joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007ba4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
jne 0x180007bc5
xor eax, eax
jmp 0x180007d20
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x180007c24
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x180007d1e
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x20]
lea rax, [rax + rcx*4]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.18000af00
mov edx, eax
mov rcx, qword [rsp + 0x28]
call fcn.1800061b4
mov dword [rsp + 0x24], eax
cmp qword [rsp + 0x38], 0
je 0x180007d19
cmp qword [rsp + 0x28], 0
je 0x180007d19
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x24], eax
jne 0x180007d19
cmp dword [rsp + 0x80], 0
je 0x180007cc1
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [0x18000fb48]
jmp 0x180007d20
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x20]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx]
lea rax, [rax + rcx*4]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
jmp 0x180007d20
jmp 0x180007c1a
xor eax, eax
add rsp, 0x68
ret
Function at 0x18000bbe8
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0x811c9dc5
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
jmp 0x18000bc16
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 8], rax
jae 0x18000bc4b
mov rax, qword [rsp + 8]
movsx eax, byte [rax]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
imul eax, dword [rsp], 0x1000193
mov dword [rsp], eax
jmp 0x18000bc09
mov eax, dword [rsp]
add rsp, 0x18
ret

Function at 0x18000bcf8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
jmp 0x18000bd24
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x20], eax
jge 0x18000be26
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x104]
inc eax
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x104], eax
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x104]
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x108]
add ecx, eax
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x108], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov r8d, dword [rcx + 0x108]
mov rcx, qword [rsp + 0x40]
mov edx, dword [rcx + 0x104]
mov rcx, rax
call fcn.18000beb4
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x104]
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x40]
movsxd rcx, dword [rcx + 0x108]
mov rdx, qword [rsp + 0x40]
movzx ecx, byte [rdx + rcx]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
cdqe
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
movzx ecx, byte [rdx + rcx]
xor eax, ecx
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov byte [rdx + rcx], al
jmp 0x18000bd1a
add rsp, 0x38
ret
Function at 0x7feeff310b9
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp qword [rcx], 0
jle 0x7feeff310fa
mov edi, 0x10
xor ebx, ebx
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.7feeff32cdd
test al, al
je 0x7feeff310ee
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.7feeff31be7
inc rbx
add rdi, 0x10
cmp rbx, qword [rsi]
jl 0x7feeff310d0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff3111a
test byte [rcx + 7], 0x40
jne 0x7feeff3111a
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff311a3
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x7feeff31123
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp qword [rcx], 0
jle 0x7feeff31164
mov edi, 0x10
xor ebx, ebx
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.7feeff31b93
test al, al
je 0x7feeff31158
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.7feeff31be7
inc rbx
add rdi, 0x10
cmp rbx, qword [rsi]
jl 0x7feeff3113a
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff31184
test byte [rcx + 7], 0x40
jne 0x7feeff31184
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff311a3
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x7feeff3118d
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
je 0x7feeff311a2
test byte [rcx + 7], 0x40
jne 0x7feeff311a2
mov edx, 8
jmp fcn.7feeff311a3
ret

Function at 0x7feeff311a3
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp rdx, 0x11
jl 0x7feeff311cc
mov edx, 2
mov rcx, rsi
call fcn.7feeff311d9
movzx edx, word [rax]
mov rcx, rsi
call fcn.7feeff311d9
mov rsi, rax
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.7feeff311e0

Function at 0x7feeff311e5
Capabilities:
Terminate process

Disassembly:
jmp 0x7feeff311ea
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff31208
lea rcx, [rax + 0x68]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.7feeff31213

Function at 0x7feeff311ea
Capabilities:
Terminate process

Disassembly:
jmp 0x7feeff311ea
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff31208
lea rcx, [rax + 0x68]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.7feeff31213

Function at 0x7feeff31208
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [0x7fef003ef50]
jmp 0x7feeff31b66
push rsi
push rdi
sub rsp, 0x28
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x7feeff31ab2
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rdx, str.out_of_memory_n
mov rcx, rax
call fcn.7feeff31ada
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x7feeff31ada
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x7feeff31af8
mov rcx, rdi
call fcn.7feeff31b19
mov r8, rax
jmp 0x7feeff31afb
xor r8d, r8d
mov edx, 1
mov rcx, rdi
mov r9, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeffcd570

Function at 0x7feeff31b66
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [0x7fef003ef50]
jmp 0x7feeff31b66
push rsi
push rdi
sub rsp, 0x28
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x7feeff31be7
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.7feeff31066
mov rdi, rax
mov rax, qword [rsi]
mov rdx, qword [rax]
test rdx, rdx
je 0x7feeff31c17
mov rcx, rsi
call rdx
cmp byte [rdi], 0
je 0x7feeff31c14
add rsp, 0x28
pop rdi
pop rsi
ret
mov rax, qword [rsi]
movsx rdx, word [rax + 0x10]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff31c2a

Function at 0x7feeff31c2a
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, 0x10
call fcn.7feeff31c5c
mov rcx, rdi
mov rdx, rax
call fcn.7feeff311d9
mov rcx, rax
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff311a3

Function at 0x7feeff32326
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call fcn.7feeff31066
mov rdi, rax
mov edx, 0x10
mov rcx, rbx
call fcn.7feeff31874
mov rbx, rax
mov rax, qword [rsi]
test rax, rax
je 0x7feeff32365
mov rcx, rbx
call rax
cmp byte [rdi], 0
je 0x7feeff32365
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
movsx rdx, word [rsi + 0x10]
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff31c2a

Function at 0x7feeff32dd5
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
call fcn.7feeff32cdd
test al, al
je 0x7feeff32df8
mov rcx, qword [rsi + 0x30]
add rsp, 0x20
pop rsi
jmp fcn.7feeff31be7
nop
add rsp, 0x20
pop rsi
ret

Function at 0x7feeff33370
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.7feeff31066
mov rdi, rax
mov rcx, qword [rsi + 8]
call fcn.7feeff32cdd
test al, al
je 0x7feeff33397
mov rcx, qword [rsi + 8]
call fcn.7feeff31be7
mov rcx, qword [rsi + 0x10]
call fcn.7feeff333cd
test al, al
je 0x7feeff333b2
mov rcx, qword [rsi + 0x10]
call fcn.7feeff33370
cmp byte [rdi], 0
je 0x7feeff333b9
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rsi + 0x10]
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff31c2a
Function at 0x7feeff33c3c
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movabs rdi, 0x4000000000000000
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x7feeff33c62
test qword [rcx], rdi
jne 0x7feeff33c62
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x20]
call fcn.7feeff32cdd
test al, al
je 0x7feeff33c78
mov rcx, qword [rsi + 0x20]
call fcn.7feeff31be7
mov rcx, qword [rsi + 0x70]
test rcx, rcx
je 0x7feeff33c8b
test qword [rcx], rdi
jne 0x7feeff33c8b
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x88]
call fcn.7feeff33cbb
mov rcx, qword [rsi + 0x98]
test rcx, rcx
je 0x7feeff33cb3
test qword [rcx], rdi
jne 0x7feeff33cb3
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff311e0
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x7feeff33cbb
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
je 0x7feeff33cd0
test byte [rcx + 7], 0x40
jne 0x7feeff33cd0
mov edx, 1
jmp fcn.7feeff311a3
ret

Function at 0x7feeff33d96
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
je 0x7feeff33da5
test byte [rcx + 7], 0x40
je fcn.7feeff311e0
ret

Function at 0x7feeff34340
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
call fcn.7feeff31066
mov al, byte [rsi + 1]
cmp al, 6
je 0x7feeff34375
cmp al, 5
je 0x7feeff34388
cmp al, 4
jne 0x7feeff34399
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x7feeff34399
test byte [rcx + 7], 0x40
jne 0x7feeff34399
add rsp, 0x30
pop rsi
jmp fcn.7feeff311e0
movups xmm0, xmmword [rsi + 8]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call fcn.7feeff34457
jmp 0x7feeff34399
movups xmm0, xmmword [rsi + 8]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call fcn.7feeff343a0
nop
add rsp, 0x30
pop rsi
ret

Function at 0x7feeff343a0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movabs r14, 0x4000000000000000
call fcn.7feeff31066
cmp qword [rsi], 0
jle 0x7feeff34427
mov r15, rax
xor ebx, ebx
xor edi, edi
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x20]
test rcx, rcx
je 0x7feeff343e6
test qword [rcx], r14
jne 0x7feeff343e6
call fcn.7feeff311e0
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x28]
call fcn.7feeff34303
test al, al
je 0x7feeff3441b
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x28]
call fcn.7feeff34340
cmp byte [r15], 0
jne 0x7feeff3444a
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x28]
mov edx, 8
call fcn.7feeff31c2a
inc rdi
add rbx, 0x28
cmp rdi, qword [rsi]
jl 0x7feeff343ca
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff3444a
test qword [rcx], r14
jne 0x7feeff3444a
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff311a3
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x7feeff34457
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff31066
cmp qword [rsi], 0
jle 0x7feeff344b1
mov rdi, rax
xor ebx, ebx
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx*8 + 8]
call fcn.7feeff34303
test al, al
je 0x7feeff344a9
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx*8 + 8]
call fcn.7feeff34340
cmp byte [rdi], 0
jne 0x7feeff344d1
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx*8 + 8]
mov edx, 8
call fcn.7feeff31c2a
inc rbx
cmp rbx, qword [rsi]
jl 0x7feeff34471
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff344d1
test byte [rcx + 7], 0x40
jne 0x7feeff344d1
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff311a3
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x7feeff348bf
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movabs r14, 0x4000000000000000
mov rax, qword [rcx]
test rax, rax
jle 0x7feeff3490a
mov ebx, 0x10
xor edi, edi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + rbx]
test rcx, rcx
je 0x7feeff348fe
test qword [rcx], r14
jne 0x7feeff348fe
call fcn.7feeff311e0
mov rax, qword [rsi]
inc rdi
add rbx, 0x10
cmp rdi, rax
jl 0x7feeff348e4
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff3492b
test qword [rcx], r14
jne 0x7feeff3492b
mov edx, 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff311a3
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x7feeff34987
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
call fcn.7feeff32cdd
test al, al
je 0x7feeff349a5
mov rcx, qword [rsi]
call fcn.7feeff31be7
mov ebx, 0xffffffff
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x7feeff349db
mov rax, qword [rcx]
mov edx, eax
xor edx, ebx
lea r8d, [rdx + rdx*2]
lea r9d, [rax + rax]
lea edx, [rax + r8]
inc edx
xor edx, r9d
not edx
shl rdx, 0x3e
test rax, rdx
jne 0x7feeff349db
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x18]
call fcn.7feeff331b4
test al, al
je 0x7feeff349f6
mov rcx, qword [rsi + 0x18]
mov edx, 8
call fcn.7feeff31c2a
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x7feeff34a57
mov rdi, qword [rcx]
mov rdx, rdi
xor rdx, rbx
lea rdx, [rdx + rdx*2]
mov rax, rdi
not rax
add rax, rbx
lea rdx, [rdx + rdi*2]
inc rdx
xor rdx, rax
mov r8d, edx
movabs rax, 0xa70b2683fdf166b1
add rax, r8
xor ebx, edx
lea ebx, [rbx + rbx*2]
add ebx, edx
inc ebx
add edx, edx
xor ebx, edx
movabs rdx, 0x40000000fffffffe
xor rdx, rbx
imul rdx, rax
test rdi, rdx
jne 0x7feeff34a57
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x7feeff34a72
test byte [rcx + 7], 0x40
jne 0x7feeff34a72
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff311e0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x7feeff37913
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movabs r14, 0x4000000000000000
cmp qword [rcx], 0
jle 0x7feeff3796f
xor ebx, ebx
xor edi, edi
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x10]
test rcx, rcx
je 0x7feeff3794f
test qword [rcx], r14
jne 0x7feeff3794f
call fcn.7feeff311e0
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x20]
test rcx, rcx
je 0x7feeff37963
test qword [rcx], r14
jne 0x7feeff37963
call fcn.7feeff311e0
inc rdi
add rbx, 0x20
cmp rdi, qword [rsi]
jl 0x7feeff37933
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff37990
test qword [rcx], r14
jne 0x7feeff37990
mov edx, 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff311a3
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x7feeff39d11
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
je 0x7feeff39d5a
mov r10, qword [rcx]
mov edx, r10d
not edx
lea r8d, [rdx + rdx*2]
lea r9d, [r10 + r10]
lea edx, [r10 + r8]
inc edx
xor edx, r9d
mov eax, 0xfffffffe
xor rax, rdx
movabs r8, 0x426302f6db2407cb
add r8, rax
movabs rax, 0xc0000000fffffffe
xor rax, rdx
imul rax, r8
test r10, rax
je 0x7feeff39d5b
ret
mov edx, 8
jmp fcn.7feeff311a3

Function at 0x7feeff3b4bd
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
call fcn.7feeff32cdd
test al, al
je 0x7feeff3b4d9
mov rcx, qword [rsi]
call fcn.7feeff31be7
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x7feeff3b4ed
test byte [rcx + 7], 0x40
jne 0x7feeff3b4ed
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x18]
call fcn.7feeff331b4
test al, al
je 0x7feeff3b50d
mov rcx, qword [rsi + 0x18]
mov edx, 8
add rsp, 0x20
pop rsi
jmp fcn.7feeff31c2a
nop
add rsp, 0x20
pop rsi
ret

Function at 0x7feeff3b6a6
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
call fcn.7feeff331b4
test al, al
je 0x7feeff3b6cc
mov rcx, qword [rsi]
mov edx, 8
add rsp, 0x20
pop rsi
jmp fcn.7feeff31c2a
nop
add rsp, 0x20
pop rsi
ret

Function at 0x7feeff3d9bc
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 8]
call fcn.7feeff32cdd
test al, al
je 0x7feeff3d9da
mov rcx, qword [rsi + 8]
call fcn.7feeff31be7
mov rcx, qword [rsi + 0x18]
call fcn.7feeff32cdd
test al, al
je 0x7feeff3d9f0
mov rcx, qword [rsi + 0x18]
call fcn.7feeff31be7
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x7feeff3da09
test byte [rcx + 7], 0x40
jne 0x7feeff3da09
add rsp, 0x20
pop rsi
jmp fcn.7feeff311e0
nop
add rsp, 0x20
pop rsi
ret

Function at 0x7feeff3df44
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.7feeff31066
mov rdi, rax
mov rcx, qword [rsi + 0x58]
call fcn.7feeff3d96b
test al, al
je 0x7feeff3df70
mov rcx, qword [rsi + 0x58]
call fcn.7feeff3d9bc
cmp byte [rdi], 0
je 0x7feeff3df77
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rsi + 0x58]
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff31c2a
Function at 0x7feeff3e9e4
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rcx, qword [rcx]
call fcn.7feeff32cdd
test al, al
je 0x7feeff3ea01
mov rcx, qword [rdi]
call fcn.7feeff31be7
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x7feeff3ea46
mov rax, qword [rcx]
mov edx, eax
not edx
lea r8d, [rdx + rdx*2]
lea r9d, [rax + rax]
lea edx, [rax + r8]
inc edx
xor edx, r9d
movabs rsi, 0x1c279aa7986a3d25
xor rsi, rdx
movabs rdx, 0x23d86558986a3d25
add rdx, rsi
test rax, rdx
jne 0x7feeff3ea46
call fcn.7feeff311e0
mov rcx, qword [rdi + 0x18]
call fcn.7feeff331b4
test al, al
je 0x7feeff3ea67
mov rcx, qword [rdi + 0x18]
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff31c2a
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x7feeff3ec3f
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff31066
cmp qword [rsi], 0
jle 0x7feeff3ecae
mov r14, rax
mov edi, 0x18
xor ebx, ebx
lea r15, [0x7feeffe3d48]
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
mov rdx, r15
call fcn.7feeff3ed00
test al, al
je 0x7feeff3eca2
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.7feeff3e9e4
cmp byte [r14], 0
jne 0x7feeff3ecdf
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
mov edx, 8
call fcn.7feeff31c2a
inc rbx
add rdi, 0x18
cmp rbx, qword [rsi]
jl 0x7feeff3ec69
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff3ecdf
mov rax, qword [rcx]
mov edx, 2
sub edx, eax
lea ebx, [rax + rax*2]
add ebx, 2
xor ebx, edx
shl rbx, 0x3e
movabs rdx, 0x4000000000000000
add rdx, rbx
test rax, rdx
je 0x7feeff3eceb
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff311a3

Function at 0x7feeff3fab9
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.7feeff31b93
test al, al
je 0x7feeff3fad7
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.7feeff31be7
nop
add rsp, 0x20
pop rsi
ret

Function at 0x7feeff3fb7a
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
call fcn.7feeff31066
mov ecx, 0x40
mov edx, 8
call fcn.7feeff3fbf8
mov rdi, rax
lea rax, [0x7feeffe4f48]
mov qword [rdi], rax
lea rbx, str.AssertionDefect
mov qword [rdi + 0x10], rbx
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rsi
call fcn.7feeff3fc2a
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi + 0x18], xmm0
mov rcx, rdi
mov rdx, rbx
call fcn.7feeff3fc31
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeff3fbef
test byte [rcx + 7], 0x40
jne 0x7feeff3fbef
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff311e0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x7feeff3fd43
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.7feeff31208
mov rdx, qword [rax + 0x18]
lea rdi, [rax + 0x18]
lea rcx, [rsi + 0x38]
call fcn.7feeff3fd73
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.7feeff3fdb7