joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065c00
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x14008cdcf]
lea r8, str.EnumLiteral
mov rcx, rax
call dbg.fprintf
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sym.fputc
cmp dword [rsi], 0
je 0x140065c7a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sym.fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140065c60
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140065c90
mov rcx, rdi
mov rdx, rsi
call sym.void__anonymous_namespace_::itanium_demangle::Node::visit_std::__1::reference_wrapper__anonymous_namespace_::DumpVisitor____std::__1::reference_wrapper__anonymous_namespace_::DumpVisitor___const
jmp 0x140065cb5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sym.fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sym.void__anonymous_namespace_::DumpVisitor::printWithComma_std::__1::basic_string_view_char__std::__1::char_traits_char______std::__1::basic_string_view_char__std::__1::char_traits_char____
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sym.fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140065d00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x14008cdcf]
lea r8, str.BracedExpr
mov rcx, rax
call dbg.fprintf
mov r14, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x20]
movzx ebx, byte [rbx + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sym.fputc
cmp dword [rsi], 0
je 0x140065d8b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sym.fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140065d70
mov byte [rsi + 4], 0
test r14, r14
je 0x140065da1
mov rcx, r14
mov rdx, rsi
call sym.void__anonymous_namespace_::itanium_demangle::Node::visit_std::__1::reference_wrapper__anonymous_namespace_::DumpVisitor____std::__1::reference_wrapper__anonymous_namespace_::DumpVisitor___const
jmp 0x140065dc6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sym.fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rdi
call sym.void__anonymous_namespace_::DumpVisitor::printWithComma__anonymous_namespace_::itanium_demangle::Node_const___anonymous_namespace_::itanium_demangle::Node_const_
mov rcx, rsi
mov edx, ebx
call sym.void__anonymous_namespace_::DumpVisitor::printWithComma_bool__bool_
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sym.fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140065e10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x14008cdcf]
lea r8, str.BracedRangeExpr
mov rcx, rax
call dbg.fprintf
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
mov rdi, qword [rdi + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sym.fputc
cmp dword [rsi], 0
je 0x140065e9b
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sym.fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140065e80
mov byte [rsi + 4], 0
test r14, r14
je 0x140065eb1
mov rcx, r14
mov rdx, rsi
call sym.void__anonymous_namespace_::itanium_demangle::Node::visit_std::__1::reference_wrapper__anonymous_namespace_::DumpVisitor____std::__1::reference_wrapper__anonymous_namespace_::DumpVisitor___const
jmp 0x140065ed6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sym.fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call sym.void__anonymous_namespace_::DumpVisitor::printWithComma__anonymous_namespace_::itanium_demangle::Node_const___anonymous_namespace_::itanium_demangle::Node_const_
mov rcx, rsi
mov rdx, rdi
call sym.void__anonymous_namespace_::DumpVisitor::printWithComma__anonymous_namespace_::itanium_demangle::Node_const___anonymous_namespace_::itanium_demangle::Node_const_
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sym.fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140080520
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
add rsp, 0x58
ret
Function at 0x140009fc4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140009db4
Function at 0x14000e914
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000e944
xor eax, eax
jmp 0x14000ea07
mov rbp, rbx
cmp word [rax], si
je 0x14000e969
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000e950
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000e94c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000e864
movsxd r14, eax
test eax, eax
jne 0x14000e9a7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000e93d
mov rcx, r14
call fcn.14000d034
mov rdi, rax
test rax, rax
jne 0x14000e9c0
xor ecx, ecx
call fcn.14000b9b8
jmp 0x14000e99c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000e864
test eax, eax
jne 0x14000e9f1
mov rcx, rdi
call fcn.14000b9b8
jmp 0x14000e9fb
xor ecx, ecx
call fcn.14000b9b8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140012074
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000c864
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400120fe
cmp byte [rbp - 0x21], r15b
je 0x1400120f9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140012134
call fcn.14000cc08
test eax, eax
jne 0x140012120
cmp byte [rbp - 0x21], r15b
je 0x140012118
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140012134
cmp byte [rbp - 0x21], r15b
je 0x140012131
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000c6e8
test eax, eax
jne 0x1400121d4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000c864
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140012173
cmp byte [rbp - 0x21], r15b
je 0x1400121a8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400121a8
call fcn.14000cc08
test eax, eax
jne 0x140012194
cmp byte [rbp - 0x21], r15b
je 0x14001218d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400121a8
cmp byte [rbp - 0x21], r15b
je 0x1400121a5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000c6e8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400121d4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400121d7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400121e5
mov rcx, rdi
call fcn.14000b9b8
cmp byte [rbp + 0x3f], r15b
je 0x1400121f4
mov rcx, qword [rbp + 0x27]
call fcn.14000b9b8
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000631c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140010960], rbx
je 0x140006383
cmp rax, rbx
jne 0x140006376
mov ebx, 1
mov esi, ebx
jmp 0x140006388
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000635b
mov ebx, 1
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x1400063a0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000640c
mov eax, dword [0x140010968]
test eax, eax
jne 0x140006401
mov dword [0x140010968], ebx
lea r15, [0x1400089c8]
lea rdi, [0x1400089b0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400063f3
test eax, eax
jne 0x1400063f7
cmp qword [rdi], r14
je 0x1400063e8
mov rax, qword [rdi]
mov rcx, qword [0x140008930]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400063ca
test eax, eax
je 0x140006407
mov eax, 0xff
jmp 0x140006562
mov dword [0x14000e3e4], ebx
mov edi, 0x1f
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x140006433
lea rdx, [0x1400089a8]
lea rcx, [0x140008938]
call sub.msvcrt.dll__initterm
mov dword [0x140010968], 2
test esi, esi
jne 0x140006441
mov rax, r14
xchg qword [0x140010960], rax
cmp qword [0x140010970], r14
je 0x140006474
lea rcx, [0x140010970]
call fcn.140006730
test eax, eax
je 0x140006474
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140010970]
mov r9, qword [0x140008930]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000648d
mov eax, 0xff
jmp 0x140006562
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140006513
test ax, ax
je 0x1400064a8
test edx, edx
jne 0x140006513
sub ax, bx
cmp ax, di
ja 0x1400064be
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400064a8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001394
mov dword [0x14000e3e0], eax
cmp dword [0x14000e400], r14d
jne 0x1400064fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000e3e4], r14d
jne 0x140006511
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000e3e0]
jmp 0x140006562
cmp ax, 0x22
jne 0x140006527
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140006496
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140197000
add rsp, 0x28
jmp 0x14000631c
Function at 0x140029a2c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d034
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d034
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029b7c
cmp rax, 0xffffffffffffffff
je 0x140029b7c
xor edi, edi
test rbp, rbp
jle 0x140029b27
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f948
mov rbx, rax
test rax, rax
jne 0x140029ab4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029b1d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a99c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001dd10
cmp eax, 0xffffffff
je 0x140029afd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029ac4
mov edx, r15d
mov ecx, r14d
call fcn.14001a99c
jmp 0x140029b1d
cmp byte [rsi + 0x38], dil
je 0x140029b14
cmp dword [rsi + 0x34], 5
jne 0x140029b14
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029b1d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b700
jmp 0x140029b90
jns 0x140029b90
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d034
cmp rax, 0xffffffffffffffff
jne 0x140029b48
cmp byte [rsi + 0x30], dil
je 0x140029b90
mov edi, dword [rsi + 0x2c]
jmp 0x140029b90
mov ecx, r14d
call fcn.140018e54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029b90
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029b89
mov eax, dword [rsi + 0x2c]
jmp 0x140029b8e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d034
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ac80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002aca8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002aca8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1004010e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea r9, str._______________Q_msgkey____M_shmkey____S_semkey__...
lea r8, str.usage:_ipcrm___q_msqid____m_shmid____s_semid_
lea rdx, str._s_n_s_n
call sub.cygwin1.dll_fprintf
mov ecx, 1
call sub.cygwin1.dll_exit
nop
nop word cs:[rax + rax]
Function at 0x14012e942
Capabilities:
Write file on windows

Disassembly:
jmp 0x140323f80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140527702]
call fcn.1401347d9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140323fd7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1403240e3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14032407c
cmp qword [rbp + 0x28], 0
jle 0x14032407c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14032401c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140134153
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x1403240d2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1403240d2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14012ee15
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140382060
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1404edd40]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x140503fc8], 0
je 0x1403820bb
mov eax, 1
jmp 0x14038223b
mov dword [rsp + 0x20], 0
jmp 0x1403820cf
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x140382101
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140503fc8], rax
cmp qword [0x140503fc8], 0
je 0x1403820ff
jmp 0x140382101
jmp 0x1403820c5
cmp qword [0x140503fc8], 0
jne 0x140382123
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.1401317dc
xor eax, eax
jmp 0x14038223b
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x140503fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140503fd0], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x140503fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140503fd8], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x140503fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140503fe0], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x140503fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140503fe8], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x140503fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140503ff0], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x140503fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140503ff8], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x140503fc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140504000], rax
cmp qword [0x140503fd0], 0
je 0x14038221c
cmp qword [0x140503fe0], 0
je 0x14038221c
cmp qword [0x140503fe8], 0
je 0x14038221c
cmp qword [0x140503ff0], 0
je 0x14038221c
cmp qword [0x140503ff8], 0
je 0x14038221c
cmp qword [0x140504000], 0
jne 0x140382236
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.1401317dc
call fcn.14012ed6b
xor eax, eax
jmp 0x14038223b
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140428cd0]
call fcn.1401335c3
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401311e7
add rsp, 0x70
pop rdi
ret
Function at 0x14012f428
Capabilities:
Create thread

Disassembly:
jmp 0x140291ca0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1404edd40]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14052772b]
call fcn.1401347d9
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14012fe0a
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.14013134f
nop
lea rax, [0x140132380]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140132547
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x140291d7a
lea rcx, [rbp + 8]
call fcn.140130c42
jmp 0x140291d93
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14012f644
nop
lea rcx, [rbp + 8]
call fcn.140130a8a
lea rcx, [rbp - 0x30]
lea rdx, [0x1403f8be0]
call fcn.1401335c3
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1401311e7
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x14012f54a
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1402e22e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x1404edd40]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1405276d5]
call fcn.1401347d9
xor edx, edx
mov ecx, 2
call fcn.1401310ed
mov qword [rbp + 8], rax
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x238
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1402e235b
xor eax, eax
jmp 0x1402e23bb
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140131ed5
test eax, eax
jne 0x1402e2370
xor eax, eax
jmp 0x1402e23bb
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140133898
test eax, eax
je 0x1402e23af
mov rcx, qword [rbp + 0x420]
call fcn.140130314
mov rdx, rax
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1402e23ad
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x38]
jmp 0x1402e23bb
jmp 0x1402e2370
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1403ef210]
call fcn.1401335c3
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1401311e7
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret