joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400746c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xf0]
mov rsi, rcx
test rax, rax
je 0x140074700
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400748e5
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x78
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400748c2
add dword [0x140134854], ebx
mov r8d, ebx
xor edx, edx
mov qword [rsi + 0xf0], rax
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [rsi + 0x80]
test rcx, rcx
jne 0x140074751
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov rax, qword [rsi + 0xf0]
mov qword [rax], rcx
mov ecx, 3
lea r8d, [rcx + 9]
mov edx, dword [rsi + 0x98]
mov rax, qword [rsi + 0xf0]
shr edx, cl
inc ecx
and edx, 1
mov dword [r8 + rax], edx
add r8, 4
cmp r8, 0x1c
jl 0x140074764
mov ecx, dword [rsi + 0x98]
mov rax, qword [rsi + 0xf0]
shr ecx, 0xa
and ecx, 1
mov dword [rax + 0x1c], ecx
mov ecx, dword [rsi + 0x98]
mov rax, qword [rsi + 0xf0]
shr ecx, 0xb
and ecx, 1
mov dword [rax + 0x20], ecx
mov rcx, qword [rsi + 0xf0]
movzx eax, word [rsi + 0x9c]
mov word [rcx + 0x24], ax
mov rcx, rsi
call fcn.140084b6c
mov rcx, qword [rsi + 0xf0]
mov dword [rcx + 0x28], eax
mov rcx, qword [rsi + 0xf0]
mov eax, dword [rsi + 0xe8]
mov dword [rcx + 0x2c], eax
mov ecx, dword [rsi + 0x98]
mov rax, qword [rsi + 0xf0]
and ecx, 7
mov dword [rax + 8], ecx
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
je 0x140074820
mov rax, qword [rcx]
mov rax, qword [rax + 0xe8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xf0]
mov qword [rcx + 0x40], rax
mov eax, dword [rsi + 0xb8]
mov rcx, qword [rsi + 0xf0]
mov dword [rcx + 0x48], eax
mov al, byte [rsi + 0xe0]
mov rcx, qword [rsi + 0xf0]
mov byte [rcx + 0x70], al
mov rcx, qword [rsi + 0xf0]
mov eax, dword [rsi + 0xe4]
mov dword [rcx + 0x74], eax
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400748c2
mov rcx, qword [rsi + 0xf0]
add dword [0x140134854], 0x10
mov rdx, qword [rcx]
mov qword [rdx + 0x10], rax
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xf0]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
jmp 0x1400746ea
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x30b
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140074910
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0xc8]
xor r14d, r14d
mov rbx, rcx
mov r15d, 1
test rax, rax
je 0x140074951
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140074af2
jmp 0x140074aae
mov ecx, 0x30
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140074acf
add dword [0x140134854], 0x30
xorps xmm0, xmm0
mov qword [rbx + 0xc8], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rcx, qword [rbx + 0x80]
test rcx, rcx
jne 0x1400749a2
mov rcx, rbx
call fcn.140073190
mov rcx, qword [rbx + 0x80]
mov rax, qword [rbx + 0xc8]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc8]
movzx eax, word [rbx + 0x98]
mov word [rcx + 8], ax
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x58]
call qword [case.0x1400cd70e.0]
mov ecx, eax
mov rax, qword [rbx + 0xc8]
mov byte [rax + 0xc], cl
mov rcx, rbx
call fcn.14007e08c
mov ecx, eax
mov rax, qword [rbx + 0xc8]
mov byte [rax + 0xd], cl
movzx ecx, r14w
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x140074acb
mov rax, rdi
mov rax, qword [rax + 0x10]
add cx, r15w
test rax, rax
jne 0x140074a02
test cx, cx
je 0x140074acb
mov rax, rdi
movzx ecx, r14w
mov rax, qword [rax + 0x10]
add cx, r15w
test rax, rax
jne 0x140074a1f
mov rax, qword [rbx + 0xc8]
movsx ecx, cx
mov dword [rax + 0x20], ecx
mov eax, 8
mov rbp, qword [rbx + 0xc8]
mov ecx, dword [rbp + 0x20]
mul rcx
mov rsi, rax
mov rax, 0xffffffffffffffff
cmovo rsi, rax
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140074acf
add dword [0x140134854], esi
mov rsi, r14
mov qword [rbp + 0x28], rax
test rdi, rdi
je 0x140074aae
mov rcx, rdi
mov rdi, qword [rdi + 0x10]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, rax
mov rax, qword [rbx + 0xc8]
mov rcx, qword [rax + 0x28]
mov qword [rsi + rcx], rdx
add rsi, 8
jmp 0x140074a7a
mov eax, r15d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor eax, eax
jmp 0x140074ab1
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x345
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140074b20
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
mov rbx, rcx
test rax, rax
je 0x140074b4d
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140074c42
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 0x38
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x140074b86
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x38
xorps xmm0, xmm0
mov qword [rbx + 0xd8], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], rcx
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
jne 0x140074bc1
mov rcx, rbx
call fcn.140074910
mov rcx, qword [rbx + 0xc8]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0xd8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
mov rax, qword [rbx + 0xd8]
mov rcx, qword [rax]
cmp dword [rcx], 0x20
jne 0x140074c29
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x1a8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xd8]
mov byte [rcx + 0x30], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x60]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xd8]
mov byte [rcx + 0x31], al
jmp 0x140074b41
lea r8, str.pDump__pThis__cgid__ID_CG_ENCAP_STRUCT
mov edx, 0x379
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x370
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140074c70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xe0]
mov rsi, rcx
test rax, rax
je 0x140074c9f
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140074de1
jmp 0x140074da8
mov ecx, 0x38
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140074dbe
mov ebx, dword [0x140134854]
xorps xmm0, xmm0
mov qword [rsi + 0xe0], rax
xor ecx, ecx
movups xmmword [rax], xmm0
add ebx, 0x38
movups xmmword [rax + 0x10], xmm0
mov dword [0x140134854], ebx
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], rcx
mov rcx, qword [rsi + 0xc8]
test rcx, rcx
jne 0x140074d04
mov rcx, rsi
call fcn.140074910
mov rcx, qword [rsi + 0xc8]
mov ebx, dword [0x140134854]
movups xmm0, xmmword [rcx]
mov rax, qword [rsi + 0xe0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
mov rdi, qword [rsi + 0xe0]
mov rax, qword [rdi]
mov ecx, dword [rax]
sub ecx, 0x1d
cmp ecx, 1
ja 0x140074dfa
cmp qword [rsi + 0xd8], 0
je 0x140074da8
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140074dbe
mov qword [rdi + 0x30], rax
add ebx, 0x10
mov rdi, qword [rsi + 0xd8]
mov rcx, rdi
mov dword [0x140134854], ebx
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xe0]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx + 0x30]
call fcn.140073058
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x387
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pThis__cgid__ID_CG_CONF_STRUCT__pDump__pThis__cgid__ID_CG_CONF_VAR_STRUCT
mov edx, 0x391
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140074e20
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xf0]
mov rsi, rcx
test rax, rax
je 0x140074e4f
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140074ffd
jmp 0x140074fc4
mov edi, 0x40
mov ecx, edi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140074fda
mov ebx, dword [0x140134854]
mov r8d, edi
add ebx, edi
mov qword [rsi + 0xf0], rax
xor edx, edx
mov dword [0x140134854], ebx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [rsi + 0xc8]
test rcx, rcx
jne 0x140074eae
mov rcx, rsi
call fcn.140074910
mov rcx, qword [rsi + 0xc8]
mov ebx, dword [0x140134854]
movups xmm0, xmmword [rcx]
mov rax, qword [rsi + 0xf0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
cmp qword [rsi + 0xd8], 0
je 0x140074f4b
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140074fda
mov rcx, qword [rsi + 0xf0]
add ebx, 0x10
mov dword [0x140134854], ebx
mov qword [rcx + 0x30], rax
mov rdi, qword [rsi + 0xd8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xf0]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx + 0x30]
call fcn.140073058
mov ebx, dword [0x140134854]
cmp qword [rsi + 0xe8], 0
je 0x140074fc4
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140074fda
mov rcx, qword [rsi + 0xf0]
add ebx, 0x10
mov dword [0x140134854], ebx
mov qword [rcx + 0x38], rax
mov rax, qword [rsi + 0xe8]
mov rdi, rax
mov rcx, rax
mov rdx, qword [rax]
mov rax, qword [rdx + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xf0]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx + 0x38]
call fcn.140073058
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x3a5
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140075020
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
mov rsi, rcx
test rax, rax
je 0x140075060
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140075218
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x38
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400751f5
add dword [0x140134854], 0x38
xorps xmm0, xmm0
mov qword [rsi + 0xd8], rax
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], rcx
mov rcx, qword [rsi + 0x80]
test rcx, rcx
jne 0x1400750b7
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov rax, qword [rsi + 0xd8]
mov qword [rax], rcx
mov eax, dword [rsi + 0xa0]
mov rcx, qword [rsi + 0xd8]
mov dword [rcx + 8], eax
mov eax, dword [rsi + 0xa4]
mov rcx, qword [rsi + 0xd8]
mov dword [rcx + 0xc], eax
mov rcx, qword [rsi + 0xd8]
mov eax, dword [rsi + 0xb8]
mov dword [rcx + 0x18], eax
mov ecx, dword [rsi + 0xbc]
mov rax, qword [rsi + 0xd8]
shr ecx, 1
sbb ecx, ecx
mov dword [rax + 0x1c], ecx
mov ecx, dword [rsi + 0xbc]
mov rax, qword [rsi + 0xd8]
shr ecx, 4
sbb ecx, ecx
mov dword [rax + 0x24], ecx
mov ecx, dword [rsi + 0xbc]
mov rax, qword [rsi + 0xd8]
shr ecx, 3
sbb ecx, ecx
mov dword [rax + 0x20], ecx
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
je 0x140075156
mov rax, qword [rcx]
mov rax, qword [rax + 0xe8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xd8]
mov qword [rcx + 0x10], rax
mov rcx, qword [rsi + 0xd8]
mov rax, qword [rsi + 0xc0]
mov qword [rcx + 0x28], rax
cmp qword [rsi + 8], 0
je 0x1400751e1
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400751f5
mov rcx, qword [rsi + 0xd8]
add dword [0x140134854], 0x10
mov rdx, qword [rcx]
mov qword [rdx + 0x10], rax
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xd8]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
jmp 0x14007504a
mov rax, qword [rsi + 0xd8]
mov rcx, qword [rax]
cmp dword [rcx], 0x23
jne 0x140075231
jmp 0x14007504a
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x3c7
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pThis__cgid__ID_CG_UNION_FIELD
mov edx, 0x3e2
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140075250
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
mov rbx, rcx
test rax, rax
je 0x14007526f
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400752e7
jmp 0x1400752db
mov ecx, 8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x1400752a8
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 8
mov rcx, qword [rbx + 0x80]
mov qword [rbx + 0x98], rax
test rcx, rcx
jne 0x1400752d8
mov rcx, rbx
call fcn.140073190
mov rax, qword [rbx + 0x98]
mov rcx, qword [rbx + 0x80]
mov qword [rax], rcx
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x3ed
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140075310
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xa8]
mov rbx, rcx
test rax, rax
je 0x14007535a
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400754e4
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400754c1
add dword [0x140134854], 0x20
xorps xmm0, xmm0
mov qword [rbx + 0xa8], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [rbx + 0x80]
test rcx, rcx
jne 0x1400753a7
mov rcx, rbx
call fcn.140073190
mov rcx, qword [rbx + 0x80]
mov rax, qword [rbx + 0xa8]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xa8]
mov rax, qword [rcx]
cmp dword [rax], 5
jne 0x14007552f
cmp dword [rbx + 0x38], 2
setne al
mov byte [rcx + 0x18], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov rcx, rax
call fcn.14002eb54
lea rcx, [rax + 0xb0]
neg rax
sbb rax, rax
and rax, rcx
xor edx, edx
mov rdi, qword [rax]
mov rax, rdi
mov rcx, rdi
test rcx, rcx
je 0x14007540c
mov rax, qword [rax + 0x58]
jmp 0x14007540e
xor eax, eax
test rcx, rcx
je 0x14007541a
inc edx
mov rcx, rax
jmp 0x140075401
mov rax, qword [rbx + 0xa8]
movsxd rbp, edx
mov dword [rax + 8], edx
mov eax, 8
mul rbp
mov rsi, rax
mov rax, 0xffffffffffffffff
cmovo rsi, rax
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400754c1
mov rcx, qword [rbx + 0xa8]
add dword [0x140134854], esi
xor esi, esi
mov qword [rcx + 0x10], rax
mov rcx, rdi
test rcx, rcx
je 0x140075472
mov rdi, qword [rdi + 0x58]
jmp 0x140075474
xor edi, edi
test rcx, rcx
je 0x14007533f
cmp rsi, rbp
jge 0x140075516
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xa8]
mov rdx, qword [rcx + 0x10]
mov qword [rdx + rsi*8], rax
mov rax, qword [rbx + 0xa8]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + rsi*8]
mov rcx, qword [rax]
cmp dword [rcx], 0x19
jne 0x1400754fd
inc rsi
jmp 0x140075464
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x3fe
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pLabels_i___pThis__skl.Kind__NODE_LABEL
mov edx, 0x41a
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.i___Count
mov edx, 0x418
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pThis__cgid__ID_CG_ENUM
mov edx, 0x407
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140075550
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xb0]
mov rsi, rcx
test rax, rax
je 0x140075590
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400756b5
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140075692
add dword [0x140134854], 0x18
xor ecx, ecx
mov qword [rsi + 0xb0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rsi + 0x80]
test rcx, rcx
jne 0x1400755df
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov rax, qword [rsi + 0xb0]
mov qword [rax], rcx
mov rcx, qword [rsi + 0xb0]
mov eax, dword [rsi + 0xa8]
mov dword [rcx + 0x10], eax
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x140075620
mov rax, qword [rcx]
mov rax, qword [rax + 0xe8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xb0]
mov qword [rcx + 8], rax
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140075692
mov rcx, qword [rsi + 0xb0]
add dword [0x140134854], 0x10
mov rdx, qword [rcx]
mov qword [rdx + 0x10], rax
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xb0]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
jmp 0x14007557a
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x426
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x1400756e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0xe0]
xor r14d, r14d
mov rsi, rcx
mov r15d, 1
test rax, rax
je 0x140075721
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140075954
jmp 0x140075910
mov ebx, 0x50
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140075931
add dword [0x140134854], ebx
mov r8d, ebx
xor edx, edx
mov qword [rsi + 0xe0], rax
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [rsi + 0x80]
test rcx, rcx
jne 0x140075772
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov rax, qword [rsi + 0xe0]
mov qword [rax], rcx
mov rcx, qword [rsi + 0xe0]
movzx eax, word [rsi + 0x98]
mov word [rcx + 8], ax
mov rcx, rsi
mov rax, qword [rsi]
mov rax, qword [rax + 0x230]
call qword [case.0x1400cd70e.0]
mov ecx, eax
mov rax, qword [rsi + 0xe0]
mov byte [rax + 0xa], cl
mov rcx, qword [rsi + 0xe0]
mov eax, dword [rsi + 0xb0]
mov dword [rcx + 0x30], eax
movzx ecx, word [rsi + 0xd0]
mov rax, qword [rsi + 0xe0]
and cx, 3
mov word [rax + 0x40], cx
cmp qword [rsi + 0xc0], r14
je 0x140075850
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
je 0x140075931
mov rax, qword [rsi + 0xe0]
add dword [0x140134854], 0x10
mov qword [rax + 0x38], rcx
mov rax, qword [rsi + 0xc0]
mov rdi, rax
mov rcx, rax
mov rdx, qword [rax]
mov rax, qword [rdx + 0x88]
call qword [case.0x1400cd70e.0]
mov rbx, rax
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xe0]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx + 0x38]
call fcn.140073058
mov rbx, qword [rsi + 8]
movzx ecx, r14w
test rbx, rbx
je 0x14007592d
mov rax, rbx
mov rax, qword [rax + 0x10]
add cx, r15w
test rax, rax
jne 0x140075864
test cx, cx
je 0x14007592d
mov rax, rbx
movzx ecx, r14w
mov rax, qword [rax + 0x10]
add cx, r15w
test rax, rax
jne 0x140075881
mov rax, qword [rsi + 0xe0]
movsx ecx, cx
mov dword [rax + 0x44], ecx
mov eax, 8
mov rbp, qword [rsi + 0xe0]
mov ecx, dword [rbp + 0x44]
mul rcx
mov rdi, rax
mov rax, 0xffffffffffffffff
cmovo rdi, rax
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140075931
add dword [0x140134854], edi
mov rdi, r14
mov qword [rbp + 0x48], rax
test rbx, rbx
je 0x140075910
mov rcx, rbx
mov rbx, qword [rbx + 0x10]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, rax
mov rax, qword [rsi + 0xe0]
mov rcx, qword [rax + 0x48]
mov qword [rdi + rcx], rdx
add rdi, 8
jmp 0x1400758dc
mov eax, r15d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor eax, eax
jmp 0x140075913
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__base.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x43e
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3