mirror of
https://gitlab.com/BinaryHardening/cfgrip
synced 2026-07-26 12:41:08 +00:00
x86byte
236e428dce
- Add mode field to normal JSON output example - Add --subs-only output section with JSON sample - Add --clean output section with stack_offset and xrefs sample - Add --subs-only --clean combined output section - Update function count 422 -> 414 (empty function removal) - Include test example files for all modes
29593 lines
756 KiB
INI
29593 lines
756 KiB
INI
{
|
|
"binary": "C:\\Users\\panji\\AppData\\Local\\Temp\\_cfgrip_example.exe",
|
|
"mode": "subs-only+clean",
|
|
"arch": "x86-64",
|
|
"format": "PE",
|
|
"entry_point": "0x1400054bc",
|
|
"imports": [
|
|
{
|
|
"address": "0x140020000",
|
|
"name": "EncodePointer",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020008",
|
|
"name": "DecodePointer",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020010",
|
|
"name": "EnterCriticalSection",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020018",
|
|
"name": "LeaveCriticalSection",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020020",
|
|
"name": "InitializeCriticalSectionEx",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020028",
|
|
"name": "DeleteCriticalSection",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020030",
|
|
"name": "MultiByteToWideChar",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020038",
|
|
"name": "WideCharToMultiByte",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020040",
|
|
"name": "LCMapStringEx",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020048",
|
|
"name": "GetStringTypeW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020050",
|
|
"name": "GetCPInfo",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020058",
|
|
"name": "RtlCaptureContext",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020060",
|
|
"name": "RtlLookupFunctionEntry",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020068",
|
|
"name": "RtlVirtualUnwind",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020070",
|
|
"name": "UnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020078",
|
|
"name": "SetUnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020080",
|
|
"name": "GetCurrentProcess",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020088",
|
|
"name": "TerminateProcess",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020090",
|
|
"name": "IsProcessorFeaturePresent",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020098",
|
|
"name": "QueryPerformanceCounter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200a0",
|
|
"name": "GetCurrentProcessId",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200a8",
|
|
"name": "GetCurrentThreadId",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200b0",
|
|
"name": "GetSystemTimeAsFileTime",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200b8",
|
|
"name": "InitializeSListHead",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200c0",
|
|
"name": "IsDebuggerPresent",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200c8",
|
|
"name": "GetStartupInfoW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200d0",
|
|
"name": "GetModuleHandleW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200d8",
|
|
"name": "WriteConsoleW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200e0",
|
|
"name": "RtlPcToFileHeader",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200e8",
|
|
"name": "RaiseException",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200f0",
|
|
"name": "RtlUnwindEx",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400200f8",
|
|
"name": "GetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020100",
|
|
"name": "SetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020108",
|
|
"name": "InitializeCriticalSectionAndSpinCount",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020110",
|
|
"name": "TlsAlloc",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020118",
|
|
"name": "TlsGetValue",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020120",
|
|
"name": "TlsSetValue",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020128",
|
|
"name": "TlsFree",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020130",
|
|
"name": "FreeLibrary",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020138",
|
|
"name": "GetProcAddress",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020140",
|
|
"name": "LoadLibraryExW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020148",
|
|
"name": "GetStdHandle",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020150",
|
|
"name": "WriteFile",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020158",
|
|
"name": "GetModuleFileNameW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020160",
|
|
"name": "ExitProcess",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020168",
|
|
"name": "GetModuleHandleExW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020170",
|
|
"name": "GetCommandLineA",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020178",
|
|
"name": "GetCommandLineW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020180",
|
|
"name": "HeapAlloc",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020188",
|
|
"name": "HeapFree",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020190",
|
|
"name": "FlsAlloc",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020198",
|
|
"name": "FlsGetValue",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201a0",
|
|
"name": "FlsSetValue",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201a8",
|
|
"name": "FlsFree",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201b0",
|
|
"name": "VirtualProtect",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201b8",
|
|
"name": "CompareStringW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201c0",
|
|
"name": "LCMapStringW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201c8",
|
|
"name": "GetLocaleInfoW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201d0",
|
|
"name": "IsValidLocale",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201d8",
|
|
"name": "GetUserDefaultLCID",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201e0",
|
|
"name": "EnumSystemLocalesW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201e8",
|
|
"name": "GetFileType",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201f0",
|
|
"name": "CloseHandle",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400201f8",
|
|
"name": "FlushFileBuffers",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020200",
|
|
"name": "GetConsoleOutputCP",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020208",
|
|
"name": "GetConsoleMode",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020210",
|
|
"name": "ReadFile",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020218",
|
|
"name": "GetFileSizeEx",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020220",
|
|
"name": "SetFilePointerEx",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020228",
|
|
"name": "ReadConsoleW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020230",
|
|
"name": "HeapReAlloc",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020238",
|
|
"name": "FindClose",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020240",
|
|
"name": "FindFirstFileExW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020248",
|
|
"name": "FindNextFileW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020250",
|
|
"name": "IsValidCodePage",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020258",
|
|
"name": "GetACP",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020260",
|
|
"name": "GetOEMCP",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020268",
|
|
"name": "GetEnvironmentStringsW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020270",
|
|
"name": "FreeEnvironmentStringsW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020278",
|
|
"name": "SetEnvironmentVariableW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020280",
|
|
"name": "SetStdHandle",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020288",
|
|
"name": "GetProcessHeap",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020290",
|
|
"name": "HeapSize",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x140020298",
|
|
"name": "CreateFileW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"address": "0x1400202a0",
|
|
"name": "RtlUnwind",
|
|
"library": "KERNEL32.dll"
|
|
}
|
|
],
|
|
"indirect_targets": [
|
|
{
|
|
"instruction": "0x1400054c0",
|
|
"resolved_target": "0x140005d30",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005354",
|
|
"resolved_target": "0x14000550c",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000549c",
|
|
"resolved_target": "0x140005e44",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054a7",
|
|
"resolved_target": "0x140005e44",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054ae",
|
|
"resolved_target": "0x14000ec14",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054b6",
|
|
"resolved_target": "0x14000ebcc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054c0",
|
|
"resolved_target": "0x140005d30",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005369",
|
|
"resolved_target": "0x1400054d0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054a7",
|
|
"resolved_target": "0x140005e44",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054ae",
|
|
"resolved_target": "0x14000ec14",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054b6",
|
|
"resolved_target": "0x14000ebcc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054c0",
|
|
"resolved_target": "0x140005d30",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000539b",
|
|
"resolved_target": "0x14000e8f8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400053bc",
|
|
"resolved_target": "0x14000e8c0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400053d7",
|
|
"resolved_target": "0x14000566c",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400053dc",
|
|
"resolved_target": "0x140005e28",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005408",
|
|
"resolved_target": "0x140005e30",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400053ed",
|
|
"resolved_target": "0x1400055d4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000542a",
|
|
"resolved_target": "0x14000e868",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005432",
|
|
"resolved_target": "0x14000ec90",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000543a",
|
|
"resolved_target": "0x14000ec88",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005447",
|
|
"resolved_target": "0x140002240",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000544e",
|
|
"resolved_target": "0x140005f98",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005419",
|
|
"resolved_target": "0x1400055d4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005402",
|
|
"resolved_target": "0x14001e360",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005408",
|
|
"resolved_target": "0x140005e30",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054ae",
|
|
"resolved_target": "0x14000ec14",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054b6",
|
|
"resolved_target": "0x14000ebcc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054c0",
|
|
"resolved_target": "0x140005d30",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000545c",
|
|
"resolved_target": "0x14000ebbc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005465",
|
|
"resolved_target": "0x140005690",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005425",
|
|
"resolved_target": "0x14000ebd8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000542a",
|
|
"resolved_target": "0x14000e868",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005432",
|
|
"resolved_target": "0x14000ec90",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000543a",
|
|
"resolved_target": "0x14000ec88",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005447",
|
|
"resolved_target": "0x140002240",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000544e",
|
|
"resolved_target": "0x140005f98",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140002252",
|
|
"resolved_target": "0x140001150",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400054d4",
|
|
"resolved_target": "0x1400060d8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000551b",
|
|
"resolved_target": "0x1400057f0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005520",
|
|
"resolved_target": "0x140007318",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005674",
|
|
"resolved_target": "0x1400060d8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400056a5",
|
|
"resolved_target": "0x140010b38",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400056ac",
|
|
"resolved_target": "0x140007340",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400056a5",
|
|
"resolved_target": "0x140010b38",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400056ac",
|
|
"resolved_target": "0x140007340",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005d5f",
|
|
"resolved_target": "0x3048e",
|
|
"name": "GetSystemTimeAsFileTime",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005d6d",
|
|
"resolved_target": "0x30478",
|
|
"name": "GetCurrentThreadId",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005d79",
|
|
"resolved_target": "0x30462",
|
|
"name": "GetCurrentProcessId",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005d89",
|
|
"resolved_target": "0x30448",
|
|
"name": "QueryPerformanceCounter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005e60",
|
|
"resolved_target": "0x3042c",
|
|
"name": "IsProcessorFeaturePresent",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005e73",
|
|
"resolved_target": "0x140005e38",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005e84",
|
|
"resolved_target": "0x14001ea80",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005e8d",
|
|
"resolved_target": "0x30388",
|
|
"name": "RtlCaptureContext",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005ea7",
|
|
"resolved_target": "0x3039c",
|
|
"name": "RtlLookupFunctionEntry",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005e73",
|
|
"resolved_target": "0x140005e38",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005e84",
|
|
"resolved_target": "0x14001ea80",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005e8d",
|
|
"resolved_target": "0x30388",
|
|
"name": "RtlCaptureContext",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005ea7",
|
|
"resolved_target": "0x3039c",
|
|
"name": "RtlLookupFunctionEntry",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005f1e",
|
|
"resolved_target": "0x14001ea80",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005f3f",
|
|
"resolved_target": "0x304be",
|
|
"name": "IsDebuggerPresent",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005f5c",
|
|
"resolved_target": "0x303e6",
|
|
"name": "SetUnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005f67",
|
|
"resolved_target": "0x303ca",
|
|
"name": "UnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005eeb",
|
|
"resolved_target": "0x303b6",
|
|
"name": "RtlVirtualUnwind",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005f1e",
|
|
"resolved_target": "0x14001ea80",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005f3f",
|
|
"resolved_target": "0x304be",
|
|
"name": "IsDebuggerPresent",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005f5c",
|
|
"resolved_target": "0x303e6",
|
|
"name": "SetUnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005f67",
|
|
"resolved_target": "0x303ca",
|
|
"name": "UnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140005f79",
|
|
"resolved_target": "0x140005e38",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140005f9e",
|
|
"resolved_target": "0x304e4",
|
|
"name": "GetModuleHandleW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000e8dd",
|
|
"resolved_target": "0x14001e3a0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000e915",
|
|
"resolved_target": "0x14001e3a0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ea53",
|
|
"resolved_target": "0x304e4",
|
|
"name": "GetModuleHandleW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ead2",
|
|
"resolved_target": "0x14000e934",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000eade",
|
|
"resolved_target": "0x1400191c0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ea96",
|
|
"resolved_target": "0x14000eb40",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ead2",
|
|
"resolved_target": "0x14000e934",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000eade",
|
|
"resolved_target": "0x1400191c0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000eb09",
|
|
"resolved_target": "0x14000eb10",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140001180",
|
|
"resolved_target": "0x14001ef10",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400011be",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140001292",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400011e1",
|
|
"resolved_target": "0x140002000",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000125b",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400012f2",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000136d",
|
|
"resolved_target": "0x1400023f4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140001379",
|
|
"resolved_target": "0x140001d10",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140001392",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000731c",
|
|
"resolved_target": "0x14000a73c",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140010b4a",
|
|
"resolved_target": "0x14000b74c",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14001c018",
|
|
"resolved_target": "0x14001e3a0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140007348",
|
|
"resolved_target": "0x140007514",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000734d",
|
|
"resolved_target": "0x14000a784",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14001edc8",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14001ecd4",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14001ec14",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14001e3a0",
|
|
"resolved_target": "0x14001e360",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000e94b",
|
|
"resolved_target": "0x14000ca20",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000e954",
|
|
"resolved_target": "0x14000e96c",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000e95c",
|
|
"resolved_target": "0x14000ca74",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400191cc",
|
|
"resolved_target": "0x1400191a8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400191da",
|
|
"resolved_target": "0x140011db4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000eb65",
|
|
"resolved_target": "0x30626",
|
|
"name": "GetModuleHandleExW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000eb7b",
|
|
"resolved_target": "0x305c2",
|
|
"name": "GetProcAddress",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000eb97",
|
|
"resolved_target": "0x305b4",
|
|
"name": "FreeLibrary",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000eb88",
|
|
"resolved_target": "0x14001e3a0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000eb2f",
|
|
"resolved_target": "0x14000eb40",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000eb36",
|
|
"resolved_target": "0x30618",
|
|
"name": "ExitProcess",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000eb1c",
|
|
"resolved_target": "0x30404",
|
|
"name": "GetCurrentProcess",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000eb27",
|
|
"resolved_target": "0x30418",
|
|
"name": "TerminateProcess",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000eb2f",
|
|
"resolved_target": "0x14000eb40",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000eb36",
|
|
"resolved_target": "0x30618",
|
|
"name": "ExitProcess",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140002034",
|
|
"resolved_target": "0x140001ab0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000209d",
|
|
"resolved_target": "0x1400023f4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400020ab",
|
|
"resolved_target": "0x140001d10",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000204c",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400020c9",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000209d",
|
|
"resolved_target": "0x1400023f4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400020ab",
|
|
"resolved_target": "0x140001d10",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140006f54",
|
|
"resolved_target": "0x14000747c",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140001d36",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000a75b",
|
|
"resolved_target": "0x14000aa38",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000a775",
|
|
"resolved_target": "0x14000a784",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000a75b",
|
|
"resolved_target": "0x14000aa38",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b5d3",
|
|
"resolved_target": "0x14000b468",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140007523",
|
|
"resolved_target": "0x14000a954",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ca32",
|
|
"resolved_target": "0x140020010",
|
|
"name": "EnterCriticalSection",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000e9bb",
|
|
"resolved_target": "0x14001e3a0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000e9d5",
|
|
"resolved_target": "0x140010944",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000e9f1",
|
|
"resolved_target": "0x14000e8c0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ea04",
|
|
"resolved_target": "0x14000e8c0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ca86",
|
|
"resolved_target": "0x140020018",
|
|
"name": "LeaveCriticalSection",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011de7",
|
|
"resolved_target": "0x140011c00",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140001ad7",
|
|
"resolved_target": null,
|
|
"name": "unresolved",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140001b09",
|
|
"resolved_target": "0x140002000",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000aa69",
|
|
"resolved_target": "0x14000a7bc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000aa83",
|
|
"resolved_target": "0x3055a",
|
|
"name": "InitializeCriticalSectionAndSpinCount",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000aa7b",
|
|
"resolved_target": "0x14001e360",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b482",
|
|
"resolved_target": "0x14000ca20",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b533",
|
|
"resolved_target": "0x14000ca74",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b52a",
|
|
"resolved_target": "0x14000b3cc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000a976",
|
|
"resolved_target": "0x14000a7bc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000a993",
|
|
"resolved_target": "0x140020128",
|
|
"name": "TlsFree",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000a987",
|
|
"resolved_target": "0x14001e360",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14001097c",
|
|
"resolved_target": "0x140010630",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140011cf9",
|
|
"resolved_target": "0x14000ca20",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140011d1d",
|
|
"resolved_target": "0x306aa",
|
|
"name": "VirtualProtect",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011dac",
|
|
"resolved_target": "0x14000d6d0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140011d4e",
|
|
"resolved_target": "0x306aa",
|
|
"name": "VirtualProtect",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011c6d",
|
|
"resolved_target": "0x305d4",
|
|
"name": "LoadLibraryExW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011c7f",
|
|
"resolved_target": "0x3053a",
|
|
"name": "GetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011c9a",
|
|
"resolved_target": "0x140011460",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140011d5a",
|
|
"resolved_target": "0x14000ca74",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140011cf9",
|
|
"resolved_target": "0x14000ca20",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140011d1d",
|
|
"resolved_target": "0x306aa",
|
|
"name": "VirtualProtect",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011cb0",
|
|
"resolved_target": "0x140011460",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140011cf9",
|
|
"resolved_target": "0x14000ca20",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140011d1d",
|
|
"resolved_target": "0x306aa",
|
|
"name": "VirtualProtect",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011cc1",
|
|
"resolved_target": "0x305d4",
|
|
"name": "LoadLibraryExW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011cf9",
|
|
"resolved_target": "0x14000ca20",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140011d1d",
|
|
"resolved_target": "0x306aa",
|
|
"name": "VirtualProtect",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000a841",
|
|
"resolved_target": "0x305d4",
|
|
"name": "LoadLibraryExW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000a84f",
|
|
"resolved_target": "0x3053a",
|
|
"name": "GetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000a868",
|
|
"resolved_target": "0x140011460",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000a879",
|
|
"resolved_target": "0x305d4",
|
|
"name": "LoadLibraryExW",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000b3e4",
|
|
"resolved_target": "0x14000b1f8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b458",
|
|
"resolved_target": "0x14000b204",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b43c",
|
|
"resolved_target": "0x14000b678",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b458",
|
|
"resolved_target": "0x14000b204",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140010647",
|
|
"resolved_target": "0x14000ca20",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140010650",
|
|
"resolved_target": "0x14001081c",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140010659",
|
|
"resolved_target": "0x14000ca74",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000d6d4",
|
|
"resolved_target": "0x14001667c",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000d6e3",
|
|
"resolved_target": "0x1400166cc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000d720",
|
|
"resolved_target": "0x14000ebcc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000d6f6",
|
|
"resolved_target": "0x3042c",
|
|
"name": "IsProcessorFeaturePresent",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000d716",
|
|
"resolved_target": "0x14000ace8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000d720",
|
|
"resolved_target": "0x14000ebcc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000d716",
|
|
"resolved_target": "0x14000ace8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000d720",
|
|
"resolved_target": "0x14000ebcc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b1fc",
|
|
"resolved_target": "0x140020010",
|
|
"name": "EnterCriticalSection",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000b208",
|
|
"resolved_target": "0x140020018",
|
|
"name": "LeaveCriticalSection",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000b6c2",
|
|
"resolved_target": "0x14000b58c",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b71b",
|
|
"resolved_target": "0x14000abc8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000b730",
|
|
"resolved_target": "0x14000abc8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400166a0",
|
|
"resolved_target": "0x140016634",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140016753",
|
|
"resolved_target": "0x140011924",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400167f3",
|
|
"resolved_target": "0x14000ca20",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400168b8",
|
|
"resolved_target": "0x14000ca74",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140016921",
|
|
"resolved_target": "0x14000ebcc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140016917",
|
|
"resolved_target": "0x14000ca74",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140016921",
|
|
"resolved_target": "0x14000ebcc",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14001684a",
|
|
"resolved_target": "0x1400118c4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14001685a",
|
|
"resolved_target": "0x1400118c4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ad34",
|
|
"resolved_target": "0x14001ea80",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ad45",
|
|
"resolved_target": "0x14001ea80",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ad73",
|
|
"resolved_target": "0x30388",
|
|
"name": "RtlCaptureContext",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ad8b",
|
|
"resolved_target": "0x3039c",
|
|
"name": "RtlLookupFunctionEntry",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ad22",
|
|
"resolved_target": "0x140005e38",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ad34",
|
|
"resolved_target": "0x14001ea80",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ad45",
|
|
"resolved_target": "0x14001ea80",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ad73",
|
|
"resolved_target": "0x30388",
|
|
"name": "RtlCaptureContext",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ad8b",
|
|
"resolved_target": "0x3039c",
|
|
"name": "RtlLookupFunctionEntry",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000adff",
|
|
"resolved_target": "0x304be",
|
|
"name": "IsDebuggerPresent",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ae09",
|
|
"resolved_target": "0x303e6",
|
|
"name": "SetUnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ae14",
|
|
"resolved_target": "0x303ca",
|
|
"name": "UnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000adc6",
|
|
"resolved_target": "0x303b6",
|
|
"name": "RtlVirtualUnwind",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000adff",
|
|
"resolved_target": "0x304be",
|
|
"name": "IsDebuggerPresent",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ae09",
|
|
"resolved_target": "0x303e6",
|
|
"name": "SetUnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ae14",
|
|
"resolved_target": "0x303ca",
|
|
"name": "UnhandledExceptionFilter",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ae38",
|
|
"resolved_target": "0x140005210",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ae29",
|
|
"resolved_target": "0x140005e38",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ae38",
|
|
"resolved_target": "0x140005210",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000abdb",
|
|
"resolved_target": "0x3053a",
|
|
"name": "GetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ac01",
|
|
"resolved_target": "0x1400119b4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14000ac10",
|
|
"resolved_target": "0x3054a",
|
|
"name": "SetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x14000ac29",
|
|
"resolved_target": "0x14000d6d0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140016648",
|
|
"resolved_target": "0x14000ca20",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x140016669",
|
|
"resolved_target": "0x14000ca74",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x14001196d",
|
|
"resolved_target": "0x3053a",
|
|
"name": "GetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x1400119a0",
|
|
"resolved_target": "0x3054a",
|
|
"name": "SetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011996",
|
|
"resolved_target": "0x1400117a4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400119a0",
|
|
"resolved_target": "0x3054a",
|
|
"name": "SetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011963",
|
|
"resolved_target": "0x1400117a4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400118c8",
|
|
"resolved_target": "0x140011924",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400118d7",
|
|
"resolved_target": "0x14000d6d0",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400119ed",
|
|
"resolved_target": "0x1400117a4",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400117b3",
|
|
"resolved_target": "0x3053a",
|
|
"name": "GetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x1400117c5",
|
|
"resolved_target": "0x140011fe8",
|
|
"name": "",
|
|
"library": ""
|
|
},
|
|
{
|
|
"instruction": "0x1400117d2",
|
|
"resolved_target": "0x3054a",
|
|
"name": "SetLastError",
|
|
"library": "KERNEL32.dll"
|
|
},
|
|
{
|
|
"instruction": "0x140011fe8",
|
|
"resolved_target": "0x1400201a0",
|
|
"name": "FlsSetValue",
|
|
"library": "KERNEL32.dll"
|
|
}
|
|
],
|
|
"functions": [
|
|
{
|
|
"address": "0x1400054bc",
|
|
"name": "entry",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400054bc",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400054bc",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054c0",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005d30",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054c5",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054c9",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005340",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005340"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005340",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005340",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005345",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000534a",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000534b",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000534f",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 1",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005354",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000550c",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005359",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000535b",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005497",
|
|
"stack_offset": -56
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005497",
|
|
"0x140005361"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005497",
|
|
"size": 15,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005497",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000549c",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e44",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054a1",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054a2",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054a7",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e44",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054ac",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054ae",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ec14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054b3",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054b4",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054b6",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebcc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054bb",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054bc",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054c0",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005d30",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054c5",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054c9",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005340",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005340"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005361",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005361",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "sil, sil",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005364",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rsp + 0x20], sil",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005369",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400054d0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000536e",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "bl, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005370",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rip + 0x2d37a]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005376",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ecx, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005379",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400054a2",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400054a2",
|
|
"0x14000537f"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400054a2",
|
|
"size": 12,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400054a2",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054a7",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e44",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054ac",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054ae",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ec14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054b3",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054b4",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054b6",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebcc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054bb",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054bc",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054c0",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005d30",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054c5",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054c9",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005340",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005340"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000537f",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000537f",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005381",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400053cd",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005383",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2d363], 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000538d",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x1aff4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005394",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rip + 0x1afad]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000539b",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000e8f8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053a0",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053a2",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400053ae",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400053ae",
|
|
"0x1400053a4"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400053ae",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400053ae",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x1af8b]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053b5",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rip + 0x1af2c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053bc",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000e8c0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053c1",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2d325], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053cb",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400053d5",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400053d5"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400053a4",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400053a4",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 0xff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053a9",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005487",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005487"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400053d5",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400053d5",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "cl, bl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053d7",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000566c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053dc",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053e1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053e4",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rax], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053e8",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005408",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005408",
|
|
"0x1400053ea"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005487",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005487",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000548c",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005491",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005495",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x140005496",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005408",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005408",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000540d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005410",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rax], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005414",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000542a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000542a",
|
|
"0x140005416"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400053ea",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400053ea",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053ed",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400055d4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053f2",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053f4",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005408",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005408",
|
|
"0x1400053f6"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000542a",
|
|
"size": 13,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000542a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000e868",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000542f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005432",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ec90",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005437",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000543a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ec88",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000543f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005442",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005445",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005447",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140002240",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000544c",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000544e",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005f98",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005453",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005455",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400054ac",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400054ac",
|
|
"0x140005457"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005416",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005416",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005419",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400055d4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000541e",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005420",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000542a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000542a",
|
|
"0x140005422"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400053f6",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400053f6",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053f9",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "edx, [r8 + 2]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053fd",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400053ff",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005402",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1aeb8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005408",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000540d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005410",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rax], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005414",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000542a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000542a",
|
|
"0x140005416"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400054ac",
|
|
"size": 10,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400054ac",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054ae",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ec14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054b3",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054b4",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054b6",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebcc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054bb",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054bc",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054c0",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005d30",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054c5",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054c9",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005340",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005340"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005457",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005457",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "sil, sil",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000545a",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005461",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000545c",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebbc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005461",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005463",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "cl, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005465",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005690",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000546a",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000546c",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005487",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005487"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005422",
|
|
"size": 15,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005422",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rbx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005425",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebd8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000542a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000e868",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000542f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005432",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ec90",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005437",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000543a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ec88",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000543f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005442",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005445",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005447",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140002240",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000544c",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000544e",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005f98",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005453",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005455",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400054ac",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400054ac",
|
|
"0x140005457"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140002240",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140002240",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140002240",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002244",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x1e32d]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000224b",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rip + 0x2ff8e]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140002252",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140001150",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140002257",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140002259",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000225d",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400054d0",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400054d0",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400054d0",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054d4",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400060d8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054d9",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400054db",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400054fe",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400054fe",
|
|
"0x1400054dd"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400054fe",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400054fe",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005500",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005504",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400054dd",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400054dd",
|
|
"size": 9,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr gs:[0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054e6",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rax + 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054ea",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400054f1",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400054f1"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400054f1",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400054f1",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054f3",
|
|
"size": 9,
|
|
"mnemonic": "lock cmpxchg",
|
|
"operands": "qword ptr [rip + 0x2d1fc], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054fc",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400054ec",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400054fe",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005500",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005504",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000550c",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000550c",
|
|
"size": 10,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000550c",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005510",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005512",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000551b",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005514",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rip + 0x2d1e5], 1",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000551b",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400057f0",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005520",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140007318",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005525",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005527",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000552d",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005529",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "al, al",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000552b",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005541",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005541"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005541",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005541",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005545",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400055d4",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400055d4",
|
|
"size": 23,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400055d4",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x18",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400055d8",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8, rcx",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x1400055db",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 0x5a4d",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x1400055e0",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "word ptr [rip - 0x55e7], ax",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x1400055e7",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005661",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x1400055e9",
|
|
"size": 7,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rip - 0x55b4]",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x1400055f0",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip - 0x55f7]",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x1400055f7",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, rdx",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x1400055fa",
|
|
"size": 6,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx], 0x4550",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005600",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005661",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005602",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 0x20b",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005607",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "word ptr [rcx + 0x18], ax",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000560b",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005661",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000560d",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "r8, rdx",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005610",
|
|
"size": 4,
|
|
"mnemonic": "movzx",
|
|
"operands": "edx, word ptr [rcx + 0x14]",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005614",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rdx, 0x18",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005618",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "rdx, rcx",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000561b",
|
|
"size": 4,
|
|
"mnemonic": "movzx",
|
|
"operands": "eax, word ptr [rcx + 6]",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000561f",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rax + rax*4]",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005623",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rdx + rcx*8]",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005627",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp], rdx",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000562b",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rdx, r9",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000562e",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005648",
|
|
"stack_offset": -24
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005648",
|
|
"0x140005630"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005648",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005648",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000564a",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rdx, rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000564d",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005653",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000564f",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005651",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005667",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005667"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005630",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005630",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rdx + 0xc]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005633",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005636",
|
|
"size": 2,
|
|
"mnemonic": "jb",
|
|
"operands": "0x140005642",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005642",
|
|
"0x140005638"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005667",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005667",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x18",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000566b",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 24
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005642",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005642",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rdx, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005646",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005627",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005627"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005638",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005638",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rdx + 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000563b",
|
|
"size": 2,
|
|
"mnemonic": "add",
|
|
"operands": "eax, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000563d",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005640",
|
|
"size": 2,
|
|
"mnemonic": "jb",
|
|
"operands": "0x14000564a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000564a",
|
|
"0x140005642"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005627",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005627",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp], rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000562b",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rdx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000562e",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005648",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005648",
|
|
"0x140005630"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000564a",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000564a",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rdx, rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000564d",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005653",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000564f",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005651",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005667",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005667"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000566c",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000566c",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000566c",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000566e",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140005672",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "bl, cl",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005674",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400060d8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005679",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000567b",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000567d",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000568a",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000568a",
|
|
"0x14000567f"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000568a",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000568a",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000568e",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000568f",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000567f",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000567f",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "bl, bl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005681",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000568a",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005683",
|
|
"size": 7,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [rip + 0x2d06e], rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000568a",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000568e",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000568f",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005690",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140005690",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005690",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005692",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140005696",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rip + 0x2d063], 0",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000569d",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "bl, cl",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000569f",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400056a5",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400056a5",
|
|
"0x1400056a1"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400056a5",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400056a5",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140010b38",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056aa",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "cl, bl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056ac",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140007340",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056b1",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056b3",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056b7",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x1400056b8",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400056a1",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400056a1",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dl, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056a3",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400056b1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056a5",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140010b38",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056aa",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "cl, bl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056ac",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140007340",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056b1",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056b3",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400056b7",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x1400056b8",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005d30",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140005d30",
|
|
"size": 39,
|
|
"is_prolog": true,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005d30",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x18], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005d35",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005d36",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, rsp",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140005d39",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140005d3d",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x2b2fc]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d44",
|
|
"size": 10,
|
|
"mnemonic": "movabs",
|
|
"operands": "rbx, 0x2b992ddfa232",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d4e",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d51",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005dca",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d53",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x10]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d57",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0x10], 0",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d5f",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a34b]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d65",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp + 0x10]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d69",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x10], rax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d6d",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a335]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d73",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d75",
|
|
"size": 4,
|
|
"mnemonic": "xor",
|
|
"operands": "qword ptr [rbp - 0x10], rax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d79",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a321]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d7f",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d81",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x18]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d85",
|
|
"size": 4,
|
|
"mnemonic": "xor",
|
|
"operands": "qword ptr [rbp - 0x10], rax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d89",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a309]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d8f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rbp + 0x18]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d92",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x10]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d96",
|
|
"size": 4,
|
|
"mnemonic": "shl",
|
|
"operands": "rax, 0x20",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d9a",
|
|
"size": 4,
|
|
"mnemonic": "xor",
|
|
"operands": "rax, qword ptr [rbp + 0x18]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005d9e",
|
|
"size": 4,
|
|
"mnemonic": "xor",
|
|
"operands": "rax, qword ptr [rbp - 0x10]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005da2",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rax, rcx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005da5",
|
|
"size": 10,
|
|
"mnemonic": "movabs",
|
|
"operands": "rcx, 0xffffffffffff",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005daf",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "rax, rcx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005db2",
|
|
"size": 10,
|
|
"mnemonic": "movabs",
|
|
"operands": "rcx, 0x2b992ddfa233",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005dbc",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005dbf",
|
|
"size": 4,
|
|
"mnemonic": "cmove",
|
|
"operands": "rax, rcx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005dc3",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b276], rax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005dca",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x50]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005dcf",
|
|
"size": 3,
|
|
"mnemonic": "not",
|
|
"operands": "rax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005dd2",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b2a7], rax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005dd9",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140005ddd",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbp",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140005dde",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005e28",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140005e28",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005e28",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rip + 0x2da49]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e2f",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005e30",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140005e30",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005e30",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rip + 0x2da39]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e37",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005e44",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140005e44",
|
|
"size": 9,
|
|
"is_prolog": true,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005e44",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e49",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e4a",
|
|
"size": 8,
|
|
"mnemonic": "lea",
|
|
"operands": "rbp, [rsp - 0x4c0]",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140005e52",
|
|
"size": 7,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x5c0",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140005e59",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, ecx",
|
|
"stack_offset": -1480
|
|
},
|
|
{
|
|
"address": "0x140005e5b",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 0x17",
|
|
"stack_offset": -1480
|
|
},
|
|
{
|
|
"address": "0x140005e60",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a22a]",
|
|
"stack_offset": -1480
|
|
},
|
|
{
|
|
"address": "0x140005e66",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -1480
|
|
},
|
|
{
|
|
"address": "0x140005e68",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005e6e",
|
|
"stack_offset": -1480
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005e6e",
|
|
"0x140005e6a"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005e6e",
|
|
"size": 15,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005e6e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e73",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e38",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e78",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e7a",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e7e",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x4d0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e84",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001ea80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e89",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e8d",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a1c5]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e93",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rbp + 0xe8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e9a",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rbp + 0x4d8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ea1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ea4",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ea7",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a1b3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ead",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005eb0",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005ef1",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005ef1",
|
|
"0x140005eb2"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005e6a",
|
|
"size": 17,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005e6a",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e6c",
|
|
"size": 2,
|
|
"mnemonic": "int",
|
|
"operands": "0x29",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e6e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e73",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e38",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e78",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e7a",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e7e",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x4d0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e84",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001ea80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e89",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e8d",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a1c5]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e93",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rbp + 0xe8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e9a",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rbp + 0x4d8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ea1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ea4",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ea7",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a1b3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ead",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005eb0",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005ef1",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005ef1",
|
|
"0x140005eb2"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005ef1",
|
|
"size": 27,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005ef1",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp + 0x4c8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ef8",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005efd",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0xe8], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f04",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f06",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x4c8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f0d",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x98",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f13",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rax, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f17",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0x88], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f1e",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001ea80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f23",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp + 0x4c8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f2a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x60], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f2f",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x50], 0x40000015",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f37",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x54], 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f3f",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a17b]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f45",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f47",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f49",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f4e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x40], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f53",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp - 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f57",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x48], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f5c",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a116]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f62",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f67",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a103]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f6d",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f6f",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005f7e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f71",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebx, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f74",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005f7e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005f7e",
|
|
"0x140005f76"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005eb2",
|
|
"size": 39,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005eb2",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rbp + 0x4d8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005eb9",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x4e0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ec0",
|
|
"size": 9,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x38], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ec9",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ecc",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x30], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ed1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ed4",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x4e8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005edb",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x28], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ee0",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ee4",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ee9",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005eeb",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a177]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ef1",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp + 0x4c8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005ef8",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005efd",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0xe8], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f04",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f06",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x4c8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f0d",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x98",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f13",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rax, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f17",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0x88], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f1e",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001ea80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f23",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp + 0x4c8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f2a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x60], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f2f",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x50], 0x40000015",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f37",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x54], 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f3f",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a17b]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f45",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f47",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f49",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f4e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x40], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f53",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp - 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f57",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x48], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f5c",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a116]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f62",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f67",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a103]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f6d",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f6f",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005f7e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f71",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebx, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f74",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005f7e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005f7e",
|
|
"0x140005f76"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005f7e",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005f7e",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x5d0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f86",
|
|
"size": 7,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x5c0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f8d",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbp",
|
|
"stack_offset": 1472
|
|
},
|
|
{
|
|
"address": "0x140005f8e",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 1480
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005f76",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005f76",
|
|
"size": 3,
|
|
"mnemonic": "lea",
|
|
"operands": "ecx, [rax + 3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f79",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e38",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f7e",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x5d0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f86",
|
|
"size": 7,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x5c0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f8d",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbp",
|
|
"stack_offset": 1472
|
|
},
|
|
{
|
|
"address": "0x140005f8e",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 1480
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005f98",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140005f98",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005f98",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005f9c",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005f9e",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1a12c]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005fa4",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140005fa7",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140005fe3",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005fe3",
|
|
"0x140005fa9"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005fe3",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005fe3",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fe5",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fe9",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005fa9",
|
|
"size": 14,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005fa9",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 0x5a4d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fae",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "word ptr [rax], cx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fb1",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005fe3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fb3",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 0x3c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fb7",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + rax], 0x4550",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fbe",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005fe3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fc0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, 0x20b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fc5",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "word ptr [rcx + rax + 0x18], dx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fca",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005fe3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fcc",
|
|
"size": 8,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + rax + 0x84], 0xe",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fd4",
|
|
"size": 2,
|
|
"mnemonic": "jbe",
|
|
"operands": "0x140005fe3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fd6",
|
|
"size": 8,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + rax + 0xf8], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fde",
|
|
"size": 3,
|
|
"mnemonic": "setne",
|
|
"operands": "al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fe1",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005fe5",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005fe5"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005fe5",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005fe5",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005fe9",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e868",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000e868",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e868",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e86c",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x2492d]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e873",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e876",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e8b1",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e878",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x24909]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e87f",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e882",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e8aa",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e884",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rip + 0x24905], rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e88b",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e891",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e88d",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e88f",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000e8aa",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000e8aa"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e8aa",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e8aa",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x248ef], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8b1",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8b5",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e8c0",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000e8c0",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e8c0",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rcx, rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8c3",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000e8f5",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000e8f5",
|
|
"0x14000e8c5"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e8f5",
|
|
"size": 1,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e8f5",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e8c5",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e8c5",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8ca",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8cb",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000e8cf",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rdx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e8d2",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e8d5",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e8d8",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e8db",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000e8e2",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000e8e2",
|
|
"0x14000e8dd"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e8e2",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e8e2",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rbx, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8e6",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8e9",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e8d5",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8eb",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8f0",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8f4",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000e8f5",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e8dd",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e8dd",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001e3a0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8e2",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rbx, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8e6",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8e9",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e8d5",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8eb",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8f0",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8f4",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000e8f5",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e8f8",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000e8f8",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e8f8",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8fd",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e8fe",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000e902",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rdx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e905",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e908",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rcx, rdx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e90b",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000e927",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000e927",
|
|
"0x14000e90d"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e927",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e927",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e929",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e92e",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e932",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000e933",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e90d",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e90d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e910",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e913",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000e91e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000e91e",
|
|
"0x14000e915"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e91e",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e91e",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rbx, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e922",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e925",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e90d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e927",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e929",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e92e",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e932",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000e933",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e915",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e915",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001e3a0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e91a",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e91c",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e929",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e91e",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rbx, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e922",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e925",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e90d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e927",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e929",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e92e",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e932",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000e933",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ebbc",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000ebbc",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ebbc",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ebbe",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ebc0",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8d, [rdx + 1]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ebc4",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000ea2c",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000ea2c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ea2c",
|
|
"size": 14,
|
|
"is_prolog": true,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ea2c",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x18], r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea31",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x10], edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea35",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea36",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, rsp",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000ea39",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x50",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000ea3d",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x20], 0xfffffffffffffffe",
|
|
"stack_offset": -88
|
|
},
|
|
{
|
|
"address": "0x14000ea45",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x60], rbx",
|
|
"stack_offset": -88
|
|
},
|
|
{
|
|
"address": "0x14000ea4a",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, ecx",
|
|
"stack_offset": -88
|
|
},
|
|
{
|
|
"address": "0x14000ea4c",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": -88
|
|
},
|
|
{
|
|
"address": "0x14000ea4f",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ea9b",
|
|
"stack_offset": -88
|
|
},
|
|
{
|
|
"address": "0x14000ea51",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": -88
|
|
},
|
|
{
|
|
"address": "0x14000ea53",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x11677]",
|
|
"stack_offset": -88
|
|
},
|
|
{
|
|
"address": "0x14000ea59",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": -88
|
|
},
|
|
{
|
|
"address": "0x14000ea5c",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000ea9b",
|
|
"stack_offset": -88
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000ea9b",
|
|
"0x14000ea5e"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ea9b",
|
|
"size": 23,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ea9b",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbp + 0x28], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea9f",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaa3",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x18], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaa7",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaab",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x10], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaaf",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eab3",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 8], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eab7",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eabc",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rbp - 0x2c], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eabf",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rbp - 0x28], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eac2",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rbp - 0x2c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eac6",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [rbp - 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaca",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rbp - 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eace",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ead2",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000e934",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ead7",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ead8",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rbp + 0x20], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eadc",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000eafc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eade",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400191c0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eae3",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eae6",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000eaec",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eae8",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "dl, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaea",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000eaf6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000eaf6"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ea5e",
|
|
"size": 14,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ea5e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 0x5a4d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea63",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "word ptr [rax], cx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea66",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ea9b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea68",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 0x3c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea6c",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea6f",
|
|
"size": 6,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx], 0x4550",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea75",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ea9b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea77",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 0x20b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea7c",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "word ptr [rcx + 0x18], ax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea80",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ea9b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea82",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + 0x84], 0xe",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea89",
|
|
"size": 2,
|
|
"mnemonic": "jbe",
|
|
"operands": "0x14000ea9b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea8b",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + 0xf8], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea92",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000ea9b",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000ea9b",
|
|
"0x14000ea94"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eaf6",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eaf6",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rbp + 0x20], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eafa",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000eb07",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000eb07",
|
|
"0x14000eafc"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ea94",
|
|
"size": 25,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ea94",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea96",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000eb40",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea9b",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbp + 0x28], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea9f",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaa3",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x18], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaa7",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaab",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x10], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaaf",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eab3",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 8], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eab7",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eabc",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rbp - 0x2c], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eabf",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rbp - 0x28], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eac2",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rbp - 0x2c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eac6",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [rbp - 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaca",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rbp - 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eace",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ead2",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000e934",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ead7",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ead8",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rbp + 0x20], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eadc",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000eafc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eade",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400191c0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eae3",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eae6",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000eaec",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eae8",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "dl, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eaea",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000eaf6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000eaf6"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb07",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb07",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb09",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000eb10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb0e",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eafc",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eafc",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb01",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x50",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb05",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbp",
|
|
"stack_offset": 80
|
|
},
|
|
{
|
|
"address": "0x14000eb06",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 88
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ebcc",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000ebcc",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ebcc",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ebcf",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "edx, [r8 + 2]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ebd3",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000ea2c",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000ea2c"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ebd8",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000ebd8",
|
|
"size": 14,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ebd8",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ebdc",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "r8, qword ptr [rip + 0x2245d]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ebe3",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ebe6",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rip + 0x245c3], r8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ebed",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ec0e",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ebef",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, r8d",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ebf2",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 0x40",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ebf7",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "eax, 0x3f",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ebfa",
|
|
"size": 2,
|
|
"mnemonic": "sub",
|
|
"operands": "ecx, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ebfc",
|
|
"size": 3,
|
|
"mnemonic": "ror",
|
|
"operands": "rdx, cl",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ebff",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rdx, r8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ec02",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x245a7], rdx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ec09",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000ec0d",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ec14",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000ec14",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ec14",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ec17",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ec19",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000ea2c",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000ea2c"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ec88",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000ec88",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ec88",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rip + 0x24539]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ec8f",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ec90",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000ec90",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ec90",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rip + 0x24539]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ec97",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001e360",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14001e360",
|
|
"size": 1,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001e360",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "rax",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001150",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140001150",
|
|
"size": 26,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001150",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001155",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000115a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000115f",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001160",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r12",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140001162",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r13",
|
|
"stack_offset": -16
|
|
},
|
|
{
|
|
"address": "0x140001164",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r14",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140001166",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r15",
|
|
"stack_offset": -32
|
|
},
|
|
{
|
|
"address": "0x140001168",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x70",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000116c",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r12, rdx",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x14000116f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, rcx",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x140001172",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r13d, r13d",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x140001175",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, r13d",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x140001178",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x20], r13d",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x14000117d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rdx",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x140001180",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001ef10",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x140001185",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r14, rax",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x140001188",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8, qword ptr [rsi]",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x14000118b",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "r9, dword ptr [r8 + 4]",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x14000118f",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r9 + rsi + 0x28]",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x140001194",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rbx, rbx",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x140001197",
|
|
"size": 2,
|
|
"mnemonic": "jle",
|
|
"operands": "0x1400011a3",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x140001199",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x14000119c",
|
|
"size": 2,
|
|
"mnemonic": "jle",
|
|
"operands": "0x1400011a3",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x14000119e",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": -152
|
|
},
|
|
{
|
|
"address": "0x1400011a1",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400011a6",
|
|
"stack_offset": -152
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400011a6"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400011a6",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400011a6",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r15, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011a9",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0xb0], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011b1",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [r9 + rsi + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011b6",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011b9",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400011c1",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400011c1",
|
|
"0x1400011bb"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400011c1",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400011c1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011c4",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011c8",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + rsi + 0x10], edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011cc",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140001342",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011d2",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + rsi + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011d7",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011da",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400011f7",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400011f7",
|
|
"0x1400011dc"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400011bb",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400011bb",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011be",
|
|
"size": 3,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rax + 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011c1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011c4",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011c8",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + rsi + 0x10], edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011cc",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140001342",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011d2",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + rsi + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011d7",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011da",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400011f7",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400011f7",
|
|
"0x1400011dc"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400011f7",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400011f7",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011fa",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011fe",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rcx + rsi + 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001202",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "eax, 0x1c0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001207",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 0x40",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000120a",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000127d",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000127d",
|
|
"0x14000120c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400011dc",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400011dc",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rcx, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011df",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400011f7",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400011f7",
|
|
"0x1400011e1"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000127d",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000127d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001280",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001284",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + rsi + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001289",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000128c",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000128f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, r12",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001292",
|
|
"size": 3,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rax + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001295",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001298",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400012a7",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400012a7",
|
|
"0x14000129a"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000120c",
|
|
"size": 10,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000120c",
|
|
"size": 4,
|
|
"mnemonic": "nop",
|
|
"operands": "dword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001210",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rbx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001213",
|
|
"size": 2,
|
|
"mnemonic": "jle",
|
|
"operands": "0x14000127d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001215",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001218",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000121c",
|
|
"size": 6,
|
|
"mnemonic": "movzx",
|
|
"operands": "r8d, byte ptr [rcx + rsi + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001222",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + rsi + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001227",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000122b",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rax], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000122f",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140001255",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001255",
|
|
"0x140001231"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400011e1",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400011e1",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140002000",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011e6",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011e9",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011ed",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + rsi + 0x10], edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011f1",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140001342",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011f7",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011fa",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400011fe",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rcx + rsi + 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001202",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "eax, 0x1c0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001207",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 0x40",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000120a",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000127d",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000127d",
|
|
"0x14000120c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400012a7",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400012a7",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rbx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012aa",
|
|
"size": 2,
|
|
"mnemonic": "jle",
|
|
"operands": "0x140001311",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012ac",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012af",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012b3",
|
|
"size": 6,
|
|
"mnemonic": "movzx",
|
|
"operands": "r8d, byte ptr [rcx + rsi + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012b9",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + rsi + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012be",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012c2",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rax], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012c6",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400012ec",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400012ec",
|
|
"0x1400012c8"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000129a",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000129a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000129f",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012a1",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x20], edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012a5",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140001316",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001349"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001255",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001255",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001258",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000125b",
|
|
"size": 3,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rax + 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000125e",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001261",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140001273",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001263",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001268",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000126a",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x20], edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000126e",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140001316",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001349"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001231",
|
|
"size": 13,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001231",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rcx + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001235",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rdx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001237",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001239",
|
|
"size": 2,
|
|
"mnemonic": "jle",
|
|
"operands": "0x140001255",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000123b",
|
|
"size": 2,
|
|
"mnemonic": "dec",
|
|
"operands": "eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000123d",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rdx], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000123f",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001243",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001246",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rdx + 1]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000124a",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rcx], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000124d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rdx], r8b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001250",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001253",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000125e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001349"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400012ec",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400012ec",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012ef",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012f2",
|
|
"size": 3,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rax + 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012f5",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012f8",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140001307",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012fa",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012ff",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001301",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x20], edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001305",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140001316",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001349"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400012c8",
|
|
"size": 13,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400012c8",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rcx + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012cc",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rdx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012ce",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012d0",
|
|
"size": 2,
|
|
"mnemonic": "jle",
|
|
"operands": "0x1400012ec",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012d2",
|
|
"size": 2,
|
|
"mnemonic": "dec",
|
|
"operands": "eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012d4",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rdx], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012d6",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012da",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012dd",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rdx + 1]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012e1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rcx], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012e4",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rdx], r8b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012e7",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400012ea",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400012f5",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001349"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001349",
|
|
"size": 20,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001349",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000134c",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001350",
|
|
"size": 6,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rcx + rsi + 0x48], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001356",
|
|
"size": 4,
|
|
"mnemonic": "cmovne",
|
|
"operands": "edx, r13d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000135a",
|
|
"size": 2,
|
|
"mnemonic": "or",
|
|
"operands": "edx, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000135c",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "edx, dword ptr [rcx + rsi + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001360",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "edx, 0x17",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001363",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rcx + rsi + 0x10], edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001367",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "edx, dword ptr [rcx + rsi + 0x14]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000136b",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400013b2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000136d",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400023f4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001372",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001374",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000137e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001376",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, r15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001379",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140001d10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000137e",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [r15]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001381",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001385",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + r15 + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000138a",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000138d",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140001395",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001395",
|
|
"0x14000138f"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001395",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001395",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001398",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r11, [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000139d",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r11 + 0x38]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400013a1",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [r11 + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400013a5",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsp, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400013a8",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400013aa",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 8
|
|
},
|
|
{
|
|
"address": "0x1400013ac",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 16
|
|
},
|
|
{
|
|
"address": "0x1400013ae",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 24
|
|
},
|
|
{
|
|
"address": "0x1400013b0",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x1400013b1",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000138f",
|
|
"size": 13,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000138f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001392",
|
|
"size": 3,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rax + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001395",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001398",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r11, [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000139d",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r11 + 0x38]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400013a1",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [r11 + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400013a5",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsp, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400013a8",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400013aa",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 8
|
|
},
|
|
{
|
|
"address": "0x1400013ac",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 16
|
|
},
|
|
{
|
|
"address": "0x1400013ae",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 24
|
|
},
|
|
{
|
|
"address": "0x1400013b0",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x1400013b1",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400060d8",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400060d8",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400060d8",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400060da",
|
|
"size": 6,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rip + 0x2d788], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400060e0",
|
|
"size": 3,
|
|
"mnemonic": "setne",
|
|
"operands": "al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400060e3",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400057f0",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400057f0",
|
|
"size": 24,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400057f0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400057f5",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x18], rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400057fa",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400057ff",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005800",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x10",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140005804",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005806",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005808",
|
|
"size": 2,
|
|
"mnemonic": "cpuid",
|
|
"operands": "",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000580a",
|
|
"size": 6,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, 0x6c65746e",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005810",
|
|
"size": 6,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, 0x49656e69",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005816",
|
|
"size": 2,
|
|
"mnemonic": "or",
|
|
"operands": "edx, ecx",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005818",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebp, eax",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000581a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 1",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000581f",
|
|
"size": 6,
|
|
"mnemonic": "xor",
|
|
"operands": "ebx, 0x756e6547",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005825",
|
|
"size": 2,
|
|
"mnemonic": "or",
|
|
"operands": "edx, ebx",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005827",
|
|
"size": 3,
|
|
"mnemonic": "lea",
|
|
"operands": "ecx, [rax - 1]",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000582a",
|
|
"size": 2,
|
|
"mnemonic": "cpuid",
|
|
"operands": "",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000582c",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, ecx",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000582e",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000588e",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005830",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "eax, 0xfff3ff0",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005835",
|
|
"size": 11,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b860], 0x8000",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005840",
|
|
"size": 11,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b85d], 0xffffffffffffffff",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000584b",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 0x106c0",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140005850",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000587a",
|
|
"stack_offset": -24
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000587a",
|
|
"0x140005852"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000587a",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000587a",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, dword ptr [rip + 0x2cebb]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005881",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "r8d, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005885",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2ceb0], r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000588c",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005895",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005895"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005852",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005852",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 0x20660",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005857",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000587a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000587a",
|
|
"0x140005859"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005895",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005895",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r9d, r9d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005898",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "esi, r9d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000589b",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r10d, r9d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000589e",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r11d, r9d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058a1",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebp, 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058a4",
|
|
"size": 2,
|
|
"mnemonic": "jl",
|
|
"operands": "0x1400058e6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400058e6",
|
|
"0x1400058a6"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005859",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005859",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 0x20670",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000585e",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000587a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000587a",
|
|
"0x140005860"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400058e6",
|
|
"size": 31,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400058e6",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x2b7a3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058ed",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "rax, 0xfffffffffffffffe",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058f1",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b79d], 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058fb",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b797], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005905",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b784], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000590c",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "edi, 0x14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005910",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005931",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005912",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "rax, 0xffffffffffffffef",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005916",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b778], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005920",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b769], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005927",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b76b], 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005931",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "edi, 0x1b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005935",
|
|
"size": 6,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a6e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000593b",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000593d",
|
|
"size": 3,
|
|
"mnemonic": "xgetbv",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005940",
|
|
"size": 4,
|
|
"mnemonic": "shl",
|
|
"operands": "rdx, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005944",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "rdx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005947",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000594c",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "edi, 0x1c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005950",
|
|
"size": 6,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005956",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000595b",
|
|
"size": 2,
|
|
"mnemonic": "and",
|
|
"operands": "al, 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000595d",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "al, 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000595f",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005965",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rip + 0x2b731]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000596b",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "dl, 0xe0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000596d",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "eax, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005970",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b71e], 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000597a",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b71c], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005980",
|
|
"size": 4,
|
|
"mnemonic": "test",
|
|
"operands": "r9b, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005984",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400059e8",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400059e8",
|
|
"0x140005986"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400058a6",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400058a6",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "eax, [r9 + 7]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058aa",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058ac",
|
|
"size": 2,
|
|
"mnemonic": "cpuid",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058ae",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "esi, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058b0",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9d, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058b3",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "ebx, 9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058b7",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x1400058c4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058b9",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "r8d, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058bd",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2ce78], r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058c4",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058c7",
|
|
"size": 2,
|
|
"mnemonic": "jl",
|
|
"operands": "0x1400058d6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400058d6",
|
|
"0x1400058c9"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005860",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005860",
|
|
"size": 5,
|
|
"mnemonic": "add",
|
|
"operands": "eax, 0xfffcf9b0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005865",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005868",
|
|
"size": 2,
|
|
"mnemonic": "ja",
|
|
"operands": "0x14000588e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000588e",
|
|
"0x14000586a"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400059e8",
|
|
"size": 38,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400059e8",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x2b6a1]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059ef",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "esi, 0x17",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059f3",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a01",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059f5",
|
|
"size": 5,
|
|
"mnemonic": "btr",
|
|
"operands": "rax, 0x18",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059fa",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b68f], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a01",
|
|
"size": 5,
|
|
"mnemonic": "bt",
|
|
"operands": "r10d, 0x13",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a06",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a08",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a0d",
|
|
"size": 2,
|
|
"mnemonic": "and",
|
|
"operands": "al, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a0f",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "al, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a11",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a13",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, r11d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a16",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, r11d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a19",
|
|
"size": 4,
|
|
"mnemonic": "shr",
|
|
"operands": "rcx, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a1d",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "eax, 0x400ff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a22",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "ecx, 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a25",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2cd0d], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a2b",
|
|
"size": 7,
|
|
"mnemonic": "or",
|
|
"operands": "rcx, 0x1000029",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a32",
|
|
"size": 3,
|
|
"mnemonic": "not",
|
|
"operands": "rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a35",
|
|
"size": 7,
|
|
"mnemonic": "and",
|
|
"operands": "rcx, qword ptr [rip + 0x2b654]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a3c",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b64d], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a43",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a45",
|
|
"size": 2,
|
|
"mnemonic": "jbe",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a47",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "rcx, 0xffffffffffffffbf",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a4b",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b63e], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a52",
|
|
"size": 5,
|
|
"mnemonic": "bt",
|
|
"operands": "r10d, 0x15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a57",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a6e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a59",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a5e",
|
|
"size": 5,
|
|
"mnemonic": "bt",
|
|
"operands": "rax, 0x13",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a63",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a6e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a65",
|
|
"size": 9,
|
|
"mnemonic": "btr",
|
|
"operands": "qword ptr [rip + 0x2b622], 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a6e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a73",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a75",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a7a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x38]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a7f",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a83",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 16
|
|
},
|
|
{
|
|
"address": "0x140005a84",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 24
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005986",
|
|
"size": 20,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005986",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "eax, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005989",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b705], 5",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005993",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b703], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005999",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 0xd0030000",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000599e",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x2b6eb]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059a5",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "r9d, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059a8",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "rax, 0xfffffffffffffffd",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059ac",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b6dd], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059b3",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "r9d, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059b6",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400059ef",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059b8",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059bd",
|
|
"size": 2,
|
|
"mnemonic": "and",
|
|
"operands": "al, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059bf",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "al, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059c1",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400059e8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059c3",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x2b6c6]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059ca",
|
|
"size": 7,
|
|
"mnemonic": "or",
|
|
"operands": "dword ptr [rip + 0x2b6cb], 0x40",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059d1",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "rax, 0xffffffffffffffdb",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059d5",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b6b9], 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059df",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b6aa], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059e6",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400059ef",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400059ef"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400058d6",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400058d6",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 0x24",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058db",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebp, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058dd",
|
|
"size": 2,
|
|
"mnemonic": "jl",
|
|
"operands": "0x1400058e6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400058e6",
|
|
"0x1400058df"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400058c9",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400058c9",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058ce",
|
|
"size": 3,
|
|
"mnemonic": "lea",
|
|
"operands": "ecx, [rax - 6]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058d1",
|
|
"size": 2,
|
|
"mnemonic": "cpuid",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058d3",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r10d, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058d6",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 0x24",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058db",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebp, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058dd",
|
|
"size": 2,
|
|
"mnemonic": "jl",
|
|
"operands": "0x1400058e6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400058e6",
|
|
"0x1400058df"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000588e",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000588e",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, dword ptr [rip + 0x2cea7]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005895",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r9d, r9d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005898",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "esi, r9d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000589b",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r10d, r9d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000589e",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r11d, r9d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058a1",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebp, 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058a4",
|
|
"size": 2,
|
|
"mnemonic": "jl",
|
|
"operands": "0x1400058e6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400058e6",
|
|
"0x1400058a6"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000586a",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000586a",
|
|
"size": 10,
|
|
"mnemonic": "movabs",
|
|
"operands": "rcx, 0x100010001",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005874",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "rcx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005878",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x14000588e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000587a",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, dword ptr [rip + 0x2cebb]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005881",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "r8d, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005885",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2ceb0], r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000588c",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140005895",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140005895"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400059ef",
|
|
"size": 37,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400059ef",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "esi, 0x17",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059f3",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a01",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059f5",
|
|
"size": 5,
|
|
"mnemonic": "btr",
|
|
"operands": "rax, 0x18",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400059fa",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b68f], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a01",
|
|
"size": 5,
|
|
"mnemonic": "bt",
|
|
"operands": "r10d, 0x13",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a06",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a08",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a0d",
|
|
"size": 2,
|
|
"mnemonic": "and",
|
|
"operands": "al, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a0f",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "al, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a11",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a13",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, r11d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a16",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, r11d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a19",
|
|
"size": 4,
|
|
"mnemonic": "shr",
|
|
"operands": "rcx, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a1d",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "eax, 0x400ff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a22",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "ecx, 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a25",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2cd0d], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a2b",
|
|
"size": 7,
|
|
"mnemonic": "or",
|
|
"operands": "rcx, 0x1000029",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a32",
|
|
"size": 3,
|
|
"mnemonic": "not",
|
|
"operands": "rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a35",
|
|
"size": 7,
|
|
"mnemonic": "and",
|
|
"operands": "rcx, qword ptr [rip + 0x2b654]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a3c",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b64d], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a43",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a45",
|
|
"size": 2,
|
|
"mnemonic": "jbe",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a47",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "rcx, 0xffffffffffffffbf",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a4b",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b63e], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a52",
|
|
"size": 5,
|
|
"mnemonic": "bt",
|
|
"operands": "r10d, 0x15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a57",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a6e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a59",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a5e",
|
|
"size": 5,
|
|
"mnemonic": "bt",
|
|
"operands": "rax, 0x13",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a63",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a6e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a65",
|
|
"size": 9,
|
|
"mnemonic": "btr",
|
|
"operands": "qword ptr [rip + 0x2b622], 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a6e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a73",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a75",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a7a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x38]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a7f",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005a83",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 16
|
|
},
|
|
{
|
|
"address": "0x140005a84",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 24
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400058df",
|
|
"size": 34,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400058df",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058e1",
|
|
"size": 2,
|
|
"mnemonic": "cpuid",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058e3",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r11d, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058e6",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x2b7a3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058ed",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "rax, 0xfffffffffffffffe",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058f1",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b79d], 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400058fb",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b797], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005905",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b784], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000590c",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "edi, 0x14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005910",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005931",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005912",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "rax, 0xffffffffffffffef",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005916",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b778], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005920",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rip + 0x2b769], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005927",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b76b], 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005931",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "edi, 0x1b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005935",
|
|
"size": 6,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a6e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000593b",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000593d",
|
|
"size": 3,
|
|
"mnemonic": "xgetbv",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005940",
|
|
"size": 4,
|
|
"mnemonic": "shl",
|
|
"operands": "rdx, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005944",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "rdx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005947",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000594c",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "edi, 0x1c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005950",
|
|
"size": 6,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005956",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000595b",
|
|
"size": 2,
|
|
"mnemonic": "and",
|
|
"operands": "al, 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000595d",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "al, 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000595f",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005a52",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005965",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rip + 0x2b731]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000596b",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "dl, 0xe0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000596d",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "eax, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005970",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b71e], 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000597a",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2b71c], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005980",
|
|
"size": 4,
|
|
"mnemonic": "test",
|
|
"operands": "r9b, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005984",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400059e8",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400059e8",
|
|
"0x140005986"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140007318",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140007318",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140007318",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000731c",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000a73c",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007321",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007323",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140007329",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007325",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "al, al",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007327",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000733b",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000733b"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000733b",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000733b",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000733f",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140010b38",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140010b38",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140010b38",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b3c",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "cl, cl",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010b3e",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140010b56",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140010b56",
|
|
"0x140010b40"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140010b56",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140010b56",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x150c3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b5d",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rip + 0x14fbc]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b64",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b68",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14001bff8",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001bff8"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140010b40",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140010b40",
|
|
"size": 8,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rip + 0x222a0], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b48",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140010b4f",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140010b4f",
|
|
"0x140010b4a"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001bff8",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001bff8",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001bffd",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001bffe",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14001c002",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rdx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001c005",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001c008",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rcx, rdx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001c00b",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001c026",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001c026",
|
|
"0x14001c00d"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140010b4f",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140010b4f",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b51",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b55",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140010b4a",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140010b4a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000b74c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b4f",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b51",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010b55",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001c026",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001c026",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c02b",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c02d",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c031",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14001c032",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001c00d",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001c00d",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx - 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c011",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c014",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001c01d",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001c01d",
|
|
"0x14001c016"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001c01d",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001c01d",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rbx, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c021",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c024",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001c00d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c026",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c02b",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c02d",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c031",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14001c032",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001c016",
|
|
"size": 10,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001c016",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c018",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001e3a0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c01d",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rbx, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c021",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c024",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001c00d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c026",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c02b",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c02d",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001c031",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14001c032",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140007340",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140007340",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140007340",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007344",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "cl, cl",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007346",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140007352",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007348",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140007514",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000734d",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000a784",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007352",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007354",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007358",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005e38",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140005e38",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005e38",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x2ce86], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005e42",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ea80",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14001ea80",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ea80",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ea83",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ea86",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r10, [rip - 0x1ea8d]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ea8d",
|
|
"size": 3,
|
|
"mnemonic": "movzx",
|
|
"operands": "edx, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ea90",
|
|
"size": 10,
|
|
"mnemonic": "movabs",
|
|
"operands": "r11, 0x101010101010101",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ea9a",
|
|
"size": 4,
|
|
"mnemonic": "imul",
|
|
"operands": "r11, rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ea9e",
|
|
"size": 5,
|
|
"mnemonic": "movq",
|
|
"operands": "xmm0, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eaa3",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, 0xf",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eaa7",
|
|
"size": 6,
|
|
"mnemonic": "ja",
|
|
"operands": "0x14001eb30",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001eb30",
|
|
"0x14001eaad"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001eb30",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001eb30",
|
|
"size": 4,
|
|
"mnemonic": "punpcklqdq",
|
|
"operands": "xmm0, xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb34",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb38",
|
|
"size": 2,
|
|
"mnemonic": "ja",
|
|
"operands": "0x14001eb46",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001eb46",
|
|
"0x14001eb3a"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001eaad",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001eaad",
|
|
"size": 3,
|
|
"mnemonic": "nop",
|
|
"operands": "dword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eab0",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, r8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eab3",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "r9d, dword ptr [r10 + r8*4 + 0x2cac0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eabb",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r9, r10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eabe",
|
|
"size": 3,
|
|
"mnemonic": "jmp",
|
|
"operands": "r9",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001eb46",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001eb46",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rip + 0x1254b], 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb4d",
|
|
"size": 6,
|
|
"mnemonic": "jb",
|
|
"operands": "0x14001ed30",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ed30",
|
|
"0x14001eb53"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001eb3a",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001eb3a",
|
|
"size": 4,
|
|
"mnemonic": "movdqu",
|
|
"operands": "xmmword ptr [rcx], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb3e",
|
|
"size": 7,
|
|
"mnemonic": "movdqu",
|
|
"operands": "xmmword ptr [rcx + r8 - 0x10], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb45",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ed30",
|
|
"size": 32,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ed30",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, qword ptr [rip + 0x12369]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed37",
|
|
"size": 2,
|
|
"mnemonic": "jbe",
|
|
"operands": "0x14001ed46",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed39",
|
|
"size": 7,
|
|
"mnemonic": "test",
|
|
"operands": "byte ptr [rip + 0x139fc], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed40",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001ea70",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed46",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed49",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "r9, 0xf",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed4d",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "r9, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed51",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "rcx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed54",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "rdx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed57",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r8, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed5a",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, 0x80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed61",
|
|
"size": 2,
|
|
"mnemonic": "jbe",
|
|
"operands": "0x14001edae",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed63",
|
|
"size": 13,
|
|
"mnemonic": "nop",
|
|
"operands": "word ptr [rax + rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed70",
|
|
"size": 4,
|
|
"mnemonic": "movdqa",
|
|
"operands": "xmmword ptr [rcx], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed74",
|
|
"size": 5,
|
|
"mnemonic": "movdqa",
|
|
"operands": "xmmword ptr [rcx + 0x10], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed79",
|
|
"size": 5,
|
|
"mnemonic": "movdqa",
|
|
"operands": "xmmword ptr [rcx + 0x20], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed7e",
|
|
"size": 5,
|
|
"mnemonic": "movdqa",
|
|
"operands": "xmmword ptr [rcx + 0x30], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed83",
|
|
"size": 5,
|
|
"mnemonic": "movdqa",
|
|
"operands": "xmmword ptr [rcx + 0x40], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed88",
|
|
"size": 5,
|
|
"mnemonic": "movdqa",
|
|
"operands": "xmmword ptr [rcx + 0x50], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed8d",
|
|
"size": 5,
|
|
"mnemonic": "movdqa",
|
|
"operands": "xmmword ptr [rcx + 0x60], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed92",
|
|
"size": 5,
|
|
"mnemonic": "movdqa",
|
|
"operands": "xmmword ptr [rcx + 0x70], xmm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed97",
|
|
"size": 7,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, 0x80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ed9e",
|
|
"size": 7,
|
|
"mnemonic": "sub",
|
|
"operands": "r8, 0x80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eda5",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, 0x80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001edac",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x14001ed70",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001edae",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [r8 + 0xf]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001edb2",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "r9, 0xfffffffffffffff0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001edb6",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r11, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001edb9",
|
|
"size": 4,
|
|
"mnemonic": "shr",
|
|
"operands": "r11, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001edbd",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "r11d, dword ptr [r10 + r11*4 + 0x2cb48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001edc5",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r11, r10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001edc8",
|
|
"size": 3,
|
|
"mnemonic": "jmp",
|
|
"operands": "r11",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001eb53",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001eb53",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, qword ptr [rip + 0x12546]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb5a",
|
|
"size": 2,
|
|
"mnemonic": "jbe",
|
|
"operands": "0x14001eb72",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb5c",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, qword ptr [rip + 0x12545]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb63",
|
|
"size": 2,
|
|
"mnemonic": "ja",
|
|
"operands": "0x14001eb72",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001eb72",
|
|
"0x14001eb65"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001eb72",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001eb72",
|
|
"size": 6,
|
|
"mnemonic": "vinsertf128",
|
|
"operands": "ymm0, ymm0, xmm0, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb78",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb7b",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "r9, 0x1f",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb7f",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "r9, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb83",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "rcx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb86",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "rdx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb89",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r8, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb8c",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb93",
|
|
"size": 2,
|
|
"mnemonic": "jbe",
|
|
"operands": "0x14001ebfa",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb95",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, qword ptr [rip + 0x1250c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb9c",
|
|
"size": 6,
|
|
"mnemonic": "ja",
|
|
"operands": "0x14001ec70",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ec70",
|
|
"0x14001eba2"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001eb65",
|
|
"size": 13,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001eb65",
|
|
"size": 7,
|
|
"mnemonic": "test",
|
|
"operands": "byte ptr [rip + 0x13bd0], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb6c",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001ea70",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb72",
|
|
"size": 6,
|
|
"mnemonic": "vinsertf128",
|
|
"operands": "ymm0, ymm0, xmm0, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb78",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb7b",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "r9, 0x1f",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb7f",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "r9, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb83",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "rcx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb86",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "rdx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb89",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r8, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb8c",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb93",
|
|
"size": 2,
|
|
"mnemonic": "jbe",
|
|
"operands": "0x14001ebfa",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb95",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, qword ptr [rip + 0x1250c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eb9c",
|
|
"size": 6,
|
|
"mnemonic": "ja",
|
|
"operands": "0x14001ec70",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ec70",
|
|
"0x14001eba2"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ec70",
|
|
"size": 19,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ec70",
|
|
"size": 4,
|
|
"mnemonic": "vmovntdq",
|
|
"operands": "ymmword ptr [rcx], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec74",
|
|
"size": 5,
|
|
"mnemonic": "vmovntdq",
|
|
"operands": "ymmword ptr [rcx + 0x20], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec79",
|
|
"size": 5,
|
|
"mnemonic": "vmovntdq",
|
|
"operands": "ymmword ptr [rcx + 0x40], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec7e",
|
|
"size": 5,
|
|
"mnemonic": "vmovntdq",
|
|
"operands": "ymmword ptr [rcx + 0x60], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec83",
|
|
"size": 8,
|
|
"mnemonic": "vmovntdq",
|
|
"operands": "ymmword ptr [rcx + 0x80], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec8b",
|
|
"size": 8,
|
|
"mnemonic": "vmovntdq",
|
|
"operands": "ymmword ptr [rcx + 0xa0], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec93",
|
|
"size": 8,
|
|
"mnemonic": "vmovntdq",
|
|
"operands": "ymmword ptr [rcx + 0xc0], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec9b",
|
|
"size": 8,
|
|
"mnemonic": "vmovntdq",
|
|
"operands": "ymmword ptr [rcx + 0xe0], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001eca3",
|
|
"size": 7,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecaa",
|
|
"size": 7,
|
|
"mnemonic": "sub",
|
|
"operands": "r8, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecb1",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecb8",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x14001ec70",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecba",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [r8 + 0x1f]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecbe",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "r9, 0xffffffffffffffe0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecc2",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r11, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecc5",
|
|
"size": 4,
|
|
"mnemonic": "shr",
|
|
"operands": "r11, 5",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecc9",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "r11d, dword ptr [r10 + r11*4 + 0x2cb24]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecd1",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r11, r10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ecd4",
|
|
"size": 3,
|
|
"mnemonic": "jmp",
|
|
"operands": "r11",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001eba2",
|
|
"size": 20,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001eba2",
|
|
"size": 14,
|
|
"mnemonic": "nop",
|
|
"operands": "word ptr [rax + rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebb0",
|
|
"size": 4,
|
|
"mnemonic": "vmovdqa",
|
|
"operands": "ymmword ptr [rcx], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebb4",
|
|
"size": 5,
|
|
"mnemonic": "vmovdqa",
|
|
"operands": "ymmword ptr [rcx + 0x20], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebb9",
|
|
"size": 5,
|
|
"mnemonic": "vmovdqa",
|
|
"operands": "ymmword ptr [rcx + 0x40], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebbe",
|
|
"size": 5,
|
|
"mnemonic": "vmovdqa",
|
|
"operands": "ymmword ptr [rcx + 0x60], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebc3",
|
|
"size": 8,
|
|
"mnemonic": "vmovdqa",
|
|
"operands": "ymmword ptr [rcx + 0x80], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebcb",
|
|
"size": 8,
|
|
"mnemonic": "vmovdqa",
|
|
"operands": "ymmword ptr [rcx + 0xa0], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebd3",
|
|
"size": 8,
|
|
"mnemonic": "vmovdqa",
|
|
"operands": "ymmword ptr [rcx + 0xc0], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebdb",
|
|
"size": 8,
|
|
"mnemonic": "vmovdqa",
|
|
"operands": "ymmword ptr [rcx + 0xe0], ymm0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebe3",
|
|
"size": 7,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebea",
|
|
"size": 7,
|
|
"mnemonic": "sub",
|
|
"operands": "r8, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebf1",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebf8",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x14001ebb0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebfa",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [r8 + 0x1f]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ebfe",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "r9, 0xffffffffffffffe0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec02",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r11, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec05",
|
|
"size": 4,
|
|
"mnemonic": "shr",
|
|
"operands": "r11, 5",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec09",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "r11d, dword ptr [r10 + r11*4 + 0x2cb00]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec11",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r11, r10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ec14",
|
|
"size": 3,
|
|
"mnemonic": "jmp",
|
|
"operands": "r11",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001e3a0",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14001e3a0",
|
|
"size": 1,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001e3a0",
|
|
"size": 6,
|
|
"mnemonic": "jmp",
|
|
"operands": "qword ptr [rip + 0x1f1a]",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001e360"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e934",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000e934",
|
|
"size": 18,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e934",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e939",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e93e",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e93f",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000e943",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, r9",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e946",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, r8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e949",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rdx]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e94b",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca20",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e950",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e951",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rdi",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e954",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000e96c",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e959",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e95a",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rbx]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e95c",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca74",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e961",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e966",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000e96a",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000e96b",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400191c0",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400191c0",
|
|
"size": 15,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400191c0",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400191c2",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x1400191c6",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ebx, ebx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191c8",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x30], ebx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191cc",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400191a8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191d1",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191d3",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400191df",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191d5",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x30]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191da",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140011db4",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191df",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rsp + 0x30], 1",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191e4",
|
|
"size": 3,
|
|
"mnemonic": "setne",
|
|
"operands": "bl",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191e7",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, ebx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191e9",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400191ed",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x1400191ee",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb40",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000eb40",
|
|
"size": 12,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb40",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb42",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000eb46",
|
|
"size": 9,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], 0xfffffffffffffffe",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000eb4f",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, ecx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000eb51",
|
|
"size": 6,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rsp + 0x48], 0",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000eb57",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [rsp + 0x48]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000eb5c",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x16d9d]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000eb63",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000eb65",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x115fd]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000eb6b",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rsp + 0x48]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000eb70",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000eb72",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000eb92",
|
|
"stack_offset": -56
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000eb92",
|
|
"0x14000eb74"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb92",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb92",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb95",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000eb9e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000eb9e",
|
|
"0x14000eb97"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb74",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb74",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x16d9d]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb7b",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x115b7]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb81",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb84",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000eb8d",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000eb8d",
|
|
"0x14000eb86"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb9e",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb9e",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eba2",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x14000eba3",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb97",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb97",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x11593]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb9d",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb9e",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eba2",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x14000eba3",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb8d",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb8d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rsp + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb92",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb95",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000eb9e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000eb9e",
|
|
"0x14000eb97"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb86",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb86",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb88",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001e3a0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb8d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rsp + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb92",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb95",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000eb9e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000eb9e",
|
|
"0x14000eb97"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb10",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000eb10",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb10",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb12",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000eb16",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, ecx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000eb18",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dl, dl",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000eb1a",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000eb2d",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000eb2d",
|
|
"0x14000eb1c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb2d",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb2d",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb2f",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000eb40",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb34",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb36",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x11624]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb3c",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000eb1c",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000eb1c",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1155e]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb22",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb25",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb27",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1155b]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb2d",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb2f",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000eb40",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb34",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb36",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x11624]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000eb3c",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef10",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14001ef10",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef10",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef13",
|
|
"size": 3,
|
|
"mnemonic": "neg",
|
|
"operands": "rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef16",
|
|
"size": 6,
|
|
"mnemonic": "test",
|
|
"operands": "rax, 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef1c",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001ef2d",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ef2d",
|
|
"0x14001ef1e"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef2d",
|
|
"size": 10,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef2d",
|
|
"size": 10,
|
|
"mnemonic": "movabs",
|
|
"operands": "r8, 0x7efefefefefefeff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef37",
|
|
"size": 10,
|
|
"mnemonic": "movabs",
|
|
"operands": "r11, 0x8101010101010100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef41",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef44",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9, r8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef47",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rax, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef4b",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r9, rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef4e",
|
|
"size": 3,
|
|
"mnemonic": "not",
|
|
"operands": "rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef51",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rdx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef54",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "rdx, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef57",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001ef41",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ef41",
|
|
"0x14001ef59"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef1e",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef1e",
|
|
"size": 2,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef20",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "dl, byte ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef22",
|
|
"size": 3,
|
|
"mnemonic": "inc",
|
|
"operands": "rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef25",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dl, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef27",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001ef88",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ef88",
|
|
"0x14001ef29"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef41",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef41",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef44",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9, r8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef47",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rax, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef4b",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r9, rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef4e",
|
|
"size": 3,
|
|
"mnemonic": "not",
|
|
"operands": "rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef51",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rdx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef54",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "rdx, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef57",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001ef41",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ef41",
|
|
"0x14001ef59"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef59",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef59",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rax - 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef5d",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dl, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef5f",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001efb2",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001efb2",
|
|
"0x14001ef61"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef88",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef88",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rax + rcx - 1]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef8d",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef29",
|
|
"size": 12,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef29",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef2b",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001ef20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef2d",
|
|
"size": 10,
|
|
"mnemonic": "movabs",
|
|
"operands": "r8, 0x7efefefefefefeff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef37",
|
|
"size": 10,
|
|
"mnemonic": "movabs",
|
|
"operands": "r11, 0x8101010101010100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef41",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef44",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9, r8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef47",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rax, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef4b",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "r9, rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef4e",
|
|
"size": 3,
|
|
"mnemonic": "not",
|
|
"operands": "rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef51",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rdx, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef54",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "rdx, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef57",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001ef41",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ef41",
|
|
"0x14001ef59"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001efb2",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001efb2",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rax + rcx - 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001efb7",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef61",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef61",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dh, dh",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef63",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001efac",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001efac",
|
|
"0x14001ef65"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001efac",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001efac",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rax + rcx - 7]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001efb1",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef65",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef65",
|
|
"size": 4,
|
|
"mnemonic": "shr",
|
|
"operands": "rdx, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef69",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dl, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef6b",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001efa6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001efa6",
|
|
"0x14001ef6d"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001efa6",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001efa6",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rax + rcx - 6]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001efab",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef6d",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef6d",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dh, dh",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef6f",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001efa0",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001efa0",
|
|
"0x14001ef71"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001efa0",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001efa0",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rax + rcx - 5]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001efa5",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef71",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef71",
|
|
"size": 4,
|
|
"mnemonic": "shr",
|
|
"operands": "rdx, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef75",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dl, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef77",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001ef9a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ef9a",
|
|
"0x14001ef79"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef9a",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef9a",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rax + rcx - 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef9f",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef79",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef79",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dh, dh",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef7b",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001ef94",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ef94",
|
|
"0x14001ef7d"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef94",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef94",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rax + rcx - 3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef99",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef7d",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef7d",
|
|
"size": 3,
|
|
"mnemonic": "shr",
|
|
"operands": "edx, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef80",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dl, dl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef82",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001ef8e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001ef8e",
|
|
"0x14001ef84"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef8e",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef8e",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rax + rcx - 2]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef93",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001ef84",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001ef84",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "dh, dh",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef86",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001ef41",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef88",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rax + rcx - 1]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001ef8d",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140002000",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140002000",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140002000",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002005",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x18], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000200a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000200f",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002010",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x70",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140002014",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rcx",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x140002017",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000201a",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rdx, dword ptr [rax + 4]",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000201e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rdx + rcx + 0x48]",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x140002023",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rsi, rsi",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x140002026",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400020cc",
|
|
"stack_offset": -120
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400020cc",
|
|
"0x14000202c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400020cc",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400020cc",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020cf",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r11, [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020d4",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r11 + 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020d8",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [r11 + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020dc",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsp, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020df",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020e0",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 8
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000202c",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000202c",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000202f",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002034",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140001ab0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002039",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rsp + 0x30], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000203e",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000209d",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000209d",
|
|
"0x140002040"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000209d",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000209d",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400023f4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020a2",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020a4",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400020b0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020a6",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rsp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020ab",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140001d10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020b0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rsp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020b5",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rdx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020b8",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020bc",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + rdx + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020c1",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020c4",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400020cc",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400020cc",
|
|
"0x1400020c6"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140002040",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140002040",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edi, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002042",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x20], edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002046",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002049",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000204c",
|
|
"size": 3,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rax + 0x68]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000204f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002052",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002057",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000205a",
|
|
"size": 4,
|
|
"mnemonic": "cmove",
|
|
"operands": "r8d, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000205e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x20], r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002063",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140002079",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140002079"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400020c6",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400020c6",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020c9",
|
|
"size": 3,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rax + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020cc",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020cf",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r11, [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020d4",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r11 + 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020d8",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [r11 + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020dc",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsp, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020df",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020e0",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 8
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140002079",
|
|
"size": 21,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140002079",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000207c",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002080",
|
|
"size": 6,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rcx + rbx + 0x48], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002086",
|
|
"size": 3,
|
|
"mnemonic": "cmovne",
|
|
"operands": "edx, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002089",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "edx, dword ptr [rcx + rbx + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000208d",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "edx, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002090",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "edx, 0x17",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002093",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rcx + rbx + 0x10], edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140002097",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "edx, dword ptr [rcx + rbx + 0x14]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000209b",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400020e1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000209d",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400023f4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020a2",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020a4",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400020b0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020a6",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rsp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020ab",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140001d10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020b0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rsp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020b5",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rdx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020b8",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020bc",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + rdx + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020c1",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400020c4",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400020cc",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400020cc",
|
|
"0x1400020c6"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400023f4",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400023f4",
|
|
"size": 1,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400023f4",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140006f50",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140006f50"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140006f50",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140006f50",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140006f54",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000747c",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140006f59",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140006f5c",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140006f5e",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140006f61",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140006f69",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140006f69",
|
|
"0x140006f63"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140006f69",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140006f69",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140006f6d",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140006f63",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140006f63",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + 0x30], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140006f66",
|
|
"size": 3,
|
|
"mnemonic": "setg",
|
|
"operands": "al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140006f69",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140006f6d",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001d10",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140001d10",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001d10",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d12",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x60",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140001d16",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rcx",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x140001d19",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x140001d1c",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rdx, dword ptr [rax + 4]",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x140001d20",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rdx + rcx + 0x10], 0",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x140001d25",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140001d68",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x140001d27",
|
|
"size": 5,
|
|
"mnemonic": "test",
|
|
"operands": "byte ptr [rdx + rcx + 0x18], 2",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x140001d2c",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140001d68",
|
|
"stack_offset": -104
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001d68",
|
|
"0x140001d2e"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001d68",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001d68",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x60",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d6c",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 96
|
|
},
|
|
{
|
|
"address": "0x140001d6d",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 104
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001d2e",
|
|
"size": 20,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001d2e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rdx + rcx + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d33",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d36",
|
|
"size": 3,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rax + 0x68]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d39",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d3c",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140001d68",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d3e",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d41",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d45",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d4a",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d4c",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rcx + rbx + 0x48], rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d51",
|
|
"size": 3,
|
|
"mnemonic": "cmovne",
|
|
"operands": "eax, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d54",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "eax, dword ptr [rcx + rbx + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d58",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "eax, 0x13",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d5b",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "eax, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d5e",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rcx + rbx + 0x10], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d62",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "eax, dword ptr [rcx + rbx + 0x14]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d66",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140001d6e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d68",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x60",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001d6c",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 96
|
|
},
|
|
{
|
|
"address": "0x140001d6d",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 104
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a73c",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000a73c",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a73c",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a73e",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000a742",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ebx, ebx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a744",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x2861d]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a74b",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a74e",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbx + rbx*4]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a752",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rdx + rcx*8]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a756",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, 0xfa0",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a75b",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000aa38",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a760",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a762",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000a775",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a775",
|
|
"0x14000a764"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a775",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a775",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000a784",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a77a",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "al, al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a77c",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a780",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a781",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a764",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a764",
|
|
"size": 6,
|
|
"mnemonic": "inc",
|
|
"operands": "dword ptr [rip + 0x28626]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a76a",
|
|
"size": 2,
|
|
"mnemonic": "inc",
|
|
"operands": "ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a76c",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebx, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a76f",
|
|
"size": 2,
|
|
"mnemonic": "jb",
|
|
"operands": "0x14000a744",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a744",
|
|
"0x14000a771"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a744",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a744",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x2861d]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a74b",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a74e",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbx + rbx*4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a752",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rdx + rcx*8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a756",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, 0xfa0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a75b",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000aa38",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a760",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a762",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000a775",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a775",
|
|
"0x14000a764"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a771",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a771",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a773",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000a77c",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a77c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a77c",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a77c",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a780",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a781",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b74c",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000b74c",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b74c",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "cl, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b74e",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000b58c",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b58c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b58c",
|
|
"size": 26,
|
|
"is_prolog": true,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b58c",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rsp + 8], cl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b590",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b591",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, rsp",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000b594",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x40",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000b598",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "dword ptr [rbp + 0x28], 0",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b59c",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x28]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5a0",
|
|
"size": 4,
|
|
"mnemonic": "and",
|
|
"operands": "dword ptr [rbp + 0x20], 0",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5a4",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rbp - 0x20]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5a8",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x18], rax",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5ac",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [rbp - 0x18]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5b0",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x10]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5b4",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x10], rax",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5b8",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rbp - 0x1c]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5bc",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x20]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5c0",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 8], rax",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5c4",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x18]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5c8",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 8",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5cd",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rbp - 0x20], eax",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5d0",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rbp - 0x1c], eax",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5d3",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000b468",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5d8",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rbp + 0x10], 0",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5dc",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rbp + 0x20]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5df",
|
|
"size": 4,
|
|
"mnemonic": "cmovne",
|
|
"operands": "eax, dword ptr [rbp + 0x28]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5e3",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x40",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000b5e7",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbp",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000b5e8",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140007514",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140007514",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140007514",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007518",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rip + 0x29ba2]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000751e",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ecx, -1",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007521",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140007532",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140007532",
|
|
"0x140007523"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140007532",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140007532",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007534",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007538",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140007523",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140007523",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000a954",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007528",
|
|
"size": 10,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rip + 0x29b8e], 0xffffffff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007532",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007534",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007538",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a784",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000a784",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a784",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a786",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000a78a",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, dword ptr [rip + 0x28600]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a790",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000a7af",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a7af"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a7af",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a7af",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "ebx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a7b1",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000a792",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a7b3",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a7b5",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a7b9",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a7ba",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ca20",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000ca20",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ca20",
|
|
"size": 3,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rax, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ca23",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rax + rax*4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ca27",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rip + 0x263d2]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ca2e",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rax + rcx*8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ca32",
|
|
"size": 7,
|
|
"mnemonic": "jmp",
|
|
"operands": "qword ptr [rip + 0x135d7]",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140020010"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140020010",
|
|
"size": 0,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e96c",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000e96c",
|
|
"size": 15,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e96c",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e96e",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000e972",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rcx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e975",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rip + 0x2483c], 0",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e97c",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ea20",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e982",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 1",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e987",
|
|
"size": 6,
|
|
"mnemonic": "xchg",
|
|
"operands": "dword ptr [rip + 0x2481b], eax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e98d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e990",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rax]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e992",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e994",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e9c9",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e996",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x226a3]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e99d",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rip + 0x2480c]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e9a4",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rdx, rax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14000e9a7",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000e9c0",
|
|
"stack_offset": -56
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000e9c0",
|
|
"0x14000e9a9"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e9c0",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e9c0",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rip + 0x24839]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9c7",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000e9d5",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000e9d5"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e9a9",
|
|
"size": 10,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e9a9",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9ab",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "ecx, 0x3f",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9ae",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rax, rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9b1",
|
|
"size": 3,
|
|
"mnemonic": "ror",
|
|
"operands": "rax, cl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9b4",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9b7",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9b9",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9bb",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001e3a0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9c0",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rip + 0x24839]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9c7",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000e9d5",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000e9d5"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000e9d5",
|
|
"size": 20,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000e9d5",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140010944",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9da",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9db",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9de",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rax], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9e1",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000e9f6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9e3",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x119c6]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9ea",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rip + 0x1199f]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9f1",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000e8c0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9f6",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x119c3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000e9fd",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rip + 0x119b4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea04",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000e8c0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea09",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx + 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea0d",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rax], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea10",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ea20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea12",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rip + 0x2479f], 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea19",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea1d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rax], 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea20",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ea24",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x14000ea25",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ca74",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000ca74",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ca74",
|
|
"size": 3,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rax, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ca77",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rax + rax*4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ca7b",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rip + 0x2637e]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ca82",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rax + rcx*8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ca86",
|
|
"size": 7,
|
|
"mnemonic": "jmp",
|
|
"operands": "qword ptr [rip + 0x1358b]",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140020018"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140020018",
|
|
"size": 0,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400191a8",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400191a8",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400191a8",
|
|
"size": 9,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr gs:[0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400191b1",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rax + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400191b5",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400191b9",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rax + 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400191bc",
|
|
"size": 3,
|
|
"mnemonic": "shr",
|
|
"operands": "eax, 0x1f",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400191bf",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011db4",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140011db4",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011db4",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011db6",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140011dba",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x2430f]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140011dc1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140011dc4",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, -1",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140011dc8",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011e05",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011e05",
|
|
"0x140011dca"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011e05",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011e05",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 0xc0000225",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011e0a",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011e0e",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x140011e0f",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011dca",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011dca",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011dcd",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011df1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011dcf",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rip + 0x14c02]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011dd6",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [rip + 0x14bf7]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011ddd",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x14bf4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011de4",
|
|
"size": 3,
|
|
"mnemonic": "lea",
|
|
"operands": "ecx, [rax + 0x1a]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011de7",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140011c00",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011dec",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011def",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011e05",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011e05",
|
|
"0x140011df1"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011df1",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011df1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011df4",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, 0xfffffffffffffffa",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011dfb",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011dff",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x140011e00",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14001e3a0",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001e3a0"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001ab0",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140001ab0",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001ab0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001ab5",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001ab6",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140001aba",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rcx], rdx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140001abd",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140001ac0",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rdx]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140001ac3",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rdx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140001ac6",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "r8, dword ptr [rax + 4]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140001aca",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [r8 + rdx + 0x48]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140001acf",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140001ad2",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140001ada",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001ada",
|
|
"0x140001ad4"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001ada",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001ada",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rdi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001add",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001ae1",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + rdi + 0x10], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001ae6",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140001afa",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001afa",
|
|
"0x140001ae8"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001ad4",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001ad4",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001ad7",
|
|
"size": 3,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rax + 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001ada",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rdi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001add",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001ae1",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + rdi + 0x10], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001ae6",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140001afa",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001afa",
|
|
"0x140001ae8"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001afa",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001afa",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx + rdi + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001aff",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b02",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140001b2e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001b2e",
|
|
"0x140001b04"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001ae8",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001ae8",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbx + 8], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001aec",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001aef",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001af4",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001af8",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x140001af9",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001b2e",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001b2e",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbx + 8], 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b32",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b35",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b3a",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b3e",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x140001b3f",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001b04",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001b04",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rcx, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b07",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140001b2e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140001b2e",
|
|
"0x140001b09"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140001b09",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140001b09",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140002000",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b0e",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rdi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b11",
|
|
"size": 4,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rcx, dword ptr [rax + 4]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b15",
|
|
"size": 5,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rcx + rdi + 0x10], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b1a",
|
|
"size": 3,
|
|
"mnemonic": "sete",
|
|
"operands": "al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b1d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbx + 8], al",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b20",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b23",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b28",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140001b2c",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x140001b2d",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000747c",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000747c",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000747c",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007481",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140007482",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140007486",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rip + 0x29c33], -1",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000748d",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140007493",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000748f",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140007491",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400074be",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400074be"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400074be",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400074be",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400074c3",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400074c7",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x1400074c8",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000aa38",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000aa38",
|
|
"size": 16,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000aa38",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa3d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa42",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa43",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000aa47",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "esi, r8d",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa4a",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rip + 0x1a3bf]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa51",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, edx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa53",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [rip + 0x1a3ae]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa5a",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa5d",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x1a3ac]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa64",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 4",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa69",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000a7bc",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa6e",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, ebx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa70",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rdi",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa73",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000aa76",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000aa83",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000aa83",
|
|
"0x14000aa78"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000aa83",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000aa83",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1567f]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa89",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa8e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x38]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa93",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa97",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000aa98",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000aa78",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000aa78",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, esi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa7b",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1583f]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa81",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000aa89",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000aa89"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000aa89",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000aa89",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa8e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x38]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa93",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aa97",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000aa98",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b468",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000b468",
|
|
"size": 17,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b468",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b46d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b472",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b473",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000b474",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r14",
|
|
"stack_offset": -16
|
|
},
|
|
{
|
|
"address": "0x14000b476",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x60",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000b47a",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, r9",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b47d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, r8",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b480",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rdx]",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b482",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca20",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b487",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b488",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rip + 0x27959]",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b48f",
|
|
"size": 7,
|
|
"mnemonic": "movsxd",
|
|
"operands": "rax, dword ptr [rip + 0x2794a]",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b496",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r14, [rbx + rax*8]",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b49a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x38], rbx",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b49f",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, r14",
|
|
"stack_offset": -120
|
|
},
|
|
{
|
|
"address": "0x14000b4a2",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b531",
|
|
"stack_offset": -120
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b531",
|
|
"0x14000b4a8"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b531",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b531",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rdi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b533",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca74",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b538",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x80]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b540",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x60",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b544",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 96
|
|
},
|
|
{
|
|
"address": "0x14000b546",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 104
|
|
},
|
|
{
|
|
"address": "0x14000b547",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rsi",
|
|
"stack_offset": 112
|
|
},
|
|
{
|
|
"address": "0x14000b548",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 120
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b4a8",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b4a8",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rbx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4ab",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4b0",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4b3",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4b6",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b4da",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b4da",
|
|
"0x14000b4b8"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b4da",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b4da",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rbx, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4de",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000b49a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b49a"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b4b8",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b4b8",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rcx + 0x14]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4bb",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4bc",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4be",
|
|
"size": 3,
|
|
"mnemonic": "shr",
|
|
"operands": "eax, 0xd",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4c1",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4c3",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b4da",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b4da",
|
|
"0x14000b4c5"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b49a",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b49a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x38], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b49f",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4a2",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b531",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b531",
|
|
"0x14000b4a8"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b4c5",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b4c5",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4c7",
|
|
"size": 2,
|
|
"mnemonic": "and",
|
|
"operands": "al, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4c9",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "al, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4cb",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000b4d2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4cd",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "cl, 0xc0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4d0",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000b4e0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4d2",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "ecx, 0xb",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4d6",
|
|
"size": 2,
|
|
"mnemonic": "jb",
|
|
"operands": "0x14000b4e0",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b4e0",
|
|
"0x14000b4d8"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b4e0",
|
|
"size": 17,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b4e0",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rsi + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4e4",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rsi + 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4e8",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4eb",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [rsp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4f0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x40], r8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4f5",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x48], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4fa",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x50], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4ff",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x58], rdx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b504",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rsp + 0x20]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b509",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x28], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b50e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x30], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b513",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rsp + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b518",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b51d",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b522",
|
|
"size": 8,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x88]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b52a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000b3cc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b52f",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000b4da",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b49a"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b4d8",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b4d8",
|
|
"size": 2,
|
|
"mnemonic": "inc",
|
|
"operands": "dword ptr [rdx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4da",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rbx, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b4de",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000b49a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b49a"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a954",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000a954",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a954",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a956",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000a95a",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, ecx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a95c",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rip + 0x1a46d]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a963",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 1",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a968",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [rip + 0x1a459]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a96f",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x1a45a]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a976",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000a7bc",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a97b",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a97d",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a980",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000a98e",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a98e",
|
|
"0x14000a982"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a98e",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a98e",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a992",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a993",
|
|
"size": 7,
|
|
"mnemonic": "jmp",
|
|
"operands": "qword ptr [rip + 0x1578e]",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140020128"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a982",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a982",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a986",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbx",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a987",
|
|
"size": 7,
|
|
"mnemonic": "jmp",
|
|
"operands": "qword ptr [rip + 0x15932]",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001e360"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140020128",
|
|
"size": 0,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140010944",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140010944",
|
|
"size": 17,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140010944",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r11, rsp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010947",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [r11 + 8], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001094b",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x38",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001094f",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [r11 - 0x10], 0xfffffffffffffffe",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010957",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [r11 + 8]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14001095b",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [r11 - 0x18], rax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14001095f",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 2",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010964",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x50], eax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010968",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x58], eax",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14001096c",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [r11 + 0x18]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010970",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [r11 - 0x18]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010974",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [r11 + 0x20]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010978",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [r11 + 0x10]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14001097c",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140010630",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010981",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010982",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x38",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010986",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011c00",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140011c00",
|
|
"size": 16,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011c00",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c05",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c0a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c0f",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c10",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r12",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140011c12",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r13",
|
|
"stack_offset": -16
|
|
},
|
|
{
|
|
"address": "0x140011c14",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r14",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140011c16",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r15",
|
|
"stack_offset": -32
|
|
},
|
|
{
|
|
"address": "0x140011c18",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140011c1c",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "rax, 0xffffffffffffffff",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x140011c20",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r12d, ecx",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x140011c23",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r14, r9",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x140011c26",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, r8",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x140011c29",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r15, rdx",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x140011c2c",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, r9",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x140011c2f",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011cf0",
|
|
"stack_offset": -72
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011cf0",
|
|
"0x140011c35"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011cf0",
|
|
"size": 14,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011cf0",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ebx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf2",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, 0xe",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf7",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf9",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cfe",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "dword ptr [rsp + 0x60], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d03",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rsi, [rip + 0x242f6]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d0a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ebp, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d0f",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d14",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, ebp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d16",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8d, [rdi - 0xa]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d1a",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d1d",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe48d]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d23",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d25",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011dac",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011dac",
|
|
"0x140011d2b"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011c35",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011c35",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r13, [rip - 0x11c3c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c3c",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, dword ptr [rsi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c3e",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r13 + rdi*8 + 0x33240]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c46",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c47",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rbx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c4a",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011c5a",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011c5a",
|
|
"0x140011c4c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011dac",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011dac",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000d6d0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011db1",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011d2b",
|
|
"size": 12,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011d2b",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rbx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d2e",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d31",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, 0xffffffffffffffff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d38",
|
|
"size": 4,
|
|
"mnemonic": "cmove",
|
|
"operands": "rax, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d3c",
|
|
"size": 4,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [rsi + r12*8], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d40",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d45",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, ebp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d47",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8d, [rdi - 0xc]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d4b",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d4e",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe45c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d54",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d56",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011dac",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011dac",
|
|
"0x140011d58"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011c5a",
|
|
"size": 18,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011c5a",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [r13 + rdi*8 + 0x262a0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c62",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c64",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c67",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x800",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c6d",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe4cd]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c73",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c76",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c79",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011d7f",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c7f",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe473]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c85",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 0x57",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c88",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011cd3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c8a",
|
|
"size": 3,
|
|
"mnemonic": "lea",
|
|
"operands": "ebx, [rax - 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c8d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c90",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c93",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x13106]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c9a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140011460",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c9f",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011ca1",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011cd3",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011cd3",
|
|
"0x140011ca3"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011c4c",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011c4c",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c4f",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011d98",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011c55",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140011ce3",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011ce3"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011d58",
|
|
"size": 13,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011d58",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d5a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca74",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d5f",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [rsp + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d64",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d67",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d6c",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x68]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d71",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d75",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x140011d77",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 40
|
|
},
|
|
{
|
|
"address": "0x140011d79",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x140011d7b",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 56
|
|
},
|
|
{
|
|
"address": "0x140011d7d",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 64
|
|
},
|
|
{
|
|
"address": "0x140011d7e",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 72
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011cd3",
|
|
"size": 20,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011cd3",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "rax, 0xffffffffffffffff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cd7",
|
|
"size": 8,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [r13 + rdi*8 + 0x33240], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cdf",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "rax, 0xffffffffffffffff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011ce3",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsi, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011ce7",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rsi, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cea",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011c3c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf0",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ebx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf2",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, 0xe",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf7",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf9",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cfe",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "dword ptr [rsp + 0x60], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d03",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rsi, [rip + 0x242f6]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d0a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ebp, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d0f",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d14",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, ebp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d16",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8d, [rdi - 0xa]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d1a",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d1d",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe48d]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d23",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d25",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011dac",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011dac",
|
|
"0x140011d2b"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011ca3",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011ca3",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011ca6",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x14bcb]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cad",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cb0",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140011460",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cb5",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cb7",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011cd3",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011cd3",
|
|
"0x140011cb9"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011ce3",
|
|
"size": 17,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011ce3",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsi, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011ce7",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rsi, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cea",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011c3c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf0",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ebx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf2",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, 0xe",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf7",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf9",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cfe",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "dword ptr [rsp + 0x60], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d03",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rsi, [rip + 0x242f6]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d0a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ebp, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d0f",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d14",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, ebp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d16",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8d, [rdi - 0xa]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d1a",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d1d",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe48d]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d23",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d25",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011dac",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011dac",
|
|
"0x140011d2b"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011cb9",
|
|
"size": 27,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011cb9",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cbc",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cbe",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cc1",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe479]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cc7",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cca",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011ccd",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011d7f",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cd3",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "rax, 0xffffffffffffffff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cd7",
|
|
"size": 8,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [r13 + rdi*8 + 0x33240], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cdf",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "rax, 0xffffffffffffffff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011ce3",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsi, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011ce7",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rsi, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cea",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011c3c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf0",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ebx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf2",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, 0xe",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf7",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cf9",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011cfe",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "dword ptr [rsp + 0x60], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d03",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rsi, [rip + 0x242f6]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d0a",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ebp, 0x100",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d0f",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d14",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, ebp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d16",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8d, [rdi - 0xa]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d1a",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d1d",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe48d]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d23",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011d25",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011dac",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011dac",
|
|
"0x140011d2b"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a7bc",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000a7bc",
|
|
"size": 19,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a7bc",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a7c1",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a7c6",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x18], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a7cb",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a7cc",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r12",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000a7ce",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r13",
|
|
"stack_offset": -16
|
|
},
|
|
{
|
|
"address": "0x14000a7d0",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r14",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000a7d2",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r15",
|
|
"stack_offset": -32
|
|
},
|
|
{
|
|
"address": "0x14000a7d4",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000a7d8",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, ecx",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000a7da",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r15, [rip - 0xa7e1]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000a7e1",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "r14, 0xffffffffffffffff",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000a7e5",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r12, r9",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000a7e8",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, r8",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000a7eb",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r13, rdx",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000a7ee",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [r15 + rdi*8 + 0x32db0]",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000a7f6",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000a7f7",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, r14",
|
|
"stack_offset": -72
|
|
},
|
|
{
|
|
"address": "0x14000a7fa",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000a8ae",
|
|
"stack_offset": -72
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a8ae",
|
|
"0x14000a800"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a8ae",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a8ae",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b5",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [rsp + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8ba",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8bf",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8c3",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a8c5",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 40
|
|
},
|
|
{
|
|
"address": "0x14000a8c7",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x14000a8c9",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 56
|
|
},
|
|
{
|
|
"address": "0x14000a8cb",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 64
|
|
},
|
|
{
|
|
"address": "0x14000a8cc",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 72
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a800",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a800",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a803",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000a8b0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a809",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "r8, r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a80c",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000a8a6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a8a6",
|
|
"0x14000a812"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a8a6",
|
|
"size": 12,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a8a6",
|
|
"size": 8,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [r15 + rdi*8 + 0x32db0], r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8ae",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b5",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [rsp + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8ba",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8bf",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8c3",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a8c5",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 40
|
|
},
|
|
{
|
|
"address": "0x14000a8c7",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x14000a8c9",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 56
|
|
},
|
|
{
|
|
"address": "0x14000a8cb",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 64
|
|
},
|
|
{
|
|
"address": "0x14000a8cc",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 72
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a812",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a812",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "esi, dword ptr [rbp]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a815",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r15 + rsi*8 + 0x32d98]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a81d",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a81e",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rbx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a821",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000a82e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a82e",
|
|
"0x14000a823"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a82e",
|
|
"size": 17,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a82e",
|
|
"size": 8,
|
|
"mnemonic": "mov",
|
|
"operands": "r15, qword ptr [r15 + rsi*8 + 0x24cf0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a836",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a838",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, r15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a83b",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x800",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a841",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x158f9]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a847",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a84a",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a84d",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000a8cd",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a84f",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x158a3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a855",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, 0x57",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a858",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000a887",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a85a",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8d, [rbx + 7]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a85e",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, r15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a861",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rip + 0x1a538]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a868",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140011460",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a86d",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a86f",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000a887",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a887",
|
|
"0x14000a871"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a823",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a823",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbx, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a826",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000a8ed",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a82c",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000a899",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000a899"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a887",
|
|
"size": 18,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a887",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a88a",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r15, [rip - 0xa891]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a891",
|
|
"size": 8,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [r15 + rsi*8 + 0x32d98], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a899",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rbp, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a89d",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbp, r12",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8a0",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000a812",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8a6",
|
|
"size": 8,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [r15 + rdi*8 + 0x32db0], r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8ae",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b5",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [rsp + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8ba",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8bf",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8c3",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a8c5",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 40
|
|
},
|
|
{
|
|
"address": "0x14000a8c7",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x14000a8c9",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 56
|
|
},
|
|
{
|
|
"address": "0x14000a8cb",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 64
|
|
},
|
|
{
|
|
"address": "0x14000a8cc",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 72
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a871",
|
|
"size": 25,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a871",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a874",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a876",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, r15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a879",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x158c1]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a87f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a882",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a885",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000a8cd",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a887",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a88a",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "r15, [rip - 0xa891]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a891",
|
|
"size": 8,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [r15 + rsi*8 + 0x32d98], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a899",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rbp, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a89d",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbp, r12",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8a0",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000a812",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8a6",
|
|
"size": 8,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [r15 + rdi*8 + 0x32db0], r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8ae",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b5",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [rsp + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8ba",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8bf",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8c3",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a8c5",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 40
|
|
},
|
|
{
|
|
"address": "0x14000a8c7",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x14000a8c9",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 56
|
|
},
|
|
{
|
|
"address": "0x14000a8cb",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 64
|
|
},
|
|
{
|
|
"address": "0x14000a8cc",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 72
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000a899",
|
|
"size": 15,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000a899",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rbp, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a89d",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rbp, r12",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8a0",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000a812",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8a6",
|
|
"size": 8,
|
|
"mnemonic": "xchg",
|
|
"operands": "qword ptr [r15 + rdi*8 + 0x32db0], r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8ae",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8b5",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [rsp + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8ba",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x60]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8bf",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000a8c3",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000a8c5",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 40
|
|
},
|
|
{
|
|
"address": "0x14000a8c7",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x14000a8c9",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 56
|
|
},
|
|
{
|
|
"address": "0x14000a8cb",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 64
|
|
},
|
|
{
|
|
"address": "0x14000a8cc",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 72
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b3cc",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000b3cc",
|
|
"size": 14,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b3cc",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b3d1",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b3d6",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b3d7",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000b3db",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, r9",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000b3de",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, r8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000b3e1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rdx]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000b3e4",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000b1f8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000b3e9",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000b3ea",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rbx + 8]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000b3ee",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000b3f1",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rax]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000b3f4",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rcx, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000b3f7",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b455",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b455",
|
|
"0x14000b3f9"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b455",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b455",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rdi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b458",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000b204",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b45d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b462",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b466",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000b467",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b3f9",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b3f9",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rcx + 0x14]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b3fc",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b3fd",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b3ff",
|
|
"size": 3,
|
|
"mnemonic": "shr",
|
|
"operands": "eax, 0xd",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b402",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b404",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b455",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b455",
|
|
"0x14000b406"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b406",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b406",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b408",
|
|
"size": 2,
|
|
"mnemonic": "and",
|
|
"operands": "al, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b40a",
|
|
"size": 2,
|
|
"mnemonic": "cmp",
|
|
"operands": "al, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b40c",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000b413",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b40e",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "cl, 0xc0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b411",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000b41d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b413",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "ecx, 0xb",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b417",
|
|
"size": 2,
|
|
"mnemonic": "jb",
|
|
"operands": "0x14000b41d",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b41d",
|
|
"0x14000b419"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b41d",
|
|
"size": 10,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b41d",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b421",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rax], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b424",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000b436",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b426",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b429",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b42c",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rcx + 0x14]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b42f",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b430",
|
|
"size": 2,
|
|
"mnemonic": "shr",
|
|
"operands": "eax, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b432",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "al, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b434",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b455",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b455",
|
|
"0x14000b436"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b419",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b419",
|
|
"size": 2,
|
|
"mnemonic": "inc",
|
|
"operands": "dword ptr [rdx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b41b",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000b455",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b455"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b436",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b436",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rbx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b439",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rcx]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b43c",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000b678",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b441",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "eax, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b444",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b44e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b44e",
|
|
"0x14000b446"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b44e",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b44e",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx + 0x18]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b452",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "dword ptr [rax], 0xffffffff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b455",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rdi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b458",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000b204",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b45d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b462",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b466",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000b467",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b446",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b446",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbx + 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b44a",
|
|
"size": 2,
|
|
"mnemonic": "inc",
|
|
"operands": "dword ptr [rax]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b44c",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000b455",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b455"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140010630",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140010630",
|
|
"size": 19,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140010630",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010635",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001063a",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001063b",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14001063f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, r9",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010642",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, r8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010645",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rdx]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010647",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca20",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001064c",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001064d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, rdi",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010650",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001081c",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010655",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010657",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rbx]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010659",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca74",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001065e",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, edi",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010660",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010665",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140010669",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14001066a",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000d6d0",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000d6d0",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000d6d0",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d6d4",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001667c",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000d6d9",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000d6dc",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000d6e8",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000d6e8",
|
|
"0x14000d6de"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000d6e8",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000d6e8",
|
|
"size": 7,
|
|
"mnemonic": "test",
|
|
"operands": "byte ptr [rip + 0x23af9], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d6ef",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000d71b",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000d71b",
|
|
"0x14000d6f1"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000d6de",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000d6de",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 0x16",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d6e3",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400166cc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d6e8",
|
|
"size": 7,
|
|
"mnemonic": "test",
|
|
"operands": "byte ptr [rip + 0x23af9], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d6ef",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000d71b",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000d71b",
|
|
"0x14000d6f1"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000d71b",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000d71b",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d720",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebcc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d725",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000d6f1",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000d6f1",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 0x17",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d6f6",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x12994]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d6fc",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d6fe",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000d707",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000d707",
|
|
"0x14000d700"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000d707",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000d707",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d70d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, 0x40000015",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d712",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "ecx, [r8 + 2]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d716",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ace8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d71b",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d720",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebcc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d725",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000d700",
|
|
"size": 9,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000d700",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d705",
|
|
"size": 2,
|
|
"mnemonic": "int",
|
|
"operands": "0x29",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d707",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d70d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, 0x40000015",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d712",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "ecx, [r8 + 2]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d716",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ace8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d71b",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d720",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebcc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000d725",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011460",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140011460",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011460",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "r8, r8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011463",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011468",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011465",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011467",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b1f8",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000b1f8",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b1f8",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b1fc",
|
|
"size": 7,
|
|
"mnemonic": "jmp",
|
|
"operands": "qword ptr [rip + 0x14e0d]",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140020010"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b204",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000b204",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b204",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b208",
|
|
"size": 7,
|
|
"mnemonic": "jmp",
|
|
"operands": "qword ptr [rip + 0x14e09]",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140020018"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b678",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000b678",
|
|
"size": 22,
|
|
"is_prolog": true,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b678",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b67d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b682",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b683",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, rsp",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000b686",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x60",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000b68a",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rbp - 0x40], 0",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b68f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rcx",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b692",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "dword ptr [rip + 0x27b57], 0",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b699",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbp - 0x30], 0",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b69d",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbp - 0x18], 0",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6a1",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbp - 0x10], 0",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6a5",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbp - 8], 0",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6a9",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000b6bb",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6ab",
|
|
"size": 7,
|
|
"mnemonic": "movups",
|
|
"operands": "xmm0, xmmword ptr [rip + 0x25d76]",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6b2",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rbp - 0x18], 1",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6b6",
|
|
"size": 5,
|
|
"mnemonic": "movdqu",
|
|
"operands": "xmmword ptr [rbp - 0x28], xmm0",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6bb",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rbx, rbx",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6be",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000b6cb",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6c0",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6c2",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000b58c",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6c7",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, eax",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x14000b6c9",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000b6fd",
|
|
"stack_offset": -104
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b6fd"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b6fd",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b6fd",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rbp - 0x18], 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b701",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000b70e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b703",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp - 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b707",
|
|
"size": 7,
|
|
"mnemonic": "and",
|
|
"operands": "dword ptr [rax + 0x3a8], 0xfffffffd",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b70e",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rbp - 0x10], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b712",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b723",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b723",
|
|
"0x14000b714"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b723",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b723",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rbp - 8], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b727",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b738",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b738",
|
|
"0x14000b729"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b714",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b714",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, dword ptr [rbp - 0x14]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b717",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b71b",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000abc8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b720",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rax + 0x20], ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b723",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rbp - 8], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b727",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000b738",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000b738",
|
|
"0x14000b729"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b738",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b738",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b73d",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b73f",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, qword ptr [rsp + 0x78]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b744",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x60",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b748",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbp",
|
|
"stack_offset": 96
|
|
},
|
|
{
|
|
"address": "0x14000b749",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 104
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000b729",
|
|
"size": 10,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000b729",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, dword ptr [rbp - 0xc]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b72c",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp - 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b730",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000abc8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b735",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rax + 0x24], ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b738",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b73d",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b73f",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, qword ptr [rsp + 0x78]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b744",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x60",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000b748",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbp",
|
|
"stack_offset": 96
|
|
},
|
|
{
|
|
"address": "0x14000b749",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 104
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001081c",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14001081c",
|
|
"size": 14,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001081c",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010821",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010826",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x18], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001082b",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001082c",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r14",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14001082e",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r15",
|
|
"stack_offset": -16
|
|
},
|
|
{
|
|
"address": "0x140010830",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x140010834",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rcx]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010837",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, rcx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14001083a",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rax]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14001083d",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rdx, rdx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010840",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001084a",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010842",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "eax, 0xffffffff",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140010845",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140010918",
|
|
"stack_offset": -56
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140010918"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140010918",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140010918",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001091d",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbp, qword ptr [rsp + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010922",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140010927",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001092b",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14001092d",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 40
|
|
},
|
|
{
|
|
"address": "0x14001092f",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x140010930",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001667c",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14001667c",
|
|
"size": 12,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001667c",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r11, rsp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001667f",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016683",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, 3",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016688",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r9, [r11 + 0x10]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001668c",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "r8, [r11 + 8]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016690",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x38], eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016694",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [r11 + 0x18]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016698",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x40], eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001669c",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [r11 + 8]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400166a0",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140016634",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400166a5",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400166a9",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400166cc",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400166cc",
|
|
"size": 16,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400166cc",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x18], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400166d1",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400166d6",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400166d7",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r12",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x1400166d9",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r13",
|
|
"stack_offset": -16
|
|
},
|
|
{
|
|
"address": "0x1400166db",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r14",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x1400166dd",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r15",
|
|
"stack_offset": -32
|
|
},
|
|
{
|
|
"address": "0x1400166df",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x40",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400166e3",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, ecx",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x1400166e5",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r15d, r15d",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x1400166e8",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "dword ptr [rsp + 0x78], r15d",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x1400166ed",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r14b, 1",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x1400166f0",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rsp + 0x70], r14b",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x1400166f5",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edx, ecx",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x1400166f7",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "edx, 2",
|
|
"stack_offset": -104
|
|
},
|
|
{
|
|
"address": "0x1400166fa",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140016723",
|
|
"stack_offset": -104
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016723",
|
|
"0x1400166fc"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016723",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016723",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "ecx, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016726",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400167e0",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167e0",
|
|
"0x14001672c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400166fc",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400166fc",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "edx, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400166ff",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140016753",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016753",
|
|
"0x140016701"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400167e0",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400167e0",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdi, [rip + 0x1cf31]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167e7",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r13d, r13d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167ea",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "r14b, r14b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167ed",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400167f9",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167f9",
|
|
"0x1400167ef"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001672c",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001672c",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "ecx, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001672f",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400167c5",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167c5",
|
|
"0x140016735"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016753",
|
|
"size": 15,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016753",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140011924",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016758",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r15, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001675b",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001675e",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001677d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016760",
|
|
"size": 3,
|
|
"mnemonic": "or",
|
|
"operands": "eax, 0xffffffff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016763",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r11, [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016768",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r11 + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001676c",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [r11 + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016770",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsp, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016773",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016775",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 8
|
|
},
|
|
{
|
|
"address": "0x140016777",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 16
|
|
},
|
|
{
|
|
"address": "0x140016779",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 24
|
|
},
|
|
{
|
|
"address": "0x14001677b",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14001677c",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016701",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016701",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "edx, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016704",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140016723",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016723",
|
|
"0x140016706"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400167f9",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400167f9",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rdi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167fc",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "r14b, r14b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167ff",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140016813",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016813",
|
|
"0x140016801"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400167ef",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400167ef",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "ecx, [r13 + 3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167f3",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167f8",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167f9",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rdi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167fc",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "r14b, r14b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167ff",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140016813",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016813",
|
|
"0x140016801"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400167c5",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400167c5",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdi, [rip + 0x1cf5c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167cc",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400167e7",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167e7"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016735",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016735",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "ecx, 9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016738",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400167d7",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167d7",
|
|
"0x14001673e"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016706",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016706",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "edx, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016709",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140016753",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016753",
|
|
"0x14001670b"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016813",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016813",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "rsi, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016817",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400168a8",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400168a8",
|
|
"0x14001681d"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016801",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016801",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x1a838]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016808",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001680a",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "ecx, 0x3f",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001680d",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rsi, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016810",
|
|
"size": 3,
|
|
"mnemonic": "ror",
|
|
"operands": "rsi, cl",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016813",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "rsi, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016817",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400168a8",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400168a8",
|
|
"0x14001681d"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400167e7",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400167e7",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r13d, r13d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167ea",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "r14b, r14b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167ed",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400167f9",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167f9",
|
|
"0x1400167ef"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400167d7",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400167d7",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdi, [rip + 0x1cf52]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167de",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400167e7",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167e7"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001673e",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001673e",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "ecx, 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016741",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400167ce",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167ce",
|
|
"0x140016747"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001670b",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001670b",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "edx, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001670e",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140016753",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016753",
|
|
"0x140016710"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400168a8",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400168a8",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r12d, 0x910",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168ae",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "r14b, r14b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168b1",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400168bd",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400168bd",
|
|
"0x1400168b3"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001681d",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001681d",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rsi, rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016820",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001690f",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001690f",
|
|
"0x140016826"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400167ce",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400167ce",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rdi, [rip + 0x1cf4b]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400167d5",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400167e7",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167e7"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016747",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016747",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ecx, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001674a",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400167c5",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167c5",
|
|
"0x14001674c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016710",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016710",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "edx, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016713",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140016723",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016723",
|
|
"0x140016715"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400168bd",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400168bd",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "rsi, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168c1",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400168ca",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168c3",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168c5",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140016763",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016763"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400168b3",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400168b3",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168b8",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca74",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168bd",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "rsi, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168c1",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400168ca",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168c3",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168c5",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140016763",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016763"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001690f",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001690f",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "r14b, r14b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016912",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001691c",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001691c",
|
|
"0x140016914"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016826",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016826",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r12d, 0x910",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001682c",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebx, 0xb",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001682f",
|
|
"size": 2,
|
|
"mnemonic": "ja",
|
|
"operands": "0x140016866",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016866",
|
|
"0x140016831"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001674c",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001674c",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edi, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001674e",
|
|
"size": 5,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400167e7",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167e7"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016715",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016715",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "edx, 6",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016718",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140016723",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016723",
|
|
"0x14001671a"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016763",
|
|
"size": 10,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016763",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "r11, [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016768",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r11 + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001676c",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [r11 + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016770",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsp, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016773",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r15",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016775",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 8
|
|
},
|
|
{
|
|
"address": "0x140016777",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r13",
|
|
"stack_offset": 16
|
|
},
|
|
{
|
|
"address": "0x140016779",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r12",
|
|
"stack_offset": 24
|
|
},
|
|
{
|
|
"address": "0x14001677b",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14001677c",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001691c",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001691c",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016921",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebcc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016926",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016927",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016914",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016914",
|
|
"size": 3,
|
|
"mnemonic": "lea",
|
|
"operands": "ecx, [rsi + 3]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016917",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca74",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001691c",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, 3",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016921",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ebcc",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016926",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016927",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016866",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016866",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebx, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016869",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001689c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001686b",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0xf006]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016872",
|
|
"size": 4,
|
|
"mnemonic": "shl",
|
|
"operands": "rax, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016876",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "rax, qword ptr [r15]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016879",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rip + 0xf000]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016880",
|
|
"size": 4,
|
|
"mnemonic": "shl",
|
|
"operands": "rcx, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016884",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016887",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x28], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001688c",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001688f",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400168ae",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400168ae",
|
|
"0x140016891"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016831",
|
|
"size": 24,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016831",
|
|
"size": 4,
|
|
"mnemonic": "bt",
|
|
"operands": "r12d, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016835",
|
|
"size": 2,
|
|
"mnemonic": "jae",
|
|
"operands": "0x140016866",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016837",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "r13, qword ptr [r15 + 8]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001683b",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x30], r13",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016840",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [r15 + 8], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016845",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebx, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016848",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001689c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001684a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400118c4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001684f",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, dword ptr [rax + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016852",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x78], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016856",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x20], eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001685a",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400118c4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001685f",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rax + 0x10], 0x8c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016866",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebx, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016869",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001689c",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001686b",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0xf006]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016872",
|
|
"size": 4,
|
|
"mnemonic": "shl",
|
|
"operands": "rax, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016876",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "rax, qword ptr [r15]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016879",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rip + 0xf000]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016880",
|
|
"size": 4,
|
|
"mnemonic": "shl",
|
|
"operands": "rcx, 4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016884",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "rcx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016887",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x28], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001688c",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001688f",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400168ae",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400168ae",
|
|
"0x140016891"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001671a",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001671a",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "edx, 1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001671d",
|
|
"size": 6,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400167a5",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016723",
|
|
"size": 3,
|
|
"mnemonic": "sub",
|
|
"operands": "ecx, 2",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016726",
|
|
"size": 6,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400167e0",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400167e0",
|
|
"0x14001672c"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400168ae",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400168ae",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "r14b, r14b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400168b1",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400168bd",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400168bd",
|
|
"0x1400168b3"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016891",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016891",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rax + 8], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016896",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rax, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001689a",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140016887",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140016887"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016887",
|
|
"size": 3,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016887",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x28], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001688c",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001688f",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400168ae",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400168ae",
|
|
"0x140016891"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ace8",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000ace8",
|
|
"size": 15,
|
|
"is_prolog": true,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ace8",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000aced",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x18], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000acf2",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rbp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000acf3",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000acf4",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "r14",
|
|
"stack_offset": -16
|
|
},
|
|
{
|
|
"address": "0x14000acf6",
|
|
"size": 8,
|
|
"mnemonic": "lea",
|
|
"operands": "rbp, [rsp - 0x4f0]",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000acfe",
|
|
"size": 7,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x5f0",
|
|
"stack_offset": -24
|
|
},
|
|
{
|
|
"address": "0x14000ad05",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x26334]",
|
|
"stack_offset": -1544
|
|
},
|
|
{
|
|
"address": "0x14000ad0c",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rax, rsp",
|
|
"stack_offset": -1544
|
|
},
|
|
{
|
|
"address": "0x14000ad0f",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0x4e0], rax",
|
|
"stack_offset": -1544
|
|
},
|
|
{
|
|
"address": "0x14000ad16",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, r8d",
|
|
"stack_offset": -1544
|
|
},
|
|
{
|
|
"address": "0x14000ad19",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "esi, edx",
|
|
"stack_offset": -1544
|
|
},
|
|
{
|
|
"address": "0x14000ad1b",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, ecx",
|
|
"stack_offset": -1544
|
|
},
|
|
{
|
|
"address": "0x14000ad1d",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ecx, -1",
|
|
"stack_offset": -1544
|
|
},
|
|
{
|
|
"address": "0x14000ad20",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000ad27",
|
|
"stack_offset": -1544
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000ad27",
|
|
"0x14000ad22"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ad27",
|
|
"size": 24,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ad27",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad29",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad2e",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x98",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad34",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001ea80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad39",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad3b",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad3f",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x4d0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad45",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001ea80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad4a",
|
|
"size": 6,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rsp + 0x48], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad50",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad55",
|
|
"size": 6,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rsp + 0x40], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad5b",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad5f",
|
|
"size": 6,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rsp + 0x50], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad65",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x58], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad6a",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad6e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x60], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad73",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x152df]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad79",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "r14, qword ptr [rbp + 0x108]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad80",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad85",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad88",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad8b",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x152cf]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad91",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad94",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000adcc",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000adcc",
|
|
"0x14000ad96"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ad22",
|
|
"size": 25,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ad22",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e38",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad27",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad29",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad2e",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x98",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad34",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001ea80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad39",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad3b",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad3f",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "r8d, 0x4d0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad45",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14001ea80",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad4a",
|
|
"size": 6,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rsp + 0x48], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad50",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rsp + 0x70]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad55",
|
|
"size": 6,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rsp + 0x40], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad5b",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad5f",
|
|
"size": 6,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rsp + 0x50], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad65",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x58], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad6a",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad6e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x60], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad73",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x152df]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad79",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "r14, qword ptr [rbp + 0x108]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad80",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rdx, [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad85",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad88",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "r8d, r8d",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad8b",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x152cf]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad91",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad94",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000adcc",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000adcc",
|
|
"0x14000ad96"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000adcc",
|
|
"size": 21,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000adcc",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp + 0x508]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000add3",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0x108], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adda",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x508]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ade1",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rax, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ade5",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x70], esi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ade9",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0xa8], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adf0",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp + 0x508]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adf7",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x80], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adfb",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x74], edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adff",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x152bb]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae05",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae07",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae09",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x15269]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae0f",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae14",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x15256]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae1a",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae1c",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ae2e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae1e",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "edi, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae20",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ae2e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae22",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebx, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae25",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000ae2e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000ae2e",
|
|
"0x14000ae27"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ad96",
|
|
"size": 33,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ad96",
|
|
"size": 6,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rsp + 0x38], 0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ad9c",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x48]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ada1",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rdx, qword ptr [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ada6",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r9, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ada9",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x30], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adae",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "r8, r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adb1",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x50]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adb6",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x28], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adbb",
|
|
"size": 4,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rbp + 0x10]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adbf",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], rcx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adc4",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adc6",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x1529c]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adcc",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp + 0x508]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000add3",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0x108], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adda",
|
|
"size": 7,
|
|
"mnemonic": "lea",
|
|
"operands": "rax, [rbp + 0x508]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ade1",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rax, 8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ade5",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x70], esi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ade9",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp + 0xa8], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adf0",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rbp + 0x508]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adf7",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rbp - 0x80], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adfb",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x74], edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000adff",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x152bb]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae05",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ecx, ecx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae07",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae09",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x15269]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae0f",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x58]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae14",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x15256]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae1a",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae1c",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ae2e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae1e",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "edi, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae20",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ae2e",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae22",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ebx, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae25",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000ae2e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000ae2e",
|
|
"0x14000ae27"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ae2e",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ae2e",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rbp + 0x4e0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae35",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rcx, rsp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae38",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005210",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae3d",
|
|
"size": 8,
|
|
"mnemonic": "lea",
|
|
"operands": "r11, [rsp + 0x5f0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae45",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r11 + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae49",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [r11 + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae4d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsp, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae50",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae52",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 8
|
|
},
|
|
{
|
|
"address": "0x14000ae53",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbp",
|
|
"stack_offset": 16
|
|
},
|
|
{
|
|
"address": "0x14000ae54",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 24
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ae27",
|
|
"size": 13,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ae27",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae29",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005e38",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae2e",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rcx, qword ptr [rbp + 0x4e0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae35",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rcx, rsp",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae38",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140005210",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae3d",
|
|
"size": 8,
|
|
"mnemonic": "lea",
|
|
"operands": "r11, [rsp + 0x5f0]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae45",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [r11 + 0x28]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae49",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [r11 + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae4d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rsp, r11",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae50",
|
|
"size": 2,
|
|
"mnemonic": "pop",
|
|
"operands": "r14",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ae52",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 8
|
|
},
|
|
{
|
|
"address": "0x14000ae53",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rbp",
|
|
"stack_offset": 16
|
|
},
|
|
{
|
|
"address": "0x14000ae54",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 24
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000abc8",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x14000abc8",
|
|
"size": 14,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000abc8",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000abcd",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000abce",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14000abd2",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "qword ptr [rcx], 0",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abd6",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rcx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abd9",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000ac1b",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abdb",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x15517]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abe1",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rdi + 0x10], 0",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abe5",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "dword ptr [rsp + 0x30], eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abe9",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14000abf8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abeb",
|
|
"size": 5,
|
|
"mnemonic": "and",
|
|
"operands": "qword ptr [rdi + 8], 0",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abf0",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edx, edx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abf2",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "byte ptr [rdi + 0x10], 1",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14000abf6",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14000abfc",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000abfc"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000abfc",
|
|
"size": 8,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000abfc",
|
|
"size": 5,
|
|
"mnemonic": "lea",
|
|
"operands": "rcx, [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac01",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400119b4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac06",
|
|
"size": 4,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac0a",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac0d",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rdi], rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac10",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0x154ea]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac16",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rbx, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac19",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14000ac29",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14000ac29",
|
|
"0x14000ac1b"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ac29",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ac29",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000d6d0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac2e",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14000ac1b",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14000ac1b",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rdi]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac1e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x38]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac23",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000ac27",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x14000ac28",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140016634",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140016634",
|
|
"size": 21,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140016634",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140016639",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], r9",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001663e",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001663f",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x140016643",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, r9",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016646",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rdx]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016648",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca20",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001664d",
|
|
"size": 1,
|
|
"mnemonic": "nop",
|
|
"operands": "",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001664e",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, qword ptr [rip + 0x1a9eb]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016655",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016657",
|
|
"size": 3,
|
|
"mnemonic": "and",
|
|
"operands": "ecx, 0x3f",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001665a",
|
|
"size": 7,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rip + 0x1d0c7]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016661",
|
|
"size": 3,
|
|
"mnemonic": "xor",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016664",
|
|
"size": 3,
|
|
"mnemonic": "ror",
|
|
"operands": "rbx, cl",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016667",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rdi]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016669",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000ca74",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001666e",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016671",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x140016676",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x14001667a",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14001667b",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011924",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140011924",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011924",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011926",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x14001192a",
|
|
"size": 9,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], 0xfffffffffffffffe",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140011933",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x40], rbx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140011938",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "edi, edi",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x14001193a",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "byte ptr [rip + 0x218ef], dil",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x140011941",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001196d",
|
|
"stack_offset": -56
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001196d",
|
|
"0x140011943"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001196d",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001196d",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe785]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011973",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ebx, eax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011975",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rip + 0x1f945]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001197b",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ecx, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001197e",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011985",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011980",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011983",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x14001198b",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001198b"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011943",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011943",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rip + 0x1f977]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011949",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ecx, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001194c",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011952",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001194e",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, edi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011950",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140011958",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011958"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001198b",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001198b",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001198f",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x14001199e",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x14001199e",
|
|
"0x140011991"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011958",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011958",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001195c",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400119a6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400119a6",
|
|
"0x14001195e"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001199e",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001199e",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119a0",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe75a]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119a6",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119a9",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119ae",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119b2",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x1400119b3",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011991",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011991",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011994",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x14001199b",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011996",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400117a4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001199b",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001199e",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, ebx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119a0",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe75a]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119a6",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119a9",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119ae",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119b2",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x1400119b3",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400119a6",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400119a6",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119a9",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119ae",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119b2",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x1400119b3",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x14001195e",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x14001195e",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011961",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140011968",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011963",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400117a4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011968",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001196b",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400119a6",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400119a6"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400118c4",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400118c4",
|
|
"size": 4,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400118c4",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400118c8",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140011924",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400118cd",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400118d0",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x1400118d7",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400118d7",
|
|
"0x1400118d2"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400118d7",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400118d7",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x14000d6d0",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400118dc",
|
|
"size": 1,
|
|
"mnemonic": "int3",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400118d2",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400118d2",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x28",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400118d6",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140005210",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140005210",
|
|
"size": 6,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140005210",
|
|
"size": 7,
|
|
"mnemonic": "cmp",
|
|
"operands": "rcx, qword ptr [rip + 0x2be29]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005217",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005229",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005219",
|
|
"size": 4,
|
|
"mnemonic": "rol",
|
|
"operands": "rcx, 0x10",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14000521d",
|
|
"size": 5,
|
|
"mnemonic": "test",
|
|
"operands": "cx, 0xffff",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005222",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x140005225",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140005224",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400119b4",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400119b4",
|
|
"size": 11,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400119b4",
|
|
"size": 2,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119b6",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x1400119ba",
|
|
"size": 9,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x20], 0xfffffffffffffffe",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x1400119c3",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x40], rbx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x1400119c8",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rdi, rdx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x1400119cb",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "ebx, ebx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x1400119cd",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rip + 0x1f8ed]",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x1400119d3",
|
|
"size": 3,
|
|
"mnemonic": "cmp",
|
|
"operands": "ecx, -1",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x1400119d6",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400119dc",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x1400119d8",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "eax, ebx",
|
|
"stack_offset": -56
|
|
},
|
|
{
|
|
"address": "0x1400119da",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x1400119e2",
|
|
"stack_offset": -56
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400119e2"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400119e2",
|
|
"size": 2,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400119e2",
|
|
"size": 4,
|
|
"mnemonic": "cmp",
|
|
"operands": "rax, -1",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119e6",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011a01",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011a01",
|
|
"0x1400119e8"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011a01",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011a01",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011a04",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011a09",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011a0d",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x140011a0e",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400119e8",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400119e8",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119eb",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400119f7",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119ed",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x1400117a4",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119f2",
|
|
"size": 3,
|
|
"mnemonic": "test",
|
|
"operands": "rax, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119f5",
|
|
"size": 2,
|
|
"mnemonic": "je",
|
|
"operands": "0x140011a01",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011a01",
|
|
"0x1400119f7"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400119f7",
|
|
"size": 7,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400119f7",
|
|
"size": 7,
|
|
"mnemonic": "imul",
|
|
"operands": "rbx, rdi, 0x3c8",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400119fe",
|
|
"size": 3,
|
|
"mnemonic": "add",
|
|
"operands": "rbx, rax",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011a01",
|
|
"size": 3,
|
|
"mnemonic": "mov",
|
|
"operands": "rax, rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011a04",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x40]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011a09",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x30",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011a0d",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 48
|
|
},
|
|
{
|
|
"address": "0x140011a0e",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 56
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400117a4",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x1400117a4",
|
|
"size": 16,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x1400117a4",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 8], rbx",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400117a9",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "qword ptr [rsp + 0x10], rsi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400117ae",
|
|
"size": 1,
|
|
"mnemonic": "push",
|
|
"operands": "rdi",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x1400117af",
|
|
"size": 4,
|
|
"mnemonic": "sub",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": -8
|
|
},
|
|
{
|
|
"address": "0x1400117b3",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe93f]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117b9",
|
|
"size": 6,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, dword ptr [rip + 0x1fb01]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117bf",
|
|
"size": 4,
|
|
"mnemonic": "or",
|
|
"operands": "rdx, 0xffffffffffffffff",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117c3",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "edi, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117c5",
|
|
"size": 5,
|
|
"mnemonic": "call",
|
|
"operands": "0x140011fe8",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117ca",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "esi, esi",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117cc",
|
|
"size": 2,
|
|
"mnemonic": "test",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117ce",
|
|
"size": 2,
|
|
"mnemonic": "jne",
|
|
"operands": "0x1400117dc",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117d0",
|
|
"size": 2,
|
|
"mnemonic": "mov",
|
|
"operands": "ecx, edi",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117d2",
|
|
"size": 6,
|
|
"mnemonic": "call",
|
|
"operands": "qword ptr [rip + 0xe928]",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117d8",
|
|
"size": 2,
|
|
"mnemonic": "xor",
|
|
"operands": "eax, eax",
|
|
"stack_offset": -40
|
|
},
|
|
{
|
|
"address": "0x1400117da",
|
|
"size": 2,
|
|
"mnemonic": "jmp",
|
|
"operands": "0x140011849",
|
|
"stack_offset": -40
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x140011849"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011849",
|
|
"size": 5,
|
|
"is_prolog": false,
|
|
"is_epilog": true,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011849",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rbx, qword ptr [rsp + 0x30]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x14001184e",
|
|
"size": 5,
|
|
"mnemonic": "mov",
|
|
"operands": "rsi, qword ptr [rsp + 0x38]",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011853",
|
|
"size": 4,
|
|
"mnemonic": "add",
|
|
"operands": "rsp, 0x20",
|
|
"stack_offset": 0
|
|
},
|
|
{
|
|
"address": "0x140011857",
|
|
"size": 1,
|
|
"mnemonic": "pop",
|
|
"operands": "rdi",
|
|
"stack_offset": 32
|
|
},
|
|
{
|
|
"address": "0x140011858",
|
|
"size": 1,
|
|
"mnemonic": "ret",
|
|
"operands": "",
|
|
"stack_offset": 40
|
|
}
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"address": "0x140011fe8",
|
|
"name": "",
|
|
"blocks": [
|
|
{
|
|
"address": "0x140011fe8",
|
|
"size": 1,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
{
|
|
"address": "0x140011fe8",
|
|
"size": 7,
|
|
"mnemonic": "jmp",
|
|
"operands": "qword ptr [rip + 0xe1b1]",
|
|
"stack_offset": 0
|
|
}
|
|
],
|
|
"successors": [
|
|
"0x1400201a0"
|
|
]
|
|
},
|
|
{
|
|
"address": "0x1400201a0",
|
|
"size": 0,
|
|
"is_prolog": false,
|
|
"is_epilog": false,
|
|
"instructions": [
|
|
],
|
|
"successors": [
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"xrefs": [
|
|
{
|
|
"target": "0x10",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001392",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400020c9",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x18",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000125b",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400012f2",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x48",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001292",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x68",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000204c",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140001d36",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1f1a",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001e3a0",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe1b1",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011fe8",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe45c",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011d4e",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe473",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011c7f",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe479",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011cc1",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe48d",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011d1d",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011d1d",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011d1d",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011d1d",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe4cd",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011c6d",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe75a",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400119a0",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400119a0",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe785",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001196d",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe928",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400117d2",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0xe93f",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400117b3",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1155b",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb27",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1155e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb1c",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x11593",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb97",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x115b7",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb7b",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x115fd",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb65",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x11624",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb36",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000eb36",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x11677",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ea53",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x12994",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000d6f6",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1358b",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ca86",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x135d7",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ca32",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14e09",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b208",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14e0d",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b1fc",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x15256",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ae14",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ae14",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x15269",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ae09",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ae09",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1529c",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000adc6",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x152bb",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000adff",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000adff",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x152cf",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ad8b",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ad8b",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x152df",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ad73",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ad73",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x154ea",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ac10",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x15517",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000abdb",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1567f",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000aa83",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1578e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a993",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1583f",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000aa7b",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x158a3",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a84f",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x158c1",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a879",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x158f9",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a841",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x15932",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a987",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a103",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005f67",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005f67",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a116",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005f5c",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005f5c",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a12c",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005f9e",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a177",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005eeb",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a17b",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005f3f",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005f3f",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a1b3",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005ea7",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005ea7",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a1c5",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005e8d",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005e8d",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a22a",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005e60",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a309",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005d89",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a321",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005d79",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a335",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005d6d",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1a34b",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005d5f",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1aeb8",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005402",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001150",
|
|
"callers": [
|
|
{
|
|
"address": "0x140002252",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400011a6",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400011a1",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400011c1",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400011b9",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400011f7",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400011da",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x1400011da",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x1400011df",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001255",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000122f",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000125e",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001253",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000127d",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000120a",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000120a",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400012a7",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001298",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400012ec",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400012c6",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400012f5",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400012ea",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001316",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400012a5",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000126e",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x140001305",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001395",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000138d",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001ab0",
|
|
"callers": [
|
|
{
|
|
"address": "0x140002034",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001ada",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001ad2",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001afa",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001ae6",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140001ae6",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001b2e",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001b02",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140001b07",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001d10",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001379",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400020ab",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400020ab",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140001d68",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001d2c",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140002000",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400011e1",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140001b09",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140002079",
|
|
"callers": [
|
|
{
|
|
"address": "0x140002063",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000209d",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000203e",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400020cc",
|
|
"callers": [
|
|
{
|
|
"address": "0x140002026",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x1400020c4",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x1400020c4",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140002240",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005447",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005447",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400023f4",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000136d",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000209d",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000209d",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005210",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ae38",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ae38",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005340",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400054c9",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x1400054c9",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x1400054c9",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x1400054c9",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400053ae",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400053a2",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400053d5",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400053cb",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005408",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400053e8",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x1400053f4",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000542a",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005414",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140005420",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140005414",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005487",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400053a9",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000546c",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005497",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000535b",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400054a2",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005379",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400054ac",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005455",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140005455",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400054d0",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005369",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400054f1",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400054ea",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400054fe",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400054db",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000550c",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005354",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005541",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000552b",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400055d4",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400053ed",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005419",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005627",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005646",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005642",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005636",
|
|
"type": "jb"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005648",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000562e",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000562e",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000564a",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005640",
|
|
"type": "jb"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005667",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005651",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x140005651",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000566c",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400053d7",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000568a",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000567d",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005690",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005465",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400056a5",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000569f",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400057f0",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000551b",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000587a",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005850",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140005857",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000585e",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000588e",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005868",
|
|
"type": "ja"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005895",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000588c",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000588c",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400058d6",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400058c7",
|
|
"type": "jl"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400058e6",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400058a4",
|
|
"type": "jl"
|
|
},
|
|
{
|
|
"address": "0x1400058dd",
|
|
"type": "jl"
|
|
},
|
|
{
|
|
"address": "0x1400058dd",
|
|
"type": "jl"
|
|
},
|
|
{
|
|
"address": "0x1400058a4",
|
|
"type": "jl"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400059e8",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005984",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140005984",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400059ef",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400059e6",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005d30",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400054c0",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400054c0",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400054c0",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400054c0",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005e28",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400053dc",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005e30",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005408",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005408",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005e38",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005e73",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005e73",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005f79",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ad22",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ae29",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005e44",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000549c",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400054a7",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400054a7",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005e6e",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005e68",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005ef1",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005eb0",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140005eb0",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005f7e",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005f74",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140005f74",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005f98",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000544e",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000544e",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005fe3",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005fa7",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140005fe5",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005fe1",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400060d8",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400054d4",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005674",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140006f50",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400023f4",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140006f69",
|
|
"callers": [
|
|
{
|
|
"address": "0x140006f61",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140007318",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005520",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000733b",
|
|
"callers": [
|
|
{
|
|
"address": "0x140007327",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140007340",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400056ac",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400056ac",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000747c",
|
|
"callers": [
|
|
{
|
|
"address": "0x140006f54",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400074be",
|
|
"callers": [
|
|
{
|
|
"address": "0x140007491",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140007514",
|
|
"callers": [
|
|
{
|
|
"address": "0x140007348",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140007532",
|
|
"callers": [
|
|
{
|
|
"address": "0x140007521",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a73c",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000731c",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a744",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a76f",
|
|
"type": "jb"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a775",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a762",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000a762",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a77c",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a773",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a784",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000734d",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000a775",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a7af",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a790",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a7bc",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000aa69",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000a976",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a82e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a821",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a887",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a86f",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a899",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a82c",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a8a6",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a80c",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a8ae",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a7fa",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a954",
|
|
"callers": [
|
|
{
|
|
"address": "0x140007523",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000a98e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a980",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000aa38",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000a75b",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000a75b",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000aa83",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000aa76",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000aa89",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000aa81",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000abc8",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b71b",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000b730",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000abfc",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000abf6",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ac29",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ac19",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ace8",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000d716",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000d716",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ad27",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ad20",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000adcc",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ad94",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000ad94",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ae2e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ae25",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000ae25",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b1f8",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b3e4",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b204",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b458",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000b458",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b3cc",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b52a",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b41d",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b417",
|
|
"type": "jb"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b44e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b444",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b455",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b3f7",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000b404",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000b434",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000b41b",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000b44c",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b468",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b5d3",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b49a",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b4de",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000b4de",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b4da",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b4b6",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000b4c3",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000b52f",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b4e0",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b4d6",
|
|
"type": "jb"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b531",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b4a2",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000b4a2",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b58c",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b74e",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000b6c2",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b678",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b43c",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b6fd",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b6c9",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b723",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b712",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b738",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000b727",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000b727",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000b74c",
|
|
"callers": [
|
|
{
|
|
"address": "0x140010b4a",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ca20",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e94b",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000b482",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011cf9",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011cf9",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011cf9",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011cf9",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140010647",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400167f3",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140016648",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ca74",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e95c",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000b533",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011d5a",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140010659",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400168b8",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140016917",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140016669",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000d6d0",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011dac",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ac29",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400118d7",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000d6e8",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000d6dc",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000d707",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000d6fe",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000d71b",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000d6ef",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000d6ef",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e868",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000542a",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000542a",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e8aa",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e88f",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e8c0",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400053bc",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000e9f1",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ea04",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e8e2",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e8db",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e8f5",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e8c3",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e8f8",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000539b",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e91e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e913",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e927",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e90b",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e934",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ead2",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ead2",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e96c",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e954",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e9c0",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e9a7",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000e9d5",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e9c7",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000e9c7",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ea2c",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ebc4",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000ebd3",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000ec19",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ea9b",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ea5c",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000ea92",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000eaf6",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eaea",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14000eaea",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000eb07",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eafa",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000eb10",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb09",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000eb2d",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb1a",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000eb40",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ea96",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000eb2f",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000eb2f",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000eb8d",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb84",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000eb92",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb72",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000eb9e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eb95",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000eb95",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14000eb95",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ebbc",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000545c",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ebcc",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400054b6",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400054b6",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400054b6",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000d720",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000d720",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000d720",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140016921",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140016921",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ebd8",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005425",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ec14",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400054ae",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400054ae",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400054ae",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ec88",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000543a",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000543a",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14000ec90",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005432",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005432",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140010630",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001097c",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001081c",
|
|
"callers": [
|
|
{
|
|
"address": "0x140010650",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140010918",
|
|
"callers": [
|
|
{
|
|
"address": "0x140010845",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140010944",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e9d5",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140010b38",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400056a5",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400056a5",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140010b4f",
|
|
"callers": [
|
|
{
|
|
"address": "0x140010b48",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140010b56",
|
|
"callers": [
|
|
{
|
|
"address": "0x140010b3e",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011460",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011c9a",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011cb0",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000a868",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400117a4",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011996",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011963",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400119ed",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011849",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400117da",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400118c4",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001684a",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14001685a",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400118d7",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400118d0",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011924",
|
|
"callers": [
|
|
{
|
|
"address": "0x140016753",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x1400118c8",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011958",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011950",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001196d",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011941",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001198b",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011983",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001199e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001198f",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400119a6",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001195c",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14001196b",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400119b4",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000ac01",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400119e2",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400119da",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011a01",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400119e6",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x1400119f5",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011c00",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011de7",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011c5a",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011c4a",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011cd3",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011ca1",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140011cb7",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011ce3",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011c55",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011cf0",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011c2f",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011dac",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011d25",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140011d56",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140011d25",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140011d25",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140011d25",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011db4",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400191da",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011e05",
|
|
"callers": [
|
|
{
|
|
"address": "0x140011dc8",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140011def",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140011fe8",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400117c5",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140016634",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400166a0",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001667c",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000d6d4",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400166cc",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000d6e3",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140016723",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400166fa",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140016704",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140016713",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140016718",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140016753",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400166ff",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140016709",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14001670e",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140016763",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400168c5",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x1400168c5",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400167c5",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001672f",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14001674a",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400167ce",
|
|
"callers": [
|
|
{
|
|
"address": "0x140016741",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400167d7",
|
|
"callers": [
|
|
{
|
|
"address": "0x140016738",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400167e0",
|
|
"callers": [
|
|
{
|
|
"address": "0x140016726",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140016726",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400167e7",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400167cc",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x1400167de",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x1400167d5",
|
|
"type": "jmp"
|
|
},
|
|
{
|
|
"address": "0x14001674e",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400167f9",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400167ed",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x1400167ed",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140016813",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400167ff",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x1400167ff",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140016866",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001682f",
|
|
"type": "ja"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x140016887",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001689a",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400168a8",
|
|
"callers": [
|
|
{
|
|
"address": "0x140016817",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x140016817",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400168ae",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001688f",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14001688f",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14001688f",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400168bd",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400168b1",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x1400168b1",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001690f",
|
|
"callers": [
|
|
{
|
|
"address": "0x140016820",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001691c",
|
|
"callers": [
|
|
{
|
|
"address": "0x140016912",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400191a8",
|
|
"callers": [
|
|
{
|
|
"address": "0x1400191cc",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x1400191c0",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000eade",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000eade",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001bff8",
|
|
"callers": [
|
|
{
|
|
"address": "0x140010b68",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001c01d",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001c014",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001c026",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001c00b",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001e3a0",
|
|
"callers": [
|
|
{
|
|
"address": "0x14000e8dd",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000e915",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14001c018",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000eb88",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000e9bb",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140011e00",
|
|
"type": "jmp"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ea80",
|
|
"callers": [
|
|
{
|
|
"address": "0x140005e84",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005e84",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005f1e",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x140005f1e",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ad34",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ad45",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ad34",
|
|
"type": "call"
|
|
},
|
|
{
|
|
"address": "0x14000ad45",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001eb30",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001eaa7",
|
|
"type": "ja"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001eb46",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001eb38",
|
|
"type": "ja"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001eb72",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001eb63",
|
|
"type": "ja"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ec70",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001eb9c",
|
|
"type": "ja"
|
|
},
|
|
{
|
|
"address": "0x14001eb9c",
|
|
"type": "ja"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ed30",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001eb4d",
|
|
"type": "jb"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ef10",
|
|
"callers": [
|
|
{
|
|
"address": "0x140001180",
|
|
"type": "call"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ef2d",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef1c",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ef41",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef57",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14001ef57",
|
|
"type": "je"
|
|
},
|
|
{
|
|
"address": "0x14001ef57",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ef88",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef27",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ef8e",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef82",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ef94",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef7b",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001ef9a",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef77",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001efa0",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef6f",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001efa6",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef6b",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001efac",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef63",
|
|
"type": "je"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"target": "0x14001efb2",
|
|
"callers": [
|
|
{
|
|
"address": "0x14001ef5f",
|
|
"type": "je"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|