joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4480
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f52a8
push 0x4efc40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x34], 0x5a4d
mov dword [ebp - 0x24], 0x4550
mov eax, dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xffff0000
or edx, 0xffffffff
sub eax, 0x1000
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
xor ecx, ecx
mov cx, word [eax]
cmp ecx, dword [ebp - 0x34]
je 0x4b44df
mov dword [ebp - 4], edx
jmp 0x4b4531
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x1c], ecx
xor esi, esi
mov si, word [ecx]
cmp esi, dword [ebp - 0x24]
je 0x4b44f6
mov dword [ebp - 4], edx
jmp 0x4b4531
mov dword [0x50410c], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x1000000
ja 0x4b44c1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ef970
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f52b8
push 0x4efc40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x34], 0x5a4d
mov dword [ebp - 0x24], 0x4550
inc ebp
add byte [eax], al
or ebx, 0xffffffff
add esi, 0x1000
mov dword [ebp - 0x20], esi
mov dword [0x4faedc], esi
mov dword [ebp - 4], 0
xor eax, eax
mov ax, word [esi]
cmp eax, dword [ebp - 0x34]
je 0x4ef9d3
mov dword [ebp - 4], ebx
jmp 0x4ef9ae
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [0x4fafec], eax
xor ecx, ecx
mov cx, word [eax]
cmp ecx, dword [ebp - 0x24]
je 0x4ef9ec
mov dword [ebp - 4], ebx
jmp 0x4ef9ae
cmp esi, 0x400000
jae 0x4ef9f9
mov esp, eax
add esp, ebx
retf
inc dword [0x4faed4]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x4fac44], eax
push 0x4f7478
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
dec edi
add byte [ebx + 0x4fac54], ah
call dword [sym.imp.KERNEL32.dll_GetLastError]
add dword [ebp - 0x30], eax
mov eax, dword [0x4fac54]
test eax, eax
je 0x4efa61
mov dword [ebp - 4], ebx
cmp dword [0x4faed4], 3
jl 0x4efa49
mov ecx, edi
and ecx, 0xffff
cmp ecx, 0x8b55
jne 0x4efa50
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4fafec]
xor edi, dword [edx + 8]
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
neg eax
sbb eax, eax
neg eax
xor edi, dword [eax + esi + 0x167b]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
jmp 0x4ef9ae
Function at 0x4efa14
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f52b8
push 0x4efc40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x34], 0x5a4d
mov dword [ebp - 0x24], 0x4550
inc ebp
add byte [eax], al
or ebx, 0xffffffff
add esi, 0x1000
mov dword [ebp - 0x20], esi
mov dword [0x4faedc], esi
mov dword [ebp - 4], 0
xor eax, eax
mov ax, word [esi]
cmp eax, dword [ebp - 0x34]
je 0x4ef9d3
mov dword [ebp - 4], ebx
jmp 0x4ef9ae
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [0x4fafec], eax
xor ecx, ecx
mov cx, word [eax]
cmp ecx, dword [ebp - 0x24]
je 0x4ef9ec
mov dword [ebp - 4], ebx
jmp 0x4ef9ae
cmp esi, 0x400000
jae 0x4ef9f9
mov esp, eax
add esp, ebx
retf
inc dword [0x4faed4]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x4fac44], eax
push 0x4f7478
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
dec edi
add byte [ebx + 0x4fac54], ah
call dword [sym.imp.KERNEL32.dll_GetLastError]
add dword [ebp - 0x30], eax
mov eax, dword [0x4fac54]
test eax, eax
je 0x4efa61
mov dword [ebp - 4], ebx
cmp dword [0x4faed4], 3
jl 0x4efa49
mov ecx, edi
and ecx, 0xffff
cmp ecx, 0x8b55
jne 0x4efa50
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4fafec]
xor edi, dword [edx + 8]
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
neg eax
sbb eax, eax
neg eax
xor edi, dword [eax + esi + 0x167b]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
jmp 0x4ef9ae
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401443
pop dword [ebp - 0x2c]
mov eax, 0x401443
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x642d8e2c
sub dword [ebp - 0x3c], 0x15db48e1
mov dword [ebp - 0x38], 0x23eb793c
add dword [ebp - 0x38], 0xe47d309
mov dword [ebp - 0x34], 0x5f6f8b96
sub dword [ebp - 0x34], 0x13234768
mov dword [ebp - 0x30], 0xffce457e
sub dword [ebp - 0x30], 0xffce457e
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xdf490cd1
sub eax, 0xdf088c59
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xd9b5d12c
add dword [ebp - 0x3c], 0x9abc982a
mov dword [ebp - 0x38], 0x8a315993
add dword [ebp - 0x38], 0xb73b07e2
mov dword [ebp - 0x34], 0x2e6572a2
sub dword [ebp - 0x34], 0xcaf60636
mov dword [ebp - 0x30], 0x82576842
add dword [ebp - 0x30], 0x7da897be
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a575
push 0
call eax
mov ecx, 0xdee45f60
add ecx, 0x211bf07c
xor esi, esi
add esi, eax
mov edi, 0x451400
add edi, dword [ebp - 0x2c]
mov ebx, 0x366b2922
add dword [ebp - 8], 0x3cf00571
mov edx, dword [edi]
xor dword [ebp - 0xc], 0xd676c8af
sub edx, ebx
add dword [ebp - 0x20], 0x62bdc997
mov dword [esi], edx
xor dword [ebp - 0xc], ebx
add esi, 0xf44df6bc
add esi, 0xbb20948
add edi, 0x19029a7c
add edi, 0xe6fd6588
loop 0x401551
add eax, 0x13243
xor ebx, ebx
add ebx, eax
add eax, 0x44a4c11e
sub eax, 0x44a4c119
mov ecx, 0xb4a0a8db
sub ecx, 0xb460a8db
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x12d86cb0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x4d8
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x12d86dc9
cmp dword [esp + 0x4e4], ebp
je 0x12d86dc9
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
cmp ebx, ebp
je 0x12d86d93
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0xda]
mov word [esp + 0xd8], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebp
rep stosd dword es:[edi], eax
push 0x207
lea eax, [esp + 0xdc]
push ebx
push eax
call fcn.12f5c57b
lea ecx, [esp + 0x1c]
push 0x32
lea edx, [esp + 0xe8]
push ecx
push edx
call fcn.12d97a80
mov esi, eax
add esp, 0x18
cmp esi, 2
jle 0x12d86d93
lea edi, [esi - 2]
mov eax, dword [esp + edi*4 + 0x10]
push eax
call fcn.12e31030
add esp, 4
test eax, eax
je 0x12d86d74
mov ecx, dword [esp + 0x4f0]
mov edx, dword [esp + 0x4ec]
dec ecx
push ecx
push eax
push edx
call fcn.12f5c57b
add esp, 0xc
mov ebp, 1
mov eax, dword [0x13199068]
test eax, eax
je 0x12d86dba
push esi
push edi
push str.CAdbManager::GetCmdSrcName_1__dwPlace:_d___nNumber:__d_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, dword [0x13199068]
test eax, eax
je 0x12d86dba
mov eax, dword [esp + 0x4ec]
push ebx
push eax
push ebp
push str.CAdbManager::GetCmdSrcName_____bRet_:__d___lpszName_:__s___lpszCmdLine_:__s_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
pop edi
pop esi
mov eax, ebp
pop ebx
pop ebp
add esp, 0x4d8
ret 8
xor eax, eax
pop ebp
add esp, 0x4d8
ret 8

Function at 0x12d86de0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x2d0
push ebx
push ebp
mov ebp, dword [esp + 0x2dc]
xor ebx, ebx
cmp ebp, ebx
je 0x12d86eca
cmp dword [esp + 0x2e0], ebx
je 0x12d86eca
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp esi, ebx
je 0x12d86e9c
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xda]
mov word [esp + 0xd8], bx
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x14]
push 0x103
rep stosd dword es:[edi], eax
lea eax, [esp + 0xdc]
push esi
push eax
call fcn.12f5c57b
lea ecx, [esp + 0x1c]
push 0x32
lea edx, [esp + 0xe8]
push ecx
push edx
call fcn.12d97a80
add esp, 0x18
cmp eax, 2
pop edi
jle 0x12d86e9c
mov eax, dword [esp + eax*4 + 8]
push eax
call fcn.12e31030
add esp, 4
test eax, eax
je 0x12d86e9c
mov ecx, dword [esp + 0x2e4]
dec ecx
push ecx
push eax
push ebp
call fcn.12f5c57b
add esp, 0xc
mov ebx, 1
mov eax, dword [0x13199068]
test eax, eax
je 0x12d86ebc
push esi
push ebp
push ebx
push str.CAdbManager::GetCmdDestName_____bRet_:__d___lpszName_:__s___lpszCmdLine_:__s_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x2d0
ret 8
pop ebp
xor eax, eax
pop ebx
add esp, 0x2d0
ret 8
Function at 0x12d86fa0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x4d8
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x12d870ac
cmp dword [esp + 0x4e4], ebx
je 0x12d870ac
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
cmp ebp, ebx
je 0x12d87076
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0xda]
mov word [esp + 0xd8], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
push 0x207
lea eax, [esp + 0xdc]
push ebp
push eax
call fcn.12f5c57b
lea ecx, [esp + 0x1c]
push 0x32
lea edx, [esp + 0xe8]
push ecx
push edx
call fcn.12d97a80
mov edi, eax
add esp, 0x18
cmp edi, 1
jle 0x12d87076
mov eax, dword [esp + 0x4f0]
mov edx, dword [esp + 0x4ec]
lea esi, [edi - 1]
dec eax
push eax
mov ecx, dword [esp + esi*4 + 0x14]
push ecx
push edx
call fcn.12f5c57b
mov eax, dword [0x13199068]
add esp, 0xc
test eax, eax
mov ebx, 1
je 0x12d8709d
push edi
push esi
push str.CAdbManager::GetCmdDestName_1__dwPlace:_d___nNumber:__d_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, dword [0x13199068]
test eax, eax
je 0x12d8709d
mov eax, dword [esp + 0x4ec]
push ebp
push eax
push ebx
push str.CAdbManager::GetCmdDestName_____bRet_:__d___lpszName_:__s___lpszCmdLine_:__s_
push 0x130b60bc
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x4d8
ret 8
xor eax, eax
pop ebx
add esp, 0x4d8
ret 8

Function at 0x12d8c0d0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x13193d84]
test eax, eax
jne 0x12d8c14b
mov dword [0x13193d84], 1
call fcn.12f9c520
test eax, eax
je 0x12d8c13b
push 0
push 0x104
push 0x13193d88
call fcn.12f7a3b0
add esp, 0xc
test eax, eax
je 0x12d8c14b
push esi
push edi
mov edi, 0x130c4e54
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x13193d88
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 0x13193d88
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x104
push 0x13193d88
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, 0x13193d88
ret

Function at 0x12d8c620
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x131945c4]
test eax, eax
jne 0x12d8c67c
mov dword [0x131945c4], 1
call fcn.12f9c520
test eax, eax
je 0x12d8c66c
push 0
push 0x104
push 0x131945c8
call fcn.12f7a5b0
add esp, 0xc
test eax, eax
je 0x12d8c67c
push str.SysWow64
push 0x131945c8
call fcn.12f5c935
add esp, 8
mov eax, 0x131945c8
ret
push 0x104
push 0x131945c8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x131945c8
ret
Function at 0x12d8ea60
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov ecx, 0x13196d88
jmp 0x12d8ea70
push 0xffffffffffffffff
push 0x13055c28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
mov ecx, dword [0x1307d24c]
mov dword [esp], eax
mov dword [eax + 0x14], ecx
mov edx, dword [0x1307d24c]
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [eax + 0x18], edx
mov edx, dword [0x1307d24c]
mov byte [esp + 0xc], 1
mov dword [eax + 0x1c], edx
mov edx, dword [0x1307d24c]
mov byte [esp + 0xc], 2
mov dword [eax + 0x20], edx
mov edx, dword [0x1307d24c]
mov byte [esp + 0xc], 3
mov dword [eax + 0x24], edx
mov edx, dword [0x1307d24c]
mov byte [esp + 0xc], 4
mov dword [eax + 0x28], edx
mov edx, dword [0x1307d24c]
mov byte [esp + 0xc], 5
mov dword [eax + 0x2c], edx
mov edx, dword [0x1307d24c]
mov byte [esp + 0xc], 6
mov dword [eax + 0x30], edx
mov byte [esp + 0xc], 7
mov word [eax], cx
mov word [eax + 2], cx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], 0xffffffff
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12d91810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
push ebx
push ebp
mov ebp, dword [esp + 0xb0]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
je 0x12d91834
push ebp
call fcn.12f5c51d
add esp, 4
test eax, eax
jne 0x12d9183a
mov ebp, dword [0x13196dcc]
mov dword [esp + 0x14], str.qqeim
mov dword [esp + 0x18], 0x130c6fac
mov dword [esp + 0x1c], 0x130c6fa4
mov dword [esp + 0x20], 0x130c6f9c
mov dword [esp + 0x24], str.ypager
mov dword [esp + 0x28], str.yahoo
mov dword [esp + 0x2c], 0x130c6f78
mov dword [esp + 0x30], str.sinauc
mov dword [esp + 0x34], str.popo
mov dword [esp + 0x38], 0x130c6f50
mov dword [esp + 0x3c], 0x130c6f48
mov dword [esp + 0x40], str.rtxc
mov dword [esp + 0x44], str.sametime
mov dword [esp + 0x48], 0x130c6f18
mov dword [esp + 0x4c], str.alitalk
mov dword [esp + 0x50], str.aliim
mov dword [esp + 0x54], str.fetion
mov dword [esp + 0x58], str.googletalk
mov dword [esp + 0x5c], str.baiduhi
mov dword [esp + 0x60], str.263EM
mov dword [esp + 0x64], str.feiq
mov dword [esp + 0x68], str.officeim
mov dword [esp + 0x6c], str.msnlite
mov dword [esp + 0x70], 0x130c6e80
mov dword [esp + 0x74], str.nlnotes
mov dword [esp + 0x78], str.notes2w
mov dword [esp + 0x7c], str.notes2
mov dword [esp + 0x80], str.qqcrm
mov dword [esp + 0x84], str.amsger
mov dword [esp + 0x88], str.line
mov dword [esp + 0x8c], str.aliworkbench
mov dword [esp + 0x90], 0x130c6e04
mov dword [esp + 0x94], str.lync
mov dword [esp + 0x98], str.wechat
mov dword [esp + 0x9c], 0x130c6df0
mov dword [esp + 0xa0], str.imoclient
mov dword [esp + 0xa4], str.wxwork
mov dword [esp + 0xa8], str.dingtalk
mov dword [esp + 0xac], 0x130c6db0
mov dword [esp + 0xb0], str.lxmain
mov dword [esp + 0x10], ebx
lea edi, [esp + 0x14]
mov esi, dword [edi]
push esi
call fcn.12f5c51d
push eax
push esi
push ebp
call fcn.12f5e383
add esp, 0x10
test eax, eax
je 0x12d919cf
inc ebx
add edi, 4
cmp ebx, 0x28
jb 0x12d919a9
mov esi, dword [esp + 0x10]
jmp 0x12d919d4
mov esi, 1
mov eax, dword [0x13199068]
test eax, eax
je 0x12d919f3
push ebp
push esi
push str.IsMatchIMAppName____d____s_
push 0x130c6b6c
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret
Function at 0x12d939c0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x131978a0]
test eax, eax
je 0x12d939cf
mov eax, 1
ret
push esi
mov esi, 0x131978a8
push esi
mov dword [0x131978a0], 1
call fcn.12f5c51d
add esp, 4
test eax, eax
jne 0x12d939f1
mov esi, str.snapb2p.dll
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x13199068]
mov dword [0x131978a4], eax
test ecx, ecx
je 0x12d93a22
push esi
push eax
push str.CBmp2PngHelper::Initialize___08x____s_
push str.QQSnapEncode
push 0xffffffffffffffff
call fcn.12dad750
mov eax, dword [0x131978a4]
add esp, 0x14
test eax, eax
je 0x12d93a96
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.TB2P_Initialize
push eax
call esi
mov dword [0x13197888], eax
mov eax, dword [0x131978a4]
push str.TB2P_Uninitialize
push eax
call esi
mov ecx, dword [0x131978a4]
push str.TB2P_Conver
push ecx
mov dword [0x1319788c], eax
call esi
mov edx, dword [0x131978a4]
push str.TP2B_Conver
push edx
mov dword [0x13197890], eax
call esi
mov dword [0x13197894], eax
mov eax, dword [0x131978a4]
push str.TP2J_Conver
push eax
call esi
mov ecx, dword [0x131978a4]
push str.TJ2J_Conver
push ecx
mov dword [0x13197898], eax
call esi
mov dword [0x1319789c], eax
mov eax, dword [0x13197888]
pop esi
test eax, eax
je 0x12d93ad3
mov eax, dword [0x1319788c]
test eax, eax
je 0x12d93ad3
mov eax, dword [0x13197890]
test eax, eax
je 0x12d93ad3
mov eax, dword [0x13197894]
test eax, eax
je 0x12d93ad3
mov eax, dword [0x13197898]
test eax, eax
je 0x12d93ad3
mov eax, dword [0x1319789c]
test eax, eax
je 0x12d93ad3
mov eax, 1
ret
xor eax, eax
ret
Function at 0x12d941d0
Capabilities:
Move file

Disassembly:
sub esp, 0x41c
push ebx
mov ebx, dword [esp + 0x424]
push ebp
push edi
xor edi, edi
mov ebp, ecx
cmp ebx, edi
jne 0x12d941f6
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 8
push esi
push 0x5c
push ebx
mov dword [esp + 0x1c], edi
call fcn.12f5c984
mov esi, eax
add esp, 8
cmp esi, edi
je 0x12d94322
add esi, 2
je 0x12d94322
call fcn.12d91f70
test eax, eax
jne 0x12d94238
push 0x130c6408
push esi
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12d94322
mov ecx, ebp
call fcn.12d93d20
mov word [esp + 0x1c], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x103
lea eax, [esp + 0x20]
push ebx
push eax
mov ecx, ebp
call fcn.12d94170
test eax, eax
je 0x12d94322
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
xor esi, esi
push ecx
push edx
push esi
push esi
push esi
lea eax, [esp + 0x30]
push esi
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], esi
call fcn.12e30390
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, 0x500000
jae 0x12d942cd
cmp dword [esp + 0x18], esi
jne 0x12d942cd
mov ecx, dword [esp + 0x434]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov ecx, ebp
call fcn.12d94b00
pop esi
pop edi
pop ebp
mov dword [esp + 8], eax
pop ebx
add esp, 0x41c
ret 8
cmp eax, 0x10000000
jb 0x12d94322
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x226]
mov word [esp + 0x224], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x22c]
push str._s_large_08X
push edx
call fcn.12f5cfbf
add esp, 0x10
lea eax, [esp + 0x224]
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [esp + 0x14]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x41c
ret 8
Function at 0x12d95b60
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x12d95b8a
push str.winbrosqlite3_module_is_Loaded
push str.History
push 0xffffffffffffffff
push 0x13198fdc
call fcn.12eb1b80
add esp, 0x10
mov eax, 1
pop esi
ret
push str.winbrosqlite3.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x28], eax
jne 0x12d95bc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.winbrosqlite3_module_load_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x13198fdc
call fcn.12eb1b80
add esp, 0x14
xor eax, eax
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.sqlite3_open16
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_prepare16_v2
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_bind_int64
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_bind_text16
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_step
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_column_int64
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_column_text16
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_close
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_finalize
push ecx
mov dword [esi + 0x20], eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x24], eax
test ecx, ecx
pop edi
je 0x12d95ca2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x12d95ca2
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x12d95ca2
test eax, eax
je 0x12d95ca2
push str.winbrosqlite3_module_load_successful
push str.History
push 0xffffffffffffffff
push 0x13198fdc
call fcn.12eb1b80
add esp, 0x10
mov eax, 1
mov dword [esi + 0x2c], eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.get_winbrosqlite3_function_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x13198fdc
call fcn.12eb1b80
add esp, 0x14
mov ecx, esi
call fcn.12d95cd0
xor eax, eax
pop esi
ret
Function at 0x12d97670
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x804
push esi
mov esi, dword [esp + 0x80c]
test esi, esi
push edi
jne 0x12d9768e
pop edi
xor eax, eax
pop esi
add esp, 0x804
ret
push esi
call fcn.12f5c51d
mov edi, 1
add esp, 4
cmp eax, edi
jne 0x12d976b1
cmp word [esi], 0x2e
jne 0x12d976ce
pop edi
xor eax, eax
pop esi
add esp, 0x804
ret
cmp eax, 2
jne 0x12d976ce
cmp word [esi], 0x2e
jne 0x12d976ce
cmp word [esi + 2], 0x2e
jne 0x12d976ce
pop edi
xor eax, eax
pop esi
add esp, 0x804
ret
push 0x5c
push esi
mov dword [esp + 0x10], 0
call fcn.12f5d099
add esp, 8
test eax, eax
jne 0x12d976f0
push 0x2f
push esi
call fcn.12f5d099
add esp, 8
mov ecx, dword [esp + 0x814]
push ebx
test eax, eax
push ebp
mov dword [ecx], 0
je 0x12d97726
push esi
mov dword [ecx], edi
call fcn.12e30b60
add esp, 4
cmp eax, 0xffffffff
je 0x12d97717
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x804
ret
mov ebx, dword [esp + 0x824]
mov ebp, dword [esp + 0x820]
push ebx
push ebp
call fcn.12d8bf20
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97713
push ebx
push ebp
call fcn.12d8bfa0
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97713
push ebx
push ebp
call fcn.12d8bac0
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97713
push ebx
push ebp
call fcn.12d8ba90
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97713
mov ecx, 0x1ff
lea edi, [esp + 0x16]
mov word [esp + 0x14], ax
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0x130c8b14
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x12d97717
lea ecx, [esp + 0x14]
push 0x130c6c74
push ecx
call fcn.12f5d769
add esp, 8
test eax, eax
je 0x12d97717
push ebx
push ebp
push eax
push esi
call fcn.12d97530
add esp, 0x10
test eax, eax
jne 0x12d97802
push 0x130c6c74
push eax
call fcn.12f5d769
add esp, 8
test eax, eax
jne 0x12d977d1
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x804
ret
pop ebp
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop ebx
pop edi
pop esi
add esp, 0x804
ret