joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428255
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
lea edi, [esi + 8]
push edi
xor ebx, ebx
call fcn.00427c89
cmp eax, 1
pop ecx
jne 0x42827a
mov word [esi], 0x17
xor eax, eax
jmp 0x4282b0
push 0x10
push 0
push edi
call sub.MSVCR80.dll_memset
add esp, 0xc
push dword [esp + 0x10]
mov word [esi], 2
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x4282ae
push 0
push 0xffffe89d
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
or ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4286fb
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
push esi
xor esi, esi
inc esi
shl esi, cl
push edi
mov eax, esi
shl eax, 4
push eax
push 1
call sym.AdobeCollabSync.exe_PR_Calloc
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4285fc
or eax, 0xffffffff
jmp 0x42870c
push ebx
xor ebx, ebx
test esi, esi
jbe 0x428620
lea eax, [edi + 8]
mov dword [ebp - 4], eax
call sym.AdobeCollabSync.exe_PR_NewMonitor
test eax, eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
je 0x428620
add dword [ebp - 4], 0x10
inc ebx
cmp ebx, esi
jb 0x428609
cmp ebx, esi
je 0x428650
test ebx, ebx
jne 0x428636
push edi
call sym.AdobeCollabSync.exe_PR_Free
or eax, 0xffffffff
jmp 0x42870a
mov eax, ebx
shl eax, 4
push eax
push edi
call sym.AdobeCollabSync.exe_PR_Realloc
test eax, eax
pop ecx
pop ecx
jne 0x428650
or eax, 0xffffffff
jmp 0x42870b
lea ecx, [ebx - 1]
test ecx, ecx
mov eax, edi
jbe 0x428663
dec ecx
lea edx, [eax + 0x10]
mov dword [eax], edx
mov eax, edx
jne 0x428659
mov ecx, dword [0x4a98f0]
add dword [0x4a98e0], ebx
mov dword [eax], ecx
mov eax, esi
shl eax, 2
push eax
push 1
mov dword [0x4a98f0], edi
call sym.AdobeCollabSync.exe_PR_Calloc
pop ecx
pop ecx
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 8], eax
jne 0x428693
xor eax, eax
jmp 0x42870b
cmp dword [0x4a98f8], ecx
mov eax, dword [0x4a98e8]
lea edi, [esi - 1]
mov dword [0x4a98f4], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
jbe 0x4286ea
mov ecx, dword [eax + ecx*4]
jmp 0x4286d7
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, 8
xor edx, ebx
mov ebx, dword [ebp - 8]
shr edx, 2
and edx, edi
lea edx, [ebx + edx*4]
mov ebx, dword [edx]
mov dword [ecx], ebx
mov dword [edx], ecx
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x4286b4
mov ecx, dword [ebp - 4]
inc ecx
cmp ecx, dword [0x4a98f8]
mov dword [ebp - 4], ecx
jb 0x4286af
mov eax, dword [ebp - 8]
push dword [ebp - 0x10]
mov dword [0x4a98e8], eax
mov eax, dword [ebp + 8]
mov dword [0x4a98f8], esi
mov dword [0x4a98ec], eax
call sym.AdobeCollabSync.exe_PR_Free
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4294b4
Capabilities:
Initialize winsock library

Disassembly:
mov ecx, dword [esp + 4]
cmp ecx, 0x20
jg 0x4294dc
je 0x4294d2
cmp ecx, 8
jg 0x4294ae
je case.0x429622.10055
mov eax, ecx
dec eax
dec eax
je 0x4294a4
dec eax
je 0x4294a4
dec eax
je 0x42949a
dec eax
je 0x429490
dec eax
jne case.0x429622.10025
mov eax, 0xffffe891
jmp 0x42955e
mov eax, 0xffffe8b2
jmp 0x42955e
mov eax, 0xffffe8ae
jmp 0x42955e
mov eax, 0xffffe8c2
jmp 0x42955e
mov eax, ecx
sub eax, 0xe
je case.0x429622.10055
sub eax, 4
je 0x4294c8
dec eax
je 0x429490
dec eax
dec eax
jmp 0x4295ae
mov eax, 0xffffe8cd
jmp 0x42955e
mov eax, 0xffffe8d0
jmp 0x42955e
mov eax, 0x2726
cmp ecx, eax
jg 0x42960c
je case.0x429622.10039
mov eax, 0x1e7
cmp ecx, eax
jg 0x42957d
je 0x4295ee
cmp ecx, 0x70
jg 0x429539
je 0x429532
mov eax, ecx
sub eax, 0x27
je 0x429532
sub eax, 0x19
je case.0x429622.10054
sub eax, 0x10
je 0x42956f
sub eax, 7
je case.0x429622.10039
sub eax, 0x15
jne 0x4294c1
mov eax, 0xffffe8ba
jmp 0x42955e
mov eax, 0xffffe8b7
jmp 0x42955e
mov eax, 0xffffe8bc
jmp 0x42955e
mov eax, ecx
sub eax, 0x7b
je case.0x429622.10039
sub eax, 9
je 0x4295b0
sub eax, 0x10
je 0x4295b0
sub eax, 0x23
je 0x42956f
sub eax, 0x17
je 0x429568
sub eax, 6
je 0x429524
mov eax, 0xffffe896
push ecx
push eax
call sym.AdobeCollabSync.exe_PR_SetError
pop ecx
pop ecx
ret
mov eax, 0xffffe8c1
jmp 0x42955e
mov eax, 0xffffe8c9
jmp 0x42955e
mov eax, 0xffffe89d
jmp 0x42955e
mov eax, 0x571
cmp ecx, eax
jg 0x4295be
je 0x4295b0
mov eax, ecx
sub eax, 0x3e3
je 0x4295b7
sub eax, 3
je 0x4295ee
sub eax, 3
je 0x4295ee
sub eax, 5
je 0x429486
sub eax, 0x79
je 0x4295b0
sub eax, 0x109
jne case.0x429622.10025
mov eax, 0xffffe899
jmp 0x42955e
mov eax, 0xffffe8d1
jmp 0x42955e
mov eax, ecx
sub eax, 0x6f8
je case.0x429622.10055
sub eax, 0x20
je 0x4295f8
sub eax, 0x249
je 0x4295b0
sub eax, 0x1db8
je 0x429486
sub eax, 4
je 0x429490
dec eax
jne case.0x429622.10025
mov eax, 0xffffe893
jmp 0x42955e
mov eax, 0xffffe890
jmp 0x42955e
mov eax, 0xffffe8aa
jmp 0x42955e
lea eax, [ecx - 0x2728]
cmp eax, 0x29
ja case.0x429622.10025
movzx eax, byte [eax + 0x429736]
jmp dword [eax*4 + 0x4296de]
mov eax, 0xffffe8a2
jmp 0x42955e
mov eax, 0xffffe89e
jmp 0x42955e
mov eax, 0xffffe89f
jmp 0x42955e
mov eax, 0xffffe8d3
jmp 0x42955e
mov eax, 0xffffe8d8
jmp 0x42955e
mov eax, 0xffffe8a3
jmp 0x42955e
mov eax, 0xffffe8d9
jmp 0x42955e
mov eax, 0xffffe8a0
jmp 0x42955e
mov eax, 0xffffe8ad
jmp 0x42955e
mov eax, 0xffffe8b6
jmp 0x42955e
mov eax, 0xffffe8d6
jmp 0x42955e
mov eax, 0xffffe8a4
jmp 0x42955e
mov eax, 0xffffe8a6
jmp 0x42955e
mov eax, 0xffffe8af
jmp 0x42955e
mov eax, 0xffffe8b3
jmp 0x42955e
mov eax, 0xffffe8b4
jmp 0x42955e
mov eax, 0xffffe8d7
jmp 0x42955e
mov eax, 0xffffe892
jmp 0x42955e
Function at 0x42ac28
Capabilities:
Get socket status

Disassembly:
push 0xffffffffffffffff
push 0x485149
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4a89e8]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 1
push 0
lea eax, [esp + 0x14]
push eax
mov edi, ecx
mov byte [esp + 0x18], 0x20
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::find_char_const___unsigned_int__unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov esi, eax
cmp esi, dword [ecx]
je 0x42ac12
push esi
push 0
lea edx, [esp + 0x18]
push edi
push edx
call fcn.0042aa40
add esp, 0x10
push 5
push str.basic
push esi
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0
call dword [sym.imp.MSVCP80.dll_public:_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::compare_unsigned_int__unsigned_int__char_const___unsigned_int_const]
test eax, eax
lea ecx, [esp + 0x10]
jne 0x42abb0
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 1
jmp 0x42ac27
push 6
push str.digest
push esi
push 0
call dword [sym.imp.MSVCP80.dll_public:_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::compare_unsigned_int__unsigned_int__char_const___unsigned_int_const]
test eax, eax
lea ecx, [esp + 0x10]
jne 0x42abdd
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 3
jmp 0x42ac27
push 4
push str.ntlm
push esi
push 0
call dword [sym.imp.MSVCP80.dll_public:_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::compare_unsigned_int__unsigned_int__char_const___unsigned_int_const]
test eax, eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
jne 0x42ac0a
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 2
jmp 0x42ac27
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
jmp 0x42ac25
push str.NTLM
push edi
call dword [sym.imp.MSVCP80.dll_bool___cdecl_std::operator_char__struct_std::char_traits_char___class_std::allocator_char___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
add esp, 8
test al, al
jne 0x42ac03
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0047ff5a
add esp, 0x30
ret
Function at 0x42ea40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x485a15
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CUriConnection.0
lea ecx, [esi + 0xfc]
mov dword [esp + 0x18], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esi + 0xe0]
mov byte [esp + 0x18], 3
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esi + 0xc0]
mov byte [esp + 0x18], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [esi + 0xbc]
test eax, eax
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x42ea32
push eax
call edi
mov dword [esi + 0xbc], 0
mov eax, dword [esi + 0xb8]
test eax, eax
je 0x42ea49
push eax
call edi
mov dword [esi + 0xb8], 0
lea ecx, [esi + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.004083c0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x435a90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x486839
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebp
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
lea ebp, [esi + 4]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x10], ebp
je 0x435a81
push eax
call sym.AdobeCollabSync.exe_PR_EnterMonitor
add esp, 4
mov dword [esp + 0x14], 1
cmp dword [esi + 0x10], edi
mov dword [esp + 0x64], edi
jne 0x435acc
push str.cannot_addRunnable_after_threadpool_stopped
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x68], 1
mov dword [esp + 0x40], vtable.PRException.0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
push 0x49aba0
lea ecx, [esp + 0x40]
push ecx
call sub.MSVCR80.dll__CxxThrowException
mov ecx, esi
call fcn.00435430
push 8
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, edi
je 0x435aec
mov edx, dword [esp + 0x6c]
mov dword [eax], edx
mov dword [eax + 4], esi
mov edi, eax
mov eax, dword [esi]
test eax, eax
mov dword [esp + 0x18], esi
je 0x435aff
push eax
call sym.AdobeCollabSync.exe_PR_EnterMonitor
add esp, 4
mov dword [esp + 0x1c], 1
push 0
push 0
push 1
push 1
push edi
push 0x434d30
push 0
mov byte [esp + 0x80], 2
call sym.AdobeCollabSync.exe_PR_CreateThread
mov edi, eax
add esp, 0x1c
lea eax, [esp + 0x6c]
push eax
lea ecx, [esi + 0x20]
call fcn.00435150
mov dword [eax], edi
mov esi, dword [esi]
test esi, esi
je 0x435b47
push esi
call sym.AdobeCollabSync.exe_PR_ExitMonitor
add esp, 4
mov eax, dword [ebp]
test eax, eax
je 0x435b57
push eax
call sym.AdobeCollabSync.exe_PR_ExitMonitor
add esp, 4
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x58
ret 4
Function at 0x43a5e0
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffffffffff
push 0x488069
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, dword [esp + 0x58]
cmp dword [esi + 4], 0
jne 0x43a597
push 1
mov ecx, esi
call fcn.00439290
mov eax, dword [esp + 0x54]
push esi
push 0
push 0
push 0
push 0
push str.Acrobat_Credential
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x43a5f1
push str.Unable_to_encrypt_data
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x50], 0
mov dword [esp + 0x28], vtable.PRException.0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
push 0x49aba0
lea edx, [esp + 0x28]
push edx
call sub.MSVCR80.dll__CxxThrowException
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x48
ret 8

Function at 0x43aab0
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x487239
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x38]
push 0x48d6f8
mov ecx, esi
call dword [0x48a28c]
lea ecx, [edi + 0x24]
call fcn.004367f0
push eax
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [edi + 0x44]
call fcn.004367f0
push eax
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov eax, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, dword [eax]
push ecx
push 0
lea edx, [esp + 0x14]
push esi
push edx
call fcn.00438c20
add esp, 0x10
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
call dword [0x48a250]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x43b7e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4874a0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esi + 4]
mov dword [esi], vtable.CResourceAnalyzer::CDependency.0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [edi + 0x20]
lea edx, [edi + 0x24]
mov dword [esi + 0x20], ecx
push edx
lea ecx, [esi + 0x24]
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea eax, [edi + 0x40]
push eax
lea ecx, [esi + 0x40]
mov byte [esp + 0x1c], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [edi + 0x5c]
push ecx
lea ecx, [esi + 0x5c]
mov byte [esp + 0x1c], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea edx, [edi + 0x78]
push edx
lea ecx, [esi + 0x78]
mov byte [esp + 0x1c], 3
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov eax, dword [edi + 0x94]
mov dword [esi + 0x94], eax
mov ecx, dword [edi + 0x98]
mov dword [esi + 0x98], ecx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4434c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48840a
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
cmp dword [ecx + 4], 0
lea ebx, [ecx + 4]
mov dword [esp + 0x14], ebx
jne 0x44341f
push 0
mov ecx, ebx
call fcn.00441620
jmp 0x443423
add dword [ebx + 4], 1
mov esi, dword [ebx]
mov dword [esp + 0x18], esi
push str.select_count_rid____0_from_resources_where_state___0
lea ecx, [esp + 0x20]
mov dword [esp + 0x64], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov byte [esp + 0x64], 1
call edx
lea ecx, [esp + 0x1c]
mov ebp, eax
mov byte [esp + 0x60], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp]
mov edx, dword [eax + 0x28]
mov ecx, ebp
call edx
mov edi, eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
test eax, eax
jne 0x4434b7
push str.expected_result_for_query_select_count_rid____0_from_resources_where_state___0
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x64], 2
mov dword [esp + 0x3c], vtable.PRException.0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
push 0x49aba0
lea ecx, [esp + 0x3c]
push ecx
call sub.MSVCR80.dll__CxxThrowException
mov edx, dword [edi]
mov eax, dword [edx + 8]
push 0
mov ecx, edi
call eax
mov edx, dword [edi]
mov esi, eax
mov eax, dword [edx]
neg esi
sbb esi, esi
push 1
mov ecx, edi
neg esi
call eax
mov edx, dword [ebp]
mov eax, dword [edx]
push 1
mov ecx, ebp
call eax
mov ecx, ebx
call fcn.00441280
mov eax, esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x453be1
Capabilities:
Delete file

Disassembly:
push ebp
push esi
mov esi, eax
mov eax, dword [esi + 0x28]
xor ebp, ebp
cmp eax, ebp
je 0x453be1
mov ecx, dword [esi + 0x2c]
sub ecx, eax
sar ecx, 6
inc ecx
push ecx
push eax
call fcn.004539f2
mov eax, dword [esi + 0x28]
pop ecx
sub eax, 0x40
pop ecx
mov dword [esi + 0x2c], eax
call fcn.00453b90
push dword [esi + 0x54]
push dword [esi + 0x58]
call fcn.004539f2
lea eax, [esi + 0x64]
push eax
call fcn.00464681
add esp, 0xc
cmp dword [esi + 0x78], ebp
je 0x453c2f
push edi
xor edi, edi
cmp dword [esi + 0x70], ebp
jle 0x453c25
push ebx
xor ebx, ebx
mov eax, dword [esi + 0x78]
lea eax, [eax + ebx + 0xc]
push eax
call fcn.00464681
inc edi
add ebx, 0x18
cmp edi, dword [esi + 0x70]
pop ecx
jl 0x453c0d
pop ebx
push dword [esi + 0x78]
call fcn.0044954f
pop ecx
pop edi
mov dword [esi + 0x78], ebp
mov dword [esi + 0x74], ebp
mov dword [esi + 0x70], ebp
add esi, 0x230
push dword [esi]
call fcn.0044954f
pop ecx
mov dword [esi], ebp
pop esi
pop ebp
ret

Function at 0x453c60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x224]
imul eax, eax, 5
push edi
push eax
push dword [esi + 0x34]
call fcn.004539f2
push dword [esi + 0x34]
call fcn.0044954f
mov eax, dword [esp + 0x1c]
mov edi, eax
imul edi, edi, 5
mov dword [esi + 0x224], eax
mov eax, edi
shl eax, 6
push 1
push eax
call fcn.00449c2b
add esp, 0x14
test eax, eax
mov dword [esi + 0x34], eax
je 0x453ca5
test edi, edi
jle 0x453ca5
add eax, 0x18
dec edi
mov word [eax], 1
add eax, 0x40
test edi, edi
jg 0x453c98
pop edi
pop esi
ret

Function at 0x453ca5
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x224]
imul eax, eax, 5
push edi
push eax
push dword [esi + 0x34]
call fcn.004539f2
push dword [esi + 0x34]
call fcn.0044954f
mov eax, dword [esp + 0x1c]
mov edi, eax
imul edi, edi, 5
mov dword [esi + 0x224], eax
mov eax, edi
shl eax, 6
push 1
push eax
call fcn.00449c2b
add esp, 0x14
test eax, eax
mov dword [esi + 0x34], eax
je 0x453ca5
test edi, edi
jle 0x453ca5
add eax, 0x18
dec edi
mov word [eax], 1
add eax, 0x40
test edi, edi
jg 0x453c98
pop edi
pop esi
ret