joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d9b2
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140094af0]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
mov r8d, 0x76c31fc1
call fcn.14003fe73
cmp byte [rdi], 0
je 0x14003d9fb
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x30]
mov rbx, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rdx], rbx
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140011be7
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003d9f3
mov rdi, qword [rcx]
lea rdx, [rdi + rbx]
mov rax, rdi
xor rax, rbx
sub rdx, rax
mov rax, rdi
and rax, rbx
add rax, rax
xor rax, rdx
mov r8d, eax
or eax, 0x67
mov esi, 0xff
and eax, esi
imul eax, eax
imul eax, eax, 0x84cd
or ebx, 0x6c
and ebx, esi
imul ebx, ebx
imul ebx, ebx, 0xabdd
movabs rsi, 0x3d11ca1941914066
lea rdx, [rsi + 1]
cmp eax, ebx
cmove rdx, rsi
movabs rax, 0x7d11ca1941914067
xor rax, r8
xor rax, rdx
test rdi, rax
jne 0x14003d9f3
add rsp, 0x50
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0

Function at 0x14003daab
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140094b00]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
mov r8d, 0xb2f7ddb
call fcn.14003fe73
cmp byte [rdi], 0
je 0x14003daf2
add rsp, 0x58
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x30]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140011be7
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003daeb
test byte [rcx + 7], 0x40
jne 0x14003daeb
add rsp, 0x58
pop rdi
pop rsi
jmp fcn.1400011e0
Function at 0x14003eb23
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov r13, rcx
call fcn.140001066
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [r13], xmm0
movups xmm6, xmmword [0x1400947d0]
movaps xmmword [rsp + 0x40], xmm6
movups xmm0, xmmword [rdi]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x50]
call fcn.14001aa65
cmp byte [rbx], 0
jne 0x14003eba1
lea rdx, [rsp + 0x50]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rsp + 0x40]
call fcn.1400102f9
cmp byte [rbx], 0
je 0x14003ebae
mov byte [rbx], 0
call fcn.140013124
cmp byte [rbx], 0
jne 0x14003ebe4
movups xmm0, xmmword [r12]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
movups xmm0, xmmword [rsi]
lea r8, [rsp + 0x60]
movaps xmmword [r8], xmm0
movaps xmm0, xmmword [rsp + 0x40]
lea r9, [rsp + 0x70]
movaps xmmword [r9], xmm0
lea rcx, [rsp + 0x50]
call fcn.14003eda7
cmp byte [rbx], 0
je 0x14003ec1b
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14003ed8c
test byte [rcx + 7], 0x40
jne 0x14003ed8c
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400011e0
lea rsi, [rsp + 0x50]
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov rcx, rsi
call fcn.14003f671
lea rdx, [rsp + 0x60]
mov qword [rdx], rdi
mov qword [rdx + 8], r14
mov r8, qword [rsi]
mov r9, qword [rsi + 8]
lea rcx, [rsp + 0x30]
call fcn.140027c3e
cmp byte [rbx], 0
je 0x14003ec59
xor r15d, r15d
jmp 0x14003ecfe
lea rcx, [rsp + 0x30]
mov rax, qword [rcx]
mov r15, qword [rcx + 8]
mov qword [rcx], rax
mov qword [rcx + 8], r15
movups xmm0, xmmword [r12]
lea rdx, [rsp + 0x60]
movaps xmmword [rdx], xmm0
call fcn.1400319e8
test rax, rax
je 0x14003eccf
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a60b0]
mov qword [rax], rcx
lea rdx, [0x1400a6100]
mov qword [rax + 0x10], rdx
movups xmmword [rax + 0x18], xmm6
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x28
lea r8, [0x14009fe20]
lea r9, str.bWaBpi
mov rcx, rax
call fcn.14000ed74
jmp 0x14003ecfe
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.14003f6a0
lea rdx, [rsp + 0x60]
mov qword [rdx], rdi
mov qword [rdx + 8], r14
mov r8, qword [rsi]
mov r9, qword [rsi + 8]
lea rcx, [rsp + 0x30]
call fcn.140027e22
cmp byte [rbx], 0
je 0x14003ed39
movabs rsi, 0x4000000000000000
test r15, r15
je 0x14003ed1a
test qword [r15], rsi
jne 0x14003ed1a
mov rcx, r15
call fcn.1400011e0
test r14, r14
je 0x14003ebe4
test qword [r14], rsi
jne 0x14003ebe4
mov rcx, r14
call fcn.1400011e0
jmp 0x14003ebe4
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
movabs rsi, 0x4000000000000000
mov qword [r13], rax
mov qword [r13 + 8], rcx
test r15, r15
je 0x14003ed67
test qword [r15], rsi
jne 0x14003ed67
mov rcx, r15
call fcn.1400011e0
test r14, r14
je 0x14003ed79
test qword [r14], rsi
jne 0x14003ed79
mov rcx, r14
call fcn.1400011e0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14003ed8c
test qword [rcx], rsi
je 0x14003ebfc
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14003f77d
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, r8
mov r14, rdx
mov rsi, rcx
call fcn.140001066
movups xmm0, xmmword [0x140094bd0]
movaps xmmword [rsp + 0x20], xmm0
test rdi, rdi
jle 0x14003f7e0
lea rbx, [rsp + 0x38]
mov rcx, rbx
mov rdx, rdi
call fcn.1400131bc
movups xmm0, xmmword [rbx]
movups xmmword [rbx], xmm0
lea rbx, [rsp + 0x20]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400102f9
mov rcx, qword [rbx + 8]
add rcx, 8
mov rdx, r14
mov r8, rdi
call fcn.140002cd3
lea rdi, [rsp + 0x20]
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003f810
test byte [rcx + 7], 0x40
jne 0x14003f810
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400011e0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14003f867
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3f8
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
call fcn.140001066
mov qword [rsp + 0x28], rbx
test rbx, rbx
jle 0x14003f909
mov r15, rax
lea r13, [rdi + 0x3e8]
xor ebp, ebp
lea rbx, [rsp + 0x30]
mov r12, r14
mov r8d, 0x3c8
mov rcx, rbx
mov rdx, rdi
call fcn.1400907f0
lea rdx, [r14 + rbp]
mov rcx, rbx
mov r8, r13
call fcn.14003637d
cmp byte [r15], 0
jne 0x14003f909
add rbp, 0x10
xor eax, eax
mov cl, byte [r12 + rax]
mov dl, byte [rdi + rax + 0x3c8]
xor dl, byte [rdi + rax + 0x3e8]
mov byte [rsi + rax], dl
mov byte [rdi + rax + 0x3c8], cl
inc rax
cmp rax, 0x10
jne 0x14003f8d5
add rsi, 0x10
add r12, 0x10
cmp rbp, qword [rsp + 0x28]
jl 0x14003f8a9
add rsp, 0x3f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14003fb26
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140094b10]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
mov r8d, 0x774d35b1
call fcn.14003fe73
cmp byte [rdi], 0
je 0x14003fb6d
add rsp, 0x58
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x30]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140011be7
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003fb66
test byte [rcx + 7], 0x40
jne 0x14003fb66
add rsp, 0x58
pop rdi
pop rsi
jmp fcn.1400011e0
Function at 0x14003fbb5
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140094b90]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
mov r8d, 0x18ac0029
call fcn.14003fe73
cmp byte [rdi], 0
je 0x14003fbfe
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x30]
mov rbx, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rdx], rbx
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140011be7
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003fbf6
mov r8, qword [rcx]
mov edx, ebx
not edx
lea edx, [rdx + rdx*2]
mov edi, ebx
add edi, ebx
add edx, ebx
inc edx
xor edx, edi
mov ebx, 0xfffffffe
xor rbx, rdx
movabs rdx, 0x19208492e74035c
add rdx, rbx
mov edi, r8d
or edi, 0xd4
mov esi, 0xff
and edi, esi
imul edi, edi
imul edi, edi, 0xe48f
or ebx, 0xdb
and ebx, esi
imul ebx, ebx
imul ebx, ebx, 0x2db3
movabs rsi, 0x419208492e74035b
lea rax, [rsi + 1]
cmp edi, ebx
cmove rax, rsi
xor rax, rdx
test r8, rax
jne 0x14003fbf6
add rsp, 0x50
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0

Function at 0x14003fcb4
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140094b90]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
mov r8d, 0x7fc4408b
call fcn.14003fe73
cmp byte [rdi], 0
je 0x14003fcfd
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x30]
mov rbx, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rdx], rbx
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140011be7
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003fcf5
mov eax, ebx
not eax
lea eax, [rax + rax*2]
mov edx, ebx
add edx, ebx
add eax, ebx
inc eax
xor eax, edx
movabs rdx, 0x40000000fffffffe
xor rdx, rax
test qword [rcx], rdx
jne 0x14003fcf5
add rsp, 0x50
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0

Function at 0x14003fd63
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140094b20]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
mov r8d, 0x362afcd3
call fcn.14003fe73
cmp byte [rdi], 0
je 0x14003fdaa
add rsp, 0x58
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x30]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140011be7
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003fda3
test byte [rcx + 7], 0x40
jne 0x14003fda3
add rsp, 0x58
pop rdi
pop rsi
jmp fcn.1400011e0
Function at 0x14003fe73
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r15, r8
mov rsi, rcx
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000ec86
mov r14, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rsi], r14
mov qword [rsi + 8], rax
test r14, r14
jle 0x14003fef9
xor r13d, r13d
lea r12, [0x1400a07e0]
xor edi, edi
mov bl, byte [rdi + r12]
mov rcx, rsi
call fcn.140010326
mov rax, r15
mov ecx, ebx
sar rax, cl
mov rcx, qword [rsi + 8]
xor byte [rcx + r13 + 8], al
add rdi, 8
cmp rdi, 0x20
jne 0x14003febf
mov rcx, r15
call fcn.14003ff09
mov r15, rax
inc r13
cmp r13, r14
jne 0x14003febd
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140040421
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call fcn.1400405a1
cmp byte [rdi], 0
jne 0x14004045a
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rcx]
movups xmmword [rsi], xmm0
call fcn.14000ed6d
mov rcx, qword [rsp + 0x28]
add rsp, 0x38
pop rdi
pop rsi
jmp fcn.140003cbb

Function at 0x14004046a
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, rdx
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov rax, qword [rbx]
and eax, 0xf
mov edx, 0x10
sub rdx, rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x20]
mov r8, rdx
call fcn.14001b668
cmp byte [rdi], 0
jne 0x1400404d7
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rbx
mov r8d, 2
mov rcx, rsi
call fcn.14001b52c
cmp byte [rdi], 0
je 0x1400404df
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
jmp fcn.140003cbb

Function at 0x1400404ee
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, r9
mov qword [rsp + 0x20], r8
mov rbx, rdx
mov rdi, rcx
call fcn.140001066
mov rsi, rax
lea r12, [rdi + 0x3c8]
xor r13d, r13d
mov r15, r14
cmp r13, qword [rsp + 0x20]
jge 0x140040590
xor eax, eax
mov cl, byte [rdi + rax + 0x3c8]
xor cl, byte [rbx + rax]
mov byte [r15 + rax], cl
inc rax
cmp rax, 0x10
jne 0x14004052a
lea rbp, [r14 + r13]
mov rcx, rdi
mov rdx, rbp
mov r8, rbp
call fcn.140035d66
cmp byte [rsi], 0
jne 0x140040590
add r13, 0x10
mov r8d, 0xf
lea rcx, [rsp + 0x28]
xor edx, edx
call fcn.14002c590
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rcx, r12
mov r9, rbp
call fcn.140031888
add r15, 0x10
add rbx, 0x10
cmp byte [rsi], 0
je 0x140040521
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140040e50
Capabilities:
Encrypt data using curve25519

Disassembly:
push rax
mov qword [rsp], rcx
mov rax, qword [rsp]
movzx ecx, byte [rax]
and ecx, 0xf8
mov byte [rax], cl
mov rax, qword [rsp]
movzx ecx, byte [rax + 0x1f]
and ecx, 0x7f
mov byte [rax + 0x1f], cl
mov rax, qword [rsp]
movzx ecx, byte [rax + 0x1f]
or ecx, 0x40
mov byte [rax + 0x1f], cl
pop rax
ret

Function at 0x140043d71
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140001066
movups xmm0, xmmword [0x1400948e0]
movups xmmword [rsi], xmm0
cmp byte [rax], 0
je 0x140043d9a
mov byte [rax], 0
add rsp, 0x20
pop rsi
jmp fcn.140013124
nop
add rsp, 0x20
pop rsi
ret

Function at 0x140043da1
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rdi, rcx
call fcn.140001066
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
lea rsi, [rsp + 0x48]
mov edx, 0x11c
mov rcx, rsi
call fcn.1400018bc
mov edx, dword [rsi + 4]
lea rcx, [rsp + 0x38]
call fcn.140020da8
cmp byte [rbx], 0
jne 0x140043e06
lea rcx, [rsp + 0x38]
mov rbp, qword [rcx]
mov r15, qword [rcx + 8]
mov esi, dword [rsp + 0x54]
mov rdx, rsi
call fcn.140020da8
cmp byte [rbx], 0
je 0x140043e1a
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r12, [rsp + 0x38]
mov r13, qword [r12]
mov r14, qword [r12 + 8]
mov eax, esi
not eax
lea eax, [rax + rax*2]
mov ecx, 0xfffffffe
sub ecx, esi
lea eax, [rax + rsi*2]
inc eax
xor eax, ecx
movabs rcx, 0x48feed29c8ec8243
xor rcx, rax
movabs rbx, 0x15a57239eb474c45
imul rbx, rcx
add rbx, rbp
lea rdx, [rbx + r13]
mov rcx, r12
call fcn.14001053f
movups xmm0, xmmword [0x1400948f0]
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm0
mov rcx, r12
mov rdx, rsi
call fcn.1400102ba
mov qword [rsi], rbp
mov qword [rsi + 8], r15
lea rsi, [rsp + 0x20]
mov rcx, r12
mov rdx, rsi
call fcn.1400102ba
movups xmm0, xmmword [0x140094900]
movaps xmmword [rsi], xmm0
lea rsi, [rsp + 0x20]
mov rcx, r12
mov rdx, rsi
call fcn.1400102ba
mov qword [rsi], r13
mov qword [rsi + 8], r14
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1400102ba
movups xmm0, xmmword [r12]
movups xmmword [rdi], xmm0
test r14, r14
je 0x140043f2b
mov rax, qword [r14]
or ebx, 0xd
mov ecx, 0xff
and ebx, ecx
imul ebx, ebx
imul edx, ebx, 0x9a4b
mov ebp, eax
or ebp, 0x71
and ebp, ecx
imul ebp, ebp
imul ecx, ebp, 0x2441
xor ebp, ebp
cmp edx, ecx
sete bpl
neg rbp
movabs rcx, 0x7390a7c76dad54f3
xor rcx, rbp
movabs rdx, 0xcc6f58389252ab0d
add rdx, rcx
test rax, rdx
jne 0x140043f2b
mov rcx, r14
call fcn.1400011e0
test r15, r15
je 0x140043e06
mov rax, qword [r15]
mov ecx, eax
not ecx
lea ecx, [rcx + rcx*2]
mov edx, 0xfffffffe
sub edx, eax
lea ecx, [rcx + rax*2]
inc ecx
xor ecx, edx
bts rcx, 0x3e
test rax, rcx
jne 0x140043e06
mov rcx, r15
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400011e0
Function at 0x1400440c4
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x140044100
cmp byte [rsi], 0
jne 0x14004424f
jmp 0x140044296
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x140044235
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400441cc
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14004418f
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x140044235
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x140044235
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14004418a
test rbx, rbx
jne 0x14004413b
test rbx, rbx
je 0x1400441cc
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.1400440c4]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x140044232
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x1400441e1
xor r12d, r12d
jmp 0x140044235
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140094780]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x14004424f
mov byte [rsi], r12b
test r12b, r12b
je 0x140044296
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x140044275
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x1400442a5
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x140046244
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x140046280
cmp byte [rsi], 0
jne 0x1400463cf
jmp 0x140046416
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x1400463b5
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14004634c
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14004630f
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x1400463b5
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x1400463b5
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14004630a
test rbx, rbx
jne 0x1400462bb
test rbx, rbx
je 0x14004634c
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.140046244]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x1400463b2
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x140046361
xor r12d, r12d
jmp 0x1400463b5
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140095fa0]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x1400463cf
mov byte [rsi], r12b
test r12b, r12b
je 0x140046416
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x1400463f5
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x140046425
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124

Function at 0x14004659b
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.140001066
mov r14, rax
mov rsi, qword [rdi]
test rbx, rbx
je 0x1400465c2
mov rcx, rbx
call fcn.140010d4f
mov qword [rdi], rbx
mov rcx, rsi
call fcn.14000a984
test al, al
je 0x1400465df
mov rcx, rsi
call fcn.14000a731
cmp byte [r14], 0
je 0x1400465e9
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140001c2a