joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b63f8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx]
xor r12d, r12d
mov rsi, rdx
mov r14, rcx
mov rbx, qword [rbx + 0xb8]
test rbx, rbx
je 0x1400b660b
mov rcx, rbx
call fcn.1400c9bb8
lea ecx, [r12 + 0x70]
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400b65cf
add dword [0x140134854], 0x70
lea r13d, [r12 + 1]
mov qword [rax + 8], r12
mov rdx, rdi
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], rsi
mov qword [rax + 0x30], rax
mov qword [rax + 0x38], r12
mov qword [rax + 0x40], r12
mov qword [rax + 0x48], r12
lea rax, vtable.CompositeFormatFragment.0
mov qword [rdi], rax
mov qword [rdi + 0x50], r12
mov qword [rdi + 0x58], r12
mov qword [rdi + 0x60], r13
mov qword [rdi + 0x68], r12
mov rcx, qword [r14 + 0x10]
call fcn.1400ad4f4
xor r9d, r9d
mov r8b, r13b
mov rdx, rsi
mov rcx, r14
mov ebp, r12d
call fcn.1400b4e70
mov rcx, qword [0x140134380]
mov r15, rax
test byte [rcx + 0xc], r13b
je 0x1400b64de
mov rdx, qword [rsi + 8]
mov rcx, r14
call fcn.1400b62ec
mov rbp, rax
mov ecx, 0x58
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
je 0x1400b65cf
add dword [0x140134854], 0x58
mov r8d, 0xfe
mov qword [rax + 8], r12
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], rsi
mov qword [rax + 0x30], rax
mov qword [rax + 0x38], r12
mov qword [rax + 0x40], r12
mov qword [rax + 0x48], r12
lea rax, vtable.MIDL_NDR64_FIX_ARRAY_HEADER_FORMAT.0
mov qword [rdx], rax
xor eax, eax
mov qword [rdx + 0x50], rax
mov byte [rdx + 0x50], 0x40
movzx ecx, word [rsi + 0x30]
movzx eax, cx
sub ax, r13w
cmp ax, r8w
ja 0x1400b65f2
and byte [rdx + 0x52], r8b
sub cl, r13b
mov byte [rdx + 0x51], cl
test r15, r15
mov rax, r12
setne cl
sub rax, rbp
or cl, byte [rdx + 0x52]
and cl, 0xfd
neg rax
sbb al, al
and al, 2
or cl, al
mov byte [rdx + 0x52], cl
mov rcx, rdi
mov eax, dword [rsi + 0x34]
mov dword [rdx + 0x54], eax
call fcn.1400ad4f4
test r15, r15
je 0x1400b659b
mov rdx, r15
mov rcx, rdi
call fcn.1400ad4f4
test rbp, rbp
je 0x1400b65ab
mov rdx, rbp
mov rcx, rdi
call fcn.1400ad4f4
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.1400c9c94
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.Alignment___0xFF__Alignment___0
mov edx, 0x8d
lea rcx, str.com_rpcmidlincmidl64types.h
call fcn.1400c7a2c
int3
lea r8, str.pGenFormatState___NULL
mov edx, 0x7c5
lea rcx, str.com_rpcmidlcodegenccb.hxx
call fcn.1400c7a2c
int3
add rcx, 8
jmp 0x1400b63f8
Function at 0x1400b7860
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea eax, [r8 - 1]
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
test dword [rdx], eax
je 0x1400b790f
mov ecx, 0x58
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x1400b78bd
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x58
lea rcx, vtable.MIDL_NDR64_EXPR_NOOP.0
mov qword [rax], rcx
dec bl
and bl, byte [rdi]
mov rcx, rsi
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x38], rdx
mov qword [rax + 0x40], rdx
mov qword [rax + 0x48], rdx
mov word [rax + 0x52], dx
mov rdx, rax
mov byte [rax + 0x51], bl
mov qword [rax + 0x30], rax
mov byte [rax + 0x50], 5
call fcn.1400ad4f4
add dword [rdi], 4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b7928
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov rsi, r8
mov rbp, rdx
cmp ecx, 7
jne 0x1400b79b4
mov ecx, 0x60
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
mov rbx, rax
test rax, rax
je 0x1400b79cf
add dword [0x140134854], 0x60
lea r8d, [rcx + 8]
mov qword [rax + 8], rcx
xorps xmm0, xmm0
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rax
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], rcx
movups xmmword [rax + 0x50], xmm0
lea rax, vtable.MIDL_NDR64_EXPR_CONST64.0
mov word [rbx + 0x50], 2
mov qword [rbx], rax
mov qword [rbx + 0x58], rbp
jmp 0x1400b7a3c
mov ecx, 0x58
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
mov rbx, rax
test rax, rax
jne 0x1400b79f2
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x58
mov r8d, 4
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], rcx
xor eax, eax
mov qword [rbx + 0x50], rax
lea rax, vtable.MIDL_NDR64_EXPR_CONST32.0
mov qword [rbx], rax
mov word [rbx + 0x50], 1
mov dword [rbx + 0x54], ebp
mov rdx, rdi
mov rcx, rsi
call fcn.1400b7860
mov rdx, rbx
mov rcx, rsi
call fcn.1400ad4f4
add dword [rdi], 0x10
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b8748
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rcx]
xor esi, esi
mov rbp, rdx
mov r12, rcx
mov bl, sil
mov rdi, qword [rdi + 0xb8]
test rdi, rdi
je 0x1400b897f
mov rcx, rdi
call fcn.1400c9bb8
lea ecx, [rsi + 0x68]
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x1400b8943
add dword [0x140134854], 0x68
xorps xmm0, xmm0
mov qword [rax + 8], rsi
mov rdx, r14
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov qword [rax + 0x28], rbp
mov qword [rax + 0x30], rax
mov qword [rax + 0x38], rsi
mov qword [rax + 0x40], rsi
mov qword [rax + 0x48], rsi
xor eax, eax
movups xmmword [r14 + 0x50], xmm0
mov qword [r14 + 0x60], rax
lea rax, vtable.MIDL_NDR64_USER_MARSHAL_FORMAT.0
mov qword [r14], rax
mov rcx, qword [r12 + 0x10]
call fcn.1400ad4f4
mov r15, qword [rbp + 8]
mov byte [r14 + 0x50], 0xa2
mov rcx, r15
movzx eax, word [r15 + 0x30]
dec ax
mov word [r14 + 0x54], ax
movzx eax, word [r15 + 0x32]
mov word [r14 + 0x56], ax
mov rax, qword [r15]
mov rax, qword [rax + 0x48]
call qword [case.0x1400cd70e.0]
test eax, eax
je 0x1400b8848
movzx eax, word [r15 + 0xa6]
cmp ax, 3
je 0x1400b8998
cmp ax, 2
jne 0x1400b8932
mov bl, 0x80
mov ecx, 0x18
mov byte [r14 + 0x51], bl
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400b8943
mov rcx, qword [rbp + 0xa8]
mov rdx, rax
add dword [0x140134854], 0x18
mov qword [rax], rcx
mov rcx, qword [rbp + 0xb0]
mov qword [rax + 8], rcx
mov rcx, qword [r12]
mov rcx, qword [rcx + 0x278]
call fcn.1400acf2c
movzx ecx, word [rbx + 0x10]
mov word [r14 + 0x52], cx
test eax, eax
jne 0x1400b88b4
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x1400b8966
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov rax, qword [rax + 0x70]
call qword [case.0x1400cd70e.0]
mov ecx, dword [rax]
mov dword [r14 + 0x58], ecx
mov rcx, r15
mov rax, qword [r15]
mov rax, qword [rax + 0x78]
call qword [case.0x1400cd70e.0]
test eax, eax
je 0x1400b88f4
mov esi, dword [r15 + 0x38]
mov dword [r14 + 0x5c], esi
mov rdx, r15
mov r8, qword [r12 + 8]
mov rcx, r12
call fcn.1400b23f0
mov rcx, rdi
mov qword [r14 + 0x60], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
jmp fcn.1400c9c94
cmp ax, 1
jne 0x1400b8848
mov bl, 0x40
jmp 0x1400b8848
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.__BUGBUG:_undefined_user_marshal_
mov edx, 0x1a7b
lea rcx, str.com_rpcmidlcodegen_ndr64.cxx
call fcn.1400c7a2c
int3
lea r8, str.pGenFormatState___NULL
mov edx, 0x7c5
lea rcx, str.com_rpcmidlcodegenccb.hxx
call fcn.1400c7a2c
int3
lea r8, str.__pPointer__IsFull__
mov edx, 0x1a5d
lea rcx, str.com_rpcmidlcodegen_ndr64.cxx
call fcn.1400c7a2c
int3
add rcx, 8
jmp 0x1400b8748
Function at 0x1400b89b8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x140134380]
xor r13d, r13d
mov r15, rdx
mov r14, rcx
or dword [rax + 0x38], 0x10
mov rbx, qword [rcx]
mov rbx, qword [rbx + 0xb8]
test rbx, rbx
je 0x1400b8b6e
mov rcx, rbx
call fcn.1400c9bb8
lea ecx, [r13 + 0x70]
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400b8a3e
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x70
xorps xmm0, xmm0
mov qword [rax + 8], r13
mov rdx, rdi
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r13
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], r15
mov qword [rax + 0x30], rdi
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
mov qword [rax + 0x48], r13
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, vtable.MIDL_NDR64_PIPE_FORMAT.0
mov qword [rdi], rax
mov rcx, qword [r14 + 0x10]
call fcn.1400ad4f4
mov rax, qword [r15]
mov rcx, r15
mov rsi, qword [r15 + 8]
mov r12d, r13d
mov rax, qword [rax + 0x98]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi]
mov r15d, r13d
mov rbp, rax
mov rax, qword [rcx + 0x78]
mov rcx, rsi
call qword [case.0x1400cd70e.0]
test eax, eax
je 0x1400b8ac2
mov r12d, dword [rsi + 0x38]
test rbp, rbp
je 0x1400b8af5
mov rcx, qword [rbp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x98]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbp + 0x28]
mov r15, rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x98]
call qword [case.0x1400cd70e.0]
mov r13, rax
mov byte [rdi + 0x50], 0xa3
mov ecx, dword [rsi + 0x24]
and cl, 0xc
neg cl
sbb dl, dl
xor ecx, ecx
not dl
sub rcx, rbp
and dl, 0x40
neg rcx
mov rcx, r14
sbb al, al
and al, 0x20
or dl, al
mov byte [rdi + 0x51], dl
mov rdx, rsi
mov al, byte [rsi + 0x30]
dec al
mov byte [rdi + 0x53], 0
mov byte [rdi + 0x52], al
mov r8, qword [r14 + 8]
call fcn.1400b23f0
mov qword [rdi + 0x58], rax
mov rcx, rbx
mov eax, dword [rsi + 0x34]
mov dword [rdi + 0x60], eax
mov dword [rdi + 0x64], r12d
mov dword [rdi + 0x68], r15d
mov dword [rdi + 0x6c], r13d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.1400c9c94
lea r8, str.pGenFormatState___NULL
mov edx, 0x7c5
lea rcx, str.com_rpcmidlcodegenccb.hxx
call fcn.1400c7a2c
int3
add rcx, 8
jmp 0x1400b89b8
Function at 0x1400bb870
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
lea r14, [rcx + 8]
mov rsi, rdx
mov rbx, qword [r14]
mov rbx, qword [rbx + 0xb8]
test rbx, rbx
je 0x1400bb9bc
mov rcx, rbx
call fcn.1400c9bb8
mov ecx, 0x68
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400bb8e6
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
and qword [rax + 8], 0
xorps xmm0, xmm0
and qword [rax + 0x10], 0
mov rdx, rdi
and qword [rax + 0x18], 0
and qword [rax + 0x20], 0
and qword [rax + 0x38], 0
and qword [rax + 0x40], 0
and qword [rax + 0x48], 0
add dword [0x140134854], 0x68
mov qword [rax + 0x28], rsi
mov qword [rax + 0x30], rdi
xor eax, eax
movups xmmword [rdi + 0x50], xmm0
mov qword [rdi + 0x60], rax
lea rax, vtable.MIDL_NDR64_TRANSMIT_AS_FORMAT.0
mov qword [rdi], rax
mov rcx, qword [r14 + 0x10]
call fcn.1400ad4f4
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov rbp, qword [rsi + 0xa8]
lea r9, [0x14012cf68]
and dword [rsp + 0x20], 0
lea r8, [0x14012d4f8]
mov rcx, rbp
xor edx, edx
mov r15, rax
call fcn.1400cbdc8
test rax, rax
je 0x1400bb97d
mov r9, qword [rbp + 0x40]
jmp 0x1400bb984
lea r9, [0x1400f48cb]
mov qword [rsp + 0x28], r15
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x20], rbp
mov rcx, r14
call fcn.1400b85c0
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
jmp fcn.1400c9c94
lea r8, str.pGenFormatState___NULL
mov edx, 0x7c5
lea rcx, str.com_rpcmidlcodegenccb.hxx
call fcn.1400c7a2c
int3
Function at 0x1400bb9e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rbx + 0xb8]
test rbx, rbx
je 0x1400bbae3
mov rcx, rbx
call fcn.1400c9bb8
mov ecx, 0x58
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
jne 0x1400bba4b
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
and qword [rax + 8], 0
and qword [rax + 0x10], 0
and qword [rax + 0x18], 0
and qword [rax + 0x20], 0
and qword [rax + 0x38], 0
and qword [rax + 0x40], 0
and qword [rax + 0x48], 0
add dword [0x140134854], 0x58
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdx
xor eax, eax
mov qword [rdx + 0x50], rax
lea rax, vtable.MIDL_NDR64_SYSTEM_HANDLE_FORMAT.0
mov qword [rdx], rax
mov byte [rdx + 0x50], 0x3c
mov eax, dword [rdi + 0xb8]
cmp eax, 0xff
ja 0x1400bbaca
mov byte [rdx + 0x51], al
mov eax, dword [rdi + 0xbc]
mov dword [rdx + 0x54], eax
mov rcx, qword [rsi + 0x18]
call fcn.1400ad4f4
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400c9c94
lea r8, str.handleType____UINT8__1
mov edx, 0x1295
lea rcx, str.com_rpcmidlcodegen_ndr64.cxx
call fcn.1400c7a2c
int3
lea r8, str.pGenFormatState___NULL
mov edx, 0x7c5
lea rcx, str.com_rpcmidlcodegenccb.hxx
call fcn.1400c7a2c
int3

Function at 0x1400bbb50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
lea r14, [rcx + 8]
mov rsi, rdx
mov rbx, qword [r14]
mov rbx, qword [rbx + 0xb8]
test rbx, rbx
je 0x1400bbc6b
mov rcx, rbx
call fcn.1400c9bb8
mov ecx, 0x68
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400bbbc3
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
and qword [rax + 8], 0
xorps xmm0, xmm0
and qword [rax + 0x10], 0
mov rdx, rdi
and qword [rax + 0x18], 0
and qword [rax + 0x20], 0
and qword [rax + 0x38], 0
and qword [rax + 0x40], 0
and qword [rax + 0x48], 0
add dword [0x140134854], 0x68
mov qword [rax + 0x28], rsi
mov qword [rax + 0x30], rdi
xor eax, eax
movups xmmword [rdi + 0x50], xmm0
mov qword [rdi + 0x60], rax
lea rax, vtable.MIDL_NDR64_REPRESENT_AS_FORMAT.0
mov qword [rdi], rax
mov rcx, qword [r14 + 0x10]
call fcn.1400ad4f4
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov r9, qword [rsi + 0xa8]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rax, qword [rsi + 0xb0]
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1400b85c0
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
jmp fcn.1400c9c94
lea r8, str.pGenFormatState___NULL
mov edx, 0x7c5
lea rcx, str.com_rpcmidlcodegenccb.hxx
call fcn.1400c7a2c
int3
Function at 0x1400bbcc0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
lea r14, [rcx + 8]
xor ebp, ebp
mov rbx, qword [r14]
mov rsi, rdx
mov rbx, qword [rbx + 0xb8]
test rbx, rbx
je 0x1400bbe24
mov rcx, rbx
call fcn.1400c9bb8
lea ecx, [rbp + 0x60]
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400bbd37
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x60
lea r8, [rax + 0x50]
mov qword [rax + 8], rbp
xorps xmm0, xmm0
mov qword [rax + 0x10], rbp
mov rcx, rsi
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rbp
mov qword [rax + 0x28], rsi
mov qword [rax + 0x30], rdi
mov qword [rax + 0x38], rbp
mov qword [rax + 0x40], rbp
mov qword [rax + 0x48], rbp
lea rax, vtable.MIDL_NDR64_POINTER_FORMAT.0
movups xmmword [r8], xmm0
mov qword [rdi], rax
mov rdx, qword [r14]
call fcn.140093960
test byte [rdi + 0x51], 8
mov rsi, qword [rsi + 8]
je 0x1400bbdc6
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 0x2d
jne 0x1400bbda5
mov rsi, qword [rsi + 8]
lea r9, [0x14012e190]
mov dword [rsp + 0x20], ebp
lea r8, [0x14012da78]
xor edx, edx
mov rcx, rsi
call fcn.1400cbdc8
test rax, rax
je 0x1400bbe0b
mov rcx, qword [r14 + 0x10]
mov rdx, rdi
call fcn.1400ad4f4
mov word [rdi + 0x52], bp
mov rdx, rsi
mov r8, qword [r14 + 8]
mov rcx, r14
call fcn.1400b23f0
mov rcx, rbx
mov qword [rdi + 0x58], rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
jmp fcn.1400c9c94
lea r8, str.NULL___dynamic_cast_CG_BASETYPE_____pointee__
mov edx, 0x118c
lea rcx, str.com_rpcmidlcodegen_ndr64.cxx
call fcn.1400c7a2c
int3
lea r8, str.pGenFormatState___NULL
mov edx, 0x7c5
lea rcx, str.com_rpcmidlcodegenccb.hxx
call fcn.1400c7a2c
int3
Function at 0x1400bc030
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov ecx, 0x58
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor r9d, r9d
mov rdx, rax
test rax, rax
jne 0x1400bc07a
mov ebx, 0x7d5
xor ecx, ecx
mov r8d, ebx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x58
mov r8d, 0xfe
mov qword [rax + 8], r9
mov qword [rax + 0x10], r9
mov qword [rax + 0x18], r9
mov qword [rax + 0x20], r9
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r9
mov qword [rax + 0x48], r9
xor eax, eax
mov qword [rdx + 0x50], rax
lea rax, vtable.MIDL_NDR64_BUFFER_ALIGN_FORMAT.0
mov qword [rdx], rax
mov byte [rdx + 0x50], 0x92
movzx ecx, word [rbx + 0x30]
lea eax, [rcx - 1]
cmp ax, r8w
ja 0x1400bc0ed
dec cl
mov word [rdx + 0x52], r9w
mov byte [rdx + 0x51], cl
mov dword [rdx + 0x54], r9d
mov rcx, qword [rdi + 0x10]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ad4f4
lea r8, str.Alignment___0xFF__Alignment___0
mov edx, 0x18d
lea rcx, str.com_rpcmidlcodegen_ndr64.cxx
call fcn.1400c7a2c
int3

Function at 0x1400bc130
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx + 8]
mov rbx, rdx
cmp byte [rdi + 0x18], 0
je 0x1400bc15b
mov rcx, rdi
call fcn.1400b5e94
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x58
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
jne 0x1400bc195
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
and qword [rax + 8], 0
mov r8d, 0xfe
and qword [rax + 0x10], 0
and qword [rax + 0x18], 0
and qword [rax + 0x20], 0
and qword [rax + 0x38], 0
and qword [rax + 0x40], 0
and qword [rax + 0x48], 0
add dword [0x140134854], 0x58
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rdx
xor eax, eax
mov qword [rdx + 0x50], rax
lea rax, vtable.MIDL_NDR64_SIMPLE_REGION_FORMAT.0
mov qword [rdx], rax
mov byte [rdx + 0x50], 0x30
movzx ecx, word [rbx + 0x30]
lea eax, [rcx - 1]
cmp ax, r8w
ja 0x1400bc216
dec cl
mov byte [rdx + 0x51], cl
cmp dword [rbx + 0x38], 0xffff
jae 0x1400bc22f
movzx eax, word [rbx + 0x38]
and dword [rdx + 0x54], 0
mov word [rdx + 0x52], ax
mov rcx, qword [rdi + 8]
call fcn.1400ad4f4
jmp 0x1400bc14f
lea r8, str.Alignment___0xFF__Alignment___0
mov edx, 0x18d
lea rcx, str.com_rpcmidlcodegen_ndr64.cxx
call fcn.1400c7a2c
int3
lea r8, str.pRegion__GetWireSize_____0xFFFF
mov edx, 0x9b7
lea rcx, str.com_rpcmidlcodegen_ndr64.cxx
call fcn.1400c7a2c
int3
Function at 0x1400bc260
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x58
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x1400bc2a2
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x58
lea rcx, vtable.MIDL_NDR64_SIMPLE_MEMBER_FORMAT.0
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x38], rdx
mov qword [rax + 0x40], rdx
mov qword [rax + 0x48], rdx
mov rdx, rax
mov qword [rax], rcx
mov qword [rax + 0x30], rax
mov qword [rax + 0x50], 0x12
mov rcx, qword [rbx + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.1400ad4f4

Function at 0x1400bca08
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, 1
mov rbx, rcx
cmp dword [rcx + 0x5c], edi
jne 0x1400bca26
and dword [rcx + 0x5c], 0
mov dword [rcx + 0x58], edi
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
jne 0x1400bca60
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [rbx + 0x60], edi
and dword [rax + 4], 0
and qword [rax + 0x10], 0
add dword [0x140134854], 0x18
mov byte [rax], 0x9f
mov word [rax + 8], di
cmp qword [rbx + 0x68], 0
jne 0x1400bca87
mov qword [rbx + 0x68], rcx
jmp 0x1400bca8f
mov rax, qword [rbx + 0x70]
mov qword [rax + 0x10], rcx
mov qword [rbx + 0x70], rcx
mov qword [rbx + 0x78], rcx
add dword [rbx + 0x50], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret