joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x658e64]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.SoftwareMicrosoftInternet_ExplorerIntelliFormsStorage2]
mov ax, word [0x633fd4]
push ebx
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 8], ax
lea ebx, [ecx + 0xcc]
movups xmm0, xmmword [0x633fac]
mov al, byte [0x633fd6]
mov ecx, ebx
mov byte [ebp - 6], al
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x444], 0x400
movups xmm0, xmmword [0x633fbc]
movups xmmword [ebp - 0x20], xmm0
movq xmm0, qword [0x633fcc]
movq qword [ebp - 0x10], xmm0
call fcn.0049b4cf
lea eax, [ebp - 0x448]
push eax
push 1
push 0
lea eax, [ebp - 0x40]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407e5b
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea eax, [ebp - 0x444]
xor esi, esi
mov dword [ebp - 0x444], 0x400
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x440]
push eax
push esi
push dword [ebp - 0x448]
call edi
cmp eax, 0x103
je 0x407e4d
test eax, eax
jne 0x407e4d
lea eax, [ebp - 0x440]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e00
sub eax, edx
cmp eax, 1
jbe 0x407e1c
lea eax, [ebp - 0x440]
mov ecx, ebx
push eax
call fcn.0049b2ba
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], 0x400
push eax
lea eax, [ebp - 0x440]
inc esi
push eax
push esi
push dword [ebp - 0x448]
call edi
cmp eax, 0x103
jne 0x407df3
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005cc070
mov esp, ebp
pop ebp
ret
Function at 0x409020
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0x658e64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x340]
mov esi, ecx
push 0
push eax
call fcn.005cf9e0
mov eax, dword [0x63424c]
add esp, 0xc
movq xmm0, qword [str.OperaOpera_]
mov dword [ebp - 0xc], eax
movzx eax, byte [0x634250]
mov byte [ebp - 8], al
mov eax, dword [0x634264]
mov dword [ebp - 0x1c], eax
movzx eax, byte [0x634268]
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x340]
push eax
push 0
push 0
movq qword [ebp - 0x14], xmm0
movups xmm0, xmmword [str.OperaOperaprofile_]
push 0x1a
push 0
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x4091af
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x238]
push 0x208
push eax
call fcn.005d5367
add esp, 0xc
lea eax, [ebp - 0x238]
push 0x632e14
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x238]
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x238]
push str.wand.dat
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40912a
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
call fcn.00408b40
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x238]
push 0x208
push eax
call fcn.005d5367
add esp, 0xc
lea eax, [ebp - 0x238]
push 0x632e14
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x238]
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x238]
push str.wand.dat
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4091af
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
call fcn.00408b40
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005cc070
mov esp, ebp
pop ebp
ret
Function at 0x4091c0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x97c
mov eax, dword [0x658e64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00409020
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.005cf9e0
movups xmm0, xmmword [str.Opera_Software]
add esp, 0xc
lea eax, [ebp - 0x630]
movups xmmword [ebp - 0x14], xmm0
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x40922a
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cc070
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.005d5367
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x220]
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push 0x208
push eax
call fcn.005d5367
add esp, 0xc
lea eax, [ebp - 0x428]
push 0x634288
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x978]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409217
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [ebp - 0x978], 0x10
je 0x4092ff
cmp byte [ebp - 0x94c], 0x2e
je 0x4092ff
lea eax, [ebp - 0x94c]
push eax
lea eax, [ebp - 0x220]
push eax
push str._s_sLogin_Data
lea eax, [ebp - 0x838]
push 0x208
push eax
call fcn.00401db0
add esp, 0x14
lea eax, [ebp - 0x838]
mov ecx, ebx
push eax
push 6
call fcn.004086e0
lea eax, [ebp - 0x978]
push eax
push esi
call edi
test eax, eax
jne 0x4092b6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cc070
mov esp, ebp
pop ebp
ret
Function at 0x409330
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb58
mov eax, dword [0x658e64]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x214]
push esi
push edi
push ebx
push 0x208
push eax
mov dword [ebp - 0xb58], ecx
call fcn.005d5367
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x634288
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0xb54]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4093ad
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cc070
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [ebp - 0xb54], 0x10
jne 0x409462
lea eax, [ebp - 0xb28]
push eax
lea eax, [ebp - 0x614]
push 0x400
push eax
call fcn.005d5367
lea eax, [ebp - 0x614]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4093e4
sub eax, edx
inc eax
push eax
lea eax, [ebp - 0x614]
push eax
call fcn.005d69be
push 0xd
lea eax, [ebp - 0x614]
push str.uc_login_data
push eax
call fcn.005d6ae0
add esp, 0x14
test eax, eax
jne 0x409462
lea eax, [ebp - 0x614]
push str.journal
push eax
call fcn.005cebc0
add esp, 8
test eax, eax
jne 0x409462
lea eax, [ebp - 0xb28]
push eax
push ebx
push 0x6342b8
lea eax, [ebp - 0xa14]
push 0x400
push eax
call fcn.00401db0
mov ecx, dword [ebp - 0xb58]
lea eax, [ebp - 0xa14]
add esp, 0x14
push eax
push 0x11
call fcn.004086e0
lea eax, [ebp - 0xb54]
push eax
push esi
call edi
test eax, eax
jne 0x4093b3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cc070
mov esp, ebp
pop ebp
ret 4
Function at 0x4094a0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x974
mov eax, dword [0x658e64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x218]
mov ebx, ecx
push 0
push eax
call fcn.005cf9e0
mov ax, word [0x6342c8]
add esp, 0xc
movq xmm0, qword [str.UCBrowser]
mov word [ebp - 8], ax
mov al, byte [0x6342ca]
mov byte [ebp - 6], al
lea eax, [ebp - 0x628]
push eax
push 0
push 0
push 0x1c
push 0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x409519
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cc070
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.005d5367
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x208
push eax
call fcn.005d5367
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x634288
push 0x208
push eax
call fcn.005d6b58
add esp, 0xc
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409506
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [ebp - 0x970], 0x10
je 0x4095ec
cmp byte [ebp - 0x944], 0x2e
je 0x4095ec
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x218]
push eax
push str._s_sDefault
lea eax, [ebp - 0x830]
push 0x208
push eax
call fcn.00401db0
add esp, 0x14
lea eax, [ebp - 0x830]
mov ecx, ebx
push eax
call fcn.00409330
lea eax, [ebp - 0x970]
push eax
push esi
call edi
test eax, eax
jne 0x4095a5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cc070
mov esp, ebp
pop ebp
ret

Function at 0x409620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.004043d0
mov esi, eax
test esi, esi
je 0x40968a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40968a
test al, 0x10
je 0x40968a
mov edx, esi
call fcn.00404240
mov edi, eax
test edi, edi
je 0x40968a
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40968a
test al, 0x10
je 0x40968a
mov ecx, edi
call fcn.0040cbe0
test eax, eax
je 0x40968a
mov edx, edi
mov ecx, esi
call fcn.0040cd10
test eax, eax
je 0x40968a
call fcn.0040cd80
test eax, eax
jne 0x409694
call fcn.0040c150
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 4]
mov ecx, esi
push dword [ebp + 8]
call fcn.0040c5d0
add esp, 8
call fcn.0040c150
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4096c0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x27c4
call fcn.005ccbd0
mov eax, dword [0x658e64]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov edi, edx
mov dword [ebp - 0x9c], 0xf8a8ac1d
push ecx
lea edx, [ebp - 0x27ac]
mov dword [ebp - 0x98], 0x3e48b8d3
mov dword [ebp - 0x94], 0xa3e7d48
mov dword [ebp - 0x90], 0x26dd0762
mov dword [ebp - 0x8c], 0x38167e6
mov dword [ebp - 0x88], 0xa513b2e7
mov dword [ebp - 0x84], 0x4fee79b0
mov dword [ebp - 0x80], 0xed15410f
mov dword [ebp - 0x7c], 0xe58c147b
mov dword [ebp - 0x78], 0xc10d464b
mov dword [ebp - 0x74], 0xe7d6fe8e
mov dword [ebp - 0x70], 0x8b067527
mov dword [ebp - 0x6c], 0xfdc0049
mov dword [ebp - 0x68], 0xfd9ea030
mov dword [ebp - 0x64], 0xc8f18509
mov dword [ebp - 0x60], 0x8c175aa
mov dword [ebp - 0x5c], 0xe2017905
mov dword [ebp - 0x58], 0x80afd897
mov dword [ebp - 0x54], 0x710b6038
mov dword [ebp - 0x50], 0x7753680e
mov dword [ebp - 0x4c], 0xf6610f2f
mov dword [ebp - 0x48], 0x5c8f8e1d
mov dword [ebp - 0x44], 0x74213db2
mov dword [ebp - 0x40], 0x6b54b40
mov dword [ebp - 0x3c], 0xbd7aab6e
mov dword [ebp - 0x38], 0x327ea98b
mov dword [ebp - 0x34], 0x24066e8f
mov dword [ebp - 0x30], 0xa5a429d9
mov dword [ebp - 0x2c], 0xfd2326be
mov dword [ebp - 0x28], 0xf4cf1ee
mov dword [ebp - 0x24], 0xfb585e74
mov dword [ebp - 0x20], 0x91ef7491
mov dword [ebp - 0x1c], 0x2e6d6f63
mov dword [ebp - 0x18], 0x6c707061
mov dword [ebp - 0x14], 0x61532e65
mov dword [ebp - 0x10], 0x69726166
call fcn.00401b10
add esp, 4
test eax, eax
je 0x409854
mov dword [ebp - 0x27bc], eax
lea ecx, [ebp - 0x27ac]
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x27b8], ecx
mov dword [ebp - 0x27b0], eax
lea eax, [ebp - 0x27c4]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x27b4]
mov dword [ebp - 0x27b4], 0x90
push eax
push 0
lea eax, [ebp - 0x27bc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x409866
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cc070
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x27c0]
movzx esi, byte [eax]
add eax, 4
push esi
push eax
push edi
call fcn.005cf460
mov ecx, dword [ebp - 8]
add esp, 0xc
mov byte [edi + esi], 0
xor ecx, ebp
mov eax, 1
pop edi
pop esi
call fcn.005cc070
mov esp, ebp
pop ebp
ret
Function at 0x409ee0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x658e64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x110]
mov edi, ecx
push 0
push eax
call fcn.005cf9e0
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x110]
add esp, 0xc
push eax
push 0
push 0
push 0x2a
push 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jns 0x409f48
call esi
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push 0x26
push 0
call ebx
test eax, eax
jns 0x409f48
call esi
cmp byte [ebp - 0x110], 0
je 0x409f77
lea eax, [ebp - 0x110]
push eax
push str._sSafariApple_Application_Supportplutil.exe
push 0x208
push edi
call fcn.00401db0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x409fde
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push 0x2c
push 0
call ebx
test eax, eax
jns 0x409fb8
call esi
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push 0x2b
push 0
call ebx
test eax, eax
jns 0x409fb8
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cc070
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x110]
push eax
push str._sAppleApple_Application_Supportplutil.exe
push 0x208
push edi
call fcn.00401db0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409fa3
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005cc070
mov esp, ebp
pop ebp
ret
Function at 0x40a000
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbac
mov eax, dword [0x658e64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x104
lea eax, [ebp - 0x128]
mov ebx, ecx
push 0
push eax
call fcn.005cf9e0
mov ax, word [0x6343d8]
add esp, 0xc
movups xmm0, xmmword [str.Apple_ComputerPreferences]
mov word [ebp - 8], ax
mov al, byte [0x6343da]
mov byte [ebp - 6], al
lea eax, [ebp - 0x128]
push eax
push 0
push 0
movups xmmword [ebp - 0x20], xmm0
push 0x1a
movq xmm0, qword [0x6343d0]
push 0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x40a086
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cc070
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x128]
push eax
push str._s_skeychain.plist
lea eax, [ebp - 0x538]
push 0x208
push eax
call fcn.00401db0
add esp, 0x14
lea eax, [ebp - 0x538]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40a06f
lea ecx, [ebp - 0x948]
call fcn.00409ee0
test eax, eax
je 0x40a06f
lea eax, [ebp - 0x740]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x740]
push eax
push str._skeytest.tmp
lea eax, [ebp - 0x330]
push 0x208
push eax
call fcn.00401db0
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x948]
push eax
push str.__s___convert_xml1__s__o___s____s_
lea eax, [ebp - 0xb50]
push 0x208
push eax
call fcn.00401db0
push 0x44
lea eax, [ebp - 0xba8]
push 0
push eax
call fcn.005cf9e0
add esp, 0x34
mov dword [ebp - 0xba8], 0x44
xor eax, eax
mov dword [ebp - 0xb7c], 1
mov word [ebp - 0xb78], ax
lea eax, [ebp - 0xb60]
push eax
lea eax, [ebp - 0xba8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xb50]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40a06f
push 0xffffffffffffffff
push dword [ebp - 0xb60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xb5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xb60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40a06f
lea eax, [ebp - 0x330]
mov ecx, ebx
push eax
call fcn.004098a0
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.005cc070
mov esp, ebp
pop ebp
ret
Function at 0x40d1a0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [0x697ed4]
push ebx
mov ebx, dword [0x697edc]
push esi
push edi
mov edi, ecx
xor esi, esi
mov byte [edi], 0
cmp edx, ebx
jl 0x40d1f4
push dword [0x697ed8]
mov dword [0x697ed4], 0
push 0x2800
push 1
push 0x6981b0
call fcn.005d7f47
mov edx, dword [0x697ed4]
mov ebx, eax
add esp, 0x10
mov dword [0x697edc], ebx
test ebx, ebx
jg 0x40d1f4
xor cl, cl
jmp 0x40d201
mov cl, byte [edx + 0x6981b0]
inc edx
mov dword [0x697ed4], edx
movsx eax, cl
test cl, cl
je 0x40d23c
cmp eax, 0xa
je 0x40d22f
cmp eax, 0xd
je 0x40d1b6
xor ecx, ecx
test al, al
je 0x40d1b6
cmp esi, 0x2800
jge 0x40d23c
mov byte [esi + edi], al
inc ecx
inc esi
shr eax, 8
cmp ecx, 4
jl 0x40d214
jmp 0x40d1b6
mov byte [esi + edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x412680
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x659db8], 0
je 0x4126d7
mov eax, dword [0x697ee8]
test eax, eax
je 0x4126b0
push eax
call dword [0x659e10]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.0040fe30
mov eax, dword [0x697ee8]
test eax, eax
je 0x4126d2
push eax
call dword [0x659e18]
mov esi, dword [ebp - 4]
jmp 0x4126e1
mov esi, dword [ebp - 4]
jmp 0x4126e4
push 0x14
call dword [0x659de0]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4126f2
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x659dbc], 0
mov ebx, dword [ebp + 8]
je 0x41273c
mov eax, dword [0x659ec0]
test eax, eax
je 0x412715
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x41273c
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x412650
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.005d85d4
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x412749
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x412762
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], edx
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
test edi, edi
je 0x4255a3
cmp byte [edi + 9], bl
je 0x4254a6
inc dword [edi + 0xc]
cmp byte [edi + 0xa], bl
jne 0x4254a6
call fcn.00421b00
mov esi, dword [edi + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x425590
cmp dword [ebp + 8], 0
je 0x425514
test byte [esi + 0x40], 1
jne 0x425514
mov al, byte [esi + 0x42]
cmp al, 1
je 0x4254cb
cmp al, 2
jne 0x425531
cmp al, 2
jne 0x4254d5
mov byte [esi + 0x42], 1
jmp 0x4254dc
mov dword [esi + 0x3c], 0
mov ecx, esi
call fcn.00421e30
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x4254f8
mov ecx, esi
call fcn.00421dd0
mov byte [esi + 0x42], 3
and byte [esi + 0x40], 0xf1
test ebx, ebx
je 0x425531
mov edi, dword [esp + 0x14]
mov edx, ebx
push 0
mov ecx, edi
call fcn.00425470
add esp, 4
jmp 0x425590
push dword [esi + 0x30]
call fcn.00410250
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
xor ebx, ebx
cmp byte [esi + 0x44], bl
jl 0x42557d
lea edi, [esi + 0x78]
nop dword [eax + eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x42556b
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x20
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
je 0x42555d
call fcn.0041ca20
jmp 0x425562
call fcn.00418bf0
mov ecx, dword [esp + 0x1c]
call fcn.0041dc80
mov dword [edi], 0
inc ebx
movsx eax, byte [esi + 0x44]
add edi, 4
cmp ebx, eax
jle 0x425540
mov esi, dword [esi + 8]
test esi, esi
jne 0x4254b4
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp byte [edi + 9], 0
je 0x4255a3
add dword [edi + 0xc], 0xffffffff
jne 0x4255a3
mov ecx, edi
call fcn.00421ac0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov ecx, ebx
call fcn.00425920
mov edi, dword [ebx + 0x18]
xor eax, eax
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x1c], eax
movsx eax, byte [ebx + 0x44]
mov dword [ebp - 0x14], esi
mov esi, dword [ebx + 0x1c]
mov eax, dword [ebx + eax*4 + 0x78]
mov ecx, dword [eax + 0x3c]
movzx eax, word [ebx + 0x20]
sub ecx, edi
cmp eax, ecx
cmovb ecx, eax
cmp esi, ecx
ja 0x432bb1
mov eax, 0x1010
mov dword [ebp - 0x24], edi
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], esi
jmp 0x432bd2
lea eax, [ebp - 0x34]
xor edx, edx
push eax
push 1
push esi
mov ecx, ebx
call fcn.0042d730
add esp, 0xc
test eax, eax
jne 0x432c93
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov al, byte [edi]
cmp al, 0x80
jae 0x432bdd
movzx ebx, al
jmp 0x432bea
lea edx, [ebp - 8]
mov ecx, edi
call fcn.00414050
mov ebx, dword [ebp - 8]
cmp ebx, 3
jb 0x432c59
cmp ebx, esi
jg 0x432c59
lea ecx, [edi - 1]
add ecx, ebx
mov al, byte [ecx]
cmp al, 0x80
jae 0x432c03
movzx edx, al
jmp 0x432c0e
lea edx, [ebp - 8]
call fcn.00414050
mov edx, dword [ebp - 8]
lea eax, [edx - 1]
cmp eax, 8
ja 0x432c59
cmp edx, 7
je 0x432c59
movzx ecx, byte [edx + 0x630450]
lea eax, [ecx + ebx]
cmp esi, eax
jb 0x432c59
sub esi, ecx
lea eax, [ebp - 0x5c]
push eax
lea ecx, [edi + esi]
call fcn.00431790
mov ecx, dword [ebp + 8]
add esp, 4
mov eax, dword [ebp - 0x5c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x58]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x34]
call fcn.0042ce90
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test dword [ebp - 0x2c], 0x2460
jne 0x432c68
cmp dword [ebp - 0x1c], 0
je 0x432c70
lea ecx, [ebp - 0x34]
call fcn.0042cdf0
push 0x63a1d8
push 0x1248a
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00412480
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret