joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140186200
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov rbx, rcx
jle 0x140186240
mov edx, edx
xor eax, eax
lea r8, [rbx + rdx]
nop dword [rax]
movsx ecx, byte [rbx]
lea edx, [rax*8]
add rbx, 1
xor eax, ecx
xor eax, edx
cmp rbx, r8
jne 0x140186218
and eax, 0x7fffffff
add rsp, 0x20
pop rbx
ret
call sym.strlen
mov rcx, rax
mov edx, eax
xor eax, eax
test ecx, ecx
jg 0x14018620c
add rsp, 0x20
pop rbx
ret
Function at 0x1401c7570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14d, dword [rcx + 0x80]
movsxd rdx, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x78]
mov rbp, rdx
imul rdx, rdx, 0x38
call sym.sqlite3Realloc
test rax, rax
mov rdi, rax
je 0x1401c76c7
movsxd rbx, r14d
mov r8d, ebp
xor edx, edx
imul rbx, rbx, 0x38
sub r8d, r14d
xor r13d, r13d
lea r12, [0x1402b2060]
movsxd r8, r8d
imul r8, r8, 0x38
add rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_memset
cmp r14d, ebp
mov qword [rsi + 0x78], rdi
jge 0x1401c769f
nop dword [rax]
mov rax, qword [rsi + 0x50]
mov r15d, dword [rsi + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r15d
je 0x1401c76a8
mov rax, qword [rsi + 0x60]
test rax, rax
jle 0x1401c76a8
mov qword [rbx], rax
mov eax, dword [rsi + 0x3c]
mov dword [rbx + 0x1c], eax
mov eax, dword [r12]
test eax, eax
je 0x1401c7700
mov rcx, qword [0x1402b1d00]
test rcx, rcx
je 0x1401c7632
call qword [0x1402b20e0]
mov ecx, 0x200
call sym.sqlite3Malloc.part.0
mov rdx, rax
test rdx, rdx
je 0x1401c76b8
mov rax, r13
mov ecx, 0x40
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rdx], r15d
mov qword [rbx + 0x10], rdx
mov rax, qword [rsi + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x1401c76e0
mov edx, dword [rax + 0x58]
add r14d, 1
add rbx, 0x38
mov dword [rbx - 0x14], edx
mov edx, dword [rax + 0x60]
mov dword [rbx - 0x10], edx
mov edx, dword [rax + 0x64]
mov dword [rbx - 0xc], edx
mov eax, dword [rax + 0x88]
mov dword [rbx - 8], eax
cmp ebp, r14d
mov dword [rsi + 0x80], r14d
jne 0x1401c75e8
xor eax, eax
jmp 0x1401c76cc
mov eax, dword [rsi + 0xb8]
jmp 0x1401c760b
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r14d, 1
add rbx, 0x38
cmp r14d, ebp
mov dword [rsi + 0x80], r14d
jne 0x1401c75e8
xor eax, eax
jmp 0x1401c76cc
mov ecx, 0x200
call qword [0x1402b2080]
mov rdx, rax
jmp 0x1401c763f
Function at 0x1401d0000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [rcx]
test edx, edx
mov rdi, qword [rax + 0x18]
mov rsi, rcx
mov ebx, edx
mov rbp, r8
jg 0x1401d0028
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, qword [r8]
test rcx, rcx
je 0x1401d001b
movzx eax, word [rcx + 0x14]
mov edx, eax
not edx
test dx, 0x202
je 0x1401d0108
test al, 1
jne 0x1401d001b
mov edx, 1
call sym.valueToText
mov rdx, rax
test rdx, rdx
je 0x1401d001b
mov eax, dword [rdi + 0x88]
sub ebx, 1
mov ecx, 0x200
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], ebx
lea r8, [rbp + 8]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x48], r8
mov word [rsp + 0x6c], cx
lea r8, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], 0
call sym.sqlite3_str_appendf
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x68]
test rdx, rdx
je 0x1401d00df
mov eax, r8d
mov byte [rdx + rax], 0
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x1401d00da
test byte [rsp + 0x6d], 4
je 0x1401d0120
mov rdx, qword [rsp + 0x58]
lea rax, [sym.sqlite3OomClear]
mov r9d, 1
mov rcx, rsi
mov qword [rsp + 0x20], rax
call sym.setResultStrOrError
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp byte [rcx + 0x16], 1
jne 0x1401d0043
mov rdx, qword [rcx + 8]
jmp 0x1401d0054
mov rcx, rbx
mov dword [rsp + 0x3c], r8d
call sym.strAccumFinishRealloc
mov r8d, dword [rsp + 0x3c]
mov rdx, rax
jmp 0x1401d00df

Function at 0x1401d7160
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r12d, dword [rsp + 0x90]
mov byte [rcx + 0x1c], 1
mov edi, r8d
mov rsi, rdx
mov rbp, r9
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rbx, rcx
mov dword [rsp + 0x20], r8d
mov r8, rdx
mov dword [rsp + 0x30], r12d
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
call sym.sqlite3NestedParse
test edi, edi
je 0x1401d71b8
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, rbp
mov r8, rsi
mov rcx, rbx
mov dword [rsp + 0x90], r12d
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.sqlite3NestedParse
Function at 0x1401dd4e0
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
lea rsi, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movq xmm1, rax
movq xmm0, rsi
punpcklqdq xmm0, xmm1
movsxd rax, edx
mov rbx, rcx
mov edi, edx
movaps xmmword [rsp + 0x40], xmm0
lea r13, [rax + 4]
mov rbp, r8
mov r12, r9
mov rsi, qword [rcx + r13*8 + 8]
test rsi, rsi
je 0x1401dd5d0
mov r9d, dword [rbx + 0x40]
test r9d, r9d
je 0x1401dd548
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edx, edx
mov rcx, rsi
call sym.vdbeUnbind
test eax, eax
jne 0x1401dd585
mov rcx, qword [rsi + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x1401dd5c0
mov r8d, 4
mov qword [rcx], rbp
mov word [rcx + 0x14], r8w
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1401dd585
call qword [0x1402b20f0]
mov rcx, rsi
call sym.sqlite3_step
cmp eax, 0x65
je 0x1401dd5f0
cmp eax, 0x64
je 0x1401dd628
mov rcx, rsi
call sym.sqlite3_reset
mov edx, dword [rbx + 0x40]
test edx, edx
jne 0x1401dd536
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rbp
call sym.vdbeReleaseAndSetInt64
jmp 0x1401dd573
mov rdx, qword [rsp + rax*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call sym.rtreeCheckPrepare
mov rsi, rax
mov qword [rbx + r13*8 + 8], rax
jmp 0x1401dd52d
test edi, edi
mov r9, r12
mov r8, rbp
lea rdx, str.__rowid
mov rcx, rbx
lea rax, str.__parent
cmovne rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call sym.rtreeCheckAppendMsg
jmp 0x1401dd59b
mov rcx, rsi
call sym.sqlite3_column_int64.constprop.0
cmp r12, rax
mov r9, rax
je 0x1401dd59b
test edi, edi
mov qword [rsp + 0x30], r12
mov r8, rbp
mov rcx, rbx
lea rdx, str.__rowid
mov qword [rsp + 0x28], rbp
lea rax, str.__parent
cmovne rax, rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call sym.rtreeCheckAppendMsg
jmp 0x1401dd59b
Function at 0x140204020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
cmp byte [rcx + 0x23], 0
mov rbx, rcx
mov ebp, r8d
je 0x1402040f8
mov eax, 2
test rdx, rdx
mov dword [rsp + 0x58], 0
mov word [rsp + 0x54], ax
lea rsi, [sym.exprNodeIsConstant]
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rsi
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
je 0x1402040d0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
call sym.walkExpr
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
jne 0x1402040d0
mov rdi, qword [rbx]
mov rcx, rdi
call sym.exprDup.constprop.0
cmp byte [rdi + 0x67], 0
mov rsi, rax
jne 0x1402040b5
cmp qword [rbx + 0x10], 0
je 0x1402040b5
mov r8d, ebp
mov rdx, rax
mov rcx, rbx
call sym.sqlite3ExprCode.part.0
test rsi, rsi
je 0x1402040e8
mov rdx, rsi
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3ExprDeleteNN
mov r8d, ebp
mov rcx, rbx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3ExprCodeRunJustOnce
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
test rdx, rdx
mov rdi, qword [rcx]
jne 0x14020408f
cmp byte [rdi + 0x67], 0
jne 0x1402040e8
cmp qword [rcx + 0x10], 0
je 0x1402040e8
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3ExprCode.part.0
Function at 0x140207fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
test rdx, rdx
mov rbx, rcx
mov rsi, r8
je 0x140207fe6
nop word [rax + rax]
mov eax, dword [rdx + 4]
test eax, 0x82000
je 0x140208043
test eax, 0x80000
je 0x140208030
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x140207fc8
movzx eax, byte [rbx + 0x1f]
test al, al
je 0x1402080f0
sub eax, 1
mov byte [rbx + 0x1f], al
movzx eax, al
mov edi, dword [rbx + rax*4 + 0xe4]
mov r8d, edi
mov rcx, rbx
call sym.sqlite3ExprCodeTarget
cmp eax, edi
je 0x1402080e0
test edi, edi
jne 0x1402080c0
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x140207fe6
mov eax, dword [rdx + 4]
test eax, 0x82000
jne 0x140207fd2
cmp byte [rbx + 0x23], 0
je 0x140207fe6
cmp byte [rdx], 0xb0
je 0x140207fe6
lea rcx, [rsp + 0x30]
mov eax, 2
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x54], ax
lea rdi, [sym.exprNodeIsConstant]
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rdi
mov dword [rsp + 0x58], 0
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
call sym.walkExpr
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
je 0x140207fe6
mov r8d, 0xffffffff
mov rcx, rbx
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
jmp sym.sqlite3ExprCodeRunJustOnce
movzx edx, byte [rbx + 0x1f]
cmp dl, 7
ja 0x14020801d
lea ecx, [rdx + 1]
mov byte [rbx + 0x1f], cl
mov dword [rbx + rdx*4 + 0xe4], edi
jmp 0x14020801d
mov dword [rsi], edi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x38]
lea edi, [rax + 1]
mov dword [rbx + 0x38], edi
jmp 0x140208002
Function at 0x14021fbd0
Capabilities:
Reference sql statements

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [rcx + 0x68]
mov r13, qword [rcx]
test rsi, rsi
mov rdi, rcx
mov r12, rdx
mov r14d, dword [r13 + 0x18]
mov rbx, r8
je 0x14021fc80
mov rcx, rsi
call sym.sqlite3_reset
xor edx, edx
mov rcx, rsi
call sym.vdbeUnbind
test eax, eax
jne 0x14021fc42
mov rcx, qword [rsi + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x14021fdf0
mov eax, 4
mov qword [rcx], r12
mov word [rcx + 0x14], ax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x14021fc42
call qword [0x1402b20f0]
mov rcx, rsi
call sym.sqlite3_step
cmp eax, 0x64
je 0x14021fd00
mov rcx, rsi
call sym.sqlite3_reset
mov ebp, eax
test eax, eax
mov eax, 0x10b
cmove ebp, eax
mov eax, ebp
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [r13 + 8]
lea rcx, str.SELECT_sz_FROM__Q._q_docsize_WHERE_id_
mov ebp, 7
mov r8, qword [r13 + 0x10]
call sym.sqlite3_mprintf
test rax, rax
mov rsi, rax
je 0x14021fce0
mov rax, qword [rdi]
xor r9d, r9d
mov r8d, 0x85
mov rdx, rsi
mov rcx, qword [r13]
add dword [rax + 0x78], 1
lea rax, [rdi + 0x68]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.sqlite3LockAndPrepare.constprop.0
mov rcx, rsi
mov ebp, eax
mov rax, qword [rdi]
sub dword [rax + 0x78], 1
call sym.sqlite3_free
mov rsi, qword [rdi + 0x68]
mov rcx, rsi
call sym.sqlite3_reset
test rsi, rsi
je 0x14021fc67
jmp 0x14021fc03
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x14021fd12
call qword [0x1402b20e0]
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x14021fe00
cmp word [rsi + 0xc0], 0
je 0x14021fe00
call sym.sqlite3_value_blob
mov rcx, rsi
mov r13, rax
call sym.columnMallocFailure
xor edx, edx
mov rcx, rsi
call sym.columnMem
mov rcx, rax
call sym.sqlite3ValueBytes.constprop.0
mov rcx, rsi
mov r12d, eax
call sym.columnMallocFailure
test r14d, r14d
jle 0x14021fe55
test r12d, r12d
jle 0x14021fc53
lea eax, [r14 - 1]
xor ebp, ebp
lea r14, [rbx + rax*4]
lea rdi, [rsp + 0x38]
jmp 0x14021fdce
movzx r8d, byte [rcx + 1]
test r8b, r8b
jns 0x14021fe20
movzx eax, byte [rcx + 2]
shl edx, 0xe
or edx, eax
test al, 0x80
je 0x14021fe38
mov rdx, rdi
call sym.sqlite3Fts5GetVarint
mov edx, dword [rsp + 0x38]
movzx eax, al
and edx, 0x7fffffff
mov dword [rbx], edx
add ebp, eax
cmp r14, rbx
je 0x14021fe60
add rbx, 4
cmp ebp, r12d
jge 0x14021fc53
movsxd rcx, ebp
add rcx, r13
movzx edx, byte [rcx]
test dl, dl
mov eax, edx
js 0x14021fd80
mov dword [rbx], edx
mov eax, 1
jmp 0x14021fdb6
mov rdx, r12
call sym.vdbeReleaseAndSetInt64
jmp 0x14021fc30
mov rcx, qword [rsi]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call sym.sqlite3ErrorFinish
lea rcx, [0x14033b9e0]
jmp 0x14021fd30
and eax, 0x7f
shl eax, 7
or eax, r8d
mov dword [rbx], eax
mov eax, 2
jmp 0x14021fdb6
and r8d, 0x7f
and edx, 0x1fc07f
mov eax, 3
shl r8d, 7
or edx, r8d
mov dword [rbx], edx
jmp 0x14021fdb6
xor ebp, ebp
nop word [rax + rax]
cmp r12d, ebp
jne 0x14021fc53
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.sqlite3_reset
Function at 0x140220560
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [rsp + 0x90]
test rcx, rcx
mov r12d, edx
mov rsi, r8
mov dword [rbp], 0
mov r13d, r9d
mov dword [rsp + 0x2c], 0
je 0x14022062e
mov eax, r9d
sub eax, 1
js 0x140220698
movsxd rdi, r9d
movsxd rdx, eax
mov eax, eax
lea r9, [r8 + rdi - 2]
add rdx, r8
sub r9, rax
mov eax, 0xd
nop dword [rax + rax]
lea r8d, [rax*8]
sub rdx, 1
xor eax, r8d
movsx r8d, byte [rdx + 1]
xor eax, r8d
cmp rdx, r9
jne 0x1402205c0
lea edx, [rax*8]
xor eax, edx
xor eax, r12d
and eax, 0x1ff
lea r14, [rcx + rax*8]
mov rbx, qword [r14]
test rbx, rbx
jne 0x140220609
jmp 0x140220640
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140220640
cmp dword [rbx + 0xc], r12d
jne 0x140220600
cmp dword [rbx + 8], r13d
jne 0x140220600
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140220600
mov dword [rbp], 1
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, [rdi + 0x18]
lea rcx, [rsp + 0x2c]
call sym.sqlite3Fts5MallocZero
test rax, rax
mov rbx, rax
je 0x140220685
lea rcx, [rax + 0x18]
movd xmm1, r12d
movd xmm0, r13d
punpckldq xmm0, xmm1
mov qword [rax], rcx
mov r8, rdi
mov rdx, rsi
movq qword [rax + 8], xmm0
call sym.memcpy
mov rax, qword [r14]
mov qword [rbx + 0x10], rax
mov qword [r14], rbx
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 0x68
mov eax, 0xd
movsxd rdi, r9d
jmp 0x1402205e3

Function at 0x14022d890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r9d, word [rcx + 0x14]
movzx r10d, word [rdx + 0x14]
mov eax, r9d
or eax, r10d
test al, 1
jne 0x14022d900
test al, 0x2c
je 0x14022d8e0
mov eax, r9d
and eax, r10d
test al, 0x24
jne 0x14022d910
test al, 8
je 0x14022d920
movsd xmm1, qword [rcx]
movsd xmm0, qword [rdx]
comisd xmm0, xmm1
ja 0x14022d96c
xor eax, eax
comisd xmm1, xmm0
seta al
jmp 0x14022d8dd
fstp st(0)
fstp st(0)
jmp 0x14022d8dd
fstp st(0)
fstp st(0)
ret
test al, 2
je 0x14022d8f9
and r9d, 2
je 0x14022d950
and r10d, 2
je 0x14022d96c
test r8, r8
jne 0x14022d978
jmp sym.sqlite3BlobCompare
and r10d, 1
and r9d, 1
mov eax, r10d
sub eax, r9d
ret
mov rax, qword [rdx]
cmp qword [rcx], rax
jl 0x14022d96c
setg al
movzx eax, al
ret
test r9b, 0x24
jne 0x14022d960
and r9d, 8
mov eax, 1
je 0x14022d8dd
and r10d, 0x24
je 0x14022d96c
fild qword [rdx]
fld qword [rcx]
fcomi st(1)
ja 0x14022d8d3
fxch st(1)
xor eax, eax
fcompi st(1)
fstp st(0)
seta al
neg eax
ret
mov eax, 1
ret
test r10b, 8
jne 0x14022d980
and r10d, 0x24
jne 0x14022d910
mov eax, 0xffffffff
ret
xor r9d, r9d
jmp sym.vdbeCompareMemString
fild qword [rcx]
mov eax, 0xffffffff
fld qword [rdx]
fcomi st(1)
ja 0x14022d8d9
fxch st(1)
xor eax, eax
fcompi st(1)
fstp st(0)
seta al
ret
Function at 0x14024b780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov edx, dword [rcx + 0x90]
mov rsi, rcx
lea r9d, [rdx + 5]
cmp r9d, dword [rcx + 0x94]
jg 0x14024b998
movsxd rax, edx
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x88]
lea rax, [rax + rcx*8]
movzx ecx, byte [rbx]
mov byte [rax], cl
movsx r11d, byte [rbx + 2]
movsx r8d, byte [rbx + 1]
movd xmm1, r11d
test r11b, r11b
movd xmm0, r8d
punpckldq xmm0, xmm1
lea r8, [0x14033c980]
movq qword [rax + 4], xmm0
jle 0x14024b7ef
test byte [r8 + rcx], 1
jne 0x14024b988
movsx ecx, byte [rbx + 3]
xor edi, edi
mov byte [rax + 1], 0
mov qword [rax + 0x10], 0
mov word [rax + 2], di
mov dword [rax + 0xc], ecx
movzx ecx, byte [rbx + 4]
mov byte [rax + 0x18], cl
movsx r10d, byte [rbx + 6]
movsx edi, byte [rbx + 5]
test byte [r8 + rcx], 1
movd xmm2, r10d
movd xmm0, edi
punpckldq xmm0, xmm2
movq qword [rax + 0x1c], xmm0
je 0x14024b83a
test r10b, r10b
jg 0x14024b978
movsx ecx, byte [rbx + 7]
xor r11d, r11d
mov byte [rax + 0x19], 0
mov qword [rax + 0x28], 0
mov word [rax + 0x1a], r11w
mov dword [rax + 0x24], ecx
movzx ecx, byte [rbx + 8]
mov byte [rax + 0x30], cl
movsx r11d, byte [rbx + 0xa]
movsx edi, byte [rbx + 9]
movd xmm3, r11d
test r11b, r11b
movd xmm0, edi
punpckldq xmm0, xmm3
movq qword [rax + 0x34], xmm0
jle 0x14024b887
test byte [r8 + rcx], 1
jne 0x14024b968
movsx ecx, byte [rbx + 0xb]
xor r10d, r10d
mov byte [rax + 0x31], 0
mov qword [rax + 0x40], 0
mov word [rax + 0x32], r10w
mov dword [rax + 0x3c], ecx
movzx ecx, byte [rbx + 0xc]
mov byte [rax + 0x48], cl
movsx r11d, byte [rbx + 0xe]
movsx edi, byte [rbx + 0xd]
movd xmm4, r11d
test r11b, r11b
movd xmm0, edi
punpckldq xmm0, xmm4
movq qword [rax + 0x4c], xmm0
jle 0x14024b8d4
test byte [r8 + rcx], 1
jne 0x14024b958
movsx ecx, byte [rbx + 0xf]
mov byte [rax + 0x49], 0
mov qword [rax + 0x58], 0
mov dword [rax + 0x54], ecx
xor ecx, ecx
mov word [rax + 0x4a], cx
movzx ecx, byte [rbx + 0x10]
mov byte [rax + 0x60], cl
movsx r10d, byte [rbx + 0x12]
movsx edi, byte [rbx + 0x11]
test byte [r8 + rcx], 1
movd xmm5, r10d
movd xmm0, edi
punpckldq xmm0, xmm5
movq qword [rax + 0x64], xmm0
je 0x14024b91b
test r10b, r10b
jg 0x14024b948
movsx edx, byte [rbx + 0x13]
mov byte [rax + 0x61], 0
mov qword [rax + 0x70], 0
mov dword [rax + 0x6c], edx
xor edx, edx
mov word [rax + 0x62], dx
mov dword [rsi + 0x90], r9d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
add r10d, edx
mov dword [rax + 0x68], r10d
jmp 0x14024b91b
add r11d, edx
mov dword [rax + 0x50], r11d
jmp 0x14024b8d4
add r11d, edx
mov dword [rax + 0x38], r11d
jmp 0x14024b887
add r10d, edx
mov dword [rax + 0x20], r10d
jmp 0x14024b83a
add r11d, edx
mov dword [rax + 8], r11d
jmp 0x14024b7ef
call sym.growOpArray.isra.0
test eax, eax
jne 0x14024b9b0
mov edx, dword [rsi + 0x90]
lea r9d, [rdx + 5]
jmp 0x14024b7a4
xor eax, eax
jmp 0x14024b93b
Function at 0x14028e6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xc0
mov rsi, r8
movzx r8d, byte [r8 + 8]
mov rax, rcx
mov rdi, r9
cmp byte [rcx + 0x16], r8b
jne 0x14028e700
mov r10d, dword [rcx + 0x10]
mov r8, qword [rdx + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], r8
mov r9d, dword [rdx + 0x10]
mov edx, r10d
mov r8, qword [rax + 8]
call qword [rsi + 0x18]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x60], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x98], rcx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movzx ecx, word [rax + 0x14]
test ch, 0x20
jne 0x14028e752
and ch, 0x8f
or ch, 0x40
mov word [rsp + 0x54], cx
mov rax, qword [rdx]
mov qword [rsp + 0x80], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x88], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x90], rax
movzx eax, word [rdx + 0x14]
test ah, 0x20
jne 0x14028e78c
and ah, 0x8f
or ah, 0x40
mov word [rsp + 0x94], ax
xor ebx, ebx
and ecx, 1
jne 0x14028e7a9
lea rcx, [rsp + 0x40]
movzx edx, r8b
call sym.valueToText
movzx r8d, byte [rsi + 8]
mov rbx, rax
movzx eax, word [rsp + 0x94]
mov edx, eax
not edx
test dx, 0x202
je 0x14028e860
test al, 1
jne 0x14028e838
lea rcx, [rsp + 0x80]
movzx edx, r8b
call sym.valueToText
test rbx, rbx
je 0x14028e838
test rax, rax
je 0x14028e838
mov rcx, qword [rsi + 0x10]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x90]
mov edx, dword [rsp + 0x50]
call qword [rsi + 0x18]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x14028e84a
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x14028e6ed
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], eax
call sym.vdbeMemClear
mov eax, dword [rsp + 0x3c]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
test rdi, rdi
je 0x14028e840
mov byte [rdi], 7
mov ecx, dword [rsp + 0x60]
xor eax, eax
test ecx, ecx
je 0x14028e802
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
call sym.vdbeMemClear
mov eax, dword [rsp + 0x3c]
jmp 0x14028e802
cmp byte [rsp + 0x96], r8b
jne 0x14028e7c0
mov rax, qword [rsp + 0x88]
jmp 0x14028e7d5
Function at 0x1e48a8a80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1e48a8c2b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1e4c10c70]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1e48c44c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x1e48a8aee
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x1e48a8b01
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x1e48a8b25
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x1e48a8b39
cmp rbx, 0x1000
jae 0x1e48a8af8
nop
jmp 0x1e48a8ba9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x1e48a8b4d
xor edx, edx
jmp 0x1e48a8ba0
mov rcx, qword [0x1e4c10c70]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1e48c44c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x1e48a8b2f
jmp 0x1e48a8b15
call fcn.1e48f5900
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.1e48c8ac0
lea rax, [0x1e4ca632f]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.1e48c93c0
mov rax, qword [rsp + 0x38]
call fcn.1e48c90c0
lea rax, [0x1e4ca6467]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.1e48c93c0
mov rax, qword [rsp + 0x30]
call fcn.1e48c90c0
call fcn.1e48c8d20
call fcn.1e48c8b40
lea rax, [0x1e4cab8d9]
mov ebx, 0x21
call fcn.1e48c7320
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.1e48f1d00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1e48a8a80