joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800325e0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x180042d0c]
mov ebx, edi
test ecx, ecx
je 0x18003271b
mov rax, qword [0x180042d00]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180032638
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180032610
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x18003271b
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180032300
mov r8d, dword [0x180042d0c]
cmp ebx, r8d
jae 0x1800326a8
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x180042d00]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x1800326a1
mov edx, esi
mov ecx, ebx
call fcn.1800324b0
mov edi, eax
test eax, eax
jne 0x1800326a8
mov r8d, dword [0x180042d0c]
inc ebx
cmp ebx, r8d
jb 0x180032670
cmp qword [rsp + 0x20], 0
je 0x18003271b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180032707
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800326f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800326d0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180042af8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180032a90
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180042af0], ebp
je 0x180032ae7
cmp rbx, 0x20
jae 0x180032ad0
xor ecx, ecx
jmp 0x180032ad2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180042af0], ebp
jne 0x180032ac6
cmp qword [0x180042af8], r15
je 0x180032be1
test rdi, rdi
jne 0x180032b07
mov ecx, esi
call fcn.1800325e0
mov ebp, eax
jmp 0x180032be6
mov ecx, dword [0x180042d0c]
mov ebx, r15d
test ecx, ecx
je 0x180032b2f
mov r8, qword [0x180042d00]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180032b39
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180032b20
mov ebp, 4
jmp 0x180032be6
cmp ebx, 0xffffffff
je 0x180032b2f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x180032bd8
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180032300
mov edx, esi
mov ecx, ebx
call fcn.1800324b0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180032be6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180032bc2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180032bb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180032b90
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180042af8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180032be6
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x180032be6
mov ebp, 2
xchg dword [0x180042af0], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x14095c550
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14095c6d7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14095c581
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095c567
add dl, dl
jne 0x14095c58e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095c5ee
xor eax, eax
add dl, dl
jne 0x14095c59d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095c6a5
add dl, dl
jne 0x14095c5ae
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095c5bb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095c5c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095c5d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14095c5e2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14095c576
mov eax, 1
add dl, dl
jne 0x14095c5fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095c60b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095c5f3
sub eax, ebx
mov ebx, 1
jne 0x14095c644
mov ecx, 1
add dl, dl
jne 0x14095c626
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14095c633
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095c61b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095c576
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14095c660
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14095c66d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095c655
cmp eax, 0x7d00
jae 0x14095c693
cmp eax, 0x500
jb 0x14095c68e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095c576
cmp eax, 0x7f
ja 0x14095c696
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095c576
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14095c6ca
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14095c576
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004f6790]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004f67a0]
mov dword [rax], 1
mov rax, qword [0x004f67b0]
mov dword [rax], 1
mov rax, qword [0x004f6780]
mov dword [rax], 1
mov rax, qword [0x004f6660]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004f6770]
mov dword [0x00509008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x004f6720]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x004f6610]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x405d71
Capabilities:
Create directory
Timestomp file
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rsi, qword [rsp + 0xf0]
test rdx, rdx
mov r14, rcx
mov rdi, rdx
mov rbp, r8
mov ebx, r9d
je 0x405f20
mov eax, r9d
and ax, 0xf000
cmp ax, 0x4000
jne 0x405e22
mov rcx, rdx
call qword [sym.imp.msvcrt.dll__mkdir]
test eax, eax
je 0x405eca
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x11
jne 0x405f20
lea rdx, [rsp + 0x58]
mov rcx, rdi
call sym.fileStat
test eax, eax
jne 0x405f20
mov ax, word [rsp + 0x5e]
mov edx, eax
and dx, 0xf000
cmp dx, 0x4000
jne 0x405f20
xor eax, ebx
test ax, 0x1ff
je 0x405eca
and ebx, 0x1ff
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.msvcrt.dll__chmod]
test eax, eax
je 0x405eca
jmp 0x405f20
lea rdx, [0x004d4486]
mov rcx, rdi
call sym.fopen
test rax, rax
mov r13, rax
je 0x405f20
mov rcx, rbp
call sym.sqlite3_value_blob
test rax, rax
mov r12, rax
je 0x405e83
mov rcx, rbp
call sym.sqlite3_value_bytes
mov rcx, r12
mov r9, r13
mov edx, 1
movsxd r8, eax
call sym.fwrite
mov rcx, rbp
mov r12, rax
call sym.sqlite3_value_bytes
movsxd rbp, eax
cmp rbp, r12
setne r12b
movzx r12d, r12b
jmp 0x405e88
xor r12d, r12d
xor ebp, ebp
mov rcx, r13
call sym.fclose
test r12d, r12d
jne 0x405ec5
test bx, bx
je 0x405ec5
and ebx, 0x1ff
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.msvcrt.dll__chmod]
test eax, eax
mov eax, 2
jne 0x405f8a
mov rdx, rbp
mov rcx, r14
call sym.sqlite3_result_int64
jmp 0x405eca
test r12d, r12d
jmp 0x405ead
xor eax, eax
test rsi, rsi
js 0x405f8a
lea rbx, [rsp + 0x58]
lea rbp, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
movsxd rax, esi
mov rcx, rdi
movabs rdx, 0x19db1ded53e8000
imul rax, rax, 0x989680
add rax, rdx
mov qword [rsp + 0x50], rax
call sym.sqlite3_win32_utf8_to_unicode
test rax, rax
mov rsi, rax
jne 0x405f27
mov eax, 1
jmp 0x405f8a
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov qword [rsp + 0x30], 0
mov rcx, rax
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rsi
mov rbx, rax
call sym.sqlite3_free
cmp rbx, 0xffffffffffffffff
je 0x405f20
xor edx, edx
mov r8, rbp
mov rcx, rbx
lea r9, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
sete al
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x405f9c
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rcx, rdx
lea rdx, [0x004d4489]
call sym.fopen
test rax, rax
mov rbx, rax
je 0x406084
xor edx, edx
mov r8d, 2
mov rcx, rax
call sym.fseek
mov rcx, rbx
call sym.ftell
mov rcx, rbx
movsxd rsi, eax
call sym.rewind
mov rcx, rdi
call sym.sqlite3_context_db_handle
or r8d, 0xffffffff
xor edx, edx
mov rcx, rax
call sym.sqlite3_limit
cmp esi, eax
jle 0x40600e
mov edx, 0x12
mov rcx, rdi
call sym.sqlite3_result_error_code
jmp 0x406074
test esi, esi
mov ecx, 1
cmovne rcx, rsi
call sym.sqlite3_malloc64
test rax, rax
mov rbp, rax
jne 0x406030
mov rcx, rdi
call sym.sqlite3_result_error_nomem
jmp 0x406074
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call sym.fread
cmp rsi, rax
jne 0x40605f
lea r9, [sym.sqlite3_free]
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call sym.sqlite3_result_blob64
jmp 0x406074
mov rcx, rdi
mov edx, 0xa
call sym.sqlite3_result_error_code
mov rcx, rbp
call sym.sqlite3_free
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.fclose
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x40608d
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [r8]
call sym.sqlite3_value_text
test rax, rax
je 0x4060b2
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.readFileContents
add rsp, 0x20
pop rbx
ret
Function at 0x4066b3
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [rsp + 0x80]
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov ebp, edx
mov edi, ebp
call sym.sqlite3_free
mov rcx, qword [rbx + 0x20]
mov qword [rbx + 0x18], 0
mov dword [rbx + 0x10], 0
call sym.sqlite3_free
mov rcx, qword [rbx + 0x38]
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x14], 0
call sym.sqlite3_finalize
and edi, 1
mov qword [rbx + 0x38], 0
mov dword [rbx + 0x4c], 0
je 0x40674e
mov rcx, qword [rsi]
call sym.sqlite3_value_bytes
test eax, eax
mov dword [rbx + 0x10], eax
jle 0x40674e
mov rcx, qword [rsi]
call sym.sqlite3_value_text
lea rcx, [0x004d40ca]
mov rdx, rax
call sym.sqlite3_mprintf
test rax, rax
mov qword [rbx + 0x18], rax
je 0x40680f
and bpl, 2
jne 0x40675f
mov r12, qword [rbx + 0x20]
test r12, r12
jne 0x406797
jmp 0x4067b5
movsxd rdi, edi
lea rsi, [rsi + rdi*8]
mov rcx, qword [rsi]
call sym.sqlite3_value_bytes
test eax, eax
mov dword [rbx + 0x14], eax
jle 0x406754
mov rcx, qword [rsi]
call sym.sqlite3_value_text
lea rcx, [0x004d40ca]
mov rdx, rax
call sym.sqlite3_mprintf
test rax, rax
mov qword [rbx + 0x20], rax
jne 0x406754
jmp 0x40680f
cmp qword [rbx + 0x18], 0
jne 0x4067b5
movsxd rdi, dword [rbx + 0x14]
mov rsi, rdi
test edi, edi
movsxd rbp, edi
jg 0x4067d8
mov edx, esi
sub edx, ebp
mov dword [rbx + 0x10], edx
jne 0x4067f6
mov rcx, rbx
mov qword [rbx + 0x40], 0
mov dword [rbx + 0x48], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.completionNext
movsx ecx, byte [r12 + rdi - 1]
dec rdi
mov r13d, ecx
call qword [sym.imp.msvcrt.dll_isalnum]
cmp r13b, 0x5f
je 0x4067a5
test eax, eax
jne 0x4067a5
jmp 0x4067ac
lea r8, [r12 + rbp]
lea rcx, [0x004d4092]
call sym.sqlite3_mprintf
test rax, rax
mov qword [rbx + 0x18], rax
jne 0x4067b5
mov eax, 7
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x4074c1
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebx, ebx
mov r12, rdx
mov rbp, rcx
lea rdx, [0x004d4489]
call sym.fopen
test rax, rax
mov rsi, rax
je 0x4075c9
xor edx, edx
mov r8d, 2
mov rcx, rax
call sym.fseek
test eax, eax
je 0x407522
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea rdx, str.Error:__s_not_seekable_n
mov r8, rbp
mov rcx, rax
call sym.fprintf
jmp 0x407561
mov rcx, rsi
call sym.ftell
mov rcx, rsi
mov edi, eax
call sym.rewind
lea ecx, [rdi + 1]
movsxd rcx, ecx
call sym.sqlite3_malloc64
test rax, rax
mov rbx, rax
jne 0x40756b
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea rcx, str.Error:_out_of_memory_n
mov rdx, rax
call sym.fputs
mov rcx, rsi
call sym.fclose
jmp 0x4075c9
movsxd r13, edi
mov r9, rsi
mov r8d, 1
mov rdx, r13
mov rcx, rax
call sym.fread
mov rcx, rsi
mov r14, rax
call sym.fclose
dec r14
je 0x4075bb
mov rcx, rbx
xor ebx, ebx
call sym.sqlite3_free
mov ecx, 2
call qword [sym.__acrt_iob_func]
lea rdx, str.Error:_cannot_read__s_n
mov r8, rbp
mov rcx, rax
call sym.fprintf
jmp 0x4075c9
test r12, r12
mov byte [rbx + r13], 0
je 0x4075c9
mov dword [r12], edi
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x409c7f
Capabilities:
Reference sql statements

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rcx]
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rdi, qword [rsi + 0x20]
call sym.sqlite3_finalize
mov qword [rbx + 8], 0
test eax, eax
jne 0x409cdd
mov rax, qword [rsi + 0x18]
lea rdx, [rbx + 8]
mov rcx, qword [rdi + 8]
lea r9, str.SELECT__FROM_main._Q_WHERE_sample__
lea r8, [rsi + 0x10]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
call sym.idxPrintfPrepareStmt
test eax, eax
jne 0x409cdd
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.expertNext
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x409e54
Capabilities:
Create directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea eax, [rdx - 2]
mov rsi, rcx
mov r12d, edx
cmp eax, 2
mov rbp, r8
jbe 0x409e8d
lea rdx, str.wrong_number_of_arguments_to_function_writefile__
or r8d, 0xffffffff
call sym.sqlite3_result_error
jmp 0x40a022
mov rcx, qword [r8]
call sym.sqlite3_value_text
test rax, rax
mov rbx, rax
je 0x40a022
or r14, 0xffffffffffffffff
cmp r12d, 2
mov word [rsp + 0x3a], 0
je 0x409ed2
mov rcx, qword [rbp + 0x10]
call sym.sqlite3_value_int
cmp r12d, 4
mov word [rsp + 0x3a], ax
jne 0x409ed2
mov rcx, qword [rbp + 0x18]
call sym.sqlite3_value_int64
mov r14, rax
movzx eax, word [rsp + 0x3a]
mov qword [rsp + 0x20], r14
mov rdx, rbx
mov rcx, rsi
mov r8, qword [rbp + 8]
mov r9d, eax
mov dword [rsp + 0x3c], eax
call sym.writeFile
cmp eax, 1
mov r13d, eax
jne 0x409fee
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 2
jne 0x409fee
lea rcx, [0x004d40ca]
mov rdx, rbx
call sym.sqlite3_mprintf
test rax, rax
mov r15, rax
je 0x409fee
xor eax, eax
mov rdi, r15
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x58]
mov qword [rsp + 0x48], rdi
mov rdx, rcx
not rdx
lea eax, [rdx - 1]
mov dword [rsp + 0x40], eax
mov eax, 1
cdqe
cmp byte [r15 + rax], 0x2f
mov dword [rsp + 0x44], eax
lea rdi, [r15 + rax]
setne cl
cmp dword [rsp + 0x40], eax
setg dl
inc rax
test cl, dl
jne 0x409f51
mov edx, dword [rsp + 0x44]
cmp dword [rsp + 0x40], edx
je 0x409fbc
mov rdx, qword [rsp + 0x48]
mov byte [rdi], 0
mov rcx, r15
call sym.fileStat
test eax, eax
je 0x409f9a
mov rcx, r15
call qword [sym.imp.msvcrt.dll__mkdir]
test eax, eax
jmp 0x409fa7
mov ax, word [rsp + 0x5e]
and ax, 0xf000
cmp ax, 0x4000
mov eax, dword [rsp + 0x44]
setne dl
mov byte [rdi], 0x2f
movzx edx, dl
inc eax
test edx, edx
je 0x409f4f
jmp 0x409fbe
xor edx, edx
mov rcx, r15
mov dword [rsp + 0x40], edx
call sym.sqlite3_free
mov edx, dword [rsp + 0x40]
test edx, edx
jne 0x409fee
mov r9d, dword [rsp + 0x3c]
mov qword [rsp + 0x20], r14
mov rdx, rbx
mov rcx, rsi
mov r8, qword [rbp + 8]
call sym.writeFile
mov r13d, eax
cmp r12d, 2
jle 0x40a022
test r13d, r13d
je 0x40a022
mov ax, word [rsp + 0x3a]
lea rdx, str.failed_to_create_directory:__s
mov r8, rbx
and ax, 0xf000
cmp ax, 0x4000
je 0x40a019
lea rdx, str.failed_to_write_file:__s
mov rcx, rsi
call sym.ctxErrorMsg
nop
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x40ad0c
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r13, qword [rsp + 0xa0]
mov rbp, qword [rcx]
mov rsi, rcx
mov r12d, edx
call sym.dbdataResetCursor
cmp dword [rsi + 0x10], 1
je 0x40ad4d
lea rdx, str.src_shell.c
mov r8d, 0x3538
lea rcx, str.pCsr__iPgno1
call sym._assert
lea rdi, [0x004d45f9]
mov ebx, r12d
and ebx, 1
je 0x40ad74
mov rcx, qword [r13]
call sym.sqlite3_value_text
test rax, rax
mov rdi, rax
jne 0x40ad74
lea rdi, [0x004d4196]
and r12b, 2
je 0x40ad96
movsxd rbx, ebx
mov rcx, qword [r13 + rbx*8]
call sym.sqlite3_value_int
mov dword [rsi + 0x2c], 1
mov dword [rsi + 0x10], eax
jmp 0x40ae46
mov qword [rsp + 0x38], 0
mov rcx, rdi
mov r12, qword [rsi]
call sym.dbdataIsFunction
test eax, eax
jle 0x40adc1
lea rcx, str.SELECT__.s_0_
mov r8, rdi
mov edx, eax
call sym.sqlite3_mprintf
jmp 0x40add0
lea rcx, str.PRAGMA__Q.page_count
mov rdx, rdi
call sym.sqlite3_mprintf
test rax, rax
mov rbx, rax
je 0x40af4b
mov rcx, qword [r12 + 0x18]
lea r9, [rsp + 0x38]
or r8d, 0xffffffff
mov rdx, rax
mov qword [rsp + 0x20], 0
call sym.sqlite3_prepare_v2
mov rcx, rbx
mov r12d, eax
call sym.sqlite3_free
test r12d, r12d
jne 0x40ae29
mov rcx, qword [rsp + 0x38]
call sym.sqlite3_step
cmp eax, 0x64
jne 0x40ae29
mov rcx, qword [rsp + 0x38]
xor edx, edx
call sym.sqlite3_column_int
mov dword [rsi + 0x30], eax
mov rcx, qword [rsp + 0x38]
call sym.sqlite3_finalize
test r12d, r12d
mov ebx, eax
jne 0x40af7a
test eax, eax
jne 0x40af50
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x40ae5d
mov qword [rsi + 8], rax
mov qword [rbp + 0x20], 0
jmp 0x40aed6
mov rcx, rdi
call sym.dbdataIsFunction
test eax, eax
jle 0x40aeaf
lea rcx, str.SELECT__.s__2_
mov r8, rdi
mov edx, eax
call sym.sqlite3_mprintf
test rax, rax
mov r12, rax
je 0x40af4b
mov rcx, qword [rbp + 0x18]
lea r9, [rsi + 8]
or r8d, 0xffffffff
mov rdx, rax
mov qword [rsp + 0x20], 0
call sym.sqlite3_prepare_v2
mov rcx, r12
mov ebx, eax
call sym.sqlite3_free
jmp 0x40aed2
mov rcx, qword [rbp + 0x18]
lea r9, [rsi + 8]
mov qword [rsp + 0x20], 0
or r8d, 0xffffffff
lea rdx, str.SELECT_data_FROM_sqlite_dbpage____WHERE_pgno_
call sym.sqlite3_prepare_v2
mov ebx, eax
test ebx, ebx
jne 0x40af50
mov rcx, qword [rsi + 8]
or r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 1
mov qword [rsp + 0x20], r9
call sym.sqlite3_bind_text
test eax, eax
mov ebx, eax
jne 0x40af50
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x34]
mov edx, 1
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
call sym.dbdataLoadPage.isra.47
mov rdx, qword [rsp + 0x38]
test eax, eax
mov ebx, eax
jne 0x40af3d
cmp dword [rsp + 0x34], 0x3b
jle 0x40af3d
lea rcx, [rdx + 0x38]
call sym.get_uint32
mov dword [rsi + 0x70], eax
mov rcx, rdx
call sym.sqlite3_free
test ebx, ebx
je 0x40af6e
jmp 0x40af50
mov ebx, 7
mov rcx, qword [rbp + 0x18]
call sym.sqlite3_errmsg
lea rcx, [0x004d40ca]
mov rdx, rax
call sym.sqlite3_mprintf
mov qword [rbp + 0x10], rax
jmp 0x40af7f
mov rcx, rsi
call sym.dbdataNext
mov ebx, eax
jmp 0x40af7f
mov ebx, r12d
jmp 0x40af50
mov eax, ebx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x40b09d
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov esi, edx
mov rdi, rcx
mov qword [rsp + 0x28], r8
call sym.sqlite3_user_data
mov r8, qword [rsp + 0x28]
mov rbx, rax
mov rcx, qword [r8]
call sym.sqlite3_value_int64
dec esi
mov rbp, rax
je 0x40b0e8
lea rdx, str.src_shell.c
mov r8d, 0x3897
lea rcx, str.nArg1
call sym._assert
test rbp, rbp
jne 0x40b115
cmp dword [rbx + 0x60], 0
jne 0x40b0fe
mov rcx, rbx
call sym.recoverPageCount.part.50
mov rbp, rax
mov rdx, rbp
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.sqlite3_result_int64
mov rsi, qword [rbx + 0x138]
test rsi, rsi
jne 0x40b14c
mov r9, qword [rbx + 8]
lea r8, str.SELECT_data_FROM_sqlite_dbpage__Q__WHERE_pgno_
mov rcx, rbx
mov rdx, qword [rbx]
call sym.recoverPreparePrintf
test rax, rax
mov rsi, rax
mov qword [rbx + 0x138], rax
je 0x40b208
jmp 0x40b170
cmp dword [rbx + 0x60], 0
je 0x40b170
mov rdx, qword [rbx + 0x68]
test rdx, rdx
je 0x40b21f
or r8d, 0xffffffff
mov rcx, rdi
call sym.sqlite3_result_error
jmp 0x40b21f
mov r8, rbp
mov edx, 1
mov rcx, rsi
call sym.sqlite3_bind_int64
mov rcx, rsi
call sym.sqlite3_step
cmp eax, 0x64
jne 0x40b1fd
cmp dword [rbx + 0x60], 0
je 0x40b1ac
lea rdx, str.src_shell.c
mov r8d, 0x38aa
lea rcx, str.p__errCodeSQLITE_OK
call sym._assert
xor edx, edx
mov rcx, rsi
call sym.sqlite3_column_blob
xor edx, edx
mov rcx, rsi
mov r12, rax
call sym.sqlite3_column_bytes
dec rbp
mov r13d, eax
jne 0x40b1e7
cmp dword [rbx + 0x44], eax
jne 0x40b1e7
mov rcx, qword [rbx + 0x58]
movsxd r8, eax
mov rdx, r12
call sym.memcmp
test eax, eax
jne 0x40b1e7
mov r12, qword [rbx + 0x50]
mov r8d, r13d
sub r8d, dword [rbx + 0x4c]
or r9, 0xffffffffffffffff
mov rdx, r12
mov rcx, rdi
call sym.sqlite3_result_blob
mov rdx, rsi
mov rcx, rbx
call sym.recoverReset
cmp dword [rbx + 0x60], 0
jne 0x40b152
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, dword [rbx + 0x60]
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.sqlite3_result_error_code
Function at 0x40b591
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [0x00509040]
test ecx, ecx
je 0x40b5bd
mov rcx, rax
call sym.free
xor eax, eax
mov qword [0x00509040], 0
jmp 0x40b6b5
test rax, rax
jne 0x40b6b5
lea rcx, str.USERPROFILE
call sym.getenv
test rax, rax
mov qword [0x00509040], rax
jne 0x40b675
lea rcx, str.HOME
call sym.getenv
test rax, rax
mov qword [0x00509040], rax
jne 0x40b675
lea rcx, str.HOMEDRIVE
call sym.getenv
lea rcx, str.HOMEPATH
mov rbx, rax
call sym.getenv
test rbx, rbx
mov rsi, rax
je 0x40b667
test rax, rax
je 0x40b667
mov rcx, rbx
call sym.strlen30
mov rcx, rsi
mov edx, eax
call sym.strlen30
lea edi, [rdx + rax + 1]
movsxd rcx, edi
call sym.malloc
test rax, rax
mov qword [0x00509040], rax
je 0x40b6b5
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov rdx, rax
mov ecx, edi
lea r8, [0x004d5426]
call sym.sqlite3_snprintf
jmp 0x40b6ae
lea rax, [0x004d542b]
mov qword [0x00509040], rax
mov rsi, qword [0x00509040]
test rsi, rsi
je 0x40b6ae
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
mov rbx, rcx
not rbx
mov rcx, rbx
call sym.malloc
test rax, rax
je 0x40b6a7
mov rdi, rax
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
mov qword [0x00509040], rax
mov rax, qword [0x00509040]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret