joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006600
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov byte [rcx + 0xa9], 0
mov rbx, rcx
xor edx, edx
mov rcx, qword [rcx + 0xb0]
mov r8b, 1
call fcn.140006a20
cmp byte [rbx + 0x10], 0
je 0x14000667a
nop dword [rax]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140006644
cmp eax, 1
jg 0x140006630
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
test edi, edi
cmovns edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000667a
cmp eax, 0x80
je 0x14000667a
cmp eax, 0x102
je 0x14000667a
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140006691
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0
cmp byte [rbx + 0x10], 0
je 0x1400066a1
mov ecx, 0xdeadbeef
call fcn.1400aaf20
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140009440
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x2d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1400f7080]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rbx, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140009680
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400094a6
xor bl, bl
jmp 0x14000958c
xor esi, esi
nop dword [rax + rax]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rax, [rsp + 0x9c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400094d2
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x28]
call fcn.140002160
nop
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x14000951c
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x28], si
add qword [rbx + 8], 0x20
jmp 0x14000952e
lea r8, [rsp + 0x28]
mov rcx, rbx
call fcn.140009730
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000956b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009566
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400095e8
call fcn.1400a508c
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400094b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400095ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400095c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400095ee
call fcn.1400a508c
movzx eax, bl
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1400a4a60
add rsp, 0x2d0
pop rdi
pop rsi
pop rbx
ret
call fcn.1400a8f10
nop
call fcn.1400a8f10
int3
Function at 0x140018be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r12
push r14
push r15
sub rsp, 8
xor r10d, r10d
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
movzx ebx, r9b
movsxd rdi, r8d
mov r14, rcx
mov qword [rsp], r13
mov r11, rdi
mov esi, r10d
mov r13d, r10d
mov r12d, r10d
cmp r9b, 1
jne 0x140018c23
lea r8d, [r10 + 1]
jmp 0x140018c68
mov edx, 3
movzx eax, bl
mov r9d, edx
mov r8d, 2
sub r9d, eax
sub rdx, rax
cmp rdx, rdi
jge 0x140018c51
nop
cmp byte [rdx + rcx], sil
jne 0x140018c51
add r9d, r8d
add rdx, r8
cmp rdx, rdi
jl 0x140018c40
cmp r9d, edi
movzx eax, bl
movsxd r11, r9d
setl r12b
and eax, 1
add rcx, rax
xor r11, 1
lea r9, [r14 + r11]
cmp rcx, r9
jae 0x140018c94
lea rdx, [0x1400e1030]
nop dword [rax + rax]
movzx eax, byte [rcx]
test byte [rax + rdx], 1
je 0x140018c94
mov eax, r8d
add rcx, rax
cmp rcx, r9
jb 0x140018c80
mov r14d, 1
cmp rcx, r9
jae 0x140018cb8
movzx eax, byte [rcx]
cmp al, 0x2d
jne 0x140018cae
mov r13d, r14d
mov r14d, r10d
jmp 0x140018cb2
cmp al, 0x2b
jne 0x140018cb8
mov eax, r8d
add rcx, rax
mov r15, rcx
cmp rcx, r9
jae 0x140018cd0
cmp byte [rcx], 0x30
jne 0x140018cd0
mov eax, r8d
add rcx, rax
cmp rcx, r9
jb 0x140018cc0
mov r11d, r10d
cmp rcx, r9
jae 0x140018d2a
mov qword [rsp + 0x30], rbp
mov rdi, rcx
mov ebp, r8d
movzx ebx, byte [rdi]
lea eax, [rbx - 0x30]
cmp al, 9
ja 0x140018d0e
movsx rax, bl
lea rsi, [rsi + rsi*4]
add r11d, r8d
lea rsi, [rsi - 0x18]
add rdi, rbp
lea rsi, [rax + rsi*2]
movsxd rax, r11d
add rax, rcx
cmp rax, r9
jb 0x140018ce3
mov rbp, qword [rsp + 0x30]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
jbe 0x140018d2a
mov esi, r13d
add rsi, rax
jmp 0x140018d32
test r13d, r13d
je 0x140018d32
neg rsi
mov rax, qword [rsp + 0x38]
mov qword [rax], rsi
mov r13, qword [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
movsxd rax, r11d
add rax, rcx
cmp rax, r9
jb 0x140018df6
test r11d, r11d
jne 0x140018d65
cmp r15, rcx
je 0x140018df6
imul eax, r8d, 0x13
cmp r11d, eax
jg 0x140018df6
test r12d, r12d
jne 0x140018df6
cmp r11d, eax
jl 0x140018de8
mov r9d, r10d
lea r11, str.922337203685477580
mov ebx, r10d
nop dword [rax]
cmp r9d, 0x12
jge 0x140018dba
movsxd rax, ebx
inc r9d
add ebx, r8d
movsx edx, byte [rax + rcx]
movsx eax, byte [r11]
inc r11
sub edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
mov r10d, eax
test eax, eax
je 0x140018d90
jmp 0x140018dce
test r10d, r10d
jne 0x140018dd1
lea eax, [r8 + r8*8]
add eax, eax
movsx r10d, byte [rax + rcx]
sub r10d, 0x38
test r10d, r10d
js 0x140018de8
test r10d, r10d
jg 0x140018df6
lea eax, [r14 + r14]
add rsp, 8
pop r15
pop r14
pop r12
pop rbx
ret
xor eax, eax
add rsp, 8
pop r15
pop r14
pop r12
pop rbx
ret
mov eax, 1
add rsp, 8
pop r15
pop r14
pop r12
pop rbx
ret
Function at 0x140046ed0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.140014fd0
mov rbx, rax
test rax, rax
jne 0x140046f0e
lea eax, [rbx + 7]
jmp 0x140046f95
cmp dword [0x1400f8df4], 0
je 0x140046f62
mov rax, qword [0x1400f8f90]
test rax, rax
je 0x140046f2e
mov ecx, 0xc8
call rax
test eax, eax
jne 0x140046f62
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x140017b60]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call fcn.1400aae4c
mov qword [rbx], rax
test rax, rax
jne 0x140046f77
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x140046f90
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140052080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov dword [r11 + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
sub rsp, 0x78
mov rax, qword [rcx]
test byte [rax + 0x50], 2
jne 0x1400522bf
movzx r10d, byte [rcx + 0x25]
cmp r10b, 0xa
jb 0x140052274
mov qword [r11 - 8], rbx
lea r10, [rcx + 0xe8]
mov qword [r11 - 0x10], rbp
mov r8d, 0x7fffffff
mov qword [r11 - 0x18], rsi
xor edx, edx
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r15
mov dword [rsp + 8], r8d
mov dword [rsp + 4], 0xffffffff
mov dword [rsp], edx
mov qword [rsp + 0x10], r10
nop word [rax + rax]
mov ecx, dword [r10 - 0x14]
mov edx, ecx
mov r13d, dword [r10 + 0x28]
cmp ecx, r8d
mov r15d, dword [r10 + 0x3c]
mov eax, r13d
cmovge edx, r8d
mov esi, dword [r10 + 0x50]
mov ebx, dword [r10 + 0x64]
mov r12d, r15d
mov r9d, dword [r10 + 0x78]
mov r14d, esi
mov r8d, dword [r10]
mov edi, ebx
cmp r8d, edx
mov dword [rsp + 0x18], edx
mov dword [rsp + 0x20], r13d
mov r11d, r9d
cmovge r8d, edx
mov edx, dword [r10 + 0x14]
cmp edx, r8d
mov dword [rsp + 0x1c], r8d
cmovge edx, r8d
mov r8d, dword [r10 + 0x8c]
cmp r13d, edx
mov r10d, dword [r10 + 0xa0]
mov r13, qword [rsp + 0x10]
mov ebp, r8d
cmovge eax, edx
mov dword [rsp + 0x24], edx
cmp r15d, eax
mov dword [rsp + 0x28], eax
cmovge r12d, eax
mov eax, dword [rsp]
cmp esi, r12d
mov edx, eax
cmovge r14d, r12d
cmp ebx, r14d
cmovge edi, r14d
cmp r9d, edi
cmovge r11d, edi
cmp r8d, r11d
cmovge ebp, r11d
cmp ecx, dword [rsp + 8]
mov ecx, dword [rsp + 0x18]
cmovge edx, dword [rsp + 4]
inc eax
cmp dword [r13], ecx
mov ecx, dword [rsp + 0x1c]
cmovge eax, edx
mov edx, dword [rsp]
add edx, 2
cmp dword [r13 + 0x14], ecx
mov ecx, dword [rsp]
mov r13d, dword [rsp + 0x20]
cmovge edx, eax
cmp r13d, dword [rsp + 0x24]
lea eax, [rcx + 3]
cmovge eax, edx
cmp r15d, dword [rsp + 0x28]
lea edx, [rcx + 4]
cmovge edx, eax
cmp esi, r12d
lea eax, [rcx + 5]
cmovge eax, edx
cmp ebx, r14d
lea edx, [rcx + 6]
cmovge edx, eax
cmp r9d, edi
lea eax, [rcx + 7]
cmovge eax, edx
cmp r8d, r11d
lea edx, [rcx + 8]
cmovge edx, eax
cmp r10d, ebp
lea eax, [rcx + 9]
cmovge eax, edx
add qword [rsp + 0x10], 0xc8
add ecx, 0xa
mov dword [rsp + 4], eax
mov dword [rsp], ecx
cmp r10d, ebp
mov r8d, r10d
mov r10, qword [rsp + 0x10]
cmovge r8d, ebp
mov dword [rsp + 8], r8d
cmp ecx, 0xa
jl 0x140052100
mov rcx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
cdqe
jmp 0x14005227f
lea eax, [r10 + 1]
mov byte [rcx + 0x25], al
movzx eax, r10b
lea rdx, [rax*4 + 0x31]
add rdx, rax
mov eax, dword [rcx + 0x4c]
lea rdx, [rcx + rdx*4]
mov dword [rdx + 8], eax
mov eax, dword [rsp + 0x88]
mov dword [rdx], eax
mov eax, dword [rsp + 0x90]
mov word [rdx + 4], ax
mov eax, dword [rsp + 0x98]
mov dword [rdx + 0xc], eax
mov byte [rdx + 6], 0
mov eax, dword [rcx + 0x50]
mov dword [rdx + 0x10], eax
inc dword [rcx + 0x50]
add rsp, 0x78
ret
Function at 0x140052740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
sub rsp, 0x30
movzx r9d, byte [rdx]
mov r14, rcx
movzx eax, r9b
cmp r9b, 0x9d
jne 0x14005275b
movzx eax, byte [rdx + 0x36]
mov qword [rsp + 0x50], rsi
cmp al, 0x9e
jne 0x14005276d
lea rsi, [rdx + 0x20]
mov rax, rsi
jmp 0x14005277d
cmp al, 0x77
jne 0x14005282b
mov rax, qword [rdx + 0x20]
lea rsi, [rdx + 0x20]
mov rax, qword [rax]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x14005282b
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov dword [r8], ebx
cmp r9b, 0x77
jne 0x1400527ba
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
jmp fcn.140050290
mov eax, dword [r14 + 0x38]
mov qword [rsp + 0x48], rbp
mov rbp, rcx
mov qword [rsp + 0x20], r15
lea r15d, [rax + 1]
add eax, ecx
mov dword [r14 + 0x38], eax
test ecx, ecx
jle 0x140052826
mov qword [rsp + 0x28], rdi
mov edi, r15d
mov rcx, qword [rsi]
mov r8d, edi
mov rdx, qword [rcx + 8]
mov rcx, r14
mov rdx, qword [rdx + rbx]
call fcn.140053d00
inc edi
lea rbx, [rbx + 0x28]
sub rbp, 1
jne 0x1400527e1
mov rdi, qword [rsp + 0x28]
mov eax, r15d
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
mov eax, r15d
jmp 0x14005280b
mov rcx, r14
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
jmp fcn.140053ab0
Function at 0x140054ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140054c7c
test rdx, rdx
je 0x140054c7c
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov esi, dword [rdx + 4]
mov ebp, esi
or ebp, dword [rcx + 4]
bt ebp, 0xa
jae 0x140054b39
and esi, dword [rcx + 4]
bt esi, 0xa
jae 0x140054c44
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x140054c44
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x140054b81
cmp r8b, 0x35
jne 0x140054b59
mov rcx, qword [rcx + 0x10]
mov r8d, r14d
call fcn.140054ac0
cmp eax, 2
jl 0x140054b7a
cmp byte [rbx], 0x35
jne 0x140054c44
mov rdx, qword [rbx + 0x10]
mov r8d, r14d
mov rcx, rdi
call fcn.140054ac0
cmp eax, 2
jge 0x140054c44
mov eax, 1
jmp 0x140054b1e
lea eax, [r8 + 0x68]
test al, 0xfd
je 0x140054bb3
mov rax, qword [rcx + 8]
test rax, rax
je 0x140054bb3
mov r9, qword [rdx + 8]
cmp r8b, 0x97
jne 0x140054c4e
mov rdx, r9
mov rcx, rax
call fcn.140018680
test eax, eax
jne 0x140054c44
xor esi, dword [rdi + 4]
test sil, 0x10
jne 0x140054c44
bt ebp, 0xe
jb 0x140054b1c
bt ebp, 0xb
jb 0x140054c44
mov rdx, qword [rbx + 0x10]
mov r8d, r14d
mov rcx, qword [rdi + 0x10]
call fcn.140054ac0
test eax, eax
jne 0x140054c44
mov rdx, qword [rbx + 0x18]
mov r8d, r14d
mov rcx, qword [rdi + 0x18]
call fcn.140054ac0
test eax, eax
jne 0x140054c44
mov rdx, qword [rbx + 0x20]
mov r8d, r14d
mov rcx, qword [rdi + 0x20]
call fcn.140054ca0
test eax, eax
jne 0x140054c44
bt ebp, 0xd
jb 0x140054b1c
cmp byte [rdi], 0x61
je 0x140054b1c
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x140054c44
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x140054b1c
cmp ecx, r14d
jne 0x140054c44
test eax, eax
js 0x140054b1c
mov eax, 2
jmp 0x140054b1e
sub r9, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140054c64
inc rax
test ecx, ecx
jne 0x140054c51
test edx, edx
je 0x140054bb3
xor eax, eax
cmp r8b, 0x35
setne al
inc eax
jmp 0x140054b1e
xor eax, eax
mov ecx, 2
cmp rbx, rdi
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmove ecx, eax
mov eax, ecx
add rsp, 0x20
pop r14
ret
Function at 0x14005a1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, dword [rcx + 0x28]
lea r15, [0x1400e2570]
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
nop dword [rax]
xor ebx, ebx
test r14d, r14d
jle 0x14005a27f
nop dword [rax + rax]
mov r9d, ebx
xor r9d, 1
cmp ebx, 2
cmovge r9d, ebx
test rsi, rsi
je 0x14005a245
mov rax, qword [rbp + 0x20]
mov r8, rsi
movzx edx, byte [rsi]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax]
movzx eax, byte [rdx + r15]
movzx ecx, byte [r10]
movzx ecx, byte [rcx + r15]
sub eax, ecx
jne 0x14005a274
sub r10, rsi
nop dword [rax]
test dl, dl
je 0x14005a241
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx ecx, byte [rax + r15]
movzx edx, byte [r8]
movzx eax, byte [rdx + r15]
sub eax, ecx
je 0x14005a220
jmp 0x14005a274
test eax, eax
jne 0x14005a274
mov rax, qword [rbp + 0x20]
lea r8, [rsp + 0x40]
movsxd rcx, r9d
mov rdx, rdi
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.140019b10
test rax, rax
je 0x14005a274
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14005a2b3
inc ebx
cmp ebx, r14d
jl 0x14005a1e0
movzx edx, byte [rdi]
cmp byte [rdx + r15], 0x73
jne 0x14005a2b1
lea r8, str.sqlite_master
sub r8, rdi
test dl, dl
je 0x14005a2cc
movzx eax, byte [r8 + rdi + 1]
inc rdi
movzx ecx, byte [rax + r15]
movzx edx, byte [rdi]
movzx eax, byte [rdx + r15]
cmp eax, ecx
je 0x14005a293
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov rax, qword [rbp + 0x20]
mov r9, qword [rax + 0x20]
test rsi, rsi
jne 0x14005a2e0
neg r9
sbb eax, eax
jmp 0x14005a31f
test r9, r9
je 0x14005a2b1
movzx eax, byte [r9]
mov r8, rsi
movzx edx, byte [rsi]
movzx ecx, byte [rax + r15]
movzx eax, byte [rdx + r15]
sub eax, ecx
jne 0x14005a31f
sub r9, rsi
test dl, dl
je 0x14005a31f
movzx eax, byte [r9 + r8 + 1]
inc r8
movzx ecx, byte [rax + r15]
movzx edx, byte [r8]
movzx eax, byte [rdx + r15]
sub eax, ecx
je 0x14005a300
test eax, eax
jne 0x14005a2b1
lea rdi, str.sqlite_temp_master
jmp 0x14005a1d0
Function at 0x14005a6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov esi, dword [rcx + 0x28]
xor r9d, r9d
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
test esi, esi
jle 0x14005a7cd
mov qword [rsp + 0x48], r14
mov r14, qword [rcx + 0x20]
mov qword [rsp + 0x50], r15
lea r15, [0x1400e2570]
nop word [rax + rax]
mov eax, ebx
xor eax, 1
cmp ebx, 2
cmovge eax, ebx
cdqe
shl rax, 5
mov r11, qword [rax + r14 + 0x18]
test rdi, rdi
je 0x14005a785
mov r10, qword [rax + r14]
mov r8, rdi
movzx edx, byte [rdi]
movzx eax, byte [r10]
movzx ecx, byte [rax + r15]
movzx eax, byte [rdx + r15]
sub eax, ecx
jne 0x14005a7a9
sub r10, rdi
nop word [rax + rax]
test dl, dl
je 0x14005a781
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx ecx, byte [rax + r15]
movzx edx, byte [r8]
movzx eax, byte [rdx + r15]
sub eax, ecx
je 0x14005a760
jmp 0x14005a7a9
test eax, eax
jne 0x14005a7a9
lea rcx, [r11 + 0x20]
mov rdx, rbp
lea r8, [rsp + 0x40]
call fcn.140019b10
test rax, rax
je 0x14005a7a6
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x14005a7b3
jmp 0x14005a7a9
xor r9d, r9d
inc ebx
cmp ebx, esi
jl 0x14005a720
mov r14, qword [rsp + 0x48]
mov rax, r9
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x58]
mov rax, r9
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006bae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x38
mov rdi, qword [rcx + 0x98]
mov r14, rcx
mov r15, qword [rcx]
mov rbx, qword [rcx + 0x10]
test rdi, rdi
je 0x14006bd51
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r12
xor r12d, r12d
mov qword [rsp + 0x30], r13
lea r13d, [r12 + 0x10]
nop dword [rax]
nop word [rax + rax]
movsxd r8, dword [rdi + 0x10]
xor edx, edx
mov rax, qword [r15 + 0x20]
mov r9, r8
mov esi, dword [rdi + 0x14]
mov rcx, r14
shl r9, 5
mov dword [rsp + 0x20], 0x69
mov r9, qword [r9 + rax + 0x18]
mov r9, qword [r9 + 0x68]
call fcn.14006b640
mov r8, qword [rdi + 8]
lea ebp, [rsi - 1]
mov edx, ebp
mov rcx, rbx
mov r8, qword [r8]
call fcn.140037270
mov rcx, qword [rbx + 0x18]
mov eax, dword [rbx + 0xb8]
add eax, 0xa
cmp eax, dword [rcx + 0x3c]
jle 0x14006bb93
mov rcx, rbx
call fcn.140036ed0
test eax, eax
jne 0x14006bd3d
movsxd rax, dword [rbx + 0xb8]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x68]
mov qword [rax + rcx*8], 0x50
mov qword [rax + rcx*8 + 8], r12
mov qword [rax + rcx*8 + 0x10], r12
lea rdx, [rax + rcx*8]
mov byte [rdx + 0x18], 0x3a
mov dword [rdx + 0x1c], r12d
mov dword [rdx + 0x20], 9
mov eax, dword [rbx + 0xb8]
add eax, 9
mov dword [rdx + 0x20], eax
mov dword [rdx + 0x24], r12d
mov byte [rdx + 0x19], r12b
mov qword [rdx + 0x28], r12
mov word [rdx + 0x1a], r12w
mov qword [rdx + 0x30], 0x62
mov qword [rdx + 0x38], r12
mov qword [rdx + 0x40], r12
mov byte [rdx + 0x48], 0x24
mov dword [rdx + 0x4c], r12d
mov dword [rdx + 0x50], 7
mov eax, dword [rbx + 0xb8]
add eax, 7
mov dword [rdx + 0x50], eax
mov dword [rdx + 0x54], r12d
mov byte [rdx + 0x49], r12b
mov qword [rdx + 0x58], r12
mov word [rdx + 0x4a], r12w
mov qword [rdx + 0x60], 0x7b
mov qword [rdx + 0x68], r12
mov qword [rdx + 0x70], r12
mov qword [rdx + 0x78], 0x62
mov qword [rdx + 0x80], 1
mov qword [rdx + 0x88], r12
mov byte [rdx + 0x90], 0xd
mov dword [rdx + 0x94], r12d
mov dword [rdx + 0x98], 9
mov eax, dword [rbx + 0xb8]
add eax, 9
mov dword [rdx + 0x98], eax
mov dword [rdx + 0x9c], r12d
mov byte [rdx + 0x91], r12b
mov qword [rdx + 0xa0], r12
mov word [rdx + 0x92], r12w
mov byte [rdx + 0xa8], 7
mov dword [rdx + 0xac], r12d
mov dword [rdx + 0xb0], 2
mov eax, dword [rbx + 0xb8]
add eax, 2
mov dword [rdx + 0xb0], eax
lea eax, [rsi + 1]
mov dword [rdx + 0xb4], r12d
mov byte [rdx + 0xa9], r12b
mov qword [rdx + 0xb8], r12
mov word [rdx + 0xaa], r12w
mov qword [rdx + 0xc0], 0x4d
mov qword [rdx + 0xc8], r12
mov qword [rdx + 0xd0], r12
mov qword [rdx + 0xd8], 0x70
mov qword [rdx + 0xe0], r12
mov qword [rdx + 0xe8], r12
add dword [rbx + 0xb8], 0xa
mov dword [rdx + 8], esi
mov dword [rdx + 0xc], eax
mov dword [rdx + 0x3c], esi
mov dword [rdx + 0x4c], ebp
mov dword [rdx + 0x54], esi
mov word [rdx + 0x4a], r13w
mov dword [rdx + 0x68], eax
mov dword [rdx + 0x84], esi
mov dword [rdx + 0xc8], esi
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14006bb30
mov r12, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r13, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rbx
ret
Function at 0x1400b202c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400b1e50

Function at 0x1405f5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405f51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405f5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f506f
add dl, dl
jne 0x1405f5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f50f6
xor eax, eax
add dl, dl
jne 0x1405f50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405f51ad
add dl, dl
jne 0x1405f50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405f50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405f507e
mov eax, 1
add dl, dl
jne 0x1405f5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405f5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f50fb
sub eax, ebx
mov ebx, 1
jne 0x1405f514c
mov ecx, 1
add dl, dl
jne 0x1405f512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405f5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405f5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405f515d
cmp eax, 0x7d00
jae 0x1405f519b
cmp eax, 0x500
jb 0x1405f5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f507e
cmp eax, 0x7f
ja 0x1405f519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405f507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405f51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405f507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20