joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e33b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400e3486
test rbx, rbx
je 0x1400e348c
test r9, r9
je 0x1400e3492
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e346f
cmp dword [rsp + 0x48], 3
jne 0x1400e346f
test eax, eax
jne 0x1400e346f
cmp dword [rdi], eax
je 0x1400e346f
mov ecx, dword [rdi]
call fcn.140002154
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e3463
cmp dword [rsp + 0x48], 3
jne 0x1400e3463
test eax, eax
jne 0x1400e3463
mov eax, 1
jmp 0x1400e3471
mov rcx, qword [rbx]
call fcn.140002198
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.1400145f8
int3
call fcn.1400145f8
int3
call fcn.1400145f8
int3

Function at 0x1400e3858
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400e3869
xor eax, eax
jmp 0x1400e3897
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400e38a0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400e38b1
xor eax, eax
jmp 0x1400e38d5
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140127e24
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140247830]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x140127e6f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x140127e78
call fcn.14000fe20
test eax, eax
je 0x140127e94
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140127e9c
xor eax, eax
jmp 0x140127ef9
test rbx, rbx
jne 0x140127ebc
lea rcx, str.ChooseColorW
call fcn.1400a6604
mov rbx, rax
test rax, rax
je 0x140127ec7
mov qword [0x140247830], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140127edc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140127ede
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140127ef7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140130928
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140247b10]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x140130973
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x14013097c
call fcn.14000fe20
test eax, eax
je 0x140130998
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1401309a0
xor eax, eax
jmp 0x1401309fd
test rbx, rbx
jne 0x1401309c0
lea rcx, str.GetOpenFileNameW
call fcn.1400a6604
mov rbx, rax
test rax, rax
je 0x1401309cb
mov qword [0x140247b10], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1401309e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1401309e2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1401309fb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140130a14
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140247b18]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x140130a5f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x140130a68
call fcn.14000fe20
test eax, eax
je 0x140130a84
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140130a8c
xor eax, eax
jmp 0x140130ae9
test rbx, rbx
jne 0x140130aac
lea rcx, str.GetSaveFileNameW
call fcn.1400a6604
mov rbx, rax
test rax, rax
je 0x140130ab7
mov qword [0x140247b18], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140130acc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140130ace
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140130ae7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140178d90
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140248e88]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x14023f210]
test eax, eax
je 0x140178ddb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14023f210]
test eax, eax
jne 0x140178de4
call fcn.14000fe20
test eax, eax
je 0x140178e00
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140237178]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140178e08
xor eax, eax
jmp 0x140178e65
test rbx, rbx
jne 0x140178e28
lea rcx, str.PrintDlgW
call fcn.1400a6604
mov rbx, rax
test rax, rax
je 0x140178e33
mov qword [0x140248e88], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140178e48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140178e4a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140178e63
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140179da4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140179c0c
Function at 0x14018d9c8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x14018d9f4
call fcn.14017a4c0
mov dword [rax], 0x16
call fcn.1401811b0
jmp 0x14018dafa
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x14018dafa
test al, 0x40
jne 0x14018dafa
test al, 2
je 0x14018da16
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x14018dafa
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
jne 0x14018da2a
call fcn.14018b900
jmp 0x14018da31
mov rax, qword [rcx + 0x10]
mov qword [rcx], rax
mov rcx, rdi
call fcn.14017f4b4
mov r8d, dword [rdi + 0x24]
mov rdx, qword [rdi + 0x10]
mov ecx, eax
call fcn.14018ab38
mov dword [rdi + 8], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14018dae9
test byte [rdi + 0x18], 0x82
jne 0x14018dab7
mov rcx, rdi
call fcn.14017f4b4
cmp eax, 0xffffffff
je 0x14018daa2
mov rcx, rdi
call fcn.14017f4b4
cmp eax, 0xfffffffe
je 0x14018daa2
mov rcx, rdi
call fcn.14017f4b4
mov rcx, rdi
lea rsi, [0x140249b10]
movsxd rbx, eax
sar rbx, 5
call fcn.14017f4b4
and eax, 0x1f
imul rax, rax, 0x58
add rax, qword [rsi + rbx*8]
jmp 0x14018daa9
lea rax, [0x14023d3f0]
mov al, byte [rax + 8]
and al, 0x82
cmp al, 0x82
jne 0x14018dab7
bts dword [rdi + 0x18], 0xd
cmp dword [rdi + 0x24], 0x200
jne 0x14018dad6
test byte [rdi + 0x18], 8
je 0x14018dad6
test dword [rdi + 0x18], 0x400
jne 0x14018dad6
mov dword [rdi + 0x24], 0x1000
mov rcx, qword [rdi]
add dword [rdi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rdi], rcx
jmp 0x14018daff
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rdi + 0x18], eax
and dword [rdi + 8], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001190
Capabilities:
Create directory

Disassembly:
jmp 0x14001db44
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140032e48]
xor rax, rsp
mov qword [rsp + 0x130], rax
movsxd rbx, ecx
mov rdi, rdx
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rax, rbx
jbe 0x14001dbb1
mov rdx, rdi
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov edx, 0x2f
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14001dbb1
lea rdx, [rsp + 0x20]
mov byte [rax], 0
mov ecx, ebx
call fcn.140001190
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14000141f
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret

Function at 0x14000129e
Capabilities:
Terminate process

Disassembly:
jmp 0x140010b40
sub rsp, 0x28
mov rcx, qword [rcx + 0xc0]
lea rax, str.error_unpacking_archive
test rdx, rdx
cmovne rax, rdx
lea rdx, [0x14002ecf4]
cmp byte [rax], 0x40
lea r8, [rax + 1]
cmovne r8, rax
call fcn.140001749
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000159b
Capabilities:
Terminate process

Disassembly:
jmp 0x14000f4b0
push rbx
movsxd r11, r9d
mov rbx, r8
mov r10, rcx
test edx, edx
jns 0x14000f4c8
lea rcx, str.bad_value_count
jmp 0x14000f537
mov r9, qword [rcx]
cmp r11d, 1
je 0x14000f50b
mov ecx, 0x100
cmp dword [rsp + 0x30], ecx
je 0x14000f50b
sub ecx, dword [rsp + 0x30]
mov r8d, r11d
jmp 0x14000f502
mov rax, r9
inc r9
sub r8d, 1
je 0x14000f4f8
movzx eax, byte [rax]
cmp eax, ecx
jge 0x14000f502
dec edx
mov r8d, r11d
cmp r9, rbx
ja 0x14000f530
test edx, edx
jg 0x14000f4e5
mov qword [r10], r9
pop rbx
ret
movsxd r8, edx
mov rcx, r11
imul r11, r8
xor edx, edx
mov rax, r11
div rcx
cmp rax, r8
jne 0x14000f530
lea rax, [r11 + r9]
cmp rax, rbx
ja 0x14000f530
mov qword [r10], rax
pop rbx
ret
lea rcx, str.EOF_reading_band
xor edx, edx
pop rbx
jmp fcn.1400014b0

Function at 0x1400015dc
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e660
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14001e6b4
lea rdx, [0x14002ee04]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rbx], rax
test rax, rax
jne 0x14001e6b4
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_Could_not_open_jar_file:__s_n
mov r8, rdi
mov rcx, qword [rcx + 0xc0]
call fcn.140001749
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400017d5
Capabilities:
Terminate process

Disassembly:
jmp 0x140014d78
push rbx
sub rsp, 0x20
mov ebx, edx
mov edx, 2
call fcn.1400012bc
movzx ecx, bx
mov rdx, rax
cmp ebx, ecx
je 0x140014da7
xor edx, edx
lea rcx, str.Internal_buffer_overflow
add rsp, 0x20
pop rbx
jmp fcn.1400014b0
mov eax, ebx
mov byte [rdx + 1], bl
sar eax, 8
mov byte [rdx], al
add rsp, 0x20
pop rbx
ret

Function at 0x1400017f8
Capabilities:
Terminate process
Write file on windows

Disassembly:
jmp 0x14001ec14
test r8d, r8d
jle 0x14001ec67
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov r9, qword [rdi]
mov edx, 1
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test eax, eax
jle 0x14001ec68
add dword [rdi + 0x34], eax
sub ebx, eax
movsxd rcx, eax
add rsi, rcx
test ebx, ebx
jg 0x14001ec31
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [rdi + 0x50]
lea rdx, str.Error:_write_on_output_file_failed_err_d_n
mov r8d, dword [rax]
mov rcx, qword [rcx + 0xc0]
call fcn.140001749
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140032210]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140032220]
mov dword [rax], 1
mov rax, qword [0x140032230]
mov dword [rax], 1
mov rax, qword [0x140032180]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140032200]
mov dword [0x14003700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400322f0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400322d0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140032160]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140032260]
xor edi, edi
mov rax, qword gs:[0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140032270]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140037008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1400321b0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call sym._pei386_runtime_relocator
mov rcx, qword [sym._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140032250]
lea rcx, [sym.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov ebx, dword [0x140037028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
test ebx, ebx
mov rbp, qword [0x140037020]
mov r12, rax
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [rbp + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [r12 + rbx], rax
mov rdx, qword [rbp + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, r12
mov qword [rdi], 0
mov qword [0x140037020], r12
call sym.__main
mov rax, qword [0x1400321e0]
mov r8, qword [0x140037018]
mov ecx, dword [0x140037028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140037020]
call sym.main
mov ecx, dword [0x14003700c]
mov dword [0x140037010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140037008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140032270]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call sym._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x1400322a0]
mov rcx, qword [0x140032290]
call sym._initterm
test edi, edi
mov dword [rsi], 2
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x140037010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x1400322c0]
mov dword [rsi], 1
mov rcx, qword [0x1400322b0]
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b6
mov ecx, eax
call sym.exit
nop
Function at 0x1400017d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
test rax, rax
mov rbx, rcx
je 0x14000180e
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001890
sub rdx, 0x10
jo 0x1400018c6
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140001821
test byte [rcx + 7], 0x40
je 0x1400018b0
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x1400018c0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001870
sub rdx, 0x10
jo 0x1400018d0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3453
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x14000180e
call sym.deallocShared
jmp 0x140001821
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x14000180e
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow

Function at 0x1400018e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
test rax, rax
mov rbx, rcx
je 0x14000191e
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x1400019a0
sub rdx, 0x10
jo 0x1400019d6
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140001931
test byte [rcx + 7], 0x40
je 0x1400019c0
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x1400019d0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001980
sub rdx, 0x10
jo 0x1400019e0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3453
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x14000191e
call sym.deallocShared
jmp 0x140001931
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x14000191e
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow
Function at 0x1400019f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
test rax, rax
mov rbx, rcx
je 0x140001a2e
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001ab0
sub rdx, 0x10
jo 0x140001ae6
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140001a41
test byte [rcx + 7], 0x40
je 0x140001ad0
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140001ae0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001a90
sub rdx, 0x10
jo 0x140001af0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3453
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x140001a2e
call sym.deallocShared
jmp 0x140001a41
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x140001a2e
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow

Function at 0x140001b00
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
test rax, rax
mov rbx, rcx
je 0x140001b3e
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001bc0
sub rdx, 0x10
jo 0x140001bf6
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140001b51
test byte [rcx + 7], 0x40
je 0x140001be0
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140001bf0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001ba0
sub rdx, 0x10
jo 0x140001c00
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3453
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x140001b3e
call sym.deallocShared
jmp 0x140001b51
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x140001b3e
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow