joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484e90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x484ebe
nop dword [eax + eax]
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x6ded78]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x484ea0
pop esi
ret
Function at 0x494590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], edx
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
test edi, edi
je 0x4946ba
cmp byte [edi + 9], bl
je 0x4945c6
inc dword [edi + 0xc]
cmp byte [edi + 0xa], bl
jne 0x4945c6
call fcn.00490d90
mov esi, dword [edi + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x4946a7
cmp dword [ebp + 8], 0
je 0x494630
test byte [esi + 0x40], 1
jne 0x494630
mov al, byte [esi + 0x42]
cmp al, 1
je 0x4945f1
cmp al, 2
jne 0x49464d
mov byte [esi + 0x42], 1
jmp 0x4945f8
mov dword [esi + 0x3c], 0
mov ecx, esi
call fcn.00490fc0
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x494614
mov ecx, esi
call fcn.00490f60
mov byte [esi + 0x42], 3
and byte [esi + 0x40], 0xf1
test ebx, ebx
je 0x49464d
mov edi, dword [esp + 0x14]
mov edx, ebx
push 0
mov ecx, edi
call fcn.00494590
add esp, 4
jmp 0x4946a7
push dword [esi + 0x30]
call fcn.00480d40
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
xor ebx, ebx
cmp byte [esi + 0x44], bl
jl 0x494694
lea edi, [esi + 0x78]
mov ecx, dword [edi]
test ecx, ecx
je 0x494682
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
je 0x494674
call fcn.0048bf80
jmp 0x494679
call fcn.00488760
mov ecx, dword [esp + 0x1c]
call fcn.0048d1b0
mov dword [edi], 0
inc ebx
movsx eax, byte [esi + 0x44]
add edi, 4
cmp ebx, eax
jle 0x494657
mov esi, dword [esi + 8]
test esi, esi
jne 0x4945d4
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp byte [edi + 9], 0
je 0x4946ba
add dword [edi + 0xc], 0xffffffff
jne 0x4946ba
mov ecx, edi
call fcn.00490d50
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x495a99
cmp al, 3
jb 0x495a6f
call fcn.00491220
test eax, eax
jne 0x495b6c
cmp byte [esi + 0x42], 0
jne 0x495a81
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x495a99
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
jg 0x495b6a
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + eax*4 + 0x78]
inc word [esi + eax*2 + 0x50]
mov ax, word [esi + eax*2 + 0x50]
mov cl, byte [edx + 5]
cmp ax, word [edx + 0x12]
jb 0x495b62
test cl, cl
jne 0x495ae2
movzx ecx, byte [edx + 6]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
call fcn.00495160
test eax, eax
jne 0x495b6c
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.00495310
mov cl, byte [esi + 0x44]
test cl, cl
je 0x495b3e
nop dword [eax]
and byte [esi + 0x40], 0xf9
xor eax, eax
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x495b19
call fcn.0048bf80
jmp 0x495b1e
call fcn.00488760
mov ecx, edi
call fcn.0048d1b0
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edx, dword [esi + eax*4 + 0x78]
mov ax, word [esi + eax*2 + 0x50]
cmp ax, word [edx + 0x12]
jb 0x495b4e
test cl, cl
jne 0x495af0
mov dword [ebx], 1
xor eax, eax
mov byte [esi + 0x42], 0
pop edi
pop esi
pop ebx
ret
cmp byte [edx + 2], 0
je 0x495b6a
push ebx
push esi
call fcn.00495b70
add esp, 8
pop edi
pop esi
pop ebx
ret
test cl, cl
je 0x495ad8
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x495a51
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x495a99
cmp al, 3
jb 0x495a6f
call fcn.00491220
test eax, eax
jne 0x495b6c
cmp byte [esi + 0x42], 0
jne 0x495a81
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x495a99
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
jg 0x495b6a
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + eax*4 + 0x78]
inc word [esi + eax*2 + 0x50]
mov ax, word [esi + eax*2 + 0x50]
mov cl, byte [edx + 5]
cmp ax, word [edx + 0x12]
jb 0x495b62
test cl, cl
jne 0x495ae2
movzx ecx, byte [edx + 6]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
call fcn.00495160
test eax, eax
jne 0x495b6c
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.00495310
mov cl, byte [esi + 0x44]
test cl, cl
je 0x495b3e
nop dword [eax]
and byte [esi + 0x40], 0xf9
xor eax, eax
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x495b19
call fcn.0048bf80
jmp 0x495b1e
call fcn.00488760
mov ecx, edi
call fcn.0048d1b0
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edx, dword [esi + eax*4 + 0x78]
mov ax, word [esi + eax*2 + 0x50]
cmp ax, word [edx + 0x12]
jb 0x495b4e
test cl, cl
jne 0x495af0
mov dword [ebx], 1
xor eax, eax
mov byte [esi + 0x42], 0
pop edi
pop esi
pop ebx
ret
cmp byte [edx + 2], 0
je 0x495b6a
push ebx
push esi
call fcn.00495b70
add esp, 8
pop edi
pop esi
pop ebx
ret
test cl, cl
je 0x495ad8
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x495be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x495c21
cmp al, 3
jb 0x495bfb
call fcn.00491220
test eax, eax
jne 0x495c09
cmp byte [esi + 0x42], 0
jne 0x495c0d
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x495c21
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
js 0x495c07
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edi, dword [esi + eax*4 + 0x78]
movzx eax, word [esi + eax*2 + 0x50]
cmp byte [edi + 5], 0
jne 0x495c69
mov ecx, eax
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x14]
movzx edx, cx
mov ecx, esi
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
call fcn.00495160
test eax, eax
jne 0x495c09
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.004953b0
test ax, ax
jne 0x495cb7
nop
xor eax, eax
test cl, cl
je 0x495cee
and byte [esi + 0x40], 0xf9
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x495c9d
call fcn.0048bf80
jmp 0x495ca2
call fcn.00488760
mov ecx, edi
call fcn.0048d1b0
mov cl, byte [esi + 0x44]
movsx eax, cl
cmp word [esi + eax*2 + 0x50], 0
je 0x495c70
movsx eax, cl
mov ecx, 0xffff
add word [esi + eax*2 + 0x50], cx
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
cmp byte [eax + 2], 0
je 0x495c07
cmp byte [eax + 5], 0
jne 0x495c07
push ebx
push esi
call fcn.00495d00
add esp, 8
pop edi
pop esi
pop ebx
ret
pop edi
mov byte [esi + 0x42], 0
pop esi
mov dword [ebx], 1
pop ebx
ret
Function at 0x495be1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x495c21
cmp al, 3
jb 0x495bfb
call fcn.00491220
test eax, eax
jne 0x495c09
cmp byte [esi + 0x42], 0
jne 0x495c0d
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x495c21
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
js 0x495c07
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edi, dword [esi + eax*4 + 0x78]
movzx eax, word [esi + eax*2 + 0x50]
cmp byte [edi + 5], 0
jne 0x495c69
mov ecx, eax
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x14]
movzx edx, cx
mov ecx, esi
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
call fcn.00495160
test eax, eax
jne 0x495c09
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.004953b0
test ax, ax
jne 0x495cb7
nop
xor eax, eax
test cl, cl
je 0x495cee
and byte [esi + 0x40], 0xf9
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x495c9d
call fcn.0048bf80
jmp 0x495ca2
call fcn.00488760
mov ecx, edi
call fcn.0048d1b0
mov cl, byte [esi + 0x44]
movsx eax, cl
cmp word [esi + eax*2 + 0x50], 0
je 0x495c70
movsx eax, cl
mov ecx, 0xffff
add word [esi + eax*2 + 0x50], cx
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
cmp byte [eax + 2], 0
je 0x495c07
cmp byte [eax + 5], 0
jne 0x495c07
push ebx
push esi
call fcn.00495d00
add esp, 8
pop edi
pop esi
pop ebx
ret
pop edi
mov byte [esi + 0x42], 0
pop esi
mov dword [ebx], 1
pop ebx
ret
Function at 0x49a160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
mov eax, edx
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
push edi
movlpd qword [esp + 0x10], xmm0
cmp dword [esi + 0x34], 0
jne 0x49a195
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call fcn.004951d0
test eax, eax
jne 0x49a18d
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], eax
nop word [eax + eax]
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edi, dword [esi + eax*4 + 0x78]
mov bl, byte [edi + 5]
test bl, bl
jne 0x49a1c6
cmp byte [edi + 2], bl
jne 0x49a1d1
movzx eax, word [edi + 0x12]
cdq
add dword [esp + 0x10], eax
adc ebp, edx
test bl, bl
je 0x49a239
test cl, cl
je 0x49a289
and byte [esi + 0x40], 0xf9
xor eax, eax
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x49a206
call fcn.0048bf80
jmp 0x49a20b
call fcn.00488760
mov ecx, edi
call fcn.0048d1b0
mov cl, byte [esi + 0x44]
movsx edx, cl
mov eax, dword [esi + edx*4 + 0x78]
movzx edi, word [esi + edx*2 + 0x50]
cmp di, word [eax + 0x12]
jae 0x49a1d5
lea eax, [edi + 1]
mov word [esi + edx*2 + 0x50], ax
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edi, dword [esi + eax*4 + 0x78]
movsx eax, cl
movzx ecx, word [esi + eax*2 + 0x50]
movzx eax, word [edi + 0x12]
cmp ecx, eax
jne 0x49a256
movzx ecx, byte [edi + 6]
mov eax, dword [edi + 0x38]
mov edx, dword [ecx + eax + 8]
jmp 0x49a270
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x14]
movzx edx, cx
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
mov ecx, esi
call fcn.00495160
test eax, eax
je 0x49a1b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop edi
mov dword [ecx + 4], ebp
mov dword [ecx], eax
mov ecx, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
jmp fcn.004951d0
Function at 0x49a165
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
mov eax, edx
xorps xmm0, xmm0
mov dword [esp + 0x18], eax
push edi
movlpd qword [esp + 0x10], xmm0
cmp dword [esi + 0x34], 0
jne 0x49a195
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call fcn.004951d0
test eax, eax
jne 0x49a18d
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], eax
nop word [eax + eax]
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edi, dword [esi + eax*4 + 0x78]
mov bl, byte [edi + 5]
test bl, bl
jne 0x49a1c6
cmp byte [edi + 2], bl
jne 0x49a1d1
movzx eax, word [edi + 0x12]
cdq
add dword [esp + 0x10], eax
adc ebp, edx
test bl, bl
je 0x49a239
test cl, cl
je 0x49a289
and byte [esi + 0x40], 0xf9
xor eax, eax
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x49a206
call fcn.0048bf80
jmp 0x49a20b
call fcn.00488760
mov ecx, edi
call fcn.0048d1b0
mov cl, byte [esi + 0x44]
movsx edx, cl
mov eax, dword [esi + edx*4 + 0x78]
movzx edi, word [esi + edx*2 + 0x50]
cmp di, word [eax + 0x12]
jae 0x49a1d5
lea eax, [edi + 1]
mov word [esi + edx*2 + 0x50], ax
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edi, dword [esi + eax*4 + 0x78]
movsx eax, cl
movzx ecx, word [esi + eax*2 + 0x50]
movzx eax, word [edi + 0x12]
cmp ecx, eax
jne 0x49a256
movzx ecx, byte [edi + 6]
mov eax, dword [edi + 0x38]
mov edx, dword [ecx + eax + 8]
jmp 0x49a270
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x14]
movzx edx, cx
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
mov ecx, esi
call fcn.00495160
test eax, eax
je 0x49a1b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop edi
mov dword [ecx + 4], ebp
mov dword [ecx], eax
mov ecx, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
jmp fcn.004951d0
Function at 0x49ceb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov ebx, ecx
push esi
push edi
movsx eax, byte [ebx + 0x44]
mov edi, dword [ebx + 0x18]
mov eax, dword [ebx + eax*4 + 0x78]
mov esi, dword [eax + 0x3c]
movzx eax, word [ebx + 0x20]
sub esi, edi
cmp eax, esi
cmovae eax, esi
mov esi, dword [esp + 0x14]
lea ecx, [edx + esi]
cmp ecx, eax
ja 0x49cef7
lea ecx, [edi + edx]
xor eax, eax
mov edx, dword [esp + 0x1c]
mov dword [edx + 0x10], ecx
mov ecx, 0x1010
mov word [edx + 8], cx
mov dword [edx + 0xc], esi
pop edi
pop esi
pop ebx
pop ecx
ret
push dword [esp + 0x1c]
mov ecx, ebx
push dword [esp + 0x1c]
push esi
call fcn.0049cdd0
add esp, 0xc
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4a18c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
mov ebx, edx
mov esi, ecx
push edi
mov ecx, ebx
call fcn.00494b50
mov edi, dword [ebx + 0x18]
xor eax, eax
mov word [esp + 0x20], ax
xor ebp, ebp
movsx eax, byte [ebx + 0x44]
mov dword [esp + 0x38], esi
mov esi, dword [ebx + 0x10]
mov dword [esp + 0x30], ebp
mov eax, dword [ebx + eax*4 + 0x78]
mov ecx, dword [eax + 0x3c]
movzx eax, word [ebx + 0x20]
sub ecx, edi
cmp eax, ecx
cmovae eax, ecx
cmp esi, eax
ja 0x4a1917
mov eax, 0x1010
mov dword [esp + 0x28], edi
mov word [esp + 0x20], ax
mov dword [esp + 0x24], esi
jmp 0x4a193f
lea eax, [esp + 0x18]
xor edx, edx
push eax
push 1
push esi
mov ecx, ebx
call fcn.0049cdd0
add esp, 0xc
test eax, eax
jne 0x4a1a05
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov al, byte [edi]
cmp al, 0x80
jae 0x4a194a
movzx ebx, al
jmp 0x4a1959
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.00484940
mov ebx, dword [esp + 0x14]
cmp ebx, 3
jb 0x4a19d0
cmp ebx, esi
jg 0x4a19d0
lea ecx, [edi - 1]
add ecx, ebx
mov al, byte [ecx]
cmp al, 0x80
jae 0x4a1972
movzx edx, al
jmp 0x4a197f
lea edx, [esp + 0x14]
call fcn.00484940
mov edx, dword [esp + 0x14]
lea eax, [edx - 1]
cmp eax, 8
ja 0x4a19d0
cmp edx, 7
je 0x4a19d0
movzx ecx, byte [edx + 0x6de744]
lea eax, [ecx + ebx]
cmp esi, eax
jb 0x4a19d0
sub esi, ecx
lea eax, [esp + 0x40]
push eax
lea ecx, [edi + esi]
call fcn.004a0760
mov ecx, dword [esp + 0x70]
add esp, 4
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, dword [esp + 0x44]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x18]
call fcn.0049c4b0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
test dword [esp + 0x20], 0x2460
jne 0x4a19de
test ebp, ebp
je 0x4a19e7
lea ecx, [esp + 0x18]
call fcn.0049c410
push 0x6f29f0
push 0x11498
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.00482f10
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x4a1a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, edx
push ebp
push esi
mov ebp, ecx
mov esi, dword [ebx]
mov ecx, esi
push edi
call fcn.00494b50
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
test eax, eax
jl 0x4a1af2
jg 0x4a1af2
test edi, edi
je 0x4a1af2
test eax, eax
jg 0x4a1af2
jl 0x4a1a56
cmp edi, 0x7fffffff
ja 0x4a1af2
mov esi, dword [ebx]
xor eax, eax
mov word [esp + 0x18], ax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], ebp
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x3c]
movzx eax, word [esi + 0x20]
sub ecx, edx
cmp eax, ecx
cmovae eax, ecx
cmp edi, eax
ja 0x4a1a98
mov eax, 0x1010
mov dword [esp + 0x20], edx
mov word [esp + 0x18], ax
mov dword [esp + 0x1c], edi
jmp 0x4a1ab8
lea eax, [esp + 0x10]
xor edx, edx
push eax
push 1
push edi
mov ecx, esi
call fcn.0049cdd0
add esp, 0xc
test eax, eax
jne 0x4a1b1a
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push 0
push dword [esp + 0x44]
mov ecx, edi
call fcn.004a0e30
mov ecx, dword [esp + 0x4c]
add esp, 8
test dword [esp + 0x18], 0x2460
mov dword [ecx], eax
jne 0x4a1adf
cmp dword [esp + 0x28], 0
je 0x4a1ae8
lea ecx, [esp + 0x10]
call fcn.0049c410
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x44]
push 0x6f29f0
push 0x114b8
push str.database_corruption_at_line__d_of___.10s_
push 0xb
mov dword [eax], 0
call fcn.00482f10
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x4ab520
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ebp, edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.00480960
mov esi, eax
add esp, 8
test esi, esi
jne 0x4ab548
lea eax, [esi + 7]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [0x727254], 0
mov edi, dword [esp + 0x14]
je 0x4ab590
mov eax, dword [0x727358]
test eax, eax
je 0x4ab56c
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x4ab590
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x483170
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.00657dae
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4ab59d
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x4ab5b5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebp
pop ebx
ret
Function at 0x4f5570
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6901d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x725fec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x733f94
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x733f94
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x6e1417
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004f4760
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f5650
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x4f568c
cmp byte [esi + 0x2c], bl
jne 0x4f5771
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f5680
jmp 0x4f5757
mov edi, dword [esi + 0x18]
test edi, edi
je 0x4f56a2
mov ecx, edi
mov edi, dword [edi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x4f5693
push 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.0064be60
push ebx
call fcn.006587c6
push 0
push 0
push ebx
mov ebp, eax
call fcn.0064be60
add esp, 0x1c
test ebp, ebp
jg 0x4f570a
cmp byte [esi + 0x2c], 0
jne 0x4f5771
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f5701
jmp 0x4f5757
lea eax, [ebp + 1]
push eax
call fcn.004fb4e3
push ebx
mov edi, eax
push 1
push ebp
push edi
mov byte [edi], 0
call fcn.0064c332
add esp, 0x14
cmp eax, 1
je 0x4f577a
push edi
call fcn.00480420
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x4f5771
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f5750
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.004f4760
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
mov byte [edi + ebp], 0
mov eax, edi
mov cl, byte [edi]
mov edx, edi
test cl, cl
je 0x4f57a9
mov ebp, eax
lea ebx, [edx + 1]
inc eax
cmp cl, 0xd
jne 0x4f579f
mov byte [edx], 0xa
cmp byte [eax], 0xa
cmovne eax, ebp
inc eax
jmp 0x4f57a1
mov byte [edx], cl
mov cl, byte [eax]
mov edx, ebx
test cl, cl
jne 0x4f5788
push 0
mov byte [edx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push edi
call dword [eax + 8]
push edi
call fcn.00480420
add esp, 4
cmp byte [esi + 0x2c], 0
sete al
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4f81b0
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebx
push ebp
push edi
mov ebp, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov edi, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebp
call dword [sym.imp.USER32.dll_BringWindowToTop]
push ebp
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebp
pop ebx
pop ecx
ret