joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400020c0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0xc0
mov eax, dword [0x14005c3c8]
test eax, eax
je 0x1400020e0
add rsp, 0xc0
pop rbx
ret
lea rcx, str.GC_USE_GETWRITEWATCH
call sub.ucrtbase.dll_getenv
test rax, rax
je 0x1400020fa
cmp byte [rax], 0x30
je 0x1400021c0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400021a9
lea rdx, str.GetWriteWatch
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140031e88], rax
test rax, rax
je 0x1400021a9
mov rdx, qword [0x14005c5b0]
mov r9d, 4
mov r8d, 0x202000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1400021e0
lea rax, [rsp + 0x34]
mov r8, qword [0x14005c5b0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], 0x10
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov rdx, rbx
mov ecx, 1
mov qword [rsp + 0x20], rax
call qword [0x140031e88]
test eax, eax
jne 0x1400021d0
mov dword [0x140031e90], 0x200000
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x14005c3c8], 1
add rsp, 0xc0
pop rbx
ret
cmp byte [rax + 1], 0
jne 0x1400020fa
jmp 0x1400021a9
mov qword [0x140031e88], 0
jmp 0x140002198
mov qword [0x140031e88], 0
jmp 0x1400021a9

Function at 0x1400021f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rcx, qword [0x14005c298]
mov rsi, rdx
test rcx, rcx
je 0x140002240
cmp rcx, 0xffffffffffffffff
je 0x140002258
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002258
mov eax, dword [rsp + 0x3c]
add rsp, 0x48
pop rbx
pop rsi
ret
call sym.GC_CreateLogFile
mov qword [0x14005c298], rax
mov rcx, rax
jmp 0x140002208
mov eax, 0xffffffff
jmp 0x140002230

Function at 0x140002260
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov dword [0x14005c3d0], 1
mov rbx, rcx
test rcx, rcx
je 0x1400022bc
mov rdx, rcx
mov r9d, 0x10
lea r8, str.Fatal_error_in_GC
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
call sym.strlen
mov rdx, rax
test rax, rax
je 0x1400022ab
mov rcx, rbx
call sym.GC_write.part.0
test eax, eax
js 0x1400022bc
mov edx, 1
lea rcx, [0x140027127]
call sym.GC_write.part.0
lea rcx, str.GC_LOOP_ON_ABORT
call sub.ucrtbase.dll_getenv
test rax, rax
je 0x1400022d0
jmp 0x1400022cd
add rsp, 0x20
pop rbx
ret
Function at 0x1400025d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x140025264], 1
sbb eax, eax
xor edx, edx
and eax, 0xffffffc4
cmp qword [0x140031e88], 0
sete dl
lea r9d, [rax + 0x40]
mov r8, rdx
not r8
add rdx, rcx
cmp rcx, r8
mov r8d, dword [0x140031e90]
mov rcx, 0xffffffffffffffff
cmovae rdx, rcx
xor ecx, ecx
or r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test eax, 0xfff
je 0x140002690
lea rcx, [0x14002715e]
call sym.GC_default_on_abort.lto_priv.0
mov rsi, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rsi
mov rax, qword [0x140031fb0]
cmp rax, 0x3ff
ja 0x140002678
lea rdx, [rax + 1]
mov qword [0x140031fb0], rdx
lea rdx, [0x140031ec0]
mov qword [rdx + rax*8 + 0x163d0], rbx
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, [0x140027176]
call sym.GC_default_on_abort.lto_priv.0
call rsi
mov rax, qword [0x140031fb0]
jmp 0x14000264e
cmp qword [0x140031fb0], 0x3ff
jbe 0x1400026af
lea rcx, [0x140027176]
call sym.GC_default_on_abort.lto_priv.0
call qword [sym.imp.KERNEL32.dll_DebugBreak]
test rbx, rbx
je 0x140002668
mov rax, qword [0x140031fb0]
jmp 0x14000264e

Function at 0x1400026c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x140031f38]
mov rdx, qword [0x140031f48]
sub rdx, rax
cmp rcx, 0xffffffffffffffef
ja 0x140002828
lea rbx, [rcx + 0xf]
and rbx, 0xfffffffffffffff0
cmp rdx, rbx
jae 0x140002811
cmp rbx, 0xffff
ja 0x14000277a
cmp dword [0x140025264], 1
mov r8d, dword [0x140031e90]
mov edx, 0x10000
sbb eax, eax
and eax, 0xffffffc4
cmp qword [0x140031e88], 1
adc rdx, 0
lea r9d, [rax + 0x40]
or r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, 0xfff
jne 0x140002795
cmp qword [0x140031fb0], 0x3ff
jbe 0x140002762
lea rcx, [0x140027176]
mov qword [rsp + 0x28], rax
call sym.GC_default_on_abort.lto_priv.0
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x14000283b
mov rdx, rbx
lea rcx, [0x140027190]
call sym.GC_default_warn_proc.lto_priv.0
mov rcx, rbx
call sym.GC_win32_get_mem
test rax, rax
je 0x14000278e
add qword [0x140031ef8], rbx
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, [0x14002715e]
mov qword [rsp + 0x28], rax
call sym.GC_default_on_abort.lto_priv.0
mov rsi, qword [sym.imp.KERNEL32.dll_DebugBreak]
call rsi
mov rdx, qword [0x140031fb0]
mov rax, qword [rsp + 0x28]
cmp rdx, 0x3ff
jbe 0x1400027de
lea rcx, [0x140027176]
call sym.GC_default_on_abort.lto_priv.0
call rsi
mov rdx, qword [0x140031fb0]
mov rax, qword [rsp + 0x28]
add qword [0x140031ef8], 0x10000
lea rcx, [rdx + 1]
mov qword [0x140031fb0], rcx
lea rcx, [0x140031ec0]
mov qword [rcx + rdx*8 + 0x163d0], rax
lea rdx, [rax + 0x10000]
mov qword [0x140031f48], rdx
add rbx, rax
mov qword [0x140031f38], rbx
add rsp, 0x38
pop rbx
pop rsi
ret
mov rbx, 0xfffffffffffffff0
cmp rdx, 0xffffffffffffffef
jbe 0x14000277a
jmp 0x140002811
mov rdx, qword [0x140031fb0]
jmp 0x1400027de
Function at 0x140002c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x140031ff8]
test rax, rax
je 0x140002d48
cmp qword [0x140031ff8], 0
je 0x140002d48
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [0x140031260]
mov edx, eax
shr edx, 8
xor edx, eax
movzx edx, dl
mov rbx, qword [rcx + rdx*8]
test rbx, rbx
jne 0x140002cbc
jmp sym.GC_notify_or_invoke_finalizers.lto_priv.0.cold
mov rbx, qword [rbx]
test rbx, rbx
je sym.GC_notify_or_invoke_finalizers.lto_priv.0.cold
cmp eax, dword [rbx + 8]
jne 0x140002cb0
movzx ecx, byte [rbx + 0x3a]
test cl, cl
jne 0x140002d58
add ecx, 1
xor ebp, ebp
xor edi, edi
mov byte [rbx + 0x3a], cl
jmp 0x140002d08
mov rax, qword [rsi + 8]
add edi, 1
mov qword [0x140031ff8], rax
mov qword [rsi + 8], 0
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsi]
call qword [rsi + 0x10]
mov qword [rsi + 0x18], 0
mov rax, qword [0x140031ff8]
test rax, rax
je 0x140002d2a
mov rsi, qword [0x140031ff8]
test edi, edi
cmove rbp, qword [0x140031f18]
test rsi, rsi
jne 0x140002ce0
test edi, edi
je 0x140002d44
mov rax, qword [0x140031f18]
cmp rax, rbp
je 0x140002d44
sub rax, rbp
add qword [0x140031f20], rax
mov byte [rbx + 0x3a], 0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx eax, word [rbx + 0x38]
add eax, 1
movzx edx, ax
shr edx, cl
test edx, edx
je 0x140002d73
xor eax, eax
mov word [rbx + 0x38], ax
jmp 0x140002ccd
mov word [rbx + 0x38], ax
jmp 0x140002d48
Function at 0x140004720
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor r14d, r14d
cmp dword [0x140031e94], 2
mov rbx, rcx
mov edi, edx
je 0x140004867
lea r12, [0x140025040]
mov rax, qword [r12 + 8]
lea rbp, [0x140031ec0]
lea rsi, [rax + 8]
lea r13, [rax + 0x408]
test rax, rax
je 0x140004816
mov r15, qword [rsi]
nop
test r15, r15
je 0x140004809
test rbx, rbx
je 0x140004788
call rbx
test eax, eax
jne 0x140004854
mov rdx, r15
mov rcx, qword [0x140031f78]
shr rdx, 0x16
mov rax, rdx
and eax, 0x7ff
mov rax, qword [rbp + rax*8 + 0x263d0]
cmp rdx, qword [rax + 0x2010]
jne 0x1400047c8
jmp 0x1400047cd
mov rax, qword [rax + 0x2018]
cmp rdx, qword [rax + 0x2010]
je 0x1400047cd
cmp rcx, rax
jne 0x1400047b8
mov rdx, r15
shr rdx, 0xc
and edx, 0x3ff
mov rax, qword [rax + rdx*8]
mov rcx, qword [rax]
mov qword [rsi], rcx
test edi, edi
je 0x140004840
mov rdx, qword [0x140031a88]
movzx r9d, word [rax + 0x1a]
sub rdx, 1
cmp r9, rdx
je 0x140004840
mov r15, rcx
test r15, r15
jne 0x140004779
add rsi, 8
cmp r13, rsi
jne 0x14000476c
add r12, 0x20
lea rax, [0x1400250a0]
cmp rax, r12
jne 0x14000474c
cmp dword [0x140031e94], 2
je 0x140004875
mov eax, 1
jmp 0x140004856
mov rdx, qword [rax + 0x20]
mov rcx, r15
call sym.GC_reclaim_small_nonempty_block.constprop.0
mov r15, qword [rsi]
jmp 0x140004770
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
jmp 0x140004745
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r8d, r8d
lea rcx, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
sub eax, r14d
mov edx, eax
call sym.GC_log_printf
jmp 0x140004833
Function at 0x140004e00
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rdi, rcx
shl rbp, 4
mov rcx, rbp
call sym.GC_scratch_alloc.lto_priv.0
mov edx, 1
mov rbx, rax
mov eax, dword [0x140031a78]
test eax, eax
je 0x140004e4b
mov eax, dword [0x140031a60]
xor edx, edx
mov esi, eax
or esi, dword [0x14005c528]
setne dl
test eax, eax
sete al
movzx eax, al
mov rsi, qword [0x140031f50]
mov dword [0x14005c528], eax
mov dword [0x140031f94], 0
test rsi, rsi
je 0x140004ed0
test rbx, rbx
je 0x140004eb8
mov ecx, dword [0x140031e94]
test edx, edx
jne 0x140004ef8
lea rax, [rbx + rbp]
mov qword [0x140031f50], rbx
mov qword [0x140031f88], rdi
mov qword [0x140031f58], rax
test ecx, ecx
jne 0x140004f78
sub rbx, 0x10
mov qword [0x140031f60], rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rdi
lea rcx, str.GC_Warning:_Failed_to_grow_mark_stack_to__ld_frames_n
call sym.GC_default_warn_proc.lto_priv.0
mov rbx, qword [0x140031f50]
jmp 0x140004e9b
test rbx, rbx
je 0x140004fa6
lea rax, [rbx + rbp]
mov qword [0x140031f50], rbx
mov qword [0x140031f88], rdi
mov qword [0x140031f58], rax
jmp 0x140004e9b
mov rax, qword [0x14005c5b0]
mov r8, qword [0x140031f88]
lea r12, [rax - 1]
mov rdx, rax
shl r8, 4
and r12, rsi
sub rdx, r12
test r12, r12
cmovne r12, rdx
cmp r12, r8
jb 0x140004f48
test ecx, ecx
je 0x140004ed9
lea rcx, str.Recycle__lu__lu_scratch_allocated_bytes_at__p_n
mov r9, rsi
xor edx, edx
call sym.GC_log_printf
mov ecx, dword [0x140031e94]
jmp 0x140004e7a
mov r13, r8
neg rax
sub r13, r12
and r13, rax
test ecx, ecx
jne 0x140004f92
test r13, r13
je 0x140004f69
lea rcx, [rsi + r12]
mov rdx, r13
call sym.GC_add_to_heap
mov ecx, dword [0x140031e94]
jmp 0x140004e7a
mov edx, edi
lea rcx, str.Grew_mark_stack_to__lu_frames_n
call sym.GC_log_printf
mov rbx, qword [0x140031f50]
jmp 0x140004e9b
mov r9, rsi
mov edx, r13d
lea rcx, str.Recycle__lu__lu_scratch_allocated_bytes_at__p_n
call sym.GC_log_printf
jmp 0x140004f58
lea rcx, str.No_space_for_mark_stack_n
call sym.GC_err_printf
xor ecx, ecx
call sym.GC_default_on_abort.lto_priv.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop
Function at 0x140004fd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor edx, edx
mov rax, qword [rcx]
cmp dword [rax], 0xc0000005
je 0x140004ff0
mov eax, edx
add rsp, 0x28
pop rbx
pop rsi
ret
cmp qword [rax + 0x20], 1
jne 0x140004fe3
mov r9, qword [rax + 0x28]
lea rbx, [0x140031ec0]
mov r10, qword [0x14005c5b0]
mov rdx, r9
shr rdx, 0x16
mov rax, rdx
and eax, 0x7ff
mov rax, qword [rbx + rax*8 + 0x263d0]
cmp qword [rax + 0x2010], rdx
je 0x14000504d
mov r8, qword [0x140031f78]
jmp 0x140005048
mov rax, qword [rax + 0x2018]
cmp rdx, qword [rax + 0x2010]
je 0x14000504d
cmp r8, rax
jne 0x140005038
mov rdx, r9
shr rdx, 0xc
and edx, 0x3ff
cmp qword [rax + rdx*8], 0
jne 0x140005087
mov rax, qword [0x14005c3c0]
cmp rax, 0xffffffffffffffff
je 0x140005080
add rsp, 0x28
pop rbx
pop rsi
jmp rax
xor edx, edx
jmp 0x140004fe3
cmp dword [0x140025264], 1
mov rsi, r10
mov rdx, r10
sbb eax, eax
neg rsi
and rsi, r9
and eax, 0xffffffc4
lea r9, [0x14005c5b8]
lea r8d, [rax + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000511a
mov rax, qword [0x14005c5b0]
xor edx, edx
mov r8d, 1
shr rax, 0xc
je 0x140005110
nop dword [rax]
mov rcx, rsi
mov r11, r8
shr rcx, 0xc
and ecx, 0x3ffff
mov rax, rcx
shl r11, cl
shr rax, 6
add rax, 0x1c79
lock or qword [rbx + rax*8], r11
mov rax, qword [0x14005c5b0]
shr rax, 0xc
add rdx, 1
add rsi, 0x1000
cmp rdx, rax
jb 0x1400050d0
mov edx, 0xffffffff
jmp 0x140004fe3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.un_VirtualProtect_failed:_errcode_0x_X_n
mov edx, eax
call sym.GC_log_printf
lea rcx, str.un_VirtualProtect_failed
call sym.GC_default_on_abort.lto_priv.0
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x1400050b7
Function at 0x140007e20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r14
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r11, rcx
mov rcx, qword [0x14005c5b0]
shl rdx, 0xc
mov rbx, r11
lea r10, [r11 + rdx]
mov rax, rcx
lea r9, [rcx + r10 - 1]
neg rax
and rbx, rax
and r9, rax
lea rax, [rbx + 0x1000]
cmp r9, rax
je 0x140007f00
xor r8d, 1
mov rax, rbx
mov edi, 1
and r8d, 1
lea rsi, [0x140031ec0]
cmp rbx, r9
jae 0x140007ec6
nop dword [rax + rax]
cmp rax, r11
setb dl
cmp rax, r10
setae cl
or dl, cl
jne 0x140007e95
test r8b, r8b
je 0x140007ebb
mov rcx, rax
mov r14, rdi
shr rcx, 0xc
and ecx, 0x3ffff
mov rdx, rcx
shl r14, cl
shr rdx, 6
add rdx, 0x1c79
lock or qword [rsi + rdx*8], r14
add rax, 0x1000
cmp rax, r9
jb 0x140007e80
cmp dword [0x140025264], 1
mov rdx, r9
mov rcx, rbx
sbb eax, eax
lea r9, [0x14005c5b8]
sub rdx, rbx
and eax, 0xffffffc4
lea r8d, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140007f40
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r14
ret
mov rax, rbx
lea rdx, [0x140031ec0]
shr rax, 0x12
and eax, 0xfff
add rax, 0x1c78
mov rdx, qword [rdx + rax*8 + 8]
mov rax, rbx
shr rax, 0xc
bt rdx, rax
jae 0x140007e5f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.un_VirtualProtect_failed:_errcode_0x_X_n
mov edx, eax
call sym.GC_log_printf
lea rcx, str.un_VirtualProtect_failed
call sym.GC_default_on_abort.lto_priv.0
nop
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r14
jmp qword [sym.imp.KERNEL32.dll_DebugBreak]
Function at 0x140008230
Capabilities:
Resume thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rsi, [0x140031260]
mov rdi, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r13, qword [sym.imp.KERNEL32.dll_DebugBreak]
lea r12, [rsi + 0x800]
nop dword [rax + rax]
mov rbx, qword [rsi]
test rbx, rbx
je 0x1400082cc
lea rbp, str.ResumeThread_failed
jmp 0x140008280
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400082cc
cmp byte [rbx + 0x3b], 0
je 0x140008278
mov rcx, qword [rbx + 0x10]
call rdi
cmp eax, 0xffffffff
jne 0x14000829c
mov rcx, rbp
call sym.GC_default_on_abort.lto_priv.0
call r13
mov edx, dword [0x140031a78]
test edx, edx
je 0x1400082c0
mov eax, dword [0x140031a60]
test eax, eax
jne 0x1400082c0
lea rax, [0x14005c300]
cmp rbx, rax
jne 0x1400082e8
nop dword [rax]
mov byte [rbx + 0x3b], 0
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140008280
add rsi, 8
cmp rsi, r12
jne 0x140008260
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp qword [0x140031e88], 0
jne 0x1400082c0
mov rcx, rbx
xor r8d, r8d
mov edx, 1
and rcx, 0xfffffffffffff000
call sym.GC_remove_protection.part.0.lto_priv.0
jmp 0x1400082c0
Function at 0x140008e20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, dword [0x140031a74]
test ebx, ebx
jne 0x140008ecb
mov r11d, dword [0x140031a78]
test r11d, r11d
je 0x140008ed8
mov r10d, dword [0x140031f90]
test r10d, r10d
je 0x140008ed8
lea esi, [rcx + rcx*4]
mov ebx, dword [0x1400605f0]
add esi, esi
cmp esi, ebx
jg 0x140008e77
jmp 0x1400090c3
add ebx, 1
cmp esi, ebx
je 0x140008eb3
xor ecx, ecx
call sym.GC_mark_some
test eax, eax
je 0x140008e70
cmp ebx, esi
jge 0x140008eb3
mov r9d, dword [0x140060638]
test r9d, r9d
jg 0x140008ea2
cmp dword [0x140025260], 0xf423f
jne 0x140009070
lea rcx, [sym.GC_never_stop_func]
call sym.GC_stopped_mark
call sym.GC_finish_collection
mov ebx, dword [0x1400605f0]
test ebx, ebx
jle 0x140008ecb
sub ebx, esi
js 0x140009038
mov dword [0x1400605f0], ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.GC_should_collect.lto_priv.0
test eax, eax
je 0x140008ecb
mov r8d, dword [0x140031a78]
test r8d, r8d
je 0x140009047
mov ecx, dword [0x1400605f4]
test ecx, ecx
jne 0x140008f0d
mov eax, dword [0x1400605f8]
cmp eax, dword [0x140025248]
jl 0x140009062
mov edx, dword [0x140031e94]
test edx, edx
jne 0x1400090a2
call sym.GC_promote_black_lists
mov edx, 1
xor ecx, ecx
call sym.GC_reclaim_all
mov rbx, qword [0x140031f28]
test rbx, rbx
je 0x140008fa3
nop dword [rax + rax]
mov r11d, 0x3ff
jmp 0x140008f78
test byte [rax + 0x19], 4
jne 0x140008f6f
mov rcx, qword [rbx + 0x2010]
xor edx, edx
shl rcx, 0xa
add rcx, r11
shl rcx, 0xc
call sym.clear_marks_for_block
sub r11, 1
test r11, r11
js 0x140008f97
mov rax, qword [rbx + r11*8]
cmp rax, 0xfff
ja 0x140008f50
lea rdx, [r11 - 1]
sub r11, rax
test rax, rax
cmove r11, rdx
test r11, r11
jns 0x140008f78
mov rbx, qword [rbx + 0x2000]
test rbx, rbx
jne 0x140008f40
mov dword [0x140031f98], 0
mov dword [0x140031f90], 5
mov qword [0x140031f80], 0
mov dword [0x1400605f8], 0
mov dword [0x1400605fc], 1
cmp dword [0x140025260], 0xf423f
jne 0x14000900c
lea rcx, [sym.GC_never_stop_func]
call sym.GC_stopped_mark
test eax, eax
jne 0x14000902d
mov eax, dword [0x1400605fc]
test eax, eax
jne 0x140008ecb
add dword [0x140060638], 1
jmp 0x140008ecb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x140025260], 0xf423f
mov dword [0x14006063c], eax
je 0x140008fe2
lea rcx, [sym.GC_timeout_stop_func]
jmp 0x140008fe9
add rsp, 0x28
pop rbx
pop rsi
jmp sym.GC_finish_collection
mov dword [0x1400605f0], 0
jmp 0x140008ecb
lea rcx, [sym.GC_never_stop_func]
call sym.GC_try_to_collect_inner
mov dword [0x1400605f8], 0
jmp 0x140008ecb
add eax, 1
mov dword [0x1400605f8], eax
jmp 0x140008fd6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [sym.GC_timeout_stop_func]
mov dword [0x14006063c], eax
call sym.GC_stopped_mark
test eax, eax
jne 0x140008eae
add dword [0x140060638], 1
mov ebx, dword [0x1400605f0]
jmp 0x140008eb9
mov eax, dword [0x140031a88]
mov r8d, dword [0x140031f00]
lea rcx, str._Full_mark_for_collection__lu_after__lu_allocd_bytes_n
lea edx, [rax + 1]
call sym.GC_log_printf
jmp 0x140008f1b
test ebx, ebx
jle 0x140008ecb
sub ebx, esi
jmp 0x140008ec5
Function at 0x14000a750
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x160
mov ebx, dword [0x14005c520]
mov dword [0x1400311f0], 1
test ebx, ebx
jne 0x14000a791
mov dword [0x1400311f0], 0
add rsp, 0x160
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov esi, ebx
lea r14, [rsp + 0x20]
xor r12d, r12d
shl rsi, 3
lea rdi, [0x14005c3e0]
mov rcx, r14
mov r8, rsi
mov rdx, rdi
lea rbp, [0x140031ec0]
call sym.memcpy
mov r8, rsi
xor edx, edx
mov rcx, rdi
mov dword [0x14005c520], 0
add rsi, r14
call sym.memset
mov edx, ebx
lea rcx, str.Found__u_leaked_objects:_n
lea rbx, [0x140025040]
call sym.GC_err_printf
nop word [rax + rax]
mov r13, qword [r14]
mov rcx, r13
call sym.GC_default_print_heap_obj_proc
test r13, r13
je 0x14000a8f6
mov rdx, r13
mov r9, r13
shr rdx, 0x16
and r9, 0xfffffffffffff000
mov rax, rdx
and eax, 0x7ff
mov rax, qword [rbp + rax*8 + 0x263d0]
cmp rdx, qword [rax + 0x2010]
je 0x14000a930
mov rcx, qword [0x140031f78]
jmp 0x14000a854
mov rax, qword [rax + 0x2018]
cmp rdx, qword [rax + 0x2010]
je 0x14000a930
cmp rax, rcx
jne 0x14000a840
mov rax, r9
shr rax, 0xc
and eax, 0x3ff
mov rdx, qword [rcx + rax*8]
mov rcx, qword [0x140031f18]
mov rax, qword [rdx + 0x20]
movzx edx, byte [rdx + 0x18]
mov r8, rax
add rcx, rax
shr r8, 4
cmp rax, 0x80f
ja 0x14000a978
mov qword [0x140031f18], rcx
cmp edx, 2
jne 0x14000a8a1
sub qword [0x140060618], rax
mov rcx, rdx
shl rcx, 5
mov r10d, dword [rbx + rcx + 0x1c]
test r10d, r10d
je 0x14000a8e0
cmp rax, 8
jbe 0x14000a8e0
sub rax, 8
lea rcx, [r13 + 8]
cmp eax, 8
jae 0x14000a940
test al, 4
jne 0x14000a9b4
test eax, eax
je 0x14000a8e0
mov byte [r13 + 8], 0
test al, 2
jne 0x14000a9cb
nop
shl rdx, 5
mov rax, qword [rbx + rdx]
lea rax, [rax + r8*8]
mov rdx, qword [rax]
mov qword [r13], rdx
mov qword [rax], r13
add r14, 8
cmp rsi, r14
jne 0x14000a7f0
lea rcx, str.GC_ABORT_ON_LEAK
call sub.ucrtbase.dll_getenv
test rax, rax
je 0x14000a775
lea rcx, str.Leaked_or_smashed_objects_encountered
call sym.GC_default_on_abort.lto_priv.0
call qword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x14000a775
mov rcx, rax
jmp 0x14000a859
lea rdi, [r13 + 0x10]
mov r9d, eax
mov qword [r13 + 8], 0
mov qword [rcx + r9 - 8], 0
and rdi, 0xfffffffffffffff8
sub rcx, rdi
add ecx, eax
mov eax, ecx
shr eax, 3
mov ecx, eax
mov rax, r12
rep stosq qword [rdi], rax
jmp 0x14000a8e0
lea r8, [rax + 0xfff]
mov qword [0x140031f18], rcx
shr r8, 0xc
cmp edx, 2
jne 0x14000a996
sub qword [0x140060618], rax
cmp r8, 1
jbe 0x14000a9a7
shl r8, 0xc
sub qword [0x140031ee0], r8
mov rcx, r9
call sym.GC_freehblk
jmp 0x14000a8f6
mov eax, eax
mov dword [r13 + 8], 0
mov dword [rcx + rax - 4], 0
jmp 0x14000a8e0
mov eax, eax
xor r9d, r9d
mov word [rcx + rax - 2], r9w
jmp 0x14000a8e0
Function at 0x14000ead0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov ecx, 1
lea rsi, [0x140028308]
mov ebx, 0x1e
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rdi, rax
nop dword [rax]
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x14000eaf8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x14000eb20
Capabilities:
Decode data using base64 via dword translation table
Terminate process

Disassembly:
sub rsp, 0x28
cmp dword [rdx + 0x14], 2
jne 0x14000eb57
mov r8, qword [rdx + 8]
movsxd rax, dword [rdx]
mov eax, dword [r8 + rax]
mov edx, dword [r8]
mov dword [rcx + 0x18], 0
mov qword [rcx + 0x20], 0
shl rax, 0x20
or rax, rdx
mov qword [rcx + 0x10], rax
add rsp, 0x28
ret
lea rcx, str.WyRandRNG_needs_2_32_bit_unsigned_integers_as_the_seed.
mov edx, 0x37
call sym.eprintln.isra.0
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop

Function at 0x140011620
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rax, qword [rcx]
mov eax, dword [rax]
lea edx, [rax - 0x40010006]
and edx, 0xfffffffb
je 0x140011727
cmp eax, 0xe06d7363
je 0x140011727
mov rdx, qword [0x140028fa0]
pxor xmm0, xmm0
lea rdi, str.Unhandled_Exception_0x
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x44], xmm0
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x48], eax
lea rax, [0x1400284a3]
movups xmmword [rsp + 0x64], xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rsp + 0x54], xmm0
mov dword [rsp + 0x40], 0x7000fe86
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x64], 1
movups xmmword [rsp + 0x70], xmm0
call sym.str_intp.constprop.0
mov rbp, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
test rbp, rbp
je 0x140011738
lea r12d, [rdi + 1]
movsxd rdi, edi
movsxd rbx, r12d
mov rcx, rbx
call sym._v_malloc
mov r8, rdi
mov rdx, rbp
mov rsi, rax
mov rcx, rax
call sym.memcpy
mov byte [rsi + rdi], 0xa
test r12d, r12d
jle 0x140011716
mov ecx, 1
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rdi, rax
nop dword [rax]
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x1400116f8
mov edx, 0x36
lea rcx, [0x1400282d0]
call sym.eprintln.isra.0
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 0xd
mov esi, 0xd
call sym._v_malloc
mov ecx, 1
mov rbx, rax
movabs rax, 0x286e6c746e697270
mov qword [rbx], rax
mov dword [rbx + 8], 0x294c494e
mov byte [rbx + 0xc], 0xa
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rdi, rax
mov r8, rsi
mov rcx, rbx
mov r9, rdi
mov edx, 1
call sym.fwrite
sub rsi, rax
add rbx, rax
test rsi, rsi
jg 0x140011770
jmp 0x140011716