joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e7a20
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r9
mov ebx, r8d
mov r14, rdx
test r8d, r8d
je 0x1400e7a88
mov esi, dword [rsp + 0x50]
nop dword [rax]
mov r9d, 2
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call sub.WSOCK32.dll_recv
mov edi, eax
cmp eax, esi
je 0x1400e7aa8
cmp eax, 0xffffffff
je 0x1400e7ab9
mov ecx, PathResolve
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, PathResolve
cmp ebx, eax
cmovb eax, ebx
sub ebx, eax
jne 0x1400e7a50
mov eax, 2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call sub.WSOCK32.dll_recv
test ebx, ebx
je 0x1400e7a88
cmp edi, 0xffffffff
jne 0x1400e7ac7
lea eax, [rdi + 4]
jmp 0x1400e7a8d
xor eax, eax
mov ecx, 4
test edi, edi
cmove eax, ecx
jmp 0x1400e7a8d

Function at 0x1400ea2b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rcx
mov rdi, r9
mov ecx, 0x1050
mov rsi, r8
mov rbp, rdx
call fcn.140247068
mov rbx, rax
test rax, rax
je 0x1400ea38d
lea rcx, [rax + 8]
xor edx, edx
mov r8d, 0x1048
call fcn.140249b10
mov qword [rbx], r14
test rbp, rbp
je 0x1400ea312
lea rcx, [rbx + 8]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
test rsi, rsi
je 0x1400ea327
lea rcx, [rbx + 0x418]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
test rdi, rdi
je 0x1400ea33c
lea rcx, [rbx + 0x828]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400ea353
lea rcx, [rbx + 0xc38]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [rsp + 0x78]
lea r8, [0x1400ea3b0]
mov dword [rbx + 0x1048], eax
mov r9, rbx
lea rax, [rsp + 0x30]
mov edx, 0x100000
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140351880], rax
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400ea400
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0xb0
mov ebx, ecx
lea rdx, str.IMGPartnerSplash.bmp
xor esi, esi
mov dword [rsp + 0x28], 0x2050
xor ecx, ecx
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_LoadImageA]
mov qword [0x140351890], rax
test rax, rax
jne 0x1400ea470
mov rcx, qword [0x14034e658]
xor r9d, r9d
movzx edx, bx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2040
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_LoadImageA]
mov qword [0x140351890], rax
test rax, rax
je 0x1400ea5d8
lea r8, [rsp + 0x40]
mov qword [rsp + 0xc0], rdi
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetObjectA]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cdq
mov ecx, 1
sub eax, edx
sar eax, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov dword [rsp + 0x60], esi
cdq
mov qword [rsp + 0x70], rsi
sub eax, edx
mov qword [rsp + 0x80], rsi
sar eax, 1
mov edi, eax
mov eax, dword [rsp + 0x44]
cdq
sub eax, edx
sar eax, 1
neg eax
add ebx, eax
mov eax, dword [rsp + 0x48]
cdq
sub eax, edx
mov edx, 0x7f00
sar eax, 1
neg eax
add edi, eax
lea rax, [0x1400ea6a0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14034e658]
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x90], xmm0
lea rax, str.SASSPLASHSCREEN
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
lea rax, [rsp + 0xc8]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x1400ea5f0]
mov edx, 0x10000
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp qword [0x140351888], 0
mov rsi, rax
jne 0x1400ea575
nop
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140351888], 0
je 0x1400ea560
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
mov r9d, edi
mov rcx, qword [0x140351888]
mov r8d, ebx
mov dword [rsp + 0x30], 0x40
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x140351888]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [0x140351888]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rdi, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rsi
ret
Function at 0x1400ea840
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x450
mov rbx, rdx
mov rdi, rcx
cmp r8d, 0x400
jne 0x1400ea943
mov rcx, qword [0x140351838]
lea rdx, [rsp + 0x478]
mov qword [rsp + 0x28], rdx
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
xor r9d, r9d
mov dword [rsp + 0x20], 0x20019
mov rdx, 0xffffffff80000001
mov rax, qword [rcx]
call qword [rax + 0x128]
test eax, eax
jne 0x1400ea943
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x410
call fcn.140249b10
mov rcx, qword [0x140351838]
lea rdx, [rsp + 0x470]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov dword [rsp + 0x470], 0x410
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
mov r8, rdi
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x478]
mov qword [rsp + 0x20], 0
call qword [rax + 0x170]
mov rcx, qword [0x140351838]
test eax, eax
mov rdx, qword [rsp + 0x478]
mov rax, qword [rcx]
jne 0x1400ea93d
call qword [rax + pe_nt_image_headers64]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400ea943
mov eax, 1
mov rbx, qword [rsp + 0x460]
add rsp, 0x450
pop rdi
ret
call qword [rax + pe_nt_image_headers64]
mov rbx, qword [rsp + 0x460]
xor eax, eax
add rsp, 0x450
pop rdi
ret

Function at 0x1400ea960
Capabilities:
Persist via run registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
mov edi, r9d
mov rbx, rdx
mov rsi, rcx
cmp r8d, 0x400
jne 0x1400eaa4d
mov rcx, qword [0x140351838]
lea rdx, [r11 - 0x18]
xor r8d, r8d
xor r9d, r9d
mov qword [r11 - 0x20], r8
mov qword [r11 - 0x28], rdx
mov rdx, 0xffffffff80000001
mov rax, qword [rcx]
mov qword [r11 - 0x30], r8
mov dword [rsp + 0x30], 0x20006
mov dword [r11 - 0x40], r8d
mov qword [r11 - 0x48], r8
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
call qword [rax + 0x118]
test eax, eax
jne 0x1400eaa4d
mov rcx, qword [0x140351838]
test edi, edi
je 0x1400eaa5f
mov r10, qword [rcx]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400ea9e7
mov rdx, qword [rsp + 0x50]
inc eax
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov r8, rsi
mov dword [rsp + 0x20], 1
call qword [r10 + 0x1b0]
mov rcx, qword [0x140351838]
mov rdx, qword [rsp + 0x50]
test eax, eax
jne 0x1400eaa44
mov r8, qword [rcx]
call qword [r8 + pe_nt_image_headers64]
mov eax, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rcx]
mov r8, rsi
mov rdx, qword [rsp + 0x50]
call qword [rax + 0x180]
mov rcx, qword [0x140351838]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rbx, qword [rsp + 0x70]
mov eax, 1
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400eaaa0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xca0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov r8d, r9d
xor edx, edx
mov rcx, rbx
call fcn.140249b10
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x1400eab49
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rax, qword [0x140351838]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14003fbb0
nop
lea rcx, [rsp + 0x40]
call fcn.14003fed0
nop
lea rcx, [rsp + 0x40]
call fcn.14003fd70
mov eax, 1
jmp 0x1400eab4b
xor eax, eax
lea r11, [rsp + 0xca0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400eab60
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xca0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov ebx, ecx
mov r8d, dword [rsp + 0xcd0]
xor edx, edx
mov rcx, r9
call fcn.140249b10
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x1400eac12
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rax, qword [0x140351838]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14003fbb0
nop
lea rcx, [rsp + 0x40]
call fcn.14003fed0
nop
lea rcx, [rsp + 0x40]
call fcn.14003fd70
mov eax, 1
jmp 0x1400eac14
xor eax, eax
lea r11, [rsp + 0xca0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400eac30
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov edx, ecx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x38
ret
Function at 0x1400f7a60
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x870
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
call fcn.1400f7f50
mov r8, rbx
lea rcx, [rsp + 0x50]
mov edx, 0x410
call fcn.140251ec0
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r8, [0x1402b6c38]
mov edx, 0x410
lea rcx, [rsp + 0x50]
call fcn.140251e40
xor ebx, ebx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f7b65
mov r8, rsi
lea rcx, [rsp + 0x50]
mov edx, 0x410
call fcn.140251ec0
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea r8, [0x1402b6c38]
mov edx, 0x410
lea rcx, [rsp + 0x50]
call fcn.140251e40
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov dword [rsp + 0x28], ebx
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400f7b65
xor eax, eax
jmp 0x1400f7c13
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp dword [rsp + 0x40], ebx
jne 0x1400f7c05
mov ecx, esi
call fcn.140247068
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rbx
mov r8d, esi
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, dword [rsp + 0x44]
jne 0x1400f7bfd
test esi, esi
je 0x1400f7bfd
nop dword [rax]
mov eax, esi
sub eax, ebx
cmp eax, 4
jb 0x1400f7bf6
mov eax, ebx
movzx r9d, byte [rax + rdi]
lea eax, [r9 - 1]
cmp al, 0x2f
ja 0x1400f7bf6
lea edx, [rbx + 3]
movzx ecx, byte [rdx + rdi]
lea eax, [rdx - 1]
movzx r8d, byte [rax + rdi]
lea eax, [rdx - 2]
movzx eax, byte [rax + rdi]
shl ecx, 0x10
shl r8d, 8
or r8d, ecx
movzx ecx, r9b
or r8d, eax
mov rax, qword [r14]
mov dword [rax + rcx*4], r8d
add ebx, 4
cmp ebx, esi
jb 0x1400f7bb0
mov rcx, rdi
call fcn.140247060
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400f7c40
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1020
call fcn.140247340
sub rsp, rax
mov edi, edx
lea rbx, [rcx + 0x38]
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
call fcn.14006d170
test eax, eax
je 0x1400f7d94
test edi, edi
je 0x1400f7d84
xor edx, edx
mov qword [rsp + 0x1048], rbp
mov r8d, 0x1000
lea rcx, [rsp + 0x20]
call fcn.140249b10
mov r8, qword [rsi + 0x28]
lea rdx, str.SELECT_1_FROM__s_WHERE_10
lea rcx, [rsp + 0x20]
call fcn.140006bc0
lea rdi, [rsi + 0x78]
mov qword [rsp + 0x1040], 0
mov rcx, rdi
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x1400f7ce6
mov rax, qword [rcx]
lea r8, [rsp + 0x1040]
xor r9d, r9d
lea rdx, [rsp + 0x20]
call qword [rax]
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebp, ebp
mov rbp, qword [rsp + 0x1048]
je 0x1400f7d1b
mov rdx, qword [rsp + 0x1040]
mov rcx, rbx
call fcn.140075720
mov eax, 1
add rsp, 0x1020
pop rdi
pop rsi
pop rbx
ret
mov r8, qword [rsi + 0x28]
lea rdx, str.CREATE_TABLE__s___id_INTEGER__name_TEXT_COLLATE_NOCASE__type_INTEGER__data_BLOB__PRIMARY_KEY_id_asc___
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x1050], 0
call fcn.140006bc0
mov rcx, rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400f7d67
mov rax, qword [rcx]
lea r8, [rsp + 0x1050]
xor r9d, r9d
lea rdx, [rsp + 0x20]
call qword [rax]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1400f7d94
mov rdx, qword [rsp + 0x1050]
mov rcx, rbx
call fcn.140075720
mov eax, 1
add rsp, 0x1020
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x1020
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f7db0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x1050
call fcn.140247340
sub rsp, rax
mov r15d, r8d
mov rbx, rdx
mov r14, rcx
lea r8d, [rax - 0x50]
xor edx, edx
lea rcx, [rsp + 0x50]
mov rsi, r9
xor edi, edi
call fcn.140249b10
mov r8, qword [r14 + 0x28]
lea rdx, str.SELECT__FROM__s_WHERE_name_s
mov r9, rbx
lea rcx, [rsp + 0x50]
call fcn.140006bc0
lea rcx, [r14 + 0x78]
mov qword [rsp + 0x1070], rdi
mov ebp, edi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [r14 + 0x68]
test rcx, rcx
je 0x1400f7e3b
mov rax, qword [rcx]
lea r8, [rsp + 0x1070]
xor r9d, r9d
lea rdx, [rsp + 0x50]
call qword [rax]
mov ebp, eax
lea rcx, [r14 + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebp, ebp
je 0x1400f7f2a
mov rcx, qword [rsp + 0x1070]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rdi
lea r8, str.type
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400f7efb
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400f7efb
call fcn.1402520ac
cmp eax, r15d
jne 0x1400f7efb
mov rcx, qword [rsp + 0x1070]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x38]
mov qword [rsp + 0x30], rdi
lea r8, str.data
mov qword [rsp + 0x28], rdi
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [rax + 0x38]
test eax, eax
je 0x1400f7efb
cmp qword [rsp + 0x38], rdi
je 0x1400f7efb
mov edx, dword [rsp + 0x30]
mov rcx, rsi
call fcn.14002dd10
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400f7ef6
mov rax, qword [rsp + 0x30]
cmp eax, dword [rsi + 0x10]
ja 0x1400f7ef6
mov rdx, qword [rsp + 0x38]
mov r8d, eax
call fcn.1402496a0
mov edi, 1
mov rsi, qword [rsp + 0x1070]
lea rcx, [r14 + 0x78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [r14 + 0x68]
test rcx, rcx
je 0x1400f7f20
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [r14 + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x1050]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400f8a50
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf40]
mov eax, 0x1040
call fcn.140247340
sub rsp, rax
mov r12d, r8d
mov r13, rdx
mov rsi, rcx
lea r8d, [rax - 0x40]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r15, r9
xor ebx, ebx
call fcn.140249b10
mov r8, qword [rsi + 0x28]
lea rdx, str.SELECT_type_FROM__s_WHERE_name_s
mov r9, r13
lea rcx, [rsp + 0x40]
call fcn.140006bc0
lea rcx, [rsi + 0x78]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r14d, ebx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x1400f8ae8
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
xor r9d, r9d
lea rdx, [rsp + 0x40]
call qword [rax]
mov r14d, eax
lea rcx, [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r14d, r14d
je 0x1400f8c19
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
lea r8, str.type
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x1400f8b4a
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400f8b4a
call fcn.1402520ac
cmp eax, r12d
jne 0x1400f8bed
mov r8, qword [rsi + 0x28]
lea rdx, str.UPDATE__s_SET_data_1_WHERE_name_s
mov r9, r13
lea rcx, [rsp + 0x40]
call fcn.140006bc0
jmp 0x1400f8b67
mov r8, qword [rsi + 0x28]
lea rdx, str.INSERT_INTO__s___name__type__data___VALUES____s___d___1__
mov r9, r13
mov dword [rsp + 0x20], r12d
lea rcx, [rsp + 0x40]
call fcn.140006bc0
lea rcx, [rsi + 0x78]
mov qword [rbp + 0xf70], rbx
mov r14d, ebx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x1400f8b9e
mov rax, qword [rcx]
lea r8, [rbp + 0xf70]
mov r9d, 1
lea rdx, [rsp + 0x40]
call qword [rax]
mov r14d, eax
lea rcx, [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r14d, r14d
je 0x1400f8bed
mov rcx, qword [rbp + 0xf70]
mov edx, 1
mov r9d, dword [r15 + 0x10]
mov r8, qword [r15 + 8]
mov dword [rsp + 0x20], ebx
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbp + 0xf70]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rdx, qword [rbp + 0xf70]
lea rcx, [rsi + 0x38]
mov ebx, 1
call fcn.140075720
mov r14, qword [rsp + 0x30]
lea rcx, [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x1400f8c0f
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x1040]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140116440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r15, rcx
mov r14d, edx
mov r12d, r9d
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r13, qword [r11]
mov r10, qword [rax + 8]
movsxd rax, dword [r10 + 0x30]
movsxd r10, dword [r11 + 0x30]
cmp eax, r10d
mov qword [rsp + 0x20], rax
mov ecx, r10d
cmovl ecx, eax
xor ebx, ebx
imul r14, rax
mov dword [rsp + 0x78], ecx
mov rcx, rax
cmp eax, r10d
je 0x1401164a3
cmp byte [r13 + 0x13], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r14
sub rdi, rcx
test ebx, ebx
jne 0x1401165ae
mov qword [rsp + 0x88], rbp
mov rbp, r10
mov qword [rsp + 0x30], rsi
cmp rdi, r14
jge 0x140116590
mov rax, rdi
mov qword [rsp + 0x70], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x14033a700]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x140116585
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, r10d
mov rcx, r13
call fcn.140153e20
mov ebx, eax
test eax, eax
jne 0x140116576
mov rcx, qword [rsp + 0x70]
call fcn.140155cf0
mov ebx, eax
test eax, eax
jne 0x140116576
mov rax, qword [rsp + 0x70]
movsxd r8, dword [rsp + 0x78]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x20]
add rdx, qword [rsp + 0x80]
call fcn.1402496a0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x140116576
test r12d, r12d
jne 0x140116576
mov rax, qword [r15 + 0x28]
mov rcx, qword [rax + 8]
mov eax, dword [rcx + 0x3c]
bswap eax
mov dword [rsi + 0x1c], eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140116585
call fcn.140155c40
add rdi, rbp
test ebx, ebx
je 0x1401164c1
mov rsi, qword [rsp + 0x30]
mov eax, ebx
mov rbp, qword [rsp + 0x88]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x140122db0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [rcx + 0x10]
lea rsi, [0x1402bae60]
xor r9d, r9d
mov r11, rdx
mov r10, rcx
test rbx, rbx
je 0x140122e1b
movzx eax, byte [rdx]
test al, al
je 0x140122dff
nop
movzx eax, al
lea rdx, [rdx + 1]
movzx ecx, byte [rax + rsi]
lea eax, [r9*8]
xor ecx, eax
movzx eax, byte [rdx]
xor r9d, ecx
test al, al
jne 0x140122de0
mov eax, r9d
xor edx, edx
div dword [r10]
mov eax, edx
shl rax, 4
add rax, rbx
mov r9d, edx
mov rbx, qword [rax + 8]
mov edi, dword [rax]
jmp 0x140122e22
mov rbx, qword [rcx + 8]
mov edi, dword [rcx + 4]
mov dword [r8], r9d
test edi, edi
je 0x140122ea2
nop dword [rax]
mov r10, qword [rbx + 0x18]
dec edi
test r10, r10
jne 0x140122e45
mov rax, r11
neg rax
sbb edx, edx
jmp 0x140122e97
test r11, r11
je 0x140122e9b
movzx r9d, byte [r10]
mov r8, r11
test r9b, r9b
je 0x140122e85
movzx eax, r9b
sub r10, r11
nop dword [rax]
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + rsi]
cmp byte [rcx + rsi], al
jne 0x140122e85
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x140122e60
movzx eax, byte [r8]
movzx ecx, byte [rax + rsi]
movzx eax, r9b
movzx edx, byte [rax + rsi]
sub edx, ecx
test edx, edx
je 0x140122eb4
mov rbx, qword [rbx]
test edi, edi
jne 0x140122e30
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rsi, qword [rsp + 0x10]
mov rax, rbx
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x18]
ret