joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059710
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x14001031e
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140010301
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1400102ec
Function at 0x140063620
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140063648
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140063648
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400756bc
Capabilities:
Read file on windows

Disassembly:
jmp 0x140606254
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14060628a
call fcn.1400432fc
mov dword [rax], 0x16
call fcn.14005a368
jmp 0x1406063da
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1406063da
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1406063da
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1406062b9
lock or dword [rcx + 0x14], 0x10
jmp 0x1406063da
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1406062cd
call fcn.1400a1668
mov ebp, dword [rbx + 0x10]
cmp ebp, 1
jne 0x1406062dd
mov rax, qword [rbx]
mov r14b, byte [rax]
jmp 0x1406062e0
xor r14b, r14b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.140077ea8
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.1400686b8
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1406063c8
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140606373
mov rcx, rbx
call fcn.140077ea8
cmp eax, 0xffffffff
je 0x14060635e
mov rcx, rbx
call fcn.140077ea8
cmp eax, 0xfffffffe
je 0x14060635e
mov rcx, rbx
call fcn.140077ea8
movsxd rdi, eax
lea rsi, [0x1409b2a00]
mov rcx, rbx
sar rdi, 6
call fcn.140077ea8
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x140606365
lea rdx, [0x1406639a0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140606373
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140606397
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140606397
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140606397
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp ebp, 1
jne 0x1406063b5
movzx ecx, byte [rdx]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, r14b
or cx, ax
inc rdx
jmp 0x1406063c0
movzx ecx, word [rdx]
add dword [rbx + 0x10], 0xfffffffe
add rdx, 2
mov qword [rbx], rdx
movzx eax, cx
jmp 0x1406063df
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14007b490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov ebp, ecx
xor edi, edi
cmp qword [rdx + 0x18], 0x10
jb 0x14007b4c4
mov rbx, qword [rdx + 0x10]
mov rax, rbx
mov rcx, qword [rdx]
jmp 0x14007b4ce
mov rax, qword [rdx + 0x10]
mov rbx, rax
mov rcx, r14
mov rdx, rdi
add rcx, rdx
sub rbx, rax
mov r8, rbx
sub r8, rdx
inc r8
lea rdx, [rcx + rax]
call fcn.1405e5db0
mov qword [r14 + 0x10], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
cmp ebp, 0xa
ja case.default.0x14007b515
lea rdx, [0x140000000]
mov ecx, dword [rdx + rbp*4 + 0x7b700]
add rcx, rdx
jmp rcx
lea r8, [0x1409af8e8]
mov r9d, 0x18
jmp 0x14007b5a2
lea r8, [0x1409af980]
jmp 0x14007b59c
lea r8, [0x1409af9a0]
mov r9d, 0x18
jmp 0x14007b5a2
lea r8, [0x1409afa18]
jmp 0x14007b59c
lea r8, [0x1409af9f8]
jmp 0x14007b59c
lea r8, [0x1409af918]
jmp 0x14007b59c
lea r8, [0x1409af9b8]
mov r9d, 0x28
jmp 0x14007b5a2
lea r8, [0x1409af900]
mov r9d, 0x18
jmp 0x14007b5a2
lea r8, [0x1409af9e0]
mov r9d, 0x18
jmp 0x14007b5a2
lea r8, [0x1409af938]
mov r9d, 0x28
jmp 0x14007b5a2
lea r8, [0x1409af960]
mov r9d, 0x20
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140037c30
mov r9, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub r9, rbx
lea rcx, [r9 - 1]
test rcx, rcx
je 0x14007b5de
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + rcx - 1]
sub byte [rbx + rcx], al
sub rcx, 1
jne 0x14007b5d0
test r9, r9
je 0x14007b66d
cmp r9, 0x40
jb 0x14007b654
mov rcx, r9
and rcx, 0xffffffffffffffc0
movdqa xmm2, xmmword [0x14063faa0]
lea rax, [rbx + 0x20]
movdqu xmm0, xmmword [rax - 0x20]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm0, xmmword [rax - 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
movdqu xmm0, xmmword [rax]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
pxor xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
add rdi, 0x40
lea rax, [rax + 0x40]
cmp rdi, rcx
jb 0x14007b600
cmp rdi, r9
jae 0x14007b66d
lea rax, [rbx + rdi]
mov rcx, r9
sub rcx, rdi
nop
xor byte [rax], 0xd9
lea rax, [rax + 1]
sub rcx, 1
jne 0x14007b660
lea rdx, [rbx + 8]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14007b680
lea rax, [r9 - 8]
cmp r8, rax
jb 0x14007b697
lea r8, [r9 - 9]
mov rcx, r14
call fcn.140034fd0
mov rdi, qword [rsp + 0x30]
jmp 0x14007b6a9
mov rbx, rdi
test rbx, rbx
je 0x14007b6dd
sub rdi, rbx
cmp rdi, 0x1000
jb 0x14007b6d2
add rdi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14007b6f8
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.14005fc58
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
call fcn.140070b34
int3
Function at 0x14007f99c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140095f30
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140095f30
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14007faec
cmp rax, 0xffffffffffffffff
je 0x14007faec
xor edi, edi
test rbp, rbp
jle 0x14007fa97
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14002024c
mov rbx, rax
test rax, rax
jne 0x14007fa24
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14007fa8d
mov edx, 0x8000
mov ecx, r14d
call fcn.140076888
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001664c
cmp eax, 0xffffffff
je 0x14007fa6d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14007fa34
mov edx, r15d
mov ecx, r14d
call fcn.140076888
jmp 0x14007fa8d
cmp byte [rsi + 0x38], dil
je 0x14007fa84
cmp dword [rsi + 0x34], 5
jne 0x14007fa84
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14007fa8d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14005a32c
jmp 0x14007fb00
jns 0x14007fb00
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140095f30
cmp rax, 0xffffffffffffffff
jne 0x14007fab8
cmp byte [rsi + 0x30], dil
je 0x14007fb00
mov edi, dword [rsi + 0x2c]
jmp 0x14007fb00
mov ecx, r14d
call fcn.1400aaef0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14007fb00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14007fb00
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14007faf9
mov eax, dword [rsi + 0x2c]
jmp 0x14007fafe
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140095f30
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14009073c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400907c3
mov rsi, rbx
cmp word [rax], bp
je 0x140090782
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14009076c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140090768
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14003f6b4
mov rdi, rax
test rax, rax
je 0x1400907b0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1405e5db0
mov rbp, rdi
xor ecx, ecx
call fcn.14005a32c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140090d44
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140077ad4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140090dce
cmp byte [rbp - 0x21], r15b
je 0x140090dc9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140090e04
call fcn.1400a0494
test eax, eax
jne 0x140090df0
cmp byte [rbp - 0x21], r15b
je 0x140090de8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140090e04
cmp byte [rbp - 0x21], r15b
je 0x140090e01
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14008339c
test eax, eax
jne 0x140090ea4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140077ad4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140090e43
cmp byte [rbp - 0x21], r15b
je 0x140090e78
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140090e78
call fcn.1400a0494
test eax, eax
jne 0x140090e64
cmp byte [rbp - 0x21], r15b
je 0x140090e5d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140090e78
cmp byte [rbp - 0x21], r15b
je 0x140090e75
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14008339c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140090ea4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140090ea7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140090eb5
mov rcx, rdi
call fcn.14005a32c
cmp byte [rbp + 0x3f], r15b
je 0x140090ec4
mov rcx, qword [rbp + 0x27]
call fcn.14005a32c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400a13c8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400a13f8
xor eax, eax
jmp 0x1400a14bb
mov rbp, rbx
cmp word [rax], si
je 0x1400a141d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400a1404
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400a1400
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400a1b08
movsxd r14, eax
test eax, eax
jne 0x1400a145b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400a13f1
mov rcx, r14
call fcn.14003f6b4
mov rdi, rax
test rax, rax
jne 0x1400a1474
xor ecx, ecx
call fcn.14005a32c
jmp 0x1400a1450
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400a1b08
test eax, eax
jne 0x1400a14a5
mov rcx, rdi
call fcn.14005a32c
jmp 0x1400a14af
xor ecx, ecx
call fcn.14005a32c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400a4510
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
sub rsp, 0x68
cmp dword [0x1409b3664], 0
jne 0x1400a45cf
mov qword [rax + 0x20], rbx
xor ebx, ebx
mov qword [rax + 0x18], rbx
mov r9d, 0x220
mov qword [rax - 8], rdi
mov dl, 2
mov dword [rax + 0x10], 0
lea rcx, [rsp + 0x78]
mov word [rax + 0x14], 0x500
lea rax, [rax + 0x18]
mov qword [rsp + 0x50], rax
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea edi, [rbx + 1]
test eax, eax
je 0x1400a45bc
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
mov dword [rsp + 0x70], ebx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400a45ae
mov eax, dword [0x1409b3660]
cmp dword [rsp + 0x70], ebx
cmovne eax, edi
mov dword [0x1409b3660], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rbx, qword [rsp + 0x88]
mov dword [0x1409b3664], edi
mov rdi, qword [rsp + 0x60]
mov eax, dword [0x1409b3660]
add rsp, 0x68
ret
Function at 0x1400bcab0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, ecx
call fcn.140179e10
test eax, eax
jne 0x1400bcc4d
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp byte [0x1406643c4], bpl
mov qword [rsp + 0x38], rsi
jne 0x1400bcae5
mov esi, ebp
jmp 0x1400bcb01
mov ecx, 5
call qword [0x140664430]
mov rsi, rax
test rax, rax
je 0x1400bcb01
mov rcx, rax
call qword [0x140664440]
test ebx, ebx
jle 0x1400bcc2f
test rdi, rdi
je 0x1400bcc2f
cmp dword [0x1409b3490], ebp
jne 0x1400bcbb8
xor ecx, ecx
call fcn.1400b7f60
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x1409b3490], xmm0
test rax, rax
jne 0x1400bcb58
xorps xmm0, xmm0
mov qword [0x1409b34c0], rax
movups xmmword [0x1409b34a0], xmm0
mov dword [0x1409b34c8], eax
movups xmmword [0x1409b34b0], xmm0
jmp 0x1400bcb9c
mov ecx, dword [0x140664570]
test ecx, ecx
je 0x1400bcb8a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1409b34a0], xmm0
mov dword [0x1409b34a0], ecx
movups xmmword [0x1409b34b0], xmm0
mov qword [0x1409b34c0], rax
mov dword [0x1409b34c8], eax
jmp 0x1400bcb9c
lea r8, [0x1409b34a0]
mov edx, 0x2c
mov rcx, rax
call qword [rax + 0x68]
mov eax, dword [0x1409b34c0]
xor cl, cl
mov byte [0x1409b3510], cl
mov dword [0x1409b34cc], eax
mov dword [0x1409b34c0], ebp
jmp 0x1400bcbbf
movzx ecx, byte [0x1409b3510]
movzx eax, cl
lea rbp, [0x1409b34d0]
cmp ebx, eax
jle 0x1400bcc11
nop dword [rax]
test cl, cl
je 0x1400bcbef
movzx r8d, cl
mov rdx, rbp
mov rcx, rdi
call fcn.1405e5db0
movzx ecx, byte [0x1409b3510]
sub ebx, ecx
add rdi, rcx
inc dword [0x1409b34c0]
lea rdx, [0x1409b3490]
mov rcx, rbp
call fcn.1400bc7d0
mov cl, 0x40
mov byte [0x1409b3510], cl
cmp ebx, 0x40
jg 0x1400bcbd0
movzx eax, cl
mov rcx, rdi
sub eax, ebx
movsxd r8, ebx
movsxd rdx, eax
add rdx, rbp
call fcn.1405e5db0
sub byte [0x1409b3510], bl
jmp 0x1400bcc35
mov dword [0x1409b3490], ebp
test rsi, rsi
je 0x1400bcc43
mov rcx, rsi
call qword [0x140664450]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140109380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r15
sub rsp, 0x68
mov r15, rdx
mov rdi, rcx
movzx edx, byte [rdx]
movzx eax, dl
cmp dl, 0xb0
jne 0x14010939e
movzx eax, byte [r15 + 2]
cmp al, 0xb1
jne 0x1401093a8
mov rax, qword [r15 + 0x20]
jmp 0x1401093b8
cmp al, 0x8a
jne 0x140109537
mov rax, qword [r15 + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x140109537
mov dword [r8], 0
cmp dl, 0x8a
jne 0x1401093e2
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.140107270
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x140109522
mov qword [rsp + 0x80], rbx
lea rcx, [0x140105200]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r14
lea r13, [fcn.1401053e0]
xor r14d, r14d
mov qword [rsp + 0x98], rsi
lea edx, [r14 + 2]
cmp byte [rdi + 0x23], 0
mov rax, qword [r15 + 0x20]
mov rbx, qword [r14 + rax + 8]
je 0x140109490
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x140109480
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400fd410
cmp word [rsp + 0x44], 0
je 0x140109490
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.14010b300
jmp 0x1401094d0
mov rsi, qword [rdi]
test rbx, rbx
je 0x1401094ac
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140103be0
mov rbx, rax
cmp byte [rsi + 0x67], 0
jne 0x1401094c0
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.14010b600
test rbx, rbx
je 0x1401094d0
mov rdx, rbx
mov rcx, rsi
call fcn.140103880
inc ebp
lea rcx, [0x140105200]
add r14, 0x20
mov edx, 2
sub r12, 1
jne 0x140109440
mov eax, dword [rsp + 0x88]
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.14010b4d0
Function at 0x14010dde0
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.1401170b0
test ebx, ebx
jne 0x14010de49
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.1401170b0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140117be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x140117ce9
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x140633c90]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x140117c61
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x140117c9c
test ecx, ecx
jne 0x140117caa
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.1400bf8d0
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x140117c80
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x140117c20
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x140117caf
inc r8
jmp 0x140117c50
test r10d, r10d
jne 0x140117c79
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x140117cd5
test edx, edx
je 0x140117c61
inc rax
jmp 0x140117cc0
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x140117c79
inc rax
jmp 0x140117cc0
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140187bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1409b35e8]
mov rdi, qword [0x1409b3650]
test rax, rax
jne 0x140187e17
movdqa xmm1, xmmword [0x14063fa30]
lea r9d, [rax + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x48], xmm0
xor edx, edx
lea r8, [0x1409af960]
movdqu xmmword [rsp + 0x58], xmm1
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x48], al
mov qword [rsp + 0x58], rax
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140037c30
mov r9, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
sub r9, rbx
lea rcx, [r9 - 1]
test rcx, rcx
je 0x140187c3e
nop dword [rax + rax]
movzx eax, byte [rbx + rcx - 1]
sub byte [rbx + rcx], al
sub rcx, 1
jne 0x140187c30
xor edx, edx
test r9, r9
je 0x140187cdd
cmp r9, 0x40
jb 0x140187cbc
movdqa xmm2, xmmword [0x14063faa0]
lea rax, [rbx + 0x20]
mov rcx, r9
and rcx, 0xffffffffffffffc0
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add rdx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp rdx, rcx
jb 0x140187c62
cmp rdx, r9
jae 0x140187cdd
mov rcx, r9
lea rax, [rbx + rdx]
sub rcx, rdx
nop word [rax + rax]
xor byte [rax], 0xd9
lea rax, [rax + 1]
sub rcx, 1
jne 0x140187cd0
lea rdx, [rbx + 8]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140187cf0
lea rax, [r9 - 8]
cmp r8, rax
jb 0x140187d07
lea r8, [r9 - 9]
lea rcx, [rsp + 0x48]
call fcn.140034fd0
test rbx, rbx
je 0x140187d4b
mov rdx, qword [rsp + 0x40]
mov rax, rbx
sub rdx, rbx
cmp rdx, 0x1000
jb 0x140187d43
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140187e46
mov rcx, rbx
call fcn.14005fc58
cmp qword [rsp + 0x60], 0x10
lea rbx, [rsp + 0x48]
cmovae rbx, qword [rsp + 0x48]
call fcn.140099690
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x60]
mov qword [0x1409b35e8], rax
test rax, rax
jne 0x140187dc9
cmp rdx, 0x10
jb 0x140187db6
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140187db1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140187e46
call fcn.14005fc58
mov eax, 0xc0000138
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
cmp rdx, 0x10
jb 0x140187e04
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140187df8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140187e46
call fcn.14005fc58
mov rax, qword [0x1409b35e8]
movdqa xmm0, xmmword [0x14063fa30]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov r9d, 0x20
mov dword [rsp + 0x20], 0
lea r8, str.ChainingModeCBC
mov rcx, rdi
lea rdx, str.ChainingMode
call rax
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
call fcn.140070b34
int3