joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f4f0
Capabilities:
Encrypt data using aes via x86 extensions
Hash data using murmur3

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x8da400]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45db8b
je 0x45dbda
cmp ebx, 0x20
jbe 0x45dbe0
cmp ebx, 0x40
jbe 0x45dc1e
jmp 0x45dcaf
test ebx, ebx
je 0x45dbd0
add eax, 0x10
test ax, 0xff0
je 0x45dbbc
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x78e420]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x78e520]
jmp 0x45dba8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45dba8
pxor xmm1, xmmword [0x8da410]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x8da410]
pxor xmm2, xmmword [0x8da420]
pxor xmm3, xmmword [0x8da430]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x8da410]
pxor xmm2, xmmword [0x8da420]
pxor xmm3, xmmword [0x8da430]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45dd0e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x8da017], 0
je 0x45f50a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45db50
jmp fcn.00408ed0
Function at 0x45f570
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409190
mov eax, dword [0x8da340]
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebx, dword [esp + 8]
lea eax, [ebx + eax*8]
xor edx, eax
imul eax, edx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor ecx, eax
imul eax, ecx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0xc], eax
ret
call fcn.0045e0e0
jmp 0x409120
cmp byte [0x8da017], 0
je 0x45f5ab
mov eax, dword [esp + 4]
movq xmm0, qword [eax]
pinsrd xmm0, dword [esp + 8], 2
aesenc xmm0, xmmword [0x8da400]
aesenc xmm0, xmmword [0x8da410]
aesenc xmm0, xmmword [0x8da420]
movd dword [esp + 0xc], xmm0
ret
jmp 0x409120

Function at 0x4602f0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0045f470
call fcn.004385a0
ret

Function at 0x460410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x22c
mov dword [esp], esp
mov dword [esp + 4], 0x22c
call fcn.0045fdf0
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.0045fdf0
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xba0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4bbbb0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4bbbe8
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x4bbbdf
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ecx, ebx
jg 0x4bbbd2
mov dword [esp + 0x14], edx
ret
call fcn.0045e0e0
jmp fcn.004bbbb0
Function at 0x5fe2bd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [eax], 0
sub esp, 8
push 0
push 0x14
call fcn.005faf5d
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5fe2ee
mov eax, 7
jmp 0x5fe3b3
movzx eax, byte [0x6d9984]
test al, al
je 0x5fe30d
sub esp, 0xc
push 0xc8
call fcn.005fef1e
add esp, 0x10
test eax, eax
je 0x5fe321
sub esp, 4
push 0x14
push 0
push dword [ebp - 0xc]
call sub.msvcrt.dll_memset
add esp, 0x10
jmp 0x5fe377
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 4
sub esp, 8
push eax
push 0
push dword [ebp - 0xc]
push 0x5fe288
push 0
push 0
mov eax, dword [sym.imp.msvcrt.dll__beginthreadex]
call eax
add esp, 0x20
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x5fe377
sub esp, 4
push 0x14
push 0
push dword [ebp - 0xc]
call sub.msvcrt.dll_memset
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
test eax, eax
jne 0x5fe3a6
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
sub esp, 0xc
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
call eax
add esp, 0x10
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret
Function at 0x600282
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
and eax, 0
mov esi, eax
mov eax, dword [ebp - 0x34]
and eax, 0xff000000
mov edi, eax
mov eax, esi
xor ah, 0
mov dword [ebp - 0x40], eax
mov eax, edi
xor ah, 0
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov eax, esi
or eax, edi
test eax, eax
je 0x600331
mov eax, dword [ebp + 8]
add eax, 8
mov edx, dword [ebp - 0x38]
mov byte [eax], dl
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 8
shr edx, 8
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], 7
jmp 0x600321
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, edx
or ecx, 0xffffff80
mov edx, ecx
mov byte [eax], dl
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 7
shr edx, 7
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
sub dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
jns 0x6002f2
mov eax, 9
jmp 0x6003c0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x38]
mov esi, eax
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov dword [ebp - 0x1c], edx
mov edx, esi
or edx, 0xffffff80
mov byte [ebp + eax - 0x26], dl
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 7
shr edx, 7
mov esi, eax
mov edi, edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x38]
xor ah, 0
mov ecx, eax
mov eax, dword [ebp - 0x34]
xor ah, 0
mov ebx, eax
mov eax, ebx
or eax, ecx
test eax, eax
jne 0x600338
movzx eax, byte [ebp - 0x26]
and eax, 0x7f
mov byte [ebp - 0x26], al
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x18], eax
jmp 0x6003b7
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add edx, eax
lea ecx, [ebp - 0x26]
mov eax, dword [ebp - 0x18]
add eax, ecx
movzx eax, byte [eax]
mov byte [edx], al
sub dword [ebp - 0x18], 1
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x18], 0
jns 0x60039a
mov eax, dword [ebp - 0x1c]
add esp, 0x34
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x60bdbd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x88]
test eax, eax
je 0x60be1b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 0x88], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
sub esp, 4
push 8
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
jmp 0x60beba
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x8c]
movzx eax, ax
add eax, 0x28
mov edx, 0
sub esp, 8
push edx
push eax
call fcn.005fb51b
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
cmp dword [ebp - 0x1c], 0
jne 0x60be93
mov eax, dword [ebp + 0xc]
sub eax, 1
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x98]
cdq
mov edi, ebx
imul edi, eax
mov esi, edx
imul esi, ecx
add esi, edi
mul ecx
lea ecx, [esi + edx]
mov edx, ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x3c]
push dword [ebp + 0x10]
push edx
push eax
push ecx
call fcn.005f9f1c
add esp, 0x10
mov eax, 7
jmp 0x60bee0
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 0x28]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x1c]
mov word [eax + 0x1c], 0x20
mov eax, dword [ebp - 0x1c]
mov word [eax + 0x1e], 1
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x78]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
mov dword [eax + 0x78], edx
mov eax, 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x647062
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
sub esp, 8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.sqlite_master
push dword [ebp + 0xc]
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push dword [ebp + 8]
call fcn.0064ca8d
add esp, 0x20
cmp dword [ebp + 0x10], 0
jne 0x6470a7
push dword [ebp + 0xc]
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push dword [ebp + 8]
call fcn.0064ca8d
add esp, 0x10
nop
leave
ret
Function at 0x695e03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x20]
mov esi, ecx
mov ecx, dword [ebp - 0x14]
lea ebx, [ecx + 1]
mov dword [ebp - 0x14], ebx
mov ebx, esi
or ebx, 0xffffff80
mov byte [ecx], bl
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esi, ecx
mov edi, ebx
shrd esi, edi, 7
shr edi, 7
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x20]
xor ch, 0
mov eax, ecx
mov ecx, dword [ebp - 0x1c]
xor ch, 0
mov edx, ecx
mov ecx, edx
or ecx, eax
test ecx, ecx
jne 0x695e2a
mov eax, dword [ebp - 0x14]
sub eax, 1
movzx edx, byte [eax]
mov eax, dword [ebp - 0x14]
sub eax, 1
and edx, 0x7f
mov byte [eax], dl
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 8]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x696271
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0
add dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov esi, ecx
mov edi, ebx
shrd esi, edi, 7
shr edi, 7
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov ecx, dword [ebp - 0x28]
xor ch, 0
mov eax, ecx
mov ecx, dword [ebp - 0x24]
xor ch, 0
mov edx, ecx
mov ecx, edx
or ecx, eax
test ecx, ecx
jne 0x69628d
mov eax, dword [ebp - 0x14]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6b0c9d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x7f
jg 0x6b0cd1
cmp dword [ebp + 8], 0x40
jle 0x6b0df2
cmp dword [ebp + 8], 0x5a
jg 0x6b0df2
mov eax, dword [ebp + 8]
add eax, 0x20
mov dword [ebp - 4], eax
jmp 0x6b0df2
cmp dword [ebp + 8], 0xffff
jg 0x6b0dd7
mov dword [ebp - 8], 0xa2
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0xffffffff
jmp 0x6b0d41
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax*4 + 0x8bae40]
movzx eax, ax
mov edx, dword [ebp + 8]
sub edx, eax
mov eax, edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
js 0x6b0d38
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x6b0d41
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jge 0x6b0cf5
mov eax, dword [ebp - 0x10]
shl eax, 2
add eax, 0x8bae40
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
movzx edx, ax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 3]
movzx eax, al
add eax, edx
cmp dword [ebp + 8], eax
jge 0x6b0db6
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 2]
movzx eax, al
and eax, 1
mov edx, eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
movzx eax, ax
xor eax, dword [ebp + 8]
and eax, edx
test eax, eax
jne 0x6b0db6
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 2]
shr al, 1
movzx eax, al
movzx eax, word [eax + eax + 0x8bb0e0]
movzx edx, ax
mov eax, dword [ebp + 8]
add eax, edx
and eax, 0xffff
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x6b0df2
cmp dword [ebp + 0xc], 2
sete al
movzx eax, al
push eax
push dword [ebp - 4]
call fcn.006b0b06
add esp, 8
mov dword [ebp - 4], eax
jmp 0x6b0df2
cmp dword [ebp + 8], 0x103ff
jle 0x6b0df2
cmp dword [ebp + 8], 0x10427
jg 0x6b0df2
mov eax, dword [ebp + 8]
add eax, 0x28
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x6b6f1d
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [ebp - 0x1c], str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push str.sqlite_stat1
push eax
push dword [ebp + 8]
call fcn.00694f9b
add esp, 0x30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6b6f92
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x30], 0x100000
mov dword [eax + 0x34], 0
cmp dword [ebp - 0xc], 1
je 0x6b6f88
mov eax, dword [ebp - 0xc]
jmp 0x6b7096
mov eax, 0
jmp 0x6b7096
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 4
push edx
push eax
push dword [ebp - 0x1c]
call fcn.005fdea6
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x6b6fc3
mov dword [ebp - 0xc], 7
jmp 0x6b7093
sub esp, 0xc
push 0
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.00666caf
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x6b7024
mov eax, dword [ebp - 0x24]
sub esp, 0xc
push eax
call fcn.0062b54c
add esp, 0x10
cmp eax, 0x64
jne 0x6b7010
mov eax, dword [ebp - 0x24]
sub esp, 8
push 0
push eax
call fcn.0062bbc0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x24]
sub esp, 0xc
push eax
call fcn.0062a7c7
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0x6b7031
cmp dword [ebp - 0xc], 7
je 0x6b7031
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x6b7085
mov eax, dword [ebp - 0x18]
xor ah, 0
mov ebx, eax
mov eax, dword [ebp - 0x14]
xor ah, 0
mov esi, eax
mov eax, esi
or eax, ebx
test eax, eax
jne 0x6b7062
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x30], 0x100000
mov dword [eax + 0x34], 0
jmp 0x6b7085
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp eax, 0x64
mov esi, edx
sbb esi, 0
jge 0x6b707c
mov eax, 0x64
mov edx, 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
sub esp, 0xc
push dword [ebp - 0x20]
call fcn.005fb16d
add esp, 0x10
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6b74d3
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0x10], 0
je 0x6b7592
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 8
push eax
push str.PRAGMA__Q.page_size
call fcn.005fdea6
add esp, 0x10
mov dword [ebp - 0x10], eax
sub esp, 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.006b7454
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x6b7567
mov eax, dword [ebp - 0x14]
lea edx, [eax - 0x40]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x17]
movzx eax, al
imul eax, eax, 0x33
lea edx, [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
cmp edx, eax
jge 0x6b762e
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x17]
movzx eax, al
imul eax, eax, 0x33
lea edx, [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], edx
jmp 0x6b762e
sub esp, 0xc
push dword [ebp + 8]
call fcn.00693a31
add esp, 0x10
sub esp, 8
push eax
push 0x8acecc
call fcn.005fdea6
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x6b762e
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 4
push edx
push eax
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.005fdea6
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, 0x10
sub esp, 4
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.006b7454
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6b75fc
sub esp, 0xc
push dword [ebp + 8]
call fcn.00693a31
add esp, 0x10
sub esp, 8
push eax
push 0x8acecc
call fcn.005fdea6
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x6b762e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
cmp eax, 0x1bf
jg 0x6b762e
mov dword [ebp - 0xc], 0x10b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x24]
sub esp, 8
push eax
push str.undersize_RTree_blobs_in___q_node_
call fcn.005fdea6
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
sub esp, 0xc
push dword [ebp - 0x10]
call fcn.005fb16d
add esp, 0x10
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x6b7eda
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
test eax, eax
jne 0x6b7f2d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x6b7f2d
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push edx
push eax
push str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
push dword [ebp + 8]
call fcn.006b7db3
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
test eax, eax
jne 0x6b8015
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 1
push eax
call fcn.0062c1f6
add esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
sub esp, 0xc
push eax
call fcn.0062b54c
add esp, 0x10
cmp eax, 0x64
jne 0x6b7fda
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
sub esp, 8
push 0
push eax
call fcn.0062badc
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
sub esp, 8
push 0
push eax
call fcn.0062baa3
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cdq
sub esp, 8
push edx
push eax
call fcn.005fb02f
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x6b7fbd
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 7
jmp 0x6b7fda
mov eax, dword [ebp - 0x10]
sub esp, 4
push eax
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0x10
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
sub esp, 8
push eax
push dword [ebp + 8]
call fcn.006b7d86
add esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
test eax, eax
jne 0x6b8015
cmp dword [ebp - 0xc], 0
jne 0x6b8015
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.Node__lld_missing_from_database
push dword [ebp + 8]
call fcn.006b7e2e
add esp, 0x10
mov eax, dword [ebp - 0xc]
leave
ret