joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e2e0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push r15
sub rsp, 0x58
mov rbx, r8
mov r15, rcx
mov r8d, edx
cmp dword [rbx + 0x2000], 8
jge 0x14000e307
mov al, 1
add rsp, 0x58
pop r15
pop rbx
ret
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rsi
xor esi, esi
cmp byte [rbx], 0x80
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
jne 0x14000e49e
mov r13d, 0x2000
nop word [rax + rax]
lea eax, [rsi + 2]
movsxd rdx, esi
movsxd rcx, eax
add rdx, rbx
lea eax, [rsi + 1]
mov qword [rsp + 0x80], rdx
movzx edi, byte [rcx + rbx]
movsxd rcx, eax
shl edi, 8
movzx eax, byte [rcx + rbx]
or edi, eax
lea eax, [rsi + 6]
movsxd r12, eax
add r12, rbx
movzx eax, byte [r12]
cmp edi, 8
jb 0x14000e50b
cmp edi, r13d
ja 0x14000e50b
cmp edi, dword [rbx + 0x2000]
jg 0x14000e4df
lea eax, [rsi + 3]
xor r10d, r10d
movsxd rbp, eax
lea r14d, [rdi - 6]
add rbp, rbx
test r14d, r14d
jle 0x14000e3fa
mov r11, r12
nop dword [rax + rax]
mov eax, 0xaaaaaaab
lea r11, [r11 + 1]
mul r10d
mov eax, r10d
shr edx, 1
lea r9d, [rdx + rdx*2]
sub eax, r9d
sub r9d, r10d
movsxd rcx, eax
inc r10d
lea eax, [r9 + 2]
movzx r8d, byte [rcx + rbp]
add r8b, byte [r11 - 1]
cdqe
xor r8b, byte [rax + rbp]
mov byte [r11 - 1], r8b
cmp r10d, r14d
jl 0x14000e3b0
mov rdx, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x78]
movzx eax, byte [r12]
lea rcx, [0x1401786e3]
mov word [0x1401786e0], r8w
mov r8d, edi
mov byte [0x1401786e2], al
call fcn.1400a12f0
lea rcx, [r15 + 0x80]
mov dword [0x14017a6e4], edi
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [r15 + 0xc8], 0x1000
jae 0x14000e455
lea rcx, [r15 + 0xa8]
lea rdx, [0x1401786e0]
call fcn.14000b2e0
mov bpl, 1
lea rcx, [r15 + 0x80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bpl, bpl
je 0x14000e47b
mov rcx, qword [r15 + 0xd0]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
sub dword [rbx + 0x2000], edi
add esi, edi
cmp dword [rbx + 0x2000], 0
jle 0x14000e507
mov r8d, dword [rsp + 0x78]
movsxd rax, esi
cmp byte [rax + rbx], 0x80
je 0x14000e340
movsxd rax, esi
lea rdx, str._SocketManager__Protocol_header_error__Index:__d__Header:__x_
mov ecx, 1
movzx r9d, byte [rax + rbx]
call fcn.14009f970
xor al, al
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x30]
add rsp, 0x58
pop r15
pop rbx
ret
test esi, esi
jle 0x14000e507
movsxd rax, dword [rbx + 0x2000]
test eax, eax
jle 0x14000e507
sub r13d, esi
cmp eax, r13d
jg 0x14000e507
movsxd rdx, esi
mov r8, rax
add rdx, rbx
mov rcx, rbx
call fcn.1400a12f0
mov al, 1
jmp 0x14000e4b9
movzx r9d, byte [rdx]
mov ecx, 1
movzx eax, al
lea rdx, str._SocketManager__Protocol_size_error__Index:__d__Header:__x__Size:__d__Head:__x_
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
call fcn.14009f970
jmp 0x14000e4b7
Function at 0x14000e8a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
lea rbx, [rcx + 0xe8]
movsxd rdi, edx
mov rsi, rcx
mov r14, r9
mov rcx, rbx
mov r15d, r8d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
test edi, edi
js 0x14000e8de
cmp edi, 0x1388
setl al
test eax, eax
je 0x14000e9b3
mov edx, edi
mov rcx, rsi
test r15d, r15d
je 0x14000e9ae
add dword [r14 + 0x2038], r15d
lea r8, [r14 + 0x38]
call fcn.14000e2e0
test al, al
je 0x14000e9a9
movsxd rdx, dword [r14 + 0x2038]
lea r11, [0x1400ecbd0]
mov eax, 0x2000
mov dword [r14 + 0x30], 0
sub eax, edx
mov qword [rsp + 0x30], 0
mov dword [r14 + 0x20], eax
lea rcx, [r14 + 0x38]
add rcx, rdx
mov qword [rsp + 0x28], r14
mov qword [r14 + 0x28], rcx
lea rax, [rsp + 0x68]
imul rcx, rdi, 0x70
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov r8d, 1
mov dword [rsp + 0x68], 0
lea rdx, [r14 + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + r11]
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x14000e9b3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x14000e9b3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str._SocketManager__WSARecv___failed_with_error:__d
mov ecx, 1
mov r8d, eax
call fcn.14009f970
mov rcx, rsi
mov edx, edi
call fcn.14000e7e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14000e9d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
lea rbp, [rcx + 0xe8]
movsxd r14, edx
mov r15, rcx
mov rbx, r9
mov rcx, rbp
mov edi, r8d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor esi, esi
mov eax, esi
test r14d, r14d
js 0x14000ea0f
cmp r14d, 0x1388
setl al
test eax, eax
je 0x14000ea22
test edi, edi
jne 0x14000ea30
mov edx, r14d
mov rcx, r15
call fcn.14000e7e0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14000ebf3
add dword [rbx + 0x2038], edi
movsxd r8, dword [rbx + 0x2038]
mov edx, dword [rbx + 0x34]
mov qword [rsp + 0x70], r12
imul r12, r14, 0x70
cmp r8d, edx
jl 0x14000eb62
movsxd rax, dword [rbx + 0x1203c]
test eax, eax
jg 0x14000ea65
mov dword [rbx + 0x34], esi
jmp 0x14000ebe5
cmp eax, 0x2000
jle 0x14000eb2b
lea rcx, [rbx + 0x203c]
mov r8d, 0x40
lea r9, [rbx + 0x38]
mov rdx, rcx
mov rax, r9
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rdx]
lea rdx, [rdx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rdx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r8, 1
jne 0x14000ea90
mov eax, dword [rbx + 0x1203c]
lea rdi, [rbx + 0x20]
sub eax, 0x2000
mov qword [rbx + 0x28], r9
movsxd r8, eax
lea rdx, [rbx + 0x403c]
mov dword [rdi], 0x2000
mov dword [rbx + 0x30], 1
mov dword [rbx + 0x34], 0x2000
mov dword [rbx + 0x2038], esi
call fcn.1400a12f0
add dword [rbx + 0x1203c], 0xffffe000
jmp 0x14000eb7d
lea rdi, [rbx + 0x38]
mov r8, rax
mov rcx, rdi
lea rdx, [rbx + 0x203c]
call fcn.1400a12f0
mov eax, dword [rbx + 0x1203c]
mov qword [rbx + 0x28], rdi
lea rdi, [rbx + 0x20]
mov dword [rdi], eax
mov dword [rbx + 0x34], eax
mov dword [rbx + 0x2038], esi
mov dword [rbx + 0x1203c], esi
jmp 0x14000eb76
lea rcx, [rbx + 0x38]
add rcx, r8
lea rdi, [rbx + 0x20]
sub edx, r8d
mov qword [rbx + 0x28], rcx
mov dword [rdi], edx
mov dword [rbx + 0x30], 1
mov qword [rsp + 0x30], rsi
lea rcx, [0x1400ecbd0]
mov rcx, qword [r12 + rcx]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rbx
mov r8d, 1
mov rdx, rdi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x14000ebe5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x14000ebe5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str._SocketManager__WSASend___failed_with_error:__d
mov ecx, 1
mov r8d, eax
call fcn.14009f970
mov edx, r14d
mov rcx, r15
call fcn.14000e7e0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r12, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
xor esi, esi
movsxd r11, r8d
mov r12, rdx
mov rbx, rcx
mov edi, esi
mov r13d, esi
mov r14d, esi
mov r10, r11
lea r15d, [rsi + 2]
cmp r9b, 1
jne 0x140015cd2
lea r8d, [rsi + 1]
jmp 0x140015d11
movzx eax, r9b
mov edx, 3
sub edx, eax
mov r8d, r15d
movsxd rax, edx
cmp rax, r11
jge 0x140015cf9
cmp byte [rax + rcx], sil
jne 0x140015cf9
add edx, r8d
add rax, r8
cmp rax, r11
jl 0x140015ce8
cmp edx, r11d
movzx eax, r9b
movsxd r10, edx
setl r14b
and eax, 1
add rcx, rax
xor r10, 1
lea r9, [rbx + r10]
cmp rcx, r9
jae 0x140015d55
lea rdx, [0x1400c8850]
movzx eax, byte [rcx]
test byte [rax + rdx], 1
je 0x140015d37
mov eax, r8d
add rcx, rax
cmp rcx, r9
jb 0x140015d21
jmp 0x140015d55
cmp rcx, r9
jae 0x140015d55
movzx eax, byte [rcx]
cmp al, 0x2d
jne 0x140015d4b
mov r13d, 1
jmp 0x140015d4f
cmp al, 0x2b
jne 0x140015d55
mov eax, r8d
add rcx, rax
mov rbp, rcx
cmp rcx, r9
jae 0x140015d70
nop dword [rax]
cmp byte [rcx], 0x30
jne 0x140015d70
mov eax, r8d
add rcx, rax
cmp rcx, r9
jb 0x140015d60
mov r10d, esi
cmp rcx, r9
jae 0x140015dcc
mov esi, r8d
mov rbx, rcx
nop
movsx r11, byte [rbx]
lea eax, [r11 - 0x30]
cmp eax, 9
ja 0x140015daa
lea rdx, [rdi - 6]
add r10d, r8d
lea rdx, [rdi + rdx*4]
add rbx, rsi
lea rdi, [r11 + rdx*2]
movsxd rdx, r10d
add rdx, rcx
cmp rdx, r9
jb 0x140015d80
movabs rdx, 0x7fffffffffffffff
xor esi, esi
cmp rdi, rdx
jbe 0x140015dcc
test r13d, r13d
mov eax, esi
setne al
add rax, rdx
mov qword [r12], rax
jmp 0x140015dd8
test r13d, r13d
je 0x140015dd4
neg rdi
mov qword [r12], rdi
movsxd rdx, r10d
add rdx, rcx
cmp rdx, r9
jb 0x140015e5d
test r10d, r10d
jne 0x140015ded
cmp rbp, rcx
je 0x140015e5d
imul eax, r8d, 0x13
cmp r10d, eax
jg 0x140015e5d
test r14d, r14d
jne 0x140015e5d
cmp r10d, eax
jge 0x140015e04
xor eax, eax
jmp 0x140015e62
mov eax, esi
lea r10, str.922337203685477580
mov r9d, esi
mov r11d, esi
cmp r9d, 0x12
jge 0x140015e38
movsxd rax, r11d
inc r9d
add r11d, r8d
movsx edx, byte [rax + rcx]
movsx eax, byte [r10]
inc r10
sub edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
je 0x140015e13
jmp 0x140015e49
test eax, eax
jne 0x140015e4b
lea eax, [r8 + r8*8]
add eax, eax
movsx eax, byte [rax + rcx]
sub eax, 0x38
test eax, eax
js 0x140015e00
test eax, eax
jg 0x140015e5d
test r13d, r13d
cmovne r15d, esi
mov eax, r15d
jmp 0x140015e62
mov eax, 1
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140030fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r13, rcx
mov r15d, edx
mov r12d, r9d
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r8d, dword [r11 + 0x30]
mov ecx, r8d
mov r10, qword [rax + 8]
mov r14, qword [r11]
mov dword [rsp + 0x78], r8d
movsxd rax, dword [r10 + 0x30]
cmp eax, r8d
mov qword [rsp + 0x28], rax
cmovl ecx, eax
xor ebx, ebx
imul r15, rax
mov dword [rsp + 0x70], ecx
mov rcx, rax
cmp eax, r8d
je 0x140031048
cmp byte [r14 + 0x11], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r15
sub rdi, rcx
test ebx, ebx
jne 0x14003115a
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x30], rsi
cmp rdi, r15
jge 0x14003113c
mov rax, rdi
movsxd rbp, r8d
cqo
mov qword [rsp + 0x20], 0
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x1400e4dcc]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x140031131
xor r9d, r9d
lea r8, [rsp + 0x20]
mov edx, r10d
mov rcx, r14
call qword [r14 + 0x108]
mov ebx, eax
test eax, eax
jne 0x14003111d
mov rcx, qword [rsp + 0x20]
call fcn.140021430
mov ebx, eax
test eax, eax
jne 0x14003111d
mov rax, qword [rsp + 0x20]
movsxd r8, dword [rsp + 0x70]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x28]
add rdx, qword [rsp + 0x80]
call fcn.1400a12f0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x14003111d
test r12d, r12d
jne 0x14003111d
mov rax, qword [r13 + 0x28]
mov rcx, qword [rax + 8]
mov eax, dword [rcx + 0x3c]
bswap eax
mov dword [rsi + 0x1c], eax
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003112c
call fcn.140020be0
mov r8d, dword [rsp + 0x78]
add rdi, rbp
test ebx, ebx
je 0x140031063
mov rbp, qword [rsp + 0x88]
mov eax, ebx
mov rsi, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x140045d50
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x20], 0
mov rbx, rcx
je 0x140045dad
mov rcx, qword [rcx]
call fcn.140044710
mov ecx, eax
test eax, eax
jne 0x140045dcb
movups xmm1, xmmword [rbx + 0x28]
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x38], xmm1
movups xmmword [rbx + 0x28], xmm0
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rax
jne 0x140045d96
mov eax, ecx
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
lea rdx, [0x140045d30]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.140014b00
call fcn.140045a60
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x28], xmm0
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x140045dcb
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret

Function at 0x140046cc0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x38]
xor ebx, ebx
mov r14, qword [rcx + 0x40]
mov r15, r9
mov ebp, r8d
mov r13, rdx
mov rdi, qword [rsi + 0x30]
test rdi, rdi
jne 0x140046d58
movzx eax, word [r14 + 6]
imul ecx, eax, 0x38
mov rax, qword [r14 + 0x10]
add ecx, 0x50
test rax, rax
je 0x140046d1a
mov edx, ecx
mov rcx, rax
call fcn.140012710
jmp 0x140046d1f
call fcn.140011ff0
mov rdi, rax
test rax, rax
jne 0x140046d2c
mov rdi, rbx
jmp 0x140046d43
lea rax, [rdi + 0x18]
mov qword [rdi], r14
mov qword [rdi + 8], rax
movzx eax, word [r14 + 6]
inc ax
mov word [rdi + 0x10], ax
mov qword [rsi + 0x30], rdi
test rdi, rdi
jne 0x140046d54
lea eax, [rdi + 7]
jmp 0x140046dda
mov word [rdi + 0x10], bp
cmp byte [rsi + 0x58], bl
je 0x140046d92
cmp byte [rsi + 0x59], bl
je 0x140046d70
mov rax, qword [rsi + 0x10]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x140046d9a
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x140046d9a
mov rax, qword [rsi + 0x38]
lea r8, [rax + 0x10]
mov edx, dword [rax]
mov r9, rdi
mov rcx, r14
call fcn.1400378a0
test ebp, ebp
jle 0x140046dc2
mov rax, qword [rdi + 8]
add rax, 8
test byte [rax], 1
jne 0x140046df9
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x140046db3
mov rdx, qword [r13 + 0x10]
xor r9d, r9d
mov ecx, dword [r13 + 0xc]
mov r8, rdi
call fcn.140037fb0
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
mov dword [r15], 0xffffffff
jmp 0x140046dd8
Function at 0x1400500e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x28
mov rdi, rdx
mov r14, rcx
movzx edx, byte [rdx]
movzx eax, dl
cmp dl, 0x9d
jne 0x1400500fd
movzx eax, byte [rdi + 0x36]
cmp al, 0x9e
jne 0x140050109
mov rax, qword [rdi + 0x20]
mov ecx, dword [rax]
jmp 0x14005011a
cmp al, 0x77
jne 0x1400501c4
mov rax, qword [rdi + 0x20]
mov rcx, qword [rax]
mov ecx, dword [rcx]
cmp ecx, 1
je 0x1400501c4
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov dword [r8], ebx
cmp dl, 0x77
jne 0x14005014f
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop r14
pop rdi
jmp fcn.14004dca0
mov eax, dword [r14 + 0x38]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x20], r15
movsxd rbp, ecx
lea r15d, [rax + 1]
add eax, ecx
mov dword [r14 + 0x38], eax
test ecx, ecx
jle 0x1400501bf
mov qword [rsp + 0x50], rsi
mov esi, r15d
nop word [rax + rax]
mov rdx, qword [rdi + 0x20]
mov r8d, esi
mov rcx, r14
mov rdx, qword [rdx + rbx + 8]
call fcn.140051810
inc esi
lea rbx, [rbx + 0x28]
sub rbp, 1
jne 0x140050180
mov rsi, qword [rsp + 0x50]
mov eax, r15d
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
pop r14
pop rdi
ret
mov eax, r15d
jmp 0x1400501a8
mov rdx, rdi
mov rcx, r14
add rsp, 0x28
pop r14
pop rdi
jmp fcn.1400515b0
Function at 0x1400526f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x20
mov r9d, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14005289d
test rdx, rdx
je 0x14005289d
mov eax, dword [rcx + 4]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov esi, dword [rdx + 4]
mov ebp, esi
or ebp, eax
bt ebp, 0xa
jae 0x140052750
and esi, eax
bt esi, 0xa
jae 0x1400527cf
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1400527cf
xor eax, eax
jmp 0x140052793
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x1400527a8
cmp r8b, 0x5e
jne 0x140052775
mov rcx, qword [rcx + 0x10]
mov r8d, r9d
call fcn.1400526f0
cmp eax, 2
jl 0x14005278e
mov r9d, dword [rsp + 0x40]
cmp byte [rbx], 0x5e
jne 0x1400527cf
mov rdx, qword [rbx + 0x10]
mov r8d, r9d
mov rcx, rdi
call fcn.1400526f0
cmp eax, 2
jge 0x1400527cf
mov eax, 1
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea eax, [r8 + 0x68]
test al, 0xfd
je 0x14005280a
mov rax, qword [rcx + 8]
test rax, rax
je 0x14005280a
cmp r8b, 0x97
jne 0x1400527d6
mov rdx, qword [rdx + 8]
mov rcx, rax
call fcn.140015760
test eax, eax
je 0x140052805
mov eax, 2
jmp 0x140052793
mov r10, qword [rdx + 8]
sub r10, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x1400527f3
inc rax
test ecx, ecx
jne 0x1400527e0
test edx, edx
je 0x14005280a
xor ecx, ecx
cmp r8b, 0x5e
setne cl
lea eax, [rcx + 1]
jmp 0x140052793
mov r9d, dword [rsp + 0x40]
xor esi, dword [rdi + 4]
test sil, 0x10
jne 0x1400527cf
bt ebp, 0xe
jb 0x140052896
bt ebp, 0xb
jb 0x1400527cf
mov rdx, qword [rbx + 0x10]
mov r8d, r9d
mov rcx, qword [rdi + 0x10]
call fcn.1400526f0
test eax, eax
jne 0x1400527cf
mov esi, dword [rsp + 0x40]
mov r8d, esi
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.1400526f0
test eax, eax
jne 0x1400527cf
mov rdx, qword [rbx + 0x20]
mov r8d, esi
mov rcx, qword [rdi + 0x20]
call fcn.1400528c0
test eax, eax
jne 0x1400527cf
bt ebp, 0xd
jb 0x140052896
cmp byte [rdi], 0x61
je 0x140052896
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x1400527cf
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x140052896
cmp ecx, esi
jne 0x1400527cf
test eax, eax
jns 0x1400527cf
xor eax, eax
jmp 0x140052793
xor ecx, ecx
mov eax, 2
cmp rbx, rdi
mov rbx, qword [rsp + 0x48]
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140057f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, dword [rcx + 0x28]
lea r15, [0x1400c9580]
mov rsi, r8
mov rdi, rdx
mov r14, rcx
nop dword [rax + rax]
xor ebx, ebx
test ebp, ebp
jle 0x14005803e
nop word [rax + rax]
mov r9d, ebx
cmp ebx, 2
jge 0x140057fac
xor r9d, 1
test rsi, rsi
je 0x140058005
mov rax, qword [r14 + 0x20]
mov r8, rsi
movzx edx, byte [rsi]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax]
movzx ecx, byte [rdx + r15]
movzx eax, byte [r10]
movzx eax, byte [rax + r15]
sub ecx, eax
jne 0x140058034
movzx eax, dl
sub r10, rsi
nop
test al, al
je 0x140058001
movzx ecx, byte [r10 + r8 + 1]
inc r8
movzx edx, byte [rcx + r15]
movzx eax, byte [r8]
movzx ecx, byte [rax + r15]
sub ecx, edx
je 0x140057fe0
jmp 0x140058034
test ecx, ecx
jne 0x140058034
mov rax, qword [r14 + 0x20]
lea r8, [rsp + 0x40]
movsxd rcx, r9d
mov rdx, rdi
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.140016bd0
test rax, rax
je 0x140058034
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140058072
inc ebx
cmp ebx, ebp
jl 0x140057fa0
movzx edx, byte [rdi]
cmp byte [rdx + r15], 0x73
jne 0x140058070
lea r8, str.sqlite_master
sub r8, rdi
test dl, dl
je 0x14005808b
movzx eax, byte [r8 + rdi + 1]
inc rdi
movzx ecx, byte [rax + r15]
movzx edx, byte [rdi]
movzx eax, byte [rdx + r15]
cmp eax, ecx
je 0x140058052
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov rax, qword [r14 + 0x20]
mov r9, qword [rax + 0x20]
test rsi, rsi
jne 0x14005809f
neg r9
sbb eax, eax
jmp 0x1400580e0
test r9, r9
je 0x140058070
movzx eax, byte [r9]
mov rdx, rsi
movzx r8d, byte [rsi]
movzx ecx, byte [rax + r15]
movzx eax, byte [r8 + r15]
sub eax, ecx
jne 0x1400580e0
sub r9, rsi
test r8b, r8b
je 0x1400580e0
movzx eax, byte [r9 + rdx + 1]
inc rdx
movzx ecx, byte [rax + r15]
movzx r8d, byte [rdx]
movzx eax, byte [r8 + r15]
sub eax, ecx
je 0x1400580c0
test eax, eax
jne 0x140058070
lea rdi, str.sqlite_temp_master
jmp 0x140057f90
Function at 0x140058330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x28
mov ebp, dword [rcx + 0x28]
xor r11d, r11d
xor ebx, ebx
mov rdi, r8
mov r15, rdx
test ebp, ebp
jle 0x140058421
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
lea r12, [0x1400c9580]
mov qword [rsp + 0x20], r14
mov r14, qword [rcx + 0x20]
nop word [rax + rax]
mov eax, ebx
cmp ebx, 2
jge 0x14005837a
xor eax, 1
cdqe
shl rax, 5
mov rsi, qword [rax + r14 + 0x18]
test rdi, rdi
je 0x1400583d7
mov r10, qword [rax + r14]
mov r8, rdi
movzx edx, byte [rdi]
movzx eax, byte [r10]
movzx r9d, byte [rdx + r12]
movzx ecx, byte [rax + r12]
sub r9d, ecx
jne 0x1400583fb
movzx eax, dl
sub r10, rdi
nop dword [rax]
test al, al
je 0x1400583d2
movzx eax, byte [r8 + 1]
inc r8
movzx ecx, byte [r10 + r8]
movzx r9d, byte [rax + r12]
movzx edx, byte [rcx + r12]
sub r9d, edx
je 0x1400583b0
jmp 0x1400583fb
test r9d, r9d
jne 0x1400583fb
lea rcx, [rsi + 0x20]
mov rdx, r15
lea r8, [rsp + 0x50]
call fcn.140016bd0
test rax, rax
je 0x1400583f8
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x140058405
jmp 0x1400583fb
xor r11d, r11d
inc ebx
cmp ebx, ebp
jl 0x140058370
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop rdi
pop rbp
pop rbx
ret
mov rax, r11
add rsp, 0x28
pop r15
pop rdi
pop rbp
pop rbx
ret