joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180043390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, qword [rdx]
mov rbp, rdx
mov rsi, rcx
xor edi, edi
lea r12, [0x180000000]
nop dword [rax]
test rbx, rbx
je 0x180043450
cmp byte [rbx], 0
mov r8, rbx
je 0x1800433da
inc r8
cmp byte [r8], 0
jne 0x1800433d1
sub r8d, ebx
and r8d, 0x3fffffff
cmp qword [rsi + 0x290], 0
je 0x18004342d
xor eax, eax
mov r9d, r8d
mov r10, rbx
test r8d, r8d
jle 0x180043423
nop dword [rax + rax]
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + r12 + 0x97ae0]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x180043400
xor edx, edx
div dword [rsi + 0x280]
jmp 0x18004342f
xor edx, edx
mov r9d, edx
lea rcx, [rsi + 0x280]
mov rdx, rbx
call fcn.18000ac60
test rax, rax
je 0x18004344c
mov rdx, qword [rax + 0x10]
jmp 0x180043454
xor edx, edx
jmp 0x180043454
mov rdx, qword [rsi + 0x38]
test rdx, rdx
je 0x18004346e
movzx eax, byte [rdi + r12 + 0x98424]
dec eax
cdqe
lea rcx, [rax + rax*4]
lea rdx, [rdx + rcx*8]
cmp qword [rdx + 0x18], 0
jne 0x180043489
inc rdi
cmp rdi, 3
jl 0x1800433c0
mov eax, 1
jmp 0x1800434b2
mov rax, qword [rdx]
mov qword [rbp], rax
mov rax, qword [rdx + 8]
mov qword [rbp + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rbp + 0x10], rax
mov rax, qword [rdx + 0x18]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x180049af0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx + 8]
mov rax, rdx
test rdx, rdx
je 0x180049b10
cmp byte [rdx], 0
je 0x180049b09
inc rax
cmp byte [rax], 0
jne 0x180049b01
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x80]
mov r8d, eax
add rcx, 0x50
jmp fcn.18000ad30
Function at 0x18004a530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
sub rsp, 0x30
mov rax, qword [rcx]
xor r13d, r13d
mov rsi, rdx
test dword [rax + 0x18], 0x4000000
mov rbp, rcx
mov ebx, r13d
je 0x18004a6b1
mov r9, qword [rdx + 0x40]
test r9, r9
je 0x18004a598
mov eax, dword [r9 + 0x28]
test eax, eax
jle 0x18004a58f
lea rdx, [r9 + 0x40]
mov r8d, eax
mov ecx, dword [rdx]
cmp ecx, 0x1f
jle 0x18004a57d
or eax, 0xffffffff
jmp 0x18004a584
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 0x10
dec r8
jne 0x18004a571
mov r9, qword [r9 + 8]
test r9, r9
jne 0x18004a562
mov r10, qword [rsi + 8]
mov r8, r10
test r10, r10
jne 0x18004a5a9
mov r8d, r13d
jmp 0x18004a5c2
cmp byte [r10], r13b
je 0x18004a5b8
nop
inc r8
cmp byte [r8], r13b
jne 0x18004a5b0
sub r8d, r10d
and r8d, 0x3fffffff
mov r11, qword [rsi + 0x80]
mov qword [rsp + 0x58], rdi
cmp qword [r11 + 0x60], r13
je 0x18004a61e
mov edx, r8d
mov rdi, r10
mov r9d, r13d
test r8d, r8d
jle 0x18004a613
mov qword [rsp + 0x60], r12
lea r12, [0x180097ae0]
nop
movzx eax, byte [rdi]
dec edx
inc rdi
movzx ecx, byte [rax + r12]
lea eax, [r9*8]
xor ecx, eax
xor r9d, ecx
test edx, edx
jg 0x18004a5f0
mov r12, qword [rsp + 0x60]
xor edx, edx
mov eax, r9d
div dword [r11 + 0x50]
jmp 0x18004a621
mov edx, r13d
mov r9d, edx
lea rcx, [r11 + 0x50]
mov rdx, r10
call fcn.18000ac60
test rax, rax
je 0x18004a69c
mov rdi, qword [rax + 0x10]
test rdi, rdi
je 0x18004a69c
nop
lea r9, [rsp + 0x50]
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x20], r13
call fcn.1800486d0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x18004a693
mov eax, dword [rdx + 8]
test eax, eax
jle 0x18004a693
mov rdx, qword [rdx + 0x10]
mov r8d, eax
mov ecx, dword [rdx]
cmp ecx, 0x1f
jle 0x18004a681
or eax, 0xffffffff
jmp 0x18004a688
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 4
dec r8
jne 0x18004a675
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x18004a640
mov eax, ebx
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop rsi
pop rbp
ret
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop rsi
pop rbp
ret
Function at 0x180063e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r14, qword [rcx + 0x18]
mov r13, qword [rcx]
mov eax, r8d
mov r12, rdx
mov r15, rcx
test rdx, rdx
je 0x18006408c
mov qword [r11 - 0x28], rdi
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
xor edi, edi
nop
cmp eax, 0x63
jne 0x180063e7d
movzx edx, byte [r12 + 1]
jmp 0x180063e80
movzx edx, al
mov byte [r15 + 0x1e1], dl
movzx ecx, byte [r12]
sub ecx, 0x69
je 0x180063fb2
xor r8d, r8d
dec ecx
je 0x180063f84
dec ecx
mov rcx, r13
je 0x180063f34
mov rdx, qword [r12 + 0x10]
call fcn.1800332e0
mov word [rsp + 0x30], 4
mov qword [rsp + 0x34], 0
mov rbx, rax
mov dword [rsp + 0x3c], edi
test rax, rax
je 0x180064012
mov r9, qword [r15]
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, r15
call fcn.1800600b0
mov rdx, rbx
mov rcx, r13
call fcn.180055e40
test r13, r13
je 0x180063f27
cmp rbx, qword [r13 + 0x158]
jb 0x180063f27
cmp rbx, qword [r13 + 0x160]
jae 0x180063f27
mov rax, qword [r13 + 0x150]
mov qword [rbx], rax
dec dword [r13 + 0x144]
mov qword [r13 + 0x150], rbx
jmp 0x180064012
mov rcx, rbx
call sym.sqlite3.dll_sqlite3_free
jmp 0x180064012
mov rdx, qword [r12 + 0x28]
xor r9d, r9d
call fcn.180032980
mov rdx, qword [r12 + 0x30]
movzx edi, byte [r15 + 0x1e1]
xor r8d, r8d
mov rcx, r13
mov rsi, rax
call fcn.180032c70
mov rdx, r12
mov rcx, r15
mov rbx, rax
call fcn.180063d00
mov r9, rsi
mov r8, rbx
mov rcx, r15
mov rdx, rax
mov dword [rsp + 0x20], edi
call fcn.180064920
jmp 0x180064010
mov rdx, qword [r12 + 0x28]
xor r9d, r9d
mov rcx, r13
call fcn.180032980
mov rdx, r12
mov rcx, r15
mov rbx, rax
call fcn.180063d00
mov r8, rbx
mov rdx, rax
mov rcx, r15
call fcn.180044470
jmp 0x180064012
movzx ebp, dl
mov rdx, qword [r12 + 0x38]
mov rcx, r13
call fcn.180033150
mov rdx, qword [r12 + 0x10]
xor r8d, r8d
mov rcx, r13
mov rsi, rax
call fcn.1800332e0
mov rdx, qword [r12 + 0x30]
xor r8d, r8d
mov rcx, r13
mov rdi, rax
call fcn.180032c70
mov rdx, r12
mov rcx, r15
mov rbx, rax
call fcn.180063d00
mov r9, rdi
mov r8, rbx
mov rcx, r15
mov rdx, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rsi
call fcn.18004c850
xor edi, edi
cmp byte [r12], 0x74
je 0x180064060
movsxd rbx, dword [r14 + 0x18]
cmp dword [r14 + 0x1c], ebx
jg 0x18006402f
mov rcx, r14
call fcn.1800214d0
test eax, eax
jne 0x180064060
mov rax, qword [r14 + 0x20]
inc dword [r14 + 0x18]
lea rcx, [rbx + rbx*2]
mov byte [rax + rcx*8 + 3], 0
mov qword [rax + rcx*8 + 4], 0
mov dword [rax + rcx*8 + 0xc], edi
mov qword [rax + rcx*8 + 0x10], rdi
mov word [rax + rcx*8], 0x39
mov byte [r14 + 0xa2], 0
mov r12, qword [r12 + 0x40]
mov eax, dword [rsp + 0x80]
test r12, r12
jne 0x180063e70
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x18006b310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
xor r15d, r15d
mov rbp, r8
mov r8, rcx
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x20], r15d
mov r14d, dword [rcx]
mov r13, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov edi, r15d
mov esi, r15d
mov r12d, r15d
test r14d, r14d
jle 0x18006b4da
nop word [rax + rax]
cmp esi, dword [rbp + 8]
jg 0x18006b4cd
mov rbx, qword [r13]
cmp byte [rbx], 0x98
jne 0x18006b4cd
cmp dword [rbx + 0x30], r9d
jne 0x18006b4cd
mov rdx, rbx
mov rcx, r8
call fcn.180031a70
mov rdx, rax
test rax, rax
jne 0x18006b3ac
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x38]
cmp qword [rbp], r15
je 0x18006b3e3
cmp esi, dword [rbp + 8]
jge 0x18006b3e3
mov rax, qword [rbp + 0x10]
mov r9d, dword [rax + r12*4]
mov rax, qword [rbp + 0x20]
cmp r9d, dword [rax + 0x10]
mov eax, 0xffffffff
cmove r9d, eax
mov rax, qword [rbp + 0x48]
movzx r10d, byte [rax + r12]
mov rax, qword [rbp + 0x50]
mov r8, qword [rax + r12*8]
jmp 0x18006b3ed
mov r8, qword [rdx]
or r9d, 0xffffffff
mov r10d, r15d
movsx eax, word [rbx + 0x34]
cmp eax, r9d
jne 0x18006b497
mov rdx, qword [rdx]
lea rbx, [0x180097ae0]
movzx ecx, byte [rdx]
test cl, cl
je 0x18006b42e
nop dword [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + rbx]
cmp byte [rcx + rbx], al
jne 0x18006b42e
movzx ecx, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x18006b410
movzx eax, byte [r8]
movzx ecx, byte [rax + rbx]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbx]
cmp eax, ecx
jne 0x18006b497
movzx eax, byte [r13 + 0x18]
movsxd rcx, dword [rsp + 0x98]
xor eax, r10d
cmp r12, rcx
jle 0x18006b462
cmp eax, dword [rsp + 0x20]
jne 0x18006b511
jmp 0x18006b466
mov dword [rsp + 0x20], eax
inc edi
add r13, 0x20
test r9d, r9d
jns 0x18006b4a4
mov r9d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
mov r8d, edi
call fcn.18006b1e0
test eax, eax
jne 0x18006b4a4
mov edi, r14d
jmp 0x18006b4a4
movsxd rax, dword [rsp + 0x98]
cmp r12, rax
jge 0x18006b4c0
mov r9d, dword [rsp + 0x88]
inc esi
inc r12
cmp edi, r14d
jge 0x18006b4cd
mov r8, qword [rsp + 0x70]
jmp 0x18006b370
cmp esi, dword [rbp + 8]
jne 0x18006b511
mov r9d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x78]
cmp dword [rsp + 0x20], r15d
mov rax, qword [rsp + 0xa0]
setne r15b
mov dword [rax], r15d
cmp edi, r14d
jl 0x18006b4fa
mov eax, 1
jmp 0x18006b513
cmp byte [rbp + 0x2c], 0
je 0x18006b511
cmp esi, dword [rbp + 8]
jne 0x18006b511
mov r8d, edi
call fcn.18006b1e0
test eax, eax
je 0x18006b4f3
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18007f980
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rdi, qword [rcx + 0xd0]
xor r14d, r14d
mov r13, r9
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x70], rdi
test rdi, rdi
jne 0x18007fa29
mov r8, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
lea rcx, str.SELECT_block_FROM__Q._q_segments_WHERE_blockid___
call sym.sqlite3.dll_sqlite3_mprintf
mov rdi, rax
test rax, rax
jne 0x18007f9de
mov ebx, 7
mov eax, ebx
jmp 0x18007faf4
mov rcx, qword [rsi + 0x18]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov r9d, 1
or r8d, 0xffffffff
mov rdx, rdi
mov qword [rsp + 0x20], r14
call fcn.180055990
mov rcx, rdi
mov ebx, eax
call sym.sqlite3.dll_sqlite3_free
mov rdi, qword [rsp + 0x70]
mov qword [rsi + 0xd0], rdi
test ebx, ebx
je 0x18007fa29
mov eax, ebx
jmp 0x18007faf4
mov rcx, rdi
call sym.sqlite3.dll_sqlite3_reset
test rbp, rbp
je 0x18007faf2
mov r8, r12
mov edx, 1
mov rcx, rdi
call sym.sqlite3.dll_sqlite3_bind_int64
mov rcx, rdi
call sym.sqlite3.dll_sqlite3_step
cmp eax, 0x64
je 0x18007fa67
mov ecx, 0xb
cmp eax, 0x65
cmove eax, ecx
jmp 0x18007faf4
xor edx, edx
mov rcx, rdi
call sym.sqlite3.dll_sqlite3_column_bytes
xor edx, edx
mov rcx, rdi
mov dword [r13], eax
call sym.sqlite3.dll_sqlite3_column_blob
mov qword [rbp], rax
test rdi, rdi
je 0x18007fad3
cmp qword [rdi + 0x48], r14
je 0x18007faad
cmp r14w, word [rdi + 0x50]
jae 0x18007faad
mov rax, qword [rdi]
mov rcx, qword [rax + 0x58]
test rcx, rcx
je 0x18007faa7
call qword [0x1800ac468]
mov rax, qword [rdi + 0x48]
jmp 0x18007fada
mov rax, qword [rdi]
test rax, rax
je 0x18007fad3
mov rcx, qword [rax + 0x58]
test rcx, rcx
je 0x18007fac4
call qword [0x1800ac468]
mov rcx, qword [rdi]
xor r8d, r8d
lea edx, [r8 + 0x19]
call fcn.180009b90
lea rax, [0x180098458]
movzx ebx, byte [rax + 0x26]
mov rcx, rdi
call fcn.1800263d0
cmp ebx, 4
je 0x18007faf2
mov eax, 0xb
jmp 0x18007faf4
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800803b0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rcx + 0x78]
xor r15d, r15d
mov r13, r8
movsxd r14, edx
mov rbp, rcx
mov esi, r15d
mov edi, r15d
mov qword [rsp + 0x70], rbx
test rbx, rbx
jne 0x18008044e
mov r8, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
lea rcx, str.SELECT_coalesce_max_idx_1__0__FROM__Q._q_segdir_WHERE_level_
mov qword [rsp + 0x78], r12
call sym.sqlite3.dll_sqlite3_mprintf
mov r12, rax
test rax, rax
jne 0x18008040c
lea edi, [rbx + 7]
jmp 0x180080449
mov rcx, qword [rbp + 0x18]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov r9d, 1
or r8d, 0xffffffff
mov rdx, r12
mov qword [rsp + 0x20], r15
call fcn.180055990
mov rcx, r12
mov edi, eax
call sym.sqlite3.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
mov qword [rbp + 0x78], rbx
mov r12, qword [rsp + 0x78]
test edi, edi
jne 0x18008051f
lea edx, [rdi + 1]
mov rcx, rbx
call fcn.180026ce0
test eax, eax
jne 0x180080483
mov rcx, qword [rbx + 0x68]
mov rdx, r14
call fcn.180020280
mov r11, qword [rbx]
mov rcx, qword [r11 + 0x58]
test rcx, rcx
je 0x180080483
call qword [0x1800ac478]
mov rcx, rbx
call sym.sqlite3.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800804f7
test rbx, rbx
je 0x1800804e0
cmp qword [rbx + 0x48], rsi
je 0x1800804ba
cmp r15w, word [rbx + 0x50]
jae 0x1800804ba
mov rax, qword [rbx]
mov rcx, qword [rax + 0x58]
test rcx, rcx
je 0x1800804b4
call qword [0x1800ac468]
mov rcx, qword [rbx + 0x48]
jmp 0x1800804e7
mov rax, qword [rbx]
test rax, rax
je 0x1800804e0
mov rcx, qword [rax + 0x58]
test rcx, rcx
je 0x1800804d1
call qword [0x1800ac468]
mov rcx, qword [rbx]
xor r8d, r8d
lea edx, [r8 + 0x19]
call fcn.180009b90
lea rcx, [0x180098458]
call fcn.18001ff10
mov rcx, rbx
mov rsi, rax
call fcn.1800263d0
mov rcx, rbx
call sym.sqlite3.dll_sqlite3_reset
test eax, eax
jne 0x180080521
cmp esi, 0x10
jl 0x180080519
mov edx, r14d
mov rcx, rbp
call fcn.180083060
mov dword [r13], r15d
jmp 0x180080521
mov dword [r13], esi
jmp 0x180080521
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x180080810
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
movsxd rbx, dword [rsp + 0x90]
xor ebp, ebp
test r8, r8
mov r14, r9
mov r13, r8
mov r12d, edx
cmove ebp, ebx
mov rdi, rcx
call sym.sqlite3.dll_sqlite3_initialize
test eax, eax
jne 0x1800809d9
lea ecx, [rbp + 0x68]
call fcn.180007030
mov rsi, rax
test rax, rax
je 0x1800809d9
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x68]
call fcn.18008c4a0
mov rcx, qword [rsp + 0x80]
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], rcx
mov dword [rsi], r12d
test ebp, ebp
je 0x1800808b0
mov rdx, qword [rsp + 0x88]
lea rcx, [rsi + 0x68]
mov r8, rbx
mov qword [rsi + 0x20], rcx
mov dword [rsi + 0x28], ebx
call fcn.180087310
jmp 0x1800809b8
cmp qword [rdi + 0xd8], 0
jne 0x1800808f1
mov r8, qword [rdi + 0x28]
mov rdx, qword [rdi + 0x20]
lea rcx, str.SELECT_block_FROM__Q._q_segments_WHERE_blockid_BETWEEN___AND___ORDER_BY_blockid
call sym.sqlite3.dll_sqlite3_mprintf
mov qword [rdi + 0xd8], rax
test rax, rax
jne 0x1800808f1
mov ebx, 7
mov rdx, rsi
mov rcx, rdi
call fcn.1800807a0
mov eax, ebx
jmp 0x1800809de
mov eax, dword [rdi + 0xe0]
test eax, eax
jne 0x180080978
mov eax, dword [rdi + 0xe8]
cmp dword [rdi + 0xe4], eax
jne 0x180080931
mov rcx, qword [rdi + 0xf0]
lea ebx, [rax + 0x10]
lea edx, [rbx*8]
call sym.sqlite3.dll_sqlite3_realloc
test rax, rax
je 0x1800808da
mov dword [rdi + 0xe8], ebx
mov qword [rdi + 0xf0], rax
mov rdx, qword [rdi + 0xd8]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], 0
lea rbp, [rsi + 0x18]
mov r9d, 1
or r8d, 0xffffffff
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 0
call fcn.180055990
mov ebx, eax
test eax, eax
jne 0x1800808df
inc dword [rdi + 0xe4]
jmp 0x180080996
dec eax
lea rbp, [rsi + 0x18]
mov dword [rdi + 0xe0], eax
movsxd r8, eax
mov rax, qword [rdi + 0xf0]
mov r8, qword [rax + r8*8]
mov qword [rbp], r8
mov rcx, qword [rbp]
mov r8, r13
mov edx, 1
call sym.sqlite3.dll_sqlite3_bind_int64
mov rcx, qword [rbp]
mov r8, r14
mov edx, 2
call sym.sqlite3.dll_sqlite3_bind_int64
mov rcx, rsi
call fcn.180080540
mov ebx, eax
test eax, eax
jne 0x1800808df
mov rax, qword [rsp + 0x98]
mov qword [rax], rsi
mov eax, ebx
jmp 0x1800809de
mov eax, 7
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x180081f70
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rdi, qword [rcx + 0xa8]
xor r13d, r13d
mov r12, r8
movsxd rbp, edx
mov rsi, rcx
mov qword [rsp + 0x60], rdi
test rdi, rdi
jne 0x180082018
mov r8, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
lea rcx, str.SELECT_count___FROM__Q._q_segdir_WHERE_level___
call sym.sqlite3.dll_sqlite3_mprintf
mov rdi, rax
test rax, rax
jne 0x180081fcd
mov ebx, 7
mov eax, ebx
jmp 0x1800820c7
mov rcx, qword [rsi + 0x18]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov r9d, 1
or r8d, 0xffffffff
mov rdx, rdi
mov qword [rsp + 0x20], r13
call fcn.180055990
mov rcx, rdi
mov ebx, eax
call sym.sqlite3.dll_sqlite3_free
mov rdi, qword [rsp + 0x60]
mov qword [rsi + 0xa8], rdi
test ebx, ebx
je 0x180082018
mov eax, ebx
jmp 0x1800820c7
mov edx, 1
mov rcx, rdi
call fcn.180026ce0
test eax, eax
jne 0x180082047
mov rcx, qword [rdi + 0x68]
mov rdx, rbp
call fcn.180020280
mov r11, qword [rdi]
mov rcx, qword [r11 + 0x58]
test rcx, rcx
je 0x180082047
call qword [0x1800ac478]
mov rcx, rdi
call sym.sqlite3.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800820bf
test rdi, rdi
je 0x1800820a4
cmp qword [rdi + 0x48], r13
je 0x18008207e
cmp r13w, word [rdi + 0x50]
jae 0x18008207e
mov rax, qword [rdi]
mov rcx, qword [rax + 0x58]
test rcx, rcx
je 0x180082078
call qword [0x1800ac468]
mov rcx, qword [rdi + 0x48]
jmp 0x1800820ab
mov rax, qword [rdi]
test rax, rax
je 0x1800820a4
mov rcx, qword [rax + 0x58]
test rcx, rcx
je 0x180082095
call qword [0x1800ac468]
mov rcx, qword [rdi]
xor r8d, r8d
lea edx, [r8 + 0x19]
call fcn.180009b90
lea rcx, [0x180098458]
call fcn.18001ff10
mov rcx, rdi
mov rbx, rax
call fcn.1800263d0
mov dword [r12], ebx
mov rcx, rdi
call sym.sqlite3.dll_sqlite3_reset
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x18008f8f8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1800ac290]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18008b228
xor ebx, ebx
cmp qword [0x1800ae488], rbx
mov rdi, rax
jne 0x18008fa0b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18008fae2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18008fae2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1800ae488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1800ae490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1800ae498], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1800ae4a8], rax
test rax, rax
je 0x18008fa02
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1800ae4a0], rax
jmp 0x18008fa12
mov rax, qword [0x1800ae4a0]
jmp 0x18008fa19
mov rax, qword [0x1800ae4a0]
mov r11, qword [0x1800ae4a8]
cmp rax, rdi
je 0x18008fa80
cmp r11, rdi
je 0x18008fa80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1800ae4a8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18008fa80
test rax, rax
je 0x18008fa80
call rsi
test rax, rax
je 0x18008fa7a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18008fa7a
test byte [rsp + 0x40], 1
jne 0x18008fa80
bts ebp, 0x15
jmp 0x18008fac0
mov rcx, qword [0x1800ae490]
cmp rcx, rdi
je 0x18008fac0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18008fac0
call rax
mov rbx, rax
test rax, rax
je 0x18008fac0
mov rcx, qword [0x1800ae498]
cmp rcx, rdi
je 0x18008fac0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18008fac0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1800ae488]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18008fae2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18008fae4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18008daf0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18008fdc7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800ac290]
jne 0x18008db0a
rol rcx, 0x10
test cx, 0xffff
jne 0x18008db06
repz ret
ror rcx, 0x10
jmp 0x18008fd20
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1800ae550]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1800ae648]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18008fda5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1800ae550]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18008fdc7
mov rax, qword [rsp + 0x88]
mov qword [0x1800ae648], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800ae5e8], rax
mov rax, qword [0x1800ae648]
mov qword [0x1800ae4c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800ae5d0], rax
mov dword [0x1800ae4b0], 0xc0000409
mov dword [0x1800ae4b4], 1
mov rax, qword [0x1800ac290]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800ac298]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800ae548], eax
mov ecx, 1
call fcn.18008dad8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180096dc8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800ae548], 0
jne 0x18008fe4e
mov ecx, 1
call fcn.18008dad8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret