joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21005f610
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov esi, edx
mov r12, r8
test r8, r8
je 0x21005f682
mov r8, qword [rcx + 8]
test r8, r8
je 0x21005f682
mov r11, qword [rcx]
xor eax, eax
lea rdi, [0x2102aa140]
sub r8, 1
nop dword [rax + rax]
movzx edx, byte [r12 + rax]
movzx ecx, byte [r11 + rax]
cmp dl, cl
je 0x21005f66f
movzx r9d, dl
movzx r10d, dl
movsx r9d, byte [rdi + r9]
xor r9d, r10d
cmp r9d, ecx
jne 0x21005f840
cmp r8, rax
sete cl
test dl, dl
sete dl
add rax, 1
or cl, dl
je 0x21005f648
lea r13, [0x210273880]
test byte [0x210273880], 1
jne 0x21005f7a0
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x21005f7d0
mov rdx, qword [0x21023d810]
test r12, r12
je 0x21005f760
cmp qword [rdx + 0x4878], 0
je 0x21005f810
mov rcx, qword [rbx + 0x20]
mov r8, qword [rbx + 8]
lea rcx, [rdx + rcx + 0x4700]
mov rdx, qword [rbx]
call rax
mov r12, rax
test rax, rax
je 0x21005f786
lea rax, [0x21024fae4]
cmp r12, rax
je 0x21005f786
mov rcx, r12
call sym.msys_2.0.dll_strlen
mov rdx, qword [rbx + 8]
mov ecx, 0xc
lea rdx, [rdx + rax + 1]
call sym.cmalloc_abort
mov rdx, qword [rbx]
mov rcx, rax
mov r14, rax
call sym.msys_2.0.dll_strcpy
mov rcx, qword [rbx + 8]
mov rdx, r12
add rcx, r14
call sym.msys_2.0.dll_strcpy
test byte [0x210273880], 1
je 0x21005f78d
mov rax, qword [rbx]
lea r9, str.using_computed_value_for__s
mov edx, 0x40
mov rcx, r13
lea r8, str.char_spenv::retrieve_bool__const_char_
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21005f78d
mov rcx, qword [rbx + 0x20]
mov r8, qword [rbx + 8]
lea rcx, [rdx + rcx + 0x4700]
mov rdx, qword [rbx]
call rax
mov r12, rax
test rax, rax
je 0x21005f786
test sil, sil
je 0x21005f6e2
lea r14, [0x21024fae4]
mov rax, r14
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
movzx eax, sil
lea r9, str.no_envblock__d
mov edx, 0x40
mov rcx, r13
mov dword [rsp + 0x20], eax
lea r8, str.char_spenv::retrieve_bool__const_char_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x21005f6a3
test r12, r12
je 0x21005f7f0
mov rcx, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
jmp sym.cstrdup1
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
mov r8d, 0xc
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
jmp sym.getwinenveq_char_const__unsigned_long__int_
test byte [0x210273880], 1
je 0x21005f7d5
mov rax, qword [rbx]
lea r9, str.duping_existing_value_for__s
mov edx, 0x40
mov rcx, r13
lea r8, str.char_spenv::retrieve_bool__const_char_
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21005f7d5
xor r14d, r14d
jmp 0x21005f78d
Function at 0x210061830
Capabilities:
Print debug messages

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x558
mov rax, qword [rcx + 0x15f8]
mov rbx, rcx
mov rbp, rdx
test rax, rax
je 0x210061863
mov r12, qword [rax + 0x10]
test r12, r12
je 0x210061863
call sym.IsDebuggerPresent
test eax, eax
jne 0x210061878
add rsp, 0x558
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, r12
lea rsi, [rsp + 0x80]
call sym.SuspendThread
mov rdx, rsi
mov rcx, r12
mov dword [rsp + 0xb0], 0x10000b
call sym.GetThreadContext
test eax, eax
je 0x210061921
mov eax, dword [rbx + 0x1644]
test eax, eax
jne 0x210061940
mov rdx, qword [rsp + 0x80]
lea rax, [rbx + 0x1050]
lea r13, [rsp + 0x30]
lea rdi, [rbx + 0x1058]
mov rcx, rax
and rdi, 0xfffffffffffffff8
mov qword [rbx + 0x1050], rdx
mov rdx, qword [rsp + 0x548]
sub rcx, rdi
sub rsi, rcx
add ecx, 0x4d0
mov qword [rbx + 0x1518], rdx
lea rdx, str.cYgSiGw00f__d__y__p
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0x20], rax
mov rcx, r13
mov r9d, dword [rbx + 0x1560]
mov r8d, dword [rbp]
call sym.__small_sprintf
mov rcx, r13
call sym.OutputDebugStringA
mov rcx, r12
call sym.ResumeThread
nop
add rsp, 0x558
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [rbx + 0x1650]
mov rax, qword [rax - 8]
mov qword [rsp + 0x178], rax
jmp 0x2100618b0
Function at 0x210062e00
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
push r14
push r13
push r12
push rbx
sub rsp, 0x520
lea r13, [0x210273880]
mov r12d, ecx
mov rbx, rdx
test byte [0x210273880], 1
jne 0x210062ec3
mov rax, qword [0x21023d810]
mov dword [0x21024fafc], 2
cmp qword [rax + 0x48b8], 0
je 0x210062e60
cmp r12d, 0x19
ja 0x210062e60
mov eax, 0x3001d78
mov ecx, r12d
shr rax, cl
test al, 1
jne 0x210062f04
mov edx, 0xffffffff
lea rcx, [0x2102738a0]
call method.muto.acquire_unsigned_int_
cmp qword [0x210272e70], 0
je 0x210062e93
test byte [0x210273880], 1
jne 0x210062ee7
mov edx, r12d
lea rcx, [0x21024fcc0]
call method.pinfo.exit_unsigned_int_
cmp dword [0x21024fafc], 3
jg 0x210062e7b
call sym.GetCurrentThread
mov edx, 0xf
mov rcx, rax
call sym.SetThreadPriority
test byte [0x210273880], 1
jne 0x210062f84
mov ecx, r12d
call sym.do_exit_int_
mov dword [rsp + 0x20], ecx
lea r9, str.exiting_due_to_signal__d
mov edx, 0x40
mov rcx, r13
lea r8, str.void_signal_exit_int__siginfo_t__void_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210062e2c
lea r9, str.recursive_exit_
lea r8, str.void_signal_exit_int__siginfo_t__void_
mov edx, 0x40
mov rcx, r13
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210062e84
or r12b, 0x80
call sym.try_to_debug
test eax, eax
jne 0x210062e60
cmp dword [rbx + 4], 0
je 0x210062f3d
mov rcx, qword [rbx + 0x8c]
test rcx, rcx
je 0x210062f3d
mov rax, qword [rcx + 0x10]
cmp dword [rax], 0xc00000fd
je 0x210062fa9
call method.cygwin_exception.dumpstack__
jmp 0x210062e60
lea rbx, [rbp - 0x4f0]
mov dword [rbp - 0x4c0], 0x10000b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov qword [rbp - 0x510], rbp
lea rcx, [rbp - 0x510]
mov qword [rbp - 0x508], rbx
mov qword [rbp - 0x500], 0
mov qword [rbp - 0x4f8], 0
jmp 0x210062f33
mov dword [rsp + 0x20], r12d
lea r9, str.about_to_call_do_exit___x_
mov edx, 0x800
mov rcx, r13
lea r8, str.void_signal_exit_int__siginfo_t__void_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210062ebb
mov qword [rsp + 0x28], 0
mov r9, rcx
lea r8, [sym.dumpstack_overflow_wrapper_void_]
xor edx, edx
mov dword [rsp + 0x20], 0
lea rcx, [0x2102d1cc0]
call sym.CreateThread
mov r14, rax
test rax, rax
je 0x210062e60
or edx, 0xffffffff
mov rcx, rax
call sym.WaitForSingleObject
mov rcx, r14
call sym.CloseHandle
jmp 0x210062e60
Function at 0x210064b70
Capabilities:
Print debug messages
Resume thread
Suspend thread

Disassembly:
cmp dword [rcx + 0x1e58], 0xc763173f
je 0x210064b80
ret
cmp qword [rdx + 0x8c], 0
jne 0x210064b7c
jmp method._cygtls.signal_debugger_siginfo_t___clone_.part.0_

Function at 0x210066000
Capabilities:
Set environment variable

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x48
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov rbx, rcx
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x34]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], 0
test rcx, rcx
je 0x210066140
call sym.build_env_char_const_const__wchar_t__int__bool__void__bool_
mov r13, qword [rsp + 0x38]
mov r14, rax
test rax, rax
je 0x2100660e8
mov rcx, qword [rax]
test rcx, rcx
je 0x210066124
mov r12, r14
nop dword [rax + rax]
call sym.cfree
mov rcx, qword [r12 + 8]
add r12, 8
test rcx, rcx
jne 0x210066068
mov rcx, r14
call sym.cfree
test rbx, rbx
jne 0x21006612c
test r13, r13
je 0x2100660e8
cmp word [r13], 0
je 0x2100660db
nop dword [rax]
mov edx, 0x3d
mov rcx, r13
call sym.msys_2.0.dll_wcschr
test rax, rax
je 0x210066100
xor edx, edx
lea r12, [rax + 2]
mov rcx, r13
mov word [rax], dx
mov rdx, r12
call sym.SetEnvironmentVariableW
xor edx, edx
mov rcx, r12
call sym.msys_2.0.dll_wcschr
cmp word [rax + 2], 0
lea r13, [rax + 2]
jne 0x2100660a0
mov rcx, qword [rsp + 0x38]
xor r13d, r13d
call sym.free_1
mov rax, r13
add rsp, 0x48
pop rbx
pop r12
pop r13
pop r14
ret
xor edx, edx
mov rcx, r13
call sym.msys_2.0.dll_wcschr
cmp word [rax + 2], 0
lea r13, [rax + 2]
jne 0x2100660a0
mov rcx, qword [rsp + 0x38]
xor r13d, r13d
call sym.free_1
jmp 0x2100660e8
mov rcx, r14
call sym.cfree
mov r13, qword [rsp + 0x38]
mov rax, r13
add rsp, 0x48
pop rbx
pop r12
pop r13
pop r14
ret
mov rcx, qword [sym.msys_2.0.dll_environ]
call sym.build_env_char_const_const__wchar_t__int__bool__void__bool_
mov r13, qword [rsp + 0x38]
mov r14, rax
test rax, rax
je 0x21006608c
mov rcx, qword [rax]
test rcx, rcx
jne 0x210066060
mov rcx, r14
call sym.cfree
jmp 0x21006608c

Function at 0x210067aa0
Capabilities:
Write file on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x60
test byte [rcx + 0x2c], 8
mov rax, qword [rcx]
mov rbx, rdx
mov rsi, r8
je 0x210067b10
call qword [rax + 0x290]
lea rdx, [0x2102307d0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbx
mov rcx, qword [rax]
call sym.NtWriteFile
test eax, eax
js 0x210067b28
mov r12, qword [rsp + 0x58]
mov rax, r12
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
call qword [rax + 0x290]
lea rdx, [0x2102307d8]
mov qword [rsp + 0x40], 0
jmp 0x210067acd
mov r8d, eax
mov edx, 0x113
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler.cc
mov r12, 0xffffffffffffffff
call sym.seterrno_from_nt_status_char_const__int__int_
call sym.msys_2.0.dll___errno
cmp dword [rax], 0x20
jne 0x210067afe
mov ecx, 0xd
call sym.raise_1
jmp 0x210067afe
Function at 0x210068160
Capabilities:
Get file attributes

Disassembly:
push r12
push rbx
sub rsp, 0x68
mov rbx, rcx
mov r12, rdx
test byte [rcx + 0x2e], 0x80
jne 0x210068209
cmp dword [rcx + 0x1b0], 0xc3
je 0x2100681c0
mov rdx, qword [rbx + 0x128]
test rdx, rdx
je 0x2100681a0
mov rcx, r12
call sym.msys_2.0.dll_strcpy
add rsp, 0x68
pop rbx
pop r12
ret
mov rdx, qword [rbx + 0x1a8]
test rdx, rdx
jne 0x21006818f
mov rax, r12
mov byte [r12], 0
add rsp, 0x68
pop rbx
pop r12
ret
mov rax, qword [rcx]
lea rdx, [method.fhandler_base.get_handle__]
mov rax, qword [rax + 0x280]
cmp rax, rdx
jne 0x210068240
lea rax, [rcx + 0x18]
lea rdx, [rsp + 0x30]
mov r9d, 0x18
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 5
mov rcx, qword [rax]
call sym.NtQueryInformationFile
test eax, eax
js 0x210068183
cmp byte [rsp + 0x54], 0
je 0x210068183
mov rdx, qword [rbx + 0x128]
mov rcx, r12
call sym.msys_2.0.dll_stpcpy
mov edx, 0x2964
movabs rcx, 0x6574656c65642820
mov qword [rax], rcx
mov word [rax + 8], dx
mov byte [rax + 0xa], 0
mov rax, r12
add rsp, 0x68
pop rbx
pop r12
ret
call rax
jmp 0x2100681da
Function at 0x21006a7e0
Capabilities:
Get file attributes

Disassembly:
push r14
push r13
push r12
sub rsp, 0x70
mov r9d, 0x18
xor r14d, r14d
mov dword [rsp + 0x20], 5
lea r13, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov r12, rcx
mov rdx, r13
call sym.NtQueryInformationFile
test eax, eax
jns 0x21006a828
mov eax, r14d
add rsp, 0x70
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x20], 0xe
mov r9d, 8
mov rdx, r13
mov rcx, r12
lea r8, [rsp + 0x38]
call sym.NtQueryInformationFile
test eax, eax
js 0x21006a814
mov rax, qword [rsp + 0x38]
xor r14d, r14d
cmp qword [rsp + 0x58], rax
sete r14b
mov eax, r14d
add rsp, 0x70
pop r12
pop r13
pop r14
ret
Function at 0x21006a870
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r14d, 2
lea r12, [method.fhandler_base.get_handle__]
lea rbp, [0x210289e18]
lea rax, [rcx + 0x18]
mov r15, rcx
mov rdi, rdx
mov rsi, r8
mov qword [rsp + 0x58], rax
lea r13, [rsp + 0x60]
mov rax, qword [r15]
mov rbx, qword [rsi]
mov rax, qword [rax + 0x280]
cmp rax, r12
jne 0x21006aa28
mov dword [rsp + 0x30], ebx
mov rcx, qword [r15 + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
call sym.NtReadFile
mov ebx, eax
test eax, eax
jns 0x21006aa67
cmp ebx, 0xc0000012
jge 0x21006a928
cmp ebx, 0xc0000005
jl 0x21006a968
lea eax, [rbx + 0x3ffffffb]
cmp eax, 0xc
ja case.0x21006a91f.1073741818
movsxd rax, dword [rbp + rax*4]
add rax, rbp
jmp rax
xor eax, eax
cmp ebx, 0xc000014b
je 0x21006a94d
mov r8d, ebx
mov edx, 0xfa
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler.cc
call sym.seterrno_from_nt_status_char_const__int__int_
mov rax, 0xffffffffffffffff
mov qword [rsi], rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x68]
cmp ebx, 0x80000005
je 0x21006a94d
jmp case.0x21006a91f.1073741818
mov rax, qword [r15]
mov rax, qword [rax + 0x280]
cmp rax, r12
jne 0x21006aa80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
call sym.is_at_eof_void_
test eax, eax
jne case.0x21006a91f.1073741807
cmp r14d, 1
je case.0x21006a91f.1073741816
mov rdx, qword [rsi]
mov rcx, rdi
call sym.mmap_is_attached_or_noreserve_void__unsigned_long_
cmp eax, 1
je 0x21006aad0
mov r14d, 1
cmp eax, 2
je 0x21006a8ab
nop dword [rax]
mov eax, dword [r15 + 0x80]
cmp eax, 0xffffffff
je case.0x21006a91f.1073741818
test al, 0x10
je case.0x21006a91f.1073741818
test byte [0x210273880], 1
jne 0x21006aa90
mov rax, qword [sym.msys_2.0.dll__impure_ptr]
mov dword [rax], 0x15
call sym.msys_2.0.dll___errno
mov dword [rax], 0x15
mov rax, 0xffffffffffffffff
jmp 0x21006a94d
mov rcx, r15
call rax
mov dword [rsp + 0x30], ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
mov rcx, qword [rax]
call sym.NtReadFile
mov ebx, eax
test eax, eax
js 0x21006a8fc
mov rax, qword [rsp + 0x68]
jmp 0x21006a94d
xor eax, eax
jmp 0x21006a94d
mov rcx, r15
call rax
jmp 0x21006a998
lea rax, str.virtual_void_fhandler_base::raw_read_void__size_t_
mov dword [rsp + 0x30], 0x15
lea r9, [0x2102894f4]
mov edx, 0x40
mov dword [rsp + 0x28], 0xf4
lea r8, [0x210289510]
lea rcx, [0x210273880]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21006a9fd
mov ecx, 0xa
call sym.raise_1
jmp case.0x21006a91f.1073741816
Function at 0x21006fa60
Capabilities:
Manipulate console buffer

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov rax, qword [0x21024fa28]
lea rbx, [method.fhandler_termios.get_output_handle__]
lea r13, [rax + 0x90]
mov rax, qword [rcx]
mov rax, qword [rax + 0x290]
mov r12, rcx
cmp rax, rbx
jne 0x21006fb40
mov rdx, qword [rcx + 0x1d0]
mov rcx, r13
call method.dev_console.fillin_void_
mov rax, qword [0x21034b1a0]
test byte [rax + 0x12], 0x10
mov rax, qword [0x21024fa28]
je 0x21006fac5
test rax, rax
je 0x21006fb33
cmp byte [rax + 0x94], 0
je 0x21006fb33
movzx edx, word [rax + 0x518]
cmp word [rax + 0x546], dx
jne 0x21006fae5
movzx ecx, word [rax + 0x51a]
cmp word [rax + 0x548], cx
je 0x21006fb33
mov ecx, dword [0x21024fa70]
call sym.acquire_attach_mutex_unsigned_int_
mov rax, qword [r12]
mov r13, qword [0x21024fa28]
mov rax, qword [rax + 0x290]
cmp rax, rbx
jne 0x21006fb50
mov edx, dword [r13 + 0x518]
mov rcx, qword [r12 + 0x1d0]
call sym.SetConsoleCursorPosition
call sym.release_attach_mutex__
mov rax, qword [0x21024fa28]
mov edx, dword [rax + 0x518]
mov dword [rax + 0x546], edx
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
call rax
mov rdx, qword [rax]
jmp 0x21006fa9b
mov rcx, r12
call rax
mov edx, dword [r13 + 0x518]
mov rcx, qword [rax]
jmp 0x21006fb16
Function at 0x210070fd0
Capabilities:
Manipulate console buffer

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x4a8], 0
setne al
test r8d, r8d
mov r13, rdx
mov r12, rcx
setne dl
or al, dl
je 0x210071000
xor eax, eax
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
movsx edx, word [rcx + 0x49a]
sub edx, 1
cmp edx, dword [rsp + 0x90]
jne 0x210070ff6
movsx edx, word [rcx + 0x490]
cmp edx, r9d
jne 0x210070ff6
movsx ecx, word [rcx + 0x494]
cmp ecx, dword [rsp + 0x98]
jne 0x210070ff6
movzx ebx, word [r12 + 0x49c]
cmp word [r12 + 0x486], bx
jle 0x210070ff6
xor r8d, r8d
mov ecx, dword [0x21024fa70]
xor r9d, r9d
xor r10d, r10d
movsx ebx, word [r12 + 0x4a0]
mov word [rsp + 0x44], r9w
mov word [r12 + 0x49e], r8w
sub ebx, edx
mov word [rsp + 0x40], r10w
add ebx, 1
call sym.acquire_attach_mutex_unsigned_int_
movsx edx, word [r12 + 0x494]
movsx r8d, word [r12 + 0x486]
mov eax, edx
add edx, ebx
mov ecx, r8d
cmp edx, r8d
jge 0x2100710d4
test ebx, ebx
jne 0x210071178
add word [r12 + 0x4a0], 1
mov rcx, r13
mov edx, dword [r12 + 0x49e]
call sym.SetConsoleCursorPosition
call sym.release_attach_mutex__
mov rdx, r13
mov rcx, r12
call method.dev_console.fillin_void_
mov eax, 1
jmp 0x210070ff6
add ax, word [r12 + 0x4a0]
sub ecx, 1
xor edx, edx
xor r9d, r9d
add eax, 2
mov word [rsp + 0x4e], cx
mov ecx, 0x20
sub ax, word [r12 + 0x490]
sub eax, r8d
mov word [rsp + 0x48], dx
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov word [rsp + 0x4a], ax
movzx eax, word [r12 + 0x484]
mov word [rsp + 0x3c], cx
mov rcx, r13
sub eax, 1
mov word [rsp + 0x4c], ax
movzx eax, word [r12 + 0x468]
mov word [rsp + 0x3e], ax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
call sym.ScrollConsoleScreenBufferW
movsx edx, word [r12 + 0x494]
movsx eax, word [r12 + 0x486]
sub eax, edx
movzx edx, word [r12 + 0x48a]
lea ebx, [rax - 1]
lea eax, [rdx + rax - 2]
mov word [r12 + 0x4a0], ax
jmp 0x210071098
mov edx, dword [r12 + 0x49e]
mov rcx, r13
call sym.SetConsoleCursorPosition
lea rdx, [r12 + 0x484]
mov rcx, r13
call sym.GetConsoleScreenBufferInfo
movsx eax, word [r12 + 0x48a]
movsx edx, word [r12 + 0x490]
cmp ax, dx
jl 0x2100711b4
sub eax, edx
lea ebx, [rax + 1]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, r13
mov word [rsp + 0x46], bx
mov word [rsp + 0x42], bx
call sym.SetConsoleWindowInfo
jmp 0x2100710a0
Function at 0x210071560
Capabilities:
Manipulate console buffer

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x21024fa28]
lea rdi, [method.fhandler_termios.get_output_handle__]
lea r12, [rax + 0x90]
mov rax, qword [rcx]
mov rax, qword [rax + 0x290]
mov r13, rcx
mov ebp, edx
mov ebx, r8d
mov esi, r9d
cmp rax, rdi
jne 0x210071628
mov rdx, qword [rcx + 0x1d0]
mov rcx, r12
call method.dev_console.fillin_void_
test esi, esi
js 0x21007163d
mov rax, qword [0x21024fa28]
test bpl, bpl
je 0x2100715c9
add si, word [rax + 0x520]
movsx eax, word [rax + 0x52a]
cmp eax, ebx
jl 0x210071651
xor eax, eax
test ebx, ebx
cmovns eax, ebx
shl esi, 0x10
movzx r12d, ax
mov ecx, dword [0x21024fa70]
or r12d, esi
call sym.acquire_attach_mutex_unsigned_int_
mov rax, qword [r13]
mov rax, qword [rax + 0x290]
cmp rax, rdi
jne 0x210071660
mov rcx, qword [r13 + 0x1d0]
mov edx, r12d
call sym.SetConsoleCursorPosition
nop
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.release_attach_mutex__
call rax
mov rcx, r12
mov rdx, qword [rax]
call method.dev_console.fillin_void_
test esi, esi
jns 0x2100715b6
mov rax, qword [0x21024fa28]
xor esi, esi
movsx eax, word [rax + 0x52a]
cmp ebx, eax
jle 0x2100715d4
sub eax, 1
shl esi, 0x10
movzx r12d, ax
jmp 0x2100715e2
mov rcx, r13
call rax
mov edx, r12d
mov rcx, qword [rax]
jmp 0x21007160a

Function at 0x210071670
Capabilities:
Manipulate console buffer

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x21024fa28]
lea r13, [rax + 0x90]
mov rax, qword [rcx]
mov rax, qword [rax + 0x290]
mov ebx, edx
lea rdx, [method.fhandler_termios.get_output_handle__]
mov r12, rcx
mov esi, r8d
cmp rax, rdx
jne 0x2100716f0
mov rdx, qword [rcx + 0x1d0]
mov rcx, r13
call method.dev_console.fillin_void_
mov rax, qword [0x21024fa28]
mov rcx, r12
movsx edx, word [rax + 0x51a]
movsx eax, word [rax + 0x518]
lea r9d, [rdx + rsi]
lea r8d, [rax + rbx]
xor edx, edx
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
jmp method.fhandler_console.cursor_set_bool__int__int_
call rax
mov rdx, qword [rax]
jmp 0x2100716ad
Function at 0x210077140
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x850
mov r9, rcx
mov rax, qword gs:[8]
mov rax, qword [rax - 0x2938]
test rax, rax
je 0x210077240
lea rdx, [sym.__ascii_mbtowc]
lea rcx, [sym.__utf8_mbtowc]
cmp qword [rax + 0xe8], rdx
je 0x21007719e
mov rax, qword gs:[8]
mov rax, qword [rax - 0x2938]
mov rcx, qword [sym.__utf8_mbtowc]
test rax, rax
je 0x21007719e
mov rcx, qword [rax + 0xe8]
mov qword [rsp + 0x20], 0xffffffffffffffff
lea rbx, [rsp + 0x40]
mov r8d, 0x401
mov rdx, rbx
call sym._sys_mbstowcs_int_____reent__wchar_t__char_const__unsigned_long___mbstate_t___wchar_t__unsigned_long__char_const__unsigned_long_
mov edx, 0x3a98
lea rcx, [rsp + 0x3f]
call method.lock_ttys.lock_ttys_unsigned_int_
mov ecx, dword [0x21024fa70]
call sym.acquire_attach_mutex_unsigned_int_
mov rcx, rbx
call sym.SetConsoleTitleW
call sym.release_attach_mutex__
test byte [0x210273880], 1
jne 0x210077210
cmp byte [rsp + 0x3f], 0
jne 0x210077200
add rsp, 0x850
pop rbx
ret
call method.lock_ttys.release__
nop
add rsp, 0x850
pop rbx
ret
mov qword [rsp + 0x20], rbx
lea r9, str.title__W
lea r8, str.void_set_console_title_char_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100771ea
lea rax, [sym.__ascii_mbtowc]
cmp qword [sym.__utf8_mbtowc], rax
lea rcx, [sym.__utf8_mbtowc]
jne 0x21007717b
jmp 0x21007719e
Function at 0x21007c860
Capabilities:
Get disk information

Disassembly:
push r12
sub rsp, 0x20
call method.fhandler_disk_file.opendir_int_
mov r12, rax
test rax, rax
je 0x21007c89c
mov ecx, 0x78
call sym.operator_new_unsigned_long_
mov ecx, 0x6a
mov qword [r12 + 0x20], rax
lea rdx, [rax + 8]
call sym.GetLogicalDriveStringsA
mov rax, qword [r12 + 0x20]
lea rdx, [rax + 8]
mov qword [rax], rdx
mov rax, r12
add rsp, 0x20
pop r12
ret

Function at 0x21007c8b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
xor ecx, ecx
mov rax, qword [rdx + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0xa0], r8
mov rsi, rdx
lea rdi, [rsp + 0x52]
lea rbp, [rsp + 0x58]
mov dword [rsp + 0x52], 0x3a0058
mov word [rsp + 0x56], cx
test rax, rax
jne 0x21007c91d
jmp 0x21007ca20
mov rbx, qword [rsi + 0x20]
mov rcx, qword [rbx]
cmp eax, 2
je 0x21007c90a
call sym.GetFileAttributesA
cmp eax, 0xffffffff
jne 0x21007c968
mov rbx, qword [rsi + 0x20]
mov r12, qword [rbx]
mov rcx, r12
call sym.msys_2.0.dll_strlen
lea rax, [r12 + rax + 1]
mov qword [rbx], rax
movsx ax, byte [rax]
test al, al
je 0x21007ca20
mov rcx, rdi
mov word [rsp + 0x52], ax
call sym.get_disk_type_wchar_t_const_
cmp eax, 4
jne 0x21007c8f0
xor ecx, ecx
mov r9, rbp
mov r8d, 1
mov rdx, rdi
call fcn.21022da10
test eax, eax
jne 0x21007c906
mov rcx, qword [rsp + 0x58]
mov ebx, dword [rcx + 0x18]
call fcn.21022d900
test ebx, ebx
jne 0x21007c906
nop dword [rax + rax]
mov rax, qword [rsi + 0x20]
lea rdx, [0x2102aa340]
mov rbx, qword [rsp + 0xa0]
mov rax, qword [rax]
movzx eax, byte [rax]
movzx eax, byte [rdx + rax]
mov byte [rbx + 0x19], 0
xor edx, edx
mov byte [rbx + 0x18], al
mov rax, qword [0x21025fe40]
mov byte [rax + 8], 1
mov rax, qword [rsi + 0x20]
mov rcx, qword [rax]
call sym.readdir_get_ino_char_const__bool_
mov qword [rbx + 8], rax
mov rbx, qword [rsi + 0x20]
add dword [rsi + 0x18], 1
mov rdi, qword [rbx]
mov rcx, rdi
call sym.msys_2.0.dll_strlen
lea rax, [rdi + rax + 1]
mov qword [rbx], rax
xor eax, eax
test byte [0x210273880], 1
je 0x21007ca2b
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0xa0]
lea r9, str._p__readdir___p____s_
lea r8, str.virtual_int_fhandler_cygdrive::readdir_DIR__dirent_
mov qword [rsp + 0x28], rsi
lea rcx, [0x210273880]
lea rdx, [rax + 0x18]
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x20], rdx
mov edx, 0x10
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, dword [rsp + 0x4c]
jmp 0x21007ca2b
test byte [rsi + 0x38], 1
je 0x21007ca40
mov eax, 0x59
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsp + 0xa0]
mov edx, 0x2e
mov word [rax + 0x18], dx
mov qword [rax + 8], 2
jmp 0x21007ca26