joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402b28a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [rcx]
test edx, edx
mov rdi, qword [rax + 0x18]
mov rsi, rcx
mov ebx, edx
mov rbp, r8
jg 0x1402b28c8
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, qword [r8]
test rcx, rcx
je 0x1402b28bb
movzx eax, word [rcx + 0x14]
mov edx, eax
not edx
test dx, 0x202
je 0x1402b29a8
test al, 1
jne 0x1402b28bb
mov edx, 1
call sym.valueToText
mov rdx, rax
test rdx, rdx
je 0x1402b28bb
mov eax, dword [rdi + 0x88]
sub ebx, 1
mov ecx, 0x200
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], ebx
lea r8, [rbp + 8]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x48], r8
mov word [rsp + 0x6c], cx
lea r8, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], 0
call sym.sqlite3_str_appendf
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x68]
test rdx, rdx
je 0x1402b297f
mov eax, r8d
mov byte [rdx + rax], 0
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x1402b297a
test byte [rsp + 0x6d], 4
je 0x1402b29c0
mov rdx, qword [rsp + 0x58]
lea rax, [sym.sqlite3OomClear]
mov r9d, 1
mov rcx, rsi
mov qword [rsp + 0x20], rax
call sym.setResultStrOrError
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp byte [rcx + 0x16], 1
jne 0x1402b28e3
mov rdx, qword [rcx + 8]
jmp 0x1402b28f4
mov rcx, rbx
mov dword [rsp + 0x3c], r8d
call sym.strAccumFinishRealloc
mov r8d, dword [rsp + 0x3c]
mov rdx, rax
jmp 0x1402b297f

Function at 0x1402b9a00
Capabilities:
Reference sql statements

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r12d, dword [rsp + 0x90]
mov byte [rcx + 0x1c], 1
mov edi, r8d
mov rsi, rdx
mov rbp, r9
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rbx, rcx
mov dword [rsp + 0x20], r8d
mov r8, rdx
mov dword [rsp + 0x30], r12d
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
call sym.sqlite3NestedParse
test edi, edi
je 0x1402b9a58
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9, rbp
mov r8, rsi
mov rcx, rbx
mov dword [rsp + 0x90], r12d
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.sqlite3NestedParse
Function at 0x1402bfd80
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
lea rsi, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movq xmm1, rax
movq xmm0, rsi
punpcklqdq xmm0, xmm1
movsxd rax, edx
mov rbx, rcx
mov edi, edx
movaps xmmword [rsp + 0x40], xmm0
lea r13, [rax + 4]
mov rbp, r8
mov r12, r9
mov rsi, qword [rcx + r13*8 + 8]
test rsi, rsi
je 0x1402bfe70
mov r9d, dword [rbx + 0x40]
test r9d, r9d
je 0x1402bfde8
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edx, edx
mov rcx, rsi
call sym.vdbeUnbind
test eax, eax
jne 0x1402bfe25
mov rcx, qword [rsi + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x1402bfe60
mov r8d, 4
mov qword [rcx], rbp
mov word [rcx + 0x14], r8w
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1402bfe25
call qword [0x1403951b0]
mov rcx, rsi
call sym.sqlite3_step
cmp eax, 0x65
je 0x1402bfe90
cmp eax, 0x64
je 0x1402bfec8
mov rcx, rsi
call sym.sqlite3_reset
mov edx, dword [rbx + 0x40]
test edx, edx
jne 0x1402bfdd6
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rbp
call sym.vdbeReleaseAndSetInt64
jmp 0x1402bfe13
mov rdx, qword [rsp + rax*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call sym.rtreeCheckPrepare
mov rsi, rax
mov qword [rbx + r13*8 + 8], rax
jmp 0x1402bfdcd
test edi, edi
mov r9, r12
mov r8, rbp
lea rdx, str.__rowid
mov rcx, rbx
lea rax, str.__parent
cmovne rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call sym.rtreeCheckAppendMsg
jmp 0x1402bfe3b
mov rcx, rsi
call sym.sqlite3_column_int64.constprop.0
cmp r12, rax
mov r9, rax
je 0x1402bfe3b
test edi, edi
mov qword [rsp + 0x30], r12
mov r8, rbp
mov rcx, rbx
lea rdx, str.__rowid
mov qword [rsp + 0x28], rbp
lea rax, str.__parent
cmovne rax, rdx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call sym.rtreeCheckAppendMsg
jmp 0x1402bfe3b
Function at 0x1402e68c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
cmp byte [rcx + 0x23], 0
mov rbx, rcx
mov ebp, r8d
je 0x1402e6998
mov eax, 2
test rdx, rdx
mov dword [rsp + 0x58], 0
mov word [rsp + 0x54], ax
lea rsi, [sym.exprNodeIsConstant]
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rsi
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
je 0x1402e6970
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
call sym.walkExpr
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
jne 0x1402e6970
mov rdi, qword [rbx]
mov rcx, rdi
call sym.exprDup.constprop.0
cmp byte [rdi + 0x67], 0
mov rsi, rax
jne 0x1402e6955
cmp qword [rbx + 0x10], 0
je 0x1402e6955
mov r8d, ebp
mov rdx, rax
mov rcx, rbx
call sym.sqlite3ExprCode.part.0
test rsi, rsi
je 0x1402e6988
mov rdx, rsi
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3ExprDeleteNN
mov r8d, ebp
mov rcx, rbx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3ExprCodeRunJustOnce
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
test rdx, rdx
mov rdi, qword [rcx]
jne 0x1402e692f
cmp byte [rdi + 0x67], 0
jne 0x1402e6988
cmp qword [rcx + 0x10], 0
je 0x1402e6988
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.sqlite3ExprCode.part.0
Function at 0x1402ea850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
test rdx, rdx
mov rbx, rcx
mov rsi, r8
je 0x1402ea886
nop word [rax + rax]
mov eax, dword [rdx + 4]
test eax, 0x82000
je 0x1402ea8e3
test eax, 0x80000
je 0x1402ea8d0
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x1402ea868
movzx eax, byte [rbx + 0x1f]
test al, al
je 0x1402ea990
sub eax, 1
mov byte [rbx + 0x1f], al
movzx eax, al
mov edi, dword [rbx + rax*4 + 0xe4]
mov r8d, edi
mov rcx, rbx
call sym.sqlite3ExprCodeTarget
cmp eax, edi
je 0x1402ea980
test edi, edi
jne 0x1402ea960
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x1402ea886
mov eax, dword [rdx + 4]
test eax, 0x82000
jne 0x1402ea872
cmp byte [rbx + 0x23], 0
je 0x1402ea886
cmp byte [rdx], 0xb0
je 0x1402ea886
lea rcx, [rsp + 0x30]
mov eax, 2
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x54], ax
lea rdi, [sym.exprNodeIsConstant]
lea rax, [sym.sqlite3SelectWalkFail]
movq xmm0, rdi
mov dword [rsp + 0x58], 0
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
call sym.walkExpr
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
je 0x1402ea886
mov r8d, 0xffffffff
mov rcx, rbx
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
jmp sym.sqlite3ExprCodeRunJustOnce
movzx edx, byte [rbx + 0x1f]
cmp dl, 7
ja 0x1402ea8bd
lea ecx, [rdx + 1]
mov byte [rbx + 0x1f], cl
mov dword [rbx + rdx*4 + 0xe4], edi
jmp 0x1402ea8bd
mov dword [rsi], edi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x38]
lea edi, [rax + 1]
mov dword [rbx + 0x38], edi
jmp 0x1402ea8a2
Function at 0x140302470
Capabilities:
Reference sql statements

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [rcx + 0x68]
mov r13, qword [rcx]
test rsi, rsi
mov rdi, rcx
mov r12, rdx
mov r14d, dword [r13 + 0x18]
mov rbx, r8
je 0x140302520
mov rcx, rsi
call sym.sqlite3_reset
xor edx, edx
mov rcx, rsi
call sym.vdbeUnbind
test eax, eax
jne 0x1403024e2
mov rcx, qword [rsi + 0x80]
test word [rcx + 0x14], 0x9000
jne 0x140302690
mov eax, 4
mov qword [rcx], r12
mov word [rcx + 0x14], ax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1403024e2
call qword [0x1403951b0]
mov rcx, rsi
call sym.sqlite3_step
cmp eax, 0x64
je 0x1403025a0
mov rcx, rsi
call sym.sqlite3_reset
mov ebp, eax
test eax, eax
mov eax, 0x10b
cmove ebp, eax
mov eax, ebp
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [r13 + 8]
lea rcx, str.SELECT_sz_FROM__Q._q_docsize_WHERE_id_
mov ebp, 7
mov r8, qword [r13 + 0x10]
call sym.sqlite3_mprintf
test rax, rax
mov rsi, rax
je 0x140302580
mov rax, qword [rdi]
xor r9d, r9d
mov r8d, 0x85
mov rdx, rsi
mov rcx, qword [r13]
add dword [rax + 0x78], 1
lea rax, [rdi + 0x68]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.sqlite3LockAndPrepare.constprop.0
mov rcx, rsi
mov ebp, eax
mov rax, qword [rdi]
sub dword [rax + 0x78], 1
call sym.sqlite3_free
mov rsi, qword [rdi + 0x68]
mov rcx, rsi
call sym.sqlite3_reset
test rsi, rsi
je 0x140302507
jmp 0x1403024a3
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1403025b2
call qword [0x1403951a0]
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x1403026a0
cmp word [rsi + 0xc0], 0
je 0x1403026a0
call sym.sqlite3_value_blob
mov rcx, rsi
mov r13, rax
call sym.columnMallocFailure
xor edx, edx
mov rcx, rsi
call sym.columnMem
mov rcx, rax
call sym.sqlite3ValueBytes.constprop.0
mov rcx, rsi
mov r12d, eax
call sym.columnMallocFailure
test r14d, r14d
jle 0x1403026f5
test r12d, r12d
jle 0x1403024f3
lea eax, [r14 - 1]
xor ebp, ebp
lea r14, [rbx + rax*4]
lea rdi, [rsp + 0x38]
jmp 0x14030266e
movzx r8d, byte [rcx + 1]
test r8b, r8b
jns 0x1403026c0
movzx eax, byte [rcx + 2]
shl edx, 0xe
or edx, eax
test al, 0x80
je 0x1403026d8
mov rdx, rdi
call sym.sqlite3Fts5GetVarint
mov edx, dword [rsp + 0x38]
movzx eax, al
and edx, 0x7fffffff
mov dword [rbx], edx
add ebp, eax
cmp r14, rbx
je 0x140302700
add rbx, 4
cmp ebp, r12d
jge 0x1403024f3
movsxd rcx, ebp
add rcx, r13
movzx edx, byte [rcx]
test dl, dl
mov eax, edx
js 0x140302620
mov dword [rbx], edx
mov eax, 1
jmp 0x140302656
mov rdx, r12
call sym.vdbeReleaseAndSetInt64
jmp 0x1403024d0
mov rcx, qword [rsi]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call sym.sqlite3ErrorFinish
lea rcx, [0x14047dde0]
jmp 0x1403025d0
and eax, 0x7f
shl eax, 7
or eax, r8d
mov dword [rbx], eax
mov eax, 2
jmp 0x140302656
and r8d, 0x7f
and edx, 0x1fc07f
mov eax, 3
shl r8d, 7
or edx, r8d
mov dword [rbx], edx
jmp 0x140302656
xor ebp, ebp
nop word [rax + rax]
cmp r12d, ebp
jne 0x1403024f3
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.sqlite3_reset
Function at 0x140302e00
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [rsp + 0x90]
test rcx, rcx
mov r12d, edx
mov rsi, r8
mov dword [rbp], 0
mov r13d, r9d
mov dword [rsp + 0x2c], 0
je 0x140302ece
mov eax, r9d
sub eax, 1
js 0x140302f38
movsxd rdi, r9d
movsxd rdx, eax
mov eax, eax
lea r9, [r8 + rdi - 2]
add rdx, r8
sub r9, rax
mov eax, 0xd
nop dword [rax + rax]
lea r8d, [rax*8]
sub rdx, 1
xor eax, r8d
movsx r8d, byte [rdx + 1]
xor eax, r8d
cmp rdx, r9
jne 0x140302e60
lea edx, [rax*8]
xor eax, edx
xor eax, r12d
and eax, 0x1ff
lea r14, [rcx + rax*8]
mov rbx, qword [r14]
test rbx, rbx
jne 0x140302ea9
jmp 0x140302ee0
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140302ee0
cmp dword [rbx + 0xc], r12d
jne 0x140302ea0
cmp dword [rbx + 8], r13d
jne 0x140302ea0
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140302ea0
mov dword [rbp], 1
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, [rdi + 0x18]
lea rcx, [rsp + 0x2c]
call sym.sqlite3Fts5MallocZero
test rax, rax
mov rbx, rax
je 0x140302f25
lea rcx, [rax + 0x18]
movd xmm1, r12d
movd xmm0, r13d
punpckldq xmm0, xmm1
mov qword [rax], rcx
mov r8, rdi
mov rdx, rsi
movq qword [rax + 8], xmm0
call sym.memcpy
mov rax, qword [r14]
mov qword [rbx + 0x10], rax
mov qword [r14], rbx
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 0x68
mov eax, 0xd
movsxd rdi, r9d
jmp 0x140302e83

Function at 0x140310130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r9d, word [rcx + 0x14]
movzx r10d, word [rdx + 0x14]
mov eax, r9d
or eax, r10d
test al, 1
jne 0x1403101a0
test al, 0x2c
je 0x140310180
mov eax, r9d
and eax, r10d
test al, 0x24
jne 0x1403101b0
test al, 8
je 0x1403101c0
movsd xmm1, qword [rcx]
movsd xmm0, qword [rdx]
comisd xmm0, xmm1
ja 0x14031020c
xor eax, eax
comisd xmm1, xmm0
seta al
jmp 0x14031017d
fstp st(0)
fstp st(0)
jmp 0x14031017d
fstp st(0)
fstp st(0)
ret
test al, 2
je 0x140310199
and r9d, 2
je 0x1403101f0
and r10d, 2
je 0x14031020c
test r8, r8
jne 0x140310218
jmp sym.sqlite3BlobCompare
and r10d, 1
and r9d, 1
mov eax, r10d
sub eax, r9d
ret
mov rax, qword [rdx]
cmp qword [rcx], rax
jl 0x14031020c
setg al
movzx eax, al
ret
test r9b, 0x24
jne 0x140310200
and r9d, 8
mov eax, 1
je 0x14031017d
and r10d, 0x24
je 0x14031020c
fild qword [rdx]
fld qword [rcx]
fcomi st(1)
ja 0x140310173
fxch st(1)
xor eax, eax
fcompi st(1)
fstp st(0)
seta al
neg eax
ret
mov eax, 1
ret
test r10b, 8
jne 0x140310220
and r10d, 0x24
jne 0x1403101b0
mov eax, 0xffffffff
ret
xor r9d, r9d
jmp sym.vdbeCompareMemString
fild qword [rcx]
mov eax, 0xffffffff
fld qword [rdx]
fcomi st(1)
ja 0x140310179
fxch st(1)
xor eax, eax
fcompi st(1)
fstp st(0)
seta al
ret
Function at 0x14032e020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov edx, dword [rcx + 0x90]
mov rsi, rcx
lea r9d, [rdx + 5]
cmp r9d, dword [rcx + 0x94]
jg 0x14032e238
movsxd rax, edx
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x88]
lea rax, [rax + rcx*8]
movzx ecx, byte [rbx]
mov byte [rax], cl
movsx r11d, byte [rbx + 2]
movsx r8d, byte [rbx + 1]
movd xmm1, r11d
test r11b, r11b
movd xmm0, r8d
punpckldq xmm0, xmm1
lea r8, [0x14047ed80]
movq qword [rax + 4], xmm0
jle 0x14032e08f
test byte [r8 + rcx], 1
jne 0x14032e228
movsx ecx, byte [rbx + 3]
xor edi, edi
mov byte [rax + 1], 0
mov qword [rax + 0x10], 0
mov word [rax + 2], di
mov dword [rax + 0xc], ecx
movzx ecx, byte [rbx + 4]
mov byte [rax + 0x18], cl
movsx r10d, byte [rbx + 6]
movsx edi, byte [rbx + 5]
test byte [r8 + rcx], 1
movd xmm2, r10d
movd xmm0, edi
punpckldq xmm0, xmm2
movq qword [rax + 0x1c], xmm0
je 0x14032e0da
test r10b, r10b
jg 0x14032e218
movsx ecx, byte [rbx + 7]
xor r11d, r11d
mov byte [rax + 0x19], 0
mov qword [rax + 0x28], 0
mov word [rax + 0x1a], r11w
mov dword [rax + 0x24], ecx
movzx ecx, byte [rbx + 8]
mov byte [rax + 0x30], cl
movsx r11d, byte [rbx + 0xa]
movsx edi, byte [rbx + 9]
movd xmm3, r11d
test r11b, r11b
movd xmm0, edi
punpckldq xmm0, xmm3
movq qword [rax + 0x34], xmm0
jle 0x14032e127
test byte [r8 + rcx], 1
jne 0x14032e208
movsx ecx, byte [rbx + 0xb]
xor r10d, r10d
mov byte [rax + 0x31], 0
mov qword [rax + 0x40], 0
mov word [rax + 0x32], r10w
mov dword [rax + 0x3c], ecx
movzx ecx, byte [rbx + 0xc]
mov byte [rax + 0x48], cl
movsx r11d, byte [rbx + 0xe]
movsx edi, byte [rbx + 0xd]
movd xmm4, r11d
test r11b, r11b
movd xmm0, edi
punpckldq xmm0, xmm4
movq qword [rax + 0x4c], xmm0
jle 0x14032e174
test byte [r8 + rcx], 1
jne 0x14032e1f8
movsx ecx, byte [rbx + 0xf]
mov byte [rax + 0x49], 0
mov qword [rax + 0x58], 0
mov dword [rax + 0x54], ecx
xor ecx, ecx
mov word [rax + 0x4a], cx
movzx ecx, byte [rbx + 0x10]
mov byte [rax + 0x60], cl
movsx r10d, byte [rbx + 0x12]
movsx edi, byte [rbx + 0x11]
test byte [r8 + rcx], 1
movd xmm5, r10d
movd xmm0, edi
punpckldq xmm0, xmm5
movq qword [rax + 0x64], xmm0
je 0x14032e1bb
test r10b, r10b
jg 0x14032e1e8
movsx edx, byte [rbx + 0x13]
mov byte [rax + 0x61], 0
mov qword [rax + 0x70], 0
mov dword [rax + 0x6c], edx
xor edx, edx
mov word [rax + 0x62], dx
mov dword [rsi + 0x90], r9d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
add r10d, edx
mov dword [rax + 0x68], r10d
jmp 0x14032e1bb
add r11d, edx
mov dword [rax + 0x50], r11d
jmp 0x14032e174
add r11d, edx
mov dword [rax + 0x38], r11d
jmp 0x14032e127
add r10d, edx
mov dword [rax + 0x20], r10d
jmp 0x14032e0da
add r11d, edx
mov dword [rax + 8], r11d
jmp 0x14032e08f
call sym.growOpArray.isra.0
test eax, eax
jne 0x14032e250
mov edx, dword [rsi + 0x90]
lea r9d, [rdx + 5]
jmp 0x14032e044
xor eax, eax
jmp 0x14032e1db
Function at 0x140370f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xc0
mov rsi, r8
movzx r8d, byte [r8 + 8]
mov rax, rcx
mov rdi, r9
cmp byte [rcx + 0x16], r8b
jne 0x140370fa0
mov r10d, dword [rcx + 0x10]
mov r8, qword [rdx + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], r8
mov r9d, dword [rdx + 0x10]
mov edx, r10d
mov r8, qword [rax + 8]
call qword [rsi + 0x18]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x60], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x98], rcx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movzx ecx, word [rax + 0x14]
test ch, 0x20
jne 0x140370ff2
and ch, 0x8f
or ch, 0x40
mov word [rsp + 0x54], cx
mov rax, qword [rdx]
mov qword [rsp + 0x80], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x88], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x90], rax
movzx eax, word [rdx + 0x14]
test ah, 0x20
jne 0x14037102c
and ah, 0x8f
or ah, 0x40
mov word [rsp + 0x94], ax
xor ebx, ebx
and ecx, 1
jne 0x140371049
lea rcx, [rsp + 0x40]
movzx edx, r8b
call sym.valueToText
movzx r8d, byte [rsi + 8]
mov rbx, rax
movzx eax, word [rsp + 0x94]
mov edx, eax
not edx
test dx, 0x202
je 0x140371100
test al, 1
jne 0x1403710d8
lea rcx, [rsp + 0x80]
movzx edx, r8b
call sym.valueToText
test rbx, rbx
je 0x1403710d8
test rax, rax
je 0x1403710d8
mov rcx, qword [rsi + 0x10]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x90]
mov edx, dword [rsp + 0x50]
call qword [rsi + 0x18]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x1403710ea
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x140370f8d
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], eax
call sym.vdbeMemClear
mov eax, dword [rsp + 0x3c]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
test rdi, rdi
je 0x1403710e0
mov byte [rdi], 7
mov ecx, dword [rsp + 0x60]
xor eax, eax
test ecx, ecx
je 0x1403710a2
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
call sym.vdbeMemClear
mov eax, dword [rsp + 0x3c]
jmp 0x1403710a2
cmp byte [rsp + 0x96], r8b
jne 0x140371060
mov rax, qword [rsp + 0x88]
jmp 0x140371075
Function at 0x21adf50
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x21adf5d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x21adf6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x21adf55
lea eax, [rcx + 1]
jmp 0x21adf7b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x21adf8e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x21adf74
sub eax, 3
jb 0x21adfae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x21adffd
sar eax, 1
movsxd rbp, eax
jb 0x21adfe4
jmp 0x21adfbc
add ebx, ebx
jne 0x21adfba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x21adfe4
inc ecx
add ebx, ebx
jne 0x21adfca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x21adfe4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x21adfdd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x21adfcc
add ecx, 2
jmp 0x21adfe9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.021adf12
jmp 0x21adf5d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1d89000]
mov eax, dword [rdi]
or eax, eax
je 0x21ae059
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1dae000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x21ae009
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x21ae053
mov qword [rbx], rax
add rbx, 8
jmp 0x21ae029
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x21ae09d
cmp al, 0xef
ja 0x21ae085
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x21ae065
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x21ae074
mov eax, dword [rdi]
add rdi, 4
jmp 0x21ae074
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x21ae0f1
sub rsp, 0xffffffffffffff80
jmp 0x46f380
Function at 0x140858058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408581df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140858089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14085806f
add dl, dl
jne 0x140858096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408580f6
xor eax, eax
add dl, dl
jne 0x1408580a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408581ad
add dl, dl
jne 0x1408580b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408580c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408580d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408580dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408580ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14085807e
mov eax, 1
add dl, dl
jne 0x140858106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140858113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408580fb
sub eax, ebx
mov ebx, 1
jne 0x14085814c
mov ecx, 1
add dl, dl
jne 0x14085812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14085813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140858123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14085807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140858168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140858175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14085815d
cmp eax, 0x7d00
jae 0x14085819b
cmp eax, 0x500
jb 0x140858196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14085807e
cmp eax, 0x7f
ja 0x14085819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14085807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408581d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14085807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20