joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140102820
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x140102838
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x140102838
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x140102840
xor eax, eax
ret
cmp rbx, 3
je 0x14010284c
cmp rbx, 4
jne 0x140102879
cmp al, 0x2c
ja 0x140102866
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x140102876
cmp al, 0x24
je 0x140102876
nop dword [rax]
cmp al, 0x26
jae 0x140102876
jmp 0x140102879
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x140102876
cmp al, 0x5b
je 0x140102876
cmp al, 0x5d
jne 0x140102879
xor eax, eax
ret
cmp al, 0x2f
ja 0x1401028b2
nop dword [rax]
cmp al, 0x26
ja 0x140102891
cmp al, 0x24
je 0x1401028d1
cmp al, 0x26
je 0x1401028d1
jmp 0x14010294b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x1401028d1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x140102948
cmp al, 0x2f
je 0x1401028d1
jmp 0x14010294b
cmp al, 0x3d
ja 0x1401028c9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x1401028d1
nop
cmp al, 0x3d
je 0x1401028d1
jmp 0x14010294b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x140102940
cmp rbx, 2
jg 0x140102907
cmp rbx, 1
je 0x140102901
nop dword [rax]
cmp rbx, 2
jne 0x14010294b
cmp al, 0x2f
je 0x1401028f2
cmp al, 0x3b
je 0x1401028f2
cmp al, 0x2c
jne 0x1401028f9
mov ecx, 1
jmp 0x1401028fe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x14010292a
cmp al, 0x40
je 0x140102919
cmp al, 0x2f
je 0x140102919
cmp al, 0x3f
jne 0x140102922
mov ecx, 1
nop
jmp 0x140102927
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x140102939
cmp rbx, 7
jne 0x14010294b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x140102948
cmp al, 0x7e
jne 0x14010294b
xor eax, eax
ret
cmp rbx, 7
jne 0x140102961
cmp al, 0x21
je 0x14010295d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x140102961
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x140108f20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14010915b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call dbg.crypto/internal/boring/sig.StandardCrypto
xorps xmm15, xmm15
mov r14, qword [0x1403eca70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x14010906a
nop dword [rax]
cmp rdx, 0x40
ja 0x14010914d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x140108fd9
mov rax, rdx
mov rcx, rsi
nop
call dbg.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x140109041
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call dbg.crypto/sha256.block
xorps xmm15, xmm15
mov r14, qword [0x1403eca70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x140109142
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x140109077
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x1401090f5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call dbg.crypto/sha256.block
xorps xmm15, xmm15
mov r14, qword [0x1403eca70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x140109138
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x140109134
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call dbg.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call dbg.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call dbg.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp dbg.crypto/sha256.(*digest).Write
Function at 0x14010d220
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x14010d2a5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x14010d406
cmp rcx, 0xe
jne 0x14010d320
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x14010d406
cmp rcx, 0xf
jne 0x14010d397
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x14010d406
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x140113580
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14011366d
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
nop dword [rax + rax]
test rcx, rcx
jle 0x140113659
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call dbg.github.com/mattn/go-sqlite3._cgo_cmalloc
xorps xmm15, xmm15
mov r14, qword [0x1403eca70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rcx
mov rsi, rcx
cmovl rsi, rbx
mov rdi, qword [rsp + 0x58]
cmp rdi, rdx
jne 0x140113613
cmp rbx, rcx
jmp 0x140113645
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov rax, rdx
mov rbx, rdi
mov rcx, rsi
call dbg.runtime.memmove
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rdx, qword [rsp + 0x40]
mov rbx, rax
mov rax, qword [rsp + 0x38]
jae 0x140113651
mov byte [rdx + rbx], 0
add rsp, 0x48
pop rbp
ret
mov rax, rbx
call dbg.runtime.panicIndex
lea rax, [0x140250580]
lea rbx, [0x1402b1850]
call dbg.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp dbg.github.com/mattn/go-sqlite3._Cfunc_CString

Function at 0x14011b2a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14011b370
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edi
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
lea rax, [0x14024ba40]
lea rbx, [rsp + 0x48]
xor ecx, ecx
xor edi, edi
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 8], rdx
mov edx, dword [rsp + 0x70]
mov dword [rsp + 0x10], edx
mov edx, dword [rsp + 0x74]
mov dword [rsp + 0x14], edx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x30], rdx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_create_function
xorps xmm15, xmm15
mov r14, qword [0x1403eca70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x38]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteConn).RegisterFunc.sqlite3CreateFunction.func3
Function at 0x140121a80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140121b55
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
lea rax, [0x14024ba40]
lea rbx, [rsp + 0x38]
xor ecx, ecx
xor edi, edi
nop
call dbg.runtime.cgoCheckPointer
lea rax, [0x14024f0c0]
mov rbx, qword [rsp + 0x60]
lea rcx, [0x140250980]
lea rdi, [0x14022f1c8]
nop
call dbg.runtime.cgoCheckPointer
lea rax, [0x14024f100]
mov rbx, qword [rsp + 0x68]
lea rcx, [0x140250980]
lea rdi, [0x14022f1c8]
nop
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x30]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], 0xffffffff
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_prepare_v2_internal
xorps xmm15, xmm15
mov r14, qword [0x1403eca70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x28]
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteConn).prepare.func2

Function at 0x1401226a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14012273d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
test rdi, rdi
jbe 0x140122732
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x14024bbc0]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov edx, dword [rsp + 0x50]
mov dword [rsp + 8], edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x18], edx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_bind_text
xorps xmm15, xmm15
mov r14, qword [0x1403eca70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rcx, rax
call dbg.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteStmt).bind.func13
Function at 0x140122be0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140122c7d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
test rdi, rdi
jbe 0x140122c72
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x14024bbc0]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov edx, dword [rsp + 0x50]
mov dword [rsp + 8], edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x18], edx
call dbg.github.com/mattn/go-sqlite3._Cfunc__sqlite3_bind_text
xorps xmm15, xmm15
mov r14, qword [0x1403eca70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rcx, rax
call dbg.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteStmt).bind.func6

Function at 0x140125720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401257cd
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x14024ba40]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
nop
call dbg.runtime.cgoCheckPointer
lea rax, [0x14024f100]
mov rbx, qword [rsp + 0x60]
lea rcx, [0x140250980]
lea rdi, [0x14022f1c8]
nop
call dbg.runtime.cgoCheckPointer
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
call dbg.github.com/mattn/go-sqlite3._Cfunc_sqlite3_load_extension
xorps xmm15, xmm15
mov r14, qword [0x1403eca70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp dbg.github.com/mattn/go-sqlite3.(*SQLiteConn).loadExtension.func4
Function at 0x14012c230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movsxd r12, dword [rdx]
mov rbp, rdx
movzx edx, byte [r8]
mov rdi, rcx
mov rbx, r8
test dl, dl
je 0x14012c28c
mov rsi, r8
mov eax, edx
lea r8, [0x14038e500]
xor r9d, r9d
nop dword [rax]
movzx ecx, al
test byte [r8 + rcx], 6
jne 0x14012c26e
cmp al, 0x5f
jne 0x14012c27e
movzx eax, byte [rsi + 1]
add rsi, 1
add r9d, 1
test al, al
jne 0x14012c260
movzx eax, dl
test byte [r8 + rax], 4
je 0x14012c308
mov byte [rdi + r12], 0x22
movzx edx, byte [rbx]
lea eax, [r12 + 1]
mov r9d, 1
test dl, dl
jne 0x14012c2b6
jmp 0x14012c2f8
movzx edx, byte [rbx + 1]
add rbx, 1
mov eax, ecx
test dl, dl
je 0x14012c2da
movsxd r8, eax
lea ecx, [rax + 1]
mov byte [rdi + r8], dl
cmp byte [rbx], 0x22
jne 0x14012c2a8
movsxd rcx, ecx
add rbx, 1
add eax, 2
mov byte [rdi + rcx], 0x22
movzx edx, byte [rbx]
test dl, dl
jne 0x14012c2b6
test r9d, r9d
jne 0x14012c2f8
movsxd rdx, eax
mov byte [rdi + rdx], 0
mov dword [rbp], eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movsxd rdx, eax
add eax, 1
mov byte [rdi + rdx], 0x22
jmp 0x14012c2df
mov dword [rsp + 0x2c], 0x3b
cmp r9d, 1
jg 0x14012c338
cmp byte [rsi], 0
setne al
xor r9d, 1
and r9d, 1
or al, r9b
jne 0x14012c28c
mov eax, r12d
xor r9d, r9d
jmp 0x14012c2b6
lea r8, [rsp + 0x2c]
mov edx, r9d
mov rcx, rbx
call dbg.keywordCode
cmp dword [rsp + 0x2c], 0x3b
jne 0x14012c28c
cmp byte [rsi], 0
jne 0x14012c28c
movzx edx, byte [rbx]
mov eax, r12d
test dl, dl
je 0x14012c2df
xor r9d, r9d
jmp 0x14012c2b6

Function at 0x14012db90
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x14012dbc8
movsxd rdx, edx
lea r9, [rcx + rdx]
xor edx, edx
nop dword [rax]
movsx r8d, byte [rcx]
lea eax, [rdx*8]
add rcx, 1
xor eax, r8d
xor edx, eax
cmp r9, rcx
jne 0x14012dba0
mov eax, edx
and eax, 0x7fffffff
ret
xor eax, eax
ret

Function at 0x14012fab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r9d, edx
test edx, edx
jle 0x14012faf8
mov rax, rbx
xor ecx, ecx
nop dword [rax]
movsx r8d, byte [rax]
lea edx, [rcx*8]
add rax, 1
xor edx, r8d
xor ecx, edx
mov edx, ebx
sub edx, eax
add edx, r9d
test edx, edx
jg 0x14012fac8
mov eax, ecx
and eax, 0x7fffffff
add rsp, 0x20
pop rbx
ret
call sym.strlen
mov rdx, rax
mov r9d, eax
xor eax, eax
test edx, edx
jg 0x14012fabf
add rsp, 0x20
pop rbx
ret
Function at 0x1401372a0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor ebx, ebx
mov rsi, r8
lea rbp, [rsp + 0x20]
movsxd r8, edx
mov edi, edx
mov rcx, rsi
xor edx, edx
call sym.memset
mov rcx, rbp
call qword [sym.GetSystemTime]
mov rdx, rbp
lea r9, [rsp + 0x30]
xor r8d, r8d
nop word [rax + rax]
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp r9, rdx
jne 0x1401372e0
call qword [sym.GetCurrentProcessId]
lea r12, [rsp + 0x24]
mov rdx, rbp
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp r12, rdx
jne 0x140137310
call qword [sym.GetTickCount]
mov rdx, rbp
xor r8d, r8d
mov dword [rsp + 0x20], eax
nop dword [rax + rax]
lea eax, [rbx + 1]
movzx ecx, byte [rdx]
xor byte [rsi + rbx], cl
cmp edi, eax
cmovle eax, r8d
add rdx, 1
movsxd rbx, eax
cmp r12, rdx
jne 0x140137340
mov rcx, rbp
call qword [sym.QueryPerformanceCounter]
mov rax, rbp
lea r9, [rsp + 0x28]
xor r8d, r8d
nop
lea edx, [rbx + 1]
movzx ecx, byte [rax]
xor byte [rsi + rbx], cl
cmp edi, edx
cmovle edx, r8d
add rax, 1
movsxd rbx, edx
cmp r9, rax
jne 0x140137370
cmp edi, 0x20
mov eax, 0x20
cmovle eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14013fc80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13d, dword [rcx + 0x80]
movsxd rax, edx
mov r12, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rsi, rax
sub rdx, rax
shl rdx, 3
test rcx, rcx
je 0x14013fe38
test rdx, rdx
je 0x14013fe50
cmp rdx, 0x7ffffeff
ja 0x14013fdf8
call sym.sqlite3Realloc.part.0
mov rdi, rax
test rdi, rdi
je 0x14013fdf8
movsxd rdx, r13d
xor ebp, ebp
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [rdi + rax*8]
mov eax, esi
sub eax, r13d
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sym.memset
mov qword [r12 + 0x78], rdi
cmp r13d, esi
jl 0x14013fdaa
jmp 0x14013fe20
lea rdi, [rax + 8]
mov rcx, rax
mov qword [rax], 0
mov qword [rax + 0x1f8], 0
and rdi, 0xfffffffffffffff8
mov rax, rbp
sub rcx, rdi
add ecx, 0x200
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rdx], r14d
mov qword [rbx + 0x10], rdx
mov rax, qword [r12 + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x14013fd95
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add r13d, 1
add rbx, 0x38
mov dword [r12 + 0x80], r13d
cmp r13d, esi
je 0x14013fe20
mov rax, qword [r12 + 0x50]
mov r14d, dword [r12 + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r14d
je 0x14013fe10
mov rax, qword [r12 + 0x60]
test rax, rax
jle 0x14013fe10
mov qword [rbx], rax
mov eax, dword [r12 + 0x3c]
mov ecx, 0x200
mov dword [rbx + 0x1c], eax
call sym.sqlite3Malloc
mov rdx, rax
test rax, rax
jne 0x14013fd30
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [r12 + 0xb8]
jmp 0x14013fdc8
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rdx
call sym.sqlite3Malloc
mov rdi, rax
jmp 0x14013fcd8
call sym.sqlite3_free
mov eax, 7
jmp 0x14013fdfd
Function at 0x1401411c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebp, ebp
lea rbx, [0x14038e600]
mov eax, dword [rcx + 0x28]
mov r12, rcx
mov rdi, rdx
mov rsi, r8
test eax, eax
jle 0x140141254
nop dword [rax + rax]
mov r10d, ebp
xor r10d, 1
cmp ebp, 2
cmovge r10d, ebp
movsxd r9, r10d
shl r9, 5
add r9, qword [r12 + 0x20]
test rsi, rsi
je 0x14014122e
mov r8, qword [r9]
xor ecx, ecx
jmp 0x14014121d
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x140141268
add rcx, 1
movzx eax, byte [r8 + rcx]
movzx edx, byte [rsi + rcx]
cmp eax, edx
jne 0x140141210
test eax, eax
jne 0x140141219
mov rcx, qword [r9 + 0x18]
xor r8d, r8d
mov rdx, rdi
add rcx, 0x20
call dbg.findElementWithHash
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140141256
add ebp, 1
cmp dword [r12 + 0x28], ebp
jg 0x1401411e8
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test r10d, r10d
jne 0x14014124a
mov rcx, rsi
mov eax, 0x6d
lea r8, str.main
jmp 0x140141298
cdqe
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x14014124a
movzx eax, byte [r8 + 1]
add r8, 1
add rcx, 1
movzx edx, byte [rcx]
cmp eax, edx
jne 0x140141280
test eax, eax
jne 0x14014128b
jmp 0x14014122e