joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027500
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x1002751d
mov esi, 0x80
cmp esi, dword [edi]
jne 0x1002752a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x100c85ec]
test eax, eax
je 0x10027535
call eax
lea ecx, [esi*8]
push ecx
call fcn.10025930
mov ebp, eax
mov eax, dword [0x100c85f0]
add esp, 4
test eax, eax
mov dword [esp + 0x10], ebp
je 0x10027556
call eax
test ebp, ebp
je 0x10027521
mov edx, dword [edi + 0xc]
push edx
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
push ebp
mov dword [edi + 0xc], ebp
call dword [0x100c6480]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call fcn.10003bb0
mov ecx, dword [edi + 8]
add esp, 0xc
test ecx, ecx
mov dword [edi + 8], 0
je 0x10027645
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x100275d7
nop
movzx ebx, byte [esi]
movzx ebx, byte [ebx + 0x100ab370]
lea ebp, [eax*8]
xor ebx, ebp
sub edx, 1
xor eax, ebx
add esi, 1
test edx, edx
jg 0x100275b0
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
xor edx, edx
div ebx
lea eax, [ebp + edx*8]
test eax, eax
je 0x10027620
mov esi, dword [eax]
test esi, esi
je 0x100275f4
mov edx, dword [eax + 4]
jmp 0x100275f6
xor edx, edx
add esi, 1
test edx, edx
mov dword [eax], esi
mov dword [eax + 4], ecx
je 0x10027620
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x10027618
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x10027639
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x10027639
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x1002762f
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x100275a3
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x10027a00
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
test esi, esi
push edi
mov ebx, eax
mov edi, ecx
jne 0x10027a49
call sym.SQLite.Interop.dll_sqlite3_initialize
test eax, eax
jne 0x10027abb
push 0x18
call fcn.10025930
mov esi, eax
add esp, 4
test esi, esi
je 0x10027abb
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
cmp ebx, 0xffffffff
jne 0x10027a54
mov ebx, dword [edi + 0x98]
mov eax, dword [esi + 0x10]
test eax, eax
mov dword [esi], edi
lea edi, [esi + 0x14]
mov dword [esi + 0xc], ebx
mov dword [edi], ebx
je 0x10027a75
push eax
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov dword [esi + 0x10], 0
mov eax, dword [edi]
add eax, eax
push eax
push edi
push 0
push 0
push 1
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov edi, dword [edi]
add edi, 0x10
call sym.SQLite.Interop.dll_sqlite3_initialize
test eax, eax
je 0x10027a9c
xor eax, eax
jmp 0x10027aa5
push edi
call fcn.10025930
add esp, 4
test eax, eax
mov dword [esi + 0x10], eax
jne 0x10027ac3
cmp esi, dword [esp + 0x1c]
je 0x10027abb
push esi
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1002ed40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x1002ed60
test edi, edi
mov al, byte [ebp + 0x100abd10]
mov byte [esp + 0x10], al
je 0x1002ede9
cmp byte [edi], 0
mov eax, edi
je 0x1002ed7d
add eax, 1
cmp byte [eax], 0
jne 0x1002ed75
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x1a4
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x1002edd1
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x1002edc7
movzx edi, byte [edx]
movzx edi, byte [edi + 0x100ab370]
lea ebp, [eax*8]
xor edi, ebp
sub esi, 1
xor eax, edi
add edx, 1
test esi, esi
jg 0x1002eda0
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x1002edd3
xor edx, edx
push edi
call fcn.1001cea0
add esp, 4
test eax, eax
je 0x1002ede5
mov eax, dword [eax + 8]
jmp 0x1002edf0
xor eax, eax
jmp 0x1002edf0
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 8]
test eax, eax
je 0x1002ee00
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x1002ee23
add ebp, 1
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x1002ed60
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x10038f80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ebx
push ebp
xor ebp, ebp
test dword [ecx + 0x18], 0x80000
push esi
push edi
mov dword [esp + 0x14], ebp
je 0x100390cd
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x10]
test edi, edi
je 0x10038fec
jmp 0x10038fb0
mov eax, dword [edi + 0x14]
test eax, eax
jle 0x10038fdd
lea edx, [edi + 0x24]
mov esi, eax
lea esp, [esp]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x10038fcc
or eax, 0xffffffff
jmp 0x10038fd3
mov eax, 1
shl eax, cl
or ebp, eax
add edx, 8
sub esi, 1
jne 0x10038fc0
mov edi, dword [edi + 4]
test edi, edi
jne 0x10038fb0
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x14], ebp
mov edi, dword [ecx]
test edi, edi
mov eax, edi
jne 0x10038ff8
xor ebx, ebx
jmp 0x10039011
cmp byte [edi], 0
je 0x10039008
lea ecx, [ecx]
add eax, 1
cmp byte [eax], 0
jne 0x10039000
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov ecx, dword [ecx + 0x44]
add ecx, 0x38
cmp dword [ecx + 0xc], 0
mov dword [esp + 0x18], ecx
je 0x1003905d
xor eax, eax
test ebx, ebx
mov esi, ebx
mov edx, edi
jle 0x10039057
jmp 0x10039030
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x100ab370]
lea ebp, [eax*8]
xor ecx, ebp
sub esi, 1
xor eax, ecx
add edx, 1
test esi, esi
jg 0x10039030
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
xor edx, edx
div dword [ecx]
jmp 0x1003905f
xor edx, edx
push edi
call fcn.1001cea0
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x100390cd
mov edi, dword [eax + 8]
cmp edi, ebx
je 0x100390cd
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push ebx
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
mov dword [esp + 0x28], ebx
call fcn.10033880
mov eax, dword [esp + 0x28]
add esp, 0x14
cmp eax, ebx
je 0x100390c6
movzx ecx, word [eax + 0x32]
cmp ecx, ebx
jle 0x100390c6
mov edx, dword [eax + 4]
mov esi, ecx
movzx ecx, word [edx]
cmp cx, 0x1f
jle 0x100390b5
or eax, 0xffffffff
jmp 0x100390bc
mov eax, 1
shl eax, cl
or ebp, eax
add edx, 2
sub esi, 1
jne 0x100390a7
mov edi, dword [edi + 0xc]
cmp edi, ebx
jne 0x10039075
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10052e00
Capabilities:
Reference sql statements

Disassembly:
push edi
mov edi, 0x100c6bd8
push 0x100c83e8
call fcn.1001fc70
add edi, 0x24
add esp, 4
cmp edi, 0x100c7424
jl 0x10052e06
mov edi, 0x100c6568
push 0x100c83e8
call fcn.1001fc70
add edi, 0x24
add esp, 4
cmp edi, 0x100c6688
jl 0x10052e23
mov edi, 0x100c6b48
push 0x100c83e8
call fcn.1001fc70
add edi, 0x24
add esp, 4
cmp edi, 0x100c6bb4
jl 0x10052e40
push 0x100c83e8
mov edi, 0x100c6b20
call fcn.1001fc70
add esp, 4
pop edi
ret
Function at 0x100627d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
cmp byte [esi], 0
push ebx
push ebp
push edi
jne 0x100629d0
mov al, byte [esi + 5]
mov ebp, dword [esi + 0x38]
mov ebx, dword [esi + 0x34]
mov byte [esp + 0xf], al
movzx eax, al
movzx ecx, byte [eax + ebp]
lea edi, [eax + ebp]
mov eax, esi
call fcn.100600b0
test eax, eax
je 0x10062826
push 0x100b2e14
push 0xcd7a
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x10
mov eax, 0xb
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
mov cx, word [ebx + 0x20]
movzx edx, byte [esi + 3]
mov ax, 3
sub ax, dx
movzx edx, byte [esp + 0xf]
add ax, ax
add ax, ax
add ax, dx
sub cx, 1
mov word [esi + 0x12], cx
movzx eax, ax
mov byte [esi + 1], 0
mov ecx, dword [ebx + 0x24]
mov word [esi + 0xc], ax
mov dword [esp + 0x10], ecx
add ecx, ebp
mov dword [esi + 0x3c], ecx
movzx ecx, ax
xor edx, edx
lea eax, [ecx + ebp]
mov dword [esi + 0x40], eax
mov dh, byte [edi + 5]
xor eax, eax
mov ah, byte [edi + 3]
mov dl, byte [edi + 6]
sub edx, 1
and edx, 0xffff
add edx, 1
mov dword [esp + 0x18], edx
movzx edx, byte [edi + 4]
or ax, dx
mov word [esi + 0x10], ax
mov edx, dword [ebx + 0x20]
movzx eax, ax
mov dword [esp + 0x14], eax
sub edx, 8
mov eax, 0xaaaaaaab
mul edx
mov eax, dword [esp + 0x14]
shr edx, 2
cmp eax, edx
jbe 0x100628d7
push 0x100b2e14
push 0xcd86
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x10
mov eax, 0xb
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
lea ecx, [ecx + eax*2]
xor eax, eax
mov ah, byte [edi + 1]
mov dword [esp + 0x14], ecx
mov al, byte [edi + 2]
movzx edi, byte [edi + 7]
add edi, dword [esp + 0x18]
movzx eax, ax
test ax, ax
jbe 0x10062967
jmp 0x10062900
movzx eax, ax
cmp eax, ecx
jl 0x100629a2
mov edx, dword [esp + 0x10]
add edx, 0xfffffffc
cmp eax, edx
jg 0x100629a2
movzx dx, byte [eax + ebp + 1]
mov dh, byte [eax + ebp]
xor ebx, ebx
mov bh, byte [eax + ebp + 2]
movzx edx, dx
test dx, dx
mov bl, byte [eax + ebp + 3]
movzx ebx, bx
mov dword [esp + 0x18], ebx
jbe 0x10062952
movzx ecx, bx
movzx ebx, dx
lea ecx, [ecx + eax + 3]
cmp ebx, ecx
jle 0x1006297d
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
movzx ebx, bx
add eax, ebx
cmp eax, dword [esp + 0x10]
jg 0x1006297d
add edi, ebx
test dx, dx
movzx eax, dx
ja 0x10062900
cmp edi, dword [esp + 0x10]
jle 0x100629c7
mov eax, 0xcdc6
pop edi
pop ebp
pop ebx
add esp, 0x10
jmp fcn.1005f050
push 0x100b2e14
push 0xcdb8
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x10
mov eax, 0xb
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x100b2e14
push 0xcdb1
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call sym.SQLite.Interop.dll_sqlite3_log
add esp, 0x10
mov eax, 0xb
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
sub edi, ecx
mov word [esi + 0xe], di
mov byte [esi], 1
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x10074b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x100c58c0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x24]
add edx, edx
mov eax, 0xaaaaaaab
mul edx
push esi
push edi
xor ecx, ecx
mov edi, edx
shr edi, 1
mov dword [esp + 0xc], ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], ecx
movsx esi, word [ebx + 0x54]
test esi, esi
mov eax, dword [ebx + esi*4 + 0x80]
mov dword [esp + 0x14], eax
jne 0x10074c14
cmp byte [eax + 1], 0
je 0x10074d59
lea ecx, [ebx + 0x84]
push ecx
call fcn.1006d480
xor ecx, ecx
add esp, 4
cmp eax, ecx
mov dword [esp + 0xc], eax
jne 0x10074d59
mov word [ebx + 0x54], 1
mov word [ebx + 0x56], cx
mov word [ebx + 0x58], cx
jmp 0x10074d4e
cmp byte [eax + 1], 0
jne 0x10074c26
movzx edx, word [eax + 0xe]
cmp edx, edi
jle 0x10074d59
mov edi, dword [ebx + esi*4 + 0x7c]
movzx eax, word [ebx + esi*2 + 0x54]
mov ecx, dword [edi + 0x44]
push ecx
mov dword [esp + 0x1c], eax
call fcn.1003fe40
add esp, 4
test eax, eax
mov dword [esp + 0xc], eax
jne 0x10074cce
mov eax, dword [esp + 0x14]
cmp byte [eax + 4], 0
je 0x10074c8a
cmp byte [eax + 1], 1
jne 0x10074c8a
mov dx, word [eax + 0x14]
cmp dx, word [eax + 0x10]
jne 0x10074c8a
cmp dword [edi + 0x48], 1
je 0x10074c8a
movzx ecx, word [edi + 0x10]
cmp ecx, dword [esp + 0x18]
jne 0x10074c8a
lea edx, [esp + 0x24]
push edx
push eax
push edi
call fcn.1006c640
add esp, 0xc
mov dword [esp + 0xc], eax
jmp 0x10074cce
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x20]
call fcn.10027400
movzx ecx, byte [ebx + 0x52]
xor edx, edx
cmp esi, 1
sete dl
push ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
push edx
push eax
push edi
call fcn.1006d5e0
mov esi, dword [esp + 0x20]
add esp, 0x10
test esi, esi
mov dword [esp + 0xc], eax
je 0x10074cc6
call fcn.10021880
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
mov byte [eax + 1], 0
mov eax, dword [eax + 0x44]
test byte [eax + 0x18], 0x40
mov edi, dword [eax + 0x10]
je 0x10074d25
add dword [edi + 0x78], 0xffffffff
mov ecx, dword [edi + 0x88]
mov dword [eax + 0xc], ecx
mov ecx, dword [edi + 0x3c]
mov dword [edi + 0x88], eax
mov esi, dword [ecx]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0x14]
mov eax, dword [edi + 0x98]
push edx
cdq
push edx
push eax
sub ecx, 1
push 0
push ecx
call fcn.10008f60
push edx
mov edx, dword [esi + 0x48]
push eax
mov eax, dword [edi + 0x3c]
push eax
call edx
add esp, 0x10
jmp 0x10074d2a
call fcn.1001ca10
cmp dword [edi + 0x78], 0
jne 0x10074d45
mov eax, dword [edi + 0xdc]
cmp dword [eax + 0xc], 0
jne 0x10074d45
push edi
call fcn.10065200
add esp, 4
add word [ebx + 0x54], 0xffff
mov edi, dword [esp + 0x20]
cmp dword [esp + 0xc], 0
je 0x10074bc7
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10074d66
call fcn.10021880
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
call fcn.100019b7
mov esp, ebp
pop ebp
ret
Function at 0x100919b0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push ebx
push esi
push edi
push ecx
push edx
push str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
xor edi, edi
xor ebx, ebx
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esp, 0xc
test eax, eax
mov dword [esp + 0x14], eax
jne 0x100919ea
lea eax, [edi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ebp + 8]
lea esi, [esp + 0x24]
call fcn.1008ade0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x10091a51
mov esi, dword [esp + 0x10]
push esi
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 4
cmp eax, 0x64
jne 0x10091a29
push 0
push esi
call sym.SQLite.Interop.dll_sqlite3_column_int64
add esp, 8
mov edi, eax
mov ebx, edx
push esi
call sym.SQLite.Interop.dll_sqlite3_finalize
add esp, 4
mov esi, eax
test esi, esi
jne 0x10091a7b
mov eax, edi
or eax, ebx
jne 0x10091a5a
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x28], 0x100000
mov dword [eax + 0x2c], 0
jmp 0x10091a7b
cmp esi, 7
je 0x10091a34
xor esi, esi
jmp 0x10091a3e
test ebx, ebx
jl 0x10091a6b
jg 0x10091a65
cmp edi, 0x64
jbe 0x10091a6b
mov eax, edi
mov ecx, ebx
jmp 0x10091a72
mov eax, 0x64
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], ecx
mov ecx, dword [esp + 0x14]
push ecx
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100939c0
Capabilities:
Reference sql statements

Disassembly:
push ecx
xor eax, eax
cmp byte [edi + 0xe5], 2
jne 0x10093a51
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
push ebp
push eax
push ecx
push str.SELECT_1_FROM__Q.sqlite_master_WHERE_tbl_name_q_stat
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x10093a4b
mov eax, dword [edi + 0xc]
push esi
push 0
push 0
push 1
push 0xffffffffffffffff
push ebp
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 0
call fcn.1008ade0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x10093a3c
mov esi, dword [esp + 8]
push ebx
push esi
call sym.SQLite.Interop.dll_sqlite3_step
xor ebx, ebx
cmp eax, 0x64
push esi
sete bl
call sym.SQLite.Interop.dll_sqlite3_finalize
mov esi, eax
add esp, 8
test esi, esi
jne 0x10093a3b
mov byte [edi + 0xe5], bl
pop ebx
push ebp
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ecx
ret
mov eax, 7
pop ebp
pop ecx
ret

Function at 0x10094220
Capabilities:
Reference sql statements

Disassembly:
cmp dword [esp + 8], 0
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, eax
je 0x1009428a
mov eax, dword [esi + 0x1c]
push eax
push str.PRAGMA__Q.page_size
mov dword [esp + 0x20], 0
call sym.SQLite.Interop.dll_sqlite3_mprintf
lea ecx, [esp + 0x20]
push ecx
mov edi, eax
push ebp
mov ecx, edi
call fcn.100918f0
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x100942b3
movzx ecx, byte [esi + 0x16]
mov eax, dword [esp + 0x18]
imul ecx, ecx, 0x33
add eax, 0xffffffc0
add ecx, 4
cmp ecx, eax
mov dword [esi + 0x10], eax
jge 0x100942cd
push edi
mov dword [esi + 0x10], ecx
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esi, 0x10
mov edi, eax
push esi
push ebp
mov ecx, edi
call fcn.100918f0
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x100942cd
push ebp
call sym.SQLite.Interop.dll_sqlite3_errmsg
push eax
push 0x100af5a4
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov edx, dword [esp + 0x28]
mov dword [edx], eax
add esp, 0xc
push edi
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x404944
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407eb4
test esi, esi
jne 0x40497c
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00407ff0
jmp 0x40499a
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00404888
mov edi, eax
test esi, esi
je 0x40499a
cmp dword [ebx], 0
je 0x40499a
dec esi
jmp 0x404983
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4049cc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x73d008], 0x8088405
inc edx
mov dword [ebx + 0x73d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x406b34
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x750054], 0
je 0x406b95
cmp word [0x750330], 0xd7b2
jne 0x406b5d
cmp dword [0x750338], 0
jbe 0x406b5d
mov eax, 0x75032c
call dword [0x750348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406bc0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x73d034], 0
jne 0x406bb1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406d40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x73d03c], 0
je 0x406d66
mov edx, esi
mov eax, ebx
call dword [0x73d03c]
jmp 0x406d75
mov eax, 8
call fcn.00404598
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x750055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x406d08
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x408a60
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x408aa2
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x408ac2
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.004080c4
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x40a380
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40a4e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00407eb4
cmp si, word [0x73d7f8]
jb 0x40a41a
cmp si, word [0x73d9f8]
ja 0x40a41a
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x40a41a
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x73d7f8]
jae 0x40a3f4
mov edi, ebx
dec edi
jmp 0x40a415
cmp si, word [ebx*8 + 0x73d7f8]
jbe 0x40a404
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x40a415
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x73d7fc]
call fcn.0040a290
jmp 0x40a41a
cmp edi, dword [ebp - 0xc]
jae 0x40a3de
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x40a4c9
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40a4c9
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.004080c4
push dword [ebp - 0x164]
push 0x40a504
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.004080c4
push dword [ebp - 0x168]
push 0x40a514
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.004080c4
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.0040847c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a4ee
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00407eac
ret