joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4fc0
Capabilities:
Reference sql statements

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x1030
xor edi, edi
call fcn.004bbb10
mov esi, eax
add esp, 4
test esi, esi
je 0x4a4feb
push 0x1030
push edi
push esi
call fcn.00585e50
add esp, 0xc
jmp 0x4a4ff0
mov edi, 7
test edi, edi
jne 0x4a50ec
mov eax, dword [esp + 0x18]
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
push eax
push str.:memory:
mov dword [esi], 0x64
call fcn.0052ac40
add esp, 8
test eax, eax
jne 0x4a50ec
lea ebp, [esi + 8]
push ebp
push str.:memory:
call fcn.0052ac40
add esp, 8
test eax, eax
jne 0x4a50ec
mov ecx, dword [ebp]
push eax
push 1
push 0x3f0
push ecx
call fcn.004c3320
mov edx, dword [esp + 0x2c]
mov eax, dword [esi + 4]
push str.SELECT_sql_FROM_sqlite_master_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_CREATE_VIRTUAL___
push edx
push eax
lea ebx, [esp + 0x2c]
call fcn.0049caa0
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x4a50aa
jmp 0x4a5070
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005277b0
add esp, 4
cmp eax, 0x64
jne 0x4a50aa
mov edx, dword [esp + 0x10]
push 0
push edx
call fcn.004cfe50
mov ecx, dword [esp + 0x24]
mov edx, dword [ebp]
push ecx
push 0
push 0
push eax
push edx
call fcn.00527b30
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x4a5070
mov eax, dword [esp + 0x10]
push eax
call fcn.005125e0
add esp, 4
test edi, edi
jne 0x4a50ec
test eax, eax
jne 0x4a50ec
mov ecx, dword [esp + 0x1c]
push ecx
mov ebx, esi
call fcn.0049dfa0
add esp, 4
test eax, eax
jne 0x4a50ec
mov edx, dword [esi + 0xc]
push esi
push 0x49dbf0
push edx
call fcn.004b6d10
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
push esi
call fcn.0049eda0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4b0fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [eax + 0x1c], 0x20
je 0x4b101b
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
push ebx
push esi
mov dword [eax + 0x10], edx
mov esi, dword [ecx + 0x3c]
push edi
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov ebx, dword [eax + 0x18]
mov eax, dword [ecx + 0x98]
mov edi, dword [esi]
push edx
cdq
push edx
push eax
push 0
dec ebx
push ebx
call fcn.00588bf0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
ret
jmp fcn.004af220

Function at 0x4bc060
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
mov dword [ebp], 0
cmp dword [0x633cb0], 0
push esi
je 0x4bc0c2
mov eax, dword [0x641778]
test eax, eax
je 0x4bc08e
push eax
call dword [0x633d0c]
add esp, 4
lea eax, [esp + 0x10]
push eax
mov eax, 0x14
call fcn.004bb9d0
mov eax, dword [0x641778]
add esp, 4
test eax, eax
je 0x4bc0b3
push eax
call dword [0x633d14]
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x4bc0d1
lea eax, [esi + 7]
pop esi
pop ebp
pop ebx
ret
push 0x14
call dword [0x633cdc]
add esp, 4
mov esi, eax
jmp 0x4bc0b7
cmp dword [0x633cb4], 0
je 0x4bc115
mov eax, dword [0x633db4]
test eax, eax
je 0x4bc0f1
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x4bc115
lea ecx, [esi + 4]
push ecx
push 0
push esi
push 0x4acd10
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call fcn.0058453d
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4bc125
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x4bc13d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4bdd90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x88]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ecx, ecx
push esi
cmp eax, ecx
je 0x4bddbf
mov dword [ebp], eax
mov edx, dword [eax + 0x10]
mov dword [edi + 0x88], edx
mov edx, dword [eax + 8]
mov dword [eax + 0x10], ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
jmp 0x4bde3f
movzx ebx, word [edi + 0x8c]
xor eax, eax
push eax
add ebx, 0x28
push ebx
call fcn.004bba90
mov esi, eax
add esp, 8
test esi, esi
je 0x4bdde7
push ebx
push 0
push esi
call fcn.00585e50
add esp, 0xc
mov eax, esi
mov dword [ebp], esi
test esi, esi
jne 0x4bde24
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [edi + 0x3c]
mov ebx, dword [esi]
push eax
mov eax, dword [edi + 0x98]
push 0
cdq
dec ecx
push ecx
push edx
push eax
call fcn.00588bf0
push edx
mov edx, dword [ebx + 0x48]
push eax
push esi
call edx
add esp, 0x10
pop esi
pop ebp
mov eax, 7
pop ebx
ret
lea ecx, [esi + 0x28]
mov dword [esi + 8], ecx
mov edx, 0x20
mov ecx, 1
mov word [esi + 0x1c], dx
mov word [esi + 0x1e], cx
mov dword [esi + 0x14], edi
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
pop esi
mov dword [eax + 0x18], edx
mov dword [eax + 4], ecx
inc dword [edi + 0x78]
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x4bf490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov al, byte [ebx + 0x44]
test al, al
jl 0x4bf579
push ebp
push esi
push edi
xor edi, edi
test al, al
jle 0x4bf519
lea ebp, [ebx + 0x78]
lea ecx, [ecx]
mov eax, dword [ebp]
mov eax, dword [eax + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4bf508
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov esi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [esi]
dec eax
push edx
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x1c]
push 0
push eax
call fcn.00588bf0
push edx
push eax
mov eax, dword [ebx + 0x48]
push esi
call eax
mov ebx, dword [esp + 0x28]
add esp, 0x10
jmp 0x4bf50d
call fcn.004af220
movsx ecx, byte [ebx + 0x44]
inc edi
add ebp, 4
cmp edi, ecx
jl 0x4bf4b0
mov edx, dword [ebx + 0x74]
mov eax, dword [edx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4bf56d
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov esi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0x18]
mov eax, dword [ecx + 0x98]
mov edi, dword [esi]
push edx
cdq
push edx
push eax
push 0
dec ebp
push ebp
call fcn.00588bf0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
pop edi
pop esi
pop ebp
mov byte [ebx + 0x44], 0xff
pop ebx
pop ecx
ret
call fcn.004af220
pop edi
pop esi
mov byte [ebx + 0x44], 0xff
pop ebp
pop ebx
pop ecx
ret
Function at 0x4c1d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
lea ecx, [ecx]
xor edi, edi
cmp dword [ebp + 0x14], edi
mov dword [esp + 0x10], edi
jle 0x4c1e04
jmp 0x4c1d90
cmp edi, 2
mov esi, edi
jge 0x4c1d9a
xor esi, 1
test ebx, ebx
je 0x4c1e56
mov edx, dword [ebp + 0x10]
mov eax, esi
shl eax, 4
mov edi, dword [eax + edx]
mov dl, byte [ebx]
movzx ebp, byte [edi]
movzx ebp, byte [ebp + 0x5eb370]
movzx eax, dl
movzx eax, byte [eax + 0x5eb370]
sub eax, ebp
mov ecx, ebx
jne 0x4c1df2
sub edi, ebx
jmp 0x4c1dd0
test dl, dl
je 0x4c1e4a
movzx eax, byte [edi + ecx + 1]
movzx ebp, byte [eax + 0x5eb370]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x5eb370]
sub eax, ebp
je 0x4c1dd0
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
inc edi
cmp edi, dword [ebp + 0x14]
mov dword [esp + 0x10], edi
jl 0x4c1d90
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx]
movzx edx, al
movzx edx, byte [edx + 0x5eb370]
sub edx, 0x73
jne 0x4c1e42
mov edx, str.sqlite_master
sub edx, ecx
test al, al
je 0x4c1e7e
mov al, byte [ecx + 1]
movzx esi, byte [edx + ecx + 1]
movzx esi, byte [esi + 0x5eb370]
inc ecx
movzx edi, al
movzx edi, byte [edi + 0x5eb370]
sub edi, esi
je 0x4c1e20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test eax, eax
jne 0x4c1df2
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x1c]
shl esi, 4
mov eax, dword [esi + ecx + 0xc]
push 0
add eax, 8
push edx
call fcn.004ae050
mov eax, dword [eax + 8]
add esp, 8
test eax, eax
jne 0x4c1e44
jmp 0x4c1dfa
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
test ebx, ebx
jne 0x4c1e8e
neg eax
sbb eax, eax
jmp 0x4c1e99
test eax, eax
je 0x4c1e42
mov ecx, ebx
call fcn.004acfb0
test eax, eax
jne 0x4c1e42
mov dword [esp + 0x1c], str.sqlite_temp_master
jmp 0x4c1d80
Function at 0x4c43f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [ebx + 0x14]
mov eax, dword [esi + 0x94]
xor edx, edx
div dword [esi + 0x98]
or byte [esi + 0x14], 4
mov edx, dword [ebx + 0x18]
lea ecx, [edx - 1]
push edi
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
lea ebp, [eax - 1]
not ebp
and ebp, ecx
mov ecx, dword [esi + 0x18]
inc ebp
cmp edx, ecx
jbe 0x4c4436
mov ebx, edx
sub ebx, ebp
inc ebx
jmp 0x4c4447
lea edx, [eax + ebp - 1]
cmp edx, ecx
jbe 0x4c4445
sub ecx, ebp
inc ecx
mov ebx, ecx
jmp 0x4c4447
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0x1c], edi
jle 0x4c45f7
mov edi, ebp
cmp dword [esp + 0x10], 0
jne 0x4c45f7
mov eax, dword [esp + 0x24]
cmp edi, dword [eax + 0x18]
je 0x4c44c8
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x4c44c8
mov eax, edi
call fcn.004aedc0
test eax, eax
je 0x4c44c8
mov eax, dword [esi + 0xd4]
mov ecx, dword [eax + 0x2c]
push 0
push edi
push ecx
call dword [0x633d3c]
add esp, 0xc
test eax, eax
je 0x4c44be
mov ecx, dword [eax + 4]
cmp dword [ecx], 0
mov edx, dword [esi + 0xd4]
jne 0x4c44b0
push eax
push edi
push edx
call fcn.004af180
add esp, 0xc
jmp 0x4c44be
mov eax, 1
add dword [edx + 0xc], eax
add word [ecx + 0x1e], ax
mov eax, ecx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4c4519
jmp 0x4c4506
mov eax, dword [0x633dc8]
cdq
idiv dword [esi + 0x98]
inc eax
cmp edi, eax
je 0x4c4519
mov eax, dword [esi + 0xcc]
push 0
lea edx, [esp + 0x18]
push edx
push edi
push esi
call eax
add esp, 0x10
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4c4519
mov eax, dword [esp + 0x14]
call fcn.004c4330
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
test byte [eax + 0x1c], 8
je 0x4c4514
mov dword [esp + 0x18], 1
call fcn.004b0fd0
mov eax, dword [esp + 0x1c]
inc eax
inc edi
cmp eax, ebx
mov dword [esp + 0x1c], eax
jl 0x4c4455
cmp dword [esp + 0x10], 0
jne 0x4c45f7
cmp dword [esp + 0x18], 0
je 0x4c45f7
mov dword [esp + 0x24], ebx
mov eax, dword [esi + 0xd4]
mov ecx, dword [eax + 0x2c]
push 0
push ebp
push ecx
call dword [0x633d3c]
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x4c45eb
mov eax, dword [ecx + 4]
cmp dword [eax], 0
mov edx, dword [esi + 0xd4]
jne 0x4c4580
push ecx
push ebp
push edx
call fcn.004af180
add esp, 0xc
jmp 0x4c458c
mov ecx, 1
add dword [edx + 0xc], ecx
add word [eax + 0x1e], cx
test eax, eax
je 0x4c45eb
or word [eax + 0x1c], 8
movzx ecx, word [eax + 0x1c]
test cl, 0x20
je 0x4c45e6
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [edi]
dec eax
push edx
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x28]
push 0
push eax
call fcn.00588bf0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x4c45eb
call fcn.004af220
inc ebp
sub dword [esp + 0x24], 1
jne 0x4c4545
and byte [esi + 0x14], 0xfb
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4e6a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov al, byte [esi + 0x44]
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0xc], ebp
test al, al
jl 0x4e6aa3
je 0x4e6b13
mov eax, dword [esi + 0x74]
mov eax, dword [eax + 0x48]
push ebx
call fcn.004b0fd0
or ebx, 0xffffffff
add byte [esi + 0x44], bl
je 0x4e6a97
movsx ecx, byte [esi + 0x44]
mov edx, dword [esi + ecx*4 + 0x78]
mov eax, dword [edx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4e6a8d
mov ecx, dword [eax + 0x14]
add dword [ecx + 0x78], ebx
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebp, dword [edi]
dec eax
push edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.00588bf0
push edx
push eax
mov eax, dword [ebp + 0x48]
push edi
call eax
mov ebp, dword [esp + 0x20]
add esp, 0x10
jmp 0x4e6a92
call fcn.004af220
add byte [esi + 0x44], bl
jne 0x4e6a30
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x74], ecx
pop ebx
jmp 0x4e6b2f
cmp dword [esi + 0x40], ebp
jne 0x4e6ab6
pop edi
mov byte [esi], 1
mov eax, 0x10
pop ebp
add esp, 8
ret
mov al, byte [esi]
cmp al, 3
jb 0x4e6adb
cmp al, 4
jne 0x4e6ac9
mov eax, dword [esi + 4]
pop edi
pop ebp
add esp, 8
ret
mov edx, dword [esi + 0x10]
push edx
call fcn.004ac9a0
add esp, 4
mov dword [esi + 0x10], ebp
mov byte [esi], 1
movzx eax, byte [esi + 2]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 4]
push eax
mov eax, dword [esi + 0x40]
push 0
lea edi, [esi + 0x74]
push edi
push edx
call fcn.004e5dd0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4e6b07
pop edi
mov byte [esi], 1
pop ebp
add esp, 8
ret
mov eax, dword [edi]
mov byte [esi + 0x44], 0
mov cl, byte [eax + 2]
mov byte [esi + 0x45], cl
mov eax, dword [esi + 0x74]
cmp byte [eax], 0
je 0x4e6ba0
movzx eax, byte [eax + 2]
xor edx, edx
cmp dword [esi + 0x70], edx
sete dl
cmp edx, eax
jne 0x4e6ba0
mov eax, dword [esi + 0x74]
and byte [esi + 1], 0xf1
xor ecx, ecx
xor edx, edx
mov word [esi + 0x46], cx
mov word [esi + 0x32], dx
cmp word [eax + 0x16], dx
jbe 0x4e6b52
pop edi
mov eax, ebp
mov byte [esi], dl
pop ebp
add esp, 8
ret
cmp byte [eax + 8], 0
jne 0x4e6b90
cmp dword [eax + 4], 1
je 0x4e6b6d
pop edi
mov eax, 0x108b8
pop ebp
add esp, 8
jmp fcn.004e1760
movzx ecx, byte [eax + 9]
mov edx, dword [eax + 0x38]
mov eax, dword [ecx + edx + 8]
bswap eax
push eax
mov eax, esi
mov byte [esi], 0
call fcn.004e6980
add esp, 4
pop edi
mov ebp, eax
pop ebp
add esp, 8
ret
mov ebp, 0x10
pop edi
mov eax, ebp
mov byte [esi], 1
pop ebp
add esp, 8
ret
push 0x5e9b1c
push 0x108ab
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.004d31b0
add esp, 0x14
pop edi
mov eax, 0xb
pop ebp
add esp, 8
ret
Function at 0x4e9e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push esi
push edi
xor edi, edi
mov esi, eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
call fcn.004e6a00
cmp eax, 0x10
jne 0x4e9ebc
mov eax, dword [esp + 0x18]
mov dword [eax], edi
mov dword [eax + 4], edi
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
push ebx
push ebp
cmp eax, edi
jne 0x4e9ff5
or ebp, 0xffffffff
lea esp, [esp]
mov ecx, dword [esi + 0x74]
mov bl, byte [ecx + 8]
test bl, bl
jne 0x4e9edf
cmp byte [ecx + 2], bl
jne 0x4e9eec
movzx eax, word [ecx + 0x16]
cdq
add dword [esp + 0x14], eax
adc dword [esp + 0x18], edx
test bl, bl
je 0x4e9f8f
mov al, byte [esi + 0x44]
test al, al
je 0x4e9fdf
and byte [esi + 1], 0xf9
xor edx, edx
mov word [esi + 0x32], dx
movsx edx, al
mov dx, word [esi + edx*2 + 0x46]
dec al
mov byte [esi + 0x44], al
movsx eax, al
mov word [esi + 0x46], dx
mov edx, dword [esi + eax*4 + 0x78]
mov dword [esi + 0x74], edx
mov eax, dword [ecx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4e9f75
mov ecx, dword [eax + 0x14]
add dword [ecx + 0x78], ebp
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [edi]
dec eax
push edx
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x1c]
push 0
push eax
call fcn.00588bf0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x4e9f7a
call fcn.004af220
mov ecx, dword [esi + 0x74]
mov dx, word [esi + 0x46]
cmp dx, word [ecx + 0x16]
jae 0x4e9ef4
inc word [esi + 0x46]
movzx eax, word [esi + 0x46]
movzx edx, word [ecx + 0x16]
cmp eax, edx
jne 0x4e9fa8
movzx eax, byte [ecx + 9]
mov ecx, dword [ecx + 0x38]
mov eax, dword [eax + ecx + 8]
jmp 0x4e9fc2
mov edx, dword [ecx + 0x40]
mov ax, word [edx + eax*2]
mov dh, al
mov dl, ah
movzx eax, dx
movzx edx, word [ecx + 0x18]
mov ecx, dword [ecx + 0x38]
and eax, edx
mov eax, dword [eax + ecx]
bswap eax
push eax
mov eax, esi
call fcn.004e6980
add esp, 4
test eax, eax
je 0x4e9ed0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], ecx
call fcn.004e6a00
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x4eea00
Capabilities:
Reference sql statements

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
push esi
push str.sqlite_master
push esi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.004d7d20
add esp, 0x18
test edi, edi
jne 0x4eea33
push esi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.004d7d20
add esp, 0x10
pop ebx
ret
Function at 0x500030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
mov esi, eax
mov al, byte [esi]
test al, al
je 0x50006d
cmp al, 3
jb 0x50004b
call fcn.004ff3a0
test eax, eax
jne 0x50018d
cmp byte [esi], 1
jne 0x500058
mov eax, 0x65
pop esi
pop ecx
ret
mov eax, dword [esi + 4]
xor ecx, ecx
cmp eax, ecx
je 0x50006d
mov byte [esi], cl
mov dword [esi + 4], ecx
jge 0x50006d
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x74]
cmp byte [eax + 8], 0
push ebp
push edi
jne 0x5000b5
mov edx, dword [eax + 0x40]
movzx ecx, word [esi + 0x46]
mov cx, word [edx + ecx*2]
mov dh, cl
mov dl, ch
movzx ecx, dx
movzx edx, word [eax + 0x18]
mov eax, dword [eax + 0x38]
and ecx, edx
mov eax, dword [ecx + eax]
bswap eax
push eax
mov eax, esi
call fcn.004e6980
add esp, 4
test eax, eax
jne 0x50018b
call fcn.004e6c10
pop edi
pop ebp
pop esi
pop ecx
ret
cmp word [esi + 0x46], 0
jne 0x500154
mov al, byte [esi + 0x44]
test al, al
je 0x50017c
and byte [esi + 1], 0xf9
movsx edx, al
xor ecx, ecx
mov word [esi + 0x32], cx
mov cx, word [esi + edx*2 + 0x46]
dec al
movsx edx, al
mov word [esi + 0x46], cx
mov ecx, dword [esi + 0x74]
mov byte [esi + 0x44], al
mov eax, dword [esi + edx*4 + 0x78]
mov dword [esi + 0x74], eax
mov eax, dword [ecx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x500144
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebp, dword [edi]
dec eax
push edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.00588bf0
push edx
push eax
mov eax, dword [ebp + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x500149
call fcn.004af220
cmp word [esi + 0x46], 0
je 0x5000c0
mov eax, dword [esi + 0x74]
mov ecx, 0xffff
add word [esi + 0x46], cx
cmp byte [eax + 2], 0
je 0x500189
cmp byte [eax + 8], 0
jne 0x500189
push 0
push esi
call fcn.00500190
add esp, 8
pop edi
pop ebp
pop esi
pop ecx
ret
pop edi
pop ebp
mov byte [esi], 1
mov eax, 0x65
pop esi
pop ecx
ret
xor eax, eax
pop edi
pop ebp
pop esi
pop ecx
ret

Function at 0x500190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
and byte [eax + 1], 0xf1
xor ecx, ecx
mov word [eax + 0x32], cx
cmp byte [eax], cl
jne 0x5001bc
movzx ecx, word [eax + 0x46]
test cx, cx
je 0x5001bc
mov edx, dword [eax + 0x74]
cmp byte [edx + 8], 0
je 0x5001bc
dec ecx
mov word [eax + 0x46], cx
xor eax, eax
ret
jmp fcn.00500030
Function at 0x5104e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
mov ebx, dword [esp + 0xdc]
push ebp
mov ebp, dword [esp + 0xe4]
push esi
push edi
push 0x34
lea eax, [esp + 0x80]
push 0
push eax
mov dword [esp + 0x1c], 0
call fcn.00585e50
push 0x34
lea ecx, [esp + 0xc0]
push 0
push ecx
call fcn.00585e50
push 0x34
lea edx, [esp + 0x64]
push 0
push edx
call fcn.00585e50
mov esi, dword [ebp + 0xc]
mov ecx, 0xd
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xa0]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x14]
lea edx, [esp + 0x38]
lea ecx, [esp + 0xd4]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0xac], edx
mov byte [esp + 0x6c], 0x2c
mov byte [esp + 0xa0], 0x39
mov ecx, dword [eax + 4]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xe0], edx
mov byte [esp + 0xd4], 0x37
mov eax, dword [eax + 0x1c]
mov ecx, edx
mov dword [esp + 0xe4], eax
push ecx
lea edx, [esp + 0x38]
mov eax, ebx
call fcn.00510410
mov dl, byte [esp + 0x3c]
and dword [esp + 0x40], 0xffffefff
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x11c]
add esp, 0x28
mov byte [esp + 0x3a], dl
mov edx, dword [esp + 0xf0]
mov byte [esp + 0x14], 0xa4
test eax, eax
je 0x5105e4
mov ecx, dword [esp + 0xf8]
push ecx
push edx
lea ecx, [esp + 0x50]
push ecx
push ebx
call eax
add esp, 0x10
jmp 0x5105f8
or dword [esp + 0x18], 1
push edx
lea eax, [esp + 0x4c]
push eax
push ebx
call fcn.00516870
add esp, 0xc
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x510614
mov al, byte [ebx + 0x13]
cmp al, 8
jae 0x510614
movzx edx, al
mov dword [ebx + edx*4 + 0x90], ecx
inc byte [ebx + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret