joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a2cf
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov r13, qword [rdx]
mov rax, qword [rcx]
mov rsi, qword [rdx + 8]
mov rbp, rcx
mov rdi, r13
cmp rax, r13
jle 0x14000a30b
cmp rax, rsi
jle 0x14000a30b
test r13, r13
js 0x14000a30b
cmp rsi, r13
jge 0x14000a3b3
jmp 0x14000a46d
lea rdi, [rsp + 0x30]
mov edx, 8
mov ecx, 0x40
call fcn.140005cfc
mov qword [rsp + 0x68], rsi
mov ecx, 6
lea r12, [0x14002d1e0]
mov rbx, rax
mov rax, qword [0x140032660]
mov qword [rsp + 0x60], r13
mov qword [rbx + 0x10], r12
lea rsi, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov qword [rbx], rax
mov rax, qword [rbp]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x50]
rep movsd dword [rdi], dword [rsi]
mov rcx, rax
call fcn.140001d1a
mov rcx, qword [0x140032710]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x18], xmm0
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x14000a46d
xor eax, eax
mov rdx, r12
mov rcx, rbx
mov qword [rbx + 8], rax
lea r9, str.strutils.nim
mov qword [rsp + 0x20], 0x61a
lea r8, str.delete
call fcn.140004f19
jmp 0x14000a46d
inc rsi
sub rax, rsi
jo 0x14000a3c3
add rax, r13
mov rbx, rax
jno 0x14000a3e9
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400049da
mov rax, qword [rbp + 8]
mov dl, byte [rax + rsi + 8]
inc rsi
mov byte [rax + rdi + 8], dl
inc rdi
cmp rbx, rdi
jg 0x14000a416
test rbx, rbx
jns 0x14000a453
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140005075
mov rdx, qword [rbp]
cmp rdx, rdi
jg 0x14000a427
dec rdx
mov rcx, rdi
jmp 0x14000a43f
mov rcx, rbp
call fcn.140009b62
cmp qword [rbp], rsi
jg 0x14000a3d7
mov rdx, qword [rbp]
mov rcx, rsi
dec rdx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.14000603a
mov rdx, rbx
mov rcx, rbp
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140005b1a
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x14000a53c
Capabilities:
Terminate process

Disassembly:
mov rax, qword [rcx]
test rax, rax
mov r8, rcx
je 0x14000a599
dec rax
test rax, rax
jns 0x14000a568
inc rax
mov rcx, rax
jns 0x14000a58e
movabs r8, 0x7fffffffffffffff
xor edx, edx
jmp fcn.140005075
mov rcx, qword [r8 + 8]
mov cl, byte [rcx + rax + 8]
mov r9d, ecx
and ecx, 7
shr r9b, 3
movzx r9d, r9b
movzx r9d, byte [rdx + r9]
shr r9d, cl
and r9b, 1
jne 0x14000a547
jmp 0x14000a54f
mov rdx, rax
mov rcx, r8
jmp fcn.140005b1a
ret

Function at 0x14000a8a0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor esi, esi
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rsi, rdi
jl 0x14000a8bc
test rbx, rbx
jne 0x14000a8dd
jmp 0x14000a8f7
mov rax, rsi
shl rax, 4
mov rcx, qword [rbx + rax + 0x10]
test rcx, rcx
je 0x14000a8d8
test byte [rcx + 7], 0x40
jne 0x14000a8d8
call fcn.140004902
inc rsi
jmp 0x14000a8b0
test byte [rbx + 7], 0x40
jne 0x14000a8f7
mov edx, 8
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140004904
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14000a96f
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor eax, eax
mov r8, rcx
mov rdi, rdx
mov ecx, 0xc
rep stosd dword [rdi], eax
mov rcx, r8
mov rsi, rdx
call fcn.140009773
mov rcx, qword [0x140032710]
mov rbx, rax
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x14000a9ef
mov rax, rbx
sub rax, 1
jo 0x14000a9d1
test rbx, rbx
mov qword [rsi + 0x28], rax
jns 0x14000a9dd
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140005075
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, rbx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400077ec
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x14000abae
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
cmp qword [rcx + 0x28], 0
mov rbx, rcx
jne 0x14000ac0c
mov ecx, 4
call fcn.140009773
mov rcx, qword [0x140032710]
mov rsi, rax
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x14000ad76
mov rax, rsi
sub rax, 1
jo 0x14000ac2c
test rsi, rsi
mov qword [rbx + 0x28], rax
js 0x14000ac4b
mov rdx, rsi
mov rcx, rbx
call fcn.1400077ec
mov rsi, qword [rbx + 0x28]
add rsi, 1
jo 0x14000ac2c
cmp rsi, qword [rbx + 0x20]
jg 0x14000ad76
xor ebp, ebp
imul rsi, rsi, 2
seto bpl
jno 0x14000ac46
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400049da
test rsi, rsi
jns 0x14000ac74
movaps xmm6, xmmword [rsp + 0x50]
xor edx, edx
mov rcx, rsi
movabs r8, 0x7fffffffffffffff
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140005075
lea rax, [rsp + 0x40]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r15, [rsp + 0x30]
mov rcx, rax
call fcn.140007812
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rbx + 0x10]
lea r14, [r13 + 8]
cmp qword [rbx + 0x20], rbp
jg 0x14000acfd
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r13
call fcn.14000ab59
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x14000ad76
mov rax, qword [rbx + 0x20]
dec rsi
mov rcx, qword [rsp + 0x28]
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x18], rax
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.14000a8a0
jmp 0x14000ad76
test rdi, rdi
mov rdx, qword [rbx]
js 0x14000ad0a
cmp rdx, rdi
jg 0x14000ad12
dec rdx
mov rcx, rdi
jmp 0x14000ad2f
mov rdx, qword [rbx + 8]
mov rax, rdi
shl rax, 4
cmp rbp, r12
lea rcx, [rdx + rax + 8]
jl 0x14000ad49
lea rdx, [r12 - 1]
mov rcx, rbp
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.14000603a
movups xmm6, xmmword [rdx + rax + 8]
inc rdi
inc rbp
call fcn.14000497e
mov rcx, r14
mov rdx, r15
add r14, 0x10
movaps xmmword [rsp + 0x30], xmm6
call fcn.140006e8e
and rdi, qword [rbx + 0x28]
jmp 0x14000aca0
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000ae30
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x14000ae8f
mov rcx, rax
add rcx, 1
jo 0x14000ae6b
test rcx, rcx
jns 0x14000ae72
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x14000ae6b
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x14000bb3f
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14000bb53
test byte [rcx + 7], 0x40
jne 0x14000bb53
jmp fcn.140004902
ret
Function at 0x14000c612
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000c626
test byte [rcx + 7], 0x40
jne 0x14000c626
jmp fcn.140004902
ret

Function at 0x14000c9a0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x14000c9ff
mov rcx, rax
add rcx, 1
jo 0x14000c9db
test rcx, rcx
jns 0x14000c9e2
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x14000c9db
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x14000cb17
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14000cb2b
test byte [rcx + 7], 0x40
jne 0x14000cb2b
jmp fcn.140004902
ret
Function at 0x14000cd21
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb0
mov edx, 1
lea rbp, [rsp + 0x20]
mov rbx, rcx
lea rcx, [0x14002d8b0]
call fcn.140006c81
cmp word [rbx + 0x5e], 0x2000
lea rax, [0x14002e360]
mov rcx, rbp
mov r14d, dword [rbx]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0x1a
mov r12d, dword [rbx + 0x60]
sete dil
cmp dword [rbx + 0xec], 0
setne r13b
xor edx, edx
cmp r14w, 0x5a4d
sete dl
call fcn.14000767c
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 2
mov rbx, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
call fcn.140006c81
xor edx, edx
cmp r12w, 0x20b
mov rcx, rbp
lea rax, [0x14002e320]
sete dl
mov qword [rsp + 0x50], 0x18
mov qword [rsp + 0x58], rax
call fcn.14000767c
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x50]
mov edx, 2
mov rsi, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rsi
call fcn.140006c81
lea rax, [0x14002e300]
movzx edx, dil
mov rcx, rbp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0x16
call fcn.14000767c
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x70]
mov edx, 2
mov rdi, qword [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdi
call fcn.140006c81
lea rax, [0x14002e2c0]
mov rcx, rbp
movzx edx, r13b
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x90], 0x1e
call fcn.14000767c
mov rbp, qword [rsp + 0x28]
mov edx, 2
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xa0], rax
call fcn.140006c81
cmp r14w, 0x5a4d
jne 0x14000ceac
cmp r12w, 0x20b
je 0x14000ceba
jmp 0x14000cec1
lea rcx, [0x14002d8a0]
mov edx, 1
jmp 0x14000cecd
test rbp, rbp
jne 0x14000cedc
jmp 0x14000ceea
lea rcx, [0x14002d890]
mov edx, 1
call fcn.140006c81
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test byte [rbp + 7], 0x40
jne 0x14000ceea
mov rcx, rbp
call fcn.140004902
test rdi, rdi
je 0x14000cefd
test byte [rdi + 7], 0x40
jne 0x14000cefd
mov rcx, rdi
call fcn.140004902
test rsi, rsi
je 0x14000cf10
test byte [rsi + 7], 0x40
jne 0x14000cf10
mov rcx, rsi
call fcn.140004902
test rbx, rbx
je 0x14000cf23
test byte [rbx + 7], 0x40
jne 0x14000cf23
mov rcx, rbx
call fcn.140004902
mov eax, r13d
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14000df4b
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000df64
test byte [rcx + 7], 0x40
jne 0x14000df64
mov edx, 8
jmp fcn.140004904
ret

Function at 0x14000eff7
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x14002d760]
mov edx, 1
jmp fcn.140006c81
Function at 0x140011f20
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, qword [rsp + 0x90]
cmp rbp, 0xf
mov rbx, rcx
mov r12, rdx
mov rsi, r8
mov rdi, r9
jle 0x140011f4c
cmp rsi, 0x1f
jg 0x140011f9f
jmp 0x140011f78
movaps xmm0, xmmword [0x14002e460]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140001b4d
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
je 0x140011f44
jmp 0x140012008
movaps xmm1, xmmword [0x14002e400]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm1
call fcn.140001b4d
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x140012008
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.140011501
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x140012008
cmp rbp, 0xf
jg 0x140011fdd
mov r8, rbp
mov edx, 0xf
xor ecx, ecx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000742b
xor eax, eax
mov r9d, 0x10
mov r8, rdi
mov qword [rsp + 0x28], 0xf
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x3c8]
call fcn.1400073ac
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140012325
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140012384
mov rcx, rax
add rcx, 1
jo 0x140012360
test rcx, rcx
jns 0x140012367
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140012360
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x140012436
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
call fcn.1400121d9
test al, al
je 0x140012454
mov rcx, qword [rbx + 8]
call fcn.140004a9a
mov rcx, qword [rbx + 0x18]
call fcn.1400121d9
test al, al
je 0x14001246a
mov rcx, qword [rbx + 0x18]
call fcn.140004a9a
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140012483
test byte [rcx + 7], 0x40
jne 0x140012483
add rsp, 0x20
pop rbx
jmp fcn.140004902
add rsp, 0x20
pop rbx
ret

Function at 0x14001248b
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x58]
call fcn.1400123a5
test al, al
je 0x1400124cd
mov rcx, qword [rbx + 0x58]
call fcn.140012436
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x1400124cd
mov rcx, qword [rbx + 0x58]
mov edx, 8
add rsp, 0x20
pop rbx
jmp fcn.140004a6e
add rsp, 0x20
pop rbx
ret
Function at 0x140012af3
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r14, rcx
mov esi, edx
movzx ecx, dl
mov rdx, r8
mov rbp, r8
call fcn.140012a99
mov rcx, qword [0x140032710]
mov rbx, rax
call fcn.14001f5f0
cmp byte [rax], 0
mov rdi, rax
jne 0x140012cf2
cmp rbx, r14
jge 0x140012cf2
xor eax, eax
mov rdx, rbp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.140001bd2
cmp byte [rdi], 0
mov r13, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
jne 0x140012cf2
mov rcx, qword [rsp + 0x28]
movzx edx, sil
mov r8d, 2
call fcn.140009b77
cmp byte [rdi], 0
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
jne 0x140012cf2
mov rcx, qword [rsp + 0x28]
mov rdx, r14
call fcn.140001bd2
cmp byte [rdi], 0
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
jne 0x140012cf2
lea rsi, [rsp + 0x40]
lea rdx, [r13 + r15]
mov rcx, rsi
lea rdx, [rdx + rbx + 0x52]
call fcn.140005a53
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
movaps xmm0, xmmword [0x14002e860]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140012325
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rbp
call fcn.140012325
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
movaps xmm1, xmmword [0x14002e840]
movaps xmmword [rsp + 0x30], xmm1
call fcn.140012325
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r12
call fcn.140012325
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
movaps xmm2, xmmword [0x14002e840]
movaps xmmword [rsp + 0x30], xmm2
call fcn.140012325
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r14
call fcn.140012325
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
movaps xmm3, xmmword [0x14002e810]
movaps xmmword [rsp + 0x30], xmm3
call fcn.140012325
mov rcx, qword [rsp + 0x28]
movaps xmm4, xmmword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
movaps xmmword [rsp + 0x30], xmm4
call fcn.140001b4d
cmp byte [rdi], 0
jne 0x140012cf2
test rsi, rsi
je 0x140012ca6
test byte [rsi + 7], 0x40
jne 0x140012ca6
mov rcx, rsi
call fcn.140004902
test r14, r14
je 0x140012cba
test byte [r14 + 7], 0x40
jne 0x140012cba
mov rcx, r14
call fcn.140004902
test r12, r12
je 0x140012ccf
test byte [r12 + 7], 0x40
jne 0x140012ccf
mov rcx, r12
call fcn.140004902
test rbp, rbp
je 0x140012cf2
test byte [rbp + 7], 0x40
jne 0x140012cf2
mov rcx, rbp
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140004902
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140012f6f
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov rbp, rcx
mov r12, rdx
mov rsi, r8
mov qword [rsp + 0x38], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0x10]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400126f8
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
mov rdi, rax
jne 0x14001316f
movups xmm0, xmmword [rbp]
lea rcx, [rsp + 0x70]
mov r8, rbx
lea rdx, [rsp + 0x60]
movaps xmmword [rsp + 0x60], xmm0
call fcn.1400125c9
cmp byte [rdi], 0
mov rbx, qword [rsp + 0x70]
jne 0x14001316f
mov edx, 0x15180
mov rcx, rbx
call fcn.140009720
cmp byte [rdi], 0
mov r8, rax
jne 0x14001316f
imul rax, rax, 0x15180
jo 0x14001302d
sub rbx, rax
mov rcx, rbx
jno 0x140013045
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400049da
mov rax, rbx
mov r9d, 0xe10
cqo
idiv r9
mov r14, rax
imul rax, rax, 0xe10
sub rcx, rax
jo 0x14001302d
mov rax, rcx
mov r9d, 0x3c
mov rbx, rcx
cqo
idiv r9
mov r13, rax
imul rax, rax, 0x3c
sub rbx, rax
jo 0x14001302d
lea rcx, [rsp + 0x98]
mov rdx, r8
call fcn.1400128c3
cmp byte [rdi], 0
jne 0x14001316f
mov dl, byte [rsp + 0xa0]
lea rax, [0x14002b540]
cmp r14, 0x17
mov r15, qword [rsp + 0x98]
mov qword [rsi], rax
mov r8, qword [rsp + 0xa8]
movzx eax, dl
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], r8
mov qword [rsi + 0x28], r15
jbe 0x1400130db
mov r8d, 0x17
xor edx, edx
mov rcx, r14
jmp 0x140013107
cmp r13, 0x3b
mov qword [rsi + 0x20], r14
jbe 0x1400130f2
mov r8d, 0x3b
xor edx, edx
mov rcx, r13
jmp 0x140013107
cmp rbx, 0x3c
mov qword [rsi + 0x18], r13
jbe 0x14001311f
mov r8d, 0x3c
xor edx, edx
mov rcx, rbx
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140005075
mov rax, qword [rbp + 8]
mov qword [rsi + 0x10], rbx
movzx ebx, dl
mov rcx, r15
mov edx, ebx
mov qword [rsp + 0x58], r8
mov qword [rsi + 8], rax
call fcn.140012e1f
cmp byte [rdi], 0
jne 0x14001316f
mov r8, qword [rsp + 0x58]
mov byte [rsi + 0x40], al
mov edx, ebx
mov rcx, r15
call fcn.140012ebf
cmp byte [rdi], 0
jne 0x14001316f
mov qword [rsi + 0x48], rax
mov al, byte [rbp + 0x18]
mov qword [rsi + 0x58], r12
mov byte [rsi + 0x50], al
mov rax, qword [rbp + 0x10]
mov qword [rsi + 0x60], rax
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140013220
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov qword [rcx], rdx
mov rcx, rbx
call fcn.1400123a5
test al, al
je 0x140013262
mov rcx, rbx
call fcn.140012436
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x140013262
mov edx, 8
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140004a6e
add rsp, 0x20
pop rbx
ret
Function at 0x1400136ae
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [rcx]
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x1400136d8
mov rax, qword [rdx - 0x10]
add rax, 0x10
jo 0x1400136d3
mov qword [rdx - 0x10], rax
jmp 0x1400136d8
call fcn.1400049da
mov qword [rsi], rbx
mov rcx, rdi
call fcn.1400123a5
test al, al
je 0x140013714
mov rcx, rdi
call fcn.140012436
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x140013714
mov edx, 8
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140004a6e
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140013d01
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140013d60
mov rcx, rax
add rcx, 1
jo 0x140013d3c
test rcx, rcx
jns 0x140013d43
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140013d3c
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x1400143d0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x80000000
mov edx, 0xffffffff
add rax, rcx
cmp rdx, rax
jae 0x1400143f4
mov r8d, 0x7fffffff
mov rdx, 0xffffffff80000000
jmp fcn.140005075
mov rax, qword [0x1400325c0]
jmp qword [rax]

Function at 0x140014423
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140014482
mov rcx, rax
add rcx, 1
jo 0x14001445e
test rcx, rcx
jns 0x140014465
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x14001445e
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x140014485
Capabilities:
Terminate process

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x140014499
test byte [rax + 7], 0x40
je 0x140014499
jmp fcn.1400071cf
ret

Function at 0x1400163ac
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x14001640b
mov rcx, rax
add rcx, 1
jo 0x1400163e7
test rcx, rcx
jns 0x1400163ee
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x1400163e7
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x14001651e
Capabilities:
Terminate process

Disassembly:
jmp fcn.1400048dc
test rcx, rcx
je 0x140016528
jmp 0x140006718
ret
Function at 0x1400165b0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
call fcn.1400162a8
test al, al
je 0x140016601
lea rdi, [rsp + 0x20]
mov ecx, 6
mov rsi, rbx
rep movsd dword [rdi], dword [rsi]
lea rcx, [rsp + 0x20]
call fcn.14001659d
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x140016601
mov edx, 8
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
jmp fcn.140004a6e
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret

Function at 0x140016e28
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor ebp, ebp
mov r12, qword [rcx]
mov rbx, qword [rcx + 8]
lea r13, [rsp + 0x20]
cmp rbp, r12
jl 0x140016e4e
test rbx, rbx
jne 0x140016e9a
jmp 0x140016eb9
mov rcx, qword [rbx + rbp*8 + 8]
call fcn.1400162a8
test al, al
je 0x140016e95
mov rsi, qword [rbx + rbp*8 + 8]
lea rdi, [rsp + 0x20]
mov ecx, 6
rep movsd dword [rdi], dword [rsi]
mov rcx, r13
call fcn.14001659d
mov rcx, qword [0x140032710]
call fcn.14001f5f0
cmp byte [rax], 0
jne 0x140016eb9
mov rcx, qword [rbx + rbp*8 + 8]
mov edx, 8
call fcn.140004a6e
inc rbp
jmp 0x140016e42
test byte [rbx + 7], 0x40
jne 0x140016eb9
mov edx, 8
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140004904
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140018190
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x1400181ef
mov rcx, rax
add rcx, 1
jo 0x1400181cb
test rcx, rcx
jns 0x1400181d2
mov ecx, 1
xor edx, edx
movabs r8, 0x7fffffffffffffff
shl rcx, 0x3f
pop rsi
pop rdi
jmp fcn.140005075
pop rsi
pop rdi
jmp fcn.1400049da
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x1400181cb
mov qword [r8], rax
pop rsi
pop rdi
ret