joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054c30
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000f0f0
lea rcx, [rsp + 0x40]
call fcn.140054bf0
movzx eax, al
test eax, eax
jne 0x140054c78
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140054b20
mov rax, qword [rsp + 0x70]
jmp 0x140054e49
lea rcx, [rsp + 0x40]
call fcn.14000f160
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140054ba0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14000f160
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140051930
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140054d1e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140054b20
mov rax, qword [rsp + 0x80]
jmp 0x140054e49
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.140020340
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000f0f0
lea rcx, [rsp + 0x48]
call fcn.14000f840
movzx eax, al
test eax, eax
jne 0x140054d85
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14000f820
lea rcx, [rsp + 0x40]
call fcn.140054b20
mov rax, qword [rsp + 0x88]
jmp 0x140054e49
lea rcx, [rsp + 0x48]
call fcn.14000f160
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14000f160
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140051930
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140054e1b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14000f820
lea rcx, [rsp + 0x40]
call fcn.140054b20
mov rax, qword [rsp + 0xa0]
jmp 0x140054e49
lea rcx, [rsp + 0x48]
call fcn.140012a20
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14000f820
lea rcx, [rsp + 0x40]
call fcn.140054b20
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400650c0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400357c0
lea rcx, [rsp + 0x48]
call fcn.1400357c0
call fcn.14003ee90
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400356b0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14006512f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140035850
lea rcx, [rsp + 0x78]
call fcn.140035850
mov eax, dword [rsp + 0x24]
jmp 0x1400651c0
call fcn.14003ee90
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400356b0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140065176
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140035850
lea rcx, [rsp + 0x78]
call fcn.140035850
mov eax, dword [rsp + 0x2c]
jmp 0x1400651c0
lea rcx, [rsp + 0x48]
call fcn.140035b80
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.140035b80
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140035850
lea rcx, [rsp + 0x78]
call fcn.140035850
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x140029b84
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d124
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d124
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029cd4
cmp rax, 0xffffffffffffffff
je 0x140029cd4
xor edi, edi
test rbp, rbp
jle 0x140029c7f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fda4
mov rbx, rax
test rax, rax
jne 0x140029c0c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029c75
mov edx, 0x8000
mov ecx, r14d
call fcn.14001aac0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001de00
cmp eax, 0xffffffff
je 0x140029c55
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c1c
mov edx, r15d
mov ecx, r14d
call fcn.14001aac0
jmp 0x140029c75
cmp byte [rsi + 0x38], dil
je 0x140029c6c
cmp dword [rsi + 0x34], 5
jne 0x140029c6c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029c75
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b404
jmp 0x140029ce8
jns 0x140029ce8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d124
cmp rax, 0xffffffffffffffff
jne 0x140029ca0
cmp byte [rsi + 0x30], dil
je 0x140029ce8
mov edi, dword [rsi + 0x2c]
jmp 0x140029ce8
mov ecx, r14d
call fcn.1400195f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029ce8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029ce8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029ce1
mov eax, dword [rsi + 0x2c]
jmp 0x140029ce6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d124
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ade0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
xor rcx, rcx
sub rcx, 0xffffffffffffffc0
lea rax, [entry0]
movabs rbx, 0xc872142845c9b1f7
xor qword [rax + 0x27], rbx
sub rax, 0xfffffffffffffff8
loop 0x14000101b
hlt
or edi, ecx
movabs rax, qword [0x1488b1f7c8befcd8]
imul eax, dword [rax + riz - 0x80], 0xdac63c6
movabs dword [0x605d9b3abf991246], eax
lahf
and al, ch
movabs eax, dword [0xbd7f7d5c783742f9]
sti
test byte [rcx + riz*8 + 0x5c], dh
or byte [r11 - 0x73], bl
test al, 0x39
sub bh, byte [rax]
push rdx
mov dword [rsi], esi
js 0x140001026
add al, 0x29
invalid
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140177780]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140177790]
mov dword [rax], 1
mov rax, qword [0x1401777a0]
mov dword [rax], 1
mov rax, qword [0x140177740]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140177770]
mov dword [0x14018a020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140177850]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140177830]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1401776f0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x1400027f0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov esi, dword [rcx + 0x640]
lea edi, [rsi - 1]
mov rbx, rcx
cmp dword [rcx + 0x644], edi
je 0x140002878
lea rdx, [rsp + 0x2e]
mov r8d, 1
mov byte [rsp + 0x2e], 6
mov byte [rsp + 0x2f], pe_nt_image_headers64
call sym.SHA3Update
mov dword [rbx + 0x644], edi
lea rdx, [rsp + 0x2f]
mov rcx, rbx
mov r8d, 1
call sym.SHA3Update
test esi, esi
je 0x140002866
mov r8d, dword [rbx + 0x648]
xor edx, edx
nop dword [rax + rax]
mov eax, r8d
xor eax, edx
movzx ecx, byte [rbx + rax]
lea eax, [rsi + rdx]
add edx, 1
mov byte [rbx + rax], cl
cmp esi, edx
jne 0x140002850
lea rax, [rbx + rsi]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rdx, [rsp + 0x2f]
mov r8d, 1
mov byte [rsp + 0x2f], 0x86
call sym.SHA3Update
jmp 0x14000283e
Function at 0x140006220
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, rcx
mov ebp, edx
mov rdi, r8
call sym.sqlite3_user_data
mov rsi, rax
test ebp, ebp
jle 0x140006340
mov rcx, qword [rdi]
call sym.sqlite3_value_int64
mov rdx, qword [rsi + 0x30]
test rdx, rdx
jne 0x14000626d
jmp 0x140006330
mov rdx, qword [rdx + 0x48]
test rdx, rdx
je 0x140006330
cmp rax, qword [rdx + 8]
jne 0x140006260
mov rax, qword [rdx + 0x40]
mov ecx, dword [rax + 0x28]
movzx r9d, word [rax + 4]
movzx r8d, word [rax + 2]
movzx edx, word [rax]
mov dword [rsp + 0x80], ecx
mov ecx, dword [rax + 0x24]
mov dword [rsp + 0x78], ecx
movzx ecx, word [rax + 0x20]
mov dword [rsp + 0x70], ecx
movzx ecx, word [rax + 0x1e]
mov dword [rsp + 0x68], ecx
movzx ecx, word [rax + 0x1c]
mov dword [rsp + 0x60], ecx
movzx ecx, word [rax + 0x1a]
mov dword [rsp + 0x58], ecx
movzx ecx, word [rax + 0x18]
mov dword [rsp + 0x50], ecx
mov ecx, dword [rax + 0x14]
mov dword [rsp + 0x48], ecx
mov ecx, dword [rax + 0x10]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x38], ecx
movzx ecx, word [rax + 0xa]
mov dword [rsp + 0x30], ecx
movzx ecx, word [rax + 8]
mov dword [rsp + 0x28], ecx
movzx eax, word [rax + 6]
lea rcx, str._version_made_by__:__u___version_to_extract__:__u___flags__:__u___compression__:__u___time__:__u___date__:__u___crc32__:__u___compressed_size__:__u___uncompressed_size__:__u___file_name_length__:__u___extra_field_length__:__u___file_comment_length__:__u___disk_number_start__:__u___internal_attr__:__u___external_attr__:__u___offset__:__u_
mov dword [rsp + 0x20], eax
call sym.sqlite3_mprintf
mov rsi, rax
test rax, rax
je 0x140006360
mov rcx, rbx
mov r9, 0xffffffffffffffff
mov r8d, 0xffffffff
mov rdx, rsi
call sym.sqlite3_result_text
mov rcx, rsi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3_free
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x2bac
lea rdx, str.shell.c
lea rcx, str.argc_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
jmp 0x140006243
mov rcx, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3_result_error_nomem
Function at 0x140006dc0
Capabilities:
Enumerate pe sections

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x40], 0
mov rbx, rcx
mov rsi, rdx
je 0x140006ef0
mov eax, dword [0x14015ece0]
lea rdi, [rsi + 0x2e]
mov rcx, rdi
mov dword [rsi], eax
movzx eax, word [rbx]
mov word [rsi + 4], ax
movzx eax, word [rbx + 2]
mov word [rsi + 6], ax
movzx eax, word [rbx + 4]
mov word [rsi + 8], ax
movzx eax, word [rbx + 6]
mov word [rsi + 0xa], ax
movzx eax, word [rbx + 8]
mov word [rsi + 0xc], ax
movzx eax, word [rbx + 0xa]
mov word [rsi + 0xe], ax
mov eax, dword [rbx + 0xc]
mov dword [rsi + 0x10], eax
mov eax, dword [rbx + 0x10]
mov dword [rsi + 0x14], eax
mov eax, dword [rbx + 0x14]
mov dword [rsi + 0x18], eax
movzx eax, word [rbx + 0x18]
mov word [rsi + 0x1c], ax
movzx eax, word [rbx + 0x1a]
mov word [rsi + 0x1e], ax
movzx eax, word [rbx + 0x1c]
mov word [rsi + 0x20], ax
movzx eax, word [rbx + 0x1e]
mov word [rsi + 0x22], ax
movzx eax, word [rbx + 0x20]
mov word [rsi + 0x24], ax
mov eax, dword [rbx + 0x24]
mov dword [rsi + 0x26], eax
mov eax, dword [rbx + 0x28]
mov dword [rsi + 0x2a], eax
mov rdx, qword [rbx + 0x30]
movzx r8d, word [rbx + 0x18]
call sym.memcpy
movzx eax, word [rbx + 0x18]
mov rdx, qword [rbx + 0x40]
add rdi, rax
test rdx, rdx
je 0x140006ea8
movzx r8d, word [rbx + 0x1a]
movzx eax, word [rbx + 0x1c]
mov rcx, rdi
lea ebx, [r8 + rax]
movsxd rbx, ebx
mov r8, rbx
call sym.memcpy
lea rax, [rdi + rbx]
sub eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp word [rbx + 0x1a], 9
je 0x140006ec9
mov r8d, 0x2b71
lea rdx, str.shell.c
lea rcx, str.pCDS__nExtra9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
mov eax, dword [0x14015ecdc]
mov byte [rdi + 4], 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x38]
mov dword [rdi + 5], eax
lea rax, [rdi + 9]
sub eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, 9
mov word [rcx + 0x1a], ax
jmp 0x140006dd8
Function at 0x140007070
Capabilities:
Create directory
Timestomp file
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov r12, rcx
mov rbx, rdx
mov rbp, r8
mov esi, r9d
test rdx, rdx
je 0x140007128
mov eax, r9d
and ax, 0xf000
cmp ax, 0x4000
je 0x140007108
lea rdx, [0x1401508ee]
mov rcx, rbx
call sym.fopen
mov rdi, rax
test rax, rax
je 0x140007128
mov rcx, rbp
call sym.sqlite3_value_blob
mov r13, rax
test rax, rax
je 0x140007140
mov rcx, rbp
call sym.sqlite3_value_bytes
mov rcx, r13
mov r9, rdi
mov edx, 1
movsxd r8, eax
call sym.fwrite
mov rcx, rbp
mov r13, rax
call sym.sqlite3_value_bytes
cdqe
cmp r13, rax
je 0x140007143
mov rcx, rdi
call sym.fclose
mov eax, 2
jmp 0x14000712d
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
test eax, eax
je 0x140007170
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x11
je 0x140007240
nop dword [rax]
mov eax, 1
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r13d, r13d
mov rcx, rdi
call sym.fclose
test si, si
je 0x140007165
and esi, 0x1ff
mov rcx, rbx
mov edx, esi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chmod]
test eax, eax
jne 0x1400070fd
mov rdx, r13
mov rcx, r12
call sym.sqlite3_result_int64
xor eax, eax
cmp qword [rsp + 0xf0], 0
js 0x14000712d
lea rsi, [rsp + 0x50]
lea rdi, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
movsxd rax, dword [rsp + 0xf0]
mov rcx, rbx
movabs rdx, 0x19db1ded53e8000
imul rax, rax, 0x989680
add rax, rdx
mov qword [rsp + 0x48], rax
call sym.sqlite3_win32_utf8_to_unicode
mov rbx, rax
test rax, rax
je 0x140007128
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x100
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rbx
mov rsi, rax
call sym.sqlite3_free
cmp rsi, 0xffffffffffffffff
je 0x140007128
xor edx, edx
lea r9, [rsp + 0x48]
mov r8, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test ebx, ebx
sete al
jmp 0x14000712d
lea rdi, [rsp + 0x50]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64]
test eax, eax
jne 0x140007128
mov rdx, rdi
mov rcx, rbx
call sym.statTimesToUtc
movzx eax, word [rsp + 0x56]
mov edx, eax
and dx, 0xf000
cmp dx, 0x4000
jne 0x140007128
xor eax, esi
test ax, 0x1ff
je 0x140007170
and esi, 0x1ff
mov rcx, rbx
mov edx, esi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chmod]
test eax, eax
je 0x140007170
jmp 0x140007128
Function at 0x140007570
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rcx, rdx
lea rdx, [0x1401508f1]
call sym.fopen
mov rbx, rax
test rax, rax
je 0x140007630
xor edx, edx
mov r8d, 2
mov rcx, rax
call sym.fseek
mov rcx, rbx
call sym.ftell
mov rcx, rbx
movsxd rsi, eax
call sym.rewind
mov rcx, rdi
call sym.sqlite3_context_db_handle
xor edx, edx
mov r8d, 0xffffffff
mov rcx, rax
call sym.sqlite3_limit
cmp esi, eax
jg 0x140007678
test esi, esi
mov ecx, 1
cmovne rcx, rsi
call sym.sqlite3_malloc64
mov rbp, rax
test rax, rax
je 0x140007640
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call sym.fread
cmp rsi, rax
je 0x140007650
mov rcx, rdi
mov edx, 0xa
call sym.sqlite3_result_error_code
mov rcx, rbp
call sym.sqlite3_free
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.fclose
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rdi
call sym.sqlite3_result_error_nomem
jmp 0x14000761e
mov rcx, rdi
lea r9, [sym.sqlite3_free]
mov r8, rsi
mov rdx, rbp
call sym.sqlite3_result_blob64
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.fclose
mov rcx, rdi
mov edx, 0x12
call sym.sqlite3_result_error_code
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.fclose

Function at 0x1400076a0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [r8]
call sym.sqlite3_value_text
mov rdx, rax
test rax, rax
je 0x1400076c8
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.readFileContents
add rsp, 0x20
pop rbx
ret
Function at 0x140007b90
Capabilities:
Reference sql statements

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [rsp + 0x80]
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov esi, edx
mov edi, esi
call sym.sqlite3_free
mov dword [rbx + 0x10], 0
mov rcx, qword [rbx + 0x20]
mov qword [rbx + 0x18], 0
call sym.sqlite3_free
mov dword [rbx + 0x14], 0
mov rcx, qword [rbx + 0x38]
mov qword [rbx + 0x20], 0
call sym.sqlite3_finalize
mov qword [rbx + 0x38], 0
mov dword [rbx + 0x4c], 0
and edi, 1
jne 0x140007c40
and esi, 2
jne 0x140007c88
mov r12, qword [rbx + 0x20]
test r12, r12
je 0x140007c17
cmp qword [rbx + 0x18], 0
je 0x140007cd8
mov rcx, rbx
mov qword [rbx + 0x40], 0
mov dword [rbx + 0x48], 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.completionNext
mov rcx, qword [rbp]
call sym.sqlite3_value_bytes
mov dword [rbx + 0x10], eax
test eax, eax
jle 0x140007bfa
mov rcx, qword [rbp]
call sym.sqlite3_value_text
lea rcx, [0x1401509b2]
mov rdx, rax
call sym.sqlite3_mprintf
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140007bfa
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movsxd rdi, edi
lea rsi, [rbp + rdi*8]
mov rcx, qword [rsi]
call sym.sqlite3_value_bytes
mov dword [rbx + 0x14], eax
test eax, eax
jle 0x140007c03
mov rcx, qword [rsi]
call sym.sqlite3_value_text
lea rcx, [0x1401509b2]
mov rdx, rax
call sym.sqlite3_mprintf
mov qword [rbx + 0x20], rax
mov r12, rax
test rax, rax
je 0x140007c71
cmp qword [rbx + 0x18], 0
jne 0x140007c17
nop dword [rax]
mov r13d, dword [rbx + 0x14]
test r13d, r13d
jle 0x140007d58
movsxd rax, r13d
mov rbp, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
mov esi, r13d
lea rdi, [r12 + rax - 1]
nop dword [rax + rax]
movsx ecx, byte [rdi]
mov r14d, ecx
call rbp
cmp r14b, 0x5f
je 0x140007d0a
test eax, eax
je 0x140007d40
sub rdi, 1
sub esi, 1
jne 0x140007cf8
mov dword [rbx + 0x10], r13d
movsxd r8, esi
mov edx, r13d
lea rcx, [0x1401509b5]
add r8, r12
call sym.sqlite3_mprintf
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140007c17
jmp 0x140007c71
sub r13d, esi
mov dword [rbx + 0x10], r13d
test r13d, r13d
jle 0x140007c17
jmp 0x140007d17
mov dword [rbx + 0x10], 0
jmp 0x140007c17
Function at 0x140008ac0
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov eax, ecx
mov rcx, qword [0x14018a040]
test eax, eax
jne 0x140008b36
test rcx, rcx
je 0x140008ae4
mov rax, rcx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.USERPROFILE
call sym.getenv
mov qword [0x14018a040], rax
test rax, rax
je 0x140008b48
mov rsi, qword [0x14018a040]
mov rcx, rsi
call sym.strlen
lea rbx, [rax + 1]
mov rcx, rbx
call sym.malloc
mov rcx, rax
test rax, rax
je 0x140008b2d
mov r8, rbx
mov rdx, rsi
call sym.memcpy
mov rcx, rax
mov qword [0x14018a040], rcx
jmp 0x140008ad9
call sym.free
xor eax, eax
mov qword [0x14018a040], rax
xor ecx, ecx
jmp 0x140008ad9
lea rcx, str.HOME
call sym.getenv
mov qword [0x14018a040], rax
test rax, rax
jne 0x140008afc
lea rcx, str.HOMEDRIVE
call sym.getenv
lea rcx, str.HOMEPATH
mov rbx, rax
call sym.getenv
mov rsi, rax
test rbx, rbx
je 0x140008bf6
mov rax, rbx
test rsi, rsi
jne 0x140008b91
jmp 0x140008bf6
add rax, 1
cmp byte [rax], 0
jne 0x140008b8d
sub rax, rbx
mov rdx, rsi
and eax, 0x3fffffff
jmp 0x140008ba7
add rdx, 1
cmp byte [rdx], 0
jne 0x140008ba3
sub rdx, rsi
and edx, 0x3fffffff
lea edi, [rax + rdx + 1]
movsxd rcx, edi
call sym.malloc
mov qword [0x14018a040], rax
mov rdx, rax
test rax, rax
je 0x140008b44
mov qword [rsp + 0x20], rsi
mov ecx, edi
mov r9, rbx
lea r8, [0x140150b41]
call sym.sqlite3_snprintf
mov rcx, qword [0x14018a040]
jmp 0x140008ad9
lea rax, [0x140150b46]
mov qword [0x14018a040], rax
jmp 0x140008afc
Function at 0x140009e20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov esi, r8d
test r8d, r8d
jg 0x140009e48
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x50]
mov edx, dword [rbx + 0x58]
movsxd rbp, r8d
xor r8d, r8d
call sym.fseek
mov r9, qword [rbx + 0x50]
mov r8, rbp
mov rcx, rdi
mov edx, 1
call sym.fwrite
cmp esi, eax
jne 0x140009e80
add qword [rbx + 0x58], rbp
jmp 0x140009e36
lea rcx, str.error_in_fwrite__
call sym.sqlite3_mprintf
mov qword [rbx + 0x10], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14000abb0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor eax, eax
test ecx, ecx
je 0x14000abc0
add rsp, 0x28
ret
mov eax, dword [0x14018a1d0]
add eax, 1
mov dword [0x14018a1d0], eax
cmp eax, 1
jg 0x14000abef
mov rcx, qword [0x14018a1d8]
test rcx, rcx
je 0x14000abe5
call sym.sqlite3_interrupt
mov eax, 1
add rsp, 0x28
ret
mov ecx, 1
call sym.exit
nop
nop word [rax + rax]