joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027d5
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Get file attributes
Read file on windows

Disassembly:
push 0x14c
mov eax, 0x4ce602
call fcn.004a9f73
mov dword [ebp - 0x158], edx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x134]
push eax
mov dword [ebp - 0x150], eax
xor edi, edi
xor esi, esi
xor bl, bl
call fcn.00404860
xor eax, eax
mov dword [ebp - 4], eax
push 0x103
push eax
mov byte [ebp - 0x11c], al
lea eax, [ebp - 0x11b]
push eax
call fcn.004aa670
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x11c]
push eax
push esi
push 0x4dce2c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x150]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4028a5
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4028a5
lea eax, [ebp - 0x11c]
push eax
call fcn.00404843
pop ecx
push eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x134]
call fcn.004047ca
and dword [ebp - 0x154], 0
lea eax, [ebp - 0x134]
cmp dword [ebp - 0x120], 0x10
push 0x4dce30
cmovae eax, dword [ebp - 0x134]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.004a52cd
add esp, 0xc
test eax, eax
jne 0x40295d
push dword [ebp - 0x154]
call fcn.004a5312
pop ecx
push eax
call fcn.004a5336
pop ecx
mov esi, eax
mov dword [ebp - 0x150], 0x1400
lea eax, [ebp - 0x150]
push eax
push eax
push str.FileLimitSizeKB
push str.CInfos
call fcn.0044a20d
mov ecx, eax
call fcn.0044a277
mov eax, dword [ebp - 0x150]
shl eax, 0xa
cmp esi, eax
jbe 0x40292e
xor bl, bl
jmp 0x4029df
test esi, esi
je 0x40294f
push esi
call fcn.0048f9a2
pop ecx
push dword [ebp - 0x154]
mov edi, eax
push esi
push 1
push edi
call fcn.004a5614
add esp, 0x10
mov esi, eax
push dword [ebp - 0x154]
call fcn.004a572c
pop ecx
jmp 0x40299f
push dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
push 0
push str.ABLOGType:FileOpenFailedFileSize:_ldPath:_s
push eax
call fcn.00461e62
add esp, 0x10
push eax
push ecx
mov byte [ebp - 4], 1
call fcn.0044d523
pop ecx
mov ecx, eax
call fcn.0044daa1
push 0
push 1
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0
call fcn.00404b60
test edi, edi
je 0x4029cb
test esi, esi
je 0x4029cb
push esi
push edi
push dword [ebp - 0x158]
push str.HISTORY
call fcn.0044d523
mov ecx, eax
call fcn.0044d9de
test al, al
movzx ebx, bl
push 1
pop eax
cmovne ebx, eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call fcn.004a43b1
pop ecx
xor eax, eax
lea ecx, [ebp - 0x134]
push 0
inc eax
push eax
call fcn.00404b60
mov al, bl
call fcn.004a9f22
ret
Function at 0x402e95
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ce6f2
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x5154b0]
xor eax, esp
mov dword [esp + 0x178], eax
push ebx
push esi
push edi
mov eax, dword [0x5154b0]
xor eax, esp
push eax
lea eax, [esp + 0x190]
mov dword fs:[0], eax
push 0xf
xor ebx, ebx
pop edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
push 0x103
lea eax, [esp + 0x81]
mov dword [esp + 0x19c], ebx
push ebx
push eax
mov byte [esp + 0x88], bl
call fcn.004aa670
add esp, 0xc
lea eax, [esp + 0x7c]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
js 0x4030bc
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x68]
call fcn.00404860
mov esi, str.TencentQQMisc
mov byte [esp + 0x198], 1
push esi
call fcn.00404843
pop ecx
push eax
push esi
lea ecx, [esp + 0x6c]
call fcn.004042ee
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
push 0x4e77ae
lea ecx, [esp + 0x50]
mov byte [esp + 0x19c], 2
call fcn.00404860
lea eax, [esp + 0x4c]
mov byte [esp + 0x198], 3
push 1
push eax
lea edx, [esp + 0x6c]
lea ecx, [esp + 0x18]
call fcn.0045cc1c
pop ecx
pop ecx
mov ebx, eax
mov byte [esp + 0x198], 2
push 0
neg ebx
lea ecx, [esp + 0x50]
push 1
sbb bl, bl
call fcn.00404b60
inc bl
je 0x402fc8
push str.CollectHisQQUsers__out__findfiles
push ecx
call fcn.0044d523
pop ecx
push eax
call fcn.0044d561
pop ecx
pop ecx
xor bl, bl
jmp 0x4030a6
xor ebx, ebx
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
mov byte [esp + 0x198], 4
mov esi, dword [esp + 0x10]
cmp esi, dword [esp + 0x14]
je 0x40305c
lea edx, [esp + 0x34]
mov ecx, esi
call fcn.0045ce88
cmp dword [esp + 0x48], 0x10
lea eax, [esp + 0x34]
cmovae eax, dword [esp + 0x34]
push eax
call fcn.004a57b7
pop ecx
test eax, eax
jle 0x403048
push 0x4dcae4
lea edx, [esp + 0x38]
lea ecx, [esp + 0x50]
call fcn.00403ad6
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1a4], 5
call fcn.00404390
push ebx
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0x1a0], 4
call fcn.00404b60
add esi, 0x18
cmp esi, dword [esp + 0x14]
jne 0x402fe8
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x403060
lea eax, [esp + 0x1c]
push dword [esp + 0x2c]
push eax
push 0x4e77ae
push str.QQUSERS
call fcn.0044d523
mov ecx, eax
call fcn.0044d9de
movzx eax, al
push eax
push str.CollectHisQQUsers__out_:ret:_d
mov dword [0x51b178], eax
call fcn.0044d523
push eax
call fcn.0044d561
add esp, 0xc
lea ecx, [esp + 0x34]
mov bl, 1
push 0
push 1
call fcn.00404b60
lea ecx, [esp + 0x10]
call fcn.004044a7
push 0
push 1
lea ecx, [esp + 0x6c]
call fcn.00404b60
push 0
push 1
lea ecx, [esp + 0x24]
call fcn.00404b60
mov al, bl
mov ecx, dword [esp + 0x190]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x178]
xor ecx, esp
call fcn.004a41df
mov esp, ebp
pop ebp
ret
Function at 0x403460
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ce7bc
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5154b0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x5154b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
push 0x6c
lea edx, [esp + 0x14]
mov dword [esp + 0x3c], ebx
pop ecx
call fcn.0045b5db
mov esi, str.config.ini
push esi
call fcn.00404843
pop ecx
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.004042ee
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
push ebx
push str.puremodule
push str.KwExternal
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea esi, [eax - 1]
neg esi
sbb esi, esi
inc esi
push esi
push str.IsPureModule:_d
call fcn.0044d523
push eax
call fcn.0044d561
add esp, 0xc
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.00404b60
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004a41df
mov esp, ebp
pop ebp
ret
Function at 0x403536
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ce7ef
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x5154b0]
xor eax, esp
mov dword [esp + 0x368], eax
push ebx
push esi
push edi
mov eax, dword [0x5154b0]
xor eax, esp
push eax
lea eax, [esp + 0x380]
mov dword fs:[0], eax
mov dword [esp + 0x1c], edx
mov esi, ecx
mov edi, 0x128
lea eax, [esp + 0x24]
push edi
push 0
push eax
call fcn.004aa670
add esp, 0xc
mov dword [esp + 0x24], edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4035ad
xor al, al
jmp 0x40369e
push esi
lea ecx, [esp + 0x14]
call fcn.0040374a
and dword [esp + 0x388], 0
mov eax, dword [esp + 0x10]
mov esi, eax
cmp eax, dword [esp + 0x14]
je 0x4035e7
cmp dword [esi + 0x14], 0x10
jb 0x4035d5
mov eax, dword [esi]
jmp 0x4035d7
mov eax, esi
push eax
call fcn.004a5ab7
add esi, 0x18
pop ecx
cmp esi, dword [esp + 0x14]
jne 0x4035cb
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x40368a
xor ebx, ebx
inc ebx
mov eax, dword [esp + 0x10]
mov esi, eax
cmp eax, dword [esp + 0x14]
je 0x403676
lea eax, [esp + 0x48]
push eax
call fcn.004a5ab7
pop ecx
lea edx, [esp + 0x48]
mov ecx, esi
call fcn.00403ab4
test al, al
je 0x40366d
push 0x224
lea eax, [esp + 0x150]
push 0
push eax
call fcn.004aa670
add esp, 0xc
mov dword [esp + 0x14c], 0x224
push dword [esp + 0x2c]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40366d
lea ecx, [esp + 0x14c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Module32First]
cmp eax, ebx
je 0x4036c2
add esi, 0x18
cmp esi, dword [esp + 0x14]
jne 0x40360a
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4035fe
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea ecx, [esp + 0x10]
call fcn.004044a7
mov al, bl
mov ecx, dword [esp + 0x380]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x368]
xor ecx, esp
call fcn.004a41df
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x26c]
push eax
call fcn.004a5ab7
mov esi, eax
push esi
call fcn.00404843
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
push eax
push esi
call fcn.004047ca
push dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
jmp 0x403693
Function at 0x405655
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5154b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov edi, ecx
push eax
call fcn.004052c3
lea esi, [edi + 0x104]
push eax
mov ecx, esi
call fcn.004036f5
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push 1
call fcn.00404b60
cmp dword [edi + 0x114], ebx
jne 0x40569a
xor eax, eax
jmp 0x405705
cmp dword [esi + 0x14], 0x10
jb 0x4056a2
mov esi, dword [esi]
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4056e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xe8
push str.CSongCollect::CheckFileIsExit
push str.__s:_d___open_file_failed__err___d
call fcn.0044d523
push eax
call fcn.0044d561
add esp, 0x14
mov ecx, edi
call fcn.00405023
jmp 0x405696
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0x11c], eax
test esi, esi
je 0x405702
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a41df
mov esp, ebp
pop ebp
ret

Function at 0x405716
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5154b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x107]
xor ebx, ebx
push 0x103
push ebx
push eax
mov dword [ebp - 0x10c], ebx
mov byte [ebp - 0x108], bl
call fcn.004aa670
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
push eax
push ebx
push 0x4e7940
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.00404860
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a41df
mov esp, ebp
pop ebp
ret 4
Function at 0x405799
Capabilities:
Delete file

Disassembly:
push 0x1ec
mov eax, 0x4ceb0d
call fcn.004a9f73
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x9c], ebx
jne 0x4057bb
xor eax, eax
jmp 0x4059d8
call fcn.00405655
test eax, eax
je 0x4057cc
xor eax, eax
inc eax
jmp 0x4059d8
lea eax, [ebp - 0x134]
push eax
call fcn.00405716
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x124], 0
je 0x4059c6
cmp dword [ebp - 0x120], 0x10
lea edx, [ebp - 0x134]
lea ecx, [edi + 0x8c]
cmovae edx, dword [ebp - 0x134]
cmp dword [ecx + 0x14], 0x10
jb 0x40580a
mov ecx, dword [ecx]
call fcn.0044c6c9
test eax, eax
je 0x4059a7
lea ecx, [ebp - 0x1ec]
mov dword [ebp - method.MD5_CTX.virtual_0], vtable.MD5_CTX.0
call fcn.0045dfab
push 0x103
lea eax, [ebp - 0x11b]
mov byte [ebp - 4], 1
push ebx
push eax
mov byte [ebp - 0x11c], bl
call fcn.004aa670
add esp, 0xc
lea eax, [ebp - 0x134]
cmp dword [ebp - 0x120], 0x10
lea ecx, [ebp - 0x1ec]
cmovae eax, dword [ebp - 0x134]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0045dfe4
lea eax, [ebp - 0x11c]
push eax
lea ebx, [edi + 0xec]
call fcn.00404843
pop ecx
push eax
lea eax, [ebp - 0x11c]
mov ecx, ebx
push eax
call fcn.004047ca
lea esi, [edi + 0x104]
lea eax, [ebp - 0x134]
cmp esi, eax
je 0x4058b0
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00404ac2
cmp dword [edi + 0x4c], 0
je 0x40595f
lea eax, [ebp - 0x14c]
push eax
call fcn.00405716
xor eax, eax
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x1f0], eax
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1f8]
call fcn.004062e6
lea edx, [ebp - 0x14c]
lea ecx, [ebp - 0x1f8]
call fcn.00452d56
lea ecx, [ebp - 0x1f8]
test al, al
je 0x405947
mov byte [ebp - 4], 2
call fcn.004044a7
cmp dword [ebp - 0x138], 0x10
lea eax, [ebp - 0x14c]
cmovae eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x14c]
cmp esi, eax
je 0x40594c
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00404ac2
jmp 0x40594c
call fcn.004044a7
push 0
push 1
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 1
call fcn.00404b60
lea eax, [edi + 0xa4]
mov ecx, edi
push eax
push ebx
push esi
call fcn.00404d76
cmp dword [ebx + 0x14], 0x10
jb 0x405977
mov ebx, dword [ebx]
cmp dword [esi + 0x14], 0x10
jb 0x40597f
mov esi, dword [esi]
push ebx
push esi
push 0x13d
push str.CSongCollect::UpdownAudioData
push str.__s:_d__DownFile_is_Success_FilePath:_s__MD5:_s
push ecx
call fcn.0044d523
pop ecx
push eax
call fcn.0044d561
xor esi, esi
add esp, 0x18
inc esi
xor ebx, ebx
jmp 0x4059c8
push 0x142
push str.CSongCollect::UpdownAudioData
push str.__s:_d__DownFile_is_failed
push ecx
call fcn.0044d523
pop ecx
push eax
call fcn.0044d561
add esp, 0x10
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x134]
call fcn.00404b60
mov eax, esi
call fcn.004a9f22
ret
Function at 0x40b98e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], 1
mov esi, ecx
mov dword [ebp - 0xc], edi
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
movsd qword [ebp - 0x20], xmm0
jmp 0x40b9b2
inc esi
movsx eax, byte [esi]
push eax
call fcn.004a6762
pop ecx
test eax, eax
jne 0x40b9b1
mov al, byte [esi]
cmp al, 0x2d
jne 0x40b9cc
or dword [ebp - 0x10], 0xffffffff
jmp 0x40b9f9
cmp al, 0x2b
jne 0x40b9fa
jmp 0x40b9f9
movsx eax, byte [esi]
movsd xmm1, qword [ebp - 0x20]
sub eax, 0x30
mulsd xmm1, qword [0x4f1d20]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm1
movaps xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
inc esi
movzx eax, byte [esi]
push eax
call fcn.004a66e1
pop ecx
test eax, eax
jne 0x40b9d2
cmp byte [esi], 0x2e
movsd xmm0, qword [0x4f1cf8]
movsd qword [ebp - 0x28], xmm0
jne 0x40ba78
movsd qword [ebp - 8], xmm0
jmp 0x40ba5a
movsx eax, byte [esi]
movsd xmm1, qword [ebp - 0x20]
sub eax, 0x30
mulsd xmm1, qword [0x4f1d20]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm1
movaps xmm1, xmm0
movsd xmm0, qword [ebp - 8]
mulsd xmm0, qword [0x4f1d20]
movsd qword [ebp - 0x20], xmm1
movsd qword [ebp - 8], xmm0
inc esi
movzx eax, byte [esi]
push eax
call fcn.004a66e1
pop ecx
test eax, eax
jne 0x40ba21
movsd xmm0, qword [ebp - 0x20]
divsd xmm0, qword [ebp - 8]
movsd qword [ebp - 0x20], xmm0
mov al, byte [esi]
cmp al, 0x65
je 0x40ba86
cmp al, 0x45
jne 0x40bb68
xor edi, edi
mov dword [ebp - 4], 1
inc esi
mov al, byte [esi]
cmp al, 0x2d
jne 0x40ba9c
or dword [ebp - 4], 0xffffffff
jmp 0x40baa0
cmp al, 0x2b
jne 0x40baa1
inc esi
movzx eax, byte [esi]
push eax
call fcn.004a66e1
pop ecx
test eax, eax
je 0x40bb47
imul ecx, edi, 0xa
movsx edi, byte [esi]
add ecx, 0xffffffd0
add edi, ecx
inc esi
movzx eax, byte [esi]
push eax
call fcn.004a66e1
pop ecx
test eax, eax
jne 0x40bab3
movsd xmm0, qword [0x4f1cf8]
cmp edi, 0x40
jl 0x40baf4
mov ecx, edi
shr ecx, 6
imul eax, ecx, 0xffffffc0
add edi, eax
mulsd xmm0, qword [0x4f1e28]
dec ecx
jne 0x40bae4
movsd qword [ebp - 0x28], xmm0
cmp edi, 0x10
jl 0x40bb13
mov ecx, edi
shr ecx, 4
imul eax, ecx, 0xfffffff0
add edi, eax
mulsd xmm0, qword [0x4f1e10]
dec ecx
jne 0x40bb03
movsd qword [ebp - 0x28], xmm0
cmp edi, 4
jl 0x40bb32
mov ecx, edi
shr ecx, 2
imul eax, ecx, 0xfffffffc
add edi, eax
mulsd xmm0, qword [0x4f1d98]
dec ecx
jne 0x40bb22
movsd qword [ebp - 0x28], xmm0
cmp edi, 1
jl 0x40bb47
mulsd xmm0, qword [0x4f1d20]
dec edi
jne 0x40bb37
movsd qword [ebp - 0x28], xmm0
cmp dword [ebp - 4], 0
mov edi, dword [ebp - 0xc]
jge 0x40bb5c
movsd xmm0, qword [ebp - 0x20]
divsd xmm0, qword [ebp - 0x28]
jmp 0x40bb6d
movsd xmm0, qword [ebp - 0x28]
mulsd xmm0, qword [ebp - 0x20]
jmp 0x40bb6d
movsd xmm0, qword [ebp - 0x20]
cmp dword [ebp - 0x10], 0
jge 0x40bb7b
xorpd xmm0, xmmword [0x4f1ec0]
sub esi, dword [ebp - 0x14]
movsd qword [edi], xmm0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c6ca
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebx
push esi
xor ebx, ebx
call fcn.0040c68e
mov esi, eax
test esi, esi
jne 0x40c6de
push 7
pop eax
jmp 0x40c751
push edi
call fcn.0040c4ab
push esi
test eax, eax
je 0x40c733
jmp 0x40c708
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c73f
mov eax, ebx
inc ebx
cmp eax, 3
jge 0x40c73f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
je 0x40c6eb
jmp 0x40c73f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c73f
mov eax, ebx
inc ebx
cmp eax, 3
jge 0x40c73f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
test edi, edi
je 0x40c716
push esi
call fcn.0040b5df
pop ecx
push 0xa
xor ecx, ecx
test edi, edi
pop eax
cmovne eax, ecx
pop edi
pop esi
pop ebx
ret

Function at 0x40c754
Capabilities:
Get file attributes

Disassembly:
push esi
call fcn.0040c68e
mov esi, eax
test esi, esi
jne 0x40c765
push 7
pop eax
pop esi
ret
push ebx
call fcn.0040c4ab
push esi
test eax, eax
je 0x40c778
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x40c77e
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, 0xffffffff
push esi
setne bl
call fcn.0040b5df
pop ecx
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x40c9ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x5154b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x51923c]
push ebx
push esi
push edi
mov edi, ecx
test eax, eax
je 0x40c9e8
push 0x118
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004a6ad0
add esp, 0xc
mov byte [ebp - 0x24], 0
jmp 0x40ca5f
call fcn.0040c4ab
mov esi, 0x118
test eax, eax
je 0x40ca29
lea eax, [ebp - 0x3a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x3a8]
call fcn.0040c55d
mov ebx, eax
test ebx, ebx
jne 0x40ca44
push 7
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a41df
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x274]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x274]
call fcn.0040c616
jmp 0x40ca0f
push esi
lea eax, [ebp - 0x13c]
push ebx
push eax
call fcn.004a6ad0
push ebx
mov byte [ebp - 0x24], 0
call fcn.0040b5df
add esp, 0x10
lea ecx, [ebp - 0x13c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ca68
sub ecx, edx
test ecx, ecx
jle 0x40ca87
lea eax, [ebp - 0x13c]
cmp byte [eax + ecx - 1], 0x5c
jne 0x40ca87
dec ecx
test ecx, ecx
jg 0x40ca7b
cmp ecx, 0x136
jae 0x40caf3
mov byte [ebp + ecx - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
push str._setilqs_
push edi
call fcn.004a624c
mov esi, edi
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40cab1
sub esi, ecx
push 0xf
pop ecx
lea edx, [edi + esi]
call fcn.0040ad94
push 0xf
pop ecx
movzx eax, byte [edi + esi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc esi
dec ecx
jne 0x40cac8
mov byte [edi + esi], cl
mov ecx, edi
call fcn.0040c754
test eax, eax
jne 0x40ca97
jmp 0x40ca18
call fcn.004a6d2c
int3

Function at 0x40cd3a
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x40cd45
xor eax, eax
pop esi
ret
call fcn.0040c4ab
test eax, eax
jne 0x40cd64
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40cd53
sub ecx, edx
cmp ecx, 0x104
ja 0x40cd41
mov ecx, esi
call fcn.0040c68e
mov esi, eax
test esi, esi
jne 0x40cd76
push 7
pop eax
pop esi
ret
push ebx
call fcn.0040c4ab
push esi
test eax, eax
je 0x40cd89
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x40cd8f
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
mov ebx, eax
call fcn.0040b5df
pop ecx
cmp ebx, 0xffffffff
jne 0x40cda1
xor eax, eax
jmp 0x40cdaa
movsx eax, bl
and eax, 0x10
shr eax, 4
pop ebx
pop esi
ret
Function at 0x41d1b2
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov edi, ecx
test edi, edi
jne 0x41d1bd
xor eax, eax
pop edi
ret
push esi
push 0x44
pop ecx
call fcn.0040b591
mov esi, eax
test esi, esi
je 0x41d266
mov al, byte [edi + 5]
mov byte [esi + 5], al
mov ecx, dword [edi]
call fcn.0041cf55
mov dword [esi], eax
mov ecx, dword [edi + 0xc]
call fcn.0041d01e
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
call fcn.0041ce90
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
call fcn.0041cf55
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 0x18]
call fcn.0041ce90
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
call fcn.0041cf55
mov dword [esi + 0x1c], eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov ecx, dword [edi + 0x20]
call fcn.0041d1b2
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x28]
call fcn.0041ce90
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
call fcn.0041ce90
or ecx, 0xffffffff
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov al, byte [edi + 6]
mov byte [esi + 6], al
mov al, byte [edi + 7]
mov byte [esi + 7], al
xor eax, eax
mov word [esi + 8], ax
mov dword [esi + 0x24], eax
mov eax, esi
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
pop esi
pop edi
ret
Function at 0x434a4a
Capabilities:
Reference sql statements

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
cmp edi, 2
jge 0x434a5a
push 0x17
pop eax
jmp 0x434abe
movzx eax, byte [ebx + edi - 1]
movzx ecx, byte [ebx]
push esi
push 0x7f
movzx eax, byte [eax + 0x4dd570]
movzx ecx, byte [ecx + 0x4dd570]
imul eax, eax, 3
shl ecx, 2
xor eax, ecx
xor eax, edi
cdq
pop ecx
idiv ecx
movzx esi, byte [edx + str._OjZ]
jmp 0x434ab7
movzx eax, byte [esi + 0x4dd180]
cmp eax, edi
jne 0x434ab0
movzx ecx, word [esi*2 + 0x4dfdf0]
mov edx, ebx
push edi
add ecx, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHEREVIRTUAL
call fcn.0040b869
pop ecx
test eax, eax
je 0x434ac1
movzx esi, byte [esi + 0x4dda00]
dec esi
jns 0x434a8a
push 0x17
pop eax
pop esi
pop edi
pop ebx
ret
movzx eax, byte [esi + 0x4deaa8]
jmp 0x434abd