joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001cdc0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x18001cdc0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18001cf72
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.180004999
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18001cf31
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop word [rax + rax]
mov rcx, qword [rcx]
movzx r9d, byte [rax + 0x10]
xor r9, rbp
imul r9, rdi
movzx edx, byte [rax + 0x11]
xor r9, rdx
imul r9, rdi
movzx edx, byte [rax + 0x12]
xor r9, rdx
imul r9, rdi
movzx edx, byte [rax + 0x13]
xor r9, rdx
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18001ceb0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18001cf25
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18001ceed
mov r10, qword [rdx]
cmp r10, rax
je 0x18001cee7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18001cf25
cmp r9, rdx
je 0x18001cf01
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18001cf4c
cmp r9, rdx
jne 0x18001cef2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18001ce60
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18001cf25
lea rcx, str.invalid_hash_bucket_count
call fcn.180004741
int3
Function at 0x18006fef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x68
movzx eax, byte [rdx]
mov r14, rdx
mov rdi, rcx
cmp al, 0xb0
jne 0x18006ff09
movzx eax, byte [rdx + 2]
cmp al, 0xb1
jne 0x18006ff13
mov rcx, qword [rdx + 0x20]
jmp 0x18006ff23
cmp al, 0x8a
jne 0x1800700a7
mov rax, qword [rdx + 0x20]
mov rcx, qword [rax + 0x20]
movsxd rcx, dword [rcx]
cmp ecx, 1
je 0x1800700a7
mov dword [r8], 0
cmp byte [rdx], 0x8a
jne 0x18006ff4a
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.180108b00
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x180070092
mov qword [rsp + 0x80], rbx
lea rcx, [0x180156fe0]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r15
lea r13, [fcn.180071760]
xor r15d, r15d
mov qword [rsp + 0x98], rsi
lea edx, [r15 + 2]
nop dword [rax + rax]
cmp byte [rdi + 0x23], 0
mov rax, qword [r14 + 0x20]
mov rbx, qword [r15 + rax + 8]
je 0x180070000
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x18006fff0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180174600
cmp word [rsp + 0x44], 0
je 0x180070000
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1801145c0
jmp 0x180070040
mov rsi, qword [rdi]
test rbx, rbx
je 0x18007001c
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.1800704a0
mov rbx, rax
cmp byte [rsi + 0x67], 0
jne 0x180070030
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1801124c0
test rbx, rbx
je 0x180070040
mov rdx, rbx
mov rcx, rsi
call fcn.180117370
inc ebp
lea rcx, [0x180156fe0]
add r15, 0x20
mov edx, 2
sub r12, 1
jne 0x18006ffb0
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x88]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.1801167a0
Function at 0x18009ef00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
movsxd rdi, r8d
mov rbp, rdx
mov rsi, rdi
mov qword [rsp + 0x38], r13
shl rsi, 5
mov rbx, rcx
add rsi, rdx
mov qword [rsp + 0x88], rdi
mov r13d, dword [rsi + 0x10]
cmp r13d, dword [rsi + 0x18]
jg 0x18009ef48
mov dword [rsi + 0x14], 1
jmp 0x18009f00c
mov rbx, qword [rsi + 8]
lea rdx, [rsi + 0x1c]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov r12, qword [rbx]
mov dword [rsi + 0x10], 1
mov rcx, qword [rbx]
inc rcx
call fcn.18012b1b0
add dword [rsi + 0x10], eax
lea rdx, [rsi + 0x20]
movsxd rcx, dword [rsi + 0x10]
add rcx, qword [rbx]
call fcn.18012af40
movzx ebx, al
add ebx, dword [rsi + 0x10]
mov dword [rsi + 0x18], ebx
xor edi, edi
movsxd rcx, ebx
add rcx, r12
mov dword [rsi + 0x10], ebx
mov qword [rsp + 0x78], rdi
cmp byte [rcx], dil
jne 0x18009efbd
nop word [rax + rax]
inc edi
lea rcx, [rcx + 1]
inc ebx
cmp byte [rcx], 0
je 0x18009efb0
movsxd rcx, ebx
lea rdx, [rsp + 0x78]
add rcx, r12
call fcn.18012af40
movzx eax, al
add ebx, eax
cmp ebx, r13d
jge 0x18009efe8
lea eax, [rdi + 1]
add dword [rsi + 0x1c], eax
mov rax, qword [rsp + 0x78]
add qword [rsi + 0x20], rax
jmp 0x18009ef90
mov r8d, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
mov r15, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
cmp dword [rsi + 0x14], 0
mov r13, qword [rsp + 0x38]
je 0x18009f084
inc r8d
cmp r8d, dword [rbp]
jge 0x18009f084
mov rdx, rbp
mov rcx, rbx
call fcn.18009ef00
cmp dword [rsi + 0x34], 0
jne 0x18009f084
mov rcx, qword [rsi + 8]
call fcn.18009db50
xorps xmm0, xmm0
mov rcx, rbx
movups xmmword [rsi + 8], xmm0
movups xmmword [rsi + 0x18], xmm0
movsxd rdx, dword [rbp + 4]
movsxd rax, dword [rsi + 0x3c]
shl rdx, 6
add rdx, 0x20
add rdx, rdi
shl rdx, 0x1f
add rdx, rax
call fcn.18009d6d0
mov qword [rsi + 8], rax
test rax, rax
je 0x18009f084
lea rcx, [rsi + 8]
call fcn.18009f100
test eax, eax
je 0x18009f070
mov dword [rsi + 0x14], 0
mov eax, dword [rbp + 0x14]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800b7f50
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x98]
xorps xmm0, xmm0
mov r13, qword [rsp + 0x90]
xor eax, eax
mov r12d, r9d
xor r14d, r14d
and r12d, 8
mov r15d, r9d
movups xmmword [rbx + 8], xmm0
mov rdi, rcx
mov ebp, 1
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm0
movups xmmword [rbx + 0x68], xmm0
mov qword [rbx + 0x78], rax
mov qword [rbx], r13
cmp qword [rcx + 0x70], rax
jne 0x1800b7fe7
mov rdx, qword [rcx]
lea rcx, str.SELECT_pgno_FROM__q._q_idx_WHERE_segid__AND_term___ORDER_BY_term_DESC_LIMIT_1
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.1800042ff
mov r8, rax
lea rdx, [rdi + 0x70]
mov rcx, rdi
call fcn.1800ac030
mov rsi, qword [rdi + 0x70]
cmp dword [rdi + 0x3c], r14d
jne 0x1800b8166
movsxd r8, dword [r13]
mov edx, ebp
mov rcx, rsi
call fcn.180004f7f
mov r9d, dword [rsp + 0x80]
mov edx, 2
mov r8, qword [rsp + 0x78]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call fcn.18000496c
mov rcx, rsi
call fcn.180001145
cmp eax, 0x64
jne 0x1800b8044
xor edx, edx
mov rcx, rsi
call fcn.180002478
mov ebp, eax
mov r14d, eax
sar ebp, 1
and r14d, 1
mov rcx, rsi
call fcn.180003206
mov edx, 1
mov dword [rdi + 0x3c], eax
mov rcx, rsi
call fcn.18018df20
test eax, eax
jne 0x1800b8072
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1800b8072
call qword [0x18028cbf0]
mov eax, dword [r13 + 4]
cmp ebp, eax
jge 0x1800b807f
mov ebp, eax
xor r14d, r14d
lea eax, [rbp - 1]
mov rdx, rbx
mov rcx, rdi
mov dword [rbx + 0xc], eax
call fcn.1800b70e0
cmp qword [rbx + 0x10], 0
je 0x1800b80b5
mov eax, dword [rsp + 0x80]
mov r8, rbx
mov r9, qword [rsp + 0x78]
mov edx, r12d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.1800af8d0
cmp dword [rdi + 0x3c], 0
jne 0x1800b8104
test r12d, r12d
je 0x1800b80c7
bt r15d, 8
jae 0x1800b8104
mov eax, dword [rbx + 8]
or eax, 1
cmp qword [rbx + 0x10], 0
mov dword [rbx + 8], eax
je 0x1800b8104
mov esi, r15d
and esi, 2
je 0x1800b80e5
or eax, 2
mov dword [rbx + 8], eax
test r14d, r14d
je 0x1800b80f5
mov rdx, rbx
mov rcx, rdi
call fcn.1800b6470
test esi, esi
je 0x1800b8104
mov rdx, rbx
mov rcx, rdi
call fcn.1800b75c0
test byte [rbx + 8], 2
je 0x1800b8113
lea rcx, [0x1800b7510]
jmp 0x1800b812c
mov rax, qword [rdi]
lea rcx, [0x1800b6840]
lea rdx, [0x1800b7230]
cmp dword [rax + 0x60], 1
cmove rcx, rdx
mov qword [rbx + 0x30], rcx
bt r15d, 8
jb 0x1800b8166
mov rax, qword [rbx]
mov esi, dword [rax + 0x20]
test esi, esi
jle 0x1800b8166
lea eax, [rsi*8 + 0x10]
movsxd rdx, eax
lea rcx, [rdi + 0x3c]
call fcn.18012ff00
test rax, rax
je 0x1800b8166
mov dword [rax + 4], esi
mov dword [rax], 1
mov qword [rbx + 0x28], rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800bc800
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
lea rbx, [rcx + 0x68]
mov r13, rdx
mov r15, rcx
mov esi, r12d
mov ebp, r12d
cmp qword [rbx], r12
jne 0x1800bc911
mov r14, qword [rcx]
lea rax, str._origin
lea rdx, [0x180238455]
lea rcx, str.SELECT_sz_s_FROM__Q._q_docsize_WHERE_id_
cmp dword [r14 + 0x44], esi
mov r9, qword [r14 + 0x10]
mov r8, qword [r14 + 8]
cmovne rdx, rax
call fcn.1800042ff
mov rdi, rax
test rax, rax
jne 0x1800bc87d
mov rcx, qword [rbx]
call fcn.180003206
lea eax, [rdi + 7]
jmp 0x1800bca47
mov rax, qword [r15]
mov r9d, 0x85
mov qword [rsp + 0x30], r12
mov r8d, 0xffffffff
mov qword [rsp + 0x28], rbx
mov rdx, rdi
mov qword [rsp + 0x20], r12
inc dword [rax + 0x80]
mov rcx, qword [r14]
call fcn.180140280
mov ebp, eax
mov rax, qword [r15]
dec dword [rax + 0x80]
cmp dword [0x18028cb60], esi
je 0x1800bc908
mov rcx, qword [0x180294f30]
test rcx, rcx
je 0x1800bc8d1
call qword [0x18028cbe0]
mov rcx, rdi
call qword [0x18028cb98]
dec qword [0x180294eb8]
movsxd rcx, eax
sub qword [0x180294e70], rcx
mov rcx, rdi
call qword [0x18028cb88]
mov rcx, qword [0x180294f30]
test rcx, rcx
je 0x1800bc911
call qword [0x18028cbf0]
jmp 0x1800bc911
mov rcx, rdi
call qword [0x18028cb88]
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.180003206
test ebp, ebp
jne 0x1800bca45
mov r8, r13
lea edx, [rbp + 1]
mov rcx, rbx
call fcn.180004f7f
mov rcx, rbx
call fcn.180001145
cmp eax, 0x64
jne 0x1800bc94d
lea edx, [rbp + 1]
mov rcx, rbx
call fcn.180001aeb
mov rsi, rax
mov rcx, rbx
call fcn.180003206
test eax, eax
jne 0x1800bca47
test rsi, rsi
je 0x1800bca47
mov r15, qword [r15 + 8]
cmp qword [r15 + 0xa0], r12
jne 0x1800bc99b
mov rcx, r15
call fcn.1800a7c20
mov qword [r15 + 0x98], rax
cmp dword [r15 + 0x3c], r12d
jne 0x1800bca3b
mov rcx, r15
call fcn.1800bf740
mov qword [r15 + 0xa0], rax
cmp dword [r15 + 0x3c], r12d
jne 0x1800bca3b
mov rax, qword [r15 + 0xa0]
inc dword [rax]
mov rcx, qword [r15 + 0xa0]
mov qword [rsp + 0x70], rcx
test rcx, rcx
je 0x1800bca3b
mov eax, dword [rcx + 0x1c]
mov ebp, r12d
sub eax, 1
movsxd r12, eax
js 0x1800bca33
mov r14, r12
shl r14, 4
add r14, 0x28
add r14, rcx
nop dword [rax + rax]
mov eax, dword [r14 - 4]
sub eax, 1
movsxd rbx, eax
js 0x1800bca24
imul rdi, rbx, 0x38
mov rdx, qword [r14]
add rdx, rdi
cmp qword [rdx + 0x10], rsi
ja 0x1800bca1a
cmp qword [rdx + 0x18], rsi
jb 0x1800bca1a
test ebp, ebp
jne 0x1800bca0f
inc qword [rdx + 0x28]
mov ebp, 1
mov r8, r13
mov rcx, r15
call fcn.1800ac140
sub rdi, 0x38
sub rbx, 1
jns 0x1800bc9f0
sub r14, 0x10
sub r12, 1
jns 0x1800bc9e0
mov rcx, qword [rsp + 0x70]
call fcn.1800bf9c0
xor r12d, r12d
mov eax, dword [r15 + 0x3c]
mov dword [r15 + 0x3c], r12d
jmp 0x1800bca47
mov eax, ebp
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800cb120
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov qword [rsp + 0x40], rbp
mov rbp, rcx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x58], r14
mov r14, r9
test r8d, r8d
je 0x1800cb1b9
lea rcx, str.PRAGMA__Q.page_size
mov dword [rsp + 0x50], 0
call fcn.1800042ff
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, rbp
mov rsi, rax
call fcn.1800c9c40
mov ebx, eax
test eax, eax
jne 0x1800cb19d
movzx ecx, byte [rdi + 0x27]
mov r8d, dword [rsp + 0x50]
imul edx, ecx, 0x33
add r8d, 0xffffffc0
mov dword [rdi + 0x20], r8d
add edx, 4
cmp edx, r8d
jge 0x1800cb220
mov dword [rdi + 0x20], edx
jmp 0x1800cb220
mov rcx, rbp
call fcn.1800046e2
mov rdx, rax
lea rcx, [0x180242e14]
call fcn.1800042ff
mov qword [r14], rax
jmp 0x1800cb220
mov r8, qword [rdi + 0x38]
lea rcx, str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
mov qword [rsp + 0x20], r15
call fcn.1800042ff
lea r8, [rdi + 0x20]
mov rdx, rax
mov rcx, rbp
mov rsi, rax
call fcn.1800c9c40
mov ebx, eax
test eax, eax
je 0x1800cb1fa
mov rcx, rbp
call fcn.1800046e2
mov rdx, rax
lea rcx, [0x180242e14]
jmp 0x1800cb213
cmp dword [rdi + 0x20], 0x1c0
jge 0x1800cb21b
mov rdx, qword [rdi + 0x38]
lea rcx, str.undersize_RTree_blobs_in___q_node_
mov ebx, 0x10b
call fcn.1800042ff
mov qword [r14], rax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
test rsi, rsi
je 0x1800cb296
cmp dword [0x18028cb60], 0
je 0x1800cb28d
mov rcx, qword [0x180294f30]
test rcx, rcx
je 0x1800cb24f
call qword [0x18028cbe0]
mov rcx, rsi
call qword [0x18028cb98]
dec qword [0x180294eb8]
movsxd rcx, eax
sub qword [0x180294e70], rcx
mov rcx, rsi
call qword [0x18028cb88]
mov rcx, qword [0x180294f30]
test rcx, rcx
je 0x1800cb296
call qword [0x18028cbf0]
mov eax, ebx
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rsi
call qword [0x18028cb88]
mov eax, ebx
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x1800ee4d0
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.180141460
test ebx, ebx
jne 0x1800ee539
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.180141460
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800f2bc0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r15
sub rsp, 0x20
xor edi, edi
mov r12, r8
mov r15, rdx
mov rbx, rcx
cmp dword [rcx + 0x40], edi
jne 0x1800f2bfc
cmp qword [rcx + 0x20], rdi
jne 0x1800f2bfc
mov r9, qword [rcx + 0x10]
lea rdx, str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
mov r8, qword [rcx + 8]
call fcn.1800f3380
mov qword [rbx + 0x20], rax
cmp dword [rbx + 0x40], edi
jne 0x1800f2d4a
mov rcx, qword [rbx + 0x20]
mov r8, r15
mov edx, 1
call fcn.180004f7f
mov rcx, qword [rbx + 0x20]
call fcn.180001145
cmp eax, 0x64
jne 0x1800f2d1a
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x40], rbp
call fcn.180003ee0
mov rsi, qword [rbx + 0x20]
movsxd r14, eax
test rsi, rsi
jne 0x1800f2c5f
lea rcx, [0x18023ac90]
call fcn.180004566
mov rbp, rax
jmp 0x1800f2cd7
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1800f2c71
call qword [0x18028cbe0]
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x1800f2c86
cmp di, word [rsi + 0xc0]
jb 0x1800f2ca1
mov rcx, qword [rsi]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call fcn.180110dc0
lea rcx, [0x18023ac90]
call fcn.180004566
mov rcx, qword [rsi]
mov rbp, rax
mov edx, dword [rsi + 0x34]
cmp byte [rcx + 0x67], dil
jne 0x1800f2cbd
test edx, edx
jne 0x1800f2cbd
mov eax, edi
jmp 0x1800f2cc2
call fcn.1800596e0
mov dword [rsi + 0x34], eax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1800f2cd7
call qword [0x18028cbf0]
call fcn.180003c56
test eax, eax
jne 0x1800f2cf0
mov rcx, r14
call fcn.1801408c0
mov rdi, rax
test rax, rax
jne 0x1800f2cf9
mov dword [rbx + 0x40], 7
jmp 0x1800f2d0b
mov r8, r14
mov rdx, rbp
mov rcx, rax
call fcn.180002c16
mov dword [r12], r14d
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rbx + 0x20]
call fcn.180003206
mov ecx, dword [rbx + 0x40]
test ecx, ecx
jne 0x1800f2d4a
mov dword [rbx + 0x40], eax
mov ecx, eax
test eax, eax
jne 0x1800f2d4a
test rdi, rdi
jne 0x1800f2d4a
mov r8, r15
lea rdx, str.Node__lld_missing_from_database
mov rcx, rbx
call fcn.1800f2b20
mov rbx, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x1800f2dd0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r15, edx
mov rdi, qword [rcx + r15*8 + 0x28]
lea r14, [rcx + r15*8]
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rsi, r8
mov rbx, rcx
test rdi, rdi
jne 0x1800f2e33
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov rdx, qword [rsp + r15*8 + 0x40]
call fcn.1800f3380
mov rdi, rax
mov qword [r14 + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x1800f2ee9
mov r8, rsi
mov edx, 1
mov rcx, rdi
call fcn.180004f7f
mov rcx, rdi
call fcn.180001145
cmp eax, 0x65
jne 0x1800f2e8b
test r15d, r15d
lea rcx, str.__rowid
lea rax, str.__parent
mov r9, rbp
cmovne rax, rcx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call fcn.1800f2b20
jmp 0x1800f2ed8
cmp eax, 0x64
jne 0x1800f2ed8
xor edx, edx
mov rcx, rdi
call fcn.180001aeb
mov r9, rax
cmp rax, rbp
je 0x1800f2ed8
test r15d, r15d
mov qword [rsp + 0x30], rbp
lea rcx, str.__rowid
mov qword [rsp + 0x28], rsi
lea rax, str.__parent
mov r8, rsi
cmovne rax, rcx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1800f2b20
mov rcx, rdi
call fcn.180003206
cmp dword [rbx + 0x40], 0
jne 0x1800f2ee9
mov dword [rbx + 0x40], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x18011a790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x18011a899
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x18023a870]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x18011a811
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x18011a84c
test ecx, ecx
jne 0x18011a85a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.180073a70
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x18011a830
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x18011a7d0
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x18011a85f
inc r8
jmp 0x18011a800
test r10d, r10d
jne 0x18011a829
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x18011a885
test edx, edx
je 0x18011a811
inc rax
jmp 0x18011a870
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x18011a829
inc rax
jmp 0x18011a870
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180132370
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, qword [rcx]
lea rbp, [rcx + 0x68]
xor ebx, ebx
mov r13, r8
mov r15, rcx
mov esi, ebx
mov r12d, dword [r14 + 0x18]
cmp qword [rbp], rbx
jne 0x18013247e
cmp dword [r14 + 0x44], ebx
lea rax, str._origin
mov r9, qword [r14 + 0x10]
lea rdx, [0x180238455]
mov r8, qword [r14 + 8]
lea rcx, str.SELECT_sz_s_FROM__Q._q_docsize_WHERE_id_
cmovne rdx, rax
call fcn.1800042ff
mov rdi, rax
test rax, rax
jne 0x1801323ea
lea esi, [rbx + 7]
jmp 0x18013247e
mov rax, qword [r15]
mov r9d, 0x85
mov qword [rsp + 0x30], rbx
mov r8d, 0xffffffff
mov qword [rsp + 0x28], rbp
mov rdx, rdi
mov qword [rsp + 0x20], rbx
inc dword [rax + 0x80]
mov rcx, qword [r14]
call fcn.180140280
mov esi, eax
mov rax, qword [r15]
dec dword [rax + 0x80]
cmp dword [0x18028cb60], ebx
je 0x180132475
mov rcx, qword [0x180294f30]
test rcx, rcx
je 0x18013243e
call qword [0x18028cbe0]
mov rcx, rdi
call qword [0x18028cb98]
dec qword [0x180294eb8]
movsxd rcx, eax
sub qword [0x180294e70], rcx
mov rcx, rdi
call qword [0x18028cb88]
mov rcx, qword [0x180294f30]
test rcx, rcx
je 0x18013247e
call qword [0x18028cbf0]
jmp 0x18013247e
mov rcx, rdi
call qword [0x18028cb88]
mov rdi, qword [rbp]
mov rcx, rdi
call fcn.180003206
test rdi, rdi
je 0x180132588
mov r8, qword [rsp + 0x78]
mov edx, 1
mov rcx, rdi
call fcn.180004f7f
mov rcx, rdi
call fcn.180001145
cmp eax, 0x64
jne 0x180132574
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1801324c8
call qword [0x18028cbe0]
mov rcx, qword [rdi + 0xa0]
test rcx, rcx
je 0x1801324dd
cmp bx, word [rdi + 0xc0]
jb 0x1801324f8
mov rcx, qword [rdi]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call fcn.180110dc0
lea rcx, [0x18023ac90]
call fcn.180004566
mov rcx, qword [rdi]
mov r14, rax
mov edx, dword [rdi + 0x34]
cmp byte [rcx + 0x67], bl
jne 0x180132513
test edx, edx
jne 0x180132513
mov eax, ebx
jmp 0x180132518
call fcn.1800596e0
mov dword [rdi + 0x34], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x18013252d
call qword [0x18028cbf0]
xor edx, edx
mov rcx, rdi
call fcn.180003ee0
mov ebp, eax
mov esi, ebx
test r12d, r12d
jle 0x180132566
cmp ebx, ebp
jge 0x180132574
movsxd rcx, esi
lea rdx, [rcx*4]
movsxd rcx, ebx
add rcx, r14
add rdx, r13
call fcn.18012b1b0
add ebx, eax
inc esi
cmp esi, r12d
jl 0x180132540
cmp ebx, ebp
jne 0x180132574
mov rcx, rdi
call fcn.180003206
jmp 0x18013258a
mov rcx, rdi
call fcn.180003206
test eax, eax
mov ecx, 0x10b
cmove eax, ecx
jmp 0x18013258a
mov eax, esi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret