joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076b90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x148]
mov rbx, rcx
test rax, rax
je 0x140076bba
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140076c99
jmp 0x140076c88
mov edi, 0x70
mov ecx, edi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x140076bf5
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], edi
mov r8, rdi
mov rcx, rax
mov qword [rbx + 0x148], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x120]
test rcx, rcx
jne 0x140076c28
mov rcx, rbx
call fcn.140076840
mov rcx, qword [rbx + 0x120]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0x148]
lea rdi, [rbx + 0x128]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jne 0x140076c79
mov rcx, rdi
call fcn.140078bb0
mov rcx, qword [rdi + 0x18]
mov rax, qword [rbx + 0x148]
movups xmm0, xmmword [rcx]
movdqu xmmword [rax + 0x60], xmm0
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
lea r8, str.pDump__array.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x5ea
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3

Function at 0x140076cc0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x128]
mov rbx, rcx
test rax, rax
je 0x140076ce6
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140076db8
jmp 0x140076dac
mov ecx, 0x68
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x140076d1f
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x68
mov r8d, 0x68
mov rcx, rax
mov qword [rbx + 0x128], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x120]
test rcx, rcx
jne 0x140076d56
mov rcx, rbx
call fcn.140076840
mov rcx, qword [rbx + 0x120]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0x128]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 3
mov rax, qword [rbx + 0x128]
setne cl
mov byte [rax + 0x60], cl
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__array.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x601
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140076de0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x128]
mov rbx, rcx
test rax, rax
je 0x140076e06
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140076ed8
jmp 0x140076ecc
mov ecx, 0x68
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x140076e3f
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x68
mov r8d, 0x68
mov rcx, rax
mov qword [rbx + 0x128], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x120]
test rcx, rcx
jne 0x140076e76
mov rcx, rbx
call fcn.140076840
mov rcx, qword [rbx + 0x120]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0x128]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 3
mov rax, qword [rbx + 0x128]
setne cl
mov byte [rax + 0x60], cl
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__array.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x617
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140076f00
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xb0]
mov rsi, rcx
test rax, rax
je 0x140076f2f
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400770f3
jmp 0x1400770ba
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400770d0
add dword [0x140134854], 0x20
xorps xmm0, xmm0
mov qword [rsi + 0xb0], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [rsi + 0x80]
test rcx, rcx
jne 0x140076f7c
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov rax, qword [rsi + 0xb0]
mov qword [rax], rcx
mov rcx, rsi
mov rax, qword [rsi]
mov rax, qword [rax + 0x260]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xb0]
mov byte [rcx + 0x1c], al
mov rcx, rsi
mov rax, qword [rsi]
mov rax, qword [rax + 0x268]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xb0]
mov byte [rcx + 0x1d], al
mov rcx, rsi
mov rax, qword [rsi]
mov rax, qword [rax + 0x270]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xb0]
mov byte [rcx + 0x1e], al
mov rcx, rsi
mov rax, qword [rsi]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xb0]
mov byte [rcx + 0x1f], al
mov rcx, qword [rsi + 0xb0]
mov eax, dword [rsi + 0xa8]
mov dword [rcx + 0x18], eax
cmp qword [rsi + 8], 0
je 0x140077082
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400770d0
mov rcx, qword [rsi + 0xb0]
add dword [0x140134854], 0x10
mov rdx, qword [rcx]
mov qword [rdx + 0x10], rax
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xb0]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
mov rdx, qword [rsi + 0x98]
test rdx, rdx
je 0x14007709e
mov rcx, qword [rsi + 0xb0]
add rcx, 8
call fcn.14003d670
mov rdx, qword [rsi + 0xa0]
test rdx, rdx
je 0x1400770ba
mov rcx, qword [rsi + 0xb0]
add rcx, 0x10
call fcn.14003d670
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x62c
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140077120
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xc8]
mov rsi, rcx
test rax, rax
je 0x14007714f
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400772a4
jmp 0x14007726b
mov ecx, 0x30
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077281
mov ebx, dword [0x140134854]
xorps xmm0, xmm0
mov qword [rsi + 0xc8], rax
add ebx, 0x30
movups xmmword [rax], xmm0
mov dword [0x140134854], ebx
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
jne 0x1400771ae
mov rcx, rsi
call fcn.140076f00
mov rcx, qword [rsi + 0xb0]
mov ebx, dword [0x140134854]
mov rax, qword [rsi + 0xc8]
xor edx, edx
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov al, byte [rsi + rdx + 0xb8]
mov rcx, qword [rsi + 0xc8]
mov byte [rdx + rcx + 0x20], al
inc rdx
cmp rdx, 4
jl 0x1400771c5
mov rcx, qword [rsi + 0xc8]
mov rax, qword [rsi + 0xc0]
mov qword [rcx + 0x28], rax
cmp qword [rsi + 8], 0
je 0x14007726b
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
je 0x140077281
mov rax, qword [rsi + 0xc8]
add ebx, 0x10
mov dword [0x140134854], ebx
mov rcx, qword [rax]
mov qword [rcx + 0x10], rdx
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xc8]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__base.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x653
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x1400772d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
mov rsi, rcx
test rax, rax
je 0x140077310
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x14007741b
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400773f8
mov ebx, dword [0x140134854]
xor ecx, ecx
add ebx, 8
mov qword [rsi + 0x98], rax
mov qword [rax], rcx
mov rcx, qword [rsi + 0x80]
mov dword [0x140134854], ebx
test rcx, rcx
jne 0x140077366
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov ebx, dword [0x140134854]
mov rax, qword [rsi + 0x98]
mov qword [rax], rcx
mov rax, qword [rsi + 0x98]
mov rdi, qword [rax]
cmp dword [rdi], 0x3a
jne 0x140077434
cmp qword [rsi + 8], 0
je 0x1400772fa
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400773f8
mov qword [rdi + 0x10], rax
add ebx, 0x10
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov dword [0x140134854], ebx
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0x98]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
jmp 0x1400772fa
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x66e
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pThis__cgid__ID_CG_ASYNC_HANDLE
mov edx, 0x677
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140077460
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
xor r12d, r12d
mov rbp, rcx
mov r13d, 1
test rax, rax
je 0x1400774a5
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x14007763c
jmp 0x1400775f4
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077619
mov ebx, dword [0x140134854]
xor ecx, ecx
mov qword [rbp + 0x98], rax
add ebx, 0x18
xorps xmm0, xmm0
mov dword [0x140134854], ebx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp + 0x80]
test rcx, rcx
jne 0x140077502
mov rcx, rbp
call fcn.140073190
mov rcx, qword [rbp + 0x80]
mov ebx, dword [0x140134854]
mov rax, qword [rbp + 0x98]
mov r15d, r12d
mov qword [rax], rcx
movzx ecx, r12w
mov r14, qword [rbp + 8]
test r14, r14
je 0x140077615
mov rax, r14
mov rax, qword [rax + 0x10]
add cx, r13w
test rax, rax
jne 0x140077523
test cx, cx
je 0x140077615
mov rax, r14
movzx ecx, r12w
mov rax, qword [rax + 0x10]
add cx, r13w
test rax, rax
jne 0x140077540
mov rax, qword [rbp + 0x98]
movsx ecx, cx
mov dword [rax + 8], ecx
mov eax, 0x10
mov rsi, qword [rbp + 0x98]
mov ecx, dword [rsi + 8]
mul rcx
mov rdi, rax
mov rax, 0xffffffffffffffff
cmovo rdi, rax
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077619
add ebx, edi
mov qword [rsi + 0x10], rax
mov dword [0x140134854], ebx
test r14, r14
je 0x1400775f4
mov rax, qword [rbp + 0x98]
mov rdi, r14
mov r14, qword [r14 + 0x10]
mov rcx, rdi
movsxd rsi, r15d
shl rsi, 4
add rsi, qword [rax + 0x10]
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rbx, rax
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
mov r8, rbx
mov rcx, rsi
mov edx, eax
call fcn.140073058
add r15d, r13d
jmp 0x14007759e
mov eax, r13d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x1400775f7
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x687
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140077660
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0xa0]
xor r12d, r12d
mov rbp, rcx
mov r13d, 1
test rax, rax
je 0x1400776a5
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x14007783c
jmp 0x1400777f4
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077819
mov ebx, dword [0x140134854]
xor ecx, ecx
mov qword [rbp + 0xa0], rax
add ebx, 0x18
xorps xmm0, xmm0
mov dword [0x140134854], ebx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp + 0x80]
test rcx, rcx
jne 0x140077702
mov rcx, rbp
call fcn.140073190
mov rcx, qword [rbp + 0x80]
mov ebx, dword [0x140134854]
mov rax, qword [rbp + 0xa0]
mov r15d, r12d
mov qword [rax], rcx
movzx ecx, r12w
mov r14, qword [rbp + 8]
test r14, r14
je 0x140077815
mov rax, r14
mov rax, qword [rax + 0x10]
add cx, r13w
test rax, rax
jne 0x140077723
test cx, cx
je 0x140077815
mov rax, r14
movzx ecx, r12w
mov rax, qword [rax + 0x10]
add cx, r13w
test rax, rax
jne 0x140077740
mov rax, qword [rbp + 0xa0]
movsx ecx, cx
mov dword [rax + 8], ecx
mov eax, 0x10
mov rsi, qword [rbp + 0xa0]
mov ecx, dword [rsi + 8]
mul rcx
mov rdi, rax
mov rax, 0xffffffffffffffff
cmovo rdi, rax
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077819
add ebx, edi
mov qword [rsi + 0x10], rax
mov dword [0x140134854], ebx
test r14, r14
je 0x1400777f4
mov rax, qword [rbp + 0xa0]
mov rdi, r14
mov r14, qword [r14 + 0x10]
mov rcx, rdi
movsxd rsi, r15d
shl rsi, 4
add rsi, qword [rax + 0x10]
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rbx, rax
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
mov r8, rbx
mov rcx, rsi
mov edx, eax
call fcn.140073058
add r15d, r13d
jmp 0x14007779e
mov eax, r13d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x1400777f7
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x6aa
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140077860
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0xa0]
xor r12d, r12d
mov rbp, rcx
mov r13d, 1
test rax, rax
je 0x1400778a5
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140077a3c
jmp 0x1400779f4
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077a19
mov ebx, dword [0x140134854]
xor ecx, ecx
mov qword [rbp + 0xa0], rax
add ebx, 0x18
xorps xmm0, xmm0
mov dword [0x140134854], ebx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp + 0x80]
test rcx, rcx
jne 0x140077902
mov rcx, rbp
call fcn.140073190
mov rcx, qword [rbp + 0x80]
mov ebx, dword [0x140134854]
mov rax, qword [rbp + 0xa0]
mov r15d, r12d
mov qword [rax], rcx
movzx ecx, r12w
mov r14, qword [rbp + 8]
test r14, r14
je 0x140077a15
mov rax, r14
mov rax, qword [rax + 0x10]
add cx, r13w
test rax, rax
jne 0x140077923
test cx, cx
je 0x140077a15
mov rax, r14
movzx ecx, r12w
mov rax, qword [rax + 0x10]
add cx, r13w
test rax, rax
jne 0x140077940
mov rax, qword [rbp + 0xa0]
movsx ecx, cx
mov dword [rax + 8], ecx
mov eax, 0x10
mov rsi, qword [rbp + 0xa0]
mov ecx, dword [rsi + 8]
mul rcx
mov rdi, rax
mov rax, 0xffffffffffffffff
cmovo rdi, rax
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077a19
add ebx, edi
mov qword [rsi + 0x10], rax
mov dword [0x140134854], ebx
test r14, r14
je 0x1400779f4
mov rax, qword [rbp + 0xa0]
mov rdi, r14
mov r14, qword [r14 + 0x10]
mov rcx, rdi
movsxd rsi, r15d
shl rsi, 4
add rsi, qword [rax + 0x10]
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rbx, rax
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
mov r8, rbx
mov rcx, rsi
mov edx, eax
call fcn.140073058
add r15d, r13d
jmp 0x14007799e
mov eax, r13d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x1400779f7
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x6cd
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140077a60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
mov rdi, rcx
test rax, rax
je 0x140077a8f
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140077bda
jmp 0x140077ba1
mov ecx, 8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077bb7
add dword [0x140134854], 8
xor ecx, ecx
mov qword [rdi + 0x98], rax
mov qword [rax], rcx
mov rcx, qword [rdi + 0x80]
test rcx, rcx
jne 0x140077ad7
mov rcx, rdi
call fcn.140073190
mov rcx, qword [rdi + 0x80]
mov rax, qword [rdi + 0x98]
mov qword [rax], rcx
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov r8d, 0x200
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0xec]
test r8d, edx
jne 0x140077b2c
mov rax, qword [0x140134390]
cmp word [rax], 6
jne 0x140077b2c
and qword [rcx + 0xd0], 0
or edx, r8d
and qword [rcx + 0xc8], 0
mov dword [rcx + 0xec], edx
mov rsi, qword [rcx + 0xd0]
test rsi, rsi
je 0x140077ba1
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077bb7
mov rdx, qword [rdi + 0x98]
mov rcx, rsi
add dword [0x140134854], 0x10
mov r8, qword [rdx]
mov qword [r8 + 0x10], rax
mov rax, qword [rsi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rsi]
mov rcx, rsi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rdi + 0x98]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x6f0
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140077c00
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1c0]
mov rbx, rcx
test rax, rax
je 0x140077c26
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140077d38
jmp 0x140077d2c
mov ecx, 0xa8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x140077c5f
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0xa8
mov r8d, 0xa8
mov rcx, rax
mov qword [rbx + 0x1c0], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x170]
test rcx, rcx
jne 0x140077c99
mov rcx, rbx
call fcn.140073e90
mov rcx, qword [rbx + 0x170]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0x1c0]
mov edx, 0x80
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rax + rdx - 0x10], xmm0
movups xmm1, xmmword [rcx + rdx]
movups xmmword [rax + rdx], xmm1
mov rax, qword [rbx + 0x1c0]
movups xmm0, xmmword [rbx + 0x110]
movdqu xmmword [rax + 0x90], xmm0
mov rcx, qword [rbx + 0x1b8]
test rcx, rcx
je 0x140077d2c
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x1c0]
mov qword [rcx + 0xa0], rax
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__inf.inf.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x70b
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140077d60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
mov rsi, rcx
test rax, rax
je 0x140077da0
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140077e97
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077e74
mov ebx, dword [0x140134854]
xor ecx, ecx
add ebx, 8
mov qword [rsi + 0x98], rax
mov qword [rax], rcx
mov rcx, qword [rsi + 0x80]
mov dword [0x140134854], ebx
test rcx, rcx
jne 0x140077df6
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov ebx, dword [0x140134854]
mov rax, qword [rsi + 0x98]
mov qword [rax], rcx
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140077e74
mov rcx, qword [rsi + 0x98]
add ebx, 0x10
mov dword [0x140134854], ebx
mov rdx, qword [rcx]
mov qword [rdx + 0x10], rax
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0x98]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
jmp 0x140077d8a
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x721
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3