Waqar Ahmed

Decompile flag: True
Repo: test
Selected modules: all
Dry run mode: True
S3 solo mode: None
Nomad job mode: False
Local mode with path: ../../samples/cmd-x64
Number of CPU cores: 8
Number of parallel processes: 4

Processing batch 1/1
{'decompiled': [{'decompiled_function_hash': 'ea20333c83dac2f3c61287a5e7f918b63d920a65b4459bcc6068abc4502f3372', 'decompiled_function': 'if (arg1 == __security_cookie)\n    int64_t rcx = rol.q(arg1, 0x10)\n    \n    if ((rcx.w & 0xffff) == 0)\n        return \n    \n    arg1 = ror.q(rcx, 0x10)\n\nnoreturn __report_gsfailure(arg1) __tailcall', 'decompiled_function_name': '__security_check_cookie', 'decompiled_function_prototype': 'void __security_check_cookie(int64_t arg1)', 'decompiled_function_address': 1255149568, 'function_type': 'USER', 'functions_caller': ['__security_check_cookie(arg21 ^ &__return_addr)', '__security_check_cookie(arg23 ^ &__return_addr)', '__security_check_cookie(arg22 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg16 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg2 ^ &__return_addr)', '__security_check_cookie(arg12 ^ &__return_addr)', '__security_check_cookie(arg11 ^ &__return_addr)', '__security_check_cookie(arg13 ^ &__return_addr)', '__security_check_cookie(arg8 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg2 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg9 ^ &__return_addr)', '__security_check_cookie(arg6 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg3 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_98)', '__security_check_cookie(arg10 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_168)', '__security_check_cookie(rax_1 ^ &var_148)', '__security_check_cookie(rax_1 ^ &var_278)', '__security_check_cookie(rax_1 ^ &var_2e8)', '__security_check_cookie(arg3 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_298)', '__security_check_cookie(rax_1 ^ &var_38)', '__security_check_cookie(arg6 ^ &__return_addr)', '__security_check_cookie(arg12 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_928)', '__security_check_cookie(rax_1 ^ &var_48)', '__security_check_cookie(arg3 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_288)', '__security_check_cookie(rax_1 ^ &var_2c8)', '__security_check_cookie(rax_1 ^ &var_48)', '__security_check_cookie(rax_1 ^ &var_6b8)', '__security_check_cookie(rax_1 ^ &var_288)', '__security_check_cookie(arg12 ^ &__return_addr)', '__security_check_cookie(arg12 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_1078)', '__security_check_cookie(rax_1 ^ &var_a8)', '__security_check_cookie(rax_1 ^ &var_148)', '__security_check_cookie(result_1 ^ &var_2d8)', '__security_check_cookie(arg17 ^ &__return_addr)', '__security_check_cookie(arg11 ^ &__return_addr)', '__security_check_cookie(arg14 ^ &__return_addr)', '__security_check_cookie(arg12 ^ &__return_addr)', '__security_check_cookie(arg6 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_78)', '__security_check_cookie(rax_1 ^ &var_e8)', '__security_check_cookie(rax_1 ^ &var_268)', '__security_check_cookie(arg4 ^ &__return_addr)', '__security_check_cookie(arg5 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_278)', '__security_check_cookie(rax_1 ^ &var_b8)', '__security_check_cookie(rax_1 ^ &var_2d8)', '__security_check_cookie(rax_1 ^ &var_308)', '__security_check_cookie(rax_1 ^ &var_298)', '__security_check_cookie(arg15 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_78)', '__security_check_cookie(rax_1 ^ &var_af8)', '__security_check_cookie(rax_1 ^ &var_288)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg15 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_318)', '__security_check_cookie(arg4 ^ &__return_addr)', '__security_check_cookie(arg10 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg2 ^ &__return_addr)', '__security_check_cookie(arg18 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg8 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_258)', '__security_check_cookie(rax_1 ^ &var_278)', '__security_check_cookie(rax_1 ^ &var_498)', '__security_check_cookie(var_28 ^ &var_258)', '__security_check_cookie(arg2 ^ &__return_addr)', '__security_check_cookie(arg2 ^ &__return_addr)', '__security_check_cookie(arg8 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_c8)', '__security_check_cookie(rax_1 ^ &var_f48)', '__security_check_cookie(rax_1 ^ &var_448)', '__security_check_cookie(rax_1 ^ &var_2a8)', '__security_check_cookie(rax_1 ^ &var_278)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_a8)', '__security_check_cookie(arg5 ^ &__return_addr)', '__security_check_cookie(arg11 ^ &__return_addr)', '__security_check_cookie(arg13 ^ &__return_addr)', '__security_check_cookie(arg12 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_78)', '__security_check_cookie(arg9 ^ &__return_addr)', '__security_check_cookie(arg13 ^ &__return_addr)', '__security_check_cookie(arg5 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_218)', '__security_check_cookie(rax_1 ^ &var_4758)', '__security_check_cookie(rax_1 ^ &var_248)', '__security_check_cookie(rax_1 ^ &var_138)', '__security_check_cookie(rax_1 ^ &var_898)', '__security_check_cookie(rax_1 ^ &var_e8)', '__security_check_cookie(rax_1 ^ &var_278)', '__security_check_cookie(rax_1 ^ &var_488)', '__security_check_cookie(rax_1 ^ &var_548)', '__security_check_cookie(rax_1 ^ &var_8e8)', '__security_check_cookie(rax_1 ^ &var_288)', '__security_check_cookie(rax_1 ^ &var_268)', '__security_check_cookie(arg10 ^ &__return_addr)', '__security_check_cookie(arg3 ^ &__return_addr)', '__security_check_cookie(arg4 ^ &__return_addr)', '__security_check_cookie(arg5 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_1c738)', '__security_check_cookie(arg6 ^ &__return_addr)', '__security_check_cookie(arg3 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg6 ^ &__return_addr)', '__security_check_cookie(arg3 ^ &__return_addr)', '__security_check_cookie(arg5 ^ &__return_addr)', '__security_check_cookie(arg4 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg10 ^ &__return_addr)', '__security_check_cookie(arg5 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg6 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg5 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg4 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg7 ^ &__return_addr)', '__security_check_cookie(arg8 ^ &__return_addr)', '__security_check_cookie(arg12 ^ &__return_addr)', '__security_check_cookie(arg15 ^ &__return_addr)', '__security_check_cookie(rax_1 ^ &var_2f8)', '__security_check_cookie(rax_1 ^ &var_2e8)', '__security_check_cookie(rax_1 ^ &var_78)', '__security_check_cookie(rax_1 ^ &var_868)', '__security_check_cookie(rax_1 ^ &var_268)', '__security_check_cookie(rax_1 ^ &var_298)', '__security_check_cookie(rax_1 ^ &var_2b8)', '__security_check_cookie(rax_1 ^ &var_b8)', '__security_check_cookie(var_18 ^ &var_258)', '__security_check_cookie(rax_1 ^ &var_6c8)', '__security_check_cookie(rax_1 ^ &var_388)', '__security_check_cookie(rax_1 ^ &var_ae8)', '__security_check_cookie(rax_1 ^ &var_448)', '__security_check_cookie(rax_1 ^ &var_a8)', '__security_check_cookie(rax_1 ^ &var_38)', '__security_check_cookie(rax_1 ^ &var_458)', '__security_check_cookie(rax_1 ^ &var_78)', '__security_check_cookie(rax_1 ^ &var_48)', '__security_check_cookie(rax_1 ^ &var_4c8)', '__security_check_cookie(rax_1 ^ &var_338)', '__security_check_cookie(rax_1 ^ &var_258)', '__security_check_cookie(rax_1 ^ &var_268)', '__security_check_cookie(rax_1 ^ &var_278)', '__security_check_cookie(rax_1 ^ &var_268)', '__security_check_cookie(rax_1 ^ &var_258)', '__security_check_cookie(rax_1 ^ &var_488)', '__security_check_cookie(rax_1 ^ &var_2c8)', '__security_check_cookie(rax_1 ^ &var_88)', 'return __security_check_cookie(r9 ^ *(sx.q(*arg3 & 0xfffffff8) + r10)) __tailcall', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg11 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)', '__security_check_cookie(arg5 ^ &__return_addr)', '__security_check_cookie(arg3 ^ &__return_addr)', '__security_check_cookie(arg2 ^ &__return_addr)', '__security_check_cookie(arg3 ^ &__return_addr)', '__security_check_cookie(arg8 ^ &__return_addr)', '__security_check_cookie(codeProperties.PackagePublisher ^ &var_138)', '__security_check_cookie(rax_1 ^ &var_288)', '__security_check_cookie(rax_1 ^ &var_278)', '__security_check_cookie(arg11 ^ &__return_addr)', '__security_check_cookie(arg1 ^ &__return_addr)'], 'functions_call': ['noreturn __report_gsfailure(arg1) __tailcall'], 'flattened_score': 0.0, 'mba_score': 0.0, 'disassembled_function_hash': '5b10689d81a029bfabb73347691d43c61cc903c211e1978058aaff9b67166164'}, {'decompiled_function_hash': '3a9066191d4aeb616809d5bf796d40e1665a8d2d55a8e1620c40ac40634ae6a1', 'decompiled_function': 'if (arg1 == 0)\n    return \n\nvoid* DHead_1 = DHead\n\nif (DHead_1 == 0)\n    return \n\nint32_t DCount_1 = DCount\n\nif (DCount_1 == 0)\n    return \n\nint64_t entry_r9\n\nif (DHead_1 != arg1 - 0x10)\n    return sub_4ad01327(arg2, DCount_1, arg1 - 0x10, DHead_1, DHead_1, entry_r9) __tailcall\nint64_t rax_1 = *(DHead_1 + 8)\n\nif (DHead_1 != DHead_1)\n    *(arg2 + 8) = rax_1\n    return sub_4ad0108b(DHead_1, arg2) __tailcall\n\nDHead = rax_1\nreturn sub_4ad0108b(DHead_1, arg2) __tailcall', 'decompiled_function_name': 'FreeStr', 'decompiled_function_prototype': 'void FreeStr(int64_t arg1, void* arg2)', 'decompiled_function_address': 1255149632, 'function_type': 'USER', 'functions_caller': ['FreeStr(arg3, entry_rdx)', 'FreeStr(arg2, FreeStr(arg3, entry_rdx))', 'return FreeStr(arg7, entry_rdx) __tailcall', 'FreeStr(var_40_1, rdx_8)', 'FreeStr(_Str_4, rdx)', 'FreeStr(rax, rdx_1)', 'FreeStr(rsi, rdx_2)', 'return FreeStr(r12, rdx) __tailcall', 'FreeStr(r12, PutStdErr(0x233f, 0, r8_1))', 'FreeStr(r12, PutStdErr(0x234f, MB_PRECOMPOSED, &data_4ad33362))', 'FreeStr(r12, PutStdErr(0x233f, 0, r8_4))', 'return FreeStr(lpConsoleTitle_2, rdx_2)', 'FreeStr(rax_19, ExecError(rax_19))', 'FreeStr(rax_8, rdx_5)', 'rcx_3, arg2, arg3, arg4 = FreeStr(rcx_3, arg2)', 'FreeStr(rax_3, rdx_1)', 'return FreeStr(arg5, rdx_2) __tailcall', 'FreeStr(lpFileName, GetDir(&CurDrvDir, 0x104, 0))', 'FreeStr(rax_34, rdx_14)', 'FreeStr(rax_5, rdx_3)', 'FreeStr(arg6, rdx_2)', 'void* rdx_4 = FreeStr(arg5, FreeStr(arg6, rdx_2))', 'FreeStr(rax_1[1], rdx_4)', 'FreeStr(rax_1, FreeStr(rax_1[1], rdx_4))', 'FreeStr(rax, FreeStr(rax_1, FreeStr(rax_1[1], rdx_4)))', 'void* rdx_12 = FreeStr(arg7, rdx_11)', 'void* rdx_13 = FreeStr(arg8, rdx_12)', 'rdx_2 = FreeStr(rax_11, rdx_13)', 'rcx_2, rdx, r8_1 = FreeStr(*(arg3 + 0x28), entry_rdx)', 'void* rdx_1 = FreeStr(arg7[1], arg2)', 'void* rdx_2 = FreeStr(*rbp_1, rdx_1)', 'FreeStr(rbp_1[1], rdx_2)', 'rdx_1 = FreeStr(rbp_1, FreeStr(rbp_1[1], rdx_2))', 'return FreeStr(arg7, rdx_5) __tailcall', 'return FreeStr(arg4, rdx_4) __tailcall', 'entry_r8 = FreeStr(lpConsoleTitle, entry_rdx)', 'r8_2 = FreeStr(lpConsoleTitle, i_1)', 'void* rdx_4 = FreeStr(i[1], rdx_2)', 'void* rdx_5 = FreeStr(*rbp_1, rdx_4)', 'FreeStr(rbp_1[1], rdx_5)', 'rdx_4 = FreeStr(rbp_1, FreeStr(rbp_1[1], rdx_5))', 'rcx_9, rdx_2, r8_2 = FreeStr(*(arg1 + 0x28), rdx)', 'FreeStr(arg2, entry_rdx)', 'FreeStr(rbp_1, rdx_2)', 'rcx_5, rdx_2, r8_1 = FreeStr(rax_3, rdx_1)', 'r8 = FreeStr(arg3, rdx_1)', 'FreeStr(arg1, rdx_2)', 'r8_7, r9_5 = FreeStr(pSecurityDescriptor, rdx_15)', 'FreeStr(rax_24, WriteFmtString(arg3, u"%s", rax_24))', 'FreeStr(rax, rdx_2)', 'void* rdx_8 = FreeStr(i_2[1], rdx_5)', 'void* rdx_9 = FreeStr(*rbp_1, rdx_8)', 'FreeStr(rbp_1[1], rdx_9)', 'rdx_8 = FreeStr(rbp_1, FreeStr(rbp_1[1], rdx_9))', 'FreeStr(i_3, rdx_8)', 'return FreeStr(arg7, rdx_4) __tailcall', 'FreeStr(arg6, rdx_2)', 'rdx_4 = FreeStr(arg5, FreeStr(arg6, rdx_2))', 'void* rdx_14 = FreeStr(i[1], rdx_6)', 'void* rdx_15 = FreeStr(*rbp_2, rdx_14)', 'FreeStr(rbp_2[1], rdx_15)', 'rdx_14 = FreeStr(rbp_2, FreeStr(rbp_2[1], rdx_15))', 'FreeStr(i_1, rdx_14)', 'FreeStr(rax_5, rdx_6)', 'FreeStr(lpFileName, rdx_10)', 'FreeStr(rax_2, rdx_2)', 'FreeStr(rax_2, rdx_4)', 'return FreeStr(lpMultiByteStr, SetErrorMode(uMode))', 'FreeStr(r13, rdx_1)', 'FreeStr(rsi, FreeStr(r13, rdx_1))', 'FreeStr(result, rdx)', 'arg3 = FreeStr(rax_3, rdx_2)', 'FreeStr(rax_7, rdx_7)', 'FreeStr(_Str, FreeStr(rax_7, rdx_7))', 'FreeStr(rsi, rdx_1)', 'FreeStr(r13, FreeStr(rsi, rdx_1))', 'arg3 = FreeStr(rax_5, rdx_1)', 'rdx_6 = FreeStr(rax_12, rdx_10)', 'FreeStr(_Str, rdx_6)', 'FreeStr(rax, rdx)', 'void* rdx_10 = FreeStr(*(rbx_1 + 0x28), rdx_4)', 'FreeStr(*(rbx_1 + 8), rdx_10)', 'FreeStr(rbx_1, FreeStr(*(rbx_1 + 8), rdx_10))', 'FreeStr(result, rdx_2)', 'void* rdx = FreeStr(*(arg2 + 0x30), arg2)', 'FreeStr(*(arg2 + 0x28), rdx)', 'void* rdx = FreeStr(*(arg2 + 0x30), arg2)', 'FreeStr(*(arg2 + 0x38), rdx)', 'FreeStr(*(arg2 + 0x80), arg2)', 'FreeStr(*(arg2 + 0x38), arg2)', 'FreeStr(rax, rdx)'], 'functions_call': ['if (DHead_1 != arg1 - 0x10)', 'return sub_4ad0108b(DHead_1, arg2) __tailcall', 'return sub_4ad0108b(DHead_1, arg2) __tailcall'], 'flattened_score': 0.0, 'mba_score': 0.0, 'disassembled_function_hash': 'c89e8da195a8271f78fca5b2f88789348ba91afb0126487aaaf05c3b93e26f47'}, {'decompiled_function_hash': '072503ee8b108e9b0f14ef3c97de04931ccbb1de86b181bb8798111755122d9f', 'decompiled_function': 'if (arg2 == 0)\n    return sub_4ad035ed() __tailcall\n\nif (GotoFlag != 0)\n    return sub_4ad035ed() __tailcall\n\nif (*arg2 == 0x2d)\n    return sub_4ad035ed() __tailcall\n\nif (fDelayedExpansion != 0)\n    int64_t var_68[0xc]\n    memset(&var_68, 0, 0x60)\n    int32_t rax_4\n    int64_t rcx_2\n    int64_t rdx_1\n    int64_t r8_1\n    rax_4, rcx_2, rdx_1, r8_1 = DelayedEnvVarSub(arg2, &var_68, 0)\n    \n    if (rax_4 != 0)\n        if (fDelayedExpansion != 0 && arg2 != 0)\n            r8_1.b = 1\n            rcx_2, rdx_1, r8_1 = DelayedEnvVarSub(arg2, &var_68, r8_1)\n        \n        return sub_4ad011bc(rcx_2, rdx_1, r8_1) __tailcall\n\nif (arg1 == 1)\n    return sub_4ad0a7c0(arg2, 1) __tailcall\n\nif (*arg2 == 0)\n    return sub_4ad01a28(arg2, 1, arg1) __tailcall\n\nif (*arg2 == 0x33)\n    return sub_4ad01a28(arg2, 1, arg1) __tailcall\n\nif (*arg2 == 0x3b)\n    return sub_4ad01a28(arg2, 1, arg1) __tailcall\n\nif (*arg2 == 0x3c)\n    return sub_4ad01a28(arg2, 1, arg1) __tailcall\n\nif (*arg2 == 0)\n    int32_t rax_16\n    int64_t rcx_13\n    int64_t rdx_10\n    int32_t* rbx_1\n    int64_t r8_9\n    rax_16, rcx_13, rdx_10, rbx_1, r8_9 = FindFixAndRun(arg2)\n    return sub_4ad01182(rcx_13, rdx_10, r8_9, rax_16, rbx_1) __tailcall\n\nint32_t rax_13\nint64_t rcx_9\nint64_t rdx_7\nint64_t r8_7\nrax_13, rcx_9, rdx_7, r8_7 = (&data_4ad37388)[sx.q(*arg2) * 4](arg2)\nreturn sub_4ad01182(rcx_9, rdx_7, r8_7, rax_13, arg2) __tailcall', 'decompiled_function_name': 'Dispatch', 'decompiled_function_prototype': 'int64_t Dispatch(int32_t arg1, int32_t* arg2)', 'decompiled_function_address': 1255149772, 'function_type': 'USER', 'functions_caller': ['result, rcx = Dispatch(0, *(arg1 + 0x70))', 'Dispatch(0, *(arg2 + 0x78))', 'return Dispatch(0, rdx_1)', 'int32_t rax_15 = Dispatch(0, rax_14)', 'Dispatch(0, rax_19)', 'int32_t rax_4 = Dispatch(1, rsi)', 'int32_t rax_8 = Dispatch(1, rbp)', 'Dispatch(0, arg1)', 'int32_t result = Dispatch(0, *(arg1 + 0x70))', 'return Dispatch(0, rdx_1