joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007808
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp dword [0x1401631b8], 0
jne 0x14000797a
lea rcx, [0x140089eb2]
call fcn.140002156
mov rcx, rax
test rax, rax
je 0x14000797a
lea rdx, [0x14000139c]
lea rdi, [0x1401632e0]
call fcn.1400036be
mov r8d, 1
lea rcx, [0x140087968]
mov rdx, rax
call fcn.140003102
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov rax, qword [0x14014eea0]
lea r9, [0x14003323e]
mov qword [rsp + 0x20], rax
call fcn.1400629c6
mov rax, qword [0x140163300]
sub rax, qword [0x1401632f8]
cmp rax, 0x13
ja 0x14000789d
mov edx, 0x14
mov rcx, rdi
call fcn.1400629fb
mov rax, qword [0x1401632f8]
movabs rdx, 0x5f5443454c4c4f43
movabs rcx, 0x504152575f4f544c
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov rcx, qword [0x140087968]
mov dword [rax + 0x10], 0x3d524550
mov rax, qword [0x1401632f8]
lea rsi, [rax + 0x14]
mov qword [0x1401632f8], rsi
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov rax, qword [0x140163300]
sub rax, rsi
cmp rax, rbx
jae 0x140007902
mov rdx, rbx
mov rcx, rdi
call fcn.1400629fb
mov rcx, rbx
mov rsi, qword [0x140087968]
mov rdi, qword [0x1401632f8]
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [0x1401632f0]
add rbx, qword [0x1401632f8]
cmp rbx, rcx
jne 0x14000792f
or byte [0x140163330], 2
mov rax, qword [0x140163310]
mov rdx, qword [0x1401632e8]
add rbx, rax
not rax
and rbx, rax
mov rax, qword [0x140163300]
mov r8, rbx
mov r9, rax
sub r8, rdx
sub r9, rdx
cmp r9, r8
cmovb rbx, rax
mov qword [0x1401632f8], rbx
mov qword [0x1401632f0], rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.14000554d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x140011780
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r14, str._w64devkit
lea r15, str._ROOT
mov r12, rcx
mov dl, byte [r12]
cmp dl, 0x40
je 0x1400117b8
cmp dl, 0x24
jne 0x140011880
mov eax, 1
mov cl, byte [r12 + rax]
mov r13, rax
inc rax
cmp cl, 0x2f
setne r9b
test cl, cl
setne r8b
test r9b, r8b
je 0x1400117de
cmp cl, 0x5c
jne 0x1400117bd
lea rax, [r13 + 0xf]
lea rcx, [r13 - 1]
and rax, 0xfffffffffffffff0
call fcn.14006aac0
sub rsp, rax
lea rsi, [r12 + 1]
mov ecx, ecx
lea rax, [rsp + 0x20]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov byte [rax + r13 - 1], 0
cmp dl, 0x40
jne 0x14001184c
xor r8d, r8d
mov rdx, r15
mov rcx, rax
call fcn.140060e90
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_getenv
mov rbx, rax
test rax, rax
jne 0x140011836
mov rbx, qword [str._3_t_]
mov rcx, rsi
call fcn.140074210
test rbx, rbx
jne 0x14001185e
mov rbx, qword [str._3_t_]
jmp 0x140011857
mov rcx, rax
call sub.msvcrt.dll_getenv
mov rbx, rax
test rbx, rbx
cmove rbx, r14
lea rdx, [r12 + r13]
mov rcx, rbx
xor r8d, r8d
call fcn.140060e90
mov rcx, r12
mov rbx, rax
call fcn.140074210
mov r12, rbx
jmp 0x1400117a6
mov rax, r12
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140023095
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.COLUMNS
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x1400230b6
call sub.msvcrt.dll_atoi
test eax, eax
jg 0x1400230bb
mov eax, 0x7fffffff
add rsp, 0x28
ret

Function at 0x140023109
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x48
mov esi, edx
call fcn.1400644b3
xor edx, edx
mov qword [rbx], rax
mov rcx, rax
call fcn.14002e298
lea rdx, [rbx + 0x10]
xor eax, eax
mov ecx, 0xf
mov rdi, rdx
rep stosd dword [rdi], eax
mov dword [rbx + 0x50], esi
movsxd rcx, esi
mov byte [rbx + 0x4c], 0
shl rcx, 2
call fcn.1400644b3
mov byte [rbx + 0x7c], 0
mov rdx, rax
mov qword [rbx + 0x58], rax
xor eax, eax
test esi, esi
cmovns eax, esi
mov rdi, rdx
xor esi, esi
movsxd rcx, eax
xor eax, eax
shl rcx, 2
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, rbx
xor edi, edi
mov edx, dword [rax + 0x28]
call fcn.1400230c0
xor r11d, r11d
xor ecx, ecx
xor r8d, r8d
lea rax, [0x140025ea3]
xor r9d, r9d
xor r10d, r10d
mov qword [rbx + 0x8c], rcx
mov qword [rbx + 0xa8], rax
lea rax, [0x140024ca4]
lea rcx, str.GCC_EXTRA_DIAGNOSTIC_OUTPUT
mov qword [rbx + 0xb0], rax
lea rax, [0x140022b67]
mov qword [rbx + 0xb8], rax
xor eax, eax
mov dword [rbx + 0x110], eax
xor eax, eax
mov dword [rbx + 0x100], esi
mov dword [rbx + 0x84], 0x5e5e5e
mov byte [rbx + 0x88], 0
mov word [rbx + 0x94], 0
mov dword [rbx + 0x98], r8d
mov word [rbx + 0x9c], 0
mov byte [rbx + 0x9e], 0
mov dword [rbx + 0xa0], r9d
mov qword [rbx + 0xc0], r10
mov qword [rbx + 0xc8], r11
mov qword [rbx + 0xd0], r11
mov qword [rbx + 0xd8], r11
mov qword [rbx + 0xe0], r11
mov qword [rbx + 0x108], rdi
mov qword [rbx + 0xf8], rdi
mov qword [rbx + 0x118], rax
mov word [rbx + 0x120], 0
call sub.msvcrt.dll_getenv
mov rsi, rax
test rax, rax
je 0x140023299
lea rdx, str.fixits_v1
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14002327c
mov dword [rbx + 0x124], 1
jmp 0x140023299
lea rdx, str.fixits_v2
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140023299
mov dword [rbx + 0x124], 2
mov eax, 1
xor edx, edx
mov qword [rbx + 0x130], 8
shl rax, 0x20
mov qword [rbx + 0x168], rdx
mov qword [rbx + 0x128], rax
xor eax, eax
mov qword [rbx + 0x138], rax
mov qword [rbx + 0x140], rax
mov qword [rbx + 0x148], rax
mov qword [rbx + 0x150], rax
lea rax, [0x140022bbb]
mov qword [rbx + 0x158], rax
mov qword [rbx + 0x170], rdx
mov qword [rbx + 0x178], rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140025ee0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.GCC_COLORS
call sub.msvcrt.dll_getenv
mov rbx, rax
test rax, rax
je 0x140025ffc
xor eax, eax
cmp byte [rbx], 0
je 0x140025ffe
lea r14, [rbx + 1]
xor r12d, r12d
xor r13d, r13d
xor esi, esi
mov al, byte [r14 - 1]
lea rdx, [r14 - 1]
test al, al
je 0x140025f31
cmp al, 0x3a
jne 0x140025fd3
test rsi, rsi
je 0x140025f3e
sub rdx, rsi
mov r12, rdx
jmp 0x140025f44
sub rdx, rbx
mov r13, rdx
lea rbp, [0x140087b40]
mov rcx, qword [rbp]
test rcx, rcx
je 0x140025f6c
movzx eax, byte [rbp + 0x10]
cmp rax, r13
jne 0x140025f7c
mov r8, r13
mov rdx, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140025f7c
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x140025fbf
test rcx, rcx
jne 0x140025f82
jmp 0x140025fbf
add rbp, 0x18
jmp 0x140025f4b
cmp byte [rbp + 0x11], 0
je 0x140025f8d
call fcn.140074210
lea rcx, [r12 + 7]
call fcn.1400644b3
mov rcx, r12
lea rdx, [rax + 2]
mov word [rax], 0x5b1b
mov rdi, rdx
lea rdx, [rax + r12 + 2]
rep movsb byte [rdi], byte [rsi]
mov dword [rdx], 0x4b5b1b6d
mov byte [rdx + 4], 0
mov qword [rbp + 8], rax
mov byte [rbp + 0x11], 1
cmp byte [r14 - 1], 0
je 0x140025ffc
mov rbx, r14
xor esi, esi
inc r14
jmp 0x140025f1d
cmp al, 0x3d
jne 0x140025fec
cmp rdx, rbx
je 0x140025ffc
test rsi, rsi
jne 0x140025ffc
sub rdx, rbx
mov rsi, r14
mov r13, rdx
jmp 0x140025fcb
test rsi, rsi
je 0x140025fcb
cmp al, 0x3b
je 0x140025fcb
sub eax, 0x30
cmp al, 9
jbe 0x140025fcb
mov al, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
sub rsp, 0x38
cmp ecx, 1
je 0x1400260c6
cmp ecx, 2
je 0x14002609f
test ecx, ecx
je 0x1400260cf
lea r8, str.colorize_init
mov edx, 0xf2
lea rcx, str._gcc_13.2.0_gcc_diagnostic_color.cc
call fcn.140085ed0
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400260cf
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1400260cf
add rsp, 0x38
jmp 0x140025ee0
xor eax, eax
add rsp, 0x38
ret
Function at 0x140026075
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.GCC_COLORS
call sub.msvcrt.dll_getenv
mov rbx, rax
test rax, rax
je 0x140025ffc
xor eax, eax
cmp byte [rbx], 0
je 0x140025ffe
lea r14, [rbx + 1]
xor r12d, r12d
xor r13d, r13d
xor esi, esi
mov al, byte [r14 - 1]
lea rdx, [r14 - 1]
test al, al
je 0x140025f31
cmp al, 0x3a
jne 0x140025fd3
test rsi, rsi
je 0x140025f3e
sub rdx, rsi
mov r12, rdx
jmp 0x140025f44
sub rdx, rbx
mov r13, rdx
lea rbp, [0x140087b40]
mov rcx, qword [rbp]
test rcx, rcx
je 0x140025f6c
movzx eax, byte [rbp + 0x10]
cmp rax, r13
jne 0x140025f7c
mov r8, r13
mov rdx, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140025f7c
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x140025fbf
test rcx, rcx
jne 0x140025f82
jmp 0x140025fbf
add rbp, 0x18
jmp 0x140025f4b
cmp byte [rbp + 0x11], 0
je 0x140025f8d
call fcn.140074210
lea rcx, [r12 + 7]
call fcn.1400644b3
mov rcx, r12
lea rdx, [rax + 2]
mov word [rax], 0x5b1b
mov rdi, rdx
lea rdx, [rax + r12 + 2]
rep movsb byte [rdi], byte [rsi]
mov dword [rdx], 0x4b5b1b6d
mov byte [rdx + 4], 0
mov qword [rbp + 8], rax
mov byte [rbp + 0x11], 1
cmp byte [r14 - 1], 0
je 0x140025ffc
mov rbx, r14
xor esi, esi
inc r14
jmp 0x140025f1d
cmp al, 0x3d
jne 0x140025fec
cmp rdx, rbx
je 0x140025ffc
test rsi, rsi
jne 0x140025ffc
sub rdx, rbx
mov rsi, r14
mov r13, rdx
jmp 0x140025fcb
test rsi, rsi
je 0x140025fcb
cmp al, 0x3b
je 0x140025fcb
sub eax, 0x30
cmp al, 9
jbe 0x140025fcb
mov al, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
sub rsp, 0x38
cmp ecx, 1
je 0x1400260c6
cmp ecx, 2
je 0x14002609f
test ecx, ecx
je 0x1400260cf
lea r8, str.colorize_init
mov edx, 0xf2
lea rcx, str._gcc_13.2.0_gcc_diagnostic_color.cc
call fcn.140085ed0
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400260cf
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1400260cf
add rsp, 0x38
jmp 0x140025ee0
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400260d6
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
cmp ecx, 1
je 0x140026100
and esi, 0xfffffffd
je 0x14002615c
lea r8, str.determine_url_format
mov edx, 0x15d
lea rcx, str._gcc_13.2.0_gcc_diagnostic_color.cc
call fcn.140085ed0
lea rcx, str.GCC_URLS
call sub.msvcrt.dll_getenv
mov rbx, rax
test rax, rax
jne 0x14002612f
lea rcx, str.TERM_URLS
call sub.msvcrt.dll_getenv
mov rbx, rax
test rax, rax
jne 0x14002612f
mov esi, 2
jmp 0x14002615e
cmp byte [rbx], 0
je 0x14002615c
lea rdx, [0x1400f95b8]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14002615c
lea rdx, [0x1400f95bb]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140026128
jmp 0x14002615e
xor esi, esi
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14002d6dc
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rbp, rdx
mov rsi, r8
mov rbx, r8
lea r12, [rsp + 0x3c]
test rbx, rbx
je 0x14002d738
mov eax, 0xffffffff
mov rdx, rsi
mov r9, r12
mov rcx, rdi
cmp rbx, rax
cmovbe rax, rbx
sub rdx, rbx
add rdx, rbp
mov dword [rsp + 0x3c], eax
mov r8, rax
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002d738
mov eax, dword [rsp + 0x3c]
sub rbx, rax
jmp 0x14002d6f7
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400310ae
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
call sub.msvcrt.dll_feof
test eax, eax
je 0x1400310c8
xor eax, eax
jmp 0x140031117
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x1400310c4
mov rcx, rbx
call fcn.14003101e
mov rax, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x18]
mov edx, 1
mov r8, qword [rbx + 0x28]
mov r9, qword [rbx + 0x10]
add rcx, rax
sub r8, rax
call sub.msvcrt.dll_fread
mov rcx, qword [rbx + 0x10]
mov rsi, rax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x1400310c4
add qword [rbx + 0x30], rsi
test rsi, rsi
setne al
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x14003111e
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.140030fea
test al, al
je 0x140031134
add rsp, 0x28
jmp fcn.1400310ae
xor eax, eax
add rsp, 0x28
ret

Function at 0x14003fcb0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r13w, word [rdx + 0x4e]
and r13w, 0xf000
mov rdi, rcx
mov rbx, rdx
mov r14d, r8d
mov r15, r9
cmp r13w, 0x3000
jne 0x14003fd07
test rcx, rcx
je 0x14003fd8b
mov rax, qword [rdx + 8]
lea r9, str._s_is_a_block_device
mov edx, 3
mov qword [rsp + 0x20], rax
call fcn.14003c2fb
jmp 0x14003fd8b
mov esi, 0x2000
cmp r13w, 0x8000
jne 0x14003fd18
mov rsi, qword [rdx + 0x60]
lea rcx, [rsi + 0x10]
xor r12d, r12d
call fcn.1400644b3
mov rbp, rax
mov ecx, dword [rbx + 0x80]
mov r8d, esi
lea rdx, [rbp + r12]
sub r8d, r12d
call sub.msvcrt.dll__read_1
cdqe
test rax, rax
jle 0x14003fd68
add r12, rax
cmp rsi, r12
jne 0x14003fd27
cmp r13w, 0x8000
je 0x14003fd8f
add rsi, rsi
mov rcx, rbp
lea rdx, [rsi + 0x10]
call fcn.140064525
mov rbp, rax
jmp 0x14003fd27
je 0x14003fd8f
test rdi, rdi
je 0x14003fd83
mov r8, qword [rbx + 8]
mov r9d, r14d
mov edx, 3
mov rcx, rdi
call fcn.14003c3d8
mov rcx, rbp
call fcn.140074210
xor ecx, ecx
jmp 0x14003fe0d
cmp r13w, 0x8000
sete dl
test rdi, rdi
setne al
test dl, al
je 0x14003fdc4
cmp rsi, r12
je 0x14003fdc4
mov rax, qword [rbx + 8]
lea r9, str._s_is_shorter_than_expected
mov r8d, r14d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.14003c2fb
lea rax, [rbx + 0x60]
mov qword [rsp + 0x20], r12
mov rdx, r15
mov rcx, rdi
mov qword [rsp + 0x30], rax
lea rax, [rbx + 0x30]
lea r9, [rsi + 0x10]
mov r8, rbp
mov qword [rsp + 0x28], rax
call fcn.1400370c4
test rax, rax
mov qword [rbx + 0x28], rax
mov al, byte [rbx + 0x8a]
setne cl
mov edx, ecx
and eax, 0xfffffffb
shl edx, 2
or eax, edx
mov byte [rbx + 0x8a], al
mov eax, ecx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140040e83
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rsi
push rbx
sub rsp, 0x40
mov ebp, dword [rsp + 0x90]
mov rbx, rcx
mov r13d, r8d
mov esi, r9d
cmp r9d, 3
jne 0x140040ebd
mov rax, qword [rcx + 0x1c0]
mov rcx, qword [rcx + 0x1e8]
cmp rax, qword [rcx + 0x10]
je 0x140040ebd
xor ecx, ecx
mov dword [rax - 0x20], ecx
mov r8d, r13d
mov r9d, esi
mov rcx, rbx
mov qword [rsp + 0x38], rdx
call fcn.14003ff3d
mov r8, rax
test rax, rax
je 0x140040f25
cmp esi, 4
mov dword [rsp + 0x28], ebp
mov rdx, qword [rsp + 0x38]
mov r9d, r13d
sete al
sete r12b
mov rcx, rbx
movzx eax, al
add eax, eax
mov dword [rsp + 0x20], eax
call fcn.140040158
mov rdx, rax
test rax, rax
jne 0x140040f0c
test r12b, r12b
jne 0x140040f25
mov r9d, ebp
mov r8d, esi
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rbp
pop r12
pop r13
jmp fcn.140040a0a
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rbp
pop r12
pop r13
ret

Function at 0x140043c18
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movzx eax, byte [rcx + 4]
movzx r8d, al
shl r8, 4
mov rsi, rdx
lea rdx, [0x140147900]
mov rbx, rcx
add rdx, r8
mov r8d, dword [rdx]
cmp r8d, 1
je 0x140043c97
cmp r8d, 2
je 0x140043cf7
test r8d, r8d
jne 0x140043d3a
mov ecx, dword [rbx + 8]
test cl, 2
je 0x140043c74
sub eax, 0x26
lea rdx, [0x140147e80]
cdqe
mov rbx, qword [rdx + rax*8]
jmp 0x140043c7d
and cl, 0x10
jne 0x140043c97
mov rbx, qword [rdx + 8]
movzx ecx, byte [rbx]
mov rdx, rsi
inc rbx
call sub.msvcrt.dll_putc
movzx ecx, byte [rbx]
test ecx, ecx
jne 0x140043c80
jmp 0x140043d3a
mov rax, qword [rbx + 0x10]
xor edi, edi
lea rbp, [rsp + 0x26]
mov r12, qword [rax]
mov rax, qword [rbx + 0x10]
mov edx, dword [rax + 8]
cmp rdi, rdx
jae 0x140043d3a
lea rdx, [r12 + rdi]
cmp byte [rdx], 0
jns 0x140043ce3
mov rcx, rbp
call fcn.140042a9e
mov r9, rsi
mov edx, 1
mov rcx, rbp
mov r8d, 0xa
lea rdi, [rdi + rax - 1]
call sub.msvcrt.dll_fwrite
jmp 0x140043cf2
mov rax, qword [rax]
mov rdx, rsi
movzx ecx, byte [rax + rdi]
call sub.msvcrt.dll_fputc
inc rdi
jmp 0x140043ca5
cmp al, 0x45
jne 0x140043d08
mov rdx, rsi
mov ecx, 0x22
call sub.msvcrt.dll_fputc
mov rcx, qword [rbx + 0x18]
mov r8d, dword [rbx + 0x10]
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp byte [rbx + 4], 0x45
jne 0x140043d3a
mov rdx, rsi
mov ecx, 0x22
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_fputc
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400515d0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
mov r12d, edx
mov rbp, rcx
mov rdx, r8
xor r8d, r8d
mov ecx, r12d
mov rsi, r9
call fcn.14006b7f0
test rax, rax
jns 0x14005161c
call qword [sym.imp.msvcrt.dll__errno]
mov rcx, qword [rsp + 0x78]
lea rdx, str.lseek
mov r8d, dword [rax]
call rdi
jmp 0x140051638
mov r9, qword [rsp + 0x78]
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.140050520
mov qword [rbx + 8], rax
test rax, rax
jne 0x14005163c
xor eax, eax
jmp 0x14005169f
mov qword [rbx], rax
xor ebp, ebp
mov qword [rbx + 0x10], rsi
cmp rbp, rsi
jae 0x14005167c
mov rdx, qword [rbx + 8]
mov r8d, esi
mov ecx, r12d
sub r8d, ebp
call sub.msvcrt.dll__read_1
cdqe
test rax, rax
jns 0x140051675
call qword [sym.imp.msvcrt.dll__errno]
lea rdx, str.read
mov r8d, dword [rax]
jmp 0x14005168d
je 0x140051683
add rbp, rax
jmp 0x140051645
mov eax, 1
jmp 0x14005169f
xor r8d, r8d
lea rdx, str.file_too_short
mov rcx, qword [rsp + 0x78]
call rdi
mov rcx, qword [rbx + 8]
call fcn.140074210
jmp 0x140051638
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400606d6
Capabilities:
Read file on windows

Disassembly:
push r13
mov eax, 0x1118
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14006aac0
sub rsp, rax
mov r13d, 0x1000
lea rdi, [rsp + 0x2c]
mov rsi, rcx
mov rbp, rdx
mov rcx, rdi
lea r12, [rsp + 0xc8]
call fcn.14005fc20
xor ebx, ebx
mov r8, r13
lea rcx, [r12 + rbx]
mov r9, rsi
mov edx, 1
sub r8, rbx
call sub.msvcrt.dll_fread
add rbx, rax
cmp rbx, 0xfff
ja 0x140060738
test rax, rax
jne 0x14006070e
jmp 0x14006073d
test rax, rax
jne 0x14006074d
mov rcx, rsi
call sub.msvcrt.dll_ferror
mov esi, eax
test eax, eax
je 0x14006075f
jmp 0x14006077f
mov r8, rdi
mov edx, 0x1000
mov rcx, r12
call fcn.14005fc59
jmp 0x14006070c
test rbx, rbx
je 0x140060772
mov r8, rdi
mov rdx, rbx
mov rcx, r12
call fcn.14006056a
mov rdx, rbp
mov rcx, rdi
call fcn.1400604eb
jmp 0x140060784
mov esi, 1
mov eax, esi
add rsp, 0x1118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140062729
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp qword [0x140166b20], 0
jne 0x140062799
mov rsi, qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor edx, edx
xor ecx, ecx
call rsi
mov ebx, eax
test eax, eax
je 0x14006277c
mov ecx, eax
call fcn.1400644b3
mov ecx, ebx
mov qword [0x140166b20], rax
mov rdx, rax
call rsi
test eax, eax
jne 0x14006277c
mov rcx, qword [0x140166b20]
call fcn.140074210
xor eax, eax
mov qword [0x140166b20], rax
jmp 0x140062786
cmp qword [0x140166b20], 0
jne 0x140062799
lea rcx, [0x14014b7e8]
call fcn.1400645c0
mov qword [0x140166b20], rax
mov rax, qword [0x140166b20]
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x14006354a
Capabilities:
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov edx, dword [rcx + 0x18]
mov rbx, rcx
test edx, edx
jle 0x140063564
mov rax, qword [rcx + 0x80]
call qword [rax + 0x18]
mov edx, dword [rbx + 0x2c]
test edx, edx
jle 0x140063578
mov rax, qword [rbx + 0x80]
mov rcx, rbx
call qword [rax + 0x18]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x140063586
call sub.msvcrt.dll_fclose
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x140063594
call sub.msvcrt.dll_fclose
cmp qword [rbx + 0x40], 0
jne 0x1400635b5
and dword [rbx], 0xfffffffe
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x28]
mov rcx, rbx
mov edx, 1
call fcn.140062b90
cmp dword [rbx + 0x28], 0
je 0x1400635c4
mov rcx, qword [rbx + 0x20]
call fcn.140074210
mov rcx, qword [rbx + 0x38]
xor esi, esi
call fcn.140074210
mov rcx, qword [rbx + 0x40]
call fcn.140074210
mov rcx, qword [rbx + 0x48]
call fcn.140074210
cmp dword [rbx + 0x70], 0
jle 0x140063610
mov rcx, qword [rbx + 0x78]
cmp dword [rbx + 0x70], esi
jle 0x14006360b
mov rcx, qword [rcx + rsi*8]
call sub.msvcrt.dll_remove
mov rax, qword [rbx + 0x78]
mov rcx, qword [rax + rsi*8]
inc rsi
call fcn.140074210
jmp 0x1400635e7
call fcn.140074210
mov rax, qword [rbx + 0x80]
mov rax, qword [rax + 0x40]
test rax, rax
je 0x140063625
mov rcx, rbx
call rax
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140074210
Function at 0x14006a114
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x140166c88]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x140166c84]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x14006a162
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14006a15a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x14006a249
inc ebx
add rax, 0x28
jmp 0x14006a13a
mov rcx, r12
call fcn.14006a941
mov rbp, rax
test rax, rax
jne 0x14006a181
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.14006a0b0
movsxd rbx, ebx
mov rax, qword [0x140166c88]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14006a9ef
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140166c88]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14006a1e3
mov rax, qword [0x140166c88]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14006a0b0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14006a243
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14006a243
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140166c88]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14006a243
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14006a0b0
inc dword [0x140166c84]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14006a670
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140166ce0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140166cc0]
test rbx, rbx
je 0x14006a6bc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x14006a6b6
test eax, eax
jne 0x14006a6b6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x14006a68e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14006a870
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14006a893
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x14006a893
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14006a894
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14006a8ce
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x14006a8c5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14006a8d0
inc r8d
add rax, 0x28
jmp 0x14006a8ac
xor eax, eax
ret