joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010f7d0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, edx
mov r14, rcx
mov dword [rcx + 0x10], edx
test edx, edx
je 0x14010f814
mov eax, ebp
lea rbx, [rax*8]
shl rax, 4
lea rsi, [rax + rax*2]
mov rdi, qword [0x140d81498]
test rdi, rdi
je 0x14010f820
lea rbx, [rbx + rbx*2]
cmp rsi, rdi
jbe 0x14010f843
jmp 0x14010f8cd
mov qword [r14], 0
jmp 0x14010f915
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140d81498], rdi
lea rbx, [rbx + rbx*2]
cmp rsi, rdi
ja 0x14010f8cd
test rdi, rdi
jne 0x14010f85e
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140d81498], rdi
cmp rbx, rdi
ja 0x14010f927
mov rax, rdi
or rax, rbx
shr rax, 0x20
je 0x14010f87d
mov rax, rdi
xor edx, edx
div rbx
jmp 0x14010f883
mov eax, edi
xor edx, edx
div ebx
bsr rcx, rax
shl rbx, cl
mov eax, dword [r14 + 0x10]
shl eax, cl
mov dword [r14 + 0x10], eax
shl rax, 3
lea rax, [rax + rax*2]
cmp rbx, rax
jne 0x14010f94b
lea r15, [rbx + rbx]
test rdi, rdi
jne 0x14010f8c4
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140d81498], rdi
cmp r15, rdi
jbe 0x14010f96b
test rdi, rdi
jne 0x14010f8e8
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140d81498], rdi
mov rcx, rbx
mov rdx, rdi
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
mov rdi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14010f98b
mov qword [r14], rax
test ebp, ebp
setne al
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__x_______0U__
mov edx, 0x191
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size______sizeof_BucketT___NumBuckets__
mov edx, 0x2af
mov r9, rbx
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size__2_______GetPageSizeCached____
mov edx, 0x2b0
mov r9, r15
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.DenseMap
lea r8, str.allocate
mov rcx, rdi
mov r9d, eax
call method.__sanitizer.ReportMmapFailureAndDie_unsigned_long_long__char_const__char_const__unsigned_int__bool_
int3
Function at 0x14010f9b0
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rcx
mov ebx, dword [rcx + 0x10]
mov r14, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x14010f9dd
mov rdx, r9
jmp 0x14010fa0f
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov esi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x14010fae5
xor al, 0x3f
mov ecx, eax
shl rsi, cl
cmp rsi, r9
jae 0x14010fb02
mov rcx, rdi
call method.__sanitizer::DenseMap___sanitizer::detail::DenseMapPair_unsigned_int__unsigned_long_long___unsigned_int____sanitizer::DenseMapInfo___sanitizer::detail::DenseMapPair_unsigned_int__unsigned_long_long_______sanitizer::detail::DenseMapPair___sanitizer:
mov rax, qword [rdi]
test rax, rax
je 0x14010fac1
test r14, r14
je 0x14010fa76
shl rbx, 3
lea rbx, [rbx + rbx*2]
lea r8, [r14 + rbx]
mov rcx, rdi
mov rdx, r14
call sym._ZN11__sanitizer12DenseMapBaseINS_8DenseMapINS_6detail12DenseMapPairIjyEEjNS_12DenseMapInfoIS4_EENS3_IS4_jEEEES4_jS6_S7_E18mov
mov rdx, qword [0x140d81498]
test rdx, rdx
jne 0x14010fa61
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140d81498], rdx
mov rcx, rbx
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
mov rcx, r14
mov rdx, rax
call method.__sanitizer.UnmapOrDie_void__unsigned_long_long_
jmp 0x14010fab7
mov qword [rdi + 8], 0
mov ecx, dword [rdi + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x14010fb1f
test rcx, rcx
je 0x14010fab7
lea rcx, [rcx + rcx*2]
lea rcx, [rax + rcx*8]
nop dword [rax + rax]
mov dword [rax], 0xffffffff
mov qword [rax + 8], 0xffffffffffffffff
add rax, 0x18
cmp rax, rcx
jne 0x14010faa0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1b9
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rsi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1ba
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x14010fb50
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, edx
mov r14, rcx
mov dword [rcx + 0x10], edx
test edx, edx
je 0x14010fb8b
mov esi, ebp
mov rbx, rsi
shl rbx, 5
mov rdi, qword [0x140d81498]
test rdi, rdi
je 0x14010fb97
shl rsi, 4
cmp rbx, rdi
jbe 0x14010fbba
jmp 0x14010fc40
mov qword [r14], 0
jmp 0x14010fc88
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140d81498], rdi
shl rsi, 4
cmp rbx, rdi
ja 0x14010fc40
test rdi, rdi
jne 0x14010fbd5
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140d81498], rdi
cmp rsi, rdi
ja 0x14010fc9a
mov rax, rdi
or rax, rsi
shr rax, 0x20
je 0x14010fbf4
mov rax, rdi
xor edx, edx
div rsi
jmp 0x14010fbfa
mov eax, edi
xor edx, edx
div esi
bsr rcx, rax
shl rsi, cl
mov eax, dword [r14 + 0x10]
shl eax, cl
mov dword [r14 + 0x10], eax
shl rax, 4
cmp rsi, rax
jne 0x14010fcbe
lea r15, [rsi + rsi]
test rdi, rdi
jne 0x14010fc37
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140d81498], rdi
cmp r15, rdi
jbe 0x14010fcde
test rdi, rdi
jne 0x14010fc5b
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rsp + 0x2c]
mov qword [0x140d81498], rdi
mov rcx, rsi
mov rdx, rdi
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
mov rdi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14010fcfe
mov qword [r14], rax
test ebp, ebp
setne al
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__x_______0U__
mov edx, 0x191
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rax
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size______sizeof_BucketT___NumBuckets__
mov edx, 0x2af
mov r9, rsi
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Size__2_______GetPageSizeCached____
mov edx, 0x2b0
mov r9, r15
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.DenseMap
lea r8, str.allocate
mov rcx, rdi
mov r9d, eax
call method.__sanitizer.ReportMmapFailureAndDie_unsigned_long_long__char_const__char_const__unsigned_int__bool_
int3
Function at 0x14010fd30
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, rcx
mov r14d, dword [rcx + 0x10]
mov rsi, qword [rcx]
cmp edx, 0x41
mov r9d, 0x40
cmovae r9d, edx
lea eax, [r9 - 1]
test r9d, eax
jne 0x14010fd5e
mov rdx, r9
jmp 0x14010fd90
bsr rax, r9
xor rax, 0x3f
mov ecx, eax
neg cl
mov edi, 1
mov edx, 1
shl rdx, cl
cmp rdx, r9
jbe 0x14010fe5f
xor al, 0x3f
mov ecx, eax
shl rdi, cl
cmp rdi, r9
jae 0x14010fe7c
mov rcx, rbx
call method.__sanitizer::DenseMap_unsigned_long_long__unsigned_int____sanitizer::DenseMapInfo_unsigned_long_long_____sanitizer::detail::DenseMapPair_unsigned_long_long__unsigned_int___.allocateBuckets_unsigned_int_
mov rax, qword [rbx]
test rax, rax
je 0x14010fe3b
test rsi, rsi
je 0x14010fdf3
shl r14, 4
lea r8, [rsi + r14]
mov rcx, rbx
mov rdx, rsi
call sym._ZN11__sanitizer12DenseMapBaseINS_8DenseMapIyjNS_12DenseMapInfoIyEENS_6detail12DenseMapPairIyjEEEEyjS3_S6_E18moveFromOldBucket
mov rdx, qword [0x140d81498]
test rdx, rdx
jne 0x14010fdde
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140d81498], rdx
mov rcx, r14
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
mov rcx, rsi
mov rdx, rax
call method.__sanitizer.UnmapOrDie_void__unsigned_long_long_
jmp 0x14010fe31
mov qword [rbx + 8], 0
mov ecx, dword [rbx + 0x10]
lea r9d, [rcx - 1]
and r9d, ecx
jne 0x14010fe99
test rcx, rcx
je 0x14010fe31
shl rcx, 4
xor edx, edx
nop word cs:[rax + rax]
mov qword [rax + rdx], 0xffffffffffffffff
add rdx, 0x10
cmp rcx, rdx
jne 0x14010fe20
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.__Buckets______0_
mov edx, 0x289
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rdx
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL_____up__1____
mov edx, 0x1b9
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rdi
lea rcx, str....._sanitizer_common_sanitizer_common.h
lea r8, str.__size________1ULL____up___
mov edx, 0x1ba
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], 0
lea rcx, str....._sanitizer_common_sanitizer_dense_map.h
lea r8, str.___getNumBuckets_____getNumBuckets_____1________0__
mov edx, 0x10f
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x140110ef0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rax, [rdx - 1]
test rdx, rax
jne 0x140110f19
lea rax, [rcx + rdx]
add rax, 0xffffffffffffffff
neg rdx
and rdx, rax
mov rax, rdx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, qword [0x140121520]
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140110faf
lea rcx, [0x140121520]
call method.__sanitizer::ReportFile.ReopenIfNecessary__
mov rcx, qword [0x140121528]
cmp rcx, 0xffffffffffffffff
je 0x140110ff6
lea rax, [rcx - 1]
cmp rax, 1
ja 0x140110f6f
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x140110f9a
mov qword [rsp + 0x20], 0
lea rdx, str.IsPowerOfTwo_boundary__n
lea r9, [rsp + 0x2c]
mov r8d, 0x17
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140110fa7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.IsPowerOfTwo_boundary__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rsi], 0
call method.__sanitizer.Die__
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140110fc3
add edi, 1
cmp edi, 0x63
ja 0x140110fe0
pause
cmp byte [rsi], 0
jne 0x140110fc0
jmp 0x140110fe9
xor ecx, ecx
call rbx
cmp byte [rsi], 0
jne 0x140110fc0
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140110fc0
jmp 0x140110f2c
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x24a7
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3

Function at 0x140114440
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x1401144be
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x1401144b1
mov rdx, qword [0x140d81498]
test rdx, rdx
jne 0x140114483
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140d81498], rdx
mov ecx, 0x100000
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401144ec
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1401144cc
add ebx, 1
cmp ebx, 0x63
ja 0x1401144d5
pause
jmp 0x1401144da
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x1401144c9
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1401144c9
jmp 0x140114457
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call method.__sanitizer.ReportMmapFailureAndDie_unsigned_long_long__char_const__char_const__unsigned_int__bool_
int3
Function at 0x140114520
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011459e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140114591
mov rdx, qword [0x140d81498]
test rdx, rdx
jne 0x140114563
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140d81498], rdx
mov ecx, 0x40000
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401145cc
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1401145ac
add ebx, 1
cmp ebx, 0x63
ja 0x1401145b5
pause
jmp 0x1401145ba
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x1401145a9
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1401145a9
jmp 0x140114537
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call method.__sanitizer.ReportMmapFailureAndDie_unsigned_long_long__char_const__char_const__unsigned_int__bool_
int3

Function at 0x140114600
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov al, 1
xchg byte [rcx], al
test al, al
jne 0x14011467e
mov rax, qword [rsi + rdi*8 + 8]
test rax, rax
jne 0x140114671
mov rdx, qword [0x140d81498]
test rdx, rdx
jne 0x140114643
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
mov qword [0x140d81498], rdx
mov ecx, 0x1000
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
mov rbx, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1401146ac
mov qword [rsi + rdi*8 + 8], rax
mov byte [rsi], 0
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14011468c
add ebx, 1
cmp ebx, 0x63
ja 0x140114695
pause
jmp 0x14011469a
xor ecx, ecx
call r14
cmp byte [rsi], 0
jne 0x140114689
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x140114689
jmp 0x140114617
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.TwoLevelMap
lea r8, str.allocate
mov rcx, rbx
mov r9d, eax
call method.__sanitizer.ReportMmapFailureAndDie_unsigned_long_long__char_const__char_const__unsigned_int__bool_
int3
Function at 0x1401148d0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov r14, rcx
mov eax, dword [rdx + 0x400000]
mov qword [rcx], rax
xor esi, esi
lea r15, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
jmp 0x14011492a
mov ecx, 0x100000
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
add rsi, rax
add rbx, 1
cmp rbx, 0x8000
je 0x140114956
mov rax, qword [rdi + rbx*8 + 0x400010]
test rax, rax
je 0x14011491d
mov rdx, qword [0x140d81498]
test rdx, rdx
jne 0x140114910
mov rcx, r15
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140d81498], rdx
jmp 0x140114910
mov r15, qword [0x140deb7e8]
xor edi, edi
lea rbx, [0x140dab7d8]
lea r12, [rsp + 0x28]
xor ebp, ebp
jmp 0x14011498a
mov ecx, 0x40000
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
add rdi, rax
add rbp, 1
cmp rbp, 0x8000
je 0x1401149b3
mov rax, qword [rbx + rbp*8 + 8]
test rax, rax
je 0x14011497d
mov rdx, qword [0x140d81498]
test rdx, rdx
jne 0x140114970
mov rcx, r12
call r13
mov edx, dword [rsp + 0x2c]
mov qword [0x140d81498], rdx
jmp 0x140114970
add rsi, r15
lea rax, [rdi + rsi]
add rax, 0x10010
mov qword [r14 + 8], rax
mov rax, r14
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x914823
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test bl, bl
jmp 0x1288e38
jmp 0x91a342
adc r8, 8
jmp 0x914fb6
push 0x4c3198ba
or rcx, rdx
push 0xffffffffdd849409
not rcx
push 0xffffffffe291d51f
call fcn.011e9618
invalid
jae 0x11ef3f0
or eax, 0xffffffff
jmp 0x92d246
ja 0x936f6f
add bl, 0x20
lea eax, [rdi - 0x41]
test sil, r12b
cmp r15w, di
cmp al, 0x19
jmp 0x12804e9
movzx ebx, byte [r13]
xchg dil, cl
movsx eax, bp
movzx edi, byte [r12]
inc r13
movsx rcx, di
cmovbe ecx, r11d
inc r12
movzx ecx, di
lahf
ror cx, cl
mov eax, 0xc011b9f
rcl ecx, 0x38
mov ecx, esi
clc
rol eax, cl
cmp r9b, dil
add al, sil
jmp 0x1273e23
seta bpl
mov eax, ebp
adc dil, 0x9c
sub r8, 2
jmp 0x12804c5
inc rsi
cmc
cmp r15b, r11b
xor bl, al
lea eax, [rbx - 0x41]
cmp al, 0x19
jmp 0x936f66
call fcn.0091455c
mov rcx, qword [r8]
mov edx, 0x89fd33f
lea rdx, [rdx*8 - 0x2d672271]
sal rdx, 0xdc
mov rdx, qword [r8 + riz + 8]
ja 0x91538c
ja 0x914823
add dil, 0x20
clc
jmp 0x914823
je 0x11e692c
cmp bl, dil
jmp 0x920210
je 0x1285980
cmp bl, dil
jmp 0x128597a
Function at 0x140003080
Capabilities:
Create process on windows
Find taskbar

Disassembly:
sub rsp, 0x48
lea eax, [r8 - 0x1c23]
cmp eax, 8
ja case.0x1400030a8.7206
lea r11, [0x140000000]
cdqe
mov r10d, dword [r11 + rax*4 + 0x31f8]
add r10, r11
jmp r10
xor eax, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CascadeWindows]
xor eax, eax
add rsp, 0x48
ret
xor eax, eax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TileWindows]
xor eax, eax
add rsp, 0x48
ret
xor eax, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_TileWindows]
xor eax, eax
add rsp, 0x48
ret
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x30], rax
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x140059970]
lea rcx, [0x140053310]
lea r8d, [rdx + 0x15]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x148]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
add rsp, 0x48
ret
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
xor r9d, r9d
mov edx, 0x111
mov rcx, rax
mov r8d, 0x1a8
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
add rsp, 0x48
ret
xor eax, eax
lea r8, str.taskmgr.exe
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
add rsp, 0x48
ret
lea rcx, str.control.exe__name_Microsoft.TaskbarAndStartMenu
mov edx, 1
call qword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
add rsp, 0x48
ret
xor eax, eax
cmp dword [rcx + 0x18], eax
sete al
mov dword [rcx + 0x18], eax
call fcn.140003300
xor eax, eax
add rsp, 0x48
ret
mov eax, dword [rsp + 0x70]
mov rcx, qword [rcx + 0x58]
mov dword [rsp + 0x20], eax
call fcn.140006690
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400035e0
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x60
mov rbx, rcx
lea rcx, str.Shell_TrayWnd
xor edx, edx
mov esi, 0x96840000
mov ebp, 0x180
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
je 0x14000363e
mov edx, 0xfffffff0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov edx, 0xffffffec
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rbp, rax
mov rcx, qword [0x1400752a8]
xor eax, eax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
lea r8, str.nViewTaskbarClass
lea rdx, str.nViewTaskbarClass
mov r9d, esi
mov ecx, ebp
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400036c5
call fcn.14001c090
lea r9, str.CNviewToolbar.cpp
lea r8, str.CNviewToolbar::create
mov rcx, rax
lea rax, str.Failed_to_create_main_window
mov edx, 1
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x3e
call fcn.14001c7d0
xor eax, eax
jmp 0x140003725
lea rdx, [rsp + 0x78]
lea rcx, [rbx + 0x28]
call fcn.1400039b0
mov rcx, qword [rbx + 0x10]
mov r8, rbx
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x10]
call fcn.140013200
mov rcx, rbx
call fcn.140003740
test eax, eax
je 0x1400036c1
mov rax, qword [rbx + 0x28]
mov edx, dword [rbx + 0x40]
mov rcx, rbx
mov r8d, dword [rax]
call fcn.140003850
mov rcx, qword [rbx + 0x58]
xor r9d, r9d
mov rcx, qword [rcx]
lea edx, [r9 + 5]
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rbx + 0x10]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140003a50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
xor edi, edi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003acf
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.TaskbarSizeMove
xor r8d, r8d
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetSubMenu]
cmp dword [rsp + 0x60], edi
mov r8d, 8
cmovne r8d, edi
mov edx, 0x1c2b
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret