joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005880
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc40
mov rax, qword [0x1400114e0]
xor rax, rsp
mov qword [rsp + 0xc30], rax
mov rbx, rdx
mov rdi, rcx
lea rdx, str.postgres_9.6
mov rcx, rbx
call sub.MSVCR120.dll_strcmp
test eax, eax
je 0x1400058c6
lea rdx, [0x14000d595]
xor ecx, ecx
call fcn.14000a8b0
lea rdx, [rsp + 0x830]
mov rcx, rdi
call fcn.1400059f0
test eax, eax
js 0x1400059bc
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140007700
lea rdx, [rsp + 0x430]
mov rcx, rbx
call qword [sym.imp.libintl.dll_libintl_bindtextdomain]
mov rcx, rbx
call qword [sym.imp.libintl.dll_libintl_textdomain]
lea rcx, str.PGLOCALEDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x14000595a
lea r9, [rsp + 0x430]
lea r8, str.PGLOCALEDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.140007ca0
lea rcx, [rsp + 0x2c]
call fcn.140006de0
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
mov rcx, rax
call fcn.14000a450
lea rcx, str.PGSYSCONFDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x1400059bc
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.1400075e0
lea r9, [rsp + 0x430]
lea r8, str.PGSYSCONFDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.140007ca0
lea rcx, [rsp + 0x2d]
call fcn.140006de0
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
mov rcx, rax
call fcn.14000a450
mov rcx, qword [rsp + 0xc30]
xor rcx, rsp
call fcn.14000adb0
mov rbx, qword [rsp + 0xc60]
add rsp, 0xc40
pop rdi
ret
Function at 0x1400068a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x1400068d9
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140007ec0
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
call qword [sym.imp.MSVCR120.dll__strdup]
test rax, rax
jne 0x140006912
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140007ec0
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x140006930
Capabilities:
Terminate process

Disassembly:
mov edx, 4
jmp 0x140006ab0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140006b1b
test sil, 2
jne 0x140006b17
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140007ec0
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x140006b81
test sil, 4
je 0x140006b7e
test al, 3
jne 0x140006b71
test bl, 3
jne 0x140006b71
cmp rbx, 0x400
ja 0x140006b71
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x140006b7e
nop dword [rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x140006b60
jmp 0x140006b7e
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140006950
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x20
mov edi, 1
test rcx, rcx
jne 0x140006967
test rdx, rdx
cmove rdx, rdi
call qword [sym.imp.MSVCR120.dll_realloc]
test rax, rax
jne 0x1400069a6
lea rcx, str.out_of_memory_n
mov qword [rsp + 0x30], rbx
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140007ec0
mov ecx, edi
call qword [sym.imp.MSVCR120.dll_exit]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006ab0
Capabilities:
Terminate process

Disassembly:
mov edx, 4
jmp 0x140006ab0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140006b1b
test sil, 2
jne 0x140006b17
lea rcx, str.out_of_memory_n
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140007ec0
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x140006b81
test sil, 4
je 0x140006b7e
test al, 3
jne 0x140006b71
test bl, 3
jne 0x140006b71
cmp rbx, 0x400
ja 0x140006b71
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x140006b7e
nop dword [rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x140006b60
jmp 0x140006b7e
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140007da0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x1400114e0]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x140007de5
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], Ordinal_24
or eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000adb0
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x30], rax
call fcn.140007fb0
mov rdi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x140007e83
test rdi, rdi
je 0x140007e83
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [rsp + 0x40]
movzx ebx, bl
add ecx, eax
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x140007e87
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
or eax, 0xffffffff
test bl, bl
mov rbx, qword [rsp + 0x470]
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000adb0
add rsp, 0x478
ret

Function at 0x140007f40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140007f92
test rdi, rdi
je 0x140007f92
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x140007f95
mov byte [rbx + 0x24], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400088b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp dword [rsp + 0x50], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], r14
mov r14, rcx
mov edi, r8d
je 0x1400088f5
movsxd rax, r9d
mov rbp, rcx
test r9d, r9d
je 0x1400088f1
nop dword [rax]
dec rax
cmp byte [rbp], 0
je 0x1400088f1
inc rbp
test rax, rax
jne 0x1400088e0
sub ebp, ecx
jmp 0x140008909
or rbp, 0xffffffffffffffff
nop dword [rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x140008900
sub edi, ebp
mov eax, 0
cmovs edi, eax
test edx, edx
je 0x140008919
neg edi
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x140008988
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140008979
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x140008979
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140008946
inc dword [rbx + 0x20]
jmp 0x140008982
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140008972
test rsi, rsi
je 0x140008972
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x140008972
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_33
inc qword [rbx]
dec edi
test edi, edi
jg 0x140008927
mov r8, rbx
mov edx, ebp
mov rcx, r14
call fcn.140009160
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x140008a10
neg edi
movsxd rsi, edi
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140008a02
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x140008a02
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x1400089cf
inc dword [rbx + 0x20]
jmp 0x140008a0b
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x1400089fb
test rdi, rdi
je 0x1400089fb
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x1400089fb
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_33
inc qword [rbx]
dec rsi
jne 0x1400089b0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140008aa0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x80
mov rax, qword [0x1400114e0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xd0]
xor ebp, ebp
movsx eax, dl
add eax, 0xffffffa8
mov r10, rcx
lea r11, str.0123456789abcdef
mov dword [rsp + 0x24], ebp
mov esi, ebp
cmp eax, 0x20
ja case.0x140008b05.89
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x8cf8]
mov ecx, dword [rdx + rax*4 + 0x8ce0]
add rcx, rdx
jmp rcx
mov ecx, 0xa
test r10, r10
jns 0x140008b1e
mov dword [rsp + 0x24], reloc.LIBPQ.dll_Ordinal_45
neg r10
jmp 0x140008b47
test r8d, r8d
je 0x140008b47
mov dword [rsp + 0x24], Ordinal_47
jmp 0x140008b47
mov ecx, 8
jmp 0x140008b47
mov ecx, 0xa
jmp 0x140008b47
lea r11, str.0123456789ABCDEF
mov ecx, reloc.LIBPQ.dll_Ordinal_16
mov qword [rsp + 0x90], rdi
mov edi, dword [rsp + 0xc0]
test r10, r10
jne 0x140008b68
cmp dword [rsp + 0xc8], esi
je 0x140008b68
test edi, edi
je 0x140008b8f
lea r8, [rsp + 0x30]
nop dword [rax]
xor edx, edx
mov rax, r10
inc esi
div rcx
lea r8, [r8 + 1]
mov r10, rax
movzx eax, byte [rdx + r11]
mov byte [r8 - 1], al
test r10, r10
jne 0x140008b70
mov eax, dword [rsp + 0xb0]
sub edi, esi
cmovs edi, ebp
sub eax, edi
sub eax, esi
cmovs eax, ebp
mov dword [rsp + 0x20], eax
test r9d, r9d
je 0x140008bb1
neg eax
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0xb8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
mov r9, rbx
call fcn.1400092e0
test edi, edi
jle 0x140008c00
nop
mov rax, qword [rbx + 0x10]
dec edi
test rax, rax
je 0x140008bf3
cmp qword [rbx], rax
jb 0x140008bf3
cmp qword [rbx + 0x18], rbp
jne 0x140008beb
inc dword [rbx + 0x20]
jmp 0x140008bfc
mov rcx, rbx
call fcn.140007f40
mov rax, qword [rbx]
mov byte [rax], reloc.LIBPQ.dll_Ordinal_48
inc qword [rbx]
test edi, edi
jg 0x140008bd0
movsxd rdi, esi
test esi, esi
jle 0x140008c47
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
movsx esi, byte [rsp + rdi + 0x2f]
dec rdi
test rax, rax
je 0x140008c39
cmp qword [rbx], rax
jb 0x140008c39
cmp qword [rbx + 0x18], rbp
jne 0x140008c31
inc dword [rbx + 0x20]
jmp 0x140008c42
mov rcx, rbx
call fcn.140007f40
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
test rdi, rdi
jg 0x140008c10
mov eax, dword [rsp + 0x20]
test eax, eax
jns 0x140008cb4
neg eax
movsxd rsi, eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140008ca6
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x140008ca6
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140008c73
inc dword [rbx + 0x20]
jmp 0x140008caf
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], bpl
jne 0x140008c9f
test rdi, rdi
je 0x140008c9f
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x140008c9f
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_33
inc qword [rbx]
dec rsi
jne 0x140008c54
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000adb0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x140008d20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor eax, eax
lea edi, [r8 - 1]
mov qword [rsp + 0x30], rbp
test edi, edi
mov rbx, r9
mov ebp, ecx
cmovs edi, eax
test edx, edx
je 0x140008d45
neg edi
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x140008db1
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140008da2
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x140008da2
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140008d6f
inc dword [rbx + 0x20]
jmp 0x140008dab
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140008d9b
test rsi, rsi
je 0x140008d9b
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x140008d9b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_33
inc qword [rbx]
dec edi
test edi, edi
jg 0x140008d50
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140008dd3
cmp qword [rbx], rax
jb 0x140008dd3
cmp qword [rbx + 0x18], 0
jne 0x140008dcb
inc dword [rbx + 0x20]
jmp 0x140008ddc
mov rcx, rbx
call fcn.140007f40
mov rax, qword [rbx]
mov byte [rax], bpl
inc qword [rbx]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x140008e50
neg edi
movsxd rsi, edi
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140008e42
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x140008e42
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140008e0f
inc dword [rbx + 0x20]
jmp 0x140008e4b
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140008e3b
test rdi, rdi
je 0x140008e3b
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x140008e3b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_33
inc qword [rbx]
dec rsi
jne 0x140008df0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140009160
Capabilities:
Write file on windows

Disassembly:
test edx, edx
jle 0x140009229
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov qword [rsp + 0x30], rsi
mov rbx, r8
mov ebp, edx
mov qword [rsp + 0x38], rdi
mov r14, rcx
nop word [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x14000919e
mov eax, dword [rbx + 0x10]
sub eax, dword [rbx]
jmp 0x1400091a0
mov eax, ebp
test eax, eax
jg 0x1400091e5
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000920c
mov rcx, qword [rbx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x1400091dc
test rdi, rdi
je 0x1400091dc
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x1400091dc
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x140009206
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
cmovl esi, eax
mov rdx, r14
movsxd rdi, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_memmove]
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x140009190
jmp 0x14000920f
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400092e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp dword [r8], 0
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov esi, ecx
jle 0x140009358
test ecx, ecx
je 0x140009358
mov ecx, dword [rdx]
test ecx, ecx
je 0x140009321
mov rdx, rbx
call fcn.140009230
dec dword [rdi]
mov dword [r14], 0
cmp dword [rdi], 0
jle 0x140009358
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140009348
cmp qword [rbx], rax
jb 0x140009348
cmp qword [rbx + 0x18], 0
jne 0x140009340
inc dword [rbx + 0x20]
jmp 0x140009351
mov rcx, rbx
call fcn.140007f40
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
dec dword [rdi]
cmp dword [rdi], 0
jg 0x140009326
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jle 0x1400093cd
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400093b6
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x1400093b6
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140009383
inc dword [rbx + 0x20]
jmp 0x1400093bf
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x1400093af
test rsi, rsi
je 0x1400093af
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x1400093af
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], Ordinal_33
inc qword [rbx]
dec dword [rdi]
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jg 0x140009364
mov esi, dword [r14]
test esi, esi
je 0x14000940f
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400093f6
cmp qword [rbx], rax
jb 0x1400093f6
cmp qword [rbx + 0x18], 0
jne 0x1400093ee
inc dword [rbx + 0x20]
jmp 0x1400093ff
mov rcx, rbx
call fcn.140007f40
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
mov eax, dword [rdi]
test eax, eax
jle 0x140009409
dec eax
jmp 0x14000940d
jns 0x14000940f
inc eax
mov dword [rdi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140009ad0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rdx
mov rbp, rcx
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x140009b43
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov ebx, eax
call fcn.14000aab0
cmp ebx, 5
je 0x140009b1c
lea eax, [rbx - 0x20]
cmp eax, 1
ja 0x140009b5a
inc edi
cmp edi, 0x64
jg 0x140009b5a
mov ecx, 0x186a0
call fcn.140007be0
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x140009b00
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
or eax, 0xffffffff
jmp 0x140009b45
Function at 0x14000a130
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1400114e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea r14d, [rdx + 1]
mov rbp, rcx
xor r15d, r15d
movsxd rcx, r14d
movzx r12d, r8b
mov dword [rsp + 0x20], r15d
call qword [sym.imp.MSVCR120.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000a360
lea rdx, [0x14000e788]
lea rcx, str.CONIN_
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], rdi
call qword [sym.imp.MSVCR120.dll_fopen]
lea rdx, [0x14000e788]
lea rcx, str.CONOUT_
mov rdi, rax
call qword [sym.imp.MSVCR120.dll_fopen]
mov rbx, rax
test rdi, rdi
je 0x14000a20d
test rax, rax
je 0x14000a204
lea rcx, str.OSTYPE
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
je 0x14000a22e
lea rcx, str.OSTYPE
call qword [sym.imp.MSVCR120.dll_getenv]
mov rcx, r15
lea r8, str.msys
mov rdx, rax
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x14000a22e
cmp rcx, 5
jne 0x14000a1f0
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_fclose]
test rbx, rbx
je 0x14000a21b
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_fclose]
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdi, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea rbx, [rax + 0x60]
test r12b, r12b
jne 0x14000a263
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll__fileno]
mov ecx, eax
call qword [sym.imp.MSVCR120.dll__get_osfhandle]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
test rbp, rbp
je 0x14000a286
mov rcx, rbp
call qword [sym.imp.libintl.dll_libintl_gettext]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCR120.dll_fputs]
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_fflush]
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll_fgets]
test rax, rax
jne 0x14000a29c
mov byte [rsi], al
or rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x14000a2a0
test eax, eax
jle 0x14000a305
movsxd r14, eax
cmp byte [r14 + rsi - 1], 0xa
je 0x14000a2ff
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 0x80
call qword [sym.imp.MSVCR120.dll_fgets]
test rax, rax
je 0x14000a2f7
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14000a2e1
test eax, eax
jle 0x14000a2f7
cdqe
cmp byte [rsp + rax + 0x2f], 0xa
jne 0x14000a2c0
cmp byte [r14 + rsi - 1], 0xa
jne 0x14000a305
mov byte [r14 + rsi - 1], 0
test r12b, r12b
jne 0x14000a330
mov edx, dword [rsp + 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea rcx, [0x14000d104]
mov rdx, rbx
call qword [sym.imp.MSVCR120.dll_fputs]
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_fflush]
call qword [sym.imp.MSVCR120.dll___iob_func]
cmp rdi, rax
je 0x14000a34d
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_fclose]
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_fclose]
mov rdi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x100]
mov rax, rsi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14000adb0
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x14000a450
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
cmp qword [str.msvcrt], 0
mov rsi, rcx
je 0x14000a500
mov qword [rsp + 0x30], rbp
lea rbp, str.msvcrt
mov qword [rsp + 0x38], rdi
xor edi, edi
mov rcx, rbp
mov ebx, edi
mov rax, qword [rbx + rbp + 0x10]
test rax, rax
jne 0x14000a4d7
cmp qword [rbx + rbp + 8], rax
jne 0x14000a4dc
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbx + rbp + 8], rax
test rax, rax
jne 0x14000a4b2
mov qword [rbx + rbp + 8], 0xffffffffffffffff
jmp 0x14000a4dc
lea rdx, [0x14000e8d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + rbp + 0x10], rax
test rax, rax
jne 0x14000a4d7
mov qword [rbx + rbp + 8], 0xffffffffffffffff
jmp 0x14000a4dc
mov rcx, rsi
call rax
inc rdi
lea rcx, [rdi + rdi*2]
lea rbx, [rcx*8]
cmp qword [rbx + rbp], 0
lea rcx, [rbx + rbp]
jne 0x14000a483
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll__strdup]
mov rbx, rax
test rax, rax
je 0x14000a530
mov edx, Ordinal_65
mov rcx, rax
call qword [sym.imp.MSVCR120.dll_strchr]
mov rdx, rax
test rax, rax
jne 0x14000a53e
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_free]
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov byte [rax], 0
inc rdx
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x14000a550
test rax, rax
je 0x14000a56b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x14000a527
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_free]
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.MSVCR120.dll__putenv]

Function at 0x14001a025
Capabilities:
Resolve function by hash

Disassembly:
movabs eax, dword fs:[0xc78c08500000030]
mov eax, dword [rax + 0xc]
mov esi, dword [rax + 0x1c]
lodsd eax, dword [rsi]
mov ebx, dword [rax + 8]
jmp 0x14001a044
pop rsi
add esi, 3
push rbx
mov edx, 0xec0e4e8e
call rsi
push rax
mov edx, 0x7c0dfcaa
call rsi
push rax
push rdi
mov edx, 0x4ee4a045
call rsi
xor edx, edx
push rdx
push 0x6d756369
push 0x6c656167
push rsp
push rdx
push rdx
call rax
push rax
mov edx, 0x75da1966
call rsi
call rax
xchg edi, eax
mov edx, 0xffd97fb
call rsi
call rax
cmp edi, 0xb7
jne 0x14001a093
mov esp, ebp
invalid
call fcn.14001a0b4
sti
xchg edi, eax
std
pcmpeqd mm5, qword [rbp - 0x50]
jb 0x14001a0a0
jb 0x14001a0a0
mov bl, 0x16
movabs eax, dword [0xd368a7c7d2d83d6a]
invalid