joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e9d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5932e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0x38], 0
je 0x41ea8f
cmp byte [ebx + 0x3d], 0
je 0x41ea8f
mov eax, dword [ebx]
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x55d39c]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x41ea45
push edi
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [edi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
mov esi, dword [esi + 0x20]
mov ecx, esi
call dword [0x55d39c]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x41ea57
sub eax, 1
je 0x41ea5b
sub eax, 2
je 0x41ea8f
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514e1d
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x41ea78
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.005208c5
add esp, 0x10
cmp esi, eax
jne 0x41ea45
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00514e1d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.00514e1d
mov esp, ebp
pop ebp
ret

Function at 0x422490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551930
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5932e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00514e2e
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004fe204
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4261d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552478
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5932e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
movzx eax, dx
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push edi
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 0xf
push eax
mov byte [ebx], 0
call fcn.00409ab0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x426299
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42628f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4262ad
push edx
push ecx
call fcn.005150f8
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00519e03
int3

Function at 0x42b600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552970
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5932e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0042a4e0
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.00409940
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0
mov byte [esi + 0x28], 0
call fcn.0041d140
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42ba10
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5529c0
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x5932e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0042a4e0
mov ecx, dword [ebx + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov word [esi + 0xc], 0
mov ecx, dword [ecx]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x20], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0
mov byte [esi + 0x28], 0
call fcn.0041d140
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x4303c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553618
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5932e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x40
call fcn.00514e2e
add esp, 4
mov esi, eax
mov dword [ebp - 0x14], esi
push 0x40
push 0
push esi
call fcn.00517340
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov byte [esi + 0x28], 1
mov dword [esi + 0x2c], 0
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ecx]
mov dword [esi + 0x34], eax
mov ecx, dword [ecx + 4]
mov dword [esi + 0x38], ecx
test ecx, ecx
je 0x43047a
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
push esi
mov ecx, edi
mov dword [esi + 0x3c], 0
call fcn.004321e0
mov dword [ebp - 4], 0
mov ecx, dword [edi]
mov eax, dword [ebp + 8]
mov dword [ecx + 0x2c], eax
lea edx, [ecx + 0x34]
mov eax, dword [ebp + 8]
push eax
push dword [ecx + 0x3c]
push dword [ecx + 0x30]
push eax
call fcn.004322b0
add esp, 0x10
test al, al
jne 0x43050a
mov dword [edi], 0
mov ebx, dword [edi + 4]
mov dword [edi + 4], 0
mov byte [ebp - 4], 1
test ebx, ebx
je 0x43050a
lea ecx, [ebx + 4]
or eax, 0xffffffff
lock xadd dword [ecx], eax
cmp eax, 1
jne 0x43050a
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x55d39c]
mov ecx, ebx
call esi
lea eax, [ebx + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x43050a
mov eax, dword [ebx]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x55d39c]
mov ecx, ebx
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43ca90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554d60
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5932e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0042a4e0
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.00409940
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x449e00
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5563c8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x158
mov eax, dword [0x5932e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x160], esi
push 0
mov dword [ebp - 0x164], esi
push 2
mov dword [ebp - 0x15c], 0
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
xorps xmm0, xmm0
mov edi, eax
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x15c], 1
cmp edi, 0xffffffff
je 0x44a04e
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32First]
test eax, eax
je 0x44a04e
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x158], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x449ee5
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
lea ecx, [ebp - 0x158]
call fcn.00409ab0
lea eax, [ebp - 0x158]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00430210
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x144]
cmp edx, 0x10
jb 0x449f54
mov ecx, dword [ebp - 0x158]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x449f4a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a06e
push edx
push ecx
call fcn.005150f8
add esp, 8
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32Next]
test eax, eax
je 0x44a047
nop word [eax + eax]
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0xf
lea edx, [eax + 1]
mov byte [ebp - 0x158], 0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449f94
sub eax, edx
lea ecx, [ebp - 0x158]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00409ab0
mov dword [ebp - 4], 2
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x449fe8
movups xmm0, xmmword [ebp - 0x158]
mov edx, 0xf
mov byte [ebp - 0x158], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x148]
movq qword [eax + 0x10], xmm0
add dword [esi + 4], 0x18
jmp 0x449ffd
lea ecx, [ebp - 0x158]
push ecx
push eax
mov ecx, esi
call fcn.00432070
mov edx, dword [ebp - 0x144]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x44a031
mov ecx, dword [ebp - 0x158]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44a027
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a06e
push edx
push ecx
call fcn.005150f8
add esp, 8
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32Next]
test eax, eax
jne 0x449f70
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00514e1d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00519e03
int3
Function at 0x44f680
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556de1
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5932e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov edi, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], edi
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
mov eax, dword [0x59f218]
mov esi, dword [0x59f214]
mov dword [ebp - 0x28], eax
cmp esi, eax
je 0x44f7b4
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00409940
call fcn.0044ea00
add esp, 0x18
test eax, eax
je 0x44f73e
test bl, bl
je 0x44f7a8
push 0xc
call fcn.00514e2e
add esp, 4
mov edx, eax
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x44f754
mov ecx, dword [esi]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
movq xmm0, qword [ebp - 0x38]
mov byte [ebp - 0x30], bl
mov eax, dword [ebp - 0x30]
movq qword [edx], xmm0
mov dword [edx + 8], eax
lea eax, [ebp - 0x20]
push eax
push 0
push edx
push 0x44f490
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x44f7a8
mov ecx, dword [edi + 4]
cmp dword [edi + 8], ecx
je 0x44f79c
mov dword [ecx], eax
add dword [edi + 4], 4
jmp 0x44f7a8
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, edi
call fcn.00451230
add esi, 0x18
cmp esi, dword [ebp - 0x28]
jne 0x44f723
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00514e1d
mov esp, ebp
pop ebp
ret
Function at 0x44fbe0
Capabilities:
Get hostname
Get user security identifier

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556e7b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x450
mov eax, dword [0x5932e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x448], 0
push 0x10
lea ecx, [ebp - 0x440]
movq qword [ebp - 0x440], xmm0
mov dword [ebp - 0x438], 0
call fcn.00409780
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x43c]
mov esi, dword [ebp - 0x440]
sub eax, esi
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x42c]
push eax
push esi
mov dword [ebp - 0x430], 0x10
mov dword [ebp - 0x434], 0x400
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
mov edx, dword [ebp - 0x448]
mov ecx, edx
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0xf
mov byte [ebp - 0x460], 0
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44fcf0
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x460]
call fcn.00409ab0
mov ecx, 0x59a848
call fcn.00409830
movups xmm0, xmmword [ebp - 0x460]
movups xmmword [0x59a848], xmm0
movq xmm0, qword [ebp - 0x450]
movq qword [0x59a858], xmm0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x44fd65
mov ecx, dword [ebp - 0x438]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x44fd5b
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44fd88
push ecx
push esi
call fcn.005150f8
add esp, 8
call fcn.0044f7e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00514e1d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00519e03
int3
Function at 0x4886b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, ecx
mov ebx, edx
push edi
push 0
push 0x14
mov dword [ebp - 4], eax
mov dword [eax], 0
call fcn.00458f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x4886e2
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x593cf4], 0
je 0x488734
mov edi, dword [0x593df4]
test edi, edi
je 0x48870b
push 0xc8
mov ecx, edi
call dword [0x55d39c]
call edi
add esp, 4
test eax, eax
jne 0x488734
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x45bbb0
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call fcn.00521d2e
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x488744
jmp 0x488737
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x488764
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push edi
mov ecx, ebx
mov dword [esi + 4], eax
call dword [0x55d39c]
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
mov edx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], edx
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [edx + 0x14], eax
jle 0x4986ad
mov ebx, eax
xor ebx, 1
cmp eax, 2
cmovge ebx, eax
test edi, edi
je 0x498706
mov eax, dword [edx + 0x10]
mov ecx, ebx
add ecx, ecx
mov esi, edi
mov edx, dword [eax + ecx*8]
mov al, byte [edi]
movzx ecx, al
movzx edi, byte [ecx + 0x5748c8]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x5748c8]
sub edi, ecx
jne 0x498698
sub edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
nop
test al, al
je 0x4986fc
movzx ecx, byte [edx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x5748c8]
mov al, byte [esi]
movzx ecx, al
movzx edi, byte [ecx + 0x5748c8]
sub edi, edx
mov edx, dword [ebp - 0x10]
je 0x498670
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
inc eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 0x14]
jl 0x498630
mov dl, byte [esi]
movzx eax, dl
movzx ecx, byte [eax + 0x5748c8]
movzx eax, byte [0x598bec]
movzx eax, byte [eax + 0x5748c8]
sub ecx, eax
jne 0x4986f3
mov edi, 0x598bec
sub edi, esi
test dl, dl
je 0x49872a
movzx eax, byte [edi + esi + 1]
inc esi
movzx ecx, byte [eax + 0x5748c8]
mov dl, byte [esi]
movzx eax, dl
movzx eax, byte [eax + 0x5748c8]
sub eax, ecx
je 0x4986d2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x498698
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
add ebx, ebx
push 0
mov edx, esi
mov ecx, dword [eax + ebx*8 + 0xc]
add ecx, 8
call fcn.0045d9c0
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x4986f5
jmp 0x49869b
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov eax, dword [eax + 0x10]
test edi, edi
jne 0x498740
neg eax
sbb eax, eax
jmp 0x498750
test eax, eax
je 0x4986f3
mov edx, eax
mov ecx, edi
call fcn.0045c5e0
mov edx, dword [ebp - 8]
test eax, eax
jne 0x4986f3
mov esi, str.sqlite_temp_master
mov dword [ebp - 4], esi
jmp 0x498626
Function at 0x498a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov dword [ebp - 0xc], edx
xor edx, edx
mov dword [ebp - 0x10], eax
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x498b19
push ebx
push esi
mov eax, dword [eax + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x498afa
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x5748c8]
movzx ecx, al
movzx ecx, byte [ecx + 0x5748c8]
sub ecx, edx
jne 0x498ae1
sub ebx, esi
test al, al
je 0x498af6
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x5748c8]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x5748c8]
sub ecx, edx
je 0x498ac0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x498a81
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x498ae1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add ecx, 0x18
push 0
call fcn.0045d9c0
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x498aed
jmp 0x498ae4
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4d34e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557797
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5932e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.chsh
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov edi, eax
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4d353b
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4d370d
push 0x2c
call fcn.00514e2e
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
push 0x2c
push 0
push esi
mov dword [ebp - 4], 0
call fcn.00517340
add esp, 0xc
mov ecx, esi
call fcn.00445aa0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
mov ebx, eax
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x5701ae
mov byte [ecx], 0
call fcn.00409ab0
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x5701ad
mov byte [ecx], 0
call fcn.00409ab0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x30], esp
push 3
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x577a38
mov byte [ecx], 0
call fcn.00409ab0
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str._chsh
mov byte [ecx], 0
call fcn.00409ab0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.004484a0
mov eax, dword [ebp - 0x24]
add eax, 0xffffff38
cmp eax, 0x63
ja 0x4d36ca
mov byte [ebp - 4], 5
mov esi, dword [ebp - 0x20]
cmp byte [esi], 0x31
jne 0x4d36cd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
push 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x577a40
mov byte [ecx], 0
call fcn.00409ab0
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
push 2
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x577a3c
mov byte [ecx], 0
call fcn.00409ab0
mov byte [ebp - 4], 5
call fcn.00409590
add esp, 0x30
mov byte [0x59a844], 1
jmp 0x4d36cd
mov esi, dword [ebp - 0x20]
test ebx, ebx
je 0x4d36d9
push ecx
mov ecx, ebx
call fcn.004d3480
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x4d370d
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x4d3703
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d372b
push ecx
push esi
call fcn.005150f8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00514e1d
mov esp, ebp
pop ebp
ret 0x10
call fcn.00519e03
int3