joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c9d0
Capabilities:
Create directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea eax, [rdx - 2]
mov rsi, rcx
mov ebx, edx
mov r15, r8
cmp eax, 2
ja 0x14000cae0
mov rcx, qword [r8]
call sym.sqlite3_value_text
mov rdi, rax
test rax, rax
je 0x14000ca30
cmp ebx, 2
jne 0x14000ca48
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r8, qword [r15 + 8]
xor r9d, r9d
mov rdx, rax
mov rcx, rsi
call sym.writeFile
cmp eax, 1
je 0x14000cb08
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [r15 + 0x10]
call sym.sqlite3_value_int
mov qword [rsp + 0x38], 0xffffffffffffffff
mov word [rsp + 0x42], ax
mov ebp, eax
cmp ebx, 4
je 0x14000cb30
mov rax, qword [rsp + 0x38]
movzx ebp, bp
mov rdx, rdi
mov rcx, rsi
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov r8, qword [r15 + 8]
call sym.writeFile
cmp eax, 1
je 0x14000cb1a
test eax, eax
setne al
cmp ebx, 2
jle 0x14000ca30
test al, al
je 0x14000ca30
movzx r12d, word [rsp + 0x42]
mov r8, rdi
lea rdx, str.failed_to_create_directory:__s
and r12w, 0xf000
cmp r12w, 0x4000
je 0x14000cac5
lea rdx, str.failed_to_write_file:__s
mov rcx, rsi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.ctxErrorMsg
mov r8d, 0xffffffff
lea rdx, str.wrong_number_of_arguments_to_function_writefile__
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3_result_error
mov qword [rsp + 0x38], 0xffffffffffffffff
xor eax, eax
xor ebp, ebp
mov word [rsp + 0x42], ax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 2
je 0x14000cb48
mov eax, 1
jmp 0x14000ca97
mov rcx, qword [r15 + 0x18]
call sym.sqlite3_value_int64
mov qword [rsp + 0x38], rax
jmp 0x14000ca6a
mov rdx, rdi
lea rcx, [0x1401509b2]
call sym.sqlite3_mprintf
mov r14, rax
test rax, rax
je 0x14000cb25
mov rcx, rax
mov r12d, 1
call sym.strlen
mov qword [rsp + 0x48], r15
mov r13d, eax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x44], ebp
mov ebp, r13d
mov r13, rax
nop dword [rax]
movsxd rax, r12d
lea r15, [r14 + rax]
cmp byte [r15], 0x2f
je 0x14000cbb6
lea rax, [r14 + rax + 1]
jmp 0x14000cbb1
mov r15, rax
add r12d, 1
add rax, 1
cmp byte [r15], 0x2f
je 0x14000cbb6
cmp ebp, r12d
jg 0x14000cba0
cmp ebp, r12d
je 0x14000cc20
mov byte [r15], 0
mov rdx, r13
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64]
test eax, eax
je 0x14000cc00
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
test eax, eax
setne al
movzx eax, al
mov byte [r15], 0x2f
add r12d, 1
test eax, eax
je 0x14000cb88
mov rcx, r14
call sym.sqlite3_free
jmp 0x14000cb25
mov rdx, r13
mov rcx, r14
call sym.statTimesToUtc
movzx eax, word [rsp + 0x56]
and ax, 0xf000
cmp ax, 0x4000
setne al
movzx eax, al
jmp 0x14000cbe0
mov rcx, r14
mov ebp, dword [rsp + 0x44]
mov r15, qword [rsp + 0x48]
call sym.sqlite3_free
mov rax, qword [rsp + 0x38]
mov rdx, rdi
mov rcx, rsi
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov r8, qword [r15 + 8]
call sym.writeFile
jmp 0x14000ca92
Function at 0x14000d350
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
call sym.clearTempFile
mov rcx, qword [rbx + 0x98]
call sym.sqlite3_free
mov rcx, qword [rbx]
mov qword [rbx + 0x98], 0
test rcx, rcx
je 0x14000d3c8
xor edx, edx
lea r9, [rbx + 0x98]
mov r8d, 0x10
call sym.sqlite3_file_control
mov rdx, qword [rbx + 0x98]
test rdx, rdx
je 0x14000d3c8
mov r8, rsi
lea rcx, str._z._s
call sym.sqlite3_mprintf
mov qword [rbx + 0x98], rax
test rax, rax
je 0x14000d42f
add rsp, 0x38
pop rbx
pop rsi
ret
lea rdx, [rsp + 0x28]
mov ecx, 8
call sym.sqlite3_randomness
lea rcx, str.TEMP
call sym.getenv
mov rdx, rax
test rax, rax
je 0x14000d410
mov r8, qword [rsp + 0x28]
mov r9, rsi
lea rcx, str._s_temp_llx._s
call sym.sqlite3_mprintf
mov qword [rbx + 0x98], rax
jmp 0x14000d3b6
lea rcx, [0x140151148]
call sym.getenv
mov rdx, rax
test rax, rax
lea rax, str._tmp
cmove rdx, rax
jmp 0x14000d3eb
call sym.shell_out_of_memory
nop
nop word cs:[rax + rax]

Function at 0x14000d820
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, qword [0x14014a810]
mov rsi, rcx
mov dword [rsp + 0x28], 0xffff0000
mov edi, edx
lea rcx, [0x14014a800]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x30], 0xffffffffffffffff
cmp rbp, 0xffffffffffffffff
je 0x14000d880
cmp qword [rcx], 0xffffffffffffffff
je 0x14000d8b5
mov r8d, edi
mov rdx, rsi
call sym.conZstrEmit
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
sub rcx, 0x48
cmp qword [0x14014a7c8], 0xffffffffffffffff
jne 0x14000d863
mov ecx, 1
lea rbx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rbx
mov rcx, rax
mov rbp, rax
call sym.streamOfConsole
mov rcx, rbx
cmp qword [rcx], 0xffffffffffffffff
jne 0x14000d869
mov r9, rbp
movsxd r8, edi
mov edx, 1
mov rcx, rsi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.fwrite

Function at 0x14000f5b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x50], r8
mov rcx, rdx
mov qword [rsp + 0x58], r9
cmp byte [rbx + 0x11], 0
jne 0x14000f5d1
add rsp, 0x30
pop rbx
ret
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], rdx
call sym.sqlite3_vmprintf
mov edx, dword [rbx + 0x30]
lea rcx, str.line__d:__s_n
mov r8, rax
call sym.ePrintfUtf8
mov ecx, 1
call sym.exit
nop
nop dword [rax]
Function at 0x14000fb30
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, rdx
lea rdx, [0x1401508f1]
mov rdi, rcx
call sym.fopen
mov rbx, rax
test rax, rax
je 0x14000fbff
xor edx, edx
mov r8d, 2
mov rcx, rax
call sym.fseek
test eax, eax
jne 0x14000fbe8
mov rcx, rbx
call sym.ftell
mov rcx, rbx
mov r12d, eax
call sym.rewind
lea ecx, [r12 + 1]
movsxd rcx, ecx
call sym.sqlite3_malloc64
mov rsi, rax
test rax, rax
je 0x14000fc28
movsxd r14, r12d
mov rcx, rax
mov r9, rbx
mov r8d, 1
mov rdx, r14
call sym.fread
mov rcx, rbx
mov r13, rax
call sym.fclose
cmp r13, 1
jne 0x14000fc08
mov byte [rsi + r14], 0
test rbp, rbp
je 0x14000fbd2
mov dword [rbp], r12d
mov rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rcx, str.Error:__s_not_seekable_n
mov rdx, rdi
call sym.ePrintfUtf8
mov rcx, rbx
call sym.fclose
xor esi, esi
jmp 0x14000fbd2
mov rcx, rsi
xor esi, esi
call sym.sqlite3_free
mov rdx, rdi
lea rcx, str.Error:_cannot_read__s_n
call sym.ePrintfUtf8
jmp 0x14000fbd2
lea rcx, str.Error:_out_of_memory_n
xor esi, esi
call sym.ePutsUtf8.isra.0
mov rcx, rbx
call sym.fclose
jmp 0x14000fbd2
Function at 0x140010b50
Capabilities:
Execute command

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x138], 0x7c
mov rsi, qword [rcx + 0x40]
mov rbx, rcx
je 0x140010c60
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test rsi, rsi
je 0x140010ba0
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 1
call rdi
cmp rsi, rax
je 0x140010ba0
mov ecx, 2
call rdi
cmp rsi, rax
je 0x140010ba0
mov rcx, rsi
call sym.fclose
nop
cmp byte [rbx + 0xe], 0
jne 0x140010bd0
mov byte [rbx + 0x138], 0
mov ecx, 1
call rdi
mov ecx, 1
mov qword [rbx + 0x40], rax
call rdi
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.designateEmitStream.constprop.0
mov r8, qword [rbx + 0x98]
lea rcx, [0x140152176]
lea rdx, str.start
call sym.sqlite3_mprintf
mov rcx, rax
mov rsi, rax
call sym.system
test eax, eax
jne 0x140010c78
mov ecx, 0x7d0
call sym.sqlite3_sleep
mov rcx, rsi
call sym.sqlite3_free
mov eax, dword [rbx + 0x58]
mov byte [rbx + 0xe], 0
movdqu xmm0, xmmword [rbx + 0xe6]
movdqu xmm1, xmmword [rbx + 0xfa]
mov dword [rbx + 0x54], eax
mov eax, dword [rbx + 0x80]
movups xmmword [rbx + 0xbe], xmm0
mov dword [rbx + 0x7c], eax
mov eax, dword [rbx + 0xf6]
movups xmmword [rbx + 0xd2], xmm1
mov dword [rbx + 0xce], eax
mov eax, dword [rbx + 0x10a]
mov dword [rbx + 0xe2], eax
jmp 0x140010ba6
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__pclose]
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
jmp 0x140010ba6
mov rdx, rsi
lea rcx, str.Failed:___s__n
call sym.ePrintfUtf8
jmp 0x140010c03
Function at 0x1400122e0
Capabilities:
Reference sql statements

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, qword [rcx]
mov rbp, qword [rdi + 0x20]
mov rbx, rcx
mov rcx, qword [rcx + 8]
call sym.sqlite3_finalize
mov qword [rbx + 8], 0
mov esi, eax
test eax, eax
je 0x140012318
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rax, qword [rdi + 0x18]
mov rcx, qword [rbp + 8]
lea rdx, [rbx + 8]
lea r8, [rdi + 0x10]
lea r9, str.SELECT__FROM_main._Q_WHERE_sample__
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
call sym.idxPrintfPrepareStmt
mov esi, eax
test eax, eax
jne 0x140012309
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140012370
call sym.sqlite3_step
cmp eax, 0x64
je 0x140012309
mov rcx, qword [rbx + 8]
call sym.sqlite3_finalize
mov qword [rbx + 8], 0
mov esi, eax
jmp 0x140012309
lea rcx, str.pCsr__pData
mov r8d, 0x3085
lea rdx, str.shell.c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
mov rcx, qword [rbx + 8]
jmp 0x14001234c
Function at 0x140014b00
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rbp, rcx
mov edi, edx
call sym.sqlite3_user_data
mov rcx, qword [rsi]
mov rbx, rax
call sym.sqlite3_value_int64
mov rsi, rax
cmp edi, 1
je 0x140014b46
mov r8d, 0x3e23
lea rdx, str.shell.c
lea rcx, str.nArg1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
test rsi, rsi
je 0x140014be0
mov rdi, qword [rbx + 0x138]
test rdi, rdi
je 0x140014c58
mov ecx, dword [rbx + 0x60]
test ecx, ecx
jne 0x140014bb0
mov rcx, rdi
mov r8, rsi
mov edx, 1
call sym.sqlite3_bind_int64
mov rcx, rdi
call sym.sqlite3_step
cmp eax, 0x64
je 0x140014c08
mov rdx, rdi
mov rcx, rbx
call sym.recoverReset.isra.0
mov eax, dword [rbx + 0x60]
test eax, eax
jne 0x140014bb0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [rbx + 0x68]
test rdx, rdx
je 0x140014bc7
mov r8d, 0xffffffff
mov rcx, rbp
call sym.sqlite3_result_error
mov edx, dword [rbx + 0x60]
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.sqlite3_result_error_code
mov r8d, dword [rbx + 0x60]
test r8d, r8d
je 0x140014c90
mov rdx, rsi
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.sqlite3_result_int64
mov edx, dword [rbx + 0x60]
test edx, edx
jne 0x140014cc8
xor edx, edx
mov rcx, rdi
call sym.sqlite3_column_blob
xor edx, edx
mov rcx, rdi
mov r13, rax
call sym.sqlite3_column_bytes
mov r12d, eax
cmp rsi, 1
je 0x140014ca0
mov r8d, r12d
mov r9, 0xffffffffffffffff
mov rdx, r13
mov rcx, rbp
sub r8d, dword [rbx + 0x4c]
call sym.sqlite3_result_blob
jmp 0x140014b87
mov rdx, qword [rbx]
mov r9, qword [rbx + 8]
lea r8, str.SELECT_data_FROM_sqlite_dbpage__Q__WHERE_pgno_
mov rcx, rbx
call sym.recoverPreparePrintf
mov qword [rbx + 0x138], rax
mov rdi, rax
test rax, rax
je 0x140014b92
jmp 0x140014b66
mov rcx, rbx
call sym.recoverPageCount.part.0
mov rsi, rax
jmp 0x140014bed
cmp dword [rbx + 0x44], eax
jne 0x140014c33
mov rcx, qword [rbx + 0x58]
movsxd r8, eax
mov rdx, r13
call sym.memcmp
test eax, eax
jne 0x140014c33
mov r13, qword [rbx + 0x50]
jmp 0x140014c33
mov r8d, 0x3e36
lea rdx, str.shell.c
lea rcx, str.p__errCodeSQLITE_OK
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
jmp 0x140014c13
Function at 0x140014cf0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
pxor xmm0, xmm0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rcx + 0x28]
movups xmmword [rbx], xmm0
mov rsi, rcx
mov rbp, r9
test rdx, rdx
je 0x140014dc0
mov eax, 0x10000
cmp r8d, eax
cmovle eax, r8d
sub r8d, eax
movsxd r8, r8d
lea rdi, [rdx + r8]
sub eax, 0x14
js 0x140014da8
movsxd rdx, eax
add rdx, rdi
jmp 0x140014d4c
sub eax, 1
sub rdx, 1
cmp eax, 0xffffffff
je 0x140014da8
cmp byte [rdx], 0x50
jne 0x140014d40
cmp byte [rdx + 1], 0x4b
jne 0x140014d40
cmp byte [rdx + 2], 5
jne 0x140014d40
cmp byte [rdx + 3], 6
jne 0x140014d40
add eax, 4
cdqe
add rdi, rax
movzx eax, word [rdi]
mov word [rbx], ax
movzx eax, word [rdi + 2]
mov word [rbx + 2], ax
movzx eax, word [rdi + 4]
mov word [rbx + 4], ax
movzx eax, word [rdi + 6]
mov word [rbx + 6], ax
mov eax, dword [rdi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rdi + 0xc]
mov dword [rbx + 0xc], eax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, str.cannot_find_end_of_central_directory_record
call sym.sqlite3_mprintf
mov qword [rsi + 0x10], rax
mov eax, 1
jmp 0x140014d97
mov rcx, r9
mov r8d, 2
call sym.fseek
mov rcx, rbp
call sym.ftell
test eax, eax
je 0x140014d95
mov r12d, 0x10000
mov rcx, rbp
cmp eax, r12d
cmovle r12d, eax
xor r8d, r8d
sub eax, r12d
mov edx, eax
call sym.fseek
mov r9, rbp
movsxd r8, r12d
mov edx, 1
mov rcx, rdi
call sym.fread
cmp r12d, eax
je 0x140014d2f
lea rcx, str.error_in_fread__
call sym.sqlite3_mprintf
mov qword [rsi + 0x10], rax
jmp 0x140014db8
Function at 0x1400152a0
Capabilities:
Reference sql statements

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov esi, dword [rcx + 8]
mov dword [rsp + 0x34], 0
mov rbp, rcx
test esi, esi
je 0x1400153fe
cmp byte [rcx + 5], 0
lea rax, str.SELECT_name_FROM__s_WHERE_glob__name_name_
mov rcx, qword [rcx + 0x38]
lea r9, str.SELECT_name_FROM__s_WHERE_name_name
cmovne r9, rax
mov rax, qword [rbp + 0x10]
lea rdx, [rsp + 0x34]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rax
call sym.shellPreparePrintf
mov rcx, qword [rsp + 0x38]
lea rdx, str._name
call sym.sqlite3_bind_parameter_index
mov esi, dword [rsp + 0x34]
mov edi, eax
mov eax, dword [rbp + 8]
test eax, eax
jle 0x14001542c
test esi, esi
jne 0x14001542c
xor r12d, r12d
nop dword [rax]
mov rax, qword [rbp + 0x28]
mov rbx, qword [rax + r12*8]
cmp byte [rbx], 0
mov rax, rbx
je 0x140015374
add rax, 1
cmp byte [rax], 0
jne 0x140015340
sub rax, rbx
and eax, 0x3fffffff
je 0x140015458
cdqe
jmp 0x14001536a
sub rax, 1
je 0x140015458
cmp byte [rbx + rax - 1], 0x2f
je 0x140015360
add rax, rbx
mov byte [rax], 0
mov rcx, qword [rsp + 0x38]
mov r9d, 0xffffffff
mov edx, edi
mov qword [rsp + 0x20], 0
mov r8, rbx
call sym.sqlite3_bind_text
mov rcx, qword [rsp + 0x38]
call sym.sqlite3_step
mov r14, qword [rsp + 0x38]
mov r13d, eax
mov rcx, r14
call sym.sqlite3_reset
mov esi, eax
test eax, eax
jne 0x140015460
mov dword [rsp + 0x34], 0
cmp r13d, 0x64
jne 0x140015410
add r12, 1
cmp dword [rbp + 8], r12d
jg 0x140015330
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1400153fe
mov rcx, rbx
call sym.sqlite3_db_handle
mov rcx, rbx
mov rdi, rax
call sym.sqlite3_finalize
mov ebx, eax
test ebx, ebx
jne 0x140015485
mov esi, ebx
mov eax, esi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, rbx
lea rcx, str.not_found_in_archive:__s_n
mov esi, 1
call sym.ePrintfUtf8
mov dword [rsp + 0x34], 1
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1400153fe
mov rcx, rbx
call sym.sqlite3_db_handle
mov rcx, rbx
mov rdi, rax
call sym.sqlite3_finalize
mov ebx, eax
test esi, esi
jne 0x1400153fe
jmp 0x1400153f4
mov rax, rbx
jmp 0x140015374
mov rcx, r14
call sym.sqlite3_db_handle
mov rcx, rax
call sym.sqlite3_errmsg
lea rcx, str.SQL_error:__s_n
mov rdx, rax
call sym.ePrintfUtf8
mov dword [rsp + 0x34], esi
jmp 0x14001542c
mov rcx, rdi
mov esi, ebx
call sym.sqlite3_errmsg
lea rcx, str.SQL_error:__s_n
mov rdx, rax
call sym.ePrintfUtf8
jmp 0x1400153fe
Function at 0x14001f620
Capabilities:
Reference sql statements

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r8d, 0xffffffff
lea r15, [sym.dummyUDF]
mov qword [rsp + 0x20], 0
mov r12, rdx
lea r9, [rsp + 0x58]
lea rdx, str.SELECT_name_type_enc_narg_flags_FROM_pragma_function_list___WHERE_builtin0
call sym.sqlite3_prepare_v2
mov r13d, eax
test eax, eax
je 0x14001f678
mov eax, r13d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x58]
call sym.sqlite3_step
mov ebx, eax
cmp eax, 0x64
jne 0x14001f791
mov rcx, qword [rsp + 0x58]
mov edx, 3
call sym.sqlite3_column_int
mov rcx, qword [rsp + 0x58]
mov edx, 4
mov ebp, eax
call sym.sqlite3_column_int
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov ebx, eax
call sym.sqlite3_column_text
mov rcx, qword [rsp + 0x58]
mov edx, 1
mov rdi, rax
call sym.sqlite3_column_text
mov rcx, qword [rsp + 0x58]
mov edx, 2
mov rsi, rax
call sym.sqlite3_column_text
test rdi, rdi
mov r14, rax
sete al
test rsi, rsi
sete dl
or al, dl
jne 0x14001f678
test r14, r14
je 0x14001f678
lea rdx, [0x140154e75]
mov rcx, r14
call sym.strcmp
mov edx, eax
mov eax, 2
test edx, edx
je 0x14001f72b
lea rdx, [0x140154e7d]
mov rcx, r14
call sym.strcmp
cmp eax, 1
sbb eax, eax
and eax, 2
add eax, 1
and ebx, 0x80800
or ebx, eax
movzx eax, byte [rsi]
mov r9d, ebx
cmp eax, 0x77
jne 0x14001f7b0
cmp byte [rsi + 1], 0
jne 0x14001f7b0
lea rax, [sym.dummyUDFvalue]
mov r8d, ebp
mov rdx, rdi
mov rcx, r12
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
call sym.sqlite3_create_window_function
mov ebx, eax
test ebx, ebx
je 0x14001f678
mov rcx, qword [rsp + 0x58]
call sym.sqlite3_finalize
cmp ebx, 0x65
cmovne r13d, ebx
jmp 0x14001f661
cmp eax, 0x61
jne 0x14001f7f0
cmp byte [rsi + 1], 0
jne 0x14001f7f0
lea rax, [sym.dummyUDFvalue]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8d, ebp
mov rdx, rdi
mov rcx, r12
call sym.sqlite3_create_function
mov ebx, eax
jmp 0x14001f789
cmp eax, 0x73
je 0x14001f810
mov rcx, qword [rsp + 0x58]
mov r13d, 1
call sym.sqlite3_finalize
jmp 0x14001f661
cmp byte [rsi + 1], 0
jne 0x14001f7f5
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], r15
jmp 0x14001f7d5
Function at 0x1400231b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov edi, edx
lea rdx, [0x1401508f1]
mov rsi, rcx
call sym.fopen
mov rbx, rax
test rax, rax
je 0x1400232f0
lea rbp, [rsp + 0x20]
mov r9, rax
mov r8d, 1
mov edx, 0x10
mov rcx, rbp
call sym.fread
cmp rax, 1
jne 0x140023220
movabs rax, 0x332074616d726f
xor rax, qword [rsp + 0x28]
movabs rdx, 0x66206574694c5153
xor rdx, qword [rsp + 0x20]
or rax, rdx
je 0x140023320
mov r8d, 2
mov edx, 0xffffffe7
mov rcx, rbx
call sym.fseek
mov r9, rbx
mov edx, 0x19
mov rcx, rbp
mov r8d, 1
call sym.fread
cmp rax, 1
jne 0x140023276
movabs rax, 0x336574694c51532d
xor rax, qword [rsp + 0x28]
movabs rdx, 0x664f2d7472617453
xor rdx, qword [rsp + 0x20]
or rax, rdx
je 0x140023330
mov r8d, 2
mov edx, 0xffffffea
mov rcx, rbx
call sym.fseek
mov r9, rbx
mov edx, 0x16
mov rcx, rbp
mov r8d, 1
call sym.fread
cmp rax, 1
je 0x1400232d0
test rax, rax
jne 0x1400232d7
test edi, edi
je 0x1400232d7
xor r8d, r8d
mov rdx, rsi
lea rcx, str._.zip
call sym.sqlite3_strlike
test eax, eax
jne 0x1400232d7
mov esi, 3
jmp 0x1400232d9
cmp byte [rsp + 0x20], 0x50
je 0x140023348
xor esi, esi
mov rcx, rbx
call sym.fclose
mov eax, esi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
test edi, edi
jne 0x140023300
mov esi, 1
jmp 0x1400232e1
mov rdx, rsi
xor r8d, r8d
lea rcx, str._.zip
mov esi, 3
call sym.sqlite3_strlike
test eax, eax
jne 0x1400232f4
jmp 0x1400232e1
mov rcx, rbx
call sym.fclose
jmp 0x1400232f4
cmp byte [rsp + 0x30], 0x2d
jne 0x140023276
mov esi, 2
jmp 0x1400232d9
cmp byte [rsp + 0x21], 0x4b
jne 0x1400232d7
cmp byte [rsp + 0x22], 5
jne 0x1400232d7
cmp byte [rsp + 0x23], 6
jne 0x1400232d7
jmp 0x1400232c4
Function at 0x1400331d0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x140033200
mov edx, edx
xor eax, eax
lea r9, [rcx + rdx]
nop dword [rax]
movsx r8d, byte [rcx]
lea edx, [rax*8]
add rcx, 1
xor edx, r8d
xor eax, edx
cmp r9, rcx
jne 0x1400331e0
and eax, 0x7fffffff
ret
xor eax, eax
ret

Function at 0x140036c70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
jle 0x140036cc0
mov r8, rbx
xor eax, eax
nop dword [rax]
movsx r10d, byte [r8]
lea r9d, [rax*8]
add r8, 1
xor r9d, r10d
xor eax, r9d
mov r9d, ebx
sub r9d, r8d
add r9d, edx
test r9d, r9d
jg 0x140036c88
and eax, 0x7fffffff
add rsp, 0x20
pop rbx
ret
call sym.strlen
mov rcx, rax
mov edx, eax
xor eax, eax
test ecx, ecx
jg 0x140036c7c
add rsp, 0x20
pop rbx
ret

Function at 0x140039610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
mov ebx, edx
cmp ecx, 0x7f
jg 0x140039630
lea edx, [rcx - 0x41]
lea eax, [rcx + 0x20]
cmp edx, 0x1a
cmovae eax, ecx
pop rbx
ret
cmp ecx, 0xffff
jg 0x1400396e0
mov edx, 0x3f1
mov r11, 0xffffffffffffffff
xor r8d, r8d
mov r9d, 0xa2
mov eax, 0xa2
lea r10, [0x14016ac00]
jmp 0x14003967c
lea r8d, [rax + 1]
movsxd r11, eax
cmp r9d, r8d
jl 0x14003968b
lea eax, [r9 + r8]
mov edx, eax
sar edx, 1
movsxd rdx, edx
movzx edx, word [r10 + rdx*4]
sar eax, 1
cmp ecx, edx
jge 0x140039660
lea r9d, [rax - 1]
cmp r9d, r8d
jge 0x14003966c
movzx edx, word [r10 + r11*4]
movzx eax, byte [r10 + r11*4 + 3]
add eax, edx
cmp ecx, eax
jge 0x1400396c3
movzx eax, byte [r10 + r11*4 + 2]
xor edx, ecx
mov r8d, eax
and r8d, 1
test r8d, edx
jne 0x1400396c3
shr al, 1
lea rdx, [0x14016a620]
and eax, 0x7f
add cx, word [rdx + rax*2]
movzx ecx, cx
mov eax, ecx
test ebx, ebx
je 0x140039624
xor edx, edx
cmp ebx, 2
sete dl
pop rbx
jmp sym.remove_diacritic
lea edx, [rcx - 0x10400]
lea eax, [rcx + 0x28]
cmp edx, 0x28
cmovae eax, ecx
pop rbx
ret
Function at 0x1400400d0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
lea rbp, [rsp + 0x20]
movsxd r8, edx
mov edi, edx
mov rcx, rsi
xor edx, edx
call sym.memset
mov rcx, rbp
call qword [sym.GetSystemTime]
mov rdx, rbp
lea r9, [rsp + 0x30]
xor r8d, r8d
nop word [rax + rax]
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp rdx, r9
jne 0x140040110
call qword [sym.GetCurrentProcessId]
lea r12, [rsp + 0x24]
mov rdx, rbp
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp rdx, r12
jne 0x140040140
call qword [sym.GetTickCount]
mov rdx, rbp
xor r8d, r8d
mov dword [rsp + 0x20], eax
nop dword [rax + rax]
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp rdx, r12
jne 0x140040170
mov rcx, rbp
call qword [sym.QueryPerformanceCounter]
mov rax, rbp
lea r9, [rsp + 0x28]
xor r8d, r8d
nop
lea edx, [rbx + 1]
movzx ecx, byte [rax]
xor byte [rsi + rbx], cl
cmp edi, edx
cmovle edx, r8d
add rax, 1
movsxd rbx, edx
cmp r9, rax
jne 0x1400401a0
mov eax, 0x20
cmp edi, eax
cmovle eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140040cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor r8d, r8d
movsxd r10, edx
movzx eax, byte [rcx + r10 - 1]
sub eax, 0x77
cmp al, 2
jbe 0x140040d65
test edx, edx
jle 0x140040d65
add r10, rcx
xor r9d, r9d
mov r11d, 0x104111
jmp 0x140040d35
cmp dl, 0x79
sete al
add rcx, 1
and eax, r9d
xor eax, 1
movzx r9d, al
lea r8d, [r9 + r8*2]
cmp rcx, r10
je 0x140040d55
movzx edx, byte [rcx]
lea eax, [rdx - 0x61]
cmp al, 0x14
ja 0x140040d18
bt r11, rax
jae 0x140040d18
xor r9d, r9d
add rcx, 1
lea r8d, [r9 + r8*2]
cmp rcx, r10
jne 0x140040d35
and r8d, 7
cmp r8d, 5
sete r8b
movzx r8d, r8b
mov eax, r8d
ret