joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011eef0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14011f0e1
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
mov r8, rbx
call fcn.14002be10
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14011f09f
movabs rbp, 0x100000001b3
movabs r14, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r8d, byte [rcx + 0x10]
xor r8, r14
imul r8, rbp
movzx eax, byte [rcx + 0x11]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x12]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x13]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x14]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x15]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x16]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x17]
xor r8, rax
imul r8, rbp
and r8, qword [rsi + 0x30]
mov r11, r8
shl r11, 4
add r11, qword [rsi + 0x18]
add r8, r8
mov rax, qword [rsi + 0x18]
lea rdi, [rax + r8*8]
cmp qword [r11], rbx
jne 0x14011f014
mov qword [r11], rcx
mov qword [rdi + 8], rcx
jmp 0x14011f093
mov rax, qword [rdi + 8]
mov r8, qword [rax + 0x10]
cmp qword [rcx + 0x10], r8
jne 0x14011f051
mov r8, qword [rax]
cmp r8, rcx
je 0x14011f04b
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov r9, qword [r8 + 8]
mov qword [r9], rcx
mov qword [r8 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [rdi + 8], rcx
jmp 0x14011f093
cmp qword [r11], rax
je 0x14011f06f
mov r9, qword [rcx + 0x10]
mov r8, qword [r11]
nop dword [rax]
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
je 0x14011f0bb
cmp r8, rax
jne 0x14011f060
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x14011ef90
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
jmp 0x14011f093
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14011f890
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1402922b8]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edi, edi
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x40]
lea rcx, [0x1402a36c0]
call fcn.14011fa30
nop
mov rax, qword [rsp + 0x48]
mov byte [rax], dil
lea ecx, [rdi + 8]
call fcn.14012fc1c
test rax, rax
je 0x14011f8e5
lea rcx, [0x14011fab0]
mov qword [rax], rcx
jmp 0x14011f8e8
mov rax, rdi
mov qword [rsp + 0x38], rax
mov ebx, 2
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14011e050]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14011fa0c
mov qword [rsp + 0x38], rdi
and ebx, 0xfffffffd
mov dword [rsp + 0x30], ebx
cmp dword [0x1402a3488], 0
je 0x14011f942
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [0x1402a3480], xmm1
cmp dword [rsp + 0x68], 0
je 0x14011f965
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call sub.MSVCP140.dll__Xtime_get_ticks
imul rcx, rax, 0x64
add rcx, 0x3b9aca00
movabs rax, 0x112e0be826d694b3
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x60], rdx
imul rax, rdx, 0x3b9aca00
sub rcx, rax
mov dword [rsp + 0x68], ecx
mov rcx, qword [rsp + 0x50]
call sub.MSVCP140.dll__Mtx_current_owns
test eax, eax
je 0x14011fa01
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
lea rcx, [0x1402a3400]
call sub.MSVCP140.dll__Cnd_timedwait
mov rax, qword [rsp + 0x48]
movzx ebx, byte [rax]
cmp byte [rsp + 0x58], 0
je 0x14011f9e0
mov rcx, qword [rsp + 0x50]
call sub.MSVCP140.dll__Mtx_unlock
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14012fd90
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
mov ecx, 4
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1401211b0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1402922b8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor ebp, ebp
mov dword [rsp + 0x40], ebp
lea ecx, [rbp + 0x28]
call fcn.14012fc1c
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14012131e
lea rax, vtable.eax::legacy::FileMapping.0
mov qword [rbx], rax
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1400f1af0
nop
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1401212c4
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401212c4
mov rax, qword [rsp + 0x48]
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
lea r8d, [rbp + 2]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1401212c4
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x20], rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140121302
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
cmp rdx, 0x1000
jb 0x1401212fd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140121317
mov rcx, r8
call fcn.14012fc60
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bp
jmp 0x140121321
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rbx, rbp
mov qword [rdi], rbx
mov dword [rsp + 0x40], 1
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14012fd90
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x140125420
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x60
mov rax, qword [0x1402922b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov ecx, dword [0x1402a4038]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1402a3940], eax
jg 0x140125578
nop dword [rax]
movzx edx, dil
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x79]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x7a]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x7b]
xor rdx, rax
imul rdx, rcx
and rdx, qword [0x1402a3930]
lea rax, [rdx + rdx]
mov r9, qword [0x1402a3918]
mov rcx, qword [r9 + rax*8 + 8]
mov r8, qword [0x1402a3908]
cmp rcx, r8
je 0x140125502
add rdx, rdx
mov rax, qword [r9 + rdx*8]
cmp edi, dword [rcx + 0x10]
je 0x140125505
cmp rcx, rax
je 0x140125502
mov rcx, qword [rcx + 8]
cmp edi, dword [rcx + 0x10]
jne 0x1401254f2
jmp 0x140125505
mov rcx, rsi
mov rdx, r8
test rcx, rcx
cmovne rdx, rcx
cmp rdx, r8
je 0x140125522
add rdx, 0x18
mov rcx, rbx
call fcn.140019bb0
jmp 0x14012554e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 5
mov qword [rbx + 0x18], 0xf
mov eax, dword [str.fatal]
mov dword [rbx], eax
movzx eax, byte [0x1401902f8]
mov byte [rbx + 4], al
mov byte [rbx + 5], 0
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012fd90
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [0x1402a3940]
call fcn.1401309b4
cmp dword [0x1402a3940], 0xffffffff
jne 0x140125480
mov dword [rsp + 0x30], 0x3e9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x50], 0xf
mov rax, qword [str.warning]
mov dword [rsp + 0x38], eax
movzx eax, word [0x1401a26c4]
mov word [rsp + 0x3c], ax
movzx eax, byte [0x1401a26c6]
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], 0
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
mov dword [0x1402a3900], eax
mov qword [0x1402a3908], rsi
mov qword [0x1402a3910], rsi
mov ecx, 0x38
call fcn.14012fc1c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x1402a3908], rax
mov qword [0x1402a3918], rsi
xorps xmm0, xmm0
movdqa xmmword [0x1402a3920], xmm0
mov qword [0x1402a3930], 7
mov qword [0x1402a3938], 8
mov dword [0x1402a3900], 0x3f800000
mov r8, qword [0x1402a3908]
mov edx, 0x10
lea rcx, [0x1402a3918]
call fcn.14002be10
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
lea rcx, [0x1402a3900]
call fcn.140124740
nop
lea r9, [fcn.14002a7b0]
mov edx, 0x28
lea r8d, [rdx - 0x27]
lea rcx, [rsp + 0x30]
call fcn.14012fddc
lea rcx, [0x14018bed0]
call fcn.1401300e4
nop
lea rcx, [0x1402a3940]
call fcn.140130948
jmp 0x140125480
Function at 0x140126e70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov r15, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
xor esi, esi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
lea ecx, [rsi + 0x50]
call fcn.14012fc1c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [r15 + 8], rax
mov qword [r15 + 0x18], rsi
mov qword [r15 + 0x20], rsi
mov qword [r15 + 0x28], rsi
mov rax, qword [rbx + 0x30]
mov qword [r15 + 0x30], rax
mov rax, qword [rbx + 0x38]
mov qword [r15 + 0x38], rax
lea rcx, [r15 + 0x18]
mov rdx, qword [rbx + 0x20]
sub rdx, qword [rbx + 0x18]
sar rdx, 3
mov r8, qword [r15 + 8]
call fcn.14002be10
mov rdi, qword [rbx + 8]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140127075
lea r12, [r15 + 8]
movabs r13, 0x333333333333333
movabs r9, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r8, qword [rbx + 0x20]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0x10
jb 0x140126f2a
mov rdx, qword [rbx + 0x10]
mov rbp, rax
mov rcx, rsi
test r8, r8
je 0x140126f53
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor rbp, rax
imul rbp, r9
inc rcx
cmp rcx, r8
jb 0x140126f40
mov r9, rbp
lea r8, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140020f90
cmp qword [rsp + 0x38], 0
jne 0x140127069
cmp qword [r15 + 0x10], r13
je 0x140127090
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x28], rsi
mov ecx, 0x50
call fcn.14012fc1c
mov r13, rax
mov qword [rsp + 0x28], rax
lea rsi, [rax + 0x10]
mov qword [rsp + 0x98], rsi
lea rdx, [rbx + 0x10]
mov rcx, rsi
call fcn.140019bb0
nop
lea rcx, [rsi + 0x20]
lea rdx, [rbx + 0x30]
call fcn.140019bb0
nop
mov rcx, qword [r15 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x140126fd9
cvtsi2ss xmm0, rcx
jmp 0x140126fee
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r15 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140127001
cvtsi2ss xmm1, rcx
jmp 0x140127016
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r15]
jbe 0x140127044
mov rcx, r15
call fcn.1400ad8c0
lea r8, [r13 + 0x10]
mov r9, rbp
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140020f90
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x28], rsi
mov r9, r13
mov r8, qword [rsp + 0x30]
mov rdx, rbp
mov rcx, r15
call fcn.14005d600
nop
movabs r13, 0x333333333333333
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140126f03
mov rax, r15
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14012f140
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov rdi, r8
mov rax, rdx
je 0x14012f170
mov r9, qword [rcx + 8]
mov ebx, 1
mov edx, ebx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
je 0x14012f172
xor bl, bl
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14012f834
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14012f8b8
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1401a3e60]
cmp byte [rcx + rax], 0
je 0x14012f8b8
dec r8
sub rdx, 1
jne 0x14012f89e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140130cc4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140130d0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140130d0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140130d0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140130d0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140130d0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140130d10
xor al, al
add rsp, 0x28
ret

Function at 0x140135b00
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 9], 0
mov rbx, rcx
je 0x140135b1b
lea rcx, str.User_requested_cancellation_of_run._n
call fcn.140151d90
mov rcx, qword [rbx + 0x6f8]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [rbx + 0x48], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1401362c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 9], 0
mov rdi, rdx
mov rbx, rcx
je 0x14013630f
lea rcx, str.Target_process_generated_an_exception._n
call fcn.140151d90
mov edx, dword [rdi]
lea rcx, str._Code______0x_08x_n
call fcn.140151d90
mov rdx, qword [rdi + 0x10]
lea rcx, str._Address___0x_016llX__n
call fcn.140151d90
mov edx, dword [rdi + 4]
lea rcx, str._Flags_____0x_08x_n
call fcn.140151d90
mov rcx, qword [rbx + 0x6f8]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [rbx + 0x48], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140137d00
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
xor r10d, r10d
mov r11, rcx
cmp byte [rcx + 0x558], r10b
je 0x140137d59
mov rax, qword [rcx + 0x5b8]
cmp rax, 0xffffffffffffffff
je 0x140137d28
mov r10, rax
cmp r8, rax
jb 0x140137d61
mov rcx, qword [rcx + 0x5c0]
add rcx, r10
cmp r8, rcx
jae 0x140137d61
cmp byte [r11 + 0x5b0], 0
je 0x140137d44
sub r8, r10
mov rax, qword [rsp + 0x60]
mov rcx, r11
mov qword [rsp + 0x20], rax
call fcn.140139490
mov r10d, eax
mov eax, r10d
add rsp, 0x38
ret
mov rcx, r11
add rsp, 0x38
jmp fcn.140139490
Function at 0x14013bb50
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rsi
sub rsp, 0x508
mov rax, qword [0x1402922b8]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, ebx
jne 0x14013bbac
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100003
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x118]
jmp 0x14013bc45
mov edx, 1
mov qword [rsp + 0x530], rbp
mov r8d, ebx
mov qword [rsp + 0x500], rdi
lea ecx, [rdx + 9]
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor ebx, ebx
mov rdi, rax
mov ebp, ebx
test rax, rax
je 0x14013bc2f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x14013bc08
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x14013bc2f
mov rbx, qword [rsp + 0x118]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
jmp 0x14013bc35
mov rcx, rbx
mov rax, rbx
mov rbp, qword [rsp + 0x530]
mov rdi, qword [rsp + 0x500]
test rbx, rbx
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x18], rbx
setne al
mov qword [rsi + 0x20], rcx
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.14012fd90
add rsp, 0x508
pop rsi
pop rbx
ret
Function at 0x140140220
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1402922b8]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor esi, esi
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], esi
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x768]
lea rdx, [rsp + 0x40]
mov r8d, 0x3ff
mov dword [rsp + 0x34], esi
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1401403d4
mov qword [rsp + 0x468], rbx
cmp dword [rsp + 0x30], esi
je 0x1401403cc
mov rcx, qword [rdi + 0x768]
lea r9, [rsp + 0x30]
mov r8d, 0x3ff
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140140393
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140140393
lea rbx, [rdi + 0x728]
movsx rdx, byte [rbx + 0x17]
movzx eax, dl
shr al, 7
test al, 1
je 0x1401402f2
mov rax, qword [rbx + 8]
jmp 0x1401402fa
mov eax, 0x17
sub rax, rdx
cmp rax, 0x7a1200
jbe 0x14014033b
movzx eax, byte [rbx + 0x17]
shr al, 7
test al, 1
je 0x140140312
mov rax, qword [rbx]
jmp 0x140140315
mov rax, rbx
lea r8, [rax + 0xf4240]
movzx eax, byte [rbx + 0x17]
shr al, 7
test al, 1
je 0x14014032c
mov rdx, qword [rbx]
jmp 0x14014032f
mov rdx, rbx
mov rcx, rbx
call fcn.140044250
mov ecx, dword [rsp + 0x30]
mov eax, ecx
lea r9, [rsp + 0x40]
movsx rcx, byte [rbx + 0x17]
add r9, rax
movzx eax, cl
shr al, 7
test al, 1
je 0x14014035d
mov rdx, qword [rbx + 8]
add rdx, qword [rbx]
jmp 0x140140367
mov rdx, rbx
sub rdx, rcx
add rdx, 0x17
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.14014f560
mov eax, dword [rsp + 0x30]
cmp rax, 0x400
jae 0x1401403f5
mov byte [rsp + rax + 0x40], sil
lea rdx, [rsp + 0x40]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov rcx, qword [rdi + 0x768]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r8d, 0x3ff
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x140140296
mov rbx, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14012fd90
mov rsi, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret
call fcn.14013054c
int3
Function at 0x140140b80
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp byte [rbx + 9], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x38], eax
je 0x140140bff
movabs rax, 0x346dc5d63886594b
lea rcx, str.Target_process_still_running_after_the__s_timeout_period_elapsed._n
imul qword [rsp + 0x38]
mov r8, rdx
lea rdx, str.response
sar r8, 0xb
mov rax, r8
shr rax, 0x3f
add r8, rax
lea rax, str.unilateral
cmp r8, qword [rbx + 0x30]
cmovg rdx, rax
call fcn.140151d90
mov r8d, dword [rbx + 0x28]
lea rcx, str.Response_timeout___d_seconds__unilateral_timeout___d_seconds._n
mov edx, dword [rbx + 0x18]
call fcn.140151d90
mov rcx, qword [rbx + 0x6f8]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [rbx + 0x48], 0
add rsp, 0x20
pop rbx
ret

Function at 0x140140c90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov rcx, rdi
lea rdx, str.keepalive
call sub.VCRUNTIME140.dll_strstr
movabs rbp, 0x346dc5d63886594b
movabs rsi, 0x7fffffffffffffff
test rax, rax
je 0x140140d10
cmp qword [rbx + 0x30], rsi
je 0x140140d10
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [rsp + 0x44]
imul rcx, qword [rbx + 0x28], 0x3e8
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x50], eax
mov rax, rbp
imul qword [rsp + 0x50]
sar rdx, 0xb
mov rax, rdx
add rdx, rcx
shr rax, 0x3f
add rax, rdx
mov qword [rbx + 0x30], rax
cmp qword [rbx + 0x20], rsi
je 0x140140d56
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [rsp + 0x44]
mov rax, rbp
mov dword [rsp + 0x54], ecx
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x50], ecx
imul qword [rsp + 0x50]
imul rcx, qword [rbx + 0x18], 0x3e8
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rcx
add rax, rdx
mov qword [rbx + 0x20], rax
cmp byte [rbx + 9], 0
je 0x140140d92
mov rdx, rdi
lea rcx, [0x1401a4120]
call fcn.140151d90
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140140d7e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret