joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400449d0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400398fc
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400398fc
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140044b20
cmp rax, 0xffffffffffffffff
je 0x140044b20
xor edi, edi
test rbp, rbp
jle 0x140044acb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140034014
mov rbx, rax
test rax, rax
jne 0x140044a58
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140044ac1
mov edx, 0x8000
mov ecx, r14d
call fcn.14003100c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140037cd8
cmp eax, 0xffffffff
je 0x140044aa1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140044a68
mov edx, r15d
mov ecx, r14d
call fcn.14003100c
jmp 0x140044ac1
cmp byte [rsi + 0x38], dil
je 0x140044ab8
cmp dword [rsi + 0x34], 5
jne 0x140044ab8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140044ac1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14003408c
jmp 0x140044b34
jns 0x140044b34
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400398fc
cmp rax, 0xffffffffffffffff
jne 0x140044aec
cmp byte [rsi + 0x30], dil
je 0x140044b34
mov edi, dword [rsi + 0x2c]
jmp 0x140044b34
mov ecx, r14d
call fcn.14003d8dc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140044b34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140044b34
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140044b2d
mov eax, dword [rsi + 0x2c]
jmp 0x140044b32
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400398fc
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140045340
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140045368
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140045368
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800043b0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x8d8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x8c0], rax
mov rax, qword [rsp + 0x8f0]
mov rcx, qword [rax]
call qword [sym.imp.IMM32.dll_ImmGetContext]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800045d1
lea rcx, [rsp + 0x50]
call fcn.180007c00
nop
mov byte [rsp + 0x70], 1
call fcn.180004f90
mov qword [rsp + 0x78], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add rax, 2
mov dword [rsp + 0x30], eax
xor eax, eax
mov word [rsp + 0xc0], ax
lea rax, [rsp + 0xc2]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0xc0]
mov edx, 0x800
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xa0]
call fcn.180001750
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, str.OnHandleWM_IME:__s
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0x207
lea rdx, [0x18010fbe0]
lea rcx, [0x18010fc38]
call fcn.1800f8f60
lea rcx, [rsp + 0xa0]
call fcn.180001780
test rax, rax
jbe 0x1800045b0
mov eax, dword [0x180132650]
and eax, 1
test eax, eax
jne 0x18000450e
mov eax, dword [0x180132650]
or eax, 1
mov dword [0x180132650], eax
lea rcx, [0x180132658]
call fcn.180002b70
lea rcx, [0x18010af20]
call fcn.180106aa8
nop
lea rdx, [rsp + 0xa0]
lea rcx, [0x180132658]
call fcn.1800050b0
test eax, eax
jne 0x180004571
mov r8d, 0x30
mov rdx, qword [rsp + 0x8f0]
lea rcx, [0x180132440]
call sub.MSVCR120.dll_memcmp
test eax, eax
jne 0x180004571
lea rax, str.WARN:_Ignore_Repeat_IME_Message_
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0x211
lea rdx, [0x18010fd50]
lea rcx, str.CGlobalManager::OnHandleWM_IME
call fcn.1800f8f60
jmp 0x1800045b0
call fcn.180007910
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.18000a620
lea rax, [0x180132440]
mov rdi, rax
mov rsi, qword [rsp + 0x8f0]
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0xa0]
lea rcx, [0x180132658]
call fcn.180001f70
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x8f0]
mov rcx, qword [rax]
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
nop
lea rcx, [rsp + 0x50]
call fcn.180007960
mov rcx, qword [rsp + 0x8c0]
xor rcx, rsp
call fcn.180106980
add rsp, 0x8d8
pop rdi
pop rsi
ret
Function at 0x180004b10
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x430
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x420], rax
cmp qword [0x180131d68], 0
jne 0x180004b47
jmp 0x180004de2
mov rax, qword [rsp + 0x440]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp eax, 1
je 0x180004b9b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetParent]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180004b8d
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x30], rax
jne 0x180004b8f
jmp 0x180004b9b
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
jmp 0x180004b62
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
je 0x180004de2
call fcn.180004f90
mov qword [0x180131d58], rax
mov qword [0x180131d68], 0
xor eax, eax
mov word [rsp + 0x220], ax
lea rax, [rsp + 0x222]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fc
rep stosb byte [rdi], al
mov r8d, 0xff
lea rdx, [rsp + 0x220]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0xf0]
call fcn.180004e00
nop
call fcn.1800027c0
mov rcx, rax
call fcn.180005560
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xf4], eax
mov rax, qword [rsp + 0x20]
add rax, 0x148
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.180001f70
mov rax, qword [rsp + 0x20]
add rax, 0x28
mov rdx, rax
lea rcx, [rsp + 0x118]
call fcn.180001f70
xor r8d, r8d
mov rdx, qword [0x180131d58]
lea rcx, [rsp + 0x70]
call fcn.180004840
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x198]
call fcn.180007760
lea rcx, [rsp + 0x70]
call fcn.180002810
xor r8d, r8d
mov rdx, qword [0x180131d60]
lea rcx, [rsp + 0xb0]
call fcn.180004840
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x158]
call fcn.180007760
lea rcx, [rsp + 0xb0]
call fcn.180002810
mov rax, qword [0x180131d60]
mov rcx, qword [0x180131d58]
sub rcx, rax
mov rax, rcx
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180004840
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x178]
call fcn.180007760
lea rcx, [rsp + 0xd0]
call fcn.180002810
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x138]
call fcn.180001750
mov rax, qword [rsp + 0x20]
add rax, 0x168
mov rdx, rax
lea rcx, [rsp + 0x1b8]
call fcn.180001f70
mov rax, qword [rsp + 0x20]
add rax, 0x188
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.180001f70
mov rax, qword [0x180131d60]
mov rcx, qword [0x180131d58]
sub rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180004a30
mov dword [rsp + 0x1f8], eax
lea rcx, [rsp + 0x90]
call fcn.180016a40
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x200]
call fcn.180007760
lea rcx, [rsp + 0x90]
call fcn.180002810
call fcn.180007c70
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.180016f00
nop
lea rcx, [rsp + 0xf0]
call fcn.180004ed0
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.180106980
add rsp, 0x430
pop rdi
ret
Function at 0x18000a010
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x30], 0
mov rax, qword [rsp + 0x50]
add rax, 0x38
mov rcx, rax
call fcn.18000a6b0
nop
mov rax, qword [rsp + 0x50]
add rax, 0x50
mov rcx, rax
call fcn.1800079a0
mov rax, qword [rsp + 0x50]
add rax, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
lea r8, [0x18000a180]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x18000a0b0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x18000a144
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x30], 1
mov edx, 0x7d0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18000a12b
lea rax, str.Force_Terminate_key_thread...
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0x16
lea rdx, [0x180110158]
lea rcx, str.CKeyInputThreadHandle::CKeyInputThreadHandle
call fcn.1800f8b80
xor edx, edx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rsp + 0x50]
cmp qword [rax], 0
je 0x18000a144
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
add rax, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
mov rax, qword [rsp + 0x50]
add rax, 0x50
mov rcx, rax
call fcn.180007bc0
nop
mov rax, qword [rsp + 0x50]
add rax, 0x38
mov rcx, rax
call fcn.18000a6e0
add rsp, 0x48
ret
Function at 0x18000ecb0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x120
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov byte [rsp + 0xa0], 0
lea rax, [rsp + 0xa1]
mov rdi, rax
xor eax, eax
mov ecx, 0x63
rep stosb byte [rdi], al
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, str.keyboard_name:__s
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0xde
lea rdx, str..._srcKeyboadHookutilVirtualKeyManager.cpp
lea rcx, str.CVirtualKeyManager::GetSpecialKeyBoard
call fcn.1800f8b80
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x78]
call fcn.18000c180
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.18000f810
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.18000f7d0
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.18000f810
mov rcx, qword [sym.imp.MSVCR120.dll_towlower]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov r9, qword [rcx]
mov rcx, qword [rsp + 0x48]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x60]
call fcn.18000efd0
lea rdx, str.0000000a
lea rcx, [rsp + 0x78]
call fcn.18000f790
test eax, eax
je 0x18000edec
lea rdx, str.0000040a
lea rcx, [rsp + 0x78]
call fcn.18000f790
test eax, eax
je 0x18000edec
lea rdx, str.0001040a
lea rcx, [rsp + 0x78]
call fcn.18000f790
test eax, eax
jne 0x18000ee09
mov dword [rsp + 0x34], 1
lea rcx, [rsp + 0x78]
call fcn.180007bc0
mov eax, dword [rsp + 0x34]
jmp 0x18000ee8b
lea rdx, str.00000016
lea rcx, [rsp + 0x78]
call fcn.18000f790
test eax, eax
je 0x18000ee5d
lea rdx, str.00000416
lea rcx, [rsp + 0x78]
call fcn.18000f790
test eax, eax
je 0x18000ee5d
lea rdx, str.00010416
lea rcx, [rsp + 0x78]
call fcn.18000f790
test eax, eax
je 0x18000ee5d
lea rdx, str.00000816
lea rcx, [rsp + 0x78]
call fcn.18000f790
test eax, eax
jne 0x18000ee75
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x78]
call fcn.180007bc0
mov eax, dword [rsp + 0x38]
jmp 0x18000ee8b
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x78]
call fcn.180007bc0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.180106980
add rsp, 0x120
pop rdi
ret
Function at 0x18000f850
Capabilities:
Create directory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [r11 - 0x40], rcx
call fcn.180011830
mov rcx, rbx
call fcn.180001780
test eax, eax
jle 0x18000f9b3
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1800032b0
mov rcx, rax
call fcn.1800115b0
test al, al
je 0x18000f8be
mov rcx, rbx
call fcn.180002810
mov al, 1
jmp 0x18000f9bd
lea r8, [0x180118ee0]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.180010180
mov rdx, rax
mov rcx, rbx
call fcn.180007760
lea rcx, [rsp + 0x50]
call fcn.180002810
mov rcx, rbx
call fcn.180011620
mov esi, 1
mov rcx, rbx
call fcn.180001780
cmp eax, esi
jle 0x18000f983
mov edi, esi
mov rcx, rbx
cmp qword [rbx + 0x10], rdi
jbe 0x18000f97d
call fcn.180002590
cmp word [rax + rdi*2], 0x5c
jne 0x18000f96a
movsxd r9, esi
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18000fb30
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1800032b0
mov rcx, rax
call fcn.1800115b0
test al, al
jne 0x18000f960
lea rcx, [rsp + 0x50]
call fcn.1800031c0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rsp + 0x50]
call fcn.180002810
inc esi
inc rdi
mov rcx, rbx
call fcn.180001780
cmp esi, eax
jl 0x18000f906
jmp 0x18000f983
call fcn.180002010
int3
mov rcx, rbx
call fcn.1800031c0
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1800032b0
mov rcx, rax
call fcn.1800115b0
test al, al
jne 0x18000f8af
mov rcx, rbx
call fcn.180002810
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180106980
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1800115b0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor bl, bl
call fcn.180011620
mov rcx, rdi
call fcn.1800031c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov rcx, rdi
call fcn.180002810
movzx eax, bl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180106980
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180016ae0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x4c0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov dword [rsp + 0x30], 0
lea rdx, str.C:Program_Files__x86_Windows_Assistant_AppMVConfiguration.ini
lea rcx, [rsp + 0x70]
call fcn.18000c180
nop
mov byte [rsp + 0xb0], 0
lea rax, [rsp + 0xb1]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
call fcn.18000fab0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, str.UniquePC
lea rcx, str.Setting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x90]
call fcn.18000c180
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
call fcn.18000baf0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x4d0]
call fcn.180010b30
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x90]
call fcn.180007bc0
nop
lea rcx, [rsp + 0x70]
call fcn.180007bc0
mov rax, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.180106980
add rsp, 0x4c0
pop rdi
ret
Function at 0x18001e9d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r9d, dword [rsp + 0x90]
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.18001e760
mov rax, qword [rsp + 0x80]
mov dword [rax], 0x28
movzx eax, word [rsp + 0x36]
cmp eax, 8
jle 0x18001ea4f
mov eax, dword [rsp + 0x38]
and eax, 3
test eax, eax
je 0x18001ea4d
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
add eax, 0xc
mov rcx, qword [rsp + 0x80]
mov dword [rcx], eax
jmp 0x18001ea97
cmp dword [rsp + 0x48], 0
je 0x18001ea60
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
jmp 0x18001ea7b
movzx eax, word [rsp + 0x36]
mov ecx, 1
mov dword [rsp + 0x24], ecx
movzx ecx, al
mov eax, dword [rsp + 0x24]
shl eax, cl
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
mov ecx, dword [rcx]
lea rax, [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
mov dword [rcx], eax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180106980
add rsp, 0x68
ret
Function at 0x180026a20
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax + 0x68], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x10325476
ret
Function at 0x18002b820
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18002a990
mov qword [rsp + 0x28], 0
cmp qword [0x180131d98], 0
jne 0x18002b869
cmp qword [0x180131da8], 0
je 0x18002b869
mov rax, qword [0x180131da8]
mov qword [0x180131d98], rax
cmp qword [0x180131d98], 0
je 0x18002b90b
mov rax, qword [0x180131d98]
cmp qword [rax + 0x10], 0
je 0x18002b90b
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18002b90b
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18002b90b
mov rax, qword [0x180131d98]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18002b8d5
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18002b8dc
xor eax, eax
jmp 0x18002ba86
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov rdi, qword [rsp + 0x28]
mov eax, 0xcc
mov ecx, 0x60
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x28]
jmp 0x18002ba86
mov rax, qword [0x180131da8]
mov qword [0x180131d98], rax
jmp 0x18002b92d
mov rax, qword [0x180131d98]
mov rax, qword [rax + 8]
mov qword [0x180131d98], rax
cmp qword [0x180131d98], 0
je 0x18002b97a
cmp qword [0x180131d98], 0
je 0x18002b978
mov rax, qword [0x180131d98]
cmp qword [rax + 0x10], 0
je 0x18002b978
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18002b978
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18002b978
jmp 0x18002b8ad
jmp 0x18002b91b
mov rcx, qword [rsp + 0x60]
call fcn.18002a520
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18002b6f0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18002ba84
mov rax, qword [rsp + 0x48]
mov qword [0x180131d98], rax
mov rax, qword [0x180131d98]
mov dword [rax], 0x52727464
mov rax, qword [0x180131d98]
mov qword [rax + 0x10], 0
mov rax, qword [0x180131d98]
mov rcx, qword [0x180131da8]
mov qword [rax + 8], rcx
mov rax, qword [0x180131d98]
mov qword [0x180131da8], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180131d98]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.SHELL32.dll_IsUserAnAdmin
jmp 0x18002ba35
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18002ba6f
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18002ba2b
mov rax, qword [0x180131d98]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18002b8ad
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x180035d50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, 0x28
call fcn.1800318c0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180035d91
mov eax, 7
jmp 0x180035e5e
movzx eax, byte [0x180129724]
test eax, eax
je 0x180035daa
mov ecx, 0xc8
call fcn.180036fa0
test eax, eax
je 0x180035dba
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
jmp 0x180035e23
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x180035d10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.MSVCR120.dll__beginthreadex]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x180035e23
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x180035e4f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1800906f0
Capabilities:
Reference sql statements

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x18012c180]
mov r8, qword [rsp + 0x48]
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rcx, qword [rsp + 0x40]
call fcn.180097a20
cmp dword [rsp + 0x50], 0
jne 0x180090756
mov r9, qword [rsp + 0x48]
lea r8, [0x18012c230]
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, qword [rsp + 0x40]
call fcn.180097a20
add rsp, 0x38
ret