joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400572e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
lea rsi, [rcx + 0x20]
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x48], 0
mov rcx, rsi
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14005742e
mov byte [rsp + 0x48], 1
cmp dword [rdi + 0x18], eax
jne 0x140057436
lea rcx, [rdi + 0xf8]
cmp rcx, rbx
je 0x14005734e
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140057346
mov rbx, qword [rbx]
mov rdx, rbx
call fcn.140011b60
mov dword [rdi + 0x18], 2
lea rcx, [rdi + 0x540]
call fcn.14005ccb0
lea rax, [0x140053c30]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov dword [rsp + 0x58], ebx
lea ecx, [rbx + 0x20]
call fcn.1401daf30
test rax, rax
je 0x140057392
mov qword [rax], rbp
mov qword [rax + 8], rdi
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax + 0x10], xmm0
jmp 0x140057395
mov rax, rbx
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14004c230]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14005741f
cmp dword [rsp + 0x38], 0
je 0x14005746e
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140057417
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, rsi
call fcn.1401dadc1
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov edx, 2
lea rcx, [rsp + 0x60]
call fcn.140057dc0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140051040
lea rdx, [0x1402c8648]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400588d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
movzx esi, r9b
movzx ebp, r8b
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0x130], 0
je 0x140058940
mov dword [rsp + 0x40], reloc.WS2_32.dll_ntohl
lea rax, str.XV_
mov qword [rsp + 0x48], rax
add rcx, 0x5e0
lea r8, [rsp + 0x40]
lea rdx, [fcn.140052340]
call fcn.14004f3c0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rdi, [rcx + 0x20]
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x48], 0
mov rcx, rdi
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x140058a34
mov byte [rsp + 0x48], 1
cmp dword [rbx + 0x18], 1
jne 0x140058a3c
mov dword [rbx + 0x18], 3
mov rcx, rdi
call fcn.1401dadc1
lea rcx, [rbx + 0x540]
call fcn.14005ccb0
lea rax, [0x140054550]
mov qword [rsp + 0x40], rax
xor edi, edi
mov dword [rsp + 0x48], edi
lea ecx, [rdi + 0x28]
call fcn.1401daf30
test rax, rax
je 0x1400589c1
mov byte [rax], sil
mov byte [rax + 1], bpl
mov qword [rax + 8], r14
mov qword [rax + 0x10], rbx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x18], xmm0
jmp 0x1400589c4
mov rax, rdi
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14004c270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140058a25
cmp dword [rsp + 0x38], 0
je 0x140058a74
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140058a1d
jmp 0x140058928
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov edx, 3
lea rcx, [rsp + 0x60]
call fcn.140057dc0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140051040
lea rdx, [0x1402c8648]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140062e60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x140063076
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140062f24
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140062ee0
mov ecx, dword [r10]
jmp 0x140063007
cmp ecx, 0x4e0
jb 0x140063007
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140062f40
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140062f90
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x140062ec0
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x140062eb0
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x14006309a
cmp r8, r14
jne 0x140062e90
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x1400637b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140063854
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140063810
mov ecx, dword [r10]
jmp 0x140063937
cmp ecx, 0x4e0
jb 0x140063937
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140063870
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400638c0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x1400637f0
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x1400637e0
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x140070900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
xor edx, edx
mov r8d, 0x400
movzx ebp, r9b
mov r14, rcx
call sub.VCRUNTIME140.dll_memset
lea r15d, [rbx - 1]
xor r12d, r12d
mov ecx, r15d
mov r13d, 1
mov edi, r13d
movzx r11d, r12w
shl rdi, cl
mov ecx, 0x20
sub ecx, ebx
mov ebx, 0xffffffff
shr ebx, cl
mov ecx, 0x80
nop dword [rax]
nop word [rax + rax]
mov edx, r12d
movzx r9d, r11w
movzx eax, r13w
nop dword [rax + rax]
movzx r10d, cx
or r10w, ax
movzx r8d, r10w
and r8w, r9w
cmp r8w, cx
je 0x14007099c
cmp r8w, ax
jne 0x1400709a0
xor r9w, r10w
shr cx, 1
add ax, ax
cmp cx, ax
ja 0x140070980
mov r8d, 8
test r13b, r9b
mov eax, r12d
mov ecx, r12d
cmovne eax, edi
xor edx, eax
test edx, edi
cmovne ecx, esi
shr r9w, 1
lea eax, [rdx + rdx]
mov edx, ecx
xor edx, eax
sub r8d, r13d
jne 0x1400709b1
and edx, ebx
test bpl, bpl
je 0x140070a4d
mov ecx, r15d
mov eax, r13d
shl eax, cl
mov r8d, r13d
cmp eax, r13d
jbe 0x140070a11
nop dword [rax + rax]
mov r9d, eax
or r9d, r8d
mov ecx, r9d
and ecx, edx
cmp ecx, eax
je 0x140070a04
cmp ecx, r8d
jne 0x140070a07
xor edx, r9d
shr eax, 1
add r8d, r8d
cmp eax, r8d
ja 0x1400709f0
movzx r10d, r11w
movzx eax, r13w
mov ecx, 0x80
nop
movzx r9d, cx
or r9w, ax
movzx r8d, r9w
and r8w, r10w
cmp r8w, cx
je 0x140070a3c
cmp r8w, ax
jne 0x140070a40
xor r10w, r9w
shr cx, 1
add ax, ax
cmp cx, ax
ja 0x140070a20
jmp 0x140070a51
movzx r10d, r11w
movzx eax, r10w
inc r11w
mov dword [r14 + rax*4], edx
mov eax, 0x100
lea ecx, [rax - 0x80]
cmp r11w, ax
jb 0x140070970
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400ec080
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rdi, rdx
mov rsi, rcx
lea rbx, [rcx + 0x30]
mov qword [rsp + 0xc0], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x1400ec22c
cmp dword [rsi + 0x2c], eax
je 0x1400ec0f1
mov dword [rsp + 0x30], 2
lea rax, [0x1402e3eb8]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400ec216
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1400ec1fa
mov dword [rsi + 0x2c], 1
mov rcx, rsi
call fcn.1400ec7c0
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0xd0], rax
xor r14d, r14d
mov qword [rsp + 0x80], r14
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400ec138
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax]
mov qword [rsp + 0x80], rax
mov ecx, 0x48
call fcn.1401daf30
mov rdi, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x1400ec185
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
lea rbp, [rdi + 8]
mov qword [rsp + 0xd8], rbp
mov qword [rbp + 0x38], r14
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400ec183
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax]
mov qword [rbp + 0x38], rax
jmp 0x1400ec188
mov rdi, r14
mov qword [rsp + 0xd0], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x1400dafd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400ec21c
cmp dword [rsi + 0xd0], 0
jne 0x1400ec20f
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rsi + 0xc8], xmm1
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400ec1fa
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, rbx
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.1401dadc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x140128920
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx edi, byte [r8]
mov r12, rdx
movabs rdx, 0x100000001b3
mov r9, rcx
mov rcx, qword [rcx + 0x50]
movabs rax, 0xcbf29ce484222325
xor rdi, rax
dec rcx
movzx eax, byte [r8 + 1]
xor r13d, r13d
mov r15, qword [r9 + 0x38]
imul rdi, rdx
mov qword [rsp + 0x78], rcx
lea r14, [r13 - 1]
xor rdi, rax
movzx eax, byte [r8 + 2]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 3]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 4]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 5]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 6]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 7]
imul rdi, rdx
xor rdi, rax
movabs rax, 0xaaaaaaaaaaaaaaab
imul rdi, rdx
and rdi, rcx
mul rdi
movzx r8d, di
mov rbx, rdx
mov edx, 1
shr rbx, 5
movzx eax, bx
mov rsi, rbx
add ax, ax
shl rsi, 4
lea ecx, [rax + rbx]
shl cx, 4
sub r8w, cx
movzx eax, r8w
mov ecx, r8d
shr rax, 3
and ecx, 7
add rax, r15
shl dx, cl
movzx eax, byte [rax + rsi + 0xa]
and dx, ax
je 0x140128b18
movzx ebp, di
nop dword [rax + rax]
cmp qword [r9 + 0x30], 0
je 0x140128a76
test dx, dx
je 0x140128a76
lea rcx, [r15 + 0xa]
movzx edx, r8w
add rcx, rsi
call fcn.14012da50
mov r9, qword [rsp + 0x60]
movzx ecx, ax
mov rax, qword [r15 + rsi]
shl rcx, 5
mov rcx, qword [rcx + rax]
cmp qword [r9 + 0x28], rcx
jne 0x140128a76
cmp r14, 0xffffffffffffffff
mov rax, rdi
cmovne rax, r14
mov r14, rax
jmp 0x140128ab3
movzx eax, bx
lea rcx, [r15 + 0xa]
add bx, bx
add rcx, rsi
add ax, bx
shl ax, 4
sub bp, ax
movzx edx, bp
call fcn.14012da50
movzx ecx, ax
mov rax, qword [r15 + rsi]
shl rcx, 5
mov rcx, qword [rcx + rax]
mov rax, qword [rsp + 0x70]
cmp qword [rax], rcx
je 0x140128b2d
mov r9, qword [rsp + 0x60]
inc r13
movabs rax, 0xaaaaaaaaaaaaaaab
add rdi, r13
and rdi, qword [rsp + 0x78]
mul rdi
movzx r8d, di
movzx ebp, di
mov rbx, rdx
mov edx, 1
shr rbx, 5
movzx eax, bx
mov rsi, rbx
add ax, ax
shl rsi, 4
lea ecx, [rax + rbx]
shl cx, 4
sub r8w, cx
movzx eax, r8w
mov ecx, r8d
shr rax, 3
and ecx, 7
add rax, r15
shl dx, cl
movzx eax, byte [rax + rsi + 0xa]
and dx, ax
jne 0x140128a30
mov qword [r12], 0xffffffffffffffff
cmp r14, 0xffffffffffffffff
jne 0x140128b3c
mov qword [r12 + 8], rdi
jmp 0x140128b41
mov qword [r12], rdi
mov qword [r12 + 8], 0xffffffffffffffff
jmp 0x140128b41
mov qword [r12 + 8], r14
mov rbx, qword [rsp + 0x68]
mov rax, r12
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140154930
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov qword [rdx], 0
movzx eax, word [r8 + 8]
mov word [rdx + 8], ax
test ax, ax
je 0x1401549e1
movzx edi, word [r8 + 8]
mov ecx, edi
shl rcx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1401549a3
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8d, edi
lea rdx, [0x140272a50]
call fcn.1401693b0
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [r15], rax
mov rdi, qword [r14]
movzx esi, word [r14 + 8]
shl rsi, 5
add rsi, rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
cmp rdi, rsi
je 0x1401549e1
mov rdx, rdi
mov rcx, rbx
call fcn.14014d340
add rbx, 0x20
mov qword [rsp + 0x28], rbx
add rdi, 0x20
cmp rdi, rsi
jne 0x1401549c4
mov eax, dword [r14 + 0xa]
mov dword [r15 + 0xa], eax
movzx eax, word [r14 + 0xe]
mov word [r15 + 0xe], ax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret

Function at 0x140154a10
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov qword [rdx], 0
movzx eax, word [r8 + 8]
mov word [rdx + 8], ax
test ax, ax
je 0x140154ac1
movzx edi, word [r8 + 8]
mov ecx, edi
shl rcx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140154a83
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8d, edi
lea rdx, [0x140272a50]
call fcn.1401693b0
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [r15], rax
mov rdi, qword [r14]
movzx esi, word [r14 + 8]
shl rsi, 5
add rsi, rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
cmp rdi, rsi
je 0x140154ac1
mov rdx, rdi
mov rcx, rbx
call fcn.14014d410
add rbx, 0x20
mov qword [rsp + 0x28], rbx
add rdi, 0x20
cmp rdi, rsi
jne 0x140154aa4
mov eax, dword [r14 + 0xa]
mov dword [r15 + 0xa], eax
movzx eax, word [r14 + 0xe]
mov word [r15 + 0xe], ax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x140155160
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rcx
movzx r13d, dx
and r13d, 7
movzx eax, dx
shr rax, 3
lea rsi, [rcx + 0xa]
add rsi, rax
mov qword [rsp + 0x60], rsi
mov r8d, 1
mov ecx, r13d
shl r8w, cl
test byte [rsi], r8b
je 0x140155309
lea rcx, [r14 + 0xa]
call fcn.14012da50
movzx edi, ax
movzx ebx, word [r14 + 8]
cmp bx, 1
jne 0x1401551d7
mov rcx, r14
call fcn.140155aa0
xor r15d, r15d
jmp 0x1401552f3
dec bx
movzx ecx, bx
shl rcx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
jne 0x140155218
movzx ebx, bx
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8d, ebx
lea rdx, [0x140272a50]
call fcn.1401693b0
lea ecx, [r15 + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r12, rdi
shl r12, 5
mov rbx, qword [r14]
lea rsi, [rbx + r12]
mov qword [rsp + 0x20], r15
mov rdi, r15
mov qword [rsp + 0x28], r15
cmp rbx, rsi
je 0x140155260
nop dword [rax + rax]
mov rdx, rbx
mov rcx, rdi
call fcn.14014d340
add rdi, 0x20
mov qword [rsp + 0x28], rdi
add rbx, 0x20
cmp rbx, rsi
jne 0x140155240
mov rbx, qword [r14]
lea rdi, [r12 + r15]
movzx eax, word [r14 + 8]
mov ebp, eax
shl rbp, 5
add rbp, rbx
lea rsi, [r12 + 0x20]
add rsi, rbx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
cmp rsi, rbp
je 0x1401552b5
nop dword [rax]
mov rdx, rsi
mov rcx, rdi
call fcn.14014d340
add rdi, 0x20
mov qword [rsp + 0x28], rdi
add rsi, 0x20
cmp rsi, rbp
jne 0x140155290
mov rbx, qword [r14]
movzx eax, word [r14 + 8]
test rbx, rbx
je 0x1401552ee
movzx edi, ax
shl rdi, 5
add rdi, rbx
cmp rbx, rdi
je 0x1401552e5
nop dword [rax]
lea rcx, [rbx + 8]
call fcn.14014f820
add rbx, 0x20
cmp rbx, rdi
jne 0x1401552d0
mov rbx, qword [r14]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x60]
mov qword [r14], r15
mov eax, 0xffff
add word [r14 + 8], ax
movzx eax, byte [rsi]
btr eax, r13d
mov byte [rsi], al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140155330
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rcx
movzx r13d, dx
and r13d, 7
movzx eax, dx
shr rax, 3
lea rsi, [rcx + 0xa]
add rsi, rax
mov qword [rsp + 0x60], rsi
mov r8d, 1
mov ecx, r13d
shl r8w, cl
test byte [rsi], r8b
je 0x1401554d9
lea rcx, [r14 + 0xa]
call fcn.140160200
movzx edi, ax
movzx ebx, word [r14 + 8]
cmp bx, 1
jne 0x1401553a7
mov rcx, r14
call fcn.140155aa0
xor r15d, r15d
jmp 0x1401554c3
dec bx
movzx ecx, bx
shl rcx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test rax, rax
jne 0x1401553e8
movzx ebx, bx
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8d, ebx
lea rdx, [0x140272a50]
call fcn.1401693b0
lea ecx, [r15 + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r12, rdi
shl r12, 5
mov rbx, qword [r14]
lea rsi, [rbx + r12]
mov qword [rsp + 0x20], r15
mov rdi, r15
mov qword [rsp + 0x28], r15
cmp rbx, rsi
je 0x140155430
nop dword [rax + rax]
mov rdx, rbx
mov rcx, rdi
call fcn.14014d410
add rdi, 0x20
mov qword [rsp + 0x28], rdi
add rbx, 0x20
cmp rbx, rsi
jne 0x140155410
mov rbx, qword [r14]
lea rdi, [r12 + r15]
movzx eax, word [r14 + 8]
mov ebp, eax
shl rbp, 5
add rbp, rbx
lea rsi, [r12 + 0x20]
add rsi, rbx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
cmp rsi, rbp
je 0x140155485
nop dword [rax]
mov rdx, rsi
mov rcx, rdi
call fcn.14014d410
add rdi, 0x20
mov qword [rsp + 0x28], rdi
add rsi, 0x20
cmp rsi, rbp
jne 0x140155460
mov rbx, qword [r14]
movzx eax, word [r14 + 8]
test rbx, rbx
je 0x1401554be
movzx edi, ax
shl rdi, 5
add rdi, rbx
cmp rbx, rdi
je 0x1401554b5
nop dword [rax]
lea rcx, [rbx + 8]
call fcn.14014f820
add rbx, 0x20
cmp rbx, rdi
jne 0x1401554a0
mov rbx, qword [r14]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x60]
mov qword [r14], r15
mov eax, 0xffff
add word [r14 + 8], ax
movzx eax, byte [rsi]
btr eax, r13d
mov byte [rsi], al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret