joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002c060
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test r9d, r9d
jne 0x18002c133
cmp dword [rcx + 0x3c], r9d
je 0x18002c133
mov eax, dword [r8]
lea ebx, [r9 + 0x10]
and eax, 0xf
je 0x18002c09b
sub ebx, eax
mov ecx, dword [rdi]
mov r8d, ebx
add rcx, rdx
mov edx, ebx
call fcn.1800e96b0
add dword [rdi], ebx
mov edx, 0
je 0x18002c121
nop word [rax + rax]
mov rax, qword [rbp + 0x58]
movsxd rcx, edx
add edx, 0x10
movdqu xmm0, xmmword [rcx + rsi]
pxor xmm0, xmmword [rax]
aesenc xmm0, xmmword [rax + 0x10]
aesenc xmm0, xmmword [rax + 0x20]
aesenc xmm0, xmmword [rax + 0x30]
aesenc xmm0, xmmword [rax + 0x40]
aesenc xmm0, xmmword [rax + 0x50]
aesenc xmm0, xmmword [rax + 0x60]
aesenc xmm0, xmmword [rax + 0x70]
aesenc xmm0, xmmword [rax + 0x80]
aesenc xmm0, xmmword [rax + 0x90]
aesenclast xmm0, xmmword [rax + 0xa0]
movdqu xmmword [rcx + rsi], xmm0
cmp edx, dword [rdi]
jb 0x18002c0c0
mov eax, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [r8]
mov ebx, eax
test r9d, r9d
je 0x18002c205
mov rsi, qword [rcx + 0x10]
test rsi, rsi
cmove rsi, qword [0x18012e778]
add ebx, 0x200
cmp eax, 0x1f4
jbe 0x18002c20c
mov rcx, qword [rsp + 0x78]
add eax, 0xfffffe0c
mov dword [rsp + 0x88], 0x1f4
lea r9, [rcx + 0x200]
lea rdx, [rcx + 0x1f4]
mov r8d, eax
mov rcx, r9
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], r9
call fcn.1800e7bc0
lea rax, [rsp + 0x88]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
xor r9d, r9d
lea r8d, [r9 + 1]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [0x18012e230]
mov r11d, eax
test eax, eax
je 0x18002c234
mov rdx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
mov r9d, 1
mov rcx, rbp
call fcn.18002c060
mov r11d, eax
test eax, eax
je 0x18002c234
mov ecx, dword [rsp + 0x88]
add ecx, dword [rsp + 0x40]
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rsi, qword [rcx + 8]
add ebx, 0x10
mov rax, qword [rsp + 0x78]
xor r9d, r9d
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r8
lea r8d, [r9 + 1]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [0x18012e230]
mov r11d, eax
mov eax, r11d
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002f340
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea r10, [rcx + 0x638]
mov r11d, 0x68
nop dword [rax]
mov r8d, dword [r10 - 0x630]
mov r9d, dword [r10 - 0x62c]
mov edx, dword [r10 - 0x634]
xor edx, r8d
btr edx, 0x1f
xor edx, dword [r10 - 0x634]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
mov edx, r9d
xor ecx, dword [r10]
xor edx, r8d
btr edx, 0x1f
mov dword [r10 + 0x38c], ecx
xor edx, r8d
mov r8d, dword [r10 - 0x628]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 4]
xor ecx, edx
mov edx, r8d
xor edx, r9d
mov dword [r10 + 0x390], ecx
btr edx, 0x1f
xor edx, r9d
mov r9d, dword [r10 - 0x624]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 8]
xor ecx, edx
mov edx, r9d
xor edx, r8d
mov dword [r10 + 0x394], ecx
btr edx, 0x1f
xor edx, r8d
mov r8d, dword [r10 - 0x620]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0xc]
xor ecx, edx
mov edx, r8d
xor edx, r9d
mov dword [r10 + 0x398], ecx
btr edx, 0x1f
xor edx, r9d
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x10]
xor ecx, edx
mov edx, dword [r10 - 0x61c]
xor edx, r8d
mov dword [r10 + 0x39c], ecx
btr edx, 0x1f
xor edx, r8d
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x14]
shr edx, 1
xor ecx, edx
add r10, 0x18
dec r11
mov dword [r10 + 0x388], ecx
jne 0x18002f350
repz ret

Function at 0x18002ff40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbx, rdx
xor edx, edx
mov rsi, rcx
call fcn.180037ae0
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18002ffea
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rdi
call qword [rsi + 0x20e8]
cmp eax, 0x1400000
jae 0x18002ff94
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [rsi + 0x20f0]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
movsxd rdx, ecx
test ecx, ecx
jle 0x18002ffbe
mov edi, 0x1234
xor word [rbx + rax*2], di
inc rax
cmp rax, rdx
jl 0x18002ffb2
lea r8d, [rcx + rcx]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x20], 0
call qword [rsi + 0x20f8]
mov rcx, rbp
call qword [rsi + 0x2100]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x180039080
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x220
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1801270d0]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
lea rax, [0x180111c10]
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 0x20], rsi
lea ecx, [rsi + 0x18]
call fcn.18005f544
test rax, rax
je 0x18003924f
mov qword [rdi + 0x18], rax
mov qword [rax], rax
mov rax, qword [rdi + 0x18]
mov qword [rax + 8], rax
lea rcx, [rdi + 0x30]
call fcn.180027a50
nop
mov dword [rdi + 0x7c], esi
mov dword [rdi + 0x80], 0x19000
mov dword [rdi + 0x84], 0x32000
mov qword [rdi + 0x90], rsi
mov rax, qword [0x18012e938]
test rax, rax
cmove rax, rdi
mov qword [0x18012e938], rax
mov ecx, 0x54a4a038
call fcn.1800061a0
mov qword [rdi + 0x98], rax
mov ecx, 0x54afa018
call fcn.180051c90
mov qword [rdi + 0xc8], rax
mov ecx, 0x54afa003
call fcn.180051c90
mov qword [rdi + 0xd8], rax
mov ecx, 0x54afa01e
call fcn.180051c90
mov qword [rdi + 0xd0], rax
mov ecx, 0x54a4a037
call fcn.1800061a0
mov qword [rdi + 0xa0], rax
mov ecx, 0x54a4a065
call fcn.1800061a0
mov qword [rdi + 0xa8], rax
mov ecx, 0x54a4a010
call fcn.1800061a0
mov qword [rdi + 0xb0], rax
mov ecx, 0x54afa015
call fcn.180051c90
mov qword [rdi + 0xb8], rax
mov ecx, 0x54afa01b
call fcn.180051c90
mov qword [rdi + 0xc0], rax
mov ebx, 0x202
mov ecx, 0x54afa01f
call fcn.180051c90
lea rdx, [rsp + 0x70]
movzx ecx, bx
call rax
mov ecx, 0x54a4a02e
call fcn.1800061a0
lea rcx, [rdi + 0x50]
call rax
mov ecx, 0x54a4a07d
call fcn.1800061a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
call rax
mov qword [rdi + 0x88], rax
mov ecx, 0x54a4a03a
call fcn.1800061a0
lea rcx, [rsp + 0x38]
call rax
mov r11d, dword [rsp + 0x58]
add r11d, 3
mov dword [rdi + 0x10], esi
mov dword [rdi + 0x78], esi
je 0x180039246
mov ebx, r11d
nop dword [rax]
mov r8, rdi
xor edx, edx
lea rcx, [0x18003fea0]
call fcn.180032ed4
dec rbx
jne 0x180039230
mov qword [rdi + 8], rsi
mov rax, rdi
jmp 0x180039281
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001aff8
lea r11, vtable.std::bad_alloc.0
mov qword [rsp + 0x38], r11
lea rdx, [0x1801230a0]
lea rcx, [rsp + 0x38]
call fcn.180048e54
int3
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1800e7b90
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180044a60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rdi
mov eax, 0x1430
call fcn.1800ec780
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1448], rbx
mov qword [rsp + 0x1450], rsi
movaps xmmword [rsp + 0x1420], xmm6
movaps xmmword [rsp + 0x1410], xmm7
movaps xmmword [rsp + 0x1400], xmm8
movaps xmmword [rsp + 0x13f0], xmm9
mov rax, qword [0x1801270d0]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov edi, edx
mov rsi, rcx
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [0x180109eb2]
lea rcx, [rsp + 0x20]
call fcn.1800535c0
nop
call fcn.18004af74
nop
cmp qword [rsp + 0x38], 0x10
jb 0x180044b05
mov rcx, qword [rsp + 0x20]
call fcn.180014a38
call fcn.18004af74
mov r11d, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov edx, 1
mov ecx, edx
nop word [rax + rax]
mov eax, r11d
shr eax, 0x1e
xor r11d, eax
imul r11d, r11d, 0x6c078965
add r11d, edx
mov dword [rsp + rcx*4 + 0x54], r11d
inc edx
inc rcx
cmp rcx, 0x270
jl 0x180044b30
mov edx, 0x270
mov dword [rsp + 0x50], edx
test edi, edi
je 0x180044c37
movsd xmm6, qword [0x180111d58]
xorpd xmm8, xmm8
subsd xmm6, xmm8
addsd xmm6, qword [0x180111d60]
movsd xmm9, qword [0x180112d48]
movapd xmm7, xmm9
subsd xmm7, xmm8
addsd xmm7, qword [0x180111d60]
mov rbx, rsi
nop
cmp edx, 0x270
jne 0x180044bb4
lea rcx, [rsp + 0x50]
call fcn.18002f340
jmp 0x180044bc6
cmp edx, 0x4e0
jb 0x180044bca
lea rcx, [rsp + 0x50]
call fcn.18005c260
mov edx, dword [rsp + 0x50]
mov eax, edx
mov ecx, dword [rsp + rax*4 + 0x54]
inc edx
mov dword [rsp + 0x50], edx
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13d4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm0, xmm6
mulsd xmm0, xmm7
addsd xmm0, xmm8
comisd xmm0, xmm9
mov eax, 0xff
jae 0x180044c29
cvttsd2si eax, xmm0
mov byte [rbx], al
inc rbx
dec rdi
jne 0x180044ba0
mov rax, rsi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1800e7b90
lea r11, [rsp + 0x1430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rdi
ret
Function at 0x1800492a4
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov edi, ecx
call sym.WWStartupCtrl64.dll_sqlite3_initialize
test eax, eax
jne 0x18004941d
cmp byte [0x180128b74], al
jne 0x1800492d6
xor ebx, ebx
jmp 0x1800492f2
mov ecx, 5
call qword [0x180128be0]
mov rbx, rax
test rax, rax
je 0x1800492f2
mov rcx, rax
call qword [0x180128bf0]
test edi, edi
jle 0x180049408
test rbp, rbp
je 0x180049408
cmp dword [0x18012e250], 0
jne 0x180049392
xor ecx, ecx
call sym.WWStartupCtrl64.dll_sqlite3_vfs_find
movups xmm0, xmmword [str.expand_32_byte_k]
movdqu xmmword [0x18012e250], xmm0
test rax, rax
jne 0x18004933f
lea r8d, [rax + 0x2c]
lea rcx, [0x18012e260]
xor edx, edx
call fcn.1800e96b0
jmp 0x180049375
mov esi, dword [0x180128d20]
test esi, esi
je 0x180049363
xor edx, edx
lea rcx, [0x18012e260]
lea r8d, [rdx + 0x2c]
call fcn.1800e96b0
mov dword [0x18012e260], esi
jmp 0x180049375
lea r8, [0x18012e260]
mov edx, 0x2c
mov rcx, rax
call qword [rax + 0x68]
mov eax, dword [0x18012e280]
and dword [0x18012e280], 0
xor cl, cl
mov dword [0x18012e28c], eax
mov byte [0x18012e2d0], cl
jmp 0x180049398
mov cl, byte [0x18012e2d0]
movzx eax, cl
lea rsi, [0x18012e290]
cmp edi, eax
jle 0x1800493e9
test cl, cl
je 0x1800493c7
movzx r8d, cl
mov rdx, rsi
mov rcx, rbp
call fcn.1800e7bc0
movzx r11d, byte [0x18012e2d0]
sub edi, r11d
add rbp, r11
inc dword [0x18012e280]
lea rdx, [0x18012e250]
mov rcx, rsi
call fcn.180068864
mov cl, 0x40
mov byte [0x18012e2d0], cl
cmp edi, 0x40
jg 0x1800493a6
movzx eax, cl
movsxd r8, edi
mov rcx, rbp
sub eax, edi
movsxd rdx, eax
add rdx, rsi
call fcn.1800e7bc0
sub byte [0x18012e2d0], dil
jmp 0x18004940f
and dword [0x18012e250], 0
test rbx, rbx
je 0x18004941d
mov rcx, rbx
call qword [0x180128c00]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18004c080
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x18012e8d8]
cmp qword [rbx + 0xa0], 0
je 0x18004c09f
xor al, al
add rsp, 0x20
pop rbx
ret
mov r9d, 1
lea r8, [0x180111aa8]
xor edx, edx
mov ecx, r9d
mov qword [rsp + 0x30], rdi
call fcn.180060f80
mov rdi, rax
test rax, rax
je 0x18004c0e5
mov ecx, 0x54a4a04a
call fcn.1800061a0
call rax
cmp eax, 0xb7
jne 0x18004c0f2
mov ecx, 0x54a4a07b
call fcn.1800061a0
mov rcx, rdi
call rax
xor al, al
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
mov qword [rbx + 0xa0], rdi
call fcn.180042cf0
lea rcx, [0x180052b70]
mov r8, rbx
xor edx, edx
mov qword [rbx + 0x18], 1
call fcn.180032ed4
mov ecx, 0xc8
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18005c260
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r9, rcx
lea r10, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r10]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
add r10, 4
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
dec r11
mov dword [r10 - 0x9c4], ecx
jne 0x18005c270
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
nop word [rax + rax]
mov edx, dword [r10 + 4]
xor edx, dword [r10]
btr edx, 0x1f
xor edx, dword [r10]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
add r10, 4
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
dec r11
mov dword [r10 - 0x9c4], ecx
jne 0x18005c2c0
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov dword [r9], r11d
ret

Function at 0x180062c70
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov qword [rcx + 0x18], rdx
mov rbx, rcx
mov r8, rcx
lea rcx, [0x180052b70]
xor edx, edx
call fcn.180032ed4
mov ecx, 0xc8
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x20]
add rsp, 0x20
pop rbx
ret

Function at 0x180064d20
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10108], 0
mov rdi, rcx
je 0x180064de4
xor r11d, r11d
cmp dword [rcx + 0xd4], r11d
jbe 0x180064de4
lea r10, [rcx + 0x100]
movzx eax, byte [r10]
mov r8, qword [rdi + 0x10138]
mov edx, dword [rdi + 0x10128]
mov r9d, dword [rdi + 0x10130]
xor rax, rdx
shr edx, 8
movzx ecx, al
and r9d, 0xfffd
inc r11d
mov eax, dword [r8 + rcx*4]
or r9d, 2
inc r10
xor eax, edx
mov edx, dword [rdi + 0x10130]
mov dword [rdi + 0x10128], eax
movzx eax, al
add eax, dword [rdi + 0x1012c]
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
mov dword [rdi + 0x1012c], eax
shr ecx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [r8 + rax*4]
xor eax, edx
mov dword [rdi + 0x10130], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
shr eax, 8
xor byte [r10 - 1], al
cmp r11d, dword [rdi + 0xd4]
jb 0x180064d51
mov r9d, dword [rdi + 0xd4]
mov rdx, qword [rdi + 0x58]
mov rcx, qword [rdi + 0x38]
mov ebx, dword [rdi + 0xd4]
lea r8, [rdi + 0x100]
call qword [rdi + 0x10]
or ecx, 0xffffffff
xor edx, edx
cmp eax, ebx
mov dword [rdi + 0xd4], 0
cmovne edx, ecx
mov ecx, dword [rdi + 0x84]
add qword [rdi + 0x10118], rbx
mov rbx, qword [rsp + 0x30]
add qword [rdi + 0x10120], rcx
mov dword [rdi + 0x84], 0
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x18007268c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor esi, esi
xor r12d, r12d
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1800726d6
mov ebp, dword [rdx + 0x18]
mov ecx, 0x200
call fcn.180067f84
mov r12, rax
test rax, rax
je 0x1800726cc
mov dword [rax], ebp
mov eax, dword [rdi + 0x18]
jmp 0x1800726d9
mov eax, 7
jmp 0x1800728a4
mov eax, dword [rcx + 0x24]
mov dword [rbx + 0x20], eax
mov al, byte [rbx + 0x10]
mov byte [rbx + 0x17], al
test rdi, rdi
jne 0x1800726fd
cmp qword [rbx + 0x128], rsi
je 0x1800726fd
mov rcx, rbx
call fcn.18007241c
jmp 0x1800728a4
mov r14, qword [rbx + 0x60]
test rdi, rdi
je 0x180072754
cmp qword [rbx + 0x128], rsi
jne 0x180072754
cmp qword [rdi + 8], rsi
mov rax, qword [rdi]
mov r13, r14
cmovne r13, qword [rdi + 8]
mov qword [rbx + 0x60], rax
cmp qword [rbx + 0x60], r13
jge 0x1800727f9
lea rdx, [rbx + 0x60]
mov r9d, 1
mov r8, r12
mov rcx, rbx
mov dword [rsp + 0x20], 1
call fcn.180071978
mov esi, eax
test eax, eax
je 0x180072722
jmp 0x1800727f9
and qword [rbx + 0x60], rsi
jmp 0x1800727f9
cmp qword [rbx + 0x60], r14
jge 0x180072801
and dword [rsp + 0x78], 0
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x78]
mov r8, r14
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1800710c4
mov r15d, dword [rsp + 0x78]
mov esi, eax
test r15d, r15d
jne 0x1800727c1
mov eax, dword [rbx + 0xb8]
add rax, qword [rbx + 0x68]
cmp rax, qword [rbx + 0x60]
jne 0x1800727c1
mov rcx, qword [rbx + 0xc8]
mov rax, r14
sub rax, qword [rbx + 0x60]
add rcx, 8
cqo
idiv rcx
mov r15, rax
xor r13d, r13d
test esi, esi
jne 0x180072801
cmp r13d, r15d
jae 0x1800727f9
cmp qword [rbx + 0x60], r14
jge 0x1800727f9
lea rdx, [rbx + 0x60]
mov r9d, 1
mov r8, r12
mov rcx, rbx
mov dword [rsp + 0x20], 1
call fcn.180071978
inc r13d
mov esi, eax
test eax, eax
je 0x1800727c8
test esi, esi
je 0x18007275d
test rdi, rdi
je 0x180072892
mov rcx, qword [rbx + 0xc8]
mov eax, dword [rdi + 0x1c]
add rcx, 4
imul rcx, rax
mov qword [rsp + 0x78], rcx
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x180072863
mov eax, dword [rcx + 0x88]
cmp dword [rdi + 0x30], eax
je 0x180072845
and dword [rdi + 0x24], 0
mov eax, dword [rcx + 0x88]
mov dword [rdi + 0x30], eax
mov eax, dword [rdi + 0x24]
cmp eax, dword [rcx + 0x58]
jae 0x180072861
mov dword [rcx + 0x58], eax
mov eax, dword [rdi + 0x28]
mov dword [rcx + 0x60], eax
mov eax, dword [rdi + 0x2c]
mov dword [rcx + 0x64], eax
call fcn.180075884
xor esi, esi
mov edi, dword [rdi + 0x1c]
test esi, esi
jne 0x180072892
cmp edi, dword [rbx + 0x3c]
jae 0x180072892
lea rdx, [rsp + 0x78]
xor r9d, r9d
mov r8, r12
mov rcx, rbx
mov dword [rsp + 0x20], 1
call fcn.180071978
inc edi
mov esi, eax
test eax, eax
je 0x18007286a
mov rcx, r12
call fcn.18006f4e4
test esi, esi
jne 0x1800728a2
mov qword [rbx + 0x60], r14
mov eax, esi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180092d48
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov rcx, qword [rcx + 0x48]
xor eax, eax
test rcx, rcx
je 0x180092d7a
cmp dword [rcx + 0x20], eax
je 0x180092d72
mov rcx, qword [rcx]
lea rdx, [0x180092d1c]
add rsp, 0x28
jmp fcn.1800919bc
mov rcx, r8
call fcn.180092c18
add rsp, 0x28
ret

Function at 0x18009e208
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov r12d, dword [rsp + 0x70]
mov ebx, r8d
mov rbp, r9
mov dword [rax - 0x18], r12d
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
mov byte [rcx + 0x1c], 1
mov dword [rax - 0x28], ebx
call fcn.1800a3d8c
test ebx, ebx
jne 0x18009e271
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov r9, rbp
mov r8, rdi
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.1800a3d8c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x1800f5570
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov edi, r9d
mov rsi, r8
mov rbx, rcx
xor ebp, ebp
mov qword [rcx + 0x20], rbp
mov dword [rcx + 0x28], ebp
mov byte [rcx + 8], bpl
mov qword [rcx + 0x10], rdx
lea rax, [0x180111cb8]
mov qword [rcx], rax
add rcx, 0xcf0
call fcn.180049140
nop
cmp rsi, 1
jbe 0x1800f55d7
mov rax, qword [rsi + 0x88]
mov qword [rbx + 0xee8], rax
mov dword [rbx + 0x34], ebp
cmp edi, 1
je 0x1800f55ef
cmp edi, 4
je 0x1800f55ef
mov eax, 0x10
cmp edi, 8
cmovne edi, eax
mov ecx, 0x54aba0d8
call fcn.180051c90
mov qword [rbx + 0xe80], rax
mov ecx, 0x54a8a0f2
call fcn.180051c90
mov qword [rbx + 0xe88], rax
mov ecx, 0x54aba038
call fcn.180051c90
mov qword [rbx + 0xe90], rax
mov ecx, 0x54aba027
call fcn.180051c90
mov qword [rbx + 0xe98], rax
mov ecx, 0x54aba0d6
call fcn.180051c90
mov qword [rbx + 0xea0], rax
mov ecx, 0x54a4a038
call fcn.1800061a0
mov qword [rbx + 0xea8], rax
mov ecx, 0x54a8a0f7
call fcn.180051c90
mov qword [rbx + 0xeb0], rax
mov ecx, 0x54a8a0fb
call fcn.180051c90
mov qword [rbx + 0xeb8], rax
mov ecx, 0x54a8a0f5
call fcn.180051c90
mov qword [rbx + 0xec0], rax
mov ecx, 0x54a8a0fa
call fcn.180051c90
mov qword [rbx + 0xec8], rax
mov dword [rbx + 0xee0], edi
mov byte [rbx + 0xed1], 0
mov eax, dword [rsp + 0x60]
cmp eax, 0xcc0020
je 0x1800f56c1
cmp eax, 0x40cc0020
je 0x1800f56c1
mov dword [rbx + 0x30], 0xcc0020
jmp 0x1800f56c4
mov dword [rbx + 0x30], eax
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0xe28], rbp
mov byte [rbx + 0xed2], 0
mov word [rbx + 0xed4], 0
mov qword [rbx + 0xed8], rbp
mov qword [rbx + 0x18], rsi
mov r8, rbx
xor edx, edx
lea rcx, [0x180052b70]
call fcn.180032ed4
mov qword [rbx + 0x20], rax
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140004430]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004440]
mov dword [rax], 1
mov rax, qword [0x140004450]
mov dword [rax], 1
mov rax, qword [0x1400043e0]
cmp word [rax], 0x5a4d
jne 0x14000105e
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c8
mov rax, qword [0x140004420]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b8
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400044f0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400044d0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140004370]
cmp dword [rax], 1
je 0x140001100
xor eax, eax
add rsp, 0x20
pop rbp
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x14000107b
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001118
cmp dx, 0x20b
jne 0x14000105e
cmp dword [rax + 0x84], 0xe
jbe 0x14000105e
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105e
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x20
pop rbp
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105e
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105e

Function at 0x1400017b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, rcx
lea rax, [rbp + 0x28]
mov ecx, 2
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov qword [rbp - 8], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rbp - 8]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]