joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013000
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401150f8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov esi, dword [rcx + 0x30]
mov rdi, rcx
sub esi, 6
movsxd rbx, esi
test esi, esi
jle 0x140013045
mov r8, rbx
lea rcx, [rbp - 0x30]
shl r8, 2
call fcn.1400c1540
xor r9d, r9d
xor r10d, r10d
test esi, esi
jle 0x140013097
xor r8d, r8d
xor edx, edx
cmp r9d, dword [rdi + 0x30]
ja 0x1400131da
cmp r8, rbx
jge 0x140013084
cmp rdx, 4
jge 0x140013088
mov eax, dword [rbp + r8*4 - 0x30]
lea rcx, [rdx + r9*4]
inc r8
mov dword [rdi + rcx*4 + 0x34], eax
inc rdx
inc r10d
cmp r8, rbx
jl 0x140013063
cmp rdx, 4
jne 0x140013092
inc r9d
xor r10d, r10d
xor edx, edx
cmp r8, rbx
jl 0x140013054
cmp r9d, dword [rdi + 0x30]
ja 0x1400131da
movsxd rax, r10d
lea r11, [0x1400f2e10]
lea r10, [0x1400f2d90]
movzx edx, byte [rbp + rbx*4 - 0x33]
lea r10, [r10 + 4]
movzx ecx, byte [rbp - 0x30]
xor cl, byte [rdx + r11]
mov edx, 1
mov byte [rbp - 0x30], cl
movzx ecx, byte [rbp + rbx*4 - 0x32]
movzx ecx, byte [rcx + r11]
xor byte [rbp - 0x2f], cl
movzx ecx, byte [rbp + rbx*4 - 0x31]
movzx ecx, byte [rcx + r11]
xor byte [rbp - 0x2e], cl
movzx ecx, byte [rbp + rbx*4 - 0x34]
movzx ecx, byte [rcx + r11]
xor byte [rbp - 0x2d], cl
movzx ecx, byte [r10 - 4]
xor byte [rbp - 0x30], cl
cmp esi, 8
je 0x140013130
cmp rdx, rbx
jge 0x140013190
nop dword [rax + rax]
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, rbx
jl 0x140013110
jmp 0x140013190
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, 4
jl 0x140013130
movzx ecx, byte [rbp - 0x24]
mov edx, 5
movzx ecx, byte [rcx + r11]
xor byte [rbp - 0x20], cl
movzx ecx, byte [rbp - 0x23]
movzx ecx, byte [rcx + r11]
xor byte [rbp - 0x1f], cl
movzx ecx, byte [rbp - 0x22]
movzx ecx, byte [rcx + r11]
xor byte [rbp - 0x1e], cl
movzx ecx, byte [rbp - 0x21]
movzx ecx, byte [rcx + r11]
xor byte [rbp - 0x1d], cl
cmp rdx, rbx
jge 0x140013190
nop dword [rax + rax]
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, rbx
jl 0x140013180
xor r8d, r8d
test esi, esi
jle 0x1400131d0
cmp r9d, dword [rdi + 0x30]
ja 0x1400131da
cmp r8, rbx
jge 0x1400131c0
cmp rax, 4
jge 0x1400131c4
mov ecx, dword [rbp + r8*4 - 0x30]
lea rdx, [rax + r9*4]
inc r8
mov dword [rdi + rdx*4 + 0x34], ecx
inc rax
cmp r8, rbx
jl 0x1400131a2
cmp rax, 4
jne 0x1400131cb
inc r9d
xor eax, eax
cmp r8, rbx
jl 0x140013197
cmp r9d, dword [rdi + 0x30]
jbe 0x1400130b2
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c0280
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140013200
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11d, 1
mov r10, rcx
cmp dword [rcx + 0x30], r11d
jbe 0x140013327
mov qword [rsp], rbx
lea rbx, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r8d, r11d
shl r8, 4
add r8, r10
mov r9d, r11d
inc r11d
movzx ecx, byte [r8 + 0x37]
movzx eax, byte [r8 + 0x36]
mov edx, dword [rbx + rcx*4 + 0x1184a0]
xor edx, dword [rbx + rax*4 + 0x1164a0]
movzx eax, byte [r8 + 0x35]
xor edx, dword [rbx + rax*4 + 0x1174a0]
movzx eax, byte [r8 + 0x34]
xor edx, dword [rbx + rax*4 + 0x1188a0]
mov dword [r8 + 0x34], edx
movzx ecx, byte [r8 + 0x3b]
movzx eax, byte [r8 + 0x3a]
mov edx, dword [rbx + rcx*4 + 0x1184a0]
xor edx, dword [rbx + rax*4 + 0x1164a0]
movzx eax, byte [r8 + 0x39]
xor edx, dword [rbx + rax*4 + 0x1174a0]
movzx eax, byte [r8 + 0x38]
xor edx, dword [rbx + rax*4 + 0x1188a0]
mov dword [r8 + 0x38], edx
movzx ecx, byte [r8 + 0x3f]
movzx eax, byte [r8 + 0x3e]
mov edx, dword [rbx + rcx*4 + 0x1184a0]
xor edx, dword [rbx + rax*4 + 0x1164a0]
movzx eax, byte [r8 + 0x3d]
xor edx, dword [rbx + rax*4 + 0x1174a0]
movzx eax, byte [r8 + 0x3c]
xor edx, dword [rbx + rax*4 + 0x1188a0]
mov dword [r8 + 0x3c], edx
lea r8, [r9 + 4]
shl r8, 4
add r8, r10
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8 + 3]
mov edx, dword [rbx + rcx*4 + 0x1184a0]
xor edx, dword [rbx + rax*4 + 0x1164a0]
movzx eax, byte [r8 + 1]
xor edx, dword [rbx + rax*4 + 0x1174a0]
movzx eax, byte [r8]
xor edx, dword [rbx + rax*4 + 0x1188a0]
mov dword [r8], edx
cmp r11d, dword [r10 + 0x30]
jb 0x140013230
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x14001b9b0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
xor eax, eax
movzx ecx, byte [rcx]
test cl, cl
je 0x14001b9f1
lea r10, [0x1400f5b00]
nop dword [rax]
nop word [rax + rax]
movzx edx, cl
lea r9, [r9 + 1]
lea ecx, [rax*8]
movzx r8d, byte [rdx + r10]
xor r8d, ecx
movzx ecx, byte [r9]
xor eax, r8d
test cl, cl
jne 0x14001b9d0
ret

Function at 0x14001ba70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, edx
mov edi, 0x40
shl rax, 4
mov rbx, rcx
cmp rax, 0x400
cmovbe edi, edx
cmp edi, dword [rcx]
jne 0x14001baa2
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x140120650]
test rax, rax
je 0x14001bab0
call rax
mov ecx, edi
shl rcx, 4
call fcn.140017280
mov rcx, qword [0x140120658]
mov rdi, rax
test rcx, rcx
je 0x14001bacc
call rcx
test rdi, rdi
je 0x14001ba95
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x30], rsi
call fcn.1400175b0
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x14011c4f0]
movsxd rsi, eax
xor edx, edx
shr rsi, 4
mov rcx, rdi
mov r8d, esi
shl r8, 4
mov dword [rbx], esi
call fcn.1400c1990
mov rcx, qword [rbx + 8]
xor r10d, r10d
mov qword [rbx + 8], r10
test rcx, rcx
je 0x14001bbd1
lea r11, [0x1400f5b00]
mov r9, qword [rcx + 0x18]
mov eax, r10d
movzx edx, byte [r9]
test dl, dl
je 0x14001bb51
movzx edx, dl
lea r9, [r9 + 1]
movzx r8d, byte [rdx + r11]
lea edx, [rax*8]
xor r8d, edx
movzx edx, byte [r9]
xor eax, r8d
test dl, dl
jne 0x14001bb30
mov r9, qword [rcx]
xor edx, edx
div esi
mov r8d, edx
shl r8, 4
add r8, rdi
je 0x14001bba9
mov eax, dword [r8]
test eax, eax
je 0x14001bb71
mov rdx, qword [r8 + 8]
jmp 0x14001bb74
mov rdx, r10
inc eax
mov qword [r8 + 8], rcx
mov dword [r8], eax
test rdx, rdx
je 0x14001bba9
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x14001bb9f
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x14001bbc5
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x14001bbc5
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x14001bbbd
mov qword [rax + 8], rcx
mov qword [rcx + 8], r10
mov qword [rbx + 8], rcx
mov rcx, r9
test r9, r9
jne 0x14001bb21
mov rsi, qword [rsp + 0x30]
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001bbf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r9, qword [rcx + 0x10]
lea rdi, [0x1400f5b00]
xor r11d, r11d
mov rbx, rdx
mov r10, rcx
test r9, r9
je 0x14001bc5c
movzx eax, byte [rdx]
test al, al
je 0x14001bc3f
nop word [rax + rax]
movzx eax, al
lea rdx, [rdx + 1]
movzx ecx, byte [rax + rdi]
lea eax, [r11*8]
xor ecx, eax
movzx eax, byte [rdx]
xor r11d, ecx
test al, al
jne 0x14001bc20
mov eax, r11d
xor edx, edx
div dword [r10]
mov eax, edx
shl rax, 4
add rax, r9
mov r11d, edx
mov r9, qword [rax + 8]
mov r10d, dword [rax]
jmp 0x14001bc64
mov r9, qword [rcx + 8]
mov r10d, dword [rcx + 4]
mov dword [r8], r11d
test r10d, r10d
je 0x14001bcdb
nop dword [rax]
mov rax, qword [r9 + 0x18]
dec r10d
test rax, rax
jne 0x14001bc86
mov rax, rbx
neg rax
sbb ecx, ecx
jmp 0x14001bccf
test rbx, rbx
je 0x14001bcd3
movzx edx, byte [rax]
mov r8, rbx
test dl, dl
je 0x14001bcbe
nop word [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + rdi]
cmp byte [rdx + rdi], cl
jne 0x14001bcbe
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x14001bca0
movzx ecx, byte [r8]
movzx edx, byte [rcx + rdi]
movzx ecx, byte [rax]
movzx ecx, byte [rcx + rdi]
sub ecx, edx
test ecx, ecx
je 0x14001bce8
mov r9, qword [r9]
test r10d, r10d
jne 0x14001bc70
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140049a30
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x20], 0
mov rbx, rcx
je 0x140049a8d
mov rcx, qword [rcx]
call fcn.140048380
mov ecx, eax
test eax, eax
jne 0x140049aab
movups xmm1, xmmword [rbx + 0x28]
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x38], xmm1
movups xmmword [rbx + 0x28], xmm0
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rax
jne 0x140049a76
mov eax, ecx
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
lea rdx, [0x140049a10]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.140019c50
call fcn.140049740
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x28], xmm0
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x140049aab
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret

Function at 0x14004a980
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x48]
xor ebx, ebx
mov r14, qword [rcx + 0x10]
mov r15, r9
mov ebp, r8d
mov r13, rdx
mov rdi, qword [rsi + 0x30]
test rdi, rdi
jne 0x14004aa09
movzx eax, word [r14 + 6]
imul ecx, eax, 0x38
add ecx, 0x58
movsxd rdx, ecx
mov rcx, qword [r14 + 0x10]
call fcn.140017900
mov rdi, rax
test rax, rax
jne 0x14004a9dd
mov edi, ebx
jmp 0x14004a9f4
add rax, 0x20
mov qword [rdi], r14
mov qword [rdi + 0x10], rax
movzx eax, word [r14 + 6]
inc ax
mov word [rdi + 8], ax
mov qword [rsi + 0x30], rdi
test rdi, rdi
jne 0x14004aa05
lea eax, [rdi + 7]
jmp 0x14004aa8b
mov word [rdi + 8], bp
cmp byte [rsi + 0x58], bl
je 0x14004aa43
cmp byte [rsi + 0x59], bl
je 0x14004aa21
mov rax, qword [rsi + 0x10]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x14004aa4b
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x14004aa4b
mov rax, qword [rsi + 0x38]
lea r8, [rax + 0x10]
mov edx, dword [rax]
mov r9, rdi
mov rcx, r14
call fcn.14003b500
test ebp, ebp
jle 0x14004aa73
mov rax, qword [rdi + 0x10]
add rax, 8
test byte [rax], 1
jne 0x14004aaaa
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x14004aa64
mov rdx, qword [r13 + 0x10]
xor r9d, r9d
mov ecx, dword [r13 + 0xc]
mov r8, rdi
call fcn.14003bad0
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
mov dword [r15], 0xffffffff
jmp 0x14004aa89
Function at 0x140051730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
lea r10, [rcx + 0x88]
mov ebx, r9d
mov esi, r8d
mov rdi, rcx
xor r11d, r11d
nop dword [rax]
cmp dword [r10 + 0xc], 0
jle 0x140051775
cmp dword [r10], ebx
jne 0x140051775
movsx eax, word [r10 + 4]
cmp eax, esi
je 0x1400517c1
inc r11d
add r10, 0x14
cmp r11d, 0xa
jl 0x140051760
mov qword [rsp + 0x40], rbp
mov r9d, esi
mov ebp, dword [rsp + 0x60]
mov r8d, ebx
mov rcx, r14
mov dword [rsp + 0x20], ebp
call fcn.140051650
movzx edx, byte [rsp + 0x68]
test dl, dl
je 0x1400517ef
mov rax, qword [r14]
mov ecx, dword [r14 + 0x3c]
dec ecx
cmp byte [rax + 0x51], 0
je 0x1400517da
lea rax, [0x140120b10]
mov byte [rax + 3], dl
jmp 0x1400517ff
mov eax, dword [rcx + 0x74]
mov dword [r10 + 0x10], eax
inc dword [rcx + 0x74]
mov edx, dword [r10 + 0xc]
call fcn.1400515b0
mov eax, dword [r10 + 0xc]
jmp 0x140051806
movsxd rax, ecx
lea rcx, [rax + rax*2]
mov rax, qword [r14 + 8]
mov byte [rax + rcx*8 + 3], dl
lea rax, [rax + rcx*8]
jmp 0x1400517ff
mov r9d, ebp
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call fcn.140051380
mov eax, ebp
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140053b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x20
mov r9d, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140053cad
test rdx, rdx
je 0x140053cad
mov eax, dword [rcx + 4]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov esi, dword [rdx + 4]
mov ebp, esi
or ebp, eax
bt ebp, 0xa
jae 0x140053b60
and esi, eax
bt esi, 0xa
jae 0x140053bdf
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x140053bdf
xor eax, eax
jmp 0x140053ba3
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x140053bb8
cmp r8b, 0x5f
jne 0x140053b85
mov rcx, qword [rcx + 0x10]
mov r8d, r9d
call fcn.140053b00
cmp eax, 2
jl 0x140053b9e
mov r9d, dword [rsp + 0x40]
cmp byte [rbx], 0x5f
jne 0x140053bdf
mov rdx, qword [rbx + 0x10]
mov r8d, r9d
mov rcx, rdi
call fcn.140053b00
cmp eax, 2
jge 0x140053bdf
mov eax, 1
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea eax, [r8 + 0x66]
test al, 0xfd
je 0x140053c1a
mov rax, qword [rcx + 8]
test rax, rax
je 0x140053c1a
cmp r8b, 0x99
jne 0x140053be6
mov rdx, qword [rdx + 8]
mov rcx, rax
call fcn.14001a7a0
test eax, eax
je 0x140053c15
mov eax, 2
jmp 0x140053ba3
mov r10, qword [rdx + 8]
sub r10, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x140053c03
inc rax
test ecx, ecx
jne 0x140053bf0
test edx, edx
je 0x140053c1a
xor ecx, ecx
cmp r8b, 0x5f
setne cl
lea eax, [rcx + 1]
jmp 0x140053ba3
mov r9d, dword [rsp + 0x40]
xor esi, dword [rdi + 4]
test sil, 0x10
jne 0x140053bdf
bt ebp, 0xe
jb 0x140053ca6
bt ebp, 0xb
jb 0x140053bdf
mov rdx, qword [rbx + 0x10]
mov r8d, r9d
mov rcx, qword [rdi + 0x10]
call fcn.140053b00
test eax, eax
jne 0x140053bdf
mov esi, dword [rsp + 0x40]
mov r8d, esi
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.140053b00
test eax, eax
jne 0x140053bdf
mov rdx, qword [rbx + 0x20]
mov r8d, esi
mov rcx, qword [rdi + 0x20]
call fcn.140053cd0
test eax, eax
jne 0x140053bdf
bt ebp, 0xd
jb 0x140053ca6
cmp byte [rdi], 0x61
je 0x140053ca6
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x140053bdf
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x140053ca6
cmp ecx, esi
jne 0x140053bdf
test eax, eax
jns 0x140053bdf
xor eax, eax
jmp 0x140053ba3
xor ecx, ecx
mov eax, 2
cmp rbx, rdi
mov rbx, qword [rsp + 0x48]
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140055300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r12
push r15
sub rsp, 0x38
mov r12d, r8d
movsxd r15, edx
mov rbx, rcx
call fcn.140076f80
mov rsi, rax
test rax, rax
je 0x1400554fa
movzx eax, byte [rbx + 0x1f]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x30], r14
test al, al
jne 0x14005534a
inc dword [rbx + 0x54]
mov r14d, dword [rbx + 0x54]
jmp 0x140055357
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0x24]
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x140055367
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x140055373
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov r9d, r14d
mov dword [rsp + 0x20], 2
mov r8d, r15d
mov edx, 0x33
mov rcx, rsi
call fcn.140037d60
mov eax, dword [rsi + 0x94]
bts eax, r15d
mov dword [rsi + 0x94], eax
cmp r15d, 1
je 0x1400553cd
mov rax, qword [rsi]
mov rdx, r15
shl rdx, 5
mov rcx, qword [rax + 0x20]
mov rax, qword [rdx + rcx + 8]
cmp byte [rax + 0x11], 0
je 0x1400553cd
mov eax, dword [rsi + 0x98]
bts eax, r15d
mov dword [rsi + 0x98], eax
xor edi, edi
mov r9d, ebp
mov r8d, r12d
mov dword [rsp + 0x20], edi
mov rcx, rsi
lea edx, [rdi + 0x17]
call fcn.140037d60
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov r8d, ebp
lea edx, [rdi + 0x53]
mov rcx, rsi
call fcn.140037d60
mov rcx, qword [rsi]
lea r13, [0x140120b10]
mov r12d, eax
mov eax, dword [rsi + 0x3c]
dec eax
cmp byte [rcx + 0x51], dil
je 0x140055417
mov rax, r13
jmp 0x140055425
cdqe
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 8]
lea rax, [rax + rcx*8]
mov r9d, 2
mov byte [rax + 3], 0x90
mov r8d, r15d
mov dword [rsp + 0x20], ebp
mov rcx, rsi
lea edx, [r9 + 0x32]
call fcn.140037d60
mov ecx, dword [rsi + 0x3c]
mov rax, qword [rsi + 0x30]
dec ecx
mov dword [rax + 0x64], ecx
mov edx, dword [rsi + 0x3c]
test r12d, r12d
jns 0x14005545a
lea r12d, [rdx - 1]
mov rax, qword [rsi]
cmp byte [rax + 0x51], dil
jne 0x140055472
movsxd rax, r12d
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 8]
lea r13, [rax + rcx*8]
mov dword [r13 + 8], edx
mov r13, qword [rsp + 0x70]
test r14d, r14d
je 0x1400554b4
movzx edx, byte [rbx + 0x1f]
cmp dl, 8
jae 0x1400554b4
mov ecx, edi
lea rax, [rbx + 0x88]
cmp dword [rax + 0xc], r14d
je 0x1400554b0
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x140055492
movzx eax, dl
mov dword [rbx + rax*4 + 0x24], r14d
inc byte [rbx + 0x1f]
jmp 0x1400554b4
mov byte [rax + 6], 1
mov r14, qword [rsp + 0x30]
test ebp, ebp
je 0x1400554f0
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x1400554f0
lea rax, [rbx + 0x88]
nop dword [rax]
cmp dword [rax + 0xc], ebp
je 0x1400554ec
inc edi
add rax, 0x14
cmp edi, 0xa
jl 0x1400554d0
movzx eax, cl
mov dword [rbx + rax*4 + 0x24], ebp
inc byte [rbx + 0x1f]
jmp 0x1400554f0
mov byte [rax + 6], 1
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x38
pop r15
pop r12
pop rsi
pop rbx
ret
Function at 0x140058f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x20
xor r10d, r10d
mov rdi, r8
cmp byte [rcx + 0x330], 3
mov r14, rdx
mov rsi, rcx
jae 0x140058f95
mov rcx, rdx
call fcn.140058ef0
test eax, eax
je 0x140058f95
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x48], rbx
xor ebx, ebx
mov qword [rsp + 0x50], rbp
mov ebp, dword [rsi + 0x28]
test ebp, ebp
jle 0x140059068
mov qword [rsp + 0x58], r15
lea r15, [0x1400f5b00]
mov r9d, ebx
cmp ebx, 2
jge 0x140058fc4
xor r9d, 1
test rdi, rdi
je 0x140059025
mov rax, qword [rsi + 0x20]
movsxd rcx, r9d
shl rcx, 5
mov r8, qword [rcx + rax]
test r8, r8
je 0x140059059
movzx edx, byte [rdi]
mov rax, rdi
test dl, dl
je 0x140059010
nop dword [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r15]
cmp byte [rdx + r15], cl
jne 0x140059010
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x140058ff0
movzx ecx, byte [r8]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r15]
cmp eax, edx
jne 0x140059059
mov rax, qword [rsi + 0x20]
lea r8, [rsp + 0x40]
movsxd rcx, r9d
mov rdx, r14
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.14001bbf0
test rax, rax
je 0x140059056
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x140059063
jmp 0x140059059
xor r10d, r10d
inc ebx
cmp ebx, ebp
jl 0x140058fb8
mov r15, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rax, r10
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140059210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov esi, dword [rcx + 0x28]
xor r9d, r9d
xor ebx, ebx
mov rdi, r8
mov r14, rdx
test esi, esi
jle 0x1400592fe
mov qword [rsp + 0x48], rbp
mov rbp, qword [rcx + 0x20]
mov qword [rsp + 0x50], r15
lea r15, [0x1400f5b00]
mov eax, ebx
cmp ebx, 2
jge 0x140059252
xor eax, 1
cdqe
shl rax, 5
mov r10, qword [rax + rbp + 0x18]
test rdi, rdi
je 0x1400592b5
mov r8, qword [rax + rbp]
test r8, r8
je 0x1400592d9
movzx edx, byte [rdi]
mov rax, rdi
test dl, dl
je 0x1400592a0
nop word [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r15]
cmp byte [rdx + r15], cl
jne 0x1400592a0
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x140059280
movzx ecx, byte [r8]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r15]
cmp eax, edx
jne 0x1400592d9
lea rcx, [r10 + 0x20]
mov rdx, r14
lea r8, [rsp + 0x40]
call fcn.14001bbf0
test rax, rax
je 0x1400592d6
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x1400592e3
jmp 0x1400592d9
xor r9d, r9d
inc ebx
cmp ebx, esi
jl 0x140059248
mov rbp, qword [rsp + 0x48]
mov rax, r9
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, r9
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14009dff0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rcx
cmp byte [rcx + 0x1bd], 2
jne 0x14009e0bf
mov r8, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
lea rcx, str.SELECT_1_FROM__Q.sqlite_master_WHERE_tbl_name_q_stat
mov qword [rsp + 0x60], rsi
call fcn.140019790
mov rsi, rax
test rax, rax
je 0x14009e0aa
mov rcx, qword [rdi + 0x18]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
lea r9d, [rbx + 1]
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rbx
call fcn.140073550
mov ebp, eax
test eax, eax
jne 0x14009e08b
mov rcx, qword [rsp + 0x50]
call fcn.14003d920
mov rcx, qword [rsp + 0x50]
cmp eax, 0x64
sete bl
call fcn.14003c9d0
mov ebp, eax
test eax, eax
jne 0x14009e08b
mov byte [rdi + 0x1bd], bl
mov rcx, rsi
call fcn.1400175b0
mov rsi, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov eax, 7
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400b9440
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov r8, qword [rdx + 0x38]
mov rsi, rdx
mov rdx, qword [rdx + 0x30]
mov rdi, rcx
lea rcx, str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
xor ebx, ebx
call fcn.140019790
mov rbp, rax
test rax, rax
jne 0x1400b9480
lea eax, [rbx + 7]
jmp 0x1400b9517
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov r9d, 1
or r8d, 0xffffffff
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rdi
call fcn.140073550
mov edi, eax
test eax, eax
jne 0x1400b94ec
mov rcx, qword [rsp + 0x58]
call fcn.14003d920
cmp eax, 0x64
jne 0x1400b94cd
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.14003e220
mov rbx, rax
mov rcx, qword [rsp + 0x58]
call fcn.14003c9d0
mov edi, eax
test edi, edi
jne 0x1400b950d
test rbx, rbx
jne 0x1400b94fd
mov qword [rsi + 0x48], 0x100000
jmp 0x1400b950d
cmp eax, 7
je 0x1400b94d9
mov edi, ebx
mov qword [rsi + 0x48], 0x100000
jmp 0x1400b950d
mov eax, 0x64
cmp rbx, rax
cmovg rax, rbx
mov qword [rsi + 0x48], rax
mov rcx, rbp
call fcn.1400175b0
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret