joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e1730
Capabilities:
Create udp socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov edi, r8d
mov rsi, rcx
cmp word [rdx], 0
mov eax, 2
mov ebx, 0x17
cmove ebx, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, r8d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1401e1785
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1401e1821
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x1401e1799
cmp eax, 0x2739
jne 0x1401e17ea
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebx
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1401e17e4
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x1401e17ff
mov qword [rsi + 8], rdi
mov qword [rsi], 0
jmp 0x1401e1821
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401e1821
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401e2f10
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1401e2f48
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1401e2f60
nop
add rsp, 0x38
ret

Function at 0x1401e2f60
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1401e2fa3
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.1401d8180]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140345330
ud2
Function at 0x1401e3600
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140473641]
mov ecx, 0x10
mov edx, 8
call fcn.140020a00
test rax, rax
je 0x1401e36df
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1401e3790]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401e36d1
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1401e36a8
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
call fcn.140020a10
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x18]
call fcn.140020a10
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov ecx, 8
mov edx, 0x10
call fcn.140345060
ud2

Function at 0x1401e4b10
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1f0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x140473b80]
cmp rax, 3
jne 0x1401e4c06
cmp rbx, 0x17f
ja 0x1401e4c18
lea r15, [rsp + 0x70]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
inc rbx
lea rcx, [rsp + 0x28]
mov rdx, r15
mov r8, rbx
call fcn.1401f14c0
cmp qword [rsp + 0x28], 0
je 0x1401e4b94
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401e4c29
mov rcx, qword [rsp + 0x30]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401e4bee
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x1401e4c29
mov rax, qword [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
jmp 0x1401e4c29
call fcn.140344510
cmp rbx, 0x17f
jbe 0x1401e4b4a
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
call fcn.1403445f0
mov rax, rsi
add rsp, 0x1f0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1401e4d80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], 0x80
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1401e4e30
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x1401e4e40
cmp ecx, 0x17
jne 0x1401e4e67
cmp eax, 0x1b
jbe 0x1401e4e80
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x1401e4e6e
cmp eax, 0xf
jbe 0x1401e4e98
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argument_
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, [0x14044be28]
mov edx, 0x43
call fcn.140345400
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
lea r8, [0x14044bdc8]
mov edx, 0x42
call fcn.140345400
int3
Function at 0x1401f9660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1401f96da
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1401f96d0
cmp r11, r10
ja 0x1401f9771
cmp r10, rdx
ja 0x1401f9783
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1401f96d2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1401f96b0
jmp 0x1401f9747
ja 0x1401f96da
mov r11, r10
cmp rax, r8
jne 0x1401f9682
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1401f974b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1401f9720
mov r8, r10
sub ecx, r9d
jns 0x1401f973e
jmp 0x1401f974d
cmp r10, rdx
je 0x1401f9759
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1401f974d
xor al, 1
cmp r8, rdx
jne 0x1401f9700
jmp 0x1401f974d
xor eax, eax
jmp 0x1401f974d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14044edd1]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140345400
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1403459b0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140345930
int3
Function at 0x14022edb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rsi, qword [rcx + 0xa8]
mov rbx, rcx
mov rax, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov qword [rsp + 0x60], rax
test rsi, rsi
je 0x14022efc7
mov qword [rsp + 0x70], r12
xor r9d, r9d
mov qword [rsp + 0x78], r13
lea r12, [rdi + 0x88]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x68], rbp
nop word [rax + rax]
movsxd r14, dword [rsi + 0x10]
mov r15d, dword [rsi + 0x14]
shl r14, 5
add r14, qword [rax + 0x20]
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x14022ee20
inc dword [rbx + 0x38]
mov ebp, dword [rbx + 0x38]
jmp 0x14022ee36
dec al
lea r12, [rdi + 0x88]
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0xe8]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r15 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x14022ee63
mov r9d, edx
mov dword [rsp + 0x20], r15d
mov edx, 0x37
mov rcx, rdi
call fcn.1402893b0
jmp 0x14022ee8e
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [r12]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r15d
mov qword [rax + rcx*8 + 0x10], r9
mov r9, qword [r14 + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x71
mov r9, qword [r9 + 0x68]
call fcn.1402e5dd0
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x14022eed2
mov edx, 5
mov rcx, rdi
call fcn.140289420
test eax, eax
jne 0x14022efae
movsxd rax, dword [rdi + 0x90]
xor r9d, r9d
lea rcx, [rax + rax*2]
mov rax, qword [r12]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r9d
lea rax, [rax + rcx*8]
mov ecx, dword [rdi + 0x90]
mov dword [rax + 0xc], r9d
add ecx, 2
mov dword [rax + 8], ecx
mov byte [rax + 1], r9b
mov qword [rax + 0x10], r9
mov word [rax + 2], r9w
mov qword [rax + 0x18], 0x7f
mov qword [rax + 0x20], r9
mov qword [rax + 0x28], r9
mov qword [rax + 0x30], 0x61
mov qword [rax + 0x38], 2
mov qword [rax + 0x40], r9
mov qword [rax + 0x48], 0x80
mov qword [rax + 0x50], r9
mov qword [rax + 0x58], r9
mov qword [rax + 0x60], 0x7a
mov qword [rax + 0x68], r9
mov qword [rax + 0x70], r9
add dword [rdi + 0x90], 5
test rax, rax
je 0x14022efae
mov dword [rax + 0x3c], ebp
lea edx, [r15 + 1]
mov dword [rax + 4], edx
lea ecx, [r15 - 1]
mov dword [rax + 0x20], edx
mov dword [rax + 0x34], ecx
mov dword [rax + 0x54], edx
mov dword [rax + 0x50], ebp
mov word [rax + 0x4a], 8
test ebp, ebp
je 0x14022ef9c
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x14022ef9c
mov dword [rbx + rax*4 + 0xe8], ebp
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
je 0x14022efae
mov rax, qword [rsp + 0x60]
jmp 0x14022ee00
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
mov r14, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140241000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x68
movzx eax, byte [rdx]
mov r14, rdx
mov rdi, rcx
cmp al, 0xb0
jne 0x140241019
movzx eax, byte [rdx + 2]
cmp al, 0xb1
jne 0x140241023
mov rcx, qword [rdx + 0x20]
jmp 0x140241033
cmp al, 0x8a
jne 0x1402411b7
mov rax, qword [rdx + 0x20]
mov rcx, qword [rax + 0x20]
movsxd rcx, dword [rcx]
cmp ecx, 1
je 0x1402411b7
mov dword [r8], 0
cmp byte [rdx], 0x8a
jne 0x14024105a
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.1402b96b0
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x1402411a2
mov qword [rsp + 0x80], rbx
lea rcx, [0x1402f71b0]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r15
lea r13, [fcn.1402423d0]
xor r15d, r15d
mov qword [rsp + 0x98], rsi
lea edx, [r15 + 2]
nop dword [rax + rax]
cmp byte [rdi + 0x23], 0
mov rax, qword [r14 + 0x20]
mov rbx, qword [r15 + rax + 8]
je 0x140241110
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x140241100
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14030ed40
cmp word [rsp + 0x44], 0
je 0x140241110
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1402c2d10
jmp 0x140241150
mov rsi, qword [rdi]
test rbx, rbx
je 0x14024112c
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140241490
mov rbx, rax
cmp byte [rsi + 0x67], 0
jne 0x140241140
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1402c12b0
test rbx, rbx
je 0x140241150
mov rdx, rbx
mov rcx, rsi
call fcn.1402c50f0
inc ebp
lea rcx, [0x1402f71b0]
add r15, 0x20
mov edx, 2
sub r12, 1
jne 0x1402410c0
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x88]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.1402c4780
Function at 0x1402681c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
movsxd rdi, r8d
mov rbp, rdx
mov rsi, rdi
mov qword [rsp + 0x38], r13
shl rsi, 5
mov rbx, rcx
add rsi, rdx
mov qword [rsp + 0x88], rdi
mov r13d, dword [rsi + 0x10]
cmp r13d, dword [rsi + 0x18]
jg 0x140268208
mov dword [rsi + 0x14], 1
jmp 0x1402682cc
mov rbx, qword [rsi + 8]
lea rdx, [rsi + 0x1c]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov r12, qword [rbx]
mov dword [rsi + 0x10], 1
mov rcx, qword [rbx]
inc rcx
call fcn.1402d4210
add dword [rsi + 0x10], eax
lea rdx, [rsi + 0x20]
movsxd rcx, dword [rsi + 0x10]
add rcx, qword [rbx]
call fcn.1402d4020
movzx ebx, al
add ebx, dword [rsi + 0x10]
mov dword [rsi + 0x18], ebx
xor edi, edi
movsxd rcx, ebx
add rcx, r12
mov dword [rsi + 0x10], ebx
mov qword [rsp + 0x78], rdi
cmp byte [rcx], dil
jne 0x14026827d
nop word [rax + rax]
inc edi
lea rcx, [rcx + 1]
inc ebx
cmp byte [rcx], 0
je 0x140268270
movsxd rcx, ebx
lea rdx, [rsp + 0x78]
add rcx, r12
call fcn.1402d4020
movzx eax, al
add ebx, eax
cmp ebx, r13d
jge 0x1402682a8
lea eax, [rdi + 1]
add dword [rsi + 0x1c], eax
mov rax, qword [rsp + 0x78]
add qword [rsi + 0x20], rax
jmp 0x140268250
mov r8d, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
mov r15, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
cmp dword [rsi + 0x14], 0
mov r13, qword [rsp + 0x38]
je 0x140268344
inc r8d
cmp r8d, dword [rbp]
jge 0x140268344
mov rdx, rbp
mov rcx, rbx
call fcn.1402681c0
cmp dword [rsi + 0x34], 0
jne 0x140268344
mov rcx, qword [rsi + 8]
call fcn.140251880
xorps xmm0, xmm0
mov rcx, rbx
movups xmmword [rsi + 8], xmm0
movups xmmword [rsi + 0x18], xmm0
movsxd rdx, dword [rbp + 4]
movsxd rax, dword [rsi + 0x3c]
shl rdx, 6
add rdx, 0x20
add rdx, rdi
shl rdx, 0x1f
add rdx, rax
call fcn.140266de0
mov qword [rsi + 8], rax
test rax, rax
je 0x140268344
lea rcx, [rsi + 8]
call fcn.140268350
test eax, eax
je 0x140268330
mov dword [rsi + 0x14], 0
mov eax, dword [rbp + 0x14]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14027bfe0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x98]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x90]
mov r15d, r9d
and r15d, 8
xor r12d, r12d
mov ebp, r9d
mov rdi, rcx
movups xmmword [rbx + 8], xmm0
mov r13d, 1
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm0
movups xmmword [rbx + 0x68], xmm0
movups xmmword [rbx + 0x78], xmm0
mov qword [rbx], rax
cmp qword [rcx + 0x68], r12
jne 0x14027c07e
mov rdx, qword [rcx]
lea rcx, str.SELECT_pgno_FROM__q._q_idx_WHERE_segid__AND_term___ORDER_BY_term_DESC_LIMIT_1
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.140225d20
mov r8, rax
lea rdx, [rdi + 0x68]
mov rcx, rdi
call fcn.140272630
mov rax, qword [rsp + 0x90]
lea r14, [rdi + 0x3c]
mov rsi, qword [rdi + 0x68]
cmp dword [r14], r12d
jne 0x14027c212
movsxd r8, dword [rax]
mov edx, r13d
mov rcx, rsi
call fcn.140227ce0
mov r9d, dword [rsp + 0x80]
mov edx, 2
mov r8, qword [rsp + 0x78]
mov rcx, rsi
mov qword [rsp + 0x20], r12
call fcn.140227a60
mov rcx, rsi
call fcn.140228410
cmp eax, 0x64
jne 0x14027c0e0
xor edx, edx
mov rcx, rsi
call fcn.1402287c0
mov r13d, eax
mov r12d, eax
sar r13d, 1
and r12d, 1
mov rcx, rsi
call fcn.1402296c0
mov edx, 1
mov dword [r14], eax
mov rcx, rsi
call fcn.140323900
test eax, eax
jne 0x14027c10e
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x14027c10e
call qword [0x14046b0c0]
mov rax, qword [rsp + 0x90]
mov esi, 0
mov rdx, rbx
mov rcx, rdi
mov eax, dword [rax + 4]
cmp r13d, eax
cmovge eax, r13d
cmovge esi, r12d
dec eax
mov dword [rbx + 0xc], eax
call fcn.14027b420
cmp qword [rbx + 0x10], 0
je 0x14027c15e
mov eax, dword [rsp + 0x80]
mov r8, rbx
mov r9, qword [rsp + 0x78]
mov edx, r15d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.1402754c0
cmp dword [r14], 0
jne 0x14027c1c0
test r15d, r15d
jne 0x14027c1c0
mov edx, dword [rbx + 8]
mov rax, qword [rbx + 0x10]
or edx, 1
mov dword [rbx + 8], edx
test rax, rax
je 0x14027c1c0
and ebp, 2
je 0x14027c186
or edx, 2
mov dword [rbx + 8], edx
test esi, esi
je 0x14027c1b1
mov r9d, dword [rbx + 0x40]
and edx, 2
cmp r9d, dword [rbx + 0xc]
jne 0x14027c19f
mov eax, dword [rax + 0xc]
cmp dword [rbx + 0x4c], eax
jl 0x14027c1b1
mov rax, qword [rbx]
mov rcx, rdi
mov r8d, dword [rax]
call fcn.140267490
mov qword [rbx + 0x60], rax
test ebp, ebp
je 0x14027c1c0
mov rdx, rbx
mov rcx, rdi
call fcn.14027b810
test byte [rbx + 8], 2
je 0x14027c1cf
lea rcx, [0x14027b780]
jmp 0x14027c1e8
mov rax, qword [rdi]
lea rcx, [0x14027afc0]
lea rdx, [0x14027b530]
cmp dword [rax + 0x5c], 1
cmove rcx, rdx
mov qword [rbx + 0x38], rcx
mov rax, qword [rbx]
movsxd rdi, dword [rax + 0x20]
test edi, edi
jle 0x14027c212
mov rdx, rdi
mov rcx, r14
shl rdx, 4
call fcn.1402d76b0
test rax, rax
je 0x14027c212
mov qword [rbx + 0x28], rax
mov dword [rbx + 0x30], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402848a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rdi
push r13
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
lea rbp, [rcx + 0x3c]
xor r14d, r14d
mov r13, rdx
mov rdi, rcx
cmp dword [rbp], r14d
jne 0x140284a8d
mov qword [rsp + 0x20], r12
xor r12d, r12d
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x28], rsi
test r15d, r15d
jne 0x140284a7e
mov rbx, qword [r13 + 0x58]
mov rax, qword [rdi]
add rbx, r12
mov ecx, dword [rax + 0x88]
cmp dword [rbx + 0x18], ecx
jl 0x1402849fd
mov rax, qword [rbx + 0x10]
movsxd rdx, r14d
mov byte [rax], 1
movsxd rcx, dword [r13]
movsxd rax, dword [rbx]
mov r9d, dword [rbx + 0x18]
mov r8, qword [rbx + 0x10]
shl rcx, 6
add rcx, 0x20
add rdx, rcx
mov rcx, rdi
shl rdx, 0x1f
add rdx, rax
call fcn.1402671c0
lea r8d, [r14 + 2]
mov rdx, r13
mov rcx, rdi
call fcn.140284aa0
mov rbx, qword [r13 + 0x58]
add rbx, r12
cmp dword [rbp], r15d
jne 0x1402849e6
cmp dword [rbx + 0x38], r15d
jne 0x1402849e6
mov rdi, qword [rbx + 0x10]
lea rdx, [rsp + 0x78]
lea rcx, [rdi + 1]
call fcn.1402d4020
movzx ecx, al
lea rdx, [rsp + 0x78]
inc rcx
add rcx, rdi
call fcn.1402d4020
mov eax, dword [rbx]
mov dword [rbx + 0x20], eax
mov r8d, dword [rbx + 0x38]
add r8d, 9
cmp r8d, dword [rbx + 0x3c]
jbe 0x1402849a9
lea rdx, [rbx + 0x30]
mov rcx, rbp
call fcn.1402d1230
test eax, eax
jne 0x1402849b8
movsxd rcx, dword [rbx + 0x38]
mov rax, qword [rbx + 0x30]
mov byte [rcx + rax], 0
inc dword [rbx + 0x38]
movsxd r8, dword [rbx]
lea rdx, [rbx + 0x30]
mov rcx, rbp
call fcn.1402d10b0
mov rdi, qword [rsp + 0x78]
lea rdx, [rbx + 0x30]
mov r8, rdi
mov rcx, rbp
call fcn.1402d10b0
mov dword [rbx + 0x24], 1
mov qword [rbx + 0x28], rdi
inc dword [rbx]
mov r8, qword [rsp + 0x70]
mov dword [rbx + 0x18], 0
mov dword [rbx + 4], 0
jmp 0x140284a03
mov r15d, 1
cmp dword [rbx + 4], 0
je 0x140284a13
sub r8, qword [rbx + 8]
lea rdi, [rbx + 0x10]
jmp 0x140284a4d
test r14d, r14d
jne 0x140284a1e
mov esi, dword [r13 + 8]
jmp 0x140284a21
mov esi, dword [rbx - 0x20]
xor r8d, r8d
lea rdi, [rbx + 0x10]
test r15d, r15d
mov rdx, rdi
mov rcx, rbp
sete r8b
call fcn.1402d10b0
movsxd r8, esi
mov rdx, rdi
mov rcx, rbp
call fcn.1402d10b0
mov r8, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbp
call fcn.1402d10b0
mov r8, qword [rsp + 0x70]
inc r14d
mov rdi, qword [rsp + 0x60]
add r12, 0x20
mov qword [rbx + 8], r8
mov dword [rbx + 4], 1
cmp dword [rbp], 0
je 0x1402848e2
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x1402a3320
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.1402e5a00
test ebx, ebx
jne 0x1402a3389
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.1402e5a00
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret