joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc40
mov rax, qword [0x14000e1e0]
xor rax, rsp
mov qword [rsp + 0xc30], rax
mov rbx, rdx
mov rdi, rcx
lea rdx, str.postgres_9.6
mov rcx, rbx
call sub.MSVCR120.dll_strcmp
test eax, eax
je 0x140001bb6
lea rdx, [0x140009235]
xor ecx, ecx
call fcn.140006000
lea rdx, [rsp + 0x830]
mov rcx, rdi
call fcn.140001ce0
test eax, eax
js 0x140001cac
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140003be0
lea rdx, [rsp + 0x430]
mov rcx, rbx
call qword [sym.imp.libintl.dll_libintl_bindtextdomain]
mov rcx, rbx
call qword [sym.imp.libintl.dll_libintl_textdomain]
lea rcx, str.PGLOCALEDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x140001c4a
lea r9, [rsp + 0x430]
lea r8, str.PGLOCALEDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.140004140
lea rcx, [rsp + 0x2c]
call fcn.1400032c0
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
mov rcx, rax
call fcn.140005ba0
lea rcx, str.PGSYSCONFDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x140001cac
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140003ac0
lea r9, [rsp + 0x430]
lea r8, str.PGSYSCONFDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.140004140
lea rcx, [rsp + 0x2d]
call fcn.1400032c0
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
mov rcx, rax
call fcn.140005ba0
mov rcx, qword [rsp + 0xc30]
xor rcx, rsp
call fcn.140006cd0
mov rbx, qword [rsp + 0xc60]
add rsp, 0xc40
pop rdi
ret
Function at 0x140002b90
Capabilities:
Read file on windows
Terminate process

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x440
mov rax, qword [0x14000e1e0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
mov ecx, pe_nt_image_headers64
mov rbp, rdx
call fcn.140002f80
lea r8, str._s_global_pg_control
lea rcx, [rsp + 0x30]
mov r9, rbx
mov edx, 0x400
mov rdi, rax
call fcn.140004140
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.MSVCR120.dll__open]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140002c3f
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR120.dll_strerror]
lea rcx, str._s:_could_not_open_file___s__for_reading:__s_n
mov rbx, rax
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rdi, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea r9, [rsp + 0x30]
lea rcx, [rax + 0x60]
mov r8, rbp
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call fcn.140004360
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
mov r8d, pe_nt_image_headers64
mov rdx, rdi
mov ecx, eax
mov qword [rsp + 0x470], rsi
call qword [sym.imp.MSVCR120.dll__read]
mov esi, eax
cmp eax, 0x108
je 0x140002cf7
test eax, eax
jns 0x140002cb5
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR120.dll_strerror]
lea rcx, str._s:_could_not_read_file___s_:__s_n
mov rbx, rax
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rdi, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea r9, [rsp + 0x30]
lea rcx, [rax + 0x60]
mov r8, rbp
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call fcn.140004360
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
lea rcx, str._s:_could_not_read_file___s_:_read__d_of__d_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea r9, [rsp + 0x30]
lea rcx, [rax + 0x60]
mov r8, rbp
mov rdx, rbx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], esi
call fcn.140004360
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
mov ecx, ebx
call qword [sym.imp.MSVCR120.dll__close]
mov r8d, 0x100
mov rdx, rdi
or ecx, 0xffffffff
call qword [0x14000e1d8]
not eax
cmp eax, dword [rdi + 0x100]
je 0x140002d30
lea rcx, str.WARNING:_Calculated_CRC_checksum_does_not_match_value_stored_in_file._nEither_the_file_is_corrupt__or_it_has_a_different_layout_than_this_program_nis_expecting.__The_results_below_are_untrustworthy._n_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rcx, rax
call fcn.140004390
mov ecx, dword [rdi + 8]
test cx, cx
jne 0x140002d55
test ecx, 0xffff0000
je 0x140002d55
lea rcx, str.WARNING:_possible_byte_ordering_mismatch_nThe_byte_ordering_used_to_store_the_pg_control_file_might_not_match_the_one_nused_by_this_program.__In_that_case_the_results_below_would_be_incorrect__and_nthe_PostgreSQL_installation_would_be_incompatible_with_this_data_directory._n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rcx, rax
call fcn.140004390
mov rax, rdi
mov rsi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140006cd0
add rsp, 0x440
pop rdi
pop rbp
pop rbx
ret
Function at 0x140002e30
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x140002e69
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004360
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
call qword [sym.imp.MSVCR120.dll__strdup]
test rax, rax
jne 0x140002ea2
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004360
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
add rsp, 0x20
pop rbx
ret
jmp 0x140002e30

Function at 0x140002f70
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x140002e69
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004360
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
call qword [sym.imp.MSVCR120.dll__strdup]
test rax, rax
jne 0x140002ea2
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004360
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
add rsp, 0x20
pop rbx
ret
jmp 0x140002e30

Function at 0x140002f80
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x140003040
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400030ab
test sil, 2
jne 0x1400030a7
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004360
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x140003111
test sil, 4
je 0x14000310e
test al, 3
jne 0x140003101
test bl, 3
jne 0x140003101
cmp rbx, 0x400
ja 0x140003101
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x14000310e
nop dword [rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x1400030f0
jmp 0x14000310e
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140003040
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x140003040
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400030ab
test sil, 2
jne 0x1400030a7
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004360
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x140003111
test sil, 4
je 0x14000310e
test al, 3
jne 0x140003101
test bl, 3
jne 0x140003101
cmp rbx, 0x400
ja 0x140003101
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x14000310e
nop dword [rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x1400030f0
jmp 0x14000310e
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140004240
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x14000e1e0]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x140004285
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0x16
or eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140006cd0
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x30], rax
call fcn.140004450
mov rdi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x140004323
test rdi, rdi
je 0x140004323
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [rsp + 0x40]
movzx ebx, bl
add ecx, eax
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x140004327
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
or eax, 0xffffffff
test bl, bl
mov rbx, qword [rsp + 0x470]
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140006cd0
add rsp, 0x478
ret

Function at 0x1400043e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140004432
test rdi, rdi
je 0x140004432
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x140004435
mov byte [rbx + 0x24], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140004d50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp dword [rsp + 0x50], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], r14
mov r14, rcx
mov edi, r8d
je 0x140004d95
movsxd rax, r9d
mov rbp, rcx
test r9d, r9d
je 0x140004d91
nop dword [rax]
dec rax
cmp byte [rbp], 0
je 0x140004d91
inc rbp
test rax, rax
jne 0x140004d80
sub ebp, ecx
jmp 0x140004da9
or rbp, 0xffffffffffffffff
nop dword [rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x140004da0
sub edi, ebp
mov eax, 0
cmovs edi, eax
test edx, edx
je 0x140004db9
neg edi
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x140004e28
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140004e19
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x140004e19
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140004de6
inc dword [rbx + 0x20]
jmp 0x140004e22
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140004e12
test rsi, rsi
je 0x140004e12
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x140004e12
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec edi
test edi, edi
jg 0x140004dc7
mov r8, rbx
mov edx, ebp
mov rcx, r14
call fcn.140005600
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x140004eb0
neg edi
movsxd rsi, edi
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140004ea2
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x140004ea2
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140004e6f
inc dword [rbx + 0x20]
jmp 0x140004eab
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140004e9b
test rdi, rdi
je 0x140004e9b
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x140004e9b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x140004e50
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140004f40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x80
mov rax, qword [0x14000e1e0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xd0]
xor ebp, ebp
movsx eax, dl
add eax, 0xffffffa8
mov r10, rcx
lea r11, str.0123456789abcdef
mov dword [rsp + 0x24], ebp
mov esi, ebp
cmp eax, 0x20
ja case.0x140004fa5.89
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x5198]
mov ecx, dword [rdx + rax*4 + 0x5180]
add rcx, rdx
jmp rcx
mov ecx, 0xa
test r10, r10
jns 0x140004fbe
mov dword [rsp + 0x24], 0x2d
neg r10
jmp 0x140004fe7
test r8d, r8d
je 0x140004fe7
mov dword [rsp + 0x24], 0x2b
jmp 0x140004fe7
mov ecx, 8
jmp 0x140004fe7
mov ecx, 0xa
jmp 0x140004fe7
lea r11, str.0123456789ABCDEF
mov ecx, 0x10
mov qword [rsp + 0x90], rdi
mov edi, dword [rsp + 0xc0]
test r10, r10
jne 0x140005008
cmp dword [rsp + 0xc8], esi
je 0x140005008
test edi, edi
je 0x14000502f
lea r8, [rsp + 0x30]
nop dword [rax]
xor edx, edx
mov rax, r10
inc esi
div rcx
lea r8, [r8 + 1]
mov r10, rax
movzx eax, byte [rdx + r11]
mov byte [r8 - 1], al
test r10, r10
jne 0x140005010
mov eax, dword [rsp + 0xb0]
sub edi, esi
cmovs edi, ebp
sub eax, edi
sub eax, esi
cmovs eax, ebp
mov dword [rsp + 0x20], eax
test r9d, r9d
je 0x140005051
neg eax
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0xb8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
mov r9, rbx
call fcn.140005780
test edi, edi
jle 0x1400050a0
nop
mov rax, qword [rbx + 0x10]
dec edi
test rax, rax
je 0x140005093
cmp qword [rbx], rax
jb 0x140005093
cmp qword [rbx + 0x18], rbp
jne 0x14000508b
inc dword [rbx + 0x20]
jmp 0x14000509c
mov rcx, rbx
call fcn.1400043e0
mov rax, qword [rbx]
mov byte [rax], 0x30
inc qword [rbx]
test edi, edi
jg 0x140005070
movsxd rdi, esi
test esi, esi
jle 0x1400050e7
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
movsx esi, byte [rsp + rdi + 0x2f]
dec rdi
test rax, rax
je 0x1400050d9
cmp qword [rbx], rax
jb 0x1400050d9
cmp qword [rbx + 0x18], rbp
jne 0x1400050d1
inc dword [rbx + 0x20]
jmp 0x1400050e2
mov rcx, rbx
call fcn.1400043e0
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
test rdi, rdi
jg 0x1400050b0
mov eax, dword [rsp + 0x20]
test eax, eax
jns 0x140005154
neg eax
movsxd rsi, eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005146
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x140005146
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140005113
inc dword [rbx + 0x20]
jmp 0x14000514f
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], bpl
jne 0x14000513f
test rdi, rdi
je 0x14000513f
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000513f
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x1400050f4
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140006cd0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x1400051c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor eax, eax
lea edi, [r8 - 1]
mov qword [rsp + 0x30], rbp
test edi, edi
mov rbx, r9
mov ebp, ecx
cmovs edi, eax
test edx, edx
je 0x1400051e5
neg edi
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x140005251
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005242
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x140005242
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x14000520f
inc dword [rbx + 0x20]
jmp 0x14000524b
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000523b
test rsi, rsi
je 0x14000523b
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x14000523b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec edi
test edi, edi
jg 0x1400051f0
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005273
cmp qword [rbx], rax
jb 0x140005273
cmp qword [rbx + 0x18], 0
jne 0x14000526b
inc dword [rbx + 0x20]
jmp 0x14000527c
mov rcx, rbx
call fcn.1400043e0
mov rax, qword [rbx]
mov byte [rax], bpl
inc qword [rbx]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x1400052f0
neg edi
movsxd rsi, edi
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400052e2
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x1400052e2
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x1400052af
inc dword [rbx + 0x20]
jmp 0x1400052eb
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x1400052db
test rdi, rdi
je 0x1400052db
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x1400052db
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x140005290
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005600
Capabilities:
Write file on windows

Disassembly:
test edx, edx
jle 0x1400056c9
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov qword [rsp + 0x30], rsi
mov rbx, r8
mov ebp, edx
mov qword [rsp + 0x38], rdi
mov r14, rcx
nop word [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x14000563e
mov eax, dword [rbx + 0x10]
sub eax, dword [rbx]
jmp 0x140005640
mov eax, ebp
test eax, eax
jg 0x140005685
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x1400056ac
mov rcx, qword [rbx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000567c
test rdi, rdi
je 0x14000567c
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000567c
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x1400056a6
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
cmovl esi, eax
mov rdx, r14
movsxd rdi, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_memmove]
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x140005630
jmp 0x1400056af
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140005780
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp dword [r8], 0
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov esi, ecx
jle 0x1400057f8
test ecx, ecx
je 0x1400057f8
mov ecx, dword [rdx]
test ecx, ecx
je 0x1400057c1
mov rdx, rbx
call fcn.1400056d0
dec dword [rdi]
mov dword [r14], 0
cmp dword [rdi], 0
jle 0x1400057f8
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400057e8
cmp qword [rbx], rax
jb 0x1400057e8
cmp qword [rbx + 0x18], 0
jne 0x1400057e0
inc dword [rbx + 0x20]
jmp 0x1400057f1
mov rcx, rbx
call fcn.1400043e0
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
dec dword [rdi]
cmp dword [rdi], 0
jg 0x1400057c6
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jle 0x14000586d
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005856
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x140005856
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140005823
inc dword [rbx + 0x20]
jmp 0x14000585f
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000584f
test rsi, rsi
je 0x14000584f
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x14000584f
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec dword [rdi]
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jg 0x140005804
mov esi, dword [r14]
test esi, esi
je 0x1400058af
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005896
cmp qword [rbx], rax
jb 0x140005896
cmp qword [rbx + 0x18], 0
jne 0x14000588e
inc dword [rbx + 0x20]
jmp 0x14000589f
mov rcx, rbx
call fcn.1400043e0
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
mov eax, dword [rdi]
test eax, eax
jle 0x1400058a9
dec eax
jmp 0x1400058ad
jns 0x1400058af
inc eax
mov dword [rdi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140005ba0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
cmp qword [str.msvcrt], 0
mov rsi, rcx
je 0x140005c50
mov qword [rsp + 0x30], rbp
lea rbp, str.msvcrt
mov qword [rsp + 0x38], rdi
xor edi, edi
mov rcx, rbp
mov ebx, edi
mov rax, qword [rbx + rbp + 0x10]
test rax, rax
jne 0x140005c27
cmp qword [rbx + rbp + 8], rax
jne 0x140005c2c
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbx + rbp + 8], rax
test rax, rax
jne 0x140005c02
mov qword [rbx + rbp + 8], 0xffffffffffffffff
jmp 0x140005c2c
lea rdx, [0x140009a00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + rbp + 0x10], rax
test rax, rax
jne 0x140005c27
mov qword [rbx + rbp + 8], 0xffffffffffffffff
jmp 0x140005c2c
mov rcx, rsi
call rax
inc rdi
lea rcx, [rdi + rdi*2]
lea rbx, [rcx*8]
cmp qword [rbx + rbp], 0
lea rcx, [rbx + rbp]
jne 0x140005bd3
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll__strdup]
mov rbx, rax
test rax, rax
je 0x140005c80
mov edx, 0x3d
mov rcx, rax
call qword [sym.imp.MSVCR120.dll_strchr]
mov rdx, rax
test rax, rax
jne 0x140005c8e
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_free]
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov byte [rax], 0
inc rdx
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140005ca0
test rax, rax
je 0x140005cbb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140005c77
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_free]
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.MSVCR120.dll__putenv]

Function at 0x140015fdd
Capabilities:
Resolve function by hash

Disassembly:
movabs eax, dword fs:[0xc78c08500000030]
mov eax, dword [rax + 0xc]
mov esi, dword [rax + 0x1c]
lodsd eax, dword [rsi]
mov ebx, dword [rax + 8]
jmp 0x140015ffc
pop rsi
add esi, 3
push rbx
mov edx, 0xec0e4e8e
call rsi
push rax
mov edx, 0x7c0dfcaa
call rsi
push rax
push rdi
mov edx, 0x4ee4a045
call rsi
xor edx, edx
push rdx
push 0x6d756369
push 0x6c656167
push rsp
push rdx
push rdx
call rax
push rax
mov edx, 0x75da1966
call rsi
call rax
xchg edi, eax
mov edx, 0xffd97fb
call rsi
call rax
cmp edi, 0xb7
jne 0x14001604b
mov esp, ebp
invalid
call fcn.14001606c
sti
xchg edi, eax
std
pcmpeqd mm5, qword [rbp - 0x50]
jb 0x140016058
jb 0x140016058
mov bl, 0x16
movabs eax, dword [0xd368a7c7d2d83d6a]
invalid