joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006bac0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
lea rdx, [0x1400cee0f]
lea r8, str.ConversionExpr
mov rcx, rax
call fcn.140056360
mov rbx, qword [rdi + 0x18]
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r14
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006bb4b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r14
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14006bb30
mov byte [rsi + 4], 0
test rbx, rbx
je 0x14006bb61
mov rcx, rbx
mov rdx, rsi
call fcn.140065e90
jmp 0x14006bb86
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140068850
mov rcx, rsi
mov edx, edi
call fcn.14006aad0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14006bbe0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400cee0f]
lea r8, str.PointerToMemberConversionExpr
mov rcx, rax
call fcn.140056360
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
movups xmm0, xmmword [rdi + 0x28]
movaps xmmword [rsp + 0x20], xmm0
mov edi, dword [rdi + 0xc]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006bc6b
xor ebp, ebp
nop word [rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14006bc50
mov byte [rsi + 4], 0
test r14, r14
je 0x14006bc81
mov rcx, r14
mov rdx, rsi
call fcn.140065e90
jmp 0x14006bca6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
shl edi, 0x1a
sar edi, 0x1a
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call fcn.140067610
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400677d0
mov rcx, rsi
mov edx, edi
call fcn.14006aad0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14006bd10
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400cee0f]
lea r8, str.InitListExpr
mov rcx, rax
call fcn.140056360
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006bd8a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14006bd70
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14006bda0
mov rcx, rdi
mov rdx, rsi
call fcn.140065e90
jmp 0x14006bdc5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140068850
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14006bf20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400cee0f]
lea r8, str.ThrowExpr
mov rcx, rax
call fcn.140056360
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006bf9a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14006bf80
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14006bfb0
mov rcx, rdi
mov rdx, rsi
call fcn.140065e90
jmp 0x14006bfd5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14006c000
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400cee0f]
lea r8, str.StringLiteral
mov rcx, rax
call fcn.140056360
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006c07a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14006c060
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14006c090
mov rcx, rdi
mov rdx, rsi
call fcn.140065e90
jmp 0x14006c0b5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x14006c0e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400cee0f]
lea r8, str.LambdaExpr
mov rcx, rax
call fcn.140056360
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006c15a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14006c140
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14006c170
mov rcx, rdi
mov rdx, rsi
call fcn.140065e90
jmp 0x14006c195
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14006c1c0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x1400cee0f]
lea r8, str.EnumLiteral
mov rcx, rax
call fcn.140056360
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006c23a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14006c220
mov byte [rsi + 4], 0
test rdi, rdi
je 0x14006c250
mov rcx, rdi
mov rdx, rsi
call fcn.140065e90
jmp 0x14006c275
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400677d0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14006c2c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400cee0f]
lea r8, str.BracedExpr
mov rcx, rax
call fcn.140056360
mov r14, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x20]
movzx ebx, byte [rbx + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006c34b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14006c330
mov byte [rsi + 4], 0
test r14, r14
je 0x14006c361
mov rcx, r14
mov rdx, rsi
call fcn.140065e90
jmp 0x14006c386
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rdi
call fcn.140067610
mov rcx, rsi
mov edx, ebx
call fcn.140069530
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14006c3d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x1400cee0f]
lea r8, str.BracedRangeExpr
mov rcx, rax
call fcn.140056360
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
mov rdi, qword [rdi + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006c45b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x14006c440
mov byte [rsi + 4], 0
test r14, r14
je 0x14006c471
mov rcx, r14
mov rdx, rsi
call fcn.140065e90
jmp 0x14006c496
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call fcn.140067610
mov rcx, rsi
mov rdx, rdi
call fcn.140067610
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140084cb0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
xor edi, edi
cmp qword [rcx + 0x78], 0
je 0x140084df6
mov rsi, rcx
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x140084e7e
mov eax, dword [rsi + 0x9c]
test al, 0x10
jne 0x140084d14
test al, 8
je 0x140084df6
mov rax, qword [rsi + 0x90]
mov qword [rsp + 0x30], rax
cmp byte [rsi + 0xa2], 0
je 0x140084db2
mov rbx, qword [rsi + 0x20]
sub rbx, qword [rsi + 0x18]
jmp 0x140084dd8
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x28]
je 0x140084d3a
mov rax, qword [rsi]
mov edi, 0xffffffff
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x68]
cmp eax, 0xffffffff
je 0x140084df6
lea rdi, [rsi + 0x88]
lea r15, [rsp + 0x30]
nop word cs:[rax + rax]
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
mov r9, qword [rsi + 0x60]
add r9, r8
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
call qword [rax + 0x28]
mov ebx, eax
mov r14, qword [rsp + 0x30]
mov rcx, qword [rsi + 0x40]
mov r9, qword [rsi + 0x78]
sub r14, rcx
mov edx, 1
mov r8, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, r14
jne 0x140084df1
cmp ebx, 1
je 0x140084d50
cmp ebx, 2
je 0x140084df1
mov rcx, qword [rsi + 0x78]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov edi, 0
test eax, eax
jne 0x140084df1
jmp 0x140084df6
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r9, qword [rsi + 0x48]
mov rbx, qword [rsi + 0x50]
sub rbx, r9
test eax, eax
jle 0x140084e3f
mov rcx, qword [rsi + 0x20]
sub rcx, qword [rsi + 0x18]
mov eax, eax
imul rcx, rax
add rbx, rcx
xor ebp, ebp
mov rcx, qword [rsi + 0x78]
neg ebx
mov edx, ebx
mov r8d, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
je 0x140084e05
mov edi, 0xffffffff
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
test bpl, bpl
je 0x140084e16
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x88], rax
mov rax, qword [rsi + 0x40]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x9c], 0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
jmp 0x140084df6
mov rax, qword [rsi + 0x18]
cmp rax, qword [rsi + 0x20]
je 0x140084dd8
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
sub rax, qword [rsi + 0x10]
mov r10, qword [rcx]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
call qword [r10 + 0x40]
mov eax, eax
add rbx, qword [rsi + 0x48]
add rax, qword [rsi + 0x40]
sub rbx, rax
mov bpl, 1
jmp 0x140084dda
call fcn.140084e90
int3
Function at 0x14008e150
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [0x1400f2f78]
test al, al
je 0x14008e325
cmp qword [0x142259870], 0
je 0x14008e231
mov rax, qword [0x1400daca0]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov r8, qword [0x1422599c8]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.140010ad0
mov rax, qword [0x1400dac90]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov r8, qword [0x142259978]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.140010ad0
mov rdi, qword [0x142259870]
test rdi, rdi
je 0x14008e20f
mov rax, qword [0x1422597f8]
lea rbx, [0x1422597f8]
mov rcx, rbx
call qword [rax + 0x30]
mov ebp, eax
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov edi, eax
mov qword [0x142259870], 0
mov rax, qword [0x1422597f8]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [rax + 0x18]
or edi, ebp
je 0x14008e231
lea rax, [0x1422597f0]
mov rcx, qword [0x1422597f0]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov edx, dword [rdx + rax + 0x20]
or edx, 4
call fcn.140010ad0
movzx eax, byte [rsi]
test al, 1
je 0x14008e26a
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14008e273
cmp qword [0x142259870], 0
je 0x14008e27c
lea rax, [0x1422597f0]
mov rcx, qword [0x1422597f0]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
mov edx, dword [rdx + rax + 0x20]
or edx, 4
jmp 0x14008e2c0
mov ecx, eax
shr ecx, 1
test rcx, rcx
jne 0x14008e241
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
test al, 1
je 0x14008e286
mov rcx, qword [rsi + 0x10]
jmp 0x14008e28a
lea rcx, [rsi + 1]
lea rdx, [0x1400d8438]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov qword [0x142259870], rax
test rax, rax
je 0x14008e24b
mov dword [0x142259890], 0x10
lea rcx, [0x1422597f0]
mov rax, qword [0x1422597f0]
add rcx, qword [rax - 0x18]
xor edx, edx
call fcn.140010ad0
cmp qword [0x142259870], 0
je 0x14008e35b
mov rax, qword [0x1400dac90]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
lea r8, [0x142259938]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
call fcn.140010ad0
mov rax, qword [0x1400daca0]
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
lea rcx, [rax + rdx]
lea r8, [0x142259988]
mov qword [rax + rdx + 0x28], r8
xor edx, edx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140010ad0
lea rcx, [0x1400f2f78]
call fcn.1400046e0
test eax, eax
je 0x14008e16a
call fcn.14008e390
lea rcx, [0x14008e480]
call fcn.140001370
lea rcx, [0x1400f2f78]
call fcn.1400047bb
jmp 0x14008e16a
mov rdi, qword [0x1400dac98]
lea rdx, str.Unable_to_open_debug_log_file
mov rcx, rdi
call fcn.140084a10
mov rcx, rdi
mov rdx, rsi
call fcn.140084a40
mov rcx, rdi
call fcn.140084a70
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x14008ea00
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x14008ea1d
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x14008ea24
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdi, qword [0x1400dac98]
lea rdx, str.Failed_to_free_large_page_memory._Error_code:_0x
mov rcx, rdi
call fcn.140084a10
mov rax, qword [rdi]
mov rax, qword [rax - 0x18]
mov ecx, dword [rdi + rax + 8]
and ecx, 0xffffffb5
or ecx, 8
mov dword [rdi + rax + 8], ecx
mov rcx, rdi
mov edx, esi
call fcn.140014ad0
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
mov edx, dword [rax + rcx + 8]
and edx, 0xffffffb5
or edx, 2
mov dword [rax + rcx + 8], edx
mov rcx, rax
call fcn.140084a70
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x1400aee20
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x142236118]
mov r14, qword [rax]
lea rdi, [r14 + 8]
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0x30], 1
mov rcx, rdi
call fcn.140006890
cmp byte [r14 + 0x21], 0
je 0x1400aee7e
lea rdi, [r14 + 0x10]
lea rbx, [rsp + 0x28]
nop dword [rax]
mov rcx, rdi
mov rdx, rbx
call fcn.140006580
cmp byte [r14 + 0x21], 0
jne 0x1400aee60
cmp byte [rsp + 0x30], 0
je 0x1400aee86
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.1400068e0
mov rcx, qword [0x142208560]
call fcn.14008ea00
mov rax, rsi
shl rax, 0xf
movabs rcx, 0x7ffffffffff8000
and rcx, rax
mov qword [0x142208558], rcx
mov rcx, rsi
shl rcx, 0x14
call fcn.14008e830
mov qword [0x142208560], rax
test rax, rax
je 0x1400aeed3
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400aef20
mov rdi, qword [0x1400dac98]
lea rdx, str.Failed_to_allocate
mov rcx, rdi
call fcn.140084a10
mov rcx, rdi
mov rdx, rsi
call fcn.140014de0
mov rsi, rax
lea rdx, str.MB_for_transposition_table.
mov rcx, rax
call fcn.140084a10
mov rcx, rsi
call fcn.140084a70
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x1400ba880
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
jne 0x1400baa46
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x1400ba903
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x1400ba8ec
mov rcx, rbx
mov r8, r14
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x1400baa46
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x1400baa62
mov rbx, r14
shr rbx, 2
lea rcx, [r14*8]
call fcn.140006100
lea rdx, [rax + rbx*8]
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
mov r11, r10
sub r11, rcx
lea r9, [rax + r14*8]
mov r8, rdx
sub r10, rcx
je 0x1400baa23
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
add r10, 0xfffffffffffffff8
cmp r10, 0xf8
jae 0x1400ba97c
mov r11, rdx
jmp 0x1400baa10
lea r11, [rax + rbx*8]
sub r11, rcx
cmp r11, 0x100
jae 0x1400ba994
mov r11, rdx
jmp 0x1400baa10
shr r10, 3
inc r10
shl rbx, 3
mov r15, r10
and r15, 0xffffffffffffffe0
lea r14, [r15*8]
lea r11, [rdx + r15*8]
add rbx, rax
add rbx, 0xc0
xor r12d, r12d
nop
vmovups zmm0, zmmword [rcx + r12*8]
vmovups zmm1, zmmword [rcx + r12*8 + 0x40]
vmovups zmm2, zmmword [rcx + r12*8 + 0x80]
vmovups zmm3, zmmword [rcx + r12*8 + 0xc0]
vmovups zmmword [rbx + r12*8 - 0xc0], zmm0
vmovups zmmword [rbx + r12*8 - 0x80], zmm1
vmovups zmmword [rbx + r12*8 - 0x40], zmm2
vmovups zmmword [rbx + r12*8], zmm3
add r12, 0x20
cmp r15, r12
jne 0x1400ba9c0
cmp r10, r15
je 0x1400baa23
add rcx, r14
nop
mov r10, qword [rcx]
mov qword [r11], r10
add r11, 8
add rcx, 8
cmp r11, r8
jne 0x1400baa10
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x1400baa46
vzeroupper
call fcn.1400061e0
mov r8, qword [rsi + 0x10]
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
vzeroupper
ret
call fcn.140084c90
int3