joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a4c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a7298
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101eff24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x340032
mov dword [ebp - 0x50], 0x330032
mov dword [ebp - 0x4c], 0x450031
mov dword [ebp - 0x48], 0x380043
mov dword [ebp - 0x44], 0x460039
mov dword [ebp - 0x40], 0x420034
mov dword [ebp - 0x3c], 0x460034
mov dword [ebp - 0x38], 0x380037
mov dword [ebp - 0x34], 0x440039
mov dword [ebp - 0x30], 0x410034
mov dword [ebp - 0x2c], 0x450037
mov dword [ebp - 0x28], 0x420033
mov dword [ebp - 0x24], 0x430034
mov dword [ebp - 0x20], 0x360042
mov dword [ebp - 0x1c], 0x450043
mov dword [ebp - 0x18], 0x320039
mov word [ebp - 0x14], ax
call fcn.100349b0
mov ecx, eax
test ecx, ecx
je 0x100a4d4b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000da30
test al, al
jne 0x100a4d2b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a4d10
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10009be0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10158d02
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10008350
int3
Function at 0x100a7250
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a90b3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x101eff24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x100a730b
cmp word [esi], di
je 0x100a730b
test eax, eax
je 0x100a72bc
cmp word [eax], di
je 0x100a72bc
push edi
push edi
push eax
push esi
push edi
call fcn.10168890
push eax
call fcn.100a7840
add esp, 4
call eax
test eax, eax
js 0x100a730b
jmp 0x100a7306
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1016abc0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call fcn.101687e0
push eax
call fcn.100a7840
add esp, 4
call eax
test eax, eax
js 0x100a730b
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100a7382
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x100a736d
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x100a733b
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x100a735c
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x100a73a2
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x100a736d
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100a7382
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10158d02
mov esp, ebp
pop ebp
ret 0x30
call fcn.10079b59
int3
Function at 0x100c1990
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x101eff24]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, 0x4f7a09cd
inc ecx
imul ecx
imul ecx, ecx, 0x9ef4
push ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x7fffff07
push esi
mov esi, dword [ebp + 0x10]
sub ecx, eax
lea ebx, [ecx + 0x7fffff07]
cmovns ebx, ecx
mov eax, ebx
imul ecx, ebx, 0x9ef4
sar eax, 8
mov byte [ebp - 0x13], al
mov eax, ebx
sar eax, 0x10
mov byte [ebp - 0x12], al
mov eax, ebx
sar eax, 0x18
mov byte [ebp - 0x11], al
mov eax, 0x4f7a09cd
imul ebx
mov byte [ebp - 0x14], bl
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x7fffff07
sub ecx, eax
lea ebx, [ecx + 0x7fffff07]
cmovns ebx, ecx
mov eax, ebx
imul ecx, ebx, 0x9ef4
sar eax, 8
mov byte [ebp - 0xf], al
mov eax, ebx
sar eax, 0x10
mov byte [ebp - 0xe], al
mov eax, ebx
sar eax, 0x18
mov byte [ebp - 0xd], al
mov eax, 0x4f7a09cd
imul ebx
mov byte [ebp - 0x10], bl
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x7fffff07
sub ecx, eax
mov eax, 0x4f7a09cd
lea ebx, [ecx + 0x7fffff07]
cmovns ebx, ecx
imul ebx
mov ecx, ebx
mov byte [ebp - 0xc], bl
sar ecx, 8
mov byte [ebp - 0xb], cl
mov ecx, ebx
sar ecx, 0x10
sar edx, 0xe
mov byte [ebp - 0xa], cl
mov eax, edx
shr eax, 0x1f
mov ecx, ebx
add eax, edx
sar ecx, 0x18
mov byte [ebp - 9], cl
imul eax, eax, 0x7fffff07
imul ecx, ebx, 0x9ef4
sub ecx, eax
lea edx, [ecx + 0x7fffff07]
cmovns edx, ecx
mov byte [ebp - 8], dl
mov eax, edx
sar eax, 8
lea ecx, [ebp - 0x54]
mov byte [ebp - 7], al
mov eax, edx
sar eax, 0x10
mov byte [ebp - 6], al
mov eax, 0x80
mov dword [ebp - 0x5c], eax
sar edx, 0x18
shr eax, 3
and eax, 0x3f
mov byte [ebp - 5], dl
movups xmm0, xmmword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x6c], 0x67452301
mov edx, 0x3f
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
sub edx, eax
mov dword [ebp - 0x60], 0x10325476
mov dword [ebp - 0x58], 0
movups xmmword [ebp - 0x54], xmm0
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x100c1b34
push edx
push 0
push ecx
call fcn.1016abc0
lea eax, [ebp - 0x54]
push 0x10
push eax
call fcn.100cac70
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.100c1c00
push 0x38
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.1016abc0
add esp, 0x28
jmp 0x100c1b43
lea eax, [edx - 8]
push eax
push 0
push ecx
call fcn.1016abc0
add esp, 0xc
lea eax, [ebp - 0x54]
push 0xe
push eax
call fcn.100cac70
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.100c1c00
lea eax, [ebp - 0x6c]
push 4
push eax
call fcn.100cac70
movups xmm0, xmmword [ebp - 0x6c]
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
movups xmmword [esi], xmm0
pop esi
pop ebx
call fcn.10158d02
mov esp, ebp
pop ebp
ret
Function at 0x100c3a40
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101eff24]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov edi, dword [ecx + 0x1c]
xor ebx, ebx
sub edi, 6
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edi
test edi, edi
jle 0x100c3a7a
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor esi, esi
test edi, edi
jle 0x100c3ac8
cmp ebx, dword [ecx + 0x1c]
ja 0x100c3c04
cmp esi, edi
jge 0x100c3aac
nop dword [eax]
cmp eax, 4
jge 0x100c3aac
mov edi, dword [ebp - 0x28]
lea edx, [eax + ebx*4]
mov ecx, dword [ebp + esi*4 - 0x24]
inc eax
inc esi
mov dword [edi + edx*4 + 0x20], ecx
mov edi, dword [ebp - 0x2c]
cmp esi, edi
jl 0x100c3a90
cmp eax, 4
lea ecx, [ebx + 1]
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0x28]
cmp esi, edi
jl 0x100c3a80
cmp ebx, dword [ecx + 0x1c]
ja 0x100c3c04
mov esi, 0x101efe70
nop word [eax + eax]
movzx ecx, byte [ebp + edi*4 - 0x27]
mov dl, byte [ebp - 0x24]
xor dl, byte [ecx + str.cw]
mov byte [ebp - 0x24], dl
movzx ecx, byte [ebp + edi*4 - 0x26]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x23], cl
movzx ecx, byte [ebp + edi*4 - 0x25]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x22], cl
movzx ecx, byte [ebp + edi*4 - 0x28]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x21], cl
movzx ecx, byte [esi]
add esi, 4
xor cl, dl
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x24], cl
mov edx, 1
cmp edi, 8
je 0x100c3b50
cmp edi, edx
jle 0x100c3bae
nop word [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, edi
jl 0x100c3b40
jmp 0x100c3bae
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 4
jl 0x100c3b50
movzx ecx, byte [ebp - 0x18]
mov edx, 5
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x14], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x13], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x12], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x11], cl
nop dword [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 8
jl 0x100c3ba0
xor esi, esi
test edi, edi
jle 0x100c3bf5
mov ecx, dword [ebp - 0x28]
cmp ebx, dword [ecx + 0x1c]
ja 0x100c3bf5
cmp esi, edi
jge 0x100c3bdc
cmp eax, 4
jge 0x100c3bdc
mov edi, dword [ebp - 0x28]
lea edx, [eax + ebx*4]
mov ecx, dword [ebp + esi*4 - 0x24]
inc eax
inc esi
mov dword [edi + edx*4 + 0x20], ecx
mov edi, dword [ebp - 0x2c]
cmp esi, edi
jl 0x100c3bc0
cmp eax, 4
lea ecx, [ebx + 1]
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
cmp esi, edi
jl 0x100c3bb4
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x30]
cmp ebx, dword [ecx + 0x1c]
jbe 0x100c3ae0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10158d02
mov esp, ebp
pop ebp
ret
Function at 0x100caad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x44]
test al, al
js 0x100cabbf
push ebx
xor ebx, ebx
push edi
test al, al
jle 0x100cab59
lea ecx, [esi + 0x78]
mov dword [ebp - 4], ecx
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x100cab3e
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.10158ec0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
jmp 0x100cab47
push ecx
call fcn.10120f40
add esp, 4
mov ecx, dword [ebp - 4]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x100caaf1
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x100cabb0
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.10158ec0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [ebp + 8]
add esp, 0x10
pop edi
pop ebx
mov byte [esi + 0x44], 0xff
pop esi
mov esp, ebp
pop ebp
ret
push edx
call fcn.10120f40
add esp, 4
mov byte [esi + 0x44], 0xff
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100cc010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
cmp eax, dword [ebx + 0x30]
jbe 0x100cc04a
push 0x101c584c
push 0x11a98
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.100bced0
add esp, 0x14
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
push ebx
call fcn.100e8070
add esp, 0x14
test eax, eax
jne 0x100cc1ed
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp byte [esi + 1], al
je 0x100cc096
push 0x101c584c
push 0x11a9d
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.100bced0
add esp, 0x14
mov ebx, 0xb
jmp 0x100cc18d
mov byte [esi + 1], 1
xor ecx, ecx
movzx eax, word [esi + 0x18]
movzx edi, byte [esi + 9]
mov edx, eax
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], ecx
cmp cx, ax
jae 0x100cc11d
mov eax, dword [esi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [esi + 0x1a]
movzx edi, cx
and edi, eax
add edi, dword [esi + 0x38]
cmp byte [esi + 8], 0
jne 0x100cc0ee
push dword [ebp + 0x14]
mov eax, dword [edi]
push 1
bswap eax
push eax
push ebx
call fcn.100cc010
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x100cc18d
lea eax, [ebp - 0x20]
push eax
push edi
push esi
call fcn.100cbe80
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x100cc18d
mov ecx, dword [ebp + 0xc]
movzx eax, word [esi + 0x18]
inc ecx
mov ebx, dword [ebp + 8]
mov edx, eax
mov dword [ebp + 0xc], ecx
cmp ecx, eax
jl 0x100cc0b4
mov edi, dword [ebp - 8]
cmp byte [esi + 8], 0
movzx eax, dx
jne 0x100cc146
mov eax, dword [esi + 0x38]
push dword [ebp + 0x14]
push 1
mov eax, dword [eax + edi + 8]
bswap eax
push eax
push ebx
call fcn.100cc010
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x100cc18d
jmp 0x100cc14f
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x100cc14f
add dword [ecx], eax
cmp dword [ebp + 0x10], 0
je 0x100cc168
push dword [esi + 4]
push esi
push dword [esi + 0x34]
call fcn.100d7990
add esp, 0xc
mov ebx, eax
jmp 0x100cc18d
push dword [esi + 0x48]
call fcn.101201f0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x100cc18d
mov eax, dword [esi + 0x38]
movzx eax, byte [eax + edi]
or eax, 8
push eax
push esi
call fcn.10158500
add esp, 8
mov byte [esi + 1], 0
mov edx, dword [esi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x100cc1e0
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.10158ec0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
call fcn.10120f40
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e8bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], 0
cmp byte [ecx + 0x11], 0
je 0x100e8c64
mov esi, dword [ebp + 0xc]
mov edi, ecx
inc esi
lea ebx, [esi - 2]
cmp esi, 2
jae 0x100e8be1
xor edx, edx
jmp 0x100e8c10
mov eax, 0xcccccccd
mul dword [edi + 0x28]
mov eax, ebx
mov ecx, edx
xor edx, edx
shr ecx, 2
inc ecx
div ecx
mov eax, dword [0x101eb1a4]
mov ecx, ebx
sub ecx, edx
xor edx, edx
div dword [edi + 0x24]
xor edx, edx
dec eax
cmp ecx, eax
sete dl
add edx, 2
add edx, ecx
cmp edx, esi
je 0x100e8c23
mov eax, dword [0x101eb1a4]
xor edx, edx
div dword [edi + 0x24]
inc eax
cmp esi, eax
jne 0x100e8c27
inc esi
inc ebx
jmp 0x100e8bd8
cmp esi, dword [edi + 0x30]
mov edi, 0
ja 0x100e8c61
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
push esi
push dword [ebp + 8]
call fcn.100f53c0
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x100e8cc6
cmp byte [ebp - 1], 4
jne 0x100e8c61
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0xc], eax
jne 0x100e8c61
mov dword [ebp - 8], esi
lea ebx, [edi + 0x65]
jmp 0x100e8cc6
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
xor eax, eax
cmp dword [ebp + 0x10], eax
mov edx, 2
mov esi, dword [ebp + 0xc]
cmove eax, edx
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ecx + 0xcc]
push esi
push ecx
call eax
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x100e8cc6
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
cmp esi, dword [edi + 4]
je 0x100e8cba
mov ecx, dword [eax + 4]
cmp esi, 1
mov dword [edi + 0x48], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x34], eax
setne al
dec al
mov dword [edi + 0x38], ecx
and al, 0x64
mov dword [edi + 4], esi
mov byte [edi + 9], al
jmp 0x100e8cbd
mov ecx, dword [edi + 0x38]
mov eax, dword [ecx]
xor ebx, ebx
bswap eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100e8ce8
mov dword [eax], edi
xor eax, eax
cmp ebx, 0x65
pop edi
cmove ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x100e8d4c
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x100e8d43
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.10158ec0
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
xor eax, eax
cmp ebx, 0x65
cmove ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push edx
call fcn.10120f40
add esp, 4
xor eax, eax
cmp ebx, 0x65
pop edi
cmove ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100ecf20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
mov al, byte [esi + 0x44]
test al, al
js 0x100ed00e
mov edx, dword [esi + 0x74]
je 0x100ed080
mov ecx, dword [edx + 0x48]
push ebx
test byte [ecx + 0x1c], 0x20
je 0x100ecf8c
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.10158ec0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x100ecf95
push ecx
call fcn.10120f40
add esp, 4
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
je 0x100ed002
nop
movsx eax, al
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x100ecfef
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.10158ec0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x100ecff8
push ecx
call fcn.10120f40
add esp, 4
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
jne 0x100ecfa0
mov edx, dword [esi + 0x78]
mov dword [esi + 0x74], edx
pop ebx
jmp 0x100ed095
mov ecx, dword [esi + 0x40]
test ecx, ecx
jne 0x100ed021
pop edi
mov byte [esi], 1
mov eax, 0x10
pop esi
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x100ed04a
cmp al, 4
jne 0x100ed032
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebp
ret
push dword [esi + 0x10]
call fcn.100b30f0
mov ecx, dword [esi + 0x40]
add esp, 4
mov dword [esi + 0x10], 0
mov byte [esi], 1
movzx eax, byte [esi + 2]
lea edi, [esi + 0x74]
push eax
mov eax, dword [esi + 8]
push 0
push edi
push ecx
push dword [eax + 4]
call fcn.100e8070
mov ecx, eax
add esp, 0x14
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x100ed074
pop edi
mov byte [esi], 1
pop esi
pop ebp
ret
mov edx, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [edx + 2]
mov byte [esi + 0x45], al
cmp byte [edx], 0
je 0x100ed0eb
movzx eax, byte [edx + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x100ed0eb
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x32], ax
cmp word [edx + 0x18], ax
jbe 0x100ed0b2
mov byte [esi], al
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret
cmp byte [edx + 8], al
jne 0x100ed015
cmp dword [edx + 4], 1
je 0x100ed0cd
push 0x101c584c
push 0x10b1c
jmp 0x100ed0f5
movzx ecx, byte [edx + 9]
mov eax, dword [edx + 0x38]
mov eax, dword [ecx + eax + 8]
bswap eax
push eax
push esi
mov byte [esi], 0
call fcn.100ecc80
add esp, 8
pop edi
pop esi
pop ebp
ret
push 0x101c584c
push 0x10b0f
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.100bced0
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebp
ret
Function at 0x100f8000
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push dword [ebp + 8]
call fcn.1011e220
add esp, 0x18
cmp dword [ebp + 0x10], 0
jne 0x100f803d
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push dword [ebp + 8]
call fcn.1011e220
add esp, 0x10
pop edi
pop ebp
ret

Function at 0x100fa230
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 8], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov dword [ebp - 4], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x100fa26e
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + ebx*4 - 8]
push esi
call fcn.100fa6a0
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x100fa32f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push edi
call fcn.100b5010
push edi
call fcn.100b5da0
add esp, 0x14
cmp eax, 0x65
jne 0x100fa2c2
mov edx, dword [ebp + 0x10]
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [ebp + 0x14]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ecx
push edx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.100fa140
add esp, 0x1c
jmp 0x100fa31d
cmp eax, 0x64
jne 0x100fa31d
push 0
push edi
call fcn.100b62b0
mov ecx, eax
add esp, 8
mov eax, edx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x18]
cmp ecx, edx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
jne 0x100fa2ea
cmp eax, ecx
je 0x100fa31d
push ecx
mov ecx, dword [ebp + 0x14]
test ebx, ebx
push edx
mov edx, dword [ebp + 0x10]
mov eax, str.__rowid
push ecx
push edx
mov dword [ebp + 8], str.__parent
cmove eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push ecx
push edx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.100fa140
add esp, 0x2c
push edi
call fcn.100b67f0
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x100fa32f
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret