joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400430a0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rcx, qword [0x140226b10]
lea rsi, [0x140226b10]
cmp rcx, rsi
je 0x140043116
test byte [rcx + 0x1c], 2
je 0x1400430ed
cmp byte [rcx + 0x19], 4
jb 0x1400430ed
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401b77f0]
mov edx, 0x44
call fcn.14001f000
mov rcx, qword [0x140226b10]
cmp rcx, rsi
je 0x140043116
test byte [rcx + 0x1c], 2
je 0x140043116
cmp byte [rcx + 0x19], 5
jb 0x140043116
mov r9d, dword [rdi]
lea r8, [0x1401b77f0]
mov rcx, qword [rcx + 0x10]
mov edx, 0x45
call fcn.14001f220
lea rax, [rsp + 0x50]
mov r9d, 0x1000b
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x140043185
mov rcx, qword [0x140226b10]
cmp rcx, rsi
je 0x140043173
test byte [rcx + 0x1c], 2
je 0x140043173
cmp byte [rcx + 0x19], 2
jb 0x140043173
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401b77f0]
mov edx, 0x46
mov r9d, eax
call fcn.14001f220
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
lea rdx, str.BootMigrationPhase
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x140043200
mov rcx, qword [0x140226b10]
cmp rcx, rsi
je 0x1400431e3
test byte [rcx + 0x1c], 2
je 0x1400431e3
cmp byte [rcx + 0x19], 2
jb 0x1400431e3
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401b77f0]
mov edx, 0x47
mov r9d, eax
call fcn.14001f220
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140043ab0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call qword [rax]
xor ebp, ebp
lea rdx, [rbx + 0x12]
mov r9, rsi
mov dword [rbx + 0x14], eax
mov rcx, rdi
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 6]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0x140043af6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x140043b65
mov rax, qword [rbx]
lea r8, [rsp + 0x50]
mov rdx, rdi
mov dword [rsp + 0x50], ebp
mov rcx, rbx
call qword [rax + 0x20]
mov ecx, dword [rsp + 0x50]
add dword [rsi], ecx
test eax, eax
jne 0x140043b65
mov rbx, qword [rbx + 0x20]
mov eax, ebp
mov dword [rsp + 0x50], eax
test rbx, rbx
je 0x140043b5f
nop dword [rax]
nop dword [rax + rax]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x68], ebp
mov rdx, rdi
mov rcx, rbx
call fcn.140043ab0
mov ecx, eax
mov eax, dword [rsp + 0x50]
add eax, dword [rsp + 0x68]
mov dword [rsp + 0x50], eax
test ecx, ecx
jne 0x140043b61
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140043b30
mov ecx, ebp
add dword [rsi], eax
mov eax, ecx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x140044b00
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp byte [rcx + 0xca], dil
je 0x140044b93
cmp byte [rcx + 0xc9], dil
je 0x140044b93
cmp byte [rcx + 0xc8], dil
je 0x140044b5f
mov rcx, qword [rcx + 0xd8]
call fcn.140050730
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140044b4d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov r8b, 1
mov edx, 1
mov rcx, rbx
call fcn.140044d90
jmp 0x140044b79
mov byte [rcx + 0xc8], 1
mov dword [rcx + 0xa8], edi
mov rcx, qword [rcx + 0xd8]
mov dword [rcx + 0x41688], edi
mov rcx, qword [rbx + 0xb8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rcx + 0xc8], dil
je 0x140044b86
mov r8b, 1
mov edx, 2
call fcn.140044d90
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400452a0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0xd8]
call fcn.1400508b0
mov rcx, qword [rdi + 0xe0]
add rcx, 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1400452e3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x1400452e5
xor ebx, ebx
mov rcx, qword [rdi + 0xe0]
add rcx, 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140044ef0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 8]
xor edi, edi
mov rbx, rcx
cmp eax, 1
jne 0x140044f3f
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov eax, edi
lea rcx, [0x1400440c0]
xchg dword [rbx + 0x1c], eax
mov r8, rbx
xor edx, edx
call fcn.140143564
mov qword [rbx + 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x140044f3f
lea eax, [rdi + 0x6e]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 8]
cmp eax, 1
je 0x140044f59
mov edi, 0x139f
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov dword [rbx + 8], 2
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400452a0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp byte [rcx + 0xca], dil
je 0x140044b93
cmp byte [rcx + 0xc9], dil
je 0x140044b93
cmp byte [rcx + 0xc8], dil
je 0x140044b5f
mov rcx, qword [rcx + 0xd8]
call fcn.140050730
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140044b4d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov r8b, 1
mov edx, 1
mov rcx, rbx
call fcn.140044d90
jmp 0x140044b79
mov byte [rcx + 0xc8], 1
mov dword [rcx + 0xa8], edi
mov rcx, qword [rcx + 0xd8]
mov dword [rcx + 0x41688], edi
mov rcx, qword [rbx + 0xb8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rcx + 0xc8], dil
je 0x140044b86
mov r8b, 1
mov edx, 2
call fcn.140044d90
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400452a0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0xd8]
call fcn.1400508b0
mov rcx, qword [rdi + 0xe0]
add rcx, 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1400452e3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x1400452e5
xor ebx, ebx
mov rcx, qword [rdi + 0xe0]
add rcx, 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140045310
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0xb8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140045341
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
add rsp, 0x20
pop rbx
ret
Function at 0x140045650
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
mov rcx, qword [0x140226b10]
lea rsi, [0x140226b10]
cmp rcx, rsi
je 0x1400456a2
test dword [rcx + 0x1c], 0x200
je 0x1400456a2
cmp byte [rcx + 0x19], 4
jb 0x1400456a2
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401b80f8]
mov edx, 0x10
call fcn.14001f000
mov rcx, qword [0x140226b10]
test edi, edi
jne 0x1400456e4
cmp rcx, rsi
je 0x1400456cd
test dword [rcx + 0x1c], 0x200
je 0x1400456cd
cmp byte [rcx + 0x19], 4
jb 0x1400456cd
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x11]
lea r8, [0x1401b80f8]
call fcn.14001f000
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140045a50
cmp rcx, rsi
je 0x14004570d
test dword [rcx + 0x1c], 0x200
je 0x14004570d
cmp byte [rcx + 0x19], 4
jb 0x14004570d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401b80f8]
mov edx, 0x12
call fcn.14001f000
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov dword [rbx + 0x2050], 0
mov dword [rbx + 0x2040], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140045960
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
call fcn.140045fe0
test eax, eax
jne 0x140045a44
mov r9d, dword [rbx + 0x2044]
lea r8d, [rax + 6]
mov qword [rsp + 0x50], rsi
lea rcx, str..pipeiastorafsvc
xor esi, esi
mov edx, 0x40080003
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_CreateNamedPipeW]
mov qword [rbx + 0x2048], rax
cmp rax, 0xffffffffffffffff
jne 0x140045a37
mov qword [rsp + 0x58], rdi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x140226b10]
lea rax, [0x140226b10]
cmp rcx, rax
je 0x140045a05
test dword [rcx + 0x1c], 0x200
je 0x140045a05
cmp byte [rcx + 0x19], 2
jb 0x140045a05
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0xa]
mov r9d, edi
lea r8, [0x1401b80f8]
call fcn.140020860
mov rcx, qword [rbx + 0x2038]
test rcx, rcx
je 0x140045a25
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x2038], rsi
mov qword [rbx + 0x2030], rsi
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140045a50
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret
Function at 0x140045d40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [0x140226b10]
lea rbp, [0x140226b10]
cmp rcx, rbp
je 0x140045d8e
test dword [rcx + 0x1c], 0x200
je 0x140045d8e
cmp byte [rcx + 0x19], 4
jb 0x140045d8e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401b80f8]
mov edx, VariantTimeToDosDateTime
call fcn.14001f000
xor eax, eax
lea rbx, [rdi + 0x2018]
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov rcx, qword [rdi + 0x2038]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov rax, qword [rdi + 0x2038]
lea rdx, [rdi + 0x10]
mov rcx, qword [rdi + 0x2048]
lea r9, [rdi + 0x1010]
mov r8d, 0x1000
mov qword [rdi + 0x2030], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
mov ebx, eax
test eax, eax
je 0x140045e3c
cmp dword [rdi + 0x1010], 0
je 0x140045e3c
mov rcx, qword [0x140226b10]
cmp rcx, rbp
je 0x140045e23
test dword [rcx + 0x1c], 0x200
je 0x140045e23
cmp byte [rcx + 0x19], 4
jb 0x140045e23
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401b80f8]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.14001f000
mov dword [rdi + 0x2050], 0
mov dword [rdi + 0x2040], 2
jmp 0x140045ebf
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test ebx, ebx
jne 0x140045e87
cmp eax, 0x3e5
jne 0x140045e87
mov rcx, qword [0x140226b10]
cmp rcx, rbp
je 0x140045e7b
test dword [rcx + 0x1c], 0x200
je 0x140045e7b
cmp byte [rcx + 0x19], 4
jb 0x140045e7b
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xd]
lea r8, [0x1401b80f8]
call fcn.14001f000
mov dword [rdi + 0x2050], 1
jmp 0x140045ebf
mov rcx, qword [0x140226b10]
cmp rcx, rbp
je 0x140045eb7
test dword [rcx + 0x1c], 0x200
je 0x140045eb7
cmp byte [rcx + 0x19], 4
jb 0x140045eb7
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401b80f8]
mov edx, 0xe
call fcn.14001f000
mov rcx, rdi
call fcn.140045a50
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140045f10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
lea rbx, [rcx + 0x2018]
xor eax, eax
mov qword [rbx], rax
mov rdi, rcx
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov rcx, qword [rcx + 0x2038]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
mov rax, qword [rdi + 0x2038]
lea rdx, [rdi + 0x1014]
mov r8d, dword [rdi + 0x2014]
lea r9, [rsp + 0x40]
mov rcx, qword [rdi + 0x2048]
mov qword [rdi + 0x2030], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
mov ebx, eax
test eax, eax
je 0x140045fa6
mov ecx, dword [rdi + 0x2014]
cmp dword [rsp + 0x40], ecx
jne 0x140045fa6
mov dword [rdi + 0x2050], 0
mov dword [rdi + 0x2040], 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test ebx, ebx
jne 0x140045fcc
cmp eax, 0x3e5
jne 0x140045fcc
mov dword [rdi + 0x2050], 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140045a50
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140049440
Capabilities:
Reference sql statements

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rsi, r8
mov edi, edx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rcx
lea rax, str.SELECT_COUNT_DIRTY__FROM_FILES_WHERE_DIRTY_value
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov dword [r8], 0
lea rcx, [rsp + 0x28]
call fcn.14000cde0
mov ebx, eax
test eax, eax
jne 0x1400494a9
mov r8d, edi
lea edx, [rax + 1]
mov rcx, qword [rsp + 0x40]
call fcn.140064bf0
mov ebx, eax
mov r8d, 1
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.14000ce60
test ebx, ebx
jne 0x140049559
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x1400494e7
add eax, 0xfffffffd
cmp eax, 1
ja 0x1400494fd
mov rcx, qword [rsp + 0x40]
call fcn.140056910
mov dword [rsp + 0x28], 1
jmp 0x1400494fd
lea rcx, [rsp + 0x28]
call fcn.14000cde0
mov ebx, eax
test eax, eax
je 0x1400494fd
mov eax, dword [rsp + 0x28]
jmp 0x140049538
mov rcx, qword [rsp + 0x40]
call fcn.140055990
mov ebx, eax
mov ecx, eax
sub ecx, 0x64
je 0x14004952f
cmp ecx, 1
je 0x140049528
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.14000ce70
mov eax, 3
jmp 0x140049534
mov eax, 4
jmp 0x140049534
mov eax, 2
mov dword [rsp + 0x28], eax
cmp ebx, 0x64
jne 0x140049559
cmp eax, 2
jne 0x140049554
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.140055f20
mov dword [rsi], eax
xor ebx, ebx
jmp 0x140049559
mov ebx, 0x15
mov rcx, qword [rsp + 0x40]
call fcn.140056340
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14004b690
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
cmp dword [rcx + 0x10], 2
jne 0x14004b6e5
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0x40]
mov qword [rsp + 0x20], rdi
mov edi, 8
mov dword [rcx + 0x10], 1
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004b6d1
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14004b6d1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
add rbx, 8
sub rdi, 1
jne 0x14004b6b4
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14004b6f0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10], 2
mov edi, 8
mov qword [rsp + 0x30], rbp
mov rbp, rcx
jne 0x14004b74b
mov qword [rsp + 0x38], rsi
lea rbx, [rcx + 0x40]
mov esi, edi
mov dword [rcx + 0x10], 1
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004b73d
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14004b73d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
add rbx, rdi
sub rsi, 1
jne 0x14004b720
mov rsi, qword [rsp + 0x38]
lea rbx, [rbp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004b762
mov rax, qword [rcx]
call qword [rax + 0x10]
add rbx, 8
sub rdi, 1
jne 0x14004b754
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14004b780
Capabilities:
Suspend thread

Disassembly:
sub rsp, 0x28
cmp dword [rcx + 0x10], 1
jne 0x14004b7d5
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0x40]
mov qword [rsp + 0x20], rdi
mov edi, 8
mov dword [rcx + 0x10], 2
mov rcx, qword [rbx]
test rcx, rcx
je 0x14004b7c1
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x14004b7c1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
add rbx, 8
sub rdi, 1
jne 0x14004b7a4
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140053390
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rax, qword [0x140225e48]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rbp, [0x140226b10]
mov rcx, qword [0x140226b10]
cmp rcx, rbp
je 0x1400533f6
test byte [rcx + 0x1c], 0x20
je 0x1400533f6
cmp byte [rcx + 0x19], 4
jb 0x1400533f6
lea edx, [rsi + 0x18]
lea r8, [0x1401ba0b8]
mov rcx, qword [rcx + 0x10]
call fcn.14001f000
add rdi, 0x45d18
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp byte [0x14022c160], sil
jne 0x140053588
mov byte [0x14022c160], 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rax, qword [0x140226b10]
cmp rax, rbp
je 0x140053480
test byte [rax + 0x1c], 0x20
je 0x140053480
cmp byte [rax + 0x19], 2
jb 0x140053480
cmp qword [rbx + 0x18], 8
jb 0x140053445
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400538f0
mov esi, 1
cmp qword [rax + 0x18], 0x10
jb 0x140053461
mov rax, qword [rax]
mov edx, 0x1a
mov r9, rax
lea r8, [0x1401ba0b8]
mov rcx, qword [0x140226b10]
mov rcx, qword [rcx + 0x10]
call fcn.140020990
test sil, 1
je 0x1400534de
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x1400534de
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x1400534d9
test cl, 0x1f
je 0x1400534ac
call fcn.14011efd0
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400534bb
call fcn.14011efd0
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400534ca
call fcn.14011efd0
int3
cmp rcx, 0x27
jbe 0x1400534d6
call fcn.14011efd0
int3
mov rcx, rax
call fcn.1400ea89c
xor edi, edi
mov ebx, 0x45d10
nop word [rax + rax]
mov rax, qword [0x14022c0d0]
test rax, rax
jne 0x140053520
mov ecx, 0x45f80
call fcn.1400ea860
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140053519
mov rcx, rax
call fcn.140051c20
nop
mov qword [0x14022c0d0], rax
mov rcx, qword [rbx + rax]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
je 0x14005355e
mov rcx, qword [0x140226b10]
cmp rcx, rbp
je 0x14005355e
test byte [rcx + 0x1c], 0x20
je 0x14005355e
cmp byte [rcx + 0x19], 2
jb 0x14005355e
mov edx, 0x1b
mov r9d, edi
lea r8, [0x1401ba0b8]
mov rcx, qword [rcx + 0x10]
call fcn.14001f220
inc edi
sub rbx, 8
cmp rbx, 0x45cd0
jg 0x1400534f0
call fcn.140053090
call fcn.1400530d0
call fcn.140053b50
mov ecx, 0x2c9
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov rcx, qword [0x140226b10]
cmp rcx, rbp
je 0x1400535b5
test byte [rcx + 0x1c], 0x20
je 0x1400535b5
cmp byte [rcx + 0x19], 5
jb 0x1400535b5
mov edx, 0x19
lea r8, [0x1401ba0b8]
mov rcx, qword [rcx + 0x10]
call fcn.14001f000
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400eb3e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r13, rcx
mov r15d, edx
mov r12d, r9d
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r8d, dword [r11 + 0x30]
mov ecx, r8d
mov r10, qword [rax + 8]
mov r14, qword [r11]
mov dword [rsp + 0x78], r8d
movsxd rax, dword [r10 + 0x30]
cmp eax, r8d
mov qword [rsp + 0x28], rax
cmovl ecx, eax
xor ebx, ebx
imul r15, rax
mov dword [rsp + 0x70], ecx
mov rcx, rax
cmp eax, r8d
je 0x1400693e8
cmp byte [r14 + 0x11], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r15
sub rdi, rcx
test ebx, ebx
jne 0x1400694fa
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x30], rsi
cmp rdi, r15
jge 0x1400694dc
mov rax, rdi
movsxd rbp, r8d
cqo
mov qword [rsp + 0x20], 0
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x140224370]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x1400694d1
xor r9d, r9d
lea r8, [rsp + 0x20]
mov edx, r10d
mov rcx, r14
call qword [r14 + 0x108]
mov ebx, eax
test eax, eax
jne 0x1400694bd
mov rcx, qword [rsp + 0x20]
call fcn.1400b1000
mov ebx, eax
test eax, eax
jne 0x1400694bd
mov rax, qword [rsp + 0x20]
movsxd r8, dword [rsp + 0x70]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x28]
add rdx, qword [rsp + 0x80]
call fcn.140113870
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x1400694bd
test r12d, r12d
jne 0x1400694bd
mov rax, qword [r13 + 0x28]
mov rcx, qword [rax + 8]
mov eax, dword [rcx + 0x3c]
bswap eax
mov dword [rsi + 0x1c], eax
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400694cc
call fcn.1400b0f50
mov r8d, dword [rsp + 0x78]
add rdi, rbp
test ebx, ebx
je 0x140069403
mov rbp, qword [rsp + 0x88]
mov eax, ebx
mov rsi, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret