joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110106bc0
Capabilities:
Check if file exists

Disassembly:
jmp 0x110107330
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x110107386
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
or rax, 0xffffffffffffffff
jmp 0x11010744d
test rcx, rcx
je 0x11010735e
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1101073e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x1101073b9
cmp eax, 3
jbe 0x1101073d3
cmp eax, 8
je 0x1101073c6
cmp eax, 0x12
je 0x1101073d3
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x11010737d
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x11010737d
call sym.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x11010737d
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.11010729c
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.11010729c
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.11010729c
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call sym.msvcrt.dll_strcpy_s
test eax, eax
je 0x11010744a
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1101303f0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x110106bd0
Capabilities:
Check if file exists

Disassembly:
jmp 0x110107478
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
jne 0x1101074c9
call sym.msvcrt.dll__errno
xor ebx, ebx
xor r9d, r9d
mov dword [rax], 0x16
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call sym.msvcrt.dll__invalid_parameter
or eax, 0xffffffff
jmp 0x110107593
xor ebx, ebx
test rdi, rdi
jne 0x1101074d7
call sym.msvcrt.dll__errno
jmp 0x1101074a7
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileA]
test eax, eax
jne 0x110107527
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x110107500
cmp eax, 3
jbe 0x11010751a
cmp eax, 8
je 0x11010750d
cmp eax, 0x12
je 0x11010751a
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x1101074c1
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x1101074c1
call sym.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x1101074c1
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, ebx
mov dword [rdi], eax
call fcn.11010729c
lea rcx, [rsp + 0x3c]
mov qword [rdi + 8], rax
call fcn.11010729c
lea rcx, [rsp + 0x44]
mov qword [rdi + 0x10], rax
call fcn.11010729c
mov qword [rdi + 0x18], rax
lea rcx, [rdi + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rdi + 0x20], eax
call sym.msvcrt.dll_strcpy_s
test eax, eax
je 0x110107591
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1101303f0
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x180
pop rdi
ret
Function at 0x110106be0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x110106c36
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
or rax, 0xffffffffffffffff
jmp 0x110106d09
test rcx, rcx
je 0x110106c0e
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x110106c90
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x110106c69
cmp eax, 3
jbe 0x110106c83
cmp eax, 8
je 0x110106c76
cmp eax, 0x12
je 0x110106c83
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x110106c2d
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x110106c2d
call sym.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x110106c2d
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.11010729c
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.11010729c
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.11010729c
mov ecx, dword [rsp + 0x4c]
lea r8, [rsp + 0x5c]
shl rcx, 0x20
mov edx, 0x104
mov qword [rbx + 0x18], rax
mov eax, dword [rsp + 0x50]
add rcx, rax
mov qword [rbx + 0x20], rcx
lea rcx, [rbx + 0x28]
call sym.msvcrt.dll_strcpy_s
test eax, eax
je 0x110106d06
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1101303f0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x110106eb0
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov rax, rdx
test rdx, rdx
jne 0x110106ef9
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
mov eax, 0x57
jmp 0x110106f65
cmp ecx, 0x1a
ja 0x110106ed3
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
test ecx, ecx
jne 0x110106f0d
mov r10, rbx
jmp 0x110106f28
add cx, 0x40
mov dword [rsp + 0x32], 0x5c003a
mov word [rsp + 0x30], cx
lea r10, [rsp + 0x30]
mov word [rsp + 0x36], bx
lea r9, [rdx + 4]
mov qword [rsp + 0x20], rax
lea r8, [rdx + 0xc]
mov rcx, r10
add rdx, 8
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x110106f63
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call sym.msvcrt.dll__errno
mov ecx, edi
mov rbx, rax
call fcn.110107e30
mov dword [rbx], eax
mov eax, edi
jmp 0x110106f65
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1101303f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x110106fb0
Capabilities:
Check if file exists

Disassembly:
jmp 0x1101075bc
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x110107612
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
or rax, 0xffffffffffffffff
jmp 0x1101076d9
test rcx, rcx
je 0x1101075ea
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x11010766c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x110107645
cmp eax, 3
jbe 0x11010765f
cmp eax, 8
je 0x110107652
cmp eax, 0x12
je 0x11010765f
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x110107609
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x110107609
call sym.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x110107609
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.11010729c
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.11010729c
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.11010729c
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call sym.msvcrt.dll_wcscpy_s
test eax, eax
je 0x1101076d6
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1101303f0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x110106fc0
Capabilities:
Check if file exists

Disassembly:
jmp 0x110107704
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
jne 0x110107755
call sym.msvcrt.dll__errno
xor ebx, ebx
xor r9d, r9d
mov dword [rax], 0x16
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call sym.msvcrt.dll__invalid_parameter
or eax, 0xffffffff
jmp 0x11010781f
xor ebx, ebx
test rdi, rdi
jne 0x110107763
call sym.msvcrt.dll__errno
jmp 0x110107733
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x1101077b3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x11010778c
cmp eax, 3
jbe 0x1101077a6
cmp eax, 8
je 0x110107799
cmp eax, 0x12
je 0x1101077a6
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x11010774d
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x11010774d
call sym.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x11010774d
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, ebx
mov dword [rdi], eax
call fcn.11010729c
lea rcx, [rsp + 0x3c]
mov qword [rdi + 8], rax
call fcn.11010729c
lea rcx, [rsp + 0x44]
mov qword [rdi + 0x10], rax
call fcn.11010729c
mov qword [rdi + 0x18], rax
lea rcx, [rdi + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rdi + 0x20], eax
call sym.msvcrt.dll_wcscpy_s
test eax, eax
je 0x11010781d
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1101303f0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
Function at 0x110106fd0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x110107026
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
or rax, 0xffffffffffffffff
jmp 0x1101070f9
test rcx, rcx
je 0x110106ffe
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x110107080
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x110107059
cmp eax, 3
jbe 0x110107073
cmp eax, 8
je 0x110107066
cmp eax, 0x12
je 0x110107073
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x11010701d
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x11010701d
call sym.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x11010701d
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.11010729c
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.11010729c
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.11010729c
mov ecx, dword [rsp + 0x4c]
lea r8, [rsp + 0x5c]
shl rcx, 0x20
mov edx, 0x104
mov qword [rbx + 0x18], rax
mov eax, dword [rsp + 0x50]
add rcx, rax
mov qword [rbx + 0x20], rcx
lea rcx, [rbx + 0x28]
call sym.msvcrt.dll_wcscpy_s
test eax, eax
je 0x1101070f6
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1101303f0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x110107330
Capabilities:
Check if file exists

Disassembly:
jmp 0x110107330
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x110107386
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
or rax, 0xffffffffffffffff
jmp 0x11010744d
test rcx, rcx
je 0x11010735e
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1101073e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x1101073b9
cmp eax, 3
jbe 0x1101073d3
cmp eax, 8
je 0x1101073c6
cmp eax, 0x12
je 0x1101073d3
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x11010737d
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x11010737d
call sym.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x11010737d
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.11010729c
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.11010729c
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.11010729c
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call sym.msvcrt.dll_strcpy_s
test eax, eax
je 0x11010744a
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1101303f0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1101075bc
Capabilities:
Check if file exists

Disassembly:
jmp 0x1101075bc
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x110190928]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x110107612
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
or rax, 0xffffffffffffffff
jmp 0x1101076d9
test rcx, rcx
je 0x1101075ea
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x11010766c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jb 0x110107645
cmp eax, 3
jbe 0x11010765f
cmp eax, 8
je 0x110107652
cmp eax, 0x12
je 0x11010765f
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
jmp 0x110107609
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x110107609
call sym.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x110107609
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.11010729c
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.11010729c
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.11010729c
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call sym.msvcrt.dll_wcscpy_s
test eax, eax
je 0x1101076d6
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1101303f0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x110107850
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov rsi, rcx
cmp edx, 1
jne 0x110107871
call fcn.110130780
mov r8, rdi
mov edx, ebx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x110107894
push rbx
sub rsp, 0x20
mov rbx, r8
cmp edx, 1
jne 0x110107915
call fcn.110107b00
test eax, eax
je 0x1101078be
call fcn.11011a214
test eax, eax
jns 0x1101078c5
call fcn.11013abe8
call fcn.1101197f4
xor eax, eax
jmp 0x1101079c1
call fcn.1101308e4
mov qword [0x1101945a0], rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineA]
mov qword [sym.msvcrt.dll__acmdln], rax
call sub.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW
mov qword [sym.msvcrt.dll__wcmdln], rax
call fcn.110120aa0
call fcn.11013c020
test eax, eax
js 0x11010790e
xor ecx, ecx
call fcn.11013a224
test eax, eax
jne 0x11010790e
inc dword [0x11019459c]
jmp 0x1101079bc
call fcn.11011a4b0
jmp 0x1101078b4
test edx, edx
jne 0x110107953
mov eax, dword [0x11019459c]
test eax, eax
jle 0x1101078be
dec eax
cmp dword [0x110194d1c], edx
mov dword [0x11019459c], eax
jne 0x110107938
call sym.msvcrt.dll__cexit
call fcn.11013a15c
test rbx, rbx
jne 0x1101079bc
call fcn.11011a4b0
call fcn.11013abe8
call fcn.1101197f4
jmp 0x1101079bc
cmp edx, 2
jne 0x1101079b0
call sym.msvcrt.dll__CrtDbgReport
mov ecx, dword [0x110190c30]
call qword [sym.imp.api_ms_win_core_fibers_l1_1_0.dll_FlsGetValue]
test rax, rax
jne 0x1101079bc
mov edx, 0x2d8
lea ecx, [rax + 1]
call fcn.110119e8c
mov rbx, rax
test rax, rax
je 0x1101078be
mov ecx, dword [0x110190c30]
mov rdx, rax
call qword [sym.imp.api_ms_win_core_fibers_l1_1_0.dll_FlsSetValue]
mov rcx, rbx
test eax, eax
je 0x1101079a6
xor edx, edx
call fcn.11013aa90
jmp 0x1101079bc
call sym.msvcrt.dll_free
jmp 0x1101078be
cmp edx, 3
jne 0x1101079bc
xor ecx, ecx
call fcn.11013a99c
mov eax, 1
add rsp, 0x20
pop rbx
ret
cmp dword [rsp + 8], 1
jne 0x110170330
push 0
push 0
push 0x776b387e
push 0x76e00bd0
push 0
push 0
mov eax, 0x76e00f10
call rax
jmp 0x110107850
Function at 0x110107894
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov rsi, rcx
cmp edx, 1
jne 0x110107871
call fcn.110130780
mov r8, rdi
mov edx, ebx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x110107894
push rbx
sub rsp, 0x20
mov rbx, r8
cmp edx, 1
jne 0x110107915
call fcn.110107b00
test eax, eax
je 0x1101078be
call fcn.11011a214
test eax, eax
jns 0x1101078c5
call fcn.11013abe8
call fcn.1101197f4
xor eax, eax
jmp 0x1101079c1
call fcn.1101308e4
mov qword [0x1101945a0], rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineA]
mov qword [sym.msvcrt.dll__acmdln], rax
call sub.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW
mov qword [sym.msvcrt.dll__wcmdln], rax
call fcn.110120aa0
call fcn.11013c020
test eax, eax
js 0x11010790e
xor ecx, ecx
call fcn.11013a224
test eax, eax
jne 0x11010790e
inc dword [0x11019459c]
jmp 0x1101079bc
call fcn.11011a4b0
jmp 0x1101078b4
test edx, edx
jne 0x110107953
mov eax, dword [0x11019459c]
test eax, eax
jle 0x1101078be
dec eax
cmp dword [0x110194d1c], edx
mov dword [0x11019459c], eax
jne 0x110107938
call sym.msvcrt.dll__cexit
call fcn.11013a15c
test rbx, rbx
jne 0x1101079bc
call fcn.11011a4b0
call fcn.11013abe8
call fcn.1101197f4
jmp 0x1101079bc
cmp edx, 2
jne 0x1101079b0
call sym.msvcrt.dll__CrtDbgReport
mov ecx, dword [0x110190c30]
call qword [sym.imp.api_ms_win_core_fibers_l1_1_0.dll_FlsGetValue]
test rax, rax
jne 0x1101079bc
mov edx, 0x2d8
lea ecx, [rax + 1]
call fcn.110119e8c
mov rbx, rax
test rax, rax
je 0x1101078be
mov ecx, dword [0x110190c30]
mov rdx, rax
call qword [sym.imp.api_ms_win_core_fibers_l1_1_0.dll_FlsSetValue]
mov rcx, rbx
test eax, eax
je 0x1101079a6
xor edx, edx
call fcn.11013aa90
jmp 0x1101079bc
call sym.msvcrt.dll_free
jmp 0x1101078be
cmp edx, 3
jne 0x1101079bc
xor ecx, ecx
call fcn.11013a99c
mov eax, 1
add rsp, 0x20
pop rbx
ret
cmp dword [rsp + 8], 1
jne 0x110170330
push 0
push 0
push 0x776b387e
push 0x76e00bd0
push 0
push 0
mov eax, 0x76e00f10
call rax
jmp 0x110107850

Function at 0x1101079d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x50]
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov r10d, dword [rax]
mov dword [0x110194674], r10d
test r9d, r9d
je 0x110107a03
call fcn.11013b600
jmp 0x110107a08
call fcn.11013b2a0
mov r9d, eax
test eax, eax
jns 0x110107a19
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov eax, dword [sym.msvcrt.dll___argc]
mov dword [rsi], eax
mov rax, qword [sym.msvcrt.dll___argv]
mov rsi, qword [rsp + 0x38]
mov qword [rdi], rax
mov rax, qword [sym.msvcrt.dll__environ]
mov qword [rbx], rax
mov eax, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x110107a50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rax, qword [rsp + 0x50]
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov r10d, dword [rax]
mov dword [0x110194674], r10d
test r9d, r9d
je 0x110107a89
call fcn.11013bcb4
jmp 0x110107a8e
call fcn.11013b980
mov ebx, eax
test eax, eax
jns 0x110107a9e
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
mov eax, dword [sym.msvcrt.dll___argc]
mov dword [r14], eax
mov rax, qword [sym.msvcrt.dll___wargv]
mov qword [rsi], rax
cmp qword [sym.msvcrt.dll__wenviron], 0
jne 0x110107ad5
call fcn.11013085c
mov qword [0x1101945a8], rax
call fcn.11013c158
test eax, eax
jns 0x110107ad5
call fcn.1101306c4
mov rax, qword [sym.msvcrt.dll__wenviron]
mov rsi, qword [rsp + 0x38]
mov qword [rdi], rax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x110107f00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
test rcx, rcx
jne 0x110107f3a
call sym.msvcrt.dll___doserrno
and dword [rax], 0
call sym.msvcrt.dll__errno
and qword [rsp + 0x20], 0
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call sym.msvcrt.dll__invalid_parameter
mov eax, ebx
jmp 0x110107f8a
test ebx, 0xfffffff0
jne 0x110107f0d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x110107f63
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.110107d08
call sym.msvcrt.dll__errno
mov eax, dword [rax]
jmp 0x110107f8a
test al, 0x10
jne 0x110107f88
test al, 1
je 0x110107f88
test bl, 2
je 0x110107f88
call sym.msvcrt.dll___doserrno
mov dword [rax], 5
call sym.msvcrt.dll__errno
mov dword [rax], 0xd
jmp 0x110107f5a
xor eax, eax
add rsp, 0x30
pop rbx
ret