joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011b40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b2b18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100c7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0x1c]
call fcn.100a4680
test al, al
je 0x10011b80
push 0xffffffffffffffff
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.10001750
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 0x10], 0
call fcn.100a3410
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x10011bdf
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x10]
test eax, eax
mov dword [edi + 0x18], eax
lea eax, [edi + 0x20]
mov dword [ebp - 0x18], 0
jne 0x10011c68
cmp dword [eax + 0x14], 8
jb 0x10011c08
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [edi + 0x1c], eax
test eax, eax
je 0x10011c31
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x10011c31
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0x14], 8
jb 0x10011c39
mov edi, dword [edi]
push edi
push str.ERR:Fail_open_db__s
push 1
push 0x35
push 0x100b97d8
push str.CTableManager::InitDB
call fcn.100a59b0
add esp, 0x18
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 8
jb 0x10011c70
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [edi + 0x1c], eax
test eax, eax
je 0x10011c99
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x10011c99
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011cb0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebx + 0x1c]
call fcn.100a4680
test al, al
je 0x10011cd2
push 0xffffffffffffffff
push dword [ebx + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp + 8]
mov ecx, esi
mov eax, dword [esi]
call dword [eax]
mov edx, dword [esi]
mov ecx, esi
mov dword [ebp + 8], eax
call dword [edx + 4]
mov edx, dword [ebp + 8]
mov esi, eax
test edx, edx
je 0x10011dbd
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 4], eax
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011d00
sub ecx, dword [ebp - 4]
je 0x10011dbd
test esi, esi
je 0x10011dbd
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011d20
sub ecx, dword [ebp - 4]
je 0x10011dbd
sub esp, 0x18
mov ecx, esp
push edx
call fcn.10006890
mov ecx, dword [ebx + 0x18]
call fcn.100a42f0
add esp, 0x18
test al, al
jne 0x10011dab
mov ecx, dword [ebp + 8]
push ecx
push str.Create_DB_table___s_...
push 1
push 0x51
push 0x100b98e8
push 0x100b9924
call fcn.100a5620
mov ecx, esp
push esi
call fcn.10006890
mov ecx, dword [ebx + 0x18]
call fcn.100a43f0
add esp, 0x18
test al, al
jne 0x10011dab
mov ecx, ebx
call fcn.10011e30
push esi
push str.ERR:AddTable_fail_sql:__s_
push 1
push 0x55
push str..._srcPrivateHelperdb_managercontrolTableManager.cpp
push str.CTableManager::AddTable
call fcn.100a5620
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, ebx
call fcn.10011e30
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 0x34], 8
lea eax, [ebx + 0x20]
jb 0x10011dc8
mov eax, dword [eax]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x10011df1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x10011df1
push dword [ebx + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
test esi, esi
mov eax, 0x100b5c37
cmovne eax, esi
test ecx, ecx
push eax
mov eax, 0x100b5c3a
cmovne eax, ecx
push eax
push str.ERR:AddTable_fail__arg_invalid____s___s_
push 1
push 0x44
push 0x100b9878
push 0x100b98b4
call fcn.100a5620
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10014bf0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x100d05e8], 0
push esi
jne 0x10014dc1
mov eax, dword [0x100d05e4]
test eax, eax
jne 0x10014dc3
xorps xmm0, xmm0
mov dword [0x100d076c], eax
movdqu xmmword [0x100d074c], xmm0
movdqu xmmword [0x100d075c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
push str.dbghelp.dll
mov dword [0x100d074c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x100d0750], eax
test eax, eax
je 0x10014d66
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImagehlpApiVersionEx
push eax
call esi
push str.SymInitialize
push dword [0x100d0750]
mov dword [0x100d0754], eax
call esi
push str.SymSetOptions
push dword [0x100d0750]
mov dword [0x100d0758], eax
call esi
push str.SymGetOptions
push dword [0x100d0750]
mov dword [0x100d075c], eax
call esi
push str.SymLoadModule64
push dword [0x100d0750]
mov dword [0x100d0760], eax
call esi
push str.SymGetModuleInfo64
push dword [0x100d0750]
mov dword [0x100d0764], eax
call esi
push str.SymFromName
push dword [0x100d0750]
mov dword [0x100d0768], eax
call esi
xorps xmm0, xmm0
mov dword [0x100d076c], eax
mov ecx, 0xc
movq qword [ebp - 8], xmm0
mov word [ebp - 8], cx
mov ecx, dword [0x100d0754]
test ecx, ecx
je 0x10014d61
cmp dword [0x100d0758], 0
je 0x10014d61
cmp dword [0x100d0764], 0
je 0x10014d61
cmp dword [0x100d0768], 0
je 0x10014d61
test eax, eax
je 0x10014d61
lea eax, [ebp - 8]
push eax
call ecx
cmp word [ebp - 8], 0xc
jb 0x10014d61
push 0
push 0
push dword [0x100d074c]
call dword [0x100d0758]
test eax, eax
je 0x10014d61
mov eax, dword [0x100d0760]
test eax, eax
je 0x10014d4d
cmp dword [0x100d075c], 0
je 0x10014d4d
call eax
and eax, 0xfffffffc
or eax, 0x2704
push eax
call dword [0x100d075c]
mov dword [0x100d05e4], 0x100d074c
mov eax, 0x100d074c
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100d0750]
mov dword [0x100d05e8], 1
test eax, eax
je 0x10014d7b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x100d0754], 0
mov dword [0x100d0758], 0
mov dword [0x100d075c], 0
mov dword [0x100d0760], 0
mov dword [0x100d0764], 0
mov dword [0x100d0768], 0
mov dword [0x100d076c], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014f60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100c2790
push 0x100b06ea
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100c7034]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x10015010
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10015010
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x10015010
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x10015010
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10015380
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x100cffd8]
push edi
test esi, esi
je 0x100153af
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x100153b7
mov esi, dword [esi + 4]
test esi, esi
jne 0x10015396
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100154e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
lea esi, [edx - 0x10000]
movzx eax, si
push edi
mov edi, ecx
test eax, eax
je 0x100154fa
sub esi, eax
cmp esi, edi
jbe 0x1001558d
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x10015510
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x10015525
sub esi, 0x8000000
jmp 0x10015589
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push esi
movdqu xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1001558d
cmp dword [ebp - 0xc], 0x10000
jne 0x10015577
cmp dword [ebp - 0x10], 0x10000
jb 0x10015577
push 0x40
push 0x3000
push 0x10000
push esi
call ebx
test eax, eax
jne 0x1001558f
sub esi, 0x10000
jmp 0x10015589
mov esi, dword [ebp - 0x18]
add esi, 0xffff0000
movzx eax, si
test eax, eax
je 0x10015589
sub esi, eax
cmp esi, edi
ja 0x10015510
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100155a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push edi
push eax
lea edx, [ebp - 8]
call fcn.100150d0
mov eax, dword [0x100cffcc]
add esp, 4
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov ecx, dword [0x100cffd8]
test eax, eax
jne 0x100155da
test ecx, ecx
je 0x100155ed
mov eax, ecx
mov dword [0x100cffcc], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x100155ed
cmp edx, ebx
jb 0x100155ed
cmp edx, edi
jbe 0x10015671
mov eax, ecx
mov dword [0x100cffcc], eax
test ecx, ecx
je 0x10015617
test eax, eax
je 0x1001560b
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1001560b
cmp ecx, ebx
jb 0x1001560b
cmp ecx, edi
jbe 0x10015671
mov eax, dword [eax + 4]
mov dword [0x100cffcc], eax
test eax, eax
jne 0x100155fc
movzx eax, si
mov ecx, ebx
sub esi, eax
mov edx, esi
call fcn.100154e0
test eax, eax
jne 0x10015636
mov edx, edi
mov ecx, esi
call fcn.10015420
test eax, eax
je 0x1001569b
mov dword [eax], 0x52727464
xor edx, edx
mov dword [eax + 8], 0
mov esi, 0x38b
mov ecx, dword [0x100cffd8]
mov dword [eax + 4], ecx
lea ecx, [eax + 0xffa8]
mov dword [0x100cffcc], eax
mov dword [0x100cffd8], eax
mov dword [ecx + 0x40], edx
mov edx, ecx
sub ecx, 0x48
dec esi
jne 0x10015663
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, ebx
jb 0x1001569b
cmp esi, edi
ja 0x1001569b
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [eax + 8], ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100156e0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov ecx, dword [0x100cffd8]
push ebx
mov ebx, 0x100cffd8
test ecx, ecx
je 0x1001574c
push esi
push edi
cmp dword [ecx], 0x52727464
jne 0x10015741
lea edi, [ecx + 0x10000]
xor edx, edx
lea esi, [ecx + 0x88]
mov eax, dword [esi]
test eax, eax
je 0x10015716
cmp eax, ecx
jb 0x10015741
cmp eax, edi
jae 0x10015741
inc edx
add esi, 0x48
cmp edx, 0x38d
jb 0x10015708
mov eax, dword [ecx + 4]
push 0x8000
push 0
push ecx
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x100cffcc], 0
jmp 0x10015744
lea ebx, [ecx + 4]
mov ecx, dword [ebx]
test ecx, ecx
jne 0x100156f2
pop edi
pop esi
pop ebx
ret
Function at 0x10015750
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100cffdc], eax
je 0x1001576b
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
push esi
mov esi, dword [0x100cffd4]
push edi
test esi, esi
je 0x100157de
mov edi, edi
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], 0
jne 0x100157d0
mov ebx, dword [esi + 0x10]
test ebx, ebx
je 0x100157ca
push 0x48
push 0
mov edi, ebx
push ebx
and edi, 0xffff0000
call sub.MSVCR120.dll_memset
mov eax, dword [edi + 8]
add esp, 0xc
mov dword [ebx + 0x40], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x10], 0
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
mov edi, dword [esi]
push esi
call ebx
add esp, 4
mov esi, edi
test edi, edi
jne 0x10015780
mov dword [0x100cffd4], 0
call fcn.100153d0
mov edi, dword [0x100cffc8]
test edi, edi
je 0x1001580e
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push edi
call ebx
add esp, 4
mov edi, esi
test esi, esi
jne 0x100157f7
pop edi
pop esi
mov dword [0x100cffc8], 0
xor eax, eax
mov dword [0x100cffdc], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015b30
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x100cffe0]
push edi
mov edi, ecx
test eax, eax
jne 0x10015ba7
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, eax
jne 0x10015b4a
xor eax, eax
pop edi
ret
push esi
push 8
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10015b61
lea edi, [eax + 8]
jmp 0x10015b7f
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10015b94
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
pop esi
mov dword [0x100cffe0], edi
mov eax, edi
mov dword [0x100cffc4], 0
pop edi
ret
mov eax, dword [0x100cffc8]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], edi
mov dword [0x100cffc8], esi
pop esi
pop edi
ret
Function at 0x1001bbb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x100cecc8], 0
je 0x1001bc07
mov eax, dword [0x100d0018]
test eax, eax
je 0x1001bbe0
push eax
call dword [0x100ced18]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.10018e90
mov eax, dword [0x100d0018]
test eax, eax
je 0x1001bc02
push eax
call dword [0x100ced20]
mov esi, dword [ebp - 4]
jmp 0x1001bc11
mov esi, dword [ebp - 4]
jmp 0x1001bc14
push 0x14
call dword [0x100cece8]
mov esi, eax
add esp, 4
test esi, esi
jne 0x1001bc22
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x100ceccc], 0
mov ebx, dword [ebp + 8]
je 0x1001bc6d
mov eax, dword [0x100cedbc]
test eax, eax
je 0x1001bc45
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x1001bc6d
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x1001bb80
push 0
push 0
mov dword [esi + 0xc], ebx
call dword [sym.imp.MSVCR120.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x1001bc7b
xorps xmm0, xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x1001bc94
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10026090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push esi
push edi
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x100260ce
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0
movq qword [eax], xmm0
jmp 0x10026152
movzx edi, word [ebx + 0x8c]
add edi, 0x28
mov eax, edi
or eax, 0
je 0x1002613e
push 0
push edi
call fcn.10018fd0
mov esi, eax
add esp, 8
test esi, esi
je 0x100260fc
push edi
push 0
push esi
call sub.MSVCR120.dll_memset
add esp, 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test esi, esi
jne 0x10026142
push dword [ebp + 8]
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 0x98]
dec ecx
mov esi, dword [ebx + 0x3c]
push 0
cdq
push ecx
mov edi, dword [esi]
push edx
push eax
call fcn.100b0750
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x10026100
lea eax, [esi + 0x28]
mov dword [esi + 0x1c], 0x10020
mov dword [esi + 8], eax
mov dword [esi + 0x14], ebx
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
pop edi
mov dword [esi + 0x18], edx
inc dword [ebx + 0x78]
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10056c00
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push 0x100c9468
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.1005c030
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x10056c3b
push edi
push 0x100c9514
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.1005c030
add esp, 0x10
pop edi
pop ebx
pop ebp
ret

Function at 0x1005c170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
xor esi, esi
cmp dword [ecx + 0x14], esi
jle 0x1005c20e
nop
mov edi, esi
cmp esi, 2
jge 0x1005c19a
xor edi, 1
test eax, eax
je 0x1005c1c5
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov ebx, dword [ecx + edx*8]
sub ebx, dword [ebp + 8]
jmp 0x1005c1b0
movzx edx, byte [eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x1005c1ea
test edx, edx
jne 0x1005c1fc
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x10]
add edi, edi
push 0
mov edx, ebx
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.1001df00
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x1005c29d
jmp 0x1005c202
movzx ecx, byte [ecx + 0x100baa20]
movzx edx, byte [edx + 0x100baa20]
sub edx, ecx
jne 0x1005c1ff
inc eax
jmp 0x1005c1b0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
inc esi
mov eax, dword [ebp + 8]
cmp esi, dword [ecx + 0x14]
jl 0x1005c190
mov edx, 0x100ca080
sub edx, ebx
movzx ecx, byte [ebx]
movzx eax, byte [edx + ebx]
cmp ecx, eax
jne 0x1005c23a
test ecx, ecx
jne 0x1005c24c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1005c24f
neg ecx
sbb ecx, ecx
jmp 0x1005c272
movzx eax, byte [eax + 0x100baa20]
movzx ecx, byte [ecx + 0x100baa20]
sub ecx, eax
jne 0x1005c29b
inc ebx
jmp 0x1005c215
test ecx, ecx
je 0x1005c29b
mov esi, ecx
mov edx, eax
sub esi, eax
lea esp, [esp]
movzx ecx, byte [edx]
movzx eax, byte [esi + edx]
cmp ecx, eax
jne 0x1005c286
test ecx, ecx
jne 0x1005c298
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x1005c29b
mov ecx, dword [ebp - 4]
mov ebx, 0x100ca090
mov dword [ebp - 8], ebx
jmp 0x1005c184
movzx eax, byte [eax + 0x100baa20]
movzx ecx, byte [ecx + 0x100baa20]
sub ecx, eax
jne 0x1005c26f
inc edx
jmp 0x1005c260
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005c470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov dword [ebp - 8], edx
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], eax
xor esi, esi
cmp dword [eax + 0x14], ebx
jle 0x1005c505
mov edx, dword [ebp + 8]
push edi
lea ecx, [ecx]
mov ecx, esi
cmp esi, 2
jge 0x1005c49a
xor ecx, 1
mov eax, dword [eax + 0x10]
shl ecx, 4
add ecx, eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 4], eax
test edx, edx
je 0x1005c4c4
mov edi, dword [ecx]
mov eax, edx
sub edi, edx
movzx edx, byte [eax]
movzx ecx, byte [edi + eax]
cmp edx, ecx
jne 0x1005c4f0
test edx, edx
jne 0x1005c502
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea ecx, [eax + 0x18]
push 0
call fcn.1001df00
add esp, 4
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x1005c4e7
mov eax, dword [ebp - 0xc]
inc esi
mov edx, dword [ebp + 8]
cmp esi, dword [eax + 0x14]
jl 0x1005c490
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [ecx + 0x100baa20]
movzx edx, byte [edx + 0x100baa20]
sub edx, ecx
jne 0x1005c4db
inc eax
jmp 0x1005c4b2
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005fd90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100c7034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push edi
mov eax, dword [esi]
mov dword [ebp - 0x20], esi
mov eax, dword [eax + 0x10]
mov edi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], eax
lea esp, [esp]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.1001b860
mov ecx, dword [esi]
lea ebx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x24], ecx
xor esi, esi
mov dword [ebp - 0x2c], ebx
cmp dword [ecx + 0x14], esi
jle 0x1005fea0
lea ebx, [ebx]
mov edi, esi
cmp esi, 2
jge 0x1005fe0a
xor edi, 1
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1005fe35
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov ebx, dword [ecx + edx*8]
sub ebx, eax
lea ecx, [ecx]
movzx edx, byte [eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x1005fe78
test edx, edx
jne 0x1005fe8a
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x10]
add edi, edi
push 0
mov edx, ebx
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.1001df00
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
je 0x1005fe90
push dword [ebp - 0x3c]
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x38]
mov esi, dword [ebp - 0x20]
push eax
push edi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push esi
call fcn.1005c030
add esp, 0x18
jmp 0x1005ff21
movzx ecx, byte [ecx + 0x100baa20]
movzx edx, byte [edx + 0x100baa20]
sub edx, ecx
jne 0x1005fe8d
inc eax
jmp 0x1005fe20
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
inc esi
cmp esi, dword [ecx + 0x14]
jl 0x1005fe00
mov edi, dword [ebp - 0x28]
mov edx, 0x100ca080
sub edx, ebx
movzx ecx, byte [ebx]
movzx eax, byte [edx + ebx]
cmp ecx, eax
jne 0x1005fed8
test ecx, ecx
jne 0x1005feea
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x10]
test edi, edi
jne 0x1005feed
neg ecx
sbb ecx, ecx
test ecx, ecx
jne 0x1005ff1e
mov ecx, dword [ebp - 0x24]
mov ebx, 0x100ca090
jmp 0x1005fdec
movzx eax, byte [eax + 0x100baa20]
movzx ecx, byte [ecx + 0x100baa20]
sub ecx, eax
jne 0x1005ff1e
inc ebx
jmp 0x1005fea7
test ecx, ecx
je 0x1005ff1e
mov esi, ecx
mov edx, edi
sub esi, edi
movzx ecx, byte [edx]
movzx eax, byte [esi + edx]
cmp ecx, eax
jne 0x1005ff09
test ecx, ecx
je 0x1005fecb
inc edx
jmp 0x1005fef7
movzx eax, byte [eax + 0x100baa20]
movzx ecx, byte [ecx + 0x100baa20]
sub ecx, eax
jne 0x1005fec7
inc edx
jmp 0x1005fef7
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 4
jle 0x1005fdd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b010b
mov esp, ebp
pop ebp
ret