joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a51b0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 1
mov rbx, rcx
xor ecx, ecx
call sub.msys_2.0.dll_fcntl
cmp eax, 0xffffffff
je 0x1004a52a0
xor edi, edi
mov edx, 1
mov ecx, 1
call sub.msys_2.0.dll_fcntl
cmp eax, 0xffffffff
je 0x1004a5270
xor ebp, ebp
mov edx, 1
mov ecx, 2
call sub.msys_2.0.dll_fcntl
cmp eax, 0xffffffff
je 0x1004a52d0
call sub.msys_2.0.dll___getreent
cmp ebp, 2
mov r12, qword [rax + 0x18]
sete al
cmp edi, 2
sete dl
or eax, edx
mov esi, eax
test r12, r12
je 0x1004a5260
cmp edi, 1
je 0x1004a5360
cmp ebp, 1
je 0x1004a5338
test sil, sil
je 0x1004a5265
mov r8, rbx
lea rdx, str._s:_fatal:_unable_to_reopen_standard_input__output__or_error_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov ecx, 3
call sub.msys_2.0.dll_exit
nop word [rax + rax]
test sil, sil
jne 0x1004a524d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x1004a51ec
mov edx, 1
lea rcx, [0x1004f1843]
xor ebp, ebp
call fcn.1004bd070
cmp eax, 1
setne bpl
add ebp, 1
jmp 0x1004a51ee
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x1004a51d2
xor edx, edx
lea rcx, [0x1004f1843]
mov edi, 1
call fcn.1004bd070
cmp eax, 1
sbb edi, 0xffffffff
jmp 0x1004a51d4
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x1004a5206
mov edx, 1
lea rcx, [0x1004f1843]
call fcn.1004bd070
cmp eax, 2
je 0x1004a5398
test ebp, ebp
jne 0x1004a524d
call sub.msys_2.0.dll___getreent
mov r12, qword [rax + 0x10]
test r12, r12
je 0x1004a524d
cmp edi, 1
jne 0x1004a523b
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_input_reopened_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
jmp 0x1004a523b
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_output_reopened_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
test sil, sil
jne 0x1004a523b
jmp 0x1004a5265
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_input_reopened_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_output_reopened_n
mov rcx, r12
cmp ebp, 1
jne 0x1004a5400
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msys_2.0.dll_fprintf
cmp ebp, 2
sete al
cmp edi, 2
sete dl
or eax, edx
mov esi, eax
test ebp, ebp
jne 0x1004a5260
call sub.msys_2.0.dll___getreent
mov rbp, qword [rax + 0x10]
test rbp, rbp
je 0x1004a5260
mov r8, rbx
cmp edi, 1
je 0x1004a540e
lea rdx, str._s:_WARNING:_standard_error_reopened_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
cmp edi, 2
jne 0x1004a5265
mov r8, rbx
lea rdx, str._s:_fatal:_unable_to_reopen_standard_input__output__or_error_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
jmp 0x1004a524d
cmp ebp, 2
jne 0x1004a5265
jmp 0x1004a523b
lea rdx, str._s:_WARNING:_standard_input_reopened_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_error_reopened_n
mov rcx, rbp
jmp 0x1004a5384

Function at 0x1004a5460
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1004a5488
lea rdx, [0x1004f1843]
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004a5488
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1004bd1c0
Function at 0x1004a54a0
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, rdx
mov rbx, r8
test r8, r8
je 0x1004a5578
mov edx, dword [r8]
test edx, edx
jne 0x1004a5558
mov rdx, rdi
mov rcx, rsi
call sub.msys_2.0.dll_rename
test eax, eax
jne 0x1004a54e8
xor ebp, ebp
mov eax, ebp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msys_gpg_error_0.dll_gpg_err_code_from_syserror
mov rdx, qword [0x1004f72f0]
mov ebp, dword [rdx]
test eax, eax
je 0x1004a54d4
shl ebp, 0x18
movzx eax, ax
and ebp, 0x7f000000
or ebp, eax
mov eax, dword [rbx]
test eax, eax
je 0x1004a55b0
test ebp, ebp
je 0x1004a54d4
call fcn.1004b32e0
mov dword [rbx], 0
mov ecx, ebp
call sub.msys_gpg_error_0.dll_gpg_strerror
lea rcx, str.renaming__s_to__s_failed:__s_n
mov rbx, rax
call sub.msys_intl_8.dll_libintl_gettext
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.msys_gpg_error_0.dll_gpgrt_log_error
mov eax, ebp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.1004b3290
mov rdx, rdi
mov rcx, rsi
call sub.msys_2.0.dll_rename
test eax, eax
je 0x1004a54d4
jmp 0x1004a54e8
call sub.msys_2.0.dll_rename
test eax, eax
je 0x1004a54d4
call sub.msys_gpg_error_0.dll_gpg_err_code_from_syserror
mov rdx, qword [0x1004f72f0]
mov ebp, dword [rdx]
test eax, eax
je 0x1004a54d4
shl ebp, 0x18
movzx eax, ax
and ebp, 0x7f000000
or ebp, eax
nop dword [rax]
test ebp, ebp
jne 0x1004a5521
jmp 0x1004a54d4
Function at 0x1004a5b00
Capabilities:
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xb0
mov rdi, rcx
xor ecx, ecx
mov esi, edx
call sub.msys_gpg_error_0.dll_gpg_err_set_errno
lea rdx, [rsp + 0x28]
mov r8d, 0xa
mov rcx, rdi
call sub.msys_2.0.dll_strtoul
mov rbx, rax
call sub.msys_2.0.dll___errno
mov eax, dword [rax]
test eax, eax
jne 0x1004a5b4a
mov rax, qword [rsp + 0x28]
cmp rax, rdi
je 0x1004a5b4a
cmp byte [rax], 0
je 0x1004a5c50
mov rcx, rdi
call sub.msys_2.0.dll_getpwnam
mov rbx, rax
test rbx, rbx
je 0x1004a5c20
mov rcx, qword [rbx + 0x28]
lea rdx, [rsp + 0x30]
call fcn.1004bd2b0
test eax, eax
je 0x1004a5c08
mov rdx, qword [rbx]
mov r8d, esi
lea rcx, str.USER
call fcn.1004a4f20
mov rdx, qword [rbx]
mov r8d, esi
lea rcx, str.LOGNAME
call fcn.1004a4f20
call sub.msys_2.0.dll_getuid
cmp eax, dword [rbx + 0x10]
je 0x1004a5bf6
lea rcx, str.PATH
mov r8d, esi
lea rdx, str._usr_local_bin:_usr_bin:_bin
call fcn.1004a4f20
lea rdi, [0x1004f19c7]
mov rcx, rdi
call sub.msys_2.0.dll_unsetenv
test eax, eax
je 0x1004a5bd3
test esi, esi
je 0x1004a5c60
mov edx, dword [rbx + 0x14]
mov rcx, qword [rbx]
call sub.msys_2.0.dll_initgroups
test eax, eax
jne 0x1004a5cd0
mov ecx, dword [rbx + 0x10]
call sub.msys_2.0.dll_setuid
test eax, eax
jne 0x1004a5c88
xor edi, edi
mov eax, edi
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
ret
mov rdx, qword [rbx + 0x28]
mov r8d, esi
lea rcx, str.HOME
call fcn.1004a4f20
jmp 0x1004a5b74
test esi, esi
je 0x1004a5d20
mov rax, qword [0x1004f72f0]
mov edi, dword [rax]
shl edi, 0x18
and edi, 0x7f000000
or edi, 0x1b
mov eax, edi
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
ret
mov ecx, ebx
call sub.msys_2.0.dll_getpwuid
mov rbx, rax
jmp 0x1004a5b55
call sub.msys_gpg_error_0.dll_gpg_err_code_from_syserror
movzx ecx, ax
call sub.msys_gpg_error_0.dll_gpg_strerror
mov rdx, rdi
lea rcx, str.error_unsetting_envvar__s:__s_n
mov r8, rax
call sub.msys_gpg_error_0.dll_gpgrt_log_info
jmp 0x1004a5bd3
call sub.msys_gpg_error_0.dll_gpg_err_code_from_syserror
mov edi, eax
mov rax, qword [0x1004f72f0]
mov eax, dword [rax]
test edi, edi
je 0x1004a5ca9
shl eax, 0x18
movzx edi, di
and eax, 0x7f000000
or edi, eax
mov ecx, edi
call sub.msys_gpg_error_0.dll_gpg_strerror
mov rdx, qword [rbx]
lea rcx, str.error_switching_to_user__s:__s_n
mov r8, rax
call sub.msys_gpg_error_0.dll_gpgrt_log_error
jmp 0x1004a5bf8
call sub.msys_gpg_error_0.dll_gpg_err_code_from_syserror
mov edi, eax
mov rax, qword [0x1004f72f0]
mov eax, dword [rax]
test edi, edi
je 0x1004a5cf1
shl eax, 0x18
movzx edi, di
and eax, 0x7f000000
or edi, eax
test esi, esi
jne 0x1004a5bf8
mov ecx, edi
call sub.msys_gpg_error_0.dll_gpg_strerror
mov rdx, qword [rbx]
lea rcx, str.error_setting_supplementary_groups_for__s:__s_n
mov r8, rax
call sub.msys_gpg_error_0.dll_gpgrt_log_error
jmp 0x1004a5bf8
mov rdx, rdi
lea rcx, str.user__s_not_found_n
call sub.msys_gpg_error_0.dll_gpgrt_log_error
jmp 0x1004a5c28
Function at 0x1004a67a0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, str.GNUPGHOME
lea rsi, str._.gnupg
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
je 0x1004a67c8
cmp byte [rax], 0
jne 0x1004a67d8
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rax
call fcn.1004a6720
test rax, rax
mov rsi, rax
cmove rsi, rbx
xor edx, edx
mov rcx, rsi
call fcn.10049ebf0
xor edx, edx
lea rcx, str._.gnupg
mov rbx, rax
call fcn.10049ebf0
mov rcx, rbx
mov rdi, rax
mov rdx, rax
call fcn.10049ec50
mov rcx, rdi
mov ebp, eax
call sub.msys_gcrypt_20.dll_gcry_free
mov rcx, rbx
call sub.msys_gcrypt_20.dll_gcry_free
test ebp, ebp
je 0x1004a67c8
mov rax, rsi
mov byte [0x1005078c0], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1004a8390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
cmp byte [rcx], 0
lea rdx, [rcx + 8]
jne 0x1004a83ab
jmp 0x1004a8410
mov rcx, rax
movzx eax, byte [rcx]
sub eax, 0x30
cmp al, 9
ja 0x1004a8420
lea rax, [rcx + 1]
cmp rax, rdx
jne 0x1004a83a8
xor eax, eax
cmp byte [rcx + 1], 0x54
jne 0x1004a8410
lea rdx, [rcx + 2]
add rcx, 8
jmp 0x1004a83d3
mov rdx, rbx
movzx eax, byte [rdx]
sub eax, 0x30
cmp al, 9
ja 0x1004a8420
lea rbx, [rdx + 1]
cmp rbx, rcx
jne 0x1004a83d0
movzx ecx, byte [rcx]
cmp cl, 0x5a
jne 0x1004a83f6
movzx ecx, byte [rdx + 2]
lea rbx, [rdx + 2]
test cl, cl
je 0x1004a843b
jns 0x1004a8428
cmp cl, 0x2c
setne al
cmp cl, 0x3a
setne dl
and eax, edx
xor eax, 1
movzx eax, al
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
call sub.msys_2.0.dll___locale_ctype_ptr
movsx rdx, byte [rbx]
mov rcx, rdx
test byte [rdx + rax + 1], 8
je 0x1004a83fc
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1004ac610
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
test rcx, rcx
jne 0x1004ac63c
jmp 0x1004ac7b0
add rbx, 1
movzx eax, byte [rbx]
cmp al, 0x20
je 0x1004ac638
cmp al, 9
je 0x1004ac638
cmp byte [rbx], 0x3f
je 0x1004ac6c0
lea rdx, [0x1004f2bf9]
mov rcx, rbx
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004ac6e0
lea rcx, str.available_compatibility_flags:_n
call sub.msys_gpg_error_0.dll_gpgrt_log_info
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x1004ac6a0
lea rbx, [rsi + 0x18]
lea rbp, str.__s_n
nop dword [rax + rax]
mov rsi, rbx
mov rcx, rbp
add rbx, 0x18
call sub.msys_gpg_error_0.dll_gpgrt_log_info
mov rdx, qword [rbx - 0x10]
test rdx, rdx
jne 0x1004ac688
xor r12d, r12d
cmp dword [rsi], 0x4d
jne 0x1004ac6d0
or dword [rdi], r12d
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rbx + 1], 0
je 0x1004ac663
jmp 0x1004ac64c
xor ecx, ecx
call sub.msys_2.0.dll_exit
nop word [rax + rax]
lea rdx, [0x1004f2c1f]
mov rcx, rbx
call fcn.10049f460
mov r13, rax
test rax, rax
je 0x1004ac853
mov r15, qword [rax]
test r15, r15
je 0x1004ac84b
lea rbp, [rax + 8]
xor r12d, r12d
lea r14, [0x1004f2c21]
jmp 0x1004ac72d
mov r15, qword [rbp]
add rbp, 8
test r15, r15
je 0x1004ac778
cmp byte [r15], 0
je 0x1004ac720
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x1004ac790
mov rbx, rsi
jmp 0x1004ac755
mov rdx, qword [rbx + 0x20]
add rbx, 0x18
test rdx, rdx
je 0x1004ac790
mov rcx, r15
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004ac748
mov eax, dword [rbx]
mov r15, qword [rbp]
add rbp, 8
or r12, rax
test r15, r15
jne 0x1004ac72d
nop dword [rax + rax]
mov rcx, r13
call sub.msys_gcrypt_20.dll_gcry_free
or dword [rdi], r12d
jmp 0x1004ac6ab
mov rdx, r14
mov rcx, r15
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004ac818
mov dword [rdi], 0
xor r12d, r12d
jmp 0x1004ac720
test rdx, rdx
je 0x1004ac6ab
lea rcx, str.enabled_compatibility_flags:
lea rbx, [0x1004f2bf5]
call sub.msys_gpg_error_0.dll_gpgrt_log_info
mov rdx, qword [rsi + 8]
test rdx, rdx
jne 0x1004ac7ed
jmp 0x1004ac800
mov rdx, qword [rsi + 0x20]
add rsi, 0x18
test rdx, rdx
je 0x1004ac800
mov eax, dword [rdi]
and eax, dword [rsi]
je 0x1004ac7e0
mov rcx, rbx
call sub.msys_gpg_error_0.dll_gpgrt_log_printf
jmp 0x1004ac7e0
lea rcx, [0x1004f2bf3]
call sub.msys_gpg_error_0.dll_gpgrt_log_printf
jmp 0x1004ac6ab
lea rdx, [0x1004f2c26]
mov rcx, r15
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004ac837
mov r12, 0xffffffffffffffff
jmp 0x1004ac720
mov rdx, r15
lea rcx, str.unknown_compatibility_flag__s_ignored_n
call sub.msys_gpg_error_0.dll_gpgrt_log_info
jmp 0x1004ac720
xor r12d, r12d
jmp 0x1004ac778
or eax, 0xffffffff
jmp 0x1004ac6ad
Function at 0x1004ae2c0
Capabilities:
Delete file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, rcx
test rcx, rcx
je 0x1004ae318
cmp dword [rcx], 2
je 0x1004ae330
mov rbx, rsi
lea rdi, [rsp + 0x38]
nop dword [rax]
mov qword [rsp + 0x38], 0
mov rax, qword [rbx + 0x70]
test rax, rax
je 0x1004ae30c
mov r8, qword [rbx + 0x90]
mov rcx, qword [rbx + 0x78]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edx, 6
call rax
mov rbx, qword [rbx + 0x90]
test rbx, rbx
jne 0x1004ae2e0
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
jmp fcn.1004ae120
mov rcx, qword [rcx + 0x88]
test rcx, rcx
je 0x1004ae350
cmp byte [rcx], 0
je 0x1004ae2d4
call fcn.1004bd1c0
jmp 0x1004ae2d4
mov rax, rsi
nop dword [rax + rax]
mov rdx, rax
mov rax, qword [rax + 0x90]
test rax, rax
jne 0x1004ae358
lea rax, [fcn.1004ad020]
cmp qword [rdx + 0x70], rax
jne 0x1004ae2d4
mov rax, qword [rdx + 0x78]
mov edx, dword [rax + 0x14]
test edx, edx
jne 0x1004ae2d4
cmp byte [rax + 0x3a], 0
je 0x1004ae2d4
lea rcx, [rax + 0x3a]
jmp 0x1004ae341

Function at 0x1004b0730
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
nop word [rax + rax]
mov rax, rcx
mov rcx, qword [rcx + 0x90]
test rcx, rcx
jne 0x1004b0740
lea rdx, [fcn.1004ad020]
cmp qword [rax + 0x70], rdx
je 0x1004b0770
xor eax, eax
add rsp, 0xa8
ret
mov rax, qword [rax + 0x78]
lea rdx, [rsp + 0x20]
mov ecx, dword [rax]
call sub.msys_2.0.dll_fstat
test eax, eax
jne 0x1004b0798
mov rax, qword [rsp + 0x48]
add rsp, 0xa8
ret
call sub.msys_2.0.dll___errno
mov ecx, dword [rax]
call sub.msys_2.0.dll_strerror
lea rcx, str.fstat___failed:__s_n
mov rdx, rax
call sub.msys_gpg_error_0.dll_gpgrt_log_error
jmp 0x1004b075c

Function at 0x1004b1080
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov edx, dword [0x100507ad0]
test edx, edx
je 0x1004b10d8
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x18]
mov qword [0x100507ae0], rcx
test rcx, rcx
je 0x1004b1144
mov rax, qword [0x100507a68]
test rax, rax
je 0x1004b10b6
call rax
lea rcx, [0x1004b0fa0]
call fcn.1004bd510
mov dword [0x100507ad8], 1
add rsp, 0x30
pop rbx
ret
mov eax, dword [0x100507a48]
test eax, eax
je 0x1004b1110
mov rcx, qword [0x100507a40]
test rcx, rcx
lea rax, str._dev_tty
lea rdx, [0x1004f3de1]
cmove rcx, rax
call sub.msys_2.0.dll_fopen
mov rcx, rax
jmp 0x1004b1098
lea rcx, [rsp + 0x20]
call sub.msys_2.0.dll_ctermid
mov rcx, qword [0x100507a40]
test rax, rax
je 0x1004b1138
mov rcx, rax
call sub.msys_2.0.dll_strdup
mov qword [0x100507a40], rax
mov rcx, rax
mov dword [0x100507a48], 1
jmp 0x1004b10e9
call sub.msys_2.0.dll___errno
mov ecx, dword [rax]
call sub.msys_2.0.dll_strerror
mov rbx, rax
call fcn.1004b1010
lea rcx, str.cannot_open__s:__s_n
mov r8, rbx
mov rdx, rax
call sub.msys_gpg_error_0.dll_gpgrt_log_error
mov ecx, 2
call sub.msys_2.0.dll_exit
nop
nop word cs:[rax + rax]
Function at 0x1004b1570
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov ecx, dword [0x100507acc]
mov rbx, rdx
mov rsi, r9
mov rdx, r8
test ecx, ecx
je 0x1004b1596
test rdi, rdi
je 0x1004b16cd
xor eax, eax
test rdx, rdx
jne 0x1004b15b1
jmp 0x1004b1734
add rax, 1
cmp rdx, rax
je 0x1004b1608
cmp byte [rbx + rax], 0
jns 0x1004b15a8
cmp rax, rdx
jae 0x1004b1608
mov rcx, rbx
xor r8d, r8d
call fcn.1004a0d00
mov rbx, rax
test rsi, rsi
je 0x1004b15e0
mov rcx, rax
call sub.msys_2.0.dll_strlen
cmp rsi, rax
jae 0x1004b15e0
mov byte [rbx + rsi], 0
mov rcx, rdi
mov r8, rbx
lea rdx, [0x1004f3e67]
call fcn.1004b14e0
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sub.msys_gcrypt_20.dll_gcry_free
test rsi, rsi
je 0x1004b1638
cmp rsi, rdx
jae 0x1004b1638
test ecx, ecx
je 0x1004b16d8
mov rdx, rsi
mov r8, rdx
mov rcx, rdi
mov rdx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.1004abde0
test ecx, ecx
jne 0x1004b161d
mov eax, dword [0x100507ad8]
test eax, eax
jne 0x1004b1726
test rdi, rdi
jne 0x1004b161d
mov qword [rsp + 0x28], rdx
call fcn.1004b1080
mov rdx, qword [rsp + 0x28]
mov rsi, rdx
add rsi, rbx
lea rdi, str.x_02x
jmp 0x1004b16a6
mov ecx, 0x5c
call sub.msys_2.0.dll_putc
movzx r8d, byte [rbx]
cmp r8b, 0xa
je 0x1004b1700
mov rcx, qword [0x100507ae0]
test r8b, r8b
jne 0x1004b16f0
mov rdx, rcx
mov ecx, 0x30
call sub.msys_2.0.dll_putc
add rbx, 1
cmp rsi, rbx
je 0x1004b16cd
call sub.msys_2.0.dll___locale_ctype_ptr
movzx edx, byte [rbx]
test byte [rdx + rax + 1], 0x20
mov rcx, rdx
mov rdx, qword [0x100507ae0]
jne 0x1004b1670
call sub.msys_2.0.dll_putc
add rbx, 1
cmp rsi, rbx
jne 0x1004b16a6
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov edx, dword [0x100507ad8]
test edx, edx
je 0x1004b1713
test rdi, rdi
je 0x1004b1661
jmp 0x1004b161a
mov rdx, rdi
call sub.msys_2.0.dll_fprintf
jmp 0x1004b169d
mov rdx, qword [0x100507ae0]
mov ecx, 0x6e
call sub.msys_2.0.dll_putc
jmp 0x1004b169d
test rdi, rdi
jne 0x1004b161a
call fcn.1004b1080
jmp 0x1004b1661
test rdi, rdi
je 0x1004b165e
jmp 0x1004b161d
test ecx, ecx
jne 0x1004b161d
mov ecx, dword [0x100507ad8]
test ecx, ecx
je 0x1004b1754
test rdi, rdi
je 0x1004b16cd
jmp 0x1004b161d
test rdi, rdi
jne 0x1004b161d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.1004b1080

Function at 0x1004b1770
Capabilities:
Terminate process

Disassembly:
xor r9d, r9d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
jmp fcn.1004b1570
Function at 0x1004b1900
Capabilities:
Terminate process

Disassembly:
mov edx, 1
jmp 0x1004b1230

Function at 0x1004b1d30
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
lea rcx, str.ASSUAN_DEBUG
mov rsi, rdx
call sub.msys_2.0.dll_getenv
mov rcx, rax
mov eax, pe_nt_image_headers64
test rcx, rcx
je 0x1004b1d5a
call sub.msys_2.0.dll_atoi
mov rdx, rbx
lea rcx, [0x1004b1c10]
mov dword [0x100507b08], eax
mov qword [0x100507b00], rsi
add rsp, 0x28
pop rbx
pop rsi
jmp 0x1004bc828
jmp qword [sym.imp.msys_assuan_0.dll_assuan_set_log_cb]

Function at 0x1004b3970
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r14, rcx
mov rdi, rdx
mov r12, r8
test r8, r8
je 0x1004b3993
mov dword [r8], 0
test r14, r14
je 0x1004b3a5b
test rdi, rdi
je 0x1004b3a5b
cmp byte [rdi], 0
je 0x1004b3a5b
mov rbp, qword [r14 + 8]
test rbp, rbp
je 0x1004b39e7
mov r13, qword [r14 + 0x10]
xor ebx, ebx
nop dword [rax]
mov rsi, qword [r13 + rbx*8]
test rsi, rsi
je 0x1004b39de
lea rcx, [rsi + 0xc]
mov rdx, rdi
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x1004b3a70
add rbx, 1
cmp rbx, rbp
jne 0x1004b39c0
mov rcx, rdi
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
je 0x1004b3ae0
cmp byte [rax], 0
je 0x1004b3aa0
mov rcx, rdi
call sub.msys_2.0.dll_strlen
mov r9, rbx
mov rdx, rdi
mov rcx, r14
mov dword [rsp + 0x20], 1
mov r8, rax
call fcn.1004b33b0
mov rbp, qword [r14 + 8]
test rbp, rbp
je 0x1004b3a5b
mov r13, qword [r14 + 0x10]
xor ebx, ebx
nop dword [rax]
mov rsi, qword [r13 + rbx*8]
test rsi, rsi
je 0x1004b3a52
lea rcx, [rsi + 0xc]
mov rdx, rdi
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x1004b3a70
add rbx, 1
cmp rbx, rbp
jne 0x1004b3a38
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test r12, r12
je 0x1004b3a84
mov eax, dword [rsi + 8]
test eax, eax
je 0x1004b3a84
mov dword [r12], 1
mov rax, qword [rsi]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, str.GPG_TTY
mov rcx, rdi
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004b3a04
xor ecx, ecx
call sub.msys_2.0.dll_ttyname
test rax, rax
je 0x1004b3a04
xor ecx, ecx
call sub.msys_2.0.dll_ttyname
mov rbx, rax
test rax, rax
jne 0x1004b3a04
jmp 0x1004b3a5b
lea rdx, str.GPG_TTY
mov rcx, rdi
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x1004b3a5b
xor ecx, ecx
call sub.msys_2.0.dll_ttyname
test rax, rax
jne 0x1004b3ac7
jmp 0x1004b3a5b
Function at 0x1004b9650
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.LC_ALL
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
je 0x1004b9690
cmp byte [rax], 0
je 0x1004b9690
cmp byte [rbx], 0x43
jne 0x1004b96d0
cmp byte [rbx + 1], 0
jne 0x1004b96d0
lea rbx, [0x1004f59a0]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rcx, str.LC_MESSAGES
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
je 0x1004b96a9
cmp byte [rax], 0
jne 0x1004b966e
lea rcx, str.LANG
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
je 0x1004b9679
cmp byte [rax], 0
je 0x1004b9679
cmp byte [rbx], 0x43
je 0x1004b9673
nop word [rax + rax]
lea rdx, str.POSIX
mov rcx, rbx
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x1004b9679
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140004430]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140004440]
mov dword [rax], 1
mov rax, qword [0x140004450]
mov dword [rax], 1
mov rax, qword [0x1400043e0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140004420]
mov dword [0x14000700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400044f0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400044d0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140004370]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001800
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]