joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406c00
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea r8, [sym.crash_details_thread]
xor edx, edx
mov r9, rcx
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov qword [rsp + 0x28], 0
call qword [sym.imp.kernel32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x406fb0
Capabilities:
Write file on windows

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
mov eax, dword [r8]
mov rsi, rcx
mov rbx, r8
mov edi, r9d
test eax, eax
jne 0x4070f0
test rcx, rcx
je 0x406fe1
mov rdx, rcx
lea rcx, [0x004304e3]
call sym.dbg_printf
cmp qword [rbx + 8], 0
mov edx, dword [rbx + 4]
je 0x407048
lea rcx, str.0x_x_
call sym.dbg_printf
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x40700c
lea rcx, [0x004304e0]
call sym.dbg_printf
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x40702d
mov ecx, dword [rbx + 0x18]
mov r8d, 1
shl r8d, cl
lea rcx, [0x004304ed]
call sym.dbg_printf
lea rcx, [0x004304f4]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp sym.dbg_printf
cmp qword [rbx + 0x10], 0
jne 0x406feb
test rsi, rsi
jne 0x407120
and edi, 1
je 0x407120
lea rcx, str.0x_x___
lea r12, [rsp + 0x40]
call sym.dbg_printf
mov rsi, qword [0x004471b0]
movsxd rdx, dword [rbx + 4]
mov r9d, 8
lea r8, [rsp + 0x30]
mov rax, qword [rsi]
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], r12
call qword [rax + 8]
test eax, eax
je 0x407150
cmp qword [rsp + 0x40], 8
jne 0x407150
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
mov r9d, 8
lea r8, [rsp + 0x38]
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], r12
call qword [rax + 8]
test eax, eax
je 0x4070e2
cmp qword [rsp + 0x40], 8
je 0x40715e
lea rcx, str._invalid_destination_
call sym.dbg_printf
jmp 0x40713f
movsxd rax, dword [r8 + 4]
movsxd rdx, edx
lea rcx, [0x004304e0]
lea rdx, [rax + rdx*8]
lea rax, [0x00430820]
mov rdx, qword [rax + rdx*8]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
jmp sym.dbg_printf
mov eax, edx
lea rcx, [rsp + 0x40]
mov edx, 1
mov dword [rsp + 0x4c], 3
mov qword [rsp + 0x40], rax
call sym.print_address
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
ret
lea rcx, str._invalid_source_
call sym.dbg_printf
jmp 0x40713f
mov eax, dword [rsp + 0x30]
mov edx, 1
mov rcx, r12
mov dword [rsp + 0x4c], 3
mov qword [rsp + 0x40], rax
call sym.print_address
jmp 0x40713f
Function at 0x40c670
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, qword [rcx + 0x118]
mov rbp, rcx
mov esi, edx
mov r13d, r8d
test edx, edx
jne 0x40c696
mov esi, dword [rcx + 0x68]
mov rbx, qword [r12 + 0x38]
lea rdi, [r12 + 0x38]
cmp rdi, rbx
je 0x40c720
cmp r9d, 0xffffffff
mov r15d, 0x10002
mov eax, 0x80010001
mov r14, qword [sym.imp.kernel32.dll_ResumeThread]
cmovne r15d, eax
jmp 0x40c6e2
mov rcx, rbx
mov edx, r13d
call sym.dbg_thread_set_single_step
mov rcx, qword [rbx + 0x18]
call r14
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x40c720
cmp esi, 0xffffffff
je 0x40c6ec
cmp dword [rbx + 0x20], esi
jne 0x40c6da
mov eax, dword [rbx + 0x130]
test eax, eax
je 0x40c6da
mov dword [rbx + 0x130], 0
mov eax, dword [rbp + 0x64]
cmp dword [r12 + 0x18], eax
jne 0x40c6c8
mov eax, dword [rbp + 0x68]
cmp dword [rbx + 0x20], eax
jne 0x40c6c8
mov dword [rbp + 0x110], r15d
jmp 0x40c6c8
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x40d7b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
mov r8d, 1
lea rbx, [0x0043a173]
mov esi, edx
lea rdx, [0x0043a1e8]
mov r12, rcx
call sym.packet_reply_add_data
movzx edx, sil
and esi, 0xf
xor eax, eax
shr rdx, 4
lea r13, [r12 + 0x28]
mov r8d, 2
mov al, byte [rbx + rdx]
movzx edx, byte [rbx + rsi]
lea rsi, [rsp + 0x20]
mov rcx, r13
mov ah, dl
mov rdx, rsi
mov word [rsp + 0x20], ax
call sym.reply_buffer_append
lea rdx, str.thread:
mov r8d, 7
mov rcx, r12
call sym.packet_reply_add_data
mov eax, dword [r12 + 0x68]
lea rdx, [rsp + 0x28]
nop dword [rax]
mov rcx, rax
sub rdx, 1
shr rax, 4
and ecx, 0xf
movzx ecx, byte [rbx + rcx]
mov byte [rdx], cl
cmp rdx, rsi
jne 0x40d830
mov rcx, r13
mov r8d, 8
call sym.reply_buffer_append
mov r8d, 1
lea rdx, [0x0043a1f2]
mov rcx, r12
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
jmp sym.packet_reply_add_data
Function at 0x4155f0
Capabilities:
Enumerate processes

Disassembly:
push r12
push rbx
sub rsp, 0x48
xor edx, edx
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x415793
mov rax, qword [0x0043d230]
mov dword [rsp + 0x2c], 0xffffffff
mov ecx, 0x1380
mov qword [rsp + 0x38], rax
call qword [sym.imp.ucrtbase.dll_malloc]
mov qword [rsp + 0x30], rax
mov rdx, rax
test rax, rax
je 0x4157c5
mov dword [rax], 0x130
mov rcx, r12
call sym.Process32First
mov rbx, qword [sym.imp.ucrtbase.dll_realloc]
test eax, eax
je 0x4156d8
nop dword [rax]
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea eax, [rdx + 1]
imul rdx, rdx, 0x138
mov dword [rsp + 0x38], eax
mov dword [rcx + rdx + 0x130], 0xffffffff
mov edx, dword [rsp + 0x3c]
cmp eax, edx
jb 0x4156ae
add edx, edx
imul rdx, rdx, 0x138
call rbx
mov rcx, rax
test rax, rax
je 0x4157af
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
shl dword [rsp + 0x3c], 1
imul rax, rax, 0x138
mov dword [rcx + rax], 0x130
mov edx, dword [rsp + 0x38]
mov rcx, r12
imul rdx, rdx, 0x138
add rdx, qword [rsp + 0x30]
call sym.Process32Next
test eax, eax
jne 0x415660
mov rcx, r12
mov r12d, 0xffffffff
call qword [sym.imp.kernel32.dll_CloseHandle]
mov r9d, dword [rsp + 0x38]
xor ecx, ecx
lea r10, [rsp + 0x2c]
test r9d, r9d
je 0x415756
nop dword [rax + rax]
mov r8d, ecx
mov rdx, qword [rsp + 0x30]
xor eax, eax
imul r8, r8, 0x138
add r8, rdx
nop dword [rax]
cmp eax, ecx
je 0x415725
mov ebx, dword [r8 + 0x20]
cmp dword [rdx + 8], ebx
je 0x4157a0
add eax, 1
add rdx, 0x138
cmp eax, r9d
jne 0x415718
mov edx, dword [rsp + 0x2c]
mov rax, r10
mov dword [r8 + 0x134], edx
mov dword [rax], ecx
mov r9d, dword [rsp + 0x38]
add ecx, 1
cmp r9d, ecx
ja 0x415700
mov r12d, dword [rsp + 0x2c]
lea r9, str.executable
lea r8, str.threads
lea rdx, [0x0043bf10]
lea rcx, str.___8.8s___8.8s__s__all_id:s_are_in_hex__n
call sym.dbg_printf
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov edx, r12d
call sym.dump_proc_info
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ucrtbase.dll_free]
nop
add rsp, 0x48
pop rbx
pop r12
ret
lea rax, [rdx + 0x130]
mov edx, dword [rdx + 0x130]
jmp 0x41573b
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x415793
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x415793
Function at 0x415ed0
Capabilities:
Resume thread
Suspend thread
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, qword [0x004471b0]
cmp qword [rbx], 0
mov r12d, ecx
je 0x415fd0
mov rsi, qword [0x004471c0]
cmp qword [rsi], 0
je 0x415fd0
lea rcx, str.Exception_frames:_n
call sym.dbg_printf
mov r15, qword [0x004471d0]
cmp dword [r15], r12d
jne 0x415f78
mov r14, qword [rsi]
mov rax, qword [rbx]
lea rsi, [rsp + 0x40]
mov rdx, qword [r14 + 0x28]
mov r9d, 8
lea r8, [rsp + 0x30]
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], rsi
call qword [rax + 8]
test eax, eax
je 0x415f57
cmp qword [rsp + 0x40], 8
je 0x415ff0
lea rcx, str.Cant_read_TEB:except_frame_n
call sym.dbg_printf
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rbx]
mov edx, r12d
call sym.dbg_get_thread
mov edx, r12d
lea rcx, str.Unknown_thread_id___04lx__in_current_process_n
mov r14, rax
test rax, rax
je 0x415fb2
mov rcx, qword [rax + 0x18]
call qword [sym.imp.kernel32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x415f20
mov edx, r12d
lea rcx, str.Cant_suspend_thread_id___04lx__n
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.dbg_printf
lea rcx, str.Cannot_get_info_on_exceptions_while_no_process_is_loaded_n
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.dbg_printf
mov rdx, qword [rsp + 0x30]
lea r13, [rsp + 0x38]
lea rbp, str._p:
lea rdi, str.prev_p_handler_p_n
cmp rdx, 0xffffffffffffffff
je 0x416051
nop
mov rcx, rbp
call sym.dbg_printf
mov rax, qword [rbx]
mov rdx, qword [rsp + 0x30]
mov r8, rsi
mov r9d, 0x10
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], r13
call qword [rax + 8]
test eax, eax
je 0x416045
cmp qword [rsp + 0x38], 0x10
je 0x416070
lea rcx, str.Invalid_frame_address_n
call sym.dbg_printf
cmp dword [r15], r12d
je 0x415f64
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.kernel32.dll_ResumeThread]
jmp 0x415f64
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rcx, rdi
call sym.dbg_printf
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rdx
cmp rdx, 0xffffffffffffffff
jne 0x416010
jmp 0x416051
Function at 0x4161e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rax, qword [0x004471a0]
mov r14d, ecx
cmp dword [rax], ecx
jne 0x4163e0
mov rax, qword [0x004471b0]
mov rax, qword [rax]
test rax, rax
je 0x41641e
mov r12, qword [rax + 0x10]
lea rcx, str.Address__End______State___Type____RWX_n
xor r15d, r15d
lea rdi, [rsp + 0x50]
call sym.dbg_printf
lea r13, str.mapped
mov rsi, qword [sym.imp.kernel32.dll_VirtualQueryEx]
lea rbx, [0x0043c10d]
lea rbp, str.image
jmp 0x41633b
cmp eax, 0x1000
lea rcx, str.commit
cmovne rcx, rbx
mov edx, dword [rsp + 0x78]
mov rax, r13
cmp edx, 0x40000
je 0x416299
ja 0x416388
lea rax, [0x0043c115]
test edx, edx
je 0x416299
cmp edx, 0x20000
lea rax, str.private
cmovne rax, rbx
mov edx, 0x2020
mov byte [rsp + 0x4e], 0x20
lea r9, [rsp + 0x4c]
mov word [rsp + 0x4c], dx
mov edx, dword [rsp + 0x60]
mov byte [rsp + 0x4f], 0
test dl, 0xee
je 0x4162c0
mov byte [rsp + 0x4c], 0x52
test dl, 0x44
je 0x4162ca
mov byte [rsp + 0x4d], 0x57
test dl, 0x88
je 0x4162d4
mov byte [rsp + 0x4d], 0x43
and edx, 0xf0
je 0x4162e1
mov byte [rsp + 0x4e], 0x58
mov rdx, qword [rsp + 0x68]
lea r11, [r15 + rdx - 1]
mov rdx, qword [0x004471b0]
mov r8, qword [rdx]
mov edx, 0x10
test r8, r8
je 0x416308
mov rdx, qword [r8 + 0x58]
mov edx, dword [rdx + 4]
add edx, edx
mov qword [rsp + 0x38], r9
mov r8, r15
mov r9d, edx
mov qword [rsp + 0x28], rcx
lea rcx, str._0Ix__0Ix__s__s__s_n
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r11
call sym.dbg_printf
mov rax, qword [rsp + 0x68]
test rax, rax
js 0x4163b0
add r15, rax
mov r9d, 0x30
mov r8, rdi
mov rdx, r15
mov rcx, r12
call rsi
cmp rax, 0x2f
jbe 0x4163b0
mov eax, dword [rsp + 0x70]
cmp eax, 0x2000
je 0x4163a0
cmp eax, 0x10000
jne 0x416258
mov byte [rsp + 0x4c], 0
lea rcx, str.free
lea r9, [rsp + 0x4c]
lea rax, [0x0043bb5c]
jmp 0x4162e1
cmp edx, 0x1000000
mov rax, rbp
cmovne rax, rbx
jmp 0x416299
lea rcx, str.reserve
jmp 0x416268
mov rax, qword [0x004471a0]
cmp dword [rax], r14d
je 0x4163c6
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.kernel32.dll_OpenProcess]
mov r12, rax
test rax, rax
jne 0x41621c
mov edx, r14d
lea rcx, str.Cannot_open_process___04lx__n
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.dbg_printf
lea rcx, str.Cannot_look_at_mapping_of_current_process__while_no_process_is_loaded_n
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.dbg_printf
Function at 0x416440
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, qword [0x004471b0]
cmp qword [rbx], 0
mov r12d, ecx
mov rbp, rdx
mov r13, r8
je 0x4165a8
mov rax, qword [0x004471c0]
cmp qword [rax], 0
je 0x4165a8
xor r9d, r9d
lea r8, [rsp + 0x60]
mov edx, 0xffffffff
lea rcx, str.debug_options
call sym.symbol_get_lvalue
test eax, eax
je 0x4164b0
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x68]
call sym.memory_to_linear_addr
mov r15, rax
test rbp, rbp
je 0x4166e8
mov ecx, 6
lea rdi, [0x0043c240]
mov rsi, rbp
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x4165d0
mov r14d, 1
mov rdi, r13
mov ecx, 4
lea rbp, [rsp + 0x50]
mov eax, r14d
lea rsi, [0x0043c26d]
not eax
mov dword [rsp + 0x34], 0
repe cmpsb byte [rsi], byte [rdi]
mov byte [rsp + 0x33], al
lea rax, [rsp + 0x51]
lea rsi, [rsp + 0x48]
mov qword [rsp + 0x38], rax
seta dil
sbb dil, 0
movsx edi, dil
test r15, r15
je 0x4166d0
nop dword [rax]
mov rax, qword [rbx]
mov r9d, 0x10
mov r8, rbp
mov rdx, r15
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], rsi
call qword [rax + 8]
test eax, eax
jne 0x416648
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x4166d0
test byte [0x0042e240], 8
je 0x41649b
mov eax, dword [rsp + 0x34]
lea r9, str.Changed__d_channel_instances_n
lea r8, str.info_wine_dbg_channel
mov ecx, 3
lea rdx, [0x0042e240]
mov dword [rsp + 0x20], eax
call sym.wine_dbg_log.constprop.0_5
jmp 0x41649b
lea rcx, str.Cannot_set_get_debug_channels_while_no_process_is_loaded_n
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.dbg_printf
mov ecx, 4
lea rdi, [0x0043c246]
mov rsi, rbp
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x4166f8
mov ecx, 5
lea rdi, [0x0043c24a]
mov rsi, rbp
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x416703
mov ecx, 6
lea rdi, [0x0043c24f]
mov rsi, rbp
mov r14d, 8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x4164ea
mov rdx, rbp
lea rcx, str.Unknown_debug_class__s_n
call sym.dbg_printf
jmp 0x41649b
cmp qword [rsp + 0x48], 0x10
jne 0x41655f
cmp byte [rsp + 0x51], 0
je 0x41655f
test edi, edi
je 0x416675
mov rcx, qword [rsp + 0x38]
mov rdx, r13
call qword [sym.imp.ucrtbase.dll_strcmp]
test eax, eax
jne 0x4166c2
movzx edx, byte [rsp + 0x50]
movzx eax, byte [rsp + 0x33]
mov r9d, 0x10
mov r8, rbp
and al, byte [rsp + 0x50]
or edx, r14d
test r12d, r12d
cmovne eax, edx
mov rdx, r15
mov byte [rsp + 0x50], al
mov rax, qword [rbx]
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], rsi
call qword [rax + 0x10]
test eax, eax
je 0x4166c2
xor eax, eax
cmp qword [rsp + 0x48], 0x10
sete al
add dword [rsp + 0x34], eax
add r15, 0x10
jmp 0x416538
mov rdx, r13
lea rcx, str.Unable_to_find_debug_channel__s_n
call sym.dbg_printf
jmp 0x41649b
mov r14d, 0xffffffff
jmp 0x4164ea
mov r14d, 2
jmp 0x4164ea
mov r14d, 4
jmp 0x4164ea
Function at 0x417350
Capabilities:
Write file on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov edx, dword [rcx + 0xc]
mov rbx, rcx
cmp edx, 2
je 0x4173d8
ja 0x4173a0
test edx, edx
je 0x4173d8
mov r8d, dword [rcx]
lea rsi, [rsp + 0x20]
lea rdx, str.0x_08x
mov rcx, rsi
call sym.sprintf
movzx edx, word [rbx + 8]
mov r8, rsi
lea rcx, str.0x_04x:_s
call sym.dbg_printf
nop
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
cmp edx, 3
jne 0x4173f8
mov r8, qword [rcx]
lea r12, [rsp + 0x20]
lea rdx, str._016I64x
mov rcx, r12
call sym.sprintf
mov rdx, r12
lea rcx, [0x0043d2ac]
call sym.dbg_printf
nop
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
movzx edx, word [rbx + 8]
mov r8d, dword [rbx]
lea rcx, str.0x_04x:0x_04x
add rsp, 0x40
pop rbx
pop rsi
pop r12
jmp sym.dbg_printf
lea rcx, str.Unknown_mode__x
add rsp, 0x40
pop rbx
pop rsi
pop r12
jmp sym.dbg_printf

Function at 0x4180a0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 0x18]
mov r12, rcx
mov ebx, edx
cmp eax, 0xffffffff
je 0x418150
test dl, dl
jne 0x418100
cmp eax, 0xffffff1d
je 0x4180d8
mov rcx, r12
add rsp, 0x38
pop rbx
pop r12
jmp sym.print_typed_basic
xor edx, edx
mov rcx, r12
xor r8d, r8d
call sym.types_extract_as_lgint
lea rcx, [0x0043d403]
mov rdx, rax
add rsp, 0x38
pop rbx
pop r12
jmp sym.dbg_printf
lea rdx, [rsp + 0x2c]
xor r8d, r8d
call sym.types_extract_as_lgint
lea edx, [rbx - 0x62]
cmp dl, 0x16
ja case.0x418126.3
lea rcx, [0x0043d4ec]
movzx edx, dl
movsxd rdx, dword [rcx + rdx*4]
add rdx, rcx
jmp rdx
movsx edx, bl
lea rcx, [0x0043d4b0]
call sym.dbg_printf
mov eax, dword [r12 + 0x18]
jmp 0x4180bc
lea rcx, str.Unable_to_evaluate_expression_n
add rsp, 0x38
pop rbx
pop r12
jmp sym.dbg_printf
test rax, rax
jne 0x4181d0
lea rcx, [0x0043d33f]
call sym.dbg_printf
nop
add rsp, 0x38
pop rbx
pop r12
ret
movzx edx, ax
lea rcx, str._d___lc
mov r8d, edx
call sym.dbg_printf
jmp 0x41817a
mov rdx, rax
lea rcx, [0x0043d403]
call sym.dbg_printf
jmp 0x41817a
movsx edx, al
lea rcx, str._d___c
mov r8d, edx
call sym.dbg_printf
jmp 0x41817a
mov ecx, 8
sub ecx, dword [rsp + 0x2c]
mov rdx, 0xffffffffffffffff
shl ecx, 3
shr rdx, cl
lea rcx, [0x0043d341]
and rdx, rax
call sym.dbg_printf
jmp 0x41817a
Function at 0x419330
Capabilities:
Get file size
Read file via mapping

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rbx, rdx
mov rsi, r8
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r8d, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.kernel32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4193f9
test rsi, rsi
je 0x41938f
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetFileSize]
mov dword [rsi], eax
cmp eax, 0xffffffff
je 0x4193f0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_CreateFileMappingW]
mov rcx, r12
mov qword [rbx], rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbx]
test rcx, rcx
je 0x4193f9
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
call qword [sym.imp.kernel32.dll_MapViewOfFile]
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x4198c0
Capabilities:
Write file on windows

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, str.Search_list:_n
call sym.dbg_printf
mov rax, qword [0x004471b0]
mov rax, qword [rax]
mov r12, qword [rax + 0x1350]
test r12, r12
je 0x41993f
mov rsi, qword [sym.imp.ucrtbase.dll_strchr]
lea rdi, str._t_.s_n
nop dword [rax]
mov edx, 0x3b
mov rcx, r12
call rsi
mov rdx, rax
test rax, rax
je 0x419930
lea rbx, [rax + 1]
sub rdx, r12
mov r8, r12
mov rcx, rdi
call sym.dbg_printf
mov r12, rbx
jmp 0x419900
mov rdx, r12
lea rcx, str._t_s_n
call sym.dbg_printf
lea rcx, [0x0043d84c]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp sym.dbg_printf

Function at 0x419a50
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
test rcx, rcx
je 0x419b40
test rdx, rdx
je 0x419b10
mov r12, qword [rcx + 0x18]
mov rdx, qword [rdx + 0x18]
test r12, r12
je 0x419bd8
test rdx, rdx
je 0x419a9c
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_strcmp]
test eax, eax
jne 0x419be8
mov ebx, dword [rbx + 0x10]
mov rbp, qword [0x004471b0]
mov esi, dword [rsi + 0x10]
mov eax, esi
and eax, ebx
cmp eax, 0xffffffff
je 0x419b82
cmp ebx, 0xffffffff
je 0x419b61
cmp esi, 0xffffffff
je 0x419b31
mov rcx, r12
mov r8d, esi
mov edx, ebx
call sym.source_display.isra.0
mov rdi, qword [rbp]
lea rcx, [rdi + 0x1358]
cmp rcx, r12
je 0x419aea
mov rdx, r12
call qword [sym.imp.ucrtbase.dll_strcpy]
movd xmm0, ebx
movd xmm1, esi
punpckldq xmm0, xmm1
movq qword [rdi + 0x145c], xmm0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test rcx, rcx
je 0x419b40
mov r12, qword [rcx + 0x18]
test r12, r12
je 0x419bb0
mov ebx, dword [rcx + 0x10]
mov rbp, qword [0x004471b0]
cmp ebx, 0xffffffff
je 0x419b82
lea esi, [rdi + rbx]
jmp 0x419ac4
test rsi, rsi
je 0x419b70
mov r12, qword [rsi + 0x18]
mov rbp, qword [0x004471b0]
test r12, r12
je 0x419c00
mov esi, dword [rsi + 0x10]
cmp esi, 0xffffffff
je 0x419b82
lea ebx, [rdi + rsi]
jmp 0x419ac4
mov rbp, qword [0x004471b0]
mov rax, qword [rbp]
lea r12, [rax + 0x1358]
mov rax, qword [rbp]
test edi, edi
js 0x419ba0
mov ebx, dword [rax + 0x1460]
lea esi, [rdi + rbx]
jmp 0x419ac4
mov esi, dword [rax + 0x145c]
lea ebx, [rdi + rsi]
jmp 0x419ac4
mov rbp, qword [0x004471b0]
mov ebx, dword [rbx + 0x10]
mov rax, qword [rbp]
lea r12, [rax + 0x1358]
test rsi, rsi
je 0x419b2c
jmp 0x419aa6
test rdx, rdx
je 0x419bb0
mov r12, rdx
jmp 0x419a9c
lea rcx, str.Ambiguous_source_file_specification._n
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.dbg_printf
mov rax, qword [rbp]
lea r12, [rax + 0x1358]
jmp 0x419b59
Function at 0x41a990
Capabilities:
Enumerate threads
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x528
mov rax, qword [0x004471c0]
mov ecx, 0x9a
xor edx, edx
mov rbx, qword [0x004471b0]
mov rsi, qword [0x00447190]
mov rax, qword [rax]
mov r13, qword [rbx]
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
rep movsq qword [rdi], qword [rsi]
mov rsi, qword [0x004471a0]
mov ecx, 4
mov edi, dword [rsi]
call sym.CreateToolhelp32Snapshot
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x41ab58
lea rbp, [rsp + 0x30]
mov rcx, rax
mov dword [rsp + 0x30], 0x1c
mov rdx, rbp
call sym.Thread32First
test eax, eax
je 0x41aabc
lea r15, str._nBacktracing_for_thread__04lx_in_process__04lx___ls_:_n
mov r14, qword gs:[0x30]
jmp 0x41aa67
cmp dword [rsi], r8d
jne 0x41ab18
mov rax, qword [rbx]
mov edx, dword [rsp + 0x38]
mov r9, qword [rax + 0x30]
mov rcx, r15
call sym.dbg_printf
mov edx, dword [rsp + 0x38]
mov rcx, qword [rbx]
call sym.backtrace_tid
mov rdx, rbp
mov rcx, r12
call sym.Thread32Next
test eax, eax
je 0x41aaa8
mov r8d, dword [rsp + 0x3c]
cmp dword [r14 + 0x40], r8d
je 0x41aa58
mov rcx, qword [rbx]
test rcx, rcx
je 0x41aa92
mov eax, dword [rsi]
cmp eax, edi
je 0x41aa92
cmp r8d, eax
je 0x41aa92
mov rax, qword [rcx + 0x20]
xor edx, edx
call qword [rax]
mov r8d, dword [rsp + 0x3c]
cmp edi, r8d
jne 0x41aa30
mov qword [rbx], r13
mov rax, r13
mov dword [rsi], edi
jmp 0x41aa3c
mov rcx, qword [rbx]
test rcx, rcx
je 0x41aabc
cmp dword [rsi], edi
je 0x41aabc
mov rax, qword [rcx + 0x20]
xor edx, edx
call qword [rax]
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rax, qword [0x004471c0]
mov qword [rbx], r13
mov rbx, qword [rsp + 0x20]
mov dword [rsi], edi
mov qword [rax], rbx
xor eax, eax
test rbx, rbx
je 0x41aae3
mov eax, dword [rbx + 0x20]
mov rdi, qword [0x00447190]
mov rsi, qword [rsp + 0x28]
mov ecx, 0x9a
rep movsq qword [rdi], qword [rsi]
mov rdx, qword [0x004471d0]
mov dword [rdx], eax
add rsp, 0x528
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, r8d
call sym.dbg_attach_debuggee
test eax, eax
je 0x41ab40
mov rax, qword [rbx]
mov eax, dword [rax + 0x18]
mov dword [rsi], eax
call sym.dbg_active_wait_for_first_exception
mov rax, qword [rbx]
mov r8d, dword [rsi]
jmp 0x41aa3c
mov edx, dword [rsp + 0x3c]
lea rcx, str._nwarning:_could_not_attach_to__04lx_n
call sym.dbg_printf
jmp 0x41aa58
lea rcx, str.Unable_to_create_toolhelp_snapshot_n
add rsp, 0x528
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.dbg_printf

Function at 0x41ab80
Capabilities:
Enumerate threads
Resume thread
Suspend thread
Write file on windows

Disassembly:
mov edx, ecx
cmp ecx, 0xffffffff
je 0x41abb8
mov rax, qword [0x004471b0]
mov rcx, qword [rax]
test rcx, rcx
je 0x41abc0
mov rax, qword [0x004471d0]
cmp dword [rax], edx
je 0x41abb0
jmp sym.backtrace_tid
jmp sym.backtrace
jmp sym.backtrace_all
lea rcx, str.You_must_be_attached_to_a_process_to_run_this_command._n
jmp sym.dbg_printf

Function at 0x41c050
Capabilities:
Write file on windows

Disassembly:
lea rcx, str.No_longer_supported_n
jmp sym.dbg_printf