joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006f8d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, eax
mov esi, ecx
mov ebx, dword [esi + 0x34]
push edi
push esi
lea eax, [esp + 0x28]
mov dword [esp + 0x24], ebx
call fcn.10021450
movzx eax, word [esp + 0x3c]
mov ecx, dword [ebp + 8]
mov word [ecx], ax
mov ax, word [esp + 0x3a]
add esp, 8
test ax, ax
je 0x1006f97e
movzx ecx, word [esi + 0x14]
add ecx, dword [esi + 0x38]
movzx edx, ax
lea eax, [edx + edi]
lea edx, [eax + 3]
cmp edx, ecx
jbe 0x1006f943
push 0x100b88d4
push 0xe3f5
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx esi, byte [eax]
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl esi, 8
or esi, ecx
mov ecx, dword [ebx + 0x24]
shl esi, 8
or esi, edx
movzx edx, word [esp + 0x30]
shl esi, 8
or esi, eax
mov eax, dword [esp + 0x2c]
sub eax, edx
sub ecx, 4
xor edx, edx
lea eax, [eax + ecx - 1]
div ecx
test eax, eax
jne 0x1006f998
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor ecx, ecx
dec eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
cmp esi, 2
jb 0x1006faad
cmp esi, dword [ebx + 0x2c]
ja 0x1006faad
cmp eax, ecx
je 0x1006f9de
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
mov edi, ebx
call fcn.1006e0b0
add esp, 0xc
test eax, eax
jne 0x1006f980
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x1006fa14
mov ecx, dword [ebx]
mov eax, esi
call fcn.10021c80
test eax, eax
je 0x1006fa0c
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp esi, 1
mov dword [ecx + 0x44], eax
setne al
dec al
and al, 0x64
mov dword [ecx + 0x38], edx
mov dword [ecx + 0x34], ebx
mov dword [ecx + 0x48], esi
mov byte [ecx + 6], al
jmp 0x1006fa0e
xor ecx, ecx
mov edi, ecx
test ecx, ecx
je 0x1006fa3e
mov ecx, dword [edi + 0x44]
cmp word [ecx + 0x1a], 1
je 0x1006fa3e
push 0x100b88d4
push 0xe417
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x10
mov ebx, 0xb
jmp 0x1006fa4c
push esi
push ebx
mov eax, edi
call fcn.1006d490
add esp, 8
mov ebx, eax
test edi, edi
je 0x1006fa89
mov eax, dword [edi + 0x44]
test eax, eax
je 0x1006fa89
test byte [eax + 0x18], 0x40
mov esi, dword [eax + 0x10]
je 0x1006fa69
mov ecx, eax
call fcn.1001cc40
jmp 0x1006fa6e
call fcn.1001d7d0
cmp dword [esi + 0x78], 0
jne 0x1006fa89
mov edx, dword [esi + 0xdc]
cmp dword [edx + 0xc], 0
jne 0x1006fa89
push esi
call fcn.10069eb0
add esp, 4
test ebx, ebx
jne 0x1006faa4
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], ebx
jne 0x1006f990
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100b88d4
push 0xe403
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x10
pop edi
pop esi
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10071cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
mov al, byte [esi + 0x49]
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
cmp al, 3
jb 0x10071d09
cmp al, 4
jne 0x10071cf7
mov eax, dword [esi + 0x44]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x38]
push eax
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov dword [esi + 0x38], ebx
mov byte [esi + 0x49], bl
movzx eax, word [esi + 0x4c]
test ax, ax
jl 0x10071db1
je 0x10071df8
lea esp, [esp]
movzx eax, word [esi + 0x4c]
movsx ecx, ax
mov ecx, dword [esi + ecx*4 + 0x78]
dec eax
mov word [esi + 0x4c], ax
test ecx, ecx
je 0x10071da4
mov eax, dword [ecx + 0x44]
test byte [eax + 0x18], 0x40
mov edi, dword [eax + 0x10]
je 0x10071d84
dec dword [edi + 0x78]
mov edx, dword [edi + 0x88]
mov dword [eax + 0xc], edx
mov ecx, dword [edi + 0x3c]
mov dword [edi + 0x88], eax
mov ebx, dword [ecx]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [eax + 0x14]
mov eax, dword [edi + 0x98]
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.100083f0
push edx
mov edx, dword [ebx + 0x48]
push eax
mov eax, dword [edi + 0x3c]
push eax
call edx
mov ebx, dword [esp + 0x1c]
add esp, 0x10
jmp 0x10071d89
call fcn.1001d7d0
cmp dword [edi + 0x78], 0
jne 0x10071da4
mov eax, dword [edi + 0xdc]
cmp dword [eax + 0xc], 0
jne 0x10071da4
push edi
call fcn.10069eb0
add esp, 4
cmp word [esi + 0x4c], 0
jne 0x10071d20
jmp 0x10071df8
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x10071dc4
mov byte [esi + 0x49], bl
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [esi + 0x48]
mov eax, dword [esi]
mov ebx, dword [eax + 4]
add ecx, ecx
not ecx
and ecx, 2
push ecx
lea edx, [esi + 0x78]
push edx
call fcn.1006e550
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10071df2
mov byte [esi + 0x49], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov word [esi + 0x4c], cx
mov eax, dword [esi + 0x78]
cmp byte [eax], 0
je 0x10071e86
movzx ecx, byte [eax + 2]
xor edx, edx
cmp dword [esi + 0x10], edx
sete dl
cmp edx, ecx
jne 0x10071e86
and byte [esi + 0x48], 0xf1
xor edx, edx
xor ecx, ecx
mov word [esi + 0x4e], dx
mov word [esi + 0x2c], cx
cmp word [eax + 0x12], cx
jbe 0x10071e37
mov byte [esi + 0x49], 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [eax + 5], cl
jne 0x10071e7a
mov ebx, 1
cmp dword [eax + 0x48], ebx
je 0x10071e57
mov eax, 0xdfb2
call fcn.10063100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx edx, byte [eax + 6]
mov eax, dword [eax + 0x38]
lea ecx, [edx + eax + 8]
call fcn.100163d0
mov edi, eax
mov byte [esi + 0x49], bl
call fcn.1006fb00
mov ebx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x49], cl
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100b88d4
push 0xdfa7
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x10
pop edi
pop esi
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10074430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
push edi
mov dword [esp + 0x10], eax
cmp esi, ebx
je 0x100744b0
cmp byte [esi + 9], al
je 0x1007445f
inc dword [esi + 0xc]
cmp byte [esi + 0xa], al
jne 0x1007445f
mov edi, esi
call fcn.10021630
mov eax, dword [esi + 4]
mov edi, dword [eax + 8]
mov dword [esp + 0x1c], edi
cmp edi, ebx
je 0x1007449b
lea ecx, [ecx]
cmp dword [ebp + 0x10], ebx
je 0x100744b7
test byte [edi + 0x48], 1
jne 0x100744b7
cmp byte [edi + 0x49], 1
jne 0x100744d0
mov eax, edi
call fcn.10072000
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x100744d0
push ebx
push eax
push esi
call fcn.10074430
add esp, 0xc
cmp byte [esi + 9], 0
je 0x100744ac
add dword [esi + 0xc], 0xffffffff
jne 0x100744ac
call fcn.1001c5c0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x38]
push ecx
call sym.SQLite.Interop.dll_sqlite3_free
mov edx, dword [ebp + 0xc]
add esp, 4
mov dword [edi + 0x38], ebx
mov byte [edi + 0x49], 4
mov dword [edi + 0x44], edx
xor eax, eax
cmp ax, word [edi + 0x4c]
mov dword [esp + 0x14], ebx
jg 0x10074585
lea ebx, [edi + 0x78]
mov dword [esp + 0x18], ebx
mov eax, dword [ebx]
test eax, eax
je 0x1007455e
mov eax, dword [eax + 0x44]
test byte [eax + 0x18], 0x40
mov esi, dword [eax + 0x10]
je 0x1007453e
dec dword [esi + 0x78]
mov ecx, dword [esi + 0x88]
mov dword [eax + 0xc], ecx
mov edi, dword [esi + 0x3c]
mov dword [esi + 0x88], eax
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0x14]
mov eax, dword [esi + 0x98]
mov ebx, dword [edi]
push edx
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.100083f0
push edx
mov edx, dword [ebx + 0x48]
push eax
push edi
call edx
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
add esp, 0x10
jmp 0x10074543
call fcn.1001d7d0
cmp dword [esi + 0x78], 0
jne 0x1007455e
mov eax, dword [esi + 0xdc]
cmp dword [eax + 0xc], 0
jne 0x1007455e
push esi
call fcn.10069eb0
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [ebx], 0
movsx ecx, word [edi + 0x4c]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
jle 0x100744e7
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [edi + 8]
mov dword [esp + 0x1c], edi
cmp edi, ebx
jne 0x10074470
jmp 0x1007449b
Function at 0x1007aa20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x100ca170]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x24]
add edx, edx
mov eax, 0xaaaaaaab
mul edx
push esi
push edi
xor ecx, ecx
mov edi, edx
shr edi, 1
mov dword [esp + 0xc], ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], ecx
movsx esi, word [ebx + 0x4c]
mov eax, dword [ebx + esi*4 + 0x78]
mov dword [esp + 0x14], eax
test esi, esi
jne 0x1007aaa1
cmp byte [eax + 1], 0
je 0x1007abfd
lea ecx, [ebx + 0x7c]
push ecx
call fcn.10072c80
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
jne 0x1007abfd
mov edx, 1
xor ecx, ecx
mov word [ebx + 0x4c], dx
mov word [ebx + 0x4e], ax
mov word [ebx + 0x50], cx
jmp 0x1007abf2
cmp byte [eax + 1], 0
jne 0x1007aab3
movzx edx, word [eax + 0x10]
cmp edx, edi
jle 0x1007abfd
movzx eax, word [ebx + esi*2 + 0x4c]
mov edi, dword [ebx + esi*4 + 0x74]
mov ecx, dword [edi + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 0x94]
push ecx
cmp edx, dword [eax + 0x98]
jbe 0x1007aadc
call fcn.1003f910
jmp 0x1007aae1
call fcn.1003a3a0
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
jne 0x1007ab76
mov eax, dword [esp + 0x14]
cmp byte [eax + 3], 0
je 0x1007ab2f
cmp byte [eax + 1], 1
jne 0x1007ab2f
mov cx, word [eax + 0x16]
cmp cx, word [eax + 0x12]
jne 0x1007ab2f
cmp dword [edi + 0x48], 1
je 0x1007ab2f
movzx edx, word [edi + 0x12]
cmp edx, dword [esp + 0x18]
jne 0x1007ab2f
lea ecx, [esp + 0x24]
push ecx
push eax
push edi
call fcn.10071a40
add esp, 0xc
mov dword [esp + 0xc], eax
jmp 0x1007ab76
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x20]
call fcn.10028490
movzx ecx, byte [ebx + 0x4a]
xor edx, edx
cmp esi, 1
sete dl
push ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
push edx
push ecx
mov edx, eax
mov ecx, edi
call fcn.10072df0
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0xc], eax
test esi, esi
je 0x1007ab6e
call fcn.10022570
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x14]
mov byte [eax + 1], 0
mov eax, dword [eax + 0x44]
test byte [eax + 0x18], 0x40
mov edi, dword [eax + 0x10]
je 0x1007abca
dec dword [edi + 0x78]
mov ecx, dword [edi + 0x88]
mov dword [eax + 0xc], ecx
mov ecx, dword [edi + 0x3c]
mov dword [edi + 0x88], eax
mov esi, dword [ecx]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0x14]
mov eax, dword [edi + 0x98]
push edx
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.100083f0
push edx
mov edx, dword [esi + 0x48]
push eax
mov eax, dword [edi + 0x3c]
push eax
call edx
add esp, 0x10
jmp 0x1007abcf
call fcn.1001d7d0
cmp dword [edi + 0x78], 0
jne 0x1007abea
mov eax, dword [edi + 0xdc]
cmp dword [eax + 0xc], 0
jne 0x1007abea
push edi
call fcn.10069eb0
add esp, 4
dec word [ebx + 0x4c]
mov edi, dword [esp + 0x20]
cmp dword [esp + 0xc], 0
je 0x1007aa57
mov esi, dword [esp + 0x10]
test esi, esi
je 0x1007ac0a
call fcn.10022570
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
call fcn.10001180
mov esp, ebp
pop ebp
ret
Function at 0x10085050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [edi]
cmp word [esi + 0x2c], 0
jne 0x1008509d
movsx eax, word [esi + 0x4c]
mov ecx, dword [esi + eax*4 + 0x78]
movzx edx, word [esi + eax*2 + 0x4e]
mov eax, dword [ecx + 0x40]
movzx ebx, byte [eax + edx*2]
lea edx, [eax + edx*2]
movzx edx, byte [edx + 1]
shl ebx, 8
or ebx, edx
movzx edx, word [ecx + 0x14]
and ebx, edx
add ebx, dword [ecx + 0x38]
lea eax, [esi + 0x18]
push ebx
push ecx
call fcn.10021450
add esp, 8
or byte [esi + 0x48], 2
mov ebx, dword [esi + 0x18]
mov esi, dword [esi + 0x1c]
mov eax, ebx
add eax, 0xffffffff
adc esi, 0xffffffff
test esi, esi
ja 0x1008511e
jb 0x100850b8
cmp eax, 0x7ffffffe
ja 0x1008511e
mov ecx, dword [esp + 0x3c]
xor eax, eax
push 1
mov word [esp + 0x1c], ax
mov dword [esp + 0x34], ecx
mov ecx, dword [edi]
mov dword [esp + 0x2c], eax
push eax
lea eax, [esp + 0x18]
call fcn.100800b0
add esp, 8
test eax, eax
jne 0x10085143
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push edx
push eax
push ecx
call fcn.10063d40
add esp, 0x10
test dword [esp + 0x18], 0x2460
mov dword [ebp], eax
jne 0x1008510c
cmp dword [esp + 0x28], 0
je 0x10085115
lea eax, [esp + 0x10]
call fcn.1002f2a0
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0x100b88d4
push 0x10a87
push str.database_corruption_at_line__d_of___.10s_
push 0xb
mov dword [ebp], 0
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x10
mov eax, 0xb
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x10097cf0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push ebx
push esi
push edi
push ecx
push edx
push str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
xor edi, edi
xor ebx, ebx
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esp, 0xc
mov dword [esp + 0x14], eax
test eax, eax
jne 0x10097d2a
lea eax, [edi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ebp + 8]
lea esi, [esp + 0x24]
call fcn.10091760
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x10097d91
mov esi, dword [esp + 0x10]
push esi
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 4
cmp eax, 0x64
jne 0x10097d69
push 0
push esi
call sym.SQLite.Interop.dll_sqlite3_column_int64
add esp, 8
mov edi, eax
mov ebx, edx
push esi
call sym.SQLite.Interop.dll_sqlite3_finalize
add esp, 4
mov esi, eax
test esi, esi
jne 0x10097dbb
mov eax, edi
or eax, ebx
jne 0x10097d9a
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x28], 0x100000
mov dword [eax + 0x2c], 0
jmp 0x10097dbb
cmp esi, 7
je 0x10097d74
xor esi, esi
jmp 0x10097d7e
test ebx, ebx
jl 0x10097dab
jg 0x10097da5
cmp edi, 0x64
jbe 0x10097dab
mov eax, edi
mov ecx, ebx
jmp 0x10097db2
mov eax, 0x64
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], ecx
mov ecx, dword [esp + 0x14]
push ecx
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10099620
Capabilities:
Reference sql statements

Disassembly:
push ecx
xor eax, eax
cmp byte [edi + 0xe5], 2
jne 0x100996b1
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
push ebp
push eax
push ecx
push str.SELECT_1_FROM__Q.sqlite_master_WHERE_tbl_name_q_stat
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x100996ab
mov eax, dword [edi + 0xc]
push esi
push 0
push 0
push 1
push 0xffffffffffffffff
push ebp
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 0
call fcn.10091760
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x1009969c
mov esi, dword [esp + 8]
push ebx
push esi
call sym.SQLite.Interop.dll_sqlite3_step
xor ebx, ebx
cmp eax, 0x64
push esi
sete bl
call sym.SQLite.Interop.dll_sqlite3_finalize
mov esi, eax
add esp, 8
test esi, esi
jne 0x1009969b
mov byte [edi + 0xe5], bl
pop ebx
push ebp
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ecx
ret
mov eax, 7
pop ebp
pop ecx
ret
Function at 0x10099de0
Capabilities:
Reference sql statements

Disassembly:
cmp dword [esp + 8], 0
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, eax
je 0x10099e4a
mov eax, dword [esi + 0x1c]
push eax
push str.PRAGMA__Q.page_size
mov dword [esp + 0x20], 0
call sym.SQLite.Interop.dll_sqlite3_mprintf
lea ecx, [esp + 0x20]
push ecx
mov edi, eax
push ebp
mov ecx, edi
call fcn.10097c90
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x10099e73
movzx ecx, byte [esi + 0x16]
mov eax, dword [esp + 0x18]
imul ecx, ecx, 0x33
add eax, 0xffffffc0
add ecx, 4
cmp ecx, eax
mov dword [esi + 0x10], eax
jge 0x10099e8d
push edi
mov dword [esi + 0x10], ecx
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esi, 0x10
mov edi, eax
push esi
push ebp
mov ecx, edi
call fcn.10097c90
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x10099e8d
push ebp
call sym.SQLite.Interop.dll_sqlite3_errmsg
push eax
push 0x100b5014
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov edx, dword [esp + 0x28]
mov dword [edx], eax
add esp, 0xc
push edi
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x401be0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push 0x4042d4
push esi
mov dword [esp + 0xc], 0x104
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SoftwareSUNRISESunriseAccessory
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401c23
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push esi
push edx
push 0
push str.Path
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401c4b
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x40232c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 0x10], 0
je 0x40234c
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
cmp dword [ebp + 0xc], 0
je 0x402358
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
test ebx, ebx
je 0x402361
cmp byte [ebx], 0
jne 0x402368
xor eax, eax
jmp 0x402419
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
jmp 0x4023c6
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x40239a
cmp dword [ebp - 4], 0
je 0x40239a
cmp dword [ebp - 8], 0
jne 0x40239a
cmp dword [ebp + 0x10], 0
je 0x402395
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov dword [ebp - 8], edx
jmp 0x4023c5
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x4023a8
cmp ecx, 0xa
jne 0x4023b0
cmp ecx, 0xd
jne 0x4023cb
inc ebx
jmp 0x4023cb
mov byte [edx], al
inc edx
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp esi, eax
jle 0x4023c5
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
jmp 0x4023cb
inc esi
cmp byte [ebx], 0
jne 0x402371
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x402417
mov edx, dword [ebp - 4]
mov byte [edx], 0
cmp dword [ebp - 8], 0
je 0x402417
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov ecx, dword [ebp + 8]
dec ecx
lea edx, [ebp - 0x1008]
mov eax, dword [ebp - 4]
call fcn.00406c80
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov byte [edx + ecx - 1], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402698
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffffbe0
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [0x40c045], 0
jne 0x402721
mov eax, esp
call fcn.004057d8
mov ecx, 6
mov edx, dword [str.RarSFX]
call fcn.00406d1c
test eax, eax
jne 0x402721
push 0x40c1f4
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.00406bf0
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x400]
mov ecx, 0x1e
xor edx, edx
call fcn.00406b94
mov dword [esp + 0x404], 3
mov word [esp + 0x410], 0x14
mov eax, esp
mov dword [esp + 0x408], eax
lea edx, [esp + 0x400]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x420
ret

Function at 0x40280a
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x40c05d], 0
je 0x402881
cmp byte [0x40dd74], 0
je 0x402881
lea edx, [esp + 8]
mov eax, 0x40dd74
call fcn.004027d9
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x402881
mov eax, ebx
call fcn.00406bf0
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x402889
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
cmp byte [0x40c05d], 0
je 0x402902
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.004027d9
push esp
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402902
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x410]
push eax
lea edx, [esp + 0x10]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4028fa
lea edx, [esp + 0x40c]
mov eax, ebx
call fcn.00406c70
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x80c
pop ebx
ret

Function at 0x4029ec
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x402b54
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x40cbe4
push 1
push 0
push 0x40cbf4
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402c53
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x402bb7
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x402bc9
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.00406c70
lea eax, [ebp - 0x40c]
call fcn.00405988
cmp byte [ebp - 0x40c], 0
je 0x402bfa
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x40cc14
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402c4a
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402c41
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402c64
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push esi
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop esi
pop ebx
ret