joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f4890
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov r12, r8
mov rbp, rdx
mov rdi, rcx
cmp dword [rcx + 0x40], ebx
jne 0x1800f48cb
cmp qword [rcx + 0x20], rbx
jne 0x1800f48cb
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
lea rdx, str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
call fcn.1800f4780
mov qword [rdi + 0x20], rax
cmp dword [rdi + 0x40], ebx
jne 0x1800f4993
mov rcx, qword [rdi + 0x20]
mov r8, rbp
mov edx, 1
call sym.sqlite.dll_sqlite3_bind_int64
mov rcx, qword [rdi + 0x20]
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f4966
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r14
call sym.sqlite.dll_sqlite3_column_bytes
mov rcx, qword [rdi + 0x20]
xor edx, edx
movsxd r13, eax
call sym.sqlite.dll_sqlite3_column_blob
mov r14, rax
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x1800f493c
test r13d, r13d
je 0x1800f4937
mov rcx, r13
call fcn.18000be40
mov rbx, rax
test rbx, rbx
jne 0x1800f4945
mov dword [rdi + 0x40], 7
jmp 0x1800f4957
mov r8, r13
mov rdx, r14
mov rcx, rbx
call fcn.180128750
mov dword [r12], r13d
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rdi + 0x20]
call sym.sqlite.dll_sqlite3_reset
cmp dword [rdi + 0x40], 0
jne 0x1800f4993
mov dword [rdi + 0x40], eax
test eax, eax
jne 0x1800f4993
test rbx, rbx
jne 0x1800f4993
lea rdx, str.Node__lld_missing_from_database
mov r8, rbp
mov rcx, rdi
call fcn.1800f4810
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x1800f49b0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r13, edx
mov rbp, r9
mov rdi, qword [rcx + r13*8 + 0x28]
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
mov r12, r8
mov rbx, rcx
test rdi, rdi
jne 0x1800f4a10
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov rdx, qword [rsp + r13*8 + 0x40]
call fcn.1800f4780
mov rdi, rax
mov qword [rbx + r13*8 + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x1800f4ac6
mov r8, r12
mov edx, 1
mov rcx, rdi
call sym.sqlite.dll_sqlite3_bind_int64
mov rcx, rdi
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x65
jne 0x1800f4a68
lea rdx, str.__rowid
test r13d, r13d
lea rcx, str.__parent
cmovne rcx, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov r8, r12
call fcn.1800f4810
jmp 0x1800f4ab5
cmp eax, 0x64
jne 0x1800f4ab5
xor edx, edx
mov rcx, rdi
call sym.sqlite.dll_sqlite3_column_int64
cmp rax, rbp
je 0x1800f4ab5
lea rdx, str.__rowid
test r13d, r13d
mov qword [rsp + 0x30], rbp
lea rcx, str.__parent
mov qword [rsp + 0x28], r12
mov r9, rax
cmovne rcx, rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov r8, r12
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.1800f4810
mov rcx, rdi
call sym.sqlite.dll_sqlite3_reset
cmp dword [rbx + 0x40], 0
jne 0x1800f4ac6
mov dword [rbx + 0x40], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x1800f4c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov esi, edx
lea r8, [rsp + 0x30]
xor edi, edi
mov rdx, r9
mov rbp, r9
mov rbx, rcx
mov dword [rsp + 0x30], edi
call fcn.1800f4890
mov rdx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800f4e04
mov ecx, dword [rsp + 0x30]
cmp ecx, 4
jge 0x1800f4cca
mov r9d, ecx
lea rdx, str.Node__lld_is_too_small___d_bytes_
mov r8, rbp
mov rcx, rbx
call fcn.1800f4810
mov rdx, qword [rsp + 0x38]
jmp 0x1800f4dfc
mov r8, qword [rsp + 0x80]
test r8, r8
jne 0x1800f4d04
movzx esi, byte [rax]
movzx eax, byte [rax + 1]
shl esi, 8
add esi, eax
cmp esi, 0x28
jle 0x1800f4d04
lea rdx, str.Rtree_depth_out_of_range___d_
mov r8d, esi
mov rcx, rbx
call fcn.1800f4810
mov rcx, qword [rsp + 0x38]
jmp 0x1800f4dff
movzx eax, byte [rdx + 3]
movzx ebp, byte [rdx + 2]
shl ebp, 8
add ebp, eax
mov eax, dword [rbx + 0x1c]
inc eax
imul eax, ebp
lea eax, [rax*8 + 4]
cmp eax, ecx
jle 0x1800f4d4c
mov r8, qword [rsp + 0x88]
mov dword [rsp + 0x20], ecx
lea rdx, str.Node__lld_is_too_small_for_cell_count_of__d___d_bytes_
mov r9d, ebp
mov rcx, rbx
call fcn.1800f4810
mov rdx, qword [rsp + 0x38]
jmp 0x1800f4dfc
test ebp, ebp
jle 0x1800f4dfc
nop word [rax + rax]
mov eax, dword [rbx + 0x1c]
mov qword [rsp + 0x20], r8
mov r8d, edi
inc eax
imul eax, edi
lea eax, [rax*8 + 4]
movsxd rcx, eax
mov rax, qword [rcx + rdx]
bswap rax
mov qword [rsp + 0x30], rax
lea rax, [rcx + rdx + 8]
mov rdx, qword [rsp + 0x88]
mov r9, rax
mov rcx, rbx
mov qword [rsp + 0x40], rax
call fcn.1800f4af0
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x30]
mov rcx, rbx
test esi, esi
jle 0x1800f4dd8
xor edx, edx
call fcn.1800f49b0
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea edx, [rsi - 1]
mov rcx, rbx
call fcn.1800f4c60
inc dword [rbx + 0x3c]
jmp 0x1800f4de5
mov edx, 1
call fcn.1800f49b0
inc dword [rbx + 0x38]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x80]
inc edi
cmp edi, ebp
jl 0x1800f4d60
mov rcx, rdx
call sym.sqlite.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800f5da0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
movaps xmmword [rsp + 0x30], xmm6
mov r15d, r9d
mov r12, r8
mov r14, rcx
cmp dword [r8 + 0x18], ebx
je 0x1800f5e1e
mov rbx, rdx
lea eax, [rdx*8]
sar rbx, 0x20
xor ebx, eax
xor ebx, edx
xor edx, edx
mov eax, ebx
div dword [r12 + 0x34]
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ebp, ebp
xor r13d, r13d
cmp dword [r8 + 0x10], ebx
jle 0x1800f5de4
xorpd xmm6, xmm6
lea rdi, [0x180145b40]
mov rax, qword [r12 + 0x28]
cmp byte [r13 + rax], 0
je 0x1800f5f9b
mov rcx, qword [r14 + 0x60]
lea r8, [rsp + 0x80]
mov edx, ebp
test r15d, r15d
je 0x1800f5e5e
call qword [r14 + 0x70]
jmp 0x1800f5e62
call qword [r14 + 0x68]
test eax, eax
jne 0x1800f5df9
mov rcx, qword [rsp + 0x80]
movzx edx, word [rcx + 0x14]
mov eax, edx
and eax, 0x3f
movzx edi, byte [rax + rdi]
lea eax, [rbx*8]
xor eax, edi
xor ebx, eax
cmp edi, 1
je 0x1800f5f72
cmp edi, 2
je 0x1800f5f19
cmp edi, 3
je 0x1800f5ebc
cmp edi, 4
je 0x1800f5eb5
mov rax, qword [rsp + 0x98]
mov dword [rax], 1
jmp 0x1800f5f94
call sym.sqlite.dll_sqlite3_value_blob
jmp 0x1800f5ec1
call sym.sqlite.dll_sqlite3_value_text
mov rcx, qword [rsp + 0x80]
mov rsi, rax
call sym.sqlite.dll_sqlite3_value_bytes
test rsi, rsi
jne 0x1800f5ee7
cmp edi, 4
jne 0x1800f5fb0
test eax, eax
jg 0x1800f5fb0
xor edx, edx
movsxd r8, eax
test eax, eax
jle 0x1800f5f94
nop word [rax + rax]
movzx ecx, byte [rdx + rsi]
lea eax, [rbx*8]
inc rdx
xor ecx, eax
xor ebx, ecx
cmp rdx, r8
jl 0x1800f5f00
jmp 0x1800f5f94
test dl, 8
je 0x1800f5f2f
movsd xmm0, qword [rcx]
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f5f7a
test dl, 0x24
je 0x1800f5f4a
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rcx]
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f5f7a
test dl, 0x12
je 0x1800f5f61
call fcn.180033b50
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f5f7a
movsd qword [rsp + 0x20], xmm6
mov rdx, qword [rsp + 0x20]
movapd xmm0, xmm6
jmp 0x1800f5f7a
call sym.sqlite.dll_sqlite3_value_int64
mov rdx, rax
lea ecx, [rbx*8]
xor ecx, edx
sar rdx, 0x20
xor ecx, ebx
lea ebx, [rcx*8]
xor ebx, edx
xor ebx, ecx
lea rdi, [0x180145b40]
inc ebp
inc r13
cmp ebp, dword [r12 + 0x10]
jl 0x1800f5e34
jmp 0x1800f5de4
mov eax, 7
jmp 0x1800f5df9
Function at 0x1800f60c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
xor edi, edi
xor esi, esi
mov r13d, r9d
mov r11, r8
mov r12d, edx
mov rbp, rcx
cmp dword [rcx + 0x10], ebx
jle 0x1800f628b
mov qword [rsp + 0x58], r14
or r14d, 0xffffffff
nop word [rax + rax]
mov rax, qword [rbp + 0x28]
movzx ecx, byte [r11]
movzx edx, byte [rsi + rax]
test r12d, r12d
je 0x1800f611b
test edx, edx
je 0x1800f6278
jmp 0x1800f6123
test edx, edx
je 0x1800f626a
lea eax, [rbx*8]
inc r11
xor eax, ecx
xor ebx, eax
cmp ecx, 1
je 0x1800f61f3
cmp ecx, 2
je 0x1800f61f3
movzx eax, byte [r11]
movzx edx, al
cmp al, 0x80
jae 0x1800f6155
mov eax, 1
jmp 0x1800f61bf
movzx ecx, byte [r11 + 1]
test cl, cl
js 0x1800f616a
and edx, 0x7f
mov al, 2
shl edx, 7
or edx, ecx
jmp 0x1800f61bc
movzx eax, byte [r11 + 2]
shl edx, 0xe
or edx, eax
mov eax, edx
test dl, dl
js 0x1800f618d
and eax, 0x1fc07f
mov edx, ecx
and edx, 0x7f
shl edx, 7
or edx, eax
mov al, 3
jmp 0x1800f61bc
movzx eax, byte [r11]
mov rcx, r11
test al, al
js 0x1800f61a4
movzx edx, al
mov al, 1
mov qword [rsp + 0x50], rdx
jmp 0x1800f61b3
lea rdx, [rsp + 0x50]
call fcn.1800117a0
mov rdx, qword [rsp + 0x50]
mov ecx, edx
cmp rcx, rdx
cmovne edx, r14d
movzx eax, al
movzx eax, al
mov r9d, edx
xor r8d, r8d
add r11, rax
test r9, r9
jle 0x1800f61e8
movzx ecx, byte [r8 + r11]
lea eax, [rbx*8]
inc r8
xor ecx, eax
xor ebx, ecx
cmp r8, r9
jl 0x1800f61d0
movsxd rax, edx
add r11, rax
jmp 0x1800f6278
movzx eax, byte [r11 + 6]
movzx r8d, byte [r11 + 5]
movzx edx, byte [r11 + 1]
shl r8d, 8
shl edx, 8
lea ecx, [rbx*8]
or r8d, eax
movzx eax, byte [r11 + 4]
shl eax, 0x18
shl r8d, 8
or r8, rax
movzx eax, byte [r11 + 7]
or r8, rax
movzx eax, byte [r11 + 2]
or edx, eax
movzx eax, byte [r11]
shl eax, 0x18
shl edx, 8
or rdx, rax
movzx eax, byte [r11 + 3]
or rdx, rax
shl rdx, 0x20
add r8, rdx
xor ecx, r8d
xor ecx, ebx
mov rbx, r8
sar rbx, 0x20
lea eax, [rcx*8]
xor ebx, eax
xor ebx, ecx
add r11, 8
jmp 0x1800f6278
mov rcx, r11
call fcn.1800f5fc0
movsxd rcx, eax
add r11, rcx
inc edi
inc rsi
cmp edi, dword [rbp + 0x10]
jl 0x1800f6100
mov r14, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
xor edx, edx
div r13d
mov eax, edx
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800f8560
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
cmp dword [r8 + 0x18], 0
mov rsi, rdx
mov r10, r9
mov r9, qword [r8 + 8]
lea rax, str._rowid___
mov ebp, ecx
mov rdi, r8
lea rdx, [0x180151904]
lea rcx, str.SELECT__s_FROM___w_.__w__WHERE_NOT_EXISTS____SELECT_1_FROM___w_.__w__WHERE__s_
cmovne rdx, rax
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rax
call sym.sqlite.dll_sqlite3_mprintf
mov r12, rax
test rax, rax
jne 0x1800f85dc
lea eax, [r12 + 7]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
xor r9d, r9d
or r8d, 0xffffffff
mov rdx, r12
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], 0
call fcn.180088370
mov ebx, eax
test eax, eax
jne 0x1800f8672
mov rcx, qword [rsi + 0x60]
mov rbx, qword [rsp + 0x70]
mov qword [rcx], rbx
mov dword [rcx + 0xc], eax
mov eax, dword [rdi + 0x18]
mov dword [rcx + 8], eax
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f8668
cmp dword [rdi + 0x18], 0
je 0x1800f8649
xor edx, edx
mov rcx, rbx
call sym.sqlite.dll_sqlite3_column_int64
jmp 0x1800f864b
xor eax, eax
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov ecx, ebp
call fcn.1800f7be0
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
je 0x1800f8637
mov rcx, rbx
call sym.sqlite.dll_sqlite3_finalize
mov ebx, eax
mov rcx, r12
call sym.sqlite.dll_sqlite3_free
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1800f8740
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [rdx + 0x28]
mov rdi, rdx
mov r12, r9
mov r9, qword [rdx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rdx + 0x20]
mov rdx, qword [rcx + 8]
mov rsi, rcx
mov ecx, dword [rdi + 0x10]
mov rbx, r8
mov qword [rsp + 0x20], rax
call fcn.1800f8480
mov rbp, rax
test rax, rax
jne 0x1800f878f
lea eax, [rbp + 7]
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rsi + 8]
mov rdx, rdi
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], r14
call fcn.1800f8690
mov rdx, rdi
mov rcx, rbx
mov r13, rax
call fcn.1800f8690
mov rcx, qword [rdi + 8]
mov r9, qword [rsi + 8]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea rcx, str.SELECT__s__s_FROM___w_.__w_____w_.__w__WHERE__s_AND___z_
mov r8, rax
mov rdx, r13
mov r14, rax
call sym.sqlite.dll_sqlite3_mprintf
mov rbp, rax
test rax, rax
je 0x1800f88a2
test r13, r13
je 0x1800f88a2
test r14, r14
je 0x1800f88a2
mov rcx, qword [rsi]
lea rax, [rsp + 0x80]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
xor r9d, r9d
or r8d, 0xffffffff
mov rdx, rbp
mov qword [rsp + 0x20], r12
call fcn.180088370
mov ebx, eax
test eax, eax
jne 0x1800f88a7
mov rcx, qword [rsi + 0x60]
mov rbx, qword [rsp + 0x80]
mov qword [rcx], rbx
mov eax, dword [rdi + 0x10]
mov dword [rcx + 0xc], eax
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f8896
cmp dword [rdi + 0x18], r12d
je 0x1800f8873
xor edx, edx
mov rcx, rbx
call sym.sqlite.dll_sqlite3_column_int64
jmp 0x1800f8876
mov rax, r12
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov ecx, 0x17
call fcn.1800f7be0
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
je 0x1800f8861
mov rcx, rbx
call sym.sqlite.dll_sqlite3_finalize
mov ebx, eax
jmp 0x1800f88a7
mov ebx, 7
mov rcx, rbp
call sym.sqlite.dll_sqlite3_free
mov rcx, r13
call sym.sqlite.dll_sqlite3_free
mov rcx, r14
call sym.sqlite.dll_sqlite3_free
mov r14, qword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
mov eax, ebx
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180106660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
movsxd rsi, r9d
mov r12, r8
lea eax, [rsi - 1]
mov r14d, edx
lea r11d, [rbp + 0xd]
movsxd r10, eax
test eax, eax
js 0x1801066a8
nop
movsx r9d, byte [r10 + r8]
lea eax, [r11*8]
xor r9d, eax
xor r11d, r9d
dec r10
jns 0x180106690
lea eax, [r11*8]
xor eax, r11d
xor eax, edx
and eax, 0x1ff
mov r15d, eax
mov rbx, qword [rcx + rax*8]
test rbx, rbx
je 0x1801066ec
cmp dword [rbx + 0xc], r14d
jne 0x1801066e3
cmp dword [rbx + 8], esi
jne 0x1801066e3
mov rcx, qword [rbx]
mov r8, rsi
mov rdx, r12
call fcn.180137910
test eax, eax
je 0x180106708
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1801066c6
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r13
lea rdi, [rsi + 0x18]
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
je 0x18010671b
mov rbx, rbp
jmp 0x18010677d
mov rcx, qword [rsp + 0x80]
mov dword [rcx], 1
jmp 0x1801067cf
test rdi, rdi
je 0x180106775
cmp rdi, 0x7ffffeff
ja 0x180106775
cmp dword [0x180172920], ebp
je 0x180106768
mov rcx, qword [0x1801821a8]
test rcx, rcx
je 0x180106743
call qword [0x1801729a0]
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.18000bd10
mov rcx, qword [0x1801821a8]
test rcx, rcx
je 0x180106761
call qword [0x1801729b0]
mov rbx, qword [rsp + 0x20]
jmp 0x180106778
mov ecx, edi
call qword [0x180172940]
mov rbx, rax
jmp 0x180106778
mov rbx, rbp
test rbx, rbx
jne 0x180106789
test rdi, rdi
jle 0x180106796
mov ebp, 7
jmp 0x180106796
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.18012e4c0
mov rdi, qword [rsp + 0x68]
test rbx, rbx
je 0x1801067ca
lea rcx, [rbx + 0x18]
mov r8, rsi
mov rdx, r12
mov dword [rbx + 8], esi
mov dword [rbx + 0xc], r14d
mov qword [rbx], rcx
call fcn.180128750
mov r10, qword [rsp + 0x60]
mov r11, qword [r10 + r15*8]
mov qword [rbx + 0x10], r11
mov qword [r10 + r15*8], rbx
mov r13, qword [rsp + 0x70]
mov eax, ebp
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x180106a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r10, rcx
mov r8, rcx
movzx ecx, byte [rcx]
movzx eax, cl
cmp cl, 0x27
je 0x180106b6a
cmp al, 0x4e
je 0x180106b0a
cmp al, 0x58
je 0x180106ab3
cmp al, 0x6e
je 0x180106b0a
cmp al, 0x78
je 0x180106ab3
cmp cl, 0x2b
je 0x180106a67
cmp cl, 0x2d
jne 0x180106a70
lea r8, [r10 + 1]
nop dword [rax + rax]
movzx eax, byte [r8]
sub al, 0x30
cmp al, 9
ja 0x180106a7f
inc r8
jmp 0x180106a70
cmp byte [r8], 0x2e
jne 0x180106aa3
movzx eax, byte [r8 + 1]
sub al, 0x30
cmp al, 9
ja 0x180106aa3
add r8, 2
movzx eax, byte [r8]
sub al, 0x30
cmp al, 9
ja 0x180106aa3
inc r8
jmp 0x180106a94
cmp r8, r10
jne 0x180106b92
xor r8d, r8d
mov eax, r8d
ret
cmp byte [r10 + 1], 0x27
lea r8, [r10 + 1]
jne 0x180106b8f
movzx eax, byte [r8 + 1]
inc r8
cmp al, 0x61
jl 0x180106ad2
cmp al, 0x66
jle 0x180106ac2
cmp al, 0x41
jl 0x180106ada
cmp al, 0x46
jle 0x180106ac2
cmp al, 0x30
jl 0x180106ae2
cmp al, 0x39
jle 0x180106ac2
cmp byte [r8], 0x27
jne 0x180106b8f
mov rax, r8
sub rax, r10
cqo
and eax, 1
xor rax, rdx
cmp rax, rdx
jne 0x180106b8f
inc r8
mov rax, r8
ret
mov edx, 4
lea r8, str.null
mov r9, r10
lea r11, [0x180144c70]
movzx ecx, byte [r8]
dec edx
test cl, cl
je 0x180106b48
movzx eax, byte [r9]
movzx ecx, cl
movzx eax, byte [rax + r11]
cmp byte [rcx + r11], al
jne 0x180106b48
inc r8
inc r9
test edx, edx
jg 0x180106b20
dec edx
test edx, edx
js 0x180106b62
movzx eax, byte [r9]
movzx edx, byte [rax + r11]
movzx eax, byte [r8]
movzx ecx, byte [rax + r11]
sub ecx, edx
jne 0x180106b8f
lea r8, [r10 + 4]
mov rax, r8
ret
lea r8, [r10 + 1]
test r8, r8
je 0x180106b92
movzx eax, byte [r8]
cmp al, 0x27
jne 0x180106b83
inc r8
cmp byte [r8], al
jne 0x180106b92
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x180106b77
xor r8d, r8d
mov rax, r8
ret
Function at 0x18010d580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov ebp, dword [rcx + 0x14]
mov r13, qword [rcx + 0x20]
mov r12, rcx
add ebp, ebp
movsxd rdi, ebp
shl rdi, 3
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x18010d6ec
test rdi, rdi
je 0x18010d6ec
mov rcx, rdi
call fcn.18000be40
mov rsi, rax
test rax, rax
je 0x18010d6ec
mov r8, rdi
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rbx
call fcn.18012e4c0
xor ebx, ebx
cmp dword [r12 + 0x14], ebx
jle 0x18010d66d
mov r10, r13
cmp qword [r10], 0
je 0x18010d660
nop dword [rax + rax]
mov r11, qword [r10]
or rcx, 0xffffffffffffffff
mov rax, qword [r11]
lea rdi, [r11 + 0x30]
mov qword [r10], rax
xor eax, eax
repne scasb al, byte [rdi]
lea r8d, [rax + 0xd]
not rcx
lea rax, [rcx - 1]
dec eax
cdqe
js 0x18010d648
nop word [rax + rax]
movzx edx, byte [r11 + rax + 0x30]
lea ecx, [r8*8]
xor edx, ecx
xor r8d, edx
dec rax
jns 0x18010d630
xor edx, edx
mov eax, r8d
div ebp
mov rax, qword [rsi + rdx*8]
mov qword [r11], rax
mov qword [rsi + rdx*8], r11
cmp qword [r10], 0
jne 0x18010d600
inc ebx
add r10, 8
cmp ebx, dword [r12 + 0x14]
jl 0x18010d5f2
mov rbx, qword [rsp + 0x40]
test r13, r13
je 0x18010d6de
cmp dword [0x180172920], 0
je 0x18010d6d5
mov rcx, qword [0x1801821a8]
test rcx, rcx
je 0x18010d692
call qword [0x1801729a0]
mov rcx, r13
call qword [0x180172958]
dec qword [0x180182138]
mov rcx, r13
movsxd rdx, eax
sub qword [0x1801820f0], rdx
call qword [0x180172948]
mov rcx, qword [0x1801821a8]
test rcx, rcx
je 0x18010d6de
call qword [0x1801729b0]
mov dword [r12 + 0x14], ebp
mov qword [r12 + 0x20], rsi
xor eax, eax
jmp 0x18010d6f1
mov rcx, r13
call qword [0x180172948]
mov dword [r12 + 0x14], ebp
mov qword [r12 + 0x20], rsi
xor eax, eax
jmp 0x18010d6f1
mov eax, 7
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x18010dfb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
movsxd rdi, r8d
mov r13, rcx
mov r12, r9
lea eax, [rdi - 1]
mov rsi, rdx
mov ecx, 0xd
cdqe
test rax, rax
js 0x18010dff8
nop
movzx r11d, byte [rax + rdx]
lea r10d, [rcx*8]
xor r11d, r10d
xor ecx, r11d
dec rax
jns 0x18010dfe0
xor edx, edx
mov eax, ecx
mov qword [rsp + 0x48], rbp
div dword [r13 + 0x14]
mov rax, qword [r13 + 0x20]
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x18010e036
mov eax, dword [rbx + 0x1c]
inc eax
cmp edi, eax
jne 0x18010e02e
lea rcx, [rbx + 0x30]
mov r8, rdi
mov rdx, rsi
call fcn.180137910
test eax, eax
je 0x18010e064
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18010e012
mov rax, qword [rsp + 0x60]
mov qword [r12], 0
mov dword [rax], 0
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov esi, dword [rbx + 0x18]
lea ebp, [rdi + 0x31]
sub esi, ebp
lea eax, [rsi + 0x1a]
movsxd rdi, eax
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x18010e0d5
test rdi, rdi
je 0x18010e0d5
cmp rdi, 0x7ffffeff
ja 0x18010e0d5
cmp dword [0x180172920], eax
je 0x18010e0c8
mov rcx, qword [0x1801821a8]
test rcx, rcx
je 0x18010e0a3
call qword [0x1801729a0]
lea rdx, [rsp + 0x40]
mov ecx, edi
call fcn.18000bd10
mov rcx, qword [0x1801821a8]
test rcx, rcx
je 0x18010e0c1
call qword [0x1801729b0]
mov rdi, qword [rsp + 0x40]
jmp 0x18010e0d7
mov ecx, edi
call qword [0x180172940]
mov rdi, rax
jmp 0x18010e0d7
xor edi, edi
mov qword [r12], rdi
test rdi, rdi
je 0x18010e11a
movsxd rdx, ebp
lea rcx, [rdi + 0x10]
movsxd r8, esi
add rdx, rbx
call fcn.180128750
mov r11d, 0x10
mov rdx, rbx
sub r11d, ebp
mov rcx, r13
movsxd r8, r11d
add r8, rdi
call fcn.18010d710
mov rcx, qword [rsp + 0x60]
add eax, esi
mov dword [rcx], eax
jmp 0x18010e049
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov eax, 7
jmp 0x18010e04b