joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d4270
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x100d4332
test ebx, ebx
je 0x100d4332
mov esi, dword [ebp + 8]
cmp esi, 0x10
je 0x100d42a8
cmp esi, 0x20
jne 0x100d4332
test bl, 3
je 0x100d42be
push esi
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.101ec960
add esp, 0xc
lea ebx, [ebp - 0x24]
mov eax, dword [ebx]
lea ecx, [ebx + 0x10]
mov dword [edi + 0x10], eax
cmp esi, 0x20
mov eax, dword [ebx + 4]
mov edx, 0x102570b8
mov dword [edi + 0x14], eax
cmovne ecx, ebx
mov eax, dword [ebx + 8]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0x1c], eax
mov eax, str.expand_32_byte_kexpand_16_byte_k
cmove edx, eax
mov eax, dword [ecx]
mov dword [edi + 0x20], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0x24], eax
mov eax, dword [ecx + 8]
mov dword [edi + 0x28], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x2c], eax
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
mov eax, dword [edx + 0xc]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi + 0x40], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffff53
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret
Function at 0x100d78e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
lea ecx, [ebp - 0x24]
call fcn.100d5990
xor eax, eax
xorps xmm4, xmm4
xorps xmm3, xmm3
movd xmm2, dword [eax + 0x102570c8]
xorps xmm0, xmm0
movd xmm1, dword [ebp + eax - 0x24]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ebp + eax - 0x20]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [eax + 0x102570cc]
add eax, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp eax, 0x20
jl 0x100d7902
mov ecx, dword [ebp - 4]
por xmm3, xmm4
movaps xmm0, xmm3
xor ecx, ebp
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
call fcn.101d506b
mov esp, ebp
pop ebp
ret
Function at 0x100f24e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov al, byte [esi + 0x44]
test al, al
js 0x100f25da
xor ebx, ebx
test al, al
jle 0x100f2577
lea ecx, [esi + 0x78]
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x100f255e
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.101d5d50
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
jmp 0x100f2563
call fcn.100e8b70
mov ecx, dword [esp + 0x10]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, eax
jl 0x100f2510
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x100f25cf
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.101d5d50
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x24]
add esp, 0x10
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.100e8b70
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100f6ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x1029912c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov esi, ecx
mov eax, edx
mov ecx, dword [ebp + 8]
push edi
mov dword [esp + 0x18], ecx
xor edi, edi
cmp byte [esi + 0x11], 0
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ecx
je 0x100f6baa
mov edi, dword [esp + 0x10]
lea esi, [eax + 1]
lea ebx, [esi - 2]
cmp esi, 2
jae 0x100f6b10
xor edx, edx
jmp 0x100f6b3f
mov eax, 0xcccccccd
mul dword [edi + 0x28]
mov eax, ebx
mov ecx, edx
xor edx, edx
shr ecx, 2
inc ecx
div ecx
mov eax, dword [0x1029d2a4]
mov ecx, ebx
sub ecx, edx
xor edx, edx
div dword [edi + 0x24]
xor edx, edx
dec eax
cmp ecx, eax
sete dl
add edx, 2
add edx, ecx
cmp edx, esi
je 0x100f6b52
mov eax, dword [0x1029d2a4]
xor edx, edx
div dword [edi + 0x24]
inc eax
cmp esi, eax
jne 0x100f6b56
inc esi
inc ebx
jmp 0x100f6b07
cmp esi, dword [edi + 0x30]
mov edi, 0
ja 0x100f6ba0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x13]
mov edx, esi
push eax
call fcn.100f2a60
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x100f6c12
cmp byte [esp + 0xf], 4
mov edx, dword [esp + 0x14]
jne 0x100f6b9a
cmp dword [esp + 0x20], edx
jne 0x100f6b9a
mov eax, esi
lea ebx, [edi + 0x65]
jmp 0x100f6c14
mov esi, dword [esp + 0x10]
jmp 0x100f6bac
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
jmp 0x100f6bac
mov edx, eax
mov ecx, dword [esi]
xor eax, eax
cmp dword [esp + 0x18], eax
mov ebx, 2
cmove eax, ebx
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [ecx + 0xcc]
push edx
push ecx
call eax
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x100f6c12
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov edi, dword [edx + 8]
cmp eax, dword [edi + 4]
je 0x100f6c07
mov ecx, dword [edx + 4]
cmp eax, 1
mov dword [edi + 4], eax
setne al
mov dword [edi + 0x38], ecx
dec al
mov dword [edi + 0x48], edx
and al, 0x64
mov dword [edi + 0x34], esi
mov byte [edi + 9], al
mov eax, dword [ecx]
bswap eax
jmp 0x100f6c14
mov ecx, dword [edi + 0x38]
xor ebx, ebx
mov eax, dword [ecx]
bswap eax
jmp 0x100f6c14
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100f6c26
mov dword [eax], edi
jmp 0x100f6c79
test edi, edi
je 0x100f6c79
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x100f6c72
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.101d5d50
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
jmp 0x100f6c79
mov ecx, edx
call fcn.100e8b70
mov ecx, dword [esp + 0x24]
xor eax, eax
cmp ebx, 0x65
pop edi
cmove ebx, eax
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
Function at 0x100fb180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x18], edx
push edi
xor edi, edi
mov dword [esp + 0x18], edi
mov ecx, dword [esi + 0x48]
mov ebx, dword [esi + 0x34]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
test byte [ecx + 0x1c], 4
mov edx, dword [ecx + 0x14]
je 0x100fb1c3
mov eax, dword [edx + 0x18]
cmp eax, dword [ecx + 0x18]
jb 0x100fb1c3
cmp dword [edx + 0x60], edi
je 0x100fb1f6
call fcn.100ecf70
jmp 0x100fb1e8
mov ebx, dword [edx + 0x28]
test ebx, ebx
jne 0x100fb2b2
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x100fb1e3
call fcn.100ee7d0
jmp 0x100fb1e8
call fcn.100ee5b0
mov ebx, eax
test ebx, ebx
jne 0x100fb2b2
mov ebx, dword [esp + 0x10]
push 0
push dword [esi + 4]
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
lea edx, [esp + 0x24]
call fcn.100f7d10
mov edi, dword [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x10], eax
mov edx, edi
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.100f9c90
add esp, 4
cmp byte [ebx + 0x11], 0
je 0x100fb245
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
mov ecx, ebx
push 5
call fcn.100f2920
add esp, 0xc
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x100fb2b2
movzx eax, byte [esi + 0xc]
add eax, eax
push eax
lea eax, [esi + 0x1a]
push eax
lea eax, [edi + 0x1a]
push eax
call fcn.101ec960
movzx eax, byte [esi + 0xc]
add esp, 0xc
shl eax, 2
push eax
lea eax, [esi + 0x24]
push eax
lea eax, [edi + 0x24]
push eax
call fcn.101ec960
mov al, byte [esi + 0xc]
add esp, 0xc
mov byte [edi + 0xc], al
mov ecx, esi
mov eax, dword [edi + 0x38]
movzx edx, byte [eax]
and edx, 0xfffffff7
call fcn.100f3bf0
mov eax, dword [esi + 0x38]
movzx ecx, byte [esi + 9]
mov edx, dword [esp + 0x14]
bswap edx
mov dword [ecx + eax + 8], edx
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [eax], 0
test edi, edi
je 0x100fb314
mov ecx, dword [edi + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x100fb30f
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov esi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.101d5d50
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100e8b70
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10110b40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.100dfb50
mov esi, eax
add esp, 8
test esi, esi
jne 0x10110b70
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x10299d94], 0
mov edi, dword [ebp + 8]
je 0x10110bba
mov eax, dword [0x10299e94]
test eax, eax
je 0x10110b93
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x10110bba
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x100e29b0
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.101f9259
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10110bc7
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x10110be0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1011d760
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.101227d0
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x1011d79b
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.101227d0
add esp, 0x10
pop edi
pop ebx
pop ebp
ret

Function at 0x10122900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
mov edx, ecx
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], edx
cmp byte [edx + 0x1e4], 3
jae 0x10122937
test esi, esi
je 0x10122937
mov edx, str.sqlite_user
mov ecx, esi
call fcn.100e33b0
test eax, eax
je 0x10122a01
mov edx, dword [ebp - 4]
mov edi, dword [ebp + 8]
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [edx + 0x14], eax
jle 0x101229c9
nop word [eax + eax]
mov ebx, eax
xor ebx, 1
cmp eax, 2
cmovge ebx, eax
test edi, edi
je 0x10122a14
mov eax, dword [edx + 0x10]
mov ecx, ebx
add ecx, ecx
mov esi, edi
mov edx, dword [eax + ecx*8]
mov al, byte [edi]
movzx ecx, al
movzx edi, byte [ecx + 0x10262ec0]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x10262ec0]
sub edi, ecx
jne 0x101229b4
sub edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
nop
test al, al
je 0x10122a0a
movzx ecx, byte [edx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x10262ec0]
mov al, byte [esi]
movzx ecx, al
movzx edi, byte [ecx + 0x10262ec0]
sub edi, edx
mov edx, dword [ebp - 0x10]
je 0x10122990
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
inc eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 0x14]
jl 0x10122950
mov dl, byte [esi]
movzx eax, dl
cmp byte [eax + 0x10262ec0], 0x73
jne 0x10122a01
mov edi, str.sqlite_master
sub edi, esi
nop
test dl, dl
je 0x10122a35
movzx eax, byte [edi + esi + 1]
inc esi
movzx ecx, byte [eax + 0x10262ec0]
mov dl, byte [esi]
movzx eax, dl
movzx eax, byte [eax + 0x10262ec0]
sub eax, ecx
je 0x101229e0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x101229b4
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
add ebx, ebx
push 0
mov edx, esi
mov ecx, dword [eax + ebx*8 + 0xc]
add ecx, 8
call fcn.100e47e0
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x10122a03
jmp 0x101229b7
mov edx, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov eax, dword [eax + 0x10]
test edi, edi
jne 0x10122a4b
neg eax
sbb eax, eax
jmp 0x10122a5b
test eax, eax
je 0x10122a01
mov edx, eax
mov ecx, edi
call fcn.100e33b0
mov edx, dword [ebp - 4]
test eax, eax
jne 0x10122a01
mov esi, str.sqlite_temp_master
mov dword [ebp - 8], esi
jmp 0x10122940
Function at 0x10122da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov dword [ebp - 0xc], edx
xor edx, edx
mov dword [ebp - 0x10], eax
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x10122e59
push ebx
push esi
mov eax, dword [eax + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x10122e3a
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x10262ec0]
movzx ecx, al
movzx ecx, byte [ecx + 0x10262ec0]
sub ecx, edx
jne 0x10122e21
sub ebx, esi
test al, al
je 0x10122e36
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x10262ec0]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x10262ec0]
sub ecx, edx
je 0x10122e00
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x10122dc1
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x10122e21
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add ecx, 0x18
push 0
call fcn.100e47e0
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x10122e2d
jmp 0x10122e24
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10186e70
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x10], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov esi, ecx
mov dword [ebp - 0xc], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
push edi
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x10186eac
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + ebx*4 - 0x10]
push esi
call fcn.10186d90
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x10186f6d
push dword [ebp + 0xc]
push dword [ebp + 8]
push 1
push edi
call fcn.101079a0
push edi
call fcn.101066b0
add esp, 0x14
cmp eax, 0x65
jne 0x10186f00
mov edx, dword [ebp + 8]
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ecx
push edx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.10186e10
add esp, 0x1c
jmp 0x10186f5b
cmp eax, 0x64
jne 0x10186f5b
push 0
push edi
call fcn.10107030
mov ecx, eax
add esp, 8
mov eax, edx
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x10]
cmp ecx, edx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], eax
jne 0x10186f28
cmp eax, ecx
je 0x10186f5b
push ecx
mov ecx, dword [ebp + 0xc]
test ebx, ebx
push edx
mov edx, dword [ebp + 8]
mov eax, str.__rowid
push ecx
push edx
mov dword [ebp - 4], str.__parent
cmove eax, dword [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push ecx
push edx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.10186e10
add esp, 0x2c
push edi
call fcn.10105890
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x10186f6d
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10189800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
mov dword [eax], 0
test edi, edi
je 0x101898f7
mov ebx, dword [ebp + 0xc]
mov esi, 0xd
lea edx, [ebx - 1]
test edx, edx
js 0x10189857
mov ebx, dword [ebp + 8]
nop word [eax + eax]
movsx ecx, byte [edx + ebx]
lea eax, [esi*8]
xor ecx, eax
xor esi, ecx
sub edx, 1
jns 0x10189840
mov ebx, dword [ebp + 0xc]
mov ecx, dword [esp + 0x10]
lea eax, [esi*8]
xor eax, esi
xor eax, ecx
and eax, 0x1ff
lea eax, [edi + eax*4]
mov edi, dword [eax]
mov dword [esp + 0x14], eax
test edi, edi
je 0x101898de
cmp dword [edi + 8], ecx
jne 0x101898d7
cmp dword [edi + 4], ebx
jne 0x101898d7
mov edx, dword [edi]
mov ecx, ebx
mov esi, dword [ebp + 8]
sub ecx, 4
jb 0x101898a1
nop
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x101898a6
add edx, 4
add esi, 4
sub ecx, 4
jae 0x10189890
cmp ecx, 0xfffffffc
je 0x101898ee
mov al, byte [edx]
cmp al, byte [esi]
jne 0x101898d3
cmp ecx, 0xfffffffd
je 0x101898ee
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x101898d3
cmp ecx, 0xfffffffe
je 0x101898ee
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x101898d3
cmp ecx, 0xffffffff
je 0x101898ee
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x101898ee
mov ecx, dword [esp + 0x10]
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x10189878
lea edi, [ebx + 0x10]
xor esi, esi
call fcn.10160610
test eax, eax
je 0x10189900
jmp 0x10189910
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.100dfb50
mov esi, eax
add esp, 8
test esi, esi
jne 0x1018991b
test edi, edi
je 0x10189927
mov edi, 7
jmp 0x10189929
push edi
push 0
push esi
call fcn.101ee530
add esp, 0xc
xor edi, edi
test esi, esi
je 0x10189954
mov edx, dword [esp + 0x10]
lea eax, [esi + 0x10]
push ebx
push dword [ebp + 8]
mov dword [esi], eax
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
call fcn.101ec960
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov dword [ecx], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1018f7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov bl, dl
sub edi, 1
mov dword [ebp - 4], ecx
mov esi, 0xd
js 0x1018f7f4
mov edx, dword [ebp + 8]
nop dword [eax]
movzx ecx, byte [edi + edx]
lea eax, [esi*8]
xor ecx, eax
xor esi, ecx
sub edi, 1
jns 0x1018f7e0
lea eax, [esi*8]
movzx ecx, bl
xor eax, ecx
xor edx, edx
xor eax, esi
div dword [ebp - 4]
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10192610
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
and eax, 8
push edi
push 0x54
mov dword [esp + 0x20], eax
mov edi, ecx
lea eax, [esi + 4]
mov dword [esp + 0x1c], edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
call fcn.101ee530
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov dword [esi], ecx
mov ebx, dword [edi + 0x3c]
test ebx, ebx
jne 0x10192684
mov eax, dword [edi]
push dword [eax + 8]
push dword [eax + 4]
push str.SELECT_pgno_FROM__q._q_idx_WHERE_segid__AND_term___ORDER_BY_term_DESC_LIMIT_1
call fcn.100e2630
add esp, 0xc
lea edx, [edi + 0x3c]
mov ecx, edi
push eax
call fcn.10190400
mov ebx, dword [edi + 0x3c]
add esp, 4
mov ecx, dword [ebp + 0x10]
cmp dword [edi + 0x24], 0
jne 0x101927e0
mov eax, dword [ecx]
cdq
push edx
push eax
push 1
push ebx
call fcn.101079a0
push 0
push 0
push dword [ebp + 8]
mov edx, 2
mov ecx, ebx
push dword [esp + 0x34]
call fcn.101077a0
push ebx
call fcn.101066b0
add esp, 0x24
cmp eax, 0x64
jne 0x101926dd
push 0
push ebx
call fcn.10106f50
cdq
add esp, 8
mov ecx, eax
shrd eax, edx, 1
and ecx, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
push ebx
call fcn.10105890
add esp, 4
mov dword [edi + 0x24], eax
mov edx, 2
mov ecx, ebx
call fcn.10107620
test eax, eax
jne 0x1019270c
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1019270c
push eax
call dword [0x10299df4]
add esp, 4
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, edi
mov eax, dword [eax + 4]
cmp dword [esp + 0x10], eax
cmovge edx, dword [esp + 0x14]
cmovge eax, dword [esp + 0x10]
mov dword [esp + 0x14], edx
dec eax
mov edx, esi
mov dword [esi + 8], eax
call fcn.10191660
cmp dword [esi + 0xc], 0
mov ebx, dword [esp + 0x1c]
je 0x10192751
push dword [ebp + 8]
mov edx, ebx
mov ecx, edi
push dword [esp + 0x1c]
push esi
call fcn.101922b0
add esp, 0xc
cmp dword [edi + 0x24], 0
jne 0x101927b6
test ebx, ebx
jne 0x101927b6
mov edx, dword [esi + 4]
or edx, 1
mov dword [esi + 4], edx
cmp dword [esi + 0xc], ebx
je 0x101927b6
mov ebx, dword [ebp + 0xc]
and ebx, 2
je 0x10192777
or edx, 2
mov dword [esi + 4], edx
cmp dword [esp + 0x14], 0
je 0x101927a9
mov ecx, dword [esi + 0x1c]
and edx, 2
cmp ecx, dword [esi + 8]
jne 0x10192797
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x28]
cmp eax, dword [ecx + 8]
mov ecx, dword [esi + 0x1c]
jl 0x101927a9
mov eax, dword [esi]
push ecx
mov ecx, edi
push dword [eax]
call fcn.10191450
add esp, 8
mov dword [esi + 0x38], eax
test ebx, ebx
je 0x101927b6
mov edx, esi
mov ecx, edi
call fcn.101920f0
test byte [esi + 4], 2
je 0x101927ca
mov dword [esi + 0x18], 0x10191c00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov ecx, 0x10191e30
mov edx, 0x10191c80
cmp dword [eax + 0x30], 1
cmove ecx, edx
mov dword [esi + 0x18], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret