joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d6435
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r13, 0x180000000
jmp 0x1800d6793
mov r12d, dword [rsp + 0x98]
jmp 0x1800d6682
lea r9, [rcx + rcx]
call fcn.1800d64b4
scasd eax, dword [rdi]
mov esp, 0xbb8836db
sal dword [r14 + reloc.KERNEL32.dll_GetFileSize], cl
lea edi, [rsp + 8]
lea rdi, [rsp + 8]
cpuid
dec rbp
jbe 0x1800d6488
lea r9, [rcx + rcx]
jmp 0x1800d653e
jmp 0x1800d649e
sub rsp, 0x238
jmp 0x1800d6547
mov rax, 0xfffffffffdbaa188
jmp 0x1800d6528
mov rcx, rsp
xchg r10b, r9b
neg sil
jmp 0x1800d6599
setle dl
mov r14, qword [rsp]
mov r10d, r12d
jmp 0x1800d657b
bswap r9d
mov r8d, ecx
cmp r8w, r12w
jp 0x1800d65ba
ror bx, cl
mov r9, 0xffffffff977b1244
jmp 0x1800d65d5
jns 0x1800d6556
setle dl
mov r14, qword [rsp]
jmp 0x1800d655d
mov r9, 0xffffffff977b1244
xchg r11d, r13d
lea r14, [rbx + r12]
jmp 0x1800d65bf
ror bx, cl
jmp 0x1800d65a4
lea r14, [r8 + r15]
mov r11, rbx
mov si, word [rsp]
mov r14, rcx
jmp 0x1800d65e2
xchg r11d, r13d
lea r14, [rbx + r12]
lea r14, [r8 + r15]
jmp 0x1800d65c3
add r12d, 0x60933eea
xchg r15w, r13w
lea r15, [rsi + r15]
jmp 0x1800d661a
shl r8d, 1
jge 0x1800d665f
bswap r9d
mov r11d, dword [rsp]
adc dl, 0x33
lea r9, [r8 + riz - 0x21]
bsr r14w, cx
jmp 0x1800d6668
adc dl, 0x33
lea r9, [r8 + riz - 0x21]
bsr r14w, cx
jmp 0x1800d6668
bswap r9d
mov r11d, dword [rsp]
jmp 0x1800d6649
lea r9, [rdi + rdi]
not r12d
bts edx, r8d
jo 0x1800d66bc
jno 0x1800d669c
mov eax, 0x2adfb82a
jmp 0x16caac94c
bswap r14d
not di
xchg bp, r14w
rol r11b, 4
jnp 0x1800d6501
jp 0x1800d6501
setle sil
lea rbx, [rcx + riz + 0xdd]
lea rbx, [rax + riz - 0x5281]
jmp 0x1800d67ac
setle sil
lea rbx, [rcx + riz + 0xdd]
lea rbx, [rax + riz - 0x5281]
xchg r15d, esi
shl r11w, 0xe
inc r12d
mov rbx, r14
jmp 0x1800d6721
push r14
lea r11, [rdx + r11]
rdtsc
jmp 0x1800d6701
mov ebx, 0xe3bcf64c
mov bx, r13w
jmp 0x1800d66e0
neg edx
ror r12d, 0
jne 0x1800d674f
mov rbp, qword [rsp]
btr r11, r15
clc
mov ebp, eax
and edx, 0x197ba241
jmp 0x1800d677a
neg bpl
jno 0x1800d66f6
mov ebx, 0xe3bcf64c
mov bx, r13w
push r14
lea r11, [rdx + r11]
rdtsc
jmp 0x1800d6701
btr r11, r15
clc
mov ebp, eax
jmp 0x1800d6774
mov rbp, qword [rsp]
jmp 0x1800d6739
xchg qword [rsp], r13
adc r13, r12
jne 0x1800d678a
mov bx, 0xb038
jmp 0x1800d63b2
and edx, 0x197ba241
lea rsp, [rsp + 8]
add r12d, 0x2ff1cc34
push r8
jmp 0x1800d6755
mov bx, 0xb038
jmp 0x1800d63b2
shl esi, cl
jmp 0x1800d67b9
xchg r15d, esi
shl r11w, 0xe
jmp 0x1800d66d8
jge 0x1800d67d6
mov sil, byte [rsp]
mov r11w, word [rsp]
jmp 0x1800d6843
mov sil, byte [rsp]
mov r11w, word [rsp]
mov r14w, ax
add r12, r13
mov r8w, 0x5e51
neg r14b
jl 0x1800d680a
bsf eax, ebx
xchg sil, r9b
jmp 0x1800d6826
jmp 0x1800d6820
bsf eax, ebx
xchg sil, r9b
add r12, qword [rdi + riz]
jmp 0x1800d6863
mov r14w, ax
jmp 0x1800d67e3
mov edx, 0x1104645b
bswap r8
mov eax, dword [rsp]
call fcn.1800d682c

Function at 0x1800d6640
Capabilities:
Execute anti-debugging instructions

Disassembly:
setae r14b
xchg qword [rsp + 0x10], rbp
call fcn.1800d6519
mov dx, si
lea rbp, [rbp + riz + 0x39]
mov bl, byte [rsp]
lea r9, [rdx + riz - 0xea]
pushfq
mov rbx, 0x6e03a326
jmp 0x1800d656d
mov r13, qword [rsp + 4]
bswap edx
jmp 0x1800d65fa
Function at 0x1800d7592
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [rsp + 2]
push word [rsp + 1]
call fcn.1800d757c
pushfq
xor dl, byte [rbp - 0x5c]
and ebp, dword [rcx - 0x17]
jns 0x1800d75c3
jmp 0x1800d760c
or bl, ch
invalid
cmp eax, 0xbb4829b9
prefetcht0 byte [rax - 1]
je 0x1800d763b
invalid
and al, 3

Function at 0x1800d7efe
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dx, 0x3df1
js 0x1800d7f33
mov edx, dword [rsp + 6]
jmp 0x1800d7f4b
jmp 0x1800d7f1d

Function at 0x180179755
Capabilities:
Encode data using xor

Disassembly:
mov word [rsp], cx
jmp 0x18017978d
add r10, rbx
lea rsp, [rsp + 8]
jmp fcn.1800c5e85
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xchg ecx, eax
invalid
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400f8350]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400f8360]
mov dword [rax], 1
mov rax, qword [0x1400f8370]
mov dword [rax], 1
mov rax, qword [0x1400f82a0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400f8340]
mov dword [0x14010900c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400f8440]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400f8420]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400f8280]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x1400f83a0]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rdi
xor eax, eax
lock cmpxchg qword [rbx], rsi
jne 0x1400011b0
mov rsi, qword [0x1400f83b0]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140109008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1400f82e0]
mov rax, qword [rax]
test rax, rax
je 0x14000121f
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call dbg._pei386_runtime_relocator
mov rcx, qword [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x1400f8390]
lea rcx, [dbg.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call dbg._fpreset
mov ebx, dword [0x140109028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
mov r12, qword [0x140109020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
nop dword [rax]
mov rcx, qword [r12 + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x140109020], rbp
call dbg.__main
mov rax, qword [0x1400f8320]
mov r8, qword [0x140109018]
mov ecx, dword [0x140109028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140109020]
call sym.main
mov ecx, dword [0x14010900c]
mov dword [0x140109010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140109008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x1400f83b0]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011dd
mov ecx, 0x1f
call dbg._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011fc
mov rdx, qword [0x1400f83f0]
mov rcx, qword [0x1400f83e0]
call sym._initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001204
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001204
call sym._cexit
mov eax, dword [0x140109010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x1400f8410]
mov rcx, qword [0x1400f8400]
mov dword [rsi], 1
call sym._initterm
jmp 0x1400011f1
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sym.exit
nop
Function at 0x140004c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rdx, str._.16g
movq r8, xmm1
movapd xmm2, xmm1
mov rbx, rcx
call sym.sprintf.constprop.0
mov rdx, rbx
xor r9d, r9d
cdqe
lea r10, [rbx + rax]
test rax, rax
jg 0x140004c61
jmp 0x140004cf0
mov ecx, r8d
and ecx, 0xffffffdf
sub ecx, 0x41
cmp cl, 0x19
seta cl
cmp r8b, 0x2e
setne r8b
add rdx, 1
and ecx, r8d
xor ecx, 1
or r9d, ecx
cmp r10, rdx
je 0x140004c7d
movzx r8d, byte [rdx]
cmp r8b, 0x2c
jne 0x140004c38
mov byte [rdx], 0x2e
add rdx, 1
mov r9d, 1
cmp r10, rdx
jne 0x140004c61
mov rsi, rax
test r9b, r9b
je 0x140004cf0
movzx ecx, byte [rbx + rax - 1]
mov eax, ecx
and eax, 0xffffffdf
cmp al, 0x4e
je 0x140004d10
lea r8d, [rcx - 0x29]
cmp r8b, 0x3b
ja 0x140004ce5
movabs r9, 0x800000008000001
xor eax, eax
mov edx, 0x6e
bt r9, r8
jae 0x140004d20
lea rcx, [0x1400e1236]
nop dword [rax + rax]
mov byte [rbx + rax], dl
add rax, 1
movzx edx, byte [rcx + rax]
test dl, dl
jne 0x140004cc0
mov rcx, qword [0x1400f8300]
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140004ce5
mov esi, 3
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
ret
movzx ecx, byte [rbx + rax - 1]
mov edx, 0x302e
mov byte [rbx + rax + 2], 0
lea rsi, [rax + 2]
mov word [rbx + rax], dx
mov eax, ecx
and eax, 0xffffffdf
cmp al, 0x4e
jne 0x140004c93
mov edx, 0x6e
xor eax, eax
jmp 0x140004cb4
cmp cl, 0x46
jne 0x140004ce5
movzx ecx, byte [rbx]
mov edx, 0x69
xor eax, eax
lea r8, [0x1400e123a]
cmp cl, 0x2d
je 0x140004d55
nop dword [rax + rax]
mov byte [rbx + rax], dl
add rax, 1
movzx edx, byte [r8 + rax]
test dl, dl
jne 0x140004d40
jmp 0x140004ccf
lea rdx, str._inf
nop dword [rax]
mov byte [rbx + rax], cl
add rax, 1
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x140004d60
mov rcx, qword [0x1400f8300]
call dbg.__emutls_get_address
cmp byte [rax], 0
mov eax, 4
cmove rsi, rax
jmp 0x140004ce5

Function at 0x140004fe0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [0x1400f8300]
xor ebx, ebx
mov rdi, qword [rcx]
mov rsi, qword [rcx + 8]
test rdi, rdi
jg 0x14000501f
jmp 0x14000509d
sub rax, 0x10
jo 0x1400050ab
mov qword [rcx - 0x10], rax
add rbx, 1
cmp rdi, rbx
je 0x140005075
mov rcx, qword [rsi + rbx*8 + 8]
test rcx, rcx
je 0x140005016
mov rax, qword [rcx - 0x10]
lea rdx, [rcx - 0x10]
cmp rax, 0xf
ja 0x140005008
cmp qword [rdx + 8], 0
jle 0x14000504b
mov rcx, rdx
call sym.unregisterCycle__system_u2958
mov rcx, qword [rsi + rbx*8 + 8]
call fcn.14009e620
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x14000507b
mov rcx, qword [rsi + rbx*8 + 8]
mov edx, 8
add rbx, 1
call sym.nimRawDispose
cmp rdi, rbx
jne 0x14000501f
test byte [rsi + 7], 0x40
je 0x140005088
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.alignedDealloc
test rsi, rsi
jne 0x140005075
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.raiseOverflow
jmp 0x140005016
Function at 0x140007870
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rax, [0x1400e1400]
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x20]
mov edx, 0xfa0
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov rbp, qword [0x1400f8300]
mov qword [rsp + 0x40], rax
mov rbx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
test rbx, rbx
jle 0x140007a58
nop word [rax + rax]
mov rax, qword [rsp + 0x48]
mov r9, rsi
mov r8d, 0xfa0
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov rbx, rax
cmp rax, 0xfa0
je 0x1400079e0
mov rcx, rsi
call sym.ferror
test eax, eax
je 0x140007927
mov rcx, rsi
call sym.checkErr__stdZsyncio_u165.part.0
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140007a90
test rbx, rbx
js 0x140007ab0
mov rdx, rbx
lea rcx, [rsp + 0x40]
call sym.setLengthStrV2
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
jle 0x1400079b8
mov rax, rbx
add rax, 1
jo 0x140007a8b
test rax, rax
js 0x140007ace
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
lea r9, [r8 + rdx + 8]
lea rdx, [rcx + 8]
mov r8, rax
mov rcx, r9
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140007a8b
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x48]
nop dword [rax]
test rcx, rcx
je 0x1400079c7
test byte [rcx + 7], 0x40
je 0x140007aa0
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbp
call dbg.__emutls_get_address
cmp byte [rax], 0
jne 0x140007a90
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jle 0x140007a58
mov rcx, rbx
add rcx, 1
jo 0x140007a6d
test rcx, rcx
js 0x140007a78
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r8, rcx
lea rax, [rdx + rax + 8]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
add rdx, 8
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140007a6d
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jg 0x1400078e8
nop dword [rax + rax]
xor ecx, ecx
lea rdx, [rbx - 1]
call sym.raiseIndexError2
mov rcx, qword [rsp + 0x48]
jmp 0x1400079b8
call sym.raiseOverflow
jmp 0x140007a45
movabs r8, 0x7fffffffffffffff
xor edx, edx
call sym.raiseRangeErrorI
jmp 0x140007a45
call sym.raiseOverflow
mov rcx, qword [rsp + 0x48]
jmp 0x1400079b8
call sym.deallocShared
jmp 0x1400079c7
movabs r8, 0x7fffffffffffffff
mov rcx, rbx
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x1400079b8
movabs r8, 0x7fffffffffffffff
mov rcx, rax
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x1400079b8
Function at 0x140007af0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov qword [rsp + 0x38], 0
test r8, r8
js 0x140007bf0
lea r14, [rsp + 0x20]
mov rdx, r8
mov rcx, r14
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
test rdx, rdx
jle 0x140007c40
mov rax, qword [rsp + 0x38]
mov r9, rsi
mov r8, rbx
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov rbp, rax
cmp rbx, rax
je 0x140007b83
mov rcx, rsi
call sym.ferror
test eax, eax
jne 0x140007c10
mov rcx, qword [0x1400f8300]
call dbg.__emutls_get_address
cmp byte [rax], 0
mov r12, rax
jne 0x140007bd3
mov rcx, rsi
call sym.fgetc
mov rdx, rsi
mov ecx, eax
mov r13d, eax
call sym.ungetc
cmp byte [r12], 0
jne 0x140007bd3
test r13d, r13d
jns 0x140007c50
cmp rbx, rbp
jle 0x140007bd3
test rbp, rbp
js 0x140007c20
lea rcx, [rsp + 0x30]
mov rdx, rbp
call sym.setLengthStrV2
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
call sym.raiseRangeErrorI
jmp 0x140007bd3
mov rcx, rsi
call sym.checkErr__stdZsyncio_u165.part.0
jmp 0x140007b83
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
call sym.raiseRangeErrorI
jmp 0x140007bd3
sub rdx, 1
xor ecx, ecx
call sym.raiseIndexError2
jmp 0x140007bd3
mov rdx, rsi
mov rcx, r14
call sym.readAllBuffer__stdZsyncio_u519
cmp byte [r12], 0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jne 0x140007cb6
lea rcx, [rsp + 0x30]
mov rdx, rbx
call sym.prepareAdd
test rbx, rbx
jle 0x140007cb6
mov rcx, rbx
add rcx, 1
jo 0x140007cd6
test rcx, rcx
js 0x140007ce0
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r8, rcx
lea rax, [rdx + rax + 8]
lea rdx, [rsi + 8]
mov rcx, rax
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x140007cd6
mov qword [rsp + 0x30], rbx
test rsi, rsi
je 0x140007bd3
test byte [rsi + 7], 0x40
jne 0x140007bd3
mov rcx, rsi
call sym.deallocShared
jmp 0x140007bd3
call sym.raiseOverflow
jmp 0x140007cb6
movabs r8, 0x7fffffffffffffff
xor edx, edx
call sym.raiseRangeErrorI
jmp 0x140007cb6

Function at 0x140008510
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x14000852f
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sym.fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fflush
Function at 0x140008610
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
mov ecx, 2
call rsi
lea rdx, str.could_not_load:
mov rcx, rax
add rbx, 8
call sym.rawWrite
test rdi, rdi
mov ecx, 2
lea rax, [0x1400e1518]
cmove rbx, rax
call rsi
mov rcx, rax
mov rdx, rbx
call sym.rawWrite
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
je 0x14000868c
mov ecx, 2
call rsi
lea rdx, [0x1400e1561]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
mov ecx, 2
call rsi
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call sym.rawWrite
jmp 0x14000866c

Function at 0x1400086b0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call sym.rawWrite
mov ecx, 2
call rbx
lea rdx, [0x1400e1561]
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop dword [rax]

Function at 0x140008860
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140109120]
test rax, rax
je 0x140008872
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
nop word [rax + rax]

Function at 0x14000a2a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r10, qword [rdx + 8]
mov r9, rdx
sar rdx, 0x15
mov r8, rcx
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x20a0]
test rax, rax
jne 0x14000a2d0
jmp 0x14000a2fa
mov rax, qword [rax]
test rax, rax
je 0x14000a2fa
cmp rdx, qword [rax + 8]
jne 0x14000a2c8
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
mov rax, qword [r8 + 0x2070]
mov rdx, qword [r8 + 0x2078]
mov rcx, r9
cmp rdx, rax
cmovl rdx, rax
sub rax, r10
mov qword [r8 + 0x2070], rax
mov qword [r8 + 0x2078], rdx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x14000a33a
add rsp, 0x28
ret
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14000a360
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [rdx + 8]
sub qword [rcx + 0x2088], rax
mov r10, qword [rdx + 8]
mov r8, rcx
mov r9, rdx
cmp r10, 0x3f000000
jg 0x14000a390
add rsp, 0x28
jmp sym.freeBigChunk__system_u6557
sar rdx, 0x15
movzx eax, dl
mov rax, qword [rcx + rax*8 + 0x20a0]
test rax, rax
jne 0x14000a3f8
nop dword [rax]
mov rax, qword [r8 + 0x2070]
mov rdx, qword [r8 + 0x2078]
mov rcx, r9
cmp rdx, rax
cmovl rdx, rax
sub rax, r10
mov qword [r8 + 0x2070], rax
mov qword [r8 + 0x2078], rdx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x14000a424
add rsp, 0x28
ret
mov rax, qword [rax]
test rax, rax
je 0x14000a3a8
cmp rdx, qword [rax + 8]
jne 0x14000a3f0
mov rcx, r9
mov edx, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl rdx, cl
sar r11, 6
not rdx
and qword [rax + r11*8 + 0x10], rdx
jmp 0x14000a3a8
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop
nop dword [rax + rax]
Function at 0x14000a440
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r9, rdx
mov rax, rcx
and r9, 0xfffffffffffff000
mov rcx, qword [r9 + 8]
cmp rcx, 0xfb0
jle 0x14000a490
mov r8, qword [r9 + 0x10]
lea r10, [r9 + 0x18]
lea rdx, [r8 + 0x2098]
cmp r8, rax
je 0x14000a510
mov rax, qword [rdx]
mov qword [r10], rax
mov rax, qword [r10]
lock cmpxchg qword [rdx], r9
jne 0x14000a500
add rsp, 0x28
ret
cmp qword [r9 + 0x10], rax
je 0x14000a4b0
lea rcx, [r9 + 0x40]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rdx]
lock cmpxchg qword [rcx], rdx
je 0x14000a486
mov qword [rdx], rax
jmp 0x14000a49a
sub qword [rax + 0x2088], rcx
mov r8, qword [r9 + 0x28]
mov qword [rdx], r8
mov qword [r9 + 0x28], rdx
mov rdx, qword [r9 + 0x30]
cmp rdx, rcx
jge 0x14000a538
test rcx, rcx
lea rdx, [rcx + 0xf]
cmovns rdx, rcx
sar rdx, 4
mov r8, qword [rax + rdx*8]
mov qword [r9 + 0x18], r8
test r8, r8
je 0x14000a4eb
mov qword [r8 + 0x20], r9
mov qword [rax + rdx*8], r9
add qword [r9 + 0x30], rcx
add rsp, 0x28
ret
mov qword [r10], rax
jmp 0x14000a476
sub qword [r8 + 0x2088], rcx
mov r10, qword [r9 + 8]
cmp r10, 0x3f000000
jg 0x14000a5a0
mov rdx, r9
mov rcx, r8
add rsp, 0x28
jmp sym.freeBigChunk__system_u6557
add rdx, rcx
mov qword [r9 + 0x30], rdx
cmp rdx, 0xfb0
jne 0x14000a486
test rcx, rcx
lea rdx, [rcx + 0xf]
cmovns rdx, rcx
mov rcx, qword [r9 + 0x18]
sar rdx, 4
cmp r9, qword [rax + rdx*8]
je 0x14000a650
mov rdx, qword [r9 + 0x20]
mov qword [rdx + 0x18], rcx
test rcx, rcx
je 0x14000a57e
mov rdx, qword [r9 + 0x20]
mov qword [rcx + 0x20], rdx
pxor xmm0, xmm0
mov rdx, r9
mov rcx, rax
mov qword [r9 + 8], 0x1000
movups xmmword [r9 + 0x18], xmm0
add rsp, 0x28
jmp sym.freeBigChunk__system_u6557
mov rcx, r9
sar rcx, 0x15
movzx edx, cl
mov rdx, qword [rax + rdx*8 + 0x20a0]
test rdx, rdx
jne 0x14000a5c8
jmp 0x14000a5f3
mov rdx, qword [rdx]
test rdx, rdx
je 0x14000a5f3
cmp rcx, qword [rdx + 8]
jne 0x14000a5c0
mov rcx, r9
mov r8d, 1
sar rcx, 0xc
and ecx, 0x1ff
mov r11, rcx
shl r8, cl
sar r11, 6
not r8
and qword [rdx + r11*8 + 0x10], r8
mov rdx, qword [rax + 0x2070]
mov rcx, qword [rax + 0x2078]
mov r8d, 0x8000
cmp rcx, rdx
cmovl rcx, rdx
sub rdx, r10
mov qword [rax + 0x2070], rdx
xor edx, edx
mov qword [rax + 0x2078], rcx
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x14000a486
lea rcx, str.virtualFree_failing_
call sym.printf.constprop.0
mov ecx, 1
call sym.exit
nop dword [rax + rax]
mov qword [rax + rdx*8], rcx
test rcx, rcx
je 0x14000a57e
mov qword [rcx + 0x20], 0
jmp 0x14000a57e

Function at 0x14000a850
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1400de4c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968

Function at 0x14000a880
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1400de4c0]
call dbg.__emutls_get_address
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sym.rawDealloc__system_u6968