joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba80
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov r15, rcx
movsxd r12, edx
mov r13, r8
call sym.strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0040b720
sub rsp, rax
movsxd rdi, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
lea r15d, [r14 + 0x50]
mov byte [rsp + 0x2e], 0x2d
movsxd rbx, ebx
call sym.memcpy
lea rax, [rsi + rdi + 0x10]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41bb69
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x41bc02
mov rcx, r12
add r14d, 0x10
call sym.malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x41bba4
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x41bb90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x41bbff
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call sym.get_ptr_from_atom_1
cmp rax, rbx
mov rsi, rax
je 0x41bc19
mov rcx, rbx
call sym.free
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call sym.get_ptr_from_atom_1
mov rsi, rax
jmp 0x41bbd9
xor edx, edx
mov r8, r12
mov rcx, rbx
call sym.memset
test r13, r13
je 0x41bbd9
mov rcx, rbx
call r13
jmp 0x41bbd9

Function at 0x41bc60
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_spin_locked_shmem]
lea rcx, str.spin_locked_shmem
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41c790
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_rwl_global_shmem]
lea rcx, str.rwl_global_shmem
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41c860
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_winpthreads_init_cond_locked_shmem_rwlock]
lea rcx, str.cond_locked_shmem_rwlock
mov edx, 0x10
jmp sym.__shmem_winpthreads_grab

Function at 0x41d5b0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init_init]
lea rcx, str.init
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x41d5d0
Capabilities:
Check mutex on windows

Disassembly:
lea rcx, str.eh_globals
xor r8d, r8d
mov edx, 0x10
jmp dbg.__shmem_grab
Function at 0x41dc80
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x41dca0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x41ed80
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
test rax, rax
jle 0x41edb1
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
mov dword [rbx + 0x48], 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x41f4a0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x0047dd30], 0
jne 0x41f568
mov byte [0x0047dd30], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x41f5fb
mov rax, qword [rax + 8]
xor esi, esi
lea r9, [rsp + 0x2c]
cmp byte [rax], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete sil
xor r8d, r8d
xor edx, edx
add rsi, rax
mov rcx, rsi
call sym.__cxa_demangle
mov rbx, qword [sym.imp.msvcrt.dll___iob_func]
mov rdi, rax
call rbx
lea rcx, str.terminate_called_after_throwing_an_instance_of_
lea r9, [rax + 0x60]
mov r8d, 0x30
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x41f558
call rbx
lea rdx, [rax + 0x60]
mov rcx, rsi
call sym.fputs
call rbx
lea rcx, [0x0047f3c1]
lea r9, [rax + 0x60]
mov r8d, 2
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x41f58e
call sym.__cxa_rethrow
call rbx
lea rdx, [rax + 0x60]
mov rcx, rdi
call sym.fputs
jmp 0x41f52f
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_recursively_n
lea r9, [rax + 0x60]
mov r8d, 0x1d
mov edx, 1
call sym.fwrite
call sym.abort
mov rcx, rdi
call sym.free
jmp 0x41f553
call sym.abort
nop dword [rax + rax]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_without_an_active_exception_n
lea r9, [rax + 0x60]
mov r8d, 0x2d
mov edx, 1
call sym.fwrite
jmp 0x41f5f6

Function at 0x449e90
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call method.std::__basic_file_char_.fd__
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sym.read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x449ee0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x449eaa
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x9f9ce8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
bts r11w, 0x9c
xor r9w, 0xf19a
inc r9w
xor r9w, 0x579b
inc r11d
xor di, r9w
add r9, rsp
call fcn.0142363a
invalid
ja 0x9f9cfb
add dil, 0x20
cmp cx, 0x4899
test r15b, r12b
stc
test bl, bl
je 0x1419e6f
cmp bl, dil
jmp 0x1419e69
seta bpl
mov eax, ebp
movsxd rsi, r11d
bt r13w, si
or bpl, 0x9b
mov rbx, qword [rsp + 0x40]
sub rdi, rsp
shr r13b, 0x27
inc bp
mov rbp, qword [rsp + 0x48]
ror r12b, 0x80
inc r12b
mov rsi, qword [rsp + 0x50]
setl r13b
add rsp, 0x20
not r13w
movsxd r13, r12d
pop r13
mov dil, 0x31
pop r12
movsx rdi, dx
pop rdi
ret
adc rbp, 6
mov qword [rsp], 0xf3e75a7
mov word [rbp + riz], ax
jmp 0x1417957
jae 0x13904d5
or eax, 0xffffffff
jmp 0x1444133
jnp 0x9f73ff
sbb rbp, 4
push 0xffffffffd90c0232
mov dword [rsp + 7], 0x5a9945a2
push 0x4e3c81b7
mov dword [rbp + riz], ecx
push 0x53b1dfac
lea rsp, [rsp + 0x38]
jmp fcn.01444390
inc rsi
cmp r10b, r14b
xor bl, al
shld eax, r13d, 0x12
test r13d, 0x3f12f79d
sal ax, 0x2c
lea eax, [rbx - 0x41]
jmp 0x142b265
call fcn.0142d55d
invalid
je 0x1421a1e
cmp bl, dil
jmp 0x1398d76
jb 0x139e193
jae 0x13933d3
ja 0x141ef29
add bl, 0x20
stc
lea eax, [rdi - 0x41]
stc
cmp al, 0x19
jmp 0x9f9ce8
movzx ebx, byte [r13]
movzx rdi, bp
mov rcx, 0x1038c090
cdqe
movzx edi, byte [r12]
cwde
inc r13
inc r12
bswap ax
movzx ecx, bp
cmovne ax, r12w
mov eax, 0xd3b46e9e
bt cx, r14w
movsx cx, r11b
btr ecx, 0x9d
mov ecx, esi
rol eax, cl
stc
add al, sil
jmp 0x13a36d4
cmp al, 0x19
jmp 0x141ef1f
jmp 0x13904e7
Function at 0x180002ce0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x1801715d0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rcx
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x180002e58
mov ecx, 0x228
call fcn.18000be40
mov rbx, rax
test rax, rax
je 0x180002e58
xor edx, edx
mov r8d, 0x228
mov rcx, rax
call fcn.18012e4c0
test rdi, rdi
je 0x180002da3
lea r9, [0x18014dd78]
mov r8, rdi
lea r10, [0x180144c70]
sub r9, rdi
nop
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x180002e7b
test ecx, ecx
jne 0x180002e8d
lea rdi, [0x180179cb0]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call fcn.18012e4c0
lea rcx, str.SystemDrive
mov r8d, 0x8000
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x180002da1
cmp eax, 0x8000
jbe 0x180002da3
xor edi, edi
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x128
call fcn.18012e4c0
lea r8, str._s
lea rcx, [rsp + 0x54]
mov r9, rdi
mov edx, 0x104
call fcn.180129844
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x54]
call fcn.180129fcc
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x180002e50
mov eax, dword [rsp + 0x30]
test al, 2
jne 0x180002df6
test al, 4
je 0x180002e95
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x128
call fcn.18012e4c0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call fcn.18012a114
cmp eax, 0xffffffff
je 0x180002e50
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
test al, 2
jne 0x180002e2c
test al, 4
je 0x180002e95
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x128
call fcn.18012e4c0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call fcn.18012a114
cmp eax, 0xffffffff
jne 0x180002e20
mov rcx, rbx
call fcn.180002fc0
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180128580
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
movzx edx, byte [rax + r10]
movzx ecx, byte [rcx + r10]
sub ecx, edx
jne 0x180002da3
inc r8
jmp 0x180002d50
lea rcx, [rbx + 0x10]
lea rdx, [rsp + 0x54]
mov r8d, 0x104
mov dword [rbx + 0xc], eax
call fcn.18012a250
mov byte [rbx + 0x114], 0
mov rax, rbx
jmp 0x180002e5a
Function at 0x180005690
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, rdx
mov rbx, rcx
lea rdx, [0x180144b00]
mov rcx, rax
call fcn.18012a4cc
mov rdi, rax
test rax, rax
je 0x18000580d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rbp
lea r8d, [rdx + 2]
call fcn.18012ae38
mov rcx, rdi
call fcn.18012ac58
mov rcx, rdi
movsxd rbp, eax
call fcn.180129388
mov r11, qword [rbx]
mov rax, qword [r11 + 0x18]
movsxd rcx, dword [rax + 0x88]
cmp rbp, rcx
jle 0x180005746
mov dword [rbx + 0x24], 0x12
test byte [r11 + 0x14], 1
je 0x18000572f
mov rax, qword [str.string_or_blob_too_big]
lea rdx, str.unknown_error
mov r9b, 1
test rax, rax
mov rcx, rbx
mov qword [rsp + 0x20], 0
cmovne rdx, rax
or r8d, 0xffffffff
call fcn.18003bb90
mov rcx, rdi
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.18012afd4
mov qword [rsp + 0x48], rsi
test rbp, rbp
mov esi, 1
cmovne rsi, rbp
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x1800057f3
test rsi, rsi
je 0x1800057f3
mov rcx, rsi
call fcn.18000be40
mov rsi, rax
test rax, rax
je 0x1800057f3
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.18012a7b8
cmp rbp, rax
jne 0x1800057ac
lea r9, [sym.sqlite.dll_sqlite3_free]
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call sym.sqlite.dll_sqlite3_result_blob64
jmp 0x1800057fb
mov rax, qword [rbx]
mov dword [rbx + 0x24], 0xa
test byte [rax + 0x14], 1
je 0x1800057e9
mov rax, qword [str.disk_I_O_error]
lea rdx, str.unknown_error
mov r9b, 1
test rax, rax
mov rcx, rbx
mov qword [rsp + 0x20], 0
cmovne rdx, rax
or r8d, 0xffffffff
call fcn.18003bb90
mov rcx, rsi
call sym.sqlite.dll_sqlite3_free
jmp 0x1800057fb
mov rcx, rbx
call sym.sqlite.dll_sqlite3_result_error_nomem
mov rcx, rdi
call fcn.18012afd4
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18000efe0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov r12, rdx
mov edi, ecx
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x18000f1d4
cmp byte [0x180172924], al
mov qword [rsp + 0x40], rsi
jne 0x18000f00e
xor esi, esi
jmp 0x18000f02a
mov ecx, 5
call qword [0x180172990]
mov rsi, rax
test rax, rax
je 0x18000f02a
mov rcx, rax
call qword [0x1801729a0]
test edi, edi
jle 0x18000f1b7
test r12, r12
je 0x18000f1b7
cmp dword [0x180181de0], 0
mov qword [rsp + 0x30], rbx
jne 0x18000f138
mov qword [rsp + 0x38], rbp
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
je 0x18000f05f
xor ebp, ebp
jmp 0x18000f09d
cmp byte [0x180172924], 0
jne 0x18000f06c
xor ebx, ebx
jmp 0x18000f088
mov ecx, 2
call qword [0x180172990]
mov rbx, rax
test rax, rax
je 0x18000f088
mov rcx, rax
call qword [0x1801729a0]
mov rbp, qword [0x1801820e8]
test rbx, rbx
je 0x18000f09d
mov rcx, rbx
call qword [0x1801729b0]
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x180181de0], xmm0
test rbp, rbp
jne 0x18000f0c4
lea r8d, [rbp + 0x2c]
lea rcx, [0x180181df0]
xor edx, edx
call fcn.18012e4c0
jmp 0x18000f113
mov eax, dword [0x180172ad0]
test eax, eax
je 0x18000f101
xor ecx, ecx
mov qword [0x180181df0], rcx
mov dword [0x180181df0], eax
mov qword [0x180181df8], rcx
mov qword [0x180181e00], rcx
mov qword [0x180181e08], rcx
mov qword [0x180181e10], rcx
mov dword [0x180181e18], ecx
jmp 0x18000f113
lea r8, [0x180181df0]
mov edx, 0x2c
mov rcx, rbp
call qword [rbp + 0x68]
mov eax, dword [0x180181e10]
mov rbp, qword [rsp + 0x38]
xor cl, cl
mov dword [0x180181e10], 0
mov byte [0x180181e60], cl
mov dword [0x180181e1c], eax
jmp 0x18000f13f
movzx ecx, byte [0x180181e60]
movzx eax, cl
lea rbx, [0x180181e20]
cmp edi, eax
jle 0x18000f193
nop dword [rax]
test cl, cl
je 0x18000f171
movzx r8d, cl
mov rdx, rbx
mov rcx, r12
call fcn.180128750
movzx r11d, byte [0x180181e60]
sub edi, r11d
add r12, r11
inc dword [0x180181e10]
lea rdx, [0x180181de0]
mov rcx, rbx
call fcn.18000ece0
mov cl, 0x40
mov byte [0x180181e60], cl
cmp edi, 0x40
jg 0x18000f150
movzx eax, cl
movsxd r8, edi
mov rcx, r12
sub eax, edi
movsxd rdx, eax
add rdx, rbx
call fcn.180128750
sub byte [0x180181e60], dil
mov rbx, qword [rsp + 0x30]
jmp 0x18000f1c1
mov dword [0x180181de0], 0
test rsi, rsi
je 0x18000f1cf
mov rcx, rsi
call qword [0x1801729b0]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18004add0
Capabilities:
Create thread

Disassembly:
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x18004adfc
cmp dword [rcx + 0x20], 0
je 0x18004adf4
mov rcx, qword [rcx]
lea rdx, [0x18004ada0]
mov r8, rax
jmp fcn.18000f210
mov rcx, rax
jmp fcn.18004ac90
xor eax, eax
ret

Function at 0x180057080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r12
sub rsp, 0x28
mov rbx, rdx
movzx edx, byte [rdx]
mov r12, rcx
movzx eax, dl
cmp dl, 0xb0
jne 0x18005709d
movzx eax, byte [rbx + 2]
cmp al, 0xb1
jne 0x1800570a9
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax]
jmp 0x1800570bb
cmp al, 0x8a
jne 0x180057152
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 0x20]
mov ecx, dword [rcx]
cmp ecx, 1
je 0x180057152
mov qword [rsp + 0x48], rsi
xor esi, esi
mov dword [r8], esi
cmp dl, 0x8a
jne 0x1800570ea
mov rdx, rbx
mov rcx, r12
mov rsi, qword [rsp + 0x48]
add rsp, 0x28
pop r12
pop rbx
jmp fcn.180055180
mov eax, dword [r12 + 0x38]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r13
lea edi, [rax + 1]
add eax, ecx
movsxd r13, ecx
mov dword [r12 + 0x38], eax
test ecx, ecx
jle 0x18005714e
mov qword [rsp + 0x40], rbp
mov ebp, edi
mov rdx, qword [rbx + 0x20]
mov r8d, ebp
mov rcx, r12
mov rdx, qword [rdx + rsi + 8]
call fcn.1800599f0
inc ebp
add rsi, 0x20
dec r13
jne 0x180057111
mov rbp, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
add rsp, 0x28
pop r12
pop rbx
ret
mov eax, edi
jmp 0x180057137
mov rdx, rbx
mov rcx, r12
add rsp, 0x28
pop r12
pop rbx
jmp fcn.180059640

Function at 0x18005be50
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov r12d, dword [rsp + 0x70]
mov ebx, r8d
mov rbp, r9
mov dword [rax - 0x18], r12d
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
mov byte [rcx + 0x1c], 1
mov dword [rax - 0x28], ebx
call fcn.180064ba0
test ebx, ebx
jne 0x18005beb9
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov r9, rbp
mov r8, rdi
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.180064ba0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x1800653c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov r12, rdx
mov ebx, r11d
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x1800654c9
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x20], r14
lea r14, str.main
lea r13, [0x180144c70]
nop
mov r9d, ebx
cmp ebx, 2
jge 0x18006540c
xor r9d, 1
mov rax, qword [rsi + 0x20]
movsxd r8, r9d
shl r8, 5
mov rbp, qword [r8 + rax + 0x18]
test rdi, rdi
je 0x180065441
mov r8, qword [r8 + rax]
mov r10, rdi
sub r10, r8
nop dword [rax + rax]
movzx ecx, byte [r8]
movzx eax, byte [r10 + r8]
cmp ecx, eax
jne 0x18006547c
test ecx, ecx
jne 0x18006548a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r12
call fcn.1800121f0
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x180065460
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x180065400
mov r13, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
mov rax, r11
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r13]
movzx ecx, byte [rcx + r13]
sub ecx, edx
jne 0x18006548f
inc r8
jmp 0x180065430
test r9d, r9d
jne 0x180065459
mov r9, rdi
mov r8, r14
sub r9, r14
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x1800654b6
test ecx, ecx
je 0x180065441
inc r8
jmp 0x1800654a0
movzx edx, byte [rax + r13]
movzx ecx, byte [rcx + r13]
sub ecx, edx
jne 0x180065459
inc r8
jmp 0x1800654a0
mov rax, r11
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800e6820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
mov r8d, ecx
cmp ecx, 0x80
jge 0x1800e684c
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x1800e6844
lea eax, [rcx + 0x20]
add rsp, 0x20
pop rdi
ret
mov eax, ecx
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x10000
jge 0x1800e6923
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov qword [rsp + 0x38], rsi
mov r9d, 0xa2
or r11d, 0xffffffff
lea rsi, [0x180000000]
mov r10d, ebx
nop dword [rax + rax]
lea eax, [r10 + r9]
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
movzx edx, word [rsi + rcx*4 + 0x14bdf0]
cmp r8d, edx
js 0x1800e68a2
mov r11d, eax
lea r10d, [rax + 1]
jmp 0x1800e68a6
lea r9d, [rax - 1]
cmp r9d, r10d
jge 0x1800e6880
movsxd rdx, r11d
movzx ecx, word [rsi + rdx*4 + 0x14bdf0]
movzx eax, byte [rsi + rdx*4 + 0x14bdf3]
add eax, ecx
cmp r8d, eax
jge 0x1800e68f2
movzx r9d, byte [rsi + rdx*4 + 0x14bdf2]
xor ecx, r8d
mov eax, r9d
and eax, 1
and eax, ecx
test al, al
jne 0x1800e68f2
mov eax, r9d
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x14c080]
add eax, r8d
movzx r8d, ax
mov rsi, qword [rsp + 0x38]
test edi, edi
je 0x1800e6915
cmp edi, 2
mov ecx, r8d
sete bl
mov edx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800e6200
mov eax, r8d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rcx - 0x10400]
cmp eax, 0x27
ja 0x1800e6844
lea eax, [rcx + 0x28]
add rsp, 0x20
pop rdi
ret
Function at 0x1800f35e0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, qword [rdx + 0x30]
xor r15d, r15d
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov r12d, 0x64
mov rbp, rdx
mov qword [rsp + 0x70], r15
mov ebx, r15d
mov r13d, r12d
test rcx, rcx
je 0x1800f3629
call qword [0x1801729a0]
cmp byte [rdi + 0x6f], bl
jne 0x1800f3636
mov rcx, rdi
call fcn.180023fe0
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180087820
mov esi, eax
test eax, eax
jne 0x1800f366c
lea rdx, str.sqlite_stat1
mov r8, r14
mov rcx, rdi
call fcn.180064c90
mov rbx, rax
test rax, rax
je 0x1800f3669
cmp byte [rax + 0x3f], 2
jne 0x1800f366c
mov rbx, r15
cmp byte [rdi + 0x6f], r15b
jne 0x1800f367a
mov rcx, rdi
call fcn.180024050
test esi, esi
jne 0x1800f36b3
test rbx, rbx
jne 0x1800f36b3
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18000c110
lea r8, str.sqlite_stat1
lea rdx, str.no_such_table_column:__s._s
xor r9d, r9d
mov rcx, rdi
call fcn.18000e980
lea esi, [rbx + 1]
mov qword [rsp + 0x70], rax
jmp 0x1800f36b8
mov rax, qword [rsp + 0x70]
lea rcx, [0x180144b04]
test rax, rax
mov r8, r15
cmovne r8, rcx
mov r9, rax
mov edx, esi
mov rcx, rdi
call fcn.18000fc60
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18000c110
cmp byte [rdi + 0x67], r15b
jne 0x1800f36f2
test esi, esi
jne 0x1800f36f2
mov ebx, r15d
jmp 0x1800f36fe
mov edx, esi
mov rcx, rdi
call fcn.18000c9c0
mov ebx, eax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800f370d
call qword [0x1801729b0]
test ebx, ebx
je 0x1800f3725
cmp ebx, 1
mov qword [rbp + 0x48], 0x100000
cmove ebx, r15d
jmp 0x1800f37b1
mov r8, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
lea rcx, str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
call sym.sqlite.dll_sqlite3_mprintf
mov rsi, rax
test rax, rax
jne 0x1800f3746
lea ebx, [rax + 7]
jmp 0x1800f37a6
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r15
mov r9d, pe_nt_image_headers64
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.180088370
mov ebx, eax
test eax, eax
jne 0x1800f379e
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, r12d
jne 0x1800f3794
xor edx, edx
mov rcx, rbx
call sym.sqlite.dll_sqlite3_column_int64
mov r13, rax
mov rcx, rbx
call sym.sqlite.dll_sqlite3_finalize
mov ebx, eax
mov rcx, rsi
call sym.sqlite.dll_sqlite3_free
cmp r13, r12
cmovg r12, r13
mov qword [rbp + 0x48], r12
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800f3dc0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r12, rcx
test r8d, r8d
je 0x1800f3e92
mov rdx, qword [rdx + 0x30]
lea rcx, str.PRAGMA__Q.page_size
xor esi, esi
call sym.sqlite.dll_sqlite3_mprintf
lea edi, [rsi + 7]
mov rbp, rax
test rax, rax
je 0x1800f3e61
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
lea r9d, [rdi + 0x79]
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rsi
call fcn.180088370
mov edi, eax
test eax, eax
jne 0x1800f3e61
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f3e57
xor edx, edx
mov rcx, rdi
call sym.sqlite.dll_sqlite3_column_int
mov esi, eax
mov rcx, rdi
call sym.sqlite.dll_sqlite3_finalize
mov edi, eax
test edi, edi
jne 0x1800f3e7e
movzx eax, byte [rbx + 0x27]
lea ecx, [rsi - 0x40]
mov dword [rbx + 0x20], ecx
imul eax, eax, 0x33
add eax, 4
cmp eax, ecx
jge 0x1800f3ee0
mov dword [rbx + 0x20], eax
jmp 0x1800f3ee0
mov rcx, r12
call sym.sqlite.dll_sqlite3_errmsg
lea rcx, [0x180144b04]
mov rdx, rax
jmp 0x1800f3ed7
mov r8, qword [rdx + 0x38]
mov rdx, qword [rdx + 0x30]
lea rcx, str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.sqlite.dll_sqlite3_mprintf
lea r8, [rbx + 0x20]
mov rcx, r12
mov rdx, rax
mov rbp, rax
call fcn.1800f3d40
mov edi, eax
test eax, eax
jne 0x1800f3e7e
cmp dword [rbx + 0x20], 0x1c0
jge 0x1800f3ee0
mov rdx, qword [rbx + 0x38]
mov edi, 0x10b
lea rcx, str.undersize_RTree_blobs_in___q_node_
call sym.sqlite.dll_sqlite3_mprintf
mov qword [r13], rax
mov rcx, rbp
call sym.sqlite.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x50
pop r13
pop r12
pop rdi
ret