joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bdbb0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, r8
mov rsi, rdx
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x70]
mov r8d, recv
mov rdx, rax
call fcn.1400bd790
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
call sub.KERNEL32.dll_GetProcessHeap
mov edi, 0x800
mov r8d, 0x800
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400bdd89
mov rbx, rax
mov rsi, qword [rsi]
mov r15, qword [rsp + 0x70]
lea r14, [rsp + 0x30]
lea r12, [rsp + 0x34]
lea r13, [rsp + 0x58]
lea rbp, [rsp + 0x40]
jmp 0x1400bdc65
mov qword [rsp + 0x40], 0
mov r8d, 1
mov rcx, r13
mov r9, rbp
call fcn.14016c1f0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
cmp qword [rsp + 0x58], 1
je 0x1400bdd70
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov rdx, r15
xor r8d, r8d
mov r9, r12
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400bdcc5
mov edx, dword [rsp + 0x30]
cmp rdi, rdx
jae 0x1400bdc65
lea rax, [rdi + rdi]
cmp rax, rdx
cmova rdx, rax
cmp rdx, 8
mov eax, 8
cmovbe rdx, rax
test rdi, rdi
je 0x1400bdc35
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 1
jmp 0x1400bdc3e
test eax, eax
jne 0x1400bdcde
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x1400bdd13
movabs rax, 0xde00000000
jmp 0x1400bdce2
shl rax, 0x20
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], 0
mov qword [rcx], 1
test rdi, rdi
je 0x1400bdd32
call sub.KERNEL32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rbx
call fcn.14021dfcd
jmp 0x1400bdd32
mov ecx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], rcx
mov byte [rdx + 0x20], al
mov qword [rdx], 0
movabs rax, 0x8000000000000000
mov rcx, qword [rsp + 0x78]
or rcx, rax
cmp rcx, rax
je 0x1400bdd5b
call sub.KERNEL32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14021dfcd
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rdi, rdi
jne 0x1400bdd7c
call fcn.1400182c0
ud2
mov rcx, rbx
mov rdx, rdi
call fcn.1400182a0
ud2
mov ecx, 0x800
mov edx, 1
call fcn.1400182a0
ud2
Function at 0x14014aeb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, rdx
mov rdi, rcx
mov rcx, qword [0x1402cc3c8]
test rcx, rcx
je 0x14014af66
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x14014af7c
mov rcx, qword [0x1402cc3c8]
test rcx, rcx
je 0x14014afd7
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
mov rsi, qword [rax + 0x10]
cmp rsi, qword [rax + 8]
jne 0x14014af5e
mov rcx, rsi
inc rcx
je 0x14014b041
lea rax, [rsi + rsi]
cmp rax, rcx
cmova rcx, rax
cmp rcx, 4
mov eax, 4
cmova rax, rcx
mov ecx, reloc.WS2_32.dll_recv
xor r8d, r8d
mul rcx
setno r8b
shl r8, 3
test rsi, rsi
je 0x14014afe4
mov rcx, qword [rbx]
shl rsi, 4
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 8
jmp 0x14014afed
mov rcx, qword [rbx]
jmp 0x14014b020
call fcn.14014b060
mov rcx, rax
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x14014aedd
call sub.KERNEL32.dll_GetProcessHeap
mov r8d, 0x18
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14014b048
mov rbx, rax
mov qword [rax], 8
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov rcx, qword [0x1402cc3c8]
test rcx, rcx
jne 0x14014afbf
call fcn.14014b060
mov rcx, rax
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [0x1402cc3c8]
test rcx, rcx
jne 0x14014aeed
call fcn.14014b060
mov rcx, rax
jmp 0x14014aeed
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov rdx, rax
call fcn.140142a50
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
cmp qword [rsp + 0x40], 1
je 0x14014b03c
mov qword [rbx], rcx
shr rdx, 4
mov qword [rbx + 8], rdx
mov rsi, qword [rbx + 0x10]
shl rsi, 4
mov qword [rcx + rsi], rdi
mov qword [rcx + rsi + 8], r14
add qword [rbx + 0x10], 1
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
test rdx, rdx
jne 0x14014b052
call fcn.1400182c0
ud2
mov ecx, 0x18
mov edx, 8
call fcn.1400182a0
ud2
Function at 0x14014b060
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x58
lea rcx, [0x1402ceec8]
call fcn.140142200
mov rsi, qword [0x1402cc3c8]
test rsi, rsi
jne 0x14014b0ef
mov rsi, qword [0x1402cc3d0]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14014b150
mov edi, eax
test rsi, rsi
je 0x14014b0df
call sub.KERNEL32.dll_GetProcessHeap
mov r8d, 0x18
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14014b1a9
mov rcx, rax
mov qword [rax], rsi
mov qword [rax + 8], 0
mov dword [rax + 0x10], edi
mov rax, qword [0x1402cee00]
mov qword [rcx + 8], rax
lock cmpxchg qword [0x1402cee00], rcx
jne 0x14014b0d0
mov esi, edi
mov rax, rsi
xchg qword [0x1402cc3c8], rax
test edi, edi
je 0x14014b16a
mov rax, qword [0x1402cee10]
test rax, rax
je 0x14014b119
lea rcx, [0x140142370]
cmp rax, rcx
jne 0x14014b12a
mov rcx, qword [0x1402ceec8]
mov byte [rcx + 0x28], 0
call fcn.14021dffd
jmp 0x14014b13f
call fcn.140142330
lea rcx, [0x140142370]
cmp rax, rcx
je 0x14014b107
mov rax, qword [0x1402cee18]
test rax, rax
je 0x14014b149
lea rcx, [0x1402ceec8]
call rax
mov rax, rsi
add rsp, 0x58
pop rdi
pop rsi
ret
call fcn.140142390
jmp 0x14014b136
lea rcx, str.assertion_failed:_key___c::TLS_OUT_OF_INDEXES
lea r8, str._nA_
mov edx, 0x2e
call fcn.14001f9d0
ud2
lea rax, str.assertion_failed:_key___0library_std_src_syswindows_thread_local_key.rslibrary_std_src_ffic_str.rslibrary_std_srcpanicking.rs
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 0
lea rax, str.ClosedIdlecalled__Result::unwrap____on_an__Err__value
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1401433f0
ud2
mov ecx, 0x18
mov edx, 8
call fcn.1400182a0
ud2
Function at 0x140153e70
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x88
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_recv
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140153ec4
movaps xmm0, xmmword [rsp + 0x20]
mov eax, dword [0x1402cf4c0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x78], 1
movups xmmword [rax + 0x80], xmm0
add rsp, 0x88
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [0x14014b6c0]
mov qword [rsp + 0x40], rax
lea rax, [0x1402752b8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.library_std_src_syswindows_rand.rscouldnt_generate_random_bytes:
lea rcx, [rsp + 0x58]
call fcn.14014b990
ud2

Function at 0x140153f40
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
cmp rdx, 1
jne 0x140153f63
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r9
jmp 0x14015409a
mov rax, qword [0x1402cef10]
cmp rax, 3
jne 0x1401540ac
cmp dword [rdi], 1
mov ebp, 0x17
mov eax, 2
cmovne ebp, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140153fe9
cmp dword [rdi], 1
mov eax, 0x1c
mov r8d, reloc.WS2_32.dll_recv
cmove r8d, eax
add rdi, 4
mov rcx, rbx
mov rdx, rdi
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
je 0x14015405e
mov qword [rsi + 8], rbx
mov qword [rsi], 0
jmp 0x1401540a1
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x140154003
mov r14d, eax
cmp eax, 0x2726
jne 0x14015408c
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, ebp
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call sub.WS2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x140154084
mov rbx, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x140153faf
call sub.KERNEL32.dll_GetLastError
mov r14d, eax
shl r14, 0x20
xor edi, edi
mov rcx, rbx
call sub.WS2_32.dll_closesocket
jmp 0x140154092
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
mov qword [rsi], 1
mov rcx, rbx
call sub.WS2_32.dll_closesocket
jmp 0x1401540a1
call sub.WS2_32.dll_WSAGetLastError
mov r14d, eax
shl r14, 0x20
xor edi, edi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
mov qword [rsi], 1
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov byte [rsp + 0x37], 1
lea rax, [rsp + 0x37]
mov qword [rsp + 0x38], rax
lea rcx, [0x1402cef10]
lea r8, [0x1402750b0]
lea rdx, [rsp + 0x38]
call fcn.14014eb60
jmp 0x140153f74
Function at 0x1401540e0
Capabilities:
Copy file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r9
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.14014b290
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
cmp qword [rsp + 0x30], 1
jne 0x140154121
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], rsi
mov qword [rbx], 1
jmp 0x1401541e4
mov r8, qword [rsp + 0xa0]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.14014b290
mov rdi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x38]
cmp qword [rsp + 0x30], 1
jne 0x140154167
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rdi
mov qword [rbx], 1
test rsi, rsi
je 0x1401541e4
test r14, r14
jne 0x1401541cd
jmp 0x1401541e4
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x140154240]
lea r9, [rsp + 0x30]
mov rcx, r14
mov rdx, r15
call sub.KERNEL32.dll_CopyFileExW
test eax, eax
je 0x1401541f1
mov rax, qword [rsp + 0x30]
mov qword [rbx + 8], rax
mov qword [rbx], 0
test rdi, rdi
je 0x1401541c8
add rdi, rdi
je 0x1401541c8
call sub.KERNEL32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14021dfcd
test rsi, rsi
je 0x1401541e4
add rsi, rsi
je 0x1401541e4
call sub.KERNEL32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r14
call fcn.14021dfcd
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], 0
mov qword [rbx], 1
test rdi, rdi
je 0x140154157
add rdi, rdi
je 0x140154157
call sub.KERNEL32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14021dfcd
jmp 0x140154157

Function at 0x140154420
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r15, r9
mov rsi, r8
mov rbx, rdx
mov r14, rcx
call sub.KERNEL32.dll_GetProcessHeap
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14015451a
mov rdi, rax
mov qword [rax], rsi
mov qword [rax + 8], r15
add rbx, 0xfffe
and rbx, 0xffffffffffff0001
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140154530]
xor ecx, ecx
mov rdx, rbx
mov r9, rax
call sub.KERNEL32.dll_CreateThread
test rax, rax
je 0x14015449f
mov qword [r14 + 8], rax
xor eax, eax
jmp 0x14015450b
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
call qword [rax]
mov rax, qword [rdi + 8]
cmp qword [rax + 8], 0
je 0x1401544df
mov rsi, qword [rdi]
cmp qword [rax + 0x10], 0x11
jae 0x1401544cc
call sub.KERNEL32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
jmp 0x1401544da
call sub.KERNEL32.dll_GetProcessHeap
mov r8, qword [rsi - 8]
mov rcx, rax
xor edx, edx
call fcn.14021dfcd
call sub.KERNEL32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rdi
call fcn.14021dfcd
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0
mov eax, 1
mov qword [r14], rax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, reloc.WS2_32.dll_recv
mov edx, 8
call fcn.1400182a0
ud2
Function at 0x140190a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0x98]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x140190c50
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd rbp, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r14d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [r12 + 0x20]
test al, al
jne 0x140190ab2
inc dword [rbx + 0x38]
mov r15d, dword [rbx + 0x38]
jmp 0x140190ac2
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r15d, dword [rbx + rax*4 + 0xcc]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r14 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x140190aef
mov r9d, edx
mov dword [rsp + 0x20], r14d
mov edx, 0x37
mov rcx, rdi
call fcn.1401a6490
jmp 0x140190b1d
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r14d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x61
mov r9, qword [r9 + 0x68]
call fcn.1401da8f0
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x140190b61
mov edx, 5
mov rcx, rdi
call fcn.1401a6500
test eax, eax
jne 0x140190c3c
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r13d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r13d
lea ecx, [r14 + 1]
mov byte [rdx + 1], r13b
add eax, 2
mov dword [rdx + 8], eax
lea eax, [r14 - 1]
mov qword [rdx + 0x10], r13
mov word [rdx + 2], r13w
mov qword [rdx + 0x18], 0x78
mov qword [rdx + 0x20], r13
mov qword [rdx + 0x28], r13
mov qword [rdx + 0x30], 0x5b
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r13
mov qword [rdx + 0x48], 0x79
mov qword [rdx + 0x50], r13
mov qword [rdx + 0x58], r13
mov qword [rdx + 0x60], reloc.WS2_32.dll_WSACleanup
mov qword [rdx + 0x68], r13
mov qword [rdx + 0x70], r13
add dword [rdi + 0x90], 5
mov dword [rdx + 0x34], eax
mov eax, 8
mov word [rdx + 0x4a], ax
mov dword [rdx + 4], ecx
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x3c], r15d
mov dword [rdx + 0x50], r15d
mov dword [rdx + 0x54], ecx
test r15d, r15d
je 0x140190c30
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x140190c30
movzx eax, al
mov dword [rbx + rax*4 + 0xcc], r15d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140190a90
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14019f300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
sub rsp, 0x28
movzx eax, byte [rdx]
mov rbx, rdx
mov rbp, rcx
cmp al, 0xad
jne 0x14019f318
movzx eax, byte [rdx + 2]
cmp al, 0xae
jne 0x14019f322
mov rax, qword [rdx + 0x20]
jmp 0x14019f332
cmp al, 0x88
jne 0x14019f3d3
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x14019f3d3
mov qword [rsp + 0x48], rdi
xor edi, edi
mov dword [r8], edi
cmp byte [rdx], 0x88
jne 0x14019f360
mov rcx, rbp
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
pop rbp
pop rbx
jmp fcn.1401c2bc0
mov eax, dword [rbp + 0x38]
mov qword [rsp + 0x50], r14
mov r14, rcx
mov qword [rsp + 0x20], r15
lea r15d, [rax + 1]
add eax, ecx
mov dword [rbp + 0x38], eax
test ecx, ecx
jle 0x14019f3ce
mov qword [rsp + 0x40], rsi
mov esi, r15d
nop word [rax + rax]
mov rdx, qword [rbx + 0x20]
mov r8d, esi
mov rcx, rbp
mov rdx, qword [rdx + rdi + 8]
call fcn.1401c9490
inc esi
lea rdi, [rdi + 0x20]
sub r14, 1
jne 0x14019f390
mov rsi, qword [rsp + 0x40]
mov eax, r15d
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
pop rbp
pop rbx
ret
mov eax, r15d
jmp 0x14019f3b8
mov rcx, rbp
add rsp, 0x28
pop rbp
pop rbx
jmp fcn.1401cbe50
Function at 0x1401b4870
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
lea r9, str.sqlite_master
mov rdi, rdx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.1401da670
test ebx, ebx
jne 0x1401b48c4
mov r9, rdi
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.1401da670
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401cec30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x1401ced39
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x1402b3a90]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x1401cecb1
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x1401cecec
test ecx, ecx
jne 0x1401cecfa
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.1401a0d30
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x1401cecd0
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1401cec70
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x1401cecff
inc r8
jmp 0x1401ceca0
test r10d, r10d
jne 0x1401cecc9
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x1401ced25
test edx, edx
je 0x1401cecb1
inc rax
jmp 0x1401ced10
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x1401cecc9
inc rax
jmp 0x1401ced10
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14020bfb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.1401d9ec0
mov rbx, rax
test rax, rax
jne 0x14020bfee
lea eax, [rbx + 7]
jmp 0x14020c076
cmp byte [0x1402cc434], 0
je 0x14020c043
mov rax, qword [0x1402cc5b8]
test rax, rax
je 0x14020c00e
mov ecx, 0xc8
call rax
test eax, eax
jne 0x14020c043
lea rax, [rbx + 8]
mov qword [rbx + 0x10], rbp
mov qword [rsp + 0x28], rax
lea r8, [0x1401ea3b0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x18], rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x14020c058
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x14020c071
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140006b10
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x140006b40
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x140006b3f
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140006b45
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x140006b3f
mov eax, 0
jmp 0x140006b3f

Function at 0x1400071c0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140007170
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400107d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140019310
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140019310
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140010840
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140595934]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400109d0
mov rax, qword [0x140595938]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x14001088c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140010915
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140010870
mov rcx, rdi
call fcn.1400113a0
test rax, rax
mov r12, rax
je 0x140010a22
mov rax, qword [0x140595938]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.1400114e0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140595938]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140010a05
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14001090e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140010980
add dword [0x140595934], 1
cmp ebx, 8
jae 0x140010941
test bl, 4
jne 0x1400109e0
test ebx, ebx
je 0x140010936
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x1400109f4
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140010936
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x14001095a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x140595938]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001090e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400107d0
xor esi, esi
jmp 0x140010897
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140010936
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140010936
mov rax, qword [0x140595938]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.1400107d0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call fcn.1400107d0
nop
nop dword [rax]
nop word cs:[rax + rax]