joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418df0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, ecx
xor ebx, ebx
mov esi, eax
mov cl, byte [ebp + 0xb]
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmp dword [ebp + 8], ebx
jle 0x418f4a
nop
mov eax, 0xaaaaaaab
mul ebx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ebx
sub edx, eax
sub edx, 0
je 0x418f0d
sub edx, 1
je 0x418eb4
sub edx, 1
jne 0x418f40
mov al, byte [edi]
shr al, 6
or al, cl
and al, 0x3f
cmp al, 0x1a
jae 0x418e4c
add al, 0x41
jmp 0x418e66
cmp al, 0x34
jae 0x418e54
add al, 0x47
jmp 0x418e66
cmp al, 0x3e
jae 0x418e5c
sub al, 4
jmp 0x418e66
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi], al
mov al, byte [edi]
and al, 0x3f
cmp al, 0x1a
jae 0x418e7d
add al, 0x41
mov byte [esi + 1], al
add esi, 2
jmp 0x418f3f
cmp al, 0x34
jae 0x418e8e
add al, 0x47
mov byte [esi + 1], al
add esi, 2
jmp 0x418f3f
cmp al, 0x3e
jae 0x418e9f
sub al, 4
mov byte [esi + 1], al
add esi, 2
jmp 0x418f3f
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi + 1], al
add esi, 2
jmp 0x418f3f
mov al, byte [edi]
shr al, 4
or al, cl
and al, 0x3f
cmp al, 0x1a
jae 0x418ed0
add al, 0x41
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x418f3f
cmp al, 0x34
jae 0x418ee3
add al, 0x47
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x418f3f
cmp al, 0x3e
jae 0x418ef6
sub al, 4
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x418f3f
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 0xf
shl cl, 2
jmp 0x418f3f
mov al, byte [edi]
shr al, 2
cmp al, 0x1a
jae 0x418f1a
add al, 0x41
jmp 0x418f34
cmp al, 0x34
jae 0x418f22
add al, 0x47
jmp 0x418f34
cmp al, 0x3e
jae 0x418f2a
sub al, 4
jmp 0x418f34
setne al
lea eax, [eax*4 + 0x2b]
mov byte [esi], al
inc esi
mov cl, byte [edi]
and cl, 3
shl cl, 4
inc edi
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x418e10
mov ebx, dword [ebp + 8]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
sub ebx, eax
je 0x418f9d
and cl, 0x3f
cmp cl, 0x1a
jae 0x418f6f
add cl, 0x41
jmp 0x418f8d
cmp cl, 0x34
jae 0x418f79
add cl, 0x47
jmp 0x418f8d
cmp cl, 0x3e
jae 0x418f83
sub cl, 4
jmp 0x418f8d
setne cl
lea ecx, [ecx*4 + 0x2b]
mov byte [esi], cl
inc esi
cmp ebx, 1
jne 0x418f99
mov byte [esi], 0x3d
inc esi
mov byte [esi], 0x3d
inc esi
mov byte [esi], 0
sub esi, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418fb0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 8], ecx
mov ebx, ecx
lea esi, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x418fc3
sub edi, esi
xor esi, esi
test edi, edi
jle 0x419084
mov ah, byte [ebp - 1]
nop dword [eax]
mov al, byte [edx]
cmp al, 0x3d
je 0x419081
nop word [eax + eax]
test al, al
je 0x419081
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x419004
sub al, 0x41
jmp 0x419026
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x419010
sub al, 0x47
jmp 0x419026
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x41901c
add al, 4
jmp 0x419026
cmp al, 0x2b
je 0x419039
cmp al, 0x2f
je 0x419035
mov al, 0x40
inc edx
cmp al, 0x40
jne 0x41902f
mov al, byte [edx]
jmp 0x418ff0
cmp al, 0x41
je 0x419081
jmp 0x41903c
mov al, 0x3f
jmp 0x41903b
mov al, 0x3e
inc edx
mov ecx, esi
and ecx, 3
jmp dword [ecx*4 + 0x419090]
mov ah, al
shl ah, 2
jmp 0x419078
mov cl, al
shr cl, 4
or cl, ah
mov ah, al
mov byte [ebx], cl
inc ebx
shl ah, 4
jmp 0x419078
mov cl, al
shr cl, 2
or cl, ah
mov ah, al
mov byte [ebx], cl
inc ebx
shl ah, 6
jmp 0x419078
mov cl, ah
or cl, al
mov byte [ebx], cl
inc ebx
inc esi
cmp esi, edi
jl 0x418fe0
mov ecx, dword [ebp - 8]
pop edi
sub ebx, ecx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419c20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505b74
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x52d324]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], esi
mov dword [esi], 0x522e50
mov byte [esi + 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xf
mov byte [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xf
mov byte [esi + 0x20], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0xf
mov byte [esi + 0x38], 0
mov dword [esi + 0x50], 0x522e64
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0xf
mov byte [esi + 0x58], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0xf
mov byte [esi + 0x70], 0
mov dword [esi + 0x54], 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00412130
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 0
je 0x419cfe
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x419d06
lea ecx, [ebp - 0x28]
call fcn.00403940
push 0xb
push str.config.dat
lea ecx, [ebp - 0x28]
call fcn.004029e0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0040b9b0
push eax
lea ecx, [esi + 0x20]
call fcn.00408fc0
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x419d59
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x419d4f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419dcb
push edx
push ecx
call fcn.004dc783
add esp, 8
push 5
push str.kantu
lea ecx, [esi + 0x38]
call fcn.00402850
push 5
push str.kantu
lea ecx, [esi + 8]
call fcn.00402850
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x419dad
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419da3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419dd0
push edx
push ecx
call fcn.004dc783
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dc214
mov esp, ebp
pop ebp
ret
call fcn.004e2bf9
call fcn.004e2bf9
int3
Function at 0x41a6e0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505c86
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.004dd480
mov eax, dword [0x52d324]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 4], 0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
jne 0x41a72d
call fcn.00419f20
test al, al
je 0x41a8fc
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.004df150
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x41a74b
mov esi, dword [esi]
cmp dword [edi + 0x4c], 0x10
lea eax, [edi + 0x38]
jb 0x41a756
mov eax, dword [eax]
push esi
push eax
push str.SELECT__FROM__s_WHERE_key_s
lea eax, [ebp - 0x1010]
push 0x1000
push eax
call fcn.00409560
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x1018], 0
add esp, 0x14
mov dword [ebp - 0x1014], 0xf
mov byte [ebp - 0x1028], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a795
sub ecx, edx
lea eax, [ebp - 0x1010]
push ecx
push eax
lea ecx, [ebp - 0x1028]
call fcn.00402850
mov dword [ebp - 4], 0
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x1030], 0
mov dword [ebp - 0x102c], 0
lea eax, [ebp - 0x1038]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1028]
push eax
lea ecx, [edi + 0x50]
call fcn.0041aed0
mov edi, dword [ebp - 0x1034]
mov eax, edi
mov esi, dword [ebp - 0x1038]
sub eax, esi
sub eax, 0xc
cmp eax, 0xc
jb 0x41a816
xor bl, bl
jmp 0x41a842
mov eax, dword [esi]
add eax, 0x18
cmp ebx, eax
je 0x41a840
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x41a829
mov edx, dword [eax]
push dword [eax + 0x10]
mov ecx, ebx
push edx
call fcn.00402850
mov edi, dword [ebp - 0x1034]
mov esi, dword [ebp - 0x1038]
mov bl, 1
test esi, esi
je 0x41a8c4
cmp esi, edi
je 0x41a864
nop word [eax + eax]
mov ecx, esi
call fcn.0041a9b0
add esi, 0xc
cmp esi, edi
jne 0x41a850
mov esi, dword [ebp - 0x1038]
mov ecx, dword [ebp - 0x1030]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 2
cmp ecx, 0x1000
jb 0x41a89c
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a91a
push ecx
push esi
call fcn.004dc783
add esp, 8
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x1030], 0
mov edx, dword [ebp - 0x1014]
cmp edx, 0x10
jb 0x41a8fa
mov ecx, dword [ebp - 0x1028]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41a8f0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a91f
push edx
push ecx
call fcn.004dc783
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dc214
mov esp, ebp
pop ebp
ret 8
call fcn.004e2bf9
call fcn.004e2bf9
int3
Function at 0x4236b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x4236de
nop dword [eax + eax]
movzx ecx, cl
lea esi, [esi + 1]
movzx edx, byte [ecx + 0x520658]
lea ecx, [eax*8]
xor edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x4236c0
pop esi
ret

Function at 0x423750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov edx, ecx
push esi
push edi
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x4237aa
mov al, byte [ebx]
xor esi, esi
mov edi, ebx
test al, al
je 0x423791
nop
movzx eax, al
lea edi, [edi + 1]
movzx ecx, byte [eax + 0x520658]
lea eax, [esi*8]
xor ecx, eax
mov al, byte [edi]
xor esi, ecx
test al, al
jne 0x423770
mov ecx, dword [edx + 0xc]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
div dword [esi]
mov eax, edx
mov dword [ebp - 4], eax
mov esi, dword [ecx + eax*8 + 4]
mov edi, dword [ecx + eax*8]
mov ecx, edx
jmp 0x4237b2
mov esi, dword [edx + 8]
xor ecx, ecx
mov edi, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test edi, edi
je 0x4237d7
nop dword [eax + eax]
push ebx
push dword [esi + 0xc]
dec edi
call fcn.00422240
add esp, 8
test eax, eax
je 0x4237e0
mov esi, dword [esi]
test edi, edi
jne 0x4237c0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4337b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x14], edx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
test ebx, ebx
je 0x4338c3
cmp byte [ebx + 9], 0
je 0x4337e8
inc dword [ebx + 0xc]
cmp byte [ebx + 0xa], 0
jne 0x4337e8
call fcn.0042fe10
mov esi, dword [ebx + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x4338b0
cmp dword [ebp + 8], 0
je 0x433832
test byte [esi + 0x40], 1
jne 0x433832
mov al, byte [esi + 0x42]
cmp al, 1
je 0x43380d
cmp al, 2
jne 0x43384f
mov ecx, esi
call fcn.00430000
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x43384f
mov ebx, dword [esp + 0x10]
mov edx, edi
push 0
mov ecx, ebx
call fcn.004337b0
add esp, 4
jmp 0x4338b0
push dword [esi + 0x30]
call fcn.0041f3a0
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
xor ebx, ebx
cmp byte [esi + 0x44], bl
jl 0x43389d
lea edi, [esi + 0x78]
nop dword [eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x43388b
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
je 0x43387d
call fcn.0042afd0
jmp 0x433882
call fcn.00427900
mov ecx, dword [esp + 0x1c]
call fcn.0042c370
mov dword [edi], 0
inc ebx
movsx eax, byte [esi + 0x44]
add edi, 4
cmp ebx, eax
jle 0x433860
mov esi, dword [esi + 8]
test esi, esi
jne 0x4337f6
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp byte [ebx + 9], 0
je 0x4338c3
add dword [ebx + 0xc], 0xffffffff
jne 0x4338c3
mov ecx, ebx
call fcn.0042fdd0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x434c59
cmp al, 3
jb 0x434c2f
call fcn.00430340
test eax, eax
jne 0x434d2c
cmp byte [esi + 0x42], 0
jne 0x434c41
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x434c59
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
jg 0x434d2a
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + eax*4 + 0x78]
inc word [esi + eax*2 + 0x50]
mov ax, word [esi + eax*2 + 0x50]
mov cl, byte [edx + 5]
cmp ax, word [edx + 0x12]
jb 0x434d22
test cl, cl
jne 0x434ca2
movzx ecx, byte [edx + 6]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
call fcn.00434340
test eax, eax
jne 0x434d2c
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.004344f0
mov cl, byte [esi + 0x44]
test cl, cl
je 0x434cfe
nop dword [eax]
and byte [esi + 0x40], 0xf9
xor eax, eax
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x434cd9
call fcn.0042afd0
jmp 0x434cde
call fcn.00427900
mov ecx, edi
call fcn.0042c370
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edx, dword [esi + eax*4 + 0x78]
mov ax, word [esi + eax*2 + 0x50]
cmp ax, word [edx + 0x12]
jb 0x434d0e
test cl, cl
jne 0x434cb0
mov dword [ebx], 1
xor eax, eax
mov byte [esi + 0x42], 0
pop edi
pop esi
pop ebx
ret
cmp byte [edx + 2], 0
je 0x434d2a
push ebx
push esi
call fcn.00434d30
add esp, 8
pop edi
pop esi
pop ebx
ret
test cl, cl
je 0x434c98
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x434da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov al, byte [esi + 0x42]
cmp al, 1
je 0x434de1
cmp al, 3
jb 0x434dbb
call fcn.00430340
test eax, eax
jne 0x434dc9
cmp byte [esi + 0x42], 0
jne 0x434dcd
mov dword [ebx], 1
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x434de1
mov byte [esi + 0x42], 1
mov dword [esi + 0x3c], 0
js 0x434dc7
mov cl, byte [esi + 0x44]
movsx eax, cl
mov edi, dword [esi + eax*4 + 0x78]
movzx eax, word [esi + eax*2 + 0x50]
cmp byte [edi + 5], 0
jne 0x434e29
mov ecx, eax
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x14]
movzx edx, cx
mov ecx, esi
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
call fcn.00434340
test eax, eax
jne 0x434dc9
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.00434590
test ax, ax
jne 0x434e77
nop
xor eax, eax
test cl, cl
je 0x434eae
and byte [esi + 0x40], 0xf9
mov word [esi + 0x24], ax
movsx eax, cl
dec cl
mov eax, dword [esi + eax*4 + 0x78]
mov byte [esi + 0x44], cl
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x18], 0x40
mov edi, dword [ecx + 0x10]
je 0x434e5d
call fcn.0042afd0
jmp 0x434e62
call fcn.00427900
mov ecx, edi
call fcn.0042c370
mov cl, byte [esi + 0x44]
movsx eax, cl
cmp word [esi + eax*2 + 0x50], 0
je 0x434e30
movsx eax, cl
mov ecx, 0xffff
add word [esi + eax*2 + 0x50], cx
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
cmp byte [eax + 2], 0
je 0x434dc7
cmp byte [eax + 5], 0
jne 0x434dc7
push ebx
push esi
call fcn.00434ec0
add esp, 8
pop edi
pop esi
pop ebx
ret
pop edi
mov byte [esi + 0x42], 0
pop esi
mov dword [ebx], 1
pop ebx
ret
Function at 0x440a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, edx
mov dword [ebp - 4], ecx
push esi
push edi
mov esi, dword [ebx]
mov ecx, esi
call fcn.00433d60
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
test eax, eax
jl 0x440b3d
jg 0x440b3d
test edi, edi
je 0x440b3d
test eax, eax
jg 0x440b3d
jl 0x440aa9
cmp edi, 0x7fffffff
ja 0x440b3d
mov esi, dword [ebx]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x3c]
movzx eax, word [esi + 0x20]
sub ecx, edx
cmp eax, ecx
cmovae eax, ecx
cmp edi, eax
ja 0x440aec
mov eax, 0x1010
mov dword [ebp - 0x20], edx
mov word [ebp - 0x28], ax
mov dword [ebp - 0x24], edi
jmp 0x440b09
lea eax, [ebp - 0x30]
xor edx, edx
push eax
push 1
push edi
mov ecx, esi
call fcn.0043be40
add esp, 0xc
test eax, eax
jne 0x440b64
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
push 0
push dword [ebp + 8]
mov ecx, edi
call fcn.0043fea0
mov ecx, dword [ebp + 0xc]
add esp, 8
test dword [ebp - 0x28], 0x2460
mov dword [ecx], eax
jne 0x440b2c
cmp dword [ebp - 0x18], 0
je 0x440b34
lea ecx, [ebp - 0x30]
call fcn.0043b470
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0x527a9c
push 0x11196
push str.database_corruption_at_line__d_of___.10s_
push 0xb
mov dword [eax], 0
call fcn.00421730
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44afa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.0041efb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x44afd0
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x52de4c], 0
mov edi, dword [ebp + 8]
je 0x44b003
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x421900
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.004e1c3c
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x44b010
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x44b029
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491b60
Capabilities:
Connect to http server
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2820
call fcn.004dd480
mov eax, dword [0x52d324]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push 0
push 0
mov dword [ebp - 0x2820], eax
mov eax, dword [ebp + 0x10]
push str.RookIE_1.0
mov dword [ebp - 0x2814], eax
mov dword [ebp - 0x281c], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 3
push 0
push 0
push 0x50
mov edi, eax
push 0x51e9f6
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test edi, edi
je 0x491bf5
cmp dword [esi + 0x14], 0x10
jb 0x491bd2
mov esi, dword [esi]
push 0
push 0x80000800
push 0
push 0
push esi
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x2810], eax
test eax, eax
jne 0x491c0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004dc214
mov esp, ebp
pop ebp
ret 0xc
push 0
lea ecx, [ebp - 0x2818]
mov dword [ebp - 0x2818], 8
push ecx
lea ecx, [ebp - 0x281c]
push ecx
push 0x20000005
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ebx, 0x2800
mov dword [ebp - 0x2808], 1
push ebx
xor edi, edi
call fcn.004dc7b4
mov esi, eax
add esp, 4
test esi, esi
je 0x491bf5
push ebx
push edi
push esi
call fcn.004df150
push ebx
lea eax, [ebp - 0x2804]
push edi
push eax
call fcn.004df150
add esp, 0x18
cmp dword [ebp - 0x2808], edi
jbe 0x491d1d
nop word [eax + eax]
lea eax, [ebp - 0x2808]
push eax
push 0x27ff
lea eax, [ebp - 0x2804]
push eax
push dword [ebp - 0x2810]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [ebp - 0x2808]
lea eax, [edi + ecx]
cmp eax, ebx
jbe 0x491cf1
add ebx, ebx
mov dword [ebp - 0x280c], esi
push ebx
call fcn.004dc7b4
mov esi, eax
add esp, 4
test esi, esi
je 0x491bf5
push ebx
push 0
push esi
call fcn.004df150
push edi
push dword [ebp - 0x280c]
push esi
call fcn.004de5a0
push dword [ebp - 0x280c]
call fcn.004dc7bd
mov ecx, dword [ebp - 0x2808]
add esp, 0x1c
push ecx
lea eax, [ebp - 0x2804]
push eax
lea eax, [edi + esi]
push eax
call fcn.004de5a0
mov ecx, dword [ebp - 0x2814]
add esp, 0xc
mov eax, dword [ebp - 0x2808]
add edi, eax
mov dword [ecx], edi
test eax, eax
jne 0x491c80
push dword [ebp - 0x2810]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x2820]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], esi
mov eax, dword [ebp - 0x2814]
mov dword [eax], edi
mov al, 1
pop edi
pop esi
pop ebx
call fcn.004dc214
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49e070
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x49e0b9
mov al, byte [esi]
push eax
call fcn.004aa9d0
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x49e097
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x4a7080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x6d0], 0
je 0x4a7107
cmp dword [esi + 0x1a4], 0
je 0x4a70d1
push esi
call fcn.00499a80
push 1
push esi
mov byte [ebp + 8], al
call fcn.00499cc0
push dword [esi + 0x154]
mov eax, dword [esi + 0x1a4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
push dword [ebp + 8]
push esi
call fcn.00499cc0
add esp, 0x28
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x4a7107
push dword [esi + 0x150]
lea eax, [eax + eax*2]
push 1
add eax, 0x50bbc4
push 2
push eax
call fcn.004e3ef9
push dword [esi + 0x150]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004e3ef9
add esp, 0x20
pop esi
pop ebp
ret

Function at 0x4a8c00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.004a8c30
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.004f4de5