joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049b560
Capabilities:
Write file on windows

Disassembly:
push rbp
push r12
push rbx
mov rbp, rsp
sub rsp, 0x30
lea rax, [rbp + 0x28]
mov r12, rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov qword [rbp - 8], rax
call sub.msys_2.0.dll___getreent
mov r8d, 0xa
mov edx, 1
lea rcx, str.readline:
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
mov rbx, qword [rbp - 8]
call sub.msys_2.0.dll___getreent
mov rdx, r12
mov rcx, qword [rax + 0x18]
mov r8, rbx
call sub.msys_2.0.dll_vfprintf
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call fcn.1004d2c50
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x18]
call fcn.1004d2bc0
nop
add rsp, 0x30
pop rbx
pop r12
pop rbp
ret

Function at 0x10049ca90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbp
push r13
push r12
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x40
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x10049cac0
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop r12
pop r13
pop rbp
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
mov qword [rsp + 0x38], 0
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r13
mov ebx, eax
test eax, eax
je 0x10049caaa
movsxd rcx, eax
call sym.bash.exe_xmalloc
xor edx, edx
mov dword [rsp + 0x28], ebx
mov r8, rsi
mov qword [rsp + 0x20], rax
mov r12, rax
mov r9d, 0xffffffff
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
call r13
cmp ebx, eax
jne 0x10049cbf8
test r12, r12
je 0x10049caaa
mov edx, 0xd
mov rcx, r12
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x10049cbd0
sub rax, r12
lea ecx, [rax + 1]
mov rbx, rax
movsxd rcx, ecx
call sym.bash.exe_xmalloc
movsxd r8, ebx
mov rdx, r12
mov byte [rax + r8], 0
mov rcx, rax
mov r13, rax
call sub.msys_2.0.dll_strncpy
mov rax, qword [sym.bash.exe_rl_point]
mov ecx, dword [rax]
call sym.bash.exe__rl_set_mark_at_pos
mov rcx, r13
call sym.bash.exe_rl_insert_text
cmp r13, r12
je 0x10049caaa
mov rcx, r13
call sym.bash.exe_xfree
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop r12
pop r13
pop rbp
ret
mov rax, qword [sym.bash.exe_rl_point]
mov ecx, dword [rax]
call sym.bash.exe__rl_set_mark_at_pos
mov rcx, r12
call sym.bash.exe_rl_insert_text
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop r12
pop r13
pop rbp
ret
mov rcx, r12
call sym.bash.exe_xfree
jmp 0x10049caaa
Function at 0x10049dc90
Capabilities:
Get socket status

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [sym.bash.exe_rl_instream]
mov rcx, qword [rax]
call sub.msys_2.0.dll_fileno
lea r9, [rbp - 0x18]
test eax, eax
lea edx, [rax + 0x3f]
mov r8d, eax
cmovns edx, eax
sar r8d, 0x1f
shr r8d, 0x1a
lea ecx, [rax + r8]
sar edx, 6
and ecx, 0x3f
movsxd rdx, edx
sub ecx, r8d
mov r8d, 1
shl r8, cl
mov qword [rbp + rdx*8 - 0x20], r8
mov qword [rbp + rdx*8 - 0x18], r8
movsxd rdx, dword [0x1004de5e0]
mov rcx, rdx
imul rdx, rdx, 0x431bde83
mov r8d, ecx
sar r8d, 0x1f
sar rdx, 0x32
sub edx, r8d
movsxd r8, edx
imul edx, edx, 0xf4240
mov qword [rbp - 0x10], r8
xor r8d, r8d
sub ecx, edx
lea rdx, [rbp - 0x20]
movsxd rcx, ecx
mov qword [rbp - 8], rcx
lea ecx, [rax + 1]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call sub.msys_2.0.dll_select
test eax, eax
setg al
movzx eax, al
add rsp, 0x50
pop rbp
ret

Function at 0x10049de10
Capabilities:
Get socket status

Disassembly:
mov rax, qword [sym.bash.exe_rl_input_available_hook]
test rax, rax
je 0x10049de20
jmp rax
jmp fcn.10049dc90
Function at 0x1004a7080
Capabilities:
Move file

Disassembly:
push rbp
mov eax, 0x1038
push r14
push r13
push r12
call fcn.1004d2960
sub rsp, rax
lea rbp, [rsp + 0x80]
mov r8d, 0x1000
mov r12, rdx
lea r14, [rbp - 0x60]
mov r13, rcx
mov rdx, r14
mov rcx, r12
call sub.msys_2.0.dll_readlink
test rax, rax
jg 0x1004a70e0
mov rdx, r12
mov rcx, r13
call sub.msys_2.0.dll_rename
add rsp, 0x1038
pop r12
pop r13
pop r14
pop rbp
ret
mov rdx, r14
mov rcx, r13
mov byte [rbp + rax - 0x60], 0
call sub.msys_2.0.dll_rename
add rsp, 0x1038
pop r12
pop r13
pop r14
pop rbp
ret

Function at 0x1004a7ad0
Capabilities:
Get file attributes

Disassembly:
mov r8d, 0xffffffff
xor edx, edx
jmp sym.bash.exe_read_history_range
Function at 0x1004a8020
Capabilities:
Get file attributes

Disassembly:
mov rax, qword [sym.bash.exe_history_length]
mov r8d, 1
mov edx, dword [rax]
jmp fcn.1004a71b0

Function at 0x1004a93a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x20
mov rbx, qword [sym.bash.exe__rl_color_indicator]
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x1004a942b
mov rdx, qword [rbx + 0x48]
cmp rax, 1
je 0x1004a9438
cmp rax, 2
je 0x1004a9420
mov rsi, qword [sym.bash.exe_rl_outstream]
mov rcx, qword [rbx + 8]
mov r8d, 1
mov rdx, qword [rbx]
mov r9, qword [rsi]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x48]
mov r8d, 1
mov r9, qword [rsi]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov r8d, 1
mov r9, qword [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rbp
jmp sub.msys_2.0.dll_fwrite
cmp byte [rdx], 0x30
jne 0x1004a93ca
cmp byte [rdx + 1], 0x30
jne 0x1004a93ca
add rsp, 0x20
pop rbx
pop rsi
pop rbp
ret
cmp byte [rdx], 0x30
jne 0x1004a93ca
jmp 0x1004a942b

Function at 0x1004a9440
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x20
mov rbx, qword [sym.bash.exe__rl_color_indicator]
mov eax, 1
cmp qword [rbx + 0x98], 0
je 0x1004a94be
mov ecx, 4
call fcn.1004a9310
mov rsi, qword [sym.bash.exe_rl_outstream]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
mov r9, qword [rsi]
test al, al
jne 0x1004a94d0
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x90]
mov r9, qword [rsi]
mov r8d, 1
mov rcx, qword [rbx + 0x98]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov r8d, 1
mov r9, qword [rsi]
call sub.msys_2.0.dll_fwrite
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rbp
ret
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov r8d, 1
mov r9, qword [rsi]
call sub.msys_2.0.dll_fwrite
mov r9, qword [rsi]
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
jmp 0x1004a947f
Function at 0x1004a9a30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x20
mov rbx, qword [sym.bash.exe__rl_color_indicator]
mov rsi, qword [sym.bash.exe_rl_outstream]
mov rcx, qword [rbx + 0x28]
mov r9, qword [rsi]
test rcx, rcx
je 0x1004a9a70
mov rdx, qword [rbx + 0x20]
mov r8d, 1
add rsp, 0x20
pop rbx
pop rsi
pop rbp
jmp sub.msys_2.0.dll_fwrite
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x38]
mov r8d, 1
mov r9, qword [rsi]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov r9, qword [rsi]
jmp 0x1004a9a58
Function at 0x1004a9ab0
Capabilities:
Parse credit card information

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
mov rbp, rsp
xor r10d, r10d
lea rdi, [0x1004fb040]
mov rax, qword [rdx]
mov r11, qword [rcx]
mov rsi, rcx
mov rbx, rdx
mov r12d, r8d
mov rcx, r11
movzx edx, byte [rax]
cmp dl, 0x5c
je 0x1004a9b31
jg 0x1004a9b00
cmp dl, 0x3d
je 0x1004a9be0
jle 0x1004a9b60
mov byte [rcx], dl
add rax, 1
lea r11, [rcx + 1]
add r10, 1
jmp 0x1004a9ad4
cmp dl, 0x5e
jne 0x1004a9aec
movzx edx, byte [rax + 1]
lea r13, [rax + 1]
lea r11d, [rdx - 0x40]
cmp r11b, 0x3e
ja 0x1004a9b88
and edx, 0x1f
add rax, 2
add r10, 1
add rcx, 1
mov byte [rcx - 1], dl
movzx edx, byte [rax]
cmp dl, 0x5c
jne 0x1004a9adf
movzx edx, byte [rax + 1]
mov r11, rcx
add rax, 2
test dl, dl
je 0x1004a9b90
lea r13d, [rdx - 0x30]
cmp r13b, 0x48
ja case.0x1004a9b55.8
movzx ecx, r13b
movsxd rcx, dword [rdi + rcx*4]
add rcx, rdi
jmp rcx
test dl, dl
je 0x1004a9b69
cmp dl, 0x3a
jne 0x1004a9aec
mov r8d, 1
mov qword [rsi], rcx
mov qword [rbx], rax
mov eax, r8d
mov qword [r9], r10
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
cmp dl, 0x3f
je 0x1004a9bf0
mov rax, r13
xor r8d, r8d
jmp 0x1004a9b6f
movzx ecx, byte [rax]
mov edx, r13d
lea r13d, [rcx - 0x30]
cmp r13b, 7
ja case.0x1004a9b55.8
nop dword [rax + rax]
add rax, 1
lea edx, [rcx + rdx*8 - 0x30]
movzx ecx, byte [rax]
lea r13d, [rcx - 0x30]
cmp r13b, 7
jbe 0x1004a9bb0
nop dword [rax]
mov byte [r11], dl
lea rcx, [r11 + 1]
add r10, 1
jmp 0x1004a9ad7
test r12b, r12b
jne 0x1004a9b6f
jmp 0x1004a9aec
mov byte [rcx], 0x7f
add r10, 1
mov rax, r13
add rcx, 1
jmp 0x1004a9ad7
xor edx, edx
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, 0x46
jg 0x1004a9c36
cmp cl, 0x40
jg 0x1004a9cf8
lea r13d, [rcx - 0x30]
cmp r13b, 9
ja case.0x1004a9b55.8
add rax, 1
shl edx, 4
lea edx, [rcx + rdx - 0x30]
movzx ecx, byte [rax]
cmp cl, 0x46
jle 0x1004a9c10
lea r13d, [rcx - 0x61]
cmp r13b, 5
ja case.0x1004a9b55.8
shl edx, 4
add rax, 1
lea edx, [rcx + rdx - 0x57]
jmp 0x1004a9c08
mov edx, 9
lea rcx, [r11 + 1]
add r10, 1
mov byte [r11], dl
jmp 0x1004a9ad7
mov edx, 0xd
lea rcx, [r11 + 1]
add r10, 1
mov byte [r11], dl
jmp 0x1004a9ad7
mov edx, 0xb
lea rcx, [r11 + 1]
add r10, 1
mov byte [r11], dl
jmp 0x1004a9ad7
mov edx, 0x7f
lea rcx, [r11 + 1]
add r10, 1
mov byte [r11], dl
jmp 0x1004a9ad7
mov edx, 0x20
lea rcx, [r11 + 1]
add r10, 1
mov byte [r11], dl
jmp 0x1004a9ad7
mov edx, 0xa
lea rcx, [r11 + 1]
add r10, 1
mov byte [r11], dl
jmp 0x1004a9ad7
mov edx, 0xc
lea rcx, [r11 + 1]
add r10, 1
mov byte [r11], dl
jmp 0x1004a9ad7
mov edx, 8
lea rcx, [r11 + 1]
add r10, 1
mov byte [r11], dl
jmp 0x1004a9ad7
shl edx, 4
add rax, 1
lea edx, [rcx + rdx - 0x37]
jmp 0x1004a9c08
mov edx, 7
jmp case.0x1004a9b55.8
mov edx, 0x1b
jmp case.0x1004a9b55.8
Function at 0x1004a9fe0
Capabilities:
Get socket status

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x80]
mov rax, qword [sym.bash.exe_rl_explicit_arg]
mov esi, dword [rax]
mov r12d, edx
test esi, esi
jne 0x1004aa012
mov eax, dword [sym.bash.exe_rl_blink_matching_paren]
test eax, eax
jne 0x1004aa030
call sym.bash.exe__rl_insert_char
xor r13d, r13d
mov eax, r13d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
call sym.bash.exe__rl_insert_char
mov rax, qword [sym.bash.exe_rl_redisplay_function]
call qword [rax]
mov rax, qword [sym.bash.exe_rl_point]
mov eax, dword [rax]
mov dword [rbp - 0x44], eax
lea ebx, [rax - 2]
cmp r12d, 0x5d
je 0x1004aa140
cmp r12d, 0x7d
je 0x1004aa078
cmp r12d, 0x29
je 0x1004aa130
mov r13d, 1
jmp 0x1004aa01a
mov dword [rbp - 0x48], 0x7b
test ebx, ebx
js 0x1004aa06c
mov rax, qword [sym.bash.exe_rl_line_buffer]
mov r13d, 1
mov rdi, qword [rax]
mov rax, qword [sym.bash.exe_rl_basic_quote_characters]
mov r14, qword [rax]
jmp 0x1004aa0bc
test r14, r14
je 0x1004aa0b7
mov edx, r15d
mov rcx, r14
call sub.msys_2.0.dll_strchr
test rax, rax
cmovne esi, r15d
cmp ebx, 0xffffffff
je 0x1004aa06c
movsxd rax, ebx
movsx r15d, byte [rdi + rax]
test esi, esi
je 0x1004aa0dd
sub ebx, 1
cmp r15d, esi
jne 0x1004aa0a0
cmp ebx, 0xffffffff
je 0x1004aa06c
movsxd rax, ebx
movsx r15d, byte [rdi + rax]
sub ebx, 1
mov esi, r15d
lea eax, [rbx + 1]
mov dword [rbp - 0x44], eax
test r14, r14
je 0x1004aa0fd
mov edx, esi
mov rcx, r14
call sub.msys_2.0.dll_strchr
test rax, rax
jne 0x1004aa0b7
cmp r12d, r15d
je 0x1004aa150
cmp r15d, dword [rbp - 0x48]
je 0x1004aa160
cmp ebx, 0xffffffff
je 0x1004aa06c
movsxd rax, ebx
sub ebx, 1
movsx r15d, byte [rdi + rax]
lea eax, [rbx + 1]
mov dword [rbp - 0x44], eax
mov esi, r15d
test r14, r14
jne 0x1004aa0ee
jmp 0x1004aa0fd
mov dword [rbp - 0x48], 0x28
jmp 0x1004aa07f
mov dword [rbp - 0x48], 0x5b
jmp 0x1004aa07f
add r13d, 1
cmp ebx, 0xffffffff
jne 0x1004aa111
jmp 0x1004aa06c
sub r13d, 1
jne 0x1004aa108
mov rsi, qword [sym.bash.exe_rl_instream]
mov qword [rbp - 0x38], 0
mov rcx, qword [rsi]
call sub.msys_2.0.dll_fileno
mov rcx, qword [rsi]
mov ebx, eax
call sub.msys_2.0.dll_fileno
mov edi, dword [rbp - 0x44]
test eax, eax
lea edx, [rax + 0x3f]
cmovns edx, eax
mov eax, ebx
sar eax, 0x1f
shr eax, 0x1a
sar edx, 6
lea ecx, [rbx + rax]
movsxd rdx, edx
and ecx, 0x3f
sub ecx, eax
mov eax, 1
shl rax, cl
or qword [rbp + rdx*8 - 0x38], rax
movsxd rax, dword [0x1004de840]
mov rdx, rax
imul rax, rax, 0x431bde83
mov ecx, edx
sar ecx, 0x1f
sar rax, 0x32
sub eax, ecx
movsxd rcx, eax
imul eax, eax, 0xf4240
mov qword [rbp - 0x30], rcx
sub edx, eax
mov rax, qword [sym.bash.exe_rl_point]
movsxd rdx, edx
mov ebx, dword [rax]
mov dword [rax], edi
mov rax, qword [sym.bash.exe_rl_redisplay_function]
mov qword [rbp - 0x28], rdx
call qword [rax]
lea rax, [rbp - 0x30]
lea rdx, [rbp - 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov ecx, 1
call sub.msys_2.0.dll_select
mov rax, qword [sym.bash.exe_rl_point]
mov dword [rax], ebx
jmp 0x1004aa01a
Function at 0x1004adca0
Capabilities:
Terminate process

Disassembly:
push r12
push rbx
sub rsp, 0x38
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x68], r9
mov r12, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
call fcn.1004ad9a0
mov qword [rsp + 0x28], rbx
call sub.msys_2.0.dll___getreent
mov r8, rbx
mov rdx, r12
mov rcx, qword [rax + 0x18]
call sub.msys_2.0.dll_vfprintf
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call fcn.1004d2c50
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop word [rax + rax]

Function at 0x1004add00
Capabilities:
Terminate process

Disassembly:
push r12
push rbx
sub rsp, 0x38
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x68], r9
mov r12, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
call fcn.1004ad9a0
mov qword [rsp + 0x28], rbx
call sub.msys_2.0.dll___getreent
mov r8, rbx
mov rdx, r12
mov rcx, qword [rax + 0x18]
call sub.msys_2.0.dll_vfprintf
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call fcn.1004d2c50
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop
nop
nop
nop
nop
nop
Function at 0x1004b0ca0
Capabilities:
Read file on windows

Disassembly:
push r15
mov eax, 0x8038
push r14
push r13
push r12
call fcn.1004d2960
sub rsp, rax
xor r14d, r14d
mov r13, rdx
lea rdx, [0x1004fc96e]
call sub.msys_2.0.dll_fopen
mov r12, rax
test rax, rax
je 0x1004b0cf6
lea r15, [rsp + 0x20]
mov r9, rax
mov r8d, 0x8001
mov edx, 1
mov rcx, r15
call sub.msys_2.0.dll_fread
test eax, eax
jg 0x1004b0d10
mov rcx, r12
call sub.msys_2.0.dll_fclose
mov eax, r14d
add rsp, 0x8038
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, eax
mov rdx, r15
mov rcx, r13
call sym.bash.exe__nc_read_termtype
mov r14d, eax
test eax, eax
jne 0x1004b0cee
mov rcx, r13
call sym.bash.exe__nc_free_termtype2
jmp 0x1004b0cee

Function at 0x1004b10d0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r13, rdx
mov edx, 4
mov r12, rcx
call sym.bash.exe__nc_access
test eax, eax
jns 0x1004b1100
xor eax, eax
add rsp, 0x28
pop r12
pop r13
ret
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp fcn.1004b0ca0

Function at 0x1004b14a0
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x1004b14cc
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x4000
sete al
add rsp, 0xa8
ret

Function at 0x1004b14e0
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x1004b150c
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x8000
sete al
add rsp, 0xa8
ret
Function at 0x1004b81b0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r12, rcx
mov rsi, r8
mov rdx, rcx
mov ecx, 0x22
call sub.msys_2.0.dll_putc
cmp rbx, rsi
je 0x1004b820b
lea rdi, [0x100502af0]
lea rbp, [0x100502af4]
nop dword [rax + rax]
movsx ecx, byte [rbx]
add rbx, 1
cmp cl, 0xa
je 0x1004b8240
cmp cl, 0x22
je 0x1004b8228
cmp cl, 0x5c
je 0x1004b8228
mov rdx, r12
call sub.msys_2.0.dll_putc
cmp rsi, rbx
jne 0x1004b81e8
mov rdx, r12
mov ecx, 0x22
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msys_2.0.dll_putc
mov ecx, 0x5c
mov rdx, r12
call sub.msys_2.0.dll_putc
movsx ecx, byte [rbx - 1]
jmp 0x1004b81fe
mov r9, r12
mov r8d, 3
mov edx, 1
mov rcx, rdi
call sub.msys_2.0.dll_fwrite
cmp rsi, rbx
je 0x1004b8280
mov r9, r12
mov r8d, 2
mov edx, 1
mov rcx, rbp
call sub.msys_2.0.dll_fwrite
jmp 0x1004b81e8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1004b8290
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rsi, [0x1004deda0]
mov r14, rcx
mov rcx, rsi
mov r15, rdx
mov r13, r8
mov rbx, r9
call sub.msys_2.0.dll_pthread_mutex_lock
test eax, eax
jne 0x1004d56c0
mov rdi, qword [0x1006042c8]
test rdi, rdi
je 0x1004b830b
mov rdx, rdi
mov rcx, r14
call sub.msys_2.0.dll_strcmp
mov r12, qword [0x1006042c0]
test eax, eax
je 0x1004b835f
test r12, r12
je 0x1004b8303
mov rcx, r12
call sub.msys_2.0.dll_fclose
mov rdi, qword [0x1006042c8]
mov qword [0x1006042c0], 0
mov rcx, rdi
call fcn.1004d2c80
mov rcx, r14
call sub.msys_2.0.dll_strlen
lea rdi, [rax + 1]
mov rcx, rdi
call fcn.1004d2f30
mov qword [0x1006042c8], rax
mov rcx, rax
test rax, rax
je 0x1004b8435
mov r8, rdi
mov rdx, r14
call fcn.1004d2fe0
lea rdx, [0x100502af7]
mov rcx, r14
call sub.msys_2.0.dll_fopen
mov qword [0x1006042c0], rax
mov r12, rax
test rax, rax
je 0x1004b8435
mov r9, r12
mov r8d, 7
mov edx, 1
lea rcx, str.domain
call sub.msys_2.0.dll_fwrite
mov rcx, r15
call sub.msys_2.0.dll_strlen
mov rdx, r15
mov rcx, r12
lea r8, [r15 + rax]
call fcn.1004b81b0
mov edx, 4
mov rcx, r13
call sub.msys_2.0.dll_strchr
mov r14, rax
test rax, rax
je 0x1004b83d1
mov r9, r12
mov r8d, 9
mov edx, 1
lea rcx, str._nmsgctxt
call sub.msys_2.0.dll_fwrite
mov rdx, r13
mov r8, r14
mov rcx, r12
call fcn.1004b81b0
lea r13, [r14 + 1]
mov r9, r12
mov r8d, 7
mov edx, 1
lea rcx, str._nmsgid
call sub.msys_2.0.dll_fwrite
mov rcx, r13
call sub.msys_2.0.dll_strlen
mov rdx, r13
mov rcx, r12
lea r8, [r13 + rax]
call fcn.1004b81b0
mov eax, dword [rsp + 0x80]
mov r9, r12
test eax, eax
jne 0x1004b8458
mov r8d, 0xb
mov edx, 1
lea rcx, str._nmsgstr____n
call sub.msys_2.0.dll_fwrite
mov rdx, r12
mov ecx, 0xa
call sub.msys_2.0.dll_putc
mov rcx, rsi
call sub.msys_2.0.dll_pthread_mutex_unlock
test eax, eax
jne 0x1004d56c0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, 0xe
mov edx, 1
lea rcx, str._nmsgid_plural
call sub.msys_2.0.dll_fwrite
mov rcx, rbx
call sub.msys_2.0.dll_strlen
mov rdx, rbx
mov rcx, r12
lea r8, [rbx + rax]
call fcn.1004b81b0
mov r9, r12
mov r8d, 0xe
mov edx, 1
lea rcx, str._nmsgstr_0_____n
call sub.msys_2.0.dll_fwrite
jmp 0x1004b8428
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140009870]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140009880]
mov dword [rax], 1
mov rax, qword [0x140009890]
mov dword [rax], 1
mov rax, qword [0x140009860]
mov dword [rax], 1
mov rax, qword [0x140009720]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x140009850]
mov dword [0x14000c020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140009810]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400097f0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400096d0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x1400015e6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call dbg.__main
mov qword [rbp - 8], 0x21b
mov rax, qword [rbp - 8]
mov r9d, 4
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140001647
lea rax, str.Memory_allocation_failed__n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x1400016e7
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, rdx
lea rdx, [0x140008020]
mov rcx, rax
call sym.memcpy
movzx eax, byte [0x14000823c]
movzx ecx, al
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8d, ecx
mov rcx, rax
call sym.decrypt_shellcode
lea rcx, [rbp - 0x1c]
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
jne 0x1400016b9
lea rax, str.Memory_protection_change_failed__n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x1400016e7
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
call rax
mov rax, qword [rbp - 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, 0
add rsp, 0x40
pop rbp
ret