joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4096c0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x42c68c]
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [eax + 0x38], 0
jne 0x40974f
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x104
push eax
push 0x20019
push 0
push str.SOFTWARE4177SBox
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40973b
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.TName
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x409776
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret 8
add eax, 0xb4
push eax
push 0x104
push esi
push 0x4238f8
push str.TName
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esi], 0
je 0x40973b
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret 8
Function at 0x40a470
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0xffffffffffffffeb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x40a4b8
mov ecx, dword [eax + 0x1b4]
mov edi, dword [eax + 0x1b8]
test ecx, ecx
je 0x40a49f
push 0
push ecx
call ebx
test edi, edi
je 0x40a4b8
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x4246e4
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esi]
test eax, eax
jne 0x40a521
mov ecx, esi
call fcn.0040a240
push 0
push dword [0x42c688]
lea eax, [esi + 8]
push 0
push dword [esi + 4]
push 0x13a
push 0x1f1
push 0
push 0
push 0x40000000
push 0x4238f8
push eax
push 0x10000
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi], eax
test eax, eax
jne 0x40a503
pop edi
pop esi
pop ebx
ret
mov ecx, esi
call fcn.0040a2c0
push 5
push dword [esi]
call ebx
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop edi
pop esi
pop ebx
ret
push 5
push eax
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x40a530
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x30
lea eax, [ebp - 0x34]
mov edi, ecx
push 0
push eax
call fcn.00413c30
mov eax, dword [0x42c688]
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0x40a390
push 5
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0x7f00
lea esi, [edi + 8]
mov dword [ebp - 0x14], eax
push 0
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [0x42c688]
push 0
push dword [edi + 4]
push 0x13a
push 0x1f1
push 0
push 0
push 0x40000000
push 0x4238f8
push esi
push 0x10000
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi], eax
test eax, eax
jne 0x40a5e3
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.0040a2c0
push 0
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret
Function at 0x40c400
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40c40b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x40c4d5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x424ce0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x424ce0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x424ce0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x424ce0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x424ce0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x424ce0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x424ce0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x424ce0]
dec edi
jne 0x40c420
pop edi
test esi, esi
je 0x40c4fa
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x424ce0]
dec esi
jne 0x40c4e0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x40cbd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x40cc16
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40cc11
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x40cc3e
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x40cc27
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.00410910
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret
Function at 0x40cc60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x40cca5
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40cca0
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x40ccd2
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x40ccb6
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.00410910
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x40ccf0
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x40ccdd
cmp byte [esi + 8], 0
je 0x40ccdd
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret
Function at 0x40cdb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x40cdf8
cmp byte [edi + 1], 0
je 0x40cde7
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40cdfe
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
mov dword [edi + 0x18], eax
cmp byte [edi], 0
push ebx
je 0x40ce23
cmp byte [edi + 1], 0
je 0x40ce1c
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x40ce26
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x40ce35
mov ebx, dword [edi + 0x18]
mov eax, 0xffff
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
cmp ebx, eax
jae 0x40ce38
mov dword [ebp - 0x10], ebx
push esi
push 0x404
call fcn.0040f090
mov esi, eax
add esp, 4
test esi, esi
jne 0x40ce5d
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov eax, 4
mov dword [ebp - 0x14], 0
cmp ecx, eax
jbe 0x40cf5d
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x20], edx
sub ebx, ecx
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x40cebe
cmp byte [edi + 1], 0
je 0x40cf5d
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40cec1
mov dword [edi + 0x18], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x18], ebx
je 0x40cee9
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40cee4
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x40cf12
mov edx, dword [edi + 0x18]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x14]
jbe 0x40cefc
mov ecx, dword [edi + 0x14]
sub ecx, edx
mov dword [ebp - 0x18], ecx
push ecx
mov ecx, dword [edi + 0x10]
add ecx, edx
push ecx
push esi
call fcn.00410910
mov eax, dword [ebp - 0x18]
add esp, 0xc
add dword [edi + 0x18], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x40cf5d
lea eax, [ebx - 3]
test eax, eax
jle 0x40cf4c
dec eax
cmp byte [eax + esi], 0x50
jne 0x40cf3e
cmp byte [eax + esi + 1], 0x4b
jne 0x40cf3e
cmp byte [eax + esi + 2], 5
jne 0x40cf3e
cmp byte [eax + esi + 3], 6
je 0x40cf44
test eax, eax
jg 0x40cf22
jmp 0x40cf4c
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
jne 0x40cf5d
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
cmp eax, ecx
jb 0x40ce74
push esi
call fcn.0040e80f
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret
Function at 0x40dc40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x40dcd6
cmp dword [edi + 4], 0xffffffff
jne 0x40dcd6
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x423e08
push 0x104
push esi
call fcn.0040ee97
add esp, 0xc
mov dword [ebp - 8], 0
push 0x1c
call fcn.0040e794
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [eax + 0x14], ecx
mov ecx, eax
mov word [eax], 0x100
mov dword [eax + 0x10], ebx
mov dword [eax + 0x18], 0
mov dword [eax + 0xc], 0
call fcn.0040cf80
mov dword [edi], eax
mov eax, dword [0x42c6a0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, 0x1000000
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416b1c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004125d8
mov dword [ebp - 0x14], eax
cmp dword [0x42c614], esi
jne 0x416c0f
push 0x800
push esi
push 0x42072c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x416b9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x416cef
push esi
push esi
push 0x42072c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x416cef
push 0x420744
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416cef
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42c614], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42c618], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42c61c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42c624], eax
test eax, eax
je 0x416c0c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42c620], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x416c34
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x416c27
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x416c49
push 4
pop eax
jmp 0x416cf1
cmp dword [ebp - 0x14], esi
je 0x416c49
push dword [0x42c614]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x416c2e
mov eax, dword [0x42c620]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x416ca7
cmp dword [0x42c624], edi
je 0x416ca7
push eax
call ebx
push dword [0x42c624]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x416ca7
test eax, eax
je 0x416ca7
call ecx
test eax, eax
je 0x416c9c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x416c9c
test byte [ebp - 8], 1
jne 0x416ca7
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x416cd7
mov eax, dword [0x42c618]
cmp eax, edi
je 0x416cd4
push eax
call ebx
test eax, eax
je 0x416cd4
call eax
mov esi, eax
test esi, esi
je 0x416cd4
mov eax, dword [0x42c61c]
cmp eax, edi
je 0x416cd4
push eax
call ebx
test eax, eax
je 0x416cd4
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42c614]
call ebx
test eax, eax
je 0x416cef
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x416cf1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e6b9
mov esp, ebp
pop ebp
ret
Function at 0x66582cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
mov esi, edx
sub esp, 0xc
mov ebp, dword [eax + 0xc]
mov dword [esp + 8], ecx
test ebp, ebp
je 0x66582d40
movzx ecx, byte [esi]
xor eax, eax
lea edx, [edx + 1]
test cl, cl
je 0x66582cef
movzx ecx, byte [ecx + 0x66626580]
lea ebx, [eax*8]
add edx, 1
xor ebx, ecx
movzx ecx, byte [edx - 1]
xor eax, ebx
test cl, cl
jne 0x66582cd2
xor edx, edx
div dword [edi]
lea eax, [ebp + edx*8]
mov ebx, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [esp + 8]
test edi, edi
mov dword [eax], edx
jne 0x66582d17
jmp 0x66582d34
sub edi, 1
mov ebx, dword [ebx]
je 0x66582d34
mov dword [esp + 4], esi
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sym.libsqlite3_0.dll_sqlite3_stricmp
test eax, eax
jne 0x66582d10
add esp, 0xc
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0xc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 8]
mov edi, dword [eax + 4]
xor edx, edx
jmp 0x66582cfc

Function at 0x66587a90
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
test esi, esi
jle 0x66587ac0
add esi, edx
xor eax, eax
add edx, 1
movsx ecx, byte [edx - 1]
lea ebx, [eax*8]
xor ecx, ebx
xor eax, ecx
cmp edx, esi
jne 0x66587aa2
and eax, 0x7fffffff
pop ebx
pop esi
ret
xor eax, eax
jmp 0x66587abd
Function at 0x66594bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test eax, eax
je 0x66594c00
test edx, edx
je 0x66594c00
jmp sym._sqlite3ExprCompare.part.316
cmp eax, edx
setne al
movzx eax, al
add eax, eax
ret

Function at 0x66597580
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x665975a4
mov ecx, dword [ebx + 0x18]
test ecx, ecx
jne 0x66597595
pop ebx
jmp sym._vdbePmaReaderIncrMergeInit
mov ecx, eax
mov eax, dword [ebx]
mov edx, sym._vdbePmaReaderBgIncrInit
pop ebx
jmp sym._sqlite3ThreadCreate
xor eax, eax
pop ebx
ret

Function at 0x665aa560
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [eax + 0x34]
mov edi, dword [eax + 0x38]
mov esi, dword [ebx + 0x24]
movzx ebx, byte [eax + 7]
mov dword [esp + 0x18], edi
add esi, edi
mov dword [esp + 4], esi
movzx esi, byte [eax + 6]
lea ebx, [esi + ebx + 8]
add ebx, edi
test edx, edx
mov dword [esp + 8], ebx
jle 0x665aa633
mov esi, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov ebp, ecx
mov dword [esp + 0x14], 0
xor ecx, ecx
lea eax, [esi + edx*2]
xor edx, edx
mov dword [esp + 0xc], eax
jmp 0x665aa5e9
test edx, edx
je 0x665aa5ca
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movzx ecx, cx
movzx edx, dx
call sym._freeSpace
mov ecx, dword [esp + 0x10]
cmp dword [esp + 4], ecx
jb 0x665aa633
add dword [esp + 0x14], 1
mov ecx, edi
mov edx, ebx
add ebp, 4
add esi, 2
cmp dword [esp + 0xc], esi
je 0x665aa610
mov ebx, dword [ebp]
cmp dword [esp + 8], ebx
ja 0x665aa5dd
cmp dword [esp + 4], ebx
jbe 0x665aa5dd
movzx edi, word [esi]
lea eax, [ebx + edi]
cmp eax, edx
mov dword [esp + 0x10], eax
jne 0x665aa5b3
add edi, ecx
jmp 0x665aa5d4
test edx, edx
je 0x665aa63d
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movzx ecx, cx
movzx edx, dx
call sym._freeSpace
mov eax, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x665aa650
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
mov edi, dword [eax + 0x38]
mov eax, dword [eax + 0x40]
movzx esi, byte [ebx + 6]
mov dword [esp + 0x18], edx
lea eax, [eax + edx*2]
mov dword [esp + 0x14], eax
movzx eax, word [eax]
lea ebp, [edi + esi + 6]
mov dword [esp + 0x1c], ebp
mov edx, eax
lea eax, [edi + esi + 5]
rol dx, 8
movzx ebp, byte [eax]
mov dword [esp + 0x10], eax
lea eax, [edi + esi + 6]
movzx edx, dx
movzx eax, byte [eax]
shl ebp, 8
or eax, ebp
cmp edx, eax
jb 0x665aa6a8
mov eax, dword [ebx + 0x34]
lea ebp, [ecx + edx]
cmp ebp, dword [eax + 0x24]
jbe 0x665aa6e0
mov dword [esp + 0xc], 0x6661a358
mov dword [esp + 8], 0xe6bb
mov dword [esp + 4], str.database_corruption_at_line__d_of___.10s_
mov dword [esp], 0xb
call sym.libsqlite3_0.dll_sqlite3_log
mov eax, dword [esp + 0x40]
mov dword [eax], 0xb
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ecx, cx
mov eax, ebx
call sym._freeSpace
test eax, eax
jne 0x665aa740
movzx eax, word [ebx + 0x12]
sub eax, 1
test ax, ax
mov word [ebx + 0x12], ax
je 0x665aa750
movzx eax, ax
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp], ecx
add eax, eax
mov dword [esp + 8], eax
mov eax, ecx
add eax, 2
mov dword [esp + 4], eax
call sym._memmove
movzx eax, byte [ebx + 0x13]
mov byte [edi + esi + 3], al
movzx eax, word [ebx + 0x12]
mov byte [edi + esi + 4], al
add word [ebx + 0x10], 2
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esp + 0x40]
mov dword [edi], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [edi + esi + 1], 0
mov byte [edi + esi + 7], 0
mov eax, dword [ebx + 0x34]
mov edi, dword [esp + 0x10]
mov eax, dword [eax + 0x24]
shr eax, 8
mov byte [edi], al
mov eax, dword [ebx + 0x34]
mov edi, dword [esp + 0x1c]
mov eax, dword [eax + 0x24]
mov byte [edi], al
mov eax, dword [ebx + 0x34]
movzx edx, byte [ebx + 6]
mov eax, dword [eax + 0x24]
sub eax, edx
movzx edx, byte [ebx + 7]
sub eax, edx
sub eax, 8
mov word [ebx + 0x10], ax
jmp 0x665aa6d6
Function at 0x665bf030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
test byte [eax + 0x18], 0x40
mov ebx, dword [eax + 0x10]
je 0x665bf0a0
mov edx, dword [ebx + 0x88]
sub dword [ebx + 0x78], 1
mov ecx, dword [ebx + 0x3c]
mov dword [eax + 0xc], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x88], eax
mov esi, dword [ecx]
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 0x98]
mov eax, dword [eax + 0x14]
mov dword [esp], ecx
mov ebp, edx
sar ebp, 0x1f
sub eax, 1
mov edi, ebp
imul edi, eax
mul edx
add edx, edi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call dword [esi + 0x48]
mov edx, dword [ebx + 0x78]
test edx, edx
je 0x665bf0ac
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._sqlite3PcacheRelease
mov edx, dword [ebx + 0x78]
test edx, edx
jne 0x665bf08e
mov eax, dword [ebx + 0xcc]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x665bf08e
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp sym._pagerUnlockAndRollback

Function at 0x665bf7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x665bf7d4
mov dword [eax], 0
mov eax, dword [edx + 0x44]
jmp sym._sqlite3PagerUnrefNotNull
repz ret

Function at 0x665bf7e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [eax + 4]
mov edx, dword [eax]
mov byte [ebx + 0x13], 0
cmp byte [eax + 8], 0
je 0x665bf855
cmp dword [edx + 0x98], 1
jle 0x665bf815
mov edx, dword [eax + 4]
cmp eax, dword [edx + 0x4c]
je 0x665bf894
mov byte [eax + 8], 1
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov edi, dword [eax + 4]
mov edx, dword [edi + 0x48]
lea esi, [edi + 0x48]
test edx, edx
je 0x665bf830
cmp eax, dword [edx]
je 0x665bf870
lea esi, [edx + 0xc]
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x665bf822
cmp eax, dword [edi + 0x4c]
je 0x665bf8c0
cmp dword [edi + 0x28], 2
jne 0x665bf844
and word [edi + 0x16], 0xffbf
mov ecx, dword [ebx + 0x28]
lea edx, [ecx - 1]
test edx, edx
mov dword [ebx + 0x28], edx
jne 0x665bf855
mov byte [ebx + 0x14], 0
mov byte [eax + 8], 0
cmp byte [ebx + 0x14], 0
jne 0x665bf80e
add esp, 0x20
lea eax, [ebx + 0xc]
pop ebx
pop esi
pop edi
jmp sym._unlockBtreeIfUnused.isra.458.part.459
cmp dword [edx + 4], 1
mov ecx, dword [edx + 0xc]
mov dword [esi], ecx
je 0x665bf890
mov dword [esp], edx
mov dword [esp + 0x1c], eax
call sym.libsqlite3_0.dll_sqlite3_free
mov edx, dword [esi]
mov eax, dword [esp + 0x1c]
jmp 0x665bf81e
mov edx, ecx
jmp 0x665bf81e
and word [edx + 0x16], 0xff9f
mov dword [edx + 0x4c], 0
mov edx, dword [edx + 0x48]
test edx, edx
je 0x665bf80a
nop
lea esi, [esi]
mov byte [edx + 8], 1
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x665bf8b0
jmp 0x665bf80a
mov dword [edi + 0x4c], 0
and word [edi + 0x16], 0xff9f
jmp 0x665bf844