joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff9b9d71dc0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x7ff9b9d71df0
xor eax, eax
jmp 0x7ff9b9d71eb3
mov rbp, rbx
cmp word [rax], si
je 0x7ff9b9d71e15
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x7ff9b9d71dfc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x7ff9b9d71df8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.7ff9b9d6db74
movsxd r14, eax
test eax, eax
jne 0x7ff9b9d71e53
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x7ff9b9d71de9
mov rcx, r14
call fcn.7ff9b9d67950
mov rdi, rax
test rax, rax
jne 0x7ff9b9d71e6c
xor ecx, ecx
call fcn.7ff9b9d67914
jmp 0x7ff9b9d71e48
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.7ff9b9d6db74
test eax, eax
jne 0x7ff9b9d71e9d
mov rcx, rdi
call fcn.7ff9b9d67914
jmp 0x7ff9b9d71ea7
xor ecx, ecx
call fcn.7ff9b9d67914
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x7ff9b9d71ed0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x7ff9b9d71f57
mov rsi, rbx
cmp word [rax], bp
je 0x7ff9b9d71f16
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x7ff9b9d71f00
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x7ff9b9d71efc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.7ff9b9d67950
mov rdi, rax
test rax, rax
je 0x7ff9b9d71f44
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.7ff9b9d7f070
mov rbp, rdi
xor ecx, ecx
call fcn.7ff9b9d67914
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff9b9d72a10
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x7ff9b9d72a30
call qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.7ff9b9d5d828
or eax, 0xffffffff
jmp 0x7ff9b9d72a32
xor eax, eax
add rsp, 0x28
ret
Function at 0x7ff9b9d77990
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x7ff9b9dc6200]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x7ff9b9d779da
call fcn.7ff9b9d5d894
mov dword [rax], 0xf
call fcn.7ff9b9d5d8b4
mov dword [rax], 0xd
call fcn.7ff9b9d55168
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.7ff9b9d49770
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x7ff9b9d779e5
lea eax, [rbx + 1]
jmp 0x7ff9b9d779c7
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.kernel32.dll_GetDriveTypeW]
test eax, eax
je 0x7ff9b9d779c5
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x7ff9b9d779c7

Function at 0x7ff9b9d79480
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp edx, 3
je fcn.7ff9b9d7b2a0
ret

Function at 0x7ff9b9d7b2a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x7ff9b9d7b380
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x7ff9b9dc6e50]
cmp ecx, 0xffffffff
jne 0x7ff9b9d7b39e
xor esi, esi
jmp 0x7ff9b9d7b3a7
call qword [sym.imp.kernel32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x7ff9b9d7b48b
cmp qword [rsi + 0x30], 0
jne 0x7ff9b9d7b3c7
cmp qword [rsi + 0x18], 0
je 0x7ff9b9d7b464
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x7ff9b9d7b424
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff9b9d7b407
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.kernel32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
call qword [sym.imp.kernel32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x7ff9b9d7b3d0
cmp qword [rsi + 0x30], 0
je 0x7ff9b9d7b3bc
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x7ff9b9d7b44c
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x7ff9b9d7b44c
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.7ff9b9d7a760
cmp qword [rsi + 0x30], 0
jne 0x7ff9b9d7b430
jmp 0x7ff9b9d7b3b5
lea rdx, [0x7ff9b9d7b0c0]
lea rcx, [0x7ff9b9e87f18]
call fcn.7ff9b9d7ac60
mov ecx, dword [0x7ff9b9dc6e50]
cmp ecx, 0xffffffff
je 0x7ff9b9d7b48b
xor edx, edx
call qword [sym.imp.kernel32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x7ff9b9d7b4bd
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x7ff9b9d7b4bd
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.kernel32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff9b9d7b590
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff9b9d7b5b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x7ff9b9d7b5b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x1400415e0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1400415f0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call sym._amsg_exit
jmp 0x14000123c
mov rax, qword [0x1400415f0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1400415f0]
mov dword [rax], 1
mov rax, qword [0x140041640]
mov rdx, rax
mov rax, qword [0x140041630]
mov rcx, rax
call sym._initterm
jmp 0x14000123c
mov dword [0x14004a024], 1
mov rax, qword [0x1400415f0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x140041620]
mov rdx, rax
mov rax, qword [0x140041610]
mov rcx, rax
call sym._initterm
mov rax, qword [0x1400415f0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x1400415e0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x140041500]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x140041500]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call sym._pei386_runtime_relocator
mov rax, qword [sym._gnu_exception_handler]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x1400415d0]
mov qword [rdx], rax
lea rax, [sym.__mingw_invalidParameterHandler]
mov rcx, rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov eax, dword [0x14004a004]
lea rdx, [0x14004a008]
mov ecx, eax
call sym.duplicate_ppstrings
call sym.__main
mov rax, qword [0x140041560]
mov rax, qword [rax]
mov rdx, qword [0x14004a010]
mov qword [rax], rdx
mov rcx, qword [0x14004a010]
mov rdx, qword [0x14004a008]
mov eax, dword [0x14004a004]
mov r8, rcx
mov ecx, eax
call sym.main
mov dword [0x14004a01c], eax
mov eax, dword [0x14004a020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14004a01c]
mov ecx, eax
call sym.exit
mov eax, dword [0x14004a024]
test eax, eax
jne 0x14000136c
call sym._cexit
mov eax, dword [0x14004a01c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140041590]
mov dword [rax], 1
mov rax, qword [0x1400415a0]
mov dword [rax], 1
mov rax, qword [0x1400415b0]
mov dword [rax], 1
mov rax, qword [0x140041550]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140009886
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x1400098b6
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen_2
mov rcx, rax
jmp 0x1400098bb
mov ecx, 0
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
mov r9, rdx
mov r8, rcx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400098f7
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, str.raiseOutOfMem
mov qword [rbp - 0x28], rax
lea rax, str.C:_nimlib_systemmmdisp.nim
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], 0
mov word [rbp - 0x10], 0
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.nimFrame_7
mov qword [rbp - 0x20], 0x2f
mov rax, qword [0x14004a0d0]
test rax, rax
je 0x14000994e
mov rax, qword [0x14004a0d0]
call rax
jmp 0x14000994f
nop
mov qword [rbp - 0x20], 0x30
mov ecx, 2
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.out_of_memory_n
mov rdx, rax
call sym.rawWrite
mov qword [rbp - 0x20], 0x31
mov ecx, 1
call sym.exit
nop
Function at 0x14000a8c1
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.osDeallocPages
mov qword [rbp - 0x38], rax
lea rax, str.C:_nimlib_systemosalloc.nim
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x30], 0
mov word [rbp - 0x20], 0
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.nimFrame_7
mov qword [rbp - 0x30], 0xbe
mov dword [rbp - 4], 0
mov rax, qword [rbp + 0x10]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x14000a967
mov qword [rbp - 0x30], 0xbf
mov dword [rbp - 8], 0
lea rax, str.virtualFree_failing_
mov rcx, rax
call sym.printf
mov dword [rbp - 8], eax
mov qword [rbp - 0x30], 0xc0
mov ecx, 1
call sym.exit
nop
call sym.popFrame_7
nop
add rsp, 0x60
pop rbp
ret

Function at 0x140010ab9
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
call sym.nimErrorFlag_5
mov qword [rbp - 8], rax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
call sym.writeStackTrace__system_u2556
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rax, [rbp - 0x30]
mov edx, 0x7d0
mov rcx, rax
call sym.dollar___systemZdollars_u8
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x140010beb
mov rax, qword [rbp - 0x30]
lea rdx, [rax + 0xa7]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.rawNewString
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [0x14003de20]
mov rdx, qword [0x14003de28]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.appendString_1
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.appendString_1
mov rax, qword [0x14003dec0]
mov rdx, qword [0x14003dec8]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.appendString_1
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.showErrorMessage2__system_u3965
mov ecx, 1
call sym.exit
nop
nop
add rsp, 0x70
pop rbp
ret
Function at 0x14001282d
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp + 0x10], ecx
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
lea rax, [rbp - 0x20]
mov edx, 0x7d0
mov rcx, rax
call sym.rawNewString
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.rawWriteStackTrace__system_u4329
cmp dword [rbp + 0x10], 2
jne 0x1400128b7
lea rax, [rbp - 0x10]
mov edx, 0x1f
mov rcx, rax
call sym.prepareAdd
mov rax, qword [0x14003df10]
mov rdx, qword [0x14003df18]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.appendString_1
jmp 0x1400129f6
nop
cmp dword [rbp + 0x10], 0xb
jne 0x1400128fa
lea rax, [rbp - 0x10]
mov edx, 0x3d
mov rcx, rax
call sym.prepareAdd
mov rax, qword [0x14003df70]
mov rdx, qword [0x14003df78]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.appendString_1
jmp 0x1400129f6
nop
cmp dword [rbp + 0x10], 0x16
jne 0x14001293d
lea rax, [rbp - 0x10]
mov edx, 0x1f
mov rcx, rax
call sym.prepareAdd
mov rax, qword [0x14003dfb0]
mov rdx, qword [0x14003dfb8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.appendString_1
jmp 0x1400129f6
nop
cmp dword [rbp + 0x10], 8
jne 0x14001297d
lea rax, [rbp - 0x10]
mov edx, 0x1a
mov rcx, rax
call sym.prepareAdd
mov rax, qword [0x14003dff0]
mov rdx, qword [0x14003dff8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.appendString_1
jmp 0x1400129f6
nop
cmp dword [rbp + 0x10], 4
jne 0x1400129bd
lea rax, [rbp - 0x10]
mov edx, 0x1b
mov rcx, rax
call sym.prepareAdd
mov rax, qword [0x14003e030]
mov rdx, qword [0x14003e038]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.appendString_1
jmp 0x1400129f6
nop
nop
lea rax, [rbp - 0x10]
mov edx, 0xf
mov rcx, rax
call sym.prepareAdd
mov rax, qword [0x14003e0c0]
mov rdx, qword [0x14003e0c8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.appendString_1
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.showErrorMessage2__system_u3965
mov ecx, 1
call sym.exit
nop
Function at 0x140012b8f
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov rbx, rcx
mov rax, qword [rbx]
mov rdx, qword [rbx + 8]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov ecx, 2
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.could_not_load:
mov rdx, rax
call sym.rawWrite
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimToCStringConv_1
mov rbx, rax
mov ecx, 2
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rdx, rbx
mov rcx, rax
call sym.rawWrite
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x3c8], eax
cmp dword [rbp + 0x3c8], 0xc1
jne 0x140012c47
mov ecx, 2
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rcx, rax
lea rax, str._n_bad_format__library_may_be_wrong_architecture_
mov rdx, rax
call sym.rawWrite
jmp 0x140012c48
nop
lea rax, [rbp - 0x40]
mov edx, 0x3e8
mov rcx, rax
call sym.nimZeroMem_1
mov qword [rbp + 0x3c0], 0x3e7
mov qword [rbp + 0x3b8], 0
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x3b8]
add rax, rdx
mov r8d, 0x10
lea rdx, str.could_not_load:
mov rcx, rax
call sym.copyMem__system_u1745_2
sub qword [rbp + 0x3c0], 0x10
add qword [rbp + 0x3b8], 0x10
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp + 0x3c0]
cmp rdx, rax
cmovle rax, rdx
mov qword [rbp + 0x3b0], rax
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimToCStringConv_1
mov rdx, rax
lea rcx, [rbp - 0x40]
mov rax, qword [rbp + 0x3b8]
add rax, rcx
mov rcx, qword [rbp + 0x3b0]
mov r8, rcx
mov rcx, rax
call sym.copyMem__system_u1745_2
mov rax, qword [rbp + 0x3b0]
sub qword [rbp + 0x3c0], rax
mov rax, qword [rbp + 0x3b0]
add qword [rbp + 0x3b8], rax
mov byte [rbp + 0x3cf], 0
cmp dword [rbp + 0x3c8], 0xc1
sete al
mov byte [rbp + 0x3cf], al
movzx eax, byte [rbp + 0x3cf]
xor eax, 1
test al, al
jne 0x140012d51
cmp qword [rbp + 0x3c0], 0x2f
setg al
mov byte [rbp + 0x3cf], al
jmp 0x140012d52
nop
movzx eax, byte [rbp + 0x3cf]
xor eax, 1
test al, al
jne 0x140012d85
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x3b8]
add rax, rdx
mov r8d, 0x30
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call sym.copyMem__system_u1745_2
jmp 0x140012d86
nop
mov dword [rbp + 0x3ac], 0
lea rax, [rbp - 0x40]
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov dword [rbp + 0x3ac], eax
mov ecx, 2
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rcx, rax
lea rax, [0x14003ea39]
mov rdx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
Function at 0x140012e63
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov ecx, 2
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.could_not_import:
mov rdx, rax
call sym.rawWrite
mov ecx, 2
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x10]
mov rdx, rax
call sym.rawWrite
mov ecx, 2
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rcx, rax
lea rax, [0x14003ea39]
mov rdx, rax
call sym.rawWrite
mov ecx, 1
call sym.exit
nop
Function at 0x140014afc
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x58], rax
lea rax, [0x14003e466]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov word [rbp - 0x40], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.nimFrame_7
call sym.nimErrorFlag_5
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], 0xac5
lea rax, [0x14004a100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x50], 0xd
lea rax, [0x14003eaa0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x50], 0xe
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jge 0x140014c89
mov qword [rbp - 0x50], 0xac6
lea rax, [0x14003e466]
mov qword [rbp - 0x48], rax
cmp qword [rbp - 8], 0
js 0x140014bc0
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jl 0x140014bd9
mov rax, qword [rbp + 0x18]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2
jmp 0x140014d1a
mov rax, qword [rbp - 8]
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov ecx, 1
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdx
lea rax, [rbp - 0x80]
mov r8d, 0
mov rdx, rax
call sym.writeWindows__system_u9096
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
movzx eax, al
test eax, eax
jne 0x140014d19
mov qword [rbp - 0x50], 0x10
lea rax, [0x14003eaa0]
mov qword [rbp - 0x48], rax
mov ecx, 0
mov rax, qword [rbp - 8]
add rax, 1
jno 0x140014c5e
mov ecx, 1
mov rdx, rax
lea rax, [rbp - 0x68]
mov qword [rax], rdx
mov rax, rcx
and eax, 1
test al, al
je 0x140014c7c
call sym.raiseOverflow
jmp 0x140014d1a
mov rax, qword [rbp - 0x68]
mov qword [rbp - 8], rax
jmp 0x140014b8e
nop
mov qword [rbp - 0x50], 0xae1
lea rax, [0x14003e466]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x20], 0
mov ecx, 1
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rax, [0x14003ea39]
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], 0xae2
mov dword [rbp - 0x24], 0
mov ecx, 1
mov rax, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov dword [rbp - 0x24], eax
mov qword [rbp - 0x50], 0xae6
lea rax, [0x14004a100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140014d1a
nop
call sym.popFrame_7
nop
add rsp, 0xa0
pop rbp
ret
Function at 0x14001552b
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov byte [rbp - 1], 0
lea rax, [0x14003c280]
mov rcx, rax
call sym.__emutls_get_address
movzx eax, byte [rax]
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
xor eax, 1
test al, al
jne 0x140015577
lea rax, [0x14003c380]
mov rcx, rax
call sym.__emutls_get_address
mov rax, qword [rax]
test rax, rax
setne al
mov byte [rbp - 1], al
jmp 0x140015578
nop
movzx eax, byte [rbp - 1]
xor eax, 1
test al, al
jne 0x1400155b7
lea rax, [0x14003c380]
mov rcx, rax
call sym.__emutls_get_address
mov rbx, rax
mov rax, qword [rbx]
mov rcx, rax
call sym.reportUnhandledError__system_u4357
mov edx, 0
mov rcx, rbx
call sym.eqsink___stdZtypedthreads_u179
mov ecx, 1
call sym.exit
nop
nop
add rsp, 0x38
pop rbx
pop rbp
ret