joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017a70
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
movzx ecx, word [edi + 0x12]
movzx edx, word [edi + 0xe]
movzx eax, byte [edi + 5]
push ebx
mov ebx, dword [edi + 0x34]
mov ebx, dword [ebx + 0x28]
push esi
mov esi, dword [edi + 0x38]
lea edx, [edx + ecx*2]
mov dword [esp + 8], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 0
test ecx, ecx
jle 0x10017bc2
movzx ecx, word [edi + 0xe]
add ecx, esi
mov dword [esp + 0xc], ecx
jmp 0x10017ad4
mov ecx, dword [esp + 0xc]
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 1]
shl eax, 8
or eax, ecx
mov dword [esp + 0x10], eax
cmp eax, edx
jl 0x10017c45
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffffc
cmp eax, ecx
jg 0x10017c45
add eax, dword [esp + 0x14]
push eax
mov eax, dword [edi + 0x4c]
push edi
call eax
movzx ecx, ax
sub ebx, ecx
add esp, 8
mov dword [esp + 0x28], ecx
cmp ebx, dword [esp + 0x18]
jl 0x10017c1c
mov edx, dword [esp + 0x10]
lea eax, [ecx + edx]
cmp eax, dword [esp + 0x1c]
jg 0x10017c1c
mov eax, dword [esp + 0xc]
mov edx, ebx
sar edx, 8
cmp dword [esp + 8], 0
mov byte [eax], dl
mov byte [eax + 1], bl
jne 0x10017b8c
cmp ebx, dword [esp + 0x10]
je 0x10017ba2
mov eax, dword [edi + 0x34]
mov edx, dword [eax]
mov eax, dword [edx + 0xe0]
mov edx, dword [esp + 0x24]
mov dword [esp + 8], eax
movzx eax, byte [edx + esi + 5]
movzx edx, byte [edx + esi + 6]
shl eax, 8
or eax, edx
sub ecx, eax
add ecx, ebx
push ecx
lea ecx, [eax + esi]
add eax, dword [esp + 0xc]
push ecx
push eax
call fcn.100aace0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
add esp, 0xc
mov dword [esp + 0x14], eax
push ecx
mov ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x18]
lea eax, [ebx + esi]
push ecx
push eax
call fcn.100aace0
add esp, 0xc
mov eax, dword [esp + 0x20]
add dword [esp + 0xc], 2
mov edx, dword [esp + 0x18]
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x2c]
jl 0x10017ad0
mov eax, dword [esp + 0x24]
mov ecx, ebx
mov byte [eax + esi + 6], bl
sub ebx, edx
push ebx
add edx, esi
sar ecx, 8
push 0
push edx
mov byte [eax + esi + 5], cl
mov word [eax + esi + 1], 0
mov byte [eax + esi + 7], 0
call fcn.100a6a70
movzx edx, word [edi + 0x10]
add esp, 0xc
cmp ebx, edx
je 0x10017c6e
push 0x100c0d50
push 0xdf6e
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.SQLite3Encrypt.dll_sqlite3_log
add esp, 0x14
mov eax, 0xb
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100c0d50
push 0xdf56
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.SQLite3Encrypt.dll_sqlite3_log
add esp, 0x14
mov eax, 0xb
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100c0d50
push 0xdf50
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.SQLite3Encrypt.dll_sqlite3_log
add esp, 0x14
mov eax, 0xb
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d3b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 0x28]
mov eax, dword [eax]
push ebx
mov ebx, dword [esi + 0x38]
lea edx, [ecx + ebx]
push edi
movzx edi, byte [esi + 5]
mov dword [esp + 0xc], edx
mov edx, dword [esi + 0x40]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 0xe0]
movzx eax, byte [ebx + edi + 5]
mov dword [esp + 0x10], edx
movzx edx, byte [ebx + edi + 6]
shl eax, 8
or eax, edx
sub ecx, eax
push ecx
lea ecx, [eax + ebx]
add eax, dword [esp + 0x14]
push ecx
push eax
call fcn.100aace0
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [ebp + 8], 0
mov dword [esp + 8], 0
jle 0x1001d4a0
jmp 0x1001d420
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + edx*4]
mov dword [esp + 0x18], ecx
cmp ecx, ebx
jb 0x1001d444
cmp ecx, dword [esp + 0xc]
jae 0x1001d444
mov edx, dword [esp + 0x10]
sub edx, ebx
add ecx, edx
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 8]
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + edx*2]
sub eax, ecx
mov ecx, dword [esp + 0x14]
mov edx, eax
sub edx, ebx
sar edx, 8
mov byte [ecx], dl
mov dl, al
sub dl, bl
mov byte [ecx + 1], dl
add ecx, 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
cmp eax, ecx
jb 0x1001d4df
mov edx, dword [esp + 8]
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + edx*2]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
call fcn.100aace0
mov eax, dword [esp + 0x14]
inc eax
add esp, 0xc
cmp eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
jl 0x1001d420
mov cx, word [ebp + 8]
mov word [esi + 0x12], cx
mov byte [esi + 1], 0
mov word [ebx + edi + 1], 0
mov dl, byte [esi + 0x13]
mov byte [ebx + edi + 3], dl
mov cl, byte [esi + 0x12]
mov edx, eax
sub edx, ebx
sub al, bl
sar edx, 8
mov byte [ebx + edi + 6], al
mov byte [ebx + edi + 4], cl
mov byte [ebx + edi + 5], dl
mov byte [ebx + edi + 7], 0
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100c0d50
push 0xf350
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.SQLite3Encrypt.dll_sqlite3_log
add esp, 0x14
pop edi
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
mov ebx, eax
call fcn.1001afa0
movsx edx, byte [ebx + 0x44]
mov ecx, dword [ebp + 8]
mov edi, dword [ebx + 0x10]
xor eax, eax
mov word [esp + 0x18], ax
mov dword [esp + 0x30], ecx
mov ecx, dword [ebx + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [ebx + edx*4 + 0x78]
mov eax, dword [eax + 0x3c]
movzx edx, word [ebx + 0x20]
sub eax, ecx
cmp edx, eax
jae 0x10028c62
mov eax, edx
cmp edi, eax
ja 0x10028c7c
mov ebx, ecx
mov ecx, 0x1010
mov dword [esp + 0x20], ebx
mov word [esp + 0x18], cx
mov dword [esp + 0x1c], edi
jmp 0x10028c9a
push 1
push 0
lea esi, [esp + 0x18]
mov eax, ebx
call fcn.10023910
add esp, 8
test eax, eax
jne 0x10028d68
mov ebx, dword [esp + 0x20]
mov al, byte [ebx]
cmp al, 0x80
jae 0x10028ca5
movzx edi, al
jmp 0x10028cb4
lea esi, [esp + 0xc]
mov ecx, ebx
call fcn.10007de0
mov edi, dword [esp + 0xc]
cmp edi, 3
jb 0x10028d2b
cmp edi, dword [esp + 0x1c]
jg 0x10028d2b
mov al, byte [edi + ebx - 1]
lea ecx, [edi + ebx - 1]
cmp al, 0x80
jae 0x10028cd0
movzx edx, al
jmp 0x10028cdd
lea esi, [esp + 0xc]
call fcn.10007de0
mov edx, dword [esp + 0xc]
lea eax, [edx - 1]
cmp eax, 8
ja 0x10028d2b
cmp edx, 7
je 0x10028d2b
movzx eax, byte [edx + 0x100b92e0]
mov ecx, dword [esp + 0x1c]
lea esi, [eax + edi]
cmp ecx, esi
jb 0x10028d2b
sub ecx, eax
add ecx, ebx
lea eax, [esp + 0x38]
call fcn.10027b20
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea eax, [esp + 0x10]
call fcn.10023020
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test dword [esp + 0x18], 0x2460
jne 0x10028d3c
cmp dword [esp + 0x28], 0
je 0x10028d45
lea eax, [esp + 0x10]
call fcn.10022f80
push 0x100c0d50
push 0x11ab5
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.SQLite3Encrypt.dll_sqlite3_log
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [eax + 0x14]
push esi
push edi
mov eax, ebx
call fcn.1001afa0
mov edi, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
mov ecx, edi
add ecx, 0xffffffff
adc eax, 0xffffffff
test eax, eax
ja 0x10028e44
jb 0x10028daa
cmp ecx, 0x7ffffffe
ja 0x10028e44
mov edx, dword [ebp + 8]
xor ecx, ecx
mov word [esp + 0x18], cx
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], ecx
movsx eax, byte [ebx + 0x44]
mov edx, dword [ebx + eax*4 + 0x78]
mov eax, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x18]
movzx edx, word [ebx + 0x20]
sub eax, ecx
cmp edx, eax
jae 0x10028dd6
mov eax, edx
cmp edi, eax
ja 0x10028dee
mov eax, 0x1010
mov dword [esp + 0x20], ecx
mov word [esp + 0x18], ax
mov dword [esp + 0x1c], edi
jmp 0x10028e04
push 1
push 0
lea esi, [esp + 0x18]
mov eax, ebx
call fcn.10023910
add esp, 8
test eax, eax
jne 0x10028e70
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push 0
push ecx
push edx
push eax
call fcn.10028340
mov ecx, dword [ebp + 0x10]
add esp, 0x10
test dword [esp + 0x18], 0x2460
mov dword [ecx], eax
jne 0x10028e32
cmp dword [esp + 0x28], 0
je 0x10028e3b
lea eax, [esp + 0x10]
call fcn.10022f80
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
push 0x100c0d50
push 0x11ad7
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
mov dword [edx], 0
call sym.SQLite3Encrypt.dll_sqlite3_log
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100420e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x1cc], 3
mov dword [ebp - 4], 0
jae 0x10042119
test ecx, ecx
je 0x10042119
mov eax, str.sqlite_user
call fcn.10007010
test eax, eax
jne 0x10042119
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x100421d5
jmp 0x10042136
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
cmp esi, 2
jge 0x1004213e
xor esi, 1
test ebx, ebx
je 0x10042198
mov edx, dword [edi + 0x10]
mov eax, esi
add eax, eax
mov edi, dword [edx + eax*8]
movzx eax, byte [edi]
mov dl, byte [ebx]
mov ecx, ebx
movzx ebx, byte [eax + 0x100b8af0]
movzx eax, dl
movzx eax, byte [eax + 0x100b8af0]
sub eax, ebx
jne 0x100421c5
sub edi, dword [ebp + 0x10]
jmp 0x10042170
test dl, dl
je 0x10042194
movzx eax, byte [edi + ecx + 1]
movzx ebx, byte [eax + 0x100b8af0]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x100b8af0]
sub eax, ebx
je 0x10042170
jmp 0x100421c5
test eax, eax
jne 0x100421c5
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [eax + 0x10]
add esi, esi
mov eax, dword [ecx + esi*8 + 0xc]
push edx
add eax, 8
call fcn.10008530
add esp, 8
test eax, eax
je 0x100421df
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100421d5
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, dword [ebp - 0xc]
jl 0x10042130
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
jmp 0x100421c5
Function at 0x10042340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ecx + 0x14]
push esi
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], edx
test edx, edx
jle 0x100423d2
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0xc], eax
push ebx
mov ecx, esi
cmp esi, 2
jge 0x1004236c
xor ecx, 1
shl ecx, 4
add ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x100423de
mov esi, dword [ecx]
movzx ecx, byte [esi]
movzx eax, byte [ecx + 0x100b8af0]
mov bl, byte [edi]
movzx ecx, bl
movzx ecx, byte [ecx + 0x100b8af0]
sub ecx, eax
mov edx, edi
jne 0x100423c2
sub esi, edi
lea esp, [esp]
test bl, bl
je 0x100423d7
mov bl, byte [edx + 1]
movzx eax, byte [esi + edx + 1]
movzx eax, byte [eax + 0x100b8af0]
inc edx
movzx ecx, bl
movzx ecx, byte [ecx + 0x100b8af0]
sub ecx, eax
je 0x100423a0
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 4]
inc esi
mov dword [ebp - 8], esi
cmp esi, dword [ebp - 0x14]
jl 0x10042362
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x100423c2
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x18
call fcn.10008530
add esp, 8
test eax, eax
je 0x10042404
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100423d1
jmp 0x100423c8
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x100423c8
Function at 0x10045530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100d2170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x40], edx
mov edx, dword [ecx + 0x10]
add eax, eax
mov ebx, dword [edx + eax*8]
mov eax, 1
push edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], eax
jmp 0x10045573
mov esi, dword [ebp - 0x28]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call sym.SQLite3Encrypt.dll_sqlite3_snprintf
mov edi, dword [esi]
xor ecx, ecx
add esp, 0x10
cmp byte [edi + 0x1cc], 3
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x20], ecx
jae 0x100455db
mov dl, byte [ebp - 0x1c]
movzx eax, dl
movzx eax, byte [eax + 0x100b8af0]
sub eax, 0x73
jne 0x100455db
test dl, dl
je 0x100455d3
movzx eax, byte [ecx + 0x100bed71]
movzx esi, byte [eax + 0x100b8af0]
mov dl, byte [ebp + ecx - 0x1b]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x100b8af0]
sub eax, esi
je 0x100455ac
jmp 0x100455db
test eax, eax
je 0x100456c6
mov eax, dword [edi + 0x14]
xor esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], eax
test eax, eax
jle 0x100456c6
jmp 0x100455f6
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x34]
cmp esi, 2
jge 0x100455fe
xor esi, 1
test ebx, ebx
je 0x10045654
mov eax, dword [edi + 0x10]
mov edx, esi
shl edx, 4
mov edi, dword [edx + eax]
mov dl, byte [ebx]
mov ecx, ebx
movzx ebx, byte [edi]
movzx ebx, byte [ebx + 0x100b8af0]
movzx eax, dl
movzx eax, byte [eax + 0x100b8af0]
sub eax, ebx
jne 0x10045681
sub edi, dword [ebp - 0x24]
test dl, dl
je 0x10045650
movzx eax, byte [edi + ecx + 1]
movzx ebx, byte [eax + 0x100b8af0]
mov dl, byte [ecx + 1]
inc ecx
movzx eax, dl
movzx eax, byte [eax + 0x100b8af0]
sub eax, ebx
je 0x1004562c
jmp 0x10045681
test eax, eax
jne 0x10045681
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x10]
add esi, esi
mov eax, dword [ecx + esi*8 + 0xc]
lea edx, [ebp - 0x1c]
push edx
add eax, 8
call fcn.10008530
add esp, 8
test eax, eax
je 0x100456ba
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x10045697
mov esi, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, dword [ebp - 0x38]
jl 0x100455f0
cmp dword [ebp - 0x20], 0
je 0x100456c3
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x24]
push edx
mov edx, dword [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push edx
call fcn.10042010
add esp, 0x18
jmp 0x100456c6
mov dword [ebp - 0x20], 0
jmp 0x10045681
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 4
jle 0x10045570
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a3aa6
mov esp, ebp
pop ebp
ret
Function at 0x10081dd0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
cmp byte [ebx + 0xe5], 2
jne 0x10081e6c
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
push str.SELECT_1_FROM__Q.sqlite_master_WHERE_tbl_name_q_stat
call sym.SQLite3Encrypt.dll_sqlite3_mprintf
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
je 0x10081e67
push esi
push edi
push 0
push 0
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ebx + 0xc]
lea edi, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.10059520
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x10081e53
mov esi, dword [ebp - 4]
push esi
call sym.SQLite3Encrypt.dll_sqlite3_step
xor ecx, ecx
cmp eax, 0x64
sete cl
push esi
mov dword [ebp - 4], ecx
call sym.SQLite3Encrypt.dll_sqlite3_finalize
mov esi, eax
add esp, 8
test esi, esi
jne 0x10081e53
mov dl, byte [ebp - 4]
mov byte [ebx + 0xe5], dl
mov eax, dword [ebp - 8]
push eax
call sym.SQLite3Encrypt.dll_sqlite3_free
add esp, 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 7
mov esp, ebp
pop ebp
ret
Function at 0x100962a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
cmp ecx, 0x80
jge 0x100962c3
lea edx, [ecx - 0x41]
cmp edx, 0x19
ja 0x1009636d
lea eax, [ecx + 0x20]
mov esp, ebp
pop ebp
ret
cmp ecx, 0x10000
jge 0x1009635f
push esi
push edi
mov edi, 0xa2
xor esi, esi
mov dword [ebp - 4], 0xffffffff
push ebx
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
movzx edx, word [eax*4 + 0x100bcc38]
mov ebx, ecx
sub ebx, edx
js 0x10096300
mov edx, eax
mov dword [ebp - 4], edx
lea esi, [eax + 1]
jmp 0x10096306
mov edx, dword [ebp - 4]
lea edi, [eax - 1]
cmp edi, esi
jge 0x100962e0
pop ebx
test edx, edx
js 0x10096348
movzx eax, word [edx*4 + 0x100bcc38]
movzx esi, byte [edx*4 + 0x100bcc3b]
add esi, eax
cmp ecx, esi
jge 0x10096348
movzx edx, byte [edx*4 + 0x100bcc3a]
xor eax, ecx
and eax, edx
test al, 1
jne 0x10096348
shr edx, 1
movzx eax, word [edx*2 + 0x100bcec8]
add eax, ecx
and eax, 0xffff
jmp 0x1009634a
mov eax, ecx
cmp dword [ebp + 8], 0
pop edi
pop esi
je 0x1009636d
push eax
call fcn.10095f70
add esp, 4
mov esp, ebp
pop ebp
ret
lea edx, [ecx - 0x10400]
cmp edx, 0x27
ja 0x1009636d
lea eax, [ecx + 0x28]
mov esp, ebp
pop ebp
ret

Function at 0x1009afd0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x1c]
push ebx
push esi
push edi
push ecx
push edx
push str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
xor esi, esi
xor ebx, ebx
call sym.SQLite3Encrypt.dll_sqlite3_mprintf
add esp, 0xc
mov dword [esp + 0x14], eax
test eax, eax
jne 0x1009b00a
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ebp + 8]
lea edi, [esp + 0x24]
call fcn.10059520
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x1009b071
mov edi, dword [esp + 0x10]
push edi
call sym.SQLite3Encrypt.dll_sqlite3_step
add esp, 4
cmp eax, 0x64
jne 0x1009b049
push 0
push edi
call sym.SQLite3Encrypt.dll_sqlite3_column_int64
add esp, 8
mov esi, eax
mov ebx, edx
push edi
call sym.SQLite3Encrypt.dll_sqlite3_finalize
add esp, 4
mov edi, eax
test edi, edi
jne 0x1009b09b
mov eax, esi
or eax, ebx
jne 0x1009b07a
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x28], 0x100000
mov dword [eax + 0x2c], 0
jmp 0x1009b09b
cmp edi, 7
je 0x1009b054
xor edi, edi
jmp 0x1009b05e
test ebx, ebx
jl 0x1009b08b
jg 0x1009b085
cmp esi, 0x64
jbe 0x1009b08b
mov eax, esi
mov ecx, ebx
jmp 0x1009b092
mov eax, 0x64
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], ecx
mov ecx, dword [esp + 0x14]
push ecx
call sym.SQLite3Encrypt.dll_sqlite3_free
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1009b290
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
push edi
je 0x1009b2fd
push eax
push str.PRAGMA__Q.page_size
mov dword [ebp + 0xc], 0
call sym.SQLite3Encrypt.dll_sqlite3_mprintf
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edx
mov ecx, edi
call fcn.1009b220
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1009b2f7
movzx ecx, byte [esi + 0x16]
mov eax, dword [ebp + 0xc]
imul ecx, ecx, 0x33
add eax, 0xffffffc0
add ecx, 4
mov dword [esi + 0x10], eax
cmp ecx, eax
jge 0x1009b33f
push edi
mov dword [esi + 0x10], ecx
call sym.SQLite3Encrypt.dll_sqlite3_free
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
jmp 0x1009b327
mov edx, dword [esi + 0x20]
push edx
push eax
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.SQLite3Encrypt.dll_sqlite3_mprintf
add esi, 0x10
push esi
mov esi, dword [ebp + 8]
mov edi, eax
push esi
mov ecx, edi
call fcn.1009b220
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x1009b33f
push esi
call sym.SQLite3Encrypt.dll_sqlite3_errmsg
push eax
push 0x100bd55c
call sym.SQLite3Encrypt.dll_sqlite3_mprintf
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
add esp, 0xc
push edi
call sym.SQLite3Encrypt.dll_sqlite3_free
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x1009c820
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov eax, ebx
mov byte [esi], 0
call fcn.1009c760
test eax, eax
jne 0x1009c847
mov byte [esi], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x1d8], 0
jne 0x1009c85c
mov byte [esi], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
push str.SELECT_pwsqlite_crypt__1_pw___isAdmin_FROM___w_.sqlite_user_WHERE_uname_2
mov esi, ebx
call fcn.1009c6e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1009c87f
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x1d0]
mov edi, dword [ebx + 0x1d4]
mov eax, 1
mov dword [ebp - 4], ecx
call fcn.1002ab00
test eax, eax
jne 0x1009c8f5
test edi, edi
je 0x1009c8e2
mov edx, dword [esi + 0x3c]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.100236f0
mov ecx, dword [esi]
mov edi, eax
add esp, 8
mov dword [ecx + 0x34], edi
test edi, edi
jne 0x1009c8c3
cmp dword [ecx + 0xf0], eax
je 0x1009c8cd
mov ebx, ecx
call fcn.10006cf0
mov ebx, dword [ebp + 8]
mov eax, dword [esi]
cmp byte [eax + 0x45], 0
jne 0x1009c8dd
cmp edi, 0xc0a
jne 0x1009c8e2
call fcn.10004830
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
test eax, eax
je 0x1009c8f5
push eax
call dword [0x100d3430]
add esp, 4
mov eax, dword [ebx + 0x1d8]
push 1
push 0
push 0xffffffffffffffff
push eax
push esi
mov eax, 2
call fcn.1002ac70
add esp, 0x14
push esi
call sym.SQLite3Encrypt.dll_sqlite3_step
add esp, 4
cmp eax, 0x64
jne 0x1009c94f
push 0
push esi
call sym.SQLite3Encrypt.dll_sqlite3_column_int
add esp, 8
test eax, eax
je 0x1009c94f
push 1
push esi
call sym.SQLite3Encrypt.dll_sqlite3_column_int
mov ecx, dword [ebp + 0x10]
add esp, 8
add al, 2
push esi
mov byte [ecx], al
call sym.SQLite3Encrypt.dll_sqlite3_finalize
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
push esi
mov byte [edx], 1
call sym.SQLite3Encrypt.dll_sqlite3_finalize
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret