joyce8/EMBER2024-capa huggingface dataset:
Function at 0x540ec0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x54113c
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
movzx ecx, byte [rbx + 0x1f]
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r15
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r10d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r10
movzx r9d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r9
movzx r8d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r8
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r8d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r8
movzx r9d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r9
movzx r10d, byte [rbx + 9]
mov qword [rsp + 8], r10
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r15d, byte [rbx + 7]
shl r15, 0x38
movzx r13d, byte [rbx + 6]
shl r13, 0x30
movzx r12d, byte [rbx + 5]
shl r12, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r9d, byte [rbx + 2]
shl r9, 0x10
movzx r8d, byte [rbx + 1]
shl r8, 8
movzx ebx, byte [rbx]
add rbx, r8
add rbx, r9
add rbx, r10
add rbx, r11
add rbx, r12
add rbx, r13
add rbx, r15
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x98]
shl rcx, 0x38
mov rdx, qword [rsp + 0x90]
shl rdx, 0x30
mov rbx, qword [rsp + 0x88]
shl rbx, 0x28
mov rsi, qword [rsp + 0x80]
shl rsi, 0x20
mov rdi, qword [rsp + 0x78]
shl rdi, 0x18
mov r8, qword [rsp + 0x70]
shl r8, 0x10
mov r9, qword [rsp + 0x68]
shl r9, 8
mov r10, qword [rsp + 0x60]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00540ec0
Function at 0x549fc0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x549fd8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x549fd8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x549fe0
xor eax, eax
ret
cmp rbx, 3
je 0x549fec
cmp rbx, 4
jne 0x54a019
cmp al, 0x2c
ja 0x54a006
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x54a016
cmp al, 0x24
je 0x54a016
nop dword [rax]
cmp al, 0x26
jae 0x54a016
jmp 0x54a019
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x54a016
cmp al, 0x5b
je 0x54a016
cmp al, 0x5d
jne 0x54a019
xor eax, eax
ret
cmp al, 0x2f
ja 0x54a052
nop dword [rax]
cmp al, 0x26
ja 0x54a031
cmp al, 0x24
je 0x54a071
cmp al, 0x26
je 0x54a071
jmp 0x54a0eb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x54a071
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x54a0e8
cmp al, 0x2f
je 0x54a071
jmp 0x54a0eb
cmp al, 0x3d
ja 0x54a069
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x54a071
nop
cmp al, 0x3d
je 0x54a071
jmp 0x54a0eb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x54a0e0
cmp rbx, 2
jg 0x54a0a7
cmp rbx, 1
je 0x54a0a1
nop dword [rax]
cmp rbx, 2
jne 0x54a0eb
cmp al, 0x2f
je 0x54a092
cmp al, 0x3b
je 0x54a092
cmp al, 0x2c
jne 0x54a099
mov ecx, 1
jmp 0x54a09e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x54a0ca
cmp al, 0x40
je 0x54a0b9
cmp al, 0x2f
je 0x54a0b9
cmp al, 0x3f
jne 0x54a0c2
mov ecx, 1
nop
jmp 0x54a0c7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x54a0d9
cmp rbx, 7
jne 0x54a0eb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x54a0e8
cmp al, 0x7e
jne 0x54a0eb
xor eax, eax
ret
cmp rbx, 7
jne 0x54a101
cmp al, 0x21
je 0x54a0fd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x54a101
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x54efc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54f1d5
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x54f0ed
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x54f1c7
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [r8 + 0x10]
add rdx, rax
cmp rbx, rdx
je 0x54f061
mov rax, rdx
mov rcx, rsi
call fcn.00464760
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x54f0c9
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0054f460
xorps xmm15, xmm15
mov r14, qword [0x007bb9c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x54f1bf
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x54f0f3
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x54f170
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.0054f460
xorps xmm15, xmm15
mov r14, qword [0x007bb9c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x54f1ae
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x54f1aa
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00464760
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
call fcn.00463e80
mov rax, rdx
mov ecx, 0x40
call fcn.00463e80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0054efc0
Function at 0x1400011a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov ecx, 2
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000121f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000121f
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000121b
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400011f1
jmp 0x14000121f
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140006280
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x140001250
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov edx, ecx
xor edi, edi
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400012d0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1400012d0
lea rdx, str.FiveM_GTAProcess.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400012cb
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400012a1
jmp 0x1400012d0
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140006280
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
Function at 0x140006010
Capabilities:
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
sub rsp, 0x28
mov r9d, 0x31
lea r8, str.Brax
lea rdx, str.I_MISS_YOU_NA
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x140006041
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x14000842c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000607f
call fcn.140002510
mov ecx, 0x36
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140006093
call fcn.140003610
mov ecx, 0x37
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400060a7
call fcn.140004710
mov ecx, 0x38
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400060bb
call fcn.140005a10
mov ecx, 0x55
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400060cf
call fcn.140005e10
mov ecx, 0x30
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400060ed
call fcn.140001410
call fcn.140005c10
call fcn.140005810
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140006060
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140006c00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006c4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006c4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006c4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006c4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140006c4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006c4c
xor al, al
add rsp, 0x28
ret
Function at 0x140f4b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f4b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f4b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f4b06f
add dl, dl
jne 0x140f4b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f4b0f6
xor eax, eax
add dl, dl
jne 0x140f4b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f4b1ad
add dl, dl
jne 0x140f4b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f4b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f4b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f4b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f4b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f4b07e
mov eax, 1
add dl, dl
jne 0x140f4b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f4b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f4b0fb
sub eax, ebx
mov ebx, 1
jne 0x140f4b14c
mov ecx, 1
add dl, dl
jne 0x140f4b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f4b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f4b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f4b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f4b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f4b15d
cmp eax, 0x7d00
jae 0x140f4b19b
cmp eax, 0x500
jb 0x140f4b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4b07e
cmp eax, 0x7f
ja 0x140f4b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f4b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f4b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x100401670
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1004016fd
mov edx, 0x2f
call sub.msys_2.0.dll_strrchr
mov rsi, rax
test rax, rax
je 0x1004016db
lea rdi, [rax + 1]
mov rax, rdi
sub rax, rbx
cmp rax, 6
jle 0x1004016db
lea rcx, [rsi - 6]
mov r8d, 7
lea rdx, str._.libs_
call sub.msys_2.0.dll_strncmp
test eax, eax
jne 0x1004016db
cmp byte [rsi + 1], 0x6c
jne 0x1004016f8
cmp byte [rdi + 1], 0x74
jne 0x1004016f8
cmp byte [rdi + 2], 0x2d
jne 0x1004016f8
mov rax, qword [sym.imp.msys_2.0.dll_program_invocation_short_name]
lea rbx, [rsi + 4]
mov qword [rax], rbx
mov rax, qword [sym.imp.msys_2.0.dll_program_invocation_name]
mov qword [0x10040c010], rbx
mov qword [rax], rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rbx, rdi
jmp 0x1004016db
call sub.msys_2.0.dll___getreent
mov r8d, 0x37
mov edx, 1
lea rcx, str.A_NULL_argv_0__was_passed_through_an_exec_system_call._n
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
call sub.msys_2.0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x100404250
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor ecx, ecx
call fcn.100404630
mov r12, rax
test rax, rax
je 0x1004043b0
lea rdx, str.US_ASCII
mov rcx, rax
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x100404310
lea rdx, [0x100407d4a]
mov rcx, r12
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x1004042fc
xor edi, edi
mov esi, 0x17
lea rbp, str.CP1361
jmp 0x1004042be
je 0x1004043c0
mov rsi, rbx
cmp rdi, rsi
jae 0x1004042ec
lea rax, [rsi + rdi]
mov rdx, r12
mov rbx, rax
and rax, 0xfffffffffffffffe
shr rbx, 1
add rax, rbx
lea r13, [rbp + rax*8]
mov rcx, r13
call sub.msys_2.0.dll_strcmp
test eax, eax
jns 0x1004042b0
lea rdi, [rbx + 1]
cmp rdi, rsi
jb 0x1004042be
cmp byte [r12], 0
lea rax, [0x100407d21]
cmove r12, rax
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.LC_ALL
call sub.msys_2.0.dll_getenv
test rax, rax
je 0x1004043d8
cmp byte [rax], 0
je 0x1004043d8
mov edx, 0x2e
mov rcx, rax
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x100404366
lea r12, [rax + 1]
mov edx, 0x40
mov rcx, r12
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x1004042fc
sub rax, r12
mov rbx, rax
cmp rax, 0xc
jbe 0x100404418
call qword [sym.imp.KERNEL32.dll_GetACP]
lea r12, [rsp + 0x33]
xor edx, edx
lea r9, str.CP_u
mov dword [rsp + 0x20], eax
mov rcx, r12
mov r8d, 0xd
call sub.msys_2.0.dll___sprintf_chk
mov rdx, r12
lea r12, [0x10040c160]
mov r8d, 0xd
mov rcx, r12
call sub.msys_2.0.dll___strcpy_chk
jmp 0x100404286
lea r12, [0x100407d20]
jmp 0x100404299
lea r12, [r13 + 0xc]
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.LC_CTYPE
call sub.msys_2.0.dll_getenv
test rax, rax
je 0x1004043f2
cmp byte [rax], 0
jne 0x10040432e
lea rcx, str.LANG
call sub.msys_2.0.dll_getenv
test rax, rax
je 0x100404366
cmp byte [rax], 0
je 0x100404366
jmp 0x10040432e
mov rdx, r12
lea r12, [0x10040c160]
mov r9d, 0xd
mov r8, rax
mov rcx, r12
call sub.msys_2.0.dll___memcpy_chk
mov byte [r12 + rbx], 0
jmp 0x1004042fc
Function at 0x140002c60
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x140224968]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1400b8c30
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x140224968]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140002df0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140002e0c
cmp rcx, r8
jl 0x140002dff
mov qword [rdx + 0x80], rcx
test dword [0x14021c100], 1
je 0x140002e3b
cmp byte [rsp + 0xd0], 0
je 0x140002e3b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140002960
mov rsp, r8
jmp rax
Function at 0x140002e40
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x140224968]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret