joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003bd40
Capabilities:
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, edx
mov rsi, rcx
mov qword [rsp + 0x40], rbx
test rcx, rcx
je 0x18003be42
test edx, edx
je 0x18003be42
call fcn.1800394b0
test eax, eax
jne 0x18003bd8f
movabs rax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.180035080
test eax, eax
jne 0x18003bdb2
lea ecx, [rax + 2]
call qword [0x18010b5d8]
mov rbx, rax
test rax, rax
je 0x18003bdb2
mov rcx, rax
call qword [0x18010b5e8]
mov rcx, qword [0x18010f390]
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x18003be1f
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x18003be14
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x18010f390]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test rbx, rbx
je 0x18003be2d
mov rcx, rbx
call qword [0x18010b5f8]
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x18004ba50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x30
mov rsi, qword [rcx + 0x10]
xor edi, edi
mov r14d, r8d
movsxd r13, edx
mov rbx, rcx
test rsi, rsi
jne 0x18004babe
call fcn.1800335e0
mov rsi, rax
mov qword [rbx + 0x10], rax
test rax, rax
je 0x18004ba9f
xor r9d, r9d
xor r8d, r8d
mov edx, 0x99
mov rcx, rax
mov dword [rsp + 0x20], edi
call fcn.180042780
cmp qword [rbx + 0x1c0], rdi
jne 0x18004bab5
mov rax, qword [rbx]
test byte [rax + 0x4c], 8
jne 0x18004bab5
mov byte [rbx + 0x23], 1
test rsi, rsi
je 0x18004bc55
movzx eax, byte [rbx + 0x1f]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r12
test al, al
jne 0x18004bad9
inc dword [rbx + 0x54]
mov r12d, dword [rbx + 0x54]
jmp 0x18004bae6
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r12d, dword [rbx + rax*4 + 0x24]
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x18004baf6
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x18004bb02
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov r9d, r12d
mov r8d, r13d
mov edx, 0x33
mov rcx, rsi
mov dword [rsp + 0x20], 2
call fcn.180042780
mov ecx, r13d
mov r8d, 1
shl r8d, cl
or dword [rsi + 0x94], r8d
cmp r13d, 1
je 0x18004bb56
mov rax, qword [rsi]
mov rdx, r13
mov rcx, qword [rax + 0x20]
shl rdx, 5
mov rax, qword [rdx + rcx + 8]
cmp byte [rax + 0x11], dil
je 0x18004bb56
or dword [rsi + 0x98], r8d
mov r9d, ebp
mov r8d, r14d
mov edx, 0x19
mov rcx, rsi
mov dword [rsp + 0x20], edi
call fcn.180042780
xor r9d, r9d
mov r8d, ebp
lea edx, [r9 + 0x53]
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.180042780
mov r14d, eax
mov rax, qword [rsi + 8]
test rax, rax
je 0x18004bb9d
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rcx + rcx*2]
mov byte [rax + rdx*8 - 0x15], 0x90
mov r9d, 2
mov r8d, r13d
mov rcx, rsi
lea edx, [r9 + 0x32]
mov dword [rsp + 0x20], ebp
call fcn.180042780
mov edx, dword [rsi + 0x3c]
cmp edx, r14d
jbe 0x18004bbca
mov rax, qword [rsi + 8]
lea rcx, [r14 + r14*2]
mov dword [rax + rcx*8 + 8], edx
mov ecx, dword [rsi + 0x3c]
mov rax, qword [rsi + 0x30]
dec ecx
mov dword [rax + 0x64], ecx
test r12d, r12d
je 0x18004bc12
movzx edx, byte [rbx + 0x1f]
cmp dl, 8
jae 0x18004bc12
mov ecx, edi
lea rax, [rbx + 0x88]
nop dword [rax]
cmp dword [rax + 0xc], r12d
je 0x18004bc0e
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x18004bbf0
movzx eax, dl
mov dword [rbx + rax*4 + 0x24], r12d
inc byte [rbx + 0x1f]
jmp 0x18004bc12
mov byte [rax + 6], 1
mov r12, qword [rsp + 0x58]
test ebp, ebp
je 0x18004bc50
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x18004bc50
lea rax, [rbx + 0x88]
nop dword [rax + rax]
cmp dword [rax + 0xc], ebp
je 0x18004bc4c
inc edi
add rax, 0x14
cmp edi, 0xa
jl 0x18004bc30
movzx eax, cl
mov dword [rbx + rax*4 + 0x24], ebp
inc byte [rbx + 0x1f]
jmp 0x18004bc50
mov byte [rax + 6], 1
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop rdi
ret
Function at 0x18005b300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov r11, qword [rcx + 0x28]
mov r14, rcx
mov r10, qword [rax + 8]
mov rax, qword [r11 + 8]
mov rbx, qword [r14 + 8]
movsxd rsi, dword [rax + 0x30]
mov eax, dword [r10 + 0x30]
mov r13, qword [r10]
cmp esi, eax
mov ecx, eax
mov dword [rsp + 0x78], eax
mov rax, qword [r11 + 8]
cmovl ecx, esi
mov r12d, edx
mov ebp, dword [rax + 0x30]
mov r15d, r9d
mov qword [rsp + 0x28], rsi
imul r12, rsi
sub ebp, dword [rax + 0x34]
cmp byte [rbx + 0x11], 0
mov dword [rsp + 0x20], ecx
je 0x18005b37a
inc dword [rbx + 0x14]
cmp byte [rbx + 0x12], 0
jne 0x18005b37a
mov rcx, rbx
call fcn.1800239f0
mov rax, qword [rbx + 8]
mov edi, dword [rax + 0x30]
sub edi, dword [rax + 0x34]
cmp byte [rbx + 0x11], 0
je 0x18005b398
add dword [rbx + 0x14], 0xffffffff
jne 0x18005b398
mov rcx, rbx
call fcn.18001c580
mov ecx, dword [rsp + 0x78]
xor ebx, ebx
lea eax, [rbx + 8]
cmp esi, ecx
je 0x18005b3b7
cmp byte [r13 + 0x13], bl
cmovne ebx, eax
cmp qword [r13 + 0x120], 0
cmovne ebx, eax
cmp ebp, edi
je 0x18005b3e5
lea rdx, [rsp + 0x70]
mov r8d, ebp
mov rcx, r13
mov dword [rsp + 0x70], esi
call fcn.1800382d0
mov ecx, dword [rsp + 0x78]
mov ebx, eax
test eax, eax
jne 0x18005b3e5
cmp dword [rsp + 0x70], esi
mov eax, 8
cmovne ebx, eax
mov rdi, r12
sub rdi, rsi
test ebx, ebx
jne 0x18005b4fc
cmp rdi, r12
jge 0x18005b4fc
movsxd rbp, ecx
mov rax, rdi
mov qword [rsp + 0x70], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r14 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x18010b710]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x18005b4ed
lea r8, [rsp + 0x70]
xor r9d, r9d
mov edx, r10d
mov rcx, r13
call fcn.18008a230
mov ebx, eax
test eax, eax
jne 0x18005b4de
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x20]
mov eax, dword [rdx + 0xbc]
cmp dword [rdx + 0xb8], eax
jbe 0x18005b470
call fcn.18004dce0
jmp 0x18005b475
call fcn.180046ce0
mov ebx, eax
test eax, eax
jne 0x18005b4de
mov rax, qword [rsp + 0x70]
movsxd r8, dword [rsp + 0x20]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x28]
add rdx, qword [rsp + 0x80]
call fcn.1800011c0
mov r11, qword [rsp + 0x70]
mov rax, qword [r11 + 0x10]
mov byte [rax], bl
test rdi, rdi
jne 0x18005b4de
test r15d, r15d
jne 0x18005b4de
mov rax, qword [r14 + 0x28]
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0x3c]
mov eax, edx
mov byte [rsi + 0x1f], dl
shr eax, 0x18
mov byte [rsi + 0x1c], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0x1d], al
mov eax, edx
shr eax, 8
mov byte [rsi + 0x1e], al
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18005b4ed
call fcn.180024230
mov ecx, dword [rsp + 0x78]
add rdi, rbp
test ebx, ebx
je 0x18005b3f3
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180084db0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, qword [rcx + 0x48]
mov r12, qword [rcx + 0x10]
xor ebx, ebx
mov rdi, qword [rsi + 0x30]
mov r13, r9
mov ebp, r8d
mov r14, rdx
test rdi, rdi
jne 0x180084e44
movzx eax, word [r12 + 6]
imul eax, eax, 0x38
add eax, 0x58
test eax, eax
jle 0x180084e14
mov rcx, qword [r12 + 0x10]
movsxd rdx, eax
call fcn.18002e4c0
mov rdi, rax
test rax, rax
jne 0x180084e17
mov rdi, rbx
jmp 0x180084e2f
mov rdi, rbx
lea rax, [rdi + 0x20]
mov qword [rdi], r12
mov qword [rdi + 0x10], rax
movzx eax, word [r12 + 6]
inc ax
mov word [rdi + 8], ax
mov qword [rsi + 0x30], rdi
test rdi, rdi
jne 0x180084e40
lea eax, [rdi + 7]
jmp 0x180084ec8
mov word [rdi + 8], bp
cmp byte [rsi + 0x58], bl
je 0x180084e7c
cmp byte [rsi + 0x59], bl
je 0x180084e5b
mov rax, qword [rsi + 0x10]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x180084e86
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x180084e86
mov rax, qword [rsi + 0x38]
mov edx, dword [rax]
lea r8, [rax + 0x10]
mov r9, rdi
mov rcx, r12
call fcn.180029770
test ebp, ebp
jle 0x180084eaf
mov rax, qword [rdi + 0x10]
add rax, 8
nop dword [rax]
test byte [rax], 1
jne 0x180084ee7
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x180084ea0
mov rdx, qword [r14 + 0x10]
mov ecx, dword [r14 + 0xc]
xor r9d, r9d
mov r8, rdi
call fcn.18007ff50
mov dword [r13], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov dword [r13], 0xffffffff
jmp 0x180084ec6
Function at 0x18008bf90
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x20], 0
mov rbx, rcx
je 0x18008c01b
mov rcx, qword [rcx]
call fcn.1800294e0
mov r11d, eax
test eax, eax
jne 0x18008c041
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rbx + 0x28]
lea rax, [rsp + 0x20]
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov rcx, qword [rbx + 0x38]
mov rax, qword [rbx + 0x40]
mov qword [rbx + 0x28], rcx
lea rcx, [rsp + 0x20]
mov qword [rbx + 0x30], rax
mov rax, qword [rcx]
mov qword [rbx + 0x38], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 0x40], rax
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rax
jne 0x18008c004
mov eax, r11d
mov dword [rbx + 0x1c], 1
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx]
lea rdx, [0x1800895d0]
mov r8, rbx
add rsp, 0x30
pop rbx
jmp fcn.18002e300
call fcn.180087b40
mov rcx, qword [rbx + 0x38]
mov qword [rbx + 0x28], rcx
mov rcx, qword [rbx + 0x40]
mov qword [rbx + 0x30], rcx
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x18008c041
mov dword [rbx + 0x1c], 1
add rsp, 0x30
pop rbx
ret
Function at 0x1800c4e60
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov r8, qword [rdx + 0x38]
mov rsi, rdx
mov rdx, qword [rdx + 0x30]
mov rbx, rcx
lea rcx, str.SELECT_stat_FROM__Q.sqlite_stat1_WHERE_tbl___q_rowid
xor edi, edi
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov rbp, rax
test rax, rax
jne 0x1800c4ea0
lea eax, [rdi + 7]
jmp 0x1800c4f36
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rdi
mov r9d, 1
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.1800bce80
mov ebx, eax
test eax, eax
jne 0x1800c4f0b
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call sym.SQLite.Interop.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800c4eee
xor edx, edx
mov rcx, rbx
call sym.SQLite.Interop.dll_sqlite3_column_int64
mov rdi, rax
mov rcx, rbx
call sym.SQLite.Interop.dll_sqlite3_finalize
mov ebx, eax
test ebx, ebx
jne 0x1800c4f2c
test rdi, rdi
jne 0x1800c4f1c
mov qword [rsi + 0x48], 0x100000
jmp 0x1800c4f2c
cmp eax, 7
je 0x1800c4ef8
mov ebx, edi
mov qword [rsi + 0x48], 0x100000
jmp 0x1800c4f2c
mov eax, 0x64
cmp rdi, rax
cmovg rax, rdi
mov qword [rsi + 0x48], rax
mov rcx, rbp
call sym.SQLite.Interop.dll_sqlite3_free
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800c7240
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor esi, esi
cmp byte [rcx + 0x1bd], 2
mov rdi, rcx
jne 0x1800c7316
mov r8, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
lea rcx, str.SELECT_1_FROM__Q.sqlite_master_WHERE_tbl_name_q_stat
mov qword [rsp + 0x60], rbp
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov rbp, rax
test rax, rax
je 0x1800c7301
mov rcx, qword [rdi + 0x18]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea r9d, [rsi + 1]
or r8d, 0xffffffff
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rsi
call fcn.1800bce80
mov ebx, eax
test eax, eax
jne 0x1800c72e2
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call sym.SQLite.Interop.dll_sqlite3_step
mov rcx, rbx
cmp eax, 0x64
sete sil
call sym.SQLite.Interop.dll_sqlite3_finalize
mov ebx, eax
test eax, eax
jne 0x1800c72e2
mov byte [rdi + 0x1bd], sil
mov rcx, rbp
call sym.SQLite.Interop.dll_sqlite3_free
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov eax, 7
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov eax, esi
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1800c7c70
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r12, rcx
test r8d, r8d
je 0x1800c7d2e
mov rdx, qword [rdx + 0x30]
lea rcx, str.PRAGMA__Q.page_size
xor esi, esi
call sym.SQLite.Interop.dll_sqlite3_mprintf
lea edi, [rsi + 7]
mov rbp, rax
test rax, rax
je 0x1800c7d11
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
lea r9d, [rsi + 1]
mov qword [rsp + 0x28], rax
or r8d, 0xffffffff
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x20], rsi
call fcn.1800bce80
mov edi, eax
test eax, eax
jne 0x1800c7d11
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call sym.SQLite.Interop.dll_sqlite3_step
cmp eax, 0x64
jne 0x1800c7d07
xor edx, edx
mov rcx, rdi
call sym.SQLite.Interop.dll_sqlite3_column_int
mov esi, eax
mov rcx, rdi
call sym.SQLite.Interop.dll_sqlite3_finalize
mov edi, eax
test edi, edi
jne 0x1800c7d5a
movzx eax, byte [rbx + 0x26]
lea ecx, [rsi - 0x40]
mov dword [rbx + 0x20], ecx
imul eax, eax, 0x33
add eax, 4
cmp eax, ecx
jge 0x1800c7d75
mov dword [rbx + 0x20], eax
jmp 0x1800c7d75
mov r8, qword [rdx + 0x38]
mov rdx, qword [rdx + 0x30]
lea rcx, str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call sym.SQLite.Interop.dll_sqlite3_mprintf
lea r8, [rbx + 0x20]
mov rcx, r12
mov rdx, rax
mov rbp, rax
call fcn.1800c4de0
mov edi, eax
test eax, eax
je 0x1800c7d75
mov rcx, r12
call sym.SQLite.Interop.dll_sqlite3_errmsg
lea rcx, [0x1800ec31c]
mov rdx, rax
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov qword [r13], rax
mov rcx, rbp
call sym.SQLite.Interop.dll_sqlite3_free
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x1800c7db0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xa0
xor r14d, r14d
mov rbp, r9
mov r12, r8
mov r13, rdx
mov rbx, rcx
mov qword [rcx + 0x18], rdx
cmp dword [rsp + 0xf0], r14d
je 0x1800c7e56
mov eax, dword [rcx + 0x20]
lea rcx, str.CREATE_TABLE___w_.__w_node__nodeno_INTEGER_PRIMARY_KEY__data_BLOB__CREATE_TABLE___w_.__w_rowid__rowid_INTEGER_PRIMARY_KEY__nodeno_INTEGER__CREATE_TABLE___w_.__w_parent__nodeno_INTEGER_PRIMARY_KEY__parentnode_INTEGER__INSERT_INTO__q._q_node_VALUES_1__zeroblob__d__
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rbp
mov rdx, r9
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov rdi, rax
test rax, rax
jne 0x1800c7e2b
lea eax, [rdi + 7]
jmp 0x1800c7f47
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, r13
mov qword [rsp + 0x20], r14
call sym.SQLite.Interop.dll_sqlite3_exec
mov rcx, rdi
mov esi, eax
call sym.SQLite.Interop.dll_sqlite3_free
test esi, esi
je 0x1800c7e56
mov eax, esi
jmp 0x1800c7f47
lea rax, [rbx + 0x60]
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x50], rax
lea rax, [rbx + 0x68]
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0x58], rax
lea rax, [rbx + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rbx + 0x78]
mov qword [rsp + 0x68], rax
lea rax, [rbx + 0x80]
mov qword [rsp + 0x70], rax
lea rax, [rbx + 0x88]
mov qword [rsp + 0x78], rax
lea rax, [rbx + 0x90]
mov qword [rsp + 0x80], rax
lea rax, [rbx + 0x98]
mov qword [rsp + 0x88], rax
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x90], rax
call fcn.1800c4e60
mov rbx, r14
mov edi, eax
lea r15, str.SELECT_data_FROM__q._q_node_WHERE_nodeno__:1
nop
test edi, edi
jne 0x1800c7f3d
mov rcx, qword [rbx + r15]
mov r8, rbp
mov rdx, r12
call sym.SQLite.Interop.dll_sqlite3_mprintf
mov rsi, rax
test rax, rax
je 0x1800c7f26
mov rcx, qword [rsp + rbx + 0x50]
mov qword [rsp + 0x30], r14
lea r9d, [rdi + 1]
mov qword [rsp + 0x28], rcx
or r8d, 0xffffffff
mov rdx, rax
mov rcx, r13
mov qword [rsp + 0x20], r14
call fcn.1800bce80
mov edi, eax
jmp 0x1800c7f2b
mov edi, 7
mov rcx, rsi
call sym.SQLite.Interop.dll_sqlite3_free
add rbx, 8
cmp rbx, 0x48
jl 0x1800c7ee0
mov r15, qword [rsp + 0xd0]
mov eax, edi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140004330
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.140010e50
sub rsp, rax
mov rax, qword [0x140024040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbp, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor r14d, r14d
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
je 0x1400043b2
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.140002800
test al, al
jne 0x1400043ba
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_read_module_headers
call fcn.140006120
lea rdx, [0x140006300]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
jmp 0x1400044a2
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
inc rdi
cmp byte [rdi + rbp], r14b
jne 0x1400043e1
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, r14d
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x14000445c
nop dword [rax]
nop word [rax + rax]
mov eax, esi
mov r8, rdi
mov rdx, rbp
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004455
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x140004443
cmp rdi, rax
je 0x1400044dc
inc esi
cmp esi, r15d
jb 0x140004420
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_section
call fcn.140006120
lea rdx, [0x140006300]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, r14d
mov qword [rsp + 0x20], rax
call fcn.1400041b0
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14000fd30
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14000445c
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x50]
add rdx, rax
je 0x14000445c
test ecx, ecx
je 0x14000445c
lea rax, [rsp + 0x50]
mov r14d, ecx
sub rdx, rax
add rdx, r13
jmp 0x140004482
Function at 0x140005860
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140024040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000588d
xor eax, eax
jmp 0x1400059f9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400058c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400058c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400059f9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400059ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000590a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005935
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400059f1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400059a4
sub eax, 1
je 0x1400059a4
cmp eax, 2
jne 0x1400059ec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400059f1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400059d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400059ec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400059f1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000fd30
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret