joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002bc20
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14002bc48
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_trylock
test eax, eax
mov edx, eax
jne 0x14002bc9e
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_trylock
test eax, eax
mov edi, eax
jne 0x14002bcd8
mov eax, dword [rsi + 8]
mov edx, 0x10
test eax, eax
jne 0x14002bc9e
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x14002bc91
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x14002bcb0
mov dword [rsi + 8], 1
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
mov rcx, r12
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
jne 0x14002bcd0
test eax, eax
mov esi, 0x10
cmovne esi, eax
mov edx, esi
jmp 0x14002bc9e
mov rcx, rbp
call sym.pthread_mutex_unlock
test eax, eax
cmovne edi, eax
mov edx, edi
jmp 0x14002bc9e

Function at 0x14002bcf0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call sym.rwl_ref_unlock
test eax, eax
jne 0x14002bd70
mov rdi, qword [rbx]
mov edx, dword [rdi + 8]
lea rbp, [rdi + 0x20]
test edx, edx
je 0x14002bd48
lock sub dword [rdi + 8], 1
mov rcx, rbp
call sym.pthread_mutex_unlock
lea rcx, [rdi + 0x18]
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rwl_unref
mov rcx, rbp
call sym.pthread_mutex_lock
test eax, eax
mov esi, eax
jne 0x14002bd2f
lock add dword [rdi + 0x10], 1
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x14002bd80
mov rcx, rbp
call sym.pthread_mutex_unlock
mov esi, eax
jmp 0x14002bd2f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [rdi + 0x28]
call sym.pthread_cond_signal
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
jmp 0x14002bd2f
Function at 0x14002bda0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14002bdc8
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x14002be19
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x14002beb0
mov edx, dword [rsi + 8]
test edx, edx
jne 0x14002be14
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x14002be10
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x14002be30
lock add dword [rsi + 8], 1
mov edx, ebp
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.rwl_unref
mov qword [rsp + 0x28], rsi
lea r13, [rsi + 0x28]
neg eax
mov dword [rsi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x14002be7f
mov eax, dword [rsi + 0x10]
test eax, eax
jns 0x14002bec0
mov rdx, r12
mov rcx, r13
call sym.pthread_cond_wait
test eax, eax
mov edi, eax
je 0x14002be78
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov ebp, edi
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x20]
jmp 0x14002be19
mov rcx, rdi
call sym.pthread_mutex_unlock
jmp 0x14002be19
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
mov dword [rsi + 0xc], 0
jmp 0x14002be14
Function at 0x14002bee0
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x14002bf90
test rdx, rdx
je 0x14002bf90
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14002bf20
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [rbx]
mov rdx, rsi
lea rbp, [rdi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
mov edx, eax
jne 0x14002bf77
lea r13, [rdi + 0x20]
mov rdx, rsi
mov rcx, r13
call sym.pthread_mutex_timedlock
test eax, eax
mov r12d, eax
jne 0x14002bfa8
mov edx, dword [rdi + 8]
test edx, edx
jne 0x14002bf6f
mov edx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
test edx, edx
jle 0x14002bf6b
sub eax, edx
mov dword [rdi + 0x10], 0
mov dword [rdi + 0xc], eax
test eax, eax
jg 0x14002bfb8
lock add dword [rdi + 8], 1
mov edx, r12d
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.rwl_unref
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
jmp 0x14002bf74
mov qword [rsp + 0x28], rdi
lea r14, [rdi + 0x28]
neg eax
mov dword [rdi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x14002c004
test ebp, ebp
jne 0x14002c01b
mov r8, rsi
mov rdx, r13
mov rcx, r14
call sym.pthread_cond_timedwait
mov ebp, eax
mov eax, dword [rdi + 0x10]
test eax, eax
js 0x14002c000
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
test ebp, ebp
mov qword [rax], rdx
jne 0x14002c040
mov dword [rdi + 0xc], 0
jmp 0x14002bf6f
mov rcx, qword [rsp + 0x28]
mov r12d, ebp
call qword [rsp + 0x20]
jmp 0x14002bf74
Function at 0x140003300
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000334a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000334a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000334a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000334a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000334a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000334c
xor al, al
add rsp, 0x28
ret

Function at 0x14000a0a4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140009e94
Function at 0x14000c75c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000c7e3
mov rsi, rbx
cmp word [rax], bp
je 0x14000c7a2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000c78c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000c788
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000b19c
mov rdi, rax
test rax, rax
je 0x14000c7d0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140011a10
mov rbp, rdi
xor ecx, ecx
call fcn.14000b484
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400117b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400117d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400117d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call fcn.140194000
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1400087ec
add rsp, 0x28
jmp 0x140008188
Function at 0x140001160
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x140001183
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x1400011ae
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x1400011a7
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x140004000
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140004071
mov r11, rsp
ret

Function at 0x140004004
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140004071
mov r11, rsp
ret

Function at 0x140004074
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400040e5
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x448
mov rax, qword [0x1400173c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14000a140
call fcn.140005288
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, str.Fatal_error_in_launcher:__s_n
call fcn.140005a1c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140004078
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400040e5
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x448
mov rax, qword [0x1400173c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14000a140
call fcn.140005288
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, str.Fatal_error_in_launcher:__s_n
call fcn.140005a1c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret
Function at 0x140004150
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r13, rcx
lea r8, [0x140014da0]
lea rdx, [0x1400193f0]
lea rcx, [rbp + 0x38]
xor r12d, r12d
mov qword [rbp + 0x38], r12
call fcn.140004df0
mov ecx, r12d
test eax, eax
lea rdx, str.Failed_to_open_executable
sete cl
call fcn.140004074
sar dh, 1
invalid
dec dword [rax - 0x75]
cmp byte [r13 - 0x73], r8b
and al, 2
xor edx, edx
call fcn.1400061c4
mov rcx, qword [rbp + 0x38]
call fcn.140005e2c
mov rcx, qword [rbp + 0x38]
movsxd r14, eax
lea edi, [r14 - 0x104]
test edi, edi
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.1400061c4
mov r9, qword [rbp + 0x38]
lea r15d, [r12 + 1]
mov esi, 0x104
mov edx, r15d
mov rcx, r13
mov r8d, esi
call fcn.1400059fc
mov rcx, r13
mov rdx, rax
call fcn.1400040e8
mov rbx, rax
test rax, rax
je 0x140004229
lea rcx, [rbp - 0x20]
lea r8d, [r12 + 0x14]
mov rdx, rax
call fcn.14000eb70
movsxd rdi, edi
sub rdi, r13
add rdi, rbx
jmp 0x1400042b0
mov ebx, 0x4100000
mov ecx, ebx
call fcn.1400051d0
mov rcx, qword [rbp + 0x38]
lea edi, [r14 - 0x4100000]
test edi, edi
mov rsi, rax
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.1400061c4
mov r9, qword [rbp + 0x38]
mov r8d, ebx
mov rdx, r15
mov rcx, rsi
call fcn.1400059fc
mov rcx, rsi
mov rdx, rax
call fcn.1400040e8
mov ecx, r12d
lea rdx, str.Unable_to_find_an_appended_archive.
test rax, rax
mov rbx, rax
setne cl
call fcn.140004074
lea rcx, [rbp - 0x20]
mov rdx, rbx
mov r8d, 0x14
call fcn.14000eb70
movsxd rdi, edi
mov rcx, rsi
sub rdi, rsi
add rdi, rbx
call fcn.140004ef8
mov esi, 0x104
mov eax, dword [rbp - 0x10]
mov rcx, qword [rbp + 0x38]
xor r8d, r8d
add eax, dword [rbp - 0x14]
sub rdi, rax
mov edx, edi
call fcn.1400061c4
mov r9, qword [rbp + 0x38]
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.1400059fc
mov ecx, r12d
lea rdx, str.Unable_to_read_from_file
test rax, rax
setne cl
call fcn.140004074
movzx eax, word [r13]
cmp ax, word [0x140014e0c]
jne 0x140004301
mov r12, r13
jmp 0x140004367
mov rcx, qword [rbp + 0x38]
lea edx, [rdi - 0x104]
test edx, edx
cmovs edx, r12d
xor r8d, r8d
call fcn.1400061c4
mov r9, qword [rbp + 0x38]
mov r8, rsi
Function at 0x140004510
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x880]
sub rsp, 0x980
mov rax, qword [0x1400173c8]
xor rax, rsp
mov qword [rbp + 0x870], rax
mov rdi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectA]
lea r8, [rbp - 0x20]
mov r9d, 0x90
mov rbx, rax
lea rax, [rsp + 0x50]
mov edx, 9
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x140004582
cmp dword [rsp + 0x50], 0x90
jne 0x140004582
mov ecx, 1
jmp 0x140004584
xor ecx, ecx
lea rdx, str.Job_information_querying_failed
call fcn.140004074
or dword [rbp - 0x10], 0x3000
lea r8, [rbp - 0x20]
mov r9d, 0x90
mov edx, 9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
lea rdx, str.Job_information_setting_failed
mov ecx, eax
call fcn.140004074
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.14000a470
mov ecx, 0xfffffff6
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.140004480
lea rdx, str.stdin_duplication_failed
mov ecx, eax
call fcn.140004074
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp - 0x38]
mov rcx, rax
call fcn.140004480
lea rdx, str.stdout_duplication_failed
mov ecx, eax
call fcn.140004074
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.140004480
lea rdx, str.stderr_duplication_failed
mov ecx, eax
call fcn.140004074
lea rcx, [0x1400044ec]
mov edx, 1
mov dword [rbp - 0x54], 0x100
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400046e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x70]
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea r9, [rbp + 0x70]
lea rdx, str.Unable_to_create_process_using__ls:__ls
mov r8, rdi
xor ecx, ecx
call fcn.140004000
mov eax, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
mov dword [0x140019e00], eax
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea rdx, str.Failed_to_get_exit_code_of_process
mov ecx, eax
call fcn.140004074
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140006783
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400173c8]
jne 0x140004d0a
rol rcx, 0x10
test cx, 0xffff
jne 0x140004d06
repz ret
ror rcx, 0x10
jmp 0x1400066dc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140018480]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140018578]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140006761
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140018480]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140006783
mov rax, qword [rsp + 0x88]
mov qword [0x140018578], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140018518], rax
mov rax, qword [0x140018578]
mov qword [0x1400183f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140018500], rax
mov dword [0x1400183e0], 0xc0000409
mov dword [0x1400183e4], 1
mov rax, qword [0x1400173c8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400173d0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140018478], eax
mov ecx, 1
call fcn.14000d6f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140013350]
add bh, bh
adc eax, 0xc901
Function at 0x14000faf8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400173c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140008a7c
xor ebx, ebx
cmp qword [0x1400193c0], rbx
mov rdi, rax
jne 0x14000fc0b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000fce2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000fce2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400193c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400193c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400193d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400193e0], rax
test rax, rax
je 0x14000fc02
lea rdx, [0x140014c40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400193d8], rax
jmp 0x14000fc12
mov rax, qword [0x1400193d8]
jmp 0x14000fc19
mov rax, qword [0x1400193d8]
mov r11, qword [0x1400193e0]
cmp rax, rdi
je 0x14000fc80
cmp r11, rdi
je 0x14000fc80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400193e0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000fc80
test rax, rax
je 0x14000fc80
call rsi
test rax, rax
je 0x14000fc7a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000fc7a
test byte [rsp + 0x40], 1
jne 0x14000fc80
bts ebp, 0x15
jmp 0x14000fcc0
mov rcx, qword [0x1400193c8]
cmp rcx, rdi
je 0x14000fcc0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000fcc0
call rax
mov rbx, rax
test rax, rax
je 0x14000fcc0
mov rcx, qword [0x1400193d0]
cmp rcx, rdi
je 0x14000fcc0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000fcc0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400193c0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000fce2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000fce4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140004cf0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001db0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140001dd1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001dfe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001e00
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001e59
test ecx, ecx
jle 0x140001e39
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001e59
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001e59
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
mov cl, 0x2a
add bh, bh
scasb al, byte [rdi]