joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c5a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0048bd50
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x63a898], 0
jne 0x48c5dd
cmp dword [0x63a894], 0
je 0x48c5dd
mov eax, dword [0x63a894]
mov dword [0x63a898], eax
cmp dword [0x63a898], 0
je 0x48c65a
mov ecx, dword [0x63a898]
cmp dword [ecx + 8], 0
je 0x48c65a
mov edx, dword [0x63a898]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x48c65a
mov ecx, dword [0x63a898]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x48c65a
mov eax, dword [0x63a898]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x48c629
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x48c630
xor eax, eax
jmp 0x48c77d
mov ecx, dword [0x63a898]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00562540
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x48c77d
mov edx, dword [0x63a894]
mov dword [0x63a898], edx
jmp 0x48c676
mov eax, dword [0x63a898]
mov ecx, dword [eax + 4]
mov dword [0x63a898], ecx
cmp dword [0x63a898], 0
je 0x48c6b6
cmp dword [0x63a898], 0
je 0x48c6b4
mov edx, dword [0x63a898]
cmp dword [edx + 8], 0
je 0x48c6b4
mov eax, dword [0x63a898]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x48c6b4
mov edx, dword [0x63a898]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x48c6b4
jmp 0x48c60e
jmp 0x48c668
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0048c550
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48c77b
mov eax, dword [ebp - 4]
mov dword [0x63a898], eax
mov ecx, dword [0x63a898]
mov dword [ecx], 0x52727464
mov edx, dword [0x63a898]
mov dword [edx + 8], 0
mov eax, dword [0x63a898]
mov ecx, dword [0x63a894]
mov dword [eax + 4], ecx
mov edx, dword [0x63a898]
mov dword [0x63a894], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x63a898]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x48c747
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x48c76b
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x48c73e
mov eax, dword [0x63a898]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x48c60e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x48c7d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x48c7e5
xor eax, eax
jmp 0x48c85a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x48c812
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x48c855
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x48c853
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x48c84f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x48c853
xor eax, eax
jmp 0x48c85a
jmp 0x48c809
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x48c960
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x63a8a4], eax
je 0x48c97e
mov eax, 0x10dd
jmp 0x48ca5f
mov eax, dword [0x63a8b4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48c9fc
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x48c9da
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x48c9da
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.0048c790
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0054f779
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x48c986
mov dword [0x63a8b4], 0
call fcn.0048c2d0
mov ecx, dword [0x63a8b0]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x48ca49
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0054f779
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x48ca14
mov dword [0x63a8b0], 0
mov dword [0x63a8a4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x48cec0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x63a8a8], 0
je 0x48ced9
mov eax, dword [0x63a8a8]
jmp 0x48cf79
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x48ceeb
xor eax, eax
jmp 0x48cf79
push 8
call fcn.0054f74a
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48cf41
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x48cf2a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.0054f779
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x63a8a8], eax
mov dword [0x63a8ac], 0
mov eax, dword [ebp - 4]
jmp 0x48cf79
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x48cf5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x48cf0b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x63a8b0]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x63a8b0], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x48ea70
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea ecx, [ebp + 8]
call fcn.00406110
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48eaa8
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 8]
call fcn.004060f0
lea ecx, [ebp + 0x24]
call fcn.00405f70
mov eax, dword [ebp - 0x10]
jmp 0x48ebf6
lea ecx, [ebp + 8]
call fcn.00406110
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x48eadf
mov dword [ebp - 0x14], 4
lea ecx, [ebp + 8]
call fcn.004060f0
lea ecx, [ebp + 0x24]
call fcn.00405f70
mov eax, dword [ebp - 0x14]
jmp 0x48ebf6
push 0
push 0x5982d4
lea ecx, [ebp + 0x24]
call fcn.00422740
cmp eax, 0xffffffff
je 0x48eb0b
mov dword [ebp - 8], 2
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 8]
jne 0x48eb0b
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
push 0
push 0x5982d8
lea ecx, [ebp + 0x24]
call fcn.00422740
cmp eax, 0xffffffff
je 0x48eb3a
mov dword [ebp - 8], 2
mov edx, dword [ebp - 0xc]
and edx, dword [ebp - 8]
cmp edx, dword [ebp - 8]
jne 0x48eb3a
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0
push 0x5982dc
lea ecx, [ebp + 0x24]
call fcn.00422740
cmp eax, 0xffffffff
je 0x48eb66
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0xc]
and ecx, dword [ebp - 8]
jne 0x48eb66
mov edx, dword [ebp - 0xc]
or edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
push 0
push 0x5982e0
lea ecx, [ebp + 0x24]
call fcn.00422740
cmp eax, 0xffffffff
je 0x48eb95
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
jne 0x48eb95
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
lea ecx, [ebp + 8]
call fcn.00406110
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x48ebca
mov dword [ebp - 0x18], 0
lea ecx, [ebp + 8]
call fcn.004060f0
lea ecx, [ebp + 0x24]
call fcn.00405f70
mov eax, dword [ebp - 0x18]
jmp 0x48ebf6
mov dword [ebp - 0x1c], 2
lea ecx, [ebp + 8]
call fcn.004060f0
lea ecx, [ebp + 0x24]
call fcn.00405f70
mov eax, dword [ebp - 0x1c]
jmp 0x48ebf6
mov esp, ebp
pop ebp
ret
Function at 0x497370
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
push 0x6016e8
push 1
push 0
push 0x6016d8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x4973dc
mov ecx, dword [ebp - 0x14]
push ecx
push str.HostProtect::firewall_state_CoCreateInstance_failed:_0x_08lx_n
push 0x597658
call fcn.0040c050
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov eax, 9
jmp 0x49754e
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x49742c
mov edx, dword [ebp - 0x14]
push edx
push str.HostProtect::firewall_state_get_LocalPolicy_failed:_0x_08lx_n
push 0x597674
call fcn.0040c050
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 8]
call eax
mov dword [ebp - 8], 0
mov eax, 9
jmp 0x49754e
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 0x1c]
call edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x497491
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ecx + 8]
call eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 8]
call ecx
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x14]
push edx
push str.HostProtect::firewall_state_get_CurrentProfile_failed:_0x_08lx_n
push str.HostProtect::firewall_state
call fcn.0040c050
add esp, 0xc
mov eax, 9
jmp 0x49754e
xor eax, eax
mov word [ebp - 0x10], ax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x20]
call edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x4974f1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 8]
call eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [edx + 8]
call ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 8]
call edx
mov dword [ebp - 8], 0
movsx eax, word [ebp - 0x10]
test eax, eax
je 0x497504
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
jmp 0x49750d
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 8]
call eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [edx + 8]
call ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 8]
call edx
mov dword [ebp - 8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4977a0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
lea ecx, [ebp - 8]
push ecx
push 0x6016e8
push 1
push 0
push 0x6016d8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x4977fd
mov edx, dword [ebp - 0xc]
push edx
push str.CoCreateInstance_failed:_0x_08lx_n
call fcn.0055ad2a
add esp, 8
jmp 0x497859
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x49782d
mov edx, dword [ebp - 0xc]
push edx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.0055ad2a
add esp, 8
jmp 0x497859
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x497859
mov edx, dword [ebp - 0xc]
push edx
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.0055ad2a
add esp, 8
cmp dword [ebp - 4], 0
je 0x49786d
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ecx + 8]
call eax
cmp dword [ebp - 8], 0
je 0x497881
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx + 8]
call ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x49a860
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 0x601738
push 1
push 0
push 0x601728
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x49a8a2
mov ecx, dword [ebp - 4]
push ecx
push str.HostProtect::WFCOMInitialize_CoCreateInstance_for_INetFwPolicy2_failed:_0x_08lx_n
push str.WFCOMInitialize
call fcn.0040c050
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x49e680
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 1
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 8], 1
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
je 0x49e715
push 0xbb8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49e6ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 4]
push edx
push str._ProcessProtect_Wait_trace_udp_thread_fail__ret_d__err_d._n
push 0x594fac
call fcn.0040c050
add esp, 0x10
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x49e709
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 4]
push edx
push str._ProcessProtect_Wait_trace_udp_thread_thread_exit_OK..._n
push 0x59505c
call fcn.0040c050
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
mov dword [edx], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
je 0x49e79a
push 0xbb8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49e770
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 8]
push eax
push 0x595080
push 0x595104
call fcn.0040c050
add esp, 0x10
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x49e78d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 8]
push eax
push str._ProcessProtect_Wait_trace_process_thread_thread_exit_OK..._n
push str.ProcessProtect::ProcessProtect
call fcn.0040c050
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x49e7d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x49eae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x49eb00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0xffffffff
je 0x49e834
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x49e834
mov eax, 1
jmp 0x49e836
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x49f180
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49f1f6
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0048b890
add esp, 8
test eax, eax
jne 0x49f1e1
mov eax, dword [ebp - 0x238]
jmp 0x49f202
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 8], eax
jmp 0x49f1bc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret
Function at 0x49f540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x49f290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffff
je 0x49f57e
mov eax, 1
jmp 0x49f580
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49f5b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00402270
mov dword [ebp - 0x6c], eax
push 0x44
push 0
lea eax, [ebp - 0x68]
push eax
call fcn.00562540
add esp, 0xc
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 1
xor ecx, ecx
mov word [ebp - 0x38], cx
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
lea ecx, [ebp + 8]
call fcn.00406030
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x49f617
mov dword [ebp - 0x80], 0
jmp 0x49f673
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3fffffff
jle 0x49f63c
mov dword [ebp - 0x84], 0
jmp 0x49f66a
mov eax, dword [ebp - 0x18]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x88], esp
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x78]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
call fcn.00402280
mov dword [ebp - 0x84], eax
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x80], edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x80]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x49f6cd
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x79], 1
lea ecx, [ebp + 8]
call fcn.00405f70
mov al, byte [ebp - 0x79]
jmp 0x49f6e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x70], eax
mov byte [ebp - 0x7a], 0
lea ecx, [ebp + 8]
call fcn.00405f70
mov al, byte [ebp - 0x7a]
lea esp, [ebp - 0x88]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret
Function at 0x4a8290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0
push 0
push 0x14
call fcn.004a4620
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a82bc
mov eax, 7
jmp 0x4a836c
movzx ecx, byte [0x61649c]
test ecx, ecx
je 0x4a82d8
push 0xc8
call fcn.004a8ff0
add esp, 4
test eax, eax
je 0x4a82ed
xor edx, edx
mov eax, dword [ebp - 4]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
jmp 0x4a833d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x4a8250
push 0
push 0
call fcn.00561ac8
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x4a833d
xor eax, eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x4a8362
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [ebp + 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4f3850
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov byte [eax + 0x10], 1
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov eax, dword [ebp + 8]
push eax
call fcn.004fa3a0
add esp, 0x1c
cmp dword [ebp + 0x10], 0
jne 0x4f38a2
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov ecx, dword [ebp + 8]
push ecx
call fcn.004fa3a0
add esp, 0x14
pop ebp
ret
Function at 0x54ddd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0x54ddeb
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x54de42
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x54de0c
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x54de34
mov eax, dword [ebp - 4]
and eax, 1
je 0x54de2a
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x54de32
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x54de03
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [ecx + eax*4], edx
jmp 0x54dde2
mov esp, ebp
pop ebp
ret