joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fafe4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x00522240]
cmp eax, 0
jne 0x4fb022
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4fb02c
mov eax, 0
jmp 0x4fb2be
mov rax, qword [0x00521cc8]
cmp rax, 0
je 0x4fb052
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00521cc8]
call r11
mov eax, dword [0x00521c44]
cmp eax, 0
je 0x4fb0d7
call fcn.00505597
cmp eax, 0
je 0x4fb0d7
mov eax, dword [0x0052224c]
cmp eax, 0
jne 0x4fb083
jmp 0x4fb095
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.0050de2a
call fcn.00505597
cmp eax, 0
je 0x4fb0d7
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4fb0c5
mov eax, 0
jmp 0x4fb2be
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.004fb31a
jmp 0x4fb095
call fcn.004fad6b
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x0052224c]
mov ecx, dword [0x00521c40]
or eax, ecx
cmp eax, 0
je 0x4fb12c
mov eax, dword [0x0052224c]
cmp eax, 0
je 0x4fb11c
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.0050de2a
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.004f5c0e
mov eax, dword [0x00522258]
cmp eax, 0
jne 0x4fb154
mov rax, qword [rbp + 0x10]
lea rcx, [0x004fa786]
cmp rax, rcx
je 0x4fb181
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050a425
cmp eax, 0
jne 0x4fb181
mov eax, 0
jmp 0x4fb2be
call fcn.00505f9f
call fcn.00505a65
mov eax, 1
mov dword [0x00521cc0], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.004fb51d
cmp eax, 0
jne 0x4fb1d1
mov eax, dword [0x00521c44]
cmp eax, 0
jne 0x4fb1c7
call fcn.00505f9f
call fcn.004f5d48
mov eax, 0
jmp 0x4fb2be
call fcn.004fbcf4
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x4fb293
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x00521c40]
cmp eax, 0
je 0x4fb263
mov eax, dword [0x00521c38]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x00521c38], eax
mov eax, dword [0x00521c3c]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x00521c3c], eax
mov eax, dword [0x00521c3c]
cmp eax, 0xf4240
jb 0x4fb263
mov eax, dword [0x00521c3c]
sub eax, 0xf4240
mov dword [0x00521c3c], eax
mov eax, dword [0x00521c38]
mov ecx, eax
add eax, 1
mov dword [0x00521c38], eax
mov eax, dword [0x0052224c]
cmp eax, 0
je 0x4fb293
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050de2a
mov rax, qword [0x00521cc8]
cmp rax, 0
je 0x4fb2b9
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00521cc8]
call r11
mov eax, 1
leave
ret
Function at 0x4fafef
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [0x00522240]
cmp eax, 0
jne 0x4fb022
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4fb02c
mov eax, 0
jmp 0x4fb2be
mov rax, qword [0x00521cc8]
cmp rax, 0
je 0x4fb052
mov eax, 0
mov r10, rax
mov rcx, r10
mov r11, qword [0x00521cc8]
call r11
mov eax, dword [0x00521c44]
cmp eax, 0
je 0x4fb0d7
call fcn.00505597
cmp eax, 0
je 0x4fb0d7
mov eax, dword [0x0052224c]
cmp eax, 0
jne 0x4fb083
jmp 0x4fb095
lea rax, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
mov r10, rax
mov rcx, r10
call fcn.0050de2a
call fcn.00505597
cmp eax, 0
je 0x4fb0d7
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov r11, qword [rbp - 0x10]
call r11
cmp eax, 0
je 0x4fb0c5
mov eax, 0
jmp 0x4fb2be
mov eax, 1
mov r10, rax
mov rcx, r10
call fcn.004fb31a
jmp 0x4fb095
call fcn.004fad6b
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [0x0052224c]
mov ecx, dword [0x00521c40]
or eax, ecx
cmp eax, 0
je 0x4fb12c
mov eax, dword [0x0052224c]
cmp eax, 0
je 0x4fb11c
lea rax, str.Initiating_full_world_stop_collection__n
mov r10, rax
mov rcx, r10
call fcn.0050de2a
mov eax, 1
mov dword [rbp - 8], eax
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 4], eax
call fcn.004f5c0e
mov eax, dword [0x00522258]
cmp eax, 0
jne 0x4fb154
mov rax, qword [rbp + 0x10]
lea rcx, [0x004fa786]
cmp rax, rcx
je 0x4fb181
mov eax, 0
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050a425
cmp eax, 0
jne 0x4fb181
mov eax, 0
jmp 0x4fb2be
call fcn.00505f9f
call fcn.00505a65
mov eax, 1
mov dword [0x00521cc0], eax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.004fb51d
cmp eax, 0
jne 0x4fb1d1
mov eax, dword [0x00521c44]
cmp eax, 0
jne 0x4fb1c7
call fcn.00505f9f
call fcn.004f5d48
mov eax, 0
jmp 0x4fb2be
call fcn.004fbcf4
mov eax, dword [rbp - 8]
cmp eax, 0
je 0x4fb293
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 4]
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [0x00521c40]
cmp eax, 0
je 0x4fb263
mov eax, dword [0x00521c38]
mov ecx, dword [rbp - 0x18]
add eax, ecx
mov dword [0x00521c38], eax
mov eax, dword [0x00521c3c]
mov ecx, dword [rbp - 0x1c]
add eax, ecx
mov dword [0x00521c3c], eax
mov eax, dword [0x00521c3c]
cmp eax, 0xf4240
jb 0x4fb263
mov eax, dword [0x00521c3c]
sub eax, 0xf4240
mov dword [0x00521c3c], eax
mov eax, dword [0x00521c38]
mov ecx, eax
add eax, 1
mov dword [0x00521c38], eax
mov eax, dword [0x0052224c]
cmp eax, 0
je 0x4fb293
mov eax, dword [rbp - 0x1c]
mov r8, rax
mov eax, dword [rbp - 0x18]
mov r11, rax
lea rax, str.Complete_collection_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050de2a
mov rax, qword [0x00521cc8]
cmp rax, 0
je 0x4fb2b9
mov eax, 5
mov r10, rax
mov rcx, r10
mov r11, qword [0x00521cc8]
call r11
mov eax, 1
leave
ret
Function at 0x5092a9
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x5092d5
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x00522218]
cmp eax, 0
je 0x50930a
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x509305
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x509503
mov eax, dword [0x00522214]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x00522218], eax
mov eax, dword [0x00522210]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x50938e
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x005220d0]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x00522210], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x005220d0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x5093af
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x00522234]
cmp eax, 0
je 0x5093cd
mov r11, qword [0x00521ce8]
call r11
jmp 0x5093d5
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x509404
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050dd8c
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x509472
jmp 0x50942c
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x50940c
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.004f5920]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.00504001
jmp 0x50941f
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x5094b6
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x5094b6
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x005222b8]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x5094d7
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x00522218], eax
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x509503
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret
Function at 0x5092b4
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x5092d5
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x00522218]
cmp eax, 0
je 0x50930a
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x509305
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x509503
mov eax, dword [0x00522214]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x00522218], eax
mov eax, dword [0x00522210]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x50938e
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x005220d0]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x00522210], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x005220d0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x5093af
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x00522234]
cmp eax, 0
je 0x5093cd
mov r11, qword [0x00521ce8]
call r11
jmp 0x5093d5
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x509404
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050dd8c
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x509472
jmp 0x50942c
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x50940c
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.004f5920]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.00504001
jmp 0x50941f
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x5094b6
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x5094b6
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x005222b8]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x5094d7
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x00522218], eax
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x509503
lea rax, [0x005252a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret
Function at 0x50a425
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x0052224c]
cmp eax, 2
jne 0x50a457
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x00522230]
cmp eax, ecx
jae 0x50a5c9
jmp 0x50a482
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x50a45f
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x00521ea0]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x50a4b9
jmp 0x50a475
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x50a5c4
jmp 0x50a4ee
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x50a4c7
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x50a5bf
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x50a546
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x50a546
mov eax, 0
jmp 0x50a60d
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.004f65f4
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x50a592
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00521c30]
sub rax, 1
cmp rcx, rax
jne 0x50a5ba
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.005099db
jmp 0x50a501
jmp 0x50a4dd
jmp 0x50a475
mov eax, dword [0x0052224c]
cmp eax, 2
jne 0x50a608
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050de2a
mov eax, 1
leave
ret
Function at 0x50a430
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x0052224c]
cmp eax, 2
jne 0x50a457
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x00522230]
cmp eax, ecx
jae 0x50a5c9
jmp 0x50a482
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x50a45f
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x00521ea0]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x50a4b9
jmp 0x50a475
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x50a5c4
jmp 0x50a4ee
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x50a4c7
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x50a5bf
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x50a546
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x50a546
mov eax, 0
jmp 0x50a60d
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.004f65f4
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x50a592
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00521c30]
sub rax, 1
cmp rcx, rax
jne 0x50a5ba
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.005099db
jmp 0x50a501
jmp 0x50a4dd
jmp 0x50a475
mov eax, dword [0x0052224c]
cmp eax, 2
jne 0x50a608
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0050de2a
mov eax, 1
leave
ret
Function at 0x50d986
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, 0
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x128]
mov qword [rbp - 0x10], rax
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, str.GC_LOG_FILE
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetEnvironmentVariableA
sub eax, 1
cmp eax, 0x104
jae 0x50d9e7
mov eax, 1
mov dword [rbp - 0x14], eax
jmp 0x50da8f
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
cmp eax, 4
jle 0x50da57
mov eax, dword [rbp - 0x12c]
sub eax, 4
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movsx eax, byte [rcx]
cmp eax, 0x2e
jne 0x50da57
mov eax, dword [rbp - 0x12c]
sub eax, 4
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movabs rax, 8
mov r8, rax
lea rax, str..gc.log
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x50daa0
jmp 0x50daaa
mov eax, 2
jmp 0x50daaf
mov eax, 4
mov ecx, dword [0x0052224c]
cmp ecx, 2
mov dword [rbp - 0x130], eax
jne 0x50dac9
jmp 0x50dad3
mov eax, 0x80000080
jmp 0x50dad8
mov eax, pe_nt_image_headers64
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x130]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 8], rax
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x50db7b
mov rax, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
je 0x50db7b
mov eax, 0
mov dword [rbp - 0x134], eax
mov eax, 2
mov r9, rax
lea rax, [rbp - 0x134]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFilePointer
mov rax, qword [rbp - 8]
leave
ret
Function at 0x50d991
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, 0
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x128]
mov qword [rbp - 0x10], rax
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, str.GC_LOG_FILE
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetEnvironmentVariableA
sub eax, 1
cmp eax, 0x104
jae 0x50d9e7
mov eax, 1
mov dword [rbp - 0x14], eax
jmp 0x50da8f
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
cmp eax, 4
jle 0x50da57
mov eax, dword [rbp - 0x12c]
sub eax, 4
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movsx eax, byte [rcx]
cmp eax, 0x2e
jne 0x50da57
mov eax, dword [rbp - 0x12c]
sub eax, 4
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movabs rax, 8
mov r8, rax
lea rax, str..gc.log
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x50daa0
jmp 0x50daaa
mov eax, 2
jmp 0x50daaf
mov eax, 4
mov ecx, dword [0x0052224c]
cmp ecx, 2
mov dword [rbp - 0x130], eax
jne 0x50dac9
jmp 0x50dad3
mov eax, 0x80000080
jmp 0x50dad8
mov eax, pe_nt_image_headers64
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x130]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 8], rax
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x50db7b
mov rax, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
je 0x50db7b
mov eax, 0
mov dword [rbp - 0x134], eax
mov eax, 2
mov r9, rax
lea rax, [rbp - 0x134]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFilePointer
mov rax, qword [rbp - 8]
leave
ret
Function at 0x50db81
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
cmp rax, 0
jne 0x50dbac
mov eax, 0
jmp 0x50dca0
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x50dbcd
lea rax, [0x005255a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov rax, qword [0x005222a8]
cmp rax, 0
jne 0x50dbea
call fcn.0050d986
mov qword [0x005222a8], rax
mov rax, qword [0x005222a8]
cmp rax, 0xffffffffffffffff
jne 0x50dc26
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x50dc1c
lea rax, [0x005255a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, 0xffffffff
jmp 0x50dca0
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 8]
mov r9, rax
mov eax, dword [rbp + 0x18]
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [0x005222a8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteFile
mov dword [rbp - 4], eax
mov eax, dword [0x0052231c]
cmp eax, 0
je 0x50dc82
lea rax, [0x005255a0]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x50dc93
jmp 0x50dc9d
mov eax, 0xffffffff
jmp 0x50dca0
mov eax, dword [rbp - 8]
leave
ret
Function at 0x511348
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x510
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
add rax, 0x10
lea rcx, [rbp - 4]
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetExitCodeThread
cmp eax, 0
je 0x5113a0
mov eax, dword [rbp - 4]
cmp eax, 0x103
je 0x5113a0
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.00510a98
jmp 0x511507
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x51146f
mov eax, 0x100003
mov dword [rbp - 0x4b0], eax
mov rax, qword [rbp + 0x10]
add rax, 0x10
lea rcx, [rbp - 0x4e0]
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetThreadContext
cmp eax, 0
je 0x511434
mov rax, qword [rbp + 0x10]
add rax, 0x40
mov rcx, qword [rbp + 0x10]
add rcx, 0x48
lea rdx, [rbp - 0x4e0]
mov r11, rdx
mov r10, rcx
mov qword [rbp - 0x4e8], rax
mov rcx, r10
mov rdx, r11
call fcn.00511978
mov rcx, qword [rbp - 0x4e8]
mov qword [rcx], rax
jmp 0x5114c1
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
jne 0x51146f
lea rax, str.ResumeThread_failed_in_suspend_loop
mov r10, rax
mov rcx, r10
mov r11, qword [0x005222b8]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [rbp - 8]
cmp eax, 1
jle 0x51148b
mov eax, 0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 8], eax
cmp eax, 0xf4240
jl 0x5114bc
lea rax, str.SuspendThread_loop_failed
mov r10, rax
mov rcx, r10
mov r11, qword [0x005222b8]
call r11
call sub.kernel32.dll_DebugBreak
jmp 0x511354
mov rax, qword [rbp + 0x10]
add rax, 0x3b
mov ecx, 1
mov byte [rax], cl
mov rax, qword [0x005222c0]
cmp rax, 0
je 0x511507
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r11, rcx
mov eax, 0xa
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [0x005222c0]
call r11
leave
ret