joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dd60
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rsi
mov r8, rdi
mov edx, 1
mov rbx, rax
mov r9, rax
call sym.fwrite
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.fflush

Function at 0x14000dda0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x48
cmp qword [0x140135110], 0
mov rbx, rcx
je 0x14000de18
lea rsi, [rsp + 0x30]
mov rdx, rcx
mov rcx, rsi
call sym.cstrToNimstr
mov rbx, qword [rsp + 0x38]
mov rcx, rsi
call qword [0x140135110]
test rbx, rbx
je 0x14000dddc
test byte [rbx + 7], 0x40
je 0x14000ddf8
lea rcx, [0x1400ff4a0]
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x14000de50
add rsp, 0x48
pop rbx
pop rsi
ret
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
call sym.rawDealloc__system_u6968
jmp 0x14000dddc
mov qword [rsp + 0x28], rdx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rbx
mov edx, 1
mov rsi, rax
mov r9, rax
call sym.fwrite
mov rcx, rsi
add rsp, 0x48
pop rbx
pop rsi
jmp sym.fflush
mov byte [rax], 0
lea rcx, [0x1400ff3a0]
call dbg.__emutls_get_address
mov rbx, qword [rax]
mov rsi, qword [rbx + 0x38]
test rsi, rsi
je 0x14000de79
mov rdx, qword [rsi - 0x10]
add rdx, 0x10
jo 0x14000dec3
mov qword [rsi - 0x10], rdx
mov qword [rax], rsi
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x14000dea8
sub rax, 0x10
jo 0x14000ded4
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x48
pop rbx
pop rsi
jmp sym.rememberCycle__system_u3375
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
jmp sym.nimDestroyAndDispose
mov qword [rsp + 0x28], rax
call sym.raiseOverflow
mov rax, qword [rsp + 0x28]
jmp 0x14000de79
add rsp, 0x48
pop rbx
pop rsi
jmp sym.raiseOverflow

Function at 0x14000dee0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, str.SIGINT:_Interrupted_by_Ctrl_C._n
cmp ecx, 2
je 0x14000df30
lea rbx, str.SIGSEGV:_Illegal_storage_access.__Attempt_to_read_from_nil___n
cmp ecx, 0xb
je 0x14000df30
lea rbx, str.SIGABRT:_Abnormal_termination._n
cmp ecx, 0x16
je 0x14000df30
lea rbx, str.SIGFPE:_Arithmetic_error._n
cmp ecx, 8
je 0x14000df30
lea rbx, str.SIGILL:_Illegal_operation._n
cmp ecx, 4
je 0x14000df30
lea rbx, str.unknown_signal_n
nop dword [rax + rax]
mov rcx, rbx
call sym.strlen
mov rcx, rbx
mov rdx, rax
call sym.showErrorMessage__system_u3952
mov ecx, 1
call sym.exit
nop
nop
Function at 0x14000e010
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r8, qword [rcx]
add r8, 1
mov rsi, rcx
jo 0x14000e09b
mov rbx, r8
add rbx, 8
jo 0x14000e09b
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
test rbx, rbx
js 0x14000e0bc
lea rcx, [0x1400ff4c0]
mov rdi, qword [rsi + 8]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
call sym.rawAlloc__system_u6816
xor edx, edx
mov r8, rbx
mov rcx, rax
call sym.memset
mov rcx, qword [rsi]
mov qword [rsi + 8], rax
mov qword [rax], rcx
add rcx, 1
jo 0x14000e09b
test rcx, rcx
js 0x14000e0b0
mov rax, qword [rsi + 8]
mov r8, rcx
lea rdx, [rdi + 8]
add rax, 8
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.memcpy
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.raiseOverflow
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.raiseRangeErrorI

Function at 0x14000e840
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rdx + 8]
mov rdi, qword [rcx + 8]
mov rbp, qword [rdx]
mov rbx, rcx
cmp rdi, rsi
je 0x14000e961
test rsi, rsi
je 0x14000e938
test byte [rsi + 7], 0x40
jne 0x14000e938
test rdi, rdi
je 0x14000e8b0
movabs rdx, 0x4000000000000000
mov rax, qword [rdi]
test rax, rdx
jne 0x14000e8b0
btr rax, 0x3e
cmp rax, rbp
jge 0x14000e970
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
call sym.rawDealloc__system_u6968
mov rdi, rbp
add rdi, 1
jo 0x14000e99e
mov r12, rdi
add r12, 8
jo 0x14000e99e
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r12
test r12, r12
js 0x14000e98f
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, r12
mov rcx, rax
call sym.rawAlloc__system_u6816
mov r8, r12
xor edx, edx
mov rcx, rax
call sym.memset
mov qword [rbx + 8], rax
mov qword [rax], rbp
mov qword [rbx], rbp
test rdi, rdi
js 0x14000e980
mov rcx, qword [rbx + 8]
lea rdx, [rsi + 8]
mov r8, rdi
add rcx, 8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.memcpy
test rdi, rdi
je 0x14000e95a
test byte [rdi + 7], 0x40
jne 0x14000e95a
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
call sym.rawDealloc__system_u6968
mov qword [rbx], rbp
mov qword [rbx + 8], rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdi, [rbp + 1]
jmp 0x14000e90d
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseRangeErrorI
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseOverflow
Function at 0x14000ea90
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebx, ebx
lea r12, [0x1400ff4c0]
mov rbp, qword [rcx]
mov rdi, qword [rcx + 8]
test rbp, rbp
jg 0x14000eac1
jmp 0x14000eb08
add rbx, 1
cmp rbp, rbx
je 0x14000eaf4
mov rax, rbx
shl rax, 4
mov rsi, qword [rdi + rax + 0x10]
test rsi, rsi
je 0x14000eab8
test byte [rsi + 7], 0x40
jne 0x14000eab8
mov rcx, r12
add rbx, 1
call dbg.__emutls_get_address
mov rdx, rsi
mov rcx, rax
call sym.rawDealloc__system_u6968
cmp rbp, rbx
jne 0x14000eac1
test byte [rdi + 7], 0x40
je 0x14000eb20
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test rdi, rdi
jne 0x14000eaf4
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rawDealloc__system_u6968

Function at 0x14000eb50
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rdx + 8]
mov rdi, qword [rcx + 8]
mov rbp, qword [rdx]
mov rbx, rcx
cmp rdi, rsi
je 0x14000ec71
test rsi, rsi
je 0x14000ec48
test byte [rsi + 7], 0x40
jne 0x14000ec48
test rdi, rdi
je 0x14000ebc0
movabs rdx, 0x4000000000000000
mov rax, qword [rdi]
test rax, rdx
jne 0x14000ebc0
btr rax, 0x3e
cmp rbp, rax
jle 0x14000ec80
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
call sym.rawDealloc__system_u6968
mov rdi, rbp
add rdi, 1
jo 0x14000ecae
mov r12, rdi
add r12, 8
jo 0x14000ecae
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r12
test r12, r12
js 0x14000ec9f
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, r12
mov rcx, rax
call sym.rawAlloc__system_u6816
mov r8, r12
xor edx, edx
mov rcx, rax
call sym.memset
mov qword [rbx + 8], rax
mov qword [rax], rbp
mov qword [rbx], rbp
test rdi, rdi
js 0x14000ec90
mov rcx, qword [rbx + 8]
lea rdx, [rsi + 8]
mov r8, rdi
add rcx, 8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.memcpy
test rdi, rdi
je 0x14000ec6a
test byte [rdi + 7], 0x40
jne 0x14000ec6a
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
call sym.rawDealloc__system_u6968
mov qword [rbx], rbp
mov qword [rbx + 8], rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdi, [rbp + 1]
jmp 0x14000ec1d
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseRangeErrorI
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseOverflow

Function at 0x14000f110
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000f168
mov rax, qword [rcx - 0x10]
lea rdx, [rcx - 0x10]
cmp rax, 0xf
jbe 0x14000f148
sub rax, 0x10
jo 0x14000f16e
mov r8, qword [rcx]
mov qword [rcx - 0x10], rax
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rcx]
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow
Function at 0x14000fd00
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x14000fd3f
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x14000fdd0
sub rdx, 0x10
jo 0x14000fe46
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x14000fd52
test byte [rsi + 7], 0x40
je 0x14000fdf0
mov rsi, qword [rbx + 0x30]
test rsi, rsi
je 0x14000fd65
test byte [rsi + 7], 0x40
je 0x14000fe10
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x14000fe34
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x14000fda8
sub rdx, 0x10
jo 0x14000fe3b
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x28
pop rbx
pop rsi
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x14000fd3f
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rsi
mov rcx, rax
call sym.rawDealloc__system_u6968
jmp 0x14000fd52
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rsi
mov rcx, rax
call sym.rawDealloc__system_u6968
mov rax, qword [rbx + 0x38]
test rax, rax
jne 0x14000fd72
add rsp, 0x28
pop rbx
pop rsi
ret
add rsp, 0x28
pop rbx
pop rsi
jmp sym.raiseOverflow
call sym.raiseOverflow
jmp 0x14000fd3f

Function at 0x140010440
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
test rax, rax
jle 0x1400104a0
lea r8, [rax + rdx + 8]
lea rcx, [rdx + 8]
xor eax, eax
nop word [rax + rax]
movzx edx, byte [rcx]
add rcx, 1
add rdx, rax
mov rax, rdx
shl rax, 0xa
add rax, rdx
mov rdx, rax
shr rdx, 6
xor rax, rdx
cmp r8, rcx
jne 0x140010460
lea rax, [rax + rax*8]
mov rdx, rax
shr rdx, 0xb
xor rdx, rax
mov rax, rdx
shl rax, 0xf
add rax, rdx
ret
xor eax, eax
ret

Function at 0x1400112f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rdx]
mov rbx, qword [rcx + 8]
mov rdx, qword [rdx + 8]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
test rbx, rbx
je 0x140011358
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x140011338
sub rax, 0x10
jo 0x14001135e
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow
Function at 0x140011550
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor esi, esi
mov rbp, qword [rcx + 8]
mov rdi, qword [rcx]
lea rbx, [rbp + 0x10]
test rdi, rdi
jg 0x140011598
jmp 0x1400115d4
sub rdx, 0x10
jo 0x14001160f
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
add rsi, 1
add rbx, 0x10
cmp rdi, rsi
je 0x1400115d4
mov rax, qword [rbx]
test rax, rax
je 0x14001158b
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
ja 0x140011570
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
add rsi, 1
add rbx, 0x10
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx - 0x10]
call sym.nimDestroyAndDispose
cmp rdi, rsi
jne 0x140011598
test rbp, rbp
je 0x1400115df
test byte [rbp + 7], 0x40
je 0x1400115f0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rbp
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rawDealloc__system_u6968
call sym.raiseOverflow
jmp 0x14001158b

Function at 0x140012a70
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
mov rbx, qword [rcx + 8]
test rsi, rsi
je 0x140012a95
mov rax, qword [rsi - 0x10]
add rax, 0x10
jo 0x140012af8
mov qword [rsi - 0x10], rax
mov qword [rcx + 8], rsi
mov qword [rcx], rdi
test rbx, rbx
je 0x140012af0
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x140012ad0
sub rax, 0x10
jo 0x140012b09
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.rememberCycle__system_u3375
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.nimDestroyAndDispose
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov qword [rsp + 0x28], rcx
call sym.raiseOverflow
mov rcx, qword [rsp + 0x28]
jmp 0x140012a95
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.raiseOverflow

Function at 0x140012d80
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140012dd8
mov rax, qword [rcx - 0x10]
lea rdx, [rcx - 0x10]
cmp rax, 0xf
jbe 0x140012db8
sub rax, 0x10
jo 0x140012dde
mov r8, qword [rcx]
mov qword [rcx - 0x10], rax
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rcx]
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow

Function at 0x140013030
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968
Function at 0x1400131f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140013248
mov rax, qword [rcx - 0x10]
lea rdx, [rcx - 0x10]
cmp rax, 0xf
jbe 0x140013228
sub rax, 0x10
jo 0x14001324e
mov r8, qword [rcx]
mov qword [rcx - 0x10], rax
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rcx]
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow
Function at 0x140013260
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [rcx]
mov r13, qword [rcx + 8]
lea rbx, [rsp + 0x30]
mov rcx, rbx
call sym.dollar___systemZdollars_u8
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
lea rcx, [0x1400ff4a0]
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x1400133f9
mov rcx, rbx
lea rdx, [rsi + rdi + 1]
call sym.rawNewString
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
lea r14, [rbx + r12 + 8]
test rdi, rdi
jle 0x1400132f8
mov rcx, rdi
add rcx, 1
jo 0x140013517
test rcx, rcx
js 0x1400134e0
mov r8, rcx
lea rdx, [r13 + 8]
mov rcx, r14
call sym.memcpy
add rdi, rbx
jo 0x140013517
lea r14, [rdi + r12 + 8]
mov rbx, rdi
test rsi, rsi
jle 0x140013333
mov rcx, rsi
add rcx, 1
jo 0x14001350d
test rcx, rcx
js 0x1400134c8
mov r8, rcx
lea rdx, [rbp + 8]
mov rcx, r14
call sym.memcpy
add rsi, rbx
jo 0x14001350d
lea r14, [rsi + r12 + 8]
mov rbx, rsi
mov rsi, rbx
mov eax, 0x27
add rsi, 1
mov word [r14], ax
jo 0x140013500
mov ecx, 0x40
call sym.nimNewObj.constprop.0
mov rbx, rax
mov rax, qword [0x140123b50]
mov rdx, qword [rbx + 0x30]
mov qword [rbx + 0x18], rsi
mov qword [rbx], rax
lea rax, str.FieldDefect
mov rsi, qword [rbx + 0x28]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x20], r12
test rdx, rdx
je 0x140013488
mov rdi, rsi
add rdi, 1
jo 0x1400134bb
movabs rax, 0xbfffffffffffffff
and rax, qword [rdx]
cmp rdi, rax
jg 0x140013430
lea rax, [rsi + rsi*2]
mov qword [rbx + 0x28], rdi
lea rdi, str.sysFatal
lea rax, [rdx + rax*8 + 8]
mov qword [rax], rdi
lea rdi, str.fatal.nim
mov qword [rax + 8], 0x35
mov qword [rax + 0x10], rdi
lea rcx, [0x1400ff420]
call dbg.__emutls_get_address
mov rax, qword [rax]
test rax, rax
je 0x140013410
mov rcx, rbx
call rax
test al, al
jne 0x140013410
test rbp, rbp
je 0x1400133f9
test byte [rbp + 7], 0x40
je 0x140013460
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rax, qword [0x140135128]
test rax, rax
je 0x140013425
mov rcx, rbx
call rax
test al, al
je 0x1400133ee
mov rcx, rbx
call sym.raiseExceptionAux__system_u4328.part.0
jmp 0x1400133ee
mov r9d, 0x18
mov r8d, 1
mov rcx, rsi
mov qword [rsp + 0x20], 8
call sym.prepareSeqAdd
mov qword [rbx + 0x30], rax
mov rdx, rax
jmp 0x1400133a7
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rbp
mov rcx, rax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.rawDealloc__system_u6968
xor edx, edx
mov r9d, 0x18
mov rcx, rsi
mov rdi, rsi
mov qword [rsp + 0x20], 8
mov r8d, 1
call sym.prepareSeqAdd
add rdi, 1
mov qword [rbx + 0x30], rax
mov rdx, rax
jno 0x1400133a7
call sym.raiseOverflow
jmp 0x1400133d1
movabs r8, 0x7fffffffffffffff
xor edx, edx
call sym.raiseRangeErrorI
jmp 0x140013333
movabs r8, 0x7fffffffffffffff
xor edx, edx
call sym.raiseRangeErrorI
jmp 0x1400132f8
call sym.raiseOverflow
mov rsi, rbx
jmp 0x140013349
call sym.raiseOverflow
jmp 0x140013333
call sym.raiseOverflow
jmp 0x1400132f8
Function at 0x140014100
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r13, [0x1401350e0]
mov rsi, rdx
mov rbx, rcx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rsi, rsi
jle 0x14001418f
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r14d, r14d
lea r12, [rsp + 0x20]
lea rbp, [0x1400ff4a0]
jmp 0x140014155
add r14, 1
add rbx, 0x10
cmp rsi, r14
je 0x140014196
mov ecx, 1
call rdi
movdqu xmm0, xmmword [rbx]
xor r8d, r8d
mov rdx, r12
mov rcx, rax
movaps xmmword [rsp + 0x20], xmm0
call sym.writeWindows__system_u8954
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
je 0x140014148
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 1
call rdi
mov r8d, 1
mov edx, 1
lea rcx, [0x140102561]
mov r9, rax
call sym.fwrite
mov ecx, 1
call rdi
mov rcx, rax
call sym.fflush
mov rcx, r13
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140014990
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rax, qword [rcx + 8]
cmp qword [rcx], 0
mov ecx, 2
lea rbx, [rax + 8]
lea rax, [0x140102518]
cmove rbx, rax
mov rsi, rdx
call rdi
mov rdx, rbx
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rdi
lea rdx, [0x140102561]
mov rcx, rax
call sym.rawWrite
cmp rsi, 0xffffffff80000000
jl 0x1400149fc
cmp rsi, 0x7fffffff
jle 0x140014a06
mov ecx, 0x7fffffff
call sym.exit
mov ecx, 0x80000000
call sym.exit
mov ecx, esi
call sym.exit
nop
nop

Function at 0x140014ae0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor ebp, ebp
lea r12, [0x1400ff4c0]
mov rax, qword [rcx + 8]
mov r13, qword [rcx]
lea rdi, [rax + 8]
mov qword [rsp + 0x28], rax
test r13, r13
jle 0x140014b70
nop
mov r14, qword [rdi]
mov r15, qword [rdi + 8]
xor ebx, ebx
test r14, r14
jg 0x140014b29
jmp 0x140014b98
add rbx, 1
cmp r14, rbx
je 0x140014b5c
mov rax, rbx
shl rax, 4
mov rsi, qword [r15 + rax + 0x10]
test rsi, rsi
je 0x140014b20
test byte [rsi + 7], 0x40
jne 0x140014b20
mov rcx, r12
add rbx, 1
call dbg.__emutls_get_address
mov rdx, rsi
mov rcx, rax
call sym.rawDealloc__system_u6968
cmp r14, rbx
jne 0x140014b29
test byte [r15 + 7], 0x40
je 0x140014ba0
add rbp, 1
add rdi, 0x10
cmp r13, rbp
jne 0x140014b10
cmp qword [rsp + 0x28], 0
je 0x140014b83
mov rax, qword [rsp + 0x28]
test byte [rax + 7], 0x40
je 0x140014bb5
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x140014b63
jmp 0x140014b5c
mov rcx, r12
call dbg.__emutls_get_address
mov rdx, r15
mov rcx, rax
call sym.rawDealloc__system_u6968
jmp 0x140014b63
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.rawDealloc__system_u6968
Function at 0x140014da0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x140014db4
test byte [rbx + 7], 0x40
je 0x140014dc0
add rsp, 0x20
pop rbx
ret
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968

Function at 0x1400163f0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebx, ebx
lea r12, [0x1400ff4c0]
mov rbp, qword [rcx]
mov rdi, qword [rcx + 8]
test rbp, rbp
jg 0x140016421
jmp 0x140016468
add rbx, 1
cmp rbp, rbx
je 0x140016454
mov rax, rbx
shl rax, 5
mov rsi, qword [rdi + rax + 0x10]
test rsi, rsi
je 0x140016418
test byte [rsi + 7], 0x40
jne 0x140016418
mov rcx, r12
add rbx, 1
call dbg.__emutls_get_address
mov rdx, rsi
mov rcx, rax
call sym.rawDealloc__system_u6968
cmp rbp, rbx
jne 0x140016421
test byte [rdi + 7], 0x40
je 0x140016480
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test rdi, rdi
jne 0x140016454
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rawDealloc__system_u6968

Function at 0x1400165b0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor esi, esi
lea r12, [0x1400ff4c0]
mov r13, qword [rcx + 8]
mov rbp, qword [rcx]
lea rbx, [r13 + 0x18]
test rbp, rbp
jg 0x1400165fc
jmp 0x140016640
mov rdi, qword [rbx + 0x18]
test rdi, rdi
je 0x1400165ef
test byte [rdi + 7], 0x40
je 0x140016620
add rsi, 1
add rbx, 0x30
cmp rbp, rsi
je 0x140016640
mov rdi, qword [rbx]
test rdi, rdi
je 0x1400165e0
test byte [rdi + 7], 0x40
jne 0x1400165e0
mov rcx, r12
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
call sym.rawDealloc__system_u6968
jmp 0x1400165e0
mov rcx, r12
add rsi, 1
add rbx, 0x30
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
call sym.rawDealloc__system_u6968
cmp rbp, rsi
jne 0x1400165fc
test r13, r13
je 0x14001664c
test byte [r13 + 7], 0x40
je 0x140016660
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, [0x1400ff4c0]
call dbg.__emutls_get_address
mov rdx, r13
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.rawDealloc__system_u6968