joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011d5d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rbx, rcx
mov edi, 0x200
mov r8d, edi
lea rcx, [rbp - 0x70]
xor edx, edx
call fcn.1400ae710
mov r10d, reloc.WS2_32.dll_WSAGetLastError
mov dword [rbp + 0x1d8], edi
lea rax, [rbp + 0x1e8]
mov dword [rsp + 0x70], 0x740066
mov r9d, 0x20019
mov dword [rbp - 0x7a], 0x700061
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x74], 0x43005c
lea r8d, [r10 + 3]
mov dword [rsp + 0x6a], 0x73006f
lea r13d, [r10 - 7]
mov word [rsp + 0x68], r8w
mov word [rbp - 0x7c], r8w
lea r15d, [r10 - 0x22]
mov word [rbp - 0x76], r13w
mov dword [rsp + 0x58], 0x410057
mov dword [rsp + 0x78], 0x790072
mov dword [rsp + 0x60], 0x4d005c
mov dword [rsp + 0x7c], 0x740070
mov dword [rsp + 0x64], 0x630069
mov dword [rbp - 0x80], 0x67006f
mov dword [rsp + 0x5c], 0x450052
mov dword [rsp + 0x50], 0x4f0053
mov dword [rsp + 0x54], 0x540046
mov dword [rbp - 0x74], 0x79
mov word [rsp + 0x6e], r10w
mov qword [rsp + 0x20], rax
call fcn.1401153bc
test eax, eax
jne 0x14011d79f
mov rcx, qword [rbp + 0x1e8]
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e0]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x38], 0x6e0069
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 0x64
mov dword [rsp + 0x3c], 0x470065
mov dword [rsp + 0x32], 0x630061
mov dword [rsp + 0x40], 0x690075
mov word [rsp + 0x30], r15w
mov word [rsp + 0x36], r13w
call fcn.1401152f4
test eax, eax
je 0x14011d77e
lea rax, [rbp + 0x1e8]
mov r9d, 0x20119
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.1401153bc
test eax, eax
jne 0x14011d79f
mov rcx, qword [rbp + 0x1e8]
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e0]
lea rax, [rbp - 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1401152f4
test eax, eax
jne 0x14011d79f
or r9, 0xffffffffffffffff
lea r8, [rbp - 0x70]
mov edx, 0x800
mov rcx, rbx
call fcn.1400ccda4
mov rcx, qword [rbp + 0x1e8]
call fcn.140116708
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x4046e0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x404819
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
nop
mov rbx, rcx
mov qword [rdx + 0x138], rcx
nop
mov rcx, qword [rbx + 0x30]
mov qword [rbx + 0xd8], rcx
mov rcx, qword [rax + 0x30]
test byte [rax], al
movups xmm0, xmmword [rcx + 0x2d0]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x2e0]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x2f0]
movups xmmword [rsp + 0x40], xmm0
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rax + 0x78]
mov qword [rsp + 0x18], rdx
call fcn.004394a0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe9], 0
mov rcx, qword [rsp + 0x70]
mov qword [rsp], rcx
call fcn.00404870
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe9], 1
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 8], rcx
call fcn.00438e50
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x2d0], xmm0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x2e0], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x2f0], xmm0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.00431300
lea rax, [0x00d67a09]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.00431ca0
call fcn.00431390
nop
mov eax, 1
lea rcx, [0x01420f6c]
xchg dword [rcx], eax
mov rax, qword [0x00bccd80]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042ed80
mov rax, qword [rsp + 0x58]
jmp 0x404714
Function at 0x428ab0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x428d23
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
lea rax, [0x01408f60]
mov qword [rsp], rax
call fcn.0040bbc0
lea rax, [0x01408ed0]
mov qword [rsp], rax
call fcn.0041af90
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
lea rcx, [0x01408f60]
mov qword [rsp], rcx
call fcn.0040bdb0
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x014215b0], 0
jne 0x428d0e
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x014215b0], 0
jne 0x428ce1
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00428710
cmp byte [rsp + 0x10], 0
je 0x428c83
cmp dword [0x01420f8c], 0
jne 0x428b9e
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.00415e90
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rcx], al
test byte [rax], al
nop
mov qword [rsp], rdx
lea rax, [rbx + 0x1270]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.00422040
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x00b9c029]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.00421ec0
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x428b8c
cmp byte [rax + 0xb1], 0
je 0x428b8c
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x428b8c
lea rax, [0x01408f60]
mov qword [rsp], rax
call fcn.0040bbc0
nop
mov rax, qword [0x01408f00]
sub rax, qword [0x01408ed0]
mov qword [0x01408f00], rax
mov rax, qword [0x01408ee8]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x01408ee8], rcx
lea rax, [0x01408f60]
mov qword [rsp], rax
call fcn.0040bdb0
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, rax
mov rax, qword [rsp + 0x78]
call fcn.0045afe0
lea rdi, [rbx + 0x28]
mov rax, qword [rsp + 0x80]
call fcn.0045afe0
mov rax, rbx
jmp 0x428b65
mov rcx, rax
mov rax, qword [rsp + 0x68]
call fcn.0045afe0
mov rax, rcx
jmp 0x428b35
call fcn.00458f80
jmp fcn.00428ab0
Function at 0x44a8c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44aa81
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
nop
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x44aa4a
mov ecx, dword [rax + 0x18]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x88]
mov byte [rsp + 0x28], bl
call fcn.0044a190
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx + 0x1c]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov dword [rsp + 0x10], edx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x88]
mov byte [rsp + 0x28], dl
call fcn.0044a190
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x44a9bd
lea rax, [0x00d50e95]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
mov dword [rsp + 0xa0], 0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
cmp eax, 0xffffffff
je 0x44a98d
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x44a98d
mov rbx, qword [rdx + 8]
mov rdx, qword [rdx]
jae 0x44aa7a
mov ecx, dword [rsi + rcx*4]
cmp rcx, rbx
jae 0x44aa7a
mov dword [rsp + 0x3c], eax
nop
lea rax, [rdx + rcx]
mov qword [rsp + 0x48], rax
mov qword [rsp], rax
call fcn.004483c0
mov rax, qword [rsp + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0xa0], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x00d50e95]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
mov dword [rsp + 0xa0], 0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.0042f2a0
ud2
call fcn.00458f80
jmp fcn.0044a8c0
Function at 0x44ab10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44ac72
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call fcn.0044a190
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x44ab92
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call fcn.0044a750
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x48], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x40], rdx
call fcn.00431300
lea rax, [0x00d59b6d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.00431ca0
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.00431ca0
call fcn.00431560
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.00431b40
call fcn.00431560
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.00431b40
call fcn.00431560
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.00431b40
call fcn.00431560
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call fcn.00431ad0
call fcn.004315b0
call fcn.00431390
mov eax, dword [rsp + 0x3c]
jmp 0x44ab81
call fcn.00458f80
jmp fcn.0044ab10

Function at 0x44b860
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
nop
inc dword [rax + 0x244]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
nop
nop
mov rdx, rax
mov qword [rcx + 0x138], rax
nop
mov rax, qword [rdx + 0x30]
mov qword [rdx + 0xd8], rax
mov dword [rsp], 0
lea rax, fcn.0043aad0
mov qword [rsp + 8], rax
call fcn.0042f5e0
test eax, eax
jne 0x44b983
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x2d0], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x2d8], rcx
lea rcx, [rsp + 0x40]
nop
mov qword [rax + 0x2e0], rcx
mov rcx, qword [0x013ff368]
mov qword [rsp], rcx
lea rcx, [rax + 0x2d0]
mov qword [rsp + 8], rcx
call fcn.00404610
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x2e8]
mov rdx, qword [rax + 0x2f0]
mov rax, qword [rax + 0x2f8]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
nop
call fcn.0042fec0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
call fcn.0042fec0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x451d30
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x451e10
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x004587c0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00458e30
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.00458f80
jmp fcn.00451d30
Function at 0x4b9130
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4b9240
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
lea rbx, [rdx + 0x2e]
neg rbx
imul rbx, rbx, 0x1c
movabs rax, 0x5816058160581606
mov rsi, rdx
imul rbx
sar rbx, 0x3f
sar rdx, 5
sub rdx, rbx
lea rbx, [rdx + 0x15c]
sar rbx, 0x3f
shr rbx, 0x3d
lea rdx, [rbx + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
jmp 0x4b91aa
mov rdx, rax
cmp rdx, 0x57
jae 0x4b9239
lea rax, [rdx + rdx*2]
lea rbx, [0x00bb11c0]
mov rdi, qword [rbx + rax*8 + 8]
lea r8, [rsi + rdi]
lea r8, [r8 + 0x40]
cmp r8, 0xffffffffffffffc4
jge 0x4b91d8
lea rax, [rdx + 1]
jmp 0x4b91a7
cmp r8, 0xffffffffffffffe0
jle 0x4b91e4
lea rax, [rdx - 1]
jmp 0x4b91a7
mov qword [rsp + 0x20], rdx
mov rdx, rax
shl rax, 3
mov rdx, qword [rbx + rdx*8]
movzx eax, byte [rbx + rax + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdi
mov byte [rsp + 0x18], al
call fcn.004b8d40
mov rax, qword [rsp + 0x20]
mov rcx, rax
shl rax, 3
add rax, 0xfffffffffffffea4
neg rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0042f2a0
ud2
call fcn.00458f80
jmp fcn.004b9130
Function at 0x50c5c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x50c819
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov rax, qword [rsp + 0x78]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rdx
call fcn.0050c830
mov eax, dword [rsp + 0x18]
mov ecx, dword [rsp + 0x1c]
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x80]
xor edi, edi
xor r8d, r8d
jmp 0x50c648
lea r9, [rdi + 1]
imul r10d, r8d, 0x1000193
movzx r11d, byte [rdx + rdi]
lea r8d, [r11 + r10]
mov rdi, r9
cmp rdi, rsi
jge 0x50c657
cmp rdi, rbx
jb 0x50c631
jmp 0x50c812
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], ecx
cmp r8d, eax
je 0x50c795
xor edi, edi
test dil, dil
jne 0x50c77f
mov rdi, rsi
cmp rsi, rbx
jge 0x50c769
imul r8d, r8d, 0x1000193
movzx r9d, byte [rdx + rsi]
add r8d, r9d
mov r9, rsi
sub rsi, rdi
cmp rsi, rbx
jae 0x50c804
movzx esi, byte [rdx + rsi]
imul esi, ecx
sub r8d, esi
lea rsi, [r9 + 1]
cmp r8d, eax
je 0x50c6cd
xor r9d, r9d
test r9b, r9b
je 0x50c676
sub rsi, rdi
mov qword [rsp + 0x90], rsi
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov r9, rsi
sub rsi, rdi
test r9, r9
jl 0x50c7fd
cmp rsi, r9
ja 0x50c7fd
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x48], r9
nop
mov rax, qword [rsp + 0x70]
sub rax, rsi
mov rbx, rax
neg rax
sar rax, 0x3f
and rax, rsi
add rax, rdx
mov qword [rsp], rax
sub r9, rsi
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rbx
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0x28], rsi
call fcn.00402e60
movzx r9d, byte [rsp + 0x30]
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x40]
jmp 0x50c6b3
mov qword [rsp + 0x90], 0xffffffffffffffff
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 0x90], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rdi, qword [rsp + 0x70]
cmp rsi, rdi
ja 0x50c80b
mov dword [rsp + 0x44], r8d
nop
mov qword [rsp], rdx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x28], rcx
call fcn.00402e60
movzx edi, byte [rsp + 0x30]
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x44]
jmp 0x50c66a
call fcn.0042f3e0
ud2
call fcn.0042f2a0
ud2
call fcn.0042f3e0
ud2
call fcn.0042f2a0
ud2
call fcn.00458f80
jmp fcn.0050c5c0
Function at 0xab85ab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov byte [rbp - 0x19], 1
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.00ab8774
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
mov byte [rbp - 1], 0
mov qword [rbp - 0x10], 0
jmp 0xab8617
mov rax, qword [rbp - 0x10]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
movzx eax, byte [rax + 3]
test al, al
je 0xab8612
mov byte [rbp - 1], 1
jmp 0xab8629
add qword [rbp - 0x10], 1
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x14]
shr eax, 2
mov eax, eax
cmp rax, qword [rbp - 0x10]
ja 0xab85f1
cmp qword [rbp - 0x28], 0
je 0xab876a
movzx eax, byte [rbp - 1]
xor eax, 1
test al, al
je 0xab876a
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rcx, rax
call fcn.00ab8774
mov qword [rbp - 0x38], rax
cmp qword [rbp - 0x38], 0
je 0xab876a
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x18], 0
jmp 0xab8744
mov rax, qword [rbp - 0x18]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x40]
add rax, rdx
movzx eax, byte [rax + 2]
cmp al, 0xff
jne 0xab8728
mov rax, qword [rbp - 0x18]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x40]
add rax, rdx
movzx eax, byte [rax + 1]
cmp al, 0xff
jne 0xab8728
mov rax, qword [rbp - 0x18]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x40]
add rax, rdx
movzx eax, byte [rax]
cmp al, 0xff
jne 0xab8728
mov rax, qword [rbp - 0x18]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov byte [rax + 2], 0
mov rax, qword [rbp - 0x18]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov byte [rax + 1], 0
mov rax, qword [rbp - 0x18]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov byte [rax], 0
mov rax, qword [rbp - 0x18]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov byte [rax + 3], 0
jmp 0xab873f
mov rax, qword [rbp - 0x18]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov byte [rax + 3], 0xff
add qword [rbp - 0x18], 1
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x14]
shr eax, 2
mov eax, eax
cmp rax, qword [rbp - 0x18]
ja 0xab8677
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalFree]
call rax
mov rax, qword [rbp - 0x28]
add rsp, 0x60
pop rbp
ret
Function at 0xac4866
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
mov qword [rax], 0
mov ecx, 0x28
call fcn.00ac0c39
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0xac48a4
mov eax, 7
jmp 0xac4997
mov eax, dword [0x00bd9c04]
test eax, eax
je 0xac48bc
mov ecx, 0xc8
call fcn.00ac569a
test eax, eax
je 0xac48d5
mov rax, qword [rbp - 8]
mov r8d, 0x28
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0xac4950
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x18]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x20]
mov qword [rax + 0x18], rdx
mov rax, qword [rbp - 8]
lea rdx, [rax + 8]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x00ac4823]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov rdx, rax
mov rax, qword [rbp - 8]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax]
test rax, rax
jne 0xac4950
mov rax, qword [rbp - 8]
mov r8d, 0x28
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
jne 0xac4987
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov edx, eax
mov rax, qword [rbp - 8]
mov dword [rax + 8], edx
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov rcx, rdx
call rax
mov rdx, rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x20], rdx
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov qword [rax], rdx
mov eax, 0
add rsp, 0x40
pop rbp
ret

Function at 0xb15be8
Capabilities:
Reference sql statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov rdx, qword [rbp + 0x18]
mov eax, dword [rbp + 0x20]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x20], rax
lea r9, str.sqlite_master
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rcx, qword [rbp + 0x10]
call fcn.00b1c431
cmp dword [rbp + 0x20], 0
jne 0xb15c4e
mov rax, qword [rbp + 0x18]
mov r9, rax
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, qword [rbp + 0x10]
call fcn.00b1c431
nop
add rsp, 0x30
pop rbp
ret