joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003cb0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
mov rcx, rdx
mov qword [rbx], rdx
js 0x140003cd8
call sym.allocShared0Impl__system_u1776
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
add rsp, 0x20
pop rbx
jmp sym.raiseRangeErrorI

Function at 0x140004430
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140004440
jmp sym.deallocShared
ret

Function at 0x1400044e0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movzx eax, byte [rdx]
mov rbx, qword [rcx + 0x10]
movzx edi, byte [rcx]
mov rbp, qword [rdx + 8]
test al, al
mov rsi, qword [rdx + 0x10]
mov byte [rcx], al
mov qword [rcx + 9], 0
mov qword [rcx + 1], 0
mov qword [rcx + 0x10], 0
je 0x140004530
test dil, dil
mov qword [rcx + 8], rbp
je 0x140004558
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
test rsi, rsi
mov qword [rcx + 8], 0
je 0x14000454b
mov rax, qword [rsi - 0x10]
add rax, 0x10
jo 0x1400045ba
mov qword [rsi - 0x10], rax
test dil, dil
mov qword [rcx + 0x10], rsi
mov qword [rcx + 8], rbp
jne 0x140004521
test rbx, rbx
je 0x140004521
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x140004590
sub rax, 0x10
jo 0x1400045ad
mov r8, qword [rbx]
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rememberCycle__system_u3453
mov r8, qword [rbx]
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.nimDestroyAndDispose
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.raiseOverflow
mov qword [rsp + 0x28], rcx
call sym.raiseOverflow
mov rcx, qword [rsp + 0x28]
jmp 0x14000454b

Function at 0x1400047e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx], 0
mov rbx, rcx
je 0x1400047f8
add rsp, 0x20
pop rbx
ret
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400047ed
mov rdx, qword [rax - 0x10]
lea rcx, [rax - 0x10]
cmp rdx, 0xf
jbe 0x140004830
sub rdx, 0x10
jo 0x14000484e
mov r8, qword [rax]
mov qword [rax - 0x10], rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp sym.rememberCycle__system_u3453
mov r8, qword [rax]
mov rdx, rcx
mov ecx, 1
call sym.rememberCycle__system_u3453
mov rcx, qword [rbx + 0x10]
add rsp, 0x20
pop rbx
jmp sym.nimDestroyAndDispose
add rsp, 0x20
pop rbx
jmp sym.raiseOverflow

Function at 0x140004940
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rcx, [0x140037040]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
add rsp, 0x28
jmp sym.nimTestErrorFlag

Function at 0x140005cc0
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
mov edx, 1
mov r9, rdi
mov rsi, r8
call sym.fread
cmp rsi, rax
mov rbx, rax
je 0x140005cf1
mov rcx, rdi
call sym.ferror
test eax, eax
jne 0x140005d00
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rdi
call sym.checkErr__stdZsyncio_u162.part.0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140005d50
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rax, [0x14002f380]
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x30]
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x20]
mov edx, 0xfa0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov rbp, qword [0x1400321d0]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
test rbx, rbx
mov qword [rsp + 0x48], rax
jle 0x140005f30
nop word [rax + rax]
mov rax, qword [rsp + 0x48]
mov r9, rsi
mov r8d, 0xfa0
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
cmp rax, 0xfa0
mov rbx, rax
je 0x140005ec0
mov rcx, rsi
call sym.ferror
test eax, eax
je 0x140005e07
mov rcx, rsi
call sym.checkErr__stdZsyncio_u162.part.0
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140005f78
test rbx, rbx
js 0x140005f98
lea rcx, [rsp + 0x40]
mov rdx, rbx
call sym.setLengthStrV2
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
jle 0x140005e98
mov r8, rbx
add r8, 1
jo 0x140005f6d
test r8, r8
js 0x140005fb6
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea rax, [rdx + rax + 8]
lea rdx, [rcx + 8]
mov rcx, rax
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140005f6d
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
test rcx, rcx
je 0x140005ea7
test byte [rcx + 7], 0x40
je 0x140005f88
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140005f78
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rbx, rbx
jle 0x140005f30
mov r8, rbx
add r8, 1
jo 0x140005f45
test r8, r8
js 0x140005f50
mov rax, qword [rsp + 0x30]
add rdx, 8
mov rcx, qword [rsp + 0x38]
lea rcx, [rcx + rax + 8]
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140005f45
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jg 0x140005dc8
nop dword [rax]
lea rdx, [rbx - 1]
xor ecx, ecx
call sym.raiseIndexError2
mov rcx, qword [rsp + 0x48]
jmp 0x140005e98
call sym.raiseOverflow
jmp 0x140005f1f
movabs r8, 0x7fffffffffffffff
xor edx, edx
movabs rcx, 0x8000000000000000
call sym.raiseRangeErrorI
jmp 0x140005f1f
call sym.raiseOverflow
nop word [rax + rax]
mov rcx, qword [rsp + 0x48]
jmp 0x140005e98
call sym.deallocShared
jmp 0x140005ea7
movabs r8, 0x7fffffffffffffff
mov rcx, rbx
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x140005e98
movabs rcx, 0x8000000000000000
xor edx, edx
movabs r8, 0x7fffffffffffffff
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x140005e98
Function at 0x140005fe0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test r8, r8
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
js 0x1400060d0
lea r14, [rsp + 0x20]
mov rdx, r8
mov rcx, r14
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov rdx, rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
test rdx, rdx
mov qword [rsp + 0x38], rax
jle 0x140006120
mov rax, qword [rsp + 0x38]
mov r9, rsi
mov r8, rbx
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
cmp rbx, rax
mov rbp, rax
je 0x140006061
mov rcx, rsi
call sym.ferror
test eax, eax
jne 0x1400060f0
mov rcx, qword [0x1400321d0]
call dbg.__emutls_get_address
cmp byte [rax], 0
mov r12, rax
jne 0x1400060b1
mov rcx, rsi
call sym.fgetc
mov rdx, rsi
mov ecx, eax
mov r13d, eax
call sym.ungetc
cmp byte [r12], 0
jne 0x1400060b1
test r13d, r13d
jns 0x140006130
cmp rbx, rbp
jle 0x1400060b1
test rbp, rbp
js 0x140006100
lea rcx, [rsp + 0x30]
mov rdx, rbp
call sym.setLengthStrV2
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
call sym.raiseRangeErrorI
jmp 0x1400060b1
mov rcx, rsi
call sym.checkErr__stdZsyncio_u162.part.0
jmp 0x140006061
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
call sym.raiseRangeErrorI
jmp 0x1400060b1
sub rdx, 1
xor ecx, ecx
call sym.raiseIndexError2
jmp 0x1400060b1
mov rdx, rsi
mov rcx, r14
call sym.readAllBuffer__stdZsyncio_u516
cmp byte [r12], 0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jne 0x140006190
lea rcx, [rsp + 0x30]
mov rdx, rbx
call sym.prepareAdd
test rbx, rbx
jle 0x140006190
mov r8, rbx
add r8, 1
jo 0x1400061b0
test r8, r8
js 0x1400061c0
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea rcx, [rdx + rax + 8]
lea rdx, [rsi + 8]
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x1400061b0
mov qword [rsp + 0x30], rbx
test rsi, rsi
je 0x1400060b1
test byte [rsi + 7], 0x40
jne 0x1400060b1
mov rcx, rsi
call sym.deallocShared
jmp 0x1400060b1
call sym.raiseOverflow
jmp 0x140006190
movabs r8, 0x7fffffffffffffff
xor edx, edx
movabs rcx, 0x8000000000000000
call sym.raiseRangeErrorI
jmp 0x140006190
Function at 0x140006470
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor ecx, ecx
call rdi
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov rcx, rax
call rsi
mov edx, 0x8000
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
mov ecx, eax
call rbx
mov ecx, 1
call rdi
mov rcx, rax
call rsi
mov edx, 0x8000
mov ecx, eax
call rbx
mov ecx, 2
call rdi
mov rcx, rax
call rsi
mov edx, 0x8000
mov ecx, eax
call rbx
call qword [0x1400370c0]
mov dword [0x1400370c8], eax
call qword [0x1400370b0]
cmp dword [0x1400370c8], 0xfde9
mov dword [0x1400370b8], eax
je 0x14000653b
mov ecx, 0xfde9
call qword [0x1400370a8]
lea rax, [sym.restoreConsoleOutputCP__stdZsyncio_u675]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
movdqa xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call sym.addExitProc__stdZexitprocs_u203
mov rcx, qword [0x1400321d0]
call dbg.__emutls_get_address
mov rdx, rax
mov eax, dword [0x1400370b8]
cmp byte [rdx], 0
jne 0x140006578
cmp eax, 0xfde9
je 0x140006578
mov ecx, 0xfde9
call qword [0x1400370a0]
lea rax, [sym.restoreConsoleCP__stdZsyncio_u676]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
movdqa xmm1, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm1
call sym.addExitProc__stdZexitprocs_u203
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
jmp sym.nimTestErrorFlag

Function at 0x1400066c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x1400066df
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sym.fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fflush

Function at 0x1400067c0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
mov ecx, 2
call rsi
lea rdx, str.could_not_load:
mov rcx, rax
call sym.rawWrite
lea rax, [0x14002f458]
mov ecx, 2
add rbx, 8
test rdi, rdi
cmove rbx, rax
call rsi
mov rcx, rax
mov rdx, rbx
call sym.rawWrite
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
je 0x14000683c
mov ecx, 2
call rsi
lea rdx, [0x14002f4a1]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
mov ecx, 2
call rsi
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call sym.rawWrite
jmp 0x14000681c

Function at 0x140006860
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
lea rdx, [0x14002f4a1]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop dword [rax]
Function at 0x1400069e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140037120]
test rax, rax
je 0x1400069f2
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop word [rax + rax]

Function at 0x140008610
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r10, qword [rdx + 8]
mov r9, rdx
sar rdx, 0x15
mov r8, rcx
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x20a0]
test rax, rax
jne 0x140008640
jmp 0x14000866a
mov rax, qword [rax]
test rax, rax
je 0x14000866a
cmp rdx, qword [rax + 8]
jne 0x140008638
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rdx, qword [r8 + 0x2078]
mov rcx, rax
sub rcx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x1400086b5
add rsp, 0x28
ret
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop dword [rax]

Function at 0x1400086d0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [rdx + 8]
sub qword [rcx + 0x2088], rax
mov r10, qword [rdx + 8]
mov r8, rcx
mov r9, rdx
cmp r10, 0x3f000000
jg 0x140008700
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x20a0]
test rax, rax
jne 0x140008770
nop dword [rax]
mov rax, qword [r8 + 0x2070]
mov rdx, qword [r8 + 0x2078]
mov rcx, rax
sub rcx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rcx
xor edx, edx
mov rcx, r9
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x14000879f
add rsp, 0x28
ret
mov rax, qword [rax]
test rax, rax
je 0x140008718
cmp rdx, qword [rax + 8]
jne 0x140008768
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
jmp 0x140008718
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
Function at 0x1400087c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r9, rdx
and r9, 0xfffffffffffff000
mov r8, qword [r9 + 8]
mov rax, qword [r9 + 0x10]
cmp r8, 0xfb0
jle 0x140008810
lea rdx, [rax + 0x2098]
cmp rcx, rax
lea r10, [r9 + 0x18]
je 0x140008890
mov rax, qword [rdx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rdx], r9
jne 0x140008880
add rsp, 0x28
ret
cmp rcx, rax
je 0x140008830
lea rcx, [r9 + 0x40]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rdx]
lock cmpxchg qword [rcx], rdx
je 0x140008803
mov qword [rdx], rax
jmp 0x140008819
sub qword [rax + 0x2088], r8
mov rcx, qword [r9 + 0x28]
mov qword [rdx], rcx
mov qword [r9 + 0x28], rdx
mov rdx, qword [r9 + 0x30]
cmp rdx, r8
jge 0x1400088b0
lea rdx, [r8 + 0xf]
test r8, r8
cmovns rdx, r8
sar rdx, 4
mov rcx, qword [rax + rdx*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x14000886b
mov qword [rcx + 0x20], r9
mov qword [rax + rdx*8], r9
add qword [r9 + 0x30], r8
add rsp, 0x28
ret
mov qword [r10], rax
jmp 0x1400087f3
sub qword [rcx + 0x2088], r8
mov r8, qword [r9 + 8]
cmp r8, 0x3f000000
jg 0x140008920
mov rdx, r9
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
add rdx, r8
cmp rdx, 0xfb0
mov qword [r9 + 0x30], rdx
jne 0x140008803
lea rdx, [r8 + 0xf]
test r8, r8
mov rcx, qword [r9 + 0x18]
cmovns rdx, r8
sar rdx, 4
cmp r9, qword [rax + rdx*8]
je 0x1400089d8
mov rdx, qword [r9 + 0x20]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x1400088f6
mov rdx, qword [r9 + 0x20]
mov qword [rcx + 0x20], rdx
mov rdx, r9
mov rcx, rax
pxor xmm0, xmm0
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
mov rcx, r9
sar rcx, 0x15
movzx edx, cl
mov rdx, qword [rax + rdx*8 + 0x20a0]
test rdx, rdx
jne 0x140008948
jmp 0x140008973
mov rdx, qword [rdx]
test rdx, rdx
je 0x140008973
cmp rcx, qword [rdx + 8]
jne 0x140008940
mov rcx, r9
mov r10d, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl r10, cl
sar r11, 6
not r10
and qword [rdx + r11*8 + 0x10], r10
mov rdx, qword [rax + 0x2070]
mov rcx, rdx
sub rcx, r8
mov r8d, 0x8000
movq xmm0, rcx
mov rcx, qword [rax + 0x2078]
cmp rdx, rcx
cmovl rdx, rcx
mov rcx, r9
movq xmm1, rdx
xor edx, edx
punpcklqdq xmm0, xmm1
movups xmmword [rax + 0x2070], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140008803
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop word [rax + rax]
test rcx, rcx
mov qword [rax + rdx*8], rcx
je 0x1400088f6
mov qword [rcx + 0x20], 0
jmp 0x1400088f6
Function at 0x140008a00
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r9, rdx
and r9, 0xfffffffffffff000
mov r8, qword [r9 + 8]
mov rax, qword [r9 + 0x10]
cmp r8, 0xfb0
jle 0x140008a50
lea rdx, [rax + 0x2098]
cmp rcx, rax
lea r10, [r9 + 0x18]
je 0x140008ad0
mov rax, qword [rdx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rdx], r9
jne 0x140008ac0
add rsp, 0x28
ret
cmp rcx, rax
je 0x140008a70
lea rcx, [r9 + 0x40]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rdx]
lock cmpxchg qword [rcx], rdx
je 0x140008a43
mov qword [rdx], rax
jmp 0x140008a59
sub qword [rax + 0x2088], r8
mov rcx, qword [r9 + 0x28]
mov qword [rdx], rcx
mov qword [r9 + 0x28], rdx
mov rdx, qword [r9 + 0x30]
cmp r8, rdx
jle 0x140008af0
lea rdx, [r8 + 0xf]
test r8, r8
cmovns rdx, r8
sar rdx, 4
mov rcx, qword [rax + rdx*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x140008aab
mov qword [rcx + 0x20], r9
mov qword [rax + rdx*8], r9
add qword [r9 + 0x30], r8
add rsp, 0x28
ret
mov qword [r10], rax
jmp 0x140008a33
sub qword [rcx + 0x2088], r8
mov r8, qword [r9 + 8]
cmp r8, 0x3f000000
jg 0x140008b60
mov rdx, r9
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
add rdx, r8
cmp rdx, 0xfb0
mov qword [r9 + 0x30], rdx
jne 0x140008a43
lea rdx, [r8 + 0xf]
test r8, r8
mov rcx, qword [r9 + 0x18]
cmovns rdx, r8
sar rdx, 4
cmp r9, qword [rax + rdx*8]
je 0x140008c18
mov rdx, qword [r9 + 0x20]
test rcx, rcx
mov qword [rdx + 0x18], rcx
je 0x140008b36
mov rdx, qword [r9 + 0x20]
mov qword [rcx + 0x20], rdx
mov rdx, r9
mov rcx, rax
pxor xmm0, xmm0
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x28
jmp sym.freeBigChunk__system_u6571
mov rcx, r9
sar rcx, 0x15
movzx edx, cl
mov rdx, qword [rax + rdx*8 + 0x20a0]
test rdx, rdx
jne 0x140008b88
jmp 0x140008bb3
mov rdx, qword [rdx]
test rdx, rdx
je 0x140008bb3
cmp rcx, qword [rdx + 8]
jne 0x140008b80
mov rcx, r9
mov r10d, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl r10, cl
sar r11, 6
not r10
and qword [rdx + r11*8 + 0x10], r10
mov rdx, qword [rax + 0x2070]
mov rcx, rdx
sub rcx, r8
mov r8d, 0x8000
movq xmm0, rcx
mov rcx, qword [rax + 0x2078]
cmp rdx, rcx
cmovl rdx, rcx
mov rcx, r9
movq xmm1, rdx
xor edx, edx
punpcklqdq xmm0, xmm1
movups xmmword [rax + 0x2070], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140008a43
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop word [rax + rax]
test rcx, rcx
mov qword [rax + rdx*8], rcx
je 0x140008b36
mov qword [rcx + 0x20], 0
jmp 0x140008b36
Function at 0x140009000
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov r9, rbx
and r9, 0xfffffffffffff000
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
cmp rdx, 0xfb0
jle 0x140009060
lea rcx, [r8 + 0x2098]
cmp rax, r8
lea r10, [r9 + 0x18]
je 0x1400090e0
mov rax, qword [rcx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rcx], r9
jne 0x1400090d0
add rsp, 0x20
pop rbx
ret
cmp rax, r8
je 0x140009080
lea rdx, [r9 + 0x40]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rbx]
lock cmpxchg qword [rdx], rbx
je 0x140009053
mov qword [rbx], rax
jmp 0x140009069
sub qword [r8 + 0x2088], rdx
mov rax, qword [r9 + 0x28]
mov qword [rbx], rax
mov rax, qword [r9 + 0x30]
mov qword [r9 + 0x28], rbx
cmp rdx, rax
jle 0x140009108
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
sar rax, 4
mov rcx, qword [r8 + rax*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x1400090bb
mov qword [rcx + 0x20], r9
mov qword [r8 + rax*8], r9
add qword [r9 + 0x30], rdx
add rsp, 0x20
pop rbx
ret
mov qword [r10], rax
jmp 0x140009043
sub qword [rax + 0x2088], rdx
mov rdx, r9
mov r10, qword [r9 + 8]
cmp r10, 0x3f000000
jg 0x140009170
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
add rax, rdx
cmp rax, 0xfb0
mov qword [r9 + 0x30], rax
jne 0x140009053
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
mov rdx, qword [r9 + 0x18]
sar rax, 4
cmp r9, qword [r8 + rax*8]
je 0x140009228
mov rax, qword [r9 + 0x20]
test rdx, rdx
mov qword [rax + 0x18], rdx
je 0x14000914d
mov rax, qword [r9 + 0x20]
mov qword [rdx + 0x20], rax
mov rdx, r9
mov rcx, r8
pxor xmm0, xmm0
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
sar rdx, 0x15
movzx eax, dl
mov rax, qword [r8 + rax*8 + 0x20a0]
test rax, rax
jne 0x140009198
jmp 0x1400091c2
mov rax, qword [rax]
test rax, rax
je 0x1400091c2
cmp rdx, qword [rax + 8]
jne 0x140009190
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rcx, r9
mov rdx, qword [r8 + 0x2078]
mov rbx, rax
sub rbx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rbx
xor edx, edx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140009053
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop word [rax + rax]
test rdx, rdx
mov qword [r8 + rax*8], rdx
je 0x14000914d
mov qword [rdx + 0x20], 0
jmp 0x14000914d
Function at 0x140009250
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14002e380]
call dbg.__emutls_get_address
mov r9, rbx
and r9, 0xfffffffffffff000
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
cmp rdx, 0xfb0
jle 0x1400092b0
lea rcx, [r8 + 0x2098]
cmp rax, r8
lea r10, [r9 + 0x18]
je 0x140009330
mov rax, qword [rcx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rcx], r9
jne 0x140009320
add rsp, 0x20
pop rbx
ret
cmp rax, r8
je 0x1400092d0
lea rdx, [r9 + 0x40]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rbx]
lock cmpxchg qword [rdx], rbx
je 0x1400092a3
mov qword [rbx], rax
jmp 0x1400092b9
sub qword [r8 + 0x2088], rdx
mov rax, qword [r9 + 0x28]
mov qword [rbx], rax
mov rax, qword [r9 + 0x30]
mov qword [r9 + 0x28], rbx
cmp rdx, rax
jle 0x140009358
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
sar rax, 4
mov rcx, qword [r8 + rax*8]
test rcx, rcx
mov qword [r9 + 0x18], rcx
je 0x14000930b
mov qword [rcx + 0x20], r9
mov qword [r8 + rax*8], r9
add qword [r9 + 0x30], rdx
add rsp, 0x20
pop rbx
ret
mov qword [r10], rax
jmp 0x140009293
sub qword [rax + 0x2088], rdx
mov rdx, r9
mov r10, qword [r9 + 8]
cmp r10, 0x3f000000
jg 0x1400093c0
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
add rax, rdx
cmp rax, 0xfb0
mov qword [r9 + 0x30], rax
jne 0x1400092a3
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
mov rdx, qword [r9 + 0x18]
sar rax, 4
cmp r9, qword [r8 + rax*8]
je 0x140009478
mov rax, qword [r9 + 0x20]
test rdx, rdx
mov qword [rax + 0x18], rdx
je 0x14000939d
mov rax, qword [r9 + 0x20]
mov qword [rdx + 0x20], rax
mov rdx, r9
mov rcx, r8
pxor xmm0, xmm0
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x20
pop rbx
jmp sym.freeBigChunk__system_u6571
sar rdx, 0x15
movzx eax, dl
mov rax, qword [r8 + rax*8 + 0x20a0]
test rax, rax
jne 0x1400093e8
jmp 0x140009412
mov rax, qword [rax]
test rax, rax
je 0x140009412
cmp rdx, qword [rax + 8]
jne 0x1400093e0
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rcx, r9
mov rdx, qword [r8 + 0x2078]
mov rbx, rax
sub rbx, r10
cmp rax, rdx
cmovl rax, rdx
movq xmm0, rbx
xor edx, edx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [r8 + 0x2070], xmm0
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x1400092a3
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop word [rax + rax]
test rdx, rdx
mov qword [r8 + rax*8], rdx
je 0x14000939d
mov qword [rdx + 0x20], 0
jmp 0x14000939d