joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002e10
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
test rax, rax
mov rbx, rcx
je 0x140002e4e
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002ed0
sub rdx, 0x10
jo 0x140002f06
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140002e61
test byte [rcx + 7], 0x40
je 0x140002ef0
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u75
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140002f00
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002eb0
sub rdx, 0x10
jo 0x140002f10
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3465
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x140002e4e
call sym.deallocShared
jmp 0x140002e61
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x140002e4e
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow

Function at 0x140002f20
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
test rax, rax
mov rbx, rcx
je 0x140002f5e
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002fe0
sub rdx, 0x10
jo 0x140003016
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140002f71
test byte [rcx + 7], 0x40
je 0x140003000
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u75
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140003010
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002fc0
sub rdx, 0x10
jo 0x140003020
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3465
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x140002f5e
call sym.deallocShared
jmp 0x140002f71
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x140002f5e
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow
Function at 0x140003030
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
test rax, rax
mov rbx, rcx
je 0x14000306e
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x1400030f0
sub rdx, 0x10
jo 0x140003126
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140003081
test byte [rcx + 7], 0x40
je 0x140003110
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u75
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140003120
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x1400030d0
sub rdx, 0x10
jo 0x140003130
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3465
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x14000306e
call sym.deallocShared
jmp 0x140003081
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x14000306e
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow

Function at 0x140003140
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
test rax, rax
mov rbx, rcx
je 0x14000317e
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140003200
sub rdx, 0x10
jo 0x140003236
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140003191
test byte [rcx + 7], 0x40
je 0x140003220
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u75
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140003230
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x1400031e0
sub rdx, 0x10
jo 0x140003240
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3465
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x14000317e
call sym.deallocShared
jmp 0x140003191
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x14000317e
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow
Function at 0x140003cb0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
mov rcx, rdx
mov qword [rbx], rdx
js 0x140003cd8
call sym.allocShared0Impl__system_u1757
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp sym.raiseRangeErrorI

Function at 0x140004200
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140004210
jmp sym.deallocShared
ret

Function at 0x140004580
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movzx eax, byte [rdx]
mov rbx, qword [rcx + 0x10]
movzx edi, byte [rcx]
mov rbp, qword [rdx + 8]
test al, al
mov rsi, qword [rdx + 0x10]
mov byte [rcx], al
mov qword [rcx + 9], 0
mov qword [rcx + 1], 0
mov qword [rcx + 0x10], 0
je 0x1400045d0
test dil, dil
mov qword [rcx + 8], rbp
je 0x1400045f8
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
test rsi, rsi
mov qword [rcx + 8], 0
je 0x1400045eb
mov rax, qword [rsi - 0x10]
add rax, 0x10
jo 0x14000465a
mov qword [rsi - 0x10], rax
test dil, dil
mov qword [rcx + 0x10], rsi
mov qword [rcx + 8], rbp
jne 0x1400045c1
test rbx, rbx
je 0x1400045c1
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x140004630
sub rax, 0x10
jo 0x14000464d
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rememberCycle__system_u3465
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.nimDestroyAndDispose
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.raiseOverflow
mov qword [rsp + 0x28], rcx
call sym.raiseOverflow
mov rcx, qword [rsp + 0x28]
jmp 0x1400045eb

Function at 0x140004880
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx], 0
mov rbx, rcx
je 0x140004898
add rsp, 0x20
pop rbx
ret
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14000488d
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x1400048d0
sub rdx, 0x10
jo 0x1400048ee
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3465
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3465
mov rcx, qword [rbx + 0x10]
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow

Function at 0x1400049e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rcx, [0x140037040]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
add rsp, 0x28
jmp sym.nimTestErrorFlag

Function at 0x140005d50
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
mov edx, 1
mov r9, rdi
mov rsi, r8
call sym.fread
cmp rsi, rax
mov rbx, rax
je 0x140005d81
mov rcx, rdi
call sym.ferror
test eax, eax
jne 0x140005d90
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rdi
call sym.checkErr__stdZsyncio_u162.part.0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140005de0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rax, [0x14002f380]
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x30]
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x20]
mov edx, 0xfa0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov rbp, qword [0x140032120]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
test rbx, rbx
mov qword [rsp + 0x48], rax
jle 0x140005fc0
nop word [rax + rax]
mov rax, qword [rsp + 0x48]
mov r9, rsi
mov r8d, 0xfa0
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
cmp rax, 0xfa0
mov rbx, rax
je 0x140005f50
mov rcx, rsi
call sym.ferror
test eax, eax
je 0x140005e97
mov rcx, rsi
call sym.checkErr__stdZsyncio_u162.part.0
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140006008
test rbx, rbx
js 0x140006028
lea rcx, [rsp + 0x40]
mov rdx, rbx
call sym.setLengthStrV2
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
jle 0x140005f28
mov r8, rbx
add r8, 1
jo 0x140005ffd
test r8, r8
js 0x140006046
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea rax, [rdx + rax + 8]
lea rdx, [rcx + 8]
mov rcx, rax
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140005ffd
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
test rcx, rcx
je 0x140005f37
test byte [rcx + 7], 0x40
je 0x140006018
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140006008
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rbx, rbx
jle 0x140005fc0
mov r8, rbx
add r8, 1
jo 0x140005fd5
test r8, r8
js 0x140005fe0
mov rax, qword [rsp + 0x30]
add rdx, 8
mov rcx, qword [rsp + 0x38]
lea rcx, [rcx + rax + 8]
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140005fd5
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jg 0x140005e58
nop dword [rax]
lea rdx, [rbx - 1]
xor ecx, ecx
call sym.raiseIndexError2
mov rcx, qword [rsp + 0x48]
jmp 0x140005f28
call sym.raiseOverflow
jmp 0x140005faf
movabs r8, 0x7fffffffffffffff
xor edx, edx
movabs rcx, 0x8000000000000000
call sym.raiseRangeErrorI
jmp 0x140005faf
call sym.raiseOverflow
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
jmp 0x140005f28
call sym.deallocShared
jmp 0x140005f37
movabs r8, 0x7fffffffffffffff
mov rcx, rbx
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x140005f28
movabs rcx, 0x8000000000000000
xor edx, edx
movabs r8, 0x7fffffffffffffff
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x140005f28
Function at 0x140006070
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test r8, r8
mov rdi, rcx
mov rsi, rdx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rbx, r8
js 0x140006170
lea r14, [rsp + 0x20]
mov rdx, r8
mov rcx, r14
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov rdx, rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
test rdx, rdx
mov qword [rsp + 0x38], rax
jle 0x1400061c0
mov rax, qword [rsp + 0x38]
mov r9, rsi
mov r8, rbx
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
cmp rbx, rax
mov rbp, rax
je 0x140006103
mov rcx, rsi
call sym.ferror
test eax, eax
jne 0x140006190
mov rcx, qword [0x140032120]
call dbg.__emutls_get_address
cmp byte [rax], 0
mov r12, rax
jne 0x140006153
mov rcx, rsi
call sym.fgetc
mov rdx, rsi
mov ecx, eax
mov r13d, eax
call sym.ungetc
cmp byte [r12], 0
jne 0x140006153
test r13d, r13d
jns 0x1400061d0
cmp rbx, rbp
jle 0x140006153
test rbp, rbp
js 0x1400061a0
lea rcx, [rsp + 0x30]
mov rdx, rbp
call sym.setLengthStrV2
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
call sym.raiseRangeErrorI
jmp 0x140006153
mov rcx, rsi
call sym.checkErr__stdZsyncio_u162.part.0
jmp 0x140006103
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
call sym.raiseRangeErrorI
jmp 0x140006153
sub rdx, 1
xor ecx, ecx
call sym.raiseIndexError2
jmp 0x140006153
mov rdx, rsi
mov rcx, r14
call sym.readAllBuffer__stdZsyncio_u497
cmp byte [r12], 0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jne 0x140006230
lea rcx, [rsp + 0x30]
mov rdx, rbx
call sym.prepareAdd
test rbx, rbx
jle 0x140006230
mov r8, rbx
add r8, 1
jo 0x140006250
test r8, r8
js 0x140006260
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea rcx, [rdx + rax + 8]
lea rdx, [rsi + 8]
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140006250
mov qword [rsp + 0x30], rbx
test rsi, rsi
je 0x140006153
test byte [rsi + 7], 0x40
jne 0x140006153
mov rcx, rsi
call sym.deallocShared
jmp 0x140006153
call sym.raiseOverflow
jmp 0x140006230
movabs r8, 0x7fffffffffffffff
xor edx, edx
movabs rcx, 0x8000000000000000
call sym.raiseRangeErrorI
jmp 0x140006230
Function at 0x140006510
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor ecx, ecx
call rdi
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov rcx, rax
call rsi
mov edx, 0x8000
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
mov ecx, eax
call rbx
mov ecx, 1
call rdi
mov rcx, rax
call rsi
mov edx, 0x8000
mov ecx, eax
call rbx
mov ecx, 2
call rdi
mov rcx, rax
call rsi
mov edx, 0x8000
mov ecx, eax
call rbx
call qword [0x1400370c0]
mov dword [0x1400370c8], eax
call qword [0x1400370b0]
cmp dword [0x1400370c8], 0xfde9
mov dword [0x1400370b8], eax
je 0x1400065db
mov ecx, 0xfde9
call qword [0x1400370a8]
lea rax, [sym.restoreConsoleOutputCP__stdZsyncio_u656]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
movdqa xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.addExitProc__stdZexitprocs_u184
mov rcx, qword [0x140032120]
call dbg.__emutls_get_address
mov rdx, rax
mov eax, dword [0x1400370b8]
cmp byte [rdx], 0
jne 0x140006618
cmp eax, 0xfde9
je 0x140006618
mov ecx, 0xfde9
call qword [0x1400370a0]
lea rax, [sym.restoreConsoleCP__stdZsyncio_u657]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
movdqa xmm1, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm1
call sym.addExitProc__stdZexitprocs_u184
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
jmp sym.nimTestErrorFlag

Function at 0x140006760
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, rdx
mov rsi, rdx
call sym.strlen
mov rcx, rsi
mov r9, rbx
mov edx, 1
mov r8, rax
call sym.fwrite
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fflush

Function at 0x140006860
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
mov ecx, 2
call rsi
lea rdx, str.could_not_load:
mov rcx, rax
call sym.rawWrite
lea rax, [0x14002f458]
mov ecx, 2
add rbx, 8
test rdi, rdi
cmove rbx, rax
call rsi
mov rcx, rax
mov rdx, rbx
call sym.rawWrite
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
je 0x1400068dc
mov ecx, 2
call rsi
lea rdx, [0x14002f4a1]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
mov ecx, 2
call rsi
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call sym.rawWrite
jmp 0x1400068bc

Function at 0x140006900
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
lea rdx, [0x14002f4a1]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop dword [rax]
Function at 0x140006a80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140037120]
test rax, rax
je 0x140006a92
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop word [rax + rax]

Function at 0x140007850
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r10, qword [rdx + 8]
mov r9, rdx
sar rdx, 0x15
mov r8, rcx
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x28a0]
test rax, rax
jne 0x140007880
jmp 0x1400078aa
mov rax, qword [rax]
test rax, rax
je 0x1400078aa
cmp rdx, qword [rax + 8]
jne 0x140007878
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2870]
mov rdx, qword [r8 + 0x2878]
mov rcx, rax
sub rcx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2870], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x1400078f5
add rsp, 0x28
ret
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop dword [rax]

Function at 0x140007c80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [rdx + 8]
sub qword [rcx + 0x2888], rax
mov r10, qword [rdx + 8]
mov r8, rcx
mov r9, rdx
cmp r10, 0x3f000000
jg 0x140007cb0
add rsp, 0x28
jmp sym.freeBigChunk__system_u6620
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x28a0]
test rax, rax
jne 0x140007d20
nop dword [rax]
mov rax, qword [r8 + 0x2870]
mov rdx, qword [r8 + 0x2878]
mov rcx, rax
sub rcx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2870], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140007d4f
add rsp, 0x28
ret
mov rax, qword [rax]
test rax, rax
je 0x140007cc8
cmp rdx, qword [rax + 8]
jne 0x140007d18
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
jmp 0x140007cc8
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
Function at 0x140007d70
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edi, 0x15
mov r12d, 1
mov rbx, rcx
mov rsi, rdx
jmp 0x140007dbb
mov rcx, rbx
call sym.freeBigChunk__system_u6620
sub rdi, 1
je 0x140007e98
test r13, r13
je 0x140007eb8
lea rax, [rsi + 0x18]
mov r13, qword [rsi + 0x18]
mov r9, rsi
mov qword [rax], 0
mov rdx, r9
mov rax, qword [r9 + 8]
sub qword [rbx + 0x2888], rax
mov rsi, r13
mov r8, qword [r9 + 8]
cmp r8, 0x3f000000
jle 0x140007da0
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rbx + rax*8 + 0x28a0]
test rax, rax
jne 0x140007e10
jmp 0x140007e38
mov rax, qword [rax]
test rax, rax
je 0x140007e38
cmp rdx, qword [rax + 8]
jne 0x140007e08
mov rcx, r9
mov rdx, r12
sar rcx, 0xc
and ecx, 0x1ff
mov r10, rcx
shl rdx, cl
sar r10, 6
not rdx
and qword [rax + r10*8 + 0x10], rdx
mov rax, qword [rbx + 0x2870]
mov rdx, qword [rbx + 0x2878]
mov rcx, rax
sub rcx, r8
cmp rax, rdx
mov r8d, 0x8000
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rbx + 0x2870], xmm0
call rbp
test eax, eax
jne 0x140007da8
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop dword [rax + rax]
test r13, r13
je 0x140007eb8
lea rdx, [rbx + 0x2898]
lea rcx, [r13 + 0x18]
mov rax, qword [rdx]
mov qword [rcx], rax
mov rax, qword [rcx]
lock cmpxchg qword [rdx], r13
jne 0x140007ec5
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rcx], rax
jmp 0x140007ea8
Function at 0x140008d90
Capabilities:
Terminate process

Disassembly:
mov r8, rdx
and rdx, 0xfffffffffffff000
mov rax, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
cmp rax, 0xfc0
jle 0x140008dd0
lea r8, [r10 + 0x2898]
cmp rcx, r10
lea r9, [rdx + 0x18]
je 0x140008e50
mov rax, qword [r8]
mov qword [r9], rax
mov rax, qword [r9]
lock cmpxchg qword [r8], rdx
jne 0x140008e40
ret
lea r9, [rax + 0xf]
test rax, rax
cmovns r9, rax
sar r9, 4
cmp rcx, r10
je 0x140008e10
lea rcx, [r9*8 + 0x800]
mov rax, qword [r10 + rcx]
mov qword [r8], rax
mov r9, qword [rdx + 0x10]
mov rax, qword [r8]
lock cmpxchg qword [r9 + rcx], r8
je 0x140008dce
mov qword [r8], rax
mov r10, qword [rdx + 0x10]
jmp 0x140008dec
sub qword [rcx + 0x2888], rax
lea r9, [rcx + r9*8]
mov rcx, qword [r9]
test rcx, rcx
je 0x140008e58
cmp rcx, rdx
je 0x140008e58
mov rdx, qword [rcx + 0x28]
mov qword [r8], rdx
add dword [rcx + 0x30], eax
mov qword [rcx + 0x28], r8
add qword [rcx + 0x38], 1
ret
mov qword [r9], rax
jmp 0x140008dbe
jmp sym.deallocBigChunk__system_u6690
mov rcx, qword [rdx + 0x28]
mov qword [r8], rcx
mov qword [rdx + 0x28], r8
movsxd r8, dword [rdx + 0x30]
cmp r8, rax
mov rcx, r8
jl 0x140008ec8
add ecx, eax
cmp ecx, 0xfc0
mov dword [rdx + 0x30], ecx
jne 0x140008dce
cmp qword [rdx + 0x38], 0
jne 0x140008dce
cmp rdx, qword [r9]
mov rax, qword [rdx + 0x18]
je 0x140008ee0
mov rcx, qword [rdx + 0x20]
test rax, rax
mov qword [rcx + 0x18], rax
je 0x140008ea9
mov rcx, qword [rdx + 0x20]
mov qword [rax + 0x20], rcx
mov rcx, r10
pxor xmm0, xmm0
mov qword [rdx + 8], 0x1000
movups xmmword [rdx + 0x18], xmm0
jmp sym.freeBigChunk__system_u6620
mov rcx, qword [r9]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x140008ed8
mov qword [rcx + 0x20], rdx
mov qword [r9], rdx
add dword [rdx + 0x30], eax
ret
test rax, rax
mov qword [r9], rax
je 0x140008ea9
mov qword [rax + 0x20], 0
jmp 0x140008ea9
Function at 0x140008f00
Capabilities:
Terminate process

Disassembly:
mov r8, rdx
and rdx, 0xfffffffffffff000
mov rax, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
cmp rax, 0xfc0
jle 0x140008f40
lea r8, [r10 + 0x2898]
cmp rcx, r10
lea r9, [rdx + 0x18]
je 0x140008fc0
mov rax, qword [r8]
mov qword [r9], rax
mov rax, qword [r9]
lock cmpxchg qword [r8], rdx
jne 0x140008fb0
ret
lea r9, [rax + 0xf]
test rax, rax
cmovns r9, rax
sar r9, 4
cmp rcx, r10
je 0x140008f80
lea rcx, [r9*8 + 0x800]
mov rax, qword [r10 + rcx]
mov qword [r8], rax
mov r9, qword [rdx + 0x10]
mov rax, qword [r8]
lock cmpxchg qword [r9 + rcx], r8
je 0x140008f3e
mov qword [r8], rax
mov r10, qword [rdx + 0x10]
jmp 0x140008f5c
sub qword [rcx + 0x2888], rax
lea r9, [rcx + r9*8]
mov rcx, qword [r9]
test rcx, rcx
je 0x140008fc8
cmp rdx, rcx
je 0x140008fc8
mov rdx, qword [rcx + 0x28]
mov qword [r8], rdx
add dword [rcx + 0x30], eax
mov qword [rcx + 0x28], r8
add qword [rcx + 0x38], 1
ret
mov qword [r9], rax
jmp 0x140008f2e
jmp sym.deallocBigChunk__system_u6690
mov rcx, qword [rdx + 0x28]
mov qword [r8], rcx
mov qword [rdx + 0x28], r8
movsxd r8, dword [rdx + 0x30]
cmp rax, r8
mov rcx, r8
jg 0x140009038
add ecx, eax
cmp ecx, 0xfc0
mov dword [rdx + 0x30], ecx
jne 0x140008f3e
cmp qword [rdx + 0x38], 0
jne 0x140008f3e
cmp rdx, qword [r9]
mov rax, qword [rdx + 0x18]
je 0x140009050
mov rcx, qword [rdx + 0x20]
test rax, rax
mov qword [rcx + 0x18], rax
je 0x140009019
mov rcx, qword [rdx + 0x20]
mov qword [rax + 0x20], rcx
mov rcx, r10
pxor xmm0, xmm0
mov qword [rdx + 8], 0x1000
movups xmmword [rdx + 0x18], xmm0
jmp sym.freeBigChunk__system_u6620
mov rcx, qword [r9]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x140009048
mov qword [rcx + 0x20], rdx
mov qword [r9], rdx
add dword [rdx + 0x30], eax
ret
test rax, rax
mov qword [r9], rax
je 0x140009019
mov qword [rax + 0x20], 0
jmp 0x140009019