joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066810
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, qword [rsp + 0x60]
mov rsi, r9
cmp r8, rbx
mov r14, rdx
mov rdi, rcx
cmovb ebx, r8d
test ebx, ebx
je 0x1400668d7
mov qword [rsp + 0x40], rbp
sub r14, r9
mov ebp, ebx
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r14 + rsi]
mov r8d, 1
mov eax, dword [rdi + 8]
or eax, 2
mov byte [rsp + 0x60], dl
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, dl
lea rdx, [rsp + 0x60]
mov byte [rsi], cl
mov ecx, dword [rdi]
not ecx
call fcn.140062c10
not eax
lea rdx, [rsp + 0x50]
mov dword [rdi], eax
mov r8d, 1
movzx eax, al
add eax, dword [rdi + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rdi + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x50], cl
mov ecx, dword [rdi + 8]
not ecx
call fcn.140062c10
lea rsi, [rsi + 1]
not eax
mov dword [rdi + 8], eax
sub rbp, 1
jne 0x140066850
mov rbp, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14006a4f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x50]
mov rdi, r9
cmp r8, rax
mov rsi, rdx
mov rbx, rcx
cmovb eax, r8d
test eax, eax
je 0x14006a595
mov qword [rsp + 0x30], rbp
sub rsi, r9
mov ebp, eax
mov eax, dword [rbx + 8]
lea rdx, [rsp + 0x50]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x50], cl
mov ecx, dword [rbx]
not ecx
call fcn.140062c10
not eax
lea rdx, [rsp + 0x40]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x40], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.140062c10
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x14006a522
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140074af0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140074b61
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140074b51
mov r9d, 1
mov dword [rsp + 0x20], 8
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140074b61
mov eax, 0xffffffe7
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor ecx, ecx
mov eax, 0xffffffe7
test ebx, ebx
mov rbx, qword [rsp + 0x40]
cmovne eax, ecx
add rsp, 0x30
pop rdi
ret
Function at 0x14007bc30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov ebx, 0xffffffff
mov rdi, rdx
cmp r8, rbx
cmovbe rbx, r8
test ecx, ecx
jns 0x14007bc6a
call fcn.14000c660
mov dword [rax], 9
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14007bd12
call fcn.14000cf00
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14007bd03
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x14007bcc3
call fcn.14000c660
mov dword [rax], reloc.WS2_32.dll_inet_addr
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp eax, 0x6d
je 0x14007bd12
cmp eax, 5
jne 0x14007bcea
call fcn.14000c660
mov dword [rax], 9
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.14007b870
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x14007c350
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rdx
test ecx, ecx
jns 0x14007c375
call fcn.14000c660
mov dword [rax], 9
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x48], rbx
mov ebx, 0xffffffff
cmp r8, rbx
cmovbe ebx, r8d
call fcn.14000cf00
mov rcx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x14007c3e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14007c3d4
call fcn.14000c660
mov dword [rax], 9
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.14007b870
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400ad970
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x30
mov edx, edx
mov r10, rcx
mov dword [rcx], 0x4000400
mov r9d, 0x400
mov qword [rsp + 0x58], rdx
test rdx, rdx
je 0x1400ad9ed
lea rax, [rcx + 8]
mov ecx, edx
nop word [rax + rax]
mov dword [rax - 4], 0x4000400
mov dword [rax], 0x4000400
mov dword [rax + 4], 0x4000400
mov dword [rax + 8], 0x4000400
mov dword [rax + 0xfc], 0x4000400
mov dword [rax + 0x100], 0x4000400
mov dword [rax + 0x104], 0x4000400
mov dword [rax + 0x108], 0x4000400
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x1400ad9a0
movzx eax, r9w
lea rdi, [r10 + 0x204]
mov ecx, 0x100
rep stosw word [rdi], ax
test r8b, r8b
jne 0x1400adb66
xor eax, eax
mov qword [rsp + 0x40], rax
test rdx, rdx
je 0x1400adb66
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rbp
lea rbp, [0x14027b420]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r12
mov qword [rsp + 0x10], r13
mov qword [rsp + 8], r14
mov qword [rsp], r15
mov esi, dword [r10 + 0x4804]
lea rdi, [0x14027b420]
mov r14d, eax
xor r8d, r8d
imul r12, r14, 0x440
mov dword [r10 + r14*4 + 0x4808], esi
movzx ecx, word [r10]
add r12, 0x404
mov eax, ecx
add r12, r10
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
movzx ebp, byte [rax + rbp]
movzx edx, byte [rcx + rdi]
movzx ecx, word [r10 + 2]
mov eax, ecx
mov dword [rsp + 0x50], ebp
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
movzx r15d, byte [rax + rdi]
movzx r13d, byte [rcx + rdi]
add r15d, edx
add r13d, edx
test esi, esi
je 0x1400adb25
mov rbx, r12
nop dword [rax]
cmp r8d, 8
jae 0x1400adb6c
xor r9d, r9d
lea edi, [r8 + 8]
lea r11, [r14*8]
lea rbp, [0x14027b420]
mov ecx, edi
shr edi, 1
and ecx, 1
mov eax, edi
add rax, r11
movzx edx, word [r10 + rax*2 + 4]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + rbp]
add r9d, eax
cmp edi, 1
jne 0x1400adae0
mov eax, dword [rsp + 0x50]
inc r8d
add eax, r9d
mov dword [rbx], eax
add rbx, 4
cmp r8d, esi
jb 0x1400adac0
lea rbp, [0x14027b420]
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
cmp rax, qword [rsp + 0x58]
jb 0x1400ada42
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp r8d, esi
jae 0x1400adb25
lea rbx, [r12 + r8*4]
lea rbp, [0x14027b420]
nop dword [rax]
cmp r8d, 0x10
jae 0x1400adbde
xor r9d, r9d
lea r11, [r14*8]
mov edi, r8d
mov ecx, edi
shr edi, 1
and ecx, 1
mov eax, edi
add rax, r11
movzx edx, word [r10 + rax*2 + 0x104]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + rbp]
add r9d, eax
cmp edi, 1
jne 0x1400adb94
lea eax, [r9 + r15]
inc r8d
mov dword [rbx], eax
add rbx, 4
cmp r8d, esi
jb 0x1400adb80
jmp 0x1400adb2c
lea r11, [r12 + r8*4]
xor r9d, r9d
lea eax, [r8 + 0xf0]
nop dword [rax]
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
shr rcx, 4
movzx edi, word [r10 + rax*2 + 0x204]
and ecx, 0x7f
shr rdi, 4
xor rdi, rcx
movzx ecx, byte [rdi + rbp]
add r9d, ecx
cmp eax, 1
jne 0x1400adbf0
lea eax, [r9 + r13]
inc r8d
mov dword [r11], eax
add r11, 4
cmp r8d, esi
jb 0x1400adbe2
jmp 0x1400adb2c
Function at 0x1400adc40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
mov esi, dword [rcx + 0x4804]
lea r9, [0x14027b420]
mov ebp, edx
mov r11, rcx
mov dword [rcx + rbp*4 + 0x4808], esi
lea r12, [r11 + 0x404]
movzx edx, word [rcx]
movzx ecx, word [rcx + 2]
mov eax, edx
shr rax, 4
xor rdx, 0x7f0
shr rdx, 4
movzx r14d, byte [rax + r9]
mov eax, ecx
movzx r8d, byte [rdx + r9]
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
mov dword [rsp + 0x38], r14d
movzx r15d, byte [rax + r9]
movzx r13d, byte [rcx + r9]
add r15d, r8d
imul rax, rbp, 0x440
add r13d, r8d
xor r9d, r9d
add r12, rax
test esi, esi
je 0x1400ade29
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rdi
mov rdi, r12
cmp r9d, 8
jae 0x1400add4f
xor r10d, r10d
lea r8d, [r9 + 8]
lea rbx, [rbp*8]
lea r14, [0x14027b420]
nop dword [rax]
nop dword [rax + rax]
mov ecx, r8d
shr r8d, 1
and ecx, 1
mov eax, r8d
add rax, rbx
movzx edx, word [r11 + rax*2 + 4]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + r14]
add r10d, eax
cmp r8d, 1
jne 0x1400add00
mov eax, dword [rsp + 0x38]
inc r9d
add eax, r10d
mov dword [rdi], eax
add rdi, 4
cmp r9d, esi
jb 0x1400adcd8
jmp 0x1400ade1f
cmp r9d, esi
jae 0x1400ade1f
lea rdi, [r12 + r9*4]
lea r14, [0x14027b420]
cmp r9d, 0x10
jae 0x1400addcc
xor r10d, r10d
lea rbx, [rbp*8]
mov r8d, r9d
nop word [rax + rax]
mov ecx, r8d
shr r8d, 1
and ecx, 1
mov eax, r8d
add rax, rbx
movzx edx, word [r11 + rax*2 + 0x104]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + r14]
add r10d, eax
cmp r8d, 1
jne 0x1400add80
lea eax, [r10 + r15]
inc r9d
mov dword [rdi], eax
add rdi, 4
cmp r9d, esi
jb 0x1400add63
jmp 0x1400ade1f
lea rbx, [r12 + r9*4]
xor r10d, r10d
lea eax, [r9 + 0xf0]
nop word [rax + rax]
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
shr rcx, 4
movzx r8d, word [r11 + rax*2 + 0x204]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
movzx ecx, byte [r8 + r14]
add r10d, ecx
cmp eax, 1
jne 0x1400adde0
lea eax, [r10 + r13]
inc r9d
mov dword [rbx], eax
add rbx, 4
cmp r9d, esi
jb 0x1400addd0
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x1400b1990
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp byte [0x1402d4be0], 0
lea rdi, [0x1402ee240]
mov r11, rdx
mov r10, rcx
jne 0x1400b1a6c
mov qword [rsp + 0x10], rbx
xor ebx, ebx
mov byte [0x1402d4be0], 1
nop word [rax + rax]
mov edx, ebx
shr edx, 1
mov ecx, edx
xor ecx, 0xedb88320
test bl, 1
cmove ecx, edx
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov r9d, eax
xor r9d, 0xedb88320
test dl, 1
cmove r9d, eax
mov ecx, r9d
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test r9b, 1
cmove eax, ecx
mov dword [rdi + rbx*4], eax
inc rbx
cmp rbx, 0x100
jb 0x1400b19c0
mov rbx, qword [rsp + 0x10]
not r8d
test r11, r11
je 0x1400b1a9d
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [rdi + rcx*4]
sub r11, 1
jne 0x1400b1a80
not r8d
mov eax, r8d
pop rdi
ret

Function at 0x1400b1ab0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp byte [0x1402d4be0], 0
jne 0x1400b1b75
mov byte [0x1402d4be0], 1
lea r9, [0x1402ee240]
xor r8d, r8d
nop
mov ecx, r8d
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test r8b, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [r9 + r8*4], eax
inc r8
cmp r8, 0x100
jb 0x1400b1ad0
ret
Function at 0x1400b3050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
cmp byte [0x1402d53f0], 0
lea rbx, [0x1402d4bf0]
mov r11, rdx
mov r10, rcx
jne 0x1400b3124
mov byte [0x1402d53f0], 1
xor r9d, r9d
movabs rcx, 0xc96c5795d7870f42
nop dword [rax]
nop word [rax + rax]
mov rdx, r9
mov rax, r9
shr rdx, 1
xor rdx, rcx
shr rax, 1
test r9b, 1
cmovne rax, rdx
test al, 1
je 0x1400b30b3
shr rax, 1
xor rax, rcx
jmp 0x1400b30b6
shr rax, 1
test al, 1
je 0x1400b30c2
shr rax, 1
xor rax, rcx
jmp 0x1400b30c5
shr rax, 1
test al, 1
je 0x1400b30d1
shr rax, 1
xor rax, rcx
jmp 0x1400b30d4
shr rax, 1
test al, 1
je 0x1400b30e0
shr rax, 1
xor rax, rcx
jmp 0x1400b30e3
shr rax, 1
test al, 1
je 0x1400b30ef
shr rax, 1
xor rax, rcx
jmp 0x1400b30f2
shr rax, 1
test al, 1
je 0x1400b30fe
shr rax, 1
xor rax, rcx
jmp 0x1400b3101
shr rax, 1
test al, 1
je 0x1400b310d
shr rax, 1
xor rax, rcx
jmp 0x1400b3110
shr rax, 1
mov qword [rbx + r9*8], rax
inc r9
cmp r9, 0x100
jb 0x1400b3090
not r8
test r11, r11
je 0x1400b314d
nop dword [rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx ecx, r8b
xor rcx, rax
shr r8, 8
xor r8, qword [rbx + rcx*8]
sub r11, 1
jne 0x1400b3130
mov rbx, qword [rsp + 8]
not r8
mov rax, r8
ret
Function at 0x1400b3fc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov r14d, 4
lea rbx, [rcx + 0x10290]
mov ebp, r14d
lea rsi, [rcx + 0x10698]
mov r10, rcx
lea r15, [0x14027b420]
xor edi, edi
nop dword [rax + rax]
mov eax, dword [r10 + 0x10e90]
xor r11d, r11d
test eax, eax
je 0x1400b4067
nop
xor r9d, r9d
lea eax, [r11 + 0x40]
nop word [rax + rax]
mov edx, eax
shr eax, 1
and edx, 1
mov ecx, eax
add rcx, rdi
movzx r8d, word [r10 + rcx*2 + 0x6efc]
mov ecx, edx
neg ecx
shr r8, 4
shr rcx, 4
and ecx, 0x7f
xor r8, rcx
movzx ecx, byte [r8 + r15]
add r9d, ecx
cmp eax, 1
jne 0x1400b4020
mov dword [rbx + r11*4], r9d
inc r11d
mov eax, dword [r10 + 0x10e90]
cmp r11d, eax
jb 0x1400b4010
mov edx, recv
cmp eax, edx
jbe 0x1400b4090
mov eax, edx
lea rcx, [rbx + rax*4]
mov eax, edx
shr eax, 1
inc edx
shl eax, 4
sub eax, 0x50
add dword [rcx], eax
cmp edx, dword [r10 + 0x10e90]
jb 0x1400b4070
nop dword [rax]
mov eax, dword [rbx]
add rdi, 0x40
mov dword [rsi - 8], eax
mov eax, dword [rbx + 4]
mov dword [rsi - 4], eax
mov eax, dword [rbx + 8]
mov dword [rsi], eax
mov eax, dword [rbx + 0xc]
add rbx, 0x100
mov dword [rsi + 4], eax
add rsi, 0x200
sub rbp, 1
jne 0x1400b4000
lea rdi, [r10 + 0x10aa0]
nop dword [rax]
cmp r14d, 4
ja 0x1400b40db
mov edx, r14d
jmp 0x1400b40ed
bsr edx, r14d
mov eax, r14d
lea ecx, [rdx - 1]
shr eax, cl
and eax, 1
lea edx, [rax + rdx*2]
mov r9d, edx
mov r11d, edx
shr r9d, 1
mov eax, edx
and eax, 1
dec r9d
or eax, 2
mov ecx, r9d
shl eax, cl
mov ebx, r14d
sub ebx, eax
mov ebp, eax
xor r8d, r8d
lea esi, [r8 + 1]
mov eax, esi
mov edx, ebx
sub rax, r11
shr ebx, 1
add rax, rbp
and edx, 1
movzx ecx, word [r10 + rax*2 + 0x70fa]
lea esi, [rdx + rsi*2]
mov eax, edx
shr rcx, 4
neg eax
shr rax, 4
and eax, 0x7f
xor rcx, rax
movzx eax, byte [rcx + r15]
add r8d, eax
add r9d, 0xffffffff
jne 0x1400b4114
mov ecx, dword [r10 + r11*4 + 0x10290]
inc r14d
add ecx, r8d
mov dword [rdi - 0x400], ecx
mov ecx, dword [r10 + r11*4 + 0x10390]
add ecx, r8d
mov dword [rdi - 0x200], ecx
mov ecx, dword [r10 + r11*4 + 0x10490]
add ecx, r8d
mov dword [rdi], ecx
mov ecx, dword [r10 + r11*4 + 0x10590]
add ecx, r8d
mov dword [rdi + 0x200], ecx
add rdi, 4
cmp r14d, 0x80
jb 0x1400b40d0
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov dword [r10 + 0x10e94], r9d
pop r15
pop r14
ret
Function at 0x1400b42b0
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov r10d, dword [rcx + 0xb94]
mov r11, rcx
mov ecx, 8
sub ecx, r10d
shr r8d, cl
mov ecx, r10d
mov eax, dword [r11 + 0xb98]
xor r10d, r10d
and eax, edx
shl eax, cl
mov ecx, dword [rsp + 0x38]
add r8d, eax
add ecx, 0x100
lea rdi, [r8 + r8*2]
shl rdi, 9
add rdi, r11
lea r11, [0x14027b420]
test r9b, r9b
jne 0x1400b4336
nop dword [rax]
mov r8d, ecx
shr ecx, 1
and r8d, 1
neg r8d
shr r8, 4
movzx r9d, word [rdi + rcx*2 + 0xb9c]
and r8d, 0x7f
shr r9, 4
xor r9, r8
movzx edx, byte [r9 + r11]
add r10d, edx
cmp ecx, 1
jne 0x1400b4300
mov eax, r10d
pop rdi
ret
mov qword [rsp + 0x10], rbx
mov r9d, 0x100
mov ebx, dword [rsp + 0x30]
nop word [rax + rax]
mov edx, ecx
add ebx, ebx
shr edx, 8
mov eax, r9d
and eax, ebx
add eax, r9d
add edx, eax
movzx r8d, word [rdi + rdx*2 + 0xb9c]
mov edx, ecx
shr edx, 7
add ecx, ecx
and edx, 1
shr r8, 4
neg edx
shr rdx, 4
and edx, 0x7f
xor r8, rdx
movzx eax, byte [r8 + r11]
add r10d, eax
mov eax, ebx
xor eax, ecx
not eax
and r9d, eax
cmp ecx, 0x10000
jb 0x1400b4350
mov rbx, qword [rsp + 0x10]
mov eax, r10d
pop rdi
ret
Function at 0x1400e9c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rsi, qword [rcx + 0xa8]
mov rbx, rcx
mov rax, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov qword [rsp + 0x60], rax
test rsi, rsi
je 0x1400e9e6f
mov qword [rsp + 0x68], rbp
xor r9d, r9d
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x38], r14
nop dword [rax]
nop word [rax + rax]
movsxd rbp, dword [rsi + 0x10]
lea r12, [rdi + 0x88]
mov r15d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [rax + 0x20]
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x1400e9cc8
inc dword [rbx + 0x38]
mov r14d, dword [rbx + 0x38]
jmp 0x1400e9cd8
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0xe8]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r15 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x1400e9d05
mov r9d, edx
mov dword [rsp + 0x20], r15d
mov edx, 0x37
mov rcx, rdi
call fcn.140125400
jmp 0x1400e9d30
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [r12]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r15d
mov qword [rax + rcx*8 + 0x10], r9
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], WSACleanup
mov r9, qword [r9 + 0x68]
call fcn.14017abd0
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x1400e9d74
mov edx, 5
mov rcx, rdi
call fcn.140125470
test eax, eax
jne 0x1400e9e56
movsxd rax, dword [rdi + 0x90]
xor r9d, r9d
lea rcx, [rax + rax*2]
mov rax, qword [r12]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], gethostbyname
mov dword [rax + rcx*8 + 4], r9d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r9d
add eax, 2
mov dword [rdx + 8], eax
mov byte [rdx + 1], r9b
mov qword [rdx + 0x10], r9
mov word [rdx + 2], r9w
mov qword [rdx + 0x18], 0x7f
mov qword [rdx + 0x20], r9
mov qword [rdx + 0x28], r9
mov qword [rdx + 0x30], 0x61
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r9
mov qword [rdx + 0x48], pe_nt_image_headers64
mov qword [rdx + 0x50], r9
mov qword [rdx + 0x58], r9
mov qword [rdx + 0x60], 0x7a
mov qword [rdx + 0x68], r9
mov qword [rdx + 0x70], r9
add dword [rdi + 0x90], 5
test rdx, rdx
je 0x1400e9e56
mov dword [rdx + 0x3c], r14d
lea ecx, [r15 + 1]
mov dword [rdx + 4], ecx
lea eax, [r15 - 1]
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x54], ecx
mov ecx, 8
mov word [rdx + 0x4a], cx
mov dword [rdx + 0x34], eax
mov dword [rdx + 0x50], r14d
test r14d, r14d
je 0x1400e9e45
movzx eax, byte [rbx + 0x1f]
cmp al, cl
jae 0x1400e9e45
mov dword [rbx + rax*4 + 0xe8], r14d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
mov rax, qword [rsp + 0x60]
test rsi, rsi
jne 0x1400e9ca0
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400fc690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x68
movzx eax, byte [rdx]
mov r14, rdx
mov rdi, rcx
cmp al, 0xb0
jne 0x1400fc6a9
movzx eax, byte [rdx + 2]
cmp al, 0xb1
jne 0x1400fc6b3
mov rax, qword [rdx + 0x20]
jmp 0x1400fc6c3
cmp al, 0x8a
jne 0x1400fc847
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x1400fc847
mov dword [r8], 0
cmp byte [rdx], 0x8a
jne 0x1400fc6ea
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.1401558d0
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x1400fc832
mov qword [rsp + 0x80], rbx
lea rcx, [0x14018dc60]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r15
lea r13, [fcn.1400fdbd0]
xor r15d, r15d
mov qword [rsp + 0x98], rsi
lea edx, [r15 + 2]
nop dword [rax + rax]
cmp byte [rdi + 0x23], 0
mov rax, qword [r14 + 0x20]
mov rbx, qword [rax + r15 + 8]
je 0x1400fc7a0
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x1400fc790
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1401a8990
cmp word [rsp + 0x44], 0
je 0x1400fc7a0
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.14015fd30
jmp 0x1400fc7e0
mov rsi, qword [rdi]
test rbx, rbx
je 0x1400fc7bc
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.1400fcc00
mov rbx, rax
cmp byte [rsi + 0x67], 0
jne 0x1400fc7d0
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.14015e190
test rbx, rbx
je 0x1400fc7e0
mov rdx, rbx
mov rcx, rsi
call fcn.1401623b0
inc ebp
lea rcx, [0x14018dc60]
add r15, 0x20
mov edx, 2
sub r12, 1
jne 0x1400fc750
mov eax, dword [rsp + 0x88]
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.1401618f0
Function at 0x1401426f0
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.14017a6d0
test ebx, ebx
jne 0x140142759
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.14017a6d0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret