joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001fe00
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x1400bdef0], 0
jne 0x14001ff03
mov byte [0x1400bdef0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x14001fed8
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.__acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x14001fec9
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x1400be171]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x1400b7f17
jmp 0x1400b7f0f
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x14001fe97
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
nop
jmp 0x1400b7f0a
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
nop
nop
nop

Function at 0x14007ebd0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x14007ec18
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14007ebea
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140091540
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140091568
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400915b0
cdqe
add rsi, rax
sub rbx, rax
jne 0x140091580
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400915bc
call rbp
cmp dword [rax], 4
je 0x140091580
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b7ea0
Capabilities:
Write file on windows

Disassembly:
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400b7f1c
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
call sym.abort
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x1400b7f0a

Function at 0x1400b9600
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x1400bb7a0]
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x1400bb7b8], 0
movups xmmword [0x1400bb7a8], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400b96b5
jmp 0x1400b975f
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400b9710
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x1400b96a0
cmp qword [rbx + 7], r12
jne 0x1400b96a0
cmp byte [rbx + 0xf], 0x2e
jne 0x1400b96a0
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x1400b96fb
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400b9705
cmp byte [rbx + rsi], 0x3d
je 0x1400b9795
add rbp, 0x18
cmp rbp, r13
jne 0x1400b96df
jmp 0x1400b96a0
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x1400bb7b8], rbx
jne 0x1400b976f
lea rcx, [sym.__tcf_0_3]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x1400bb7b8], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x1400bb7b0], rax
test rax, rax
je 0x1400b97cc
xor edx, edx
mov qword [0x1400bb7a8], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400b9747
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400b97bc
test dl, dl
jne 0x1400b96a0
test eax, eax
js 0x1400b96a0
mov dword [rbp + 0x10], eax
jmp 0x1400b96a0
xor ecx, ecx
mov qword [0x1400bb7b8], rcx
jmp 0x1400b9747
Function at 0x14000ccc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1402fc2c8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000cd93
cmp byte [rcx + 0x71], 0
je 0x14000cd93
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000cd8f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000cd54
sub eax, 1
je 0x14000cd58
cmp eax, 2
jne 0x14000cd8f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140120140
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000cd86
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000cd8f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000cd3c
xor al, al
jmp 0x14000cd3c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140120140
add rsp, 0x60
pop rbx
ret
Function at 0x14000e7d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402fc2c8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14000e7fd
xor eax, eax
jmp 0x14000e966
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000e83d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14000e83d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14000e95e
cmp qword [rdi + 0x80], 0
je 0x14000e959
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14000e877
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14000e8a2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000e95e
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000e911
sub eax, 1
je 0x14000e911
cmp eax, 2
jne 0x14000e959
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000e95e
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14000e93f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14000e959
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14000e95e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140120140
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000fac0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x14000faf1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14000fb0f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x14000fb59
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x14000fbd1
mov rcx, rbp
call fcn.14000d780
cmp rbx, 0xfff
jbe 0x14000fbb1
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14000fbf2
cmp rbx, rax
ja 0x14000fb80
test rdi, rdi
je 0x14000fbd1
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x14000fbd4
Function at 0x14000fc00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14000fc28
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14000fc9c
test rax, rax
jle 0x14000fc7c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14000fc9c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000fc9c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x140068eb0
Capabilities:
Inspect section memory permissions

Disassembly:
mov rax, qword [rcx]
cmp rax, 0x20000
jg 0x140068f55
je case.0x140068ef1.4
cmp rax, 0x100
jg 0x140068eff
je case.0x140068ef1.4
dec rax
cmp rax, 0x7f
ja case.0x140068ef1.3
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x69038]
mov ecx, dword [rdx + rax*4 + 0x69028]
add rcx, rdx
jmp rcx
mov eax, 0x20
ret
mov eax, 4
ret
cmp rax, 0x2000
jg 0x140068f33
je case.0x140068ef1.4
cmp rax, 0x200
je case.0x140068ef1.4
cmp rax, 0x400
je case.0x140068ef1.1
cmp rax, 0x800
je case.0x140068ef1.1
cmp rax, 0x1000
jne case.0x140068ef1.3
mov eax, 1
ret
cmp rax, 0x4000
je 0x140068fb3
cmp rax, 0x8000
je case.0x140068ef1.1
cmp rax, 0x10000
jne case.0x140068ef1.3
mov eax, 0x20
ret
cmp rax, 0x2080000
jg 0x140068fb9
je 0x140068fb3
cmp rax, 0x400000
jg 0x140068f97
je case.0x140068ef1.1
cmp rax, 0x40000
je 0x140068f2d
cmp rax, 0x80000
je 0x140068fb3
cmp rax, 0x100000
je case.0x140068ef1.1
cmp rax, 0x200000
jne case.0x140068ef1.3
mov eax, 0x20
ret
cmp rax, 0x800000
je case.0x140068ef1.4
cmp rax, 0x1000000
je 0x140068f2d
cmp rax, 0x2000000
jne case.0x140068ef1.3
mov eax, 2
ret
cmp rax, 0x40000000
jg 0x140068ff5
je case.0x140068ef1.1
cmp rax, 0x4000000
je case.0x140068ef1.1
cmp rax, 0x8000000
je case.0x140068ef1.32
cmp rax, 0x10000000
je case.0x140068ef1.4
cmp rax, 0x20000000
jne case.0x140068ef1.3
mov eax, 0x20
ret
mov ecx, 0x80000000
cmp rax, rcx
je case.0x140068ef1.32
movabs rcx, 0x100000000
cmp rax, rcx
je case.0x140068ef1.32
movabs rcx, 0x200000000
cmp rax, rcx
je case.0x140068ef1.32
xor eax, eax
ret
mov eax, 8
ret
Function at 0x140083cf0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402fc2c8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140082890
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 8
jb 0x140083d70
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140083d6b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140083d6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011fcb0
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140120140
add rsp, 0x50
pop rbx
ret
Function at 0x140089900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r14
sub rsp, 0x20
mov esi, dword [rcx + 0x44]
mov rbx, rcx
mov qword [rsp + 0x40], rdi
xor r12d, r12d
mov qword [rsp + 0x48], r15
nop word [rax + rax]
mov edx, dword [rbx + 0x94]
mov ebp, dword [rbx + 0x58]
sub ebp, dword [rbx + 0x9c]
mov ecx, dword [rbx + 0x44]
sub ebp, edx
add ecx, 0xfffffefa
add ecx, esi
cmp edx, ecx
jb 0x1400899e0
mov rcx, qword [rbx + 0x50]
mov r8, rsi
lea rdx, [rcx + rsi]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rbx + 0x74]
mov rax, qword [rbx + 0x68]
sub dword [rbx + 0x98], esi
sub dword [rbx + 0x94], esi
sub dword [rbx + 0x84], esi
lea rdx, [rax + r8*2]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
movzx eax, cx
sub ax, si
cmp ecx, esi
cmovb ax, r12w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x140089990
mov rax, qword [rbx + 0x60]
mov r8d, esi
lea rdx, [rax + rsi*2]
nop dword [rax]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
movzx eax, cx
sub ax, si
cmp ecx, esi
cmovb ax, r12w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x1400899c0
add ebp, esi
mov r14, qword [rbx]
mov ecx, dword [r14 + 8]
test ecx, ecx
je 0x140089abd
mov r15d, dword [rbx + 0x9c]
mov eax, dword [rbx + 0x94]
add r15, rax
add r15, qword [rbx + 0x50]
cmp ecx, ebp
cmovbe ebp, ecx
test ebp, ebp
jne 0x140089a11
mov ebp, r12d
jmp 0x140089a63
mov rax, qword [r14 + 0x28]
sub ecx, ebp
mov dword [r14 + 8], ecx
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x140089a34
mov rdx, qword [r14]
mov r8d, ebp
mov ecx, dword [r14 + 0x4c]
call fcn.140089e00
jmp 0x140089a48
cmp ecx, 2
jne 0x140089a4c
mov rdx, qword [r14]
mov r8d, ebp
mov ecx, dword [r14 + 0x4c]
call fcn.140087b40
mov dword [r14 + 0x4c], eax
mov rdx, qword [r14]
mov rcx, r15
mov r8d, ebp
mov edi, ebp
call sub.VCRUNTIME140.dll_memcpy
add qword [r14], rdi
add dword [r14 + 0xc], ebp
mov r9d, dword [rbx + 0x9c]
add r9d, ebp
mov dword [rbx + 0x9c], r9d
cmp r9d, 3
jb 0x140089aa7
mov eax, dword [rbx + 0x94]
mov rdx, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x7c]
mov dword [rbx + 0x70], r8d
cmp r9d, 0x106
jae 0x140089abd
mov rax, qword [rbx]
cmp dword [rax + 8], r12d
jne 0x140089930
mov r15, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
Function at 0x14008e980
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x24]
mov rbx, rcx
cmp eax, 0xca
jne 0x14008e9b6
call fcn.140093690
cmp byte [rbx + 0x58], 0
je 0x14008e9ad
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
jmp 0x14008e9c1
cmp eax, 0xcb
jne 0x14008ea45
mov rax, qword [rbx + 0x228]
cmp byte [rax + 0x20], 0
je 0x14008ea2c
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14008e9de
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x228]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x14008ea24
cmp eax, 2
je 0x14008ea2c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14008e9d0
dec eax
test eax, 0xfffffffd
jne 0x14008e9d0
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x14008e9d0
mov ecx, dword [rbx + 0x18c]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x14008e9d0
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp fcn.14008ea80
cmp eax, 0xcc
je 0x14008ea67
mov rax, qword [rcx]
mov dword [rax + 0x28], 0x18
mov rcx, qword [rcx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14008ea80

Function at 0x14008ea80
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor ebp, ebp
lea rsi, [rcx + 0x98]
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x14008eabc
mov rax, qword [rcx + 0x208]
call qword [rax]
mov dword [rsi], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x208]
mov qword [rsp + 0x30], rdi
cmp byte [rax + 0x10], bpl
je 0x14008eb40
nop
mov eax, dword [rsi]
cmp eax, dword [rbx + 0x78]
jae 0x14008eb18
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14008eaf6
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rax, qword [rbx + 0x210]
xor r9d, r9d
mov edi, dword [rsi]
mov r8, rsi
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rsi]
cmp eax, edi
je 0x14008eb6e
cmp eax, dword [rbx + 0x78]
jb 0x14008ead7
mov rax, qword [rbx + 0x208]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x208]
mov rcx, rbx
call qword [rax]
mov dword [rsi], ebp
mov rax, qword [rbx + 0x208]
cmp byte [rax + 0x10], bpl
jne 0x14008ead0
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x14008eb53
Function at 0x140092850
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov qword [rcx + 8], rsi
call fcn.1400392c0
mov edx, 0xa0
mov dword [rsp + 0x38], eax
mov rcx, rbx
call fcn.140093df0
mov rdi, rax
test rax, rax
jne 0x1400928a6
mov rcx, rbx
call fcn.14000a8f0
mov rcx, qword [rbx]
mov dword [rcx + 0x28], 0x3c
mov rcx, qword [rbx]
mov dword [rcx + 0x2c], esi
mov rcx, rbx
mov rdx, qword [rbx]
call qword [rdx]
mov dword [rdi + 0x64], 0x3b9aca00
lea rax, [fcn.140092570]
mov qword [rdi], rax
lea rcx, str.JPEGMEM
lea rax, [fcn.140092390]
mov qword [rdi + 8], rax
lea rax, [fcn.140092480]
mov qword [rdi + 0x10], rax
lea rax, [fcn.1400921b0]
mov qword [rdi + 0x18], rax
lea rax, [0x1400922a0]
mov qword [rdi + 0x20], rax
lea rax, [0x140092c50]
mov qword [rdi + 0x28], rax
lea rax, [0x140092ba0]
mov qword [rdi + 0x30], rax
lea rax, [0x1400929d0]
mov qword [rdi + 0x38], rax
lea rax, [0x140091f50]
mov qword [rdi + 0x40], rax
lea rax, [0x140091ce0]
mov qword [rdi + 0x48], rax
lea rax, [0x140092700]
mov qword [rdi + 0x50], rax
lea rax, [0x140092d00]
mov qword [rdi + 0x58], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x60], eax
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x90], rsi
mov dword [rdi + 0x98], 0xa0
mov qword [rbx + 8], rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400929bc
lea r9, [rsp + 0x30]
mov byte [rsp + 0x30], 0x78
lea r8, [rsp + 0x38]
mov rcx, rax
lea rdx, str._ld_c
call fcn.140024d90
test eax, eax
jle 0x1400929bc
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x1400929af
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x1400929b3
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rdi + 0x60], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret