joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400321e0
Capabilities:
Get local ipv4 addresses
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor ebx, ebx
mov rdi, rcx
mov rcx, rdx
mov dword [rsp + 0x3c], 0
lea r12, [rsp + 0x3c]
call dbg.rawsock_win_name
mov rbp, rax
jmp 0x14003222d
mov rcx, rbx
call sym.free
mov ecx, dword [rsp + 0x3c]
call sym.malloc
mov rbx, rax
test rax, rax
je 0x140032366
mov qword [rsp + 0x20], r12
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov ecx, 0x17
call sym.GetAdaptersAddresses
mov esi, eax
cmp eax, 0x6f
je 0x140032210
test eax, eax
jne 0x140032320
mov rsi, rbx
test rbx, rbx
jne 0x14003226d
jmp 0x140032343
mov rsi, qword [rsi + 8]
test rsi, rsi
je 0x14003238d
mov rcx, qword [rsi + 0x10]
mov rdx, rbp
call dbg.rawsock_is_adapter_names_equal
test eax, eax
je 0x140032260
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x140032360
movabs r8, 0x500000004
xor esi, esi
xor ebp, ebp
nop dword [rax + rax]
mov rdx, qword [rax + 0x10]
cmp word [rdx], 0x17
jne 0x1400322f0
cmp dword [rax + 4], 2
je 0x1400322f0
cmp dword [rax + 0x20], 2
je 0x1400322f0
cmp qword [rax + 0x20], r8
je 0x1400322f0
mov rcx, qword [rdx + 8]
cmp cl, 0xfb
ja 0x1400322f0
bswap rcx
mov r9, rcx
shr r9, 0x20
cmp r9, 0x20010db8
je 0x1400322f0
mov rsi, qword [rdx + 0x10]
mov rbp, rcx
bswap rsi
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [rax + 8]
test rax, rax
jne 0x1400322a0
mov rcx, rbx
call sym.free
mov rax, rdi
mov qword [rdi], rbp
mov qword [rdi + 8], rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, esi
lea rdx, str.GetAdaptersAddresses__:_failed:__u_n
mov rcx, rax
call sym.fprintf_1
xor ebp, ebp
xor esi, esi
jmp 0x140032301
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbp
lea rdx, str.GetAdaptersInfo:_adapter_not_found:__s_n
mov rcx, rax
call sym.fprintf_1
xor esi, esi
xor ebp, ebp
jmp 0x1400322f9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x37
mov edx, 1
lea rcx, str.GetAdaptersAddresses__:malloc__:_failed:_out_of_memory_n
mov r9, rax
call sym.fwrite
jmp 0x14003233d
jmp sym.rawsock_get_adapter_ipv6.cold
Function at 0x1400323a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov dword [rsp + 0x3c], 0x2c0
call dbg.rawsock_win_name
mov ecx, 0x2c0
mov rsi, rax
call sym.malloc
mov rbx, rax
test rax, rax
je 0x1400324af
lea rbp, [rsp + 0x3c]
jmp 0x1400323fd
mov rcx, rbx
call sym.free
mov ecx, dword [rsp + 0x3c]
call sym.malloc
mov rbx, rax
test rax, rax
je 0x1400324af
mov rdx, rbp
mov rcx, rbx
call sym.GetAdaptersInfo
cmp eax, 0x6f
je 0x1400323e0
mov rbp, rbx
test eax, eax
jne 0x140032485
nop word cs:[rax + rax]
nop
lea rcx, [rbp + 0xc]
mov rdx, rsi
call dbg.rawsock_is_adapter_names_equal
test eax, eax
jne 0x140032450
mov rbp, qword [rbp]
test rbp, rbp
jne 0x140032420
mov rcx, rbx
call sym.free
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp dword [rbp + 0x194], 6
je 0x140032470
mov eax, 0xe
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbp + 0x198]
mov dword [rdi], eax
movzx eax, word [rbp + 0x19c]
mov word [rdi + 4], ax
jmp 0x140032439
mov ecx, 2
mov dword [rsp + 0x2c], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [rsp + 0x2c]
lea rdx, str.if:_GetAdaptersInfo_failed_with_error:__u_n
mov rcx, rax
call sym.fprintf_1
mov eax, 0xe
jmp 0x14003245e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x37
mov edx, 1
lea rcx, [0x14006e390]
mov r9, rax
call sym.fwrite
jmp 0x140032459

Function at 0x1400324e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov dword [rsp + 0x3c], 0x2c0
call dbg.rawsock_win_name
mov ecx, 0x2c0
mov rbp, rax
call sym.malloc
mov rbx, rax
test rax, rax
je 0x1400325fb
lea rsi, [rsp + 0x3c]
jmp 0x14003253d
mov rcx, rbx
call sym.free
mov ecx, dword [rsp + 0x3c]
call sym.malloc
mov rbx, rax
test rax, rax
je 0x1400325fb
mov rdx, rsi
mov rcx, rbx
call sym.GetAdaptersInfo
cmp eax, 0x6f
je 0x140032520
mov rsi, rbx
test eax, eax
jne 0x1400325ca
nop word cs:[rax + rax]
nop
lea rcx, [rsi + 0xc]
mov rdx, rbp
call dbg.rawsock_is_adapter_names_equal
test eax, eax
jne 0x140032590
mov rsi, qword [rsi]
test rsi, rsi
jne 0x140032560
mov rcx, rbx
call sym.free
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
add rsi, 0x1e8
lea rcx, [rsi + 8]
call dbg.massip_parse_ipv4
cmp eax, 0xffffffff
jne 0x1400325c6
nop word cs:[rax + rax]
mov rsi, qword [rsi]
test rsi, rsi
je 0x140032578
lea rcx, [rsi + 8]
call dbg.massip_parse_ipv4
cmp eax, 0xffffffff
je 0x1400325b0
mov dword [rdi], eax
jmp 0x140032578
mov ecx, 2
mov dword [rsp + 0x2c], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [rsp + 0x2c]
lea rdx, [0x14006e438]
mov rcx, rax
call sym.fprintf_1
mov eax, 0xe
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x37
mov edx, 1
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
mov r9, rax
call sym.fwrite
jmp 0x1400325ed
Function at 0x140033090
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movabs rax, 0x40002a1b2c3d4
mov ebp, edx
xor edx, edx
mov qword [rsp + 0x20], rax
mov rdi, rcx
movabs rax, 0xff00000000000000
mov qword [rsp + 0x28], rdx
mov edx, 0x690000ff
mov qword [rsp + 0x31], rdx
lea rdx, [0x14006e72a]
mov qword [rsp + 0x29], rax
mov word [rsp + 0x34], bp
call sym.fopen
mov rsi, rax
test rax, rax
je 0x1400331a0
lea rcx, [rsp + 0x20]
mov r9, rax
mov r8d, 0x18
mov edx, 1
call sym.fwrite
cmp rax, 0x18
jne 0x140033160
mov edx, 1
mov ecx, 0x150
call sym.calloc
mov rbx, rax
test rax, rax
je 0x1400331d4
lea rcx, [rax + 0x1c]
mov r9, rdi
mov edx, 0x100
lea r8, [0x14006e727]
call sym.snprintf
mov qword [rbx], rsi
mov dword [rbx + 0x11c], 2
mov dword [rbx + 0x120], ebp
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 2
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x24
mov edx, 1
lea rcx, str.Could_not_write_capture_file_header_n
mov r9, rax
call sym.fwrite
mov rcx, rdi
call sym.perror
mov rcx, rsi
call sym.fclose
jmp 0x14003314d
mov ecx, 2
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Could_not_open_capture_file_n
mov r9, rax
call sym.fwrite
mov rcx, rdi
call sym.perror
jmp 0x14003314d
mov ecx, 1
call sym.exit
nop
nop
Function at 0x140033980
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x138
mov rsi, qword [0x140073360]
mov ebx, ecx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [rsi + 0x28]
cmp eax, 0xffffffff
je 0x140033a0f
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400339e0
sub ebx, 1
jmp 0x1400339c9
call qword [rsi + 0xa8]
sub ebx, 1
mov rcx, rax
test rax, rax
je 0x140033a0f
cmp ebx, 0xffffffff
jne 0x1400339b8
call qword [rsi + 0x98]
add rsp, 0x138
pop rbx
pop rsi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x3b
mov edx, 1
lea rcx, str.ERR:libpcap:_no_adapters_found__are_you_sure_you_are_root__n
mov r9, rax
call sym.fwrite
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jne 0x1400339ae
xor eax, eax
add rsp, 0x138
pop rbx
pop rsi
ret
Function at 0x140033ba0
Capabilities:
Get mac address on windows
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov ecx, 0x2c0
mov dword [rsp + 0x3c], 0x2c0
call sym.malloc
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140033e01
lea rbx, [rsp + 0x3c]
mov rcx, qword [rsp + 0x28]
mov rdx, rbx
call sym.GetAdaptersInfo
cmp eax, 0x6f
je 0x140033de0
mov rdx, rbx
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call sym.GetAdaptersInfo
test eax, eax
jne 0x140033e20
lea r14, [0x14017ecc0]
jmp 0x140033c2c
mov rbx, qword [rbx]
test rbx, rbx
je 0x140033dbc
cmp dword [rbx + 0x1a4], 6
jne 0x140033c20
lea r12, [rbx + 0xc]
mov rcx, r12
call sym.strlen
lea r15, [rax + 0xd]
mov rcx, r15
call sym.malloc
mov rbp, rax
mov eax, dword [rbx + 0x194]
lea esi, [rax + rax*2 + 1]
mov rcx, rsi
call sym.malloc
mov rdi, rax
test rbp, rbp
je 0x140033e30
test rax, rax
je 0x140033e30
mov rdx, r15
mov r9, r12
lea r8, str.DeviceNPF__s
mov rcx, rbp
call sym.snprintf
mov r13, rdi
add rsi, rdi
xor r15d, r15d
mov eax, dword [rbx + 0x194]
test eax, eax
jne 0x140033cca
jmp 0x140033cf8
lea r8, str._.2X_
mov rcx, r13
call sym.snprintf
mov eax, dword [rbx + 0x194]
add r15, 1
add r13, 3
cmp r15d, eax
jae 0x140033cf8
movzx r9d, byte [rbx + r15 + 0x198]
mov rdx, rsi
sub eax, 1
sub rdx, r13
cmp eax, r15d
jne 0x140033ca8
lea r8, str._.2X
mov rcx, r13
call sym.snprintf
jmp 0x140033cb7
mov eax, dword [0x14017eca0]
mov rcx, r12
lea r15, [rbx + 0x1c0]
mov rdx, rax
shl rax, 4
add rax, r14
add edx, 1
mov qword [rax], rdi
mov qword [rax + 8], rbp
mov dword [0x14017eca0], edx
call sym.strlen
lea rdx, [rax + 0xd]
mov rcx, rdx
mov qword [rsp + 0x20], rdx
call sym.malloc
mov rcx, r15
mov rsi, rax
call sym.strlen
lea rbp, [rax + 1]
mov rcx, rbp
call sym.malloc
mov rdi, rax
test rsi, rsi
je 0x140033e30
test rax, rax
mov rdx, qword [rsp + 0x20]
je 0x140033e30
mov r9, r12
lea r8, str.DeviceNPF__s
mov rcx, rsi
call sym.snprintf
mov rdx, rbp
mov r9, r15
mov rcx, rdi
lea r8, [0x14006e9b9]
call sym.snprintf
mov eax, dword [0x14017eca0]
mov rbx, qword [rbx]
mov rdx, rax
shl rax, 4
add rax, r14
add edx, 1
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov dword [0x14017eca0], edx
test rbx, rbx
jne 0x140033c2c
mov rcx, qword [rsp + 0x28]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.free
mov rcx, qword [rsp + 0x28]
call sym.free
mov ecx, dword [rsp + 0x3c]
call sym.malloc
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x140033beb
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo
call sym.puts
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, eax
lea rcx, str.GetAdaptersInfo_failed_with_error:__u_n
call sym.printf
jmp 0x140033dbc
mov ecx, 1
call sym.exit
nop
nop dword [rax + rax]
Function at 0x140033e40
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rsi, qword [0x140073360]
lea rbx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov rdx, rbx
call qword [rsi + 0x28]
cmp eax, 0xffffffff
je 0x140033fa8
mov rbx, qword [rsp + 0x28]
mov r12, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test rbx, rbx
je 0x140033f38
xor ebp, ebp
lea r13, str.__d___s__t
lea r14, str.__s__n
jmp 0x140033ed7
mov rcx, rbx
call qword [rsi + 0xa0]
mov ecx, 2
mov rdi, rax
call r12
mov r8, rdi
mov rdx, r14
mov rcx, rax
call sym.fprintf_1
mov rcx, rbx
call qword [rsi + 0xa8]
mov rbx, rax
test rax, rax
je 0x140033f70
mov rcx, rbx
mov r15d, ebp
add ebp, 1
call qword [rsi + 0x98]
mov ecx, 2
mov rdi, rax
call r12
mov r9, rdi
mov r8d, r15d
mov rdx, r13
mov rcx, rax
call sym.fprintf_1
mov rcx, rbx
call qword [rsi + 0xa0]
test rax, rax
jne 0x140033ea0
mov ecx, 2
call r12
mov r8d, 0x1b
mov edx, 1
lea rcx, str._No_description_available__n
mov r9, rax
call sym.fwrite
jmp 0x140033ec2
mov ecx, 2
call r12
mov r8d, 0x3b
mov edx, 1
lea rcx, str.ERR:libpcap:_no_adapters_found__are_you_sure_you_are_root__n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
test rbx, rbx
jne 0x140033e88
nop dword [rax + rax]
mov ecx, 2
call r12
mov ecx, 0xa
mov rdx, rax
call sym.fputc
mov rcx, qword [rsp + 0x28]
call qword [rsi + 0x30]
nop
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, [0x14006ea13]
mov rcx, rax
call sym.fprintf_1
jmp 0x140033f8e
Function at 0x1400354f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rbp, rcx
lea rdx, [0x14006f085]
mov r12d, r9d
mov rcx, rsi
call sym.fprintf_1
mov eax, dword [rbp + 8]
test eax, eax
je 0x14003561b
xor r15d, r15d
lea r13, [0x14006f08f]
jmp 0x140035582
test r15d, r15d
jne 0x140035680
test r12d, r12d
je 0x140035558
mov r9, rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x14006f089]
call sym.fwrite
mov r14d, edi
mov r8d, ebx
xor r12d, r12d
mov rdx, r13
mov rcx, rsi
call sym.fprintf_1
cmp ebx, edi
jl 0x1400355fb
add r15, 1
cmp r15d, dword [rbp + 8]
jae 0x14003561b
mov rax, qword [rbp]
lea rax, [rax + r15*8]
mov ebx, dword [rax]
mov edi, dword [rax + 4]
cmp ebx, 0xffff
jbe 0x140035530
lea r14d, [rbx - 0x10000]
cmp r14d, 0xffff
jbe 0x140035640
lea r8d, [rbx - 0x20000]
lea r14d, [rdi - 0x20000]
test r15d, r15d
jne 0x1400356b0
cmp r12d, 0x20000
je 0x1400355e2
mov rdx, rsi
mov ecx, 0x53
mov dword [rsp + 0x2c], r8d
call sym.fputc
mov r8d, dword [rsp + 0x2c]
mov rdx, r13
mov rcx, rsi
mov r12d, 0x20000
call sym.fprintf_1
cmp ebx, edi
jge 0x140035574
mov r8d, r14d
lea rdx, [0x14006f092]
mov rcx, rsi
add r15, 1
call sym.fprintf_1
cmp r15d, dword [rbp + 8]
jb 0x140035582
mov rdx, rsi
mov ecx, 0xa
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.fputc
test r15d, r15d
jne 0x140035698
cmp r12d, 0x10000
je 0x140035668
mov r9, rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x14006f08c]
call sym.fwrite
mov r8d, r14d
mov r12d, 0x10000
lea r14d, [rdi - 0x10000]
jmp 0x140035561
mov rdx, rsi
mov ecx, 0x2c
call sym.fputc
jmp 0x140035539
mov rdx, rsi
mov ecx, 0x2c
call sym.fputc
jmp 0x140035645
mov rdx, rsi
mov ecx, 0x2c
mov dword [rsp + 0x2c], r8d
call sym.fputc
cmp r12d, 0x20000
mov r8d, dword [rsp + 0x2c]
jne 0x1400355cb
jmp 0x1400355e2
Function at 0x1400380d0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12d, dword [rcx + 8]
mov rsi, qword [rcx]
mov r13d, r8d
mov rbp, rcx
mov rbx, rdx
lea ecx, [r12 + r13]
shl rcx, 3
call sym.malloc
mov rdi, rax
test rax, rax
je 0x1400381aa
mov r8d, r12d
xor eax, eax
lea rcx, [r8*8]
test r12d, r12d
je 0x140038131
nop word [rax + rax]
mov rdx, qword [rsi + rax]
mov qword [rdi + rax], rdx
add rax, 8
cmp rax, rcx
jne 0x140038120
lea rcx, [rsi + r8*8]
mov r9, rbx
lea r10, [rbx + r13*8]
mov r8d, r12d
mov rdx, qword [r9]
test r12d, r12d
je 0x140038170
mov rax, rsi
jmp 0x140038159
add rax, 8
cmp rax, rcx
je 0x140038170
cmp rdx, qword [rax]
jne 0x140038150
add r9, 8
cmp r9, r10
je 0x140038186
mov rdx, qword [r9]
jmp 0x140038147
add r9, 8
mov qword [rdi + r8*8], rdx
lea ebx, [r8 + 1]
cmp r9, r10
je 0x140038189
mov r8d, ebx
jmp 0x14003813f
mov ebx, r8d
test rsi, rsi
je 0x140038196
mov rcx, rsi
call sym.free
mov qword [rbp], rdi
mov dword [rbp + 8], ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r8, [0x14006ff70]
lea rdx, [0x14006ff76]
mov rcx, rax
call sym.fprintf_1
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]

Function at 0x140038330
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov esi, edx
mov ecx, 0x558
mov edx, 1
call sym.calloc
mov rbx, rax
test rax, rax
je 0x140038399
movzx eax, byte [rax + 8]
mov edx, esi
mov rcx, rdi
and edx, 1
and eax, 0xfffffffe
or eax, edx
mov byte [rbx + 8], al
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x140038399
mov r8, rsi
mov rdx, rdi
call sym.memcpy
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r8, [0x14006ff70]
lea rdx, [0x14006ff76]
mov rcx, rax
call sym.fprintf_1
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
Function at 0x1400383d0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1400383f0
call sym.free
mov qword [rsi + 0x20], 0
mov rdx, qword [rsi + 0x30]
test rdx, rdx
je 0x14003845a
mov r9d, dword [rsi + 0x28]
test r9d, r9d
je 0x14003844a
xor ebx, ebx
jmp 0x140038422
test rcx, rcx
jne 0x1400384b7
add rbx, 1
cmp ebx, dword [rsi + 0x28]
jae 0x14003844a
mov rax, rbx
shl rax, 4
add rax, rdx
mov r8d, dword [rax + 8]
mov rcx, qword [rax]
test r8d, r8d
je 0x140038410
call sym.free
add rbx, 1
mov rdx, qword [rsi + 0x30]
cmp ebx, dword [rsi + 0x28]
jb 0x140038422
mov rcx, rdx
call sym.free
mov qword [rsi + 0x30], 0
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140038497
mov eax, dword [rsi + 0x18]
test eax, eax
je 0x140038492
xor ebx, ebx
nop dword [rax]
mov rdi, qword [rcx + rbx*8]
add rbx, 1
mov rcx, qword [rdi + 8]
call sym.free
mov rcx, rdi
call sym.free
mov rcx, qword [rsi + 0x10]
cmp ebx, dword [rsi + 0x18]
jb 0x140038470
call sym.free
mov rcx, qword [rsi + 0x550]
test rcx, rcx
je 0x1400384a8
call sym.free
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.free
mov r8d, 0x1e5
lea rdx, str.src_smack1.c
lea rcx, str.match__m_ids__NULL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400384e0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebx, dword [rsp + 0x90]
mov rsi, rcx
mov ecx, 0x18
mov rbp, rdx
mov r12d, r8d
mov r13, r9
call sym.malloc
mov rdi, rax
test rax, rax
je 0x1400386aa
mov dword [rax + 0x10], r12d
mov eax, ebx
mov edx, ebx
lea ecx, [r12 + 1]
shr eax, 1
and edx, 1
mov qword [rdi], r13
and eax, 1
add eax, eax
or eax, edx
mov edx, ebx
shr ebx, 3
shr edx, 2
and ebx, 1
and edx, 1
shl ebx, 3
shl edx, 2
or eax, edx
movzx edx, byte [rdi + 0x14]
or eax, ebx
movzx ebx, byte [rsi + 8]
and edx, 0xfffffff0
or eax, edx
and ebx, 1
mov byte [rdi + 0x14], al
call sym.malloc
mov r13, rax
test rax, rax
je 0x1400386aa
mov r14d, r12d
test bl, bl
je 0x140038620
mov r15, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
xor ebx, ebx
test r12d, r12d
je 0x1400385a6
nop word [rax + rax]
movzx ecx, byte [rbp + rbx]
call r15
mov byte [r13 + rbx], al
add rbx, 1
cmp rbx, r14
jne 0x140038590
movzx ebx, byte [rdi + 0x14]
mov byte [r13 + r14], 0
mov qword [rdi + 8], r13
test bl, 1
je 0x1400385bd
or byte [rsi + 8], 2
test bl, 2
jne 0x140038610
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call dbg.smack_add_symbols
and ebx, 4
jne 0x140038690
mov ebx, dword [rsi + 0x18]
mov eax, dword [rsi + 0x1c]
lea r12d, [rbx + 1]
cmp r12d, eax
jae 0x140038638
mov rbp, qword [rsi + 0x10]
mov qword [rbp + rbx*8], rdi
mov dword [rsi + 0x18], r12d
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
or byte [rsi + 8], 4
jmp 0x1400385c2
mov r8, r14
mov rdx, rbp
mov rcx, rax
call sym.memcpy
jmp 0x1400385a6
lea ecx, [rax + rax + 1]
mov r13, rcx
shl rcx, 3
call sym.malloc
mov rbp, rax
test rax, rax
je 0x1400386aa
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x14003867a
mov r8d, ebx
mov rdx, r14
mov rcx, rax
shl r8, 3
call sym.memcpy
mov rcx, r14
call sym.free
mov ebx, dword [rsi + 0x18]
lea r12d, [rbx + 1]
mov qword [rsi + 0x10], rbp
mov dword [rsi + 0x1c], r13d
jmp 0x1400385ec
mov r8d, 1
lea rdx, [0x14006ffb1]
mov rcx, rsi
call dbg.smack_add_symbols
jmp 0x1400385d9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r8, [0x14006ff70]
lea rdx, [0x14006ff76]
mov rcx, rax
call sym.fprintf_1
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
Function at 0x140039430
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x70], xmm7
lea rcx, str.___smack_1___
call sym.puts
mov edx, 1
lea rcx, str.benchmark1
call dbg.smack_create
mov ecx, 0x100000
mov rdi, rax
call sym.malloc
mov rbp, rax
test rax, rax
je 0x1400396aa
lea rcx, [rax + 0x100000]
xor ebx, ebx
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop dword [rax]
imul ebx, ebx, 0x343fd
add rax, 1
add ebx, 0x269ec3
mov edx, ebx
shr edx, 0x10
and edx, 0x7f
mov byte [rax - 1], dl
cmp rcx, rax
jne 0x1400394a0
xor r13d, r13d
lea rsi, [rsp + 0x40]
mov r12d, 0xaaaaaaab
nop
imul eax, ebx, 0x343fd
add eax, 0x269ec3
imul ebx, eax, 0x343fd
shr eax, 0x10
and eax, 0x7fff
mov edx, eax
imul rdx, r12
add ebx, 0x269ec3
shr rdx, 0x21
lea edx, [rdx + rdx*2]
sub eax, edx
mov edx, ebx
shr edx, 0x10
and edx, 3
lea ecx, [rax + rdx + 4]
mov rax, rsi
mov r8, rcx
add rcx, rsi
nop word cs:[rax + rax]
nop
imul ebx, ebx, 0x343fd
add rax, 1
add ebx, 0x269ec3
mov edx, ebx
shr edx, 0x10
or edx, 0xffffff80
mov byte [rax - 1], dl
cmp rcx, rax
jne 0x140039520
mov dword [rsp + 0x20], 0
mov r9, r13
mov rdx, rsi
mov rcx, rdi
add r13, 1
call dbg.smack_add_pattern
cmp r13, 0x14
jne 0x1400394d0
mov rcx, rdi
mov r13d, 0x1e
lea r12, [rsp + 0x3c]
xor ebx, ebx
call dbg.smack_compile
call dbg.pixie_nanotime
mov r14, rax
nop word cs:[rax + rax]
nop dword [rax]
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
mov r9, rsi
mov r8, rbp
mov rdx, r12
mov rcx, rdi
mov dword [rsp + 0x20], 0x100000
call dbg.smack_search_next
add rbx, rax
cmp dword [rsp + 0x40], 0xfffff
jbe 0x1400395a0
sub r13d, 1
jne 0x140039590
call dbg.pixie_nanotime
test rbx, rbx
jne 0x1400395fa
mov rcx, rbp
call sym.free
nop
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
sub rax, r14
js 0x14003968c
pxor xmm6, xmm6
cvtsi2sd xmm6, rax
movsd xmm1, qword [0x1400701c0]
divsd xmm6, qword [0x1400701b8]
lea rcx, str.bits_second___5.3f_million_n
pxor xmm7, xmm7
divsd xmm1, xmm6
divsd xmm1, qword [0x1400701c8]
movq rdx, xmm1
call sym.printf
movsd xmm0, qword [0x1400701d0]
movsd xmm1, qword [0x1400701d8]
lea rcx, str.clocks_byte___5.3f_n
divsd xmm0, xmm7
divsd xmm1, xmm0
movq rdx, xmm1
call sym.printf
divsd xmm7, xmm6
lea rcx, str.clockrate___5.3f_GHz_n
movapd xmm1, xmm7
divsd xmm1, qword [0x1400701b8]
movq rdx, xmm1
call sym.printf
jmp 0x1400395d6
mov rdx, rax
and eax, 1
pxor xmm6, xmm6
shr rdx, 1
or rdx, rax
cvtsi2sd xmm6, rdx
addsd xmm6, xmm6
jmp 0x14003960c
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r8, [0x14006ff70]
lea rdx, [0x14006ff76]
mov rcx, rax
call sym.fprintf_1
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
Function at 0x140039d80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov edx, 1
mov ecx, 0x10
call sym.calloc
test rax, rax
je 0x140039d9d
add rsp, 0x28
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r8, str.smack
lea rdx, str._s:_out_of_memory_error_n
mov rcx, rax
call sym.fprintf_1
mov ecx, 1
call sym.exit
nop
nop dword [rax]

Function at 0x140039e10
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov ecx, 0x10
mov esi, edx
call sym.malloc
test rax, rax
je 0x140039e55
cmp qword [rbx], 0
je 0x140039e50
mov rdx, qword [rbx + 8]
mov qword [rdx + 8], rax
mov dword [rax], esi
mov qword [rax + 8], 0
mov qword [rbx + 8], rax
add rsp, 0x28
pop rbx
pop rsi
ret
mov qword [rbx], rax
jmp 0x140039e38
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea r8, str.smack
lea rdx, str._s:_out_of_memory_error_n
mov rcx, rax
call sym.fprintf_1
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]