joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032970
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, qword [rsp + 0x90]
mov r13, r9
mov rbx, r8
mov edi, edx
mov r14, rcx
test rsi, rsi
je 0x1400329aa
movzx ebp, byte [rsi + 0x18]
jmp 0x1400329af
mov ebp, 0x30
mov r15, qword [rcx + 8]
test rsi, rsi
je 0x1400329cf
bt edi, 0x10
jb 0x1400329cb
mov rdx, rbx
mov rcx, rsi
call fcn.14003179c
jmp 0x1400329cf
btr edi, 0x10
cmp ebp, 0x2d
jne 0x140032a0c
lea eax, [rbp - 0x27]
cmp ax, word [rbx + 8]
jae 0x140032b85
mov rdx, qword [rbx]
mov rcx, rbx
mov rdx, qword [rdx + 0x30]
call fcn.140031560
lea eax, [rbp - 0x26]
cmp ax, word [rbx + 8]
jae 0x140032b6c
mov rdx, qword [rbx]
mov rcx, rbx
mov rdx, qword [rdx + 0x38]
call fcn.140031688
mov eax, 4
cmp ax, word [rbx + 8]
jae 0x140032b6c
mov rdx, qword [rbx]
mov rcx, rbx
mov rdx, qword [rdx + 0x20]
call fcn.140031688
mov r12, qword [r14 + 0x40]
lea rax, [r12 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140032aaa
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
jne 0x140032a75
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov rax, qword [r12]
mov rcx, r12
add dword [0x140134854], 0x10
mov rax, qword [rax + 0x98]
call qword [case.0x1400cd70e.0]
mov r9d, 0xa
mov rdx, rbp
mov rcx, rax
lea r8d, [r9 + 6]
call fcn.1400cb398
mov rdx, rbp
jmp 0x140032ac1
cmp ebp, 0x1d
je 0x140032aba
cmp ebp, 0x2e
je 0x140032aba
bt edi, 0x13
jae 0x140032ac9
lea rdx, [0x140100914]
mov rcx, rbx
call fcn.140031688
mov eax, 5
cmp ax, word [rbx + 8]
jae 0x140032b6c
mov rdx, qword [rbx]
mov rcx, rbx
mov rdx, qword [rdx + 0x28]
call fcn.140031688
test rsi, rsi
je 0x140032afa
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.14003181c
mov rax, qword [r15]
and edi, 0xfefffffd
test dword [r14 + 0x20], 0x8000000
mov r9, r13
mov r8, rbx
je 0x140032b29
mov rdx, qword [rsp + 0x98]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x28], rdx
jmp 0x140032b3d
mov rcx, qword [rsp + 0x98]
mov rax, qword [rax + 0x90]
mov qword [rsp + 0x28], rcx
mov edx, edi
mov qword [rsp + 0x20], r14
mov rcx, r15
call qword [case.0x1400cd70e.0]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea r8, str.iIndex___usTabSize
mov edx, 0xb4
lea rcx, str.com_rpcmidlinc_buffer.hxx
call fcn.1400c7a2c
int3
lea r8, str.iIndex___usTabSize
mov edx, 0x9e
lea rcx, str.com_rpcmidlinc_buffer.hxx
call fcn.1400c7a2c
int3
Function at 0x140033d30
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov esi, edx
mov r15, rcx
xor ebx, ebx
call fcn.1400319ec
mov rdi, rax
test rax, rax
je 0x140033f21
bt esi, 0x1a
jae 0x140033ea3
mov rax, qword [0x140134380]
mov ebp, dword [rax + 0xc]
bt ebp, 0x10
jae 0x140033ea3
mov rsi, qword [rsp + 0x70]
cmp byte [rsi + 0x18], 0x18
jne 0x140033ea3
mov r13d, 0x100
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140033dd5
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], r13d
mov rcx, rsi
bt ebp, 0xf
jae 0x140033e1e
call fcn.140031254
mov r8, r13
mov rdx, rbx
sub rax, rbx
lea rcx, [r8 + 0x7ffffefe]
test rcx, rcx
je 0x140033e11
mov cl, byte [rax + rdx]
test cl, cl
je 0x140033e11
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x140033df3
test r8, r8
lea rax, [rdx - 1]
cmovne rax, rdx
jmp 0x140033e7c
and dword [rsp + 0x20], 0
lea r9, [0x14012cf68]
lea r8, [0x14012d4f8]
xor edx, edx
call fcn.1400cbdc8
test rax, rax
je 0x140033e43
mov rdx, qword [rsi + 0x40]
jmp 0x140033e4a
lea rdx, [0x1400f48cb]
mov r8, r13
mov rcx, rbx
sub rdx, rbx
lea rax, [r8 + 0x7ffffefe]
test rax, rax
je 0x140033e71
mov al, byte [rdx + rcx]
test al, al
je 0x140033e71
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x140033e53
test r8, r8
lea rax, [rcx - 1]
cmovne rax, rcx
lea r8, [0x140100968]
mov byte [rax], 0
mov rdx, r13
mov rcx, rbx
call fcn.140001250
mov rdx, rsi
mov rcx, r15
call fcn.140033c9c
test rax, rax
cmovne rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.1400c9f64
cmp qword [r15 + 0x98], 0
je 0x140033eff
lea rdx, [0x14010096c]
mov rcx, r14
call fcn.1400c9f64
mov rcx, qword [r15 + 0x98]
mov rdx, r14
test rbx, rbx
je 0x140033eef
mov r8, rbx
call fcn.1400c5ebc
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x140033eff
mov rax, qword [rcx]
mov rax, qword [rax + 0xc0]
call qword [case.0x1400cd70e.0]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
lea r8, str.pName____char__0
mov edx, 0x6d8
lea rcx, str.com_rpcmidl_frontprttype.cxx
call fcn.1400c7a2c
int3
Function at 0x140035a60
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp byte [rdx + 1], 0
mov r14, rdx
mov rsi, qword [rcx + 0x98]
je 0x140035a91
mov rbx, rsi
jmp 0x140035b14
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140035a95
lea rbp, [rdi + 1]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
mov rbx, rax
test rax, rax
jne 0x140035adc
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], ebp
xor r8d, r8d
test rdi, rdi
je 0x140035b0f
xor eax, eax
mov r9b, byte [rax + rsi]
cmp r9b, 0xd
jne 0x140035aff
lea eax, [rdx + 1]
cmp byte [rax + rsi], 0xa
je 0x140035b06
mov byte [r8 + rbx], r9b
inc r8d
inc edx
mov eax, edx
cmp rax, rdi
jb 0x140035aec
mov byte [r8 + rbx], 0
mov rdx, rbx
mov rcx, r14
call fcn.1400c9f64
cmp rbx, rsi
je 0x140035b38
test rbx, rbx
je 0x140035b38
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14003b748
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x740]
sub rsp, 0x840
mov rax, qword [0x140131c10]
xor rax, rsp
mov qword [rbp + 0x730], rax
mov rsi, rdx
mov r13, r9
mov r9, rcx
mov edx, r8d
lea rcx, [rsp + 0x38]
call fcn.1400c9668
lea rcx, [rsp + 0x38]
call fcn.1400c96bc
xor r14d, r14d
test eax, eax
je 0x14003b963
lea rax, vtable.tracked_node.0
mov dword [rsp + 0x28], r14d
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, r9
lea rcx, [rsp + 0x50]
lea rbx, [rbp + 0x340]
call fcn.14003b3dc
or r12, 0xffffffffffffffff
lea rax, [rsp + 0x50]
mov rdi, r12
inc rdi
cmp byte [rax + rdi], r14b
jne 0x14003b7d7
lea eax, [rdi + 1]
mov r15d, 0x3e8
movsx r14d, ax
inc r14d
cmp r14d, r15d
jle 0x14003b839
movsxd rcx, r14d
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14003b82f
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], r14d
cmp r14d, r15d
cmovg r15d, r14d
movsxd r14, r15d
lea r15, [0x1400f48cb]
test r13, r13
jne 0x14003b861
test rdi, rdi
jne 0x14003b861
mov r8, r15
mov rdx, r14
mov rcx, rbx
call fcn.1400011d4
jmp 0x14003b8c1
lea r8, [0x1400fac34]
mov rdx, r14
mov rcx, rbx
call fcn.1400011d4
test r13, r13
je 0x14003b886
mov r8, r13
mov rdx, r14
mov rcx, rbx
call fcn.140001250
xor r13d, r13d
inc r12
cmp byte [rbx + r12], r13b
jne 0x14003b889
cmp byte [r12 + rbx - 1], 0x20
je 0x14003b8ac
lea r8, [0x1401004d0]
mov rdx, r14
mov rcx, rbx
call fcn.140001250
test rdi, rdi
je 0x14003b8c1
lea r8, [rsp + 0x50]
mov rdx, r14
mov rcx, rbx
call fcn.140001250
mov rax, qword [rsi + 8]
jmp 0x14003b8d4
cmp dword [rax + 0x20], r13d
je 0x14003b8d9
mov rsi, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x14003b8c7
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
movsx eax, word [rsp + 0x28]
mov rsi, qword [rsi + 8]
test ax, ax
jne 0x14003b90a
test rsi, rsi
jne 0x14003b8d9
movzx r8d, r13w
jmp 0x14003b933
mov ecx, eax
mov rax, qword [0x140134340]
mov r15, qword [rax + 8]
test r15, r15
je 0x14003b92a
movsx eax, word [rax + 2]
cmp ecx, eax
jae 0x14003b92a
mov r15, qword [r15 + rcx*8]
jmp 0x14003b92d
mov r15, r13
movzx r8d, word [rsp + 0x2a]
mov r9, rbx
lea rcx, [rsp + 0x38]
mov rdx, r15
call fcn.1400c9788
lea rax, [rbp + 0x340]
cmp rbx, rax
je 0x14003b963
test rbx, rbx
je 0x14003b963
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x730]
xor rcx, rsp
call fcn.1400caef0
mov rbx, qword [rsp + 0x898]
add rsp, 0x840
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003b994
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x420
mov rax, qword [0x140131c10]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov rbp, qword [rsp + 0x480]
lea rbx, [rsp + 0x20]
mov r12d, r9d
mov r14, rcx
call fcn.14002d980
or rcx, 0xffffffffffffffff
mov r15, rax
mov rdx, rcx
xor r13d, r13d
inc rdx
cmp byte [rax + rdx], r13b
jne 0x14003b9e2
test rbp, rbp
je 0x14003b9ff
inc rcx
cmp byte [rcx + rbp], r13b
jne 0x14003b9f0
add rcx, 2
jmp 0x14003ba02
mov rcx, r13
inc dx
mov esi, 0x3e8
add dx, cx
movsx edi, dx
inc edi
cmp edi, esi
jle 0x14003ba58
movsxd rcx, edi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14003ba50
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], edi
cmp edi, esi
cmovg esi, edi
mov r8, r15
movsxd rdi, esi
mov rcx, rbx
mov rdx, rdi
call fcn.1400011d4
test rbp, rbp
je 0x14003ba91
lea r8, [0x1400fac34]
mov rdx, rdi
mov rcx, rbx
call fcn.140001250
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.140001250
cmp word [r14 + 0x28], r13w
je 0x14003bac5
mov rax, qword [0x140134340]
movsx ecx, word [r14 + 0x28]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003babb
movsx eax, word [rax + 2]
cmp ecx, eax
jae 0x14003babb
mov rcx, qword [rdx + rcx*8]
jmp 0x14003babe
mov rcx, r13
movzx eax, word [r14 + 0x2a]
jmp 0x14003bacf
lea rcx, [0x1400f48cb]
mov eax, r13d
mov r9, rbx
mov r8d, r12d
movzx edx, ax
call fcn.1400c9744
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x14003bafb
test rbx, rbx
je 0x14003bafb
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1400caef0
mov rbx, qword [rsp + 0x468]
add rsp, 0x420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003c798
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov edi, r8d
mov ecx, 0x128
mov esi, r9d
mov r15, rdx
call fcn.1400ca61c
test rax, rax
je 0x14003c7da
xor edx, edx
mov rcx, rax
call fcn.1400026f0
mov rbx, rax
jmp 0x14003c7dc
xor ebx, ebx
mov rdx, rbp
mov rcx, rbx
call fcn.14003bb30
mov rax, qword [rbx]
xor edx, edx
and qword [rbx + 0x58], 0
mov rcx, rbx
mov rax, qword [rax + 0x118]
call qword [case.0x1400cd70e.0]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x110]
call qword [case.0x1400cd70e.0]
mov rax, qword [rbx]
mov rdx, rbp
mov rcx, rbx
mov rax, qword [rax + 0xe0]
call qword [case.0x1400cd70e.0]
mov rax, qword [rbx]
mov edx, esi
and qword [rbx + 0xb0], 0
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400cd70e.0]
and dword [rsp + 0x20], 0
lea r9, [0x14012cf68]
lea r8, [0x14012d4f8]
xor edx, edx
mov rcx, rbp
call fcn.1400cbdc8
lea r14, [0x1400f48cb]
test rax, rax
je 0x14003c875
mov rax, qword [rbp + 0x40]
jmp 0x14003c878
mov rax, r14
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x14003c87c
lea rsi, [rdi + 1]
add rsi, rcx
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14003c8c6
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], esi
mov r8, r15
mov rdx, rsi
mov byte [rax], 0
mov rcx, rdi
call fcn.1400011d4
and dword [rsp + 0x20], 0
lea r9, [0x14012cf68]
lea r8, [0x14012d4f8]
xor edx, edx
mov rcx, rbp
call fcn.1400cbdc8
test rax, rax
je 0x14003c903
mov r14, qword [rbp + 0x40]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.140001250
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
mov qword [rbx + 0x40], rdi
call fcn.140027d7c
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14003d670
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14003d692
and qword [rcx], rdx
lea eax, [rdx + 1]
jmp 0x14003d6f9
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x14003d6cb
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x10
mov rcx, rdi
mov qword [rsi], rax
mov rax, qword [rdi]
movzx ebx, byte [rdi + 0x18]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi]
mov edx, ebx
mov r8, rax
call fcn.14003d57c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14003d710
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x38]
mov rbx, rcx
test rax, rax
je 0x14003d739
cmp dword [rax], 0x37
jae 0x14003d896
mov eax, 1
jmp 0x14003d88a
mov edi, 0x40
mov ecx, edi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x14003d774
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], edi
mov r8, rdi
mov rcx, rax
mov qword [rbx + 0x38], rax
call sub.msvcrt.dll_memset
movzx ecx, byte [rbx + 0x18]
lea rdx, [rsp + 0x20]
mov rax, qword [rbx + 0x38]
mov edi, 1
mov dword [rax], ecx
mov rax, qword [rbx + 0x38]
movzx ecx, byte [rbx + 0x19]
mov dword [rax + 4], ecx
mov rcx, qword [rbx + 0x38]
mov rax, qword [rbx + 0x20]
mov qword [rcx + 8], rax
mov rcx, rbx
mov rax, qword [rbx + 0x38]
mov word [rax + 0x10], di
mov rax, qword [rbx]
mov rax, qword [rax + 0x70]
call qword [case.0x1400cd70e.0]
lea rdx, [rsp + 0x20]
mov ecx, dword [rax]
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x14], ecx
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x70]
call qword [case.0x1400cd70e.0]
lea rdx, [rsp + 0x20]
movzx ecx, word [rax + 4]
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x18], ecx
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x70]
call qword [case.0x1400cd70e.0]
movzx ecx, byte [rax + 8]
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x1c], ecx
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x50]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x38]
mov byte [rcx + 0x20], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x38]
mov byte [rcx + 0x21], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x38]
mov byte [rcx + 0x22], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x40]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x38]
mov byte [rcx + 0x23], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x58]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x38]
mov byte [rcx + 0x24], al
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, str.pDump__Kind___INTERNAL_NODE_END
mov edx, 0xb1
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003d8c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [rcx + 0x88]
mov rbx, rcx
test rax, rax
je 0x14003d8e7
cmp dword [rax], 0x37
jae 0x14003da4c
jmp 0x14003da3b
mov edi, 0x68
mov ecx, edi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x14003d922
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], edi
mov r8, rdi
mov rcx, rax
mov qword [rbx + 0x88], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x38]
test rcx, rcx
jne 0x14003d94f
mov rcx, rbx
call fcn.14003d710
mov rcx, qword [rbx + 0x38]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0x88]
lea r9, [0x14012cf68]
and dword [rsp + 0x20], 0
lea r8, [0x14012d4f8]
xor edx, edx
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
mov rcx, rbx
movups xmmword [rax + 0x30], xmm1
call fcn.1400cbdc8
lea rdi, [0x1400f48cb]
test rax, rax
je 0x14003d9a3
mov rcx, qword [rbx + 0x40]
jmp 0x14003d9a6
mov rcx, rdi
mov rax, qword [rbx + 0x88]
lea r9, [0x14012cf68]
and dword [rsp + 0x20], 0
lea r8, [0x14012d4f8]
xor edx, edx
mov qword [rax + 0x40], rcx
mov rcx, rbx
call fcn.1400cbdc8
test rax, rax
je 0x14003d9d7
mov rdi, qword [rbx + 0x50]
mov rax, qword [rbx + 0x88]
mov qword [rax + 0x48], rdi
movups xmm2, xmmword [rbx + 0x60]
movups xmm0, xmmword [rbx + 0x70]
movsd xmm1, qword [rbx + 0x80]
mov rbx, qword [rbx + 0x88]
movups xmmword [rsp + 0x30], xmm2
psrldq xmm2, 8
movd eax, xmm2
movups xmmword [rsp + 0x40], xmm0
movsd qword [rsp + 0x50], xmm1
test eax, eax
jne 0x14003da20
lea rcx, [rsp + 0x30]
call fcn.14003fdbc
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x50], rax
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x58], rax
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x60], rax
mov rbx, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x60
pop rdi
ret
lea r8, str.pDump__skl.Kind___INTERNAL_NODE_END
mov edx, 0xd0
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003da70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x98]
xor esi, esi
mov rbx, rcx
test rax, rax
je 0x14003daa1
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003dba5
jmp 0x14003db8f
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x14003dada
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x18
xorps xmm0, xmm0
mov qword [rbx + 0x98], rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 0x88]
test rcx, rcx
jne 0x14003db0d
mov rcx, rbx
call fcn.14003d8c0
mov rcx, qword [rbx + 0x88]
mov rax, qword [rbx + 0x98]
lea r9, [0x14012d168]
lea r8, [0x14012cb18]
mov dword [rsp + 0x20], esi
xor edx, edx
mov qword [rax], rcx
mov rcx, rbx
call fcn.1400cbdc8
test rax, rax
je 0x14003db68
cmp word [rax + 0xb0], si
je 0x14003db68
lea rdi, [rax + 0xa8]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
jne 0x14003db5d
mov rcx, rdi
call fcn.14003fd10
mov rcx, qword [rdi + 0x10]
mov rax, qword [rbx + 0x98]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x14003db8f
mov rax, qword [rcx]
mov rax, qword [rax + 0xe8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x98]
mov qword [rcx + 8], rax
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea r8, str.pDump__base__skl.Kind___INTERNAL_NODE_END
mov edx, 0xe6
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003dbd0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xb8]
mov rbx, rcx
test rax, rax
je 0x14003dbf6
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003ddbe
jmp 0x14003ddb2
mov ecx, 0x30
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x14003dc2f
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x30
xorps xmm0, xmm0
mov qword [rbx + 0xb8], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rcx, qword [rbx + 0x88]
test rcx, rcx
jne 0x14003dc66
mov rcx, rbx
call fcn.14003d8c0
mov rcx, qword [rbx + 0x88]
mov rax, qword [rbx + 0xb8]
mov qword [rax], rcx
mov ecx, dword [rbx + 0x98]
mov rax, qword [rbx + 0xb8]
shr ecx, 1
sbb ecx, ecx
mov byte [rax + 8], cl
mov ecx, dword [rbx + 0x98]
mov rax, qword [rbx + 0xb8]
shr ecx, 2
sbb ecx, ecx
mov byte [rax + 9], cl
mov ecx, dword [rbx + 0x98]
mov rax, qword [rbx + 0xb8]
shr ecx, 3
sbb ecx, ecx
mov byte [rax + 0xa], cl
mov ecx, dword [rbx + 0x98]
mov rax, qword [rbx + 0xb8]
shr ecx, 4
sbb ecx, ecx
mov byte [rax + 0xb], cl
mov ecx, dword [rbx + 0x98]
mov rax, qword [rbx + 0xb8]
shr ecx, 5
sbb ecx, ecx
mov byte [rax + 0xc], cl
mov ecx, dword [rbx + 0x98]
mov rax, qword [rbx + 0xb8]
shr ecx, 6
sbb ecx, ecx
mov byte [rax + 0xd], cl
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x138]
call qword [case.0x1400cd70e.0]
mov ecx, eax
mov rax, qword [rbx + 0xb8]
mov byte [rax + 0xe], cl
mov ecx, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xb8]
and ecx, 0xf
mov dword [rax + 0x20], ecx
mov ecx, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xb8]
shr ecx, 4
and ecx, 1
mov dword [rax + 0x24], ecx
mov ecx, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xb8]
shr ecx, 5
and ecx, 3
mov dword [rax + 0x28], ecx
mov ecx, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xb8]
shr ecx, 7
and ecx, 3
mov dword [rax + 0x2c], ecx
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x14003dd8b
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, rax
mov rax, qword [rbx + 0xb8]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x14003ddb2
mov rdx, qword [rcx]
mov rax, qword [rdx + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xb8]
mov qword [rcx + 0x18], rax
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0xfc
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3