joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4452b0
sub esp, 0x48
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x78]
add ebx, 1
mov edx, dword [edx + 0x54]
mov ebp, dword [ecx + 0x7c]
mov dword [ecx + 0x78], ebx
adc ebp, 0
mov dword [ecx + 0x7c], ebp
mov ebx, edx
nop
mov ebp, dword [edx + 0x950]
nop
cmp ecx, ebp
jne 0x4451e8
mov dword [esp + 0x44], ecx
nop
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.0045058a
mov ecx, dword [esp + 0x44]
mov ebx, dword [ecx + 0x50]
mov ebp, dword [ecx + 0x54]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebp
mov ebx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x78]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebx
mov ecx, dword [edx + 0x954]
cmp ecx, 3
jae 0x4452a9
lea eax, [0xcf4794]
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
mov byte [esp], 0x29
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.004441b0
add esp, 0x48
ret
cmp dword [ecx + 0x80], ebx
jne 0x445239
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov eax, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp], 0x26
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004441b0
jmp 0x4451e4
mov dword [ecx + 0x80], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [ecx + 0x50]
mov edx, dword [ecx + 0x54]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x78]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov byte [esp], 0xe
mov dword [esp + 4], 0xffffffff
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004441b0
jmp 0x4451e4
call fcn.00429960
ud2
call fcn.0044ebf0
jmp fcn.00445110
Function at 0x447fb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44804f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00450587
lea ecx, [0x44e500]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0044ead0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0044ebf0
jmp fcn.00447fb0
Function at 0x4500e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x450120
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xcf4d00]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45015b
je 0x4501aa
cmp ebx, 0x20
jbe 0x4501b0
cmp ebx, 0x40
jbe 0x4501ee
jmp 0x45027f
test ebx, ebx
je 0x4501a0
add eax, 0x10
test ax, 0xff0
je 0x45018c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xa0b560]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xa0b660]
jmp 0x450178
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x450178
pxor xmm1, xmmword [0xcf4d10]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xcf4d10]
pxor xmm2, xmmword [0xcf4d20]
pxor xmm3, xmmword [0xcf4d30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xcf4d10]
pxor xmm2, xmmword [0xcf4d20]
pxor xmm3, xmmword [0xcf4d30]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4502de
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
Function at 0x450fd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x1bc
mov dword [esp], esp
mov dword [esp + 4], 0x1bc
call fcn.00450ab0
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.00450ab0
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4510d0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.00450030
call fcn.0042e6e0
ret

Function at 0x79ec34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [eax], 0
sub esp, 8
push 0
push 0x14
call fcn.0079b9fd
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x79ec65
mov eax, 7
jmp 0x79ed2a
movzx eax, byte [0x889b04]
test al, al
je 0x79ec84
sub esp, 0xc
push 0xc8
call fcn.0079f8e7
add esp, 0x10
test eax, eax
je 0x79ec98
sub esp, 4
push 0x14
push 0
push dword [ebp - 0xc]
call sub.msvcrt.dll_memset
add esp, 0x10
jmp 0x79ecee
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 4
sub esp, 8
push eax
push 0
push dword [ebp - 0xc]
push 0x79ebff
push 0
push 0
mov eax, dword [sym.imp.msvcrt.dll__beginthreadex]
call eax
add esp, 0x20
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x79ecee
sub esp, 4
push 0x14
push 0
push dword [ebp - 0xc]
call sub.msvcrt.dll_memset
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
test eax, eax
jne 0x79ed1d
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
sub esp, 0xc
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
call eax
add esp, 0x10
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret
Function at 0x7a0c56
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
and eax, 0
mov esi, eax
mov eax, dword [ebp - 0x34]
and eax, 0xff000000
mov edi, eax
mov eax, esi
xor ah, 0
mov dword [ebp - 0x40], eax
mov eax, edi
xor ah, 0
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov eax, esi
or eax, edi
test eax, eax
je 0x7a0d05
mov eax, dword [ebp + 8]
add eax, 8
mov edx, dword [ebp - 0x38]
mov byte [eax], dl
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 8
shr edx, 8
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], 7
jmp 0x7a0cf5
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, edx
or ecx, 0xffffff80
mov edx, ecx
mov byte [eax], dl
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 7
shr edx, 7
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
sub dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
jns 0x7a0cc6
mov eax, 9
jmp 0x7a0d94
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x38]
mov esi, eax
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov dword [ebp - 0x1c], edx
mov edx, esi
or edx, 0xffffff80
mov byte [ebp + eax - 0x26], dl
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd eax, edx, 7
shr edx, 7
mov esi, eax
mov edi, edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x38]
xor ah, 0
mov ecx, eax
mov eax, dword [ebp - 0x34]
xor ah, 0
mov ebx, eax
mov eax, ebx
or eax, ecx
test eax, eax
jne 0x7a0d0c
movzx eax, byte [ebp - 0x26]
and eax, 0x7f
mov byte [ebp - 0x26], al
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x18], eax
jmp 0x7a0d8b
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add edx, eax
lea ecx, [ebp - 0x26]
mov eax, dword [ebp - 0x18]
add eax, ecx
movzx eax, byte [eax]
mov byte [edx], al
sub dword [ebp - 0x18], 1
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x18], 0
jns 0x7a0d6e
mov eax, dword [ebp - 0x1c]
add esp, 0x34
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x7ac7ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x88]
test eax, eax
je 0x7ac82c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 0x88], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
sub esp, 4
push 8
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
jmp 0x7ac8cb
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x8c]
movzx eax, ax
add eax, 0x28
mov edx, 0
sub esp, 8
push edx
push eax
call fcn.0079bf6e
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
cmp dword [ebp - 0x1c], 0
jne 0x7ac8a4
mov eax, dword [ebp + 0xc]
sub eax, 1
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x98]
cdq
mov edi, ebx
imul edi, eax
mov esi, edx
imul esi, ecx
add esi, edi
mul ecx
lea ecx, [esi + edx]
mov edx, ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x3c]
push dword [ebp + 0x10]
push edx
push eax
push ecx
call fcn.0079ab3a
add esp, 0x10
mov eax, 7
jmp 0x7ac8f1
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 0x28]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x1c]
mov word [eax + 0x1c], 0x20
mov eax, dword [ebp - 0x1c]
mov word [eax + 0x1e], 1
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x78]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
mov dword [eax + 0x78], edx
mov eax, 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x7e69e6
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
sub esp, 8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.sqlite_master
push dword [ebp + 0xc]
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push dword [ebp + 8]
call fcn.007ebf38
add esp, 0x20
cmp dword [ebp + 0x10], 0
jne 0x7e6a2b
push dword [ebp + 0xc]
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push dword [ebp + 8]
call fcn.007ebf38
add esp, 0x10
nop
leave
ret
Function at 0x8325b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x20]
mov esi, ecx
mov ecx, dword [ebp - 0x14]
lea ebx, [ecx + 1]
mov dword [ebp - 0x14], ebx
mov ebx, esi
or ebx, 0xffffff80
mov byte [ecx], bl
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esi, ecx
mov edi, ebx
shrd esi, edi, 7
shr edi, 7
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 0x20]
xor ch, 0
mov eax, ecx
mov ecx, dword [ebp - 0x1c]
xor ch, 0
mov edx, ecx
mov ecx, edx
or ecx, eax
test ecx, ecx
jne 0x8325de
mov eax, dword [ebp - 0x14]
sub eax, 1
movzx edx, byte [eax]
mov eax, dword [ebp - 0x14]
sub eax, 1
and edx, 0x7f
mov byte [eax], dl
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
sub edx, eax
mov eax, edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x83292f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0
add dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov esi, ecx
mov edi, ebx
shrd esi, edi, 7
shr edi, 7
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov ecx, dword [ebp - 0x28]
xor ch, 0
mov eax, ecx
mov ecx, dword [ebp - 0x24]
xor ch, 0
mov edx, ecx
mov ecx, edx
or ecx, eax
test ecx, ecx
jne 0x83294b
mov eax, dword [ebp - 0x14]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x84cdd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x7f
jg 0x84ce04
cmp dword [ebp + 8], 0x40
jle 0x84cf25
cmp dword [ebp + 8], 0x5a
jg 0x84cf25
mov eax, dword [ebp + 8]
add eax, 0x20
mov dword [ebp - 4], eax
jmp 0x84cf25
cmp dword [ebp + 8], 0xffff
jg 0x84cf0a
mov dword [ebp - 8], 0xa2
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0xffffffff
jmp 0x84ce74
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax*4 + 0xcde020]
movzx eax, ax
mov edx, dword [ebp + 8]
sub edx, eax
mov eax, edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
js 0x84ce6b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x84ce74
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jge 0x84ce28
mov eax, dword [ebp - 0x10]
shl eax, 2
add eax, 0xcde020
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
movzx edx, ax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 3]
movzx eax, al
add eax, edx
cmp dword [ebp + 8], eax
jge 0x84cee9
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 2]
movzx eax, al
and eax, 1
mov edx, eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
movzx eax, ax
xor eax, dword [ebp + 8]
and eax, edx
test eax, eax
jne 0x84cee9
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 2]
shr al, 1
movzx eax, al
movzx eax, word [eax + eax + 0xcde2c0]
movzx edx, ax
mov eax, dword [ebp + 8]
add eax, edx
and eax, 0xffff
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x84cf25
cmp dword [ebp + 0xc], 2
sete al
movzx eax, al
push eax
push dword [ebp - 4]
call fcn.0084cc39
add esp, 8
mov dword [ebp - 4], eax
jmp 0x84cf25
cmp dword [ebp + 8], 0x103ff
jle 0x84cf25
cmp dword [ebp + 8], 0x10427
jg 0x84cf25
mov eax, dword [ebp + 8]
add eax, 0x28
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x852f72
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [ebp - 0x1c], str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push str.sqlite_stat1
push eax
push dword [ebp + 8]
call fcn.00831a68
add esp, 0x30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x852fe7
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x30], 0x100000
mov dword [eax + 0x34], 0
cmp dword [ebp - 0xc], 1
je 0x852fdd
mov eax, dword [ebp - 0xc]
jmp 0x8530ee
mov eax, 0
jmp 0x8530ee
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 4
push edx
push eax
push dword [ebp - 0x1c]
call fcn.0079e81d
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x853018
mov dword [ebp - 0xc], 7
jmp 0x8530eb
sub esp, 0xc
push 0
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.00804a45
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x853079
mov eax, dword [ebp - 0x24]
sub esp, 0xc
push eax
call fcn.007cbaac
add esp, 0x10
cmp eax, 0x64
jne 0x853065
mov eax, dword [ebp - 0x24]
sub esp, 8
push 0
push eax
call fcn.007cc132
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x24]
sub esp, 0xc
push eax
call fcn.007cad31
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0x853086
cmp dword [ebp - 0xc], 7
je 0x853086
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x8530dd
mov eax, dword [ebp - 0x18]
xor ah, 0
mov ebx, eax
mov eax, dword [ebp - 0x14]
xor ah, 0
mov esi, eax
mov eax, esi
or eax, ebx
test eax, eax
jne 0x8530b7
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x30], 0x100000
mov dword [eax + 0x34], 0
jmp 0x8530dd
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
test edx, edx
jg 0x8530d4
test edx, edx
js 0x8530ca
cmp eax, 0x64
jae 0x8530d4
mov eax, 0x64
mov edx, 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
sub esp, 0xc
push dword [ebp - 0x20]
call fcn.0079bbbe
add esp, 0x10
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x85352b
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0x10], 0
je 0x8535ea
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 8
push eax
push str.PRAGMA__Q.page_size
call fcn.0079e81d
add esp, 0x10
mov dword [ebp - 0x10], eax
sub esp, 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.008534ac
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x8535bf
mov eax, dword [ebp - 0x14]
lea edx, [eax - 0x40]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x17]
movzx eax, al
imul eax, eax, 0x33
lea edx, [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
cmp edx, eax
jge 0x853686
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x17]
movzx eax, al
imul eax, eax, 0x33
lea edx, [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], edx
jmp 0x853686
sub esp, 0xc
push dword [ebp + 8]
call fcn.00830574
add esp, 0x10
sub esp, 8
push eax
push 0xcd058c
call fcn.0079e81d
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x853686
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
sub esp, 4
push edx
push eax
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.0079e81d
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, 0x10
sub esp, 4
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.008534ac
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x853654
sub esp, 0xc
push dword [ebp + 8]
call fcn.00830574
add esp, 0x10
sub esp, 8
push eax
push 0xcd058c
call fcn.0079e81d
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x853686
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
cmp eax, 0x1bf
jg 0x853686
mov dword [ebp - 0xc], 0x10b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x24]
sub esp, 8
push eax
push str.undersize_RTree_blobs_in___q_node_
call fcn.0079e81d
add esp, 0x10
mov edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
sub esp, 0xc
push dword [ebp - 0x10]
call fcn.0079bbbe
add esp, 0x10
mov eax, dword [ebp - 0xc]
leave
ret