joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e070
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r10d, dword [rcx]
mov rbx, r9
mov dword [rsp + 0x60], 0
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r10d, r10d
je 0x14000e0d2
cmp r10d, 1
jne 0x14000e194
call fcn.14000daf0
xor edi, edi
test rax, rax
setne dil
test rax, rax
je 0x14000e108
mov ecx, dword [rax + 8]
btr ecx, 0x1f
test rbx, rbx
je 0x14000e0cc
mov eax, dword [rax + 0x10]
mov dword [rbx], eax
mov dword [rsp + 0x60], ecx
jmp 0x14000e10c
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edi, edi
test eax, eax
sete dil
test eax, eax
je 0x14000e108
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [rsp + 0x60]
test edi, edi
je 0x14000e194
test ecx, ecx
je 0x14000e1a0
mov edx, ecx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, qword [rsp + 0x80]
mov qword [rdi], rax
test rax, rax
je 0x14000e1a0
lea rcx, [rsp + 0x60]
mov r8, rbp
mov qword [rsp + 0x30], rcx
mov rdx, r14
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call fcn.14000dc50
mov ebx, eax
test eax, eax
je 0x14000e178
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14000e1a2
mov eax, dword [rsp + 0x60]
mov dword [rcx], eax
mov eax, ebx
jmp 0x14000e1a2
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov eax, ebx
jmp 0x14000e1a2
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___pre___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400111d0
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
cmp qword [0x1401b28a0], 0
lea rax, [rbp + 0x1f]
mov rbx, qword [rcx + 8]
mov rdi, rcx
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x59], 0x10
mov dword [rbp - 0x55], 0x10
je 0x1400113c8
cmp dword [0x1401b2898], 0
je 0x1400113c8
cmp dword [rcx], 0x14
jb 0x1400113af
test rbx, rbx
je 0x1400113af
lea rcx, [rbp - 0x39]
mov qword [rsp + 0xb8], r14
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, dword [0x1401b2898]
lea rcx, [rbp - 0x39]
mov rdx, qword [0x1401b28a0]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 0x10
lea rcx, [rbp - 0x39]
mov rdx, rbx
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Final]
mov eax, dword [rdi]
lea r14, [rbx + 0x10]
sub eax, 0x10
mov qword [rbp - 0x41], r14
lea rdx, [rbp - 0x59]
mov dword [rbp - 0x45], eax
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x49], eax
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
test eax, eax
js 0x14001139f
mov qword [rsp + 0xf8], rsi
lea rdx, [rbp + 0x67]
mov esi, dword [rdi]
mov ecx, 0xffffff7c
sub esi, 0x14
mov qword [rsp + 0xb0], r15
call qword [sym.imp.cryptdll.dll_CDLocateCheckSum]
test eax, eax
js 0x140011391
mov rax, qword [rbp + 0x67]
lea rdx, [rbp + 0x77]
xor ecx, ecx
call qword [rax + 0x10]
test eax, eax
js 0x140011391
mov rax, qword [rbp + 0x67]
lea r15, [rbx + 0x14]
mov rcx, qword [rbp + 0x77]
mov r8, r15
mov edx, esi
call qword [rax + reloc.ODBC32.dll_SQLAllocHandle]
mov rax, qword [rbp + 0x67]
lea rdx, [rbp + 0x6f]
mov rcx, qword [rbp + 0x77]
call qword [rax + 0x20]
mov rdx, qword [rbp + 0x67]
lea rcx, [rbp + 0x77]
mov ebx, eax
call qword [rdx + Ordinal_41]
test ebx, ebx
js 0x140011391
mov r8d, dword [r14]
mov edx, dword [rbp + 0x6f]
cmp edx, r8d
jne 0x140011360
mov rbx, qword [rdi + 8]
mov ecx, 0x40
mov edx, esi
mov r14d, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi + 8], rax
test rax, rax
je 0x14001136c
mov r8d, r14d
mov rdx, r15
mov rcx, rax
call fcn.14011b4a0
mov dword [rdi], esi
test rbx, rbx
je 0x140011359
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x14001136e
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Checksums_dont_match__C:0x_08x___R:0x_08x__n
call fcn.14000afb0
xor eax, eax
mov rsi, qword [rsp + 0xf8]
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
add rsp, 0xc0
pop rdi
pop rbx
pop rbp
ret
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___Unable_to_calculate_CRC32_n
call fcn.14000afb0
jmp 0x14001136c
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___RtlDecryptData2_n
call fcn.14000afb0
xor eax, eax
jmp 0x14001137e
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_valid_data_n
call fcn.14000afb0
xor eax, eax
add rsp, 0xc0
pop rdi
pop rbx
pop rbp
ret
lea rcx, str.ERROR_kull_m_rpc_drsr_ProcessGetNCChangesReply_decrypt___No_Session_Key_n
call fcn.14000afb0
xor eax, eax
add rsp, 0xc0
pop rdi
pop rbx
pop rbp
ret
Function at 0x140011b80
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rdx, str.ServicesActive
xor ebx, ebx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140011be6
mov r8d, 0x10000
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140011bdd
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140012cd0
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r12, r8
mov r15, rdx
mov r14, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea ecx, [rdi + 0x40]
and eax, 3
lea edx, [rax + 1]
add edx, esi
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x140012df5
mov qword [rsp + 0x60], rbx
lea r8, [rsi + rsi]
mov rdx, r14
mov rcx, rax
mov ebx, esi
call fcn.14011b4a0
test esi, esi
je 0x140012d71
mov rax, rbp
lea edx, [rdi + 0x2b]
lea r8d, [rdi + 0x2f]
lea r9d, [rdi + 0x3d]
movzx ecx, word [rax]
cmp cx, 0x2d
jne 0x140012d52
mov word [rax], dx
jmp 0x140012d67
cmp cx, 0x5f
jne 0x140012d5e
mov word [rax], r8w
jmp 0x140012d67
test cx, cx
jne 0x140012d67
mov word [rax], r9w
add rax, 2
sub rbx, 1
jne 0x140012d44
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, rbp
mov qword [r15], rdi
mov dword [r12], edi
lea r8d, [r9 + 1]
mov qword [rsp + 0x20], r12
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x140012dec
mov edx, dword [r12]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r15], rax
test rax, rax
je 0x140012dec
xor edx, edx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov r9, rax
mov rcx, rbp
mov qword [rsp + 0x20], r12
lea r8d, [rdx + 1]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov edi, eax
test eax, eax
jne 0x140012dec
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [r15], rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x68]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
ret

Function at 0x140012e20
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x40
mov ebp, r8d
lea rax, [rsp + 0x30]
mov r14, rdx
mov qword [rsp + 0x20], rax
mov r15, r9
mov rsi, rcx
xor ebx, ebx
mov edx, ebp
mov rcx, r14
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov r8d, 0x80000001
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x140012ee3
mov edx, dword [rsp + 0x30]
lea ecx, [rbx + 0x40]
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140012ec8
lea rax, [rsp + 0x30]
mov r9, rdi
mov r8d, 0x80000001
mov qword [rsp + 0x20], rax
mov edx, ebp
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x140012ebf
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8, rsi
lea rdx, str._____BEGIN__s______n_s_____END__s______n
mov rcx, r15
call fcn.140012fa0
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
mov eax, ebx
jmp 0x140012ecf
Function at 0x1400132e0
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor edi, edi
lea rax, [rsp + 0x30]
mov rsi, r8
mov qword [rsp + 0x20], rax
mov rbp, rdx
lea r8, [rsp + 0x68]
mov rbx, rcx
lea r9d, [rdi + 4]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400133b9
mov eax, dword [rsp + 0x68]
cmp eax, 1
jne 0x140013371
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9d, [rdi + 1]
lea edx, [rdi + 8]
mov dword [rsp + 0x20], 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
test eax, eax
jne 0x14001337b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___DuplicateTokenEx__0x_08x__n
call fcn.14000afb0
mov eax, dword [rsp + 0x68]
jmp 0x140013376
mov qword [rsp + 0x38], rbx
cmp eax, 1
je 0x1400133cd
mov rcx, qword [rsp + 0x38]
mov r8, rsi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ebx, eax
test eax, eax
jne 0x1400133a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___CheckTokenMembership__0x_08x__n
call fcn.14000afb0
test edi, edi
je 0x1400133b5
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1400133cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_token_CheckTokenMembership___GetTokenInformation__0x_08x__n
call fcn.14000afb0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140013500
Capabilities:
Get user security identifier

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebx, ebx
lea rbp, [r11 - 0x24]
test r9, r9
mov dword [rsp + 0x40], ebx
mov rdi, rdx
mov dword [r11 + 0x20], ebx
cmovne rbp, r9
lea rax, [r11 + 0x20]
mov qword [r11 - 0x38], rbp
lea r9, [r11 - 0x28]
mov rsi, r8
mov qword [r11 - 0x40], rax
mov r14, rcx
mov qword [r11 - 0x48], rbx
mov rdx, rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1400135f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400135f1
mov edx, dword [rsp + 0x40]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x1400135f1
mov edx, dword [rsp + 0x88]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi], rax
test rax, rax
je 0x1400135e5
mov r8, qword [rdi]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rdx, r14
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test eax, eax
jne 0x1400135f3
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], rax
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140039ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push r12
push r13
push r15
sub rsp, 0x48
mov rax, qword [rcx + 8]
mov r13, rcx
mov r15d, edx
mov r12d, r9d
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov rbp, qword [r11]
mov r10, qword [rax + 8]
movsxd rax, dword [r10 + 0x30]
movsxd r10, dword [r11 + 0x30]
cmp eax, r10d
mov qword [rsp + 0x20], rax
mov ecx, r10d
cmovl ecx, eax
imul r15, rax
mov dword [rsp + 0x78], ecx
cmp eax, r10d
je 0x140039b46
cmp byte [rbp + 0x10], 0
je 0x140039b46
mov eax, 8
add rsp, 0x48
pop r15
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x40], rsi
mov rsi, r15
mov qword [rsp + 0x30], r14
sub rsi, rax
xor ebx, ebx
mov qword [rsp + 0x38], rdi
mov r14, r10
nop dword [rax + rax]
cmp rsi, r15
jge 0x140039ce9
mov rax, rsi
mov qword [rsp + 0x70], 0
cqo
idiv r14
mov rdi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 8]
mov eax, 0x40000000
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x140039cde
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, r10d
mov rcx, rbp
call qword [rbp + 0x108]
mov ebx, eax
test eax, eax
jne 0x140039c85
mov rcx, qword [rsp + 0x70]
test byte [rcx + 0x34], 4
mov rdx, qword [rcx + 0x28]
je 0x140039bf6
mov eax, dword [rcx + 0x30]
cmp dword [rdx + 0x1c], eax
jb 0x140039bf6
cmp dword [rdx + 0x80], ebx
je 0x140039bf2
call fcn.140025a60
jmp 0x140039c1b
xor ebx, ebx
jmp 0x140039c26
mov ebx, dword [rdx + 0x2c]
test ebx, ebx
jne 0x140039c8a
mov eax, dword [rdx + 0xbc]
cmp dword [rdx + 0xb8], eax
jbe 0x140039c16
call fcn.140027400
jmp 0x140039c1b
call fcn.140027180
mov ebx, eax
test eax, eax
jne 0x140039c85
mov rcx, qword [rsp + 0x70]
add rdi, qword [rcx + 8]
mov rax, rsi
movsxd r8, dword [rsp + 0x78]
cqo
idiv qword [rsp + 0x20]
mov rcx, rdi
add rdx, qword [rsp + 0x80]
call fcn.14011b4a0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x10]
mov byte [rcx], 0
test rsi, rsi
jne 0x140039c85
test r12d, r12d
jne 0x140039c85
mov rax, qword [r13 + 0x28]
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0x3c]
mov eax, edx
shr eax, 0x18
mov byte [rdi + 0x1c], al
mov eax, edx
shr eax, 0x10
mov byte [rdi + 0x1d], al
mov eax, edx
shr eax, 8
mov byte [rdi + 0x1e], al
mov byte [rdi + 0x1f], dl
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140039cde
test byte [rcx + 0x34], 0x20
je 0x140039cd9
mov r8, qword [rcx + 0x28]
mov rax, qword [r8 + 0xa8]
dec dword [r8 + 0x98]
mov qword [rcx + 0x20], rax
mov r9, qword [r8 + 0x48]
movsxd rax, dword [r8 + 0xbc]
mov qword [r8 + 0xa8], rcx
mov edx, dword [rcx + 0x30]
mov r8, qword [rcx + 8]
dec edx
mov r10, qword [r9]
mov rcx, r9
imul rdx, rax
call qword [r10 + Ordinal_145]
jmp 0x140039cde
call fcn.140020d40
add rsi, r14
test ebx, ebx
je 0x140039b70
mov rdi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x30]
add rsp, 0x48
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x14005a0c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x70
movzx r9d, byte [rdx]
mov rsi, rcx
movzx eax, r9b
cmp r9b, 0xab
jne 0x14005a0db
movzx eax, byte [rdx + 0x32]
mov qword [rsp + 0x50], r15
cmp al, 0xac
jne 0x14005a0ed
lea r15, [rdx + 0x20]
mov rax, r15
jmp 0x14005a0fd
cmp al, 0x86
jne 0x14005a23a
mov rax, qword [rdx + 0x20]
lea r15, [rdx + 0x20]
mov rax, qword [rax]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x14005a23a
mov qword [rsp + 0x60], r13
xor r13d, r13d
mov dword [r8], r13d
cmp r9b, 0x86
jne 0x14005a134
mov rcx, rsi
mov r13, qword [rsp + 0x60]
mov r15, qword [rsp + 0x50]
add rsp, 0x70
pop rsi
jmp fcn.140058370
mov eax, dword [rsi + 0x38]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x58], r14
mov r14, rcx
lea r12d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r12d
mov dword [rsi + 0x38], eax
test ecx, ecx
jle 0x14005a235
mov qword [rsp + 0x80], rbx
lea rcx, [0x1400567a0]
mov qword [rsp + 0x90], rbp
mov rbp, r13
mov qword [rsp + 0x98], rdi
mov edi, r12d
lea r12, [fcn.140056930]
nop dword [rax]
mov rax, qword [r15]
mov rbx, qword [rax + rbp + 8]
cmp byte [rsi + 0x23], r13b
je 0x14005a1db
mov byte [rsp + 0x44], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], r13d
test rbx, rbx
je 0x14005a1cb
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140050350
cmp byte [rsp + 0x44], r13b
je 0x14005a1db
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.14005b6c0
jmp 0x14005a1e9
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.14005ba00
inc edi
lea rcx, [0x1400567a0]
add rbp, 0x28
sub r14, 1
jne 0x14005a190
mov eax, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
mov r15, qword [rsp + 0x50]
add rsp, 0x70
pop rsi
ret
mov eax, r12d
jmp 0x14005a21b
mov rcx, rsi
mov r15, qword [rsp + 0x50]
add rsp, 0x70
pop rsi
jmp fcn.14005b8d0

Function at 0x14005d6e0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
lea r9, str.sqlite_master
mov rdi, rdx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.140065a20
test ebx, ebx
jne 0x14005d734
mov r9, rdi
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.140065a20
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140065c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
lea r14, [0x140149330]
mov rdi, rdx
mov rbp, rcx
xor ebx, ebx
cmp dword [rbp + 0x28], ebx
jle 0x140065d37
nop dword [rax]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
test rsi, rsi
je 0x140065d04
mov rcx, qword [rbp + 0x20]
mov rax, rsi
movsxd rdx, r10d
shl rdx, 5
mov r9, qword [rdx + rcx]
sub r9, rsi
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x140065d73
test edx, edx
jne 0x140065d82
mov rax, qword [rbp + 0x20]
xor r8d, r8d
movsxd rcx, r10d
mov rdx, rdi
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.14001bfc0
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140065ddb
inc ebx
cmp ebx, dword [rbp + 0x28]
jl 0x140065cc0
lea r8, str.sqlite_master
sub r8, rdi
movzx ecx, byte [rdi]
movzx eax, byte [r8 + rdi]
cmp ecx, eax
jne 0x140065d8a
test ecx, ecx
jne 0x140065d98
mov rax, qword [rbp + 0x20]
mov r9, qword [rax + 0x20]
test rsi, rsi
jne 0x140065d9d
neg r9
sbb edx, edx
test edx, edx
jne 0x140065dd9
lea rdi, str.sqlite_temp_master
jmp 0x140065cb2
movzx r8d, byte [rcx + r14]
movzx edx, byte [rdx + r14]
cmp edx, r8d
jne 0x140065d30
inc rax
jmp 0x140065cf0
movzx edx, byte [rax + r14]
movzx ecx, byte [rcx + r14]
cmp ecx, edx
jne 0x140065dd9
inc rdi
jmp 0x140065d41
test r9, r9
je 0x140065dd9
mov r8, rsi
sub r9, rsi
nop dword [rax + rax]
movzx edx, byte [r8]
movzx eax, byte [r9 + r8]
cmp edx, eax
jne 0x140065dc6
test edx, edx
je 0x140065d67
inc r8
jmp 0x140065db0
movzx ecx, byte [rax + r14]
movzx edx, byte [rdx + r14]
sub edx, ecx
jne 0x140065d63
inc r8
jmp 0x140065db0
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140066100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor r10d, r10d
mov rdi, r8
mov ebx, r10d
mov rbp, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x1400661b8
mov qword [rsp + 0x48], r14
lea r14, [0x140149330]
mov eax, ebx
xor eax, 1
cmp ebx, 2
cmovge eax, ebx
movsxd r9, eax
shl r9, 5
add r9, qword [rsi + 0x20]
mov r11, qword [r9 + 0x18]
test rdi, rdi
je 0x140066170
mov r9, qword [r9]
mov rax, rdi
sub r9, rdi
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x1400661a4
test edx, edx
jne 0x1400661b3
lea rcx, [r11 + 0x20]
xor r8d, r8d
mov rdx, rbp
call fcn.14001bfc0
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x14006618f
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x140066130
mov r14, qword [rsp + 0x48]
mov rax, r10
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
movzx r8d, byte [rcx + r14]
movzx edx, byte [rdx + r14]
cmp edx, r8d
jne 0x140066188
inc rax
jmp 0x140066160
mov rbx, qword [rsp + 0x50]
mov rax, r10
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006abe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [rcx]
mov r12, r9
movsxd r10, edx
mov r13, r8
shl r10, 5
mov r15, rcx
mov r14d, 1
mov rdx, qword [rax + 0x20]
mov rsi, qword [r10 + rdx]
nop dword [rax]
mov r9d, r14d
lea r8, str.sqlite_stat_d
lea rdx, [rsp + 0x30]
mov ecx, reloc.ODBC32.dll_SQLAllocHandle
call fcn.140019d70
mov rbp, qword [r15]
lea rdi, [rsp + 0x30]
xor ebx, ebx
cmp dword [rbp + 0x28], ebx
jle 0x14006acc5
nop dword [rax + rax]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
test rsi, rsi
je 0x14006ac94
mov rcx, qword [rbp + 0x20]
mov rax, rsi
movsxd rdx, r10d
shl rdx, 5
mov r9, qword [rdx + rcx]
sub r9, rsi
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x14006ad06
test edx, edx
jne 0x14006ad1c
mov rax, qword [rbp + 0x20]
xor r8d, r8d
movsxd rcx, r10d
mov rdx, rdi
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.14001bfc0
cmp qword [rax + 0x10], 0
jne 0x14006ad7d
inc ebx
cmp ebx, dword [rbp + 0x28]
jl 0x14006ac50
lea r8, str.sqlite_master
sub r8, rdi
nop
movzx ecx, byte [rdi]
movzx eax, byte [r8 + rdi]
cmp ecx, eax
jne 0x14006ad24
test ecx, ecx
jne 0x14006ad37
mov rax, qword [rbp + 0x20]
mov r9, qword [rax + 0x20]
test rsi, rsi
jne 0x14006ad3c
neg r9
sbb edx, edx
test edx, edx
jne 0x14006ad9e
lea rdi, str.sqlite_temp_master
jmp 0x14006ac41
lea r11, [0x140149330]
movzx r8d, byte [rcx + r11]
movzx edx, byte [rdx + r11]
cmp edx, r8d
jne 0x14006acbe
inc rax
jmp 0x14006ac80
lea rbx, [0x140149330]
movzx edx, byte [rax + rbx]
movzx ecx, byte [rcx + rbx]
cmp ecx, edx
jne 0x14006ad9e
inc rdi
jmp 0x14006acd0
test r9, r9
je 0x14006ad9e
mov r8, rsi
lea r10, [0x140149330]
sub r9, rsi
nop
movzx edx, byte [r8]
movzx eax, byte [r9 + r8]
cmp edx, eax
jne 0x14006ad66
test edx, edx
je 0x14006acfa
inc r8
jmp 0x14006ad50
movzx ecx, byte [rax + r10]
movzx edx, byte [rdx + r10]
sub edx, ecx
jne 0x14006acf2
inc r8
jmp 0x14006ad50
mov qword [rsp + 0x28], r12
lea r9, [rsp + 0x30]
mov r8, rsi
mov qword [rsp + 0x20], r13
lea rdx, str.DELETE_FROM__Q._s_WHERE__s_Q
mov rcx, r15
call fcn.140065a20
inc r14d
cmp r14d, 4
jle 0x14006ac20
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret