joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a81c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1000570c
xor ebx, ebx
cmp dword [0x10015dc0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1000a8f2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1000a9d2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1000a9d2
push eax
call fcn.1000569e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10015dc0], eax
call esi
push eax
call fcn.1000569e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10015dc4], eax
call esi
push eax
call fcn.1000569e
mov dword [0x10015dc8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.100084c0
test eax, eax
pop ecx
pop ecx
je 0x1000a8c0
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100082f7
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1000a8f2
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1000569e
cmp eax, ebx
pop ecx
mov dword [0x10015dd0], eax
je 0x1000a8f2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000569e
pop ecx
mov dword [0x10015dcc], eax
mov eax, dword [0x10015dcc]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1000a977
cmp dword [0x10015dd0], ecx
je 0x1000a977
push eax
call fcn.10005715
push dword [0x10015dd0]
mov esi, eax
call fcn.10005715
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1000a977
cmp edi, ebx
je 0x1000a977
call esi
cmp eax, ebx
je 0x1000a944
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000a944
test byte [ebp - 0x18], 1
jne 0x1000a977
lea eax, [ebp - 0x10]
push eax
call fcn.100084f7
test eax, eax
pop ecx
je 0x1000a95f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100082f7
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1000a96e
or dword [ebp + 0x10], 0x200000
jmp 0x1000a9b2
or dword [ebp + 0x10], 0x40000
jmp 0x1000a9b2
mov eax, dword [0x10015dc4]
cmp eax, dword [ebp - 8]
je 0x1000a9b2
push eax
call fcn.10005715
cmp eax, ebx
pop ecx
je 0x1000a9b2
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1000a9b2
mov eax, dword [0x10015dc8]
cmp eax, dword [ebp - 8]
je 0x1000a9b2
push eax
call fcn.10005715
cmp eax, ebx
pop ecx
je 0x1000a9b2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10015dc0]
call fcn.10005715
cmp eax, ebx
pop ecx
je 0x1000a9d2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000a9d4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40892d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
mov edx, 0xd700b604
sub ecx, ecx
call fcn.00408961
xor dword [edi], ebx
and edx, edx
mov ecx, 0xb840bdca
inc edi
sub ecx, 0x6bdd763b
or ecx, edx
cmp edi, esi
jne fcn.0040892d
add ecx, 0x8af4fa1d
ret
Function at 0x401b00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov edi, dword [ebp + 8]
mov eax, dword [0x45a454]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x814], eax
lea esi, [ebp - 0x810]
push 0x800
push 0
push esi
call fcn.004273a0
add esp, 0xc
mov ebx, dword [ebp - 0x814]
call fcn.00402040
mov ecx, dword [eax]
or ecx, 2
push ebx
push 0
push edi
push 0x7fd
push esi
push dword [eax + 4]
push ecx
call fcn.0042a2c8
add esp, 0x1c
test eax, eax
mov edi, 0xffffffff
cmovns edi, eax
push esi
call fcn.0043002a
add esp, 4
mov word [ebp + edi - 0x810], 0xa0d
mov byte [ebp + edi - 0x80e], 0
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d348
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401e70
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x45a454]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x18], 0
je 0x401f02
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 1
push esi
push 0
push 0x450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, 1
test eax, eax
je 0x401f07
mov edi, eax
sub esp, 0x1c
movaps xmm0, xmmword [0x4470f0]
movups xmmword [esp + 4], xmm0
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x401f07
lea ecx, [ebp - 0x1c]
push 0
push 0
push ecx
push 0
push eax
push esi
push edi
call sub.dbghelp.dll_MiniDumpWriteDump
xor ebx, ebx
test eax, eax
sete bl
jmp 0x401f07
mov ebx, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d348
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402240
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x42c
mov eax, dword [0x45a454]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x434]
push 0x424
push 0
push eax
call fcn.004273a0
add esp, 0xc
mov dword [ebp - 0x438], 0x428
push dword [ebp + 8]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea ebx, [ebp - 0x438]
push ebx
push eax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4022aa
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
test eax, eax
je 0x4022bb
cmp eax, 0x5c
jne 0x4022c3
lea edi, [ebp - 0x218]
jmp 0x4022eb
push str.CheckLibraryLoaded:_Failed_to_load_module_snapshot
call fcn.00401b00
add esp, 4
xor ebx, ebx
jmp 0x402318
lea edi, [ebp - 0x418]
jmp 0x4022eb
xor eax, eax
mov ecx, dword [ebp + 0xc]
cmp word [ecx + 2], 0x3a
sete al
shl eax, 9
lea edi, [eax + ebp]
add edi, 0xfffffbe8
jmp 0x4022eb
push ebx
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x4022b7
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x430], eax
jne 0x4022e0
push edi
push dword [ebp + 0xc]
call fcn.0042f313
add esp, 8
test eax, eax
jne 0x4022e0
push dword [ebp + 0xc]
push str.CheckLibraryLoaded:_Module__ls_is_already_loaded
call fcn.00401b00
add esp, 8
mov bl, 1
mov eax, esi
inc eax
cmp eax, 2
jb 0x402327
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d348
mov eax, ebx
add esp, 0x42c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42c5ee
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42c62d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42c62d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42c62d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42c62d
cmp dword [ecx + 0x74], 0xe
jbe 0x42c62d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438006
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44abf0
push 0x44abe8
push str.FlsAlloc
push 0x1f
call fcn.004384b9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43803a
push dword [ebp + 8]
mov ecx, esi
call dword [0x457158]
call esi
jmp 0x438040
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x438084
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44ac00
push 0x44abf8
push str.FlsGetValue
push 0x21
call fcn.004384b9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4380bb
push dword [ebp + 8]
mov ecx, esi
call dword [0x457158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4380c3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44ac08
push 0x44ac00
push str.FlsSetValue
push 0x22
call fcn.004384b9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4380fd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x457158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43cdb7
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x45a454]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004377da
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004377da
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x43ce2e
cmp word [ecx], dx
je 0x43ce2e
mov eax, dword [0x44b07c]
push edi
dec eax
push eax
push 0x44af68
call fcn.0043cfa7
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x43cea1
cmp word [eax], dx
je 0x43cea1
mov eax, dword [edi]
test eax, eax
je 0x43ce52
cmp word [eax], dx
je 0x43ce52
lea eax, [ebp - 0x10]
push eax
call fcn.0043d008
jmp 0x43ce5b
lea eax, [ebp - 0x10]
push eax
call fcn.0043d303
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x43cecb
mov eax, dword [0x44af64]
push dword [ebp - 0x14]
dec eax
push eax
push 0x44ac58
call fcn.0043cfa7
add esp, 0xc
test al, al
je 0x43cecb
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x43ce96
cmp word [eax], di
je 0x43ce96
lea eax, [ebp - 0x10]
push eax
call fcn.0043d008
pop ecx
jmp 0x43cecd
lea eax, [ebp - 0x10]
push eax
call fcn.0043d303
jmp 0x43ce93
mov eax, dword [edi]
test eax, eax
je 0x43ceb8
cmp word [eax], dx
je 0x43ceb8
lea eax, [ebp - 0x10]
push eax
call fcn.0043d445
pop ecx
jmp 0x43cecb
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x43cf96
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0043d537
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x43cf96
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x43cf96
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x43cf96
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43cf23
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004382fc
test ebx, ebx
je 0x43cf91
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004382fc
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43cf96
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43cf96
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00443e49
add esp, 0x10
xor eax, eax
inc eax
jmp 0x43cf98
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d348
leave
ret
Function at 0x43d63d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004377da
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x43d6ac
cmp esi, dword [ebp - 4]
je 0x43d6a7
cmp dword [ebp + 0xc], 0
je 0x43d6a7
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x43d684
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0043d706
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x43d6ae
xor eax, eax
inc eax
jmp 0x43d6ae
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4408c7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x440964
push ebx
push esi
call fcn.004409b5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00437689
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x440911
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x440963
push edi
push eax
call fcn.00437579
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x440931
call fcn.0043753f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x440962
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00437689
add esp, 0x20
test eax, eax
jne 0x440950
push edi
call fcn.0043753f
jmp 0x440958
push ebx
call fcn.0043753f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x440967
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x440978
pop esi
ret
push ebx
push edi
push esi
call fcn.004409b5
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00437579
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4409a0
push ebx
push esi
push edi
call fcn.00426e20
add esp, 0xc
push 0
call fcn.0043753f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4409ec
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004409f7
Function at 0x4025e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40260b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00406f20
add esp, 4
or eax, 0xffffffff
jmp 0x40263a
mov ecx, dword [ebp - 4]
and ecx, 1
test ecx, ecx
je 0x402638
mov edx, dword [ebp + 0xc]
and edx, 2
test edx, edx
je 0x402638
mov dword [0x4255ec], 0xd
mov dword [0x4255f0], 5
or eax, 0xffffffff
jmp 0x40263a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x30032398
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x30033f10
call fcn.3003260e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x3006be98
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x30032188
cmp eax, esi
jne 0x3003217b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x3003218b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30032162
xor esi, esi
inc esi
mov eax, dword [0x3006be94]
cmp eax, esi
jne 0x3003219e
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x300321d9
mov eax, dword [0x3006be94]
test eax, eax
jne 0x300321d3
mov dword [0x3006be94], esi
push 0x3000130c
push 0x30001300
call fcn.3018a000
pop ecx
pop ecx
test eax, eax
je 0x300321d9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x300322b0
mov dword [0x3006bb50], esi
mov eax, dword [0x3006be94]
cmp eax, esi
jne 0x300321fd
push 0x300012fc
push 0x300012e4
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x3006be94], 2
cmp dword [ebp - 0x1c], ebx
jne 0x3003220a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x3006bea4], ebx
je 0x3003222b
push 0x3006bea4
call fcn.300329cc
pop ecx
test eax, eax
je 0x3003222b
push ebx
push 2
push ebx
call dword [0x3006bea4]
mov eax, dword [0x3006bb38]
mov ecx, dword [sym.imp.MSVCR80.dll___winitenv]
mov dword [ecx], eax
push dword [0x3006bb38]
push dword [0x3006bb3c]
push dword [0x3006bb34]
call fcn.3001d9bd
add esp, 0xc
mov dword [0x3006bb4c], eax
cmp dword [0x3006bb40], ebx
jne 0x30032296
push eax
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x3006bb50], ebx
jne 0x300322a4
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3006bb4c]
call fcn.30032653
ret
call fcn.30032029
jmp 0x30032140
Function at 0x61e6310a
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x61e63145
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x61e6312c
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x61e6313d
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x61e63147
inc edi
add eax, 0x28
cmp edi, esi
jb 0x61e63122
xor eax, eax
pop edi
pop esi
ret

Function at 0x61e632dd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aaa
push eax
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.61e630ca
push edi
sub byte [eax + 0x478b66f0], dh
push es
cmp ax, bx
jbe 0x61e63324
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x61e6331e
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x61e6330f
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.61e630ca
stc
mov edx, 0x458db37a
test al, 0x50
call fcn.61e630da
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.61e6308f
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x61e633b8
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.61e630ca
invalid
Function at 0x61e634ed
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.61e630da
push eax
push esi
push dword [ebp + 8]
call fcn.61e6308f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.61e630ca
mov ah, 0x2d
int3
Function at 0x61e6e25f
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x6c
mov dword [ebp - 0x4c], eax
lea eax, [eax + edx*4]
mov dword [ebp - 0x54], ecx
cmp dword [eax + 0x1c], 0
mov dword [ebp - 0x50], eax
jne 0x61e6e3f4
mov eax, dword [ebp - 0x4c]
cmp edx, 0xa
lea edi, [ebp - 0x44]
mov esi, 0x61e8b2c0
mov ecx, 0xb
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax]
ja case.0x61e6e29f.5
jmp dword [edx*4 + 0x61e91c28]
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
jmp 0x61e6e38a
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp + edx*4 - 0x44]
mov dword [esp], eax
call sym.sqlite3.dll_sqlite3_mprintf
jmp 0x61e6e392
mov eax, dword [esi + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym.sqlite3.dll_sqlite3_mprintf
jmp 0x61e6e392
mov eax, dword [esi + 0xc]
lea edi, [eax + 1]
lea eax, [edi + edi + 1]
mov dword [esp], eax
call sym.sqlite3.dll_sqlite3_malloc
mov edx, eax
xor eax, eax
test edx, edx
jne 0x61e6e333
mov ebx, 7
jmp 0x61e6e3f4
cmp eax, edi
jge 0x61e6e343
mov byte [edx + eax*2], 0x3f
mov byte [edx + eax*2 + 1], 0x2c
inc eax
jmp 0x61e6e333
mov byte [edx + eax*2 - 1], 0
mov dword [esp + 0xc], edx
mov eax, dword [esi + 8]
mov dword [ebp - 0x58], edx
mov dword [esp + 8], eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp + ebx*4 - 0x44]
mov dword [esp], eax
call sym.sqlite3.dll_sqlite3_mprintf
mov edx, dword [ebp - 0x58]
mov edi, eax
mov dword [esp], edx
call sym.sqlite3.dll_sqlite3_free
jmp 0x61e6e394
mov eax, dword [esi + 8]
mov dword [esp + 8], eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp + ebx*4 - 0x44]
mov dword [esp], eax
call sym.sqlite3.dll_sqlite3_mprintf
mov edi, eax
test edi, edi
je 0x61e6e329
mov eax, dword [ebp - 0x4c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edi
lea eax, [eax + ebx*4 + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov dword [esp], eax
call sym.sqlite3.dll_sqlite3_prepare_v2
mov dword [esp], edi
mov ebx, eax
call sym.sqlite3.dll_sqlite3_free
test ebx, ebx
je 0x61e6e3f4
cmp dword [ebp + 8], 0
je 0x61e6e3f4
mov eax, dword [esi]
mov dword [esp], eax
call sym.sqlite3.dll_sqlite3_errmsg
mov dword [esp], 0x61e8dab0
mov dword [esp + 4], eax
call sym.sqlite3.dll_sqlite3_mprintf
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
mov eax, dword [eax + 0x1c]
mov dword [ecx], eax
mov dword [esp], eax
call sym.sqlite3.dll_sqlite3_reset
add esp, 0x6c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret