joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003c6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180113150
mov r9, rbx
lea r8, str.CLSID_sInprocServer32
mov edx, 0x103
lea rcx, [rsp + 0x40]
call fcn.18000f870
lea rax, [rsp + 0x30]
mov r9d, 0x101
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000000
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18003c79e
mov qword [rsp + 0x488], rdi
lea rcx, [rsp + 0x250]
mov edi, 1
xor edx, edx
mov r8d, 0x208
mov dword [rsp + 0x3c], edi
call fcn.180113150
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x250]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18003c78b
xor edx, edx
lea rcx, [rsp + 0x250]
call fcn.18012561c
cmp eax, 0xffffffff
cmovne ebx, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x488]
mov eax, ebx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x470
pop rbx
ret
Function at 0x18003c840
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
mov dword [rbp - 0x31], 0x67452301
xor esi, esi
mov dword [rbp - 0x2d], 0xefcdab89
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x39], rsi
mov ebx, r8d
mov dword [rbp - 0x29], 0x98badcfe
mov dword [rbp - 0x25], 0x10325476
call fcn.180030bd0
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x39]
call fcn.180030ca0
movzx ecx, byte [rdi + 0x13]
movzx eax, byte [rbp + 0x36]
add ecx, eax
movzx eax, byte [rbp + 0x35]
mov byte [rdi + 0x13], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 0x12]
add ecx, eax
mov byte [rdi + 0x12], cl
movzx eax, byte [rdi + 0x11]
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp + 0x34]
add ecx, eax
movzx eax, byte [rbp + 0x33]
mov byte [rdi + 0x11], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 0x10]
add ecx, eax
movzx eax, byte [rbp + 0x32]
mov byte [rdi + 0x10], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 0xf]
add ecx, eax
movzx eax, byte [rbp + 0x31]
mov byte [rdi + 0xf], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 0xe]
add ecx, eax
movzx eax, byte [rbp + 0x30]
mov byte [rdi + 0xe], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 0xd]
add ecx, eax
movzx eax, byte [rbp + 0x2f]
mov byte [rdi + 0xd], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 0xc]
add ecx, eax
movzx eax, byte [rbp + 0x2e]
mov byte [rdi + 0xc], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 0xb]
add ecx, eax
movzx eax, byte [rbp + 0x2d]
mov byte [rdi + 0xb], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 0xa]
add ecx, eax
movzx eax, byte [rbp + 0x2c]
mov byte [rdi + 0xa], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 9]
add ecx, eax
movzx eax, byte [rbp + 0x2b]
mov byte [rdi + 9], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 8]
add ecx, eax
movzx eax, byte [rbp + 0x2a]
mov byte [rdi + 8], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 7]
add ecx, eax
movzx eax, byte [rbp + 0x29]
mov byte [rdi + 7], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 6]
add ecx, eax
movzx eax, byte [rbp + 0x28]
mov byte [rdi + 6], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rdi + 5]
add ecx, eax
movzx eax, byte [rbp + 0x27]
mov byte [rdi + 5], cl
shr ecx, 8
add ecx, eax
add byte [rdi + 4], cl
mov ecx, dword [rdi]
sub ecx, ebx
cmp dword [rdi], ebx
cmovb ecx, esi
xor eax, eax
mov dword [rdi], ecx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003ca90
Capabilities:
Hash data with md5

Disassembly:
push rsi
push r12
push r14
sub rsp, 0xb0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp dword [r8], 0
mov r14, r8
mov esi, edx
mov r12, rcx
je 0x18003cac7
mov eax, 0x408
jmp 0x18003cc3d
mov qword [rsp + 0xa8], rbp
mov ebp, dword [r8 + 0x14]
mov qword [rsp + 0x90], r15
mov r15d, 0x10
cmp edx, ebp
jbe 0x18003cc0d
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], r13
mov eax, r15d
mov r8d, ebp
sub eax, ebp
mov ebx, ebp
lea rdx, [r14 + 0x18]
mov rcx, r12
add rdx, rax
call fcn.180112cb0
add r12, rbx
mov dword [rsp + 0x28], 0x67452301
xor ebx, ebx
mov dword [rsp + 0x2c], 0xefcdab89
mov r8d, r15d
mov qword [rsp + 0x20], rbx
lea rdx, [r14 + 4]
mov dword [rsp + 0x30], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x34], 0x10325476
sub esi, ebp
call fcn.180030bd0
lea rdx, [r14 + 0x18]
lea rcx, [rsp + 0x20]
call fcn.180030ca0
mov eax, ebx
mov ebp, r15d
nop word [rax + rax]
mov ecx, 0xf
sub ecx, eax
mov edx, ecx
movzx r8d, byte [rcx + r14 + 4]
lea ecx, [r8 + 1]
mov byte [rdx + r14 + 4], cl
test r8b, r8b
jne 0x18003cbec
mov ecx, 0xe
sub ecx, eax
mov edx, ecx
movzx r8d, byte [rcx + r14 + 4]
lea ecx, [r8 + 1]
mov byte [rdx + r14 + 4], cl
test r8b, r8b
jne 0x18003cbec
mov ecx, 0xd
sub ecx, eax
mov edx, ecx
movzx r8d, byte [rcx + r14 + 4]
lea ecx, [r8 + 1]
mov byte [rdx + r14 + 4], cl
test r8b, r8b
jne 0x18003cbec
mov ecx, 0xc
sub ecx, eax
mov edx, ecx
movzx r8d, byte [rcx + r14 + 4]
lea ecx, [r8 + 1]
mov byte [rdx + r14 + 4], cl
test r8b, r8b
jne 0x18003cbec
add eax, 4
cmp eax, r15d
jb 0x18003cb70
cmp esi, r15d
ja 0x18003cb01
mov r13, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xe8]
sub r15d, ebp
mov r8d, esi
mov eax, r15d
lea rdx, [r14 + 0x18]
add rdx, rax
mov rcx, r12
call fcn.180112cb0
mov r15, qword [rsp + 0x90]
sub ebp, esi
mov dword [r14 + 0x14], ebp
xor eax, eax
mov rbp, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0xb0
pop r14
pop r12
pop rsi
ret
Function at 0x180041180
Capabilities:
Get volume information via ioctl
Read file on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rcx + 0x260]
mov qword [rsp + 0x38], 0
mov rbx, rcx
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov edx, 0x90064
mov dword [rsp + 0x28], 0x60
mov rcx, qword [rbx + 0x250]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800412ed
mov edx, dword [rbx + 0x28c]
xor r9d, r9d
imul rdx, qword [rbx + 0x2a0]
mov rcx, qword [rbx + 0x250]
xor r8d, r8d
mov qword [rbx + 0x2c8], rdx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800412ed
mov rdx, qword [rbx + 0x2d8]
test rdx, rdx
jne 0x180041239
mov ecx, dword [rbx + 0x290]
call fcn.1800f30bc
mov qword [rbx + 0x2d8], rax
mov rdx, rax
test rax, rax
je 0x1800412ed
mov r8d, dword [rbx + 0x290]
lea r9, [rsp + 0x40]
mov rcx, qword [rbx + 0x250]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800412ed
mov rdx, qword [rbx + 0x2d8]
mov rcx, rbx
call sym.SafeBase64.dll_private:_int___cdecl_CScanNTFS::fixFileRecord_struct__MFTRecodeHeader____ptr64____ptr64
mov rax, qword [rbx + 0x2d8]
mov edx, 1
movzx ecx, word [rax + 0x14]
mov r8d, dword [rax + 0x1c]
add rcx, rax
cmp r8d, edx
jbe 0x1800412ab
nop
mov eax, dword [rcx]
cmp eax, 0x80
je 0x1800412ad
cmp eax, 0xffffffff
je 0x1800412ab
mov eax, dword [rcx + 4]
inc edx
add rcx, rax
cmp edx, r8d
jb 0x180041290
xor ecx, ecx
mov qword [rbx + 0x2e0], rcx
test rcx, rcx
je 0x1800412ed
mov rax, qword [rcx + 0x30]
xor edx, edx
mov ecx, dword [rbx + 0x290]
mov qword [rbx + 0x2c0], rax
div rcx
mov dword [rbx + 0x2d0], eax
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x50
pop rbx
ret
Function at 0x180041310
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
mov rbx, r9
mov edx, dword [rcx + 0x28c]
mov rsi, rcx
mov rcx, qword [rcx + 0x250]
xor r9d, r9d
imul rdx, r8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test rbx, rbx
je 0x18004141e
mov r14d, 0x2800
xor r15d, r15d
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsi + 0x250]
lea r9, [rsp + 0x30]
cmp rbx, r14
mov qword [rsp + 0x20], r15
mov edi, ebx
mov rdx, rbp
cmova edi, r14d
mov r8d, edi
imul r8d, dword [rsi + 0x28c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18004143d
mov r8d, dword [rsp + 0x30]
mov rdx, rbp
mov rcx, rsi
call sym.SafeBase64.dll_private:_void___cdecl_CScanNTFS::processMFTBuffer_unsigned_char____ptr64__unsigned_long_int____ptr64
mov eax, edi
sub rbx, rax
cmp dword [rsi + 0x220], r15d
jne 0x18004141e
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, dword [rsp + 0x3c]
mul ecx
shr edx, 6
cmp edx, 0xa
jae 0x1800413f9
mov ecx, 0xc8
jmp 0x18004140f
cmp edx, 0x14
jae 0x180041405
mov ecx, 0x64
jmp 0x18004140f
cmp edx, 0x1e
jae 0x180041415
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
jne 0x180041370
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x180041423
Function at 0x180044bc0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x830
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x800
call fcn.180113150
lea rdx, [rsp + 0x20]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x180044c7b
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [rbx + 0x33c], eax
mov ecx, eax
cmp eax, 0x1a
jbe 0x180044c30
mov dword [rbx + 0x33c], 0x1a
mov ecx, 0x1a
xor eax, eax
test ecx, ecx
je 0x180044c61
nop word [rax + rax]
lea r8d, [rax*4]
movzx r8d, word [rsp + r8*2 + 0x20]
mov word [rbx + rax*2 + 0x308], r8w
inc eax
cmp eax, dword [rbx + 0x33c]
jb 0x180044c40
lea r8, [rbx + 0x308]
mov edx, 0x1a
mov rcx, rdi
call fcn.1801259f0
mov eax, dword [rbx + 0x33c]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x850]
add rsp, 0x830
pop rdi
ret
Function at 0x180046b00
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov r15d, r8d
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
je 0x180046c43
mov ecx, 0x348
call fcn.1800f3074
mov rbx, rax
test rax, rax
je 0x180046c43
xor edx, edx
mov r8d, 0x348
mov rcx, rax
call fcn.180113150
mov rcx, rbx
call sym.SafeBase64.dll_public:_void___cdecl_CSearchFile::constructor_void____ptr64
mov rbx, rax
test rax, rax
je 0x180046c43
mov qword [rsp + 0x50], rsi
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x58], r12
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x180046b73
xor r12d, r12d
cmp rcx, 3
ja 0x180046bba
cmp word [rdi + 2], 0x3a
jne 0x180046bba
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 1
ja 0x180046bba
movzx edx, word [rdi]
xor r9d, r9d
mov r8, rbp
mov qword [rsp + 0x20], r12
mov rcx, rbx
call sym.SafeBase64.dll_public:_int___cdecl_CScanNTFS::ScanMFTFiles_wchar_t__wchar_t_const____ptr64__int____cdecl___struct__scanFileInfo____ptr64__void____ptr64___void____ptr64____ptr64
mov esi, eax
test eax, eax
jne 0x180046c15
mov rdx, rbp
mov dword [rbx + 0x220], r12d
mov rcx, rbx
call sym.SafeBase64.dll_public:_void___cdecl_CPattern::InitPattern_wchar_t_const____ptr64____ptr64
mov r9d, r15d
mov qword [rsp + 0x28], r12
mov r8, rbp
mov qword [rbx + 0x224], r12
mov rdx, rdi
mov qword [rbx + 0x230], r12
mov rcx, rbx
mov qword [rbx + 0x238], r12
mov qword [rsp + 0x20], r12
call sym.SafeBase64.dll_public:_int___cdecl_CSearchFile::FindFolder_wchar_t_const____ptr64__wchar_t_const____ptr64__int__int____cdecl___struct__scanFileInfo____ptr64__void____ptr64___void____ptr64____ptr64
mov esi, eax
test eax, eax
jne 0x180046c15
mov eax, dword [rbx + 0x224]
mov esi, r12d
test eax, eax
setne sil
test eax, eax
je 0x180046c2d
mov eax, dword [rbx + 0x228]
mov dword [r14], eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbx + 0x238]
mov qword [rax], rcx
mov rcx, rbx
call fcn.180046ab0
mov r12, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x50]
jmp 0x180046c45
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180048050
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r8d, dword [rcx + 0x58]
mov r14, rdx
mov rbx, rcx
cmp r8d, 0x40
jne 0x180048096
lea rdx, [rcx + 0x18]
call fcn.180046d00
inc dword [rbx + 0x14]
mov r9d, dword [rbx + 0x14]
xor r8d, r8d
mov dword [rbx + 0x58], 0
jmp 0x18004809a
mov r9d, dword [rcx + 0x14]
mov esi, r9d
shr r9d, 0x1a
shl esi, 6
mov ecx, esi
add esi, r8d
mov edx, esi
mov eax, esi
shl esi, 3
lea ebp, [r9 + 1]
cmp edx, ecx
movsxd rax, r8d
cmovae ebp, r9d
shr edx, 0x1d
shl ebp, 3
mov byte [rax + rbx + 0x18], 0x80
or ebp, edx
mov eax, dword [rbx + 0x58]
inc eax
mov dword [rbx + 0x58], eax
cmp r8d, 0x38
jge 0x1800480f4
cmp eax, 0x38
jge 0x180048148
nop dword [rax]
cdqe
mov byte [rax + rbx + 0x18], 0
inc dword [rbx + 0x58]
mov eax, dword [rbx + 0x58]
cmp eax, 0x38
jl 0x1800480e0
jmp 0x180048148
cmp eax, 0x40
jge 0x180048112
nop dword [rax]
cdqe
mov byte [rax + rbx + 0x18], 0
inc dword [rbx + 0x58]
mov eax, dword [rbx + 0x58]
cmp eax, 0x40
jl 0x180048100
jne 0x18004812a
lea rdx, [rbx + 0x18]
mov rcx, rbx
call fcn.180046d00
inc dword [rbx + 0x14]
mov dword [rbx + 0x58], 0
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], rax
mov eax, ebp
mov byte [rbx + 0x53], bpl
shr eax, 0x18
lea rdx, [rbx + 0x18]
mov byte [rbx + 0x50], al
mov rcx, rbx
mov eax, ebp
mov byte [rbx + 0x57], sil
shr eax, 0x10
mov byte [rbx + 0x51], al
mov eax, ebp
shr eax, 8
mov byte [rbx + 0x52], al
mov eax, esi
shr eax, 0x18
mov byte [rbx + 0x54], al
mov eax, esi
shr eax, 0x10
mov byte [rbx + 0x55], al
mov eax, esi
shr eax, 8
mov byte [rbx + 0x56], al
call fcn.180046d00
movzx eax, byte [rbx + 3]
mov byte [r14], al
movzx eax, byte [rbx + 2]
mov byte [r14 + 1], al
mov eax, dword [rbx]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
shr eax, 8
mov byte [r14 + 2], al
movzx eax, byte [rbx]
mov byte [r14 + 3], al
movzx eax, byte [rbx + 7]
mov byte [r14 + 4], al
movzx eax, byte [rbx + 6]
mov byte [r14 + 5], al
mov eax, dword [rbx + 4]
shr eax, 8
mov byte [r14 + 6], al
movzx eax, byte [rbx + 4]
mov byte [r14 + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [r14 + 8], al
movzx eax, byte [rbx + 0xa]
mov byte [r14 + 9], al
mov eax, dword [rbx + 8]
shr eax, 8
mov byte [r14 + 0xa], al
movzx eax, byte [rbx + 8]
mov byte [r14 + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [r14 + 0xc], al
movzx eax, byte [rbx + 0xe]
mov byte [r14 + 0xd], al
mov eax, dword [rbx + 0xc]
shr eax, 8
mov byte [r14 + 0xe], al
movzx eax, byte [rbx + 0xc]
mov byte [r14 + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [r14 + 0x10], al
movzx eax, byte [rbx + 0x12]
mov byte [r14 + 0x11], al
mov eax, dword [rbx + 0x10]
shr eax, 8
mov byte [r14 + 0x12], al
movzx eax, byte [rbx + 0x10]
mov rbx, qword [rsp + 0x30]
mov byte [r14 + 0x13], al
add rsp, 0x20
pop r14
ret
Function at 0x180048250
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov dword [rsp + 0x20], 0x67452301
mov rbx, r8
mov dword [rsp + 0x24], 0xefcdab89
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x78], eax
call fcn.180047f40
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180048050
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x90
pop rbx
ret

Function at 0x1800482e0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x67452301
mov rbx, r8
mov dword [rsp + 0x24], 0xefcdab89
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x78], eax
call fcn.180047f40
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.180048050
lea rdi, [rsp + 0x80]
mov esi, 0x14
movzx r8d, byte [rdi]
lea rdx, str._02x
mov rcx, rbx
call fcn.180010dc0
add rbx, 2
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x180048361
mov byte [rbx], sil
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
ret
Function at 0x180082310
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.18004cc10
mov rbx, rax
test rax, rax
jne 0x18008234e
lea eax, [rbx + 7]
jmp 0x1800823d5
cmp dword [0x1801862f4], 0
je 0x1800823a2
mov rax, qword [0x180186488]
test rax, rax
je 0x18008236e
mov ecx, 0xc8
call rax
test eax, eax
jne 0x1800823a2
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x18004fbb0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call fcn.180127c88
mov qword [rbx], rax
test rax, rax
jne 0x1800823b7
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x1800823d0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800911b0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
lea r9, str.sqlite_master
mov rdi, rdx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.180097bb0
test ebx, ebx
jne 0x180091204
mov r9, rdi
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.180097bb0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180097de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
lea r14, [0x180150a50]
mov rdi, rdx
mov rbp, rcx
xor ebx, ebx
cmp dword [rbp + 0x28], ebx
jle 0x180097ea8
nop dword [rax]
mov r9d, ebx
xor r9d, 1
cmp ebx, 2
cmovge r9d, ebx
test rsi, rsi
je 0x180097e75
mov rax, qword [rbp + 0x20]
mov r8, rsi
movzx edx, byte [rsi]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax]
movzx eax, byte [rdx + r14]
movzx ecx, byte [r10]
movzx ecx, byte [rcx + r14]
sub eax, ecx
jne 0x180097e9d
sub r10, rsi
nop dword [rax]
test dl, dl
je 0x180097e71
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx ecx, byte [rax + r14]
movzx edx, byte [r8]
movzx eax, byte [rdx + r14]
sub eax, ecx
je 0x180097e50
jmp 0x180097e9d
test eax, eax
jne 0x180097e9d
mov rax, qword [rbp + 0x20]
xor r8d, r8d
movsxd rcx, r9d
mov rdx, rdi
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.180051b60
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x180097ee0
inc ebx
cmp ebx, dword [rbp + 0x28]
jl 0x180097e10
movzx edx, byte [rdi]
cmp byte [rdx + r14], 0x73
jne 0x180097ede
lea r8, str.sqlite_master
sub r8, rdi
nop dword [rax]
test dl, dl
je 0x180097ef3
movzx eax, byte [r8 + rdi + 1]
inc rdi
movzx ecx, byte [rax + r14]
movzx edx, byte [rdi]
movzx eax, byte [rdx + r14]
cmp eax, ecx
je 0x180097ec0
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rbp + 0x20]
mov r9, qword [rax + 0x20]
test rsi, rsi
jne 0x180097f07
neg r9
sbb eax, eax
jmp 0x180097f46
test r9, r9
je 0x180097ede
movzx eax, byte [r9]
mov r8, rsi
movzx edx, byte [rsi]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx + r14]
sub eax, ecx
jne 0x180097f46
sub r9, rsi
test dl, dl
je 0x180097f46
movzx eax, byte [r9 + r8 + 1]
inc r8
movzx ecx, byte [rax + r14]
movzx edx, byte [r8]
movzx eax, byte [rdx + r14]
sub eax, ecx
je 0x180097f27
test eax, eax
jne 0x180097ede
lea rdi, str.sqlite_temp_master
jmp 0x180097e02
Function at 0x1800982a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor r10d, r10d
mov rdi, r8
mov ebx, r10d
mov rbp, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x180098385
mov qword [rsp + 0x30], r14
lea r14, [0x180150a50]
nop dword [rax + rax]
mov eax, ebx
xor eax, 1
cmp ebx, 2
cmovge eax, ebx
movsxd rcx, eax
mov rax, qword [rsi + 0x20]
shl rcx, 5
mov r11, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x180098345
mov r9, qword [rcx + rax]
mov r8, rdi
movzx edx, byte [rdi]
movzx eax, byte [r9]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx + r14]
sub eax, ecx
jne 0x18009835d
sub r9, rdi
nop
test dl, dl
je 0x180098341
movzx eax, byte [r9 + r8 + 1]
inc r8
movzx ecx, byte [rax + r14]
movzx edx, byte [r8]
movzx eax, byte [rdx + r14]
sub eax, ecx
je 0x180098320
jmp 0x18009835d
test eax, eax
jne 0x18009835d
lea rcx, [r11 + 0x20]
xor r8d, r8d
mov rdx, rbp
call fcn.180051b60
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x180098368
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1800982e0
mov r14, qword [rsp + 0x30]
mov rax, r10
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, r10
jmp 0x180098370