joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9e70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x140255c24]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400a9ee0
xor edx, edx
mov ecx, dword [0x140255c24]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx]
call fcn.1400eaf30
mov rcx, qword [rbx + 8]
call fcn.1400eaf30
mov rcx, rbx
call fcn.1400eaf30
lea rcx, [0x140255c40]
mov qword [0x140255c70], 0
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [0x140255c24]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsFree]
call fcn.14009fcb0
lea rcx, [0x1401ff254]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
call fcn.1400a9880
mov rbx, rax
jmp 0x1400a9e89
Function at 0x1400ad050
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rax, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
mov r14d, dword [rsp + 0xd8]
mov rdi, rdx
mov rsi, r9
mov edx, dword [rsp + 0xd0]
test rax, rax
je 0x1400ad220
mov r13, qword [rax]
test r13, r13
je 0x1400ad220
movsx ebx, cl
test edx, edx
je 0x1400ad110
mov rbp, qword [fcn.1401de8b0]
mov ecx, 1
test rsi, rsi
je 0x1400ad230
call rbp
mov qword [rsp + 0x20], r13
lea r9, [rsi + 0xb0]
mov r8d, ebx
mov rcx, rax
lea rdx, str._c_t_s:_s_t
call sub.libintl_8.dll_libintl_fprintf
mov ecx, 1
test r12, r12
je 0x1400ad255
call rbp
mov r9, r12
mov r8, rdi
lea rdx, str._s___s__n
mov rcx, rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.libintl_8.dll_libintl_fprintf
mov eax, dword [r8 + 0x94]
cmp eax, 1
jbe 0x1400ad125
cmp eax, 0xa
jne 0x1400ad280
mov r8, qword [r8]
test r8, r8
jne 0x1400ad110
lea r15, [0x1401ff650]
mov qword [rsp + 0x48], r15
mov ecx, 2
mov rbp, qword [fcn.1401de8b0]
call rbp
mov qword [rsp + 0x30], r15
mov r8, qword [rsp + 0x48]
mov r9d, ebx
mov qword [rsp + 0x28], rdi
mov rcx, rax
lea rdx, str.__s_c___s_s
mov dword [rsp + 0x20], r14d
call sub.libintl_8.dll_libintl_fprintf
test rsi, rsi
je 0x1400ad2d0
mov rcx, r13
call fcn.140059d70
lea rcx, [rsi + 0xb0]
mov rdi, rax
call fcn.140059d70
mov ecx, 2
mov rbx, rax
call rbp
mov r9, rdi
mov r8, rbx
lea rdx, str._s_____s
mov rcx, rax
call sub.libintl_8.dll_libintl_fprintf
test r12, r12
je 0x1400ad1f8
mov ecx, 2
call rbp
mov r8d, 2
mov edx, 1
lea rcx, [0x1401ff687]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rbp
mov rcx, r12
mov rdx, rax
call fcn.1401deb18
mov ecx, 2
call rbp
mov ecx, 0x29
mov rdx, rax
call sub.msvcrt.dll_fputc
mov ecx, 2
call rbp
mov ecx, 0xa
mov rdx, rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.msvcrt.dll_fputc
lea r13, [r8 + 0xb0]
jmp 0x1400ad09a
call rbp
mov r9, r13
mov r8d, ebx
lea rdx, str._c_t:_s_t
mov rcx, rax
call sub.libintl_8.dll_libintl_fprintf
mov ecx, 1
test r12, r12
jne 0x1400ad0e4
call rbp
mov r8, rdi
lea rdx, [0x1401ff66c]
mov rcx, rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.libintl_8.dll_libintl_fprintf
mov edx, dword [0x1401e1ad8]
mov ecx, 2
lea rbp, [0x1401ff650]
lea r15, [0x1401e1a8b]
call fcn.140105780
mov edx, dword [0x1401e1ad8]
mov ecx, 2
test eax, eax
cmove r15, rbp
mov qword [rsp + 0x48], r15
mov r15, rbp
call fcn.140105780
lea rdx, [0x1401e1a40]
test eax, eax
cmovne r15, rdx
jmp 0x1400ad139
mov ecx, 2
call rbp
mov rcx, r13
mov rbx, rax
call fcn.140059d70
mov rdx, rbx
mov rcx, rax
call fcn.1401deb18
jmp 0x1400ad1ac
Function at 0x1400b6950
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14022c040]
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
xor edx, edx
call qword [0x1401e1af0]
test eax, eax
je 0x1400b69c5
mov ecx, 2
call qword [fcn.1401de8b0]
mov r8d, 0x29
mov edx, 1
lea rcx, str.fatal:_recursion_detected_in_die_handler_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r8d, pe_nt_image_headers64
mov edx, 0xb5
lea rcx, str.usage.c
call fcn.140009c20
mov ecx, eax
call sub.msvcrt.dll_exit
lea rdx, [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x20], rdx
call qword [0x1401e1b08]
nop
nop dword [rax]

Function at 0x1400b69e0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x440
mov rax, qword [0x14022c040]
mov qword [rsp + 0x468], rdx
mov rbx, rcx
mov qword [rsp + 0x470], r8
mov qword [rsp + 0x478], r9
mov rdi, qword [rax]
mov qword [rsp + 0x438], rdi
xor edi, edi
call qword [0x1401e1af0]
test eax, eax
je 0x1400b6a66
mov ecx, 2
call qword [fcn.1401de8b0]
mov r8d, 0x2f
mov edx, 1
lea rcx, str.fatal:_recursion_detected_in_die_errno_handler_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r8d, pe_nt_image_headers64
mov edx, 0xdd
lea rcx, str.usage.c
call fcn.140009c20
mov ecx, eax
call sub.msvcrt.dll_exit
lea rsi, [rsp + 0x468]
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov rdi, qword [0x1401e1b08]
mov qword [rsp + 0x28], rsi
call fcn.1400b6430
mov rdx, rsi
mov rcx, rax
call rdi
nop

Function at 0x1400bd470
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r12, qword [0x14022c040]
mov qword [rsp + 0x70], r8
mov edi, edx
mov rsi, rcx
mov ebx, edx
mov qword [rsp + 0x78], r9
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
and edi, 0x100
je 0x1400bd4b2
movzx edi, word [rsp + 0x70]
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov r8d, edi
mov edx, ebx
mov rcx, rsi
call fcn.1400d7b40
test eax, eax
jns 0x1400bd520
call rbp
cmp dword [rax], 4
je 0x1400bd4b9
mov eax, ebx
not eax
test ah, 5
je 0x1400bd536
test bl, 2
jne 0x1400bd54d
mov rax, qword [str.PF__]
and ebx, 1
mov edx, dword [rax]
jne 0x1400bd510
lea rcx, [0x140202098]
test edx, edx
je 0x1400bd500
call fcn.1401d81b8
mov rcx, rax
mov rdx, rsi
call fcn.1400b69e0
nop dword [rax + rax]
lea rcx, [0x140202078]
test edx, edx
je 0x1400bd500
jmp 0x1400bd4f8
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r12]
jne 0x1400bd564
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, str.unable_to_create__s
call fcn.1400bd060
mov rdx, rsi
mov rcx, rax
call fcn.1400b69e0
lea rcx, str.could_not_open__s_for_reading_and_writing
call fcn.1400bd060
mov rdx, rsi
mov rcx, rax
call fcn.1400b69e0
call fcn.1401d96b0
nop
nop word [rax + rax]
Function at 0x1400bd570
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r13, qword [0x14022c040]
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rax, qword [r13]
mov qword [rsp + 0x28], rax
mov eax, 0x800000
mov edi, ecx
mov rbp, rdx
cmp r8, rax
cmovbe rax, r8
mov rsi, rax
mov r8d, esi
mov rdx, rbp
mov ecx, edi
call sub.msvcrt.dll__read
movsxd rbx, eax
test rbx, rbx
jns 0x1400bd5d5
call r12
cmp dword [rax], 4
je 0x1400bd5a7
call r12
mov eax, dword [rax]
cmp eax, 0xb
je 0x1400bd5f0
cmp eax, 0x8c
je 0x1400bd5f0
mov rax, qword [rsp + 0x28]
sub rax, qword [r13]
jne 0x1400bd615
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, 1
lea rcx, [rsp + 0x20]
mov r8d, 0xffffffff
mov edx, 1
mov dword [rsp + 0x20], edi
mov word [rsp + 0x24], ax
call fcn.1400ddab0
jmp 0x1400bd5a7
call fcn.1401d96b0
nop
nop dword [rax + rax]

Function at 0x1400bd8b0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__dup
test eax, eax
js 0x1400bd8c2
add rsp, 0x28
ret
lea rcx, str.dup_failed
call fcn.1400b69e0
nop
nop

Function at 0x1400bd9a0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.msvcrt.dll__fdopen
test rax, rax
je 0x1400bd993
add rsp, 0x28
ret
lea rcx, str.Out_of_memory__fdopen_failed
call fcn.1400b69e0
nop
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rdi, [0x140202124]
mov rdx, rdi
mov rsi, rcx
call fcn.1400d77c0
mov rbx, rax
test rax, rax
je 0x1400bd9d0
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
cmp dword [rax], 1
jne 0x1400bd9c2
mov rcx, rsi
call fcn.1400d6940
test eax, eax
jne 0x1400bda00
mov rdx, rdi
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400d77c0
call rbp
mov dword [rax], 1
jmp 0x1400bd9c2

Function at 0x1400bdae0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x130
mov rsi, qword [0x14022c040]
mov r8d, 0x104
mov rdi, qword [rsi]
mov qword [rsp + 0x128], rdi
lea rdi, [rsp + 0x20]
mov rbx, rcx
mov rdx, rcx
mov rcx, rdi
call fcn.1400de280
mov rcx, rbx
call fcn.1400d17f0
test eax, eax
js 0x1400bdb3f
mov rdx, qword [rsp + 0x128]
sub rdx, qword [rsi]
jne 0x1400bdb84
add rsp, 0x130
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
mov rcx, rbx
mov r12d, dword [rax]
call sub.msvcrt.dll_strlen
mov rcx, rdi
mov rsi, rax
call sub.msvcrt.dll_strlen
cmp rsi, rax
cmovne rbx, rdi
mov rcx, rbx
call fcn.1400f7440
mov rbx, rax
call rbp
mov rdx, rbx
lea rcx, str.Unable_to_create_temporary_file__s
mov dword [rax], r12d
call fcn.1400b69e0
call fcn.1401d96b0
nop
nop word [rax + rax]
Function at 0x1400bdb90
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r14, qword [0x14022c040]
mov rsi, rcx
movsxd rbx, edx
mov edi, r8d
mov rcx, qword [r14]
mov qword [rsp + 0x28], rcx
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea edx, [rbx + 6]
movsxd rdx, edx
cmp rax, rdx
jb 0x1400bdcd0
sub rax, rbx
mov r8d, 6
lea rdx, str.XXXXXX
lea r13, [rax - 6]
lea rbp, [rsi + r13]
mov rcx, rbp
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x1400bdcd0
lea r15, [rsi + r13 + 6]
mov ebx, 0x4000
lea r12, [rsp + 0x20]
mov r13, qword [sym.imp.msvcrt.dll__errno]
nop dword [rax]
mov edx, 8
mov rcx, r12
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400bdcc2
mov rcx, qword [rsp + 0x20]
mov r8, rbp
lea r10, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
movabs r9, 0x8421084210842109
nop
mov rdx, rcx
add r8, 1
shr rdx, 1
mov rax, rdx
mul r9
shr rdx, 4
mov rax, rdx
shl rax, 5
sub rax, rdx
add rax, rax
sub rcx, rax
movzx eax, byte [r10 + rcx]
mov rcx, rdx
mov byte [r8 - 1], al
cmp r8, r15
jne 0x1400bdc40
mov qword [rsp + 0x20], rdx
mov r8d, edi
mov edx, 0x502
mov rcx, rsi
call fcn.1400d7b40
test eax, eax
jns 0x1400bdca7
call r13
cmp dword [rax], 0x11
jne 0x1400bdc9f
sub ebx, 1
jne 0x1400bdc10
mov byte [rsi], 0
mov eax, 0xffffffff
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r14]
jne 0x1400bdcde
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.unable_to_get_random_bytes_for_temporary_file
call fcn.1400b6b60
jmp 0x1400bdca2
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400bdca2
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop

Function at 0x1400bdcf0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov r8d, edx
xor edx, edx
jmp fcn.1400bdb90

Function at 0x1400be240
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rdi, qword [0x14022c040]
mov qword [rsp + 0x80], r8
lea rsi, [rsp + 0x30]
mov rbx, rcx
lea r8, [rsp + 0x80]
mov qword [rsp + 0x88], r9
mov rcx, rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], 0
mov rax, qword [rdi]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rax, qword [0x14022c910]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
call fcn.14008fa90
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
test r8, r8
je 0x1400be2ba
cmp byte [rdx + r8 - 1], 0xa
jne 0x1400be2e0
mov rcx, rbx
call fcn.1400be180
mov rcx, rsi
call fcn.14008e580
mov rax, qword [rsp + 0x48]
sub rax, qword [rdi]
jne 0x1400be33b
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x1400be330
mov edx, 1
mov rcx, rsi
call fcn.14008e7e0
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
lea rax, [r8 + 1]
mov qword [rsp + 0x38], rax
mov byte [rdx + r8], 0xa
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov byte [rdx + rax], 0
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
jmp 0x1400be2ba
sub rax, r8
cmp rax, 1
jne 0x1400be301
jmp 0x1400be2ea
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400be350
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
xor edx, edx
mov r8d, ecx
xor ecx, ecx
jmp fcn.1400ddab0

Function at 0x1400be410
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rdi, qword [0x14022c040]
mov rax, qword [0x14022c660]
mov esi, edx
mov rbx, rcx
mov rdx, qword [rdi]
mov qword [rsp + 0x78], rdx
lea rdx, [rsp + 0x20]
call qword [rax]
test eax, eax
js 0x1400be474
movzx eax, word [rsp + 0x26]
and ax, 0xf000
cmp ax, 0xa000
je 0x1400be468
mov edx, esi
mov rcx, rbx
call fcn.1400d7b40
mov rdx, qword [rsp + 0x78]
sub rdx, qword [rdi]
jne 0x1400be47b
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x72
mov eax, 0xffffffff
jmp 0x1400be456
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
call sub.ADVAPI32.dll_SystemFunction036
cmp al, 1
sbb eax, eax
add rsp, 0x28
ret

Function at 0x1400be490
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rdi, qword [0x14022c040]
mov rax, qword [0x14022c660]
mov esi, edx
mov rbx, rcx
mov rdx, qword [rdi]
mov qword [rsp + 0x78], rdx
lea rdx, [rsp + 0x20]
call qword [rax]
test eax, eax
js 0x1400be474
movzx eax, word [rsp + 0x26]
and ax, 0xf000
cmp ax, 0xa000
je 0x1400be468
mov edx, esi
mov rcx, rbx
call fcn.1400d7b40
mov rdx, qword [rsp + 0x78]
sub rdx, qword [rdi]
jne 0x1400be47b
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x72
mov eax, 0xffffffff
jmp 0x1400be456
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop dword [rax]
sub rsp, 0x28
call sub.ADVAPI32.dll_SystemFunction036
cmp al, 1
sbb eax, eax
add rsp, 0x28
ret

Function at 0x1400be4b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x14022c040]
mov edx, 4
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x24]
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400be4f0
mov eax, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rbx]
jne 0x1400be511
add rsp, 0x30
pop rbx
ret
mov rax, qword [str.PF__]
lea rcx, str.unable_to_get_random_bytes
mov eax, dword [rax]
test eax, eax
je 0x1400be50c
call fcn.1401d81b8
mov rcx, rax
call fcn.1400b6950
call fcn.1401d96b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400be7e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14022c450]
and ecx, dword [rax]
mov rbx, r8
jne 0x1400be800
add rsp, 0x20
pop rbx
ret
mov ecx, edx
call fcn.1400be540
test eax, eax
jns 0x1400be7f3
mov rdx, rbx
lea rcx, str.fsync_error_on__s
call fcn.1400b69e0
nop
nop dword [rax + rax]
Function at 0x1400be820
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1400bd7a0
test rax, rax
js 0x1400be833
add rsp, 0x28
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call fcn.1400822a0
lea rcx, str.write_error
call fcn.1400b69e0
nop
nop dword [rax]

Function at 0x1400be850
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, rcx
mov rcx, rdx
mov edx, 1
mov rbx, r8
call sub.msvcrt.dll_fwrite
cmp rax, rbx
jne 0x1400be873
add rsp, 0x20
pop rbx
ret
lea rcx, str.fwrite_error
call fcn.1400b69e0
nop

Function at 0x1400be880
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1400d14d0
test eax, eax
jne 0x1400be892
add rsp, 0x28
ret
lea rcx, str.fflush_error
call fcn.1400b69e0
nop
nop
Function at 0x1400bf1a0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [0x14022c040]
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x14022c910]
mov ebx, ecx
lea rsi, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], rax
mov eax, ecx
mov qword [rsp + 0x28], 0
not eax
test eax, 0x440
je 0x1400bf2d0
test cl, 0x40
jne 0x1400bf2b0
test bh, 4
je 0x1400bf21b
cmp qword [rsp + 0x28], 0
jne 0x1400bf350
mov r8d, 0x15
lea rdx, str.new_blank_line_at_EOF
mov rcx, rsi
call fcn.14008f5f0
test bl, 0x80
je 0x1400bf241
cmp qword [rsp + 0x28], 0
jne 0x1400bf310
mov r8d, 0x1a
lea rdx, str.space_before_tab_in_indent
mov rcx, rsi
call fcn.14008f5f0
test bh, 1
je 0x1400bf267
cmp qword [rsp + 0x28], 0
jne 0x1400bf330
mov r8d, 0x12
lea rdx, str.indent_with_spaces
mov rcx, rsi
call fcn.14008f5f0
and bh, 8
je 0x1400bf289
cmp qword [rsp + 0x28], 0
jne 0x1400bf2f0
mov r8d, 0xd
lea rdx, [0x140202490]
mov rcx, rsi
call fcn.14008f5f0
xor edx, edx
mov rcx, rsi
call fcn.14008e600
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi]
jne 0x1400bf36a
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov r8d, 0x13
lea rdx, str.trailing_whitespace
mov rcx, rsi
call fcn.14008f5f0
jmp 0x1400bf1f5
mov r8d, 0x13
lea rdx, str.trailing_whitespace
mov rcx, rsi
call fcn.14008f5f0
jmp 0x1400bf21b
mov r8d, 2
lea rdx, [0x140202449]
mov rcx, rsi
call fcn.14008f5f0
jmp 0x1400bf274
mov r8d, 2
lea rdx, [0x140202449]
mov rcx, rsi
call fcn.14008f5f0
jmp 0x1400bf22c
mov r8d, 2
lea rdx, [0x140202449]
mov rcx, rsi
call fcn.14008f5f0
jmp 0x1400bf252
mov r8d, 2
lea rdx, [0x140202449]
mov rcx, rsi
call fcn.14008f5f0
jmp 0x1400bf206
call fcn.1401d96b0
nop
Function at 0x1400c3730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, qword [0x14022c040]
mov rsi, rdx
mov rbx, rcx
lea rdi, [rsp + 0x20]
mov rdx, qword [rbp]
mov qword [rsp + 0x78], rdx
lea rdx, str.rebase_apply
call fcn.140043180
mov rdx, rdi
mov rcx, rax
call fcn.1400d9690
test eax, eax
jne 0x1400c37e0
lea rdx, str.rebase_apply_applying
mov rcx, rbx
call fcn.140043180
mov rdx, rdi
mov rcx, rax
call fcn.1400d9690
test eax, eax
je 0x1400c3860
mov dword [rsi + 0xc], 1
lea rdx, str.rebase_apply_head_name
mov rcx, rbx
call fcn.1400c13c0
lea rdx, str.rebase_apply_onto
mov rcx, rbx
mov qword [rsi + 0x28], rax
call fcn.1400c13c0
mov qword [rsi + 0x30], rax
mov eax, 1
mov rdx, qword [rsp + 0x78]
sub rdx, qword [rbp]
jne 0x1400c38b4
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [0x140202e1d]
mov rcx, rbx
call fcn.140043180
mov rdx, rdi
mov rcx, rax
call fcn.1400d9690
mov edx, eax
xor eax, eax
test edx, edx
jne 0x1400c37c5
lea rdx, str.rebase_merge_interactive
mov rcx, rbx
call fcn.140043180
mov rdx, rdi
mov rcx, rax
call fcn.1400d9690
test eax, eax
je 0x1400c38a8
mov dword [rsi + 0xc], 1
lea rdx, [0x140202e43]
mov rcx, rbx
call fcn.1400c13c0
lea rdx, [0x140202e5a]
mov rcx, rbx
mov qword [rsi + 0x28], rax
call fcn.1400c13c0
mov qword [rsi + 0x30], rax
jmp 0x1400c37c0
mov dword [rsi + 4], 1
lea rdx, str.rebase_apply_patch
mov rcx, rbx
call fcn.140043180
mov rdx, rdi
mov rcx, rax
call fcn.1400d9690
test eax, eax
jne 0x1400c37c0
cmp qword [rsp + 0x38], 0
jne 0x1400c37c0
mov dword [rsi + 8], 1
jmp 0x1400c37c0
mov dword [rsi + 0x10], 1
jmp 0x1400c382b
call fcn.1401d96b0
nop
nop word [rax + rax]
Function at 0x1400cff00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov ecx, 2
call qword [fcn.1401de8b0]
mov r8d, 0x2b
mov edx, 1
lea rcx, str.fatal:_not_enough_memory_for_initialization
mov r9, rax
call sub.msvcrt.dll_fwrite
mov r8d, pe_nt_image_headers64
mov edx, 0xf76
lea rcx, str.compat_mingw.c
call fcn.140009c20
mov ecx, eax
call sub.msvcrt.dll_exit
nop
nop dword [rax + rax]

Function at 0x1400cff50
Capabilities:
Enumerate processes
Initialize winsock library
Query environment variable
Set environment variable
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov r13, qword [0x14022c040]
mov r12d, 3
mov rax, qword [r13]
mov qword [rsp + 0x248], rax
xor eax, eax
lea r14, [rsp + 0x40]
cmp r8d, 1
mov rbx, rcx
sbb r12d, 0xffffffff
mov edi, edx
mov esi, r8d
mov ebp, r9d
mov r8d, 0x104
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x102
jbe 0x1400cffd8
mov rax, qword [rsp + 0x248]
sub rax, qword [r13]
jne 0x1400d0110
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140204a24]
mov rcx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400d00d0
cmp edi, 0xfffffff4
je 0x1400d0070
mov eax, dword [rsp + 0x2b0]
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov qword [rsp + 0x30], 0
mov rcx, r14
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400cffad
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov rdx, rbx
mov ecx, edi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, ebp
mov edx, esi
call fcn.1400da6a0
mov ecx, ebp
call sub.msvcrt.dll__close
jmp 0x1400cffad
lea rdx, str.2_1
mov rcx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400cffff
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rdi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d00f7
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov rdx, rbx
mov ecx, 0xfffffff4
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
mov edx, esi
mov ecx, edi
call fcn.1400da6a0
jmp 0x1400cffad
mov ecx, esi
call sub.msvcrt.dll__close
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
je 0x1400cffad
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400cffad
mov ecx, esi
call sub.msvcrt.dll__close
mov ecx, 0xfffffff4
call rdi
cmp rax, 0xffffffffffffffff
jne 0x1400d00e9
jmp 0x1400cffad
call fcn.1401d96b0
nop
nop word cs:[rax + rax]

Function at 0x1400d0120
Capabilities:
Enumerate processes
Initialize winsock library
Terminate process

Disassembly:
sub rsp, 0x28
mov r8d, 0x296
lea rdx, str.compat_mingw.c
lea rcx, str.hide_dotfiles__HIDE_DOTFILES_DOTGITONLY
call qword [sym.imp.msvcrt.dll__assert]
nop
nop