joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140113530
Capabilities:
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x140113564
movabs r10, 0x100000001b3
movzx edx, byte [r8 + rcx]
inc r8
xor rax, rdx
imul rax, r10
cmp r8, r9
jb 0x140113550
ret

Function at 0x14011b9d0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14011bb84
nop dword [rax + rax]
cmp ecx, 0x7c
je 0x14011bb84
cmp ecx, 0x29
jne 0x14011ba1d
cmp dword [rbx + 0x1c], 0
jne 0x14011bb84
test dword [rbx + 0x80], 0x10000000
je 0x14011bb9d
jmp 0x14011bb59
cmp ecx, 0x2e
jne 0x14011ba30
lea rcx, [rbx + 0x40]
call fcn.14011aa00
jmp 0x14011bb66
cmp ecx, 0x5c
jne 0x14011ba94
mov rcx, rbx
call fcn.140120920
test byte [rbx + 0x80], 0x80
je 0x14011ba87
movzx eax, byte [rbx + 0x78]
cmp al, 0x62
jne 0x14011ba64
lea rcx, [rbx + 0x40]
call fcn.14011b9b0
mov rcx, rbx
call fcn.140120920
jmp 0x14011bb76
cmp al, 0x42
jne 0x14011ba87
lea rcx, [rbx + 0x40]
call fcn.14011b9b0
lea rcx, [rbx + 0x40]
call fcn.140120840
mov rcx, rbx
call fcn.140120920
jmp 0x14011bb76
mov rcx, rbx
call fcn.14011bdd0
jmp 0x14011bb6e
cmp ecx, 0x5b
jne 0x14011babf
mov rcx, rbx
call fcn.140120920
mov rcx, rbx
call fcn.14011ca10
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.14011f510
jmp 0x14011bb6e
cmp ecx, 0x28
jne 0x14011baf3
mov rcx, rbx
call fcn.140120920
mov rcx, rbx
call fcn.140121750
mov edx, 0x29
mov rcx, rbx
movzx edi, al
lea r8d, [rdx - 0x24]
call fcn.14011f510
test dil, dil
je 0x14011bb76
jmp 0x14011bb6e
cmp ecx, 0x5e
jne 0x14011bb0b
lea rcx, [rbx + 0x40]
call fcn.14011a450
mov rcx, rbx
call fcn.140120920
jmp 0x14011bb76
cmp ecx, 0x24
jne 0x14011bb23
lea rcx, [rbx + 0x40]
call fcn.14011abf0
mov rcx, rbx
call fcn.140120920
jmp 0x14011bb76
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14011bb8f
cmp ecx, 0x3f
je 0x14011bb8f
cmp ecx, 0x7b
je 0x14011bb8f
cmp ecx, 0x7d
jne 0x14011bb48
test dword [rbx + 0x80], 0x10000000
je 0x14011bbab
jmp 0x14011bb59
cmp ecx, 0x5d
jne 0x14011bb59
test dword [rbx + 0x80], 0x10000000
je 0x14011bbb9
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14011a470
mov rcx, rbx
call fcn.140120920
mov rcx, rbx
call fcn.140120a20
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x14011b9f0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.14011f4f0
int3
mov edx, 5
mov rcx, rbx
call fcn.14011f4f0
int3
mov edx, 6
mov rcx, rbx
call fcn.14011f4f0
int3
mov edx, 4
mov rcx, rbx
call fcn.14011f4f0
int3
Function at 0x14011bbd0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14011bd88
nop dword [rax + rax]
cmp ecx, 0x7c
je 0x14011bd88
cmp ecx, 0x29
jne 0x14011bc1d
cmp dword [rbx + 0x1c], 0
jne 0x14011bd88
test dword [rbx + 0x80], 0x10000000
je 0x14011bda1
jmp 0x14011bd5d
cmp ecx, 0x2e
jne 0x14011bc30
lea rcx, [rbx + 0x40]
call fcn.14011aa10
jmp 0x14011bd6a
cmp ecx, 0x5c
jne 0x14011bc98
mov rcx, rbx
call fcn.140120970
test byte [rbx + 0x80], 0x80
je 0x14011bc8b
movzx eax, word [rbx + 0x78]
cmp ax, 0x62
jne 0x14011bc66
lea rcx, [rbx + 0x40]
call fcn.14011b9c0
mov rcx, rbx
call fcn.140120970
jmp 0x14011bd7a
cmp ax, 0x42
jne 0x14011bc8b
lea rcx, [rbx + 0x40]
call fcn.14011b9c0
lea rcx, [rbx + 0x40]
call fcn.140120850
mov rcx, rbx
call fcn.140120970
jmp 0x14011bd7a
mov rcx, rbx
call fcn.14011bed0
jmp 0x14011bd72
cmp ecx, 0x5b
jne 0x14011bcc3
mov rcx, rbx
call fcn.140120970
mov rcx, rbx
call fcn.14011ca80
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.14011f530
jmp 0x14011bd72
cmp ecx, 0x28
jne 0x14011bcf7
mov rcx, rbx
call fcn.140120970
mov rcx, rbx
call fcn.140121820
mov edx, 0x29
mov rcx, rbx
movzx edi, al
lea r8d, [rdx - 0x24]
call fcn.14011f530
test dil, dil
je 0x14011bd7a
jmp 0x14011bd72
cmp ecx, 0x5e
jne 0x14011bd0f
lea rcx, [rbx + 0x40]
call fcn.14011a460
mov rcx, rbx
call fcn.140120970
jmp 0x14011bd7a
cmp ecx, 0x24
jne 0x14011bd27
lea rcx, [rbx + 0x40]
call fcn.14011ac00
mov rcx, rbx
call fcn.140120970
jmp 0x14011bd7a
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14011bd93
cmp ecx, 0x3f
je 0x14011bd93
cmp ecx, 0x7b
je 0x14011bd93
cmp ecx, 0x7d
jne 0x14011bd4c
test dword [rbx + 0x80], 0x10000000
je 0x14011bdaf
jmp 0x14011bd5d
cmp ecx, 0x5d
jne 0x14011bd5d
test dword [rbx + 0x80], 0x10000000
je 0x14011bdbd
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14011a530
mov rcx, rbx
call fcn.140120970
mov rcx, rbx
call fcn.140120b30
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x14011bbf0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.14011f500
int3
mov edx, 5
mov rcx, rbx
call fcn.14011f500
int3
mov edx, 6
mov rcx, rbx
call fcn.14011f500
int3
mov edx, 4
mov rcx, rbx
call fcn.14011f500
int3

Function at 0x140121c80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp fcn.140113530
Function at 0x140124430
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx + 8], 0x100
mov rdi, rdx
mov rbx, rcx
jne 0x140124585
mov ecx, select
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140124585
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140124487
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140124585
mov rax, qword [rdi + 0x10]
cmp rax, 0x41
je 0x140124547
cmp rax, 0x43
je 0x140124522
cmp rax, 0x56
je 0x1401244fd
cmp rax, 0x58
je 0x1401244d8
cmp rax, 0x5a
jne 0x140124585
mov rcx, qword [rbx + 0x40]
lea edx, [rax + 0x6d]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x300
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x302
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x301
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x40]
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, UnRegisterTypeLib
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [rdi + 8], 0x100
jne 0x140124656
mov rax, qword [rdi + 0x10]
cmp rax, 0xd
jne 0x1401245fc
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc140u.dll_CMFCRibbonComboBox::FindItem
test rax, rax
je 0x1401245ec
mov rcx, qword [rax + 0x40]
xor r9d, r9d
xor r8d, r8d
cmp dword [0x1403c5398], r8d
je 0x1401245e1
mov edx, 0x500
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0x512
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp rax, 0x28
ja 0x140124612
movabs rcx, 0x14600000000
bt rcx, rax
jb 0x140124618
cmp rax, 0x72
jne 0x140124656
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc140u.dll_CMFCRibbonComboBox::FindItem
test rax, rax
je 0x140124656
mov r9, qword [rdi + 0x18]
mov edx, 0x513
mov r8, qword [rdi + 0x10]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp sub.mfc140u.dll_CPreviewView::OnVScroll
Function at 0x140125230
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x31], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14012529b
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rbx + 8]
mov byte [rbx + 0x30], 0
mov qword [rsp + 0x28], rax
lea r8, [0x140124d80]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rbx + 0x38], rdi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rbx + 0x18]
mov edx, 0x3e8
mov qword [rbx + 0x10], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140125420
Function at 0x140126160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, qword [rcx + 8]
mov rdi, r8
mov rbp, rdx
test rcx, rcx
je 0x140126191
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rbx + 0x10]
xor r14d, r14d
mov qword [rbx + 8], r14
test rcx, rcx
je 0x1401261b5
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 0x10], r14
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1401262b9
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
je 0x1401262b9
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1401262b9
mov edx, ebp
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x1401262b9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1401262ab
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x40], r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1401262a1
mov rcx, qword [rsp + 0x40]
xor edx, edx
call fcn.1401260b0
mov rcx, qword [rsp + 0x40]
mov qword [rbx + 8], rax
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1401262a1
mov eax, dword [rcx + 0x10]
mov dword [rcx + 0x10], r14d
test eax, eax
jne 0x14012628a
mov al, 1
jmp 0x1401262bb
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14012629d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 8], r14
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rbx + 0x10], r14
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1401295a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov ebx, edx
mov qword [rsp + 0x28], rcx
mov rdi, rcx
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
add ebx, 0xffffffdf
mov r9d, eax
cmp ebx, 0x6f
ja case.0x1401295f7.41
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x129664]
mov ecx, dword [rdx + rax*4 + 0x12965c]
add rcx, rdx
jmp rcx
bts r9d, 8
shl r9d, 0x10
lea rdx, [rsp + 0x30]
mov ecx, r9d
mov r8d, 0x64
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
mov rcx, rdi
test eax, eax
je 0x14012962a
lea rdx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
jmp 0x140129637
lea rdx, str._Error_
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1402654f0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
ret
Function at 0x14012c0b0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [rcx + 0x10], 0x67452301
mov dword [rcx + 0x24], eax
mov dword [rcx + 0x14], 0xefcdab89
mov dword [rcx + 0x18], 0x98badcfe
mov qword [rcx + 0x1c], 0x10325476
ret
Function at 0x140131cb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x58
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1403ce500]
mov rax, qword gs:[0x58]
mov ecx, 0xf4
mov r8, qword [rax + r8*8]
mov eax, dword [rcx + r8]
cmp dword [0x1403c4d70], eax
jg 0x140131e25
mov edx, 0x7d0
mov rcx, qword [0x1403c4d68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rbx, [rdi + 0x50]
mov qword [rsp + 0x38], rbx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [rsp + 0x88], eax
lea rdx, [rdi + 0x68]
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov dword [rsp + 0x80], 0
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov rdx, rax
lea rcx, [0x1403c44c8]
call fcn.140143e10
movsxd rdi, eax
mov dword [rsp + 0x80], edi
mov r8, rdi
xor r9d, r9d
mov edx, 0x516
mov rcx, qword [r14 + 0x40]
call qword [sym.imp.USER32.dll_PostMessageW]
nop
jmp 0x140131d8c
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x98], rax
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildQPasteWndThread.cpp
lea rcx, [rsp + 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
mov r9d, eax
mov r8d, edi
lea rdx, str.Set_list_count___d__time___d
lea rcx, [rsp + 0x88]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, 0x55
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
add rsp, 0x58
pop r14
pop rdi
pop rsi
pop rbx
ret
lea rcx, [0x1403c4d70]
call fcn.1402658a8
cmp dword [0x1403c4d70], 0xffffffff
jne 0x140131ce9
mov qword [rsp + 0x20], 0
lea r9, str.Ditto_Update_Clip_Time
mov edx, 1
mov r8d, edx
lea rcx, [0x1403c4d60]
call sub.mfc140u.dll_CDocTemplate::CDocTemplate
lea rcx, [0x1402a5030]
call fcn.140265448
nop
lea rcx, [0x1403c4d70]
call fcn.140265848
nop
jmp 0x140131ce9

Function at 0x140136840
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx + 8]
xor bl, bl
mov r10, rcx
test r9, r9
je 0x140136867
mov rcx, qword [r9]
call fcn.140136ca0
mov r9, qword [r9 + 8]
xor bl, al
test r9, r9
jne 0x140136854
movzx edx, bl
mov rcx, r10
call fcn.140136990
movzx eax, bl
add rsp, 0x20
pop rbx
ret
Function at 0x140136ca0
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx + 8]
xor dl, dl
test r8, r8
je 0x140136cd8
nop dword [rax + rax]
cmp dword [r8], 4
je 0x140136ccf
mov eax, dword [r8 + 4]
sub eax, 1
movsxd rcx, eax
js 0x140136ccf
mov rax, qword [r8 + 8]
xor dl, byte [rax + rcx]
sub rcx, 1
jns 0x140136cc6
mov r8, qword [r8 + 0x18]
test r8, r8
jne 0x140136cb0
movzx eax, dl
ret

Function at 0x140138c10
Capabilities:
Encode data using xor

Disassembly:
mov r10d, r9d
mov dword [rcx + 0x10], r9d
mov r9, qword [rsp + 0x28]
mov eax, edx
mov dword [rcx], edx
mov edx, r10d
mov qword [rcx + 0x18], r9
mov qword [rcx + 8], r8
mov ecx, eax
jmp 0x140138c10
mov qword [rsp + 0x18], r8
push rbx
push rsi
push r15
sub rsp, 0x30
cmp dword [0x1403c4d80], 0
mov rbx, r9
movsxd rsi, edx
movsxd r15, ecx
jne 0x140138c34
call fcn.140138db0
cmp esi, 0x1e
jle 0x140138c47
mov eax, 0xffffffff
add rsp, 0x30
pop r15
pop rsi
pop rbx
ret
mov qword [rsp + 0x50], rbp
mov r8, rsi
mov qword [rsp + 0x58], rdi
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], r14
mov rdi, rsi
call sub.VCRUNTIME140.dll_memset
lea r10, [0x140000000]
lea rbp, [rsi - 2]
cmp byte [r10 + rbp + 0x3c5318], 0
jne 0x140138c8a
mov ecx, esi
call fcn.140138e50
lea r10, [0x140000000]
imul r14, rbp, 0x1f
lea rax, [0x1403c4f90]
add r14, rax
test r15, r15
jle 0x140138d87
mov qword [rsp + 0x68], r12
lea eax, [rsi - 1]
movsxd r12, eax
xor ebp, ebp
mov qword [rsp + 0x28], r13
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rsp + 0x60]
movzx ecx, byte [rax + rbp]
movzx eax, byte [rbx]
xor rcx, rax
movzx esi, byte [rcx + r10 + 0x3c4e90]
cmp sil, 0xff
je 0x140138d29
mov ecx, 1
cmp rcx, rdi
jge 0x140138d29
nop dword [rax + rax]
mov rax, rdi
sub rax, rcx
movzx r8d, byte [rax + r14]
mov eax, 0x80808081
add r8d, esi
mul r8d
shr edx, 7
imul eax, edx, 0xff
sub r8d, eax
movsxd rax, r8d
movzx eax, byte [rax + r10 + 0x3c4d90]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, rdi
jl 0x140138cf0
mov r8, r12
lea rdx, [rbx + 1]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea r10, [0x140000000]
cmp sil, 0xff
je 0x140138d6b
movzx ecx, byte [r14]
mov eax, 0x80808081
add ecx, esi
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movsxd rax, ecx
movzx ecx, byte [rax + r10 + 0x3c4d90]
jmp 0x140138d6d
xor cl, cl
inc rbp
mov byte [rdi + rbx - 1], cl
cmp rbp, r15
jl 0x140138cc0
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop rsi
pop rbx
ret

Function at 0x140138df0
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x1403c4e8f], 0
lea r9, [0x1403c4d90]
mov byte [0x1403c4e90], 0xff
lea r10, [0x1403c4e90]
mov eax, 1
xor r8d, r8d
nop dword [rax]
nop dword [rax + rax]
mov byte [r9], al
lea r9, [r9 + 1]
mov ecx, eax
add eax, eax
mov edx, eax
xor edx, reloc.mfc140u.dll_Ordinal_285
bt eax, 8
mov byte [rcx + r10], r8b
cmovae edx, eax
inc r8d
movzx eax, dl
cmp r8d, 0xff
jl 0x140138e20
ret
Function at 0x140138e50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r8d, r8d
mov dword [rsp], 1
movsxd r11, ecx
mov ebx, r8d
lea rdi, [0x140000000]
test ecx, ecx
jle 0x140138f2e
mov r10d, r8d
mov dword [rsp + r10*4 + 4], 1
mov r9, r10
test r10, r10
jle 0x140138ee7
movsxd rax, dword [rsp + r9*4]
movzx ecx, byte [rax + rdi + 0x3c4e90]
mov eax, 0x80808081
add ecx, ebx
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi + 0x3c4d90]
xor eax, dword [rsp + r9*4 - 4]
mov dword [rsp + r9*4], eax
dec r9
test r9, r9
jg 0x140138ea2
movsxd rax, dword [rsp]
inc r10
movzx ecx, byte [rax + rdi + 0x3c4e90]
mov eax, 0x80808081
add ecx, ebx
inc ebx
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
movsxd rax, ecx
movzx eax, byte [rax + rdi + 0x3c4d90]
mov dword [rsp], eax
cmp r10, r11
jl 0x140138e91
jmp 0x140138f30
js 0x140138f68
lea rax, [r11 - 2]
imul rcx, rax, 0x1f
lea rdx, [rdi + 0x3c4f90]
add rdx, rcx
nop dword [rax]
nop word [rax + rax]
movsxd rax, dword [rsp + r8*4]
movzx eax, byte [rax + rdi + 0x3c4e90]
mov byte [rdx + r8], al
inc r8
cmp r8, r11
jle 0x140138f50
mov byte [r11 + rdi + 0x3c5316], 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402654f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret

Function at 0x140144ed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov r10, rdx
mov rbx, rcx
xor r11d, r11d
cmp qword [rcx + 8], r11
je 0x140144f2b
test r8d, r8d
je 0x140144f14
mov r8d, r8d
nop dword [rax]
mov edx, dword [r9]
movzx ecx, dl
movzx eax, byte [r10]
xor rcx, rax
mov rax, qword [rbx + 8]
shr edx, 8
xor edx, dword [rax + rcx*4]
mov dword [r9], edx
lea r10, [r10 + 1]
sub r8, 1
jne 0x140144ef0
mov eax, r11d
add rsp, 0x30
pop rbx
ret
mov dword [rsp + 0x20], r11d
lea rdx, [0x14038f228]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140144f50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140144ea0
mov ecx, 0x400
call sub.mfc140u.dll_operator_2
xor r8d, r8d
mov qword [rbx + 8], rax
mov r9d, r8d
mov ecx, r8d
lea r9, [r9 + 4]
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test r8b, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov rax, qword [rbx + 8]
inc r8d
mov dword [r9 + rax - 4], ecx
cmp r8d, 0x100
jl 0x140144f72
add rsp, 0x20
pop rbx
ret
Function at 0x140145e50
Capabilities:
Reference sql statements

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
movzx r14d, cl
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildDatabaseUtilities.cpp
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, reloc.mfc140u.dll_CSocketFile::CSocketFile
mov r8, rax
xor edx, edx
lea rcx, str.Start_of_delete_all_non_used_clips
call fcn.14015b6c0
lea rcx, [rbp - 0x28]
call fcn.140006750
lea rax, vtable.CClipIDs.0
mov qword [rbp - 0x28], rax
lea r8, str.SELECT_lID_FROM_Main_WHERE_bIsGroup__0_AND_lShortCut__0_AND_lParentID___0_AND_lDontAutoDelete__0_AND_stickyClipOrder____2147483647__AND_stickyClipGroupOrder____2147483647_
lea rdx, [rbp - 0x50]
lea rcx, [0x1403c44c8]
call fcn.140143da0
nop
lea rcx, [rbp - 0x50]
call fcn.1401437b0
test al, al
jne 0x140145f78
nop word [rax + rax]
xor r8d, r8d
lea rdx, [0x1402bee18]
lea rcx, [rbp - 0x50]
call fcn.140144630
mov r8d, eax
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x28]
call fcn.1401061f0
lea rax, [rbp + 0x38]
mov qword [rbp + 0x48], rax
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildDatabaseUtilities.cpp
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rbx, rax
xor r8d, r8d
lea rdx, [0x1402bee18]
lea rcx, [rbp - 0x50]
call fcn.140144630
mov r8d, eax
lea rdx, str.From_Clips_DeleteNonUsedClips___Deleting_Id:__d
lea rcx, [rbp + 0x40]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, reloc.mfc140u.dll_CStdioFile::CStdioFile
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rbp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x50]
call fcn.1401446f0
lea rcx, [rbp - 0x50]
call fcn.1401437b0
test al, al
je 0x140145ed0
mov rdi, qword [rbp - 0x18]
xor esi, esi
test rdi, rdi
jle 0x140145fac
lea r8, [0x1403c44c8]
movzx edx, r14b
lea rcx, [rbp - 0x28]
call fcn.140104ce0
lea rdx, str.DELETE_FROM_MainDeletes
lea rcx, [0x1403c44c8]
call fcn.140143b90
mov esi, eax
lea rax, [rbp + 0x38]
mov qword [rbp + 0x48], rax
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildDatabaseUtilities.cpp
lea rcx, [rbp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rbx, rax
mov r9d, esi
mov r8d, edi
lea rdx, str.End_of_delete_all_non_used_clips__clips_deleted:__d__delete_table_delted:__d
lea rcx, [rbp + 0x40]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, reloc.mfc140u.dll_CUserTool::CUserTool
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rbp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x50]
call fcn.140143000
nop
lea rcx, [rbp - 0x28]
call fcn.140006800
mov eax, 1
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret