joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427270
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
mov esi, edx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 1
push esi
push edi
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call fcn.00501920
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [ebp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], esi
cmp eax, 0x40
jne 0x4272d2
call fcn.00501920
mov dword [edi], 0x2746
jmp 0x4272e4
cmp eax, 0x4d2
jne 0x4272e7
call fcn.00501920
mov dword [edi], 0x274d
mov dword [edi + 4], eax
test ebx, ebx
je 0x4272f5
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00501920
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427390
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
mov esi, edx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call fcn.00501920
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [ebp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], esi
cmp eax, 0x40
jne 0x4273ea
call fcn.00501920
mov dword [edi], 0x2746
jmp 0x4273fc
cmp eax, 0x4d2
jne 0x4273ff
call fcn.00501920
mov dword [edi], 0x274d
mov dword [edi + 4], eax
test ebx, ebx
je 0x42740d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00501920
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427580
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x4275ac
call fcn.00501920
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
or eax, esi
mov dword [ecx], 0x2719
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0xc]
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 4], eax
call fcn.00501920
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, dword [ebp + 0x10]
mov dword [ebx + 4], esi
mov esi, dword [ebp - 4]
mov dword [ebx], eax
test esi, esi
js 0x427607
call fcn.00501920
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx], 0
cmp dword [eax], 0
je 0x427604
or byte [edi], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and byte [edi], 0xfc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427610
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov ebx, edx
mov dword [ebp - 4], ecx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
test ebx, ebx
jne 0x42767c
test ecx, ecx
jne 0x42767c
test edi, edi
jne 0x42767c
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x42769d
mov eax, 0x10624dd3
imul dword [esi + 4]
imul eax, dword [esi], 0x3e8
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, eax
mov eax, 1
cmove ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00501920
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ecx], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x42769d
cmp dword [esi], 0
jne 0x42769d
mov eax, dword [esi + 4]
test eax, eax
jle 0x42769d
cmp eax, 0x3e8
jge 0x42769d
mov dword [esi + 4], 0x3e8
push esi
push edi
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call fcn.00501920
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [ebp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
js 0x4276d3
call fcn.00501920
mov dword [edi], 0
mov dword [edi + 4], eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4276e0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x647138]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x427721
call fcn.00501920
mov dword [edi + 4], eax
or eax, esi
mov dword [edi], 0x2719
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501f98
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call fcn.00501920
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
je 0x42777e
jle 0x42778c
call fcn.00501920
mov dword [edi + 4], eax
mov dword [edi], 0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501f98
mov esp, ebp
pop ebp
ret
Function at 0x427e60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x647138]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x1c], 0x400
lea eax, [esp + 0x24]
mov dword [esp + 0x18], esi
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0
call fcn.00501920
mov ecx, dword [esi]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
sub esp, 8
call fcn.00427270
add esp, 0xc
test eax, eax
setg bl
cmp eax, 0x400
jne 0x427f37
mov edi, dword [sym.imp.WS2_32.dll_WSARecv]
nop dword [eax]
mov esi, dword [esi]
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
push 1
lea eax, [esp + 0x34]
push eax
push esi
call edi
mov esi, eax
call fcn.00501920
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x427f1b
cmp eax, 0x4d2
jne 0x427f20
call fcn.00501920
test esi, esi
jne 0x427f37
call fcn.00501920
cmp dword [esp + 0x10], 0x400
mov esi, dword [esp + 0x1c]
je 0x427ed0
mov ecx, dword [esp + 0x42c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00501f98
mov esp, ebp
pop ebp
ret
Function at 0x427f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca93b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x647138]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov dword [edi], vtable.boost::asio::detail::select_reactor.0
mov eax, dword [eax + 8]
mov dword [edi + 0x14], eax
call fcn.00422d10
mov esi, eax
call fcn.00501920
mov dword [ebp - 0x18], eax
mov ecx, fcn.0040e670
xor eax, eax
mov dword [ebp - 0x1c], esi
test esi, esi
cmove ecx, eax
test ecx, ecx
je 0x427fdd
push str.mutex
lea eax, [ebp - 0x1c]
push eax
call fcn.00422af0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.004277f0
push 0x428150
push 0x42b1f0
push 4
push 0x1c
lea eax, [edi + 0x38]
mov byte [ebp - 4], 2
push eax
call fcn.005027c7
push 0x418080
push 0x426b70
push 3
push 0xc
lea eax, [edi + 0xa8]
mov byte [ebp - 4], 3
push eax
call fcn.005027c7
mov byte [ebp - 4], 4
mov dword [edi + 0xcc], 0
push 0xc
mov byte [edi + 0xd0], 0
mov dword [edi + 0xd4], 0
mov byte [edi + 0xd8], 0
call fcn.00501ce1
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
mov byte [ebp - 4], 5
push 0x14
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00501ce1
mov dword [ebp - 0x18], eax
mov ecx, esi
push eax
mov dword [eax], vtable.boost::asio::detail::win_thread::func_class_boost::asio::detail::binder1_void____cdecl___class_boost::asio::detail::select_reactor____class_boost::asio::detail::select_reactor___.0
mov dword [eax + 0xc], 0x428690
mov dword [eax + 0x10], edi
call fcn.00423030
mov dword [edi + 0xd4], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x428bc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x428bf3
mov ecx, dword [esi + 4]
push 0
push dword [ebp + 0x1c]
call fcn.00426af0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x428c15
mov ecx, dword [esi + 4]
push 0x2719
push dword [ebp + 0x1c]
call fcn.00426af0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x1c]
push edi
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x428c4f
mov eax, 0x2746
jmp 0x428c5c
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x428c7c
cmp eax, 0x3e5
je 0x428c7c
push dword [ebp + 0x18]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.00426af0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.00426a80
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x433a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x64a418], 0
je 0x433ad7
mov eax, dword [0x656138]
test eax, eax
je 0x433ab0
push eax
call dword [0x64a474]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.00430df0
mov eax, dword [0x656138]
test eax, eax
je 0x433ad2
push eax
call dword [0x64a47c]
mov esi, dword [ebp - 4]
jmp 0x433ae1
mov esi, dword [ebp - 4]
jmp 0x433ae4
push 0x14
call dword [0x64a444]
mov esi, eax
add esp, 4
test esi, esi
jne 0x433af2
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x64a41c], 0
mov ebx, dword [ebp + 8]
je 0x433b3c
mov eax, dword [0x64a51c]
test eax, eax
je 0x433b15
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x433b3c
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x433a50
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.0059ddfe
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x433b49
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x433b62
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43e4e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push esi
push edi
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x43e51e
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0
movq qword [eax], xmm0
jmp 0x43e5a2
movzx eax, word [ebx + 0x8c]
cdq
mov edi, eax
add edi, 0x28
mov ecx, edi
adc edx, 0
or ecx, edx
je 0x43e552
push edx
push edi
call fcn.00430ee0
mov esi, eax
add esp, 8
test esi, esi
je 0x43e554
push edi
push 0
push esi
call fcn.005889a0
add esp, 0xc
jmp 0x43e554
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test esi, esi
jne 0x43e592
push dword [ebp + 8]
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 0x98]
dec ecx
mov esi, dword [ebx + 0x3c]
push 0
cdq
push ecx
mov edi, dword [esi]
push edx
push eax
call fcn.00502070
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x28]
mov dword [esi + 0x1c], 0x10020
mov dword [esi + 8], eax
mov dword [esi + 0x14], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
pop edi
mov dword [esi + 0x18], ecx
inc dword [ebx + 0x78]
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46eca0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.00474030
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x46ecdb
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.00474030
add esp, 0x10
pop edi
pop ebx
pop ebp
ret

Function at 0x4741a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], ecx
push edi
mov dword [ebp - 8], ebx
xor edi, edi
cmp dword [ecx + 0x14], edi
jle 0x474231
mov esi, dword [ebp + 8]
mov eax, edi
xor eax, 1
mov ecx, edi
cmp edi, 2
cmovl ecx, eax
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x474284
mov bl, byte [esi]
mov edx, ecx
mov ecx, dword [ebp - 4]
add edx, edx
mov eax, esi
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x61b4e0]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x61b4e0]
sub esi, ecx
jne 0x474225
sub edx, eax
mov dword [ebp - 0xc], edx
test bl, bl
je 0x47427a
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x61b4e0]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x61b4e0]
sub esi, edx
mov edx, dword [ebp - 0xc]
je 0x474201
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
inc edi
cmp edi, dword [ecx + 0x14]
jl 0x4741b8
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x61b4e0]
sub eax, 0x73
jne 0x474271
mov esi, str.sqlite_master
sub esi, ebx
nop dword [eax]
test dl, dl
je 0x4742a8
movzx eax, byte [esi + ebx + 1]
inc ebx
movzx ecx, byte [eax + 0x61b4e0]
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x61b4e0]
sub eax, ecx
je 0x474250
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x474225
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add ecx, ecx
push 0
mov edx, ebx
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.00435ca0
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x474273
jmp 0x474228
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 0x10]
test edi, edi
jne 0x4742be
neg edx
sbb edx, edx
jmp 0x474306
test edx, edx
je 0x474271
movzx eax, byte [edx]
mov esi, edi
mov bl, byte [edi]
movzx ecx, byte [eax + 0x61b4e0]
movzx eax, bl
movzx eax, byte [eax + 0x61b4e0]
sub eax, ecx
jne 0x474301
sub edx, edi
test bl, bl
je 0x474301
movzx eax, byte [edx + esi + 1]
inc esi
movzx ecx, byte [eax + 0x61b4e0]
mov bl, byte [esi]
movzx eax, bl
movzx eax, byte [eax + 0x61b4e0]
sub eax, ecx
je 0x4742e0
mov ecx, dword [ebp - 4]
mov edx, eax
test edx, edx
jne 0x474271
mov ebx, str.sqlite_temp_master
mov dword [ebp - 8], ebx
jmp 0x4741b1
Function at 0x4744e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 8], ebx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [ebx + 0x14], edx
jle 0x47459e
push esi
mov eax, edi
mov ecx, edi
xor eax, 1
cmp edi, 2
cmovl ecx, eax
mov eax, dword [ebx + 0x10]
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x47457f
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x61b4e0]
movzx ecx, al
movzx ecx, byte [ecx + 0x61b4e0]
sub ecx, edx
jne 0x474563
sub ebx, esi
test al, al
je 0x474578
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x61b4e0]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x61b4e0]
sub ecx, edx
je 0x474542
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
inc edi
cmp edi, dword [ebx + 0x14]
jl 0x474501
pop esi
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x474563
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add ecx, 0x18
push 0
call fcn.00435ca0
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x47456f
jmp 0x474569
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
shl edx, 4
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov esi, dword [edx + eax]
mov eax, 1
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x34]
push eax
push 0x18
call fcn.00433790
mov ecx, dword [edi]
lea ebx, [ebp - 0x34]
add esp, 0x10
mov dword [ebp - 8], ecx
xor edi, edi
mov dword [ebp - 0xc], ebx
cmp dword [ecx + 0x14], edi
jle 0x477a3e
nop
mov eax, edi
mov ecx, edi
xor eax, 1
cmp edi, 2
cmovl ecx, eax
mov dword [ebp - 0x1c], ecx
test esi, esi
je 0x477aa5
mov bl, byte [esi]
mov edx, ecx
mov ecx, dword [ebp - 8]
add edx, edx
mov eax, esi
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x61b4e0]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x61b4e0]
sub esi, ecx
jne 0x477a2f
sub edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
test bl, bl
je 0x477a98
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x61b4e0]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x61b4e0]
sub esi, edx
mov edx, dword [ebp - 0x18]
je 0x477a07
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
inc edi
mov esi, dword [ebp - 4]
cmp edi, dword [ecx + 0x14]
jl 0x4779c0
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x61b4e0]
sub eax, 0x73
jne 0x477a7b
mov esi, str.sqlite_master
sub esi, ebx
test dl, dl
je 0x477ae9
movzx eax, byte [esi + ebx + 1]
inc ebx
movzx ecx, byte [eax + 0x61b4e0]
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x61b4e0]
sub eax, ecx
je 0x477a56
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 4]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 4
jle 0x477994
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x477a2f
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
add ecx, ecx
push 0
mov edx, ebx
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.00435ca0
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
je 0x477a32
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x34]
push dword [ebp + 8]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push edi
call fcn.00474030
add esp, 0x18
jmp 0x477a7e
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 0x10]
test esi, esi
jne 0x477aff
neg edx
sbb edx, edx
jmp 0x477b4d
test edx, edx
je 0x477a7b
movzx eax, byte [edx]
mov edi, esi
movzx ecx, byte [eax + 0x61b4e0]
mov bl, byte [edi]
movzx eax, bl
movzx eax, byte [eax + 0x61b4e0]
sub eax, ecx
jne 0x477b46
sub edx, edi
test bl, bl
je 0x477b46
movzx eax, byte [edx + esi + 1]
inc esi
movzx ecx, byte [eax + 0x61b4e0]
mov bl, byte [esi]
movzx eax, bl
movzx eax, byte [eax + 0x61b4e0]
sub eax, ecx
je 0x477b25
mov ecx, dword [ebp - 8]
mov edx, eax
mov esi, edi
test edx, edx
jne 0x477a7b
mov ebx, str.sqlite_temp_master
jmp 0x4779b0
Function at 0x4b8ee0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cb5c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040e5f0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push dword [ebp + 8]
call fcn.00412c10
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x34], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c0f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cc2af
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x647138]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
lea ecx, [edi + 0xc]
mov dword [edi], vtable.AbstractProvider.0
mov dword [edi + 8], eax
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
mov dword [ebp - 4], 1
jb 0x4c0fe1
mov eax, dword [ecx]
jmp 0x4c0fe3
mov eax, ecx
push 0xffffffffffffffff
push 0
push esi
mov byte [eax], 0
call fcn.0040ea60
mov dword [edi + 0x38], 0xf
lea edx, [esi + 0x18]
mov dword [edi + 0x34], 0
cmp dword [edi + 0x38], 0x10
mov byte [ebp - 4], 2
jb 0x4c1010
mov ecx, dword [edi + 0x24]
jmp 0x4c1013
lea ecx, [edi + 0x24]
push 0xffffffffffffffff
push 0
mov byte [ecx], 0
lea ecx, [edi + 0x24]
push edx
call fcn.0040ea60
mov eax, dword [esi + 0x34]
lea ecx, [edi + 0x40]
mov dword [edi + 0x3c], eax
lea eax, [esi + 0x38]
push eax
mov byte [ebp - 4], 3
call fcn.004c0db0
lea esi, [edi + 0x50]
mov dword [ebp - 0x10], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebp + 0x3c]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x4c1059
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x4c107b
lock inc dword [ebx + 4]
mov esi, dword [edi + 0x7c]
or ebx, 0xffffffff
test esi, esi
je 0x4c10a4
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4c10a4
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x4c10a4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x7c], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x78], eax
mov al, byte [ebp - 0x20]
sub esp, 0x28
mov ecx, esp
mov byte [ebp - 4], 7
mov dword [ecx], vtable.std::_Func_base_void__struct_Models::EventModel_const__.0
mov dword [ecx], vtable.._AV___Func_impl_V___Binder_U_Unforced_std__P8AbstractProvider__AEXUEventModel_Models___ZQAV3_ABU___Ph__00_2__std__V__allocator_H_2_XABUEventModel_Models___std__.0
mov dword [ecx + 4], method.Poco::Exception.virtual_4
mov byte [ecx + 8], al
lea eax, [edi + 0x24]
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x24], ecx
mov ecx, dword [edi + 0x78]
push eax
call fcn.004c7250
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4c1109
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4c1109
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x4c1109
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x3c]
test ecx, ecx
je 0x4c1121
mov esi, dword [ecx]
lea eax, [ebp + 0x18]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x38