joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049e40
Capabilities:
Create thread

Disassembly:
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x180049e6c
cmp dword [rcx + 0x20], 0
je 0x180049e64
mov rcx, qword [rcx]
lea rdx, [0x180049e10]
mov r8, rax
jmp fcn.18000e360
mov rcx, rax
jmp fcn.180049d00
xor eax, eax
ret

Function at 0x1800560e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r12
sub rsp, 0x28
mov rbx, rdx
movzx edx, byte [rdx]
mov r12, rcx
movzx eax, dl
cmp dl, 0xb0
jne 0x1800560fd
movzx eax, byte [rbx + 2]
cmp al, 0xb1
jne 0x180056109
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax]
jmp 0x18005611b
cmp al, 0x8a
jne 0x1800561b2
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 0x20]
mov ecx, dword [rcx]
cmp ecx, 1
je 0x1800561b2
mov qword [rsp + 0x48], rsi
xor esi, esi
mov dword [r8], esi
cmp dl, 0x8a
jne 0x18005614a
mov rdx, rbx
mov rcx, r12
mov rsi, qword [rsp + 0x48]
add rsp, 0x28
pop r12
pop rbx
jmp fcn.1800541e0
mov eax, dword [r12 + 0x38]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r13
lea edi, [rax + 1]
add eax, ecx
movsxd r13, ecx
mov dword [r12 + 0x38], eax
test ecx, ecx
jle 0x1800561ae
mov qword [rsp + 0x40], rbp
mov ebp, edi
mov rdx, qword [rbx + 0x20]
mov r8d, ebp
mov rcx, r12
mov rdx, qword [rdx + rsi + 8]
call fcn.180058a50
inc ebp
add rsi, 0x20
dec r13
jne 0x180056171
mov rbp, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
add rsp, 0x28
pop r12
pop rbx
ret
mov eax, edi
jmp 0x180056197
mov rdx, rbx
mov rcx, r12
add rsp, 0x28
pop r12
pop rbx
jmp fcn.1800586a0

Function at 0x18005aeb0
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov r12d, dword [rsp + 0x70]
mov ebx, r8d
mov rbp, r9
mov dword [rax - 0x18], r12d
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
mov byte [rcx + 0x1c], 1
mov dword [rax - 0x28], ebx
call fcn.180063c00
test ebx, ebx
jne 0x18005af19
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov r9, rbp
mov r8, rdi
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.180063c00
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x180064420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov r12, rdx
mov ebx, r11d
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x180064529
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x20], r14
lea r14, str.main
lea r13, [0x180143970]
nop
mov r9d, ebx
cmp ebx, 2
jge 0x18006446c
xor r9d, 1
mov rax, qword [rsi + 0x20]
movsxd r8, r9d
shl r8, 5
mov rbp, qword [r8 + rax + 0x18]
test rdi, rdi
je 0x1800644a1
mov r8, qword [r8 + rax]
mov r10, rdi
sub r10, r8
nop dword [rax + rax]
movzx ecx, byte [r8]
movzx eax, byte [r10 + r8]
cmp ecx, eax
jne 0x1800644dc
test ecx, ecx
jne 0x1800644ea
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r12
call fcn.180011230
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x1800644c0
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x180064460
mov r13, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
mov rax, r11
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r13]
movzx ecx, byte [rcx + r13]
sub ecx, edx
jne 0x1800644ef
inc r8
jmp 0x180064490
test r9d, r9d
jne 0x1800644b9
mov r9, rdi
mov r8, r14
sub r9, r14
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x180064516
test ecx, ecx
je 0x1800644a1
inc r8
jmp 0x180064500
movzx edx, byte [rax + r13]
movzx ecx, byte [rcx + r13]
sub ecx, edx
jne 0x1800644b9
inc r8
jmp 0x180064500
mov rax, r11
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800e5870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
mov r8d, ecx
cmp ecx, 0x80
jge 0x1800e589c
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x1800e5894
lea eax, [rcx + 0x20]
add rsp, 0x20
pop rdi
ret
mov eax, ecx
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x10000
jge 0x1800e5973
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov qword [rsp + 0x38], rsi
mov r9d, 0xa2
or r11d, 0xffffffff
lea rsi, [0x180000000]
mov r10d, ebx
nop dword [rax + rax]
lea eax, [r10 + r9]
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
movzx edx, word [rsi + rcx*4 + 0x14aaf0]
cmp r8d, edx
js 0x1800e58f2
mov r11d, eax
lea r10d, [rax + 1]
jmp 0x1800e58f6
lea r9d, [rax - 1]
cmp r9d, r10d
jge 0x1800e58d0
movsxd rdx, r11d
movzx ecx, word [rsi + rdx*4 + 0x14aaf0]
movzx eax, byte [rsi + rdx*4 + 0x14aaf3]
add eax, ecx
cmp r8d, eax
jge 0x1800e5942
movzx r9d, byte [rsi + rdx*4 + 0x14aaf2]
xor ecx, r8d
mov eax, r9d
and eax, 1
and eax, ecx
test al, al
jne 0x1800e5942
mov eax, r9d
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x14ad80]
add eax, r8d
movzx r8d, ax
mov rsi, qword [rsp + 0x38]
test edi, edi
je 0x1800e5965
cmp edi, 2
mov ecx, r8d
sete bl
mov edx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800e5250
mov eax, r8d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rcx - 0x10400]
cmp eax, 0x27
ja 0x1800e5894
lea eax, [rcx + 0x28]
add rsp, 0x20
pop rdi
ret
Function at 0x1800f2630
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, qword [rdx + 0x30]
xor r15d, r15d
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov r12d, 0x64
mov rbp, rdx
mov qword [rsp + 0x70], r15
mov ebx, r15d
mov r13d, r12d
test rcx, rcx
je 0x1800f2679
call qword [0x1801719a0]
cmp byte [rdi + 0x6f], bl
jne 0x1800f2686
mov rcx, rdi
call fcn.180023080
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180086890
mov esi, eax
test eax, eax
jne 0x1800f26bc
lea rdx, str.sqlite_stat1
mov r8, r14
mov rcx, rdi
call fcn.180063cf0
mov rbx, rax
test rax, rax
je 0x1800f26b9
cmp byte [rax + 0x3f], 2
jne 0x1800f26bc
mov rbx, r15
cmp byte [rdi + 0x6f], r15b
jne 0x1800f26ca
mov rcx, rdi
call fcn.1800230f0
test esi, esi
jne 0x1800f2703
test rbx, rbx
jne 0x1800f2703
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18000b260
lea r8, str.sqlite_stat1
lea rdx, str.no_such_table_column:__s._s
xor r9d, r9d
mov rcx, rdi
call fcn.18000dad0
lea esi, [rbx + 1]
mov qword [rsp + 0x70], rax
jmp 0x1800f2708
mov rax, qword [rsp + 0x70]
lea rcx, [0x180143804]
test rax, rax
mov r8, r15
cmovne r8, rcx
mov r9, rax
mov edx, esi
mov rcx, rdi
call fcn.18000edb0
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18000b260
cmp byte [rdi + 0x67], r15b
jne 0x1800f2742
test esi, esi
jne 0x1800f2742
mov ebx, r15d
jmp 0x1800f274e
mov edx, esi
mov rcx, rdi
call fcn.18000bb10
mov ebx, eax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800f275d
call qword [0x1801719b0]
test ebx, ebx
je 0x1800f2775
cmp ebx, 1
mov qword [rbp + 0x48], 0x100000
cmove ebx, r15d
jmp 0x1800f2801
mov r8, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
lea rcx, str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
call sym.sqlite.dll_sqlite3_mprintf
mov rsi, rax
test rax, rax
jne 0x1800f2796
lea ebx, [rax + 7]
jmp 0x1800f27f6
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r15
mov r9d, pe_nt_image_headers64
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.1800873e0
mov ebx, eax
test eax, eax
jne 0x1800f27ee
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, r12d
jne 0x1800f27e4
xor edx, edx
mov rcx, rbx
call sym.sqlite.dll_sqlite3_column_int64
mov r13, rax
mov rcx, rbx
call sym.sqlite.dll_sqlite3_finalize
mov ebx, eax
mov rcx, rsi
call sym.sqlite.dll_sqlite3_free
cmp r13, r12
cmovg r12, r13
mov qword [rbp + 0x48], r12
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800f2e10
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r12, rcx
test r8d, r8d
je 0x1800f2ee2
mov rdx, qword [rdx + 0x30]
lea rcx, str.PRAGMA__Q.page_size
xor esi, esi
call sym.sqlite.dll_sqlite3_mprintf
lea edi, [rsi + 7]
mov rbp, rax
test rax, rax
je 0x1800f2eb1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
lea r9d, [rdi + 0x79]
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rsi
call fcn.1800873e0
mov edi, eax
test eax, eax
jne 0x1800f2eb1
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f2ea7
xor edx, edx
mov rcx, rdi
call sym.sqlite.dll_sqlite3_column_int
mov esi, eax
mov rcx, rdi
call sym.sqlite.dll_sqlite3_finalize
mov edi, eax
test edi, edi
jne 0x1800f2ece
movzx eax, byte [rbx + 0x27]
lea ecx, [rsi - 0x40]
mov dword [rbx + 0x20], ecx
imul eax, eax, 0x33
add eax, 4
cmp eax, ecx
jge 0x1800f2f30
mov dword [rbx + 0x20], eax
jmp 0x1800f2f30
mov rcx, r12
call sym.sqlite.dll_sqlite3_errmsg
lea rcx, [0x180143804]
mov rdx, rax
jmp 0x1800f2f27
mov r8, qword [rdx + 0x38]
mov rdx, qword [rdx + 0x30]
lea rcx, str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.sqlite.dll_sqlite3_mprintf
lea r8, [rbx + 0x20]
mov rcx, r12
mov rdx, rax
mov rbp, rax
call fcn.1800f2d90
mov edi, eax
test eax, eax
jne 0x1800f2ece
cmp dword [rbx + 0x20], 0x1c0
jge 0x1800f2f30
mov rdx, qword [rbx + 0x38]
mov edi, 0x10b
lea rcx, str.undersize_RTree_blobs_in___q_node_
call sym.sqlite.dll_sqlite3_mprintf
mov qword [r13], rax
mov rcx, rbp
call sym.sqlite.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x1800f38e0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov r12, r8
mov rbp, rdx
mov rdi, rcx
cmp dword [rcx + 0x40], ebx
jne 0x1800f391b
cmp qword [rcx + 0x20], rbx
jne 0x1800f391b
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
lea rdx, str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
call fcn.1800f37d0
mov qword [rdi + 0x20], rax
cmp dword [rdi + 0x40], ebx
jne 0x1800f39e3
mov rcx, qword [rdi + 0x20]
mov r8, rbp
mov edx, 1
call sym.sqlite.dll_sqlite3_bind_int64
mov rcx, qword [rdi + 0x20]
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f39b6
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r14
call sym.sqlite.dll_sqlite3_column_bytes
mov rcx, qword [rdi + 0x20]
xor edx, edx
movsxd r13, eax
call sym.sqlite.dll_sqlite3_column_blob
mov r14, rax
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x1800f398c
test r13d, r13d
je 0x1800f3987
mov rcx, r13
call fcn.18000af90
mov rbx, rax
test rbx, rbx
jne 0x1800f3995
mov dword [rdi + 0x40], 7
jmp 0x1800f39a7
mov r8, r13
mov rdx, r14
mov rcx, rbx
call fcn.1801278d0
mov dword [r12], r13d
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rdi + 0x20]
call sym.sqlite.dll_sqlite3_reset
cmp dword [rdi + 0x40], 0
jne 0x1800f39e3
mov dword [rdi + 0x40], eax
test eax, eax
jne 0x1800f39e3
test rbx, rbx
jne 0x1800f39e3
lea rdx, str.Node__lld_missing_from_database
mov r8, rbp
mov rcx, rdi
call fcn.1800f3860
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x1800f3a00
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r13, edx
mov rbp, r9
mov rdi, qword [rcx + r13*8 + 0x28]
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
mov r12, r8
mov rbx, rcx
test rdi, rdi
jne 0x1800f3a60
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov rdx, qword [rsp + r13*8 + 0x40]
call fcn.1800f37d0
mov rdi, rax
mov qword [rbx + r13*8 + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x1800f3b16
mov r8, r12
mov edx, 1
mov rcx, rdi
call sym.sqlite.dll_sqlite3_bind_int64
mov rcx, rdi
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x65
jne 0x1800f3ab8
lea rdx, str.__rowid
test r13d, r13d
lea rcx, str.__parent
cmovne rcx, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov r8, r12
call fcn.1800f3860
jmp 0x1800f3b05
cmp eax, 0x64
jne 0x1800f3b05
xor edx, edx
mov rcx, rdi
call sym.sqlite.dll_sqlite3_column_int64
cmp rax, rbp
je 0x1800f3b05
lea rdx, str.__rowid
test r13d, r13d
mov qword [rsp + 0x30], rbp
lea rcx, str.__parent
mov qword [rsp + 0x28], r12
mov r9, rax
cmovne rcx, rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov r8, r12
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.1800f3860
mov rcx, rdi
call sym.sqlite.dll_sqlite3_reset
cmp dword [rbx + 0x40], 0
jne 0x1800f3b16
mov dword [rbx + 0x40], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x1800f3cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov esi, edx
lea r8, [rsp + 0x30]
xor edi, edi
mov rdx, r9
mov rbp, r9
mov rbx, rcx
mov dword [rsp + 0x30], edi
call fcn.1800f38e0
mov rdx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800f3e54
mov ecx, dword [rsp + 0x30]
cmp ecx, 4
jge 0x1800f3d1a
mov r9d, ecx
lea rdx, str.Node__lld_is_too_small___d_bytes_
mov r8, rbp
mov rcx, rbx
call fcn.1800f3860
mov rdx, qword [rsp + 0x38]
jmp 0x1800f3e4c
mov r8, qword [rsp + 0x80]
test r8, r8
jne 0x1800f3d54
movzx esi, byte [rax]
movzx eax, byte [rax + 1]
shl esi, 8
add esi, eax
cmp esi, 0x28
jle 0x1800f3d54
lea rdx, str.Rtree_depth_out_of_range___d_
mov r8d, esi
mov rcx, rbx
call fcn.1800f3860
mov rcx, qword [rsp + 0x38]
jmp 0x1800f3e4f
movzx eax, byte [rdx + 3]
movzx ebp, byte [rdx + 2]
shl ebp, 8
add ebp, eax
mov eax, dword [rbx + 0x1c]
inc eax
imul eax, ebp
lea eax, [rax*8 + 4]
cmp eax, ecx
jle 0x1800f3d9c
mov r8, qword [rsp + 0x88]
mov dword [rsp + 0x20], ecx
lea rdx, str.Node__lld_is_too_small_for_cell_count_of__d___d_bytes_
mov r9d, ebp
mov rcx, rbx
call fcn.1800f3860
mov rdx, qword [rsp + 0x38]
jmp 0x1800f3e4c
test ebp, ebp
jle 0x1800f3e4c
nop word [rax + rax]
mov eax, dword [rbx + 0x1c]
mov qword [rsp + 0x20], r8
mov r8d, edi
inc eax
imul eax, edi
lea eax, [rax*8 + 4]
movsxd rcx, eax
mov rax, qword [rcx + rdx]
bswap rax
mov qword [rsp + 0x30], rax
lea rax, [rcx + rdx + 8]
mov rdx, qword [rsp + 0x88]
mov r9, rax
mov rcx, rbx
mov qword [rsp + 0x40], rax
call fcn.1800f3b40
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x30]
mov rcx, rbx
test esi, esi
jle 0x1800f3e28
xor edx, edx
call fcn.1800f3a00
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea edx, [rsi - 1]
mov rcx, rbx
call fcn.1800f3cb0
inc dword [rbx + 0x3c]
jmp 0x1800f3e35
mov edx, 1
call fcn.1800f3a00
inc dword [rbx + 0x38]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x80]
inc edi
cmp edi, ebp
jl 0x1800f3db0
mov rcx, rdx
call sym.sqlite.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800f4df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
movaps xmmword [rsp + 0x30], xmm6
mov r15d, r9d
mov r12, r8
mov r14, rcx
cmp dword [r8 + 0x18], ebx
je 0x1800f4e6e
mov rbx, rdx
lea eax, [rdx*8]
sar rbx, 0x20
xor ebx, eax
xor ebx, edx
xor edx, edx
mov eax, ebx
div dword [r12 + 0x34]
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ebp, ebp
xor r13d, r13d
cmp dword [r8 + 0x10], ebx
jle 0x1800f4e34
xorpd xmm6, xmm6
lea rdi, [0x180144840]
mov rax, qword [r12 + 0x28]
cmp byte [r13 + rax], 0
je 0x1800f4feb
mov rcx, qword [r14 + 0x60]
lea r8, [rsp + 0x80]
mov edx, ebp
test r15d, r15d
je 0x1800f4eae
call qword [r14 + 0x70]
jmp 0x1800f4eb2
call qword [r14 + 0x68]
test eax, eax
jne 0x1800f4e49
mov rcx, qword [rsp + 0x80]
movzx edx, word [rcx + 0x14]
mov eax, edx
and eax, 0x3f
movzx edi, byte [rax + rdi]
lea eax, [rbx*8]
xor eax, edi
xor ebx, eax
cmp edi, 1
je 0x1800f4fc2
cmp edi, 2
je 0x1800f4f69
cmp edi, 3
je 0x1800f4f0c
cmp edi, 4
je 0x1800f4f05
mov rax, qword [rsp + 0x98]
mov dword [rax], 1
jmp 0x1800f4fe4
call sym.sqlite.dll_sqlite3_value_blob
jmp 0x1800f4f11
call sym.sqlite.dll_sqlite3_value_text
mov rcx, qword [rsp + 0x80]
mov rsi, rax
call sym.sqlite.dll_sqlite3_value_bytes
test rsi, rsi
jne 0x1800f4f37
cmp edi, 4
jne 0x1800f5000
test eax, eax
jg 0x1800f5000
xor edx, edx
movsxd r8, eax
test eax, eax
jle 0x1800f4fe4
nop word [rax + rax]
movzx ecx, byte [rdx + rsi]
lea eax, [rbx*8]
inc rdx
xor ecx, eax
xor ebx, ecx
cmp rdx, r8
jl 0x1800f4f50
jmp 0x1800f4fe4
test dl, 8
je 0x1800f4f7f
movsd xmm0, qword [rcx]
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f4fca
test dl, 0x24
je 0x1800f4f9a
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rcx]
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f4fca
test dl, 0x12
je 0x1800f4fb1
call fcn.180032be0
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f4fca
movsd qword [rsp + 0x20], xmm6
mov rdx, qword [rsp + 0x20]
movapd xmm0, xmm6
jmp 0x1800f4fca
call sym.sqlite.dll_sqlite3_value_int64
mov rdx, rax
lea ecx, [rbx*8]
xor ecx, edx
sar rdx, 0x20
xor ecx, ebx
lea ebx, [rcx*8]
xor ebx, edx
xor ebx, ecx
lea rdi, [0x180144840]
inc ebp
inc r13
cmp ebp, dword [r12 + 0x10]
jl 0x1800f4e84
jmp 0x1800f4e34
mov eax, 7
jmp 0x1800f4e49
Function at 0x1800f5110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
xor edi, edi
xor esi, esi
mov r13d, r9d
mov r11, r8
mov r12d, edx
mov rbp, rcx
cmp dword [rcx + 0x10], ebx
jle 0x1800f52db
mov qword [rsp + 0x58], r14
or r14d, 0xffffffff
nop word [rax + rax]
mov rax, qword [rbp + 0x28]
movzx ecx, byte [r11]
movzx edx, byte [rsi + rax]
test r12d, r12d
je 0x1800f516b
test edx, edx
je 0x1800f52c8
jmp 0x1800f5173
test edx, edx
je 0x1800f52ba
lea eax, [rbx*8]
inc r11
xor eax, ecx
xor ebx, eax
cmp ecx, 1
je 0x1800f5243
cmp ecx, 2
je 0x1800f5243
movzx eax, byte [r11]
movzx edx, al
cmp al, 0x80
jae 0x1800f51a5
mov eax, 1
jmp 0x1800f520f
movzx ecx, byte [r11 + 1]
test cl, cl
js 0x1800f51ba
and edx, 0x7f
mov al, 2
shl edx, 7
or edx, ecx
jmp 0x1800f520c
movzx eax, byte [r11 + 2]
shl edx, 0xe
or edx, eax
mov eax, edx
test dl, dl
js 0x1800f51dd
and eax, 0x1fc07f
mov edx, ecx
and edx, 0x7f
shl edx, 7
or edx, eax
mov al, 3
jmp 0x1800f520c
movzx eax, byte [r11]
mov rcx, r11
test al, al
js 0x1800f51f4
movzx edx, al
mov al, 1
mov qword [rsp + 0x50], rdx
jmp 0x1800f5203
lea rdx, [rsp + 0x50]
call fcn.1800107e0
mov rdx, qword [rsp + 0x50]
mov ecx, edx
cmp rcx, rdx
cmovne edx, r14d
movzx eax, al
movzx eax, al
mov r9d, edx
xor r8d, r8d
add r11, rax
test r9, r9
jle 0x1800f5238
movzx ecx, byte [r8 + r11]
lea eax, [rbx*8]
inc r8
xor ecx, eax
xor ebx, ecx
cmp r8, r9
jl 0x1800f5220
movsxd rax, edx
add r11, rax
jmp 0x1800f52c8
movzx eax, byte [r11 + 6]
movzx r8d, byte [r11 + 5]
movzx edx, byte [r11 + 1]
shl r8d, 8
shl edx, 8
lea ecx, [rbx*8]
or r8d, eax
movzx eax, byte [r11 + 4]
shl eax, 0x18
shl r8d, 8
or r8, rax
movzx eax, byte [r11 + 7]
or r8, rax
movzx eax, byte [r11 + 2]
or edx, eax
movzx eax, byte [r11]
shl eax, 0x18
shl edx, 8
or rdx, rax
movzx eax, byte [r11 + 3]
or rdx, rax
shl rdx, 0x20
add r8, rdx
xor ecx, r8d
xor ecx, ebx
mov rbx, r8
sar rbx, 0x20
lea eax, [rcx*8]
xor ebx, eax
xor ebx, ecx
add r11, 8
jmp 0x1800f52c8
mov rcx, r11
call fcn.1800f5010
movsxd rcx, eax
add r11, rcx
inc edi
inc rsi
cmp edi, dword [rbp + 0x10]
jl 0x1800f5150
mov r14, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
xor edx, edx
div r13d
mov eax, edx
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800f75c0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
cmp dword [r8 + 0x18], 0
mov rsi, rdx
mov r10, r9
mov r9, qword [r8 + 8]
lea rax, str._rowid___
mov ebp, ecx
mov rdi, r8
lea rdx, [0x180150604]
lea rcx, str.SELECT__s_FROM___w_.__w__WHERE_NOT_EXISTS____SELECT_1_FROM___w_.__w__WHERE__s_
cmovne rdx, rax
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rax
call sym.sqlite.dll_sqlite3_mprintf
mov r12, rax
test rax, rax
jne 0x1800f763c
lea eax, [r12 + 7]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
xor r9d, r9d
or r8d, 0xffffffff
mov rdx, r12
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], 0
call fcn.1800873e0
mov ebx, eax
test eax, eax
jne 0x1800f76d2
mov rcx, qword [rsi + 0x60]
mov rbx, qword [rsp + 0x70]
mov qword [rcx], rbx
mov dword [rcx + 0xc], eax
mov eax, dword [rdi + 0x18]
mov dword [rcx + 8], eax
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f76c8
cmp dword [rdi + 0x18], 0
je 0x1800f76a9
xor edx, edx
mov rcx, rbx
call sym.sqlite.dll_sqlite3_column_int64
jmp 0x1800f76ab
xor eax, eax
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov ecx, ebp
call fcn.1800f6c30
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
je 0x1800f7697
mov rcx, rbx
call sym.sqlite.dll_sqlite3_finalize
mov ebx, eax
mov rcx, r12
call sym.sqlite.dll_sqlite3_free
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret