joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002eb6
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
sub rsp, 0x38
mov rsi, rcx
mov rcx, rdx
mov edx, 1
mov r9, rsi
mov rdi, r8
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rdi, rax
je 0x140002ee9
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.140002d28
mov rax, qword [rsp + 0x28]
add rsp, 0x38
pop rsi
pop rdi
ret

Function at 0x140003583
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, rdx
mov edx, 1
mov r9, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
mov qword [rsp + 0x28], rax
call fcn.140002d28
mov rax, qword [rsp + 0x28]
add rsp, 0x30
pop rbx
ret

Function at 0x140003852
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x140003871
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400249c8

Function at 0x1400039d2
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rsi, [0x14002c5d8]
mov rbp, qword [rcx]
mov rdi, qword [rcx + 8]
mov ecx, 2
call rbx
lea rdx, str.could_not_load:
mov rcx, rax
call fcn.140003852
test rbp, rbp
je 0x140003a0e
lea rsi, [rdi + 8]
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.140003852
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x140003a43
mov ecx, 2
call rbx
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call fcn.140003852
mov ecx, 2
call rbx
lea rdx, [0x14002c61b]
mov rcx, rax
call fcn.140003852
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop

Function at 0x140003a64
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call fcn.140003852
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.140003852
mov ecx, 2
call rbx
lea rdx, [0x14002c61b]
mov rcx, rax
call fcn.140003852
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop

Function at 0x140003baf
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140039120]
test rax, rax
je 0x140003bc1
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call fcn.140003852
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
Function at 0x1400048dc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14002b380]
call fcn.14001f5f0
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.140004762

Function at 0x140004904
Capabilities:
Terminate process

Disassembly:
cmp rdx, 0x10
jle 0x140004911
movzx eax, word [rcx - 2]
sub rcx, rax
jmp fcn.1400048dc

Function at 0x140004969
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000497d
test byte [rcx + 7], 0x40
jne 0x14000497d
jmp fcn.1400048dc
ret

Function at 0x140004a6e
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x10
mov qword [rsp + 0x28], rdx
call fcn.140004a3a
mov rdx, qword [rsp + 0x28]
sub rbx, rax
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.140004904

Function at 0x140004a9a
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rax, qword [rax]
mov rbx, rcx
test rax, rax
jne 0x140004abf
mov rax, qword [rbx]
mov rcx, rbx
movsx rdx, word [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140004a6e
call rax
lea rcx, [0x14002b360]
call fcn.14001f5f0
cmp byte [rax], 0
je 0x140004aad
add rsp, 0x20
pop rbx
ret

Function at 0x140004e48
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [rcx]
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x140004e72
mov rax, qword [rdx - 0x10]
add rax, 0x10
jo 0x140004e6d
mov qword [rdx - 0x10], rax
jmp 0x140004e72
call fcn.1400049da
mov qword [rsi], rbx
mov rcx, rdi
call fcn.1400056f9
test al, al
je 0x140004e90
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140004a9a
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140005075
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor eax, eax
lea rbx, [rsp + 0x20]
mov rbp, rdx
mov rdx, rcx
mov qword [rsp + 0x30], rax
mov rcx, rbx
mov r12, r8
mov qword [rsp + 0x38], rax
call fcn.140001c01
lea rcx, [0x14002b360]
mov r13, qword [rsp + 0x20]
call fcn.14001f5f0
mov rdi, qword [rsp + 0x28]
cmp byte [rax], 0
mov rsi, rax
jne 0x1400051fd
mov rdx, rbp
mov rcx, rbx
call fcn.140001c01
cmp byte [rsi], 0
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
jne 0x1400051fd
mov rdx, r12
mov rcx, rbx
call fcn.140001c01
cmp byte [rsi], 0
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
jne 0x1400051fd
lea rax, [r13 + r14]
lea rsi, [rsp + 0x30]
lea rdx, [rax + r15 + 0x1f]
mov rcx, rsi
call fcn.140005a53
movaps xmm0, xmmword [0x14002cc80]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm0
call fcn.140005ab8
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], rdi
call fcn.140005ab8
movaps xmm1, xmmword [0x14002cbc0]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm1
call fcn.140005ab8
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rbp
call fcn.140005ab8
movaps xmm2, xmmword [0x14002cba0]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm2
call fcn.140005ab8
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r12
call fcn.140005ab8
movaps xmm3, xmmword [rsp + 0x30]
mov rcx, rbx
movaps xmmword [rsp + 0x20], xmm3
call fcn.140004f7d
test r12, r12
je 0x1400051c7
test byte [r12 + 7], 0x40
jne 0x1400051c7
mov rcx, r12
call fcn.1400048dc
test rbp, rbp
je 0x1400051da
test byte [rbp + 7], 0x40
jne 0x1400051da
mov rcx, rbp
call fcn.1400048dc
test rdi, rdi
je 0x1400051fd
test byte [rdi + 7], 0x40
jne 0x1400051fd
mov rcx, rdi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400048dc
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000520e
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
imul rax, qword [rcx + 8], 3
mov rbx, rcx
jo 0x140005231
mov ecx, 2
cqo
idiv rcx
imul rcx, rax, 0x10
mov qword [rbx + 8], rax
jno 0x14000523b
add rsp, 0x20
pop rbx
jmp fcn.1400049da
test rcx, rcx
jns 0x140005256
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140005075
mov rdx, rcx
mov rcx, qword [rbx + 0x10]
call fcn.1400048ac
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret

Function at 0x140005745
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov qword [rcx], rdx
mov rcx, rbx
call fcn.1400056f9
test al, al
je 0x140005769
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140004a9a
add rsp, 0x20
pop rbx
ret
Function at 0x14000576f
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
imul rax, qword [rcx + 8], 3
mov rbx, rcx
jo 0x140005792
mov ecx, 2
cqo
idiv rcx
imul rcx, rax, 0x10
mov qword [rbx + 8], rax
jno 0x14000579c
add rsp, 0x20
pop rbx
jmp fcn.1400049da
test rcx, rcx
jns 0x1400057b7
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140005075
mov rdx, rcx
mov rcx, qword [rbx + 0x10]
call fcn.1400048ac
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret

Function at 0x1400058d6
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
add rdx, qword [rcx]
mov rbp, rcx
mov rbx, rdx
jo 0x140005905
mov rsi, qword [rcx + 8]
test rsi, rsi
je 0x1400058fc
mov rcx, qword [rsi]
bt rcx, 0x3e
jae 0x140005912
mov rcx, rbx
add rcx, 1
jno 0x140005922
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400049da
btr rcx, 0x3e
cmp rdx, rcx
jle 0x140005a09
jmp 0x140005976
add rcx, 8
jo 0x140005905
test rcx, rcx
js 0x1400059e3
call fcn.14000444f
mov rcx, qword [rbp]
mov qword [rbp + 8], rax
mov qword [rax], rbx
test rcx, rcx
jg 0x140005958
test rsi, rsi
jne 0x140005a09
mov byte [rax + 8], 0
jmp 0x140005a09
cmp rbx, rcx
cmovle rcx, rbx
test rcx, rcx
js 0x1400059e3
add rax, 8
add rsi, 8
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
jmp 0x140005a09
call fcn.140004e01
cmp rbx, rax
cmovge rax, rbx
mov rsi, rax
add rax, 1
jo 0x140005905
add rax, 8
jo 0x140005905
test rax, rax
jns 0x1400059ba
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140005075
mov rcx, qword [rbp + 8]
mov rdx, rax
call fcn.1400048ac
cmp rbx, rsi
mov qword [rbp + 8], rax
mov qword [rax], rsi
jge 0x140005a09
sub rsi, rbx
mov rcx, rsi
jo 0x140005905
test rsi, rsi
jns 0x1400059f1
movabs r8, 0x7fffffffffffffff
xor edx, edx
jmp 0x1400059ad
lea rax, [rax + rbx + 9]
mov rdx, rsi
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14000388f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140005ab8
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140005b17
mov rcx, rax
add rcx, 1
jo 0x140005af3
test rcx, rcx
jns 0x140005afa
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140005af3
mov qword [r8], rax
pop rsi
pop rdi
ret
Function at 0x140005b1a
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rdx, rdx
mov rbp, rcx
mov rbx, rdx
je 0x140005c81
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x140005b52
mov rsi, qword [rdi]
bt rsi, 0x3e
jb 0x140005b52
cmp qword [rcx], rdx
jl 0x140005bfa
jmp 0x140005c78
mov rsi, rbx
add rsi, 1
jo 0x140005b64
mov rcx, rsi
add rcx, 8
jno 0x140005b71
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400049da
test rcx, rcx
js 0x140005c49
call fcn.14000444f
mov rcx, qword [rbp]
mov qword [rbp + 8], rax
mov qword [rax], rbx
test rcx, rcx
jg 0x140005b9d
test rsi, rsi
js 0x140005c12
lea rcx, [rax + 8]
mov rdx, rsi
jmp 0x140005bf3
cmp rcx, rbx
cmovg rcx, rbx
test rcx, rcx
js 0x140005c49
lea rsi, [rdi + 8]
add rax, 8
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp]
cmp rax, rbx
jl 0x140005bd1
mov rax, qword [rbp + 8]
mov byte [rax + rbx + 8], 0
jmp 0x140005c78
mov rcx, rbx
sub rcx, rax
jo 0x140005b64
add rcx, 1
jo 0x140005b64
test rcx, rcx
js 0x140005c49
mov rdx, qword [rbp + 8]
lea rax, [rdx + rax + 8]
mov rdx, rcx
mov rcx, rax
call fcn.14000388f
jmp 0x140005c78
btr rsi, 0x3e
cmp rdx, rsi
jle 0x140005c78
mov rcx, rsi
call fcn.140004e01
add rsi, 9
jns 0x140005c23
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
jmp 0x140005c55
cmp rbx, rax
cmovge rax, rbx
mov rcx, rax
mov rdi, rax
add rcx, 1
jo 0x140005b64
add rcx, 8
jo 0x140005b64
test rcx, rcx
jns 0x140005c62
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140005075
mov r8, rcx
mov rcx, qword [rbp + 8]
mov rdx, rsi
call fcn.140004988
mov qword [rbp + 8], rax
mov qword [rax], rdi
mov rax, qword [rbp + 8]
mov byte [rax + rbx + 8], 0
mov qword [rbp], rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140006471
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
call fcn.1400056f9
test al, al
je 0x140006494
mov rcx, qword [rbx + 8]
add rsp, 0x20
pop rbx
jmp fcn.140004a9a
add rsp, 0x20
pop rbx
ret

Function at 0x140006597
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov qword [rsp + 0x28], rdx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400249c8
Function at 0x1400065d6
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x140039110], 0
jne 0x1400065ee
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140006597
lea rsi, [rsp + 0x20]
mov rdx, rcx
mov rcx, rsi
call fcn.140006535
mov rbx, qword [rsp + 0x28]
mov rcx, rsi
call qword [0x140039110]
test rbx, rbx
je 0x14000661f
test byte [rbx + 7], 0x40
jne 0x14000661f
mov rcx, rbx
call fcn.1400048dc
lea rcx, [0x14002b360]
call fcn.14001f5f0
cmp byte [rax], 0
je 0x140006657
lea rcx, [0x14002b260]
mov byte [rax], 0
call fcn.14001f5f0
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140004e48
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x140006718
Capabilities:
Terminate process

Disassembly:
jmp fcn.1400048dc
test rcx, rcx
je 0x140016528
jmp 0x140006718
ret

Function at 0x14000699f
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rdx + 8]
mov rbx, qword [rdx]
mov rdi, rcx
mov rcx, qword [rcx + 8]
cmp rcx, rsi
je 0x140006a71
test rsi, rsi
je 0x1400069cf
test byte [rsi + 7], 0x40
jne 0x1400069cf
test rcx, rcx
jne 0x1400069eb
jmp 0x140006a0b
test rcx, rcx
je 0x1400069df
test byte [rcx + 7], 0x40
jne 0x1400069df
call fcn.1400048dc
mov qword [rdi], rbx
mov qword [rdi + 8], rsi
jmp 0x140006a71
mov rax, qword [rcx]
mov edx, 1
shl rdx, 0x3e
test rax, rdx
jne 0x140006a0b
btr rax, 0x3e
cmp rax, rbx
jge 0x140006a37
call fcn.1400048dc
mov rcx, rbx
add rcx, 1
jo 0x140006a1a
add rcx, 8
jno 0x140006a26
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400049da
test rcx, rcx
js 0x140006a48
call fcn.14000444f
mov qword [rdi + 8], rax
mov qword [rax], rbx
mov qword [rdi], rbx
add rbx, 1
mov rcx, rbx
jo 0x140006a1a
test rbx, rbx
jns 0x140006a60
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140005075
mov rax, qword [rdi + 8]
add rsi, 8
add rax, 8
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140006c81
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r12, [0x1400390e0]
xor ebx, ebx
lea r14, [0x14002b360]
lea r13, [rsp + 0x20]
mov rsi, rcx
mov rdi, rdx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbp, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rbx, rdi
mov ecx, 1
jl 0x140006d07
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14002c61b]
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
call fcn.1400249c8
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rbp
xor r8d, r8d
mov rdx, r13
mov rcx, rax
mov rax, rbx
shl rax, 4
movups xmm0, xmmword [rsi + rax]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140006b5b
mov rcx, r14
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x140006d39
inc rbx
jmp 0x140006cba
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140006d48
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1400056f9
test al, al
je 0x140006d68
mov rcx, qword [rsp + 0x28]
add rsp, 0x38
jmp fcn.140004a9a
add rsp, 0x38
ret

Function at 0x140006d6d
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor esi, esi
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rsi, rdi
jl 0x140006d89
test rbx, rbx
jne 0x140006daa
jmp 0x140006dbf
mov rax, rsi
shl rax, 4
mov rcx, qword [rbx + rax + 0x10]
test rcx, rcx
je 0x140006da5
test byte [rcx + 7], 0x40
jne 0x140006da5
call fcn.1400048dc
inc rsi
jmp 0x140006d7d
test byte [rbx + 7], 0x40
jne 0x140006dbf
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400048dc
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140006ec0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14002c5d8]
cmp qword [rcx], 0
mov rax, qword [rcx + 8]
mov rbx, rdx
je 0x140006edf
lea rdi, [rax + 8]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
mov rdx, rdi
mov rcx, rax
call fcn.140003852
mov ecx, 2
call rsi
lea rdx, [0x14002c61b]
mov rcx, rax
call fcn.140003852
cmp rbx, 0xffffffff80000000
mov ecx, 0x80000000
jl 0x140006f2c
cmp rbx, 0x7fffffff
mov ecx, 0x7fffffff
jg 0x140006f2c
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop

Function at 0x1400071cf
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx]
add rcx, 1
jo 0x1400071ec
add rcx, 8
jno 0x1400071f8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400049da
test rcx, rcx
js 0x140007217
call fcn.14000444f
mov rcx, qword [rbx]
mov qword [rbx + 8], rax
mov qword [rax], rcx
add rcx, 1
jo 0x1400071ec
test rcx, rcx
jns 0x14000722f
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140005075
add rax, 8
add rsi, 8
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14000742b
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor eax, eax
lea rbx, [rsp + 0x20]
mov r12, rdx
mov rdx, rcx
mov qword [rsp + 0x30], rax
mov rcx, rbx
mov rdi, r8
mov qword [rsp + 0x38], rax
call fcn.140001bd2
lea rcx, [0x14002b360]
mov r13, qword [rsp + 0x20]
call fcn.14001f5f0
mov rbp, qword [rsp + 0x28]
cmp byte [rax], 0
mov rsi, rax
jne 0x1400075b4
mov rdx, r12
mov rcx, rbx
call fcn.140001bd2
cmp byte [rsi], 0
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
jne 0x1400075b4
lea rdx, [rdi - 1]
mov rcx, rbx
call fcn.140001bd2
cmp byte [rsi], 0
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
jne 0x1400075b4
lea rax, [r13 + r14]
lea rsi, [rsp + 0x30]
lea rdx, [rax + r15 + 0x21]
mov rcx, rsi
call fcn.140005a53
movaps xmm0, xmmword [0x14002c9d0]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm0
call fcn.140005ab8
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], rbp
call fcn.140005ab8
movaps xmm1, xmmword [0x14002c9b0]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm1
call fcn.140005ab8
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r12
call fcn.140005ab8
movaps xmm2, xmmword [0x14002c980]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm2
call fcn.140005ab8
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rdi
call fcn.140005ab8
movaps xmm3, xmmword [rsp + 0x30]
mov rcx, rbx
movaps xmmword [rsp + 0x20], xmm3
call fcn.140005fda
test rdi, rdi
je 0x14000757c
test byte [rdi + 7], 0x40
jne 0x14000757c
mov rcx, rdi
call fcn.1400048dc
test r12, r12
je 0x140007591
test byte [r12 + 7], 0x40
jne 0x140007591
mov rcx, r12
call fcn.1400048dc
test rbp, rbp
je 0x1400075b4
test byte [rbp + 7], 0x40
jne 0x1400075b4
mov rcx, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400048dc
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140007654
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140007668
test byte [rcx + 7], 0x40
jne 0x140007668
jmp fcn.1400048dc
ret

Function at 0x140007841
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movups xmm0, xmmword [rdx]
lea rdi, [rsp + 0x30]
mov rsi, rcx
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140001c46
lea rcx, [0x14002b360]
mov rbp, qword [rsp + 0x30]
call fcn.14001f5f0
mov rbx, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x1400078bc
mov rdx, rbp
mov rcx, rsi
call fcn.1400058d6
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbx
call fcn.140005ab8
test rbx, rbx
je 0x1400078bc
test byte [rbx + 7], 0x40
jne 0x1400078bc
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400048dc
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140007b18
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor esi, esi
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rsi, rdi
jl 0x140007b34
test rbx, rbx
jne 0x140007b52
jmp 0x140007b67
imul rax, rsi, 0x38
mov rcx, qword [rbx + rax + 0x10]
test rcx, rcx
je 0x140007b4d
test byte [rcx + 7], 0x40
jne 0x140007b4d
call fcn.1400048dc
inc rsi
jmp 0x140007b28
test byte [rbx + 7], 0x40
jne 0x140007b67
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400048dc
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140007fe0
Capabilities:
Terminate process

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x140007ff4
test byte [rax + 7], 0x40
je 0x140007ff4
jmp fcn.1400071cf
ret

Function at 0x14000842d
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
je 0x140008485
mov rax, qword [rcx - 0x10]
lea rdx, [rcx - 0x10]
cmp rax, 0xf
jbe 0x14000846b
sub rax, 0x10
jo 0x140008461
mov r8, qword [rcx]
mov qword [rcx - 0x10], rax
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.1400056c5
add rsp, 0x20
pop rbx
jmp fcn.1400049da
mov r8, qword [rcx]
mov ecx, 1
call fcn.1400056c5
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140004a9a
add rsp, 0x20
pop rbx
ret

Function at 0x140008d3b
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp qword [r8], rdx
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
jge 0x140008d5d
test rdx, rdx
js 0x140008d9b
mov rcx, r8
call fcn.140005b1a
cmp qword [rbx], 0
lea rdx, [0x14002cd25]
mov rax, qword [rbx + 8]
je 0x140008d72
lea rdx, [rax + 8]
mov r8, rsi
mov rcx, rdi
call fcn.140008703
mov rcx, qword [0x140032710]
mov rsi, rax
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x140008dc8
cmp qword [rbx], rsi
je 0x140008dc8
test rsi, rsi
jns 0x140008db6
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140005075
mov rdx, rsi
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140005b1a
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140009530
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r9, r9
mov r12, rcx
mov rdi, rdx
mov rsi, r8
mov rbp, r9
jns 0x140009569
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140005075
mov rdx, r9
mov rcx, r8
xor ebx, ebx
call fcn.140005b1a
cmp rbx, rbp
je 0x1400095cb
mov rdx, qword [rsi]
cmp rdx, rbx
jg 0x140009588
dec rdx
jmp 0x1400095a8
mov rax, qword [rsi + 8]
test rax, rax
je 0x14000959f
test byte [rax + 7], 0x40
je 0x14000959f
mov rcx, rsi
call fcn.1400071cf
cmp rbx, rdi
jl 0x1400095ba
lea rdx, [rdi - 1]
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000603a
mov dl, byte [r12 + rbx]
mov rax, qword [rsi + 8]
mov byte [rax + rbx + 8], dl
inc rbx
jmp 0x140009576
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140009b00
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140009b5f
mov rcx, rax
add rcx, 1
jo 0x140009b3b
test rcx, rcx
jns 0x140009b42
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140009b3b
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x140009b62
Capabilities:
Terminate process

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x140009b76
test byte [rax + 7], 0x40
je 0x140009b76
jmp fcn.1400071cf
ret