joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000222b
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
mov rcx, rdx
mov qword [rbx], rdx
jns 0x140002254
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400050a1
call fcn.140004495
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret

Function at 0x140002518
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140002526
jmp fcn.140004925
ret

Function at 0x14000257c
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor eax, eax
mov r12b, byte [rcx]
mov rbp, qword [rcx + 0x10]
mov r13, qword [rdx + 8]
mov rsi, qword [rdx + 0x10]
lea r8, [rcx + 1]
mov rbx, rcx
mov ecx, 0x17
mov rdi, r8
rep stosb byte [rdi], al
mov al, byte [rdx]
test al, al
mov byte [rbx], al
je 0x1400025bc
dec al
jne 0x1400025f0
mov qword [rbx + 8], r13
jmp 0x1400025f0
test rsi, rsi
je 0x1400025d6
mov rax, qword [rsi - 0x10]
add rax, 0x10
jo 0x1400025d1
mov qword [rsi - 0x10], rax
jmp 0x1400025d6
call fcn.1400049fd
xor ecx, ecx
mov qword [rbx + 0x10], rsi
mov qword [rbx + 8], r13
call fcn.140002530
test al, al
je 0x1400025f0
xor ecx, ecx
call fcn.140004ab4
test r12b, r12b
jne 0x140002615
mov rcx, rbp
call fcn.140002530
test al, al
je 0x140002615
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140004ab4
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140002658
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx], 0
mov rbx, rcx
jne 0x140002680
mov rcx, qword [rcx + 0x10]
call fcn.140002530
test al, al
je 0x140002680
mov rcx, qword [rbx + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140004ab4
add rsp, 0x20
pop rbx
ret

Function at 0x1400028c9
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor edi, edi
mov rsi, qword [rcx + 8]
mov rbp, qword [rcx]
lea rbx, [rsi + 0x18]
cmp rdi, rbp
jl 0x1400028ea
test rsi, rsi
jne 0x14000290d
jmp 0x140002928
cmp byte [rbx - 0x10], 0
jne 0x140002904
mov rcx, qword [rbx]
call fcn.140002530
test al, al
je 0x140002904
mov rcx, qword [rbx]
call fcn.140004ab4
inc rdi
add rbx, 0x18
jmp 0x1400028de
test byte [rsi + 7], 0x40
jne 0x140002928
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140004927
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14000295a
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x1400029b0
mov rcx, rax
add rcx, 1
jo 0x14000298c
test rcx, rcx
jns 0x140002993
movabs r8, 0x7fffffffffffffff
xor edx, edx
pop rsi
pop rdi
jmp fcn.1400050a1
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x14000298c
mov qword [r8], rax
pop rsi
pop rdi
ret
Function at 0x140002f02
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
sub rsp, 0x38
mov rsi, rcx
mov rcx, rdx
mov edx, 1
mov r9, rsi
mov rdi, r8
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rdi, rax
je 0x140002f35
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.140002d74
mov rax, qword [rsp + 0x28]
add rsp, 0x38
pop rsi
pop rdi
ret

Function at 0x1400035a2
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, rdx
mov edx, 1
mov r9, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
mov qword [rsp + 0x28], rax
call fcn.140002d74
mov rax, qword [rsp + 0x28]
add rsp, 0x30
pop rbx
ret

Function at 0x140003872
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x140003891
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140029138

Function at 0x1400039f2
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rsi, [0x1400305d8]
mov rbp, qword [rcx]
mov rdi, qword [rcx + 8]
mov ecx, 2
call rbx
lea rdx, str.could_not_load:
mov rcx, rax
call fcn.140003872
test rbp, rbp
je 0x140003a2e
lea rsi, [rdi + 8]
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.140003872
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x140003a63
mov ecx, 2
call rbx
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call fcn.140003872
mov ecx, 2
call rbx
lea rdx, [0x14003061b]
mov rcx, rax
call fcn.140003872
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop

Function at 0x140003a84
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call fcn.140003872
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.140003872
mov ecx, 2
call rbx
lea rdx, [0x14003061b]
mov rcx, rax
call fcn.140003872
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop

Function at 0x140003bcf
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14003e120]
test rax, rax
je 0x140003be1
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call fcn.140003872
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
Function at 0x1400048ff
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14002f380]
call fcn.140023d60
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.140004785

Function at 0x140004927
Capabilities:
Terminate process

Disassembly:
cmp rdx, 0x10
jle 0x140004934
movzx eax, word [rcx - 2]
sub rcx, rax
jmp fcn.1400048ff

Function at 0x14000498c
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400049a0
test byte [rcx + 7], 0x40
jne 0x1400049a0
jmp fcn.1400048ff
ret

Function at 0x140004a88
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x10
mov qword [rsp + 0x28], rdx
call fcn.140004a5d
mov rdx, qword [rsp + 0x28]
sub rbx, rax
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.140004927

Function at 0x140004ab4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rax, qword [rax]
mov rbx, rcx
test rax, rax
jne 0x140004ad9
mov rax, qword [rbx]
mov rcx, rbx
movsx rdx, word [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140004a88
call rax
lea rcx, [0x14002f360]
call fcn.140023d60
cmp byte [rax], 0
je 0x140004ac7
add rsp, 0x20
pop rbx
ret

Function at 0x140004e64
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [rcx]
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x140004e8e
mov rax, qword [rdx - 0x10]
add rax, 0x10
jo 0x140004e89
mov qword [rdx - 0x10], rax
jmp 0x140004e8e
call fcn.1400049fd
mov qword [rsi], rbx
mov rcx, rdi
call fcn.140005725
test al, al
je 0x140004eac
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140004ab4
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400050a1
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor eax, eax
lea rbx, [rsp + 0x20]
mov rbp, rdx
mov rdx, rcx
mov qword [rsp + 0x30], rax
mov rcx, rbx
mov r12, r8
mov qword [rsp + 0x38], rax
call fcn.140001c08
lea rcx, [0x14002f360]
mov r13, qword [rsp + 0x20]
call fcn.140023d60
mov rdi, qword [rsp + 0x28]
cmp byte [rax], 0
mov rsi, rax
jne 0x140005229
mov rdx, rbp
mov rcx, rbx
call fcn.140001c08
cmp byte [rsi], 0
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
jne 0x140005229
mov rdx, r12
mov rcx, rbx
call fcn.140001c08
cmp byte [rsi], 0
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
jne 0x140005229
lea rax, [r13 + r14]
lea rsi, [rsp + 0x30]
lea rdx, [rax + r15 + 0x1f]
mov rcx, rsi
call fcn.140005a9e
movaps xmm0, xmmword [0x140030d00]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm0
call fcn.140005b44
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], rdi
call fcn.140005b44
movaps xmm1, xmmword [0x140030c40]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm1
call fcn.140005b44
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rbp
call fcn.140005b44
movaps xmm2, xmmword [0x140030c20]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm2
call fcn.140005b44
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r12
call fcn.140005b44
movaps xmm3, xmmword [rsp + 0x30]
mov rcx, rbx
movaps xmmword [rsp + 0x20], xmm3
call fcn.140004fa9
test r12, r12
je 0x1400051f3
test byte [r12 + 7], 0x40
jne 0x1400051f3
mov rcx, r12
call fcn.1400048ff
test rbp, rbp
je 0x140005206
test byte [rbp + 7], 0x40
jne 0x140005206
mov rcx, rbp
call fcn.1400048ff
test rdi, rdi
je 0x140005229
test byte [rdi + 7], 0x40
jne 0x140005229
mov rcx, rdi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400048ff
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000523a
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
imul rax, qword [rcx + 8], 3
mov rbx, rcx
jo 0x14000525d
mov ecx, 2
cqo
idiv rcx
imul rcx, rax, 0x10
mov qword [rbx + 8], rax
jno 0x140005267
add rsp, 0x20
pop rbx
jmp fcn.1400049fd
test rcx, rcx
jns 0x140005282
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400050a1
mov rdx, rcx
mov rcx, qword [rbx + 0x10]
call fcn.1400048cf
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret

Function at 0x140005771
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov qword [rcx], rdx
mov rcx, rbx
call fcn.140005725
test al, al
je 0x140005795
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140004ab4
add rsp, 0x20
pop rbx
ret
Function at 0x14000579b
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
imul rax, qword [rcx + 8], 3
mov rbx, rcx
jo 0x1400057be
mov ecx, 2
cqo
idiv rcx
imul rcx, rax, 0x10
mov qword [rbx + 8], rax
jno 0x1400057c8
add rsp, 0x20
pop rbx
jmp fcn.1400049fd
test rcx, rcx
jns 0x1400057e3
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400050a1
mov rdx, rcx
mov rcx, qword [rbx + 0x10]
call fcn.1400048cf
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret

Function at 0x1400058fd
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
add rbx, qword [rcx]
mov rbp, rcx
jo 0x14000592c
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x140005923
mov rsi, qword [rdi]
bt rsi, 0x3e
jae 0x140005939
mov rcx, rbx
add rcx, 1
jno 0x140005949
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400049fd
btr rsi, 0x3e
cmp rbx, rsi
jle 0x1400059fc
jmp 0x14000598b
add rcx, 8
jo 0x14000592c
test rcx, rcx
js 0x1400059cd
call fcn.140004495
mov rdx, qword [rbp]
mov qword [rbp + 8], rax
mov qword [rax], rbx
test rdx, rdx
jle 0x1400059fc
cmp rbx, rdx
cmovle rdx, rbx
test rdx, rdx
mov rcx, rdx
js 0x1400059cd
lea rsi, [rdi + 8]
add rax, 8
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
jmp 0x1400059fc
mov rcx, rsi
call fcn.140004e2b
add rsi, 9
jns 0x1400059aa
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
jmp 0x1400059d9
cmp rbx, rax
cmovl rbx, rax
mov rcx, rbx
add rcx, 1
jo 0x14000592c
add rcx, 8
jo 0x14000592c
test rcx, rcx
jns 0x1400059e6
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400050a1
mov r8, rcx
mov rcx, qword [rbp + 8]
mov rdx, rsi
call fcn.1400049ab
mov qword [rbp + 8], rax
mov qword [rax], rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140005b44
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140005b9a
mov rcx, rax
add rcx, 1
jo 0x140005b76
test rcx, rcx
jns 0x140005b7d
movabs r8, 0x7fffffffffffffff
xor edx, edx
pop rsi
pop rdi
jmp fcn.1400050a1
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140005b76
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x140006371
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
call fcn.140005725
test al, al
je 0x140006394
mov rcx, qword [rbx + 8]
add rsp, 0x20
pop rbx
jmp fcn.140004ab4
add rsp, 0x20
pop rbx
ret

Function at 0x1400064db
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov qword [rsp + 0x28], rdx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140029138
Function at 0x14000651a
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x14003e110], 0
jne 0x140006532
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400064db
lea rsi, [rsp + 0x20]
mov rdx, rcx
mov rcx, rsi
call fcn.140006454
mov rbx, qword [rsp + 0x28]
mov rcx, rsi
call qword [0x14003e110]
test rbx, rbx
je 0x140006563
test byte [rbx + 7], 0x40
jne 0x140006563
mov rcx, rbx
call fcn.1400048ff
lea rcx, [0x14002f360]
call fcn.140023d60
cmp byte [rax], 0
je 0x14000659b
lea rcx, [0x14002f260]
mov byte [rax], 0
call fcn.140023d60
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140004e64
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x14000665c
Capabilities:
Terminate process

Disassembly:
jmp fcn.1400048ff
test rcx, rcx
je 0x140019226
jmp 0x14000665c
ret

Function at 0x140006924
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rdx + 8]
mov rbx, qword [rdx]
mov rdi, rcx
mov rcx, qword [rcx + 8]
cmp rcx, rsi
je 0x1400069f6
test rsi, rsi
je 0x140006954
test byte [rsi + 7], 0x40
jne 0x140006954
test rcx, rcx
jne 0x140006970
jmp 0x140006990
test rcx, rcx
je 0x140006964
test byte [rcx + 7], 0x40
jne 0x140006964
call fcn.1400048ff
mov qword [rdi], rbx
mov qword [rdi + 8], rsi
jmp 0x1400069f6
mov rax, qword [rcx]
mov edx, 1
shl rdx, 0x3e
test rax, rdx
jne 0x140006990
btr rax, 0x3e
cmp rax, rbx
jge 0x1400069bc
call fcn.1400048ff
mov rcx, rbx
add rcx, 1
jo 0x14000699f
add rcx, 8
jno 0x1400069ab
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400049fd
test rcx, rcx
js 0x1400069cd
call fcn.140004495
mov qword [rdi + 8], rax
mov qword [rax], rbx
mov qword [rdi], rbx
add rbx, 1
mov rcx, rbx
jo 0x14000699f
test rbx, rbx
jns 0x1400069e5
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400050a1
mov rax, qword [rdi + 8]
add rsi, 8
add rax, 8
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140006c07
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r12, [0x14003e0e0]
xor ebx, ebx
lea r14, [0x14002f360]
lea r13, [rsp + 0x20]
mov rsi, rcx
mov rdi, rdx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbp, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rbx, rdi
mov ecx, 1
jl 0x140006c8d
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14003061b]
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
call fcn.140029138
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rbp
xor r8d, r8d
mov rdx, r13
mov rcx, rax
mov rax, rbx
shl rax, 4
movups xmm0, xmmword [rsi + rax]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140006ae0
mov rcx, r14
call fcn.140023d60
cmp byte [rax], 0
jne 0x140006cbf
inc rbx
jmp 0x140006c40
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140006cce
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.140005725
test al, al
je 0x140006cee
mov rcx, qword [rsp + 0x28]
add rsp, 0x38
jmp fcn.140004ab4
add rsp, 0x38
ret

Function at 0x140006cf3
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor esi, esi
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rsi, rdi
jl 0x140006d0f
test rbx, rbx
jne 0x140006d30
jmp 0x140006d45
mov rax, rsi
shl rax, 4
mov rcx, qword [rbx + rax + 0x10]
test rcx, rcx
je 0x140006d2b
test byte [rcx + 7], 0x40
jne 0x140006d2b
call fcn.1400048ff
inc rsi
jmp 0x140006d03
test byte [rbx + 7], 0x40
jne 0x140006d45
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400048ff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140006e74
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor eax, eax
lea rbx, [rsp + 0x20]
mov r12, rdx
mov rdx, rcx
mov qword [rsp + 0x30], rax
mov rcx, rbx
mov rdi, r8
mov qword [rsp + 0x38], rax
call fcn.140001bd9
lea rcx, [0x14002f360]
mov r13, qword [rsp + 0x20]
call fcn.140023d60
mov rbp, qword [rsp + 0x28]
cmp byte [rax], 0
mov rsi, rax
jne 0x140006ffd
mov rdx, r12
mov rcx, rbx
call fcn.140001bd9
cmp byte [rsi], 0
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
jne 0x140006ffd
lea rdx, [rdi - 1]
mov rcx, rbx
call fcn.140001bd9
cmp byte [rsi], 0
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
jne 0x140006ffd
lea rax, [r13 + r14]
lea rsi, [rsp + 0x30]
lea rdx, [rax + r15 + 0x21]
mov rcx, rsi
call fcn.140005a9e
movaps xmm0, xmmword [0x140030b30]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm0
call fcn.140005b44
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], rbp
call fcn.140005b44
movaps xmm1, xmmword [0x140030b10]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm1
call fcn.140005b44
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r12
call fcn.140005b44
movaps xmm2, xmmword [0x140030ae0]
mov rdx, rbx
mov rcx, rsi
movaps xmmword [rsp + 0x20], xmm2
call fcn.140005b44
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rdi
call fcn.140005b44
movaps xmm3, xmmword [rsp + 0x30]
mov rcx, rbx
movaps xmmword [rsp + 0x20], xmm3
call fcn.140005eda
test rdi, rdi
je 0x140006fc5
test byte [rdi + 7], 0x40
jne 0x140006fc5
mov rcx, rdi
call fcn.1400048ff
test r12, r12
je 0x140006fda
test byte [r12 + 7], 0x40
jne 0x140006fda
mov rcx, r12
call fcn.1400048ff
test rbp, rbp
je 0x140006ffd
test byte [rbp + 7], 0x40
jne 0x140006ffd
mov rcx, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400048ff
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140007060
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1400305d8]
cmp qword [rcx], 0
mov rax, qword [rcx + 8]
mov rbx, rdx
je 0x14000707f
lea rdi, [rax + 8]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
mov rdx, rdi
mov rcx, rax
call fcn.140003872
mov ecx, 2
call rsi
lea rdx, [0x14003061b]
mov rcx, rax
call fcn.140003872
cmp rbx, 0xffffffff80000000
mov ecx, 0x80000000
jl 0x1400070cc
cmp rbx, 0x7fffffff
mov ecx, 0x7fffffff
jg 0x1400070cc
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop

Function at 0x14000730b
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx]
add rcx, 1
jo 0x140007328
add rcx, 8
jno 0x140007334
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400049fd
test rcx, rcx
js 0x140007353
call fcn.140004495
mov rcx, qword [rbx]
mov qword [rbx + 8], rax
mov qword [rax], rcx
add rcx, 1
jo 0x140007328
test rcx, rcx
jns 0x14000736b
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400050a1
add rax, 8
add rsi, 8
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140007634
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140007648
test byte [rcx + 7], 0x40
jne 0x140007648
jmp fcn.1400048ff
ret

Function at 0x1400077f9
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movups xmm0, xmmword [rdx]
lea rdi, [rsp + 0x30]
mov rsi, rcx
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140001c4d
lea rcx, [0x14002f360]
mov rbp, qword [rsp + 0x30]
call fcn.140023d60
mov rbx, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x140007874
mov rdx, rbp
mov rcx, rsi
call fcn.1400058fd
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbx
call fcn.140005b44
test rbx, rbx
je 0x140007874
test byte [rbx + 7], 0x40
jne 0x140007874
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400048ff
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140007ad0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor esi, esi
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rsi, rdi
jl 0x140007aec
test rbx, rbx
jne 0x140007b0a
jmp 0x140007b1f
imul rax, rsi, 0x38
mov rcx, qword [rbx + rax + 0x10]
test rcx, rcx
je 0x140007b05
test byte [rcx + 7], 0x40
jne 0x140007b05
call fcn.1400048ff
inc rsi
jmp 0x140007ae0
test byte [rbx + 7], 0x40
jne 0x140007b1f
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400048ff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret