joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c0f50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1401c0f50
push rbp
push r15
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r15, rcx
call fcn.140004db3
mov ecx, dword [0x1407630c0]
xor eax, eax
lea rdx, [0x140000000]
mov r8d, dword [r15]
and r8d, ecx
mov dword [0x14072db60], r8d
mov r9d, r8d
shr r9d, 0x1e
xor r8d, r9d
imul r8d, r8d, 0x6c078965
lea r11d, [r8 + rax*2 + 1]
and r11d, ecx
mov r10d, r11d
shr r10d, 0x1e
mov dword [rdx + rax*8 + 0x72db64], r11d
xor r11d, r10d
imul r15d, r11d, 0x6c078965
lea r8d, [r15 + rax*2 + 2]
and r8d, ecx
mov dword [rdx + rax*8 + 0x72db68], r8d
inc rax
cmp rax, 0x137
jb 0x1401c0f80
mov edx, dword [0x14072e518]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul r8d, edx, 0x6c078965
add r8d, 0x26f
and ecx, r8d
mov dword [0x14072e51c], ecx
mov dword [0x140710920], 0x270
mov dword [0x140710924], 0x75bcd15
lea rsp, [rbp + 8]
pop r15
pop rbp
ret

Function at 0x1401caf20
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401caf20
push rbp
push rsi
push rdi
push r12
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov r12, rcx
mov al, 0x20
lea rdi, [0x140000000]
mov dword [0x140898f1c], 0
mov byte [0x140761848], 0x43
movsxd r9, dword [r12]
mov dword [0x140761844], r9d
mov byte [0x140761849], 0x4c
mov byte [0x14076184a], 0x4f
mov byte [0x14076184b], 0x53
mov byte [0x14076184c], 0x45
mov byte [0x14076184d], al
mov byte [0x14076184e], al
mov byte [0x14076184f], al
cmp r9, 0x32
ja 0x1401cb083
imul rax, r9, 0x138
mov rsi, qword [rdi + rax + 0x75da18]
cmp rsi, 0xffffffffffffffff
je 0x1401cafea
mov rdx, qword [rdi + rax + 0x75da30]
test rdx, rdx
je 0x1401cafea
cmp dword [rdi + rax + 0x75da3c], 0
je 0x1401cafea
mov r8d, dword [rdi + rax + 0x75da20]
test r8d, r8d
je 0x1401cafea
mov rax, rsp
mov rcx, rsi
lea r9, [rbp]
mov qword [rax + 0x20], 0
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x1401cb08d
movsxd r9, dword [r12]
imul r10, r9, 0x138
mov r11, rsp
lea rcx, [rdi + r10 + 0x75da4c]
mov edx, 0x104
lea r8, [0x1404eb6ec]
mov r9d, 1
xor eax, eax
mov dword [rcx - 0x2c], eax
mov dword [rcx - 0x28], eax
mov dword [rcx - 0x24], eax
mov dword [rcx - 0x10], eax
mov qword [r11 + 0x20], 0
call fcn.1400025f4
movsxd rax, dword [r12]
imul rdx, rax, 0x138
mov dword [rdi + rdx + 0x75da48], 0
lea rcx, [rdi + rdx + 0x75da30]
cmp qword [rcx], 0
je 0x1401cb052
call fcn.140003643
cmp rsi, 0xffffffffffffffff
je 0x1401cb060
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
movsxd rax, dword [r12]
imul rdx, rax, 0x138
mov qword [rdi + rdx + 0x75da18], 0xffffffffffffffff
mov qword [rdi + rdx + 0x75da30], 0
lea rsp, [rbp + 8]
pop r12
pop rdi
pop rsi
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
mov dword [0x140898f1c], eax
movsxd r9, dword [r12]
jmp 0x1401cafea
Function at 0x14023a9e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rbp]
pop rbp
jmp fcn.1400041ba

Function at 0x14023aa00
Capabilities:
Get file size

Disassembly:
jmp 0x14023aa00
push rbp
push r13
push r14
sub rsp, 0x170
lea rbp, [rsp + 0x40]
mov r9, rdx
mov r8, rcx
lea rcx, [rbp]
mov edx, 0x12c
call fcn.1400042eb
mov rax, rsp
lea rcx, [0x140683000]
mov edx, 0x105
lea r8, [rbp]
mov r9d, 0x12c
mov qword [rax + 0x20], 0
call fcn.1400025f4
mov rax, rsp
lea rcx, [0x140683000]
mov edx, 0x80000000
mov r8d, 3
xor r9d, r9d
mov dword [rax + 0x20], 3
mov dword [rax + 0x28], 0x80
mov qword [rax + 0x30], 0
call sub.KERNEL32.dll_CreateFileA
mov r13, rax
cmp r13, 0xffffffffffffffff
jne 0x14023aa8c
xor r14d, r14d
jmp 0x14023aab2
mov rcx, r13
lea rdx, [rbp + 0x12c]
call sub.KERNEL32.dll_GetFileSize
mov r14d, eax
cmp r14d, 0xffffffff
je 0x14023aac2
mov rcx, r13
call sub.KERNEL32.dll_CloseHandle
mov dword [rbp + 0x12c], eax
mov eax, r14d
lea rsp, [rbp + 0x130]
pop r14
pop r13
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
xor r14d, r14d
test eax, eax
sete r14b
jmp 0x14023aaa4
Function at 0x1402a7ee0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1402a7ee0
push rbp
push r12
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r12, [0x140000000]
cmp dword [0x140710924], 0x75bcd15
je 0x1402a7f0b
lea rcx, [0x1405091a0]
call fcn.1400041ba
mov edx, dword [0x140710920]
cmp edx, 0x270
jl 0x1402a808f
mov r8d, dword [0x1407630e0]
xor eax, eax
mov ecx, dword [0x1407630e4]
nop dword [rax]
mov r9d, ecx
mov edx, dword [r12 + rax*8 + 0x72db64]
and r9d, edx
mov r10d, dword [r12 + rax*8 + 0x72db60]
and edx, r8d
and r10d, r8d
or r10d, r9d
mov r11d, r10d
and r10d, 1
mov r9d, dword [r12 + rax*8 + 0x72db68]
shr r11d, 1
and r9d, ecx
xor r11d, dword [r12 + rax*8 + 0x72e194]
or edx, r9d
xor r11d, dword [r12 + r10*4 + 0x763100]
mov r10d, edx
shr r10d, 1
and edx, 1
xor r10d, dword [r12 + rax*8 + 0x72e198]
xor r10d, dword [r12 + rdx*4 + 0x763100]
mov dword [r12 + rax*8 + 0x72db60], r11d
mov dword [r12 + rax*8 + 0x72db64], r10d
inc rax
cmp rax, 0x71
jb 0x1402a7f30
mov edx, dword [0x14072dee8]
mov eax, dword [0x14072deec]
and edx, r8d
and eax, ecx
or edx, eax
mov r9d, edx
and edx, 1
shr r9d, 1
xor r9d, dword [0x14072e51c]
xor r9d, dword [r12 + rdx*4 + 0x763100]
xor edx, edx
mov dword [0x14072dee8], r9d
nop dword [rax]
mov r9d, ecx
mov eax, dword [r12 + rdx*8 + 0x72def0]
and r9d, eax
mov r10d, dword [r12 + rdx*8 + 0x72deec]
and eax, r8d
and r10d, r8d
or r10d, r9d
mov r11d, r10d
and r10d, 1
mov r9d, dword [r12 + rdx*8 + 0x72def4]
shr r11d, 1
and r9d, ecx
xor r11d, dword [r12 + rdx*8 + 0x72db60]
or eax, r9d
xor r11d, dword [r12 + r10*4 + 0x763100]
mov r10d, eax
shr r10d, 1
and eax, 1
xor r10d, dword [r12 + rdx*8 + 0x72db64]
xor r10d, dword [r12 + rax*4 + 0x763100]
mov dword [r12 + rdx*8 + 0x72deec], r11d
mov dword [r12 + rdx*8 + 0x72def0], r10d
inc rdx
cmp rdx, 0xc6
jb 0x1402a7fe0
mov eax, dword [0x14072e51c]
and eax, r8d
mov r8d, dword [0x14072db60]
and r8d, ecx
or eax, r8d
mov edx, eax
and eax, 1
shr edx, 1
xor edx, dword [0x14072e190]
xor edx, dword [r12 + rax*4 + 0x763100]
mov dword [0x14072e51c], edx
xor edx, edx
movsxd rdx, edx
mov eax, dword [r12 + rdx*4 + 0x72db60]
mov ecx, eax
shr ecx, 0xb
inc edx
xor eax, ecx
mov r8d, eax
shl r8d, 7
and r8d, dword [0x1407630ec]
xor eax, r8d
mov r9d, eax
shl r9d, 0xf
and r9d, dword [0x1407630f0]
xor eax, r9d
mov r10d, eax
shr r10d, 0x12
xor eax, r10d
mov dword [0x140710920], edx
lea rsp, [rbp + 8]
pop r12
pop rbp
ret
Function at 0x1402e09d0
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1402e09d0
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x20]
movsxd rax, dword [rdx]
test rax, rax
jle 0x1402e0a38
mov dl, byte [rax + rcx - 1]
cmp dl, 0xa
je 0x1402e0a5f
cmp dl, 0xd
je 0x1402e0a58
mov edx, 1
mov qword [rbp + 0x10], rbx
mov rbx, rax
mov qword [rbp + 8], rsi
mov rsi, rdx
mov qword [rbp], rdi
mov rdi, rcx
mov edx, 0x102
xor r9d, r9d
mov rcx, qword [0x1407619c8]
movsx r8, byte [rsi + rdi - 1]
call sub.USER32.dll_SendMessageA
inc rsi
cmp rsi, rbx
jle 0x1402e0a0a
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 8]
mov rdi, qword [rbp]
mov edx, 0x102
mov r8d, 0xd
xor r9d, r9d
mov rcx, qword [0x1407619c8]
call sub.USER32.dll_SendMessageA
lea rsp, [rbp + 0x20]
pop rbp
ret
dec rax
jle 0x1402e0a38
jmp 0x1402e09f0
dec rax
jle 0x1402e0a38
mov dl, byte [rax + rcx - 1]
jmp 0x1402e09eb

Function at 0x1402e09f0
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1402e09d0
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x20]
movsxd rax, dword [rdx]
test rax, rax
jle 0x1402e0a38
mov dl, byte [rax + rcx - 1]
cmp dl, 0xa
je 0x1402e0a5f
cmp dl, 0xd
je 0x1402e0a58
mov edx, 1
mov qword [rbp + 0x10], rbx
mov rbx, rax
mov qword [rbp + 8], rsi
mov rsi, rdx
mov qword [rbp], rdi
mov rdi, rcx
mov edx, 0x102
xor r9d, r9d
mov rcx, qword [0x1407619c8]
movsx r8, byte [rsi + rdi - 1]
call sub.USER32.dll_SendMessageA
inc rsi
cmp rsi, rbx
jle 0x1402e0a0a
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 8]
mov rdi, qword [rbp]
mov edx, 0x102
mov r8d, 0xd
xor r9d, r9d
mov rcx, qword [0x1407619c8]
call sub.USER32.dll_SendMessageA
lea rsp, [rbp + 0x20]
pop rbp
ret
dec rax
jle 0x1402e0a38
jmp 0x1402e09f0
dec rax
jle 0x1402e0a38
mov dl, byte [rax + rcx - 1]
jmp 0x1402e09eb

Function at 0x1402e0a38
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1402e09d0
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x20]
movsxd rax, dword [rdx]
test rax, rax
jle 0x1402e0a38
mov dl, byte [rax + rcx - 1]
cmp dl, 0xa
je 0x1402e0a5f
cmp dl, 0xd
je 0x1402e0a58
mov edx, 1
mov qword [rbp + 0x10], rbx
mov rbx, rax
mov qword [rbp + 8], rsi
mov rsi, rdx
mov qword [rbp], rdi
mov rdi, rcx
mov edx, 0x102
xor r9d, r9d
mov rcx, qword [0x1407619c8]
movsx r8, byte [rsi + rdi - 1]
call sub.USER32.dll_SendMessageA
inc rsi
cmp rsi, rbx
jle 0x1402e0a0a
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 8]
mov rdi, qword [rbp]
mov edx, 0x102
mov r8d, 0xd
xor r9d, r9d
mov rcx, qword [0x1407619c8]
call sub.USER32.dll_SendMessageA
lea rsp, [rbp + 0x20]
pop rbp
ret
dec rax
jle 0x1402e0a38
jmp 0x1402e09f0
dec rax
jle 0x1402e0a38
mov dl, byte [rax + rcx - 1]
jmp 0x1402e09eb
Function at 0x140312930
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
jmp 0x140312930
push rbp
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x30]
lea rdx, [0x1406e2aa0]
mov rbx, rcx
call sub.KERNEL32.dll_FindFirstFileA
mov rcx, rax
cmp rcx, 0xffffffffffffffff
je 0x140312a24
xor edx, edx
lea rax, [0x1406e2acc]
mov qword [rbp + 0x10], rsi
mov rsi, rbx
mov qword [rbp + 8], rdi
mov rbx, rax
mov qword [rbp], r12
mov r12, rdx
mov rdi, rcx
mov r10, rsp
mov rcx, rsi
mov edx, 0x104
lea r8, [0x140517934]
mov r9d, 1
mov dword [r10 + 0x20], 0
call fcn.140006019
mov edx, 2
lea rcx, [rbp + 0x18]
movsxd rax, eax
lea r8, [0x1406e2be0]
dec rax
mov qword [rcx], rsi
cmovle rax, r12
mov r9d, 0x104
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], 0x104
call fcn.1400048cc
lea rcx, [0x1406e2be0]
call sub.KERNEL32.dll_DeleteFileA
mov rcx, rdi
lea rdx, [0x1406e2aa0]
call sub.KERNEL32.dll_FindNextFileA
movsxd rcx, eax
test rcx, rcx
jne 0x1403129fd
xor r8b, r8b
jmp 0x140312a05
call sub.KERNEL32.dll_FindClose
mov r8b, 0xff
test r8b, 1
jne 0x140312978
mov rcx, rdi
mov rsi, qword [rbp + 0x10]
mov rdi, qword [rbp + 8]
mov r12, qword [rbp]
call sub.KERNEL32.dll_FindClose
nop
xor eax, eax
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret

Function at 0x140312957
Capabilities:
Delete file

Disassembly:
jmp 0x140312930
push rbp
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x30]
lea rdx, [0x1406e2aa0]
mov rbx, rcx
call sub.KERNEL32.dll_FindFirstFileA
mov rcx, rax
cmp rcx, 0xffffffffffffffff
je 0x140312a24
xor edx, edx
lea rax, [0x1406e2acc]
mov qword [rbp + 0x10], rsi
mov rsi, rbx
mov qword [rbp + 8], rdi
mov rbx, rax
mov qword [rbp], r12
mov r12, rdx
mov rdi, rcx
mov r10, rsp
mov rcx, rsi
mov edx, 0x104
lea r8, [0x140517934]
mov r9d, 1
mov dword [r10 + 0x20], 0
call fcn.140006019
mov edx, 2
lea rcx, [rbp + 0x18]
movsxd rax, eax
lea r8, [0x1406e2be0]
dec rax
mov qword [rcx], rsi
cmovle rax, r12
mov r9d, 0x104
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], 0x104
call fcn.1400048cc
lea rcx, [0x1406e2be0]
call sub.KERNEL32.dll_DeleteFileA
mov rcx, rdi
lea rdx, [0x1406e2aa0]
call sub.KERNEL32.dll_FindNextFileA
movsxd rcx, eax
test rcx, rcx
jne 0x1403129fd
xor r8b, r8b
jmp 0x140312a05
call sub.KERNEL32.dll_FindClose
mov r8b, 0xff
test r8b, 1
jne 0x140312978
mov rcx, rdi
mov rsi, qword [rbp + 0x10]
mov rdi, qword [rbp + 8]
mov r12, qword [rbp]
call sub.KERNEL32.dll_FindClose
nop
xor eax, eax
lea rsp, [rbp + 0x38]
pop rbx
pop rbp
ret
Function at 0x140357e90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x140357e90
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x30]
mov r9, rdx
mov r8, rcx
lea rcx, [rbp]
mov edx, 0x12c
call fcn.1400042eb
mov rax, rsp
lea rcx, [0x1406ef4c0]
mov edx, 0x104
lea r8, [rbp]
mov r9d, 0x12c
mov qword [rax + 0x20], 0
call fcn.1400025f4
lea rcx, [0x1406ef4c0]
call sub.KERNEL32.dll_GetFileAttributesA
xor edx, edx
cmp eax, 0xffffffff
sete dl
dec edx
mov eax, edx
lea rsp, [rbp + 0x130]
pop rbp
ret

Function at 0x140360280
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp byte [0x1406efe50], 0
jne 0x140360330
lea rcx, str.libicaf.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14036030e
mov rsi, rax
lea rdx, str.for_rtl_ICAF_THIS_ORIGINAL_IMAGE
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rdi
mov qword [0x1406efe58], rax
lea rdx, str.for_rtl_ICAF_THIS_IMAGE
mov rcx, rsi
call rdi
mov qword [0x1406efbf8], rax
lea rdx, str.for_rtl_ICAF_THIS_TEAM_ID
mov rcx, rsi
call rdi
mov qword [0x1406efc00], rax
lea rdx, str.for_rtl_ICAF_ABORT
mov rcx, rsi
call rdi
mov qword [0x1406efe60], rax
lea rdx, str.for_rtl_ICAF_PROBABLY_ABORT
mov rcx, rsi
call rdi
mov qword [0x1406efe68], rax
mov rax, qword [0x1406efe58]
test rax, rax
je 0x140360329
mov byte [0x1406efe70], 1
call rax
mov dword [0x1406efbf0], eax
mov byte [0x1406efe50], 1
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1403604e0
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x1406efe7c]
call fcn.1400012d0
cmp dword [0x1406efe80], 0
jne 0x140360583
mov dword [0x1406efe80], 1
lea r8, [rsp + 0x20]
mov ecx, 0x1001
xor edx, edx
call fcn.140003765
mov rsi, qword [rsp + 0x20]
lea rcx, str.FORT0
mov rdx, rsi
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x104
jb 0x140360550
test rsi, rsi
je 0x140360550
mov byte [rsi], 0
mov rsi, qword [rsp + 0x20]
cmp byte [rsi], 0
je 0x14036057b
mov ecx, 2
call fcn.1400067a3
lea rdx, [0x14052abbd]
mov rcx, rsi
mov r8, rax
call fcn.140001e4c
mov rsi, qword [rsp + 0x20]
mov rcx, rsi
call fcn.140001b0e
mov dword [0x1406efe7c], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140003706
nop
add rsp, 0x30
pop rsi
ret
Function at 0x1403616d0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x40]
mov ecx, 0x1001
xor edx, edx
call fcn.140003765
test eax, eax
jne 0x140361919
mov rbx, qword [rsp + 0x40]
lea rcx, str.FOR_DIAGNOSTIC_LOG_FILE
mov rdx, rbx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x104
jb 0x140361730
test rbx, rbx
je 0x140361730
mov byte [rbx], 0
mov rcx, qword [rsp + 0x40]
cmp byte [rcx], 0
je 0x1403617e4
cmp edi, 0xaa
jne 0x1403617bd
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1403617e4
mov rbx, rax
mov rcx, rax
xor edx, edx
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rsi
call fcn.140003463
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rbx
mov rdx, rsi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1403617e4
lea rdx, [0x14052abbd]
call fcn.1400019ec
test rax, rax
je 0x1403617e4
mov rbx, rax
mov rcx, rsi
mov rdx, rax
call fcn.14000238d
mov rcx, rbx
call fcn.140003003
mov rcx, qword [rsp + 0x40]
call fcn.140001b0e
test eax, eax
jne 0x140361919
lea rcx, str.FOR_DISABLE_DIAGNOSTIC_DISPLAY
call fcn.140005452
test eax, eax
jne 0x140361919
cmp dword [0x1407108a8], 0
je 0x14036182d
lea rdx, str.Intel_r__Visual_Fortran_run_time_error
mov rcx, rsi
mov r8d, 0x2010
call fcn.140006596
jmp 0x140361919
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1403618b5
movsxd rcx, dword [rax + 0x3c]
movzx edx, word [rax + rcx + 0x18]
cmp edx, 0x20b
jne 0x1403618b5
cmp word [rax + rcx + 0x5c], 2
jne 0x1403618b5
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140361896
lea rdx, [0x14052381a]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140361896
lea r8, str.Intel_r__Visual_Fortran_run_time_error
xor ecx, ecx
mov rdx, rsi
mov r9d, 0x12010
call rax
test eax, eax
jne 0x140361919
cmp edi, 0xaa
je 0x1403618bd
mov ecx, 2
call fcn.1400067a3
mov rcx, rsi
mov rdx, rax
call fcn.14000238d
jmp 0x140361919
cmp edi, 0xaa
jne 0x1403618f2
mov rcx, rsi
call fcn.140003463
mov rdi, rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rcx, rax
mov rdx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140361919
mov ecx, 2
call fcn.1400067a3
mov rcx, rsi
mov rdx, rax
call fcn.14000238d
mov ecx, 2
call fcn.1400067a3
mov rcx, rax
call fcn.1400051fa
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140003706
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x14036d8b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rcx + 0x78]
mov rdi, qword [rcx + 0x88]
sub rdi, rbx
mov r14, qword [rcx + 0x240]
test r14, r14
mov r12d, 0x20000
cmove r14, r12
cmp rdi, r14
jbe 0x14036d95f
lea r15, [rsp + 0x2c]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, rdi
nop dword [rax + rax]
mov rcx, qword [rsi + 0x1a0]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, r14d
mov r9, r15
call r13
test eax, eax
sete al
je 0x14036d985
mov ecx, dword [rsp + 0x2c]
sub rbp, rcx
mov rax, qword [rsi + 0x240]
test rax, rax
cmove rax, r12
cmp rbp, rax
cmovb r14, rbp
xor eax, eax
test rbp, rbp
je 0x14036d985
add rbx, rcx
test ecx, ecx
jne 0x14036d910
jmp 0x14036d985
mov rcx, qword [rsi + 0x1a0]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete al
mov rcx, qword [rsi + 0x78]
mov qword [rsi + 0x88], rcx
add rcx, qword [rsi + 0x1c8]
mov qword [rsi + 0x90], rcx
and byte [rsi + 0x295], 0xfb
mov qword [rsi + 0x158], 0
add rdi, qword [rsi + 0x170]
mov qword [rsi + 0x170], rdi
mov qword [rsi + 0x168], rdi
xor edi, edi
test al, al
je 0x14036d9dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov edi, 0x26
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140003706
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140373e90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140373e90
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x1406eff40]
lea rdx, [0x140373f70]
call fcn.1400062d5
mov ecx, dword [0x1406eff3c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
xor edi, edi
test rax, rax
jne 0x140373f1f
lea r8, [rsp + 0x20]
mov ecx, 0x88
xor edx, edx
call fcn.140003765
test eax, eax
je 0x140373ef1
mov ecx, eax
xor eax, eax
mov edi, ecx
jmp 0x140373f1f
mov rbx, qword [rsp + 0x20]
lea rdx, [0x140569fe0]
mov r8d, 0x88
mov rcx, rbx
call fcn.14000419c
mov ecx, dword [0x1406eff3c]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140003706
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140373fe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140373fe0
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x1406eff40]
lea rdx, [0x140373f70]
call fcn.1400062d5
mov ecx, dword [0x1406eff3c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14037405b
mov qword [rsi], rbx
xor edi, edi
cmp dword [0x14056a068], 1
jne 0x140374079
mov edx, 1
mov ecx, 2
call fcn.1400066bd
mov qword [rbx + 0x68], rax
mov edx, 1
mov ecx, 0x16
call fcn.1400066bd
mov qword [rbx + 0x70], rax
jmp 0x140374079
lea r8, [rsp + 0x20]
mov ecx, 0x88
xor edx, edx
call fcn.140003765
test eax, eax
je 0x140374090
mov edi, eax
mov qword [rsi], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140003706
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [rsp + 0x20]
lea rdx, [0x140569fe0]
mov r8d, 0x88
mov rcx, rdi
call fcn.14000419c
mov ecx, dword [0x1406eff3c]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x20]
jmp 0x140374025
Function at 0x14037a720
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rcx + 0x78]
mov rdi, qword [rcx + 0x88]
sub rdi, rbx
mov r14, qword [rcx + 0x240]
test r14, r14
mov r12d, 0x20000
cmove r14, r12
cmp rdi, r14
jbe 0x14037a7cf
lea r15, [rsp + 0x2c]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, rdi
nop dword [rax + rax]
mov rcx, qword [rsi + 0x1a0]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, r14d
mov r9, r15
call r13
test eax, eax
sete al
je 0x14037a7f5
mov ecx, dword [rsp + 0x2c]
sub rbp, rcx
mov rax, qword [rsi + 0x240]
test rax, rax
cmove rax, r12
cmp rbp, rax
cmovb r14, rbp
xor eax, eax
test rbp, rbp
je 0x14037a7f5
add rbx, rcx
test ecx, ecx
jne 0x14037a780
jmp 0x14037a7f5
mov rcx, qword [rsi + 0x1a0]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete al
mov rcx, qword [rsi + 0x78]
mov qword [rsi + 0x88], rcx
add rcx, qword [rsi + 0x1c8]
mov qword [rsi + 0x90], rcx
and byte [rsi + 0x295], 0xfb
mov qword [rsi + 0x158], 0
add rdi, qword [rsi + 0x170]
mov qword [rsi + 0x170], rdi
mov qword [rsi + 0x168], rdi
xor edi, edi
test al, al
je 0x14037a84c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov edi, 0x26
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140003706
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14037dcd0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x88
cmp dword [0x14056a088], 0
je 0x14037de3c
lea rcx, [0x1406f84d8]
call fcn.1400012d0
cmp dword [0x1406f84dc], 0
jne 0x14037dd23
lea rcx, str.FOR_DISABLE_KMP_MALLOC
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14037dd19
mov dword [0x14056a088], 0
mov dword [0x1406f84dc], 1
lea rax, [0x140002478]
mov qword [rsp + 0x68], rax
lea rax, [0x140002bd5]
mov qword [rsp + 0x60], rax
lea rax, [0x1400031d9]
mov qword [rsp + 0x58], rax
lea rax, [fcn.14000236f]
mov qword [rsp + 0x80], rax
lea rax, [fcn.140002cac]
mov qword [rsp + 0x78], rax
lea rax, [0x14000168b]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x68]
cmp rax, qword [rsp + 0x80]
je 0x14037dd9f
mov rax, qword [rsp + 0x60]
cmp rax, qword [rsp + 0x78]
je 0x14037dd9f
mov rax, qword [rsp + 0x58]
cmp rax, qword [rsp + 0x70]
je 0x14037dd9f
mov dword [0x1406f04bc], 1
lea rax, [0x140002013]
mov qword [rsp + 0x38], rax
lea rax, [0x140004cb9]
mov qword [rsp + 0x30], rax
lea rax, case.0x1400ebcb9.61
mov qword [rsp + 0x28], rax
lea rax, [fcn.140001a41]
mov qword [rsp + 0x50], rax
lea rax, [fcn.140003f08]
mov qword [rsp + 0x48], rax
lea rax, [fcn.140003d14]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x50]
je 0x14037de15
mov rax, qword [rsp + 0x30]
cmp rax, qword [rsp + 0x48]
je 0x14037de15
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x40]
je 0x14037de15
mov dword [0x1406f04b8], 1
cmp dword [0x1406f04b8], 0
je 0x14037de28
mov dword [0x1406f04b0], 1
mov dword [0x14056a088], 0
mov dword [0x1406f84d8], 0
add rsp, 0x88
ret