joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b8ce0
Capabilities:
Enumerate processes
Initialize winsock library
Terminate process
Write file on windows

Disassembly:
push rbx
sub rsp, 0x1c0
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x1b8], rax
xor eax, eax
mov eax, dword [0x14023eb40]
test eax, eax
je 0x1400b8d20
mov rax, qword [rsp + 0x1b8]
sub rax, qword [rbx]
jne 0x1400b8d4c
add rsp, 0x1c0
pop rbx
ret
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400b8d51
mov rcx, qword [sym.imp.WS2_32.dll_WSACleanup]
call fcn.140001410
mov dword [0x14023eb40], 1
jmp 0x1400b8d06
call fcn.1401be670
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, str.unable_to_initialize_winsock_subsystem__error__d
mov edx, eax
call fcn.1400a08a0
nop
nop word cs:[rax + rax]
Function at 0x1400b9890
Capabilities:
Delete file
Get file attributes

Disassembly:
push r12
mov eax, 0x2090
push rbp
push rdi
push rsi
push rbx
call fcn.1401be370
sub rsp, rax
mov rbp, qword [0x140207460]
mov rax, qword [rbp]
mov qword [rsp + 0x2088], rax
xor eax, eax
mov rdi, rcx
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x410
cmp eax, 0x400
je 0x1400b9900
mov eax, 1
nop dword [rax + rax]
mov rdx, qword [rsp + 0x2088]
sub rdx, qword [rbp]
jne 0x1400b9ac4
add rsp, 0x2090
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rsi
call sub.msvcrt.dll_wcslen
movzx ecx, word [rdi]
mov rbx, rax
cmp cx, 0x2f
je 0x1400b995f
cmp cx, 0x5c
je 0x1400b995f
mov edx, 0x103
call sub.msvcrt.dll_iswctype
test eax, eax
je 0x1400b9933
cmp word [rdi + 2], 0x3a
je 0x1400b9a90
test rbx, rbx
je 0x1400b995f
nop dword [rax + rax]
movzx eax, word [rsi + rbx*2 - 2]
cmp ax, 0x2f
je 0x1400b9a18
cmp ax, 0x5c
je 0x1400b9a18
sub rbx, 1
jne 0x1400b9940
mov rcx, rdi
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 7
xor edx, edx
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b99f0
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1400b9a60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [rsp + 0x40], 0x10
je 0x1400b98d3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400b99f0
mov r8d, dword [0x1401c4550]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
test al, al
je 0x1400b99f0
mov eax, 2
jmp 0x1400b98e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400b95f0
mov dword [rbx], eax
xor eax, eax
jmp 0x1400b98e0
mov rcx, rdi
call sub.msvcrt.dll_wcslen
lea rax, [rbx + rax + 1]
cmp rax, 0x1000
ja 0x1400b9aad
lea r12, [rsp + 0x80]
add rbx, rbx
mov rdx, rsi
mov r8, rbx
mov rcx, r12
call sub.msvcrt.dll_memcpy
lea rcx, [r12 + rbx]
mov rdx, rdi
call sub.msvcrt.dll_wcscpy
mov rcx, r12
jmp 0x1400b9962
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov rsi, rax
call fcn.1400b95f0
mov rcx, rbx
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400b98e0
movzx eax, word [rdi + 4]
cmp ax, 0x2f
je 0x1400b995f
cmp ax, 0x5c
jne 0x1400b9933
jmp 0x1400b995f
mov r8, rsi
mov rdx, rdi
lea rcx, str.Could_not_make__ls_relative_to__ls__too_large_
call fcn.1400a0b40
jmp 0x1400b98d3
call fcn.1401be670
nop
nop word [rax + rax]
Function at 0x1400b9b60
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
mov ecx, eax
or edx, 2
and ecx, 0xfffffffd
test esi, esi
cmove edx, ecx
cmp edx, eax
je 0x1400b9b91
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400b9ba0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400b95f0
mov dword [rbx], eax
mov eax, 0xffffffff
jmp 0x1400b9b93

Function at 0x1400b9f80
Capabilities:
Get disk information

Disassembly:
push r12
mov eax, 0x2030
push rbp
push rdi
push rsi
push rbx
call fcn.1401be370
sub rsp, rax
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x2028], rax
xor eax, eax
mov ebp, ecx
mov rsi, rdx
call sub.msvcrt.dll__write
movsxd rbx, eax
test rbx, rbx
js 0x1400b9fe0
mov rax, qword [rsp + 0x2028]
sub rax, qword [rdi]
jne 0x1400ba086
mov rax, rbx
add rsp, 0x2030
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r12, qword [sym.imp.msvcrt.dll__errno]
call r12
cmp dword [rax], 0x16
jne 0x1400ba040
test rsi, rsi
je 0x1400b9fb9
mov ecx, ebp
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x1400ba078
lea rbp, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x1000
mov rcx, rsi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
sub eax, 1
cmp eax, 0xffe
jbe 0x1400ba050
call r12
mov dword [rax], 0x16
jmp 0x1400b9fb9
call r12
cmp dword [rax], 9
jne 0x1400b9fb9
jmp 0x1400b9fef
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x1400ba063
cmp eax, 4
jne 0x1400ba031
lea rcx, str.invalid_write_operation_detected__you_may_try:_n_n_tgit_config_windows.appendAtomically_false
call fcn.1400a0c10
jmp 0x1400ba031
call r12
mov dword [rax], 0x20
jmp 0x1400b9fb9
call fcn.1401be670
nop
nop dword [rax]

Function at 0x1400ba1b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov edx, 0x180
jmp fcn.1400a6be0

Function at 0x1400ba1c0
Capabilities:
Create pipe
Get hostname

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rsi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
movabs rax, 0xd6bf94d5e57a42bd
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsp + 0x20]
imul rcx
mov rax, rcx
sar rax, 0x3f
add rdx, rcx
sar rdx, 0x17
sub rdx, rax
movabs rax, 0x6666666666666667
mov dword [rsi], edx
imul rdx, rdx, 0x989680
sub rcx, rdx
imul rcx
sar rcx, 0x3f
sar rdx, 2
sub rdx, rcx
mov dword [rsi + 4], edx
mov rax, qword [rsp + 0x28]
sub rax, qword [rbx]
jne 0x1400ba24c
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400ba260
Capabilities:
Create pipe
Get hostname

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x140207460]
xor r8d, r8d
mov r9d, 0x2000
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rbx, rcx
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400ba2e0
movsxd rcx, dword [rsp + 0x20]
mov rdi, qword [sym.imp.msvcrt.dll__open_osfhandle]
mov edx, pe_nt_image_headers64
call rdi
mov dword [rbx], eax
test eax, eax
js 0x1400ba301
movsxd rcx, dword [rsp + 0x28]
mov edx, pe_nt_image_headers64
call rdi
mov dword [rbx + 4], eax
test eax, eax
js 0x1400ba318
xor eax, eax
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rsi]
jne 0x1400ba32c
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov rbx, rax
call fcn.1400b95f0
mov dword [rbx], eax
mov eax, 0xffffffff
jmp 0x1400ba2c6
mov rcx, qword [rsp + 0x20]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x28]
call rbx
jmp 0x1400ba2fa
mov ecx, dword [rbx]
call sub.msvcrt.dll__close
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ba2fa
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400ba340
Capabilities:
Create thread
Get hostname

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
xor eax, eax
test rcx, rcx
mov rbx, rcx
setg al
cmp edx, 0xf
jne 0x1400ba36d
test al, al
jne 0x1400ba3c0
test edx, edx
jne 0x1400ba508
test al, al
je 0x1400ba508
mov ecx, 0x400
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
test rax, rax
je 0x1400ba508
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov rax, qword [rsp + 0x48]
sub rax, qword [rsi]
jne 0x1400ba5ab
mov eax, ebx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov ecx, 0x43b
call rbp
mov rdi, rax
test rax, rax
je 0x1400ba4b0
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400ba39d
cmp dword [rsp + 0x40], 0x103
jne 0x1400ba39d
mov eax, dword [0x14023ed70]
test eax, eax
je 0x1400ba520
mov rax, qword [0x14023ed68]
test rax, rax
je 0x1400ba4c8
mov eax, dword [0x1401c4420]
cmp eax, 0xffffffff
je 0x1400ba558
cmp eax, 0xfffffffe
je 0x1400ba4c8
lea rbx, [rsp + 0x44]
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400ba4c8
mov eax, dword [0x1401c4420]
cmp dword [rsp + 0x44], eax
jne 0x1400ba4c8
mov rcx, rdi
mov qword [rsp + 0x30], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0
mov r9, qword [0x14023ed68]
mov qword [rsp + 0x20], 0x8f
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
test rax, rax
je 0x1400ba4c8
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400ba4c8
mov rcx, rdi
call rbx
jmp 0x1400ba39d
mov r8d, ebx
xor edx, edx
mov ecx, 1
call rbp
mov rdi, rax
test rax, rax
je 0x1400ba58c
mov rcx, rdi
call fcn.1400b8d70
mov ebx, eax
test eax, eax
je 0x1400ba39f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, r12d
mov rbp, rax
call fcn.1400b95f0
mov rcx, rdi
mov dword [rbp], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ba39f
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov ebx, 0xffffffff
jmp 0x1400ba39f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
test rax, rax
je 0x1400ba5b0
lea rdx, str.ExitProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x14023ed70], 1
mov qword [0x14023ed68], rax
jmp 0x1400ba410
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [0x1401c4420]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400ba57d
mov eax, dword [0x1401c4420]
jmp 0x1400ba428
mov dword [0x1401c4420], 0xfffffffe
jmp 0x1400ba4c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov rbx, rax
call fcn.1400b95f0
mov dword [rbx], eax
jmp 0x1400ba514
call fcn.1401be670
lea rcx, str.BUG:_cannot_find_kernel32
call fcn.1400a08a0
nop
nop dword [rax]
Function at 0x1400ba5c0
Capabilities:
Get hostname

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
call fcn.1400b8ce0
mov rcx, rbx
mov edx, esi
call qword [sym.imp.WS2_32.dll_gethostname]
mov ebx, eax
test eax, eax
js 0x1400ba5f0
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, 5
sub eax, 0x2714
cmp eax, 0x3e
jbe 0x1400ba620
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
lea rdx, [0x1401e1920]
movzx esi, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
jmp 0x1400ba60d

Function at 0x1400ba6b0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov rbp, r9
call fcn.1400b8ce0
mov rcx, rbx
mov r9, rbp
mov r8, rdi
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
js 0x1400ba6f0
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, 5
sub eax, 0x2714
cmp eax, 0x3e
jbe 0x1400ba720
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [0x1401e1920]
movzx esi, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
jmp 0x1400ba70d

Function at 0x1400ba7f0
Capabilities:
Connect socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, r8
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rdx, rbx
mov r8d, esi
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
test eax, eax
js 0x1400ba820
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, 5
sub eax, 0x2714
cmp eax, 0x3e
jbe 0x1400ba850
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
lea rdx, [0x1401e1920]
movzx esi, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
jmp 0x1400ba83d

Function at 0x1400ba8f0
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov ebx, edx
mov esi, r8d
mov rdi, r9
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov edx, ebx
mov r9, rdi
mov r8d, esi
mov rcx, rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
test eax, eax
js 0x1400ba930
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, 5
sub eax, 0x2714
cmp eax, 0x3e
jbe 0x1400ba960
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rdx, [0x1401e1920]
movzx esi, byte [rdx + rax]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], esi
jmp 0x1400ba94d
Function at 0x1400bab20
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rbx]
jne 0x1400bab55
add rsp, 0x60
pop rbx
ret
call fcn.1401be670
nop
nop dword [rax + rax]

Function at 0x1400bab60
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
test r8, r8
jne 0x1400bacf0
mov eax, dword [rdx + 8]
test eax, eax
je 0x1400baba8
cmp eax, dword [rbx]
je 0x1400bac70
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.setitimer:_it_interval_must_be_zero_or_eq_it_value
mov dword [rax], 0x16
call fcn.1400a0b40
mov eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
mov edx, dword [rdx + 0xc]
test edx, edx
jne 0x1400bab78
cmp qword [0x14023eeb0], 0
je 0x1400babc1
call fcn.1400b89e0
mov eax, dword [rbx + 8]
mov edx, dword [rbx]
mov r8d, dword [rbx + 4]
mov ecx, edx
or ecx, r8d
je 0x1400bacc0
imul ecx, edx, 0x3e8
movsxd rdx, r8d
sar r8d, 0x1f
imul rdx, rdx, 0x10624dd3
sar rdx, 0x26
sub edx, r8d
add edx, ecx
mov dword [0x14023eeac], edx
test eax, eax
je 0x1400bac90
xor eax, eax
mov dword [0x14023eea8], eax
mov eax, dword [0x14023e2b0]
test eax, eax
je 0x1400baca0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x14023eeb8], rax
test rax, rax
je 0x1400bad27
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
lea r8, [0x1400b91b0]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [0x14023eeb0], rax
test rax, rax
je 0x1400bacd3
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov ecx, dword [rbx + 4]
cmp dword [rbx + 0xc], ecx
jne 0x1400bab80
cmp qword [0x14023eeb0], 0
jne 0x1400babb9
jmp 0x1400babc1
mov eax, dword [rbx + 0xc]
test eax, eax
sete al
movzx eax, al
jmp 0x1400babff
lea rcx, [fcn.1400b89e0]
call fcn.140001410
mov dword [0x14023e2b0], 1
jmp 0x1400bac13
test eax, eax
je 0x1400bad0d
mov dword [0x14023eeac], 0
jmp 0x1400babfd
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.cannot_start_timer_thread
mov dword [rax], 0xc
call fcn.1400a0b40
jmp 0x1400bab98
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.setitimer_param_3___NULL_not_implemented
mov dword [rax], 0x16
call fcn.1400a0b40
jmp 0x1400bab98
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x1400bac64
mov dword [0x14023eeac], 0
jmp 0x1400bac93
call qword [sym.imp.msvcrt.dll__errno]
lea rcx, str.cannot_allocate_resources_for_timer
mov dword [rax], 0xc
call fcn.1400a0b40
jmp 0x1400bab98
Function at 0x1400bade0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
cmp ecx, 2
je 0x1400bae20
cmp ecx, 0xe
jne 0x1400bae10
mov rax, qword [0x14023eea0]
test rax, rax
je 0x1400bae40
cmp rax, 1
je 0x1400bae07
mov ecx, 0xe
call rax
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x1401bf160
mov rax, qword [0x14023ee98]
test rax, rax
je 0x1400bae6c
cmp rax, 1
je 0x1400bae07
mov ecx, 2
call rax
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call fcn.1400c2da0
test eax, eax
jne 0x1400bae8a
lea rcx, str.compat_mingw.c
mov r8d, 0x8e
mov edx, 0xbaa
call fcn.140003470
mov ecx, eax
call sub.msvcrt.dll_exit
lea rcx, str.compat_mingw.c
mov r8d, 0x82
mov edx, 0xbb1
call fcn.140003470
mov ecx, eax
call sub.msvcrt.dll_exit
mov ecx, 2
call qword [fcn.1401bee20]
mov r8d, 0xc
mov edx, 1
lea rcx, str.Alarm_clock_n
mov r9, rax
call sub.msvcrt.dll_fwrite
jmp 0x1400bae4e
jmp qword [sym.imp.msvcrt.dll_raise]

Function at 0x1400bb4b0
Capabilities:
Set environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
test rcx, rcx
je 0x1400bb4c5
cmp byte [rcx], 0
jne 0x1400bb4d0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll_strlen
mov edx, 2
lea ebp, [rax + rax + 1]
movsxd rdi, ebp
mov rcx, rdi
call fcn.1400d2950
mov rsi, rax
test rax, rax
je 0x1400bb56f
mov rdx, rbx
mov rcx, rax
mov r9d, 0xffffffff
mov r8, rdi
call fcn.1400bb020
mov edx, 0x3d
mov rcx, rsi
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x1400bb560
xor edx, edx
mov rcx, rsi
mov word [rax], dx
lea rdx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
mov rcx, rsi
call fcn.1400d2670
test ebx, ebx
jne 0x1400bb4c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400b95f0
mov dword [rbx], eax
mov eax, 0xffffffff
jmp 0x1400bb4c7
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400bb52b
mov edx, ebp
lea rcx, str.Out_of_memory___tried_to_allocate__u_wchar_ts_
call fcn.1400a08a0
nop
nop
Function at 0x1400bb610
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r12, qword [0x140207460]
mov r15, qword [rbp + 0x70]
mov rax, qword [r12]
mov qword [rbp - 8], rax
mov eax, 0x4000
mov r14d, edx
mov r13, r8
mov rdi, r9
call fcn.1401be370
xor r9d, r9d
mov r8d, 7
xor edx, edx
sub rsp, rax
mov qword [rsp + 0x30], 0
lea rsi, [rsp + 0x40]
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400bb782
lea rax, [rbp - 0xc]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rax
mov edx, 0x900a8
mov rcx, rbx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x4000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400bb758
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi]
mov dword [r15], eax
cmp eax, 0xa0000003
je 0x1400bb740
cmp eax, 0xa000000c
jne 0x1400bb730
movzx eax, word [rsi + 8]
xor r8d, r8d
lea rcx, [rsi + rax + 0x14]
movzx eax, word [rsi + 0xa]
mov word [rcx + rax], r8w
call fcn.1400b8820
mov r8d, 0x1000
mov rcx, r13
mov rdx, rax
call fcn.1400bb580
mov dword [rdi], eax
sar eax, 0x1f
mov rdx, qword [rbp - 8]
sub rdx, qword [r12]
jne 0x1400bb7ac
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test r14d, r14d
jne 0x1400bb79e
mov dword [rdi], 0x1000
xor eax, eax
jmp 0x1400bb711
movzx eax, word [rsi + 8]
xor edx, edx
lea rcx, [rsi + rax + 0x10]
movzx eax, word [rsi + 0xa]
mov word [rcx + rax], dx
jmp 0x1400bb6f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov rsi, rax
call fcn.1400b95f0
mov rcx, rbx
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x1400bb711
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, esi
mov rbx, rax
call fcn.1400b95f0
mov dword [rbx], eax
jmp 0x1400bb77b
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400bb77b
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400bb7c0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x238
mov rbp, qword [0x140207460]
mov r9d, 0xffffffff
mov r8d, 0x104
mov rax, qword [rbp]
mov qword [rsp + 0x228], rax
xor eax, eax
lea rdi, [rsp + 0x20]
mov rbx, rcx
mov rdx, rcx
mov rcx, rdi
call fcn.1400bb020
test eax, eax
js 0x1400bb8a0
movsx eax, byte [rbx]
cmp eax, 0x5c
je 0x1400bb868
cmp eax, 0x2f
je 0x1400bb868
xor esi, esi
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wmktemp]
test rax, rax
je 0x1400bb8b0
mov rcx, rbx
movsxd rsi, esi
call sub.msvcrt.dll_strlen
lea rdx, [rdi + rsi*2]
mov rcx, rbx
lea r8, [rax + 1]
call fcn.1400bb580
test eax, eax
js 0x1400bb8b0
mov rax, qword [rsp + 0x228]
sub rax, qword [rbp]
jne 0x1400bb8c7
mov rax, rbx
add rsp, 0x238
pop rbx
pop rsi
pop rdi
pop rbp
ret
movsx eax, byte [rbx + 1]
cmp eax, 0x2f
je 0x1400bb814
cmp eax, 0x5c
je 0x1400bb814
movzx ecx, word [rsp + 0x20]
mov edx, 0x103
call sub.msvcrt.dll_iswctype
test eax, eax
je 0x1400bb814
xor esi, esi
cmp word [rsp + 0x22], 0x3a
sete sil
add esi, esi
jmp 0x1400bb816
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400bb8b8
nop
xor ebx, ebx
jmp 0x1400bb847
call rbx
xor ebx, ebx
mov dword [rax], 0x26
jmp 0x1400bb847
call fcn.1401be670
nop
nop dword [rax]
Function at 0x1400bb8d0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x460
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x458], rax
xor eax, eax
lea r12, [rsp + 0x40]
mov rbx, rcx
mov ebp, edx
mov ecx, 0x104
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [rax - 1]
cmp edx, 0x102
ja 0x1400bba40
mov dword [rsp + 0x28], 0x2000000
xor r9d, r9d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400bb9f8
lea r14, [rsp + 0x250]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov rcx, rsi
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
sub r13d, 1
cmp r13d, 0x102
jbe 0x1400bb9ad
mov rdx, r14
mov r8d, 0x104
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea edx, [rax - 1]
cmp edx, 0x102
ja 0x1400bba40
mov rcx, r14
call fcn.1400b8820
movsxd r8, ebp
mov rcx, rbx
mov rdx, rax
call fcn.1400bb580
test eax, eax
js 0x1400bba51
mov rax, rbx
mov rdx, qword [rsp + 0x458]
sub rdx, qword [rdi]
jne 0x1400bba8b
add rsp, 0x460
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400bba78
movsxd r8, ebp
mov rdx, r12
mov rcx, rbx
call fcn.1400bb580
test eax, eax
js 0x1400bba51
movzx edx, byte [rbx]
test dl, dl
je 0x1400bb9cb
mov rax, rbx
nop word [rax + rax]
cmp dl, 0x5c
jne 0x1400bba30
mov byte [rax], 0x2f
movzx edx, byte [rax + 1]
add rax, 1
test dl, dl
jne 0x1400bba28
jmp 0x1400bb9cb
mov ebx, 0x26
test eax, eax
je 0x1400bba60
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
xor eax, eax
jmp 0x1400bb9ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b95f0
mov ebx, eax
jmp 0x1400bba49
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 2
xor eax, eax
jmp 0x1400bb9ce
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop dword [rax]