joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44c7f1
sub esp, 0x48
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x78]
add ebx, 1
mov edx, dword [edx + 0x54]
mov ebp, dword [ecx + 0x7c]
mov dword [ecx + 0x78], ebx
adc ebp, 0
mov dword [ecx + 0x7c], ebp
mov ebx, edx
mov ebp, dword [edx + 0x950]
cmp ecx, ebp
jne 0x44c725
mov dword [esp + 0x44], ecx
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.0045832a
mov ecx, dword [esp + 0x44]
mov ebx, dword [ecx + 0x50]
mov ebp, dword [ecx + 0x54]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebp
mov ebx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x78]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebx
mov eax, dword [edx + 0x954]
cmp eax, 3
jae 0x44c7e6
lea ecx, [0x144d814]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
mov byte [esp], 0x29
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.0044aab0
add esp, 0x48
ret
cmp dword [ecx + 0x80], ebx
jne 0x44c776
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp], 0x26
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.0044aab0
jmp 0x44c721
mov dword [ecx + 0x80], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [ecx + 0x50]
mov edx, dword [ecx + 0x54]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x78]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov byte [esp], 0xe
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.0044aab0
jmp 0x44c721
mov ecx, 3
call fcn.00458100
nop
call fcn.004567f0
jmp fcn.0044c650
Function at 0x44ccb0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44ce3c
sub esp, 0x54
lea edi, [esp + 0x28]
xor eax, eax
call fcn.00458325
mov ecx, dword [esp + 0x58]
mov ecx, dword [ecx + 0x14]
jmp 0x44cce4
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x44cde0
mov dword [esp + 0x24], ecx
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x44cd53
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
mov ecx, dword [esp + 0x60]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x5c]
mov ebx, dword [edx]
call ebx
movzx eax, byte [esp + 8]
test al, al
jne 0x44ccdd
add esp, 0x54
ret
mov dword [esp + 0x20], eax
mov ecx, dword [eax]
mov dword [esp + 0x30], ecx
mov dword [esp], ecx
call fcn.00446e30
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x44cde4
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0x24]
mov ebp, dword [ebx]
test ebp, ebp
jne 0x44cdda
xor edx, edx
mov dword [esp + 0x48], edx
mov ebp, dword [ecx + 8]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], 0
cmp ebp, 0x80000000
jne 0x44cd27
lea edx, [esp + 0x28]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov byte [esp + 0xc], 1
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
call fcn.0044e510
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
mov ebx, dword [esp + 0x24]
jmp 0x44cd27
nop
lea edx, [ebx + 0x1c]
jmp 0x44cd85
add esp, 0x54
ret
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
call fcn.0042f560
lea eax, [0xd5bce1]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.0042fe00
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0042fcd0
call fcn.0042f780
call fcn.0042f5d0
lea eax, [0xd467d5]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.0042e730
nop
call fcn.004567f0
jmp fcn.0044ccb0
Function at 0x44e510
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44e681
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 8]
movzx edx, byte [esp + 0x2c]
test dl, dl
je 0x44e541
cmp ecx, 0x80000000
je 0x44e54f
xor eax, eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
add esp, 0x1c
ret
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
call fcn.00447420
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
cmp eax, 0x14
je 0x44e5dd
cmp eax, 0x17
je 0x44e57d
xor eax, eax
mov ecx, dword [esp + 0x14]
jmp 0x44e543
mov dword [esp], ecx
lea ecx, [0xd54af4]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004028b0
movzx eax, byte [esp + 0xc]
test al, al
je 0x44e575
mov eax, dword [esp + 0x30]
test eax, eax
je 0x44e5ca
xor ecx, ecx
mov edx, dword [esp + 0x24]
mov ebx, dword [edx]
cmp dword [eax], ebx
jne 0x44e611
mov edx, dword [eax + 4]
mov ebx, dword [edx]
shl ebx, 2
test cl, cl
je 0x44e5c2
mov eax, edx
mov ecx, ebx
jmp 0x44e543
mov ebx, dword [eax + 8]
and ebx, 0xfffffffc
jmp 0x44e5bc
mov edx, dword [esp + 0x20]
mov edx, dword [edx + 0x14]
mov ebx, edx
add ebx, 0xc
mov eax, dword [edx]
movzx ecx, byte [ebx]
jmp 0x44e5a6
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
mov dword [esp], ecx
lea edx, [0xd513c5]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call fcn.004028b0
movzx eax, byte [esp + 0xc]
test al, al
jne 0x44e59c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
jmp 0x44e570
mov dword [esp], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.00447420
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
call fcn.0042f560
lea eax, [0xd524e8]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.0042fe00
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.0042fe00
call fcn.0042f780
call fcn.0042f5d0
lea eax, [0xd4c813]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0042e730
nop
call fcn.004567f0
jmp fcn.0044e510

Function at 0x44f2e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44f37f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00458327
lea ecx, [0x456160]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004566d0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004567f0
jmp fcn.0044f2e0
Function at 0x457cd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x457d10
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x144e060]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x457d4b
je 0x457d9a
cmp ebx, 0x20
jbe 0x457da0
cmp ebx, 0x40
jbe 0x457dde
jmp 0x457e6f
test ebx, ebx
je 0x457d90
add eax, 0x10
test ax, 0xff0
je 0x457d7c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xe8ef40]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xe8f040]
jmp 0x457d68
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x457d68
pxor xmm1, xmmword [0x144e070]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x144e070]
pxor xmm2, xmmword [0x144e080]
pxor xmm3, xmmword [0x144e090]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x144e070]
pxor xmm2, xmmword [0x144e080]
pxor xmm3, xmmword [0x144e090]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x457ece
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
Function at 0x458d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x1bc
mov dword [esp], esp
mov dword [esp + 4], 0x1bc
call fcn.00458850
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.00458850
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x458e90
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.00457c20
call fcn.00432770
ret

Function at 0x458ef0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Read file via mapping

Disassembly:
mov ecx, dword [esp + 8]
mov dword fs:[0x14], ecx
push ecx
not esi
or ecx, edx

Function at 0x458f00
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Read file via mapping

Disassembly:
add edi, eax
dec edx
neg eax
cmp dword [0xbb093a], 0x53aa2c89
jns 0x458f17
sub dword [0xbbdac4], edx
test edx, edx
jae 0x458f20
call fcn.0081500d
ror ecx, 5
mov edi, dword [0xba0d43]
sub edx, 0xdd9d1de6
rol esi, 9
test eax, 0x2a5c8325
jne 0x458f3c
xor ebx, esi
shl ebx, 5
add ebx, dword [0xbac977]
or eax, esi
mov esi, 0xbab6bf92
inc ebx
mov edx, ecx
xchg ebx, eax
call fcn.00acc0b9
cmp esi, esp
jns 0x458f5f
call fcn.0064e27e
shr ebx, 0x19
cmp esp, eax
jns 0x458f68
add edi, ebp
inc edi
shr edx, 0x1b
inc eax
dec ebx
add edx, ebp
call fcn.00688ca6
xor eax, ebx
add ecx, esi
xchg ecx, esi
or ecx, 0x871477ef
shr ebx, 0x14
ror ecx, 0x17
or edx, ecx
add edi, 0xfac79eb4
and ebx, 0xd9e1573d
mov ecx, 0x79c35199
test dword [0xb9c536], 0x92d351e1
jg 0x458fac
mov dword [0xbbdb59], edi
xchg edi, esi
or ebx, 0x52f5d16e
test dword [0xb96da7], esp
js 0x458fbe
neg eax
shl ebx, 9
shr eax, 0xa
mov edi, dword [0xb99f58]
dec ecx
jne 0x458f9a
call fcn.00acc0b9
Function at 0x458fd0
Capabilities:
Encode data using xor

Disassembly:
xor byte [edi], ah
mov eax, esp
mov esi, dword [0xbadc46]
rol ebx, 3
mov edi, ebp
xchg ecx, edx
neg ecx
cmp ebp, 0x5b5b1e5f
jno 0x458fef
ror eax, 0xf
or esi, dword [0xbb135b]
mov ecx, 0x573812d0
xor ebx, 0xca1cc8b4
call fcn.00a97ee7
shr edx, 3
rol edx, 3
shl edx, 2
and dword [0xbbd871], edx
jno 0x458fea
mov ebx, 0x4adc0300
and edi, 0xb061a61f
xor edi, 0xad0690b1
or dword [0xbbdad2], edx
ror edi, 6
shl edx, 0x1d
dec esi
or esi, dword [0xb8451c]
dec eax
and dword [0xbbdb42], ebx
shl edi, 0x11
or dword [0xbbd960], eax
dec ecx
jne 0x458ffa
and edi, dword [0xbb4e35]
call fcn.00acc0b9
mov ecx, 0x3b0ecb10
not eax
or esi, 0xd7cadb67
neg edx
mov edx, dword [0xb9d60d]
not edi
ror edx, 2
xchg esi, eax
dec edi
add dword [0xbbdbc8], ebx
and edx, ebp
add ebx, 0xf6826b73
sub ebx, esp
and edi, ebp
sub esi, 0x2dfb7f6b
dec ecx
jne 0x45905a
and dword [0xbbd977], edx
ror ecx, 0x15
xchg edx, eax
rol eax, 0x10
call fcn.00a26274
cmp edx, esp
jnp 0x4590ab
xor ecx, 0xb2cecb16
cmp esi, edi
jb 0x4590b5
sub edi, dword [0xba2ded]
rol ecx, 0x19
shl edx, 0x10
call fcn.004ba4d3

Function at 0x97cdd0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x97cebd
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x1fc]
mov edx, dword [eax + 0x200]
mov ecx, dword [ecx + 0x10]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 8]
mov dword [esp + 0x1c], ebx
test edx, edx
je 0x97ce97
mov dword [esp + 0x20], ecx
je 0x97ce26
mov edx, dword [edx + 4]
mov dword [esp + 0x24], edx
lea eax, [0xc39fc0]
mov dword [esp], eax
call fcn.0040be40
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [0x144ddb0]
test ecx, ecx
jne 0x97ceab
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x6c]
mov ecx, dword [ecx + 0x70]
mov edx, dword [edx + 0x30]
mov dword [esp], ecx
lea ecx, [0xd6322f]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x24
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 1
call edx
mov dword [esp], 0x7f
call fcn.004cf3e0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
add esp, 0x28
ret
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0x20]
call fcn.00458080
mov eax, ecx
jmp 0x97ce53
call fcn.004567f0
jmp fcn.0097cdd0
Function at 0xaadc08
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [eax], 0
sub esp, 8
push 0
push 0x14
call fcn.00aaa76d
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xaadc39
mov eax, 7
jmp 0xaadcfe
movzx eax, byte [0xbbbaa4]
test al, al
je 0xaadc58
sub esp, 0xc
push 0xc8
call fcn.00aae872
add esp, 0x10
test eax, eax
je 0xaadc6c
sub esp, 4
push 0x14
push 0
push dword [ebp - 0xc]
call sub.msvcrt.dll_memset
add esp, 0x10
jmp 0xaadcc2
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 4
sub esp, 8
push eax
push 0
push dword [ebp - 0xc]
push 0xaadbd3
push 0
push 0
mov eax, dword [sym.imp.msvcrt.dll__beginthreadex]
call eax
add esp, 0x20
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jne 0xaadcc2
sub esp, 4
push 0x14
push 0
push dword [ebp - 0xc]
call sub.msvcrt.dll_memset
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
test eax, eax
jne 0xaadcf1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
sub esp, 0xc
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
call eax
add esp, 0x10
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret
Function at 0xaaf56c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 0
jns 0xaaf5c0
mov ecx, dword [ebp - 0x40]
xor ch, 0
mov eax, ecx
mov ecx, dword [ebp - 0x3c]
xor ecx, 0x80000000
mov edx, ecx
or eax, edx
test eax, eax
je 0xaaf5ae
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
neg eax
adc edx, 0
neg edx
jmp 0xaaf5b8
mov eax, 0
mov edx, 0x80000000
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0xaaf5cc
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], 0x14
mov byte [ebp - 0x19], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
push 0
push 0xa
push edx
push eax
call fcn.00b71d20
add esp, 0x10
lea ecx, [eax + 0x30]
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov dword [ebp - 0xc], edx
mov edx, ecx
mov byte [ebp + eax - 0x2e], dl
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
push 0
push 0xa
push edx
push eax
call fcn.00b71c10
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
xor ah, 0
mov ebx, eax
mov eax, dword [ebp - 0x14]
xor ah, 0
mov esi, eax
mov eax, esi
or eax, ebx
test eax, eax
jne 0xaaf5d7
cmp dword [ebp - 0x3c], 0
jns 0xaaf643
mov eax, dword [ebp - 0xc]
lea edx, [eax - 1]
mov dword [ebp - 0xc], edx
mov byte [ebp + eax - 0x2e], 0x2d
mov eax, dword [ebp - 0xc]
mov edx, 0x15
sub edx, eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 1]
lea eax, [ebp - 0x2e]
add eax, ecx
sub esp, 4
push edx
push eax
push dword [ebp + 0x10]
call sub.msvcrt.dll_memcpy
add esp, 0x10
nop
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0xaafe58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
and eax, 0
mov esi, eax
mov eax, dword [ebp - 0x34]
and eax, 0xff000000
mov edi, eax
mov eax, esi
xor ah, 0
mov dword [ebp - 0x40], eax
mov eax, edi
xor ah, 0
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov eax, esi
or eax, edi
test eax, eax
je 0xaaff07
mov eax, dword [ebp + 8]
add eax, 8
mov edx, dword [ebp - 0x38]
mov byte [eax], dl
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 8
shr edx, 8
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], 7
jmp 0xaafef7
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, edx
or ecx, 0xffffff80
mov edx, ecx
mov byte [eax], dl
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 7
shr edx, 7
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
sub dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
jns 0xaafec8
mov eax, 9
jmp 0xaaff96
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x38]
mov esi, eax
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov dword [ebp - 0x1c], edx
mov edx, esi
or edx, 0xffffff80
mov byte [ebp + eax - 0x26], dl
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 7
shr edx, 7
mov esi, eax
mov edi, edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x38]
xor ah, 0
mov ecx, eax
mov eax, dword [ebp - 0x34]
xor ah, 0
mov ebx, eax
mov eax, ebx
or eax, ecx
test eax, eax
jne 0xaaff0e
movzx eax, byte [ebp - 0x26]
and eax, 0x7f
mov byte [ebp - 0x26], al
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x18], eax
jmp 0xaaff8d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add edx, eax
lea ecx, [ebp - 0x26]
mov eax, dword [ebp - 0x18]
add eax, ecx
movzx eax, byte [eax]
mov byte [edx], al
sub dword [ebp - 0x18], 1
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x18], 0
jns 0xaaff70
mov eax, dword [ebp - 0x1c]
add esp, 0x34
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xabce20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x88]
test eax, eax
je 0xabce7e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 0x88], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
sub esp, 4
push 8
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
jmp 0xabcf1d
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x8c]
movzx eax, ax
add eax, 0x28
mov edx, 0
sub esp, 8
push edx
push eax
call fcn.00aaad92
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
cmp dword [ebp - 0x1c], 0
jne 0xabcef6
mov eax, dword [ebp + 0xc]
sub eax, 1
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x98]
cdq
mov edi, ebx
imul edi, eax
mov esi, edx
imul esi, ecx
add esi, edi
mul ecx
lea ecx, [esi + edx]
mov edx, ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x3c]
push dword [ebp + 0x10]
push edx
push eax
push ecx
call fcn.00aa96f5
add esp, 0x10
mov eax, 7
jmp 0xabcf43
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 0x28]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x1c]
mov word [eax + 0x1c], 0x20
mov eax, dword [ebp - 0x1c]
mov word [eax + 0x1e], 1
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x78]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
mov dword [eax + 0x78], edx
mov eax, 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xaf986c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov byte [eax + 0x10], 1
sub esp, 4
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push dword [ebp + 8]
call fcn.00b0028e
add esp, 0x20
cmp dword [ebp + 0x10], 0
jne 0xaf98bd
sub esp, 0xc
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push dword [ebp + 8]
call fcn.00b0028e
add esp, 0x20
nop
leave
ret