joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e8b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40e8d5
cmp dword [edi + 0x54], 0
jne 0x40e8d5
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00418b23
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040e872
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4148ed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x414934
call fcn.00418b23
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x414934
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x414950
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00414465
mov esi, eax
test edi, edi
je 0x41494e
test ebx, ebx
je 0x41494e
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41511b
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x43f38d
call fcn.0042ad3d
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x415140
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x415186
lea ecx, [ebp - 0x10]
call fcn.00404ed0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d5b5
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401000
mov eax, esi
call fcn.0042ae15
ret 8
Function at 0x415a02
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x454688]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x415a9a
push 0x442f74
push 4
push eax
call fcn.0042a621
push eax
call fcn.004011b0
add esp, 0x10
push ebx
push edi
call fcn.0042be64
mov edi, dword [eax]
call fcn.0042be64
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0042cd67
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0042be64
cmp dword [eax], ebx
je 0x415ab1
call fcn.0042be64
push dword [eax]
call fcn.0040de51
pop ecx
jmp 0x415ab8
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x415a45
jmp 0x415b3f
call fcn.0042be64
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x415b3b
cmp dword [ebp - 0x234], esi
jae 0x415b3b
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.0042cd90
add esp, 0xc
push 0x442cd4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x415b2a
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x415b2a
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x415b2a
push ebx
push ebx
push esi
jmp 0x415b33
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x415b3d
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00429c7e
leave
ret

Function at 0x417121
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x417169
call fcn.00418b23
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x417169
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4171ac
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x417195
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x417195
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4171a9
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x429c7e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454688]
jne 0x429c88
repz ret
jmp fcn.00430764
Function at 0x438fbd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00430173
and dword [ebp - 4], 0
cmp dword [0x458680], 0
mov ebx, eax
jne 0x43906e
push 0x445858
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43911f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44584c
push edi
call esi
test eax, eax
je 0x43911f
push eax
call fcn.00430101
mov dword [esp], 0x44583c
push edi
mov dword [0x458680], eax
call esi
push eax
call fcn.00430101
mov dword [esp], 0x445828
push edi
mov dword [0x458684], eax
call esi
push eax
call fcn.00430101
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x458688], eax
call esi
push eax
call fcn.00430101
pop ecx
mov dword [0x458690], eax
test eax, eax
je 0x43906e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00430101
pop ecx
mov dword [0x45868c], eax
mov eax, dword [0x45868c]
cmp eax, ebx
je 0x4390c6
cmp dword [0x458690], ebx
je 0x4390c6
push eax
call fcn.0043017c
push dword [0x458690]
mov esi, eax
call fcn.0043017c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4390c6
test edi, edi
je 0x4390c6
call esi
test eax, eax
je 0x4390bd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4390bd
test byte [ebp - 0xc], 1
jne 0x4390c6
or dword [ebp + 0x10], 0x200000
jmp 0x4390ff
mov eax, dword [0x458684]
cmp eax, ebx
je 0x4390ff
push eax
call fcn.0043017c
pop ecx
test eax, eax
je 0x4390ff
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4390ff
mov eax, dword [0x458688]
cmp eax, ebx
je 0x4390ff
push eax
call fcn.0043017c
pop ecx
test eax, eax
je 0x4390ff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x458680]
call fcn.0043017c
pop ecx
test eax, eax
je 0x43911f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x439121
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a5004]
jne 0x40100a
repz ret
jmp fcn.00401587

Function at 0x40444b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a5004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00401e3b
and dword [ebp - 0x14], 0
cmp dword [0x4a78c8], 0
mov dword [ebp - 0x18], eax
jne 0x4044fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4045a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4045a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4a78c8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a78cc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a78d0], eax
call edi
push eax
call esi
mov dword [0x4a78d8], eax
test eax, eax
je 0x4044fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4a78d4], eax
mov eax, dword [0x4a78d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404557
cmp dword [0x4a78d8], ecx
je 0x404557
push eax
call esi
push dword [0x4a78d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404557
test ebx, ebx
je 0x404557
call edi
test eax, eax
je 0x40454e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40454e
test byte [ebp - 8], 1
jne 0x404557
or dword [ebp + 0x10], 0x200000
jmp 0x40458a
mov eax, dword [0x4a78cc]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40458a
mov eax, dword [0x4a78d0]
cmp eax, dword [ebp - 0x18]
je 0x40458a
push eax
call esi
test eax, eax
je 0x40458a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a78c8]
call esi
test eax, eax
je 0x4045a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4045a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x405480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
mov edx, dword [0x4e330c]
mov eax, dword [0x4e3030]
xor ecx, ecx
mov word [0x4e3328], cx
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
mov dword [0x4e3314], 0x6e0072
mov dword [0x4e3318], 0x6c0065
mov dword [0x4e331c], 0x320033
mov dword [0x4e3320], 0x64002e
mov dword [0x4e3324], 0x6c006c
mov dword [0x4e3310], 0x65006b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x4056b0
Capabilities:
Create pipe
Get common file path
Get file attributes
Get geographical location
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x444
mov eax, dword [0x4a5004]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ebx, ebx
xor esi, esi
cmp esi, 0x562d05
jne 0x4056e9
mov eax, dword [0x4a6934]
mov dword [0x4e3694], eax
cmp dword [0x4e330c], 0x3c
jne 0x4056f5
push ebx
call edi
inc esi
cmp esi, 0x5f6c74
jl 0x4056d7
cmp dword [0x4e330c], 0x7c
jne 0x405779
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ebx
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [0x4e330c], 0x110a
jne 0x4057e0
push ebx
mov dword [0x4e3300], ebx
mov dword [0x4e3304], ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push str.migicaranafojoyota_feganowofu_vuj_lelalezecebesijorabifovihapida
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSize]
push ebx
push ebx
call fcn.0040100f
push ebx
push ebx
call fcn.0040100f
push ebx
push ebx
call fcn.0040104f
add esp, 0x18
push ebx
call fcn.0040137f
call fcn.00405450
xor ecx, ecx
cmp dword [0x4e330c], ebx
jbe 0x40581b
nop
mov eax, dword [0x4e3694]
mov dword [esp + 0xc], eax
mov eax, 0xa231
add dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
mov al, byte [edx + ecx]
mov edx, dword [0x4e3030]
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [0x4e330c]
jb 0x4057f0
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.00405480
call fcn.00405640
call fcn.00405470
mov edi, dword [sym.imp.USER32.dll_GetMonitorInfoA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetAtomNameA]
xor esi, esi
lea eax, [esp + 0x20]
push eax
push 0
call edi
push 0
push 0
push 0
call ebx
cmp esi, 0x1a01e
jle 0x405866
cmp dword [esp + 0x28], 0xf5bed7
jne 0x40586f
inc esi
cmp esi, 0x1ece7a52
jl 0x405843
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
lea ecx, [ecx]
cmp esi, 0x12e6c3
jne 0x40588d
call fcn.00405440
cmp dword [0x4e330c], 0x3dc
mov dword [0x4e3034], 0x8e46a6f0
jne 0x4058c7
xor ecx, ecx
lea eax, [esp + 0x10]
push eax
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x20], ecx
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push str.rixovohucivununiboneb_huzurucurajo_jajonaberewevale_sivakawizematec
call ebx
inc esi
cmp esi, 0x1519a5
jl 0x405880
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x416db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x44]
test al, al
js 0x416e9f
push ebx
xor ebx, ebx
push edi
test al, al
jle 0x416e39
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ecx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x416e1e
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.004db9e0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
jmp 0x416e27
push ecx
call fcn.0044cef0
add esp, 4
mov ecx, dword [ebp - 4]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x416dd1
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x416e90
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004db9e0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
pop edi
pop ebx
mov byte [esi + 0x44], 0xff
pop esi
mov esp, ebp
pop ebp
ret
push edx
call fcn.0044cef0
add esp, 4
mov byte [esi + 0x44], 0xff
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4276c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], 0
mov al, byte [esi + 0x44]
test al, al
js 0x42775e
je 0x4277d4
push dword [esi + 0x74]
call fcn.0042f0a0
add esp, 4
sub byte [esi + 0x44], 1
je 0x427753
push ebx
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x427743
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.004db9e0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x42774c
push edx
call fcn.0044cef0
add esp, 4
sub byte [esi + 0x44], 1
jne 0x4276f3
pop ebx
mov eax, dword [esi + 0x78]
mov dword [esi + 0x74], eax
jmp 0x4277ec
cmp dword [esi + 0x3c], 0
jne 0x427772
pop edi
mov byte [esi], 0
mov eax, 0x10
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x42779a
cmp al, 4
jne 0x427785
mov eax, dword [esi + 0x40]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [esi + 0x38]
call fcn.00405c40
add esp, 4
mov dword [esi + 0x38], 0
mov byte [esi], 0
movzx eax, byte [esi + 2]
lea edi, [esi + 0x74]
push eax
mov eax, dword [esi + 8]
push 0
push edi
push dword [esi + 0x3c]
push dword [eax + 4]
call fcn.00423d30
mov ecx, eax
add esp, 0x14
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x4277c8
pop edi
mov byte [esi], 0
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [eax + 2]
mov byte [esi + 0x45], al
mov eax, dword [esi + 0x74]
cmp byte [eax], 0
je 0x427853
movzx eax, byte [eax + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x427853
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x2a], ax
mov eax, dword [esi + 0x74]
cmp word [eax + 0x16], 0
jbe 0x427810
mov eax, dword [ebp - 4]
pop edi
mov byte [esi], 1
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [eax + 8], 0
jne 0x427764
cmp dword [eax + 4], 1
je 0x427833
push 0xfcc4
call fcn.00439ab0
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
movzx ecx, byte [eax + 9]
mov eax, dword [eax + 0x38]
mov eax, dword [ecx + eax + 8]
bswap eax
push eax
push esi
mov byte [esi], 1
call fcn.00427430
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x551524
push 0xfcb7
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00411010
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x441b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [ebx + 0x14], edx
jle 0x441c3e
push esi
nop dword [eax]
mov eax, edi
mov ecx, edi
xor eax, 1
cmp edi, 2
cmovl ecx, eax
mov eax, dword [ebx + 0x10]
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x441c1e
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x549c60]
movzx ecx, al
movzx ecx, byte [ecx + 0x549c60]
sub ecx, edx
jne 0x441c02
sub ebx, esi
test al, al
je 0x441c17
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x549c60]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x549c60]
sub ecx, edx
je 0x441be1
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, dword [ebx + 0x14]
jl 0x441ba0
pop esi
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x441c02
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 8]
push 0
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.004201b0
add esp, 0xc
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x441c0e
jmp 0x441c08
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x441c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 8
push ebx
push esi
push edi
nop dword [eax]
mov esi, dword [ebp + 8]
xor edi, edi
cmp dword [esi + 0x14], edi
jle 0x441d19
nop
mov ebx, dword [ebp + 0x10]
mov eax, edi
xor eax, 1
mov ecx, edi
cmp edi, 2
cmovl ecx, eax
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x441cdf
mov edx, ecx
mov eax, ebx
mov ecx, dword [esi + 0x10]
add edx, edx
mov bl, byte [ebx]
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x549c60]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x549c60]
sub esi, ecx
jne 0x441d07
sub edx, eax
mov dword [ebp - 4], edx
test bl, bl
je 0x441cd8
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x549c60]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x549c60]
sub esi, edx
mov edx, dword [ebp - 4]
je 0x441cb2
jmp 0x441d07
test esi, esi
jne 0x441d07
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add ecx, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + ecx*8 + 0xc]
add eax, 8
push eax
call fcn.004201b0
add esp, 0xc
mov eax, dword [eax + 8]
test eax, eax
jne 0x441dc9
mov eax, dword [ebp + 8]
inc edi
mov esi, eax
cmp edi, dword [eax + 0x14]
jl 0x441c70
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx]
movzx eax, dl
cmp byte [eax + 0x549c60], 0x73
jne 0x441dc7
mov esi, str.sqlite_master
sub esi, ecx
test dl, dl
je 0x441d5b
movzx eax, byte [esi + ecx + 1]
inc ecx
mov dword [ebp + 0xc], ecx
mov dl, byte [ecx]
movzx ecx, byte [eax + 0x549c60]
movzx eax, dl
movzx eax, byte [eax + 0x549c60]
sub eax, ecx
jne 0x441dc7
mov ecx, dword [ebp + 0xc]
jmp 0x441d32
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x10]
test edi, edi
jne 0x441d71
neg edx
sbb edx, edx
jmp 0x441db6
test edx, edx
je 0x441dc7
movzx eax, byte [edx]
mov esi, edi
mov bl, byte [edi]
movzx ecx, byte [eax + 0x549c60]
movzx eax, bl
movzx eax, byte [eax + 0x549c60]
sub eax, ecx
jne 0x441db4
sub edx, edi
test bl, bl
je 0x441db4
movzx eax, byte [edx + esi + 1]
inc esi
movzx ecx, byte [eax + 0x549c60]
mov bl, byte [esi]
movzx eax, bl
movzx eax, byte [eax + 0x549c60]
sub eax, ecx
je 0x441d93
mov edx, eax
test edx, edx
jne 0x441dc7
mov ecx, str.sqlite_temp_master
mov dword [ebp + 0xc], ecx
jmp 0x441c60
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test byte [ecx + 0x1c], 4
mov edx, dword [ecx + 0x14]
je 0x44c2da
mov eax, dword [edx + 0x18]
cmp eax, dword [ecx + 0x18]
jb 0x44c2da
cmp dword [edx + 0x60], 0
je 0x44c2d6
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.0046ade0
xor eax, eax
pop ebp
ret
mov eax, dword [edx + 0x28]
test eax, eax
jne 0x44c2d8
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x44c2f8
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.0042b000
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.0042c1a0
Function at 0x46efb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x14
mov dword [edi], 0
call fcn.00449f50
mov esi, eax
add esp, 8
test esi, esi
jne 0x46efd7
pop edi
lea eax, [esi + 7]
pop esi
pop ebp
ret
cmp dword [0x586664], 0
push ebx
mov ebx, dword [ebp + 0x10]
je 0x46f022
mov eax, dword [0x586764]
test eax, eax
je 0x46effb
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x46f022
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x4561b0
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.0052685f
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x46f02f
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x46f048
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x47b090
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541a03
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5875a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x589398
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], 0x5518b8
mov dword [ebp - 4], 0
mov dword [ecx], 0x589398
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x54895d
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0047aec0
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret