joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402abe
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xca
jne 0x402af3
push ebx
call fcn.004069bf
pop eax
cmp dword [ebx + 0x40], 0
je 0x402aec
mov eax, 1
mov dword [ebx + 0x14], 0xcf
jmp 0x402b8e
mov dword [ebx + 0x14], 0xcb
mov eax, dword [ebx + 0x14]
cmp eax, 0xcb
jne 0x402b65
mov eax, dword [ebx + 0x1ec]
cmp dword [eax + 0x10], 0
je 0x402b57
mov eax, dword [ebx + 8]
test eax, eax
je 0x402b14
push ebx
call dword [eax]
pop ecx
mov eax, dword [ebx + 0x1ec]
push ebx
call dword [eax]
pop edx
test eax, eax
je 0x402b8c
cmp eax, 2
je 0x402b57
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x402b09
cmp eax, 3
sete dl
dec eax
sete al
or eax, edx
test al, 1
je 0x402b09
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
inc eax
mov dword [ecx + 4], eax
cmp eax, edx
jl 0x402b09
add edx, dword [ebx + 0x178]
mov dword [ecx + 8], edx
jmp 0x402b09
mov eax, dword [ebx + 0x90]
mov dword [ebx + 0x98], eax
jmp 0x402b81
cmp eax, 0xcc
je 0x402b81
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebx]
push ebx
call dword [eax]
pop eax
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
jmp fcn.004029f0
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x40415b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push ecx
push ecx
mov esi, dword [ebp + 8]
mov dword [esi + 4], 0
push esi
call fcn.00406d78
push 0x54
push esi
mov dword [ebp - 0x10], eax
call fcn.00406d20
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x4041a3
push esi
call fcn.00406d7f
mov eax, dword [esi]
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0x36
mov eax, dword [esi]
push esi
call dword [eax]
pop eax
pop edx
mov eax, dword [ebp - 0x10]
mov dword [ebx], fcn.00403746
mov dword [ebx + 4], fcn.00403862
mov dword [ebx + 8], fcn.004038fe
mov dword [ebx + 0xc], fcn.00403993
mov dword [ebx + 0x10], 0x403a39
mov dword [ebx + 0x14], 0x403aa1
mov dword [ebx + 0x18], 0x403b09
mov dword [ebx + 0x1c], 0x403dcf
mov dword [ebx + 0x20], 0x403efe
mov dword [ebx + 0x24], fcn.0040402b
mov dword [ebx + 0x28], 0x40411f
mov dword [ebx + 0x30], 0x3b9aca00
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x54
mov dword [esi + 4], ebx
push str.JPEGMEM
call sub.msvcrt.dll_getenv
pop ecx
mov edx, eax
test eax, eax
je 0x404286
lea eax, [ebp - 9]
mov byte [ebp - 9], 0x78
push eax
lea eax, [ebp - 0x10]
push eax
push str._ld_c
push edx
call sub.msvcrt.dll_sscanf
add esp, 0x10
test eax, eax
jle 0x404286
mov al, byte [ebp - 9]
cmp al, 0x6d
sete dl
cmp al, 0x4d
sete al
or eax, edx
test al, 1
je 0x40427c
imul eax, dword [ebp - 0x10], 0x3e8
mov dword [ebp - 0x10], eax
imul eax, dword [ebp - 0x10], 0x3e8
mov dword [ebx + 0x2c], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x424aa7
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [eax]
mov ebx, dword [ebp + 8]
xor ebx, ecx
shr ecx, 8
and ebx, 0xff
xor ecx, dword [edx + ebx*4]
mov ebx, dword [eax + 8]
mov dword [eax], ecx
and ecx, 0xff
add ecx, dword [eax + 4]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [eax + 4], ecx
shr ecx, 0x18
xor ecx, ebx
shr ebx, 8
and ecx, 0xff
xor ebx, dword [edx + ecx*4]
mov dword [eax + 8], ebx
mov eax, dword [ebp + 8]
pop ebx
pop ebp
ret
Function at 0x4260c7
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [eax]
mov ebx, dword [ebp + 8]
xor ebx, ecx
shr ecx, 8
and ebx, 0xff
xor ecx, dword [edx + ebx*4]
mov ebx, dword [eax + 8]
mov dword [eax], ecx
and ecx, 0xff
add ecx, dword [eax + 4]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [eax + 4], ecx
shr ecx, 0x18
xor ecx, ebx
shr ebx, 8
and ecx, 0xff
xor ebx, dword [edx + ecx*4]
mov dword [eax + 8], ebx
mov eax, dword [ebp + 8]
pop ebx
pop ebp
ret
Function at 0x426b35
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
xor edi, edi
mov esi, dword [ebp + 8]
mov eax, 0xffffff9a
test esi, esi
je 0x426d18
cmp dword [esi + 0x2c], 0
je 0x426d18
mov dword [esi + 0x34], 0
cmp dword [esi + 0x80], 8
jne 0x426bb8
cmp dword [esi + 0x84], 0
jne 0x426bb8
cmp dword [esi + 0x40], 0
jne 0x426b8e
mov eax, esi
call fcn.004269a7
lea eax, [esi + 0x88]
mov dword [esi + 0x40], 0x4000
mov dword [esi + 0x3c], eax
lea eax, [esi + 0x30]
mov ebx, dword [esi + 0x44]
push 4
push eax
call fcn.0042979d
mov edi, eax
mov eax, dword [esi + 0x44]
sub eax, ebx
add dword [esi + 0x6c], eax
test edi, edi
pop ebx
pop eax
je 0x426b71
xor eax, eax
cmp edi, 1
setne al
neg eax
and edi, eax
cmp dword [esi + 0x6c], 0
setne dl
xor eax, eax
test edi, edi
sete al
test edx, eax
je 0x426bd7
mov eax, esi
call fcn.004269a7
inc eax
jne 0x426bd7
or edi, 0xffffffff
cmp dword [esi + 0x80], 8
jne 0x426bfc
cmp dword [esi + 0x84], 0
jne 0x426c14
lea eax, [esi + 0x30]
push eax
call fcn.00429450
mov dword [esi + 0x68], 0
mov edi, eax
pop ecx
cmp dword [esi + 0x84], 0
jne 0x426c14
mov eax, dword [esi + 0x408c]
mov dword [ebp + 0x10], eax
mov eax, dword [esi + 0x38]
mov dword [ebp + 0xc], eax
mov ebx, dword [esi + 0x40a4]
mov eax, dword [esi + 0x74]
add ebx, dword [esi + 0x44]
add eax, 0x10
mov edx, dword [ebp + 0x10]
push 4
call fcn.00426280
mov eax, dword [esi + 0x74]
add eax, 0x14
mov edx, ebx
push 4
call fcn.00426280
pop eax
pop edx
cmp dword [esi + 0x5c], 1
jne 0x426c57
mov eax, dword [esi + 0x74]
mov edx, 1
add eax, 0x24
push 2
call fcn.00426280
pop eax
mov eax, dword [esi + 0x74]
mov edx, dword [ebp + 0xc]
add eax, 0x18
push 4
call fcn.00426280
pop eax
test edi, edi
jne 0x426c7d
mov edx, dword [esi + 0x74]
lea eax, [esi + 0x24]
push dword [esi + 0x78]
call fcn.00426177
mov edi, eax
pop eax
push dword [esi + 0x74]
call fcn.0047d2f0
pop eax
test edi, edi
jne 0x426d09
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 0xc]
push 0
or edi, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x70]
add eax, 0xe
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 0x10]
add esp, 0x18
test eax, eax
jne 0x426cf1
mov edx, dword [esi + 0x20]
push 4
push dword [ebp + 0x10]
mov eax, esi
call fcn.00426231
pop ecx
mov edi, eax
pop eax
test edi, edi
jne 0x426cf1
mov edx, dword [esi + 0x20]
mov eax, esi
push 4
push ebx
call fcn.00426231
mov edi, eax
pop eax
test edi, edi
pop edx
jne 0x426cf1
mov edx, dword [esi + 0x20]
push 4
push dword [ebp + 0xc]
mov eax, esi
call fcn.00426231
pop ecx
mov edi, eax
pop ebx
push 0
push dword [ebp - 0x10]
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 0x10]
add esp, 0x10
test eax, eax
je 0x426d09
or edi, 0xffffffff
inc dword [esi + 0x40b0]
mov dword [esi + 0x2c], 0
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4290fa
Capabilities:
Hash data with crc32

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x429344
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, eax
test esi, esi
not ecx
jmp 0x429132
test dl, 3
je 0x429134
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x5255d0]
dec esi
jne 0x42911a
mov ebx, edx
cmp esi, 0x1f
jbe 0x4292e7
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x525dd0]
xor eax, dword [edx*4 + 0x5261d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x5259d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x5255d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x525dd0]
xor eax, dword [edx*4 + 0x5261d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x5259d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x5255d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x525dd0]
xor eax, dword [edx*4 + 0x5261d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x5259d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x5255d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x525dd0]
xor eax, dword [edx*4 + 0x5261d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x5259d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x5255d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x525dd0]
xor eax, dword [edx*4 + 0x5261d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x5259d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x5255d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x525dd0]
xor eax, dword [edx*4 + 0x5261d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x5259d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x5255d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x525dd0]
xor eax, dword [edx*4 + 0x5261d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x5259d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x5255d0]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x525dd0]
xor eax, dword [edx*4 + 0x5261d0]
sub esi, 0x20
shr ecx, 0x10
movzx edx, cl
xor eax, dword [edx*4 + 0x5259d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x5255d0]
jmp 0x429136
cmp esi, 3
jbe 0x429325
xor ecx, dword [ebx]
sub esi, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x525dd0]
add ebx, 4
shr ecx, 0x10
xor eax, dword [edx*4 + 0x5261d0]
movzx edx, cl
xor eax, dword [edx*4 + 0x5259d0]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x5255d0]
jmp 0x4292e7
mov edx, ebx
test esi, esi
je 0x429340
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x5255d0]
dec esi
jmp 0x429329
mov eax, ecx
not eax
pop ebx
pop esi
pop ebp
ret
Function at 0x42a0a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x42a0c7
mov ebx, dword [edi + 0x1c]
test ebx, ebx
je 0x42a0c7
cmp dword [edi + 0x20], 0
je 0x42a0c7
cmp dword [edi + 0x24], 0
jne 0x42a0d1
mov eax, 0xfffffffe
jmp 0x42a1d1
mov dword [edi + 0x2c], 2
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [ebx + 0x14], 0
test eax, eax
jns 0x42a106
neg eax
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x18]
cmp edx, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
cmp edx, 2
mov dword [ebx + 4], eax
jne 0x42a129
push 0
push 0
push 0
call fcn.004290fa
jmp 0x42a134
push 0
push 0
push 0
call fcn.0042ba10
add esp, 0xc
mov dword [edi + 0x30], eax
mov dword [ebx + 0x28], 0
push ebx
call fcn.0042bdcf
pop edi
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x44]
add eax, eax
cld
mov dword [ebx + 0x3c], eax
mov word [edi + ecx*2 - 2], 0
xor eax, eax
lea ecx, [ecx + ecx - 2]
rep stosb byte es:[edi], al
imul edx, dword [ebx + 0x84], 0xc
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
movzx eax, word [edx + 0x527612]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0
movzx eax, word [edx + 0x527610]
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x78], 2
movzx eax, word [edx + 0x527614]
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x60], 2
movzx eax, word [edx + 0x527616]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x48], 0
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x42a7d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, eax
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x14]
add eax, dword [esi + 0x2c]
mov dword [ebp - 0x10], edx
sub eax, 0x106
mov edx, dword [esi + 0x6c]
sub dword [ebp - 0x10], edx
cmp edx, eax
jb 0x42a871
push dword [ebp - 0x14]
mov edx, dword [esi + 0x38]
mov eax, dword [ebp - 0x14]
add eax, edx
push eax
push edx
call fcn.0047d340
mov edx, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edx
add esp, 0xc
sub dword [esi + 0x6c], edx
lea eax, [eax + ecx*2]
sub dword [esi + 0x5c], edx
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x42a843
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x42a830
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x40]
lea eax, [eax + ecx*2]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x42a865
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x42a852
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov ebx, dword [esi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x42a929
mov edx, dword [esi + 0x6c]
mov edi, eax
mov dword [ebp - 0x18], edx
mov edx, dword [esi + 0x38]
add dword [ebp - 0x18], edx
mov edx, dword [esi + 0x74]
add dword [ebp - 0x18], edx
cmp eax, dword [ebp - 0x10]
jbe 0x42a89a
mov edi, dword [ebp - 0x10]
xor edx, edx
test edi, edi
je 0x42a8e8
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x42a8bd
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0042ba10
jmp 0x42a8cd
cmp eax, 2
jne 0x42a8d3
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004290fa
add esp, 0xc
mov dword [ebx + 0x30], eax
push edi
push dword [ebx]
push dword [ebp - 0x18]
call fcn.0047d340
add dword [ebx], edi
add dword [ebx + 8], edi
add esp, 0xc
mov edx, edi
mov eax, dword [esi + 0x74]
add eax, edx
mov dword [esi + 0x74], eax
cmp eax, 2
jbe 0x42a914
mov ebx, dword [esi + 0x6c]
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [ebx + edx]
mov dword [esi + 0x48], eax
movzx edx, byte [edx + ebx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp dword [esi + 0x74], 0x105
ja 0x42a929
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x42a7e6
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42eb53
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.0042ea5a
mov ebx, eax
test eax, eax
je 0x42eb7e
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
inc eax
setne al
push ebx
movzx esi, al
call fcn.0042f5f0
pop ebx
jmp 0x42eb8b
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
inc eax
setne al
movzx esi, al
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
Function at 0x42eb9b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3b4
mov eax, dword [0x540060]
mov esi, dword [ebp + 8]
test eax, eax
je 0x42ebce
push 0x118
push eax
lea eax, [ebp - 0x14c]
push eax
call sub.msvcrt.dll_strncpy
add esp, 0xc
mov byte [ebp - 0x34], 0
jmp 0x42ec27
call fcn.0042ea12
test eax, eax
je 0x42ec16
lea ebx, [ebp - 0x3bc]
push ebx
push 0x118
call sub.KERNEL32.DLL_GetTempPathW
mov eax, ebx
call fcn.0042eac1
mov ebx, eax
test eax, eax
je 0x42ec27
push 0x118
push eax
lea eax, [ebp - 0x14c]
push eax
call sub.msvcrt.dll_strncpy
push ebx
mov byte [ebp - 0x34], 0
call fcn.0042f5f0
add esp, 0x10
jmp 0x42ec27
lea eax, [ebp - 0x14c]
push eax
push 0x118
call sub.KERNEL32.DLL_GetTempPathA
cld
or ecx, 0xffffffff
xor eax, eax
lea edi, [ebp - 0x14c]
repne scasb al, byte es:[edi]
not ecx
lea ebx, [ecx - 1]
jmp 0x42ec47
cmp byte [ebx + ebp - 0x14d], 0x5c
jne 0x42ec4b
dec ebx
test ebx, ebx
jg 0x42ec3c
mov byte [ebx + ebp - 0x14c], 0
lea eax, [ebp - 0x14c]
mov edi, esi
push eax
push str._s_sqlite_
push esi
call sub.msvcrt.dll_sprintf
cld
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov ebx, 0xe
lea edi, [ecx - 1]
lea eax, [esi + edi]
push eax
push 0xf
call fcn.0043f470
add esp, 0x14
movzx ax, byte [edi + esi]
xor edx, edx
mov ecx, 0x3e
div cx
and edx, 0x3f
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc edi
dec ebx
jns 0x42ec87
mov byte [edi + esi], 0
push esi
call fcn.0042eb53
pop edi
test eax, eax
jne 0x42ec53
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42f127
Capabilities:
Get file attributes

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x42f188
call fcn.0042ea12
test eax, eax
jne 0x42f153
cld
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor eax, eax
cmp ecx, 0x104
ja 0x42f188
mov eax, ebx
call fcn.0042ea5a
mov edi, eax
test eax, eax
je 0x42f171
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
push edi
call fcn.0042f5f0
pop ecx
jmp 0x42f179
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x42f188
xor eax, eax
test bl, 0x10
setne al
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x42f51a
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x540090], 0
push ebx
mov esi, dword [ebp + 8]
jne 0x42f561
call fcn.0042f4ae
cmp dword [0x540090], 0
jne 0x42f55c
call sub.KERNEL32.DLL_TlsAlloc
mov dword [0x540080], eax
inc eax
jne 0x42f552
call fcn.0042f4b9
xor eax, eax
jmp 0x42f5e1
mov dword [0x540090], 1
call fcn.0042f4b9
push dword [0x540080]
call sub.KERNEL32.DLL_TlsGetValue
test esi, esi
mov ebx, eax
jle 0x42f5a9
test eax, eax
jne 0x42f5df
push 0xc
call fcn.0042e9f0
mov ebx, eax
pop eax
test ebx, ebx
je 0x42f5df
mov eax, dword [0x5287e4]
mov dword [ebx], eax
mov eax, dword [0x5287e8]
mov dword [ebx + 4], eax
mov eax, dword [0x5287ec]
mov dword [ebx + 8], eax
push ebx
push dword [0x540080]
call sub.KERNEL32.DLL_TlsSetValue
jmp 0x42f5df
test eax, eax
setne al
shr esi, 0x1f
test eax, esi
je 0x42f5df
push 0xc
push 0x5287e4
push ebx
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x42f5df
push ebx
call fcn.0042ea02
push 0
xor ebx, ebx
push dword [0x540080]
call sub.KERNEL32.DLL_TlsSetValue
pop eax
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x451ea0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
cmp edx, 1
push edi
mov edi, eax
push esi
mov eax, 0x17
push ebx
mov esi, edx
push ecx
jle 0x451f31
jmp 0x451ec0
movzx eax, byte [ebx + 0x52bde0]
jmp 0x451f31
movzx eax, byte [edi]
movzx eax, byte [eax + 0x5287f0]
lea ecx, [eax*4]
movzx eax, byte [edi + edx - 1]
movzx eax, byte [eax + 0x5287f0]
imul eax, eax, 3
xor ecx, eax
xor ecx, edx
mov edx, 0x7f
mov eax, ecx
mov ebx, edx
cdq
idiv ebx
movzx eax, byte [edx + str.Pk_]
mov ebx, eax
dec ebx
js 0x451f2c
movzx eax, byte [ebx + 0x52bc60]
cmp eax, esi
jne 0x451f23
movzx eax, word [ebx + ebx + 0x52bce0]
add eax, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHERE
push esi
push edi
push eax
call fcn.0042f76b
add esp, 0xc
test eax, eax
je 0x451eb7
movzx eax, byte [ebx + 0x52bbe0]
jmp 0x451ef7
mov eax, 0x17
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x451f39
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.00451ea0
Function at 0x46b690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 0xc]
mov bl, byte [esi]
movzx eax, bl
mov edx, eax
and edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp + 8], 0xff
jg 0x46b6d8
test al, 2
je 0x46b6d8
mov edx, 8
mov eax, dword [ebp + 8]
mov edi, edx
mov ecx, dword [ebp + 8]
cdq
idiv edi
and ecx, 7
movzx eax, byte [esi + eax + 1]
sar eax, cl
test al, 1
jne 0x46b88b
inc esi
and bl, 2
je 0x46b6e1
add esi, 0x20
movzx ebx, byte [esi]
inc esi
test ebx, ebx
je 0x46b8a2
cmp ebx, 1
jne 0x46b743
movzx eax, byte [esi]
inc esi
mov dword [ebp - 0x14], eax
cmp eax, 0xbf
jle 0x46b736
and eax, 0x3f
movzx edx, byte [eax + 0x530790]
imul ebx, edx, 6
mov ecx, dword [edx*4 + 0x5307d0]
and dword [ebp - 0x14], ecx
mov cl, bl
shl dword [ebp - 0x14], cl
mov eax, edx
dec edx
test eax, eax
jle 0x46b736
movzx eax, byte [esi]
sub ebx, 6
and eax, 0x3f
mov cl, bl
inc esi
shl eax, cl
or dword [ebp - 0x14], eax
jmp 0x46b71c
mov edi, dword [ebp - 0x14]
cmp dword [ebp + 8], edi
jne 0x46b6e1
jmp 0x46b88b
cmp ebx, 2
mov cl, byte [esi]
jne 0x46b7f4
movzx ecx, cl
inc esi
mov dword [ebp - 0x14], ecx
cmp ecx, 0xbf
jle 0x46b797
mov eax, ecx
and eax, 0x3f
movzx edx, byte [eax + 0x530790]
imul ebx, edx, 6
mov eax, dword [edx*4 + 0x5307d0]
and ecx, eax
mov dword [ebp - 0x14], ecx
mov cl, bl
shl dword [ebp - 0x14], cl
mov eax, edx
dec edx
test eax, eax
jle 0x46b797
movzx eax, byte [esi]
sub ebx, 6
and eax, 0x3f
mov cl, bl
inc esi
shl eax, cl
or dword [ebp - 0x14], eax
jmp 0x46b77d
movzx ebx, byte [esi]
inc esi
cmp ebx, 0xbf
jle 0x46b7d6
mov eax, ebx
and eax, 0x3f
movzx edx, byte [eax + 0x530790]
imul edi, edx, 6
and ebx, dword [edx*4 + 0x5307d0]
mov ecx, edi
shl ebx, cl
mov eax, edx
dec edx
test eax, eax
jle 0x46b7d6
movzx eax, byte [esi]
sub edi, 6
and eax, 0x3f
mov ecx, edi
inc esi
shl eax, cl
or ebx, eax
jmp 0x46b7bd
mov edi, dword [ebp - 0x14]
cmp dword [ebp + 8], edi
setge dl
xor eax, eax
cmp dword [ebp + 8], ebx
setle al
test edx, eax
je 0x46b6e1
jmp 0x46b88b
mov edx, pe_nt_image_headers32
mov eax, dword [ebp + 8]
mov edi, edx
cdq
idiv edi
mov dword [ebp - 0x18], eax
movzx eax, byte [eax + 0x53a6b0]
shl eax, 7
add eax, edx
movzx edx, cl
movzx eax, word [eax + eax + 0x5308b0]
cmp edx, 4
lea eax, [eax*8 + 0x53c8b0]
ja case.default.0x46b827
jmp dword [edx*4 + 0x53db50]
cmp ebx, 3
jne 0x46b89a
jmp 0x46b88b
mov cl, byte [eax + 1]
xor edi, edi
cmp cl, 9
setne dl
xor eax, eax
cmp cl, 5
setne al
test edx, eax
je 0x46b855
cmp cl, 8
je 0x46b855
mov di, 1
xor eax, eax
cmp ebx, 3
sete al
cmp edi, eax
jmp 0x46b889
movzx eax, byte [eax + 1]
movzx edx, byte [esi + 1]
cmp edx, dword [eax*4 + 0x530710]
jmp 0x46b87c
mov al, byte [eax + 1]
jmp 0x46b879
mov al, byte [eax]
cmp byte [esi + 1], al
setne dl
cmp ebx, 3
sete al
xor eax, edx
test al, 1
je 0x46b89a
xor eax, eax
cmp dword [ebp - 0x10], 0
sete al
jmp 0x46b8a5
xor eax, eax
jmp 0x46b8a5
add esi, 2
jmp 0x46b6e1
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x46cfa5
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x130
mov edi, dword [ebp + 0xc]
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp eax, 0xffffffff
je 0x46d022
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0x128
push eax
push esi
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x46d01c
cmp dword [ebp - 0x124], edi
jne 0x46d00d
push dword [ebp - 0x134]
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
test eax, eax
je 0x46d00d
push 0xffffffffffffffff
push eax
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x13c]
push eax
push esi
call sub.KERNEL32.DLL_Process32Next
jmp 0x46cfdb
push esi
call sub.KERNEL32.DLL_CloseHandle
push 0xffffffffffffffff
push dword [ebp + 8]
call sub.KERNEL32.DLL_TerminateProcess
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret