joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401071e0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x1401071f8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x1401071f8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x140107200
xor eax, eax
ret
cmp rbx, 3
je 0x14010720c
cmp rbx, 4
jne 0x140107239
cmp al, 0x2c
ja 0x140107226
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x140107236
cmp al, 0x24
je 0x140107236
nop dword [rax]
cmp al, 0x26
jae 0x140107236
jmp 0x140107239
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x140107236
cmp al, 0x5b
je 0x140107236
cmp al, 0x5d
jne 0x140107239
xor eax, eax
ret
cmp al, 0x2f
ja 0x140107272
nop dword [rax]
cmp al, 0x26
ja 0x140107251
cmp al, 0x24
je 0x140107291
cmp al, 0x26
je 0x140107291
jmp 0x14010730b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x140107291
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x140107308
cmp al, 0x2f
je 0x140107291
jmp 0x14010730b
cmp al, 0x3d
ja 0x140107289
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x140107291
nop
cmp al, 0x3d
je 0x140107291
jmp 0x14010730b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x140107300
cmp rbx, 2
jg 0x1401072c7
cmp rbx, 1
je 0x1401072c1
nop dword [rax]
cmp rbx, 2
jne 0x14010730b
cmp al, 0x2f
je 0x1401072b2
cmp al, 0x3b
je 0x1401072b2
cmp al, 0x2c
jne 0x1401072b9
mov ecx, 1
jmp 0x1401072be
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x1401072ea
cmp al, 0x40
je 0x1401072d9
cmp al, 0x2f
je 0x1401072d9
cmp al, 0x3f
jne 0x1401072e2
mov ecx, 1
nop
jmp 0x1401072e7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x1401072f9
cmp rbx, 7
jne 0x14010730b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x140107308
cmp al, 0x7e
jne 0x14010730b
xor eax, eax
ret
cmp rbx, 7
jne 0x140107321
cmp al, 0x21
je 0x14010731d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x140107321
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x14010d640
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14010d87b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call dbg.crypto/internal/boring/sig.StandardCrypto
xorps xmm15, xmm15
mov r14, qword [0x1403fda70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x14010d78a
nop dword [rax]
cmp rdx, 0x40
ja 0x14010d86d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x14010d6f9
mov rax, rdx
mov rcx, rsi
nop
call dbg.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x14010d761
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call dbg.crypto/sha256.block
xorps xmm15, xmm15
mov r14, qword [0x1403fda70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x14010d862
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x14010d797
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x14010d815
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call dbg.crypto/sha256.block
xorps xmm15, xmm15
mov r14, qword [0x1403fda70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x14010d858
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x14010d854
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call dbg.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call dbg.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call dbg.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp dbg.crypto/sha256.(*digest).Write
Function at 0x140111940
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x1401119c5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x140111b26
cmp rcx, 0xe
jne 0x140111a40
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x140111b26
cmp rcx, 0xf
jne 0x140111ab7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x140111b26
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x140117cc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140117dad
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
nop dword [rax + rax]
test rcx, rcx
jle 0x140117d99
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call dbg.github.com/mattn/go-sqlite3._cgo_cmalloc
xorps xmm15, xmm15
mov r14, qword [0x1403fda70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rcx
mov rsi, rcx
cmovl rsi, rbx
mov rdi, qword [rsp + 0x58]
cmp rdi, rdx
jne 0x140117d53
cmp rbx, rcx
jmp 0x140117d85
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov rax, rdx
mov rbx, rdi
mov rcx, rsi
call dbg.runtime.memmove
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rdx, qword [rsp + 0x40]
mov rbx, rax
mov rax, qword [rsp + 0x38]
jae 0x140117d91
mov byte [rdx + rbx], 0
add rsp, 0x48
pop rbp
ret
mov rax, rbx
call dbg.runtime.panicIndex
lea rax, [0x140258a80]
lea rbx, [0x1402bb5a0]
call dbg.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp dbg.github.com/mattn/go-sqlite3._Cfunc_CString

Function at 0x14011f9e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14011fab0
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edi
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
lea rax, [0x140254040]
lea rbx, [rsp + 0x48]
xor ecx, ecx
xor edi, edi
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 8], rdx
mov edx, dword [rsp + 0x70]
mov dword [rsp + 0x10], edx
mov edx, dword [rsp + 0x74]
mov dword [rsp + 0x14], edx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x30], rdx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_create_function
xorps xmm15, xmm15
mov r14, qword [0x1403fda70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x38]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteConn).RegisterFunc.sqlite3CreateFunction.func3
Function at 0x1401261c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140126295
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
lea rax, [0x140254040]
lea rbx, [rsp + 0x38]
xor ecx, ecx
xor edi, edi
nop
call dbg.runtime.cgoCheckPointer
lea rax, [0x140257540]
mov rbx, qword [rsp + 0x60]
lea rcx, [0x140258e80]
lea rdi, [0x140236368]
nop
call dbg.runtime.cgoCheckPointer
lea rax, [0x140257580]
mov rbx, qword [rsp + 0x68]
lea rcx, [0x140258e80]
lea rdi, [0x140236368]
nop
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x30]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], 0xffffffff
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_prepare_v2_internal
xorps xmm15, xmm15
mov r14, qword [0x1403fda70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x28]
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteConn).prepare.func2

Function at 0x140126de0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140126e7d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
test rdi, rdi
jbe 0x140126e72
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x1402541c0]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov edx, dword [rsp + 0x50]
mov dword [rsp + 8], edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x18], edx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_bind_text
xorps xmm15, xmm15
mov r14, qword [0x1403fda70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rcx, rax
call dbg.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteStmt).bind.func13
Function at 0x140127320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401273bd
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
test rdi, rdi
jbe 0x1401273b2
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x1402541c0]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov edx, dword [rsp + 0x50]
mov dword [rsp + 8], edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x18], edx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_bind_text
xorps xmm15, xmm15
mov r14, qword [0x1403fda70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rcx, rax
call dbg.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteStmt).bind.func6

Function at 0x140129e60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140129f0d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x140254040]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
nop
call dbg.runtime.cgoCheckPointer
lea rax, [0x140257580]
mov rbx, qword [rsp + 0x60]
lea rcx, [0x140258e80]
lea rdi, [0x140236368]
nop
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
call dbg.github.com/mattn/go-sqlite3._Cfunc_sqlite3_load_extension
xorps xmm15, xmm15
mov r14, qword [0x1403fda70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteConn).loadExtension.func4
Function at 0x1401310e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movsxd r12, dword [rdx]
mov rbp, rdx
movzx edx, byte [r8]
mov rdi, rcx
mov rbx, r8
test dl, dl
je 0x14013113c
mov rsi, r8
mov eax, edx
lea r8, [0x14039f7a0]
xor r9d, r9d
nop dword [rax]
movzx ecx, al
test byte [r8 + rcx], 6
jne 0x14013111e
cmp al, 0x5f
jne 0x14013112e
movzx eax, byte [rsi + 1]
add rsi, 1
add r9d, 1
test al, al
jne 0x140131110
movzx eax, dl
test byte [r8 + rax], 4
je 0x1401311b8
mov byte [rdi + r12], 0x22
movzx edx, byte [rbx]
lea eax, [r12 + 1]
mov r9d, 1
test dl, dl
jne 0x140131166
jmp 0x1401311a8
movzx edx, byte [rbx + 1]
add rbx, 1
mov eax, ecx
test dl, dl
je 0x14013118a
movsxd r8, eax
lea ecx, [rax + 1]
mov byte [rdi + r8], dl
cmp byte [rbx], 0x22
jne 0x140131158
movsxd rcx, ecx
add rbx, 1
add eax, 2
mov byte [rdi + rcx], 0x22
movzx edx, byte [rbx]
test dl, dl
jne 0x140131166
test r9d, r9d
jne 0x1401311a8
movsxd rdx, eax
mov byte [rdi + rdx], 0
mov dword [rbp], eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movsxd rdx, eax
add eax, 1
mov byte [rdi + rdx], 0x22
jmp 0x14013118f
mov dword [rsp + 0x2c], 0x3b
cmp r9d, 1
jg 0x1401311e8
cmp byte [rsi], 0
setne al
xor r9d, 1
and r9d, 1
or al, r9b
jne 0x14013113c
mov eax, r12d
xor r9d, r9d
jmp 0x140131166
lea r8, [rsp + 0x2c]
mov edx, r9d
mov rcx, rbx
call dbg.keywordCode
cmp dword [rsp + 0x2c], 0x3b
jne 0x14013113c
cmp byte [rsi], 0
jne 0x14013113c
movzx edx, byte [rbx]
mov eax, r12d
test dl, dl
je 0x14013118f
xor r9d, r9d
jmp 0x140131166

Function at 0x140132a40
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x140132a78
movsxd rdx, edx
lea r9, [rcx + rdx]
xor edx, edx
nop dword [rax]
movsx r8d, byte [rcx]
lea eax, [rdx*8]
add rcx, 1
xor eax, r8d
xor edx, eax
cmp r9, rcx
jne 0x140132a50
mov eax, edx
and eax, 0x7fffffff
ret
xor eax, eax
ret

Function at 0x140134960
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r9d, edx
test edx, edx
jle 0x1401349a8
mov rax, rbx
xor ecx, ecx
nop dword [rax]
movsx r8d, byte [rax]
lea edx, [rcx*8]
add rax, 1
xor edx, r8d
xor ecx, edx
mov edx, ebx
sub edx, eax
add edx, r9d
test edx, edx
jg 0x140134978
mov eax, ecx
and eax, 0x7fffffff
add rsp, 0x20
pop rbx
ret
call sym.strlen
mov rdx, rax
mov r9d, eax
xor eax, eax
test edx, edx
jg 0x14013496f
add rsp, 0x20
pop rbx
ret
Function at 0x14013c150
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
lea rbp, [rsp + 0x20]
movsxd r8, edx
mov edi, edx
mov rcx, rsi
xor edx, edx
call sym.memset
mov rcx, rbp
call qword [sym.GetSystemTime]
mov rdx, rbp
lea r9, [rsp + 0x30]
xor r8d, r8d
nop word [rax + rax]
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp r9, rdx
jne 0x14013c190
call qword [sym.GetCurrentProcessId]
lea r12, [rsp + 0x24]
mov rdx, rbp
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp r12, rdx
jne 0x14013c1c0
call qword [sym.GetTickCount]
mov rdx, rbp
xor r8d, r8d
mov dword [rsp + 0x20], eax
nop dword [rax + rax]
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp r12, rdx
jne 0x14013c1f0
mov rcx, rbp
call qword [str._b__]
mov rax, rbp
lea r9, [rsp + 0x28]
xor r8d, r8d
nop
lea edx, [rbx + 1]
movzx ecx, byte [rax]
xor byte [rsi + rbx], cl
cmp edi, edx
cmovle edx, r8d
add rax, 1
movsxd rbx, edx
cmp r9, rax
jne 0x14013c220
cmp edi, 0x20
mov eax, 0x20
cmovle eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140144b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13d, dword [rcx + 0x80]
movsxd rax, edx
mov r12, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rsi, rax
sub rdx, rax
shl rdx, 3
test rcx, rcx
je 0x140144ce8
test rdx, rdx
je 0x140144d00
cmp rdx, 0x7ffffeff
ja 0x140144ca8
call sym.sqlite3Realloc.part.0
mov rdi, rax
test rdi, rdi
je 0x140144ca8
movsxd rdx, r13d
xor ebp, ebp
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [rdi + rax*8]
mov eax, esi
sub eax, r13d
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sym.memset
mov qword [r12 + 0x78], rdi
cmp r13d, esi
jl 0x140144c5a
jmp 0x140144cd0
lea rdi, [rax + 8]
mov rcx, rax
mov qword [rax], 0
mov qword [rax + 0x1f8], 0
and rdi, 0xfffffffffffffff8
mov rax, rbp
sub rcx, rdi
add ecx, 0x200
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rdx], r14d
mov qword [rbx + 0x10], rdx
mov rax, qword [r12 + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x140144c45
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add r13d, 1
add rbx, 0x38
mov dword [r12 + 0x80], r13d
cmp r13d, esi
je 0x140144cd0
mov rax, qword [r12 + 0x50]
mov r14d, dword [r12 + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r14d
je 0x140144cc0
mov rax, qword [r12 + 0x60]
test rax, rax
jle 0x140144cc0
mov qword [rbx], rax
mov eax, dword [r12 + 0x3c]
mov ecx, 0x200
mov dword [rbx + 0x1c], eax
call sym.sqlite3Malloc
mov rdx, rax
test rax, rax
jne 0x140144be0
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [r12 + 0xb8]
jmp 0x140144c78
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rdx
call sym.sqlite3Malloc
mov rdi, rax
jmp 0x140144b88
call sym.sqlite3_free
mov eax, 7
jmp 0x140144cad
Function at 0x140146070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebp, ebp
lea rbx, [0x14039f8a0]
mov eax, dword [rcx + 0x28]
mov r12, rcx
mov rdi, rdx
mov rsi, r8
test eax, eax
jle 0x140146104
nop dword [rax + rax]
mov r10d, ebp
xor r10d, 1
cmp ebp, 2
cmovge r10d, ebp
movsxd r9, r10d
shl r9, 5
add r9, qword [r12 + 0x20]
test rsi, rsi
je 0x1401460de
mov r8, qword [r9]
xor ecx, ecx
jmp 0x1401460cd
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x140146118
add rcx, 1
movzx eax, byte [r8 + rcx]
movzx edx, byte [rsi + rcx]
cmp eax, edx
jne 0x1401460c0
test eax, eax
jne 0x1401460c9
mov rcx, qword [r9 + 0x18]
xor r8d, r8d
mov rdx, rdi
add rcx, 0x20
call dbg.findElementWithHash
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140146106
add ebp, 1
cmp dword [r12 + 0x28], ebp
jg 0x140146098
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test r10d, r10d
jne 0x1401460fa
mov rcx, rsi
mov eax, 0x6d
lea r8, str.main
jmp 0x140146148
cdqe
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x1401460fa
movzx eax, byte [r8 + 1]
add r8, 1
add rcx, 1
movzx edx, byte [rcx]
cmp eax, edx
jne 0x140146130
test eax, eax
jne 0x14014613b
jmp 0x1401460de