joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401154a0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x1401154b8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x1401154b8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x1401154c0
xor eax, eax
ret
cmp rbx, 3
je 0x1401154cc
cmp rbx, 4
jne 0x1401154f9
cmp al, 0x2c
ja 0x1401154e6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x1401154f6
cmp al, 0x24
je 0x1401154f6
nop dword [rax]
cmp al, 0x26
jae 0x1401154f6
jmp 0x1401154f9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x1401154f6
cmp al, 0x5b
je 0x1401154f6
cmp al, 0x5d
jne 0x1401154f9
xor eax, eax
ret
cmp al, 0x2f
ja 0x140115532
nop dword [rax]
cmp al, 0x26
ja 0x140115511
cmp al, 0x24
je 0x140115551
cmp al, 0x26
je 0x140115551
jmp 0x1401155cb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x140115551
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x1401155c8
cmp al, 0x2f
je 0x140115551
jmp 0x1401155cb
cmp al, 0x3d
ja 0x140115549
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x140115551
nop
cmp al, 0x3d
je 0x140115551
jmp 0x1401155cb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x1401155c0
cmp rbx, 2
jg 0x140115587
cmp rbx, 1
je 0x140115581
nop dword [rax]
cmp rbx, 2
jne 0x1401155cb
cmp al, 0x2f
je 0x140115572
cmp al, 0x3b
je 0x140115572
cmp al, 0x2c
jne 0x140115579
mov ecx, 1
jmp 0x14011557e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x1401155aa
cmp al, 0x40
je 0x140115599
cmp al, 0x2f
je 0x140115599
cmp al, 0x3f
jne 0x1401155a2
mov ecx, 1
nop
jmp 0x1401155a7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x1401155b9
cmp rbx, 7
jne 0x1401155cb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x1401155c8
cmp al, 0x7e
jne 0x1401155cb
xor eax, eax
ret
cmp rbx, 7
jne 0x1401155e1
cmp al, 0x21
je 0x1401155dd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x1401155e1
xor eax, eax
nop
ret
mov eax, 1
ret

Function at 0x1401173a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14011748d
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
nop dword [rax + rax]
test rcx, rcx
jle 0x140117479
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call fcn.14011a500
xorps xmm15, xmm15
mov r14, qword [0x14041f678]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rcx
mov rsi, rcx
cmovl rsi, rbx
mov rdi, qword [rsp + 0x58]
cmp rdi, rdx
jne 0x140117433
cmp rbx, rcx
jmp 0x140117465
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov rax, rdx
mov rbx, rdi
mov rcx, rsi
call fcn.140074c80
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rdx, qword [rsp + 0x40]
mov rbx, rax
mov rax, qword [rsp + 0x38]
jae 0x140117471
mov byte [rdx + rbx], 0
add rsp, 0x48
pop rbp
ret
mov rax, rbx
call fcn.1400742e0
lea rax, [0x140252600]
lea rbx, [0x1402999b0]
call fcn.140040c00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140071fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1401173a0
Function at 0x14011eae0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14011ebb0
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], edi
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
lea rax, [0x14024f4c0]
lea rbx, [rsp + 0x48]
xor ecx, ecx
xor edi, edi
call fcn.140007ea0
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 8], rdx
mov edx, dword [rsp + 0x70]
mov dword [rsp + 0x10], edx
mov edx, dword [rsp + 0x74]
mov dword [rsp + 0x14], edx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x30], rdx
call fcn.1401178a0
xorps xmm15, xmm15
mov r14, qword [0x14041f678]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x38]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.140071fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
jmp fcn.14011eae0

Function at 0x140124ba0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140124c75
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rdx
lea rax, [0x14024f4c0]
lea rbx, [rsp + 0x38]
xor ecx, ecx
xor edi, edi
nop
call fcn.140007ea0
lea rax, [0x140251e80]
mov rbx, qword [rsp + 0x60]
lea rcx, [0x140252a00]
lea rdi, [0x140233ac8]
nop
call fcn.140007ea0
lea rax, [0x140251ec0]
mov rbx, qword [rsp + 0x68]
lea rcx, [0x140252a00]
lea rdi, [0x140233ac8]
nop
call fcn.140007ea0
mov rdx, qword [rsp + 0x30]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], 0xffffffff
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdx
call fcn.140117bc0
xorps xmm15, xmm15
mov r14, qword [0x14041f678]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x28]
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140071fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.140124ba0
Function at 0x140125800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14012589d
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
test rdi, rdi
jbe 0x140125892
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x14024f680]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
call fcn.140007ea0
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov edx, dword [rsp + 0x50]
mov dword [rsp + 8], edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x18], edx
call fcn.140117740
xorps xmm15, xmm15
mov r14, qword [0x14041f678]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.1400742e0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.140071fe0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.140125800

Function at 0x140125d40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140125ddd
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x58], rcx
test rdi, rdi
jbe 0x140125dd2
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x14024f680]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
call fcn.140007ea0
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov edx, dword [rsp + 0x50]
mov dword [rsp + 8], edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov dword [rsp + 0x18], edx
call fcn.140117740
xorps xmm15, xmm15
mov r14, qword [0x14041f678]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.1400742e0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.140071fe0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.140125d40
Function at 0x140128300
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401283ad
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rdx
lea rax, [0x14024f4c0]
lea rbx, [rsp + 0x30]
xor ecx, ecx
xor edi, edi
nop
call fcn.140007ea0
lea rax, [0x140251ec0]
mov rbx, qword [rsp + 0x60]
lea rcx, [0x140252a00]
lea rdi, [0x140233ac8]
nop
call fcn.140007ea0
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
call fcn.1401198e0
xorps xmm15, xmm15
mov r14, qword [0x14041f678]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140071fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.140128300

Function at 0x14012ec20
Capabilities:
Hash data using fnv

Disassembly:
movzx ecx, bl
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
ret

Function at 0x14012ec40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x14012ec61
movzx esi, byte [rbx + rdx]
xor rax, rsi
inc rdx
movabs rsi, 0x100000001b3
imul rax, rsi
cmp rcx, rdx
jg 0x14012ec49
ret

Function at 0x14012ec80
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x14012eca0
movzx edx, bl
xor rax, rdx
inc rcx
shr rbx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
nop
cmp rcx, 8
jl 0x14012ec84
ret

Function at 0x14012ecc0
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x14012ece0
movzx edx, bl
xor rax, rdx
inc rcx
shr ebx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
nop
cmp rcx, 4
jl 0x14012ecc4
ret
Function at 0x140134420
Capabilities:
Parse credit card information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401345eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov byte [rsp + 0x58], al
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov rax, rcx
mov rbx, rdi
call fcn.140134900
nop dword [rax]
test al, al
je 0x140134477
mov rcx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
xor eax, eax
xor edx, edx
jmp 0x1401344e1
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call fcn.140134640
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov rcx, rdi
neg rdi
sar rdi, 0x3f
and rdi, rax
lea rbx, [rdi + rsi]
mov rax, qword [rsp + 0x60]
call fcn.140134640
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rdx, rsi
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x40]
mov rcx, rsi
mov rsi, rdi
mov rax, r8
cmp rcx, rax
jle 0x1401345cb
jbe 0x1401345e5
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rdx
movzx r8d, byte [rsi + rax]
lea r9d, [r8 - 0x20]
cmp r9b, 0x5e
ja 0x140134527
cmp r8b, 0x3d
je 0x140134527
cmp r8b, 0x3f
je 0x140134527
cmp r8b, 0x5f
je 0x140134527
mov ebx, 1
mov edi, 1
jmp 0x140134566
mov rbx, rcx
sub rbx, rax
mov rdx, rbx
neg rdx
sar rdx, 0x3f
and rdx, rax
add rdx, rsi
mov rax, rdx
call fcn.1400801e0
lea rcx, [rbx + rbx*2]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x78]
mov rdi, rbx
mov rbx, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rbx
lea r8, [rbx + rdx]
cmp r8, 0x3f
jle 0x1401345b1
mov qword [rsp + 0x20], rdi
movzx eax, byte [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
call fcn.140134860
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x20]
xor edx, edx
lea r8, [rdi + rax]
cmp rcx, r8
jb 0x1401345d9
nop word [rax + rax]
cmp rax, r8
jbe 0x140134494
jmp 0x1401345d1
add rsp, 0x48
pop rbp
ret
mov rcx, r8
call fcn.1400743a0
mov rdx, rcx
mov rcx, r8
nop
call fcn.140074320
call fcn.1400742e0
nop
mov byte [rsp + 8], al
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.140071fe0
movzx eax, byte [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.140134420
Function at 0x14014c2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movsxd r12, dword [rdx]
mov rbp, rdx
movzx edx, byte [r8]
mov rdi, rcx
mov rbx, r8
test dl, dl
je 0x14014c32c
mov rsi, r8
mov eax, edx
lea r8, [0x14037cea0]
xor r9d, r9d
nop dword [rax]
movzx ecx, al
test byte [r8 + rcx], 6
jne 0x14014c30e
cmp al, 0x5f
jne 0x14014c31e
movzx eax, byte [rsi + 1]
add rsi, 1
add r9d, 1
test al, al
jne 0x14014c300
movzx eax, dl
test byte [r8 + rax], 4
je 0x14014c3a8
mov byte [rdi + r12], 0x22
movzx edx, byte [rbx]
lea eax, [r12 + 1]
mov r9d, 1
test dl, dl
jne 0x14014c356
jmp 0x14014c398
movzx edx, byte [rbx + 1]
add rbx, 1
mov eax, ecx
test dl, dl
je 0x14014c37a
movsxd r8, eax
lea ecx, [rax + 1]
mov byte [rdi + r8], dl
cmp byte [rbx], 0x22
jne 0x14014c348
movsxd rcx, ecx
add rbx, 1
add eax, 2
mov byte [rdi + rcx], 0x22
movzx edx, byte [rbx]
test dl, dl
jne 0x14014c356
test r9d, r9d
jne 0x14014c398
movsxd rdx, eax
mov byte [rdi + rdx], 0
mov dword [rbp], eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movsxd rdx, eax
add eax, 1
mov byte [rdi + rdx], 0x22
jmp 0x14014c37f
mov dword [rsp + 0x2c], 0x3b
cmp r9d, 1
jle 0x14014c3f0
lea r8, [rsp + 0x2c]
mov edx, r9d
mov rcx, rbx
call fcn.14014c1b0
cmp dword [rsp + 0x2c], 0x3b
jne 0x14014c32c
cmp byte [rsi], 0
jne 0x14014c32c
movzx edx, byte [rbx]
mov eax, r12d
test dl, dl
je 0x14014c37f
xor r9d, r9d
jmp 0x14014c356
cmp byte [rsi], 0
setne al
xor r9d, 1
and r9d, 1
or al, r9b
jne 0x14014c32c
mov eax, r12d
xor r9d, r9d
jmp 0x14014c356
Function at 0x14015a9f0
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor edi, edi
movzx ebp, byte [rcx + 0x5b]
sub ebp, 1
mov byte [rcx + 0x58], 1
mov rsi, rcx
test ebp, ebp
jg 0x14015aa27
jmp 0x14015aa65
lea rax, [rbx + rbx*2]
lea rax, [rbx + rax*4]
cmp qword [rsi + rax*8 + 0x60], 0
je 0x14015aa70
add edi, 1
cmp edi, ebp
je 0x14015aa70
movzx eax, byte [rsi + 0x5a]
lea eax, [rdi + rax + 1]
cdq
idiv ebp
movsxd rbx, edx
lea rax, [rbx + rbx*2]
lea rax, [rbx + rax*4]
shl rax, 3
lea r12, [rsi + rax + 0x60]
mov eax, dword [rsi + rax + 0x68]
test eax, eax
je 0x14015aa10
mov rcx, r12
call fcn.14014ea80
test eax, eax
je 0x14015aa10
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor r12d, r12d
nop dword [rax + rax]
cmp ebp, edi
je 0x14015aaf0
lea rdx, [rsi + 0x60]
mov rax, r12
mov rcx, qword [r12 + 0x28]
movdqu xmm0, xmmword [rsi + 0x38]
sub rax, rdx
movabs rdx, 0x4ec4ec4ec4ec4ec5
sar rax, 3
imul rax, rdx
mov byte [rsi + 0x5a], al
mov rax, qword [rsi + 0x48]
movups xmmword [r12 + 0x20], xmm0
mov qword [r12 + 0x30], rax
mov qword [rsi + 0x38], 0
mov dword [rsi + 0x48], 0
test rcx, rcx
je 0x14015ab18
mov qword [rsi + 0x40], rcx
call qword [0x140241db8]
mov dword [rsi + 0x54], eax
mov r8, r12
lea rdx, [0x14015a9d0]
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14014e990
movsxd rbp, ebp
lea rdx, [rsi + 0x38]
lea rax, [rbp + rbp*2]
lea rax, [rbp + rax*4]
lea rcx, [rsi + rax*8 + 0x60]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14015a750
cmp qword [rsi + 0x40], 0
je 0x14015aacd
movsxd rcx, dword [rsi + 0x54]
call fcn.14014dcb0
mov qword [rsi + 0x40], rax
test rax, rax
jne 0x14015aacd
mov eax, 7
jmp 0x14015aa5a
Function at 0x14015abd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13d, dword [rcx + 0x80]
movsxd rax, edx
mov r12, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rsi, rax
sub rdx, rax
shl rdx, 3
test rcx, rcx
je 0x14015ad88
test rdx, rdx
je 0x14015ada0
cmp rdx, 0x7ffffeff
ja 0x14015ad48
call fcn.14014db60
mov rdi, rax
test rdi, rdi
je 0x14015ad48
movsxd rdx, r13d
xor ebp, ebp
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [rdi + rax*8]
mov eax, esi
sub eax, r13d
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sub.msvcrt.dll_memset
mov qword [r12 + 0x78], rdi
cmp r13d, esi
jl 0x14015acfa
jmp 0x14015ad70
lea rdi, [rax + 8]
mov rcx, rax
mov qword [rax], 0
mov qword [rax + 0x1f8], 0
and rdi, 0xfffffffffffffff8
mov rax, rbp
sub rcx, rdi
add ecx, 0x200
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rdx], r14d
mov qword [rbx + 0x10], rdx
mov rax, qword [r12 + 0x120]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x14015ace5
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add r13d, 1
add rbx, 0x38
mov dword [r12 + 0x80], r13d
cmp r13d, esi
je 0x14015ad70
mov rax, qword [r12 + 0x50]
mov r14d, dword [r12 + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r14d
je 0x14015ad60
mov rax, qword [r12 + 0x60]
test rax, rax
jle 0x14015ad60
mov qword [rbx], rax
mov eax, dword [r12 + 0x3c]
mov ecx, 0x200
mov dword [rbx + 0x1c], eax
call fcn.14014dcb0
mov rdx, rax
test rax, rax
jne 0x14015ac80
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [r12 + 0xb8]
jmp 0x14015ad18
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rdx
call fcn.14014dcb0
mov rdi, rax
jmp 0x14015ac28
call fcn.14014ac00
mov eax, 7
jmp 0x14015ad4d
Function at 0x14015d3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebp, ebp
lea rbx, [0x14037cfa0]
mov eax, dword [rcx + 0x28]
mov r12, rcx
mov rdi, rdx
mov rsi, r8
test eax, eax
jle 0x14015d444
nop dword [rax + rax]
mov r10d, ebp
xor r10d, 1
cmp ebp, 2
cmovge r10d, ebp
movsxd r9, r10d
shl r9, 5
add r9, qword [r12 + 0x20]
test rsi, rsi
je 0x14015d41e
mov r8, qword [r9]
xor ecx, ecx
jmp 0x14015d40d
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x14015d458
add rcx, 1
movzx eax, byte [r8 + rcx]
movzx edx, byte [rsi + rcx]
cmp eax, edx
jne 0x14015d400
test eax, eax
jne 0x14015d409
mov rcx, qword [r9 + 0x18]
xor r8d, r8d
mov rdx, rdi
add rcx, 0x20
call fcn.140155270
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14015d446
add ebp, 1
cmp dword [r12 + 0x28], ebp
jg 0x14015d3d8
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test r10d, r10d
jne 0x14015d43a
mov rcx, rsi
mov eax, 0x6d
lea r8, str.main
jmp 0x14015d488
cdqe
movzx edx, byte [rbx + rdx]
cmp byte [rbx + rax], dl
jne 0x14015d43a
movzx eax, byte [r8 + 1]
add r8, 1
add rcx, 1
movzx edx, byte [rcx]
cmp eax, edx
jne 0x14015d470
test eax, eax
jne 0x14015d47b
jmp 0x14015d41e
Function at 0x140176280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov esi, edx
test rcx, rcx
je 0x140176428
mov rax, qword [rcx]
test rax, rax
je 0x140176450
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1401762b0
call qword [0x140241e00]
cmp dword [rbx + 0x24], 0x2df20da3
jne 0x140176370
mov ecx, dword [rbx + 0x34]
test ecx, ecx
jns 0x140176370
test esi, esi
jle 0x1401763e8
movsx eax, word [rbx + 0x20]
cmp eax, esi
jl 0x1401763e8
sub esi, 1
movsxd rdx, esi
lea rax, [rdx*8]
sub rax, rdx
mov rdx, qword [rbx + 0x88]
lea rdi, [rdx + rax*8]
test word [rdi + 8], 0x2400
jne 0x140176307
mov edx, dword [rdi + 0x20]
test edx, edx
je 0x14017630f
mov rcx, rdi
call fcn.1401540d0
mov eax, 1
mov r8d, dword [rbx + 0x11c]
mov word [rdi + 8], ax
mov rax, qword [rbx]
mov dword [rax + 0x50], 0
xor eax, eax
test r8d, r8d
je 0x1401763dd
mov ecx, esi
mov edx, 1
shl edx, cl
cmp esi, 0x1f
mov ecx, 0x80000000
cmovge edx, ecx
test r8d, edx
je 0x1401763dd
movzx edx, byte [rbx + 0xd0]
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0xd0], dl
jmp 0x1401763dd
mov rcx, qword [rbx]
mov edx, 0x15
mov dword [rcx + 0x50], 0x15
call fcn.140155760
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140176396
call qword [0x140241e10]
mov r8, qword [rbx + 0xf8]
lea rdx, str.bind_on_a_busy_prepared_statement:___s_
mov ecx, 0x15
call fcn.140172c50
lea rax, [0x14036c43c]
mov r9d, 0x14f17
mov qword [rsp + 0x20], rax
lea r8, str.misuse
lea rdx, str._s_at_line__d_of___.10s_
mov ecx, 0x15
call fcn.140172c50
mov eax, 0x15
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rbx]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call fcn.140155760
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
mov eax, 0x19
test rcx, rcx
je 0x1401763dd
mov dword [rsp + 0x3c], eax
call qword [0x140241e10]
mov eax, dword [rsp + 0x3c]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
lea rdx, str.API_called_with_NULL_prepared_statement
mov ecx, 0x15
call fcn.140172c50
lea rax, [0x14036c43c]
mov r9d, 0x14f0f
mov qword [rsp + 0x20], rax
jmp 0x1401763c0
lea rdx, str.API_called_with_finalized_prepared_statement
mov ecx, 0x15
call fcn.140172c50
jmp 0x140176439
Function at 0x140206630
Capabilities:
Reference sql statements

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd rdi, edx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rbp, r8
cmp qword [rcx + rdi*8 + 0x28], 0
mov rsi, rdi
lea r12, [rdi + 4]
mov r13, r9
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
je 0x1402066d0
mov ecx, dword [rbx + 0x40]
test ecx, ecx
je 0x140206688
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rbx + rdi*8 + 0x28]
mov r8, rbp
mov edx, 1
mov rcx, r12
call fcn.140176540
mov rcx, r12
call fcn.1401dddc0
cmp eax, 0x65
je 0x1402066f0
cmp eax, 0x64
je 0x140206720
mov rcx, r12
call fcn.1401b1340
mov edx, dword [rbx + 0x40]
test edx, edx
jne 0x140206676
mov dword [rbx + 0x40], eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [rsp + rdi*8 + 0x40]
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
call fcn.1401fa340
mov qword [rbx + r12*8 + 8], rax
jmp 0x14020666f
test esi, esi
lea rdx, str.__parent
mov r9, r13
mov r8, rbp
lea rax, str.__rowid
mov rcx, rbx
cmove rax, rdx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov qword [rsp + 0x20], rax
call fcn.140194890
jmp 0x1402066af
xor edx, edx
mov rcx, r12
call fcn.1401558c0
mov rcx, rax
call fcn.14014f740
mov rdi, rax
test r12, r12
je 0x140206742
mov rcx, r12
call fcn.140155860
cmp r13, rdi
je 0x1402066af
test esi, esi
lea rdx, str.__parent
mov r9, rdi
mov r8, rbp
lea rax, str.__rowid
mov qword [rsp + 0x30], r13
mov rcx, rbx
cmove rax, rdx
mov qword [rsp + 0x28], rbp
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov qword [rsp + 0x20], rax
call fcn.140194890
jmp 0x1402066af