joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412560
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x41259c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x412900
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x4129f4
cmp word [edx], 0
je 0x4129f4
mov ecx, dword [esp + 0x10]
push esi
cmp ecx, 0x19
jne 0x41298d
mov esi, dword [esp + 0xc]
mov ecx, edx
push edi
cmp dword [esi + 4], 0
lea edi, [ecx + 2]
je 0x412960
jmp 0x412940
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412940
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00412a00
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412960
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x10]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00412b10
mov esi, eax
test esi, esi
je 0x4129eb
mov eax, dword [esp + 0xc]
cmp dword [eax + 4], 0
je 0x4129c8
push dword [esp + 0x10]
push esi
push eax
call fcn.00412a00
mov dword [esp + 4], eax
jmp 0x4129dc
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x18]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push 0
push dword [0x50803c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x412a00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x412b07
cmp dword [esi + 0x14], 1
jne 0x412a4b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x412ac8
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x412ab3
dec eax
je 0x412a9c
sub eax, 2
je 0x412a87
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00412560
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x412af5
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x412a71
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x4142e1
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x414429
xor ecx, ecx
cmp word [eax], cx
je 0x414429
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x41433a
cmp eax, 3
jne 0x414374
cmp word [esp + 0xa], 0x3a
jne 0x414374
cmp eax, 2
jne 0x414358
lea eax, [esp + 8]
push 0x4e4f20
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x414429
push 0xfffffffffffffffe
pop edi
jmp 0x414429
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x414389
cmp ax, bx
jne 0x414393
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x41437c
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x4143d2
test byte [esp + 0x21c], 0x10
je 0x4143b9
push 0xfffffffffffffffe
pop edi
jmp 0x4143c9
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x414427
cmp word [esp + 0x10], bp
jne 0x4143e0
cmp word [esp + 0x12], bp
je 0x4143ff
cmp word [esp + 0x10], bx
jne 0x4143ee
cmp word [esp + 0x12], bx
je 0x4143ff
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x414427
cmp word [esp + 0x12], ax
jne 0x414427
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x414414
test al, 0x10
je 0x414427
jmp 0x414424
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x414427
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x415535
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x5c], eax
ret
Function at 0x416f73
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x416fd0
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x416fd0
mov eax, dword [esi + 0x70]
test eax, eax
je 0x416faf
push ebx
push esi
call eax
push esi
push ebx
push dword [0x50803c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x50e7e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x50e7ec], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x41717c
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x50803c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x50e7e8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x50e7ec], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00419d78
mov dword [esi + 0x58], 0x417d8f
mov eax, esi
mov dword [esi + 0x5c], 0x417ddb
mov dword [esi + 0x10], fcn.00417930
mov dword [esi + 0x30], 0x417822
mov dword [esi + 0x64], 0x417e65
mov dword [esi + 0x60], 0x417e1d
mov dword [esi + 0x34], 0x4174d2
mov dword [esi + 0x24], 0x4174a9
mov dword [esi + 0x28], 0x41747e
mov dword [esi + 0x2c], 0x4173d0
mov dword [esi + 0x44], 0x417b95
pop esi
ret 4
Function at 0x41d00c
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x41d0c2
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x41d0a2
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x41d07d
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x41d0b7
add edi, dword [esp + 0x14]
jmp 0x41d0bb
add edi, dword [esp + 0x24]
test edx, edx
jne 0x41d05b
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x41d3cd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x41d4a7
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x41d47d
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x41d445
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x41d494
add edi, ecx
jmp 0x41d498
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x41d41b
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x41dac7
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x41db7c
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x41db5d
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x41db38
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x41db72
add edx, dword [esp + 0x14]
jmp 0x41db76
add edx, dword [esp + 0x24]
test esi, esi
jne 0x41db16
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x4204a9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x50dda4], eax
test eax, eax
je 0x4204d7
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50dda0], eax
lea eax, [ebp - 0x114]
mov dword [0x50dda8], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x420539
cmp dword [ebp - 0x104], 1
jne 0x42050e
and dword [0x50dda8], 0
jmp 0x420551
cmp dword [ebp - 0x104], 2
jne 0x420539
cmp dword [ebp - 0x110], 5
jb 0x420505
jne 0x420539
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x50dda8]
mov dword [0x50dda8], eax
jmp 0x42053e
mov eax, dword [0x50dda8]
test eax, eax
je 0x420551
call fcn.004201c3
neg eax
sbb eax, eax
and dword [0x50dda8], eax
mov esp, ebp
pop ebp
ret

Function at 0x4215c0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4215f2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4215ed
cmp dword [esp + 0xc], esi
je 0x421609
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x4255f0
Capabilities:
Query environment variable

Disassembly:
push str.EXPAT_ENTROPY_DEBUG
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x425654
mov ecx, 0x4e55f0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x425627
test dl, dl
je 0x425623
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x425627
add eax, 2
add ecx, 2
test dl, dl
jne 0x425607
xor eax, eax
jmp 0x42562c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x425654
push 4
push dword [esp + 0xc]
push 8
push dword [esp + 0x10]
push str.Entropy:__s_____0x_0lx___lu_bytes__n
call dword [sym.imp.MSVCRT.dll___p__iob]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0x18
mov eax, dword [esp + 8]
ret
Function at 0x4299c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xc
push esi
xor esi, esi
jmp 0x4299d0
push 4
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call sub.ADVAPI32.DLL_SystemFunction036
test al, al
je 0x429a21
mov edx, dword [esp + 4]
xor ecx, ecx
mov edi, edi
cmp esi, 4
jae 0x429a0b
mov eax, edx
shr eax, cl
add ecx, 8
mov byte [esp + esi + 8], al
inc esi
cmp ecx, 0x20
jb 0x4299f0
cmp esi, 4
jb 0x4299d0
push dword [esp + 8]
push str.rand_s
call fcn.004255f0
add esp, 8
pop esi
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [esp + 8]
xor esi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, esi
imul eax, eax, 0x7fffffff
push eax
push str.fallback_4_
call fcn.004255f0
add esp, 8
pop esi
add esp, 0xc
ret

Function at 0x42d220
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [esp + 0x10], 0
jle 0x42d322
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push edi
jmp 0x42d240
mov edi, dword [eax + 8]
add ecx, edi
mov esi, dword [eax + 0xc]
adc edx, esi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor ecx, ecx
mov edx, esi
shld esi, edi, 0xd
shr edx, 0x13
or ecx, esi
shl edi, 0xd
mov esi, dword [eax]
or edx, edi
mov edi, dword [eax + 0x18]
mov dword [eax + 8], edx
xor dword [eax + 8], esi
mov edx, dword [eax + 4]
mov dword [eax + 0xc], ecx
xor ecx, ecx
xor dword [eax + 0xc], edx
or ecx, esi
add dword [eax + 0x10], edi
mov esi, dword [eax + 0x1c]
adc dword [eax + 0x14], esi
mov ebp, dword [eax + 0x10]
mov ebx, dword [eax + 0x14]
mov dword [eax], edx
mov edx, esi
shld esi, edi, 0x10
mov dword [eax + 4], ecx
xor ecx, ecx
or ecx, esi
shr edx, 0x10
shl edi, 0x10
or edx, edi
mov dword [eax + 0x1c], ecx
xor dword [eax + 0x1c], ebx
mov esi, dword [eax + 0x1c]
mov dword [eax + 0x18], edx
mov edx, esi
xor dword [eax + 0x18], ebp
mov edi, dword [eax + 0x18]
add dword [eax], edi
adc dword [eax + 4], esi
xor ecx, ecx
shld esi, edi, 0x15
shr edx, 0xb
or ecx, esi
shl edi, 0x15
mov esi, dword [eax + 0xc]
or edx, edi
mov edi, dword [eax + 8]
mov dword [eax + 0x18], edx
mov edx, dword [eax + 4]
mov dword [eax + 0x1c], ecx
xor dword [eax + 0x1c], edx
mov edx, esi
mov ecx, dword [eax]
xor dword [eax + 0x18], ecx
add ebp, edi
adc ebx, esi
xor ecx, ecx
shld esi, edi, 0x11
shr edx, 0xf
or ecx, esi
shl edi, 0x11
or edx, edi
mov dword [eax + 0xc], ecx
xor ecx, ecx
mov dword [eax + 8], edx
mov esi, ebp
mov edx, ebx
xor dword [eax + 0xc], edx
or ecx, esi
xor dword [eax + 8], esi
dec dword [esp + 0x20]
mov dword [eax + 0x10], edx
mov edx, dword [eax + 4]
mov dword [eax + 0x14], ecx
mov ecx, dword [eax]
jne 0x42d240
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x453e90
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
movzx edx, byte [esi + 9]
mov ebx, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
movzx ecx, byte [edx + ebx + 5]
mov ebp, dword [eax + 0x24]
movzx eax, byte [edx + ebx + 6]
movzx edi, byte [edx + ebx + 7]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x10], ebp
movzx eax, byte [esi + 0xa]
dec ecx
and ecx, 0xffff
add eax, edx
inc ecx
add ebp, 0xfffffffc
mov dword [esp + 0x14], ecx
movzx ecx, word [esi + 0x18]
movzx esi, byte [edx + ebx + 1]
shl esi, 8
lea eax, [eax + ecx*2]
add eax, 8
mov dword [esp + 0x18], eax
movzx eax, byte [edx + ebx + 2]
or esi, eax
mov eax, dword [esp + 0x14]
add edi, eax
test esi, esi
jle 0x453f89
cmp esi, eax
jge 0x453f13
push 0x4f48b4
push 0x101ef
jmp 0x453fb9
cmp esi, ebp
jg 0x453f4e
jmp 0x453f20
movzx eax, byte [esi + ebx]
movzx ecx, byte [ebx + esi + 1]
movzx edx, byte [ebx + esi + 2]
shl eax, 8
or eax, ecx
shl edx, 8
movzx ecx, byte [ebx + esi + 3]
or edx, ecx
lea ecx, [esi + 3]
add ecx, edx
add edi, edx
cmp eax, ecx
jbe 0x453f5a
mov esi, eax
cmp eax, ebp
jle 0x453f20
push 0x4f48b4
push 0x101f4
jmp 0x453fb9
test eax, eax
je 0x453f6a
push 0x4f48b4
push 0x101fe
jmp 0x453fb9
mov ecx, dword [esp + 0x10]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x453f8d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
mov dword [esp + 4], 0x10202
jmp fcn.004906b0
mov ecx, dword [esp + 0x10]
cmp edi, ecx
jg 0x453faf
mov eax, dword [esp + 0x18]
cmp edi, eax
jl 0x453faf
mov ecx, dword [esp + 0x20]
sub edi, eax
movzx eax, di
pop edi
pop esi
pop ebp
mov dword [ecx + 0x14], eax
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x4f48b4
push 0x1020e
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.0044c270
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x455370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov al, byte [esi]
test al, al
je 0x4553ae
cmp al, 3
jb 0x455390
push esi
call fcn.004555c0
add esp, 4
test eax, eax
jne 0x4554c9
mov al, byte [esi]
cmp al, 1
jne 0x45539d
mov eax, 0x65
pop esi
ret
cmp al, 2
jne 0x4553ae
cmp dword [esi + 4], 0
mov byte [esi], 0
jge 0x4553ae
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x74]
push ebx
push edi
cmp byte [edx + 8], 0
jne 0x4553f8
movzx ecx, word [esi + 0x46]
mov eax, dword [edx + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edx + 0x1a]
movzx ecx, cx
and ecx, eax
mov eax, dword [edx + 0x38]
mov eax, dword [ecx + eax]
bswap eax
push eax
push esi
call fcn.00478e00
add esp, 8
test eax, eax
jne 0x4554c7
push esi
call fcn.00478f70
add esp, 4
pop edi
pop ebx
pop esi
ret
cmp word [esi + 0x46], 0
jne 0x455492
mov dl, byte [esi + 0x44]
test dl, dl
je 0x4554b9
and byte [esi + 1], 0xf9
xor eax, eax
mov ecx, dword [esi + 0x74]
mov word [esi + 0x32], ax
movsx eax, dl
dec dl
mov ax, word [esi + eax*2 + 0x46]
mov word [esi + 0x46], ax
movsx eax, dl
mov byte [esi + 0x44], dl
mov eax, dword [esi + eax*4 + 0x78]
mov dword [esi + 0x74], eax
mov edx, dword [ecx + 0x48]
test byte [edx + 0x1c], 0x20
je 0x45547e
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.0040b170
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x455487
push edx
call fcn.004ab270
add esp, 4
cmp word [esi + 0x46], 0
je 0x455403
mov eax, 0xffff
add word [esi + 0x46], ax
mov eax, dword [esi + 0x74]
cmp byte [eax + 2], 0
je 0x4554c5
cmp byte [eax + 8], 0
jne 0x4554c5
push 0
push esi
call fcn.0048ddf0
add esp, 8
pop edi
pop ebx
pop esi
ret
pop edi
pop ebx
mov byte [esi], 1
mov eax, 0x65
pop esi
ret
xor eax, eax
pop edi
pop ebx
pop esi
ret
Function at 0x4554d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov al, byte [ebp + 0x44]
test al, al
js 0x4555ba
push ebx
push esi
xor ebx, ebx
push edi
test al, al
jle 0x455558
add ebp, 0x78
lea esp, [esp]
mov ecx, dword [ebp]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x45553b
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.0040b170
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
jmp 0x455544
push ecx
call fcn.004ab270
add esp, 4
mov eax, dword [esp + 0x14]
inc ebx
add ebp, 4
movsx eax, byte [eax + 0x44]
cmp ebx, eax
jl 0x4554f0
mov ebp, dword [esp + 0x14]
mov eax, dword [ebp + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x4555aa
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.0040b170
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov byte [ebp + 0x44], 0xff
pop edi
pop esi
pop ebx
pop ebp
ret
push edx
call fcn.004ab270
add esp, 4
mov byte [ebp + 0x44], 0xff
pop edi
pop esi
pop ebx
pop ebp
ret