joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1407700c0]
mov dword [rax], 1
mov rax, qword [0x1407700d0]
mov dword [rax], 1
mov rax, qword [0x1407700e0]
mov dword [rax], 1
mov rax, qword [0x140770080]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001890
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x1400018ce
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001950
sub rdx, 0x10
jo 0x140001986
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400018e1
test byte [rcx + 7], 0x40
je 0x140001970
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140001980
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001930
sub rdx, 0x10
jo 0x140001990
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x1400018ce
call sym.deallocShared
jmp 0x1400018e1
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x1400018ce
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow
Function at 0x1400019a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x1400019de
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001a60
sub rdx, 0x10
jo 0x140001a96
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400019f1
test byte [rcx + 7], 0x40
je 0x140001a80
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140001a90
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001a40
sub rdx, 0x10
jo 0x140001aa0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x1400019de
call sym.deallocShared
jmp 0x1400019f1
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x1400019de
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow

Function at 0x140001ab0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x140001aee
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001b70
sub rdx, 0x10
jo 0x140001ba6
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140001b01
test byte [rcx + 7], 0x40
je 0x140001b90
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140001ba0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001b50
sub rdx, 0x10
jo 0x140001bb0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x140001aee
call sym.deallocShared
jmp 0x140001b01
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x140001aee
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow
Function at 0x140001bc0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x140001bfe
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001c80
sub rdx, 0x10
jo 0x140001cb6
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140001c11
test byte [rcx + 7], 0x40
je 0x140001ca0
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140001cb0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001c60
sub rdx, 0x10
jo 0x140001cc0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x140001bfe
call sym.deallocShared
jmp 0x140001c11
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x140001bfe
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow

Function at 0x140001cd0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x140001d0e
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001d90
sub rdx, 0x10
jo 0x140001dc6
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140001d21
test byte [rcx + 7], 0x40
je 0x140001db0
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140001dc0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140001d70
sub rdx, 0x10
jo 0x140001dd0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x140001d0e
call sym.deallocShared
jmp 0x140001d21
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x140001d0e
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow
Function at 0x140002080
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x1400020be
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002140
sub rdx, 0x10
jo 0x140002176
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400020d1
test byte [rcx + 7], 0x40
je 0x140002160
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140002170
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002120
sub rdx, 0x10
jo 0x140002180
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x1400020be
call sym.deallocShared
jmp 0x1400020d1
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x1400020be
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow

Function at 0x140002190
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x1400021ce
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002250
sub rdx, 0x10
jo 0x140002286
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400021e1
test byte [rcx + 7], 0x40
je 0x140002270
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140002280
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002230
sub rdx, 0x10
jo 0x140002290
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x1400021ce
call sym.deallocShared
jmp 0x1400021e1
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x1400021ce
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow
Function at 0x1400022a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x1400022de
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002360
sub rdx, 0x10
jo 0x140002396
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400022f1
test byte [rcx + 7], 0x40
je 0x140002380
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140002390
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002340
sub rdx, 0x10
jo 0x1400023a0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x1400022de
call sym.deallocShared
jmp 0x1400022f1
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x1400022de
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow

Function at 0x1400023b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x1400023ee
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002470
sub rdx, 0x10
jo 0x1400024a6
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140002401
test byte [rcx + 7], 0x40
je 0x140002490
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x1400024a0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002450
sub rdx, 0x10
jo 0x1400024b0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x1400023ee
call sym.deallocShared
jmp 0x140002401
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x1400023ee
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow
Function at 0x1400024c0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x1400024fe
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002580
sub rdx, 0x10
jo 0x1400025b6
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
xor ecx, ecx
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140002511
test byte [rcx + 7], 0x40
je 0x1400025a0
movdqu xmm0, xmmword [rbx + 0x28]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.eqdestroy___stdZassertions_u91
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x1400025b0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140002560
sub rdx, 0x10
jo 0x1400025c0
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x38]
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 8]
call sym.nimDestroyAndDispose
jmp 0x1400024fe
call sym.deallocShared
jmp 0x140002511
add rsp, 0x30
pop rbx
ret
call sym.raiseOverflow
jmp 0x1400024fe
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow
Function at 0x140003180
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
mov qword [rbx], rdx
test rdx, rdx
js 0x1400031a8
call sym.allocShared0Impl__system_u1776
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp sym.raiseRangeErrorI

Function at 0x1400034c0
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400034d0
jmp sym.deallocShared
ret

Function at 0x1400036d0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
pxor xmm0, xmm0
movzx eax, byte [rdx]
mov rbx, qword [rcx + 0x10]
movzx edi, byte [rcx]
mov rbp, qword [rdx + 8]
mov rsi, qword [rdx + 0x10]
movups xmmword [rcx + 1], xmm0
mov byte [rcx], al
mov qword [rcx + 0x10], 0
test al, al
je 0x140003750
cmp al, 1
je 0x140003718
test dil, dil
je 0x140003721
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rcx + 8], rbp
test dil, dil
jne 0x140003709
test rbx, rbx
je 0x140003709
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x140003770
sub rax, 0x10
jo 0x14000378d
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rememberCycle__system_u3375
test rsi, rsi
je 0x140003763
mov rax, qword [rsi - 0x10]
add rax, 0x10
jo 0x14000379a
mov qword [rsi - 0x10], rax
mov qword [rcx + 0x10], rsi
mov qword [rcx + 8], rbp
jmp 0x140003704
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.nimDestroyAndDispose
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.raiseOverflow
mov qword [rsp + 0x28], rcx
call sym.raiseOverflow
mov rcx, qword [rsp + 0x28]
jmp 0x140003763

Function at 0x1400037f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx], 0
mov rbx, rcx
je 0x140003808
add rsp, 0x20
pop rbx
ret
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400037fd
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140003840
sub rdx, 0x10
jo 0x14000385e
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3375
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx + 0x10]
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow
Function at 0x140003a20
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor esi, esi
mov rbp, qword [rcx + 8]
mov rdi, qword [rcx]
lea rbx, [rbp + 0x18]
test rdi, rdi
jg 0x140003a4d
jmp 0x140003a90
add rsi, 1
add rbx, 0x18
cmp rdi, rsi
je 0x140003a90
cmp byte [rbx - 0x10], 0
jne 0x140003a40
mov rax, qword [rbx]
test rax, rax
je 0x140003a40
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140003aa8
sub rdx, 0x10
jo 0x140003add
mov qword [rax - 0x10], rdx
mov r8, qword [rax]
mov rdx, rcx
add rsi, 1
xor ecx, ecx
add rbx, 0x18
call sym.rememberCycle__system_u3375
cmp rdi, rsi
jne 0x140003a4d
nop dword [rax]
test rbp, rbp
je 0x140003a9b
test byte [rbp + 7], 0x40
je 0x140003ac8
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3375
mov rcx, qword [rbx]
call sym.nimDestroyAndDispose
jmp 0x140003a40
mov edx, 8
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.alignedDealloc
call sym.raiseOverflow
jmp 0x140003a40

Function at 0x140003cf0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x140003d0f
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sym.fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fflush

Function at 0x140003df0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
mov ecx, 2
call rsi
lea rdx, str.could_not_load:
mov rcx, rax
add rbx, 8
call sym.rawWrite
test rdi, rdi
mov ecx, 2
lea rax, [0x14001d2d8]
cmove rbx, rax
call rsi
mov rcx, rax
mov rdx, rbx
call sym.rawWrite
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
je 0x140003e6c
mov ecx, 2
call rsi
lea rdx, [0x14001d321]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
mov ecx, 2
call rsi
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call sym.rawWrite
jmp 0x140003e4c

Function at 0x140003e90
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
lea rdx, [0x14001d321]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop dword [rax]

Function at 0x140004040
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140776160]
test rax, rax
je 0x140004052
call rax
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop word [rax + rax]
Function at 0x140005c00
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r10, qword [rdx + 8]
mov r9, rdx
sar rdx, 0x15
mov r8, rcx
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x20a0]
test rax, rax
jne 0x140005c30
jmp 0x140005c5a
mov rax, qword [rax]
test rax, rax
je 0x140005c5a
cmp rdx, qword [rax + 8]
jne 0x140005c28
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rdx, qword [r8 + 0x2078]
mov rcx, r9
cmp rdx, rax
cmovl rdx, rax
sub rax, r10
mov qword [r8 + 0x2070], rax
mov qword [r8 + 0x2078], rdx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140005c9a
add rsp, 0x28
ret
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140005cc0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [rdx + 8]
sub qword [rcx + 0x2088], rax
mov r10, qword [rdx + 8]
mov r8, rcx
mov r9, rdx
cmp r10, 0x3f000000
jg 0x140005cf0
add rsp, 0x28
jmp sym.freeBigChunk__system_u6557
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x20a0]
test rax, rax
jne 0x140005d58
nop dword [rax]
mov rax, qword [r8 + 0x2070]
mov rdx, qword [r8 + 0x2078]
mov rcx, r9
cmp rdx, rax
cmovl rdx, rax
sub rax, r10
mov qword [r8 + 0x2070], rax
mov qword [r8 + 0x2078], rdx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140005d84
add rsp, 0x28
ret
mov rax, qword [rax]
test rax, rax
je 0x140005d08
cmp rdx, qword [rax + 8]
jne 0x140005d50
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
jmp 0x140005d08
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop dword [rax + rax]