joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140177130
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2e0
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x80
call fcn.140289490
mov r8d, 0x80
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1401763e0
mov edx, 0x104
lea rax, [rsp + 0xc0]
mov r9, rdi
lea rcx, [rsp + 0xc0]
mov r8d, edx
sub r9, rax
nop word [rax + rax]
lea rax, [r8 + 0x7ffffefa]
test rax, rax
je 0x1401771c0
movzx eax, byte [r9 + rcx]
test al, al
je 0x1401771c0
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x1401771a0
lea rax, [rcx - 1]
test r8, r8
cmovne rax, rcx
mov rcx, rdx
mov byte [rax], 0
lea rax, [rsp + 0xc0]
nop dword [rax]
cmp byte [rax], 0
je 0x1401771ee
inc rax
sub rcx, 1
jne 0x1401771e0
xor r8d, r8d
mov rax, rdx
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x14017724f
lea rcx, [rsp + 0xc0]
lea rcx, [rcx + r8]
sub rdx, r8
je 0x140177241
lea rax, [r8 + 0x7ffffefb]
add rax, rdx
lea r9, [rsp + 0x40]
sub r9, rcx
test rax, rax
je 0x140177241
movzx r8d, byte [r9 + rcx]
test r8b, r8b
je 0x140177241
mov byte [rcx], r8b
dec rax
inc rcx
sub rdx, 1
jne 0x140177223
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
xor edx, edx
mov dword [rsp + 0x34], 1
mov r8d, 0x100
lea rcx, [rsp + 0x1d0]
call fcn.140289490
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x1d0]
mov rcx, 0xffffffff80000002
lea r8, str.mid64
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareWow6432NodeComMaster
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov rbx, 0xffffffffffffffff
test eax, eax
jne 0x14017731d
lea rax, [rsp + 0x1d0]
sub rdi, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x1401772d3
inc rax
test ecx, ecx
jne 0x1401772c1
test edx, edx
je 0x14017731d
lea rcx, [rsp + 0x1d0]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1401772e2
mov dword [rsp + 0x28], eax
lea r8, str.mid64_old
lea rax, [rsp + 0x1d0]
mov r9d, 1
lea rdx, str.SoftwareWow6432NodeComMaster
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea rax, [rsp + 0xc0]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140177325
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x28], ebx
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8, str.mid64
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareWow6432NodeComMaster
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2e0
pop rdi
ret
Function at 0x1401788e0
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov r9, rcx
test edx, edx
je 0x1401789c4
mov r10d, edx
movzx edx, byte [r9]
lea r9, [r9 + 1]
xor dl, al
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx edx, al
and r8b, 1
cmove edx, ecx
movzx eax, dl
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
movzx r8d, al
and dl, 1
cmove r8d, ecx
movzx eax, r8b
shr al, 1
movzx ecx, al
movzx eax, cl
xor al, 0x8c
and r8b, 1
movzx eax, al
cmove eax, ecx
sub r10, 1
jne 0x1401788f0
ret
Function at 0x14017a320
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
mov r15, rcx
xor esi, esi
mov dword [rdx], esi
mov qword [rbp - 0x71], rsi
mov dword [rbp - 0x69], esi
mov qword [rbp - 0x61], rsi
mov r9d, 0x201
mov r8, qword [0x1403b9cc0]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x71]
call fcn.14007dcc0
test eax, eax
jne 0x14017a4e2
xor edx, edx
lea r8d, [rsi + 0x64]
lea rcx, [rbp - 0x49]
call fcn.140289490
mov dword [rsp + 0x30], 0x64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, [0x14032d10c]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14017a4e2
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
ja 0x14017a4e2
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x14017a408
test cl, 1
jne 0x14017a4e2
mov eax, ecx
shr rax, 1
cmp word [rbp + rax*2 - 0x4b], si
je 0x14017a40c
jmp 0x14017a4e2
mov word [rbp - 0x49], si
shr ecx, 1
cmp ecx, 0x2d
jne 0x14017a4e2
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x14017a516
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x79]
call fcn.140071a50
mov dword [rsp + 0x34], esi
lea r8, [rsp + 0x34]
lea rdx, [0x14032d114]
lea rcx, [rbp + 0xb]
call fcn.14017a5b0
mov edx, 0x2a
mov rbx, qword [rbp - 0x79]
mov rcx, rbx
call fcn.1401788e0
movzx ecx, al
cmp dword [rsp + 0x34], ecx
jne 0x14017a4c3
lea rcx, [rbp - 0x49]
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14017a484
mov r8d, eax
lea rdx, [rbp - 0x49]
mov rcx, r15
call fcn.140010860
mov r8d, dword [reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [str.ffffffff]
lea rcx, [rbp - 0x49]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
mov esi, 1
test eax, eax
jne 0x14017a4c1
mov dword [r14], esi
jmp 0x14017a4ca
mov rdi, 0xffffffffffffffff
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14017a4e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x14017a4f1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000adf0
int3
Function at 0x140198280
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x100
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, qword [rbp + 0x6f]
mov rsi, rcx
mov r12, qword [rbp + 0x7f]
mov ecx, 0x28
mov eax, 0x20
mov dword [rsp + 0x34], r8d
mov r13d, edx
mov r14d, SafeArrayCopy
cmp dword [rsi + 0x10068], 1
mov ebx, InitCommonControls
mov rdx, r9
cmovne r14d, ecx
xor ecx, ecx
test r8d, r8d
sete cl
cmp dword [rsi + 0x10068], 1
mov dword [rsp + 0x30], ecx
lea rcx, [rbp - 0x41]
cmovne ebx, eax
mov r8d, ebx
call fcn.140289020
mov eax, r13d
mov byte [rbp + rbx - 0x41], r13b
sar eax, 8
mov byte [rbp + rbx - 0x40], al
mov eax, r13d
sar eax, 0x10
mov byte [rbp + rbx - 0x3f], al
mov eax, r13d
sar eax, 0x18
cmp dword [rsi + 0x10068], 2
mov byte [rbp + rbx - 0x3e], al
mov dword [rbp + rbx - 0x3d], 0x546c4173
jne 0x14019834d
lea r8, [rbp - 9]
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.1401dfa00
xor ebx, ebx
jmp 0x140198393
xor ebx, ebx
mov dword [rsp + 0x40], 0x67452301
mov r8d, r14d
mov dword [rsp + 0x54], ebx
lea rdx, [rbp - 0x41]
mov dword [rsp + 0x44], 0xefcdab89
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x98badcfe
mov qword [rsp + 0x4c], 0x10325476
call fcn.140199420
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 9]
call fcn.140198a60
lea r8, [rbp - 0x19]
mov edx, r13d
mov rcx, rsi
call fcn.140198850
mov r8d, dword [rsp + 0x30]
lea rcx, [rbp - 0x19]
mov eax, 2
mov qword [rsp + 0x28], rcx
cmp dword [rsi + 0x10068], eax
lea r9, [rbp - 9]
mov rcx, qword [rsi + 0x50]
mov edx, 1
cmovne eax, ebx
mov dword [rsp + 0x20], eax
call fcn.14019ae90
cmp dword [rsp + 0x34], 0
mov r9, r12
mov eax, dword [rbp + 0x77]
mov rdx, r15
mov rcx, qword [rsi + 0x50]
lea r8d, [rax*8]
je 0x1401983f7
call fcn.14019a1c0
jmp 0x1401983fc
call fcn.140199d50
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140198850
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea ecx, [rdx + 1]
mov rbx, r8
mov eax, 0x4f7a09cd
imul ecx
imul ecx, ecx, 0x9ef4
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul ecx, r8d, 0x9ef4
mov eax, r8d
sar eax, 8
mov byte [rbp + 0x38], al
mov eax, r8d
sar eax, 0x10
mov byte [rbp + 0x39], al
mov eax, r8d
sar eax, 0x18
mov byte [rbp + 0x3a], al
mov eax, 0x4f7a09cd
imul r8d
mov byte [rbp + 0x37], r8b
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul ecx, r8d, 0x9ef4
mov eax, r8d
sar eax, 8
mov byte [rbp + 0x3c], al
mov eax, r8d
sar eax, 0x10
mov byte [rbp + 0x3d], al
mov eax, r8d
sar eax, 0x18
mov byte [rbp + 0x3e], al
mov eax, 0x4f7a09cd
imul r8d
mov byte [rbp + 0x3b], r8b
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
mov eax, 0x4f7a09cd
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul r8d
mov ecx, r8d
mov byte [rbp + 0x3f], r8b
sar ecx, 8
mov byte [rbp + 0x40], cl
mov ecx, r8d
sar ecx, 0x10
sar edx, 0xe
mov byte [rbp + 0x41], cl
mov eax, edx
shr eax, 0x1f
mov ecx, r8d
add edx, eax
sar ecx, 0x18
imul eax, edx, 0x7fffff07
mov byte [rbp + 0x42], cl
imul ecx, r8d, 0x9ef4
sub ecx, eax
lea edx, [rcx + 0x7fffff07]
cmovns edx, ecx
mov eax, edx
mov byte [rbp + 0x43], dl
sar eax, 8
mov byte [rbp + 0x44], al
mov eax, edx
sar eax, 0x10
lea rcx, [rbp - 0x29]
sar edx, 0x18
mov byte [rbp + 0x45], al
xor eax, eax
mov byte [rbp + 0x46], dl
lea rdx, [rbp + 0x37]
mov dword [rbp - 0x29], 0x67452301
mov dword [rbp - 0x25], 0xefcdab89
lea r8d, [rax + 0x10]
mov dword [rbp - 0x21], 0x98badcfe
mov qword [rbp - 0x1d], 0x10325476
mov dword [rbp - 0x15], eax
call fcn.140199420
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.140198a60
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140172190
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x14019b140
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15d, dword [rcx + 0x1c]
xor esi, esi
sub r15d, 6
xor ebx, ebx
movsxd rdi, r15d
mov r14, rcx
test r15d, r15d
jle 0x14019b1f0
mov r8, rdi
lea rcx, [rbp - 0x30]
shl r8, 2
call fcn.140289020
xor r8d, r8d
xor edx, edx
cmp esi, dword [r14 + 0x1c]
ja 0x14019b359
cmp r8, rdi
jge 0x14019b1c7
cmp rdx, 4
jge 0x14019b1c7
mov eax, esi
inc ebx
lea rcx, [rdx + rax*4]
mov eax, dword [rbp + r8*4 - 0x30]
inc r8
mov dword [r14 + rcx*4 + 0x20], eax
inc rdx
cmp r8, rdi
jl 0x14019b1a4
cmp rdx, 4
lea eax, [rsi + 1]
cmovne eax, esi
mov esi, eax
xor eax, eax
cmp rdx, 4
cmovne eax, ebx
mov ebx, eax
xor eax, eax
cmp rdx, 4
cmovne rax, rdx
mov rdx, rax
cmp r8, rdi
jl 0x14019b195
cmp esi, dword [r14 + 0x1c]
ja 0x14019b359
movsxd rax, ebx
lea r9, [0x1403bfc80]
lea r10, str.cw
nop dword [rax + rax]
movzx ecx, byte [rbp + rdi*4 - 0x33]
lea r9, [r9 + 4]
movzx edx, byte [rbp - 0x30]
xor dl, byte [rcx + r10]
mov byte [rbp - 0x30], dl
movzx ecx, byte [rbp + rdi*4 - 0x32]
xor dl, byte [r9 - 4]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x2f], cl
movzx ecx, byte [rbp + rdi*4 - 0x31]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x2e], cl
movzx ecx, byte [rbp + rdi*4 - 0x34]
mov byte [rbp - 0x30], dl
mov edx, 1
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x2d], cl
cmp r15d, 8
je 0x14019b290
cmp rdx, rdi
jge 0x14019b2f0
nop word [rax + rax]
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, rdi
jl 0x14019b270
jmp 0x14019b2f0
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, 4
jl 0x14019b290
movzx ecx, byte [rbp - 0x24]
mov edx, 5
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x20], cl
movzx ecx, byte [rbp - 0x23]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1f], cl
movzx ecx, byte [rbp - 0x22]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1e], cl
movzx ecx, byte [rbp - 0x21]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1d], cl
cmp rdx, rdi
jge 0x14019b2f0
nop dword [rax + rax]
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, rdi
jl 0x14019b2e0
xor r8d, r8d
test r15d, r15d
jle 0x14019b34f
cmp esi, dword [r14 + 0x1c]
ja 0x14019b359
cmp r8, rdi
jge 0x14019b326
cmp rax, 4
jge 0x14019b326
mov ecx, esi
inc ebx
lea rdx, [rax + rcx*4]
mov ecx, dword [rbp + r8*4 - 0x30]
inc r8
mov dword [r14 + rdx*4 + 0x20], ecx
inc rax
cmp r8, rdi
jl 0x14019b303
cmp rax, 4
lea ecx, [rsi + 1]
cmovne ecx, esi
mov esi, ecx
xor ecx, ecx
cmp rax, 4
cmovne ecx, ebx
mov ebx, ecx
xor ecx, ecx
cmp rax, 4
cmovne rcx, rax
mov rax, rcx
cmp r8, rdi
jl 0x14019b2f8
cmp esi, dword [r14 + 0x1c]
jbe 0x14019b210
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14019e930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0x98]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x14019eb30
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd rbp, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r14d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [r12 + 0x20]
test al, al
jne 0x14019e992
inc dword [rbx + 0x38]
mov r15d, dword [rbx + 0x38]
jmp 0x14019e9a2
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r15d, dword [rbx + rax*4 + 0xcc]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r14 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x14019e9cf
mov r9d, edx
mov dword [rsp + 0x20], r14d
mov edx, 0x37
mov rcx, rdi
call fcn.1401c6d10
jmp 0x14019e9fd
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r14d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], WSAStartup
mov r9, qword [r9 + 0x68]
call fcn.140204a40
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x14019ea41
mov edx, 5
mov rcx, rdi
call fcn.1401c6d80
test eax, eax
jne 0x14019eb1c
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r13d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r13d
lea ecx, [r14 + 1]
mov byte [rdx + 1], r13b
add eax, 2
mov dword [rdx + 8], eax
lea eax, [r14 - 1]
mov qword [rdx + 0x10], r13
mov word [rdx + 2], r13w
mov qword [rdx + 0x18], 0x79
mov qword [rdx + 0x20], r13
mov qword [rdx + 0x28], r13
mov qword [rdx + 0x30], 0x5c
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r13
mov qword [rdx + 0x48], 0x7a
mov qword [rdx + 0x50], r13
mov qword [rdx + 0x58], r13
mov qword [rdx + 0x60], 0x75
mov qword [rdx + 0x68], r13
mov qword [rdx + 0x70], r13
add dword [rdi + 0x90], 5
mov dword [rdx + 0x34], eax
mov eax, 8
mov word [rdx + 0x4a], ax
mov dword [rdx + 4], ecx
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x3c], r15d
mov dword [rdx + 0x50], r15d
mov dword [rdx + 0x54], ecx
test r15d, r15d
je 0x14019eb10
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x14019eb10
movzx eax, al
mov dword [rbx + rax*4 + 0xcc], r15d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14019e970
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401ad950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x30
movzx eax, byte [rdx]
mov rbp, rcx
cmp al, 0xa8
jne 0x1401ad964
movzx eax, byte [rdx + 0x36]
mov qword [rsp + 0x48], rsi
cmp al, 0xa9
jne 0x1401ad976
lea rsi, [rdx + 0x20]
mov rax, rsi
jmp 0x1401ad986
cmp al, 0x83
jne 0x1401ada26
mov rax, qword [rdx + 0x20]
lea rsi, [rdx + 0x20]
mov rax, qword [rax]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x1401ada26
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov dword [r8], ebx
cmp byte [rdx], 0x83
jne 0x1401ad9bb
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
jmp fcn.1401e9130
mov eax, dword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov r14, rcx
mov qword [rsp + 0x20], r15
lea r15d, [rax + 1]
add eax, ecx
mov dword [rbp + 0x38], eax
test ecx, ecx
jle 0x1401ada21
mov qword [rsp + 0x50], rdi
mov edi, r15d
mov rdx, qword [rsi]
mov r8d, edi
mov rcx, rbp
mov rdx, qword [rdx + rbx + 8]
call fcn.1401ef920
inc edi
lea rbx, [rbx + 0x28]
sub r14, 1
jne 0x1401ad9e0
mov rdi, qword [rsp + 0x50]
mov eax, r15d
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret
mov eax, r15d
jmp 0x1401ada07
mov rcx, rbp
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
jmp fcn.1401f1e60
Function at 0x1401d77e0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
lea r9, str.sqlite_master
mov rdi, rdx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.1402046d0
test ebx, ebx
jne 0x1401d7834
mov r9, rdi
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.1402046d0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401da150
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r15, edx
mov rdi, qword [rcx + r15*8 + 0x28]
lea r14, [rcx + r15*8]
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rsi, r8
mov rbx, rcx
test rdi, rdi
jne 0x1401da1b3
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov rdx, qword [rsp + r15*8 + 0x40]
call fcn.1401da630
mov rdi, rax
mov qword [r14 + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x1401da269
mov r8, rsi
mov edx, 1
mov rcx, rdi
call fcn.14018ad00
mov rcx, rdi
call fcn.14018b7c0
cmp eax, 0x65
jne 0x1401da20b
test r15d, r15d
lea rcx, str.__rowid
lea rax, str.__parent
mov r9, rbp
cmovne rax, rcx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call fcn.1401da0d0
jmp 0x1401da258
cmp eax, 0x64
jne 0x1401da258
xor edx, edx
mov rcx, rdi
call fcn.14018bf50
mov r9, rax
cmp rax, rbp
je 0x1401da258
test r15d, r15d
mov qword [rsp + 0x30], rbp
lea rcx, str.__rowid
mov qword [rsp + 0x28], rsi
lea rax, str.__parent
mov r8, rsi
cmovne rax, rcx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401da0d0
mov rcx, rdi
call fcn.14018c5e0
cmp dword [rbx + 0x40], 0
jne 0x1401da269
mov dword [rbx + 0x40], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x1401dfa00
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov eax, dword [0x1403b9e80]
mov ebx, 0x40
mov dword [r11 - 0x60], eax
mov esi, edx
mov eax, dword [0x1403b9e84]
mov rbp, r8
mov dword [r11 - 0x5c], eax
mov r14, rcx
mov eax, dword [0x1403b9e88]
mov dword [r11 - 0x58], eax
mov eax, dword [0x1403b9e8c]
mov dword [r11 - 0x54], eax
mov eax, dword [0x1403b9e90]
mov dword [r11 - 0x50], eax
mov eax, dword [0x1403b9e94]
mov dword [r11 - 0x4c], eax
mov eax, dword [0x1403b9e98]
mov dword [r11 - 0x48], eax
mov eax, dword [0x1403b9e9c]
mov dword [r11 - 0x44], eax
xor eax, eax
cmp edx, ebx
mov qword [rsp + 0x20], rax
cmovb ebx, edx
mov rdx, rcx
mov r8d, ebx
lea rcx, [rsp + 0x28]
call fcn.140289020
mov ecx, dword [rsp + 0x24]
add ecx, esi
cmp ecx, 0x40
jae 0x1401dfaad
mov dword [rsp + 0x24], ecx
jmp 0x1401dfb18
sub esi, ebx
mov qword [rsp + 0x128], rdi
mov edi, esi
lea rdx, [rsp + 0x28]
mov r8d, 1
shr edi, 6
lea rcx, [rsp + 0x20]
add rbx, r14
call fcn.1401dfd90
mov r8d, edi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1401dfd90
mov edx, edi
lea rcx, [rsp + 0x28]
shl edx, 6
and esi, 0x3f
add rdx, rbx
mov r8d, esi
call fcn.140289020
mov ecx, dword [rsp + 0x20]
shl edi, 6
add ecx, 0x40
add ecx, edi
mov dword [rsp + 0x24], esi
mov rdi, qword [rsp + 0x128]
mov dword [rsp + 0x20], ecx
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.1401dfb50
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140172190
add rsp, 0xe0
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret