joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cac60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea ecx, [ebp - 0x20]
push dword [ebp + 8]
call dbg.spec_new_impl
add esp, 4
mov eax, dword [ebp - 0x20]
cmp eax, 0x80000000
jne 0x100caccc
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x38], 1
push eax
push ecx
push 0
push edi
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x100caced
call sub.ws2_32.dll_WSAGetLastError
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x100cad00
mov ecx, dword [0x101c1e08]
mov edx, dword [0x101c1e0c]
test eax, eax
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], 1
je 0x100cad15
mov ecx, dword [ebp - 0x1c]
jmp 0x100cad0b
mov ecx, dword [ebp - 0x10]
movzx eax, word [ebp + 0xc]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x100cad15
mov ecx, edi
mov edx, 1
call sym.___rust_dealloc
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100cad20
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1ac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [eax], 0
test esi, esi
je 0x100cad74
lea edi, [ebp - 0x1b4]
push 0x190
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push 0x202
call sub.ws2_32.dll_WSAStartup
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x100cad88
mov dword [esi], 0x100e6c84
add esp, 0x1ac
pop esi
pop edi
pop ebp
ret
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x101c1d14
call dbg.panic
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0xc]
mov edx, 0x101c3730
push 0x101c2758
push eax
call dbg.assert_failed<i32, i32>
nop word cs:[eax + eax]
nop

Function at 0x100cb1c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
movzx eax, byte [0x1022a138]
mov ebx, edx
mov esi, ecx
mov ecx, 8
mov edx, 4
call sym.___rust_alloc
test eax, eax
je 0x100cb253
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
push 0
push 0x10000
push edi
push dbg.thread_start
push ebx
push 0
call sub.kernel32.dll_CreateThread
test eax, eax
je 0x100cb213
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x100cb24b
mov ebx, dword [edi + 4]
mov ecx, dword [edi]
mov eax, dword [ebx]
mov dword [ebp - 0x10], ecx
push ecx
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x100cb234
mov edx, dword [ebx + 8]
mov ecx, dword [ebp - 0x10]
call sym.___rust_dealloc
mov ecx, edi
mov edx, 4
call sym.___rust_dealloc
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, 4
mov edx, 8
call dbg.handle_alloc_error
ud2
Function at 0x100cb370
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, ecx
xorps xmm0, xmm0
movaps xmmword [esp], xmm0
mov eax, esp
push 0x10
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x100cb3b5
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov dword [esi + 0xc], edi
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov byte [esp + 0x20], 0
mov dword [esp + 0x24], eax
lea edi, [esp + 0x20]
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 0x101c28fc
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], sym.__LT_std..io..error..Error_u20_as_u20_core..fmt..Display_GT_::fmt::hf94c3164284d5fa3
mov dword [esp + 0x34], 1
lea ecx, [esp + 0x28]
mov edx, 0x101c2928
call dbg.panic_fmt
ud2
Function at 0x100cde20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call dbg.inner
add esp, 4
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp ecx, 0x80000000
je 0x100cde6f
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
call dbg.get_long_path
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
cmp ebx, 0x80000000
jne 0x100cde7c
mov eax, dword [ebp - 0x1c]
mov dword [esi + 4], eax
mov dword [esi], edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebp + 0xc]
push edi
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
je 0x100cde92
mov byte [esi], 4
test ebx, ebx
jne 0x100cdea1
jmp 0x100cde74
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x100cde74
mov ecx, edi
mov edx, 2
call sym.___rust_dealloc
jmp 0x100cde74

Function at 0x100ce0d0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x101631f8]
test eax, eax
je 0x100ce1b1
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x100ce100
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x100ce1a6
mov eax, dword [0x101631f8]
test eax, eax
je 0x100ce1c0
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x100ce183
mov esi, eax
test eax, eax
jne 0x100ce164
movzx eax, byte [0x1022a138]
mov ecx, 0x20
mov edx, 8
call sym.___rust_alloc
test eax, eax
je 0x100ce1db
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x101631f8
mov esi, eax
mov eax, dword [0x101631f8]
test eax, eax
je 0x100ce1cf
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x100ce187
movaps xmm0, xmmword [esp]
jmp 0x100ce195
xor esi, esi
jmp 0x100ce1a9
lea ecx, [esp + 0x10]
call dbg.fallback_rng
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x101631f8
call dbg.init
jmp 0x100ce0e8
mov ecx, 0x101631f8
call dbg.init
jmp 0x100ce10e
mov ecx, 0x101631f8
call dbg.init
jmp 0x100ce15d
mov ecx, 8
mov edx, 0x20
call dbg.handle_alloc_error
nop word [eax + eax]
Function at 0x100d68c9
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
and dword [ebp - 0x10], 0
cmp dword [edx + 8], 0
mov esi, edx
mov ebx, ecx
je 0x100d6966
push 0x101c38f2
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x18], ebx
mov ebx, eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov edi, eax
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
push edx
push 0
push 0x30
push edi
push ebx
push eax
call dword [ecx + 0x50]
mov dword [ebp - 0x14], eax
push ebx
mov ebx, dword [ebp - 0x18]
call sub.oleaut32.dll_SysFreeString
push edi
call sub.oleaut32.dll_SysFreeString
cmp dword [ebp - 0x14], 0
js 0x100d6966
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov edi, dword [ebp - 0x10]
call sym.core::ptr::drop_in_place_LT_core..option..Option_LT_sysinfo..windows..component..Instance_GT__GT_::h85a741aaeada15b7
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], edi
movsd xmm1, qword [esi + 8]
mov eax, dword [esi + 0x18]
movsd xmm0, qword [esi]
movsd qword [ebx + 8], xmm1
movsd xmm1, qword [esi + 0x10]
mov dword [ebx + 0x18], eax
movsd qword [ebx], xmm0
movsd qword [ebx + 0x10], xmm1
jmp 0x100d6973
mov ecx, esi
mov dword [ebx], 2
call sym.core::ptr::drop_in_place_LT_sysinfo..windows..component..Connection_GT_::h23fc400cad89ce99
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100d710b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push eax
lea edi, [ebp - 0xc]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [edi], 0
push esi
push eax
push edi
push 0
push edx
push ecx
call sub.ADVAPI32.dll_RegQueryValueExW
add esp, 4
pop esi
pop edi
pop ebp
ret

Function at 0x100d8db3
Capabilities:
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1022a134]
test eax, 0x7fffffff
jne 0x100d8dc6
mov al, 1
pop ebp
ret
pop ebp
jmp dbg.is_zero_slow_path

Function at 0x100dc5cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x100dc5d1
test al, 1
je 0x100dc5e9
test al, 2
jne 0x100dc5fb
xor eax, 3
pop ebp
ret
push 0x23
pop edx
mov ecx, 0x101c52a0
push 0x101c52c4
call dbg.panic
push 0x25
pop edx
mov ecx, str.assertion_failed:__prev.is_complete__
push 0x101c52fc
call dbg.panic

Function at 0x100dd9ea
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push eax
mov bl, byte [ebp + 8]
mov esi, ecx
mov ecx, edx
call sym.tokio::io::poll_evented::PollEvented_LT_E_GT_::get_ref::h09bac0eb7a30bd90
mov eax, dword [eax + 0x10]
movzx ecx, bl
lea edx, [ebp - 0xc]
mov eax, dword [eax]
mov dword [edx], ecx
push 4
push edx
push 1
push 6
push eax
call sub.ws2_32.dll_setsockopt
mov cl, 4
cmp eax, 0xffffffff
jne 0x100dda30
call sub.ws2_32.dll_WSAGetLastError
and word [esi + 1], 0
xor ecx, ecx
mov byte [esi + 3], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 4
pop esi
pop ebx
pop ebp
ret
Function at 0x100ec230
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x100ec290
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x1022a188]
test esi, esi
jle 0x100ec3b0
mov eax, dword [0x1022a18c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x100ec2c4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x100ec347
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x100ec2b0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x100ec3d7
mov eax, dword [0x1022a18c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x1022a18c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x100ec3b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x100ec340
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x100ec350
add dword [0x1022a188], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x1022a18c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x100ec340
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x100ec2ce
mov eax, dword [0x1022a18c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x100ec6f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x1022a198
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [0x1022a190]
sub esp, 4
test ebx, ebx
je 0x100ec745
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x100ec73e
test esi, esi
je 0x100ec73e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x100ec720
mov dword [esp], 0x1022a198
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x100eca80
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x10000000], 0x5a4d
jne 0x100ecaa5
mov ecx, dword [0x1000003c]
cmp dword [ecx + 0x10000000], 0x4550
lea edx, [ecx + 0x10000000]
je 0x100ecab0
ret
cmp word [ecx + 0x10000018], 0x10b
jne 0x100ecaa5
push esi
movzx eax, word [ecx + 0x10000014]
push ebx
movzx esi, word [ecx + 0x10000006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x10000000
test si, si
je 0x100ecaf8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x100ecaee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x100ecafa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x100ecae0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x1010afc8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov byte [eax + 0x10], 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [ebp - 0x20], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [ebp - 0x1c], edx
mov dword [esp + 4], str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [esp], eax
call sym._sqlite3NestedParse
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x1010b02d
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov dword [esp], ebx
call sym._sqlite3NestedParse
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1014eafc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
mov ecx, 6
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
pop ebp
jmp sym._openDatabase

Function at 0x1014ebac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
pop ebp
jmp sym._openDatabase

Function at 0x1015754c
Capabilities:
Create thread

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov byte [eax + 0x38], 1
movzx edi, byte [eax + 0x3b]
mov dword [ebp - 0x1c], ecx
dec edi
cmp esi, edi
jge 0x10157625
movzx eax, byte [ebx + 0x3a]
lea eax, [esi + eax + 1]
cdq
idiv edi
imul eax, edx, 0x48
lea ecx, [ebx + eax + 0x40]
cmp dword [ebx + eax + 0x44], 0
mov dword [ebp - 0x1c], ecx
jne 0x10157598
imul edx, edx, 0x48
cmp dword [ebx + edx + 0x40], 0
je 0x101575af
inc esi
jmp 0x10157567
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
call sym._vdbeSorterJoinThread
mov edx, dword [ebp - 0x20]
test eax, eax
je 0x1015758b
jmp 0x1015763d
mov edx, dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
mov eax, dword [ebp - 0x1c]
lea esi, [ebx + 0x24]
sub edx, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x1c]
sar edx, 3
imul edx, edx, 0x38e38e39
lea edi, [ecx + 0x10]
mov ecx, 3
mov byte [ebx + 0x3a], dl
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x2c], edx
test eax, eax
je 0x101575f2
mov dword [ebx + 0x28], eax
call sym._sqlite3MallocSize
mov dword [ebx + 0x34], eax
jmp 0x10157608
cmp dword [ebx + 0x28], 0
je 0x10157608
mov eax, dword [ebx + 0x34]
cdq
call sym._sqlite3Malloc
mov dword [ebx + 0x28], eax
test eax, eax
je 0x1015761e
mov ecx, dword [ebp - 0x1c]
add esp, 0x1c
mov edx, sym._vdbeSorterFlushThread
pop ebx
pop esi
mov eax, ecx
pop edi
pop ebp
jmp sym._sqlite3ThreadCreate
mov eax, 7
jmp 0x1015763d
jne 0x101575af
imul esi, esi, 0x48
add esp, 0x1c
lea edx, [ebx + 0x24]
lea eax, [ebx + esi + 0x40]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._vdbeSorterListToPMA
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x101617a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 8
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp - 0x10]
mov ecx, esi
mov edx, dword [eax + 8]
lea ebx, [esi + edi]
xor edi, edi
mov dword [ebp - 0x14], ebx
lea esi, [edx + 1]
add edx, dword [eax]
mov bl, byte [ecx]
xor byte [edx], bl
cmp dword [eax + 4], esi
cmovle esi, edi
inc ecx
mov edx, esi
cmp dword [ebp - 0x14], ecx
jne 0x101617c2
mov dword [eax + 8], esi
mov edi, dword [ebp - 0x10]
add dword [eax + 0xc], edi
pop eax
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10001ac8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
add dword [edi + 0x29], edi
mov eax, dword [ebp - 0x10]
mov eax, dword [0x1002adcc]
mov edi, dword [ebp - 8]
mov dx, 8
mov eax, dword [0x1002b088]
mov dword [ebp - 0x14], eax
mov dword [0x1002ae00], edx
mov dword [ebp - 0x14], edx
mov dword [0x1002acec], edi
mov eax, dword [ebp - 8]
mov ecx, dword [0x1002ae74]
lea edi, [ebp - 0x10]
mov dword [ebp - 8], eax
push edi
call sub.USER32.dll_CharNextA
mov eax, dword [0x1002b09c]
mov edi, dword [ebp - 8]
add eax, eax
mov edx, dword [ebp - 0x14]
cmp dword [0x1002b008], 0x2d
jg 0x10001b49
mov dword [0x1002acbc], eax
mov eax, dword [0x1002af64]
mov edi, dword [ebp - 0x14]
and eax, eax
mov edx, dword [ebp - 0x14]
mov edi, dword [0x1002af24]
mov si, 0xca
mov dword [ebp - 0x14], edi
mov dword [0x1002b038], edx
mov dword [ebp - 0x14], edx
mov dword [0x1002ae54], eax
mov edi, dword [ebp - 0x14]
mov dword [0x1002add0], eax
push 0x40
push 0x1000
push 0x19000
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [0x1002b058], eax
adc esi, dword [0x1002ae20]
mov esi, dword [ebp - 8]
add ecx, eax
adc ecx, dword [0x1002adc0]
cmp dword [ebp + 0xc6], eax
jne 0x10001ba5
mov esi, dword [0x1002b068]
xor ecx, dword [ebp - 8]
mov ax, 4
mov eax, dword [ebp - 8]
and edx, edi
mov dword [ebp - 0x14], eax
mov dword [0x1002af34], esi
mov dword [0x1002ae30], eax
mov dword [ebp - 8], eax
invalid

Function at 0x10001df8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x1002acbc]
mov eax, dword [ebp - 8]
sub eax, eax
mov ax, 0xe5
cmp eax, 0

Function at 0x10001e0f
Capabilities:
Accept command line arguments

Disassembly:
jo 0x10001e31
mov esi, dword [ebp - 0xc]
mov ecx, dword [0x1002b070]
mov esi, dword [ebp - 8]
sub ecx, edx
mov esi, dword [0x1002ad84]
mov dword [ebp - 0xc], edx
mov dword [0x1002ad14], edi
xor dword [ebp - 0xc], eax
sub dword [0x1002ad5c], esi
push dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [0x1002affc]
sub eax, eax
push eax
mov eax, dword [ebp - 0xc]
mov eax, 0xc6
push eax
call sub.USER32.dll_DrawIcon
mov edx, dword [0x1002ae74]
mov eax, dword [ebp - 0xc]
sub edx, eax
mov eax, dword [0x1002b0a8]
mov al, 2
adc byte [esi - 0x48], ah
or byte [eax], al
Function at 0x10001e60
Capabilities:
Accept command line arguments

Disassembly:
mov al, 2
adc byte [esi - 0x48], ah
or byte [eax], al
cmp eax, 1
jl 0x10001e97
mov eax, dword [ebp - 0xc]
mov eax, dword [0x1002adbc]
mov edx, dword [ebp - 8]
mov di, 0x80
mov ecx, 8
mov dword [ebp - 8], ecx
mov dword [0x1002b070], edx
mov dword [ebp - 0xc], eax
mov dword [0x1002adb4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
mov dword [0x1002b014], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 8], ecx
push 1
push esi
mov dword [ebp - 8], ecx
mov dword [0x1002af08], eax
push dword [0x1002ae28]
push ecx
call sub.KERNEL32.dll_GetCommandLineW
mov esi, dword [0x1002aec8]
mov eax, dword [ebp - 0xc]
mov edi, 0x40
mov eax, dword [0x1002ace4]
cmp eax, dword [0x1002ae70]
je 0x10001f04
mov dword [0x1002ae44], eax
mov dword [ebp - 0xc], ecx
mov esi, dword [0x1002aea8]
mov esi, dword [ebp - 8]
mov eax, 0x9c
mov eax, dword [0x1002b050]
mov edx, 0x69
mov dword [ebp - 8], eax
mov dword [0x1002ae84], eax
mov dword [0x1002aefc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [0x1002ad64]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002d9a
Capabilities:
Terminate process

Disassembly:
sub eax, edx
mov dword [0x1002b048], ecx
mov dword [0x1002af34], ecx
Function at 0x10002ed3
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1002ad90]
mov dword [0x1002af24], esi
scasd eax, dword es:[edi]
add dl, byte [eax]
mov dword [0x1002b028], esi