joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4091ea
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x0044da40]
and eax, 0x10
cmp eax, 0
je 0x409206
call fcn.004079c0
jmp 0x40920b
call fcn.00407a56
mov rax, qword [0x0044da38]
cmp rax, 0
je 0x409267
mov eax, dword [0x0044da24]
cmp eax, 0xcc
je 0x409245
mov eax, dword [0x0044da24]
cmp eax, 0xcb
je 0x409245
jmp 0x40924c
jmp 0x4091ea
mov eax, dword [0x0044da24]
cmp eax, 0
jne 0x409262
call fcn.00403706
jmp 0x4091ea
jmp 0x409329
mov eax, dword [0x0044da24]
cmp eax, 0x100
jl 0x409329
mov eax, dword [0x0044da40]
and eax, 1
cmp eax, 0
je 0x409329
mov eax, dword [0x0044da24]
mov r10, rax
mov rcx, r10
call fcn.00442278
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x409329
movabs rax, 0
mov qword [rbp - 0x10], rax
mov eax, 0
mov dword [0x004710a8], eax
mov rax, qword [rbp - 8]
mov r8, rax
lea rax, [rbp - 0x10]
mov r11, rax
lea rax, [0x004710a0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040850b
mov eax, 0
mov r11, rax
lea rax, [0x004710a0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00403602
mov eax, 2
mov r11, rax
lea rax, [0x004710a0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040368f
jmp 0x4091ea
mov eax, dword [0x0044da24]
cmp eax, 0xbe
jne 0x409364
mov eax, dword [0x0044da40]
and eax, 2
cmp eax, 0
je 0x40935f
mov rax, qword [0x0044da30]
mov r10, rax
mov rcx, r10
call fcn.00406c29
jmp 0x4093a9
mov eax, dword [0x0044da24]
cmp eax, 0xbf
jne 0x4093a9
mov eax, dword [0x0044da40]
and eax, 0x40
cmp eax, 0
je 0x4093a9
mov eax, dword [0x0044da28]
sub eax, 1
mov r11, rax
mov rax, qword [0x0044da30]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00406853
leave
ret
Function at 0x4223d7
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov dword [rbp - 0x10], eax
mov eax, 1
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x10]
add rax, 0x538
mov ecx, dword [rbp - 0xc]
mov edx, dword [rax]
cmp ecx, edx
jge 0x422514
jmp 0x422429
mov eax, dword [rbp - 0xc]
mov rcx, rax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x4223fe
mov rax, qword [rbp + 0x10]
add rax, 0x530
mov ecx, dword [rbp - 0xc]
movsxd rcx, ecx
shl rcx, 2
mov rdx, qword [rbp + 0x20]
add rdx, rcx
mov ecx, dword [rdx]
movsxd rcx, ecx
shl rcx, 3
mov rdx, qword [rax]
add rdx, rcx
mov rax, qword [rdx]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
add rax, 0x1c
mov ecx, dword [rax]
cmp ecx, 8
je 0x42250f
mov rax, qword [rbp - 8]
add rax, 0x20
mov ecx, dword [rax]
and ecx, 2
cmp ecx, 0
je 0x42250f
mov rax, qword [rbp - 8]
add rax, 0x40
mov ecx, dword [rbp - 0x10]
mov edx, dword [rax]
cmp ecx, edx
jae 0x4224c1
mov rax, qword [rbp + 0x18]
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fputc
mov eax, dword [rbp - 0x10]
mov rcx, rax
add eax, 1
mov dword [rbp - 0x10], eax
jmp 0x422484
mov rax, qword [rbp - 8]
add rax, 0x30
mov ecx, dword [rax]
mov dword [rbp - 0x14], ecx
mov rax, qword [rbp - 8]
add rax, 8
mov ecx, dword [rbp - 0x14]
movsxd rcx, ecx
mov rdx, qword [rbp + 0x18]
mov r9, rdx
mov r8, rcx
movabs rcx, 1
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov eax, dword [rbp - 0x10]
mov ecx, dword [rbp - 0x14]
add eax, ecx
mov dword [rbp - 0x10], eax
jmp 0x42241b
leave
ret
Function at 0x4223e2
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov dword [rbp - 0x10], eax
mov eax, 1
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x10]
add rax, 0x538
mov ecx, dword [rbp - 0xc]
mov edx, dword [rax]
cmp ecx, edx
jge 0x422514
jmp 0x422429
mov eax, dword [rbp - 0xc]
mov rcx, rax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x4223fe
mov rax, qword [rbp + 0x10]
add rax, 0x530
mov ecx, dword [rbp - 0xc]
movsxd rcx, ecx
shl rcx, 2
mov rdx, qword [rbp + 0x20]
add rdx, rcx
mov ecx, dword [rdx]
movsxd rcx, ecx
shl rcx, 3
mov rdx, qword [rax]
add rdx, rcx
mov rax, qword [rdx]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
add rax, 0x1c
mov ecx, dword [rax]
cmp ecx, 8
je 0x42250f
mov rax, qword [rbp - 8]
add rax, 0x20
mov ecx, dword [rax]
and ecx, 2
cmp ecx, 0
je 0x42250f
mov rax, qword [rbp - 8]
add rax, 0x40
mov ecx, dword [rbp - 0x10]
mov edx, dword [rax]
cmp ecx, edx
jae 0x4224c1
mov rax, qword [rbp + 0x18]
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fputc
mov eax, dword [rbp - 0x10]
mov rcx, rax
add eax, 1
mov dword [rbp - 0x10], eax
jmp 0x422484
mov rax, qword [rbp - 8]
add rax, 0x30
mov ecx, dword [rax]
mov dword [rbp - 0x14], ecx
mov rax, qword [rbp - 8]
add rax, 8
mov ecx, dword [rbp - 0x14]
movsxd rcx, ecx
mov rdx, qword [rbp + 0x18]
mov r9, rdx
mov r8, rcx
movabs rcx, 1
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov eax, dword [rbp - 0x10]
mov ecx, dword [rbp - 0x14]
add eax, ecx
mov dword [rbp - 0x10], eax
jmp 0x42241b
leave
ret
Function at 0x425737
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0x40
mov r8, rax
mov rax, qword [rbp + 0x18]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
movsxd rax, eax
cmp rax, 0x40
jne 0x4257f4
movabs rax, 4
mov r8, rax
lea rax, [0x00449160]
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcmp
mov ecx, 0
cmp ecx, eax
jne 0x4257f4
mov rax, qword [rbp + 0x18]
add rax, 0x10
movzx ecx, word [rax]
cmp ecx, 1
jne 0x4257d1
mov eax, 1
jmp 0x425845
mov rax, qword [rbp + 0x18]
add rax, 0x10
movzx ecx, word [rax]
cmp ecx, 3
jne 0x4257ef
mov eax, 2
jmp 0x425845
jmp 0x425840
mov eax, dword [rbp - 4]
cmp eax, 8
jl 0x425840
movabs rax, 8
mov r8, rax
lea rax, [0x00449165]
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcmp
mov ecx, 0
cmp ecx, eax
jne 0x425840
mov eax, 3
jmp 0x425845
mov eax, 0
leave
ret

Function at 0x425742
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0x40
mov r8, rax
mov rax, qword [rbp + 0x18]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
movsxd rax, eax
cmp rax, 0x40
jne 0x4257f4
movabs rax, 4
mov r8, rax
lea rax, [0x00449160]
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcmp
mov ecx, 0
cmp ecx, eax
jne 0x4257f4
mov rax, qword [rbp + 0x18]
add rax, 0x10
movzx ecx, word [rax]
cmp ecx, 1
jne 0x4257d1
mov eax, 1
jmp 0x425845
mov rax, qword [rbp + 0x18]
add rax, 0x10
movzx ecx, word [rax]
cmp ecx, 3
jne 0x4257ef
mov eax, 2
jmp 0x425845
jmp 0x425840
mov eax, dword [rbp - 4]
cmp eax, 8
jl 0x425840
movabs rax, 8
mov r8, rax
lea rax, [0x00449165]
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcmp
mov ecx, 0
cmp ecx, eax
jne 0x425840
mov eax, 3
jmp 0x425845
mov eax, 0
leave
ret
Function at 0x426955
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, dword [rbp + 0x20]
mov r10, rax
mov rcx, r10
call fcn.0043a979
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x20]
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov eax, dword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov ecx, dword [rbp + 0x20]
cmp eax, ecx
je 0x4269b0
jmp 0x426b6a
mov eax, dword [rbp + 0x28]
cmp eax, 4
mov eax, 0
sete al
cmp eax, 0
je 0x4269db
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.004268b6
jmp 0x4269ef
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.00426901
jmp 0x4269ef
mov dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x28]
movsxd rax, eax
mov rcx, qword [rbp - 0x20]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp + 0x28]
imul eax, ecx
movsxd rax, eax
mov rcx, qword [rbp - 0x38]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jge 0x426b7c
jmp 0x426a71
mov eax, dword [rbp - 4]
mov rcx, rax
add eax, 1
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_strlen
add rax, 1
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x30], rcx
jmp 0x426a32
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [0x00450bd0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0041fb91
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
cmp eax, 0
je 0x426b77
mov rax, qword [0x00450bd0]
add rax, 8
mov ecx, dword [rbp - 0x10]
movsxd rcx, ecx
movabs rdx, 0x18
imul rcx, rdx
mov rdx, qword [rax]
add rdx, rcx
mov qword [rbp - 0x40], rdx
mov rax, qword [rbp - 0x40]
add rax, 6
movzx ecx, word [rax]
cmp ecx, 0
jne 0x426b77
mov eax, dword [rbp + 0x28]
cmp eax, 4
mov eax, 0
sete al
cmp eax, 0
je 0x426b10
mov eax, dword [rbp - 4]
shl eax, 2
movsxd rax, eax
mov rcx, qword [rbp - 0x38]
add rcx, rax
mov r10, rcx
mov rcx, r10
call fcn.004268b6
jmp 0x426b30
mov eax, dword [rbp - 4]
shl eax, 3
movsxd rax, eax
mov rcx, qword [rbp - 0x38]
add rcx, rax
mov r10, rcx
mov rcx, r10
call fcn.00426901
jmp 0x426b30
movsxd rax, eax
add rax, 0x3c
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 8], eax
mov eax, dword [rbp - 0x14]
mov r8, rax
mov eax, dword [rbp + 0x18]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00425847
cmp eax, 0
jge 0x426b77
mov eax, 0xffffffff
mov dword [rbp - 0x18], eax
jmp 0x426b90
jmp 0x426a45
mov eax, dword [rbp - 8]
cmp eax, 0
jne 0x426a1a
mov eax, 0
mov dword [rbp - 0x18], eax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.0043a959
mov eax, dword [rbp - 0x18]
leave
ret
Function at 0x426960
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, dword [rbp + 0x20]
mov r10, rax
mov rcx, r10
call fcn.0043a979
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x20]
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov eax, dword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov ecx, dword [rbp + 0x20]
cmp eax, ecx
je 0x4269b0
jmp 0x426b6a
mov eax, dword [rbp + 0x28]
cmp eax, 4
mov eax, 0
sete al
cmp eax, 0
je 0x4269db
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.004268b6
jmp 0x4269ef
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.00426901
jmp 0x4269ef
mov dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x28]
movsxd rax, eax
mov rcx, qword [rbp - 0x20]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp + 0x28]
imul eax, ecx
movsxd rax, eax
mov rcx, qword [rbp - 0x38]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jge 0x426b7c
jmp 0x426a71
mov eax, dword [rbp - 4]
mov rcx, rax
add eax, 1
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x30]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_strlen
add rax, 1
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x30], rcx
jmp 0x426a32
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [0x00450bd0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0041fb91
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x10]
cmp eax, 0
je 0x426b77
mov rax, qword [0x00450bd0]
add rax, 8
mov ecx, dword [rbp - 0x10]
movsxd rcx, ecx
movabs rdx, 0x18
imul rcx, rdx
mov rdx, qword [rax]
add rdx, rcx
mov qword [rbp - 0x40], rdx
mov rax, qword [rbp - 0x40]
add rax, 6
movzx ecx, word [rax]
cmp ecx, 0
jne 0x426b77
mov eax, dword [rbp + 0x28]
cmp eax, 4
mov eax, 0
sete al
cmp eax, 0
je 0x426b10
mov eax, dword [rbp - 4]
shl eax, 2
movsxd rax, eax
mov rcx, qword [rbp - 0x38]
add rcx, rax
mov r10, rcx
mov rcx, r10
call fcn.004268b6
jmp 0x426b30
mov eax, dword [rbp - 4]
shl eax, 3
movsxd rax, eax
mov rcx, qword [rbp - 0x38]
add rcx, rax
mov r10, rcx
mov rcx, r10
call fcn.00426901
jmp 0x426b30
movsxd rax, eax
add rax, 0x3c
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 8], eax
mov eax, dword [rbp - 0x14]
mov r8, rax
mov eax, dword [rbp + 0x18]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00425847
cmp eax, 0
jge 0x426b77
mov eax, 0xffffffff
mov dword [rbp - 0x18], eax
jmp 0x426b90
jmp 0x426a45
mov eax, dword [rbp - 8]
cmp eax, 0
jne 0x426a1a
mov eax, 0
mov dword [rbp - 0x18], eax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.0043a959
mov eax, dword [rbp - 0x18]
leave
ret
Function at 0x42786d
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, dword [rbp + 0x18]
lea rcx, [rbp - 4]
mov r9, rcx
mov ecx, 0x40
mov r8, rcx
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_VirtualProtect
leave
ret

Function at 0x427878
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, dword [rbp + 0x18]
lea rcx, [rbp - 4]
mov r9, rcx
mov ecx, 0x40
mov r8, rcx
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_VirtualProtect
leave
ret
Function at 0x435f77
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x28]
cmp rax, 0
je 0x436037
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov dword [rbp - 4], ecx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0
jle 0x43602e
jmp 0x435fd3
mov eax, dword [rbp - 0x14]
sub eax, 2
mov dword [rbp - 0x14], eax
jmp 0x435fb7
mov eax, dword [rbp - 0x14]
cmp eax, 2
mov eax, 0
setge al
cmp eax, 0
je 0x435ffe
mov rax, qword [rbp - 0x10]
mov rcx, rax
add rax, 2
mov qword [rbp - 0x10], rax
jmp 0x43600a
mov rax, qword [rbp - 0x10]
movzx ecx, byte [rax]
jmp 0x436010
movzx eax, word [rcx]
mov rcx, rax
mov eax, dword [rbp - 4]
add eax, ecx
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0x10
mov ecx, dword [rbp - 4]
add ecx, eax
and ecx, 0xffff
mov dword [rbp - 4], ecx
jmp 0x435fc8
mov rax, qword [rbp + 0x28]
mov ecx, dword [rbp - 4]
mov dword [rax], ecx
mov eax, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x20]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov ecx, dword [rbp + 0x18]
cmp rcx, rax
mov eax, 0
sete al
cmp eax, 0
je 0x43607f
jmp 0x436089
mov eax, 0xffffffff
jmp 0x43608e
mov eax, 0
leave
ret

Function at 0x435f82
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x28]
cmp rax, 0
je 0x436037
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov dword [rbp - 4], ecx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0
jle 0x43602e
jmp 0x435fd3
mov eax, dword [rbp - 0x14]
sub eax, 2
mov dword [rbp - 0x14], eax
jmp 0x435fb7
mov eax, dword [rbp - 0x14]
cmp eax, 2
mov eax, 0
setge al
cmp eax, 0
je 0x435ffe
mov rax, qword [rbp - 0x10]
mov rcx, rax
add rax, 2
mov qword [rbp - 0x10], rax
jmp 0x43600a
mov rax, qword [rbp - 0x10]
movzx ecx, byte [rax]
jmp 0x436010
movzx eax, word [rcx]
mov rcx, rax
mov eax, dword [rbp - 4]
add eax, ecx
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0x10
mov ecx, dword [rbp - 4]
add ecx, eax
and ecx, 0xffff
mov dword [rbp - 4], ecx
jmp 0x435fc8
mov rax, qword [rbp + 0x28]
mov ecx, dword [rbp - 4]
mov dword [rax], ecx
mov eax, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x20]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov ecx, dword [rbp + 0x18]
cmp rcx, rax
mov eax, 0
sete al
cmp eax, 0
je 0x43607f
jmp 0x436089
mov eax, 0xffffffff
jmp 0x43608e
mov eax, 0
leave
ret
Function at 0x438bd1
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, 0
mov r8, rax
mov eax, dword [rbp + 0x18]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__lseek
mov eax, dword [rbp + 0x28]
mov r8, rax
mov rax, qword [rbp + 0x20]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov ecx, dword [rbp + 0x28]
cmp ecx, eax
mov eax, 0
sete al
leave
ret
Function at 0x43dee8
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, 0
mov dword [rbp - 0x1c], eax
movabs rax, 0
mov qword [rbp - 0x28], rax
mov eax, 0x8000
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__open
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
cmp eax, 0
jge 0x43df5e
mov rax, qword [rbp + 0x18]
mov r11, rax
lea rax, str.listfile__s_not_found
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043b310
mov eax, 2
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, dword [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__lseek
movsxd rax, eax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
add rax, 1
mov r10, rax
mov rcx, r10
call fcn.0043a979
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
add rcx, rax
mov eax, 0
mov byte [rcx], al
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, dword [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__lseek
mov eax, dword [rbp - 0x10]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
mov eax, dword [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov eax, dword [rbp - 4]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__close
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rbp - 8]
mov edx, dword [rax]
cmp ecx, edx
jge 0x43e098
jmp 0x43e025
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 8], eax
jmp 0x43e004
mov eax, dword [rbp - 8]
mov ecx, dword [rbp + 0x20]
cmp eax, ecx
jne 0x43e058
lea rax, [rbp - 0x28]
mov r8, rax
lea rax, [rbp - 0x1c]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043dd26
jmp 0x43e096
mov rax, qword [rbp + 0x30]
mov ecx, dword [rbp - 8]
movsxd rcx, ecx
shl rcx, 3
mov rdx, qword [rax]
add rdx, rcx
mov rax, qword [rdx]
mov r10, rax
mov rcx, r10
call fcn.0043aa7e
mov r8, rax
lea rax, [rbp - 0x1c]
mov r11, rax
lea rax, [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043aadb
jmp 0x43e01a
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call fcn.0043a959
mov rax, qword [rbp + 0x10]
add rax, 0x608
mov rcx, qword [rbp + 0x10]
add rcx, 0x604
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043ab9b
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x10]
add rcx, 0x604
mov edx, dword [rbp - 0x1c]
mov dword [rcx], edx
mov dword [rax], edx
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x10]
add rcx, 0x608
mov rdx, qword [rbp - 0x28]
mov qword [rcx], rdx
mov qword [rax], rdx
leave
ret
Function at 0x43def3
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, 0
mov dword [rbp - 0x1c], eax
movabs rax, 0
mov qword [rbp - 0x28], rax
mov eax, 0x8000
mov r11, rax
mov rax, qword [rbp + 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__open
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
cmp eax, 0
jge 0x43df5e
mov rax, qword [rbp + 0x18]
mov r11, rax
lea rax, str.listfile__s_not_found
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043b310
mov eax, 2
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, dword [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__lseek
movsxd rax, eax
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
add rax, 1
mov r10, rax
mov rcx, r10
call fcn.0043a979
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
add rcx, rax
mov eax, 0
mov byte [rcx], al
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, dword [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__lseek
mov eax, dword [rbp - 0x10]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
mov eax, dword [rbp - 4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov eax, dword [rbp - 4]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__close
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rbp - 8]
mov edx, dword [rax]
cmp ecx, edx
jge 0x43e098
jmp 0x43e025
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 8], eax
jmp 0x43e004
mov eax, dword [rbp - 8]
mov ecx, dword [rbp + 0x20]
cmp eax, ecx
jne 0x43e058
lea rax, [rbp - 0x28]
mov r8, rax
lea rax, [rbp - 0x1c]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043dd26
jmp 0x43e096
mov rax, qword [rbp + 0x30]
mov ecx, dword [rbp - 8]
movsxd rcx, ecx
shl rcx, 3
mov rdx, qword [rax]
add rdx, rcx
mov rax, qword [rdx]
mov r10, rax
mov rcx, r10
call fcn.0043aa7e
mov r8, rax
lea rax, [rbp - 0x1c]
mov r11, rax
lea rax, [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043aadb
jmp 0x43e01a
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call fcn.0043a959
mov rax, qword [rbp + 0x10]
add rax, 0x608
mov rcx, qword [rbp + 0x10]
add rcx, 0x604
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043ab9b
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x10]
add rcx, 0x604
mov edx, dword [rbp - 0x1c]
mov dword [rcx], edx
mov dword [rax], edx
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x10]
add rcx, 0x608
mov rdx, qword [rbp - 0x28]
mov qword [rcx], rdx
mov qword [rax], rdx
leave
ret
Function at 0x440ee0
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
lea rax, str.C_INCLUDE_PATH
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x440f2c
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043c4bf
lea rax, str.CPATH
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x440f69
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043c470
lea rax, str.LIBRARY_PATH
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x440fa6
mov rax, qword [rbp - 8]
mov r11, rax
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0043c869
leave
ret