joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103b0ec6
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x104d7946
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
xor eax, eax
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
lea edi, [esp + 0x38]
push 6
pop ecx
mov esi, 0x1061d748
mov dword [esp + 0x30], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], al
lea eax, [esp + 0x38]
push 0x18
push eax
mov dword [esp + 0x24], ebx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x3c], 0xf
call fcn.1007a193
xor ebp, ebp
inc ebp
mov dword [esp + 0x64], ebp
lea ecx, [esp + 0x20]
mov esi, dword [esp + 0x34]
cmp esi, 0x10
mov edi, dword [esp + 0x20]
cmovae ecx, edi
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x20]
cmp esi, 0x10
cmovae edx, edi
add eax, edx
cmp eax, ecx
je 0x103b0f78
xor byte [ecx], 0xd8
inc ecx
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x20]
jmp 0x103b0f56
cmp esi, 0x10
lea eax, [esp + 0x20]
push 0xc
cmovae eax, edi
mov ecx, ebx
push eax
call fcn.10079d49
mov dword [esp + 0x18], ebp
mov byte [esp + 0x64], 0
lea ecx, [esp + 0x20]
push 0
push ebp
call fcn.1007a274
mov eax, ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.10436e26
add esp, 0x54
ret 4

Function at 0x103b1bc5
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x104d7946
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1072a790]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
xor eax, eax
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
lea edi, [esp + 0x38]
push 6
pop ecx
mov esi, str.I2A2W2S2_2Q2Z2f2W2_2_2O2
mov dword [esp + 0x30], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], al
lea eax, [esp + 0x38]
push 0x18
push eax
mov dword [esp + 0x24], ebx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x3c], 0xf
call fcn.1007a193
xor ebp, ebp
inc ebp
mov dword [esp + 0x64], ebp
lea ecx, [esp + 0x20]
mov esi, dword [esp + 0x34]
cmp esi, 0x10
mov edi, dword [esp + 0x20]
cmovae ecx, edi
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x20]
cmp esi, 0x10
cmovae edx, edi
add eax, edx
cmp eax, ecx
je 0x103b1c77
xor byte [ecx], 0x32
inc ecx
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x20]
jmp 0x103b1c55
cmp esi, 0x10
lea eax, [esp + 0x20]
push 0xc
cmovae eax, edi
mov ecx, ebx
push eax
call fcn.10079d49
mov dword [esp + 0x18], ebp
mov byte [esp + 0x64], 0
lea ecx, [esp + 0x20]
push 0
push ebp
call fcn.1007a274
mov eax, ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.10436e26
add esp, 0x54
ret 4
Function at 0x103b8570
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x103b859d
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x105eb560]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x103b8580
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x103b8620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
mov ecx, 0x80
mov dword [ebp - 0xc], edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [edi]
jne 0x103b8651
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1077e534]
test eax, eax
je 0x103b865c
call eax
lea eax, [esi*8]
push eax
call fcn.103b4db0
mov ecx, dword [0x1077e538]
add esp, 4
mov ebx, eax
mov dword [ebp - 8], ebx
test ecx, ecx
je 0x103b867d
call ecx
test ebx, ebx
je 0x103b8648
push dword [edi + 0xc]
call fcn.103b50c0
add esp, 4
mov dword [edi + 0xc], ebx
push ebx
call dword [0x1075cc64]
shr eax, 3
add esp, 4
mov dword [ebp - 4], eax
mov dword [edi], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.1043c810
mov ebx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ebx, ebx
je 0x103b870e
mov ecx, dword [ebx + 0x10]
xor edi, edi
mov esi, dword [ebx + 0xc]
test ecx, ecx
jle 0x103b86ed
mov edi, edi
movzx eax, byte [esi]
lea esi, [esi + 1]
dec ecx
movzx edx, byte [eax + 0x105eb560]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test ecx, ecx
jg 0x103b86d0
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov esi, dword [ebx]
div dword [ebp - 4]
mov eax, dword [ebp - 8]
push ebx
lea edx, [eax + edx*8]
call fcn.103b85b0
add esp, 4
mov ebx, esi
test esi, esi
jne 0x103b86c2
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x103c0470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1072a790]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 0x14], ebx
mov edx, dword [esi + 0x3c]
cmp dword [edx], ebx
jne 0x103c04ba
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f7f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
mov ebx, eax
add esp, 0x14
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x103c0597
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x103c04f3
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.1043c760
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
push 5
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], eax
test edi, edi
je 0x103c0595
mov ebx, dword [edi + 0x14]
cmp ebx, dword [esi + 0x18]
ja 0x103c0587
test byte [edi + 0x18], 0x20
jne 0x103c0587
mov eax, dword [esi + 0x80]
lea ecx, [ebx - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.1043c760
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp ebx, 1
jne 0x103c0533
mov ecx, edi
call fcn.103bf760
push dword [ebp - 0x14]
mov eax, dword [esi + 0x3c]
push dword [ebp - 0x18]
mov edx, dword [edi + 4]
push dword [esi + 0x80]
mov ecx, dword [eax]
push edx
push eax
mov dword [ebp - 0xc], edx
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
mov dword [ebp - 0x14], eax
cmp ebx, 1
jne 0x103c0569
mov eax, dword [ebp - 0xc]
movdqu xmm0, xmmword [eax + 0x18]
movdqu xmmword [esi + 0x64], xmm0
cmp ebx, dword [esi + 0x20]
jbe 0x103c0571
mov dword [esi + 0x20], ebx
inc dword [esi + 0xa8]
mov edx, ebx
push dword [edi + 4]
mov ecx, dword [esi + 0x58]
call fcn.103cf170
add esp, 4
mov ebx, dword [ebp - 0x14]
mov edi, dword [edi + 0xc]
test ebx, ebx
je 0x103c04f3
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10436e26
mov esp, ebp
pop ebp
ret
Function at 0x103e97d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ecx
mov ebx, edx
push edi
test edx, edx
je 0x103e97fd
cmp byte [edx], cl
je 0x103e97f5
inc ebx
cmp byte [ebx], cl
jne 0x103e97f0
sub ebx, edx
and ebx, 0x3fffffff
mov edi, dword [esi + 0x14]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], edi
test edi, edi
jle 0x103e98e7
mov edi, eax
cmp eax, 2
jge 0x103e981a
xor edi, 1
mov eax, dword [ebp + 8]
test eax, eax
je 0x103e987f
mov edx, eax
mov ecx, edi
mov eax, dword [esi + 0x10]
add ecx, ecx
mov esi, dword [eax + ecx*8]
mov eax, edx
mov al, byte [eax]
test al, al
je 0x103e985d
jmp 0x103e9840
movzx ecx, byte [esi]
movzx eax, al
mov al, byte [eax + 0x105eb560]
cmp al, byte [ecx + 0x105eb560]
jne 0x103e985d
mov al, byte [edx + 1]
inc edx
inc esi
test al, al
jne 0x103e9840
movzx eax, byte [esi]
movzx ecx, byte [eax + 0x105eb560]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x105eb560]
sub eax, ecx
jne 0x103e98f5
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 4], ecx
cmp dword [ecx + 0xc], 0
je 0x103e98c8
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
jle 0x103e98c0
mov edi, edi
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x105eb560]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x103e98a0
mov ecx, dword [ebp - 4]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x103e98ca
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ebx
call fcn.103b8720
add esp, 8
test eax, eax
je 0x103e98ee
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x103e98f8
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x103e98f8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x14]
jge 0x103e98e5
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
jmp 0x103e9810
Function at 0x103e9a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
push edi
test edx, edx
je 0x103e9a4d
cmp byte [edx], al
je 0x103e9a45
jmp 0x103e9a40
inc ebx
cmp byte [ebx], al
jne 0x103e9a40
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], esi
test esi, esi
jle 0x103e9b29
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], esi
mov eax, edi
cmp edi, 2
jge 0x103e9a70
xor eax, 1
shl eax, 4
cmp dword [ebp + 8], 0
mov ecx, dword [eax + esi + 0xc]
mov dword [ebp - 0x10], ecx
je 0x103e9acb
mov ecx, dword [ebp + 8]
mov edx, ecx
mov esi, dword [eax + esi]
mov al, byte [ecx]
test al, al
je 0x103e9aad
mov edi, edi
movzx ecx, byte [esi]
movzx eax, al
mov al, byte [eax + 0x105eb560]
cmp al, byte [ecx + 0x105eb560]
jne 0x103e9aad
mov al, byte [edx + 1]
inc edx
inc esi
test al, al
jne 0x103e9a90
movzx eax, byte [esi]
movzx ecx, byte [eax + 0x105eb560]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x105eb560]
sub eax, ecx
jne 0x103e9b37
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add ecx, 0x18
mov dword [ebp - 0x10], ecx
cmp dword [ecx + 0xc], 0
je 0x103e9b0c
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
jle 0x103e9b01
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x105eb560]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x103e9ae1
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x103e9b0e
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ebx
call fcn.103b8720
add esp, 8
test eax, eax
je 0x103e9b30
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x103e9b3a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x103e9b3a
mov eax, dword [ebp - 4]
inc edi
mov dword [ebp - 0xc], edi
cmp edi, dword [ebp - 0x14]
jge 0x103e9b29
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
jmp 0x103e9a66
Function at 0x103e9ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], ebx
push edi
test esi, esi
je 0x103ea060
test ebx, ebx
je 0x103e9eed
cmp dword [ebx + 0x1f0], 0
jne 0x103e9efc
mov eax, 0xffff
add word [esi + 0x28], ax
jne 0x103ea060
mov edi, dword [esi + 8]
mov dword [esp + 0x14], edi
test edi, edi
je 0x103ea002
jmp 0x103e9f10
mov eax, dword [edi + 0x14]
mov dword [esp + 0x2c], eax
test ebx, ebx
je 0x103e9f28
cmp dword [ebx + 0x1f0], 0
jne 0x103e9fd9
mov esi, dword [edi]
mov ecx, esi
mov dword [esp + 0x20], esi
test esi, esi
je 0x103e9f4e
cmp byte [esi], 0
je 0x103e9f46
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x103e9f40
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [edi + 0x18]
add eax, 0x18
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov edx, dword [eax]
mov dword [esp + 0x24], edx
test edx, edx
je 0x103e9faf
xor edi, edi
mov dword [esp + 0x1c], esi
mov ebx, ecx
test ecx, ecx
jle 0x103e9f99
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x105eb560]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x103e9f74
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
mov eax, edi
mov edi, dword [esp + 0x14]
xor edx, edx
div dword [esp + 0x24]
mov eax, dword [esp + 0x10]
jmp 0x103e9fb1
xor edx, edx
push edx
mov dword [esp + 0x10], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.103b8720
add esp, 8
test eax, eax
je 0x103e9fd9
push dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, eax
call fcn.103b87d0
add esp, 4
mov edx, dword [edi + 0x10]
mov ecx, ebx
call fcn.103b5160
mov edx, edi
mov ecx, ebx
call fcn.103b5160
mov eax, dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x103e9f10
mov esi, dword [esp + 0x18]
mov edx, esi
mov ecx, ebx
call fcn.103f5460
mov edx, esi
mov ecx, ebx
call fcn.103e9e40
mov edx, dword [esi]
mov ecx, ebx
call fcn.103b5160
mov edx, dword [esi + 0x14]
mov ecx, ebx
call fcn.103b5160
mov esi, dword [esi + 0xc]
test esi, esi
je 0x103ea040
mov edx, esi
mov ecx, ebx
call fcn.103fd870
mov edx, esi
mov ecx, ebx
call fcn.103b5160
mov esi, dword [esp + 0x18]
mov ecx, ebx
mov edx, dword [esi + 0x18]
call fcn.103e2280
mov edx, esi
mov ecx, ebx
call fcn.1040a440
mov edx, esi
mov ecx, ebx
call fcn.103b5160
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x103ebc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1072a790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push esi
mov eax, dword [ebx]
push edi
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
lea esp, [esp]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.103b6920
mov ecx, dword [ebx]
lea edx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
je 0x103ebcc6
lea esp, [esp]
inc edx
cmp byte [edx], 0
jne 0x103ebcc0
lea eax, [ebp - 0x1c]
xor ebx, ebx
sub edx, eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ecx + 0x14]
and edx, 0x3fffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x44], eax
test eax, eax
jle 0x103ebe01
mov edi, ebx
cmp ebx, 2
jge 0x103ebcf1
xor edi, 1
test esi, esi
je 0x103ebd4f
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, esi
mov esi, dword [ecx + edx*8]
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x103ebd2d
lea ebx, [ebx]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x105eb560]
cmp cl, byte [edx + 0x105eb560]
jne 0x103ebd2d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x103ebd10
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x105eb560]
movzx ecx, byte [ecx + 0x105eb560]
sub eax, ecx
jne 0x103ebdc3
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ecx + 0xc], 0
je 0x103ebd9b
xor esi, esi
lea ebx, [ebp - 0x1c]
mov edi, edx
test edx, edx
jle 0x103ebd90
nop
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x105eb560]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x103ebd70
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov eax, esi
xor edx, edx
div dword [ecx]
jmp 0x103ebd9d
xor edx, edx
push edx
push dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.103b8720
add esp, 8
test eax, eax
je 0x103ebdbc
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x103ebde0
jmp 0x103ebdc6
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x103ebdc6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
inc ebx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x44]
jl 0x103ebce7
test eax, eax
je 0x103ebe01
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.103e9720
add esp, 0x18
jmp 0x103ebe04
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 3
jle 0x103ebc90
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10436e26
mov esp, ebp
pop ebp
ret
Function at 0x103ee740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, edx
xor edx, edx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x20], eax
mov esi, dword [eax]
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edx
lea ecx, [ecx]
mov al, byte [edx + 0x105ebe68]
mov byte [ebp - 1], al
test esi, esi
je 0x103ee803
cmp byte [esi], 0
mov ecx, esi
je 0x103ee77e
inc ecx
cmp byte [ecx], 0
jne 0x103ee778
sub ecx, esi
lea eax, [ebx + 0x19c]
and ecx, 0x3fffffff
mov dword [ebp - 0x1c], eax
cmp dword [eax + 0xc], 0
mov dword [ebp - 0x10], ecx
je 0x103ee7da
xor edi, edi
mov dword [ebp - 0xc], esi
mov ebx, ecx
test ecx, ecx
jle 0x103ee7c8
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x105eb560]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x103ee7a5
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov eax, edi
xor edx, edx
div dword [ebx + 0x19c]
mov eax, dword [ebp - 0x1c]
jmp 0x103ee7dc
xor edx, edx
push edx
push ecx
mov edx, esi
mov ecx, eax
call fcn.103b8720
add esp, 8
test eax, eax
je 0x103ee7f9
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
jmp 0x103ee806
mov edx, dword [ebp - 8]
xor ecx, ecx
mov al, byte [ebp - 1]
jmp 0x103ee806
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x103ee816
movzx eax, al
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*4]
add ecx, 0xffffffec
cmp dword [ecx + 0xc], 0
jne 0x103ee835
inc edx
mov dword [ebp - 8], edx
cmp edx, 3
jl 0x103ee760
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x20]
xor eax, eax
movdqu xmm0, xmmword [ecx]
pop edi
pop esi
movdqu xmmword [edx], xmm0
mov dword [edx + 0x10], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x103f4570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], eax
push ebx
push esi
mov eax, dword [eax]
xor esi, esi
push edi
test dword [eax + 0x18], 0x40000
je 0x103f46b2
mov ebx, dword [edx + 0x10]
test ebx, ebx
je 0x103f45d5
lea esp, [esp]
mov edi, dword [ebx + 0x14]
test edi, edi
jle 0x103f45cb
lea edx, [ebx + 0x24]
lea ebx, [ebx]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x103f45bc
or eax, 0xffffffff
jmp 0x103f45c3
mov eax, 1
shl eax, cl
or esi, eax
add edx, 8
dec edi
jne 0x103f45b0
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x103f45a0
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx]
mov edi, ecx
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x103f45f3
cmp byte [ecx], 0
je 0x103f45eb
inc edi
cmp byte [edi], 0
jne 0x103f45e5
sub edi, ecx
and edi, 0x3fffffff
mov eax, dword [edx + 0x40]
xor edx, edx
add eax, 0x38
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
cmp dword [eax + 0xc], edx
je 0x103f463f
mov dword [ebp - 0x10], ecx
mov ebx, edi
test edi, edi
jle 0x103f4634
mov edi, ecx
movzx eax, byte [edi]
lea edi, [edi + 1]
dec ebx
movzx ecx, byte [eax + 0x105eb560]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test ebx, ebx
jg 0x103f4611
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 8]
mov eax, edx
xor edx, edx
div dword [ebx]
mov eax, ebx
push edx
mov edx, ecx
mov ecx, eax
push edi
call fcn.103b8720
add esp, 8
test eax, eax
je 0x103f46b2
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x103f46b2
jmp 0x103f4660
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
push 0
push eax
push ebx
mov dword [ebp - 8], 0
call fcn.103f2d40
mov edx, dword [ebp - 8]
add esp, 0xc
test edx, edx
je 0x103f46ab
movzx edi, word [edx + 0x28]
test edi, edi
jle 0x103f46ab
mov edx, dword [edx + 4]
mov edi, edi
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x103f469c
or eax, 0xffffffff
jmp 0x103f46a3
mov eax, 1
shl eax, cl
or esi, eax
add edx, 4
dec edi
jne 0x103f4690
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x103f4660
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x104316b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x104f0b10
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10436f19
mov dword [esi], vtable.._AV2606_______________________.0
lea ecx, [esi + 0x14]
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.1007a0ff
mov dword [esi], vtable.._AV2594______________.0
mov dword [esi + 0x2c], vtable.._AV2633_____________.0
mov ecx, dword [edi + 0x30]
mov dword [esp + 0x18], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x10431742
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.._AU3498______________________________________________________________.0
mov dword [esi + 0x2c], vtable.._AU3498______________________________________________________________.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x10431780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x104f0f38
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1072a790]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push esi
call fcn.10436f19
mov dword [edi], vtable.._AV2606_______________________.0
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [esp + 0x24], 0
mov byte [ecx], 0
call fcn.1007a0ff
mov dword [edi + 0x2c], vtable.._AV2633_____________.0
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.._AU3498______________________________________________________________.0
mov dword [edi + 0x2c], vtable.._AU3498______________________________________________________________.1.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4