joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e770
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5147ac
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x535008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], 0
push eax
lea eax, [esi + 4]
mov dword [ebp - 0x3c], vtable.std::exception.0
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x38], xmm0
call dword [sym.imp.VCRUNTIME140.dll___std_exception_copy]
mov eax, dword [esi + 0xc]
add esp, 8
movaps xmm0, xmmword [0x52a370]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2c], eax
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x3c], vtable.boost::exception_detail::error_info_injector_class_boost::io::too_many_args_.1.0
mov dword [ebp - 0x28], vtable.boost::exception_detail::error_info_injector_class_boost::io::too_many_args_.0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0x5204b4
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
mov dword [ebp - 0x10], 2
call fcn.0041d330
mov dword [ebp - 4], 3
lea edx, [ebp - 0x28]
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_many_args__.2.0
mov dword [edi + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_many_args__.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::io::too_many_args__.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
lea ecx, [edi + 0x14]
call fcn.0040aed0
mov eax, dword [edi + 0x28]
mov dword [edi], vtable.boost::wrapexcept_class_boost::io::too_many_args_.2.0
mov dword [edi + 0x14], vtable.boost::wrapexcept_class_boost::io::too_many_args_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::wrapexcept_class_boost::io::too_many_args_.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
mov dword [ebp - 0x3c], vtable.boost::exception_detail::error_info_injector_class_boost::io::too_many_args_.1.0
mov dword [ebp - 0x28], vtable.boost::exception.0
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x41e8a7
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], vtable.std::exception.0
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_exception_destroy]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42de30
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x535188]
test eax, eax
jns 0x42de48
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x535188], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x42dea3
push esi
push 0x1c
call fcn.0051055c
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
push esi
push dword [0x535188]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x53502c
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x430160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
mov eax, ecx
mov dword [ebp - 4], eax
test esi, esi
jle 0x43019b
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
mov edi, 0x10
push eax
cmp esi, edi
push 1
cmovl edi, esi
push edi
push 0x5179b0
call ebx
mov eax, dword [ebp - 4]
sub esi, edi
add esp, 0x10
test esi, esi
jg 0x430178
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x430d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
mov eax, ecx
mov dword [ebp - 4], eax
test esi, esi
jle 0x430d4b
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
mov edi, 0x10
push eax
cmp esi, edi
push 2
cmovl edi, esi
push edi
push 0x5179e8
call ebx
mov eax, dword [ebp - 4]
sub esi, edi
add esp, 0x10
test esi, esi
jg 0x430d28
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x431430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x535008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x21c]
mov edi, ecx
push eax
xorps xmm0, xmm0
mov ebx, edx
push edi
movlpd qword [ebp - 0x21c], xmm0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetpos]
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push edi
push 0x200
lea eax, [ebp - 0x204]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x24
mov dword [ebp - 0x208], 0xffdd
lea ecx, [ebp - 0x208]
push ecx
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
mov esi, eax
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fsetpos]
add esp, 8
call fcn.0042de30
mov edx, ebx
push dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x210], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - method.NodeFileReader.virtual_0], vtable.NodeFileReader.0
mov dword [ebp - 0x20c], edi
test esi, esi
jle 0x431505
call fcn.00431b70
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret 4
call fcn.00431520
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051023c
mov esp, ebp
pop ebp
ret 4
Function at 0x4337a0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
xor edi, edi
nop dword [eax]
mov ecx, dword [ebx]
add esi, 3
and esi, 0xfffffffc
mov edx, esi
call fcn.00436660
test eax, eax
jne 0x4337df
mov ecx, esi
call fcn.00433770
cmp eax, 1
jne 0x4337d7
mov eax, edi
inc edi
cmp eax, 0xa
jl 0x4337b0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
pop esi
pop ebx
ret

Function at 0x4337f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, ecx
xor esi, esi
nop dword [eax]
push 4
push 0x3000
push 0x10000
push 0
call edi
mov ecx, eax
test ecx, ecx
jne 0x433835
mov ecx, 0x10000
call fcn.00433770
cmp eax, 1
jne 0x43382d
mov eax, esi
inc esi
cmp eax, 0xa
jl 0x433800
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebx + 0x20]
pop edi
mov dword [ecx], eax
lea eax, [ecx + 4]
pop esi
mov dword [ebx + 0x20], ecx
pop ebx
ret

Function at 0x433ec0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x538564], 0
jne 0x433f5c
mov ecx, 0x538578
mov dword [0x53856c], 0x40000
mov dword [0x538570], 0x200000
mov dword [0x538574], 7
call fcn.00433e20
cmp dword [0x538560], 0
jne 0x433f22
mov eax, dword [0x538574]
mov dword [0x538560], 0x58585858
mov dword [0x538b38], 0
mov dword [0x538b34], eax
mov ecx, 0x538578
call fcn.00433e60
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov dword [0x538564], edx
mov dword [0x538568], ecx
lea eax, [ecx - 1]
test ecx, eax
jne 0x433f56
lea eax, [edx - 1]
test edx, eax
je 0x433f5c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x450ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov al, byte [esi + 0x44]
test al, al
js 0x450fca
xor ebx, ebx
test al, al
jle 0x450f67
lea ecx, [esi + 0x78]
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x450f4e
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00511980
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
jmp 0x450f53
call fcn.00444eb0
mov ecx, dword [esp + 0x10]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, eax
jl 0x450f00
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x450fbf
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.00511980
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.00444eb0
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4559d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x14], 0
push edi
mov eax, edx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0x14], eax
cmp byte [esi + 0x11], 0
je 0x455aa9
lea esi, [eax + 1]
mov edi, ecx
lea ebx, [esi - 2]
cmp esi, 2
jae 0x455a0d
xor edx, edx
jmp 0x455a3c
mov eax, 0xcccccccd
mul dword [edi + 0x24]
mov eax, ebx
mov ecx, edx
xor edx, edx
shr ecx, 2
inc ecx
div ecx
mov eax, dword [0x5352fc]
mov ecx, ebx
sub ecx, edx
xor edx, edx
div dword [edi + 0x20]
xor edx, edx
dec eax
cmp ecx, eax
sete dl
add edx, 2
add edx, ecx
cmp edx, esi
je 0x455a4f
mov eax, dword [0x5352fc]
xor edx, edx
div dword [edi + 0x20]
inc eax
cmp esi, eax
jne 0x455a53
inc esi
inc ebx
jmp 0x455a04
cmp esi, dword [edi + 0x2c]
mov edi, 0
ja 0x455a9f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x13]
mov edx, esi
push eax
call fcn.004514c0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x455b0e
cmp byte [esp + 0xf], 4
mov edx, dword [esp + 0x14]
jne 0x455a99
cmp dword [esp + 0x1c], edx
jne 0x455a99
mov dword [esp + 0x18], esi
lea ebx, [edi + 0x65]
jmp 0x455b0e
mov esi, dword [esp + 0x10]
jmp 0x455aab
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
jmp 0x455aab
mov edx, eax
mov ecx, dword [esi]
xor eax, eax
cmp dword [ebp + 8], eax
mov ebx, 2
cmove eax, ebx
push eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [ecx + 0xcc]
push edx
push ecx
call eax
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x455b0e
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edi, dword [edx + 8]
cmp eax, dword [edi + 4]
je 0x455b01
mov ecx, dword [edx + 4]
cmp eax, 1
mov dword [edi + 4], eax
setne al
mov dword [edi + 0x38], ecx
dec al
mov dword [edi + 0x48], edx
and al, 0x64
mov dword [edi + 0x34], esi
mov byte [edi + 9], al
jmp 0x455b04
mov ecx, dword [edi + 0x38]
mov eax, dword [ecx]
xor ebx, ebx
bswap eax
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x455b31
mov dword [eax], edi
xor eax, eax
cmp ebx, 0x65
cmove ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x455b93
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x455b8c
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.00511980
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
xor eax, eax
add esp, 0x10
cmp ebx, 0x65
cmove ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.00444eb0
xor eax, eax
cmp ebx, 0x65
pop edi
cmove ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x18], edx
push edi
xor edi, edi
mov dword [esp + 0x18], edi
mov ecx, dword [esi + 0x48]
mov ebx, dword [esi + 0x34]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
test byte [ecx + 0x1c], 4
mov edx, dword [ecx + 0x14]
je 0x45a6d3
mov eax, dword [edx + 0x18]
cmp eax, dword [ecx + 0x18]
jb 0x45a6d3
cmp dword [edx + 0x60], edi
je 0x45a706
call fcn.0044a3e0
jmp 0x45a6f8
mov ebx, dword [edx + 0x28]
test ebx, ebx
jne 0x45a7c2
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x45a6f3
call fcn.0044bea0
jmp 0x45a6f8
call fcn.0044bc80
mov ebx, eax
test ebx, ebx
jne 0x45a7c2
mov ebx, dword [esp + 0x10]
push 0
push dword [esi + 4]
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
lea edx, [esp + 0x24]
call fcn.00456d40
mov edi, dword [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x10], eax
mov edx, edi
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004590d0
add esp, 4
cmp byte [ebx + 0x11], 0
je 0x45a755
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
mov ecx, ebx
push 5
call fcn.004513a0
add esp, 0xc
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x45a7c2
movzx eax, byte [esi + 0xc]
add eax, eax
push eax
lea eax, [esi + 0x1c]
push eax
lea eax, [edi + 0x1c]
push eax
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [esi + 0xc]
add esp, 0xc
shl eax, 2
push eax
lea eax, [esi + 0x24]
push eax
lea eax, [edi + 0x24]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov al, byte [esi + 0xc]
add esp, 0xc
mov byte [edi + 0xc], al
mov ecx, esi
mov eax, dword [edi + 0x38]
movzx edx, byte [eax]
and edx, 0xfffffff7
call fcn.00452820
mov eax, dword [esi + 0x38]
movzx ecx, byte [esi + 9]
mov edx, dword [esp + 0x14]
bswap edx
mov dword [ecx + eax + 8], edx
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [eax], 0
test edi, edi
je 0x45a824
mov ecx, dword [edi + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x45a81f
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov esi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00511980
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00444eb0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ba90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x14], ebx
cmp edx, dword [ebx + 0x2c]
jbe 0x45bad1
push 0x52a07c
push 0x11e81
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.0043d780
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00452a30
add esp, 0xc
test eax, eax
jne 0x45bc77
mov esi, dword [esp + 0x10]
cmp byte [esi + 1], al
je 0x45bb1b
push 0x52a07c
push 0x11e86
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.0043d780
add esp, 0x14
mov ebx, 0xb
jmp 0x45bc1b
mov byte [esi + 1], 1
xor ecx, ecx
movzx eax, word [esi + 0x18]
movzx edi, byte [esi + 9]
mov edx, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
cmp cx, ax
jae 0x45bbb0
nop dword [eax]
mov eax, dword [esi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [esi + 0x1a]
movzx edi, cx
and edi, eax
add edi, dword [esi + 0x38]
cmp byte [esi + 8], 0
jne 0x45bb7a
mov edx, dword [edi]
mov ecx, ebx
push dword [ebp + 0xc]
bswap edx
push 1
call fcn.0045ba90
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x45bc1b
lea eax, [esp + 0x20]
mov edx, edi
push eax
mov ecx, esi
call fcn.004579e0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x45bc1b
mov ecx, dword [esp + 0x10]
movzx eax, word [esi + 0x18]
inc ecx
mov ebx, dword [esp + 0x14]
mov edx, eax
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x45bb40
mov edi, dword [esp + 0x1c]
cmp byte [esi + 8], 0
movzx eax, dx
jne 0x45bbd9
mov eax, dword [esi + 0x38]
mov ecx, ebx
push dword [ebp + 0xc]
push 1
mov edx, dword [eax + edi + 8]
bswap edx
call fcn.0045ba90
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x45bc1b
jmp 0x45bbe2
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x45bbe2
add dword [ecx], eax
cmp dword [ebp + 8], 0
je 0x45bbfc
push dword [esi + 4]
mov ecx, dword [esi + 0x34]
mov edx, esi
call fcn.00457620
add esp, 4
mov ebx, eax
jmp 0x45bc1b
mov ecx, dword [esi + 0x48]
call fcn.0044c100
mov ebx, eax
test ebx, ebx
jne 0x45bc1b
mov eax, dword [esi + 0x38]
mov ecx, esi
movzx edx, byte [eax + edi]
or edx, 8
call fcn.00452820
mov byte [esi + 1], 0
mov edx, dword [esi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x45bc6e
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.00511980
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.00444eb0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470fa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.0043a970
mov esi, eax
add esp, 8
test esi, esi
jne 0x470fd0
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x53506c], 0
mov edi, dword [ebp + 8]
je 0x47101b
mov eax, dword [0x53515c]
test eax, eax
je 0x470ff3
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x47101b
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x43da70
push 0
push 0
mov dword [esi + 0xc], edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x471028
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x471041
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47fde0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.00485500
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x47fe1b
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.00485500
add esp, 0x10
pop edi
pop ebx
pop ebp
ret

Function at 0x485600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
xor esi, esi
cmp dword [ecx + 0x14], esi
jle 0x48569e
nop
mov edi, esi
xor edi, 1
cmp esi, 2
cmovge edi, esi
test eax, eax
je 0x485655
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov ebx, dword [ecx + edx*8]
sub ebx, dword [ebp + 8]
nop dword [eax]
movzx edx, byte [eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x48567a
test edx, edx
jne 0x48568c
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x10]
add edi, edi
push 0
mov edx, ebx
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.0043ff10
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x48572d
jmp 0x485692
movzx ecx, byte [ecx + 0x51b350]
movzx edx, byte [edx + 0x51b350]
sub edx, ecx
jne 0x48568f
inc eax
jmp 0x485640
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
inc esi
mov eax, dword [ebp + 8]
cmp esi, dword [ecx + 0x14]
jl 0x485620
mov edx, str.sqlite_master
sub edx, ebx
movzx ecx, byte [ebx]
movzx eax, byte [edx + ebx]
cmp ecx, eax
jne 0x4856ca
test ecx, ecx
jne 0x4856dc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4856df
neg ecx
sbb ecx, ecx
jmp 0x485702
movzx eax, byte [eax + 0x51b350]
movzx ecx, byte [ecx + 0x51b350]
sub ecx, eax
jne 0x48572b
inc ebx
jmp 0x4856a5
test ecx, ecx
je 0x48572b
mov esi, ecx
mov edx, eax
sub esi, eax
nop dword [eax]
movzx ecx, byte [edx]
movzx eax, byte [esi + edx]
cmp ecx, eax
jne 0x485716
test ecx, ecx
jne 0x485728
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x48572b
mov ecx, dword [ebp - 4]
mov ebx, str.sqlite_temp_master
mov dword [ebp - 8], ebx
jmp 0x485614
movzx eax, byte [eax + 0x51b350]
movzx ecx, byte [ecx + 0x51b350]
sub ecx, eax
jne 0x4856ff
inc edx
jmp 0x4856f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x485940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov dword [ebp - 8], edx
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [eax + 0x14], ebx
jle 0x4859d6
mov edx, dword [ebp + 8]
push esi
nop dword [eax]
mov eax, dword [eax + 0x10]
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
shl esi, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
test edx, edx
je 0x485995
mov esi, dword [esi]
mov eax, edx
sub esi, edx
movzx edx, byte [eax]
movzx ecx, byte [esi + eax]
cmp edx, ecx
jne 0x4859c1
test edx, edx
jne 0x4859d3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea ecx, [eax + 0x18]
push 0
call fcn.0043ff10
add esp, 4
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x4859b8
mov eax, dword [ebp - 0xc]
inc edi
mov edx, dword [ebp + 8]
cmp edi, dword [eax + 0x14]
jl 0x485960
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ecx + 0x51b350]
movzx edx, byte [edx + 0x51b350]
sub edx, ecx
jne 0x4859ac
inc eax
jmp 0x485983
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret