joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004a60
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x430
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x420], rax
cmp qword [0x180131d68], 0
jne 0x180004a97
jmp 0x180004d32
mov rax, qword [rsp + 0x440]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp eax, 1
je 0x180004aeb
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetParent]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180004add
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x30], rax
jne 0x180004adf
jmp 0x180004aeb
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
jmp 0x180004ab2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
je 0x180004d32
call fcn.180004ee0
mov qword [0x180131d58], rax
mov qword [0x180131d68], 0
xor eax, eax
mov word [rsp + 0x220], ax
lea rax, [rsp + 0x222]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fc
rep stosb byte [rdi], al
mov r8d, 0xff
lea rdx, [rsp + 0x220]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0xf0]
call fcn.180004d50
nop
call fcn.1800027c0
mov rcx, rax
call fcn.1800054b0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xf4], eax
mov rax, qword [rsp + 0x20]
add rax, 0x148
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.180001f70
mov rax, qword [rsp + 0x20]
add rax, 0x28
mov rdx, rax
lea rcx, [rsp + 0x118]
call fcn.180001f70
xor r8d, r8d
mov rdx, qword [0x180131d58]
lea rcx, [rsp + 0x70]
call fcn.180004790
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x198]
call fcn.1800076b0
lea rcx, [rsp + 0x70]
call fcn.180002810
xor r8d, r8d
mov rdx, qword [0x180131d60]
lea rcx, [rsp + 0xb0]
call fcn.180004790
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x158]
call fcn.1800076b0
lea rcx, [rsp + 0xb0]
call fcn.180002810
mov rax, qword [0x180131d60]
mov rcx, qword [0x180131d58]
sub rcx, rax
mov rax, rcx
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180004790
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x178]
call fcn.1800076b0
lea rcx, [rsp + 0xd0]
call fcn.180002810
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x138]
call fcn.180001750
mov rax, qword [rsp + 0x20]
add rax, 0x168
mov rdx, rax
lea rcx, [rsp + 0x1b8]
call fcn.180001f70
mov rax, qword [rsp + 0x20]
add rax, 0x188
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.180001f70
mov rax, qword [0x180131d60]
mov rcx, qword [0x180131d58]
sub rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180004980
mov dword [rsp + 0x1f8], eax
lea rcx, [rsp + 0x90]
call fcn.180016990
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x200]
call fcn.1800076b0
lea rcx, [rsp + 0x90]
call fcn.180002810
call fcn.180007bc0
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.180016e50
nop
lea rcx, [rsp + 0xf0]
call fcn.180004e20
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1801068d0
add rsp, 0x430
pop rdi
ret
Function at 0x180009f60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x30], 0
mov rax, qword [rsp + 0x50]
add rax, 0x38
mov rcx, rax
call fcn.18000a600
nop
mov rax, qword [rsp + 0x50]
add rax, 0x50
mov rcx, rax
call fcn.1800078f0
mov rax, qword [rsp + 0x50]
add rax, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x18000a0d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x18000a000
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x18000a094
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x30], 1
mov edx, 0x7d0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18000a07b
lea rax, str.Force_Terminate_key_thread...
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0x16
lea rdx, [0x180110138]
lea rcx, str.CKeyInputThreadHandle::CKeyInputThreadHandle
call fcn.1800f8ad0
xor edx, edx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x18000a094
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
add rax, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
mov rax, qword [rsp + 0x50]
add rax, 0x50
mov rcx, rax
call fcn.180007b10
nop
mov rax, qword [rsp + 0x50]
add rax, 0x38
mov rcx, rax
call fcn.18000a630
add rsp, 0x48
ret
Function at 0x18000ec00
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x120
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov byte [rsp + 0xa0], 0
lea rax, [rsp + 0xa1]
mov rdi, rax
xor eax, eax
mov ecx, 0x63
rep stosb byte [rdi], al
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, str.keyboard_name:__s
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0xde
lea rdx, str..._srcKeyboadHookutilVirtualKeyManager.cpp
lea rcx, str.CVirtualKeyManager::GetSpecialKeyBoard
call fcn.1800f8ad0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x78]
call fcn.18000c0d0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.18000f760
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.18000f720
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.18000f760
mov rcx, qword [sym.imp.MSVCR120.dll_towlower]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov r9, qword [rcx]
mov rcx, qword [rsp + 0x48]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x60]
call fcn.18000ef20
lea rdx, str.0000000a
lea rcx, [rsp + 0x78]
call fcn.18000f6e0
test eax, eax
je 0x18000ed3c
lea rdx, str.0000040a
lea rcx, [rsp + 0x78]
call fcn.18000f6e0
test eax, eax
je 0x18000ed3c
lea rdx, str.0001040a
lea rcx, [rsp + 0x78]
call fcn.18000f6e0
test eax, eax
jne 0x18000ed59
mov dword [rsp + 0x34], 1
lea rcx, [rsp + 0x78]
call fcn.180007b10
mov eax, dword [rsp + 0x34]
jmp 0x18000eddb
lea rdx, str.00000016
lea rcx, [rsp + 0x78]
call fcn.18000f6e0
test eax, eax
je 0x18000edad
lea rdx, str.00000416
lea rcx, [rsp + 0x78]
call fcn.18000f6e0
test eax, eax
je 0x18000edad
lea rdx, str.00010416
lea rcx, [rsp + 0x78]
call fcn.18000f6e0
test eax, eax
je 0x18000edad
lea rdx, str.00000816
lea rcx, [rsp + 0x78]
call fcn.18000f6e0
test eax, eax
jne 0x18000edc5
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x78]
call fcn.180007b10
mov eax, dword [rsp + 0x38]
jmp 0x18000eddb
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x78]
call fcn.180007b10
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1801068d0
add rsp, 0x120
pop rdi
ret
Function at 0x18000f7a0
Capabilities:
Create directory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [r11 - 0x40], rcx
call fcn.180011780
mov rcx, rbx
call fcn.180001780
test eax, eax
jle 0x18000f903
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1800032b0
mov rcx, rax
call fcn.180011500
test al, al
je 0x18000f80e
mov rcx, rbx
call fcn.180002810
mov al, 1
jmp 0x18000f90d
lea r8, [0x180118f20]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1800100d0
mov rdx, rax
mov rcx, rbx
call fcn.1800076b0
lea rcx, [rsp + 0x50]
call fcn.180002810
mov rcx, rbx
call fcn.180011570
mov esi, 1
mov rcx, rbx
call fcn.180001780
cmp eax, esi
jle 0x18000f8d3
mov edi, esi
mov rcx, rbx
cmp qword [rbx + 0x10], rdi
jbe 0x18000f8cd
call fcn.180002590
cmp word [rax + rdi*2], 0x5c
jne 0x18000f8ba
movsxd r9, esi
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18000fa80
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1800032b0
mov rcx, rax
call fcn.180011500
test al, al
jne 0x18000f8b0
lea rcx, [rsp + 0x50]
call fcn.1800031c0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rsp + 0x50]
call fcn.180002810
inc esi
inc rdi
mov rcx, rbx
call fcn.180001780
cmp esi, eax
jl 0x18000f856
jmp 0x18000f8d3
call fcn.180002010
int3
mov rcx, rbx
call fcn.1800031c0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1800032b0
mov rcx, rax
call fcn.180011500
test al, al
jne 0x18000f7ff
mov rcx, rbx
call fcn.180002810
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1801068d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180011500
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor bl, bl
call fcn.180011570
mov rcx, rdi
call fcn.1800031c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov rcx, rdi
call fcn.180002810
movzx eax, bl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801068d0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180016a30
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4c0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov dword [rsp + 0x30], 0
lea rdx, str.C:Program_Files__x86_Windows_Assistant_AppMVConfiguration.ini
lea rcx, [rsp + 0x70]
call fcn.18000c0d0
nop
mov byte [rsp + 0xb0], 0
lea rax, [rsp + 0xb1]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
call fcn.18000fa00
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, str.UniquePC
lea rcx, str.Setting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x90]
call fcn.18000c0d0
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
call fcn.18000ba40
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x4d0]
call fcn.180010a80
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x90]
call fcn.180007b10
nop
lea rcx, [rsp + 0x70]
call fcn.180007b10
mov rax, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1801068d0
add rsp, 0x4c0
pop rdi
ret
Function at 0x18001e920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r9d, dword [rsp + 0x90]
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.18001e6b0
mov rax, qword [rsp + 0x80]
mov dword [rax], 0x28
movzx eax, word [rsp + 0x36]
cmp eax, 8
jle 0x18001e99f
mov eax, dword [rsp + 0x38]
and eax, 3
test eax, eax
je 0x18001e99d
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
add eax, 0xc
mov rcx, qword [rsp + 0x80]
mov dword [rcx], eax
jmp 0x18001e9e7
cmp dword [rsp + 0x48], 0
je 0x18001e9b0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
jmp 0x18001e9cb
movzx eax, word [rsp + 0x36]
mov ecx, 1
mov dword [rsp + 0x24], ecx
movzx ecx, al
mov eax, dword [rsp + 0x24]
shl eax, cl
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
mov ecx, dword [rcx]
lea rax, [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
mov dword [rcx], eax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801068d0
add rsp, 0x68
ret
Function at 0x180026970
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax + 0x68], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x10325476
ret
Function at 0x18002b770
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18002a8e0
mov qword [rsp + 0x28], 0
cmp qword [0x180131d98], 0
jne 0x18002b7b9
cmp qword [0x180131da8], 0
je 0x18002b7b9
mov rax, qword [0x180131da8]
mov qword [0x180131d98], rax
cmp qword [0x180131d98], 0
je 0x18002b85b
mov rax, qword [0x180131d98]
cmp qword [rax + 0x10], 0
je 0x18002b85b
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18002b85b
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18002b85b
mov rax, qword [0x180131d98]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18002b825
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18002b82c
xor eax, eax
jmp 0x18002b9d6
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov rdi, qword [rsp + 0x28]
mov eax, 0xcc
mov ecx, 0x60
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x28]
jmp 0x18002b9d6
mov rax, qword [0x180131da8]
mov qword [0x180131d98], rax
jmp 0x18002b87d
mov rax, qword [0x180131d98]
mov rax, qword [rax + 8]
mov qword [0x180131d98], rax
cmp qword [0x180131d98], 0
je 0x18002b8ca
cmp qword [0x180131d98], 0
je 0x18002b8c8
mov rax, qword [0x180131d98]
cmp qword [rax + 0x10], 0
je 0x18002b8c8
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18002b8c8
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18002b8c8
jmp 0x18002b7fd
jmp 0x18002b86b
mov rcx, qword [rsp + 0x60]
call fcn.18002a470
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18002b640
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18002b9d4
mov rax, qword [rsp + 0x48]
mov qword [0x180131d98], rax
mov rax, qword [0x180131d98]
mov dword [rax], 0x52727464
mov rax, qword [0x180131d98]
mov qword [rax + 0x10], 0
mov rax, qword [0x180131d98]
mov rcx, qword [0x180131da8]
mov qword [rax + 8], rcx
mov rax, qword [0x180131d98]
mov qword [0x180131da8], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180131d98]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.SHELL32.dll_IsUserAnAdmin
jmp 0x18002b985
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18002b9bf
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18002b97b
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18002b7fd
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x180035ca0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, 0x28
call fcn.180031810
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180035ce1
mov eax, 7
jmp 0x180035dae
movzx eax, byte [0x180129724]
test eax, eax
je 0x180035cfa
mov ecx, 0xc8
call fcn.180036ef0
test eax, eax
je 0x180035d0a
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
jmp 0x180035d73
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x180035c60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.MSVCR120.dll__beginthreadex]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x180035d73
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x180035d9f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x180090640
Capabilities:
Reference sql statements

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x18012c180]
mov r8, qword [rsp + 0x48]
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rcx, qword [rsp + 0x40]
call fcn.180097970
cmp dword [rsp + 0x50], 0
jne 0x1800906a6
mov r9, qword [rsp + 0x48]
lea r8, [0x18012c230]
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, qword [rsp + 0x40]
call fcn.180097970
add rsp, 0x38
ret
Function at 0x1800f8880
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x1b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r14, rdx
mov ebp, ecx
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1800f8fb0
nop
cmp byte [0x180131281], 0
je 0x1800f89b0
mov byte [rsp + 0x90], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x91]
call sub.MSVCR120.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp qword [r14 + 0x18], 0x10
jb 0x1800f8914
mov r15, qword [r14]
jmp 0x1800f8917
mov r15, r14
lea rsi, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov r9d, ebx
lea rdx, str.__d._d._s._s___s_n
lea rcx, [rsp + 0x48]
call fcn.1800f9730
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp qword [rsp + 0x60], 0x10
jb 0x1800f8999
mov rcx, qword [rsp + 0x48]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
mov rcx, qword [0x180131288]
test rcx, rcx
jne 0x1800f89f2
mov ecx, 0x28
call sub.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [0x180131288], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x180131288]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.180100ce0
mov r8, qword [rax]
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [r8 + 0x40]
test rax, rax
jne 0x1800f8a1a
xor edx, edx
xor ecx, ecx
call fcn.1800f84a0
mov rcx, qword [0x180131288]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.180100ce0
mov rbx, rax
cmp qword [r14 + 0x10], 0
je 0x1800f8a86
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
cmp ebp, eax
jg 0x1800f8a86
test ebp, ebp
je 0x1800f8a7a
dec ebp
je 0x1800f8a6d
dec ebp
je 0x1800f8a60
dec ebp
jne 0x1800f8a86
mov rdx, r14
mov rcx, rbx
call fcn.180100ac0
jmp 0x1800f8a86
mov rdx, r14
mov rcx, rbx
call fcn.180101360
jmp 0x1800f8a86
mov rdx, r14
mov rcx, rbx
call fcn.180100dc0
jmp 0x1800f8a86
mov rdx, r14
mov rcx, rbx
call fcn.1801005d0
nop
cmp qword [rsp + 0x80], 0x10
jb 0x1800f8a9b
mov rcx, qword [rsp + 0x68]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1801068d0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800f9aa0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.1800f9cf0
cmp qword [rbx + 0x18], 8
jb 0x1800f9adc
mov rcx, qword [rbx]
jmp 0x1800f9adf
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne dil
cmp qword [rbx + 0x18], 8
jb 0x1800f9afa
mov rcx, qword [rbx]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbx + 0x18], 7
xor eax, eax
mov qword [rbx + 0x10], rax
mov word [rbx], ax
movzx eax, dil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801068d0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180105f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1801313f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x180105ffc
lea ecx, [rax + 0x20]
mov qword [rsp + 0x20], rbx
call sub.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x180105fc4
mov rcx, rax
call fcn.180105830
mov rbx, rax
jmp 0x180105fc6
xor ebx, ebx
mov ecx, dword [0x1801313f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180105fe5
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov ecx, dword [0x1801313f0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret