joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5190
Capabilities:
Reference sql statements

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x1030
xor edi, edi
call fcn.004bbcc0
mov esi, eax
add esp, 4
test esi, esi
je 0x4a51bb
push 0x1030
push edi
push esi
call fcn.00586030
add esp, 0xc
jmp 0x4a51c0
mov edi, 7
test edi, edi
jne 0x4a52bc
mov eax, dword [esp + 0x18]
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
push eax
push str.:memory:
mov dword [esi], 0x64
call fcn.0052ae10
add esp, 8
test eax, eax
jne 0x4a52bc
lea ebp, [esi + 8]
push ebp
push str.:memory:
call fcn.0052ae10
add esp, 8
test eax, eax
jne 0x4a52bc
mov ecx, dword [ebp]
push eax
push 1
push 0x3f0
push ecx
call fcn.004c34d0
mov edx, dword [esp + 0x2c]
mov eax, dword [esi + 4]
push str.SELECT_sql_FROM_sqlite_master_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_CREATE_VIRTUAL___
push edx
push eax
lea ebx, [esp + 0x2c]
call fcn.0049cc70
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x4a527a
jmp 0x4a5240
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00527980
add esp, 4
cmp eax, 0x64
jne 0x4a527a
mov edx, dword [esp + 0x10]
push 0
push edx
call fcn.004d0010
mov ecx, dword [esp + 0x24]
mov edx, dword [ebp]
push ecx
push 0
push 0
push eax
push edx
call fcn.00527d00
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x4a5240
mov eax, dword [esp + 0x10]
push eax
call fcn.005127b0
add esp, 4
test edi, edi
jne 0x4a52bc
test eax, eax
jne 0x4a52bc
mov ecx, dword [esp + 0x1c]
push ecx
mov ebx, esi
call fcn.0049e170
add esp, 4
test eax, eax
jne 0x4a52bc
mov edx, dword [esi + 0xc]
push esi
push 0x49ddc0
push edx
call fcn.004b6ed0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
push esi
call fcn.0049ef70
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4b1190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [eax + 0x1c], 0x20
je 0x4b11db
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
push ebx
push esi
mov dword [eax + 0x10], edx
mov esi, dword [ecx + 0x3c]
push edi
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov ebx, dword [eax + 0x18]
mov eax, dword [ecx + 0x98]
mov edi, dword [esi]
push edx
cdq
push edx
push eax
push 0
dec ebx
push ebx
call fcn.00588dd0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
ret
jmp fcn.004af3e0

Function at 0x4bc210
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
mov dword [ebp], 0
cmp dword [0x633cb0], 0
push esi
je 0x4bc272
mov eax, dword [0x641778]
test eax, eax
je 0x4bc23e
push eax
call dword [0x633d0c]
add esp, 4
lea eax, [esp + 0x10]
push eax
mov eax, 0x14
call fcn.004bbb80
mov eax, dword [0x641778]
add esp, 4
test eax, eax
je 0x4bc263
push eax
call dword [0x633d14]
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x4bc281
lea eax, [esi + 7]
pop esi
pop ebp
pop ebx
ret
push 0x14
call dword [0x633cdc]
add esp, 4
mov esi, eax
jmp 0x4bc267
cmp dword [0x633cb4], 0
je 0x4bc2c5
mov eax, dword [0x633db4]
test eax, eax
je 0x4bc2a1
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x4bc2c5
lea ecx, [esi + 4]
push ecx
push 0
push esi
push 0x4aced0
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call fcn.0058471d
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4bc2d5
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x4bc2ed
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4bdf40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x88]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ecx, ecx
push esi
cmp eax, ecx
je 0x4bdf6f
mov dword [ebp], eax
mov edx, dword [eax + 0x10]
mov dword [edi + 0x88], edx
mov edx, dword [eax + 8]
mov dword [eax + 0x10], ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
jmp 0x4bdfef
movzx ebx, word [edi + 0x8c]
xor eax, eax
push eax
add ebx, 0x28
push ebx
call fcn.004bbc40
mov esi, eax
add esp, 8
test esi, esi
je 0x4bdf97
push ebx
push 0
push esi
call fcn.00586030
add esp, 0xc
mov eax, esi
mov dword [ebp], esi
test esi, esi
jne 0x4bdfd4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [edi + 0x3c]
mov ebx, dword [esi]
push eax
mov eax, dword [edi + 0x98]
push 0
cdq
dec ecx
push ecx
push edx
push eax
call fcn.00588dd0
push edx
mov edx, dword [ebx + 0x48]
push eax
push esi
call edx
add esp, 0x10
pop esi
pop ebp
mov eax, 7
pop ebx
ret
lea ecx, [esi + 0x28]
mov dword [esi + 8], ecx
mov edx, 0x20
mov ecx, 1
mov word [esi + 0x1c], dx
mov word [esi + 0x1e], cx
mov dword [esi + 0x14], edi
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
pop esi
mov dword [eax + 0x18], edx
mov dword [eax + 4], ecx
inc dword [edi + 0x78]
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x4bf640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov al, byte [ebx + 0x44]
test al, al
jl 0x4bf729
push ebp
push esi
push edi
xor edi, edi
test al, al
jle 0x4bf6c9
lea ebp, [ebx + 0x78]
lea ecx, [ecx]
mov eax, dword [ebp]
mov eax, dword [eax + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4bf6b8
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov esi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [esi]
dec eax
push edx
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x1c]
push 0
push eax
call fcn.00588dd0
push edx
push eax
mov eax, dword [ebx + 0x48]
push esi
call eax
mov ebx, dword [esp + 0x28]
add esp, 0x10
jmp 0x4bf6bd
call fcn.004af3e0
movsx ecx, byte [ebx + 0x44]
inc edi
add ebp, 4
cmp edi, ecx
jl 0x4bf660
mov edx, dword [ebx + 0x74]
mov eax, dword [edx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4bf71d
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov esi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0x18]
mov eax, dword [ecx + 0x98]
mov edi, dword [esi]
push edx
cdq
push edx
push eax
push 0
dec ebp
push ebp
call fcn.00588dd0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
pop edi
pop esi
pop ebp
mov byte [ebx + 0x44], 0xff
pop ebx
pop ecx
ret
call fcn.004af3e0
pop edi
pop esi
mov byte [ebx + 0x44], 0xff
pop ebp
pop ebx
pop ecx
ret
Function at 0x4c1f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
lea ecx, [ecx]
xor edi, edi
cmp dword [ebp + 0x14], edi
mov dword [esp + 0x10], edi
jle 0x4c1fb4
jmp 0x4c1f40
cmp edi, 2
mov esi, edi
jge 0x4c1f4a
xor esi, 1
test ebx, ebx
je 0x4c2006
mov edx, dword [ebp + 0x10]
mov eax, esi
shl eax, 4
mov edi, dword [eax + edx]
mov dl, byte [ebx]
movzx ebp, byte [edi]
movzx ebp, byte [ebp + 0x5eb2b0]
movzx eax, dl
movzx eax, byte [eax + 0x5eb2b0]
sub eax, ebp
mov ecx, ebx
jne 0x4c1fa2
sub edi, ebx
jmp 0x4c1f80
test dl, dl
je 0x4c1ffa
movzx eax, byte [edi + ecx + 1]
movzx ebp, byte [eax + 0x5eb2b0]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x5eb2b0]
sub eax, ebp
je 0x4c1f80
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
inc edi
cmp edi, dword [ebp + 0x14]
mov dword [esp + 0x10], edi
jl 0x4c1f40
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx]
movzx edx, al
movzx edx, byte [edx + 0x5eb2b0]
sub edx, 0x73
jne 0x4c1ff2
mov edx, str.sqlite_master
sub edx, ecx
test al, al
je 0x4c202e
mov al, byte [ecx + 1]
movzx esi, byte [edx + ecx + 1]
movzx esi, byte [esi + 0x5eb2b0]
inc ecx
movzx edi, al
movzx edi, byte [edi + 0x5eb2b0]
sub edi, esi
je 0x4c1fd0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test eax, eax
jne 0x4c1fa2
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x1c]
shl esi, 4
mov eax, dword [esi + ecx + 0xc]
push 0
add eax, 8
push edx
call fcn.004ae210
mov eax, dword [eax + 8]
add esp, 8
test eax, eax
jne 0x4c1ff4
jmp 0x4c1faa
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
test ebx, ebx
jne 0x4c203e
neg eax
sbb eax, eax
jmp 0x4c2049
test eax, eax
je 0x4c1ff2
mov ecx, ebx
call fcn.004ad170
test eax, eax
jne 0x4c1ff2
mov dword [esp + 0x1c], str.sqlite_temp_master
jmp 0x4c1f30
Function at 0x4c45a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [ebx + 0x14]
mov eax, dword [esi + 0x94]
xor edx, edx
div dword [esi + 0x98]
or byte [esi + 0x14], 4
mov edx, dword [ebx + 0x18]
lea ecx, [edx - 1]
push edi
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
lea ebp, [eax - 1]
not ebp
and ebp, ecx
mov ecx, dword [esi + 0x18]
inc ebp
cmp edx, ecx
jbe 0x4c45e6
mov ebx, edx
sub ebx, ebp
inc ebx
jmp 0x4c45f7
lea edx, [eax + ebp - 1]
cmp edx, ecx
jbe 0x4c45f5
sub ecx, ebp
inc ecx
mov ebx, ecx
jmp 0x4c45f7
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0x1c], edi
jle 0x4c47a7
mov edi, ebp
cmp dword [esp + 0x10], 0
jne 0x4c47a7
mov eax, dword [esp + 0x24]
cmp edi, dword [eax + 0x18]
je 0x4c4678
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x4c4678
mov eax, edi
call fcn.004aef80
test eax, eax
je 0x4c4678
mov eax, dword [esi + 0xd4]
mov ecx, dword [eax + 0x2c]
push 0
push edi
push ecx
call dword [0x633d3c]
add esp, 0xc
test eax, eax
je 0x4c466e
mov ecx, dword [eax + 4]
cmp dword [ecx], 0
mov edx, dword [esi + 0xd4]
jne 0x4c4660
push eax
push edi
push edx
call fcn.004af340
add esp, 0xc
jmp 0x4c466e
mov eax, 1
add dword [edx + 0xc], eax
add word [ecx + 0x1e], ax
mov eax, ecx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4c46c9
jmp 0x4c46b6
mov eax, dword [0x633dc8]
cdq
idiv dword [esi + 0x98]
inc eax
cmp edi, eax
je 0x4c46c9
mov eax, dword [esi + 0xcc]
push 0
lea edx, [esp + 0x18]
push edx
push edi
push esi
call eax
add esp, 0x10
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4c46c9
mov eax, dword [esp + 0x14]
call fcn.004c44e0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
test byte [eax + 0x1c], 8
je 0x4c46c4
mov dword [esp + 0x18], 1
call fcn.004b1190
mov eax, dword [esp + 0x1c]
inc eax
inc edi
cmp eax, ebx
mov dword [esp + 0x1c], eax
jl 0x4c4605
cmp dword [esp + 0x10], 0
jne 0x4c47a7
cmp dword [esp + 0x18], 0
je 0x4c47a7
mov dword [esp + 0x24], ebx
mov eax, dword [esi + 0xd4]
mov ecx, dword [eax + 0x2c]
push 0
push ebp
push ecx
call dword [0x633d3c]
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x4c479b
mov eax, dword [ecx + 4]
cmp dword [eax], 0
mov edx, dword [esi + 0xd4]
jne 0x4c4730
push ecx
push ebp
push edx
call fcn.004af340
add esp, 0xc
jmp 0x4c473c
mov ecx, 1
add dword [edx + 0xc], ecx
add word [eax + 0x1e], cx
test eax, eax
je 0x4c479b
or word [eax + 0x1c], 8
movzx ecx, word [eax + 0x1c]
test cl, 0x20
je 0x4c4796
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [edi]
dec eax
push edx
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x28]
push 0
push eax
call fcn.00588dd0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x4c479b
call fcn.004af3e0
inc ebp
sub dword [esp + 0x24], 1
jne 0x4c46f5
and byte [esi + 0x14], 0xfb
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4e6bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov al, byte [esi + 0x44]
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0xc], ebp
test al, al
jl 0x4e6c63
je 0x4e6cd3
mov eax, dword [esi + 0x74]
mov eax, dword [eax + 0x48]
push ebx
call fcn.004b1190
or ebx, 0xffffffff
add byte [esi + 0x44], bl
je 0x4e6c57
movsx ecx, byte [esi + 0x44]
mov edx, dword [esi + ecx*4 + 0x78]
mov eax, dword [edx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4e6c4d
mov ecx, dword [eax + 0x14]
add dword [ecx + 0x78], ebx
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebp, dword [edi]
dec eax
push edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.00588dd0
push edx
push eax
mov eax, dword [ebp + 0x48]
push edi
call eax
mov ebp, dword [esp + 0x20]
add esp, 0x10
jmp 0x4e6c52
call fcn.004af3e0
add byte [esi + 0x44], bl
jne 0x4e6bf0
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x74], ecx
pop ebx
jmp 0x4e6cef
cmp dword [esi + 0x40], ebp
jne 0x4e6c76
pop edi
mov byte [esi], 1
mov eax, 0x10
pop ebp
add esp, 8
ret
mov al, byte [esi]
cmp al, 3
jb 0x4e6c9b
cmp al, 4
jne 0x4e6c89
mov eax, dword [esi + 4]
pop edi
pop ebp
add esp, 8
ret
mov edx, dword [esi + 0x10]
push edx
call fcn.004acb60
add esp, 4
mov dword [esi + 0x10], ebp
mov byte [esi], 1
movzx eax, byte [esi + 2]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 4]
push eax
mov eax, dword [esi + 0x40]
push 0
lea edi, [esi + 0x74]
push edi
push edx
call fcn.004e5f90
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4e6cc7
pop edi
mov byte [esi], 1
pop ebp
add esp, 8
ret
mov eax, dword [edi]
mov byte [esi + 0x44], 0
mov cl, byte [eax + 2]
mov byte [esi + 0x45], cl
mov eax, dword [esi + 0x74]
cmp byte [eax], 0
je 0x4e6d60
movzx eax, byte [eax + 2]
xor edx, edx
cmp dword [esi + 0x70], edx
sete dl
cmp edx, eax
jne 0x4e6d60
mov eax, dword [esi + 0x74]
and byte [esi + 1], 0xf1
xor ecx, ecx
xor edx, edx
mov word [esi + 0x46], cx
mov word [esi + 0x32], dx
cmp word [eax + 0x16], dx
jbe 0x4e6d12
pop edi
mov eax, ebp
mov byte [esi], dl
pop ebp
add esp, 8
ret
cmp byte [eax + 8], 0
jne 0x4e6d50
cmp dword [eax + 4], 1
je 0x4e6d2d
pop edi
mov eax, 0x108b8
pop ebp
add esp, 8
jmp fcn.004e1920
movzx ecx, byte [eax + 9]
mov edx, dword [eax + 0x38]
mov eax, dword [ecx + edx + 8]
bswap eax
push eax
mov eax, esi
mov byte [esi], 0
call fcn.004e6b40
add esp, 4
pop edi
mov ebp, eax
pop ebp
add esp, 8
ret
mov ebp, 0x10
pop edi
mov eax, ebp
mov byte [esi], 1
pop ebp
add esp, 8
ret
push 0x5e9a5c
push 0x108ab
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.004d3370
add esp, 0x14
pop edi
mov eax, 0xb
pop ebp
add esp, 8
ret
Function at 0x4ea050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push esi
push edi
xor edi, edi
mov esi, eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
call fcn.004e6bc0
cmp eax, 0x10
jne 0x4ea07c
mov eax, dword [esp + 0x18]
mov dword [eax], edi
mov dword [eax + 4], edi
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
push ebx
push ebp
cmp eax, edi
jne 0x4ea1b5
or ebp, 0xffffffff
lea esp, [esp]
mov ecx, dword [esi + 0x74]
mov bl, byte [ecx + 8]
test bl, bl
jne 0x4ea09f
cmp byte [ecx + 2], bl
jne 0x4ea0ac
movzx eax, word [ecx + 0x16]
cdq
add dword [esp + 0x14], eax
adc dword [esp + 0x18], edx
test bl, bl
je 0x4ea14f
mov al, byte [esi + 0x44]
test al, al
je 0x4ea19f
and byte [esi + 1], 0xf9
xor edx, edx
mov word [esi + 0x32], dx
movsx edx, al
mov dx, word [esi + edx*2 + 0x46]
dec al
mov byte [esi + 0x44], al
movsx eax, al
mov word [esi + 0x46], dx
mov edx, dword [esi + eax*4 + 0x78]
mov dword [esi + 0x74], edx
mov eax, dword [ecx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x4ea135
mov ecx, dword [eax + 0x14]
add dword [ecx + 0x78], ebp
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [edi]
dec eax
push edx
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x1c]
push 0
push eax
call fcn.00588dd0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x4ea13a
call fcn.004af3e0
mov ecx, dword [esi + 0x74]
mov dx, word [esi + 0x46]
cmp dx, word [ecx + 0x16]
jae 0x4ea0b4
inc word [esi + 0x46]
movzx eax, word [esi + 0x46]
movzx edx, word [ecx + 0x16]
cmp eax, edx
jne 0x4ea168
movzx eax, byte [ecx + 9]
mov ecx, dword [ecx + 0x38]
mov eax, dword [eax + ecx + 8]
jmp 0x4ea182
mov edx, dword [ecx + 0x40]
mov ax, word [edx + eax*2]
mov dh, al
mov dl, ah
movzx eax, dx
movzx edx, word [ecx + 0x18]
mov ecx, dword [ecx + 0x38]
and eax, edx
mov eax, dword [eax + ecx]
bswap eax
push eax
mov eax, esi
call fcn.004e6b40
add esp, 4
test eax, eax
je 0x4ea090
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], ecx
call fcn.004e6bc0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x4eebc0
Capabilities:
Reference sql statements

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
push esi
push str.sqlite_master
push esi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.004d7ee0
add esp, 0x18
test edi, edi
jne 0x4eebf3
push esi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.004d7ee0
add esp, 0x10
pop ebx
ret
Function at 0x500200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
mov esi, eax
mov al, byte [esi]
test al, al
je 0x50023d
cmp al, 3
jb 0x50021b
call fcn.004ff570
test eax, eax
jne 0x50035d
cmp byte [esi], 1
jne 0x500228
mov eax, 0x65
pop esi
pop ecx
ret
mov eax, dword [esi + 4]
xor ecx, ecx
cmp eax, ecx
je 0x50023d
mov byte [esi], cl
mov dword [esi + 4], ecx
jge 0x50023d
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x74]
cmp byte [eax + 8], 0
push ebp
push edi
jne 0x500285
mov edx, dword [eax + 0x40]
movzx ecx, word [esi + 0x46]
mov cx, word [edx + ecx*2]
mov dh, cl
mov dl, ch
movzx ecx, dx
movzx edx, word [eax + 0x18]
mov eax, dword [eax + 0x38]
and ecx, edx
mov eax, dword [ecx + eax]
bswap eax
push eax
mov eax, esi
call fcn.004e6b40
add esp, 4
test eax, eax
jne 0x50035b
call fcn.004e6dd0
pop edi
pop ebp
pop esi
pop ecx
ret
cmp word [esi + 0x46], 0
jne 0x500324
mov al, byte [esi + 0x44]
test al, al
je 0x50034c
and byte [esi + 1], 0xf9
movsx edx, al
xor ecx, ecx
mov word [esi + 0x32], cx
mov cx, word [esi + edx*2 + 0x46]
dec al
movsx edx, al
mov word [esi + 0x46], cx
mov ecx, dword [esi + 0x74]
mov byte [esi + 0x44], al
mov eax, dword [esi + edx*4 + 0x78]
mov dword [esi + 0x74], eax
mov eax, dword [ecx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x500314
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebp, dword [edi]
dec eax
push edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.00588dd0
push edx
push eax
mov eax, dword [ebp + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x500319
call fcn.004af3e0
cmp word [esi + 0x46], 0
je 0x500290
mov eax, dword [esi + 0x74]
mov ecx, 0xffff
add word [esi + 0x46], cx
cmp byte [eax + 2], 0
je 0x500359
cmp byte [eax + 8], 0
jne 0x500359
push 0
push esi
call fcn.00500360
add esp, 8
pop edi
pop ebp
pop esi
pop ecx
ret
pop edi
pop ebp
mov byte [esi], 1
mov eax, 0x65
pop esi
pop ecx
ret
xor eax, eax
pop edi
pop ebp
pop esi
pop ecx
ret

Function at 0x500360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
and byte [eax + 1], 0xf1
xor ecx, ecx
mov word [eax + 0x32], cx
cmp byte [eax], cl
jne 0x50038c
movzx ecx, word [eax + 0x46]
test cx, cx
je 0x50038c
mov edx, dword [eax + 0x74]
cmp byte [edx + 8], 0
je 0x50038c
dec ecx
mov word [eax + 0x46], cx
xor eax, eax
ret
jmp fcn.00500200
Function at 0x5106b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
push ebx
mov ebx, dword [esp + 0xdc]
push ebp
mov ebp, dword [esp + 0xe4]
push esi
push edi
push 0x34
lea eax, [esp + 0x80]
push 0
push eax
mov dword [esp + 0x1c], 0
call fcn.00586030
push 0x34
lea ecx, [esp + 0xc0]
push 0
push ecx
call fcn.00586030
push 0x34
lea edx, [esp + 0x64]
push 0
push edx
call fcn.00586030
mov esi, dword [ebp + 0xc]
mov ecx, 0xd
lea edi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xa0]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x14]
lea edx, [esp + 0x38]
lea ecx, [esp + 0xd4]
mov dword [esp + 0x7c], ecx
mov dword [esp + 0xac], edx
mov byte [esp + 0x6c], 0x2c
mov byte [esp + 0xa0], 0x39
mov ecx, dword [eax + 4]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xe0], edx
mov byte [esp + 0xd4], 0x37
mov eax, dword [eax + 0x1c]
mov ecx, edx
mov dword [esp + 0xe4], eax
push ecx
lea edx, [esp + 0x38]
mov eax, ebx
call fcn.005105e0
mov dl, byte [esp + 0x3c]
and dword [esp + 0x40], 0xffffefff
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x11c]
add esp, 0x28
mov byte [esp + 0x3a], dl
mov edx, dword [esp + 0xf0]
mov byte [esp + 0x14], 0xa4
test eax, eax
je 0x5107b4
mov ecx, dword [esp + 0xf8]
push ecx
push edx
lea ecx, [esp + 0x50]
push ecx
push ebx
call eax
add esp, 0x10
jmp 0x5107c8
or dword [esp + 0x18], 1
push edx
lea eax, [esp + 0x4c]
push eax
push ebx
call fcn.00516a40
add esp, 0xc
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x5107e4
mov al, byte [ebx + 0x13]
cmp al, 8
jae 0x5107e4
movzx edx, al
mov dword [ebx + edx*4 + 0x90], ecx
inc byte [ebx + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret