joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4680
Capabilities:
Get disk size

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rsi, rdx
lea rdi, [rsp + 0x50]
mov rbx, rcx
call dbg.std::_V2::system_category()
pcmpeqd xmm0, xmm0
mov rdx, rsi
mov rcx, rdi
mov rbp, rax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0xffffffffffffffff
call dbg.std::filesystem::absolute(std::filesystem::__cxx11::path const&)
mov rcx, rdi
call dbg.std::filesystem::__cxx11::path::remove_filename()
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400b47a0
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1400b470e
mov qword [rbx], rax
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400b471c
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400b472a
mov qword [rbx + 0x10], rax
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400b4780
lea rcx, [rsp + 0x70]
xor r12d, r12d
call dbg.std::filesystem::__cxx11::path::_List::_Impl_deleter::operator()(std::filesystem::__cxx11::path::_List::_Impl*) const
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x1400b4764
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call dbg.operator delete(void*, unsigned long long)
test r12d, r12d
jne 0x1400b47ce
mov rax, rbx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x1400b4764
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call dbg.operator delete(void*, unsigned long long)
jmp 0x1400b4764
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x70]
mov r12d, eax
test rdx, rdx
je 0x1400b47bd
lea rcx, [rsp + 0x70]
call dbg.std::filesystem::__cxx11::path::_List::_Impl_deleter::operator()(std::filesystem::__cxx11::path::_List::_Impl*) const
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
jne 0x1400b4750
jmp 0x1400b475f
mov ecx, 0x30
call dbg.__cxa_allocate_exception
lea rdx, str.cannot_get_free_space
mov rcx, rdi
mov r13, rax
call fcn.1400fe7a0
mov eax, r12d
lea r9, [rsp + 0x20]
mov r8, rsi
mov rdx, rdi
mov rcx, r13
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbp
call dbg.std::filesystem::__cxx11::filesystem_error::filesystem_error(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::filesystem::__cxx11::path const&, std::error_code)
mov rcx, rdi
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_dispose()
lea r8, [dbg.std::filesystem::__cxx11::filesystem_error::~filesystem_error()]
lea rdx, [0x140126aa0]
mov rcx, r13
call dbg.__cxa_throw
mov rbx, rax
jmp 0x1400b4838
mov rcx, r13
call dbg.__cxa_free_exception
mov rcx, rbx
call dbg._Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b4850
Capabilities:
Get disk size

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
pcmpeqd xmm0, xmm0
lea rdi, [rsp + 0x40]
movups xmmword [rcx], xmm0
mov rbx, rcx
mov rsi, r8
mov qword [rcx + 0x10], 0xffffffffffffffff
mov rcx, rdi
call dbg.std::filesystem::absolute(std::filesystem::__cxx11::path const&)
mov rcx, rdi
call dbg.std::filesystem::__cxx11::path::remove_filename()
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400b4940
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400b48cb
mov qword [rbx], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400b48d9
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x1400b4930
call dbg.std::_V2::system_category()
xor edi, edi
mov rdx, qword [rsp + 0x60]
mov dword [rsi], edi
mov qword [rsi + 8], rax
test rdx, rdx
je 0x1400b4904
lea rcx, [rsp + 0x60]
call dbg.std::filesystem::__cxx11::path::_List::_Impl_deleter::operator()(std::filesystem::__cxx11::path::_List::_Impl*) const
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x1400b4922
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rax + 2]
call dbg.operator delete(void*, unsigned long long)
mov rax, rbx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
mov qword [rbx + 0x10], rax
jmp 0x1400b48e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dbg.std::_V2::system_category()
jmp 0x1400b48ea
Function at 0x1400b4950
Capabilities:
Delete directory
Delete file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, rcx
lea rdi, [rsp + 0x30]
mov dword [rsp + 0x30], 0
call dbg.std::_V2::system_category()
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov rsi, rax
call dbg.std::filesystem::symlink_status(std::filesystem::__cxx11::path const&, std::error_code&)
test al, al
jne 0x1400b4998
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1400b49c8
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
cmp al, 0xff
je 0x1400b498b
mov rdx, rdi
mov rcx, rbx
call dbg.std::filesystem::status(std::filesystem::__cxx11::path const&, std::error_code&)
cmp al, 2
je 0x1400b4a28
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400b4a39
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400b4a50
mov ecx, 0x30
lea rdi, [rsp + 0x40]
call dbg.__cxa_allocate_exception
lea rdx, str.cannot_remove
mov rcx, rdi
mov rsi, rax
call fcn.1400fe7a0
movdqa xmm0, xmmword [rsp + 0x30]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
lea r9, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call dbg.std::filesystem::__cxx11::filesystem_error::filesystem_error(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::filesystem::__cxx11::path const&, std::error_code)
mov rcx, rdi
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_dispose()
lea r8, [dbg.std::filesystem::__cxx11::filesystem_error::~filesystem_error()]
lea rdx, [0x140126aa0]
mov rcx, rsi
call dbg.__cxa_throw
nop dword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1400b49ab
mov eax, 1
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
jmp 0x1400b4987

Function at 0x1400b4a90
Capabilities:
Delete directory
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call dbg.std::filesystem::symlink_status(std::filesystem::__cxx11::path const&, std::error_code&)
test al, al
je 0x1400b4ade
cmp al, 0xff
je 0x1400b4af0
mov rdx, rbx
mov rcx, rsi
call dbg.std::filesystem::status(std::filesystem::__cxx11::path const&, std::error_code&)
cmp al, 2
je 0x1400b4b08
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400b4b15
mov eax, dword [rbx]
test eax, eax
jne 0x1400b4ade
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dbg.std::_V2::system_category()
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call dbg.std::_V2::system_category()
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x1400b4ade
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1400b4ab8
call dbg.std::_V2::system_category()
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400b4b30
Capabilities:
Move file

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rdx
lea rbp, [rsp + 0x40]
mov r12, rcx
mov dword [rsp + 0x40], 0
call dbg.std::_V2::system_category()
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov rdi, rax
call dbg.std::filesystem::status(std::filesystem::__cxx11::path const&, std::error_code&)
mov rsi, rax
cmp al, 0xff
je 0x1400b4ba8
mov ecx, dword [rsp + 0x40]
test ecx, ecx
jne 0x1400b4c0e
test al, al
jne 0x1400b4bc0
mov rdx, qword [rbx]
mov rcx, qword [r12]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400b4c78
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], rdi
jmp 0x1400b4b7c
mov rdx, rbp
mov rcx, r12
call dbg.std::filesystem::status(std::filesystem::__cxx11::path const&, std::error_code&)
mov edx, dword [rsp + 0x40]
test edx, edx
jne 0x1400b4c0e
cmp sil, 2
je 0x1400b4bf8
cmp al, 2
jne 0x1400b4b7c
call dbg.std::_V2::generic_category()
mov dword [rsp + 0x40], 0x14
mov qword [rsp + 0x48], rax
jmp 0x1400b4c0e
cmp al, 2
je 0x1400b4b7c
call dbg.std::_V2::generic_category()
mov dword [rsp + 0x40], 0x15
mov qword [rsp + 0x48], rax
mov ecx, 0x30
lea rdi, [rsp + 0x50]
call dbg.__cxa_allocate_exception
lea rdx, str.cannot_rename
mov rcx, rdi
mov rsi, rax
call fcn.1400fe7a0
lea rax, [rsp + 0x30]
mov r9, rbx
mov r8, r12
mov rdx, rdi
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [rsp + 0x40]
mov rcx, rsi
movaps xmmword [rsp + 0x30], xmm0
call dbg.std::filesystem::__cxx11::filesystem_error::filesystem_error(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::filesystem::__cxx11::path const&, std::filesystem::__cxx11::path const&, std::error_code)
mov rcx, rdi
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_dispose()
lea r8, [dbg.std::filesystem::__cxx11::filesystem_error::~filesystem_error()]
lea rdx, [0x140126aa0]
mov rcx, rsi
call dbg.__cxa_throw
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x1400b4cb8
call rdi
mov dword [rax], 5
call dbg.std::_V2::generic_category()
mov rsi, rax
call rdi
mov qword [rsp + 0x48], rsi
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x1400b4c0e
jmp 0x1400b4b97
call rdi
mov dword [rax], 0xd
jmp 0x1400b4c92
Function at 0x1400b4cf0
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
mov rbx, r8
mov rcx, rsi
call dbg.std::filesystem::status(std::filesystem::__cxx11::path const&, std::error_code&)
mov rdi, rax
cmp al, 0xff
je 0x1400b4d50
mov ecx, dword [rbx]
test ecx, ecx
jne 0x1400b4d43
test al, al
jne 0x1400b4d68
mov rdx, qword [rsi]
mov rcx, qword [rbp]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400b4db0
call dbg.std::_V2::system_category()
mov dword [rbx], 0
mov qword [rbx + 8], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call dbg.std::_V2::system_category()
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x1400b4d1d
mov rdx, rbx
mov rcx, rbp
call dbg.std::filesystem::status(std::filesystem::__cxx11::path const&, std::error_code&)
mov edx, dword [rbx]
test edx, edx
jne 0x1400b4d43
cmp dil, 2
je 0x1400b4d98
cmp al, 2
jne 0x1400b4d1d
call dbg.std::_V2::generic_category()
mov dword [rbx], 0x14
mov qword [rbx + 8], rax
jmp 0x1400b4d43
cmp al, 2
je 0x1400b4d1d
call dbg.std::_V2::generic_category()
mov dword [rbx], 0x15
mov qword [rbx + 8], rax
jmp 0x1400b4d43
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x1400b4de5
call rdi
mov dword [rax], 5
call dbg.std::_V2::generic_category()
mov rsi, rax
call rdi
mov eax, dword [rax]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call rdi
mov dword [rax], 0xd
jmp 0x1400b4dca

Function at 0x1400c06b0
Capabilities:
Get disk size

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [rsp + 0x90]
mov rdi, rdx
mov rbp, r8
mov rsi, r9
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400c0748
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400c070a
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400c0718
mov qword [rbp], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x1400c0740
call dbg.std::_V2::system_category()
xor esi, esi
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsi], rax
jmp 0x1400c0722
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dbg.std::_V2::system_category()
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400c6330
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1400c6378
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400c634a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400df480
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400df4a8
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400df4f0
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400df4c0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400df4fc
call rbp
cmp dword [rax], 4
je 0x1400df4c0
lea rcx, str.random_device_could_not_be_read
call dbg.std::__throw_runtime_error(char const*)
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400df820
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400df848
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400df890
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400df860
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400df89c
call rbp
cmp dword [rax], 4
je 0x1400df860
lea rcx, str.random_device_could_not_be_read
call dbg.std::__throw_runtime_error(char const*)
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400f74c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
xor edx, edx
test eax, eax
cmovs eax, edx
add rsp, 0x58
ret

Function at 0x14010ee40
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x14010ee98
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x14010ee70
and edx, 7
je 0x14010ef42
lea eax, [rdx - 1]
mov ecx, edx
cdqe
movzx eax, byte [r11 + rax]
sub ecx, 2
js 0x14010ef31
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 3]
cmp rdx, 2
je 0x14010ef31
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 4]
cmp rdx, 3
je 0x14010ef31
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 5]
cmp rdx, 4
je 0x14010ef31
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 6]
cmp rdx, 5
je 0x14010ef31
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
cmp edx, 6
je 0x14010ef31
movzx edx, byte [r11]
shl rax, 8
add rax, rdx
xor rax, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rax
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret
Function at 0x140110570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, r8
test rdx, rdx
je 0x14011059c
movabs r9, 0x100000001b3
add rdx, rcx
nop dword [rax]
movsx r8, byte [rcx]
add rcx, 1
xor rax, r8
imul rax, r9
cmp rcx, rdx
jne 0x140110588
ret

Function at 0x140119f80
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [0x140124f10]
mov r8d, dword [rax]
test r8d, r8d
jne 0x14011a11d
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x14011b7f8], 0
lea rbp, str.obj_count
movups xmmword [0x14011b7e8], xmm0
movabs rsi, 0x2e78786362696c67
movabs rdi, 0x6c6f6f705f68652e
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x14011a035
jmp 0x14011a0e7
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x14011a098
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rsi
jne 0x14011a020
cmp qword [rbx + 7], rdi
jne 0x14011a020
cmp byte [rbx + 0xf], 0x2e
jne 0x14011a020
movabs rax, 0x657a69735f6a626f
lea r12, [rbx + 0x10]
cmp qword [rbx + 0x10], rax
jne 0x14011a06f
cmp byte [rbx + 0x18], 0x3d
je 0x14011a12e
mov r8d, 9
mov rdx, r12
mov rcx, rbp
call sym.memcmp
test eax, eax
jne 0x14011a08e
cmp byte [rbx + 0x19], 0x3d
je 0x14011a170
mov rbx, r12
jmp 0x14011a020
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x14011b7f8], rbx
jne 0x14011a0f7
lea rcx, [sym.__tcf_0]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x14011b7f8], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x14011b7f0], rax
test rax, rax
je 0x14011a17c
xor edx, edx
mov qword [0x14011b7e8], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x14011a0cf
lea rcx, [0x14011b7c0]
call dbg.__gthr_win32_mutex_init_function
jmp 0x140119f9f
mov eax, 8
lea r13, [rsp + 0x30]
lea rdx, [rsp + 0x28]
lea rcx, [r12 + rax + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x14011a15f
test dl, dl
jne 0x14011a020
test eax, eax
js 0x14011a020
mov dword [r13 + 0x10], eax
jmp 0x14011a020
mov eax, 9
lea r13, [rsp + 0x48]
jmp 0x14011a138
xor ecx, ecx
mov qword [0x14011b7f8], rcx
jmp 0x14011a0cf
Function at 0x140008770
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push r12
mov eax, 0x2110
push rbp
push rdi
push rsi
push rbx
call fcn.14000eb80
sub rsp, rax
mov r8d, 0x1000
xor ebx, ebx
lea rsi, [rsp + 0x110]
mov rdx, rcx
lea rbp, [rsp + 0xa0]
mov dword [rsp + 0x5c], 0
mov rcx, rsi
call fcn.140009100
mov edx, 1
lea rcx, [0x140007c30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov rcx, rbp
mov dword [rsp + 0x60], 0x18
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 1
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
pxor xmm0, xmm0
mov eax, 1
xor ecx, ecx
movups xmmword [rsp + 0xa8], xmm0
mov r12, qword [fcn.140016d90]
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0xdc], 0x101
mov word [rsp + 0xe0], ax
call r12
mov rcx, rax
call sub.msvcrt.dll__fileno_1
mov rdi, qword [sym.imp.msvcrt.dll__get_osfhandle]
mov ecx, eax
call rdi
mov ecx, 1
cmp rax, 0xffffffffffffffff
cmove rax, rbx
mov qword [rsp + 0xf0], rax
call r12
mov rcx, rax
call sub.msvcrt.dll__fileno_1
mov ecx, eax
call rdi
mov ecx, 2
cmp rax, 0xffffffffffffffff
cmove rax, rbx
mov qword [rsp + 0xf8], rax
call r12
mov rcx, rax
call sub.msvcrt.dll__fileno_1
mov ecx, eax
call rdi
cmp rax, 0xffffffffffffffff
cmove rax, rbx
mov qword [rsp + 0x100], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
mov qword [rsp + 0x40], rbp
mov rcx, rsi
mov rdx, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140008918
mov rcx, qword [rsp + 0x80]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x5c]
add rsp, 0x2110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.Error_creating_child_process__n
lea rcx, str.CreateProcessW
call fcn.140002cf0
mov eax, 0xffffffff
add rsp, 0x2110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14000ddc0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140016d90
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140016d90
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x14000de30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140024384]
mov rbx, rcx
test esi, esi
jle 0x14000df60
mov rax, qword [0x140024388]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000de7b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000df05
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000de60
mov rcx, rbx
call fcn.14000e8a0
mov rdi, rax
test rax, rax
je 0x14000df82
mov rax, qword [0x140024388]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000e9e0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140024388]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000df67
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000defe
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x14000df10
add dword [0x140024384], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140024388]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000defe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000ddc0
nop dword [rax]
xor esi, esi
jmp 0x14000de88
mov rax, qword [0x140024388]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000ddc0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000ddc0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000e510
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400243e0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400243c0]
test rbx, rbx
je 0x14000e56c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000e563
test eax, eax
jne 0x14000e563
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000e548
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]