joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cf77
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.GCC_COLORS
call sub.msvcrt.dll_getenv
mov r14, rax
test rax, rax
je 0x14000ce94
movzx edi, byte [rax]
xor eax, eax
test dil, dil
je 0x14000ce99
lea rbp, [r14 + 1]
xor r13d, r13d
xor esi, esi
xor r12d, r12d
jmp 0x14000cd56
test r12, r12
je 0x14000cd4e
cmp dil, 0x3b
je 0x14000cd4e
sub edi, 0x30
cmp dil, 9
ja 0x14000ce94
movzx edi, byte [rbp]
add rbp, 1
lea rax, [rbp - 1]
test dil, dil
je 0x14000cd9d
cmp dil, 0x3a
je 0x14000cd9d
cmp dil, 0x3d
jne 0x14000cd2e
cmp r14, rax
je 0x14000ce94
test r12, r12
jne 0x14000ce94
sub rax, r14
mov r12, rbp
mov rsi, rax
jmp 0x14000cd4e
mov rcx, qword [0x140098040]
test r12, r12
je 0x14000ce7c
sub rax, r12
lea rbx, [0x140098040]
mov r13, rax
test rcx, rcx
je 0x14000ce05
lea rbx, [0x140098040]
jmp 0x14000cde5
mov rcx, qword [rbx + 0x18]
add rbx, 0x18
test rcx, rcx
je 0x14000ce05
movzx eax, byte [rbx + 0x10]
cmp rax, rsi
jne 0x14000cdd4
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000cdd4
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000ce63
test r12, r12
je 0x14000ce63
cmp byte [rbx + 0x11], 0
jne 0x14000ceb0
lea rcx, [r13 + 7]
call fcn.1400641d3
mov r8, r13
mov rdx, r12
mov rdi, rax
mov eax, 0x5b1b
mov word [rdi], ax
lea rcx, [rdi + 2]
call sub.msvcrt.dll_memcpy
lea rax, [rdi + r13 + 2]
mov qword [rbx + 8], rdi
mov dword [rax], 0x4b5b1b6d
mov byte [rax + 4], 0
mov byte [rbx + 0x11], 1
movzx edi, byte [rbp - 1]
test dil, dil
je 0x14000ce94
mov r14, rbp
xor r12d, r12d
jmp 0x14000cd4e
sub rax, r14
mov rsi, rax
test rcx, rcx
jne 0x14000cdc3
test dil, dil
jne 0x14000ce6c
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.1400771af
jmp 0x14000ce25
sub rsp, 0x38
cmp ecx, 1
je 0x14000cfda
cmp ecx, 2
jne 0x14000cfb3
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x14000cfc7
xor eax, eax
add rsp, 0x38
ret
test ecx, ecx
je 0x14000cfa9
jmp 0x14008dff7
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x14000cfa9
add rsp, 0x38
jmp 0x14000cce3

Function at 0x14000cfeb
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, ecx
cmp ecx, 1
je 0x14000d013
and eax, 0xfffffffd
jne 0x14000d00b
add rsp, 0x28
ret
jmp 0x14008e010
lea rcx, str.GCC_URLS
call sub.msvcrt.dll_getenv
mov rdx, rax
test rax, rax
je 0x14000d06b
xor eax, eax
cmp byte [rdx], 0
je 0x14000d003
movzx ecx, byte [rdx]
cmp ecx, 0x6e
jne 0x14000d04c
cmp byte [rdx + 1], 0x6f
je 0x14000d092
cmp ecx, 0x73
jne 0x14000d05f
cmp byte [rdx + 1], 0x74
je 0x14000d0a9
mov eax, 2
add rsp, 0x28
ret
lea rcx, str.TERM_URLS
call sub.msvcrt.dll_getenv
mov rdx, rax
test rax, rax
je 0x14000d05f
jmp 0x14000d02b
cmp byte [rdx + 2], 0
je 0x14000d003
jmp 0x14000d04c
cmp byte [rdx + 2], 0
mov eax, 1
je 0x14000d003
jmp 0x14000d05f
Function at 0x140012718
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov rbp, rdx
mov rsi, r8
test r8, r8
je 0x140012791
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, r8
lea r13, [rsp + 0x3c]
jmp 0x14001275c
mov eax, dword [rsp + 0x3c]
sub rbx, rax
je 0x140012791
mov r8d, 0xffffffff
mov rdx, rsi
mov r9, r13
mov rcx, rdi
mov qword [rsp + 0x20], 0
cmp rbx, r8
cmovbe r8, rbx
sub rdx, rbx
add rdx, rbp
mov dword [rsp + 0x3c], r8d
call r12
test eax, eax
jne 0x14001274f
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14001723f
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x28]
mov rbx, rcx
test rax, rax
je 0x14001727b
cmp rax, qword [rcx + 0x20]
je 0x14001727b
sub rax, 1
cmp qword [rcx + 0x30], rax
jae 0x14001727b
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_feof
test eax, eax
jne 0x14001726d
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x14001726d
mov rax, qword [rbx + 0x28]
mov rsi, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
cmp rax, rsi
jne 0x1400172d9
test rax, rax
lea rsi, [rax + rax]
mov eax, 0x1000
cmove rsi, rax
mov rdx, rsi
call fcn.14006428d
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x18], rax
mov rcx, rax
mov rax, qword [rbx + 0x28]
sub rsi, rax
mov r9, qword [rbx + 0x10]
add rcx, rax
mov edx, 1
mov r8, rsi
call sub.msvcrt.dll_fread
mov rcx, qword [rbx + 0x10]
mov rsi, rax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x14001726d
add qword [rbx + 0x28], rsi
test rsi, rsi
setne al
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14002ac27
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movzx edi, byte [rdx + 0x8a]
mov eax, edi
shr al, 2
mov dword [rsp + 0xb0], r8d
mov r13, rcx
mov r15, rdx
and eax, 1
jne 0x14002adc8
shr dil, 1
and edi, 1
jne 0x14002adc8
mov edx, dword [rdx + 0x84]
test edx, edx
jne 0x14002adc8
cmp dword [r15 + 0x80], 0xffffffff
je 0x14002adda
movzx r14d, word [r15 + 0x4e]
and r14w, 0xf000
cmp r14w, 0x3000
je 0x14002ae58
mov ecx, 0x2010
mov esi, 0x2000
cmp r14w, 0x8000
je 0x14002ae15
call fcn.1400641d3
xor ebp, ebp
mov r12, rax
nop word [rax + rax]
mov ecx, dword [r15 + 0x80]
mov r8d, esi
lea rdx, [r12 + rbp]
sub r8d, ebp
call sub.msvcrt.dll__read
movsxd rbx, eax
test rbx, rbx
jle 0x14002ad12
add rbp, rbx
cmp rbp, rsi
jne 0x14002acbf
cmp r14w, 0x8000
je 0x14002ae25
lea rsi, [rbp + rbp]
mov rcx, r12
lea rdx, [rsi + 0x10]
call fcn.14006428d
mov r12, rax
jmp 0x14002acbf
jne 0x14002ae2d
cmp r14w, 0x8000
jne 0x14002ad4f
cmp rbp, rsi
je 0x14002ad4f
mov rax, qword [r15 + 8]
lea r9, str._s_is_shorter_than_expected
xor edx, edx
mov rcx, r13
mov r8d, dword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call fcn.140025dff
lea rax, [r15 + 0x60]
mov qword [rsp + 0x20], rbp
lea r9, [rsi + 0x10]
mov r8, r12
mov qword [rsp + 0x30], rax
lea rax, [r15 + 0x30]
mov rdx, qword [r13 + 0x520]
mov rcx, r13
mov qword [rsp + 0x28], rax
call fcn.140020664
or byte [r15 + 0x8a], 4
mov qword [r15 + 0x28], rax
movzx eax, byte [r15 + 0x8a]
and edi, 1
mov ecx, dword [r15 + 0x80]
add edi, edi
and eax, 0xfffffffd
or eax, edi
mov byte [r15 + 0x8a], al
call sub.msvcrt.dll__close
movzx eax, byte [r15 + 0x8a]
mov dword [r15 + 0x80], 0xffffffff
shr al, 1
and eax, 1
xor eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call fcn.14002a9af
test al, al
jne 0x14002ac82
xor r8d, r8d
mov rdx, r15
mov rcx, r13
mov byte [rsp + 0x4f], al
mov r9d, dword [rsp + 0xb0]
call fcn.14002aada
movzx eax, byte [rsp + 0x4f]
jmp 0x14002adc8
mov rsi, qword [r15 + 0x60]
lea rcx, [rsi + 0x10]
jmp 0x14002acaf
mov rbp, rsi
jmp 0x14002ad4f
mov r9d, dword [rsp + 0xb0]
mov r8, qword [r15 + 8]
mov edx, 3
mov rcx, r13
mov edi, 1
call fcn.140025f47
mov rcx, r12
call fcn.1400771af
jmp 0x14002ad88
mov rax, qword [r15 + 8]
mov r8d, dword [rsp + 0xb0]
mov edx, 3
mov rcx, r13
lea r9, str._s_is_a_block_device
mov edi, 1
mov qword [rsp + 0x20], rax
call fcn.140025dff
jmp 0x14002ad88
Function at 0x14002c51e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov edi, dword [rsp + 0x80]
mov r12, rcx
mov r13, rdx
mov esi, r8d
mov ebx, r9d
cmp r9d, 3
je 0x14002c59e
call fcn.14002b086
mov r8, rax
test rax, rax
je 0x14002c586
cmp ebx, 4
jne 0x14002c5dd
mov dword [rsp + 0x28], edi
mov rdx, r13
mov r9d, esi
mov rcx, r12
mov dword [rsp + 0x20], 2
call fcn.14002b36f
mov rdx, rax
test rax, rax
jne 0x14002c5fa
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rdx, qword [rcx + 0x1e8]
mov rax, qword [rcx + 0x1c0]
cmp rax, qword [rdx + 0x10]
je 0x14002c5bd
mov dword [rax - 0x20], 0
mov r8d, esi
mov r9d, 3
mov rdx, r13
mov rcx, r12
call fcn.14002b086
mov r8, rax
test rax, rax
je 0x14002c586
mov dword [rsp + 0x28], edi
mov rdx, r13
mov r9d, esi
mov rcx, r12
mov dword [rsp + 0x20], 0
call fcn.14002b36f
mov rdx, rax
mov r9d, edi
mov r8d, ebx
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.14002bf02

Function at 0x140030497
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rax, [0x1400a6ce0]
movzx r8d, byte [rcx + 4]
mov r12, rdx
movzx edx, r8b
mov rsi, rcx
shl rdx, 4
add rax, rdx
mov edx, dword [rax]
cmp edx, 1
je 0x1400304eb
cmp edx, 2
je 0x1400305b9
test edx, edx
je 0x14003056d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi + 0x10]
mov edx, dword [rax + 8]
mov rdi, qword [rax]
test edx, edx
je 0x1400304da
xor ebx, ebx
lea rbp, [rsp + 0x26]
jmp 0x140030549
mov rcx, rbp
call fcn.14002ea54
mov r9, r12
loope 0x1400304d8
add dword [rax], eax
add byte [rax], al
mov rcx, rbp
mov r8d, 0xa
lea rbx, [rbx + rax - 1]
call sub.msvcrt.dll_fwrite
mov rax, qword [rsi + 0x10]
add rbx, 1
mov edx, dword [rax + 8]
cmp rdx, rbx
jbe 0x1400304da
lea rdx, [rdi + rbx]
test byte [rdx], 0x80
jne 0x140030512
mov rax, qword [rax]
mov rdx, r12
movzx ecx, byte [rax + rbx]
call fcn.1400771c7
jmp 0x140030535
movzx edx, word [rsi + 8]
test dl, 2
jne 0x1400305fd
and edx, 0x10
jne 0x1400304eb
mov rbx, qword [rax + 8]
cmp r8b, 0x45
je 0x14003061d
mov rcx, qword [rsi + 0x18]
mov r8d, dword [rsi + 0x10]
mov r9, r12
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp byte [rsi + 4], 0x45
jne 0x1400304da
mov rdx, r12
mov ecx, 0x22
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400771c7
mov rdx, r12
mov ecx, 0x22
call fcn.1400771c7
jmp 0x1400305c3
Function at 0x14003bfb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, dword [rdx + 0x18]
movzx edi, byte [rcx + 0x501]
mov rsi, rcx
mov rbx, rdx
test eax, eax
je 0x14003bfe3
cmp qword [rdx + 8], 0
je 0x14003bff4
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp byte [rcx + 0x4ee], 0
mov byte [rcx + 0x4ee], 0
mov ecx, 0x800
setne r12b
call fcn.1400641d3
mov qword [rbx + 8], rax
cmp byte [rsi + 0x501], 0
jne 0x14003c1b3
mov eax, dword [rbx + 0x18]
mov r13, qword [rbx]
lea ebp, [rax + 1]
test dil, dil
je 0x14003c16f
mov dword [rsp + 0x28], ebp
mov r9, qword [rbx + 0x20]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
mov rcx, rsi
call fcn.140038a02
mov edx, dword [rbx + 0x1c]
mov edi, 0x100
lea rbp, [rsp + 0x3c]
jmp 0x14003c072
test rcx, rcx
je 0x14003c147
mov qword [rcx + r8*8], rax
add edx, 1
mov dword [rbx + 0x1c], edx
lea r13d, [rdx + 1]
cmp r13, rdi
jbe 0x14003c0c7
mov rcx, qword [rbx + 8]
mov rdx, r13
lea rdi, [r13 + r13]
shl rdx, 4
call fcn.14006428d
mov qword [rbx + 8], rax
cmp byte [rsi + 0x501], 0
je 0x14003c0c7
mov rcx, qword [rbx + 0x28]
lea rdx, [r13*8]
test rcx, rcx
je 0x14003c157
call fcn.14006428d
mov qword [rbx + 0x28], rax
nop dword [rax]
mov rdx, rbp
mov rcx, rsi
call fcn.14003b6a9
cmp byte [rax + 4], 0x16
je 0x14003c127
mov r8d, dword [rbx + 0x1c]
cmp byte [rsi + 0x501], 0
mov r10d, dword [rsp + 0x3c]
mov rcx, qword [rbx + 8]
mov rdx, r8
je 0x14003c05f
test rcx, rcx
je 0x14003c147
mov r9, qword [rbx + 0x28]
mov qword [rcx + r8*8], rax
lea r9, [r9 + r8*4]
test r9, r9
je 0x14003c06c
mov dword [r9], r10d
mov edx, dword [rbx + 0x1c]
jmp 0x14003c06c
mov rcx, rsi
call fcn.140038ffa
mov byte [rsi + 0x4ee], r12b
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [0], rax
ud2
mov rcx, rdx
call fcn.1400641d3
mov qword [rbx + 0x28], rax
jmp 0x14003c0c7
mov rax, qword [rsi + 0x88]
mov rax, qword [rax]
test rax, rax
je 0x14003c1c6
lea rdx, [r13 + rbp*8]
mov qword [rsi + 0x88], rax
mov dword [rax + 0x30], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], rdx
jmp 0x14003c04d
mov ecx, 0x400
call fcn.1400641d3
mov qword [rbx + 0x28], rax
jmp 0x14003c021
mov ecx, 0x38
call fcn.1400641d3
mov rdx, qword [rsi + 0x88]
mov qword [rax], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
mov qword [rax + 8], rdx
mov qword [rdx], rax
jmp 0x14003c182
Function at 0x14003e0d3
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [rsp + 0x80], 0
mov r12, rcx
mov r13, rdx
mov esi, r8d
mov edi, r9d
jne 0x14003e186
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rbx, rax
mov r14d, eax
test esi, esi
je 0x14003e12c
test edi, edi
jne 0x14003e14f
lea r14d, [rsi + 1]
mov rdx, r13
mov ecx, 0x20
add r14d, ebx
call fcn.1400771c7
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll_fputs
mov eax, r14d
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
lea eax, [rsi + rax]
cmp eax, edi
jbe 0x14003e118
mov r9, r13
mov r8d, 3
mov edx, 1
mov r14d, 1
lea rcx, [0x1400a7fc0]
call sub.msvcrt.dll_fwrite
jmp 0x14003e11c
mov rdx, qword [rsp + 0x88]
call fcn.14003df7d
mov r12, rax
jmp 0x14003e0fa

Function at 0x14003e7eb
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [rcx + 0x330]
mov r10d, dword [rbx + 0x18]
lea eax, [r8 - 1]
mov esi, r8d
mov rbp, rcx
mov r12, rdx
cmp eax, 0x20
mov eax, 0x22
cmovbe esi, eax
test r10d, r10d
jne 0x14003eaaf
cmp byte [rbp + 0x53a], 0
mov r8d, dword [rbx + 8]
movzx r13d, word [rbx + 0x52]
test r8d, r8d
je 0x14003eb03
xor r8d, r8d
xor edi, edi
nop dword [rax + rax]
mov rax, qword [rbx]
mov edx, edi
mov r9d, esi
mov rcx, qword [rax + rdx*8]
xor eax, eax
cmp r13d, edi
mov rdx, r12
mov qword [rsp + 0x28], 0
setbe al
add edi, 1
mov dword [rsp + 0x20], eax
call fcn.14003e0d3
mov r8d, eax
cmp edi, dword [rbx + 8]
jne 0x14003eacb
cmp byte [rbp + 0x53a], 0
jne 0x14003ebdb
mov rdx, r12
mov ecx, 0x3a
mov dword [rsp + 0x3c], r8d
call fcn.1400771c7
mov r8d, dword [rsp + 0x3c]
mov r9d, dword [rbx + 0x18]
add r8d, 1
test r9d, r9d
je 0x14003eb70
xor edi, edi
nop
mov rax, qword [rbx + 0x10]
mov edx, edi
mov r9d, esi
add edi, 1
mov rcx, qword [rax + rdx*8]
mov dword [rsp + 0x20], 1
mov rdx, r12
mov qword [rsp + 0x28], 0
call fcn.14003e0d3
mov r8d, eax
cmp edi, dword [rbx + 0x18]
jne 0x14003eb3b
mov rdx, r12
mov ecx, 0xa
call fcn.1400771c7
cmp byte [rbp + 0x539], 0
je 0x14003e823
cmp dword [rbx + 0x18], 1
jbe 0x14003e823
mov edi, 1
lea r13, str._s:_n
nop dword [rax]
mov rax, qword [rbx + 0x10]
mov edx, edi
add edi, 1
mov rcx, qword [rax + rdx*8]
xor edx, edx
call fcn.14003df7d
mov rdx, r13
mov rcx, r12
mov r8, rax
call fcn.1400780d4
cmp edi, dword [rbx + 0x18]
jb 0x14003eba7
jmp 0x14003e823
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14003eb10
mov qword [rsp + 0x28], 0
mov r9d, esi
mov rdx, r12
mov dword [rsp + 0x20], 1
call fcn.14003e0d3
mov r8d, eax
jmp 0x14003eb10
Function at 0x140043c31
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
mov r8d, 0
mov ecx, eax
call fcn.14007105d
test rax, rax
jns 0x140043c92
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov edx, dword [rax]
mov rax, qword [rbp + 0x38]
mov r9, qword [rbp + 0x30]
mov r8d, edx
lea rdx, str.lseek
mov rcx, rax
call r9
mov eax, 0
jmp 0x140043dde
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x28]
mov r9, rcx
mov r8, rdx
mov rdx, rax
mov rcx, qword [rbp + 0x10]
call fcn.140041976
mov rdx, rax
mov rax, qword [rbp + 0x40]
mov qword [rax + 8], rdx
mov rax, qword [rbp + 0x40]
mov rax, qword [rax + 8]
test rax, rax
jne 0x140043cd6
mov eax, 0
jmp 0x140043dde
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x40]
mov qword [rax], rdx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x28]
mov qword [rax + 0x10], rdx
mov qword [rbp - 8], 0
jmp 0x140043d82
mov rax, qword [rbp + 0x28]
mov edx, eax
mov rax, qword [rbp - 8]
mov ecx, edx
sub ecx, eax
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax + 8]
mov eax, dword [rbp + 0x18]
mov r8d, ecx
mov ecx, eax
call sub.msvcrt.dll__read
cdqe
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jns 0x140043d6f
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov edx, dword [rax]
mov rax, qword [rbp + 0x38]
mov r9, qword [rbp + 0x30]
mov r8d, edx
lea rdx, str.read
mov rcx, rax
call r9
mov rax, qword [rbp + 0x40]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.1400771af
mov eax, 0
jmp 0x140043dde
cmp qword [rbp - 0x10], 0
je 0x140043d95
mov rax, qword [rbp - 0x10]
add qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x28]
jb 0x140043cfe
jmp 0x140043d96
nop
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x28]
jae 0x140043dd9
mov rax, qword [rbp + 0x38]
mov r9, qword [rbp + 0x30]
mov r8d, 0
lea rdx, str.file_too_short
mov rcx, rax
call r9
mov rax, qword [rbp + 0x40]
mov rax, qword [rax + 8]
mov rcx, rax
call fcn.1400771af
mov eax, 0
jmp 0x140043dde
mov eax, 1
add rsp, 0x30
pop rbp
ret

Function at 0x140057f01
Capabilities:
Hash data with md5

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov dword [rax], 0x67452301
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 0
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x10], edx
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x18], 0
nop
pop rbp
ret
Function at 0x1400580ee
Capabilities:
Read file on windows

Disassembly:
push rbp
mov eax, 0x1120
call fcn.14006fd9c
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10b0], rcx
mov qword [rbp + 0x10b8], rdx
lea rax, [rbp + 0xff0]
mov rcx, rax
call fcn.140057f01
mov qword [rbp + 0x1098], 0
mov eax, 0x1000
sub rax, qword [rbp + 0x1098]
mov rdx, rax
lea rcx, [rbp - 0x60]
mov rax, qword [rbp + 0x1098]
add rax, rcx
mov r9, qword [rbp + 0x10b0]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov qword [rbp + 0x1090], rax
mov rax, qword [rbp + 0x1090]
add qword [rbp + 0x1098], rax
cmp qword [rbp + 0x1098], 0xfff
ja 0x140058194
cmp qword [rbp + 0x1090], 0
jne 0x14005812c
cmp qword [rbp + 0x1090], 0
jne 0x1400581c0
mov rcx, qword [rbp + 0x10b0]
call sub.msvcrt.dll_ferror
test eax, eax
je 0x1400581c0
mov eax, 1
jmp 0x140058235
cmp qword [rbp + 0x1090], 0
je 0x1400581ee
lea rdx, [rbp + 0xff0]
lea rax, [rbp - 0x60]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call fcn.14005849a
jmp 0x140058121
nop
cmp qword [rbp + 0x1098], 0
je 0x14005821a
lea rcx, [rbp + 0xff0]
mov rdx, qword [rbp + 0x1098]
lea rax, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call fcn.14005829a
mov rdx, qword [rbp + 0x10b8]
lea rax, [rbp + 0xff0]
mov rcx, rax
call fcn.140057faf
mov eax, 0
add rsp, 0x1120
pop rbp
ret
Function at 0x14005db69
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [0x140098200]
mov dword [0x14019e6fc], eax
mov eax, dword [0x14019e6fc]
mov dword [0x14019e6f8], eax
mov qword [0x14019e6e0], 0
lea rax, str.POSIXLY_CORRECT
mov rcx, rax
call sub.msvcrt.dll_getenv
mov qword [0x14019e6f0], rax
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2d
jne 0x14005dbd8
mov dword [0x14019e6e8], 2
add qword [rbp + 0x20], 1
jmp 0x14005dc24
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2b
jne 0x14005dbfb
mov dword [0x14019e6e8], 0
add qword [rbp + 0x20], 1
jmp 0x14005dc24
mov rax, qword [0x14019e6f0]
test rax, rax
je 0x14005dc1a
mov dword [0x14019e6e8], 0
jmp 0x14005dc24
mov dword [0x14019e6e8], 1
mov rax, qword [rbp + 0x20]
add rsp, 0x20
pop rbp
ret

Function at 0x14006e94f
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140077a8f
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140077a8f
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x14006f676
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14019e828]
test eax, eax
je 0x14006f720
lea rax, [0x14019e800]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14019e830]
mov qword [rbp - 8], rax
jmp 0x14006f6fd
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14006f6f1
cmp qword [rbp - 0x10], 0
je 0x14006f6f1
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14006f6af
lea rax, [0x14019e800]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14006f721
nop
add rsp, 0x30
pop rbp
ret
Function at 0x14006f845
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14006f874
mov eax, 0
jmp 0x14006f8d0
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14006f8a4
mov eax, 0
jmp 0x14006f8d0
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14006f8cb
mov eax, 0
jmp 0x14006f8d0
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14006f8d6
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14006f962
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14006f959
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14006f959
mov rax, qword [rbp - 8]
jmp 0x14006f97b
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14006f921
mov eax, 0
add rsp, 0x20
pop rbp
ret