joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800653b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov r12, rdx
mov ebx, r11d
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x1800654b9
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x20], r14
lea r14, str.main
lea r13, [0x180144c60]
nop
mov r9d, ebx
cmp ebx, 2
jge 0x1800653fc
xor r9d, 1
mov rax, qword [rsi + 0x20]
movsxd r8, r9d
shl r8, 5
mov rbp, qword [r8 + rax + 0x18]
test rdi, rdi
je 0x180065431
mov r8, qword [r8 + rax]
mov r10, rdi
sub r10, r8
nop dword [rax + rax]
movzx ecx, byte [r8]
movzx eax, byte [r10 + r8]
cmp ecx, eax
jne 0x18006546c
test ecx, ecx
jne 0x18006547a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r12
call fcn.1800121f0
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x180065450
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1800653f0
mov r13, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
mov rax, r11
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r13]
movzx ecx, byte [rcx + r13]
sub ecx, edx
jne 0x18006547f
inc r8
jmp 0x180065420
test r9d, r9d
jne 0x180065449
mov r9, rdi
mov r8, r14
sub r9, r14
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x1800654a6
test ecx, ecx
je 0x180065431
inc r8
jmp 0x180065490
movzx edx, byte [rax + r13]
movzx ecx, byte [rcx + r13]
sub ecx, edx
jne 0x180065449
inc r8
jmp 0x180065490
mov rax, r11
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800f2fc0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, qword [rdx + 0x30]
xor r15d, r15d
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov r12d, 0x64
mov rbp, rdx
mov qword [rsp + 0x70], r15
mov ebx, r15d
mov r13d, r12d
test rcx, rcx
je 0x1800f3009
call qword [0x1801729a0]
cmp byte [rdi + 0x6f], bl
jne 0x1800f3016
mov rcx, rdi
call fcn.180023fd0
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180087830
mov esi, eax
test eax, eax
jne 0x1800f304c
lea rdx, str.sqlite_stat1
mov r8, r14
mov rcx, rdi
call fcn.180064c80
mov rbx, rax
test rax, rax
je 0x1800f3049
cmp byte [rax + 0x3f], 2
jne 0x1800f304c
mov rbx, r15
cmp byte [rdi + 0x6f], r15b
jne 0x1800f305a
mov rcx, rdi
call fcn.180024040
test esi, esi
jne 0x1800f3093
test rbx, rbx
jne 0x1800f3093
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18000c110
lea r8, str.sqlite_stat1
lea rdx, str.no_such_table_column:__s._s
xor r9d, r9d
mov rcx, rdi
call fcn.18000e980
lea esi, [rbx + 1]
mov qword [rsp + 0x70], rax
jmp 0x1800f3098
mov rax, qword [rsp + 0x70]
lea rcx, [0x180144af4]
test rax, rax
mov r8, r15
cmovne r8, rcx
mov r9, rax
mov edx, esi
mov rcx, rdi
call fcn.18000fc60
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18000c110
cmp byte [rdi + 0x67], r15b
jne 0x1800f30d2
test esi, esi
jne 0x1800f30d2
mov ebx, r15d
jmp 0x1800f30de
mov edx, esi
mov rcx, rdi
call fcn.18000c9c0
mov ebx, eax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800f30ed
call qword [0x1801729b0]
test ebx, ebx
je 0x1800f3105
cmp ebx, 1
mov qword [rbp + 0x48], 0x100000
cmove ebx, r15d
jmp 0x1800f3191
mov r8, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
lea rcx, str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
call sym.sqlite.dll_sqlite3_mprintf
mov rsi, rax
test rax, rax
jne 0x1800f3126
lea ebx, [rax + 7]
jmp 0x1800f3186
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r15
mov r9d, pe_nt_image_headers64
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.180088380
mov ebx, eax
test eax, eax
jne 0x1800f317e
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, r12d
jne 0x1800f3174
xor edx, edx
mov rcx, rbx
call sym.sqlite.dll_sqlite3_column_int64
mov r13, rax
mov rcx, rbx
call sym.sqlite.dll_sqlite3_finalize
mov ebx, eax
mov rcx, rsi
call sym.sqlite.dll_sqlite3_free
cmp r13, r12
cmovg r12, r13
mov qword [rbp + 0x48], r12
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800f37a0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r12, rcx
test r8d, r8d
je 0x1800f3872
mov rdx, qword [rdx + 0x30]
lea rcx, str.PRAGMA__Q.page_size
xor esi, esi
call sym.sqlite.dll_sqlite3_mprintf
lea edi, [rsi + 7]
mov rbp, rax
test rax, rax
je 0x1800f3841
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
lea r9d, [rdi + 0x79]
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rsi
call fcn.180088380
mov edi, eax
test eax, eax
jne 0x1800f3841
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f3837
xor edx, edx
mov rcx, rdi
call sym.sqlite.dll_sqlite3_column_int
mov esi, eax
mov rcx, rdi
call sym.sqlite.dll_sqlite3_finalize
mov edi, eax
test edi, edi
jne 0x1800f385e
movzx eax, byte [rbx + 0x27]
lea ecx, [rsi - 0x40]
mov dword [rbx + 0x20], ecx
imul eax, eax, 0x33
add eax, 4
cmp eax, ecx
jge 0x1800f38c0
mov dword [rbx + 0x20], eax
jmp 0x1800f38c0
mov rcx, r12
call sym.sqlite.dll_sqlite3_errmsg
lea rcx, [0x180144af4]
mov rdx, rax
jmp 0x1800f38b7
mov r8, qword [rdx + 0x38]
mov rdx, qword [rdx + 0x30]
lea rcx, str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.sqlite.dll_sqlite3_mprintf
lea r8, [rbx + 0x20]
mov rcx, r12
mov rdx, rax
mov rbp, rax
call fcn.1800f3720
mov edi, eax
test eax, eax
jne 0x1800f385e
cmp dword [rbx + 0x20], 0x1c0
jge 0x1800f38c0
mov rdx, qword [rbx + 0x38]
mov edi, 0x10b
lea rcx, str.undersize_RTree_blobs_in___q_node_
call sym.sqlite.dll_sqlite3_mprintf
mov qword [r13], rax
mov rcx, rbp
call sym.sqlite.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x1800f4270
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov r12, r8
mov rbp, rdx
mov rdi, rcx
cmp dword [rcx + 0x40], ebx
jne 0x1800f42ab
cmp qword [rcx + 0x20], rbx
jne 0x1800f42ab
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
lea rdx, str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
call fcn.1800f4160
mov qword [rdi + 0x20], rax
cmp dword [rdi + 0x40], ebx
jne 0x1800f4373
mov rcx, qword [rdi + 0x20]
mov r8, rbp
mov edx, 1
call sym.sqlite.dll_sqlite3_bind_int64
mov rcx, qword [rdi + 0x20]
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f4346
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r14
call sym.sqlite.dll_sqlite3_column_bytes
mov rcx, qword [rdi + 0x20]
xor edx, edx
movsxd r13, eax
call sym.sqlite.dll_sqlite3_column_blob
mov r14, rax
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x1800f431c
test r13d, r13d
je 0x1800f4317
mov rcx, r13
call fcn.18000be40
mov rbx, rax
test rbx, rbx
jne 0x1800f4325
mov dword [rdi + 0x40], 7
jmp 0x1800f4337
mov r8, r13
mov rdx, r14
mov rcx, rbx
call fcn.180128740
mov dword [r12], r13d
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rdi + 0x20]
call sym.sqlite.dll_sqlite3_reset
cmp dword [rdi + 0x40], 0
jne 0x1800f4373
mov dword [rdi + 0x40], eax
test eax, eax
jne 0x1800f4373
test rbx, rbx
jne 0x1800f4373
lea rdx, str.Node__lld_missing_from_database
mov r8, rbp
mov rcx, rdi
call fcn.1800f41f0
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x1800f4390
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r13, edx
mov rbp, r9
mov rdi, qword [rcx + r13*8 + 0x28]
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
mov r12, r8
mov rbx, rcx
test rdi, rdi
jne 0x1800f43f0
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov rdx, qword [rsp + r13*8 + 0x40]
call fcn.1800f4160
mov rdi, rax
mov qword [rbx + r13*8 + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x1800f44a6
mov r8, r12
mov edx, 1
mov rcx, rdi
call sym.sqlite.dll_sqlite3_bind_int64
mov rcx, rdi
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x65
jne 0x1800f4448
lea rdx, str.__rowid
test r13d, r13d
lea rcx, str.__parent
cmovne rcx, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov r8, r12
call fcn.1800f41f0
jmp 0x1800f4495
cmp eax, 0x64
jne 0x1800f4495
xor edx, edx
mov rcx, rdi
call sym.sqlite.dll_sqlite3_column_int64
cmp rax, rbp
je 0x1800f4495
lea rdx, str.__rowid
test r13d, r13d
mov qword [rsp + 0x30], rbp
lea rcx, str.__parent
mov qword [rsp + 0x28], r12
mov r9, rax
cmovne rcx, rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov r8, r12
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.1800f41f0
mov rcx, rdi
call sym.sqlite.dll_sqlite3_reset
cmp dword [rbx + 0x40], 0
jne 0x1800f44a6
mov dword [rbx + 0x40], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x1800f4640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov esi, edx
lea r8, [rsp + 0x30]
xor edi, edi
mov rdx, r9
mov rbp, r9
mov rbx, rcx
mov dword [rsp + 0x30], edi
call fcn.1800f4270
mov rdx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800f47e4
mov ecx, dword [rsp + 0x30]
cmp ecx, 4
jge 0x1800f46aa
mov r9d, ecx
lea rdx, str.Node__lld_is_too_small___d_bytes_
mov r8, rbp
mov rcx, rbx
call fcn.1800f41f0
mov rdx, qword [rsp + 0x38]
jmp 0x1800f47dc
mov r8, qword [rsp + 0x80]
test r8, r8
jne 0x1800f46e4
movzx esi, byte [rax]
movzx eax, byte [rax + 1]
shl esi, 8
add esi, eax
cmp esi, 0x28
jle 0x1800f46e4
lea rdx, str.Rtree_depth_out_of_range___d_
mov r8d, esi
mov rcx, rbx
call fcn.1800f41f0
mov rcx, qword [rsp + 0x38]
jmp 0x1800f47df
movzx eax, byte [rdx + 3]
movzx ebp, byte [rdx + 2]
shl ebp, 8
add ebp, eax
mov eax, dword [rbx + 0x1c]
inc eax
imul eax, ebp
lea eax, [rax*8 + 4]
cmp eax, ecx
jle 0x1800f472c
mov r8, qword [rsp + 0x88]
mov dword [rsp + 0x20], ecx
lea rdx, str.Node__lld_is_too_small_for_cell_count_of__d___d_bytes_
mov r9d, ebp
mov rcx, rbx
call fcn.1800f41f0
mov rdx, qword [rsp + 0x38]
jmp 0x1800f47dc
test ebp, ebp
jle 0x1800f47dc
nop word [rax + rax]
mov eax, dword [rbx + 0x1c]
mov qword [rsp + 0x20], r8
mov r8d, edi
inc eax
imul eax, edi
lea eax, [rax*8 + 4]
movsxd rcx, eax
mov rax, qword [rcx + rdx]
bswap rax
mov qword [rsp + 0x30], rax
lea rax, [rcx + rdx + 8]
mov rdx, qword [rsp + 0x88]
mov r9, rax
mov rcx, rbx
mov qword [rsp + 0x40], rax
call fcn.1800f44d0
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x30]
mov rcx, rbx
test esi, esi
jle 0x1800f47b8
xor edx, edx
call fcn.1800f4390
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea edx, [rsi - 1]
mov rcx, rbx
call fcn.1800f4640
inc dword [rbx + 0x3c]
jmp 0x1800f47c5
mov edx, 1
call fcn.1800f4390
inc dword [rbx + 0x38]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x80]
inc edi
cmp edi, ebp
jl 0x1800f4740
mov rcx, rdx
call sym.sqlite.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800f5780
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
movaps xmmword [rsp + 0x30], xmm6
mov r15d, r9d
mov r12, r8
mov r14, rcx
cmp dword [r8 + 0x18], ebx
je 0x1800f57fe
mov rbx, rdx
lea eax, [rdx*8]
sar rbx, 0x20
xor ebx, eax
xor ebx, edx
xor edx, edx
mov eax, ebx
div dword [r12 + 0x34]
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ebp, ebp
xor r13d, r13d
cmp dword [r8 + 0x10], ebx
jle 0x1800f57c4
xorpd xmm6, xmm6
lea rdi, [0x180145b30]
mov rax, qword [r12 + 0x28]
cmp byte [r13 + rax], 0
je 0x1800f597b
mov rcx, qword [r14 + 0x60]
lea r8, [rsp + 0x80]
mov edx, ebp
test r15d, r15d
je 0x1800f583e
call qword [r14 + 0x70]
jmp 0x1800f5842
call qword [r14 + 0x68]
test eax, eax
jne 0x1800f57d9
mov rcx, qword [rsp + 0x80]
movzx edx, word [rcx + 0x14]
mov eax, edx
and eax, 0x3f
movzx edi, byte [rax + rdi]
lea eax, [rbx*8]
xor eax, edi
xor ebx, eax
cmp edi, 1
je 0x1800f5952
cmp edi, 2
je 0x1800f58f9
cmp edi, 3
je 0x1800f589c
cmp edi, 4
je 0x1800f5895
mov rax, qword [rsp + 0x98]
mov dword [rax], 1
jmp 0x1800f5974
call sym.sqlite.dll_sqlite3_value_blob
jmp 0x1800f58a1
call sym.sqlite.dll_sqlite3_value_text
mov rcx, qword [rsp + 0x80]
mov rsi, rax
call sym.sqlite.dll_sqlite3_value_bytes
test rsi, rsi
jne 0x1800f58c7
cmp edi, 4
jne 0x1800f5990
test eax, eax
jg 0x1800f5990
xor edx, edx
movsxd r8, eax
test eax, eax
jle 0x1800f5974
nop word [rax + rax]
movzx ecx, byte [rdx + rsi]
lea eax, [rbx*8]
inc rdx
xor ecx, eax
xor ebx, ecx
cmp rdx, r8
jl 0x1800f58e0
jmp 0x1800f5974
test dl, 8
je 0x1800f590f
movsd xmm0, qword [rcx]
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f595a
test dl, 0x24
je 0x1800f592a
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rcx]
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f595a
test dl, 0x12
je 0x1800f5941
call fcn.180033b40
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f595a
movsd qword [rsp + 0x20], xmm6
mov rdx, qword [rsp + 0x20]
movapd xmm0, xmm6
jmp 0x1800f595a
call sym.sqlite.dll_sqlite3_value_int64
mov rdx, rax
lea ecx, [rbx*8]
xor ecx, edx
sar rdx, 0x20
xor ecx, ebx
lea ebx, [rcx*8]
xor ebx, edx
xor ebx, ecx
lea rdi, [0x180145b30]
inc ebp
inc r13
cmp ebp, dword [r12 + 0x10]
jl 0x1800f5814
jmp 0x1800f57c4
mov eax, 7
jmp 0x1800f57d9
Function at 0x1800f5aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
xor edi, edi
xor esi, esi
mov r13d, r9d
mov r11, r8
mov r12d, edx
mov rbp, rcx
cmp dword [rcx + 0x10], ebx
jle 0x1800f5c6b
mov qword [rsp + 0x58], r14
or r14d, 0xffffffff
nop word [rax + rax]
mov rax, qword [rbp + 0x28]
movzx ecx, byte [r11]
movzx edx, byte [rsi + rax]
test r12d, r12d
je 0x1800f5afb
test edx, edx
je 0x1800f5c58
jmp 0x1800f5b03
test edx, edx
je 0x1800f5c4a
lea eax, [rbx*8]
inc r11
xor eax, ecx
xor ebx, eax
cmp ecx, 1
je 0x1800f5bd3
cmp ecx, 2
je 0x1800f5bd3
movzx eax, byte [r11]
movzx edx, al
cmp al, 0x80
jae 0x1800f5b35
mov eax, 1
jmp 0x1800f5b9f
movzx ecx, byte [r11 + 1]
test cl, cl
js 0x1800f5b4a
and edx, 0x7f
mov al, 2
shl edx, 7
or edx, ecx
jmp 0x1800f5b9c
movzx eax, byte [r11 + 2]
shl edx, 0xe
or edx, eax
mov eax, edx
test dl, dl
js 0x1800f5b6d
and eax, 0x1fc07f
mov edx, ecx
and edx, 0x7f
shl edx, 7
or edx, eax
mov al, 3
jmp 0x1800f5b9c
movzx eax, byte [r11]
mov rcx, r11
test al, al
js 0x1800f5b84
movzx edx, al
mov al, 1
mov qword [rsp + 0x50], rdx
jmp 0x1800f5b93
lea rdx, [rsp + 0x50]
call fcn.1800117a0
mov rdx, qword [rsp + 0x50]
mov ecx, edx
cmp rcx, rdx
cmovne edx, r14d
movzx eax, al
movzx eax, al
mov r9d, edx
xor r8d, r8d
add r11, rax
test r9, r9
jle 0x1800f5bc8
movzx ecx, byte [r8 + r11]
lea eax, [rbx*8]
inc r8
xor ecx, eax
xor ebx, ecx
cmp r8, r9
jl 0x1800f5bb0
movsxd rax, edx
add r11, rax
jmp 0x1800f5c58
movzx eax, byte [r11 + 6]
movzx r8d, byte [r11 + 5]
movzx edx, byte [r11 + 1]
shl r8d, 8
shl edx, 8
lea ecx, [rbx*8]
or r8d, eax
movzx eax, byte [r11 + 4]
shl eax, 0x18
shl r8d, 8
or r8, rax
movzx eax, byte [r11 + 7]
or r8, rax
movzx eax, byte [r11 + 2]
or edx, eax
movzx eax, byte [r11]
shl eax, 0x18
shl edx, 8
or rdx, rax
movzx eax, byte [r11 + 3]
or rdx, rax
shl rdx, 0x20
add r8, rdx
xor ecx, r8d
xor ecx, ebx
mov rbx, r8
sar rbx, 0x20
lea eax, [rcx*8]
xor ebx, eax
xor ebx, ecx
add r11, 8
jmp 0x1800f5c58
mov rcx, r11
call fcn.1800f59a0
movsxd rcx, eax
add r11, rcx
inc edi
inc rsi
cmp edi, dword [rbp + 0x10]
jl 0x1800f5ae0
mov r14, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
xor edx, edx
div r13d
mov eax, edx
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800f7f30
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
cmp dword [r8 + 0x18], 0
mov rsi, rdx
mov r10, r9
mov r9, qword [r8 + 8]
lea rax, str._rowid___
mov ebp, ecx
mov rdi, r8
lea rdx, [0x1801518f4]
lea rcx, str.SELECT__s_FROM___w_.__w__WHERE_NOT_EXISTS____SELECT_1_FROM___w_.__w__WHERE__s_
cmovne rdx, rax
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rax
call sym.sqlite.dll_sqlite3_mprintf
mov r12, rax
test rax, rax
jne 0x1800f7fac
lea eax, [r12 + 7]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
xor r9d, r9d
or r8d, 0xffffffff
mov rdx, r12
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], 0
call fcn.180088380
mov ebx, eax
test eax, eax
jne 0x1800f8042
mov rcx, qword [rsi + 0x60]
mov rbx, qword [rsp + 0x70]
mov qword [rcx], rbx
mov dword [rcx + 0xc], eax
mov eax, dword [rdi + 0x18]
mov dword [rcx + 8], eax
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f8038
cmp dword [rdi + 0x18], 0
je 0x1800f8019
xor edx, edx
mov rcx, rbx
call sym.sqlite.dll_sqlite3_column_int64
jmp 0x1800f801b
xor eax, eax
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov ecx, ebp
call fcn.1800f75c0
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
je 0x1800f8007
mov rcx, rbx
call sym.sqlite.dll_sqlite3_finalize
mov ebx, eax
mov rcx, r12
call sym.sqlite.dll_sqlite3_free
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1800f8110
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [rdx + 0x28]
mov rdi, rdx
mov r12, r9
mov r9, qword [rdx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rdx + 0x20]
mov rdx, qword [rcx + 8]
mov rsi, rcx
mov ecx, dword [rdi + 0x10]
mov rbx, r8
mov qword [rsp + 0x20], rax
call fcn.1800f7e50
mov rbp, rax
test rax, rax
jne 0x1800f815f
lea eax, [rbp + 7]
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rsi + 8]
mov rdx, rdi
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], r14
call fcn.1800f8060
mov rdx, rdi
mov rcx, rbx
mov r13, rax
call fcn.1800f8060
mov rcx, qword [rdi + 8]
mov r9, qword [rsi + 8]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea rcx, str.SELECT__s__s_FROM___w_.__w_____w_.__w__WHERE__s_AND___z_
mov r8, rax
mov rdx, r13
mov r14, rax
call sym.sqlite.dll_sqlite3_mprintf
mov rbp, rax
test rax, rax
je 0x1800f8272
test r13, r13
je 0x1800f8272
test r14, r14
je 0x1800f8272
mov rcx, qword [rsi]
lea rax, [rsp + 0x80]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
xor r9d, r9d
or r8d, 0xffffffff
mov rdx, rbp
mov qword [rsp + 0x20], r12
call fcn.180088380
mov ebx, eax
test eax, eax
jne 0x1800f8277
mov rcx, qword [rsi + 0x60]
mov rbx, qword [rsp + 0x80]
mov qword [rcx], rbx
mov eax, dword [rdi + 0x10]
mov dword [rcx + 0xc], eax
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f8266
cmp dword [rdi + 0x18], r12d
je 0x1800f8243
xor edx, edx
mov rcx, rbx
call sym.sqlite.dll_sqlite3_column_int64
jmp 0x1800f8246
mov rax, r12
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov ecx, 0x17
call fcn.1800f75c0
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
je 0x1800f8231
mov rcx, rbx
call sym.sqlite.dll_sqlite3_finalize
mov ebx, eax
jmp 0x1800f8277
mov ebx, 7
mov rcx, rbp
call sym.sqlite.dll_sqlite3_free
mov rcx, r13
call sym.sqlite.dll_sqlite3_free
mov rcx, r14
call sym.sqlite.dll_sqlite3_free
mov r14, qword [rsp + 0x90]
mov r13, qword [rsp + 0x88]
mov eax, ebx
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180106030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
movsxd rsi, r9d
mov r12, r8
lea eax, [rsi - 1]
mov r14d, edx
lea r11d, [rbp + 0xd]
movsxd r10, eax
test eax, eax
js 0x180106078
nop
movsx r9d, byte [r10 + r8]
lea eax, [r11*8]
xor r9d, eax
xor r11d, r9d
dec r10
jns 0x180106060
lea eax, [r11*8]
xor eax, r11d
xor eax, edx
and eax, 0x1ff
mov r15d, eax
mov rbx, qword [rcx + rax*8]
test rbx, rbx
je 0x1801060bc
cmp dword [rbx + 0xc], r14d
jne 0x1801060b3
cmp dword [rbx + 8], esi
jne 0x1801060b3
mov rcx, qword [rbx]
mov r8, rsi
mov rdx, r12
call fcn.180137900
test eax, eax
je 0x1801060d8
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x180106096
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r13
lea rdi, [rsi + 0x18]
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
je 0x1801060eb
mov rbx, rbp
jmp 0x18010614d
mov rcx, qword [rsp + 0x80]
mov dword [rcx], 1
jmp 0x18010619f
test rdi, rdi
je 0x180106145
cmp rdi, 0x7ffffeff
ja 0x180106145
cmp dword [0x180172920], ebp
je 0x180106138
mov rcx, qword [0x1801821a8]
test rcx, rcx
je 0x180106113
call qword [0x1801729a0]
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.18000bd10
mov rcx, qword [0x1801821a8]
test rcx, rcx
je 0x180106131
call qword [0x1801729b0]
mov rbx, qword [rsp + 0x20]
jmp 0x180106148
mov ecx, edi
call qword [0x180172940]
mov rbx, rax
jmp 0x180106148
mov rbx, rbp
test rbx, rbx
jne 0x180106159
test rdi, rdi
jle 0x180106166
mov ebp, 7
jmp 0x180106166
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.18012e4b0
mov rdi, qword [rsp + 0x68]
test rbx, rbx
je 0x18010619a
lea rcx, [rbx + 0x18]
mov r8, rsi
mov rdx, r12
mov dword [rbx + 8], esi
mov dword [rbx + 0xc], r14d
mov qword [rbx], rcx
call fcn.180128740
mov r10, qword [rsp + 0x60]
mov r11, qword [r10 + r15*8]
mov qword [rbx + 0x10], r11
mov qword [r10 + r15*8], rbx
mov r13, qword [rsp + 0x70]
mov eax, ebp
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret