joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140090430
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140263ab8]
mov ecx, dword [0x14025e4e8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140090490
lea rsi, [0x140263ab0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400fd9d0
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140263ab8]
call fcn.1400fc420
cmp dword [0x140263ab8], 0xffffffff
jne 0x14009046c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400ffb20
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.1400fc2cc
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140263b00]
mov ecx, dword [0x14025e4e8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140090550
lea r8, [0x140263ad0]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140090650
mov qword [0x140263ab0], rsi
lea rcx, [0x140263ab8]
call fcn.1400fc4b8
jmp 0x14009046c
lea rcx, [0x140263b00]
call fcn.1400fc420
cmp dword [0x140263b00], 0xffffffff
jne 0x140090521
xorps xmm0, xmm0
movups xmmword [0x140263af0], xmm0
movups xmmword [0x140263ae0], xmm0
movups xmmword [0x140263ad0], xmm0
lea rcx, [0x140263ad0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140263b00]
call fcn.1400fc4b8
jmp 0x140090521

Function at 0x1400905a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140263b00]
mov ecx, dword [0x14025e4e8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400905db
movzx eax, word [0x140263ad0]
cmp eax, 9
jne 0x140090623
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x140263b00]
call fcn.1400fc420
cmp dword [0x140263b00], 0xffffffff
jne 0x1400905c5
xorps xmm0, xmm0
movups xmmword [0x140263af0], xmm0
movups xmmword [0x140263ae0], xmm0
movups xmmword [0x140263ad0], xmm0
lea rcx, [0x140263ad0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140263b00]
call fcn.1400fc4b8
jmp 0x1400905c5
test eax, eax
je 0x1400905d6
cmp eax, 6
jne 0x140090633
mov eax, 2
jmp 0x1400905d6
cmp eax, 0xc
jne 0x14009063f
mov eax, 3
jmp 0x1400905d6
mov eax, 4
jmp 0x1400905d6
Function at 0x140091050
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r9
mov r14, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1401ff190]
lea r9, [0x14022a350]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14009120c
mov qword [rsp + 0x60], 0
movsx rax, byte [r14 + 0x17]
test rax, rax
jns 0x1400910c5
mov rax, qword [r14 + 8]
mov r14, qword [r14]
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rax
test rax, rax
js 0x140091218
sete al
test r14, r14
setne cl
or cl, al
je 0x14009122b
lea r14, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.1400aa0e0
mov rdx, qword [r14]
mov rax, qword [r15]
mov rax, qword [rax + 0x18]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call qword [0x14023e858]
mov ebp, eax
mov rcx, r14
call fcn.1400aa130
test ebp, ebp
js 0x1400911fa
test bl, bl
je 0x14009118a
mov rcx, qword [rsp + 0x60]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140091202
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
jne 0x14009123e
mov byte [rsi], 0
xor eax, eax
mov byte [rsi + 4], al
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x140091250
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400911dd
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14023e858]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400fd9d0
mov rax, rsi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rsi], 1
jmp 0x140091208
mov dword [rsi], 2
mov al, 1
jmp 0x1400911ac
mov dword [rsi], 0
mov byte [rsi + 4], 1
jmp 0x1400911bd
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.140139400
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.140139400
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14023e858]
jmp 0x1400911a7
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14023e858]
jmp 0x1400911bd
Function at 0x140094030
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x140094179
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x1402103c0]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [0x14023e858]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [0x14023e858]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [0x14023e858]
test r14, r14
je 0x140094113
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x140094103
mov ecx, 1
call fcn.1400e4c80
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x14009417d
call fcn.140002fe0
lea rax, [0x140001d60]
lea rcx, section..text
mov qword [rsi + 0xf8], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x14009415c
bt eax, 9
jae 0x140094198
call fcn.1400040d0
lea rax, [0x1400045a0]
lea rcx, [0x1400042a0]
jmp 0x140094143
call fcn.1401873a0
lea rax, [0x140187ba0]
lea rcx, [0x140187280]
jmp 0x140094143

Function at 0x1400941c0
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 2
call fcn.1400e4c80
mov ebp, eax
bt eax, 0x1d
jb 0x140094203
not ebp
test ebp, 0x128
jne 0x140094229
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140010eb0
mov ecx, 1
call fcn.1400e4c80
bt eax, 9
jae 0x1400941e3
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000ef40
mov ecx, 1
call fcn.1400e4c80
mov ebp, eax
bt eax, 0x1c
jae 0x140094248
xor ecx, ecx
call fcn.1400e4c80
bt eax, 0x1e
jb 0x140094272
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
bt ebp, 9
jb 0x140094264
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000df00
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000f210
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.1400100b0
Function at 0x1400942e0
Capabilities:
Encode data using xor
Hash data using sha256 via x86 extensions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 2
call fcn.1400e4c80
bt eax, 0x1d
jb 0x140094360
mov ecx, 1
call fcn.1400e4c80
mov ebp, eax
bt eax, 0x1c
jae 0x140094336
xor ecx, ecx
call fcn.1400e4c80
bt eax, 0x1e
jae 0x140094336
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140014f40
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
bt ebp, 9
jb 0x140094352
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140012a80
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140014000
mov ecx, 1
call fcn.1400e4c80
bt eax, 9
jae 0x140094301
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140013c40
Function at 0x140094740
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x140094835
cmp qword [rsi], 0
jne 0x140094835
cmp dword [rsi + 0x14], 0
jne 0x140094835
cmp qword [rsi + 8], 0
jne 0x140094835
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x1400947b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14009481c
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400947ac
mov qword [rsi], r14
call fcn.1400dc3b0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x1400947ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140094804
lea rax, [r14 + 1]
cmp rax, 2
jb 0x1400947e6
mov qword [rsi + 8], r14
call fcn.1400dc3b0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400dc3b0
mov rcx, qword [rsi + 8]
call fcn.1400ce120
mov qword [rsi + 8], 0
jmp 0x1400947d3
call fcn.1400dc3b0
mov rcx, qword [rsi]
call fcn.1400ce120
mov qword [rsi], 0
jmp 0x14009479a
mov rcx, rsi
call fcn.1400c9140
lea rcx, [rsi + 8]
call fcn.1400c9140
mov qword [rsi + 0x10], 0
mov rax, qword [rsi]
jmp 0x14009477a
Function at 0x14009bff0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x1402103c0]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x14009c16c
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x1402641c0]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.14012048c
mov rcx, rbx
call fcn.14011f794
sub r14, rax
lea rdx, [0x140211688]
mov rcx, rbx
mov r8, r14
call fcn.14012048c
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1400ffb20
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14009c0cc
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401204d4
test eax, eax
je 0x14009c190
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14009c107
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401204d4
test eax, eax
je 0x14009c190
xor eax, eax
mov byte [0x140263db9], al
mov dword [rsp + 0x30], 0
lea rcx, [0x140217240]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x14022fe9c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009c197
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x14023e858]
test eax, eax
je 0x14009c197
cmp dword [rsp + 0x30], 0
setne al
mov byte [0x1402643c0], al
mov byte [0x140263db8], 1
test esi, esi
setns bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
mov al, 1
jmp 0x14009c109
xor eax, eax
jmp 0x14009c15f
Function at 0x14009c490
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsx rax, byte [r8 + 0x17]
test rax, rax
jns 0x14009c4c4
mov rax, qword [rsi + 8]
test rax, rax
je 0x14009c5bb
bt ebx, 8
jae 0x14009c4e0
mov eax, ebx
and eax, 0x200
jne 0x14009c5bb
cmp edi, 2
lea rax, [0x140263dc0]
lea rcx, [0x140263fc0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14009c5bb
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x14009c5bb
bt ebx, 8
jb 0x14009c5bb
shr ebx, 9
and ebx, 1
or bl, byte [0x1402643c0]
je 0x14009c5bb
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movsx r13, byte [rsi + 0x17]
test r13, r13
jns 0x14009c5da
mov r14, qword [rsi]
mov r13, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov rbp, r13
sub rbp, r15
jb 0x14009c5a4
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
call fcn.14011a51c
test eax, eax
je 0x14009c5df
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x14009c584
cmp dword [rsp + 0x2c], 0
jne 0x14009c65a
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400fd9d0
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rsi
jmp 0x14009c567
movzx ecx, word [r14 + r15*2]
cmp ecx, 0x5c
je 0x14009c5ed
test ecx, ecx
jne 0x14009c5a4
lea rax, [r14 + r15*2]
mov edx, dword [r12 + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x14009c619
cmp dword [rsp + 0x2c], 2
jne 0x14009c62a
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
jmp 0x14009c62a
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
cmp cx, 0x5c
jne 0x14009c643
lea r14, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, r14
je 0x14009c630
jmp 0x14009c646
mov r14, rax
mov rdi, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
xor ebx, ebx
mov r13, rbp
jmp 0x14009c5ab
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x14009c666
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, rsi
mov r8, qword [rsp + 0x38]
call fcn.140162c90
jmp 0x14009c5bb
Function at 0x14009d150
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
movsx rax, byte [r8 + 0x17]
test rax, rax
jns 0x14009d185
mov rax, qword [r8 + 8]
mov r8, qword [r8]
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
test rax, rax
js 0x14009d240
sete al
test r8, r8
setne cl
or cl, al
je 0x14009d253
lea rsi, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400d2d60
cmp byte [rsi + 0x17], 0
jns 0x14009d1c6
mov rsi, qword [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.1400d2d60
cmp byte [rdi + 0x17], 0
jns 0x14009d1eb
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x5f], 0
jns 0x14009d20a
mov rcx, qword [rsp + 0x48]
call fcn.1400fc308
cmp byte [rsp + 0x87], 0
jns 0x14009d21e
mov rcx, qword [rsp + 0x70]
call fcn.1400fc308
test esi, esi
setne bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.140139400
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.140139400
int3

Function at 0x14009d2f0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x10050
call fcn.1400fd970
sub rsp, rax
mov rsi, rdx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x10048], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1402103c0]
movaps xmmword [rdi], xmm0
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov rcx, rdi
call fcn.1400d2d60
test rsi, rsi
je 0x14009d3c8
lea rbx, [rsp + 0x4a]
mov r8d, 0xfffe
mov rcx, rbx
mov dl, 0xaa
call fcn.1400ffb20
cmp byte [rsp + 0x47], 0
jns 0x14009d36b
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x14009d39a
cmp eax, 0x7fff
jae 0x14009d3ed
mov edx, eax
lea rcx, [rsp + 0x4a]
mov r8, rsi
call fcn.140063f10
cmp byte [rsp + 0x47], 0
jns 0x14009d3ab
mov rcx, qword [rsp + 0x30]
call fcn.1400fc308
mov rcx, qword [rsp + 0x10048]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, ebx
add rsp, 0x10050
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsp + 0x47], 0
js 0x14009d3d6
lea rcx, [rsp + 0x30]
jmp 0x14009d3db
mov rcx, qword [rsp + 0x30]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x14009d39a
int3
Function at 0x14009f0b0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x14009f127
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x140252190], rax
jne 0x14009f12a
mov rsi, rcx
call fcn.1400aa410
mov edx, 0x570
mov rcx, rax
xor r8d, r8d
call fcn.1400937c0
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.1400edad0
mov ecx, dword [0x1402643ec]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x14025e4e8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x168], rdi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
int3
int3
Function at 0x1400a2e70
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14024f038]
xor rax, rsp
mov qword [rsp + 0x100], rax
lea r15, [rcx + 0x20]
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1400a2ec2
mov qword [r15], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14023e858]
lea r13, [rsi + 0x18]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400a2ee4
mov qword [r13], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14023e858]
mov qword [rsp + 0x20], r13
lea rcx, [0x1402002c8]
lea r9, [0x1402331c0]
xor edx, edx
mov r8d, 0x17
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov r12, qword [r13]
test eax, eax
js 0x1400a309f
mov rcx, qword [r15]
test rcx, rcx
je 0x1400a2f2d
mov qword [r15], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14023e858]
mov rax, qword [r12]
mov rax, qword [rax + 0x90]
mov rcx, r12
mov rdx, r15
call qword [0x14023e858]
test eax, eax
js 0x1400a305e
mov rax, qword [rsp + 0x170]
cmp byte [rax + 0x17], 0
js 0x1400a3019
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
cmp byte [r14 + 0x17], 0
js 0x1400a3032
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x60], xmm0
movzx ebp, word [rsp + 0x178]
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.1400dc580
cmp byte [rdi + 0x17], 0
js 0x1400a3048
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x28], bp
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x98]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea r9, [rsp + 0x60]
call fcn.1400b0c60
mov rdi, qword [rsi + 8]
cmp rdi, qword [rsi + 0x10]
jae 0x1400a3076
test rdi, rdi
je 0x1400a30e5
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.1400b0d60
add rdi, 0x68
jmp 0x1400a3089
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x80]
call fcn.1400cc5b0
jmp 0x1400a2f75
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
lea rcx, [rsp + 0x60]
call fcn.1400cc5b0
jmp 0x1400a2f92
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
lea rcx, [rsp + 0x30]
call fcn.1400cc5b0
jmp 0x1400a2fc2
mov rcx, qword [r15]
test rcx, rcx
je 0x1400a30bd
mov qword [r15], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
jmp 0x1400a30b7
lea rdx, [rsp + 0x98]
mov rcx, rsi
call fcn.1400a5470
mov rdi, rax
mov qword [rsi + 8], rdi
lea rcx, [rsp + 0x98]
call fcn.1400b0e10
mov sil, 1
jmp 0x1400a30bf
test r12, r12
je 0x1400a30bd
mov qword [r13], 0
mov rax, qword [r12]
mov rax, qword [rax + 0x10]
mov rcx, r12
call qword [0x14023e858]
xor esi, esi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400fd9d0
mov eax, esi
add rsp, 0x108
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140210516]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.140139400
int3