joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5860
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, rdx
mov rsi, rcx
mov rdx, qword [0x140125bf8]
mov rcx, rax
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
mov rdi, rax
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, rcx
sub rdx, rax
cmp rdx, rdi
jge 0x1400b591b
mov rax, qword [0x140cb88e8]
test rax, rax
jne 0x1400b58b9
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
mov qword [0x140cb88e8], rax
shl rax, 4
cmp rax, 0x10000
mov edx, 0x10000
cmovb rdx, rax
mov rcx, rdi
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
mov r14, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1400b5958
mov qword [rsi + 8], rax
mov rcx, r14
add rcx, rax
mov qword [rsi], rcx
mov rbx, qword [0x140cb88d8]
test rbx, rbx
je 0x1400b591b
mov rcx, rax
mov rdx, r14
call rbx
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
sub rcx, rax
cmp rcx, rdi
jl 0x1400b5934
add rdi, rax
mov qword [rsi + 8], rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__allocated_end____allocated_current_____sptr_size______0_
mov edx, 0x19d5
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x20], 0
lea rdx, str.Allocate
lea r8, str.allocate
mov rcx, r14
mov r9d, eax
call method.__sanitizer.ReportMmapFailureAndDie_unsigned_long_long__char_const__char_const__unsigned_int__bool_
int3
Function at 0x1400b5b40
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rcx
xor edi, edi
nop
cmp byte [rsi + rdi], 0
lea rdi, [rdi + 1]
jne 0x1400b5b50
mov rbx, qword [0x140125c00]
mov al, 1
xchg byte [rbx], al
test al, al
jne 0x1400b5bee
lea rcx, [0x140125c00]
call method.__sanitizer::ReportFile.ReopenIfNecessary__
mov rcx, qword [0x140125c08]
cmp rcx, 0xffffffffffffffff
je 0x1400b5c1c
lea rax, [rcx - 1]
cmp rax, 1
ja 0x1400b5bb0
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x1400b5bd7
add edi, 0xffffffff
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400b5be0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rbx], 0
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor ebp, ebp
mov r14, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400b5bfc
add ebp, 1
cmp ebp, 0x63
ja 0x1400b5c05
pause
jmp 0x1400b5c0a
xor ecx, ecx
call r14
cmp byte [rbx], 0
jne 0x1400b5bf9
mov al, 1
xchg byte [rbx], al
test al, al
jne 0x1400b5bf9
jmp 0x1400b5b6d
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x250a
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x1400b6ce0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
cmp qword [0x140221cb0], 0
je 0x1400b6d0d
mov rax, rcx
lock xadd qword [0x140cb8910], rax
add rax, rcx
shr rax, 0x14
cmp rax, qword [0x140221cb0]
jae 0x1400b6d15
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, qword [0x140125c00]
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1400b6dab
lea rcx, [0x140125c00]
call method.__sanitizer::ReportFile.ReopenIfNecessary__
mov rcx, qword [0x140125c08]
cmp rcx, 0xffffffffffffffff
je 0x1400b6df6
lea rax, [rcx - 1]
cmp rax, 1
ja 0x1400b6d6b
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x1400b6d96
mov qword [rsp + 0x20], 0
lea rdx, str._total_mmaped____20____common_flags____mmap_limit_mb_n
lea r9, [rsp + 0x2c]
mov r8d, 0x35
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400b6da3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._total_mmaped____20____common_flags____mmap_limit_mb_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rsi], 0
call method.__sanitizer.Die__
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400b6dc3
add edi, 1
cmp edi, 0x63
ja 0x1400b6de0
pause
cmp byte [rsi], 0
jne 0x1400b6dc0
jmp 0x1400b6de9
xor ecx, ecx
call rbx
cmp byte [rsi], 0
jne 0x1400b6dc0
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1400b6dc0
jmp 0x1400b6d28
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x250a
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x1400b89d0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r15d, dword [rsp + 0xc8]
cmp r15d, 1
jbe 0x1400b8aef
mov r12, r9
mov rbp, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140cb88e8]
test rax, rax
je 0x1400b8a21
mov qword [rbx + 0x10], r14
mov dword [rbx + 8], 1
cmp r12, 0x1000
jae 0x1400b8a4b
jmp 0x1400b8ac0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov qword [0x140cb88e8], rax
mov qword [rbx + 0x10], r14
mov dword [rbx + 8], 1
cmp r12, 0x1000
jb 0x1400b8ac0
mov rcx, qword [rsp + 0xc0]
cmp r12, rcx
jbe 0x1400b8b13
cmp rbp, rcx
jbe 0x1400b8ac0
lea rcx, [r12 - 0x10]
cmp rcx, rbp
jbe 0x1400b8ac0
mov edx, ebp
and edx, 7
test rdx, rdx
jne 0x1400b8ac0
mov edx, 1
nop word [rax + rax]
cmp edx, r15d
jae 0x1400b8ac0
mov rdi, qword [rbp + 8]
cmp rdi, rax
jb 0x1400b8ac0
cmp rdi, r14
je 0x1400b8aa0
mov esi, edx
add edx, 1
mov dword [rbx + 8], edx
mov qword [rbx + rsi*8 + 0x10], rdi
cmp rbp, r12
jae 0x1400b8acf
mov rdi, qword [rbp]
cmp rdi, rbp
jbe 0x1400b8ac0
cmp rcx, rdi
jbe 0x1400b8ac0
mov esi, edi
and esi, 7
mov rbp, rdi
test rsi, rsi
je 0x1400b8a80
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov qword [rsp + 0x20], rbp
lea rcx, str.gotsan.cpp
lea r8, str.__stack_top_______stack_bottom__
mov edx, 0x1c88
mov r9, r12
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov r9d, r15d
mov qword [rsp + 0x20], 2
lea rcx, str.gotsan.cpp
lea r8, str.__max_depth_______2__
mov edx, 0x1c9e
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rcx
jmp 0x1400b8ad4
Function at 0x1400be5c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
add rsp, 0x58
ret

Function at 0x1400be5e0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
add rsp, 0x58
ret

Function at 0x1400be600
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret

Function at 0x1400be620
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret

Function at 0x1400be660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
add rsp, 0x28
ret
Function at 0x1400bf270
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov r15, r8
mov rdi, rdx
mov r14, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r12d, dword [rsp + 0x58]
mov r13, r12
mov ecx, edi
shl r13, cl
mov ebx, 1
mov ecx, r15d
shl rbx, cl
cmp r13, rbx
cmovbe r13, rbx
cmp rbx, r12
cmovb rbx, r12
lea rdx, [rsp + 0x30]
mov r8d, 0x30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400bf350
add rbx, r14
lea rdi, [rsp + 0x30]
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x1400bf305
add rcx, qword [rsp + 0x48]
mov r8d, 0x30
mov rdx, rdi
call rsi
test rax, rax
je 0x1400bf350
cmp dword [rsp + 0x50], 0x10000
mov rcx, qword [rsp + 0x30]
jne 0x1400bf2f0
add rcx, r12
mov rdx, r13
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
lea rdx, [rbx + rax]
mov rcx, qword [rsp + 0x48]
add rcx, qword [rsp + 0x30]
cmp rdx, rcx
jae 0x1400bf2f5
test rax, rax
je 0x1400bf350
add r13, 0xffffffffffffffff
test rax, r13
jne 0x1400bf374
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.___uptr_0_______shadow_start__
mov edx, 0x2377
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__IsAligned_shadow_start__alignment_______0_
mov edx, 0x2378
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3

Function at 0x1400bf7e0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1400bf910
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
cmp rcx, 0xffffffffffffffff
je 0x1400bf965
mov rsi, r9
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test rbx, rbx
je 0x1400bf94c
test edi, edi
jne 0x1400bf94c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
test rsi, rsi
je 0x1400bf958
mov eax, dword [rsp + 0x2c]
mov qword [rsi], rax
test edi, edi
setne al
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x24f5
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x1400bf9a0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp rcx, 0xffffffffffffffff
je 0x1400bfa56
mov r14, r8
mov rsi, rdx
mov rax, qword [rsp + 0x80]
test rax, rax
lea rbx, [rsp + 0x2c]
cmovne rbx, rax
test r9, r9
lea rdi, [rsp + 0x30]
cmovne rdi, r9
mov dword [rbx], 0
mov qword [rdi], 0
lea rax, [rcx - 1]
cmp rax, 1
ja 0x1400bfa0c
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x1400bfa4c
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x28]
mov rdx, rsi
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
je 0x1400bfa35
mov eax, dword [rsp + 0x28]
mov qword [rdi], rax
jmp 0x1400bfa3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
test esi, esi
setne al
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov dword [rbx], 6
xor eax, eax
jmp 0x1400bfa42
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x250a
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3

Function at 0x1400bfba0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, r8
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx]
mov al, 1
xchg byte [rdi], al
test al, al
jne 0x1400bfc39
mov rcx, rbx
call method.__sanitizer::ReportFile.ReopenIfNecessary__
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400bfc67
lea rax, [rcx - 1]
cmp rax, 1
ja 0x1400bfbfc
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x1400bfc20
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rdx, rsi
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400bfc29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rdi], 0
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebp, ebp
mov r15, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400bfc47
add ebp, 1
cmp ebp, 0x63
ja 0x1400bfc50
pause
jmp 0x1400bfc55
xor ecx, ecx
call r15
cmp byte [rdi], 0
jne 0x1400bfc44
mov al, 1
xchg byte [rdi], al
test al, al
jne 0x1400bfc44
jmp 0x1400bfbc0
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x250a
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x1400c0a50
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x5c]
neg rax
lea rbx, [rsi + rdi]
add rbx, 0xffffffffffffffff
and rbx, rax
mov rdi, rax
and rdi, rsi
lea r14, [rsp + 0x28]
mov r15, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ebp, 0x10003
jmp 0x1400c0aad
mov rax, qword [rsp + 0x40]
add rdi, rax
test rax, rax
je 0x1400c0adb
cmp rdi, rbx
seta sil
ja 0x1400c0adb
mov r8d, 0x30
mov rcx, rdi
mov rdx, r14
call r15
cmp rax, 0x30
jne 0x1400c0ad9
mov eax, dword [rsp + 0x4c]
cmp eax, 0x10
ja 0x1400c0aa0
bt ebp, eax
jae 0x1400c0aa0
xor esi, esi
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400c0f30
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1400c29f0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, qword [0x140d22c28]
xor ebx, ebx
lea rdi, [0x140ce2c18]
lea r15, [rsp + 0x28]
mov r12, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor esi, esi
jmp 0x1400c2a3a
mov ecx, 0x40000
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
add rbx, rax
add rsi, 1
cmp rsi, 0x8000
je 0x1400c2a63
mov rax, qword [rdi + rsi*8 + 8]
test rax, rax
je 0x1400c2a2d
mov rdx, qword [0x140cb88e8]
test rdx, rdx
jne 0x1400c2a20
mov rcx, r15
call r12
mov edx, dword [rsp + 0x2c]
mov qword [0x140cb88e8], rdx
jmp 0x1400c2a20
lea rax, [r14 + rbx]
add rax, 0x10010
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400c2a80
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
sub rsp, 0x30
mov rdx, r8
mov rsi, rcx
mov qword [rcx], r9
mov qword [rsp + 0x28], 0
lea rcx, [0x140d22c20]
lea r8, [rsp + 0x28]
call method.__sanitizer::StackStore.Store___sanitizer::StackTrace_const__unsigned_long_long_
mov dword [rsi + 0xc], eax
cmp qword [rsp + 0x28], 0
jne 0x1400c2ab9
add rsp, 0x30
pop rsi
ret
add rsp, 0x30
pop rsi
jmp method.__sanitizer._anonymous_namespace_::CompressThread::NewWorkNotify__

Function at 0x1400c2ad0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp dword [0x140221d10], 0
je 0x1400c2b51
jle 0x1400c2b2b
mov al, 1
xchg byte [0x141180584], al
test al, al
jne 0x1400c2b58
mov eax, dword [0x141180588]
cmp eax, 1
je 0x1400c2b36
test eax, eax
jne 0x1400c2b24
mov byte [0x141180598], 1
mov rax, qword [0x141180590]
test rax, rax
jne 0x1400c2b8d
mov qword [0x141180590], 0
mov dword [0x141180588], 2
mov byte [0x141180584], 0
add rsp, 0x28
pop rdi
pop rsi
jmp method.__sanitizer.CompressStackStore__
lock add dword [0x141180580], 1
lea rcx, [0x141180580]
call fcn.1400c8458
mov byte [0x141180584], 0
add rsp, 0x28
pop rdi
pop rsi
ret
xor esi, esi
mov rdi, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400c2b66
add esi, 1
cmp esi, 0x63
ja 0x1400c2b6f
pause
jmp 0x1400c2b73
xor ecx, ecx
call rdi
cmp byte [0x141180584], 0
jne 0x1400c2b63
mov al, 1
xchg byte [0x141180584], al
test al, al
jne 0x1400c2b63
jmp 0x1400c2aed
mov qword [rsp + 0x20], rax
lea rcx, str.gotsan.cpp
lea r8, str.__nullptr______thread___
mov edx, 0x2961
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x1400c4030
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov ebx, r8d
mov r12, rdx
mov rdi, rcx
mov rax, qword [0x140cb88e8]
test rax, rax
jne 0x1400c4068
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x4c]
mov qword [0x140cb88e8], rax
cmp rax, 0x8001
mov ecx, 0x8000
cmovae rcx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rcx, r12
call method.__sanitizer.ReadFileToBuffer_char_const__char__unsigned_long_long__unsigned_long_long__unsigned_long_long__unsigned_int_
test al, al
je 0x1400c4132
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400c416b
mov r14, qword [rdi + 0x10]
mov r15, qword [rdi + 0x18]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0
xor eax, eax
movabs rsi, 0x400100100002600
mov rcx, rbx
add rax, 1
movzx edx, byte [rcx + rax - 1]
cmp rdx, 0x3a
jbe 0x1400c4103
jmp 0x1400c410e
mov qword [rdi + 0x18], rax
add rax, 1
movzx edx, byte [rcx + rax - 1]
cmp rdx, 0x3a
ja 0x1400c410e
bt rsi, rdx
jb 0x1400c40f0
test rdx, rdx
je 0x1400c4150
mov rcx, rdi
mov rdx, r12
call method.__sanitizer::FlagParser.parse_flag_char_const_
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
add rax, 1
movzx edx, byte [rcx + rax - 1]
cmp rdx, 0x3a
jbe 0x1400c4103
jmp 0x1400c410e
mov al, 1
test bl, bl
jne 0x1400c417a
mov r8d, dword [rsp + 0x34]
lea rcx, str.Failed_to_read_options_from__s:_error__d_n
mov rdx, r12
call method.__sanitizer.Printf_char_const__..._
xor eax, eax
jmp 0x1400c417a
cmp dword [0x140221c44], 0
jg 0x1400c4163
mov dword [0x140221c44], 1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r15
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call method.__sanitizer.UnmapOrDie_void__unsigned_long_long_
mov al, 1
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400c5740
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
je 0x1400c5783
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rcx, rax
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400c5783
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400c7950
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
cmp dword [0x140cb88e4], 0
jle 0x1400c79a2
cmp qword [0x140ce2c10], 0
je 0x1400c7aaf
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
imul rax, qword [rsp + 0x30], 0x3b9aca00
mov rcx, qword [0x140ce2c10]
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x1400c79a7
cqo
idiv rcx
mov r14, rax
jmp 0x1400c79ae
xor r14d, r14d
jmp 0x1400c79ae
xor edx, edx
div ecx
mov r14d, eax
mov eax, dword [0x140221d10]
mov ebp, eax
neg ebp
cmovs ebp, eax
mov ebx, 0x10
xor edi, edi
lea rsi, [0x140d22c20]
nop dword [rax]
lea rcx, [rsi + rbx]
mov edx, ebp
mov r8, rsi
call method.__sanitizer::StackStore::BlockInfo.Pack___sanitizer::StackStore::Compression____sanitizer::StackStore_
add rdi, rax
add rbx, 0x10
cmp rbx, 0x10010
jne 0x1400c79d0
test rdi, rdi
je 0x1400c7aa3
cmp dword [0x140cb88e4], 0
jle 0x1400c7aa3
cmp qword [0x140ce2c10], 0
je 0x1400c7acc
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [0x140ce2c10]
lea rdx, [0x140d32c30]
lea rcx, [rsp + 0x30]
call method.__sanitizer::StackDepotBase___sanitizer::StackDepotNode__1__20_.GetStats___const
mov r9, qword [rsp + 0x38]
cmp dword [0x140cb88e4], 0
je 0x1400c7aa3
imul rax, rbx, 0x3b9aca00
mov rcx, rax
or rcx, rsi
shr rcx, 0x20
je 0x1400c7a62
cqo
idiv rsi
jmp 0x1400c7a66
xor edx, edx
div esi
sub rax, r14
add r9, rdi
mov rbx, qword [str.SanitizerTool]
shr rdi, 0xa
shr r9, 0xa
movabs rcx, 0x431bde82d7b634db
mul rcx
shr rdx, 0x12
mov qword [rsp + 0x20], rdx
lea rcx, str._s:_StackDepot_released__zu_KiB_out_of__zu_KiB_in__llu_ms_n
mov rdx, rbx
mov r8, rdi
call method.__sanitizer.Printf_char_const__..._
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140ce2c10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
cmp qword [0x140ce2c10], 0
jne 0x1400c7971
jmp 0x1400c7ae7
lea rcx, [0x140ce2c10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
cmp qword [0x140ce2c10], 0
jne 0x1400c7a12
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__frequency.QuadPart_______0__
mov edx, 0x2430
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3

Function at 0x1400c7fc0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_CreateEventA]
test rax, rax
mov qword [0x1411805c8], rax
je 0x1400c7ff5
lea rcx, [0x1411805e0]
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitializeCriticalSection]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov r9, rax
call sym.fwrite
call sym.abort
nop