joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d101a3a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d101a44
repz ret
jmp fcn.6d101ded

Function at 0x6d101aaa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x6d101ab9
pop dword [ebp - 0x24]
mov eax, 0x6d101ab9
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x2f29d6da
add dword [ebp - 0x34], 0x1f286e71
mov dword [ebp - 0x30], 0x6b27446b
sub dword [ebp - 0x30], 0x38f3f826
mov dword [ebp - 0x2c], 0x691e76b2
sub dword [ebp - 0x2c], 0x1cd23284
mov dword [ebp - 0x28], 0x38c50996
add dword [ebp - 0x28], 0xc73af66a
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x25945695
add dword [ebp - 0x34], 0x4ede12c1
mov dword [ebp - 0x30], 0xffb8dc35
add dword [ebp - 0x30], 0x41b38540
mov dword [ebp - 0x2c], 0x927b0560
sub dword [ebp - 0x2c], 0x2f0b98f4
mov dword [ebp - 0x28], 0x3ddd608
add dword [ebp - 0x28], 0xfc2229f8
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4d3
push 0
call eax
mov ecx, 0x5736
xor edx, edx
add edx, eax
mov edi, 0x6d106400
add edi, dword [ebp - 0x24]
mov esi, 0xd5ca336f
add esi, 0xcc8b0d63
sub dword [ebp - 0xc], 0xdf873861
mov ebx, dword [edi]
xor dword [ebp - 0x14], 0xa61bede8
sub ebx, esi
mov dword [ebp - 0x18], 0x90b4e7a9
mov dword [edx], ebx
sub dword [ebp - 0x18], esi
add edx, 0xfbae50b0
sub edx, 0xfbae50ac
add edi, 0xc797a8
sub edi, 0xc797a4
loop 0x6d101bc2
add eax, 0x63fa8001
add eax, 0x9c06cfaa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6d100000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x66587876
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x18]
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov edi, dword [edi]
mov edx, dword [edi + 0x30]
test edx, edx
je 0x6658788a
test ebp, ebp
je 0x6658789d
mov eax, dword [edi + 0x28]
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x665878da
mov edx, dword [edi + 0x30]
movzx eax, word [edx]
test ax, ax
je 0x6658788a
add edx, 2
xor ecx, ecx
nop
lea esi, [eax - 0x41]
lea ebx, [eax + 0x20]
cmp si, 0x1a
cmovb eax, ebx
add edx, 2
movzx eax, ax
add ecx, eax
movzx eax, word [edx - 2]
test ax, ax
jne 0x665878b6
cmp dword [esp + 0x14], ecx
jne 0x6658788a
pop ebx
mov eax, dword [edi + 0x18]
pop esi
pop edi
pop ebp
ret

Function at 0x665879d6
Capabilities:
Access peb ldr_data
Get file size
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov eax, dword [0x6667b878]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.66587876
mov ebx, eax
mov eax, dword [str.LoadLibraryA]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.66587926
mov edi, eax
mov dword [esp + 0x2c], eax
mov eax, dword [str.User32.dll]
mov dword [esp], eax
call edi
mov edx, dword [0x6667b864]
sub esp, 4
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.66587926
mov dword [esp], ebx
mov dword [esp + 0x34], eax
mov eax, dword [0x6667b8ac]
mov dword [esp + 4], eax
call fcn.66587926
mov dword [esp + 0x38], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov ebp, dword [eax + 0x30]
test ebp, ebp
je 0x66587a4f
mov edi, dword [0x6667b86c]
mov esi, dword [eax + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebp
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 8], edi
mov dword [esp + 0x3c], eax
call eax
mov edi, dword [0x6667b86c]
sub esp, 0xc
mov edx, eax
lea ecx, [eax + edi]
test edi, edi
je 0x66587aa0
nop
mov byte [edx], 0
add edx, 1
cmp edx, ecx
jne 0x66587a96
movzx ecx, word [esi]
xor edx, edx
test cx, cx
je 0x66587aba
mov word [eax + edx*2], cx
add edx, 1
movzx ecx, word [esi + edx*2]
test cx, cx
jne 0x66587aaa
cmp word [eax], 0
mov esi, dword [str.__hf_]
je 0x66587e96
xor ecx, ecx
jmp 0x66587ad8
mov ecx, edx
lea edx, [ecx + 1]
cmp word [eax + edx*2], 0
jne 0x66587ad6
add ecx, ecx
cmp word [eax + ecx], 0x5c
je 0x66587afc
xor edi, edi
mov word [eax + edx*2], di
sub edx, 1
cmp word [eax + edx*2 - 2], 0x5c
jne 0x66587aeb
movsx cx, byte [esi]
lea edx, [eax + edx*2]
add esi, 1
test cl, cl
je 0x66587b1b
mov word [edx], cx
movsx cx, byte [esi]
add edx, 2
add esi, 1
test cl, cl
jne 0x66587b0a
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov ecx, 0xfffffffe
xor edx, edx
jmp 0x66587ae4
Function at 0x66587af0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov eax, dword [0x6667b878]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.66587876
mov ebx, eax
mov eax, dword [str.LoadLibraryA]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.66587926
mov edi, eax
mov dword [esp + 0x2c], eax
mov eax, dword [str.User32.dll]
mov dword [esp], eax
call edi
mov edx, dword [0x6667b864]
sub esp, 4
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.66587926
mov dword [esp], ebx
mov dword [esp + 0x34], eax
mov eax, dword [0x6667b8ac]
mov dword [esp + 4], eax
call fcn.66587926
mov dword [esp + 0x38], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov ebp, dword [eax + 0x30]
test ebp, ebp
je 0x66587a4f
mov edi, dword [0x6667b86c]
mov esi, dword [eax + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebp
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 8], edi
mov dword [esp + 0x3c], eax
call eax
mov edi, dword [0x6667b86c]
sub esp, 0xc
mov edx, eax
lea ecx, [eax + edi]
test edi, edi
je 0x66587aa0
nop
mov byte [edx], 0
add edx, 1
cmp edx, ecx
jne 0x66587a96
movzx ecx, word [esi]
xor edx, edx
test cx, cx
je 0x66587aba
mov word [eax + edx*2], cx
add edx, 1
movzx ecx, word [esi + edx*2]
test cx, cx
jne 0x66587aaa
cmp word [eax], 0
mov esi, dword [str.__hf_]
je 0x66587e96
xor ecx, ecx
jmp 0x66587ad8
mov ecx, edx
lea edx, [ecx + 1]
cmp word [eax + edx*2], 0
jne 0x66587ad6
add ecx, ecx
cmp word [eax + ecx], 0x5c
je 0x66587afc
xor edi, edi
mov word [eax + edx*2], di
sub edx, 1
cmp word [eax + edx*2 - 2], 0x5c
jne 0x66587aeb
movsx cx, byte [esi]
lea edx, [eax + edx*2]
add esi, 1
test cl, cl
je 0x66587b1b
mov word [edx], cx
movsx cx, byte [esi]
add edx, 2
add esi, 1
test cl, cl
jne 0x66587b0a
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov ecx, 0xfffffffe
xor edx, edx
jmp 0x66587ae4

Function at 0x66587b20
Capabilities:
Get file size
Read file on windows

Disassembly:
add byte [eax], al
add bh, al
inc esp
and al, 0x14
add byte [eax], 0
add bh, al
inc esp
and al, 0x10
add eax, dword [eax]
add byte [eax], al
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x66587d96
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [0x6667b8a4]
sub esp, 8
mov dword [esp + 0x30], eax
call ebp
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], esi
call eax
mov ecx, dword [0x6667b8a4]
sub esp, 0xc
mov ebp, eax
lea edx, [eax + ecx]
test ecx, ecx
je 0x66587bb3
mov byte [eax], 0
add eax, 1
cmp eax, edx
sal byte [ebp - 0xa], 1
mov eax, dword [0x6667b880]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
call eax
sub esp, 0x10
mov dword [esp], 0
mov eax, dword [esp + 0x38]
call eax
sub esp, 4
jmp 0x66587b62
Function at 0x66588f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, ecx
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [edx]
movzx eax, byte [ecx]
mov dword [esp + 4], edx
lea ecx, [edi + ebx]
mov byte [esp + 0xb], al
mov dword [esp], ecx
test al, al
je 0x66588fe0
mov esi, ebp
xor edx, edx
lea esi, [esi]
lea esi, [esi]
movzx ecx, al
test byte [ecx + 0x66690980], 6
jne 0x66588fc0
cmp al, 0x5f
jne 0x66588fce
movzx eax, byte [esi + 1]
add esi, 1
add edx, 1
test al, al
jne 0x66588fb0
movzx eax, byte [esp + 0xb]
test byte [eax + 0x66690980], 4
je 0x66589068
mov eax, dword [esp]
add ebx, 1
mov ecx, 1
mov byte [eax], 0x22
movzx eax, byte [ebp]
test al, al
jne 0x6658900d
jmp 0x6658904b
movzx eax, byte [ebp + 1]
add ebp, 1
mov ebx, edx
test al, al
je 0x66589030
mov byte [edi + ebx], al
lea edx, [ebx + 1]
cmp byte [ebp], 0x22
lea esi, [edi + edx]
jne 0x66589000
add ebp, 1
mov byte [esi], 0x22
add ebx, 2
movzx eax, byte [ebp]
lea esi, [edi + ebx]
test al, al
jne 0x6658900d
mov dword [esp], esi
test ecx, ecx
jne 0x66589051
mov eax, dword [esp]
mov byte [eax], 0
mov eax, dword [esp + 4]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edi + ebx]
mov dword [esp], eax
mov eax, dword [esp]
add ebx, 1
mov byte [eax], 0x22
lea eax, [edi + ebx]
mov dword [esp], eax
jmp 0x66589037
mov dword [esp + 0x18], 0x3b
cmp edx, 1
jle 0x665890a8
lea ecx, [esp + 0x18]
mov eax, ebp
call fcn.66588e90
cmp dword [esp + 0x18], 0x3b
jne 0x66588fe0
cmp byte [esi], 0
jne 0x66588fe0
movzx eax, byte [ebp]
test al, al
je 0x66589037
xor ecx, ecx
jmp 0x6658900d
cmp byte [esi], 0
setne al
xor edx, 1
and edx, 1
or al, dl
jne 0x66588fe0
movzx eax, byte [esp + 0xb]
xor ecx, ecx
jmp 0x6658900d

Function at 0x66589ad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, eax
cmp eax, 0x7f
jg 0x66589ae8
lea edx, [eax - 0x41]
lea eax, [eax + 0x20]
cmp edx, 0x1a
cmovae eax, ecx
ret
cmp eax, 0xffff
jg 0x66589b88
push ebp
mov eax, 0xa2
mov ebp, 0xffffffff
push edi
mov edi, edx
mov edx, 0x3f1
push esi
mov esi, 0xa2
push ebx
xor ebx, ebx
jmp 0x66589b30
lea ebx, [eax + 1]
mov ebp, eax
cmp ebx, esi
jg 0x66589b3d
lea eax, [ebx + esi]
mov edx, eax
sar edx, 1
movzx edx, word [edx*4 + 0x66687a00]
sar eax, 1
cmp ecx, edx
jns 0x66589b18
lea esi, [eax - 1]
cmp ebx, esi
jle 0x66589b21
movzx edx, word [ebp*4 + 0x66687a00]
movzx eax, byte [ebp*4 + 0x66687a03]
add eax, edx
cmp ecx, eax
jge 0x66589b76
movzx eax, byte [ebp*4 + 0x66687a02]
xor edx, ecx
mov ebx, eax
and ebx, 1
test ebx, edx
jne 0x66589b76
shr al, 1
movzx eax, al
add cx, word [eax + eax + 0x66687560]
movzx ecx, cx
mov eax, ecx
test edi, edi
jne 0x66589ba0
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [eax - 0x10400]
lea eax, [eax + 0x28]
cmp edx, 0x28
cmovae eax, ecx
ret
xor edx, edx
cmp edi, 2
pop ebx
pop esi
sete dl
pop edi
pop ebp
jmp fcn.66584970
Function at 0x66598910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x5c
movzx ebp, byte [eax + 4]
mov eax, ebp
test al, al
je 0x6659893d
mov edx, 4
mov eax, esi
call fcn.66588b00
mov edi, eax
test eax, eax
jne 0x66598ab0
movzx ebp, byte [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 0xa4]
mov dword [esi + 0xd8], 0
mov edi, dword [esi + 0xdc]
mov eax, dword [esi + 0xa0]
mov dword [esp + 0x2c], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x34], edi
mov edi, dword [esi + 0x3c]
mov dword [esp + 0x3c], ecx
lea ecx, [edx + 0x78]
xor edx, edx
mov dword [esp + 0x28], eax
mov eax, ecx
mov dword [esp + 0x30], edi
mov edi, 7
mov dword [esp + 0x38], ecx
call fcn.6658bcf0
mov ebx, eax
test eax, eax
je 0x66598a56
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], ecx
call sub.msvcrt.dll_memset
lea edx, [ebx + 0x78]
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov dword [ebx + 8], edx
mov eax, 0xffffffff
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x2c]
mov word [ebx + 0x28], ax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x14], edx
mov edx, 0x101
mov word [ebx + 0x30], dx
mov edx, ebp
test dl, dl
mov edx, 2
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x34]
cmovne ebp, edx
mov dword [ebx], ecx
mov dword [ebx + 4], edi
mov edx, ebp
mov dword [ebx + 0x6c], eax
mov byte [ebx + 0x2b], dl
lea edx, [esp + 0x4c]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x4c], 0x80006
mov dword [esp + 0xc], 0x80006
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [ecx + 0x18]
mov edi, eax
test eax, eax
jne 0x66598a78
test byte [esp + 0x4c], 1
jne 0x66598aa8
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
mov dword [esp], ecx
call dword [eax + 0x30]
test ah, 4
je 0x66598a47
mov byte [ebx + 0x30], 0
test ah, 0x10
je 0x66598a50
mov byte [ebx + 0x31], 0
mov dword [esi + 0xd8], ebx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax]
test eax, eax
je 0x66598a6b
cmp dword [eax], 2
jle 0x66598a6b
mov eax, esi
call fcn.6658e310
add esp, 0x5c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
xor edx, edx
call fcn.6658ae10
mov ebp, dword [ebx + 8]
mov eax, dword [ebp]
test eax, eax
je 0x66598a98
mov dword [esp], ebp
call dword [eax + 4]
mov dword [ebp], 0
mov dword [esp], ebx
call sym.libsqlite3_0.dll_sqlite3_free
jmp 0x66598a56
mov byte [ebx + 0x2e], 1
jmp 0x66598a32
mov edx, dword [esi + 0x3c]
mov eax, dword [edx]
test eax, eax
je 0x66598af0
cmp byte [esi + 0xd], 0
jne 0x66598ad2
mov dword [esp + 4], 1
mov dword [esp], edx
call dword [eax + 0x20]
mov eax, dword [esi + 0x3c]
mov eax, dword [eax]
cmp byte [esi + 0x11], 5
je 0x66598adc
mov byte [esi + 0x11], 1
movzx edx, byte [esi + 0xc]
mov byte [esi + 0x12], dl
jmp 0x66598a5b
movzx eax, byte [esi + 0xc]
mov byte [esi + 0x12], al
jmp 0x66598a6b
Function at 0x6659af50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
xor ebp, ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xc
mov dword [esp + 8], edx
mov edx, dword [eax + 0x14]
mov dword [esp], eax
test edx, edx
jle 0x6659afe5
lea esi, [esi]
mov edi, ebp
xor edi, 1
cmp ebp, 2
cmovge edi, ebp
mov eax, edi
mov dword [esp + 4], edi
mov edi, dword [esp]
shl eax, 4
add eax, dword [edi + 0x10]
mov edi, eax
test ebx, ebx
je 0x6659afc2
mov esi, dword [eax]
xor eax, eax
jmp 0x6659afb2
movzx ecx, byte [ecx + 0x66690a80]
cmp byte [edx + 0x66690a80], cl
jne 0x6659aff0
add eax, 1
movzx edx, byte [esi + eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x6659afa0
test edx, edx
jne 0x6659afaf
mov eax, dword [edi + 0xc]
mov edx, dword [esp + 8]
xor ecx, ecx
add eax, 0x18
call fcn.66593b10
mov eax, dword [eax + 8]
test eax, eax
jne 0x6659afe7
mov eax, dword [esp]
add ebp, 1
cmp dword [eax + 0x14], ebp
jg 0x6659af70
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 4]
test eax, eax
jne 0x6659afda
xor edx, edx
mov eax, 0x6d
jmp 0x6659b021
movzx ecx, byte [ecx + 0x66690a80]
cmp byte [eax + 0x66690a80], cl
jne 0x6659afda
movzx eax, byte [edx + 0x6667dd05]
add edx, 1
movzx ecx, byte [ebx + edx]
cmp eax, ecx
jne 0x6659b008
test eax, eax
jne 0x6659b017
jmp 0x6659afc2

Function at 0x6659c0d0
Capabilities:
Create thread

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x2c
movzx edi, byte [eax + 0x3b]
mov byte [eax + 0x38], 1
sub edi, 1
test edi, edi
jg 0x6659c102
jmp 0x6659c13a
lea eax, [edx + edx*8]
mov edx, dword [ebx + eax*8 + 0x40]
test edx, edx
je 0x6659c140
add esi, 1
cmp esi, edi
je 0x6659c140
movzx eax, byte [ebx + 0x3a]
lea eax, [esi + eax + 1]
cdq
idiv edi
lea eax, [edx + edx*8]
shl eax, 3
mov ecx, dword [ebx + eax + 0x44]
lea ebp, [ebx + eax + 0x40]
test ecx, ecx
je 0x6659c0f0
mov eax, ebp
mov dword [esp + 0x1c], edx
call fcn.6658c910
mov edx, dword [esp + 0x1c]
test eax, eax
je 0x6659c0f0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebp, ebp
lea esi, [esi]
cmp edi, esi
je 0x6659c1a8
lea ecx, [ebx + 0x40]
mov eax, ebp
mov edx, dword [ebp + 0x14]
sub eax, ecx
sar eax, 3
imul eax, eax, 0x38e38e39
mov byte [ebx + 0x3a], al
mov eax, dword [ebx + 0x24]
mov dword [ebp + 0x10], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp + 0x14], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp + 0x18], eax
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x2c], 0
test edx, edx
je 0x6659c1c0
mov dword [ebx + 0x28], edx
mov dword [esp], edx
call dword [0x6667ce2c]
mov dword [ebx + 0x34], eax
add esp, 0x2c
mov ecx, ebp
mov eax, ebp
mov edx, 0x6659c0b0
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6658c4f0
add esp, 0x2c
lea eax, [edi + edi*8]
lea edx, [ebx + 0x24]
lea eax, [ebx + eax*8 + 0x40]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6659be10
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x6659c18d
mov eax, dword [ebx + 0x34]
cdq
call fcn.6658bcf0
mov dword [ebx + 0x28], eax
test eax, eax
jne 0x6659c18d
mov eax, 7
jmp 0x6659c132
Function at 0x665bf6f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov eax, edx
mov edx, ecx
mov ecx, dword [esp + 0x34]
movzx esi, byte [ecx]
mov ebx, esi
cmp bl, 0xb0
je 0x665bf768
mov ebx, esi
cmp bl, 0xa6
je 0x665bf780
mov edi, edx
mov esi, eax
or edi, eax
je 0x665bf7a0
add esi, 0xffffffff
mov edi, edx
adc edi, 0xffffffff
mov ebx, esi
xor esi, esi
and ebx, eax
and edi, edx
or ebx, edi
je 0x665bf748
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x34], ecx
mov ecx, edx
mov edx, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x30], ebp
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.665bf570
sub edi, 0x36
cmp edi, 3
ja 0x665bf71c
mov ecx, dword [ecx + 0x14]
mov ecx, dword [ecx + 4]
movzx esi, byte [ecx]
mov ebx, esi
cmp bl, 0xa6
jne 0x665bf71c
mov eax, dword [ecx + 0x1c]
mov esi, 1
mov dword [ebp], eax
movsx eax, word [ecx + 0x20]
mov dword [ebp + 4], eax
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x665ca0e0
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
test ebx, ebx
je 0x665ca120
test esi, esi
je 0x665ca120
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, ebx
and eax, 0x3fffffff
mov ecx, eax
mov eax, dword [esi + 0x80]
add esp, 0x14
pop ebx
pop esi
jmp fcn.66587bb0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret

Function at 0x665cd390
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0x3c
mov edx, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], 0
mov dword [edx], 0
test eax, eax
je 0x665cd448
mov eax, edi
mov esi, ecx
sub eax, 1
js 0x665cd4a4
mov edx, 0xd
lea esi, [esi]
movsx ebp, byte [esi + eax]
lea ecx, [edx*8]
xor ecx, ebp
xor edx, ecx
sub eax, 1
jae 0x665cd3d0
lea eax, [edx*8]
xor edx, eax
mov eax, dword [esp + 0x18]
xor edx, ebx
and edx, 0x1ff
lea eax, [eax + edx*4]
mov ebp, dword [eax]
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x665cd417
jmp 0x665cd458
mov ebp, dword [ebp + 0xc]
test ebp, ebp
je 0x665cd458
cmp dword [ebp + 8], ebx
jne 0x665cd410
cmp dword [ebp + 4], edi
jne 0x665cd410
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebp]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x665cd410
mov edi, dword [esp + 0x54]
mov dword [edi], 1
jmp 0x665cd44a
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edi + 0x10]
xor edx, edx
mov ecx, edx
mov edx, eax
lea eax, [esp + 0x2c]
call fcn.665cc500
mov edx, eax
test eax, eax
je 0x665cd4b3
lea eax, [edx + 0x10]
mov dword [edx + 4], edi
mov dword [edx], eax
mov dword [edx + 8], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [edi]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [edi], edx
jmp 0x665cd44a
mov eax, 0x68
mov edx, 0xd
jmp 0x665cd3eb
mov eax, dword [esp + 0x2c]
jmp 0x665cd44a
Function at 0x665e0910
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x2c
mov eax, dword [eax + 0x34]
mov edx, dword [edx + 0x38]
cmp dword [esi + 4], 1
mov edi, dword [ebx + 0x38]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
movzx eax, byte [ebx + 9]
mov dword [esp + 0x14], edx
jne 0x665e0941
lea ecx, [edx + 0x64]
mov dword [esp + 0x14], ecx
movzx ebp, al
movzx eax, byte [edi + ebp + 5]
movzx ecx, byte [edi + ebp + 6]
shl eax, 8
or eax, ecx
mov ecx, dword [esp + 0x10]
add edx, eax
mov ecx, dword [ecx + 0x28]
mov dword [esp], edx
mov dword [esp + 0x18], ecx
sub ecx, eax
add eax, edi
add edi, ebp
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
movzx eax, word [ebx + 0x18]
movzx edx, word [ebx + 0x12]
mov dword [esp + 4], edi
lea eax, [edx + eax*2]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov byte [esi], 0
mov eax, esi
call fcn.665afde0
test eax, eax
je 0x665e09b8
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
call fcn.665b1600
test eax, eax
jne 0x665e09a3
mov eax, dword [esp + 0x10]
cmp byte [eax + 0x11], 0
je 0x665e09a9
mov eax, esi
call fcn.665e0810
mov ebx, dword [esp + 0x1c]
mov dword [ebx], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6661fac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, 6
mov dword [esp + 4], 0
jmp fcn.6661f330

Function at 0x6661fae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
jmp fcn.6661f330
Function at 0x6664ef10
Capabilities:
Reference sql statements

Disassembly:
push ebp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x2c
mov eax, dword [edx + 0x20]
test ecx, ecx
je 0x6664ef90
mov dword [esp + 4], eax
mov dword [esp], str.PRAGMA__Q.page_size
mov dword [esp + 0x1c], 0
call sym.libsqlite3_0.dll_sqlite3_mprintf
mov ebx, eax
test eax, eax
je 0x6664eff0
mov edx, eax
lea ecx, [esp + 0x1c]
mov eax, edi
call fcn.6664ee90
mov ebp, eax
test eax, eax
je 0x6664f000
mov dword [esp], edi
call sym.libsqlite3_0.dll_sqlite3_errmsg
mov dword [esp], 0x6667eaa2
mov dword [esp + 4], eax
call sym.libsqlite3_0.dll_sqlite3_mprintf
mov edi, dword [esp + 0x40]
mov dword [edi], eax
mov dword [esp], ebx
call sym.libsqlite3_0.dll_sqlite3_free
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [edx + 0x24]
mov dword [esp + 4], eax
mov dword [esp], str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
mov dword [esp + 8], edx
call sym.libsqlite3_0.dll_sqlite3_mprintf
mov ebx, eax
test eax, eax
je 0x6664eff0
mov edx, eax
lea ecx, [esi + 0x10]
mov eax, edi
call fcn.6664ee90
mov ebp, eax
test eax, eax
jne 0x6664ef5b
cmp dword [esi + 0x10], 0x1bf
jg 0x6664ef79
mov eax, dword [esi + 0x24]
mov dword [esp], str.undersize_RTree_blobs_in___q_node_
mov ebp, 0x10b
mov dword [esp + 4], eax
call sym.libsqlite3_0.dll_sqlite3_mprintf
mov esi, dword [esp + 0x40]
mov dword [esi], eax
jmp 0x6664ef79
mov ebp, 7
jmp 0x6664ef5b
movzx edx, byte [esi + 0x17]
mov eax, dword [esp + 0x1c]
imul edx, edx, 0x33
sub eax, 0x40
add edx, 4
cmp eax, edx
cmovg eax, edx
mov dword [esi + 0x10], eax
jmp 0x6664ef79