joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
test r10, r10
mov qword [rsp + 0x58], rdi
mov rbp, r8
mov rsi, rdx
lea r11, [0x0069aea0]
mov qword [rsp + 0x30], r12
mov rdi, rcx
je 0x43c2d4
movzx ecx, byte [rdx]
xor eax, eax
mov r9, rdx
test cl, cl
je 0x43c2bd
nop
movzx ecx, cl
inc r9
movzx edx, byte [rcx + r11]
lea ecx, [rax*8]
xor edx, ecx
mov cl, byte [r9]
xor eax, edx
test cl, cl
jne 0x43c2a0
xor edx, edx
div dword [rdi]
mov eax, edx
mov r12d, edx
add rax, rax
mov r9, qword [r10 + rax*8 + 8]
mov r10d, dword [r10 + rax*8]
jmp 0x43c2df
mov r9, qword [rcx + 8]
mov r10d, dword [rcx + 4]
xor r12d, r12d
test r10d, r10d
mov qword [rsp + 0x40], rbx
je 0x43c34c
nop
nop
mov rdx, qword [r9 + 0x18]
dec r10d
mov r8, rsi
movzx ecx, byte [rdx]
test cl, cl
je 0x43c32f
nop
nop
nop
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r11]
cmp byte [rcx + r11], al
jne 0x43c32f
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x43c310
movzx eax, byte [r8]
movzx ecx, byte [rax + r11]
movzx eax, byte [rdx]
movzx eax, byte [rax + r11]
cmp eax, ecx
je 0x43c398
test r10d, r10d
mov r9, qword [r9]
jne 0x43c2f0
test rbp, rbp
je 0x43c498
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x43c3c7
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x43c370
call qword [0x0072d0f8]
lea rdx, [rsp + 0x20]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.0043a720
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x43c3d7
call qword [0x0072d108]
mov rbx, qword [rsp + 0x20]
jmp 0x43c3dc
test rbp, rbp
mov rbx, qword [r9 + 0x10]
jne 0x43c3b7
mov r8d, r12d
mov rdx, r9
mov rcx, rdi
call fcn.004277f0
mov rax, rbx
jmp 0x43c49a
mov qword [r9 + 0x10], rbp
mov qword [r9 + 0x18], rsi
mov rax, rbx
jmp 0x43c49a
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [0x0072d098]
mov rbx, rax
jmp 0x43c3dc
mov rbx, qword [rsp + 0x20]
test rbx, rbx
jne 0x43c3e9
mov rax, rbp
jmp 0x43c49a
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x10], rbp
inc dword [rdi + 4]
mov edx, dword [rdi + 4]
cmp edx, 0xa
jb 0x43c421
mov eax, dword [rdi]
add eax, eax
cmp edx, eax
jbe 0x43c421
add edx, edx
mov rcx, rdi
call fcn.0043bfe0
test eax, eax
je 0x43c421
mov rcx, rsi
call fcn.00427630
xor edx, edx
div dword [rdi]
mov r12d, edx
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x43c478
mov ecx, r12d
shl rcx, 4
add rcx, rax
je 0x43c478
mov eax, dword [rcx]
test eax, eax
je 0x43c442
mov rdx, qword [rcx + 8]
jmp 0x43c444
xor edx, edx
inc eax
test rdx, rdx
mov qword [rcx + 8], rbx
mov dword [rcx], eax
je 0x43c478
mov qword [rbx], rdx
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x43c46e
mov qword [rax], rbx
mov qword [rdx + 8], rbx
jmp 0x43c498
mov qword [rdi + 8], rbx
mov qword [rdx + 8], rbx
jmp 0x43c498
mov rax, qword [rdi + 8]
mov qword [rbx], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x43c48c
mov qword [rax + 8], rbx
mov qword [rbx + 8], 0
mov qword [rdi + 8], rbx
xor eax, eax
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x446190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
test rcx, rcx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], rdi
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
je 0x446327
test rdx, rdx
je 0x446327
mov r11d, dword [rcx + 4]
mov ecx, dword [rdx + 4]
mov qword [rsp + 0x40], rsi
mov esi, ecx
or esi, r11d
bt esi, 0xa
jae 0x446209
and ecx, r11d
bt ecx, 0xa
jae 0x44631d
mov eax, dword [rdx + 8]
cmp dword [rdi + 8], eax
jne 0x44631d
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
movzx edx, byte [rdi]
cmp dl, byte [rbx]
je 0x44624e
cmp dl, 0x5f
jne 0x446226
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.00446190
cmp eax, 2
jl 0x446247
cmp byte [rbx], 0x5f
jne 0x44631d
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, rdi
call fcn.00446190
cmp eax, 2
jge 0x44631d
mov eax, 1
jmp 0x4461f0
cmp dl, 0x9a
je 0x44629b
cmp dl, 0x9c
je 0x44629b
mov rax, qword [rdi + 8]
test rax, rax
je 0x44629b
mov r10, qword [rbx + 8]
sub r10, rax
nop
nop
movzx r9d, byte [rax]
movzx r8d, byte [rax + r10]
sub r9d, r8d
jne 0x446286
inc rax
test r8d, r8d
jne 0x446270
test r9d, r9d
je 0x44629b
xor ecx, ecx
cmp dl, 0x5f
setne cl
lea eax, [rcx + 1]
jmp 0x4461f0
xor ecx, r11d
test cl, 0x10
jne 0x44631d
bt esi, 0xe
jb 0x4461ee
bt esi, 0xb
jb 0x44631d
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
mov r8d, ebp
call fcn.00446190
test eax, eax
jne 0x44631d
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
mov r8d, ebp
call fcn.00446190
test eax, eax
jne 0x44631d
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
mov r8d, ebp
call fcn.00431fa0
test eax, eax
jne 0x44631d
bt esi, 0xd
jb 0x4461ee
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x44631d
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x4461ee
cmp ecx, ebp
jne 0x44631d
test eax, eax
js 0x4461ee
mov eax, 2
jmp 0x4461f0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
cmp rdx, rdi
mov rdi, qword [rsp + 0x48]
mov eax, 2
cmove eax, ecx
add rsp, 0x28
ret
Function at 0x446dc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
movsxd r9, edx
mov qword [rsp + 0x48], rdi
shl r9, 5
mov rbx, r8
mov rdi, rcx
mov rsi, qword [r9 + rax + 0x18]
lea rbp, [0x0069aea0]
mov r9, qword [rsi + 0x30]
test r9, r9
je 0x446e4a
movzx eax, byte [r8]
xor r11d, r11d
mov rdx, r8
test al, al
je 0x446e2d
nop
movzx eax, al
inc rdx
movzx ecx, byte [rax + rbp]
lea eax, [r11*8]
xor ecx, eax
mov al, byte [rdx]
xor r11d, ecx
test al, al
jne 0x446e10
mov eax, r11d
xor edx, edx
div dword [rsi + 0x20]
mov eax, edx
mov r11d, edx
shl rax, 4
add rax, r9
mov r9, qword [rax + 8]
mov r10d, dword [rax]
jmp 0x446e55
mov r9, qword [rsi + 0x28]
mov r10d, dword [rsi + 0x24]
xor r11d, r11d
test r10d, r10d
je 0x446f1b
nop
mov rdx, qword [r9 + 0x18]
dec r10d
mov r8, rbx
movzx ecx, byte [rdx]
test cl, cl
je 0x446e9d
nop
nop
nop
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + rbp]
cmp byte [rcx + rbp], al
jne 0x446e9d
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x446e80
movzx eax, byte [r8]
movzx ecx, byte [rax + rbp]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbp]
cmp eax, ecx
je 0x446eba
test r10d, r10d
mov r9, qword [r9]
jne 0x446e60
jmp 0x446f1b
mov rbx, qword [r9 + 0x10]
lea rcx, [rsi + 0x20]
mov r8d, r11d
mov rdx, r9
call fcn.004277f0
test rbx, rbx
je 0x446f1b
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdx + 0x10]
cmp rcx, rbx
jne 0x446ee9
mov rax, qword [rbx + 0x28]
mov qword [rdx + 0x10], rax
jmp 0x446f10
test rcx, rcx
je 0x446f10
nop
mov rax, qword [rcx + 0x28]
cmp rax, rbx
je 0x446f03
test rax, rax
mov rcx, rax
jne 0x446ef0
jmp 0x446f10
cmp rax, rbx
jne 0x446f10
mov rax, qword [rbx + 0x28]
mov qword [rcx + 0x28], rax
mov rdx, rbx
mov rcx, rdi
call fcn.00446c40
or dword [rdi + 0x2c], 2
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x44a420
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
movsxd r9, edx
mov qword [rsp + 0x48], rdi
shl r9, 5
mov rbx, r8
mov rsi, rcx
mov rdi, qword [r9 + rax + 0x18]
lea rbp, [0x0069aea0]
mov r9, qword [rdi + 0x48]
test r9, r9
je 0x44a4aa
movzx eax, byte [r8]
xor r11d, r11d
mov rdx, r8
test al, al
je 0x44a48d
nop
movzx eax, al
inc rdx
movzx ecx, byte [rax + rbp]
lea eax, [r11*8]
xor ecx, eax
mov al, byte [rdx]
xor r11d, ecx
test al, al
jne 0x44a470
mov eax, r11d
xor edx, edx
div dword [rdi + 0x38]
mov eax, edx
mov r11d, edx
shl rax, 4
add rax, r9
mov r9, qword [rax + 8]
mov r10d, dword [rax]
jmp 0x44a4b5
mov r9, qword [rdi + 0x40]
mov r10d, dword [rdi + 0x3c]
xor r11d, r11d
test r10d, r10d
je 0x44a623
nop
mov rdx, qword [r9 + 0x18]
dec r10d
mov r8, rbx
movzx ecx, byte [rdx]
test cl, cl
je 0x44a4fd
nop
nop
nop
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + rbp]
cmp byte [rcx + rbp], al
jne 0x44a4fd
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x44a4e0
movzx eax, byte [r8]
movzx ecx, byte [rax + rbp]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbp]
cmp eax, ecx
je 0x44a51d
test r10d, r10d
mov r9, qword [r9]
jne 0x44a4c0
jmp 0x44a623
mov rbx, qword [r9 + 0x10]
lea rcx, [rdi + 0x38]
mov r8d, r11d
mov rdx, r9
call fcn.004277f0
test rbx, rbx
je 0x44a623
mov rcx, qword [rbx + 0x30]
cmp qword [rbx + 0x28], rcx
jne 0x44a577
mov rdx, qword [rbx + 8]
add rcx, 8
call fcn.00427900
mov rcx, qword [rax + 0x68]
cmp rcx, rbx
lea r11, [rax + 0x68]
je 0x44a56d
nop
lea r11, [rcx + 0x40]
mov rcx, qword [rcx + 0x40]
cmp rcx, rbx
jne 0x44a560
mov rax, qword [r11]
mov rcx, qword [rax + 0x40]
mov qword [r11], rcx
mov rdx, qword [rbx + 0x38]
mov rcx, rsi
call fcn.00449910
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.00425ea0
mov rdx, qword [rbx + 8]
mov rcx, rsi
call fcn.00425ea0
mov rdi, qword [rbx + 0x18]
test rdi, rdi
je 0x44a608
bt dword [rdi + 4], 0xe
jb 0x44a5f6
mov rdx, qword [rdi + 0x10]
mov rcx, rsi
call fcn.00445010
mov rdx, qword [rdi + 0x18]
mov rcx, rsi
call fcn.00445010
bt dword [rdi + 4], 0x10
jae 0x44a5d5
mov rdx, qword [rdi + 8]
mov rcx, rsi
call fcn.00425ea0
bt dword [rdi + 4], 0xb
jae 0x44a5ea
mov rdx, qword [rdi + 0x20]
mov rcx, rsi
call fcn.004353b0
jmp 0x44a5f6
mov rdx, qword [rdi + 0x20]
mov rcx, rsi
call fcn.00445760
bt dword [rdi + 4], 0xf
jb 0x44a608
mov rdx, rdi
mov rcx, rsi
call fcn.00425ea0
mov rdx, qword [rbx + 0x20]
mov rcx, rsi
call fcn.00433080
mov rdx, rbx
mov rcx, rsi
call fcn.00425ea0
or dword [rsi + 0x2c], 2
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x452b40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
movsxd r9, edx
shl r9, 5
mov qword [rsp + 0x20], r12
mov r11, r8
mov rdi, qword [r9 + rax + 0x18]
mov rsi, rcx
lea r12, [0x0069aea0]
mov r9, qword [rdi + 0x18]
test r9, r9
je 0x452bc6
movzx ecx, byte [r8]
xor ebx, ebx
test cl, cl
mov eax, ebx
je 0x452bad
nop
movzx ecx, cl
inc r8
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
mov cl, byte [r8]
xor eax, edx
test cl, cl
jne 0x452b90
xor edx, edx
div dword [rdi + 8]
mov eax, edx
mov ebp, edx
shl rax, 4
add rax, r9
mov r9, qword [rax + 8]
mov r10d, dword [rax]
jmp 0x452bd2
mov r9, qword [rdi + 0x10]
mov r10d, dword [rdi + 0xc]
xor ebx, ebx
mov ebp, ebx
test r10d, r10d
je 0x452c51
nop
nop
nop
mov rdx, qword [r9 + 0x18]
dec r10d
mov r8, r11
movzx eax, byte [rdx]
test al, al
je 0x452c1f
nop
nop
nop
nop
movzx ecx, al
movzx eax, byte [r8]
movzx eax, byte [rax + r12]
cmp byte [rcx + r12], al
jne 0x452c1f
mov al, byte [rdx + 1]
inc rdx
inc r8
test al, al
jne 0x452c00
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
movzx eax, byte [rdx]
movzx eax, byte [rax + r12]
sub eax, ecx
je 0x452c3e
test r10d, r10d
mov r9, qword [r9]
jne 0x452be0
jmp 0x452c51
mov rbx, qword [r9 + 0x10]
lea rcx, [rdi + 8]
mov r8d, ebp
mov rdx, r9
call fcn.004277f0
mov rdx, rbx
mov rcx, rsi
call fcn.00452490
or dword [rsi + 0x2c], 2
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x45bc20
Capabilities:
Encode data using xor

Disassembly:
mov r11, qword [rdx]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor ebx, ebx
mov rdi, rcx
mov rsi, rdx
lea rbp, [0x00400000]
test r11, r11
je 0x45bd23
mov r9, qword [rdi + 0x298]
test r9, r9
je 0x45bcaa
movzx ecx, byte [r11]
xor eax, eax
mov r8, r11
test cl, cl
je 0x45bc90
nop
nop
movzx ecx, cl
inc r8
movzx edx, byte [rcx + rbp + 0x29aea0]
lea ecx, [rax*8]
xor edx, ecx
mov cl, byte [r8]
xor eax, edx
test cl, cl
jne 0x45bc70
xor edx, edx
div dword [rdi + 0x288]
mov ecx, edx
shl rcx, 4
add rcx, r9
mov r9, qword [rcx + 8]
mov r10d, dword [rcx]
jmp 0x45bcb8
mov r9, qword [rdi + 0x290]
mov r10d, dword [rdi + 0x28c]
test r10d, r10d
je 0x45bd19
nop
mov rdx, qword [r9 + 0x18]
dec r10d
mov r8, r11
movzx eax, byte [rdx]
test al, al
je 0x45bcf6
movzx ecx, al
movzx eax, byte [r8]
movzx eax, byte [rax + rbp + 0x29aea0]
cmp byte [rcx + rbp + 0x29aea0], al
jne 0x45bcf6
mov al, byte [rdx + 1]
inc rdx
inc r8
test al, al
jne 0x45bcd1
movzx eax, byte [r8]
movzx ecx, byte [rax + rbp + 0x29aea0]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbp + 0x29aea0]
sub eax, ecx
je 0x45bd1d
test r10d, r10d
mov r9, qword [r9]
jne 0x45bcc0
xor edx, edx
jmp 0x45bd27
mov rdx, qword [r9 + 0x10]
jmp 0x45bd27
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x45bd40
movzx eax, byte [rbx + rbp + 0x29bd3c]
dec eax
cdqe
lea rcx, [rax + rax*4]
lea rdx, [rdx + rcx*8]
cmp qword [rdx + 0x18], 0
jne 0x45bd6e
inc rbx
cmp rbx, 3
jl 0x45bc46
mov eax, 1
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 8]
ret
mov rax, qword [rdx]
mov qword [rsi], rax
mov rax, qword [rdx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rdx + 0x18]
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], 0
xor eax, eax
jmp 0x45bd59
Function at 0x468710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov rsi, qword [rcx + 0x10]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r13
xor edi, edi
test rsi, rsi
mov qword [rsp + 0x40], r14
movsxd r13, r8d
mov rbx, rcx
mov r14d, edx
jne 0x4687b4
call fcn.0044f4c0
test rax, rax
mov rsi, rax
mov qword [rbx + 0x10], rax
je 0x46879e
mov rcx, qword [rax + 0x30]
movsxd rbp, dword [rax + 0x3c]
cmp dword [rcx + 0x60], ebp
jg 0x468773
lea edx, [rdi + 1]
mov rcx, rax
call fcn.00441a80
test eax, eax
jne 0x46879e
mov rax, qword [rsi + 8]
inc dword [rsi + 0x3c]
lea rcx, [rbp + rbp*2]
mov byte [rax + rcx*8], 0x99
mov byte [rax + rcx*8 + 3], dil
mov dword [rax + rcx*8 + 4], edi
mov dword [rax + rcx*8 + 8], edi
mov dword [rax + rcx*8 + 0xc], edi
mov qword [rax + rcx*8 + 0x10], rdi
mov byte [rax + rcx*8 + 1], dil
cmp qword [rbx + 0x1c0], rdi
jne 0x4687b4
mov rax, qword [rbx]
test byte [rax + 0x4c], 8
jne 0x4687b4
mov byte [rbx + 0x23], 1
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x4687c4
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x4687d0
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x50], r12
movsxd r12, dword [rsi + 0x3c]
cmp dword [rax + 0x60], r12d
jg 0x4687f4
mov edx, 1
mov rcx, rsi
call fcn.00441a80
test eax, eax
jne 0x468820
mov rax, qword [rsi + 8]
inc dword [rsi + 0x3c]
lea rcx, [r12 + r12*2]
mov byte [rax + rcx*8], 0x75
mov byte [rax + rcx*8 + 3], dil
mov dword [rax + rcx*8 + 4], r14d
mov dword [rax + rcx*8 + 8], ebp
mov dword [rax + rcx*8 + 0xc], r13d
mov qword [rax + rcx*8 + 0x10], rdi
mov byte [rax + rcx*8 + 1], dil
mov rax, qword [rbx + 0x1c0]
mov dword [rsp + 0x30], ebp
mov rcx, rbx
test rax, rax
lea r9, str.sqlite_temp_master
lea rdx, str.UPDATE__Q._s_SET_rootpage_d_WHERE__d_AND_rootpage_d
cmovne rcx, rax
lea rax, str.sqlite_master
cmp r13d, 1
mov byte [rcx + 0x21], 1
cmovne r9, rax
mov rax, qword [rbx]
mov r8, qword [rax + 0x20]
mov rcx, r13
mov dword [rsp + 0x28], ebp
shl rcx, 5
mov dword [rsp + 0x20], r14d
mov r8, qword [rcx + r8]
mov rcx, rbx
call fcn.00468100
test ebp, ebp
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x70]
je 0x4688bb
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x4688bb
lea rax, [rbx + 0x88]
cmp dword [rax + 0xc], ebp
je 0x4688cf
inc edi
add rax, 0x14
cmp edi, 0xa
jl 0x4688a1
movzx eax, cl
mov dword [rbx + rax*4 + 0x24], ebp
inc byte [rbx + 0x1f]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov byte [rax + 6], 1
add rsp, 0x58
ret
Function at 0x46d790
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [rcx]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x48], r13
xor r13d, r13d
bt dword [rax + 0x2c], 0x13
mov rsi, rdx
mov rbp, rcx
mov ebx, r13d
jae 0x46d96b
mov r9, qword [rdx + 0x20]
test r9, r9
je 0x46d809
nop
nop
mov eax, dword [r9 + 0x28]
test eax, eax
jle 0x46d800
lea rdx, [r9 + 0x40]
mov r8, rax
nop
mov ecx, dword [rdx]
cmp ecx, 0x1f
jle 0x46d7ee
mov eax, 0xffffffff
jmp 0x46d7f5
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 0x10
dec r8
jne 0x46d7e0
mov r9, qword [r9 + 8]
test r9, r9
jne 0x46d7d0
mov r8, qword [rsi + 0x70]
mov r11, qword [rsi]
mov qword [rsp + 0x78], rdi
mov r10, qword [r8 + 0x60]
mov qword [rsp + 0x50], r12
lea r12, [0x0069aea0]
test r10, r10
je 0x46d877
movzx eax, byte [r11]
mov rdx, r11
mov r9d, r13d
test al, al
je 0x46d85e
nop
nop
movzx eax, al
inc rdx
movzx ecx, byte [rax + r12]
lea eax, [r9*8]
xor ecx, eax
mov al, byte [rdx]
xor r9d, ecx
test al, al
jne 0x46d840
xor edx, edx
mov eax, r9d
div dword [r8 + 0x50]
mov ecx, edx
add rcx, rcx
mov rdi, qword [r10 + rcx*8 + 8]
mov r9d, dword [r10 + rcx*8]
jmp 0x46d87f
mov rdi, qword [r8 + 0x58]
mov r9d, dword [r8 + 0x54]
test r9d, r9d
je 0x46d961
nop
nop
mov r8, qword [rdi + 0x18]
dec r9d
mov rdx, r11
movzx eax, byte [r8]
test al, al
je 0x46d8cf
nop
nop
nop
nop
movzx ecx, al
movzx eax, byte [rdx]
movzx eax, byte [rax + r12]
cmp byte [rcx + r12], al
jne 0x46d8cf
mov al, byte [r8 + 1]
inc r8
inc rdx
test al, al
jne 0x46d8b0
movzx ecx, byte [rdx]
movzx edx, byte [rcx + r12]
movzx ecx, byte [r8]
movzx ecx, byte [rcx + r12]
cmp ecx, edx
je 0x46d8ee
test r9d, r9d
mov rdi, qword [rdi]
jne 0x46d890
jmp 0x46d961
mov rdi, qword [rdi + 0x10]
test rdi, rdi
je 0x46d961
nop
nop
nop
lea r9, [rsp + 0x30]
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], r13
call fcn.0046d2f0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x46d958
movzx eax, word [rdx + 0x5e]
test eax, eax
jle 0x46d958
mov rdx, qword [rdx + 8]
mov r8, rax
mov cx, word [rdx]
cmp cx, 0x1f
jle 0x46d946
mov eax, 0xffffffff
jmp 0x46d94d
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 2
dec r8
jne 0x46d936
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x46d900
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x50]
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x47dd80
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp dword [rcx + 0x20], 0
mov qword [rsp + 0x50], rbx
mov rbx, rcx
je 0x47de46
mov qword [rsp + 0x58], rdi
mov rdi, qword [rcx]
xor edx, edx
mov rcx, qword [rdi]
test rcx, rcx
je 0x47ddcd
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 1
call fcn.0043bb00
mov edx, dword [rsp + 0x40]
mov dword [rdi + 8], 0
mov qword [rdi], 0
test edx, edx
mov rdi, qword [rsp + 0x58]
jne 0x47de1f
mov rax, qword [rbx + 0x28]
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rbx + 0x30]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x38]
lea rax, [rsp + 0x20]
mov qword [rbx + 0x28], rcx
mov rcx, qword [rbx + 0x40]
mov qword [rbx + 0x30], rcx
mov rcx, qword [rax]
mov qword [rbx + 0x38], rcx
mov rcx, qword [rax + 8]
mov qword [rbx + 0x40], rcx
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x47de2b
mov dword [rbx + 0x1c], 1
mov eax, edx
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
mov rcx, qword [rbx]
lea rdx, [0x0047dd40]
mov r8, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
jmp fcn.0043b9d0
call fcn.0047d8b0
mov rcx, qword [rbx + 0x38]
mov qword [rbx + 0x28], rcx
mov rcx, qword [rbx + 0x40]
mov qword [rbx + 0x30], rcx
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x47de21
mov dword [rbx + 0x1c], 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x47df80
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
sub rsp, 0x38
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, qword [rcx + 0x48]
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov rdi, qword [rsi + 0x30]
mov r12, qword [rcx + 0x10]
mov qword [rax - 0x10], r13
xor ebx, ebx
test rdi, rdi
mov qword [rax - 0x18], r14
mov r13, r9
mov ebp, r8d
mov r14, rdx
jne 0x47e019
movzx eax, word [r12 + 6]
imul eax, eax, 0x38
add eax, 0x58
test eax, eax
jle 0x47dfe9
mov rcx, qword [r12 + 0x10]
movsxd rdx, eax
call fcn.0043b030
test rax, rax
mov rdi, rax
jne 0x47dfec
mov rdi, rbx
jmp 0x47e004
mov rdi, rbx
lea rax, [rdi + 0x20]
mov qword [rdi], r12
mov qword [rdi + 0x10], rax
movzx eax, word [r12 + 6]
inc ax
mov word [rdi + 8], ax
test rdi, rdi
mov qword [rsi + 0x30], rdi
jne 0x47e015
lea eax, [rdi + 7]
jmp 0x47e09a
mov word [rdi + 8], bp
cmp byte [rsi + 0x58], bl
je 0x47e051
cmp byte [rsi + 0x59], bl
je 0x47e030
mov rax, qword [rsi + 0x10]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x47e05b
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x47e05b
mov rax, qword [rsi + 0x38]
mov edx, dword [rax]
lea r8, [rax + 0x10]
mov r9, rdi
mov rcx, r12
call fcn.0042f4a0
test ebp, ebp
jle 0x47e081
mov rax, qword [rdi + 0x10]
add rax, 8
test byte [rax], 1
jne 0x47e0c2
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x47e072
mov rdx, qword [r14 + 0x10]
mov ecx, dword [r14 + 0xc]
xor r9d, r9d
mov r8, rdi
call fcn.0047b2a0
mov dword [r13], eax
xor eax, eax
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
mov dword [r13], 0xffffffff
jmp 0x47e098