joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007f27
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x14002f360]
call fcn.140023d60
cmp byte [rax], 0
je 0x140007f6e
lea rcx, [0x14002f260]
call fcn.140023d60
mov rcx, qword [rax]
mov rbx, rax
test rcx, rcx
je 0x140007f6e
call fcn.140007f02
mov rcx, rbx
xor edx, edx
call fcn.140005771
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
add rsp, 0x20
pop rbx
ret

Function at 0x140007fa0
Capabilities:
Terminate process

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x140007fb4
test byte [rax + 7], 0x40
je 0x140007fb4
jmp fcn.14000730b
ret

Function at 0x1400083fc
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
mov rbx, rcx
je 0x140008453
mov rax, qword [rcx - 0x10]
lea rdx, [rcx - 0x10]
cmp rax, 0xf
jbe 0x140008431
sub rax, 0x10
jo 0x140008426
mov qword [rcx - 0x10], rax
xor esi, esi
jmp 0x140008434
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400049fd
mov sil, 1
mov r8, qword [rbx]
movzx ecx, sil
call fcn.1400056f1
test sil, sil
je 0x140008453
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140004ab4
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140008d0c
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp qword [r8], rdx
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
jge 0x140008d2e
test rdx, rdx
js 0x140008d6c
mov rcx, r8
call fcn.140005a05
cmp qword [rbx], 0
lea rdx, [0x140030da5]
mov rax, qword [rbx + 8]
je 0x140008d43
lea rdx, [rax + 8]
mov r8, rsi
mov rcx, rdi
call fcn.1400086d2
mov rcx, qword [0x140037e00]
mov rsi, rax
call fcn.140023d60
cmp byte [rax], 0
jne 0x140008d99
cmp qword [rbx], rsi
je 0x140008d99
test rsi, rsi
jns 0x140008d87
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400050a1
mov rdx, rsi
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140005a05
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400096a1
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r9, r9
mov r12, rcx
mov rdi, rdx
mov rsi, r8
mov rbp, r9
jns 0x1400096da
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400050a1
mov rdx, r9
mov rcx, r8
xor ebx, ebx
call fcn.140005a05
cmp rbx, rbp
je 0x14000973c
mov rdx, qword [rsi]
cmp rdx, rbx
jg 0x1400096f9
dec rdx
jmp 0x140009719
mov rax, qword [rsi + 8]
test rax, rax
je 0x140009710
test byte [rax + 7], 0x40
je 0x140009710
mov rcx, rsi
call fcn.14000730b
cmp rbx, rdi
jl 0x14000972b
lea rdx, [rdi - 1]
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140005f3a
mov dl, byte [r12 + rbx]
mov rax, qword [rsi + 8]
mov byte [rax + rbx + 8], dl
inc rbx
jmp 0x1400096e7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140009b40
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140009b96
mov rcx, rax
add rcx, 1
jo 0x140009b72
test rcx, rcx
jns 0x140009b79
movabs r8, 0x7fffffffffffffff
xor edx, edx
pop rsi
pop rdi
jmp fcn.1400050a1
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140009b72
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x140009b99
Capabilities:
Terminate process

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x140009bad
test byte [rax + 7], 0x40
je 0x140009bad
jmp fcn.14000730b
ret

Function at 0x14000a46b
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov r13, qword [rdx]
mov rax, qword [rcx]
mov rsi, qword [rdx + 8]
xor edx, edx
mov rbp, rcx
mov rcx, r13
mov rdi, r13
not rcx
shr rcx, 0x3f
cmp rax, r13
cmovg edx, ecx
cmp rax, rsi
jle 0x14000a4b3
test dl, dl
je 0x14000a4b3
cmp rsi, r13
jge 0x14000a55b
jmp 0x14000a61f
lea rdi, [rsp + 0x30]
mov edx, 8
mov ecx, 0x40
call fcn.140005c06
mov qword [rsp + 0x68], rsi
mov ecx, 6
lea r12, [0x1400312a0]
mov rbx, rax
mov rax, qword [0x140037ce0]
mov qword [rsp + 0x60], r13
mov qword [rbx + 0x10], r12
lea rsi, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov qword [rbx], rax
mov rax, qword [rbp]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x50]
rep movsd dword [rdi], dword [rsi]
mov rcx, rax
call fcn.140001d2d
mov rcx, qword [0x140037e00]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x18], xmm0
call fcn.140023d60
cmp byte [rax], 0
jne 0x14000a61f
xor eax, eax
mov rdx, r12
mov rcx, rbx
mov qword [rbx + 8], rax
lea r9, str.strutils.nim
mov qword [rsp + 0x20], 0x61a
lea r8, str.delete
call fcn.140004f35
jmp 0x14000a61f
inc rsi
sub rax, rsi
jo 0x14000a56b
add rax, r13
mov rbx, rax
jno 0x14000a5b2
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400049fd
test rdi, rdi
mov rdx, qword [rbp]
js 0x14000a5df
cmp rdi, rdx
jge 0x14000a5df
mov rcx, rbp
call fcn.140009b99
test rsi, rsi
js 0x14000a5e7
cmp qword [rbp], rsi
jle 0x14000a5e7
mov rax, qword [rbp + 8]
mov dl, byte [rax + rsi + 8]
inc rsi
mov byte [rax + rdi + 8], dl
inc rdi
cmp rbx, rdi
jg 0x14000a57f
test rbx, rbx
jns 0x14000a605
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400050a1
dec rdx
mov rcx, rdi
jmp 0x14000a5f1
mov rdx, qword [rbp]
mov rcx, rsi
dec rdx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140005f3a
mov rdx, rbx
mov rcx, rbp
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140005a05
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14000a6fc
Capabilities:
Terminate process

Disassembly:
mov rax, qword [rcx]
test rax, rax
mov r8, rcx
je 0x14000a75d
dec rax
test rax, rax
jns 0x14000a728
inc rax
mov rcx, rax
je 0x14000a752
movabs r8, 0x7fffffffffffffff
xor edx, edx
jmp fcn.1400050a1
mov rcx, qword [r8 + 8]
mov cl, byte [rcx + rax + 8]
mov r9d, ecx
and ecx, 7
shr r9b, 3
movzx r9d, r9b
movzx r9d, byte [rdx + r9]
bt r9d, ecx
setb cl
test cl, cl
jne 0x14000a707
lea rcx, [rax + 1]
mov rdx, rcx
mov rcx, r8
jmp fcn.140005a05
ret

Function at 0x14000aab0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor esi, esi
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
cmp rsi, rdi
jl 0x14000aacc
test rbx, rbx
jne 0x14000aaed
jmp 0x14000ab07
mov rax, rsi
shl rax, 4
mov rcx, qword [rbx + rax + 0x10]
test rcx, rcx
je 0x14000aae8
test byte [rcx + 7], 0x40
jne 0x14000aae8
call fcn.140004925
inc rsi
jmp 0x14000aac0
test byte [rbx + 7], 0x40
jne 0x14000ab07
mov edx, 8
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140004927
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x14000ab7f
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor eax, eax
mov r8, rcx
mov rdi, rdx
mov ecx, 0xc
rep stosd dword [rdi], eax
mov rcx, r8
mov rsi, rdx
call fcn.1400097a1
mov rcx, qword [0x140037e00]
mov rbx, rax
call fcn.140023d60
cmp byte [rax], 0
jne 0x14000abff
mov rax, rbx
sub rax, 1
jo 0x14000abe1
test rbx, rbx
mov qword [rsi + 0x28], rax
jns 0x14000abed
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400050a1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, rbx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400077a4
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14000adbe
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
cmp qword [rcx + 0x28], 0
mov rbx, rcx
jne 0x14000ae1c
mov ecx, 4
call fcn.1400097a1
mov rcx, qword [0x140037e00]
mov rsi, rax
call fcn.140023d60
cmp byte [rax], 0
jne 0x14000af86
mov rax, rsi
sub rax, 1
jo 0x14000ae3c
test rsi, rsi
mov qword [rbx + 0x28], rax
js 0x14000ae5b
mov rdx, rsi
mov rcx, rbx
call fcn.1400077a4
mov rsi, qword [rbx + 0x28]
add rsi, 1
jo 0x14000ae3c
cmp rsi, qword [rbx + 0x20]
jg 0x14000af86
xor ebp, ebp
imul rsi, rsi, 2
seto bpl
jno 0x14000ae56
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400049fd
test rsi, rsi
jns 0x14000ae84
movaps xmm6, xmmword [rsp + 0x50]
xor edx, edx
mov rcx, rsi
movabs r8, 0x7fffffffffffffff
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400050a1
lea rax, [rsp + 0x40]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r15, [rsp + 0x30]
mov rcx, rax
call fcn.1400077ca
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rbx + 0x10]
lea r14, [r13 + 8]
cmp qword [rbx + 0x20], rbp
jg 0x14000af0d
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r13
call fcn.14000ad69
mov rcx, qword [0x140037e00]
call fcn.140023d60
cmp byte [rax], 0
jne 0x14000af86
mov rax, qword [rbx + 0x20]
dec rsi
mov rcx, qword [rsp + 0x28]
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x18], rax
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.14000aab0
jmp 0x14000af86
test rdi, rdi
mov rdx, qword [rbx]
js 0x14000af1a
cmp rdi, rdx
jl 0x14000af22
dec rdx
mov rcx, rdi
jmp 0x14000af3f
mov rdx, qword [rbx + 8]
mov rax, rdi
shl rax, 4
cmp rbp, r12
lea rcx, [rdx + rax + 8]
jl 0x14000af59
lea rdx, [r12 - 1]
mov rcx, rbp
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140005f3a
movups xmm6, xmmword [rdx + rax + 8]
inc rdi
inc rbp
call fcn.1400049a1
mov rcx, r14
mov rdx, r15
add r14, 0x10
movaps xmmword [rsp + 0x30], xmm6
call fcn.14000702e
and rdi, qword [rbx + 0x28]
jmp 0x14000aeb0
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000b040
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x14000b096
mov rcx, rax
add rcx, 1
jo 0x14000b072
test rcx, rcx
jns 0x14000b079
movabs r8, 0x7fffffffffffffff
xor edx, edx
pop rsi
pop rdi
jmp fcn.1400050a1
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x14000b072
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x14000c0bf
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14000c0d3
test byte [rcx + 7], 0x40
jne 0x14000c0d3
jmp fcn.140004925
ret
Function at 0x14000cffb
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000d00f
test byte [rcx + 7], 0x40
jne 0x14000d00f
jmp fcn.140004925
ret

Function at 0x14000d48f
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x14000d4e5
mov rcx, rax
add rcx, 1
jo 0x14000d4c1
test rcx, rcx
jns 0x14000d4c8
movabs r8, 0x7fffffffffffffff
xor edx, edx
pop rsi
pop rdi
jmp fcn.1400050a1
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x14000d4c1
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x14000d601
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14000d615
test byte [rcx + 7], 0x40
jne 0x14000d615
jmp fcn.140004925
ret
Function at 0x14000fa2f
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000fa48
test byte [rcx + 7], 0x40
jne 0x14000fa48
mov edx, 8
jmp fcn.140004927
ret
Function at 0x1400145c0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r14, qword [rsp + 0xe0]
cmp r14, 0xf
mov rbx, rcx
mov r12, rdx
mov rbp, r8
mov r13, r9
jle 0x1400145f6
cmp rbp, 0x1f
jg 0x1400146c5
jmp 0x140014667
movaps xmm0, xmmword [0x140032ef0]
lea r15, [rsp + 0x50]
movaps xmm1, xmmword [0x140032e70]
lea rdx, [rsp + 0x40]
mov rcx, r15
lea r8, [rsp + 0x30]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm1
call fcn.14000bdeb
mov rcx, qword [0x140037e00]
mov rsi, qword [rsp + 0x58]
call fcn.140023d60
cmp byte [rax], 0
mov rdi, rax
jne 0x140014763
mov rcx, r15
call fcn.140001b5d
test rsi, rsi
je 0x14001465d
test byte [rsi + 7], 0x40
jne 0x14001465d
mov rcx, rsi
call fcn.140004925
cmp byte [rdi], 0
je 0x1400145ea
jmp 0x14001476c
movaps xmm2, xmmword [0x140032ef0]
lea r15, [rsp + 0x50]
movaps xmm3, xmmword [0x140032de0]
lea rdx, [rsp + 0x40]
mov rcx, r15
lea r8, [rsp + 0x30]
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm3
call fcn.14000bdeb
mov rcx, qword [0x140037e00]
mov rsi, qword [rsp + 0x58]
call fcn.140023d60
cmp byte [rax], 0
mov rdi, rax
jne 0x1400146e9
mov rcx, r15
call fcn.140001b5d
test rsi, rsi
jne 0x1400146ee
cmp byte [rdi], 0
jne 0x14001476c
mov r8, rbp
mov rdx, r12
mov rcx, rbx
call fcn.140013bb2
mov rcx, qword [0x140037e00]
call fcn.140023d60
cmp byte [rax], 0
je 0x1400146fe
jmp 0x14001476c
test rsi, rsi
je 0x14001476c
test byte [rsi + 7], 0x40
jne 0x1400146bc
mov rcx, rsi
call fcn.140004925
jmp 0x1400146bc
mov qword [rsp + 0x68], 0xf
xor eax, eax
cmp r14, 0xf
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
jg 0x14001473d
mov r8, r14
mov edx, 0xf
xor ecx, ecx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140006e74
mov qword [rsp + 0x28], rdx
lea rcx, [rbx + 0x3c8]
mov r9d, 0x10
mov r8, r13
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.1400074f0
jmp 0x14001476c
test rsi, rsi
jne 0x14001464f
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140014a8a
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140014ae0
mov rcx, rax
add rcx, 1
jo 0x140014abc
test rcx, rcx
jns 0x140014ac3
movabs r8, 0x7fffffffffffffff
xor edx, edx
pop rsi
pop rdi
jmp fcn.1400050a1
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140014abc
mov qword [r8], rax
pop rsi
pop rdi
ret
Function at 0x140014b92
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
call fcn.14001493f
test al, al
je 0x140014bb0
mov rcx, qword [rbx + 8]
call fcn.140004ab4
mov rcx, qword [rbx + 0x18]
call fcn.14001493f
test al, al
je 0x140014bc6
mov rcx, qword [rbx + 0x18]
call fcn.140004ab4
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140014bdf
test byte [rcx + 7], 0x40
jne 0x140014bdf
add rsp, 0x20
pop rbx
jmp fcn.140004925
add rsp, 0x20
pop rbx
ret

Function at 0x140014be7
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x58]
call fcn.140014b01
test al, al
je 0x140014c29
mov rcx, qword [rbx + 0x58]
call fcn.140014b92
mov rcx, qword [0x140037e00]
call fcn.140023d60
cmp byte [rax], 0
jne 0x140014c29
mov rcx, qword [rbx + 0x58]
mov edx, 8
add rsp, 0x20
pop rbx
jmp fcn.140004a88
add rsp, 0x20
pop rbx
ret
Function at 0x1400152ad
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r14, rcx
mov esi, edx
movzx ecx, dl
mov rdx, r8
mov rbp, r8
call fcn.140015250
mov rcx, qword [0x140037e00]
mov rbx, rax
call fcn.140023d60
cmp byte [rax], 0
mov rdi, rax
jne 0x1400154ac
cmp rbx, r14
jge 0x1400154ac
xor eax, eax
mov rdx, rbp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.140001bd9
cmp byte [rdi], 0
mov r13, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
jne 0x1400154ac
mov rcx, qword [rsp + 0x28]
movzx edx, sil
mov r8d, 2
call fcn.140009cb7
cmp byte [rdi], 0
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
jne 0x1400154ac
mov rcx, qword [rsp + 0x28]
mov rdx, r14
call fcn.140001bd9
cmp byte [rdi], 0
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
jne 0x1400154ac
lea rsi, [rsp + 0x40]
lea rdx, [r13 + r15]
mov rcx, rsi
lea rdx, [rdx + rbx + 0x52]
call fcn.140005a9e
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
movaps xmm0, xmmword [0x1400332c0]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140014a8a
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rbp
call fcn.140014a8a
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
movaps xmm1, xmmword [0x1400332a0]
movaps xmmword [rsp + 0x30], xmm1
call fcn.140014a8a
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r12
call fcn.140014a8a
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
movaps xmm2, xmmword [0x1400332a0]
movaps xmmword [rsp + 0x30], xmm2
call fcn.140014a8a
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r14
call fcn.140014a8a
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
movaps xmm3, xmmword [0x140033270]
movaps xmmword [rsp + 0x30], xmm3
call fcn.140014a8a
mov rcx, qword [rsp + 0x28]
movaps xmm4, xmmword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
movaps xmmword [rsp + 0x30], xmm4
call fcn.140001b5d
cmp byte [rdi], 0
jne 0x1400154ac
test rsi, rsi
je 0x140015460
test byte [rsi + 7], 0x40
jne 0x140015460
mov rcx, rsi
call fcn.140004925
test r14, r14
je 0x140015474
test byte [r14 + 7], 0x40
jne 0x140015474
mov rcx, r14
call fcn.140004925
test r12, r12
je 0x140015489
test byte [r12 + 7], 0x40
jne 0x140015489
mov rcx, r12
call fcn.140004925
test rbp, rbp
je 0x1400154ac
test byte [rbp + 7], 0x40
jne 0x1400154ac
mov rcx, rbp
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140004925
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001571f
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov rbp, rcx
mov r12, rdx
mov rsi, r8
mov qword [rsp + 0x38], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0x10]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140014e75
mov rcx, qword [0x140037e00]
call fcn.140023d60
cmp byte [rax], 0
mov rdi, rax
jne 0x140015939
movups xmm0, xmmword [rbp]
lea rcx, [rsp + 0x70]
mov r8, rbx
lea rdx, [rsp + 0x60]
movaps xmmword [rsp + 0x60], xmm0
call fcn.140014d25
cmp byte [rdi], 0
mov rbx, qword [rsp + 0x70]
jne 0x140015939
mov edx, 0x15180
mov rcx, rbx
call fcn.140009750
cmp byte [rdi], 0
mov r8, rax
jne 0x140015939
imul rax, rax, 0x15180
jo 0x1400157dd
sub rbx, rax
mov rcx, rbx
jno 0x1400157f5
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400049fd
mov rax, rbx
mov r9d, 0xe10
cqo
idiv r9
mov r13, rax
imul rax, rax, 0xe10
sub rcx, rax
jo 0x1400157dd
mov rax, rcx
mov r9d, 0x3c
mov rbx, rcx
cqo
idiv r9
mov r14, rax
imul rax, rax, 0x3c
sub rbx, rax
jo 0x1400157dd
lea rcx, [rsp + 0x98]
mov rdx, r8
call fcn.140015060
cmp byte [rdi], 0
jne 0x140015939
mov r8, qword [rsp + 0xa8]
mov edx, 0x68
mov rcx, rsi
mov r9b, byte [rsp + 0xa0]
mov r15, qword [rsp + 0x98]
mov qword [rsp + 0x58], r8
call fcn.140014a7b
mov r8, qword [rsp + 0x58]
lea rax, [0x14002f540]
cmp r13, 0x17
mov qword [rsi], rax
movzx eax, r9b
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x28], r15
mov qword [rsi + 0x38], r8
jbe 0x1400158a4
mov r8d, 0x17
xor edx, edx
mov rcx, r13
jmp 0x1400158d0
cmp r14, 0x3b
mov qword [rsi + 0x20], r13
jbe 0x1400158bb
mov r8d, 0x3b
xor edx, edx
mov rcx, r14
jmp 0x1400158d0
cmp rbx, 0x3c
mov qword [rsi + 0x18], r14
jbe 0x1400158e8
mov r8d, 0x3c
xor edx, edx
mov rcx, rbx
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400050a1
mov rax, qword [rbp + 8]
mov qword [rsi + 0x10], rbx
movzx ebx, r9b
mov rcx, r15
mov edx, ebx
mov qword [rsp + 0x58], r8
mov qword [rsi + 8], rax
call fcn.1400155d5
cmp byte [rdi], 0
jne 0x140015939
mov r8, qword [rsp + 0x58]
mov byte [rsi + 0x40], al
mov edx, ebx
mov rcx, r15
call fcn.140015672
cmp byte [rdi], 0
jne 0x140015939
mov qword [rsi + 0x48], rax
mov al, byte [rbp + 0x18]
mov qword [rsi + 0x58], r12
mov byte [rsi + 0x50], al
mov rax, qword [rbp + 0x10]
mov qword [rsi + 0x60], rax
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400159ea
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov qword [rcx], rdx
mov rcx, rbx
call fcn.140014b01
test al, al
je 0x140015a2c
mov rcx, rbx
call fcn.140014b92
mov rcx, qword [0x140037e00]
call fcn.140023d60
cmp byte [rax], 0
jne 0x140015a2c
mov edx, 8
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140004a88
add rsp, 0x20
pop rbx
ret
Function at 0x140015e8d
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [rcx]
test rdx, rdx
mov rsi, rcx
mov rbx, rdx
je 0x140015eb7
mov rax, qword [rdx - 0x10]
add rax, 0x10
jo 0x140015eb2
mov qword [rdx - 0x10], rax
jmp 0x140015eb7
call fcn.1400049fd
mov qword [rsi], rbx
mov rcx, rdi
call fcn.140014b01
test al, al
je 0x140015ef3
mov rcx, rdi
call fcn.140014b92
mov rcx, qword [0x140037e00]
call fcn.140023d60
cmp byte [rax], 0
jne 0x140015ef3
mov edx, 8
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.140004a88
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140016541
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140016597
mov rcx, rax
add rcx, 1
jo 0x140016573
test rcx, rcx
jns 0x14001657a
movabs r8, 0x7fffffffffffffff
xor edx, edx
pop rsi
pop rdi
jmp fcn.1400050a1
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140016573
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x140016bf0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x80000000
mov edx, 0xffffffff
add rax, rcx
cmp rdx, rax
jae 0x140016c14
mov r8d, 0x7fffffff
mov rdx, 0xffffffff80000000
jmp fcn.1400050a1
mov rax, qword [0x140037cc0]
jmp qword [rax]

Function at 0x140016c43
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x140016c99
mov rcx, rax
add rcx, 1
jo 0x140016c75
test rcx, rcx
jns 0x140016c7c
movabs r8, 0x7fffffffffffffff
xor edx, edx
pop rsi
pop rdi
jmp fcn.1400050a1
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x140016c75
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x140016c9c
Capabilities:
Terminate process

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x140016cb0
test byte [rax + 7], 0x40
je 0x140016cb0
jmp fcn.14000730b
ret

Function at 0x1400190b9
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rax, qword [rdx]
mov rsi, qword [rdx + 8]
test rax, rax
mov r8, rcx
jle 0x14001910f
mov rcx, rax
add rcx, 1
jo 0x1400190eb
test rcx, rcx
jns 0x1400190f2
movabs r8, 0x7fffffffffffffff
xor edx, edx
pop rsi
pop rdi
jmp fcn.1400050a1
pop rsi
pop rdi
jmp fcn.1400049fd
mov rdx, qword [r8]
add rsi, 8
mov r9, qword [r8 + 8]
lea rdx, [r9 + rdx + 8]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
add rax, qword [r8]
jo 0x1400190eb
mov qword [r8], rax
pop rsi
pop rdi
ret

Function at 0x14001921c
Capabilities:
Terminate process

Disassembly:
jmp fcn.1400048ff
test rcx, rcx
je 0x140019226
jmp 0x14000665c
ret