joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000df90
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 7
mov rbx, rcx
mov rdx, rcx
jbe 0x14000dfa6
mov rdx, qword [rcx]
lea rcx, str.SteamAppId
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x14000dfc0
mov rdx, qword [rbx]
lea rcx, str.SteamGameId
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp qword [rbx + 0x18], 7
jbe case.default.0x14000dfe6
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.SteamOverlayGameId
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
adc rdx, qword [rax]
sub ah, cl
sal byte [rsi + 0x4c], cl
push rbp
popfq
invalid
enter 0x74bf, 9
mov cl, 0xbe
invalid
pop rbp
invalid
jl 0x1400857e8
invalid
fisubr dword [rbx]
mov al, 0xc6
adc ah, byte [rdi + rax + 0x231b91ad]
invalid
enter 0xfffffffffffff12f, 0xffffffffffffffde
stc
or ecx, ecx
jo 0x140085819
invalid
sub eax, 0x29e2b61b
mov bh, 0x9e
invalid
invalid
jne 0x140085806
lodsd eax, dword [rsi]
mov dl, 0x46
test byte [rdx], al
push rbp
adc al, 0x41
mov dl, 0x61
imul edx, dword [rsp + riz*4 + 0x79], 0xffffff9a
rcl ebx, 0xdc
loopne 0x1400858a9
sbb dword [rdi - 0x5e1b4439], ecx
in eax, 0xd9
loop 0x14008582d
movabs eax, dword [0xa0e62aa790e2d9e5]
test eax, 0x5928bbb8
rol ch, cl
invalid
cmpsd dword [rsi], dword [rdi]
sub ah, dh
movabs al, byte [0xd6c5d25928bbb8a9]
and ebp, dword [rcx]
test al, 1
movabs eax, dword [0x4208100d28969102]
xor byte [rdi - 0x7712a4d3], dh
jg 0x1400858cf
and eax, 0x3e09c0c
xor dword [rdi - 0x1d], esp
stosb byte [rdi], al
movabs byte [0xef8d342793d39ad5], al
out dx, eax
push rax
int1
movabs eax, dword [0xab152500d9665be3]
invalid
Function at 0x180012440
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
lea rsi, [rdx + 0x10]
mov rdx, qword [rsi]
call fcn.1800186a0
lea r15d, [rbp - 6]
mov r14, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800124a7
mov r14, qword [rdi]
mov rdi, r14
mov r13, qword [rsi]
add r13, rdi
cmp r14, r13
je 0x1800125af
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
shl ebp, 8
movzx eax, byte [r14]
add ebp, eax
add r15d, 8
js 0x18001254d
movsxd r12, ebp
movsxd rdi, r15d
lea ecx, [r15 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov esi, edx
imul eax, edx, 0xfffffffa
add r15d, eax
nop dword [rax + rax]
mov rax, r12
mov rcx, rdi
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001252d
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180012522
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180012543
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.180002ae0
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub rdi, 6
sub rsi, 1
jne 0x1800124f0
inc r14
cmp r14, r13
jne 0x1800124c0
cmp r15d, 0xfffffffa
jle 0x1800125af
lea ecx, [r15 + 8]
shl ebp, 8
movsxd rdx, ebp
sar rdx, cl
and edx, 0x3f
movzx r9d, byte [rdx + r8]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1800125a0
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180012595
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800125af
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.180002ae0
mov rcx, qword [rbx + 0x10]
test cl, 3
je 0x180012600
nop dword [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1800125e5
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1800125dd
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x1800125f7
mov r9b, 0x3d
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.180002ae0
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x1800125c0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18001bdf0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rcx
xor r9d, r9d
mov qword [rsp + 0x10], rdx
mov r10, r8
mov byte [rsp + 8], 0
test r8, r8
je 0x18001be3b
nop word [rax + rax]
mov rax, qword [rsp + 0x10]
movzx ecx, byte [rax + r9]
mov rax, qword [rsp + 0x18]
movzx r8d, byte [rax + r9]
inc r9
movzx eax, byte [rsp + 8]
xor r8d, ecx
or al, r8b
mov byte [rsp + 8], al
cmp r9, r10
jb 0x18001be10
movzx eax, byte [rsp + 8]
dec eax
sar eax, 8
and eax, 1
dec eax
ret

Function at 0x18001c760
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movabs rax, 0x6a09e667f3bcc908
mov rbx, rdx
mov qword [rcx], rax
mov rdi, rcx
movabs rax, 0xbb67ae8584caa73b
xor edx, edx
mov qword [rcx + 8], rax
mov r8d, 0x129
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
add rcx, 0x40
call fcn.18003b270
mov rax, qword [rbx]
xor qword [rdi], rax
mov rax, qword [rbx + 8]
xor qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
xor qword [rdi + 0x38], rax
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x180022ed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x18007d1d8]
xor rax, rsp
mov qword [rsp + 8], rax
xor r8d, r8d
lea r15, [0x18005de00]
mov dword [rsp], r8d
mov r9, rcx
movzx edi, byte [rsp + 3]
xor eax, eax
movzx esi, byte [rsp + 2]
movzx ebx, r8b
movzx ebp, byte [rsp + 1]
movzx r14d, r8b
mov word [rsp + 4], r8w
movzx r11d, byte [rsp + 5]
nop dword [rax]
movzx edx, byte [r9 + rax]
movzx ecx, byte [rax + r15]
movzx r10d, byte [rax + r15 + 0xc0]
xor cl, dl
or cl, r14b
xor r10b, dl
movzx r14d, cl
or r10b, r8b
movzx ecx, byte [rax + r15 + 0x20]
movzx r8d, r10b
xor cl, dl
or cl, bpl
movzx ebp, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or cl, sil
movzx esi, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or cl, dil
movzx edi, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or cl, bl
movzx ebx, cl
movzx ecx, byte [rax + r15 + 0xa0]
inc rax
xor cl, dl
or cl, r11b
movzx r11d, cl
cmp rax, 0x1f
jb 0x180022f30
movzx ecx, byte [rax + r9]
movzx r9d, byte [rax + r15 + 0xc0]
and cl, 0x7f
movzx edx, byte [rax + r15 + 0xa0]
movzx r8d, cl
xor edx, r8d
movzx ecx, r10b
or edx, r11d
xor r9d, r8d
dec edx
or r9d, ecx
dec r9d
or r9d, edx
movzx edx, byte [rax + r15 + 0x80]
xor edx, r8d
or edx, ebx
dec edx
or r9d, edx
movzx edx, byte [rax + r15]
xor edx, r8d
or edx, r14d
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x20]
xor edx, r8d
or edx, ebp
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x40]
movzx eax, byte [rax + r15 + 0x60]
xor edx, r8d
xor eax, r8d
or edx, esi
or eax, edi
dec edx
dec eax
or r9d, edx
or eax, r9d
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180038f90
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret
Function at 0x1800238b0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
ret
Function at 0x180028030
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret
Function at 0x18002cdb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x18007d1d8]
xor rax, rsp
mov qword [rsp + 8], rax
xor r8d, r8d
lea r15, [0x180066180]
mov dword [rsp], r8d
mov r9, rcx
movzx edi, byte [rsp + 3]
xor eax, eax
movzx esi, byte [rsp + 2]
movzx ebx, r8b
movzx ebp, byte [rsp + 1]
movzx r14d, r8b
mov word [rsp + 4], r8w
movzx r11d, byte [rsp + 5]
nop dword [rax]
movzx edx, byte [r9 + rax]
movzx ecx, byte [rax + r15]
movzx r10d, byte [rax + r15 + 0xc0]
xor cl, dl
or cl, r14b
xor r10b, dl
movzx r14d, cl
or r10b, r8b
movzx ecx, byte [rax + r15 + 0x20]
movzx r8d, r10b
xor cl, dl
or cl, bpl
movzx ebp, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or cl, sil
movzx esi, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or cl, dil
movzx edi, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or cl, bl
movzx ebx, cl
movzx ecx, byte [rax + r15 + 0xa0]
inc rax
xor cl, dl
or cl, r11b
movzx r11d, cl
cmp rax, 0x1f
jb 0x18002ce10
movzx ecx, byte [rax + r9]
movzx r9d, byte [rax + r15 + 0xc0]
and cl, 0x7f
movzx edx, byte [rax + r15 + 0xa0]
movzx r8d, cl
xor edx, r8d
movzx ecx, r10b
or edx, r11d
xor r9d, r8d
dec edx
or r9d, ecx
dec r9d
or r9d, edx
movzx edx, byte [rax + r15 + 0x80]
xor edx, r8d
or edx, ebx
dec edx
or r9d, edx
movzx edx, byte [rax + r15]
xor edx, r8d
or edx, r14d
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x20]
xor edx, r8d
or edx, ebp
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x40]
movzx eax, byte [rax + r15 + 0x60]
xor edx, r8d
xor eax, r8d
or edx, esi
or eax, edi
dec edx
dec eax
or r9d, edx
or eax, r9d
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180038f90
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret
Function at 0x18002f8f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx r9d, byte [rcx + rax]
inc rax
mov ecx, dword [rsp + 8]
xor r9d, edx
or ecx, r9d
mov dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x18002f900
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret

Function at 0x18002f940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx r9d, byte [rcx + rax]
inc rax
mov ecx, dword [rsp + 8]
xor r9d, edx
or ecx, r9d
mov dword [rsp + 8], ecx
cmp rax, 0x20
jl 0x18002f950
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x1404555dd
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1404791fa
add rbp, 2
push 0xffffffffa4b6e8b5
call fcn.14048ae89
jmp 0x140456606
mov qword [rsp], rsi
push r11
mov esi, 0x51294d9f
lea rsi, [0x140483fd8]
mov r11d, 0x110a270a
not r11d
shr r11d, 0x2d
movzx r11d, byte [rax + r11*2 - 0xeef5c]
push 0x57acbf34
xor r11d, r8d
and r11d, 0xff
mov r11d, dword [rsi + r11*4]
shr r8d, 8
xor r8d, r11d
inc rax
xor r8d, 0x18a49333
dec rdi
lea rsp, [rsp + 8]
jne 0x14047920c
pop r11
mov esi, 0x311baf02
pop rsi
jmp 0x14048250f
call fcn.1404968f3
mov r8, qword [rsi]
add rsi, 8
mov ecx, 0xb3995d18
not cx
lea rcx, [rcx + rcx*8 - 0x5d587a4e]
movzx ecx, word [rbp + riz]
jmp 0x14045d2c6
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14129abe0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14129abf0]
mov dword [rax], 1
mov rax, qword [0x14129ac00]
mov dword [rax], 1
mov rax, qword [0x14129ab80]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14129abd0]
mov dword [0x1412a800c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010b0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x14129acb0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x14129ac90]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x14129ab30]
cmp dword [rax], 1
je 0x1400010f1
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001104
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x1400047a0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1f8
mov rax, qword [rcx]
mov rdi, qword [rax]
mov qword [rax], 0
test rdi, rdi
je 0x1400047f8
lea rsi, [rsp + 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov cx, 0x202
mov rdx, rsi
call sub.WS2_32.dll_WSAStartup
mov dword [rsp + 0x2c], eax
test eax, eax
jne 0x140004804
lea rax, [0x140097a2c]
mov qword [rdi], rax
add rsp, 0x1f8
pop rdi
pop rsi
ret
lea rcx, [0x14127b458]
call sym.core::option::unwrap_failed::hc0851016c6838662
mov qword [rsp + 0x30], 0
lea rdx, [0x14127ca78]
lea r9, [0x14127ca80]
lea rcx, [rsp + 0x2c]
lea r8, [rsp + 0x30]
call sym.core::panicking::assert_failed::h8ffd437d9df69bb7
int3
Function at 0x1400236c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, [0x14127d458]
cmovne rdx, rcx
add rsp, 0x58
ret

Function at 0x140024ac0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x48], rax
xor esi, esi
mov edi, 0xffffffff
xor r13d, r13d
xor ebx, ebx
cmp r8, 0x201
jae 0x140024b50
jmp 0x140024b2f
jae 0x140024bfe
cmp r8, 0x201
jae 0x140024b50
mov r14d, 0x200
lea r15, [rsp + 0x98]
mov r12, r8
jmp 0x140024b96
sub r8, rbx
sub r13, rbx
cmp r13, r8
jae 0x140024b77
lea rcx, [rsp + 0x28]
mov rdx, rbx
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h652bddeb65308e11
mov rsi, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
cmp rsi, rdi
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rsp + 0x38], rbx
mov r13, rsi
mov r14, rbx
mov r15, qword [rsp + 0x48]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x140024bbb
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140024c6b
mov r8d, ebp
cmp r12, r8
jne 0x140024b20
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140024c9a
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140024b2f
jmp 0x140024b50
cmp r14, r8
jb 0x140024cb4
lea rcx, [rsp + 0x50]
mov rdx, r15
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::hbf8b2f0179ef5cb6
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov rsi, qword [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x140024c54
mov rcx, qword [rsp + 0x30]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rsp + 0x28]
test rdx, rdx
jne 0x140024c41
jmp 0x140024c54
lea rcx, [0x141278d88]
lea r8, [0x14127d6a8]
mov edx, 0x28
call sym.core::panicking::panic::hef3431a3c19424e4
jmp 0x140024cc9
lea rax, [0x14127d690]
mov rcx, r8
mov rdx, r14
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::h89faa5dda92f1452
ud2
Function at 0x140024d00
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x70
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x140024d18
mov rdx, rax
add rsp, 0x70
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h80d056e31c2ff722]
mov qword [rsp + 0x38], rax
lea rax, [0x14127ccc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rdx, [0x14127ccd0]
lea rcx, [rsp + 0x40]
call sym.core::panicking::panic_fmt::he2608bd87643dbc4
ud2
Function at 0x1400256d0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov r14, r9
mov r15, r8
mov r8, rdx
mov rdx, rcx
movabs r13, 0x8000000000000000
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r9
lea rsi, [rsp + 0x30]
mov rcx, rsi
call sym.std::sys::pal::windows::to_u16s::inner::h4c9a51427fa9952c
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
cmp rdi, r13
jne 0x14002572d
mov r14, rbx
jmp 0x140025795
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, r14
call sym.std::sys::pal::windows::to_u16s::inner::h4c9a51427fa9952c
mov r12, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
cmp r12, r13
jne 0x140025751
mov r14, r15
jmp 0x14002577c
mov rcx, rbx
mov rdx, r15
call sub.KERNEL32.dll_SetEnvironmentVariableW
test eax, eax
je 0x1400257ad
xor r14d, r14d
test r12, r12
je 0x14002577c
add r12, r12
mov r8d, 2
mov rcx, r15
mov rdx, r12
call sym.__rust_dealloc
test rdi, rdi
je 0x140025795
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
test r14, r14
jne 0x1400257c4
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
test r12, r12
jne 0x140025768
jmp 0x14002577c
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [sym.__std::ffi::os_str::Display_as_core::fmt::Debug_::fmt::h8d36de3fecc47fdc]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h80d056e31c2ff722]
mov qword [rsp + 0x58], rax
lea rax, [0x141279e58]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 3
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], 3
lea rdx, [0x141279e88]
lea rcx, [rsp + 0x80]
call sym.core::panicking::panic_fmt::he2608bd87643dbc4
ud2
Function at 0x1400258a0
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov r8, rdx
mov rdx, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
lea rcx, [rsp + 0x40]
call sym.std::sys::pal::windows::to_u16s::inner::h4c9a51427fa9952c
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
movabs rax, 0x8000000000000000
cmp rdi, rax
jne 0x1400258e2
mov rsi, rbx
jmp 0x14002591a
xor esi, esi
mov rcx, rbx
xor edx, edx
call sub.KERNEL32.dll_SetEnvironmentVariableW
test eax, eax
jne 0x140025901
call sub.KERNEL32.dll_GetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
test rdi, rdi
je 0x14002591a
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
test rsi, rsi
jne 0x14002592a
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
lea rax, [sym.__std::ffi::os_str::Display_as_core::fmt::Debug_::fmt::h8d36de3fecc47fdc]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x80], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h80d056e31c2ff722]
mov qword [rsp + 0x88], rax
lea rax, [0x141279ec8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
lea rdx, [0x141279ee8]
lea rcx, [rsp + 0x40]
call sym.core::panicking::panic_fmt::he2608bd87643dbc4
ud2