joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000e2d0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov r12, rdx
mov edi, ecx
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x18000e4c4
cmp byte [0x180171924], al
mov qword [rsp + 0x40], rsi
jne 0x18000e2fe
xor esi, esi
jmp 0x18000e31a
mov ecx, 5
call qword [0x180171990]
mov rsi, rax
test rax, rax
je 0x18000e31a
mov rcx, rax
call qword [0x1801719a0]
test edi, edi
jle 0x18000e4a7
test r12, r12
je 0x18000e4a7
cmp dword [0x180180de0], 0
mov qword [rsp + 0x30], rbx
jne 0x18000e428
mov qword [rsp + 0x38], rbp
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
je 0x18000e34f
xor ebp, ebp
jmp 0x18000e38d
cmp byte [0x180171924], 0
jne 0x18000e35c
xor ebx, ebx
jmp 0x18000e378
mov ecx, 2
call qword [0x180171990]
mov rbx, rax
test rax, rax
je 0x18000e378
mov rcx, rax
call qword [0x1801719a0]
mov rbp, qword [0x1801810e8]
test rbx, rbx
je 0x18000e38d
mov rcx, rbx
call qword [0x1801719b0]
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x180180de0], xmm0
test rbp, rbp
jne 0x18000e3b4
lea r8d, [rbp + 0x2c]
lea rcx, [0x180180df0]
xor edx, edx
call fcn.18012da30
jmp 0x18000e403
mov eax, dword [0x180171ad0]
test eax, eax
je 0x18000e3f1
xor ecx, ecx
mov qword [0x180180df0], rcx
mov dword [0x180180df0], eax
mov qword [0x180180df8], rcx
mov qword [0x180180e00], rcx
mov qword [0x180180e08], rcx
mov qword [0x180180e10], rcx
mov dword [0x180180e18], ecx
jmp 0x18000e403
lea r8, [0x180180df0]
mov edx, 0x2c
mov rcx, rbp
call qword [rbp + 0x68]
mov eax, dword [0x180180e10]
mov rbp, qword [rsp + 0x38]
xor cl, cl
mov dword [0x180180e10], 0
mov byte [0x180180e60], cl
mov dword [0x180180e1c], eax
jmp 0x18000e42f
movzx ecx, byte [0x180180e60]
movzx eax, cl
lea rbx, [0x180180e20]
cmp edi, eax
jle 0x18000e483
nop dword [rax]
test cl, cl
je 0x18000e461
movzx r8d, cl
mov rdx, rbx
mov rcx, r12
call fcn.180127c70
movzx r11d, byte [0x180180e60]
sub edi, r11d
add r12, r11
inc dword [0x180180e10]
lea rdx, [0x180180de0]
mov rcx, rbx
call fcn.18000dfd0
mov cl, 0x40
mov byte [0x180180e60], cl
cmp edi, 0x40
jg 0x18000e440
movzx eax, cl
movsxd r8, edi
mov rcx, r12
sub eax, edi
movsxd rdx, eax
add rdx, rbx
call fcn.180127c70
sub byte [0x180180e60], dil
mov rbx, qword [rsp + 0x30]
jmp 0x18000e4b1
mov dword [0x180180de0], 0
test rsi, rsi
je 0x18000e4bf
mov rcx, rsi
call qword [0x1801719b0]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18004a0c0
Capabilities:
Create thread

Disassembly:
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x18004a0ec
cmp dword [rcx + 0x20], 0
je 0x18004a0e4
mov rcx, qword [rcx]
lea rdx, [0x18004a090]
mov r8, rax
jmp fcn.18000e500
mov rcx, rax
jmp fcn.180049f80
xor eax, eax
ret

Function at 0x180056360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r12
sub rsp, 0x28
mov rbx, rdx
movzx edx, byte [rdx]
mov r12, rcx
movzx eax, dl
cmp dl, 0xb0
jne 0x18005637d
movzx eax, byte [rbx + 2]
cmp al, 0xb1
jne 0x180056389
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax]
jmp 0x18005639b
cmp al, 0x8a
jne 0x180056432
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 0x20]
mov ecx, dword [rcx]
cmp ecx, 1
je 0x180056432
mov qword [rsp + 0x48], rsi
xor esi, esi
mov dword [r8], esi
cmp dl, 0x8a
jne 0x1800563ca
mov rdx, rbx
mov rcx, r12
mov rsi, qword [rsp + 0x48]
add rsp, 0x28
pop r12
pop rbx
jmp fcn.180054460
mov eax, dword [r12 + 0x38]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r13
lea edi, [rax + 1]
add eax, ecx
movsxd r13, ecx
mov dword [r12 + 0x38], eax
test ecx, ecx
jle 0x18005642e
mov qword [rsp + 0x40], rbp
mov ebp, edi
mov rdx, qword [rbx + 0x20]
mov r8d, ebp
mov rcx, r12
mov rdx, qword [rdx + rsi + 8]
call fcn.180058cd0
inc ebp
add rsi, 0x20
dec r13
jne 0x1800563f1
mov rbp, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
add rsp, 0x28
pop r12
pop rbx
ret
mov eax, edi
jmp 0x180056417
mov rdx, rbx
mov rcx, r12
add rsp, 0x28
pop r12
pop rbx
jmp fcn.180058920

Function at 0x18005b130
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov r12d, dword [rsp + 0x70]
mov ebx, r8d
mov rbp, r9
mov dword [rax - 0x18], r12d
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
mov byte [rcx + 0x1c], 1
mov dword [rax - 0x28], ebx
call fcn.180063e80
test ebx, ebx
jne 0x18005b199
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov r9, rbp
mov r8, rdi
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.180063e80
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x1800646a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov r12, rdx
mov ebx, r11d
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x1800647a9
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x20], r14
lea r14, str.main
lea r13, [0x1801439c0]
nop
mov r9d, ebx
cmp ebx, 2
jge 0x1800646ec
xor r9d, 1
mov rax, qword [rsi + 0x20]
movsxd r8, r9d
shl r8, 5
mov rbp, qword [r8 + rax + 0x18]
test rdi, rdi
je 0x180064721
mov r8, qword [r8 + rax]
mov r10, rdi
sub r10, r8
nop dword [rax + rax]
movzx ecx, byte [r8]
movzx eax, byte [r10 + r8]
cmp ecx, eax
jne 0x18006475c
test ecx, ecx
jne 0x18006476a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r12
call fcn.1800114e0
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x180064740
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x1800646e0
mov r13, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
mov rax, r11
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r13]
movzx ecx, byte [rcx + r13]
sub ecx, edx
jne 0x18006476f
inc r8
jmp 0x180064710
test r9d, r9d
jne 0x180064739
mov r9, rdi
mov r8, r14
sub r9, r14
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x180064796
test ecx, ecx
je 0x180064721
inc r8
jmp 0x180064780
movzx edx, byte [rax + r13]
movzx ecx, byte [rcx + r13]
sub ecx, edx
jne 0x180064739
inc r8
jmp 0x180064780
mov rax, r11
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800e5ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
mov r8d, ecx
cmp ecx, 0x80
jge 0x1800e5b0c
lea eax, [rcx - 0x41]
cmp eax, 0x19
ja 0x1800e5b04
lea eax, [rcx + 0x20]
add rsp, 0x20
pop rdi
ret
mov eax, ecx
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x10000
jge 0x1800e5be3
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov qword [rsp + 0x38], rsi
mov r9d, 0xa2
or r11d, 0xffffffff
lea rsi, [0x180000000]
mov r10d, ebx
nop dword [rax + rax]
lea eax, [r10 + r9]
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
movzx edx, word [rsi + rcx*4 + 0x14ab40]
cmp r8d, edx
js 0x1800e5b62
mov r11d, eax
lea r10d, [rax + 1]
jmp 0x1800e5b66
lea r9d, [rax - 1]
cmp r9d, r10d
jge 0x1800e5b40
movsxd rdx, r11d
movzx ecx, word [rsi + rdx*4 + 0x14ab40]
movzx eax, byte [rsi + rdx*4 + 0x14ab43]
add eax, ecx
cmp r8d, eax
jge 0x1800e5bb2
movzx r9d, byte [rsi + rdx*4 + 0x14ab42]
xor ecx, r8d
mov eax, r9d
and eax, 1
and eax, ecx
test al, al
jne 0x1800e5bb2
mov eax, r9d
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x14add0]
add eax, r8d
movzx r8d, ax
mov rsi, qword [rsp + 0x38]
test edi, edi
je 0x1800e5bd5
cmp edi, 2
mov ecx, r8d
sete bl
mov edx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800e54c0
mov eax, r8d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rcx - 0x10400]
cmp eax, 0x27
ja 0x1800e5b04
lea eax, [rcx + 0x28]
add rsp, 0x20
pop rdi
ret
Function at 0x1800f28b0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, qword [rdx + 0x30]
xor r15d, r15d
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov r12d, 0x64
mov rbp, rdx
mov qword [rsp + 0x70], r15
mov ebx, r15d
mov r13d, r12d
test rcx, rcx
je 0x1800f28f9
call qword [0x1801719a0]
cmp byte [rdi + 0x6f], bl
jne 0x1800f2906
mov rcx, rdi
call fcn.180023300
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180086b00
mov esi, eax
test eax, eax
jne 0x1800f293c
lea rdx, str.sqlite_stat1
mov r8, r14
mov rcx, rdi
call fcn.180063f70
mov rbx, rax
test rax, rax
je 0x1800f2939
cmp byte [rax + 0x3f], 2
jne 0x1800f293c
mov rbx, r15
cmp byte [rdi + 0x6f], r15b
jne 0x1800f294a
mov rcx, rdi
call fcn.180023370
test esi, esi
jne 0x1800f2983
test rbx, rbx
jne 0x1800f2983
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18000b400
lea r8, str.sqlite_stat1
lea rdx, str.no_such_table_column:__s._s
xor r9d, r9d
mov rcx, rdi
call fcn.18000dc70
lea esi, [rbx + 1]
mov qword [rsp + 0x70], rax
jmp 0x1800f2988
mov rax, qword [rsp + 0x70]
lea rcx, [0x180143854]
test rax, rax
mov r8, r15
cmovne r8, rcx
mov r9, rax
mov edx, esi
mov rcx, rdi
call fcn.18000ef50
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.18000b400
cmp byte [rdi + 0x67], r15b
jne 0x1800f29c2
test esi, esi
jne 0x1800f29c2
mov ebx, r15d
jmp 0x1800f29ce
mov edx, esi
mov rcx, rdi
call fcn.18000bcb0
mov ebx, eax
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800f29dd
call qword [0x1801719b0]
test ebx, ebx
je 0x1800f29f5
cmp ebx, 1
mov qword [rbp + 0x48], 0x100000
cmove ebx, r15d
jmp 0x1800f2a81
mov r8, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
lea rcx, str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
call sym.sqlite.dll_sqlite3_mprintf
mov rsi, rax
test rax, rax
jne 0x1800f2a16
lea ebx, [rax + 7]
jmp 0x1800f2a76
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r15
mov r9d, 0x80
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], r15
call fcn.180087650
mov ebx, eax
test eax, eax
jne 0x1800f2a6e
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call sym.sqlite.dll_sqlite3_step
cmp eax, r12d
jne 0x1800f2a64
xor edx, edx
mov rcx, rbx
call sym.sqlite.dll_sqlite3_column_int64
mov r13, rax
mov rcx, rbx
call sym.sqlite.dll_sqlite3_finalize
mov ebx, eax
mov rcx, rsi
call sym.sqlite.dll_sqlite3_free
cmp r13, r12
cmovg r12, r13
mov qword [rbp + 0x48], r12
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800f3090
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r12, rcx
test r8d, r8d
je 0x1800f3162
mov rdx, qword [rdx + 0x30]
lea rcx, str.PRAGMA__Q.page_size
xor esi, esi
call sym.sqlite.dll_sqlite3_mprintf
lea edi, [rsi + 7]
mov rbp, rax
test rax, rax
je 0x1800f3131
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
lea r9d, [rdi + 0x79]
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rsi
call fcn.180087650
mov edi, eax
test eax, eax
jne 0x1800f3131
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f3127
xor edx, edx
mov rcx, rdi
call sym.sqlite.dll_sqlite3_column_int
mov esi, eax
mov rcx, rdi
call sym.sqlite.dll_sqlite3_finalize
mov edi, eax
test edi, edi
jne 0x1800f314e
movzx eax, byte [rbx + 0x27]
lea ecx, [rsi - 0x40]
mov dword [rbx + 0x20], ecx
imul eax, eax, 0x33
add eax, 4
cmp eax, ecx
jge 0x1800f31b0
mov dword [rbx + 0x20], eax
jmp 0x1800f31b0
mov rcx, r12
call sym.sqlite.dll_sqlite3_errmsg
lea rcx, [0x180143854]
mov rdx, rax
jmp 0x1800f31a7
mov r8, qword [rdx + 0x38]
mov rdx, qword [rdx + 0x30]
lea rcx, str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.sqlite.dll_sqlite3_mprintf
lea r8, [rbx + 0x20]
mov rcx, r12
mov rdx, rax
mov rbp, rax
call fcn.1800f3010
mov edi, eax
test eax, eax
jne 0x1800f314e
cmp dword [rbx + 0x20], 0x1c0
jge 0x1800f31b0
mov rdx, qword [rbx + 0x38]
mov edi, 0x10b
lea rcx, str.undersize_RTree_blobs_in___q_node_
call sym.sqlite.dll_sqlite3_mprintf
mov qword [r13], rax
mov rcx, rbp
call sym.sqlite.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x1800f3b60
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov r12, r8
mov rbp, rdx
mov rdi, rcx
cmp dword [rcx + 0x40], ebx
jne 0x1800f3b9b
cmp qword [rcx + 0x20], rbx
jne 0x1800f3b9b
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
lea rdx, str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
call fcn.1800f3a50
mov qword [rdi + 0x20], rax
cmp dword [rdi + 0x40], ebx
jne 0x1800f3c63
mov rcx, qword [rdi + 0x20]
mov r8, rbp
mov edx, 1
call sym.sqlite.dll_sqlite3_bind_int64
mov rcx, qword [rdi + 0x20]
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800f3c36
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x40], rsi
xor edx, edx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r14
call sym.sqlite.dll_sqlite3_column_bytes
mov rcx, qword [rdi + 0x20]
xor edx, edx
movsxd r13, eax
call sym.sqlite.dll_sqlite3_column_blob
mov r14, rax
call sym.sqlite.dll_sqlite3_initialize
test eax, eax
jne 0x1800f3c0c
test r13d, r13d
je 0x1800f3c07
mov rcx, r13
call fcn.18000b130
mov rbx, rax
test rbx, rbx
jne 0x1800f3c15
mov dword [rdi + 0x40], 7
jmp 0x1800f3c27
mov r8, r13
mov rdx, r14
mov rcx, rbx
call fcn.180127c70
mov dword [r12], r13d
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rdi + 0x20]
call sym.sqlite.dll_sqlite3_reset
cmp dword [rdi + 0x40], 0
jne 0x1800f3c63
mov dword [rdi + 0x40], eax
test eax, eax
jne 0x1800f3c63
test rbx, rbx
jne 0x1800f3c63
lea rdx, str.Node__lld_missing_from_database
mov r8, rbp
mov rcx, rdi
call fcn.1800f3ae0
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x1800f3c80
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r13, edx
mov rbp, r9
mov rdi, qword [rcx + r13*8 + 0x28]
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
mov r12, r8
mov rbx, rcx
test rdi, rdi
jne 0x1800f3ce0
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov rdx, qword [rsp + r13*8 + 0x40]
call fcn.1800f3a50
mov rdi, rax
mov qword [rbx + r13*8 + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x1800f3d96
mov r8, r12
mov edx, 1
mov rcx, rdi
call sym.sqlite.dll_sqlite3_bind_int64
mov rcx, rdi
call sym.sqlite.dll_sqlite3_step
cmp eax, 0x65
jne 0x1800f3d38
lea rdx, str.__rowid
test r13d, r13d
lea rcx, str.__parent
cmovne rcx, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov r8, r12
call fcn.1800f3ae0
jmp 0x1800f3d85
cmp eax, 0x64
jne 0x1800f3d85
xor edx, edx
mov rcx, rdi
call sym.sqlite.dll_sqlite3_column_int64
cmp rax, rbp
je 0x1800f3d85
lea rdx, str.__rowid
test r13d, r13d
mov qword [rsp + 0x30], rbp
lea rcx, str.__parent
mov qword [rsp + 0x28], r12
mov r9, rax
cmovne rcx, rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov r8, r12
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.1800f3ae0
mov rcx, rdi
call sym.sqlite.dll_sqlite3_reset
cmp dword [rbx + 0x40], 0
jne 0x1800f3d96
mov dword [rbx + 0x40], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x1800f3f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov esi, edx
lea r8, [rsp + 0x30]
xor edi, edi
mov rdx, r9
mov rbp, r9
mov rbx, rcx
mov dword [rsp + 0x30], edi
call fcn.1800f3b60
mov rdx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800f40d4
mov ecx, dword [rsp + 0x30]
cmp ecx, 4
jge 0x1800f3f9a
mov r9d, ecx
lea rdx, str.Node__lld_is_too_small___d_bytes_
mov r8, rbp
mov rcx, rbx
call fcn.1800f3ae0
mov rdx, qword [rsp + 0x38]
jmp 0x1800f40cc
mov r8, qword [rsp + 0x80]
test r8, r8
jne 0x1800f3fd4
movzx esi, byte [rax]
movzx eax, byte [rax + 1]
shl esi, 8
add esi, eax
cmp esi, 0x28
jle 0x1800f3fd4
lea rdx, str.Rtree_depth_out_of_range___d_
mov r8d, esi
mov rcx, rbx
call fcn.1800f3ae0
mov rcx, qword [rsp + 0x38]
jmp 0x1800f40cf
movzx eax, byte [rdx + 3]
movzx ebp, byte [rdx + 2]
shl ebp, 8
add ebp, eax
mov eax, dword [rbx + 0x1c]
inc eax
imul eax, ebp
lea eax, [rax*8 + 4]
cmp eax, ecx
jle 0x1800f401c
mov r8, qword [rsp + 0x88]
mov dword [rsp + 0x20], ecx
lea rdx, str.Node__lld_is_too_small_for_cell_count_of__d___d_bytes_
mov r9d, ebp
mov rcx, rbx
call fcn.1800f3ae0
mov rdx, qword [rsp + 0x38]
jmp 0x1800f40cc
test ebp, ebp
jle 0x1800f40cc
nop word [rax + rax]
mov eax, dword [rbx + 0x1c]
mov qword [rsp + 0x20], r8
mov r8d, edi
inc eax
imul eax, edi
lea eax, [rax*8 + 4]
movsxd rcx, eax
mov rax, qword [rcx + rdx]
bswap rax
mov qword [rsp + 0x30], rax
lea rax, [rcx + rdx + 8]
mov rdx, qword [rsp + 0x88]
mov r9, rax
mov rcx, rbx
mov qword [rsp + 0x40], rax
call fcn.1800f3dc0
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x30]
mov rcx, rbx
test esi, esi
jle 0x1800f40a8
xor edx, edx
call fcn.1800f3c80
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea edx, [rsi - 1]
mov rcx, rbx
call fcn.1800f3f30
inc dword [rbx + 0x3c]
jmp 0x1800f40b5
mov edx, 1
call fcn.1800f3c80
inc dword [rbx + 0x38]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x80]
inc edi
cmp edi, ebp
jl 0x1800f4030
mov rcx, rdx
call sym.sqlite.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800f5070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
movaps xmmword [rsp + 0x30], xmm6
mov r15d, r9d
mov r12, r8
mov r14, rcx
cmp dword [r8 + 0x18], ebx
je 0x1800f50ee
mov rbx, rdx
lea eax, [rdx*8]
sar rbx, 0x20
xor ebx, eax
xor ebx, edx
xor edx, edx
mov eax, ebx
div dword [r12 + 0x34]
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ebp, ebp
xor r13d, r13d
cmp dword [r8 + 0x10], ebx
jle 0x1800f50b4
xorpd xmm6, xmm6
lea rdi, [0x180144890]
mov rax, qword [r12 + 0x28]
cmp byte [r13 + rax], 0
je 0x1800f526b
mov rcx, qword [r14 + 0x60]
lea r8, [rsp + 0x80]
mov edx, ebp
test r15d, r15d
je 0x1800f512e
call qword [r14 + 0x70]
jmp 0x1800f5132
call qword [r14 + 0x68]
test eax, eax
jne 0x1800f50c9
mov rcx, qword [rsp + 0x80]
movzx edx, word [rcx + 0x14]
mov eax, edx
and eax, 0x3f
movzx edi, byte [rax + rdi]
lea eax, [rbx*8]
xor eax, edi
xor ebx, eax
cmp edi, 1
je 0x1800f5242
cmp edi, 2
je 0x1800f51e9
cmp edi, 3
je 0x1800f518c
cmp edi, 4
je 0x1800f5185
mov rax, qword [rsp + 0x98]
mov dword [rax], 1
jmp 0x1800f5264
call sym.sqlite.dll_sqlite3_value_blob
jmp 0x1800f5191
call sym.sqlite.dll_sqlite3_value_text
mov rcx, qword [rsp + 0x80]
mov rsi, rax
call sym.sqlite.dll_sqlite3_value_bytes
test rsi, rsi
jne 0x1800f51b7
cmp edi, 4
jne 0x1800f5280
test eax, eax
jg 0x1800f5280
xor edx, edx
movsxd r8, eax
test eax, eax
jle 0x1800f5264
nop word [rax + rax]
movzx ecx, byte [rdx + rsi]
lea eax, [rbx*8]
inc rdx
xor ecx, eax
xor ebx, ecx
cmp rdx, r8
jl 0x1800f51d0
jmp 0x1800f5264
test dl, 8
je 0x1800f51ff
movsd xmm0, qword [rcx]
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f524a
test dl, 0x24
je 0x1800f521a
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rcx]
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f524a
test dl, 0x12
je 0x1800f5231
call fcn.180032ec0
movsd qword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
jmp 0x1800f524a
movsd qword [rsp + 0x20], xmm6
mov rdx, qword [rsp + 0x20]
movapd xmm0, xmm6
jmp 0x1800f524a
call sym.sqlite.dll_sqlite3_value_int64
mov rdx, rax
lea ecx, [rbx*8]
xor ecx, edx
sar rdx, 0x20
xor ecx, ebx
lea ebx, [rcx*8]
xor ebx, edx
xor ebx, ecx
lea rdi, [0x180144890]
inc ebp
inc r13
cmp ebp, dword [r12 + 0x10]
jl 0x1800f5104
jmp 0x1800f50b4
mov eax, 7
jmp 0x1800f50c9
Function at 0x1800f5390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
xor edi, edi
xor esi, esi
mov r13d, r9d
mov r11, r8
mov r12d, edx
mov rbp, rcx
cmp dword [rcx + 0x10], ebx
jle 0x1800f555b
mov qword [rsp + 0x58], r14
or r14d, 0xffffffff
nop word [rax + rax]
mov rax, qword [rbp + 0x28]
movzx ecx, byte [r11]
movzx edx, byte [rsi + rax]
test r12d, r12d
je 0x1800f53eb
test edx, edx
je 0x1800f5548
jmp 0x1800f53f3
test edx, edx
je 0x1800f553a
lea eax, [rbx*8]
inc r11
xor eax, ecx
xor ebx, eax
cmp ecx, 1
je 0x1800f54c3
cmp ecx, 2
je 0x1800f54c3
movzx eax, byte [r11]
movzx edx, al
cmp al, 0x80
jae 0x1800f5425
mov eax, 1
jmp 0x1800f548f
movzx ecx, byte [r11 + 1]
test cl, cl
js 0x1800f543a
and edx, 0x7f
mov al, 2
shl edx, 7
or edx, ecx
jmp 0x1800f548c
movzx eax, byte [r11 + 2]
shl edx, 0xe
or edx, eax
mov eax, edx
test dl, dl
js 0x1800f545d
and eax, 0x1fc07f
mov edx, ecx
and edx, 0x7f
shl edx, 7
or edx, eax
mov al, 3
jmp 0x1800f548c
movzx eax, byte [r11]
mov rcx, r11
test al, al
js 0x1800f5474
movzx edx, al
mov al, 1
mov qword [rsp + 0x50], rdx
jmp 0x1800f5483
lea rdx, [rsp + 0x50]
call fcn.180010a90
mov rdx, qword [rsp + 0x50]
mov ecx, edx
cmp rcx, rdx
cmovne edx, r14d
movzx eax, al
movzx eax, al
mov r9d, edx
xor r8d, r8d
add r11, rax
test r9, r9
jle 0x1800f54b8
movzx ecx, byte [r8 + r11]
lea eax, [rbx*8]
inc r8
xor ecx, eax
xor ebx, ecx
cmp r8, r9
jl 0x1800f54a0
movsxd rax, edx
add r11, rax
jmp 0x1800f5548
movzx eax, byte [r11 + 6]
movzx r8d, byte [r11 + 5]
movzx edx, byte [r11 + 1]
shl r8d, 8
shl edx, 8
lea ecx, [rbx*8]
or r8d, eax
movzx eax, byte [r11 + 4]
shl eax, 0x18
shl r8d, 8
or r8, rax
movzx eax, byte [r11 + 7]
or r8, rax
movzx eax, byte [r11 + 2]
or edx, eax
movzx eax, byte [r11]
shl eax, 0x18
shl edx, 8
or rdx, rax
movzx eax, byte [r11 + 3]
or rdx, rax
shl rdx, 0x20
add r8, rdx
xor ecx, r8d
xor ecx, ebx
mov rbx, r8
sar rbx, 0x20
lea eax, [rcx*8]
xor ebx, eax
xor ebx, ecx
add r11, 8
jmp 0x1800f5548
mov rcx, r11
call fcn.1800f5290
movsxd rcx, eax
add r11, rcx
inc edi
inc rsi
cmp edi, dword [rbp + 0x10]
jl 0x1800f53d0
mov r14, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
xor edx, edx
div r13d
mov eax, edx
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret