joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b23e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
jb 0x1400b23f0
mov rdx, qword [rdx]
mov rcx, rdx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400b24e1
mov qword [rsp + 0x30], rdi
test bl, 0x10
je 0x1400b249a
test bl, 2
je 0x1400b248a
mov rcx, qword [0x14027fe70]
lea rdi, [0x14027fe70]
cmp rcx, rdi
je 0x1400b2452
test byte [rcx + 0x44], 0x40
je 0x1400b2452
cmp byte [rcx + 0x41], 4
jb 0x1400b2452
mov rcx, qword [rcx + 0x38]
lea r8, [0x1401fde50]
mov edx, 0x12
call fcn.14001d350
mov rcx, qword [0x14027fe70]
test bl, 4
je 0x1400b248a
cmp rcx, rdi
je 0x1400b247d
test byte [rcx + 0x44], 0x40
je 0x1400b247d
cmp byte [rcx + 0x41], 4
jb 0x1400b247d
mov rcx, qword [rcx + 0x38]
lea r8, [0x1401fde50]
mov edx, 0x13
call fcn.14001d350
xor eax, eax
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rcx, qword [0x14027fe70]
lea rdi, [0x14027fe70]
cmp rcx, rdi
je 0x1400b24d1
test byte [rcx + 0x44], 0x40
je 0x1400b24d1
cmp byte [rcx + 0x41], 2
jb 0x1400b24d1
mov rcx, qword [rcx + 0x38]
lea r8, [0x1401fde50]
mov edx, 0x14
mov r9d, ebx
call fcn.14001f1d0
mov eax, 0x50
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov eax, 2
add rsp, 0x20
pop rbx
ret

Function at 0x1400b25c0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14027ef78]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
mov dword [rsp + 0x30], 0x18
mov rbx, rdx
mov dword [rsp + 0x40], edi
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rcx, str.D:_A_OI_FA___SY__A_OI_FA___BA_
lea edx, [rdi + 1]
call sub.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x1400b2646
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x14027fe70]
lea rdx, [0x14027fe70]
cmp rcx, rdx
je 0x1400b2642
test byte [rcx + 0x44], 0x40
je 0x1400b2642
cmp byte [rcx + 0x41], 2
jb 0x1400b2642
mov rcx, qword [rcx + 0x38]
lea edx, [rdi + 0x15]
mov r9d, eax
lea r8, [0x1401fde50]
call fcn.14001ef30
mov eax, ebx
jmp 0x1400b26be
cmp qword [rbx + 0x18], 8
jb 0x1400b2652
mov rcx, qword [rbx]
jmp 0x1400b2655
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x1400b26b1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x14027fe70]
lea rdx, [0x14027fe70]
cmp rcx, rdx
je 0x1400b26b1
test byte [rcx + 0x44], 0x40
je 0x1400b26b1
cmp byte [rcx + 0x41], 2
jb 0x1400b26b1
cmp qword [rbx + 0x18], 8
jb 0x1400b2695
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x1401fde50]
mov edx, 0x16
mov dword [rsp + 0x20], eax
mov r9, rbx
call fcn.14002ca00
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14017e000
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400b26e0
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rax, qword [0x140285e30]
test rax, rax
jne 0x1400b27b8
mov ecx, 0x95050
call fcn.14017deb0
mov rdi, rax
mov qword [rsp + 0x40], rax
xor ebx, ebx
test rax, rax
je 0x1400b2737
xor edx, edx
mov r8d, 0x95050
mov rcx, rax
call fcn.1401803b0
mov rcx, rdi
call fcn.1400afb60
jmp 0x1400b273a
mov rax, rbx
mov qword [0x140285e30], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov dword [0x14027d110], eax
cmp eax, 0xffffffff
jne 0x1400b27ae
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rdx, [0x14027fe70]
mov rcx, qword [0x14027fe70]
cmp rcx, rdx
je 0x1400b278f
test byte [rcx + 0x44], 0x40
je 0x1400b278f
cmp byte [rcx + 0x41], 4
jb 0x1400b278f
mov edx, 0x2c
mov r9d, eax
lea r8, [0x1401fde50]
mov rcx, qword [rcx + 0x38]
call fcn.14001ef30
mov rcx, qword [0x140285e30]
test rcx, rcx
je 0x1400b27a5
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x140285e30], rbx
jmp 0x1400b27b5
mov rbx, qword [0x140285e30]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b3710
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov rbx, rdx
mov dword [rsp + 0x50], esi
mov rdi, rcx
mov rcx, qword [0x14027fe70]
lea rbp, [0x14027fe70]
cmp rcx, rbp
je 0x1400b3762
test byte [rcx + 0x44], 0x40
je 0x1400b3762
cmp byte [rcx + 0x41], 4
jb 0x1400b3762
mov rcx, qword [rcx + 0x38]
lea edx, [rsi + 0x2d]
lea r8, [0x1401fde50]
call fcn.14001d350
add rdi, 0x94dd8
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp byte [0x140285f38], sil
jne 0x1400b380d
mov rcx, rdi
mov byte [0x140285f38], 1
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rax, qword [0x14027fe70]
cmp rax, rbp
je 0x1400b37ec
test byte [rax + 0x44], 0x40
je 0x1400b37ec
cmp byte [rax + 0x41], 2
jb 0x1400b37ec
cmp qword [rbx + 0x18], 8
jb 0x1400b37b1
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400b3f20
mov esi, 1
cmp qword [rax + 0x18], 0x10
jb 0x1400b37cd
mov rax, qword [rax]
mov rcx, qword [0x14027fe70]
lea r8, [0x1401fde50]
mov edx, 0x2f
mov r9, rax
mov rcx, qword [rcx + 0x38]
call fcn.140023320
test sil, 1
je 0x1400b37fc
lea rcx, [rsp + 0x20]
call fcn.140005dd0
call fcn.1400b4690
mov ecx, 0x2c9
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, qword [0x14027fe70]
cmp rcx, rbp
je 0x1400b383a
test byte [rcx + 0x44], 0x40
je 0x1400b383a
cmp byte [rcx + 0x41], 5
jb 0x1400b383a
mov rcx, qword [rcx + 0x38]
lea r8, [0x1401fde50]
mov edx, 0x2e
call fcn.14001d350
mov rcx, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
Function at 0x1400b3b70
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov esi, r8d
mov rbx, rdx
jb 0x1400b3b91
mov rcx, qword [rdx]
jmp 0x1400b3b94
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
or edi, esi
mov rcx, qword [0x14027fe70]
lea rsi, [0x14027fe70]
cmp rcx, rsi
je 0x1400b3bd5
test byte [rcx + 0x44], 0x40
je 0x1400b3bd5
cmp byte [rcx + 0x41], 4
jb 0x1400b3bd5
mov rcx, qword [rcx + 0x38]
lea r8, [0x1401fde50]
mov edx, 0x17
mov r9d, edi
call fcn.14001ef30
cmp qword [rbx + 0x18], 8
jb 0x1400b3be1
mov rcx, qword [rbx]
jmp 0x1400b3be4
mov rcx, rbx
mov edx, edi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
test eax, eax
jne 0x1400b3c4e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [0x14027fe70]
cmp rcx, rsi
je 0x1400b3c39
test byte [rcx + 0x44], 0x40
je 0x1400b3c39
cmp byte [rcx + 0x41], 2
jb 0x1400b3c39
cmp qword [rbx + 0x18], 8
jb 0x1400b3c18
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x1401fde50]
mov dword [rsp + 0x28], eax
mov edx, 0x18
mov r9d, edi
mov qword [rsp + 0x20], rbx
call fcn.1400b4450
mov eax, 0x3eb
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b7ec0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x14027ef78]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea rax, [0x14027fe70]
mov rcx, qword [0x14027fe70]
cmp rcx, rax
je 0x1400b7f2a
test dword [rcx + 0x44], 0x8000
je 0x1400b7f2a
cmp byte [rcx + 0x41], 4
jb 0x1400b7f2a
mov edx, 0x11
mov r9d, dword [rbx + 0x58]
lea r8, [0x140200b38]
mov rcx, qword [rcx + 0x38]
call fcn.14001f1d0
lea rcx, [rbx + 0x30]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov byte [rsp + 0x38], 1
mov eax, dword [rbx + 0x20]
cmp eax, 4
je 0x1400b7f50
mov edi, 0x139f
jmp 0x1400b7fed
mov dword [rbx + 0x20], 1
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1400b7f70
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x1400b7fed
xor edi, edi
cmp qword [rbx + 0x18], rdi
je 0x1400b7fed
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rcx, qword [0x140285e30]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdx, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], dil
mov r9d, 0xb8
lea r8, str.ServiceThread::resume
lea rcx, [rsp + 0x48]
call fcn.14006d3e0
mov rcx, qword [rbx + 0x18]
call fcn.1400b8020
mov qword [rbx + 0x18], rdi
cmp byte [rsp + 0x50], dil
jne 0x1400b7fed
lea rcx, [rsp + 0x48]
call fcn.14006de80
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14017e000
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x1400b80c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx esi, dl
mov rcx, qword [rcx + 0x60]
add rcx, 0xa0
call fcn.1400a76c0
mov edi, eax
test eax, eax
je 0x140085b71
mov rcx, qword [0x14027fe70]
lea rdx, [0x14027fe70]
cmp rcx, rdx
je 0x140085b5f
test byte [rcx + 0x44], 4
je 0x140085b5f
cmp byte [rcx + 0x41], 2
jb 0x140085b5f
mov edx, 0x2d
mov rcx, qword [rcx + 0x38]
lea r8, [0x1401f88f0]
call fcn.14001d350
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x60]
mov ecx, dword [rax + 0xac]
cmp ecx, 2
je 0x140085bd8
mov rcx, qword [rbx + 0x60]
add rcx, 0xa0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, eax
test eax, eax
je 0x140085bbd
mov rcx, qword [0x14027fe70]
lea rdx, [0x14027fe70]
cmp rcx, rdx
je 0x140085b5f
test byte [rcx + 0x44], 4
je 0x140085b5f
cmp byte [rcx + 0x41], 2
jb 0x140085b5f
mov edx, 0x2e
jmp 0x140085b4f
movzx edx, sil
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp method.ServiceThread.virtual_16
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx ebp, dl
mov rbx, rcx
mov rcx, qword [0x14027fe70]
lea rax, [0x14027fe70]
cmp rcx, rax
je 0x1400b8115
test dword [rcx + 0x44], 0x8000
je 0x1400b8115
cmp byte [rcx + 0x41], 4
jb 0x1400b8115
mov r9d, dword [rbx + 0x58]
lea r8, [0x140200b38]
mov rcx, qword [rcx + 0x38]
mov edx, 0x12
call fcn.14001f1d0
lea rcx, [rbx + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov eax, dword [rbx + 0x20]
cmp eax, 3
je 0x1400b812e
mov edi, 0x139f
jmp 0x1400b8183
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
movzx eax, bpl
lea r8, [0x1400b7940]
neg al
mov r9, rbx
sbb ecx, ecx
xor edi, edi
and ecx, 4
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ecx
xor edx, edx
xor ecx, ecx
call fcn.1401a6150
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400b8170
lea edi, [rax + 0x6f]
jmp 0x1400b8183
test bpl, bpl
mov edx, 1
mov eax, 4
cmovne edx, eax
mov dword [rbx + 0x20], edx
lea rcx, [rbx + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b8540
Capabilities:
Suspend thread

Disassembly:
push rbx
sub rsp, 0x90
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14027ef78]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
lea rax, [0x14027fe70]
mov rcx, qword [0x14027fe70]
cmp rcx, rax
je 0x1400b85a2
test dword [rcx + 0x44], 0x8000
je 0x1400b85a2
cmp byte [rcx + 0x41], 4
jb 0x1400b85a2
mov edx, 0x10
mov r9d, dword [rbx + 0x58]
lea r8, [0x140200b38]
mov rcx, qword [rcx + 0x38]
call fcn.14001f1d0
lea rcx, [rbx + 0x30]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov byte [rsp + 0x38], 1
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rcx, qword [0x140285e30]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdx, rax
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov r9d, 0x89
lea r8, str.ServiceThread::suspend
lea rcx, [rsp + 0x48]
call fcn.14006d3e0
nop
mov rcx, qword [rbx + 0x10]
call fcn.1400b86c0
mov qword [rbx + 0x18], rax
mov eax, dword [rbx + 0x20]
cmp eax, 1
je 0x1400b8629
mov ebx, 0x139f
jmp 0x1400b8679
mov dword [rbx + 0x20], 4
mov rcx, qword [0x140285e30]
mov rax, qword [rcx]
call qword [rax + 0x28]
lea rcx, [rax + 0x10]
call fcn.14002bbe0
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SuspendThread]
mov ebx, eax
mov rcx, qword [0x140285e30]
mov rdx, qword [rcx]
call qword [rdx + 0x28]
lea rcx, [rax + 0x10]
call fcn.14002bc00
cmp ebx, 0xffffffff
jne 0x1400b8677
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x1400b8679
xor ebx, ebx
cmp byte [rsp + 0x50], 0
jne 0x1400b868b
lea rcx, [rsp + 0x48]
call fcn.14006de80
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14017e000
add rsp, 0x90
pop rbx
ret
Function at 0x1400d8830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r13, rcx
mov r15d, edx
mov r12d, r9d
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r8d, dword [r11 + 0x30]
mov ecx, r8d
mov r10, qword [rax + 8]
mov r14, qword [r11]
mov dword [rsp + 0x78], r8d
movsxd rax, dword [r10 + 0x30]
cmp eax, r8d
mov qword [rsp + 0x28], rax
cmovl ecx, eax
xor ebx, ebx
imul r15, rax
mov dword [rsp + 0x70], ecx
mov rcx, rax
cmp eax, r8d
je 0x1400d8898
cmp byte [r14 + 0x11], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r15
sub rdi, rcx
test ebx, ebx
jne 0x1400d89aa
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x30], rsi
cmp rdi, r15
jge 0x1400d898c
mov rax, rdi
movsxd rbp, r8d
cqo
mov qword [rsp + 0x20], 0
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x14027d430]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x1400d8981
xor r9d, r9d
lea r8, [rsp + 0x20]
mov edx, r10d
mov rcx, r14
call qword [r14 + 0x108]
mov ebx, eax
test eax, eax
jne 0x1400d896d
mov rcx, qword [rsp + 0x20]
call fcn.1401204b0
mov ebx, eax
test eax, eax
jne 0x1400d896d
mov rax, qword [rsp + 0x20]
movsxd r8, dword [rsp + 0x70]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x28]
add rdx, qword [rsp + 0x80]
call fcn.140180560
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x1400d896d
test r12d, r12d
jne 0x1400d896d
mov rax, qword [r13 + 0x28]
mov rcx, qword [rax + 8]
mov eax, dword [rcx + 0x3c]
bswap eax
mov dword [rsi + 0x1c], eax
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400d897c
call fcn.140120400
mov r8d, dword [rsp + 0x78]
add rdi, rbp
test ebx, ebx
je 0x1400d88b3
mov rbp, qword [rsp + 0x88]
mov eax, ebx
mov rsi, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x140102450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
xor esi, esi
movsxd r11, r8d
mov r12, rdx
mov rbx, rcx
mov edi, esi
mov r13d, esi
mov r14d, esi
mov r10, r11
lea r15d, [rsi + 2]
cmp r9b, 1
jne 0x140102492
lea r8d, [rsi + 1]
jmp 0x1401024d1
movzx eax, r9b
mov edx, 3
sub edx, eax
mov r8d, r15d
movsxd rax, edx
cmp rax, r11
jge 0x1401024b9
cmp byte [rax + rcx], sil
jne 0x1401024b9
add edx, r8d
add rax, r8
cmp rax, r11
jl 0x1401024a8
cmp edx, r11d
movzx eax, r9b
movsxd r10, edx
setl r14b
and eax, 1
add rcx, rax
xor r10, 1
lea r9, [rbx + r10]
cmp rcx, r9
jae 0x140102515
lea rdx, [0x140203920]
movzx eax, byte [rcx]
test byte [rax + rdx], 1
je 0x1401024f7
mov eax, r8d
add rcx, rax
cmp rcx, r9
jb 0x1401024e1
jmp 0x140102515
cmp rcx, r9
jae 0x140102515
movzx eax, byte [rcx]
cmp al, 0x2d
jne 0x14010250b
mov r13d, 1
jmp 0x14010250f
cmp al, 0x2b
jne 0x140102515
mov eax, r8d
add rcx, rax
mov rbp, rcx
cmp rcx, r9
jae 0x140102530
nop dword [rax]
cmp byte [rcx], 0x30
jne 0x140102530
mov eax, r8d
add rcx, rax
cmp rcx, r9
jb 0x140102520
mov r10d, esi
cmp rcx, r9
jae 0x14010258c
mov esi, r8d
mov rbx, rcx
nop
movsx r11, byte [rbx]
lea eax, [r11 - 0x30]
cmp eax, 9
ja 0x14010256a
lea rdx, [rdi - 6]
add r10d, r8d
lea rdx, [rdi + rdx*4]
add rbx, rsi
lea rdi, [r11 + rdx*2]
movsxd rdx, r10d
add rdx, rcx
cmp rdx, r9
jb 0x140102540
movabs rdx, 0x7fffffffffffffff
xor esi, esi
cmp rdi, rdx
jbe 0x14010258c
test r13d, r13d
mov eax, esi
setne al
add rax, rdx
mov qword [r12], rax
jmp 0x140102598
test r13d, r13d
je 0x140102594
neg rdi
mov qword [r12], rdi
movsxd rdx, r10d
add rdx, rcx
cmp rdx, r9
jb 0x14010261d
test r10d, r10d
jne 0x1401025ad
cmp rbp, rcx
je 0x14010261d
imul eax, r8d, 0x13
cmp r10d, eax
jg 0x14010261d
test r14d, r14d
jne 0x14010261d
cmp r10d, eax
jge 0x1401025c4
xor eax, eax
jmp 0x140102622
mov eax, esi
lea r10, str.922337203685477580
mov r9d, esi
mov r11d, esi
cmp r9d, 0x12
jge 0x1401025f8
movsxd rax, r11d
inc r9d
add r11d, r8d
movsx edx, byte [rax + rcx]
movsx eax, byte [r10]
inc r10
sub edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
je 0x1401025d3
jmp 0x140102609
test eax, eax
jne 0x14010260b
lea eax, [r8 + r8*8]
add eax, eax
movsx eax, byte [rax + rcx]
sub eax, 0x38
test eax, eax
js 0x1401025c0
test eax, eax
jg 0x14010261d
test r13d, r13d
cmovne r15d, esi
mov eax, r15d
jmp 0x140102622
mov eax, 1
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1401077c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x14027ef78]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx]
mov r13, r9
movsxd r10, edx
mov r12, r8
shl r10, 5
mov r15, rcx
mov r14d, 1
mov rdx, qword [rax + 0x20]
mov rsi, qword [r10 + rdx]
mov r9d, r14d
lea r8, str.sqlite_stat_d
lea rdx, [rsp + 0x38]
mov ecx, 0x18
call fcn.1400cfde0
mov rbp, qword [r15]
lea rdi, [rsp + 0x38]
xor ebx, ebx
cmp dword [rbp + 0x28], ebx
jle 0x1401078d6
nop dword [rax]
mov r9d, ebx
cmp ebx, 2
jge 0x14010783c
xor r9d, 1
test rsi, rsi
je 0x14010789a
mov rax, qword [rbp + 0x20]
lea r11, [0x140203820]
movzx edx, byte [rsi]
mov r8, rsi
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax]
movzx ecx, byte [rdx + r11]
movzx eax, byte [r10]
movzx eax, byte [rax + r11]
sub ecx, eax
jne 0x1401078cb
movzx eax, dl
sub r10, rsi
test al, al
je 0x140107896
movzx ecx, byte [r10 + r8 + 1]
inc r8
movzx edx, byte [rcx + r11]
movzx eax, byte [r8]
movzx ecx, byte [rax + r11]
sub ecx, edx
je 0x140107875
jmp 0x1401078cb
test ecx, ecx
jne 0x1401078cb
mov rax, qword [rbp + 0x20]
lea r8, [rsp + 0x30]
movsxd rcx, r9d
mov rdx, rdi
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.1400e8a50
test rax, rax
je 0x1401078cb
cmp qword [rax + 0x10], 0
jne 0x14010797f
inc ebx
cmp ebx, dword [rbp + 0x28]
jl 0x140107830
movzx edx, byte [rdi]
lea rbx, [0x140203820]
cmp byte [rdx + rbx], 0x73
jne 0x1401079a0
lea r8, str.sqlite_master
sub r8, rdi
test dl, dl
je 0x140107915
movzx eax, byte [r8 + rdi + 1]
inc rdi
movzx ecx, byte [rax + rbx]
movzx edx, byte [rdi]
movzx eax, byte [rdx + rbx]
cmp eax, ecx
je 0x1401078f4
jmp 0x1401079a0
mov rax, qword [rbp + 0x20]
mov r9, qword [rax + 0x20]
test rsi, rsi
jne 0x140107929
neg r9
sbb eax, eax
jmp 0x14010796f
test r9, r9
je 0x1401079a0
movzx eax, byte [r9]
mov rdx, rsi
movzx r8d, byte [rsi]
movzx ecx, byte [rax + rbx]
movzx eax, byte [r8 + rbx]
sub eax, ecx
jne 0x14010796f
sub r9, rsi
nop dword [rax]
test r8b, r8b
je 0x14010796f
movzx eax, byte [r9 + rdx + 1]
inc rdx
movzx ecx, byte [rax + rbx]
movzx r8d, byte [rdx]
movzx eax, byte [r8 + rbx]
sub eax, ecx
je 0x140107950
test eax, eax
jne 0x1401079a0
lea rdi, str.sqlite_temp_master
jmp 0x140107822
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x38]
mov r8, rsi
mov qword [rsp + 0x20], r12
lea rdx, str.DELETE_FROM__Q._s_WHERE__s_Q
mov rcx, r15
call fcn.14011e010
inc r14d
cmp r14d, 4
jle 0x140107801
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14017e000
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401118d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x20
mov r9d, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140111a7d
test rdx, rdx
je 0x140111a7d
mov eax, dword [rcx + 4]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov esi, dword [rdx + 4]
mov ebp, esi
or ebp, eax
bt ebp, 0xa
jae 0x140111930
and esi, eax
bt esi, 0xa
jae 0x1401119af
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1401119af
xor eax, eax
jmp 0x140111973
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x140111988
cmp r8b, 0x35
jne 0x140111955
mov rcx, qword [rcx + 0x10]
mov r8d, r9d
call fcn.1401118d0
cmp eax, 2
jl 0x14011196e
mov r9d, dword [rsp + 0x40]
cmp byte [rbx], 0x35
jne 0x1401119af
mov rdx, qword [rbx + 0x10]
mov r8d, r9d
mov rcx, rdi
call fcn.1401118d0
cmp eax, 2
jge 0x1401119af
mov eax, 1
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea eax, [r8 + 0x68]
test al, 0xfd
je 0x1401119ea
mov rax, qword [rcx + 8]
test rax, rax
je 0x1401119ea
cmp r8b, 0x97
jne 0x1401119b6
mov rdx, qword [rdx + 8]
mov rcx, rax
call fcn.14012cc10
test eax, eax
je 0x1401119e5
mov eax, 2
jmp 0x140111973
mov r10, qword [rdx + 8]
sub r10, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x1401119d3
inc rax
test ecx, ecx
jne 0x1401119c0
test edx, edx
je 0x1401119ea
xor ecx, ecx
cmp r8b, 0x35
setne cl
lea eax, [rcx + 1]
jmp 0x140111973
mov r9d, dword [rsp + 0x40]
xor esi, dword [rdi + 4]
test sil, 0x10
jne 0x1401119af
bt ebp, 0xe
jb 0x140111a76
bt ebp, 0xb
jb 0x1401119af
mov rdx, qword [rbx + 0x10]
mov r8d, r9d
mov rcx, qword [rdi + 0x10]
call fcn.1401118d0
test eax, eax
jne 0x1401119af
mov esi, dword [rsp + 0x40]
mov r8d, esi
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.1401118d0
test eax, eax
jne 0x1401119af
mov rdx, qword [rbx + 0x20]
mov r8d, esi
mov rcx, qword [rdi + 0x20]
call fcn.140112ba0
test eax, eax
jne 0x1401119af
bt ebp, 0xd
jb 0x140111a76
cmp byte [rdi], 0x61
je 0x140111a76
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x1401119af
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x140111a76
cmp ecx, esi
jne 0x1401119af
test eax, eax
jns 0x1401119af
xor eax, eax
jmp 0x140111973
xor ecx, ecx
mov eax, 2
cmp rbx, rdi
mov rbx, qword [rsp + 0x48]
cmove eax, ecx
add rsp, 0x20
pop rdi
ret