joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b8b10
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400a91d0
movzx eax, al
test eax, eax
jne 0x1401b8b30
mov ecx, 7
call fcn.1400a7e5c
nop
mov byte [rsp + 0x20], 0
call fcn.1400a800a
mov byte [rsp + 0x21], al
cmp dword [0x140263fd0], 1
jne 0x1401b8b54
mov ecx, 7
call fcn.1400a7e5c
nop
jmp 0x1401b8bac
cmp dword [0x140263fd0], 0
jne 0x1401b8ba7
mov dword [0x140263fd0], 1
lea rdx, [0x140200920]
lea rcx, [0x1402005f0]
call fcn.1400a5c92
test eax, eax
je 0x1401b8b88
mov eax, 0xff
jmp 0x1401b8cb1
lea rdx, [0x1402004e0]
lea rcx, [section..rdata]
call fcn.1400a7fab
mov dword [0x140263fd0], 2
jmp 0x1401b8bac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400a7d7b
call fcn.1400a73da
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1401b8c09
mov rcx, qword [rsp + 0x30]
call fcn.1400a544a
movzx eax, al
test eax, eax
je 0x1401b8c09
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140286020]
nop
call fcn.1400a77ea
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1401b8c3d
mov rcx, qword [rsp + 0x38]
call fcn.1400a544a
movzx eax, al
test eax, eax
je 0x1401b8c3d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400a8ae6
nop
call fcn.1401b8d20
mov dword [rsp + 0x28], eax
call fcn.1400a7191
movzx eax, al
test eax, eax
jne 0x1401b8c5c
mov ecx, dword [rsp + 0x28]
call fcn.1400a3636
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1401b8c6b
call fcn.1400a8be5
nop
xor edx, edx
mov cl, 1
call fcn.1400a52a1
mov eax, dword [rsp + 0x28]
jmp 0x1401b8cb1
add rsp, 0x68
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14002bbc0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14002bbd0]
mov dword [rax], 1
mov rax, qword [0x14002bbe0]
mov dword [rax], 1
mov rax, qword [0x14002bb30]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14002bbb0]
mov dword [0x14003000c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x14002bca0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x14002bc80]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x14002bb10]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14002bc10]
xor edi, edi
mov rax, qword gs:[0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x14002bc20]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140030008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x14002bb60]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call sym._pei386_runtime_relocator
mov rcx, qword [sym._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x14002bc00]
lea rcx, [sym.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov ebx, dword [0x140030028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
test ebx, ebx
mov rbp, qword [0x140030020]
mov r12, rax
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [rbp + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [r12 + rbx], rax
mov rdx, qword [rbp + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, r12
mov qword [rdi], 0
mov qword [0x140030020], r12
call sym.__main
mov rax, qword [0x14002bb90]
mov r8, qword [0x140030018]
mov ecx, dword [0x140030028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140030020]
call sym.main
mov ecx, dword [0x14003000c]
mov dword [0x140030010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140030008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x14002bc20]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call sym._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x14002bc50]
mov rcx, qword [0x14002bc40]
call sym._initterm
test edi, edi
mov dword [rsi], 2
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x140030010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x14002bc70]
mov dword [rsi], 1
mov rcx, qword [0x14002bc60]
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b6
mov ecx, eax
call sym.exit
nop
Function at 0x140003cb0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
mov rcx, rdx
mov qword [rbx], rdx
js 0x140003cd8
call sym.allocShared0Impl__system_u1776
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp sym.raiseRangeErrorI

Function at 0x140004430
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140004440
jmp sym.deallocShared
ret

Function at 0x1400044e0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movzx eax, byte [rdx]
mov rbx, qword [rcx + 0x10]
movzx edi, byte [rcx]
mov rbp, qword [rdx + 8]
test al, al
mov rsi, qword [rdx + 0x10]
mov byte [rcx], al
mov qword [rcx + 9], 0
mov qword [rcx + 1], 0
mov qword [rcx + 0x10], 0
je 0x140004530
test dil, dil
mov qword [rcx + 8], rbp
je 0x140004558
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
test rsi, rsi
mov qword [rcx + 8], 0
je 0x14000454b
mov rax, qword [rsi - 0x10]
add rax, 0x10
jo 0x1400045ba
mov qword [rsi - 0x10], rax
test dil, dil
mov qword [rcx + 0x10], rsi
mov qword [rcx + 8], rbp
jne 0x140004521
test rbx, rbx
je 0x140004521
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x140004590
sub rax, 0x10
jo 0x1400045ad
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rememberCycle__system_u3453
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.nimDestroyAndDispose
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.raiseOverflow
mov qword [rsp + 0x28], rcx
call sym.raiseOverflow
mov rcx, qword [rsp + 0x28]
jmp 0x14000454b

Function at 0x1400047e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx], 0
mov rbx, rcx
je 0x1400047f8
add rsp, 0x20
pop rbx
ret
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400047ed
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140004830
sub rdx, 0x10
jo 0x14000484e
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3453
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x10]
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow

Function at 0x140004940
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rcx, [0x140030040]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
add rsp, 0x28
jmp sym.nimTestErrorFlag
Function at 0x140005c40
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor ecx, ecx
call rdi
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov rcx, rax
call rsi
mov edx, 0x8000
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
mov ecx, eax
call rbx
mov ecx, 1
call rdi
mov rcx, rax
call rsi
mov edx, 0x8000
mov ecx, eax
call rbx
mov ecx, 2
call rdi
mov rcx, rax
call rsi
mov edx, 0x8000
mov ecx, eax
call rbx
call qword [0x1400300c0]
mov dword [0x1400300c8], eax
call qword [0x1400300b0]
cmp dword [0x1400300c8], 0xfde9
mov dword [0x1400300b8], eax
je 0x140005d0b
mov ecx, 0xfde9
call qword [0x1400300a8]
lea rax, [sym.restoreConsoleOutputCP__stdZsyncio_u675]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
movdqa xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.addExitProc__stdZexitprocs_u203
mov rcx, qword [0x14002bb80]
call dbg.__emutls_get_address
mov rdx, rax
mov eax, dword [0x1400300b8]
cmp byte [rdx], 0
jne 0x140005d48
cmp eax, 0xfde9
je 0x140005d48
mov ecx, 0xfde9
call qword [0x1400300a0]
lea rax, [sym.restoreConsoleCP__stdZsyncio_u676]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
movdqa xmm1, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm1
call sym.addExitProc__stdZexitprocs_u203
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
jmp sym.nimTestErrorFlag

Function at 0x140005e90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x140005eaf
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sym.fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fflush

Function at 0x140005f60
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
mov ecx, 2
call rsi
lea rdx, str.could_not_load:
mov rcx, rax
call sym.rawWrite
lea rax, [0x140029455]
mov ecx, 2
add rbx, 8
test rdi, rdi
cmove rbx, rax
call rsi
mov rcx, rax
mov rdx, rbx
call sym.rawWrite
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
je 0x140005fdc
mov ecx, 2
call rsi
lea rdx, [0x140029499]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
mov ecx, 2
call rsi
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call sym.rawWrite
jmp 0x140005fbc

Function at 0x140006000
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
lea rdx, [0x140029499]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop dword [rax]
Function at 0x140006180
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140030120]
test rax, rax
je 0x140006192
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop word [rax + rax]

Function at 0x140007db0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r10, qword [rdx + 8]
mov r9, rdx
sar rdx, 0x15
mov r8, rcx
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x20a0]
test rax, rax
jne 0x140007de0
jmp 0x140007e0a
mov rax, qword [rax]
test rax, rax
je 0x140007e0a
cmp rdx, qword [rax + 8]
jne 0x140007dd8
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rdx, qword [r8 + 0x2078]
mov rcx, rax
sub rcx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140007e55
add rsp, 0x28
ret
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop dword [rax]

Function at 0x140007e70
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [rdx + 8]
sub qword [rcx + 0x2088], rax
mov r10, qword [rdx + 8]
mov r8, rcx
mov r9, rdx
cmp r10, 0x3f000000
jg 0x140007ea0
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x20a0]
test rax, rax
jne 0x140007f10
nop dword [rax]
mov rax, qword [r8 + 0x2070]
mov rdx, qword [r8 + 0x2078]
mov rcx, rax
sub rcx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140007f3f
add rsp, 0x28
ret
mov rax, qword [rax]
test rax, rax
je 0x140007eb8
cmp rdx, qword [rax + 8]
jne 0x140007f08
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
jmp 0x140007eb8
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
Function at 0x140007f60
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r9, rdx
and r9, 0xfffffffffffff000
mov r8, qword [r9 + 8]
mov rax, qword [r9 + 0x10]
cmp r8, 0xfb0
jle 0x140007fb0
lea rdx, [rax + 0x2098]
cmp rcx, rax
lea r10, [r9 + 0x18]
je 0x140008030
mov rax, qword [rdx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rdx], r9
jne 0x140008020
add rsp, 0x28
ret
cmp rcx, rax
je 0x140007fd0
lea rcx, [r9 + 0x40]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rdx]
lock cmpxchg qword [rcx], rdx
je 0x140007fa3
mov qword [rdx], rax
jmp 0x140007fb9
sub qword [rax + 0x2088], r8
mov rcx, qword [r9 + 0x28]
mov qword [rdx], rcx
mov qword [r9 + 0x28], rdx
mov rdx, qword [r9 + 0x30]
cmp rdx, r8
jge 0x140008050
lea rdx, [r8 + 0xf]
test r8, r8
cmovns rdx, r8
sar rdx, 4
mov rcx, qword [rax + rdx*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x14000800b
mov qword [rcx + 0x20], r9
mov qword [rax + rdx*8], r9
add qword [r9 + 0x30], r8
add rsp, 0x28
ret
mov qword [r10], rax
jmp 0x140007f93
sub qword [rcx + 0x2088], r8
mov r8, qword [r9 + 8]
cmp r8, 0x3f000000
jg 0x1400080c0
mov rdx, r9
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
add rdx, r8
cmp rdx, 0xfb0
mov qword [r9 + 0x30], rdx
jne 0x140007fa3
lea rdx, [r8 + 0xf]
test r8, r8
mov rcx, qword [r9 + 0x18]
cmovns rdx, r8
sar rdx, 4
cmp r9, qword [rax + rdx*8]
je 0x140008178
mov rdx, qword [r9 + 0x20]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x140008096
mov rdx, qword [r9 + 0x20]
mov qword [rcx + 0x20], rdx
mov rdx, r9
mov rcx, rax
pxor xmm0, xmm0
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
mov rcx, r9
sar rcx, 0x15
movzx edx, cl
mov rdx, qword [rax + rdx*8 + 0x20a0]
test rdx, rdx
jne 0x1400080e8
jmp 0x140008113
mov rdx, qword [rdx]
test rdx, rdx
je 0x140008113
cmp rcx, qword [rdx + 8]
jne 0x1400080e0
mov rcx, r9
mov r10d, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl r10, cl
sar r11, 6
not r10
and qword [rdx + r11*8 + 0x10], r10
mov rdx, qword [rax + 0x2070]
mov rcx, rdx
sub rcx, r8
mov r8d, 0x8000
movq xmm0, rcx
mov rcx, qword [rax + 0x2078]
cmp rdx, rcx
cmovl rdx, rcx
mov rcx, r9
movq xmm1, rdx
xor edx, edx
punpcklqdq xmm0, xmm1
movups xmmword [rax + 0x2070], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140007fa3
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop word [rax + rax]
test rcx, rcx
mov qword [rax + rdx*8], rcx
je 0x140008096
mov qword [rcx + 0x20], 0
jmp 0x140008096
Function at 0x1400081a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r9, rdx
and r9, 0xfffffffffffff000
mov r8, qword [r9 + 8]
mov rax, qword [r9 + 0x10]
cmp r8, 0xfb0
jle 0x1400081f0
lea rdx, [rax + 0x2098]
cmp rcx, rax
lea r10, [r9 + 0x18]
je 0x140008270
mov rax, qword [rdx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rdx], r9
jne 0x140008260
add rsp, 0x28
ret
cmp rcx, rax
je 0x140008210
lea rcx, [r9 + 0x40]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rdx]
lock cmpxchg qword [rcx], rdx
je 0x1400081e3
mov qword [rdx], rax
jmp 0x1400081f9
sub qword [rax + 0x2088], r8
mov rcx, qword [r9 + 0x28]
mov qword [rdx], rcx
mov qword [r9 + 0x28], rdx
mov rdx, qword [r9 + 0x30]
cmp r8, rdx
jle 0x140008290
lea rdx, [r8 + 0xf]
test r8, r8
cmovns rdx, r8
sar rdx, 4
mov rcx, qword [rax + rdx*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x14000824b
mov qword [rcx + 0x20], r9
mov qword [rax + rdx*8], r9
add qword [r9 + 0x30], r8
add rsp, 0x28
ret
mov qword [r10], rax
jmp 0x1400081d3
sub qword [rcx + 0x2088], r8
mov r8, qword [r9 + 8]
cmp r8, 0x3f000000
jg 0x140008300
mov rdx, r9
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
add rdx, r8
cmp rdx, 0xfb0
mov qword [r9 + 0x30], rdx
jne 0x1400081e3
lea rdx, [r8 + 0xf]
test r8, r8
mov rcx, qword [r9 + 0x18]
cmovns rdx, r8
sar rdx, 4
cmp r9, qword [rax + rdx*8]
je 0x1400083b8
mov rdx, qword [r9 + 0x20]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x1400082d6
mov rdx, qword [r9 + 0x20]
mov qword [rcx + 0x20], rdx
mov rdx, r9
mov rcx, rax
pxor xmm0, xmm0
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
mov rcx, r9
sar rcx, 0x15
movzx edx, cl
mov rdx, qword [rax + rdx*8 + 0x20a0]
test rdx, rdx
jne 0x140008328
jmp 0x140008353
mov rdx, qword [rdx]
test rdx, rdx
je 0x140008353
cmp rcx, qword [rdx + 8]
jne 0x140008320
mov rcx, r9
mov r10d, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl r10, cl
sar r11, 6
not r10
and qword [rdx + r11*8 + 0x10], r10
mov rdx, qword [rax + 0x2070]
mov rcx, rdx
sub rcx, r8
mov r8d, 0x8000
movq xmm0, rcx
mov rcx, qword [rax + 0x2078]
cmp rdx, rcx
cmovl rdx, rcx
mov rcx, r9
movq xmm1, rdx
xor edx, edx
punpcklqdq xmm0, xmm1
movups xmmword [rax + 0x2070], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x1400081e3
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop word [rax + rax]
test rcx, rcx
mov qword [rax + rdx*8], rcx
je 0x1400082d6
mov qword [rcx + 0x20], 0
jmp 0x1400082d6
Function at 0x1400087a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x140028380]
call dbg.__emutls_get_address
mov r9, rbx
and r9, 0xfffffffffffff000
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
cmp rdx, 0xfb0
jle 0x140008800
lea rcx, [r8 + 0x2098]
cmp rax, r8
lea r10, [r9 + 0x18]
je 0x140008880
mov rax, qword [rcx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rcx], r9
jne 0x140008870
add rsp, 0x20
pop rbx
ret
cmp rax, r8
je 0x140008820
lea rdx, [r9 + 0x40]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rbx]
lock cmpxchg qword [rdx], rbx
je 0x1400087f3
mov qword [rbx], rax
jmp 0x140008809
sub qword [r8 + 0x2088], rdx
mov rax, qword [r9 + 0x28]
mov qword [rbx], rax
mov rax, qword [r9 + 0x30]
mov qword [r9 + 0x28], rbx
cmp rdx, rax
jle 0x1400088a8
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
sar rax, 4
mov rcx, qword [r8 + rax*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x14000885b
mov qword [rcx + 0x20], r9
mov qword [r8 + rax*8], r9
add qword [r9 + 0x30], rdx
add rsp, 0x20
pop rbx
ret
mov qword [r10], rax
jmp 0x1400087e3
sub qword [rax + 0x2088], rdx
mov rdx, r9
mov r10, qword [r9 + 8]
cmp r10, 0x3f000000
jg 0x140008910
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
add rax, rdx
cmp rax, 0xfb0
mov qword [r9 + 0x30], rax
jne 0x1400087f3
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
mov rdx, qword [r9 + 0x18]
sar rax, 4
cmp r9, qword [r8 + rax*8]
je 0x1400089c8
mov rax, qword [r9 + 0x20]
test rdx, rdx
mov qword [rax + 0x18], rdx
je 0x1400088ed
mov rax, qword [r9 + 0x20]
mov qword [rdx + 0x20], rax
mov rdx, r9
mov rcx, r8
pxor xmm0, xmm0
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
sar rdx, 0x15
movzx eax, dl
mov rax, qword [r8 + rax*8 + 0x20a0]
test rax, rax
jne 0x140008938
jmp 0x140008962
mov rax, qword [rax]
test rax, rax
je 0x140008962
cmp rdx, qword [rax + 8]
jne 0x140008930
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rcx, r9
mov rdx, qword [r8 + 0x2078]
mov rbx, rax
sub rbx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rbx
xor edx, edx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x1400087f3
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop word [rax + rax]
test rdx, rdx
mov qword [r8 + rax*8], rdx
je 0x1400088ed
mov qword [rdx + 0x20], 0
jmp 0x1400088ed
Function at 0x1400089f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x140028380]
call dbg.__emutls_get_address
mov r9, rbx
and r9, 0xfffffffffffff000
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
cmp rdx, 0xfb0
jle 0x140008a50
lea rcx, [r8 + 0x2098]
cmp rax, r8
lea r10, [r9 + 0x18]
je 0x140008ad0
mov rax, qword [rcx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rcx], r9
jne 0x140008ac0
add rsp, 0x20
pop rbx
ret
cmp rax, r8
je 0x140008a70
lea rdx, [r9 + 0x40]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rbx]
lock cmpxchg qword [rdx], rbx
je 0x140008a43
mov qword [rbx], rax
jmp 0x140008a59
sub qword [r8 + 0x2088], rdx
mov rax, qword [r9 + 0x28]
mov qword [rbx], rax
mov rax, qword [r9 + 0x30]
mov qword [r9 + 0x28], rbx
cmp rdx, rax
jle 0x140008af8
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
sar rax, 4
mov rcx, qword [r8 + rax*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x140008aab
mov qword [rcx + 0x20], r9
mov qword [r8 + rax*8], r9
add qword [r9 + 0x30], rdx
add rsp, 0x20
pop rbx
ret
mov qword [r10], rax
jmp 0x140008a33
sub qword [rax + 0x2088], rdx
mov rdx, r9
mov r10, qword [r9 + 8]
cmp r10, 0x3f000000
jg 0x140008b60
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
add rax, rdx
cmp rax, 0xfb0
mov qword [r9 + 0x30], rax
jne 0x140008a43
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
mov rdx, qword [r9 + 0x18]
sar rax, 4
cmp r9, qword [r8 + rax*8]
je 0x140008c18
mov rax, qword [r9 + 0x20]
test rdx, rdx
mov qword [rax + 0x18], rdx
je 0x140008b3d
mov rax, qword [r9 + 0x20]
mov qword [rdx + 0x20], rax
mov rdx, r9
mov rcx, r8
pxor xmm0, xmm0
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
sar rdx, 0x15
movzx eax, dl
mov rax, qword [r8 + rax*8 + 0x20a0]
test rax, rax
jne 0x140008b88
jmp 0x140008bb2
mov rax, qword [rax]
test rax, rax
je 0x140008bb2
cmp rdx, qword [rax + 8]
jne 0x140008b80
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rcx, r9
mov rdx, qword [r8 + 0x2078]
mov rbx, rax
sub rbx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rbx
xor edx, edx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140008a43
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop word [rax + rax]
test rdx, rdx
mov qword [r8 + rax*8], rdx
je 0x140008b3d
mov qword [rdx + 0x20], 0
jmp 0x140008b3d