joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ec0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4e5640
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x50e74c]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50e74c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
movq qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x2c], 1
lea ecx, [esp + 0x34]
cmp dword [esp + 0x48], 8
lea edx, [esp + 0x14]
cmovae ecx, dword [esp + 0x34]
call fcn.004042b0
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ebp, eax
jne 0x403f4f
xor bl, bl
jmp 0x403f8b
mov ebx, eax
xor ecx, ecx
sub ebx, ebp
xor edi, edi
add ebx, 3
mov esi, ebp
shr ebx, 2
cmp ebp, eax
cmova ebx, ecx
test ebx, ebx
je 0x403f89
push dword [esi]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x403f81
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc edi
add esi, 4
cmp edi, ebx
jne 0x403f68
mov bl, 1
mov byte [esp + 0x2c], 0
test ebp, ebp
je 0x403fb5
push ebp
call fcn.004c515a
add esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x403fd0
push dword [esp + 0x34]
call fcn.004c515a
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov word [esp + 0x34], ax
mov al, bl
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.004c515f
add esp, 0x1c
ret
Function at 0x4042b0
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x4e5707
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x50e74c]
xor eax, esp
mov dword [esp + 0x648], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50e74c]
xor eax, esp
push eax
lea eax, [esp + 0x660]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov ebp, eax
mov dword [esp + 0x28], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40431b
xor al, al
jmp 0x40448d
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40447c
nop
cmp dword [esp + 0x28], ebp
je 0x404468
xor eax, eax
push 0x206
push eax
mov word [esp + 0x45c], ax
lea eax, [esp + 0x45e]
push eax
call fcn.004cb9a0
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x464]
push 0x104
push eax
call fcn.004c5cd0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x26c], ax
lea eax, [esp + 0x26e]
push eax
call fcn.004cb9a0
push esi
lea eax, [esp + 0x274]
push 0x104
push eax
call fcn.004c5cd0
lea eax, [esp + 0x27c]
push eax
call fcn.004e4a98
mov esi, eax
lea eax, [esp + 0x488]
push eax
call fcn.004e4a98
add esp, 0x38
lea ecx, [ecx]
mov cx, word [eax]
cmp cx, word [esi]
jne 0x4043e6
test cx, cx
je 0x4043e2
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x4043e6
add eax, 4
add esi, 4
test cx, cx
jne 0x4043c0
xor eax, eax
jmp 0x4043eb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x404464
mov eax, dword [edi + 4]
lea ecx, [esp + 0x28]
cmp ecx, eax
jae 0x404446
mov ecx, dword [edi]
lea edx, [esp + 0x28]
cmp ecx, edx
ja 0x404446
mov esi, edx
sub esi, ecx
sar esi, 2
cmp eax, dword [edi + 8]
jne 0x404418
push ecx
mov ecx, edi
call fcn.004044f0
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x668], 0
test ecx, ecx
je 0x404439
mov eax, dword [eax + esi*4]
mov dword [ecx], eax
mov dword [esp + 0x668], 0xffffffff
jmp 0x404460
cmp eax, dword [edi + 8]
jne 0x404453
push ecx
mov ecx, edi
call fcn.004044f0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x404460
mov eax, dword [esp + 0x28]
mov dword [ecx], eax
add dword [edi + 4], 4
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x404330
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [edi]
xor eax, eax
cmp ecx, dword [edi + 4]
setne al
mov ecx, dword [esp + 0x660]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x648]
xor ecx, esp
call fcn.004c515f
add esp, 0x658
ret

Function at 0x40b010
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x40b03d
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x4f4d50]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x40b020
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x40b0b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
mov ebp, ecx
mov ecx, 0x80
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebp]
jne 0x40b0de
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x70dab8]
test eax, eax
je 0x40b0e9
call eax
lea eax, [esi*8]
push eax
call fcn.004073b0
mov ecx, dword [0x70dabc]
add esp, 4
mov ebx, eax
mov dword [esp + 0x18], ebx
test ecx, ecx
je 0x40b10b
call ecx
test ebx, ebx
je 0x40b0d4
push dword [ebp + 0xc]
call fcn.004076a0
add esp, 4
mov dword [ebp + 0xc], ebx
push ebx
call dword [0x510f4c]
shr eax, 3
add esp, 4
mov dword [esp + 0x14], eax
mov dword [ebp], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.004cb9a0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp + 8], 0
test ecx, ecx
je 0x40b1ec
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x40b17f
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x4f4d50]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x40b162
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea esi, [eax + edx*8]
test esi, esi
je 0x40b1c9
mov eax, dword [esi]
test eax, eax
je 0x40b19f
mov edx, dword [esi + 4]
jmp 0x40b1a1
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x40b1c9
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x40b1c1
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x40b1e2
mov dword [ebp + 8], ecx
mov dword [edx + 4], ecx
jmp 0x40b1e2
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x40b1d8
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [ebp + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x40b156
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x40b310
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [ecx + 0xc], 0
mov eax, edx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
je 0x40b365
push ebx
push esi
xor esi, esi
mov ebx, eax
push edi
mov edi, ebp
test ebp, ebp
jle 0x40b356
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x4f4d50]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x40b335
mov ecx, dword [esp + 0x10]
mov eax, esi
xor edx, edx
div dword [ecx]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
jmp 0x40b367
xor edx, edx
push edx
push ebp
mov edx, eax
call fcn.0040b200
add esp, 8
pop ebp
test eax, eax
je 0x40b37f
mov eax, dword [eax + 8]
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x40b390
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [esp + 0x10], edi
cmp dword [esi], 0
je 0x40b3dc
mov eax, dword [esp + 0x18]
mov ebp, edi
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x40b3ce
movzx eax, byte [ebp]
lea ecx, [edi*8]
dec ebx
lea ebp, [ebp + 1]
movzx edx, byte [eax + 0x4f4d50]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x40b3b0
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [esp + 0x10]
mov ebp, edx
jmp 0x40b3de
xor ebp, ebp
push ebp
push dword [esp + 0x1c]
mov edx, edi
mov ecx, esi
call fcn.0040b200
add esp, 8
test eax, eax
je 0x40b421
mov ecx, dword [esp + 0x1c]
mov ebx, dword [eax + 8]
test ecx, ecx
jne 0x40b413
push ebp
mov edx, eax
mov ecx, esi
call fcn.0040b2b0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x40b4b7
push 0x14
call fcn.004073b0
mov edi, eax
add esp, 4
test edi, edi
je 0x40b419
mov eax, dword [esp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x40b481
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x40b481
add edx, edx
mov ecx, esi
call fcn.0040b0b0
test eax, eax
je 0x40b481
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
call fcn.0040b010
xor edx, edx
div dword [esi]
mov ebp, edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40b49e
push edi
lea edx, [eax + ebp*8]
mov ecx, esi
call fcn.0040b050
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x40b4ad
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x438ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc8
mov eax, dword [0x50e74c]
xor eax, esp
mov dword [esp + 0xc4], eax
mov eax, dword [edx + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
movdqu xmm0, xmmword [eax]
mov ecx, dword [edx + 0x14]
lea edx, [esp + 0x9c]
movdqu xmmword [esp + 0x9c], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esp + 0xac], xmm0
movdqu xmm0, xmmword [eax + 0x20]
lea eax, [esp + 0x3c]
mov byte [esp + 0xc], 0x45
mov dword [esp + 0x18], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x48], eax
movdqu xmmword [esp + 0xbc], xmm0
mov byte [esp + 0x3c], 0x50
mov eax, dword [ecx + 8]
mov eax, dword [eax]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x78], eax
mov byte [esp + 0x6c], 0x4e
mov eax, dword [ecx + 8]
mov ecx, esi
mov eax, dword [eax + 0x18]
mov dword [esp + 0x7c], eax
lea eax, [esp + 8]
push eax
call fcn.00438650
mov cl, byte [esp + 0xa0]
lea edx, [esp + 0x10]
and dword [esp + 0xa4], 0xffffefff
add esp, 4
cmp dword [esp + 0xd8], 0
mov byte [esp + 0xc2], cl
mov ecx, esi
mov byte [esp + 0x9c], 0x84
push dword [esp + 0xdc]
mov dword [esp + 0xbc], eax
push dword [esp + 0xd8]
je 0x438bba
call fcn.00438c30
jmp 0x438bbf
call fcn.00438f00
mov edx, dword [esp + 0x10]
add esp, 8
test edx, edx
je 0x438c0a
mov bl, byte [esi + 0x13]
cmp bl, 8
jae 0x438c0a
xor ecx, ecx
lea eax, [esi + 0x68]
cmp dword [eax + 0x10], edx
je 0x438c06
inc ecx
add eax, 0x18
cmp ecx, 0xa
jl 0x438bd7
movzx eax, bl
mov dword [esi + eax*4 + 0x1c], edx
inc byte [esi + 0x13]
pop esi
pop ebx
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.004c515f
add esp, 0xc8
ret
mov byte [eax + 8], 1
mov ecx, dword [esp + 0xcc]
pop esi
pop ebx
xor ecx, esp
call fcn.004c515f
add esp, 0xc8
ret
Function at 0x43d4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
xor eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov ebx, edx
mov dword [esp + 4], eax
push edi
test edx, edx
je 0x43d4ed
cmp byte [edx], al
je 0x43d4e5
lea ecx, [ecx]
inc ebx
cmp byte [ebx], al
jne 0x43d4e0
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [ecx + 0x14], eax
jle 0x43d598
push ebp
push esi
lea ebx, [ebx]
mov ebp, edi
cmp edi, 2
jge 0x43d50a
xor ebp, 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43d561
mov ecx, dword [ecx + 0x10]
mov edx, ebp
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x43d541
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4f4d50]
cmp cl, byte [edx + 0x4f4d50]
jne 0x43d541
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x43d524
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x4f4d50]
movzx ecx, byte [ecx + 0x4f4d50]
sub eax, ecx
jne 0x43d580
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x10]
add ebp, ebp
push ebx
mov ecx, dword [eax + ebp*8 + 0xc]
add ecx, 8
call fcn.0040b310
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x43d596
jmp 0x43d584
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc edi
mov edx, dword [esp + 0x18]
cmp edi, dword [ecx + 0x14]
jl 0x43d500
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret

Function at 0x43d6b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 8], edx
mov ebx, edx
push edi
test edx, edx
je 0x43d6d5
cmp byte [edx], 0
je 0x43d6cd
inc ebx
cmp byte [ebx], 0
jne 0x43d6c7
sub ebx, edx
and ebx, 0x3fffffff
mov eax, dword [ecx + 0x14]
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x43d78c
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x18], ecx
push esi
mov edi, edi
mov eax, edi
cmp edi, 2
jge 0x43d6fa
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x43d75d
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x43d741
jmp 0x43d720
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4f4d50]
cmp cl, byte [edx + 0x4f4d50]
jne 0x43d73d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x43d720
mov edx, dword [esp + 0x10]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x4f4d50]
movzx ecx, byte [ecx + 0x4f4d50]
sub eax, ecx
jne 0x43d76f
mov eax, dword [esp + 0x14]
push ebx
lea ecx, [eax + 0x18]
call fcn.0040b310
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x43d782
mov edx, dword [esp + 0x10]
inc edi
mov ecx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jl 0x43d6f0
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x43d7a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
add edx, edx
mov ecx, dword [esp + 0x24]
mov esi, ecx
mov dword [esp + 0x14], edi
mov eax, dword [edi + 0x10]
mov ebp, dword [eax + edx*8 + 0xc]
add ebp, 0x18
mov dword [esp + 0x1c], ebp
test ecx, ecx
je 0x43d7de
cmp byte [ecx], 0
je 0x43d7d6
lea esp, [esp]
inc esi
cmp byte [esi], 0
jne 0x43d7d0
sub esi, ecx
and esi, 0x3fffffff
mov eax, dword [ebp]
xor ebx, ebx
mov dword [esp + 0x18], eax
test eax, eax
je 0x43d826
mov ebp, esi
test esi, esi
jle 0x43d818
mov edi, ecx
movzx eax, byte [edi]
lea ecx, [ebx*8]
dec ebp
lea edi, [edi + 1]
movzx edx, byte [eax + 0x4f4d50]
xor edx, ecx
xor ebx, edx
test ebp, ebp
jg 0x43d7f3
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
mov eax, ebx
mov ebp, dword [esp + 0x1c]
xor edx, edx
div dword [esp + 0x18]
mov ebx, edx
push ebx
mov edx, ecx
mov ecx, ebp
push esi
call fcn.0040b200
add esp, 8
test eax, eax
je 0x43d894
mov esi, dword [eax + 8]
mov edx, eax
push ebx
mov ecx, ebp
call fcn.0040b2b0
add esp, 4
test esi, esi
je 0x43d894
mov edx, dword [esi + 0xc]
mov ecx, dword [edx + 8]
cmp ecx, esi
jne 0x43d85e
mov eax, dword [esi + 0x14]
mov dword [edx + 8], eax
jmp 0x43d877
test ecx, ecx
je 0x43d877
mov eax, dword [ecx + 0x14]
cmp eax, esi
je 0x43d871
mov ecx, eax
test ecx, ecx
jne 0x43d862
jmp 0x43d877
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi + 0x24]
mov ecx, edi
call fcn.004350a0
mov edx, dword [esi + 0x10]
mov ecx, edi
call fcn.00407740
mov edx, esi
mov ecx, edi
call fcn.00407740
or dword [edi + 0x18], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x43db30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0x2c], ebp
mov ebx, ecx
mov dword [esp + 0x18], ebx
test ebp, ebp
je 0x43dcd4
test ebx, ebx
je 0x43db5e
cmp dword [ebx + 0x200], 0
jne 0x43db6d
mov eax, 0xffff
add word [ebp + 0x28], ax
jne 0x43dcd4
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], edi
test edi, edi
je 0x43dc79
lea esp, [esp]
mov eax, dword [edi + 0x14]
mov dword [esp + 0x28], eax
test ebx, ebx
je 0x43db98
cmp dword [ebx + 0x200], 0
jne 0x43dc46
mov esi, dword [edi]
mov ecx, esi
mov dword [esp + 0x1c], esi
test esi, esi
je 0x43dbbe
cmp byte [esi], 0
je 0x43dbb6
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x43dbb0
sub ecx, esi
and ecx, 0x3fffffff
mov ebp, dword [edi + 0x18]
add ebp, 0x18
mov dword [esp + 0x24], ebp
mov eax, dword [ebp]
mov dword [esp + 0x20], eax
test eax, eax
je 0x43dc1e
xor edi, edi
mov dword [esp + 0x10], esi
mov ebp, ecx
test ecx, ecx
jle 0x43dc06
mov ebx, esi
movzx eax, byte [ebx]
lea edx, [edi*8]
dec ebp
lea ebx, [ebx + 1]
movzx esi, byte [eax + 0x4f4d50]
xor esi, edx
xor edi, esi
test ebp, ebp
jg 0x43dbe1
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov eax, edi
mov ebp, dword [esp + 0x24]
xor edx, edx
mov edi, dword [esp + 0x14]
div dword [esp + 0x20]
mov eax, edx
mov dword [esp + 0x10], edx
jmp 0x43dc24
xor eax, eax
mov dword [esp + 0x10], eax
push eax
push ecx
mov edx, esi
mov ecx, ebp
call fcn.0040b200
add esp, 8
test eax, eax
je 0x43dc46
push dword [esp + 0x10]
mov edx, eax
mov ecx, ebp
call fcn.0040b2b0
add esp, 4
mov edx, dword [edi + 0x24]
mov ecx, ebx
call fcn.004350a0
mov edx, dword [edi + 0x10]
mov ecx, ebx
call fcn.00407740
mov edx, edi
mov ecx, ebx
call fcn.00407740
mov eax, dword [esp + 0x28]
mov edi, eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x43db80
mov ebp, dword [esp + 0x2c]
mov edx, ebp
mov ecx, ebx
call fcn.004498a0
mov edx, ebp
mov ecx, ebx
call fcn.0043dac0
mov edx, dword [ebp]
mov ecx, ebx
call fcn.00407740
mov edx, dword [ebp + 0x14]
mov ecx, ebx
call fcn.00407740
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43dcb8
mov edx, esi
mov ecx, ebx
call fcn.004529d0
mov edx, esi
mov ecx, ebx
call fcn.00407740
mov edx, dword [ebp + 0x18]
mov ecx, ebx
call fcn.00435c40
mov edx, ebp
mov ecx, ebx
call fcn.00462170
mov edx, ebp
mov ecx, ebx
call fcn.00407740
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dce0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
shl edx, 4
mov ecx, dword [esp + 0x1c]
push esi
push edi
add edx, dword [ebp + 0x10]
mov esi, ecx
mov dword [esp + 0x1c], ebp
test ecx, ecx
je 0x43dd10
cmp byte [ecx], 0
je 0x43dd08
inc esi
cmp byte [esi], 0
jne 0x43dd02
sub esi, ecx
and esi, 0x3fffffff
mov ebx, dword [edx + 0xc]
xor edi, edi
add ebx, 8
mov dword [esp + 0x18], ebx
mov eax, dword [ebx]
mov dword [esp + 0x14], eax
test eax, eax
je 0x43dd64
mov ebx, esi
mov ebp, ecx
test esi, esi
jle 0x43dd52
mov edi, edi
movzx eax, byte [ebp]
lea ecx, [edi*8]
dec ebx
lea ebp, [ebp + 1]
movzx edx, byte [eax + 0x4f4d50]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x43dd30
mov ecx, dword [esp + 0x24]
mov eax, edi
mov ebx, dword [esp + 0x18]
xor edx, edx
mov ebp, dword [esp + 0x1c]
div dword [esp + 0x14]
mov edi, edx
push edi
mov edx, ecx
mov ecx, ebx
push esi
call fcn.0040b200
add esp, 8
test eax, eax
je 0x43dd88
mov esi, dword [eax + 8]
mov edx, eax
push edi
mov ecx, ebx
call fcn.0040b2b0
add esp, 4
jmp 0x43dd8a
xor esi, esi
mov edx, esi
mov ecx, ebp
call fcn.0043db30
or dword [ebp + 0x18], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x43fc10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x44
mov eax, dword [0x50e74c]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x48]
add edx, edx
push ebx
mov ebx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
push ebp
mov eax, dword [ebx]
push esi
push edi
mov dword [esp + 0x1c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [esp + 0x10], esi
mov dword [esp + 0x24], eax
nop
push eax
push str.sqlite_stat_d
lea eax, [esp + 0x3c]
push eax
push 0x18
call fcn.004090c0
mov eax, dword [ebx]
lea ecx, [esp + 0x44]
add esp, 0x10
mov dword [esp + 0x18], eax
xor ebp, ebp
cmp byte [esp + 0x34], 0
je 0x43fc7e
inc ecx
cmp byte [ecx], 0
jne 0x43fc78
lea edx, [esp + 0x34]
xor ebx, ebx
sub ecx, edx
mov dword [esp + 0x20], ebx
mov edx, dword [eax + 0x14]
and ecx, 0x3fffffff
mov dword [esp + 0x14], ecx
mov dword [esp + 0x30], edx
test edx, edx
jle 0x43fdc5
mov edi, ebx
cmp ebx, 2
jge 0x43fcad
xor edi, 1
test esi, esi
je 0x43fd0d
mov ecx, dword [esp + 0x18]
mov edx, edi
add edx, edx
mov eax, esi
mov ecx, dword [ecx + 0x10]
mov esi, dword [ecx + edx*8]
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx]
test cl, cl
je 0x43fced
jmp 0x43fcd0
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4f4d50]
cmp cl, byte [edx + 0x4f4d50]
jne 0x43fced
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x43fcd0
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x4f4d50]
movzx ecx, byte [ecx + 0x4f4d50]
sub eax, ecx
jne 0x43fd80
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x10]
add edi, edi
mov ebp, dword [eax + edi*8 + 0xc]
cmp dword [ebp + 0x14], 0
je 0x43fd5e
xor esi, esi
lea ebx, [esp + 0x34]
mov edi, ecx
test ecx, ecx
jle 0x43fd51
jmp 0x43fd30
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x4f4d50]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x43fd30
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov eax, esi
xor edx, edx
div dword [ebp + 8]
jmp 0x43fd60
xor edx, edx
push edx
push ecx
lea edx, [esp + 0x3c]
lea ecx, [ebp + 8]
call fcn.0040b200
add esp, 8
test eax, eax
je 0x43fd7e
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x43fd9f
jmp 0x43fd80
xor ebp, ebp
mov ecx, dword [esp + 0x14]
inc ebx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], ebx
cmp ebx, dword [esp + 0x30]
jl 0x43fca3
test ebp, ebp
je 0x43fdc5
push dword [esp + 0x28]
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x38]
push dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.0043d390
add esp, 0x18
jmp 0x43fdc9
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, 4
jle 0x43fc50
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c515f
add esp, 0x44
ret
Function at 0x45d7a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
add edx, edx
mov ecx, dword [esp + 0x1c]
push esi
push edi
mov eax, dword [ebp + 0x10]
mov esi, ecx
mov dword [esp + 0x1c], ebp
mov ebx, dword [eax + edx*8 + 0xc]
add ebx, 0x28
mov dword [esp + 0x18], ebx
test ecx, ecx
je 0x45d7de
cmp byte [ecx], 0
je 0x45d7d6
lea esp, [esp]
inc esi
cmp byte [esi], 0
jne 0x45d7d0
sub esi, ecx
and esi, 0x3fffffff
mov eax, dword [ebx]
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x45d826
mov ebx, esi
mov ebp, ecx
test esi, esi
jle 0x45d814
movzx eax, byte [ebp]
lea ecx, [edi*8]
dec ebx
lea ebp, [ebp + 1]
movzx edx, byte [eax + 0x4f4d50]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x45d7f2
mov ecx, dword [esp + 0x24]
mov eax, edi
mov ebx, dword [esp + 0x18]
xor edx, edx
mov ebp, dword [esp + 0x1c]
div dword [esp + 0x14]
mov edi, edx
push edi
mov edx, ecx
mov ecx, ebx
push esi
call fcn.0040b200
add esp, 8
test eax, eax
je 0x45d8b2
mov esi, dword [eax + 8]
mov edx, eax
push edi
mov ecx, ebx
call fcn.0040b2b0
add esp, 4
test esi, esi
je 0x45d8b2
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x45d874
mov ecx, esi
call fcn.0045d5d0
lea ecx, [eax + 0x40]
mov eax, dword [ecx]
cmp eax, esi
je 0x45d86d
lea ecx, [eax + 0x20]
mov eax, dword [ecx]
cmp eax, esi
jne 0x45d864
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
mov edx, dword [esi + 0x1c]
mov ecx, ebp
call fcn.0045c6c0
mov edx, dword [esi]
mov ecx, ebp
call fcn.00407740
mov edx, dword [esi + 4]
mov ecx, ebp
call fcn.00407740
mov edx, dword [esi + 0xc]
mov ecx, ebp
call fcn.004350a0
mov edx, dword [esi + 0x10]
mov ecx, ebp
call fcn.00441790
mov edx, esi
mov ecx, ebp
call fcn.00407740
or dword [ebp + 0x18], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret