joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e160
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd0]
mov rbx, rcx
test rax, rax
je 0x14003e186
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003e26e
jmp 0x14003e262
mov ecx, 0x28
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x14003e1bf
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x28
xorps xmm0, xmm0
mov qword [rbx + 0xd0], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x20], rcx
mov rcx, qword [rbx + 0x88]
test rcx, rcx
jne 0x14003e1f6
mov rcx, rbx
call fcn.14003d8c0
mov rcx, qword [rbx + 0x88]
mov rax, qword [rbx + 0xd0]
mov qword [rax], rcx
mov rax, qword [rbx + 0xa0]
mov rcx, qword [rbx + 0xd0]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0xd0]
movzx eax, word [rbx + 0xa8]
mov word [rcx + 0x10], ax
mov ecx, dword [rbx + 0xac]
mov rax, qword [rbx + 0xd0]
shr ecx, 1
sbb ecx, ecx
mov byte [rax + 0x12], cl
mov ecx, dword [rbx + 0xac]
mov rax, qword [rbx + 0xd0]
shr ecx, 2
sbb ecx, ecx
mov byte [rax + 0x13], cl
mov ecx, dword [rbx + 0xac]
mov rax, qword [rbx + 0xd0]
shr ecx, 3
sbb ecx, ecx
mov byte [rax + 0x14], cl
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x150
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003e290
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x118]
xor esi, esi
mov rbx, rcx
test rax, rax
je 0x14003e2c1
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003e4c7
jmp 0x14003e4b1
mov edi, 0x48
mov ecx, edi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x14003e2fc
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], edi
mov r8, rdi
mov rcx, rax
mov qword [rbx + 0x118], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x88]
test rcx, rcx
jne 0x14003e32f
mov rcx, rbx
call fcn.14003d8c0
mov rcx, qword [rbx + 0x88]
mov rax, qword [rbx + 0x118]
mov qword [rax], rcx
mov rdx, qword [rbx + 0xb8]
test rdx, rdx
je 0x14003e370
mov rcx, qword [rbx + 0x118]
add rcx, 8
call fcn.14003d670
mov rax, qword [rbx + 0x118]
mov rcx, qword [rax + 8]
mov eax, dword [rcx]
sub eax, 0x24
test eax, 0xfffffffd
jne 0x14003e4e0
cmp word [rbx + 0xa0], si
je 0x14003e3a0
lea rdi, [rbx + 0x98]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
jne 0x14003e395
mov rcx, rdi
call fcn.14003fd10
mov rcx, qword [rdi + 0x10]
mov rax, qword [rbx + 0x118]
mov qword [rax + 0x18], rcx
mov rcx, qword [rbx + 0xc0]
test rcx, rcx
je 0x14003e3c7
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x118]
mov qword [rcx + 0x10], rax
movzx eax, word [rbx + 0xe0]
mov rcx, qword [rbx + 0x118]
mov word [rcx + 0x20], ax
movzx eax, word [rbx + 0xe2]
mov rcx, qword [rbx + 0x118]
mov word [rcx + 0x22], ax
movzx eax, word [rbx + 0xe4]
mov rcx, qword [rbx + 0x118]
mov word [rcx + 0x24], ax
mov rcx, qword [rbx + 0x118]
mov eax, dword [rbx + 0xe8]
mov dword [rcx + 0x28], eax
mov ecx, dword [rbx + 0xec]
mov rax, qword [rbx + 0x118]
shr ecx, 1
sbb ecx, ecx
mov byte [rax + 0x2c], cl
mov ecx, dword [rbx + 0xec]
mov rax, qword [rbx + 0x118]
shr ecx, 2
sbb ecx, ecx
mov byte [rax + 0x2d], cl
mov ecx, dword [rbx + 0xec]
mov rax, qword [rbx + 0x118]
shr ecx, 3
sbb ecx, ecx
mov byte [rax + 0x2e], cl
mov ecx, dword [rbx + 0xec]
mov rax, qword [rbx + 0x118]
shr ecx, 9
sbb ecx, ecx
mov byte [rax + 0x31], cl
mov ecx, dword [rbx + 0xec]
mov rax, qword [rbx + 0x118]
shr ecx, 7
sbb ecx, ecx
mov byte [rax + 0x2f], cl
mov ecx, dword [rbx + 0xec]
mov rax, qword [rbx + 0x118]
shr ecx, 8
sbb ecx, ecx
mov byte [rax + 0x30], cl
mov rcx, qword [rbx + 0x100]
test rcx, rcx
je 0x14003e4b1
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x118]
mov qword [rcx + 0x38], rax
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x167
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pBaseIntf__Nodekind_NODE_INTERFACE_REFERENCE__pDump__pBaseIntf__Nodekind_NODE_HREF
mov edx, 0x174
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003e500
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xa0]
mov rbx, rcx
test rax, rax
je 0x14003e526
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003e5b4
jmp 0x14003e5a8
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x14003e55f
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x10
xorps xmm0, xmm0
mov qword [rbx + 0xa0], rax
movups xmmword [rax], xmm0
mov rcx, qword [rbx + 0x88]
test rcx, rcx
jne 0x14003e58e
mov rcx, rbx
call fcn.14003d8c0
mov rcx, qword [rbx + 0x88]
mov rax, qword [rbx + 0xa0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xa0]
mov al, byte [rbx + 0x98]
mov byte [rcx + 8], al
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x194
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3

Function at 0x14003e5e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x50]
mov rbx, rcx
test rax, rax
je 0x14003e613
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003e70f
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x14003e6ec
mov ecx, dword [0x140134854]
xorps xmm0, xmm0
add ecx, 0x18
mov qword [rbx + 0x50], rax
mov edi, ecx
mov dword [0x140134854], ecx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov ecx, 0x68
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x14003e6ec
lea ecx, [rdi + 0x68]
xor edx, edx
mov dword [0x140134854], ecx
mov rcx, qword [rbx + 0x50]
lea r8d, [rdx + 0x68]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x50]
mov rcx, qword [rcx]
call sub.msvcrt.dll_memset
mov rdx, qword [rbx + 0x38]
test rdx, rdx
jne 0x14003e69f
mov rcx, rbx
call fcn.14003d710
mov rdx, qword [rbx + 0x38]
mov rax, qword [rbx + 0x50]
movups xmm0, xmmword [rdx]
mov rcx, qword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
mov rcx, qword [rbx + 0x50]
mov rax, qword [rcx]
cmp dword [rax], 0x2f
jne 0x14003e728
mov rdx, qword [rbx + 0x40]
add rcx, 8
call fcn.14003d670
mov rcx, qword [rbx + 0x50]
mov al, byte [rbx + 0x48]
mov byte [rcx + 0x10], al
jmp 0x14003e602
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x1a6
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pThis__skl.Kind__NODE_SAFEARRAY
mov edx, 0x1b0
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003e750
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x98]
xor esi, esi
mov rbx, rcx
test rax, rax
je 0x14003e792
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003e894
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x14003e7cb
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x10
xorps xmm0, xmm0
mov qword [rbx + 0x98], rax
movups xmmword [rax], xmm0
mov rcx, qword [rbx + 0x88]
test rcx, rcx
jne 0x14003e7fa
mov rcx, rbx
call fcn.14003d8c0
mov rcx, qword [rbx + 0x88]
mov rax, qword [rbx + 0x98]
lea r9, [0x14012d320]
lea r8, [0x14012cf20]
mov dword [rsp + 0x20], esi
xor edx, edx
mov qword [rax], rcx
mov rcx, rbx
call fcn.1400cbdc8
test rax, rax
je 0x14003e855
cmp word [rax + 0xb0], si
je 0x14003e855
lea rdi, [rax + 0xa8]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
jne 0x14003e84a
mov rcx, rdi
call fcn.14003fd10
mov rcx, qword [rdi + 0x10]
mov rax, qword [rbx + 0x98]
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x98]
mov rcx, qword [rax]
cmp dword [rcx], 0x1e
jne 0x14003e87b
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x14003e8ad
add rcx, 0x28
call fcn.14003d670
jmp 0x14003e77c
lea r8, str.pDump__pThis__skl.Kind__NODE_DEF
mov edx, 0x1ca
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x1be
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.GetChild_____NULL
mov edx, 0x1cb
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003e8d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x128]
mov rbx, rcx
test rax, rax
je 0x14003e8fd
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003e9fe
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 0x50
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x14003e936
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x50
mov r8d, 0x50
mov rcx, rax
mov qword [rbx + 0x128], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x118]
test rcx, rcx
jne 0x14003e96d
mov rcx, rbx
call fcn.14003e290
mov rcx, qword [rbx + 0x118]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0x128]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [rcx + 0x40]
movsd qword [rax + 0x40], xmm0
mov rax, qword [rbx + 0x128]
mov rcx, qword [rax]
cmp dword [rcx], 0x29
jne 0x14003e9e5
mov rcx, qword [rbx + 0x120]
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x128]
mov qword [rcx + 0x48], rax
mov rax, qword [rbx + 0x128]
mov rcx, qword [rax + 0x48]
mov rax, qword [rcx]
cmp dword [rax], 0x21
jne 0x14003ea17
jmp 0x14003e8f1
lea r8, str.pDump__Intf.pThis__skl.Kind__NODE_DISPINTERFACE
mov edx, 0x1e1
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__Intf.pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x1d7
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pDispInf__pThis__skl.Kind__NODE_INTERFACE
mov edx, 0x1e4
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003ea40
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x128]
mov rbx, rcx
test rax, rax
je 0x14003ea6d
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003eb48
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 0x50
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x14003eaa6
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x50
mov r8d, 0x50
mov rcx, rax
mov qword [rbx + 0x128], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x118]
test rcx, rcx
jne 0x14003eadd
mov rcx, rbx
call fcn.14003e290
mov rcx, qword [rbx + 0x118]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0x128]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [rcx + 0x40]
movsd qword [rax + 0x40], xmm0
mov rcx, qword [rbx + 0x128]
mov al, byte [rbx + 0x120]
mov byte [rcx + 0x48], al
mov rax, qword [rbx + 0x128]
mov rcx, qword [rax]
cmp dword [rcx], 0x2c
je 0x14003ea61
lea r8, str.pDump__Intf.pThis__skl.Kind__NODE_COCLASS
mov edx, 0x1fa
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__Intf.pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x1ee
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3

Function at 0x14003eb70
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
mov rbx, rcx
test rax, rax
je 0x14003eb9d
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003ec58
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x14003ebd6
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x10
mov rcx, qword [rbx + 0x88]
mov qword [rbx + 0x98], rax
test rcx, rcx
jne 0x14003ec06
mov rcx, rbx
call fcn.14003d8c0
mov rax, qword [rbx + 0x98]
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x98]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x98]
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
cmp dword [rax], 0x21
je 0x14003eb91
lea r8, str.pDump__pBaseIntf__pThis__skl.Kind__NODE_INTERFACE
mov edx, 0x20a
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x203
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003ecb0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
mov rbx, rcx
test rax, rax
je 0x14003ecd6
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003ed6f
jmp 0x14003ed63
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x14003ed0f
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x18
xorps xmm0, xmm0
mov qword [rbx + 0x98], rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 0x88]
test rcx, rcx
jne 0x14003ed42
mov rcx, rbx
call fcn.14003d8c0
mov rcx, qword [rbx + 0x88]
mov rax, qword [rbx + 0x98]
mov qword [rax], rcx
mov rax, qword [rbx + 0xa0]
mov rcx, qword [rbx + 0x98]
movups xmm0, xmmword [rax + 0x28]
movdqu xmmword [rcx + 8], xmm0
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x225
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3

Function at 0x14003ed90
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x48]
mov rbx, rcx
test rax, rax
je 0x14003edac
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003ee22
jmp 0x14003ee16
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
jne 0x14003ede5
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x18
xorps xmm0, xmm0
mov qword [rbx + 0x48], rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 0x38]
test rcx, rcx
jne 0x14003ee0f
mov rcx, rbx
call fcn.14003d710
mov rcx, qword [rbx + 0x38]
mov rax, qword [rbx + 0x48]
mov qword [rax], rcx
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__pThis__Kind___INTERNAL_NODE_END
mov edx, 0x236
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3

Function at 0x14003ee50
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
mov rbx, rcx
test rax, rax
je 0x14003ee76
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003ef11
jmp 0x14003ef05
mov ecx, 0x10
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x14003eeaf
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x10
xorps xmm0, xmm0
mov qword [rbx + 0x98], rax
movups xmmword [rax], xmm0
mov rcx, qword [rbx + 0x88]
test rcx, rcx
jne 0x14003eede
mov rcx, rbx
call fcn.14003d8c0
mov rcx, qword [rbx + 0x88]
mov rax, qword [rbx + 0x98]
mov qword [rax], rcx
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 0x100]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x98]
mov byte [rcx + 9], al
mov eax, 1
add rsp, 0x20
pop rbx
ret
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x247
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003ef30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
xor r15d, r15d
mov rsi, rcx
test rax, rax
je 0x14003ef6b
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003f17d
jmp 0x14003f13b
mov ebx, 0x40
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x14003f15a
add dword [0x140134854], ebx
mov r8d, ebx
xor edx, edx
mov qword [rsi + 0xd8], rax
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [rsi + 0x88]
test rcx, rcx
jne 0x14003efbc
mov rcx, rsi
call fcn.14003d8c0
mov rcx, qword [rsi + 0x88]
mov rax, qword [rsi + 0xd8]
mov qword [rax], rcx
movzx ecx, word [rsi + 0xb8]
mov rax, qword [rsi + 0xd8]
mov dword [rax + 8], ecx
movzx ecx, byte [rsi + 0xba]
mov rax, qword [rsi + 0xd8]
mov dword [rax + 0xc], ecx
movzx ecx, byte [rsi + 0xbb]
mov rax, qword [rsi + 0xd8]
and ecx, 1
mov dword [rax + 0x10], ecx
mov ecx, dword [rsi + 0xb8]
mov rax, qword [rsi + 0xd8]
shr ecx, 0x1a
and ecx, 1
mov dword [rax + 0x14], ecx
mov rcx, qword [rsi + 0xd8]
mov rax, qword [rsi + 0xc0]
mov qword [rcx + 0x18], rax
mov rcx, rsi
mov rax, qword [rsi]
mov rax, qword [rax + 0x48]
call qword [case.0x1400cd70e.0]
mov ecx, eax
mov rax, qword [rsi + 0xd8]
mov byte [rax + 0x20], cl
cmp word [rsi + 0xa0], r15w
je 0x14003f071
lea rbx, [rsi + 0x98]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jne 0x14003f066
mov rcx, rbx
call fcn.14003fd10
mov rcx, qword [rbx + 0x10]
mov rax, qword [rsi + 0xd8]
mov qword [rax + 0x28], rcx
mov rbp, qword [rsi + 0xb0]
mov ecx, r15d
mov rax, rbp
mov rdx, rbp
test rdx, rdx
je 0x14003f08c
mov rax, qword [rax + 0x58]
jmp 0x14003f08f
mov rax, r15
test rdx, rdx
je 0x14003f09b
inc ecx
mov rdx, rax
jmp 0x14003f081
mov rax, qword [rsi + 0xd8]
mov dword [rax + 0x30], ecx
mov eax, 0x10
movsxd rcx, ecx
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rcx, rax
test rax, rax
je 0x14003f15a
mov rax, qword [rsi + 0xd8]
mov r14d, r15d
add dword [0x140134854], ebx
mov qword [rax + 0x38], rcx
mov rcx, rbp
test rcx, rcx
je 0x14003f0fb
mov rbp, qword [rbp + 0x58]
jmp 0x14003f0fe
mov rbp, r15
test rcx, rcx
je 0x14003f13b
mov rax, qword [rsi + 0xd8]
movzx ebx, byte [rcx + 0x18]
movsxd rdi, r14d
shl rdi, 4
add rdi, qword [rax + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0xd8]
call qword [case.0x1400cd70e.0]
mov edx, ebx
mov rcx, rdi
mov r8, rax
call fcn.14003d57c
inc r14d
jmp 0x14003f0ed
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea r8, str.pDump__pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x258
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
Function at 0x14003f1a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xe0]
mov rbx, rcx
test rax, rax
je 0x14003f1cd
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003f2a9
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 0x48
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x14003f206
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x48
mov r8d, 0x48
mov rcx, rax
mov qword [rbx + 0xe0], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x14003f23d
mov rcx, rbx
call fcn.14003ef30
mov rcx, qword [rbx + 0xd8]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0xe0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
mov rax, qword [rbx + 0xe0]
mov rcx, qword [rax]
cmp dword [rcx], 0x16
jne 0x14003f290
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x30]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xe0]
mov byte [rcx + 0x40], al
jmp 0x14003f1c1
lea r8, str.pDump__base.pThis__skl.Kind__NODE_STRUCT
mov edx, 0x288
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__base.pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x280
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3

Function at 0x14003f2d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xe0]
mov rbx, rcx
test rax, rax
je 0x14003f2fd
mov rax, qword [rax]
cmp dword [rax], 0x37
jae 0x14003f3d9
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, 0x48
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor edx, edx
test rax, rax
jne 0x14003f336
mov ebx, 0x7d5
xor r9d, r9d
mov r8d, ebx
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x48
mov r8d, 0x48
mov rcx, rax
mov qword [rbx + 0xe0], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x14003f36d
mov rcx, rbx
call fcn.14003ef30
mov rcx, qword [rbx + 0xd8]
movups xmm0, xmmword [rcx]
mov rax, qword [rbx + 0xe0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
mov rax, qword [rbx + 0xe0]
mov rcx, qword [rax]
cmp dword [rcx], 0x17
jne 0x14003f3c0
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xe0]
mov byte [rcx + 0x40], al
jmp 0x14003f2f1
lea r8, str.pDump__base.pThis__skl.Kind__NODE_UNION
mov edx, 0x29b
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3
lea r8, str.pDump__base.pThis__skl.Kind___INTERNAL_NODE_END
mov edx, 0x293
lea rcx, str.com_rpcmidl_frontdumpfrnt.cxx
call fcn.1400c7a2c
int3