joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140097770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140097790
add rsp, 0x28
ret
call fcn.14008e180
lea rcx, [0x1401db6f4]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
add rsp, 0x28
jmp fcn.1400975c0

Function at 0x1400977c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp qword [0x14023de90], rax
sete al
movzx eax, al
add rsp, 0x28
ret

Function at 0x1400977f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [0x14023dd6c]
mov rsi, rcx
mov ebp, edx
test eax, eax
jne 0x14008f860
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call fcn.1400977c0
test eax, eax
jne 0x14008f928
call fcn.14008e180
lea rdi, [0x1401daa80]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
mov rbx, rdx
shr rbx, 4
mov rcx, rbx
call fcn.140097b20
mov r13, rax
call fcn.1400979d0
mov rcx, rbx
call fcn.140097ab0
lea rcx, [0x14008e580]
mov r12, rax
call fcn.140097e70
lea rcx, [0x14008e520]
call fcn.1400903e0
call fcn.140097c90
call fcn.140097de0
call fcn.1400903a0
call fcn.140097ca0
mov rbx, qword [0x140207d30]
mov rcx, qword [rbx]
call fcn.140090be0
test eax, eax
je 0x14008f904
mov rax, qword [rbx + 0x90]
test rax, rax
je 0x14008f904
mov r9, r12
mov r8, r13
mov edx, ebp
mov rcx, rsi
call rax
mov rbx, qword [rdi + 8]
add rdi, 8
test rbx, rbx
jne 0x14008f8df
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x1400977f0
lea rax, str.thread_proc_on_main
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], 0
call fcn.14008f7c0
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
push rbx
sub rsp, 0x20
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140097838
xor edx, edx
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx]
call fcn.1400d2670
mov rcx, qword [rbx + 8]
call fcn.1400d2670
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d2670
call fcn.14008e180
lea rcx, [0x1401db6f4]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
call fcn.1400975c0
mov rbx, rax
jmp 0x140097809
Function at 0x140097870
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140097900
mov rdx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
lea rcx, [rdx + 1]
cmp rax, rcx
jb 0x1400978b8
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rcx
mov qword [rax + rdx*8], rsi
add rsp, 0x28
pop rbx
pop rsi
ret
lea rdx, [rax + rax*2 + 0x30]
shr rdx, 1
cmp rdx, rcx
cmovb rdx, rcx
mov rax, rdx
mov qword [rbx + 0x10], rdx
shr rax, 0x3d
jne 0x14009792e
mov rcx, qword [rbx + 8]
shl rdx, 3
call fcn.1400a61c0
mov rdx, qword [rbx + 0x18]
mov qword [rbx + 8], rax
lea rcx, [rdx + 1]
mov qword [rbx + 0x18], rcx
mov qword [rax + rdx*8], rsi
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14008e180
lea rcx, [0x1401db6f4]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
call fcn.1400975c0
mov rbx, rax
jmp 0x14009788d
mov r8, rdx
lea rcx, [0x1401db700]
mov edx, 8
call fcn.1400a08a0
nop
nop word cs:[rax + rax]
nop

Function at 0x140097950
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140097980
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x1400979a8
sub rdx, 1
mov qword [rax + 0x18], rdx
add rsp, 0x28
ret
call fcn.14008e180
lea rcx, [0x1401db6f4]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
call fcn.1400975c0
jmp 0x140097965
mov r9, qword [rax]
lea r8, str.no_open_regions_in_thread__s
mov edx, 0x77
lea rcx, str.trace2_tr2_tls.c
call fcn.1400a0ca0
nop
nop word cs:[rax + rax]
nop

Function at 0x1400979d0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ecx, dword [0x14023de44]
mov rsi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rsi
mov rbx, rax
test rax, rax
je 0x140097a60
cmp qword [rbx + 0x18], 1
jbe 0x140097a50
movabs rbp, 0x20c49ba5e353f7cf
lea rdi, [0x1401db6f4]
jmp 0x140097a28
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x140097a8e
sub rdx, 1
mov qword [rax + 0x18], rdx
cmp qword [rbx + 0x18], 1
jbe 0x140097a50
mov ecx, dword [0x14023de44]
call rsi
test rax, rax
jne 0x140097a10
call fcn.14008e180
mov rcx, rdi
shr rax, 3
mul rbp
shr rdx, 4
call fcn.1400975c0
jmp 0x140097a10
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.14008e180
lea rcx, [0x1401db6f4]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
call fcn.1400975c0
mov rbx, rax
jmp 0x1400979ef
mov r9, qword [rax]
lea r8, str.no_open_regions_in_thread__s
mov edx, 0x77
lea rcx, str.trace2_tr2_tls.c
call fcn.1400a0ca0
nop
nop word [rax + rax]
Function at 0x140097ab0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140097af0
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x140097ade
mov rax, qword [rax + 8]
sub rbx, qword [rax + rdx*8 - 8]
mov rdx, rbx
mov rax, rdx
add rsp, 0x20
pop rbx
ret
call fcn.14008e180
lea rcx, [0x1401db6f4]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
call fcn.1400975c0
jmp 0x140097ac9

Function at 0x140097b40
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
cmp qword [0x14023de88], 0
jne 0x140097b6f
call fcn.14008e180
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
mov qword [0x14023de88], rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
lea rcx, [0x14023de60]
mov dword [0x14023de44], eax
call fcn.14008c8c0
mov rdx, qword [0x14023de88]
lea rcx, str.main
call fcn.1400975c0
mov qword [0x14023de90], rax
add rsp, 0x28
ret

Function at 0x140097bb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140097c20
xor edx, edx
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx]
call fcn.1400d2670
mov rcx, qword [rbx + 8]
call fcn.1400d2670
mov rcx, rbx
call fcn.1400d2670
lea rcx, [0x14023de60]
mov qword [0x14023de90], 0
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [0x14023de44]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsFree]
call fcn.14008e180
lea rcx, [0x1401db6f4]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
call fcn.1400975c0
mov rbx, rax
jmp 0x140097bc9
Function at 0x1400a08a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140207460]
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
xor edx, edx
call qword [str.__f_n_]
test eax, eax
je 0x1400a0915
mov ecx, 2
call qword [fcn.1401bee20]
mov r8d, 0x29
mov edx, 1
lea rcx, str.fatal:_recursion_detected_in_die_handler_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r8d, pe_nt_image_headers64
mov edx, 0xb2
lea rcx, str.usage.c
call fcn.140003470
mov ecx, eax
call sub.msvcrt.dll_exit
lea rdx, [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x20], rdx
call qword [0x1401c1718]
nop
nop dword [rax]

Function at 0x1400a0930
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x440
mov rax, qword [0x140207460]
mov qword [rsp + 0x468], rdx
mov rbx, rcx
mov qword [rsp + 0x470], r8
mov qword [rsp + 0x478], r9
mov rdi, qword [rax]
mov qword [rsp + 0x438], rdi
xor edi, edi
call qword [str.__f_n_]
test eax, eax
je 0x1400a09b6
mov ecx, 2
call qword [fcn.1401bee20]
mov r8d, 0x2f
mov edx, 1
lea rcx, str.fatal:_recursion_detected_in_die_errno_handler_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r8d, pe_nt_image_headers64
mov edx, 0xda
lea rcx, str.usage.c
call fcn.140003470
mov ecx, eax
call sub.msvcrt.dll_exit
lea rsi, [rsp + 0x468]
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov rdi, qword [0x1401c1718]
mov qword [rsp + 0x28], rsi
call fcn.1400a05f0
mov rdx, rsi
mov rcx, rax
call rdi
nop

Function at 0x1400a6360
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r12, qword [0x140207460]
mov qword [rsp + 0x70], r8
mov edi, edx
mov rsi, rcx
mov ebx, edx
mov qword [rsp + 0x78], r9
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
xor eax, eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
and edi, 0x100
je 0x1400a63a4
movzx edi, word [rsp + 0x70]
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov r8d, edi
mov edx, ebx
mov rcx, rsi
call fcn.1400c0420
test eax, eax
jns 0x1400a6410
call rbp
cmp dword [rax], 4
je 0x1400a63ab
mov eax, ebx
not eax
test ah, 5
je 0x1400a6426
test bl, 2
jne 0x1400a643d
mov rax, qword [0x1402078f0]
and ebx, 1
mov edx, dword [rax]
jne 0x1400a6400
lea rcx, [0x1401dda98]
test edx, edx
je 0x1400a63f2
call sub.libintl_8.dll_libintl_gettext
mov rcx, rax
mov rdx, rsi
call fcn.1400a0930
nop word [rax + rax]
lea rcx, [0x1401dda78]
test edx, edx
je 0x1400a63f2
jmp 0x1400a63ea
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r12]
jne 0x1400a6454
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, str.unable_to_create__s
call fcn.1400a5f60
mov rdx, rsi
mov rcx, rax
call fcn.1400a0930
lea rcx, str.could_not_open__s_for_reading_and_writing
call fcn.1400a5f60
mov rdx, rsi
mov rcx, rax
call fcn.1400a0930
call fcn.1401be670
nop
nop word [rax + rax]
Function at 0x1400a6460
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r13, qword [0x140207460]
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rax, qword [r13]
mov qword [rsp + 0x28], rax
mov eax, 0x800000
mov edi, ecx
mov rbp, rdx
cmp r8, rax
cmovbe rax, r8
mov rsi, rax
mov r8d, esi
mov rdx, rbp
mov ecx, edi
call sub.msvcrt.dll__read
movsxd rbx, eax
test rbx, rbx
jns 0x1400a64c5
call r12
cmp dword [rax], 4
je 0x1400a6497
call r12
mov eax, dword [rax]
cmp eax, 0xb
je 0x1400a64e0
cmp eax, 0x8c
je 0x1400a64e0
mov rax, qword [rsp + 0x28]
sub rax, qword [r13]
jne 0x1400a6505
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, 1
lea rcx, [rsp + 0x20]
mov r8d, 0xffffffff
mov edx, 1
mov dword [rsp + 0x20], edi
mov word [rsp + 0x24], ax
call fcn.1400c59f0
jmp 0x1400a6497
call fcn.1401be670
nop
nop dword [rax + rax]

Function at 0x1400a67a0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__dup
test eax, eax
js 0x1400a67b2
add rsp, 0x28
ret
lea rcx, str.dup_failed
call fcn.1400a0930
nop
nop

Function at 0x1400a6890
Capabilities:
Check if file exists
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__fdopen
test rax, rax
je 0x1400a6883
add rsp, 0x28
ret
lea rcx, str.Out_of_memory__fdopen_failed
call fcn.1400a0930
nop
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rdi, [0x1401ddb24]
mov rdx, rdi
mov rsi, rcx
call fcn.1400c00c0
mov rbx, rax
test rax, rax
je 0x1400a68c0
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
cmp dword [rax], 1
jne 0x1400a68b2
mov rcx, rsi
call fcn.1400bf250
test eax, eax
jne 0x1400a68f0
mov rdx, rdi
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400c00c0
call rbp
mov dword [rax], 1
jmp 0x1400a68b2

Function at 0x1400a69d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x130
mov rsi, qword [0x140207460]
mov r8d, 0x104
mov rax, qword [rsi]
mov qword [rsp + 0x128], rax
xor eax, eax
lea rdi, [rsp + 0x20]
mov rbx, rcx
mov rdx, rcx
mov rcx, rdi
call fcn.1400c6190
mov rcx, rbx
call fcn.1400ba1b0
test eax, eax
js 0x1400a6a31
mov rdx, qword [rsp + 0x128]
sub rdx, qword [rsi]
jne 0x1400a6a76
add rsp, 0x130
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
mov rcx, rbx
mov r12d, dword [rax]
call sub.msvcrt.dll_strlen
mov rcx, rdi
mov rsi, rax
call sub.msvcrt.dll_strlen
cmp rsi, rax
cmovne rbx, rdi
mov rcx, rbx
call fcn.1400de740
mov rbx, rax
call rbp
mov rdx, rbx
lea rcx, str.Unable_to_create_temporary_file__s
mov dword [rax], r12d
call fcn.1400a0930
call fcn.1401be670
nop
nop dword [rax]
Function at 0x1400a6a80
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r14, qword [0x140207460]
mov rax, qword [r14]
mov qword [rsp + 0x28], rax
xor eax, eax
movsxd rbx, edx
mov rsi, rcx
mov edi, r8d
call sub.msvcrt.dll_strlen
lea edx, [rbx + 6]
movsxd rdx, edx
cmp rax, rdx
jb 0x1400a6bc0
sub rax, rbx
mov r8d, 6
lea rdx, str.XXXXXX
lea r13, [rax - 6]
lea rbp, [rsi + r13]
mov rcx, rbp
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x1400a6bc0
lea r15, [rsi + r13 + 6]
mov ebx, 0x4000
lea r12, [rsp + 0x20]
mov r13, qword [sym.imp.msvcrt.dll__errno]
nop dword [rax]
mov edx, 8
mov rcx, r12
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400a6bb2
mov rcx, qword [rsp + 0x20]
mov r8, rbp
lea r10, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
movabs r9, 0x8421084210842109
nop
mov rdx, rcx
add r8, 1
shr rdx, 1
mov rax, rdx
mul r9
shr rdx, 4
mov rax, rdx
shl rax, 5
sub rax, rdx
add rax, rax
sub rcx, rax
movzx eax, byte [r10 + rcx]
mov rcx, rdx
mov byte [r8 - 1], al
cmp r8, r15
jne 0x1400a6b30
mov qword [rsp + 0x20], rdx
mov r8d, edi
mov edx, 0x502
mov rcx, rsi
call fcn.1400c0420
test eax, eax
jns 0x1400a6b97
call r13
cmp dword [rax], 0x11
jne 0x1400a6b8f
sub ebx, 1
jne 0x1400a6b00
mov byte [rsi], 0
mov eax, 0xffffffff
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r14]
jne 0x1400a6bce
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.unable_to_get_random_bytes_for_temporary_file
call fcn.1400a0ab0
jmp 0x1400a6b92
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400a6b92
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop

Function at 0x1400a6be0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov r8d, edx
xor edx, edx
jmp fcn.1400a6a80

Function at 0x1400a7270
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
xor edx, edx
mov r8d, ecx
xor ecx, ecx
jmp fcn.1400c59f0

Function at 0x1400a7330
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x78], rax
xor eax, eax
mov rax, qword [0x140207a10]
mov esi, edx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call qword [rax]
test eax, eax
js 0x1400a7396
movzx eax, word [rsp + 0x26]
and ax, 0xf000
cmp ax, 0xa000
je 0x1400a738a
mov edx, esi
mov rcx, rbx
call fcn.1400c0420
mov rdx, qword [rsp + 0x78]
sub rdx, qword [rdi]
jne 0x1400a739d
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x72
mov eax, 0xffffffff
jmp 0x1400a7378
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop
sub rsp, 0x28
call sub.ADVAPI32.dll_SystemFunction036
cmp al, 1
sbb eax, eax
add rsp, 0x28
ret
Function at 0x1400a73b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x78], rax
xor eax, eax
mov rax, qword [0x140207a10]
mov esi, edx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call qword [rax]
test eax, eax
js 0x1400a7396
movzx eax, word [rsp + 0x26]
and ax, 0xf000
cmp ax, 0xa000
je 0x1400a738a
mov edx, esi
mov rcx, rbx
call fcn.1400c0420
mov rdx, qword [rsp + 0x78]
sub rdx, qword [rdi]
jne 0x1400a739d
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x72
mov eax, 0xffffffff
jmp 0x1400a7378
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop
sub rsp, 0x28
call sub.ADVAPI32.dll_SystemFunction036
cmp al, 1
sbb eax, eax
add rsp, 0x28
ret

Function at 0x1400a7690
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140207840]
and ecx, dword [rax]
mov rbx, r8
jne 0x1400a76b0
add rsp, 0x20
pop rbx
ret
mov ecx, edx
call fcn.1400a73d0
test eax, eax
jns 0x1400a76a3
mov rdx, rbx
lea rcx, str.fsync_error_on__s
call fcn.1400a0930
nop
nop dword [rax + rax]

Function at 0x1400a76d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1400a6690
test rax, rax
js 0x1400a76e3
add rsp, 0x28
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call fcn.140071f40
lea rcx, str.write_error
call fcn.1400a0930
nop
nop dword [rax]

Function at 0x1400a7700
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, rcx
mov rcx, rdx
mov edx, 1
mov rbx, r8
call sub.msvcrt.dll_fwrite
cmp rax, rbx
jne 0x1400a7723
add rsp, 0x20
pop rbx
ret
lea rcx, str.fwrite_error
call fcn.1400a0930
nop

Function at 0x1400a7730
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1400b9f40
test eax, eax
jne 0x1400a7742
add rsp, 0x28
ret
lea rcx, str.fflush_error
call fcn.1400a0930
nop
nop
Function at 0x1400a7e60
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x140207c90]
mov ebx, ecx
lea rsi, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], rax
mov eax, ecx
mov qword [rsp + 0x28], 0
not eax
test eax, 0x440
je 0x1400a7f90
test cl, 0x40
jne 0x1400a7f70
test bh, 4
je 0x1400a7edb
cmp qword [rsp + 0x28], 0
jne 0x1400a8010
mov r8d, 0x15
lea rdx, str.new_blank_line_at_EOF
mov rcx, rsi
call fcn.14007e800
test bl, 0x80
je 0x1400a7f01
cmp qword [rsp + 0x28], 0
jne 0x1400a7fd0
mov r8d, 0x1a
lea rdx, str.space_before_tab_in_indent
mov rcx, rsi
call fcn.14007e800
test bh, 1
je 0x1400a7f27
cmp qword [rsp + 0x28], 0
jne 0x1400a7ff0
mov r8d, 0x12
lea rdx, str.indent_with_spaces
mov rcx, rsi
call fcn.14007e800
and bh, 8
je 0x1400a7f49
cmp qword [rsp + 0x28], 0
jne 0x1400a7fb0
mov r8d, 0xd
lea rdx, [0x1401dde70]
mov rcx, rsi
call fcn.14007e800
xor edx, edx
mov rcx, rsi
call fcn.14007d860
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi]
jne 0x1400a802a
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov r8d, 0x13
lea rdx, str.trailing_whitespace
mov rcx, rsi
call fcn.14007e800
jmp 0x1400a7eb5
mov r8d, 0x13
lea rdx, str.trailing_whitespace
mov rcx, rsi
call fcn.14007e800
jmp 0x1400a7edb
mov r8d, 2
lea rdx, [0x1401dde29]
mov rcx, rsi
call fcn.14007e800
jmp 0x1400a7f34
mov r8d, 2
lea rdx, [0x1401dde29]
mov rcx, rsi
call fcn.14007e800
jmp 0x1400a7eec
mov r8d, 2
lea rdx, [0x1401dde29]
mov rcx, rsi
call fcn.14007e800
jmp 0x1400a7f12
mov r8d, 2
lea rdx, [0x1401dde29]
mov rcx, rsi
call fcn.14007e800
jmp 0x1400a7ec6
call fcn.1401be670
nop
Function at 0x1400ac430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, qword [0x140207460]
mov rax, qword [rbp]
mov qword [rsp + 0x78], rax
xor eax, eax
mov rsi, rdx
lea rdx, str.rebase_apply
mov rbx, rcx
call fcn.140037a70
lea rdi, [rsp + 0x20]
mov rcx, rax
mov rdx, rdi
call fcn.1400c1e40
test eax, eax
jne 0x1400ac4e8
lea rdx, str.rebase_apply_applying
mov rcx, rbx
call fcn.140037a70
mov rdx, rdi
mov rcx, rax
call fcn.1400c1e40
test eax, eax
je 0x1400ac560
mov dword [rsi + 0xc], 1
lea rdx, str.rebase_apply_head_name
mov rcx, rbx
call fcn.1400a9d70
lea rdx, str.rebase_apply_onto
mov rcx, rbx
mov qword [rsi + 0x28], rax
call fcn.1400a9d70
mov qword [rsi + 0x30], rax
mov eax, 1
mov rdx, qword [rsp + 0x78]
sub rdx, qword [rbp]
jne 0x1400ac5b4
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [0x1401de7f5]
mov rcx, rbx
call fcn.140037a70
mov rdx, rdi
mov rcx, rax
call fcn.1400c1e40
mov edx, eax
xor eax, eax
test edx, edx
jne 0x1400ac4c7
lea rdx, str.rebase_merge_interactive
mov rcx, rbx
call fcn.140037a70
mov rdx, rdi
mov rcx, rax
call fcn.1400c1e40
test eax, eax
je 0x1400ac5a8
mov dword [rsi + 0xc], 1
lea rdx, [0x1401de81b]
mov rcx, rbx
call fcn.1400a9d70
lea rdx, [0x1401de832]
mov rcx, rbx
mov qword [rsi + 0x28], rax
call fcn.1400a9d70
mov qword [rsi + 0x30], rax
jmp 0x1400ac4c2
mov dword [rsi + 4], 1
lea rdx, str.rebase_apply_patch
mov rcx, rbx
call fcn.140037a70
mov rdx, rdi
mov rcx, rax
call fcn.1400c1e40
test eax, eax
jne 0x1400ac4c2
cmp qword [rsp + 0x38], 0
jne 0x1400ac4c2
mov dword [rsi + 8], 1
jmp 0x1400ac4c2
mov dword [rsi + 0x10], 1
jmp 0x1400ac533
call fcn.1401be670
nop
nop word [rax + rax]
Function at 0x1400b8aa0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov ecx, 2
call qword [fcn.1401bee20]
mov r8d, 0x2b
mov edx, 1
lea rcx, str.fatal:_not_enough_memory_for_initialization
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r8d, pe_nt_image_headers64
mov edx, 0xf33
lea rcx, str.compat_mingw.c
call fcn.140003470
mov ecx, eax
call sub.msvcrt.dll_exit
nop
nop dword [rax + rax]

Function at 0x1400b8af0
Capabilities:
Enumerate processes
Initialize winsock library
Query environment variable
Set environment variable
Terminate process
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov r13, qword [0x140207460]
mov r12d, 3
mov rax, qword [r13]
mov qword [rsp + 0x248], rax
xor eax, eax
lea r14, [rsp + 0x40]
cmp r8d, 1
mov rbx, rcx
sbb r12d, 0xffffffff
mov edi, edx
mov esi, r8d
mov ebp, r9d
mov r8d, 0x104
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x102
jbe 0x1400b8b78
mov rax, qword [rsp + 0x248]
sub rax, qword [r13]
jne 0x1400b8cb0
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x1401e0384]
mov rcx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400b8c70
cmp edi, 0xfffffff4
je 0x1400b8c10
mov eax, dword [rsp + 0x2b0]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov qword [rsp + 0x30], 0
mov rcx, r14
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b8b4d
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov rdx, rbx
mov ecx, edi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, ebp
mov edx, esi
call fcn.1400c2d50
mov ecx, ebp
call sub.msvcrt.dll__close
jmp 0x1400b8b4d
lea rdx, str.2_1
mov rcx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400b8b9f
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rdi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b8c97
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov rdx, rbx
mov ecx, 0xfffffff4
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov edx, esi
mov ecx, edi
call fcn.1400c2d50
jmp 0x1400b8b4d
mov ecx, esi
call sub.msvcrt.dll__close
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
je 0x1400b8b4d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b8b4d
mov ecx, esi
call sub.msvcrt.dll__close
mov ecx, 0xfffffff4
call rdi
cmp rax, 0xffffffffffffffff
jne 0x1400b8c89
jmp 0x1400b8b4d
call fcn.1401be670
nop
nop word cs:[rax + rax]

Function at 0x1400b8cc0
Capabilities:
Enumerate processes
Initialize winsock library
Terminate process
Write file on windows

Disassembly:
sub rsp, 0x28
mov r8d, 0x294
lea rdx, str.compat_mingw.c
lea rcx, str.hide_dotfiles__HIDE_DOTFILES_DOTGITONLY
call qword [sym.imp.msvcrt.dll__assert]
nop
nop