joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d3350
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbp, rsp
mov rax, qword [rcx]
mov qword [rbp + 0x64], rax
mov qword [rbp + 0xa8], rdx
xor eax, eax
mov qword [rbp + 0x38], rax
cmp qword [0x00759e90], 0
je 0x6d3510
mov ecx, 0x11
call sub.user32.dll_GetKeyState
mov rcx, qword [0x0074c720]
mov rcx, qword [rcx]
test ax, 0x8000
setne al
movzx rcx, byte [rcx + 0x178]
xor cl, al
test cl, cl
je 0x6d3510
mov rcx, qword [0x00759e98]
mov rax, qword [0x00759e98]
mov rbx, qword [rax]
call qword [rbx + 0x10]
xor eax, eax
mov rcx, qword [0x00759e90]
mov esi, dword [rcx + 0x10]
sub esi, 1
mov ebx, eax
cmp ebx, esi
jg 0x6d34d3
sub esi, eax
add esi, 1
mov rcx, qword [0x00759e90]
mov edx, ebx
call fcn.00504a40
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
cmp rax, qword [rbp + 0xa8]
je 0x6d34c5
mov rax, qword [rbp + 0x58]
cmp byte [rax + 0x3a1], 0
je 0x6d34c5
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
call qword [rax + 0xf8]
test al, al
je 0x6d34c5
mov rcx, qword [rbp + 0x58]
call fcn.006e5cf0
mov rcx, rax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x6d34c5
mov rcx, rbp
call fcn.006d32f0
test al, al
jne 0x6d34c5
mov rcx, qword [rbp + 0x58]
mov dx, 0xffb9
call fcn.0040dd40
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0xa8]
call rax
test al, al
je 0x6d34c5
mov byte [rbp + 0x6f], 1
mov rcx, qword [rbp + 0x58]
mov dx, 0xffba
call fcn.0040dd40
mov rdi, rax
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0xa8]
lea r8, [rbp + 0x48]
lea r9, [rbp + 0x64]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
call rdi
cmp byte [rbp + 0x6f], 0
je 0x6d34c5
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x64]
call fcn.0041e420
test al, al
je 0x6d34c5
mov rcx, qword [0x00759e98]
mov rdx, qword [rbp + 0x58]
call fcn.006d2590
add ebx, 1
sub esi, 1
test esi, esi
jne 0x6d33dc
nop
mov rax, qword [0x00759e98]
cmp dword [rax + 0x10], 0
jle 0x6d34f1
mov rcx, qword [0x00759e98]
call fcn.006d2690
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x6d3510
mov rcx, rbp
mov rdx, qword [rbp + 0x38]
call fcn.006d3110
test al, al
jne 0x6d3510
xor eax, eax
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x78]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6e0600
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
call sub.user32.dll_GetMessagePos
mov ecx, eax
call fcn.0041eb10
mov dword [rbp + 0x3c], eax
movsx rax, word [rbp + 0x3c]
mov dword [rbp + 0x34], eax
movsx rax, word [rbp + 0x3e]
mov dword [rbp + 0x38], eax
mov rcx, rbx
lea rdx, [rbp + 0x34]
call fcn.006d6c30
mov qword [rbp + 0x158], rax
test rdi, rdi
jne 0x6e066b
mov rcx, rbx
lea rdx, [rbp + 0x158]
xor r8, r8
xor r9, r9
mov byte [rsp + 0x20], 0
call fcn.006e0460
mov rdi, rax
test rdi, rdi
je 0x6e0748
cmp rdi, rbx
je 0x6e0699
mov eax, dword [rbp + 0x158]
sub eax, dword [rdi + 0x90]
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x15c]
sub eax, dword [rdi + 0x94]
mov dword [rbp + 0x44], eax
jmp 0x6e06a4
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x40], rax
movzx eax, word [rsi + 0x10]
mov dword [rbp + 0x48], eax
mov rax, qword [rsi + 8]
mov qword [rbp + 0x50], rax
movzx eax, word [rsi + 0x12]
cmp eax, 0x201
jge 0x6e06da
sub eax, 0xa1
cmp eax, 2
jb 0x6e06f6
sub eax, 3
cmp eax, 2
jb 0x6e0702
sub eax, 3
cmp eax, 2
jae 0x6e0708
jmp 0x6e06fc
sub eax, 0x201
cmp eax, 2
jb 0x6e06f6
sub eax, 3
cmp eax, 2
jb 0x6e0702
sub eax, 3
cmp eax, 2
jae 0x6e0708
jmp 0x6e06fc
mov byte [rbp + 0x4c], 0
jmp 0x6e070c
mov byte [rbp + 0x4c], 2
jmp 0x6e070c
mov byte [rbp + 0x4c], 1
jmp 0x6e070c
mov byte [rbp + 0x4c], 0
lea rcx, [rbp + 0x58]
call sub.user32.dll_GetKeyboardState
lea rcx, [rbp + 0x58]
call fcn.0067ef00
mov ebx, eax
call fcn.006d1870
or bx, ax
mov word [rbp + 0x4d], bx
mov rcx, rdi
mov edx, 0xb04b
xor r8, r8
lea r9, [rbp + 0x40]
call fcn.006d96e0
mov qword [rsi + 0x18], rax
mov al, 1
jmp 0x6e074a
xor eax, eax
lea rsp, [rbp + 0x168]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6f4310
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x70], rcx
mov byte [rbp + 0x78], dl
nop
mov rcx, qword [0x004d3450]
mov dl, 1
mov r8, qword [rbp + 0x70]
mov r9w, 2
call fcn.0050fab0
mov qword [rbp + 0x58], rax
nop
mov rcx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
call qword [rax]
lea rcx, [rbp + 0x50]
mov rdx, qword [0x006f42c8]
mov r8d, 1
mov r9, rax
call fcn.00414f30
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
je 0x6f4389
mov rax, qword [rbp + 0x40]
mov rax, qword [rax - 8]
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
mov r8d, dword [rbp + 0x40]
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
call qword [rax + 0x18]
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
je 0x6f43ba
mov rax, qword [rbp + 0x38]
mov rax, qword [rax - 8]
mov qword [rbp + 0x38], rax
xor eax, eax
mov ecx, dword [rbp + 0x38]
sub ecx, 1
mov dword [rbp + 0x4c], eax
cmp dword [rbp + 0x4c], ecx
jg 0x6f43ed
sub ecx, eax
add ecx, 1
mov rax, qword [rbp + 0x50]
movsxd rdx, dword [rbp + 0x4c]
lea rax, [rax + rdx]
movzx rdx, byte [rbp + 0x78]
xor byte [rax], dl
add dword [rbp + 0x4c], 1
sub ecx, 1
test ecx, ecx
jne 0x6f43cf
nop
mov rcx, qword [rbp + 0x58]
xor edx, edx
call fcn.0050ce70
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
je 0x6f4414
mov rax, qword [rbp + 0x30]
mov rax, qword [rax - 8]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
mov r8d, dword [rbp + 0x30]
mov rax, qword [rbp + 0x58]
mov rax, qword [rax]
call qword [rax + 0x20]
nop
mov rcx, qword [rbp + 0x58]
call fcn.0040d6e0
nop
lea rcx, [rbp + 0x50]
mov rdx, qword [0x006f42c8]
call fcn.00415100
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x6f44f0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0xf8
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x68], 0
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x50]
call fcn.004110f0
lea rcx, [rbp + 0x68]
call fcn.00411370
lea rcx, [rbp + 0x88]
mov edx, 0x68
xor r8, r8
call fcn.0040c560
mov dword [rbp + 0x88], 0x68
mov ebx, 0x400
mov rcx, qword [rbp + 0x68]
call fcn.00411d50
xor ecx, ecx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
setne al
mov byte [rbp + 0x5f], al
nop
lea rcx, [rbp + 0x68]
call fcn.004109f0
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0xf8]
pop rbx
pop rbp
ret
Function at 0x6f45d0
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
call fcn.00411d50
mov rdi, rax
mov rcx, rdi
xor edx, edx
xor r8, r8
call sub.kernel32.dll_GetEnvironmentVariableW
mov esi, eax
test esi, esi
jle 0x6f461d
mov rcx, rbx
mov edx, esi
sub edx, 1
call fcn.00411fa0
mov rcx, qword [rbx]
call fcn.00411d50
mov rcx, rdi
mov rdx, rax
mov r8d, esi
call sub.kernel32.dll_GetEnvironmentVariableW
jmp 0x6f4625
mov rcx, rbx
call fcn.004109f0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x6f4d30
Capabilities:
Set file attributes

Disassembly:
push rbp
sub rsp, 0x190
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov qword [rbp + 0x48], r8
mov qword [rbp + 0x50], 0
nop
lea rcx, [rbp + 0x58]
call fcn.00410400
cmp eax, 1
setle cl
movzx rcx, cl
mov dword [rbp + 0x18c], ecx
test eax, eax
jne 0x6f4dc6
lea rcx, [rbp + 0x58]
lea rdx, [0x006f4e10]
mov r8, qword [rbp + 0x38]
mov r9d, dword [rbp + 0x44]
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.0041b310
nop
lea rcx, [rbp + 0x50]
call fcn.006f4490
mov rcx, qword [rbp + 0x50]
call fcn.00411d50
mov rcx, rax
mov edx, 6
call sub.kernel32.dll_SetFileAttributesW
nop
lea rcx, [rbp + 0x50]
call fcn.004109f0
jmp 0x6f4dc1
call fcn.00410550
mov eax, dword [rbp + 0x18c]
lea rsp, [rbp + 0x190]
pop rbp
ret
Function at 0x402ca0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov ecx, 0x2000
mov rbx, rdx
call fcn.0048c870
xor edx, edx
mov rcx, rsi
mov rbp, rax
call sub.msvcrt.dll__open
xor edx, edx
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll__open
mov edi, eax
mov eax, esi
or eax, edi
jns 0x402d10
mov rcx, rbp
call fcn.004a6450
mov ecx, esi
call sub.msvcrt.dll__close_1
mov ecx, edi
call sub.msvcrt.dll__close_1
xor eax, eax
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, qword [sym.imp.msvcrt.dll__fstat64]
lea rdx, [rsp + 0x30]
mov ecx, esi
call rbx
test eax, eax
js 0x402ce4
lea rdx, [rsp + 0x70]
mov ecx, edi
call rbx
test eax, eax
js 0x402ce4
mov rbx, qword [rsp + 0x88]
cmp qword [rsp + 0x48], rbx
jne 0x402ce4
lea rax, [rbp + 0x1000]
test rbx, rbx
mov r13d, 0x1000
mov qword [rsp + 0x28], rax
je 0x402dc6
nop word [rax + rax]
cmp ebx, 0x1000
mov r14d, r13d
mov r12d, 0x1000
cmovle r14d, ebx
mov rdx, rbp
mov ecx, esi
cmovle r12, rbx
mov r8d, r14d
mov r15d, r14d
call sub.msvcrt.dll__read_1
cmp eax, r14d
mov r8d, eax
jne 0x402ce4
mov r14, qword [rsp + 0x28]
mov ecx, edi
mov rdx, r14
call sub.msvcrt.dll__read_1
cmp eax, r15d
jne 0x402ce4
mov r8, r12
mov rdx, r14
mov rcx, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x402ce4
sub rbx, r12
jne 0x402d60
mov rcx, rbp
call fcn.004a6450
mov ecx, esi
call sub.msvcrt.dll__close_1
mov ecx, edi
call sub.msvcrt.dll__close_1
mov eax, 1
jmp 0x402cfc
Function at 0x407cb0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
cmp byte [rcx + 1], 0
mov rbx, rcx
mov rdi, rdx
jne 0x407dc0
mov rax, qword [0x0058b1a0]
mov eax, dword [rax + 0x1750]
test eax, eax
jne 0x407de8
cmp byte [rbx], 0
je 0x407d72
mov edx, 0x3d
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x4bbee6
sub rax, rdi
mov rcx, rdi
mov rdx, rax
call fcn.0048ca20
mov rcx, rax
movq xmm6, rax
call sub.msvcrt.dll_getenv
cmp byte [rbx + 1], 0
mov rsi, rax
jne 0x407d90
test rsi, rsi
je 0x407d39
mov rcx, rsi
call fcn.0048c9a0
mov rsi, rax
movq xmm1, rsi
mov rsi, qword [rbx + 8]
punpcklqdq xmm6, xmm1
test rsi, rsi
je 0x407ed5
mov eax, dword [rsi]
mov ebp, dword [rsi + 4]
and eax, 0x7fffffff
lea r12d, [rbp + 1]
cmp eax, ebp
je 0x407e10
shl rbp, 4
mov dword [rsi + 4], r12d
movups xmmword [rsi + rbp + 8], xmm6
movaps xmm6, xmmword [rsp + 0x20]
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x4a6368
mov ecx, 2
call qword [fcn.004a5d20]
lea rdx, str.saving_old_value:__s_n
mov r8, rsi
mov rcx, rax
call fcn.004ac0c0
test rsi, rsi
jne 0x407d2e
jmp 0x407d39
mov ecx, 2
call qword [fcn.004a5d20]
lea rdx, str.env_manager::xput___s__n
mov r8, rdi
mov rcx, rax
call fcn.004ac0c0
jmp 0x407cd1
mov ecx, 2
call qword [fcn.004a5d20]
lea rdx, [0x004c0cfb]
mov r8, rdi
mov rcx, rax
call fcn.00430660
jmp 0x407ce6
cmp byte [rsi + 3], 0
js 0x407e68
mov ecx, ebp
mov edx, r12d
call fcn.0042d9f0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x407efc
mov ebp, dword [rcx + 4]
mov r12d, eax
and r12d, 0x7fffffff
mov edx, eax
mov rax, rdx
shl rax, 4
lea rdx, [rax + 8]
call fcn.0048c8f0
mov qword [rbx + 8], rax
mov rsi, rax
mov dword [rax], r12d
lea r12d, [rbp + 1]
mov dword [rax + 4], ebp
jmp 0x407d65
mov r13d, 4
mov qword [rbx + 8], 0
cmp r12d, r13d
cmovae r13d, r12d
xor ecx, ecx
mov edx, r13d
and r13d, 0x7fffffff
shl rdx, 4
add rdx, 8
call fcn.0048c8f0
test ebp, ebp
mov qword [rbx + 8], rax
mov ebx, r13d
mov qword [rax], rbx
je 0x407eca
lea ecx, [rbp - 1]
mov edx, 8
shl rcx, 4
add rcx, 0x18
nop dword [rax]
movdqu xmm0, xmmword [rsi + rdx]
movups xmmword [rax + rdx], xmm0
add rdx, 0x10
cmp rdx, rcx
jne 0x407eb8
mov dword [rax + 4], ebp
mov rsi, rax
jmp 0x407d65
mov edx, 0x48
xor ecx, ecx
xor ebp, ebp
call fcn.0048c8f0
mov r12d, 1
mov qword [rbx + 8], rax
mov rsi, rax
mov qword [rax], 4
jmp 0x407d65
mov r12d, eax
xor ebp, ebp
and r12d, 0x7fffffff
jmp 0x407e3a
jmp qword [sym.imp.msvcrt.dll__putenv]
Function at 0x409e70
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor r9d, r9d
mov r8d, 1
lea rdx, [0x004c137b]
lea rcx, [0x004bf8f0]
call fcn.00402250
test rax, rax
mov rsi, rax
je 0x40a020
movzx eax, byte [rax]
test al, al
je 0x409eec
lea rdx, [rsi + 1]
xor ebx, ebx
xor r8d, r8d
jmp 0x409ec9
movzx eax, byte [rdx]
lea ecx, [rbx + 1]
add rdx, 1
test al, al
je 0x409ee3
movsxd rbx, ecx
cmp al, 9
je 0x409ed1
cmp al, 0x20
jne 0x409eb8
movzx eax, byte [rdx]
lea ecx, [rbx + 1]
add rdx, 1
add r8d, 1
test al, al
jne 0x409ec6
test r8d, r8d
jne 0x40a030
lea rcx, [0x004bf988]
mov r8d, 1
mov rdx, rsi
call fcn.00403480
mov rax, qword [0x0058ac70]
xor edx, edx
xor r8d, r8d
lea rbp, [0x0059d2e0]
lea r9, [0x00446010]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.0048a660
mov rax, qword [0x0059d2f8]
mov rdx, qword [0x0059d300]
sub rdx, rax
cmp rdx, 0x13
jbe 0x40a088
movabs rdi, 0x5f5443454c4c4f43
mov dword [rax + 0x10], 0x3d524550
mov qword [rax], rdi
movabs rdi, 0x504152575f4f544c
mov qword [rax + 8], rdi
mov rdi, qword [0x004bf988]
mov rax, qword [0x0059d2f8]
mov rcx, rdi
lea rsi, [rax + 0x14]
mov qword [0x0059d2f8], rsi
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov rax, qword [0x0059d300]
sub rax, rsi
cmp rax, rbx
jb 0x40a0a8
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x0059d2f8]
mov rdx, qword [0x0059d2f0]
cmp rbx, rdx
je 0x40a0d0
mov rax, qword [0x0059d310]
mov rcx, qword [0x0059d2e8]
lea r8, [rbx + rax]
not rax
and r8, rax
mov rax, qword [0x0059d300]
mov r9, r8
sub r9, rcx
mov r10, rax
sub r10, rcx
lea rcx, [0x0059d430]
cmp r10, r9
cmovb r8, rax
movq xmm0, r8
punpcklqdq xmm0, xmm0
movaps xmmword [0x0059d2f0], xmm0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.00407cb0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea ecx, [rcx + r8 + 1]
movsxd rcx, ecx
call fcn.0048c870
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
lea rax, [rsi + rbx + 2]
jmp 0x40a063
add rdx, 1
movsxd r9, ecx
add ecx, 1
cmp rdx, rax
mov byte [rdi + r9], r8b
je 0x40a0e0
movzx r8d, byte [rdx]
cmp r8b, 0x20
je 0x40a073
cmp r8b, 9
jne 0x40a050
movsxd r8, ecx
add ecx, 1
mov byte [rdi + r8], 0x5c
movzx r8d, byte [rdx]
jmp 0x40a050
mov edx, 0x14
mov rcx, rbp
call fcn.0048a6a0
mov rax, qword [0x0059d2f8]
jmp 0x409f43
mov rdx, rbx
mov rcx, rbp
call fcn.0048a6a0
mov rdi, qword [0x004bf988]
mov rsi, qword [0x0059d2f8]
jmp 0x409f9d
or byte [0x0059d330], 2
jmp 0x409fc2
mov rcx, rsi
mov rsi, rdi
call fcn.004a6450
jmp 0x409eec
Function at 0x40ee40
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x0058ac70]
lea rbp, [0x0059d2e0]
xor r8d, r8d
lea r9, [0x00446010]
mov rcx, rbp
mov rdi, rdx
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.0048a660
mov rax, qword [0x0059d2f8]
mov rdx, qword [0x0059d300]
sub rdx, rax
cmp rdx, 0xb
jbe 0x40ef50
movabs rsi, 0x5f5443454c4c4f43
mov dword [rax + 8], 0x3d434347
mov rcx, rdi
mov qword [rax], rsi
mov rax, qword [0x0059d2f8]
lea rsi, [rax + 0xc]
mov qword [0x0059d2f8], rsi
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov rax, qword [0x0059d300]
sub rax, rsi
cmp rax, rbx
jb 0x40ef70
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x0059d2f8]
mov rdx, qword [0x0059d2f0]
cmp rbx, rdx
je 0x40ef90
mov rax, qword [0x0059d310]
mov rcx, qword [0x0059d2e8]
lea r8, [rbx + rax]
not rax
and r8, rax
mov rax, qword [0x0059d300]
mov r9, r8
sub r9, rcx
mov r10, rax
sub r10, rcx
lea rcx, [0x0059d430]
cmp r10, r9
cmovb r8, rax
movq xmm0, r8
punpcklqdq xmm0, xmm0
movaps xmmword [0x0059d2f0], xmm0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.00407cb0
mov edx, 0xc
mov rcx, rbp
call fcn.0048a6a0
mov rax, qword [0x0059d2f8]
jmp 0x40ee8d
mov rdx, rbx
mov rcx, rbp
call fcn.0048a6a0
mov rsi, qword [0x0059d2f8]
jmp 0x40eed2
or byte [0x0059d330], 2
jmp 0x40eef7
Function at 0x417fa0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
movzx r13d, byte [rcx]
cmp r13b, 0x40
mov rdi, rcx
je 0x417fca
cmp r13b, 0x24
jne 0x4180fc
lea rsi, str.E:_msys_mingw64_64
lea rbx, str._ROOT
nop dword [rax + rax]
movzx eax, byte [rdi + 1]
lea r9, [rdi + 1]
cmp al, 0x2f
setne cl
test al, al
setne dl
test cl, dl
je 0x418110
cmp al, 0x5c
je 0x418110
mov edx, 2
jmp 0x418015
cmp cl, 0x5c
je 0x418032
movzx ecx, byte [rdi + rdx]
mov rax, rdx
add rdx, 1
test cl, cl
setne r10b
cmp cl, 0x2f
setne r8b
test r10b, r8b
jne 0x418010
lea r14, [rax - 1]
lea r12, [rdi + rax]
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.00497ea0
sub rsp, rax
mov r8, r14
mov rdx, r9
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_memcpy
cmp r13b, 0x40
mov rcx, rax
mov byte [rax + r14], 0
je 0x4180b0
call sub.msvcrt.dll_getenv
test rax, rax
mov r13, rax
je 0x4180f4
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call fcn.004883c0
mov rcx, rdi
mov r12, rax
call fcn.004a6450
movzx r13d, byte [r12]
cmp r13b, 0x40
je 0x41809f
cmp r13b, 0x24
jne 0x4180ff
mov rdi, r12
jmp 0x417fe0
xor r8d, r8d
mov rdx, rbx
call fcn.004883c0
mov rcx, rax
mov r14, rax
call sub.msvcrt.dll_getenv
test rax, rax
mov r13, rax
je 0x4180e0
mov rcx, r14
call fcn.004a6450
jmp 0x418075
mov r13, qword [str.E:_msys_mingw64_64]
mov rcx, r14
call fcn.004a6450
test r13, r13
jne 0x418075
mov r13, rsi
jmp 0x418075
mov r12, rcx
mov rax, r12
mov rsp, rbp
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
mov r12, r9
mov eax, 1
xor r14d, r14d
jmp 0x41803a
Function at 0x42faa0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.COLUMNS
call sub.msvcrt.dll_getenv
test rax, rax
mov rcx, rax
je 0x42fad0
call sub.msvcrt.dll_atoi
test eax, eax
jle 0x42fad0
add rsp, 0x28
ret
mov eax, 0x7fffffff
add rsp, 0x28
ret

Function at 0x42fae0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov rbx, rcx
je 0x42fb00
sub edx, 1
test edx, edx
jle 0x42fb1e
mov dword [rbx + 0x80], edx
add rsp, 0x20
pop rbx
ret
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0xc0]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
call sub.msvcrt.dll__isatty
test eax, eax
jne 0x42fb30
mov edx, 0x7fffffff
mov dword [rbx + 0x80], edx
add rsp, 0x20
pop rbx
ret
lea rcx, str.COLUMNS
call sub.msvcrt.dll_getenv
test rax, rax
mov rcx, rax
je 0x42fb58
call sub.msvcrt.dll_atoi
test eax, eax
jle 0x42fb58
lea edx, [rax - 1]
jmp 0x42faef
mov edx, 0x7ffffffe
jmp 0x42faf3

Function at 0x42fb60
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x48
mov esi, edx
call fcn.0048c870
xor edx, edx
mov rcx, rax
mov qword [rbx], rax
call fcn.0043f4b0
lea rdx, [rbx + 0x10]
xor eax, eax
mov ecx, 7
mov rdi, rdx
rep stosq qword [rdi], rax
movsxd rcx, esi
shl rcx, 2
mov dword [rdi], 0
mov byte [rbx + 0x4c], 0
mov dword [rbx + 0x50], esi
call fcn.0048c870
test esi, esi
mov rcx, rax
mov qword [rbx + 0x58], rax
jle 0x42fbc6
mov r8d, esi
xor edx, edx
shl r8, 2
call sub.msvcrt.dll_memset
mov rax, qword [rbx]
mov rcx, rbx
mov byte [rbx + 0x7c], 0
lea rdi, [0x00433920]
mov edx, dword [rax + 0x28]
call fcn.0042fae0
xor eax, eax
xor edx, edx
xor ecx, ecx
mov word [rbx + 0x94], ax
movq xmm0, rdi
lea rax, [0x00432020]
mov word [rbx + 0x120], cx
movq xmm1, rax
mov dword [rbx + 0x84], 0x5e5e5e
lea rax, [0x0042f400]
punpcklqdq xmm0, xmm1
mov byte [rbx + 0x88], 0
movups xmmword [rbx + 0xa8], xmm0
lea rcx, str.GCC_EXTRA_DIAGNOSTIC_OUTPUT
pxor xmm0, xmm0
mov qword [rbx + 0x8c], 0
mov dword [rbx + 0x98], 0
mov word [rbx + 0x9c], dx
mov byte [rbx + 0x9e], 0
mov dword [rbx + 0xa0], 0
mov qword [rbx + 0xb8], rax
movups xmmword [rbx + 0xc0], xmm0
mov qword [rbx + 0xd0], 0
movups xmmword [rbx + 0xd8], xmm0
mov dword [rbx + 0x100], 0
mov qword [rbx + 0x108], 0
mov qword [rbx + 0xf8], 0
mov dword [rbx + 0x110], 0
mov qword [rbx + 0x118], 0
call sub.msvcrt.dll_getenv
test rax, rax
mov rsi, rax
je 0x42fcde
lea rdx, str.fixits_v1
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x42fd48
mov dword [rbx + 0x124], 1
movabs rax, 0x100000000
pxor xmm0, xmm0
mov qword [rbx + 0x130], 8
mov qword [rbx + 0x128], rax
lea rax, [0x0042f460]
mov qword [rbx + 0x138], 0
mov qword [rbx + 0x140], 0
movups xmmword [rbx + 0x148], xmm0
mov qword [rbx + 0x158], rax
mov qword [rbx + 0x168], 0
movups xmmword [rbx + 0x170], xmm0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rdx, str.fixits_v2
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x42fcde
mov dword [rbx + 0x124], 2
jmp 0x42fcde
Function at 0x433960
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.GCC_COLORS
call sub.msvcrt.dll_getenv
test rax, rax
mov rbp, rax
je 0x433adc
movzx r14d, byte [rax]
xor eax, eax
test r14b, r14b
je 0x433ae1
lea rdi, [rbp + 1]
xor r13d, r13d
xor esi, esi
xor r12d, r12d
jmp 0x4339d0
test r12, r12
je 0x4339c8
cmp r14b, 0x3b
je 0x4339c8
sub r14d, 0x30
cmp r14b, 9
ja 0x433adc
nop dword [rax]
movzx r14d, byte [rdi]
add rdi, 1
lea rax, [rdi - 1]
test r14b, r14b
je 0x433a08
cmp r14b, 0x3a
je 0x433a08
cmp r14b, 0x3d
jne 0x4339a8
cmp rax, rbp
je 0x433adc
test r12, r12
jne 0x433adc
sub rax, rbp
mov r12, rdi
mov rsi, rax
jmp 0x4339c8
test r12, r12
mov rcx, qword [0x004bfae0]
je 0x433ac8
lea rbx, [0x004bfae0]
sub rax, r12
test rcx, rcx
mov r13, rax
je 0x433a5d
lea rbx, [0x004bfae0]
jmp 0x433a45
mov rcx, qword [rbx + 0x18]
add rbx, 0x18
test rcx, rcx
je 0x433a5d
movzx eax, byte [rbx + 0x10]
cmp rax, rsi
jne 0x433a38
mov r8, rsi
mov rdx, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x433a38
test r12, r12
mov rcx, qword [rbx + 8]
je 0x433ab1
test rcx, rcx
je 0x433ab1
cmp byte [rbx + 0x11], 0
jne 0x433af0
lea rcx, [r13 + 7]
call fcn.0048c870
mov r8, r13
mov rdx, r12
mov rbp, rax
mov eax, 0x5b1b
mov word [rbp], ax
lea rcx, [rbp + 2]
call sub.msvcrt.dll_memcpy
lea rax, [rbp + r13 + 2]
mov qword [rbx + 8], rbp
mov dword [rax], 0x4b5b1b6d
mov byte [rax + 4], 0
mov byte [rbx + 0x11], 1
movzx r14d, byte [rdi - 1]
test r14b, r14b
je 0x433adc
mov rbp, rdi
xor r12d, r12d
jmp 0x4339c8
sub rax, rbp
test rcx, rcx
mov rsi, rax
jne 0x433a2a
test r14b, r14b
jne 0x433ab6
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.004a6450
jmp 0x433a71
sub rsp, 0x38
cmp ecx, 1
je 0x433bef
cmp ecx, 2
jne 0x433bd0
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x433be0
xor eax, eax
add rsp, 0x38
ret
test ecx, ecx
je 0x433bc6
jmp 0x4bd1a0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x433bc6
add rsp, 0x38
jmp 0x433960