joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a56f0
Capabilities:
Delete file
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x571c20
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
push ecx
push edx
mov dword [esp + 0x2c], 0x60
call fcn.00476e70
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4a574f
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push ebx
call fcn.004a54d0
mov ecx, dword [ebx + 4]
mov edi, eax
add esp, 8
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x4a577c
mov dword [ebx + 8], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x24], 0
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x4a5799
mov dword [ebx + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
imul ecx, esi
mov edx, dword [esp + 0x1c]
push esi
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call fcn.0046c450
lea esi, [esp + 0x2c]
call fcn.004a52a0
test al, al
je 0x4a57f7
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 0
push 0
push 0
push ecx
push edx
push edi
call fcn.004d1870
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4a57f7
test edi, edi
je 0x4a57f1
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov dword [esp + 0x18], esi
mov edi, esi
push 0x64
lea eax, [esp + 0x18]
push 0x58cffc
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0
call fcn.004d1f00
add esp, 0xc
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x4a589a
lea esi, [esp + 0x1c]
call fcn.00476bf0
mov byte [esp + 0x38], 1
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4a587e
push ecx
mov edx, esp
mov dword [esp + 0x24], esp
push edx
mov edi, str.disable_resize
call fcn.00421180
push ecx
mov byte [esp + 0x40], 2
mov edi, dword [esp + 0x1c]
mov eax, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00421180
mov byte [esp + 0x40], 3
mov ecx, esi
mov byte [esp + 0x40], 1
call fcn.00476af0
mov edi, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [esp + 0x38], 0
test esi, esi
je 0x4a589a
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
test edi, edi
je 0x4a58b2
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a58da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aaea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571b88
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CMyScrollbar.0
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
or edi, 0xffffffff
mov dword [esi + 0x28], edi
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
xor eax, eax
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi + 0x2c], eax
push 0x58f340
mov dword [esi + 0x30], eax
lea ecx, [ebp - 0x10]
push ebx
mov dword [esi + 0x34], eax
push ecx
mov dword [esi + 0x38], eax
call fcn.00478070
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, dword [eax]
call fcn.004d1740
mov dword [esi + 0x38], eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4aaf54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.IDI_SCROLLBAR_BG
lea ecx, [ebp - 0x10]
push ebx
push ecx
call fcn.00478070
add esp, 0xc
mov byte [ebp - 4], 2
mov ecx, dword [eax]
call fcn.004d1740
mov dword [esi + 0x2c], eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x4aaf93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b7580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0x84
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], 0
call fcn.00544310
xor eax, eax
movzx ebx, ax
lea edx, [esi + 0x88]
mov eax, ebx
add esp, 0xc
shl ebx, 0x10
mov edi, edx
or eax, ebx
mov ecx, 0x82
rep stosd dword es:[edi], eax
lea ecx, [ebp - 4]
push ecx
push edx
lea edx, [ebp - 8]
push edx
push 0x58a648
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0x208
mov dword [ebp - 8], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop edi
mov eax, esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ba870
Capabilities:
Create thread

Disassembly:
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esi + 0x18], 0
jne 0x4ba90b
cmp dword [0x5cede8], 0
jne 0x4ba8ab
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4ba8ab
push str.CancelIoEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5cede8], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0xac], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0xa4], eax
call edi
mov dword [esi + 0xa0], eax
mov eax, esi
call fcn.004bb100
lea eax, [esi + 0xb0]
push eax
push 0
push esi
push 0x4bb210
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xa8], eax
mov byte [esi + 0x18], 1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
ret
Function at 0x4bd5e0
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56f51c
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x5c3678]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x4bd805
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x6e]
push edx
mov word [esp + 0x70], cx
call fcn.00544310
add esp, 0xc
push 0x104
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x68]
call fcn.00423950
lea edx, [esp + 0x14]
push edx
mov eax, 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x284], 0
call fcn.00420540
lea edi, [esp + 0x10]
mov byte [esp + 0x280], 1
call fcn.00423c70
mov byte [esp + 0x280], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bd6c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x4bd700
mov dword [esp + 0x280], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4bd7f9
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
shrd esi, ecx, 0x14
shrd edi, edx, 0x14
shr ecx, 0x14
shr edx, 0x14
cmp esi, ebx
jae 0x4bd7da
push 0
call fcn.0053ddbc
add esp, 4
push ebx
push edi
mov dword [esp + 0x20], eax
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], edx
call fcn.004b4e70
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x38]
push edx
push ecx
mov eax, esp
mov byte [esp + 0x288], 2
mov dword [eax], 1
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], esp
push eax
call fcn.004b87a0
mov eax, 0x5cfd68
lea edx, [esp + 0x14]
mov byte [esp + 0x280], 3
call fcn.0040e850
test al, al
je 0x4bd7c8
mov esi, dword [esi + 0x158]
test esi, esi
je 0x4bd7a9
lea ecx, [esp + 0x14]
push ecx
mov edi, esi
call fcn.004226a0
lea ecx, [esp + 0x14]
call fcn.00423d60
lea esi, [esp + 0x38]
call fcn.004b5430
lea ecx, [esp + 0x10]
call fcn.00423d60
mov al, 1
jmp 0x4bd807
lea ecx, [esp + 0x14]
call fcn.00423d60
lea esi, [esp + 0x38]
call fcn.004b5430
mov dword [esp + 0x280], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4bd805
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret 8
Function at 0x4bdfb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [esi + 0x50], 0
push 0
je 0x4bdfde
push 1
push 0x407
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
neg eax
sbb eax, eax
neg eax
pop ebx
pop ebp
ret 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4bdffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop ebx
pop ebp
ret 4
lea eax, [esi + 0x28]
push eax
push 0
push esi
push 0x4c86f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x24], eax
call fcn.004d0e60
test eax, eax
jl 0x4bdff7
mov ecx, dword [esi + 0x38]
push 0x7d0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [edi]
mov dword [esi + 0x148], edx
mov eax, dword [edi + 4]
push ebx
mov dword [esi + 0x14c], eax
push 0x401
mov ecx, 0x407
mov eax, esi
call fcn.004c78c0
neg eax
sbb eax, eax
neg eax
pop ebx
pop ebp
ret 4

Function at 0x4bf140
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568b01
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5c3678]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [ebp - 0x21a]
push ecx
mov word [ebp - 0x21c], ax
call fcn.00544310
mov edx, dword [esi + 4]
xor eax, eax
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], eax
mov edi, dword [edi]
push edi
push str.misc
lea eax, [ebp - 0x21c]
push str.SELECT__FROM__s_WHERE_prop___s_
push eax
mov ecx, 0x104
call fcn.00420800
add esp, 0x1c
lea ecx, [ebp - 0x220]
push ecx
mov ecx, str.value
call fcn.00421320
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.00423950
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x230], esp
lea ecx, [ebp - 0x220]
push ecx
push eax
mov byte [ebp - 4], 2
call fcn.004b7e50
lea edx, [ebp - 0x22c]
push edx
mov edi, ebx
lea edx, [ebp - 0x224]
call fcn.004cb230
test al, al
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x224]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bf244
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bf26a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret 4
Function at 0x4bfa80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570b9c
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x5c3678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
mov esi, ecx
test eax, eax
je 0x4bfb4e
lea edi, [esi + 0x14]
mov eax, ebx
call fcn.00423c70
call fcn.004b76c0
push eax
call fcn.004b7740
test al, al
je 0x4bfb4e
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.00544310
mov ebx, dword [ebx]
add esp, 0xc
push str.member_activity.db
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
call fcn.004b76c0
mov eax, dword [eax + 8]
test eax, eax
je 0x4bfb4e
lea edi, [esi + 4]
lea edx, [ebp - 0x218]
push edi
push edx
call eax
add esp, 8
test eax, eax
jne 0x4bfb4e
test bl, bl
je 0x4bfb55
mov ecx, esi
call fcn.004c2620
test al, al
jne 0x4bfb62
xor al, al
jmp 0x4bfcb7
call fcn.004c2a50
test al, al
je 0x4bfcb7
call fcn.004c2d00
test al, al
je 0x4bfb4e
push 8
call fcn.0053d304
add esp, 4
test eax, eax
je 0x4bfb86
mov ecx, dword [edi]
mov dword [eax], ecx
mov dword [eax + 4], 0
jmp 0x4bfb88
xor eax, eax
push eax
lea edi, [esi + 0xc]
push edi
call fcn.004c7350
cmp dword [edi], 0
je 0x4bfb4e
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x41e]
push eax
mov word [ebp - 0x420], dx
call fcn.00544310
push str.activity
lea ecx, [ebp - 0x420]
push str.INSERT_OR_IGNORE_INTO__s_time_hash_seq_lang_type_content_flags__VALUES________________
push ecx
mov ecx, 0x104
call fcn.00420800
add esp, 0x18
lea edx, [ebp - 0x424]
push edx
lea ecx, [ebp - 0x420]
call fcn.00423950
mov dword [ebp - 4], 0
mov edi, dword [edi]
lea edx, [ebp - 0x424]
mov eax, edi
call fcn.004b8180
test al, al
sete bl
or edi, 0xffffffff
lea ecx, [ebp - 0x424]
mov dword [ebp - 4], edi
call fcn.00423d60
test bl, bl
jne 0x4bfb4e
push 0x5cfb38
lea eax, [ebp - 0x424]
push eax
call fcn.004b4160
mov dword [ebp - 4], 1
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
lea eax, [ebp - 0x424]
push eax
mov ecx, esi
call edx
test al, al
lea eax, [ebp - 0x424]
sete bl
mov dword [ebp - 4], edi
call fcn.004f0b40
test bl, bl
je 0x4bfcb1
lea eax, [ebp - 0x42c]
push eax
mov ecx, 0x58a634
call fcn.00423950
push eax
lea ecx, [ebp - 0x428]
push ecx
mov dword [ebp - 4], 2
call fcn.004b4160
mov byte [ebp - 4], 3
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
lea eax, [ebp - 0x428]
push eax
mov ecx, esi
call edx
test al, al
lea eax, [ebp - 0x428]
sete bl
call fcn.004f0b40
lea ecx, [ebp - 0x42c]
call fcn.00423d60
test bl, bl
jne 0x4bfb4e
mov byte [esi + 8], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret 4

Function at 0x4bfce0
Capabilities:
Check if file exists
Delete file

Disassembly:
cmp byte [ecx + 8], 0
jne 0x4bfce9
xor al, al
ret
jmp fcn.004bfcf0
Function at 0x4c13c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568a0e
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x5c3678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x228], esi
cmp byte [edi + 8], 0
mov dword [ebp - 0x244], ebx
jne 0x4c143d
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x2c], 0xf
mov dword [ebx + 0x28], esi
mov byte [ebx + 0x18], 0
mov eax, dword [0x5cc90c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5cc90c
call edx
add eax, 0x10
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], esi
jmp 0x4c15e9
mov ecx, dword [eax]
cmp dword [ecx - 0xc], esi
jne 0x4c1450
mov esi, ebx
call fcn.004b7d40
jmp 0x4c15e9
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], esi
lea ecx, [ebp - 0x240]
lea esi, [ebp - 0x220]
call fcn.004c0bb0
test al, al
je 0x4c1444
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x216]
push eax
mov word [ebp - 0x218], dx
call fcn.00544310
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x220]
push edx
push eax
push ecx
push str.activity
lea edx, [ebp - 0x218]
push str.SELECT__FROM__s_WHERE_time_I64u_AND_seq_I64u_
push edx
mov ecx, 0x104
call fcn.00420800
mov eax, dword [edi + 4]
add esp, 0x28
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x224]
push ecx
mov edi, 1
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], edi
call fcn.00423950
sub esp, 8
mov byte [ebp - 4], 2
mov edx, esp
mov dword [ebp - 0x21c], esp
push edx
call fcn.004b79f0
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x224]
call fcn.004cb7a0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4c1547
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x238]
cmp dword [eax + 0x18], 0
jne 0x4c1562
mov esi, ebx
call fcn.004b7d40
mov dword [ebp - 0x228], edi
jmp 0x4c15cb
mov ecx, dword [eax + 0x14]
mov eax, dword [eax]
mov esi, dword [ecx]
test eax, eax
jne 0x4c1609
call fcn.0053d6a6
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x4c1582
call fcn.0053d6a6
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
add esi, 8
push ecx
push edx
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.004c0b20
add esp, 0xc
lea edi, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.00423c70
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 4
call fcn.00423d60
push ebx
mov edi, esi
call fcn.004c1610
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 1
call fcn.004551c0
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.004b8100
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret 8
mov eax, dword [eax]
jmp 0x4c1578
Function at 0x4c1610
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56461b
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
lea eax, [edi + 0x14]
push 0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00423020
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x30]
sub eax, 0x10
call fcn.00423cf0
add eax, 0x10
mov dword [esi + 0x30], eax
mov edx, dword [edi + 0x34]
mov dword [esi + 0x34], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c2290
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56601e
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5c3678]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi + 8], 0
jne 0x4c22fa
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c22f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
jmp 0x4c23d7
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.00544310
add esp, 0xc
lea edi, [ebp + 8]
call fcn.004b3e50
push eax
mov eax, dword [esi + 0x30]
push eax
push 0xffffffffffffffff
push str.activity
lea ecx, [ebp - 0x218]
push str.SELECT_COUNT_ROWID__FROM__s_WHERE_lang_IN__d__d__AND_type_IN___s__
push ecx
mov ecx, 0x104
call fcn.00420800
mov edx, dword [esi + 4]
add esp, 0x18
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 1
call fcn.00423950
or eax, 0xffffffff
push eax
lea ecx, [ebp - 0x21c]
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 2
call fcn.004cb890
mov esi, eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c23af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c23d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053c15d
mov esp, ebp
pop ebp
ret 8