joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51ddd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], edi
mov dword [edi], 1
cmp eax, 1
je 0x51de10
test eax, eax
je 0x51de10
cmp eax, 2
je 0x51de10
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x51de33
cmp eax, 1
je 0x51de33
mov eax, 0xfffffffe
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
mov dword [edi + 8], eax
test edx, edx
je 0x51de4f
xor ecx, ecx
nop
mov al, byte [ecx + edx]
mov byte [edi + ecx + 0xc], al
inc ecx
cmp ecx, 0x10
jb 0x51de40
jmp 0x51de56
xorps xmm0, xmm0
movups xmmword [edi + 0xc], xmm0
mov eax, dword [ebp + 0x18]
push ebx
sub eax, 0
je 0x51de9a
sub eax, 1
je 0x51de8c
sub eax, 1
je 0x51de7e
pop ebx
mov eax, 0xfffffffd
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret
mov ebx, 0x20
mov dword [edi + 0x1c], 0xe
jmp 0x51dea6
mov ebx, 0x18
mov dword [edi + 0x1c], 0xc
jmp 0x51dea6
mov ebx, 0x10
mov dword [edi + 0x1c], 0xa
cmp dword [ebp + 0x14], 0
jne 0x51dec1
pop ebx
mov eax, 0xfffffffc
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa103
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x14]
xor eax, eax
push esi
mov ecx, eax
lea edx, [ebp - 0x24]
and ecx, 3
mov esi, eax
add edx, ecx
shr esi, 2
mov cl, byte [eax + edi]
inc eax
mov byte [edx + esi*4], cl
cmp eax, ebx
jb 0x51dec7
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.0051e000
add esp, 8
cmp dword [edi + 8], 1
jne 0x51dfd9
mov ebx, 1
cmp dword [edi + 0x1c], ebx
jbe 0x51dfd9
lea esi, [edi + 0x32]
nop dword [eax]
movzx eax, byte [esi + 1]
lea esi, [esi + 0x10]
movzx ecx, byte [esi - 0x11]
inc ebx
mov edx, dword [eax*4 + 0x6963e0]
xor edx, dword [ecx*4 + 0x695be0]
movzx eax, byte [esi - 0x10]
xor edx, dword [eax*4 + 0x695fe0]
movzx eax, byte [esi - 0x12]
xor edx, dword [eax*4 + 0x6957e0]
mov dword [esi - 0x12], edx
movzx eax, byte [esi - 0xb]
movzx ecx, byte [esi - 0xc]
mov edx, dword [eax*4 + 0x6963e0]
xor edx, dword [ecx*4 + 0x695fe0]
movzx eax, byte [esi - 0xd]
xor edx, dword [eax*4 + 0x695be0]
movzx eax, byte [esi - 0xe]
xor edx, dword [eax*4 + 0x6957e0]
mov dword [esi - 0xe], edx
movzx eax, byte [esi - 7]
movzx ecx, byte [esi - 8]
mov edx, dword [eax*4 + 0x6963e0]
xor edx, dword [ecx*4 + 0x695fe0]
movzx eax, byte [esi - 9]
xor edx, dword [eax*4 + 0x695be0]
movzx eax, byte [esi - 0xa]
xor edx, dword [eax*4 + 0x6957e0]
mov dword [esi - 0xa], edx
movzx eax, byte [esi - 3]
movzx ecx, byte [esi - 4]
mov edx, dword [eax*4 + 0x6963e0]
movzx eax, byte [esi - 5]
xor edx, dword [ecx*4 + 0x695fe0]
xor edx, dword [eax*4 + 0x695be0]
movzx eax, byte [esi - 6]
xor edx, dword [eax*4 + 0x6957e0]
mov dword [esi - 6], edx
cmp ebx, dword [edi + 0x1c]
jb 0x51df10
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop ebx
mov dword [edi], 0
xor ecx, ebp
pop edi
call fcn.004fa103
mov esp, ebp
pop ebp
ret
Function at 0x51e000
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov edi, dword [ecx + 0x1c]
xor ebx, ebx
sub edi, 6
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edi
test edi, edi
jle 0x51e03a
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor esi, esi
test edi, edi
jle 0x51e088
cmp ebx, dword [ecx + 0x1c]
ja 0x51e1c4
cmp esi, edi
jge 0x51e06c
nop dword [eax]
cmp eax, 4
jge 0x51e06c
mov edi, dword [ebp - 0x28]
lea edx, [eax + ebx*4]
mov ecx, dword [ebp + esi*4 - 0x24]
inc eax
inc esi
mov dword [edi + edx*4 + 0x20], ecx
mov edi, dword [ebp - 0x2c]
cmp esi, edi
jl 0x51e050
cmp eax, 4
lea ecx, [ebx + 1]
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x28]
cmp esi, edi
jl 0x51e040
cmp ebx, dword [ecx + 0x1c]
ja 0x51e1c4
mov esi, 0x6967e0
nop word [eax + eax]
movzx ecx, byte [ebp + edi*4 - 0x27]
mov dl, byte [ebp - 0x24]
xor dl, byte [ecx + str.cw]
mov byte [ebp - 0x24], dl
movzx ecx, byte [ebp + edi*4 - 0x26]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x23], cl
movzx ecx, byte [ebp + edi*4 - 0x25]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x22], cl
movzx ecx, byte [ebp + edi*4 - 0x28]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x21], cl
movzx ecx, byte [esi]
add esi, 4
xor cl, dl
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x24], cl
mov edx, 1
cmp edi, 8
je 0x51e110
cmp edi, edx
jle 0x51e16e
nop word [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, edi
jl 0x51e100
jmp 0x51e16e
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 4
jl 0x51e110
movzx ecx, byte [ebp - 0x18]
mov edx, 5
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x14], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x13], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x12], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x11], cl
nop dword [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 8
jl 0x51e160
xor esi, esi
test edi, edi
jle 0x51e1b5
mov ecx, dword [ebp - 0x28]
cmp ebx, dword [ecx + 0x1c]
ja 0x51e1b5
cmp esi, edi
jge 0x51e19c
cmp eax, 4
jge 0x51e19c
mov edi, dword [ebp - 0x28]
lea edx, [eax + ebx*4]
mov ecx, dword [ebp + esi*4 - 0x24]
inc eax
inc esi
mov dword [edi + edx*4 + 0x20], ecx
mov edi, dword [ebp - 0x2c]
cmp esi, edi
jl 0x51e180
cmp eax, 4
lea ecx, [ebx + 1]
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
cmp esi, edi
jl 0x51e174
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x30]
cmp ebx, dword [ecx + 0x1c]
jbe 0x51e0a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fa103
mov esp, ebp
pop ebp
ret
Function at 0x5244f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x44]
test al, al
js 0x5245df
push ebx
xor ebx, ebx
push edi
test al, al
jle 0x524579
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ecx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x52455e
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004fac10
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
jmp 0x524567
push ecx
call fcn.005765a0
add esp, 4
mov ecx, dword [ebp - 4]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x524511
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x5245d0
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004fac10
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
pop edi
pop ebx
mov byte [esi + 0x44], 0xff
pop esi
mov esp, ebp
pop ebp
ret
push edx
call fcn.005765a0
add esp, 4
mov byte [esi + 0x44], 0xff
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x544ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
mov al, byte [esi + 0x44]
test al, al
js 0x544d4e
mov edx, dword [esi + 0x74]
je 0x544dc0
push edx
call fcn.0054def0
mov al, byte [esi + 0x44]
add esp, 4
sub al, 1
mov byte [esi + 0x44], al
je 0x544d43
push ebx
nop word [eax + eax]
movsx eax, al
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x544d2f
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004fac10
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x544d38
push ecx
call fcn.005765a0
add esp, 4
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
jne 0x544ce0
pop ebx
mov edx, dword [esi + 0x78]
mov dword [esi + 0x74], edx
jmp 0x544dd5
mov ecx, dword [esi + 0x40]
test ecx, ecx
jne 0x544d61
pop edi
mov byte [esi], 1
mov eax, 0x10
pop esi
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x544d8a
cmp al, 4
jne 0x544d72
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebp
ret
push dword [esi + 0x10]
call fcn.0050e8c0
mov ecx, dword [esi + 0x40]
add esp, 4
mov dword [esi + 0x10], 0
mov byte [esi], 1
movzx eax, byte [esi + 2]
lea edi, [esi + 0x74]
push eax
mov eax, dword [esi + 8]
push 0
push edi
push ecx
push dword [eax + 4]
call fcn.0053ffd0
mov ecx, eax
add esp, 0x14
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x544db4
pop edi
mov byte [esi], 1
pop esi
pop ebp
ret
mov edx, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [edx + 2]
mov byte [esi + 0x45], al
cmp byte [edx], 0
je 0x544e2e
movzx eax, byte [edx + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x544e2e
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x32], ax
cmp word [edx + 0x18], ax
jbe 0x544df2
mov byte [esi], al
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret
cmp byte [edx + 8], al
jne 0x544d55
cmp dword [edx + 4], 1
je 0x544e10
pop edi
pop esi
mov dword [ebp + 8], 0x10b30
pop ebp
jmp fcn.0055e140
movzx ecx, byte [edx + 9]
mov eax, dword [edx + 0x38]
mov eax, dword [ecx + eax + 8]
bswap eax
push eax
push esi
mov byte [esi], 0
call fcn.00544a20
add esp, 8
pop edi
pop esi
pop ebp
ret
push 0x65f7a4
push 0x10b23
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00518430
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebp
ret
Function at 0x54f180
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push dword [ebp + 8]
call fcn.005739d0
add esp, 0x18
cmp dword [ebp + 0x10], 0
jne 0x54f1bd
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push dword [ebp + 8]
call fcn.005739d0
add esp, 0x10
pop edi
pop ebp
ret

Function at 0x551270
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 8], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov dword [ebp - 4], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x5512ae
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + ebx*4 - 8]
push esi
call fcn.005516e0
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x55136f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push edi
call fcn.00510510
push edi
call fcn.00510fe0
add esp, 0x14
cmp eax, 0x65
jne 0x551302
mov edx, dword [ebp + 0x10]
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [ebp + 0x14]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ecx
push edx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.00551190
add esp, 0x1c
jmp 0x55135d
cmp eax, 0x64
jne 0x55135d
push 0
push edi
call fcn.00511450
mov ecx, eax
add esp, 8
mov eax, edx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x18]
cmp ecx, edx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
jne 0x55132a
cmp eax, ecx
je 0x55135d
push ecx
mov ecx, dword [ebp + 0x14]
test ebx, ebx
push edx
mov edx, dword [ebp + 0x10]
mov eax, str.__rowid
push ecx
push edx
mov dword [ebp + 8], str.__parent
cmove eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push ecx
push edx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.00551190
add esp, 0x2c
push edi
call fcn.00511fd0
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x55136f
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5663d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
xor edx, edx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x56648a
push ebx
push esi
nop dword [eax]
mov eax, dword [eax + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x56646a
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x6538a8]
movzx ecx, al
movzx ecx, byte [ecx + 0x6538a8]
sub ecx, edx
jne 0x566451
sub ebx, esi
nop
test al, al
je 0x566466
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x6538a8]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x6538a8]
sub ecx, edx
je 0x566430
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x5663f0
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x566451
mov eax, dword [ebp - 8]
push 0
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.0052df00
add esp, 0xc
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x56645d
jmp 0x566454
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5664a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
nop
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], eax
jle 0x56656d
mov ebx, eax
xor ebx, 1
cmp eax, 2
cmovge ebx, eax
test edi, edi
je 0x566530
mov eax, dword [edx + 0x10]
mov ecx, ebx
add ecx, ecx
mov esi, edi
mov edx, dword [eax + ecx*8]
mov al, byte [edi]
movzx ecx, al
movzx edi, byte [ecx + 0x6538a8]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x6538a8]
sub edi, ecx
jne 0x566554
sub edx, dword [ebp + 0x10]
mov dword [ebp - 8], edx
nop dword [eax]
test al, al
je 0x566526
movzx ecx, byte [edx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x6538a8]
mov al, byte [esi]
movzx ecx, al
movzx edi, byte [ecx + 0x6538a8]
sub edi, edx
mov edx, dword [ebp - 8]
je 0x566500
jmp 0x566554
test edi, edi
jne 0x566554
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
shl ebx, 4
push 0
push ecx
mov eax, dword [ebx + eax + 0xc]
add eax, 8
push eax
call fcn.0052df00
add esp, 0xc
mov eax, dword [eax + 8]
test eax, eax
jne 0x56661d
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
inc eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
cmp eax, dword [edx + 0x14]
jl 0x5664c1
mov dl, byte [ecx]
movzx eax, dl
cmp byte [eax + 0x6538a8], 0x73
jne 0x56661b
mov esi, str.sqlite_master
sub esi, ecx
test dl, dl
je 0x5665af
movzx eax, byte [esi + ecx + 1]
inc ecx
mov dword [ebp + 0xc], ecx
mov dl, byte [ecx]
movzx ecx, byte [eax + 0x6538a8]
movzx eax, dl
movzx eax, byte [eax + 0x6538a8]
sub eax, ecx
jne 0x56661b
mov ecx, dword [ebp + 0xc]
jmp 0x566586
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x10]
test edi, edi
jne 0x5665c5
neg edx
sbb edx, edx
jmp 0x56660a
test edx, edx
je 0x56661b
movzx eax, byte [edx]
mov esi, edi
mov bl, byte [edi]
movzx ecx, byte [eax + 0x6538a8]
movzx eax, bl
movzx eax, byte [eax + 0x6538a8]
sub eax, ecx
jne 0x566608
sub edx, edi
test bl, bl
je 0x566608
movzx eax, byte [edx + esi + 1]
inc esi
movzx ecx, byte [eax + 0x6538a8]
mov bl, byte [esi]
movzx eax, bl
movzx eax, byte [eax + 0x6538a8]
sub eax, ecx
je 0x5665e7
mov edx, eax
test edx, edx
jne 0x56661b
mov ecx, str.sqlite_temp_master
mov dword [ebp + 0xc], ecx
jmp 0x5664b0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x575940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test byte [ecx + 0x1c], 4
mov edx, dword [ecx + 0x14]
je 0x57596a
mov eax, dword [edx + 0x18]
cmp eax, dword [ecx + 0x18]
jb 0x57596a
cmp dword [edx + 0x60], 0
je 0x575966
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00597340
xor eax, eax
pop ebp
ret
mov eax, dword [edx + 0x28]
test eax, eax
jne 0x575968
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x575988
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00548fe0
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.0054a2a0
Function at 0x59ba50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x14
mov dword [edi], 0
call fcn.00573380
mov esi, eax
add esp, 8
test esi, esi
jne 0x59ba77
pop edi
lea eax, [esi + 7]
pop esi
pop ebp
ret
cmp dword [0x691fdc], 0
push ebx
mov ebx, dword [ebp + 0x10]
je 0x59bac2
mov eax, dword [0x6920dc]
test eax, eax
je 0x59ba9b
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x59bac2
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x57ffb0
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.005f84ce
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x59bacf
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x59bae8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x5ac96b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x5fa30f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004fa510
mov eax, dword [0x690a1c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.006058bf
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x5fa351
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x5fa4ad
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004fa750
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x6a3738]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.005fe163
mov ecx, dword [esi*4 + 0x6a3738]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x5fa4a6
cmp eax, dword [ecx + edi + 0x24]
jne 0x5fa4a6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5fa4a6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005fe163
add esp, 0x14
test edx, edx
jl 0x5fa4a6
jg 0x5fa41c
test eax, eax
jb 0x5fa4a6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x5fa4a6
jl 0x5fa436
cmp dword [ebp - 0x1008], eax
ja 0x5fa4a6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x5fa454
test ebx, ebx
je 0x5fa48d
cmp ecx, edi
jae 0x5fa48d
mov al, byte [ecx]
cmp al, 0xd
jne 0x5fa46e
lea eax, [edi - 1]
cmp ecx, eax
jae 0x5fa47a
cmp byte [ecx + 1], 0xa
jne 0x5fa47a
inc ecx
jmp 0x5fa47a
movzx eax, al
movsx eax, byte [eax + 0x696e28]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x5fa454
cmp edx, ebx
jne 0x5fa454
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x5fa4ab
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004fa103
leave
ret
Function at 0x6006b7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x6006f6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6006f6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6006f6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x6006f6
cmp dword [ecx + 0x74], 0xe
jbe 0x6006f6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x607433
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x665294
push 0x66528c
push str.FlsAlloc
push 0x1f
call fcn.0060725e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x607467
push dword [ebp + 8]
mov ecx, esi
call dword [0x632890]
call esi
jmp 0x60746d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x6074b1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x6652a4
push 0x66529c
push str.FlsGetValue
push 0x21
call fcn.0060725e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x6074e8
push dword [ebp + 8]
mov ecx, esi
call dword [0x632890]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x6074f0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x6652ac
push 0x6652a4
push str.FlsSetValue
push 0x22
call fcn.0060725e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x60752a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x632890]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]