joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7002f4d
Capabilities:
Get number of processors
Parse pe header

Disassembly:
jbe 0x7002fb1
jae 0x7002f9e
push 0x71
push edx
dec eax
push edx
pop ecx
outsb dx, byte [esi]

Function at 0x7002f53
Capabilities:
Get number of processors
Parse pe header

Disassembly:
push edi
push ebx
insd dword es:[edi], dx
das
ja 0x7002fb0
jp 0x700300b
dec ebp
inc esp

Function at 0x7002f59
Capabilities:
Get number of processors
Parse pe header

Disassembly:
xor eax, 0x4d576137
push ebx
xor edx, dword [ebx + 0x37]
bound si, dword [eax]
xor byte [esi], dh
push esi
xor dword [ebx + ebp*2 + 0x38], esi
dec eax
pop edx
jo 0x7002fb2
das

Function at 0x7002f5f
Capabilities:
Get number of processors
Parse pe header

Disassembly:
xor eax, 0x4d576137
push ebx
xor edx, dword [ebx + 0x37]
bound si, dword [eax]
xor byte [esi], dh
push esi
xor dword [ebx + ebp*2 + 0x38], esi
dec eax
pop edx
jo 0x7002fb2
das

Function at 0x7002f65
Capabilities:
Get number of processors
Parse pe header

Disassembly:
xor eax, 0x4d576137
push ebx
xor edx, dword [ebx + 0x37]
bound si, dword [eax]
xor byte [esi], dh
push esi
xor dword [ebx + ebp*2 + 0x38], esi
dec eax
pop edx
jo 0x7002fb2
das

Function at 0x7002f6b
Capabilities:
Get number of processors
Parse pe header

Disassembly:
xor eax, 0x4d576137
push ebx
xor edx, dword [ebx + 0x37]
bound si, dword [eax]
xor byte [esi], dh
push esi
xor dword [ebx + ebp*2 + 0x38], esi
dec eax
pop edx
jo 0x7002fb2
das

Function at 0x7002f77
Capabilities:
Get number of processors
Parse pe header

Disassembly:
inc esp
dec esi
je 0x7002fe6
js 0x7002fee
pop eax
pop ecx
invalid

Function at 0x7002f89
Capabilities:
Get number of processors
Parse pe header

Disassembly:
dec ecx
push esp
push esp
push ebp
js 0x7002ffc
inc esi
popal
popal
invalid
push esi

Function at 0x7002f95
Capabilities:
Get number of processors
Parse pe header

Disassembly:
xor dh, byte [edx]
dec esi
xor eax, 0x7a4e676c
dec esi
jp 0x7002fe0

Function at 0x7002f9b
Capabilities:
Get number of processors
Parse pe header

Disassembly:
xor dh, byte [edx]
dec esi
xor eax, 0x7a4e676c
dec esi
jp 0x7002fe0

Function at 0x7002fb3
Capabilities:
Get number of processors
Parse pe header

Disassembly:
insb byte es:[edi], dx
push eax
inc edi
aaa
insd dword es:[edi], dx
ja 0x7003029
outsd dx, dword [esi]
push eax
dec ecx
pop eax
push ebp
invalid

Function at 0x7002fb9
Capabilities:
Get number of processors
Parse pe header

Disassembly:
insb byte es:[edi], dx
push eax
inc edi
aaa
insd dword es:[edi], dx
ja 0x7003029
outsd dx, dword [esi]
push eax
dec ecx
pop eax
push ebp
invalid

Function at 0x7002fd1
Capabilities:
Get number of processors
Parse pe header

Disassembly:
dec edi
inc ecx
ja 0x7003000
js 0x700304a
push esi
xor al, 0x4e
xor byte [ebp + 0x75], dh

Function at 0x700301f
Capabilities:
Get number of processors
Parse pe header

Disassembly:
jae 0x700308a
dec ebx
inc esi
jno 0x7003050
insb byte es:[edi], dx
inc esi
sub ebx, dword [bx + di + 0x79]
jns 0x70030cb
invalid
dec edi
insd dword es:[edi], dx
xor eax, 0x4e713147
aaa
insd dword es:[edi], dx
Function at 0x7003055
Capabilities:
Get number of processors
Parse pe header

Disassembly:
jae 0x700308a
dec ebx
inc esi
jno 0x7003050
insb byte es:[edi], dx
inc esi
sub ebx, dword [bx + di + 0x79]
jns 0x70030cb
invalid
dec edi
insd dword es:[edi], dx
xor eax, 0x4e713147
aaa
insd dword es:[edi], dx
Function at 0x70094aa
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea ebx, [ebp - 4]
push 0
push 0
push ebx
push 0
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x7009538
mov eax, dword [ebp - 4]
test eax, eax
je 0x7009538
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x70094f2
mov esi, dword [ebp + 0x14]
jmp 0x7009511
inc dword [ebp - 4]
push 0x40
push 0x3000
push dword [ebp - 4]
push 0
call fcn.0700948c
test eax, eax
je 0x7009538
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov esi, eax
push 0
push 0
push ebx
push esi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x7009538
inc dword [ebp - 8]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x7009538
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret 0x14
Function at 0x405590
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
lea eax, [esp]
push ebx
push eax
push 0x4f4720
push 1
push 0
push 0x4f8180
xor bl, bl
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x4055b9
xor al, al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 4]
push dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
push dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x4f8170
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jne 0x405608
mov eax, dword [esp + 8]
push 1
push dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov bl, 1
mov ecx, dword [esp + 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov al, bl
pop ebx
add esp, 8
ret
Function at 0x406300
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
call fcn.0040ea20
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x18]
mov ecx, dword [edi]
push 0
push 0
push dword [edi + 4]
or ecx, 2
push ecx
call fcn.004c8fe9
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
lea ecx, [esi*2 + 2]
push ecx
call fcn.004c4d46
mov ecx, dword [edi]
mov ebx, eax
lea eax, [esp + 0x34]
or ecx, 1
push eax
push 0
push dword [esp + 0x38]
push esi
push ebx
push dword [edi + 4]
push ecx
call fcn.004c8fe9
add esp, 0x3c
xor eax, eax
mov word [ebx + esi*2], ax
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebx, ebx
je 0x406378
push ebx
call fcn.004c4d2b
add esp, 4
pop edi
pop esi
pop ebx
ret

Function at 0x406380
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x50a0b0]
xor eax, esp
mov dword [esp + 0x220], eax
push esi
mov esi, dword [esp + 0x22c]
lea eax, [esp + 0x1c]
push eax
push 0
push dword [0x50bd58]
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40644d
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 7
lea ecx, [edx + 2]
mov word [esp + 4], ax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4063d3
sub edx, ecx
lea eax, [esp + 0x1c]
sar edx, 1
lea ecx, [esp + 4]
push edx
push eax
call fcn.0040b6e0
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.004041a0
mov edx, dword [esp + 0x18]
cmp edx, 8
jb 0x406435
mov ecx, dword [esp + 4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40642b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406466
push edx
push ecx
call fcn.004bf4bc
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004bf929
add esp, 0x224
ret
mov ecx, dword [esp + 0x224]
or eax, 0xffffffff
pop esi
xor ecx, esp
call fcn.004bf929
add esp, 0x224
ret
call fcn.004c4cda
int3
Function at 0x406470
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x224
mov eax, dword [0x50a0b0]
xor eax, esp
mov dword [esp + 0x220], eax
push edi
mov edi, dword [esp + 0x22c]
lea eax, [esp + 0x1c]
push eax
push 0
push dword [0x50bd58]
push 0x2a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x406541
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 7
lea ecx, [edx + 2]
mov word [esp + 4], ax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4064c3
sub edx, ecx
lea eax, [esp + 0x1c]
sar edx, 1
lea ecx, [esp + 4]
push edx
push eax
call fcn.0040b6e0
lea eax, [esp + 4]
mov ecx, edi
push eax
call fcn.004041a0
mov edx, dword [esp + 0x18]
cmp edx, 8
jb 0x406529
mov ecx, dword [esp + 4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40651f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4065ee
push edx
push ecx
call fcn.004bf4bc
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004bf929
add esp, 0x224
ret
lea eax, [esp + 0x1c]
push eax
push 0
push dword [0x50bd58]
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4065d5
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 7
lea edx, [ecx + 2]
mov word [esp + 4], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406574
sub ecx, edx
lea eax, [esp + 0x1c]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0xc]
call fcn.0040b6e0
lea eax, [esp + 4]
mov ecx, edi
push eax
call fcn.004041a0
mov edx, dword [esp + 0x18]
cmp edx, 8
jb 0x406529
mov ecx, dword [esp + 4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40651f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4065ee
jmp 0x40651f
mov ecx, dword [esp + 0x224]
or eax, 0xffffffff
pop edi
xor ecx, esp
call fcn.004bf929
add esp, 0x224
ret
call fcn.004c4cda
int3
Function at 0x407800
Capabilities:
Delete directory
Get common file path
Get startup folder

Disassembly:
push ebp
lea ebp, [esp - 0x23c]
sub esp, 0x23c
push 0xffffffffffffffff
push 0x4e5b50
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x50a0b0]
xor eax, ebp
mov dword [ebp + 0x238], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], 7
mov word [ebp], ax
mov dword [ebp - 4], eax
lea eax, [ebp + 0x30]
push eax
push 0
push dword [0x50bd58]
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40790a
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x28], eax
mov dword [ebp + 0x2c], 7
lea edx, [ecx + 2]
mov word [ebp + 0x18], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407880
sub ecx, edx
lea eax, [ebp + 0x30]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp + 0x18]
call fcn.0040b6e0
push 0x4e97e0
lea eax, [ebp + 0x18]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00401920
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4078bd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x24]
call fcn.00403880
mov edx, dword [ebp + 0x2c]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x40790a
mov ecx, dword [ebp + 0x18]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407900
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40799c
push edx
push ecx
call fcn.004bf4bc
add esp, 8
lea eax, [ebp]
push eax
call fcn.00406470
add esp, 4
test eax, eax
js 0x407946
push 0x4e97e0
lea eax, [ebp]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00401a50
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x407937
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x24]
call fcn.00403880
mov edx, dword [ebp + 0x14]
cmp edx, 8
jb 0x40797c
mov ecx, dword [ebp]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407972
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4079a1
push edx
push ecx
call fcn.004bf4bc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp + 0x238]
xor ecx, ebp
call fcn.004bf929
lea esp, [ebp + 0x23c]
pop ebp
ret
call fcn.004c4cda
call fcn.004c4cda
int3
Function at 0x44bbf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ecx, ecx
xor ebp, ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
cmp dword [esi + 0x3c], ecx
jne 0x44bc1b
mov eax, dword [esp + 0x18]
pop esi
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
add esp, 8
ret
push ebx
push edi
push esi
call fcn.004387d0
add esp, 4
test eax, eax
jne 0x44bdc4
mov edi, edi
movzx ecx, word [esi + 0x4c]
movsx eax, cx
mov edi, dword [esi + eax*4 + 0x78]
mov bl, byte [edi + 5]
test bl, bl
jne 0x44bc47
cmp byte [edi + 2], bl
jne 0x44bc56
movzx eax, word [edi + 0x12]
cdq
add ebp, eax
mov dword [esp + 0x10], ebp
adc dword [esp + 0x14], edx
mov eax, ecx
test bl, bl
je 0x44bd27
test cx, cx
je 0x44bdaa
movsx eax, cx
mov ecx, dword [esi + eax*4 + 0x78]
test ecx, ecx
je 0x44bce0
mov ecx, dword [ecx + 0x44]
test byte [ecx + 0x18], 0x40
mov ebp, dword [ecx + 0x10]
je 0x44bcbc
dec dword [ebp + 0x78]
mov eax, dword [ebp + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 0x98]
mov edi, dword [ebp + 0x3c]
mov dword [ebp + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004bfcf0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x44bcc5
push ecx
call fcn.00465650
add esp, 4
cmp dword [ebp + 0x78], 0
jne 0x44bce0
mov eax, dword [ebp + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x44bce0
push ebp
call fcn.0043d640
add esp, 4
movzx eax, word [esi + 0x4c]
xor edx, edx
and byte [esi + 0x48], 0xf9
mov word [esi + 0x2c], dx
movsx edx, ax
lea ecx, [eax - 1]
mov word [esi + 0x4c], cx
movzx ecx, cx
mov eax, dword [esi + edx*4 + 0x74]
movzx edi, word [esi + edx*2 + 0x4c]
cmp di, word [eax + 0x12]
jae 0x44bc60
mov ebp, dword [esp + 0x10]
lea eax, [edi + 1]
mov word [esi + edx*2 + 0x4c], ax
movzx ecx, word [esi + 0x4c]
movsx eax, cx
mov edi, dword [esi + eax*4 + 0x78]
mov eax, ecx
cwde
movzx edx, word [esi + eax*2 + 0x4e]
movzx eax, word [edi + 0x12]
cmp edx, eax
jne 0x44bd58
movzx ecx, byte [edi + 6]
add ecx, dword [edi + 0x38]
movzx edx, byte [ecx + 8]
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xb]
jmp 0x44bd8b
mov eax, dword [edi + 0x40]
movzx ecx, byte [eax + edx*2 + 1]
movzx eax, byte [eax + edx*2]
shl eax, 8
or ecx, eax
movzx eax, word [edi + 0x14]
and ecx, eax
add ecx, dword [edi + 0x38]
movzx edx, byte [ecx]
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 3]
shl edx, 8
or edx, eax
push edx
push esi
call fcn.00438630
add esp, 8
test eax, eax
je 0x44bc30
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], ecx
call fcn.004387d0
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x44e100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
mov dword [esp + 0x10], ebp
test esi, esi
je 0x44e274
cmp byte [esi + 9], 0
je 0x44e12f
inc dword [esi + 0xc]
cmp byte [esi + 0xa], 0
jne 0x44e12f
push esi
call fcn.00423a60
add esp, 4
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [eax + 8]
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x44e25e
push edi
cmp dword [esp + 0x28], 0
je 0x44e183
test byte [ebx + 0x48], 1
jne 0x44e183
mov al, byte [ebx + 0x49]
cmp al, 1
je 0x44e15b
cmp al, 2
jne 0x44e197
push ebx
call fcn.00444470
mov ebp, eax
add esp, 4
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x44e197
mov esi, dword [esp + 0x20]
push 0
push ebp
push esi
call fcn.0044e100
add esp, 0xc
jmp 0x44e25d
push ebx
call fcn.0044b560
mov eax, dword [esp + 0x28]
add esp, 4
mov byte [ebx + 0x49], 4
mov dword [ebx + 0x44], eax
xor edi, edi
xor eax, eax
mov dword [esp + 0x10], edi
cmp ax, word [ebx + 0x4c]
jg 0x44e246
lea ebp, [ebx + 0x78]
lea esp, [esp]
mov ecx, dword [ebp]
test ecx, ecx
je 0x44e22b
mov ecx, dword [ecx + 0x44]
test byte [ecx + 0x18], 0x40
mov esi, dword [ecx + 0x10]
je 0x44e207
dec dword [esi + 0x78]
mov eax, dword [esi + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x98]
mov edi, dword [esi + 0x3c]
mov dword [esi + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004bfcf0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x24]
add esp, 0x10
mov edi, dword [esp + 0x10]
jmp 0x44e210
push ecx
call fcn.00465650
add esp, 4
cmp dword [esi + 0x78], 0
jne 0x44e22b
mov eax, dword [esi + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x44e22b
push esi
call fcn.0043d640
add esp, 4
mov dword [ebp], 0
inc edi
movsx eax, word [ebx + 0x4c]
add ebp, 4
mov dword [esp + 0x10], edi
cmp edi, eax
jle 0x44e1b0
mov ebx, dword [ebx + 8]
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x44e143
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
pop edi
cmp byte [esi + 9], 0
pop ebx
je 0x44e274
add dword [esi + 0xc], 0xffffffff
jne 0x44e274
push esi
call fcn.00486180
add esp, 4
pop esi
mov eax, ebp
pop ebp
add esp, 0xc
ret
Function at 0x44e600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x3c
mov eax, dword [0x50a0b0]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
add ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x20], eax
mov eax, dword [esi]
push edi
mov dword [esp + 0x18], esi
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + ecx*8]
mov eax, 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
push eax
push str.sqlite_stat_d
lea eax, [esp + 0x38]
push eax
push 0x18
call fcn.00418210
mov edi, dword [esi]
xor ebp, ebp
add esp, 0x10
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], 0
cmp dword [edi + 0x14], ebp
jle 0x44e757
mov esi, ebp
xor esi, 1
cmp ebp, 2
cmovae esi, ebp
test ebx, ebx
je 0x44e6e3
mov eax, dword [edi + 0x10]
mov ecx, esi
add ecx, ecx
mov edx, dword [eax + ecx*8]
test edx, edx
je 0x44e71b
mov bl, byte [ebx]
test bl, bl
je 0x44e6c7
mov edi, dword [esp + 0x10]
mov al, bl
sub edi, edx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x4ea938]
cmp al, byte [ecx + 0x4ea938]
jne 0x44e6c3
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x44e6a2
mov edi, dword [esp + 0x20]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x4ea938]
movzx eax, bl
movzx eax, byte [eax + 0x4ea938]
sub eax, ecx
jne 0x44e71b
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 0x10]
lea ecx, [esp + 0x2c]
add esi, esi
push ecx
lea ecx, [esp + 0x34]
push ecx
mov eax, dword [eax + esi*8 + 0xc]
add eax, 8
push eax
call fcn.0042fa90
add esp, 0xc
test eax, eax
je 0x44e713
mov eax, dword [eax + 8]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x44e731
jmp 0x44e71f
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x44e71f
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
inc ebp
cmp ebp, dword [edi + 0x14]
jl 0x44e673
test eax, eax
je 0x44e753
push dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push dword [esp + 0x2c]
push eax
push ebx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push esi
call fcn.004624b0
add esp, 0x18
jmp 0x44e757
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 4
jle 0x44e645
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bf929
add esp, 0x3c
ret
Function at 0x458730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebp, ebp
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
jle 0x4587f9
push ebx
mov eax, dword [esi + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovae ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x24]
test edx, edx
je 0x4587bd
mov eax, dword [eax + ecx*8]
test eax, eax
je 0x4587e5
mov bl, byte [edx]
test bl, bl
je 0x4587a5
mov esi, edx
mov cl, bl
sub esi, eax
jmp 0x458780
movzx edx, byte [eax]
mov bl, cl
movzx ecx, cl
mov cl, byte [ecx + 0x4ea938]
cmp cl, byte [edx + 0x4ea938]
jne 0x4587a1
mov cl, byte [esi + eax + 1]
inc eax
mov bl, cl
test cl, cl
jne 0x458780
mov esi, dword [esp + 0x1c]
movzx eax, byte [eax]
movzx ecx, byte [eax + 0x4ea938]
movzx eax, bl
movzx eax, byte [eax + 0x4ea938]
sub eax, ecx
jne 0x4587e5
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x24]
add eax, 0x18
push eax
call fcn.0042fa90
add esp, 0xc
test eax, eax
je 0x4587e3
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x4587ef
jmp 0x4587e5
xor ebp, ebp
inc edi
cmp edi, dword [esi + 0x14]
jl 0x458748
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret

Function at 0x458810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
xor eax, eax
push edi
xor edi, edi
mov dword [esp + 8], eax
cmp dword [ebp + 0x14], eax
jle 0x4588e9
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, edi
xor esi, 1
cmp edi, 2
cmovae esi, edi
test ebx, ebx
je 0x4588a2
mov eax, dword [ebp + 0x10]
mov ecx, esi
add ecx, ecx
mov edx, dword [eax + ecx*8]
test edx, edx
je 0x4588d9
mov ecx, dword [esp + 0x24]
mov bl, byte [ecx]
test bl, bl
je 0x458886
mov ebp, ecx
mov al, bl
sub ebp, edx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x4ea938]
cmp al, byte [ecx + 0x4ea938]
jne 0x458882
mov al, byte [edx + ebp + 1]
inc edx
mov bl, al
test al, al
jne 0x458861
mov ebp, dword [esp + 0x1c]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x4ea938]
movzx eax, bl
mov ebx, dword [esp + 0x24]
movzx eax, byte [eax + 0x4ea938]
sub eax, ecx
jne 0x4588d9
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x14]
add esi, esi
push ecx
push dword [esp + 0x24]
mov eax, dword [eax + esi*8 + 0xc]
add eax, 8
push eax
call fcn.0042fa90
add esp, 0xc
test eax, eax
je 0x4588d1
mov eax, dword [eax + 8]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4588e7
jmp 0x4588dd
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4588dd
mov eax, dword [esp + 0x10]
inc edi
cmp edi, dword [ebp + 0x14]
jl 0x458830
pop esi
pop ebx
pop edi
pop ebp
add esp, 8
ret
Function at 0x47ef10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x18]
movsx eax, word [edi + 0x4c]
mov ecx, dword [edi + 0x20]
movzx edx, word [edi + 0x28]
mov dword [esp + 0x10], ecx
mov eax, dword [edi + eax*4 + 0x78]
mov eax, dword [eax + 0x3c]
sub eax, ecx
lea ecx, [ebx + ebp]
cmp edx, eax
cmovae edx, eax
cmp ecx, edx
ja 0x47ef66
mov ecx, dword [esp + 0x10]
add ecx, ebp
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ecx
xor eax, eax
pop edi
mov ecx, 0x1010
mov word [esi + 8], cx
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, 1
mov word [esi + 8], ax
lea eax, [ebx + 2]
cmp dword [esi + 0x18], eax
jge 0x47ef8d
push 0
push eax
push esi
call fcn.0047f010
add esp, 0xc
test eax, eax
je 0x47ef93
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], eax
cmp dword [esp + 0x24], 0
mov eax, dword [esi + 0x10]
je 0x47efad
push 0
push eax
push ebx
push ebp
push edi
call fcn.0041e610
add esp, 0x14
jmp 0x47efb9
push eax
push ebx
push ebp
push edi
call fcn.0044bef0
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x47efe2
mov eax, dword [esi + 0x10]
mov byte [ebx + eax], 0
mov eax, dword [esi + 0x10]
mov byte [eax + ebx + 1], 0
mov eax, 0x210
mov word [esi + 8], ax
mov eax, edi
pop edi
mov dword [esi + 0xc], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, 0x2460
test word [esi + 8], ax
jne 0x47eff3
cmp dword [esi + 0x18], 0
je 0x47effc
push esi
call fcn.00488f40
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret