joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004bfd0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x140
call fcn.100ffa80
mov eax, dword [0x10291210]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x154]
push edi
mov ecx, 8
lea edi, [esp + 0x12c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x148]
and byte [esp + 0x12c], 0xf8
shr ecx, 0x18
and cl, 0x3f
or cl, 0x40
lea edx, [esp + 0x3c]
mov byte [esp + 0x14b], cl
push edx
lea ecx, [esp + 0x130]
mov dword [esp + 0x14], eax
call fcn.10043d90
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebx, dword [esp + 0x78]
add ecx, eax
sub eax, dword [esp + 0x68]
mov dword [esp + 0xe0], ecx
mov ecx, dword [esp + 0x94]
add edx, ecx
mov dword [esp + 0xe4], edx
mov edx, dword [esp + 0x98]
add esi, edx
mov dword [esp + 0xe8], esi
mov esi, dword [esp + 0x9c]
add edi, esi
mov ebp, dword [esp + 0x8c]
mov dword [esp + 0xec], edi
mov edi, dword [esp + 0xa0]
add ebx, edi
mov dword [esp + 0xf0], ebx
mov ebx, dword [esp + 0xa4]
add ebx, dword [esp + 0x7c]
sub ecx, dword [esp + 0x6c]
sub edx, dword [esp + 0x70]
sub esi, dword [esp + 0x74]
sub edi, dword [esp + 0x78]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x7c]
mov dword [esp + 0xf4], ebx
mov ebx, dword [esp + 0xa8]
add ebx, dword [esp + 0x80]
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0xa8]
sub eax, dword [esp + 0x80]
mov dword [esp + 0xf8], ebx
mov ebx, dword [esp + 0xac]
add ebx, dword [esp + 0x84]
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0xac]
sub eax, dword [esp + 0x84]
mov dword [esp + 0xfc], ebx
mov ebx, dword [esp + 0xb0]
add ebx, dword [esp + 0x88]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0xb0]
sub eax, dword [esp + 0x88]
mov dword [esp + 0x100], ebx
mov ebx, dword [esp + 0xb4]
add ebp, ebx
sub ebx, dword [esp + 0x8c]
mov dword [esp + 0x128], eax
mov dword [esp + 0x104], ebp
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], esi
mov dword [esp + 0x118], edi
mov dword [esp + 0x12c], ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10c]
call fcn.10041370
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xe8]
push edx
mov ecx, edx
call fcn.1003f0b0
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0xf0]
call fcn.1003ee10
lea ecx, [esp + 0x140]
push 0x20
push ecx
call fcn.100055e0
mov ecx, dword [esp + 0x168]
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100fd740
add esp, 0x140
ret
Function at 0x10074760
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.100ffa80
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.10010e30
add esp, 8
test eax, eax
jne 0x1007479b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x100747fd
xor ebx, ebx
test ebp, ebp
jle 0x10074960
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x100747df
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x100747b8
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x100747b0
jmp 0x10074960
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x40], eax
jle 0x10074960
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
mov dword [esp + 0x20], esi
cmp edi, esi
jle 0x1007493c
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x100748d0
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [esp + 0x40]
jl 0x100748a0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x100a7c77
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.100ffa80
mov eax, dword [0x10291210]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
je 0x100a7dda
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 4]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 5]
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 8
mov byte [edi], dl
mov byte [ebp], al
call fcn.10098800
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.10098880
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.10096f00
push ebp
call fcn.10098800
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.10098880
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.10096f00
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ebx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, dword [esp + 0x44]
shr ebx, 0x18
mov byte [eax + 3], bl
mov ebx, edx
add esp, 0x30
mov byte [eax + 4], dl
shr ebx, 8
mov byte [eax + 5], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax + 6], bl
mov byte [eax + 7], dl
mov eax, ebp
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 0x18
dec dword [esp + 0x18]
mov byte [eax + 6], dl
mov byte [eax + 7], cl
jne 0x100a7c93
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.100fd740
add esp, 0xa0
ret
Function at 0x100af1d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, edi
mov ecx, ebp
cmp edi, 4
jb 0x100af1f8
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x100af200
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x100af1e4
test esi, esi
je case.0x100af2be.2
movzx eax, byte [edx]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x100af247
cmp esi, 1
jbe case.0x100af2be.2
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x100af247
cmp esi, 2
jbe case.0x100af2be.2
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x100af247
cmp esi, 3
jbe case.0x100af2be.2
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jle case.0x100af2be.2
mov ebx, dword [esp + 0x10]
xor edx, edx
test edi, edi
jle 0x100af270
mov esi, ebx
mov eax, ebp
sub esi, ebp
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x100af270
inc edx
inc eax
cmp edx, edi
jl 0x100af263
lea eax, [edi - 1]
test eax, eax
js 0x100af28f
mov esi, ebx
lea ecx, [eax + ebp]
sub esi, ebp
mov edi, edi
cmp byte [ecx + esi], 0
jne 0x100af28f
cmp byte [ecx], 0xff
jne 0x100af28f
dec ecx
dec eax
jns 0x100af280
cmp edx, eax
jl case.0x100af2be.2
jle 0x100af2a0
pop esi
pop ebp
lea eax, [edx*8]
pop ebx
ret
mov cl, byte [edx + ebx]
mov bl, byte [edx + ebp]
mov al, bl
xor al, cl
mov byte [esp + 0x10], cl
movzx ecx, al
dec ecx
cmp ecx, 0x7e
ja case.0x100af2be.2
movzx ecx, byte [ecx + 0x100af330]
jmp dword [ecx*4 + 0x100af310]
mov esi, 7
jmp 0x100af2f4
mov esi, 6
jmp 0x100af2f4
mov esi, 5
jmp 0x100af2f4
mov esi, 4
jmp 0x100af2f4
mov esi, 3
jmp 0x100af2f4
mov esi, 2
jmp 0x100af2f4
mov esi, 1
test byte [esp + 0x10], al
jne case.0x100af2be.2
and bl, al
cmp bl, al
jne case.0x100af2be.2
lea eax, [esi + edx*8]
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x100eeff0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
xor eax, eax
push esi
test edx, edx
je 0x100ef007
test byte [edx + 0x5c], 2
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x100ef00c
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test ebp, ebp
jle 0x100ef0d5
push ebx
push edi
mov edi, dword [esp + 0x14]
inc edi
jmp 0x100ef020
movzx edx, byte [edi - 1]
cmp ebp, 3
jl 0x100ef071
movzx ebx, byte [edi]
shl edx, 8
or edx, ebx
movzx ebx, byte [edi + 1]
shl edx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 1], bl
mov ebx, edx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 2], bl
and edx, 0x3f
mov dl, byte [edx + esi]
mov byte [ecx + 3], dl
jmp 0x100ef0b9
shl edx, 0x10
cmp ebp, 2
jne 0x100ef081
movzx ebx, byte [edi]
shl ebx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 1], bl
cmp ebp, 1
jne 0x100ef0a8
lea edx, [ebp + 0x3c]
jmp 0x100ef0b2
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub ebp, 3
add ecx, 4
add eax, 4
add edi, 3
test ebp, ebp
jg 0x100ef020
pop edi
pop ebx
pop esi
mov byte [ecx], 0
pop ebp
ret
pop esi
mov byte [ecx], al
pop ebp
ret

Function at 0x100fd740
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10291210]
jne 0x100fd74a
repz ret
jmp fcn.1010298c
Function at 0x1010eae7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10291210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10104af0
and dword [ebp - 0x14], 0
cmp dword [0x10299314], 0
mov dword [ebp - 0x18], eax
jne 0x1010eb9a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1010ec42
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1026a930
push ebx
call edi
test eax, eax
je 0x1010ec42
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10299314], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10299318], eax
call edi
push eax
call esi
push 0x1026a8f0
push ebx
mov dword [0x1029931c], eax
call edi
push eax
call esi
mov dword [0x10299324], eax
test eax, eax
je 0x1010eb9a
push 0x1026a8d8
push ebx
call edi
push eax
call esi
mov dword [0x10299320], eax
mov eax, dword [0x10299320]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1010ebf3
cmp dword [0x10299324], ecx
je 0x1010ebf3
push eax
call esi
push dword [0x10299324]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1010ebf3
test ebx, ebx
je 0x1010ebf3
call edi
test eax, eax
je 0x1010ebea
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1010ebea
test byte [ebp - 8], 1
jne 0x1010ebf3
or dword [ebp + 0x10], 0x200000
jmp 0x1010ec26
mov eax, dword [0x10299318]
cmp eax, dword [ebp - 0x18]
je 0x1010ec26
push eax
call esi
test eax, eax
je 0x1010ec26
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1010ec26
mov eax, dword [0x1029931c]
cmp eax, dword [ebp - 0x18]
je 0x1010ec26
push eax
call esi
test eax, eax
je 0x1010ec26
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10299314]
call esi
test eax, eax
je 0x1010ec42
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1010ec44
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100fd740
leave
ret
Function at 0x10121b70
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test edx, edx
jle 0x10121b91
push ebx
sub ecx, eax
push edi
jmp 0x10121b80
movzx edi, byte [ecx + eax]
movzx ebx, byte [eax]
xor edi, ebx
or esi, edi
inc eax
dec edx
jne 0x10121b80
pop edi
pop ebx
xor eax, eax
test esi, esi
setne al
pop esi
ret

Function at 0x10123830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
cmp ecx, 0x80
jge 0x10123853
lea edx, [ecx - 0x41]
cmp edx, 0x19
ja 0x10123903
lea eax, [ecx + 0x20]
mov esp, ebp
pop ebp
ret
cmp ecx, 0x10000
jge 0x101238f5
push ebx
push esi
push edi
mov edi, 0xa2
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
movzx edx, word [eax*4 + 0x10273998]
mov ebx, ecx
sub ebx, edx
js 0x10123890
mov edx, eax
mov dword [ebp - 4], edx
lea esi, [eax + 1]
jmp 0x10123896
mov edx, dword [ebp - 4]
lea edi, [eax - 1]
cmp edi, esi
jge 0x10123870
movzx eax, word [edx*4 + 0x10273998]
movzx esi, byte [edx*4 + 0x1027399b]
add esi, eax
pop edi
cmp ecx, esi
pop esi
pop ebx
jge 0x101238d6
movzx edx, byte [edx*4 + 0x1027399a]
xor eax, ecx
and eax, edx
test al, 1
jne 0x101238d6
shr edx, 1
movzx eax, word [edx*2 + 0x10273c28]
add eax, ecx
and eax, 0xffff
jmp 0x101238d8
mov eax, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10123903
xor edx, edx
cmp ecx, 2
sete dl
push edx
push eax
call fcn.101155e0
add esp, 8
mov esp, ebp
pop ebp
ret
lea edx, [ecx - 0x10400]
cmp edx, 0x27
ja 0x10123903
lea eax, [ecx + 0x28]
mov esp, ebp
pop ebp
ret

Function at 0x10125a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
cmp ecx, 0x80
jge 0x10125a53
lea edx, [ecx - 0x41]
cmp edx, 0x19
ja 0x10125b03
lea eax, [ecx + 0x20]
mov esp, ebp
pop ebp
ret
cmp ecx, 0x10000
jge 0x10125af5
push ebx
push esi
push edi
mov edi, 0xa2
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
movzx edx, word [eax*4 + 0x10273120]
mov ebx, ecx
sub ebx, edx
js 0x10125a90
mov edx, eax
mov dword [ebp - 4], edx
lea esi, [eax + 1]
jmp 0x10125a96
mov edx, dword [ebp - 4]
lea edi, [eax - 1]
cmp edi, esi
jge 0x10125a70
movzx eax, word [edx*4 + 0x10273120]
movzx esi, byte [edx*4 + 0x10273123]
add esi, eax
pop edi
cmp ecx, esi
pop esi
pop ebx
jge 0x10125ad6
movzx edx, byte [edx*4 + 0x10273122]
xor eax, ecx
and eax, edx
test al, 1
jne 0x10125ad6
shr edx, 1
movzx eax, word [edx*2 + 0x102733c8]
add eax, ecx
and eax, 0xffff
jmp 0x10125ad8
mov eax, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10125b03
xor edx, edx
cmp ecx, 2
sete dl
push edx
push eax
call fcn.10118be0
add esp, 8
mov esp, ebp
pop ebp
ret
lea edx, [ecx - 0x10400]
cmp edx, 0x27
ja 0x10125b03
lea eax, [ecx + 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x1012e590
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax + 4]
push esi
cmp edx, dword [ecx + 4]
jne 0x1012e5d5
mov eax, dword [eax + 0x10]
mov ecx, dword [ecx + 0x10]
cmp eax, ecx
je 0x1012e5c5
xor esi, esi
test edx, edx
jle 0x1012e5c5
push ebx
sub ecx, eax
push edi
lea ecx, [ecx]
movzx edi, byte [ecx + eax]
movzx ebx, byte [eax]
xor edi, ebx
or esi, edi
inc eax
dec edx
jne 0x1012e5b0
pop edi
pop ebx
test esi, esi
jne 0x1012e5d5
mov eax, 1
xor ecx, ecx
test eax, eax
sete cl
pop esi
mov eax, ecx
ret
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
pop esi
mov eax, ecx
ret

Function at 0x1013adf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], eax
jle 0x1013ae5e
push esi
push edi
mov ecx, ebx
cmp ebx, 2
jge 0x1013ae12
xor ecx, 1
shl ecx, 4
add ecx, dword [edx + 0x10]
mov edx, dword [ebp + 0x10]
mov eax, dword [ecx + 0xc]
test edx, edx
je 0x1013ae35
mov edi, dword [ecx]
sub edi, edx
movzx ecx, byte [edx]
movzx esi, byte [edi + edx]
cmp ecx, esi
jne 0x1013ae63
test ecx, ecx
jne 0x1013ae75
mov edx, dword [ebp + 0xc]
push 0
push edx
add eax, 0x18
call fcn.1012ced0
mov eax, dword [eax + 8]
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jne 0x1013ae5c
mov edx, dword [ebp + 8]
inc ebx
cmp ebx, dword [edx + 0x14]
jl 0x1013ae08
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx esi, byte [esi + 0x1026d428]
movzx ecx, byte [ecx + 0x1026d428]
sub ecx, esi
jne 0x1013ae50
inc edx
jmp 0x1013ae26
Function at 0x1013ae80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 0x14], ebx
jle 0x1013af07
mov eax, ebx
cmp ebx, 2
jge 0x1013ae9b
xor eax, 1
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1013aec2
mov esi, dword [edi + 0x10]
mov ecx, eax
add ecx, ecx
mov edi, dword [esi + ecx*8]
sub edi, edx
mov edi, edi
movzx ecx, byte [edx]
movzx esi, byte [edi + edx]
cmp ecx, esi
jne 0x1013aee9
test ecx, ecx
jne 0x1013aefb
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x10]
mov ecx, dword [ebp + 0xc]
add eax, eax
mov eax, dword [edx + eax*8 + 0xc]
push 0
add eax, 8
push ecx
call fcn.1012ced0
mov eax, dword [eax + 8]
add esp, 8
test eax, eax
jne 0x1013af89
jmp 0x1013af01
movzx esi, byte [esi + 0x1026d428]
movzx ecx, byte [ecx + 0x1026d428]
sub ecx, esi
jne 0x1013aefe
inc edx
jmp 0x1013aeb0
mov edi, dword [ebp + 8]
inc ebx
cmp ebx, dword [edi + 0x14]
jl 0x1013ae91
mov ecx, dword [ebp + 0xc]
mov esi, str.sqlite_master
sub esi, ecx
movzx eax, byte [ecx]
movzx edx, byte [esi + ecx]
cmp eax, edx
jne 0x1013af41
test eax, eax
jne 0x1013af53
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x1013af56
neg eax
sbb eax, eax
test eax, eax
jne 0x1013af87
mov dword [ebp + 0xc], str.sqlite_temp_master
jmp 0x1013ae87
movzx edx, byte [edx + 0x1026d428]
movzx eax, byte [eax + 0x1026d428]
sub eax, edx
jne 0x1013af87
inc ecx
jmp 0x1013af11
test eax, eax
je 0x1013af87
mov esi, eax
sub esi, ecx
mov edi, edi
movzx eax, byte [ecx]
movzx edx, byte [esi + ecx]
cmp eax, edx
jne 0x1013af72
test eax, eax
je 0x1013af35
inc ecx
jmp 0x1013af60
movzx edx, byte [edx + 0x1026d428]
movzx eax, byte [eax + 0x1026d428]
sub eax, edx
jne 0x1013af31
inc ecx
jmp 0x1013af60
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1013c300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov al, byte [ebx + 0x44]
push esi
push edi
test al, al
js 0x1013c3fa
xor edi, edi
test al, al
jle 0x1013c394
lea eax, [ebx + 0x78]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x1013c381
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov esi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [esi]
dec eax
push edx
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x20]
push 0
push eax
call fcn.10100050
push edx
push eax
mov eax, dword [ebx + 0x48]
push esi
call eax
mov ebx, dword [ebp + 8]
add esp, 0x10
jmp 0x1013c386
call fcn.1012c920
movsx ecx, byte [ebx + 0x44]
add dword [esp + 0x10], 4
inc edi
cmp edi, ecx
jl 0x1013c327
mov edx, dword [ebx + 0x74]
mov eax, dword [edx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x1013c3f1
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov esi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov edi, dword [esi]
dec eax
push edx
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x20]
push 0
push eax
call fcn.10100050
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov byte [ebx + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1012c920
mov byte [ebx + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret