joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47afc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56446b
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x5ab3e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x244], 0xffffffff
push eax
mov dword [ebp - 0x248], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x47b1d0
cmp dword [ebp - 0x248], 0xffffffff
je 0x47b1d0
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
cmp eax, 0xffffffff
je 0x47b199
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push ebx
push eax
call fcn.0048deb0
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x47b110
jmp 0x47b0a0
lea eax, [ebp - 0x218]
push str.explorer.exe
push eax
call fcn.00497199
add esp, 8
test eax, eax
jne 0x47b0ee
cmp edi, ebx
je 0x47b0cf
mov eax, dword [ebp - 0x234]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x258], edi
jmp 0x47b0ee
lea eax, [ebp - 0x234]
push eax
push edi
lea ecx, [ebp - 0x25c]
call fcn.00402a10
mov ebx, dword [ebp - 0x254]
mov edi, dword [ebp - 0x258]
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x240]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47b0a0
mov esi, dword [ebp - 0x25c]
mov dword [ebp - 0x24c], esi
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
je 0x47b199
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0xffffffff
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x47b184
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x248]
jne 0x47b184
push dword [esi]
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x47b184
lea ecx, [ebp - 0x244]
push ecx
push 0xf
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x250]
test eax, eax
jne 0x47b18d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, edi
jne 0x47b120
jmp 0x47b193
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x24c]
mov edi, dword [ebp - 0x244]
test esi, esi
je 0x47b1cc
sub ebx, esi
mov eax, esi
and ebx, 0xfffffffc
cmp ebx, 0x1000
jb 0x47b1c2
mov esi, dword [esi - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47b1f2
push ebx
push esi
call fcn.0048b6db
add esp, 8
mov eax, edi
jmp 0x47b1d6
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b6e9
mov esp, ebp
pop ebp
ret
call fcn.00497009
int3
Function at 0x47c2f0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5647b9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ab3e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004762d0
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
call fcn.004762d0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.004762d0
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
call fcn.004762d0
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 3
call fcn.004762d0
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.004762d0
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 5
call fcn.004762d0
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 6
call fcn.004762d0
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 7
call fcn.004762d0
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 8
call fcn.004762d0
lea ecx, [esi + 0xf0]
mov byte [ebp - 4], 9
call fcn.004762d0
lea ecx, [esi + 0x108]
mov byte [ebp - 4], 0xa
call fcn.004762d0
lea ecx, [esi + 0x120]
mov byte [ebp - 4], 0xb
call fcn.004762d0
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 0xc
call fcn.004762d0
lea ecx, [esi + 0x150]
mov byte [ebp - 4], 0xd
call fcn.004762d0
lea ecx, [esi + 0x168]
mov byte [ebp - 4], 0xe
call fcn.004762d0
lea ecx, [esi + 0x180]
mov byte [ebp - 4], 0xf
call fcn.004762d0
lea ecx, [esi + 0x198]
mov byte [ebp - 4], 0x10
call fcn.004762d0
mov dword [esi + 0x1b0], 0
mov eax, esi
mov dword [esi + 0x1b4], 0
mov dword [esi + 0x1b8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x483780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5656c7
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5ab3e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
call fcn.00484580
test al, al
jne 0x4837c8
or ebx, 0xffffffff
jmp 0x48392e
cmp dword [edi + 0xc], 0
jne 0x483811
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0
push 0
push 1
push 0
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi], eax
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push 0x484ae0
push 0
push 0
mov dword [ebp - 0x10], 0
call fcn.0049d5d9
add esp, 0x18
mov dword [edi + 0xc], eax
lea ecx, [edi + 0x10]
call fcn.00485370
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x20
mov byte [ebp - 4], 1
call fcn.0048b6ab
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x48384f
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
call fcn.004828a0
mov ebx, eax
jmp 0x483851
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push 0x10
mov byte [ebp - 4], 3
call fcn.0048b6ab
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
test esi, esi
je 0x483884
mov dword [esi + 4], 1
mov dword [esi + 8], 1
mov dword [esi], vtable.std::_Ref_count_struct_KIC::Event_.0
mov dword [esi + 0xc], ebx
jmp 0x483886
xor esi, esi
cmp dword [ebp - 0x20], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
je 0x4838bd
push 4
call fcn.0048b6ab
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], ecx
jmp 0x4838c0
mov ecx, dword [ebp - 0x14]
mov edx, dword [edi + 0x20]
cmp edx, dword [edi + 0x24]
je 0x4838e2
mov dword [edx + 4], esi
xor esi, esi
mov dword [edx], ebx
mov dword [edx + 8], ecx
add dword [edi + 0x20], 0xc
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], esi
jmp 0x4838f2
lea ecx, [ebp - 0x1c]
push ecx
push edx
lea ecx, [edi + 0x1c]
call fcn.00482ee0
mov esi, dword [ebp - 0x18]
lea ecx, [edi + 0x10]
call fcn.00485380
push 0
push 1
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
xor ebx, ebx
test esi, esi
je 0x48392e
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x48392e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x48392e
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
lea ecx, [ebp + 8]
call fcn.00408bd0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x4881d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x4881e7
cmp esi, 0x20
jne 0x4883bb
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x4883ba
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x488252
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x488225
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x48833a
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x4882d0
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x57d878]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + str.cw]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx ebx, byte [ebx + str.cw]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x48831d
cmp esi, 6
jbe 0x48831d
cmp edx, 4
jne 0x48831d
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + str.cw]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x488270
xor esi, esi
sub ecx, 1
js 0x4883b9
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x4883a9
cmp ecx, 4
jb 0x4883a9
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x57cc78]
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x57d078]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x57c878]
movzx eax, bl
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x57d478]
mov eax, dword [ebp + 8]
jmp 0x4883ab
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x488347
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4887c0
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [ebx + 0x10]
add eax, 3
shr eax, 2
lea eax, [eax + eax*2]
push eax
call fcn.0048b832
mov ecx, ebx
add esp, 4
mov esi, eax
cmp dword [ecx + 0x14], 0x10
jb 0x4887ec
mov ecx, dword [ecx]
mov ebx, dword [ebx + 0x10]
lea eax, [ebx - 1]
add eax, ecx
cmp byte [eax], 0x3d
jne 0x488809
lea esp, [esp]
lea eax, [eax - 1]
dec ebx
cmp byte [eax], 0x3d
je 0x488800
push edi
xor edi, edi
test ebx, ebx
je 0x4888a6
mov eax, 1
mov dword [ebp + 8], 2
sub eax, ecx
lea edx, [ecx + 2]
mov dword [ebp - 8], eax
lea eax, [ebx - 1]
shr eax, 2
inc eax
mov dword [ebp - 4], eax
movsx eax, byte [edx - 1]
mov ch, byte [eax + 0x57d8e0]
movsx eax, byte [edx - 2]
mov cl, byte [eax + 0x57d8e0]
mov al, ch
sar al, 4
and al, 3
shl cl, 2
or cl, al
mov eax, dword [ebp + 8]
mov byte [edi + esi], cl
inc edi
cmp eax, ebx
jae 0x488897
movsx eax, byte [edx]
shl ch, 4
mov cl, byte [eax + 0x57d8e0]
mov al, cl
sar al, 2
and al, 0xf
or al, ch
mov byte [edi + esi], al
inc edi
mov eax, dword [ebp - 8]
add eax, edx
cmp eax, ebx
jae 0x488894
movsx eax, byte [edx + 1]
shl cl, 6
mov al, byte [eax + 0x57d8e0]
and al, 0x3f
or al, cl
mov byte [edi + esi], al
inc edi
mov eax, dword [ebp + 8]
add eax, 4
add edx, 4
sub dword [ebp - 4], 1
mov dword [ebp + 8], eax
jne 0x488832
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4888af
mov dword [eax], edi
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4888d2
lea eax, [ebp + 8]
cmp ecx, eax
je 0x4888d2
mov edx, dword [ecx]
mov eax, esi
xor esi, esi
mov dword [ecx], eax
test edx, edx
je 0x4888d2
push edx
call fcn.0048b83b
add esp, 4
test edi, edi
pop edi
setne bl
test esi, esi
je 0x4888e5
push esi
call fcn.0048b83b
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4abe70
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004abce6

Function at 0x4b9f20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5661d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5ab3e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xf
mov byte [esi + 0x20], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea ecx, [esi + 0x48]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
push 0
push 0x56beb0
mov byte [ebp - 4], 1
mov dword [esi + 0x60], 4
mov byte [esi + 0x6c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x44], 0
call fcn.0040c3e0
mov dword [esi + 0x68], 0
mov eax, esi
mov dword [esi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4df7f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x44]
test al, al
js 0x4df8df
push ebx
xor ebx, ebx
push edi
test al, al
jle 0x4df879
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ecx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x4df85e
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.0048c6e0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
jmp 0x4df867
push ecx
call fcn.0051fb60
add esp, 4
mov ecx, dword [ebp - 4]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x4df811
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x4df8d0
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.0048c6e0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
pop edi
pop ebx
mov byte [esi + 0x44], 0xff
pop esi
mov esp, ebp
pop ebp
ret
push edx
call fcn.0051fb60
add esp, 4
mov byte [esi + 0x44], 0xff
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f2ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
mov al, byte [esi + 0x44]
test al, al
js 0x4f3099
je 0x4f3094
push dword [esi + 0x74]
call fcn.004fbc40
mov al, byte [esi + 0x44]
add esp, 4
sub al, 1
mov byte [esi + 0x44], al
je 0x4f3089
push ebx
movsx eax, al
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x4f3075
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.0048c6e0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x4f307e
push ecx
call fcn.0051fb60
add esp, 4
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
jne 0x4f3026
pop ebx
mov edx, dword [esi + 0x78]
mov dword [esi + 0x74], edx
jmp 0x4f3114
mov edx, dword [esi + 0x74]
jmp 0x4f30ff
mov ecx, dword [esi + 0x40]
test ecx, ecx
jne 0x4f30ac
pop edi
mov byte [esi], 1
mov eax, 0x10
pop esi
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x4f30c9
cmp al, 4
jne 0x4f30bd
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebp
ret
push esi
call fcn.005052e0
mov ecx, dword [esi + 0x40]
add esp, 4
movzx eax, byte [esi + 2]
lea edi, [esi + 0x74]
push eax
mov eax, dword [esi + 8]
push 0
push edi
push ecx
push dword [eax + 4]
call fcn.004eeab0
mov ecx, eax
add esp, 0x14
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x4f30f3
pop edi
mov byte [esi], 1
pop esi
pop ebp
ret
mov edx, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [edx + 2]
mov byte [esi + 0x45], al
cmp byte [edx], 0
je 0x4f316d
movzx eax, byte [edx + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x4f316d
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x32], ax
cmp word [edx + 0x18], ax
jbe 0x4f3131
mov byte [esi], al
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret
cmp byte [edx + 8], al
jne 0x4f30a0
cmp dword [edx + 4], 1
je 0x4f314f
pop edi
pop esi
mov dword [ebp + 8], 0x10fc9
pop ebp
jmp fcn.0050a770
movzx ecx, byte [edx + 9]
mov eax, dword [edx + 0x38]
mov eax, dword [ecx + eax + 8]
bswap eax
push eax
push esi
mov byte [esi], 0
call fcn.004f2d70
add esp, 8
pop edi
pop esi
pop ebp
ret
push 0x595f94
push 0x10fbc
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.004d8010
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebp
ret
Function at 0x4fcdc0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push dword [ebp + 8]
call fcn.0051ccc0
add esp, 0x18
cmp dword [ebp + 0x10], 0
jne 0x4fcdfd
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push dword [ebp + 8]
call fcn.0051ccc0
add esp, 0x10
pop edi
pop ebp
ret
Function at 0x5132b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
xor edx, edx
push esi
xor esi, esi
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0x10]
cmp dword [eax + 0x14], edx
jle 0x51336d
push ebx
nop
mov eax, dword [eax + 0x10]
mov ebx, esi
xor ebx, 1
cmp esi, 2
cmovae ebx, esi
mov ecx, ebx
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
test edi, edi
je 0x513331
mov eax, dword [eax + ecx*8]
sub edi, eax
movzx edx, byte [eax]
movzx ecx, byte [edi + eax]
cmp edx, ecx
jne 0x513304
test edx, edx
je 0x513331
inc eax
jmp 0x5132f2
movzx ecx, byte [ecx + 0x58c540]
movzx edx, byte [edx + 0x58c540]
sub edx, ecx
jne 0x513319
inc eax
jmp 0x5132f2
test ebx, ebx
jne 0x513351
push dword [ebp + 0x10]
push str.main
call fcn.0052a4f0
add esp, 8
test eax, eax
jne 0x513351
mov eax, dword [ebp - 8]
push 0
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.004ea2e0
add esp, 0xc
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x513364
jmp 0x513354
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
inc esi
mov edi, dword [ebp + 0x10]
cmp esi, dword [eax + 0x14]
jl 0x5132d0
pop ebx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x51ef50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test byte [ecx + 0x1c], 4
mov edx, dword [ecx + 0x14]
je 0x51ef7a
mov eax, dword [edx + 0x18]
cmp eax, dword [ecx + 0x18]
jb 0x51ef7a
cmp dword [edx + 0x60], 0
je 0x51ef76
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.005453a0
xor eax, eax
pop ebp
ret
mov eax, dword [edx + 0x28]
test eax, eax
jne 0x51ef78
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x51ef98
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.004f6e30
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.004f8110
Function at 0x549e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x14
mov dword [edi], 0
call fcn.0051c500
mov esi, eax
add esp, 8
test esi, esi
jne 0x549e77
pop edi
lea eax, [esi + 7]
pop esi
pop ebp
ret
cmp byte [0x5ac1cc], 0
push ebx
mov ebx, dword [ebp + 0x10]
je 0x549ec2
mov eax, dword [0x5ac2bc]
test eax, eax
je 0x549e9b
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x549ec2
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x52a930
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.0049d5d9
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x549ed2
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x549eeb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x402870
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x44c054]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4028e7
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x18], 0
je 0x4028f3
mov byte [ebp - 0xd], 1
jmp 0x4028f7
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417bc0
mov esp, ebp
pop ebp
ret

Function at 0x4029e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439f07
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x44c054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00402870
movzx eax, al
test eax, eax
jne 0x402b1a
mov dword [ebp - 0x84], 0x3c
push 0x38
push 0
lea ecx, [ebp - 0x80]
push ecx
call fcn.00419f00
add esp, 0xc
mov dword [ebp - 0x78], str.runas
lea edx, [ebp - 0x40]
push edx
call fcn.00402910
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.00402710
add esp, 8
lea ecx, [ebp - 0x28]
call fcn.00413100
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x68], 0
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x402afa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x4c7
jne 0x402aba
mov byte [ebp - 0x41], 0
lea ecx, [ebp - 0x28]
call fcn.0040df30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040df10
mov al, byte [ebp - 0x41]
jmp 0x402b1c
mov byte [ebp - 0x42], 0
lea ecx, [ebp - 0x28]
call fcn.0040df30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040df10
mov al, byte [ebp - 0x42]
jmp 0x402b1c
push 0
call fcn.0041c82e
lea ecx, [ebp - 0x28]
call fcn.0040df30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040df10
jmp 0x402b1c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00417bc0
mov esp, ebp
pop ebp
ret