joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401aa8c0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
lea rdi, [rsp + 0x40]
mov ecx, Ordinal_41
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf0]
mov rax, qword [0x14021ab88]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xb4], 8
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1401aa936
xor al, al
jmp 0x1401aaa48
mov r8d, reloc.WS2_32.dll_sendto
xor edx, edx
lea rcx, [rsp + 0x88]
call fcn.14009a1ac
mov byte [rsp + 0x88], 8
mov byte [rsp + 0x89], 2
mov dword [rsp + 0x8c], 0x6601
mov dword [rsp + 0x90], 8
lea rdx, [rsp + 0x94]
mov rcx, qword [rsp + 0x100]
call fcn.1401aa6d0
mov edx, 8
lea rcx, [rsp + 0x94]
call fcn.14009a215
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1401aa9db
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x1401aaa48
mov r8d, 8
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
call fcn.14009961c
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_connect
call fcn.14009a508
mov rax, rdi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400995fe
add rsp, 0xe0
pop rdi
ret

Function at 0x1401abcb0
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, Ordinal_27
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401abd06
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1401abd20
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x20
pop rdi
ret
Function at 0x1401af480
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401af4ef
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
add rsp, 0x30
pop rdi
ret

Function at 0x1401af500
Capabilities:
Hash data via wincrypt

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
add rsp, 0x20
pop rdi
ret
Function at 0x210041060
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors
Get process heap flags
Get process heap force flags
Parse pe header

Disassembly:
mov dword [rsp + 0x448], 0xef148fc6
mov byte [rsp + 0x1a7], 0xbc
movabs rax, 0x2fa2a925418e62f1
mov qword [rsp + 0x4a0], rax
movabs rax, 0xe996639054721469
mov qword [rsp + 0x4a8], rax
mov byte [rsp + 0x150], 0xce
mov qword [rsp + 0x2f0], 0
movabs rax, 0x76c1d751538b6730
mov qword [rsp + 0x4b0], rax
mov byte [rsp + 0x151], 0x3f
movabs rax, 0xeb59176096ce59b2
mov qword [rsp + 0x4b8], rax
mov rax, qword gs:[0x30]
mov qword [rsp + 0x2f0], rax
mov byte [rsp + 0x152], 0x81
mov dword [rsp + 0x44c], 0x9437a1
mov dword [rsp + 0x450], 0x76a67547
mov dword [rsp + 0x454], 0xa3bee54b
mov dword [rsp + 0x498], 0x51aa6f43
mov byte [rsp + 0x153], 0xb2
movabs rax, 0xcb0e8e9307c1c6bc
invalid
invalid

Function at 0x210041290
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
add byte [rax], al
movabs rax, 0x338037bc034db8f0
mov qword [rsp + 0x4f8], rax
mov byte [rsp + 0x159], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x4c
mov dword [rsp + 0x30c], 0xb26e61e3
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x33
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x32
mov byte [rsp + 0x15a], 0xac
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x2e
add dword [rax], eax
add byte [rsi], ch
mov dword [rsp + 0x310], 0x7856f6d1
mov byte [rsp + 0x15b], 0xdb
mov byte [rsp + 0x15c], 0x40
mov dword [rsp + 0x314], 0x874c6df8
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x44
movabs rax, 0xf4e11a3b8eedbeff
mov qword [rsp + 0x500], rax
mov dword [rsp + 0x318], 0xcc5f1053
mov byte [rsp + 0x15d], 0x5b
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x4c
movabs rax, 0xa48444ac57e64599
mov qword [rsp + 0x508], rax
mov dword [rsp + 0x31c], 0x50b44218
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0x4c
mov dword [rsp + 0x320], 0x329fd38b
invalid
test byte [rsp], ah
add eax, dword [rax]
Function at 0x210041300
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
add byte [rax], al
movabs rax, 0x338037bc034db8f0
mov qword [rsp + 0x4f8], rax
mov byte [rsp + 0x159], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x1e0], 0x4c
mov dword [rsp + 0x30c], 0xb26e61e3
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x1e0], 0x33
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x1e0], 0x32
mov byte [rsp + 0x15a], 0xac
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x1e0], 0x2e
add dword [rax], eax
add byte [rsi], ch
mov dword [rsp + 0x310], 0x7856f6d1
mov byte [rsp + 0x15b], 0xdb
mov byte [rsp + 0x15c], 0x40
mov dword [rsp + 0x314], 0x874c6df8
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x1e0], 0x44
movabs rax, 0xf4e11a3b8eedbeff
mov qword [rsp + 0x500], rax
mov dword [rsp + 0x318], 0xcc5f1053
mov byte [rsp + 0x15d], 0x5b
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1e0], 0x4c
movabs rax, 0xa48444ac57e64599
mov qword [rsp + 0x508], rax
mov dword [rsp + 0x31c], 0x50b44218
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x1e0], 0x4c
mov dword [rsp + 0x320], 0x329fd38b
invalid
test byte [rsp], ah
add eax, dword [rax]
Function at 0x210043e50
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [0x21034b1a0]
mov rsi, rcx
mov rbx, r8
test byte [rax + 0x11], 0x40
jne 0x210043ed0
cmp qword [rsi + 8], 0
lea rcx, [rsp + 0x28]
je 0x210043eb0
call sym.QueryPerformanceCounter
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsi + 8]
cqo
idiv rcx
mov qword [rbx], rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rcx
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea r12, [rsp + 0x28]
mov rcx, r12
call sym.QueryPerformanceFrequency
mov rax, qword [rsp + 0x28]
xchg qword [rsi + 8], rax
mov rcx, r12
jmp 0x210043e77
lea rcx, [rsp + 0x28]
call fcn.21022d080
mov rcx, qword [rsp + 0x28]
movabs rdx, 0xd6bf94d5e57a42bd
mov rax, rcx
mul rdx
shr rdx, 0x17
mov qword [rbx], rdx
imul rdx, rdx, 0x989680
sub rcx, rdx
lea rax, [rcx + rcx*4]
lea rax, [rax + rax*4]
shl rax, 2
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
Function at 0x210046750
Capabilities:
Create thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
lea r12, [0x210273880]
mov rbx, rcx
test byte [0x210273880], 1
jne 0x210046840
cmp qword [rbx + 8], 0
je 0x21004687b
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x21004679d
call sym.ResetEvent
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x2100467a6
nop dword [rax]
call sym.yield
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x210046798
call sym.SetEvent
test byte [0x210273880], 1
jne 0x210046800
mov rsi, qword [rbx + 8]
mov eax, dword [rbx + 0x38]
test eax, eax
jne 0x2100467d5
mov qword [rbx + 8], rsi
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
call sym.yield
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x2100467d0
mov edx, 0xffffffff
call sym.WaitForSingleObject
mov rcx, qword [rbx + 0x10]
call sym.ResetEvent
mov qword [rbx + 8], rsi
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
mov eax, dword [rbx + 4]
lea r9, str.activated_name__s__thread_sync__p_for_id__y
mov edx, 0xc0000
mov rcx, r12
lea r8, str.void_cygthread::create__
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100467b4
mov qword [rsp + 0x30], rcx
mov eax, dword [rcx + 4]
mov edx, 0xc0000
lea r9, str.name__s__id__y__this__p
lea r8, str.void_cygthread::create__
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 0x28]
mov rcx, r12
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
cmp qword [rbx + 8], 0
jne 0x21004677a
lea rax, [rbx + 4]
cmp byte [rbx + 0x48], 0
mov qword [rbx + 0x20], 0
lea r8, [method.cygthread.simplestub_void_]
mov qword [rsp + 0x28], rax
lea rax, [method.cygthread.stub_void_]
mov r9, rbx
lea rcx, [0x2102d1cc0]
mov dword [rsp + 0x20], 0
cmove r8, rax
xor edx, edx
call sym.CreateThread
mov rsi, rax
test rax, rax
je 0x210046909
test byte [0x210273880], 1
je 0x2100467b8
mov eax, dword [rbx + 4]
lea r9, str.created_name__s__thread__p__id__y
mov edx, 0xc0000
mov rcx, r12
lea r8, str.void_cygthread::create__
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100467b8
mov rdx, qword [rbx + 0x28]
mov r9d, dword [rbx + 4]
lea rcx, str.CreateThread_failed_for__s____p__y____E
mov r8, qword [rbx + 8]
call sym.api_fatal
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x210046c70
Capabilities:
Terminate thread

Disassembly:
push r14
push r13
push r12
sub rsp, 0x50
lea r14, [0x210273880]
mov r12, rcx
test byte [0x210273880], 1
je 0x210046ca5
jmp 0x210046d50
cmp qword [r12 + 0x20], 0
jne 0x210046cc0
call sym.yield
mov ecx, dword [r12]
test ecx, ecx
jne 0x210046c98
xor r13d, r13d
mov eax, r13d
add rsp, 0x50
pop r12
pop r13
pop r14
ret
mov rcx, qword [r12 + 8]
xor edx, edx
call sym.TerminateThread
mov rcx, qword [r12 + 8]
mov edx, 0xffffffff
call sym.WaitForSingleObject
mov rcx, qword [r12 + 8]
call sym.CloseHandle
mov eax, dword [r12]
test eax, eax
je 0x210046cad
movzx r13d, byte [0x21023d820]
test r13b, r13b
jne 0x210046cad
mov rcx, qword [r12 + 0x10]
test rcx, rcx
je 0x210046d30
mov qword [rsp + 0x20], 0
xor edx, edx
mov r9d, 8
lea r8, [rsp + 0x48]
call sym.NtQueryEvent
test eax, eax
js 0x210046d30
mov edx, dword [rsp + 0x4c]
test edx, edx
jne 0x210046dd8
nop
mov r13d, 1
cmp byte [r12 + 0x48], 0
je 0x210046d8f
mov rcx, r12
call sym.free_1
jmp 0x210046cb0
mov rax, qword [rcx + 0x20]
lea r9, str.thread__s__id__y__inuse__d__stack_ptr__p
mov edx, 0x40
lea r8, str.bool_cygthread::terminate_thread__
mov qword [rsp + 0x38], rax
mov eax, dword [rcx]
mov dword [rsp + 0x30], eax
mov eax, dword [rcx + 4]
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 0x28]
mov rcx, r14
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210046ca5
mov qword [r12 + 8], 0
xor eax, eax
mov qword [r12 + 0x28], 0
mov qword [r12 + 0x30], 0
xchg dword [r12], eax
test eax, eax
jne 0x210046cb0
lea r9, str.released_a_thread_that_was_not_inuse
lea r8, str.void_cygthread::release_bool_
mov edx, 0x8000
mov rcx, r14
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210046cb0
mov rcx, qword [r12 + 0x10]
call sym.ResetEvent
jmp 0x210046d36
Function at 0x210049be0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
cmp byte [0x21024fae5], 0
mov r12, rcx
mov rsi, rdx
mov rbx, r8
je 0x210049c3c
lea rdx, [0x210276238]
call sym.msys_2.0.dll_strstr
test rax, rax
je 0x210049c28
mov rax, qword [0x21023ee48]
mov edx, 4
mov word [rax + 0x10], dx
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
lea rdx, str.cygheap
mov rcx, r12
call sym.msys_2.0.dll_strstr
test rax, rax
jne 0x210049c0b
xor r8d, r8d
xor edx, edx
lea rcx, str.MSYS_MISMATCH_OK
call sym.GetEnvironmentVariableA
test eax, eax
jne 0x210049c1b
movzx eax, si
cmp rbx, rax
jne 0x210049c91
mov qword [rsp + 0x30], rbx
lea r9, str._s_magic_number_mismatch_detected____p__ly
lea r8, str.void_multiple_cygwin_problem_const_char__uintptr_t__uintptr_t_
mov edx, 0x8000
mov qword [rsp + 0x28], rsi
lea rcx, [0x210273880]
mov qword [rsp + 0x20], r12
call method.strace.prntf_unsigned_int__char_const__char_const__..._
nop
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
mov r9, rbx
mov r8, rsi
lea rcx, str._s_mismatch_detected____ly__ly._nThis_problem_is_probably_due_to_using_incompatible_versions_of_the_cygwin_DLL._nSearch_for_cygwin1.dll_using_the_Windows_Start__Find_Search_facility_nand_delete_all_but_the_most_recent_version.__The_most_recent_version_should_nreside_in_x:cygwin_bin__where_x_is_the_drive_on_which_you_have_ninstalled_the_cygwin_distribution.__Rebooting_is_also_suggested_if_you_nare_unable_to_find_another_cygwin_DLL.
mov rdx, r12
call sym.api_fatal
nop
nop word [rax + rax]
Function at 0x21005af70
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
cmp byte [0x21023ee50], 0
mov rbx, rcx
je 0x21005afa8
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.IsDebuggerPresent
test eax, eax
je 0x21005af8f
mov dword [rsp + 0x20], 3
lea rdi, [rsp + 0x40]
xor esi, esi
lea r12, [rsp + 0x70]
mov r9d, 0xd
mov r8, rdi
mov rcx, r12
mov r15d, esi
lea rdx, str.cYgstd__p__zx__x
mov byte [rsp + 0x5a], 0
lea rbp, [0x210285460]
mov byte [rsp + 0x4d], 0
mov byte [rsp + 0x40], 0
call sym.sprintf_1
mov rcx, r12
call sym.OutputDebugStringA
lea rax, [method.fhandler_base.get_handle__]
cmp byte [rdi], 0
mov qword [rsp + 0x38], rax
jne 0x21005b029
add rsi, 1
add rdi, 0xd
cmp rsi, 3
je 0x21005af8f
cmp byte [rdi], 0
mov r15d, esi
je 0x21005b00f
mov r14d, dword [rbp + rsi*4]
mov ecx, r14d
call sym.GetStdHandle
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov r13, rax
call sym.build_fh_name_char_const__unsigned_int__suffix_info_
mov r12, rax
test rax, rax
je 0x21005b00f
mov rax, qword [rbx]
mov qword [rax + rsi*8], r12
mov rax, qword [r12]
mov rax, qword [rax + 0x90]
test rsi, rsi
je 0x21005b0d0
cmp esi, 2
je 0x21005b0a8
mov r8d, 0x1ff
mov edx, 0x10001
mov rcx, r12
call rax
test eax, eax
je 0x21005b0c0
mov rcx, r13
call sym.CloseHandle
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x290]
mov rdx, qword [rax]
mov ecx, r14d
call sym.SetStdHandle
jmp 0x21005b00f
mov r8d, 0x1ff
mov edx, 0x10002
mov rcx, r12
call rax
test eax, eax
jne 0x21005b07e
nop dword [rax]
mov edx, r15d
mov rcx, rbx
call method.dtable.release_int_
jmp 0x21005b00f
mov r8d, 0x1ff
mov edx, 0x10000
mov rcx, r12
call rax
test eax, eax
je 0x21005b0c0
mov rcx, r13
call sym.CloseHandle
mov rax, qword [r12]
mov rdx, qword [rax + 0x280]
lea rax, [r12 + 0x18]
cmp rdx, qword [rsp + 0x38]
jne 0x21005b108
mov rdx, qword [rax]
jmp 0x21005b096
mov rcx, r12
call rdx
jmp 0x21005b103
Function at 0x21005d170
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x21023ee48]
mov r12, rcx
test rax, rax
je 0x21005d1f0
mov rax, qword [rax + 0x90]
mov rbx, qword [rax + 0x18]
test rbx, rbx
je 0x21005d1f0
call sym.msys_2.0.dll_strlen
mov rdx, qword [rbx]
movsxd rsi, eax
test rdx, rdx
je 0x21005d1d5
nop dword [rax]
mov r8, rsi
mov rcx, r12
call sym.cygwin_strncasecmp
test eax, eax
jne 0x21005d1c8
mov rax, qword [rbx]
cmp byte [rax + rsi], 0x3d
je 0x21005d230
mov rdx, qword [rbx + 8]
add rbx, 8
test rdx, rdx
jne 0x21005d1b0
xor r13d, r13d
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
xor r8d, r8d
xor edx, edx
mov rcx, r12
call sym.GetEnvironmentVariableA
mov ebx, eax
test eax, eax
je 0x21005d1d5
movsxd rdx, eax
mov ecx, 0x65
call sym.cmalloc_abort
mov r13, rax
test rax, rax
je 0x21005d1d5
mov r8d, ebx
mov rdx, rax
mov rcx, r12
call sym.GetEnvironmentVariableA
test eax, eax
jne 0x21005d1d8
jmp 0x21005d1d5
lea r13, [rax + rsi + 1]
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x21005d300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
mov r10, rcx
test rcx, rcx
je 0x21005d388
cmp byte [rcx], 0
je 0x21005d388
xor eax, eax
mov ecx, 0x69
lea rbx, [0x2102aa140]
lea r11, str.ignorecase
jmp 0x21005d356
movzx r8d, dl
movzx r9d, dl
movsx r8d, byte [rbx + r8]
xor r8d, r9d
cmp r8d, ecx
jne 0x21005d3a0
test dl, dl
sete dl
cmp rax, 9
sete cl
add rax, 1
or dl, cl
jne 0x21005d373
movzx ecx, byte [r11 + rax]
movzx edx, byte [r10 + rax]
cmp dl, cl
jne 0x21005d328
cmp rax, 9
sete dl
test cl, cl
sete cl
add rax, 1
or dl, cl
je 0x21005d351
mov eax, edx
mov byte [0x210307933], dl
mov byte [0x210230a11], al
pop rbx
ret
xor eax, eax
xor edx, edx
mov byte [0x210230a11], al
mov byte [0x210307933], dl
pop rbx
ret
mov eax, 1
xor edx, edx
jmp 0x21005d38c
Function at 0x21005f200
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x60
mov r12, rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
lea rcx, [rsp + 0x40]
mov rax, qword [rax - 0x1bf8]
mov qword [rsp + 0x40], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov rax, qword [rax - 0x2cc8]
mov qword [rsp + 0x48], rax
lea rax, [0x21005f3b7]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsp
test r12, r12
je 0x21005f340
lea ebx, [rdx*8 + 8]
movsxd rbx, ebx
mov rcx, rbx
call sym.malloc_1
mov r8, rbx
mov rdx, r12
mov rcx, rax
mov rsi, rax
call sym.msys_2.0.dll_memcpy
mov rcx, r12
call sym.cfree
imul eax, dword [0x2102309b0], 0x3e8
add eax, dword [0x2102309b4]
cmp eax, 0x1c
ja 0x21005f2e0
mov r12, qword [rsi]
test r12, r12
je 0x21005f2e0
mov rbx, rsi
nop dword [rax + rax]
mov rcx, r12
add rbx, 8
call sym.strdup_1
mov rcx, r12
mov qword [rbx - 8], rax
call sym.cfree
mov r12, qword [rbx]
test r12, r12
jne 0x21005f2c0
lea rax, [sym.my_findenv_char_const__int_]
lea rcx, [0x2102855f8]
mov qword [sym.msys_2.0.dll_environ], rsi
lea rdx, [rsp + 0x3c]
mov qword [sym.getearly_char_const__int_], rax
call sym.my_findenv_char_const__int_
mov rcx, rax
test rax, rax
je 0x21005f318
call sym.parse_options_char_const_
nop dword [rax + rax]
mov rax, qword gs:[0x30]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
add rsp, 0x60
pop rbx
pop rsi
pop r12
ret
call sym.GetEnvironmentStringsW
mov r12, rax
test rax, rax
je 0x21005f3d0
test byte [0x210273880], 1
je 0x21005f37e
mov qword [rsp + 0x20], rax
lea r9, str.GetEnvironmentStrings_returned__p
lea r8, str.void_environ_init_char__int_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov edx, 1
mov rcx, r12
call sym.win32env_to_cygenv_wchar_t__bool_
mov rcx, r12
mov rbx, rax
mov qword [0x2102f7248], rax
call sym.FreeEnvironmentStringsW
lea rax, [sym.my_findenv_char_const__int_]
mov qword [sym.msys_2.0.dll_environ], rbx
mov qword [sym.getearly_char_const__int_], rax
jmp 0x21005f318
mov edx, 0x8000
lea r9, str.GetEnvironmentStrings_returned_NULL___E
lea r8, str.void_environ_init_char__int_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov rdx, qword [rsp + 0x40]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
jmp 0x21005f331
Function at 0x21005f410
Capabilities:
Query environment variable

Disassembly:
push rbp
mov eax, 0x10030
push r14
push r13
push r12
push rdi
push rsi
push rbx
call fcn.21021b550
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rbx, rdx
lea rdx, [rdx - 1]
mov r13d, r8d
mov r12, rcx
lea r8, [rdx + rdx]
lea rax, [r8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.21021b550
sub rsp, rax
lea rsi, [rsp + 0x30]
mov rax, qword gs:[8]
mov rax, qword [rax - 0x2938]
test rax, rax
je 0x21005f530
lea rcx, [sym.__ascii_mbtowc]
cmp qword [rax + 0xe8], rcx
je 0x21005f520
mov rax, qword gs:[8]
mov rax, qword [rax - 0x2938]
mov rcx, qword [sym.__utf8_mbtowc]
test rax, rax
je 0x21005f4a5
mov rcx, qword [rax + 0xe8]
mov qword [rsp + 0x20], rdx
mov r9, r12
mov rdx, rsi
lea rdi, [rbp - 0x50]
call sym._sys_mbstowcs_int_____reent__wchar_t__char_const__unsigned_long___mbstate_t___wchar_t__unsigned_long__char_const__unsigned_long_
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
mov word [rsi + rax*2], dx
mov rdx, rdi
call sym.GetEnvironmentVariableW
test eax, eax
jg 0x21005f550
test byte [0x210273880], 1
jne 0x21005f4f8
xor r13d, r13d
mov rax, r13
lea rsp, [rbp + 0xffb0]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
mov qword [rsp + 0x20], r12
lea r9, str.warning:__s_not_present_in_environment
lea r8, str.char_getwinenveq_const_char__size_t__int_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21005f4dd
lea rcx, [sym.__utf8_mbtowc]
jmp 0x21005f4a5
lea rax, [sym.__ascii_mbtowc]
cmp qword [sym.__utf8_mbtowc], rax
lea rcx, [sym.__utf8_mbtowc]
jne 0x21005f482
jmp 0x21005f4a5
mov dword [rsp + 0x20], 0
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov r9, 0xffffffffffffffff
call sym._sys_wcstombs_char__unsigned_long__wchar_t_const__unsigned_long__bool_
add eax, 1
cmp r13d, 0xc
je 0x21005f5e0
movsxd r14, eax
mov ecx, r13d
mov rdx, r14
call sym.cmalloc_abort
mov r13, rax
mov rcx, rax
mov dword [rsp + 0x20], 0
mov r9, 0xffffffffffffffff
mov r8, rdi
mov rdx, r14
call sym._sys_wcstombs_char__unsigned_long__wchar_t_const__unsigned_long__bool_
test byte [0x210273880], 1
je 0x21005f4e0
mov qword [rsp + 0x20], rsi
lea r9, str.using_value_from_GetEnvironmentVariable_for__W
lea r8, str.char_getwinenveq_const_char__size_t__int_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21005f4e0
add eax, ebx
mov ecx, 0xc
movsxd r14, eax
mov rdx, r14
call sym.cmalloc_abort
mov r13, rax
mov rcx, rax
test rbx, rbx
je 0x21005f588
mov rdx, r12
call sym.msys_2.0.dll_strcpy
lea rcx, [r13 + rbx]
jmp 0x21005f588