joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140209fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x60
mov r12, rcx
mov rbx, r8
test rdx, rdx
je 0x140209fd6
nop dword [rax + rax]
mov eax, dword [rdx + 4]
test eax, 0x82000
je 0x14020a03b
test eax, 0x80000
je 0x14020a028
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x140209fb8
movzx eax, byte [r12 + 0x1f]
test al, al
je 0x14020a0f8
sub eax, 1
mov byte [r12 + 0x1f], al
movzx eax, al
mov esi, dword [r12 + rax*4 + 0xe8]
mov r8d, esi
mov rcx, r12
call sym.sqlite3ExprCodeTarget
cmp eax, esi
je 0x14020a0e8
test esi, esi
jne 0x14020a0c0
mov dword [rbx], 0
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x140209fd6
mov eax, dword [rdx + 4]
test eax, 0x82000
jne 0x140209fc2
cmp byte [r12 + 0x23], 0
je 0x140209fd6
cmp byte [rdx], 0xb0
je 0x140209fd6
mov eax, 2
lea rcx, [rsp + 0x30]
lea rsi, [sym.exprNodeIsConstant]
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x54], ax
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rsi
movq xmm1, rax
mov dword [rsp + 0x58], 0
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
call sym.sqlite3WalkExprNN
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
je 0x140209fd6
mov r8d, 0xffffffff
mov rcx, r12
mov dword [rbx], 0
add rsp, 0x60
pop rbx
pop rsi
pop r12
jmp sym.sqlite3ExprCodeRunJustOnce
movzx edx, byte [r12 + 0x1f]
cmp dl, 7
ja 0x14020a012
lea ecx, [rdx + 1]
mov byte [r12 + 0x1f], cl
mov dword [r12 + rdx*4 + 0xe8], esi
jmp 0x14020a012
mov dword [rbx], esi
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
mov eax, dword [r12 + 0x38]
lea esi, [rax + 1]
mov dword [r12 + 0x38], esi
jmp 0x140209ff7

Function at 0x14020dd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebx, dword [rcx + 0x28]
mov rdi, rdx
mov r12, r8
test ebx, ebx
jle 0x14020de1b
mov rsi, qword [rcx + 0x20]
xor r13d, r13d
lea rbp, [0x140344560]
nop dword [rax + rax]
mov r10d, r13d
xor r10d, 1
cmp r13d, 2
cmovge r10d, r13d
movsxd r9, r10d
shl r9, 5
add r9, rsi
test r12, r12
je 0x14020ddf9
mov r8, qword [r9]
xor ecx, ecx
jmp 0x14020dde7
movzx edx, byte [rbp + rdx]
cmp byte [rbp + rax], dl
jne 0x14020de30
add rcx, 1
movzx eax, byte [r8 + rcx]
movzx edx, byte [r12 + rcx]
cmp eax, edx
jne 0x14020ddd8
test eax, eax
jne 0x14020dde3
mov rcx, qword [r9 + 0x18]
mov rdx, rdi
add rcx, 0x20
call sym.findElementWithHash.constprop.0
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14020de1d
add r13d, 1
cmp r13d, ebx
jne 0x14020ddb0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r10d, r10d
jne 0x14020de12
mov r8, r12
lea rcx, str.main
jmp 0x14020de5b
movzx edx, byte [rbp + rdx]
cmp byte [rbp + rax], dl
jne 0x14020de12
add rcx, 1
add r8, 1
movzx eax, byte [rcx]
movzx edx, byte [r8]
cmp eax, edx
jne 0x14020de48
test eax, eax
jne 0x14020de53
jmp 0x14020ddf9
Function at 0x140220ae0
Capabilities:
Reference sql statements

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rdi, qword [rcx]
mov r12, qword [rcx + 0x68]
mov ebp, dword [rdi + 0x18]
mov rsi, rcx
mov r14, rdx
mov rbx, r8
test r12, r12
je 0x140220b90
mov rcx, r12
call sym.sqlite3_reset
xor edx, edx
mov rcx, r12
call sym.vdbeUnbind
test eax, eax
jne 0x140220b53
mov rcx, qword [r12 + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x140220ce0
mov eax, 4
mov qword [rcx], r14
mov word [rcx + 0x14], ax
mov rax, qword [r12]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140220b53
call qword [0x1402ba750]
mov rcx, r12
call sym.sqlite3_step
cmp eax, 0x64
je 0x140220c30
mov rcx, r12
call sym.sqlite3_reset
mov r13d, eax
test eax, eax
mov eax, 0x10b
cmove r13d, eax
mov eax, r13d
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, dword [rdi + 0x44]
lea rax, [0x140330c0e]
mov r9, qword [rdi + 0x10]
lea rcx, str.SELECT_sz_s_FROM__Q._q_docsize_WHERE_id_
mov r8, qword [rdi + 8]
mov r13d, 7
test edx, edx
lea rdx, str._origin
cmove rdx, rax
call sym.sqlite3_mprintf
mov r12, rax
test rax, rax
je 0x140220c14
mov rax, qword [rsi]
mov r9d, 0x85
mov r8d, 0xffffffff
mov rdx, r12
add dword [rax + 0x78], 1
lea rax, [rsi + 0x68]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi]
call sym.sqlite3LockAndPrepare
mov rcx, r12
mov r13d, eax
mov rax, qword [rsi]
sub dword [rax + 0x78], 1
call sym.sqlite3_free
mov r12, qword [rsi + 0x68]
mov rcx, r12
call sym.sqlite3_reset
test r12, r12
je 0x140220b7a
jmp 0x140220b12
xor edx, edx
mov rcx, r12
call sym.columnMem
mov rcx, rax
call sym.sqlite3_value_blob
mov rcx, r12
mov rdi, rax
call sym.columnMallocFailure
xor edx, edx
mov rcx, r12
call sym.sqlite3_column_bytes
mov r13d, eax
test ebp, ebp
jle 0x140220d24
test eax, eax
jle 0x140220b64
lea eax, [rbp - 1]
xor esi, esi
lea rdx, [rsp + 0x48]
lea rbp, [rbx + rax*4]
jmp 0x140220cc1
movzx r9d, byte [rcx + 1]
test r9b, r9b
jns 0x140220cf0
movzx eax, byte [rcx + 2]
shl r8d, 0xe
or r8d, eax
test al, 0x80
je 0x140220d08
call sym.sqlite3Fts5GetVarint
mov ecx, dword [rsp + 0x48]
movzx eax, al
and ecx, 0x7fffffff
mov dword [rbx], ecx
add esi, eax
cmp rbx, rbp
je 0x140220d30
add rbx, 4
cmp r13d, esi
jle 0x140220b64
movsxd rcx, esi
add rcx, rdi
movzx r8d, byte [rcx]
mov eax, r8d
test r8b, r8b
js 0x140220c80
mov dword [rbx], r8d
mov eax, 1
jmp 0x140220cad
mov rdx, r14
call sym.vdbeReleaseAndSetInt64
jmp 0x140220b40
and eax, 0x7f
shl eax, 7
or eax, r9d
mov dword [rbx], eax
mov eax, 2
jmp 0x140220cad
and r9d, 0x7f
and r8d, 0x1fc07f
mov eax, 3
shl r9d, 7
or r8d, r9d
mov dword [rbx], r8d
jmp 0x140220cad
xor esi, esi
nop word cs:[rax + rax]
cmp r13d, esi
jne 0x140220b64
mov rcx, r12
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.sqlite3_reset
Function at 0x140221350
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
xor eax, eax
mov rsi, qword [rsp + 0x90]
mov dword [rsi], 0
mov dword [rsp + 0x2c], 0
mov edi, edx
mov r12, r8
mov ebp, r9d
test rcx, rcx
je 0x14022141b
mov edx, r9d
sub edx, 1
js 0x140221479
movsxd r13, r9d
movsxd rax, edx
mov edx, edx
lea r10, [r8 + r13 - 2]
add rax, r8
sub r10, rdx
mov edx, 0xd
nop dword [rax + rax]
movsx r9d, byte [rax]
lea r8d, [rdx*8]
sub rax, 1
xor r8d, r9d
xor edx, r8d
cmp rax, r10
jne 0x1402213b0
lea eax, [rdx*8]
xor edx, eax
xor edx, edi
and edx, 0x1ff
lea r14, [rcx + rdx*8]
mov rbx, qword [r14]
test rbx, rbx
jne 0x1402213f9
jmp 0x140221430
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140221430
cmp dword [rbx + 0xc], edi
jne 0x1402213f0
cmp dword [rbx + 8], ebp
jne 0x1402213f0
mov rcx, qword [rbx]
mov r8, r13
mov rdx, r12
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1402213f0
mov dword [rsi], 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, [r13 + 0x18]
lea rcx, [rsp + 0x2c]
call sym.sqlite3Fts5MallocZero.part.0
mov rbx, rax
test rax, rax
je 0x14022148b
lea rcx, [rbx + 0x18]
movd xmm1, edi
movd xmm0, ebp
mov r8, r13
mov qword [rbx], rcx
punpckldq xmm0, xmm1
mov rdx, r12
movq qword [rbx + 8], xmm0
call sym.memcpy
mov rax, qword [r14]
mov qword [rbx + 0x10], rax
mov eax, dword [rsp + 0x2c]
mov qword [r14], rbx
jmp 0x14022141b
mov eax, 0x68
mov edx, 0xd
movsxd r13, r9d
jmp 0x1402213d2
mov eax, dword [rsp + 0x2c]
jmp 0x14022141b
Function at 0x14022dea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
movzx eax, word [rcx + 0x14]
mov r9d, eax
mov r10, rdx
movzx edx, word [rdx + 0x14]
or r9d, edx
test r9b, 1
jne 0x14022df30
test r9b, 0x2c
je 0x14022df00
mov r8d, eax
and r8d, edx
test r8b, 0x24
jne 0x14022df50
and r8d, 8
je 0x14022df70
movsd xmm1, qword [rcx]
movsd xmm0, qword [r10]
comisd xmm0, xmm1
ja 0x14022e05e
xor r8d, r8d
comisd xmm1, xmm0
seta r8b
jmp 0x14022df47
and r9d, 2
je 0x14022df20
test al, 2
je 0x14022e040
and edx, 2
je 0x14022e05e
test r8, r8
jne 0x14022e070
mov rdx, r10
add rsp, 0x18
jmp sym.sqlite3BlobCompare
and edx, 1
and eax, 1
sub edx, eax
mov r8d, edx
jmp 0x14022df47
fstp st(0)
fstp st(0)
jmp 0x14022df47
fstp st(0)
fstp st(0)
mov eax, r8d
add rsp, 0x18
ret
mov rax, qword [r10]
cmp qword [rcx], rax
jl 0x14022e05e
setg r8b
movzx r8d, r8b
mov eax, r8d
add rsp, 0x18
ret
test al, 0x24
jne 0x14022e050
mov r8d, 1
test al, 8
je 0x14022df47
and edx, 0x24
je 0x14022e05e
movsd xmm0, qword [rcx]
mov r8d, 0xffffffff
movd eax, xmm0
movq rdx, xmm0
neg eax
or eax, edx
shr rdx, 0x20
and edx, 0x7fffffff
shr eax, 0x1f
or eax, edx
mov edx, 0x7ff00000
cmp edx, eax
js 0x14022df47
cmp byte [0x1402ba6ca], 0
mov rax, qword [r10]
jne 0x14022e120
movsd xmm1, qword [0x14033d638]
comisd xmm1, xmm0
ja 0x14022df47
comisd xmm0, xmmword [0x14033d560]
mov r8d, 1
jae 0x14022df47
cvttsd2si rdx, xmm0
cmp rax, rdx
jl 0x14022df47
mov r8d, 0xffffffff
jg 0x14022df47
pxor xmm1, xmm1
mov r8d, 1
cvtsi2sd xmm1, rax
comisd xmm0, xmm1
ja 0x14022df47
xor edx, edx
comisd xmm1, xmm0
seta dl
neg edx
mov r8d, edx
jmp 0x14022df47
mov r8d, 1
jmp 0x14022df47
test dl, 8
jne 0x14022e080
and edx, 0x24
jne 0x14022df50
mov r8d, 0xffffffff
jmp 0x14022df47
xor r9d, r9d
mov rdx, r10
add rsp, 0x18
jmp sym.vdbeCompareMemString
movsd xmm0, qword [r10]
mov r8d, 1
movd eax, xmm0
movq rdx, xmm0
neg eax
or eax, edx
shr rdx, 0x20
and edx, 0x7fffffff
shr eax, 0x1f
or eax, edx
mov edx, 0x7ff00000
cmp edx, eax
js 0x14022df47
cmp byte [0x1402ba6ca], 0
mov rax, qword [rcx]
jne 0x14022e156
movsd xmm1, qword [0x14033d638]
comisd xmm1, xmm0
ja 0x14022df47
comisd xmm0, xmmword [0x14033d560]
mov r8d, 0xffffffff
jae 0x14022df47
cvttsd2si rdx, xmm0
cmp rax, rdx
jl 0x14022df47
mov r8d, 1
jg 0x14022df47
pxor xmm1, xmm1
or r8d, 0xffffffff
cvtsi2sd xmm1, rax
comisd xmm0, xmm1
ja 0x14022df47
jmp 0x14022deee
mov qword [rsp + 8], rax
fild qword [rsp + 8]
mov r8d, 1
movsd qword [rsp + 8], xmm0
fld qword [rsp + 8]
fcomi st(1)
ja 0x14022df3d
fxch st(1)
xor edx, edx
fcompi st(1)
fstp st(0)
seta dl
neg edx
mov r8d, edx
jmp 0x14022df47
mov qword [rsp + 8], rax
fild qword [rsp + 8]
mov r8d, 0xffffffff
movsd qword [rsp + 8], xmm0
fld qword [rsp + 8]
fcomi st(1)
ja 0x14022df43
fxch st(1)
xor r8d, r8d
fcompi st(1)
fstp st(0)
seta r8b
jmp 0x14022df47
Function at 0x140252280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov edx, dword [rcx + 0x90]
mov rsi, rcx
lea r9d, [rdx + 5]
cmp r9d, dword [rcx + 0x94]
jg 0x140252460
movsxd rax, edx
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x88]
lea rax, [rax + rcx*8]
movzx ecx, byte [rbx]
mov byte [rax], cl
movsx r8d, byte [rbx + 1]
mov dword [rax + 4], r8d
movsx r11d, byte [rbx + 2]
lea r8, [0x140344400]
mov dword [rax + 8], r11d
test r11b, r11b
jle 0x1402522e3
test byte [r8 + rcx], 1
jne 0x140252450
movsx ecx, byte [rbx + 3]
mov byte [rax + 1], 0
mov qword [rax + 0x10], 0
mov dword [rax + 0xc], ecx
xor ecx, ecx
mov word [rax + 2], cx
movzx ecx, byte [rbx + 4]
mov byte [rax + 0x18], cl
movsx r10d, byte [rbx + 5]
mov dword [rax + 0x1c], r10d
movsx r11d, byte [rbx + 6]
mov dword [rax + 0x20], r11d
test r11b, r11b
jle 0x140252325
test byte [r8 + rcx], 1
jne 0x140252440
movsx ecx, byte [rbx + 7]
xor r11d, r11d
mov byte [rax + 0x19], 0
mov qword [rax + 0x28], 0
mov dword [rax + 0x24], ecx
mov word [rax + 0x1a], r11w
movzx ecx, byte [rbx + 8]
mov byte [rax + 0x30], cl
movsx r10d, byte [rbx + 9]
mov dword [rax + 0x34], r10d
movsx r11d, byte [rbx + 0xa]
mov dword [rax + 0x38], r11d
test r11b, r11b
jle 0x140252369
test byte [r8 + rcx], 1
jne 0x140252430
movsx ecx, byte [rbx + 0xb]
xor r10d, r10d
mov byte [rax + 0x31], 0
mov qword [rax + 0x40], 0
mov dword [rax + 0x3c], ecx
mov word [rax + 0x32], r10w
movzx ecx, byte [rbx + 0xc]
mov byte [rax + 0x48], cl
movsx r10d, byte [rbx + 0xd]
mov dword [rax + 0x4c], r10d
movsx r11d, byte [rbx + 0xe]
mov dword [rax + 0x50], r11d
test r11b, r11b
jle 0x1402523a9
test byte [r8 + rcx], 1
jne 0x140252420
movsx ecx, byte [rbx + 0xf]
mov byte [rax + 0x49], 0
mov qword [rax + 0x58], 0
mov dword [rax + 0x54], ecx
xor ecx, ecx
mov word [rax + 0x4a], cx
movzx ecx, byte [rbx + 0x10]
mov byte [rax + 0x60], cl
movsx r10d, byte [rbx + 0x11]
mov dword [rax + 0x64], r10d
movsx r10d, byte [rbx + 0x12]
mov dword [rax + 0x68], r10d
test byte [r8 + rcx], 1
je 0x1402523e7
test r10b, r10b
jg 0x140252410
movsx edx, byte [rbx + 0x13]
mov byte [rax + 0x61], 0
mov qword [rax + 0x70], 0
mov dword [rax + 0x6c], edx
xor edx, edx
mov word [rax + 0x62], dx
mov dword [rsi + 0x90], r9d
add rsp, 0x28
pop rbx
pop rsi
ret
add edx, r10d
mov dword [rax + 0x68], edx
jmp 0x1402523e7
add r11d, edx
mov dword [rax + 0x50], r11d
jmp 0x1402523a9
add r11d, edx
mov dword [rax + 0x38], r11d
jmp 0x140252369
add r11d, edx
mov dword [rax + 0x20], r11d
jmp 0x140252325
add r11d, edx
mov dword [rax + 8], r11d
jmp 0x1402522e3
call sym.growOpArray.constprop.0
test eax, eax
jne 0x140252478
mov edx, dword [rsi + 0x90]
lea r9d, [rdx + 5]
jmp 0x1402522a3
xor eax, eax
jmp 0x140252407
Function at 0x140299c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
mov r12, rcx
mov rcx, qword [r8]
mov rsi, r8
movzx eax, word [rcx + 0x14]
mov edx, eax
and dx, 0x202
cmp dx, 0x202
je 0x140299d68
xor ebx, ebx
test al, 1
jne 0x140299cd3
mov edx, 1
call sym.valueToText
mov rcx, qword [rsi]
mov rbx, rax
movzx eax, word [rcx + 0x14]
test al, 2
je 0x140299ce1
cmp byte [rcx + 0x16], 1
je 0x140299d7e
test al, 0x10
jne 0x140299d48
xor r8d, r8d
test al, 1
jne 0x140299cf9
mov edx, 1
call sym.valueBytes
mov r8d, eax
test rbx, rbx
je 0x140299d59
movsxd rsi, r8d
lea r13, [rsi + 1]
test r12, r12
je 0x140299ea0
mov rcx, qword [r12]
mov rax, qword [rcx + 0x18]
movsxd rax, dword [rax + 0x88]
cmp r13, rax
jg 0x140299d90
cmp rsi, 0x7ffffefe
jbe 0x140299dd0
mov rcx, r12
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
jmp sym.sqlite3_result_error_nomem
mov r8d, dword [rcx + 0x10]
test ah, 4
je 0x140299cf9
add r8d, dword [rcx]
test rbx, rbx
jne 0x140299cfe
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
cmp byte [rcx + 0x16], 1
jne 0x140299cb9
mov rbx, qword [rcx + 8]
test al, 2
je 0x140299ce1
mov r8d, dword [rcx + 0x10]
jmp 0x140299cf9
mov dword [r12 + 0x24], 0x12
mov r9d, 1
mov r8, 0xffffffffffffffff
lea rdx, [0x140332721]
mov qword [rsp + 0x20], 0
call sym.sqlite3VdbeMemSetStr
nop
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov eax, dword [0x1402ba6c0]
test eax, eax
jne 0x140299e60
mov dword [rsp + 0x3c], r8d
mov ecx, r13d
call qword [0x1402ba6e0]
mov r8d, dword [rsp + 0x3c]
mov r10, rax
test r10, r10
je 0x140299d2f
xor edx, edx
lea r9, [0x140344300]
test r8d, r8d
jle 0x140299e30
nop dword [rax + rax]
movzx eax, byte [rbx + rdx]
mov rcx, rax
movzx eax, byte [r9 + rax]
and eax, 0x20
not eax
and eax, ecx
mov byte [r10 + rdx], al
add rdx, 1
cmp rdx, rsi
jne 0x140299e10
lea rax, [sym.sqlite3_free]
mov r9d, 1
mov rdx, r10
mov rcx, r12
mov qword [rsp + 0x20], rax
call sym.setResultStrOrError
nop
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, qword [0x1402ba340]
test rcx, rcx
je 0x140299e7c
mov dword [rsp + 0x3c], r8d
call qword [0x1402ba740]
mov r8d, dword [rsp + 0x3c]
mov rcx, r13
mov dword [rsp + 0x3c], r8d
call sym.sqlite3Malloc.part.0
mov r8d, dword [rsp + 0x3c]
mov r10, rax
jmp 0x140299df4
mov eax, dword [0x88]
ud2
Function at 0x14029b3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0xc0
mov rbx, r8
mov rsi, r9
movzx r8d, byte [r8 + 8]
cmp byte [rcx + 0x16], r8b
jne 0x14029b400
mov r11d, dword [rcx + 0x10]
mov rax, qword [rdx + 8]
mov r10, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rdx + 0x10]
mov edx, r11d
mov r8, qword [rcx + 8]
mov rcx, r10
call qword [rbx + 0x18]
add rsp, 0xc0
pop rbx
pop rsi
pop r12
ret
mov rax, qword [rcx + 0x18]
movdqu xmm0, xmmword [rcx]
mov dword [rsp + 0x60], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x98], rax
mov rax, qword [rcx + 0x10]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
movzx eax, word [rcx + 0x14]
test ah, 0x20
jne 0x14029b44a
and ah, 0x8f
or ah, 0x40
mov word [rsp + 0x54], ax
movdqu xmm1, xmmword [rdx]
mov rcx, qword [rdx + 0x10]
movzx edx, word [rdx + 0x14]
mov qword [rsp + 0x90], rcx
movups xmmword [rsp + 0x80], xmm1
test dh, 0x20
jne 0x14029b479
and dh, 0x8f
or dh, 0x40
mov word [rsp + 0x94], dx
movzx edx, r8b
xor r12d, r12d
test al, 1
jne 0x14029b498
lea rcx, [rsp + 0x40]
call sym.valueToText
movzx edx, byte [rbx + 8]
mov r12, rax
mov r8d, edx
movzx eax, word [rsp + 0x94]
mov ecx, eax
and cx, 0x202
cmp cx, 0x202
je 0x14029b550
test al, 1
jne 0x14029b520
lea rcx, [rsp + 0x80]
call sym.valueToText
test r12, r12
je 0x14029b520
test rax, rax
je 0x14029b520
mov rcx, qword [rbx + 0x10]
mov edx, dword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, r12
mov r9d, dword [rsp + 0x90]
call qword [rbx + 0x18]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x14029b532
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x14029b3ee
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], eax
call sym.vdbeMemClear
mov eax, dword [rsp + 0x3c]
add rsp, 0xc0
pop rbx
pop rsi
pop r12
ret
test rsi, rsi
je 0x14029b528
mov byte [rsi], 7
mov ecx, dword [rsp + 0x60]
xor eax, eax
test ecx, ecx
je 0x14029b4f0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
call sym.vdbeMemClear
mov eax, dword [rsp + 0x3c]
jmp 0x14029b4f0
cmp byte [rsp + 0x96], r8b
jne 0x14029b4b2
mov rax, qword [rsp + 0x88]
jmp 0x14029b4c3
Function at 0x1400014dc
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400014fa
movsxd rdx, dword [rcx + 0x3c]
xor eax, eax
add rdx, rcx
cmp dword [rdx], 0x4550
cmove rax, rdx
ret
xor eax, eax
ret

Function at 0x140001578
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword gs:[0x60]
mov rax, qword [rdi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
jmp 0x1400015b7
mov rcx, qword [rbx + 0x50]
lea rdx, str.kernel32.dll
call fcn.140003608
test eax, eax
je 0x1400015c9
mov rax, qword [rdi + 0x18]
mov rbx, qword [rbx]
add rax, 0x20
cmp rbx, rax
jne 0x140001598
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400015be
Function at 0x140023df0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r15
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x140023e25
or rax, 0xffffffffffffffff
add rsp, 0x78
pop r15
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x90], rbx
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.140023f90
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
xor ebx, ebx
test eax, eax
jle 0x140023f29
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x70], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140023f90
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jl 0x140023ea0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x98]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.14000ba50
mov esi, eax
cmp dword [rsp + 0x40], ebx
jle 0x140023f69
mov rdi, r14
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x140023f69
call fcn.140023f98
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jl 0x140023f50
mov rcx, r14
call fcn.140023f98
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
add rsp, 0x78
pop r15
pop rdi
ret
Function at 0x18005ed00
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [0x1801b2840], rcx
mov rbx, rcx
test edx, edx
je 0x18005ed55
cmp edx, 1
jne 0x18005ed60
call fcn.18005e800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov r9, qword [0x1801b2840]
lea r8, [0x18005e620]
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
mov eax, 1
xchg byte [0x1801b2838], al
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x18005f230
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18018e040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.1801266ec
lea rcx, [0x18005e4c0]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18005f2e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x18005f2ad
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180126690
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x180063f00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180063f5d
lea rbx, [0x18015f5b0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180063f44
cmp r10, 2
jb 0x180063f44
cmp byte [r9], r8b
jne 0x180063f44
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180063f20
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180063f9f
lea rbx, [0x18015f5b0]
cmp r8b, 0x23
jne 0x180063f83
cmp byte [r9], r8b
jne 0x180063f83
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180063f70
mov rbx, qword [rsp + 8]
not eax
ret