joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eea0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov rsi, r8
mov r12, rcx
movsxd rbx, edx
call sym.strlen
mov r8, rax
lea eax, [rax + 0xf]
mov dword [rbp - 0x54], eax
lea eax, [r8 + 0x51]
lea edi, [r8 + 0x10]
cdqe
lea r15d, [r8 + 0x50]
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0040d770
movabs rcx, 0x656d68732d636367
sub rsp, rax
movsxd r13, r8d
mov rdx, r12
mov eax, 0x326d
mov r8, r13
mov qword [rsp + 0x20], rcx
lea r14, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
mov byte [rsp + 0x2e], 0x2d
call sym.memcpy
lea rax, [r14 + r13 + 0x10]
movsxd r12, dword [rbp - 0x54]
mov r8, r14
movabs rdx, 0x6161616161616161
movabs rcx, 0x6161616161616161
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rdx
xor edx, edx
mov qword [rax + 0x38], rcx
movsxd rax, r15d
xor ecx, ecx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + r12 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + r12 + 0x20], 0x2d
mov edx, 0xffffffff
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41ef9e
int3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
je 0x41eff0
mov rdx, r14
movzx ecx, ax
mov r9d, edi
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov r14, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r14
lea rsp, [rbp - 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rbx
call sym.malloc
mov r12, rax
mov eax, 0x40
bt r12, rax
jae 0x41f013
mov edx, r15d
sub edx, eax
movsxd rdx, edx
mov byte [r14 + rdx], 0x41
sub eax, 1
jne 0x41f000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
jne 0x41f027
int3
mov rdx, r14
movzx ecx, ax
mov r9d, edi
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov r14, rax
cmp r12, rax
je 0x41f04d
mov rcx, r12
call sym.free
jmp 0x41efc0
xor edx, edx
mov r8, rbx
mov rcx, rax
call sym.memset
test rsi, rsi
je 0x41efc0
mov rcx, r14
call rsi
jmp 0x41efc0

Function at 0x41f470
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_rwl_global_shmem]
mov edx, 8
lea rcx, str.rwl_global_shmem
jmp sym.__shmem_winpthreads_grab

Function at 0x41f540
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_rwlock]
mov edx, 8
lea rcx, str.cond_locked_shmem_rwlock
jmp sym.__shmem_winpthreads_grab

Function at 0x420340
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init_init]
mov edx, 8
lea rcx, str.init
jmp dbg.__shmem_grab

Function at 0x420360
Capabilities:
Check mutex on windows

Disassembly:
xor r8d, r8d
mov edx, 0x10
lea rcx, str.eh_globals
jmp dbg.__shmem_grab
Function at 0x4209f0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
mov edx, 8
lea rcx, str.__terminate_handler_sh
jmp dbg.__shmem_grab

Function at 0x420a10
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
mov edx, 8
lea rcx, str.__unexpected_handler_sh
jmp dbg.__shmem_grab

Function at 0x422220
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x42224c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x422eb0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp byte [0x004b7e50], 0
jne 0x422fba
mov byte [0x004b7e50], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x422f90
mov r12, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [r12], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add r12, rax
mov rcx, r12
call sym.__cxa_demangle
mov ecx, 2
mov rbx, qword [dbg.__acrt_iob_func]
mov r13, rax
call rbx
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x422f81
call rbx
mov rcx, r12
mov rdx, rax
call sym.fputs
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x004b9911]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x422f7c
mov rcx, r13
call sym.free
call sym.__cxa_rethrow
call rbx
mov rcx, r13
mov rdx, rax
call sym.fputs
jmp 0x422f4b
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x42304f
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sym.fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x422fb5
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x422fb5

Function at 0x47c6e0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x47c707
call rbp
cmp dword [rax], 4
jne 0x47c724
mov rcx, rdi
call method.std::__basic_file_char_.fd__
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x47c700
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140005e30
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x68], rbx
cmp dword [0x140012510], ebx
jne 0x140005ef3
mov eax, dword [0x14001250c]
test eax, eax
jne 0x140005ef3
mov ecx, dword [0x140012504]
test ecx, ecx
je 0x140005e93
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14001250c]
mov ecx, dword [0x140012504]
test eax, eax
jne 0x140005ef3
test ecx, ecx
jne 0x140005ea4
call fcn.140003700
test eax, eax
je 0x140005eba
lea rdx, [rsp + 0x68]
mov rcx, qword [0x140010048]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x140005ef3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x140005ee9
cmp eax, 0x78
je 0x140005ee9
cmp eax, 1
je 0x140005ee9
cmp eax, 0x32
je 0x140005ee9
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [0x14001250c], 1
mov qword [rsp + 0x20], rbx
lea r9, [0x140004740]
mov r8, rdi
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x30], rax
cmp dword [0x140012510], 0
je 0x140005f27
cmp dword [0x14001250c], 0
jne 0x140005f55
mov edi, ebx
test rsi, rsi
sete dil
test edi, edi
je 0x140005f3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x140005f55
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140007fdc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008026
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008026
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008026
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008026
cmp dword [rcx + 0x84], 0xe
jbe 0x140008026
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008028
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4cfd40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d0742
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d07da
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d07be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d07b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d07b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d0778
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d07db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d08e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d0908
mov eax, 0
jmp 0x2fc4d0956
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d0931
mov eax, 0
jmp 0x2fc4d0956
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d0951
mov eax, 0
jmp 0x2fc4d0956
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d095c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d09da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d09d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d09d1
mov rax, qword [rbp - 8]
jmp 0x2fc4d09ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d09a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400010a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r11d, r11d
movsxd r9, r9d
mov rbx, rcx
mov r10d, r11d
test r9, r9
je 0x140001124
sub rdx, r8
lea eax, [r11 + 1]
and eax, 0x800000ff
jge 0x1400010d7
dec eax
or eax, 0xffffff00
inc eax
movsxd r11, eax
movzx esi, byte [r11 + rbx]
add r10d, esi
and r10d, 0x800000ff
jge 0x1400010f8
dec r10d
or r10d, 0xffffff00
inc r10d
movsxd rcx, r10d
mov al, byte [rcx + rbx]
mov byte [r11 + rbx], al
mov byte [rcx + rbx], sil
movzx eax, byte [r11 + rbx]
add rax, rsi
movzx eax, al
mov cl, byte [rax + rbx]
xor cl, byte [rdx + r8]
mov byte [r8], cl
inc r8
sub r9, 1
jne 0x1400010c3
mov rbx, qword [rsp + 8]
xor eax, eax
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140001188
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [section..data]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, dword [section..data]
mov rbx, rax
mov r8d, r9d
test r9d, r9d
je 0x1400011c9
xor edx, edx
mov rcx, rax
call fcn.1400011ec
mov r9d, dword [section..data]
mov r8, rbx
lea rdx, [0x140003004]
lea rcx, str.EvqeLlpJtyJIVPVrnZPhgdqYDRiulzGRffgsYHIR
call fcn.140001138
call rbx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
in eax, 0xec
xchg ebx, eax
cmp dword [rdx + 0x74], 0xffffff97
jae 0x1400209fd
pop rsi
hlt
fidiv word [rbp + 0x88dd7af]
movabs r13, 0x521dcb45d51d07b4
pop rsi
xchg ah, dl
hlt
Function at 0x1400022f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000233e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000233e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000233e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000233e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000233e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002340
xor al, al
add rsp, 0x28
ret
Function at 0x140003044
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rcx, rdx
call fcn.140004fa4
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400030b5
lea rdx, [0x14003dab3]
mov rcx, rdi
call fcn.140004e18
jmp 0x140003153
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400030d9
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14003dab6]
jmp 0x1400030a8
lea rcx, [rsp + 0x48]
call fcn.140004db8
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.140004efc
lea rcx, [rsp + 0x48]
xor edx, edx
call fcn.140004e9c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14000313a
cmp dword [rsp + 0x40], esi
jne 0x14000313a
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140004e4c
jmp 0x140003149
lea rdx, [0x14003dab7]
mov rcx, rdi
call fcn.140004e18
lea rcx, [rsp + 0x48]
call fcn.140004e88
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001c0c0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400035d0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.sqlite.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14004bb10], rax
test rax, rax
je 0x140003717
lea rdx, str.sqlite3_open
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004bb10]
lea rdx, str.sqlite3_open16
mov qword [0x14004bb18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004bb10]
lea rdx, str.sqlite3_prepare_v2
mov qword [0x14004bb50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004bb10]
lea rdx, str.sqlite3_column_text
mov qword [0x14004bb20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004bb10]
lea rdx, str.sqlite3_column_blob
mov qword [0x14004bb28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004bb10]
lea rdx, str.sqlite3_column_bytes
mov qword [0x14004bb30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004bb10]
lea rdx, str.sqlite3_step
mov qword [0x14004bb38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14004bb10]
lea rdx, str.sqlite3_close
mov qword [0x14004bb40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14004bb18], 0
mov qword [0x14004bb48], rax
je 0x14000370a
cmp qword [0x14004bb20], 0
je 0x14000370a
cmp qword [0x14004bb28], 0
je 0x14000370a
cmp qword [0x14004bb30], 0
je 0x14000370a
cmp qword [0x14004bb38], 0
je 0x14000370a
cmp qword [0x14004bb40], 0
je 0x14000370a
test rax, rax
je 0x14000370a
mov al, 1
jmp 0x140003719
mov rcx, qword [0x14004bb10]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
add rsp, 0x28
ret
Function at 0x1400057ec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x140048490]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r12d, dx
mov rsi, rcx
mov word [rbp - 0x39], dx
call fcn.1400018ec
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x35]
movzx edi, ax
mov word [rbp - 0x35], ax
call fcn.1400018b4
test al, al
je 0x140005848
lea rcx, [rbp - 0x39]
call fcn.1400018c0
jmp 0x140005a20
mov rcx, rsi
call fcn.140007728
test rax, rax
je 0x14000588d
mov rcx, rsi
call fcn.140007864
mov rcx, rsi
mov rbx, rax
call fcn.140007728
cmp rax, rbx
jae 0x14000588d
mov rcx, rsi
call fcn.1400078d4
lea rcx, [rbp - 0x39]
mov rbx, rax
call fcn.1400018b0
mov word [rbx], ax
movzx eax, r12w
jmp 0x140005a20
cmp qword [rsi + 0x98], 0
je 0x140005a1d
mov rcx, rsi
call fcn.140007d38
lea rcx, [rbp - 0x39]
call fcn.1400018b0
cmp qword [rsi + 0x80], 0
jne 0x1400058d1
mov rdx, qword [rsi + 0x98]
movzx ecx, ax
call fcn.140002df8
test al, al
cmovne di, r12w
jmp 0x140005a1d
xor r8d, r8d
lea rcx, [rbp - 1]
mov word [rbp - 0x39], ax
lea edx, [r8 + 8]
call fcn.140006e1c
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
lea rcx, [rbp - 1]
mov rbx, rax
call fcn.140004fac
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 1]
add rbx, rax
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
lea rcx, [rbp - 0x31]
lea r9, [rbp - 0x37]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsi + 0x80]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
lea r8, [rbp - 0x39]
lea rdx, [rsi + 0x8c]
mov qword [rsp + 0x20], rax
call fcn.140001df0
test eax, eax
js 0x140005a14
cmp eax, 1
jg 0x1400059f8
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov rbx, qword [rbp - 0x31]
sub rbx, rax
je 0x1400059b5
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
call fcn.140007200
mov rcx, rax
call fcn.1400081c0
mov r9, qword [rsi + 0x98]
mov r8, rbx
mov rcx, rax
mov edx, 1
call fcn.14001df1c
cmp rbx, rax
jne 0x140005a14
lea rax, [rbp - 0x39]
mov byte [rsi + 0x8a], 1
cmp qword [rbp - 0x29], rax
jne 0x1400059f2
test rbx, rbx
jne 0x1400058e5
lea rcx, [rbp - 1]
call fcn.140004fac
cmp rax, 0x20
jae 0x140005a14
lea edx, [rbx + 8]
lea rcx, [rbp - 1]
xor r8d, r8d
call fcn.140006eec
jmp 0x1400058e5
movzx edi, r12w
jmp 0x140005a14
cmp eax, 3
jne 0x140005a14
mov rdx, qword [rsi + 0x98]
movzx ecx, word [rbp - 0x39]
call fcn.140002df8
test al, al
cmovne di, r12w
lea rcx, [rbp - 1]
call fcn.140004e88
movzx eax, di
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14001c0c0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret