joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400048f0
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x130
mov rdi, r9
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], r8
mov rax, rdx
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x88], rbx
mov rsi, qword [rsp + 0x1a0]
mov eax, dword [rsp + 0x198]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x70], rax
mov r8, qword [rsp + 0x188]
mov qword [rsp + 0x68], r8
mov r9, qword [rsp + 0x180]
mov qword [rsp + 0x60], r9
mov r10, qword [rsp + 0x178]
mov qword [rsp + 0x58], r10
mov r11, qword [rsp + 0x170]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], r11
mov qword [rsp + 0xd0], r10
mov qword [rsp + 0xd8], r9
mov qword [rsp + 0xe0], r8
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
xor eax, eax
mov r8d, eax
mov qword [rsp + 0x78], r8
call fcn.14002e460
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
call fcn.14001e000
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
call fcn.14002e4b0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
call fcn.14001dfb0
mov r11d, dword [rsp + 0x84]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0xa0]
mov r10, rax
mov rax, rsp
mov qword [rax + 0x30], rsi
mov dword [rax + 0x28], r11d
mov qword [rax + 0x20], r10
mov rax, qword [sym.imp.crypt32.dll_CryptUnprotectData]
call rax
mov ecx, eax
call fcn.14000f470
nop
add rsp, 0x130
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001a9d0
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov dword [rbp - 0x1c], r9d
mov qword [rbp - 0x18], r8
mov dword [rbp - 0xc], edx
mov rax, qword [rbp + 0xa0]
mov qword [rbp - 8], rax
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov qword [rbp + 0x48], r8
mov dword [rbp + 0x54], r9d
mov byte [rbp + 0x37], 0
mov byte [rbp + 0x37], 1
call fcn.14001e0a0
mov qword [rbp], rdx
mov qword [rbp + 8], rax
jmp 0x14001aa24
mov rax, qword [rbp]
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x10]
call fcn.14000e640
mov qword [rbp - 0x28], rax
jmp 0x14001aa43
mov rcx, qword [rbp - 0x18]
mov byte [rbp + 0x37], 0
call fcn.14001e190
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rax
jmp 0x14001aa5a
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x20]
call fcn.14000e6a0
mov qword [rbp - 0x40], rax
jmp 0x14001aa79
mov r9d, dword [rbp - 0x1c]
mov r8, qword [rbp - 0x40]
mov edx, dword [rbp - 0xc]
mov rcx, qword [rbp - 0x28]
mov r10, qword [rbp - 8]
mov qword [rbp + 0x58], r10
mov qword [rbp + 0x60], 0x104
mov rax, rsp
mov qword [rax + 0x20], r10
mov rax, qword [sym.imp.shell32.dll_SHGetFolderPathW]
call rax
mov ecx, eax
call fcn.140010250
mov dword [rbp - 0x4c], edx
mov qword [rbp - 0x48], rax
jmp 0x14001aab8
mov edx, dword [rbp - 0x4c]
mov rax, qword [rbp - 0x48]
add rsp, 0xf0
pop rbp
ret

Function at 0x14003b310
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
movdqa xmm0, xmmword [rdx]
aeskeygenassist xmm0, xmm0, 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x140055840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140055960
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400558a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400558a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400558a0

Function at 0x140070910
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.140070910
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret
Function at 0x140070a1a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400709f0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret

Function at 0x14010dfe0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x14010e020
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14010e0c0
jmp 0x14010e0af
jae 0x14010e18e
cmp r8, 0x201
jae 0x14010e0c0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14010e126
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14010e0fe
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14028c930
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14010e14f
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14010e1fa
mov r8d, r13d
cmp r12, r8
jne 0x14010e0a0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14010e22e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14010e0af
jmp 0x14010e0c0
cmp r14, r8
jb 0x14010e248
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140111230
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x14010e1e3
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.14001f1a0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14010e1ce
jmp 0x14010e1e3
lea rcx, str.internal_error:_entered_unreachable_code_rustc_759e07f063fb8e6306ff1bdaeb70af56a878b415library_alloc_src_vecmod.rs
lea r8, str.f._
mov edx, 0x28
call fcn.14028de60
jmp 0x14010e25d
lea rax, str.std_src_syspalwindowsmod.rsf._
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14028e300
ud2
Function at 0x140116670
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x1402e6020]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1401166ff
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0xc0000011
jne 0x14011670c
xor edx, edx
xor eax, eax
jmp 0x140116736
cmp eax, 0x103
je 0x140116740
test eax, eax
js 0x14011671f
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x140116736
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, str.8_._
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.140110cc0
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.14010c2b0
mov ecx, 7
int 0x29
ud2

Function at 0x140116790
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x1402e6020]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140116826
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0x103
je 0x140116853
test eax, eax
js 0x140116832
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x140116849
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, str.8_._
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.140110cc0
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.14010c2b0
mov ecx, 7
int 0x29
ud2
Function at 0x140117240
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14032e3e1]
jp 0x1401172d6
and dword [rax], eax
mov ecx, 0x10
mov edx, 8
call fcn.14001f190
test rax, rax
je 0x14011732b
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
and al, 0x28
add byte [rax], al
add byte [rax], al
mov dword [rsp + 0x20], 0x10000
lea r8, case.0x140111982.422
lea eax, case.0x140111982.422
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
ret 0x8548
invalid
jne 0x14011731d
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x1401172da
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x10], r14
Function at 0x14012a2a0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.1401284a0
test eax, eax
je 0x14012a2c5
jmp 0x14012a504
mov ecx, 5
call fcn.1401495e0
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.140130e00
cmp dword [rsp + 0x50], 0
jle 0x14012a2ed
cmp qword [rsp + 0x58], 0
jne 0x14012a314
mov eax, 4
imul rax, rax, 0
lea rcx, [0x14032e5b0]
mov dword [rcx + rax], 0
mov rcx, qword [rsp + 0x28]
call fcn.140130e70
nop
jmp 0x14012a504
mov eax, 4
imul rax, rax, 0
lea rcx, [0x14032e5b0]
cmp dword [rcx + rax], 0
jne 0x14012a404
xor ecx, ecx
call fcn.140130ba0
mov qword [rsp + 0x30], rax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x14032e5b0]
add rcx, rax
mov rax, rcx
mov r8d, 0x10
lea rdx, [0x14029c430]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rsp + 0x30], 0
jne 0x14012a396
mov eax, 4
imul rax, rax, 4
lea rcx, [0x14032e5b0]
add rcx, rax
mov rax, rcx
mov r8d, 0x2c
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
nop
jmp 0x14012a3bf
mov eax, 4
imul rax, rax, 4
lea rcx, [0x14032e5b0]
add rcx, rax
mov rax, rcx
mov r8, rax
mov edx, 0x2c
mov rcx, qword [rsp + 0x30]
call fcn.140137980
nop
mov eax, 4
imul rax, rax, 0xc
lea rcx, [0x14032e5b0]
mov edx, 4
imul rdx, rdx, 0xf
lea r8, [0x14032e5b0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 0xc
lea rcx, [0x14032e5b0]
mov dword [rcx + rax], 0
mov byte [0x14032e630], 0
xor eax, eax
cmp eax, 1
je 0x14012a4f9
movzx eax, byte [0x14032e630]
cmp dword [rsp + 0x50], eax
jg 0x14012a462
movsxd rax, dword [rsp + 0x50]
movzx ecx, byte [0x14032e630]
sub ecx, dword [rsp + 0x50]
movsxd rcx, ecx
lea rdx, [0x14032e5f0]
add rdx, rcx
mov rcx, rdx
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x14032e630]
sub eax, dword [rsp + 0x50]
mov byte [0x14032e630], al
jmp 0x14012a4f9
movzx eax, byte [0x14032e630]
test eax, eax
jle 0x14012a4b2
movzx eax, byte [0x14032e630]
mov r8d, eax
lea rdx, [0x14032e5f0]
mov rcx, qword [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x14032e630]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14032e630]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov eax, 4
imul rax, rax, 0xc
lea rcx, [0x14032e5b0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x14032e5b0]
mov dword [rdx + rcx], eax
lea rdx, [0x14032e5b0]
lea rcx, [0x14032e5f0]
call fcn.14019f130
mov byte [0x14032e630], 0x40
jmp 0x14012a404
mov rcx, qword [rsp + 0x28]
call fcn.140130e70
nop
add rsp, 0x48
ret
Function at 0x140188800
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, 0x28
call fcn.1401489d0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140188840
mov eax, 7
jmp 0x140188917
movzx eax, byte [0x14031e034]
test eax, eax
je 0x140188859
mov ecx, 0xc8
call fcn.140158850
test eax, eax
je 0x14018886e
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
nop
jmp 0x1401888dc
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x1401a01d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x1401888dc
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
nop
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x140188908
call qword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x48
ret
Function at 0x1401c3eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 8]
call fcn.14013f570
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 0x28]
call fcn.14013b9e0
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 8]
call fcn.14013b9e0
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x24], eax
jge 0x1401c3f1e
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x38], eax
jmp 0x1401c3f26
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0xb8]
movsxd rcx, dword [rsp + 0x24]
imul rax, rcx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x1401c3f77
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x20], 0
jne 0x1401c4123
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x30], rax
jge 0x1401c4123
mov qword [rsp + 0x40], 0
movsxd rax, dword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
cqo
mov rcx, qword [rsp + 0x60]
idiv rcx
inc eax
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x68], rax
xor edx, edx
mov eax, dword [0x14031ee98]
mov rcx, qword [rsp + 0x68]
div dword [rcx + 0x34]
inc eax
cmp dword [rsp + 0x3c], eax
jne 0x1401c3fec
jmp 0x1401c3f62
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x70]
call fcn.1401390d0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1401c4113
mov rcx, qword [rsp + 0x40]
call fcn.140139240
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1401c4113
movsxd rax, dword [rsp + 0x24]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
cqo
mov rcx, qword [rsp + 0x78]
idiv rcx
mov rax, rdx
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x40]
call fcn.1401395c0
mov qword [rsp + 0x88], rax
movsxd rax, dword [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x30]
cqo
mov rcx, qword [rsp + 0x80]
idiv rcx
mov rax, rdx
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
movsxd rax, dword [rsp + 0x48]
mov r8, rax
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x40]
call fcn.1401395e0
mov ecx, 1
imul rcx, rcx, 0
mov byte [rax + rcx], 0
cmp qword [rsp + 0x30], 0
jne 0x1401c4113
cmp dword [rsp + 0xc8], 0
jne 0x1401c4113
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 0x28]
call fcn.14013ba50
mov ecx, 1
imul rcx, rcx, 0x1c
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov edx, eax
call fcn.1401887c0
nop
mov rcx, qword [rsp + 0x40]
call fcn.140139190
nop
jmp 0x1401c3f62
mov eax, dword [rsp + 0x20]
add rsp, 0xa8
ret
Function at 0x1401d6b10
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x1c], 1
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x58]
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rcx, qword [rsp + 0x50]
call fcn.14017d110
cmp dword [rsp + 0x60], 0
jne 0x1401d6b91
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, qword [rsp + 0x50]
call fcn.14017d110
nop
add rsp, 0x48
ret