joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bc5e0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov esi, r8d
mov rbx, rdx
jb 0x1400bc601
mov rcx, qword [rdx]
jmp 0x1400bc604
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
or edi, esi
mov rcx, qword [0x1402b9860]
lea rsi, [0x1402b9860]
cmp rcx, rsi
je 0x1400bc645
test byte [rcx + 0x44], 0x40
je 0x1400bc645
cmp byte [rcx + 0x41], 4
jb 0x1400bc645
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov edx, 0x1f
mov r9d, edi
call fcn.140024fa0
cmp qword [rbx + 0x18], 8
jb 0x1400bc651
mov rcx, qword [rbx]
jmp 0x1400bc654
mov rcx, rbx
mov edx, edi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
test eax, eax
jne 0x1400bc6be
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [0x1402b9860]
cmp rcx, rsi
je 0x1400bc6a9
test byte [rcx + 0x44], 0x40
je 0x1400bc6a9
cmp byte [rcx + 0x41], 2
jb 0x1400bc6a9
cmp qword [rbx + 0x18], 8
jb 0x1400bc688
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140231f38]
mov dword [rsp + 0x28], eax
mov edx, 0x20
mov r9d, edi
mov qword [rsp + 0x20], rbx
call fcn.1400bcf70
mov eax, 0x3eb
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c0ac0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea rax, [0x1402b9860]
mov rcx, qword [0x1402b9860]
cmp rcx, rax
je 0x1400c0b2a
test dword [rcx + 0x44], 0x8000
je 0x1400c0b2a
cmp byte [rcx + 0x41], 4
jb 0x1400c0b2a
mov edx, 0x11
mov r9d, dword [rbx + 0x58]
lea r8, [0x140234d88]
mov rcx, qword [rcx + 0x38]
call fcn.140025240
lea rcx, [rbx + 0x30]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov byte [rsp + 0x38], 1
mov eax, dword [rbx + 0x20]
cmp eax, 4
je 0x1400c0b50
mov edi, 0x139f
jmp 0x1400c0bed
mov dword [rbx + 0x20], 1
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1400c0b70
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x1400c0bed
xor edi, edi
cmp qword [rbx + 0x18], rdi
je 0x1400c0bed
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rcx, qword [0x1402bf880]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdx, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], dil
mov r9d, 0xb8
lea r8, str.ServiceThread::resume
lea rcx, [rsp + 0x48]
call fcn.140074410
mov rcx, qword [rbx + 0x18]
call fcn.1400c0c20
mov qword [rbx + 0x18], rdi
cmp byte [rsp + 0x50], dil
jne 0x1400c0bed
lea rcx, [rsp + 0x48]
call fcn.140074ee0
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401b1920
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x1400c0cc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx esi, dl
mov rcx, qword [rcx + 0x60]
add rcx, 0xa0
call fcn.1400ae860
mov edi, eax
test eax, eax
je 0x14008cbb1
mov rcx, qword [0x1402b9860]
lea rdx, [0x1402b9860]
cmp rcx, rdx
je 0x14008cb9f
test byte [rcx + 0x44], 4
je 0x14008cb9f
cmp byte [rcx + 0x41], 2
jb 0x14008cb9f
mov edx, 0x2d
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022c9d0]
call fcn.140022ad0
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x60]
mov ecx, dword [rax + 0xac]
cmp ecx, 2
je 0x14008cc18
mov rcx, qword [rbx + 0x60]
add rcx, 0xa0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, eax
test eax, eax
je 0x14008cbfd
mov rcx, qword [0x1402b9860]
lea rdx, [0x1402b9860]
cmp rcx, rdx
je 0x14008cb9f
test byte [rcx + 0x44], 4
je 0x14008cb9f
cmp byte [rcx + 0x41], 2
jb 0x14008cb9f
mov edx, 0x2e
jmp 0x14008cb8f
movzx edx, sil
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp method.ServiceThread.virtual_16
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx ebp, dl
mov rbx, rcx
mov rcx, qword [0x1402b9860]
lea rax, [0x1402b9860]
cmp rcx, rax
je 0x1400c0d15
test dword [rcx + 0x44], 0x8000
je 0x1400c0d15
cmp byte [rcx + 0x41], 4
jb 0x1400c0d15
mov r9d, dword [rbx + 0x58]
lea r8, [0x140234d88]
mov rcx, qword [rcx + 0x38]
mov edx, 0x12
call fcn.140025240
lea rcx, [rbx + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov eax, dword [rbx + 0x20]
cmp eax, 3
je 0x1400c0d2e
mov edi, 0x139f
jmp 0x1400c0d83
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
movzx eax, bpl
lea r8, [0x1400c0540]
neg al
mov r9, rbx
sbb ecx, ecx
xor edi, edi
and ecx, 4
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ecx
xor edx, edx
xor ecx, ecx
call fcn.1401d9a80
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400c0d70
lea edi, [rax + 0x6f]
jmp 0x1400c0d83
test bpl, bpl
mov edx, 1
mov eax, 4
cmovne edx, eax
mov dword [rbx + 0x20], edx
lea rcx, [rbx + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c1140
Capabilities:
Suspend thread

Disassembly:
push rbx
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea rax, [0x1402b9860]
mov rcx, qword [0x1402b9860]
cmp rcx, rax
je 0x1400c11a2
test dword [rcx + 0x44], 0x8000
je 0x1400c11a2
cmp byte [rcx + 0x41], 4
jb 0x1400c11a2
mov edx, 0x10
mov r9d, dword [rbx + 0x58]
lea r8, [0x140234d88]
mov rcx, qword [rcx + 0x38]
call fcn.140025240
lea rcx, [rbx + 0x30]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov byte [rsp + 0x38], 1
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rcx, qword [0x1402bf880]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdx, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov r9d, 0x89
lea r8, str.ServiceThread::suspend
lea rcx, [rsp + 0x48]
call fcn.140074410
nop
mov rcx, qword [rbx + 0x10]
call fcn.1400c12c0
mov qword [rbx + 0x18], rax
mov eax, dword [rbx + 0x20]
cmp eax, 1
je 0x1400c1229
mov ebx, 0x139f
jmp 0x1400c1279
mov dword [rbx + 0x20], 4
mov rcx, qword [0x1402bf880]
mov rax, qword [rcx]
call qword [rax + 0x28]
lea rcx, [rax + 0x10]
call fcn.140031ad0
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SuspendThread]
mov ebx, eax
mov rcx, qword [0x1402bf880]
mov rdx, qword [rcx]
call qword [rdx + 0x28]
lea rcx, [rax + 0x10]
call fcn.140031af0
cmp ebx, 0xffffffff
jne 0x1400c1277
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x1400c1279
xor ebx, ebx
cmp byte [rsp + 0x50], 0
jne 0x1400c128b
lea rcx, [rsp + 0x48]
call fcn.140074ee0
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401b1920
add rsp, 0x90
pop rbx
ret
Function at 0x1400fb4d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x68
movzx eax, byte [rdx]
mov r14, rdx
mov rdi, rcx
cmp al, 0xaf
jne 0x1400fb4e9
movzx eax, byte [rdx + 2]
cmp al, 0xb0
jne 0x1400fb4f3
mov rax, qword [rdx + 0x20]
jmp 0x1400fb503
cmp al, 0x89
jne 0x1400fb687
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x1400fb687
mov dword [r8], 0
cmp byte [rdx], 0x89
jne 0x1400fb52a
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.140124f00
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x1400fb672
mov qword [rsp + 0x80], rbx
lea rcx, [0x14014eb50]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r15
lea r13, [fcn.1400fc710]
xor r15d, r15d
mov qword [rsp + 0x98], rsi
lea edx, [r15 + 2]
nop dword [rax + rax]
cmp byte [rdi + 0x23], 0
mov rax, qword [r14 + 0x20]
mov rbx, qword [rax + r15 + 8]
je 0x1400fb5e0
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x1400fb5d0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14017ccd0
cmp word [rsp + 0x44], 0
je 0x1400fb5e0
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.14012e1f0
jmp 0x1400fb620
mov rsi, qword [rdi]
test rbx, rbx
je 0x1400fb5fc
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.1400fb960
mov rbx, rax
cmp byte [rsi + 0x63], 0
jne 0x1400fb610
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.14012c7a0
test rbx, rbx
je 0x1400fb620
mov rdx, rbx
mov rcx, rsi
call fcn.14012fd70
inc ebp
lea rcx, [0x14014eb50]
add r15, 0x20
mov edx, 2
sub r12, 1
jne 0x1400fb590
mov eax, dword [rsp + 0x88]
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.14012f700
Function at 0x140114010
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, qword [rsp + 0x70]
mov ebx, r8d
mov qword [rax - 0x18], r14
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___Q_NULL
mov rsi, rcx
call fcn.14013e6d0
test ebx, ebx
jne 0x140114079
mov r9, rbp
mov qword [rsp + 0x20], r14
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___Q_NULL
mov rcx, rsi
call fcn.14013e6d0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140132400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x140132509
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x140237d20]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x140132481
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x1401324bc
test ecx, ecx
jne 0x1401324ca
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.1400fd7e0
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x1401324a0
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x140132440
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x1401324cf
inc r8
jmp 0x140132470
test r10d, r10d
jne 0x140132499
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x1401324f5
test edx, edx
je 0x140132481
inc rax
jmp 0x1401324e0
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x140132499
inc rax
jmp 0x1401324e0
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140178800
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.14013de30
mov rbx, rax
test rax, rax
jne 0x14017883e
lea eax, [rbx + 7]
jmp 0x1401788c0
cmp byte [0x1402b6284], 0
je 0x140178892
mov rax, qword [0x1402b6408]
test rax, rax
je 0x14017885e
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
call rax
test eax, eax
jne 0x140178892
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x140150da0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call fcn.1401d9a80
mov qword [rbx], rax
test rax, rax
jne 0x1401788a2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x1401788bb
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401b7ad8
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x14024b9a8]
xor ecx, ecx
lea r8, [0x14024b9a0]
lea rdx, str.FlsAlloc
call fcn.1401b7654
mov rbx, rax
test rax, rax
je 0x1401b7b18
mov rcx, rax
call fcn.1401b2d04
mov rcx, rdi
call rbx
jmp 0x1401b7b1e
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401b7b80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x14024b9b8]
mov ecx, 2
lea r8, [0x14024b9b0]
lea rdx, str.FlsGetValue
call fcn.1401b7654
mov rdi, rax
test rax, rax
je 0x1401b7bc1
mov rcx, rax
call fcn.1401b2d04
mov ecx, ebx
call rdi
jmp 0x1401b7bc9
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1401b7bd4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x14024b9c0]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x14024b9b8]
call fcn.1401b7654
mov rsi, rax
test rax, rax
je 0x1401b7c20
mov rcx, rax
call fcn.1401b2d04
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1401b7c2b
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401db6c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1401db4a7
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test rax, rax
je 0x1401db4a7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401db4a7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401db4a7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401db4a7
cmp dword [rcx + 0x84], 0xe
jbe 0x1401db4a7
cmp dword [rcx + 0xf8], 0
je 0x1401db4a7
mov ecx, ebx
call fcn.1401db5d8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1401db220
cmp dword [rbp + 0x20], 0
je 0x1401db4f4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401db4fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x1401db440
Function at 0x14001ab40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001accb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1406dbbd0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140038a80
xorps xmm15, xmm15
mov r14, qword [0x140ee5468]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001aba5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x14001abb4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x14001abd3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001abe3
cmp rbx, 0x1000
jae 0x14001abab
jmp 0x14001ac4d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x14001abf5
xor edx, edx
jmp 0x14001ac44
mov rcx, qword [0x1406dbbd0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140038a80
xorps xmm15, xmm15
mov r14, qword [0x140ee5468]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x14001abd9
jmp 0x14001abc8
call fcn.14006cf80
xorps xmm15, xmm15
mov r14, qword [0x140ee5468]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003d160
lea rax, [0x14088a204]
mov ebx, 0x18
nop dword [rax]
call fcn.14003d9e0
mov rax, qword [rsp + 0x38]
call fcn.14003d720
lea rax, [0x14088b20c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.14003d9e0
mov rax, qword [rsp + 0x30]
call fcn.14003d720
call fcn.14003d3a0
call fcn.14003d1c0
lea rax, [0x1408926cc]
mov ebx, 0x21
call fcn.14003b7c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069840
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14001ab40
Function at 0x14001ad00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001af26
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x1406dbbc8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140038b00
xorps xmm15, xmm15
mov r14, qword [0x140ee5468]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x14001ad73
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x14001ad82
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x14001ada5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x14001adb5
cmp rbx, 0x1000
jae 0x14001ad79
nop
jmp 0x14001ae38
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x14001adcd
xor esi, esi
jmp 0x14001ae2a
mov rax, qword [0x1406dbbc8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140038b00
xorps xmm15, xmm15
mov r14, qword [0x140ee5468]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x14001adab
jmp 0x14001ad96
call fcn.14006cf80
xorps xmm15, xmm15
mov r14, qword [0x140ee5468]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x14001aec0
nop dword [rax + rax]
call fcn.14003d160
lea rax, [0x14088b225]
mov ebx, 0x19
call fcn.14003d9e0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.14003d720
lea rax, [0x14088b20c]
mov ebx, 0x19
call fcn.14003d9e0
mov eax, dword [rsp + 0x34]
call fcn.14003d720
nop
call fcn.14003d3a0
call fcn.14003d1c0
lea rax, [0x1408805d8]
mov ebx, 0xd
call fcn.14003b7c0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x14001ae60
call fcn.14003d160
lea rax, [0x14088b225]
mov ebx, 0x19
call fcn.14003d9e0
mov rax, qword [rsp + 0x38]
call fcn.14003d720
lea rax, [0x14088b20c]
mov ebx, 0x19
call fcn.14003d9e0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.14003d720
call fcn.14003d3a0
call fcn.14003d1c0
lea rax, [0x140890b95]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.14003b7c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069840
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.14001ad00
Function at 0x140024600
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x140ee50b5], 0
jne 0x1400246e7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x1400246da
lea rbx, [0x140eb7498]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x1400246c0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.14006bb40
lea rax, [0x140899d84]
mov ebx, 0x2c
call fcn.14003b7c0
nop
int3

Function at 0x140025be0
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140025c90
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rax, [0x14087d92f]
mov ebx, 0xa
nop
call fcn.14000b880
test rbx, rbx
je 0x140025c1d
cmp rbx, 3
jne 0x140025c2d
cmp word [rax], 0x666f
jne 0x140025c2d
cmp byte [rax + 2], 0x66
jne 0x140025c2d
movabs rax, 0x7fffffffffffffff
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rax
call fcn.140054a20
nop dword [rax]
test bl, bl
je 0x140025c4a
add rsp, 0x20
pop rbp
ret
call fcn.14003d160
lea rax, [0x14087e731]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.14003d9e0
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
call fcn.14003d9e0
call fcn.14003d3a0
call fcn.14003d1c0
lea rax, [0x1408a0e53]
mov ebx, 0x3f
call fcn.14003b7c0
nop
call fcn.140069840
jmp fcn.140025be0