joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dc5e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x458
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rsp + 0x440], rax
cmp qword [rsp + 0x460], 0
je 0x1400dc61c
cmp dword [rsp + 0x468], 0
jne 0x1400dc623
xor eax, eax
jmp 0x1400dc784
mov dword [rsp + 0x2c], 0
cmp qword [rsp + 0x470], 0
je 0x1400dc66f
call fcn.1400e3be0
movzx eax, al
test eax, eax
jne 0x1400dc649
xor eax, eax
jmp 0x1400dc784
lea r9, [rsp + 0x2c]
mov r8, qword [rsp + 0x470]
mov edx, dword [rsp + 0x468]
mov rcx, qword [rsp + 0x460]
call fcn.1400dc7a0
jmp 0x1400dc780
movzx eax, byte [0x14064657a]
test eax, eax
jne 0x1400dc67f
call fcn.1400dda00
mov eax, dword [rsp + 0x468]
cmp dword [0x14037a570], eax
ja 0x1400dc69a
mov eax, dword [0x14037a570]
mov dword [rsp + 0x30], eax
jmp 0x1400dc6a5
mov eax, dword [rsp + 0x468]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x28], eax
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, dword [rsp + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
test eax, eax
jne 0x1400dc704
cmp dword [rsp + 0x28], 0
jbe 0x1400dc704
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, dword [rsp + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
test eax, eax
jne 0x1400dc704
lea rcx, str.RtlCaptureStackBackTrace_failed__returning_an_empty_backtrace.
call sub.KERNEL32.dll_OutputDebugStringW
movzx eax, word [rsp + 0x20]
mov dword [rsp + 0x2c], eax
xor eax, eax
mov word [rsp + 0x24], ax
jmp 0x1400dc723
movzx eax, word [rsp + 0x24]
inc ax
mov word [rsp + 0x24], ax
movzx eax, word [rsp + 0x24]
movzx ecx, word [rsp + 0x20]
cmp eax, ecx
jge 0x1400dc74e
movzx eax, word [rsp + 0x24]
movzx ecx, word [rsp + 0x24]
mov rdx, qword [rsp + 0x460]
mov rax, qword [rsp + rax*8 + 0x40]
mov qword [rdx + rcx*8], rax
jmp 0x1400dc716
movzx eax, word [rsp + 0x20]
cmp eax, dword [rsp + 0x468]
jae 0x1400dc780
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x460]
mov qword [rcx + rax*8], 0
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
jmp 0x1400dc74e
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0x458
ret
Function at 0x1400dc9b0
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x538
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rsp + 0x520], rax
call fcn.1400e3be0
cmp qword [rsp + 0x548], 0
je 0x1400dc9f2
cmp dword [rsp + 0x550], 0
jne 0x1400dc9f9
xor eax, eax
jmp 0x1400dca9d
mov r8d, dword [rsp + 0x540]
xor edx, edx
mov ecx, 0x1b
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400dca1f
xor eax, eax
jmp 0x1400dca9d
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rcx, [rsp + 0x30]
call fcn.1400daa20
mov dword [rsp + 0x70], 0x100001
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x510], rax
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400dca83
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x550]
mov rcx, qword [rsp + 0x548]
call fcn.1400dc7a0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0x538
ret

Function at 0x1400de450
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0xa8
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp qword [0x14037a4c0], 0
jne 0x1400de59c
xorps xmm0, xmm0
mov qword [r11 + 8], rbx
movups xmmword [rsp + 0x50], xmm0
mov qword [r11 + 0x10], rsi
lea rcx, [r11 - 0x58]
mov qword [r11 - 8], rdi
mov edi, 0x40
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x28], xmm0
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbx, qword [rsp + 0x58]
mov r9d, 0x3f
mov ecx, dword [rsp + 0x48]
mov rax, qword [rsp + 0x78]
mov qword [0x14037a4c8], rax
mov eax, dword [rsp + 0x24]
mov qword [0x14037a4e8], rax
mov qword [0x14037a4d0], rax
lea rax, [rbx - 1]
mov qword [0x14037a4e0], rcx
mov qword [0x14037a4d8], rcx
bsr r10, rbx
mov qword [0x14037a4c0], rbx
setne r11b
bsr rcx, rax
mov eax, r9d
setne r8b
sub eax, ecx
mov ecx, eax
xor esi, esi
test r8b, r8b
mov eax, edi
mov edx, esi
cmovne eax, esi
cmovne edx, ecx
or dl, al
sub r9d, r10d
sub dil, dl
mov eax, r9d
test r11b, r11b
mov ecx, esi
mov edx, 1
cmovne ecx, eax
mov eax, 0xffffffff
cmovne eax, esi
mov rsi, qword [rsp + 0xb8]
or rcx, rax
lea rax, [rbx + 0x3fffffff]
mov rbx, qword [rsp + 0xb0]
shl rcx, 0x39
sar rcx, 0x3f
not cl
and cl, dil
mov rdi, qword [rsp + 0xa0]
shl rdx, cl
shr rax, 0x1e
mov dword [0x14037a4f8], eax
mov qword [0x14037a4f0], rdx
lea rax, [0x14037a4c0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0xa8
ret
Function at 0x1400de5d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov eax, 0x80
mov qword [rcx], rsi
mov edi, esi
mov qword [rcx + 8], rsi
cmp eax, esi
mov rbx, rcx
jle 0x1400de60a
mov dword [rbx + 8], eax
cmp eax, dword [rbx + 0xc]
jle 0x1400de619
mov edx, edi
mov rcx, rbx
call fcn.1400197d0
jmp 0x1400de619
jge 0x1400de619
je 0x1400de619
mov rcx, rbx
mov dword [rbx + 8], eax
call fcn.140022bf0
mov rdx, qword [rbx]
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400de69c
movsxd rdi, dword [rbx + 8]
cmp eax, edi
jae 0x1400de5f4
inc eax
cmp eax, edi
jle 0x1400de674
mov esi, eax
mov dword [rbx + 8], eax
sub esi, edi
cmp eax, dword [rbx + 0xc]
jle 0x1400de64d
mov edx, edi
mov rcx, rbx
call fcn.1400197d0
mov rax, qword [rbx]
xor edx, edx
movsxd r8, esi
add r8, r8
lea rcx, [rax + rdi*2]
call fcn.140260ab0
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
jge 0x1400de6bb
mov ecx, edi
sub ecx, eax
je 0x1400de6bb
sub edi, ecx
mov rcx, rbx
mov dword [rbx + 8], edi
call fcn.140022bf0
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], esi
test eax, eax
jns 0x1400de6b0
xor edx, edx
mov rcx, rbx
call fcn.140019a30
mov rax, qword [rbx]
test rax, rax
je 0x1400de6bb
mov word [rax], si
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e2f80
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
call fcn.14002b540
xorps xmm0, xmm0
mov qword [rbx + 0x70], 0
movups xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0xa0], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x50], rdx
mov qword [rbx + 0x50], rcx
mov rcx, qword [rsp + 0x68]
cmovbe rdx, qword [rsp + 0x50]
mov qword [rbx + 0x58], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rbx], rax
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x60], rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rbx + 0x40], rax
mov rax, rbx
mov qword [rbx + 0x68], rcx
mov qword [rbx + 0x48], rdx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0xc0
pop rbx
ret
Function at 0x1400e3be0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
add rsp, 0x28
jmp fcn.1400e3c00

Function at 0x1400e41b0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r12d, r12d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x20], r12
mov r15, r8
mov qword [rsp + 0x28], r12
mov r14, rdx
mov dil, 1
mov esi, r12d
mov r13d, r12d
test rdx, rdx
je 0x1400e427c
cmp word [rdx], r12w
je 0x1400e427c
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], r12w
jne 0x1400e4213
inc ebx
test ebx, ebx
jle 0x1400e423d
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140019a30
mov r13d, dword [rsp + 0x2c]
mov esi, dword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
mov edx, esi
add esi, ebx
mov dword [rsp + 0x28], esi
cmp esi, r13d
jle 0x1400e4262
lea rcx, [rsp + 0x20]
call fcn.1400197d0
mov r13d, dword [rsp + 0x2c]
mov esi, dword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
movsxd r8, ebx
mov rdx, r14
add r8, r8
mov rcx, r12
call fcn.140038f30
mov eax, 4
test esi, esi
jne 0x1400e4281
mov eax, 5
lea edx, [rsi + rax]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x3c], r13d
cmp edx, r13d
jle 0x1400e42a1
lea rcx, [rsp + 0x30]
call fcn.140019a30
mov r8d, 3
lea rdx, [0x140291960]
lea rcx, [rsp + 0x30]
call fcn.140026080
cmp dword [rsp + 0x38], 0
lea rbx, [0x140280be0]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov r8, rbx
movzx r9d, dil
cmovne r8, qword [rsp + 0x30]
call fcn.1400eae80
cmp dword [rsp + 0x28], 0
lea rdx, [rsp + 0x50]
cmovne rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, qword [rsp + 0x20]
mov rbx, rax
test rcx, rcx
je 0x1400e430b
call fcn.1400556b0
cmp rbx, 0xffffffffffffffff
je 0x1400e437b
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rsp + 0x7c]
movzx eax, word [rsp + 0x7e]
cmp cx, 0x2e
jne 0x1400e4346
test ax, ax
je 0x1400e4360
cmp cx, cx
jne 0x1400e4346
cmp ax, cx
jne 0x1400e4346
cmp word [rbp - 0x80], 0
je 0x1400e435b
mov rcx, qword [r15 + 8]
lea rdx, [rsp + 0x50]
mov rax, qword [r15]
call qword [case.0x140041db8.0]
movzx edi, al
test dil, dil
je 0x1400e4372
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400e4320
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400e438a
call fcn.1400556b0
movzx eax, dil
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14025eac0
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e6620
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xb70]
sub rsp, 0xc70
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rbp + 0xb50], rax
mov qword [rsp + 0xc60], r15
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.1400e3c00
lea rcx, [rsp + 0x48]
call fcn.1400e3280
mov rdx, rax
xor r8d, r8d
mov rcx, rsi
call fcn.1400e4b30
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400e6687
call fcn.1400556b0
mov r15, qword [0x14037a560]
lea rcx, [rbp + 0x6f0]
mov qword [rsp + 0xca0], rbx
xor edx, edx
mov r8d, 0x458
mov qword [rsp + 0xc68], r14
mov qword [rdi + 0xc10], rsi
call fcn.140260ab0
lea r9, [rbp + 0x6f0]
mov dword [rbp + 0x6f0], 0x58
xor r8d, r8d
mov dword [rbp + 0x740], 0x400
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.dbghelp.dll_SymFromAddr]
test eax, eax
je 0x1400e6769
xor ecx, ecx
lea rax, [rbp + 0x744]
cmp byte [rax], 0x20
jge 0x1400e6700
inc ecx
inc rax
jmp 0x1400e66f4
movsxd rax, ecx
lea rbx, [rdi + 0x400]
lea rdx, [rbp + 0x744]
mov rcx, rbx
add rdx, rax
mov r8d, 0x400
call qword [0x140272a28]
mov rax, 0xffffffffffffffff
mov byte [rbx + 0x3ff], 0
inc rax
cmp byte [rbx + rax], 0
jne 0x1400e6731
movsxd r14, eax
mov ecx, 0x400
add r14, rbx
sub ecx, eax
test ecx, ecx
jle 0x1400e6797
movsxd rbx, ecx
lea rdx, [0x14029f7b0]
mov r8, rbx
mov rcx, r14
call qword [0x140272a28]
mov byte [rbx + r14 - 1], 0
jmp 0x1400e6797
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.SymGetSymFromAddr64_Failed:__d
mov edx, 0x80
mov r9d, eax
lea rcx, [rbp + 0x5f0]
call fcn.140041910
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xorps xmm0, xmm0
lea r8, [rdi + 0xc04]
xor eax, eax
lea r9, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
mov rdx, rsi
mov dword [rsp + 0x20], 0x28
mov rcx, r15
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.dbghelp.dll_SymGetLineFromAddr64]
mov r14, qword [rsp + 0xc68]
test eax, eax
je 0x1400e6802
mov rdx, qword [rsp + 0x38]
lea rcx, [rdi + 0x800]
mov r8d, 0x400
call qword [0x140272a28]
mov eax, dword [rsp + 0x30]
mov byte [rdi + 0xbff], 0
mov dword [rdi + 0xc00], eax
jmp 0x1400e6808
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x68c
call fcn.140260ab0
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 0x690
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.dbghelp.dll_SymGetModuleInfo64]
mov r15, qword [rsp + 0xc60]
mov rbx, qword [rsp + 0xca0]
test eax, eax
je 0x1400e686f
mov r8d, 0x400
lea rdx, [rbp - 0x5c]
mov rcx, rdi
call qword [0x140272a28]
sub rsi, qword [rsp + 0x68]
mov byte [rdi + 0x3ff], 0
mov qword [rdi + 0xc08], rsi
jmp 0x1400e689d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.SymGetModuleInfo64_Failed:__d
mov edx, 0x80
mov r9d, eax
lea rcx, [rbp + 0x5f0]
call fcn.140041910
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0xb50]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0xc70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e6e50
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push r15
sub rsp, 0x68
mov eax, 0x5a4d
mov r15, rdx
mov rbx, rcx
cmp word [rcx], ax
jne 0x1400e7047
mov qword [r11 - 0x28], r12
movsxd r12, dword [rcx + 0x3c]
add r12, rcx
cmp dword [r12], 0x4550
jne 0x1400e7038
mov r8d, dword [r12 + 0x90]
mov rdx, r12
mov qword [r11 + 0x10], rbp
mov qword [r11 - 0x30], r13
call fcn.1400e4f20
xor ebp, ebp
mov qword [rsp + 0x90], rax
mov r13d, ebp
cmp dword [r12 + 0x94], ebp
jbe 0x1400e701c
mov qword [rsp + 0x58], rdi
mov ecx, ebp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
nop
cmp dword [rcx + rax], 0
jne 0x1400e6ef6
cmp dword [rcx + rax + 4], 0
jne 0x1400e6ef6
cmp dword [rcx + rax + 8], 0
jne 0x1400e6ef6
cmp dword [rcx + rax + 0xc], 0
jne 0x1400e6ef6
cmp dword [rcx + rax + 0x10], 0
je 0x1400e700d
mov eax, dword [rcx + rax + 0xc]
test eax, eax
je 0x1400e6fe2
mov r8d, eax
mov rdx, r12
mov rcx, rbx
call fcn.1400e4f20
mov qword [rsp + 0x30], rbp
mov rdi, rax
mov qword [rsp + 0x38], 0
mov r14, rbp
mov esi, ebp
test rax, rax
je 0x1400e6f9c
cmp byte [rax], 0
je 0x1400e6f9c
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400e6f37
inc ebx
test ebx, ebx
jle 0x1400e6f5f
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140019a30
mov ebp, dword [rsp + 0x3c]
mov esi, dword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov edx, esi
add esi, ebx
mov dword [rsp + 0x38], esi
cmp esi, ebp
jle 0x1400e6f82
lea rcx, [rsp + 0x30]
call fcn.1400197d0
mov ebp, dword [rsp + 0x3c]
mov esi, dword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov eax, 0x3f
mov r9d, ebx
mov r8, rdi
mov word [rsp + 0x20], ax
mov edx, ebx
mov rcx, r14
call fcn.14001b180
movsxd rbx, dword [r15 + 8]
lea eax, [rbx + 1]
mov dword [r15 + 8], eax
cmp eax, dword [r15 + 0xc]
jle 0x1400e6fb7
mov edx, ebx
mov rcx, r15
call fcn.1400196c0
mov rax, rbx
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x80]
shl rax, 4
add rax, qword [r15]
mov qword [rax], r14
mov dword [rax + 0xc], ebp
xor ebp, ebp
mov qword [rsp + 0x38], rbp
mov dword [rax + 8], esi
mov eax, dword [r12 + 0x94]
inc r13
lea rcx, [r13*4]
add rcx, r13
shl rcx, 2
cmp rcx, rax
mov rax, qword [rsp + 0x90]
jb 0x1400e6ed0
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
mov r13, qword [rsp + 0x48]
mov al, 1
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x50]
add rsp, 0x68
pop r15
pop rbx
ret
mov r12, qword [rsp + 0x50]
xor al, al
add rsp, 0x68
pop r15
pop rbx
ret
xor al, al
add rsp, 0x68
pop r15
pop rbx
ret
Function at 0x1400e7060
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
lea rax, [rsp + 0x50]
mov rbx, rdx
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x50], esi
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400e7188
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x1400e7188
mov eax, dword [rbx + 8]
cmp r8d, eax
jle 0x1400e70cc
mov dword [rbx + 8], r8d
cmp r8d, dword [rbx + 0xc]
jle 0x1400e70e7
mov edx, eax
mov rcx, rbx
call fcn.140048160
jmp 0x1400e70e2
jge 0x1400e70e7
mov ecx, eax
sub ecx, r8d
je 0x1400e70e7
sub eax, ecx
mov rcx, rbx
mov dword [rbx + 8], eax
call fcn.140097d40
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rbx]
lea r9, [rsp + 0x58]
mov rcx, rdi
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e7176
mov eax, dword [rsp + 0x58]
cmp eax, dword [rsp + 0x50]
jae 0x1400e7164
movsxd rdi, dword [rbx + 8]
cmp eax, edi
jle 0x1400e714f
mov esi, eax
mov dword [rbx + 8], eax
sub esi, edi
cmp eax, dword [rbx + 0xc]
jle 0x1400e712d
mov edx, edi
mov rcx, rbx
call fcn.140048160
mov rcx, rdi
movsxd r8, esi
add rcx, qword [rbx]
xor edx, edx
call fcn.140260ab0
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
jge 0x1400e7164
mov ecx, edi
sub ecx, eax
je 0x1400e7164
sub edi, ecx
mov rcx, rbx
mov dword [rbx + 8], edi
call fcn.140097d40
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx + 8], esi
cmp dword [rbx + 0xc], esi
je 0x1400e7188
xor edx, edx
mov rcx, rbx
call fcn.1400acf70
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400e8840
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x1400e885f
movzx eax, byte [0x1403e93c2]
neg al
sbb dl, dl
and dl, 3
add rsp, 0x28
jmp 0x1400e8890
lea rcx, str.Win_RequestExit
call fcn.1400aca10
lea rcx, [0x14036ef30]
call fcn.14001ca70
xor ecx, ecx
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_PostQuitMessage]
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx ebx, cl
movzx edi, dl
lea rcx, str.Win_RequestExit
call fcn.1400aca10
lea rcx, [0x14036ef30]
call fcn.14001ca70
test bl, bl
je 0x1400e8912
call fcn.1400b6d90
test rax, rax
je 0x1400e88f6
call fcn.1400b6d90
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x68]
mov rcx, rdx
call qword [case.0x140041db8.0]
call fcn.1400b6d90
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140041db8.0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_PostQuitMessage]

Function at 0x1400e8890
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x1400e885f
movzx eax, byte [0x1403e93c2]
neg al
sbb dl, dl
and dl, 3
add rsp, 0x28
jmp 0x1400e8890
lea rcx, str.Win_RequestExit
call fcn.1400aca10
lea rcx, [0x14036ef30]
call fcn.14001ca70
xor ecx, ecx
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_PostQuitMessage]
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx ebx, cl
movzx edi, dl
lea rcx, str.Win_RequestExit
call fcn.1400aca10
lea rcx, [0x14036ef30]
call fcn.14001ca70
test bl, bl
je 0x1400e8912
call fcn.1400b6d90
test rax, rax
je 0x1400e88f6
call fcn.1400b6d90
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x68]
mov rcx, rdx
call qword [case.0x140041db8.0]
call fcn.1400b6d90
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140041db8.0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_PostQuitMessage]

Function at 0x1400e9550
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call fcn.14002f400
call fcn.1400dbef0
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
Function at 0x1400e9d60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x40], xmm6
lea rcx, [rsp + 0x88]
movaps xmm6, xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mulss xmm6, dword [0x140290cc0]
cvttss2si rax, xmm6
movaps xmm6, xmmword [rsp + 0x40]
test eax, eax
jne 0x1400e9da8
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x1400e9db0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1403ebb08], 0
je 0x1400e9e16
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1403ebb08]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
sub rdi, rbx
cmp rdi, qword [rax + 0x40]
jbe 0x1400e9e11
xor ecx, ecx
call fcn.1400cd940
mov rcx, qword [0x1403ebb08]
lea rdx, str.FWindowsPlatformProcess::SleepNoStats
mov r8d, eax
mov r9, rbx
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400cac50
mov rdi, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x38], rax
lea rdx, [0x14036e380]
lea rax, [0x14002f520]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140055990
lea rcx, [rsp + 0x78]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [rsp + 0x78]
sub ecx, dword [rsp + 0x88]
add dword [rbx + 0x10], ecx
add rsp, 0x60
pop rbx
ret

Function at 0x1400e9e70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x38
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1403ebb08], 0
je 0x1400e9eec
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1403ebb08]
mov rdi, qword [rsp + 0x48]
sub rdi, qword [rsp + 0x40]
cmp rdi, qword [rax + 0x40]
jbe 0x1400e9ee7
xor ecx, ecx
call fcn.1400cd940
mov r9, qword [rsp + 0x40]
lea rdx, str.FWindowsPlatformProcess::SleepInfinite
mov rcx, qword [0x1403ebb08]
mov r8d, eax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400cac50
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x1400ea6e0
Capabilities:
Get session user name

Disassembly:
sub rsp, 0x28
test cl, cl
je 0x1400ea773
cmp word [0x140645970], 0
jne 0x1400ea767
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
lea rcx, [0x140645970]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], 0x100
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
movzx eax, word [0x140645970]
lea rbx, [0x140645970]
lea rdi, [0x140645970]
test ax, ax
je 0x1400ea758
movzx ecx, ax
call qword [0x140272a30]
test eax, eax
je 0x1400ea74b
movzx eax, word [rbx]
mov word [rdi], ax
add rdi, 2
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x1400ea734
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov word [rdi], cx
mov rdi, qword [rsp + 0x20]
lea rax, [0x140645970]
add rsp, 0x28
ret
cmp word [0x140645770], 0
jne 0x1400ea797
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x100
lea rcx, [0x140645770]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [0x140645770]
add rsp, 0x28
ret