joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013e980
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xe8
call fcn.1402f1230
sub rsp, rax
mov rax, qword [0x140430528]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r15, qword [rsp + 0x150]
mov rax, rcx
mov rbx, qword [rsp + 0x158]
mov rdi, r9
mov r12, qword [rsp + 0x178]
mov r13, rdx
mov qword [rsp + 0x40], rcx
xor esi, esi
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], r8
mov r14d, dword [rcx]
mov rcx, rax
call fcn.140111480
mov r8d, r14d
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, r12
call fcn.14015df00
test eax, eax
je 0x14013ebef
mov ebp, dword [rsp + 0x160]
inc r14d
test ebp, ebp
je 0x14013ea34
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov r8, rbx
mov rdx, r15
call fcn.14008acb0
test eax, eax
jle 0x14013ebf2
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.1402f4a50
mov r8, rbx
lea rcx, [rsp + 0x90]
mov rdx, r15
call fcn.1402f4a50
movsxd rax, ebx
sub rax, 1
js 0x14013ea6e
add rax, rdi
add byte [rax], 1
jne 0x14013ea6e
dec rax
cmp rax, rdi
jns 0x14013ea61
mov rbp, qword [rsp + 0x38]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov rdx, rbx
mov qword [rsp + 0x20], rbp
mov rcx, r15
call fcn.1400858f0
test eax, eax
je 0x14013ebf2
mov qword [rsp + 0x28], rsi
lea r8, [rsp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rdx, rbx
mov rcx, rdi
call fcn.1400858f0
test eax, eax
je 0x14013ebf2
mov r9d, esi
mov rdx, rsi
test ebx, ebx
jle 0x14013eba1
cmp ebx, 0x40
jb 0x14013eb6c
mov ecx, ebx
and ecx, 0x8000003f
jge 0x14013eae8
dec ecx
or ecx, 0xffffffc0
inc ecx
mov eax, ebx
sub eax, ecx
movsxd rcx, eax
nop
movdqu xmm0, xmmword [rsp + rdx + 0x50]
add r9d, 0x40
movdqu xmm1, xmmword [rsp + rdx + 0x90]
pxor xmm1, xmm0
movdqu xmmword [rsp + rdx + 0x50], xmm1
movdqu xmm0, xmmword [rsp + rdx + 0x60]
movdqu xmm1, xmmword [rsp + rdx + 0xa0]
pxor xmm1, xmm0
movdqu xmmword [rsp + rdx + 0x60], xmm1
movdqu xmm0, xmmword [rsp + rdx + 0x70]
movdqu xmm1, xmmword [rsp + rdx + 0xb0]
pxor xmm1, xmm0
movdqu xmmword [rsp + rdx + 0x70], xmm1
movdqu xmm0, xmmword [rsp + rdx + 0x80]
movdqu xmm1, xmmword [rsp + rdx + 0xc0]
pxor xmm1, xmm0
movdqu xmmword [rsp + rdx + 0x80], xmm1
add rdx, 0x40
cmp rdx, rcx
jl 0x14013eaf0
cmp r9d, ebx
jge 0x14013eba1
lea rcx, [rsp + 0x50]
add rcx, rdx
lea r8, [rsp + 0x90]
lea rax, [rsp + 0x50]
mov edx, ebx
sub r8, rax
sub edx, r9d
nop dword [rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14013eb90
or byte [rsp + 0x50], 0x80
lea rcx, [rsp + 0x50]
or byte [rsp + rbx + 0x4f], 1
mov r8, r13
mov edx, ebx
call fcn.1400caaa0
test rax, rax
je 0x14013ebf2
mov rdx, qword [rsp + 0x40]
mov r8, r12
mov rcx, r13
call fcn.14015df60
test eax, eax
jg 0x14013ec20
jne 0x14013ebf2
mov r8d, r14d
xor edx, edx
mov rcx, r12
mov ebp, 1
call fcn.14015df00
test eax, eax
jne 0x14013ea12
inc r14d
mov rax, qword [rsp + 0x48]
mov dword [rax], r14d
mov eax, esi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1402f09e0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov esi, 1
jmp 0x14013ebf2
Function at 0x140149fb0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1a0
call fcn.1402f1230
sub rsp, rax
mov rax, qword [0x140430528]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, r8
mov rsi, rdx
mov r8, r9
lea rdx, str.SHA512
call fcn.140086720
mov rdi, rax
test rax, rax
je 0x14014a033
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x150]
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r9 + 0x20]
call fcn.1400858f0
mov rcx, rdi
mov ebx, eax
call fcn.140086770
test ebx, ebx
jne 0x14014a03a
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x150]
call fcn.140001240
xor eax, eax
jmp 0x14014a0ee
movzx eax, byte [rsp + 0x16f]
lea rdx, [rsp + 0x150]
and byte [rsp + 0x150], 0xf8
lea rcx, [rsp + 0xb0]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x16f], al
call fcn.140149550
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x30]
call fcn.140145f00
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.140146180
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.140146180
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.140147820
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x80]
call fcn.140147820
movzx eax, byte [rsp + 0x30]
lea rcx, [rsp + 0x150]
shl al, 7
mov edx, 0x40
xor byte [rsi + 0x1f], al
call fcn.140001240
mov eax, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1402f09e0
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x14014a110
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1a8
call fcn.1402f1230
sub rsp, rax
mov rax, qword [0x140430528]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r12, qword [rsp + 0x210]
mov r15, r8
mov r8, qword [rsp + 0x220]
mov r14, rdx
mov rsi, rcx
lea rdx, str.SHA512
mov rcx, qword [rsp + 0x218]
mov r13, r9
call fcn.140086720
mov rdi, rax
call fcn.140086660
xor ebp, ebp
mov rbx, rax
test rdi, rdi
je 0x14014a31b
test rax, rax
je 0x14014a31b
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.140085ef0
test eax, eax
je 0x14014a31b
lea r8d, [rbp + 0x20]
mov rdx, r12
mov rcx, rbx
call fcn.140085f30
test eax, eax
je 0x14014a31b
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0xd0]
call fcn.140085d50
test eax, eax
je 0x14014a31b
movzx eax, byte [rsp + 0xef]
xor r8d, r8d
and byte [rsp + 0xd0], 0xf8
and al, 0x3f
or al, 0x40
mov rdx, rdi
mov rcx, rbx
mov byte [rsp + 0xef], al
call fcn.140085ef0
test eax, eax
je 0x14014a31b
lea r8d, [rbp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0xf0]
call fcn.140085f30
test eax, eax
je 0x14014a31b
mov r8, r15
mov rdx, r14
mov rcx, rbx
call fcn.140085f30
test eax, eax
je 0x14014a31b
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x110]
call fcn.140085d50
test eax, eax
je 0x14014a31b
lea rcx, [rsp + 0x110]
call fcn.14014c890
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
call fcn.140149550
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401494c0
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.140085ef0
test eax, eax
je 0x14014a31b
lea r8d, [rbp + 0x20]
mov rdx, rsi
mov rcx, rbx
call fcn.140085f30
test eax, eax
je 0x14014a31b
lea r8d, [rbp + 0x20]
mov rdx, r13
mov rcx, rbx
call fcn.140085f30
test eax, eax
je 0x14014a31b
mov r8, r15
mov rdx, r14
mov rcx, rbx
call fcn.140085f30
test eax, eax
je 0x14014a31b
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x150]
call fcn.140085d50
test eax, eax
je 0x14014a31b
lea rcx, [rsp + 0x150]
call fcn.14014c890
lea rcx, [rsi + 0x20]
lea r9, [rsp + 0x110]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x150]
call fcn.14014a800
mov ebp, 1
mov edx, 0x40
lea rcx, [rsp + 0x110]
call fcn.140001240
mov edx, 0x40
lea rcx, [rsp + 0xd0]
call fcn.140001240
mov rcx, rdi
call fcn.140086770
mov rcx, rbx
call fcn.1400865b0
mov eax, ebp
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1402f09e0
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140183a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.1402f1230
sub rsp, rax
mov r12, rdx
test rdx, rdx
mov rdx, r8
mov r15, r9
mov rbp, r8
je 0x140183c43
mov rbx, qword [rsp + 0xa8]
lea r14, [r9 + 1]
mov rsi, qword [rsp + 0xa0]
mov r13, qword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rbx
shr r14, 1
mov r8, r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
call fcn.140183810
test eax, eax
je 0x140183c7e
mov r8d, 0x1bb
mov qword [rsp + 0x70], rdi
lea rdx, str.providersimplementationskdfs_tls1_prf.c
mov rcx, rbx
call fcn.140087c20
mov rdi, rax
test rax, rax
jne 0x140183b0c
call fcn.140089990
lea r8, str.tls1_prf_alg
mov edx, 0x1bc
lea rcx, str.providersimplementationskdfs_tls1_prf.c
call fcn.140089ab0
xor r8d, r8d
lea ecx, [rdi + 0x39]
mov edx, 0xc0100
call fcn.140089bb0
xor eax, eax
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov r9, qword [rsp + 0x90]
sub rbp, r14
mov qword [rsp + 0x30], rbx
mov r8, r14
mov qword [rsp + 0x28], rdi
mov rcx, r12
mov qword [rsp + 0x20], r13
lea rdx, [r15 + rbp]
call fcn.140183810
test eax, eax
jne 0x140183b53
mov r9d, 0x1c2
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rdi
call fcn.140087d60
jmp 0x140183aea
xor ecx, ecx
test rbx, rbx
je 0x140183c21
cmp rbx, 0x40
jb 0x140183bf2
lea rdx, [rsi - 1]
lea rax, [rbx - 1]
add rdx, rbx
add rax, rdi
cmp rsi, rax
ja 0x140183b80
cmp rdx, rdi
jae 0x140183bf2
mov r8, rbx
and r8, 0xffffffffffffffc0
mov rdx, rdi
lea rax, [rsi + 0x10]
sub rdx, rsi
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, r8
jb 0x140183b91
cmp rcx, rbx
jae 0x140183c21
mov r8, rdi
lea rax, [rcx + rsi]
sub r8, rsi
mov rdx, rbx
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax + r8]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140183c10
mov r9d, 0x1c7
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rdi
call fcn.140087d60
mov eax, 1
jmp 0x140183aec
mov rax, qword [rsp + 0xa8]
mov r8, r15
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call fcn.140183810
test eax, eax
jne 0x140183c85
xor eax, eax
jmp 0x140183af1
mov eax, 1
jmp 0x140183af1
Function at 0x14018c970
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x14018c9f8
test r8, r8
je 0x14018c9f8
mov rax, qword [rcx + 0x28]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x14018c9b6
add rcx, 0x34
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x34]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x14018c9a0
mov rax, qword [r10 + 0x28]
cmp r8, rax
jbe 0x14018c9f8
sub r8, rax
cmp r8, 0x10
jbe 0x14018c9cc
mov r8d, reloc.WS2_32.dll_recv
jmp 0x14018c9d1
test r8, r8
je 0x14018c9f8
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x28]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x54], al
inc rcx
cmp rcx, r8
jb 0x14018c9e0
ret
Function at 0x1401ca400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov r11, qword [rcx]
mov rsi, rdx
mov r10, qword [rcx + 8]
mov rbx, rcx
mov r9, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov rax, qword [rcx + 0x20]
shl r11, 0x38
cmp dword [rcx + 0x30], 0
je 0x1401ca63f
test r8, r8
je 0x1401ca63f
mov r14d, dword [rcx + 0x2c]
cmp r8, r14
jne 0x1401ca63f
mov ecx, dword [rcx + 0x28]
dec ecx
cmp ecx, 6
ja case.default.0x1401ca46d
lea r8, [0x140000000]
mov edx, dword [r8 + rcx*4 + 0x1ca658]
add rdx, r8
jmp rdx
movzx ecx, byte [rbx + 0x3e]
shl rcx, 0x30
or r11, rcx
movzx ecx, byte [rbx + 0x3d]
shl rcx, 0x28
or r11, rcx
movzx ecx, byte [rbx + 0x3c]
shl rcx, 0x20
or r11, rcx
movzx ecx, byte [rbx + 0x3b]
shl rcx, 0x18
or r11, rcx
movzx ecx, byte [rbx + 0x3a]
shl rcx, 0x10
or r11, rcx
movzx ecx, byte [rbx + 0x39]
shl rcx, 8
or r11, rcx
movzx ecx, byte [rbx + 0x38]
or r11, rcx
xor rax, r11
cmp dword [rbx + 0x30], 0
jbe 0x1401ca506
mov ecx, dword [rbx + 0x30]
nop dword [rax]
nop dword [rax + rax]
add r10, r9
add rdi, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, rdi
rol r10, 0x20
add rdi, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, rdi
xor rax, r10
rol rdi, 0x20
sub rcx, 1
jne 0x1401ca4d0
xor r10, r11
mov ecx, 0xff
cmp r14d, 0x10
mov r8d, 0xee
cmovne r8d, ecx
mov ecx, dword [rbx + 0x34]
xor r8, rdi
test ecx, ecx
je 0x1401ca566
nop word [rax + rax]
add r10, r9
add r8, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r8
rol r10, 0x20
add r8, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r8
xor rax, r10
rol r8, 0x20
sub rcx, 1
jne 0x1401ca530
mov rdx, rax
xor rdx, r8
xor rdx, r9
xor rdx, r10
mov ecx, edx
mov byte [rsi], dl
shr ecx, 8
mov byte [rsi + 1], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rsi + 2], cl
mov ecx, edx
shr ecx, 0x18
shr rdx, 0x20
mov byte [rsi + 3], cl
mov ecx, edx
shr ecx, 8
mov byte [rsi + 5], cl
mov ecx, edx
mov byte [rsi + 4], dl
shr ecx, 0x10
shr edx, 0x18
mov byte [rsi + 6], cl
mov byte [rsi + 7], dl
cmp dword [rbx + 0x2c], 8
je 0x1401ca638
mov ecx, dword [rbx + 0x34]
xor r9, 0xdd
test ecx, ecx
je 0x1401ca5f7
add r10, r9
add r8, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r8
rol r10, 0x20
add r8, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r8
xor rax, r10
rol r8, 0x20
sub rcx, 1
jne 0x1401ca5c1
xor rax, r8
xor rax, r9
xor rax, r10
mov ecx, eax
mov byte [rsi + 8], al
shr ecx, 8
mov byte [rsi + 9], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 0xa], cl
mov ecx, eax
shr ecx, 0x18
shr rax, 0x20
mov byte [rsi + 0xb], cl
mov ecx, eax
shr ecx, 8
mov byte [rsi + 0xd], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 0xc], al
shr eax, 0x18
mov byte [rsi + 0xf], al
mov byte [rsi + 0xe], cl
mov eax, 1
jmp 0x1401ca641
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
Function at 0x1401d7840
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push r12
push r13
push r14
mov eax, 0x50
call fcn.1402f1230
sub rsp, rax
mov r14, qword [rsp + 0xa8]
lea r10, [rax - 0x51]
mov rbp, qword [rsp + 0xb0]
xor r11d, r11d
cmp r14, 1
mov eax, r11d
mov r13, r9
mov r12, r8
mov r9, qword [rcx]
setne al
add rax, rbp
mov rsi, rcx
cmp rax, r9
jbe 0x1401d789e
xor eax, eax
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0x80], rbx
cmp r14, 1
je 0x1401d79a3
lea r10, [r8 - 1]
add r10, r9
movzx ebx, byte [r10]
cmp dword [rsp + 0xb8], r11d
je 0x1401d78db
sub r9, rbx
mov eax, 1
sub r9, rbp
dec r9
mov qword [rcx], r9
jmp 0x1401d79da
lea rcx, [rbx + rax]
mov qword [rsp + 0x98], r15
mov r15d, 0x100
mov r8, r9
sub r8, rcx
mov rax, r9
xor r8, rcx
xor rax, rcx
or r8, rax
xor r8, r9
shr r8, 0x3f
dec r8
cmp r9, r15
cmovb r15, r9
test r15, r15
je 0x1401d797d
mov qword [rsp + 0x90], rdi
mov rdi, rbx
shr rdi, 0x3f
nop dword [rax]
nop dword [rax + rax]
mov rax, r11
lea r10, [r10 - 1]
shr rax, 0x3f
mov rcx, rbx
sub rcx, r11
inc r11
shr rcx, 0x3f
xor cl, al
xor al, dil
or cl, al
xor cl, dil
dec cl
movzx edx, cl
movzx ecx, byte [r10 + 1]
xor rcx, rbx
and rdx, rcx
not rdx
and r8, rdx
cmp r11, r15
jb 0x1401d7930
mov rdx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
lea rax, [rbx + 1]
not r8
movzx r10d, r8b
dec r10
shr r10, 0x3f
neg r10
and rax, r10
sub r9, rax
mov qword [rsi], r9
mov rax, qword [rsp + 0xc0]
mov r9, r13
mov qword [rsp + 0x40], rax
mov r8, r12
mov rax, qword [rsp + 0xa0]
mov rcx, rsi
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1401d7470
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1401d7f20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x68
call fcn.1402f1230
sub rsp, rax
mov rax, qword [0x140430528]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x3c]
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test eax, eax
je 0x1401d8064
movups xmm0, xmmword [rcx + 0x10]
mov r15, qword [rcx + 0x20]
lea rbx, [rcx + 0x10]
dec eax
mov dword [rsp + 0x28], 1
mov dword [rcx + 0x3c], eax
xor r9d, r9d
movups xmmword [rsp + 0x48], xmm0
and byte [rsp + 0x54], 0x7f
xor r8d, r8d
psrldq xmm0, 8
xor edx, edx
movd eax, xmm0
mov rcx, r15
mov dword [rsp + 0x30], edi
and al, 0x7f
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.14007d7f0
test eax, eax
je 0x1401d8064
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov r9, r14
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, r15
call fcn.14007e480
test eax, eax
je 0x1401d8064
mov r9, rdi
lea rdx, [rsp + 0x38]
mov r8, rbp
mov rcx, rsi
call fcn.1401d8580
test eax, eax
je 0x1401d8064
lea rax, [rbx + 0xf]
xor r8d, r8d
lea rcx, [rsp + 0x38]
cmp rcx, rax
ja 0x1401d8039
lea rax, [rsp + 0x47]
cmp rax, rbx
jb 0x1401d8039
lea rcx, [rsp + 0x38]
mov eax, r8d
sub rbx, rcx
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x38]
add rdx, rax
inc rax
movzx ecx, byte [rbx + rdx]
xor byte [rdx], cl
cmp rax, 0x10
jl 0x1401d8020
jmp 0x1401d804d
movdqu xmm1, xmmword [rsp + 0x38]
movdqu xmm0, xmmword [rbx]
pxor xmm1, xmm0
movdqu xmmword [rsp + 0x38], xmm1
mov rax, qword [rsp + 0x38]
or rax, qword [rsp + 0x40]
je 0x1401d8080
mov rdx, rdi
mov rcx, rbp
call fcn.140001240
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402f09e0
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsi + 0x38], r8d
mov eax, edi
jmp 0x1401d8066
Function at 0x140207960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0x98]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x140207b5d
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd rbp, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r14d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [r12 + 0x20]
test al, al
jne 0x1402079c2
inc dword [rbx + 0x38]
mov r15d, dword [rbx + 0x38]
jmp 0x1402079d2
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r15d, dword [rbx + rax*4 + 0xd8]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r14 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x1402079ff
mov r9d, edx
mov dword [rsp + 0x20], r14d
mov edx, reloc.WS2_32.dll_getservbyname
mov rcx, rdi
call fcn.1402471f0
jmp 0x140207a2d
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], reloc.WS2_32.dll_getservbyname
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r14d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], WSACleanup
mov r9, qword [r9 + 0x68]
call fcn.14029e3e0
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x140207a71
mov edx, 5
mov rcx, rdi
call fcn.140247260
test eax, eax
jne 0x140207b49
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], reloc.WS2_32.dll_gethostbyaddr
mov dword [rax + rcx*8 + 4], r13d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r13d
lea ecx, [r14 + 1]
mov byte [rdx + 1], r13b
add eax, 2
mov dword [rdx + 8], eax
lea eax, [r14 - 1]
mov qword [rdx + 0x10], r13
mov word [rdx + 2], r13w
mov qword [rdx + 0x18], 0x7f
mov qword [rdx + 0x20], r13
mov qword [rdx + 0x28], r13
mov qword [rdx + 0x30], 0x61
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r13
mov qword [rdx + 0x48], 0x80
mov qword [rdx + 0x50], r13
mov qword [rdx + 0x58], r13
mov qword [rdx + 0x60], 0x7a
mov qword [rdx + 0x68], r13
mov qword [rdx + 0x70], r13
add dword [rdi + 0x90], 5
mov dword [rdx + 0x34], eax
mov eax, 8
mov word [rdx + 0x4a], ax
mov dword [rdx + 4], ecx
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x3c], r15d
mov dword [rdx + 0x50], r15d
mov dword [rdx + 0x54], ecx
test r15d, r15d
je 0x140207b3d
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x140207b3d
mov dword [rbx + rax*4 + 0xd8], r15d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1402079a0
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1402191c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r14
sub rsp, 0x68
movzx eax, byte [rdx]
mov r14, rdx
mov rdi, rcx
cmp al, 0xb0
jne 0x1402191d9
movzx eax, byte [rdx + 2]
cmp al, 0xb1
jne 0x1402191e3
mov rax, qword [rdx + 0x20]
jmp 0x1402191f3
cmp al, 0x8a
jne 0x140219377
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax]
cmp ecx, 1
je 0x140219377
mov dword [r8], 0
cmp byte [rdx], 0x8a
jne 0x14021921a
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.14027bdf0
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x140219362
mov qword [rsp + 0x80], rbx
lea rcx, [0x1402afe40]
mov qword [rsp + 0x90], rbp
mov ebp, r13d
mov qword [rsp + 0x50], r15
lea r13, [fcn.14021a1f0]
xor r15d, r15d
mov qword [rsp + 0x98], rsi
lea edx, [r15 + 2]
nop dword [rax + rax]
cmp byte [rdi + 0x23], 0
mov rax, qword [r14 + 0x20]
mov rbx, qword [rax + r15 + 8]
je 0x1402192d0
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x1402192c0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1402dff00
cmp word [rsp + 0x44], 0
je 0x1402192d0
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.140285e20
jmp 0x140219310
mov rsi, qword [rdi]
test rbx, rbx
je 0x1402192ec
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140219650
mov rbx, rax
cmp byte [rsi + 0x67], 0
jne 0x140219300
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1402841d0
test rbx, rbx
je 0x140219310
mov rdx, rbx
mov rcx, rsi
call fcn.140287b50
inc ebp
lea rcx, [0x1402afe40]
add r15, 0x20
mov edx, 2
sub r12, 1
jne 0x140219280
mov eax, dword [rsp + 0x88]
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r14
pop rdi
ret
mov rcx, rdi
add rsp, 0x68
pop r14
pop rdi
jmp fcn.140287440
Function at 0x140246860
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov qword [rsp + 0x40], rbp
mov rbp, rcx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x58], r14
mov r14, r9
test r8d, r8d
je 0x1402468f9
lea rcx, str.PRAGMA__Q.page_size
mov dword [rsp + 0x50], 0
call fcn.1401f3a90
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, rbp
mov rsi, rax
call fcn.1402453d0
mov ebx, eax
test eax, eax
jne 0x1402468dd
movzx ecx, byte [rdi + 0x27]
mov r8d, dword [rsp + 0x50]
imul edx, ecx, 0x33
add r8d, 0xffffffc0
mov dword [rdi + 0x20], r8d
add edx, 4
cmp edx, r8d
jge 0x140246960
mov dword [rdi + 0x20], edx
jmp 0x140246960
mov rcx, rbp
call fcn.1401f4ca0
mov rdx, rax
lea rcx, [0x14035a7b4]
call fcn.1401f3a90
mov qword [r14], rax
jmp 0x140246960
mov r8, qword [rdi + 0x38]
lea rcx, str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
mov qword [rsp + 0x20], r15
call fcn.1401f3a90
lea r8, [rdi + 0x20]
mov rdx, rax
mov rcx, rbp
mov rsi, rax
call fcn.1402453d0
mov ebx, eax
test eax, eax
je 0x14024693a
mov rcx, rbp
call fcn.1401f4ca0
mov rdx, rax
lea rcx, [0x14035a7b4]
jmp 0x140246953
cmp dword [rdi + 0x20], 0x1c0
jge 0x14024695b
mov rdx, qword [rdi + 0x38]
lea rcx, str.undersize_RTree_blobs_in___q_node_
mov ebx, 0x10b
call fcn.1401f3a90
mov qword [r14], rax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
test rsi, rsi
je 0x1402469d6
cmp dword [0x14042c570], 0
je 0x1402469cd
mov rcx, qword [0x140433850]
test rcx, rcx
je 0x14024698f
call qword [0x14042c5f0]
mov rcx, rsi
call qword [0x14042c5a8]
dec qword [0x1404337e8]
movsxd rcx, eax
sub qword [0x1404337a0], rcx
mov rcx, rsi
call qword [0x14042c598]
mov rcx, qword [0x140433850]
test rcx, rcx
je 0x1402469d6
call qword [0x14042c600]
mov eax, ebx
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rsi
call qword [0x14042c598]
mov eax, ebx
add rsp, 0x28
pop rsi
pop rbx
ret