joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54dba0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x98
call fcn.00584ea0
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xa0]
mov dword [esp + 4], edi
mov eax, dword [ecx]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x84], eax
mov dword [esp + 0x58], 0x61707865
mov dword [esp + 0x5c], 0x3320646e
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x8c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x90], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x60], 0x79622d32
mov dword [esp + 0x64], 0x6b206574
test eax, eax
je 0x54dd9d
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], esi
push eax
call fcn.0054ddc0
add esp, 8
xor eax, eax
test esi, esi
je 0x54dd6c
cmp esi, 0x20
jb 0x54dd44
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x23]
add edx, esi
cmp edi, ecx
ja 0x54dcbc
lea ecx, [esp + 0x24]
cmp edx, ecx
jae 0x54dd44
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x54dcc9
cmp edx, ebx
jae 0x54dd44
mov ebp, esi
lea edx, [edi + 0x10]
lea esi, [esp + 0x24]
mov ecx, ebx
sub ecx, esi
and ebp, 0xffffffe0
mov dword [esp + 0x14], ecx
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x14]
sub ecx, edi
mov esi, dword [esp + 0x18]
mov edi, ecx
mov dword [esp + 0x1c], ecx
nop word [eax + eax]
movups xmm0, xmmword [esp + eax + 0x24]
lea ecx, [ebx + eax]
movups xmm1, xmmword [esp + ecx + 0x24]
lea ecx, [esi + eax]
lea edx, [edx + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
add eax, 0x20
movups xmmword [esp + ecx + 0x24], xmm1
movups xmm1, xmmword [edi + edx - 0x20]
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp eax, ebp
jb 0x54dd00
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xb0]
cmp eax, esi
jae 0x54dd6c
lea ecx, [esp + 0x24]
mov ebp, edi
sub ebx, ecx
sub ebp, ecx
lea edx, [esp + 0x24]
add edx, eax
inc eax
mov cl, byte [ebx + edx]
xor cl, byte [edx]
mov byte [edx + ebp], cl
cmp eax, esi
jb 0x54dd52
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
add edi, esi
inc dword [esp + 0x94]
sub eax, esi
add ebx, esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], eax
test eax, eax
jne 0x54dc70
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
pop edi
xor ecx, esp
call fcn.00584a28
add esp, 0x98
ret
Function at 0x580180
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.00584ea0
mov eax, dword [0x6009e4]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x5801e0
push 0x4d4
push 0x5e4c38
push str.assertion_failed:_rec__orig_len___md_size
call fcn.004e66d0
add esp, 0xc
cmp ebx, 0x40
jbe 0x5801fc
push 0x4d5
push 0x5e4c38
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.004e66d0
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x20], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x2c], edi
cmp ecx, eax
jbe 0x58022a
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x18], 0
push esi
push edi
call fcn.005869c0
add esp, 0xc
mov dword [esp + 0x18], esi
cmp ebp, dword [esp + 0x20]
jae 0x5802dd
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x10]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x10]
neg edi
or edx, eax
mov eax, dword [esp + 0x28]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x14]
inc ebp
and eax, edx
mov edx, dword [esp + 0x18]
and edi, edx
mov dword [esp + 0x14], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x2c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ebp, dword [esp + 0x20]
jb 0x580265
xor edx, edx
test ebx, ebx
je 0x580311
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x5802e7
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00584a28
add esp, 0xa8
ret
Function at 0x580ce0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.00584ea0
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x28]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x580d2d
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x580d1d
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x580d32
cmp edi, dword [esi + 8]
ja 0x580d14
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebp
call fcn.00557870
push eax
call fcn.004fdae0
add esp, 8
test eax, 0x200000
je 0x580d78
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov ebx, edx
mov dword [esp + 0x10], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x580e04
mov eax, dword [esi + 0x14]
mov esi, dword [esp + 0x20]
mov edx, esi
mov ebp, dword [esp + 0x10]
shr edx, 0x1f
dec ebp
mov dword [esp + 0x18], edx
add ebp, eax
nop
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x2c]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jb 0x580dc0
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebp + 1]
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop ebp
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x59b113
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059af92

Function at 0x59e67a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059e33a
Function at 0x100063e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [0x100d33d0], 0
push esi
je 0x1000643d
mov eax, dword [0x100d8cc0]
test eax, eax
je 0x1000640d
push eax
call dword [0x100d3428]
add esp, 4
lea ebx, [ebp - 4]
mov eax, 0x14
call fcn.10003ca0
mov eax, dword [0x100d8cc0]
test eax, eax
je 0x1000642d
push eax
call dword [0x100d3430]
add esp, 4
mov esi, dword [ebp - 4]
test esi, esi
jne 0x1000644c
lea eax, [esi + 7]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x14
call dword [0x100d33f8]
add esp, 4
mov esi, eax
jmp 0x10006430
cmp dword [0x100d33d4], 0
je 0x10006493
mov eax, dword [0x100d34d8]
test eax, eax
je 0x1000646c
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x10006493
mov ecx, dword [ebp + 0xc]
lea edx, [esi + 4]
push edx
push 0
push esi
push 0x100063b0
push 0
push 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
call fcn.100a48ec
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x100064a3
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x100064bc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008350
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x1000837d
push esi
lea esp, [esp]
movzx ecx, cl
movzx ecx, byte [ecx + 0x100b8af0]
lea esi, [eax*8]
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x10008360
pop esi
ret
Function at 0x100083e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x100083fe
mov esi, 0x80
cmp esi, dword [edi]
jne 0x1000840a
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100d8b5c]
test eax, eax
je 0x10008415
call eax
lea ecx, [esi*8]
push 0
push ecx
call fcn.10003d80
mov esi, eax
mov eax, dword [0x100d8b60]
add esp, 8
mov dword [ebp - 4], esi
test eax, eax
je 0x10008437
call eax
test esi, esi
je 0x10008402
mov edx, dword [edi + 0xc]
push edx
call sym.SQLite3Encrypt.dll_sqlite3_free
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x100d3404]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 8], ebx
mov dword [edi], ebx
call fcn.100a6a70
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x10008519
mov esi, dword [ecx + 0xc]
mov dl, byte [esi]
xor eax, eax
test dl, dl
je 0x100084ad
movzx edx, dl
movzx edx, byte [edx + 0x100b8af0]
lea ebx, [eax*8]
xor edx, ebx
inc esi
xor eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x1000848e
mov ebx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x100084f5
mov esi, dword [eax]
test esi, esi
je 0x100084cb
mov edx, dword [eax + 4]
jmp 0x100084cd
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x100084f5
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x100084ed
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x1000850e
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x1000850e
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x10008504
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x10008483
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi + 0xc]
test esi, esi
je 0x10008579
mov edx, dword [ebp + 8]
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x1000856c
jmp 0x10008550
movzx ecx, cl
movzx ecx, byte [ecx + 0x100b8af0]
lea ebx, [eax*8]
xor ecx, ebx
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x10008550
xor edx, edx
div dword [edi]
mov eax, dword [esi + edx*8 + 4]
mov esi, dword [esi + edx*8]
jmp 0x10008581
mov eax, dword [edi + 8]
mov esi, dword [edi + 4]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
test esi, esi
je 0x100085f1
mov edx, dword [ebp + 8]
movzx ecx, byte [edx]
movzx edx, byte [ecx + 0x100b8af0]
mov dword [ebp + 0xc], edx
lea ebx, [ebx]
mov edx, dword [eax + 0xc]
mov bl, byte [edx]
movzx ecx, bl
movzx ecx, byte [ecx + 0x100b8af0]
dec esi
sub ecx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
jne 0x100085e8
mov esi, dword [ebp + 8]
sub esi, edx
lea ecx, [ecx]
test bl, bl
je 0x100085e4
movzx ecx, byte [esi + edx + 1]
movzx edi, byte [ecx + 0x100b8af0]
mov bl, byte [edx + 1]
inc edx
movzx ecx, bl
movzx ecx, byte [ecx + 0x100b8af0]
sub ecx, edi
je 0x100085c0
jmp 0x100085e8
test ecx, ecx
je 0x100085f3
mov esi, dword [ebp - 4]
mov eax, dword [eax]
test esi, esi
jne 0x100085a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100962a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
cmp ecx, 0x80
jge 0x100962c3
lea edx, [ecx - 0x41]
cmp edx, 0x19
ja 0x1009636d
lea eax, [ecx + 0x20]
mov esp, ebp
pop ebp
ret
cmp ecx, 0x10000
jge 0x1009635f
push esi
push edi
mov edi, 0xa2
xor esi, esi
mov dword [ebp - 4], 0xffffffff
push ebx
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
movzx edx, word [eax*4 + 0x100bcc38]
mov ebx, ecx
sub ebx, edx
js 0x10096300
mov edx, eax
mov dword [ebp - 4], edx
lea esi, [eax + 1]
jmp 0x10096306
mov edx, dword [ebp - 4]
lea edi, [eax - 1]
cmp edi, esi
jge 0x100962e0
pop ebx
test edx, edx
js 0x10096348
movzx eax, word [edx*4 + 0x100bcc38]
movzx esi, byte [edx*4 + 0x100bcc3b]
add esi, eax
cmp ecx, esi
jge 0x10096348
movzx edx, byte [edx*4 + 0x100bcc3a]
xor eax, ecx
and eax, edx
test al, 1
jne 0x10096348
shr edx, 1
movzx eax, word [edx*2 + 0x100bcec8]
add eax, ecx
and eax, 0xffff
jmp 0x1009634a
mov eax, ecx
cmp dword [ebp + 8], 0
pop edi
pop esi
je 0x1009636d
push eax
call fcn.10095f70
add esp, 4
mov esp, ebp
pop ebp
ret
lea edx, [ecx - 0x10400]
cmp edx, 0x27
ja 0x1009636d
lea eax, [ecx + 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x1009afd0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push ebx
push esi
push edi
push ecx
push edx
push str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
xor esi, esi
xor ebx, ebx
call sym.SQLite3Encrypt.dll_sqlite3_mprintf
add esp, 0xc
mov dword [esp + 0x14], eax
test eax, eax
jne 0x1009b00a
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ebp + 8]
lea edi, [esp + 0x24]
call fcn.10059520
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x1009b071
mov edi, dword [esp + 0x10]
push edi
call sym.SQLite3Encrypt.dll_sqlite3_step
add esp, 4
cmp eax, 0x64
jne 0x1009b049
push 0
push edi
call sym.SQLite3Encrypt.dll_sqlite3_column_int64
add esp, 8
mov esi, eax
mov ebx, edx
push edi
call sym.SQLite3Encrypt.dll_sqlite3_finalize
add esp, 4
mov edi, eax
test edi, edi
jne 0x1009b09b
mov eax, esi
or eax, ebx
jne 0x1009b07a
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x28], 0x100000
mov dword [eax + 0x2c], 0
jmp 0x1009b09b
cmp edi, 7
je 0x1009b054
xor edi, edi
jmp 0x1009b05e
test ebx, ebx
jl 0x1009b08b
jg 0x1009b085
cmp esi, 0x64
jbe 0x1009b08b
mov eax, esi
mov ecx, ebx
jmp 0x1009b092
mov eax, 0x64
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], ecx
mov ecx, dword [esp + 0x14]
push ecx
call sym.SQLite3Encrypt.dll_sqlite3_free
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1009b290
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
push edi
je 0x1009b2fd
push eax
push str.PRAGMA__Q.page_size
mov dword [ebp + 0xc], 0
call sym.SQLite3Encrypt.dll_sqlite3_mprintf
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edx
mov ecx, edi
call fcn.1009b220
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1009b2f7
movzx ecx, byte [esi + 0x16]
mov eax, dword [ebp + 0xc]
imul ecx, ecx, 0x33
add eax, 0xffffffc0
add ecx, 4
mov dword [esi + 0x10], eax
cmp ecx, eax
jge 0x1009b33f
push edi
mov dword [esi + 0x10], ecx
call sym.SQLite3Encrypt.dll_sqlite3_free
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
jmp 0x1009b327
mov edx, dword [esi + 0x20]
push edx
push eax
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.SQLite3Encrypt.dll_sqlite3_mprintf
add esi, 0x10
push esi
mov esi, dword [ebp + 8]
mov edi, eax
push esi
mov ecx, edi
call fcn.1009b220
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x1009b33f
push esi
call sym.SQLite3Encrypt.dll_sqlite3_errmsg
push eax
push 0x100bd55c
call sym.SQLite3Encrypt.dll_sqlite3_mprintf
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
add esp, 0xc
push edi
call sym.SQLite3Encrypt.dll_sqlite3_free
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x1009ebe0
Capabilities:
Encode data using xor
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4
mov eax, dword [0x100d2170]
xor eax, esp
mov dword [esp + 0xc0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
mov dword [esp + 0xc], eax
xor edi, edi
xor eax, eax
cmp esi, 0x20
jle 0x1009ec14
mov esi, 0x20
cmp esi, edi
jle 0x1009ec2c
push esi
push ecx
lea edx, [esp + 0xb4]
push edx
call fcn.100aace0
add esp, 0xc
mov eax, esi
xor ecx, ecx
cmp eax, 0x20
jge 0x1009ec4c
cmp ecx, 0x20
jge 0x1009ec4c
mov dl, byte [ecx + 0x100d79b4]
mov byte [esp + eax + 0xac], dl
inc eax
inc ecx
cmp eax, 0x20
jl 0x1009ec33
xor eax, eax
cmp eax, 0x20
jge 0x1009ec63
mov cl, byte [eax + 0x100d79b4]
mov byte [esp + eax + 0x7c], cl
inc eax
cmp eax, 0x20
jl 0x1009ec53
lea edx, [esp + 0x7c]
push 0x20
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.1009dec0
add esp, 8
lea esi, [esp + 0x10]
lea ebx, [esp + 0x6c]
call fcn.1009de10
mov edi, 0x32
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x6c]
push 0x10
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.1009dec0
add esp, 8
lea esi, [esp + 0x10]
lea ebx, [esp + 0x6c]
call fcn.1009de10
dec edi
jne 0x1009ecb0
mov ecx, 8
lea esi, [esp + 0xac]
lea edi, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor ebx, ebx
xor eax, eax
jmp 0x1009ed20
mov cl, byte [esp + eax + 0x6c]
xor cl, bl
mov byte [esp + eax + 0x9c], cl
inc eax
cmp eax, 0x10
jl 0x1009ed20
lea edx, [esp + 0x7c]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0xa4]
call fcn.1009e660
inc ebx
add esp, 8
cmp ebx, 0x14
jl 0x1009ed13
lea ecx, [esp + 0xac]
push 0x20
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.1009dec0
lea edx, [esp + 0x84]
push 0x20
push edx
lea eax, [esp + 0x20]
call fcn.1009dec0
add esp, 0x10
lea esi, [esp + 0x10]
lea ebx, [esp + 0x6c]
call fcn.1009de10
mov edi, 0x32
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x6c]
push 0x10
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.1009dec0
add esp, 8
lea esi, [esp + 0x10]
lea ebx, [esp + 0x6c]
call fcn.1009de10
dec edi
jne 0x1009edb3
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov dword [eax], ecx
mov ecx, dword [esp + 0x74]
pop edi
mov dword [eax + 4], edx
mov edx, dword [esp + 0x74]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0xc8]
pop esi
pop ebx
xor ecx, esp
mov dword [eax + 0xc], edx
call fcn.100a3aa6
mov esp, ebp
pop ebp
ret
Function at 0x100a3aa6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100d2170]
jne 0x100a3ab0
repz ret
jmp fcn.100a52f4

Function at 0x100a9edb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100d2170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100a6dee
and dword [ebp - 0x14], 0
cmp dword [0x100d87cc], 0
mov dword [ebp - 0x18], eax
jne 0x100a9f8e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100aa036
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100aa036
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100d87cc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100d87d0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100d87d4], eax
call edi
push eax
call esi
mov dword [0x100d87dc], eax
test eax, eax
je 0x100a9f8e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100d87d8], eax
mov eax, dword [0x100d87d8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100a9fe7
cmp dword [0x100d87dc], ecx
je 0x100a9fe7
push eax
call esi
push dword [0x100d87dc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100a9fe7
test ebx, ebx
je 0x100a9fe7
call edi
test eax, eax
je 0x100a9fde
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100a9fde
test byte [ebp - 8], 1
jne 0x100a9fe7
or dword [ebp + 0x10], 0x200000
jmp 0x100aa01a
mov eax, dword [0x100d87d0]
cmp eax, dword [ebp - 0x18]
je 0x100aa01a
push eax
call esi
test eax, eax
je 0x100aa01a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100aa01a
mov eax, dword [0x100d87d4]
cmp eax, dword [ebp - 0x18]
je 0x100aa01a
push eax
call esi
test eax, eax
je 0x100aa01a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100d87cc]
call esi
test eax, eax
je 0x100aa036
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100aa038
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a3aa6
leave
ret
Function at 0x2ae2c20
Capabilities:
Encode data using xor

Disassembly:
xor al, al
cmp dword [esp + 8], 0
push ebp
mov ebp, dword [esp + 8]
je 0x2ae2cb7
test ebp, ebp
je 0x2ae2cb7
mov eax, ebp
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x2ae2c40
sub eax, edx
push ebx
sar eax, 1
shr eax, 1
push esi
mov ebx, eax
push edi
lea edi, [ebx + 2]
push edi
call fcn.02ae374f
mov esi, eax
add esp, 4
test esi, esi
je 0x2ae2cb2
push edi
push 0
push esi
call fcn.02ae6370
push esi
push ebp
mov eax, ebx
call fcn.02ae20d0
add esp, 0x14
xor eax, eax
test ebx, ebx
jbe 0x2ae2c8b
xor byte [eax + esi], bl
inc eax
cmp eax, ebx
jb 0x2ae2c83
mov ecx, dword [esp + 0x18]
lea eax, [ebx + ebx]
push eax
push ecx
push ebx
push esi
push 0
push 0
call dword [0x2aef018]
push esi
mov bl, 1
call fcn.02ae574e
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret