joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438234
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x004571d0]
cmp eax, 0
jne 0x438272
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x43827c
mov eax, 0
jmp 0x43850e
mov rax, qword [0x00456c58]
cmp rax, 0
je 0x4382a2
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00456c58]
call r11
mov eax, dword [0x00456bd4]
cmp eax, 0
je 0x438327
call fcn.004427e7
cmp eax, 0
je 0x438327
mov eax, dword [0x004571dc]
cmp eax, 0
jne 0x4382d3
jmp 0x4382e5
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.0044b07a
call fcn.004427e7
cmp eax, 0
je 0x438327
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x438315
mov eax, 0
jmp 0x43850e
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.0043856a
jmp 0x4382e5
call fcn.00437fbb
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x004571dc]
mov ecx, dword [0x00456bd0]
or eax, ecx
cmp eax, 0
je 0x43837c
mov eax, dword [0x004571dc]
cmp eax, 0
je 0x43836c
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.0044b07a
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.00432e5e
mov eax, dword [0x004571e8]
cmp eax, 0
jne 0x4383a4
mov rax, qword [rbp + 0x10]
lea rcx, [0x004379d6]
cmp rax, rcx
je 0x4383d1
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00447675
cmp eax, 0
jne 0x4383d1
mov eax, 0
jmp 0x43850e
call fcn.004431ef
call fcn.00442cb5
mov eax, 1
mov dword [0x00456c50], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.0043876d
cmp eax, 0
jne 0x438421
mov eax, dword [0x00456bd4]
cmp eax, 0
jne 0x438417
call fcn.004431ef
call fcn.00432f98
mov eax, 0
jmp 0x43850e
call fcn.00438f44
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x4384e3
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x00456bd0]
cmp eax, 0
je 0x4384b3
mov eax, dword [0x00456bc8]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x00456bc8], eax
mov eax, dword [0x00456bcc]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x00456bcc], eax
mov eax, dword [0x00456bcc]
cmp eax, 0xf4240
jb 0x4384b3
mov eax, dword [0x00456bcc]
sub eax, 0xf4240
mov dword [0x00456bcc], eax
mov eax, dword [0x00456bc8]
mov ecx, eax
add eax, 1
mov dword [0x00456bc8], eax
mov eax, dword [0x004571dc]
cmp eax, 0
je 0x4384e3
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0044b07a
mov rax, qword [0x00456c58]
cmp rax, 0
je 0x438509
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00456c58]
call r11
mov eax, 1
leave
ret
Function at 0x43823f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x004571d0]
cmp eax, 0
jne 0x438272
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x43827c
mov eax, 0
jmp 0x43850e
mov rax, qword [0x00456c58]
cmp rax, 0
je 0x4382a2
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00456c58]
call r11
mov eax, dword [0x00456bd4]
cmp eax, 0
je 0x438327
call fcn.004427e7
cmp eax, 0
je 0x438327
mov eax, dword [0x004571dc]
cmp eax, 0
jne 0x4382d3
jmp 0x4382e5
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.0044b07a
call fcn.004427e7
cmp eax, 0
je 0x438327
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x438315
mov eax, 0
jmp 0x43850e
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.0043856a
jmp 0x4382e5
call fcn.00437fbb
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x004571dc]
mov ecx, dword [0x00456bd0]
or eax, ecx
cmp eax, 0
je 0x43837c
mov eax, dword [0x004571dc]
cmp eax, 0
je 0x43836c
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.0044b07a
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.00432e5e
mov eax, dword [0x004571e8]
cmp eax, 0
jne 0x4383a4
mov rax, qword [rbp + 0x10]
lea rcx, [0x004379d6]
cmp rax, rcx
je 0x4383d1
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00447675
cmp eax, 0
jne 0x4383d1
mov eax, 0
jmp 0x43850e
call fcn.004431ef
call fcn.00442cb5
mov eax, 1
mov dword [0x00456c50], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.0043876d
cmp eax, 0
jne 0x438421
mov eax, dword [0x00456bd4]
cmp eax, 0
jne 0x438417
call fcn.004431ef
call fcn.00432f98
mov eax, 0
jmp 0x43850e
call fcn.00438f44
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x4384e3
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x00456bd0]
cmp eax, 0
je 0x4384b3
mov eax, dword [0x00456bc8]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x00456bc8], eax
mov eax, dword [0x00456bcc]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x00456bcc], eax
mov eax, dword [0x00456bcc]
cmp eax, 0xf4240
jb 0x4384b3
mov eax, dword [0x00456bcc]
sub eax, 0xf4240
mov dword [0x00456bcc], eax
mov eax, dword [0x00456bc8]
mov ecx, eax
add eax, 1
mov dword [0x00456bc8], eax
mov eax, dword [0x004571dc]
cmp eax, 0
je 0x4384e3
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0044b07a
mov rax, qword [0x00456c58]
cmp rax, 0
je 0x438509
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00456c58]
call r11
mov eax, 1
leave
ret
Function at 0x4464f9
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x446525
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x004571a8]
cmp eax, 0
je 0x44655a
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x446555
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x446753
mov eax, dword [0x004571a4]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x004571a8], eax
mov eax, dword [0x004571a0]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x4465de
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x00457060]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x004571a0], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x00457060]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x4465ff
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x004571c4]
cmp eax, 0
je 0x44661d
mov r11, qword [0x00456c78]
call r11
jmp 0x446625
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x446654
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0044afdc
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x4466c2
jmp 0x44667c
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x44665c
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.00432b70]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.00441251
jmp 0x44666f
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x446706
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x446706
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x00457248]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x446727
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x004571a8], eax
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x446753
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret
Function at 0x446504
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x446525
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x004571a8]
cmp eax, 0
je 0x44655a
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x446555
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x446753
mov eax, dword [0x004571a4]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x004571a8], eax
mov eax, dword [0x004571a0]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x4465de
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x00457060]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x004571a0], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x00457060]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x4465ff
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x004571c4]
cmp eax, 0
je 0x44661d
mov r11, qword [0x00456c78]
call r11
jmp 0x446625
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x446654
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0044afdc
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x4466c2
jmp 0x44667c
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x44665c
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.00432b70]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.00441251
jmp 0x44666f
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x446706
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x446706
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x00457248]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x446727
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x004571a8], eax
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x446753
lea rax, [0x00457f68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret
Function at 0x447675
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x004571dc]
cmp eax, 2
jne 0x4476a7
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x004571c0]
cmp eax, ecx
jae 0x447819
jmp 0x4476d2
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x4476af
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x00456e30]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x447709
jmp 0x4476c5
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x447814
jmp 0x44773e
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x447717
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x44780f
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x447796
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x447796
mov eax, 0
jmp 0x44785d
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.00433844
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x4477e2
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00456bc0]
sub rax, 1
cmp rcx, rax
jne 0x44780a
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00446c2b
jmp 0x447751
jmp 0x44772d
jmp 0x4476c5
mov eax, dword [0x004571dc]
cmp eax, 2
jne 0x447858
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0044b07a
mov eax, 1
leave
ret
Function at 0x447680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x004571dc]
cmp eax, 2
jne 0x4476a7
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x004571c0]
cmp eax, ecx
jae 0x447819
jmp 0x4476d2
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x4476af
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x00456e30]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x447709
jmp 0x4476c5
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x447814
jmp 0x44773e
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x447717
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x44780f
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x447796
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x447796
mov eax, 0
jmp 0x44785d
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.00433844
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x4477e2
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00456bc0]
sub rax, 1
cmp rcx, rax
jne 0x44780a
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00446c2b
jmp 0x447751
jmp 0x44772d
jmp 0x4476c5
mov eax, dword [0x004571dc]
cmp eax, 2
jne 0x447858
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0044b07a
mov eax, 1
leave
ret
Function at 0x44abd6
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, 0
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x128]
mov qword [rbp - 0x10], rax
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, str.GC_LOG_FILE
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetEnvironmentVariableA
sub eax, 1
cmp eax, 0x104
jae 0x44ac37
mov eax, 1
mov dword [rbp - 0x14], eax
jmp 0x44acdf
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
cmp eax, 4
jle 0x44aca7
mov eax, dword [rbp - 0x12c]
sub eax, 4
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movsx eax, byte [rcx]
cmp eax, 0x2e
jne 0x44aca7
mov eax, dword [rbp - 0x12c]
sub eax, 4
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movabs rax, 8
mov r8, rax
lea rax, str..gc.log
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x44acf0
jmp 0x44acfa
mov eax, 2
jmp 0x44acff
mov eax, 4
mov ecx, dword [0x004571dc]
cmp ecx, 2
mov dword [rbp - 0x130], eax
jne 0x44ad19
jmp 0x44ad23
mov eax, 0x80000080
jmp 0x44ad28
mov eax, pe_nt_image_headers64
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x130]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 8], rax
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x44adcb
mov rax, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
je 0x44adcb
mov eax, 0
mov dword [rbp - 0x134], eax
mov eax, 2
mov r9, rax
lea rax, [rbp - 0x134]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFilePointer
mov rax, qword [rbp - 8]
leave
ret
Function at 0x44abe1
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, 0
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x128]
mov qword [rbp - 0x10], rax
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, str.GC_LOG_FILE
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetEnvironmentVariableA
sub eax, 1
cmp eax, 0x104
jae 0x44ac37
mov eax, 1
mov dword [rbp - 0x14], eax
jmp 0x44acdf
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
cmp eax, 4
jle 0x44aca7
mov eax, dword [rbp - 0x12c]
sub eax, 4
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movsx eax, byte [rcx]
cmp eax, 0x2e
jne 0x44aca7
mov eax, dword [rbp - 0x12c]
sub eax, 4
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movabs rax, 8
mov r8, rax
lea rax, str..gc.log
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x44acf0
jmp 0x44acfa
mov eax, 2
jmp 0x44acff
mov eax, 4
mov ecx, dword [0x004571dc]
cmp ecx, 2
mov dword [rbp - 0x130], eax
jne 0x44ad19
jmp 0x44ad23
mov eax, 0x80000080
jmp 0x44ad28
mov eax, pe_nt_image_headers64
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x130]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 8], rax
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x44adcb
mov rax, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
je 0x44adcb
mov eax, 0
mov dword [rbp - 0x134], eax
mov eax, 2
mov r9, rax
lea rax, [rbp - 0x134]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFilePointer
mov rax, qword [rbp - 8]
leave
ret
Function at 0x44add1
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
cmp rax, 0
jne 0x44adfc
mov eax, 0
jmp 0x44aef0
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x44ae1d
lea rax, [0x00458268]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov rax, qword [0x00457238]
cmp rax, 0
jne 0x44ae3a
call fcn.0044abd6
mov qword [0x00457238], rax
mov rax, qword [0x00457238]
cmp rax, 0xffffffffffffffff
jne 0x44ae76
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x44ae6c
lea rax, [0x00458268]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, 0xffffffff
jmp 0x44aef0
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 8]
mov r9, rax
mov eax, dword [rbp + 0x18]
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [0x00457238]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteFile
mov dword [rbp - 4], eax
mov eax, dword [0x004572ac]
cmp eax, 0
je 0x44aed2
lea rax, [0x00458268]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x44aee3
jmp 0x44aeed
mov eax, 0xffffffff
jmp 0x44aef0
mov eax, dword [rbp - 8]
leave
ret
Function at 0x44e598
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x510
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
add rax, 0x10
lea rcx, [rbp - 4]
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetExitCodeThread
cmp eax, 0
je 0x44e5f0
mov eax, dword [rbp - 4]
cmp eax, 0x103
je 0x44e5f0
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.0044dce8
jmp 0x44e757
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x44e6bf
mov eax, 0x100003
mov dword [rbp - 0x4b0], eax
mov rax, qword [rbp + 0x10]
add rax, 0x10
lea rcx, [rbp - 0x4e0]
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetThreadContext
cmp eax, 0
je 0x44e684
mov rax, qword [rbp + 0x10]
add rax, 0x40
mov rcx, qword [rbp + 0x10]
add rcx, 0x48
lea rdx, [rbp - 0x4e0]
mov r11, rdx
mov r10, rcx
mov qword [rbp - 0x4e8], rax
mov rcx, r10
mov rdx, r11
call fcn.0044ebc8
mov rcx, qword [rbp - 0x4e8]
mov qword [rcx], rax
jmp 0x44e711
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
jne 0x44e6bf
lea rax, str.ResumeThread_failed_in_suspend_loop
mov r10, rax
mov rcx, r10
mov r11, qword [0x00457248]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [rbp - 8]
cmp eax, 1
jle 0x44e6db
mov eax, 0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 8], eax
cmp eax, 0xf4240
jl 0x44e70c
lea rax, str.SuspendThread_loop_failed
mov r10, rax
mov rcx, r10
mov r11, qword [0x00457248]
call r11
call sub.kernel32.dll_DebugBreak
jmp 0x44e5a4
mov rax, qword [rbp + 0x10]
add rax, 0x3b
mov ecx, 1
mov byte [rax], cl
mov rax, qword [0x00457250]
cmp rax, 0
je 0x44e757
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r11, rcx
mov eax, 0xa
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [0x00457250]
call r11
leave
ret