0x6df1fd
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5a
jbe 0x6df207
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6df257
lea eax, [ebp - 0xc]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405920
mov eax, dword [ebp - 0xc]
call fcn.00405774
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
je 0x6df23e
cmp eax, 6
je 0x6df23e
cmp eax, 2
je 0x6df23e
xor eax, eax
jmp 0x6df240
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6df257
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6df281
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405538
lea eax, [ebp - 4]
call fcn.00405520
ret
Function at 0x6ebf58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ec034
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6ec017
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404dd0
mov eax, 0x104
call fcn.0040bd48
mov ebx, eax
push ebx
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.00404fd0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004050b4
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x5c
je 0x6ebfd2
mov eax, dword [ebp - 4]
mov edx, 0x6ec048
call fcn.004050bc
mov eax, dword [ebp - 4]
mov eax, ebx
call fcn.0040bd94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ec01e
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x6ebffc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040b664
test al, al
jne 0x6ec016
lea edx, [ebp - 8]
mov eax, dword [0x7158ac]
mov eax, dword [eax]
call fcn.0046f524
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040b944
ret
Function at 0x404de0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
mov dword [esp + 0x20], 0
call dword [0x409270]
mov esi, eax
cmp esi, 0xffffffff
je 0x404e24
push 0
lea ecx, [esp + 8]
push ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x404e2c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0
lea edx, [esp + 0xc]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
je 0x404e1e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
pop esi
add esp, 8
ret

Function at 0x404f00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push ebx
call dword [0x409270]
mov edi, eax
cmp edi, 0xffffffff
je 0x404f9a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x404f9a
test esi, esi
jne 0x404f51
mov eax, dword [esp + 0x14]
pop edi
mov dword [ebp], esi
mov dword [eax], esi
pop esi
mov eax, 1
pop ebp
ret
push esi
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp], edi
je 0x404f9a
push esi
push 0
push edi
call sub.MSVCR80.dll_memset
push esi
push edi
mov eax, ebx
call fcn.00404de0
add esp, 0x14
cmp eax, 0xffffffff
jne 0x404fa0
mov ecx, dword [ebp]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [ebp], 0
mov dword [edx], 0
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword [ecx], eax
mov eax, 1
pop ebp
ret

Function at 0x405300
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [eax]
rol cl, 4
xor cl, 0xaa
mov byte [eax], cl
je 0x405320
mov edx, eax
mov edi, edi
mov cl, byte [edx + 1]
add edx, 1
rol cl, 4
xor cl, 0xaa
mov byte [edx], cl
jne 0x405310
ret

Function at 0x405321
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40532b
repz ret
jmp fcn.0040569a

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001a80
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x1022e328]
test eax, eax
jne 0x10001adc
mov dword [0x1022e328], 1
call fcn.10115070
test eax, eax
je 0x10001acc
push 0
push 0x104
push 0x1022e32c
call fcn.1011ac60
add esp, 0xc
test eax, eax
je 0x10001adc
push str.SysWow64
push 0x1022e32c
call fcn.100e9a39
add esp, 8
mov eax, 0x1022e32c
ret
push 0x104
push 0x1022e32c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x1022e32c
ret
Function at 0x10003180
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x100031b3
mov eax, dword [0x102acd68]
test eax, eax
je 0x100031ac
push str.winbrosqlite3_module_is_Loaded
push str.History
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x10
mov eax, 1
pop esi
ret
push str.winbrosqlite3.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x28], eax
jne 0x100031f6
mov eax, dword [0x102acd68]
test eax, eax
je 0x10003311
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.winbrosqlite3_module_load_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
xor eax, eax
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.sqlite3_open16
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_prepare16_v2
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_bind_int64
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_bind_text16
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_step
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_column_int64
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_column_text16
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_close
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_finalize
push ecx
mov dword [esi + 0x20], eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x24], eax
test ecx, ecx
pop edi
je 0x100032e1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100032e1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x100032e1
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x100032e1
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100032e1
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x100032e1
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x100032e1
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100032e1
test eax, eax
je 0x100032e1
mov eax, dword [0x102acd68]
test eax, eax
je 0x100032d7
push str.winbrosqlite3_module_load_successful
push str.History
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x10
mov eax, 1
mov dword [esi + 0x2c], eax
pop esi
ret
mov eax, dword [0x102acd68]
test eax, eax
je 0x1000330a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.get_winbrosqlite3_function_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x102ac4d4
call fcn.10141bb0
add esp, 0x14
mov ecx, esi
call fcn.10003320
xor eax, eax
pop esi
ret