joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d760
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53d956
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rcx
call fcn.005383a0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x18]
lea rdi, [rsi - 1]
nop
cmp rdx, rdi
jb 0x53d94d
mov r8, qword [rsp + 0x20]
lea rax, [r8 - 1]
cmp rdi, rax
jb 0x53d945
sub rsi, r8
sub rdx, r8
inc rdx
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
lea rdx, [rbx + rax]
test rsi, rsi
jbe 0x53d93b
movzx r8d, byte [rbx + rax]
cmp r8b, 0x66
ja 0x53d841
cmp r8b, 0x22
je 0x53d7fa
cmp r8b, 0x66
je 0x53d851
jmp 0x53d877
nop
mov rax, rdx
mov rbx, rsi
mov rcx, rdi
call fcn.0053da00
mov byte [rsp + 0x1f], dil
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044ee60
movzx edx, byte [rsp + 0x1f]
test dl, dl
je 0x53d928
call fcn.0040bc40
mov rbx, rax
lea rax, [0x009e4c00]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp r8b, 0x6e
je 0x53d907
cmp r8b, 0x74
jne 0x53d877
cmp r8b, 0x74
sete cl
movzx ecx, cl
lea rdx, [0x00942d00]
lea rbx, [rdx + rcx*8]
lea rax, [0x009dd180]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp r8b, 0x2d
je 0x53d88b
lea edi, [r8 - 0x30]
cmp dil, 9
ja 0x53d915
xor eax, eax
mov rbx, rdx
mov rcx, rsi
call fcn.0044ee60
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x48]
call fcn.0053b0a0
test rcx, rcx
je 0x53d8fd
nop
mov rdx, qword [rsp + 0x48]
cmp qword [rdx + 0x70], 0
jne 0x53d8fd
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rax, rdx
mov rbx, rcx
mov rcx, rdi
call fcn.00537fe0
mov rdx, qword [rsp + 0x48]
mov qword [rdx + 0x70], rax
cmp dword [0x011546d0], 0
jne 0x53d8ea
mov qword [rdx + 0x78], rbx
jmp 0x53d8f3
lea rdi, [rdx + 0x78]
call fcn.00465800
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db4740]
call fcn.004373c0
lea rax, [0x009e4c00]
lea rbx, [0x00db4740]
call fcn.004373c0
xor eax, eax
mov rcx, rsi
call fcn.00465b60
mov rcx, rdi
call fcn.00465c20
mov rcx, rdi
call fcn.00465be0
nop
mov qword [rsp + 8], rax
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.0053d760
Function at 0x5435c0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5436f1
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
nop dword [rax]
test rbx, rbx
je 0x5435f3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
xor ecx, ecx
jmp 0x54360e
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
cmp rbx, rcx
jle 0x5436e2
movzx edx, byte [rax + rcx]
nop dword [rax + rax]
cmp edx, 0x80
jge 0x54362e
lea rsi, [rcx + 1]
jmp 0x543638
call fcn.0045cfe0
mov edx, eax
mov rsi, rbx
mov dword [rsp + 0x1c], edx
mov qword [rsp + 0x20], rsi
lea rax, [0x00acc6eb]
mov ebx, 0x1c
mov ecx, edx
call fcn.0050a580
test rax, rax
jge 0x5435ff
mov ebx, dword [rsp + 0x1c]
nop dword [rax]
cmp ebx, 0xff
ja 0x54367e
movzx edx, bl
lea rsi, [0x00935500]
movzx edx, byte [rsi + rdx]
test dl, 0x60
setne dl
jmp 0x543697
mov rax, qword [0x00977198]
call fcn.0047e560
mov ebx, dword [rsp + 0x1c]
lea rsi, [0x00935500]
mov edx, eax
test dl, dl
jne 0x5435ff
nop
cmp ebx, 0xff
jg 0x5436b9
cmp ebx, 0x30
jl 0x5436b5
cmp ebx, 0x39
setle dl
jmp 0x5436ce
xor edx, edx
jmp 0x5436ce
mov rax, qword [0x00977018]
call fcn.0047e560
lea rsi, [0x00935500]
mov edx, eax
test dl, dl
jne 0x5435ff
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, 1
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005435c0

Function at 0x5470e0
Capabilities:
Get geographical location

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5471c3
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x28], 0
nop dword [rax]
jne 0x5471b4
cmp byte [rax + 8], 0
jne 0x5471a5
mov qword [rsp + 0x20], rax
mov rdx, qword [rax]
mov rcx, qword [rdx]
mov ebx, 0x20
call rcx
mov rcx, qword [rsp + 0x20]
cmp byte [rcx + 8], 0
jne 0x547196
cmp qword [rcx + 0x28], 0
jne 0x547187
lea rax, [0x00a47060]
nop dword [rax + rax]
call fcn.0040e6a0
mov qword [rax + 8], 0x1c
lea rcx, [0x00acd593]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x38]
mov qword [rax + 0x10], rdx
lea rdx, [0x00dbe580]
mov qword [rcx + 0x28], rdx
cmp dword [0x011546d0], 0
jne 0x54717e
mov qword [rcx + 0x30], rax
jmp 0x547187
lea rdi, [rcx + 0x30]
call fcn.004656c0
mov eax, 0xb
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov eax, 0xa
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov eax, 0xa
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov eax, 0xb
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
call fcn.00463440
mov rax, qword [rsp + 8]
jmp fcn.005470e0
Function at 0x562ac0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x562bf0
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x562bdc
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
lea rax, [0x00a8a8e0]
nop dword [rax]
call fcn.0040e6a0
mov qword [rsp + 0x20], rax
cmp dword [0x011546d0], 0
jne 0x562b42
movups xmmword [rax], xmm15
lea rdx, [rax + 0x10]
movups xmmword [rdx], xmm15
lea rdx, [rax + 0x20]
movups xmmword [rdx], xmm15
lea rdx, [rax + 0x30]
movups xmmword [rdx], xmm15
mov rdx, qword [rsp + 0x38]
mov qword [rax], rdx
mov rbx, qword [rsp + 0x40]
mov qword [rax + 8], rbx
jmp 0x562b7e
mov rbx, rax
lea rax, [0x00a8a8e0]
call fcn.00414cc0
mov rdi, qword [rsp + 0x20]
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.004656c0
lea rcx, [rdi + 8]
mov rdi, rcx
mov rbx, qword [rsp + 0x40]
call fcn.00465800
mov rdx, rax
mov rax, qword [rsp + 0x20]
lea rcx, [0x00dc4990]
mov rdi, rax
mov rax, rdx
call fcn.00562c80
lea rax, [0x00a3d400]
call fcn.0040e6a0
lea rdx, [0x00562c20]
mov qword [rax], rdx
cmp dword [0x011546d0], 0
jne 0x562bba
mov rbx, qword [rsp + 0x20]
mov qword [rax + 8], rbx
jmp 0x562bc8
lea rdi, [rax + 8]
mov rbx, qword [rsp + 0x20]
call fcn.00465800
mov rcx, rax
lea rax, [0x00dc8f38]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db4400]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00562ac0
Function at 0x563740
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x5639bf
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rdi
test rcx, rcx
je 0x5639ab
mov byte [rsp + 0xb0], bl
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xb8], rcx
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx + 0x10], esi
sete sil
lea rax, [rdx + 0x10]
mov qword [rsp + 0x20], rax
test sil, sil
jne 0x5637ea
nop
call fcn.0047c400
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xa8]
movzx ebx, byte [rsp + 0xb0]
mov rdi, qword [rsp + 0xc0]
cmp qword [rdx + 0x30], 0
jne 0x5638c7
mov qword [rdx + 0x30], rcx
cmp dword [0x011546d0], 0
jne 0x563808
mov qword [rdx + 0x38], rdi
jmp 0x56381a
lea rsi, [rdx + 0x38]
mov r8, rdi
mov rdi, rsi
call fcn.00465840
mov rdi, r8
movups xmmword [rsp + 0x28], xmm15
mov rsi, qword [rdx + 0x18]
test rsi, rsi
je 0x563842
mov r8, rsi
cmp rsi, 0xffffffffffffffff
je 0x563842
mov rsi, qword [rdx + 0x20]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rsi
jmp 0x563848
movups xmmword [rsp + 0x28], xmm15
mov rsi, qword [rsp + 0x30]
lea r8, [0x009dd880]
cmp qword [rsp + 0x28], r8
je 0x563860
xor esi, esi
nop dword [rax]
test rsi, rsi
je 0x56386f
mov rax, rsi
call fcn.00406f20
jmp 0x563885
lea rax, [rdx + 0x18]
mov rcx, qword [0x010fb080]
mov rbx, r8
nop dword [rax]
call fcn.0046ba20
mov rdx, qword [rsp + 0xa8]
mov rbx, qword [rdx + 0x28]
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00465e4b
mov rbp, qword [rbp]
lea rax, [0x00a0d000]
lea rcx, [rsp + 0x38]
nop
call fcn.00410600
jmp 0x563917
nop
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
lea ebx, [rcx - 1]
test ebx, ebx
je 0x5638de
call fcn.0047c700
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rsi, qword [rdx]
mov rax, qword [rdx + 8]
mov rdx, qword [rsi + 0x20]
xor ebx, ebx
mov rcx, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
call rdx
lea rax, [rsp + 0x38]
call fcn.00410880
mov rdx, qword [rsp + 0x38]
nop dword [rax]
test rdx, rdx
jne 0x5638ee
cmp dword [0x011546d0], 0
jne 0x563942
mov rdi, qword [rsp + 0xa8]
mov qword [rdi + 0x28], 0
nop
jmp 0x563958
mov rdx, qword [rsp + 0xa8]
lea rdi, [rdx + 0x28]
xor esi, esi
call fcn.00465820
mov rdi, rdx
nop
mov edx, 0xffffffff
lock xadd dword [rdi + 0x10], edx
lea ebx, [rdx - 1]
test ebx, ebx
je 0x56397c
mov rax, qword [rsp + 0x20]
call fcn.0047c700
mov rdi, qword [rsp + 0xa8]
movzx edx, byte [rsp + 0xb0]
test dl, dl
je 0x56399b
mov rax, qword [rdi]
mov rbx, qword [rdi + 8]
lea rcx, [0x00dc4990]
call fcn.00563100
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
lea rax, [0x009e4c00]
lea rbx, [0x00db4410]
call fcn.004373c0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463440
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00563740
Function at 0x870e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movsxd rbp, dword [rdx]
mov rbx, rbp
mov r12, rcx
mov rcx, r8
movzx r8d, byte [r8]
mov r13, rdx
lea rdi, [r12 + rbp]
test r8b, r8b
je 0x870ead
mov eax, r8d
mov rsi, rcx
lea r10, [0x010ebe20]
xor edx, edx
nop word [rax + rax]
movzx r9d, al
test byte [r10 + r9], 6
jne 0x870e8f
cmp al, 0x5f
jne 0x870e9e
movzx eax, byte [rsi + 1]
add rsi, 1
add edx, 1
test al, al
jne 0x870e80
movzx eax, r8b
test byte [r10 + rax], 4
je 0x870f40
mov byte [rdi], 0x22
add ebx, 1
movzx eax, byte [rcx]
mov r8d, 1
movsxd rbp, ebx
lea rdi, [r12 + rbp]
test al, al
jne 0x870ee1
jmp 0x870f28
movzx eax, byte [rcx + 1]
add rcx, 1
mov ebx, edx
test al, al
je 0x870f0b
movsxd rbp, ebx
lea edx, [rbx + 1]
mov byte [r12 + rbp], al
movsxd rdi, edx
add rdi, r12
cmp byte [rcx], 0x22
jne 0x870ed0
add rcx, 1
mov byte [rdi], 0x22
add ebx, 2
movzx eax, byte [rcx]
movsxd rbp, ebx
lea rdi, [r12 + rbp]
test al, al
jne 0x870ede
test r8d, r8d
jne 0x870f28
mov byte [rdi], 0
mov dword [r13], ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
add ebx, 1
mov byte [rdi], 0x22
movsxd rdi, ebx
add rdi, r12
jmp 0x870f10
mov dword [rsp + 0x2c], 0x3b
cmp edx, 1
jle 0x870f80
lea r8, [rsp + 0x2c]
call fcn.00870d00
cmp dword [rsp + 0x2c], 0x3b
jne 0x870ead
cmp byte [rsi], 0
jne 0x870ead
movzx eax, byte [rcx]
test al, al
je 0x870f10
xor r8d, r8d
jmp 0x870ee1
cmp byte [rsi], 0
setne al
xor edx, 1
and edx, 1
or al, dl
jne 0x870ead
mov eax, r8d
xor r8d, r8d
jmp 0x870ee1

Function at 0x874990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edi, dword [rcx + 0x80]
movsxd rax, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rbp, rax
sub rdx, rax
shl rdx, 3
call fcn.008743f0
mov r12, rax
test rax, rax
je 0x874aa7
movsxd rdx, edi
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [r12 + rax*8]
mov eax, ebp
sub eax, edi
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sub.msvcrt.dll_memset
mov qword [rsi + 0x78], r12
cmp edi, ebp
jl 0x874a77
jmp 0x874ac0
mov rax, qword [rsi + 0x60]
test rax, rax
jle 0x874a89
mov qword [rbx], rax
mov eax, dword [rsi + 0x3c]
mov ecx, 0x200
mov dword [rbx + 0x1c], eax
call fcn.00873de0
test rax, rax
je 0x874a98
mov dword [rax], r12d
mov qword [rbx + 0x10], rax
mov rax, qword [rsi + 0x120]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x874a66
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add edi, 1
add rbx, 0x38
mov dword [rsi + 0x80], edi
cmp edi, ebp
je 0x874ac0
mov rax, qword [rsi + 0x50]
mov r12d, dword [rsi + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r12d
jne 0x874a10
mov eax, dword [rsi + 0xb8]
jmp 0x874a19
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x87b6b0
Capabilities:
Create thread

Disassembly:
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x87b6e0
mov r8d, dword [rax + 0x20]
test r8d, r8d
je 0x87b6d8
mov r8, rcx
mov rcx, qword [rax]
lea rdx, [0x0087b870]
jmp fcn.00874300
jmp fcn.0087b590
xor eax, eax
ret
Function at 0x8d52b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, dword [rdx + 8]
mov r12, rcx
mov rbx, rdx
mov edi, r8d
test eax, eax
jne 0x8d53bf
mov rsi, qword [rdx + 0x60]
test rsi, rsi
je 0x8d53bf
mov eax, dword [rcx + 0x38]
mov r13, qword [rcx + 0x10]
lea ebp, [rax + 1]
mov dword [rcx + 0x38], ebp
mov dword [rdx + 8], ebp
test r13, r13
jne 0x8d52fa
call fcn.00883f10
mov r13, rax
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x3c]
call fcn.0086ecf0
test eax, eax
jne 0x8d53d0
cmp qword [r12 + 0x10], 0
je 0x8d5327
mov rdx, qword [rsi + 0x10]
mov r8d, ebp
mov rcx, r12
call fcn.008d4430
xor r9d, r9d
mov r8d, ebp
mov edx, 0xf
mov rcx, r13
mov dword [rsp + 0x20], 0
call fcn.00883630
mov r9d, edi
mov r8d, ebp
mov edx, 0x14
mov dword [rsp + 0x20], 0
mov rcx, r13
call fcn.00883630
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x8d53bf
mov eax, dword [r12 + 0x38]
cmp qword [r12 + 0x10], 0
lea esi, [rax + 1]
mov dword [rbx + 0xc], esi
lea ebx, [rax + 2]
mov dword [r12 + 0x38], ebx
je 0x8d538c
mov r8d, esi
mov rcx, r12
call fcn.008d4430
xor r9d, r9d
mov r8d, esi
mov edx, 0xf
mov rcx, r13
mov dword [rsp + 0x20], 0
call fcn.00883630
mov dword [rsp + 0x20], esi
mov r9d, ebx
mov r8d, ebp
mov edx, 0x9f
mov rcx, r13
call fcn.00883630
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, dword [rsp + 0x3c]
mov r9d, ebp
mov edx, 0x47
mov rcx, r13
mov dword [rsp + 0x20], 0
call fcn.00883630
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x8d5470
js 0x8d535d
movzx r9d, word [rbx + 2]
movsxd rdx, eax
cmp eax, 7
jg 0x8d5490
cmp eax, 1
je 0x8d54de
mov rax, rdx
mov ecx, 0x1e
nop dword [rax]
add rax, rax
mov r8d, ecx
sub ecx, 0xa
cmp rax, 7
jbe 0x8d5420
lea r10, [0x010e56e0]
and eax, 7
movzx eax, word [r10 + rax*2]
lea r8d, [r8 + rax - 0xa]
cmp r9w, r8w
jle 0x8d535d
mov ecx, 0x1e
nop word [rax + rax]
mov eax, ecx
add rdx, rdx
lea ecx, [rax - 0xa]
cmp rdx, 7
jbe 0x8d5458
and edx, 7
movzx edx, word [r10 + rdx*2]
jmp 0x8d54ca
mov r9d, edi
xor r8d, r8d
mov edx, 0xb
mov rcx, r13
mov dword [rsp + 0x20], 0
call fcn.00883630
jmp 0x8d535d
bsr rax, rdx
mov ecx, 0x3c
xor rax, 0x3f
sub ecx, eax
shr rdx, cl
lea r8d, [rcx + rcx*4]
lea rcx, [0x010e56e0]
and edx, 7
add r8d, r8d
movzx edx, word [rcx + rdx*2]
lea eax, [r8 + 0x28]
lea r8d, [rdx + r8 + 0x1e]
cmp r9w, r8w
jle 0x8d535d
lea eax, [rax + rdx - 0xa]
or dword [rbx + 4], 0x4000
mov word [rbx + 2], ax
jmp 0x8d535d
test r9w, r9w
jle 0x8d535d
xor eax, eax
jmp 0x8d54ce
Function at 0x90f350
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov ebp, dword [rsp + 0x90]
mov byte [rcx + 0x1c], 1
mov esi, r8d
mov rbx, rdx
mov rdi, r9
mov qword [rsp + 0x28], r9
mov r9, rdx
mov r12, rcx
mov dword [rsp + 0x20], r8d
mov r8, rdx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [rsp + 0x30], ebp
call fcn.0090b5c0
test esi, esi
je 0x90f3a0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, rdi
mov r8, rbx
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, r12
mov dword [rsp + 0x90], ebp
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.0090b5c0
Function at 0x9138e0
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov esi, edx
mov r13, r8
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov rbp, r9
mov qword [rsp + 0x48], rax
movsxd rax, edx
lea rdi, [rcx + rax*8]
cmp qword [rdi + 0x28], 0
je 0x913980
mov ecx, dword [rbx + 0x40]
test ecx, ecx
je 0x913938
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rdi + 0x28]
mov r8, r13
mov edx, 1
mov rcx, r12
call fcn.0088dce0
mov rcx, r12
call fcn.008eff10
cmp eax, 0x65
je 0x9139a0
cmp eax, 0x64
je 0x9139d0
mov rcx, r12
call fcn.008cb150
mov edx, dword [rbx + 0x40]
test edx, edx
jne 0x913924
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [rsp + rax*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call fcn.0090abf0
mov qword [rdi + 0x28], rax
jmp 0x91391d
test esi, esi
lea rdx, str.__parent
mov r9, rbp
mov r8, r13
lea rax, str.__rowid
mov rcx, rbx
cmove rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call fcn.008b3120
jmp 0x91395e
xor edx, edx
mov rcx, r12
call fcn.00875ea0
mov r9, rax
cmp rbp, rax
je 0x91395e
test esi, esi
lea rdx, str.__parent
mov r8, r13
mov rcx, rbx
lea rax, str.__rowid
mov qword [rsp + 0x30], rbp
cmove rax, rdx
mov qword [rsp + 0x28], r13
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call fcn.008b3120
jmp 0x91395e
Function at 0x9290d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateEventA]
mov qword [0x011645b0], rax
test rax, rax
je 0x929105
lea rcx, [0x011645c0]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov ecx, 2
call qword [fcn.0092aef0]
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov r9, rax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop

Function at 0x929990
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0092aef0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.0092aef0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x929a00
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x01164bf4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x929ba8
mov rax, qword [0x01164bf8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x929a4c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x929ad7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x929a30
mov rcx, r12
call fcn.0092a760
mov rbp, rax
test rax, rax
je 0x929be2
mov rax, qword [0x01164bf8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.0092a890
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x01164bf8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.DLL_VirtualQuery]
test rax, rax
je 0x929bf1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x929ad0
sub eax, 4
and eax, 0xfffffffb
jne 0x929b60
add dword [0x01164bf4], 1
cmp ebx, 8
jae 0x929b08
test bl, 4
jne 0x929bb0
test ebx, ebx
je 0x929af9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x929bd0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x929af9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x929b3a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x01164bf8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x929ad0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00929990
nop dword [rax]
xor edi, edi
jmp 0x929a57
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x929af9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x929af9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00929990
mov rax, qword [0x01164bf8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00929990
nop
nop dword [rax]
Function at 0x92a3d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x01164ee0]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rbx, qword [0x01164ec0]
test rbx, rbx
je 0x92a424
mov rdi, qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x92a41b
test r12, r12
je 0x92a41b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x92a400
lea rcx, [0x01164ee0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]

Function at 0x92a760
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x010ecb90]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x92a7d9
mov rcx, r10
call fcn.0092a630
test eax, eax
je 0x92a7d9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x92a7d6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x92a7cd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x92a7d9
add r8, 0x28
cmp r8, r9
jne 0x92a7b8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret