joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e6d60
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
cmp qword [0x1402ea870], 0
je 0x1400e6d8d
mov rax, rcx
lock xadd qword [0x140d814c0], rax
add rax, rcx
shr rax, 0x14
cmp rax, qword [0x1402ea870]
jae 0x1400e6d95
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rsi, qword [0x140121520]
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1400e6e2b
lea rcx, [0x140121520]
call method.__sanitizer::ReportFile.ReopenIfNecessary__
mov rcx, qword [0x140121528]
cmp rcx, 0xffffffffffffffff
je 0x1400e6e76
lea rax, [rcx - 1]
cmp rax, 1
ja 0x1400e6deb
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x1400e6e16
mov qword [rsp + 0x20], 0
lea rdx, str._total_mmaped____20____common_flags____mmap_limit_mb_n
lea r9, [rsp + 0x2c]
mov r8d, 0x35
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400e6e23
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._total_mmaped____20____common_flags____mmap_limit_mb_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rsi], 0
call method.__sanitizer.Die__
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400e6e43
add edi, 1
cmp edi, 0x63
ja 0x1400e6e60
pause
cmp byte [rsi], 0
jne 0x1400e6e40
jmp 0x1400e6e69
xor ecx, ecx
call rbx
cmp byte [rsi], 0
jne 0x1400e6e40
mov al, 1
xchg byte [rsi], al
test al, al
jne 0x1400e6e40
jmp 0x1400e6da8
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x24a7
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x1400e8a50
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r15d, dword [rsp + 0xc8]
cmp r15d, 1
jbe 0x1400e8b6f
mov r12, r9
mov rbp, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140d81498]
test rax, rax
je 0x1400e8aa1
mov qword [rbx + 0x10], r14
mov dword [rbx + 8], 1
cmp r12, 0x1000
jae 0x1400e8acb
jmp 0x1400e8b40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov qword [0x140d81498], rax
mov qword [rbx + 0x10], r14
mov dword [rbx + 8], 1
cmp r12, 0x1000
jb 0x1400e8b40
mov rcx, qword [rsp + 0xc0]
cmp r12, rcx
jbe 0x1400e8b93
cmp rbp, rcx
jbe 0x1400e8b40
lea rcx, [r12 - 0x10]
cmp rcx, rbp
jbe 0x1400e8b40
mov edx, ebp
and edx, 7
test rdx, rdx
jne 0x1400e8b40
mov edx, 1
nop word [rax + rax]
cmp edx, r15d
jae 0x1400e8b40
mov rdi, qword [rbp + 8]
cmp rdi, rax
jb 0x1400e8b40
cmp rdi, r14
je 0x1400e8b20
mov esi, edx
add edx, 1
mov dword [rbx + 8], edx
mov qword [rbx + rsi*8 + 0x10], rdi
cmp rbp, r12
jae 0x1400e8b4f
mov rdi, qword [rbp]
cmp rdi, rbp
jbe 0x1400e8b40
cmp rcx, rdi
jbe 0x1400e8b40
mov esi, edi
and esi, 7
mov rbp, rdi
test rsi, rsi
je 0x1400e8b00
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov qword [rsp + 0x20], rbp
lea rcx, str.gotsan.cpp
lea r8, str.__stack_top_______stack_bottom__
mov edx, 0x1c56
mov r9, r12
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov r9d, r15d
mov qword [rsp + 0x20], 2
lea rcx, str.gotsan.cpp
lea r8, str.__max_depth_______2__
mov edx, 0x1c6c
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], rcx
jmp 0x1400e8b54
Function at 0x1400edf40
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
add rsp, 0x58
ret

Function at 0x1400edf60
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
add rsp, 0x58
ret

Function at 0x1400edf80
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret

Function at 0x1400edfa0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret

Function at 0x1400edfe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne cl
and eax, 0x10
shr eax, 4
and al, cl
add rsp, 0x28
ret
Function at 0x1400eebd0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov r15, r8
mov rdi, rdx
mov r14, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r12d, dword [rsp + 0x58]
mov r13, r12
mov ecx, edi
shl r13, cl
mov ebx, 1
mov ecx, r15d
shl rbx, cl
cmp r13, rbx
cmovbe r13, rbx
cmp rbx, r12
cmovb rbx, r12
lea rdx, [rsp + 0x30]
mov r8d, 0x30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400eecb0
add rbx, r14
lea rdi, [rsp + 0x30]
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x1400eec65
add rcx, qword [rsp + 0x48]
mov r8d, 0x30
mov rdx, rdi
call rsi
test rax, rax
je 0x1400eecb0
cmp dword [rsp + 0x50], 0x10000
mov rcx, qword [rsp + 0x30]
jne 0x1400eec50
add rcx, r12
mov rdx, r13
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
lea rdx, [rbx + rax]
mov rcx, qword [rsp + 0x48]
add rcx, qword [rsp + 0x30]
cmp rdx, rcx
jae 0x1400eec55
test rax, rax
je 0x1400eecb0
add r13, 0xffffffffffffffff
test rax, r13
jne 0x1400eecd4
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.___uptr_0_______shadow_start__
mov edx, 0x231f
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__IsAligned_shadow_start__alignment_______0_
mov edx, 0x2320
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3

Function at 0x1400ef140
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x1400ef270
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
cmp rcx, 0xffffffffffffffff
je 0x1400ef2c5
mov rsi, r9
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test rbx, rbx
je 0x1400ef2ac
test edi, edi
jne 0x1400ef2ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
test rsi, rsi
je 0x1400ef2b8
mov eax, dword [rsp + 0x2c]
mov qword [rsi], rax
test edi, edi
setne al
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x2492
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x1400ef300
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp rcx, 0xffffffffffffffff
je 0x1400ef3b6
mov r14, r8
mov rsi, rdx
mov rax, qword [rsp + 0x80]
test rax, rax
lea rbx, [rsp + 0x2c]
cmovne rbx, rax
test r9, r9
lea rdi, [rsp + 0x30]
cmovne rdi, r9
mov dword [rbx], 0
mov qword [rdi], 0
lea rax, [rcx - 1]
cmp rax, 1
ja 0x1400ef36c
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x1400ef3ac
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x28]
mov rdx, rsi
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
je 0x1400ef395
mov eax, dword [rsp + 0x28]
mov qword [rdi], rax
jmp 0x1400ef39d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
test esi, esi
setne al
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov dword [rbx], 6
xor eax, eax
jmp 0x1400ef3a2
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x24a7
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3

Function at 0x1400ef500
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, r8
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx]
mov al, 1
xchg byte [rdi], al
test al, al
jne 0x1400ef599
mov rcx, rbx
call method.__sanitizer::ReportFile.ReopenIfNecessary__
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400ef5c7
lea rax, [rcx - 1]
cmp rax, 1
ja 0x1400ef55c
xor eax, eax
cmp rcx, 1
sete al
or eax, 0xfffffff4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
test rax, rax
je 0x1400ef580
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rdx, rsi
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400ef589
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [rdi], 0
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebp, ebp
mov r15, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400ef5a7
add ebp, 1
cmp ebp, 0x63
ja 0x1400ef5b0
pause
jmp 0x1400ef5b5
xor ecx, ecx
call r15
cmp byte [rdi], 0
jne 0x1400ef5a4
mov al, 1
xchg byte [rdi], al
test al, al
jne 0x1400ef5a4
jmp 0x1400ef520
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__fd_____fd_t__1_______0_
mov edx, 0x24a7
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x1400f03b0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x5c]
neg rax
lea rbx, [rsi + rdi]
add rbx, 0xffffffffffffffff
and rbx, rax
mov rdi, rax
and rdi, rsi
lea r14, [rsp + 0x28]
mov r15, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ebp, 0x10003
jmp 0x1400f040d
mov rax, qword [rsp + 0x40]
add rdi, rax
test rax, rax
je 0x1400f043b
cmp rdi, rbx
seta sil
ja 0x1400f043b
mov r8d, 0x30
mov rcx, rdi
mov rdx, r14
call r15
cmp rax, 0x30
jne 0x1400f0439
mov eax, dword [rsp + 0x4c]
cmp eax, 0x10
ja 0x1400f0400
bt ebp, eax
jae 0x1400f0400
xor esi, esi
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400f0890
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1400f2350
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, qword [0x140deb7e8]
xor ebx, ebx
lea rdi, [0x140dab7d8]
lea r15, [rsp + 0x28]
mov r12, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor esi, esi
jmp 0x1400f239a
mov ecx, 0x40000
call method.__sanitizer.RoundUpTo_unsigned_long_long__unsigned_long_long_
add rbx, rax
add rsi, 1
cmp rsi, 0x8000
je 0x1400f23c3
mov rax, qword [rdi + rsi*8 + 8]
test rax, rax
je 0x1400f238d
mov rdx, qword [0x140d81498]
test rdx, rdx
jne 0x1400f2380
mov rcx, r15
call r12
mov edx, dword [rsp + 0x2c]
mov qword [0x140d81498], rdx
jmp 0x1400f2380
lea rax, [r14 + rbx]
add rax, 0x10010
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400f23e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
sub rsp, 0x30
mov rdx, r8
mov rsi, rcx
mov qword [rcx], r9
mov qword [rsp + 0x28], 0
lea rcx, [0x140deb7e0]
lea r8, [rsp + 0x28]
call method.__sanitizer::StackStore.Store___sanitizer::StackTrace_const__unsigned_long_long_
mov dword [rsi + 0xc], eax
cmp qword [rsp + 0x28], 0
jne 0x1400f2419
add rsp, 0x30
pop rsi
ret
add rsp, 0x30
pop rsi
jmp method.__sanitizer._anonymous_namespace_::CompressThread::NewWorkNotify__

Function at 0x1400f2430
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp dword [0x1402ea8d0], 0
je 0x1400f24b1
jle 0x1400f248b
mov al, 1
xchg byte [0x141249144], al
test al, al
jne 0x1400f24b8
mov eax, dword [0x141249148]
cmp eax, 1
je 0x1400f2496
test eax, eax
jne 0x1400f2484
mov byte [0x141249158], 1
mov rax, qword [0x141249150]
test rax, rax
jne 0x1400f24ed
mov qword [0x141249150], 0
mov dword [0x141249148], 2
mov byte [0x141249144], 0
add rsp, 0x28
pop rdi
pop rsi
jmp method.__sanitizer.CompressStackStore__
lock add dword [0x141249140], 1
lea rcx, [0x141249140]
call fcn.1400f7c08
mov byte [0x141249144], 0
add rsp, 0x28
pop rdi
pop rsi
ret
xor esi, esi
mov rdi, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400f24c6
add esi, 1
cmp esi, 0x63
ja 0x1400f24cf
pause
jmp 0x1400f24d3
xor ecx, ecx
call rdi
cmp byte [0x141249144], 0
jne 0x1400f24c3
mov al, 1
xchg byte [0x141249144], al
test al, al
jne 0x1400f24c3
jmp 0x1400f244d
mov qword [rsp + 0x20], rax
lea rcx, str.gotsan.cpp
lea r8, str.__nullptr______thread___
mov edx, 0x28fe
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3
Function at 0x1400f3830
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov ebx, r8d
mov r12, rdx
mov rdi, rcx
mov rax, qword [0x140d81498]
test rax, rax
jne 0x1400f3868
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x4c]
mov qword [0x140d81498], rax
cmp rax, 0x8001
mov ecx, 0x8000
cmovae rcx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rcx, r12
call method.__sanitizer.ReadFileToBuffer_char_const__char__unsigned_long_long__unsigned_long_long__unsigned_long_long__unsigned_int_
test al, al
je 0x1400f3932
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400f396b
mov r14, qword [rdi + 0x10]
mov r15, qword [rdi + 0x18]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0
xor eax, eax
movabs rsi, 0x400100100002600
mov rcx, rbx
add rax, 1
movzx edx, byte [rcx + rax - 1]
cmp rdx, 0x3a
jbe 0x1400f3903
jmp 0x1400f390e
mov qword [rdi + 0x18], rax
add rax, 1
movzx edx, byte [rcx + rax - 1]
cmp rdx, 0x3a
ja 0x1400f390e
bt rsi, rdx
jb 0x1400f38f0
test rdx, rdx
je 0x1400f3950
mov rcx, rdi
mov rdx, r12
call method.__sanitizer::FlagParser.parse_flag_char_const_
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
add rax, 1
movzx edx, byte [rcx + rax - 1]
cmp rdx, 0x3a
jbe 0x1400f3903
jmp 0x1400f390e
mov al, 1
test bl, bl
jne 0x1400f397a
mov r8d, dword [rsp + 0x34]
lea rcx, str.Failed_to_read_options_from__s:_error__d_n
mov rdx, r12
call method.__sanitizer.Printf_char_const__..._
xor eax, eax
jmp 0x1400f397a
cmp dword [0x1402ea804], 0
jg 0x1400f3963
mov dword [0x1402ea804], 1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r15
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call method.__sanitizer.UnmapOrDie_void__unsigned_long_long_
mov al, 1
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400f4df0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
je 0x1400f4e33
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rcx, rax
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400f4e33
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400f7080
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
cmp dword [0x140d81494], 0
jle 0x1400f70d2
cmp qword [0x140dab7d0], 0
je 0x1400f71df
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
imul rax, qword [rsp + 0x30], 0x3b9aca00
mov rcx, qword [0x140dab7d0]
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x1400f70d7
cqo
idiv rcx
mov r14, rax
jmp 0x1400f70de
xor r14d, r14d
jmp 0x1400f70de
xor edx, edx
div ecx
mov r14d, eax
mov eax, dword [0x1402ea8d0]
mov ebp, eax
neg ebp
cmovs ebp, eax
mov ebx, 0x10
xor edi, edi
lea rsi, [0x140deb7e0]
nop dword [rax]
lea rcx, [rsi + rbx]
mov edx, ebp
mov r8, rsi
call method.__sanitizer::StackStore::BlockInfo.Pack___sanitizer::StackStore::Compression____sanitizer::StackStore_
add rdi, rax
add rbx, 0x10
cmp rbx, 0x10010
jne 0x1400f7100
test rdi, rdi
je 0x1400f71d3
cmp dword [0x140d81494], 0
jle 0x1400f71d3
cmp qword [0x140dab7d0], 0
je 0x1400f71fc
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [0x140dab7d0]
lea rdx, [0x140dfb7f0]
lea rcx, [rsp + 0x30]
call method.__sanitizer::StackDepotBase___sanitizer::StackDepotNode__1__20_.GetStats___const
mov r9, qword [rsp + 0x38]
cmp dword [0x140d81494], 0
je 0x1400f71d3
imul rax, rbx, 0x3b9aca00
mov rcx, rax
or rcx, rsi
shr rcx, 0x20
je 0x1400f7192
cqo
idiv rsi
jmp 0x1400f7196
xor edx, edx
div esi
sub rax, r14
add r9, rdi
mov rbx, qword [str.SanitizerTool]
shr rdi, 0xa
shr r9, 0xa
movabs rcx, 0x431bde82d7b634db
mul rcx
shr rdx, 0x12
mov qword [rsp + 0x20], rdx
lea rcx, str._s:_StackDepot_released__zu_KiB_out_of__zu_KiB_in__llu_ms_n
mov rdx, rbx
mov r8, rdi
call method.__sanitizer.Printf_char_const__..._
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140dab7d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
cmp qword [0x140dab7d0], 0
jne 0x1400f70a1
jmp 0x1400f7217
lea rcx, [0x140dab7d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
cmp qword [0x140dab7d0], 0
jne 0x1400f7142
mov qword [rsp + 0x20], 0
lea rcx, str.gotsan.cpp
lea r8, str.__frequency.QuadPart_______0__
mov edx, 0x23d8
xor r9d, r9d
call method.__sanitizer.CheckFailed_char_const__int__char_const__unsigned_long_long__unsigned_long_long_
int3

Function at 0x1400f7b80
Capabilities:
Create thread

Disassembly:
mov rdx, rcx
lea rcx, [dbg.threadentry]
jmp sym._cgo_beginthread

Function at 0x1400fcd30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x1400fcda0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x141249c54]
mov r12, rcx
test ebx, ebx
jle 0x1400fced0
mov rax, qword [0x141249c58]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x1400fcdec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400fce73
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x1400fcdd0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x1400fcef2
mov rax, qword [0x141249c58]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x141249c58]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400fced7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400fce6c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400fce80
add dword [0x141249c54], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x141249c58]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400fce6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x1400fcdf7
mov rax, qword [0x141249c58]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400fd3b0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x141249cc0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
mov rbx, qword [0x141249ca0]
test rbx, rbx
je 0x1400fd404
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1400fd3fb
test r12, r12
je 0x1400fd3fb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400fd3e0
lea rcx, [0x141249cc0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]

Function at 0x1400fd620
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400fd638
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400fd640
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret