joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2100f9450
Capabilities:
Check for peb beingdebugged flag
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r15, qword [rsp + 0xc8]
mov rbx, rdx
mov rbp, r8
mov r13, r9
call sym.__get_lcid_from_locale_char_const_
mov r14d, eax
cmp eax, 0xffffffff
je 0x2100f9598
test eax, eax
jne 0x2100f95a0
lea rdx, [0x21029d5de]
mov rcx, r15
call sym.msys_2.0.dll_strcmp
test eax, eax
je 0x2100f957b
mov ecx, 0x100
call sym.malloc_1
mov r12, rax
test rax, rax
je 0x2100f9598
movdqu xmm0, xmmword [rbx + 8]
mov rcx, r12
movups xmmword [rbp + 8], xmm0
movdqu xmm1, xmmword [rbx + 0x18]
movups xmmword [rbp + 0x18], xmm1
movdqu xmm2, xmmword [rbx + 0x28]
movups xmmword [rbp + 0x28], xmm2
movdqu xmm3, xmmword [rbx + 0x38]
movups xmmword [rbp + 0x38], xmm3
movdqu xmm4, xmmword [rbx + 0x48]
movups xmmword [rbp + 0x48], xmm4
movdqu xmm5, xmmword [rbx + 0x58]
movups xmmword [rbp + 0x58], xmm5
movdqu xmm0, xmmword [rbx + 0x68]
movups xmmword [rbp + 0x68], xmm0
movdqu xmm1, xmmword [rbx + 0x78]
movups xmmword [rbp + 0x78], xmm1
movdqu xmm2, xmmword [rbx + 0x88]
movups xmmword [rbp + 0x88], xmm2
movdqu xmm3, xmmword [rbx + 0x98]
movups xmmword [rbp + 0x98], xmm3
mov rdx, qword [rbx + 0xa8]
mov qword [rbp], r12
mov qword [rbp + 0xa8], rdx
mov rdx, r15
call sym.msys_2.0.dll_stpcpy
movzx edi, byte [rsp + 0xd0]
lea rdx, [rax + 1]
mov byte [rax + 2], 0
lea rbx, [rax + 3]
mov qword [rbp + 8], rdx
mov byte [rax + 1], dil
mov rdx, rbx
mov rcx, r12
sub rdx, r12
call sym.realloc_1
test rax, rax
je 0x2100f958c
cmp rax, r12
jne 0x2100f966a
mov qword [r13], rax
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call sym.free_1
nop dword [rax]
mov eax, 0xffffffff
jmp 0x2100f957b
mov ecx, 0x100
call sym.malloc_1
mov r12, rax
test rax, rax
je 0x2100f9598
mov qword [rbp], rax
mov rdx, r15
mov rcx, rax
lea r15, [rsp + 0x30]
call sym.msys_2.0.dll_stpcpy
movzx edi, byte [rsp + 0xd0]
mov ecx, r14d
mov r8, r15
lea rdx, [rax + 1]
mov byte [rax + 2], 0
mov r9d, 0xb
lea rbx, [rax + 3]
mov qword [rbp + 8], rdx
mov edx, 0x13
lea r14, [rsp + 0x28]
mov byte [rax + 1], dil
xor edi, edi
call sym.GetLocaleInfoW
nop
mov rax, rbx
movzx r8d, word [r15 + rdi*2]
mov qword [r14], 0
and eax, 1
cmp rax, 1
sbb rbx, 0xffffffffffffffff
xor eax, eax
lea rsi, [rbx + 4]
mov qword [rbp + rdi*8 + 0x60], rbx
mov word [rbx], r8w
mov word [rbx + 2], ax
mov qword [rbp + rdi*8 + 0x10], rsi
mov rcx, qword gs:[8]
mov rdx, rsi
sub rcx, 0x2980
mov r9, r14
add rdi, 1
call qword [rsp + 0xc0]
cdqe
add rsi, rax
mov byte [rsi], 0
lea rbx, [rsi + 1]
cmp rdi, 0xa
jne 0x2100f9600
jmp 0x2100f9556
mov rcx, rax
lea r8, [rbp + 0xb0]
sub rcx, r12
mov rdx, qword [rbp]
cmp rbx, rdx
jbe 0x2100f968c
cmp rdx, r12
jb 0x2100f968c
add rdx, rcx
mov qword [rbp], rdx
add rbp, 8
cmp r8, rbp
jne 0x2100f9677
jmp 0x2100f9572
Function at 0x210101a50
Capabilities:
Get file attributes

Disassembly:
push r13
push r12
push rdi
push rbx
sub rsp, 0x48
mov r9d, 0x68
lea r12, [rsp + 0x30]
mov rbx, rdx
mov r8, rdx
mov r13, rcx
mov dword [rsp + 0x20], 0x12
mov rdx, r12
call sym.NtQueryInformationFile
cmp eax, 0x80000005
jne 0x210101a98
xor eax, eax
add rsp, 0x48
pop rbx
pop rdi
pop r12
pop r13
ret
test eax, eax
jns 0x210101a87
cmp eax, 0xc0000022
je 0x210101a87
lea rdi, [rbx + 8]
mov rcx, rbx
xor eax, eax
mov qword [rbx], 0
and rdi, 0xfffffffffffffff8
mov r9d, 0x28
mov r8, rbx
mov rdx, r12
sub rcx, rdi
mov qword [rbx + 0x60], 0
add ecx, 0x68
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rsp + 0x20], 4
mov rcx, r13
call sym.NtQueryInformationFile
test eax, eax
js 0x210101a87
mov r9d, 8
lea r8, [rbx + 0x40]
mov rdx, r12
mov rcx, r13
mov dword [rsp + 0x20], 6
call sym.NtQueryInformationFile
test eax, eax
jns 0x210101b14
mov qword [rbx + 0x40], 0
mov r9d, 0x18
lea r8, [rbx + 0x28]
mov rdx, r12
mov rcx, r13
mov dword [rsp + 0x20], 5
call sym.NtQueryInformationFile
jmp 0x210101a87
Function at 0x210105840
Capabilities:
Access peb ldr_data

Disassembly:
push r12
sub rsp, 0x20
lea rdx, str.cwd_lock
mov r12, rcx
lea rcx, [0x21024fc80]
call method.muto.init_char_const_
cmp qword [r12 + 0x30], 0
je 0x210105880
mov r8d, dword [0x7ffe02dc]
mov edx, 1
mov rcx, r12
add rsp, 0x20
pop r12
jmp method.cwdstuff.override_win32_cwd_bool__unsigned_int_
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [r12 + 0x18], 0xffffffffffffffff
mov dword [r12 + 0x20], 1
add rsp, 0x20
pop r12
jmp method.cwdstuff.set_path_conv__char_const_
Function at 0x21010d3c0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0xc8
mov esi, edx
mov rbx, rcx
call sym.proc_terminate__
mov edx, 0xffffffff
lea rcx, [0x2102738a0]
call method.muto.acquire_unsigned_int_
call method.cygthread.terminate__
cmp esi, 0x4000000
je 0x21010d53e
mov rax, qword [rbx + 0x28]
mov edx, esi
lea r12, [rsp + 0x30]
mov dword [0x21024fafc], 0xb
or edx, 0x8000000
mov dword [rax + 0xc], edx
mov rax, qword [0x21024fce8]
mov eax, dword [rax + 0xfc28]
test eax, eax
jle 0x21010d453
mov edx, eax
lea r12, [rsp + 0x30]
shr edx, 0x10
cmp dx, 3
setne cl
cmp eax, 0x50001
setne dl
test cl, dl
je 0x21010d453
sub eax, 0x500fe
cmp eax, 1
ja 0x21010d56f
call sym.GetCurrentProcess
mov rcx, r12
mov rdx, rax
call sym.fill_rusage_rusage__void_
mov rax, qword [rbx + 0x28]
mov rdx, r12
lea rcx, [rax + 0xfc38]
call sym.add_rusage_rusage__rusage_
mov rax, qword [rbx + 0x28]
movzx r12d, word [rax + 0xc]
mov eax, dword [rax + 0x10]
mov edx, r12d
test eax, eax
jne 0x21010d491
rol dx, 8
movzx r12d, dx
lea r13, [0x210273880]
test byte [0x210273880], 1
jne 0x21010d515
lea rcx, [0x2102f7100]
call method.dll_list.cleanup_forkables__
test byte [0x210273880], 1
jne 0x21010d4ef
call sym.GetCurrentProcess
mov edx, r12d
mov rcx, rax
call sym.TerminateProcess
test eax, eax
je 0x21010d4d2
mov ecx, r12d
call sym.ExitProcess
lea r9, str.TerminateProcess_failed___E
lea r8, str.void_pinfo::exit_DWORD_
mov edx, 0x8000
mov rcx, r13
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21010d4ca
mov dword [rsp + 0x28], r12d
mov edx, 0x800
mov rcx, r13
lea r9, str.Calling_ExitProcess_n__y__exitcode__y
mov dword [rsp + 0x20], esi
lea r8, str.void_pinfo::exit_DWORD_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21010d4b6
mov dword [rsp + 0x28], r12d
mov edx, 0x800
mov rcx, r13
lea r9, str.Calling_dlls.cleanup_forkables_n__y__exitcode__y
mov dword [rsp + 0x20], esi
lea r8, str.void_pinfo::exit_DWORD_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21010d4a1
mov rcx, rbx
lea r12, [rsp + 0x30]
call method.pinfo.maybe_set_exit_code_from_windows__
mov rax, qword [0x21024fce8]
mov dword [0x21024fafc], 0xb
mov eax, dword [rax + 0xfc28]
test eax, eax
jg 0x21010d428
jmp 0x21010d453
or edx, 0xffffffff
mov rcx, r12
call method.lock_ttys.lock_ttys_unsigned_int_
mov rax, qword [0x21024fce8]
mov rdx, qword [0x21025fe48]
movzx eax, word [rax + 0xfc28]
imul rax, rax, 0x138
lea r13, [rdx + rax + 8]
mov rcx, r13
call method.tty.slave_alive__
test al, al
je 0x21010d5bc
cmp byte [rsp + 0x30], 0
je 0x21010d453
call method.lock_ttys.release__
jmp 0x21010d453
xor edx, edx
mov rcx, r13
call method.tty_min.setpgid_int_
jmp 0x21010d5a7
Function at 0x2101108d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov rbx, rcx
mov rcx, qword [0x210317fa8]
mov byte [rsp + 0x58], dl
mov dword [rsp + 0x3c], 0
test rcx, rcx
je 0x21011091d
lea rdx, [rsp + 0x58]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
mov r8d, 1
call sym.WriteFile
test eax, eax
je 0x210110928
mov eax, dword [rsp + 0x3c]
test eax, eax
setne al
add rsp, 0x40
pop rbx
ret
call sym.GetLastError
cmp eax, 0x6d
je 0x210110970
test byte [0x210273880], 1
je 0x210110914
movsx eax, byte [rsp + 0x58]
mov edx, 0x40
lea r9, str.sending__d_notification_to_parent_failed___E
lea r8, str.bool__pinfo::alert_parent_char_
lea rcx, [0x210273880]
mov dword [rsp + 0x20], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov edx, dword [rsp + 0x3c]
test edx, edx
setne al
jmp 0x21011091d
mov dword [rbx + 8], 1
mov rcx, qword [0x210317fa8]
mov qword [0x210317fa8], 0
call sym.CloseHandle
jmp 0x210110914
Function at 0x210110ea0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov dword [rsp + 0x40], 0
mov rdi, rcx
test dl, dl
jne 0x210110ed3
jmp 0x210110f70
cmp eax, 0xc0000004
jne 0x2101110b0
mov eax, dword [0x2103198c8]
mov rcx, qword [0x2103198c0]
lea edx, [rax + 0x10680]
mov dword [0x2103198c8], edx
mov rbx, rdx
call sym.realloc_1
mov rdx, rax
test rax, rax
je 0x21011110b
xor r9d, r9d
mov r8d, ebx
mov ecx, 5
mov qword [0x2103198c0], rax
call sym.NtQuerySystemInformation
test eax, eax
js 0x210110ec8
mov rbx, qword [0x2103198c0]
lea rsi, [rsp + 0x40]
jmp 0x210110f33
add rbx, rax
mov r9, qword [rbx + 0x50]
test r9, r9
je 0x210110f4d
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call method.winpids.add_unsigned_int__bool__unsigned_int_
mov eax, dword [rbx]
test eax, eax
jne 0x210110f30
mov eax, dword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
lea r15, [rsp + 0x44]
lea r13, [rsp + 0x40]
lea rsi, str.winpid.
mov eax, dword [rax - 0x2cc8]
mov dword [rsp + 0x48], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov eax, dword [rax - 0x2cc4]
mov dword [rsp + 0x4c], eax
call sym.get_shared_parent_dir__
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x44], 0
mov r14, rax
call method.tmp_pathbuf.w_get__
mov r12, rax
mov eax, 1
nop dword [rax]
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov rdx, r12
mov rcx, r14
mov qword [rsp + 0x30], 0
mov r8d, 0x10000
mov dword [rsp + 0x20], eax
call sym.NtQueryDirectoryObject
mov ebp, eax
test eax, eax
js 0x2101110da
cmp word [r12], 0
mov rbx, r12
jne 0x210111022
jmp 0x210111068
add rbx, 0x20
cmp word [rbx], 0
je 0x210111068
mov rcx, qword [rbx + 8]
mov r8d, 7
mov rdx, rsi
call sym.msys_2.0.dll_wcsncmp
test eax, eax
jne 0x210111018
mov rax, qword [rbx + 8]
xor edx, edx
mov r8d, 0xa
add rbx, 0x20
lea rcx, [rax + 0xe]
call sym.msys_2.0.dll_wcstoul
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
mov r9d, eax
call method.winpids.add_unsigned_int__bool__unsigned_int_
cmp word [rbx], 0
jne 0x210111022
xor eax, eax
cmp ebp, 0x105
je 0x210110fd8
mov edx, dword [rsp + 0x48]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc8], edx
mov edx, dword [rsp + 0x4c]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc4], edx
jmp 0x210110f53
mov dword [rsp + 0x20], eax
lea r9, str.error__y_reading_system_process_information
lea r8, str.DWORD_winpids::enum_processes_bool_
mov edx, 0x8000
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
xor eax, eax
jmp 0x210110f57
test byte [0x210273880], 1
je 0x210111076
mov dword [rsp + 0x20], eax
lea r9, [0x2102a2eb8]
lea r8, str.DWORD_winpids::enum_processes_bool_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210111076
lea r9, str.out_of_memory_reading_system_process_information
lea r8, str.DWORD_winpids::enum_processes_bool_
mov edx, 0x8000
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
xor eax, eax
jmp 0x210110f57
Function at 0x210115e20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
test rcx, rcx
je 0x210115ee0
cmp byte [0x2103198e4], 0
je 0x210115eb0
mov rcx, qword [0x210319900]
mov rdx, qword [0x210319918]
lea rax, [rcx + rdx]
cmp r12, rax
jae 0x210115e59
cmp rcx, r12
jbe 0x210115ed2
lea r13, [0x210319900]
test byte [0x210319924], 0x44
je 0x210115f00
mov r8d, 0x30
mov rdx, r13
mov rcx, r12
call sym.VirtualQuery
test byte [0x210319924], 0x44
jne 0x210115ed2
mov rdx, qword [0x210319918]
mov rcx, qword [0x210319900]
lea r9, [0x2103198e0]
mov r8d, 0x40
add rsp, 0x28
pop r12
pop r13
jmp sym.VirtualProtect
mov r8d, 0x30
lea rdx, [0x210319900]
mov byte [0x2103198e4], 1
call sym.VirtualQuery
test byte [0x210319924], 0x44
je 0x210115e87
add rsp, 0x28
pop r12
pop r13
ret
test byte [0x210319924], 0x44
je 0x210115f20
mov byte [0x2103198e4], 0
add rsp, 0x28
pop r12
pop r13
ret
mov r8d, dword [0x2103198e0]
lea r9, [0x2103198e0]
call sym.VirtualProtect
jmp 0x210115e6d
mov r8d, dword [0x2103198e0]
mov rdx, qword [0x210319918]
lea r9, [0x2103198e0]
mov rcx, qword [0x210319900]
call sym.VirtualProtect
jmp 0x210115ee9

Function at 0x210117d40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r13
push r12
push rsi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov eax, dword [rcx + 8]
mov rbx, rcx
mov r12d, r8d
test eax, eax
je 0x210117d70
mov eax, r12d
mov rsp, rbp
pop rbx
pop rsi
pop r12
pop r13
pop rbp
ret
lea r13, [rbp - 0x10]
sub rsp, 0x20
mov rcx, r13
lea rsi, [rsp + 0x30]
call sym.RtlInitUnicodeString
lea rax, [rbp - 0x14]
mov rcx, qword [rbx]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8d, 2
mov rdx, r13
mov dword [rsp + 0x20], 0x14
call sym.NtQueryValueKey
test eax, eax
jne 0x210117d5d
cmp dword [rsp + 0x34], 4
jne 0x210117d5d
mov r12d, dword [rsp + 0x3c]
mov eax, r12d
mov rsp, rbp
pop rbx
pop rsi
pop r12
pop r13
pop rbp
ret

Function at 0x210117dd0
Capabilities:
Set registry value

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov eax, dword [rcx + 8]
mov rbx, rcx
test eax, eax
jne 0x210117e19
lea r12, [rsp + 0x40]
mov dword [rsp + 0x3c], r8d
mov rcx, r12
call sym.RtlInitUnicodeString
lea rax, [rsp + 0x3c]
mov rcx, qword [rbx]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9d, 4
mov rdx, r12
mov dword [rsp + 0x28], 4
call sym.NtSetValueKey
add rsp, 0x58
pop rbx
pop r12
ret
Function at 0x210117e30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r12d, dword [rcx + 8]
mov r14, qword [rbp + 0x70]
mov rbx, rcx
mov r13, r8
mov rsi, r9
test r12d, r12d
je 0x210117e88
test r14, r14
je 0x210117e6e
mov r8, rsi
mov rdx, r14
mov rcx, r13
call sym.msys_2.0.dll_wcpncpy
mov eax, r12d
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea eax, [r9 + r9 + 0x10]
mov r12, rax
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.21021b550
lea r15, [rbp - 0x10]
sub rsp, rax
mov rcx, r15
lea rdi, [rsp + 0x30]
call sym.RtlInitUnicodeString
lea rax, [rbp - 0x14]
mov rcx, qword [rbx]
mov r9, rdi
mov dword [rsp + 0x20], r12d
mov r8d, 2
mov rdx, r15
mov qword [rsp + 0x28], rax
call sym.NtQueryValueKey
mov r12d, eax
test eax, eax
jne 0x210117e60
cmp dword [rdi + 4], 1
jne 0x210117e60
lea rdx, [rdi + 0xc]
mov r8, rsi
mov rcx, r13
call sym.msys_2.0.dll_wcpncpy
jmp 0x210117e6e

Function at 0x210117f00
Capabilities:
Set registry value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov eax, dword [rcx + 8]
mov rbx, rcx
mov rsi, r8
test eax, eax
jne 0x210117f4b
lea r12, [rsp + 0x30]
mov rcx, r12
call sym.RtlInitUnicodeString
mov rcx, rsi
call sym.msys_2.0.dll_wcslen
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbx]
xor r8d, r8d
lea eax, [rax + rax + 2]
mov r9d, 1
mov rdx, r12
mov dword [rsp + 0x28], eax
call sym.NtSetValueKey
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x21012ca00
Capabilities:
Get file attributes

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x98
cmp dword [rdx + 0x1b0], 0xc6
mov r12d, ecx
mov rbx, rdx
mov rcx, r8
mov esi, r9d
jne 0x21012ca80
mov r12d, 0xffffffff
test r9b, r9b
je 0x21012ca48
mov eax, r12d
add rsp, 0x98
pop rbx
pop rsi
pop r12
pop r13
ret
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.PeekNamedPipe
test eax, eax
je 0x21012ca30
mov eax, dword [rsp + 0x60]
xor r12d, r12d
test eax, eax
setne r12b
jmp 0x21012ca30
lea rdx, [rsp + 0x50]
mov r9d, 0x28
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 0x18
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
call sym.NtQueryInformationFile
test eax, eax
js 0x21012cb40
test sil, sil
je 0x21012cb18
cmp dword [rbx + 0x1b0], 0xc5
mov eax, dword [rsp + 0x7c]
je 0x21012cb60
test eax, eax
je 0x21012cb24
test byte [0x210273880], 1
jne 0x21012cc10
mov r12d, 1
jmp 0x21012ca30
mov eax, dword [rsp + 0x74]
test eax, eax
jne 0x21012cbc0
mov r12d, dword [rsp + 0x80]
shl r12d, 0x1d
sar r12d, 0x1f
jmp 0x21012ca30
test byte [0x210273880], 1
jne 0x21012cc60
mov r12d, 0xffffffff
test sil, sil
je 0x21012ca30
jmp 0x21012cb09
test eax, eax
jne 0x21012cafc
mov r13, qword [rbx + 0x1e8]
test r13, r13
je 0x21012cc99
lea rax, [rsp + 0x4c]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], 0
mov rcx, r13
mov qword [rsp + 0x20], rax
call sym.PeekNamedPipe
cmp qword [rbx + 0x1e8], 0
mov esi, eax
je 0x21012ccb8
test esi, esi
je 0x21012cb09
mov eax, dword [rsp + 0x70]
sub eax, dword [rsp + 0x4c]
mov dword [rsp + 0x7c], eax
jmp 0x21012caf8
test byte [0x210273880], 1
je 0x21012cb09
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 0x128]
lea r9, str.fd__d___s__read_avail__u
lea r8, str.int_pipe_data_available_int__fhandler_base__HANDLE__bool_
mov dword [rsp + 0x20], r12d
mov edx, 0x80080
lea rcx, [0x210273880]
mov qword [rsp + 0x28], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21012cb09
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x70]
lea r9, str.fd__d___s__write:_size__u__avail__u
lea r8, str.int_pipe_data_available_int__fhandler_base__HANDLE__bool_
mov dword [rsp + 0x20], r12d
mov edx, 0x80080
lea rcx, [0x210273880]
mov r12d, 1
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 0x128]
mov qword [rsp + 0x28], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21012ca30
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 0x128]
lea r9, str.fd__d___s__NtQueryInformationFile_failed__status__y
lea r8, str.int_pipe_data_available_int__fhandler_base__HANDLE__bool_
mov dword [rsp + 0x20], r12d
mov edx, 0x200
lea rcx, [0x210273880]
mov qword [rsp + 0x28], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21012cb4d
mov rcx, rbx
call method.fhandler_pipe.temporary_query_hdl__
mov r13, rax
test rax, rax
je 0x21012cb09
jmp 0x21012cb74
mov rcx, r13
call sym.CloseHandle
jmp 0x21012cba7
Function at 0x210132510
Capabilities:
Create directory

Disassembly:
push rbp
push r13
push r12
sub rsp, 0x280
lea rbp, [rsp + 0x80]
mov rax, qword [0x21025fe28]
test rax, rax
je 0x210132540
lea rsp, [rbp + 0x200]
pop r12
pop r13
pop rbp
ret
mov rax, qword [0x21023d810]
lea r13, [rbp - 0x10]
lea r9, [0x2102a75b4]
add rax, 0x4210
cmp byte [0x21024fae5], 0
mov qword [rsp + 0x20], rax
jne 0x2101325f8
lea r8, str.msys_2.0S5
lea rdx, str.BaseNamedObjects_s_s__S
mov rcx, r13
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
lea r12, [rbp - 0x50]
mov rdx, r13
mov rcx, r12
call sym.RtlInitUnicodeString
add rsp, 0xffffffffffffff80
mov edx, 0x2000f
mov dword [rbp - 0x40], 0x30
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x38], 0
mov dword [rbp - 0x28], pe_nt_image_headers64
mov qword [rbp - 0x30], r12
call sym._everyone_sd_void__unsigned_int_
lea r8, [rbp - 0x40]
mov edx, 0x2000f
lea rcx, [0x21025fe28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
call sym.NtCreateDirectoryObject
test eax, eax
js 0x210132604
mov rax, qword [0x21025fe28]
lea rsp, [rbp + 0x200]
pop r12
pop r13
pop rbp
ret
mov r9, qword [0x2102357d0]
jmp 0x21013256a
mov r8d, eax
mov rdx, r12
lea rcx, str.NtCreateDirectoryObject__S_:__y
call sym.api_fatal
nop
nop word [rax + rax]

Function at 0x210132620
Capabilities:
Create directory

Disassembly:
push rbp
push r13
push r12
sub rsp, 0x290
lea rbp, [rsp + 0x80]
mov rax, qword [0x21025fe20]
test rax, rax
je 0x210132650
lea rsp, [rbp + 0x210]
pop r12
pop r13
pop rbp
ret
mov r9d, 4
lea r8, [rbp - 0x44]
mov qword [rsp + 0x20], 0
mov edx, 0x18
mov rcx, 0xffffffffffffffff
call sym.NtQueryInformationProcess
test eax, eax
js 0x210132740
mov r8d, dword [rbp - 0x44]
test r8d, r8d
je 0x210132740
mov rax, qword [0x21023d810]
lea rdx, [0x2102a75b4]
add rax, 0x4210
cmp byte [0x21024fae5], 0
jne 0x210132760
mov qword [rsp + 0x20], rdx
lea r9, str.msys_2.0S5
mov rcx, rbp
lea rdx, str.SessionsBNOLINKS_d_s_s__S
mov qword [rsp + 0x28], rax
lea r12, [rbp - 0x40]
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
mov rdx, rbp
mov rcx, r12
call sym.RtlInitUnicodeString
add rsp, 0xffffffffffffff80
mov edx, 0x2000f
mov dword [rbp - 0x30], 0x30
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x18], pe_nt_image_headers64
mov qword [rbp - 0x20], r12
call sym._everyone_sd_void__unsigned_int_
lea r8, [rbp - 0x30]
mov edx, 0x2000f
lea rcx, [0x21025fe20]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0
call sym.NtCreateDirectoryObject
test eax, eax
js 0x21013276c
mov rax, qword [0x21025fe20]
jmp 0x210132640
call sym.get_shared_parent_dir__
mov qword [0x21025fe20], rax
lea rsp, [rbp + 0x210]
pop r12
pop r13
pop rbp
ret
mov rdx, qword [0x2102357d0]
jmp 0x2101326aa
mov r8d, eax
mov rdx, r12
lea rcx, str.NtCreateDirectoryObject__S_:__y
call sym.api_fatal
nop
nop
Function at 0x210132b20
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
cmp dword [rcx], 0xab1fcce8
mov rbx, rcx
jne 0x210132b58
mov rax, qword [0x21025fe40]
cmp dword [rax + 4], 0x8a28
jne 0x210132c50
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
mov eax, 0xffffffff
xchg dword [rcx], eax
lea r13, [rsp + 0x28]
test eax, eax
je 0x210132be0
cmp eax, 0xab1fcce8
jne 0x210132b78
xchg dword [rcx], eax
jmp 0x210132b35
lea r13, [rsp + 0x28]
xor r12d, r12d
mov esi, 0xffffffff
mov rcx, r13
call sym.NtQuerySystemTime
test eax, eax
cmove r12, qword [rsp + 0x28]
jmp 0x210132bae
cmp r12, 0xfffffffff70f2e81
jl 0x210132be0
call sym.yield
mov r8d, esi
xchg dword [rbx], r8d
cmp r8d, 0xffffffff
jne 0x210132c70
mov rcx, r13
call sym.NtQuerySystemTime
test eax, eax
jne 0x210132ba0
mov rax, qword [rsp + 0x28]
sub rax, r12
cmp rax, 0x8f0d17f
jle 0x210132ba9
nop word [rax + rax]
mov dword [rbx + 4], 0x8a28
lea r12, [rbx + 0x10]
xor edx, edx
mov rcx, r12
call method.mount_info.init_bool_
mov rax, qword [0x21023d810]
xor edx, edx
mov rcx, r13
mov rax, qword [rax + 0x4740]
mov qword [rsp + 0x28], rax
call sym.internal_getpwsid_cygpsid__cyg_ldap_
test rax, rax
je 0x210132c2d
mov rsi, qword [0x21023d810]
mov rdx, qword [rax]
lea rcx, [rsi + 0x4700]
call method.cygheap_user.set_name_char_const_
mov edx, 1
mov rcx, r12
call method.mount_info.init_bool_
mov eax, 0xab1fcce8
xchg dword [rbx], eax
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
mov edx, dword [rbx + 4]
mov r8d, 0x8a28
lea rcx, str.user_shared_memory_size
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
jmp sym.multiple_cygwin_problem_char_const__unsigned_long__unsigned_long_
mov eax, r8d
xchg dword [rbx], eax
test r8d, r8d
je 0x210132ca8
cmp r8d, 0xab1fcce8
je 0x210132b35
mov edx, dword [rbx]
mov r8d, r8d
lea rcx, str.user_shared_memory_version
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
jmp sym.multiple_cygwin_problem_char_const__unsigned_long__unsigned_long_
mov dword [rbx + 4], 0x8a28
lea r12, [rbx + 0x10]
xor edx, edx
mov rcx, r12
call method.mount_info.init_bool_
mov rax, qword [0x21023d810]
xor edx, edx
mov rcx, r13
mov rax, qword [rax + 0x4740]
mov qword [rsp + 0x28], rax
call sym.internal_getpwsid_cygpsid__cyg_ldap_
test rax, rax
je 0x210132cf8
mov rsi, qword [0x21023d810]
mov rdx, qword [rax]
lea rcx, [rsi + 0x4700]
call method.cygheap_user.set_name_char_const_
nop dword [rax]
mov edx, 1
mov rcx, r12
call method.mount_info.init_bool_
jmp 0x210132b49