joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140248f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movzx eax, byte [rdx]
cmp al, 0xb0
mov rdi, rdx
mov rsi, rcx
mov edx, eax
jne 0x140248fa8
movzx edx, byte [rdi + 2]
cmp dl, 0xb1
je 0x140249138
cmp dl, 0x8a
je 0x140248fe0
movaps xmm6, xmmword [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1402ed7c0
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdx + 0x20]
mov ebp, dword [rcx]
cmp ebp, 1
je 0x140248fb6
cmp al, 0x8a
mov dword [r8], 0
je 0x140249148
mov eax, dword [rsi + 0x38]
lea r13d, [rax + 1]
add eax, ebp
test ebp, ebp
mov dword [rsi + 0x38], eax
jle 0x14024911a
lea rax, [0x140327a20]
xor ebx, ebx
lea rcx, [0x14024a260]
movq xmm0, rax
lea r14, [rsp + 0x30]
movq xmm6, rcx
punpcklqdq xmm6, xmm0
jmp 0x1402490c7
mov eax, 2
test rdx, rdx
movups xmmword [rsp + 0x38], xmm6
mov word [rsp + 0x54], ax
mov dword [rsp + 0x58], 0
je 0x140249108
mov rcx, r14
mov qword [rsp + 0x28], rdx
call fcn.14037ba20
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
jne 0x140249108
mov r15, qword [rsi]
mov rcx, r15
call fcn.140249650
cmp byte [r15 + 0x67], 0
mov rdx, rax
jne 0x1402490af
cmp qword [rsi + 0x10], 0
je 0x1402490af
mov r8d, r12d
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.1402e9210
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x1402490bc
mov rcx, r15
call fcn.1402ee4e0
add ebx, 1
cmp ebx, ebp
je 0x14024911a
mov rdx, qword [rdi + 0x20]
lea r12d, [r13 + rbx]
movsxd rax, ebx
shl rax, 5
cmp byte [rsi + 0x23], 0
mov rdx, qword [rdx + rax + 8]
jne 0x140249040
test rdx, rdx
mov r15, qword [rsi]
jne 0x140249081
cmp byte [r15 + 0x67], 0
jne 0x1402490bc
cmp qword [rsi + 0x10], 0
je 0x1402490bc
mov r8d, r12d
mov rcx, rsi
call fcn.1402e9210
jmp 0x1402490bc
mov r8d, r12d
mov rcx, rsi
add ebx, 1
call fcn.1402eae80
cmp ebx, ebp
jne 0x1402490c3
movaps xmm6, xmmword [rsp + 0x60]
mov eax, r13d
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rdi + 0x20]
mov ebp, dword [rdx]
jmp 0x140248fea
movaps xmm6, xmmword [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1402de850
Function at 0x1402acd80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14d, dword [rcx + 0x80]
movsxd rdx, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x78]
mov rbp, rdx
imul rdx, rdx, 0x38
call fcn.14031cee0
test rax, rax
mov rdi, rax
je 0x1402aced7
movsxd rbx, r14d
mov r8d, ebp
xor edx, edx
imul rbx, rbx, 0x38
sub r8d, r14d
xor r13d, r13d
lea r12, [0x140398100]
movsxd r8, r8d
imul r8, r8, 0x38
add rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_memset
cmp r14d, ebp
mov qword [rsi + 0x78], rdi
jge 0x1402aceaf
nop dword [rax]
mov rax, qword [rsi + 0x50]
mov r15d, dword [rsi + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r15d
je 0x1402aceb8
mov rax, qword [rsi + 0x60]
test rax, rax
jle 0x1402aceb8
mov qword [rbx], rax
mov eax, dword [rsi + 0x3c]
mov dword [rbx + 0x1c], eax
mov eax, dword [r12]
test eax, eax
je 0x1402acf10
mov rcx, qword [0x140397da0]
test rcx, rcx
je 0x1402ace42
call qword [0x140398180]
mov ecx, 0x200
call fcn.140312d00
mov rdx, rax
test rdx, rdx
je 0x1402acec8
mov rax, r13
mov ecx, 0x40
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rdx], r15d
mov qword [rbx + 0x10], rdx
mov rax, qword [rsi + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x1402acef0
mov edx, dword [rax + 0x58]
add r14d, 1
add rbx, 0x38
mov dword [rbx - 0x14], edx
mov edx, dword [rax + 0x60]
mov dword [rbx - 0x10], edx
mov edx, dword [rax + 0x64]
mov dword [rbx - 0xc], edx
mov eax, dword [rax + 0x88]
mov dword [rbx - 8], eax
cmp ebp, r14d
mov dword [rsi + 0x80], r14d
jne 0x1402acdf8
xor eax, eax
jmp 0x1402acedc
mov eax, dword [rsi + 0xb8]
jmp 0x1402ace1b
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r14d, 1
add rbx, 0x38
cmp r14d, ebp
mov dword [rsi + 0x80], r14d
jne 0x1402acdf8
xor eax, eax
jmp 0x1402acedc
mov ecx, 0x200
call qword [0x140398120]
mov rdx, rax
jmp 0x1402ace4f
Function at 0x1402bc970
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r12d, dword [rsp + 0x90]
mov byte [rcx + 0x1c], 1
mov edi, r8d
mov rsi, rdx
mov rbp, r9
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rbx, rcx
mov dword [rsp + 0x20], r8d
mov r8, rdx
mov dword [rsp + 0x30], r12d
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
call fcn.140313360
test edi, edi
je 0x1402bc9c8
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, rbp
mov r8, rsi
mov rcx, rbx
mov dword [rsp + 0x90], r12d
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140313360

Function at 0x1402c2cf0
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
lea rsi, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movq xmm1, rax
movq xmm0, rsi
punpcklqdq xmm0, xmm1
movsxd rax, edx
mov rbx, rcx
mov edi, edx
movaps xmmword [rsp + 0x40], xmm0
lea r13, [rax + 4]
mov rbp, r8
mov r12, r9
mov rsi, qword [rcx + r13*8 + 8]
test rsi, rsi
je 0x1402c2de0
mov r9d, dword [rbx + 0x40]
test r9d, r9d
je 0x1402c2d58
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edx, edx
mov rcx, rsi
call fcn.140377be0
test eax, eax
jne 0x1402c2d95
mov rcx, qword [rsi + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x1402c2dd0
mov r8d, 4
mov qword [rcx], rbp
mov word [rcx + 0x14], r8w
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1402c2d95
call qword [0x140398190]
mov rcx, rsi
call fcn.140361710
cmp eax, 0x65
je 0x1402c2e00
cmp eax, 0x64
je 0x1402c2e38
mov rcx, rsi
call fcn.14035e260
mov edx, dword [rbx + 0x40]
test edx, edx
jne 0x1402c2d46
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rbp
call fcn.140376360
jmp 0x1402c2d83
mov rdx, qword [rsp + rax*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call fcn.1402c3410
mov rsi, rax
mov qword [rbx + r13*8 + 8], rax
jmp 0x1402c2d3d
test edi, edi
mov r9, r12
mov r8, rbp
lea rdx, str.__rowid
mov rcx, rbx
lea rax, str.__parent
cmovne rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call fcn.1402c2af0
jmp 0x1402c2dab
mov rcx, rsi
call fcn.140353e40
cmp r12, rax
mov r9, rax
je 0x1402c2dab
test edi, edi
mov qword [rsp + 0x30], r12
mov r8, rbp
mov rcx, rbx
lea rdx, str.__rowid
mov qword [rsp + 0x28], rbp
lea rax, str.__parent
cmovne rax, rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call fcn.1402c2af0
jmp 0x1402c2dab
Function at 0x1402e9830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
cmp byte [rcx + 0x23], 0
mov rbx, rcx
mov ebp, r8d
je 0x1402e9908
mov eax, 2
test rdx, rdx
mov dword [rsp + 0x58], 0
mov word [rsp + 0x54], ax
lea rsi, [0x14024a260]
lea rax, [0x140327a20]
movq xmm0, rsi
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
je 0x1402e98e0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
call fcn.14037ba20
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
jne 0x1402e98e0
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.140249650
cmp byte [rdi + 0x67], 0
mov rsi, rax
jne 0x1402e98c5
cmp qword [rbx + 0x10], 0
je 0x1402e98c5
mov r8d, ebp
mov rdx, rax
mov rcx, rbx
call fcn.1402e9210
test rsi, rsi
je 0x1402e98f8
mov rdx, rsi
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1402ee4e0
mov r8d, ebp
mov rcx, rbx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1402eae80
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
test rdx, rdx
mov rdi, qword [rcx]
jne 0x1402e989f
cmp byte [rdi + 0x67], 0
jne 0x1402e98f8
cmp qword [rcx + 0x10], 0
je 0x1402e98f8
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1402e9210
Function at 0x1402ed7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
test rdx, rdx
mov rbx, rcx
mov rsi, r8
je 0x1402ed7f6
nop word [rax + rax]
mov eax, dword [rdx + 4]
test eax, 0x82000
je 0x1402ed853
test eax, 0x80000
je 0x1402ed840
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x1402ed7d8
movzx eax, byte [rbx + 0x1f]
test al, al
je 0x1402ed900
sub eax, 1
mov byte [rbx + 0x1f], al
movzx eax, al
mov edi, dword [rbx + rax*4 + 0xe4]
mov r8d, edi
mov rcx, rbx
call fcn.1402eb180
cmp eax, edi
je 0x1402ed8f0
test edi, edi
jne 0x1402ed8d0
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x1402ed7f6
mov eax, dword [rdx + 4]
test eax, 0x82000
jne 0x1402ed7e2
cmp byte [rbx + 0x23], 0
je 0x1402ed7f6
cmp byte [rdx], 0xb0
je 0x1402ed7f6
lea rcx, [rsp + 0x30]
mov eax, 2
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x54], ax
lea rdi, [0x14024a260]
lea rax, [0x140327a20]
movq xmm0, rdi
mov dword [rsp + 0x58], 0
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
call fcn.14037ba20
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
je 0x1402ed7f6
mov r8d, 0xffffffff
mov rcx, rbx
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
jmp fcn.1402eae80
movzx edx, byte [rbx + 0x1f]
cmp dl, 7
ja 0x1402ed82d
lea ecx, [rdx + 1]
mov byte [rbx + 0x1f], cl
mov dword [rbx + rdx*4 + 0xe4], edi
jmp 0x1402ed82d
mov dword [rsi], edi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x38]
lea edi, [rax + 1]
mov dword [rbx + 0x38], edi
jmp 0x1402ed812
Function at 0x1403053e0
Capabilities:
Reference sql statements

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [rcx + 0x68]
mov r13, qword [rcx]
test rsi, rsi
mov rdi, rcx
mov r12, rdx
mov r14d, dword [r13 + 0x18]
mov rbx, r8
je 0x140305490
mov rcx, rsi
call fcn.14035e260
xor edx, edx
mov rcx, rsi
call fcn.140377be0
test eax, eax
jne 0x140305452
mov rcx, qword [rsi + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x140305600
mov eax, 4
mov qword [rcx], r12
mov word [rcx + 0x14], ax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140305452
call qword [0x140398190]
mov rcx, rsi
call fcn.140361710
cmp eax, 0x64
je 0x140305510
mov rcx, rsi
call fcn.14035e260
mov ebp, eax
test eax, eax
mov eax, 0x10b
cmove ebp, eax
mov eax, ebp
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [r13 + 8]
lea rcx, str.SELECT_sz_FROM__Q._q_docsize_WHERE_id_
mov ebp, 7
mov r8, qword [r13 + 0x10]
call fcn.14035ca70
test rax, rax
mov rsi, rax
je 0x1403054f0
mov rax, qword [rdi]
xor r9d, r9d
mov r8d, 0x85
mov rdx, rsi
mov rcx, qword [r13]
add dword [rax + 0x78], 1
lea rax, [rdi + 0x68]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.140312880
mov rcx, rsi
mov ebp, eax
mov rax, qword [rdi]
sub dword [rax + 0x78], 1
call fcn.14035ad80
mov rsi, qword [rdi + 0x68]
mov rcx, rsi
call fcn.14035e260
test rsi, rsi
je 0x140305477
jmp 0x140305413
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140305522
call qword [0x140398180]
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x140305610
cmp word [rsi + 0xc0], 0
je 0x140305610
call fcn.140366a30
mov rcx, rsi
mov r13, rax
call fcn.14023f930
xor edx, edx
mov rcx, rsi
call fcn.14023f9a0
mov rcx, rax
call fcn.1403309c0
mov rcx, rsi
mov r12d, eax
call fcn.14023f930
test r14d, r14d
jle 0x140305665
test r12d, r12d
jle 0x140305463
lea eax, [r14 - 1]
xor ebp, ebp
lea r14, [rbx + rax*4]
lea rdi, [rsp + 0x38]
jmp 0x1403055de
movzx r8d, byte [rcx + 1]
test r8b, r8b
jns 0x140305630
movzx eax, byte [rcx + 2]
shl edx, 0xe
or edx, eax
test al, 0x80
je 0x140305648
mov rdx, rdi
call fcn.140300bd0
mov edx, dword [rsp + 0x38]
movzx eax, al
and edx, 0x7fffffff
mov dword [rbx], edx
add ebp, eax
cmp r14, rbx
je 0x140305670
add rbx, 4
cmp ebp, r12d
jge 0x140305463
movsxd rcx, ebp
add rcx, r13
movzx edx, byte [rcx]
test dl, dl
mov eax, edx
js 0x140305590
mov dword [rbx], edx
mov eax, 1
jmp 0x1403055c6
mov rdx, r12
call fcn.140376360
jmp 0x140305440
mov rcx, qword [rsi]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call fcn.1402e8360
lea rcx, [0x14047b600]
jmp 0x140305540
and eax, 0x7f
shl eax, 7
or eax, r8d
mov dword [rbx], eax
mov eax, 2
jmp 0x1403055c6
and r8d, 0x7f
and edx, 0x1fc07f
mov eax, 3
shl r8d, 7
or edx, r8d
mov dword [rbx], edx
jmp 0x1403055c6
xor ebp, ebp
nop word [rax + rax]
cmp r12d, ebp
jne 0x140305463
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.14035e260
Function at 0x140305d70
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [rsp + 0x90]
test rcx, rcx
mov r12d, edx
mov rsi, r8
mov dword [rbp], 0
mov r13d, r9d
mov dword [rsp + 0x2c], 0
je 0x140305e3e
mov eax, r9d
sub eax, 1
js 0x140305ea8
movsxd rdi, r9d
movsxd rdx, eax
mov eax, eax
lea r9, [r8 + rdi - 2]
add rdx, r8
sub r9, rax
mov eax, 0xd
nop dword [rax + rax]
lea r8d, [rax*8]
sub rdx, 1
xor eax, r8d
movsx r8d, byte [rdx + 1]
xor eax, r8d
cmp rdx, r9
jne 0x140305dd0
lea edx, [rax*8]
xor eax, edx
xor eax, r12d
and eax, 0x1ff
lea r14, [rcx + rax*8]
mov rbx, qword [r14]
test rbx, rbx
jne 0x140305e19
jmp 0x140305e50
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140305e50
cmp dword [rbx + 0xc], r12d
jne 0x140305e10
cmp dword [rbx + 8], r13d
jne 0x140305e10
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140305e10
mov dword [rbp], 1
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, [rdi + 0x18]
lea rcx, [rsp + 0x2c]
call fcn.140302c70
test rax, rax
mov rbx, rax
je 0x140305e95
lea rcx, [rax + 0x18]
movd xmm1, r12d
movd xmm0, r13d
punpckldq xmm0, xmm1
mov qword [rax], rcx
mov r8, rdi
mov rdx, rsi
movq qword [rax + 8], xmm0
call sub.msvcrt.dll_memcpy
mov rax, qword [r14]
mov qword [rbx + 0x10], rax
mov qword [r14], rbx
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 0x68
mov eax, 0xd
movsxd rdi, r9d
jmp 0x140305df3

Function at 0x1403130a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r9d, word [rcx + 0x14]
movzx r10d, word [rdx + 0x14]
mov eax, r9d
or eax, r10d
test al, 1
jne 0x140313110
test al, 0x2c
je 0x1403130f0
mov eax, r9d
and eax, r10d
test al, 0x24
jne 0x140313120
test al, 8
je 0x140313130
movsd xmm1, qword [rcx]
movsd xmm0, qword [rdx]
comisd xmm0, xmm1
ja 0x14031317c
xor eax, eax
comisd xmm1, xmm0
seta al
jmp 0x1403130ed
fstp st(0)
fstp st(0)
jmp 0x1403130ed
fstp st(0)
fstp st(0)
ret
test al, 2
je 0x140313109
and r9d, 2
je 0x140313160
and r10d, 2
je 0x14031317c
test r8, r8
jne 0x140313188
jmp fcn.1402d6670
and r10d, 1
and r9d, 1
mov eax, r10d
sub eax, r9d
ret
mov rax, qword [rdx]
cmp qword [rcx], rax
jl 0x14031317c
setg al
movzx eax, al
ret
test r9b, 0x24
jne 0x140313170
and r9d, 8
mov eax, 1
je 0x1403130ed
and r10d, 0x24
je 0x14031317c
fild qword [rdx]
fld qword [rcx]
fcomi st(1)
ja 0x1403130e3
fxch st(1)
xor eax, eax
fcompi st(1)
fstp st(0)
seta al
neg eax
ret
mov eax, 1
ret
test r10b, 8
jne 0x140313190
and r10d, 0x24
jne 0x140313120
mov eax, 0xffffffff
ret
xor r9d, r9d
jmp fcn.140373ec0
fild qword [rcx]
mov eax, 0xffffffff
fld qword [rdx]
fcomi st(1)
ja 0x1403130e9
fxch st(1)
xor eax, eax
fcompi st(1)
fstp st(0)
seta al
ret
Function at 0x140330f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov edx, dword [rcx + 0x90]
mov rsi, rcx
lea r9d, [rdx + 5]
cmp r9d, dword [rcx + 0x94]
jg 0x1403311a8
movsxd rax, edx
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x88]
lea rax, [rax + rcx*8]
movzx ecx, byte [rbx]
mov byte [rax], cl
movsx r11d, byte [rbx + 2]
movsx r8d, byte [rbx + 1]
movd xmm1, r11d
test r11b, r11b
movd xmm0, r8d
punpckldq xmm0, xmm1
lea r8, [0x14047c5a0]
movq qword [rax + 4], xmm0
jle 0x140330fff
test byte [r8 + rcx], 1
jne 0x140331198
movsx ecx, byte [rbx + 3]
xor edi, edi
mov byte [rax + 1], 0
mov qword [rax + 0x10], 0
mov word [rax + 2], di
mov dword [rax + 0xc], ecx
movzx ecx, byte [rbx + 4]
mov byte [rax + 0x18], cl
movsx r10d, byte [rbx + 6]
movsx edi, byte [rbx + 5]
test byte [r8 + rcx], 1
movd xmm2, r10d
movd xmm0, edi
punpckldq xmm0, xmm2
movq qword [rax + 0x1c], xmm0
je 0x14033104a
test r10b, r10b
jg 0x140331188
movsx ecx, byte [rbx + 7]
xor r11d, r11d
mov byte [rax + 0x19], 0
mov qword [rax + 0x28], 0
mov word [rax + 0x1a], r11w
mov dword [rax + 0x24], ecx
movzx ecx, byte [rbx + 8]
mov byte [rax + 0x30], cl
movsx r11d, byte [rbx + 0xa]
movsx edi, byte [rbx + 9]
movd xmm3, r11d
test r11b, r11b
movd xmm0, edi
punpckldq xmm0, xmm3
movq qword [rax + 0x34], xmm0
jle 0x140331097
test byte [r8 + rcx], 1
jne 0x140331178
movsx ecx, byte [rbx + 0xb]
xor r10d, r10d
mov byte [rax + 0x31], 0
mov qword [rax + 0x40], 0
mov word [rax + 0x32], r10w
mov dword [rax + 0x3c], ecx
movzx ecx, byte [rbx + 0xc]
mov byte [rax + 0x48], cl
movsx r11d, byte [rbx + 0xe]
movsx edi, byte [rbx + 0xd]
movd xmm4, r11d
test r11b, r11b
movd xmm0, edi
punpckldq xmm0, xmm4
movq qword [rax + 0x4c], xmm0
jle 0x1403310e4
test byte [r8 + rcx], 1
jne 0x140331168
movsx ecx, byte [rbx + 0xf]
mov byte [rax + 0x49], 0
mov qword [rax + 0x58], 0
mov dword [rax + 0x54], ecx
xor ecx, ecx
mov word [rax + 0x4a], cx
movzx ecx, byte [rbx + 0x10]
mov byte [rax + 0x60], cl
movsx r10d, byte [rbx + 0x12]
movsx edi, byte [rbx + 0x11]
test byte [r8 + rcx], 1
movd xmm5, r10d
movd xmm0, edi
punpckldq xmm0, xmm5
movq qword [rax + 0x64], xmm0
je 0x14033112b
test r10b, r10b
jg 0x140331158
movsx edx, byte [rbx + 0x13]
mov byte [rax + 0x61], 0
mov qword [rax + 0x70], 0
mov dword [rax + 0x6c], edx
xor edx, edx
mov word [rax + 0x62], dx
mov dword [rsi + 0x90], r9d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
add r10d, edx
mov dword [rax + 0x68], r10d
jmp 0x14033112b
add r11d, edx
mov dword [rax + 0x50], r11d
jmp 0x1403310e4
add r11d, edx
mov dword [rax + 0x38], r11d
jmp 0x140331097
add r10d, edx
mov dword [rax + 0x20], r10d
jmp 0x14033104a
add r11d, edx
mov dword [rax + 8], r11d
jmp 0x140330fff
call fcn.140297560
test eax, eax
jne 0x1403311c0
mov edx, dword [rsi + 0x90]
lea r9d, [rdx + 5]
jmp 0x140330fb4
xor eax, eax
jmp 0x14033114b
Function at 0x140373ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xc0
mov rsi, r8
movzx r8d, byte [r8 + 8]
mov rax, rcx
mov rdi, r9
cmp byte [rcx + 0x16], r8b
jne 0x140373f10
mov r10d, dword [rcx + 0x10]
mov r8, qword [rdx + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], r8
mov r9d, dword [rdx + 0x10]
mov edx, r10d
mov r8, qword [rax + 8]
call qword [rsi + 0x18]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x60], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x98], rcx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movzx ecx, word [rax + 0x14]
test ch, 0x20
jne 0x140373f62
and ch, 0x8f
or ch, 0x40
mov word [rsp + 0x54], cx
mov rax, qword [rdx]
mov qword [rsp + 0x80], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x88], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x90], rax
movzx eax, word [rdx + 0x14]
test ah, 0x20
jne 0x140373f9c
and ah, 0x8f
or ah, 0x40
mov word [rsp + 0x94], ax
xor ebx, ebx
and ecx, 1
jne 0x140373fb9
lea rcx, [rsp + 0x40]
movzx edx, r8b
call fcn.140373b00
movzx r8d, byte [rsi + 8]
mov rbx, rax
movzx eax, word [rsp + 0x94]
mov edx, eax
not edx
test dx, 0x202
je 0x140374070
test al, 1
jne 0x140374048
lea rcx, [rsp + 0x80]
movzx edx, r8b
call fcn.140373b00
test rbx, rbx
je 0x140374048
test rax, rax
je 0x140374048
mov rcx, qword [rsi + 0x10]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x90]
mov edx, dword [rsp + 0x50]
call qword [rsi + 0x18]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x14037405a
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x140373efd
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], eax
call fcn.140374650
mov eax, dword [rsp + 0x3c]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
test rdi, rdi
je 0x140374050
mov byte [rdi], 7
mov ecx, dword [rsp + 0x60]
xor eax, eax
test ecx, ecx
je 0x140374012
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
call fcn.140374650
mov eax, dword [rsp + 0x3c]
jmp 0x140374012
cmp byte [rsp + 0x96], r8b
jne 0x140373fd0
mov rax, qword [rsp + 0x88]
jmp 0x140373fe5
Function at 0x140b28ad3
Capabilities:
Encode data using xor

Disassembly:
add r10, 0xc
xor edi, edi
test rbx, rbx
jmp 0x140b6342f
lea rsp, [rsp + 8]
je 0x140b63495
mov edx, 0xca829e85
xor dl, dh
push r8
inc rdx
sal dx, 0x61
lea r8, [0x140b61e68]
mov edx, 0x95af74af
movzx edx, byte [rbp + riz]
push 0x1ca96d80
xor edx, edi
and edx, 0xff
push 0xffffffff8180aeb5
mov edx, dword [r8 + rdx*4]
sal word [rsp + 1], 0x41
shr edi, 8
xor edi, edx
inc rbp
xor edi, 0x6d1f2cbe
dec rbx
lea rsp, [rsp + 0x10]
jne 0x140b63451
pop r8
call fcn.140b4a8c6

Function at 0x140b44ded
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0x2d872e22
movzx r9d, byte [r9 + rbx - 0x2d872e22]
push 0xffffffff909b1996
sar dword [rsp + 4], 0x87
xor r9d, edx
and r9d, 0xff
mov r9d, dword [rsi + r9*4]
shr edx, 8
xor edx, r9d
inc rbx
xor edx, 0x7a1ac4be
not qword [rsp]
dec r11
push 0x99c4912
push 0xffffffffefb0919b
lea rsp, [rsp + 0x18]
jne 0x140b3b5e6
neg r8w
jae 0x140b3b60d
add rsi, 1
add r8w, 0x5037
or r8, r8
xor r9b, r10b
sar r8d, 0x11
ror r8, 0xaa
sar r8, 0x18
rol r9b, 1
bswap r8
dec r9b
pop r8
add r8, 0x39629
jmp r8

Function at 0x140b5f8eb
Capabilities:
Encode data using xor

Disassembly:
push 0x100a8d15
lea rsp, [rsp + 0x10]
je 0x140b3f42a
mov eax, 0xd4293f95
movsx r8d, al
lea r8, [0x140b45fc8]
movzx eax, byte [rdi]
push 0xfffffffffc139c98
xor eax, ecx
and eax, 0xff
mov eax, dword [r8 + rax*4]
shr ecx, 8
xor ecx, eax
inc rdi
xor ecx, 0xf78e1ba0
dec r11
lea rsp, [rsp + 8]
jne 0x140b3f3fb
jmp 0x140b54cb1
add rsi, 0xc
xor ecx, ecx
test r11, r11
jmp 0x140b3f3db
Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x140013610
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011299
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400149a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400149c0
xor al, al
jmp 0x140014a41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400149d3
xor al, al
jmp 0x140014a41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400149fd
xor al, al
jmp 0x140014a41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014a11
xor al, al
jmp 0x140014a41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014a23
xor al, al
jmp 0x140014a41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014a3f
xor al, al
jmp 0x140014a41
mov al, 1
add rsp, 0x38
ret