joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c3c0
Capabilities:
Query environment variable
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, ecx
lea esi, [ecx + 0x84]
mov eax, dword [ecx + 0x84]
xor ebx, ebx
test eax, eax
mov dword [esp + 4], edx
je 0x41c420
cmp byte [edi + 0xa], 0
jne 0x41c41e
push eax
call fcn.00428f90
add esp, 4
mov dword [esp + 0x14], eax
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wunlink]
add esp, 4
mov dword [esp + 0x18], eax
push dword [esp + 0x14]
call fcn.00424f10
add esp, 4
mov eax, dword [esi]
cmp dword [esp + 0x18], 0
je 0x41c4d0
mov ebx, eax
push ebx
call fcn.00424f10
add esp, 4
mov dword [edi + 0x84], 0
mov eax, dword [edi]
test eax, eax
je 0x41c461
push esi
push 0x10
push 0
push eax
call fcn.0043d690
add esp, 0x10
mov eax, dword [esi]
test eax, eax
je 0x41c461
push dword [esp + 4]
push eax
push str._z._s
call fcn.00428600
add esp, 0xc
jmp 0x41c4c2
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xffffffff
lea eax, [esp + 8]
push eax
push 8
call fcn.004288e0
add esp, 8
push str.TEMP
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
jne 0x41c49e
push 0x5257dc
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
mov ecx, str._tmp
cmovne ecx, eax
push dword [esp + 4]
push dword [esp + 0x10]
push dword [esp + 0x10]
push ecx
push str._s_temp_llx._s
call fcn.00428600
add esp, 0x14
mov dword [esi], eax
test eax, eax
je 0x41c4e4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.00424f10
add esp, 4
mov dword [esi], 0
jmp 0x41c420
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x15
push str.Error:_out_of_memory_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop dword [eax + eax]
Function at 0x41c6a0
Capabilities:
Reference sql statements

Disassembly:
push esi
push eax
mov esi, ecx
mov dword [esp], 0
mov eax, esp
push eax
push 0
push 0
push str.SAVEPOINT_selftest_init__nCREATE_TABLE_IF_NOT_EXISTS_selftest__n__tno_INTEGER_PRIMARY_KEY__n__op_TEXT__n__cmd_TEXT__n__ans_TEXT_n__CREATE_TEMP_TABLE___shell_self__op_cmd_ans___nINSERT_INTO___shell_self__rowid_op_cmd__n__VALUES_coalesce__SELECT__max_tno_100__10_FROM_selftest__10___n_________memo_Tests_generated_by___init___nINSERT_INTO___shell_self__n__SELECT_run__n____SELECT_hex_sha3_query_SELECT_type_name_tbl_name_sql_FROM_sqlite_schema_ORDER_BY_2_224____n____hex_sha3_query_SELECT_type_name_tbl_name_sql_FROM_sqlite_schema_ORDER_BY_2_224____nINSERT_INTO___shell_self__n__SELECT_run_____SELECT_hex_sha3_query_SELECT__FROM___________printf__w_name_____NOT_INDEXED_224____n____hex_sha3_query_printf_SELECT__FROM___w__NOT_INDEXED_name__224___n__FROM___n____SELECT_name_FROM_sqlite_schema_n_____WHERE_typetable_n_______AND_name__selftest_n_______AND_coalesce_rootpage_0__0_n____n_ORDER_BY_name__nINSERT_INTO___shell_self__n__VALUES_run_PRAGMA_integrity_check_ok___nINSERT_INTO_selftest_tno_op_cmd_ans___SELECT_rowid10_op_cmd_ans_FROM___shell_self___nDROP_TABLE___shell_self__
push dword [ecx]
call fcn.00435e30
add esp, 0x14
cmp dword [esp], 0
je 0x41c6ee
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push dword [esp]
push str.SELFTEST_initialization_failure:__s_n
push eax
call fcn.004014c0
add esp, 0xc
push dword [esp]
call fcn.00424f10
add esp, 4
push 0
push 0
push 0
push str.RELEASE_selftest_init
push dword [esi]
call fcn.00435e30
add esp, 0x18
pop esi
ret
Function at 0x41fdc0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], ecx
test edx, edx
mov edi, 0x51cfd7
cmovne edi, edx
movzx eax, byte [edi]
test al, al
je case.0x41fe68.35
mov ebx, 0x14000031
jmp 0x41fe13
push dword [esp]
push 1
push 5
push str.39_
nop dword [eax]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
movzx eax, byte [edi]
test al, al
je case.0x41fe68.35
mov ecx, edi
inc edi
xor edx, edx
nop dword [eax + eax]
movzx ebp, al
lea esi, [ebp - 0x22]
cmp esi, 0x1c
ja 0x41fe30
bt ebx, esi
jb 0x41fe40
test ebp, ebp
je 0x41fe40
movzx eax, byte [edi]
inc edi
dec edx
jmp 0x41fe20
test edx, edx
je 0x41fe5d
neg edx
push ecx
push edx
push 0x51d875
push dword [esp + 0xc]
call fcn.004014c0
add esp, 0x10
movzx eax, byte [edi - 1]
movzx eax, al
add eax, 0xffffffde
cmp eax, 0x1c
ja case.0x41fe68.35
jmp dword [eax*4 + 0x51cad0]
push dword [esp]
push 1
push 6
push str.quot_
jmp 0x41fe00
push dword [esp]
push 1
push 5
push str.amp_
jmp 0x41fe00
push dword [esp]
push 1
push 4
push str.lt_
jmp 0x41fe00
push dword [esp]
push 1
push 4
push str.gt_
jmp 0x41fe00
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41fee0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ecx + 0x38]
test edx, edx
je 0x41ff7c
mov edi, edx
movzx ecx, byte [edx]
test cl, cl
je 0x41ff2e
mov eax, 1
nop
movzx ecx, cl
cmp byte [ecx + 0x5220be], 0
jne 0x41ff2e
movzx ecx, byte [edi + eax]
inc eax
test cl, cl
jne 0x41ff00
cmp eax, 1
je 0x41ff2e
lea eax, [esi + 0xa6]
push eax
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
add esp, 8
test eax, eax
je 0x41ff9a
push edi
push 0x51e35e
call fcn.00428600
add esp, 8
test eax, eax
je 0x41ff9d
mov edi, eax
push eax
push 0x51d22f
push ebx
call fcn.004014c0
add esp, 0xc
push edi
call fcn.00424f10
add esp, 4
cmp dword [esp + 0x10], 0
je 0x41ff78
lea eax, [esi + 0xa6]
push eax
push 0x51d22f
push dword [esi + 0x38]
call fcn.004014c0
add esp, 0xc
pop esi
pop edi
pop ebx
ret
lea eax, [esi + 0x104]
push eax
push 0x51d22f
push ebx
call fcn.004014c0
add esp, 0xc
cmp dword [esp + 0x10], 0
jne 0x41ff61
jmp 0x41ff78
push edi
jmp 0x41ff83
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x15
push str.Error:_out_of_memory_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
Function at 0x420400
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov ebx, dword [esp + 0x14]
push ecx
push 1
push 2
push 0x5221e5
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
test ebx, ebx
jle 0x420448
xor ebp, ebp
nop word cs:[eax + eax]
movzx eax, byte [edi + ebp]
push eax
push 0x5221e8
push esi
call fcn.004062d0
add esp, 0xc
inc ebp
cmp ebx, ebp
jne 0x420430
push esi
push 0x27
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x420550
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, edx
mov esi, ecx
mov edi, 0xffffffff
mov ebp, dword [esp + 0x1c]
nop word cs:[eax + eax]
cmp byte [ebp + edi + 1], 0
lea edi, [edi + 1]
jne 0x420570
and edi, 0x3fffffff
cmp byte [esi + 6], 0
je 0x42059c
push ebp
push dword [esp + 0x1c]
push ebx
push str._d__d__s_n
push dword [esi + 0x38]
call fcn.004014c0
add esp, 0x14
mov dword [esp], ebx
lea eax, [edi + 0x10]
push 0
push eax
call fcn.00424ee0
add esp, 8
test eax, eax
je 0x4205fb
mov ebx, eax
mov eax, dword [esp]
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 4], eax
mov eax, ebx
add eax, 0xc
inc edi
push edi
push ebp
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [ebx + 8], 0
lea eax, [esi + 0x274]
mov ecx, dword [esi + 0x278]
lea edx, [ecx + 8]
test ecx, ecx
cmove edx, eax
mov dword [edx], ebx
mov dword [esi + 0x278], ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x15
push str.Error:_out_of_memory_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
push esi
call fcn.004315a0
add esp, 4
mov ebp, eax
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0
push dword [ebx]
call fcn.004304e0
add esp, 4
mov dword [esp + 0xc], eax
push dword [ebx + 4]
call fcn.004304e0
add esp, 4
mov edi, eax
push dword [ebx + 8]
call fcn.004304e0
add esp, 4
mov dword [esp + 8], eax
push dword [ebx + 0xc]
call fcn.004304e0
add esp, 4
mov ebx, eax
push 0
push 0xffffffffffffffff
push 0x51cfd7
push esi
call fcn.00431080
add esp, 0x10
mov eax, esp
push 0
push 0
push 0
push eax
push 0
push edi
push dword [esp + 0x24]
push 0x51db42
push ebp
call fcn.0043c7a0
add esp, 0x24
test eax, eax
jne 0x420718
lea eax, [esp + 4]
push 0
push 0
push 0
push eax
push 0
push ebx
push dword [esp + 0x20]
push 0x51db42
push ebp
call fcn.0043c7a0
add esp, 0x24
test eax, eax
jne 0x420718
push dword [esp + 4]
push dword [esp + 4]
call fcn.00428d80
add esp, 8
test eax, eax
je 0x420718
push dword [esp]
push str._COLLATE__s
call fcn.00428600
add esp, 8
mov esi, eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push dword [esp + 0x30]
call fcn.00431080
add esp, 0x10
push esi
call fcn.00424f10
add esp, 4
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x420870
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, edx
mov edi, ecx
mov ebx, dword [esp + 0x14]
push 0
call fcn.004284e0
add esp, 4
mov esi, eax
push edi
call fcn.004362c0
add esp, 4
push eax
push ebp
push str._s___s
push esi
call fcn.00428090
add esp, 0x10
cmp ebx, 2
jl 0x4208b5
push ebx
push str.___d_
push esi
call fcn.00428090
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov edx, edi
call fcn.0041e420
test eax, eax
je 0x4208d9
mov edi, eax
push eax
push esi
call fcn.00428030
add esp, 8
push edi
call fcn.00424f10
add esp, 4
push esi
call fcn.004283a0
add esp, 4
test eax, eax
je 0x4208eb
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x15
push str.Error:_out_of_memory_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
Function at 0x422e90
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov dword [esp], edx
mov esi, ecx
test ecx, ecx
mov ebx, 0x64
cmove ebx, ecx
xor ebp, ebp
nop word cs:[eax + eax]
lea eax, [ebp + 0x64]
cmp eax, ebx
jle 0x422ed0
add ebx, ebx
add ebx, 0x64
push ebx
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov esi, eax
test eax, eax
je 0x422fb1
lea edi, [esi + ebp]
mov eax, ebx
sub eax, ebp
push dword [esp]
push eax
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fgets
add esp, 0xc
test eax, eax
je 0x422f20
add ebp, 0xfffffffd
mov eax, ebp
nop dword [eax]
cmp byte [esi + eax + 3], 0
lea eax, [eax + 1]
jne 0x422ef0
lea ebp, [eax + 2]
test ebp, ebp
jle 0x422eb0
cmp byte [esi + eax + 1], 0xa
jne 0x422eb0
lea ecx, [eax + 2]
xor edi, edi
cmp ecx, 2
jb 0x422f1c
lea edi, [eax + 1]
cmp byte [esi + eax], 0xd
cmove edi, eax
add edi, esi
jmp 0x422f24
test ebp, ebp
je 0x422f9c
mov byte [edi], 0
cmp dword [0x53c140], 0
je 0x422fa7
push 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
cmp eax, dword [esp]
jne 0x422fa7
push 0
push esi
call fcn.004292e0
add esp, 8
test eax, eax
je 0x422fa7
mov edi, eax
mov eax, 0xffffffff
nop word cs:[eax + eax]
cmp byte [edi + eax + 1], 0
lea eax, [eax + 1]
jne 0x422f60
and eax, 0x3fffffff
lea ebp, [eax + 1]
cmp eax, ebx
jl 0x422f86
push ebp
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov esi, eax
test eax, eax
je 0x422fb1
push ebp
push edi
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
push edi
call fcn.00424f10
add esp, 4
jmp 0x422fa7
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x15
push str.Error:_out_of_memory_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x4647c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov word [ecx + 0x32], 0
and byte [ecx + 1], 0xf9
cmp byte [ecx], 0
je 0x4647d6
pop esi
jmp fcn.0046a640
mov eax, dword [ecx + 0x74]
movzx edx, word [ecx + 0x46]
lea esi, [edx + 1]
mov word [ecx + 0x46], si
cmp si, word [eax + 0x18]
jae 0x4647f4
cmp byte [eax + 8], 0
je 0x4647fe
xor eax, eax
pop esi
ret
mov word [ecx + 0x46], dx
pop esi
jmp fcn.0046a640
pop esi
jmp fcn.0046a970
Function at 0x4715c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ecx + 0x14]
mov dword [esp + 0xc], eax
test eax, eax
jle 0x47176d
mov esi, edx
mov ebp, dword [esp + 0x2c]
mov edi, dword [ecx + 0x10]
lea eax, [edx + 1]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], edi
jmp 0x47160f
cmp dword [esp + 0x10], 0
je 0x471734
nop dword [eax + eax]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, dword [esp + 0xc]
je 0x47176d
xor ecx, ecx
cmp eax, 2
setb cl
mov dword [esp + 0x14], eax
xor ecx, eax
mov dword [esp + 0x10], ecx
mov eax, ecx
shl eax, 4
mov ecx, dword [edi + eax + 0xc]
mov dword [esp], ecx
test ebp, ebp
je 0x471661
mov ecx, dword [edi + eax]
xor edx, edx
jmp 0x471650
movzx ebx, byte [ebx + 0x52a853]
cmp bl, byte [eax + 0x52a853]
jne 0x4715f0
inc edx
movzx ebx, byte [ecx + edx]
movzx eax, byte [ebp + edx]
cmp bl, al
jne 0x471640
test ebx, ebx
jne 0x47164f
mov eax, dword [esp]
mov edi, dword [eax + 0x24]
test edi, edi
je 0x4716b0
movzx ecx, byte [esi]
xor eax, eax
test cl, cl
je 0x47169a
mov edx, dword [esp + 8]
nop dword [eax + eax]
movzx ecx, cl
movzx ecx, byte [ecx + 0x52a853]
add ecx, eax
imul eax, ecx, 0x9e3779b1
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x471680
xor edx, edx
mov ecx, dword [esp]
div dword [ecx + 0x18]
lea eax, [edi + edx*8]
lea ecx, [edi + edx*8]
add ecx, 4
jmp 0x4716b6
lea ecx, [eax + 0x20]
add eax, 0x1c
mov edi, dword [eax]
mov eax, 0x53e0d4
test edi, edi
je 0x471723
mov ecx, dword [ecx]
dec edi
mov dword [esp], ecx
mov ecx, dword [ecx + 0xc]
xor edx, edx
jmp 0x4716e0
movzx ebx, byte [ebx + 0x52a853]
cmp bl, byte [eax + 0x52a853]
jne 0x471700
inc edx
movzx ebx, byte [ecx + edx]
movzx eax, byte [esi + edx]
cmp bl, al
jne 0x4716d0
test ebx, ebx
jne 0x4716df
jmp 0x471720
test edi, edi
mov ecx, dword [esp]
jne 0x4716c1
mov edi, dword [esp + 4]
mov eax, 0x53e0d4
jmp 0x471727
mov eax, dword [esp]
mov edi, dword [esp + 4]
mov eax, dword [eax + 8]
test eax, eax
je 0x471600
jmp 0x47176f
xor eax, eax
jmp 0x471754
movzx ecx, byte [ecx + 0x52a853]
cmp cl, byte [edx + 0x52a853]
jne 0x471600
inc eax
movzx ecx, byte [eax + str.main]
movzx edx, byte [ebp + eax]
cmp cl, dl
jne 0x471740
test ecx, ecx
jne 0x471753
jmp 0x471661
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4965c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
test ax, ax
js 0x496789
mov edx, dword [ecx + 0x1c]
and edx, 0x20
je 0x496789
xor esi, esi
mov edx, dword [ecx + 4]
test ax, ax
je 0x496773
mov edi, 0
cmp ax, 0x11
jb 0x496752
mov esi, eax
and esi, 0xf
mov edi, 0x10
cmovne edi, esi
mov esi, eax
sub esi, edi
lea edi, [edx + 0xbe]
pxor xmm0, xmm0
movdqa xmm3, xmmword [0x5284a0]
mov ebx, esi
pxor xmm1, xmm1
nop word cs:[eax + eax]
movzx ebp, word [edi - 0x60]
movd xmm4, ebp
movzx ebp, word [edi - 0x6c]
movd xmm6, ebp
punpcklwd xmm6, xmm4
movzx ebp, word [edi - 0x78]
movd xmm4, ebp
movzx ebp, word [edi - 0x84]
movd xmm5, ebp
punpcklwd xmm5, xmm4
punpckldq xmm5, xmm6
movzx ebp, word [edi - 0x90]
movd xmm4, ebp
movzx ebp, word [edi - 0x9c]
movd xmm6, ebp
punpcklwd xmm6, xmm4
movzx ebp, word [edi - 0xa8]
movd xmm7, ebp
movzx ebp, word [edi - 0xb4]
movd xmm4, ebp
punpcklwd xmm4, xmm7
punpckldq xmm4, xmm6
punpcklqdq xmm4, xmm5
movzx ebp, word [edi]
movd xmm5, ebp
movzx ebp, word [edi - 0xc]
movd xmm7, ebp
punpcklwd xmm7, xmm5
movzx ebp, word [edi - 0x18]
movd xmm5, ebp
movzx ebp, word [edi - 0x24]
movd xmm6, ebp
punpcklwd xmm6, xmm5
punpckldq xmm6, xmm7
movzx ebp, word [edi - 0x30]
movd xmm5, ebp
movzx ebp, word [edi - 0x3c]
movd xmm7, ebp
punpcklwd xmm7, xmm5
movzx ebp, word [edi - 0x48]
movd xmm2, ebp
movzx ebp, word [edi - 0x54]
movd xmm5, ebp
punpcklwd xmm5, xmm2
punpckldq xmm5, xmm7
punpcklqdq xmm5, xmm6
pcmpeqd xmm2, xmm2
pxor xmm4, xmm2
psrlw xmm4, 5
pand xmm4, xmm3
paddw xmm0, xmm4
pxor xmm5, xmm2
psrlw xmm5, 5
pand xmm5, xmm3
paddw xmm1, xmm5
add edi, 0xc0
add ebx, 0xfffffff0
jne 0x496630
paddw xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddw xmm0, xmm1
pshufd xmm1, xmm0, 0x55
paddw xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
paddw xmm0, xmm1
movd edi, xmm0
mov ebx, eax
sub ebx, esi
lea esi, [esi + esi*2]
lea esi, [edx + esi*4]
add esi, 0xa
nop
movzx ebp, word [esi]
bt ebp, 5
sbb di, 0xffff
add esi, 0xc
dec ebx
jne 0x496760
jmp 0x496775
xor edi, edi
lea esi, [eax + eax*2]
test byte [edx + esi*4 + 0xa], 0x20
jne 0x496783
mov eax, edi
jmp 0x496789
sub eax, edi
add ax, word [ecx + 0x24]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bdf10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, dword [esp + 0x88]
mov edi, dword [esp + 0x84]
mov eax, dword [esp + 0x78]
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x1c], xmm0
movdqu xmmword [esp + 0x4c], xmm0
movdqu xmmword [esp + 0x3c], xmm0
movdqu xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x5c], 0xffffffff
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x1c], 0
mov dword [esp + 0xc], 0
mov dword [esp], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], edx
mov word [esp + 0x1d], 0x101
test esi, esi
je 0x4bdfc7
mov ecx, dword [esi + 4]
mov edi, dword [esi + 0xc]
movsx ecx, word [ecx + eax*2]
mov edx, 0xffffffff
cmp cx, word [edi + 0x20]
je 0x4be014
test cx, cx
js 0x4bdfd2
mov edx, dword [edi + 4]
lea edi, [ecx + ecx*2]
movzx edx, byte [edx + edi*4 + 5]
mov byte [esp + 0x1c], dl
mov edx, dword [esi + 0x20]
mov eax, dword [edx + eax*4]
mov dword [esp + 0xc], eax
mov edx, ecx
jmp 0x4be014
xor esi, esi
mov edx, eax
cmp eax, 0xfffffffe
je 0x4be00a
jmp 0x4be014
mov edx, ecx
cmp cx, 0xfffe
jne 0x4be014
mov ecx, dword [esi + 0x28]
mov edx, eax
shl edx, 4
mov ecx, dword [ecx + edx + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx + eax*4]
mov dword [esp + 0xc], eax
mov word [esp + 0x4c], 0xfffe
lea ecx, [esp + 4]
call fcn.004be3b0
test eax, eax
jne 0x4be026
xor esi, esi
mov eax, esi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
mov word [esp + 0x4c], dx
lea ecx, [esp + 4]
call fcn.004be080
test eax, eax
je 0x4be008
and dword [esp], 0x82
xor esi, esi
lea edi, [esp + 4]
jmp 0x4be050
test esi, esi
cmove esi, eax
mov ecx, edi
call fcn.004be080
test eax, eax
je 0x4be00a
mov ebx, dword [eax + 0x20]
mov ebp, dword [eax + 0x24]
mov edx, ebp
and edx, dword [esp + 0x80]
mov ecx, ebx
and ecx, dword [esp + 0x7c]
or ecx, edx
jne 0x4be045
or ebx, ebp
jne 0x4be040
movzx ecx, word [eax + 0xc]
test dword [esp], ecx
je 0x4be040
mov esi, eax
jmp 0x4be00a
Function at 0x4cba10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [esp + 4], ecx
xor ebx, ebx
cmp dword [esp + 0x30], 0
sete al
test edx, edx
je 0x4cbbad
mov esi, edx
mov bl, al
xor ebx, 0x81
xor ebp, ebp
mov dword [esp], ebx
jmp 0x4cba7f
mov edi, dword [esp + 4]
mov ecx, edi
mov edx, esi
push dword [esp + 0x40]
push dword [esp + 0x40]
call fcn.004ccf40
add esp, 8
mov ecx, dword [edi]
mov dword [ecx + 0x44], 0xffffffff
test eax, eax
je 0x4cba70
mov ecx, dword [esp + 0x34]
or ebp, dword [eax + ecx*4 + 0x10]
nop dword [eax + eax]
mov eax, ebp
mov esi, dword [esi + 0x20]
mov ebp, eax
test esi, esi
je 0x4cbbaf
movzx eax, byte [esi + 8]
cmp ebx, eax
jne 0x4cba70
movzx eax, byte [esi + 9]
test dword [esp + 0x38], eax
je 0x4cba70
cmp dword [esp + 0x30], 0
je 0x4cbb60
mov eax, dword [esi + 0x10]
mov dword [esp + 8], eax
test eax, eax
je 0x4cbb60
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
test eax, eax
jle 0x4cbb47
mov eax, dword [esp + 8]
mov edi, dword [eax]
xor ebx, ebx
mov dword [esp + 0xc], edi
test edi, edi
jle 0x4cbb40
mov eax, ebx
shl eax, 4
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + eax + 0xc]
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ebx, dword [eax + ecx*8 + 8]
xor edi, edi
jmp 0x4cbb00
movzx eax, byte [eax + 0x52a853]
cmp al, byte [ecx + 0x52a853]
jne 0x4cbb20
inc edi
movzx eax, byte [ebx + edi]
movzx ecx, byte [edx + edi]
cmp al, cl
jne 0x4cbaf0
test eax, eax
jne 0x4cbaff
jmp 0x4cbb60
mov ecx, dword [esp + 0x18]
inc ecx
mov edi, dword [esp + 0xc]
cmp ecx, edi
mov ebx, dword [esp + 0x10]
jne 0x4cbae0
nop word cs:[eax + eax]
inc ebx
cmp ebx, dword [esp + 0x14]
jne 0x4cbac9
mov eax, ebp
mov ebx, dword [esp]
jmp 0x4cba72
mov eax, 0xffffffff
cmp byte [esi + 0xa], 0
mov ebx, dword [esp]
jne 0x4cba72
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x74]
test eax, eax
cmove eax, ecx
mov eax, dword [eax + 0x7c]
jmp 0x4cbb93
mov eax, dword [eax + 4]
test eax, eax
je 0x4cba3e
cmp dword [eax], esi
jne 0x4cbb90
mov ecx, dword [esp + 0x40]
cmp dword [eax + 0xc], ecx
jne 0x4cbb90
jmp 0x4cba63
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4db1d0
Capabilities:
Reference sql statements

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov byte [ecx + 0x10], 1
push ebp
push dword [esp + 0x1c]
push ebx
push edx
push edx
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push ecx
call fcn.0049fb10
add esp, 0x1c
test ebx, ebx
jne 0x4db212
push ebp
push dword [esp + 0x1c]
push edi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push esi
call fcn.0049fb10
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret