joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4076b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.004a35f0
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0xffffffffffffffff
push 0x100
push eax
call fcn.0048ebb0
add esp, 0x20
lea ecx, [ebp - 0x204]
xor eax, eax
mov word [ebp - 6], ax
call fcn.0048f390
add esp, 4
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret

Function at 0x4094d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3058
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x51b08c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ecx + 8], eax
lea eax, [ecx + 0x10]
mov dword [ecx + 0x30], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0xf
mov dword [ecx + 0xc], eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x40e310
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x40e340
mov dword [ebp - 8], edi
lea edx, [ebp - 8]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 8]
call eax
test al, al
je 0x40e37c
xorps xmm0, xmm0
mov word [ebp - 0xc], 0
movups xmmword [ebp - 0x24], xmm0
mov eax, 0x218
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x14], xmm0
mov word [ebp - 0x18], ax
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00499a52
mov esp, ebp
pop ebp
ret 4

Function at 0x40f370
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
lea edx, [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.00493d10
Function at 0x414a40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.004a35f0
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x404]
push 0x400
push 0x400
push eax
call fcn.00414a00
add esp, 0x24
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret

Function at 0x41a900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x51bfe0], 0
je 0x41a957
mov eax, dword [0x51f900]
test eax, eax
je 0x41a930
push eax
call dword [0x51c038]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.004180c0
mov eax, dword [0x51f900]
test eax, eax
je 0x41a952
push eax
call dword [0x51c040]
mov esi, dword [ebp - 4]
jmp 0x41a961
mov esi, dword [ebp - 4]
jmp 0x41a964
push 0x14
call dword [0x51c008]
mov esi, eax
add esp, 4
test esi, esi
jne 0x41a972
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x51bfe4], 0
mov ebx, dword [ebp + 8]
je 0x41a9bc
mov eax, dword [0x51c0e8]
test eax, eax
je 0x41a995
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x41a9bc
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x41a8d0
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.004ad8ba
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x41a9c9
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x41a9e2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c800
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x41c82e
nop dword [eax + eax]
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x4f9580]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x41c810
pop esi
ret
Function at 0x41c8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [edx*8]
mov esi, ecx
push edi
cmp eax, 0x400
mov dword [ebp - 4], esi
mov edi, 0x80
cmovbe edi, edx
cmp edi, dword [esi]
jne 0x41c8cf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x51f920]
test eax, eax
je 0x41c8da
call eax
lea eax, [edi*8]
push 0
push eax
call fcn.004181c0
mov ecx, dword [0x51f924]
add esp, 8
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ecx, ecx
je 0x41c8fd
call ecx
test ebx, ebx
je 0x41c8c6
push dword [esi + 0xc]
call fcn.004184e0
add esp, 4
mov dword [esi + 0xc], ebx
push ebx
call dword [0x51c014]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [esi], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.004a35f0
mov ecx, dword [esi + 8]
add esp, 0xc
mov dword [esi + 8], 0
test ecx, ecx
je 0x41c9e0
mov edi, dword [ecx + 0xc]
xor ebx, ebx
mov al, byte [edi]
test al, al
je 0x41c96f
movzx eax, al
lea edx, [ebx*8]
lea edi, [edi + 1]
movzx esi, byte [eax + 0x4f9580]
mov al, byte [edi]
xor esi, edx
xor ebx, esi
test al, al
jne 0x41c951
xor edx, edx
mov edi, dword [ecx]
mov eax, ebx
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x41c9ba
mov eax, dword [esi]
test eax, eax
je 0x41c98d
mov edx, dword [esi + 4]
jmp 0x41c98f
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x41c9ba
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x41c9af
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x41c9d6
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x41c9d6
mov esi, dword [ebp - 4]
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x41c9cc
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [esi + 8], ecx
mov ecx, edi
test edi, edi
jne 0x41c946
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
mov esi, edx
push edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 4], esi
test ecx, ecx
je 0x41ca46
mov eax, edx
mov edi, esi
xor esi, esi
mov al, byte [eax]
test al, al
je 0x41ca34
movzx eax, al
lea ecx, [esi*8]
lea edi, [edi + 1]
movzx edx, byte [eax + 0x4f9580]
mov al, byte [edi]
xor edx, ecx
xor esi, edx
test al, al
jne 0x41ca13
mov ecx, dword [ebx + 0xc]
mov eax, esi
xor edx, edx
div dword [ebx]
mov esi, dword [ebp - 4]
mov edi, dword [ecx + edx*8 + 4]
mov ecx, dword [ecx + edx*8]
jmp 0x41ca4e
mov edi, dword [ebx + 8]
xor edx, edx
mov ecx, dword [ebx + 4]
mov eax, dword [ebp + 8]
mov dword [eax], edx
test ecx, ecx
je 0x41cab6
movzx eax, byte [esi]
movzx edx, byte [eax + 0x4f9580]
mov dword [ebp + 8], edx
mov eax, dword [edi + 0xc]
dec ecx
mov dword [ebp - 8], ecx
mov bl, byte [eax]
movzx ecx, bl
movzx ecx, byte [ecx + 0x4f9580]
sub ecx, edx
jne 0x41caad
sub esi, eax
nop dword [eax]
test bl, bl
je 0x41caa3
movzx ecx, byte [esi + eax + 1]
inc eax
movzx edx, byte [ecx + 0x4f9580]
mov bl, byte [eax]
movzx ecx, bl
movzx ecx, byte [ecx + 0x4f9580]
sub ecx, edx
je 0x41ca80
jmp 0x41caa7
test ecx, ecx
je 0x41cabf
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edi, dword [edi]
test ecx, ecx
jne 0x41ca64
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], edx
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
test edi, edi
je 0x42e5c3
cmp byte [edi + 9], bl
je 0x42e466
inc dword [edi + 0xc]
cmp byte [edi + 0xa], bl
jne 0x42e466
call fcn.0042a8d0
mov esi, dword [edi + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x42e5b0
cmp dword [ebp + 8], 0
je 0x42e4df
test byte [esi + 0x40], 1
jne 0x42e4df
mov al, byte [esi + 0x42]
cmp al, 1
je 0x42e48f
cmp al, 2
jne 0x42e550
cmp al, 2
jne 0x42e499
mov byte [esi + 0x42], 1
jmp 0x42e4a0
mov dword [esi + 0x3c], 0
mov ecx, esi
call fcn.0042ad30
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x42e4bc
mov ecx, esi
call fcn.0042acd0
mov byte [esi + 0x42], 3
and byte [esi + 0x40], 0xf1
test ebx, ebx
je 0x42e550
mov edi, dword [esp + 0x14]
mov edx, ebx
push 0
mov ecx, edi
call fcn.0042e430
add esp, 4
jmp 0x42e5b0
mov edi, dword [esi + 0x30]
test edi, edi
je 0x42e53e
cmp dword [0x51bfe0], 0
je 0x42e534
mov eax, dword [0x51f900]
test eax, eax
je 0x42e502
push eax
call dword [0x51c038]
add esp, 4
push edi
call dword [0x51c014]
sub dword [0x51f930], eax
add esp, 4
dec dword [0x51f954]
push edi
call dword [0x51c00c]
mov eax, dword [0x51f900]
add esp, 4
test eax, eax
je 0x42e53e
push eax
call dword [0x51c040]
jmp 0x42e53b
push edi
call dword [0x51c00c]
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
xor ebx, ebx
cmp byte [esi + 0x44], bl
jl 0x42e59d
lea edi, [esi + 0x78]
nop word [eax + eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x42e58b
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x20
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
je 0x42e57d
call fcn.004251e0
jmp 0x42e582
call fcn.00420f10
mov ecx, dword [esp + 0x1c]
call fcn.004262e0
mov dword [edi], 0
inc ebx
movsx eax, byte [esi + 0x44]
add edi, 4
cmp ebx, eax
jle 0x42e560
mov esi, dword [esi + 8]
test esi, esi
jne 0x42e474
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp byte [edi + 9], 0
je 0x42e5c3
add dword [edi + 0xc], 0xffffffff
jne 0x42e5c3
mov ecx, edi
call fcn.0042a890
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c4c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [edx + 0x14]
mov ebx, ecx
mov ecx, edi
call fcn.0042eaa0
mov esi, dword [edi + 0x10]
mov edx, esi
mov eax, dword [edi + 0x14]
add edx, 0xffffffff
adc eax, 0xffffffff
test eax, eax
ja 0x43c584
jb 0x43c4f9
cmp edx, 0x7ffffffe
ja 0x43c584
xor eax, eax
mov dword [ebp - 8], ebx
mov word [ebp - 0x20], ax
mov dword [ebp - 0x10], eax
movsx eax, byte [edi + 0x44]
mov edx, dword [edi + 0x18]
mov eax, dword [edi + eax*4 + 0x78]
mov ecx, dword [eax + 0x3c]
movzx eax, word [edi + 0x20]
sub ecx, edx
cmp eax, ecx
cmovb ecx, eax
cmp esi, ecx
ja 0x43c533
mov eax, 0x1010
mov dword [ebp - 0x18], edx
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1c], esi
jmp 0x43c550
lea eax, [ebp - 0x28]
xor edx, edx
push eax
push 1
push esi
mov ecx, edi
call fcn.00436d50
add esp, 0xc
test eax, eax
jne 0x43c5b0
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
push 0
push dword [ebp + 8]
mov ecx, esi
call fcn.0043b9b0
mov ecx, dword [ebp + 0xc]
add esp, 8
test dword [ebp - 0x20], 0x2460
mov dword [ecx], eax
jne 0x43c573
cmp dword [ebp - 0x10], 0
je 0x43c57b
lea ecx, [ebp - 0x28]
call fcn.00436390
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0x507b78
push 0x12267
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
mov dword [eax], 0
call fcn.0041a6e0
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x14], edx
xor edx, edx
mov dword [ebp - 8], eax
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x45554b
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, edi
xor eax, 1
mov ecx, edi
cmp edi, 2
cmovl ecx, eax
mov dword [ebp - 0x10], ecx
test ebx, ebx
je 0x455516
mov edx, ecx
mov eax, ebx
mov ecx, dword [ebp - 8]
add edx, edx
mov bl, byte [ebx]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x4f9580]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x4f9580]
sub esi, ecx
jne 0x4554fa
sub edx, eax
mov dword [ebp - 0xc], edx
test bl, bl
je 0x45550f
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x4f9580]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x4f9580]
sub esi, edx
mov edx, dword [ebp - 0xc]
je 0x4554d6
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x455491
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x4554fa
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
add ecx, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0041c9f0
add esp, 4
test eax, eax
je 0x455544
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x455506
jmp 0x4554fd
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x4554fd
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4556d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ecx + 0x14]
push edi
mov dword [ebp - 0xc], edx
xor edi, edi
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
test eax, eax
jle 0x45579c
mov edx, dword [ecx + 0x10]
push ebx
mov dword [ebp - 0x14], edx
push esi
mov ecx, edi
mov eax, edi
xor ecx, 1
cmp edi, 2
cmovl eax, ecx
shl eax, 4
mov ecx, dword [eax + edx + 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x455769
mov ebx, dword [eax + edx]
mov esi, ecx
mov al, byte [ecx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x4f9580]
movzx ecx, al
movzx ecx, byte [ecx + 0x4f9580]
sub ecx, edx
jne 0x455757
sub ebx, esi
test al, al
je 0x455765
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x4f9580]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x4f9580]
sub ecx, edx
je 0x455736
mov edx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp - 0x10]
jge 0x45578c
mov edx, dword [ebp - 0x14]
jmp 0x4556f7
test ecx, ecx
jne 0x455757
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
add ecx, 0x18
push eax
call fcn.0041c9f0
add esp, 4
test eax, eax
je 0x455795
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
je 0x45575a
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x45575a
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x458590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], edi
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov ebx, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], eax
nop dword [eax]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.0041a5f0
mov eax, dword [edi]
add esp, 0x10
xor edi, edi
mov dword [ebp - 0x24], 0
cmp dword [eax + 0x14], edi
jle 0x4586dd
mov eax, edi
mov ecx, edi
xor eax, 1
cmp edi, 2
cmovl ecx, eax
mov dword [ebp - 0x30], ecx
test ebx, ebx
je 0x4586a2
mov esi, dword [ebp - 0x20]
mov edx, ecx
add edx, edx
mov eax, ebx
mov bl, byte [ebx]
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x4f9580]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x4f9580]
sub esi, ecx
jne 0x458665
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], edx
test bl, bl
je 0x458698
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x4f9580]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x4f9580]
sub esi, edx
mov edx, dword [ebp - 0x34]
je 0x458641
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
inc edi
mov ebx, dword [ebp - 0x28]
mov eax, dword [ecx]
cmp edi, dword [eax + 0x14]
jl 0x4585f8
test edx, edx
je 0x4586d9
push dword [ebp - 0x38]
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x3c]
push eax
push ebx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push edi
call fcn.004553d0
add esp, 0x18
jmp 0x4586e0
test esi, esi
jne 0x458665
mov ecx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x30]
push eax
add ecx, ecx
mov eax, dword [edx]
lea edx, [ebp - 0x1c]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0041c9f0
add esp, 4
test eax, eax
je 0x4586d2
mov edx, dword [eax + 8]
mov dword [ebp - 0x24], edx
test edx, edx
jne 0x45867a
jmp 0x458668
xor edx, edx
mov dword [ebp - 0x24], edx
jmp 0x458668
mov edi, ecx
jmp 0x4586e0
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 4
jle 0x4585d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00499a52
mov esp, ebp
pop ebp
ret
Function at 0x48f450
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov esi, ecx
push edi
push 4
mov word [ebp - 0xc], ax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x48f49e
push 1
push 0x4fe0f8
lea eax, [ebp - 0xc]
push 4
push eax
call fcn.004aca37
add esp, 0x10
push esi
push 0x507fec
call fcn.0048f120
mov esi, eax
add esp, 8
mov dword [ebp - 0x20], esi
test esi, esi
je 0x48f4d1
mov edi, esi
lea ecx, [edi + 2]
nop word [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x48f4c0
sub edi, ecx
sar edi, 1
jmp 0x48f4d3
xor edi, edi
lea edx, [ebp - 0xc]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x48f4e0
sub edx, ecx
sar edx, 1
test esi, esi
je 0x48f511
mov ecx, esi
lea ebx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48f500
sub ecx, ebx
sar ecx, 1
jmp 0x48f513
xor ecx, ecx
add ecx, 3
mov eax, 0xaaaaaaab
imul ecx, edx
push 2
mul ecx
lea eax, [edi + 1]
shr edx, 1
add eax, edx
push eax
mov dword [ebp - 0x10], eax
call fcn.004acf95
mov edi, eax
add esp, 8
mov dword [ebp - 0x18], edi
test edi, edi
je 0x48f60a
mov ebx, edi
test esi, esi
je 0x48f561
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48f550
sub ecx, edx
sar ecx, 1
jmp 0x48f563
xor ecx, ecx
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
inc edx
lea edx, [edx + edx*2]
sub edx, ecx
cmp word [esi], 0
mov dword [ebp - 0x14], edx
mov ecx, esi
je 0x48f605
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x1c], 3
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
mov word [ebx], ax
add ebx, 2
mov dword [ebp - 0x10], ecx
cmp word [ecx], 0
je 0x48f5f2
cmp edx, 2
jne 0x48f5f2
mov eax, ebx
mov edx, esi
sub eax, edi
sar eax, 1
sub edx, eax
jne 0x48f5ba
xor eax, eax
mov byte [eax], al
lea ecx, [ebp - 0xc]
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48f5c0
sub ecx, edi
lea eax, [ebp - 0xc]
sar ecx, 1
lea edi, [edx - 1]
cmp ecx, edi
cmovb edi, ecx
push edi
push eax
push edx
push ebx
call fcn.004aca37
mov ecx, dword [ebp - 0x10]
lea ebx, [ebx + edi*2]
mov edx, dword [ebp - 0x14]
add esp, 0x10
mov edi, dword [ebp - 0x18]
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x1c]
cmp word [ecx], 0
mov dword [ebp - 0x14], edx
jne 0x48f590
mov esi, dword [ebp - 0x20]
xor eax, eax
mov word [ebx], ax
push esi
call fcn.004a51e5
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00499a52
mov esp, ebp
pop ebp
ret
Function at 0x48f630
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmm1
mulsd xmm0, qword [0x508238]
push ebx
push esi
push edi
addsd xmm0, qword [0x5081e8]
call fcn.004bd901
mov esi, eax
mov eax, 0x51eb851f
mul esi
mov ebx, edx
shr ebx, 5
mov ecx, ebx
call fcn.0048f450
push 4
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x48f69e
push 1
push 0x4fb7f0
lea eax, [ebp - 0xc]
push 4
push eax
call fcn.004aca37
add esp, 0x10
imul eax, ebx, 0x64
sub esi, eax
lea eax, [ebp - 0xc]
push esi
push eax
push edi
push 0x507ff8
call fcn.0048f120
mov esi, eax
add esp, 0x10
test esi, esi
je 0x48f706
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48f6c1
sub ecx, edx
sar ecx, 1
cmp ecx, 1
jb 0x48f706
dec ecx
mov edx, 0x507ff4
lea ecx, [esi + ecx*2]
call fcn.0048ecb0
test al, al
je 0x48f706
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48f6f0
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [esi + ecx*2 - 2], ax
push 0
call fcn.004a51e5
add esp, 4
push edi
call fcn.004a51e5
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00499a52
mov esp, ebp
pop ebp
ret

Function at 0x490ae0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
test ecx, ecx
jne 0x490b0d
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x490b44
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x490b44
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
jmp 0x490b49
or edi, 0xffffffff
or ebx, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
mov edx, ebx
xor ecx, ebp
pop ebx
call fcn.00499a52
mov esp, ebp
pop ebp
ret

Function at 0x490bf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ecx
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x490c28
xor bl, bl
jmp 0x490c4b
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push 0
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x490c48
cmp dword [ebp - 8], edi
jne 0x490c48
mov bl, 1
jmp 0x490c4a
xor bl, bl
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00499a52
mov esp, ebp
pop ebp
ret