joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cabfe
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [0x00550b1d]
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x00550b1f]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004679bd
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00476e52
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
je 0x4cad46
mov eax, dword [rbp - 0x44]
and eax, 0x400
cmp eax, 0
jne 0x4cad4d
mov eax, 0
jmp 0x4cad52
mov eax, 1
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x4cad5e
leave
ret
Function at 0x4cac09
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [0x00550b1d]
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x28], eax
mov eax, 1
mov dword [rbp - 0x24], eax
lea rax, [0x00550b1f]
mov qword [rbp - 0x40], rax
mov eax, 1
mov dword [rbp - 0x38], eax
mov eax, 1
mov dword [rbp - 0x34], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x30]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x40]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea r11, [rsp + 0x40]
lea rax, [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004679bd
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00476e52
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
cmp eax, 0xffffffff
je 0x4cad46
mov eax, dword [rbp - 0x44]
and eax, 0x400
cmp eax, 0
jne 0x4cad4d
mov eax, 0
jmp 0x4cad52
mov eax, 1
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x45]
jmp 0x4cad5e
leave
ret

Function at 0x4cad60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 4], al
mov eax, 0
mov byte [rbp - 3], al
mov eax, 2
mov r8, rax
lea rax, [rbp - 4]
mov r11, rax
lea rax, [rbp - 2]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00476e52
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cmp eax, 0xffffffff
je 0x4cae1a
mov eax, dword [rbp - 8]
and eax, 0x10
cmp eax, 0
je 0x4cae00
mov eax, 1
mov byte [rbp - 2], al
mov eax, dword [rbp - 8]
and eax, 0x400
cmp eax, 0
je 0x4cae1a
mov eax, 1
mov byte [rbp - 1], al
movsx eax, word [rbp - 2]
leave
ret
Function at 0x4cad6b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 4], al
mov eax, 0
mov byte [rbp - 3], al
mov eax, 2
mov r8, rax
lea rax, [rbp - 4]
mov r11, rax
lea rax, [rbp - 2]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
mov rcx, qword [rbp + 0x10]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00476e52
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
cmp eax, 0xffffffff
je 0x4cae1a
mov eax, dword [rbp - 8]
and eax, 0x10
cmp eax, 0
je 0x4cae00
mov eax, 1
mov byte [rbp - 2], al
mov eax, dword [rbp - 8]
and eax, 0x400
cmp eax, 0
je 0x4cae1a
mov eax, 1
mov byte [rbp - 1], al
movsx eax, word [rbp - 2]
leave
ret
Function at 0x4dbc8a
Capabilities:
Get hostname

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rbp + 0x10], rcx
mov eax, 0
mov word [rbp - 0x1fe], ax
movabs rax, 0x1fc
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1fc]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0xff
mov dword [rbp - 0x204], eax
lea rax, [rbp - 0x204]
mov r11, rax
lea rax, [rbp - 0x1fe]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetComputerNameW
mov byte [rbp - 0x205], al
movzx eax, byte [rbp - 0x205]
cmp eax, 0
jne 0x4dbd7c
call sub.kernel32.dll_GetLastError
mov r11, rax
lea rax, [rbp - 0x228]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004d9960
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x228]
mov r11, rax
lea rax, [rbp - 0x218]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x218]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4dbde6
lea rax, [rbp - 0x1fe]
mov r11, rax
lea rax, [rbp - 0x248]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00476f59
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x248]
mov r11, rax
lea rax, [rbp - 0x238]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x238]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4df9b8
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret

Function at 0x4df9c3
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret

Function at 0x4df9f8
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
add rax, 0x10
mov ecx, dword [rax]
mov r11, rcx
mov eax, 1
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GenerateConsoleCtrlEvent
mov eax, 0x14
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret

Function at 0x4dfa03
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
add rax, 0x10
mov ecx, dword [rax]
mov r11, rcx
mov eax, 1
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GenerateConsoleCtrlEvent
mov eax, 0x14
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov rax, qword [rbp - 8]
mov ecx, 3
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_TerminateProcess
leave
ret
Function at 0x4e02ae
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10f0
call fcn.00547290
nop
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x4e0347
lea rax, [0x0055137b]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4e0594
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
cmp eax, 1
jne 0x4e0373
mov rax, qword [rbp - 8]
add rax, 0x10020
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov eax, dword [rbp + 0x20]
cmp eax, 2
jne 0x4e0391
mov rax, qword [rbp - 8]
add rax, 0x10030
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x4e0401
lea rax, [0x0055137c]
mov qword [rbp - 0x50], rax
mov eax, 0
mov dword [rbp - 0x48], eax
mov eax, 1
mov dword [rbp - 0x44], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x50]
mov r11, rax
lea rax, [rbp - 0x40]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4e0594
mov eax, 0
mov dword [rbp - 0x54], eax
mov eax, 0
mov byte [rbp - 0x1054], al
movabs rax, 0xfff
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1053]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x400
mov r11, rax
lea rax, [rbp - 0x1098]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043e734
mov eax, 0x20
mov r8, rax
lea rax, [rbp - 0x1098]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov byte [rbp - 0x1099], al
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x54]
mov r9, rax
mov eax, 0x3e8
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
mov byte [rbp - 0x1099], al
mov eax, dword [rbp - 0x54]
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043e834
movzx eax, byte [rbp - 0x1099]
cmp eax, 0
je 0x4e050e
mov eax, dword [rbp - 0x54]
cmp eax, 0
jne 0x4e0513
jmp 0x4e0518
jmp 0x4e0482
lea rax, [rbp - 0x1078]
mov r11, rax
lea rax, [rbp - 0x10c0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043f213
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x10c0]
mov r11, rax
lea rax, [rbp - 0x10b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
call fcn.0043f406
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10b0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x4e02b9
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10f0
call fcn.00547290
nop
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
add rax, 0x88
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
cmp rax, 0
jne 0x4e0347
lea rax, [0x0055137b]
mov qword [rbp - 0x28], rax
mov eax, 0
mov dword [rbp - 0x20], eax
mov eax, 1
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x28]
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x18]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4e0594
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x20]
cmp eax, 1
jne 0x4e0373
mov rax, qword [rbp - 8]
add rax, 0x10020
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov eax, dword [rbp + 0x20]
cmp eax, 2
jne 0x4e0391
mov rax, qword [rbp - 8]
add rax, 0x10030
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x4e0401
lea rax, [0x0055137c]
mov qword [rbp - 0x50], rax
mov eax, 0
mov dword [rbp - 0x48], eax
mov eax, 1
mov dword [rbp - 0x44], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x50]
mov r11, rax
lea rax, [rbp - 0x40]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x40]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
jmp 0x4e0594
mov eax, 0
mov dword [rbp - 0x54], eax
mov eax, 0
mov byte [rbp - 0x1054], al
movabs rax, 0xfff
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1053]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x400
mov r11, rax
lea rax, [rbp - 0x1098]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043e734
mov eax, 0x20
mov r8, rax
lea rax, [rbp - 0x1098]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov byte [rbp - 0x1099], al
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x54]
mov r9, rax
mov eax, 0x3e8
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ReadFile
mov byte [rbp - 0x1099], al
mov eax, dword [rbp - 0x54]
mov r8, rax
lea rax, [rbp - 0x1054]
mov r11, rax
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043e834
movzx eax, byte [rbp - 0x1099]
cmp eax, 0
je 0x4e050e
mov eax, dword [rbp - 0x54]
cmp eax, 0
jne 0x4e0513
jmp 0x4e0518
jmp 0x4e0482
lea rax, [rbp - 0x1078]
mov r11, rax
lea rax, [rbp - 0x10c0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043f213
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x10c0]
mov r11, rax
lea rax, [rbp - 0x10b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rbp - 0x1078]
mov r10, rax
mov rcx, r10
call fcn.0043f406
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10b0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
leave
ret
Function at 0x52d09c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x00555308]
cmp eax, 0
jne 0x52d0da
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x52d0e4
mov eax, 0
jmp 0x52d376
mov rax, qword [0x00554d90]
cmp rax, 0
je 0x52d10a
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00554d90]
call r11
mov eax, dword [0x00554d0c]
cmp eax, 0
je 0x52d18f
call fcn.0053764f
cmp eax, 0
je 0x52d18f
mov eax, dword [0x00555314]
cmp eax, 0
jne 0x52d13b
jmp 0x52d14d
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.0053fee2
call fcn.0053764f
cmp eax, 0
je 0x52d18f
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x52d17d
mov eax, 0
jmp 0x52d376
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.0052d3d2
jmp 0x52d14d
call fcn.0052ce23
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x00555314]
mov ecx, dword [0x00554d08]
or eax, ecx
cmp eax, 0
je 0x52d1e4
mov eax, dword [0x00555314]
cmp eax, 0
je 0x52d1d4
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.0053fee2
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.00527cc6
mov eax, dword [0x00555320]
cmp eax, 0
jne 0x52d20c
mov rax, qword [rbp + 0x10]
lea rcx, [0x0052c83e]
cmp rax, rcx
je 0x52d239
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053c4dd
cmp eax, 0
jne 0x52d239
mov eax, 0
jmp 0x52d376
call fcn.00538057
call fcn.00537b1d
mov eax, 1
mov dword [0x00554d88], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.0052d5d5
cmp eax, 0
jne 0x52d289
mov eax, dword [0x00554d0c]
cmp eax, 0
jne 0x52d27f
call fcn.00538057
call fcn.00527e00
mov eax, 0
jmp 0x52d376
call fcn.0052ddac
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x52d34b
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x00554d08]
cmp eax, 0
je 0x52d31b
mov eax, dword [0x00554d00]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x00554d00], eax
mov eax, dword [0x00554d04]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x00554d04], eax
mov eax, dword [0x00554d04]
cmp eax, 0xf4240
jb 0x52d31b
mov eax, dword [0x00554d04]
sub eax, 0xf4240
mov dword [0x00554d04], eax
mov eax, dword [0x00554d00]
mov ecx, eax
add eax, 1
mov dword [0x00554d00], eax
mov eax, dword [0x00555314]
cmp eax, 0
je 0x52d34b
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053fee2
mov rax, qword [0x00554d90]
cmp rax, 0
je 0x52d371
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00554d90]
call r11
mov eax, 1
leave
ret
Function at 0x52d0a7
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x00555308]
cmp eax, 0
jne 0x52d0da
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x52d0e4
mov eax, 0
jmp 0x52d376
mov rax, qword [0x00554d90]
cmp rax, 0
je 0x52d10a
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00554d90]
call r11
mov eax, dword [0x00554d0c]
cmp eax, 0
je 0x52d18f
call fcn.0053764f
cmp eax, 0
je 0x52d18f
mov eax, dword [0x00555314]
cmp eax, 0
jne 0x52d13b
jmp 0x52d14d
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.0053fee2
call fcn.0053764f
cmp eax, 0
je 0x52d18f
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x52d17d
mov eax, 0
jmp 0x52d376
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.0052d3d2
jmp 0x52d14d
call fcn.0052ce23
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x00555314]
mov ecx, dword [0x00554d08]
or eax, ecx
cmp eax, 0
je 0x52d1e4
mov eax, dword [0x00555314]
cmp eax, 0
je 0x52d1d4
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.0053fee2
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.00527cc6
mov eax, dword [0x00555320]
cmp eax, 0
jne 0x52d20c
mov rax, qword [rbp + 0x10]
lea rcx, [0x0052c83e]
cmp rax, rcx
je 0x52d239
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053c4dd
cmp eax, 0
jne 0x52d239
mov eax, 0
jmp 0x52d376
call fcn.00538057
call fcn.00537b1d
mov eax, 1
mov dword [0x00554d88], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.0052d5d5
cmp eax, 0
jne 0x52d289
mov eax, dword [0x00554d0c]
cmp eax, 0
jne 0x52d27f
call fcn.00538057
call fcn.00527e00
mov eax, 0
jmp 0x52d376
call fcn.0052ddac
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x52d34b
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x00554d08]
cmp eax, 0
je 0x52d31b
mov eax, dword [0x00554d00]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x00554d00], eax
mov eax, dword [0x00554d04]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x00554d04], eax
mov eax, dword [0x00554d04]
cmp eax, 0xf4240
jb 0x52d31b
mov eax, dword [0x00554d04]
sub eax, 0xf4240
mov dword [0x00554d04], eax
mov eax, dword [0x00554d00]
mov ecx, eax
add eax, 1
mov dword [0x00554d00], eax
mov eax, dword [0x00555314]
cmp eax, 0
je 0x52d34b
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053fee2
mov rax, qword [0x00554d90]
cmp rax, 0
je 0x52d371
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00554d90]
call r11
mov eax, 1
leave
ret
Function at 0x53b361
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b38d
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x005552e0]
cmp eax, 0
je 0x53b3c2
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b3bd
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x53b5bb
mov eax, dword [0x005552dc]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x005552e0], eax
mov eax, dword [0x005552d8]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x53b446
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x00555198]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x005552d8], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x00555198]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b467
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x005552fc]
cmp eax, 0
je 0x53b485
mov r11, qword [0x00554db0]
call r11
jmp 0x53b48d
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x53b4bc
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053fe44
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x53b52a
jmp 0x53b4e4
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x53b4c4
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.005279d8]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.005360b9
jmp 0x53b4d7
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x53b56e
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x53b56e
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x00555380]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b58f
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x005552e0], eax
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b5bb
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret