joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x1402a7d08]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0xa0], 0
mov r14, rcx
mov ebp, edx
jne 0x1400669bc
xor al, al
jmp 0x140066b9e
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.1400681b0
test al, al
je 0x140066b82
mov rax, qword [r14 + 0x48]
mov r8, rbp
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.140069660
test al, al
je 0x140066b82
mov rdx, rbx
mov rcx, rdi
call fcn.140069a10
test al, al
je 0x140066b82
mov rbx, qword [r14 + 0x40]
cmp rbx, qword [r14 + 0x48]
je 0x140066b6c
mov qword [rsp + 0x60], rsi
movabs rcx, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x140066adf
xorps xmm0, xmm0
mov qword [rsp + 0x20], rbp
cvtsi2sd xmm0, rbp
mov rdi, rcx
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x140066a80
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x140066ad4
mov rcx, rsi
call fcn.140070d30
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x140066b13
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x140066b13
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.140066990
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140066af0
cmp qword [rbx + 0x40], r12
je 0x140066b45
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x140066b45
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.140066990
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140066b22
add rbx, 0x78
movabs rcx, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x48]
jne 0x140066a50
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.140067cd0
test al, al
setne al
mov byte [r14 + 0xa0], al
jmp 0x140066b8c
mov byte [r14 + 0xa0], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140140100
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x140066bc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x1402a7d08]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0xa0], 0
mov r14, rcx
movsxd rbp, edx
jne 0x140066bed
xor al, al
jmp 0x140066dce
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.1400681b0
test al, al
je 0x140066db2
mov rax, qword [r14 + 0x48]
mov r8, rbp
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.140069860
test al, al
je 0x140066db2
mov rdx, rbx
mov rcx, rdi
call fcn.140069a10
test al, al
je 0x140066db2
mov rbx, qword [r14 + 0x40]
cmp rbx, qword [r14 + 0x48]
je 0x140066d9c
mov qword [rsp + 0x60], rsi
movabs rax, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop word [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x140066d0f
movd xmm0, ebp
mov rdi, rax
cvtdq2pd xmm0, xmm0
mov qword [rsp + 0x20], rbp
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x140066cb0
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x140066d04
mov rcx, rsi
call fcn.140070d30
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x140066d43
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x140066d43
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.140066bc0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140066d20
cmp qword [rbx + 0x40], r12
je 0x140066d75
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x140066d75
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.140066bc0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140066d52
add rbx, 0x78
movabs rax, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x48]
jne 0x140066c80
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.140067cd0
test al, al
setne al
mov byte [r14 + 0xa0], al
jmp 0x140066dbc
mov byte [r14 + 0xa0], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140140100
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x140066df0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x38
cmp byte [rcx + 0xa0], 0
mov r14, rcx
movzx esi, dl
jne 0x140066e11
xor al, al
add rsp, 0x38
pop r14
pop rsi
ret
mov qword [rsp + 0x50], rbx
call fcn.1400681b0
test al, al
je 0x140066e56
mov rax, qword [r14 + 0x48]
mov rcx, qword [rax - 0x70]
lea rbx, [rax - 0x78]
test byte [rcx + 0x58], 2
jne 0x140066e6d
call fcn.140061a00
mov ecx, 0x1000
test word [rax + 0xe], cx
jne 0x140066e52
mov rax, qword [rax + 8]
movabs rcx, 0xffffffffffff
and rax, rcx
mov qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x50]
xor al, al
mov byte [r14 + 0xa0], 0
add rsp, 0x38
pop r14
pop rsi
ret
mov rdx, rbx
call fcn.140069a10
test al, al
je 0x140066e56
mov rbx, qword [r14 + 0x40]
cmp rbx, qword [r14 + 0x48]
je 0x140066f8c
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r12
movabs r12, 0x84222325cbf29ce4
mov qword [rsp + 0x28], r13
movabs r13, 0x100000001b3
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x58], rbp
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140066ef0
mov rcx, qword [rdi + 0x18]
lea rbp, [rsi + 1]
xor rbp, r12
imul rbp, r13
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x140066ee5
mov rcx, rdi
call fcn.140070d30
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov qword [rcx], rbp
cmp qword [rbx + 0x30], r15
je 0x140066f25
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x140066f25
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, sil
cmove rcx, r15
call fcn.140066df0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140066f00
cmp qword [rbx + 0x40], r15
je 0x140066f65
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140066f65
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, sil
cmove rcx, r15
call fcn.140066df0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140066f40
add rbx, 0x78
cmp rbx, qword [r14 + 0x48]
jne 0x140066eb7
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rcx, r14
call fcn.140067cd0
mov rbx, qword [rsp + 0x50]
test al, al
setne al
mov byte [r14 + 0xa0], al
add rsp, 0x38
pop r14
pop rsi
ret

Function at 0x140067340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
movabs rax, 0x84222325cbf29ce4
xor rbx, rax
mov rdi, rcx
movabs rcx, 0x100000001b3
xor edx, edx
imul rbx, rcx
test r9, r9
je 0x140067394
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
inc rdx
xor rbx, rax
imul rbx, rcx
cmp rdx, r9
jb 0x140067380
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x1400673ae
mov rcx, rdi
call fcn.140070b70
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov al, 1
mov qword [rcx], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140068fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
movabs rax, 0x84222325cbf29ce4
xor rbx, rax
mov rdi, rcx
movabs rcx, 0x100000001b3
xor edx, edx
imul rbx, rcx
test r9, r9
je 0x140069034
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
inc rdx
xor rbx, rax
imul rbx, rcx
cmp rdx, r9
jb 0x140069020
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x14006904e
mov rcx, rdi
call fcn.140070d30
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov al, 1
mov qword [rcx], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400768d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xfff0]
mov eax, 0x100f0
call fcn.140140150
sub rsp, rax
mov rax, qword [0x1402a7d08]
xor rax, rsp
mov qword [rbp + 0xffe0], rax
mov rdi, rcx
cmp qword [rdx + 0x18], 8
jb 0x14007690e
mov rdx, qword [rdx]
lea r8, [0x140262998]
lea rcx, [rsp + 0x78]
call fcn.14020e150
mov ebx, eax
test eax, eax
jne 0x140076a18
mov r9, qword [rsp + 0x78]
test r9, r9
je 0x140076a27
xor ebx, ebx
mov dword [rbp - 0x27], ebx
mov word [rbp - 0x23], bx
mov byte [rbp - 0x21], bl
mov qword [rbp - 0x60], r9
lea rax, [rbp - 0x20]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 0x10000
mov qword [rbp - 0x38], rbx
mov byte [rbp - 0x28], bl
mov qword [rbp - 0x30], rbx
lea edx, [rbx + 1]
mov r8d, 0x10000
lea rcx, [rbp - 0x20]
call fcn.140212450
mov qword [rbp - 0x38], rax
mov rdx, qword [rbp - 0x58]
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rdx
cmp rax, qword [rbp - 0x50]
jae 0x14007699c
mov byte [rax + rdx], bl
inc qword [rbp - 0x48]
mov byte [rbp - 0x28], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
lea rax, [rbp - 0x60]
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], ebx
mov byte [rbp - 0x68], bl
lea rcx, [rbp - 0x80]
call fcn.14005c5a0
movsxd rax, dword [rbp - 0x78]
lea rcx, [0x140258e88]
mov rax, qword [rcx + rax*8]
mov qword [rbp - 0x70], rax
mov rcx, qword [rbp - 0x80]
call qword [case.0x140047660.0]
mov dword [rbp - 0x74], eax
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.140063c00
mov rcx, qword [rsp + 0x78]
call fcn.1400fc6d0
mov rcx, qword [rbp + 0xffe0]
xor rcx, rsp
call fcn.140140100
lea r11, [rsp + 0x100f0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140076a27
call fcn.1400fc6d0
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.14003d7d0
nop
mov r8, rax
lea rdx, str.Could_not_open_json_file._Status:
lea rcx, [rsp + 0x58]
call fcn.140041f90
nop
mov rcx, rax
call fcn.140006310
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140002250
lea rdx, [0x1402a3de8]
lea rcx, [rsp + 0x20]
call fcn.140132d3c
int3
Function at 0x140078a60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x30], 0
jne 0x140078b05
lea rsi, [0x1402b05f8]
mov qword [rsp + 0x20], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov byte [rsp + 0x28], 1
cmp qword [0x1402b05f0], 0
jne 0x140078ab8
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [0x1402b0640]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
call qword [case.0x140047660.0]
mov ecx, eax
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rdi, rax
mov rcx, qword [0x1402b05f0]
mov rbx, qword [rcx + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp rbx, rdi
je 0x140078b05
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007bd20
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1402a7d08]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
mov rcx, qword [0x1402b0640]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x140047660.0]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x58], rcx
lea r14, vtable.SqliteStatement.0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x30], ecx
add rax, 0x10
mov qword [rsp + 0x38], rax
lea rdx, str.SELECT_PIN_ACTION_FROM_PINNED_APPLICATIONS_WHERE_FILE_ID___file_id
mov qword [rsp + 0x40], rdx
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x58], cl
lea r8d, [rcx + 6]
lea rcx, str.SELECT
call fcn.1400e0530
movzx ecx, byte [rsp + 0x58]
mov edx, 1
test eax, eax
cmove ecx, edx
mov byte [rsp + 0x58], cl
lea rax, vtable.TransactionSafeStatement.0
mov qword [rsp + 0x28], rax
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14002ab90
mov ebx, eax
test eax, eax
jne 0x14007bdf4
lea rcx, [rsp + 0x28]
call fcn.14002afe0
mov ebx, eax
lea rsi, [0x1402aa8a0]
cmp ebx, 0x64
jne 0x14007be3c
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14002ae70
mov ebx, eax
test eax, eax
je 0x14007be6f
mov rcx, qword [0x1402aa8a0]
cmp rcx, rsi
je 0x14007be76
test dword [rcx + 0x44], 0x20000
je 0x14007be76
cmp byte [rcx + 0x41], 2
jb 0x14007be76
mov edx, 0x12
mov r9d, eax
jmp 0x14007be5f
mov rcx, qword [0x1402aa8a0]
cmp rcx, rsi
je 0x14007be76
test dword [rcx + 0x44], 0x20000
je 0x14007be76
cmp byte [rcx + 0x41], 2
jb 0x14007be76
mov edx, 0x13
mov r9d, ebx
lea r8, [0x14022e8d8]
mov rcx, qword [rcx + 0x38]
call fcn.1400388f0
mov rcx, qword [0x1402aa8a0]
mov edi, dword [rsp + 0x20]
cmp edi, 3
jbe 0x14007beb1
cmp rcx, rsi
je 0x14007beab
test dword [rcx + 0x44], 0x20000
je 0x14007beab
cmp byte [rcx + 0x41], 2
jb 0x14007beab
mov edx, 0x14
mov r9d, ebx
lea r8, [0x14022e8d8]
mov rcx, qword [rcx + 0x38]
call fcn.1400388f0
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.14002b160
nop
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140140100
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14007e710
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 0x410]
xorps xmm0, xmm0
mov qword [rsp + 0x38], rbp
mov rsi, rcx
mov qword [rsp + 0x40], rdi
mov rbp, rdx
mov qword [rsp + 0x48], r14
xor r14d, r14d
mov rdi, qword [rcx + rax*8 + 0x418]
mov qword [rdi], r14
mov dword [rdi + 8], r14d
mov qword [rdi + 0x28], r14
movups xmmword [rdi + 0x18], xmm0
mov rcx, qword [rdi + 0x2c0]
mov dword [rdi + 0x248], 4
mov word [rdi + 0x48], r14w
mov qword [rdi + 0x2c0], r14
test rcx, rcx
je 0x14007e78c
mov qword [rsp + 0x30], rbx
mov rbx, qword [rcx + 0x40]
call fcn.1400e1604
mov rcx, rbx
test rbx, rbx
jne 0x14007e776
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + 0x280]
mov qword [rdi + 0x268], r14
mov qword [rdi + 0x2e0], rax
mov rdx, rbp
mov qword [rax + 0x40], r14
mov dword [rax + 0x48], r14d
mov dword [rax + 0x4c], 1
mov dword [rdi + 0x270], r14d
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], 0xffffffffffffffff
mov qword [rax + 0x28], 0xffffffffffffffff
mov qword [rax + 0x30], 0xffffffffffffffff
mov qword [rax + 0x38], 0xffffffffffffffff
mov r8, qword [rsi + 0x410]
mov rcx, qword [rsi + 8]
mov r8, qword [rsi + r8*8 + 0x418]
call fcn.1400be580
mov r14, qword [rsp + 0x48]
test eax, eax
mov rax, qword [rsi + 0x410]
mov rdi, qword [rsp + 0x40]
sete cl
mov byte [rsi + rax + 0x818], cl
mov rax, qword [rsi + 0x410]
mov qword [rsi + rax*8 + 0x10], rbp
inc qword [rsi + 0x410]
mov rcx, qword [rsi + 0x410]
mov rax, qword [section..data]
mov rbp, qword [rsp + 0x38]
cmp rcx, rax
jb 0x14007e866
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14007dd00
add rsp, 0x20
pop rsi
ret

Function at 0x1400809a0
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + 8]
mov rdi, rdx
test rsi, rsi
je 0x140080a0b
lea rbx, [rdx + 8]
test rbx, rbx
je 0x140080a0b
cmp byte [rcx + 0x4c], 0
je 0x140080a0b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.DLL_IsValidSid]
test eax, eax
je 0x140080a0b
cmp byte [rdi + 0x4c], 0
je 0x140080a0b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_IsValidSid]
test eax, eax
je 0x140080a0b
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.DLL_EqualSid]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140084010
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov esi, r9d
mov rbp, r8
mov rbx, rcx
mov qword [rcx], rdx
mov byte [rcx + 8], 0
movzx eax, byte [rsp + 0x60]
mov byte [rcx + 9], al
mov qword [rcx + 0x10], 0
movzx eax, byte [rsp + 0x68]
mov byte [rcx + 0x20], al
mov qword [rcx + 0x28], r8
mov dword [rcx + 0x30], r9d
lea r9, [0x14022e9d0]
mov r8d, esi
mov rdx, rbp
call fcn.1400bc8e0
mov rcx, qword [0x1402b0640]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
call qword [case.0x140047660.0]
mov ecx, eax
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400840ab
xor r8d, r8d
lea rdx, str.Retrieving_thread_context_failed._Queuing
mov rcx, rbx
call fcn.1400bc870
jmp 0x1400841af
mov edi, 0x65
lea r14, [0x1402b05f8]
mov qword [rsp + 0x20], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov byte [rsp + 0x28], 1
cmp byte [rbx + 9], 0
je 0x1400840f9
mov rax, qword [0x1402b05e8]
test rax, rax
jne 0x1400840ec
mov qword [0x1402b05e0], rbx
mov qword [0x1402b05e8], rbx
jmp 0x140084119
mov qword [rax + 0x10], rbx
mov qword [0x1402b05e8], rbx
jmp 0x140084119
mov rax, qword [0x1402b05d8]
test rax, rax
jne 0x14008410e
mov qword [0x1402b05d0], rbx
jmp 0x140084112
mov qword [rax + 0x10], rbx
mov qword [0x1402b05d8], rbx
mov rax, qword [0x1402b05b0]
inc rax
mov qword [0x1402b05b0], rax
cmp byte [0x1402b05c8], 0
jne 0x14008413d
mov rcx, rbx
call fcn.14007e640
mov edi, eax
mov byte [rsp + 0x28], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp edi, 0x65
je 0x140084162
mov r8d, edi
lea rdx, str.Begin
mov rcx, rbx
call fcn.1400bc870
lea r9, str.WAITTING
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1400bc8e0
mov rax, qword [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea r9, str.ENTERED
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1400bc8e0
mov rax, qword [0x1402b05c0]
inc rax
mov qword [0x1402b05c0], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140087ed0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rsp + 0x28], rcx
lea rax, vtable.Component.0
mov qword [rcx], rax
mov dword [rcx + 8], 0xffffffff
xor esi, esi
mov dword [rcx + 0xc], esi
mov qword [rcx + 0x18], rdx
lea rax, [r8 + 0x98]
test r8, r8
cmove rax, rsi
mov qword [rcx + 0x20], rax
lea rax, vtable.PinningController.0
mov qword [rcx], rax
lea rax, vtable.PinningController.1.0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x28], r8
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rdx
lea rbx, [rcx + 0x40]
mov qword [rsp + 0x20], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
lea ecx, [rsi + 0x50]
call fcn.140008f80
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rcx, [rbx + 0x10]
mov edx, 0x80000400
call qword [sym.imp.KERNEL32.DLL_InitializeCriticalSectionAndSpinCount]
lea rax, str.pinning_sequence_number
mov qword [rdi + 0x78], rax
mov qword [rdi + 0x80], rsi
mov rax, qword [rdi + 0x38]
add rax, 0x10
lea rcx, vtable.SqliteStatement.0
mov qword [rdi + 0x88], rcx
mov dword [rdi + 0x90], esi
mov qword [rdi + 0x98], rax
lea rdx, str._SELECT_SUM_VALUE_________SELECT_VALUE_FROM_STATISTICS_WHERE_ID__1_________SELECT_SUM_CLUSTERS__FROM_SEGMENTS_WHERE______________FILE_ID__0xFFFFFF___32__OR_______________FILE_ID_IN__SELECT_FILE_ID_FROM_SYSTEM_FILES____AND___________SEGMENT_ID__0_____FROM_STATISTICS__WHERE_ID__6_OR_ID__7
mov qword [rdi + 0xa0], rdx
mov qword [rdi + 0xa8], rsi
mov qword [rdi + 0xb0], rsi
mov byte [rdi + 0xb8], sil
lea r8d, [rsi + 6]
lea rcx, str.SELECT
call fcn.1400e0530
test eax, eax
jne 0x140087fe2
mov byte [rdi + 0xb8], 1
lea rax, vtable.TransactionSafeStatement.0
mov qword [rdi + 0x88], rax
mov edx, 0x80000400
lea rcx, [rdi + 0xc0]
call qword [sym.imp.KERNEL32.DLL_InitializeCriticalSectionAndSpinCount]
mov qword [rdi + 0xe8], rsi
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14008ff40
Capabilities:
Listen for remote procedure calls

Disassembly:
sub rsp, 0x28
mov r8d, 1
mov edx, 0x4d2
mov ecx, r8d
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
test eax, eax
jne 0x14008ff61
add rsp, 0x28
ret
mov rcx, qword [0x1402aa8a0]
lea rdx, [0x1402aa8a0]
cmp rcx, rdx
je 0x14008ff9b
test dword [rcx + 0x44], 0x400000
je 0x14008ff9b
cmp byte [rcx + 0x41], 2
jb 0x14008ff9b
mov rcx, qword [rcx + 0x38]
lea r8, [0x140230970]
mov edx, 0x1a
mov r9d, eax
call fcn.140026630
mov eax, 0x1f
add rsp, 0x28
ret
Function at 0x14009ef00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402a7d08]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov qword [rsp + 0x30], 0
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov rsi, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14009ef95
mov rdx, qword [rsi + 8]
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 4
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x14009ef95
mov eax, dword [rsp + 0x38]
mov dword [rdi], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140140100
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret