joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
mov esi, edx
push edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 4], esi
test ecx, ecx
je 0x45e306
mov eax, edx
mov edi, esi
xor esi, esi
mov al, byte [eax]
test al, al
je 0x45e2f4
movzx eax, al
lea ecx, [esi*8]
lea edi, [edi + 1]
movzx edx, byte [eax + 0x5649b0]
mov al, byte [edi]
xor edx, ecx
xor esi, edx
test al, al
jne 0x45e2d3
mov ecx, dword [ebx + 0xc]
mov eax, esi
xor edx, edx
div dword [ebx]
mov esi, dword [ebp - 4]
mov edi, dword [ecx + edx*8 + 4]
mov ecx, dword [ecx + edx*8]
jmp 0x45e30e
mov edi, dword [ebx + 8]
xor edx, edx
mov ecx, dword [ebx + 4]
mov eax, dword [ebp + 8]
mov dword [eax], edx
test ecx, ecx
je 0x45e376
movzx eax, byte [esi]
movzx edx, byte [eax + 0x5649b0]
mov dword [ebp + 8], edx
mov eax, dword [edi + 0xc]
dec ecx
mov dword [ebp - 8], ecx
mov bl, byte [eax]
movzx ecx, bl
movzx ecx, byte [ecx + 0x5649b0]
sub ecx, edx
jne 0x45e36d
sub esi, eax
lea ecx, [ecx]
test bl, bl
je 0x45e363
movzx ecx, byte [esi + eax + 1]
inc eax
movzx edx, byte [ecx + 0x5649b0]
mov bl, byte [eax]
movzx ecx, bl
movzx ecx, byte [ecx + 0x5649b0]
sub ecx, edx
je 0x45e340
jmp 0x45e367
test ecx, ecx
je 0x45e37f
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edi, dword [edi]
test ecx, ecx
jne 0x45e324
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fcc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], edx
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
test edi, edi
je 0x46fe52
cmp byte [edi + 9], bl
je 0x46fcf6
inc dword [edi + 0xc]
cmp byte [edi + 0xa], bl
jne 0x46fcf6
call fcn.0046c150
mov esi, dword [edi + 4]
mov esi, dword [esi + 8]
test esi, esi
je 0x46fe40
cmp dword [ebp + 8], 0
je 0x46fd6f
test byte [esi + 0x40], 1
jne 0x46fd6f
mov al, byte [esi + 0x42]
cmp al, 1
je 0x46fd1f
cmp al, 2
jne 0x46fde0
cmp al, 2
jne 0x46fd29
mov byte [esi + 0x42], 1
jmp 0x46fd30
mov dword [esi + 0x3c], 0
mov ecx, esi
call fcn.0046c5b0
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x46fd4c
mov ecx, esi
call fcn.0046c550
mov byte [esi + 0x42], 3
and byte [esi + 0x40], 0xf1
test ebx, ebx
je 0x46fde0
mov edi, dword [esp + 0x14]
mov edx, ebx
push 0
mov ecx, edi
call fcn.0046fcc0
add esp, 4
jmp 0x46fe40
mov edi, dword [esi + 0x30]
test edi, edi
je 0x46fdce
cmp dword [0x58c138], 0
je 0x46fdc4
mov eax, dword [0x5a22a8]
test eax, eax
je 0x46fd92
push eax
call dword [0x58c190]
add esp, 4
push edi
call dword [0x58c16c]
sub dword [0x5a22e8], eax
add esp, 4
dec dword [0x5a230c]
push edi
call dword [0x58c164]
mov eax, dword [0x5a22a8]
add esp, 4
test eax, eax
je 0x46fdce
push eax
call dword [0x58c198]
jmp 0x46fdcb
push edi
call dword [0x58c164]
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esi + 0x30], 0
mov byte [esi + 0x42], 4
mov dword [esi + 0x3c], eax
xor ebx, ebx
cmp byte [esi + 0x44], bl
jl 0x46fe2d
lea edi, [esi + 0x78]
lea ebx, [ebx]
mov ecx, dword [edi]
test ecx, ecx
je 0x46fe1b
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x18], 0x40
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x1c], eax
je 0x46fe0d
call fcn.004668d0
jmp 0x46fe12
call fcn.00462670
mov ecx, dword [esp + 0x1c]
call fcn.00467a40
mov dword [edi], 0
inc ebx
movsx eax, byte [esi + 0x44]
add edi, 4
cmp ebx, eax
jle 0x46fdf0
mov esi, dword [esi + 8]
test esi, esi
jne 0x46fd04
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp byte [edi + 9], 0
je 0x46fe52
dec dword [edi + 0xc]
jne 0x46fe52
mov ecx, edi
call fcn.0046c110
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47dd30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [edx + 0x14]
mov ebx, ecx
mov ecx, edi
call fcn.00470310
mov esi, dword [edi + 0x10]
mov edx, esi
mov eax, dword [edi + 0x14]
add edx, 0xffffffff
adc eax, 0xffffffff
test eax, eax
ja 0x47ddf4
jb 0x47dd69
cmp edx, 0x7ffffffe
ja 0x47ddf4
xor eax, eax
mov dword [ebp - 8], ebx
mov word [ebp - 0x20], ax
mov dword [ebp - 0x10], eax
movsx eax, byte [edi + 0x44]
mov edx, dword [edi + 0x18]
mov eax, dword [edi + eax*4 + 0x78]
mov ecx, dword [eax + 0x3c]
movzx eax, word [edi + 0x20]
sub ecx, edx
cmp eax, ecx
cmovb ecx, eax
cmp esi, ecx
ja 0x47dda3
mov eax, 0x1010
mov dword [ebp - 0x18], edx
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1c], esi
jmp 0x47ddc0
lea eax, [ebp - 0x28]
xor edx, edx
push eax
push 1
push esi
mov ecx, edi
call fcn.00478850
add esp, 0xc
test eax, eax
jne 0x47de20
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
push 0
push dword [ebp + 8]
mov ecx, esi
call fcn.0047d340
mov ecx, dword [ebp + 0xc]
add esp, 8
test dword [ebp - 0x20], 0x2460
mov dword [ecx], eax
jne 0x47dde3
cmp dword [ebp - 0x10], 0
je 0x47ddeb
lea ecx, [ebp - 0x28]
call fcn.00477e90
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0x571334
push 0x11ada
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
mov dword [eax], 0
call fcn.0045be30
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496e90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
mov dword [ebp - 0xc], ecx
cmp byte [ecx + 0x1cc], 3
mov ebx, edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], eax
jae 0x496ecb
test ebx, ebx
je 0x496ecb
mov edx, str.sqlite_user
mov ecx, ebx
call fcn.0045cc50
test eax, eax
jne 0x496ec6
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov edx, dword [ecx + 0x14]
push esi
xor esi, esi
mov dword [ebp - 0x14], edx
test edx, edx
jle 0x496f53
push edi
lea esp, [esp]
mov edi, esi
cmp esi, 2
jge 0x496eea
xor edi, 1
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x496f60
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, ebx
mov bl, byte [ebx]
mov ecx, dword [ecx + edx*8]
mov dword [ebp - 8], ecx
movzx ecx, byte [ecx]
movzx edx, byte [ecx + 0x5649b0]
movzx ecx, bl
movzx ecx, byte [ecx + 0x5649b0]
sub ecx, edx
jne 0x496f46
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp - 8], edx
test bl, bl
je 0x496f59
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x5649b0]
mov bl, byte [eax]
movzx ecx, bl
movzx ecx, byte [ecx + 0x5649b0]
sub ecx, edx
mov edx, dword [ebp - 8]
je 0x496f22
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x496ee0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x496f46
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.0045e2b0
add esp, 4
test eax, eax
je 0x496f8b
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x496f52
jmp 0x496f49
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x496f49

Function at 0x497110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov dword [ebp - 0xc], edx
xor eax, eax
mov edx, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edx
test edx, edx
jle 0x4971cb
mov edx, dword [ecx + 0x10]
push ebx
mov dword [ebp - 0x14], edx
push esi
mov eax, edi
cmp edi, 2
jge 0x497141
xor eax, 1
shl eax, 4
mov ecx, dword [eax + edx + 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4971a6
mov ebx, dword [eax + edx]
mov esi, ecx
mov al, byte [ecx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x5649b0]
movzx ecx, al
movzx ecx, byte [ecx + 0x5649b0]
sub ecx, edx
jne 0x497194
sub ebx, esi
test al, al
je 0x4971a2
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x5649b0]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x5649b0]
sub ecx, edx
je 0x497173
mov eax, dword [ebp - 4]
inc edi
cmp edi, dword [ebp - 0x10]
jge 0x4971c9
mov edx, dword [ebp - 0x14]
jmp 0x497137
test ecx, ecx
jne 0x497194
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
add ecx, 0x18
push eax
call fcn.0045e2b0
add esp, 4
test eax, eax
je 0x4971d0
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x497197
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x497197
Function at 0x4d6960
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 0xe5], 2
jne 0x4d6a01
push edi
push dword [esi + 0x14]
push dword [esi + 0x10]
push str.SELECT_1_FROM__Q.sqlite_master_WHERE_tbl_name_q_stat
call fcn.0045bcb0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4d69f6
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 4]
push ebx
push 0
push eax
push 0
push 1
push 0xffffffffffffffff
mov edx, edi
mov dword [ebp - 4], 0
call fcn.004adf10
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x4d69e4
push dword [ebp - 4]
call fcn.0047ed80
push dword [ebp - 4]
xor ecx, ecx
cmp eax, 0x64
sete cl
mov dword [ebp - 8], ecx
call fcn.0047e020
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4d69e4
mov eax, dword [ebp - 8]
mov byte [esi + 0xe5], al
push edi
call fcn.00459c50
add esp, 4
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e8230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov eax, edi
or eax, ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
je 0x4e83f0
mov eax, edi
xor esi, esi
and eax, 1
mov dword [ebp - 0xc], esi
or eax, esi
jne 0x4e8288
inc esi
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, edi
and ecx, ebx
or edx, ecx
je 0x4e8265
mov dword [ebp - 0xc], esi
mov eax, dword [ebp + 8]
xor edx, edx
dec eax
mov dword [ebp - 8], 0
xor ecx, ecx
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, edi
and ecx, ebx
or edx, ecx
jne 0x4e82d8
mov esi, eax
inc dword [ebp - 8]
dec esi
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, edi
and ecx, ebx
or edx, ecx
je 0x4e82b2
mov esi, dword [ebp - 0xc]
sub esi, dword [ebp - 8]
mov eax, esi
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
test ebx, ebx
jle 0x4e83f0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov ecx, dword [ecx + 0x24]
mov dword [ebp - 0x14], ecx
mov eax, dword [ecx]
mov edi, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi + 0xc]
push dword [ebp + 0xc]
push ecx
call eax
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4e8356
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
cmp dword [edi], 1
jl 0x4e8356
push dword [ebp - 0x18]
mov eax, dword [edi + 0x18]
push dword [ebp - 8]
call eax
mov esi, eax
add esp, 8
test esi, esi
je 0x4e8356
push dword [ebp - 8]
mov eax, dword [edi + 0x10]
call eax
add esp, 4
xor edi, edi
mov dword [ebp - 8], edi
jmp 0x4e8359
mov edi, dword [ebp - 8]
test esi, esi
je 0x4e8366
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add ebx, dword [ebp + 8]
lea esp, [esp]
cmp dword [ebp - 0xc], ebx
jge 0x4e83b0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push edi
mov eax, dword [eax + 0x14]
call eax
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4e8370
mov eax, dword [ebp - 0x10]
push edi
mov ecx, dword [eax + 0x10]
call ecx
add esp, 4
test esi, esi
je 0x4e83c5
cmp esi, 0x65
jne 0x4e835d
xor ecx, ecx
cmp esi, 0x65
sete cl
sub ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
test ecx, ecx
jle 0x4e83f0
mov eax, dword [ebp + 0x14]
movq xmm1, qword [ebp - 0x2c]
movd xmm0, ecx
psrlq xmm1, xmm0
add dword [eax], ecx
mov eax, dword [ebp + 0x18]
movq qword [eax], xmm1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ea6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x5876e0]
xor eax, ebp
mov dword [ebp - 4], eax
movdqa xmm0, xmmword [0x5733d0]
mov eax, ecx
movdqu xmmword [ebp - 0x138], xmm0
mov ecx, 0xf79e
mov dword [ebp - 0x13c], eax
movdqa xmm0, xmmword [0x5733e0]
movdqu xmmword [ebp - 0x128], xmm0
push ebx
movdqa xmm0, xmmword [0x573400]
xor ebx, ebx
movdqu xmmword [ebp - 0x118], xmm0
shl eax, 3
movdqa xmm0, xmmword [str.usthaeoy]
or eax, 7
movdqu xmmword [ebp - 0x108], xmm0
push esi
movdqa xmm0, xmmword [0x5733f0]
mov esi, 0x64
movdqu xmmword [ebp - 0xf8], xmm0
push edi
movdqa xmm0, xmmword [str.rrstuvwwxyzhtwya]
xor edi, edi
mov dword [ebp - 0xd0], 0x7050000
mov dword [ebp - 0xcc], 0x7430738
mov dword [ebp - 0xc8], 0x7880763
mov dword [ebp - 0xc4], 0x7cb0794
mov dword [ebp - 0xc0], 0x7f807e8
mov dword [ebp - 0xbc], 0x83e080c
mov dword [ebp - 0xb8], 0x89e0878
mov dword [ebp - 0xb4], 0x8ee08d8
mov dword [ebp - 0xb0], 0x94f0928
mov dword [ebp - 0xac], 0x9b809a8
mov dword [ebp - 0xa8], 0xa2409d4
mov dword [ebp - 0xa4], 0xaac0a6c
mov dword [ebp - 0xa0], 0xb1a0ade
mov dword [ebp - 0x9c], 0xb8a0b4e
mov dword [ebp - 0x98], 0xbb80ba8
mov dword [ebp - 0x94], 0xd080bd4
mov dword [ebp - 0x90], 0xe700d80
mov dword [ebp - 0x8c], 0xe900e80
mov dword [ebp - 0x88], 0xf380ea0
mov dword [ebp - 0x84], 0xf580f48
mov dword [ebp - 0x80], 0xfa80f80
mov dword [ebp - 0x7c], 0x100a0fc8
mov dword [ebp - 0x78], 0x104a102a
mov dword [ebp - 0x74], 0x108a106a
mov dword [ebp - 0x70], 0x10c810aa
mov dword [ebp - 0x6c], 0x10f810d8
mov dword [ebp - 0x68], 0x11481138
mov dword [ebp - 0x64], 0x11981178
mov dword [ebp - 0x60], 0x18361804
mov dword [ebp - 0x5c], 0x18881878
mov dword [ebp - 0x58], 0x191d18d8
mov dword [ebp - 0x54], 0x19811969
mov dword [ebp - 0x50], 0xf01cf008
mov dword [ebp - 0x4c], 0xf098f05e
mov dword [ebp - 0x48], 0xf0f8f0ca
mov dword [ebp - 0x44], 0xf11ef108
mov dword [ebp - 0x40], 0xf168f158
mov dword [ebp - 0x3c], 0xf1b8f18c
mov dword [ebp - 0x38], 0xf1fcf1da
mov dword [ebp - 0x34], 0xf2aaf22e
mov dword [ebp - 0x30], 0xf2f8f2ca
mov dword [ebp - 0x2c], 0xf35ef30a
mov dword [ebp - 0x28], 0xf3eaf39c
mov dword [ebp - 0x24], 0xf448f40e
mov dword [ebp - 0x20], 0xf478f45a
mov dword [ebp - 0x1c], 0xf4b0f48c
mov dword [ebp - 0x18], 0xf4c0f4b8
mov dword [ebp - 0x14], 0xf50af4c8
mov dword [ebp - 0x10], 0xf64af5cc
mov dword [ebp - 0xc], 0xf72af66a
mov word [ebp - 8], cx
movdqu xmmword [ebp - 0xe8], xmm0
mov dword [ebp - 0xd8], 0x756f6965
mov byte [ebp - 0xd4], 0x79
mov dword [ebp - 0x140], eax
lea eax, [edi + esi]
cdq
sub eax, edx
sar eax, 1
movzx ecx, word [ebp + eax*2 - 0xd0]
cmp dword [ebp - 0x140], ecx
jb 0x4ea936
mov ebx, eax
lea edi, [eax + 1]
jmp 0x4ea939
lea esi, [eax - 1]
cmp esi, edi
jge 0x4ea917
movzx ecx, word [ebp + ebx*2 - 0xd0]
mov eax, ecx
and ecx, 7
shr eax, 3
add eax, ecx
mov ecx, dword [ebp - 0x13c]
cmp ecx, eax
mov eax, ecx
jg 0x4ea963
movsx eax, byte [ebp + ebx - 0x138]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050904e
mov esp, ebp
pop ebp
ret
Function at 0x4ea980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
cmp esi, 0x80
jge 0x4ea9a8
lea eax, [esi - 0x41]
cmp eax, 0x19
ja 0x4eaa50
lea eax, [esi + 0x20]
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x10000
jge 0x4eaa42
push ebx
push edi
mov edi, 0xa2
mov dword [ebp - 4], 0xffffffff
xor ebx, ebx
lea eax, [ebx + edi]
cdq
sub eax, edx
mov edx, esi
sar eax, 1
movzx ecx, word [eax*4 + 0x567e30]
sub edx, ecx
js 0x4ea9e4
mov ecx, eax
lea ebx, [eax + 1]
mov dword [ebp - 4], ecx
jmp 0x4ea9ea
mov ecx, dword [ebp - 4]
lea edi, [eax - 1]
cmp edi, ebx
jge 0x4ea9c4
pop edi
pop ebx
test ecx, ecx
js 0x4eaa30
movzx edx, word [ecx*4 + 0x567e30]
movzx eax, byte [ecx*4 + 0x567e33]
add eax, edx
cmp esi, eax
jge 0x4eaa30
movzx eax, byte [ecx*4 + 0x567e32]
xor edx, esi
and edx, eax
test edx, 1
jne 0x4eaa30
shr eax, 1
movzx eax, word [eax*2 + 0x5651b0]
add esi, eax
and esi, 0xffff
cmp dword [ebp - 8], 0
je 0x4eaa50
mov ecx, esi
call fcn.004ea6d0
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x10400]
cmp eax, 0x27
lea eax, [esi + 0x28]
jbe 0x4eaa52
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ef720
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, edx
xorps xmm0, xmm0
push edi
mov dword [esp + 0x10], esi
mov edi, ecx
movlpd qword [esp + 0x18], xmm0
push dword [esi + 0x20]
push dword [esi + 0x1c]
push str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
call fcn.0045bcb0
add esp, 0xc
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4ef764
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
mov edx, eax
push ecx
push 0
push 1
push 0xffffffffffffffff
mov ecx, edi
call fcn.004adf10
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x4ef7cd
push dword [esp + 0xc]
call fcn.0047ed80
add esp, 4
cmp eax, 0x64
jne 0x4ef7b5
push ebx
push dword [esp + 0x10]
call fcn.0047f5f0
add esp, 8
mov esi, eax
mov edi, edx
push dword [esp + 0xc]
call fcn.0047e020
add esp, 4
mov ebx, eax
jmp 0x4ef7fb
push dword [esp + 0xc]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
call fcn.0047e020
add esp, 4
mov ebx, eax
jmp 0x4ef7fb
cmp ebx, 7
je 0x4ef7f3
push dword [esp + 0x14]
xor ebx, ebx
mov dword [esi + 0x28], 0x100000
mov dword [esi + 0x2c], ebx
call fcn.00459c50
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test ebx, ebx
jne 0x4ef844
mov eax, esi
or eax, edi
jne 0x4ef828
mov esi, dword [esp + 0x10]
push dword [esp + 0x14]
mov dword [esi + 0x28], 0x100000
mov dword [esi + 0x2c], eax
call fcn.00459c50
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jl 0x4ef833
jg 0x4ef83a
cmp esi, 0x64
ja 0x4ef83a
mov esi, 0x64
xor edi, edi
mov eax, dword [esp + 0x10]
mov dword [eax + 0x28], esi
mov dword [eax + 0x2c], edi
push dword [esp + 0x14]
call fcn.00459c50
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4efa10
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x4efa7b
push dword [esi + 0x1c]
mov dword [ebp + 8], 0
push str.PRAGMA__Q.page_size
call fcn.0045bcb0
mov ebx, eax
mov ecx, edi
lea eax, [ebp + 8]
mov edx, ebx
push eax
call fcn.004ef9a0
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jne 0x4efaa4
movzx ecx, byte [esi + 0x16]
mov edx, dword [ebp + 8]
imul ecx, ecx, 0x33
add edx, 0xffffffc0
mov dword [esi + 0x10], edx
add ecx, 4
cmp ecx, edx
jge 0x4efabd
push ebx
mov dword [esi + 0x10], ecx
call fcn.00459c50
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x20]
push dword [esi + 0x1c]
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.0045bcb0
mov ebx, eax
mov ecx, edi
lea eax, [esi + 0x10]
mov edx, ebx
push eax
call fcn.004ef9a0
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
je 0x4efabd
push edi
call fcn.004cfe00
push eax
push 0x568b20
call fcn.0045bcb0
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov dword [ecx], eax
push ebx
call fcn.00459c50
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f0500
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x5876e0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [ebp - 0x2c], 0x6a09e667
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x28], 0xbb67ae85
mov dword [ebp - 0x24], 0x3c6ef372
mov dword [ebp - 0x20], 0xa54ff53a
mov dword [ebp - 0x1c], 0x510e527f
mov dword [ebp - 0x18], 0x9b05688c
mov dword [ebp - 0x14], 0x1f83d9ab
mov dword [ebp - 0x10], 0x5be0cd19
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
call fcn.004f0590
add esp, 4
lea ecx, [ebp - 0xb4]
mov edx, esi
call fcn.004f0630
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.0050904e
mov esp, ebp
pop ebp
ret

Function at 0x4f0950
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
mov byte [edi], 0
call fcn.004f0890
test eax, eax
jne 0x4f0976
mov byte [edi], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x1d8], 0
jne 0x4f098b
mov byte [edi], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.SELECT_pwsqlite_crypt__1_pw___isAdmin_FROM___w_.sqlite_user_WHERE_uname_2
push ebx
call fcn.004f0810
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4f09aa
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x1d0]
mov edx, 1
mov dword [ebp - 4], eax
mov ecx, esi
mov eax, dword [ebx + 0x1d4]
mov dword [ebp + 8], eax
call fcn.0047fa20
test eax, eax
jne 0x4f0a2c
mov eax, dword [ebp + 8]
test eax, eax
je 0x4f0a19
mov ecx, dword [esi + 0x3c]
mov edx, eax
push 0
push 0
push dword [ebp - 4]
call fcn.00478640
mov ecx, dword [esi]
add esp, 0xc
mov dword [ebp + 8], eax
mov dword [ecx + 0x34], eax
test eax, eax
jne 0x4f09fb
cmp dword [ecx + 0xf0], eax
je 0x4f0a05
mov edx, eax
call fcn.0045c930
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
cmp byte [ecx + 0x45], 0
jne 0x4f0a14
cmp eax, 0xc0a
jne 0x4f0a19
call fcn.0045a400
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4f0a2c
push eax
call dword [0x58c198]
add esp, 4
push 1
push 0
push 0xffffffffffffffff
push dword [ebx + 0x1d8]
mov edx, 2
mov ecx, esi
call fcn.0047fb80
push esi
call fcn.0047ed80
add esp, 0x14
cmp eax, 0x64
jne 0x4f0a80
push 0
push esi
call fcn.0047f590
add esp, 8
test eax, eax
je 0x4f0a80
push 1
push esi
call fcn.0047f590
add esp, 8
add al, 2
mov byte [edi], al
push esi
call fcn.0047e020
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov byte [edi], 1
call fcn.0047e020
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret