joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a5c5
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x118
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], rcx
mov rax, rbp
lea rdx, [sym.map_free_string]
mov qword [rsp + 0x30], rdx
lea rdx, [sym.map_clone_string]
mov qword [rsp + 0x28], rdx
lea rdx, [sym.map_eq_string]
mov qword [rsp + 0x20], rdx
lea r9, [sym.map_hash_string]
mov r8d, 0x10
mov edx, 0x10
mov rcx, rax
call sym.new_map
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call rax
mov qword [rbp + 0x80], rax
lea rax, [0x140088256]
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], 0
mov dword [rbp - 4], 1
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x88], rax
jmp 0x14005a719
lea rax, [rbp - 0x10]
mov rdx, qword [rbp + 0x88]
mov rcx, rax
call sym.string_from_wide
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
lea rax, [rbp - 0x40]
mov edx, 0x3d
mov rcx, rax
call sym.string_index_u8
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0
jle 0x14005a706
mov eax, dword [rbp + 0x7c]
lea r8d, [rax + 1]
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
lea rax, [rbp - 0x40]
mov r9d, 0x7fffffff
mov rdx, rax
call sym.string_substr
lea rcx, [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov edx, dword [rbp + 0x7c]
lea rax, [rbp - 0x40]
mov r9d, edx
mov r8d, 0
mov rdx, rax
call sym.string_substr
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x20]
mov rax, rbp
mov r8, rcx
mov rcx, rax
call sym.map_set
mov eax, dword [rbp - 8]
cdqe
add rax, 1
add rax, rax
add qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
movzx eax, word [rax]
test ax, ax
jne 0x14005a65a
mov rax, qword [rbp + 0x80]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
call rax
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rbp]
mov rbx, qword [rbp + 8]
mov qword [rax], rcx
mov qword [rax + 8], rbx
mov rcx, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x18]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rbx
mov rcx, qword [rbp + 0x20]
mov rbx, qword [rbp + 0x28]
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rbx
mov rcx, qword [rbp + 0x30]
mov rbx, qword [rbp + 0x38]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rbx
mov rcx, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x48]
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], rbx
mov rcx, qword [rbp + 0x50]
mov rbx, qword [rbp + 0x58]
mov qword [rax + 0x50], rcx
mov qword [rax + 0x58], rbx
mov rcx, qword [rbp + 0x60]
mov rbx, qword [rbp + 0x68]
mov qword [rax + 0x60], rcx
mov qword [rax + 0x68], rbx
mov rdx, qword [rbp + 0x70]
mov qword [rax + 0x70], rdx
mov rax, qword [rbp + 0xb0]
add rsp, 0x118
pop rbx
pop rbp
ret
Function at 0x14005a970
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov dword [rbp + 0x20], r8d
cmp dword [rbp + 0x18], 0xffffffff
jne 0x14005a9c0
mov rax, qword [rbp + 0x10]
lea rdx, [0x140088256]
mov qword [rax], rdx
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 1
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x10], 0
jmp 0x14005aa70
mov eax, dword [rbp + 0x20]
add eax, 1
cdqe
mov rcx, rax
call sym.malloc_noscan
mov qword [rbp - 8], rax
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp - 8]
mov eax, dword [rbp + 0x18]
mov r8d, ecx
mov ecx, eax
call sym.read
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jns 0x14005aa2d
mov rax, qword [rbp - 8]
mov rcx, rax
call sym._v_free
mov rax, qword [rbp + 0x10]
lea rdx, [0x140088256]
mov qword [rax], rdx
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 1
mov rax, qword [rbp + 0x10]
mov edx, dword [rbp - 0xc]
mov dword [rax + 0x10], edx
jmp 0x14005aa70
mov eax, dword [rbp - 0xc]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov byte [rax], 0
lea rax, [rbp - 0x20]
mov ecx, dword [rbp - 0xc]
mov rdx, qword [rbp - 8]
mov r8d, ecx
mov rcx, rax
call sym.tos
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp + 0x10]
mov edx, dword [rbp - 0xc]
mov dword [rax + 0x10], edx
mov rax, qword [rbp + 0x10]
add rsp, 0xc0
pop rbp
ret

Function at 0x14005aa7d
Capabilities:
Get socket status

Disassembly:
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x400], ecx
lea rdx, [rbp + 0x1d0]
mov eax, 0
mov ecx, 0x41
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x1d0], 0
mov dword [rbp + 0x3dc], 0
jmp 0x14005aae3
mov eax, dword [rbp + 0x3dc]
mov rdx, qword [rbp + rax*8 + 0x1d8]
mov eax, dword [rbp + 0x400]
cdqe
cmp rdx, rax
je 0x14005aaf1
add dword [rbp + 0x3dc], 1
mov eax, dword [rbp + 0x1d0]
cmp dword [rbp + 0x3dc], eax
jb 0x14005aac1
mov eax, dword [rbp + 0x1d0]
cmp dword [rbp + 0x3dc], eax
jne 0x14005ab30
mov eax, dword [rbp + 0x1d0]
cmp eax, 0x3f
ja 0x14005ab30
mov eax, dword [rbp + 0x400]
movsxd rdx, eax
mov eax, dword [rbp + 0x3dc]
mov qword [rbp + rax*8 + 0x1d8], rdx
mov eax, dword [rbp + 0x1d0]
add eax, 1
mov dword [rbp + 0x1d0], eax
mov dword [rbp - 0x48], 0
mov dword [rbp - 0x44], 0
mov eax, dword [rbp + 0x400]
lea ecx, [rax + 1]
lea rax, [rbp + 0x1d0]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_select]
call rax
mov dword [rbp + 0x3d8], eax
cmp dword [rbp + 0x3d8], 0
jle 0x14005aba0
mov eax, dword [rbp + 0x400]
cdqe
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call sym.__WSAFDIsSet
test eax, eax
je 0x14005aba0
mov eax, 1
jmp 0x14005aba5
mov eax, 0
add rsp, 0x468
pop rdi
pop rbp
ret
Function at 0x14005b73e
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x20]
mov eax, dword [rax + 0xc]
test eax, eax
jne 0x14005b7af
lea rax, [rbp - 0x64]
mov edx, 0
mov rcx, rax
call sym.memdup
mov rdx, rax
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.I_os__Eof_to_Interface_IError
mov rax, qword [rbp + 0x10]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x10]
mov byte [rax], 1
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005b907
mov rax, qword [rbp + 0x18]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x20]
mov eax, dword [rax + 0xc]
movsxd rdx, eax
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jg 0x14005b8c8
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov rcx, rax
call sym.feof
test eax, eax
je 0x14005b849
lea rax, [rbp - 0x64]
mov edx, 0
mov rcx, rax
call sym.memdup
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.I_os__Eof_to_Interface_IError
mov rax, qword [rbp + 0x10]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x10]
mov byte [rax], 1
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005b907
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov rcx, rax
call sym.ferror
test eax, eax
je 0x14005b8c8
lea rax, str.unexpected_error_from_fread
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], 0x1b
mov dword [rbp - 0x74], 1
mov dword [rbp - 0x70], 0xffffffff
lea rax, [rbp - 0x80]
mov edx, 0x18
mov rcx, rax
call sym.memdup
mov rdx, rax
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.I_os__NotExpected_to_Interface_IError
mov rax, qword [rbp + 0x10]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x10]
mov byte [rax], 1
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005b907
mov eax, dword [rbp - 4]
mov dword [rbp - 0x64], eax
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x64]
mov r8d, 4
mov rcx, rax
call sym._result_ok
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
mov rax, qword [rbp + 0x10]
add rsp, 0xc0
pop rbp
ret
Function at 0x14005b914
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xb0]
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov rbx, r8
mov rax, qword [rbp + 0x38]
movzx eax, byte [rax + 0xc]
test al, al
jne 0x14005b979
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.os__error_file_not_opened
mov rax, qword [rbp + 0x30]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x30]
mov byte [rax], 1
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005ba73
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax]
mov eax, dword [rbx + 0xc]
movsxd rdx, eax
mov rax, qword [rbx]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x14005ba34
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14005ba34
lea rsi, str.0_bytes_written
mov rdx, rdi
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 0xf
mov rdi, rax
mov rax, rdi
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov rdi, rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x90], rsi
mov qword [rbp - 0x88], rdi
lea rdx, [rbp - 0x90]
mov rcx, rax
call sym._v_error
mov rax, qword [rbp + 0x30]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x30]
mov byte [rax], 1
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005ba73
mov eax, dword [rbp - 4]
mov dword [rbp - 0x54], eax
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x54]
mov r8d, 4
mov rcx, rax
call sym._result_ok
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
mov rax, qword [rbp + 0x30]
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14005bd68
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0xc0]
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], r8
mov rbx, r9
mov rax, qword [rbp + 0x38]
movzx eax, byte [rax + 0xc]
test al, al
jne 0x14005bdd1
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.os__error_file_not_opened
mov rax, qword [rbp + 0x30]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x30]
mov byte [rax], 1
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005bf0f
mov rdx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov r8d, 0
mov rcx, rax
mov rax, qword [dbg._fseeki64]
call rax
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax]
mov eax, dword [rbx + 0xc]
movsxd rdx, eax
mov rax, qword [rbx]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x14005bea9
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14005bea9
lea rsi, str.0_bytes_written
mov rdx, rdi
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 0xf
mov rdi, rax
mov rax, rdi
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov rdi, rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0xa0], rsi
mov qword [rbp - 0x98], rdi
lea rdx, [rbp - 0xa0]
mov rcx, rax
call sym._v_error
mov rax, qword [rbp + 0x30]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x30]
mov byte [rax], 1
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005bf0f
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov r8d, 2
mov edx, 0
mov rcx, rax
mov rax, qword [dbg._fseeki64]
call rax
mov eax, dword [rbp - 4]
mov dword [rbp - 0x64], eax
lea rdx, [rbp - 0x90]
lea rax, [rbp - 0x64]
mov r8d, 4
mov rcx, rax
call sym._result_ok
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp - 0x90]
mov rdx, qword [rbp - 0x88]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
mov rax, qword [rbp + 0x30]
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14005bf1f
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
mov eax, dword [rbp + 0x20]
movsxd rdx, eax
mov rax, qword [rbp + 0x18]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14005bf63
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0xb0
lea rbp, [rsp + 0xb0]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
cmp qword [rbp + 0x38], 0
jne 0x14005bfa0
mov rax, qword [rbp + 0x20]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
jmp 0x14005c0cf
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax + 0xc]
test al, al
jne 0x14005bfe7
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.os__error_file_not_opened
mov rax, qword [rbp + 0x20]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x20]
mov byte [rax], 1
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005c0cf
mov rax, qword [rbp + 0x30]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jle 0x14005c0bf
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
add qword [rbp - 8], rax
mov rax, qword [rbp - 0x18]
sub qword [rbp - 0x10], rax
cmp qword [rbp - 0x18], 0
jg 0x14005bff7
lea rsi, str.C.fwrite_returned_0
mov rdx, rdi
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 0x13
mov rdi, rax
mov rax, rdi
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov rdi, rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x90], rsi
mov qword [rbp - 0x88], rdi
lea rdx, [rbp - 0x90]
mov rcx, rax
call sym._v_error
mov rax, qword [rbp + 0x20]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x20]
mov byte [rax], 1
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005c0cf
nop
mov rax, qword [rbp + 0x20]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x20]
add rsp, 0xb0
pop rsi
pop rdi
pop rbp
ret

Function at 0x14005c0de
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, 0
mov rcx, rax
mov rax, qword [dbg._fseeki64]
call rax
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
mov eax, dword [rbp + 0x20]
movsxd rdx, eax
mov rax, qword [rbp + 0x18]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov dword [rbp - 4], eax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov r8d, 2
mov edx, 0
mov rcx, rax
mov rax, qword [dbg._fseeki64]
call rax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret
Function at 0x14005c161
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0xb0
lea rbp, [rsp + 0xb0]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov dword [rbp + 0x30], r8d
mov dword [rbp + 0x38], r9d
mov eax, dword [rbp + 0x38]
movsxd rcx, eax
mov eax, dword [rbp + 0x30]
movsxd rdx, eax
mov r8, qword [rbp + 0x40]
mov rax, qword [rbp + 0x28]
mov r9, r8
mov r8, rcx
mov rcx, rax
call sym.fread
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jg 0x14005c2a5
mov rax, qword [rbp + 0x40]
mov rcx, rax
call sym.feof
test eax, eax
je 0x14005c211
lea rax, [rbp - 0x54]
mov edx, 0
mov rcx, rax
call sym.memdup
mov rdx, rax
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.I_os__Eof_to_Interface_IError
mov rax, qword [rbp + 0x20]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x20]
mov byte [rax], 1
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005c2e4
mov rax, qword [rbp + 0x40]
mov rcx, rax
call sym.ferror
test eax, eax
je 0x14005c2a5
lea rsi, str.file_read_error
mov rdx, rdi
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 0xf
mov rdi, rax
mov rax, rdi
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov rdi, rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x90], rsi
mov qword [rbp - 0x88], rdi
lea rdx, [rbp - 0x90]
mov rcx, rax
call sym._v_error
mov rax, qword [rbp + 0x20]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x20]
mov byte [rax], 1
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14005c2e4
mov eax, dword [rbp - 4]
mov dword [rbp - 0x54], eax
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x54]
mov r8d, 4
mov rcx, rax
call sym._result_ok
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
mov rax, qword [rbp + 0x20]
add rsp, 0xb0
pop rsi
pop rdi
pop rbp
ret
Function at 0x14006113b
Capabilities:
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xb0]
mov rbx, rcx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
mov dword [rbp - 4], 0
mov eax, dword [rbp - 0x78]
cmp eax, 1
jle 0x14006124c
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
lea rax, [rbp - 0x90]
mov edx, 0
mov rcx, rax
call sym.string_at
cmp al, 0x22
jne 0x14006124c
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
lea rax, [rbp - 0x90]
mov edx, 1
mov rcx, rax
call sym.string_at
cmp al, 0x22
je 0x14006124c
pxor xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
lea rax, [0x140088edb]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 1
mov dword [rbp - 0x64], 1
mov dword [rbp - 0x60], 0xfe10
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rdx
lea rax, [0x140088edb]
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], 1
mov dword [rbp - 0x3c], 1
lea rax, [rbp - 0x20]
lea rdx, [rbp - 0x70]
mov r8, rdx
mov edx, 2
mov rcx, rax
call sym.str_intp
jmp 0x14006125c
mov rax, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
call sym.flush_stdout
call sym.flush_stderr
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
lea rax, [rbp - 0x90]
mov rcx, rax
call sym.string_to_wide
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wsystem]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0xffffffff
jne 0x1400612a5
call sym.os__print_c_errno
mov eax, dword [rbp - 4]
add rsp, 0xb8
pop rbx
pop rbp
ret
Function at 0x1400617d8
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], rcx
mov rbx, rdx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov dword [rbp + 0xbc], 0
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.string_to_wide
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wremove]
call rax
mov dword [rbp + 0xbc], eax
cmp dword [rbp + 0xbc], 0xffffffff
jne 0x14006198d
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov edx, dword [rax]
lea rax, [rbp + 0x80]
mov rcx, rax
call sym.os__posix_get_error_msg
pxor xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
lea rax, str.Failed_to_remove__
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], 0x12
mov dword [rbp - 4], 1
mov dword [rbp], 0xfe10
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rdx
lea rax, [0x14008a201]
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], 3
mov dword [rbp + 0x24], 1
lea rax, [rbp + 0x90]
lea rdx, [rbp - 0x10]
mov r8, rdx
mov edx, 2
mov rcx, rax
call sym.str_intp
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x98]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x88]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
lea rdx, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov r8, rdx
mov rdx, rax
call sym.string__plus
mov dword [rbp + 0x50], 0x7efefefe
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov rax, qword [rbp + 0x50]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x60]
mov rdx, rax
call sym.os__error_posix
mov rax, qword [rbp + 0xe0]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0xe0]
mov byte [rax], 1
mov rcx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa8]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
jmp 0x14006199f
mov rax, qword [rbp + 0xe0]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [rbp + 0xe0]
add rsp, 0x148
pop rbx
pop rbp
ret