joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400309e8
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movabs r14, 0x4000000000000000
mov rax, qword [rcx]
test rax, rax
jle 0x140030a33
mov ebx, 0x18
xor edi, edi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + rbx]
test rcx, rcx
je 0x140030a27
test qword [rcx], r14
jne 0x140030a27
call fcn.1400011e0
mov rax, qword [rsi]
inc rdi
add rbx, 0x18
cmp rdi, rax
jl 0x140030a0d
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140030a54
test qword [rcx], r14
jne 0x140030a54
mov edx, 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400011a3
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140030a5f
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, rdx
mov rbx, rcx
call fcn.140001066
mov rsi, rax
lea rcx, [rsp + 0x30]
call fcn.140014482
lea rcx, [rsp + 0x20]
call fcn.140014482
call fcn.14000ec3e
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
call fcn.14002fe2d
mov bpl, 1
cmp byte [rsi], 0
je 0x140030acc
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400175ac
cmp byte [rsi], 0
jne 0x140030adf
mov rcx, qword [rsp + 0x38]
call fcn.1400175ac
cmp byte [rsi], 0
jne 0x140030adf
mov byte [rsi], bpl
jmp 0x140030adf
test al, al
je 0x140030ae8
mov rcx, qword [rsp + 0x28]
call fcn.1400175ac
cmp byte [rsi], 0
je 0x140030b45
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
ret
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
call fcn.14001756e
cmp byte [rsi], 0
jne 0x140030aa6
movups xmm0, xmmword [rdi]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x20]
call fcn.14001756e
cmp byte [rsi], 0
jne 0x140030aa6
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
xor r8d, r8d
call qword [0x1400fdea0]
test eax, eax
jne 0x140030b3d
call fcn.14000ffc0
cmp byte [rsi], 0
je 0x140030b57
mov bpl, byte [rsi]
jmp 0x140030aa6
mov rcx, qword [rsp + 0x38]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.1400175ac
mov ebp, eax
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [rdx + 0x10], xmm0
lea rdi, [rsp + 0x68]
mov rcx, rdi
call fcn.14002ec69
mov rdi, qword [rdi + 8]
cmp byte [rsi], 0
jne 0x140030b97
lea rdx, [rsp + 0x68]
mov rax, qword [rdx]
mov qword [rdx], rax
mov qword [rdx + 8], rdi
mov ecx, ebp
call fcn.14000ffc7
test rdi, rdi
je 0x140030b3d
test byte [rdi + 7], 0x40
jne 0x140030b3d
mov rcx, rdi
call fcn.1400011e0
jmp 0x140030b3d
Function at 0x140030ff7
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call fcn.140001066
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x20]
call fcn.140030fbd
cmp byte [rsi], 0
je 0x140031034
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x20]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rbx
mov rcx, rdi
call fcn.14003040c
cmp byte [rsi], 0
jne 0x14003102c
test rbx, rbx
je 0x14003102c
test byte [rbx + 7], 0x40
jne 0x14003102c
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0

Function at 0x1400318c8
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
call fcn.140001066
mov ecx, 0x40
call fcn.14000ed36
mov rdi, rax
lea rax, [0x14009d630]
mov qword [rdi], rax
lea rbx, [0x14009d140]
mov qword [rdi + 0x10], rbx
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, rsi
call fcn.14000ed6d
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi + 0x18], xmm0
mov qword [rsp + 0x20], 0x35
lea r8, [0x14009d100]
lea r9, str.LEc41v3cy
mov rcx, rdi
mov rdx, rbx
call fcn.14000ed74
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003194f
test byte [rcx + 7], 0x40
jne 0x14003194f
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140031b0a
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov r14, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.140030c38
mov rdi, qword [rbx]
mov rsi, qword [rbx + 8]
mov rcx, r14
mov rdx, rdi
call fcn.14001021a
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.1400102ba
test rsi, rsi
je 0x140031b65
test byte [rsi + 7], 0x40
jne 0x140031b65
mov rcx, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400011e0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140031bfb
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movabs r14, 0x4000000000000000
mov rax, qword [rcx]
test rax, rax
jle 0x140031c46
mov ebx, 0x10
xor edi, edi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + rbx]
test rcx, rcx
je 0x140031c3a
test qword [rcx], r14
jne 0x140031c3a
call fcn.1400011e0
mov rax, qword [rsi]
inc rdi
add rbx, 0x20
cmp rdi, rax
jl 0x140031c20
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140031c67
test qword [rcx], r14
jne 0x140031c67
mov edx, 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400011a3
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140031f02
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400031b4
test al, al
je 0x140031f2d
mov rcx, rsi
call fcn.14000a957
mov edx, 8
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140001c2a
nop
add rsp, 0x20
pop rsi
ret
Function at 0x140031fa3
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140001066
mov rdi, rax
mov rcx, rsi
call fcn.14000a984
test al, al
je 0x140031fcd
mov rcx, rsi
call fcn.14000a731
cmp byte [rdi], 0
je 0x140031fd4
add rsp, 0x28
pop rdi
pop rsi
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001c2a

Function at 0x140032440
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140001066
mov rdi, rax
mov rcx, rsi
call fcn.14000e246
test al, al
je 0x14003246a
mov rcx, rsi
call fcn.14000d914
cmp byte [rdi], 0
je 0x140032471
add rsp, 0x28
pop rdi
pop rsi
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001c2a

Function at 0x140032484
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
call fcn.140001208
cmp byte [rax], 0
je 0x14003249f
mov rsi, rax
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x1400324a5
add rsp, 0x20
pop rsi
ret
add rsi, 0x18
call fcn.14001feb2
mov rcx, rsi
xor edx, edx
call fcn.14000ef11
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
jmp 0x1400870bf
jmp 0x140032484
sub rsp, 0x28
call fcn.140086fcb
nop
add rsp, 0x28
jmp 0x1400870ba

Function at 0x1400324e6
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
call fcn.140001066
mov ecx, 0x40
call fcn.14000ed36
mov rdi, rax
lea rax, [0x14009d750]
mov qword [rdi], rax
lea rbx, [0x14009d3c0]
mov qword [rdi + 0x10], rbx
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, rsi
call fcn.14000ed6d
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi + 0x18], xmm0
mov qword [rsp + 0x20], 0x35
lea r8, [0x14009d100]
lea r9, str.LEc41v3cy
mov rcx, rdi
mov rdx, rbx
call fcn.14000ed74
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003256d
test byte [rcx + 7], 0x40
jne 0x14003256d
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140033bf4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x130
mov r12, r8
mov r13, rdx
mov rbx, rcx
call fcn.140001066
mov r14, rax
lea rcx, [rsp + 0x20]
mov edx, 0x40
call fcn.1400018bc
lea rsi, [rsp + 0xc8]
mov edx, 0x68
mov rcx, rsi
call fcn.1400018bc
mov ecx, 0x1a
mov rdi, rbx
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x60]
mov edx, 0x68
mov rcx, rsi
call fcn.1400018bc
lea r15, [rbx + 0x68]
mov ecx, 0x1a
mov rdi, r15
rep movsd dword [rdi], dword [rsi]
mov rcx, r15
call fcn.140033d63
cmp byte [r14], 0
jne 0x140033d2c
test r12, r12
jle 0x140033cd1
cmp r12, 0x41
jl 0x140033cc1
mov rcx, rbx
call fcn.140033d63
cmp byte [r14], 0
jne 0x140033d2c
mov rcx, rbx
mov rdx, r13
mov r8, r12
call fcn.140033d87
cmp byte [r14], 0
jne 0x140033d2c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140033e18
cmp byte [r14], 0
jne 0x140033d2c
jmp 0x140033cd1
lea rcx, [rsp + 0x20]
mov rdx, r13
mov r8, r12
call fcn.140002cd3
xor eax, eax
movaps xmm0, xmmword [str.6666666666666666]
movaps xmm1, xmmword [0x1400929e0]
movaps xmm2, xmmword [rsp + rax + 0x20]
movaps xmm3, xmm2
xorps xmm3, xmm0
movups xmmword [rbx + rax + 0x110], xmm3
xorps xmm2, xmm1
movups xmmword [rbx + rax + 0xd0], xmm2
add rax, 0x10
cmp rax, 0x40
jne 0x140033ce1
mov rcx, rbx
call fcn.140033d63
cmp byte [r14], 0
jne 0x140033d2c
lea rdx, [rbx + 0xd0]
mov rcx, rbx
call fcn.140033f21
cmp byte [r14], 0
je 0x140033d3f
add rsp, 0x130
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rbx, 0x110
mov rcx, r15
mov rdx, rbx
add rsp, 0x130
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140033f21
Function at 0x140035c3f
Capabilities:
Encode data using xor
Hash data using murmur3
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.140001066
mov rdi, rax
mov eax, dword [rsi]
and eax, 0x3f
lea r14, [rsi + 0x28]
mov byte [rsi + rax + 0x28], 0x80
lea rbx, [rsi + 8]
cmp rax, 0x3f
je 0x140035c76
cmp rax, 0x37
je 0x140035c8f
inc rax
jmp 0x140035c88
mov rcx, rbx
mov rdx, r14
call fcn.140033fb4
cmp byte [rdi], 0
jne 0x140035ce9
xor eax, eax
mov byte [rsi + rax + 0x28], 0
jmp 0x140035c65
mov eax, dword [rsi]
mov ecx, dword [rsi + 4]
shld ecx, eax, 3
mov dword [rsi + 4], ecx
shl eax, 3
mov dword [rsi], eax
bswap ecx
lea rdx, [rsp + 0x24]
mov dword [rdx], ecx
lea rcx, [rsi + 0x60]
mov r8d, 4
call fcn.140002cd3
mov eax, dword [rsi]
bswap eax
lea rdx, [rsp + 0x20]
mov dword [rdx], eax
add rsi, 0x64
mov r8d, 4
mov rcx, rsi
call fcn.140002cd3
mov rcx, rbx
mov rdx, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140033fb4
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140036f56
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
jne fcn.1400011e5
ret

Function at 0x140037492
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140001066
mov rdi, rax
mov rcx, rsi
call fcn.1400031b4
test al, al
je 0x1400374bc
mov rcx, qword [rsi]
call fcn.140008282
cmp byte [rdi], 0
je 0x1400374c3
add rsp, 0x28
pop rdi
pop rsi
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001c2a

Function at 0x14003a25d
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp qword [rcx], 0
jle 0x14003a296
xor edi, edi
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi*8 + 8]
call fcn.140002cdd
test al, al
je 0x14003a28e
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi*8 + 8]
call fcn.140001be7
inc rdi
cmp rdi, qword [rsi]
jl 0x14003a26e
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003a2b5
test byte [rcx + 7], 0x40
jne 0x14003a2b5
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400011a3
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14003c14c
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x28]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x14003c188
cmp byte [rsi], 0
jne 0x14003c2d7
jmp 0x14003c31e
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x30]
call qword [rdi + 0x28]
mov r12b, 1
cmp byte [rsi], 0
jne 0x14003c2bd
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14003c254
lea rbp, [rdi + 0x28]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14003c217
mov rcx, qword [rdi + 0x30]
call qword [rdi + 0x28]
cmp byte [rsi], 0
jne 0x14003c2bd
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x14003c2bd
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14003c212
test rbx, rbx
jne 0x14003c1c3
test rbx, rbx
je 0x14003c254
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.14003c14c]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x14003c2ba
mov rax, qword [rdi + 0x20]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14003c269
xor r12d, r12d
jmp 0x14003c2bd
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x1400947d0]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x14003c2d7
mov byte [rsi], r12b
test r12b, r12b
je 0x14003c31e
mov byte [rsi], 0
mov rax, qword [rdi + 0x20]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14003c2fd
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x20]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x14003c32d
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124

Function at 0x14003c340
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140001208
lea rcx, [rax + 0x18]
mov rdx, rsi
call fcn.14000ef11
xor ecx, ecx
add rsp, 0x20
pop rsi
jmp fcn.14000ebe5
Function at 0x14003c927
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x18]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x14003c963
cmp byte [rsi], 0
jne 0x14003cab2
jmp 0x14003caf9
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x20]
call qword [rdi + 0x18]
mov r12b, 1
cmp byte [rsi], 0
jne 0x14003ca98
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14003ca2f
lea rbp, [rdi + 0x18]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14003c9f2
mov rcx, qword [rdi + 0x20]
call qword [rdi + 0x18]
cmp byte [rsi], 0
jne 0x14003ca98
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x14003ca98
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14003c9ed
test rbx, rbx
jne 0x14003c99e
test rbx, rbx
je 0x14003ca2f
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.14003c927]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x14003ca95
mov rax, qword [rdi + 0x10]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14003ca44
xor r12d, r12d
jmp 0x14003ca98
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x1400947d0]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x14003cab2
mov byte [rsi], r12b
test r12b, r12b
je 0x14003caf9
mov byte [rsi], 0
mov rax, qword [rdi + 0x10]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14003cad8
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x10]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x14003cb08
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x14003d4b6
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x30]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x14003d4f2
cmp byte [rsi], 0
jne 0x14003d63c
jmp 0x14003d683
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x38]
call qword [rdi + 0x30]
mov r12b, 1
cmp byte [rsi], 0
jne 0x14003d622
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14003d5b9
lea rbp, [rdi + 0x30]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14003d581
mov rcx, qword [rdi + 0x38]
call qword [rdi + 0x30]
cmp byte [rsi], 0
jne 0x14003d622
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x14003d622
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14003d57c
test rbx, rbx
jne 0x14003d52d
test rbx, rbx
je 0x14003d5b9
lea r14, [rsp + 0x30]
mov rcx, r14
call fcn.140014482
lea rax, [fcn.14003d4b6]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x14003d61f
mov rax, qword [rdi + 0x28]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14003d5ce
xor r12d, r12d
jmp 0x14003d622
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140094830]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x14003d63c
mov byte [rsi], r12b
test r12b, r12b
je 0x14003d683
mov byte [rsi], 0
mov rax, qword [rdi + 0x28]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14003d662
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x28]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x14003d692
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x14003d6a5
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, rdx
mov rsi, rcx
call fcn.140001066
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x30], xmm0
cmp qword [rbx], 0
je 0x14003d6dd
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov rcx, rsi
call fcn.140011be7
jmp 0x14003d704
mov rdi, rax
movups xmm0, xmmword [0x140094ac0]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x20]
mov r8d, 0x7f8b85a3
call fcn.14003fe73
cmp byte [rdi], 0
je 0x14003d70c
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x20]
mov rbx, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rdx], rbx
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140011be7
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003d704
mov rax, qword [rcx]
mov edx, eax
or edx, 0x2f
mov edi, 0xff
and edx, edi
imul edx, edx
imul edx, edx, 0xbe09
or ebx, 0xb2
and ebx, edi
imul ebx, ebx
imul ebx, ebx, 0x2b3f
xor edi, edi
cmp edx, ebx
sete dil
neg rdi
btc rdi, 0x3e
test rax, rdi
jne 0x14003d704
add rsp, 0x50
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0

Function at 0x14003d78d
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
call fcn.140001066
mov r15, rax
xorps xmm0, xmm0
movups xmmword [r14], xmm0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rsi]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm1
movups xmm1, xmmword [rbx]
lea r8, [rsp + 0x30]
movaps xmmword [r8], xmm1
lea r9, [rsp + 0x50]
movups xmmword [r9], xmm0
lea rcx, [rsp + 0x20]
call fcn.14003ff0e
cmp byte [r15], 0
je 0x14003d7ed
mov rcx, qword [rsp + 0x28]
jmp 0x14003d805
lea rsi, [rsp + 0x20]
movups xmm0, xmmword [rsi]
movups xmmword [r14], xmm0
mov rcx, rsi
call fcn.14000ed6d
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14003d820
test byte [rcx + 7], 0x40
jne 0x14003d820
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400011e0
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003d82d
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140094ad0]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
mov r8d, 0x1ade862b
call fcn.14003fe73
cmp byte [rdi], 0
je 0x14003d874
add rsp, 0x58
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x30]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140011be7
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003d86d
mov rax, qword [rcx]
mov edx, eax
not edx
lea edx, [rdx + rdx*2]
mov edi, 0xfffffffe
sub edi, eax
lea edx, [rdx + rax*2]
inc edx
xor edx, edi
movabs rdi, 0x73f8f9f4ede25f05
add rdi, rdx
movabs rdx, 0x33f8f9f4ede25f05
xor rdx, rdi
test rax, rdx
jne 0x14003d86d
add rsp, 0x58
pop rdi
pop rsi
jmp fcn.1400011e0

Function at 0x14003d8ed
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
call fcn.140001066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140094ae0]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
mov r8d, 0x6ba35f99
call fcn.14003fe73
cmp byte [rdi], 0
je 0x14003d936
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x30]
mov rbx, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rdx], rbx
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140011be7
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.14000ed6d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003d92e
mov eax, 0xfffffffe
xor eax, ebx
add eax, ebx
add eax, 2
add ebx, ebx
and ebx, 2
xor rax, rbx
mov edx, eax
not edx
lea edx, [rdx + rdx*2]
lea ebx, [rax + rax]
add edx, eax
inc edx
xor edx, ebx
movabs rbx, 0x40000000fffffffe
xor rbx, rax
xor rbx, rdx
test qword [rcx], rbx
jne 0x14003d92e
add rsp, 0x50
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0