joyce8/EMBER2024-capa huggingface dataset:
Function at 0x504560
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x504578
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x504578
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x504580
xor eax, eax
ret
cmp rbx, 3
je 0x50458c
cmp rbx, 4
jne 0x5045b9
cmp al, 0x2c
ja 0x5045a6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5045b6
cmp al, 0x24
je 0x5045b6
nop dword [rax]
cmp al, 0x26
jae 0x5045b6
jmp 0x5045b9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5045b6
cmp al, 0x5b
je 0x5045b6
cmp al, 0x5d
jne 0x5045b9
xor eax, eax
ret
cmp al, 0x2f
ja 0x5045f2
nop dword [rax]
cmp al, 0x26
ja 0x5045d1
cmp al, 0x24
je 0x504611
cmp al, 0x26
je 0x504611
jmp 0x50468b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x504611
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x504688
cmp al, 0x2f
je 0x504611
jmp 0x50468b
cmp al, 0x3d
ja 0x504609
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x504611
nop
cmp al, 0x3d
je 0x504611
jmp 0x50468b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x504680
cmp rbx, 2
jg 0x504647
cmp rbx, 1
je 0x504641
nop dword [rax]
cmp rbx, 2
jne 0x50468b
cmp al, 0x2f
je 0x504632
cmp al, 0x3b
je 0x504632
cmp al, 0x2c
jne 0x504639
mov ecx, 1
jmp 0x50463e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x50466a
cmp al, 0x40
je 0x504659
cmp al, 0x2f
je 0x504659
cmp al, 0x3f
jne 0x504662
mov ecx, 1
nop
jmp 0x504667
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x504679
cmp rbx, 7
jne 0x50468b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x504688
cmp al, 0x7e
jne 0x50468b
xor eax, eax
ret
cmp rbx, 7
jne 0x5046a1
cmp al, 0x21
je 0x50469d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5046a1
xor eax, eax
nop
ret
mov eax, 1
ret

Function at 0x505bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505cad
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
nop dword [rax + rax]
test rcx, rcx
jle 0x505c99
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call dbg.github.com/mattn/go-sqlite3._cgo_cmalloc
xorps xmm15, xmm15
mov r14, qword [0x007e3638]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rcx
mov rsi, rcx
cmovl rsi, rbx
mov rdi, qword [rsp + 0x58]
cmp rdi, rdx
jne 0x505c53
cmp rbx, rcx
jmp 0x505c85
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov rax, rdx
mov rbx, rdi
mov rcx, rsi
call dbg.runtime.memmove
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rdx, qword [rsp + 0x40]
mov rbx, rax
mov rax, qword [rsp + 0x38]
jae 0x505c91
mov byte [rdx + rbx], 0
add rsp, 0x48
pop rbp
ret
mov rax, rbx
call dbg.runtime.panicIndex
lea rax, [0x00619500]
lea rbx, [0x00675420]
call dbg.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp dbg.github.com/mattn/go-sqlite3._Cfunc_CString
Function at 0x50d940
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50da10
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edi
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
lea rax, [0x00615240]
lea rbx, [rsp + 0x48]
xor ecx, ecx
xor edi, edi
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 8], rdx
mov edx, dword [rsp + 0x70]
mov dword [rsp + 0x10], edx
mov edx, dword [rsp + 0x74]
mov dword [rsp + 0x14], edx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x30], rdx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_create_function
xorps xmm15, xmm15
mov r14, qword [0x007e3638]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x38]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteConn).RegisterFunc.sqlite3CreateFunction.func3

Function at 0x514160
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x514235
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
lea rax, [0x00615240]
lea rbx, [rsp + 0x38]
xor ecx, ecx
xor edi, edi
nop
call dbg.runtime.cgoCheckPointer
lea rax, [0x00618180]
mov rbx, qword [rsp + 0x60]
lea rcx, [0x00619900]
lea rdi, [0x005f9328]
nop
call dbg.runtime.cgoCheckPointer
lea rax, [0x006181c0]
mov rbx, qword [rsp + 0x68]
lea rcx, [0x00619900]
lea rdi, [0x005f9328]
nop
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x30]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], 0xffffffff
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_prepare_v2_internal
xorps xmm15, xmm15
mov r14, qword [0x007e3638]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x28]
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteConn).prepare.func2
Function at 0x514d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x514e1d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
test rdi, rdi
jbe 0x514e12
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x006153c0]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov edx, dword [rsp + 0x50]
mov dword [rsp + 8], edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x18], edx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_bind_text
xorps xmm15, xmm15
mov r14, qword [0x007e3638]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rcx, rax
call dbg.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteStmt).bind.func13

Function at 0x5152c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51535d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
test rdi, rdi
jbe 0x515352
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x006153c0]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov edx, dword [rsp + 0x50]
mov dword [rsp + 8], edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x18], edx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_bind_text
xorps xmm15, xmm15
mov r14, qword [0x007e3638]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rcx, rax
call dbg.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteStmt).bind.func6
Function at 0x517e20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x517ecd
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x00615240]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
nop
call dbg.runtime.cgoCheckPointer
lea rax, [0x006181c0]
mov rbx, qword [rsp + 0x60]
lea rcx, [0x00619900]
lea rdi, [0x005f9328]
nop
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
call dbg.github.com/mattn/go-sqlite3._Cfunc_sqlite3_load_extension
xorps xmm15, xmm15
mov r14, qword [0x007e3638]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteConn).loadExtension.func4

Function at 0x51f7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movsxd rbp, dword [rdx]
mov rbx, rbp
mov r12, rcx
mov rcx, r8
movzx r8d, byte [r8]
mov r13, rdx
lea rdi, [r12 + rbp]
test r8b, r8b
je 0x51f82d
mov eax, r8d
mov rsi, rcx
lea r10, [0x00746f40]
xor edx, edx
nop word [rax + rax]
movzx r9d, al
test byte [r10 + r9], 6
jne 0x51f80f
cmp al, 0x5f
jne 0x51f81e
movzx eax, byte [rsi + 1]
add rsi, 1
add edx, 1
test al, al
jne 0x51f800
movzx eax, r8b
test byte [r10 + rax], 4
je 0x51f8c0
mov byte [rdi], 0x22
add ebx, 1
movzx eax, byte [rcx]
mov r8d, 1
movsxd rbp, ebx
lea rdi, [r12 + rbp]
test al, al
jne 0x51f861
jmp 0x51f8a8
movzx eax, byte [rcx + 1]
add rcx, 1
mov ebx, edx
test al, al
je 0x51f88b
movsxd rbp, ebx
lea edx, [rbx + 1]
mov byte [r12 + rbp], al
movsxd rdi, edx
add rdi, r12
cmp byte [rcx], 0x22
jne 0x51f850
add rcx, 1
mov byte [rdi], 0x22
add ebx, 2
movzx eax, byte [rcx]
movsxd rbp, ebx
lea rdi, [r12 + rbp]
test al, al
jne 0x51f85e
test r8d, r8d
jne 0x51f8a8
mov byte [rdi], 0
mov dword [r13], ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
add ebx, 1
mov byte [rdi], 0x22
movsxd rdi, ebx
add rdi, r12
jmp 0x51f890
mov dword [rsp + 0x2c], 0x3b
cmp edx, 1
jg 0x51f8f0
cmp byte [rsi], 0
setne al
xor edx, 1
and edx, 1
or al, dl
jne 0x51f82d
mov eax, r8d
xor r8d, r8d
jmp 0x51f861
lea r8, [rsp + 0x2c]
call dbg.keywordCode
cmp dword [rsp + 0x2c], 0x3b
jne 0x51f82d
cmp byte [rsi], 0
jne 0x51f82d
movzx eax, byte [rcx]
test al, al
je 0x51f890
xor r8d, r8d
jmp 0x51f861

Function at 0x5217c0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x5217f0
lea eax, [rdx - 1]
lea r9, [rcx + rax + 1]
xor eax, eax
nop
movsx r8d, byte [rcx]
lea edx, [rax*8]
add rcx, 1
xor edx, r8d
xor eax, edx
cmp r9, rcx
jne 0x5217d0
and eax, 0x7fffffff
ret
xor eax, eax
ret
Function at 0x522a40
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
lea rbp, [rsp + 0x20]
movsxd r8, edx
mov edi, edx
mov rcx, rsi
xor edx, edx
call sym.memset
mov rcx, rbp
call qword [sym.GetSystemTime]
mov rdx, rbp
lea r9, [rsp + 0x30]
xor r8d, r8d
nop word [rax + rax]
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp r9, rdx
jne 0x522a80
call qword [sym.GetCurrentProcessId]
lea r12, [rsp + 0x24]
mov rdx, rbp
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp r12, rdx
jne 0x522ab0
call qword [sym.GetTickCount]
mov rdx, rbp
xor r8d, r8d
mov dword [rsp + 0x20], eax
nop dword [rax + rax]
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp r12, rdx
jne 0x522ae0
mov rcx, rbp
call qword [sym.QueryPerformanceCounter]
mov rax, rbp
lea r9, [rsp + 0x28]
xor r8d, r8d
nop
lea edx, [rbx + 1]
movzx ecx, byte [rax]
xor byte [rsi + rbx], cl
cmp edi, edx
cmovle edx, r8d
add rax, 1
movsxd rbx, edx
cmp r9, rax
jne 0x522b10
cmp edi, 0x20
mov eax, 0x20
cmovle eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x524010
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
jle 0x524060
mov r8, rbx
xor eax, eax
nop dword [rax]
movsx r10d, byte [r8]
lea r9d, [rax*8]
add r8, 1
xor r9d, r10d
xor eax, r9d
mov r9d, ebx
sub r9d, r8d
add r9d, edx
test r9d, r9d
jg 0x524028
and eax, 0x7fffffff
add rsp, 0x20
pop rbx
ret
call sym.strlen
mov rcx, rax
mov edx, eax
xor eax, eax
test ecx, ecx
jg 0x52401c
add rsp, 0x20
pop rbx
ret
Function at 0x52ffd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edi, dword [rcx + 0x80]
movsxd rax, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rbp, rax
sub rdx, rax
shl rdx, 3
call sym.sqlite3Realloc
mov r12, rax
test rax, rax
je 0x5300e7
movsxd rdx, edi
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [r12 + rax*8]
mov eax, ebp
sub eax, edi
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sym.memset
mov qword [rsi + 0x78], r12
cmp edi, ebp
jl 0x5300b7
jmp 0x530100
mov rax, qword [rsi + 0x60]
test rax, rax
jle 0x5300c9
mov qword [rbx], rax
mov eax, dword [rsi + 0x3c]
mov ecx, 0x200
mov dword [rbx + 0x1c], eax
call dbg.sqlite3MallocZero
test rax, rax
je 0x5300d8
mov dword [rax], r12d
mov qword [rbx + 0x10], rax
mov rax, qword [rsi + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x5300a6
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add edi, 1
add rbx, 0x38
mov dword [rsi + 0x80], edi
cmp edi, ebp
je 0x530100
mov rax, qword [rsi + 0x50]
mov r12d, dword [rsi + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r12d
jne 0x530050
mov eax, dword [rsi + 0xb8]
jmp 0x530059
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x535640
Capabilities:
Create thread

Disassembly:
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x535670
mov r8d, dword [rax + 0x20]
test r8d, r8d
je 0x535668
mov r8, rcx
mov rcx, qword [rax]
lea rdx, [dbg.vdbePmaReaderBgIncrInit]
jmp dbg.sqlite3ThreadCreate
jmp dbg.vdbePmaReaderIncrMergeInit
xor eax, eax
ret
Function at 0x55f740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rdi, [0x007407c0]
mov r15, r8
mov r8, qword [r8]
mov r12, rcx
movzx eax, word [r8 + 0x14]
and eax, 0x3f
cmp byte [rdi + rax], 5
je 0x55f7ef
cmp edx, 1
jle 0x55f807
mov rax, qword [rcx + 8]
mov rcx, qword [rcx + 0x18]
xor r13d, r13d
lea ebp, [rdx - 2]
mov ebx, 1
cmp qword [rax + 8], 0
movsxd rax, dword [r12 + 0x20]
mov r8, qword [rcx + 0x88]
setne r13b
add rbp, 2
xor esi, esi
lea rax, [rax + rax*2]
neg r13d
lea rax, [r8 + rax*8]
mov r14, qword [rax - 8]
jmp 0x55f7de
movsxd rax, esi
mov r8, r14
mov rcx, qword [r15 + rax*8]
call dbg.sqlite3MemCompare
xor eax, r13d
cmovns esi, ebx
add rbx, 1
cmp rbp, rbx
je 0x55f800
mov rdx, qword [r15 + rbx*8]
movzx eax, word [rdx + 0x14]
and eax, 0x3f
cmp byte [rdi + rax], 5
jne 0x55f7c0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd rsi, esi
mov r8, qword [r15 + rsi*8]
mov rdx, r8
mov rcx, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.sqlite3_result_value
Function at 0x577120
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12d, ecx
mov r13, rdx
call sym.sqlite3_initialize
test eax, eax
jne 0x577150
mov rdx, r13
mov ecx, r12d
add rsp, 0x28
pop r12
pop r13
jmp sym.sqlite3_randomness.part.0
add rsp, 0x28
pop r12
pop r13
ret
Function at 0x57ca90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
jne 0x57cae0
movzx eax, byte [rcx + 0x10]
test al, al
je 0x57cae0
cmp al, 1
je 0x57cae8
mov r9, qword [rcx + 8]
test r8, r8
je 0x57cabb
mov rax, qword [r9 + 0x18]
mov rax, qword [rax + 0x50]
mov eax, dword [rax + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x57caf5
mov rax, qword [rcx]
mov rcx, qword [r9]
mov edx, dword [rax + 0x2e0]
cmp edx, dword [rcx + 0x80]
jle 0x57caf5
cmp byte [rcx + 0xa], 0
je 0x57caf5
jmp dbg.pagerOpenSavepoint
jmp dbg.btreeBeginTrans
test edx, edx
jne 0x57cae0
mov r9, qword [rcx + 8]
test r8, r8
jne 0x57caab
xor eax, eax
ret

Function at 0x5831c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, qword [rsp + 0x90]
mov r14, r8
mov r12, rcx
mov rbx, rdx
mov r8d, r9d
test rdx, rdx
je 0x583290
mov rsi, qword [rcx + 0x80]
mov rcx, rsi
call dbg.sqlite3VdbeAllocUnpackedRecord
mov r13, rax
test rax, rax
je 0x5832b0
mov qword [rsp + 0x20], rax
lea rdx, [rsi + 0x10]
lea rcx, [rsi + 4]
mov r9, rbx
mov r8d, r14d
call sym.sqlite3VdbeRecordUnpack.isra.0
movzx eax, word [r13 + 0x1c]
test ax, ax
je 0x583231
cmp ax, word [rsi + 8]
jbe 0x5832c0
lea rax, [0x00735444]
mov r9d, 0x11532
lea r8, str.database_corruption
mov ecx, 0xb
mov qword [rsp + 0x20], rax
lea rdx, str._s_at_line__d_of___.10s_
mov r14d, 0xb
call dbg.sqlite3_log
mov rax, qword [r12 + 0x80]
mov rdx, r13
mov rcx, qword [rax + 0x10]
call sym.sqlite3DbFreeNN
mov eax, r14d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov r9, rdi
mov rdx, r14
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
jmp dbg.sqlite3BtreeTableMoveto
mov r14d, 7
jmp 0x583275
mov r8, rdi
mov rdx, r13
mov rcx, r12
call dbg.sqlite3BtreeIndexMoveto
mov r14d, eax
jmp 0x583261
Function at 0x599470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, dword [rdx + 8]
mov r12, rcx
mov rbx, rdx
mov edi, r8d
test eax, eax
jne 0x59957f
mov rsi, qword [rdx + 0x60]
test rsi, rsi
je 0x59957f
mov eax, dword [rcx + 0x38]
mov r13, qword [rcx + 0x10]
lea ebp, [rax + 1]
mov dword [rcx + 0x38], ebp
mov dword [rdx + 8], ebp
test r13, r13
jne 0x5994ba
call sym.sqlite3GetVdbe.part.0
mov r13, rax
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x3c]
call sym.sqlite3ExprIsInteger
test eax, eax
jne 0x599590
cmp qword [r12 + 0x10], 0
je 0x5994e7
mov rdx, qword [rsi + 0x10]
mov r8d, ebp
mov rcx, r12
call sym.sqlite3ExprCode.part.0
xor r9d, r9d
mov r8d, ebp
mov edx, 0xd
mov rcx, r13
mov dword [rsp + 0x20], 0
call dbg.sqlite3VdbeAddOp3
mov r9d, edi
mov r8d, ebp
mov edx, 0x11
mov dword [rsp + 0x20], 0
mov rcx, r13
call dbg.sqlite3VdbeAddOp3
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x59957f
mov eax, dword [r12 + 0x38]
cmp qword [r12 + 0x10], 0
lea esi, [rax + 1]
mov dword [rbx + 0xc], esi
lea ebx, [rax + 2]
mov dword [r12 + 0x38], ebx
je 0x59954c
mov r8d, esi
mov rcx, r12
call sym.sqlite3ExprCode.part.0
xor r9d, r9d
mov r8d, esi
mov edx, 0xd
mov rcx, r13
mov dword [rsp + 0x20], 0
call dbg.sqlite3VdbeAddOp3
mov dword [rsp + 0x20], esi
mov r9d, ebx
mov r8d, ebp
mov edx, 0xa0
mov rcx, r13
call dbg.sqlite3VdbeAddOp3
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, dword [rsp + 0x3c]
mov r9d, ebp
mov edx, 0x47
mov rcx, r13
mov dword [rsp + 0x20], 0
call dbg.sqlite3VdbeAddOp3
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x599630
js 0x59951d
movzx r9d, word [rbx + 2]
movsxd rdx, eax
cmp eax, 7
jg 0x599650
cmp eax, 1
je 0x59969e
mov rax, rdx
mov ecx, 0x1e
nop dword [rax]
add rax, rax
mov r8d, ecx
sub ecx, 0xa
cmp rax, 7
jbe 0x5995e0
lea r10, [0x00740470]
and eax, 7
movzx eax, word [r10 + rax*2]
lea r8d, [r8 + rax - 0xa]
cmp r9w, r8w
jle 0x59951d
mov ecx, 0x1e
nop word [rax + rax]
mov eax, ecx
add rdx, rdx
lea ecx, [rax - 0xa]
cmp rdx, 7
jbe 0x599618
and edx, 7
movzx edx, word [r10 + rdx*2]
jmp 0x59968a
mov r9d, edi
xor r8d, r8d
mov edx, 9
mov rcx, r13
mov dword [rsp + 0x20], 0
call dbg.sqlite3VdbeAddOp3
jmp 0x59951d
bsr rax, rdx
mov ecx, 0x3c
xor rax, 0x3f
sub ecx, eax
shr rdx, cl
lea r8d, [rcx + rcx*4]
lea rcx, [0x00740470]
and edx, 7
add r8d, r8d
movzx edx, word [rcx + rdx*2]
lea eax, [r8 + 0x28]
lea r8d, [rdx + r8 + 0x1e]
cmp r9w, r8w
jle 0x59951d
lea eax, [rax + rdx - 0xa]
or dword [rbx + 4], 0x4000
mov word [rbx + 2], ax
jmp 0x59951d
test r9w, r9w
jle 0x59951d
xor eax, eax
jmp 0x59968e
Function at 0x5d5fd0
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov ebp, dword [rsp + 0x90]
mov byte [rcx + 0x1c], 1
mov esi, r8d
mov rbx, rdx
mov rdi, r9
mov qword [rsp + 0x28], r9
mov r9, rdx
mov r12, rcx
mov dword [rsp + 0x20], r8d
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [rsp + 0x30], ebp
call dbg.sqlite3NestedParse
test esi, esi
je 0x5d6020
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, rdi
mov r8, rbx
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, r12
mov dword [rsp + 0x90], ebp
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp dbg.sqlite3NestedParse