joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400677e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x20], 0
mov rbx, rcx
je 0x14006783d
mov rcx, qword [rcx]
call fcn.1400661d0
mov ecx, eax
test eax, eax
jne 0x14006785b
movups xmm1, xmmword [rbx + 0x28]
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x38], xmm1
movups xmmword [rbx + 0x28], xmm0
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rax
jne 0x140067826
mov eax, ecx
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
lea rdx, [0x1400677c0]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.140038450
call fcn.1400674f0
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x28], xmm0
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x14006785b
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret

Function at 0x140068730
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x48]
xor ebx, ebx
mov r14, qword [rcx + 0x10]
mov r15, r9
mov ebp, r8d
mov r13, rdx
mov rdi, qword [rsi + 0x30]
test rdi, rdi
jne 0x1400687b9
movzx eax, word [r14 + 6]
imul ecx, eax, 0x38
add ecx, 0x58
movsxd rdx, ecx
mov rcx, qword [r14 + 0x10]
call fcn.140036150
mov rdi, rax
test rax, rax
jne 0x14006878d
mov edi, ebx
jmp 0x1400687a4
add rax, 0x20
mov qword [rdi], r14
mov qword [rdi + 0x10], rax
movzx eax, word [r14 + 6]
inc ax
mov word [rdi + 8], ax
mov qword [rsi + 0x30], rdi
test rdi, rdi
jne 0x1400687b5
lea eax, [rdi + 7]
jmp 0x14006883b
mov word [rdi + 8], bp
cmp byte [rsi + 0x58], bl
je 0x1400687f3
cmp byte [rsi + 0x59], bl
je 0x1400687d1
mov rax, qword [rsi + 0x10]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x1400687fb
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x1400687fb
mov rax, qword [rsi + 0x38]
lea r8, [rax + 0x10]
mov edx, dword [rax]
mov r9, rdi
mov rcx, r14
call fcn.1400596f0
test ebp, ebp
jle 0x140068823
mov rax, qword [rdi + 0x10]
add rax, 8
test byte [rax], 1
jne 0x14006885a
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x140068814
mov rdx, qword [r13 + 0x10]
xor r9d, r9d
mov ecx, dword [r13 + 0xc]
mov r8, rdi
call fcn.140059cc0
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
mov dword [r15], 0xffffffff
jmp 0x140068839
Function at 0x14006f430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
lea r10, [rcx + 0x88]
mov ebx, r9d
mov esi, r8d
mov rdi, rcx
xor r11d, r11d
nop dword [rax]
cmp dword [r10 + 0xc], 0
jle 0x14006f475
cmp dword [r10], ebx
jne 0x14006f475
movsx eax, word [r10 + 4]
cmp eax, esi
je 0x14006f4c1
inc r11d
add r10, 0x14
cmp r11d, 0xa
jl 0x14006f460
mov qword [rsp + 0x40], rbp
mov r9d, esi
mov ebp, dword [rsp + 0x60]
mov r8d, ebx
mov rcx, r14
mov dword [rsp + 0x20], ebp
call fcn.14006f350
movzx edx, byte [rsp + 0x68]
test dl, dl
je 0x14006f4ef
mov rax, qword [r14]
mov ecx, dword [r14 + 0x3c]
dec ecx
cmp byte [rax + 0x51], 0
je 0x14006f4da
lea rax, [0x140330198]
mov byte [rax + 3], dl
jmp 0x14006f4ff
mov eax, dword [rcx + 0x74]
mov dword [r10 + 0x10], eax
inc dword [rcx + 0x74]
mov edx, dword [r10 + 0xc]
call fcn.14006f2b0
mov eax, dword [r10 + 0xc]
jmp 0x14006f506
movsxd rax, ecx
lea rcx, [rax + rax*2]
mov rax, qword [r14 + 8]
mov byte [rax + rcx*8 + 3], dl
lea rax, [rax + rcx*8]
jmp 0x14006f4ff
mov r9d, ebp
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call fcn.14006f080
mov eax, ebp
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140071800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x20
mov r9d, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400719ad
test rdx, rdx
je 0x1400719ad
mov eax, dword [rcx + 4]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov esi, dword [rdx + 4]
mov ebp, esi
or ebp, eax
bt ebp, 0xa
jae 0x140071860
and esi, eax
bt esi, 0xa
jae 0x1400718df
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1400718df
xor eax, eax
jmp 0x1400718a3
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x1400718b8
cmp r8b, 0x5f
jne 0x140071885
mov rcx, qword [rcx + 0x10]
mov r8d, r9d
call fcn.140071800
cmp eax, 2
jl 0x14007189e
mov r9d, dword [rsp + 0x40]
cmp byte [rbx], 0x5f
jne 0x1400718df
mov rdx, qword [rbx + 0x10]
mov r8d, r9d
mov rcx, rdi
call fcn.140071800
cmp eax, 2
jge 0x1400718df
mov eax, 1
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea eax, [r8 + 0x66]
test al, 0xfd
je 0x14007191a
mov rax, qword [rcx + 8]
test rax, rax
je 0x14007191a
cmp r8b, 0x99
jne 0x1400718e6
mov rdx, qword [rdx + 8]
mov rcx, rax
call fcn.140038f60
test eax, eax
je 0x140071915
mov eax, 2
jmp 0x1400718a3
mov r10, qword [rdx + 8]
sub r10, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x140071903
inc rax
test ecx, ecx
jne 0x1400718f0
test edx, edx
je 0x14007191a
xor ecx, ecx
cmp r8b, 0x5f
setne cl
lea eax, [rcx + 1]
jmp 0x1400718a3
mov r9d, dword [rsp + 0x40]
xor esi, dword [rdi + 4]
test sil, 0x10
jne 0x1400718df
bt ebp, 0xe
jb 0x1400719a6
bt ebp, 0xb
jb 0x1400718df
mov rdx, qword [rbx + 0x10]
mov r8d, r9d
mov rcx, qword [rdi + 0x10]
call fcn.140071800
test eax, eax
jne 0x1400718df
mov esi, dword [rsp + 0x40]
mov r8d, esi
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.140071800
test eax, eax
jne 0x1400718df
mov rdx, qword [rbx + 0x20]
mov r8d, esi
mov rcx, qword [rdi + 0x20]
call fcn.1400719d0
test eax, eax
jne 0x1400718df
bt ebp, 0xd
jb 0x1400719a6
cmp byte [rdi], 0x61
je 0x1400719a6
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x1400718df
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x1400719a6
cmp ecx, esi
jne 0x1400718df
test eax, eax
jns 0x1400718df
xor eax, eax
jmp 0x1400718a3
xor ecx, ecx
mov eax, 2
cmp rbx, rdi
mov rbx, qword [rsp + 0x48]
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140072ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r12
push r15
sub rsp, 0x38
mov r12d, r8d
movsxd r15, edx
mov rbx, rcx
call fcn.140094390
mov rsi, rax
test rax, rax
je 0x1400731ea
movzx eax, byte [rbx + 0x1f]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x30], r14
test al, al
jne 0x14007303a
inc dword [rbx + 0x54]
mov r14d, dword [rbx + 0x54]
jmp 0x140073047
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0x24]
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x140073057
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x140073063
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov r9d, r14d
mov dword [rsp + 0x20], 2
mov r8d, r15d
mov edx, gethostbyname
mov rcx, rsi
call fcn.140056030
mov eax, dword [rsi + 0x94]
bts eax, r15d
mov dword [rsi + 0x94], eax
cmp r15d, 1
je 0x1400730bd
mov rax, qword [rsi]
mov rdx, r15
shl rdx, 5
mov rcx, qword [rax + 0x20]
mov rax, qword [rdx + rcx + 8]
cmp byte [rax + 0x11], 0
je 0x1400730bd
mov eax, dword [rsi + 0x98]
bts eax, r15d
mov dword [rsi + 0x98], eax
xor edi, edi
mov r9d, ebp
mov r8d, r12d
mov dword [rsp + 0x20], edi
mov rcx, rsi
lea edx, [rdi + 0x17]
call fcn.140056030
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov r8d, ebp
lea edx, [rdi + 0x53]
mov rcx, rsi
call fcn.140056030
mov rcx, qword [rsi]
lea r13, [0x140330198]
mov r12d, eax
mov eax, dword [rsi + 0x3c]
dec eax
cmp byte [rcx + 0x51], dil
je 0x140073107
mov rax, r13
jmp 0x140073115
cdqe
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 8]
lea rax, [rax + rcx*8]
mov r9d, 2
mov byte [rax + 3], 0x90
mov r8d, r15d
mov dword [rsp + 0x20], ebp
mov rcx, rsi
lea edx, [r9 + 0x32]
call fcn.140056030
mov ecx, dword [rsi + 0x3c]
mov rax, qword [rsi + 0x30]
dec ecx
mov dword [rax + 0x64], ecx
mov edx, dword [rsi + 0x3c]
test r12d, r12d
jns 0x14007314a
lea r12d, [rdx - 1]
mov rax, qword [rsi]
cmp byte [rax + 0x51], dil
jne 0x140073162
movsxd rax, r12d
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 8]
lea r13, [rax + rcx*8]
mov dword [r13 + 8], edx
mov r13, qword [rsp + 0x70]
test r14d, r14d
je 0x1400731a4
movzx edx, byte [rbx + 0x1f]
cmp dl, 8
jae 0x1400731a4
mov ecx, edi
lea rax, [rbx + 0x88]
cmp dword [rax + 0xc], r14d
je 0x1400731a0
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x140073182
movzx eax, dl
mov dword [rbx + rax*4 + 0x24], r14d
inc byte [rbx + 0x1f]
jmp 0x1400731a4
mov byte [rax + 6], 1
mov r14, qword [rsp + 0x30]
test ebp, ebp
je 0x1400731e0
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x1400731e0
lea rax, [rbx + 0x88]
nop dword [rax]
cmp dword [rax + 0xc], ebp
je 0x1400731dc
inc edi
add rax, 0x14
cmp edi, 0xa
jl 0x1400731c0
movzx eax, cl
mov dword [rbx + rax*4 + 0x24], ebp
inc byte [rbx + 0x1f]
jmp 0x1400731e0
mov byte [rax + 6], 1
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x38
pop r15
pop r12
pop rsi
pop rbx
ret
Function at 0x140076b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x20
xor r10d, r10d
mov rdi, r8
cmp byte [rcx + 0x330], 3
mov r14, rdx
mov rsi, rcx
jae 0x140076b75
mov rcx, rdx
call fcn.140076ad0
test eax, eax
je 0x140076b75
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x48], rbx
xor ebx, ebx
mov qword [rsp + 0x50], rbp
mov ebp, dword [rsi + 0x28]
test ebp, ebp
jle 0x140076c48
mov qword [rsp + 0x58], r15
lea r15, [0x1402931d0]
mov r9d, ebx
cmp ebx, 2
jge 0x140076ba4
xor r9d, 1
test rdi, rdi
je 0x140076c05
mov rax, qword [rsi + 0x20]
movsxd rcx, r9d
shl rcx, 5
mov r8, qword [rcx + rax]
test r8, r8
je 0x140076c39
movzx edx, byte [rdi]
mov rax, rdi
test dl, dl
je 0x140076bf0
nop dword [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r15]
cmp byte [rdx + r15], cl
jne 0x140076bf0
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x140076bd0
movzx ecx, byte [r8]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r15]
cmp eax, edx
jne 0x140076c39
mov rax, qword [rsi + 0x20]
lea r8, [rsp + 0x40]
movsxd rcx, r9d
mov rdx, r14
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.14003a3b0
test rax, rax
je 0x140076c36
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x140076c43
jmp 0x140076c39
xor r10d, r10d
inc ebx
cmp ebx, ebp
jl 0x140076b98
mov r15, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rax, r10
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140076df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov esi, dword [rcx + 0x28]
xor r9d, r9d
xor ebx, ebx
mov rdi, r8
mov r14, rdx
test esi, esi
jle 0x140076ede
mov qword [rsp + 0x48], rbp
mov rbp, qword [rcx + 0x20]
mov qword [rsp + 0x50], r15
lea r15, [0x1402931d0]
mov eax, ebx
cmp ebx, 2
jge 0x140076e32
xor eax, 1
cdqe
shl rax, 5
mov r10, qword [rax + rbp + 0x18]
test rdi, rdi
je 0x140076e95
mov r8, qword [rax + rbp]
test r8, r8
je 0x140076eb9
movzx edx, byte [rdi]
mov rax, rdi
test dl, dl
je 0x140076e80
nop word [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r15]
cmp byte [rdx + r15], cl
jne 0x140076e80
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x140076e60
movzx ecx, byte [r8]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r15]
cmp eax, edx
jne 0x140076eb9
lea rcx, [r10 + 0x20]
mov rdx, r14
lea r8, [rsp + 0x40]
call fcn.14003a3b0
test rax, rax
je 0x140076eb6
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x140076ec3
jmp 0x140076eb9
xor r9d, r9d
inc ebx
cmp ebx, esi
jl 0x140076e28
mov rbp, qword [rsp + 0x48]
mov rax, r9
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, r9
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400bab80
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rcx
cmp byte [rcx + 0x1bd], 2
jne 0x1400bac4f
mov r8, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
lea rcx, str.SELECT_1_FROM__Q.sqlite_master_WHERE_tbl_name_q_stat
mov qword [rsp + 0x60], rsi
call fcn.140037f90
mov rsi, rax
test rax, rax
je 0x1400bac3a
mov rcx, qword [rdi + 0x18]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
lea r9d, [rbx + 1]
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbx
call fcn.140090ca0
mov ebp, eax
test eax, eax
jne 0x1400bac1b
mov rcx, qword [rsp + 0x50]
call fcn.14005b950
mov rcx, qword [rsp + 0x50]
cmp eax, 0x64
sete bl
call fcn.14005ab60
mov ebp, eax
test eax, eax
jne 0x1400bac1b
mov byte [rdi + 0x1bd], bl
mov rcx, rsi
call fcn.140035dc0
mov rsi, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov eax, 7
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d56e0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov r8, qword [rdx + 0x38]
mov rsi, rdx
mov rdx, qword [rdx + 0x30]
mov rdi, rcx
lea rcx, str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
xor ebx, ebx
call fcn.140037f90
mov rbp, rax
test rax, rax
jne 0x1400d5720
lea eax, [rbx + 7]
jmp 0x1400d57b7
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov r9d, 1
or r8d, 0xffffffff
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rdi
call fcn.140090ca0
mov edi, eax
test eax, eax
jne 0x1400d578c
mov rcx, qword [rsp + 0x58]
call fcn.14005b950
cmp eax, 0x64
jne 0x1400d576d
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.14005c260
mov rbx, rax
mov rcx, qword [rsp + 0x58]
call fcn.14005ab60
mov edi, eax
test edi, edi
jne 0x1400d57ad
test rbx, rbx
jne 0x1400d579d
mov qword [rsi + 0x48], 0x100000
jmp 0x1400d57ad
cmp eax, 7
je 0x1400d5779
mov edi, ebx
mov qword [rsi + 0x48], 0x100000
jmp 0x1400d57ad
mov eax, 0x64
cmp rbx, rax
cmovg rax, rbx
mov qword [rsi + 0x48], rax
mov rcx, rbp
call fcn.140035dc0
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d57d0
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x140320c20]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor r12d, r12d
mov qword [rcx + 0x18], rdx
mov r14, r9
mov rbp, r8
mov r15, rdx
mov rbx, rcx
cmp dword [rsp + 0x120], r12d
je 0x1400d587e
mov eax, dword [rcx + 0x20]
lea rcx, str.CREATE_TABLE___w_.__w_node__nodeno_INTEGER_PRIMARY_KEY__data_BLOB__CREATE_TABLE___w_.__w_rowid__rowid_INTEGER_PRIMARY_KEY__nodeno_INTEGER__CREATE_TABLE___w_.__w_parent__nodeno_INTEGER_PRIMARY_KEY__parentnode_INTEGER__INSERT_INTO__q._q_node_VALUES_1__zeroblob__d__
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r9
mov r9, r8
mov rdx, r9
mov r8, r14
call fcn.140037f90
mov rdi, rax
test rax, rax
jne 0x1400d5856
lea eax, [rdi + 7]
jmp 0x1400d59cc
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call fcn.14008aea0
mov rcx, rdi
mov esi, eax
call fcn.140035dc0
test esi, esi
jne 0x1400d59ca
lea rax, [rbx + 0x60]
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0x50], rax
mov rdx, rbx
lea rax, [rbx + 0x68]
mov rcx, r15
mov qword [rsp + 0x58], rax
lea rax, [rbx + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rbx + 0x78]
mov qword [rsp + 0x68], rax
lea rax, [rbx + 0x80]
mov qword [rsp + 0x70], rax
lea rax, [rbx + 0x88]
mov qword [rsp + 0x78], rax
lea rax, [rbx + 0x90]
mov qword [rsp + 0x80], rax
lea rax, [rbx + 0x98]
mov qword [rsp + 0x88], rax
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x90], rax
call fcn.1400d56e0
mov esi, eax
lea r13, str.SELECT_data_FROM__q._q_node_WHERE_nodeno__:1
mov rdi, r12
test esi, esi
jne 0x1400d59c2
mov rcx, qword [rdi + r13]
mov r8, r14
mov rdx, rbp
call fcn.140037f90
mov rbx, rax
test rax, rax
je 0x1400d59af
mov rcx, qword [rsp + rdi + 0x50]
lea r9d, [rsi + 1]
mov qword [rsp + 0x30], r12
or r8d, 0xffffffff
mov qword [rsp + 0x28], rcx
mov rdx, rax
mov rcx, r15
mov qword [rsp + 0x20], r12
call fcn.140090ca0
cmp dword [reloc.WS2_32.dll_accept], r12d
mov esi, eax
je 0x1400d59a4
mov rcx, qword [0x14032fbf0]
test rcx, rcx
je 0x1400d596d
call qword [0x1403252a8]
mov rcx, rbx
call qword [0x140325260]
dec qword [0x14032fc78]
movsxd rcx, eax
sub qword [0x14032fc30], rcx
mov rcx, rbx
call qword [0x140325250]
mov rcx, qword [0x14032fbf0]
test rcx, rcx
je 0x1400d59b4
call qword [0x1403252b8]
jmp 0x1400d59b4
mov rcx, rbx
call qword [0x140325250]
jmp 0x1400d59b4
mov esi, 7
add rdi, 8
cmp rdi, 0x48
jl 0x1400d5906
mov r13, qword [rsp + 0xb8]
mov eax, esi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140215090
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d5a70
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r15, r9
mov rdi, rdx
mov r14, rcx
test r8d, r8d
je 0x1400d5b2f
mov rdx, qword [rdx + 0x30]
lea rcx, str.PRAGMA__Q.page_size
xor esi, esi
call fcn.140037f90
lea ebx, [rsi + 7]
mov rbp, rax
test rax, rax
je 0x1400d5b12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea r9d, [rsi + 1]
or r8d, 0xffffffff
mov qword [rsp + 0x20], rsi
mov rdx, rbp
mov qword [rsp + 0x40], rsi
mov rcx, r14
call fcn.140090ca0
mov ebx, eax
test eax, eax
jne 0x1400d5b12
mov rcx, qword [rsp + 0x40]
call fcn.14005b950
cmp eax, 0x64
jne 0x1400d5b06
mov rcx, qword [rsp + 0x40]
xor edx, edx
call fcn.14005c1f0
mov esi, eax
mov rcx, qword [rsp + 0x40]
call fcn.14005ab60
mov ebx, eax
test ebx, ebx
jne 0x1400d5b5b
movzx eax, byte [rdi + 0x26]
lea edx, [rsi - 0x40]
imul ecx, eax, 0x33
mov dword [rdi + 0x20], edx
add ecx, 4
cmp ecx, edx
jge 0x1400d5b75
mov dword [rdi + 0x20], ecx
jmp 0x1400d5b75
mov r8, qword [rdx + 0x38]
lea rcx, str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
mov rdx, qword [rdx + 0x30]
call fcn.140037f90
lea r8, [rdi + 0x20]
mov rdx, rax
mov rcx, r14
mov rbp, rax
call fcn.1400d59f0
mov ebx, eax
test eax, eax
je 0x1400d5b75
mov rcx, r14
call fcn.1400b33b0
mov rdx, rax
lea rcx, [0x14028fef0]
call fcn.140037f90
mov qword [r15], rax
mov rcx, rbp
call fcn.140035dc0
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x1400d6380
Capabilities:
Hash data using murmur3

Disassembly:
test r8d, r8d
jle 0x1400d660e
mov r11, rsp
push r15
sub rsp, 0x150
mov rax, qword [0x140320c20]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov qword [r11 + 0x10], rbx
mov r10, rcx
mov qword [r11 + 0x18], rbp
xor r15d, r15d
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
mov dword [rsp + 4], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
nop dword [rax + rax]
mov eax, r15d
lea r9, [rsp + 0x20]
shl eax, 6
movsxd r11, eax
add r11, rdx
xor r8d, r8d
nop dword [rax]
nop dword [rax + rax]
lea eax, [r8*4]
inc r8d
movsxd rcx, eax
lea r9, [r9 + 4]
movzx eax, byte [r11 + rcx + 1]
movzx edx, byte [rcx + r11]
shl edx, 8
or edx, eax
movzx eax, byte [r11 + rcx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [r11 + rcx + 3]
shl edx, 8
or edx, eax
mov dword [r9 - 4], edx
cmp r8d, 0x10
jl 0x1400d6400
lea rax, [rsp + 0x58]
mov r11d, gethostbyname
nop dword [rax]
mov edx, dword [rax]
mov r9d, edx
mov r8d, dword [rax - 0x34]
lea rax, [rax + 4]
mov ecx, edx
rol r9d, 0xf
shr edx, 0xa
rol ecx, 0xd
xor r9d, ecx
mov ecx, r8d
xor r9d, edx
ror ecx, 7
mov edx, r8d
shr r8d, 3
rol edx, 0xe
xor edx, ecx
xor edx, r8d
add r9d, edx
add r9d, dword [rax - 0x3c]
add r9d, dword [rax - 0x18]
mov dword [rax + 4], r9d
sub r11, 1
jne 0x1400d6450
mov r11d, dword [r10 + 0x88]
xor ebx, ebx
mov edi, dword [r10 + 0x8c]
mov esi, dword [r10 + 0x90]
mov r13d, dword [r10 + 0x94]
mov r9d, dword [r10 + 0x98]
mov ebp, dword [r10 + 0x9c]
mov r14d, dword [r10 + 0xa0]
mov r12d, dword [r10 + 0xa4]
lea r10, [0x140290d10]
nop word [rax + rax]
mov r8d, r9d
mov eax, r9d
rol eax, 7
mov ecx, r9d
ror r8d, 0xb
not ecx
xor r8d, eax
and ecx, r14d
mov eax, r9d
mov edx, r11d
ror eax, 6
xor r8d, eax
ror edx, 0xd
mov eax, ebp
and eax, r9d
xor ecx, eax
mov eax, r11d
add r8d, ecx
rol eax, 0xa
add r8d, dword [rbx + r10]
xor edx, eax
add r8d, dword [rsp + rbx + 0x20]
mov eax, r11d
ror eax, 2
add r8d, r12d
xor edx, eax
mov ecx, edi
xor ecx, esi
mov eax, edi
and eax, esi
and ecx, r11d
xor ecx, eax
mov r12d, r14d
add edx, ecx
mov r14d, ebp
mov ebp, r9d
add rbx, 4
lea r9d, [r8 + r13]
mov r13d, esi
mov esi, edi
mov edi, r11d
lea r11d, [rdx + r8]
cmp rbx, 0x100
jl 0x1400d64e0
mov r10, qword [rsp + 8]
mov eax, r12d
mov rdx, qword [rsp + 0x10]
inc r15d
mov dword [rsp], r12d
add dword [r10 + 0x88], r11d
add dword [r10 + 0x8c], edi
add dword [r10 + 0x90], esi
add dword [r10 + 0x94], r13d
add dword [r10 + 0x98], r9d
add dword [r10 + 0x9c], ebp
add dword [r10 + 0xa0], r14d
add dword [r10 + 0xa4], eax
cmp r15d, dword [rsp + 4]
jl 0x1400d63e0
mov r14, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
mov r12, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140215090
add rsp, 0x150
pop r15
ret