joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001fb90
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1005d014]
xor eax, esp
mov dword [esp + 0x30], eax
cmp dword [0x100932fc], 0x23f0
push ebx
push esi
push edi
mov ebx, ecx
jae 0x1001fbc9
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1002bc85
mov esp, ebp
pop ebp
ret
call fcn.100015c0
mov edi, eax
mov dword [esp + 0x14], 0xaaa1adb3
mov eax, 7
mov dword [esp + 0x18], 0x24550
xor esi, esi
mov dword [esp + 0x1c], 7
mov dword [esp + 0x20], 0
lea edx, [esp + 0x20]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], 6
test eax, eax
je 0x1001fc46
nop
mov eax, dword [edx]
lea ecx, [esp + 0x14]
add ecx, eax
lea edx, [edx + 4]
add eax, 0xfffffffc
inc esi
xor byte [ecx], al
cmp esi, 7
jne 0x1001fc30
mov byte [esp + 0x1b], 1
lea ecx, [esp + 0x14]
mov eax, dword [edi]
push 0
push ecx
mov ecx, edi
call dword [eax + 8]
cmp eax, 1
je 0x1001fbb5
call fcn.100015c0
mov edi, eax
mov dword [esp + 0x14], 0xaaa1adb3
mov eax, 7
mov dword [esp + 0x18], 0x24550
xor esi, esi
mov dword [esp + 0x1c], 7
mov dword [esp + 0x20], 0
lea edx, [esp + 0x20]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], 6
test eax, eax
je 0x1001fcde
mov eax, dword [edx]
lea ecx, [esp + 0x14]
add ecx, eax
lea edx, [edx + 4]
add eax, 0xfffffffc
inc esi
xor byte [ecx], al
cmp esi, 7
jne 0x1001fcc8
mov byte [esp + 0x1b], 1
lea ecx, [esp + 0x14]
mov eax, dword [edi]
push 0
push ecx
mov ecx, edi
call dword [eax + 8]
cmp eax, 2
je 0x1001fbb5
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x1001cfb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [ebx + 0xb94], eax
mov al, 1
pop esi
pop ebx
xor ecx, esp
call fcn.1002bc85
mov esp, ebp
pop ebp
ret

Function at 0x10021020
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push str._n_nbzip2_libbzip2:_internal_error_number__d._n_n
push 2
call fcn.10032395
add esp, 4
push eax
call fcn.10001750
add esp, 0xc
push 3
call fcn.10036e71
int3
Function at 0x100212d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov bl, byte [ecx + 0x34]
push esi
mov esi, dword [ecx + 0x38]
test esi, esi
jle 0x10021303
mov edx, dword [ecx + 0x260]
push edi
movzx edi, bl
mov eax, edx
shl edx, 8
shr eax, 0x18
xor eax, edi
xor edx, dword [eax*4 + 0x10054790]
sub esi, 1
jne 0x100212e6
mov dword [ecx + 0x260], edx
pop edi
mov eax, dword [ecx + 0x34]
mov byte [ecx + eax + 0x58], 1
mov edx, dword [ecx + 0x38]
mov eax, edx
sub eax, 1
je 0x1002135a
sub eax, 1
je 0x10021390
sub eax, 1
je 0x10021369
mov byte [edx + ecx + 0x54], 1
mov edx, dword [ecx + 0x24]
mov eax, dword [ecx + 0x44]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov bl, byte [ecx + 0x38]
sub bl, 4
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
Function at 0x10022870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
test esi, esi
jne 0x1002288f
test ebx, ebx
je 0x100229b8
mov dword [ebx], edx
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp byte [esi + 0x1390], 0
jne 0x100228b3
test ebx, ebx
je 0x100228a2
mov dword [ebx], 0xffffffff
mov dword [esi + 0x13c4], 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
push dword [esi]
call fcn.1003201d
add esp, 4
test eax, eax
je 0x100228dc
test ebx, ebx
je 0x100228cb
mov dword [ebx], 0xfffffffa
mov dword [esi + 0x13c4], 0xfffffffa
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp dword [ebp + 8], 0
jne 0x10022990
cmp dword [esi + 0x13c4], 0
jne 0x10022966
lea eax, [esi + 4]
mov dword [esi + 0x13a8], 0x1388
lea ecx, [esi + 0x1394]
mov dword [esi + 0x13a4], eax
call fcn.10021710
mov dword [ebp + 8], eax
cmp eax, 3
je 0x1002291e
cmp eax, 4
jne 0x100229bf
mov ecx, dword [esi + 0x13a8]
cmp ecx, 0x1388
jae 0x10022961
push dword [esi]
mov edi, 0x1388
lea eax, [esi + 4]
sub edi, ecx
push edi
push 1
push eax
call fcn.10038174
add esp, 0x10
cmp edi, eax
jne 0x100228c1
push dword [esi]
call fcn.1003201d
add esp, 4
test eax, eax
jne 0x100228c1
mov eax, dword [ebp + 8]
cmp eax, 4
jne 0x100228ef
push dword [esi]
call fcn.1003201d
add esp, 4
test eax, eax
jne 0x10022990
push dword [esi]
call fcn.1003bcb9
add esp, 4
push dword [esi]
call fcn.1003201d
add esp, 4
test eax, eax
jne 0x100228c1
test ebx, ebx
je 0x1002299a
mov dword [ebx], 0
lea ecx, [esi + 0x1394]
mov dword [esi + 0x13c4], 0
call fcn.100217b0
push esi
call fcn.1003217f
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
test ebx, ebx
je 0x100229c5
mov dword [ebx], eax
pop edi
mov dword [esi + 0x13c4], eax
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x10022b90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x10022ba5
mov dword [edi], 0
test esi, esi
je 0x10022d5e
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c4], 0
test eax, eax
je 0x10022d5e
cmp byte [esi + 0x1390], 0
je 0x10022be9
test edi, edi
je 0x10022bd5
mov dword [edi], 0xffffffff
mov dword [esi + 0x13c4], 0xffffffff
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
push dword [esi]
mov dword [esi + 0x13a8], 0x40000
mov dword [esi + 0x13a4], eax
call fcn.1003201d
add esp, 4
test eax, eax
jne 0x10022cc3
nop dword [eax + eax]
cmp dword [esi + 0x1398], 0
jne 0x10022c67
mov ebx, dword [esi]
push ebx
call fcn.100321cb
add esp, 4
cmp eax, 0xffffffff
je 0x10022c67
push ebx
push eax
call fcn.1003babb
push dword [esi]
lea eax, [esi + 4]
push 0x1388
push 1
push eax
call fcn.10037df0
push dword [esi]
mov ebx, eax
call fcn.1003201d
add esp, 0x1c
test eax, eax
jne 0x10022cc3
lea eax, [esi + 4]
mov dword [esi + 0x138c], ebx
mov dword [esi + 0x1398], ebx
mov dword [esi + 0x1394], eax
lea ecx, [esi + 0x1394]
call fcn.10022570
test eax, eax
jne 0x10022d20
mov ebx, dword [esi]
push ebx
call fcn.100321cb
add esp, 4
cmp eax, 0xffffffff
je 0x10022c96
push ebx
push eax
call fcn.1003babb
add esp, 8
jmp 0x10022ca8
cmp dword [esi + 0x1398], 0
jne 0x10022ca8
cmp dword [esi + 0x13a8], 0
ja 0x10022ce1
cmp dword [esi + 0x13a8], 0
je 0x10022cff
push dword [esi]
call fcn.1003201d
add esp, 4
test eax, eax
je 0x10022c10
test edi, edi
je 0x10022ccd
mov dword [edi], 0xfffffffa
mov dword [esi + 0x13c4], 0xfffffffa
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
test edi, edi
je 0x10022ceb
mov dword [edi], 0xfffffff9
mov dword [esi + 0x13c4], 0xfffffff9
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
test edi, edi
je 0x10022d09
mov dword [edi], 0
mov dword [esi + 0x13c4], 0
mov eax, 0x40000
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
cmp eax, 4
jne 0x10022d48
test edi, edi
je 0x10022d2b
mov dword [edi], eax
mov eax, 0x40000
mov dword [esi + 0x13c4], 4
sub eax, dword [esi + 0x13a8]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
test edi, edi
je 0x10022d4e
mov dword [edi], eax
mov dword [esi + 0x13c4], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
test edi, edi
je 0x10022d68
mov dword [edi], 0xfffffffe
test esi, esi
je 0x10022d76
mov dword [esi + 0x13c4], 0xfffffffe
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x1003f3b4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003f233

Function at 0x10045abd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004577d
Function at 0x698c54
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x698d63
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6b1e14], 0
je 0x698d4b
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407aa8
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov eax, 0x698d70
mov dword [ebp - 0x30], eax
mov eax, dword [0x6b1e14]
call fcn.0040aaa8
mov dword [ebp - 0x2c], eax
mov eax, dword [0x6b276c]
add eax, 0x11100
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x40]
mov eax, dword [0x6b1e14]
call fcn.004272ec
mov eax, dword [ebp - 0x40]
call fcn.0040aaa8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x698d3a
mov eax, dword [ebp - 4]
test eax, eax
je 0x698d4b
xor edx, edx
push ebp
push 0x698d33
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [0x6b276c]
movzx eax, byte [eax + 0x21101]
mov edx, dword [0x6b276c]
mov byte [edx + 0x21101], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x698d4b
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
call sub.kernel32.dll_GetLastError
mov edx, eax
mov eax, dword [0x6b1e14]
call fcn.00698754
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x698d6a
lea eax, [ebp - 0x40]
call fcn.0040a0ac
pop eax
jmp eax

Function at 0x69ae88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov byte [ebp - 5], 0
xor eax, eax
mov dword [edi], eax
xor eax, eax
mov dword [esi], eax
push ebx
mov eax, dword [ebp - 4]
call fcn.0040aaa8
push eax
push 0
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x69aef0
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x69aef0
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov dword [esi], eax
cmp dword [esi], 0
je 0x69aef0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [edi], eax
cmp dword [edi], 0
setne byte [ebp - 5]
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0xb40980
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xb409ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xb409ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10009f2a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10125170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10004c2c
mov dword [ebp - 0x14], eax
cmp dword [0x1012833c], edi
jne 0x1000a01b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10009fa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1000a0fb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000a0fb
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a0fb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x1012833c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x10128340], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x10128344], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1012834c], eax
test eax, eax
je 0x1000a018
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10128348], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1000a040
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1000a033
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1000a055
push 4
pop eax
jmp 0x1000a0fd
cmp dword [ebp - 0x14], edi
je 0x1000a055
push dword [0x1012833c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1000a03a
mov eax, dword [0x10128348]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1000a0b3
cmp dword [0x1012834c], esi
je 0x1000a0b3
push eax
call ebx
push dword [0x1012834c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1000a0b3
test eax, eax
je 0x1000a0b3
call ecx
test eax, eax
je 0x1000a0a8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1000a0a8
test byte [ebp - 8], 1
jne 0x1000a0b3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1000a0e3
mov eax, dword [0x10128340]
cmp eax, esi
je 0x1000a0e0
push eax
call ebx
test eax, eax
je 0x1000a0e0
call eax
mov edi, eax
test edi, edi
je 0x1000a0e0
mov eax, dword [0x10128344]
cmp eax, esi
je 0x1000a0e0
push eax
call ebx
test eax, eax
je 0x1000a0e0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1012833c]
call ebx
test eax, eax
je 0x1000a0fb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1000a0fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001186
leave
ret
Function at 0x10018510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
cmp esi, 0x80
jge 0x10018538
lea eax, [esi - 0x41]
cmp eax, 0x19
ja 0x100185dc
lea eax, [esi + 0x20]
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0x10000
jge 0x100185ce
push ebx
push edi
mov edi, 0xa2
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx + edi]
cdq
sub eax, edx
sar eax, 1
mov edx, esi
movzx ecx, word [eax*4 + 0x10104390]
sub edx, ecx
js 0x10018574
mov edx, eax
mov dword [ebp - 4], edx
lea ebx, [eax + 1]
jmp 0x1001857a
mov edx, dword [ebp - 4]
lea edi, [eax - 1]
cmp edi, ebx
jge 0x10018554
movzx ecx, word [edx*4 + 0x10104390]
movzx eax, byte [edx*4 + 0x10104393]
add eax, ecx
pop edi
pop ebx
cmp esi, eax
jge 0x100185bc
movzx eax, byte [edx*4 + 0x10104392]
xor ecx, esi
and ecx, eax
test ecx, 1
jne 0x100185bc
shr eax, 1
movzx eax, word [eax*2 + 0x10109858]
add esi, eax
and esi, 0xffff
cmp dword [ebp - 8], 0
je 0x100185dc
mov ecx, esi
call fcn.10018630
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x10400]
cmp eax, 0x27
lea eax, [esi + 0x28]
jbe 0x100185de
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001ac50
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ecx]
lea ebx, [ecx + 0x3c]
mov eax, dword [edi + 0xc]
xor esi, esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
cmp dword [ebx], esi
jne 0x1001acb1
push dword [edi + 8]
push dword [edi + 4]
push str.SELECT_sz_FROM__Q._q_docsize_WHERE_id_
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001ac8c
lea esi, [eax + 7]
jmp 0x1001acb1
mov ecx, dword [edi]
push 0
push ebx
push 0
push 0x81
push 0xffffffffffffffff
mov edx, eax
call fcn.1008e180
add esp, 0x14
mov esi, eax
push dword [ebp - 4]
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
mov edi, dword [ebx]
push edi
call sym.SQLite.Interop.dll_sqlite3_reset
add esp, 4
test esi, esi
jne 0x1001ad23
push dword [ebp + 0xc]
lea ebx, [esi + 1]
push dword [ebp + 8]
push ebx
push edi
call sym.SQLite.Interop.dll_sqlite3_bind_int64
push edi
call sym.SQLite.Interop.dll_sqlite3_step
add esp, 0x14
cmp eax, 0x64
jne 0x1001ad05
push esi
push edi
call sym.SQLite.Interop.dll_sqlite3_column_blob
push 0
push edi
mov esi, eax
call sym.SQLite.Interop.dll_sqlite3_column_bytes
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push eax
push esi
call fcn.1001ad30
add esp, 0x18
neg eax
sbb eax, eax
and ebx, eax
push edi
call sym.SQLite.Interop.dll_sqlite3_reset
add esp, 4
test ebx, ebx
je 0x1001ad25
mov ecx, 0x10b
test eax, eax
cmove eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c9c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
lea eax, [edx + 7]
push edi
xor edi, edi
lea eax, [ecx + eax*4]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ecx + edx*4 + 0x1c], edi
jne 0x1001cb49
mov esi, dword [ecx]
mov dword [ebp - 0x34], str.SELECT__s_FROM__s_T_WHERE_T._Q_____AND_T._Q_____ORDER_BY_T._Q_ASC
mov dword [ebp - 0x30], str.SELECT__s_FROM__s_T_WHERE_T._Q_____AND_T._Q_____ORDER_BY_T._Q_DESC
mov dword [ebp - 0x2c], str.SELECT__s_FROM__s_T_WHERE_T._Q_
mov dword [ebp - 0x28], str.INSERT_INTO__Q._q_content_VALUES__s_
mov dword [ebp - 0x24], str.REPLACE_INTO__Q._q_content_VALUES__s_
mov dword [ebp - 0x20], str.DELETE_FROM__Q._q_content_WHERE_id_
mov dword [ebp - 0x1c], str.REPLACE_INTO__Q._q_docsize_VALUES_____
mov dword [ebp - 0x18], str.DELETE_FROM__Q._q_docsize_WHERE_id_
mov dword [ebp - 0x14], str.SELECT_sz_FROM__Q._q_docsize_WHERE_id_
mov dword [ebp - 0x10], str.REPLACE_INTO__Q._q_config_VALUES_____
mov dword [ebp - 0xc], str.SELECT__s_FROM__s_AS_T
cmp edx, 0xa
ja case.0x1001ca40.5
movzx eax, byte [edx + 0x1001cb7c]
jmp dword [eax*4 + 0x1001cb68]
push dword [esi + 0x24]
push dword [esi + 0x34]
push str.SELECT__s_FROM__s_AS_T
jmp 0x1001caea
mov eax, dword [esi + 0x28]
push eax
push eax
push eax
push dword [esi + 0x24]
push dword [esi + 0x34]
push dword [ebp + edx*4 - 0x34]
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esp, 0x18
jmp 0x1001caf2
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x34]
push str.SELECT__s_FROM__s_T_WHERE_T._Q_
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esp, 0x10
jmp 0x1001caf2
mov ebx, dword [esi + 0xc]
inc ebx
lea eax, [ebx*2 + 1]
push eax
call sym.SQLite.Interop.dll_sqlite3_malloc
mov edi, eax
add esp, 4
test edi, edi
je 0x1001caf8
xor eax, eax
test ebx, ebx
jle 0x1001cabb
lea esp, [esp]
mov word [edi + eax*2], 0x2c3f
inc eax
cmp eax, ebx
jl 0x1001cab0
mov byte [edi + eax*2 - 1], 0
mov eax, dword [ebp - 8]
push edi
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + eax*4 - 0x34]
call sym.SQLite.Interop.dll_sqlite3_mprintf
push edi
mov ebx, eax
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 0x14
jmp 0x1001caf4
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + edx*4 - 0x34]
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x1001caff
mov edi, 7
jmp 0x1001cb49
mov ecx, dword [esi]
push 0
push dword [ebp - 4]
mov edx, ebx
push 0
push 0x81
push 0xffffffffffffffff
call fcn.1008e180
add esp, 0x14
mov edi, eax
push ebx
call sym.SQLite.Interop.dll_sqlite3_free
add esp, 4
test edi, edi
je 0x1001cb49
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1001cb49
push dword [esi]
call sym.SQLite.Interop.dll_sqlite3_errmsg
add esp, 4
push eax
push 0x100fc3c4
call sym.SQLite.Interop.dll_sqlite3_mprintf
add esp, 8
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
push ecx
mov dword [eax], ecx
call sym.SQLite.Interop.dll_sqlite3_reset
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1001eb4c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1001eb01
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.1001eb4c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1001eb01
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.1001eb3c
add dword [0xa580f182], esi
int3
Function at 0x1002aae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
lea esi, [ecx - 1]
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ebx
mov eax, 0xd
test esi, esi
js 0x1002ab18
movzx edx, byte [esi + edx]
lea ecx, [eax*8]
xor edx, ecx
xor eax, edx
dec esi
mov edx, dword [ebp - 4]
jns 0x1002ab00
mov ecx, dword [ebp + 8]
xor edx, edx
div dword [ebx + 0xc]
mov eax, dword [ebx + 0x14]
mov edi, dword [eax + edx*4]
test edi, edi
je 0x1002abd2
jmp 0x1002ab30
mov esi, dword [ebp - 4]
mov eax, ecx
lea ebx, [edi + 0x28]
mov edx, ebx
sub eax, 4
jb 0x1002ab54
nop
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x1002ab59
add edx, 4
add esi, 4
sub eax, 4
jae 0x1002ab40
mov ecx, dword [ebp + 8]
cmp eax, 0xfffffffc
je 0x1002ab8e
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x1002abc5
cmp eax, 0xfffffffd
je 0x1002ab8b
mov cl, byte [edx + 1]
cmp cl, byte [esi + 1]
jne 0x1002abc5
cmp eax, 0xfffffffe
je 0x1002ab8b
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
jne 0x1002abc5
mov ecx, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x1002ab8e
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
jne 0x1002abc8
jmp 0x1002ab8e
mov ecx, dword [ebp + 8]
cmp byte [ebx + ecx], 0
jne 0x1002abc8
test edi, edi
je 0x1002abd2
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.1002b3b0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea ecx, [edx + 1]
add ecx, ebx
mov dword [eax], ecx
mov ecx, dword [edi + 0x10]
mov eax, dword [ebp + 0x10]
sub ecx, edx
sub ecx, 0x29
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov edi, dword [edi]
test edi, edi
jne 0x1002ab30
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
pop esi
mov dword [eax], 0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret