joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457c20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x004a8078], 1
je 0x457c36
call sym._pthread_once_raw.part.2.constprop.7
mov ecx, dword [0x00479c48]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x457c50
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.pop_pthread_mem
cmp qword [sym.__dyn_tls_pthread], 0
mov rbx, rax
je 0x457d40
test rax, rax
je 0x457d40
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x457d47
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov rdx, rbx
mov dword [rbx + 0xb4], 0
mov ecx, dword [0x00479c48]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x457d47
mov rax, rbx
jmp 0x457c47
xor eax, eax
jmp 0x457c47
call sym.abort
nop
nop dword [rax]
Function at 0x457ea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp edx, 3
je 0x457ec0
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, dword [0x00479c48]
cmp ecx, 0xffffffff
je 0x457eab
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x457eab
test byte [rax + 0x40], 0x30
je 0x457f55
mov rcx, qword [rax + 0x1c8]
test rcx, rcx
jne 0x457ff0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x457f1c
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x457f0c
call rsi
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
lea rcx, [rbx + 0x38]
call dbg.pthread_mutex_destroy
cmp qword [rbx + 0x1c0], 0
mov qword [rbx + 0x60], 0xffffffffffffffff
je 0x458000
mov ecx, dword [0x00479c48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, dword [rax + 0xb4]
mov rcx, qword [rbx + 0x30]
test eax, eax
jne 0x457fb0
test rcx, rcx
je 0x457f6e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x1c8]
mov qword [rbx + 0x30], 0
mov dword [rbx + 0xb4], 1
test rcx, rcx
jne 0x457fe0
test byte [rbx + 0x44], 4
je 0x457fc3
mov rcx, qword [rbx + 0x28]
mov dword [rbx], 0xdeadbeef
test rcx, rcx
je 0x457f14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x457f14
test rcx, rcx
je 0x457fbb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
call dbg.pthread_mutex_destroy
mov qword [rbx + 0x60], 0xffffffffffffffff
jmp 0x457eab
call sym._pthread_cleanup_dest.part.5
jmp 0x457f8c
call sym._pthread_cleanup_dest.part.5
jmp 0x457eef
mov rcx, rbx
call sym.push_pthread_mem.part.1
jmp 0x457f3b
Function at 0x458010
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov rbp, rsp
sub rsp, 0x28
mov qword [rbp + 0x28], rcx
lea rcx, [0x00479c38]
call dbg.pthread_mutex_lock
mov rax, qword [rbp + 0x28]
lea rbx, [rax + 0x38]
mov rcx, rbx
call dbg.pthread_mutex_lock
cmp dword [0x004a8078], 1
je 0x458049
call sym._pthread_once_raw.part.2.constprop.7
mov rdx, qword [rbp + 0x28]
mov ecx, dword [0x00479c48]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rsi, qword [rbp + 0x28]
mov rcx, rbx
mov dword [rsi + 0x68], eax
call dbg.pthread_mutex_unlock
mov rax, qword [rbp + 0x28]
mov rdx, rbp
lea rcx, [rax + 0xc0]
call sym._setjmp
test eax, eax
je 0x458121
lea rcx, [0x00479c38]
call dbg.pthread_mutex_lock
mov rax, qword [rbp + 0x28]
lea rbx, [rax + 0x38]
mov rcx, rbx
call dbg.pthread_mutex_lock
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax + 0x30]
mov rsi, qword [rax + 8]
test rcx, rcx
je 0x4580bc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x28]
cmp qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
je 0x45817e
mov rcx, rbx
call dbg.pthread_mutex_unlock
mov rcx, rbx
call dbg.pthread_mutex_destroy
mov rax, qword [rbp + 0x28]
mov qword [rax + 0x38], 0xffffffffffffffff
mov dword [rax + 0xb4], 1
lea rdi, [0x00479c38]
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45810d
xor ecx, ecx
call rbx
mov rcx, rdi
call dbg.pthread_mutex_unlock
test eax, eax
je 0x458109
mov ecx, esi
call qword [sym.imp.msvcrt.dll__endthreadex]
lea rcx, [0x00479c38]
call dbg.pthread_mutex_unlock
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x458177
mov rdi, qword [rbp + 0x28]
mov rcx, qword [rdi + 8]
call rax
mov rbx, rax
nop
nop
lea rcx, [0x00479c38]
call dbg.pthread_mutex_lock
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax + 0x1c8]
mov qword [rax + 8], rbx
test rcx, rcx
je 0x458095
call sym._pthread_cleanup_dest.part.5
jmp 0x458095
mov ebx, pe_nt_image_headers64
jmp 0x458147
mov rax, qword [rbp + 0x28]
mov rcx, rbx
mov dword [rax], 0xdeadbeef
call dbg.pthread_mutex_unlock
mov rcx, rbx
call dbg.pthread_mutex_destroy
cmp qword [rbp + 0x28], 0
je 0x4581b5
mov rax, qword [rbp + 0x28]
cmp qword [rax + 0x1c0], 0
jne 0x4581b5
mov rcx, rax
call sym.push_pthread_mem.part.1
xor edx, edx
mov ecx, dword [0x00479c48]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4580f9
Function at 0x458d50
Capabilities:
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
call dbg.__pth_gpointer_locked
test rax, rax
mov rbx, rax
je 0x458d79
mov rcx, qword [rax + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x458d90
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x458d79
lea rbp, [rbx + 0x38]
mov rcx, rbp
call dbg.pthread_mutex_lock
call sym.__pthread_self_lite
test rax, rax
je 0x458f20
mov rax, qword [rax + 0x1c8]
cmp rsi, rax
je 0x458e27
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
movzx eax, byte [rbx + 0x40]
je 0x458e80
test al, 3
jne 0x458e0e
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x004a8080], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x458dff
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call dbg.pthread_mutex_unlock
xor eax, eax
jmp 0x458d7e
mov rcx, rbp
call dbg.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
jne 0x458d79
xor eax, eax
jmp 0x458d7e
movzx eax, byte [rbx + 0x40]
test al, 3
jne 0x458e0e
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x004a8080], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x458e4f
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
jne 0x458dff
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
mov rcx, rbp
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop dword [rax + rax]
test al, 0xc
jne 0x458e0e
test al, 0xf
jne 0x458d79
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x458dff
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [dbg._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x004a8080], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x458f06
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call dbg.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x458dff
xor eax, eax
jmp 0x458dc3
Function at 0x458f30
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x00479c38]
mov edi, edx
call dbg.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x458f5e
cmp rbx, qword [rax + 0x1c8]
je 0x458f80
lea rcx, [0x00479c38]
mov esi, 3
call dbg.pthread_mutex_unlock
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test byte [rax + 0x40], 0xc
jne 0x458f5e
mov esi, dword [rax + 0xb4]
test esi, esi
jne 0x458f5e
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x458f5e
lea rcx, [0x00479c38]
call dbg.pthread_mutex_unlock
test edi, edi
je 0x458f6f
sub edi, 2
mov esi, 0x16
cmp edi, 0x15
ja 0x458f6f
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp dbg.pthread_cancel
Function at 0x459220
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r13, rcx
mov rbp, rdx
mov rsi, r8
mov rdi, r9
call sym.pop_pthread_mem
test rax, rax
mov rbx, rax
je 0x4593d6
test r13, r13
je 0x45925b
mov rax, qword [rax + 0x1c8]
mov qword [r13], rax
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
mov esi, 1
mov dword [rbx + 0xb4], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x459480
cmp esi, 1
je 0x4592c5
mov ecx, 0x14
call r14
cmp esi, 5
je 0x4592d0
add esi, 1
jmp 0x459292
xor ecx, ecx
call r12
jmp 0x4592c0
mov rax, qword [rbx + 0x30]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
test rax, rax
je 0x4593bb
test rbp, rbp
je 0x4594c0
mov eax, dword [rbp]
mov rsi, qword [rbp + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x459450
mov eax, dword [rbp + 0x18]
mov edx, esi
mov dword [rbx + 0xb8], eax
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [dbg.pthread_create_wrapper]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x45938b
mov edx, dword [rbx + 0xb8]
cmp edx, 0xfffffff2
jl 0x4593f0
cmp edx, 0xffffffff
jl 0x459470
cmp edx, 0xe
jg 0x4594b0
cmp edx, 2
mov eax, 2
cmovge edx, eax
jmp 0x4593f5
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x45939a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call dbg.pthread_mutex_destroy
mov qword [rbx + 0x60], 0xffffffffffffffff
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
test r13, r13
je 0x4593c8
mov qword [r13], 0
cmp qword [rbx + 0x1c0], 0
je 0x4594c7
mov eax, 0xb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 0xfffffff1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
je 0x459441
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x459428
call sym.__pthread_self_lite
mov eax, dword [rax + 0xb8]
mov edx, esi
mov dword [rbx + 0xb8], eax
jmp 0x45932d
mov edx, 0xfffffffe
jmp 0x4593f5
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
jmp 0x459307
mov edx, 0xf
jmp 0x4593f5
xor edx, edx
jmp 0x45932d
mov rcx, rbx
call sym.push_pthread_mem.part.1
jmp 0x4593d6
Function at 0x45a996
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xc20
mov rbx, rcx
call sym.sigar_os_open
test eax, eax
jne 0x45aa8f
lea rcx, str.SIGAR_CPU_LIST_SOCKETS
mov rsi, qword [rbx]
call sym.getenv
test rax, rax
sete al
movzx eax, al
mov dword [rsi], eax
mov rax, qword [rbx]
mov qword [rax + 0x248], 0
mov dword [rax + 0x140], 0
mov rax, qword [rbx]
mov qword [rax + 0x18], 0
mov dword [rax + 0x250], 0
mov dword [rax + 4], 0xffffffff
mov rax, qword [rbx]
mov qword [rax + 0x10], 0
mov rax, qword [rbx]
mov qword [rax + 0x28], 0
mov rax, qword [rbx]
mov qword [rax + 0x20], 0
mov rax, qword [rbx]
mov qword [rax + 0x258], 0
mov rax, qword [rbx]
mov qword [rax + 0x268], 0
mov rax, qword [rbx]
mov qword [rax + 0x260], 0
mov rax, qword [rbx]
mov qword [rax + 0x270], 0
mov rax, qword [rbx]
mov qword [rax + 0x278], 0
mov rax, qword [rbx]
mov qword [rax + 0x280], 0
mov rax, qword [rbx]
mov qword [rax + 0x288], 0
mov rax, qword [rbx]
mov qword [rax + 0x290], 0
lea rsi, [rsp + 0x20]
mov rcx, qword [rbx]
mov rdx, rsi
call sym.mettle.exe_sigar_sys_info_get
test eax, eax
mov edi, eax
jne 0x45aab8
mov rcx, qword [rbx]
lea rdx, [rsi + 0x200]
add rcx, 0x40
call sym.strcpy
mov eax, edi
add rsp, 0xc20
pop rbx
pop rsi
pop rdi
ret
Function at 0x45c3c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
mov eax, 0x2178
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0046ba70
sub rsp, rax
mov r12, rcx
lea rcx, str.SIGAR_NET_SERVICES_FILE
mov r13, rdx
call sym.getenv
lea rdx, str.C:windows_system32driversetc_services
test rax, rax
cmove rax, rdx
lea rdx, [0x00488a71]
mov rcx, rax
call sym.fopen
test rax, rax
mov rsi, rax
jne 0x45c41d
call qword [sym.imp.msvcrt.dll__errno]
mov eax, dword [rax]
jmp 0x45c4d3
lea rbp, [rsp + 0x170]
lea r14, [rsp + 0x34]
mov r8, rsi
mov edx, 0x2000
mov rcx, rbp
call sym.fgets
test rax, rax
mov rbx, rax
je 0x45c4c9
movzx ecx, byte [rbx]
mov edi, ecx
call qword [sym.imp.msvcrt.dll_isspace]
test eax, eax
je 0x45c45a
inc rbx
jmp 0x45c446
cmp dil, 0x23
je 0x45c42a
test dil, dil
je 0x45c42a
lea rdi, [rsp + 0x70]
lea r15, [rsp + 0x38]
lea rdx, str._s_d__s
mov r9, r14
mov rcx, rbx
mov qword [rsp + 0x20], r15
mov r8, rdi
call sym.sscanf
cmp eax, 3
jne 0x45c42a
mov rdx, r15
mov rcx, r13
call sym.strcmp
test eax, eax
jne 0x45c42a
movsxd rdx, dword [rsp + 0x34]
mov rcx, r12
call sym.sigar_cache_get
cmp qword [rax + 0x10], 0
mov rbx, rax
jne 0x45c42a
mov rcx, rdi
call sym.strdup
mov qword [rbx + 0x10], rax
jmp 0x45c42a
mov rcx, rsi
call sym.fclose
xor eax, eax
add rsp, 0x2178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x45c872
Capabilities:
Resolve dns

Disassembly:
push rdi
push rbx
sub rsp, 0x68
mov byte [r8], 0
mov eax, dword [rdx]
mov rbx, r8
cmp eax, 1
je 0x45c93a
jb 0x45c93f
cmp eax, 2
je 0x45c8db
cmp eax, 3
jne 0x45c948
movzx eax, byte [rdx + 9]
movzx r9d, byte [rdx + 5]
mov rcx, rbx
movzx r8d, byte [rdx + 4]
mov dword [rsp + 0x38], eax
movzx eax, byte [rdx + 8]
mov dword [rsp + 0x30], eax
movzx eax, byte [rdx + 7]
mov dword [rsp + 0x28], eax
movzx eax, byte [rdx + 6]
lea rdx, str._02X:_02X:_02X:_02X:_02X:_02X
mov dword [rsp + 0x20], eax
call sym.sprintf
xor eax, eax
jmp 0x45c94d
lea r10, [rsp + 0x44]
xor eax, eax
mov ecx, 7
movups xmm0, xmmword [rdx + 4]
mov r9d, 0x2e
mov rdi, r10
mov edx, 0x1c
rep stosd dword [rdi], eax
mov word [rsp + 0x44], 0x17
mov dword [rsp + 0x30], 2
mov rcx, r10
movups xmmword [rsp + 0x4c], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x45c932
test rbx, rbx
jne 0x45c94d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45c94d
mov edx, dword [rdx + 4]
jmp 0x45c941
xor edx, edx
call sym.sigar_inet_ntoa
jmp 0x45c94d
mov eax, 0x16
add rsp, 0x68
pop rbx
pop rdi
ret
Function at 0x45cea0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r8d, ecx
mov edi, edx
mov ecx, 0x1f0fff
mov edx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
jne 0x45ced2
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
test edi, edi
je 0x45ceec
xor ebx, ebx
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
sete bl
neg ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x45cec4
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x45d350
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rdx
xor edx, edx
mov dword [rsp + 0x2c], r8d
call sym.open
movsxd rcx, dword [rsp + 0x2c]
mov esi, eax
mov rdi, rbx
xor eax, eax
test esi, esi
mov r8, rcx
rep stosb byte [rdi], al
mov eax, 2
js 0x45d3a4
dec r8d
mov rdx, rbx
mov ecx, esi
call sym.read
xor ebx, ebx
test eax, eax
jns 0x45d39b
call qword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [rax]
mov ecx, esi
call sym.close
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x45d3ac
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x258], 0
mov rbx, rcx
jne 0x45d427
lea rcx, str.SIGAR_PATH
call sym.getenv
test rax, rax
je 0x45d3e1
mov rcx, rax
call qword [sym.imp.msvcrt.dll__strdup]
mov qword [rbx + 0x258], rax
jmp 0x45d42e
lea rax, [sym.proc_module_get_self]
mov rcx, rbx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rax
call sym.mettle.exe_sigar_pid_get
lea r8, [rsp + 0x20]
mov edx, eax
mov rcx, rbx
call sym.mettle.exe_sigar_proc_modules_get
cmp qword [rbx + 0x258], 0
jne 0x45d427
lea rcx, [0x00488cf3]
call qword [sym.imp.msvcrt.dll__strdup]
mov qword [rbx + 0x258], rax
mov rax, qword [rbx + 0x258]
add rsp, 0x30
pop rbx
ret

Function at 0x45d7bd
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x8020
call fcn.0046ba70
sub rsp, rax
mov r8d, 0x7fff
lea rcx, str.SIGAR_NETIF_NAME_SHORT
lea rbx, [rsp + 0x21]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor edx, edx
test eax, eax
je 0x45d81a
lea rdx, [0x004890c8]
mov rcx, rbx
call sym.strcmp
test eax, eax
mov edx, 1
je 0x45d81a
lea rdx, str.true
mov rcx, rbx
call sym.strcmp
xor edx, edx
test eax, eax
sete dl
mov eax, edx
add rsp, 0x8020
pop rbx
ret
Function at 0x45ddad
Capabilities:
Query or enumerate registry value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov dword [r9], 0
cmp dword [rcx + 0x2a0], 0
mov rbx, rcx
mov rsi, rdx
mov ebp, r8d
mov rdi, r9
je 0x45de00
lea rax, [rsp + 0x46]
mov r8, rdx
mov word [rsp + 0x46], 0
mov dword [rsp + 0x28], 0x105
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp qword [rbx + 0x2b0], 0
jne 0x45de2a
mov edx, 0x2000
mov ecx, 1
call sym.calloc
mov dword [rbx + 0x2b8], 0x2000
mov qword [rbx + 0x2b0], rax
mov eax, dword [rbx + 0x2b8]
lea r12, [rsp + 0x3c]
mov dword [rsp + 0x40], eax
cmp dword [rbx + 0x2a0], 0
mov rax, qword [rbx + 0x2b0]
lea r8, [rsp + 0x40]
mov rcx, qword [rbx + 0x2a8]
je 0x45de72
mov qword [rsp + 0x28], r8
lea rdx, [rsp + 0x46]
mov qword [rsp + 0x20], rax
mov r9, r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x45de8b
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
mov r9, r12
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x45ded1
cmp eax, 0xea
jne 0x45deca
mov eax, dword [rbx + 0x2b8]
mov rcx, qword [rbx + 0x2b0]
lea edx, [rax + 0x2000]
mov dword [rbx + 0x2b8], edx
call sym.realloc
mov qword [rbx + 0x2b0], rax
mov eax, dword [rbx + 0x2b8]
mov dword [rsp + 0x40], eax
jmp 0x45de39
mov dword [rdi], eax
jmp 0x45df62
mov rdx, qword [rbx + 0x2b0]
mov ecx, dword [rdx + 0x1c]
test ecx, ecx
jne 0x45df66
lea rdx, [0x00489151]
mov rcx, rsi
call sym.strcmp
test eax, eax
lea r8, str.Memory
je 0x45df4d
lea rdx, [0x00489153]
mov rcx, rsi
call sym.strcmp
test eax, eax
lea r8, str.Process
je 0x45df4d
lea rdx, [0x00489157]
mov rcx, rsi
call sym.strcmp
test eax, eax
lea r8, str.Processor
je 0x45df4d
lea rdx, [0x0048915b]
mov rcx, rsi
call sym.strcmp
lea r8, str.LogicalDisk
test eax, eax
cmovne r8, rsi
lea rdx, str.No__s_counters_defined__disabled__
mov rcx, rbx
call sym.sigar_strerror_printf
mov dword [rdi], 0xffffffff
xor eax, eax
jmp 0x45df92
mov eax, dword [rdx + 0x18]
add rdx, rax
test ebp, ebp
mov rax, rdx
je 0x45df92
cmp dword [rdx + 0x28], 0xffffffff
jne 0x45df92
xor eax, eax
cmp dword [rdx + 0x28], 0xffffffff
jne 0x45df8f
mov r8d, dword [rdx]
inc eax
add rdx, r8
cmp ecx, eax
jne 0x45df7b
jmp 0x45df62
mov rax, rdx
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x45eade
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
xor eax, eax
cmp word [rcx + 0x67c], 0
mov rbx, rcx
jne 0x45eb2e
lea rdx, [rsp + 0x28]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x45eb23
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx + 0x680], eax
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [rbx + 0x680]
jmp 0x45eb2e
mov edx, dword [rsp + 0x28]
mov word [rbx + 0x67c], dx
add rsp, 0x1c0
pop rbx
ret
Function at 0x45ef3a
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov r8d, 1
mov rbx, rdx
lea rdx, [rcx + 0x518]
mov rsi, rcx
call sym.sigar_dllmod_init
mov rax, qword [rsi + 0x530]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x45ef7f
mov dword [rsp + 0x20], 0x40
call rax
test eax, eax
jne 0x45ef85
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45efc8
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov rax, qword [rsp + 0x28]
mov r8, rbx
mov rcx, rsi
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x18]
sub rax, rdx
mov qword [rbx + 0x28], rdx
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x20], rax
call sym.get_mem_counters
mov rdx, rbx
mov rcx, rsi
call sym.sigar_mem_calc_ram
xor eax, eax
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x45efcf
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rbx
sub rsp, 0x68
mov r8d, 1
mov rbx, rdx
lea rdx, [rcx + 0x518]
mov rsi, rcx
call sym.sigar_dllmod_init
mov rax, qword [rsi + 0x530]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x45f014
mov dword [rsp + 0x20], 0x40
call rax
test eax, eax
jne 0x45f01a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45f05a
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov rax, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov qword [rbx], rax
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x10], rax
mov rax, qword [rbx]
sub rax, qword [rbx + 0x10]
mov qword [rbx + 8], rax
call sym.get_mem_counters
test eax, eax
je 0x45f05a
mov qword [rbx + 0x18], 0xffffffffffffffff
mov qword [rbx + 0x20], 0xffffffffffffffff
xor eax, eax
add rsp, 0x68
pop rbx
pop rsi
ret

Function at 0x45fbe0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x140], edx
mov rsi, rcx
jne 0x45fc00
xor edx, edx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.sigar_parse_proc_args
mov ecx, edx
mov qword [rsp + 0x28], r8
call sym.open_process
test rax, rax
mov rdi, rax
je 0x45fc37
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, rsi
call sym.sigar_proc_args_peb_get
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test ebx, ebx
jne 0x45fc39
jmp 0x45fc52
xor ebx, ebx
cmp qword [rsi + 0x2c0], 0
je 0x45fc50
cmp ebx, 0x490
mov eax, 0x9c41
je 0x45fc52
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret