joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43edcd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004350b7
and dword [ebp - 4], 0
cmp dword [0x457aac], 0
mov ebx, eax
jne 0x43ee7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43ef2f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x43ef2f
push eax
call fcn.00435045
mov dword [esp], 0x4480f0
push edi
mov dword [0x457aac], eax
call esi
push eax
call fcn.00435045
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x457ab0], eax
call esi
push eax
call fcn.00435045
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x457ab4], eax
call esi
push eax
call fcn.00435045
pop ecx
mov dword [0x457abc], eax
test eax, eax
je 0x43ee7e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00435045
pop ecx
mov dword [0x457ab8], eax
mov eax, dword [0x457ab8]
cmp eax, ebx
je 0x43eed6
cmp dword [0x457abc], ebx
je 0x43eed6
push eax
call fcn.004350c0
push dword [0x457abc]
mov esi, eax
call fcn.004350c0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43eed6
test edi, edi
je 0x43eed6
call esi
test eax, eax
je 0x43eecd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43eecd
test byte [ebp - 0xc], 1
jne 0x43eed6
or dword [ebp + 0x10], 0x200000
jmp 0x43ef0f
mov eax, dword [0x457ab0]
cmp eax, ebx
je 0x43ef0f
push eax
call fcn.004350c0
pop ecx
test eax, eax
je 0x43ef0f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43ef0f
mov eax, dword [0x457ab4]
cmp eax, ebx
je 0x43ef0f
push eax
call fcn.004350c0
pop ecx
test eax, eax
je 0x43ef0f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x457aac]
call fcn.004350c0
pop ecx
test eax, eax
je 0x43ef2f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43ef31
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405024
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44533c]
jne 0x40502e
repz ret
jmp fcn.00408e12

Function at 0x40b8ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004069f0
and dword [ebp - 4], 0
cmp dword [0x446c70], 0
mov ebx, eax
jne 0x40b95d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ba0e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40ba0e
push eax
call fcn.0040697e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x446c70], eax
call esi
push eax
call fcn.0040697e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x446c74], eax
call esi
push eax
call fcn.0040697e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x446c78], eax
call esi
push eax
call fcn.0040697e
pop ecx
mov dword [0x446c80], eax
test eax, eax
je 0x40b95d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040697e
pop ecx
mov dword [0x446c7c], eax
mov eax, dword [0x446c7c]
cmp eax, ebx
je 0x40b9b5
cmp dword [0x446c80], ebx
je 0x40b9b5
push eax
call fcn.004069f9
push dword [0x446c80]
mov esi, eax
call fcn.004069f9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b9b5
test edi, edi
je 0x40b9b5
call esi
test eax, eax
je 0x40b9ac
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b9ac
test byte [ebp - 0xc], 1
jne 0x40b9b5
or dword [ebp + 0x10], 0x200000
jmp 0x40b9ee
mov eax, dword [0x446c74]
cmp eax, ebx
je 0x40b9ee
push eax
call fcn.004069f9
pop ecx
test eax, eax
je 0x40b9ee
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b9ee
mov eax, dword [0x446c78]
cmp eax, ebx
je 0x40b9ee
push eax
call fcn.004069f9
pop ecx
test eax, eax
je 0x40b9ee
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x446c70]
call fcn.004069f9
pop ecx
test eax, eax
je 0x40ba0e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ba10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rcr edi, 0x4f
not esi
inc esi
inc edx
not edi
rol eax, 0x43
sbb ebx, 0x44
or ebx, 0x2a
rol ebx, 0x6d
rcr edx, 0xfd
bswap esi
ror esi, 0xca
sbb esi, 0xd0
imul esi
mov ebx, 0x87
ror ebx, 0x4e
neg edx
and eax, 0x9d
neg edi
rol edi, 0x1f
dec eax
mov ebx, 0x2a
not eax
or edi, 0xc8
sub edx, 0xaf
sbb edi, 0xc
and esi, 0xc7
bswap ebx
dec edi
rcl esi, 0x1d
imul eax
inc edx
add edx, 0x2a
sub ebx, 0xe
inc eax
ror ebx, 0xe8
dec eax
imul esi
and edi, 0x57
ror edi, 0x69
neg eax
sub eax, 0xe4
inc edi
inc ebx
rol edi, 0xda
and edx, 0x95
dec esi
neg edx
ror edx, 0xef
rcr ebx, 0x87
xor ecx, ecx
xor edi, edi
dec eax
add edi, 0x7d
not edi
rol eax, 0xb6
and esi, 0xcb
bswap esi
ror edx, 0x38
not eax
dec ebx
rol edx, 0xf
and edx, 0x79
not edi
imul ebx
neg esi
mov ebx, 0x73
and ebx, 0xad
mov edx, 0xed
inc ebx
sub edi, 0x5b
mov eax, 0x1e
bswap ebx
rol edi, 0xa5
dec edi
dec esi
inc edi
inc esi
mov ebx, 0xb
neg eax
not ebx
bswap edi
mov eax, 0x45
inc edi
rcr esi, 0x9b
ror edi, 0xe
imul ebx
dec ebx
rcr esi, 0xbe
or edi, 0xb0
ror edx, 0x1f
or ebx, 0x96
dec edi
rcl eax, 0x2b
or edi, 0x77
and edi, 0x99
rcr edi, 0x5a
rol eax, 0xb6
sub edx, 0x51
rcr edx, 0xd4
or edx, 0x3b
rcl edx, 0xc7
mov ecx, dword [ebp + 0xc]
inc eax
sub edi, 0xe2
rcl ebx, 0x69
bswap ebx
bswap ebx
neg ebx
not ebx
and eax, 0xb3
rol eax, 0x1c
mov ebx, 0x8e
and edi, 0x15
add eax, 0x56
add eax, 0x9f
and esi, 0x86
not esi
inc eax
neg ebx
rcl esi, 0x13
bswap edi
dec edi
and edi, 0x67
ror edx, 0xb1
add eax, 0x84
neg ebx
dec edi
neg ebx
rol edi, 0xd9
mov eax, 0x6c
imul esi
add edi, 0xe8
rol esi, 0xcc
not esi
and ebx, 0x47
bswap esi
sub esi, 0x80
rcr eax, 0xba
neg eax
neg esi
imul esi
dec edx
and edx, 0x5c
rcl ebx, 0xeb
inc edx
inc edi
imul edx
and ebx, 0x35
dec edx
inc eax
mov ebx, 0x57
sub esi, 0x53
mov edi, dword [ebp + 8]
xor ebx, eax
xor eax, esi
xor ebx, ebx
not byte [edi]
xor eax, eax
xor esi, eax
xor ebx, ebx
mov ebx, esi
mov esi, esi
mov esi, ebx
mov eax, eax
xor ebx, eax
mov eax, ebx
add byte [edi], 0x26
mov ebx, ebx
mov eax, esi
xor eax, esi
mov eax, ebx
mov eax, ebx
mov ebx, esi
mov ebx, esi
xor eax, esi
xor esi, ebx
sub byte [edi], 0x86
xor eax, esi
xor esi, ebx
mov ebx, eax
xor eax, eax
mov ebx, ebx
xor ebx, eax
mov esi, esi
mov ebx, ebx
mov esi, eax
imul byte [edi]
inc edi
loop 0x4103df
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x402d9e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402db5
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x402dea
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x402de6
cmp edi, eax
jae 0x402dea
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x402dd8
cmp edi, eax
jb 0x402dee
xor eax, eax
jmp 0x402df7
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x404809
Capabilities:
Query environment variable

Disassembly:
push 0x4c
mov eax, 0x5bac07
call fcn.0058ec94
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov edi, ecx
push edi
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ebx
call fcn.0040820f
mov dword [ebp - 4], 1
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
call ebx
mov esi, dword [ebp - 0x30]
mov edi, eax
inc edi
inc edi
call fcn.004081d8
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0x38], 1
neg ecx
or ecx, eax
push ecx
call fcn.005807c3
pop ecx
push edi
push eax
push dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
call ebx
test eax, eax
je 0x4048a4
push edi
push dword [ebp - 0x34]
lea esi, [ebp - 0x58]
call fcn.004081eb
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
push 0xffffffffffffffff
push 0
call fcn.00409acd
mov byte [ebp - 4], 1
push 0
push 1
call fcn.00409da6
push dword [ebp - 0x34]
call fcn.005820bb
pop ecx
mov byte [ebp - 4], 0
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.00409da6
mov eax, dword [ebp - 0x30]
call fcn.0058ed17
ret
Function at 0x40632a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x6c56f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x114
mov dword [ebp - 0x124], eax
xor ebx, ebx
lea eax, [ebp - 0x120]
push ebx
push eax
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4063c0
cmp dword [ebp - 0x11c], 6
jb 0x4063b2
push ebx
push ebx
push ebx
push 3
push 6
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, ebx
jge 0x40639f
cmp eax, 0x80010119
jne 0x4063c0
push 0x6810d0
push dword [ebp - 0x124]
call fcn.0040568c
pop ecx
jmp 0x4063bd
push dword [ebp - 0x124]
call fcn.004051bf
mov bl, al
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00581268
leave
ret
Function at 0x412673
Capabilities:
Reference sql statements

Disassembly:
push 0x40
mov eax, 0x5c1dfe
call fcn.0058ec5e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push str.SELECT__FROM_logs_WHERE_flags____ORDER_BY_cfired_DESC_LIMIT___
lea eax, [ebp - 0x1c]
push eax
call fcn.0049d0d0
mov byte [ebp - 4], 1
push dword [ebp + 0x10]
push 1
lea eax, [ebp - 0x1c]
call fcn.0049cfb0
push dword [ebp + 0x14]
push 2
lea eax, [ebp - 0x1c]
call fcn.0049cfb0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0049cd60
mov byte [ebp - 4], 2
cmp byte [ebp - 0x28], bl
jne 0x412765
lea eax, [ebp - 0x4c]
push eax
call fcn.00411aa0
mov byte [ebp - 4], 3
xor esi, esi
lea edi, [ebp - 0x30]
call fcn.0049c840
mov dword [ebp - 0x4c], eax
inc esi
call fcn.0049c900
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040865a
push 2
pop esi
call fcn.0049c840
mov dword [ebp - 0x44], eax
push 3
pop esi
call fcn.0049c900
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040865a
push 4
pop esi
call fcn.0049c900
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040865a
push 5
pop esi
call fcn.0049c840
mov dword [ebp - 0x38], eax
push 6
pop esi
call fcn.0049c840
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00416b42
mov eax, edi
push eax
call fcn.0049c980
mov byte [ebp - 4], 2
lea eax, [ebp - 0x4c]
push eax
call fcn.00412635
jmp 0x4126c7
mov byte [ebp - 4], 1
lea esi, [ebp - 0x30]
call fcn.0049c7f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0049cb30
or dword [ebp - 4], 0xffffffff
call fcn.0058ed03
ret 0x10

Function at 0x412cf6
Capabilities:
Reference sql statements

Disassembly:
push 0x34
mov eax, 0x5c1cbc
call fcn.0058ec5e
and dword [ebp - 4], 0
push str.SELECT_id__value_FROM_reports_WHERE_type__
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
call fcn.0049d0d0
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push 1
lea eax, [ebp - 0x24]
call fcn.0049cfb0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0049cd60
mov byte [ebp - 4], 2
cmp byte [ebp - 0x38], 0
jne 0x412d98
xor esi, esi
inc esi
lea edi, [ebp - 0x40]
call fcn.0049c900
mov ebx, eax
test ebx, ebx
je 0x412d8d
xor esi, esi
call fcn.0049c840
mov esi, eax
mov dword [ebp - 0x2c], ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.004085b5
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
mov edi, dword [ebp + 0x10]
call fcn.00416cbf
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
push eax
call fcn.0041679b
lea eax, [ebp - 0x40]
push eax
call fcn.0049c980
jmp 0x412d3c
mov byte [ebp - 4], 1
lea esi, [ebp - 0x40]
call fcn.0049c7f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.0049cb30
or dword [ebp - 4], 0xffffffff
call fcn.0058ed03
ret 0xc
Function at 0x413d76
Capabilities:
Reference sql statements

Disassembly:
push 0x24
mov eax, 0x5c18db
call fcn.0058ec5e
mov ebx, ecx
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push str.SELECT_b_sent_b_recv_FROM_bandwidth_WHERE_b_hour____
lea eax, [ebp - 0x1c]
push eax
call fcn.0049d0d0
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push 1
lea eax, [ebp - 0x1c]
call fcn.0049cfb0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0049cd60
mov byte [ebp - 4], 2
cmp byte [ebp - 0x28], 0
jne 0x413def
xor esi, esi
lea edi, [ebp - 0x30]
call fcn.0049c880
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], edx
inc esi
call fcn.0049c880
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov byte [ebp - 4], 1
lea esi, [ebp - 0x30]
call fcn.0049c7f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0049cb30
call fcn.0058ed03
ret 0xc

Function at 0x413e4d
Capabilities:
Reference sql statements

Disassembly:
push 0x24
mov eax, 0x5c18b0
call fcn.0058ec5e
mov ebx, ecx
xor ecx, ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push str.SELECT_sum_b_sent___sum_b_recv__FROM_bandwidth_WHERE_b_hour_____AND_b_hour_____
lea eax, [ebp - 0x1c]
push eax
call fcn.0049d0d0
mov byte [ebp - 4], 1
push dword [ebp + 0x10]
push 1
lea eax, [ebp - 0x1c]
call fcn.0049cfb0
push dword [ebp + 0xc]
push 2
lea eax, [ebp - 0x1c]
call fcn.0049cfb0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0049cd60
mov byte [ebp - 4], 2
cmp byte [ebp - 0x28], 0
jne 0x413ed3
xor esi, esi
lea edi, [ebp - 0x30]
call fcn.0049c880
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], edx
inc esi
call fcn.0049c880
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov byte [ebp - 4], 1
lea esi, [ebp - 0x30]
call fcn.0049c7f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0049cb30
call fcn.0058ed03
ret 0x10
Function at 0x414133
Capabilities:
Reference sql statements

Disassembly:
push 0x2c
mov eax, 0x5c17f1
call fcn.0058ec5e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
push str.SELECT_name__path__severity__status__action_FROM_realtime_WHERE_applied__0_ORDER_BY_t_on_DESC_
lea ecx, [ebp - 0x38]
push ecx
push eax
call fcn.0049d2f0
mov byte [ebp - 4], 1
cmp byte [ebp - 0x30], bl
jne 0x414214
xor esi, esi
lea edi, [ebp - 0x38]
call fcn.0049c900
push eax
lea eax, [ebp + 8]
push eax
call fcn.004085b5
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00416ae3
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.004085f6
inc esi
call fcn.0049c900
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004085b5
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0x10]
call fcn.00416ae3
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004085f6
push 2
pop esi
call fcn.0049c840
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x14]
call fcn.0040fe12
push 3
pop esi
call fcn.0049c840
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 0x18]
call fcn.0040fe12
push 4
pop esi
call fcn.0049c840
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 0x1c]
call fcn.0040fe12
mov eax, edi
push eax
call fcn.0049c980
jmp 0x41415d
mov byte [ebp - 4], bl
lea esi, [ebp - 0x38]
call fcn.0049c7f0
or dword [ebp - 4], 0xffffffff
call fcn.0058ed03
ret 0x18

Function at 0x414354
Capabilities:
Reference sql statements

Disassembly:
push 0x28
mov eax, 0x5c1778
call fcn.0058ec5e
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
push dword [ebp + 0xc]
call fcn.0040855f
mov dword [ebp - 4], esi
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
push str.SELECT_r_threats_FROM_scan_logs_WHERE_id__
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
call fcn.0049d0d0
mov byte [ebp - 4], 2
push dword [ebp + 0x10]
push ebx
lea eax, [ebp - 0x20]
call fcn.0049cfb0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0049cd60
mov byte [ebp - 4], 3
cmp byte [ebp - 0x2c], 0
jne 0x4143c8
lea edi, [ebp - 0x34]
call fcn.0049c900
push eax
push dword [ebp + 0xc]
call fcn.0040865a
mov byte [ebp - 4], 2
lea esi, [ebp - 0x34]
call fcn.0049c7f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20]
call fcn.0049cb30
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
call fcn.0058ed03
ret 0xc
Function at 0x414426
Capabilities:
Reference sql statements

Disassembly:
push 0x24
mov eax, 0x5c1734
call fcn.0058ec5e
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.SELECT_r_time__r_app__r_os__r_comp__r_user__r_logs__r_sigs__r_found__r_end_FROM_scan_logs_WHERE_id__
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
call fcn.0049d0d0
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push 1
lea eax, [ebp - 0x1c]
call fcn.0049cfb0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0049cd60
mov byte [ebp - 4], 2
cmp byte [ebp - 0x28], bl
jne 0x414521
xor esi, esi
lea edi, [ebp - 0x30]
call fcn.0049c900
push eax
push dword [ebp + 0x10]
call fcn.0040865a
inc esi
call fcn.0049c900
push eax
push dword [ebp + 0x14]
call fcn.0040865a
push 2
pop esi
call fcn.0049c900
push eax
push dword [ebp + 0x18]
call fcn.0040865a
push 3
pop esi
call fcn.0049c900
push eax
push dword [ebp + 0x1c]
call fcn.0040865a
push 4
pop esi
call fcn.0049c900
push eax
push dword [ebp + 0x20]
call fcn.0040865a
push 5
pop esi
call fcn.0049c900
push eax
push dword [ebp + 0x24]
call fcn.0040865a
push 6
pop esi
call fcn.0049c840
mov ecx, dword [ebp + 0x28]
mov dword [ecx], eax
push 7
pop esi
call fcn.0049c840
mov ecx, dword [ebp + 0x2c]
mov dword [ecx], eax
push 8
pop esi
call fcn.0049c900
push eax
push dword [ebp + 0x30]
call fcn.0040865a
mov byte [ebp - 4], 1
mov esi, edi
call fcn.0049c7f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0049cb30
mov al, 1
jmp 0x41453e
mov byte [ebp - 4], 1
lea esi, [ebp - 0x30]
call fcn.0049c7f0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0049cb30
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.0058ed03
ret 0x2c
Function at 0x4157c1
Capabilities:
Reference sql statements

Disassembly:
push 0x64
mov eax, 0x5c56d0
call fcn.0058ec5e
mov ebx, ecx
or dword [ebp - 0x20], 0xffffffff
or dword [ebp - 0x1c], 0xffffffff
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push str.SELECT_id__url__title__visit_count__last_visit_time_FROM_urls_WHERE_id_____ORDER_BY_id_ASC_LIMIT_100_
lea eax, [ebp - 0x28]
push eax
call fcn.0049d0d0
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push 1
lea eax, [ebp - 0x28]
call fcn.0049cfb0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0049cd60
mov byte [ebp - 4], 2
cmp byte [ebp - 0x44], 0
jne 0x4158d8
lea eax, [ebp - 0x70]
push eax
call fcn.00410be4
mov byte [ebp - 4], 3
push str.Google_Chrome
lea eax, [ebp - 0x68]
push eax
call fcn.0040865a
xor esi, esi
lea edi, [ebp - 0x4c]
call fcn.0049c880
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
inc esi
call fcn.0049c900
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0040865a
push 2
pop esi
call fcn.0049c900
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0040865a
push 3
pop esi
call fcn.0049c840
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x41587e
mov dword [ebp - 0x54], 1
push 4
pop esi
lea edi, [ebp - 0x4c]
call fcn.0049c880
mov ecx, eax
or ecx, edx
je 0x4158aa
push 0
push 0xf4240
push edx
push eax
call fcn.005870d0
sub eax, 0xb6109100
sbb edx, 2
mov dword [ebp - 0x2c], edx
jmp 0x4158af
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x70]
push eax
mov eax, ebx
call fcn.00410ed5
lea eax, [ebp - 0x4c]
push eax
call fcn.0049c980
mov byte [ebp - 4], 2
lea eax, [ebp - 0x70]
push eax
call fcn.00415757
jmp 0x415811
mov esi, dword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
mov ecx, esi
sub ecx, eax
test ecx, 0xffffffe0
je 0x415917
and dword [ebp - 0x38], 0
cmp eax, esi
jbe 0x4158f7
call fcn.0058204a
mov eax, dword [ebx]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x30]
call fcn.00410f2f
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
jmp 0x415934
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x1c]
push str.SELECT_id_FROM_urls_ORDER_BY_id_DESC_
call fcn.0049d4d0
cmp eax, dword [ebp + 0xc]
jge 0x415934
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
lea esi, [ebp - 0x4c]
call fcn.0049c7f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0049cb30
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.0058ed03
ret 8
Function at 0x415efb
Capabilities:
Reference sql statements

Disassembly:
push 0x44
mov eax, 0x5c1416
call fcn.0058ec5e
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
push dword [ebp + 0xc]
call fcn.00417200
mov dword [ebp - 4], esi
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push str.SELECT_c_id__c_path__c_proc__c_size__c_mod__c_on__c_blocked_FROM_doc_events2_WHERE_c_on____i_AND_c_on____i_
push 0x3e8
lea eax, [ebp + 0x14]
push eax
call fcn.00489330
add esp, 0x14
mov byte [ebp - 4], 2
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push ecx
call fcn.0049d2f0
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x14]
call fcn.004084b5
cmp byte [ebp - 0x20], 0
jne 0x415fff
lea eax, [ebp - 0x50]
push eax
call fcn.00411a09
mov byte [ebp - 4], 5
xor esi, esi
lea edi, [ebp - 0x28]
call fcn.0049c880
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov esi, ebx
call fcn.0049c900
push eax
lea eax, [ebp - 0x48]
call fcn.0040fedc
push 2
pop esi
call fcn.0049c900
push eax
lea eax, [ebp - 0x44]
call fcn.0040fedc
push 3
pop esi
call fcn.0049c880
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push 4
pop esi
call fcn.0049c840
mov dword [ebp - 0x38], eax
push 5
pop esi
call fcn.0049c840
mov dword [ebp - 0x34], eax
push 6
pop esi
call fcn.0049c840
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00417262
mov eax, edi
push eax
call fcn.0049c980
mov byte [ebp - 4], 4
lea eax, [ebp - 0x50]
push eax
call fcn.00416023
jmp 0x415f62
mov byte [ebp - 4], bl
lea esi, [ebp - 0x28]
call fcn.0049c7f0
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
call fcn.0058ed03
ret 0x10