joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140758058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407581df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140758089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14075806f
add dl, dl
jne 0x140758096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407580f6
xor eax, eax
add dl, dl
jne 0x1407580a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407581ad
add dl, dl
jne 0x1407580b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407580c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407580d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407580dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407580ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14075807e
mov eax, 1
add dl, dl
jne 0x140758106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140758113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407580fb
sub eax, ebx
mov ebx, 1
jne 0x14075814c
mov ecx, 1
add dl, dl
jne 0x14075812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14075813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140758123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140758168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140758175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14075815d
cmp eax, 0x7d00
jae 0x14075819b
cmp eax, 0x500
jb 0x140758196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075807e
cmp eax, 0x7f
ja 0x14075819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407581d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14075807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400010f5
Capabilities:
Generate random numbers via winapi

Disassembly:
jmp 0x140024f00
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r8
mov rbx, rdx
mov r13, rcx
mov qword [rbp - 0x50], rdx
xor edi, edi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x38], rdi
mov esi, 0xf
mov qword [rbp - 0x30], rsi
mov byte [rbp - 0x48], dil
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp - 0x48]
call fcn.140004520
nop
lea r15, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae r15, qword [rbp - 0x48]
mov r8, r14
xor edx, edx
mov rcx, r15
call fcn.14000376a
mov rax, qword [r13 + 8]
test rax, rax
je 0x140024fa0
mov edx, r14d
mov rcx, r15
call rax
test al, al
setne r15b
test al, al
jne 0x140024fd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GenRandom:_RtlGenRandom_SystemFunction036_failed:__u
call fcn.140004610
jmp 0x140024fd9
cmp byte [r13 + 0x10], 0
je 0x140024ffc
mov r8, r15
mov edx, r14d
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
setne r15b
test eax, eax
jne 0x140024fd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, r14d
lea rcx, str.GenRandom:_CryptGenRandom_failed__size_d__lasterror_u
call fcn.140004610
test r15b, r15b
je 0x140024ffc
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x18], xmm1
mov qword [rbp - 0x30], rsi
mov rsi, qword [rbp - 0x10]
mov r14, qword [rbp - 0x18]
jmp 0x14002504e
mov qword [rbp - 0x28], rdi
mov r14, rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rsi
mov byte [rbp - 0x28], r14b
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14002504a
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025045
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025130
call fcn.140003b75
mov qword [rbp - 0x30], rsi
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x38], rdi
xor r8d, r8d
lea rdx, [r14 + r14]
mov rcx, rbx
call fcn.1400024b9
mov rcx, qword [rbp - 0x28]
test r14, r14
je 0x1400250dc
lea r8, [0x1400aec08]
nop word [rax + rax]
lea rax, [rbp - 0x28]
cmp rsi, 0x10
cmovae rax, rcx
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140025099
mov rdx, qword [rbx]
movzx eax, byte [rax + rdi]
shr rax, 4
movzx eax, word [r8 + rax*2]
mov word [rdx + rdi*4], ax
lea rax, [rbp - 0x28]
cmp rsi, 0x10
cmovae rax, rcx
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400250c3
mov rdx, qword [rbx]
movzx eax, byte [rax + rdi]
and eax, 0xf
movzx eax, word [r8 + rax*2]
mov word [rdx + rdi*4 + 2], ax
inc rdi
cmp rdi, r14
jb 0x140025080
cmp rsi, 0x10
jb 0x14002510c
lea rdx, [rsi + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025107
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002512a
call fcn.140003b75
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400029d2
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000215d
int3
call fcn.14000215d
int3
Function at 0x140001406
Capabilities:
Parse pe header

Disassembly:
jmp 0x14006f278
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14006efcb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006efcb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006efcb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006efcb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006efcb
cmp dword [rcx + 0x84], 0xe
jbe 0x14006efcb
cmp dword [rcx + 0xf8], 0
je 0x14006efcb
mov ecx, ebx
call fcn.14006f144
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14006ecb4
nop
cmp dword [rbp + 0x20], 0
je 0x14006f019
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14006f054
int3
xor r8d, r8d
xor edx, edx
jmp 0x14006ef5c

Function at 0x14000155a
Capabilities:
Read pipe
Write pipe

Disassembly:
jmp 0x14002a700
mov rax, r8
mov r9d, edx
mov r8, rcx
mov rdx, rax
lea rcx, str.Assertion_failed:__s__file__s__line__d
jmp fcn.140004610
Function at 0x140001ff5
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
jmp 0x140024940
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx], rax
test rax, rax
jne 0x140024983
lea r8, str.m_module___NULL
lea edx, [rax + 0x28]
lea rcx, str.D:_a_arduino_ide_arduino_ideelectron_build_node_modules_node_ptydepswinpty_src_sharedOsModule.h
call fcn.1400040b1
nop
xor eax, eax
mov qword [rbx + 8], rax
mov byte [rbx + 0x10], al
mov qword [rbx + 0x18], rax
lea rdx, str.SystemFunction036
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x1400249fc
lea rdx, str.SystemFunction036
lea rcx, str.GetProcAddress:__s_is_missing
call fcn.140004610
mov qword [rbx + 8], rdi
mov dword [rsp + 0x20], 0xf0000000
lea r9d, [rdi + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
setne cl
mov byte [rbx + 0x10], cl
test eax, eax
jne 0x140024a00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GenRandom:_CryptAcquireContext_failed:__u
call fcn.140004610
jmp 0x140024a00
mov qword [rbx + 8], rdi
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000246e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14009b970
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0xa0]
lea r10, [0x1400ce4c0]
xor r11d, r11d
lea rdi, [0x1400abaf3]
test r9, r9
mov rax, rdx
mov r12, rdx
cmovne r10, r9
test rdx, rdx
lea ebp, [r11 + 1]
cmovne rdi, rdx
mov r15d, ebp
cmovne r15, r8
neg rax
sbb r14, r14
and r14, rcx
test r15, r15
jne 0x14009b9e0
mov rax, 0xfffffffffffffffe
jmp 0x14009bb2d
cmp word [r10 + 6], r11w
jne 0x14009ba4f
movzx r9d, byte [rdi]
inc rdi
test r9b, r9b
js 0x14009ba0a
test r14, r14
je 0x14009b9fb
mov dword [r14], r9d
test r9b, r9b
setne r11b
mov rax, r11
jmp 0x14009bb2d
mov al, r9b
and al, 0xe0
cmp al, 0xc0
jne 0x14009ba18
mov r8b, 2
jmp 0x14009ba36
mov al, r9b
and al, 0xf0
cmp al, 0xe0
jne 0x14009ba26
mov r8b, 3
jmp 0x14009ba36
mov al, r9b
and al, 0xf8
cmp al, 0xf0
jne 0x14009bb22
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov bl, r8b
sub edx, ebp
and edx, r9d
jmp 0x14009ba78
mov r8b, byte [r10 + 4]
mov edx, dword [r10]
mov bl, byte [r10 + 6]
lea eax, [r8 - 2]
cmp al, 2
ja 0x14009bb22
cmp bl, bpl
jb 0x14009bb22
cmp bl, r8b
jae 0x14009bb22
movzx ebp, bl
cmp rbp, r15
mov r9d, ebp
cmovae r9, r15
jmp 0x14009baa5
movzx ecx, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x14009bb22
mov eax, edx
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r12
cmp rax, r9
jb 0x14009ba87
cmp r9, rbp
jae 0x14009bad1
movzx eax, r8b
sub bl, r9b
mov word [r10 + 4], ax
movzx eax, bl
mov word [r10 + 6], ax
mov dword [r10], edx
jmp 0x14009b9d4
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x14009bb22
cmp edx, 0x110000
jae 0x14009bb22
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x14009bb22
test r14, r14
je 0x14009bb10
mov dword [r14], edx
neg edx
mov rdx, r10
sbb rcx, rcx
and rcx, rbp
call fcn.140004160
jmp 0x14009bb2d
mov rdx, rsi
mov rcx, r10
call fcn.140004917
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400029d2
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000281f
Capabilities:
Check os version

Disassembly:
jmp 0x14002a410
sub rsp, 0x148
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.14000376a
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14002a456
lea r8, str.success___GetVersionEx_failed_
lea edx, [rax + 0x3a]
lea rcx, str.D:_a_arduino_ide_arduino_ideelectron_build_node_modules_node_ptydepswinpty_src_sharedWindowsVersion.cc
call fcn.1400040b1
mov rax, qword [rsp + 0x20]
shr rax, 0x20
cmp eax, 6
setae al
add rsp, 0x148
ret

Function at 0x140002892
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x140021620
sub rsp, 0x38
mov r9, qword [rdx]
xor eax, eax
mov rcx, qword [rcx]
mov r10, r8
mov dword [rsp + 0x40], eax
mov rdx, r10
mov rax, r9
mov qword [rsp + 0x58], r9
shr rax, 0x20
sub ax, r9w
inc ax
mov word [rsp + 0x48], ax
mov rax, r9
shr rax, 0x30
shr r9, 0x10
sub ax, r9w
mov r9d, dword [rsp + 0x40]
inc ax
mov word [rsp + 0x4a], ax
lea rax, [rsp + 0x58]
mov r8d, dword [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
test eax, eax
jne 0x14002168f
lea rcx, str.WriteConsoleOutput_failed
call fcn.140004610
add rsp, 0x38
ret

Function at 0x1400029b4
Capabilities:
Check os version

Disassembly:
jmp 0x14002a380
sub rsp, 0x148
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.14000376a
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14002a3c6
lea r8, str.success___GetVersionEx_failed_
lea edx, [rax + 0x3a]
lea rcx, str.D:_a_arduino_ide_arduino_ideelectron_build_node_modules_node_ptydepswinpty_src_sharedWindowsVersion.cc
call fcn.1400040b1
mov rax, qword [rsp + 0x20]
shr rax, 0x20
cmp eax, 6
jb 0x14002a3e7
ja 0x14002a3dd
cmp dword [rsp + 0x28], 2
jb 0x14002a3e7
mov al, 1
add rsp, 0x148
ret
xor al, al
add rsp, 0x148
ret
Function at 0x1400029cd
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x14001bb40
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor r14d, r14d
lea rdi, [rcx + 0x20]
mov esi, r14d
mov rbx, rcx
cmp byte [rcx + 0x10], sil
je 0x14001bbc5
mov rcx, qword [rcx + 8]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x68], r14d
xor r9d, r9d
mov rdx, rdi
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x14001bba1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
jne 0x14001bca8
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rsp + 0x68]
mov byte [rbx + 0x10], sil
call qword [rax + 8]
mov dword [rbx + 0x14], r14d
mov esi, 2
mov rax, qword [rbx]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], r14d
mov rcx, rbx
mov byte [rsp + 0x60], r14b
call qword [rax + 0x10]
test al, al
je 0x14001bc7d
nop word [rax + rax]
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x70]
lea rdx, [rbx + 0x40]
mov dword [rbx + 0x14], r8d
xorps xmm0, xmm0
mov dword [rsp + 0x68], r14d
movups xmmword [rdi], xmm0
mov qword [rsp + 0x20], rdi
movups xmmword [rdi + 0x10], xmm0
mov rcx, qword [rbx + 8]
mov rax, qword [rbx + 0x18]
mov qword [rbx + 0x38], rax
mov rcx, qword [rcx + 0x98]
cmp byte [rsp + 0x60], r14b
je 0x14001bc38
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x14001bc3e
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001bc8a
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rbx]
mov rcx, rbx
mov edx, dword [rsp + 0x68]
call qword [rax + 8]
mov dword [rbx + 0x14], r14d
lea r8, [rsp + 0x60]
mov rax, qword [rbx]
lea rdx, [rsp + 0x70]
mov rcx, rbx
mov esi, 2
call qword [rax + 0x10]
test al, al
jne 0x14001bbf0
mov eax, esi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14001bca8
mov byte [rbx + 0x10], 1
mov eax, esi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140002b30
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140040be4
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1400b23d8]
mov ecx, 2
lea r8, [0x1400b23d0]
lea rdx, str.FlsGetValue
call fcn.1400406b4
mov ecx, ebx
test rax, rax
je 0x140040c1e
add rsp, 0x20
pop rbx
jmp qword [0x1400d9020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x140002ca7
Capabilities:
Query environment variable

Disassembly:
jmp 0x14008a0c4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14008a0f4
xor eax, eax
jmp 0x14008a1b7
mov rbp, rbx
cmp word [rax], si
je 0x14008a119
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14008a100
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14008a0fc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400037c4
movsxd r14, eax
test eax, eax
jne 0x14008a157
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14008a0ed
mov rcx, r14
call fcn.140001032
mov rdi, rax
test rax, rax
jne 0x14008a170
xor ecx, ecx
call fcn.1400011ae
jmp 0x14008a14c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400037c4
test eax, eax
jne 0x14008a1a1
mov rcx, rdi
call fcn.1400011ae
jmp 0x14008a1ab
xor ecx, ecx
call fcn.1400011ae
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140002cbb
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140040b34
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1400b2398]
xor ecx, ecx
lea r8, [0x1400b2390]
lea rdx, str.FlsAlloc
call fcn.1400406b4
test rax, rax
je 0x140040b6d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1400d9020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x140002cc5
Capabilities:
Log keystrokes

Disassembly:
jmp 0x140011060
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov dword [rsp + 0x24], edx
mov eax, 1
movzx ecx, r8w
xor edx, edx
mov word [rsp + 0x28], ax
movzx ebx, r9w
mov dword [rsp + 0x20], 1
mov word [rsp + 0x2a], r8w
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rdx, qword [rdi + 8]
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov word [rsp + 0x2e], bx
cmp rdx, qword [rdi + 0x10]
je 0x1400110d1
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rdi + 8], 0x14
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000270c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140002d60
Capabilities:
Terminate process

Disassembly:
jmp 0x14002bf30
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140002e8c
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x140011bc0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
movzx ebp, dl
mov rdi, rcx
lea rsi, [rcx + 0x28]
mov r14, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140011be9
mov r14, qword [rsi]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
xor ebx, ebx
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x140011c40
nop word [rax + rax]
sub ecx, ebx
lea r8, [r14 + rbx]
mov byte [rsp + 0x20], bpl
mov r9d, ecx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140002428
cmp eax, 0xffffffff
je 0x140011c40
cdqe
add rbx, rax
mov rax, qword [rdi + 0x38]
mov ecx, eax
cmp rbx, rax
jb 0x140011c10
lea rax, [rsi + 0x10]
mov r8, qword [rax]
cmp r8, rbx
cmovb rbx, r8
cmp qword [rsi + 0x18], 0x10
jb 0x140011c58
mov rsi, qword [rsi]
sub r8, rbx
mov qword [rax], r8
inc r8
lea rdx, [rsi + rbx]
mov rcx, rsi
call fcn.1400048c7
mov rcx, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
sub rcx, r10
movabs rbx, 0x6666666666666667
mov rax, rbx
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140011cd1
mov dword [rsp + 0x70], 0
lea r9, [rsp + 0x70]
mov r8d, edx
mov rdx, r10
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x140011cc7
lea rcx, str.WriteConsoleInputW_failed
call fcn.140004610
mov r10, qword [rsp + 0x30]
mov qword [rsp + 0x38], r10
test r10, r10
je 0x140011d23
mov rcx, qword [rsp + 0x40]
sub rcx, r10
mov rax, rbx
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 2
mov rax, r10
cmp rdx, 0x1000
jb 0x140011d1b
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011d39
mov rcx, r10
call fcn.140003b75
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call fcn.14000215d
int3

Function at 0x140002ef0
Capabilities:
Parse pe header

Disassembly:
jmp 0x14006f210
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14006ef5c

Function at 0x140003774
Capabilities:
Read pipe
Write pipe

Disassembly:
jmp 0x14002af20
lea r8, str.11044673299c2458737eb6c223d8cc5a8b21f436
lea rdx, str.0.4.4_dev
lea rcx, str.winpty_version__s__commit__s_
jmp fcn.140004610

Function at 0x140003972
Capabilities:
Terminate process

Disassembly:
jmp 0x140041a88
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140041aa2
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.140004174
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140003b98
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x14000d930
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, r8d
mov edi, edx
mov rsi, rcx
cmp edx, 1
jl 0x14000d966
cmp ebx, 1
jge 0x14000d97e
lea r8, str.cols___1__rows___1
mov edx, 0x227
lea rcx, str.D:_a_arduino_ide_arduino_ideelectron_build_node_modules_node_ptydepswinpty_src_agentAgent.cc
call fcn.1400040b1
mov eax, 0x9c4
cmp edi, eax
cmovg edi, eax
mov eax, 0x7d0
cmp ebx, eax
cmovg ebx, eax
lea r15, [rsi + 0x40]
mov qword [rbp - 0x48], r15
movzx r12d, byte [r15 + 8]
mov byte [rbp - 0x40], r12b
movzx edx, byte [rsi + 0x48]
mov rcx, r15
call fcn.140003526
nop
mov word [rbp - 0x60], di
mov word [rbp - 0x5e], bx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x28], eax
mov word [rbp - 0x24], ax
cmp byte [rsi + 0x38], al
jne 0x14000d9e6
lea rcx, [rbp - 0x50]
call fcn.140002ce8
mov rbx, qword [rax]
mov qword [rax], 0
mov rdi, qword [rbp - 0x50]
jmp 0x14000d9fd
lea rcx, [rbp - 0x58]
call fcn.140003b6b
mov rbx, qword [rax]
mov qword [rax], 0
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x14000da1e
cmp byte [rdi + 8], 0
je 0x14000da11
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x10
mov rcx, rdi
call fcn.140003b75
mov qword [rbp - 0x58], rbx
mov edi, dword [rbp - 0x60]
mov dword [rbp - 0x60], edi
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x60]
mov rdx, rbx
mov rcx, qword [rsi + 0x68]
call fcn.140003715
mov rcx, qword [rsi + 0xa8]
mov rax, qword [rbp - 0x2e]
mov qword [rcx + 0xec], rax
mov rcx, qword [rsi + 0x70]
test rcx, rcx
je 0x14000da6b
mov dword [rbp - 0x60], edi
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x60]
mov rdx, qword [rsi + 0x78]
call fcn.140003715
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], eax
mov eax, 4
mov word [rbp - 0x20], ax
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.1400020d6
mov ecx, dword [rax]
mov dword [rbp - 0x1c], ecx
mov dword [rbp - 0x5c], 0
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea r9, [rbp - 0x5c]
mov r8d, 1
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
nop
test rbx, rbx
je 0x14000dadd
cmp byte [rbx + 8], 0
je 0x14000dacf
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x10
mov rcx, rbx
call fcn.140003b75
nop
movzx edx, r12b
mov rcx, r15
call fcn.140003526
nop
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400029d2
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret