joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457080
Capabilities:
Get socket status

Disassembly:
sub esp, 0x224
mov eax, dword [0x7e4788]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
mov ebx, dword [esp + 0x230]
push ebp
mov ebp, dword [esp + 0x238]
push esi
push edi
push ebp
push ebx
call fcn.004eb430
add esp, 8
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
test ebp, ebp
jg 0x4570d4
jl 0x4570c2
test ebx, ebx
jae 0x4570d4
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
jmp 0x4570fa
push 0
push 0x3e8
push ebp
push ebx
call fcn.0052a1f0
mov dword [esp + 0x14], eax
mov ecx, ebx
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x238]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x134], edi
push eax
lea eax, [esp + 0x134]
mov dword [esp + 0x134], 1
push eax
push 0
lea eax, [edi + 1]
mov dword [esp + 0x3c], edi
push eax
mov dword [esp + 0x3c], 1
call dword [sym.imp.WSOCK32.dll_select]
mov esi, eax
test esi, esi
js 0x457147
xor eax, eax
jmp 0x45714d
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov dword [esp + 0x14], eax
call fcn.004573a0
add esp, 4
test esi, esi
jle 0x4571be
lea eax, [esp + 0x28]
push eax
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4571be
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 4
push eax
lea eax, [esp + 0x14]
push eax
push 0x1007
push 0xffff
push edi
call dword [sym.imp.WSOCK32.dll_getsockopt]
test eax, eax
je 0x4571ac
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov dword [esp + 0x14], eax
call fcn.004573a0
add esp, 4
or eax, 0xffffffff
jmp 0x4571ed
mov eax, dword [esp + 0x10]
push eax
call fcn.004573a0
add esp, 4
or eax, 0xffffffff
jmp 0x4571ed
cmp esi, 0xffffffff
jne 0x4571cf
cmp dword [esp + 0x10], 0x2714
jne 0x457208
jmp 0x4571d3
test esi, esi
jne 0x457206
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
call fcn.004eb480
add esp, 0xc
or eax, edx
je 0x4571eb
call fcn.0047edc0
xor eax, eax
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00529c8c
add esp, 0x224
ret
jns 0x45720d
or eax, 0xffffffff
jmp 0x4571ed
test esi, esi
jle 0x4571eb
lea eax, [esp + 0x12c]
push eax
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4571eb
mov eax, 1
jmp 0x4571ed
Function at 0x457260
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push esi
call fcn.0044b580
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0xc]
test eax, eax
jl 0x4572ac
mov ecx, dword [esp + 0x1c]
jg 0x45727d
test ecx, ecx
jb 0x4572ac
push eax
push ecx
push ebp
call fcn.00456f30
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4572aa
call fcn.00473af0
mov dword [eax + 0x10], esi
or esi, 0xffffffff
mov dword [eax + 0xc], 2
call fcn.0044b580
mov eax, esi
pop esi
pop ebp
ret
js 0x457324
mov eax, dword [esp + 0x18]
push ebx
xor ebx, ebx
push edi
test eax, eax
je 0x4572e0
mov ecx, eax
and ecx, 1
mov edx, ecx
or edx, 2
and al, 2
cmove edx, ecx
mov ecx, dword [esp + 0x20]
mov ebx, edx
mov eax, ecx
or ebx, 4
and al, 4
cmove ebx, edx
test cl, 8
je 0x4572e0
or ebx, 8
nop
push ebx
push dword [esp + 0x20]
push dword [esp + 0x20]
push ebp
call dword [sym.imp.WSOCK32.dll_send]
mov esi, eax
test esi, esi
jle 0x4572fa
xor edi, edi
jmp 0x457302
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov edi, eax
push edi
call fcn.004573a0
add esp, 4
cmp esi, 0xffffffff
jne 0x457322
cmp edi, 0x2714
jne 0x457322
call fcn.0047edc0
test ax, ax
je 0x4572e0
pop edi
pop ebx
call fcn.0044b580
mov eax, esi
pop esi
pop ebp
ret

Function at 0x457350
Capabilities:
Set socket configuration

Disassembly:
xor eax, eax
cmp dword [esp + 8], eax
push esi
setne al
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push dword [esp + 0x18]
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov esi, eax
cmp esi, 0xffffffff
je 0x45738c
xor eax, eax
push eax
call fcn.004573a0
add esp, 4
mov eax, esi
pop esi
ret
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
call fcn.004573a0
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x457820
Capabilities:
Set socket configuration

Disassembly:
push esi
push 4
lea eax, [esp + 0x10]
push eax
push 0x1002
push 0xffff
push dword [esp + 0x18]
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov esi, eax
cmp esi, 0xffffffff
je 0x457852
xor eax, eax
push eax
call fcn.004573a0
add esp, 4
mov eax, esi
pop esi
ret
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
call fcn.004573a0
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x457870
Capabilities:
Set socket configuration

Disassembly:
push esi
push 4
lea eax, [esp + 0x10]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x18]
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov esi, eax
cmp esi, 0xffffffff
je 0x4578a2
xor eax, eax
push eax
call fcn.004573a0
add esp, 4
mov eax, esi
pop esi
ret
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
call fcn.004573a0
add esp, 4
mov eax, esi
pop esi
ret
Function at 0x457d90
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
lea eax, [ecx - 1]
cmp eax, 0xff
ja 0x457dc3
lea eax, [ecx + ecx*2]
shl eax, 4
test byte [eax + 0x7eba10], 2
lea esi, [eax + 0x7eb9f8]
jne 0x457dc5
mov dword [esi + 0x1c], 2
mov dword [esi + 0x20], 0
xor esi, esi
or edi, 0xffffffff
test esi, esi
je 0x457e86
call fcn.0044b580
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x457df4
jl 0x457de7
mov eax, dword [esp + 0x18]
test eax, eax
jae 0x457df8
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp dword [esi + 0x10], eax
jne 0x457e02
cmp dword [esi + 0x14], ecx
je 0x457e2c
push ecx
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push esi
call fcn.00457ef0
add esp, 0x14
test eax, eax
jne 0x457e2c
push 1
push esi
call fcn.00457e90
add esp, 8
call fcn.0044b580
mov eax, edi
pop edi
pop esi
ret
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
or edi, 0xffffffff
test eax, eax
cmovne edi, dword [esp + 0xc]
test edi, edi
jne 0x457e70
mov dword [esi + 0x20], edi
or edi, 0xffffffff
mov dword [esi + 0x1c], 3
call fcn.0044b580
mov eax, edi
pop edi
pop esi
ret
xor ecx, ecx
test eax, eax
sete cl
push ecx
push esi
call fcn.00457e90
add esp, 8
call fcn.0044b580
mov eax, edi
pop edi
pop esi
ret

Function at 0x458aa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x430
mov eax, dword [0x7e4788]
xor eax, esp
mov dword [esp + 0x42c], eax
mov eax, dword [esp + 0x440]
push ebx
mov ebx, dword [esp + 0x43c]
push ebp
mov ebp, dword [esp + 0x43c]
push esi
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x3e6
nop dword [eax]
mov byte [eax], 0
call fcn.0044b580
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x458afb
push ebx
call fcn.004495b0
add esp, 4
mov esi, eax
test ebp, ebp
je 0x458b14
cmp byte [ebp], 0
je 0x458b14
push ebp
call fcn.004495b0
mov edi, eax
add esp, 4
mov ecx, edi
jmp 0x458b3a
lea eax, [esp + 0x1c]
push eax
push 0x108
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x458bd4
xor eax, eax
lea ecx, [esp + 0x1c]
mov word [esp + 0x22a], ax
lea eax, [esp + 0x22c]
test esi, esi
push eax
push 0
mov eax, 0x70ef88
cmovne eax, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, eax
test ebx, ebx
je 0x458b75
push 0x107
push dword [esp + 0x14]
lea eax, [esp + 0x234]
push eax
call fcn.0046f560
add esp, 0xc
test esi, esi
je 0x458b82
push esi
call fcn.0047f840
add esp, 4
test edi, edi
je 0x458b8f
push edi
call fcn.0047f840
add esp, 4
push 0
push ebx
call fcn.004541f0
add esp, 8
call fcn.0044b580
test ebx, ebx
je 0x458be0
push 0x210
push dword [esp + 0x450]
push dword [esp + 0x18]
call fcn.004488f0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x458be3
sub dword [esp + 0x14], 1
je 0x458be0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
jmp 0x458ae0
push 0
push 0
call fcn.004541f0
add esp, 8
or eax, 0xffffffff
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00529c8c
add esp, 0x430
ret
Function at 0x458d60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x7e4788]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
lea eax, [esp + 4]
push edi
push eax
push 0x108
or edi, 0xffffffff
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x458df7
xor eax, eax
xor edi, edi
push 0x107
mov word [esp + 0x21a], ax
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0046f560
add esp, 0xc
cmp byte [esi], 0
je 0x458df7
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x458dc0
sub ecx, edx
cmp byte [esi + ecx - 1], 0x5c
je 0x458e00
mov eax, edi
cmp ecx, 0x107
jge 0x458e02
pop edi
mov word [esi + ecx], 0x5c
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00529c8c
add esp, 0x214
ret
mov word [esi], 0x5c2e
mov byte [esi + 2], 0
mov eax, edi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
xor ecx, esp
call fcn.00529c8c
add esp, 0x214
ret
Function at 0x459560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x214
mov eax, dword [0x7e4788]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push edi
xor edi, edi
test esi, esi
je 0x459695
call fcn.0044b580
cmp dword [0x7eea5c], edi
jne 0x4595d3
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4595b6
push str.GetFinalPathNameByHandleW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7eea5c], eax
jmp 0x4595bb
mov eax, dword [0x7eea5c]
test eax, eax
jne 0x4595d3
push 1
call fcn.004541d0
add esp, 4
call fcn.0044b580
jmp 0x45969f
push esi
call fcn.004495b0
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4595f5
test al, 0x10
je 0x4595f5
mov ecx, 1
jmp 0x4595f7
xor ecx, ecx
push 0
test ecx, ecx
mov edx, 0x2000010
mov eax, 0x80
cmovne eax, edx
push eax
push 3
push 0
push 1
push Ordinal_2
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
cmp eax, 0xffffffff
jne 0x45962e
push 0
call fcn.004541f0
add esp, 8
jmp 0x459681
push 0x108
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [0x7eea5c]
cmp eax, 0x108
jae 0x459677
test eax, eax
je 0x459669
add eax, eax
cmp eax, 0x210
jae 0x4596b8
xor ecx, ecx
mov word [esp + eax + 8], cx
lea eax, [esp + 8]
push eax
call fcn.0046f4f0
add esp, 4
mov edi, eax
push 0
push 1
call fcn.004541f0
add esp, 8
jmp 0x459681
push 9
call fcn.004541d0
add esp, 4
test esi, esi
je 0x45968e
push esi
call fcn.0047f840
add esp, 4
call fcn.0044b580
jmp 0x45969f
push 2
call fcn.004541d0
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00529c8c
add esp, 0x214
ret
call fcn.00529dbc
int3

Function at 0x4596c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
test esi, esi
je 0x459795
mov edi, dword [esp + 0x10]
test edi, edi
je 0x459795
call fcn.0044b580
cmp dword [0x7eea58], 0
jne 0x459729
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45970a
push str.CreateSymbolicLinkW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7eea58], eax
jmp 0x45970f
mov eax, dword [0x7eea58]
test eax, eax
jne 0x459729
push 1
call fcn.004541d0
add esp, 4
xor esi, esi
call fcn.0044b580
pop edi
mov eax, esi
pop esi
ret
push ebx
push edi
call fcn.004495b0
push esi
mov ebx, eax
call fcn.004495b0
add esp, 8
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x459754
test al, 0x10
je 0x459754
mov eax, 1
jmp 0x459756
xor eax, eax
push eax
push edi
push ebx
call dword [0x7eea58]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.004541f0
add esp, 8
test ebx, ebx
je 0x45977d
push ebx
call fcn.0047f840
add esp, 4
pop ebx
test edi, edi
je 0x45978b
push edi
call fcn.0047f840
add esp, 4
call fcn.0044b580
pop edi
mov eax, esi
pop esi
ret
push 2
call fcn.004541d0
add esp, 4
xor eax, eax
pop edi
pop esi
ret
Function at 0x4597b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov al, byte [0x7eea68]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
dec al
push esi
push edi
xor edi, edi
inc al
mov cl, byte [0x7eea69]
mov byte [0x7eea68], al
movzx esi, al
mov eax, edi
cdq
inc edi
idiv ebp
mov eax, dword [esp + 0x14]
mov bl, byte [esi + 0x7eea6a]
movzx eax, byte [edx + eax]
add al, bl
add cl, al
movzx eax, cl
mov byte [0x7eea69], cl
movzx eax, byte [eax + 0x7eea6a]
mov byte [esi + 0x7eea6a], al
movzx eax, byte [0x7eea69]
mov byte [eax + 0x7eea6a], bl
mov al, byte [0x7eea68]
cmp edi, 0x100
jl 0x4597c1
pop edi
pop esi
pop ebp
mov byte [0x7eea69], al
pop ebx
ret

Function at 0x459830
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0x24
mov eax, dword [0x7e4788]
xor eax, esp
mov dword [esp + 0x20], eax
cmp dword [0x7eea60], 0
jne 0x459871
xor eax, eax
nop dword [eax]
mov byte [eax + 0x7eea6a], al
inc eax
cmp eax, 0x100
jl 0x459850
mov word [0x7eea68], 0
mov dword [0x7eea60], 1
cmp dword [0x7eeb88], 0
push esi
jne 0x4598a2
push 0xf0000040
push 1
push 0
push 0
push 0x7eeb8c
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4598a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4598c3
lea eax, [esp + 4]
mov dword [0x7eeb88], 1
push eax
push 0x20
push dword [0x7eeb8c]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4598f0
call fcn.004ea370
push eax
call fcn.005365a9
add esp, 4
xor esi, esi
call fcn.00536588
and eax, 0x800000ff
jns 0x4598e6
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + esi + 4], al
inc esi
cmp esi, 0x20
jb 0x4598d3
lea eax, [esp + 4]
push 0x20
push eax
call fcn.004597b0
add esp, 8
mov esi, 0xc00
mov al, byte [0x7eea68]
inc al
movzx ecx, al
mov byte [0x7eea68], al
mov al, byte [0x7eea69]
mov dl, byte [ecx + 0x7eea6a]
add al, dl
mov byte [0x7eea69], al
movzx eax, al
movzx eax, byte [eax + 0x7eea6a]
mov byte [ecx + 0x7eea6a], al
movzx eax, byte [0x7eea69]
mov byte [eax + 0x7eea6a], dl
sub esi, 1
jne 0x459904
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
mov dword [0x7eea64], 0x186a00
call fcn.00529c8c
add esp, 0x24
ret
Function at 0x47f8c0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
mov eax, dword [0x7e4788]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
cmp eax, 0x3e9
jg 0x47f9da
je 0x47f9c3
cmp eax, 0x69
ja case.0x47f9e4.1006
movzx eax, byte [eax + 0x47fa88]
jmp dword [eax*4 + 0x47fa68]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0xc]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
or ecx, 0xffffffff
cmp dword [esp + 0xc], 0xffffffff
cmovb ecx, dword [esp + 0xc]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x1c]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 8]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
mov ecx, 1
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x14]
shr ecx, 0xa
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
mov ecx, dword [0x7ef1c8]
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
add eax, 0xfffffc16
cmp eax, 7
ja case.0x47f9e4.1006
jmp dword [eax*4 + 0x47faf4]
mov ecx, dword [0x7ef1cc]
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
mov ecx, dword [0x7eedf0]
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
mov eax, dword [0x7eedf0]
lea ecx, [eax + eax*2]
shl ecx, 3
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
mov ecx, dword [0x7eedc8]
sub ecx, dword [0x7eedd0]
sar ecx, 2
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret
xor ecx, ecx
mov eax, ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00529c8c
add esp, 0x24
ret

Function at 0x481720
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
cmp dword [0x7ef000], 0
jne 0x481796
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0x1c]
lea eax, [edx - 1]
test edx, eax
jne 0x48179f
mov ecx, dword [esp + 4]
lea eax, [ecx - 1]
test ecx, eax
jne 0x48179f
mov dword [0x7ef008], edx
mov dword [0x7ef004], ecx
mov dword [0x7ef00c], 0x40000
mov dword [0x7ef010], 0x200000
mov dword [0x7ef014], 5
mov dword [0x7ef1d4], 5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, 0x55555550
and eax, 0xfffffff8
or eax, 8
mov dword [0x7ef000], eax
mov eax, 1
add esp, 0x24
ret
call fcn.005365bb
int3
Function at 0x4d6660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 0xffffffffffffffff
push dword [esp + 0x18]
push ebx
call fcn.004de6c0
mov esi, eax
add esp, 0xc
mov ecx, dword [esi + 0x7c]
or byte [esi + 0x1b], 0x80
mov edi, dword [ecx + 0xc]
mov eax, dword [edi + 0x88]
test eax, eax
je 0x4d66c1
test byte [eax + 0x24], 8
jne 0x4d66c1
cmp dword [edi + 0x170], 0
jne 0x4d66c1
cmp dword [edi + 0x168], 0
jne 0x4d66c1
push eax
call fcn.004515e0
add esp, 4
mov dword [edi + 0x168], eax
test eax, eax
jne 0x4d66c1
mov dword [edi + 0x170], 1
mov dword [esi + 0xc], 0
mov eax, 0x38e38e39
mov dword [esi + 0x10], 0
mov dword [esi + 0x38], 1
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x14], 0xa0043
mov byte [esi + 0x1a], 0x20
movzx ecx, word [ebx + 0x2e]
sub ecx, 0xc
mov dword [esi + 0x44], 1
imul ecx
push 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push esi
mov word [esi + 0x78], ax
call fcn.004dcad0
add esp, 8
mov dword [ebx + 0x14], esi
pop edi
pop esi
pop ebx
ret
Function at 0x4d6760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push 0xffffffffffffffff
push dword [esp + 0x1c]
push ebp
call fcn.004de6c0
add esp, 0xc
mov esi, eax
cmp dword [esp + 0x10], 0
je 0x4d6783
or byte [esi + 0x1b], 0x80
mov bl, byte [esp + 0x24]
cmp bl, 0x43
jne 0x4d67d3
mov eax, dword [esi + 0x7c]
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [edi + 0x88]
test eax, eax
je 0x4d67d2
test byte [eax + 0x24], 8
jne 0x4d67d2
cmp dword [edi + 0x170], 0
jne 0x4d67d2
cmp dword [edi + 0x168], 0
jne 0x4d67d2
push eax
call fcn.004515e0
add esp, 4
mov dword [edi + 0x168], eax
test eax, eax
jne 0x4d67d2
mov dword [edi + 0x170], 1
pop edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4d67f7
push eax
call fcn.004e9710
mov dword [esi + 4], eax
push eax
mov eax, dword [esi + 0x7c]
push dword [eax + 0xc]
call fcn.004ac290
add esp, 0xc
mov word [esi + 0x18], ax
mov eax, dword [esp + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4d6812
push eax
call fcn.004e9710
add esp, 4
mov dword [esi + 8], eax
cmp dword [esp + 0x3c], 0
mov eax, dword [esp + 0x30]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x38], eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x20], eax
mov dword [esi + 0x3c], 0
je 0x4d6844
cmp bl, 0x43
jne 0x4d6844
mov eax, 1
jmp 0x4d6846
xor eax, eax
mov cx, word [esp + 0x28]
cmp bl, 0x43
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
movzx eax, bl
mov word [esi + 0x14], ax
setne al
dec al
mov word [esi + 0x16], cx
and al, 0x20
mov dword [esi + 0x34], 0
mov byte [esi + 0x1a], al
mov dword [esi + 0x30], 0
movzx eax, word [ebp + 0x2e]
sub eax, 0xc
movzx ecx, cx
add ecx, 8
cdq
idiv ecx
push dword [esp + 0x44]
mov word [esi + 0x78], ax
push esi
mov dword [esi + 0x44], 1
call fcn.004dcad0
add esp, 8
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4d6b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4d6ba9
push eax
call fcn.004de860
mov eax, dword [edi + 0x14]
add esp, 4
cmp dword [eax + 0x44], 0
je 0x4d6ba9
push eax
call fcn.004dda50
add esp, 4
mov esi, dword [edi + 0x18]
test esi, esi
je 0x4d6bd2
push esi
call fcn.004de860
add esp, 4
cmp dword [esi + 0x44], 0
je 0x4d6bc8
push esi
call fcn.004dda50
add esp, 4
mov esi, dword [esi + 0x80]
test esi, esi
jne 0x4d6bb0
cmp dword [edi + 0x20], 0
mov esi, dword [edi + 0x3c]
je 0x4d6bf1
push 0
push 0
push str.hb_cdxIndexFlushAvailPage_on_readonly_database.
push 0x238d
call fcn.0044a4a0
add esp, 0x10
cmp dword [edi + 0x1c], 0
je 0x4d6c13
cmp dword [edi + 0x40], 0
jne 0x4d6c13
push 0
push 0
push str.hb_cdxIndexFlushAvailPage_on_not_locked_index_file.
push 0x238e
call fcn.0044a4a0
add esp, 0x10
lea eax, [edi + 0x48]
push eax
push dword [edi + 8]
push dword [edi + 0xc]
call fcn.004b9c70
add esp, 0xc
test eax, eax
jne 0x4d6c3d
push eax
push eax
push str.hb_cdxIndexLockFlush:_flush_lock_failed.
push 0x2395
call fcn.0044a4a0
add esp, 0x10
mov ebp, dword [edi + 0x38]
test esi, esi
je 0x4d6ce3
cmp dword [esi + 4], 0
je 0x4d6ce3
movzx eax, word [edi + 0x2e]
push ebx
push eax
push 0
push eax
call fcn.0047f870
add esp, 4
push eax
call fcn.0052b3e0
add esp, 0xc
mov ebx, eax
nop
mov eax, dword [esi]
mov dword [ebx], eax
cmp dword [edi + 0x28], 0
je 0x4d6c80
movzx ecx, word [edi + 0x30]
jmp 0x4d6c82
xor ecx, ecx
mov eax, ebp
xor edx, edx
call fcn.0052a2a0
push edx
push eax
movzx eax, word [edi + 0x2e]
push eax
push ebx
push dword [edi + 8]
call fcn.00455870
movzx ecx, word [edi + 0x2e]
add esp, 0x14
cmp eax, ecx
je 0x4d6cbc
push 0
push 0
push str.Write_in_index_page_failed.
push 0x3f3
call fcn.0044a4a0
add esp, 0x10
mov dword [edi + 0x78], 1
mov ebp, dword [esi]
mov dword [esi + 4], 0
mov esi, dword [esi + 8]
test esi, esi
je 0x4d6cd9
cmp dword [esi + 4], 0
jne 0x4d6c70
push ebx
call fcn.0047f840
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret