joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ae0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [rcx + 1], 0
mov rdi, rcx
mov rbp, rdx
jne 0x406c80
mov rax, qword [0x00502630]
mov eax, dword [rax + 0x1358]
test eax, eax
jne 0x406ca0
movzx r14d, byte [rdi]
test r14b, r14b
je 0x406b9a
mov edx, 0x3d
mov rcx, rbp
call sub.msvcrt.dll_strchr
test rax, rax
je 0x406d34
sub rax, rbp
mov rcx, rbp
mov rdx, rax
call fcn.0047c2d0
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_getenv
cmp byte [rdi + 1], 0
mov rbx, rax
jne 0x406bb2
xor r13d, r13d
test rbx, rbx
je 0x406b69
mov rcx, rbx
call fcn.0047c240
mov r13, rax
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x406bd5
mov eax, dword [rbx]
mov esi, dword [rbx + 4]
and eax, 0x7fffffff
cmp eax, esi
je 0x406cc0
lea eax, [rsi + 1]
shl rsi, 4
mov dword [rbx + 4], eax
lea rax, [rbx + rsi + 8]
mov qword [rax], r12
mov qword [rax + 8], r13
mov rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x494af8
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str.saving_old_value:__s_n
lea rcx, [rax + 0x60]
mov r8, rbx
xor r13d, r13d
call fcn.00495340
test rbx, rbx
jne 0x406b5e
jmp 0x406b69
xor esi, esi
xor r14d, r14d
mov eax, 1
cmp eax, 4
mov r15d, 4
cmovae r15d, eax
xor ecx, ecx
mov edx, r15d
and r15d, 0x7fffffff
shl rdx, 4
add rdx, 8
call fcn.0047c14c
mov edx, dword [rax]
mov qword [rdi + 8], rax
mov dword [rax + 4], 0
and edx, 0x80000000
or r15d, edx
mov dword [rax], r15d
shr r15d, 0x18
and r15d, 0x7f
test r14b, r14b
mov byte [rax + 3], r15b
je 0x406d4c
add rbx, 8
test esi, esi
lea rdx, [rax + 8]
je 0x406c70
lea ecx, [rsi - 1]
add rcx, 1
shl rcx, 4
add rcx, rdx
nop dword [rax]
test rdx, rdx
je 0x406c63
mov r9, qword [rbx]
mov r10, qword [rbx + 8]
mov qword [rdx], r9
mov qword [rdx + 8], r10
add rdx, 0x10
add rbx, 0x10
cmp rdx, rcx
jne 0x406c50
mov dword [rax + 4], esi
mov rbx, rax
jmp 0x406b84
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str.env_manager::xput___s__n
lea rcx, [rax + 0x60]
mov r8, rbp
call fcn.00495340
jmp 0x406b00
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, [0x0049c96d]
lea rcx, [rax + 0x60]
mov r8, rbp
call fcn.00424db0
jmp 0x406b15
cmp byte [rbx + 3], 0
js 0x406d20
lea edx, [rsi + 1]
mov ecx, esi
call fcn.00421b50
mov rcx, qword [rdi + 8]
mov edx, eax
mov r14, rdx
shl rdx, 4
add rdx, 8
test rcx, rcx
je 0x406d30
mov esi, dword [rcx + 4]
call fcn.0047c14c
mov rbx, rax
mov qword [rdi + 8], rax
mov eax, dword [rax]
and r14d, 0x7fffffff
mov dword [rbx + 4], esi
and eax, 0x80000000
or eax, r14d
mov dword [rbx], eax
shr eax, 0x18
and eax, 0x7f
mov byte [rbx + 3], al
jmp 0x406b84
mov qword [rdi + 8], 0
lea eax, [rsi + 1]
jmp 0x406bdf
xor esi, esi
jmp 0x406ce9
lea r8, str.xput
lea rcx, str._workdir_repo_gcc_gnu_gcc_gcc.c
mov edx, 0x7c
call fcn.0049a060
mov rbx, rax
xor esi, esi
jmp 0x406b84
jmp qword [sym.imp.msvcrt.dll__putenv]
Function at 0x40c3a0
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [0x005022a0]
lea r9, [0x004338c0]
lea rcx, [0x005102e0]
xor r8d, r8d
mov rdi, rdx
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.0047905c
mov rax, qword [0x005102f8]
mov rdx, qword [0x00510300]
sub rdx, rax
cmp rdx, 0xb
jbe 0x40c4b0
movabs rsi, 0x5f5443454c4c4f43
mov dword [rax + 8], 0x3d434347
mov rcx, rdi
mov qword [rax], rsi
mov rax, qword [0x005102f8]
lea rsi, [rax + 0xc]
mov qword [0x005102f8], rsi
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov rax, qword [0x00510300]
sub rax, rsi
cmp rbx, rax
ja 0x40c4d0
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x005102f8]
mov rdx, qword [0x005102f0]
cmp rbx, rdx
je 0x40c4f0
mov rcx, qword [0x00510310]
mov r8, qword [0x005102e8]
lea rax, [rbx + rcx]
not rcx
and rax, rcx
mov rcx, qword [0x00510300]
mov r9, rax
mov qword [0x005102f8], rax
sub r9, r8
mov rdi, rcx
sub rdi, r8
cmp r9, rdi
jbe 0x40c494
mov qword [0x005102f8], rcx
mov rax, rcx
lea rcx, [0x00510410]
mov qword [0x005102f0], rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.00406ae0
lea rcx, [0x005102e0]
mov edx, 0xc
call fcn.0047911e
mov rax, qword [0x005102f8]
jmp 0x40c3e9
lea rcx, [0x005102e0]
mov rdx, rbx
call fcn.0047911e
mov rsi, qword [0x005102f8]
jmp 0x40c42e
or byte [0x00510330], 2
jmp 0x40c453

Function at 0x40c500
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov eax, dword [0x005101b0]
test eax, eax
je 0x40c520
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rdx, [0x0049d457]
lea rcx, [0x0049b8c0]
xor r9d, r9d
mov r8d, 1
call fcn.004036d0
test rax, rax
je 0x40c511
mov rcx, rax
call fcn.004015f0
mov qword [0x0049b958], rax
mov rax, qword [0x005022a0]
lea r9, [0x004338c0]
lea rcx, [0x005102e0]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.0047905c
mov rax, qword [0x005102f8]
mov rdx, qword [0x00510300]
sub rdx, rax
cmp rdx, 0x13
jbe 0x40c692
movabs rsi, 0x5f5443454c4c4f43
movabs rdi, 0x504152575f4f544c
mov dword [rax + 0x10], 0x3d524550
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov rax, qword [0x005102f8]
mov rdi, qword [0x0049b958]
lea rsi, [rax + 0x14]
mov rcx, rdi
mov qword [0x005102f8], rsi
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov rax, qword [0x00510300]
sub rax, rsi
cmp rbx, rax
ja 0x40c670
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x005102f8]
mov rdx, qword [0x005102f0]
cmp rbx, rdx
je 0x40c6b0
mov rcx, qword [0x00510310]
mov r8, qword [0x005102e8]
lea rax, [rbx + rcx]
not rcx
and rax, rcx
mov rcx, qword [0x00510300]
mov r9, rax
mov qword [0x005102f8], rax
sub r9, r8
mov rdi, rcx
sub rdi, r8
cmp r9, rdi
jbe 0x40c64f
mov qword [0x005102f8], rcx
mov rax, rcx
lea rcx, [0x00510410]
mov qword [0x005102f0], rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.00406ae0
lea rcx, [0x005102e0]
mov rdx, rbx
call fcn.0047911e
mov rdi, qword [0x0049b958]
mov rsi, qword [0x005102f8]
jmp 0x40c5e9
lea rcx, [0x005102e0]
mov edx, 0x14
call fcn.0047911e
mov rax, qword [0x005102f8]
jmp 0x40c58f
or byte [0x00510330], 2
jmp 0x40c60e
Function at 0x40ff70
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x80]
movzx r14d, byte [rcx]
mov rbx, rcx
cmp r14b, 0x24
je 0x40ffa2
cmp r14b, 0x40
mov r12, rcx
jne 0x410090
movzx eax, byte [rbx + 1]
lea rdi, str._workdir_xtensa_lx106_elf.win64
lea rdx, [rbx + 1]
test al, al
je 0x41007e
nop dword [rax]
cmp al, 0x5c
je 0x41007e
cmp al, 0x2f
je 0x41007e
mov r9, rbx
lea rax, [rbx + 2]
not r9
jmp 0x40ffee
add rax, 1
cmp cl, 0x2f
je 0x410002
cmp cl, 0x5c
je 0x410002
movzx ecx, byte [rax]
mov r8, rax
lea r12, [r9 + rax]
sub r8, rbx
mov r13, rax
test cl, cl
jne 0x40ffe0
lea rax, [r8 + 0x1e]
and rax, 0xfffffffffffffff0
call fcn.00487db0
sub rsp, rax
mov r8, r12
lea r15, [rsp + 0x30]
mov rcx, r15
call sub.msvcrt.dll_memcpy
cmp r14b, 0x40
mov byte [r15 + r12], 0
je 0x4100a4
mov rcx, r15
call sub.msvcrt.dll_getenv
test rax, rax
mov rsi, rax
je 0x410162
xor r8d, r8d
mov rdx, r13
mov rcx, rsi
call fcn.004764c2
mov rcx, rbx
mov r12, rax
call fcn.00494cb8
movzx r14d, byte [r12]
cmp r14b, 0x40
je 0x41006b
cmp r14b, 0x24
jne 0x410090
mov rbx, r12
movzx eax, byte [rbx + 1]
lea rdx, [rbx + 1]
test al, al
jne 0x40ffc0
mov r13, rdx
mov r8d, 1
xor r12d, r12d
jmp 0x410002
mov rax, r12
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp qword [0x0049ba20], 0xffffffffffffffff
je 0x410170
lea r12, [rbp - 0x44]
lea r14, [rbp - 0x48]
mov ecx, 0x20
mov dword [rbp - 0x48], 0x20
call fcn.0047c0a6
xor r8d, r8d
mov rsi, rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
mov r9, r12
mov rdx, r15
mov rcx, qword [0x0049ba20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
je 0x410110
cmp dword [rbp - 0x44], 1
jne 0x41011a
xor r12d, r12d
test eax, eax
jne 0x41011a
mov rcx, r12
call fcn.00494cb8
jmp 0x410041
cmp dword [rbp - 0x44], 1
je 0x410200
mov rcx, rsi
call fcn.00494cb8
lea rdx, str._ROOT
xor r8d, r8d
mov rcx, r15
call fcn.004764c2
mov rcx, rax
mov r14, rax
mov r12, rax
call sub.msvcrt.dll_getenv
test rax, rax
mov rsi, rax
jne 0x410102
mov rsi, qword [str._workdir_xtensa_lx106_elf.win64]
mov rcx, r14
call fcn.00494cb8
test rsi, rsi
jne 0x410041
mov rsi, rdi
jmp 0x410041
lea r14, [0x0049ba20]
xor r8d, r8d
mov r9d, 0x20019
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000002
mov r12, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov qword [rsp + 0x20], r14
call r12
test eax, eax
je 0x4101b1
mov qword [0x0049ba20], 0xffffffffffffffff
jmp 0x410122
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov r9d, 0x20019
lea rdx, str.Free_Software_Foundation
mov rcx, qword [0x0049ba20]
call r12
test eax, eax
jne 0x4101a1
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov r9d, 0x20019
lea rdx, [0x004a1cf2]
mov rcx, qword [0x0049ba20]
call r12
test eax, eax
je 0x4100b2
jmp 0x4101a1
mov edx, dword [rbp - 0x48]
mov rcx, rsi
call fcn.0047c14c
mov qword [rsp + 0x28], r14
mov rsi, rax
mov qword [rsp + 0x20], rax
mov r9, r12
xor r8d, r8d
mov rdx, r15
mov rcx, qword [0x0049ba20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x4100f5
Function at 0x4242f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.COLUMNS
call sub.msvcrt.dll_getenv
test rax, rax
je 0x424320
mov rcx, rax
call sub.msvcrt.dll_atoi
test eax, eax
jle 0x424320
add rsp, 0x28
ret
mov eax, 0x7fffffff
add rsp, 0x28
ret
Function at 0x426fc0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.GCC_COLORS
call sub.msvcrt.dll_getenv
test rax, rax
mov rbp, rax
je 0x4270f0
movzx edi, byte [rax]
xor eax, eax
test dil, dil
je 0x4270f5
mov r14, rbp
xor r13d, r13d
xor esi, esi
xor r12d, r12d
jmp 0x427035
cmp dil, 0x3a
je 0x42703a
cmp dil, 0x3d
je 0x427104
test r12, r12
je 0x427029
cmp dil, 0x3b
je 0x427029
sub edi, 0x30
cmp dil, 9
ja 0x4270f0
lea rax, [r14 + 1]
movzx edi, byte [r14 + 1]
mov r14, rax
test dil, dil
jne 0x427001
test r12, r12
mov rcx, qword [0x0049baa0]
je 0x427120
mov r13, r14
sub r13, r12
test rcx, rcx
je 0x42713b
lea rbx, [0x0049baa0]
jmp 0x42706e
add rbx, 0x18
mov rcx, qword [rbx]
test rcx, rcx
je 0x427086
movzx eax, byte [rbx + 0x10]
cmp rax, rsi
jne 0x427062
mov r8, rsi
mov rdx, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x427062
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x4270dc
test r12, r12
je 0x4270dc
cmp byte [rbx + 0x11], 0
jne 0x427131
lea rcx, [r13 + 7]
call fcn.0047c0a6
mov rdi, rax
mov eax, 0x5b1b
mov r8, r13
lea rcx, [rdi + 2]
mov word [rdi], ax
mov rdx, r12
call sub.msvcrt.dll_memcpy
lea rax, [rdi + r13 + 2]
mov qword [rbx + 8], rdi
mov byte [rbx + 0x11], 1
mov dword [rax], 0x4b5b1b6d
mov byte [rax + 4], 0
movzx edi, byte [r14]
test dil, dil
je 0x4270f0
lea rax, [r14 + 1]
xor r12d, r12d
mov rbp, rax
jmp 0x42702d
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp rbp, r14
je 0x4270f0
test r12, r12
jne 0x4270f0
lea rax, [r14 + 1]
mov rsi, r14
sub rsi, rbp
mov r12, rax
jmp 0x42702d
mov rsi, r14
sub rsi, rbp
test rcx, rcx
jne 0x427059
jmp 0x4270dc
call fcn.00494cb8
jmp 0x42709e
lea rbx, [0x0049baa0]
jmp 0x427086

Function at 0x4271e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
cmp ecx, 1
je 0x427222
jb 0x427205
cmp ecx, 2
jne 0x42722c
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffd
jbe 0x427210
xor eax, eax
add rsp, 0x38
ret
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x427205
call fcn.00426fc0
add rsp, 0x38
ret
lea r8, str.colorize_init
lea rcx, str._workdir_repo_gcc_gnu_gcc_diagnostic_color.c
mov edx, 0xef
call fcn.0049a060
nop
nop
nop word cs:[rax + rax]
Function at 0x427250
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
sub rsp, 0x28
cmp ecx, 1
je 0x427270
jb 0x427262
cmp ecx, 2
jne 0x4272e0
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
ret
lea rcx, str.GCC_URLS
call sub.msvcrt.dll_getenv
test rax, rax
mov rdx, rax
je 0x4272c0
xor eax, eax
cmp byte [rdx], 0
je 0x427264
lea rdi, [0x004f0ab8]
mov ecx, 3
mov rsi, rdx
repe cmpsb byte [rsi], byte [rdi]
je 0x427264
lea rdi, [0x004f0abb]
mov ecx, 3
mov rsi, rdx
mov eax, 1
repe cmpsb byte [rsi], byte [rdi]
seta cl
setb dl
cmp cl, dl
je 0x427264
jmp 0x4272d4
lea rcx, str.TERM_URLS
call sub.msvcrt.dll_getenv
test rax, rax
mov rdx, rax
jne 0x427284
mov eax, 2
add rsp, 0x28
pop rsi
pop rdi
ret
lea r8, str.determine_url_format
lea rcx, str._workdir_repo_gcc_gnu_gcc_diagnostic_color.c
mov edx, 0x15a
call fcn.0049a060
nop
nop
nop
nop
nop
nop
nop
nop
mov rax, qword [rcx]
mov rdx, qword [rdx]
mov eax, dword [rax]
sub eax, dword [rdx]
ret
Function at 0x42d800
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test r8, r8
mov rdi, rcx
mov rbp, rdx
mov rsi, r8
je 0x42d880
mov rbx, r8
lea r14, [rsp + 0x3c]
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r12d, 0xffffffff
mov r15d, 0xffffffff
jmp 0x42d86f
mov r8d, ebx
mov dword [rsp + 0x3c], ebx
mov rdx, rsi
mov qword [rsp + 0x20], 0
mov r9, r14
sub rdx, rbx
mov rcx, rdi
add rdx, rbp
call r13
test eax, eax
je 0x42d880
mov eax, dword [rsp + 0x3c]
sub rbx, rax
je 0x42d880
cmp rbx, r12
jbe 0x42d840
mov dword [rsp + 0x3c], r15d
mov r8d, r15d
jmp 0x42d847
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x430c90
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x28]
mov rbx, rcx
test rax, rax
je 0x430cb2
cmp rax, qword [rcx + 0x20]
je 0x430cb2
sub rax, 1
cmp qword [rcx + 0x30], rax
jb 0x430cbf
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_feof
test eax, eax
je 0x430cd0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x430cbf
mov rsi, qword [rbx + 0x20]
mov rax, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x18]
cmp rsi, rax
jne 0x430d15
lea rax, [rsi + rsi]
test rsi, rsi
mov esi, 0x1000
cmovne rsi, rax
mov rdx, rsi
call fcn.0047c14c
mov rcx, rax
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x28]
mov qword [rbx + 0x20], rsi
mov r9, qword [rbx + 0x10]
sub rsi, rax
add rcx, rax
mov r8, rsi
mov edx, 1
call sub.msvcrt.dll_fread
mov rcx, qword [rbx + 0x10]
mov rsi, rax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x430cbf
add qword [rbx + 0x28], rsi
test rsi, rsi
setne al
jmp 0x430cc1
Function at 0x444320
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rdx
movzx edx, byte [rdx + 0x8a]
mov rbp, rcx
mov r12d, r8d
mov eax, edx
shr al, 3
and eax, 1
jne 0x4443ea
mov ebx, edx
shr bl, 1
and ebx, 1
jne 0x4443ea
mov edx, dword [rsi + 0x84]
test edx, edx
jne 0x4443ea
cmp dword [rsi + 0x80], 0xffffffff
je 0x444400
movzx eax, word [rsi + 0x4e]
and ax, 0xf000
cmp ax, 0x3000
jne 0x444430
mov rax, qword [rsi + 8]
lea r9, str._s_is_a_block_device
mov r8d, r12d
mov edx, 3
mov rcx, rbp
mov ebx, 1
mov qword [rsp + 0x20], rax
call fcn.0043f5b0
movzx edx, byte [rsi + 0x8a]
mov eax, ebx
mov ecx, dword [rsi + 0x80]
and eax, 1
add eax, eax
and edx, 0xfffffffd
or eax, edx
mov byte [rsi + 0x8a], al
call sub.msvcrt.dll__close_1
movzx eax, byte [rsi + 0x8a]
mov dword [rsi + 0x80], 0xffffffff
shr al, 1
and eax, 1
xor eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call fcn.00443e80
test al, al
jne 0x444376
mov r9d, r12d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
mov byte [rsp + 0x4f], al
call fcn.00443f90
movzx eax, byte [rsp + 0x4f]
jmp 0x4443ea
cmp ax, 0x8000
je 0x4444fa
xor r15d, r15d
mov ecx, 0x2010
mov r13d, 0x2000
call fcn.0047c0a6
xor edi, edi
mov r14, rax
mov ecx, dword [rsi + 0x80]
lea rdx, [r14 + rdi]
mov r8d, r13d
sub r8d, edi
call sub.msvcrt.dll__read_1
cdqe
cmp rax, 0
jle 0x444494
add rdi, rax
cmp r13, rdi
jne 0x444452
test r15b, r15b
jne 0x44450d
add r13, r13
mov rcx, r14
lea rdx, [r13 + 0x10]
call fcn.0047c14c
mov r14, rax
jmp 0x444452
jne 0x444512
cmp r13, rdi
je 0x4444bd
test r15b, r15b
je 0x4444bd
mov rax, qword [rsi + 8]
lea r9, str._s_is_shorter_than_expected
mov r8d, r12d
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.0043f5b0
lea rax, [rsi + 0x60]
mov rdx, qword [rbp + 0x480]
lea r9, [r13 + 0x10]
mov qword [rsp + 0x20], rdi
mov r8, r14
mov rcx, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsi + 0x30]
mov qword [rsp + 0x28], rax
call fcn.0043b0d0
or byte [rsi + 0x8a], 8
mov qword [rsi + 0x28], rax
jmp 0x4443ad
mov r13, qword [rsi + 0x60]
mov r15d, 1
lea rcx, [r13 + 0x10]
jmp 0x444448
mov rdi, r13
jmp 0x4444bd
mov r8, qword [rsi + 8]
mov r9d, r12d
mov edx, 3
mov rcx, rbp
mov ebx, 1
call fcn.0043f690
mov rcx, r14
call fcn.00494cb8
jmp 0x4443ad
Function at 0x448730
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movzx eax, byte [rcx + 4]
mov rsi, rcx
mov rdi, rdx
mov rcx, rax
shl rax, 4
mov rdx, rax
lea rax, [0x004fa4c0]
add rax, rdx
mov edx, dword [rax]
cmp edx, 1
je 0x448790
jb 0x448800
cmp edx, 2
jne 0x448780
mov r8d, dword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov r9, rdi
mov edx, 1
call sub.msvcrt.dll_fwrite
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi + 8]
mov edx, dword [rax + 8]
mov rbp, qword [rax]
test edx, edx
je 0x448780
xor ebx, ebx
lea r12, [rsp + 0x26]
jmp 0x4487e3
mov rcx, r12
call fcn.00447490
mov r9, rdi
mov r8d, 0xa
mov edx, 1
mov rcx, r12
lea rbx, [rax + rbx - 1]
call sub.msvcrt.dll_fwrite
mov rax, qword [rsi + 8]
add rbx, 1
mov edx, dword [rax + 8]
cmp rdx, rbx
jbe 0x448780
lea rdx, [rbp + rbx]
test byte [rdx], 0x80
jne 0x4487b0
mov rax, qword [rax]
mov rdx, rdi
movzx ecx, byte [rax + rbx]
call sub.msvcrt.dll_fputc
jmp 0x4487d3
movzx edx, word [rsi + 6]
test dl, 2
jne 0x448833
and edx, 0x10
jne 0x448790
mov rbx, qword [rax + 8]
movzx ecx, byte [rbx]
add rbx, 1
mov rdx, rdi
call sub.msvcrt.dll_putc
movzx ecx, byte [rbx]
test ecx, ecx
jne 0x448815
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
sub ecx, 0x26
lea rax, [0x004faa40]
movsxd rcx, ecx
mov rbx, qword [rax + rcx*8]
jmp 0x448812
Function at 0x451dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, dword [rdx + 0x18]
mov rsi, rcx
mov rbx, rdx
test eax, eax
je 0x451de0
cmp qword [rdx + 8], 0
je 0x451df0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp byte [rcx + 0x44a], 0
movzx r12d, byte [rcx + 0x45d]
mov byte [rcx + 0x44a], 0
mov ecx, 0x800
setne r13b
call fcn.0047c0a6
mov qword [rbx + 8], rax
cmp byte [rsi + 0x45d], 0
je 0x451e2f
mov ecx, 0x400
call fcn.0047c0a6
mov qword [rbx + 0x28], rax
mov eax, dword [rbx + 0x18]
test r12b, r12b
mov rbp, qword [rbx]
lea edi, [rax + 1]
jne 0x451ef0
lea rcx, [rsi + 0x88]
call fcn.0044e720
lea rdx, [rbp + rdi*8]
mov dword [rax + 0x30], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdx
mov edx, dword [rbx + 0x1c]
mov ebp, 0x100
lea r12, [rsp + 0x3c]
jmp 0x451e93
test rcx, rcx
je 0x451f54
mov qword [rcx + r8*8], rax
add edx, 1
mov dword [rbx + 0x1c], edx
lea edi, [rdx + 1]
cmp rdi, rbp
ja 0x451f10
mov rdx, r12
mov rcx, rsi
call fcn.00450f70
cmp byte [rax + 4], 0x16
je 0x451f60
mov r8d, dword [rbx + 0x1c]
cmp byte [rsi + 0x45d], 0
mov rcx, qword [rbx + 8]
mov rdx, r8
je 0x451e80
test rcx, rcx
je 0x451f54
mov r9, qword [rbx + 0x28]
mov r10d, dword [rsp + 0x3c]
mov qword [rcx + r8*8], rax
lea r9, [r9 + r8*4]
test r9, r9
je 0x451e8d
mov dword [r9], r10d
mov edx, dword [rbx + 0x1c]
jmp 0x451e8d
mov r9, qword [rbx + 0x20]
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
mov rcx, rsi
call fcn.0044e790
jmp 0x451e71
mov rcx, qword [rbx + 8]
mov rdx, rdi
lea rbp, [rdi + rdi]
shl rdx, 4
call fcn.0047c14c
mov qword [rbx + 8], rax
cmp byte [rsi + 0x45d], 0
je 0x451e9b
mov rcx, qword [rbx + 0x28]
lea rdx, [rdi*8]
test rcx, rcx
je 0x451f74
call fcn.0047c14c
mov qword [rbx + 0x28], rax
jmp 0x451e9b
mov qword [0], rax
ud2
mov rcx, rsi
call fcn.0044ebf0
mov byte [rsi + 0x44a], r13b
jmp 0x451de0
mov rcx, rdx
call fcn.0047c0a6
mov qword [rbx + 0x28], rax
jmp 0x451e9b

Function at 0x453620
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 8]
mov r12d, dword [rsp + 0x90]
mov rdi, rcx
mov rbp, rdx
mov esi, r8d
mov r13d, r9d
test eax, eax
je 0x4536c0
xor ebx, ebx
jmp 0x453683
test r13d, r13d
je 0x45365d
lea eax, [rsi + rax]
cmp r13d, eax
jb 0x4536d3
add esi, 1
mov rdx, rbp
mov ecx, 0x20
add esi, r14d
call sub.msvcrt.dll_fputc
mov rdx, rbp
mov rcx, r15
add ebx, 1
call sub.msvcrt.dll_fputs
cmp dword [rdi + 8], ebx
je 0x4536c0
mov rdx, qword [rdi]
mov eax, ebx
cmp r12d, ebx
mov r15, qword [rdx + rax*8]
jbe 0x4536a4
mov rcx, r15
call sub.msvcrt.dll_strlen
test esi, esi
mov r14, rax
jne 0x453650
mov esi, eax
jmp 0x453670
mov rcx, r15
xor r8d, r8d
xor edx, edx
call fcn.004534c0
mov r15, rax
jmp 0x453691
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x004fb780]
mov r9, rbp
mov r8d, 3
mov edx, 1
mov esi, 1
call sub.msvcrt.dll_fwrite
jmp 0x453660
Function at 0x458430
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
mov r8d, 0
mov ecx, eax
call fcn.00489120
test rax, rax
jns 0x458489
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov edx, dword [rax]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x30]
mov r8d, edx
lea rdx, str.lseek
call rax
mov eax, 0
jmp 0x45857f
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x28]
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.00456530
mov rdx, rax
mov rax, qword [rbp + 0x40]
mov qword [rax + 8], rdx
mov rax, qword [rbp + 0x40]
mov rax, qword [rax + 8]
test rax, rax
jne 0x4584c9
mov eax, 0
jmp 0x45857f
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x40]
mov qword [rax], rdx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x28]
mov ecx, eax
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax + 8]
mov eax, dword [rbp + 0x18]
mov r8d, ecx
mov ecx, eax
call sub.msvcrt.dll__read_1
cdqe
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jns 0x458542
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov edx, dword [rax]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x30]
mov r8d, edx
lea rdx, str.read
call rax
mov rax, qword [rbp + 0x40]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.00494cb8
mov eax, 0
jmp 0x45857f
mov rax, qword [rbp - 8]
cmp qword [rbp + 0x28], rax
jbe 0x45857a
mov rcx, qword [rbp + 0x38]
mov rax, qword [rbp + 0x30]
mov r8d, 0
lea rdx, str.file_too_short
call rax
mov rax, qword [rbp + 0x40]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.00494cb8
mov eax, 0
jmp 0x45857f
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x474770
Capabilities:
Hash data with md5

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov dword [rax], 0x67452301
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 0
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x10], edx
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x18], 0
nop
pop rbp
ret