joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400094a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov r9, rbx
and r9, 0xfffffffffffff000
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
cmp rdx, 0xfb0
jle 0x140009500
lea rcx, [r8 + 0x2098]
cmp rax, r8
lea r10, [r9 + 0x18]
je 0x140009580
mov rax, qword [rcx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rcx], r9
jne 0x140009570
add rsp, 0x20
pop rbx
ret
cmp rax, r8
je 0x140009520
lea rdx, [r9 + 0x40]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rbx]
lock cmpxchg qword [rdx], rbx
je 0x1400094f3
mov qword [rbx], rax
jmp 0x140009509
sub qword [r8 + 0x2088], rdx
mov rax, qword [r9 + 0x28]
mov qword [rbx], rax
mov rax, qword [r9 + 0x30]
mov qword [r9 + 0x28], rbx
cmp rdx, rax
jle 0x1400095a8
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
sar rax, 4
mov rcx, qword [r8 + rax*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x14000955b
mov qword [rcx + 0x20], r9
mov qword [r8 + rax*8], r9
add qword [r9 + 0x30], rdx
add rsp, 0x20
pop rbx
ret
mov qword [r10], rax
jmp 0x1400094e3
sub qword [rax + 0x2088], rdx
mov rdx, r9
mov r10, qword [r9 + 8]
cmp r10, 0x3f000000
jg 0x140009610
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
add rax, rdx
cmp rax, 0xfb0
mov qword [r9 + 0x30], rax
jne 0x1400094f3
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
mov rdx, qword [r9 + 0x18]
sar rax, 4
cmp r9, qword [r8 + rax*8]
je 0x1400096c8
mov rax, qword [r9 + 0x20]
test rdx, rdx
mov qword [rax + 0x18], rdx
je 0x1400095ed
mov rax, qword [r9 + 0x20]
mov qword [rdx + 0x20], rax
mov rdx, r9
mov rcx, r8
pxor xmm0, xmm0
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
sar rdx, 0x15
movzx eax, dl
mov rax, qword [r8 + rax*8 + 0x20a0]
test rax, rax
jne 0x140009638
jmp 0x140009662
mov rax, qword [rax]
test rax, rax
je 0x140009662
cmp rdx, qword [rax + 8]
jne 0x140009630
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rcx, r9
mov rdx, qword [r8 + 0x2078]
mov rbx, rax
sub rbx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rbx
xor edx, edx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x1400094f3
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop word [rax + rax]
test rdx, rdx
mov qword [r8 + rax*8], rdx
je 0x1400095ed
mov qword [rdx + 0x20], 0
jmp 0x1400095ed

Function at 0x1400096f0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbx, rcx
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
cmp rsi, 0x10
mov rcx, rax
jle 0x140009718
movzx eax, word [rbx - 2]
sub rbx, rax
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.rawDealloc__system_u6959
Function at 0x140009730
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [rcx + 0x10]
test rsi, rsi
mov rbx, rcx
je 0x140009799
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov r9, rsi
and r9, 0xfffffffffffff000
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
cmp rdx, 0xfb0
jle 0x1400097b0
lea rcx, [r8 + 0x2098]
cmp rax, r8
lea r10, [r9 + 0x18]
je 0x140009860
mov rax, qword [rcx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rcx], r9
jne 0x140009858
mov qword [rbx + 0x10], 0
pxor xmm0, xmm0
movups xmmword [rbx], xmm0
add rsp, 0x28
pop rbx
pop rsi
ret
cmp rax, r8
je 0x1400097d0
lea rdx, [r9 + 0x40]
mov rax, qword [rdx]
mov qword [rsi], rax
mov rax, qword [rsi]
lock cmpxchg qword [rdx], rsi
je 0x140009791
mov qword [rsi], rax
jmp 0x1400097b9
sub qword [r8 + 0x2088], rdx
mov rax, qword [r9 + 0x28]
mov qword [rsi], rax
mov rax, qword [r9 + 0x30]
mov qword [r9 + 0x28], rsi
cmp rdx, rax
jg 0x140009888
add rax, rdx
cmp rax, 0xfb0
mov qword [r9 + 0x30], rax
jne 0x140009791
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
mov rdx, qword [r9 + 0x18]
sar rax, 4
cmp r9, qword [r8 + rax*8]
je 0x140009970
mov rax, qword [r9 + 0x20]
test rdx, rdx
mov qword [rax + 0x18], rdx
je 0x140009830
mov rax, qword [r9 + 0x20]
mov qword [rdx + 0x20], rax
pxor xmm0, xmm0
mov rdx, r9
movups xmmword [r9 + 0x18], xmm0
mov rcx, r8
mov qword [r9 + 8], 0x1000
call sym.freeBigChunk__system_u6571
jmp 0x140009791
mov qword [r10], rax
jmp 0x14000977d
sub qword [rax + 0x2088], rdx
mov rdx, r9
mov r10, qword [r9 + 8]
cmp r10, 0x3f000000
jg 0x1400098b8
mov rcx, rax
call sym.freeBigChunk__system_u6571
jmp 0x140009791
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
sar rax, 4
mov rcx, qword [r8 + rax*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x1400098a8
mov qword [rcx + 0x20], r9
mov qword [r8 + rax*8], r9
add qword [r9 + 0x30], rdx
jmp 0x140009791
sar rdx, 0x15
movzx eax, dl
mov rax, qword [r8 + rax*8 + 0x20a0]
test rax, rax
jne 0x140009938
nop dword [rax]
mov rax, qword [r8 + 0x2070]
mov rcx, r9
mov rdx, qword [r8 + 0x2078]
mov rsi, rax
sub rsi, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rsi
xor edx, edx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140009791
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
mov rax, qword [rax]
test rax, rax
je 0x1400098d0
cmp rdx, qword [rax + 8]
jne 0x140009930
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
jmp 0x1400098d0
test rdx, rdx
mov qword [r8 + rax*8], rdx
je 0x140009830
mov qword [rdx + 0x20], 0
jmp 0x140009830
Function at 0x140009990
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [rcx + 0x10]
test rsi, rsi
mov rbx, rcx
je 0x1400099f9
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov r9, rsi
and r9, 0xfffffffffffff000
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
cmp rdx, 0xfb0
jle 0x140009a10
lea rcx, [r8 + 0x2098]
cmp rax, r8
lea r10, [r9 + 0x18]
je 0x140009ac0
mov rax, qword [rcx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rcx], r9
jne 0x140009ab8
mov qword [rbx + 0x10], 0
pxor xmm0, xmm0
movups xmmword [rbx], xmm0
add rsp, 0x28
pop rbx
pop rsi
ret
cmp rax, r8
je 0x140009a30
lea rdx, [r9 + 0x40]
mov rax, qword [rdx]
mov qword [rsi], rax
mov rax, qword [rsi]
lock cmpxchg qword [rdx], rsi
je 0x1400099f1
mov qword [rsi], rax
jmp 0x140009a19
sub qword [r8 + 0x2088], rdx
mov rax, qword [r9 + 0x28]
mov qword [rsi], rax
mov rax, qword [r9 + 0x30]
mov qword [r9 + 0x28], rsi
cmp rdx, rax
jg 0x140009ae8
add rax, rdx
cmp rax, 0xfb0
mov qword [r9 + 0x30], rax
jne 0x1400099f1
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
mov rdx, qword [r9 + 0x18]
sar rax, 4
cmp r9, qword [r8 + rax*8]
je 0x140009bd0
mov rax, qword [r9 + 0x20]
test rdx, rdx
mov qword [rax + 0x18], rdx
je 0x140009a90
mov rax, qword [r9 + 0x20]
mov qword [rdx + 0x20], rax
pxor xmm0, xmm0
mov rdx, r9
movups xmmword [r9 + 0x18], xmm0
mov rcx, r8
mov qword [r9 + 8], 0x1000
call sym.freeBigChunk__system_u6571
jmp 0x1400099f1
mov qword [r10], rax
jmp 0x1400099dd
sub qword [rax + 0x2088], rdx
mov rdx, r9
mov r10, qword [r9 + 8]
cmp r10, 0x3f000000
jg 0x140009b18
mov rcx, rax
call sym.freeBigChunk__system_u6571
jmp 0x1400099f1
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
sar rax, 4
mov rcx, qword [r8 + rax*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x140009b08
mov qword [rcx + 0x20], r9
mov qword [r8 + rax*8], r9
add qword [r9 + 0x30], rdx
jmp 0x1400099f1
sar rdx, 0x15
movzx eax, dl
mov rax, qword [r8 + rax*8 + 0x20a0]
test rax, rax
jne 0x140009b98
nop dword [rax]
mov rax, qword [r8 + 0x2070]
mov rcx, r9
mov rdx, qword [r8 + 0x2078]
mov rsi, rax
sub rsi, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rsi
xor edx, edx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x1400099f1
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
mov rax, qword [rax]
test rax, rax
je 0x140009b30
cmp rdx, qword [rax + 8]
jne 0x140009b90
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
jmp 0x140009b30
test rdx, rdx
mov qword [r8 + rax*8], rdx
je 0x140009a90
mov qword [rdx + 0x20], 0
jmp 0x140009a90

Function at 0x140009bf0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x140009c04
test byte [rbx + 7], 0x40
je 0x140009c10
add rsp, 0x20
pop rbx
ret
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6959
Function at 0x14000a2b0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rdx, rdx
mov rbx, rcx
mov rsi, rdx
jne 0x14000a2f0
lea rdi, [0x14002e380]
sub rbx, 0x10
mov rcx, rdi
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.rawDealloc__system_u6959
mov rax, rdx
sub rax, 1
jo 0x14000a33c
mov rdx, rax
add rdx, 0x10
jo 0x14000a33c
not rax
and rax, rdx
mov rdi, rax
sub rbx, rdi
lea rdi, [0x14002e380]
mov rcx, rdi
call dbg.__emutls_get_address
cmp rsi, 0x10
mov rcx, rax
jle 0x14000a2cd
movzx eax, word [rbx - 2]
sub rbx, rax
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.rawDealloc__system_u6959
call sym.raiseOverflow
jmp 0x14000a30b

Function at 0x14000a350
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
mov rdx, qword [rax]
mov rbx, rcx
test rdx, rdx
je 0x14000a37a
call rdx
lea rcx, [0x14002e360]
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x14000a3c8
mov rax, qword [rbx]
movsx rsi, word [rax + 0x10]
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
lea rdx, [rbx - 0x10]
mov rcx, rax
test rsi, rsi
je 0x14000a3b7
lea rdx, [rsi + 0xf]
mov rax, rsi
neg rax
and rax, rdx
sub rbx, rax
cmp rsi, 0x10
jle 0x14000a3b4
movzx eax, word [rbx - 2]
sub rbx, rax
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.rawDealloc__system_u6959
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14000aa10
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
imul rdx, qword [rcx + 8], 3
mov rsi, rcx
jo 0x14000aabb
mov rax, rdx
shr rax, 0x3f
add rax, rdx
sar rax, 1
imul rbx, rax, 0x10
mov qword [rcx + 8], rax
jo 0x14000aabb
test rbx, rbx
js 0x14000aae8
mov r12, qword [rcx + 0x10]
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
test rbx, rbx
mov rdi, rax
je 0x14000aad0
mov rdx, rbx
mov rcx, rax
call sym.rawAlloc__system_u6807
test r12, r12
mov rbp, rax
je 0x14000aaac
mov rax, r12
mov rdx, r12
mov rcx, rbp
and rax, 0xfffffffffffff000
mov r8, qword [rax + 8]
lea rax, [r8 - 0x30]
cmp r8, 0xfb0
cmovg r8, rax
cmp rbx, r8
cmovle r8, rbx
call sym.memcpy
mov rdx, r12
mov rcx, rdi
call sym.rawDealloc__system_u6959
mov qword [rsi + 0x10], rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseOverflow
test r12, r12
je 0x14000aae0
mov rdx, r12
mov rcx, rax
call sym.rawDealloc__system_u6959
xor ebp, ebp
jmp 0x14000aaac
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseRangeErrorI

Function at 0x14000ab10
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
imul rdx, qword [rcx + 8], 3
mov rsi, rcx
jo 0x14000abbb
mov rax, rdx
shr rax, 0x3f
add rax, rdx
sar rax, 1
imul rbx, rax, 0x10
mov qword [rcx + 8], rax
jo 0x14000abbb
test rbx, rbx
js 0x14000abe8
mov r12, qword [rcx + 0x10]
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
test rbx, rbx
mov rdi, rax
je 0x14000abd0
mov rdx, rbx
mov rcx, rax
call sym.rawAlloc__system_u6807
test r12, r12
mov rbp, rax
je 0x14000abac
mov rax, r12
mov rdx, r12
mov rcx, rbp
and rax, 0xfffffffffffff000
mov r8, qword [rax + 8]
lea rax, [r8 - 0x30]
cmp r8, 0xfb0
cmovg r8, rax
cmp rbx, r8
cmovle r8, rbx
call sym.memcpy
mov rdx, r12
mov rcx, rdi
call sym.rawDealloc__system_u6959
mov qword [rsi + 0x10], rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseOverflow
test r12, r12
je 0x14000abe0
mov rdx, r12
mov rcx, rax
call sym.rawDealloc__system_u6959
xor ebp, ebp
jmp 0x14000abac
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseRangeErrorI
Function at 0x14000b0e0
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rdx
add rbx, qword [rcx]
mov rsi, rcx
jo 0x14000b1b9
mov rbp, qword [rcx + 8]
test rbp, rbp
je 0x14000b115
mov rax, qword [rbp]
bt rax, 0x3e
jae 0x14000b1a0
mov rax, rbx
add rax, 1
jo 0x14000b1b9
add rax, 8
mov rdi, rax
jo 0x14000b1b9
test rax, rax
js 0x14000b2b8
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov rdx, rdi
mov rcx, rax
call sym.rawAlloc__system_u6807
mov qword [rsi + 8], rax
mov qword [rax], rbx
mov rcx, qword [rsi]
test rcx, rcx
jle 0x14000b2e0
cmp rbx, rcx
cmovle rcx, rbx
test rcx, rcx
js 0x14000b300
mov rax, qword [rsi + 8]
lea rdx, [rbp + 8]
mov r8, rcx
add rax, 8
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.memcpy
btr rax, 0x3e
cmp rbx, rax
jg 0x14000b1d0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.raiseOverflow
test rax, rax
mov edi, 4
jle 0x14000b1ea
cmp rax, 0x7fff
jg 0x14000b310
lea rdi, [rax + rax]
cmp rbx, rdi
cmovge rdi, rbx
mov rax, rdi
add rax, 1
jo 0x14000b1b9
add rax, 8
mov rbp, rax
jo 0x14000b1b9
test rax, rax
js 0x14000b330
lea rcx, [0x14002e380]
mov r14, qword [rsi + 8]
call dbg.__emutls_get_address
test rbp, rbp
mov r12, rax
je sym.prepareAdd.cold
mov rdx, rbp
mov rcx, rax
call sym.rawAlloc__system_u6807
test r14, r14
mov r13, rax
je 0x14000b274
mov rax, r14
mov rdx, r14
mov rcx, r13
and rax, 0xfffffffffffff000
mov r8, qword [rax + 8]
lea rax, [r8 - 0x30]
cmp r8, 0xfb0
cmovg r8, rax
cmp rbp, r8
cmovle r8, rbp
call sym.memcpy
mov rdx, r14
mov rcx, r12
call sym.rawDealloc__system_u6959
cmp rbx, rdi
mov qword [rsi + 8], r13
mov qword [r13], rdi
jge 0x14000b1aa
sub rdi, rbx
jo 0x14000b1b9
test rdi, rdi
js 0x14000b2b8
mov rax, qword [rsi + 8]
mov r8, rdi
xor edx, edx
lea rcx, [rax + rbx + 9]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.memset
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.raiseRangeErrorI
test rbp, rbp
jne 0x14000b1aa
mov rax, qword [rsi + 8]
mov byte [rax + 8], 0
jmp 0x14000b1aa
movabs r8, 0x7fffffffffffffff
xor edx, edx
jmp 0x14000b2c7
imul rax, rax, 3
jo 0x14000b341
mov rdi, rax
shr rdi, 0x3f
add rdi, rax
sar rdi, 1
jmp 0x14000b1ea
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rax
jmp 0x14000b2c7
call sym.raiseOverflow
jmp 0x14000b1ea
Function at 0x14000b3e0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x14000b4d5
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x14000b410
mov rax, qword [rdi]
bt rax, 0x3e
jae 0x14000b508
mov rbp, rbx
add rbp, 1
jo 0x14000b578
mov r12, rbp
add r12, 8
jo 0x14000b578
movabs r8, 0x7fffffffffffffff
xor edx, edx
test r12, r12
mov rcx, r12
js 0x14000b4f4
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov rdx, r12
mov rcx, rax
call sym.rawAlloc__system_u6807
mov qword [rsi + 8], rax
mov qword [rax], rbx
mov rcx, qword [rsi]
test rcx, rcx
jle 0x14000b5a0
cmp rcx, rbx
cmovg rcx, rbx
test rcx, rcx
js 0x14000b4e8
mov rax, qword [rsi + 8]
lea rdx, [rdi + 8]
mov r8, rcx
add rax, 8
mov rcx, rax
call sym.memcpy
mov rax, qword [rsi]
cmp rax, rbx
jge 0x14000b5c0
mov rcx, rbx
sub rcx, rax
jo 0x14000b578
add rcx, 1
jo 0x14000b578
test rcx, rcx
js 0x14000b4e8
mov rdx, qword [rsi + 8]
mov r8, rcx
lea rax, [rdx + rax + 8]
xor edx, edx
mov rcx, rax
call sym.memset
mov rdi, qword [rsi + 8]
mov byte [rdi + rbx + 8], 0
mov qword [rsi], rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseRangeErrorI
cmp qword [rcx], rdx
jge 0x14000b4d0
btr rax, 0x3e
cmp rdx, rax
jle 0x14000b4d0
test rax, rax
mov edi, 4
jle 0x14000b531
cmp rax, 0x7fff
jg 0x14000b5f0
lea rdi, [rax + rax]
add rax, 9
js 0x14000b587
cmp rbx, rdi
cmovge rdi, rbx
mov rcx, rdi
add rcx, 1
jo 0x14000b578
add rcx, 8
jo 0x14000b578
test rcx, rcx
js 0x14000b4e8
mov r8, rcx
mov rcx, qword [rsi + 8]
mov rdx, rax
call sym.realloc0Impl__system_u1770
mov qword [rsi + 8], rax
mov qword [rax], rdi
mov rdi, qword [rsi + 8]
jmp 0x14000b4d0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.raiseOverflow
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rax
jmp 0x14000b4f4
test rbp, rbp
js 0x14000b5d8
mov rax, qword [rsi + 8]
mov r8, rbp
xor edx, edx
lea rcx, [rax + 8]
call sym.memset
mov rdi, qword [rsi + 8]
jmp 0x14000b4d0
mov rax, qword [rsi + 8]
mov byte [rax + rbx + 8], 0
mov rdi, qword [rsi + 8]
jmp 0x14000b4d0
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
jmp 0x14000b4f4
imul rdx, rax, 3
jo 0x14000b608
mov rdi, rdx
shr rdi, 0x3f
add rdi, rdx
sar rdi, 1
jmp 0x14000b531
mov qword [rsp + 0x28], rax
call sym.raiseOverflow
mov rax, qword [rsp + 0x28]
jmp 0x14000b531

Function at 0x14000c4e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
test rbx, rbx
mov qword [rcx], rdx
je 0x14000c540
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x14000c520
sub rax, 0x10
jo 0x14000c546
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3453
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow
Function at 0x14000c550
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [rcx]
test rdx, rdx
je 0x14000c56b
mov rax, qword [rdx - 0x10]
add rax, 0x10
jo 0x14000c5c6
mov qword [rdx - 0x10], rax
test rbx, rbx
mov qword [rcx], rdx
je 0x14000c5c0
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x14000c5a0
sub rax, 0x10
jo 0x14000c5e1
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x30
pop rbx
jmp sym.rememberCycle__system_u3453
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call sym.raiseOverflow
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
jmp 0x14000c56b
add rsp, 0x30
pop rbx
jmp sym.raiseOverflow

Function at 0x14000d790
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 8]
test rax, rax
mov rbx, rcx
je 0x14000d7f0
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x14000d7d0
sub rdx, 0x10
jo 0x14000d7f6
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3453
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 8]
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow

Function at 0x14000d990
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rsi
mov r8, rdi
mov edx, 1
mov rbx, rax
mov r9, rax
call sym.fwrite
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.fflush
Function at 0x14000d9d0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [0x140037110]
test rsi, rsi
mov rbx, rcx
je 0x14000dad8
mov qword [rsp + 0x40], 0
test rcx, rcx
mov qword [rsp + 0x48], 0
je 0x14000daa0
call sym.strlen
test rax, rax
mov rdi, rax
je 0x14000daa0
lea rbp, [rax + 1]
mov rsi, rax
add rsi, 9
js 0x14000dbcd
cmp rsi, rbp
jb 0x14000dbcd
test rsi, rsi
js 0x14000db70
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov rdx, rsi
mov rcx, rax
call sym.rawAlloc__system_u6807
mov r8, rbp
mov rdx, rbx
lea rcx, [rax + 8]
mov rsi, rax
mov qword [rax], rdi
call sym.memcpy
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rsi
call qword [0x140037110]
test byte [rsi + 7], 0x40
jne 0x14000dab9
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov rdx, rsi
mov rcx, rax
call sym.rawDealloc__system_u6959
jmp 0x14000dab9
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], 0
call rsi
lea rcx, [0x14002e360]
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x14000db10
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsp + 0x28], rdx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rbx
mov edx, 1
mov rsi, rax
mov r9, rax
call sym.fwrite
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.fflush
mov byte [rax], 0
lea rcx, [0x14002e2a0]
call dbg.__emutls_get_address
mov rbx, qword [rax]
mov rsi, qword [rbx + 0x38]
test rsi, rsi
je 0x14000db3d
mov rdx, qword [rsi - 0x10]
add rdx, 0x10
jo 0x14000dbd4
mov qword [rsi - 0x10], rdx
mov qword [rax], rsi
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x14000dbb0
sub rax, 0x10
jo 0x14000dbe8
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rememberCycle__system_u3453
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call sym.raiseRangeErrorI
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
xor esi, esi
mov qword [rsp + 0x38], rsi
call qword [0x140037110]
test rsi, rsi
jne 0x14000da7b
jmp 0x14000dab9
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.nimDestroyAndDispose
call sym.raiseOverflow
jmp 0x14000db84
mov qword [rsp + 0x28], rax
call sym.raiseOverflow
mov rax, qword [rsp + 0x28]
jmp 0x14000db3d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.raiseOverflow