joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rdx, str._.16g
movq r8, xmm1
movapd xmm2, xmm1
mov rbx, rcx
call sym.sprintf.constprop.0
mov rdx, rbx
xor r9d, r9d
cdqe
lea r10, [rbx + rax]
test rax, rax
jg 0x140004c61
jmp 0x140004cf0
mov ecx, r8d
and ecx, 0xffffffdf
sub ecx, 0x41
cmp cl, 0x19
seta cl
cmp r8b, 0x2e
setne r8b
add rdx, 1
and ecx, r8d
xor ecx, 1
or r9d, ecx
cmp r10, rdx
je 0x140004c7d
movzx r8d, byte [rdx]
cmp r8b, 0x2c
jne 0x140004c38
mov byte [rdx], 0x2e
add rdx, 1
mov r9d, 1
cmp r10, rdx
jne 0x140004c61
mov rsi, rax
test r9b, r9b
je 0x140004cf0
movzx ecx, byte [rbx + rax - 1]
mov eax, ecx
and eax, 0xffffffdf
cmp al, 0x4e
je 0x140004d10
lea r8d, [rcx - 0x29]
cmp r8b, 0x3b
ja 0x140004ce5
movabs r9, 0x800000008000001
xor eax, eax
mov edx, 0x6e
bt r9, r8
jae 0x140004d20
lea rcx, [0x14010a236]
nop dword [rax + rax]
mov byte [rbx + rax], dl
add rax, 1
movzx edx, byte [rcx + rax]
test dl, dl
jne 0x140004cc0
mov rcx, qword [0x14012c5f0]
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140004ce5
mov esi, 3
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
ret
movzx ecx, byte [rbx + rax - 1]
mov edx, 0x302e
mov byte [rbx + rax + 2], 0
lea rsi, [rax + 2]
mov word [rbx + rax], dx
mov eax, ecx
and eax, 0xffffffdf
cmp al, 0x4e
jne 0x140004c93
mov edx, 0x6e
xor eax, eax
jmp 0x140004cb4
cmp cl, 0x46
jne 0x140004ce5
movzx ecx, byte [rbx]
mov edx, 0x69
xor eax, eax
lea r8, [0x14010a23a]
cmp cl, 0x2d
je 0x140004d55
nop dword [rax + rax]
mov byte [rbx + rax], dl
add rax, 1
movzx edx, byte [r8 + rax]
test dl, dl
jne 0x140004d40
jmp 0x140004ccf
lea rdx, str._inf
nop dword [rax]
mov byte [rbx + rax], cl
add rax, 1
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x140004d60
mov rcx, qword [0x14012c5f0]
call dbg.__emutls_get_address
cmp byte [rax], 0
mov eax, 4
cmove rsi, rax
jmp 0x140004ce5

Function at 0x140004fe0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [0x14012c5f0]
xor ebx, ebx
mov rdi, qword [rcx]
mov rsi, qword [rcx + 8]
test rdi, rdi
jg 0x14000501f
jmp 0x14000509d
sub rax, 0x10
jo 0x1400050ab
mov qword [rcx - 0x10], rax
add rbx, 1
cmp rdi, rbx
je 0x140005075
mov rcx, qword [rsi + rbx*8 + 8]
test rcx, rcx
je 0x140005016
mov rax, qword [rcx - 0x10]
lea rdx, [rcx - 0x10]
cmp rax, 0xf
ja 0x140005008
cmp qword [rdx + 8], 0
jle 0x14000504b
mov rcx, rdx
call sym.unregisterCycle__system_u2958
mov rcx, qword [rsi + rbx*8 + 8]
call fcn.1400c5580
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x14000507b
mov rcx, qword [rsi + rbx*8 + 8]
mov edx, 8
add rbx, 1
call sym.nimRawDispose
cmp rdi, rbx
jne 0x14000501f
test byte [rsi + 7], 0x40
je 0x140005088
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.alignedDealloc
test rsi, rsi
jne 0x140005075
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.raiseOverflow
jmp 0x140005016
Function at 0x140007870
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rax, [0x14010a400]
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x20]
mov edx, 0xfa0
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov rbp, qword [0x14012c5f0]
mov qword [rsp + 0x40], rax
mov rbx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
test rbx, rbx
jle 0x140007a58
nop word [rax + rax]
mov rax, qword [rsp + 0x48]
mov r9, rsi
mov r8d, 0xfa0
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov rbx, rax
cmp rax, 0xfa0
je 0x1400079e0
mov rcx, rsi
call sym.ferror
test eax, eax
je 0x140007927
mov rcx, rsi
call sym.checkErr__stdZsyncio_u165.part.0
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140007a90
test rbx, rbx
js 0x140007ab0
mov rdx, rbx
lea rcx, [rsp + 0x40]
call sym.setLengthStrV2
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
jle 0x1400079b8
mov rax, rbx
add rax, 1
jo 0x140007a8b
test rax, rax
js 0x140007ace
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
lea r9, [r8 + rdx + 8]
lea rdx, [rcx + 8]
mov r8, rax
mov rcx, r9
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140007a8b
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x48]
nop dword [rax]
test rcx, rcx
je 0x1400079c7
test byte [rcx + 7], 0x40
je 0x140007aa0
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140007a90
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jle 0x140007a58
mov rcx, rbx
add rcx, 1
jo 0x140007a6d
test rcx, rcx
js 0x140007a78
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r8, rcx
lea rax, [rdx + rax + 8]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
add rdx, 8
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140007a6d
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jg 0x1400078e8
nop dword [rax + rax]
xor ecx, ecx
lea rdx, [rbx - 1]
call sym.raiseIndexError2
mov rcx, qword [rsp + 0x48]
jmp 0x1400079b8
call sym.raiseOverflow
jmp 0x140007a45
movabs r8, 0x7fffffffffffffff
xor edx, edx
call sym.raiseRangeErrorI
jmp 0x140007a45
call sym.raiseOverflow
mov rcx, qword [rsp + 0x48]
jmp 0x1400079b8
call sym.deallocShared
jmp 0x1400079c7
movabs r8, 0x7fffffffffffffff
mov rcx, rbx
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x1400079b8
movabs r8, 0x7fffffffffffffff
mov rcx, rax
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x1400079b8
Function at 0x140007af0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov qword [rsp + 0x38], 0
test r8, r8
js 0x140007bf0
lea r14, [rsp + 0x20]
mov rdx, r8
mov rcx, r14
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
test rdx, rdx
jle 0x140007c40
mov rax, qword [rsp + 0x38]
mov r9, rsi
mov r8, rbx
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov rbp, rax
cmp rbx, rax
je 0x140007b83
mov rcx, rsi
call sym.ferror
test eax, eax
jne 0x140007c10
mov rcx, qword [0x14012c5f0]
call dbg.__emutls_get_address
cmp byte [rax], 0
mov r12, rax
jne 0x140007bd3
mov rcx, rsi
call sym.fgetc
mov rdx, rsi
mov ecx, eax
mov r13d, eax
call sym.ungetc
cmp byte [r12], 0
jne 0x140007bd3
test r13d, r13d
jns 0x140007c50
cmp rbx, rbp
jle 0x140007bd3
test rbp, rbp
js 0x140007c20
lea rcx, [rsp + 0x30]
mov rdx, rbp
call sym.setLengthStrV2
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
call sym.raiseRangeErrorI
jmp 0x140007bd3
mov rcx, rsi
call sym.checkErr__stdZsyncio_u165.part.0
jmp 0x140007b83
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
call sym.raiseRangeErrorI
jmp 0x140007bd3
sub rdx, 1
xor ecx, ecx
call sym.raiseIndexError2
jmp 0x140007bd3
mov rdx, rsi
mov rcx, r14
call sym.readAllBuffer__stdZsyncio_u519
cmp byte [r12], 0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jne 0x140007cb6
lea rcx, [rsp + 0x30]
mov rdx, rbx
call sym.prepareAdd
test rbx, rbx
jle 0x140007cb6
mov rcx, rbx
add rcx, 1
jo 0x140007cd6
test rcx, rcx
js 0x140007ce0
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r8, rcx
lea rax, [rdx + rax + 8]
lea rdx, [rsi + 8]
mov rcx, rax
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140007cd6
mov qword [rsp + 0x30], rbx
test rsi, rsi
je 0x140007bd3
test byte [rsi + 7], 0x40
jne 0x140007bd3
mov rcx, rsi
call sym.deallocShared
jmp 0x140007bd3
call sym.raiseOverflow
jmp 0x140007cb6
movabs r8, 0x7fffffffffffffff
xor edx, edx
call sym.raiseRangeErrorI
jmp 0x140007cb6

Function at 0x140008510
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x14000852f
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sym.fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fflush
Function at 0x140008610
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
mov ecx, 2
call rsi
lea rdx, str.could_not_load:
mov rcx, rax
add rbx, 8
call sym.rawWrite
test rdi, rdi
mov ecx, 2
lea rax, [0x14010a518]
cmove rbx, rax
call rsi
mov rcx, rax
mov rdx, rbx
call sym.rawWrite
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
je 0x14000868c
mov ecx, 2
call rsi
lea rdx, [0x14010a561]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
mov ecx, 2
call rsi
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call sym.rawWrite
jmp 0x14000866c

Function at 0x1400086b0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
lea rdx, [0x14010a561]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop dword [rax]

Function at 0x140008860
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14013e120]
test rax, rax
je 0x140008872
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop word [rax + rax]

Function at 0x140009db0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r10, qword [rdx + 8]
mov r9, rdx
sar rdx, 0x15
mov r8, rcx
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x20a0]
test rax, rax
jne 0x140009de0
jmp 0x140009e0a
mov rax, qword [rax]
test rax, rax
je 0x140009e0a
cmp rdx, qword [rax + 8]
jne 0x140009dd8
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rdx, qword [r8 + 0x2078]
mov rcx, r9
cmp rdx, rax
cmovl rdx, rax
sub rax, r10
mov qword [r8 + 0x2070], rax
mov qword [r8 + 0x2078], rdx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140009e4a
add rsp, 0x28
ret
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140009f50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r9, rdx
mov rax, rcx
and r9, 0xfffffffffffff000
mov rcx, qword [r9 + 8]
cmp rcx, 0xfb0
jle 0x140009fa0
mov r8, qword [r9 + 0x10]
lea r10, [r9 + 0x18]
lea rdx, [r8 + 0x2098]
cmp r8, rax
je 0x14000a020
mov rax, qword [rdx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rdx], r9
jne 0x14000a010
add rsp, 0x28
ret
cmp qword [r9 + 0x10], rax
je 0x140009fc0
lea rcx, [r9 + 0x40]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rdx]
lock cmpxchg qword [rcx], rdx
je 0x140009f96
mov qword [rdx], rax
jmp 0x140009faa
sub qword [rax + 0x2088], rcx
mov r8, qword [r9 + 0x28]
mov qword [rdx], r8
mov qword [r9 + 0x28], rdx
mov rdx, qword [r9 + 0x30]
cmp rdx, rcx
jge 0x14000a048
test rcx, rcx
lea rdx, [rcx + 0xf]
cmovns rdx, rcx
sar rdx, 4
mov r8, qword [rax + rdx*8]
mov qword [r9 + 0x18], r8
test r8, r8
je 0x140009ffb
mov qword [r8 + 0x20], r9
mov qword [rax + rdx*8], r9
add qword [r9 + 0x30], rcx
add rsp, 0x28
ret
mov qword [r10], rax
jmp 0x140009f86
sub qword [r8 + 0x2088], rcx
mov r10, qword [r9 + 8]
cmp r10, 0x3f000000
jg 0x14000a0b0
mov rdx, r9
mov rcx, r8
add rsp, 0x28
jmp sym.freeBigChunk__system_u6557
add rdx, rcx
mov qword [r9 + 0x30], rdx
cmp rdx, 0xfb0
jne 0x140009f96
test rcx, rcx
lea rdx, [rcx + 0xf]
cmovns rdx, rcx
mov rcx, qword [r9 + 0x18]
sar rdx, 4
cmp r9, qword [rax + rdx*8]
je 0x14000a160
mov rdx, qword [r9 + 0x20]
mov qword [rdx + 0x18], rcx
test rcx, rcx
je 0x14000a08e
mov rdx, qword [r9 + 0x20]
mov qword [rcx + 0x20], rdx
pxor xmm0, xmm0
mov rdx, r9
mov rcx, rax
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x28
jmp sym.freeBigChunk__system_u6557
mov rcx, r9
sar rcx, 0x15
movzx edx, cl
mov rdx, qword [rax + rdx*8 + 0x20a0]
test rdx, rdx
jne 0x14000a0d8
jmp 0x14000a103
mov rdx, qword [rdx]
test rdx, rdx
je 0x14000a103
cmp rcx, qword [rdx + 8]
jne 0x14000a0d0
mov rcx, r9
mov r8d, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl r8, cl
sar r11, 6
not r8
and qword [rdx + r11*8 + 0x10], r8
mov rdx, qword [rax + 0x2070]
mov rcx, qword [rax + 0x2078]
mov r8d, 0x8000
cmp rcx, rdx
cmovl rcx, rdx
sub rdx, r10
mov qword [rax + 0x2070], rdx
xor edx, edx
mov qword [rax + 0x2078], rcx
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140009f96
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop dword [rax + rax]
mov qword [rax + rdx*8], rcx
test rcx, rcx
je 0x14000a08e
mov qword [rcx + 0x20], 0
jmp 0x14000a08e

Function at 0x14000a360
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968

Function at 0x14000a390
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968
Function at 0x14000a3c0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968

Function at 0x14000a3f0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
lea rcx, [0x1401074c0]
mov rsi, rdx
call dbg.__emutls_get_address
mov rcx, rax
cmp rsi, 0x10
jle 0x14000a418
movzx eax, word [rbx - 2]
sub rbx, rax
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.rawDealloc__system_u6968

Function at 0x14000a4b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x14000a4c4
test byte [rbx + 7], 0x40
je 0x14000a4d0
add rsp, 0x20
pop rbx
ret
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968

Function at 0x14000a8b0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
test rdx, rdx
je 0x14000a910
mov rax, rdx
sub rax, 1
jo 0x14000a931
mov rdx, rax
add rdx, 0x10
jo 0x14000a931
not rax
and rax, rdx
sub rbx, rax
cmp rsi, 0x10
jle 0x14000a914
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rcx, rax
movzx eax, word [rbx - 2]
sub rbx, rax
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.rawDealloc__system_u6968
sub rbx, 0x10
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
jmp sym.rawDealloc__system_u6968
call sym.raiseOverflow
xor eax, eax
jmp 0x14000a8d9

Function at 0x14000aaf0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rdx, qword [rax]
mov rbx, rcx
test rdx, rdx
je 0x14000ab19
call rdx
lea rcx, [0x1401074a0]
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x14000ab80
mov rax, qword [rbx]
movsx rax, word [rax + 0x10]
test rax, rax
je 0x14000ab60
mov rcx, rax
lea rdx, [rax + 0xf]
neg rcx
and rdx, rcx
sub rbx, rdx
cmp rax, 0x10
jle 0x14000ab64
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
movzx eax, word [rbx - 2]
sub rdx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968
sub rbx, 0x10
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968
add rsp, 0x20
pop rbx
ret
Function at 0x14000b150
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
imul rdx, qword [rcx + 8], 3
mov rsi, rcx
jo 0x14000b1fb
mov rax, rdx
shr rax, 0x3f
add rax, rdx
sar rax, 1
imul rbx, rax, 0x10
mov qword [rcx + 8], rax
jo 0x14000b1fb
test rbx, rbx
js 0x14000b228
mov r12, qword [rcx + 0x10]
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdi, rax
test rbx, rbx
je 0x14000b210
mov rdx, rbx
mov rcx, rax
call sym.rawAlloc__system_u6816
mov rbp, rax
test r12, r12
je 0x14000b1ec
mov rax, r12
mov rdx, r12
mov rcx, rbp
and rax, 0xfffffffffffff000
mov r8, qword [rax + 8]
lea rax, [r8 - 0x30]
cmp r8, 0xfb0
cmovg r8, rax
cmp rbx, r8
cmovle r8, rbx
call sym.memcpy
mov rdx, r12
mov rcx, rdi
call sym.rawDealloc__system_u6968
mov qword [rsi + 0x10], rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseOverflow
test r12, r12
je 0x14000b220
mov rdx, r12
mov rcx, rax
call sym.rawDealloc__system_u6968
xor ebp, ebp
jmp 0x14000b1ec
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseRangeErrorI

Function at 0x14000b250
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
imul rdx, qword [rcx + 8], 3
mov rsi, rcx
jo 0x14000b2fb
mov rax, rdx
shr rax, 0x3f
add rax, rdx
sar rax, 1
imul rbx, rax, 0x10
mov qword [rcx + 8], rax
jo 0x14000b2fb
test rbx, rbx
js 0x14000b328
mov r12, qword [rcx + 0x10]
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdi, rax
test rbx, rbx
je 0x14000b310
mov rdx, rbx
mov rcx, rax
call sym.rawAlloc__system_u6816
mov rbp, rax
test r12, r12
je 0x14000b2ec
mov rax, r12
mov rdx, r12
mov rcx, rbp
and rax, 0xfffffffffffff000
mov r8, qword [rax + 8]
lea rax, [r8 - 0x30]
cmp r8, 0xfb0
cmovg r8, rax
cmp rbx, r8
cmovle r8, rbx
call sym.memcpy
mov rdx, r12
mov rcx, rdi
call sym.rawDealloc__system_u6968
mov qword [rsi + 0x10], rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseOverflow
test r12, r12
je 0x14000b320
mov rdx, r12
mov rcx, rax
call sym.rawDealloc__system_u6968
xor ebp, ebp
jmp 0x14000b2ec
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseRangeErrorI
Function at 0x14000b560
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rdx
add rbx, qword [rcx]
mov rsi, rcx
jo 0x14000b643
mov rbp, qword [rcx + 8]
test rbp, rbp
je 0x14000b597
movabs rdx, 0x4000000000000000
mov rax, qword [rbp]
and rdx, rax
je 0x14000b630
mov r8, rbx
add r8, 1
jo 0x14000b643
mov rdi, r8
add rdi, 8
jo 0x14000b643
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rdi
test rdi, rdi
js 0x14000b6ac
lea rcx, [0x1401074c0]
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
call sym.rawAlloc__system_u6816
mov r8, rdi
xor edx, edx
mov rcx, rax
call sym.memset
mov qword [rsi + 8], rax
mov qword [rax], rbx
mov rcx, qword [rsi]
test rcx, rcx
jle 0x14000b63a
cmp rbx, rcx
cmovle rcx, rbx
test rcx, rcx
js 0x14000b6a0
mov rax, qword [rsi + 8]
mov r8, rcx
lea rdx, [rbp + 8]
add rax, 8
mov rcx, rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.memcpy
btr rax, 0x3e
cmp rbx, rax
jg 0x14000b650
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.raiseOverflow
test rax, rax
jle 0x14000b6c0
cmp rax, 0x7fff
jg 0x14000b6d0
lea rdx, [rax + rax]
add rax, 9
js 0x14000b6f0
cmp rbx, rdx
cmovl rbx, rdx
mov rcx, rbx
add rcx, 1
jo 0x14000b643
add rcx, 8
jo 0x14000b643
test rcx, rcx
js 0x14000b6a0
mov r8, rcx
mov rcx, qword [rsi + 8]
mov rdx, rax
call sym.realloc0Impl__system_u1770
mov qword [rsi + 8], rax
mov qword [rax], rbx
jmp 0x14000b63a
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.raiseRangeErrorI
mov edx, 4
jmp 0x14000b661
imul rcx, rax, 3
jo 0x14000b701
mov rdx, rcx
shr rdx, 0x3f
add rdx, rcx
sar rdx, 1
jmp 0x14000b661
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rax
jmp 0x14000b6ac
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
call sym.raiseOverflow
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14000b661

Function at 0x14000b840
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rdx]
mov rdx, qword [rdx + 8]
mov rsi, rcx
test rbx, rbx
jle 0x14000b886
mov rcx, rbx
add rcx, 1
jo 0x14000b88d
test rcx, rcx
js 0x14000b8a0
mov r8, qword [rsi + 8]
mov rax, qword [rsi]
add rdx, 8
lea rax, [r8 + rax + 8]
mov r8, rcx
mov rcx, rax
call sym.memcpy
add rbx, qword [rsi]
jo 0x14000b88d
mov qword [rsi], rbx
add rsp, 0x28
pop rbx
pop rsi
ret
add rsp, 0x28
pop rbx
pop rsi
jmp sym.raiseOverflow
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.raiseRangeErrorI

Function at 0x14000caa0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov qword [rcx], rdx
test rbx, rbx
je 0x14000cb00
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x14000cae0
sub rax, 0x10
jo 0x14000cb06
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow