joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011ba0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov ebp, dword [rcx + 0x28]
mov ebx, 1
xor r10d, r10d
cmp ebp, ebx
mov rdi, r8
mov r11, rdx
mov rsi, rcx
jle 0x140011d5e
mov qword [rsp + 0x20], r12
lea r12, [0x1400ab830]
cmp ebx, 2
jge 0x140011be2
mov r9d, ebx
xor r9d, 1
jmp 0x140011be5
mov r9d, ebx
test rdi, rdi
je 0x140011c4a
mov rax, qword [rsi + 0x20]
movsxd rcx, r9d
shl rcx, 5
mov rdx, qword [rcx + rax]
test rdx, rdx
je 0x140011d33
movzx eax, byte [rdi]
mov r8, rdi
test al, al
je 0x140011c31
nop
movzx ecx, al
movzx eax, byte [rdx]
movzx eax, byte [rax + r12]
cmp byte [rcx + r12], al
jne 0x140011c31
mov al, byte [r8 + 1]
add r8, 1
add rdx, 1
test al, al
jne 0x140011c10
movzx eax, byte [rdx]
movzx edx, byte [rax + r12]
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
sub ecx, edx
jne 0x140011d33
mov rax, qword [rsi + 0x20]
movsxd rcx, r9d
shl rcx, 5
mov r8, qword [rcx + rax + 0x18]
mov r10, qword [r8 + 0x18]
test r10, r10
je 0x140011cab
movzx eax, byte [r11]
xor r9d, r9d
mov rdx, r11
test al, al
je 0x140011c90
movzx eax, al
add rdx, 1
movzx ecx, byte [rax + r12]
lea eax, [r9*8]
xor ecx, eax
mov al, byte [rdx]
xor r9d, ecx
test al, al
jne 0x140011c71
xor edx, edx
mov eax, r9d
div dword [r8 + 8]
mov ecx, edx
shl rcx, 4
add rcx, r10
mov r9, qword [rcx + 8]
mov r10d, dword [rcx]
jmp 0x140011cb3
mov r9, qword [r8 + 0x10]
mov r10d, dword [r8 + 0xc]
test r10d, r10d
je 0x140011d30
nop
nop
mov rdx, qword [r9 + 0x18]
sub r10d, 1
test rdx, rdx
jne 0x140011cd7
mov rax, r11
neg rax
sbb edx, edx
jmp 0x140011d24
test r11, r11
je 0x140011d28
movzx ecx, byte [rdx]
mov r8, r11
test cl, cl
je 0x140011d11
nop
nop
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r12]
cmp byte [rcx + r12], al
jne 0x140011d11
mov cl, byte [rdx + 1]
add rdx, 1
add r8, 1
test cl, cl
jne 0x140011cf0
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
movzx eax, byte [rdx]
movzx edx, byte [rax + r12]
sub edx, ecx
test edx, edx
je 0x140011d53
test r10d, r10d
mov r9, qword [r9]
jne 0x140011cc0
xor r10d, r10d
add ebx, 1
cmp ebx, ebp
jl 0x140011bd4
mov rax, r10
mov r12, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r10, qword [r9 + 0x10]
test r10, r10
jne 0x140011d3e
jmp 0x140011d33
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rax, r10
pop rdi
pop rsi
ret
Function at 0x140015750
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x20
mov eax, edx
mov rdi, rcx
mov ecx, 0x40
shl rax, 4
cmp rax, 0x400
cmova edx, ecx
cmp edx, dword [rdi]
jne 0x140015779
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x38], rbx
mov ebx, edx
mov qword [rsp + 0x48], rsi
shl rbx, 4
je 0x140015978
cmp rbx, 0x7fffff00
jae 0x140015978
cmp dword [0x1400bf010], 0
je 0x1400157ea
mov rcx, qword [0x1400c52b8]
test rcx, rcx
je 0x1400157b7
call qword [0x1400bf098]
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140011830
mov rcx, qword [0x1400c52b8]
test rcx, rcx
je 0x1400157e3
call qword [0x1400bf0a8]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [0x1400c52b8]
jmp 0x1400157fc
mov rsi, qword [rsp + 0x30]
jmp 0x1400157fc
mov ecx, ebx
call qword [0x1400bf038]
mov rcx, qword [0x1400c52b8]
mov rsi, rax
test rsi, rsi
je 0x140015978
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x140015863
cmp dword [0x1400bf010], 0
je 0x14001585a
test rcx, rcx
je 0x140015822
call qword [0x1400bf098]
mov rcx, rbx
call qword [0x1400bf050]
sub qword [0x1400c5018], 1
mov rcx, rbx
movsxd rdx, eax
sub qword [0x1400c4fd0], rdx
call qword [0x1400bf040]
mov rcx, qword [0x1400c52b8]
test rcx, rcx
je 0x140015863
call qword [0x1400bf0a8]
jmp 0x140015863
mov rcx, rbx
call qword [0x1400bf040]
mov rcx, rsi
mov qword [rdi + 0x10], rsi
call qword [0x1400bf050]
xor edx, edx
mov rcx, rsi
movsxd rbx, eax
shr rbx, 4
mov r8d, ebx
mov dword [rdi], ebx
shl r8, 4
call sub.msvcrt.dll_memset
mov r8, qword [rdi + 8]
xor r11d, r11d
test r8, r8
mov qword [rdi + 8], r11
je 0x140015963
mov qword [rsp + 0x40], rbp
lea rbp, [0x1400ab830]
nop
nop
mov r9, qword [r8 + 0x18]
mov eax, r11d
movzx ecx, byte [r9]
test cl, cl
je 0x1400158dd
nop
movzx ecx, cl
add r9, 1
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
mov cl, byte [r9]
xor eax, edx
test cl, cl
jne 0x1400158c0
mov r10, qword [r8]
xor edx, edx
div ebx
mov r9d, edx
shl r9, 4
add r9, rsi
je 0x140015936
mov eax, dword [r9]
test eax, eax
je 0x1400158fd
mov rcx, qword [r9 + 8]
jmp 0x140015900
mov rcx, r11
add eax, 1
test rcx, rcx
mov qword [r9 + 8], r8
mov dword [r9], eax
je 0x140015936
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x14001592c
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x140015952
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x140015952
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x14001594a
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
test r10, r10
mov r8, r10
jne 0x1400158b0
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14001c3f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
movsxd r9, edx
mov r11, r8
shl r9, 5
xor esi, esi
mov rdi, rcx
mov rbp, qword [r9 + rax + 0x18]
lea rbx, [0x1400ab830]
mov r8, qword [rbp + 0x30]
test r8, r8
je 0x14001c475
movzx eax, byte [r11]
mov rdx, r11
test al, al
je 0x14001c45c
nop
nop
nop
movzx eax, al
add rdx, 1
movzx ecx, byte [rax + rbx]
lea eax, [rsi*8]
xor ecx, eax
mov al, byte [rdx]
xor esi, ecx
test al, al
jne 0x14001c440
mov eax, esi
xor edx, edx
div dword [rbp + 0x20]
mov eax, edx
mov esi, edx
add rax, rax
mov r9, qword [r8 + rax*8 + 8]
mov r10d, dword [r8 + rax*8]
jmp 0x14001c47d
mov r9, qword [rbp + 0x28]
mov r10d, dword [rbp + 0x24]
test r10d, r10d
je 0x14001c558
nop
nop
nop
mov rdx, qword [r9 + 0x18]
sub r10d, 1
test rdx, rdx
jne 0x14001c4a7
mov rax, r11
neg rax
sbb edx, edx
jmp 0x14001c4f0
test r11, r11
je 0x14001c4f4
movzx ecx, byte [rdx]
mov r8, r11
test cl, cl
je 0x14001c4df
nop
nop
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + rbx]
cmp byte [rcx + rbx], al
jne 0x14001c4df
mov cl, byte [rdx + 1]
add rdx, 1
add r8, 1
test cl, cl
jne 0x14001c4c0
movzx eax, byte [r8]
movzx ecx, byte [rax + rbx]
movzx eax, byte [rdx]
movzx edx, byte [rax + rbx]
sub edx, ecx
test edx, edx
je 0x14001c4fe
test r10d, r10d
mov r9, qword [r9]
jne 0x14001c490
jmp 0x14001c558
mov rbx, qword [r9 + 0x10]
lea rcx, [rbp + 0x20]
mov r8d, esi
mov rdx, r9
call fcn.140012ef0
test rbx, rbx
je 0x14001c558
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdx + 0x10]
cmp rcx, rbx
jne 0x14001c52d
mov rax, qword [rbx + 0x28]
mov qword [rdx + 0x10], rax
jmp 0x14001c54d
test rcx, rcx
je 0x14001c54d
mov rax, qword [rcx + 0x28]
cmp rax, rbx
je 0x14001c545
test rax, rax
mov rcx, rax
jne 0x14001c532
jmp 0x14001c54d
mov rax, qword [rbx + 0x28]
mov qword [rcx + 0x28], rax
mov rdx, rbx
mov rcx, rdi
call fcn.140018060
or dword [rdi + 0x2c], 2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400201e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov r11, qword [rdx]
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea rbp, [0x140000000]
test r11, r11
je 0x1400202f4
mov r9, qword [rdi + 0x238]
test r9, r9
je 0x14002026b
movzx ecx, byte [r11]
xor eax, eax
mov r8, r11
test cl, cl
je 0x140020251
nop
nop
nop
movzx ecx, cl
add r8, 1
movzx edx, byte [rcx + rbp + 0xab830]
lea ecx, [rax*8]
xor edx, ecx
mov cl, byte [r8]
xor eax, edx
test cl, cl
jne 0x140020230
xor edx, edx
div dword [rdi + 0x228]
mov ecx, edx
shl rcx, 4
add rcx, r9
mov r9, qword [rcx + 8]
mov r10d, dword [rcx]
jmp 0x140020279
mov r9, qword [rdi + 0x230]
mov r10d, dword [rdi + 0x22c]
test r10d, r10d
je 0x1400202ea
nop
mov rdx, qword [r9 + 0x18]
sub r10d, 1
test rdx, rdx
je 0x1400202e2
movzx eax, byte [rdx]
mov r8, r11
test al, al
je 0x1400202c7
nop
nop
nop
movzx ecx, al
movzx eax, byte [r8]
movzx eax, byte [rax + rbp + 0xab830]
cmp byte [rcx + rbp + 0xab830], al
jne 0x1400202c7
mov al, byte [rdx + 1]
add rdx, 1
add r8, 1
test al, al
jne 0x1400202a0
movzx eax, byte [r8]
movzx ecx, byte [rax + rbp + 0xab830]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbp + 0xab830]
sub eax, ecx
je 0x1400202ee
test r10d, r10d
mov r9, qword [r9]
jne 0x140020280
xor edx, edx
jmp 0x1400202f8
mov rdx, qword [r9 + 0x10]
jmp 0x1400202f8
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x140020312
movzx eax, byte [rbx + rbp + 0xac02c]
sub eax, 1
cdqe
lea rcx, [rax + rax*4]
lea rdx, [rdx + rcx*8]
cmp qword [rdx + 0x18], 0
jne 0x14002033d
add rbx, 1
cmp rbx, 3
jl 0x140020202
mov eax, 1
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
pop rdi
ret
mov rax, qword [rdx]
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
mov qword [rsi], rax
mov rax, qword [rdx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rdx + 0x18]
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], 0
mov rsi, qword [rsp + 0x28]
xor eax, eax
pop rdi
ret
Function at 0x140023380
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
movsxd r9, edx
xor ebx, ebx
shl r9, 5
mov r11, r8
mov rsi, rcx
mov rdi, qword [r9 + rax + 0x18]
lea r12, [0x1400ab830]
mov r9, qword [rdi + 0x18]
test r9, r9
je 0x140023407
movzx ecx, byte [r8]
mov eax, ebx
test cl, cl
je 0x1400233ee
nop
movzx ecx, cl
add r8, 1
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
mov cl, byte [r8]
xor eax, edx
test cl, cl
jne 0x1400233d0
xor edx, edx
div dword [rdi + 8]
mov eax, edx
mov ebp, edx
shl rax, 4
add rax, r9
mov r9, qword [rax + 8]
mov r10d, dword [rax]
jmp 0x140023411
mov r9, qword [rdi + 0x10]
mov r10d, dword [rdi + 0xc]
mov ebp, ebx
test r10d, r10d
je 0x1400234a5
nop
nop
mov rdx, qword [r9 + 0x18]
sub r10d, 1
test rdx, rdx
jne 0x140023437
mov rax, r11
neg rax
sbb edx, edx
jmp 0x140023484
test r11, r11
je 0x140023488
movzx eax, byte [rdx]
mov r8, r11
test al, al
je 0x140023471
nop
nop
nop
movzx ecx, al
movzx eax, byte [r8]
movzx eax, byte [rax + r12]
cmp byte [rcx + r12], al
jne 0x140023471
mov al, byte [rdx + 1]
add rdx, 1
add r8, 1
test al, al
jne 0x140023450
movzx eax, byte [r8]
movzx ecx, byte [rax + r12]
movzx eax, byte [rdx]
movzx edx, byte [rax + r12]
sub edx, ecx
test edx, edx
je 0x140023492
test r10d, r10d
mov r9, qword [r9]
jne 0x140023420
jmp 0x1400234a5
mov rbx, qword [r9 + 0x10]
lea rcx, [rdi + 8]
mov r8d, ebp
mov rdx, r9
call fcn.140012ef0
mov rdx, rbx
mov rcx, rsi
call fcn.140020a00
or dword [rsi + 0x2c], 2
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140027230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, qword [rcx + 0x10]
xor edi, edi
mov r13d, r8d
test rsi, rsi
mov r14d, edx
mov rbx, rcx
jne 0x1400272c8
call fcn.140019700
test rax, rax
mov rsi, rax
mov qword [rbx + 0x10], rax
je 0x1400272bb
mov rcx, qword [rax + 0x30]
movsxd rbp, dword [rax + 0x3c]
cmp dword [rcx + 0x60], ebp
jg 0x14002728f
lea edx, [rdi + 1]
mov rcx, rax
call fcn.1400214c0
test eax, eax
jne 0x1400272bb
mov rax, qword [rsi + 8]
add dword [rsi + 0x3c], 1
lea rcx, [rbp + rbp*2]
mov byte [rax + rcx*8], 0x9e
mov byte [rax + rcx*8 + 3], dil
mov dword [rax + rcx*8 + 4], edi
mov dword [rax + rcx*8 + 8], edi
mov dword [rax + rcx*8 + 0xc], edi
mov qword [rax + rcx*8 + 0x10], rdi
mov byte [rax + rcx*8 + 1], dil
cmp qword [rbx + 0x1b8], rdi
jne 0x1400272c8
mov byte [rbx + 0x23], 1
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x1400272d9
add dword [rbx + 0x54], 1
mov ebp, dword [rbx + 0x54]
jmp 0x1400272e5
sub al, 1
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov rax, qword [rsi + 0x30]
movsxd r12, dword [rsi + 0x3c]
cmp dword [rax + 0x60], r12d
jg 0x140027304
mov edx, 1
mov rcx, rsi
call fcn.1400214c0
test eax, eax
jne 0x140027331
mov rax, qword [rsi + 8]
add dword [rsi + 0x3c], 1
lea rcx, [r12 + r12*2]
mov byte [rax + rcx*8], 0x76
mov byte [rax + rcx*8 + 3], dil
mov dword [rax + rcx*8 + 4], r14d
mov dword [rax + rcx*8 + 8], ebp
mov dword [rax + rcx*8 + 0xc], r13d
mov qword [rax + rcx*8 + 0x10], rdi
mov byte [rax + rcx*8 + 1], dil
test ebp, ebp
mov byte [rbx + 0x21], 1
je 0x140027372
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x140027372
lea rax, [rbx + 0x88]
nop
nop
cmp dword [rax + 0xc], ebp
je 0x14002736e
add edi, 1
add rax, 0x14
cmp edi, 0xa
jl 0x140027350
movzx eax, cl
mov dword [rbx + rax*4 + 0x24], ebp
add byte [rbx + 0x1f], 1
jmp 0x140027372
mov byte [rax + 6], 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x140041c50
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x48]
mov r13, qword [rcx + 0x10]
xor ebx, ebx
mov rdi, qword [rsi + 0x30]
mov r14, r9
mov r12d, r8d
test rdi, rdi
mov r15, rdx
jne 0x140041d61
movzx eax, word [r13 + 6]
mov qword [rsp + 0x58], rbp
imul eax, eax, 0x38
add eax, 0x58
test eax, eax
jle 0x140041d2b
mov rbp, qword [r13 + 0x10]
movsxd rdi, eax
test rbp, rbp
je 0x140041cb0
cmp byte [rbp + 0x51], bl
jne 0x140041d26
test eax, eax
je 0x140041d15
cmp rdi, 0x7fffff00
jae 0x140041d15
cmp dword [0x1400bf010], ebx
je 0x140041d03
mov rcx, qword [0x1400c52b8]
test rcx, rcx
je 0x140041cd7
call qword [0x1400bf098]
lea rdx, [rsp + 0x50]
mov ecx, edi
call fcn.140011830
mov rcx, qword [0x1400c52b8]
test rcx, rcx
je 0x140041cfc
call qword [0x1400bf0a8]
mov rdi, qword [rsp + 0x50]
jmp 0x140041d0e
mov rdi, qword [rsp + 0x50]
jmp 0x140041d0e
mov ecx, edi
call qword [0x1400bf038]
mov rdi, rax
test rdi, rdi
jne 0x140041d21
jmp 0x140041d18
mov rdi, rbx
test rbp, rbp
je 0x140041d21
mov byte [rbp + 0x51], 1
test rdi, rdi
jne 0x140041d2e
mov rdi, rbx
jmp 0x140041d46
mov rdi, rbx
lea rax, [rdi + 0x20]
mov qword [rdi], r13
mov qword [rdi + 0x10], rax
movzx eax, word [r13 + 6]
add ax, 1
mov word [rdi + 8], ax
test rdi, rdi
mov rbp, qword [rsp + 0x58]
mov qword [rsi + 0x30], rdi
jne 0x140041d5c
lea eax, [rdi + 7]
jmp 0x140041de9
mov word [rdi + 8], r12w
cmp byte [rsi + 0x58], bl
je 0x140041d99
cmp byte [rsi + 0x59], bl
je 0x140041d78
mov rax, qword [rsi + 0x10]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x140041da3
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x140041da3
mov rax, qword [rsi + 0x38]
mov edx, dword [rax]
lea r8, [rax + 0x10]
mov r9, rdi
mov rcx, r13
call fcn.14000fc60
test r12d, r12d
jle 0x140041dd1
mov rax, qword [rdi + 0x10]
add rax, 8
nop
nop
test byte [rax], 1
jne 0x140041e01
add ebx, 1
add rax, 0x38
cmp ebx, r12d
jl 0x140041dc0
mov rdx, qword [r15 + 0x10]
mov ecx, dword [r15 + 0xc]
xor r9d, r9d
mov r8, rdi
call fcn.140038230
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [r14], 0xffffffff
jmp 0x140041de7
Function at 0x140054c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x48
mov r14, qword [rcx + 0x10]
xor ebx, ebx
or r11d, 0xffffffff
test byte [rdx + 0x3e], 0x20
mov r15d, r9d
mov rsi, rcx
mov r10, rbx
jne 0x140054cb0
mov r12, rbx
jmp 0x140054cd5
mov r12, qword [rdx + 0x10]
test r12, r12
je 0x140054cd5
nop
nop
mov eax, dword [r12 + 0x5c]
and al, 3
cmp al, 2
je 0x140054cd5
mov r12, qword [r12 + 0x28]
test r12, r12
jne 0x140054cc0
mov rbp, qword [rdx + 0x10]
test rbp, rbp
je 0x140054e7c
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x98], rdi
mov r13, rax
nop
nop
test rax, rax
je 0x140054d10
cmp dword [r13], 0
je 0x140054e5a
cmp rbp, r12
je 0x140054e5a
mov dword [rsp + 0x38], r11d
mov qword [rsp + 0x30], r10
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 1
call fcn.140054930
test byte [rbp + 0x5c], 8
mov r11d, eax
mov dword [rsp + 0x80], eax
je 0x140054d5c
movzx ebx, word [rbp + 0x56]
jmp 0x140054d60
movzx ebx, word [rbp + 0x58]
mov rax, qword [r14 + 0x30]
movsxd rdi, dword [r14 + 0x3c]
cmp dword [rax + 0x60], edi
jg 0x140054d86
mov edx, 1
mov rcx, r14
call fcn.1400214c0
test eax, eax
jne 0x140054db7
mov r11d, dword [rsp + 0x80]
add dword [r14 + 0x3c], 1
mov rax, qword [r14 + 8]
lea rcx, [rdi + rdi*2]
mov dword [rax + rcx*8 + 0xc], ebx
xor ebx, ebx
mov byte [rax + rcx*8], 0x70
mov byte [rax + rcx*8 + 3], 0
mov dword [rax + rcx*8 + 4], r15d
mov dword [rax + rcx*8 + 8], r11d
mov qword [rax + rcx*8 + 0x10], rbx
mov byte [rax + rcx*8 + 1], bl
jmp 0x140054dc1
mov r11d, dword [rsp + 0x80]
xor ebx, ebx
mov eax, dword [rsp + 0x88]
test eax, eax
je 0x140054e47
mov r8, qword [rsi + 0x10]
or ecx, 0xffffffff
sub ecx, eax
mov r9, qword [r8 + 0x30]
js 0x140054df1
mov rdx, qword [r9 + 0x80]
test rdx, rdx
je 0x140054df1
mov eax, dword [r8 + 0x3c]
movsxd rcx, ecx
mov dword [rdx + rcx*4], eax
mov eax, dword [r8 + 0x3c]
lea rcx, [rsi + 0x94]
mov r8d, 0xa
sub eax, 1
mov dword [r9 + 0x64], eax
add dword [rsi + 0x70], 0xffffffff
nop
mov edx, dword [rcx]
test edx, edx
je 0x140054e3d
mov eax, dword [rsi + 0x70]
cmp dword [rcx - 4], eax
jle 0x140054e3d
cmp byte [rcx - 6], 0
je 0x140054e3b
movzx eax, byte [rsi + 0x1f]
cmp al, 8
jae 0x140054e37
movzx eax, al
mov dword [rsi + rax*4 + 0x24], edx
add byte [rsi + 0x1f], 1
mov byte [rcx - 6], 0
mov dword [rcx], ebx
add rcx, 0x14
sub r8, 1
jne 0x140054e10
mov rax, qword [rsp + 0xa0]
mov r8d, dword [rsp + 0x90]
mov r10, rbp
mov rbp, qword [rbp + 0x28]
add r15d, 1
add r13, 4
test rbp, rbp
jne 0x140054d00
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x98]
add rsp, 0x48
pop r15
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x140063470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.1400565a0
test eax, eax
jne 0x1400636b4
mov rcx, qword [rbx]
lea r8, [rsp + 0x48]
lea edx, [rax + 1]
xor r9d, r9d
call fcn.140039950
test eax, eax
jne 0x1400636b4
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rsi
mov rax, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x48], rbx
mov dword [rsi + 0x88], 1
mov byte [rsi + 6], 0x64
mov r9d, dword [rax + 0x1c]
mov rdx, rax
mov rax, qword [rbx]
bswap r9d
test r9d, r9d
mov r10d, dword [rax + 0x1c]
je 0x1400634ee
mov eax, dword [rdx + 0x18]
cmp eax, dword [rdx + 0x5c]
je 0x1400634f1
mov r9d, r10d
test r9d, r9d
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
jle 0x140063639
mov r8, qword [rdx]
lea r11, [0x140000000]
mov r13d, 0x1a
cmp r8, qword [r11 + 0xabe38]
jne 0x140063538
mov r8, qword [rdx + 8]
cmp r8, qword [r11 + 0xabe40]
jne 0x140063538
xor eax, eax
jmp 0x14006353d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x140063616
cmp byte [rdx + 0x12], 1
jbe 0x140063550
or word [rbx + 0x24], 1
cmp byte [rdx + 0x13], 1
ja 0x140063616
mov r8w, word [rdx + 0x15]
cmp r8w, word [r11 + 0xaf2bc]
jne 0x14006357a
mov r8b, byte [rdx + 0x17]
cmp r8b, byte [r11 + 0xaf2be]
jne 0x14006357a
xor eax, eax
jmp 0x14006357f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x140063616
movzx eax, byte [rdx + 0x10]
movzx edi, byte [rdx + 0x11]
shl edi, 8
or edi, eax
shl edi, 8
lea eax, [rdi - 1]
test edi, eax
jne 0x140063616
lea eax, [rdi - 0x101]
cmp eax, 0xfeff
ja 0x140063616
movzx eax, byte [rdx + 0x14]
mov ebp, edi
sub ebp, eax
cmp edi, dword [rbx + 0x30]
je 0x1400635e4
mov rcx, rsi
call fcn.14005cd10
mov rcx, rbx
mov dword [rbx + 0x34], ebp
mov dword [rbx + 0x30], edi
call fcn.140014db0
mov rcx, qword [rbx]
sub edi, ebp
lea rdx, [rbx + 0x30]
mov r8d, edi
call fcn.14001e510
jmp 0x14006369b
mov rax, qword [rbx + 8]
bt dword [rax + 0x2c], 0x10
jb 0x14006362b
cmp r9d, r10d
jle 0x14006362b
mov r13d, 0xb
lea r9, [0x1400b0b4c]
lea rdx, str.database_corruption_at_line__d_of___.10s_
mov ecx, r13d
mov r8d, 0xddbb
call fcn.140034d20
mov rcx, rsi
call fcn.14005cd10
mov qword [rbx + 0x18], 0
mov eax, r13d
jmp 0x14006369b
cmp ebp, 0x1e0
jb 0x140063616
mov dword [rbx + 0x30], edi
mov dword [rbx + 0x34], ebp
mov r8d, dword [rbx + 0x34]
mov eax, 0x80808081
add r8d, 0xfffffff4
mov ecx, r8d
shl r8d, 5
shl ecx, 6
mul ecx
mov eax, 0x80808081
mov ecx, edx
mul r8d
movzx eax, word [rbx + 0x34]
shr ecx, 7
shr edx, 7
sub ax, 0x23
sub dx, 0x17
sub cx, 0x17
mov word [rbx + 0x2a], ax
cmp cx, 0x7f
mov word [rbx + 0x28], dx
mov word [rbx + 0x2c], dx
mov word [rbx + 0x26], cx
jbe 0x14006368e
mov byte [rbx + 0x22], 0x7f
jmp 0x140063691
mov byte [rbx + 0x22], cl
mov qword [rbx + 0x18], rsi
mov dword [rbx + 0x3c], r9d
xor eax, eax
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x40]
mov r13, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
Function at 0x14006f590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
sub rsp, 0x28
test edx, edx
mov qword [rsp + 0x20], r12
mov r12, qword [rcx + 8]
mov eax, edx
mov rbp, rcx
jne 0x14006f5de
mov rcx, qword [r12 + 0x10]
test rcx, rcx
je 0x14006f5c5
test rcx, rcx
jne 0x14006f5d2
mov rcx, qword [InitCommonControls]
test rcx, rcx
jne 0x14006f5b3
xor eax, eax
test eax, eax
mov edi, eax
je 0x14006f5ef
xor r8d, r8d
jmp 0x14006f5e0
xor r8d, r8d
xor edx, edx
call fcn.14006ea50
jmp 0x14006f5c7
xor edi, edi
mov edx, eax
mov rcx, rbp
call fcn.14006e6e0
test eax, eax
cmovne edi, eax
cmp byte [rbp + 0x10], 2
jne 0x14006f6bc
mov qword [rsp + 0x50], rsi
mov rsi, qword [r12]
movzx ecx, byte [rsi + 0x14]
cmp cl, 6
jne 0x14006f610
mov eax, dword [rsi + 0x2c]
jmp 0x14006f64a
cmp cl, 1
jbe 0x14006f64f
mov rax, qword [rsi + 0x50]
cmp qword [rax], 0
je 0x14006f6e7
cmp cl, 2
je 0x14006f6e7
xor edx, edx
mov rcx, rsi
call fcn.1400507d0
movzx ecx, al
cmp ecx, 0xd
je 0x14006f643
cmp ecx, 0xa
jne 0x14006f64a
mov dword [rsi + 0x2c], eax
mov byte [rsi + 0x14], 6
test eax, eax
cmovne edi, eax
mov rcx, qword [r12]
xor r9d, r9d
lea r8, [rsp + 0x40]
lea edx, [r9 + 1]
call fcn.140039950
mov rsi, qword [rsp + 0x50]
test eax, eax
jne 0x14006f6ae
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 8]
mov qword [rcx + 0x70], rax
mov qword [rcx + 0x50], rdx
mov qword [rcx + 0x48], r12
mov dword [rcx + 0x88], 1
mov byte [rcx + 6], 0x64
mov eax, dword [rdx + 0x1c]
bswap eax
test eax, eax
jne 0x14006f6a4
mov rax, qword [r12]
mov eax, dword [rax + 0x1c]
mov dword [r12 + 0x3c], eax
call fcn.14005cd10
mov rcx, r12
mov byte [r12 + 0x21], 1
call fcn.140012850
movzx eax, byte [rbp + 0x10]
mov rdx, qword [rbp + 8]
mov r12, qword [rsp + 0x20]
test al, al
je 0x14006f71a
mov rcx, qword [rbp]
cmp dword [rcx + 0xa8], 1
jle 0x14006f71a
mov byte [rbp + 0x10], 1
mov eax, edi
add rsp, 0x28
pop rdi
pop rbp
ret
mov qword [rsp + 0x48], rbx
movzx ebx, cl
xor r8d, r8d
mov rcx, rsi
xor edx, edx
call fcn.140014df0
cmp ebx, 2
mov rbx, qword [rsp + 0x48]
jle 0x14006f636
mov dword [rsi + 0x2c], 4
mov byte [rsi + 0x14], 6
jmp 0x14006f64a
test al, al
je 0x14006f728
add dword [rdx + 0x38], 0xffffffff
jne 0x14006f728
mov byte [rdx + 0x21], 0
mov byte [rbp + 0x10], 0
cmp byte [rdx + 0x21], 0
jne 0x14006f748
mov rcx, qword [rdx + 0x18]
test rcx, rcx
je 0x14006f748
mov qword [rdx + 0x18], 0
call fcn.14005caf0
mov eax, edi
add rsp, 0x28
pop rdi
pop rbp
ret