joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408150
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
sub rsp, 0x28
cmp ecx, 1
je 0x408170
jb 0x408162
cmp ecx, 2
jne 0x4081e0
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
ret
lea rcx, str.GCC_URLS
call sub.msvcrt.dll_getenv
test rax, rax
mov rdx, rax
je 0x4081c0
xor eax, eax
cmp byte [rdx], 0
je 0x408164
lea rdi, [0x00470d78]
mov ecx, 3
mov rsi, rdx
repe cmpsb byte [rsi], byte [rdi]
je 0x408164
lea rdi, [0x00470d7b]
mov ecx, 3
mov rsi, rdx
mov eax, 1
repe cmpsb byte [rsi], byte [rdi]
seta cl
setb dl
cmp cl, dl
je 0x408164
jmp 0x4081d4
lea rcx, str.TERM_URLS
call sub.msvcrt.dll_getenv
test rax, rax
mov rdx, rax
jne 0x408184
mov eax, 2
add rsp, 0x28
pop rsi
pop rdi
ret
lea r8, str.determine_url_format
lea rcx, str._workdir_repo_gcc_gnu_gcc_diagnostic_color.c
mov edx, 0x15a
call fcn.0046d0e0
nop
nop
nop
nop
nop
nop
nop
nop
mov rax, qword [rcx]
mov rdx, qword [rdx]
mov eax, dword [rax]
sub eax, dword [rdx]
ret
Function at 0x40d200
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test r8, r8
mov rdi, rcx
mov rbp, rdx
mov rsi, r8
je 0x40d280
mov rbx, r8
lea r14, [rsp + 0x3c]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r12d, 0xffffffff
mov r15d, 0xffffffff
jmp 0x40d26f
mov r8d, ebx
mov dword [rsp + 0x3c], ebx
mov rdx, rsi
mov qword [rsp + 0x20], 0
mov r9, r14
sub rdx, rbx
mov rcx, rdi
add rdx, rbp
call r13
test eax, eax
je 0x40d280
mov eax, dword [rsp + 0x3c]
sub rbx, rax
je 0x40d280
cmp rbx, r12
jbe 0x40d240
mov dword [rsp + 0x3c], r15d
mov r8d, r15d
jmp 0x40d247
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x411590
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x28]
mov rbx, rcx
test rax, rax
je 0x4115b2
cmp rax, qword [rcx + 0x20]
je 0x4115b2
sub rax, 1
cmp qword [rcx + 0x30], rax
jb 0x4115bf
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_feof
test eax, eax
je 0x4115d0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x4115bf
mov rsi, qword [rbx + 0x20]
mov rax, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x18]
cmp rsi, rax
jne 0x411615
lea rax, [rsi + rsi]
test rsi, rsi
mov esi, 0x1000
cmovne rsi, rax
mov rdx, rsi
call fcn.0044fd7c
mov rcx, rax
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x28]
mov qword [rbx + 0x20], rsi
mov r9, qword [rbx + 0x10]
sub rsi, rax
add rcx, rax
mov r8, rsi
mov edx, 1
call sub.msvcrt.dll_fread
mov rcx, qword [rbx + 0x10]
mov rsi, rax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x4115bf
add qword [rbx + 0x28], rsi
test rsi, rsi
setne al
jmp 0x4115c1
Function at 0x4250c0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rdx
movzx edx, byte [rdx + 0x8a]
mov rbp, rcx
mov r12d, r8d
mov eax, edx
shr al, 3
and eax, 1
jne 0x42518a
mov ebx, edx
shr bl, 1
and ebx, 1
jne 0x42518a
mov edx, dword [rsi + 0x84]
test edx, edx
jne 0x42518a
cmp dword [rsi + 0x80], 0xffffffff
je 0x4251a0
movzx eax, word [rsi + 0x4e]
and ax, 0xf000
cmp ax, 0x3000
jne 0x4251d0
mov rax, qword [rsi + 8]
lea r9, str._s_is_a_block_device
mov r8d, r12d
mov edx, 3
mov rcx, rbp
mov ebx, 1
mov qword [rsp + 0x20], rax
call fcn.00420350
movzx edx, byte [rsi + 0x8a]
mov eax, ebx
mov ecx, dword [rsi + 0x80]
and eax, 1
add eax, eax
and edx, 0xfffffffd
or eax, edx
mov byte [rsi + 0x8a], al
call sub.msvcrt.dll__close
movzx eax, byte [rsi + 0x8a]
mov dword [rsi + 0x80], 0xffffffff
shr al, 1
and eax, 1
xor eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call fcn.00424c20
test al, al
jne 0x425116
mov r9d, r12d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
mov byte [rsp + 0x4f], al
call fcn.00424d30
movzx eax, byte [rsp + 0x4f]
jmp 0x42518a
cmp ax, 0x8000
je 0x42529a
xor r15d, r15d
mov ecx, 0x2010
mov r13d, 0x2000
call fcn.0044fcd6
xor edi, edi
mov r14, rax
mov ecx, dword [rsi + 0x80]
lea rdx, [r14 + rdi]
mov r8d, r13d
sub r8d, edi
call sub.msvcrt.dll__read
cdqe
cmp rax, 0
jle 0x425234
add rdi, rax
cmp r13, rdi
jne 0x4251f2
test r15b, r15b
jne 0x4252ad
add r13, r13
mov rcx, r14
lea rdx, [r13 + 0x10]
call fcn.0044fd7c
mov r14, rax
jmp 0x4251f2
jne 0x4252b2
cmp r13, rdi
je 0x42525d
test r15b, r15b
je 0x42525d
mov rax, qword [rsi + 8]
lea r9, str._s_is_shorter_than_expected
mov r8d, r12d
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.00420350
lea rax, [rsi + 0x60]
mov rdx, qword [rbp + 0x480]
lea r9, [r13 + 0x10]
mov qword [rsp + 0x20], rdi
mov r8, r14
mov rcx, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsi + 0x30]
mov qword [rsp + 0x28], rax
call fcn.0041be70
or byte [rsi + 0x8a], 8
mov qword [rsi + 0x28], rax
jmp 0x42514d
mov r13, qword [rsi + 0x60]
mov r15d, 1
lea rcx, [r13 + 0x10]
jmp 0x4251e8
mov rdi, r13
jmp 0x42525d
mov r8, qword [rsi + 8]
mov r9d, r12d
mov edx, 3
mov rcx, rbp
mov ebx, 1
call fcn.00420430
mov rcx, r14
call fcn.004689a0
jmp 0x42514d
Function at 0x4294d0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movzx eax, byte [rcx + 4]
mov rsi, rcx
mov rdi, rdx
mov rcx, rax
shl rax, 4
mov rdx, rax
lea rax, [0x0047a940]
add rax, rdx
mov edx, dword [rax]
cmp edx, 1
je 0x429530
jb 0x4295a0
cmp edx, 2
jne 0x429520
mov r8d, dword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov r9, rdi
mov edx, 1
call sub.msvcrt.dll_fwrite
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi + 8]
mov edx, dword [rax + 8]
mov rbp, qword [rax]
test edx, edx
je 0x429520
xor ebx, ebx
lea r12, [rsp + 0x26]
jmp 0x429583
mov rcx, r12
call fcn.00428230
mov r9, rdi
mov r8d, 0xa
mov edx, 1
mov rcx, r12
lea rbx, [rax + rbx - 1]
call sub.msvcrt.dll_fwrite
mov rax, qword [rsi + 8]
add rbx, 1
mov edx, dword [rax + 8]
cmp rdx, rbx
jbe 0x429520
lea rdx, [rbp + rbx]
test byte [rdx], 0x80
jne 0x429550
mov rax, qword [rax]
mov rdx, rdi
movzx ecx, byte [rax + rbx]
call sub.msvcrt.dll_fputc
jmp 0x429573
movzx edx, word [rsi + 6]
test dl, 2
jne 0x4295d3
and edx, 0x10
jne 0x429530
mov rbx, qword [rax + 8]
movzx ecx, byte [rbx]
add rbx, 1
mov rdx, rdi
call sub.msvcrt.dll_putc
movzx ecx, byte [rbx]
test ecx, ecx
jne 0x4295b5
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
sub ecx, 0x26
lea rax, [0x0047aec0]
movsxd rcx, ecx
mov rbx, qword [rax + rcx*8]
jmp 0x4295b2
Function at 0x432b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, dword [rdx + 0x18]
mov rsi, rcx
mov rbx, rdx
test eax, eax
je 0x432b80
cmp qword [rdx + 8], 0
je 0x432b90
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp byte [rcx + 0x44a], 0
movzx r12d, byte [rcx + 0x45d]
mov byte [rcx + 0x44a], 0
mov ecx, 0x800
setne r13b
call fcn.0044fcd6
mov qword [rbx + 8], rax
cmp byte [rsi + 0x45d], 0
je 0x432bcf
mov ecx, 0x400
call fcn.0044fcd6
mov qword [rbx + 0x28], rax
mov eax, dword [rbx + 0x18]
test r12b, r12b
mov rbp, qword [rbx]
lea edi, [rax + 1]
jne 0x432c90
lea rcx, [rsi + 0x88]
call fcn.0042f4c0
lea rdx, [rbp + rdi*8]
mov dword [rax + 0x30], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdx
mov edx, dword [rbx + 0x1c]
mov ebp, 0x100
lea r12, [rsp + 0x3c]
jmp 0x432c33
test rcx, rcx
je 0x432cf4
mov qword [rcx + r8*8], rax
add edx, 1
mov dword [rbx + 0x1c], edx
lea edi, [rdx + 1]
cmp rdi, rbp
ja 0x432cb0
mov rdx, r12
mov rcx, rsi
call fcn.00431d10
cmp byte [rax + 4], 0x16
je 0x432d00
mov r8d, dword [rbx + 0x1c]
cmp byte [rsi + 0x45d], 0
mov rcx, qword [rbx + 8]
mov rdx, r8
je 0x432c20
test rcx, rcx
je 0x432cf4
mov r9, qword [rbx + 0x28]
mov r10d, dword [rsp + 0x3c]
mov qword [rcx + r8*8], rax
lea r9, [r9 + r8*4]
test r9, r9
je 0x432c2d
mov dword [r9], r10d
mov edx, dword [rbx + 0x1c]
jmp 0x432c2d
mov r9, qword [rbx + 0x20]
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
mov rcx, rsi
call fcn.0042f530
jmp 0x432c11
mov rcx, qword [rbx + 8]
mov rdx, rdi
lea rbp, [rdi + rdi]
shl rdx, 4
call fcn.0044fd7c
mov qword [rbx + 8], rax
cmp byte [rsi + 0x45d], 0
je 0x432c3b
mov rcx, qword [rbx + 0x28]
lea rdx, [rdi*8]
test rcx, rcx
je 0x432d14
call fcn.0044fd7c
mov qword [rbx + 0x28], rax
jmp 0x432c3b
mov qword [0], rax
ud2
mov rcx, rsi
call fcn.0042f990
mov byte [rsi + 0x44a], r13b
jmp 0x432b80
mov rcx, rdx
call fcn.0044fcd6
mov qword [rbx + 0x28], rax
jmp 0x432c3b

Function at 0x4343c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 8]
mov r12d, dword [rsp + 0x90]
mov rdi, rcx
mov rbp, rdx
mov esi, r8d
mov r13d, r9d
test eax, eax
je 0x434460
xor ebx, ebx
jmp 0x434423
test r13d, r13d
je 0x4343fd
lea eax, [rsi + rax]
cmp r13d, eax
jb 0x434473
add esi, 1
mov rdx, rbp
mov ecx, 0x20
add esi, r14d
call sub.msvcrt.dll_fputc
mov rdx, rbp
mov rcx, r15
add ebx, 1
call sub.msvcrt.dll_fputs
cmp dword [rdi + 8], ebx
je 0x434460
mov rdx, qword [rdi]
mov eax, ebx
cmp r12d, ebx
mov r15, qword [rdx + rax*8]
jbe 0x434444
mov rcx, r15
call sub.msvcrt.dll_strlen
test esi, esi
mov r14, rax
jne 0x4343f0
mov esi, eax
jmp 0x434410
mov rcx, r15
xor r8d, r8d
xor edx, edx
call fcn.00434260
mov r15, rax
jmp 0x434431
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x0047bc00]
mov r9, rbp
mov r8d, 3
mov edx, 1
mov esi, 1
call sub.msvcrt.dll_fwrite
jmp 0x434400
Function at 0x4391d0
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
mov r8d, 0
mov ecx, eax
call fcn.0045ce90
test rax, rax
jns 0x439229
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov edx, dword [rax]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x30]
mov r8d, edx
lea rdx, str.lseek
call rax
mov eax, 0
jmp 0x43931f
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x28]
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.004372d0
mov rdx, rax
mov rax, qword [rbp + 0x40]
mov qword [rax + 8], rdx
mov rax, qword [rbp + 0x40]
mov rax, qword [rax + 8]
test rax, rax
jne 0x439269
mov eax, 0
jmp 0x43931f
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x40]
mov qword [rax], rdx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x28]
mov ecx, eax
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax + 8]
mov eax, dword [rbp + 0x18]
mov r8d, ecx
mov ecx, eax
call sub.msvcrt.dll__read
cdqe
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jns 0x4392e2
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov edx, dword [rax]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x30]
mov r8d, edx
lea rdx, str.read
call rax
mov rax, qword [rbp + 0x40]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.004689a0
mov eax, 0
jmp 0x43931f
mov rax, qword [rbp - 8]
cmp qword [rbp + 0x28], rax
jbe 0x43931a
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x30]
mov r8d, 0
lea rdx, str.file_too_short
call rax
mov rax, qword [rbp + 0x40]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.004689a0
mov eax, 0
jmp 0x43931f
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x44ab10
Capabilities:
Hash data with md5

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov dword [rax], 0x67452301
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 0
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x10], edx
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x18], 0
nop
pop rbp
ret
Function at 0x44acf2
Capabilities:
Read file on windows

Disassembly:
push rbp
mov eax, 0x1120
call fcn.0045b000
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10b0], rcx
mov qword [rbp + 0x10b8], rdx
lea rax, [rbp + 0xff0]
mov rcx, rax
call fcn.0044ab10
mov qword [rbp + 0x1098], 0
mov eax, 0x1000
sub rax, qword [rbp + 0x1098]
mov rdx, rax
lea rcx, [rbp - 0x60]
mov rax, qword [rbp + 0x1098]
add rax, rcx
mov r9, qword [rbp + 0x10b0]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov qword [rbp + 0x1090], rax
mov rax, qword [rbp + 0x1090]
add qword [rbp + 0x1098], rax
cmp qword [rbp + 0x1098], 0xfff
ja 0x44ad90
cmp qword [rbp + 0x1090], 0
jne 0x44ad30
cmp qword [rbp + 0x1090], 0
jne 0x44adb1
mov rcx, qword [rbp + 0x10b0]
call sub.msvcrt.dll_ferror
test eax, eax
je 0x44adb1
mov eax, 1
jmp 0x44ae1e
cmp qword [rbp + 0x1090], 0
je 0x44addb
lea rdx, [rbp + 0xff0]
lea rax, [rbp - 0x60]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call fcn.0044b06f
jmp 0x44ad25
nop
cmp qword [rbp + 0x1098], 0
je 0x44ae03
lea rcx, [rbp + 0xff0]
mov rdx, qword [rbp + 0x1098]
lea rax, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call fcn.0044ae83
mov rdx, qword [rbp + 0x10b8]
lea rax, [rbp + 0xff0]
mov rcx, rax
call fcn.0044abbe
mov eax, 0
add rsp, 0x1120
pop rbp
ret
Function at 0x44cc5b
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [0x0046e1e0]
mov dword [0x0048e63c], eax
mov eax, dword [0x0048e63c]
mov dword [0x0048e638], eax
mov qword [0x0048e620], 0
lea rcx, str.POSIXLY_CORRECT
call sub.msvcrt.dll_getenv
mov qword [0x0048e630], rax
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2d
jne 0x44ccc0
mov dword [0x0048e628], 2
add qword [rbp + 0x20], 1
jmp 0x44ccfe
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2b
jne 0x44ccdc
mov dword [0x0048e628], 0
add qword [rbp + 0x20], 1
jmp 0x44ccfe
mov rax, qword [0x0048e630]
test rax, rax
je 0x44ccf4
mov dword [0x0048e628], 0
jmp 0x44ccfe
mov dword [0x0048e628], 1
mov rax, qword [rbp + 0x20]
add rsp, 0x20
pop rbp
ret

Function at 0x45a0c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x0048ec84]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x45a1e0
mov rax, qword [0x0048ec88]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x45a10c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x45a1c6
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x45a0f0
mov rcx, rsi
call fcn.0045ad00
test rax, rax
mov r12, rax
je 0x45a218
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x0048ec88]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.0045ae50
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x0048ec88]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x45a1fb
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x45a1bf
sub eax, 0x40
and eax, 0xffffffbf
je 0x45a1bf
add rbx, qword [0x0048ec88]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x45a1e7
add dword [0x0048ec84], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x45a117
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0045a050
mov rax, qword [0x0048ec88]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.0045a050
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.0045a050
nop
nop dword [rax + rax]
Function at 0x45a970
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0048ef60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0048ef40]
test rbx, rbx
je 0x45a9c4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x45a9bb
test rsi, rsi
je 0x45a9bb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x45a9a0
lea rcx, [0x0048ef60]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x45ad00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00481de0]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x45ad20
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.0045abe0
test eax, eax
je 0x45ad18
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x45ad7d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x45ad74
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x45ad18
add rdx, 0x28
cmp rdx, r9
jne 0x45ad60
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x45b0b0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x0048ef48]
xor esi, esi
mov ebp, ecx
mov rdi, rdx
test eax, eax
jne 0x45aa04
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
test rax, rax
mov rbx, rax
je 0x45aa58
mov dword [rax], ebp
mov qword [rax + 8], rdi
lea rcx, [0x0048ef60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x0048ef40]
lea rcx, [0x0048ef60]
mov qword [0x0048ef40], rbx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov esi, 0xffffffff
jmp 0x45a9f9
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x45b0e0
mov rdx, rbx
mov ecx, eax
mov dword [rsi], eax
add rsp, 0x28
pop rbx
pop rsi
jmp 0x468e60
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
test rdx, rdx
je 0x468e70
jmp 0x45a9e0
xor eax, eax
ret

Function at 0x45b110
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x45b140
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x45b155
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x45ba80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x45bc0c
cmp byte [rbx], 0
je 0x45bbd4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x45bbf0
test al, 0x10
je 0x45bbd4
lea rdi, [rsp + 0x20]
mov r8d, 0x104
mov rdx, rbx
mov rcx, rdi
mov rsi, rdi
call sub.msvcrt.dll__fullpath
mov edx, dword [rsi]
add rsi, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x45bade
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rsi + 2]
mov ecx, eax
cmove rsi, rdx
add cl, al
sbb rsi, 3
sub rsi, rdi
lea rcx, [rsi + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x45bbff
lea r9, [rax + 0x244]
lea rbp, [rsi + 1]
mov rdx, rdi
mov rcx, r9
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rbx + 0x244], 0
mov r9, rax
je 0x45bb70
movzx eax, byte [rbx + rsi + 0x243]
cmp al, 0x2f
je 0x45bb70
cmp al, 0x5c
je 0x45bb70
mov r8d, 0x5c
mov word [r9 + rsi], r8w
mov rsi, rbp
mov eax, 0x2a
xor edx, edx
xor ecx, ecx
mov word [r9 + rsi], ax
mov word [rbx + 0x12c], dx
lea rdx, [rbx + 0x130]
mov word [rbx + 0x12e], cx
xor eax, eax
mov ecx, 0x20
mov rdi, rdx
mov qword [rbx + 0x238], 0xffffffffffffffff
mov dword [rbx + 0x240], 0
mov dword [rbx + 0x128], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 2
jmp 0x45bbc5
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x45bbc5
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x45bbc5
Function at 0x4618b0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12d, 1
sub r8d, 1
mov edi, ecx
mov ecx, 0x66666667
mov eax, r8d
mov rbp, rdx
movsxd rsi, r8d
imul ecx
sar r8d, 0x1f
mov rbx, r9
mov ecx, edx
sar ecx, 2
sub ecx, r8d
je 0x461905
mov r8d, 0x66666667
nop dword [rax]
mov eax, ecx
sar ecx, 0x1f
add r12d, 1
imul r8d
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x4618f0
mov edx, dword [rbx + 0x2c]
cmp edx, 0xffffffff
je 0x461980
mov ecx, dword [rbx + 0xc]
cmp r12d, edx
mov r9, rbx
cmovl r12d, edx
mov r8d, 1
lea edx, [r12 + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, edi
mov rdx, rbp
mov dword [rbx + 0xc], eax
add r12d, 1
call fcn.00461170
mov ecx, dword [rbx + 8]
mov eax, dword [rbx + 0x2c]
mov rdx, rbx
mov dword [rbx + 0x10], eax
mov eax, ecx
and ecx, 0x20
or eax, 0x1c0
or ecx, 0x45
mov dword [rbx + 8], eax
call fcn.00460d20
add dword [rbx + 0xc], r12d
mov rdx, rbx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.004615e0
mov eax, dword [0x0046e2c0]
cmp eax, 0xffffffff
je 0x4619ac
test eax, eax
je 0x46199c
mov edx, 2
mov dword [rbx + 0x2c], edx
jmp 0x46190d
call fcn.00468bf0
test al, 1
mov edx, 3
jne 0x46198f
jmp 0x461994
lea rcx, str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x4619d4
movsx eax, byte [rax]
sub eax, 0x30
cmp eax, 2
setbe al
movzx eax, al
mov dword [0x0046e2c0], eax
jmp 0x46198b
xor eax, eax
jmp 0x4619c9

Function at 0x46c680
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [0x0046e3b4], 0
jne 0x46c691
lea rax, [0x0046e3a0]
ret
mov ecx, dword [0x0046e3b0]
jmp fcn.0045b110