joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077ec0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x170]
mov rbx, rcx
test rax, rax
je 0x140077eed
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x14007804d
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 0x110
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x140077f26
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x110
mov r8d, 0x110
mov rcx, rax
mov qword [rbx + 0x170], rax
call sub.msvcrt.dll_memset
mov rax, qword [rbx + 0x148]
test rax, rax
jne 0x140077f60
mov rcx, rbx
call fcn.140073fe0
mov rax, qword [rbx + 0x148]
mov rcx, qword [rbx + 0x170]
mov edx, 2
lea r8d, [rdx + 0x7e]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r8
movups xmm1, xmmword [rax + 0x70]
add rax, r8
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140077f70
mov rax, qword [rax]
mov qword [rcx], rax
mov rax, qword [rbx + 0x170]
mov rcx, qword [rax]
cmp dword [rcx], 0xe
jne 0x140078034
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x290]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x170]
mov byte [rcx + 0x108], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x290]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x170]
mov byte [rcx + 0x109], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x2a0]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x170]
mov byte [rcx + 0x10a], al
jmp 0x140077ee1
lea r8, str.pDump__Proc.pThis__cgid__ID_CG_ENCODE_PROC
mov edx, 0x73e
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__Proc.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x735
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140078070
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x168]
mov rbx, rcx
test rax, rax
je 0x140078096
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400781ed
jmp 0x1400781e1
mov ecx, 0x110
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x1400780cf
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x110
mov r8d, 0x110
mov rcx, rax
mov qword [rbx + 0x168], rax
call sub.msvcrt.dll_memset
mov rax, qword [rbx + 0x148]
test rax, rax
jne 0x140078109
mov rcx, rbx
call fcn.140073fe0
mov rax, qword [rbx + 0x148]
mov rcx, qword [rbx + 0x168]
mov edx, 2
lea r8d, [rdx + 0x7e]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r8
movups xmm1, xmmword [rax + 0x70]
add rax, r8
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140078119
mov rax, qword [rax]
mov qword [rcx], rax
mov rax, qword [rbx + 0x168]
mov rcx, qword [rax]
mov eax, dword [rcx]
sub eax, 0xd
cmp eax, 1
ja 0x140078206
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x290]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x168]
mov byte [rcx + 0x108], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x290]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x168]
mov byte [rcx + 0x109], al
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x2a0]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x168]
mov byte [rcx + 0x10a], al
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__Proc.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x74d
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__Proc.pThis__cgid__ID_CG_ENCODE_PROC__pDump__Proc.pThis__cgid__ID_CG_TYPE_ENCODE_PROC
mov edx, 0x757
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140078230
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xc8]
mov rbx, rcx
test rax, rax
je 0x14007825d
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x14007834c
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x140078296
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x20
xorps xmm0, xmm0
mov qword [rbx + 0xc8], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbx + 0xa0]
test rax, rax
jne 0x1400782c9
mov rcx, rbx
call fcn.140078370
mov rax, qword [rbx + 0xa0]
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rax]
mov qword [rcx], rax
mov rcx, qword [rbx + 0xc8]
mov rax, qword [rcx]
cmp dword [rax], 0xc
jne 0x140078333
mov al, byte [rbx + 0xa8]
mov byte [rcx + 8], al
mov rcx, qword [rbx + 0xc8]
mov al, byte [rbx + 0xac]
mov byte [rcx + 9], al
mov rax, qword [rbx + 0xc8]
cmp dword [rbx + 0xb0], 1
sete cl
mov byte [rax + 0xa], cl
mov eax, dword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
mov dword [rcx + 0x18], eax
mov rax, qword [rbx + 0xc8]
and qword [rax + 0x10], 0
jmp 0x140078251
lea r8, str.pDump__ptypedef.pThis__cgid__ID_CG_TYPE_ENCODE
mov edx, 0x76d
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__ptypedef.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x765
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140078370
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xa0]
mov rsi, rcx
test rax, rax
je 0x1400783b0
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400784a7
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140078484
mov ebx, dword [0x140134854]
xor ecx, ecx
add ebx, 8
mov qword [rsi + 0xa0], rax
mov qword [rax], rcx
mov rcx, qword [rsi + 0x80]
mov dword [0x140134854], ebx
test rcx, rcx
jne 0x140078406
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov ebx, dword [0x140134854]
mov rax, qword [rsi + 0xa0]
mov qword [rax], rcx
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140078484
mov rcx, qword [rsi + 0xa0]
add ebx, 0x10
mov dword [0x140134854], ebx
mov rdx, qword [rcx]
mov qword [rdx + 0x10], rax
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xa0]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
jmp 0x14007839a
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x77d
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3

Function at 0x1400784d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xb8]
mov rbx, rcx
test rax, rax
je 0x1400784f6
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400785b4
jmp 0x1400785a8
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x14007852f
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x18
xorps xmm0, xmm0
mov qword [rbx + 0xb8], rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rax, qword [rbx + 0xa0]
test rax, rax
jne 0x140078562
mov rcx, rbx
call fcn.140078370
mov rax, qword [rbx + 0xa0]
mov rcx, qword [rbx + 0xb8]
mov rax, qword [rax]
mov qword [rcx], rax
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x140078596
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xb8]
mov qword [rcx + 0x10], rax
mov rcx, qword [rbx + 0xb8]
mov rax, qword [rbx + 0xa8]
mov qword [rcx + 8], rax
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__ptypedef.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x790
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x1400785e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd0]
mov rbx, rcx
test rax, rax
je 0x140078606
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400786d4
jmp 0x1400786c8
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x14007863f
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x20
xorps xmm0, xmm0
mov qword [rbx + 0xd0], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbx + 0xa0]
test rax, rax
jne 0x140078672
mov rcx, rbx
call fcn.140078370
mov rax, qword [rbx + 0xa0]
mov rcx, qword [rbx + 0xd0]
mov rax, qword [rax]
mov qword [rcx], rax
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x1400786a6
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xd0]
mov qword [rcx + 0x10], rax
mov rcx, qword [rbx + 0xd0]
mov rax, qword [rbx + 0xa8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0xd0]
mov eax, dword [rbx + 0xc0]
mov dword [rcx + 0x18], eax
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__ptypedef.pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x7a6
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3

Function at 0x140078700
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xb8]
mov rbx, rcx
test rax, rax
je 0x140078726
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x1400787cf
jmp 0x1400787c3
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x14007875f
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x18
xorps xmm0, xmm0
mov qword [rbx + 0xb8], rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 0x80]
test rcx, rcx
jne 0x140078792
mov rcx, rbx
call fcn.140073190
mov rcx, qword [rbx + 0x80]
mov rax, qword [rbx + 0xb8]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x1400787c3
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xb8]
mov qword [rcx + 8], rax
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x7bc
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x1400787f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xa0]
mov rsi, rcx
test rax, rax
je 0x140078830
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140078927
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140078904
mov ebx, dword [0x140134854]
xor ecx, ecx
add ebx, 8
mov qword [rsi + 0xa0], rax
mov qword [rax], rcx
mov rcx, qword [rsi + 0x80]
mov dword [0x140134854], ebx
test rcx, rcx
jne 0x140078886
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov ebx, dword [0x140134854]
mov rax, qword [rsi + 0xa0]
mov qword [rax], rcx
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140078904
mov rcx, qword [rsi + 0xa0]
add ebx, 0x10
mov dword [0x140134854], ebx
mov rdx, qword [rcx]
mov qword [rdx + 0x10], rax
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xa0]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
jmp 0x14007881a
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x7d2
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140078950
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0xa8]
mov rsi, rcx
test rax, rax
je 0x140078990
mov rax, qword [rax]
cmp dword [rax], 0x46
jg 0x140078a87
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 8
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140078a64
mov ebx, dword [0x140134854]
xor ecx, ecx
add ebx, 8
mov qword [rsi + 0xa8], rax
mov qword [rax], rcx
mov rcx, qword [rsi + 0x80]
mov dword [0x140134854], ebx
test rcx, rcx
jne 0x1400789e6
mov rcx, rsi
call fcn.140073190
mov rcx, qword [rsi + 0x80]
mov ebx, dword [0x140134854]
mov rax, qword [rsi + 0xa8]
mov qword [rax], rcx
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140078a64
mov rcx, qword [rsi + 0xa8]
add ebx, 0x10
mov dword [0x140134854], ebx
mov rdx, qword [rcx]
mov qword [rdx + 0x10], rax
mov rdi, qword [rsi + 8]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x88]
call qword [case.0x1400cd70e.0]
mov rdx, qword [rdi]
mov rcx, rdi
mov rbx, rax
mov rax, qword [rdx + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0xa8]
mov r8, rbx
mov edx, eax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x10]
call fcn.140073058
jmp 0x14007897a
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__cgid___ID_CG_RANGE_STRING_PTR
mov edx, 0x7e5
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3

Function at 0x140078ab0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rbx, rcx
test rax, rax
je 0x140078ad4
mov rax, qword [rax + 8]
cmp dword [rax], 6
jg 0x140078b8d
jmp 0x140078b81
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x140078b0d
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x18
xorps xmm0, xmm0
mov qword [rbx + 0x20], rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140078b43
mov rax, qword [rcx]
mov rax, qword [rax + 0xe8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140078b63
mov rax, qword [rcx]
mov rax, qword [rax + 0xe8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x20]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140078b81
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 0x10], rax
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__pSizeIsExpr__Kind___DUMP_EXPR_MAX
mov edx, 0x7f8
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140078bb0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov rbx, rcx
test rax, rax
je 0x140078bdb
mov rax, qword [rax + 8]
cmp dword [rax], 6
jg 0x140078c84
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x140078c14
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x10
xorps xmm0, xmm0
mov qword [rbx + 0x18], rax
movups xmmword [rax], xmm0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140078c6b
mov rax, qword [rcx]
mov rax, qword [rax + 0xe8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140078bcf
mov rax, qword [rcx]
mov rax, qword [rax + 0xe8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x18]
mov qword [rcx], rax
jmp 0x140078bcf
lea r8, str.pLengthIsExpr___NULL
mov edx, 0x818
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pLengthIsExpr__Kind___DUMP_EXPR_MAX
mov edx, 0x811
lea rcx, str.com_rpcmidlcodegendumpinfo.cxx
call fcn.1400c7a2c
int3
Function at 0x140079aa4
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
lea rax, [rcx + 0x48]
mov qword [rcx + 0x60], rax
mov rbx, rcx
mov qword [rax], rbp
mov r14d, 0x400
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
lea rax, vtable.OffsetDictionary.0
mov qword [rcx + 0x20], rax
lea rax, [rcx + 0x90]
mov qword [rcx + 0xa8], rax
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
lea rax, vtable.TypeOffsetDictionary.0
mov qword [rcx + 0x68], rax
lea rax, [rcx + 0xd8]
mov qword [rcx + 0xf0], rax
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
lea rax, vtable.StackSizeDictionary.0
mov qword [rcx + 0xb0], rax
lea rax, [rcx + 0x120]
mov qword [rcx + 0x138], rax
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
lea rax, vtable.CommentDictionary.0
mov qword [rcx + 0xf8], rax
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov qword [rcx + 0x38], rbp
mov dword [rcx + 0x40], ebp
mov qword [rcx + 0x70], rbp
mov qword [rcx + 0x78], rbp
mov qword [rcx + 0x80], rbp
mov dword [rcx + 0x88], ebp
mov qword [rcx + 0xb8], rbp
mov qword [rcx + 0xc0], rbp
mov qword [rcx + 0xc8], rbp
mov dword [rcx + 0xd0], ebp
mov qword [rcx + 0x100], rbp
mov qword [rcx + 0x108], rbp
mov qword [rcx + 0x110], rbp
mov dword [rcx + 0x118], ebp
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140079c9b
mov ecx, dword [0x140134854]
add ecx, r14d
mov qword [rbx], rax
mov edi, ecx
mov dword [0x140134854], ecx
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140079c9b
add edi, r14d
mov qword [rbx + 8], rax
mov r8d, r14d
mov dword [0x140134854], edi
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 8]
mov r8d, r14d
xor edx, edx
call sub.msvcrt.dll_memset
lea ecx, [rbp + 0x50]
mov qword [rbx + 0x10], r14
mov dword [rbx + 0x18], ebp
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x140079c9b
mov rsi, qword [rsp + 0x40]
lea ecx, [rdi + 0x50]
mov rdi, qword [rsp + 0x48]
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], ebp
mov qword [rax + 0x48], rbx
mov dword [0x140134854], ecx
lea rcx, [rax + 0x28]
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov rbp, qword [rsp + 0x38]
mov qword [rax + 0x40], rcx
lea rcx, vtable.FRMTREG_DICT.0
mov qword [rax], rcx
mov qword [rbx + 0x140], rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
Function at 0x140079cc4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x14]
mov rbx, rcx
add eax, 3
cmp eax, dword [rcx + 0x10]
jbe 0x140079dd9
mov ebp, dword [rcx + 0x10]
mov eax, 2
mul rbp
mov r12, 0xffffffffffffffff
mov rdi, rax
cmovo rdi, r12
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140079df3
mov r14d, dword [0x140134854]
mov r8d, ebp
mov rdx, qword [rbx]
add r14d, edi
mov rcx, rax
mov dword [0x140134854], r14d
call sub.msvcrt.dll_memcpy
mov r8d, dword [rbx + 0x10]
xor edx, edx
lea rcx, [r8 + rsi]
call sub.msvcrt.dll_memset
mov rcx, qword [rbx]
test rcx, rcx
je 0x140079d64
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov ebp, dword [rbx + 0x10]
mov eax, 2
mul rbp
mov qword [rbx], rsi
mov rsi, rax
cmovo rsi, r12
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140079df3
mov rdx, qword [rbx + 8]
lea ecx, [r14 + rsi]
mov dword [0x140134854], ecx
mov r8d, ebp
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r8d, dword [rbx + 0x10]
xor edx, edx
lea rcx, [r8 + rdi]
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140079dcd
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov eax, dword [rbx + 0x10]
add eax, eax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r12
pop rdi
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3

Function at 0x140079e1c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call fcn.140079cc4
cmp edi, 0xffff
ja 0x140079e9c
mov r8d, dword [rbx + 0x14]
mov rax, qword [rbx + 8]
mov byte [r8 + rax], 6
mov r8d, edi
mov edx, dword [rbx + 0x14]
mov rax, qword [rbx + 8]
inc edx
mov byte [rdx + rax], 2
mov ecx, dword [rbx + 0x14]
mov rax, qword [rbx]
mov word [rcx + rax], di
lea rcx, [rbx + 0x68]
mov edx, dword [rbx + 0x14]
call fcn.14007bee8
mov rax, qword [0x140134380]
test dword [rax + 4], 0x20000000
je 0x140079e81
test byte [rax + 0x26], 0x80
je 0x140079e90
add dword [rbx + 0x14], 2
mov eax, dword [rbx + 0x14]
cmp eax, dword [rbx + 0x18]
jbe 0x140079e90
mov dword [rbx + 0x18], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x94b
lea r9, [0x1400f48cb]
mov r8d, ebx
xor edx, edx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3