joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ec90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3d28
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4e4738]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [0x4e78e8]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x41ece9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41ecd3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x41ecd3
movzx eax, word [ecx + 6]
lea edi, [ecx + 8]
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 4]
push eax
movzx eax, word [ecx + 2]
mov ecx, ebx
push eax
call fcn.0041ec20
cmp dword [ebx + 0x48], 0
jne 0x41ed77
mov esi, dword [0x4e78e8]
push 2
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
cmp word [eax + 0xe], 0x20
sete al
shl al, 5
xor al, byte [ebx + 0x85]
and al, 0x20
xor byte [ebx + 0x85], al
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 6]
push eax
call fcn.00422530
test al, al
je 0x41ecd3
push dword [ebx + 0x48]
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
test byte [ebx + 0x85], 0x20
je 0x41edaf
push 0x2040
push 0
push 0
push 0
push dword [ebp + 8]
push dword [0x4e78e8]
call dword [sym.imp.USER32.dll_LoadImageW]
jmp 0x41edbe
push dword [ebp + 8]
push dword [0x4e78e8]
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x41ee2c
push dword [ebx + 0xa0]
push esi
push dword [ebx + 0x48]
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp eax, 0xffffffff
je 0x41ee2c
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x41edfe
cmp word [edi], 0
je 0x41edf5
push edi
lea ecx, [ebx + 0x4c]
call fcn.0041caf0
mov eax, dword [ebp - 0x10]
add edi, 2
dec eax
mov dword [ebp - 0x10], eax
jne 0x41ede3
push dword [ebx + 0x48]
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov edi, eax
cmp edi, dword [ebx + 0x50]
jne 0x41ee2c
call fcn.0041a980
test al, al
je 0x41ee25
mov eax, dword [ebp - 0x18]
mov ecx, ebx
sub edi, eax
push edi
push eax
call fcn.00422580
mov edi, 1
jmp 0x41ee2e
xor edi, edi
test esi, esi
je 0x41ee39
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x420120
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
je 0x420155
test byte [esi + 0x58], 4
je 0x42014c
cmp dword [esi + 0xac], 0
jne 0x42014c
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esi + 0xac], eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp + 8]
push 0
push dword [eax + 0xc]
push 0x419
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
and byte [esi + 0x84], 0xcf
mov ecx, esi
push 1
push eax
call fcn.00421aa0
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x420190
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [esi + 0xa8]
mov dword [edi], 0
cmp eax, 0x12
je 0x4201c5
cmp eax, 0x79
jne 0x4201bc
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4201c5
cmp dword [esi + 0xa8], 0x20
jne 0x420244
cmp dword [ebp + 0xc], 0xf100
jne 0x420244
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x420201
mov ecx, esi
call fcn.00422440
push 0
push 0xffffffffffffffff
push 0x448
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
and byte [esi + 0x84], 0xbf
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0xa8]
cmp eax, 0x20
je 0x420244
test byte [esi + 0x84], 0x40
jne 0x420239
mov al, byte [esi + 0x85]
test al, 2
je 0x420230
test al, 4
jne 0x420230
test al, 8
je 0x420230
push 1
mov ecx, esi
call fcn.004224d0
mov ecx, esi
call fcn.00422410
jmp 0x42023e
cmp eax, 0x20
je 0x420244
mov dword [edi], 1
and byte [esi + 0x84], 0xbf
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x420e50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c3de8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4e4738]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4e4738]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x420fa6
cmp byte [ebx + 0x46], 0
je 0x420fa6
mov eax, dword [ebx]
push 0xffff
call dword [eax + 0xc]
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
jne 0x420ebb
xor al, al
jmp 0x420fa8
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x420f33
dec eax
je 0x420f37
sub eax, 2
je 0x420f8d
xor bl, bl
jmp 0x420f8f
mov byte [ebx + 0x46], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x420f6e
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004a9a4f
add esp, 0x10
cmp esi, eax
jne 0x420f2f
cmp byte [ebx + 0x46], 0
je 0x420f8d
test esi, esi
jne 0x420ef2
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00420a90
jmp 0x420ef2
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x420fa2
push dword [esp + 0x18]
call fcn.00427430
add esp, 4
mov al, bl
jmp 0x420fa8
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a83d2
mov esp, ebp
pop ebp
ret
Function at 0x42a3e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x4e64d8], 0
je 0x42a437
mov eax, dword [0x4e8c60]
test eax, eax
je 0x42a410
push eax
call dword [0x4e652c]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.00427b30
mov eax, dword [0x4e8c60]
test eax, eax
je 0x42a432
push eax
call dword [0x4e6534]
mov esi, dword [ebp - 4]
jmp 0x42a441
mov esi, dword [ebp - 4]
jmp 0x42a444
push 0x14
call dword [0x4e64fc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x42a452
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x4e64dc], 0
mov ebx, dword [ebp + 8]
je 0x42a485
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x42a3b0
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.004a9fe3
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x42a493
xorps xmm0, xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x42a4ac
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c500
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x42c52e
jmp 0x42c510
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x4cf920]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x42c510
pop esi
ret
Function at 0x42c5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov ecx, 0x80
mov dword [ebp - 4], esi
lea eax, [edi*8]
cmp eax, 0x400
cmova edi, ecx
cmp edi, dword [esi]
jne 0x42c5d1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4e8c8c]
test eax, eax
je 0x42c5dc
call eax
lea eax, [edi*8]
push 0
push eax
call fcn.00427c20
mov ecx, dword [0x4e8c90]
add esp, 8
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ecx, ecx
je 0x42c5ff
call ecx
test ebx, ebx
je 0x42c5c8
push dword [esi + 0xc]
call fcn.00427fe0
add esp, 4
mov dword [esi + 0xc], ebx
push ebx
call dword [0x4e6508]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [esi], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.004aaf60
mov ecx, dword [esi + 8]
add esp, 0xc
mov dword [esi + 8], 0
test ecx, ecx
je 0x42c6e2
mov edi, dword [ecx + 0xc]
xor ebx, ebx
mov al, byte [edi]
test al, al
je 0x42c671
movzx eax, al
lea edx, [ebx*8]
lea edi, [edi + 1]
movzx esi, byte [eax + 0x4cf920]
mov al, byte [edi]
xor esi, edx
xor ebx, esi
test al, al
jne 0x42c653
xor edx, edx
mov edi, dword [ecx]
mov eax, ebx
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x42c6bc
mov eax, dword [esi]
test eax, eax
je 0x42c68f
mov edx, dword [esi + 4]
jmp 0x42c691
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x42c6bc
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x42c6b1
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x42c6d8
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x42c6d8
mov esi, dword [ebp - 4]
mov eax, dword [esi + 8]
mov dword [ecx], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x42c6ce
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [esi + 8], ecx
mov ecx, edi
test edi, edi
jne 0x42c648
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push esi
push edi
mov ecx, dword [eax + 0xc]
mov ebx, edx
mov dword [ebp - 4], eax
test ecx, ecx
je 0x42c743
mov al, byte [ebx]
xor esi, esi
mov edi, ebx
test al, al
je 0x42c72e
nop
movzx eax, al
lea ecx, [esi*8]
lea edi, [edi + 1]
movzx edx, byte [eax + 0x4cf920]
mov al, byte [edi]
xor edx, ecx
xor esi, edx
test al, al
jne 0x42c710
mov ecx, dword [ebp - 4]
mov eax, esi
xor edx, edx
div dword [ecx]
mov edi, dword [ecx + 0xc]
mov esi, dword [edi + edx*8 + 4]
mov edi, dword [edi + edx*8]
jmp 0x42c74b
mov esi, dword [eax + 8]
xor edx, edx
mov edi, dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [eax], edx
test edi, edi
je 0x42c76b
push ebx
push dword [esi + 0xc]
dec edi
call fcn.0042afb0
add esp, 8
test eax, eax
je 0x42c774
mov esi, dword [esi]
test edi, edi
jne 0x42c754
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
xor eax, eax
mov dword [esp + 0xc], edi
cmp ax, word [ecx + 0x4c]
jg 0x43a036
lea ebx, [ecx + 0x78]
mov dword [esp + 0x10], ebx
lea esp, [esp]
mov ecx, dword [ebx]
test ecx, ecx
je 0x43a014
mov ecx, dword [ecx + 0x44]
test byte [ecx + 0x18], 0x40
mov esi, dword [ecx + 0x10]
je 0x439ff6
dec dword [esi + 0x78]
mov eax, dword [esi + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x98]
mov edi, dword [esi + 0x3c]
mov dword [esi + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004adf70
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [esp + 0xc]
jmp 0x439ffb
call fcn.00430740
cmp dword [esi + 0x78], 0
jne 0x43a014
mov eax, dword [esi + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x43a014
mov ecx, esi
call fcn.00433110
mov ecx, dword [esp + 0x14]
inc edi
mov dword [ebx], 0
add ebx, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
movsx eax, word [ecx + 0x4c]
cmp edi, eax
jle 0x439fa0
pop edi
or eax, 0xffffffff
pop esi
mov word [ecx + 0x4c], ax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edx
xor esi, esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
test edi, edi
je 0x43d5f1
cmp byte [edi + 9], 0
je 0x43d4a8
inc dword [edi + 0xc]
cmp byte [edi + 0xa], 0
jne 0x43d4a8
call fcn.00439b90
mov eax, dword [edi + 4]
mov ebx, dword [eax + 8]
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x43d5df
lea ebx, [ebx]
cmp dword [ebp + 8], 0
je 0x43d4fa
test byte [ebx + 0x48], 1
jne 0x43d4fa
cmp byte [ebx + 0x49], 1
jne 0x43d517
mov ecx, ebx
call fcn.0043a050
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
je 0x43d517
mov edi, dword [esp + 0x20]
mov edx, esi
push 0
mov ecx, edi
call fcn.0043d470
add esp, 4
jmp 0x43d5df
push dword [ebx + 0x38]
call fcn.00427fe0
mov eax, dword [esp + 0x28]
add esp, 4
mov dword [ebx + 0x38], 0
mov byte [ebx + 0x49], 4
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [ebx + 0x4c]
jg 0x43d5c8
lea edi, [ebx + 0x78]
mov dword [esp + 0x14], edi
mov ecx, dword [edi]
test ecx, ecx
je 0x43d5a6
mov ecx, dword [ecx + 0x44]
test byte [ecx + 0x18], 0x40
mov esi, dword [ecx + 0x10]
je 0x43d588
dec dword [esi + 0x78]
mov eax, dword [esi + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x98]
mov edi, dword [esi + 0x3c]
mov dword [esi + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004adf70
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x28]
add esp, 0x10
mov edi, dword [esp + 0x14]
jmp 0x43d58d
call fcn.00430740
cmp dword [esi + 0x78], 0
jne 0x43d5a6
mov eax, dword [esi + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x43d5a6
mov ecx, esi
call fcn.00433110
mov ecx, dword [esp + 0x10]
mov dword [edi], 0
inc ecx
movsx eax, word [ebx + 0x4c]
add edi, 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
cmp ecx, eax
jle 0x43d532
mov ebx, dword [ebx + 8]
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x43d4c0
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
cmp byte [edi + 9], 0
je 0x43d5f1
dec dword [edi + 0xc]
jne 0x43d5f1
mov ecx, edi
call fcn.00439b50
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov al, byte [esi + 0x49]
cmp al, 3
jb 0x43e174
cmp al, 4
jne 0x43e163
mov eax, dword [esi + 0x44]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x38]
call fcn.00427fe0
add esp, 4
mov dword [esi + 0x38], ebx
mov byte [esi + 0x49], bl
movzx eax, word [esi + 0x4c]
test ax, ax
js 0x43e227
je 0x43e26e
jmp 0x43e190
movzx ecx, word [esi + 0x4c]
movsx eax, cx
mov edx, dword [esi + eax*4 + 0x78]
lea eax, [ecx - 1]
mov word [esi + 0x4c], ax
test edx, edx
je 0x43e218
mov ecx, dword [edx + 0x44]
test byte [ecx + 0x18], 0x40
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0xc], ebx
je 0x43e1fa
dec dword [ebx + 0x78]
mov eax, dword [ebx + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0xc]
mov edi, dword [ebx + 0x3c]
mov dword [ebx + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004adf70
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x1c]
add esp, 0x10
jmp 0x43e1ff
call fcn.00430740
cmp dword [ebx + 0x78], 0
jne 0x43e218
mov eax, dword [ebx + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x43e218
mov ecx, ebx
call fcn.00433110
cmp word [esi + 0x4c], 0
jne 0x43e190
xor ebx, ebx
jmp 0x43e26e
mov edx, dword [esi + 0x3c]
test edx, edx
jne 0x43e23a
mov byte [esi + 0x49], bl
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 0x48]
mov ecx, dword [esi]
add eax, eax
not eax
and eax, 2
push eax
mov ecx, dword [ecx + 4]
lea eax, [esi + 0x78]
push eax
call fcn.0043b3c0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x43e268
mov byte [esi + 0x49], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [esi + 0x4c], ax
mov edx, dword [esi + 0x78]
cmp byte [edx], 0
je 0x43e2fa
movzx eax, byte [edx + 2]
xor ecx, ecx
cmp dword [esi + 0x10], ecx
sete cl
cmp ecx, eax
jne 0x43e2fa
xor eax, eax
mov word [esi + 0x4e], ax
and byte [esi + 0x48], 0xf1
mov word [esi + 0x2c], ax
cmp word [edx + 0x12], ax
jbe 0x43e2ab
mov byte [esi + 0x49], 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx + 5], al
jne 0x43e2ee
cmp dword [edx + 0x48], 1
je 0x43e2c7
mov ecx, 0xdfb2
call fcn.0049a590
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx + 0x38]
movzx ecx, byte [edx + 6]
add eax, 8
add ecx, eax
call fcn.0042bf70
mov edx, eax
mov byte [esi + 0x49], 1
mov ecx, esi
call fcn.0043e0a0
mov ebx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x49], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4daaa0
push 0xdfa7
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.0042a1d0
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43fee0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov dword [esp + 0x18], edx
mov edi, ecx
cmp dword [ebx], 0
mov dword [esp + 0x10], 0
jne 0x440087
cmp byte [edi + 1], 0
jne 0x440033
mov esi, dword [ebp + 0xc]
movzx eax, word [edi + 0x10]
lea ecx, [esi + 2]
cmp ecx, eax
jg 0x440033
mov ecx, dword [edi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x43ff3d
call fcn.00436140
jmp 0x43ff42
call fcn.00435f90
test eax, eax
je 0x43ff4f
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x38]
mov edx, esi
movzx ecx, word [edi + 0xe]
mov dword [esp + 0x14], eax
movzx eax, word [edi + 0x12]
lea eax, [ecx + eax*2]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
lea eax, [ecx + eax*2]
mov ecx, edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
call fcn.0043abe0
add esp, 4
test eax, eax
jne 0x43ff46
mov ecx, dword [esp + 0x10]
mov eax, 0xfffe
mov edx, dword [esp + 0x14]
sub eax, esi
inc word [edi + 0x12]
add word [edi + 0x10], ax
push esi
push dword [ebp + 8]
lea esi, [edx + ecx]
push esi
call fcn.004aaff0
mov ecx, dword [ebp + 0x14]
add esp, 0xc
test ecx, ecx
je 0x43ffcd
mov eax, ecx
mov byte [esi + 3], cl
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov esi, dword [esp + 0x14]
add esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
push eax
lea eax, [esi + 2]
push esi
push eax
call fcn.004a83f0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov edx, dword [esp + 0x14]
mov eax, ecx
mov byte [esi + 1], cl
sar eax, 8
mov byte [esi], al
movzx ecx, byte [edi + 6]
movzx eax, byte [edi + 0x13]
mov byte [ecx + edx + 3], al
movzx ecx, byte [edi + 6]
movzx eax, byte [edi + 0x12]
mov byte [ecx + edx + 4], al
mov eax, dword [edi + 0x34]
cmp byte [eax + 0x11], 0
je 0x440087
mov edx, dword [ebp + 8]
mov ecx, edi
push ebx
call fcn.0043a860
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x44004f
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.004aaff0
mov edx, dword [esp + 0x24]
add esp, 0xc
jmp 0x440052
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x440073
mov eax, ecx
mov byte [esi + 3], cl
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov al, byte [edi + 1]
movzx ecx, al
inc al
mov byte [edi + 1], al
mov dword [edi + ecx*4 + 0x20], esi
mov word [edi + ecx*2 + 0x16], dx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x4e4738]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x24]
mov eax, 0xaaaaaaab
add edx, edx
mul edx
shr edx, 1
xor ecx, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
jmp 0x441e50
movsx ecx, word [ebx + 0x4c]
mov dword [esp + 0x20], ecx
mov esi, dword [ebx + ecx*4 + 0x78]
test ecx, ecx
jne 0x441e8e
cmp byte [esi + 1], cl
je 0x441fe8
lea edx, [ebx + 0x7c]
mov ecx, esi
call fcn.00441cd0
mov edi, eax
test edi, edi
jne 0x441fe8
mov edx, dword [esp + 0x18]
mov dword [ebx + 0x4c], 1
mov word [ebx + 0x50], ax
jmp 0x441e50
cmp byte [esi + 1], 0
jne 0x441ea0
movzx eax, word [esi + 0x10]
cmp eax, edx
jle 0x441fe8
mov edi, dword [ebx + ecx*4 + 0x74]
movzx eax, word [ebx + ecx*2 + 0x4c]
mov dword [esp + 0xc], eax
mov ecx, dword [edi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x441ec8
call fcn.00436140
jmp 0x441ecd
call fcn.00435f90
mov dword [esp + 0x10], eax
test eax, eax
jne 0x441f5e
cmp byte [esi + 3], al
je 0x441f15
cmp byte [esi + 1], 1
jne 0x441f15
mov ax, word [esi + 0x16]
cmp ax, word [esi + 0x12]
jne 0x441f15
cmp dword [edi + 0x48], 1
je 0x441f15
movzx eax, word [edi + 0x12]
cmp eax, dword [esp + 0xc]
jne 0x441f15
lea eax, [esp + 0x24]
mov edx, esi
push eax
mov ecx, edi
call fcn.00440980
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x441f5e
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0x20]
call fcn.00430be0
movzx ecx, byte [ebx + 0x4a]
mov edx, dword [esp + 0xc]
push ecx
xor ecx, ecx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x24], 1
sete cl
push ecx
push eax
mov ecx, edi
call fcn.00440bf0
mov dword [esp + 0x1c], eax
add esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x441f56
mov ecx, eax
call fcn.00430d00
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 0x44]
mov byte [esi + 1], 0
test byte [ecx + 0x18], 0x40
mov esi, dword [ecx + 0x10]
mov dword [esp + 0xc], esi
je 0x441fb6
dec dword [esi + 0x78]
mov eax, dword [esi + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov eax, dword [eax + 0x98]
dec ecx
mov esi, dword [esi + 0x3c]
cdq
push edx
push eax
mov edi, dword [esi]
push 0
push ecx
call fcn.004adf70
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x1c]
add esp, 0x10
jmp 0x441fbb
call fcn.00430740
cmp dword [esi + 0x78], 0
jne 0x441fd4
mov eax, dword [esi + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x441fd4
mov ecx, esi
call fcn.00433110
dec word [ebx + 0x4c]
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
test edi, edi
je 0x441e50
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x441ff5
call fcn.00430d00
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a83d2
mov esp, ebp
pop ebp
ret