joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015d6b0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x1015d6bc
xor al, al
ret 8
jmp fcn.10158420

Function at 0x1015d9d0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x1015d9dc
xor al, al
ret 8
jmp fcn.101594d0

Function at 0x1015db60
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x1015db6c
xor al, al
ret 8
jmp fcn.10159800

Function at 0x1015dba0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x1015dbac
xor al, al
ret 8
jmp fcn.1015a470

Function at 0x1015dbc0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x1015dbcc
xor al, al
ret 8
jmp fcn.1015aa60

Function at 0x1015def0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x1015defc
xor al, al
ret 8
jmp fcn.1015b780

Function at 0x101657b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
mov word [edi + 0x10], 0
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x101657d6
lea ecx, [edi + 0x14]
call fcn.1017bdc0
add dword [edi + 0x18], eax
mov ecx, dword [edi + 0x14]
adc dword [edi + 0x1c], edx
lea eax, [ecx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov word [edi + 0x10], 1
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [edi + 0x14]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi + 0x14]
mov ecx, edi
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.10165830
pop edi
pop ebx
pop ecx
ret
Function at 0x10169960
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10294570
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10314008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi]
add edi, 0x2c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], edi
je 0x101699ab
mov eax, dword [edi]
test eax, eax
je 0x101699ab
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov esi, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp byte [esi + 0x20], 0
mov dword [ebp - 0x18], eax
je 0x101699e1
mov edi, eax
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
sub eax, edi
cmp eax, dword [esi + 0x1c]
ja 0x101699de
cmp byte [esi + 0x20], 0
jne 0x101699c7
mov edi, dword [ebp - 0x14]
push 0x11
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x30]
push str.begin_transaction
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.10004d70
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call fcn.1017c2d0
mov bl, al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.10004cc0
mov byte [esi + 0x20], 1
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10169a52
mov ecx, dword [edi]
test ecx, ecx
je 0x10169a4b
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1025b3e6
mov esp, ebp
pop ebp
ret

Function at 0x1016b510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102949f1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10314008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 7
mov word [ecx + 0x10], ax
mov dword [ebp - 4], eax
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], 7
mov word [ecx + 0x30], ax
mov byte [ebp - 4], 1
mov dword [ecx + 0x58], eax
mov dword [ecx + 0x5c], 7
mov word [ecx + 0x48], ax
mov byte [ebp - 4], 2
mov dword [ecx], 0xffffffff
mov dword [ecx + 4], 0xffffffff
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 0xc], 0xffffffff
mov dword [ecx + 0x28], 2
mov byte [ecx + 0x2c], al
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1016b900
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10294c26
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10314008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.RC::IRefCount.0
mov dword [ebp - 4], 0
mov dword [edi], vtable.DL::IDownloadBlockEvent.0
mov dword [ebp - 4], 1
mov dword [edi + 4], vtable.RC::RCRefCounted.0
mov dword [edi + 8], 0
mov byte [ebp - 4], 2
mov dword [edi], vtable.RC::RCRefCountImpl1_class_DL::IDownloadBlockEvent_.0
mov dword [edi + 4], vtable.RC::RCRefCountImpl1_class_DL::IDownloadBlockEvent_.1.0
mov dword [ebp - 4], 3
mov dword [edi], vtable.DL::RCDownloadTask.0
mov dword [edi + 4], vtable.DL::RCDownloadTask.1.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 3
push 0x18
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.1025b3f7
add esp, 4
mov dword [edi + 0x20], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 4
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 5
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [ebp - 4], 6
push ecx
push 1
push 0
lea ecx, [edi + 0x30]
call fcn.101036f0
mov byte [ebp - 4], 7
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov byte [ebp - 4], 8
lea esi, [edi + 0x60]
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10176230
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x68]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10175f30
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea esi, [edi + 0x70]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10175c30
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea esi, [edi + 0x7c]
mov byte [edi + 0x78], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10175770
mov dword [esi], eax
mov byte [ebp - 4], 0x14
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 2
mov byte [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1016dc30
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x3c
mov eax, dword [0x10314008]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x1016ddd9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetTimer
push eax
call esi
push str.KillTimer
push dword [edi + 0xa0]
mov dword [esp + 0x24], eax
call esi
push str.GetMessageW
push dword [edi + 0xa0]
mov dword [esp + 0x20], eax
call esi
push str.TranslateMessage
push dword [edi + 0xa0]
mov ebp, eax
call esi
push str.DispatchMessageW
push dword [edi + 0xa0]
mov ebx, eax
mov dword [esp + 0x28], ebx
call esi
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
test ecx, ecx
je 0x1016ddd9
cmp dword [esp + 0x18], 0
je 0x1016ddd9
test ebp, ebp
je 0x1016ddd9
test ebx, ebx
je 0x1016ddd9
test eax, eax
je 0x1016ddd9
push 0
push 0xbb8
push 0x465
push 0
call ecx
push 0
push 0
mov esi, eax
mov dword [esp + 0x48], 0
xorps xmm0, xmm0
lea eax, [esp + 0x30]
push 0
push eax
movups xmmword [esp + 0x38], xmm0
movq qword [esp + 0x48], xmm0
call ebp
test eax, eax
je 0x1016dd43
mov eax, dword [esp + 0x2c]
mov bl, 1
mov byte [esp + 0x17], 0
cmp eax, 0x464
jne 0x1016dd5f
mov ecx, edi
xor bl, bl
call fcn.1016f010
test al, al
jne 0x1016dd9b
cmp dword [edi + 0x1c], 0
je 0x1016dd43
cmp byte [edi + 0x14], al
jne 0x1016dd43
push 1
mov ecx, edi
call fcn.10170060
push esi
push 0
call dword [esp + 0x20]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1025b3e6
add esp, 0x3c
ret
mov ecx, dword [esp + 0x30]
cmp eax, 0x113
jne 0x1016dd7d
cmp ecx, esi
jne 0x1016dd7d
mov ecx, edi
xor bl, bl
call fcn.1016f200
test al, al
je 0x1016dd43
jmp 0x1016dd9b
lea edx, [esp + 0x17]
push edx
push ecx
push eax
mov ecx, edi
call fcn.1016ddf0
xor ecx, ecx
movzx ebx, bl
test al, al
cmovne ebx, ecx
cmp byte [esp + 0x17], cl
jne 0x1016dd43
cmp dword [edi + 0x1c], 0
je 0x1016dd43
cmp byte [edi + 0x14], 0
jne 0x1016dd43
test bl, bl
je 0x1016ddbf
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
call ebx
lea eax, [esp + 0x28]
push eax
call dword [esp + 0x28]
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
call ebp
test eax, eax
jne 0x1016dd10
jmp 0x1016dd43
mov ecx, dword [esp + 0x44]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1025b3e6
add esp, 0x3c
ret
Function at 0x1019ef60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1019ef6b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1019efa0
Function at 0x101d8690
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ebp, edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.101a4690
mov esi, eax
add esp, 8
test esi, esi
jne 0x101d86b8
lea eax, [esi + 7]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp byte [0x1031406c], 0
mov edi, dword [esp + 0x14]
je 0x101d8701
mov eax, dword [0x1031415c]
test eax, eax
je 0x101d86dc
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x101d8701
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x101a7810
push 0
push 0
mov dword [esi + 0xc], edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x101d870e
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x101d8726
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebp
pop ebx
ret
Function at 0x101e6a40
Capabilities:
Reference sql statements

Disassembly:
push ebx
push edi
push dword [esp + 0xc]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.101ebbc0
add esp, 0x18
cmp dword [esp + 0xc], 0
jne 0x101e6a7a
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.101ebbc0
add esp, 0x10
pop edi
pop ebx
ret

Function at 0x101ebcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebx, ecx
mov ebp, edx
mov ecx, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x10], ebx
xor esi, esi
cmp dword [ebx + 0x14], esi
jle 0x101ebd6b
nop
mov edi, esi
xor edi, 1
cmp esi, 2
cmovge edi, esi
test ecx, ecx
je 0x101ebd23
mov edx, edi
mov eax, ecx
mov ecx, dword [ebx + 0x10]
add edx, edx
mov ebx, dword [ecx + edx*8]
sub ebx, dword [esp + 0x1c]
nop
movzx edx, byte [eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x101ebd48
test edx, edx
jne 0x101ebd5a
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x10]
add edi, edi
push 0
mov edx, ebp
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.101a9c80
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x101ebdca
jmp 0x101ebd61
movzx ecx, byte [ecx + 0x102abd60]
movzx edx, byte [edx + 0x102abd60]
sub edx, ecx
jne 0x101ebd5d
inc eax
jmp 0x101ebd10
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
inc esi
cmp esi, dword [ebx + 0x14]
jl 0x101ebcf0
mov edx, str.sqlite_master
sub edx, ebp
movzx ecx, byte [ebp]
movzx eax, byte [edx + ebp]
cmp ecx, eax
jne 0x101ebd96
test ecx, ecx
jne 0x101ebda8
mov eax, dword [ebx + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
test ecx, ecx
jne 0x101ebdab
neg eax
sbb eax, eax
jmp 0x101ebdba
movzx eax, byte [eax + 0x102abd60]
movzx ecx, byte [ecx + 0x102abd60]
sub ecx, eax
jne 0x101ebdc8
inc ebp
jmp 0x101ebd72
test eax, eax
je 0x101ebdc8
mov edx, eax
call fcn.101a83f0
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x101ebdc8
mov ebp, str.sqlite_temp_master
jmp 0x101ebce3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x101ec110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, ecx
mov dword [esp + 4], edx
push ebx
push edi
xor ebx, ebx
mov dword [esp + 0x10], eax
xor edi, edi
cmp dword [eax + 0x14], ebx
jle 0x101ec1aa
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov eax, dword [eax + 0x10]
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
shl esi, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x101ec169
mov esi, dword [esi]
mov eax, ebp
sub esi, ebp
movzx edx, byte [eax]
movzx ecx, byte [esi + eax]
cmp edx, ecx
jne 0x101ec195
test edx, edx
jne 0x101ec1a7
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea ecx, [eax + 0x18]
push 0
call fcn.101a9c80
add esp, 4
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x101ec18b
mov eax, dword [esp + 0x18]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x101ec132
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
movzx ecx, byte [ecx + 0x102abd60]
movzx edx, byte [edx + 0x102abd60]
sub edx, ecx
jne 0x101ec181
inc eax
jmp 0x101ec156
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x10248e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push 0x38
xorps xmm0, xmm0
lea eax, [esp + 0x4c]
mov ebp, edx
movlpd qword [esp + 0x2c], xmm0
mov ebx, ecx
mov dword [esp + 0x20], ebp
push 0
movups xmmword [esp + 0x40], xmm0
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x50], 0x13
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x48]
mov edx, ebp
mov ecx, ebx
push eax
push 1
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esp + 0xa0]
call fcn.10236b20
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x1024905e
push dword [esp + 0x3c]
lea eax, [esp + 0x3c]
mov ecx, ebx
push dword [esp + 0x3c]
lea edx, [esp + 0x50]
mov dword [esp + 0x5c], eax
call fcn.10243ff0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1024905e
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.102442b0
mov esi, eax
cmp esi, 0x64
jne 0x1024905e
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
mov edi, dword [esp + 0x78]
lea edx, [esp + 0x20]
mov ebp, dword [esp + 0x7c]
xorps xmm0, xmm0
mov ecx, edi
movlpd qword [esp + 0x20], xmm0
add ebp, edi
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x28], xmm0
call fcn.102322f0
lea esi, [edi + eax]
cmp esi, ebp
jae 0x1024903e
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.102322f0
add esi, eax
cmp esi, ebp
jae 0x1024903a
mov ecx, dword [esp + 0x20]
mov eax, ecx
mov edx, dword [esp + 0x24]
or eax, edx
je 0x10248fe6
cmp ecx, 1
jne 0x10248fa6
test edx, edx
je 0x10248fe6
mov eax, dword [esp + 0x28]
add ecx, 0xfffffffe
adc edx, 0xffffffff
add eax, ecx
mov ecx, dword [esp + 0x70]
adc dword [esp + 0x2c], edx
mov edx, dword [esp + 0x74]
push eax
push dword [esp + 0x34]
mov dword [esp + 0x30], eax
push edi
push ebx
push dword [esp + 0x98]
push dword [esp + 0x30]
call fcn.10248dd0
xor dword [esp + 0x2c], eax
add esp, 0x18
xor dword [esp + 0x10], edx
jmp 0x10249032
xorps xmm0, xmm0
or ecx, edx
movlpd qword [esp + 0x30], xmm0
mov ecx, esi
movlpd qword [esp + 0x28], xmm0
je 0x10249008
lea edx, [esp + 0x30]
call fcn.102322f0
add esi, eax
jmp 0x10249032
lea edx, [esp + 0x20]
call fcn.102322f0
add esi, eax
mov eax, dword [esp + 0x18]
cmp byte [eax + 0xef], 0
je 0x1024902a
sub ebx, dword [esp + 0x20]
sbb edi, dword [esp + 0x24]
jmp 0x10249032
add ebx, dword [esp + 0x20]
adc edi, dword [esp + 0x24]
cmp esi, ebp
jb 0x10248f71
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.102442b0
mov esi, eax
cmp esi, 0x64
je 0x10248f34
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
jmp 0x10249066
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x48]
call fcn.10244a10
mov ecx, dword [esp + 0x8c]
mov edx, edi
pop edi
mov eax, ebp
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x10255210
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, edx
mov dword [esp + 0x10], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov esi, ecx
mov dword [esp + 0x14], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
push edi
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x1025524c
push dword [esi + 8]
push dword [esi + 4]
push dword [esp + ebx*4 + 0x1c]
push esi
call fcn.10255020
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x1025530c
mov ebp, dword [esp + 0x24]
push ebp
push dword [esp + 0x24]
push 1
push edi
call fcn.101cf8c0
push edi
call fcn.101ce4a0
add esp, 0x14
cmp eax, 0x65
jne 0x102552a3
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebp
push ecx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.102550a0
add esp, 0x1c
jmp 0x102552fa
cmp eax, 0x64
jne 0x102552fa
push 0
push edi
call fcn.101cef30
mov ecx, dword [esp + 0x34]
add esp, 8
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x28]
jne 0x102552c5
cmp edx, ecx
je 0x102552fa
push ecx
push dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
test ebx, ebx
push ebp
push ecx
mov eax, str.__rowid
mov dword [esp + 0x20], str.__parent
cmove eax, dword [esp + 0x20]
push eax
push edx
push dword [esp + 0x2c]
push ebp
push ecx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.102550a0
add esp, 0x2c
push edi
call fcn.101cd350
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x1025530c
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0xaa9360
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [ecx]
mov byte [edi], al
mov al, byte [ecx]
push esi
xor esi, esi
test al, al
je 0xaa9387
mov edx, edi
sub edx, ecx
push ebx
mov al, byte [ecx + 1]
mov bl, byte [edx + ecx]
inc esi
inc ecx
dec al
xor al, bl
mov byte [edx + ecx], al
cmp byte [ecx], 0
jne 0xaa9372
pop ebx
mov byte [esi + edi], 0
mov eax, edi
pop esi
ret

Function at 0xaa9390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0x25
call fcn.00aa9070
mov cl, byte [eax]
mov byte [ebx], cl
mov cl, byte [eax]
add esp, 4
xor edi, edi
test cl, cl
je 0xaa93c5
mov esi, ebx
sub esi, eax
mov dl, byte [eax + 1]
mov cl, byte [esi + eax]
inc edi
inc eax
dec dl
xor dl, cl
mov byte [esi + eax], dl
cmp byte [eax], 0
jne 0xaa93b1
mov eax, ebx
mov byte [edi + ebx], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa93d0
sub eax, edx
mov byte [eax + ebx], 0x3a
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa93e2
sub eax, edx
mov byte [eax + ebx], 0x20
mov eax, dword [esp + 0x10]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa93f5
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xaa9401
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9420
sub eax, edx
test ebp, ebp
mov byte [eax + ebx], 0x28
je 0xaa9459
mov eax, ebp
mov edx, ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9435
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xaa9441
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, ebx
pop esi
lea edx, [eax + 1]
pop ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9461
sub eax, edx
mov byte [eax + ebx], 0x29
ret

Function at 0xaa97c0
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [ecx + 0x3c]
movzx eax, word [edx + ecx + 0x14]
add eax, edx
lea eax, [eax + ecx + 0x18]
movzx ecx, word [edx + ecx + 6]
lea ecx, [ecx + ecx*4]
push esi
lea esi, [eax + ecx*8]
cmp eax, esi
jae 0xaa97fe
mov edi, edi
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xaa97ea
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp edx, edi
ja 0xaa97f7
add edx, ecx
cmp edi, edx
jb 0xaa9800
add eax, 0x28
cmp eax, esi
jb 0xaa97e0
xor eax, eax
pop esi
ret
Function at 0xaa9e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
push 0
push 0
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0x400
push ebx
push 0
push 0x1300
call dword [esi + 0x7c]
test eax, eax
je 0xaa9eba
mov ecx, dword [edi + 4]
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov ecx, dword [esp + 0xc]
push 0x10
push edx
push ecx
push 0
call eax
mov edx, dword [esp + 0xc]
push edx
mov edi, eax
call dword [esi + 0x34]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, ebx
mov esi, ecx
nop
xor edx, edx
mov edi, 0x10
div edi
cmp edx, 9
jbe 0xaa9ef3
add dl, 0x57
jmp 0xaa9ef6
add dl, 0x30
mov byte [ecx], dl
inc ecx
test eax, eax
ja 0xaa9ee0
mov byte [ecx], 0
dec ecx
mov dl, byte [esi]
mov al, byte [ecx]
mov byte [ecx], dl
dec ecx
mov byte [esi], al
inc esi
cmp esi, ecx
jb 0xaa9f01
push 0x22
call fcn.00aa9070
mov cl, byte [eax]
mov byte [esp + 0x24], cl
mov cl, byte [eax]
add esp, 4
xor esi, esi
test cl, cl
je 0xaa9f44
lea ecx, [esp + 0x20]
sub ecx, eax
lea ecx, [ecx]
mov dl, byte [eax + 1]
mov bl, byte [ecx + eax]
inc esi
inc eax
dec dl
xor dl, bl
mov byte [ecx + eax], dl
cmp byte [eax], 0
jne 0xaa9f30
lea eax, [esp + 0x20]
mov byte [esp + esi + 0x20], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9f50
sub eax, edx
mov byte [esp + eax + 0x20], 0x28
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9f65
sub eax, edx
mov byte [esp + eax + 0x20], 0x29
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9f80
sub eax, edx
mov bl, 0x20
mov byte [esp + eax + 0x20], bl
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9f96
sub eax, edx
mov byte [esp + eax + 0x20], 0x3d
lea eax, [esp + 0x20]
lea edx, [eax + 1]
jmp 0xaa9fb0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9fb0
sub eax, edx
mov byte [esp + eax + 0x20], bl
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9fc4
sub eax, edx
mov byte [esp + eax + 0x20], 0x30
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9fe0
sub eax, edx
mov byte [esp + eax + 0x20], 0x78
lea eax, [esp + 0x10]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xaa9ff4
lea edi, [esp + 0x20]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xaaa002
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
push 0x10
push edx
lea ecx, [esp + 0x28]
push ecx
push 0
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret