joyce8/EMBER2024-capa huggingface dataset:
Function at 0x631870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
push edi
mov al, byte [esi + 0x44]
test al, al
js 0x63190a
je 0x631972
mov eax, dword [esi + 0x74]
push dword [eax + 0x48]
call fcn.0065dcd0
add esp, 4
dec byte [esi + 0x44]
je 0x6318ff
push ebx
mov edi, edi
movsx eax, byte [esi + 0x44]
mov eax, dword [esi + eax*4 + 0x78]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x6318f0
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.00519690
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x6318f9
push edx
call fcn.0065ec30
add esp, 4
dec byte [esi + 0x44]
jne 0x6318a0
pop ebx
mov eax, dword [esi + 0x78]
mov dword [esi + 0x74], eax
jmp 0x63198e
cmp dword [esi + 0x3c], ebp
jne 0x63191b
pop edi
mov byte [esi], 0
mov eax, 0x10
pop esi
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x63193d
cmp al, 4
jne 0x63192c
mov eax, dword [esi + 0x40]
pop edi
pop esi
pop ebp
ret
push dword [esi + 0x38]
call fcn.006014a0
add esp, 4
mov dword [esi + 0x38], ebp
mov byte [esi], 0
movzx eax, byte [esi + 2]
lea edi, [esi + 0x74]
push eax
mov eax, dword [esi + 8]
push 0
push edi
push dword [esi + 0x3c]
push dword [eax + 4]
call fcn.0062cfc0
mov ebp, eax
add esp, 0x14
test ebp, ebp
je 0x631966
pop edi
mov byte [esi], 0
pop esi
pop ebp
ret
mov eax, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [eax + 2]
mov byte [esi + 0x45], al
mov eax, dword [esi + 0x74]
cmp byte [eax], 0
je 0x6319f9
movzx eax, byte [eax + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x6319f9
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x2a], ax
mov eax, dword [esi + 0x74]
cmp word [eax + 0x16], 0
jbe 0x6319af
pop edi
mov byte [esi], 1
mov eax, ebp
pop esi
pop ebp
ret
cmp byte [eax + 8], 0
jne 0x6319eb
cmp dword [eax + 4], 1
je 0x6319cb
pop edi
pop esi
pop ebp
mov dword [esp + 4], 0xfcde
jmp fcn.00646520
movzx ecx, byte [eax + 9]
mov eax, dword [eax + 0x38]
mov eax, dword [ecx + eax + 8]
bswap eax
push eax
push esi
mov byte [esi], 1
call fcn.00631650
add esp, 8
mov ebp, eax
pop edi
pop esi
pop ebp
ret
pop edi
mov ebp, 0x10
mov byte [esi], 0
pop esi
mov eax, ebp
pop ebp
ret
push 0x6c9afc
push 0xfcd1
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00605420
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebp
ret
Function at 0x633eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebx
push edi
mov edi, dword [esp + 0x20]
mov ebx, dword [edi + 8]
mov edx, dword [edi]
mov dword [esp + 0xc], edx
test ebx, ebx
jne 0x633eec
cmp dword [edi + 0x78], ebx
jne 0x633ed5
test byte [edx + 0x44], 8
jne 0x633ed5
mov byte [edi + 0x17], 1
push edi
call fcn.0066c560
mov edx, dword [esp + 0x10]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x634012
mov eax, dword [esp + 0x24]
shl eax, 4
add eax, dword [edx + 0x10]
push esi
mov dword [esp + 0xc], eax
xor esi, esi
push ebp
mov edi, edi
push dword [eax]
mov ebp, dword [esi*8 + 0x6c2cd4]
push ebp
push edx
call fcn.0064ed50
add esp, 0xc
test eax, eax
jne 0x633f46
mov eax, dword [esi*8 + 0x6c2cd8]
test eax, eax
je 0x633f9d
push eax
mov eax, dword [esp + 0x14]
push ebp
push dword [eax]
push str.CREATE_TABLE__Q._s__s_
push edi
call fcn.0065b780
mov eax, dword [edi + 0x64]
add esp, 0x14
mov dword [esp + esi*4 + 0x18], eax
mov byte [esp + esi + 0x28], 0x10
jmp 0x633f9d
mov eax, dword [eax + 0x1c]
push ebp
push 1
push eax
push dword [esp + 0x38]
mov dword [esp + esi*4 + 0x28], eax
push edi
mov byte [esp + esi + 0x3c], 0
call fcn.00667af0
mov eax, dword [esp + 0x48]
add esp, 0x14
test eax, eax
je 0x633f87
push eax
push dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
push ebp
push dword [eax]
push str.DELETE_FROM__Q._s_WHERE__s_Q
push edi
call fcn.0065b780
add esp, 0x18
jmp 0x633f9d
push dword [esp + 0x2c]
push dword [esp + esi*4 + 0x1c]
push 0x85
push ebx
call fcn.0066bba0
add esp, 0x10
mov eax, dword [esp + 0x10]
inc esi
mov edx, dword [esp + 0x14]
cmp esi, 3
jl 0x633f00
cmp dword [str.tbl_idx_stat], 0
je 0x634010
mov eax, dword [esp + 0x30]
lea esi, [esp + 0x28]
mov ecx, esi
lea ebp, [esp + 0x18]
sub eax, ecx
mov edi, 0x6c2cd8
mov dword [esp + 0x30], eax
push 3
push dword [esp + 0x30]
add eax, esi
push dword [ebp]
push eax
push 0x69
push ebx
call fcn.0066bd50
mov eax, dword [ebx + 0x88]
add esp, 0x18
test eax, eax
jle 0x634000
movzx edx, byte [esi]
lea ecx, [eax + eax*4]
mov eax, dword [ebx + 0x58]
mov word [eax + ecx*4 - 0x12], dx
mov eax, dword [esp + 0x30]
add edi, 8
add ebp, 4
inc esi
cmp dword [edi], 0
jne 0x633fd1
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x6347d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x634803
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x634877
movzx edi, word [ebx + 0x8c]
add edi, 0x28
push 0
push edi
call fcn.0065af30
mov esi, eax
add esp, 8
test esi, esi
je 0x63482a
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [esp + 0x1c]
mov dword [ecx], esi
test esi, esi
jne 0x634867
push dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [ebx + 0x98]
dec ecx
mov esi, dword [ebx + 0x3c]
push 0
cdq
push ecx
mov edi, dword [esi]
push edx
push eax
call fcn.00519690
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, 7
pop edi
pop esi
pop ebx
ret
lea eax, [esi + 0x28]
mov dword [esi + 0x1c], 0x10020
mov dword [esi + 8], eax
mov dword [esi + 0x14], ebx
mov eax, dword [esp + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 4], eax
xor eax, eax
inc dword [ebx + 0x78]
pop edi
pop esi
pop ebx
ret
Function at 0x63a640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
test eax, eax
jne 0x63a677
cmp dword [ebx + 0x78], eax
jne 0x63a662
mov eax, dword [ebx]
test byte [eax + 0x44], 8
jne 0x63a662
mov byte [ebx + 0x17], 1
push ebx
call fcn.0066c560
add esp, 4
mov dword [esp + 4], eax
test eax, eax
je 0x63a776
mov eax, dword [ebx]
push ebp
push edi
mov edi, dword [esp + 0x18]
mov ebp, 0xfff0bdc0
mov dword [esp + 0x14], ebp
mov ecx, dword [edi + 0x48]
test ecx, ecx
je 0x63a6b2
mov edx, dword [eax + 0x14]
xor ebp, ebp
mov dword [esp + 0x14], ebp
test edx, edx
jle 0x63a6b2
mov eax, dword [eax + 0x10]
add eax, 0xc
cmp dword [eax], ecx
je 0x63a6ae
inc ebp
add eax, 0x10
cmp ebp, edx
jl 0x63a6a2
mov dword [esp + 0x14], ebp
push esi
push edi
push ebx
call fcn.00668080
mov esi, eax
add esp, 8
test esi, esi
je 0x63a722
mov ebp, dword [esp + 0x10]
jmp 0x63a6d0
mov edx, dword [esi + 0x14]
mov ecx, 0xfff0bdc0
mov eax, dword [ebx]
test edx, edx
je 0x63a6fc
mov edi, dword [eax + 0x14]
xor ecx, ecx
test edi, edi
jle 0x63a6fc
mov eax, dword [eax + 0x10]
add eax, 0xc
lea ecx, [ecx]
cmp dword [eax], edx
je 0x63a6fc
inc ecx
add eax, 0x10
cmp ecx, edi
jl 0x63a6f0
push 0
push dword [esi]
push 0
push 0
push ecx
push 0x8d
push ebp
call fcn.0066bc70
mov esi, dword [esi + 0x20]
add esp, 0x1c
test esi, esi
jne 0x63a6d0
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
push 0
push dword [edi]
push 0
push 0
push ebp
push 0x8b
push esi
call fcn.0066bc70
push dword [esp + 0x3c]
push str.tbl_name_Q
push dword [ebx]
call fcn.0065af10
add esp, 0x28
test eax, eax
je 0x63a773
push eax
push ebp
push esi
call fcn.0066bea0
push edi
push ebx
call fcn.0068a530
add esp, 0x14
test eax, eax
je 0x63a773
push eax
push 1
push esi
call fcn.0066bea0
add esp, 0xc
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6421f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push esi
xor ebp, ebp
mov dword [esp + 0x10], ebx
call fcn.00631870
add esp, 4
cmp eax, 0x10
jne 0x64221e
mov eax, dword [esp + 0x18]
pop esi
pop ebp
mov dword [eax], ebx
mov dword [eax + 4], ebx
xor eax, eax
pop ebx
pop ecx
ret
push edi
test eax, eax
jne 0x64234d
mov edi, dword [esi + 0x74]
mov cl, byte [edi + 8]
test cl, cl
jne 0x642236
cmp byte [edi + 2], cl
jne 0x642243
movzx eax, word [edi + 0x16]
cdq
add ebp, eax
adc ebx, edx
mov dword [esp + 0x10], ebx
test cl, cl
je 0x6422ea
jmp 0x642250
mov cl, byte [esi + 0x44]
test cl, cl
je 0x642337
and byte [esi + 1], 0xf9
xor eax, eax
mov word [esi + 0x2a], ax
movsx eax, cl
dec cl
mov ax, word [esi + eax*2 + 0x46]
mov word [esi + 0x46], ax
movsx eax, cl
mov byte [esi + 0x44], cl
mov eax, dword [esi + eax*4 + 0x78]
mov dword [esi + 0x74], eax
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x6422c8
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.00519690
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x6422d1
push edx
call fcn.0065ec30
add esp, 4
mov edi, dword [esi + 0x74]
mov ax, word [esi + 0x46]
cmp ax, word [edi + 0x16]
jae 0x642250
inc word [esi + 0x46]
mov ebx, dword [esp + 0x10]
movzx ecx, word [esi + 0x46]
movzx eax, word [edi + 0x16]
cmp ecx, eax
jne 0x642303
movzx ecx, byte [edi + 9]
mov eax, dword [edi + 0x38]
mov eax, dword [ecx + eax + 8]
jmp 0x64231d
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x18]
movzx ecx, cx
and ecx, eax
mov eax, dword [edi + 0x38]
mov eax, dword [ecx + eax]
bswap eax
push eax
push esi
call fcn.00631650
add esp, 8
test eax, eax
je 0x642227
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push esi
mov dword [eax], ebp
mov dword [eax + 4], ecx
call fcn.00631870
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x644e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x28
mov ecx, dword [esp + 0x30]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3c]
add ecx, ecx
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov esi, dword [eax + ecx*8]
mov eax, 1
mov dword [esp + 0x40], esi
mov dword [esp + 0x18], eax
push eax
push str.sqlite_stat_d
lea eax, [esp + 0x28]
push eax
push 0x18
call fcn.00600f20
mov ecx, dword [edi]
lea ebx, [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x14], ecx
xor edi, edi
mov dword [esp + 0x10], ebx
cmp dword [ecx + 0x14], edi
jle 0x644eeb
mov ebp, edi
cmp edi, 2
jge 0x644e7a
xor ebp, 1
test esi, esi
je 0x644f5a
mov ecx, dword [ecx + 0x10]
mov edx, ebp
mov bl, byte [esi]
add edx, edx
mov eax, esi
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x6c13b0]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x6c13b0]
sub esi, ecx
jne 0x644ed9
sub edx, dword [esp + 0x40]
mov dword [esp + 0x1c], edx
test bl, bl
je 0x644f4a
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x6c13b0]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x6c13b0]
sub esi, edx
mov edx, dword [esp + 0x1c]
je 0x644eb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc edi
mov esi, dword [esp + 0x40]
cmp edi, dword [ecx + 0x14]
jl 0x644e70
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x6c13b0]
sub eax, 0x73
jne 0x644f28
mov esi, str.sqlite_master
sub esi, ebx
test dl, dl
je 0x644f9f
movzx eax, byte [esi + ebx + 1]
inc ebx
movzx ecx, byte [eax + 0x6c13b0]
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x6c13b0]
sub eax, ecx
je 0x644f03
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x40]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 4
jle 0x644e46
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
test esi, esi
jne 0x644ed9
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x10]
add ebp, ebp
push 0
push ebx
mov eax, dword [eax + ebp*8 + 0xc]
add eax, 8
push eax
call fcn.006198b0
add esp, 0xc
mov eax, dword [eax + 8]
test eax, eax
je 0x644edd
push dword [esp + 0x48]
mov edi, dword [esp + 0x40]
lea eax, [esp + 0x24]
push dword [esp + 0x48]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push edi
call fcn.0065b780
add esp, 0x18
jmp 0x644f2c
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x40]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 0x10]
test esi, esi
jne 0x644fb7
neg edx
sbb edx, edx
jmp 0x645009
test edx, edx
je 0x644f28
movzx eax, byte [edx]
mov edi, esi
movzx ecx, byte [eax + 0x6c13b0]
mov bl, byte [edi]
movzx eax, bl
movzx eax, byte [eax + 0x6c13b0]
sub eax, ecx
jne 0x645001
sub edx, edi
lea ecx, [ecx]
test bl, bl
je 0x645001
movzx eax, byte [edx + esi + 1]
inc esi
movzx ecx, byte [eax + 0x6c13b0]
mov bl, byte [esi]
movzx eax, bl
movzx eax, byte [eax + 0x6c13b0]
sub eax, ecx
je 0x644fe0
mov ecx, dword [esp + 0x14]
mov edx, eax
mov esi, edi
test edx, edx
jne 0x644f28
mov ebx, str.sqlite_temp_master
jmp 0x644e65
Function at 0x64ec90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push edi
xor edi, edi
xor ebp, ebp
cmp dword [eax + 0x14], edi
jle 0x64ed40
push ebx
push esi
mov ecx, edi
cmp edi, 2
jge 0x64ecb0
xor ecx, 1
mov eax, dword [eax + 0x10]
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
test edx, edx
je 0x64ed0d
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x6c13b0]
movzx ecx, al
movzx ecx, byte [ecx + 0x6c13b0]
sub ecx, edx
jne 0x64ed2a
sub ebx, esi
test al, al
je 0x64ed09
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x6c13b0]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x6c13b0]
sub ecx, edx
je 0x64ece6
jmp 0x64ed2a
test ecx, ecx
jne 0x64ed2a
mov eax, dword [esp + 0x10]
push 0
push dword [esp + 0x20]
add eax, 0x18
push eax
call fcn.006198b0
add esp, 0xc
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x64ed38
mov eax, dword [esp + 0x18]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x64eca6
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
pop ecx
ret
pop edi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x64ed50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
lea ecx, [ecx]
xor edi, edi
cmp dword [ebp + 0x14], edi
jle 0x64ee1a
jmp 0x64ed70
mov ebp, edi
cmp edi, 2
jge 0x64ed7a
xor ebp, 1
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x64ede1
mov ecx, dword [esp + 0x18]
mov edx, ebp
add edx, edx
mov eax, ebx
mov bl, byte [ebx]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x6c13b0]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x6c13b0]
sub esi, ecx
jne 0x64ee08
sub edx, eax
mov dword [esp + 0x10], edx
test bl, bl
je 0x64edd9
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x6c13b0]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x6c13b0]
sub esi, edx
mov edx, dword [esp + 0x10]
je 0x64edb2
jmp 0x64ee08
test esi, esi
jne 0x64ee08
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add ebp, ebp
push 0
push ecx
mov eax, dword [eax + 0x10]
mov eax, dword [eax + ebp*8 + 0xc]
add eax, 8
push eax
call fcn.006198b0
add esp, 0xc
mov eax, dword [eax + 8]
test eax, eax
jne 0x64eece
mov ebp, dword [esp + 0x18]
inc edi
mov ecx, dword [esp + 0x1c]
cmp edi, dword [ebp + 0x14]
jl 0x64ed70
mov dl, byte [ecx]
movzx eax, dl
movzx eax, byte [eax + 0x6c13b0]
sub eax, 0x73
jne 0x64eecc
mov esi, str.sqlite_master
sub esi, ecx
test dl, dl
je 0x64ee61
movzx eax, byte [esi + ecx + 1]
inc ecx
mov dword [esp + 0x1c], ecx
mov dl, byte [ecx]
movzx ecx, byte [eax + 0x6c13b0]
movzx eax, dl
movzx eax, byte [eax + 0x6c13b0]
sub eax, ecx
jne 0x64eecc
mov ecx, dword [esp + 0x1c]
jmp 0x64ee36
mov eax, dword [ebp + 0x10]
mov edi, dword [esp + 0x20]
mov edx, dword [eax + 0x10]
test edi, edi
jne 0x64ee75
neg edx
sbb edx, edx
jmp 0x64eeba
test edx, edx
je 0x64eecc
movzx eax, byte [edx]
mov esi, edi
mov bl, byte [edi]
movzx ecx, byte [eax + 0x6c13b0]
movzx eax, bl
movzx eax, byte [eax + 0x6c13b0]
sub eax, ecx
jne 0x64eeb8
sub edx, edi
test bl, bl
je 0x64eeb8
movzx eax, byte [edx + esi + 1]
inc esi
movzx ecx, byte [eax + 0x6c13b0]
mov bl, byte [esi]
movzx eax, bl
movzx eax, byte [eax + 0x6c13b0]
sub eax, ecx
je 0x64ee97
mov edx, eax
test edx, edx
jne 0x64eecc
mov ecx, str.sqlite_temp_master
mov dword [esp + 0x1c], ecx
jmp 0x64ed60
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x667c00
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov dword [edi], 0
cmp dword [0xb26600], 0
je 0x667c53
mov eax, dword [0xb2e130]
test eax, eax
je 0x667c28
push eax
call dword [0xb2665c]
add esp, 4
lea eax, [esp + 0xc]
push eax
push 0x14
call fcn.00631070
mov eax, dword [0xb2e130]
add esp, 8
test eax, eax
je 0x667c4d
push eax
call dword [0xb26664]
mov esi, dword [esp + 0x10]
jmp 0x667c5d
mov esi, dword [esp + 0xc]
jmp 0x667c60
push 0x14
call dword [0xb2662c]
mov esi, eax
add esp, 4
test esi, esi
jne 0x667c6a
pop edi
lea eax, [esi + 7]
pop esi
ret
cmp dword [0xb26604], 0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
je 0x667cb9
mov eax, dword [0xb26704]
test eax, eax
je 0x667c94
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x667cb9
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x667d50
push 0
push 0
mov dword [esi + 0xc], ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x667cc9
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x667ce1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop ebp
pop ebx
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
ret
Function at 0x673480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
push esi
push edi
push ebx
call fcn.0062d130
mov edi, dword [ebx + 0x20]
xor eax, eax
movzx ecx, word [ebx + 0x28]
xor ebp, ebp
mov esi, dword [ebx + 0x24]
add esp, 4
mov word [esp + 0x18], ax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 0x74]
mov dword [esp + 0x28], ebp
mov eax, dword [eax + 0x3c]
sub eax, edi
cmp ecx, eax
jle 0x6734c9
xor ecx, ecx
test eax, eax
sets cl
dec ecx
and ecx, eax
cmp esi, ecx
ja 0x6734e1
mov eax, 0x1010
mov dword [esp + 0x20], edi
mov word [esp + 0x18], ax
mov dword [esp + 0x1c], esi
jmp 0x673506
lea eax, [esp + 0x10]
push eax
push esi
push 0
push ebx
call fcn.00680c80
add esp, 0x10
test eax, eax
jne 0x6735e0
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov al, byte [edi]
cmp al, 0x80
jae 0x673511
movzx ebx, al
jmp 0x673523
lea eax, [esp + 0x68]
push eax
push edi
call fcn.006576d0
mov ebx, dword [esp + 0x70]
add esp, 8
cmp ebx, 3
jb 0x6735a2
cmp ebx, esi
jg 0x6735a2
lea eax, [edi - 1]
add eax, ebx
mov cl, byte [eax]
cmp cl, 0x80
jae 0x67353d
movzx ecx, cl
jmp 0x67354f
lea ecx, [esp + 0x68]
push ecx
push eax
call fcn.006576d0
mov ecx, dword [esp + 0x70]
add esp, 8
lea eax, [ecx - 1]
cmp eax, 8
ja 0x6735a2
cmp ecx, 7
je 0x6735a2
movzx edx, byte [ecx + 0x6c0e48]
lea eax, [edx + ebx]
cmp esi, eax
jb 0x6735a2
lea eax, [esp + 0x38]
sub esi, edx
push eax
push ecx
add esi, edi
push esi
call fcn.006759c0
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x44]
mov dword [ecx], eax
mov eax, dword [esp + 0x48]
mov dword [ecx + 4], eax
lea eax, [esp + 0x1c]
push eax
call fcn.00674540
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
test dword [esp + 0x18], 0x2460
jne 0x6735b0
test ebp, ebp
je 0x6735bd
lea eax, [esp + 0x10]
push eax
call fcn.00680b60
add esp, 4
push 0x6c9afc
push 0x12b7e
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.00605420
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x684c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov ecx, 0xc
push ebx
mov ebx, dword [esp + 0x68]
push ebp
push esi
push edi
cmp byte [ebx + 0x2b], 2
lea edi, [esp + 0x10]
mov eax, dword [ebx + 0x20]
mov ebp, dword [eax]
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
je 0x684c31
mov eax, dword [ebx + 4]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3c]
call eax
add esp, 4
lea esi, [ebp + 0x30]
mov ecx, 0xc
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
mov esi, 0x2c
lea edx, [esp + 0x40]
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x684d01
add ecx, 4
add edx, 4
sub esi, 4
jae 0x684c50
cmp byte [esp + 0x1c], 0
je 0x684d01
xor edx, edx
lea ecx, [esp + 0x10]
xor esi, esi
mov eax, dword [ecx]
add eax, edx
add esi, eax
mov eax, dword [ecx + 4]
add eax, esi
add ecx, 8
add edx, eax
lea eax, [esp + 0x38]
cmp ecx, eax
jb 0x684c78
cmp esi, dword [esp + 0x38]
jne 0x684d01
cmp edx, dword [esp + 0x3c]
jne 0x684d01
lea edi, [ebx + 0x34]
mov esi, 0x2c
mov ecx, edi
lea edx, [esp + 0x10]
lea ebx, [ebx]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x684ccb
add ecx, 4
add edx, 4
sub esi, 4
jae 0x684cb0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60
ret
mov eax, dword [esp + 0x78]
lea esi, [esp + 0x10]
mov ecx, 0xc
mov dword [eax], 1
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [ebx + 0x42]
mov eax, ecx
and ecx, 0xfe00
and eax, 1
pop edi
shl eax, 0x10
pop esi
add eax, ecx
mov dword [ebx + 0x24], eax
xor eax, eax
pop ebp
pop ebx
add esp, 0x60
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x60
ret