joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f520
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568130
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CFontIcon.0
mov byte [esi + 0x44], 0xff
mov eax, dword [0x5ce94c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ce94c
call edx
add eax, 0x10
mov dword [esi + 0x4c], eax
mov byte [ebp - 4], 1
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov eax, dword [0x5ce94c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ce94c
call edx
add eax, 0x10
mov dword [esi + 0x68], eax
mov byte [ebp - 4], 2
mov eax, dword [0x5ce94c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ce94c
call edx
add eax, 0x10
mov dword [esi + 0x6c], eax
mov byte [ebp - 4], 3
mov eax, dword [0x5ce94c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ce94c
call edx
add eax, 0x10
mov dword [esi + 0x70], eax
mov byte [ebp - 4], 4
xor eax, eax
mov word [esi + 0xa4], ax
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], 3
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [esi + 0xd8], eax
mov byte [ebp - 4], 5
mov edx, dword [0x5ce94c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5ce94c
call eax
add eax, 0x10
mov dword [esi + 0xdc], eax
mov byte [ebp - 4], 6
mov eax, 1
lea ecx, [esi + 0xec]
mov dword [esi + 0xe0], eax
mov byte [esi + 0xe4], bl
mov byte [esi + 0xe5], bl
mov dword [esi + 0xe8], eax
call fcn.004a3270
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
or eax, 0xffffffff
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x45], ebx
mov dword [esi + 0xac], 9
mov dword [esi + 0xb0], 0x190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a2960
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4a2973
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4a29f1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x4a29e3
mov eax, dword [ebp + 0x10]
push 0x5cea3e
push esi
mov dword [eax], esi
call fcn.0053ef06
mov ecx, dword [ebp + 0xc]
add esp, 8
mov dword [ecx], eax
test eax, eax
je 0x4a29e3
push 0
lea edx, [ebp - 4]
push edx
push esi
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a29e3
cmp dword [ebp - 4], esi
jne 0x4a29e3
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4a2a04
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push esi
call fcn.004a28d0
add esp, 0xc
mov bl, al
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a6720
Capabilities:
Delete file
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x573360
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
push ecx
push edx
mov dword [esp + 0x2c], 0x60
call fcn.004a6340
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4a677f
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push ebx
call fcn.004a6500
mov ecx, dword [ebx + 4]
mov edi, eax
add esp, 8
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x4a67ac
mov dword [ebx + 8], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x24], 0
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x4a67c9
mov dword [ebx + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
imul ecx, esi
mov edx, dword [esp + 0x1c]
push esi
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call fcn.0046daa0
lea esi, [esp + 0x2c]
call fcn.004a6110
test al, al
je 0x4a6827
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 0
push 0
push 0
push ecx
push edx
push edi
call fcn.004d3370
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4a6827
test edi, edi
je 0x4a6821
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov dword [esp + 0x18], esi
mov edi, esi
push 0x64
lea eax, [esp + 0x18]
push 0x58f384
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004d3a00
add esp, 0xc
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x4a68ca
lea esi, [esp + 0x1c]
call fcn.00478360
mov byte [esp + 0x38], 1
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4a68ae
push ecx
mov edx, esp
mov dword [esp + 0x24], esp
push edx
mov edi, str.disable_resize
call fcn.00422950
push ecx
mov byte [esp + 0x40], 2
mov edi, dword [esp + 0x1c]
mov eax, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00422950
mov byte [esp + 0x40], 3
mov ecx, esi
mov byte [esp + 0x40], 1
call fcn.00478260
mov edi, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x38], 0
test esi, esi
je 0x4a68ca
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
test edi, edi
je 0x4a68e2
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a690a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4abb80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5732c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CMyScrollbar.0
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
or edi, 0xffffffff
mov dword [esi + 0x28], edi
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
xor eax, eax
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi + 0x2c], eax
push 0x5916c8
mov dword [esi + 0x30], eax
lea ecx, [ebp - 0x10]
push ebx
mov dword [esi + 0x34], eax
push ecx
mov dword [esi + 0x38], eax
call fcn.00479600
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, dword [eax]
call fcn.004d3240
mov dword [esi + 0x38], eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4abc34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.IDI_SCROLLBAR_BG
lea ecx, [ebp - 0x10]
push ebx
push ecx
call fcn.00479600
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [eax]
call fcn.004d3240
mov dword [esi + 0x2c], eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x4abc73
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b8f60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0x84
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], 0
call fcn.00545940
xor eax, eax
movzx ebx, ax
lea edx, [esi + 0x88]
mov eax, ebx
add esp, 0xc
shl ebx, 0x10
mov edi, edx
or eax, ebx
mov ecx, 0x82
rep stosd dword es:[edi], eax
lea ecx, [ebp - 4]
push ecx
push edx
lea edx, [ebp - 8]
push edx
push 0x58c9c8
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0x208
mov dword [ebp - 8], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop edi
mov eax, esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bc260
Capabilities:
Create thread

Disassembly:
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi + 0x18], 0
jne 0x4bc2fb
cmp dword [0x5d0e28], 0
jne 0x4bc29b
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4bc29b
push str.CancelIoEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5d0e28], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0xac], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0xa4], eax
call edi
mov dword [esi + 0xa0], eax
mov eax, esi
call fcn.004bcaf0
lea eax, [esi + 0xb0]
push eax
push 0
push esi
push 0x4bcc00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xa8], eax
mov byte [esi + 0x18], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
ret
Function at 0x4befd0
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x570cbc
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x5c5678]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x4bf1f5
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x6e]
push edx
mov word [esp + 0x70], cx
call fcn.00545940
add esp, 0xc
push 0x104
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x68]
call fcn.00425130
lea edx, [esp + 0x14]
push edx
mov eax, 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x284], 0
call fcn.00421cd0
lea edi, [esp + 0x10]
mov byte [esp + 0x280], 1
call fcn.00425450
mov byte [esp + 0x280], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bf0b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x4bf0f0
mov dword [esp + 0x280], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4bf1e9
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
shrd esi, ecx, 0x14
shrd edi, edx, 0x14
shr ecx, 0x14
shr edx, 0x14
cmp esi, ebx
jae 0x4bf1ca
push 0
call fcn.0053f3ec
add esp, 4
push ebx
push edi
mov dword [esp + 0x20], eax
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], edx
call fcn.004b6860
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x38]
push edx
push ecx
mov eax, esp
mov byte [esp + 0x288], 2
mov dword [eax], 1
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], esp
push eax
call fcn.004ba180
mov eax, 0x5d1db0
lea edx, [esp + 0x14]
mov byte [esp + 0x280], 3
call fcn.0040f100
test al, al
je 0x4bf1b8
mov esi, dword [esi + 0x158]
test esi, esi
je 0x4bf199
lea ecx, [esp + 0x14]
push ecx
mov edi, esi
call fcn.00423d80
lea ecx, [esp + 0x14]
call fcn.00425530
lea esi, [esp + 0x38]
call fcn.004b86a0
lea ecx, [esp + 0x10]
call fcn.00425530
mov al, 1
jmp 0x4bf1f7
lea ecx, [esp + 0x14]
call fcn.00425530
lea esi, [esp + 0x38]
call fcn.004b86a0
mov dword [esp + 0x280], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4bf1f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0053d78d
mov esp, ebp
pop ebp
ret 8
Function at 0x4bf9a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [esi + 0x50], 0
push 0
je 0x4bf9ce
push 1
push 0x407
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
neg eax
sbb eax, eax
neg eax
pop ebx
pop ebp
ret 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4bf9ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop ebx
pop ebp
ret 4
lea eax, [esi + 0x28]
push eax
push 0
push esi
push 0x4ca0f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x24], eax
call fcn.004d2960
test eax, eax
jl 0x4bf9e7
mov ecx, dword [esi + 0x38]
push 0x7d0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi]
mov dword [esi + 0x148], edx
mov eax, dword [edi + 4]
push ebx
mov dword [esi + 0x14c], eax
push 0x401
mov ecx, 0x407
mov eax, esi
call fcn.004c9350
neg eax
sbb eax, eax
neg eax
pop ebx
pop ebp
ret 4
Function at 0x4c1480
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57233c
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x5c5678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
mov esi, ecx
test eax, eax
je 0x4c154e
lea edi, [esi + 0x14]
mov eax, ebx
call fcn.00425450
call fcn.004b90a0
push eax
call fcn.004b9120
test al, al
je 0x4c154e
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.00545940
mov ebx, dword [ebx]
add esp, 0xc
push str.member_activity.db
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
call fcn.004b90a0
mov eax, dword [eax + 8]
test eax, eax
je 0x4c154e
lea edi, [esi + 4]
lea edx, [ebp - 0x218]
push edi
push edx
call eax
add esp, 8
test eax, eax
jne 0x4c154e
test bl, bl
je 0x4c1555
mov ecx, esi
call fcn.004c4020
test al, al
jne 0x4c1562
xor al, al
jmp 0x4c16b7
call fcn.004c4450
test al, al
je 0x4c16b7
call fcn.004c4700
test al, al
je 0x4c154e
push 8
call fcn.0053e934
add esp, 4
test eax, eax
je 0x4c1586
mov ecx, dword [edi]
mov dword [eax], ecx
mov dword [eax + 4], 0
jmp 0x4c1588
xor eax, eax
push eax
lea edi, [esi + 0xc]
push edi
call fcn.004c8e50
cmp dword [edi], 0
je 0x4c154e
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x41e]
push eax
mov word [ebp - 0x420], dx
call fcn.00545940
push str.activity
lea ecx, [ebp - 0x420]
push str.INSERT_OR_IGNORE_INTO__s_time_hash_seq_lang_type_content_flags__VALUES________________
push ecx
mov ecx, 0x104
call fcn.00421fd0
add esp, 0x18
lea edx, [ebp - 0x424]
push edx
lea ecx, [ebp - 0x420]
call fcn.00425130
mov dword [ebp - 4], 0
mov edi, dword [edi]
lea edx, [ebp - 0x424]
mov eax, edi
call fcn.004b9b60
test al, al
sete bl
or edi, 0xffffffff
lea ecx, [ebp - 0x424]
mov dword [ebp - 4], edi
call fcn.00425530
test bl, bl
jne 0x4c154e
push 0x5d1b80
lea eax, [ebp - 0x424]
push eax
call fcn.004b5b50
mov dword [ebp - 4], 1
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
lea eax, [ebp - 0x424]
push eax
mov ecx, esi
call edx
test al, al
lea eax, [ebp - 0x424]
sete bl
mov dword [ebp - 4], edi
call fcn.0046d830
test bl, bl
je 0x4c16b1
lea eax, [ebp - 0x42c]
push eax
mov ecx, 0x58c9b4
call fcn.00425130
push eax
lea ecx, [ebp - 0x428]
push ecx
mov dword [ebp - 4], 2
call fcn.004b5b50
mov byte [ebp - 4], 3
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
lea eax, [ebp - 0x428]
push eax
mov ecx, esi
call edx
test al, al
lea eax, [ebp - 0x428]
sete bl
call fcn.0046d830
lea ecx, [ebp - 0x42c]
call fcn.00425530
test bl, bl
jne 0x4c154e
mov byte [esi + 8], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d78d
mov esp, ebp
pop ebp
ret 4
Function at 0x4c2dc0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a21e
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x5c5678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x228], esi
cmp byte [edi + 8], 0
mov dword [ebp - 0x244], ebx
jne 0x4c2e3d
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x2c], 0xf
mov dword [ebx + 0x28], esi
mov byte [ebx + 0x18], 0
mov eax, dword [0x5ce94c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5ce94c
call edx
add eax, 0x10
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], esi
jmp 0x4c2fe9
mov ecx, dword [eax]
cmp dword [ecx - 0xc], esi
jne 0x4c2e50
mov esi, ebx
call fcn.004b9720
jmp 0x4c2fe9
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], esi
lea ecx, [ebp - 0x240]
lea esi, [ebp - 0x220]
call fcn.004c25b0
test al, al
je 0x4c2e44
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x216]
push eax
mov word [ebp - 0x218], dx
call fcn.00545940
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x220]
push edx
push eax
push ecx
push str.activity
lea edx, [ebp - 0x218]
push str.SELECT__FROM__s_WHERE_time_I64u_AND_seq_I64u_
push edx
mov ecx, 0x104
call fcn.00421fd0
mov eax, dword [edi + 4]
add esp, 0x28
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x224]
push ecx
mov edi, 1
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], edi
call fcn.00425130
sub esp, 8
mov byte [ebp - 4], 2
mov edx, esp
mov dword [ebp - 0x21c], esp
push edx
call fcn.004b93d0
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x224]
call fcn.004cd1f0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4c2f47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x238]
cmp dword [eax + 0x18], 0
jne 0x4c2f62
mov esi, ebx
call fcn.004b9720
mov dword [ebp - 0x228], edi
jmp 0x4c2fcb
mov ecx, dword [eax + 0x14]
mov eax, dword [eax]
mov esi, dword [ecx]
test eax, eax
jne 0x4c3009
call fcn.0053ecd6
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x4c2f82
call fcn.0053ecd6
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
add esi, 8
push ecx
push edx
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.004c2520
add esp, 0xc
lea edi, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.00425450
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 4
call fcn.00425530
push ebx
mov edi, esi
call fcn.004c3010
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 1
call fcn.004c8e10
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.004b9ae0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d78d
mov esp, ebp
pop ebp
ret 8
mov eax, dword [eax]
jmp 0x4c2f78
Function at 0x4c3010
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565d5b
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5c5678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
lea eax, [edi + 0x14]
push 0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00424780
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x30]
sub eax, 0x10
call fcn.004254c0
add eax, 0x10
mov dword [esi + 0x30], eax
mov edx, dword [edi + 0x34]
mov dword [esi + 0x34], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c3c90
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56769e
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5c5678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi + 8], 0
jne 0x4c3cfa
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c3cf2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
jmp 0x4c3dd7
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.00545940
add esp, 0xc
lea edi, [ebp + 8]
call fcn.004b5840
push eax
mov eax, dword [esi + 0x30]
push eax
push 0xffffffffffffffff
push str.activity
lea ecx, [ebp - 0x218]
push str.SELECT_COUNT_ROWID__FROM__s_WHERE_lang_IN__d__d__AND_type_IN___s__
push ecx
mov ecx, 0x104
call fcn.00421fd0
mov edx, dword [esi + 4]
add esp, 0x18
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 1
call fcn.00425130
or eax, 0xffffffff
push eax
lea ecx, [ebp - 0x21c]
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 2
call fcn.004cd2e0
mov esi, eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c3daf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c3dd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d78d
mov esp, ebp
pop ebp
ret 8