joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074188
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400741d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400741d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400741d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400741d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400741d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400741d4
xor al, al
add rsp, 0x28
ret

Function at 0x140082604
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140082497
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140082497
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140082497
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140082497
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140082497
cmp dword [rcx + 0x84], 0xe
jbe 0x140082497
cmp dword [rcx + 0xf8], 0
je 0x140082497
mov ecx, ebx
call fcn.140082538
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140082328
cmp dword [rbp + 0x20], 0
je 0x1400824e4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400824ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x140082430
Function at 0x140093550
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140093578
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140093578
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x41c5dd
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [rbp + 0x20]
cmp eax, 0
jg 0x41c605
jmp 0x41c6af
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x20]
movsxd rax, eax
mov qword [rbp - 0x10], rax
movabs rax, 0
mov qword [rbp - 0x18], rax
call sub.msvcrt.dll___iob_func
add rax, 0x30
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x10]
cmp eax, 2
jne 0x41c64b
call sub.msvcrt.dll___iob_func
add rax, 0x60
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
jg 0x41c65e
jmp 0x41c6af
mov rax, qword [rbp - 0x20]
mov r9, rax
mov rax, qword [rbp - 0x10]
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rax, rcx
mov qword [rbp - 0x10], rax
jmp 0x41c64b
leave
ret

Function at 0x41c5e8
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [rbp + 0x20]
cmp eax, 0
jg 0x41c605
jmp 0x41c6af
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x20]
movsxd rax, eax
mov qword [rbp - 0x10], rax
movabs rax, 0
mov qword [rbp - 0x18], rax
call sub.msvcrt.dll___iob_func
add rax, 0x30
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x10]
cmp eax, 2
jne 0x41c64b
call sub.msvcrt.dll___iob_func
add rax, 0x60
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
jg 0x41c65e
jmp 0x41c6af
mov rax, qword [rbp - 0x20]
mov r9, rax
mov rax, qword [rbp - 0x10]
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
sub rax, rcx
mov qword [rbp - 0x10], rax
jmp 0x41c64b
leave
ret
Function at 0x45428c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x00471078]
cmp eax, 0
jne 0x4542ca
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4542d4
mov eax, 0
jmp 0x454566
mov rax, qword [0x00470b00]
cmp rax, 0
je 0x4542fa
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00470b00]
call r11
mov eax, dword [0x00470a7c]
cmp eax, 0
je 0x45437f
call fcn.0045e83f
cmp eax, 0
je 0x45437f
mov eax, dword [0x00471084]
cmp eax, 0
jne 0x45432b
jmp 0x45433d
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.004670d2
call fcn.0045e83f
cmp eax, 0
je 0x45437f
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x45436d
mov eax, 0
jmp 0x454566
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.004545c2
jmp 0x45433d
call fcn.00454013
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x00471084]
mov ecx, dword [0x00470a78]
or eax, ecx
cmp eax, 0
je 0x4543d4
mov eax, dword [0x00471084]
cmp eax, 0
je 0x4543c4
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.004670d2
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.0044eeb6
mov eax, dword [0x00471090]
cmp eax, 0
jne 0x4543fc
mov rax, qword [rbp + 0x10]
lea rcx, [0x00453a2e]
cmp rax, rcx
je 0x454429
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004636cd
cmp eax, 0
jne 0x454429
mov eax, 0
jmp 0x454566
call fcn.0045f247
call fcn.0045ed0d
mov eax, 1
mov dword [0x00470af8], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.004547c5
cmp eax, 0
jne 0x454479
mov eax, dword [0x00470a7c]
cmp eax, 0
jne 0x45446f
call fcn.0045f247
call fcn.0044eff0
mov eax, 0
jmp 0x454566
call fcn.00454f9c
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x45453b
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x00470a78]
cmp eax, 0
je 0x45450b
mov eax, dword [0x00470a70]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x00470a70], eax
mov eax, dword [0x00470a74]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x00470a74], eax
mov eax, dword [0x00470a74]
cmp eax, 0xf4240
jb 0x45450b
mov eax, dword [0x00470a74]
sub eax, 0xf4240
mov dword [0x00470a74], eax
mov eax, dword [0x00470a70]
mov ecx, eax
add eax, 1
mov dword [0x00470a70], eax
mov eax, dword [0x00471084]
cmp eax, 0
je 0x45453b
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004670d2
mov rax, qword [0x00470b00]
cmp rax, 0
je 0x454561
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00470b00]
call r11
mov eax, 1
leave
ret
Function at 0x454297
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x00471078]
cmp eax, 0
jne 0x4542ca
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4542d4
mov eax, 0
jmp 0x454566
mov rax, qword [0x00470b00]
cmp rax, 0
je 0x4542fa
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00470b00]
call r11
mov eax, dword [0x00470a7c]
cmp eax, 0
je 0x45437f
call fcn.0045e83f
cmp eax, 0
je 0x45437f
mov eax, dword [0x00471084]
cmp eax, 0
jne 0x45432b
jmp 0x45433d
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.004670d2
call fcn.0045e83f
cmp eax, 0
je 0x45437f
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x45436d
mov eax, 0
jmp 0x454566
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.004545c2
jmp 0x45433d
call fcn.00454013
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x00471084]
mov ecx, dword [0x00470a78]
or eax, ecx
cmp eax, 0
je 0x4543d4
mov eax, dword [0x00471084]
cmp eax, 0
je 0x4543c4
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.004670d2
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.0044eeb6
mov eax, dword [0x00471090]
cmp eax, 0
jne 0x4543fc
mov rax, qword [rbp + 0x10]
lea rcx, [0x00453a2e]
cmp rax, rcx
je 0x454429
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004636cd
cmp eax, 0
jne 0x454429
mov eax, 0
jmp 0x454566
call fcn.0045f247
call fcn.0045ed0d
mov eax, 1
mov dword [0x00470af8], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.004547c5
cmp eax, 0
jne 0x454479
mov eax, dword [0x00470a7c]
cmp eax, 0
jne 0x45446f
call fcn.0045f247
call fcn.0044eff0
mov eax, 0
jmp 0x454566
call fcn.00454f9c
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x45453b
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x00470a78]
cmp eax, 0
je 0x45450b
mov eax, dword [0x00470a70]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x00470a70], eax
mov eax, dword [0x00470a74]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x00470a74], eax
mov eax, dword [0x00470a74]
cmp eax, 0xf4240
jb 0x45450b
mov eax, dword [0x00470a74]
sub eax, 0xf4240
mov dword [0x00470a74], eax
mov eax, dword [0x00470a70]
mov ecx, eax
add eax, 1
mov dword [0x00470a70], eax
mov eax, dword [0x00471084]
cmp eax, 0
je 0x45453b
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004670d2
mov rax, qword [0x00470b00]
cmp rax, 0
je 0x454561
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00470b00]
call r11
mov eax, 1
leave
ret
Function at 0x462551
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x00471154]
cmp eax, 0
je 0x46257d
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x00471050]
cmp eax, 0
je 0x4625b2
mov eax, dword [0x00471154]
cmp eax, 0
je 0x4625ad
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4627ab
mov eax, dword [0x0047104c]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x00471050], eax
mov eax, dword [0x00471048]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x462636
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x00470f08]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x00471048], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x00470f08]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x00471154]
cmp eax, 0
je 0x462657
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x0047106c]
cmp eax, 0
je 0x462675
mov r11, qword [0x00470b20]
call r11
jmp 0x46267d
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x4626ac
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00467034
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x46271a
jmp 0x4626d4
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x4626b4
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.0044ebc8]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.0045d2a9
jmp 0x4626c7
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x46275e
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x46275e
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x004710f0]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x00471154]
cmp eax, 0
je 0x46277f
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x00471050], eax
mov eax, dword [0x00471154]
cmp eax, 0
je 0x4627ab
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret
Function at 0x46255c
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x00471154]
cmp eax, 0
je 0x46257d
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x00471050]
cmp eax, 0
je 0x4625b2
mov eax, dword [0x00471154]
cmp eax, 0
je 0x4625ad
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x4627ab
mov eax, dword [0x0047104c]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x00471050], eax
mov eax, dword [0x00471048]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x462636
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x00470f08]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x00471048], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x00470f08]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x00471154]
cmp eax, 0
je 0x462657
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x0047106c]
cmp eax, 0
je 0x462675
mov r11, qword [0x00470b20]
call r11
jmp 0x46267d
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x4626ac
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00467034
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x46271a
jmp 0x4626d4
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x4626b4
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.0044ebc8]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.0045d2a9
jmp 0x4626c7
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x46275e
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x46275e
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x004710f0]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x00471154]
cmp eax, 0
je 0x46277f
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x00471050], eax
mov eax, dword [0x00471154]
cmp eax, 0
je 0x4627ab
lea rax, [0x00472088]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret
Function at 0x4636cd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x00471084]
cmp eax, 2
jne 0x4636ff
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x00471068]
cmp eax, ecx
jae 0x463871
jmp 0x46372a
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x463707
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x00470cd8]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x463761
jmp 0x46371d
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x46386c
jmp 0x463796
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x46376f
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x463867
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x4637ee
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x4637ee
mov eax, 0
jmp 0x4638b5
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.0044f89c
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x46383a
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00470a68]
sub rax, 1
cmp rcx, rax
jne 0x463862
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00462c83
jmp 0x4637a9
jmp 0x463785
jmp 0x46371d
mov eax, dword [0x00471084]
cmp eax, 2
jne 0x4638b0
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004670d2
mov eax, 1
leave
ret
Function at 0x4636d8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x00471084]
cmp eax, 2
jne 0x4636ff
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x00471068]
cmp eax, ecx
jae 0x463871
jmp 0x46372a
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x463707
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x00470cd8]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x463761
jmp 0x46371d
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x46386c
jmp 0x463796
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x46376f
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x463867
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x4637ee
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x4637ee
mov eax, 0
jmp 0x4638b5
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.0044f89c
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x46383a
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00470a68]
sub rax, 1
cmp rcx, rax
jne 0x463862
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00462c83
jmp 0x4637a9
jmp 0x463785
jmp 0x46371d
mov eax, dword [0x00471084]
cmp eax, 2
jne 0x4638b0
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004670d2
mov eax, 1
leave
ret
Function at 0x466c2e
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, 0
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x128]
mov qword [rbp - 0x10], rax
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, str.GC_LOG_FILE
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetEnvironmentVariableA
sub eax, 1
cmp eax, 0x104
jae 0x466c8f
mov eax, 1
mov dword [rbp - 0x14], eax
jmp 0x466d37
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
cmp eax, 4
jle 0x466cff
mov eax, dword [rbp - 0x12c]
sub eax, 4
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movsx eax, byte [rcx]
cmp eax, 0x2e
jne 0x466cff
mov eax, dword [rbp - 0x12c]
sub eax, 4
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movabs rax, 8
mov r8, rax
lea rax, str..gc.log
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x466d48
jmp 0x466d52
mov eax, 2
jmp 0x466d57
mov eax, 4
mov ecx, dword [0x00471084]
cmp ecx, 2
mov dword [rbp - 0x130], eax
jne 0x466d71
jmp 0x466d7b
mov eax, 0x80000080
jmp 0x466d80
mov eax, pe_nt_image_headers64
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x130]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 8], rax
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x466e23
mov rax, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
je 0x466e23
mov eax, 0
mov dword [rbp - 0x134], eax
mov eax, 2
mov r9, rax
lea rax, [rbp - 0x134]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFilePointer
mov rax, qword [rbp - 8]
leave
ret