joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409170
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
cmp dword [esp + 8], 0
push esi
mov esi, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x2c], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x34], ecx
setne cl
push str.MAPI32.DLL
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
mov byte [esi + 0x20], cl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x18], eax
jne 0x4091d4
mov edx, dword [esp + 8]
mov dword [esi + 0x1c], 0x80040102
mov dword [edx], eax
mov eax, esi
pop esi
ret 0x24
push ebx
push edi
push 0xc
call fcn.0042fb1e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x409214
mov eax, dword [esi + 0x18]
push ebp
push str.MAPIFreeBuffer
push eax
call edi
mov ecx, dword [esi + 0x18]
push str.MAPIAllocateBuffer
push ecx
mov ebp, eax
call edi
mov dword [ebx + 8], ebp
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
pop ebp
jmp 0x409216
xor ebx, ebx
mov edx, dword [esi + 0x18]
push str.MAPIInitialize
push edx
mov dword [esi + 0x14], ebx
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x18]
push str.MAPIUninitialize
push eax
call edi
mov ecx, dword [esi + 0x18]
push str.MAPILogonEx
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x18]
push str.HrQueryAllRows
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 4]
test eax, eax
pop edi
pop ebx
je 0x409296
cmp dword [esi + 8], 0
je 0x409296
cmp dword [esi + 0xc], 0
je 0x409296
push 0
call eax
test eax, eax
mov dword [esi + 0x1c], eax
jl 0x40929d
mov eax, dword [esi + 0xc]
push esi
push 0x63
push 0
push 0
push 0
call eax
mov ecx, dword [esp + 8]
push ecx
push esi
mov dword [esi + 0x1c], eax
call fcn.00409030
add esp, 8
mov eax, esi
pop esi
ret 0x24
mov dword [esi + 0x1c], 0x80040102
mov ecx, dword [esp + 8]
push ecx
push esi
call fcn.00409030
add esp, 8
mov eax, esi
pop esi
ret 0x24
Function at 0x40b550
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
push ebx
xor edi, edi
xor ebp, ebp
call fcn.0040cf90
mov esi, eax
add esp, 4
test esi, esi
jne 0x40b618
push eax
mov eax, dword [ebx]
push 0x40d1c0
push eax
call fcn.0040d0c0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40b618
mov ecx, dword [ebx]
push eax
push 0x43844c
push ecx
call fcn.0040d110
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40b618
lea ebp, [edi + 0x10]
push ebp
call dword [sym.imp.MSVCR80.dll_malloc]
xor edx, edx
add esp, 4
mov edi, eax
test edi, edi
sete dl
mov esi, edx
test esi, esi
jne 0x40b618
xor eax, eax
push 0xf0000000
mov dword [edi], eax
mov dword [edi + 4], eax
push 1
mov dword [edi + 8], eax
push eax
mov dword [edi + 0xc], eax
push eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40b625
mov ecx, dword [esp + 0x10]
push edi
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x40b625
mov edx, dword [esp + 0x10]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebx]
push esi
push ebp
push edi
push eax
call fcn.0040d140
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b625
push ebx
call fcn.0040d080
add esp, 4
test ebp, ebp
jbe 0x40b631
push ebp
push 0
push edi
call sub.MSVCR80.dll_memset
add esp, 0xc
test edi, edi
je 0x40b63f
push edi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40c600
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x818
mov eax, dword [0x43c510]
xor eax, esp
mov dword [esp + 0x814], eax
mov eax, dword [esp + 0x81c]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebp
push edi
mov edi, ecx
lea ecx, [esp + 0x14]
push ecx
push 0x20019
xor ebp, ebp
push ebp
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x40c773
mov eax, dword [esp + 0x14]
push esi
lea edx, [esp + 0x1c]
push edx
push 0x20019
push ebp
push str.cAllowedRegistryPaths
push eax
mov dword [esp + 0x28], 0x400
call ebx
test eax, eax
mov esi, dword [sym.imp.MSVCR80.dll_wcstok_s]
jne 0x40c6d7
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push ebp
push ebp
push 0x43309c
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c6cc
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x28]
push 0x433098
push eax
mov word [esp + ecx*2 + 0x30], bp
mov dword [esp + 0x1c], ebp
call esi
add esp, 0xc
mov edi, edi
push eax
mov ecx, edi
call fcn.0040c3b0
lea ecx, [esp + 0x10]
push ecx
push 0x433098
push ebp
call esi
add esp, 0xc
cmp eax, ebp
jne 0x40c6b0
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push 0x20019
push ebp
push str.cAllowedFolderPaths
push ecx
call ebx
test eax, eax
jne 0x40c767
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push ebp
push ebp
push 0x43309c
push ecx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c75c
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push 0x433098
push ecx
mov word [esp + edx*2 + 0x30], bp
mov dword [esp + 0x1c], ebp
call esi
add esp, 0xc
jmp 0x40c740
push eax
mov ecx, edi
call fcn.0040c420
lea edx, [esp + 0x10]
push edx
push 0x433098
push ebp
call esi
add esp, 0xc
cmp eax, ebp
jne 0x40c740
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [esp + 0x820]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fac4
add esp, 0x818
ret 4
Function at 0x40c790
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x430dd9
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x43c510]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c510]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.0040ba70
xor ebx, ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x22c], ebx
call fcn.0040ba70
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
push str.HKEY_CURRENT_USERSoftwareAdobeAdobe_Acrobat9.0
mov ecx, esi
mov byte [esp + 0x230], 1
call fcn.0040c3b0
push str.HKEY_CURRENT_USERSoftwareAdobeAcrobat_Reader9.0
mov ecx, esi
call fcn.0040c3b0
push str.HKEY_CURRENT_USERSoftwareAdobeAdobe_Synchronizer9.0
mov ecx, esi
call fcn.0040c3b0
push 0x206
lea eax, [esp + 0x1e]
push ebx
push eax
mov word [esp + 0x24], bx
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push ebx
push 0x1a
lea ecx, [esp + 0x20]
push ecx
push ebx
call edi
test eax, eax
mov ebp, dword [sym.imp.MSVCR80.dll_wcscat_s]
je 0x40c874
push str.AdobeAcrobat9.0
lea edx, [esp + 0x1c]
push 0x104
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0040c420
push ebx
push 0x1c
lea ecx, [esp + 0x20]
push ecx
push ebx
call edi
test eax, eax
je 0x40c8a3
push str.AdobeAcrobat9.0
lea edx, [esp + 0x1c]
push 0x104
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0040c420
push ebx
push 0x1a
lea ecx, [esp + 0x20]
push ecx
push ebx
call edi
test eax, eax
je 0x40c8d2
push str.AdobeLinguisticsDictionaries
lea edx, [esp + 0x1c]
push 0x104
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0040c420
push str.SOFTWAREPoliciesAdobeAdobe_Acrobat9.0FeatureLockDown
mov ecx, esi
call fcn.0040c600
push str.SOFTWAREPoliciesAdobeAcrobat_Reader9.0FeatureLockDown
mov ecx, esi
call fcn.0040c600
mov eax, esi
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0042fac4
add esp, 0x21c
ret

Function at 0x40c950
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push edx
mov dword [esp + 0x18], 0
call esi
test eax, eax
jne 0x40c9d2
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push ecx
push edx
call esi
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x40c9cb
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
xor eax, eax
cmp dword [esp + 4], eax
pop esi
setne al
pop ecx
ret 0x10
Function at 0x411bb0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, dword [esp + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.004186d0
cmp eax, 0x17
je 0x411bee
mov dword [esi], 0x417d28
pop esi
ret
mov dword [esi], 0x411b80
pop esi
ret

Function at 0x411c00
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x4c
mov eax, dword [0x43c510]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 0x18]
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
push edi
mov edi, 0x38
jb 0x411c32
mov edi, 0x78
sub edi, eax
push edi
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0040b3e0
add esp, 0xc
mov byte [esp + 0x10], 0x80
lea ecx, [esp + edi + 0x11]
lea eax, [esi + 0x1a]
mov ebp, 2
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x411c55
add edi, 8
push edi
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00411a80
add esp, 0xc
lea ecx, [ebx + 1]
lea eax, [esi + 0xa]
lea edi, [ebp + 4]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x411c95
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.004186d0
cmp eax, 0x17
je 0x411d04
pop edi
mov dword [esi], 0x417d28
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0042fac4
add esp, 0x4c
ret
mov ecx, dword [esp + 0x58]
pop edi
mov dword [esi], 0x411b80
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fac4
add esp, 0x4c
ret
Function at 0x421630
Capabilities:
Hash data using sha1

Disassembly:
call fcn.004186d0
add eax, 0xfffffffd
cmp eax, 0x25
ja case.0x421644.4
movzx eax, byte [eax + 0x4216b8]
jmp dword [eax*4 + 0x4216a8]
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x426668
jmp 0x42167d
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x4255c0
jmp 0x42167d
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x421600
jmp 0x42167d
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x424480
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret

Function at 0x4216e0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x60
mov eax, dword [0x43c510]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x6c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x70]
push edi
mov edi, dword [esp + 0x78]
lea ecx, [esp + 0x1c]
and ecx, 7
push 0x48
lea ebx, [esp + 0x28]
sub ebx, ecx
push 0
push ebx
mov dword [esp + 0x1c], eax
call fcn.0040b3e0
mov edx, dword [esi + 0x18]
and edx, 0x3f
mov eax, 0x40
sub eax, edx
add esp, 0xc
cmp eax, 8
ja 0x421731
add eax, 0x40
mov ecx, dword [esi + 0x14]
mov ebp, dword [esi + 0x18]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebp
shr edx, 0x1d
or ecx, edx
mov byte [ebx], 0x80
lea edx, [ebp*8]
mov dword [esp + 0x18], edx
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 8], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 7], dl
mov edx, ecx
shr edx, 8
mov byte [eax + ebx - 6], dl
mov byte [eax + ebx - 5], cl
mov ecx, dword [esp + 0x18]
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 3], dl
mov edx, ecx
mov byte [eax + ebx - 1], cl
mov ecx, dword [esp + 0x10]
push ecx
push eax
shr edx, 8
push ebx
push esi
mov byte [eax + ebx - 2], dl
call fcn.00421500
movzx edx, byte [esi + 3]
mov byte [edi], dl
movzx eax, byte [esi + 2]
mov byte [edi + 1], al
mov ecx, dword [esi]
shr ecx, 8
mov byte [edi + 2], cl
movzx edx, byte [esi]
mov byte [edi + 3], dl
movzx eax, byte [esi + 7]
mov byte [edi + 4], al
movzx ecx, byte [esi + 6]
mov byte [edi + 5], cl
mov edx, dword [esi + 4]
shr edx, 8
mov byte [edi + 6], dl
movzx eax, byte [esi + 4]
mov byte [edi + 7], al
movzx ecx, byte [esi + 0xb]
mov byte [edi + 8], cl
movzx edx, byte [esi + 0xa]
mov byte [edi + 9], dl
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 0xa], al
movzx ecx, byte [esi + 8]
mov byte [edi + 0xb], cl
movzx edx, byte [esi + 0xf]
mov byte [edi + 0xc], dl
movzx eax, byte [esi + 0xe]
mov byte [edi + 0xd], al
mov ecx, dword [esi + 0xc]
shr ecx, 8
mov byte [edi + 0xe], cl
movzx edx, byte [esi + 0xc]
mov byte [edi + 0xf], dl
movzx eax, byte [esi + 0x13]
mov byte [edi + 0x10], al
movzx ecx, byte [esi + 0x12]
mov byte [edi + 0x11], cl
mov edx, dword [esi + 0x10]
shr edx, 8
mov byte [edi + 0x12], dl
movzx eax, byte [esi + 0x10]
push esi
mov byte [edi + 0x13], al
call fcn.00421630
mov ecx, dword [esp + 0x80]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fac4
add esp, 0x60
ret
Function at 0x42c200
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
push esi
push 0
push 1
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
test eax, eax
mov dword [esi + 4], eax
jne 0x42c24b
push eax
push 0xffffffffffffffff
push str.unable_to_create_tls_index
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], vtable.RSException.0
call fcn.00429a30
push 0x435564
lea eax, [esp + 8]
push eax
call sub.MSVCR80.dll__CxxThrowException
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add esp, 0x1c
ret

Function at 0x42c260
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [ecx + 4]
sub esp, 0x1c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x42c29e
push eax
push 0xffffffffffffffff
push str.unable_to_set_tls_value
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], vtable.RSException.0
call fcn.00429a30
push 0x435564
lea edx, [esp + 4]
push edx
call sub.MSVCR80.dll__CxxThrowException
add esp, 0x1c
ret 4

Function at 0x42c2b0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
test eax, eax
push esi
mov esi, ecx
je 0x42c2fd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x42c2fd
push eax
push 0xffffffffffffffff
push str.unable_to_set_tls_value
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], vtable.RSException.0
call fcn.00429a30
push 0x435564
lea ecx, [esp + 8]
push ecx
call sub.MSVCR80.dll__CxxThrowException
pop esi
add esp, 0x1c
ret 4

Function at 0x42c310
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x42c36d
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x42c35f
push eax
push 0xffffffffffffffff
push str.unable_to_create_tls_data
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], vtable.RSException.0
call fcn.00429a30
push 0x435564
lea ecx, [esp + 0xc]
push ecx
call sub.MSVCR80.dll__CxxThrowException
push esi
mov ecx, edi
mov dword [esi], 0
call fcn.0042c260
pop edi
mov eax, esi
pop esi
add esp, 0x1c
ret

Function at 0x42c440
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x42c47c
push eax
push 0xffffffffffffffff
push str.likely_unbalanced_enter_exit_monitor_pair__extra_exit_
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], vtable.RSException.0
call fcn.00429a30
push 0x435564
lea ecx, [esp + 8]
push ecx
call sub.MSVCR80.dll__CxxThrowException
add dword [eax], 0xffffffff
jne 0x42c489
push eax
mov ecx, esi
call fcn.0042c2b0
pop esi
add esp, 0x1c
ret
Function at 0x42c500
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, dword [ecx + 4]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42c517
cmp dword [eax], 0
jne 0x42c521
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, esi
call fcn.0042c310
add dword [eax], 1
pop esi
ret

Function at 0x42c530
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
test eax, eax
je 0x42c4ac
cmp dword [eax], 0
ja 0x42c4d5
push 0
push 0xffffffffffffffff
push str.must_own_monitor_prior_to_calling_exit__
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], vtable.RSException.0
call fcn.00429a30
push 0x435564
lea ecx, [esp + 0xc]
push ecx
call sub.MSVCR80.dll__CxxThrowException
mov ecx, esi
call fcn.0042c440
mov edx, dword [esi + 4]
push edx
call edi
test eax, eax
je 0x42c4eb
cmp dword [eax], 0
jne 0x42c4f5
add esi, 8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
add esp, 0x1c
ret
mov ecx, dword [ecx + 4]
jmp 0x42c490

Function at 0x42cda0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4313b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x43c510]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor esi, esi
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], esi
call fcn.004291e1
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], esi
call fcn.00429ac0
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call fcn.004291e1
mov edx, dword [esp + 0x1c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x18]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret
Function at 0x42d500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4313b8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x43c510]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42d598
push eax
lea ecx, [esp + 0x10]
call fcn.0042ba70
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0
call fcn.00429650
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xc]
call fcn.00429650
mov ecx, dword [edi + 0x14]
push 0xffffffffffffffff
push esi
push eax
movzx eax, word [esp + 0x40]
add eax, 1
push eax
push ecx
call sub.sqlite.dll_sqlite3_bind_text
mov edx, dword [esp + 0x30]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x2c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x1c
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 8
mov edx, dword [edi]
mov eax, dword [esp + 0x34]
mov edx, dword [edx + 0x24]
push eax
call edx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 8
Function at 0x42eac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4317a0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c510]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor esi, esi
push esi
push 0xffffffffffffffff
push str.:memory:
lea ecx, [esp + 0x24]
call fcn.00429a30
mov ebp, dword [esp + 0x88]
push esi
push esi
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
mov dword [esp + 0x8c], esi
call fcn.0042a0d0
mov ecx, dword [esp + 0x28]
test ax, ax
push ecx
setne bl
mov dword [esp + 0x84], 0xffffffff
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x24]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 8
test bl, bl
je 0x42eb4b
push ebp
call fcn.0042ee60
add esp, 4
push ebp
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], esi
call fcn.0042ba70
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0x8c]
mov dword [esp + 0x80], 1
xor edi, edi
lea ecx, [esp + 0x30]
call fcn.00429650
push ebx
push ebp
lea ecx, [esp + 0x1c]
push ecx
push eax
call sub.sqlite.dll_sqlite3_open_v2
add esp, 0x10
test eax, eax
je 0x42ec06
cmp eax, 0xe
jne 0x42ebbf
cmp edi, 0x7d0
jae 0x42ebb1
mov eax, esi
mov edx, 0x3e8
mul edx
push edx
push eax
call fcn.0042ee00
add esp, 8
add esi, 5
add edi, 1
cmp esi, 0x2710
jb 0x42eb74
push 0
push 0xffffffffffffffff
push str.error_opening_database
lea ecx, [esp + 0x54]
call fcn.00429a30
mov ecx, dword [esp + 0x88]
push ecx
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x68]
push eax
mov byte [esp + 0x8c], 2
call fcn.0042cda0
add esp, 0xc
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x88], 3
call fcn.0042e970
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x42e870
push 0
push 1
push 3
push 0x433ca0
push eax
call sub.sqlite.dll_sqlite3_create_function
mov edx, dword [esp + 0x60]
mov esi, dword [esp + 0x34]
add esp, 0x20
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x3c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret