joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400018a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x140005040]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400018e3
lea ecx, [rax + 3]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Premature_EOF_in_JPEG_file
lea rdx, [0x14000325c]
call fcn.140001010
lea ecx, [rbx + 2]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140005040]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
cmp eax, 0xffffffff
jne 0x140001920
lea ecx, [rax + 3]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Premature_EOF_in_JPEG_file
lea rdx, [0x14000325c]
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
shl ebx, 8
add eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140001930
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov esi, edx
mov rcx, qword [0x140005040]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov rcx, qword [0x140005040]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
cmp ebx, 0xff
jne 0x1400019c9
cmp eax, 0xd8
jne 0x1400019c9
lea rbx, [0x140000000]
call fcn.140001310
lea ecx, [rax - 0xc0]
cmp ecx, 0x3e
ja case.0x14000199a.196
movsxd rcx, ecx
movzx ecx, byte [rbx + rcx + 0x1a1c]
mov edx, dword [rbx + rcx*4 + 0x1a08]
add rdx, rbx
jmp rdx
test edi, edi
je case.0x14000199a.196
mov ecx, eax
call fcn.1400015d0
jmp 0x140001975
test edi, edi
je case.0x14000199a.196
lea rcx, str.APP12_contains:_n
call fcn.140001420
mov ecx, esi
call fcn.140001480
jmp 0x140001975
call fcn.140001a60
jmp 0x140001975
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Not_a_JPEG_file
lea rdx, [0x14000325c]
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140001a60
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
call fcn.1400018a0
mov ebx, eax
cmp eax, 2
jae 0x140001a9f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Erroneous_JPEG_marker_length
lea rdx, [0x14000325c]
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add ebx, 0xfffffffe
je 0x140001ac7
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [0x140005040]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
cmp eax, 0xffffffff
je 0x140001acd
add ebx, 0xffffffff
jne 0x140001ab0
add rsp, 0x20
pop rbx
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Premature_EOF_in_JPEG_file
lea rdx, [0x14000325c]
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140001b00
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.rdjpgcom_displays_any_textual_comments_in_a_JPEG_file._n
call fcn.140001010
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x140005048]
lea rdx, str.Usage:__s__switches___inputfile__n
mov rcx, rax
call fcn.140001010
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Switches__names_may_be_abbreviated_:_n
call fcn.140001010
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.___raw________Display_non_printable_characters_in_comments__unsafe__n
call fcn.140001010
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.___verbose____Also_display_dimensions_of_JPEG_image_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140001f74
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140002005
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140002005
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002005
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140001fe9
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140001fe3
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140001feb
add rdx, 0x28
jmp 0x140001fc8
xor edx, edx
test rdx, rdx
jne 0x140001ff4
xor al, al
jmp 0x14000200b
test dword [rdx + 0x24], 0x80000000
je 0x140002001
xor al, al
jmp 0x14000200b
mov al, 1
jmp 0x14000200b
xor al, al
jmp 0x14000200b
add rsp, 0x18
ret
Function at 0x140003ae0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003b14
cmp word [rcx], 0x5a4d
jne 0x140003b14
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003b14
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003b14
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003a20
test eax, eax
jne 0x140003b30
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003a90
test rax, rax
je 0x140003b25
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400042dc
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400041e0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004180
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004644
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1404705f8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1404705f4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004692
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000468a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004779
inc ebx
add rax, 0x28
jmp 0x14000466a
mov rcx, r12
call fcn.140004e71
mov rbp, rax
test rax, rax
jne 0x1400046b1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400045e0
movsxd rbx, ebx
mov rax, qword [0x1404705f8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004f1f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1404705f8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004713
mov rax, qword [0x1404705f8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400045e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004773
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004773
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1404705f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004773
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400045e0
inc dword [0x1404705f4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x4015a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
test rcx, rcx
je 0x401600
cmp qword [0x005ca040], rcx
je 0x4015f0
mov rcx, qword [r12 + 0x28]
call fcn.004c9260
mov rcx, qword [r12 + 8]
call fcn.004c9260
mov rcx, qword [r12 + 0x20]
call fcn.004521d0
mov rcx, qword [r12]
call fcn.004c9260
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004c9260
mov qword [0x005ca040], 0
jmp 0x4015b7
add rsp, 0x20
pop r12
ret

Function at 0x406c90
Capabilities:
Get socket status

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x680
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rsi]
mov qword [rsp + 0x678], rax
xor eax, eax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov rbx, rcx
mov qword [rcx + 0x18], rax
xor eax, eax
jmp 0x406ce0
call fcn.00406c10
mov edx, dword [rbx + 8]
test edx, edx
jne 0x406d08
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x406cd0
mov rax, qword [rsp + 0x678]
xor rax, qword [rsi]
jne 0x406e1d
add rsp, 0x680
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [0x005ca1c0]
lea rdx, [rsp + 0x44]
call qword [sym.imp.libcurl_4.dll_curl_multi_timeout]
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x406cdc
cmp eax, 0xffffffff
je 0x406de0
movsxd rdx, eax
mov ecx, eax
imul rdx, rdx, 0x10624dd3
sar ecx, 0x1f
sar rdx, 0x26
sub edx, ecx
mov dword [rsp + 0x48], edx
imul edx, edx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
mov dword [rsp + 0x4c], eax
lea rax, [rsp + 0x3c]
lea rbp, [rsp + 0x470]
mov rcx, qword [0x005ca1c0]
mov dword [rsp + 0x3c], 0xffffffff
lea rdi, [rsp + 0x260]
lea r12, [rsp + 0x50]
mov dword [rsp + 0x50], 0
mov r9, rbp
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x260], 0
mov dword [rsp + 0x470], 0
call qword [sym.imp.libcurl_4.dll_curl_multi_fdset]
mov ecx, dword [rsp + 0x3c]
test ecx, ecx
js 0x406df8
lea rax, [rsp + 0x48]
add ecx, 1
mov r9, rbp
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, r12
call qword [sym.imp.WS2_32.dll_select]
jmp 0x406cdc
movabs rax, 0xc35000000000
mov qword [rsp + 0x48], rax
jmp 0x406d56
mov eax, dword [rsp + 0x48]
test eax, eax
jle 0x406e11
movabs rax, 0xc35000000000
mov qword [rsp + 0x48], rax
jmp 0x406db9
cmp dword [rsp + 0x4c], 0xc350
jle 0x406db9
jmp 0x406e00
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop
sub rsp, 0x28
mov rcx, qword [0x005ca108]
test rcx, rcx
je 0x406e50
mov eax, dword [rcx + 8]
test eax, eax
jne 0x406e58
mov rcx, qword [rcx + 0x38]
test rcx, rcx
jne 0x406e40
add rsp, 0x28
ret
call fcn.00406c90
mov rcx, qword [0x005ca108]
jmp 0x406e3b
Function at 0x406f90
Capabilities:
Check http status code

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov qword [rcx + 0x20], rdx
mov r12, rcx
mov rbx, rdx
call fcn.00406a70
test eax, eax
je 0x407070
mov rcx, r12
call fcn.00406c90
mov eax, dword [rbx]
mov r9d, dword [rbx + 4]
test eax, eax
jne 0x407008
cmp r9d, 0x12b
jg 0x4070a0
test eax, eax
jne 0x407008
lea rcx, [0x00572120]
xor r12d, r12d
call fcn.00418db0
cmp qword [0x005721b0], 0
je 0x406ff6
lea rcx, [0x00572180]
call fcn.00418db0
mov eax, r12d
add rsp, 0x28
pop rbx
pop r12
ret
mov r12d, 1
cmp eax, 0x25
je 0x406ff6
mov edx, dword [rbx + 4]
cmp edx, 0x194
jne 0x407023
cmp eax, 0x16
je 0x406ff6
cmp edx, 0x226
jne 0x407036
mov r12d, 1
cmp eax, 0x13
je 0x406ff6
cmp edx, 0x191
jne 0x407100
cmp qword [0x00572148], 0
je 0x4070c8
cmp qword [0x00572150], 0
je 0x4070c8
lea rcx, [0x00572120]
mov r12d, 5
call fcn.00418e20
jmp 0x406ff6
lea r8, str.failed_to_start_HTTP_request
mov edx, 0x100
lea rcx, [0x005f5a60]
mov r12d, 3
call fcn.0049a500
mov eax, r12d
add rsp, 0x28
pop rbx
pop r12
ret
mov dword [rbx], 0x16
lea r8, str.The_requested_URL_returned_error:__ld
mov edx, 0x100
lea rcx, [0x005f5a60]
call fcn.0049a500
mov eax, dword [rbx]
jmp 0x406fcd
mov eax, dword [0x005720a0]
mov edx, dword [rbx + 8]
mov r12d, 4
and eax, 0xfffffffb
mov dword [0x005720a0], eax
test edx, edx
je 0x406ff6
mov dword [0x005ca120], 1
and eax, edx
mov dword [0x005720a0], eax
jmp 0x406ff6
cmp dword [rbx + 0xc], 0x197
je 0x40713e
cmp byte [0x005f5a60], 0
mov r12d, 2
jne 0x406ff6
mov ecx, dword [rbx]
call qword [sym.imp.libcurl_4.dll_curl_easy_strerror]
mov r8d, 0x100
lea rcx, [0x005f5a60]
mov rdx, rax
call fcn.004b7cf0
jmp 0x406ff6
lea rcx, [0x00572180]
call fcn.00418e20
jmp 0x407109
Function at 0x408ec0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa0
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
lea rdi, [0x0057a36d]
mov rax, qword [rsi]
mov qword [rsp + 0x98], rax
xor eax, eax
lea r13, [rsp + 0x40]
mov rax, qword [0x005ab200]
mov rbx, rdx
mov qword [rsp + 0x60], 0
lea r12, [rdx + 0x90]
mov rdx, rcx
mov rcx, r13
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x60], 1
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rax
call fcn.00492b60
movsx r8d, byte [rbx + 0x90]
mov ebp, r8d
test r8d, r8d
jne 0x408fc7
jmp 0x409018
lea eax, [r8 - 0x30]
cmp eax, 9
jbe 0x408fd3
lea eax, [r8 - 0x2d]
cmp eax, 2
jbe 0x408fd3
mov rdx, rdi
mov rcx, r13
call fcn.004737e0
movsx r8d, byte [r12 + 1]
add r12, 1
mov ebp, r8d
test r8d, r8d
je 0x409018
mov eax, ebp
and eax, 0xffffffdf
sub eax, 0x41
cmp al, 0x19
ja 0x408f98
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x4090c8
mov rax, qword [rsp + 0x48]
sub rdx, rax
cmp rdx, 1
je 0x4090c8
lea rdx, [rax + 1]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x50]
mov byte [rdx + rax], bpl
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov byte [rdx + rax], 0
jmp 0x408fb5
mov rcx, r13
xor edx, edx
lea r14, [rsp + 0x20]
call fcn.004728a0
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, r14
mov rcx, rax
mov r13, rax
call fcn.00408be0
mov r12d, eax
test eax, eax
jne 0x4090f8
mov rcx, r14
call fcn.00472940
mov rax, qword [0x005ab240]
mov rax, qword [rax]
mov rax, qword [rax + 0xc8]
mov rax, qword [rax + 0x18]
cmp qword [rsp + 0x28], rax
je 0x4090e0
mov rcx, qword [rsp + 0x30]
lea rdx, [0x0057a374]
call fcn.00472690
test eax, eax
je 0x4090f8
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 5]
call fcn.004996c0
mov qword [rbx + 0x68], rax
mov rcx, r14
call fcn.004727a0
mov rcx, r13
call fcn.004c9260
mov rax, qword [rsp + 0x98]
xor rax, qword [rsi]
jne 0x409100
mov eax, r12d
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 1
mov rcx, r13
call fcn.004727c0
mov rax, qword [rsp + 0x48]
jmp 0x408ff3
mov rcx, qword [rsp + 0x30]
lea rdx, [rbx + 8]
call fcn.00427150
mov r12d, eax
jmp 0x409093
mov r12d, 0xffffffff
jmp 0x409093
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
Function at 0x4095d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x4095f0
call sub.msvcrt.dll_fclose
mov qword [r12 + 0x18], 0
mov qword [r12 + 0x38], 0
lea rcx, [r12 + 0x20]
call fcn.004727a0
mov rcx, qword [r12]
call fcn.004c9260
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004c9260

Function at 0x40a4e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x38]
mov r12, rcx
test rax, rax
je 0x40a4fa
mov edx, dword [rax + 0x20]
cmp edx, 0xffffffff
jne 0x40a520
mov rdx, qword [r12 + 0x40]
mov rax, qword [r12 + 0x48]
mov rcx, r12
mov qword [rdx + 8], rax
mov qword [rax], rdx
add rsp, 0x20
pop r12
jmp fcn.004c9260
lea rcx, str.fd_leakage_in_release:__d
call fcn.00494950
jmp 0x40a4fa

Function at 0x40ba50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13, rcx
mov rcx, qword [rcx + 8]
call fcn.004c9260
mov edx, dword [r13 + 0x18]
test edx, edx
je 0x40bb0a
xor edi, edi
lea r14, [0x0057ada0]
lea rsi, str._builtin_unknown
nop word cs:[rax + rax]
mov rax, qword [r13 + 0x20]
mov r12, qword [rax + rdi*8]
mov eax, dword [r12 + 0x1c]
test eax, eax
je 0x40baf8
xor ebx, ebx
lea rbp, str._builtin_true
jmp 0x40babb
add rbx, 1
cmp dword [r12 + 0x1c], ebx
jbe 0x40baf8
mov rax, rbx
shl rax, 4
mov rcx, qword [r12 + rax + 0x28]
cmp rcx, r14
sete al
cmp rcx, rbp
sete dl
or eax, edx
test rcx, rcx
sete dl
or al, dl
jne 0x40bab0
cmp rcx, rsi
je 0x40bab0
call fcn.004c9260
add rbx, 1
cmp dword [r12 + 0x1c], ebx
ja 0x40babb
nop dword [rax]
mov rcx, r12
add rdi, 1
call fcn.004c9260
cmp dword [r13 + 0x18], edi
ja 0x40ba90
mov rcx, qword [r13 + 0x20]
call fcn.004c9260
mov rcx, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.004c9260

Function at 0x40d3c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
test rcx, rcx
je 0x40d468
lea rcx, [0x005ca218]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [0x005ca200]
test rdx, rdx
je 0x40d46f
mov r8, qword [0x005ca210]
xor eax, eax
jmp 0x40d409
add rax, 1
cmp rax, rdx
je 0x40d46f
movsxd rcx, eax
cmp r12, qword [r8 + rax*8]
jne 0x40d400
lea r9, [rdx - 1]
cmp rcx, r9
jae 0x40d439
lea rax, [r8 + rcx*8]
lea rcx, [r8 + rdx*8 - 8]
nop dword [rax]
mov rdx, qword [rax + 8]
add rax, 8
mov qword [rax - 8], rdx
cmp rcx, rax
jne 0x40d428
mov qword [0x005ca200], r9
lea rcx, [0x005ca218]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, r12
call fcn.0040d350
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004c9260
add rsp, 0x20
pop r12
ret
lea r8, str.no_entry_found
mov edx, 0x214
lea rcx, str.attr.c
call fcn.00494ad0
nop
nop dword [rax + rax]
Function at 0x414ca0
Capabilities:
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov rbx, rcx
mov rsi, rdx
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
call fcn.00414be0
mov r9, rsi
mov r8, rbx
mov edx, 0xa89
lea rcx, str.config.c
add rsp, 0x38
pop rbx
pop rsi
jmp 0x481270
mov eax, dword [0x005edc0c]
test eax, eax
jne 0x481280
ret
jmp 0x482060
push r13
push r12
push rbx
sub rsp, 0x40
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov eax, dword [0x005edc10]
mov qword [rsp + 0x20], rcx
mov r12, r8
mov dword [rsp + 0x28], edx
mov r13, r9
test eax, eax
je 0x4820c8
mov eax, dword [0x005edc14]
test eax, eax
jle 0x4820ad
lea r8, [rsp + 0x20]
mov rdx, r13
mov rcx, r12
call fcn.00481e10
mov rax, qword [rsp + 0x38]
xor rax, qword [rbx]
jne 0x4820cf
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
call fcn.00481e80
jmp 0x482099
call sub.libssp_0.dll___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x415900
Capabilities:
Resolve dns

Disassembly:
sub rsp, 0x48
mov r9d, 0x401
lea r8, [0x005ca2e0]
mov rax, rcx
mov rcx, rdx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov edx, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x415950
lea rax, [0x005ca2e0]
add rsp, 0x48
ret
lea r8, [0x0057c070]
mov edx, 0x401
lea rcx, [0x005ca2e0]
call fcn.0049a500
lea rax, [0x005ca2e0]
add rsp, 0x48
ret

Function at 0x419130
Capabilities:
Create pipe

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
lea rcx, str.GIT_TEST_DATE_NOW
call fcn.004ae0e0
mov rcx, rax
test rax, rax
je 0x419170
call sub.msvcrt.dll_atoi
mov dword [r12 + 4], 0
mov dword [r12], eax
add rsp, 0x20
pop r12
ret
xor edx, edx
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004ac7f0

Function at 0x41bc80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
test rcx, rcx
je 0x41bd00
mov edx, dword [rcx + 0x38]
test edx, edx
je 0x41bcb0
xor ebx, ebx
mov rax, qword [r12]
mov rcx, qword [rax + rbx*8]
add rbx, 1
call fcn.0041bc80
cmp dword [r12 + 0x38], ebx
ja 0x41bc98
mov eax, dword [r12 + 0x40]
test eax, eax
je 0x41bcd9
xor ebx, ebx
nop dword [rax + rax]
mov rax, qword [r12 + 8]
mov rcx, qword [rax + rbx*8]
add rbx, 1
call fcn.004c9260
cmp dword [r12 + 0x40], ebx
ja 0x41bcc0
mov rcx, qword [r12 + 8]
call fcn.004c9260
mov rcx, qword [r12]
call fcn.004c9260
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp fcn.004c9260
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x421b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
add rsp, 0xffffffffffffff80
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x78], rax
xor eax, eax
mov rax, qword [0x005aaf20]
lea rdx, [rsp + 0x20]
call qword [rax]
test eax, eax
sete al
mov rdx, qword [rsp + 0x78]
xor rdx, qword [rbx]
movzx eax, al
jne 0x421bcc
sub rsp, 0xffffffffffffff80
pop rbx
ret
call sub.libssp_0.dll___stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x421be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
add rsp, 0xffffffffffffff80
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x78], rax
xor eax, eax
mov rax, qword [0x005ab240]
mov r8, rcx
mov rcx, rdx
cmp qword [rax], r8
jne 0x421c2e
mov rax, qword [0x005aaf20]
lea rdx, [rsp + 0x20]
call qword [rax]
test eax, eax
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, qword [rbx]
movzx eax, al
jne 0x421c46
sub rsp, 0xffffffffffffff80
pop rbx
ret
lea r8, str.do_not_know_how_to_check_file_existence_in_arbitrary_repo
mov edx, 0xac7
lea rcx, str.dir.c
call fcn.00494ad0
call sub.libssp_0.dll___stack_chk_fail
nop
nop dword [rax]