joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404e3c47
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rax, rsp
clc
push rbp
rcl bp, 0x7c
btc ebp, r10d
push rbx
push rsi
bts rsi, rbp
or bp, di
push rdi
rol si, 0x36
sub di, 0x412d
push r14
lea rbp, [rax - 0x37]
adc r14b, spl
sub rsp, 0xf0
movaps xmmword [rax - 0x38], xmm6
and rdi, r10
mov rax, qword [0x1400b7288]
xor rax, rsp
movzx rsi, cx
jmp 0x1404e3c96
mov qword [rbp - 0x11], rax
movsx edi, bx
bswap rsi
mov esi, edx
bswap ebx
mov bx, r11w
mov r14, rcx
mov rdi, 0x16d223a8
jmp 0x1404e3cb9
mov edx, 0xffc0
xchg bl, dil
not ch
mov cx, 0x2726
mov ecx, 0x1f80
cmova bx, ax
bswap di
movzx rdi, sp
mov edi, r9d
movzx rbx, ax
bswap bx
mov rbx, r8
jmp 0x1404e3ce9
call fcn.1404def4c
mov ecx, dword [rbp + 0x5f]
movsx rdx, r9w
mov qword [rsp + 0x48], rax
setae dl
xchg dl, dl
mov dword [rsp + 0x50], ebx
jmp 0x1404e3d0e
movss xmm0, dword [rsp + 0x50]
movsx edx, sp
cdq
mov rdx, qword [rsp + 0x48]
jmp 0x1404e3d22
movss dword [rsp + 0x40], xmm0
jmp 0x1404e3d2d
call fcn.1404e3abc
movss xmm6, dword [rbp + 0x77]
cmc
cmp r15b, 0x13
test eax, eax
jmp 0x1404e3d43
jne 0x1404e3dbe
cmp dword [rbp + 0x7f], 2
jne 0x1404e3d6c
mov eax, dword [rbp - 0x41]
bswap rdx
and eax, 0xffffffe1
movss dword [rbp - 0x51], xmm6
or eax, 1
movzx r8, r9w
cdq
mov dword [rbp - 0x41], eax
mov r8d, dword [rbp + 0x5f]
mov dx, r8w
cdq
lea rax, [rsp + 0x40]
movzx cx, r8b
mov qword [rsp + 0x28], rax
cwde
seta ah
movsx r9d, di
lea rdx, [rsp + 0x48]
xchg al, ch
lea rax, [rbp + 0x6f]
xchg r9d, ecx
mov r9d, esi
cmovb cx, r14w
movsxd rcx, r9d
lea rcx, [rsp + 0x60]
jmp 0x1404e3daf
mov qword [rsp + 0x20], rax
jmp 0x1404e3db9
call fcn.1404e1596
call fcn.140108d00
test al, al
jmp 0x1404e3dca
je 0x1404e3e34
test edi, edi
jmp 0x1404e3dd7
je 0x1404e3e34
movss xmm0, dword [rsp + 0x40]
cdqe
cwd
mov r8, r14
movss xmm3, dword [rbp + 0x6f]
rdtsc
mov ecx, edi
rdtsc
mov rax, qword [rsp + 0x48]
mov edx, dword [rbp + 0x67]
jmp 0x1404e3e02
mov qword [rsp + 0x30], rax
jmp 0x1404e3e0c
cvtps2pd xmm0, xmm0
cvtps2pd xmm1, xmm6
movsd qword [rsp + 0x28], xmm0
cvtps2pd xmm3, xmm3
movsd qword [rsp + 0x20], xmm1
jmp 0x1404e3e26
call fcn.1404e39f7
cvtsd2ss xmm0, xmm0
jmp 0x1404e3e60
mov ecx, edi
jmp 0x1404e3e3b
call fcn.1404e10db
mov rcx, qword [rsp + 0x48]
cdq
movsx dx, r12b
mov edx, 0xffc0
jmp 0x1404e3e55
call fcn.1404def4c
movss xmm0, dword [rsp + 0x40]
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
jmp 0x1404e3e6c
call fcn.1404a3da6
movaps xmm6, xmmword [rsp + 0xe0]
btr di, 0x11
add rsp, 0xf0
bswap bp
movzx r14, r13w
mov rbx, rdi
pop r14
cmovo ebp, ebp
pop rdi
mov sil, sil
bswap si
pop rsi
movzx rbp, r12w
mov rbx, 0xe0f3939
pop rbx
jmp 0x1404e3eb4
pop rbp
jmp 0x1404e3eba
ret

Function at 0x1404e427a
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1400c8ea0]
not edx
cqo
mov ecx, 2
lea r8, [0x1400c8e98]
movzx dx, al
lea rdx, [0x1400cf758]
jmp 0x1404e42a9
call fcn.1404e446f
mov ecx, ebx
clc
stc
test rax, rax
jmp 0x1404e42ba
je 0x1404e42d4
add rsp, 0x20
movsxd rbx, ebx
pop rbx
jmp 0x1404e42cd
push qword [0x1400b8d90]
ret
add rsp, 0x20
mov rbx, 0x26b4a16
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1404e42e7
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
xadd r8, r8
add r8b, r12b
push rdi
btr r8, 0xc3
sub bx, 0x1d93
sub rsp, 0x20
movsxd r8, eax
movzx r9w, dil
mov rbx, rdx
movsx r9d, r8w
movzx r8, r9w
cdq
lea r9, [0x1400c8ea8]
movsx dx, r8b
mov edi, ecx
not dx
jmp 0x1404e432e
lea rdx, [0x1400cf748]
cmovs cx, bp
mov ecx, 3
xchg r8, r8
not r8b
lea r8, [0x1400c8ea0]
jmp 0x1404e4350
call fcn.1404e446f
mov rdx, rbx
ror ecx, 0xb5
mov ecx, edi
clc
test rax, rax
jmp 0x1404e4366
je 0x1404e4377
call qword [0x1400b8d90]
jmp 0x1404e437d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
rcr dil, 0xec
adc dil, 0x7e
add rsp, 0x20
not di
jmp 0x1404e4399
pop rdi
jmp 0x1404e439f
ret

Function at 0x1404e4c75
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test dx, di
clc
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
cmp cx, 0x2990
bsf si, ax
push rdi
btr rsi, rax
sub rsp, 0x30
movsx si, r10b
btc si, 0xfc
movsxd rdi, r8d
or r8b, cl
shld si, r14w, 0xea
bsr r8d, r8d
mov r8d, ecx
movsx si, r14b
mov rsi, rdx
test bpl, spl
test ecx, 0xfffff3ff
jmp 0x1404e4ccd
jne 0x1404e4ce4
cmp ecx, 0xc00
jmp 0x1404e4cde
jne 0x1404e4e46
test rsi, rsi
jmp 0x1404e4cec
jne 0x1404e4cff
test edi, edi
jmp 0x1404e4cf9
jg 0x1404e4e46
test edi, edi
js 0x1404e4e46
sub r9d, r9d
shl bpl, 0x49
lea rbp, reloc.d2d1.dll_Ordinal_1
mov r10d, 0xe3
xchg ch, dl
clc
mov eax, 0x729668ce
lea eax, [r10 + r9]
cmovne rdx, r8
cdq
xchg ecx, ecx
xor cx, di
bts rcx, rsi
sub eax, edx
sal ecx, cl
or cx, 0x2815
mov edx, r8d
mov ch, 0x1c
sar eax, 1
adc ch, 0xa1
movsxd rcx, eax
jmp 0x1404e4d52
shl rcx, 4
sub edx, dword [rcx + rbp]
je 0x1404e4db1
test edx, edx
cmovg rcx, rdi
not ch
lea ecx, [rax - 1]
jmp 0x1404e4d6f
cmovns ecx, r10d
inc r10
mov r10, rdx
xchg r10b, r10b
inc eax
not r10b
ror r10w, cl
test edx, edx
mov r10d, ecx
jmp 0x1404e4d8f
cmovns r9d, eax
test sil, 0x81
cmp di, 0x28c6
cmp r9d, ecx
jmp 0x1404e4da4
jle 0x1404e4d23
or eax, 0xffffffff
test si, si
clc
test eax, eax
jmp 0x1404e4db8
js 0x1404e4e46
cdqe
mov edx, 0x55
movzx cx, bl
add rax, rax
movsx ecx, r12w
mov rbp, qword [rbp + rax*8 + 8]
mov cx, 0x6b3a
jmp 0x1404e4de2
mov rcx, rbp
jmp 0x1404e4dea
call fcn.14019e9c3
mov rbx, rax
test edi, edi
jmp 0x1404e4df9
jle 0x1404e4e39
cmp ebx, edi
jge 0x1404e4e46
mov rdx, rdi
movzx r8w, spl
setl r8b
mov r8, rbp
movzx ecx, cx
bswap rcx
movsxd rcx, ebp
mov rcx, rsi
jmp 0x1404e4e27
call fcn.1404ce49c
test eax, eax
jmp 0x1404e4e33
jne 0x1404e4e7d
lea eax, [rbx + 1]
jmp 0x1404e4e41
jmp 0x1404e4e4c
xor eax, eax
bts rsi, rdi
mov rbx, qword [rsp + 0x40]
movsx bp, sil
mov rbp, qword [rsp + 0x48]
sbb sil, spl
mov rsi, qword [rsp + 0x50]
cmovne edi, edi
test r13w, 0x2b4e
bsf di, sp
add rsp, 0x30
not di
movzx di, cl
pop rdi
ret
and qword [rsp + 0x20], 0
stc
xor r9d, r9d
stc
jmp 0x1404e4e90
sub r8d, r8d
xor edx, edx
jmp 0x1404e4e9a
xor ecx, ecx
jmp 0x1404e4ea1
call fcn.1404ba609
int3
Function at 0x1404e5533
Capabilities:
Encrypt data using speck

Disassembly:
mov qword [rsp + 0x10], rbx
jmp 0x1404e554d
mov qword [rsp + 0x18], rbp
bsr ebp, esp
push rdi
rcr bpl, cl
setp bpl
sbb rdi, 0x7fb310a4
push r12
push r13
sal dil, 0x34
sbb bpl, 0x96
push r14
xor rdi, 0x213f5aac
cmp dl, r11b
add dil, 0x25
push r15
sub rsp, 0x20
mov rdi, qword [rdx]
xchg r15b, r14b
sub r13d, r13d
and r12b, 0xf3
cmc
mov r12, r9
mov rbp, r8
cmova r15, r11
bts r14, rsp
mov r14, rdx
btr r15w, r11w
adc r15b, 0x8d
sar r15, cl
mov r15, rcx
cmp bpl, r15b
test rcx, rcx
je 0x1404e57a3
mov rbx, rcx
clc
test r8, r8
jmp 0x1404e55cc
je 0x1404e5724
cmp byte [rdi], r13b
jmp 0x1404e55da
jne 0x1404e55f0
mov r8d, 1
jmp 0x1404e55eb
jmp 0x1404e5634
cmp byte [rdi + 1], r13b
jmp 0x1404e55f9
jne 0x1404e560f
mov r8d, 2
jmp 0x1404e560a
jmp 0x1404e5634
mov al, byte [rdi + 2]
movsxd rcx, ebx
neg al
movzx r9d, di
movsx rdx, r11w
sbb r8, r8
rol ch, cl
movzx rdx, r11w
shr edx, cl
neg r8
sbb cx, bx
add r8, 3
mov r9, r12
lea rcx, [rsp + 0x50]
cmove dx, r11w
movsx edx, dx
movsx dx, dil
mov rdx, rdi
jmp 0x1404e5651
call fcn.1404ea4db
mov rdx, rax
cmc
cmp rax, 0xffffffffffffffff
jmp 0x1404e5663
je 0x1404e5755
test rax, rax
jmp 0x1404e5671
je 0x1404e5744
mov ecx, dword [rsp + 0x50]
test r14b, r14b
stc
cmp ecx, 0xffff
jmp 0x1404e568a
jbe 0x1404e570b
cmp rbp, 1
jmp 0x1404e5699
jbe 0x1404e5724
add ecx, 0xffff0000
or ax, 0x3982
xor rax, 0x4cc64d57
mov r8d, 0xd800
sar ax, 0x9b
shrd ax, di, 0xd4
sub rax, r9
mov eax, ecx
cmp ah, 0x1a
jmp 0x1404e56cc
mov dword [rsp + 0x50], ecx
shr eax, 0xa
jmp 0x1404e56d8
dec rbp
or ax, r8w
clc
cmp dil, spl
mov word [rbx], ax
cwde
sub al, r10b
rcr al, 0x30
mov eax, 0x3ff
and cx, ax
add rbx, 2
mov eax, 0xdc00
or cx, ax
test r8d, 0x306f24af
test r10, r12
mov word [rbx], cx
test sil, 0x68
clc
add rdi, rdx
add rbx, 2
sub rbp, 1
jne 0x1404e55d2
sub rbx, r15
stc
ror ah, 0x27
rcl eax, 0x25
mov qword [r14], rdi
setbe ah
sar rbx, 1
mov rax, rbx
jmp 0x1404e573f
jmp 0x1404e5767
mov rdi, r13
mov word [rbx], r13w
jmp 0x1404e5750
jmp 0x1404e5724
mov qword [r14], rdi
call fcn.1404b98a4
mov dword [rax], 0x2a
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x58]
sal dil, cl
ror r12d, 0xd4
mov rbp, qword [rsp + 0x60]
shl r14b, 0x21
rcr r15b, 0x93
add rsp, 0x20
movsx r12d, cx
pop r15
pop r14
movsxd rdi, r10d
pop r13
not r12b
movsx r12, dx
movsxd rdi, r11d
pop r12
movzx di, dl
pop rdi
ret
mov rbx, r13
clc
cmp r10b, 0x76
cmp byte [rdi], r13b
jne 0x1404e57c4
mov r8d, 1
jmp 0x1404e57bf
jmp 0x1404e5816
cmp byte [rdi + 1], r13b
jmp 0x1404e57cd
jne 0x1404e57e3
mov r8d, 2
jmp 0x1404e57de
jmp 0x1404e5816
mov al, byte [rdi + 2]
bswap dx
shl dh, 0x70
neg al
movsx r9, r14w
mov r9w, cx
sbb r8, r8
stc
shr dl, 0x94
sar r9w, cl
neg r8
add r8, 3
rcr r9w, 0xbe
rol r9b, 0x34
sar r9w, 0x4e
mov r9, r12
mov rdx, rdi
sub ecx, ecx
jmp 0x1404e5823
call fcn.1404ea4db
cmp rax, 0xffffffffffffffff
jmp 0x1404e5831
je 0x1404e5758
test rax, rax
je 0x1404e5737
cmp rax, 4
jmp 0x1404e5849
jne 0x1404e5858
inc rbx
cmp spl, 0x74
stc
clc
add rdi, rax
jmp 0x1404e5860
inc rbx
jmp 0x1404e5868
jmp 0x1404e57ab
Function at 0x1404e845d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
mov r10b, 0x24
shl r10b, cl
sub rsp, 0x30
cmp esi, r11d
test r12d, r10d
jmp 0x1404e8474
xor eax, eax
shl r10b, cl
mov r10d, ecx
cmp dil, spl
test rdx, rdx
jmp 0x1404e8487
jne 0x1404e84ab
call fcn.1404b98a4
mov ebx, 0x16
mov dword [rax], ebx
call fcn.1404ba568
mov eax, ebx
add rsp, 0x30
pop rbx
jmp 0x1404e84aa
ret
test r8, r8
jmp 0x1404e84b3
je 0x1404e848d
movzx ecx, byte [rsp + 0x60]
cmc
mov word [rdx], ax
sbb eax, r13d
bt ax, r13w
lea rax, [rcx + 1]
cmp r8, rax
jmp 0x1404e84d6
ja 0x1404e84f0
call fcn.1404b98a4
mov ebx, 0x22
jmp 0x1404e84eb
jmp 0x1404e8497
lea eax, [r9 - 2]
mov ebx, 0x22
stc
cmp eax, ebx
ja 0x1404e848d
mov byte [rsp + 0x60], cl
mov ecx, r10d
and bh, 0x57
test dil, 0x94
sar bx, cl
add rsp, 0x30
not rbx
pop rbx
jmp 0x1404e8520
mov qword [rsp + 8], rbx
cmp bh, 0xcb
mov qword [rsp + 0x10], rbp
setbe bh
sbb r10w, 0x31c8
mov qword [rsp + 0x18], rsi
push rdi
mov ebp, r12d
sub bl, r11b
bts edi, ecx
push r14
or dil, r8b
push r15
movsx r10, bx
sub rsp, 0x20
cmp cx, r15w
sub r15d, r15d
mov ebp, r9d
or r11b, bpl
and dil, 0xcf
mov rdi, r8
mov r11, rdx
mov r10, rdx
rol bh, cl
mov bh, 0xdb
mov ebx, r15d
jmp 0x1404e857e
cmp byte [rsp + 0x60], r15b
je 0x1404e85a5
lea eax, [r15 + 0x2d]
neg ecx
mov word [rdx], ax
lea ebx, [rax - 0x2c]
lea r10, [rdx + 2]
movsx si, cl
movzx esi, sp
bt r8d, 0x8c
mov r8, r10
cmc
not r9b
sub edx, edx
jmp 0x1404e85b5
lea rsi, [r10 + 2]
mov eax, ecx
ror r9, 0x70
sbb cx, r13w
bsr r14d, esp
mov r9, r10
rcl r14, cl
adc cl, 0x8e
div ebp
ror r14w, cl
movsx r14w, r11b
mov ecx, eax
and al, sil
cmp edx, 9
mov eax, 0x57
movsxd r14, r13d
lea r14d, [rax - 0x27]
jmp 0x1404e85f4
cmovbe ax, r14w
inc rbx
test bp, 0x40bd
add ax, dx
stc
cmp bpl, 6
mov word [r10], ax
test ecx, ecx
jmp 0x1404e8614
je 0x1404e862b
mov r10, rsi
cmp rbx, rdi
jmp 0x1404e8625
jb 0x1404e85ac
cmp rbx, rdi
jmp 0x1404e8633
jb 0x1404e8664
mov word [r11], r15w
jmp 0x1404e8642
call fcn.1404b98a4
mov ebx, 0x22
jmp 0x1404e8651
mov dword [rax], ebx
jmp 0x1404e8658
call fcn.1404ba568
mov eax, ebx
jmp 0x1404e86aa
mov word [rsi], r15w
or al, sil
xor cx, r14w
movzx eax, word [r8]
movzx ecx, word [r9]
mov word [r9], ax
test rbp, rbx
sub r9, 2
mov word [r8], cx
jmp 0x1404e868b
add r8, 2
cmp r8, r9
jmp 0x1404e8697
jb 0x1404e866f
xor eax, eax
cmp sil, 0x24
or r14b, sil
bsr ebp, r15d
mov rbx, qword [rsp + 0x40]
mov r15b, 0x36
mov rbp, qword [rsp + 0x48]
shrd si, si, 0x24
btc di, 0x6b
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
mov r15d, 0x5685f8d
sets r15b
movzx edi, r14w
pop r15
pop r14
movsxd rdi, ebx
pop rdi
ret
Function at 0x140001492
Capabilities:
Query environment variable

Disassembly:
jmp 0x14000bda0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
lea rcx, str.ADLM_ENABLE_HELP
call qword [sym.imp.MSVCR110.dll_getenv]
test rax, rax
jne 0x14000bde7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_void____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14000be1f
cmp dword [rsp + 0x24], 1
je 0x14000be46
cmp dword [rsp + 0x24], 2
je 0x14000be6d
cmp dword [rsp + 0x24], 3
je 0x14000be91
cmp dword [rsp + 0x24], 4
je 0x14000beb5
jmp 0x14000bed9
lea rdx, str.AL_index.html
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
lea rdx, str.AL_index.html_contextIdlicense_transfer_utility
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
lea rdx, str.AL_index.html_contextIdimport_a_license
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
lea rdx, str.AL_index.html_contextIdexport_a_license
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
lea rdx, str.AL_index.html_contextIdLicenseBorrowing
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_void____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14000bda0
Capabilities:
Query environment variable

Disassembly:
jmp 0x14000bda0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
lea rcx, str.ADLM_ENABLE_HELP
call qword [sym.imp.MSVCR110.dll_getenv]
test rax, rax
jne 0x14000bde7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_void____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14000be1f
cmp dword [rsp + 0x24], 1
je 0x14000be46
cmp dword [rsp + 0x24], 2
je 0x14000be6d
cmp dword [rsp + 0x24], 3
je 0x14000be91
cmp dword [rsp + 0x24], 4
je 0x14000beb5
jmp 0x14000bed9
lea rdx, str.AL_index.html
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
lea rdx, str.AL_index.html_contextIdlicense_transfer_utility
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
lea rdx, str.AL_index.html_contextIdimport_a_license
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
lea rdx, str.AL_index.html_contextIdexport_a_license
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
lea rdx, str.AL_index.html_contextIdLicenseBorrowing
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_char_const____ptr64____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000bef4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::constructor_void____ptr64]
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14000e2d8
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140120000
add rsp, 0x28
jmp 0x14000e2d8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x20], 0
call qword [sym.imp.MSVCR110.dll___crtGetShowWindowMode]
movzx esi, ax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 8]
xor ebx, ebx
xor eax, eax
lock cmpxchg qword [0x140020a78], rdx
je 0x14000e31f
cmp rax, rdx
jne 0x14000e31d
mov ebx, 1
jmp 0x14000e31f
jmp 0x14000e304
mov eax, dword [0x140020a8c]
cmp eax, 1
jne 0x14000e334
lea ecx, [rax + 0x1e]
call sub.MSVCR110.dll__amsg_exit
jmp 0x14000e373
mov eax, dword [0x140020a8c]
test eax, eax
jne 0x14000e369
mov dword [0x140020a8c], 1
lea rdx, [0x1400179e8]
lea rcx, [0x1400175a8]
call sub.MSVCR110.dll__initterm_e
test eax, eax
je 0x14000e373
mov eax, 0xff
jmp 0x14000e4ab
mov dword [0x1400204cc], 1
mov eax, dword [0x140020a8c]
cmp eax, 1
jne 0x14000e39b
lea rdx, [0x140017498]
lea rcx, [section..rdata]
call sub.MSVCR110.dll__initterm
mov dword [0x140020a8c], 2
test ebx, ebx
jne 0x14000e3a8
xor eax, eax
xchg qword [0x140020a78], rax
cmp qword [0x140020a90], 0
je 0x14000e3d4
lea rcx, [0x140020a90]
call fcn.14000ea20
test eax, eax
je 0x14000e3d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140020a90]
call rax
mov rax, qword [sym.imp.MSVCR110.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
cmp byte [rbx], 0x20
ja 0x14000e44a
cmp byte [rbx], 0
je 0x14000e3f5
test edi, edi
jne 0x14000e44a
mov al, byte [rbx]
dec al
cmp al, 0x1f
ja 0x14000e407
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x14000e3f5
movzx r9d, si
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.14000efa0
mov dword [0x1400204c8], eax
cmp dword [0x1400204e8], 0
jne 0x14000e433
mov ecx, eax
call qword [sym.imp.MSVCR110.dll_exit]
cmp dword [0x1400204cc], 0
jne 0x14000e448
call qword [sym.imp.MSVCR110.dll__cexit]
mov eax, dword [0x1400204c8]
jmp 0x14000e4ab
cmp byte [rbx], 0x22
jne 0x14000e45c
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rbx]
call qword [sym.imp.MSVCR110.dll__ismbblead]
test eax, eax
je 0x14000e471
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x14000e3e7
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000efa0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov esi, r9d
mov r14, rdx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rbp - 0x10]
or r8d, 0xffffffff
mov rdx, rax
call qword [sym.imp.QtCoreAdlm4.dll_public:_static_class_AdlmQt::QString___cdecl_AdlmQt::QString::fromWCharArray_unsigned_short_int_const____ptr64__int_]
lea rdx, [rbp - 0x18]
mov rcx, rax
call qword [sym.imp.QtCoreAdlm4.dll_public:_class_AdlmQt::QByteArray___cdecl_AdlmQt::QString::toLocal8Bit_void____ptr64]
lea rcx, [rbp - 0x10]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QString::destructor_void____ptr64]
mov edx, 8
mov dword [rbp - 0x30], 0
lea ecx, [rdx + 0x48]
mov dword [rbp - 0x2c], 8
mov dword [rbp - 0x28], 8
call qword [sym.imp.QtCoreAdlm4.dll_public:_static_struct_AdlmQt::QVectorData____ptr64___cdecl_AdlmQt::QVectorData::allocate_int__int_]
mov rdi, rax
test rax, rax
jne 0x14000f023
call qword [sym.imp.QtCoreAdlm4.dll_void___cdecl_AdlmQt::qBadAlloc_void_]
mov qword [rbp - 0x20], rdi
mov dword [rdi], 1
mov rax, qword [rbp - 0x20]
mov dword [rax + 8], 8
mov rax, qword [rbp - 0x20]
xor edx, edx
mov dword [rax + 4], 8
mov rax, qword [rbp - 0x20]
lea r8d, [rdx + 0x40]
or dword [rax + 0xc], 1
mov rax, qword [rbp - 0x20]
and dword [rax + 0xc], 0xfffffffd
mov rcx, qword [rbp - 0x20]
add rcx, 0x10
call qword [sym.imp.QtCoreAdlm4.dll_void____ptr64___cdecl_AdlmQt::qMemSet_void____ptr64__int__unsigned_long_long_unsigned___int64__]
lea rcx, [rbp - 0x18]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QByteArray::detach_void____ptr64]
mov r8, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov r8, qword [r8 + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov r9d, esi
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rax
call sub.QtCoreAdlm4.dll_void___cdecl_AdlmQt::qWinMain_struct_HINSTANCE______ptr64__struct_HINSTANCE______ptr64__char____ptr64__int__int____ptr64__class_AdlmQt::QVector_char____ptr64_____ptr64_
mov rax, qword [rbp - 0x20]
mov ecx, dword [rax]
cmp ecx, 1
je 0x14000f0b8
mov rax, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
mov r8d, dword [rax + 4]
mov edx, dword [rax + 8]
call fcn.14000ee00
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 0x30]
add rdx, 0x10
call fcn.1400013a2
mov rcx, qword [rbp - 0x20]
mov edi, eax
test rcx, rcx
je 0x14000f0e7
lock dec dword [rcx]
jne 0x14000f0e7
mov rcx, qword [rbp - 0x20]
mov edx, 8
call qword [sym.imp.QtCoreAdlm4.dll_public:_static_void___cdecl_AdlmQt::QVectorData::free_struct_AdlmQt::QVectorData____ptr64__int_]
lea rcx, [rbp - 0x18]
call qword [sym.imp.QtCoreAdlm4.dll_public:_void___cdecl_AdlmQt::QByteArray::destructor_void____ptr64]
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret