joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021d70
Capabilities:
Get disk size

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rdx
movups xmm0, xmmword [rcx]
movaps xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x10], 0
mov rbx, qword [rbp - 0x40]
mov r14, qword [rbp - 0x38]
cmp byte [r14 + rbx - 1], 0
je 0x140021e6f
lea rdi, [rbp - 0x30]
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
cmp r14, 0xf
jbe 0x140021e15
test r14, r14
js 0x140021ee4
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
cmp r12, 0xfff
jb 0x140021e33
lea rcx, [r12 + 0x28]
call fcn.1400fa374
mov r15, rax
add r15, 0x27
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140021e40
mov qword [rbp - 0x20], r14
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x30], 0
mov r15, qword [rbp - 0x30]
jmp 0x140021e5f
lea rcx, [r12 + 1]
call fcn.1400fa374
mov r15, rax
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r12
mov rcx, r15
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + r14], 0
mov qword [rbp - 0x30], r15
mov byte [rbp - 0x10], 1
cmp qword [rbp - 0x18], 0x10
cmovae rdi, r15
mov rbx, rdi
lea rdx, [rbp - 0x48]
mov rcx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov edi, eax
cmp byte [rbp - 0x10], 0
je 0x140021ec5
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x140021ec5
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140021ec0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140021ee9
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400fa3b8
test edi, edi
je 0x140021ed0
mov rax, qword [rbp - 0x48]
mov qword [rsi], rax
test edi, edi
setne al
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.1400067d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400256d0
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov r8d, ecx
mov ecx, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, 0xffffffffffffffff
je 0x14002570b
mov rsi, rax
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x20
pop rsi
ret
Function at 0x140027750
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x40]
test ecx, ecx
mov eax, 1
cmovne eax, ecx
add rsp, 0x58
ret

Function at 0x140027790
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
mov rsi, rdx
xorps xmm6, xmm6
movups xmmword [rdx + 0x20], xmm6
movups xmmword [rdx + 0x10], xmm6
movups xmmword [rdx], xmm6
mov qword [rdx + 0x30], 0
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x20], 0x50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r8d, 0x50
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x140027822
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x140027806
mov rax, qword [rsp + 0x68]
movdqu xmm0, xmmword [rsp + 0x28]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x18], rax
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov dword [rsp + 0x70], 0x40
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14002786d
movdqu xmm0, xmmword [rsp + 0x78]
movdqu xmmword [rsi + 0x20], xmm0
mov rax, qword [rsp + 0x88]
mov qword [rsi + 0x30], rax
mov rax, rsi
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rsi
ret
Function at 0x140029320
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x260
lea rsi, [rcx + 0x100]
cmp qword [rcx + 0x110], 0
jne 0x140029440
mov rdi, rcx
lea rbx, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 0x1a
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140029382
lea rbx, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
jmp 0x1400293a3
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
test rax, rax
je 0x140029440
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rax
mov r8d, 0xffffffff
call fcn.140042940
cmp rsi, rbx
je 0x140029403
mov rax, qword [rdi + 0x118]
cmp rax, 0x10
jb 0x1400293f0
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400293eb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002944e
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400fa3b8
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
jmp 0x140029440
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x140029440
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002943b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002944e
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400fa3b8
mov rax, rsi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140029460
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
js 0x1400294bd
mov ebx, eax
inc ebx
mov edx, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
mov ecx, ebx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1400294a1
mov word [rdi], 0x30
mov rcx, rsi
mov rdx, rdi
mov r8d, 0xffffffff
call fcn.140042940
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400294d7
mov qword [rsi], 0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400294f0
Capabilities:
Set current directory

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rdx, qword [rdx]
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140042450
mov rax, qword [rsp + 0x28]
test rax, rax
lea rcx, [0x140102f6e]
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
mov rcx, rsi
call fcn.140042730
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
Function at 0x140029540
Capabilities:
Create directory
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rdx
lea rdi, [rbp - 0x18]
mov edx, 0x104
mov rcx, rdi
call fcn.140042500
mov rcx, rdi
call fcn.140042900
mov ecx, dword [rbp - 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, eax
cmp qword [rbp - 0x10], rdx
jae 0x1400295a2
lea rcx, [rbp - 0x18]
call fcn.140042560
lea rcx, [rbp - 0x18]
call fcn.140042900
mov ecx, dword [rbp - 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400295e7
mov edx, eax
lea rcx, [rbp - 0x18]
call fcn.140042560
lea rdx, str.AndroidEmulator
lea rcx, [rbp - 0x18]
call fcn.140042b90
mov rax, qword [rbp - 0x18]
test rax, rax
lea rcx, [0x140102f6e]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
lea rcx, [rbp - 0x18]
mov rdx, rsi
call fcn.140042920
jmp 0x140029608
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], 7
mov dword [rsi], 0x545c3a43
mov dword [rsi + 3], 0x706d6554
mov byte [rsi + 7], 0
lea rcx, [rbp - 0x18]
call fcn.140042730
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002ead0
Capabilities:
Get file size

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rdx
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140042450
mov rax, qword [rsp + 0x40]
test rax, rax
lea rcx, [0x140102f6e]
cmovne rcx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor edi, edi
mov edx, 0x80000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002eb4b
mov rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14002eb5e
mov rax, qword [rsp + 0x38]
jmp 0x14002eb60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 2
mov edi, 0xffffffff
jmp 0x14002eb6c
xor eax, eax
mov qword [rsi], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call fcn.140042730
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002eb80
Capabilities:
Check if file exists

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2d0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x248], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r8, rcx
lea rcx, [rbp - 0x40]
mov esi, 0xffffffff
mov edx, 0x105
mov r9d, 0xffffffff
call fcn.140042b40
test eax, eax
js 0x14002ed0b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
lea rcx, [rbp - 0x40]
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002ecc2
mov qword [rbp + 0x240], rax
lea rcx, [rbp - 0x40]
mov edx, 0x105
mov r8, rbx
mov r9d, 0xffffffff
call fcn.140042b40
test eax, eax
js 0x14002ecd7
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
lea rcx, [rbp - 0x40]
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r14, qword [rbp + 0x240]
je 0x14002ece0
mov rbx, rax
lea rdx, [rbp + 0x1d0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14002ecf9
lea rdx, [rbp + 0x208]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14002ecf9
mov ecx, dword [rbp + 0x1ec]
xor esi, esi
mov eax, 0
cmp ecx, dword [rbp + 0x224]
jne 0x14002ecf7
mov eax, dword [rbp + 0x1fc]
cmp eax, dword [rbp + 0x234]
jne 0x14002ecf5
mov eax, dword [rbp + 0x200]
cmp eax, dword [rbp + 0x238]
sete al
jmp 0x14002ecf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xfffffffe
cmp eax, 2
jne 0x14002ed0b
mov byte [rdi], 0
xor esi, esi
jmp 0x14002ed0b
mov r14, qword [rbp + 0x240]
jmp 0x14002ed02
call qword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xfffffffe
cmp eax, 2
jne 0x14002ed02
mov byte [rdi], 0
xor esi, esi
jmp 0x14002ed02
xor eax, eax
mov byte [rdi], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x2d0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x14002ed80
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov byte [rbp - 9], 0
lea r8, [rbp - 9]
mov rcx, rdx
mov rdx, rsi
call fcn.14002eb80
mov ebx, eax
test eax, eax
jne 0x14002eee4
cmp byte [rbp - 9], 0
jne 0x14002eee4
mov rcx, rdi
mov edx, 4
call fcn.140044ad0
test eax, eax
js 0x14002ee80
lea rcx, [rbp - 0x20]
mov rdx, rsi
call fcn.140042450
mov r14, qword [rbp - 0x20]
lea rcx, [rbp - 0x30]
mov rdx, rdi
call fcn.140042450
test r14, r14
lea rax, [0x140102f6e]
cmove r14, rax
mov rcx, qword [rbp - 0x30]
test rcx, rcx
cmove rcx, rax
xor ebx, ebx
mov rdx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r14d, eax
lea rcx, [rbp - 0x30]
call fcn.140042730
lea rcx, [rbp - 0x20]
call fcn.140042730
test r14d, r14d
jne 0x14002eee4
mov ebx, 0xffffffff
test byte [0x14014a570], 1
je 0x14002eee4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea rdx, str.C:_buildbot_src_android_emu_33_release_external_qemu_android_android_emu_base_android_utils_path.cpp
lea r9, str.Failed_to_copy__s_to__s:__u
mov ecx, 0xffffffff
mov r8d, 0x1cb
call fcn.1400385d0
jmp 0x14002eee4
test byte [0x14014a570], 1
je 0x14002eeb8
mov qword [rsp + 0x28], rdi
lea rax, str.path_copy_file
mov qword [rsp + 0x20], rax
lea rdx, str.C:_buildbot_src_android_emu_33_release_external_qemu_android_android_emu_base_android_utils_path.cpp
lea r9, str._s:_source_file_is_un_readable:__s_n
mov ecx, 0xffffffff
mov r8d, 0x1bd
call fcn.1400385d0
mov rcx, rdi
xor edx, edx
call fcn.140044ad0
mov ebx, 0xffffffff
test eax, eax
jne 0x14002eee4
mov rcx, rsi
mov edx, 0x80
call fcn.140044b70
test eax, eax
js 0x14002eee4
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1400321a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400321e5
mov rdx, rcx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test rax, rax
jne 0x1400321e7
lea rdx, str.C:_buildbot_src_android_emu_33_release_external_qemu_android_android_emu_base_android_utils_system.c
lea r9, str.PANIC:_not_enough_memory
mov ecx, 3
mov r8d, 0x46
call fcn.1400385d0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor eax, eax
add rsp, 0x28
ret
Function at 0x140036090
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
lea rdx, str._help
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14003611c
lea rdx, str.__help
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14003611c
lea rdx, str._help_
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x140036150
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
add rsi, 6
lea rdx, [0x140100646]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140036157
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140052980
test eax, eax
je 0x140036161
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140052a10
jmp 0x140036161
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.140052ee0
mov r8, qword [rsp + 0x20]
mov edx, dword [rsp + 0x28]
lea rcx, str._.s
call fcn.140004c70
mov rcx, rsi
call fcn.1400547a0
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x20]
call fcn.140052f10
mov edx, dword [rsp + 0x28]
test edx, edx
je 0x14003617c
mov r8, qword [rsp + 0x20]
lea rcx, str._n_.s_n
call fcn.140004c70
jmp 0x14003614e
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.unknown_option:__help__s_n
mov rcx, rax
mov r8, rsi
call fcn.140004880
mov ecx, 2
call rdi
lea rcx, str.please_use__help_for_a_list_of_valid_topics_n
mov edx, 0x2c
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov eax, 1
jmp 0x140036150
Function at 0x1400395d0
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rax, rdx
mov rdi, rcx
lea rdx, [0x140105d28]
mov rcx, rax
call fcn.140044520
test rax, rax
je 0x140039668
mov rsi, rax
xor ebx, ebx
mov rcx, rax
xor edx, edx
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
js 0x140039674
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
test eax, eax
js 0x14003967e
je 0x14003968a
mov ebp, eax
xor ebx, ebx
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
js 0x140039674
mov ebx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14003967e
mov r14, rax
mov edx, 1
mov rcx, rax
mov r8, rbx
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbx
jne 0x1400396b1
mov qword [rdi], r14
mov qword [rdi + 8], rbx
jmp 0x140039690
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor ebx, ebx
sub ebx, dword [rax]
jmp 0x1400396a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
sub ebx, dword [rax]
jmp 0x14003969b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor ebx, ebx
sub ebx, dword [rax]
jmp 0x14003969b
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov eax, 0x87002013
mov qword [rdi + 0x10], rax
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
mov ebx, 0xfffffffb
test eax, eax
jne 0x14003969b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ebx, eax
neg ebx
jmp 0x14003969b

Function at 0x140044b20
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdx, rcx
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140042450
mov rax, qword [rsp + 0x28]
test rax, rax
lea rcx, [0x140102f6e]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
mov edi, eax
mov rcx, rsi
call fcn.140042730
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140044c80
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdx, rcx
lea rsi, [rsp + 0x28]
mov rcx, rsi
call fcn.140042450
mov rax, qword [rsp + 0x28]
test rax, rax
lea rcx, [0x140102f6e]
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edi, edi
test eax, eax
sete dil
mov rcx, rsi
call fcn.140042730
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140054860
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov eax, dword [rcx + 8]
add eax, edx
jb 0x1400548b9
mov rsi, rcx
mov ecx, dword [rcx + 0xc]
cmp ecx, eax
jae 0x14005489a
mov edx, 0xffffffff
nop dword [rax]
mov r8d, ecx
shr r8d, 1
lea edi, [rcx + r8]
add edi, 0x10
cmp edi, ecx
mov ecx, edi
cmovb edi, edx
cmp edi, eax
jb 0x140054880
jmp 0x14005489c
mov edi, ecx
mov edx, edi
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [rsi], rax
test rax, rax
je 0x1400548ed
mov dword [rsi + 0xc], edi
add rsp, 0x38
pop rdi
pop rsi
ret
cmp dword [0x14014a578], 2
jg 0x140054924
mov dword [rsp + 0x28], edx
lea rax, str.stralloc_readyplus
mov qword [rsp + 0x20], rax
lea rdx, str.C:_buildbot_src_android_emu_33_release_external_qemu_android_android_emu_base_android_utils_stralloc.c
lea r9, str._s:_trying_to_grow_by_too_many_bytes:__ld
mov ecx, 2
mov r8d, 0x5b
jmp 0x14005491f
cmp dword [0x14014a578], 2
jg 0x140054924
mov dword [rsp + 0x28], edi
lea rax, str.stralloc_ready
mov qword [rsp + 0x20], rax
lea rdx, str.C:_buildbot_src_android_emu_33_release_external_qemu_android_android_emu_base_android_utils_stralloc.c
lea r9, str._s:_not_enough_memory_to_reallocate__ld_bytes
mov ecx, 2
mov r8d, 0x4e
call fcn.1400385d0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140054c60
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x38], r8
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi + 8], 0
mov ecx, 0x10
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsi], rax
test rax, rax
je 0x140054dce
mov dword [rsi + 0xc], 0x10
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
mov ebp, 0xffffffff
mov r12, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
nop dword [rax]
mov r13, qword [rsp + 0x38]
mov qword [rsp + 0x40], r13
mov ebx, dword [rsi + 0xc]
mov r14, qword [rsi]
call fcn.1400067f0
mov rcx, qword [rax]
or rcx, 2
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8, rbx
mov r9, rdi
call r15
mov ecx, dword [rsi + 0xc]
test eax, eax
cmovs eax, ebp
js 0x140054d30
cmp eax, ecx
jb 0x140054d78
nop word cs:[rax + rax]
mov edx, ecx
shr edx, 1
lea ebx, [rcx + rdx]
add ebx, 0x10
cmp ebx, ecx
mov ecx, ebx
cmovb ebx, ebp
cmp ebx, eax
jbe 0x140054d10
jmp 0x140054d60
test ecx, ecx
jle 0x140054d57
lea eax, [rcx + rcx]
nop word [rax + rax]
mov edx, ecx
shr edx, 1
lea ebx, [rcx + rdx]
add ebx, 0x10
cmp ebx, ecx
mov ecx, ebx
cmovb ebx, ebp
cmp ebx, eax
jb 0x140054d40
jmp 0x140054d60
mov ebx, ecx
nop dword [rax]
mov edx, ebx
mov rcx, qword [rsi]
call r12
mov qword [rsi], rax
test rax, rax
je 0x140054d8c
mov dword [rsi + 0xc], ebx
jmp 0x140054cc0
mov dword [rsi + 8], eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [0x14014a578], 2
jg 0x140054dc3
mov dword [rsp + 0x28], ebx
lea rax, str.stralloc_ready
mov qword [rsp + 0x20], rax
lea rdx, str.C:_buildbot_src_android_emu_33_release_external_qemu_android_android_emu_base_android_utils_stralloc.c
lea r9, str._s:_not_enough_memory_to_reallocate__ld_bytes
mov ecx, 2
mov r8d, 0x4e
call fcn.1400385d0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp dword [0x14014a578], 2
jg 0x140054dc3
lea rax, str.stralloc_ready
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x10
jmp 0x140054da5
Function at 0x14005eba0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, qword [rdx + 0x40]
cmp ecx, 0xffffffff
jne 0x14005ebbb
mov ecx, dword [rdi + 0x98]
movsxd rax, ecx
mov rcx, rax
shl rcx, 7
lea rax, [rcx + rax*8]
lea rcx, [0x14014a7a0]
cmp qword [rcx + rax], 0
je 0x14005ec30
add rdi, 0xa0
lea r14, [rsi + 0x58]
xor ebx, ebx
jmp 0x14005ec01
inc rbx
add rdi, 0x28
add r14, 0x10
cmp rbx, 0x20
je 0x14005ec2c
mov rdx, qword [rdi]
test rdx, rdx
je 0x14005ebf0
mov rax, qword [rdi + 8]
cmp byte [rax], 3
jne 0x14005ebf0
mov rcx, qword [rsi + 0x40]
mov r8d, 0xc0000000
call fcn.140062790
cmp rax, 0xffffffffffffffff
je 0x14005ec37
mov qword [r14], rax
jmp 0x14005ebf0
xor eax, eax
jmp 0x14005ec8d
mov eax, 0xfffffffd
jmp 0x14005ec8d
xor ecx, ecx
call fcn.14006efa0
mov rdx, qword [rdi]
mov rcx, qword [rsi + 0x40]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
lea r8, str.winusbx_open
lea r9, str.could_not_open_device__s__interface__d_:__s
mov edx, 1
call fcn.140055400
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 5
setne cl
neg ecx
or ecx, 0xfffffffd
cmp eax, 2
mov eax, 0xfffffffc
cmovne eax, ecx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14006a0e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
lea rsi, [0x14014aa10]
mov rcx, rsi
call fcn.140042db0
test al, al
je 0x14006a149
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14014aa18], eax
lea rdi, [0x14014aa10]
lea rcx, [0x14014aa20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x14014aa48], 0
lea rcx, [0x14014aa50]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call fcn.140042e10
mov ecx, dword [0x14014aa18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14006a1df
mov rdi, rax
xor r15d, r15d
lea rbx, [0x14014aa20]
mov r12, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r13, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14006a189
inc r15
cmp r15, 0x40
je 0x14006a1b7
mov r14, qword [rdi + r15*8]
test r14, r14
je 0x14006a180
mov qword [rdi + r15*8], 0
mov rcx, rbx
call r12
mov rbp, qword [rsi + r15*8 + 0x40]
mov rcx, rbx
call r13
test rbp, rbp
je 0x14006a180
mov rcx, r14
call rbp
jmp 0x14006a180
mov ecx, dword [0x14014aa18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret