joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ca740
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rdx], eax
test rcx, rcx
je 0x1800ca76e
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add rsp, 0x48
ret

Function at 0x1800ca7a0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.18003ce00
xor esi, esi
test rbx, rbx
je 0x1800ca82d
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], sil
call fcn.18004a760
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov ebx, eax
call fcn.1800395f0
mov eax, ebx
jmp 0x1800ca82f
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18004ac60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800ca900
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x430
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.18003ce00
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
dec eax
cmp eax, 0x3fe
ja 0x1800ca975
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800395f0
mov eax, 1
jmp 0x1800ca977
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.18004ac60
mov rbx, qword [rsp + 0x450]
add rsp, 0x430
pop rdi
ret

Function at 0x1800caa70
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.18003e4e0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
nop dword [rax]
test dword [rsi], edi
je 0x1800cab00
movzx eax, word [0x18010e2e0]
mov word [rsp + 0x50], ax
movzx eax, byte [0x18010e2e2]
mov byte [rsp + 0x52], al
xor eax, eax
mov byte [rsp + 0x53], al
add byte [rsp + 0x50], bl
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.18003cb90
nop
lea r8, [rsp + 0x60]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18003e730
nop
lea rcx, [rsp + 0x60]
call fcn.180039470
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x1800caab0
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800cab20
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.18003e4e0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
nop dword [rax]
test dword [rsi], edi
je 0x1800cabb0
movzx eax, word [0x18010e2e0]
mov word [rsp + 0x50], ax
movzx eax, byte [0x18010e2e2]
mov byte [rsp + 0x52], al
xor eax, eax
mov byte [rsp + 0x53], al
add byte [rsp + 0x50], bl
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.18003cb90
nop
lea r8, [rsp + 0x60]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18003e730
nop
lea rcx, [rsp + 0x60]
call fcn.180039470
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x1800cab60
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800cabd0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.18003e9f0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
test dword [rsi], edi
je 0x1800cac69
mov eax, dword [0x18010e338]
mov dword [rsp + 0x30], eax
movzx eax, word [0x18010e33c]
mov word [rsp + 0x34], ax
xor eax, eax
mov word [rsp + 0x36], ax
add word [rsp + 0x30], bx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.18003d740
nop
lea r8, [rsp + 0x20]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18003ec40
nop
lea rcx, [rsp + 0x20]
call fcn.18003add0
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x1800cac18
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18004ac60
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800caca0
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x160
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r12, rdx
mov rbp, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.18003e4e0
or r8d, 0xffffffff
xor edx, edx
mov rcx, r12
call fcn.18003e4e0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov edi, 1
xor ebx, ebx
nop
test esi, edi
je 0x1800cadc1
movzx eax, word [0x18010e2e0]
mov word [rsp + 0x20], ax
movzx eax, byte [0x18010e2e2]
mov byte [rsp + 0x22], al
xor eax, eax
mov byte [rsp + 0x23], al
add byte [rsp + 0x20], bl
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18003cb90
nop
lea r8, [rsp + 0x30]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18003e730
mov r11, qword [0x1800fa5c8]
mov qword [rsp + 0x28], r11
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.18004a760
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov byte [rsp + 0x143], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.1800395f0
lea r8, [rsp + 0x28]
mov edx, dword [r12 + 8]
mov rcx, r12
call fcn.18003e730
nop
lea rcx, [rsp + 0x28]
call fcn.180039470
nop
lea rcx, [rsp + 0x30]
call fcn.180039470
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x1800cad00
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18004ac60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1800cae00
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x160
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r12, rdx
mov rbp, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.18003e4e0
or r8d, 0xffffffff
xor edx, edx
mov rcx, r12
call fcn.18003e4e0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov edi, 1
xor ebx, ebx
nop
test esi, edi
je 0x1800caf21
movzx eax, word [0x18010e2e0]
mov word [rsp + 0x20], ax
movzx eax, byte [0x18010e2e2]
mov byte [rsp + 0x22], al
xor eax, eax
mov byte [rsp + 0x23], al
add byte [rsp + 0x20], bl
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18003cb90
nop
lea r8, [rsp + 0x30]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18003e730
mov r11, qword [0x1800fa5c8]
mov qword [rsp + 0x28], r11
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x41]
call fcn.18004a760
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov byte [rsp + 0x143], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.1800395f0
lea r8, [rsp + 0x28]
mov edx, dword [r12 + 8]
mov rcx, r12
call fcn.18003e730
nop
lea rcx, [rsp + 0x28]
call fcn.180039470
nop
lea rcx, [rsp + 0x30]
call fcn.180039470
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x1800cae60
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18004ac60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1800caf60
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2a0], rbx
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, rdx
mov rbp, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.18003e9f0
or r8d, 0xffffffff
xor edx, edx
mov rcx, r12
call fcn.18003e9f0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov edi, 1
xor r13d, r13d
mov ebx, r13d
test esi, edi
je 0x1800cb088
mov eax, dword [0x18010e338]
mov dword [rsp + 0x38], eax
movzx eax, word [0x18010e33c]
mov word [rsp + 0x3c], ax
xor eax, eax
mov word [rsp + 0x3e], ax
add word [rsp + 0x38], bx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.18003d740
nop
lea r8, [rsp + 0x28]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.18003ec40
mov r11, qword [0x1800fa5d0]
mov qword [rsp + 0x20], r11
mov word [rsp + 0x40], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x42]
call fcn.18004a760
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov word [rsp + 0x246], r13w
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.18003af50
lea r8, [rsp + 0x20]
mov edx, dword [r12 + 8]
mov rcx, r12
call fcn.18003ec40
nop
lea rcx, [rsp + 0x20]
call fcn.18003add0
nop
lea rcx, [rsp + 0x28]
call fcn.18003add0
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x1800cafc4
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18004ac60
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800cb490
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rdi, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.18003e4e0
or r8d, 0xffffffff
xor edx, edx
mov rcx, rdi
call fcn.18003e4e0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov ecx, dword [0x180157d74]
test ecx, ecx
je 0x1800cb541
cmp eax, ecx
jne 0x1800cb541
mov eax, dword [0x180157d78]
test eax, eax
je 0x1800cb541
cmp ebx, eax
jb 0x1800cb541
add eax, 0x493e0
cmp eax, ebx
jb 0x1800cb541
inc dword [0x180157d7c]
mov r8d, 1
lea rdx, [0x180157e28]
lea rcx, [rsp + 0x28]
call fcn.180042e10
nop
lea rdx, [0x180157df8]
mov rcx, rsi
call fcn.18003e650
lea rdx, [0x180157e10]
mov rcx, rdi
call fcn.18003e650
nop
jmp 0x1800cb5bd
mov dword [0x180157d7c], 0
mov rdx, rdi
mov rcx, rsi
call fcn.1800cae00
mov r8d, 1
lea rdx, [0x180157e28]
lea rcx, [rsp + 0x28]
call fcn.180042e10
nop
mov dword [0x180157d74], ebp
mov dword [0x180157d78], ebx
or r8d, 0xffffffff
xor edx, edx
lea rcx, [0x180157df8]
call fcn.18003e4e0
mov rdx, rsi
lea rcx, [0x180157df8]
call fcn.18003e650
or r8d, 0xffffffff
xor edx, edx
lea rcx, [0x180157e10]
call fcn.18003e4e0
mov rdx, rdi
lea rcx, [0x180157e10]
call fcn.18003e650
nop
lea rcx, [rsp + 0x28]
call fcn.180042e90
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800cb5f0
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rdi, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
call fcn.18003e9f0
or r8d, 0xffffffff
xor edx, edx
mov rcx, rdi
call fcn.18003e9f0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov ecx, dword [0x180157d80]
test ecx, ecx
je 0x1800cb6a1
cmp eax, ecx
jne 0x1800cb6a1
mov eax, dword [0x180157d84]
test eax, eax
je 0x1800cb6a1
cmp ebx, eax
jb 0x1800cb6a1
add eax, 0x493e0
cmp eax, ebx
jb 0x1800cb6a1
inc dword [0x180157d88]
mov r8d, 1
lea rdx, [0x180157e90]
lea rcx, [rsp + 0x28]
call fcn.180042e10
nop
lea rdx, [0x180157e60]
mov rcx, rsi
call fcn.18003eb60
lea rdx, [0x180157e78]
mov rcx, rdi
call fcn.18003eb60
nop
jmp 0x1800cb71d
mov dword [0x180157d88], 0
mov rdx, rdi
mov rcx, rsi
call fcn.1800caf60
mov r8d, 1
lea rdx, [0x180157e90]
lea rcx, [rsp + 0x28]
call fcn.180042e10
nop
mov dword [0x180157d80], ebp
mov dword [0x180157d84], ebx
or r8d, 0xffffffff
xor edx, edx
lea rcx, [0x180157e60]
call fcn.18003e9f0
mov rdx, rsi
lea rcx, [0x180157e60]
call fcn.18003eb60
or r8d, 0xffffffff
xor edx, edx
lea rcx, [0x180157e78]
call fcn.18003e9f0
mov rdx, rdi
lea rcx, [0x180157e78]
call fcn.18003eb60
nop
lea rcx, [rsp + 0x28]
call fcn.180042e90
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140028ed8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140028f22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140028f22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140028f22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140028f22
cmp dword [rcx + 0x84], 0xe
jbe 0x140028f22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140028f24
xor al, al
add rsp, 0x28
ret

Function at 0x14002f640
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002f43c
Function at 0x140031d5c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140031de3
mov rsi, rbx
cmp word [rax], bp
je 0x140031da2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140031d8c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140031d88
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14003073c
mov rdi, rax
test rax, rax
je 0x140031dd0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002dee0
mov rbp, rdi
xor ecx, ecx
call fcn.140030a24
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140036e10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140036e38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140036e38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400de640]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400de650]
mov dword [rax], 1
mov rax, qword [0x1400de660]
mov dword [rax], 1
mov rax, qword [0x1400de5e0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400de630]
mov dword [0x1400f300c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010b0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400de710]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400de6f0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400de590]
cmp dword [rax], 1
je 0x1400010f1
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001104
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140018b30
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1f0
lea rbp, [rsp + 0x80]
mov rax, qword [rcx]
mov rdi, qword [rax]
mov qword [rax], 0
test rdi, rdi
je 0x140018b93
lea rsi, [rbp - 0x60]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov cx, 0x202
mov rdx, rsi
call sub.WS2_32.dll_WSAStartup
mov dword [rbp + 0x16c], eax
test eax, eax
jne 0x140018b9f
lea rax, [0x1400aa95c]
mov qword [rdi], rax
add rsp, 0x1f0
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.library_std_src_synconce.rs
call sym.core::option::unwrap_failed::he56e1bcb20c6688c
mov qword [rbp + 0x138], 0
lea rdx, [0x1400c00f0]
lea r9, [0x1400c00f8]
lea rcx, [rbp + 0x16c]
lea r8, [rbp + 0x138]
call sym.core::panicking::assert_failed::ha5e250ffb62a7266
int3

Function at 0x140036580
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x140037910
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x468
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c8], rcx
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3d8], 2
mov qword [rbp + 0x3e0], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c0], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400379a0
jmp 0x14003798f
jae 0x140037a5b
cmp r8, 0x201
jae 0x1400379a0
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x1400379f7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1400379cf
lea rcx, [rbp + 0x3d0]
mov rdx, rbx
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h885312df9b6b04ea
mov rsi, qword [rbp + 0x3d0]
mov rax, qword [rbp + 0x3d8]
mov qword [rbp + 0x3c0], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e0], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c0]
mov r12, rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, r12d
mov rdx, r15
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov r13d, eax
test eax, eax
jne 0x140037a1d
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140037ac7
mov r8d, r13d
cmp r12, r8
jne 0x140037980
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140037afa
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14003798f
jmp 0x1400379a0
cmp r14, r8
jb 0x140037b14
lea rcx, [rbp + 0x3a0]
mov rdx, r15
call sym.__std::ffi::os_str::OsString_as_std::os::windows::ffi::OsStringExt_::from_wide::ha0312d0ddf593664
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
mov rsi, qword [rbp + 0x3c8]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
je 0x140037ab0
mov rcx, qword [rbp + 0x3d8]
add rdx, rdx
mov r8d, 2
call sym.__rust_dealloc
mov rax, rsi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3c8]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d0]
test rdx, rdx
jne 0x140037a9b
jmp 0x140037ab0
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call sym.core::panicking::panic::hba033bb5326eda2b
jmp 0x140037b29
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call sym.core::slice::index::slice_end_index_len_fail::h0369f756e1733715
ud2
Function at 0x140037b60
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x140037b7f
mov rdx, rax
add rsp, 0x68
pop rsi
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp], rax
mov rax, rbp
mov qword [rbp - 0x10], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h3915d14c4c77d97f]
mov qword [rbp - 8], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x20], 0
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x40]
call sym.core::panicking::panic_fmt::h18e16da0d04b3f72
ud2
Function at 0x140038550
Capabilities:
Set environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov r14, r9
mov r15, r8
mov r8, rdx
mov rdx, rcx
movabs r13, 0x8000000000000000
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r9
lea rsi, [rbp - 0x10]
mov rcx, rsi
call sym.std::sys::pal::windows::to_u16s::inner::h1da119d54a64f2b0
mov rdi, qword [rbp - 0x10]
mov rbx, qword [rbp - 8]
cmp rdi, r13
jne 0x1400385af
mov r14, rbx
jmp 0x140038614
lea rcx, [rbp - 0x10]
mov rdx, r15
mov r8, r14
call sym.std::sys::pal::windows::to_u16s::inner::h1da119d54a64f2b0
mov r12, qword [rbp - 0x10]
mov r15, qword [rbp - 8]
cmp r12, r13
jne 0x1400385d0
mov r14, r15
jmp 0x1400385fb
mov rcx, rbx
mov rdx, r15
call sub.KERNEL32.dll_SetEnvironmentVariableW
test eax, eax
je 0x14003862d
xor r14d, r14d
test r12, r12
je 0x1400385fb
add r12, r12
mov r8d, 2
mov rcx, r15
mov rdx, r12
call sym.__rust_dealloc
test rdi, rdi
je 0x140038614
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
test r14, r14
jne 0x140038644
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
mov r14d, eax
shl r14, 0x20
or r14, 2
test r12, r12
jne 0x1400385e7
jmp 0x1400385fb
mov qword [rbp + 0x20], r14
lea rax, [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rax, [sym.__std::ffi::os_str::Display_as_core::fmt::Debug_::fmt::h7ee8f036deefa9ed]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x30]
mov qword [rbp], rcx
mov qword [rbp + 8], rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h3915d14c4c77d97f]
mov qword [rbp + 0x18], rax
lea rax, str.failed_to_set_environment_variable____to___:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 3
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 3
lea rdx, str.library_std_srcenv.rs
lea rcx, [rbp - 0x60]
call sym.core::panicking::panic_fmt::h18e16da0d04b3f72
ud2
Function at 0x140038700
Capabilities:
Set environment variable

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov r8, rdx
mov rdx, rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], r8
lea rcx, [rbp - 0x40]
call sym.std::sys::pal::windows::to_u16s::inner::h1da119d54a64f2b0
mov rdi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x38]
movabs rax, 0x8000000000000000
cmp rdi, rax
jne 0x140038746
mov rsi, rbx
jmp 0x14003877e
xor esi, esi
mov rcx, rbx
xor edx, edx
call sub.KERNEL32.dll_SetEnvironmentVariableW
test eax, eax
jne 0x140038765
call sub.KERNEL32.dll_GetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
test rdi, rdi
je 0x14003877e
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
test rsi, rsi
jne 0x14003878f
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp], rsi
lea rax, [rbp - 0x10]
mov qword [rbp - 0x60], rax
lea rax, [sym.__std::ffi::os_str::Display_as_core::fmt::Debug_::fmt::h7ee8f036deefa9ed]
mov qword [rbp - 0x58], rax
mov rax, rbp
mov qword [rbp - 0x50], rax
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h3915d14c4c77d97f]
mov qword [rbp - 0x48], rax
lea rax, str.failed_to_remove_environment_variable__
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 2
mov qword [rbp - 0x20], 0
lea rax, [rbp - 0x60]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 2
lea rdx, str.library_std_srcenv.rs
lea rcx, [rbp - 0x40]
call sym.core::panicking::panic_fmt::h18e16da0d04b3f72
ud2