joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d3e0
Capabilities:
Reference sql statements

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
nop
test cl, cl
je 0x40d46f
mov qword [rsp + 0x28], r14
test rbx, rbx
jge 0x40d43b
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x009c8250]
cmp qword [rcx], 0
jne 0x40d657
mov rax, 0xffffffffffffffff
call fcn.004349e0
jmp 0x40d605
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x48], rbx
call fcn.0046a2c0
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x48]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40d49b
cmp qword [rdx], 1
jne 0x40d484
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00adb19f]
mov ebx, 0x1e
call fcn.004389c0
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x009c8250]
cmp qword [rdx], 0
je 0x40d4ce
nop dword [rax + rax]
cmp rbx, 0x989680
jle 0x40d4ce
mov ebx, 0x989680
mov rax, rbx
call fcn.004349e0
test eax, eax
jge 0x40d55c
mov rax, qword [0x009c8250]
mov rax, qword [rax]
test rax, rax
je 0x40d511
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00468020
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.0046a2c0
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40d495
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x40d57b
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rcx]
mov rsi, qword [rdx + 0x30]
mov rdi, rsi
cmp rax, rsi
jne 0x40d5a6
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
test dil, dil
je 0x40d57b
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp rax, 1
jne 0x40d5f4
mov byte [rdi + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.004349e0
nop
test eax, eax
jl 0x40d5e3
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00ae64ed]
mov ebx, 0x32
call fcn.004389c0
lea rax, [0x00ae5e56]
mov ebx, 0x31
call fcn.004389c0
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x009c8250]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
nop dword [rax + rax]
call fcn.00468020
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, 0x989680
nop dword [rax]
call fcn.004349e0
test eax, eax
jl 0x40d624
jmp 0x40d605
Function at 0x40f560
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40f7f7
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40f7e5
test rbx, rbx
je 0x40f5ae
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40f7d0
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40f5b3
jmp 0x40f7bf
mov ebx, 8
cmp rax, 0x10000
jae 0x40f685
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40f5fe
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40f5fe
test byte [rsi], al
add rsi, 0x11f0
jmp 0x40f627
nop
nop
lea rax, [0x00f0c610]
call fcn.0040cf20
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x00f0c618]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea r8, [rbx - 1]
add rdi, r8
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40f658
cmp qword [rsi], 0
jne 0x40f697
mov eax, 0x40000
lea rbx, [0x00f11a60]
call fcn.00418aa0
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40f743
nop dword [rax + rax]
jmp 0x40f792
mov rbx, rcx
call fcn.00418aa0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40f6d8
cmp byte [r14 + 0xb1], 0
je 0x40f6d8
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x00f0c618]
cmp rsi, rdi
jne 0x40f706
nop
nop
lea rax, [0x00f0c610]
call fcn.0040d140
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x00f11a60]
cmp rcx, rsi
je 0x40f736
mov rbx, rax
mov rax, rcx
call fcn.004314c0
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x00f11a60]
call fcn.004314c0
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x00f0c150]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x00f0c150]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40f743
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40f697
lea rdx, [0x00f0c618]
cmp rcx, rdx
je 0x40f7af
lea rax, [0x00adbd98]
mov ebx, 0x1f
call fcn.004389c0
nop
nop
lea rax, [0x00f0c610]
call fcn.0040d140
jmp 0x40f79e
lea rax, [0x00ade922]
mov ebx, 0x23
call fcn.004389c0
lea rax, [0x00ae2b90]
mov ebx, 0x2a
nop dword [rax]
call fcn.004389c0
lea rax, [0x00ad839a]
mov ebx, 0x1a
call fcn.004389c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046aea0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040f560
Function at 0x415a60
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415c4f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rbx
call fcn.0043a300
call fcn.0043a300
lea rax, [0x00ad0800]
mov ebx, 0x11
call fcn.0043ac00
mov rax, qword [rsp + 0x30]
call fcn.0043aa60
call fcn.0043a380
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x415b77
nop
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x415c2a
nop dword [rax + rax]
call fcn.0043a300
lea rax, [0x00ad2834]
mov ebx, 0x14
call fcn.0043ac00
call fcn.0043a380
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.0043a300
lea rax, [0x00acc97e]
mov ebx, 0xd
call fcn.0043ac00
mov rax, qword [rsp + 0x28]
call fcn.0043aa60
lea rax, [0x00acbc12]
mov ebx, 0xc
nop
call fcn.0043ac00
mov rax, qword [rsp + 0x30]
call fcn.0043aa60
lea rax, [0x00acbc1e]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.0043ac00
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.0043a900
call fcn.0043a380
call fcn.0043a300
nop dword [rax]
call fcn.0043a560
call fcn.0043a380
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x415bb0
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x00ae923a]
mov ebx, 0x3e
call fcn.004389c0
call fcn.0043a300
lea rax, [0x00adb343]
mov ebx, 0x1e
call fcn.0043ac00
mov rax, qword [rsp + 0x60]
call fcn.0043aa60
lea rax, [0x00b97820]
mov ebx, 1
nop dword [rax]
call fcn.0043ac00
mov rax, qword [rsp + 0x38]
call fcn.0043aa60
lea rax, [0x00ac2266]
mov ebx, 2
nop dword [rax + rax]
call fcn.0043ac00
call fcn.0043a380
lea rax, [0x00ac55fd]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x38]
call fcn.004211a0
jmp 0x415b94
call fcn.0043a300
lea rax, [0x00ad6aae]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043ac00
call fcn.0043a380
jmp 0x415afb
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00466260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00415a60
Function at 0x4180e0
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4181aa
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [0x00ede118]
mov edx, dword [rax + 0x488]
cmp edx, ecx
je 0x418141
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x41814b
mov qword [rsp + 0x28], rax
call fcn.00417ee0
mov rax, qword [rsp + 0x28]
nop
call fcn.0044d440
mov ecx, dword [0x00ede118]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x14], ecx
mov dword [rsp + 0x10], edx
call fcn.0043a300
lea rax, [0x00acd0c1]
mov ebx, 0xd
call fcn.0043ac00
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.0043a900
lea rax, [0x00adab0f]
mov ebx, 0x1e
call fcn.0043ac00
mov eax, dword [rsp + 0x14]
call fcn.0043a900
call fcn.0043a560
call fcn.0043a380
lea rax, [0x00acc3fe]
mov ebx, 0xc
call fcn.004389c0
nop
mov qword [rsp + 8], rax
call fcn.00466260
mov rax, qword [rsp + 8]
jmp fcn.004180e0
Function at 0x4188a0
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418a46
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x41895a
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x41894d
lea rsi, [0x00ede170]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x114c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and ecx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x41893d
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00468900
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.0043a300
call fcn.0043a300
lea rax, [0x00ae83e3]
mov ebx, 0x39
nop
call fcn.0043ac00
mov rax, qword [rsp + 0x40]
call fcn.0043aa60
call fcn.0043a560
call fcn.0043a380
call fcn.0043a300
lea rax, [0x00ad68fd]
mov ebx, 0x18
call fcn.0043ac00
mov rax, qword [rsp + 0x28]
call fcn.0043aa60
lea rax, [0x00b97820]
mov ebx, 1
call fcn.0043ac00
mov rax, qword [rsp + 0x20]
call fcn.0043aa60
lea rax, [0x00ac2266]
mov ebx, 2
call fcn.0043ac00
call fcn.0043a380
lea rax, [0x00ac2c2f]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.004211a0
lea rax, [0x00ac2738]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.004211a0
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x00adb91d]
mov ebx, 0x1f
nop dword [rax]
call fcn.004389c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.00466260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004188a0
Function at 0x418d20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418ec6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x009c8220]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435800
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x418d8b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x418da0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x418dc5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x418dd9
cmp rbx, 0x1000
jae 0x418d95
nop dword [rax]
jmp 0x418e49
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x418ded
xor edx, edx
jmp 0x418e40
mov rcx, qword [0x009c8220]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435800
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x418dcf
jmp 0x418db4
call fcn.00469e60
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043a300
lea rax, [0x00ad68e5]
mov ebx, 0x18
call fcn.0043ac00
mov rax, qword [rsp + 0x38]
call fcn.0043a900
lea rax, [0x00ad6a95]
mov ebx, 0x19
call fcn.0043ac00
mov rax, qword [rsp + 0x30]
nop
call fcn.0043a900
call fcn.0043a560
call fcn.0043a380
lea rax, [0x00add4a0]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.004389c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00418d20
Function at 0x418f00
Capabilities:
Access peb ldr_data
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41912a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x009c8218]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00435880
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x418f79
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x418f8c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x418fb0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x418fc4
cmp rbx, 0x1000
jae 0x418f83
jmp 0x419045
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418fd6
xor esi, esi
jmp 0x419036
mov rax, qword [0x009c8218]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00435880
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x418fba
nop
jmp 0x418fa2
call fcn.00469e60
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4190c5
call fcn.0043a300
lea rax, [0x00ad76e3]
mov ebx, 0x19
call fcn.0043ac00
mov rax, qword [rsp + 0x68]
call fcn.0043a900
lea rax, [0x00ad6a95]
mov ebx, 0x19
call fcn.0043ac00
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.0043a900
call fcn.0043a560
call fcn.0043a380
lea rax, [0x00acd2af]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.004389c0
cmp eax, 0x5af
je 0x419068
call fcn.0043a300
lea rax, [0x00ad76e3]
mov ebx, 0x19
nop dword [rax]
call fcn.0043ac00
mov rax, qword [rsp + 0x38]
call fcn.0043a900
lea rax, [0x00ad6a95]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043ac00
mov eax, dword [rsp + 0x34]
call fcn.0043a900
call fcn.0043a560
call fcn.0043a380
lea rax, [0x00adbdb7]
mov ebx, 0x1f
call fcn.004389c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418f00
Function at 0x4208c0
Capabilities:
Reference sql statements

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x420b66
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
prefetcht0 byte [rax]
nop
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rsi, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x420b56
lea rdi, [0x00ede170]
mov rdx, qword [rdi + rdx*8]
shr rsi, 0x16
and esi, 0xfffff
mov rsi, qword [rdx + rsi*8]
mov rdi, rax
shr rax, 0xd
and eax, 0x1ff
mov r8, qword [rsi + rax*8 + 0x10400]
test byte [rdx], al
test byte [rsi], al
mov rdx, qword [r8 + 0x68]
nop
test rdx, rdx
je 0x420b45
movzx esi, byte [r8 + 0x62]
test sil, 1
jne 0x420b31
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x98], rbx
cmp rdx, 0x20000
jbe 0x420989
cmp qword [r8 + 0x18], rdi
jne 0x420aa1
mov qword [rsp + 0x30], r8
lea rdx, [rdi + 0x20000]
jmp 0x420acc
mov qword [rsp + 0x48], rdx
mov rax, rdi
mov rbx, rdx
call fcn.00415e00
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x48]
xor r8d, r8d
jmp 0x4209ac
add r8, 8
test rcx, rcx
jne 0x4209b6
xor r9d, r9d
jmp 0x4209c2
bsf r9, rcx
btc rcx, r9
lea r9, [rax + r9*8]
test r9, r9
jne 0x4209e7
mov qword [rsp + 0x38], r8
call fcn.00415f20
test rsi, rsi
je 0x420a76
mov rdx, qword [rsp + 0x78]
mov r9, rsi
mov rsi, qword [rsp + 0x48]
mov r8, r9
sub r8, rdx
mov r9, qword [r9]
test r9, r9
je 0x4209a8
mov r10, r9
sub r9, rdx
nop dword [rax + rax]
cmp rsi, r9
ja 0x4209a8
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rax
mov rax, r10
mov rbx, rdx
mov rcx, r8
call fcn.00415ca0
test rax, rax
je 0x420a4e
mov rdi, rbx
mov rsi, qword [rsp + 0x98]
mov r8, rcx
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.00420e80
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x70]
jmp 0x4209a8
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
add qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x38]
add qword [rcx + 0x18], rax
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
nop
ret
mov rdx, qword [r8 + 0x68]
add rdx, qword [r8 + 0x18]
sub rdx, rdi
cmp rdx, 0x20000
mov ecx, 0x20000
cmova rdx, rcx
nop dword [rax]
jmp 0x420989
add rdx, 0x20000
mov rsi, qword [r8 + 0x68]
add rsi, qword [r8 + 0x18]
cmp rdx, rsi
jae 0x420aa1
mov rsi, qword [rbx]
nop dword [rax]
test rsi, rsi
je 0x420afe
mov rax, qword [rsi + 0x10]
cmp rax, 0xfd
je 0x420afe
jae 0x420b27
mov qword [rsi + rax*8 + 0x18], rdx
inc qword [rsi + 0x10]
jmp 0x420ac5
mov qword [rsp + 0x40], rdx
mov rax, rbx
mov rbx, rdx
call fcn.00426e20
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x30]
jmp 0x420ac5
mov ecx, 0xfd
call fcn.004688e0
lea rax, [0x00ada921]
mov ebx, 0x1d
nop dword [rax]
call fcn.004389c0
lea rax, [0x00ad0844]
mov ebx, 0x11
call fcn.004389c0
mov rax, rdx
mov ecx, 0x40
nop
call fcn.00468900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004208c0
Function at 0x4215e0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00f0bd50], 0
jne 0x4216cf
mov rdx, qword [rax + 0x50]
test byte [rdx], al
nop
nop
nop
sub rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x5c]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x4216c5
lea rbx, [0x00ede170]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x11440]
lea rsi, [rcx + 0x11440]
add rdx, rsi
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop
test al, bl
jne 0x4216a7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00468900
lea rax, [0x00ae3679]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.004389c0
nop
int3

Function at 0x423ac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423bbe
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x423b00
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x423baf
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00424660
nop dword [rax]
test rax, rax
je 0x423baf
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00423c00]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.00466120
xorps xmm15, xmm15
mov r14, qword [0x00f0c1e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x423b9d
xor eax, eax
jmp 0x423ba7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x423af2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00466260
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00423ac0
Function at 0x4251e0
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x425366
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
cmp dword [0x00ede118], ebx
je 0x425210
jmp 0x42534f
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
btr ecx, 0x1f
dec ecx
nop word [rax + rax]
cmp ecx, 0x80000000
jae 0x42533e
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x42520d
nop
cmp edx, 0x80000000
jne 0x425334
cmp dword [0x00f0c8f0], 0
jle 0x42532a
nop
mov rax, qword [0x00f0d2d0]
mov qword [rsp + 0x18], rax
mov rcx, qword [0x00ede140]
mov qword [rsp + 0x10], rcx
mov rdx, qword [0x00ede150]
mov qword [rsp + 0x28], rdx
movsd xmm0, qword [0x00ede158]
movsd qword [rsp + 0x20], xmm0
call fcn.0043a300
lea rax, [0x00adbca0]
mov ebx, 0x1f
nop dword [rax]
call fcn.0043ac00
mov rax, qword [rsp + 0x18]
shr rax, 0x14
call fcn.0043a900
lea rax, [0x00acd8fb]
mov ebx, 0xe
nop
call fcn.0043ac00
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
sub rax, rcx
shr rax, 0x14
call fcn.0043a900
lea rax, [0x00ad53f8]
mov ebx, 0x17
call fcn.0043ac00
mov rax, qword [rsp + 0x10]
call fcn.0043a900
lea rax, [0x00aca0fb]
mov ebx, 0xa
call fcn.0043ac00
movsd xmm0, qword [rsp + 0x20]
call fcn.0043a600
lea rax, [0x00acbbe2]
mov ebx, 0xc
nop
call fcn.0043ac00
call fcn.0043a380
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00ade80a]
mov ebx, 0x23
call fcn.004389c0
lea rax, [0x00ae5f7c]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.004389c0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.00466260
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.004251e0