joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a890
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x40a8bd
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x4f4b60]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x40a8a0
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40a930
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
mov ebp, ecx
mov ecx, 0x80
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebp]
jne 0x40a95e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x70dab8]
test eax, eax
je 0x40a969
call eax
lea eax, [esi*8]
push eax
call fcn.00406c30
mov ecx, dword [0x70dabc]
add esp, 4
mov ebx, eax
mov dword [esp + 0x18], ebx
test ecx, ecx
je 0x40a98b
call ecx
test ebx, ebx
je 0x40a954
push dword [ebp + 0xc]
call fcn.00406f20
add esp, 4
mov dword [ebp + 0xc], ebx
push ebx
call dword [0x510f4c]
shr eax, 3
add esp, 4
mov dword [esp + 0x14], eax
mov dword [ebp], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.004cb700
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp + 8], 0
test ecx, ecx
je 0x40aa6c
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x40a9ff
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x4f4b60]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x40a9e2
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea esi, [eax + edx*8]
test esi, esi
je 0x40aa49
mov eax, dword [esi]
test eax, eax
je 0x40aa1f
mov edx, dword [esi + 4]
jmp 0x40aa21
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x40aa49
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x40aa41
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x40aa62
mov dword [ebp + 8], ecx
mov dword [edx + 4], ecx
jmp 0x40aa62
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x40aa58
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [ebp + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x40a9d6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x40ab90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [ecx + 0xc], 0
mov eax, edx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
je 0x40abe5
push ebx
push esi
xor esi, esi
mov ebx, eax
push edi
mov edi, ebp
test ebp, ebp
jle 0x40abd6
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x4f4b60]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x40abb5
mov ecx, dword [esp + 0x10]
mov eax, esi
xor edx, edx
div dword [ecx]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
jmp 0x40abe7
xor edx, edx
push edx
push ebp
mov edx, eax
call fcn.0040aa80
add esp, 8
pop ebp
test eax, eax
je 0x40abff
mov eax, dword [eax + 8]
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x40ac10
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [esp + 0x10], edi
cmp dword [esi], 0
je 0x40ac5c
mov eax, dword [esp + 0x18]
mov ebp, edi
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x40ac4e
movzx eax, byte [ebp]
lea ecx, [edi*8]
dec ebx
lea ebp, [ebp + 1]
movzx edx, byte [eax + 0x4f4b60]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x40ac30
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [esp + 0x10]
mov ebp, edx
jmp 0x40ac5e
xor ebp, ebp
push ebp
push dword [esp + 0x1c]
mov edx, edi
mov ecx, esi
call fcn.0040aa80
add esp, 8
test eax, eax
je 0x40aca1
mov ecx, dword [esp + 0x1c]
mov ebx, dword [eax + 8]
test ecx, ecx
jne 0x40ac93
push ebp
mov edx, eax
mov ecx, esi
call fcn.0040ab30
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x40ad37
push 0x14
call fcn.00406c30
mov edi, eax
add esp, 4
test edi, edi
je 0x40ac99
mov eax, dword [esp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x40ad01
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x40ad01
add edx, edx
mov ecx, esi
call fcn.0040a930
test eax, eax
je 0x40ad01
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
call fcn.0040a890
xor edx, edx
div dword [esi]
mov ebp, edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40ad1e
push edi
lea edx, [eax + ebp*8]
mov ecx, esi
call fcn.0040a8d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x40ad2d
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x438350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc8
mov eax, dword [0x50e74c]
xor eax, esp
mov dword [esp + 0xc4], eax
mov eax, dword [edx + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
movdqu xmm0, xmmword [eax]
mov ecx, dword [edx + 0x14]
lea edx, [esp + 0x9c]
movdqu xmmword [esp + 0x9c], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esp + 0xac], xmm0
movdqu xmm0, xmmword [eax + 0x20]
lea eax, [esp + 0x3c]
mov byte [esp + 0xc], 0x45
mov dword [esp + 0x18], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x48], eax
movdqu xmmword [esp + 0xbc], xmm0
mov byte [esp + 0x3c], 0x50
mov eax, dword [ecx + 8]
mov eax, dword [eax]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x78], eax
mov byte [esp + 0x6c], 0x4e
mov eax, dword [ecx + 8]
mov ecx, esi
mov eax, dword [eax + 0x18]
mov dword [esp + 0x7c], eax
lea eax, [esp + 8]
push eax
call fcn.00437ee0
mov cl, byte [esp + 0xa0]
lea edx, [esp + 0x10]
and dword [esp + 0xa4], 0xffffefff
add esp, 4
cmp dword [esp + 0xd8], 0
mov byte [esp + 0xc2], cl
mov ecx, esi
mov byte [esp + 0x9c], 0x84
push dword [esp + 0xdc]
mov dword [esp + 0xbc], eax
push dword [esp + 0xd8]
je 0x43844a
call fcn.004384c0
jmp 0x43844f
call fcn.00438790
mov edx, dword [esp + 0x10]
add esp, 8
test edx, edx
je 0x43849a
mov bl, byte [esi + 0x13]
cmp bl, 8
jae 0x43849a
xor ecx, ecx
lea eax, [esi + 0x68]
cmp dword [eax + 0x10], edx
je 0x438496
inc ecx
add eax, 0x18
cmp ecx, 0xa
jl 0x438467
movzx eax, bl
mov dword [esi + eax*4 + 0x1c], edx
inc byte [esi + 0x13]
pop esi
pop ebx
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.004c4eaf
add esp, 0xc8
ret
mov byte [eax + 8], 1
mov ecx, dword [esp + 0xcc]
pop esi
pop ebx
xor ecx, esp
call fcn.004c4eaf
add esp, 0xc8
ret
Function at 0x43cd50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
xor eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov ebx, edx
mov dword [esp + 4], eax
push edi
test edx, edx
je 0x43cd7d
cmp byte [edx], al
je 0x43cd75
lea ecx, [ecx]
inc ebx
cmp byte [ebx], al
jne 0x43cd70
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [ecx + 0x14], eax
jle 0x43ce28
push ebp
push esi
lea ebx, [ebx]
mov ebp, edi
cmp edi, 2
jge 0x43cd9a
xor ebp, 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43cdf1
mov ecx, dword [ecx + 0x10]
mov edx, ebp
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x43cdd1
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4f4b60]
cmp cl, byte [edx + 0x4f4b60]
jne 0x43cdd1
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x43cdb4
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x4f4b60]
movzx ecx, byte [ecx + 0x4f4b60]
sub eax, ecx
jne 0x43ce10
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x10]
add ebp, ebp
push ebx
mov ecx, dword [eax + ebp*8 + 0xc]
add ecx, 8
call fcn.0040ab90
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x43ce26
jmp 0x43ce14
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc edi
mov edx, dword [esp + 0x18]
cmp edi, dword [ecx + 0x14]
jl 0x43cd90
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret

Function at 0x43cf40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 8], edx
mov ebx, edx
push edi
test edx, edx
je 0x43cf65
cmp byte [edx], 0
je 0x43cf5d
inc ebx
cmp byte [ebx], 0
jne 0x43cf57
sub ebx, edx
and ebx, 0x3fffffff
mov eax, dword [ecx + 0x14]
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x43d01c
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x18], ecx
push esi
mov edi, edi
mov eax, edi
cmp edi, 2
jge 0x43cf8a
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x43cfed
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x43cfd1
jmp 0x43cfb0
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4f4b60]
cmp cl, byte [edx + 0x4f4b60]
jne 0x43cfcd
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x43cfb0
mov edx, dword [esp + 0x10]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x4f4b60]
movzx ecx, byte [ecx + 0x4f4b60]
sub eax, ecx
jne 0x43cfff
mov eax, dword [esp + 0x14]
push ebx
lea ecx, [eax + 0x18]
call fcn.0040ab90
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x43d012
mov edx, dword [esp + 0x10]
inc edi
mov ecx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jl 0x43cf80
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x43d030
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
add edx, edx
mov ecx, dword [esp + 0x24]
mov esi, ecx
mov dword [esp + 0x14], edi
mov eax, dword [edi + 0x10]
mov ebp, dword [eax + edx*8 + 0xc]
add ebp, 0x18
mov dword [esp + 0x1c], ebp
test ecx, ecx
je 0x43d06e
cmp byte [ecx], 0
je 0x43d066
lea esp, [esp]
inc esi
cmp byte [esi], 0
jne 0x43d060
sub esi, ecx
and esi, 0x3fffffff
mov eax, dword [ebp]
xor ebx, ebx
mov dword [esp + 0x18], eax
test eax, eax
je 0x43d0b6
mov ebp, esi
test esi, esi
jle 0x43d0a8
mov edi, ecx
movzx eax, byte [edi]
lea ecx, [ebx*8]
dec ebp
lea edi, [edi + 1]
movzx edx, byte [eax + 0x4f4b60]
xor edx, ecx
xor ebx, edx
test ebp, ebp
jg 0x43d083
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
mov eax, ebx
mov ebp, dword [esp + 0x1c]
xor edx, edx
div dword [esp + 0x18]
mov ebx, edx
push ebx
mov edx, ecx
mov ecx, ebp
push esi
call fcn.0040aa80
add esp, 8
test eax, eax
je 0x43d124
mov esi, dword [eax + 8]
mov edx, eax
push ebx
mov ecx, ebp
call fcn.0040ab30
add esp, 4
test esi, esi
je 0x43d124
mov edx, dword [esi + 0xc]
mov ecx, dword [edx + 8]
cmp ecx, esi
jne 0x43d0ee
mov eax, dword [esi + 0x14]
mov dword [edx + 8], eax
jmp 0x43d107
test ecx, ecx
je 0x43d107
mov eax, dword [ecx + 0x14]
cmp eax, esi
je 0x43d101
mov ecx, eax
test ecx, ecx
jne 0x43d0f2
jmp 0x43d107
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi + 0x24]
mov ecx, edi
call fcn.00434930
mov edx, dword [esi + 0x10]
mov ecx, edi
call fcn.00406fc0
mov edx, esi
mov ecx, edi
call fcn.00406fc0
or dword [edi + 0x18], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x43d3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0x2c], ebp
mov ebx, ecx
mov dword [esp + 0x18], ebx
test ebp, ebp
je 0x43d564
test ebx, ebx
je 0x43d3ee
cmp dword [ebx + 0x200], 0
jne 0x43d3fd
mov eax, 0xffff
add word [ebp + 0x28], ax
jne 0x43d564
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], edi
test edi, edi
je 0x43d509
lea esp, [esp]
mov eax, dword [edi + 0x14]
mov dword [esp + 0x28], eax
test ebx, ebx
je 0x43d428
cmp dword [ebx + 0x200], 0
jne 0x43d4d6
mov esi, dword [edi]
mov ecx, esi
mov dword [esp + 0x1c], esi
test esi, esi
je 0x43d44e
cmp byte [esi], 0
je 0x43d446
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x43d440
sub ecx, esi
and ecx, 0x3fffffff
mov ebp, dword [edi + 0x18]
add ebp, 0x18
mov dword [esp + 0x24], ebp
mov eax, dword [ebp]
mov dword [esp + 0x20], eax
test eax, eax
je 0x43d4ae
xor edi, edi
mov dword [esp + 0x10], esi
mov ebp, ecx
test ecx, ecx
jle 0x43d496
mov ebx, esi
movzx eax, byte [ebx]
lea edx, [edi*8]
dec ebp
lea ebx, [ebx + 1]
movzx esi, byte [eax + 0x4f4b60]
xor esi, edx
xor edi, esi
test ebp, ebp
jg 0x43d471
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov eax, edi
mov ebp, dword [esp + 0x24]
xor edx, edx
mov edi, dword [esp + 0x14]
div dword [esp + 0x20]
mov eax, edx
mov dword [esp + 0x10], edx
jmp 0x43d4b4
xor eax, eax
mov dword [esp + 0x10], eax
push eax
push ecx
mov edx, esi
mov ecx, ebp
call fcn.0040aa80
add esp, 8
test eax, eax
je 0x43d4d6
push dword [esp + 0x10]
mov edx, eax
mov ecx, ebp
call fcn.0040ab30
add esp, 4
mov edx, dword [edi + 0x24]
mov ecx, ebx
call fcn.00434930
mov edx, dword [edi + 0x10]
mov ecx, ebx
call fcn.00406fc0
mov edx, edi
mov ecx, ebx
call fcn.00406fc0
mov eax, dword [esp + 0x28]
mov edi, eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x43d410
mov ebp, dword [esp + 0x2c]
mov edx, ebp
mov ecx, ebx
call fcn.00449130
mov edx, ebp
mov ecx, ebx
call fcn.0043d350
mov edx, dword [ebp]
mov ecx, ebx
call fcn.00406fc0
mov edx, dword [ebp + 0x14]
mov ecx, ebx
call fcn.00406fc0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43d548
mov edx, esi
mov ecx, ebx
call fcn.00452270
mov edx, esi
mov ecx, ebx
call fcn.00406fc0
mov edx, dword [ebp + 0x18]
mov ecx, ebx
call fcn.004354d0
mov edx, ebp
mov ecx, ebx
call fcn.00461a10
mov edx, ebp
mov ecx, ebx
call fcn.00406fc0
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d570
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
shl edx, 4
mov ecx, dword [esp + 0x1c]
push esi
push edi
add edx, dword [ebp + 0x10]
mov esi, ecx
mov dword [esp + 0x1c], ebp
test ecx, ecx
je 0x43d5a0
cmp byte [ecx], 0
je 0x43d598
inc esi
cmp byte [esi], 0
jne 0x43d592
sub esi, ecx
and esi, 0x3fffffff
mov ebx, dword [edx + 0xc]
xor edi, edi
add ebx, 8
mov dword [esp + 0x18], ebx
mov eax, dword [ebx]
mov dword [esp + 0x14], eax
test eax, eax
je 0x43d5f4
mov ebx, esi
mov ebp, ecx
test esi, esi
jle 0x43d5e2
mov edi, edi
movzx eax, byte [ebp]
lea ecx, [edi*8]
dec ebx
lea ebp, [ebp + 1]
movzx edx, byte [eax + 0x4f4b60]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x43d5c0
mov ecx, dword [esp + 0x24]
mov eax, edi
mov ebx, dword [esp + 0x18]
xor edx, edx
mov ebp, dword [esp + 0x1c]
div dword [esp + 0x14]
mov edi, edx
push edi
mov edx, ecx
mov ecx, ebx
push esi
call fcn.0040aa80
add esp, 8
test eax, eax
je 0x43d618
mov esi, dword [eax + 8]
mov edx, eax
push edi
mov ecx, ebx
call fcn.0040ab30
add esp, 4
jmp 0x43d61a
xor esi, esi
mov edx, esi
mov ecx, ebp
call fcn.0043d3c0
or dword [ebp + 0x18], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x43f4a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x44
mov eax, dword [0x50e74c]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x48]
add edx, edx
push ebx
mov ebx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
push ebp
mov eax, dword [ebx]
push esi
push edi
mov dword [esp + 0x1c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [esp + 0x10], esi
mov dword [esp + 0x24], eax
nop
push eax
push str.sqlite_stat_d
lea eax, [esp + 0x3c]
push eax
push 0x18
call fcn.00408940
mov eax, dword [ebx]
lea ecx, [esp + 0x44]
add esp, 0x10
mov dword [esp + 0x18], eax
xor ebp, ebp
cmp byte [esp + 0x34], 0
je 0x43f50e
inc ecx
cmp byte [ecx], 0
jne 0x43f508
lea edx, [esp + 0x34]
xor ebx, ebx
sub ecx, edx
mov dword [esp + 0x20], ebx
mov edx, dword [eax + 0x14]
and ecx, 0x3fffffff
mov dword [esp + 0x14], ecx
mov dword [esp + 0x30], edx
test edx, edx
jle 0x43f655
mov edi, ebx
cmp ebx, 2
jge 0x43f53d
xor edi, 1
test esi, esi
je 0x43f59d
mov ecx, dword [esp + 0x18]
mov edx, edi
add edx, edx
mov eax, esi
mov ecx, dword [ecx + 0x10]
mov esi, dword [ecx + edx*8]
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx]
test cl, cl
je 0x43f57d
jmp 0x43f560
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x4f4b60]
cmp cl, byte [edx + 0x4f4b60]
jne 0x43f57d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x43f560
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x4f4b60]
movzx ecx, byte [ecx + 0x4f4b60]
sub eax, ecx
jne 0x43f610
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x10]
add edi, edi
mov ebp, dword [eax + edi*8 + 0xc]
cmp dword [ebp + 0x14], 0
je 0x43f5ee
xor esi, esi
lea ebx, [esp + 0x34]
mov edi, ecx
test ecx, ecx
jle 0x43f5e1
jmp 0x43f5c0
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x4f4b60]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x43f5c0
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov eax, esi
xor edx, edx
div dword [ebp + 8]
jmp 0x43f5f0
xor edx, edx
push edx
push ecx
lea edx, [esp + 0x3c]
lea ecx, [ebp + 8]
call fcn.0040aa80
add esp, 8
test eax, eax
je 0x43f60e
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x43f62f
jmp 0x43f610
xor ebp, ebp
mov ecx, dword [esp + 0x14]
inc ebx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], ebx
cmp ebx, dword [esp + 0x30]
jl 0x43f533
test ebp, ebp
je 0x43f655
push dword [esp + 0x28]
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x38]
push dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.0043cc20
add esp, 0x18
jmp 0x43f659
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, 4
jle 0x43f4e0
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c4eaf
add esp, 0x44
ret
Function at 0x45d040
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
add edx, edx
mov ecx, dword [esp + 0x1c]
push esi
push edi
mov eax, dword [ebp + 0x10]
mov esi, ecx
mov dword [esp + 0x1c], ebp
mov ebx, dword [eax + edx*8 + 0xc]
add ebx, 0x28
mov dword [esp + 0x18], ebx
test ecx, ecx
je 0x45d07e
cmp byte [ecx], 0
je 0x45d076
lea esp, [esp]
inc esi
cmp byte [esi], 0
jne 0x45d070
sub esi, ecx
and esi, 0x3fffffff
mov eax, dword [ebx]
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x45d0c6
mov ebx, esi
mov ebp, ecx
test esi, esi
jle 0x45d0b4
movzx eax, byte [ebp]
lea ecx, [edi*8]
dec ebx
lea ebp, [ebp + 1]
movzx edx, byte [eax + 0x4f4b60]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x45d092
mov ecx, dword [esp + 0x24]
mov eax, edi
mov ebx, dword [esp + 0x18]
xor edx, edx
mov ebp, dword [esp + 0x1c]
div dword [esp + 0x14]
mov edi, edx
push edi
mov edx, ecx
mov ecx, ebx
push esi
call fcn.0040aa80
add esp, 8
test eax, eax
je 0x45d152
mov esi, dword [eax + 8]
mov edx, eax
push edi
mov ecx, ebx
call fcn.0040ab30
add esp, 4
test esi, esi
je 0x45d152
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x45d114
mov ecx, esi
call fcn.0045ce70
lea ecx, [eax + 0x40]
mov eax, dword [ecx]
cmp eax, esi
je 0x45d10d
lea ecx, [eax + 0x20]
mov eax, dword [ecx]
cmp eax, esi
jne 0x45d104
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
mov edx, dword [esi + 0x1c]
mov ecx, ebp
call fcn.0045bf60
mov edx, dword [esi]
mov ecx, ebp
call fcn.00406fc0
mov edx, dword [esi + 4]
mov ecx, ebp
call fcn.00406fc0
mov edx, dword [esi + 0xc]
mov ecx, ebp
call fcn.00434930
mov edx, dword [esi + 0x10]
mov ecx, ebp
call fcn.00441020
mov edx, esi
mov ecx, ebp
call fcn.00406fc0
or dword [ebp + 0x18], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4727e0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push 0xffffffffffffffff
push 0x4e5470
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x50e74c]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push esi
push edi
mov eax, dword [0x50e74c]
xor eax, esp
push eax
lea eax, [esp + 0x820]
mov dword fs:[0], eax
mov dword [esp + 0x828], 1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
je 0x472947
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x834
push eax
push 2
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
cmp dword [esp + 0x844], 8
lea eax, [esp + 0x830]
push 0
cmovae eax, dword [esp + 0x834]
push 0
push 3
push 0
push 0
push 0x50
push eax
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
test ebx, ebx
jne 0x472894
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x472947
cmp dword [esp + 0x85c], 8
lea eax, [esp + 0x848]
push 0
cmovae eax, dword [esp + 0x84c]
push 0x4280000
push 0
push 0
push str.HTTP_1.1
push eax
push 0x4fd9c8
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
test esi, esi
jne 0x4728dc
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call esi
push edi
call esi
jmp 0x472947
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x24], ax
lea eax, [esp + 0x26]
push eax
call fcn.004cb700
add esp, 0xc
mov dword [esp + 0x14], 0x400
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0x24]
push eax
push 0x13
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
call ebx
push edi
call ebx
lea ecx, [esp + 0x1c]
call fcn.00495210
push esi
cmp eax, 0xd2
jne 0x472945
call ebx
mov bl, 1
jmp 0x472949
call ebx
xor bl, bl
mov byte [esp + 0x828], 0
cmp dword [esp + 0x844], 8
jb 0x47296a
push dword [esp + 0x830]
call fcn.004c4eaa
add esp, 4
xor eax, eax
mov dword [esp + 0x844], 7
mov dword [esp + 0x840], 0
mov word [esp + 0x830], ax
mov dword [esp + 0x828], 0xffffffff
cmp dword [esp + 0x85c], 8
jb 0x4729ae
push dword [esp + 0x848]
call fcn.004c4eaa
add esp, 4
xor eax, eax
mov dword [esp + 0x85c], 7
mov word [esp + 0x848], ax
mov al, bl
mov dword [esp + 0x858], 0
mov ecx, dword [esp + 0x820]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.004c4eaf
add esp, 0x81c
ret
Function at 0x472a00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4e54d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x50e74c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [esp + 0xc], eax
mov dword [eax + 0xc], 0
mov dword [esp + 0x18], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esp + 0x18], 4
lea ecx, [esi + 0x2c]
mov eax, dword [esp + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x28], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [esi], vtable.RC::RCPackagesItemWnd.0
push eax
push dword [esp + 0x34]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
call fcn.00403000
mov byte [esp + 0x18], 5
mov eax, dword [esp + 0x30]
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], 0
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 0x14