joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460940
Capabilities:
Allocate thread local storage

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rdi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov esi, dword [rcx + 0x10]
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rbx, rcx
test esi, esi
js 0x460a50
mov ebp, dword [rcx + 0x14]
mov r12d, ebp
test ebp, ebp
js 0x460b48
test esi, esi
mov r13d, 0xffffffff
cmovne r13d, esi
test r12d, r12d
mov eax, 0xffffffff
cmove r12d, eax
mov eax, dword [0x005ed5f0]
test eax, eax
je 0x4609e8
mov dword [rbx + 0x3c], r12d
lea rcx, [rbx + 0x18]
mov r9, rbx
xor edx, edx
mov dword [rbx + 0x38], r13d
lea r8, [0x0045f240]
call fcn.004b56f0
mov r12d, eax
test eax, eax
jne 0x460a98
mov rax, qword [rsp + 0x58]
xor rax, qword [rdi]
jne 0x460bee
mov eax, r12d
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [0x005ed5f0], 1
lea rcx, [rsp + 0x20]
call fcn.004b57d0
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmm1, xmmword [rsp + 0x30]
mov r14, qword [sym.imp.KERNEL32.dll_TlsAlloc]
movaps xmmword [0x005ed600], xmm0
movaps xmmword [0x005ed610], xmm1
call r14
mov dword [0x005ed5ec], eax
call r14
lea rcx, [0x0045f490]
mov dword [0x005ed5e8], eax
call fcn.004946b0
lea rcx, [0x0045f270]
call fcn.00494700
jmp 0x46099d
lea rcx, [rsp + 0x48]
call fcn.004ac8a0
test eax, eax
js 0x460b91
mov eax, dword [rsp + 0x4c]
mov r12d, dword [rbx + 0x14]
mov dword [rbx + 0x10], eax
mov ebp, r12d
test r12d, r12d
js 0x460b08
mov r13d, dword [rsp + 0x48]
test r12d, r12d
jns 0x460b88
mov r12d, dword [rsp + 0x54]
jmp 0x460993
mov ecx, eax
call sub.msvcrt.dll_strerror
mov r12, rax
call fcn.00426640
lea rcx, [0x00585a73]
test eax, eax
je 0x460af0
mov rdx, r12
call fcn.00494950
test esi, esi
js 0x460b30
mov ecx, dword [rbx + 0x10]
test ecx, ecx
jne 0x460b78
test ebp, ebp
js 0x460bbd
mov ecx, dword [rbx + 0x14]
mov r12d, 0xffffffff
test ecx, ecx
je 0x4609c5
call sub.msvcrt.dll__close
jmp 0x4609c5
lea rcx, str.cannot_create_async_thread:__s
call fcn.0056e6a8
mov rcx, rax
jmp 0x460ab2
lea rcx, [rsp + 0x50]
call fcn.004ac8a0
test eax, eax
js 0x460bda
mov eax, dword [rsp + 0x50]
mov dword [rbx + 0x14], eax
jmp 0x460a79
mov ecx, dword [rsp + 0x48]
call sub.msvcrt.dll__close
mov ecx, dword [rsp + 0x4c]
call sub.msvcrt.dll__close
jmp 0x460ac9
lea rcx, [rsp + 0x50]
call fcn.004ac8a0
test eax, eax
js 0x460baf
mov eax, dword [rsp + 0x50]
mov r13d, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
test r13d, r13d
mov eax, 0xffffffff
cmove r13d, eax
jmp 0x460a87
call sub.msvcrt.dll__close
jmp 0x460ac9
mov r12d, dword [rbx + 0x14]
jmp 0x460987
mov ecx, dword [rbx + 0x14]
test ecx, ecx
jg 0x460bb6
lea rcx, str.cannot_create_pipe
mov r12d, 0xffffffff
call fcn.004948c0
jmp 0x4609c5
mov ecx, dword [rbx + 0x10]
test ecx, ecx
je 0x460b98
call sub.msvcrt.dll__close
jmp 0x460b98
mov ecx, dword [rsp + 0x50]
mov r12d, 0xffffffff
call sub.msvcrt.dll__close
mov ecx, dword [rsp + 0x54]
call sub.msvcrt.dll__close
jmp 0x4609c5
mov ecx, dword [rsp + 0x48]
call sub.msvcrt.dll__close
mov ecx, dword [rsp + 0x4c]
call sub.msvcrt.dll__close
jmp 0x460b98
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop
Function at 0x4679d0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push r14
mov eax, 0x4a00
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rbp, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbp]
mov qword [rsp + 0x49f8], rax
xor eax, eax
mov dword [rsp + 0x4a58], r9d
mov rdi, rdx
mov rbx, rcx
mov r9, qword [rsp + 0x4a60]
mov rdx, r8
test r8, r8
je 0x467ad0
lea rax, [rsp + 0x4c]
mov rcx, qword [rcx + 0xc8]
lea rbx, [rsp + 0x50]
mov r8d, dword [rsp + 0x4a58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x9f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x4c], 0x20
call fcn.004654f0
mov rax, qword [0x005ab240]
mov rdx, qword [rdi + 8]
mov rax, qword [rax]
mov rax, qword [rax + 0xc8]
cmp qword [rax + 0x10], 0x20
mov rax, qword [rdi]
je 0x467bc8
xor rdx, qword [rsp + 0x58]
xor rax, qword [rsp + 0x50]
or rdx, rax
je 0x467ac0
mov eax, 1
xor eax, 1
sub eax, 1
mov rdi, qword [rsp + 0x49f8]
xor rdi, qword [rbp]
jne 0x467c05
add rsp, 0x4a00
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [rbx + 0x10]
cmp dword [rdi + 0x10], eax
jne 0x467a8d
xor eax, eax
jmp 0x467a92
lea r9, [rsp + 0x4a58]
lea r8, [rsp + 0x4c]
mov rdx, rdi
mov qword [rsp + 0x20], 0
call fcn.00476380
mov r12, rax
test rax, rax
je 0x467bfb
mov esi, dword [rsp + 0x4a58]
mov ecx, dword [rsp + 0x4c]
lea r13, [rsp + 0x70]
lea r14, [rsp + 0x9d0]
call fcn.0051bbf0
mov qword [rsp + 0x20], rsi
mov edx, 0x20
mov rcx, r14
mov r9, rax
lea r8, [0x005865a6]
call fcn.0049a500
mov rcx, r13
mov esi, eax
mov rax, qword [rbx + 0xc8]
call qword [rax + 0x28]
mov rax, qword [rbx + 0xc8]
mov rdx, r14
mov rcx, r13
lea r8d, [rsi + 1]
lea rsi, [rsp + 0x9f0]
movsxd r8, r8d
call qword [rax + 0x30]
jmp 0x467b7a
mov rax, qword [rbx + 0xc8]
je 0x467ba8
mov rdx, rsi
mov rcx, r13
call qword [rax + 0x30]
mov r8d, 0x4000
mov rdx, rsi
mov rcx, r12
call fcn.00476370
mov r8, rax
test rax, rax
jns 0x467b68
mov rcx, r12
call fcn.00476340
mov eax, 0xffffffff
jmp 0x467a98
lea rbx, [rsp + 0x50]
mov rdx, r13
mov rcx, rbx
call qword [rax + 0x38]
mov rcx, r12
call fcn.00476340
jmp 0x467a5b
xor rdx, qword [rsp + 0x58]
xor rax, qword [rsp + 0x50]
or rdx, rax
jne 0x467a8d
mov rax, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
xor rax, qword [rbx + 0x10]
xor rdx, qword [rbx + 0x18]
or rdx, rax
jne 0x467a8d
xor eax, eax
jmp 0x467a92
mov eax, 0xffffffff
jmp 0x467a98
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax + rax]

Function at 0x467c10
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov ebx, edx
mov edx, dword [0x00572df8]
mov r13, rcx
or edx, ebx
call fcn.004b0de0
cmp byte [0x00572df8], 0
mov r12d, eax
jns 0x467c3b
test eax, eax
js 0x467c50
mov eax, r12d
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x16
jne 0x467c3b
mov edx, dword [0x00572df8]
mov rcx, r13
and dl, 0x7f
mov dword [0x00572df8], edx
or edx, ebx
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.004b0de0
Function at 0x470190
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
call fcn.004c9260
mov rcx, qword [rbx + 0x18]
add rsp, 0x20
pop rbx
jmp fcn.004c9260

Function at 0x472290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov r12, qword [rcx + 0x28]
test r12, r12
je 0x4722e0
mov qword [rcx + 0x28], 0
sub dword [r12 + 0x4c], 1
jne 0x4722e0
mov rcx, qword [r12 + 0x20]
test rcx, rcx
je 0x4722c8
call fcn.0043ec50
mov rcx, qword [r12 + 0x20]
call fcn.004c9260
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004c9260
add rsp, 0x20
pop r12
ret

Function at 0x4722f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rcx
mov rcx, rdx
mov edx, dword [rdx + 0x44]
test edx, edx
je 0x472320
mov rax, qword [rax + 0x28]
test rax, rax
je 0x472320
mov rax, qword [rax + 0x20]
test rax, rax
je 0x472320
cmp edx, dword [rax + 0xc]
ja 0x472320
mov rax, qword [rax]
sub edx, 1
cmp qword [rax + rdx*8], rcx
je 0x472328
jmp fcn.0043f0f0
or dword [rcx + 0x38], 0x20000
ret

Function at 0x472bc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x472c08
mov rbx, r12
jmp 0x472bf4
mov rcx, qword [rbx]
add rbx, 8
call fcn.004c9260
mov rcx, qword [rbx]
test rcx, rcx
je 0x472c08
cmp qword [rcx], 0
je 0x472be0
call fcn.00472650
jmp 0x472be0
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp fcn.004c9260

Function at 0x47a8a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, qword [rcx + 8]
mov rbx, rcx
call fcn.00423260
mov r8, r12
lea rcx, str._s_modules__s_config
mov rdx, rax
call fcn.004751e0
xor r8d, r8d
lea rdx, str.core.worktree
mov rcx, rax
mov r12, rax
call fcn.00414b90
test eax, eax
jne 0x47a8f8
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.004c9260
mov r13, qword [rbx]
call fcn.00426640
lea rcx, [0x005883ef]
test eax, eax
je 0x47a918
mov rdx, r13
call fcn.00494a30
jmp 0x47a8e0
lea rcx, str.Could_not_unset_core.worktree_setting_in_submodule__s
call fcn.0056e6a8
mov rcx, rax
jmp 0x47a90b

Function at 0x47d940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
test byte [rcx + 0x60], 1
je 0x47d954
call fcn.0047c730
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004c9260

Function at 0x47ee50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov dword [rcx + 0x10], 0
mov r12, rcx
lea rcx, [rcx + 0x28]
call fcn.004727a0
mov rdx, qword [r12]
mov rax, qword [r12 + 8]
mov rcx, r12
mov qword [rdx + 8], rax
mov qword [rax], rdx
add rsp, 0x20
pop r12
jmp fcn.004c9260
Function at 0x47f670
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
test eax, eax
mov eax, 1
cmovg eax, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
xor rdx, qword [rbx]
jne 0x47f6b1
add rsp, 0x60
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]

Function at 0x47fec0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x48
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
lea r14, [rsp + 0x20]
mov r13, r9
mov r12, r8
mov rax, qword [0x005ab200]
mov r9, r14
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call fcn.0047f9d0
test eax, eax
je 0x47ff2f
mov rdx, r13
mov rcx, r14
call fcn.004733c0
mov rcx, r12
mov rdx, r14
call fcn.0047f930
mov rcx, r14
call fcn.004727a0
mov rax, qword [rsp + 0x38]
xor rax, qword [rbx]
jne 0x47ff45
add rsp, 0x48
pop rbx
pop r12
pop r13
pop r14
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax + rax]

Function at 0x47fff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x50
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
xor eax, eax
lea r12, [rsp + 0x30]
mov r13, r8
mov r14, r9
mov rax, qword [0x005ab200]
lea rsi, [rsp + 0xa0]
mov r9, r12
lea r8, str.GIT_TRACE
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
call fcn.0047f9d0
test eax, eax
je 0x480086
mov r8, rsi
mov rdx, r14
mov rcx, r12
call fcn.00473660
mov rdx, r13
mov rcx, r12
call fcn.00438710
lea rcx, str.GIT_TRACE
mov rdx, r12
call fcn.0047f930
mov rcx, r12
call fcn.004727a0
mov rax, qword [rsp + 0x48]
xor rax, qword [rbx]
jne 0x48009d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop

Function at 0x4800b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
call fcn.0047fb50
mov rax, qword [rsp + 0x38]
xor rax, qword [rbx]
jne 0x4800ea
add rsp, 0x40
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
Function at 0x4800f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov eax, dword [0x005edb80]
test eax, eax
je 0x480119
sub eax, 1
mov dword [0x005edb80], eax
test r9, r9
je 0x480144
lea rax, [rsp + 0x70]
movsxd r10, dword [0x005edb80]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
lea rax, [0x005edba0]
sub r8, qword [rax + r10*8]
call fcn.0047fb50
mov rax, qword [rsp + 0x38]
xor rax, qword [rbx]
jne 0x480154
add rsp, 0x40
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]
push r14
push r13
push r12
sub rsp, 0x30
mov eax, dword [0x00573118]
mov r12, rcx
test byte [0x0057311c], 1
jne 0x480188
lea rcx, str.GIT_TRACE_SETUP
call fcn.0047f6e0
test eax, eax
jne 0x4801a0
add rsp, 0x30
pop r12
pop r13
pop r14
ret
call fcn.0049a480
mov r14, rax
call fcn.00423440
movabs rdx, 0x1ffffffff
movabs rcx, 0x100000000
mov r13, rax
lea rax, [0x005897cb]
test r13, r13
cmove r13, rax
test r12, r12
cmove r12, rax
mov rax, qword [0x00573118]
and rdx, rax
cmp rdx, rcx
je 0x480220
call fcn.00423260
mov rcx, rax
call fcn.0047fca0
lea r9, str.setup:_git_dir:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x177
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rax, qword [0x00573118]
movabs rdx, 0x1ffffffff
movabs rcx, 0x100000000
and rdx, rax
cmp rdx, rcx
je 0x480274
call fcn.004232a0
mov rcx, rax
call fcn.0047fca0
lea r9, str.setup:_git_common_dir:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x178
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rax, qword [0x00573118]
movabs rdx, 0x1ffffffff
movabs rcx, 0x100000000
and rdx, rax
cmp rdx, rcx
je 0x4802c3
mov rcx, r13
call fcn.0047fca0
lea r9, str.setup:_worktree:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x179
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rax, qword [0x00573118]
movabs rdx, 0x1ffffffff
movabs rcx, 0x100000000
and rdx, rax
cmp rdx, rcx
je 0x480312
mov rcx, r14
call fcn.0047fca0
lea r9, str.setup:_cwd:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x17a
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rax, qword [0x00573118]
movabs rdx, 0x1ffffffff
and rax, rdx
movabs rdx, 0x100000000
cmp rax, rdx
je 0x48035a
mov rcx, r12
call fcn.0047fca0
lea r9, str.setup:_prefix:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x17b
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rcx, r14
add rsp, 0x30
pop r12
pop r13
pop r14
jmp fcn.004c9260
Function at 0x480160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov eax, dword [0x005edb80]
test eax, eax
je 0x480119
sub eax, 1
mov dword [0x005edb80], eax
test r9, r9
je 0x480144
lea rax, [rsp + 0x70]
movsxd r10, dword [0x005edb80]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
lea rax, [0x005edba0]
sub r8, qword [rax + r10*8]
call fcn.0047fb50
mov rax, qword [rsp + 0x38]
xor rax, qword [rbx]
jne 0x480154
add rsp, 0x40
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]
push r14
push r13
push r12
sub rsp, 0x30
mov eax, dword [0x00573118]
mov r12, rcx
test byte [0x0057311c], 1
jne 0x480188
lea rcx, str.GIT_TRACE_SETUP
call fcn.0047f6e0
test eax, eax
jne 0x4801a0
add rsp, 0x30
pop r12
pop r13
pop r14
ret
call fcn.0049a480
mov r14, rax
call fcn.00423440
movabs rdx, 0x1ffffffff
movabs rcx, 0x100000000
mov r13, rax
lea rax, [0x005897cb]
test r13, r13
cmove r13, rax
test r12, r12
cmove r12, rax
mov rax, qword [0x00573118]
and rdx, rax
cmp rdx, rcx
je 0x480220
call fcn.00423260
mov rcx, rax
call fcn.0047fca0
lea r9, str.setup:_git_dir:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x177
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rax, qword [0x00573118]
movabs rdx, 0x1ffffffff
movabs rcx, 0x100000000
and rdx, rax
cmp rdx, rcx
je 0x480274
call fcn.004232a0
mov rcx, rax
call fcn.0047fca0
lea r9, str.setup:_git_common_dir:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x178
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rax, qword [0x00573118]
movabs rdx, 0x1ffffffff
movabs rcx, 0x100000000
and rdx, rax
cmp rdx, rcx
je 0x4802c3
mov rcx, r13
call fcn.0047fca0
lea r9, str.setup:_worktree:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x179
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rax, qword [0x00573118]
movabs rdx, 0x1ffffffff
movabs rcx, 0x100000000
and rdx, rax
cmp rdx, rcx
je 0x480312
mov rcx, r14
call fcn.0047fca0
lea r9, str.setup:_cwd:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x17a
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rax, qword [0x00573118]
movabs rdx, 0x1ffffffff
and rax, rdx
movabs rdx, 0x100000000
cmp rax, rdx
je 0x48035a
mov rcx, r12
call fcn.0047fca0
lea r9, str.setup:_prefix:__s_n
lea r8, str.GIT_TRACE_SETUP
mov edx, 0x17b
mov qword [rsp + 0x20], rax
lea rcx, str.trace.c
call fcn.0047ff50
mov rcx, r14
add rsp, 0x30
pop r12
pop r13
pop r14
jmp fcn.004c9260
Function at 0x4803b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp qword [0x005edb78], 1
ja 0x480510
je 0x4804c0
lea r13, [rsp + 0x20]
xor edx, edx
mov rcx, r13
call fcn.004ac7f0
movsxd r12, dword [rsp + 0x20]
imul eax, dword [rsp + 0x24], 0x3e8
imul r12, r12, 0x3b9aca00
cdqe
add r12, rax
mov eax, dword [0x005edb70]
test eax, eax
jne 0x480478
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x480500
movabs rax, 0x3b9aca0000000000
xor edx, edx
mov ecx, 0xffffffff
mov dword [0x005edb70], 0x20
div qword [rsp + 0x20]
mov qword [0x005edb68], rax
mov qword [0x005edb60], rax
cmp rax, rcx
jbe 0x480478
mov edx, 0x20
nop dword [rax]
shr rax, 1
sub edx, 1
cmp rax, rcx
ja 0x480460
mov qword [0x005edb60], rax
mov dword [0x005edb70], edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x20]
mov ecx, dword [0x005edb70]
imul rax, qword [0x005edb60]
movsxd rdx, dword [rsp + 0x24]
imul rdx, qword [0x005edb68]
shr rax, cl
add rax, rdx
je 0x480500
mov rdx, r12
sub rdx, rax
mov qword [0x005edb78], rdx
jmp 0x4804e5
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.004ac7f0
movsxd r12, dword [rsp + 0x20]
imul eax, dword [rsp + 0x24], 0x3e8
imul r12, r12, 0x3b9aca00
cdqe
add r12, rax
mov rax, qword [rsp + 0x28]
xor rax, qword [rbx]
jne 0x4805c7
mov rax, r12
add rsp, 0x30
pop rbx
pop r12
pop r13
ret
mov qword [0x005edb78], 1
jmp 0x4804e5
mov edx, dword [0x005edb70]
lea r13, [rsp + 0x20]
test edx, edx
jne 0x48058c
mov rcx, r13
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4805bb
movabs rax, 0x3b9aca0000000000
xor edx, edx
mov ecx, 0xffffffff
mov dword [0x005edb70], 0x20
div qword [rsp + 0x20]
mov qword [0x005edb68], rax
mov qword [0x005edb60], rax
cmp rax, rcx
jbe 0x48058c
mov edx, 0x1f
nop dword [rax + rax]
shr rax, 1
mov r8d, edx
sub edx, 1
cmp rax, rcx
ja 0x480570
mov qword [0x005edb60], rax
mov dword [0x005edb70], r8d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r12d, dword [rsp + 0x20]
mov ecx, dword [0x005edb70]
imul r12, qword [0x005edb60]
movsxd rax, dword [rsp + 0x24]
imul rax, qword [0x005edb68]
shr r12, cl
add r12, rax
add r12, qword [0x005edb78]
jmp 0x4804e5
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]
Function at 0x481270
Capabilities:
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov rbx, rcx
mov rsi, rdx
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
call fcn.00414be0
mov r9, rsi
mov r8, rbx
mov edx, 0xa89
lea rcx, str.config.c
add rsp, 0x38
pop rbx
pop rsi
jmp 0x481270
mov eax, dword [0x005edc0c]
test eax, eax
jne 0x481280
ret
jmp 0x482060
push r13
push r12
push rbx
sub rsp, 0x40
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov eax, dword [0x005edc10]
mov qword [rsp + 0x20], rcx
mov r12, r8
mov dword [rsp + 0x28], edx
mov r13, r9
test eax, eax
je 0x4820c8
mov eax, dword [0x005edc14]
test eax, eax
jle 0x4820ad
lea r8, [rsp + 0x20]
mov rdx, r13
mov rcx, r12
call fcn.00481e10
mov rax, qword [rsp + 0x38]
xor rax, qword [rbx]
jne 0x4820cf
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
call fcn.00481e80
jmp 0x482099
call sub.libssp_0.dll___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4819a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r11d, dword [0x005edc0c]
mov r10, qword [rsp + 0x80]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rax
test r11d, r11d
je 0x4819ef
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r10
call fcn.00480a10
mov rax, qword [rsp + 0x48]
xor rax, qword [rbx]
jne 0x4819ff
add rsp, 0x50
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
Function at 0x481a10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov r10, qword [rsp + 0x80]
mov r11, qword [rsp + 0x88]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rax, [rsp + 0x90]
cmp dword [0x005edc0c], 0
mov qword [rsp + 0x40], rax
je 0x481a60
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r10
call fcn.00480a10
mov rax, qword [rsp + 0x48]
xor rax, qword [rbx]
jne 0x481a70
add rsp, 0x50
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov eax, dword [0x005edc0c]
mov r12, rcx
mov r13d, edx
test eax, eax
jne 0x481ab0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.00487eb0
test eax, eax
jne 0x481b70
call fcn.004803b0
lea rbx, [0x005898e0]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
mov rcx, rdx
mov r14, rdx
call fcn.00488050
mov rdi, rax
call fcn.00487ff0
mov rcx, r14
call fcn.00488020
mov rsi, qword [0x005ab270]
mov r14, qword [0x005ab280]
mov rbp, rax
mov rcx, qword [rsi]
call fcn.004829b0
test eax, eax
je 0x481b30
mov rax, qword [rsi + 0x80]
test rax, rax
je 0x481b30
mov r9, rbp
mov r8, rdi
mov edx, r13d
mov rcx, r12
call rax
add rbx, 8
test r14, r14
je 0x481b55
mov rsi, r14
mov r14, qword [rbx + 8]
mov rcx, qword [rsi]
call fcn.004829b0
test eax, eax
jne 0x481b16
add rbx, 8
test r14, r14
jne 0x481b39
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.00487ee0
lea rax, str.thread_proc_on_main
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov qword [rsp + 0x28], rax
mov rcx, r12
mov qword [rsp + 0x20], 0
call fcn.00481a10
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret