joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101830e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10182802
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1018284d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10182802
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.1018284d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10182802
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.1018283d
outsd dx, dword [esi]
or al, 0x84
rol byte [eax - 0x5335b], 0xff
add byte [eax - 0x5325b], al
inc dword [eax]
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], pe_nt_image_headers32
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.1018284d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10182802
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.1018283d
aaa
int3
Function at 0x10183460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.1018284d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10182802
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.1018283d
ret 0x4c0

Function at 0x10183550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
Function at 0x1019d270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
mov al, byte [esi]
push edi
test al, al
je 0x1019d2ae
cmp al, 3
jb 0x1019d293
call fcn.1019a570
test eax, eax
jne 0x1019d3d0
mov al, byte [esi]
cmp al, 1
je 0x1019d3c2
cmp al, 2
jne 0x1019d2ae
cmp dword [esi + 4], 0
mov byte [esi], 0
jl 0x1019d3ce
mov eax, dword [esi + 0x74]
cmp byte [eax + 8], 0
jne 0x1019d2f6
mov edx, dword [eax + 0x40]
movzx ecx, word [esi + 0x46]
mov cx, word [edx + ecx*2]
mov dh, cl
mov dl, ch
movzx ecx, dx
movzx edx, word [eax + 0x1a]
mov eax, dword [eax + 0x38]
and ecx, edx
mov eax, dword [ecx + eax]
bswap eax
push eax
mov eax, esi
call fcn.10141e60
add esp, 4
test eax, eax
jne 0x1019d3d0
call fcn.10143350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [esi + 0x46], 0
jne 0x1019d395
mov al, byte [esi + 0x44]
test al, al
je 0x1019d3bf
and byte [esi + 1], 0xf9
movsx edx, al
xor ecx, ecx
mov word [esi + 0x32], cx
mov cx, word [esi + edx*2 + 0x46]
dec al
movsx edx, al
mov word [esi + 0x46], cx
mov ecx, dword [esi + 0x74]
mov byte [esi + 0x44], al
mov eax, dword [esi + edx*4 + 0x78]
mov dword [esi + 0x74], eax
mov eax, dword [ecx + 0x48]
test byte [eax + 0x1c], 0x20
je 0x1019d385
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [edi]
dec eax
push edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x18]
push 0
push eax
call fcn.10100050
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x1019d38a
call fcn.1012c920
cmp word [esi + 0x46], 0
je 0x1019d301
mov eax, dword [esi + 0x74]
mov ecx, 0xffff
add word [esi + 0x46], cx
cmp byte [eax + 2], 0
je 0x1019d3ce
cmp byte [eax + 8], 0
jne 0x1019d3ce
push 0
push esi
call fcn.1019e5b0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi], 1
mov eax, 0x65
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101a27a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
push eax
call sym.SQLite.Interop.dll_sqlite3_reset
add esp, 4
add edi, 0x10
mov dword [esp + 0x10], 0x20
xor ebx, ebx
call fcn.101303d0
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x101a2829
test byte [eax + 0x1c], 0x20
je 0x101a2824
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov esi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [esi]
dec eax
push edx
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x20]
push 0
push eax
call fcn.10100050
push edx
push eax
mov eax, dword [ebx + 0x48]
push esi
call eax
add esp, 0x10
xor ebx, ebx
jmp 0x101a2829
call fcn.1012c920
mov esi, dword [edi + 0xc]
cmp esi, ebx
je 0x101a2887
cmp dword [0x10292428], ebx
je 0x101a287d
mov eax, dword [0x10299778]
cmp eax, ebx
je 0x101a284b
push eax
call dword [0x10292478]
add esp, 4
push esi
call dword [0x10292454]
sub dword [0x10299710], eax
dec dword [0x10299734]
add esp, 4
push esi
call dword [0x1029244c]
mov eax, dword [0x10299778]
add esp, 4
cmp eax, ebx
je 0x101a2887
push eax
call dword [0x10292480]
jmp 0x101a2884
push esi
call dword [0x1029244c]
add esp, 4
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
add edi, 0x28
dec dword [esp + 0x10]
jne 0x101a27c8
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x51c]
mov dword [edi + 0x510], ebx
cmp esi, ebx
je 0x101a292e
cmp dword [0x10292428], ebx
je 0x101a2924
mov eax, dword [0x10299778]
cmp eax, ebx
je 0x101a28e1
push eax
call dword [0x10292478]
add esp, 4
push esi
call dword [0x10292454]
sub dword [0x10299710], eax
dec dword [0x10299734]
add esp, 4
push esi
call dword [0x1029244c]
mov eax, dword [0x10299778]
add esp, 4
cmp eax, ebx
je 0x101a292e
push eax
call dword [0x10292480]
add esp, 4
mov byte [edi + 8], bl
mov dword [edi + 0x51c], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [0x1029244c]
add esp, 4
mov byte [edi + 8], bl
mov dword [edi + 0x51c], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101bea80
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, eax
cmp dword [esi + 0x3c], 0
push edi
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
lea ebx, [esi + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
jne 0x101beafb
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
push ecx
push edx
push str.SELECT_sz_FROM__Q._q_docsize_WHERE_id_
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov ecx, eax
add esp, 0xc
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x101beaca
mov dword [ebp - 4], 7
jmp 0x101beafb
mov eax, dword [esi]
inc dword [eax + 0x40]
mov edi, dword [edi]
push 0
push ebx
push 0
push 0x85
push 0xffffffffffffffff
push ecx
push edi
call fcn.101fbc70
mov esi, dword [esi]
dec dword [esi + 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add esp, 0x1c
push eax
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov esi, dword [ebx]
push esi
call sym.SQLite.Interop.dll_sqlite3_reset
mov eax, dword [ebp - 4]
add esp, 4
test eax, eax
jne 0x101beb6c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
lea edi, [eax + 1]
push edi
push esi
call sym.SQLite.Interop.dll_sqlite3_bind_int64
push esi
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 0x14
cmp eax, 0x64
jne 0x101beb56
push 0
push esi
call sym.SQLite.Interop.dll_sqlite3_column_blob
push 0
push esi
mov ebx, eax
call sym.SQLite.Interop.dll_sqlite3_column_bytes
push eax
mov eax, dword [ebp - 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push eax
call fcn.10115e50
add esp, 0x1c
test eax, eax
jne 0x101beb56
xor edi, edi
push esi
call sym.SQLite.Interop.dll_sqlite3_reset
add esp, 4
test edi, edi
je 0x101beb6c
test eax, eax
jne 0x101beb6c
mov eax, 0x10b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101bfe60
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + edi*4 + 0x18], 0
mov dword [ebp - 8], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov dword [ebp - 4], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
jne 0x101bfe9a
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
mov edx, dword [ebp + edi*4 - 8]
push eax
push ecx
push edx
push esi
call fcn.1015cea0
add esp, 0x10
mov dword [esi + edi*4 + 0x18], eax
cmp dword [esi + 0x28], 0
jne 0x101bff62
mov eax, dword [esi + edi*4 + 0x18]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push edi
push ebx
push 1
push eax
mov dword [ebp - 4], eax
call sym.SQLite.Interop.dll_sqlite3_bind_int64
mov eax, dword [ebp - 4]
push eax
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 0x14
cmp eax, 0x65
jne 0x101bfef7
cmp dword [ebp + 8], 0
mov eax, str.__rowid
jne 0x101bfedc
mov eax, str.__parent
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
push ecx
push edx
push edi
push ebx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.10162a90
add esp, 0x1c
jmp 0x101bff4d
cmp eax, 0x64
jne 0x101bff4d
mov eax, dword [ebp - 4]
push 0
push eax
call sym.SQLite.Interop.dll_sqlite3_column_int64
mov ecx, dword [ebp + 0x14]
add esp, 8
mov dword [ebp - 0xc], edx
cmp eax, ecx
jne 0x101bff19
cmp edx, dword [ebp + 0x18]
je 0x101bff4d
cmp dword [ebp + 8], 0
mov dword [ebp + 8], str.__rowid
jne 0x101bff2d
mov dword [ebp + 8], str.__parent
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edi
push ebx
push ecx
push edx
push eax
push edi
push ebx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.10162a90
add esp, 0x2c
mov eax, dword [ebp - 4]
push eax
call sym.SQLite.Interop.dll_sqlite3_reset
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x101bff62
mov dword [esi + 0x28], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101bff70
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
xor ebx, ebx
push edi
cmp dword [esi + 0x28], ebx
jne 0x101c007b
cmp dword [esi + 0x14], ebx
jne 0x101bffa4
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
push str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
push esi
call fcn.1015cea0
add esp, 0x10
mov dword [esi + 0x14], eax
cmp dword [esi + 0x28], ebx
jne 0x101c007b
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x14]
push edx
push eax
push 1
push ecx
call sym.SQLite.Interop.dll_sqlite3_bind_int64
mov edx, dword [esi + 0x14]
push edx
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 0x14
cmp eax, 0x64
jne 0x101c0048
mov eax, dword [esi + 0x14]
push 0
push eax
call sym.SQLite.Interop.dll_sqlite3_column_bytes
mov ecx, dword [esi + 0x14]
push 0
push ecx
mov edi, eax
call sym.SQLite.Interop.dll_sqlite3_column_blob
mov dword [esp + 0x1c], eax
mov eax, edi
cdq
add esp, 0x10
mov ebx, eax
mov dword [esp + 0x14], edx
call sym.SQLite.Interop.dll_sqlite3_initialize
test eax, eax
je 0x101c000d
xor ebx, ebx
mov dword [esi + 0x28], 7
jmp 0x101c0048
mov eax, dword [esp + 0x14]
mov edx, ebx
or edx, eax
je 0x101c0023
push eax
push ebx
call fcn.10145440
add esp, 8
jmp 0x101c0025
xor eax, eax
mov ebx, eax
test eax, eax
jne 0x101c0034
mov dword [esi + 0x28], 7
jmp 0x101c0048
mov ecx, dword [esp + 0xc]
push edi
push ecx
push eax
call fcn.100ffb30
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov dword [edx], edi
mov eax, dword [esi + 0x14]
push eax
call sym.SQLite.Interop.dll_sqlite3_reset
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x101c007b
mov dword [esi + 0x28], eax
test eax, eax
jne 0x101c007b
test ebx, ebx
jne 0x101c007b
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push str.Node__lld_missing_from_database
push esi
call fcn.10162a90
add esp, 0x10
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101fe660
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
mov eax, dword [esi + 0x20]
push ebx
push edi
je 0x101fe6dd
push eax
push str.PRAGMA__Q.page_size
mov dword [ebp + 0xc], 0
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
mov ebx, eax
push edx
mov ecx, ebx
call fcn.101fd2e0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x101fe6c9
movzx ecx, byte [esi + 0x17]
mov eax, dword [ebp + 0xc]
imul ecx, ecx, 0x33
add eax, 0xffffffc0
add ecx, 4
mov dword [esi + 0x10], eax
cmp ecx, eax
jge 0x101fe741
push ebx
mov dword [esi + 0x10], ecx
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov eax, edi
pop edi
pop ebx
pop ecx
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
call sym.SQLite.Interop.dll_sqlite3_errmsg
add esp, 4
push eax
push 0x102759c0
jmp 0x101fe734
mov edx, dword [esi + 0x24]
push edx
push eax
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov ecx, dword [ebp + 8]
mov ebx, eax
add esp, 0xc
lea eax, [esi + 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.101fd2e0
mov edi, eax
add esp, 8
test edi, edi
je 0x101fe71d
mov edx, dword [ebp + 8]
push edx
call sym.SQLite.Interop.dll_sqlite3_errmsg
add esp, 4
push eax
push 0x102759c0
jmp 0x101fe734
cmp dword [esi + 0x10], 0x1c0
jge 0x101fe741
mov edx, dword [esi + 0x24]
push edx
mov edi, 0x10b
push str.undersize_RTree_blobs_in___q_node_
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov ecx, dword [ebp + 0x10]
add esp, 8
mov dword [ecx], eax
push ebx
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov eax, edi
pop edi
pop ebx
pop ecx
pop ebp
ret
Function at 0x10210180
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
sub esp, 0x10
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.sqlite_stat1
push eax
push ecx
xor edi, edi
call sym.SQLite.Interop.dll_sqlite3_table_column_metadata
mov ecx, eax
add esp, 0x24
test ecx, ecx
je 0x102101c9
lea eax, [ecx - 1]
neg eax
sbb eax, eax
mov dword [esi + 0x30], 0x100000
mov dword [esi + 0x34], ebx
and eax, ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
push edx
push eax
push str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esp, 0xc
mov dword [esp + 0x14], eax
test eax, eax
jne 0x102101f1
mov eax, 7
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x80
push 0xffffffffffffffff
push eax
push edx
call fcn.101fbc70
xor ecx, ecx
add esp, 0x1c
mov dword [esp + 0xc], eax
cmp eax, ecx
jne 0x10210263
mov eax, dword [esp + 0x10]
push eax
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 4
cmp eax, 0x64
jne 0x1021023d
mov ecx, dword [esp + 0x10]
push 0
push ecx
call sym.SQLite.Interop.dll_sqlite3_column_int64
add esp, 8
mov edi, eax
mov ebx, edx
mov edx, dword [esp + 0x10]
push edx
call sym.SQLite.Interop.dll_sqlite3_finalize
add esp, 4
mov dword [esp + 0xc], eax
xor ecx, ecx
cmp eax, ecx
jne 0x10210291
mov eax, edi
or eax, ebx
jne 0x10210275
mov dword [esi + 0x30], 0x100000
jmp 0x1021028e
cmp eax, 7
je 0x1021024e
mov dword [esp + 0xc], ecx
mov dword [esi + 0x30], 0x100000
jmp 0x1021028e
cmp ebx, ecx
jl 0x10210286
jg 0x10210280
cmp edi, 0x64
jbe 0x10210286
mov eax, edi
mov ecx, ebx
jmp 0x1021028b
mov eax, 0x64
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov ecx, dword [esp + 0x14]
push ecx
call sym.SQLite.Interop.dll_sqlite3_free
mov eax, dword [esp + 0x10]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10211f90
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
mov edx, dword [ebp + 8]
sub esp, 0xc
push edi
mov edi, dword [esi + 4]
push eax
mov eax, dword [ebx + 4]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
call fcn.101629d0
add esp, 0x14
test eax, eax
je 0x10211fe2
mov ecx, dword [esi + 4]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push edx
push ecx
push eax
push ecx
mov ecx, dword [ebx + 4]
push ecx
push str.SELECT__FROM___w_.__w_____w_.__w__WHERE__s_AND___z_
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov edi, eax
add esp, 0x1c
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x10211fec
mov eax, 7
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0xffffffffffffffff
push edi
push eax
call fcn.101fbc70
add esp, 0x1c
mov dword [ebp - 4], eax
test eax, eax
jne 0x1021204e
mov eax, dword [ebx + 0x2c]
mov edi, dword [ebp - 8]
mov dword [eax], edi
mov ecx, dword [esi + 8]
push edi
mov dword [eax + 4], ecx
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 4
cmp eax, 0x64
jne 0x1021203f
push ebx
push 0x17
mov eax, esi
call fcn.10211820
push edi
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 0xc
cmp eax, 0x64
je 0x10212027
push edi
call sym.SQLite.Interop.dll_sqlite3_finalize
mov edi, dword [ebp - 0xc]
add esp, 4
mov dword [ebp - 4], eax
push edi
call sym.SQLite.Interop.dll_sqlite3_free
mov eax, dword [ebp - 4]
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10212060
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push ebx
push esi
push ecx
push eax
push edx
push eax
mov eax, dword [ebp + 0x10]
push eax
push str.SELECT__FROM___w_.__w__WHERE_NOT_EXISTS____SELECT_1_FROM___w_.__w__WHERE__s_
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x10212090
lea eax, [ebx + 7]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0xffffffffffffffff
push ebx
push eax
call fcn.101fbc70
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x102120f6
mov eax, dword [edi + 0x2c]
mov esi, dword [ebp - 4]
push esi
mov dword [eax], esi
mov dword [eax + 4], 0
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 4
cmp eax, 0x64
jne 0x102120eb
jmp 0x102120d0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edi
push edx
call fcn.10211820
push esi
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 0xc
cmp eax, 0x64
je 0x102120d0
push esi
call sym.SQLite.Interop.dll_sqlite3_finalize
add esp, 4
mov esi, eax
push ebx
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4923db]
shl eax, 2
mov dword [0x4923df], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004717ac
pop edx
call fcn.00471710
call fcn.004717ec
push 0
call fcn.00472a80
pop ecx
push 0x492384
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4923e3], eax
push 0
jmp fcn.00478a58
Function at 0x409418
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x364], 0
jle 0x409535
cmp dword [ebp + 0x10], 0x2800
jle 0x409535
mov edx, 4
mov eax, dword [ebp + 0xc]
call fcn.0045f920
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x30]
mov ecx, 0x14
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, dword [ebp + 0x10]
sar edx, 1
jns 0x409464
adc edx, 0
mov eax, dword [ebp + 0xc]
call fcn.0045f920
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x48]
mov ecx, 0x14
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x364], 1
jne 0x4094d6
push 0x15
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.00471b00
mov ecx, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 0x18]
mov eax, dword [ecx + 0x368]
push eax
push 0x492b82
push edx
call fcn.00474444
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x48]
mov ebx, 0x14
sub ebx, eax
inc eax
mov bl, byte [ebp + ebx - 0x18]
xor bl, byte [edx]
xor bl, byte [ecx]
inc ecx
mov byte [edx], bl
inc edx
cmp eax, 0x14
jl 0x4094bb
jmp 0x409509
mov eax, dword [ebp + 8]
cmp dword [eax + 0x364], 2
jne 0x409509
xor eax, eax
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x48]
mov ebx, 0x14
mov esi, dword [ebp + 8]
sub ebx, eax
inc eax
mov bl, byte [esi + ebx + 0x36c]
xor bl, byte [edx]
xor bl, byte [ecx]
inc ecx
mov byte [edx], bl
inc edx
cmp eax, 0x14
jl 0x4094ea
mov edx, dword [ebp + 0x10]
sar edx, 1
jns 0x409513
adc edx, 0
mov eax, dword [ebp + 0xc]
call fcn.0045f920
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x48]
mov ecx, 0x14
mov ebx, dword [eax]
call dword [ebx + 8]
xor edx, edx
mov eax, dword [ebp + 0xc]
call fcn.0045f920
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40faf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov edx, dword [ebp + 0xc]
mov ecx, eax
inc eax
shl ecx, 2
push ecx
mov cl, 0x64
pop ebx
sub cl, bl
xor byte [edx], cl
inc edx
cmp eax, 0x28
jl 0x40faf9
pop ebx
pop ebp
ret