joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bcaac
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
cmp dword [rcx + 0x54], edx
ja 0x1400bcc59
mov ebp, 1
jae 0x1400bcae8
mov rcx, rbx
call fcn.1400bca08
add dword [rbx + 0x54], ebp
cmp dword [rbx + 0x54], esi
jb 0x1400bcad8
sub edi, esi
lea eax, [rdi + 0x60]
cmp eax, 0xdf
ja 0x1400bcc72
cmp dword [rbx + 0x5c], ebp
jne 0x1400bcb11
mov rcx, qword [rbx + 0x78]
movsx eax, byte [rcx]
cmp eax, edi
jne 0x1400bcb11
add word [rcx + 8], bp
jmp 0x1400bcc3d
mov rax, qword [rbx + 0x70]
xor esi, esi
test rax, rax
je 0x1400bcbc9
movsx eax, byte [rax]
cmp eax, edi
jne 0x1400bcbc9
add dword [rbx + 0x58], ebp
cmp dword [rbx + 0x58], 4
jl 0x1400bcb8d
mov rax, qword [rbx + 0x78]
mov dword [rax + 4], ebp
mov rcx, qword [rbx + 0x78]
movzx eax, word [rbx + 0x58]
mov word [rcx + 8], ax
mov rax, qword [rbx + 0x78]
mov dword [rbx + 0x5c], ebp
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x70], rcx
test rcx, rcx
je 0x1400bcb7f
mov rax, qword [rcx + 0x10]
mov qword [rbx + 0x70], rax
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x70]
dec dword [rbx + 0x60]
test rcx, rcx
jne 0x1400bcb5b
mov rax, qword [rbx + 0x78]
mov qword [rax + 0x10], rsi
add dword [rbx + 0x60], 3
mov rax, qword [rbx + 0x78]
jmp 0x1400bcbc3
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400bcbe6
add dword [0x140134854], 0x18
add dword [rbx + 0x60], ebp
mov byte [rax], dil
mov dword [rax + 4], esi
mov word [rax + 8], bp
mov qword [rax + 0x10], rsi
mov rcx, qword [rbx + 0x70]
mov qword [rcx + 0x10], rax
mov qword [rbx + 0x70], rax
jmp 0x1400bcc3d
mov ecx, 0x18
mov qword [rbx + 0x58], rbp
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
jne 0x1400bcc09
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [rbx + 0x60], ebp
add dword [0x140134854], 0x18
mov byte [rax], dil
mov dword [rax + 4], esi
mov word [rax + 8], bp
mov qword [rax + 0x10], rsi
cmp qword [rbx + 0x68], rsi
jne 0x1400bcc2d
mov qword [rbx + 0x68], rcx
jmp 0x1400bcc35
mov rax, qword [rbx + 0x70]
mov qword [rax + 0x10], rcx
mov qword [rbx + 0x78], rcx
mov qword [rbx + 0x70], rcx
add dword [rbx + 0x50], ebp
add dword [rbx + 0x54], ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea r8, str.CurrentOffset___Offset
mov edx, 0x96
lea rcx, str.com_rpcmidlcodegen_armstack.hxx
call fcn.1400c7a2c
int3
lea r8, str._Delta____96____Delta___127_
mov edx, 0xa0
lea rcx, str.com_rpcmidlcodegen_armstack.hxx
call fcn.1400c7a2c
int3
Function at 0x1400bcc94
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov sil, r8b
mov edi, edx
mov rbx, rcx
cmp dword [rcx + 0x54], edx
ja 0x1400bcd62
mov ebp, 1
jae 0x1400bccd0
mov rcx, rbx
call fcn.1400bca08
add dword [rbx + 0x54], ebp
cmp dword [rbx + 0x54], edi
jb 0x1400bccc0
xor edi, edi
mov qword [rbx + 0x58], rbp
lea ecx, [rdi + 0x18]
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
jne 0x1400bcd0e
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [rbx + 0x60], ebp
add sil, 0x80
add dword [0x140134854], 0x18
mov byte [rax], sil
mov dword [rax + 4], edi
mov word [rax + 8], bp
mov qword [rax + 0x10], rdi
cmp qword [rbx + 0x68], rdi
jne 0x1400bcd36
mov qword [rbx + 0x68], rcx
jmp 0x1400bcd3e
mov rax, qword [rbx + 0x70]
mov qword [rax + 0x10], rcx
mov qword [rbx + 0x70], rcx
mov qword [rbx + 0x78], rcx
add dword [rbx + 0x50], ebp
add dword [rbx + 0x54], ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea r8, str.CurrentOffset___Offset
mov edx, 0x102
lea rcx, str.com_rpcmidlcodegen_armstack.hxx
call fcn.1400c7a2c
int3

Function at 0x1400bce80
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, 1
mov rbx, rcx
cmp dword [rcx + 0x14], edi
jne 0x1400bce9e
and dword [rcx + 0x14], 0
mov dword [rcx + 0x10], edi
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
jne 0x1400bced8
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [rbx + 0x18], edi
and dword [rax + 4], 0
and qword [rax + 0x10], 0
add dword [0x140134854], 0x18
mov byte [rax], 0x9f
mov word [rax + 8], di
cmp qword [rbx + 0x20], 0
jne 0x1400bceff
mov qword [rbx + 0x20], rcx
jmp 0x1400bcf07
mov rax, qword [rbx + 0x28]
mov qword [rax + 0x10], rcx
mov qword [rbx + 0x28], rcx
mov qword [rbx + 0x30], rcx
add dword [rbx + 8], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400bcf24
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
cmp dword [rcx + 0xc], edx
ja 0x1400bd0d1
mov ebp, 1
jae 0x1400bcf60
mov rcx, rbx
call fcn.1400bce80
add dword [rbx + 0xc], ebp
cmp dword [rbx + 0xc], esi
jb 0x1400bcf50
sub edi, esi
lea eax, [rdi + 0x61]
cmp eax, 0xe0
ja 0x1400bd0ea
cmp dword [rbx + 0x14], ebp
jne 0x1400bcf89
mov rcx, qword [rbx + 0x30]
movsx eax, byte [rcx]
cmp eax, edi
jne 0x1400bcf89
add word [rcx + 8], bp
jmp 0x1400bd0b5
mov rax, qword [rbx + 0x28]
xor esi, esi
test rax, rax
je 0x1400bd041
movsx eax, byte [rax]
cmp eax, edi
jne 0x1400bd041
add dword [rbx + 0x10], ebp
cmp dword [rbx + 0x10], 4
jl 0x1400bd005
mov rax, qword [rbx + 0x30]
mov dword [rax + 4], ebp
mov rcx, qword [rbx + 0x30]
movzx eax, word [rbx + 0x10]
mov word [rcx + 8], ax
mov rax, qword [rbx + 0x30]
mov dword [rbx + 0x14], ebp
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x28], rcx
test rcx, rcx
je 0x1400bcff7
mov rax, qword [rcx + 0x10]
mov qword [rbx + 0x28], rax
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x28]
dec dword [rbx + 0x18]
test rcx, rcx
jne 0x1400bcfd3
mov rax, qword [rbx + 0x30]
mov qword [rax + 0x10], rsi
add dword [rbx + 0x18], 3
mov rax, qword [rbx + 0x30]
jmp 0x1400bd03b
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400bd05e
add dword [0x140134854], 0x18
add dword [rbx + 0x18], ebp
mov byte [rax], dil
mov dword [rax + 4], esi
mov word [rax + 8], bp
mov qword [rax + 0x10], rsi
mov rcx, qword [rbx + 0x28]
mov qword [rcx + 0x10], rax
mov qword [rbx + 0x28], rax
jmp 0x1400bd0b5
mov ecx, 0x18
mov qword [rbx + 0x10], rbp
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
jne 0x1400bd081
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [rbx + 0x18], ebp
add dword [0x140134854], 0x18
mov byte [rax], dil
mov dword [rax + 4], esi
mov word [rax + 8], bp
mov qword [rax + 0x10], rsi
cmp qword [rbx + 0x20], rsi
jne 0x1400bd0a5
mov qword [rbx + 0x20], rcx
jmp 0x1400bd0ad
mov rax, qword [rbx + 0x28]
mov qword [rax + 0x10], rcx
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x28], rcx
add dword [rbx + 8], ebp
add dword [rbx + 0xc], ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea r8, str.CurrentOffset___Offset
mov edx, 0x91
lea rcx, str.com_rpcmidlcodegen_arm64stack.hxx
call fcn.1400c7a2c
int3
lea r8, str._Delta____97____Delta___127_
mov edx, 0x9b
lea rcx, str.com_rpcmidlcodegen_arm64stack.hxx
call fcn.1400c7a2c
int3
Function at 0x1400bd10c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov sil, r8b
mov edi, edx
mov rbx, rcx
cmp dword [rcx + 0xc], edx
ja 0x1400bd1da
mov ebp, 1
jae 0x1400bd148
mov rcx, rbx
call fcn.1400bce80
add dword [rbx + 0xc], ebp
cmp dword [rbx + 0xc], edi
jb 0x1400bd138
xor edi, edi
mov qword [rbx + 0x10], rbp
lea ecx, [rdi + 0x18]
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
jne 0x1400bd186
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [rbx + 0x18], ebp
add sil, 0x80
add dword [0x140134854], 0x18
mov byte [rax], sil
mov dword [rax + 4], edi
mov word [rax + 8], bp
mov qword [rax + 0x10], rdi
cmp qword [rbx + 0x20], rdi
jne 0x1400bd1ae
mov qword [rbx + 0x20], rcx
jmp 0x1400bd1b6
mov rax, qword [rbx + 0x28]
mov qword [rax + 0x10], rcx
mov qword [rbx + 0x28], rcx
mov qword [rbx + 0x30], rcx
add dword [rbx + 8], ebp
add dword [rbx + 0xc], ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea r8, str.CurrentOffset___Offset
mov edx, 0x138
lea rcx, str.com_rpcmidlcodegen_arm64stack.hxx
call fcn.1400c7a2c
int3
Function at 0x1400bd4f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
xor ebp, ebp
mov rdi, qword [rcx + 0x20]
xor esi, esi
mov rbx, rcx
cmp eax, 0xdc
jge 0x1400bd622
cmp eax, 1
lea r14d, [rax + 3]
lea r15d, [rbp + 4]
cmovle r14d, r15d
movsxd rcx, r14d
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
jne 0x1400bd568
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
movzx eax, word [rbx + 8]
add dword [0x140134854], r14d
mov word [rdx], ax
mov al, byte [rbx + 0x18]
mov byte [rdx + 2], al
cmp dword [rbx + 8], esi
jle 0x1400bd5fb
test rdi, rdi
je 0x1400bd63b
xor ecx, ecx
lea r8d, [rcx + 3]
cmp dword [rdi + 4], 1
jne 0x1400bd5bb
cmp r8d, dword [rbx + 0x18]
jge 0x1400bd5fb
mov byte [rcx + rdx + 3], 0x9d
add esi, r15d
mov al, byte [rdi]
add r8d, r15d
mov byte [rdx + rcx + 4], al
movzx eax, word [rdi + 8]
mov word [rdx + rcx + 5], ax
add rcx, r15
jmp 0x1400bd5ec
cmp esi, dword [rbx + 0x18]
jge 0x1400bd5fe
mov al, byte [rdi]
inc esi
mov byte [rdx + rcx + 3], al
inc r8d
mov al, byte [rdi]
inc rcx
add al, 0x69
inc ebp
cmp al, 5
jbe 0x1400bd5dd
cmp byte [rdi], 0xa0
jne 0x1400bd5f2
mov al, byte [rdi + 8]
inc esi
inc r8d
mov byte [rdx + rcx + 3], al
inc rcx
movzx eax, word [rdi + 8]
add ebp, eax
mov rdi, qword [rdi + 0x10]
test rdi, rdi
jne 0x1400bd590
cmp esi, dword [rbx + 0x18]
jne 0x1400bd654
cmp ebp, dword [rbx + 8]
jne 0x1400bd654
mov rbx, qword [rsp + 0x40]
mov rax, rdx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
lea r8, str.TotalSlots___MAX_ARM64_PARAMETERS
mov edx, 0xfc
lea rcx, str.com_rpcmidlcodegen_arm64stack.cxx
call fcn.1400c7a2c
int3
lea r8, str.CurrentItem___NULL
mov edx, 0x108
lea rcx, str.com_rpcmidlcodegen_arm64stack.cxx
call fcn.1400c7a2c
int3
lea r8, str._Slot__TotalSlots____CheckEntries__Entries_
mov edx, 0x130
lea rcx, str.com_rpcmidlcodegen_arm64stack.cxx
call fcn.1400c7a2c
int3
Function at 0x1400be59c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
mov ecx, 1
mov eax, dword [rbx]
or word [rbx + 0xc], cx
and eax, 0xfffff6ff
or eax, ecx
mov dword [rbx + 4], edi
mov ecx, 0x120
mov dword [rbx], eax
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x1400be5fb
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x120
mov rcx, rax
call fcn.1400838b8
btr dword [rbx], 0xc
mov qword [rbx + 0x10], rax
mov rax, rbx
mov word [rbx + 0xc], di
mov qword [rbx + 0x20], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400be8b4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140131c10]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsx eax, word [0x1401358dc]
lea r9, [0x1400f48cb]
test rdx, rdx
mov dword [rsp + 0x20], eax
lea r8, str.__sM_d
cmovne r9, rdx
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.140001318
inc word [0x1401358dc]
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400be912
lea rbx, [rax + 1]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400be959
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], ebx
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.1400011d4
mov rax, rdi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400caef0
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x1400c19d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov rbx, rcx
test rax, rax
je 0x1400c19f0
cmp dword [rax], 0
jge 0x1400c1b6c
jmp 0x1400c1b60
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x1400c1a29
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x20
xorps xmm0, xmm0
mov qword [rbx + 0x18], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400c1a54
mov rcx, qword [rbx + 0x18]
add rcx, 8
call fcn.14003d670
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x30]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x10], al
mov ecx, dword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
shr ecx, 2
sbb ecx, ecx
mov byte [rax + 0x11], cl
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x12], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x13], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x40]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x14], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x15], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x50]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x16], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x58]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x17], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x60]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x18], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x68]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x19], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x70]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x1a], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x78]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov byte [rcx + 0x1b], al
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__kind___DUMP_EXPR_ERROR
mov edx, 0x82
lea rcx, str.com_rpcmidlexprdumpexpr.cxx
call fcn.1400c7a2c
int3
Function at 0x1400c1b90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x38]
mov rbx, rcx
test rax, rax
je 0x1400c1bca
cmp dword [rax], 2
jne 0x1400c1c9e
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400c1c7b
mov ecx, dword [0x140134854]
xorps xmm0, xmm0
add ecx, 0x10
mov qword [rbx + 0x38], rax
mov esi, ecx
mov dword [0x140134854], ecx
mov ecx, 0x30
movups xmmword [rax], xmm0
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400c1c7b
xorps xmm0, xmm0
lea ecx, [rsi + 0x30]
movups xmmword [rax], xmm0
mov dword [0x140134854], ecx
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1400c1c44
mov rcx, rbx
call fcn.1400c19d0
mov rax, qword [rbx + 0x18]
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rdi], 2
mov rax, qword [rbx + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
mov qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x38]
mov dword [rax], 2
mov qword [rax + 8], rdi
jmp 0x1400c1bb4
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__Kind__DUMP_EXPR_VARIABLE
mov edx, 0xa1
lea rcx, str.com_rpcmidlexprdumpexpr.cxx
call fcn.1400c7a2c
int3

Function at 0x1400c1cc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x40]
mov rbx, rcx
test rax, rax
je 0x1400c1cfa
cmp dword [rax], 4
jne 0x1400c1dba
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400c1d97
mov ecx, dword [0x140134854]
xorps xmm0, xmm0
add ecx, 0x10
mov qword [rbx + 0x40], rax
mov esi, ecx
mov dword [0x140134854], ecx
mov ecx, 0x20
movups xmmword [rax], xmm0
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400c1d97
xorps xmm0, xmm0
lea ecx, [rsi + 0x20]
movups xmmword [rax], xmm0
mov dword [0x140134854], ecx
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1400c1d70
mov rcx, rbx
call fcn.1400c19d0
mov rax, qword [rbx + 0x18]
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rdi], 4
mov rax, qword [rbx + 0x40]
mov dword [rax], 4
mov qword [rax + 8], rdi
jmp 0x1400c1ce4
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__Kind__DUMP_EXPR_NAMED_CONSTANT
mov edx, 0xbd
lea rcx, str.com_rpcmidlexprdumpexpr.cxx
call fcn.1400c7a2c
int3
Function at 0x1400c1de0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x30]
mov rbx, rcx
test rax, rax
je 0x1400c1e1a
cmp dword [rax], 3
jne 0x1400c1f05
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400c1ee2
mov ecx, dword [0x140134854]
xorps xmm0, xmm0
add ecx, 0x10
mov qword [rbx + 0x30], rax
mov esi, ecx
mov dword [0x140134854], ecx
mov ecx, 0x30
movups xmmword [rax], xmm0
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400c1ee2
xorps xmm0, xmm0
lea ecx, [rsi + 0x30]
movups xmmword [rax], xmm0
mov dword [0x140134854], ecx
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1400c1e94
mov rcx, rbx
call fcn.1400c19d0
mov rax, qword [rbx + 0x18]
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rdi], 3
mov eax, dword [rbx + 0x20]
mov dword [rdi + 0x20], eax
mov ecx, dword [rbx + 0x20]
test ecx, ecx
je 0x1400c1ec7
sub ecx, 1
je 0x1400c1ec7
sub ecx, 0x10
jne 0x1400c1ec7
mov eax, dword [rbx + 0x28]
mov dword [rdi + 0x28], eax
jmp 0x1400c1ecf
mov rax, qword [rbx + 0x28]
mov qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
mov dword [rax], 3
mov qword [rax + 8], rdi
jmp 0x1400c1e04
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__Kind__DUMP_EXPR_CONSTANT
mov edx, 0xd6
lea rcx, str.com_rpcmidlexprdumpexpr.cxx
call fcn.1400c7a2c
int3

Function at 0x1400c1f24
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
mov rbx, rcx
test rax, rax
je 0x1400c1f44
cmp dword [rax], 0
jge 0x1400c1fdd
jmp 0x1400c1fd1
mov ecx, 0x28
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x1400c1f7d
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x28
xorps xmm0, xmm0
mov qword [rbx + 0x28], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], rcx
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x1400c1fab
mov rcx, rbx
call fcn.1400c19d0
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x28]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov rax, qword [rbx + 0x28]
mov dword [rax], 1
mov rcx, qword [rbx + 0x28]
mov eax, dword [rbx + 0x20]
mov dword [rcx + 0x20], eax
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__node.kind___DUMP_EXPR_ERROR
mov edx, 0x102
lea rcx, str.com_rpcmidlexprdumpexpr.cxx
call fcn.1400c7a2c
int3
Function at 0x1400c2000
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x38]
mov rbx, rcx
test rax, rax
je 0x1400c2044
cmp dword [rax], 5
jne 0x1400c2172
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov esi, 0x10
mov ecx, esi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400c214f
mov edx, dword [0x140134854]
xorps xmm0, xmm0
add edx, esi
mov qword [rbx + 0x38], rax
mov ecx, esi
mov dword [0x140134854], edx
mov edi, edx
movups xmmword [rax], xmm0
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x1400c214f
xorps xmm0, xmm0
lea ebp, [rdi + 0x10]
mov ecx, 0x30
mov dword [0x140134854], ebp
movups xmmword [rax], xmm0
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400c214f
xorps xmm0, xmm0
lea ecx, [rbp + 0x30]
movups xmmword [rax], xmm0
mov dword [0x140134854], ecx
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rax, qword [rbx + 0x28]
test rax, rax
jne 0x1400c20ec
mov rcx, rbx
call fcn.1400c1f24
mov rax, qword [rbx + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rdi + 0x20], xmm0
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0xe8]
call qword [case.0x1400cd70e.0]
mov qword [rdi + 0x28], rax
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x90]
call qword [case.0x1400cd70e.0]
mov dword [rsi], eax
dec eax
cmp eax, 0x20
ja 0x1400c213c
mov qword [rsi + 8], rdi
mov rax, qword [rbx + 0x38]
mov dword [rax], 5
mov qword [rax + 8], rsi
jmp 0x1400c2029
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__Kind__DUMP_EXPR_OPERON
mov edx, 0x116
lea rcx, str.com_rpcmidlexprdumpexpr.cxx
call fcn.1400c7a2c
int3