joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c620
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018e3f8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x101f62b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], eax
xor eax, eax
push 3
push 0x101aee58
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10001d60
mov dword [ebp - 4], 0
call fcn.1004cb70
mov esi, eax
call fcn.1012cb80
lea ecx, [eax + 4]
mov dword [eax], esi
lea eax, [ebp - 0x28]
cmp ecx, eax
je 0x1001c6a3
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10001d60
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1001c6e4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001c6da
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001c78c
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov ebx, dword [ebp + 8]
lea esi, [edi + 0x60]
mov dword [edi + 0x5c], ebx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1001c6f7
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001c73c
cmp dword [esi + 0x14], 8
jb 0x1001c70a
mov esi, dword [esi]
push esi
push str.Unable_to_create_application_folder_at_path:__s
push 0x101aee58
call fcn.1004cb70
push eax
call fcn.1004dbb0
add esp, 0x10
mov eax, 0xcc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
call fcn.10169cb4
mov dword [edi + 0x78], eax
add esp, 4
mov dword [edi + 0x7c], edx
mov esi, dword [ebx + 0x4c]
cmp esi, dword [ebx + 0x50]
je 0x1001c76c
push dword [esi]
mov ecx, edi
push dword [ebp - 0x10]
call fcn.1001c7a0
test eax, eax
jne 0x1001c778
add esi, 4
cmp esi, dword [ebx + 0x50]
jne 0x1001c754
push 1
push dword [ebp - 0x10]
mov ecx, edi
call fcn.1001d6d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.101686f5
int3
Function at 0x1002d320
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.1002b370
Function at 0x10032a20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018d238
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.1004cb70
push str.Get_NON_RIBS_Product_count
push 0x101b0364
push eax
mov edx, dword [eax]
mov esi, dword [edx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
xor eax, eax
mov dword [ebp - 0x18], 0
add esp, 0xc
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov dword [ebp - 4], eax
lea ecx, [eax + 0x15]
call fcn.100460e0
test al, al
jne 0x10032a9f
push str.Failed_to_get_ACF_path.
jmp 0x10032b6b
push 0x20
push str.AdobeApplicationManagerAAMRefs
lea ecx, [ebp - 0x28]
call fcn.10001e70
xor bl, bl
call fcn.1004cb70
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10032ae6
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
mov cl, 1
setne bl
jmp 0x10032ae8
xor cl, cl
xor edx, edx
movzx eax, bl
test cl, cl
cmove eax, edx
test al, al
jne 0x10032b1c
mov dword [edi], edx
call fcn.1004cb70
push str.AAMRefs_folder__does_not_exists._Non_Ribs_products_does_not_exist_on_the_system
push 0x101b0364
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
jmp 0x10032b84
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10008a80
test al, al
jne 0x10032b5e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.Failed_to_get_AAMRef_file_count_from_the_directory__s.
push 0x101b0364
push ecx
call fcn.1004cb70
add esp, 4
push eax
call fcn.1004dc40
add esp, 0x10
xor bl, bl
jmp 0x10032b86
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
jne 0x10032b82
push str.Error_occured_while_fetching_the_product_count__1.
push 0x101b0364
call fcn.1004cb70
push eax
call fcn.1004dbb0
add esp, 0xc
xor bl, bl
jmp 0x10032b86
mov dword [edi], eax
mov bl, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10032bbc
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10032bb2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032bda
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret
call fcn.101686f5
int3
Function at 0x10033ca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10190120
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1004cb70
push str.Remove_the_ADCRef_file_created_by_ACCC
push 0x101b0364
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
xor eax, eax
mov dword [ebp - 0x18], 0
add esp, 0xc
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov dword [ebp - 4], eax
lea ecx, [eax + 0x21]
call fcn.100460e0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10033d33
call fcn.1004cb70
push str.Failed_to_find_ADCRefs_Folder_location_for_ACCC.
jmp 0x10033e13
push 0xa
xor eax, eax
mov dword [ebp - 0x30], 0
push str.ACC.adcref
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.10001d60
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100fd940
mov byte [ebp - 4], 0
add esp, 0xc
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x10033daa
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10033da0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10033ea6
push edx
push ecx
call fcn.1015cbd5
add esp, 8
xor bl, bl
call fcn.1004cb70
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10033de2
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
mov cl, 1
setne bl
jmp 0x10033de4
xor cl, cl
xor edx, edx
movzx eax, bl
test cl, cl
cmove eax, edx
test al, al
je 0x10033e2f
sub esp, 8
lea ecx, [ebp - 0x28]
push edx
push 1
mov dl, 1
call fcn.1010a370
add esp, 0x10
test al, al
jne 0x10033e2f
call fcn.1004cb70
push str.Failed_to_remove_ADC.adcref.
mov ecx, dword [eax]
push 0x101b0364
push eax
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
xor bl, bl
jmp 0x10033e53
call fcn.1004cb70
push str.ADCRefs_Folders_deleted_successfully
push 0x101b0364
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
mov bl, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10033e89
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10033e7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10033eab
push edx
push ecx
call fcn.1015cbd5
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret
call fcn.101686f5
call fcn.101686f5
int3
Function at 0x10035bd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.PIM_Uninstall
push ecx
call fcn.1004cb70
mov ecx, eax
call fcn.1004cc20
mov ecx, dword [ebp + 8]
mov dl, 1
pop ebp
jmp fcn.10038cd0
Function at 0x1004c940
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019216f
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x414]
mov ecx, 0x101fcfa0
mov dword [ebp - 0x414], eax
push 0x101ca2d4
mov dword [ebp - 0x414], 0x101fcfa0
call fcn.10122840
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
mov dword [0x101fcfa0], 0x101ad518
xor eax, eax
mov dword [0x101fd020], 0
push eax
push 0x101ace0c
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.10001d60
mov ecx, 0x101fd028
call fcn.10122df0
lea eax, [ebp - 0x410]
mov byte [ebp - 4], 1
push eax
push 0x200
mov dword [0x101fd058], 0
mov word [0x101fd05c], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004ca21
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x110
call fcn.1015c88b
mov esi, eax
add esp, 4
mov dword [ebp - 0x418], esi
push 0x110
push 0
push esi
mov byte [ebp - 4], 2
call fcn.10160450
add esp, 0xc
mov ecx, esi
call fcn.101219e0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x94]
mov dword [esi], vtable.oobe::LogTargetDefault.0
call fcn.1011dc80
xor eax, eax
mov dword [esi + 0xe4], 0
mov dword [esi + 0xe8], 7
mov word [esi + 0xd4], ax
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], eax
mov byte [ebp - 4], 6
lea ecx, [esi + 4]
push 3
push 0x101b3ba8
mov dword [esi + 0x90], eax
mov byte [esi + 0xd1], 1
mov dword [esi + 0x68], eax
call fcn.10001d60
mov ecx, esi
call fcn.101271a0
mov ecx, esi
call fcn.101281a0
mov byte [esi + 0xd0], 0
mov ecx, esi
mov byte [ebp - 4], 1
push 0x1e
mov dword [0x101fd024], esi
call fcn.10121b80
mov ecx, dword [0x101fd024]
push 0x101ace0c
push 0x101ca2d8
call fcn.10121fa0
push dword [0x101fd024]
call fcn.1011d230
mov ecx, eax
call fcn.1011d2f0
push 3
push 0x101b3ba8
mov ecx, 0x101fcfc0
call fcn.10001d60
mov eax, 0x101fcfa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015c875
mov esp, ebp
pop ebp
ret

Function at 0x1004de41
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
jb 0x1004de51
mov eax, dword [eax]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1004de94
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1004de78
mov al, 1
mov byte [esi + 0x20], al
pop esi
pop ebx
ret
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov byte [esi + 0x20], bl
pop esi
mov al, bl
pop ebx
ret
Function at 0x1004dee0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor bl, bl
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
jb 0x1004def3
mov eax, dword [edi + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 4], eax
test eax, eax
jne 0x1004df20
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1004df1a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1004dee7
cmp dword [edi + 4], 0
je 0x1004df73
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1004df49
mov ecx, dword [edi]
mov bl, 1
mov byte [edi + 0x20], bl
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x1019a4f8]
mov ecx, edi
call esi
pop edi
pop esi
mov al, bl
pop ebx
ret
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1004df73
push dword [edi + 4]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x100647a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov al, byte [esi + 0x44]
test al, al
js 0x100648aa
xor ebx, ebx
test al, al
jle 0x1006483f
lea ecx, [esi + 0x78]
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x10064826
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.1015da40
push edx
push eax
push esi
mov esi, dword [edi + 0x48]
mov ecx, esi
call dword [0x1019a4f8]
call esi
mov esi, dword [esp + 0x24]
add esp, 0x10
jmp 0x1006482b
call fcn.1005a500
mov ecx, dword [esp + 0x10]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, eax
jl 0x100647d0
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x1006489f
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.1015da40
push edx
push eax
push esi
mov esi, dword [edi + 0x48]
mov ecx, esi
call dword [0x1019a4f8]
call esi
mov esi, dword [esp + 0x24]
add esp, 0x10
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.1005a500
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10069110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
push edi
mov al, byte [esi + 0x44]
test al, al
js 0x100691c1
mov edx, dword [esi + 0x74]
je 0x1006923c
mov ecx, dword [edx + 0x48]
call fcn.1005ff80
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
je 0x100691b6
nop word [eax + eax]
movsx eax, al
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x100691a7
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.1015da40
push edx
push eax
push edi
mov edi, dword [ebx + 0x48]
mov ecx, edi
call dword [0x1019a4f8]
call edi
add esp, 0x10
jmp 0x100691ac
call fcn.1005a500
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
jne 0x10069150
mov edx, dword [esi + 0x78]
mov dword [esi + 0x74], edx
jmp 0x10069251
mov edx, dword [esi + 0x40]
test edx, edx
jne 0x100691d7
mov byte [esi], 1
mov eax, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x10069203
cmp al, 4
jne 0x100691eb
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x10]
call fcn.100516f0
mov edx, dword [esi + 0x40]
add esp, 4
mov dword [esi + 0x10], 0
mov byte [esi], 1
movzx eax, byte [esi + 2]
lea edi, [esi + 0x74]
mov ecx, dword [esi + 8]
push eax
push 0
push edi
mov ecx, dword [ecx + 4]
call fcn.10066070
mov ecx, eax
add esp, 0xc
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x10069230
mov byte [esi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [edx + 2]
mov byte [esi + 0x45], al
cmp byte [edx], 0
je 0x100692b0
movzx eax, byte [edx + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x100692b0
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x32], ax
cmp word [edx + 0x18], ax
jbe 0x10069272
mov byte [esi], al
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx + 8], al
jne 0x100691c8
cmp dword [edx + 4], 1
je 0x10069292
mov ecx, 0x10fd7
call fcn.100dfa60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [edx + 9]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
mov byte [esi], 0
call fcn.10069080
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x101d00b4
push 0x10fca
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.10054150
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10069bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x10069bfe
cmp al, 3
jb 0x10069be3
call fcn.10064af0
test eax, eax
jne 0x10069d1f
mov al, byte [esi]
cmp al, 1
je 0x10069d11
cmp al, 2
jne 0x10069bfe
cmp dword [esi + 4], 0
mov byte [esi], 0
jl 0x10069d1d
mov edi, dword [esi + 0x74]
movzx eax, word [esi + 0x46]
mov ecx, eax
cmp byte [edi + 8], 0
jne 0x10069c46
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x1a]
movzx edx, cx
mov ecx, esi
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
call fcn.10069080
test eax, eax
jne 0x10069d1f
mov ecx, esi
call fcn.100693a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x10069ce9
nop
mov bl, byte [esi + 0x44]
test bl, bl
je 0x10069d0e
and byte [esi + 1], 0xf9
xor eax, eax
mov ecx, dword [esi + 0x74]
movsx edx, bl
dec bl
mov word [esi + 0x32], ax
mov ax, word [esi + edx*2 + 0x46]
mov word [esi + 0x46], ax
mov byte [esi + 0x44], bl
mov eax, dword [esi + edx*4 + 0x74]
mov dword [esi + 0x74], eax
mov edx, dword [ecx + 0x48]
test byte [edx + 0x1c], 0x20
je 0x10069cd0
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.1015da40
push edx
push eax
push edi
mov edi, dword [ebx + 0x48]
mov ecx, edi
call dword [0x1019a4f8]
call edi
add esp, 0x10
jmp 0x10069cd7
mov ecx, edx
call fcn.1005a500
movzx eax, word [esi + 0x46]
test ax, ax
je 0x10069c50
mov edi, dword [esi + 0x74]
mov ecx, eax
lea eax, [ecx - 1]
mov word [esi + 0x46], ax
cmp byte [edi + 2], 0
je 0x10069d1d
cmp byte [edi + 8], 0
jne 0x10069d1d
push 0
push esi
call fcn.10069d30
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi], 1
mov eax, 0x65
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006eb90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xorps xmm0, xmm0
mov dword [esp + 0x1c], edi
mov ecx, esi
movlpd qword [esp + 0x10], xmm0
call fcn.10069110
cmp eax, 0x10
jne 0x1006ebd2
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x1006ed2e
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
nop word [eax + eax]
cmp dword [edi + 0x110], 0
jne 0x1006ed2e
mov edi, dword [esi + 0x74]
mov cl, byte [edi + 8]
test cl, cl
jne 0x1006ec10
cmp byte [edi + 2], cl
jne 0x1006ecce
movzx eax, word [edi + 0x18]
cdq
add dword [esp + 0xc], eax
adc ebx, edx
mov dword [esp + 0x10], ebx
test cl, cl
je 0x1006ecce
nop word [eax + eax]
mov dl, byte [esi + 0x44]
test dl, dl
je 0x1006ed17
and byte [esi + 1], 0xf9
xor eax, eax
movsx ecx, dl
dec dl
mov word [esi + 0x32], ax
mov ax, word [esi + ecx*2 + 0x46]
mov word [esi + 0x46], ax
mov byte [esi + 0x44], dl
mov eax, dword [esi + ecx*4 + 0x74]
mov dword [esi + 0x74], eax
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x1006ecad
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.1015da40
push edx
push eax
push edi
mov edi, dword [ebx + 0x48]
mov ecx, edi
call dword [0x1019a4f8]
call edi
add esp, 0x10
jmp 0x1006ecb4
mov ecx, edx
call fcn.1005a500
mov edi, dword [esi + 0x74]
movzx eax, word [esi + 0x46]
cmp ax, word [edi + 0x18]
jae 0x1006ec30
mov ebx, dword [esp + 0x10]
inc eax
mov word [esi + 0x46], ax
movzx ecx, word [esi + 0x46]
movzx eax, word [edi + 0x18]
cmp ecx, eax
jne 0x1006ece7
movzx ecx, byte [edi + 9]
mov eax, dword [edi + 0x38]
mov edx, dword [ecx + eax + 8]
jmp 0x1006ed01
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x1a]
movzx edx, cx
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
mov ecx, esi
call fcn.10069080
test eax, eax
jne 0x1006ed2e
mov edi, dword [esp + 0x1c]
jmp 0x1006ebf0
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], ecx
mov ecx, esi
call fcn.10069110
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10083470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, ecx
mov ebx, edx
push edi
push 0
push 0x14
mov dword [ebp - 4], eax
mov dword [eax], 0
call fcn.10051440
mov esi, eax
add esp, 8
test esi, esi
jne 0x100834a2
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x101f6c3c], 0
je 0x100834f4
mov edi, dword [0x101f6d2c]
test edi, edi
je 0x100834cb
push 0xc8
mov ecx, edi
call dword [0x1019a4f8]
call edi
add esp, 4
test eax, eax
jne 0x100834f4
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x10054430
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call fcn.1016d42c
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10083504
jmp 0x100834f7
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x10083524
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov ecx, ebx
mov dword [esi + 4], eax
call dword [0x1019a4f8]
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret