joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1017e1a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x16f580
jmp 0x1017e169
mov dword [esp + 4], ecx
call 0x1017e076
push eax
mov dword [esp], esp
pushfd
push word [esp + 1]
js 0x1017e13d
jns 0x1017e0f7
mov dword [esp + 4], ebp
jmp 0x1017e14c
push dword [esp + 5]
pop word [esp]
mov dword [esp], edi
jmp 0x1017e0e1
push dword [esp + 5]
pop word [esp]
mov dword [esp], edi
mov dword [esp + 4], ebp
call fcn.1017e11a
lea esp, [esp + 2]
lea esp, [esp + 2]
mov dword [esp], edi
jmp 0x1017e17f
setle bl
mov bl, cl
mov ebx, 0x881fa758
mov al, byte [esp]
jmp 0x1017e185
pushfd
jmp 0x1017e062
mov edi, dword [esp + 0x2c]
mov si, bx
lea esi, [esp + esi]
bswap ebx
sub bx, 0x13d2
jmp 0x1017e24c
push edx
mov byte [esp + 0xa], al
mov dword [esp + 6], esi
mov dword [esp + 8], eax
jmp 0x1017e0a6
bswap ebx
mov eax, ecx
rdtsc
jmp 0x1017e1e5
sub esp, 0xc0
mov ebp, esp
xchg dx, cx
mov ecx, ebx
not ah
jmp 0x1017e21f
bswap ebx
mov eax, ecx
rdtsc
jmp 0x1017e1bc
lea ecx, [ebx + 0x7e]
mov dx, bx
call fcn.1017e1e7
neg edi
mov cx, word [esp]
jmp 0x1017e30c
mov ebx, edi
lea eax, reloc.KERNEL32.dll_EnterCriticalSection
bswap eax
sete al
mov al, byte [esp]
lea edx, [edi*4]
jmp 0x1017e1fd
jg 0x1017e344
jle 0x1017e344
neg ecx
not ax
mov ch, 0xe9
xchg dword [esp + 0xc], edx
inc dx
shl ecx, 0x17
jmp 0x1017e28e
push cx
mov eax, 0x7a5711a0
lea esp, [esp + 2]
push dword [esp + 0xc]
ret 0x10
rol edi, 0
call 0x1017e2e5
fisub dword [esi - 0x46]
add ah, byte fs:[esi + 0x40]
lea ecx, [ebp*4]
mov al, byte [esp]
dec dl
jmp 0x1017e32c
push eax
not dx
neg eax
jl 0x1017e2dc
jge 0x1017e2dc
lea esi, [esi - 0x2f]
rdtsc
bsf eax, ebx
mov cx, 0x90b2
jmp 0x1017e5b9
xchg dword [esp], esi
mov cl, byte [esp]
mov eax, 0x83407434
mov edx, 0x6f2048a
clc
jmp 0x1017e316
lea esi, [esp]
bts edx, esp
jno 0x1017e1df
jo 0x1017e1b4
lea edx, [ebx + edi]
jmp 0x1017e391
jmp 0x1017e400
ror edi, 0
mov dh, 0x64
mov cl, byte [esp]
sbb cl, ah
jp 0x1017e37b
bts edx, edi
lea edx, [edx + 0x6d]
lea edx, [edx + edi]
mov dh, bl
mov ax, di
jmp 0x1017e3dd
lea ecx, [ecx + ebx]
lea eax, [eax - 0x28]
jmp 0x1017e3e2
sbb eax, 0xb0d141df
inc ebx
add dword [eax + reloc.KERNEL32.dll_EnterCriticalSection], 0xffffff8b
mov ecx, 0xe0eb00cf
mov dh, bl
mov ax, di
ror edi, 0
jmp 0x1017e3c2
add edi, dword [esi]
mov edx, dword [esp]
bswap ecx
jmp 0x1017e43b
bts edx, edi
lea edx, [edx + 0x6d]
lea edx, [edx + edi]
jmp 0x1017e3d8
mov ecx, edi
movzx edx, byte [ecx]
xchg cx, ax
mov ecx, esp
lea ecx, [esi*4]
call fcn.1017e40b
pop ds
xchg cx, ax
adc byte [ebx - 0x61171b15], dl
add byte [eax], al
add byte [ecx], cl
mov byte [esi], bl
jns 0x1017e3cf
jmp 0x1017e421
aaa
mov eax, dword [reloc.KERNEL32.dll_EnterCriticalSection]
jmp 0x1017e423
setl al
push dword [esp]
ret 4
xchg ch, dl
mov cx, sp
xchg dword [esp], esi
lea eax, [edi*4]
shr edx, cl
rcr dh, 5
jmp 0x1017e472

Function at 0x1018e464
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x101728a6
Function at 0x1022837d
Capabilities:
Execute anti-debugging instructions

Disassembly:
setbe ah
cpuid
pushfd
jmp 0x1022841c
xchg bp, cx
mov byte [esp], al
mov dword [esp], eax
pop edx
xchg esi, eax
cpuid
jmp 0x102283c1
rdtsc
lea esp, [esp + 0x1f]
pop bx
xchg byte [esp + 1], ch
bswap edx
pop di
jmp 0x102283d7

Function at 0x10235934
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x102357dd
push edi
lea esp, [esp + 2]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x1023574b
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x1022903a
pop word [esp]
jmp 0x10235770
Function at 0x10015030
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, 0x1006ba42
push edi
mov edi, edx
call fcn.10038b15
test edi, edi
jne 0x1001504d
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [ebp + 8]
not esi
cmp ecx, 8
jb 0x10015106
mov edx, ecx
shr edx, 3
movzx eax, byte [edi]
sub ecx, 8
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1004eb70]
movzx eax, byte [edi + 1]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1004eb70]
movzx eax, byte [edi + 2]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1004eb70]
movzx eax, byte [edi + 3]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1004eb70]
movzx eax, byte [edi + 4]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1004eb70]
movzx eax, byte [edi + 5]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1004eb70]
movzx eax, byte [edi + 6]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1004eb70]
movzx eax, byte [edi + 7]
add edi, 8
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1004eb70]
sub edx, 1
jne 0x10015060
test ecx, ecx
je 0x1001512a
nop word [eax + eax]
movzx eax, byte [edi]
lea edi, [edi + 1]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1004eb70]
sub ecx, 1
jne 0x10015110
not esi
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x10015d70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
push edi
mov ecx, 0x1006ba42
call fcn.10038b15
cmp byte [esi], 0
mov edi, 1
je 0x10015db5
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
lea ebx, [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10015db0
mov byte [ebx], 1
mov edi, dword [ebp - 8]
jmp 0x10015de2
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x10015dc6
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call sub.VCRUNTIME140.dll_memcpy
lea eax, [ebx + edi]
add esp, 0xc
mov dword [esi + 0x18], eax
lea ebx, [esi + 8]
cmp edi, 1
jne 0x10015df9
mov ecx, dword [ebp - 0xc]
movzx eax, byte [ebp - 1]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x10015df0
cmp byte [ebx], 0
je 0x10015df0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016060
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov ecx, 0x1006ba42
push edi
call fcn.10038b15
cmp byte [esi], 0
lea ecx, [esi + 1]
mov edx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], ecx
je 0x100160a1
cmp byte [ecx], 0
je 0x100160f3
push 2
push 0
push 0
push dword [esi + 4]
call edx
mov edx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esi + 1]
jmp 0x100160aa
mov eax, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov dword [ebp - 0x10], ecx
cmp byte [esi], 0
je 0x100160ca
cmp byte [ecx], 0
je 0x100160c6
push 1
push 0
push 0
push dword [esi + 4]
call edx
mov edi, eax
sub edi, dword [esi + 0xc]
jmp 0x100160cd
xor edi, edi
jmp 0x100160d9
mov edi, dword [esi + 0x18]
mov eax, 0xffff
mov dword [ebp - 8], eax
cmp edi, eax
jae 0x100160dc
mov dword [ebp - 8], edi
push 0x404
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x100160fc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, 4
mov dword [ebp - 0x14], 0
cmp ecx, eax
jbe 0x10016211
add eax, 0x400
mov dword [ebp - 0xc], edi
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, edi
sub ecx, edx
mov dword [ebp - 0x20], edx
cmp edx, 0x404
mov dword [ebp - 0x1c], ecx
mov edi, edx
cmova edi, eax
cmp byte [esi], 0
je 0x10016162
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
je 0x10016211
mov eax, dword [esi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1001616b
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x18], ecx
mov dword [ebp - 0xc], eax
cmp byte [esi], 0
mov ebx, edi
je 0x10016193
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x18]
push 0
push eax
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001618e
mov byte [esi + 8], 1
mov eax, dword [ebp - 0x18]
jmp 0x100161be
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [edx + edi]
cmp eax, ecx
jbe 0x100161a4
mov ebx, ecx
sub ebx, edx
mov ecx, dword [esi + 0x10]
push ebx
add ecx, edx
push ecx
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, ebx
add dword [esi + 0x18], ebx
mov ebx, dword [ebp - 4]
xor edx, edx
div edi
cmp eax, 1
jne 0x10016211
lea ecx, [edi - 3]
test ecx, ecx
jle 0x10016200
lea eax, [ebx + 3]
add eax, ecx
mov edx, ecx
lea eax, [eax - 1]
dec ecx
cmp byte [eax - 3], 0x50
jne 0x100161f0
cmp byte [edx + ebx], 0x4b
jne 0x100161f0
cmp byte [eax - 1], 5
jne 0x100161f0
cmp byte [eax], 6
je 0x100161f6
test ecx, ecx
jg 0x100161d3
jmp 0x10016200
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov dword [ebp - 0x14], eax
jne 0x10016211
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
cmp eax, ecx
jb 0x10016113
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017cf0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov ecx, 0x1006ba42
call fcn.10038b15
test ebx, ebx
je 0x10017dea
movzx eax, word [ebx]
test ax, ax
je 0x10017dea
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
nop
cmp dx, 0x2f
je 0x10017d3c
cmp word [ecx], 0x5c
jne 0x10017d3e
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x10017d30
cmp edi, ebx
je 0x10017d8b
sub edi, ebx
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x10017dfa
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, esi
mov word [ebp + edi - 0x20c], ax
call fcn.10017cf0
lea ecx, [ebp - 0x414]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x10017d93
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10017da5
lea edi, [ebp - 0x414]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10017dc0
mov ecx, ebx
lea eax, [ebp - 0x414]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003738f
mov esp, ebp
pop ebp
ret
call fcn.100379c3
int3
Function at 0x1002c780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003acb5
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 0x1006ba40
call fcn.10038b15
push 5
call dword [sym.imp.utility.dll_public:_static_bool___cdecl_utility::thread::AppThread::CurrentlyOn_enum_utility::thread::AppThread::ID_]
add esp, 4
test al, al
jne 0x1002c81e
push 0
push fcn.1002c780
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
lea ecx, [ebp - 0x44]
call fcn.100304e0
add esp, 8
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.GBase.dll_void_const____cdecl_tracked_objects::GetProgramCounter_void_]
push eax
push pe_nt_image_headers32
push str.D:geeplayergeeplayer_srcdlnapluginpushoperate.cpp
push str.CPushOperate::Pause
lea ecx, [ebp - 0x54]
call dword [sym.imp.GBase.dll_public:_void___thiscall_tracked_objects::Location::constructor_char_const___char_const___int__void_const__]
push eax
push 5
call dword [sym.imp.utility.dll_public:_static_bool___cdecl_utility::thread::AppThread::PostTask_enum_utility::thread::AppThread::ID__class_tracked_objects::Location_const___class_base::Callback_void____cdecl___void___const__]
add esp, 0xc
lea ecx, [ebp - 0x44]
call dword [sym.imp.GBase.dll_protected:_void___thiscall_base::internal::CallbackBase::destructor_void_]
jmp 0x1002c8e8
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x1002c8e8
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1002c8a1
cmp byte [eax + 0xb0], 0
je 0x1002c8a1
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov dword [ebp - 0x3c], 0x32
jbe 0x1002c84b
mov edx, dword [edx]
mov eax, dword [ecx]
lea edi, [ebp - 0x3c]
push edi
push edx
call dword [eax + 0x78]
mov edi, dword [esi + 0x40]
cmp dword [edi + 0x94], 2
je 0x1002c8e8
lea esi, [edi + 0xb4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0x94], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0x18], 0
je 0x1002c8e8
sub esp, 0x18
lea eax, [edi + 0x3c]
mov ecx, esp
push eax
call fcn.10019480
mov ecx, dword [edi + 0x18]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x1002c8e8
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_class__lambda_a6f2e4d0206ac001419b5c792c25bb2b___void__class_QMSDKBridge::IQMDlnaPauseAction__.0
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], eax
add esi, 8
mov dword [ebp - 4], 1
cmp dword [esi + 0x14], 0xf
jbe 0x1002c8c3
mov esi, dword [esi]
mov eax, dword [ecx]
lea edx, [ebp - 0x38]
push edx
push esi
call dword [eax + 0x84]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1002c8e8
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003738f
mov esp, ebp
pop ebp
ret
Function at 0x409000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545667
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x57f0b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x4090b4
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0xc]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.00405010
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.00409ea0
mov dword [ebp - 4], 7
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x4090ff
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30

Function at 0x40fac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545d30
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x57f0b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00411e60
mov ecx, dword [ebx + 8]
mov esi, eax
mov dword [ebp - 4], 0
mov word [esi + 0xc], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x20], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0
mov byte [esi + 0x28], 0
call fcn.00405010
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x412e30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x546050
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57f0b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.00411e60
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.00404880
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0
mov byte [esi + 0x28], 0
call fcn.00405010
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x450680
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.0041dc00
mov esi, eax
add esp, 8
test esi, esi
jne 0x4506b0
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x57fc8c], 0
mov edi, dword [ebp + 8]
je 0x4506fa
mov eax, dword [0x57fd88]
test eax, eax
je 0x4506d3
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x4506fa
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x420d70
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.00528295
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x450707
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x450720
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ec90
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0x10]
mov edi, edx
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov byte [ebx + 0x10], 1
push edi
push edi
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push ebx
call fcn.00465000
add esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x45ecd1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push ebx
call fcn.00465000
add esp, 0x14
pop edi
pop ebx
pop ebp
ret
Function at 0x4b9800
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4b982b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ba0e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4b984d
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4b984f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x4b98ee
jg 0x4b986c
test esi, esi
je 0x4b98ee
test ecx, ecx
jl 0x4b98b9
jg 0x4b9876
test eax, eax
je 0x4b98b9
cmp ebx, ecx
jg 0x4b988a
jl 0x4b9880
cmp esi, eax
jae 0x4b988a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.00401cd0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4b98c0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x4b98ee
jg 0x4b98ca
test esi, esi
je 0x4b98ee
cmp dword [edi + 0x4c], 0
je 0x4b98ee
mov ecx, edi
call fcn.004ba890
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0052986f
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c26e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x548849
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x57f0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0x2c]
push 0x563af1
mov dword [ebp - 0x34], 0
call fcn.00404820
mov dword [ebp - 4], 1
push 0
push 0x80
push 3
push 0
push 7
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
je 0x4c27ef
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xa00000
ja 0x4c27e2
lea esi, [ebx + 1]
mov dword [ebp - 0x14], 0
push esi
call fcn.005186e4
add esp, 4
mov dword [ebp - 0x30], eax
push esi
push 0
push eax
call fcn.0051b820
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x14]
add esp, 0xc
push 0
push eax
push ebx
push dword [ebp - 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c27d0
mov edx, dword [ebp - 0x30]
push ecx
push ebx
lea ecx, [ebp - 0x54]
call fcn.004c2920
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push eax
call fcn.00415a80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.00404760
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x30]
call fcn.005186a1
add esp, 4
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.004047b0
jmp 0x4c27fa
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.004047b0
mov dword [ebp - 0x34], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00404760
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00518690
mov esp, ebp
pop ebp
ret