joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004acba0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1004acbc0
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
mov ebx, eax
test eax, eax
je 0x1004acbb4
movsxd rcx, eax
call sym.bash.exe_xmalloc
xor edx, edx
mov dword [rsp + 0x28], ebx
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rsi, rax
mov r9d, 0xffffffff
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
call rbp
cmp ebx, eax
jne 0x1004accf8
test rsi, rsi
je 0x1004acbb4
mov edx, 0xd
mov rcx, rsi
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x1004accd0
sub rax, rsi
lea ecx, [rax + 1]
mov rbx, rax
movsxd rcx, ecx
call sym.bash.exe_xmalloc
movsxd r8, ebx
mov rdx, rsi
mov byte [rax + r8], 0
mov rcx, rax
mov rdi, rax
call sub.msys_2.0.dll_strncpy
mov rax, qword [sym.bash.exe_rl_point]
mov ecx, dword [rax]
call sym.bash.exe__rl_set_mark_at_pos
mov rcx, rdi
call sym.bash.exe_rl_insert_text
cmp rdi, rsi
je 0x1004acbb4
mov rcx, rdi
call sym.bash.exe_xfree
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rax, qword [sym.bash.exe_rl_point]
mov ecx, dword [rax]
call sym.bash.exe__rl_set_mark_at_pos
mov rcx, rsi
call sym.bash.exe_rl_insert_text
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rsi
call sym.bash.exe_xfree
jmp 0x1004acbb4

Function at 0x1004b7910
Capabilities:
Move file

Disassembly:
push rdi
mov eax, 0x1030
push rsi
push rbx
call fcn.100513c00
sub rsp, rax
mov r8d, 0x1000
mov rbx, rdx
lea rdi, [rsp + 0x20]
mov rsi, rcx
mov rdx, rdi
mov rcx, rbx
call sub.msys_2.0.dll_readlink
test rax, rax
jg 0x1004b7960
mov rdx, rbx
mov rcx, rsi
call sub.msys_2.0.dll_rename
add rsp, 0x1030
pop rbx
pop rsi
pop rdi
ret
mov rdx, rdi
mov rcx, rsi
mov byte [rsp + rax + 0x20], 0
call sub.msys_2.0.dll_rename
add rsp, 0x1030
pop rbx
pop rsi
pop rdi
ret

Function at 0x1004b83b0
Capabilities:
Get file attributes

Disassembly:
mov r8d, 0xffffffff
xor edx, edx
jmp sym.bash.exe_read_history_range
Function at 0x1004b88e0
Capabilities:
Get file attributes

Disassembly:
mov rax, qword [sym.bash.exe_history_length]
mov r8d, 1
mov edx, dword [rax]
jmp 0x1004b7a20

Function at 0x1004b9b20
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.bash.exe__rl_color_indicator]
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x1004b9b51
mov rdx, qword [rbx + 0x48]
cmp rax, 1
je 0x1004b9b60
cmp rax, 2
jne 0x1004b9b65
cmp byte [rdx], 0x30
jne 0x1004b9b65
cmp byte [rdx + 1], 0x30
jne 0x1004b9b65
add rsp, 0x28
pop rbx
pop rsi
ret
cmp byte [rdx], 0x30
je 0x1004b9b51
mov rsi, qword [sym.bash.exe_rl_outstream]
mov rdx, qword [rbx]
mov r8d, 1
mov rcx, qword [rbx + 8]
mov r9, qword [rsi]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x48]
mov r8d, 1
mov r9, qword [rsi]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov r8d, 1
mov r9, qword [rsi]
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msys_2.0.dll_fwrite

Function at 0x1004b9bc0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [sym.bash.exe__rl_color_ext_list]
test rbx, rbx
je 0x1004b9c10
lea rsi, str..readline_colored_completion_prefix
jmp 0x1004b9be9
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x1004b9c10
cmp qword [rbx], 0x23
jne 0x1004b9be0
mov rcx, qword [rbx + 8]
cmp byte [rcx], 0x2e
jne 0x1004b9be0
mov r8d, 0x23
mov rdx, rsi
call sub.msys_2.0.dll_strncmp
test eax, eax
jne 0x1004b9be0
add rbx, 0x10
jmp 0x1004b9c1e
mov rsi, qword [sym.bash.exe__rl_color_indicator]
lea rbx, [rsi + 0x90]
cmp qword [rbx + 8], 0
mov eax, 1
je 0x1004b9c88
mov ecx, 4
call fcn.1004b9aa0
test al, al
jne 0x1004b9c90
mov rsi, qword [sym.bash.exe__rl_color_indicator]
mov rdi, qword [sym.bash.exe_rl_outstream]
mov rdx, qword [rsi]
mov rcx, qword [rsi + 8]
mov r8d, 1
mov r9, qword [rdi]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
mov r8d, 1
mov r9, qword [rdi]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov r8d, 1
mov r9, qword [rdi]
call sub.msys_2.0.dll_fwrite
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rsi, qword [sym.bash.exe__rl_color_indicator]
mov rdi, qword [sym.bash.exe_rl_outstream]
mov r8d, 1
mov rdx, qword [rsi]
mov rcx, qword [rsi + 8]
mov r9, qword [rdi]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
mov r8d, 1
mov r9, qword [rdi]
call sub.msys_2.0.dll_fwrite
jmp 0x1004b9c46
Function at 0x1004ba1c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.bash.exe__rl_color_indicator]
mov rsi, qword [sym.bash.exe_rl_outstream]
mov rcx, qword [rbx + 0x28]
mov r9, qword [rsi]
test rcx, rcx
je 0x1004ba1f8
mov rdx, qword [rbx + 0x20]
mov r8d, 1
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
mov r8d, 1
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x38]
mov r8d, 1
mov r9, qword [rsi]
call sub.msys_2.0.dll_fwrite
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov r9, qword [rsi]
jmp 0x1004ba1e4
Function at 0x1004ba230
Capabilities:
Parse credit card information

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
xor eax, eax
lea rbp, [0x10053e7a0]
mov rdi, rcx
mov rcx, qword [rdx]
mov rsi, rdx
mov r12d, r8d
mov r13, qword [rdi]
xor edx, edx
movzx r10d, byte [rcx]
xor ebx, ebx
cmp ebx, 2
jne 0x1004ba3be
lea r11d, [r10 - 0x30]
cmp r11b, 7
jbe 0x1004ba330
mov byte [r13], dl
movzx r10d, byte [rcx]
lea rbx, [r13 + 1]
add rax, 1
mov r11, rcx
cmp r10b, 0x5c
je 0x1004ba2e2
jg 0x1004ba348
cmp r10b, 0x3d
je 0x1004ba2c0
jg 0x1004ba2c9
test r10b, r10b
je 0x1004ba2a1
cmp r10b, 0x3a
jne 0x1004ba2c9
mov rcx, r11
mov r8d, 1
mov qword [rdi], rbx
mov qword [rsi], rcx
mov qword [r9], rax
mov eax, r8d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r12b, r12b
jne 0x1004ba3e0
add r11, 1
mov byte [rbx], r10b
add rax, 1
add rbx, 1
movzx r10d, byte [r11]
cmp r10b, 0x5c
jne 0x1004ba288
movzx edx, byte [r11 + 1]
test dl, dl
je 0x1004ba430
lea r10d, [rdx - 0x30]
cmp r10b, 0x48
ja case.0x1004ba305.8
movzx ecx, r10b
movsxd rcx, dword [rbp + rcx*4]
add rcx, rbp
jmp rcx
mov edx, 0x7f
nop dword [rax]
mov byte [rbx], dl
lea r13, [rbx + 1]
add rax, 1
xor ebx, ebx
movzx r10d, byte [r11 + 2]
lea rcx, [r11 + 2]
jmp 0x1004ba258
add rcx, 1
lea edx, [r10 + rdx*8 - 0x30]
movzx r10d, byte [rcx]
jmp 0x1004ba261
cmp r10b, 0x5e
jne 0x1004ba2c9
movzx r10d, byte [r11 + 1]
lea ecx, [r10 - 0x40]
cmp cl, 0x3e
ja 0x1004ba380
and r10d, 0x1f
lea rcx, [r11 + 2]
lea r13, [rbx + 1]
add rax, 1
mov byte [rbx], r10b
movzx r10d, byte [r11 + 2]
jmp 0x1004ba256
lea rcx, [r11 + 1]
cmp r10b, 0x3f
je 0x1004ba398
xor r8d, r8d
jmp 0x1004ba2aa
mov byte [rbx], 0x7f
lea r13, [rbx + 1]
movzx r10d, byte [r11 + 1]
add rax, 1
jmp 0x1004ba256
mov byte [rbx], dl
movzx r10d, byte [rcx]
lea r13, [rbx + 1]
add rax, 1
mov r11, rcx
mov rbx, r13
jmp 0x1004ba282
mov r13, rbx
mov edx, r10d
mov ebx, 2
jmp 0x1004ba31c
mov rcx, r11
jmp 0x1004ba2aa
mov edx, 0xb
jmp case.0x1004ba305.8
mov edx, 9
jmp case.0x1004ba305.8
mov edx, 0xd
jmp case.0x1004ba305.8
mov edx, 0xa
jmp case.0x1004ba305.8
mov edx, 0xc
jmp case.0x1004ba305.8
mov edx, 0x1b
jmp case.0x1004ba305.8
mov edx, 0x20
jmp case.0x1004ba305.8
lea rcx, [r11 + 2]
xor r8d, r8d
jmp 0x1004ba2aa
movzx r10d, byte [r11 + 2]
lea rcx, [r11 + 2]
xor edx, edx
nop word [rax + rax]
cmp r10b, 0x46
jg 0x1004ba480
cmp r10b, 0x40
jg 0x1004ba4b8
lea r11d, [r10 - 0x30]
cmp r11b, 9
ja 0x1004ba3b0
shl edx, 4
add rcx, 1
lea edx, [r10 + rdx - 0x30]
movzx r10d, byte [rcx]
cmp r10b, 0x46
jle 0x1004ba456
lea r11d, [r10 - 0x61]
cmp r11b, 5
ja 0x1004ba3b0
shl edx, 4
add rcx, 1
lea edx, [r10 + rdx - 0x57]
movzx r10d, byte [rcx]
jmp 0x1004ba450
mov edx, 8
jmp case.0x1004ba305.8
mov edx, 7
jmp case.0x1004ba305.8
shl edx, 4
add rcx, 1
lea edx, [r10 + rdx - 0x37]
movzx r10d, byte [rcx]
jmp 0x1004ba450
Function at 0x1004ba7f0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov rax, qword [sym.bash.exe_rl_explicit_arg]
mov r8d, dword [rax]
mov esi, edx
test r8d, r8d
jne 0x1004ba81e
mov eax, dword [sym.bash.exe_rl_blink_matching_paren]
test eax, eax
jne 0x1004ba840
call sym.bash.exe__rl_insert_char
xor eax, eax
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 1
call sym.bash.exe__rl_insert_char
mov rax, qword [sym.bash.exe_rl_redisplay_function]
call qword [rax]
mov r12, qword [sym.bash.exe_rl_point]
mov rax, qword [sym.bash.exe_rl_line_buffer]
mov ebx, dword [r12]
mov rdi, qword [rax]
cmp esi, 0x5d
je 0x1004ba900
cmp esi, 0x7d
je 0x1004baa10
cmp esi, 0x29
jne 0x1004baa00
mov dword [rsp + 0x3c], 0x28
sub ebx, 2
js 0x1004baa00
mov rax, qword [sym.bash.exe_rl_basic_quote_characters]
xor r13d, r13d
mov r15d, 1
mov r14, qword [rax]
movsxd rax, ebx
add rdi, rax
jmp 0x1004ba8d7
test r14, r14
je 0x1004ba910
mov edx, ebp
mov rcx, r14
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x1004ba910
mov r13d, ebp
sub ebx, 1
sub rdi, 1
cmp ebx, 0xffffffff
je 0x1004baa00
movsx ebp, byte [rdi]
test r13d, r13d
je 0x1004ba8b0
cmp r13d, ebp
je 0x1004ba9e0
test r14, r14
je 0x1004ba8c7
mov edx, ebp
mov rcx, r14
call sub.msys_2.0.dll_strchr
test rax, rax
cmovne r13d, ebp
jmp 0x1004ba8c7
mov dword [rsp + 0x3c], 0x5b
jmp 0x1004ba88b
cmp esi, ebp
je 0x1004ba9f0
cmp dword [rsp + 0x3c], ebp
jne 0x1004ba8c7
sub r15d, 1
test r15d, r15d
jne 0x1004ba8c7
mov rbp, qword [sym.bash.exe_rl_instream]
lea rsi, [rsp + 0x50]
xor eax, eax
mov ecx, 0x10
mov rdi, rsi
rep stosq qword [rdi], rax
mov rcx, qword [rbp]
call sub.msys_2.0.dll_fileno
mov rcx, qword [rbp]
mov edi, eax
call sub.msys_2.0.dll_fileno
mov ecx, edi
mov edi, dword [r12]
mov dword [r12], ebx
mov edx, eax
lea eax, [rax + 0x3f]
test edx, edx
cmovns eax, edx
mov edx, 1
shl rdx, cl
sar eax, 6
cdqe
or qword [rsp + rax*8 + 0x50], rdx
movsxd rax, dword [0x10051f980]
mov rdx, rax
imul rax, rax, 0x431bde83
mov ecx, edx
sar ecx, 0x1f
sar rax, 0x32
sub eax, ecx
movsxd rcx, eax
imul eax, eax, 0xf4240
mov qword [rsp + 0x40], rcx
sub edx, eax
mov rax, qword [sym.bash.exe_rl_redisplay_function]
movsxd rdx, edx
mov qword [rsp + 0x48], rdx
call qword [rax]
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov ecx, 1
call sub.msys_2.0.dll_select
mov dword [r12], edi
jmp 0x1004ba823
xor r13d, r13d
jmp 0x1004ba8c7
add r15d, 1
jmp 0x1004ba922
mov eax, 1
jmp 0x1004ba825
mov dword [rsp + 0x3c], 0x7b
jmp 0x1004ba88b
Function at 0x1004c3560
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rsi, [rsp + 0x58]
mov qword [rsp + 0x68], r9
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
call fcn.1004c3230
mov qword [rsp + 0x28], rsi
call sub.msys_2.0.dll___getreent
mov r8, rsi
mov rdx, rbx
mov rcx, qword [rax + 0x18]
call sub.msys_2.0.dll_vfprintf
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call fcn.100513f60
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop dword [rax]

Function at 0x1004c35c0
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rsi, [rsp + 0x58]
mov qword [rsp + 0x68], r9
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
call fcn.1004c3230
mov qword [rsp + 0x28], rsi
call sub.msys_2.0.dll___getreent
mov r8, rsi
mov rdx, rbx
mov rcx, qword [rax + 0x18]
call sub.msys_2.0.dll_vfprintf
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call fcn.100513f60
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1004c5d00
Capabilities:
Read file on windows

Disassembly:
push r14
mov eax, 0x8030
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.100513c00
sub rsp, rax
mov rbp, rdx
mov edx, 4
mov rbx, rcx
call sym.bash.exe__nc_access
test eax, eax
jns 0x1004c5d48
xor esi, esi
mov eax, esi
add rsp, 0x8030
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdx, [0x1005406e4]
mov rcx, rbx
call sub.msys_2.0.dll_fopen
mov rdi, rax
test rax, rax
je 0x1004c5d2b
lea r13, [rsp + 0x20]
mov r9, rax
mov r8d, 0x8001
xor esi, esi
mov edx, 1
mov rcx, r13
call sub.msys_2.0.dll_fread
mov r12, rax
test eax, eax
jg 0x1004c5d90
mov rcx, rdi
call sub.msys_2.0.dll_fclose
jmp 0x1004c5d2d
call sym.bash.exe__nc_get_source
mov r14, rax
test rax, rax
je 0x1004c5dd0
mov r8d, r12d
mov rdx, r13
mov rcx, rbp
call sym.bash.exe__nc_read_termtype
mov esi, eax
test eax, eax
je 0x1004c5dc0
mov rcx, r14
call sym.bash.exe__nc_set_source
jmp 0x1004c5d83
mov rcx, rbp
call sym.bash.exe__nc_free_termtype2
jmp 0x1004c5db1
mov rcx, rbx
call sym.bash.exe__nc_set_source
jmp 0x1004c5d9d
Function at 0x1004c6f90
Capabilities:
Manipulate console buffer

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd r15, r9d
mov ebx, ecx
mov r12d, edx
mov rsi, r8
lea rbp, [r15*4]
mov r14, r15
mov rcx, rbp
call sub.msys_2.0.dll__alloca
movsxd rdi, eax
test r15d, r15d
jle 0x1004c7190
movzx r13d, word [0x100663074]
add rbp, r15
mov r8, rsi
xor ecx, ecx
mov dword [rsp + 0xa0], ebx
lea rbp, [rsi + rbp*4]
lea r15, [0x100662e00]
mov eax, r13d
xor al, al
mov word [rsp + 0x3e], ax
mov rax, qword [sym.bash.exe__nc_wacs]
mov r9, qword [rax]
jmp 0x1004c7030
lea rax, [rbx + rbx*4]
movzx eax, word [r9 + rax*4 + 4]
test ax, ax
je 0x1004c7108
mov word [r11], ax
nop
add ecx, 1
add r8, 0x14
cmp r8, rbp
je 0x1004c7120
mov edx, dword [r8]
movzx ebx, word [r8 + 4]
test dl, 0xfe
je 0x1004c7042
test dl, 0xe0
je 0x1004c7023
movsxd rax, ecx
lea r11, [rdi + rax*4]
mov eax, r13d
mov word [r11], bx
test dh, 0xff
je 0x1004c7072
movzx esi, dh
movsxd r10, esi
lea esi, [r10 - 1]
cmp esi, 0x3e
ja 0x1004c7072
movzx eax, word [rsp + 0x3e]
or ax, word [r15 + r10*2 + 0x1d4]
test edx, 0x40000
je 0x1004c7094
mov esi, eax
mov r10d, eax
shl esi, 4
shr r10w, 4
and esi, 0x70
and r10d, 7
mov al, sil
or al, r10b
test edx, 0x10000
je 0x1004c70bd
mov esi, eax
mov r10d, eax
xor al, al
shl esi, 4
shr r10w, 4
and esi, 0x70
and r10d, 7
or r10d, esi
or r10d, eax
mov eax, r10d
or al, 0x80
mov r10d, eax
or r10d, 8
test edx, 0x200000
cmovne eax, r10d
mov r10d, eax
or r10b, 0x80
test edx, 0x100000
cmovne eax, r10d
and edx, 0x400000
mov word [r11 + 2], ax
je 0x1004c7020
test r9, r9
je 0x1004c7020
movzx eax, bx
sub eax, 1
cmp eax, 0x7e
jbe 0x1004c7008
mov r10d, 0x20
mov word [r11], r10w
jmp 0x1004c7020
mov ebx, dword [rsp + 0xa0]
mov edx, dword [0x100662e04]
movzx r8d, cx
mov word [rsp + 0x48], r12w
mov eax, ebx
or r8d, 0x10000
test edx, edx
jne 0x1004c714b
add ax, word [0x100663078]
mov word [rsp + 0x4a], ax
lea r12d, [r12 + r14 - 1]
xor r9d, r9d
mov rdx, rdi
mov word [rsp + 0x4e], ax
mov rcx, qword [0x100662e28]
lea rax, [rsp + 0x48]
mov word [rsp + 0x4c], r12w
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x1004c7127

Function at 0x1004dc800
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
mov edx, eax
xor eax, eax
test edx, edx
jne 0x1004dc82a
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x4000
sete al
add rsp, 0xa8
ret

Function at 0x1004dc840
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
lea rdx, [rsp + 0x20]
call sub.msys_2.0.dll_stat
mov edx, eax
xor eax, eax
test edx, edx
jne 0x1004dc86a
mov eax, dword [rsp + 0x30]
and eax, 0xf000
cmp eax, 0x8000
sete al
add rsp, 0xa8
ret
Function at 0x1004f7630
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rbp, [0x1005510e0]
lea r12, [0x1005510e4]
mov rsi, rcx
mov rbx, rdx
mov rdi, r8
mov rdx, rcx
mov ecx, 0x22
call sub.msys_2.0.dll_putc
cmp rbx, rdi
je 0x1004f768b
nop dword [rax + rax]
movsx ecx, byte [rbx]
add rbx, 1
cmp cl, 0xa
je 0x1004f76c0
cmp cl, 0x22
je 0x1004f76a8
cmp cl, 0x5c
je 0x1004f76a8
mov rdx, rsi
call sub.msys_2.0.dll_putc
cmp rdi, rbx
jne 0x1004f7668
mov rdx, rsi
mov ecx, 0x22
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msys_2.0.dll_putc
mov ecx, 0x5c
mov rdx, rsi
call sub.msys_2.0.dll_putc
movsx ecx, byte [rbx - 1]
jmp 0x1004f767e
mov r9, rsi
mov r8d, 3
mov edx, 1
mov rcx, rbp
call sub.msys_2.0.dll_fwrite
cmp rdi, rbx
je 0x1004f7700
mov r9, rsi
mov r8d, 2
mov edx, 1
mov rcx, r12
call sub.msys_2.0.dll_fwrite
jmp 0x1004f7668
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1004f7710
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r13, [0x1005200b0]
mov rdi, rcx
mov rcx, r13
mov rbp, rdx
mov rsi, r8
mov r12, r9
call sub.msys_2.0.dll_pthread_mutex_lock
test eax, eax
jne 0x100516cc0
mov r14, qword [0x1006633c8]
test r14, r14
je 0x1004f778a
mov rdx, r14
mov rcx, rdi
call sub.msys_2.0.dll_strcmp
mov rbx, qword [0x1006633c0]
test eax, eax
je 0x1004f77de
test rbx, rbx
je 0x1004f7782
mov rcx, rbx
call sub.msys_2.0.dll_fclose
mov r14, qword [0x1006633c8]
mov qword [0x1006633c0], 0
mov rcx, r14
call sym.bash.exe__libintl_free
mov rcx, rdi
call sub.msys_2.0.dll_strlen
lea rbx, [rax + 1]
mov rcx, rbx
call sub.msys_2.0.dll_malloc
mov qword [0x1006633c8], rax
mov rcx, rax
test rax, rax
je 0x1004f78b4
mov r8, rbx
mov rdx, rdi
call sub.msys_2.0.dll_memcpy
lea rdx, [0x1005510e7]
mov rcx, rdi
call sub.msys_2.0.dll_fopen
mov qword [0x1006633c0], rax
mov rbx, rax
test rax, rax
je 0x1004f78b4
mov r9, rbx
mov r8d, 7
mov edx, 1
lea rcx, str.domain
call sub.msys_2.0.dll_fwrite
mov rcx, rbp
call sub.msys_2.0.dll_strlen
mov rdx, rbp
mov rcx, rbx
lea r8, [rbp + rax]
call fcn.1004f7630
mov edx, 4
mov rcx, rsi
call sub.msys_2.0.dll_strchr
mov rdi, rax
test rax, rax
je 0x1004f7851
mov r9, rbx
mov r8d, 9
mov edx, 1
lea rcx, str._nmsgctxt
call sub.msys_2.0.dll_fwrite
mov rdx, rsi
mov r8, rdi
mov rcx, rbx
call fcn.1004f7630
lea rsi, [rdi + 1]
mov r9, rbx
mov r8d, 7
mov edx, 1
lea rcx, str._nmsgid
call sub.msys_2.0.dll_fwrite
mov rcx, rsi
call sub.msys_2.0.dll_strlen
mov rdx, rsi
mov rcx, rbx
lea r8, [rsi + rax]
call fcn.1004f7630
mov eax, dword [rsp + 0x80]
mov r9, rbx
test eax, eax
jne 0x1004f78d8
mov r8d, 0xb
mov edx, 1
lea rcx, str._nmsgstr____n
call sub.msys_2.0.dll_fwrite
mov rdx, rbx
mov ecx, 0xa
call sub.msys_2.0.dll_putc
mov rcx, r13
call sub.msys_2.0.dll_pthread_mutex_unlock
test eax, eax
jne 0x100516cc0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r8d, 0xe
mov edx, 1
lea rcx, str._nmsgid_plural
call sub.msys_2.0.dll_fwrite
mov rcx, r12
call sub.msys_2.0.dll_strlen
mov rdx, r12
mov rcx, rbx
lea r8, [r12 + rax]
call fcn.1004f7630
mov r9, rbx
mov r8d, 0xe
mov edx, 1
lea rcx, str._nmsgstr_0_____n
call sub.msys_2.0.dll_fwrite
jmp 0x1004f78a7
Function at 0x14001b39c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b3b2
mov al, 1
jmp 0x14001b412
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b3c3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b410
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400194f0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b410
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b410
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b410
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b412
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f630
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f658
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f658
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
lea r9, str._J_ms8m
mov r8d, 3
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140e9d750
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e9d75a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e9d783
pop rbp
sub rbp, 0x33
sub rbp, 0xe9d750
sub rsp, 0x20
jmp 0x140e9d7a2
mov rax, 0xe9d750
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x7d243cd2
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e9d7c1
jmp 0x140e9d7d8
invalid