joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2100a4df0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x90]
mov rbx, qword [rcx + 0x128]
mov r13, rcx
mov rcx, rbx
mov r14d, edx
call sym.msys_2.0.dll_strlen
lea rax, [rax + rax + 0x11]
and rax, 0xfffffffffffffff0
call fcn.21021b550
sub rsp, rax
movsx ax, byte [rbx + 9]
lea rcx, [rbx + 9]
lea r8, [rsp + 0x40]
mov rdx, r8
test al, al
jne 0x2100a4e63
jmp 0x2100a4fb0
add rcx, 1
mov word [rdx], ax
add rdx, 2
movsx ax, byte [rcx]
test al, al
je 0x2100a4e82
cmp al, 0x2f
jne 0x2100a4e50
mov r9d, 0x5c
add rcx, 1
add rdx, 2
mov word [rdx - 2], r9w
movsx ax, byte [rcx]
test al, al
jne 0x2100a4e63
cmp r8, rdx
je 0x2100a4fb0
xor eax, eax
lea rbx, [rbp - 0x40]
mov word [rdx], ax
mov rcx, rbx
mov rdx, r8
call sym.RtlInitUnicodeString
lea rcx, [rbp - 0x48]
lea r8, [rbp - 0x30]
mov edx, 1
mov dword [rbp - 0x30], 0x30
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x18], 0x40
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
call sym.NtOpenDirectoryObject
test eax, eax
js 0x2100a4fdc
mov dword [rbp - 0x4c], 0
mov ebx, 4
mov edi, 0x10000
xor r12d, r12d
lea rsi, [rbp - 0x4c]
mov rcx, r12
mov edx, edi
mov r15, r12
call sym.realloc_1
mov rcx, qword [rbp - 0x48]
mov r12, rax
test rax, rax
je 0x2100a4ff4
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov r8d, edi
mov rdx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
call sym.NtQueryDirectoryObject
test eax, eax
js 0x2100a4fc2
cmp eax, 0x105
jne 0x2100a4f7e
add edi, edi
sub ebx, 1
jne 0x2100a4efb
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_procsys.cc
mov r8d, 0xc000009a
mov edx, 0x15c
call sym.seterrno_from_nt_status_char_const__int__int_
mov rcx, qword [rbp - 0x48]
call sym.NtClose
mov rcx, r12
call sym.free_1
xor eax, eax
jmp 0x2100a4f9d
mov rcx, r13
mov edx, r14d
call method.fhandler_virtual.opendir_int_
mov rcx, qword [rbp - 0x48]
test rax, rax
je 0x2100a4f6d
mov esi, dword [rbp - 0x4c]
mov qword [rax + 0x28], r12
mov qword [rax + 0x20], rsi
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 0x5c
add rdx, 2
mov word [rdx - 2], cx
jmp 0x2100a4e8b
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_procsys.cc
mov r8d, eax
mov edx, 0x153
call sym.seterrno_from_nt_status_char_const__int__int_
mov rcx, qword [rbp - 0x48]
jmp 0x2100a4f6d
mov r8d, eax
mov edx, 0x141
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_procsys.cc
call sym.seterrno_from_nt_status_char_const__int__int_
xor eax, eax
jmp 0x2100a4f9d
mov r12, r15
jmp 0x2100a4f6d
Function at 0x2100ad360
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xd0], ecx
mov rcx, qword [0x2102ff770]
test rcx, rcx
je 0x2100ad4f0
mov edx, 0xffffffff
call sym.WaitForSingleObject
test eax, 0xffffff7f
je 0x2100ad3b0
lea rcx, str.WFSO_failed_for_shared_socket_mutex___E
call sym.api_fatal
nop
mov ebx, dword [rbp + 0xd0]
lea rdi, [0x21033f020]
and ebx, 0x7ff
mov eax, ebx
mov dword [rbp - 0x54], ebx
lea rdx, [rax + rax*2]
mov r8d, dword [rdi + rdx*8]
test r8d, r8d
je 0x2100ad479
lea r13, str.socket._d
lea r12, [rbp - 0x40]
lea r15, [rbp - 0x30]
lea rsi, [rbp + 0x40]
lea r14, [rbp - 0x48]
jmp 0x2100ad422
mov rcx, qword [rbp - 0x48]
add ebx, 1
and ebx, 0x7ff
call sym.NtClose
cmp dword [rbp - 0x54], ebx
je 0x2100ad4d0
mov eax, ebx
lea rdx, [rax + rax*2]
mov r8d, dword [rdi + rdx*8]
test r8d, r8d
je 0x2100ad479
mov rdx, r13
mov rcx, rsi
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
mov rdx, rsi
mov rcx, r12
call sym.RtlInitUnicodeString
mov dword [rbp - 0x30], 0x30
call sym.get_session_parent_dir__
mov r8, r15
mov edx, 0x20000
mov rcx, r14
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x18], 0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
call sym.NtOpenMutant
test eax, eax
jns 0x2100ad3f8
mov eax, ebx
lea rax, [rax + rax*2]
mov rcx, qword [0x2102ff770]
lea r12, [rdi + rax*8]
mov eax, dword [rbp + 0xd0]
mov qword [r12], 0
mov qword [r12 + 8], 0
mov qword [r12 + 0x10], 0
mov dword [r12], eax
call sym.ReleaseMutex
mov rax, r12
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test byte [0x210273880], 1
jne 0x2100ad580
mov rcx, qword [0x2102ff770]
xor r12d, r12d
call sym.ReleaseMutex
jmp 0x2100ad4b1
lea r13, str.socket._d
xor r8d, r8d
lea r12, [rbp - 0x40]
mov rcx, rbp
mov rdx, r13
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
mov rdx, rbp
mov rcx, r12
call sym.RtlInitUnicodeString
mov dword [rbp - 0x30], 0x30
call sym.get_session_parent_dir__
add rsp, 0xffffffffffffff80
mov edx, 0x120001
mov dword [rbp - 0x18], 0x82
lea rcx, [rsp + 0x20]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], r12
call sym._everyone_sd_void__unsigned_int_
xor r9d, r9d
lea r8, [rbp - 0x30]
mov edx, 0x120001
lea rcx, [0x2102ff770]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0
call sym.NtCreateMutant
test eax, eax
js 0x2100ad5a4
mov rcx, qword [0x2102ff770]
jmp 0x2100ad391
lea r9, str.No_free_socket_slot
lea r8, str.wsa_event_search_wsa_event_slot_LONG_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100ad4dd
mov r8d, eax
mov rdx, r12
lea rcx, str.Couldnt_create_open_shared_socket_mutex__S___y
call sym.api_fatal
nop
nop
nop dword [rax + rax]
Function at 0x2100b7b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [rcx + 0x18], 3
mov ebp, dword [rsp + 0xb0]
mov r13d, dword [rsp + 0xb8]
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov r14, r9
je 0x2100b7c6e
mov rax, r14
movsxd r15, ebp
mov dword [rbx + 0x18], 0
shr rax, 0x20
shl r15, 5
mov r12, rax
add r15, rbx
mov dword [rsp + 0x28], r13d
mov r9d, r14d
mov r8d, ebp
mov edx, edi
mov dword [rsp + 0x20], r12d
mov rcx, rsi
call sym.SetTapePosition
mov dword [rbx + 4], eax
cmp eax, 0x456
jne 0x2100b7c5d
mov dword [rbx + 8], 0
lea rax, [rbx + 0x70]
lea rdx, [rbx + 0x870]
mov qword [rbx + 0x10], 0xffffffffffffffff
mov dword [rbx + 0x1c], 0
nop dword [rax]
mov qword [rax], 0xffffffffffffffff
add rax, 0x20
mov qword [rax - 0x18], 0xffffffffffffffff
mov dword [rax - 0x10], 0xffffffff
mov byte [rax - 0xc], 0
mov dword [rax - 8], 0
cmp rax, rdx
jne 0x2100b7c00
mov qword [r15 + 0x70], 0
mov qword [r15 + 0x78], 0
mov dword [r15 + 0x80], 0
mov byte [r15 + 0x84], 0
mov dword [r15 + 0x88], 0
jmp 0x2100b7bb0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rcx + 0x60]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov rcx, rsi
call sym.GetOverlappedResult
mov r8d, eax
xor eax, eax
test r8d, r8d
je 0x2100b7c97
mov dword [rbx + 4], eax
jmp 0x2100b7b95
call sym.GetLastError
jmp 0x2100b7c8f
Function at 0x2100b8b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
cmp dword [rcx + 0x18], 3
mov rsi, rcx
mov r14, rdx
mov r13d, r8d
mov ebp, r9d
je 0x2100b8d1f
xor edi, edi
test r13d, r13d
je 0x2100b8b6e
mov dword [rsi + 0x18], 0
mov edi, r13d
cmp r13d, 1
jne 0x2100b8b6e
mov eax, dword [rsi + 0x38]
mov edi, 1
test eax, 0x82000000
je 0x2100b8d4f
lea rbx, [rsi + 0x870]
nop dword [rax]
xor r9d, r9d
mov r8d, ebp
mov edx, edi
mov rcx, r14
call sym.WriteTapemark
mov dword [rsi + 4], eax
mov r12d, eax
cmp eax, 0x456
jne 0x2100b8c0a
mov dword [rsi + 8], 0
lea rax, [rsi + 0x70]
mov qword [rsi + 0x10], 0xffffffffffffffff
mov dword [rsi + 0x1c], 0
nop
mov qword [rax], 0xffffffffffffffff
add rax, 0x20
mov qword [rax - 0x18], 0xffffffffffffffff
mov dword [rax - 0x10], 0xffffffff
mov byte [rax - 0xc], 0
mov dword [rax - 8], 0
cmp rax, rbx
jne 0x2100b8bb0
mov qword [rsi + 0x70], 0
mov qword [rsi + 0x78], 0
mov dword [rsi + 0x80], 0
mov byte [rsi + 0x84], 0
mov dword [rsi + 0x88], 0
jmp 0x2100b8b78
mov rdi, qword [rsi + 0x10]
movsxd rbx, dword [rsi + 8]
test eax, eax
jne 0x2100b8c72
mov rax, rbx
mov edx, ebp
shl rax, 5
add rdi, rdx
add rax, rsi
mov qword [rsi + 0x10], rdi
add qword [rax + 0x70], rdx
mov edx, dword [rax + 0x80]
test edx, edx
js 0x2100b8c3f
add edx, ebp
mov dword [rax + 0x80], edx
shl rbx, 5
test r13d, r13d
mov qword [rsi + rbx + 0x78], 0
mov dword [rax + 0x88], 2
sete byte [rax + 0x84]
mov eax, r12d
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call method.mtinfo_drive.get_pos_void__int__long_
movsxd rax, dword [rsi + 8]
cmp eax, ebx
je 0x2100b8d6b
cmp eax, 0x3f
jg 0x2100b8cd5
shl rax, 5
mov rdx, qword [rsi + 0x10]
add rax, rsi
cmp qword [rax + 0x70], rdx
je 0x2100b8cd5
mov rdi, rdx
mov rcx, rdx
neg rdi
sbb r8, r8
neg rcx
sbb ecx, ecx
mov qword [rax + 0x70], rdx
mov qword [rax + 0x78], r8
mov dword [rax + 0x80], ecx
mov byte [rax + 0x84], 0
mov dword [rax + 0x88], 0
mov dword [rsi + 4], r12d
test byte [0x210273880], 1
je 0x2100b8c60
lea rax, str.write_marks
mov dword [rsp + 0x28], r12d
lea r9, str._s:_Win32_error__d
mov edx, 0x40
mov qword [rsp + 0x20], rax
lea r8, str.int_mtinfo_drive::error_const_char_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov r12d, dword [rsi + 4]
jmp 0x2100b8c60
mov rdx, qword [rcx + 0x60]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov rcx, r14
call sym.GetOverlappedResult
mov r8d, eax
xor eax, eax
test r8d, r8d
je 0x2100b8d64
mov dword [rsi + 4], eax
mov dword [rsi + 0x18], 2
jmp 0x2100b8b44
and eax, 0x88000000
cmp eax, 1
sbb edi, edi
add edi, 3
mov r13d, edi
jmp 0x2100b8b6e
call sym.GetLastError
jmp 0x2100b8d40
mov rdx, qword [rsi + 0x10]
cmp eax, 0x3f
jg 0x2100b8cd5
cmp rdx, rdi
je 0x2100b8cd5
mov rdi, rdx
mov rcx, rdx
neg rdi
sbb r8, r8
neg rcx
sbb ecx, ecx
shl rax, 5
add rax, rsi
jmp 0x2100b8cb6
Function at 0x2100b8f10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [rcx + 0x18], 3
mov rsi, rcx
mov r12, rdx
mov edi, r8d
mov ebp, r9d
je 0x2100b90d1
mov dword [rsi + 0x18], 0
xor r13d, r13d
cmp edi, 2
ja 0x2100b8f4e
movzx r13d, byte [rsi + 0x68]
shr r13b, 6
and r13d, 1
lea rbx, [rsi + 0x870]
nop dword [rax]
mov r8d, r13d
mov edx, edi
mov rcx, r12
call sym.PrepareTape
mov dword [rsi + 4], eax
mov r9d, eax
cmp eax, 0x456
jne 0x2100b8fea
mov dword [rsi + 8], 0
lea rax, [rsi + 0x70]
mov qword [rsi + 0x10], 0xffffffffffffffff
mov dword [rsi + 0x1c], 0
nop dword [rax]
mov qword [rax], 0xffffffffffffffff
add rax, 0x20
mov qword [rax - 0x18], 0xffffffffffffffff
mov dword [rax - 0x10], 0xffffffff
mov byte [rax - 0xc], 0
mov dword [rax - 8], 0
cmp rax, rbx
jne 0x2100b8f90
mov qword [rsi + 0x70], 0
mov qword [rsi + 0x78], 0
mov dword [rsi + 0x80], 0
mov byte [rsi + 0x84], 0
mov dword [rsi + 0x88], 0
jmp 0x2100b8f58
cmp edi, 5
ja case.default.0x2100b8ffd
lea rdx, [0x210294348]
movsxd rax, dword [rdx + rdi*4]
add rax, rdx
jmp rax
xor eax, eax
test r9d, r9d
setne al
mov dword [rsi + 0x1c], eax
test r9d, r9d
je 0x2100b901c
test byte [0x210273880], 1
jne 0x2100b90fa
mov eax, r9d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov dword [rsi + 8], 0
lea rax, [rsi + 0x70]
lea rdx, [rsi + 0x870]
mov qword [rsi + 0x10], 0xffffffffffffffff
mov dword [rsi + 0x1c], 0
nop dword [rax]
mov qword [rax], 0xffffffffffffffff
add rax, 0x20
mov qword [rax - 0x18], 0xffffffffffffffff
mov dword [rax - 0x10], 0xffffffff
mov byte [rax - 0xc], 0
mov dword [rax - 8], 0
cmp rdx, rax
jne 0x2100b9050
jmp case.default.0x2100b8ffd
mov eax, 1
test r9d, r9d
jne 0x2100b9007
movzx ebp, bpl
mov eax, 3
sub eax, ebp
jmp 0x2100b9007
movsxd rax, dword [rsi + 8]
shl rax, 5
add rax, rsi
mov qword [rax + 0x70], 0
mov qword [rax + 0x78], 0
mov dword [rax + 0x80], 0
mov byte [rax + 0x84], 0
mov dword [rax + 0x88], 0
jmp case.default.0x2100b8ffd
mov rdx, qword [rcx + 0x60]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov rcx, r12
call sym.GetOverlappedResult
mov r8d, eax
xor eax, eax
test r8d, r8d
je 0x2100b913e
mov dword [rsi + 4], eax
jmp 0x2100b8f32
lea rax, str.prepare
mov dword [rsp + 0x28], r9d
lea r8, str.int_mtinfo_drive::error_const_char_
mov edx, 0x40
mov qword [rsp + 0x20], rax
lea r9, str._s:_Win32_error__d
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov r9d, dword [rsi + 4]
mov eax, r9d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call sym.GetLastError
jmp 0x2100b90f2
Function at 0x2100bfd10
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
mov edx, dword [0x21024fa70]
mov rbx, rcx
lea rsi, [rsp + 0x38]
lea rbp, [rsp + 0x3c]
mov rcx, qword [rcx + 0x1e8]
lea rdi, [rsp + 0x40]
call sym.WaitForSingleObject
jmp 0x2100bfd71
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x2100bfd84
mov qword [rsp + 0x20], 0
mov rcx, qword [rbx + 0x258]
mov r9, rbp
mov rdx, rdi
mov r8d, 0x400
call sym.ReadFile
mov rdx, qword [rbx + 0x258]
mov rcx, rsi
call sym.bytes_available_unsigned_int__void_
test al, al
jne 0x2100bfd48
mov rcx, qword [rbx + 0x1f8]
call sym.ResetEvent
mov rax, qword [rbx + 0x1d8]
cmp byte [rax + 0xc8], 0
jne 0x2100bfdf3
lea rbp, [rsp + 0x3c]
lea rdi, [rsp + 0x40]
jmp 0x2100bfdd9
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x2100bfdec
mov qword [rsp + 0x20], 0
mov rcx, qword [rbx + 0x218]
mov r9, rbp
mov rdx, rdi
mov r8d, 0x400
call sym.ReadFile
mov rdx, qword [rbx + 0x218]
mov rcx, rsi
call sym.bytes_available_unsigned_int__void_
test al, al
jne 0x2100bfdb0
mov rax, qword [rbx + 0x1d8]
mov byte [rax + 0x129], 1
mov rcx, qword [rbx + 0x1e8]
call sym.ReleaseMutex
nop
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x2100c9470
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, qword [rcx + 0x1d8]
cmp byte [rax + 0x110], 0
je 0x2100c9490
movzx eax, byte [rax + 0x111]
ret
jmp method.fhandler_pty_slave.term_has_pcon_cap_wchar_t_const___clone_.part.0_
Function at 0x2100ceb50
Capabilities:
Get file attributes
Set file attributes

Disassembly:
and edx, 0xfffcffff
or edx, 0x10000
jmp method.fhandler_base.open_int__unsigned_int_

Function at 0x2100cf1a0
Capabilities:
Create directory

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0xc0]
mov dword [rcx + 0x20], edx
mov esi, edx
mov rdi, r8
lea r13, [rbp - 0x60]
mov qword [rcx + 0x28], r8
mov rbx, rcx
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 0
mov dword [rcx + 0x40], 0
call sym.get_shared_parent_dir__
mov r8d, esi
mov r9, rdi
mov rcx, r13
lea rdx, str.flock__08x__016X
mov r12, rax
lea rsi, [rbp - 0x90]
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
add rsp, 0xffffffffffffff80
mov edx, 0x20007
mov qword [rbp - 0x98], r13
add eax, eax
lea rcx, [rsp + 0x20]
mov dword [rbp - 0x90], 0x30
mov word [rbp - 0x9e], ax
mov word [rbp - 0xa0], ax
lea rax, [rbp - 0xa0]
mov qword [rbp - 0x88], r12
mov dword [rbp - 0x78], 0x82
mov qword [rbp - 0x80], rax
call sym._everyone_sd_void__unsigned_int_
lea rcx, [rbx + 0x30]
mov r8, rsi
mov edx, 0x20007
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 0
call sym.NtCreateDirectoryObject
test eax, eax
js 0x2100cf2de
mov rax, qword [rbx + 0x30]
add rsp, 0xffffffffffffff80
mov edx, 0x120001
mov dword [rbp - 0x90], 0x30
lea rcx, [rsp + 0x20]
mov dword [rbp - 0x78], 0x82
mov qword [rbp - 0x88], rax
lea rax, [0x2102981f0]
mov qword [rbp - 0x80], rax
call sym._everyone_sd_void__unsigned_int_
xor r9d, r9d
lea rcx, [rbx + 0x38]
mov r8, rsi
mov edx, 0x120001
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 0
call sym.NtCreateMutant
test eax, eax
js 0x2100cf2ec
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov edx, eax
lea rcx, str.NtCreateDirectoryObject_inode_:__y
call sym.api_fatal
mov edx, eax
lea rcx, str.NtCreateMutant_inode_:__y
call sym.api_fatal
nop
nop
nop dword [rax]
Function at 0x2100d0c00
Capabilities:
Create thread

Disassembly:
xor r8d, r8d
xor edx, edx
jmp method.lockf_t.del_lock_obj_void__bool_
Function at 0x2100d3090
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test dl, dl
je 0x2100d30a8
add rsp, 0x20
pop rbx
ret
lea rdx, [rcx + 0x38]
mov r9d, 0x10
lea rcx, [rcx + 0x30]
lea r8, [0x2102d1cc0]
call sym.CreatePipe
test eax, eax
je 0x2100d30ee
mov rcx, qword [rbx + 0x38]
mov r8d, 1
mov edx, 1
call sym.SetHandleInformation
test eax, eax
jne 0x2100d309c
mov rdx, qword [rbx + 0x38]
lea rcx, str.prefork:_couldnt_set_process_pipe__p__inherit_state___E
call sym.api_fatal
lea rcx, str.prefork:_couldnt_create_pipe_process_tracker___E
call sym.api_fatal
nop
nop
nop dword [rax]
Function at 0x2100d58d0
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x58
mov r9d, 8
mov qword [rdx], 0xffffffffffffffff
mov rbx, rdx
lea rdx, [rsp + 0x40]
mov rsi, rcx
mov dword [rsp + 0x20], 6
mov r8, rbx
call sym.NtQueryInformationFile
test eax, eax
js 0x2100d5910
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
ret
mov edx, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, str.WARNING:__y__NtQueryInformationFile___p__InternalInfo__io.Status__y_
lea r8, str.static_bool_dll_list::read_fii_HANDLE__PFILE_INTERNAL_INFORMATION_
mov qword [rsp + 0x28], rsi
lea rcx, [0x210273880]
mov dword [rsp + 0x30], edx
mov edx, 0x8000
call method.strace.prntf_unsigned_int__char_const__char_const__..._
xor eax, eax
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x58
pop rbx
pop rsi
ret
Function at 0x2100d5b50
Capabilities:
Set file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r15, qword [rcx + 0x90]
mov rsi, rcx
test r15, r15
je 0x2100d5de0
movzx eax, word [r15]
mov edx, 1
test ax, ax
je 0x2100d5d64
cmp dword [rcx + 0x58], 2
jg 0x2100d5da0
lea r10, [0x21023eea0]
mov rcx, r15
xor r8d, r8d
mov rdx, r10
jmp 0x2100d5bc4
mov word [rdx], ax
add rcx, 2
add rdx, 2
cmp ax, 0x3a
je 0x2100d5be0
movzx eax, word [rcx]
test ax, ax
je 0x2100d5be0
cmp word [rdx], 0x5c
jne 0x2100d5bb0
add r8d, 1
cmp r8d, 4
jle 0x2100d5bb0
nop dword [rax]
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov rcx, r10
mov word [rdx], ax
xor edx, edx
mov qword [rsp + 0x20], 0
call method.dll_list.ntopenfile_wchar_t_const__int__unsigned_int__unsigned_int__void_
mov qword [rbp - 0x18], rax
cmp rax, 0xffffffffffffffff
je 0x2100d5d80
mov rcx, r15
call sym.msys_2.0.dll_wcslen
lea r14d, [rax + rax + 0x18]
movsxd rbx, eax
movsxd rax, r14d
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.21021b550
sub rsp, rax
mov rdx, r15
add ebx, ebx
add rsi, 0x88
lea rax, [rsp + 0x54]
lea r13, [rsp + 0x40]
mov rcx, rax
mov qword [rbp - 0x20], rax
lea r15, [rbp - 0x10]
call sym.msys_2.0.dll_wcscpy
mov dword [r13 + 0x10], ebx
xor ebx, ebx
mov byte [r13], 0
mov qword [r13 + 8], 0
jmp 0x2100d5ca4
mov edx, r12d
cmp r12d, 0xc0000035
not edx
sete al
shr edx, 0x1f
or dl, al
jne 0x2100d5d54
cmp r12d, 0xc0190003
jne 0x2100d5d88
test ebx, ebx
jne 0x2100d5d88
mov ebx, 0x100
mov rax, qword [rbp - 0x18]
mov r9d, ebx
mov r8d, 0x2000
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call method.dll_list.ntopenfile_wchar_t_const__int__unsigned_int__unsigned_int__void_
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x2100d5d88
mov r9d, r14d
mov r8, r13
mov rdx, r15
mov rcx, rax
mov dword [rsp + 0x20], 0xb
call sym.NtSetInformationFile
mov rcx, rdi
mov r12d, eax
call sym.NtClose
lea rax, [0x210273880]
test byte [rax], 1
je 0x2100d5c70
mov eax, dword [rbp - 0x10]
mov qword [rsp + 0x28], rdi
mov edx, 0x40
lea r9, str._y__NtSetInformationFile___p__FileLink__W__iosb.Status__y_
mov dword [rsp + 0x20], r12d
lea r8, str.bool_dll::create_forkable__
lea rcx, [0x210273880]
mov dword [rsp + 0x38], eax
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x30], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov edx, r12d
not edx
shr edx, 0x1f
cmp r12d, 0xc0000035
sete al
or dl, al
je 0x2100d5c8a
mov rcx, qword [rbp - 0x18]
mov byte [rbp - 0x20], dl
call sym.NtClose
movzx edx, byte [rbp - 0x20]
mov eax, edx
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor edx, edx
jmp 0x2100d5d64
mov rcx, qword [rbp - 0x18]
xor edx, edx
mov byte [rbp - 0x20], dl
call sym.NtClose
movzx edx, byte [rbp - 0x20]
jmp 0x2100d5d64
mov edx, 0x5c
mov rcx, r15
call sym.msys_2.0.dll_wcsrchr
mov rbx, rax
test rax, rax
je 0x2100d5d80
xor edx, edx
mov rcx, r15
mov word [rax], dx
mov edx, 1
call sym.mkdirs_wchar_t__int_
mov ecx, 0x5c
mov word [rbx], cx
test al, al
je 0x2100d5d80
movzx eax, word [r15]
jmp 0x2100d5b94
mov edx, 1
jmp 0x2100d5d64
Function at 0x2100daa20
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r15d, dword [rsp + 0xb8]
sub r15d, dword [rsp + 0xb0]
mov r13, r8
mov r8d, dword [0x21034b048]
mov eax, r9d
mov r12, rdx
xor edx, edx
mov rbx, rax
mov rbp, rcx
div r8
mov r14d, eax
imul r14d, r8d
sub ebx, r14d
mov edi, ebx
cmp r15d, r8d
jbe 0x2100dab30
add edi, dword [rsp + 0xb0]
mov eax, edi
mov r9d, r14d
xor r8d, r8d
mov edx, 4
mov qword [rsp + 0x20], rax
mov rcx, r13
call sym.MapViewOfFile
mov r9, rax
test rax, rax
je 0x2100dab90
mov eax, ebx
cmp r15d, dword [0x21034b048]
mov esi, r14d
lea r10, [r9 + rax]
mov qword [rsp + 0x38], rax
mov rax, qword [r12]
mov qword [rbp], r10
jbe 0x2100dab0b
mov ecx, dword [r10 + 0x10]
test ecx, ecx
je 0x2100dab0b
mov r15d, 0x100
mov r11d, edi
sub r15d, eax
sub r15d, r14d
nop dword [rax + rax]
mov edx, dword [r10 + 0xc]
mov ecx, dword [r10 + 0xc]
mov r8d, r11d
sub rdx, rax
add ecx, r15d
sub rdx, rsi
add rdx, 0xff
cmp rdx, r8
cmovge r11d, ecx
mov edx, dword [r10 + 0x24]
add r10, 0x14
test edx, edx
jne 0x2100daad8
cmp r11d, edi
ja 0x2100dab40
add rax, rsi
mov qword [r12], rax
mov rax, r9
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add edi, dword [rsp + 0xb8]
jmp 0x2100daa77
add ebx, dword [rsp + 0xb8]
mov rcx, r9
cmp ebx, r11d
cmova ebx, r11d
call sym.UnmapViewOfFile
mov r9d, r14d
xor r8d, r8d
mov edx, 4
mov eax, ebx
mov rcx, r13
mov qword [rsp + 0x20], rax
call sym.MapViewOfFile
mov r9, rax
test rax, rax
je 0x2100dab90
mov rax, qword [rsp + 0x38]
add rax, r9
mov qword [rbp], rax
mov rax, qword [r12]
jmp 0x2100dab0b
xor r9d, r9d
jmp 0x2100dab12