joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401bba70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140628520]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1401bbb05
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1401bbb66
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140196890
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401cfb20
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1401bbc21
sub ecx, 1
je 0x1401bbc94
sub ecx, 1
je 0x1401bbbd0
cmp ecx, 1
je 0x1401bbbb3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14040bb00]
call fcn.140196890
jmp 0x1401bbc94
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1401bb7a0
test eax, eax
je 0x1401bbc94
jmp 0x1401bbb3a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1401bbc94
sub rax, rsi
cmp rax, rbp
jae 0x1401bbc94
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.140196a10
jmp 0x1401bbc94
cmp r8d, 4
jle 0x1401bbc94
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1401bbc94
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1401967b0
mov esi, eax
test eax, eax
je 0x1401bbc73
mov edx, 5
mov rcx, rbx
call fcn.1401bc760
mov eax, esi
jmp 0x1401bbb3a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1401a49c0
mov rcx, r14
call fcn.1401a4ca0
test eax, eax
je 0x1401bbb38
mov edx, 5
mov rcx, rbx
call fcn.1401bc760
mov eax, Ordinal_46
jmp 0x1401bbb3a
Function at 0x1401cea30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1401cea72
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1401ceab9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1401ceb12
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1401cead0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1401ceb53
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14041127a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14041127b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1401ceb20
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1401d01e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401d022e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401d022e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401d022e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401d022e
cmp dword [rcx + 0x84], 0xe
jbe 0x1401d022e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401d0230
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4d8fa0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d99a2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4d9a3a
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4d9a1e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9a12
cmp qword [rbp - 0x10], 0
je 0x2fc4d9a12
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d99d8
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d9a3b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9b40
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d9b68
mov eax, 0
jmp 0x2fc4d9bb6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d9b91
mov eax, 0
jmp 0x2fc4d9bb6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d9bb1
mov eax, 0
jmp 0x2fc4d9bb6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9bbc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d9c3a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9c31
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9c31
mov rax, qword [rbp - 8]
jmp 0x2fc4d9c4f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9c04
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4da370
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dad72
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ff108]
test eax, eax
je 0x2fc4dae0a
lea rax, [0x2fc4ff0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ff110]
mov qword [rbp - 8], rax
jmp 0x2fc4dadee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dade2
cmp qword [rbp - 0x10], 0
je 0x2fc4dade2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dada8
lea rax, [0x2fc4ff0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dae0b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4daf10
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4daf38
mov eax, 0
jmp 0x2fc4daf86
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4daf61
mov eax, 0
jmp 0x2fc4daf86
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4daf81
mov eax, 0
jmp 0x2fc4daf86
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4daf8c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4db00a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4db001
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4db001
mov rax, qword [rbp - 8]
jmp 0x2fc4db01f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dafd4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x4030c0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov ecx, 0x2000
mov rbx, rdx
call fcn.00482890
xor edx, edx
mov rcx, rsi
mov rdi, rax
call sub.msvcrt.dll__open_1
xor edx, edx
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll__open_1
test esi, esi
mov ebp, eax
js 0x4031c0
test eax, eax
js 0x4031c0
lea rdx, [rsp + 0x30]
mov ecx, esi
mov rbx, qword [sym.imp.msvcrt.dll__fstat64]
call rbx
test eax, eax
js 0x4031c0
lea rdx, [rsp + 0x70]
mov ecx, ebp
call rbx
test eax, eax
js 0x4031c0
mov rbx, qword [rsp + 0x88]
cmp qword [rsp + 0x48], rbx
jne 0x4031c0
lea rax, [rdi + 0x1000]
test rbx, rbx
mov r13d, 0x1000
mov qword [rsp + 0x28], rax
jne 0x40318d
jmp 0x4031f0
mov r14, qword [rsp + 0x28]
mov ecx, ebp
mov rdx, r14
call sub.msvcrt.dll__read_1
cmp eax, r15d
jne 0x4031c0
mov r8, r12
mov rdx, r14
mov rcx, rdi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4031c0
sub rbx, r12
je 0x4031f0
cmp ebx, 0x1000
mov r14d, r13d
mov r12d, 0x1000
cmovle r14d, ebx
mov rdx, rdi
mov ecx, esi
cmovle r12, rbx
mov r8d, r14d
mov r15d, r14d
call sub.msvcrt.dll__read_1
cmp eax, r14d
mov r8d, eax
je 0x403162
nop dword [rax]
mov rcx, rdi
call fcn.0049a918
mov ecx, esi
call sub.msvcrt.dll__close_1
mov ecx, ebp
call sub.msvcrt.dll__close_1
xor eax, eax
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
call fcn.0049a918
mov ecx, esi
call sub.msvcrt.dll__close_1
mov ecx, ebp
call sub.msvcrt.dll__close_1
mov eax, 1
jmp 0x4031d8

Function at 0x405290
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
mov rsi, rdx
call sub.msvcrt.dll_getenv
cmp byte [rdi + 1], 0
mov rbx, rax
jne 0x4052c0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [fcn.0049ab10]
mov r9, rbx
mov r8, rsi
lea rdx, str.env_manager::getenv___s______s_n
mov rcx, rax
call fcn.0049af80
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x4053b0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [rcx + 1], 0
mov r12, rcx
mov rsi, rdx
jne 0x4054c0
mov rax, qword [0x005cfdf0]
mov eax, dword [rax + 0xed0]
test eax, eax
jne 0x4054e2
cmp byte [r12], 0
je 0x40547a
mov edx, 0x3d
mov rcx, rsi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x49f172
sub rax, rsi
mov rcx, rsi
mov rdx, rax
call fcn.00482a40
mov rcx, rax
mov rdi, rax
call sub.msvcrt.dll_getenv
cmp byte [r12 + 1], 0
mov rbx, rax
jne 0x405492
xor ebp, ebp
test rbx, rbx
je 0x40543c
mov rcx, rbx
call fcn.004829c0
mov rbp, rax
mov r13, qword [r12 + 8]
test r13, r13
je 0x4055f2
mov eax, dword [r13]
mov ebx, dword [r13 + 4]
and eax, 0x7fffffff
lea r14d, [rbx + 1]
cmp eax, ebx
mov edx, r14d
je 0x405504
shl rbx, 4
mov dword [r13 + 4], edx
lea rax, [r13 + rbx + 8]
mov qword [rax], rdi
mov qword [rax + 8], rbp
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x49a9f8
mov ecx, 2
xor ebp, ebp
call qword [fcn.0049ab10]
lea rdx, str.saving_old_value:__s_n
mov r8, rbx
mov rcx, rax
call fcn.0049af80
test rbx, rbx
jne 0x405431
jmp 0x40543c
mov ecx, 2
call qword [fcn.0049ab10]
lea rdx, str.env_manager::xput___s__n
mov r8, rsi
mov rcx, rax
call fcn.0049af80
jmp 0x4053d0
mov ecx, 2
call qword [fcn.0049ab10]
lea rdx, [0x004a258c]
mov r8, rsi
mov rcx, rax
call fcn.00426ce0
jmp 0x4053e5
cmp byte [r13 + 3], 0
js 0x405570
mov ecx, ebx
call fcn.00422ee0
mov rcx, qword [r12 + 8]
mov edx, eax
shl rdx, 4
add rdx, 8
test rcx, rcx
je 0x405614
mov ebx, dword [rcx + 4]
and eax, 0x7fffffff
mov r14d, eax
call fcn.00482910
mov r13, rax
mov qword [r12 + 8], rax
mov eax, dword [rax]
mov dword [r13 + 4], ebx
and eax, 0x80000000
or eax, r14d
mov dword [r13], eax
shr eax, 0x18
and eax, 0x7f
mov byte [r13 + 3], al
lea edx, [rbx + 1]
jmp 0x405466
cmp r14d, 4
mov r15d, 4
mov qword [r12 + 8], 0
cmovae r15d, r14d
xor ecx, ecx
mov edx, r15d
and r15d, 0x7fffffff
shl rdx, 4
add rdx, 8
call fcn.00482910
mov edx, dword [rax]
mov qword [r12 + 8], rax
and edx, 0x80000000
or r15d, edx
mov dword [rax], r15d
and qword [rax], 0x7fffffff
test ebx, ebx
je 0x4055e4
lea ecx, [rbx - 1]
mov edx, 8
shl rcx, 4
add rcx, 0x18
nop
movdqu xmm0, xmmword [r13 + rdx]
movups xmmword [rax + rdx], xmm0
add rdx, 0x10
cmp rcx, rdx
jne 0x4055d0
mov dword [rax + 4], ebx
mov edx, r14d
mov r13, rax
jmp 0x405466
mov edx, 0x48
xor ecx, ecx
xor ebx, ebx
call fcn.00482910
mov qword [r12 + 8], rax
mov r13, rax
mov qword [rax], 4
jmp 0x40555e
and eax, 0x7fffffff
xor ebx, ebx
mov r14d, eax
jmp 0x405535
jmp qword [sym.imp.msvcrt.dll__putenv]
Function at 0x4078f0
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [0x005cfae0]
xor r8d, r8d
lea r9, [0x004314c0]
lea rcx, [0x005de2e0]
mov rdi, rdx
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.0047ff60
mov rax, qword [0x005de2f8]
mov rdx, qword [0x005de300]
sub rdx, rax
cmp rdx, 0xb
jbe 0x407a00
movabs rsi, 0x5f5443454c4c4f43
mov dword [rax + 8], 0x3d434347
mov rcx, rdi
mov qword [rax], rsi
mov rax, qword [0x005de2f8]
lea rsi, [rax + 0xc]
mov qword [0x005de2f8], rsi
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov rax, qword [0x005de300]
sub rax, rsi
cmp rbx, rax
ja 0x407a20
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x005de2f8]
mov rdx, qword [0x005de2f0]
cmp rbx, rdx
je 0x407a40
mov rcx, qword [0x005de310]
mov r8, qword [0x005de2e8]
lea rax, [rbx + rcx]
not rcx
and rax, rcx
mov rcx, qword [0x005de300]
mov r9, rax
mov qword [0x005de2f8], rax
sub r9, r8
mov rdi, rcx
sub rdi, r8
cmp r9, rdi
jbe 0x4079e4
mov qword [0x005de2f8], rcx
mov rax, rcx
lea rcx, [0x005de400]
mov qword [0x005de2f0], rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.004053b0
lea rcx, [0x005de2e0]
mov edx, 0xc
call fcn.0047ffa0
mov rax, qword [0x005de2f8]
jmp 0x407939
lea rcx, [0x005de2e0]
mov rdx, rbx
call fcn.0047ffa0
mov rsi, qword [0x005de2f8]
jmp 0x40797e
or byte [0x005de330], 2
jmp 0x4079a3

Function at 0x407a50
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov eax, dword [0x005de1b0]
test eax, eax
je 0x407a70
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rdx, [0x004a29bf]
xor r9d, r9d
mov r8d, 1
lea rcx, [0x004a18c0]
call fcn.00403930
test rax, rax
je 0x407a61
mov rcx, rax
call fcn.004015e0
xor edx, edx
xor r8d, r8d
mov qword [0x004a1958], rax
mov rax, qword [0x005cfae0]
lea r9, [0x004314c0]
lea rcx, [0x005de2e0]
mov qword [rsp + 0x20], rax
call fcn.0047ff60
mov rax, qword [0x005de2f8]
mov rdx, qword [0x005de300]
sub rdx, rax
cmp rdx, 0x13
jbe 0x407be2
movabs rsi, 0x5f5443454c4c4f43
mov dword [rax + 0x10], 0x3d524550
mov qword [rax], rsi
mov rdi, qword [0x004a1958]
movabs rsi, 0x504152575f4f544c
mov qword [rax + 8], rsi
mov rax, qword [0x005de2f8]
mov rcx, rdi
lea rsi, [rax + 0x14]
mov qword [0x005de2f8], rsi
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov rax, qword [0x005de300]
sub rax, rsi
cmp rbx, rax
ja 0x407bc0
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x005de2f8]
mov rdx, qword [0x005de2f0]
cmp rbx, rdx
je 0x407c00
mov rcx, qword [0x005de310]
mov r8, qword [0x005de2e8]
lea rax, [rbx + rcx]
not rcx
and rax, rcx
mov rcx, qword [0x005de300]
mov r9, rax
mov qword [0x005de2f8], rax
sub r9, r8
mov rdi, rcx
sub rdi, r8
cmp r9, rdi
jbe 0x407b9f
mov qword [0x005de2f8], rcx
mov rax, rcx
lea rcx, [0x005de400]
mov qword [0x005de2f0], rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.004053b0
lea rcx, [0x005de2e0]
mov rdx, rbx
call fcn.0047ffa0
mov rdi, qword [0x004a1958]
mov rsi, qword [0x005de2f8]
jmp 0x407b39
lea rcx, [0x005de2e0]
mov edx, 0x14
call fcn.0047ffa0
mov rax, qword [0x005de2f8]
jmp 0x407adf
or byte [0x005de330], 2
jmp 0x407b5e
Function at 0x413400
Capabilities:
Query environment variable

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
movzx r13d, byte [rcx]
cmp r13b, 0x24
mov rsi, rcx
je 0x41342b
cmp r13b, 0x40
jne 0x413549
lea rdi, str.C:_msys64_mingw64
movzx eax, byte [rsi + 1]
lea rdx, [rsi + 1]
test al, al
sete r8b
cmp al, 0x2f
sete cl
or r8b, cl
jne 0x413560
cmp al, 0x5c
je 0x413560
lea rax, [rsi + 2]
mov ebx, 1
jmp 0x413469
cmp cl, 0x5c
je 0x41348c
mov rbx, r11
movzx ecx, byte [rax]
lea r11, [rbx + 1]
mov r12, rax
add rax, 1
mov r8d, ebx
cmp cl, 0x2f
sete r10b
test cl, cl
sete r9b
or r10b, r9b
je 0x413461
lea eax, [r8 + 1]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0048deb0
sub rsp, rax
mov r8, rbx
lea r9, [rsp + 0x20]
mov rcx, r9
call sub.msvcrt.dll_memcpy
cmp r13b, 0x40
mov byte [rax + rbx], 0
je 0x413500
mov rcx, rax
call sub.msvcrt.dll_getenv
test rax, rax
mov rbx, rax
je 0x413544
xor r8d, r8d
mov rcx, rbx
mov rdx, r12
call fcn.0047df30
mov rcx, rsi
mov rbx, rax
call fcn.0049a918
movzx r13d, byte [rbx]
cmp r13b, 0x40
je 0x4134f5
cmp r13b, 0x24
jne 0x41354c
mov rsi, rbx
jmp 0x413432
lea rdx, str._ROOT
xor r8d, r8d
mov rcx, rax
call fcn.0047df30
mov rcx, rax
mov r13, rax
call sub.msvcrt.dll_getenv
test rax, rax
mov rbx, rax
je 0x413530
mov rcx, r13
call fcn.0049a918
jmp 0x4134cc
mov rbx, qword [str.C:_msys64_mingw64]
mov rcx, r13
call fcn.0049a918
test rbx, rbx
jne 0x4134cc
mov rbx, rdi
jmp 0x4134cc
mov rbx, rcx
mov rax, rbx
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov r12, rdx
mov eax, 1
xor ebx, ebx
jmp 0x413492
Function at 0x4264a0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.COLUMNS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x4264d0
mov rcx, rax
call fcn.0049a990
test eax, eax
jle 0x4264d0
add rsp, 0x28
ret
mov eax, 0x7fffffff
add rsp, 0x28
ret
Function at 0x4282e0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.GCC_COLORS
call sub.msvcrt.dll_getenv
test rax, rax
mov rbp, rax
je 0x428454
movzx r14d, byte [rax]
xor eax, eax
test r14b, r14b
je 0x428459
mov rdi, rbp
xor r13d, r13d
xor esi, esi
xor r12d, r12d
jmp 0x428347
test r12, r12
je 0x42833b
cmp r14b, 0x3b
je 0x42833b
sub r14d, 0x30
cmp r14b, 9
ja 0x428454
lea rax, [rdi + 1]
movzx r14d, byte [rdi + 1]
mov rdi, rax
test r14b, r14b
je 0x428380
cmp r14b, 0x3a
je 0x428380
cmp r14b, 0x3d
jne 0x428322
cmp rbp, rdi
je 0x428454
test r12, r12
jne 0x428454
lea rax, [rdi + 1]
mov rsi, rdi
sub rsi, rbp
mov r12, rax
jmp 0x42833f
test r12, r12
mov rcx, qword [0x004a1ae0]
je 0x428440
mov r13, rdi
sub r13, r12
test rcx, rcx
je 0x42847a
lea rbx, [0x004a1ae0]
jmp 0x4283bc
add rbx, 0x18
mov rcx, qword [rbx]
test rcx, rcx
je 0x4283d4
movzx eax, byte [rbx + 0x10]
cmp rax, rsi
jne 0x4283b0
mov r8, rsi
mov rdx, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4283b0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x42842b
test r12, r12
je 0x42842b
cmp byte [rbx + 0x11], 0
jne 0x428470
lea rcx, [r13 + 7]
call fcn.00482890
mov r8, r13
mov rdx, r12
mov rbp, rax
mov eax, 0x5b1b
mov word [rbp], ax
lea rcx, [rbp + 2]
call sub.msvcrt.dll_memcpy
lea rax, [rbp + r13 + 2]
mov qword [rbx + 8], rbp
mov dword [rax], 0x4b5b1b6d
mov byte [rax + 4], 0
mov byte [rbx + 0x11], 1
movzx r14d, byte [rdi]
test r14b, r14b
je 0x428454
lea rax, [rdi + 1]
xor r12d, r12d
mov rbp, rax
jmp 0x42833f
mov rsi, rdi
sub rsi, rbp
test rcx, rcx
jne 0x42839f
test r14b, r14b
jne 0x428430
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.0049a918
jmp 0x4283ec
lea rbx, [0x004a1ae0]
jmp 0x4283d4
Function at 0x42c210
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test r8, r8
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x42c279
mov rbx, r8
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 0xffffffff
lea r14, [rsp + 0x3c]
jmp 0x42c24b
mov eax, dword [rsp + 0x3c]
sub rbx, rax
je 0x42c279
cmp rbx, rsi
mov r8, rsi
mov rdx, rdi
mov qword [rsp + 0x20], 0
cmovbe r8, rbx
sub rdx, rbx
mov r9, r14
add rdx, r12
mov rcx, rbp
mov dword [rsp + 0x3c], r8d
call r13
test eax, eax
jne 0x42c242
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret