joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c7ff4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx]
mov r15, rcx
mov ecx, 0x20
mov rbp, r8
mov rsi, rdx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x1400c8054
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x20
and qword [rax + 8], 0
mov qword [rax], rsi
add rsi, rbp
mov r14, rsi
mov qword [rax + 0x10], rbp
xor al, al
cmp byte [r14], al
je 0x1400c808d
movsx ecx, byte [r14]
call qword [sym.imp.msvcrt.dll_isspace]
nop dword [rax + rax]
inc r14
test eax, eax
je 0x1400c806d
mov al, 1
mov byte [rbx + 0x18], al
test al, al
je 0x1400c80c5
mov byte [rbx + 0x19], 0
or rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x1400c809c
cmp rax, 1
jbe 0x1400c80c5
xor ecx, ecx
cmp byte [rsi + rax - 1], 0x5c
jne 0x1400c80bc
inc ecx
sub rax, 1
jne 0x1400c80ad
test cl, 1
je 0x1400c80c5
mov byte [rbx + 0x19], 1
test rdi, rdi
je 0x1400c80e1
mov rax, rdi
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x1400c80ca
test rax, rax
je 0x1400c80e1
mov qword [rax + 8], rbx
jmp 0x1400c80e8
mov qword [r15], rbx
mov qword [r15 + 8], rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400c8150
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
lea rdx, str.client
mov qword [rcx], rdx
mov rdi, rcx
cmp qword [str.client], rbp
movzx ebx, bp
je 0x1400c819f
movzx eax, bx
movzx ebx, word [rdx + 8]
cmp bx, ax
lea rdx, [rdx + 0x10]
cmovle bx, ax
cmp qword [rdx], rbp
jne 0x1400c8188
mov r15d, 1
lea eax, [r15 + rbx]
movsx rax, ax
lea r12, [r15 - 2]
mov dword [rcx + 0x10], eax
mov rcx, rax
lea eax, [r15 + 7]
mul rcx
mov rsi, rax
cmovo rsi, r12
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r9, rax
test rax, rax
jne 0x1400c81fc
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], esi
lea r14, [rdi + 8]
movsx rsi, bx
mov ebx, ebp
mov qword [r14], r9
lea ecx, [rsi + 1]
test esi, esi
js 0x1400c8262
cmp ecx, 2
jb 0x1400c8262
lea rdx, [rax + rsi*8]
cmp r9, r14
ja 0x1400c8229
cmp rdx, r14
jae 0x1400c8262
and ecx, 0x80000001
jge 0x1400c823a
sub ecx, r15d
or ecx, 0xfffffffe
add ecx, r15d
mov eax, esi
sub eax, ecx
add ebx, 2
cmp ebx, eax
jle 0x1400c823e
add eax, 2
mov rcx, r9
cdq
sub eax, edx
xor edx, edx
sar eax, 1
movsxd r8, eax
shl r8, 4
and r8, 0xfffffffffffffff8
call sub.msvcrt.dll_memset
movsxd rcx, ebx
jmp 0x1400c8271
mov rax, qword [r14]
mov qword [rax + rcx*8], rbp
add rcx, r15
cmp rcx, rsi
jle 0x1400c8267
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov word [rdi + 0x14], r12w
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400c88bc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, rdx
mov rsi, rcx
mov rax, rcx
lea edi, [rbx + 1]
cmp byte [rcx], bl
je 0x1400c8932
add rax, rdi
add ebx, edi
cmp byte [rax], 0
jne 0x1400c88e3
test ebx, ebx
je 0x1400c8932
lea edi, [rbx + 1]
mov ecx, edi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x1400c892a
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], edi
jmp 0x1400c8934
xor eax, eax
mov qword [r14], rax
test rax, rax
je 0x1400c894a
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x40]
inc rsi
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1400c8a08
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx]
mov rsi, rdx
mov rdi, rcx
mov r8d, dword [rax]
mov eax, 8
mov dword [rcx + 0x10], r8d
add qword [rdx], 4
movsxd r8, dword [rcx + 0x10]
mul r8
mov rbp, rax
mov rax, 0xffffffffffffffff
cmovo rbp, rax
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ebx, ebx
test rax, rax
jne 0x1400c8a83
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], ebp
mov qword [rdi + 8], rax
cmp dword [rdi + 0x10], ebx
jle 0x1400c8ab4
mov rax, qword [rdi + 8]
movsx rcx, bx
lea rdx, [rax + rcx*8]
mov rcx, qword [rsi]
call fcn.1400c88bc
inc bx
mov qword [rsi], rax
movsx eax, bx
cmp eax, dword [rdi + 0x10]
jl 0x1400c8a92
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c9470
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x1400c9647
mov ecx, 0x1c
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
jne 0x1400c94be
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov qword [rbx + 0x18], rcx
mov r8d, 1
mov al, byte [rbx + 8]
add dword [0x140134854], 0x1c
and al, r8b
mov byte [rcx], al
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 1
and cl, r8b
mov byte [rax + 1], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 2
and cl, r8b
mov byte [rax + 2], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 3
and cl, r8b
mov byte [rax + 3], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 4
and cl, r8b
mov byte [rax + 4], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 5
and cl, r8b
mov byte [rax + 5], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 6
and cl, r8b
mov byte [rax + 6], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 7
and cl, r8b
mov byte [rax + 7], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 8
and cl, r8b
mov byte [rax + 8], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 9
and cl, r8b
mov byte [rax + 9], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0xa
and cl, r8b
mov byte [rax + 0xa], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0xb
and cl, r8b
mov byte [rax + 0xb], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0xc
and cl, r8b
mov byte [rax + 0xc], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0xd
and cl, r8b
mov byte [rax + 0xd], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0xe
and cl, r8b
mov byte [rax + 0xe], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0xf
and cl, r8b
mov byte [rax + 0xf], cl
mov cl, byte [rbx + 0xa]
mov rax, qword [rbx + 0x18]
and cl, r8b
mov byte [rax + 0x10], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0x11
and cl, r8b
mov byte [rax + 0x11], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0x12
and cl, r8b
mov byte [rax + 0x12], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0x13
and cl, r8b
mov byte [rax + 0x13], cl
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
shr ecx, 0x15
and cl, r8b
mov byte [rax + 0x14], cl
mov eax, r8d
mov edx, dword [rbx + 8]
mov rcx, qword [rbx + 0x18]
shr edx, 0x16
and dl, r8b
mov byte [rcx + 0x15], dl
mov edx, dword [rbx + 8]
mov rcx, qword [rbx + 0x18]
shr edx, 0x17
and dl, r8b
mov byte [rcx + 0x16], dl
mov rdx, qword [rbx + 0x18]
mov ecx, dword [rbx + 0x10]
mov dword [rdx + 0x18], ecx
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__NULL
mov edx, 0x7cf
lea rcx, str.com_rpcmidlcommoncmdutil.cxx
call fcn.1400c7a2c
int3
Function at 0x1400c996c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsx rsi, dx
mov rbx, rcx
mov eax, 8
movzx ebp, r8w
mul rsi
mov rdi, rax
mov rax, 0xffffffffffffffff
cmovo rdi, rax
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x1400c99d8
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], edi
mov qword [rbx + 8], rax
mov rax, rbx
mov word [rbx], si
mov rsi, qword [rsp + 0x40]
mov word [rbx + 4], bp
mov rbp, qword [rsp + 0x38]
mov word [rbx + 2], cx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c9a0c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx esi, word [rcx + 4]
mov rbx, rcx
add si, word [rcx]
cmp si, word [rcx]
jle 0x1400c9abf
mov rdi, qword [rcx + 8]
mov eax, 8
movsx rdx, si
mul rdx
mov rbp, rax
mov rax, 0xffffffffffffffff
cmovo rbp, rax
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
mov r8, rax
test rax, rax
je 0x1400c9abf
add dword [0x140134854], ebp
mov rcx, rdi
mov qword [rbx + 8], rax
mov word [rbx], si
test rdi, rdi
je 0x1400c9aa9
cmp dx, word [rbx + 2]
jge 0x1400c9a9d
sub r8, rdi
mov rax, qword [rdi]
inc edx
mov qword [r8 + rdi], rax
lea rdi, [rdi + 8]
movsx eax, word [rbx + 2]
cmp edx, eax
jl 0x1400c9a88
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3

Function at 0x1400c9b38
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov word [rcx], dx
mov rdi, rcx
movsx rdx, dx
mov eax, 8
mul rdx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x1400c9b99
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], ebx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], rax
add rsp, 0x20
pop rdi
ret
Function at 0x1400c9bb8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
movzx ecx, word [rcx + 2]
mov ebp, 1
cmp cx, word [rbx]
jne 0x1400c9c65
movzx edx, word [rbx]
add dx, dx
cmp dx, word [rbx]
jg 0x1400c9c12
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
mov rdi, qword [rbx + 8]
mov rcx, rbx
call fcn.1400c9b38
movzx ecx, word [rbx + 2]
xor r9d, r9d
mov r8d, r9d
cmp r9w, cx
jge 0x1400c9c4d
mov edx, r9d
mov rcx, qword [rbx + 8]
add r8d, ebp
mov rax, qword [rdx + rdi]
mov qword [rdx + rcx], rax
lea rdx, [rdx + 8]
movsx ecx, word [rbx + 2]
cmp r8d, ecx
jl 0x1400c9c31
test rdi, rdi
je 0x1400c9c65
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
movzx ecx, word [rbx + 2]
mov rax, qword [rbx + 8]
movsx rcx, cx
mov qword [rax + rcx*8], rsi
mov rax, rsi
add word [rbx + 2], bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c9cd8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and word [rcx + 4], 0
mov rdi, rdx
and qword [rcx + 8], 0
mov rbx, rcx
mov byte [rcx + 6], 0
test rdx, rdx
jne 0x1400c9d03
mov byte [rcx], 2
jmp 0x1400c9e07
cmp byte [rdx + 2], 0x2d
jne 0x1400c9d20
mov ecx, 1
call fcn.1400cd430
mov qword [rbx + 0x10], rax
mov byte [rbx + 5], 1
jmp 0x1400c9dd2
mov rax, qword [0x140134380]
cmp dword [rax + 0x74], 0
jne 0x1400c9d36
cmp dword [rax + 0x80], 0
je 0x1400c9d8b
mov r8d, 0x20
lea rdx, [0x14010a3a8]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__fsopen]
nop dword [rax + rax]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x1400c9d8b
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.msvcrt.dll_fseek]
nop dword [rax + rax]
test eax, eax
je 0x1400c9dab
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.msvcrt.dll_fclose]
nop dword [rax + rax]
and qword [rbx + 0x10], 0
jmp 0x1400c9dab
mov r8d, 0x20
lea rdx, [0x140116a28]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__fsopen]
nop dword [rax + rax]
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400c9dd7
mov r9d, 0x8000
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_setvbuf]
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x1400c9dfa
mov ebx, 0x8a4
xor edx, edx
mov r8d, ebx
mov r9, rdi
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
xor edx, edx
mov byte [rbx], 1
mov rcx, rbx
call fcn.1400c9e24
and word [rbx + 2], 0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c9e70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov cl, byte [rcx]
cmp cl, 2
je 0x1400c9ecd
cmp byte [rbx + 3], 0
jne 0x1400c9ecd
cmp byte [rbx + 4], 0
jne 0x1400c9ecd
mov edx, 1
cmp cl, dl
jne 0x1400c9ede
mov r9, qword [rbx + 0x10]
mov rcx, rsi
movsxd r8, r8d
call qword [sym.imp.msvcrt.dll_fwrite]
nop dword [rax + rax]
cmp byte [rbx + 5], 0
je 0x1400c9ecd
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.msvcrt.dll_fflush]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test cl, cl
jne 0x1400c9ee8
mov rax, qword [rbx + 0x18]
jmp 0x1400c9eea
xor eax, eax
test rax, rax
je 0x1400c9f42
test cl, cl
jne 0x1400c9ef9
mov rax, qword [rbx + 0x18]
jmp 0x1400c9efb
xor eax, eax
movsxd rdi, r8d
add rax, rdi
cmp rax, qword [rbx + 0x28]
jb 0x1400c9f20
test cl, cl
jne 0x1400c9f10
mov eax, dword [rbx + 0x14]
jmp 0x1400c9f12
xor eax, eax
lea edx, [rax + r8]
mov rcx, rbx
call fcn.1400ca358
mov cl, byte [rbx]
test cl, cl
jne 0x1400c9f2a
mov rcx, qword [rbx + 0x18]
jmp 0x1400c9f2c
xor ecx, ecx
mov r8, rdi
mov rdx, rsi
call sub.msvcrt.dll_memcpy
cmp byte [rbx], 0
jne 0x1400c9ecd
add qword [rbx + 0x18], rdi
jmp 0x1400c9ecd
lea r8, str.GetCurrentPtr_____0
mov edx, 0xdd
lea rcx, str.com_rpcmidlcommon_stream.cxx
call fcn.1400c7a2c
int3

Function at 0x1400ca274
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp byte [rcx], dil
jne 0x1400ca336
movsxd r14, dword [rcx + 0x10]
mov ebp, dword [rcx + 0x14]
mov rsi, qword [rcx + 0x20]
add ebp, r14d
mov dword [rcx + 0x10], ebp
movsxd r15, ebp
mov rcx, r15
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
jne 0x1400ca2e6
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], ebp
add rax, r15
mov r8, r14
mov qword [rbx + 0x28], rax
mov rdx, rsi
mov qword [rbx + 0x20], rcx
call sub.msvcrt.dll_memcpy
mov cl, byte [rbx]
test cl, cl
jne 0x1400ca313
mov rdx, qword [rbx + 0x20]
add rdx, r14
mov qword [rbx + 0x18], rdx
test rsi, rsi
je 0x1400ca329
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov cl, byte [rbx]
test cl, cl
jne 0x1400ca331
mov rdi, qword [rbx + 0x18]
mov rax, rdi
jmp 0x1400ca338
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400ca358
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp byte [rcx], dil
jne 0x1400ca421
movsxd r14, dword [rcx + 0x10]
mov rsi, qword [rcx + 0x20]
movsx ebp, dx
add ebp, dword [rcx + 0x14]
add ebp, r14d
mov dword [rcx + 0x10], ebp
movsxd r15, ebp
mov rcx, r15
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
jne 0x1400ca3cd
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], ebp
add rax, r15
mov r8, r14
mov qword [rbx + 0x28], rax
mov rdx, rsi
mov qword [rbx + 0x20], rcx
call sub.msvcrt.dll_memcpy
mov r8b, byte [rbx]
test r8b, r8b
jne 0x1400ca3fc
mov rdx, qword [rbx + 0x20]
add rdx, r14
mov qword [rbx + 0x18], rdx
test rsi, rsi
je 0x1400ca413
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov r8b, byte [rbx]
test r8b, r8b
jne 0x1400ca41c
mov rdi, qword [rbx + 0x18]
mov rax, rdi
jmp 0x1400ca423
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400ca61c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140135838]
mov rbx, rcx
mov rdx, qword [0x140135820]
sub rax, rdx
cmp rax, rcx
jae 0x1400ca683
mov ecx, 0x7fe8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdx, rax
test rax, rax
jne 0x1400ca675
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea rcx, [rax + 0x7fe8]
mov qword [0x140135838], rcx
lea rcx, [rbx + 7]
mov rax, rdx
and rcx, 0xfffffffffffffff8
add rcx, rdx
mov qword [0x140135820], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x1400ca6a8
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp rdx, qword [rcx + 8]
jne 0x1400ca6d2
mov rax, qword [rcx]
test rax, rax
je 0x1400ca6c6
mov rdx, qword [rax]
mov qword [rcx], rdx
add rsp, 0x28
ret
mov rcx, rdx
add rsp, 0x28
jmp fcn.1400ca61c
lea r8, str.size__element_size
mov edx, 0x42
lea rcx, str.com_rpcmidl_support_freelist.cxx
call fcn.1400c7a2c
int3
Function at 0x1400ca6f4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x40
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400ca79d
mov edx, dword [0x140134854]
lea rax, [0x14012c360]
add edx, 0x40
mov dword [rbx + 8], 0x80019
mov ecx, 0x18
mov dword [0x140134854], edx
mov esi, edx
mov qword [rbx], rax
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x1400ca79d
and qword [rax], 0
lea ecx, [rsi + 0x18]
and qword [rax + 8], 0
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x10], rdi
mov dword [0x140134854], ecx
movzx ecx, word [rbx + 0xa]
sub cx, 2
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x18], rax
mov rax, rbx
mov word [rbx + 0x2a], cx
mov word [rbx + 0x28], cx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
Function at 0x1400ca7c8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov dword [rsp + 0x70], edi
lea r13d, [rdi + 0x51]
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x1400ca96a
mov ebp, dword [0x140134854]
lea r9d, [rdi + 1]
mov r15, qword [rbx + 0x18]
add ebp, r13d
mov rax, qword [rbx + 0x20]
mov dword [0x140134854], ebp
cmp r15, qword [rbx + 0x18]
jne 0x1400ca830
movzx edi, word [rbx + 0x28]
jmp 0x1400ca832
xor edi, edi
cmp r15, rax
jne 0x1400ca83e
movzx r12d, word [rbx + 0x2a]
jmp 0x1400ca843
movzx r12d, word [rbx + 0xa]
xor esi, esi
cmp di, r12w
jae 0x1400ca87d
mov rax, qword [r15 + 0x10]
movzx ecx, di
lea rdx, [rax + rcx*8]
movzx eax, r12w
sub ax, di
movzx r8d, ax
mov rcx, qword [rdx]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400ca868
add rsi, rax
add rdx, 8
sub r8, r9
jne 0x1400ca861
add rsi, r9
cmp r13, rsi
jae 0x1400ca8ba
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x1400ca96a
add ebp, esi
mov r13, rsi
mov dword [0x140134854], ebp
mov byte [r14], 0
cmp di, r12w
jae 0x1400ca8ec
mov esi, 1
mov r8, qword [r15 + 0x10]
mov rdx, r13
movzx eax, di
mov rcx, r14
mov r8, qword [r8 + rax*8]
call fcn.140001250
test eax, eax
js 0x1400ca929
add di, si
cmp di, r12w
jb 0x1400ca8c9
mov rcx, qword [rsp + 0x68]
mov rdx, r14
call fcn.1400c9f64
mov rax, qword [rbx + 0x20]
mov r9d, 1
cmp r15, rax
je 0x1400ca912
mov r15, qword [r15 + 8]
mov edi, dword [rsp + 0x70]
jmp 0x1400ca91a
mov edi, r9d
mov dword [rsp + 0x70], r9d
test edi, edi
jne 0x1400ca951
mov ebp, dword [0x140134854]
jmp 0x1400ca824
xor edx, edx
xor r9d, r9d
xor ecx, ecx
mov r8d, 0x7d5
call fcn.1400c9744
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r14
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400314c8
jmp 0x1400ca93b
xor edx, edx
xor r9d, r9d
xor ecx, ecx
mov r8d, 0x7d5
call fcn.1400c9744
mov ecx, 0x7d5
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3