joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400580b0
Capabilities:
Encode data using xor

Disassembly:
cmp r8, 0xf
jbe 0x1400580ea
lea rax, [r8 - 0x10]
and rax, 0xfffffffffffffff0
lea r9, [rax + 0x10]
xor eax, eax
nop dword [rax]
movups xmm0, xmmword [rcx + rax]
movups xmm2, xmmword [rdx + rax]
xorps xmm0, xmm2
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, r9
jne 0x1400580c8
add rcx, rax
add rdx, rax
and r8d, 0xf
test r8, r8
je 0x140058177
cmp r8, 3
jbe 0x140058158
lea rax, [r8 - 4]
cmp rax, 7
jbe 0x1400581a0
lea r10, [rdx + 4]
mov r9, rcx
sub r9, r10
add r9, 3
cmp r9, 6
ja 0x140058180
mov r9d, dword [rdx]
xor dword [rcx], r9d
lea r9, [rcx + 4]
mov r10d, dword [r10]
xor dword [r9], r10d
lea r9, [r8 - 8]
cmp r9, 3
jbe 0x140058140
mov r9d, dword [rdx + 8]
xor dword [rcx + 8], r9d
nop dword [rax]
and r8d, 3
je 0x140058177
shr rax, 2
lea rax, [rax*4 + 4]
add rcx, rax
add rdx, rax
movzx eax, byte [rdx]
xor byte [rcx], al
cmp r8, 1
je 0x140058177
movzx eax, byte [rdx + 1]
xor byte [rcx + 1], al
cmp r8, 3
jne 0x140058177
movzx eax, byte [rdx + 2]
xor byte [rcx + 2], al
ret
movq xmm1, qword [rdx]
movq xmm0, qword [rcx]
pxor xmm0, xmm1
movq qword [rcx], xmm0
mov r9d, dword [rdx + 8]
xor dword [rcx + 8], r9d
jmp 0x140058140
mov r9d, dword [rdx]
xor dword [rcx], r9d
cmp rax, 3
jbe 0x140058140
lea r9, [rcx + 4]
lea r10, [rdx + 4]
jmp 0x140058125

Function at 0x140058300
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov rcx, rdx
cmp r8, 7
jbe 0x140058440
lea rax, [r8 - 8]
mov r10, rax
shr r10, 3
add r10, 1
cmp rax, 7
jbe 0x140058447
mov rdx, r10
xor eax, eax
pxor xmm0, xmm0
shr rdx, 1
shl rdx, 4
nop dword [rax]
movdqu xmm1, xmmword [rcx + rax]
movdqu xmm2, xmmword [r9 + rax]
add rax, 0x10
pxor xmm1, xmm2
por xmm0, xmm1
cmp rax, rdx
jne 0x140058340
movdqa xmm1, xmm0
psrldq xmm1, 8
por xmm0, xmm1
movq rax, xmm0
test r10b, 1
je 0x14005838f
mov rdx, r10
and rdx, 0xfffffffffffffffe
shl rdx, 3
lea r11, [r9 + rdx]
add rdx, rcx
mov rdx, qword [rdx]
xor rdx, qword [r11]
or rax, rdx
mov rdx, rax
shl r10, 3
and r8d, 7
shr rdx, 0x20
add r9, r10
add rcx, r10
or edx, eax
mov eax, edx
shr eax, 0x10
or al, dh
or eax, edx
shr edx, 0x18
or eax, edx
movzx eax, al
test r8, r8
je 0x140058439
movzx edx, byte [rcx]
xor dl, byte [r9]
movzx edx, dl
or eax, edx
cmp r8, 1
je 0x140058439
movzx edx, byte [rcx + 1]
xor dl, byte [r9 + 1]
movzx edx, dl
or eax, edx
cmp r8, 2
je 0x140058439
movzx edx, byte [rcx + 2]
xor dl, byte [r9 + 2]
movzx edx, dl
or eax, edx
cmp r8, 3
je 0x140058439
movzx edx, byte [rcx + 3]
xor dl, byte [r9 + 3]
movzx edx, dl
or eax, edx
cmp r8, 4
je 0x140058439
movzx edx, byte [rcx + 4]
xor dl, byte [r9 + 4]
movzx edx, dl
or eax, edx
cmp r8, 5
je 0x140058439
movzx edx, byte [r9 + 5]
xor dl, byte [rcx + 5]
movzx edx, dl
or eax, edx
cmp r8, 7
jne 0x140058439
movzx edx, byte [r9 + 6]
xor dl, byte [rcx + 6]
movzx edx, dl
or eax, edx
test eax, eax
sete al
ret
xor eax, eax
jmp 0x1400583b7
mov r11, r9
xor eax, eax
jmp 0x140058386
Function at 0x14006d5d0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r8d, r8d
xor edx, edx
mov rsi, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov r9d, 1
mov qword [rcx], 0
mov rbx, rcx
mov dword [rsp + 0x20], 0xf0000000
call rsi
test eax, eax
je 0x14006d610
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbp, str.Crypto_RNG
xor r8d, r8d
mov dword [rsp + 0x20], 8
mov edi, eax
mov r9d, 1
mov rdx, rbp
mov rcx, rbx
call rsi
test eax, eax
jne 0x14006d602
xor r8d, r8d
mov r9d, 1
mov rdx, rbp
mov rcx, rbx
mov dword [rsp + 0x20], 0x28
call rsi
test eax, eax
jne 0x14006d602
mov ecx, edi
lea rdi, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x30
call sym.__cxa_allocate_exception
lea rdx, str.CryptAcquireContext
mov rcx, rdi
mov rsi, rax
call fcn.14006cdd0
mov rdx, rdi
mov rcx, rsi
call method.CryptoPP::OS_RNG_Err.OS_RNG_Err_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rcx, rdi
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
lea r8, [method.CryptoPP::OS_RNG_Err.OS_RNG_Err__]
lea rdx, [0x1403972b0]
mov rcx, rsi
call sym.__cxa_throw
mov rbx, rax
jmp 0x14006d6bb
mov rcx, rsi
call sym.__cxa_free_exception
mov rcx, rbx
call sym._Unwind_Resume
nop
nop dword [rax]
Function at 0x14006d6d0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movzx eax, byte [0x14042b460]
mov rsi, rdx
mov rbx, r8
test al, al
je 0x14006d7f0
mov rax, rbx
shr rax, 0x20
jne 0x14006d708
test rbx, rbx
setne dl
test ebx, ebx
setne al
cmp dl, al
je 0x14006d7c8
mov ecx, 0x5b6
lea rbx, [rsp + 0x30]
lea rdi, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x30
call sym.__cxa_allocate_exception
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x30], rdi
mov rsi, rax
mov qword [rsp + 0x28], 0x12
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_create_unsigned_long_long__unsigned_long_long_
mov rdx, qword [rsp + 0x28]
mov ecx, 0x657a
movabs r9, 0x65746172656e6547
movabs r10, 0x6973206b636f6c42
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdx
mov word [rax + 0x10], cx
mov rcx, rsi
mov qword [rax], r9
mov qword [rax + 8], r10
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rdx
mov byte [rax + rdx], 0
mov rdx, rbx
call method.CryptoPP::OS_RNG_Err.OS_RNG_Err_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rcx, qword [rsp + 0x30]
cmp rcx, rdi
je 0x14006d7ac
mov rax, qword [rsp + 0x40]
lea rdx, [rax + 1]
call sym.operator_delete_void__unsigned_long_long_
lea r8, [method.CryptoPP::OS_RNG_Err.OS_RNG_Err__]
lea rdx, [0x1403972b0]
mov rcx, rsi
call sym.__cxa_throw
nop word [rax + rax]
mov rcx, qword [0x14042b468]
mov r8, rsi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14006d85f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rdi, [0x14042b460]
mov rcx, rdi
call sym.__cxa_guard_acquire
test eax, eax
je 0x14006d6ec
lea rcx, [0x14042b468]
call method.CryptoPP::MicrosoftCryptoProvider.MicrosoftCryptoProvider__
lea rcx, [sym.__tcf_0_7]
call dbg.atexit
mov rcx, rdi
call sym.__cxa_guard_release
jmp 0x14006d6ec
mov ecx, 0x30
lea rbx, [rsp + 0x30]
call sym.__cxa_allocate_exception
lea rdx, str.CryptGenRandom
mov rcx, rbx
mov rdi, rax
call fcn.14006cdd0
mov rdx, rbx
mov rcx, rdi
call method.CryptoPP::OS_RNG_Err.OS_RNG_Err_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rcx, rbx
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
lea r8, [method.CryptoPP::OS_RNG_Err.OS_RNG_Err__]
lea rdx, [0x1403972b0]
mov rcx, rdi
call sym.__cxa_throw
mov rsi, rax
jmp 0x14006d8b9
mov rcx, rdi
call sym.__cxa_free_exception
mov rcx, rsi
call sym._Unwind_Resume
nop
nop word [rax + rax]
Function at 0x14006d9c0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov edx, 1
mov rbx, rcx
call method.CryptoPP::Algorithm.Algorithm_bool_
add rbx, 8
xor r8d, r8d
xor edx, edx
lea rax, fcn.14006cd30
mov qword [rbx], 0
mov rsi, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov r9d, 1
mov qword [rbx - 8], rax
mov rcx, rbx
mov dword [rsp + 0x20], 0xf0000000
call rsi
test eax, eax
je 0x14006da20
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbp, str.Crypto_RNG
xor r8d, r8d
mov dword [rsp + 0x20], 8
mov edi, eax
mov r9d, 1
mov rdx, rbp
mov rcx, rbx
call rsi
test eax, eax
jne 0x14006da0e
xor r8d, r8d
mov r9d, 1
mov rdx, rbp
mov rcx, rbx
mov dword [rsp + 0x20], 0x28
call rsi
test eax, eax
jne 0x14006da0e
mov ecx, edi
lea rdi, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x30
call sym.__cxa_allocate_exception
lea rdx, str.CryptAcquireContext
mov rcx, rdi
mov rsi, rax
call fcn.14006cdd0
mov rdx, rdi
mov rcx, rsi
call method.CryptoPP::OS_RNG_Err.OS_RNG_Err_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rcx, rdi
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
lea r8, [method.CryptoPP::OS_RNG_Err.OS_RNG_Err__]
lea rdx, [0x1403972b0]
mov rcx, rsi
call sym.__cxa_throw
mov rbx, rax
jmp 0x14006dacb
mov rcx, rsi
call sym.__cxa_free_exception
mov rcx, rbx
call sym._Unwind_Resume
nop
nop dword [rax]
Function at 0x14006dae0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rdi, fcn.14006cd30
lea rbp, [rsp + 0x30]
mov rbx, rdx
lea r13, [rsp + 0x38]
mov rsi, r8
mov edx, 1
mov rcx, rbp
call method.CryptoPP::Algorithm.Algorithm_bool_
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rdi
mov r12, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov r9d, 1
mov rcx, r13
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0xf0000000
call r12
test eax, eax
je 0x14006db80
mov r8, rsi
mov rdx, rbx
mov rcx, rbp
call method.CryptoPP::NonblockingRng.GenerateBlock_unsigned_char__unsigned_long_long_
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rdi
test rcx, rcx
jne 0x14006dc28
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15, str.Crypto_RNG
xor r8d, r8d
mov dword [rsp + 0x20], 8
mov r14d, eax
mov r9d, 1
mov rdx, r15
mov rcx, r13
call r12
test eax, eax
jne 0x14006db46
xor r8d, r8d
mov r9d, 1
mov rdx, r15
mov rcx, r13
mov dword [rsp + 0x20], 0x28
call r12
test eax, eax
jne 0x14006db46
mov ecx, r14d
lea rdi, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x30
call sym.__cxa_allocate_exception
lea rdx, str.CryptAcquireContext
mov rcx, rdi
mov rsi, rax
call fcn.14006cdd0
mov rdx, rdi
mov rcx, rsi
call method.CryptoPP::OS_RNG_Err.OS_RNG_Err_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rcx, rdi
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
lea r8, [method.CryptoPP::OS_RNG_Err.OS_RNG_Err__]
lea rdx, [0x1403972b0]
mov rcx, rsi
call sym.__cxa_throw
nop dword [rax + rax]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x14006db67

Function at 0x140073f60
Capabilities:
Encode data using xor

Disassembly:
sub rcx, 8
jmp method.CryptoPP::Rijndael::Dec.ProcessAndXorBlock_unsigned_char_const__unsigned_char_const__unsigned_char__const
Function at 0x1400768e0
Capabilities:
Encode data using xor

Disassembly:
sub rcx, 8
jmp method.CryptoPP::Rijndael::Enc.ProcessAndXorBlock_unsigned_char_const__unsigned_char_const__unsigned_char__const

Function at 0x140076990
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x30
movups xmmword [rsp + 0x20], xmm6
movdqu xmm6, xmmword [rcx + rdx - 0x10]
mov r9, r8
mov rbx, rdx
mov r8, rdx
mov rdx, rcx
mov rcx, r9
call sym.memcpy
mov rcx, rbx
shr rcx, 2
add rcx, 7
shl rcx, 4
add rcx, rax
cmp rbx, 0x18
je 0x140076b10
cmp rbx, 0x20
je 0x140076a48
and rbx, 0xfffffffffffffffc
mov r8, rax
lea r10, [0x14036a480]
mov rdx, rbx
lea r9, [rbx + rax + 0x10]
jmp 0x1400769fe
pinsrd xmm6, dword [r8 + 0x1c], 3
add r9, rdx
add r8, rdx
aeskeygenassist xmm0, xmm6, 0
add r10, 4
pextrd eax, xmm0, 3
xor eax, dword [r10 - 4]
xor eax, dword [r8]
mov dword [r9 - 0x10], eax
xor eax, dword [r8 + 4]
mov dword [r9 - 0xc], eax
xor eax, dword [r8 + 8]
mov dword [r9 - 8], eax
xor eax, dword [r8 + 0xc]
mov dword [r9 - 4], eax
cmp rcx, r9
jne 0x1400769f0
movups xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
mov r8, rax
lea rdx, [rax + 0x30]
lea r9, [0x14036a480]
jmp 0x140076ac3
mov eax, dword [r8 + 0x14]
mov r11d, dword [r8 + 0x18]
add rdx, 0x20
add r8, 0x20
pinsrd xmm6, dword [r8 + 0xc], 3
movdqu xmm2, xmmword [r8 - 0x10]
aeskeygenassist xmm0, xmm6, 0
psrldq xmm0, 8
movd r10d, xmm0
xor r10d, dword [r8 - 0x10]
xor eax, r10d
pinsrd xmm0, r10d, 1
xor r11d, eax
movd xmm1, eax
pinsrd xmm1, r11d, 1
punpcklqdq xmm0, xmm1
pxor xmm0, xmm2
pextrd eax, xmm0, 3
movups xmmword [r8 + 0x10], xmm0
pinsrd xmm6, eax, 3
aeskeygenassist xmm0, xmm6, 0
add r9, 4
pextrd eax, xmm0, 3
xor eax, dword [r9 - 4]
xor eax, dword [r8]
mov dword [rdx - 0x10], eax
xor eax, dword [r8 + 4]
mov dword [rdx - 0xc], eax
xor eax, dword [r8 + 8]
mov dword [rdx - 8], eax
xor eax, dword [r8 + 0xc]
mov dword [rdx - 4], eax
cmp rcx, rdx
jne 0x140076a60
movups xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
mov r8, rax
lea rdx, [rax + 0x28]
lea r9, [0x14036a480]
jmp 0x140076b5a
mov eax, dword [r8 + 0x24]
mov r10d, dword [r8 + 0x10]
add rdx, 0x18
add r8, 0x18
movq xmm1, qword [r8 - 8]
xor r10d, eax
movd xmm0, eax
pinsrd xmm0, r10d, 1
pxor xmm0, xmm1
pextrd eax, xmm0, 1
movq qword [r8 + 0x10], xmm0
pinsrd xmm6, eax, 3
aeskeygenassist xmm0, xmm6, 0
add r9, 4
pextrd eax, xmm0, 3
xor eax, dword [r9 - 4]
xor eax, dword [r8]
mov dword [rdx - 0x10], eax
xor eax, dword [r8 + 4]
mov dword [rdx - 0xc], eax
xor eax, dword [r8 + 8]
mov dword [rdx - 8], eax
xor eax, dword [r8 + 0xc]
mov dword [rdx - 4], eax
cmp rdx, rcx
jne 0x140076b20
movups xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
Function at 0x140076ba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm0, xmmword [rcx]
lea eax, [rdx*4]
mov rdx, rax
lea rax, [rcx + rax*4]
movdqu xmm2, xmmword [rax]
sub edx, 4
movups xmmword [rcx], xmm2
movups xmmword [rax], xmm0
cmp edx, 4
jbe 0x140076c10
mov eax, 4
nop dword [rax]
mov r8d, eax
add eax, 4
lea r9, [rcx + r8*4]
mov r8d, edx
sub edx, 4
lea r8, [rcx + r8*4]
aesimc xmm0, xmmword [r9]
aesimc xmm1, xmmword [r8]
movups xmmword [r9], xmm1
movups xmmword [r8], xmm0
cmp eax, edx
jb 0x140076bd0
shl rax, 2
add rcx, rax
aesimc xmm0, xmmword [rcx]
movups xmmword [rcx], xmm0
ret
mov eax, 0x10
add rcx, rax
aesimc xmm0, xmmword [rcx]
movups xmmword [rcx], xmm0
ret
Function at 0x14007cd30
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140387e50]
cmp byte [rax], 0
je 0x14007cd70
mov rax, qword [0x140387eb0]
cmp byte [rax], 0
jne 0x14007cd58
add rsp, 0x38
jmp method.CryptoPP._anonymous_namespace_::SHA256_HashBlock_CXX_unsigned_int__unsigned_int_const_
xor r9d, r9d
mov r8d, 0x40
add rsp, 0x38
jmp method.CryptoPP.SHA256_HashMultipleBlocks_SHANI_unsigned_int__unsigned_int_const__unsigned_long_long__CryptoPP::ByteOrder_
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call method.CryptoPP.DetectX86Features__
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
jmp 0x14007cd40

Function at 0x14007ce10
Capabilities:
Hash data using sha384

Disassembly:
sub rsp, 0x48
movabs rax, 0xcbbb9d5dc1059ed8
movabs rdx, 0x629a292a367cd507
mov qword [rcx], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 8], rdx
movabs rdx, 0x152fecd8f70e5939
mov qword [rcx + 0x10], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x18], rdx
movabs rdx, 0x8eb44a8768581511
mov qword [rcx + 0x20], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x28], rdx
movabs rdx, 0x47b5481dbefa4fa4
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rdx
add rsp, 0x48
ret

Function at 0x14007ce90
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x48
movabs rax, 0x6a09e667f3bcc908
movabs rdx, 0xbb67ae8584caa73b
mov qword [rcx], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 8], rdx
movabs rdx, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x10], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x18], rdx
movabs rdx, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x20], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x28], rdx
movabs rdx, 0x5be0cd19137e2179
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rdx
add rsp, 0x48
ret
Function at 0x1400aba3b
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
call sym.sqlite3_initialize
test eax, eax
jne 0x1400abc0d
mov ecx, 5
call sym.sqlite3MutexAlloc
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.sqlite3_mutex_enter
cmp dword [rbp + 0x10], 0
jle 0x1400aba86
cmp qword [rbp + 0x18], 0
jne 0x1400abaa1
mov dword [0x14042c840], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.sqlite3_mutex_leave
jmp 0x1400abc0e
mov eax, dword [0x14042c840]
test eax, eax
jne 0x1400abb31
mov ecx, 0
call sym.sqlite3_vfs_find
mov qword [rbp - 0x18], rax
mov rax, qword [str.expand_32_byte_k]
mov rdx, qword [0x14037e368]
mov qword [0x14042c840], rax
mov qword [0x14042c848], rdx
cmp qword [rbp - 0x18], 0
jne 0x1400abafc
mov r8d, 0x2c
mov edx, 0
lea rax, [0x14042c850]
mov rcx, rax
call sym.memset
jmp 0x1400abb14
mov rax, qword [rbp - 0x18]
lea r8, [0x14042c850]
mov edx, 0x2c
mov rcx, rax
call sym.sqlite3OsRandomness
mov eax, dword [0x14042c870]
mov dword [0x14042c87c], eax
mov dword [0x14042c870], 0
mov byte [0x14042c8c0], 0
movzx eax, byte [0x14042c8c0]
movzx eax, al
cmp dword [rbp + 0x10], eax
jg 0x1400abb93
mov eax, dword [rbp + 0x10]
movsxd rcx, eax
movzx eax, byte [0x14042c8c0]
movzx eax, al
sub eax, dword [rbp + 0x10]
cdqe
lea rdx, [rax + 0x40]
lea rax, [0x14042c840]
add rdx, rax
mov rax, qword [rbp - 8]
mov r8, rcx
mov rcx, rax
call sym.memcpy
movzx eax, byte [0x14042c8c0]
mov edx, dword [rbp + 0x10]
sub eax, edx
mov byte [0x14042c8c0], al
nop
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.sqlite3_mutex_leave
jmp 0x1400abc0e
movzx eax, byte [0x14042c8c0]
test al, al
je 0x1400abbd9
movzx eax, byte [0x14042c8c0]
movzx edx, al
mov rax, qword [rbp - 8]
mov r8, rdx
lea rdx, [0x14042c880]
mov rcx, rax
call sym.memcpy
movzx eax, byte [0x14042c8c0]
movzx eax, al
sub dword [rbp + 0x10], eax
movzx eax, byte [0x14042c8c0]
movzx eax, al
add qword [rbp - 8], rax
mov eax, dword [0x14042c870]
add eax, 1
mov dword [0x14042c870], eax
lea rax, [0x14042c840]
mov rdx, rax
lea rax, [0x14042c880]
mov rcx, rax
call sym.chacha_block
mov byte [0x14042c8c0], 0x40
jmp 0x1400abb31
nop
add rsp, 0x40
pop rbp
ret
Function at 0x1400abe3a
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
mov qword [rax], 0
mov ecx, 0x28
call sym.sqlite3Malloc
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400abe78
mov eax, 7
jmp 0x1400abf67
movzx eax, byte [0x140355084]
test al, al
je 0x1400abe91
mov ecx, 0xc8
call sym.sqlite3FaultSim
test eax, eax
je 0x1400abeaa
mov rax, qword [rbp - 8]
mov r8d, 0x28
mov edx, 0
mov rcx, rax
call sym.memset
jmp 0x1400abf25
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x18]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x20]
mov qword [rax + 0x18], rdx
mov rax, qword [rbp - 8]
add rax, 8
mov rdx, qword [rbp - 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdx
lea r8, [sym.sqlite3ThreadProc]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.msvcrt.dll__beginthreadex]
call rax
mov rdx, rax
mov rax, qword [rbp - 8]
mov qword [rax], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax]
test rax, rax
jne 0x1400abf25
mov rax, qword [rbp - 8]
mov r8d, 0x28
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400abf57
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 8], eax
mov rax, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
mov rcx, rax
call rdx
mov rdx, qword [rbp - 8]
mov qword [rdx + 0x20], rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov qword [rax], rdx
mov eax, 0
add rsp, 0x40
pop rbp
ret

Function at 0x1400afa76
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov word [rbp - 2], 0x28
cmp qword [rbp + 0x10], 7
ja 0x1400afab5
cmp qword [rbp + 0x10], 1
ja 0x1400afaac
mov eax, 0
jmp 0x1400afb0e
movzx eax, word [rbp - 2]
sub eax, 0xa
mov word [rbp - 2], ax
shl qword [rbp + 0x10], 1
cmp qword [rbp + 0x10], 7
jbe 0x1400afa9d
jmp 0x1400afaed
bsr rax, qword [rbp + 0x10]
xor rax, 0x3f
mov edx, eax
mov eax, 0x3c
sub eax, edx
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov edx, eax
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
mov edx, eax
movzx eax, word [rbp - 2]
add eax, edx
mov word [rbp - 2], ax
mov eax, dword [rbp - 8]
mov ecx, eax
shr qword [rbp + 0x10], cl
mov rax, qword [rbp + 0x10]
and eax, 7
lea rdx, [rax + rax]
lea rax, [0x1403581b0]
movzx eax, word [rdx + rax]
mov edx, eax
movzx eax, word [rbp - 2]
add eax, edx
sub eax, 0xa
add rsp, 0x10
pop rbp
ret
Function at 0x14010929b
Capabilities:
Reference sql statements

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x10]
mov byte [rax + 0x1c], 1
mov r8, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov edx, dword [rbp + 0x30]
mov dword [rsp + 0x30], edx
mov rdx, qword [rbp + 0x28]
mov qword [rsp + 0x28], rdx
mov edx, dword [rbp + 0x20]
mov dword [rsp + 0x20], edx
mov r9, r8
mov r8, rcx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rcx, rax
call sym.sqlite3NestedParse
cmp dword [rbp + 0x20], 0
jne 0x140109321
mov r8, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x10]
mov edx, dword [rbp + 0x30]
mov dword [rsp + 0x20], edx
mov r9, r8
mov r8, rcx
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rax
call sym.sqlite3NestedParse
nop
add rsp, 0x40
pop rbp
ret
Function at 0x1401994f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp + 0x10], ecx
mov dword [rbp + 0x18], edx
mov eax, dword [rbp + 0x10]
mov dword [rbp - 4], eax
cmp dword [rbp + 0x10], 0x7f
jg 0x140199534
cmp dword [rbp + 0x10], 0x40
jle 0x140199679
cmp dword [rbp + 0x10], 0x5a
jg 0x140199679
mov eax, dword [rbp + 0x10]
add eax, 0x20
mov dword [rbp - 4], eax
jmp 0x140199679
cmp dword [rbp + 0x10], 0xffff
jg 0x14019965e
mov dword [rbp - 8], 0xa2
mov dword [rbp - 0xc], 0
mov dword [rbp - 0x10], 0xffffffff
jmp 0x1401995af
mov edx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
add eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp - 0x1c]
cdqe
lea rdx, [rax*4]
lea rax, [0x140380a20]
movzx eax, word [rdx + rax]
movzx eax, ax
mov edx, dword [rbp + 0x10]
sub edx, eax
mov dword [rbp - 0x20], edx
cmp dword [rbp - 0x20], 0
js 0x1401995a6
mov eax, dword [rbp - 0x1c]
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x1c]
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x1401995af
mov eax, dword [rbp - 0x1c]
sub eax, 1
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cmp eax, dword [rbp - 0xc]
jge 0x140199558
mov eax, dword [rbp - 0x10]
cdqe
lea rdx, [rax*4]
lea rax, [0x140380a20]
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx edx, ax
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 3]
movzx eax, al
add eax, edx
cmp dword [rbp + 0x10], eax
jge 0x14019963f
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 2]
movzx eax, al
and eax, 1
mov edx, eax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
xor eax, dword [rbp + 0x10]
and eax, edx
test eax, eax
jne 0x14019963f
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 2]
shr al, 1
movzx eax, al
cdqe
lea rdx, [rax + rax]
lea rax, [0x140380cc0]
movzx eax, word [rdx + rax]
movzx edx, ax
mov eax, dword [rbp + 0x10]
add eax, edx
and eax, 0xffff
mov dword [rbp - 4], eax
cmp dword [rbp + 0x18], 0
je 0x140199679
cmp dword [rbp + 0x18], 2
sete al
movzx edx, al
mov eax, dword [rbp - 4]
mov ecx, eax
call sym.remove_diacritic
mov dword [rbp - 4], eax
jmp 0x140199679
cmp dword [rbp + 0x10], 0x103ff
jle 0x140199679
cmp dword [rbp + 0x10], 0x10427
jg 0x140199679
mov eax, dword [rbp + 0x10]
add eax, 0x28
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret