joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409b0c
Capabilities:
Get http content length

Disassembly:
push rbx
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
lea rcx, [rsp + 0x38]
call fcn.00404580
cmp qword [rax + 0x20], 0x10
jb 0x409b35
mov rcx, qword [rax + 8]
jmp 0x409b39
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x0046e850], rax
cmp qword [rsp + 0x58], 0x10
jb 0x409b58
mov rcx, qword [rsp + 0x40]
call fcn.00409f14
lea rcx, [rsp + 0x60]
call fcn.00404f98
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.00403988
nop
cmp qword [rbx + 0x20], 0x10
jb 0x409b7d
mov rbx, qword [rbx + 8]
jmp 0x409b81
add rbx, 8
cmp qword [rax + 0x20], 0x10
jb 0x409b8e
mov rdx, qword [rax + 8]
jmp 0x409b92
lea rdx, [rax + 8]
mov rcx, qword [0x0046e850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rbx
call rax
mov qword [0x0046e848], rax
cmp qword [rsp + 0x58], 0x10
jb 0x409bcf
mov rcx, qword [rsp + 0x40]
call fcn.00409f14
mov qword [rsp + 0x58], SafeArrayGetDim
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
cmp qword [rsp + 0x80], 0x10
jb 0x409bfb
mov rcx, qword [rsp + 0x68]
call fcn.00409f14
lea rcx, [rsp + 0x60]
call fcn.004059b0
cmp qword [rax + 0x20], 0x10
jb 0x409c12
mov rdx, qword [rax + 8]
jmp 0x409c16
lea rdx, [rax + 8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x0046e848]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [0x0046e840], rax
cmp qword [rsp + 0x80], 0x10
jb 0x409c5d
mov rcx, qword [rsp + 0x68]
call fcn.00409f14
mov rax, qword [0x0046e840]
mov dword [0x0046e874], 4
mov qword [rsp + 0x20], 0
lea r9, [0x0046e874]
lea r8, [0x0046e870]
mov edx, 0x20000005
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ecx, dword [0x0046e870]
call fcn.00409f1c
mov qword [0x0046e838], rax
lea rcx, [rsp + 0x60]
call fcn.00407d7c
nop
cmp qword [rax + 0x20], 0x10
jb 0x409cb6
mov rdx, qword [rax + 8]
jmp 0x409cba
lea rdx, [rax + 8]
mov rcx, qword [0x0046e850]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [0x0046e878]
mov r8d, dword [0x0046e870]
mov rdx, qword [0x0046e838]
mov rcx, qword [0x0046e840]
call rax
nop
cmp qword [rsp + 0x80], 0x10
jb 0x409cfb
mov rcx, qword [rsp + 0x68]
call fcn.00409f14
lea rcx, [rsp + 0x60]
call fcn.00402e80
nop
cmp qword [rax + 0x20], 0x10
jb 0x409d13
mov rdx, qword [rax + 8]
jmp 0x409d17
lea rdx, [rax + 8]
mov ebx, dword [0x0046e870]
mov rcx, qword [0x0046e868]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call rax
mov qword [0x0046e830], rax
cmp qword [rsp + 0x80], 0x10
jb 0x409d60
mov rcx, qword [rsp + 0x68]
call fcn.00409f14
mov rax, qword [0x0046e830]
mov r8d, dword [0x0046e870]
mov rdx, qword [0x0046e838]
mov rcx, rax
add rsp, 0x90
pop rbx
jmp fcn.00432940
Function at 0x4175e8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x417642
call fcn.0041a418
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x417642
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x417664
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.00417068
test rdi, rdi
mov esi, eax
je 0x417662
test rbx, rbx
je 0x417662
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x417dd4
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x417e0a
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x417ec1
call fcn.004185b0
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x417e29
mov ecx, 0x80004005
call fcn.00401158
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x118]
mov rdx, rsi
mov rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x50]
mov rcx, rdi
call fcn.00433ba0
test eax, eax
je 0x417e94
cmp eax, 0xc
je 0x417e8e
cmp eax, 0x16
je 0x417e88
cmp eax, 0x22
je 0x417e88
cmp eax, 0x50
je 0x417e94
call fcn.0040fbc4
int3
call fcn.0040fbc4
int3
call fcn.0040fb7c
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x417ebf
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x439247
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0046cd68]
jne 0x43289a
rol rcx, 0x10
test cx, 0xffff
jne 0x432896
repz ret
ror rcx, 0x10
jmp 0x4391a0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x004729b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x00472aa8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x439225
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x004729b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x439247
mov rax, qword [rsp + 0x88]
mov qword [0x00472aa8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00472a48], rax
mov rax, qword [0x00472aa8]
mov qword [0x00472920], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00472a30], rax
mov dword [0x00472910], 0xc0000409
mov dword [0x00472914], 1
mov rax, qword [0x0046cd68]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0046cd70]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004729a8], eax
mov ecx, 1
call fcn.00441650
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004567b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004729a8], 0
jne 0x4392ce
mov ecx, 1
call fcn.00441650
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x4411b0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.004368b0
xor ebx, ebx
cmp qword [0x00473210], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x4412e1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x441213
xor eax, eax
jmp 0x4413c1
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x44120c
mov rcx, rax
call fcn.00436840
lea rdx, [0x00456920]
mov rcx, rbp
mov qword [0x00473210], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00436840
lea rdx, [0x00456908]
mov rcx, rbp
mov qword [0x00473218], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00436840
lea rcx, [rsp + 0x30]
mov qword [0x00473220], rax
call fcn.00432e70
test eax, eax
je 0x441297
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00438ee0
cmp dword [rsp + 0x30], 2
jne 0x4412e1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00436840
test rax, rax
mov qword [0x00473230], rax
je 0x4412e1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.00436840
mov qword [0x00473228], rax
mov rcx, qword [0x00473228]
cmp rcx, rsi
je 0x441373
cmp qword [0x00473230], rsi
je 0x441373
call fcn.00436910
call rax
test rax, rax
mov rbp, rax
je 0x44133e
mov rcx, qword [0x00473230]
call fcn.00436910
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x44133e
test byte [rsp + 0x48], 1
jne 0x441373
lea rcx, [rsp + 0x34]
call fcn.00432ec0
test eax, eax
je 0x441360
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00438ee0
cmp dword [rsp + 0x34], 4
jb 0x44136d
bts edi, 0x15
jmp 0x4413a7
bts edi, 0x12
jmp 0x4413a7
mov rcx, qword [0x00473218]
cmp rcx, rsi
je 0x4413a7
call fcn.00436910
call rax
test rax, rax
mov rbx, rax
je 0x4413a7
mov rcx, qword [0x00473220]
cmp rcx, rsi
je 0x4413a7
call fcn.00436910
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x00473210]
call fcn.00436910
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140065650
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140065684
xor eax, eax
jmp 0x1400657df
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400656c1
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x1400656c1
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x1400657df
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xc0], rbp
je 0x1400657d4
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140065708
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140065731
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.1402ae138
cmp ax, di
je 0x1400657d4
movzx edi, si
jmp 0x1400657d4
lea r8, [rsp + 0x50]
mov word [rsp + 0x60], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x62]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x68]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x60]
call qword [0x1403085a0]
test eax, eax
je 0x140065791
sub eax, 1
je 0x140065791
cmp eax, 2
jne 0x1400657d4
movzx ecx, word [rsp + 0x60]
jmp 0x140065714
mov rbp, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
sub rbp, rax
je 0x1400657c1
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x68]
mov r8, rbp
mov edx, 1
call fcn.1402aeabc
cmp rbp, rax
jne 0x1400657d4
lea rax, [rsp + 0x60]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x58], rax
movzx eax, si
jne 0x1400657d7
movzx eax, di
mov rbp, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x140067800
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400678e5
cmp byte [rcx + 0x72], 0
je 0x1400678e5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
mov rax, qword [rax + 0x18]
call qword [0x1403085a0]
cmp di, ax
je 0x1400678e1
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1403085a0]
test eax, eax
je 0x1400678a4
sub eax, 1
je 0x1400678a8
cmp eax, 2
jne 0x1400678e1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400678d8
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1402aeabc
cmp rdi, rax
jne 0x1400678e1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14006788c
xor al, al
jmp 0x14006788c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x60
pop rbx
ret

Function at 0x14006d340
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x14006d370
mov qword [rdi], 0
jmp 0x14006d3d3
cmp qword [rsp + 0x28], 0
jle 0x14006d367
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x20]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14006d3a6
nop
inc ebx
cmp ebx, 3
ja 0x14006d3e9
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14006d390
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm1, qword [rsp + 0x20]
cvtsi2sd xmm0, qword [rsp + 0x28]
mulsd xmm1, qword [0x1403d0bf0]
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov qword [rdi], rax
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x40
pop rdi
ret
mov qword [rdi], 0
jmp 0x14006d3ce
Function at 0x14006dab0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x14006db51
test r8, r8
jle 0x14006db49
mov rcx, rdi
call fcn.14003c380
test rax, rax
jle 0x14006db20
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140299130
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14006db41
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
mov rax, qword [rax + 0x18]
call qword [0x1403085a0]
cmp eax, 0xffffffff
je 0x14006db49
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x14006dae2
sub r14, rbx
mov rax, r14
jmp 0x14006dbcd
mov rax, qword [rcx + 0x40]
mov r9, qword [rax]
test r9, r9
je 0x14006db65
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14006db67
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x14006dbc7
test ecx, ecx
jle 0x14006dba0
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.140299130
mov rax, qword [rdi + 0x58]
sub r14, rsi
add rbp, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x14006dbc7
cmp qword [rdi + 0x80], 0
je 0x14006dbc7
lfence
mov r9, qword [rdi + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.1402aeabc
sub r14, rax
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14006dbf0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x14006dc12
xor eax, eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x14006dc9e
lfence
mov rdi, rbp
nop dword [rax]
mov rcx, rbx
call fcn.140040a10
test rax, rax
jle 0x14006dc6e
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rsi, rdi
mov rcx, r14
cmovge rsi, rax
mov r8, rsi
mov rdx, qword [rdx]
call fcn.140299130
mov rax, qword [rbx + 0x50]
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14006dc8e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [0x1403085a0]
cmp eax, 0xffffffff
je 0x14006dc96
mov byte [r14], al
dec rdi
mov esi, 1
add r14, rsi
test rdi, rdi
jg 0x14006dc30
sub rbp, rdi
jmp 0x14006dd88
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14006dcb5
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14006dcb7
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x14006dcec
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.140299130
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
mov rdi, rsi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14006dd82
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14006dd27
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x14006dd60
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1402af6ec
sub rsi, rax
add r14, rax
mov rdi, rsi
cmp rax, 0xfff
jne 0x14006dd82
cmp rsi, rax
ja 0x14006dd30
test rdi, rdi
je 0x14006dd82
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1402af6ec
mov rsi, rdi
sub rsi, rax
sub rbp, rsi
lfence
mov rsi, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
Function at 0x14006e180
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14006e1b0
xor eax, eax
jmp 0x14006e303
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14006e1ea
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14006e1ea
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14006e303
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rsi
je 0x14006e2f6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14006e22d
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14006e23c
movsx ecx, dil
jmp 0x14006e29a
lea r8, [rsp + 0x50]
mov byte [rsp + 0x60], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x61]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x68]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x60]
call qword [0x1403085a0]
test eax, eax
je 0x14006e2b4
sub eax, 1
je 0x14006e2b4
cmp eax, 2
jne 0x14006e2f6
movsx ecx, byte [rsp + 0x60]
mov rdx, qword [rbx + 0x80]
call fcn.1402af134
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14006e2fb
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
sub rsi, rax
je 0x14006e2e4
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x68]
mov r8, rsi
mov edx, 1
call fcn.1402aeabc
cmp rsi, rax
jne 0x14006e2f6
lea rax, [rsp + 0x60]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x58], rax
mov eax, edi
jne 0x14006e2fb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140296bc0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x14006f240
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14006f323
cmp byte [rcx + 0x71], 0
je 0x14006f323
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [0x1403085a0]
cmp eax, 0xffffffff
je 0x14006f31f
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1403085a0]
test eax, eax
je 0x14006f2e2
sub eax, 1
je 0x14006f2e6
cmp eax, 2
jne 0x14006f31f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14006f316
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1402aeabc
cmp rdi, rax
jne 0x14006f31f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14006f2ca
xor al, al
jmp 0x14006f2ca
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x60
pop rbx
ret
Function at 0x1400ad4d0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400ad51b
call qword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm0, xmm0
lea rcx, [0x1403c3108]
movups xmmword [rsp + 0x20], xmm0
test eax, eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rcx
setne byte [rsp + 0x24]
test eax, eax
jne 0x1400ad530
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x40
pop rbx
ret
lea rdx, [0x1403c3180]
lea rcx, [rsp + 0x20]
call fcn.1400ad480
int3

Function at 0x1400b0bb0
Capabilities:
Get system information on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14045f360]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx edi, r9b
mov rbx, r8
mov r14, rcx
mov qword [rsp + 0x30], rcx
lea rax, vtable.AMD::MMIO.0
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], rbp
mov qword [rcx + 0x20], rbp
lea rsi, [rcx + 0x28]
mov rcx, rsi
call fcn.14003c2e0
nop
lea rcx, [r14 + 0x48]
mov rdx, rbx
call fcn.14003c2e0
nop
mov qword [r14 + 0x68], rbp
mov qword [r14 + 0x70], rbp
mov byte [r14 + 0x88], dil
cmp dword [0x140476720], ebp
jne 0x1400b0c53
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x54]
mov dword [0x140476720], eax
mov rax, qword [0x140476728]
test rax, rax
jne 0x1400b0ccf
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1400b0c6c
mov rax, qword [rsi]
mov qword [rsp + 0x20], rax
lea r9, str.Initializing_for_user:__s_for_cached
xor r8d, r8d
lea edx, [r8 + 0x36]
lea rcx, str.D:JenkinsworkspaceToollib_f541e707ToollibPCIimpl_srcwinMMIO.cpp
call fcn.1400e7220
movzx ecx, byte [r14 + 0x88]
call fcn.1400b0ec0
mov ebx, eax
lea rax, str.MMIO::Initialize_m_bUseUncachedMinus_
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.0x_x_returned_by__s
xor r8d, r8d
lea edx, [r8 + 0x37]
lea rcx, str.D:JenkinsworkspaceToollib_f541e707ToollibPCIimpl_srcwinMMIO.cpp
call fcn.1400e7220
test ebx, ebx
js 0x1400b0d29
mov rax, qword [0x140476728]
inc rax
mov qword [0x140476728], rax
cmp qword [rsi + 0x18], 0x10
jb 0x1400b0ce3
mov rsi, qword [rsi]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
lea r9, str.Incrementing_Uncached_Reference_Count:__d__User:__s
xor r8d, r8d
lea edx, [r8 + 0x3d]
lea rcx, str.D:JenkinsworkspaceToollib_f541e707ToollibPCIimpl_srcwinMMIO.cpp
call fcn.1400e7220
nop
mov rax, r14
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140296bc0
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lfence
mov r8d, ebx
lea rdx, str.HRESULT_Exception
lea rcx, [rsp + 0x38]
call fcn.14003b310
lea rdx, [0x14043a468]
lea rcx, [rsp + 0x38]
call fcn.140298f00
int3