joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005cd0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor ecx, ecx
call rdi
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov rcx, rax
call rsi
mov edx, 0x8000
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
mov ecx, eax
call rbx
mov ecx, 1
call rdi
mov rcx, rax
call rsi
mov edx, 0x8000
mov ecx, eax
call rbx
mov ecx, 2
call rdi
mov rcx, rax
call rsi
mov edx, 0x8000
mov ecx, eax
call rbx
call qword [0x1400310c0]
mov dword [0x1400310c8], eax
call qword [0x1400310b0]
cmp dword [0x1400310c8], 0xfde9
mov dword [0x1400310b8], eax
je 0x140005d9b
mov ecx, 0xfde9
call qword [0x1400310a8]
lea rax, [sym.restoreConsoleOutputCP__stdZsyncio_u656]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
movdqa xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.addExitProc__stdZexitprocs_u184
mov rcx, qword [0x14002cb80]
call dbg.__emutls_get_address
mov rdx, rax
mov eax, dword [0x1400310b8]
cmp byte [rdx], 0
jne 0x140005dd8
cmp eax, 0xfde9
je 0x140005dd8
mov ecx, 0xfde9
call qword [0x1400310a0]
lea rax, [sym.restoreConsoleCP__stdZsyncio_u657]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
movdqa xmm1, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm1
call sym.addExitProc__stdZexitprocs_u184
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
jmp sym.nimTestErrorFlag

Function at 0x140005f20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, rdx
mov rsi, rdx
call sym.strlen
mov rcx, rsi
mov r9, rbx
mov edx, 1
mov r8, rax
call sym.fwrite
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fflush

Function at 0x140005ff0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
mov ecx, 2
call rsi
lea rdx, str.could_not_load:
mov rcx, rax
call sym.rawWrite
lea rax, [0x14002a455]
mov ecx, 2
add rbx, 8
test rdi, rdi
cmove rbx, rax
call rsi
mov rcx, rax
mov rdx, rbx
call sym.rawWrite
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
je 0x14000606c
mov ecx, 2
call rsi
lea rdx, [0x14002a499]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
mov ecx, 2
call rsi
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call sym.rawWrite
jmp 0x14000604c

Function at 0x140006090
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
lea rdx, [0x14002a499]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop dword [rax]
Function at 0x140006210
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140031120]
test rax, rax
je 0x140006222
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop word [rax + rax]

Function at 0x140006fe0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r10, qword [rdx + 8]
mov r9, rdx
sar rdx, 0x15
mov r8, rcx
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x28a0]
test rax, rax
jne 0x140007010
jmp 0x14000703a
mov rax, qword [rax]
test rax, rax
je 0x14000703a
cmp rdx, qword [rax + 8]
jne 0x140007008
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2870]
mov rdx, qword [r8 + 0x2878]
mov rcx, rax
sub rcx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2870], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x140007085
add rsp, 0x28
ret
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop dword [rax]

Function at 0x140007410
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [rdx + 8]
sub qword [rcx + 0x2888], rax
mov r10, qword [rdx + 8]
mov r8, rcx
mov r9, rdx
cmp r10, 0x3f000000
jg 0x140007440
add rsp, 0x28
jmp sym.freeBigChunk__system_u6620
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x28a0]
test rax, rax
jne 0x1400074b0
nop dword [rax]
mov rax, qword [r8 + 0x2870]
mov rdx, qword [r8 + 0x2878]
mov rcx, rax
sub rcx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2870], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x1400074df
add rsp, 0x28
ret
mov rax, qword [rax]
test rax, rax
je 0x140007458
cmp rdx, qword [rax + 8]
jne 0x1400074a8
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
jmp 0x140007458
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
Function at 0x140007500
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edi, 0x15
mov r12d, 1
mov rbx, rcx
mov rsi, rdx
jmp 0x14000754b
mov rcx, rbx
call sym.freeBigChunk__system_u6620
sub rdi, 1
je 0x140007628
test r13, r13
je 0x140007648
lea rax, [rsi + 0x18]
mov r13, qword [rsi + 0x18]
mov r9, rsi
mov qword [rax], 0
mov rdx, r9
mov rax, qword [r9 + 8]
sub qword [rbx + 0x2888], rax
mov rsi, r13
mov r8, qword [r9 + 8]
cmp r8, 0x3f000000
jle 0x140007530
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rbx + rax*8 + 0x28a0]
test rax, rax
jne 0x1400075a0
jmp 0x1400075c8
mov rax, qword [rax]
test rax, rax
je 0x1400075c8
cmp rdx, qword [rax + 8]
jne 0x140007598
mov rcx, r9
mov rdx, r12
sar rcx, 0xc
and ecx, 0x1ff
mov r10, rcx
shl rdx, cl
sar r10, 6
not rdx
and qword [rax + r10*8 + 0x10], rdx
mov rax, qword [rbx + 0x2870]
mov rdx, qword [rbx + 0x2878]
mov rcx, rax
sub rcx, r8
cmp rax, rdx
mov r8d, 0x8000
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rbx + 0x2870], xmm0
call rbp
test eax, eax
jne 0x140007538
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop dword [rax + rax]
test r13, r13
je 0x140007648
lea rdx, [rbx + 0x2898]
lea rcx, [r13 + 0x18]
mov rax, qword [rdx]
mov qword [rcx], rax
mov rax, qword [rcx]
lock cmpxchg qword [rdx], r13
jne 0x140007655
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rcx], rax
jmp 0x140007638
Function at 0x140008520
Capabilities:
Terminate process

Disassembly:
mov r8, rdx
and rdx, 0xfffffffffffff000
mov rax, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
cmp rax, 0xfc0
jle 0x140008560
lea r8, [r10 + 0x2898]
cmp rcx, r10
lea r9, [rdx + 0x18]
je 0x1400085e0
mov rax, qword [r8]
mov qword [r9], rax
mov rax, qword [r9]
lock cmpxchg qword [r8], rdx
jne 0x1400085d0
ret
lea r9, [rax + 0xf]
test rax, rax
cmovns r9, rax
sar r9, 4
cmp rcx, r10
je 0x1400085a0
lea rcx, [r9*8 + 0x800]
mov rax, qword [r10 + rcx]
mov qword [r8], rax
mov r9, qword [rdx + 0x10]
mov rax, qword [r8]
lock cmpxchg qword [r9 + rcx], r8
je 0x14000855e
mov qword [r8], rax
mov r10, qword [rdx + 0x10]
jmp 0x14000857c
sub qword [rcx + 0x2888], rax
lea r9, [rcx + r9*8]
mov rcx, qword [r9]
test rcx, rcx
je 0x1400085e8
cmp rcx, rdx
je 0x1400085e8
mov rdx, qword [rcx + 0x28]
mov qword [r8], rdx
add dword [rcx + 0x30], eax
mov qword [rcx + 0x28], r8
add qword [rcx + 0x38], 1
ret
mov qword [r9], rax
jmp 0x14000854e
jmp sym.deallocBigChunk__system_u6690
mov rcx, qword [rdx + 0x28]
mov qword [r8], rcx
mov qword [rdx + 0x28], r8
movsxd r8, dword [rdx + 0x30]
cmp r8, rax
mov rcx, r8
jl 0x140008658
add ecx, eax
cmp ecx, 0xfc0
mov dword [rdx + 0x30], ecx
jne 0x14000855e
cmp qword [rdx + 0x38], 0
jne 0x14000855e
cmp rdx, qword [r9]
mov rax, qword [rdx + 0x18]
je 0x140008670
mov rcx, qword [rdx + 0x20]
test rax, rax
mov qword [rcx + 0x18], rax
je 0x140008639
mov rcx, qword [rdx + 0x20]
mov qword [rax + 0x20], rcx
mov rcx, r10
pxor xmm0, xmm0
mov qword [rdx + 8], 0x1000
movups xmmword [rdx + 0x18], xmm0
jmp sym.freeBigChunk__system_u6620
mov rcx, qword [r9]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x140008668
mov qword [rcx + 0x20], rdx
mov qword [r9], rdx
add dword [rdx + 0x30], eax
ret
test rax, rax
mov qword [r9], rax
je 0x140008639
mov qword [rax + 0x20], 0
jmp 0x140008639
Function at 0x140008690
Capabilities:
Terminate process

Disassembly:
mov r8, rdx
and rdx, 0xfffffffffffff000
mov rax, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
cmp rax, 0xfc0
jle 0x1400086d0
lea r8, [r10 + 0x2898]
cmp rcx, r10
lea r9, [rdx + 0x18]
je 0x140008750
mov rax, qword [r8]
mov qword [r9], rax
mov rax, qword [r9]
lock cmpxchg qword [r8], rdx
jne 0x140008740
ret
lea r9, [rax + 0xf]
test rax, rax
cmovns r9, rax
sar r9, 4
cmp rcx, r10
je 0x140008710
lea rcx, [r9*8 + 0x800]
mov rax, qword [r10 + rcx]
mov qword [r8], rax
mov r9, qword [rdx + 0x10]
mov rax, qword [r8]
lock cmpxchg qword [r9 + rcx], r8
je 0x1400086ce
mov qword [r8], rax
mov r10, qword [rdx + 0x10]
jmp 0x1400086ec
sub qword [rcx + 0x2888], rax
lea r9, [rcx + r9*8]
mov rcx, qword [r9]
test rcx, rcx
je 0x140008758
cmp rdx, rcx
je 0x140008758
mov rdx, qword [rcx + 0x28]
mov qword [r8], rdx
add dword [rcx + 0x30], eax
mov qword [rcx + 0x28], r8
add qword [rcx + 0x38], 1
ret
mov qword [r9], rax
jmp 0x1400086be
jmp sym.deallocBigChunk__system_u6690
mov rcx, qword [rdx + 0x28]
mov qword [r8], rcx
mov qword [rdx + 0x28], r8
movsxd r8, dword [rdx + 0x30]
cmp rax, r8
mov rcx, r8
jg 0x1400087c8
add ecx, eax
cmp ecx, 0xfc0
mov dword [rdx + 0x30], ecx
jne 0x1400086ce
cmp qword [rdx + 0x38], 0
jne 0x1400086ce
cmp rdx, qword [r9]
mov rax, qword [rdx + 0x18]
je 0x1400087e0
mov rcx, qword [rdx + 0x20]
test rax, rax
mov qword [rcx + 0x18], rax
je 0x1400087a9
mov rcx, qword [rdx + 0x20]
mov qword [rax + 0x20], rcx
mov rcx, r10
pxor xmm0, xmm0
mov qword [rdx + 8], 0x1000
movups xmmword [rdx + 0x18], xmm0
jmp sym.freeBigChunk__system_u6620
mov rcx, qword [r9]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x1400087d8
mov qword [rcx + 0x20], rdx
mov qword [r9], rdx
add dword [rdx + 0x30], eax
ret
test rax, rax
mov qword [r9], rax
je 0x1400087a9
mov qword [rax + 0x20], 0
jmp 0x1400087a9
Function at 0x1400089d0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x140029380]
call dbg.__emutls_get_address
mov rdx, rbx
and rdx, 0xfffffffffffff000
mov rcx, rax
mov rax, qword [rdx + 8]
mov r9, qword [rdx + 0x10]
cmp rax, 0xfc0
jle 0x140008a30
lea r8, [r9 + 0x2898]
cmp rcx, r9
lea r10, [rdx + 0x18]
je 0x140008ab0
mov rax, qword [r8]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [r8], rdx
jne 0x140008aa8
add rsp, 0x20
pop rbx
ret
lea r8, [rax + 0xf]
test rax, rax
cmovns r8, rax
sar r8, 4
cmp rcx, r9
je 0x140008a70
lea rcx, [r8*8 + 0x800]
mov rax, qword [r9 + rcx]
mov qword [rbx], rax
mov r8, qword [rdx + 0x10]
mov rax, qword [rbx]
lock cmpxchg qword [r8 + rcx], rbx
je 0x140008a29
mov qword [rbx], rax
mov r9, qword [rdx + 0x10]
jmp 0x140008a4c
sub qword [rcx + 0x2888], rax
lea r8, [rcx + r8*8]
mov rcx, qword [r8]
test rcx, rcx
je 0x140008ac0
cmp rdx, rcx
je 0x140008ac0
mov rdx, qword [rcx + 0x28]
mov qword [rbx], rdx
add dword [rcx + 0x30], eax
mov qword [rcx + 0x28], rbx
add qword [rcx + 0x38], 1
add rsp, 0x20
pop rbx
ret
mov qword [r10], rax
jmp 0x140008a15
add rsp, 0x20
pop rbx
jmp sym.deallocBigChunk__system_u6690
mov rcx, qword [rdx + 0x28]
mov qword [rbx], rcx
movsxd r10, dword [rdx + 0x30]
mov qword [rdx + 0x28], rbx
cmp rax, r10
mov rcx, r10
jg 0x140008b30
add ecx, eax
cmp ecx, 0xfc0
mov dword [rdx + 0x30], ecx
jne 0x140008a29
cmp qword [rdx + 0x38], 0
jne 0x140008a29
cmp rdx, qword [r8]
mov rax, qword [rdx + 0x18]
je 0x140008b50
mov rcx, qword [rdx + 0x20]
test rax, rax
mov qword [rcx + 0x18], rax
je 0x140008b11
mov rcx, qword [rdx + 0x20]
mov qword [rax + 0x20], rcx
mov rcx, r9
pxor xmm0, xmm0
mov qword [rdx + 8], 0x1000
movups xmmword [rdx + 0x18], xmm0
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6620
mov rcx, qword [r8]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x140008b40
mov qword [rcx + 0x20], rdx
mov qword [r8], rdx
add dword [rdx + 0x30], eax
jmp 0x140008a29
test rax, rax
mov qword [r8], rax
je 0x140008b11
mov qword [rax + 0x20], 0
jmp 0x140008b11
Function at 0x140008b70
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x140029380]
call dbg.__emutls_get_address
mov rdx, rbx
and rdx, 0xfffffffffffff000
mov rcx, rax
mov rax, qword [rdx + 8]
mov r9, qword [rdx + 0x10]
cmp rax, 0xfc0
jle 0x140008bd0
lea r8, [r9 + 0x2898]
cmp rcx, r9
lea r10, [rdx + 0x18]
je 0x140008c50
mov rax, qword [r8]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [r8], rdx
jne 0x140008c48
add rsp, 0x20
pop rbx
ret
lea r8, [rax + 0xf]
test rax, rax
cmovns r8, rax
sar r8, 4
cmp rcx, r9
je 0x140008c10
lea rcx, [r8*8 + 0x800]
mov rax, qword [r9 + rcx]
mov qword [rbx], rax
mov r8, qword [rdx + 0x10]
mov rax, qword [rbx]
lock cmpxchg qword [r8 + rcx], rbx
je 0x140008bc9
mov qword [rbx], rax
mov r9, qword [rdx + 0x10]
jmp 0x140008bec
sub qword [rcx + 0x2888], rax
lea r8, [rcx + r8*8]
mov rcx, qword [r8]
test rcx, rcx
je 0x140008c60
cmp rdx, rcx
je 0x140008c60
mov rdx, qword [rcx + 0x28]
mov qword [rbx], rdx
add dword [rcx + 0x30], eax
mov qword [rcx + 0x28], rbx
add qword [rcx + 0x38], 1
add rsp, 0x20
pop rbx
ret
mov qword [r10], rax
jmp 0x140008bb5
add rsp, 0x20
pop rbx
jmp sym.deallocBigChunk__system_u6690
mov rcx, qword [rdx + 0x28]
mov qword [rbx], rcx
movsxd r10, dword [rdx + 0x30]
mov qword [rdx + 0x28], rbx
cmp rax, r10
mov rcx, r10
jg 0x140008cd0
add ecx, eax
cmp ecx, 0xfc0
mov dword [rdx + 0x30], ecx
jne 0x140008bc9
cmp qword [rdx + 0x38], 0
jne 0x140008bc9
cmp rdx, qword [r8]
mov rax, qword [rdx + 0x18]
je 0x140008cf0
mov rcx, qword [rdx + 0x20]
test rax, rax
mov qword [rcx + 0x18], rax
je 0x140008cb1
mov rcx, qword [rdx + 0x20]
mov qword [rax + 0x20], rcx
mov rcx, r9
pxor xmm0, xmm0
mov qword [rdx + 8], 0x1000
movups xmmword [rdx + 0x18], xmm0
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6620
mov rcx, qword [r8]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x140008ce0
mov qword [rcx + 0x20], rdx
mov qword [r8], rdx
add dword [rdx + 0x30], eax
jmp 0x140008bc9
test rax, rax
mov qword [r8], rax
je 0x140008cb1
mov qword [rax + 0x20], 0
jmp 0x140008cb1
Function at 0x140008d10
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x140029380]
call dbg.__emutls_get_address
mov rdx, rbx
and rdx, 0xfffffffffffff000
mov rcx, rax
mov rax, qword [rdx + 8]
mov r9, qword [rdx + 0x10]
cmp rax, 0xfc0
jle 0x140008d70
lea r8, [r9 + 0x2898]
cmp rcx, r9
lea r10, [rdx + 0x18]
je 0x140008df0
mov rax, qword [r8]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [r8], rdx
jne 0x140008de8
add rsp, 0x20
pop rbx
ret
lea r8, [rax + 0xf]
test rax, rax
cmovns r8, rax
sar r8, 4
cmp rcx, r9
je 0x140008db0
lea rcx, [r8*8 + 0x800]
mov rax, qword [r9 + rcx]
mov qword [rbx], rax
mov r8, qword [rdx + 0x10]
mov rax, qword [rbx]
lock cmpxchg qword [r8 + rcx], rbx
je 0x140008d69
mov qword [rbx], rax
mov r9, qword [rdx + 0x10]
jmp 0x140008d8c
sub qword [rcx + 0x2888], rax
lea r8, [rcx + r8*8]
mov rcx, qword [r8]
test rcx, rcx
je 0x140008e00
cmp rdx, rcx
je 0x140008e00
mov rdx, qword [rcx + 0x28]
mov qword [rbx], rdx
add dword [rcx + 0x30], eax
mov qword [rcx + 0x28], rbx
add qword [rcx + 0x38], 1
add rsp, 0x20
pop rbx
ret
mov qword [r10], rax
jmp 0x140008d55
add rsp, 0x20
pop rbx
jmp sym.deallocBigChunk__system_u6690
mov rcx, qword [rdx + 0x28]
mov qword [rbx], rcx
movsxd r10, dword [rdx + 0x30]
mov qword [rdx + 0x28], rbx
cmp rax, r10
mov rcx, r10
jg 0x140008e70
add ecx, eax
cmp ecx, 0xfc0
mov dword [rdx + 0x30], ecx
jne 0x140008d69
cmp qword [rdx + 0x38], 0
jne 0x140008d69
cmp rdx, qword [r8]
mov rax, qword [rdx + 0x18]
je 0x140008e90
mov rcx, qword [rdx + 0x20]
test rax, rax
mov qword [rcx + 0x18], rax
je 0x140008e51
mov rcx, qword [rdx + 0x20]
mov qword [rax + 0x20], rcx
mov rcx, r9
pxor xmm0, xmm0
mov qword [rdx + 8], 0x1000
movups xmmword [rdx + 0x18], xmm0
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6620
mov rcx, qword [r8]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x140008e80
mov qword [rcx + 0x20], rdx
mov qword [r8], rdx
add dword [rdx + 0x30], eax
jmp 0x140008d69
test rax, rax
mov qword [r8], rax
je 0x140008e51
mov qword [rax + 0x20], 0
jmp 0x140008e51

Function at 0x140008eb0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbx, rcx
lea rcx, [0x140029380]
call dbg.__emutls_get_address
cmp rsi, 0x10
mov rcx, rax
jle 0x140008ed8
movzx eax, word [rbx - 2]
sub rbx, rax
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.rawDealloc__system_u7009

Function at 0x140009270
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x140009284
test byte [rbx + 7], 0x40
je 0x140009290
add rsp, 0x20
pop rbx
ret
lea rcx, [0x140029380]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u7009
Function at 0x140009930
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rdx, rdx
mov rbx, rcx
mov rsi, rdx
jne 0x140009970
lea rdi, [0x140029380]
sub rbx, 0x10
mov rcx, rdi
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.rawDealloc__system_u7009
mov rax, rdx
sub rax, 1
jo 0x1400099bc
mov rdx, rax
add rdx, 0x10
jo 0x1400099bc
not rax
and rax, rdx
mov rdi, rax
sub rbx, rdi
lea rdi, [0x140029380]
mov rcx, rdi
call dbg.__emutls_get_address
cmp rsi, 0x10
mov rcx, rax
jle 0x14000994d
movzx eax, word [rbx - 2]
sub rbx, rax
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.rawDealloc__system_u7009
call sym.raiseOverflow
jmp 0x14000998b

Function at 0x1400099d0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, qword [rax]
mov rbx, rcx
test rdx, rdx
je 0x1400099fa
call rdx
lea rcx, [0x140029360]
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140009a48
mov rax, qword [rbx]
movsx rsi, word [rax + 0x10]
lea rcx, [0x140029380]
call dbg.__emutls_get_address
lea rdx, [rbx - 0x10]
mov rcx, rax
test rsi, rsi
je 0x140009a37
lea rdx, [rsi + 0xf]
mov rax, rsi
neg rax
and rax, rdx
sub rbx, rax
cmp rsi, 0x10
jle 0x140009a34
movzx eax, word [rbx - 2]
sub rbx, rax
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.rawDealloc__system_u7009
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x140009fd0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
imul rdx, qword [rcx + 8], 3
mov rsi, rcx
jo 0x14000a07b
mov rax, rdx
shr rax, 0x3f
add rax, rdx
sar rax, 1
imul rbx, rax, 0x10
mov qword [rcx + 8], rax
jo 0x14000a07b
test rbx, rbx
js 0x14000a0a8
mov r12, qword [rcx + 0x10]
lea rcx, [0x140029380]
call dbg.__emutls_get_address
test rbx, rbx
mov rdi, rax
je 0x14000a090
mov rdx, rbx
mov rcx, rax
call sym.rawAlloc__system_u6833
test r12, r12
mov rbp, rax
je 0x14000a06c
mov rax, r12
mov rdx, r12
mov rcx, rbp
and rax, 0xfffffffffffff000
mov r8, qword [rax + 8]
lea rax, [r8 - 0x30]
cmp r8, 0xfc0
cmovg r8, rax
cmp rbx, r8
cmovle r8, rbx
call sym.memcpy
mov rdx, r12
mov rcx, rdi
call sym.rawDealloc__system_u7009
mov qword [rsi + 0x10], rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseOverflow
test r12, r12
je 0x14000a0a0
mov rdx, r12
mov rcx, rax
call sym.rawDealloc__system_u7009
xor ebp, ebp
jmp 0x14000a06c
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseRangeErrorI

Function at 0x14000a0d0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
imul rdx, qword [rcx + 8], 3
mov rsi, rcx
jo 0x14000a17b
mov rax, rdx
shr rax, 0x3f
add rax, rdx
sar rax, 1
imul rbx, rax, 0x10
mov qword [rcx + 8], rax
jo 0x14000a17b
test rbx, rbx
js 0x14000a1a8
mov r12, qword [rcx + 0x10]
lea rcx, [0x140029380]
call dbg.__emutls_get_address
test rbx, rbx
mov rdi, rax
je 0x14000a190
mov rdx, rbx
mov rcx, rax
call sym.rawAlloc__system_u6833
test r12, r12
mov rbp, rax
je 0x14000a16c
mov rax, r12
mov rdx, r12
mov rcx, rbp
and rax, 0xfffffffffffff000
mov r8, qword [rax + 8]
lea rax, [r8 - 0x30]
cmp r8, 0xfc0
cmovg r8, rax
cmp rbx, r8
cmovle r8, rbx
call sym.memcpy
mov rdx, r12
mov rcx, rdi
call sym.rawDealloc__system_u7009
mov qword [rsi + 0x10], rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseOverflow
test r12, r12
je 0x14000a1a0
mov rdx, r12
mov rcx, rax
call sym.rawDealloc__system_u7009
xor ebp, ebp
jmp 0x14000a16c
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseRangeErrorI
Function at 0x14000a370
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rdx
add rbx, qword [rcx]
mov rsi, rcx
jo 0x14000a449
mov rbp, qword [rcx + 8]
test rbp, rbp
je 0x14000a3a5
mov rax, qword [rbp]
bt rax, 0x3e
jae 0x14000a430
mov rax, rbx
add rax, 1
jo 0x14000a449
add rax, 8
mov rdi, rax
jo 0x14000a449
test rax, rax
js 0x14000a548
lea rcx, [0x140029380]
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
call sym.rawAlloc__system_u6833
mov qword [rsi + 8], rax
mov qword [rax], rbx
mov rcx, qword [rsi]
test rcx, rcx
jle 0x14000a570
cmp rbx, rcx
cmovle rcx, rbx
test rcx, rcx
js 0x14000a590
mov rax, qword [rsi + 8]
lea rdx, [rbp + 8]
mov r8, rcx
add rax, 8
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.memcpy
btr rax, 0x3e
cmp rbx, rax
jg 0x14000a460
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.raiseOverflow
test rax, rax
mov edi, 4
jle 0x14000a47a
cmp rax, 0x7fff
jg 0x14000a5a0
lea rdi, [rax + rax]
cmp rbx, rdi
cmovge rdi, rbx
mov rax, rdi
add rax, 1
jo 0x14000a449
add rax, 8
mov rbp, rax
jo 0x14000a449
test rax, rax
js 0x14000a5c0
lea rcx, [0x140029380]
mov r14, qword [rsi + 8]
call dbg.__emutls_get_address
test rbp, rbp
mov r12, rax
je sym.prepareAdd.cold
mov rdx, rbp
mov rcx, rax
call sym.rawAlloc__system_u6833
test r14, r14
mov r13, rax
je 0x14000a504
mov rax, r14
mov rdx, r14
mov rcx, r13
and rax, 0xfffffffffffff000
mov r8, qword [rax + 8]
lea rax, [r8 - 0x30]
cmp r8, 0xfc0
cmovg r8, rax
cmp rbp, r8
cmovle r8, rbp
call sym.memcpy
mov rdx, r14
mov rcx, r12
call sym.rawDealloc__system_u7009
cmp rbx, rdi
mov qword [rsi + 8], r13
mov qword [r13], rdi
jge 0x14000a43a
sub rdi, rbx
jo 0x14000a449
test rdi, rdi
js 0x14000a548
mov rax, qword [rsi + 8]
mov r8, rdi
xor edx, edx
lea rcx, [rax + rbx + 9]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.memset
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.raiseRangeErrorI
test rbp, rbp
jne 0x14000a43a
mov rax, qword [rsi + 8]
mov byte [rax + 8], 0
jmp 0x14000a43a
movabs r8, 0x7fffffffffffffff
xor edx, edx
jmp 0x14000a557
imul rax, rax, 3
jo 0x14000a5d1
mov rdi, rax
shr rdi, 0x3f
add rdi, rax
sar rdi, 1
jmp 0x14000a47a
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rax
jmp 0x14000a557
call sym.raiseOverflow
jmp 0x14000a47a