joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f88c990
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6fb3f8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6fb3f8a0]
test rbx, rbx
je 0x6f88c9e4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x6f88c9db
test r12, r12
je 0x6f88c9db
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6f88c9c0
lea rcx, [0x6fb3f8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6f88cd20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x6fa31630]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x6f88cd99
mov rcx, r10
call fcn.6f88cbf0
test eax, eax
je 0x6f88cd99
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x6f88cd96
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x6f88cd8d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x6f88cd99
add r8, 0x28
cmp r8, r9
jne 0x6f88cd78
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x6f88d0f0
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x6fb3f8a8]
mov edi, ecx
mov rsi, rdx
test eax, eax
jne 0x6f88ca20
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x6f88ca73
mov dword [rax], edi
lea rcx, [0x6fb3f8c0]
mov qword [rax + 8], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x6fb3f8a0]
lea rcx, [0x6fb3f8c0]
mov qword [0x6fb3f8a0], rbx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
or eax, 0xffffffff
jmp 0x6f88ca16
push r12
push rbx
sub rsp, 0x28
mov rbx, rcx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, 0xffffffff
je 0x6f88d120
mov rdx, r12
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop r12
jmp 0x6f894810
add rsp, 0x28
pop rbx
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
test rdx, rdx
jne 0x6f894820
xor eax, eax
ret
jmp 0x6f88ca00

Function at 0x6f88d160
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r12d
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x6f88d1a0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x6f88d1b8
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x6f896110
Capabilities:
Query environment variable

Disassembly:
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [0x6fa24c0b]
jmp 0x6f898bc0
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a420]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f898c54
lea rcx, [0x6fa1a420]
call fcn.6f8c6b30
test eax, eax
je 0x6f898c54
mov ecx, 2
call rsi
lea rcx, [0x6fa24bbd]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f898c30
lea rdx, [0x6fa24bd8]
lea rcx, [0x6fa24bdb]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a420]
mov qword [0x6fa1ac10], rbx
call fcn.6f8c6c40
jmp 0x6f898c54
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x6fa1ac10]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x6f898ca4
lea rdx, [0x6fa24bf0]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac10]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa24bfc]
jmp 0x6f898ccb
lea rdx, [0x6fa24c02]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac10]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa24c09]
mov rcx, qword [0x6fa1ac10]
call fcn.6f896080
mov rcx, qword [0x6fa1ac10]
call sub.msvcrt.dll_fflush
jmp 0x6f898cf3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x6f896130
Capabilities:
Query environment variable

Disassembly:
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [0x6fa2576e]
jmp fcn.6f899090

Function at 0x6f896170
Capabilities:
Query environment variable

Disassembly:
lea r8, str.src_Window.cpp
mov r9d, edx
mov rdx, rcx
lea rcx, [0x6fa252cd]
jmp fcn.6f898e40

Function at 0x6f896190
Capabilities:
Query environment variable

Disassembly:
lea r8, str.src_NanoVG.cpp
mov r9d, edx
mov rdx, rcx
lea rcx, [0x6fa25f8d]
jmp fcn.6f8991d0

Function at 0x6f898790
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x6fa243ca]
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f8987d1
lea rdx, [0x6fa243e5]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
jne 0x6f8987d4
jmp 0x6f8987d1
mov rax, rbx
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x6f8987e0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x6fa254a0]
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f898821
lea rdx, [0x6fa254bb]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
jne 0x6f898824
jmp 0x6f898821
mov rax, rbx
add rsp, 0x28
pop rbx
pop r12
ret
Function at 0x6f898830
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a3f0]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f8988c4
lea rcx, [0x6fa1a3f0]
call fcn.6f8c6b30
test eax, eax
je 0x6f8988c4
mov ecx, 2
call rsi
lea rcx, [0x6fa24038]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f8988a0
lea rdx, [0x6fa24053]
lea rcx, [0x6fa24056]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a3f0]
mov qword [0x6fa1abe0], rbx
call fcn.6f8c6c40
jmp 0x6f8988c4
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x6fa1abe0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x6f898914
lea rdx, [0x6fa2406b]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1abe0]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa24077]
jmp 0x6f89893b
lea rdx, [0x6fa2407d]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1abe0]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa24084]
mov rcx, qword [0x6fa1abe0]
call fcn.6f896080
mov rcx, qword [0x6fa1abe0]
call sub.msvcrt.dll_fflush
jmp 0x6f898963
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x6f898970
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a400]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f898a04
lea rcx, [0x6fa1a400]
call fcn.6f8c6b30
test eax, eax
je 0x6f898a04
mov ecx, 2
call rsi
lea rcx, [0x6fa241f0]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f8989e0
lea rdx, [0x6fa2420b]
lea rcx, [0x6fa2420e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a400]
mov qword [0x6fa1abf0], rbx
call fcn.6f8c6c40
jmp 0x6f898a04
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x6fa1abf0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x6f898a54
lea rdx, [0x6fa24223]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1abf0]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa2422f]
jmp 0x6f898a7b
lea rdx, [0x6fa24235]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1abf0]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa2423c]
mov rcx, qword [0x6fa1abf0]
call fcn.6f896080
mov rcx, qword [0x6fa1abf0]
call sub.msvcrt.dll_fflush
jmp 0x6f898aa3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x6f898bc0
Capabilities:
Query environment variable

Disassembly:
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [0x6fa24c0b]
jmp 0x6f898bc0
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a420]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f898c54
lea rcx, [0x6fa1a420]
call fcn.6f8c6b30
test eax, eax
je 0x6f898c54
mov ecx, 2
call rsi
lea rcx, [0x6fa24bbd]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f898c30
lea rdx, [0x6fa24bd8]
lea rcx, [0x6fa24bdb]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a420]
mov qword [0x6fa1ac10], rbx
call fcn.6f8c6c40
jmp 0x6f898c54
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x6fa1ac10]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x6f898ca4
lea rdx, [0x6fa24bf0]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac10]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa24bfc]
jmp 0x6f898ccb
lea rdx, [0x6fa24c02]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac10]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa24c09]
mov rcx, qword [0x6fa1ac10]
call fcn.6f896080
mov rcx, qword [0x6fa1ac10]
call sub.msvcrt.dll_fflush
jmp 0x6f898cf3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x6f898d00
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a450]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f898d94
lea rcx, [0x6fa1a450]
call fcn.6f8c6b30
test eax, eax
je 0x6f898d94
mov ecx, 2
call rsi
lea rcx, [0x6fa24f80]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f898d70
lea rdx, [0x6fa24f9b]
lea rcx, [0x6fa24f9e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a450]
mov qword [0x6fa1ac40], rbx
call fcn.6f8c6c40
jmp 0x6f898d94
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x6fa1ac40]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x6f898de4
lea rdx, [0x6fa24fb3]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac40]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa24fbf]
jmp 0x6f898e0b
lea rdx, [0x6fa24fc5]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac40]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa24fcc]
mov rcx, qword [0x6fa1ac40]
call fcn.6f896080
mov rcx, qword [0x6fa1ac40]
call sub.msvcrt.dll_fflush
jmp 0x6f898e33
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x6f898e40
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a480]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f898ed4
lea rcx, [0x6fa1a480]
call fcn.6f8c6b30
test eax, eax
je 0x6f898ed4
mov ecx, 2
call rsi
lea rcx, [0x6fa25270]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f898eb0
lea rdx, [0x6fa2528b]
lea rcx, [0x6fa2528e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a480]
mov qword [0x6fa1ac70], rbx
call fcn.6f8c6c40
jmp 0x6f898ed4
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x6fa1ac70]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x6f898f24
lea rdx, [0x6fa252a3]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac70]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa252af]
jmp 0x6f898f4b
lea rdx, [0x6fa252b5]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac70]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa252bc]
mov rcx, qword [0x6fa1ac70]
call fcn.6f896080
mov rcx, qword [0x6fa1ac70]
call sub.msvcrt.dll_fflush
jmp 0x6f898f73
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x6f899090
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a4a0]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f899124
lea rcx, [0x6fa1a4a0]
call fcn.6f8c6b30
test eax, eax
je 0x6f899124
mov ecx, 2
call rsi
lea rcx, [0x6fa25720]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f899100
lea rdx, [0x6fa2573b]
lea rcx, [0x6fa2573e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a4a0]
mov qword [0x6fa1ac90], rbx
call fcn.6f8c6c40
jmp 0x6f899124
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x6fa1ac90]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x6f899174
lea rdx, [0x6fa25753]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac90]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa2575f]
jmp 0x6f89919b
lea rdx, [0x6fa25765]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac90]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa2576c]
mov rcx, qword [0x6fa1ac90]
call fcn.6f896080
mov rcx, qword [0x6fa1ac90]
call sub.msvcrt.dll_fflush
jmp 0x6f8991c3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x6f8991d0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a4b0]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f899264
lea rcx, [0x6fa1a4b0]
call fcn.6f8c6b30
test eax, eax
je 0x6f899264
mov ecx, 2
call rsi
lea rcx, [0x6fa25f30]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f899240
lea rdx, [0x6fa25f4b]
lea rcx, [0x6fa25f4e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a4b0]
mov qword [0x6fa1aca0], rbx
call fcn.6f8c6c40
jmp 0x6f899264
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x6fa1aca0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x6f8992b4
lea rdx, [0x6fa25f63]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1aca0]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa25f6f]
jmp 0x6f8992db
lea rdx, [0x6fa25f75]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1aca0]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa25f7c]
mov rcx, qword [0x6fa1aca0]
call fcn.6f896080
mov rcx, qword [0x6fa1aca0]
call sub.msvcrt.dll_fflush
jmp 0x6f899303
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x6f899310
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a4c0]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f8993a4
lea rcx, [0x6fa1a4c0]
call fcn.6f8c6b30
test eax, eax
je 0x6f8993a4
mov ecx, 2
call rsi
lea rcx, [0x6fa27a2d]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f899380
lea rdx, [0x6fa27a48]
lea rcx, [0x6fa27a4b]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a4c0]
mov qword [0x6fa1acb0], rbx
call fcn.6f8c6c40
jmp 0x6f8993a4
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x6fa1acb0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x6f8993f4
lea rdx, [0x6fa27a60]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1acb0]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa27a6c]
jmp 0x6f89941b
lea rdx, [0x6fa27a72]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1acb0]
mov rdx, r12
call fcn.6f88dde0
lea rdx, [0x6fa27a79]
mov rcx, qword [0x6fa1acb0]
call fcn.6f896080
mov rcx, qword [0x6fa1acb0]
call sub.msvcrt.dll_fflush
jmp 0x6f899443
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x6f8995a0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a440]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f89962f
lea rcx, [0x6fa1a440]
call fcn.6f8c6b30
test eax, eax
je 0x6f89962f
mov ecx, 2
call rsi
lea rcx, [0x6fa24e60]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f89960b
lea rdx, [0x6fa24e7b]
lea rcx, [0x6fa24e7e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a440]
mov qword [0x6fa1ac30], rbx
call fcn.6f8c6c40
jmp 0x6f89962f
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov r9, qword [0x6fa1ac30]
mov rcx, rax
mov qword [rsp + 0x28], r8
cmp rax, r9
jne 0x6f899686
lea rdx, [0x6fa24e93]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac30]
lea rdx, [0x6fa24e9f]
call fcn.6f88dde0
lea rdx, [0x6fa24ecb]
jmp 0x6f8996b4
mov rcx, r9
lea rdx, [0x6fa24ed1]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac30]
lea rdx, [0x6fa24e9f]
call fcn.6f88dde0
lea rdx, [0x6fa24ed8]
mov rcx, qword [0x6fa1ac30]
call fcn.6f896080
mov rcx, qword [0x6fa1ac30]
call sub.msvcrt.dll_fflush
jmp 0x6f8996dc
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x6f899840
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a470]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f8998cf
lea rcx, [0x6fa1a470]
call fcn.6f8c6b30
test eax, eax
je 0x6f8998cf
mov ecx, 2
call rsi
lea rcx, [0x6fa251c0]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f8998ab
lea rdx, [0x6fa251db]
lea rcx, [0x6fa251de]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a470]
mov qword [0x6fa1ac60], rbx
call fcn.6f8c6c40
jmp 0x6f8998cf
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov r9, qword [0x6fa1ac60]
mov rcx, rax
mov qword [rsp + 0x28], r8
cmp rax, r9
jne 0x6f899926
lea rdx, [0x6fa251f3]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac60]
lea rdx, [0x6fa251ff]
call fcn.6f88dde0
lea rdx, [0x6fa2522b]
jmp 0x6f899954
mov rcx, r9
lea rdx, [0x6fa25231]
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1ac60]
lea rdx, [0x6fa251ff]
call fcn.6f88dde0
lea rdx, [0x6fa25238]
mov rcx, qword [0x6fa1ac60]
call fcn.6f896080
mov rcx, qword [0x6fa1ac60]
call sub.msvcrt.dll_fflush
jmp 0x6f89997c
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x6f899990
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x6fa1a4d0]
test al, al
mov rsi, qword [fcn.6f894680]
jne 0x6f899a1f
lea rcx, [0x6fa1a4d0]
call fcn.6f8c6b30
test eax, eax
je 0x6f899a1f
mov ecx, 2
call rsi
lea rcx, str.DPF_CAPTURE_CONSOLE_OUTPUT
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6f8999fb
lea rdx, [0x6fa27f8b]
lea rcx, str._tmp_dpf.stderr2.log
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x6fa1a4d0]
mov qword [0x6fa1acc0], rbx
call fcn.6f8c6c40
jmp 0x6f899a1f
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov r9, qword [0x6fa1acc0]
mov rcx, rax
mov qword [rsp + 0x28], r8
cmp rax, r9
jne 0x6f899a76
lea rdx, str.e_31m_dpf_
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1acc0]
lea rdx, str.assertion_failure:___s__in_file__s__line__i
call fcn.6f88dde0
lea rdx, str.e_0m_n
jmp 0x6f899aa4
mov rcx, r9
lea rdx, str._dpf_
call fcn.6f896080
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x6fa1acc0]
lea rdx, str.assertion_failure:___s__in_file__s__line__i
call fcn.6f88dde0
lea rdx, [0x6fa27fe8]
mov rcx, qword [0x6fa1acc0]
call fcn.6f896080
mov rcx, qword [0x6fa1acc0]
call sub.msvcrt.dll_fflush
jmp 0x6f899acc
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x6f89a600
Capabilities:
Query environment variable

Disassembly:
mov r8, rdx
test rdx, rdx
je 0x6f89a61f
cmp byte [rdx], 0
je 0x6f89a61f
mov rcx, qword [rcx]
test rcx, rcx
je 0x6f89a63f
mov edx, 1
jmp fcn.6f8a19c0
mov r9d, 0xc0
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, [0x6fa24f0d]
lea rcx, [0x6fa24e9f]
jmp fcn.6f8995a0
ret
mov rcx, qword [rcx + 8]
jmp 0x6f89a600

Function at 0x6f89a660
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [rcx + 0x10]
test eax, eax
jne 0x6f89a687
mov r9d, 0x70
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, str.visibleWindows___0
lea rcx, [0x6fa24e9f]
jmp fcn.6f8995a0
dec eax
mov dword [rcx + 0x10], eax
jne 0x6f89a692
mov byte [rcx + 9], 1
ret

Function at 0x6f89a7b0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x20
cmp dl, 1
mov esi, edx
mov rbx, rcx
sbb edx, edx
lea r13, [rbx + 0x20]
lea r14, [rbx + 0x38]
xor ecx, ecx
inc edx
cmp sil, 1
setb cl
call fcn.6f89bcf0
mov byte [rbx + 8], sil
mov qword [rbx], rax
mov dword [rbx + 9], 0x10000
mov dword [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rbx]
mov qword [rbx + 0x28], r13
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], r13
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x38], r14
mov qword [rbx + 0x48], 0
test rcx, rcx
jne 0x6f89a851
mov r9d, 0x45
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, str.world___nullptr
lea rcx, [0x6fa24e9f]
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp fcn.6f8995a0
mov rdx, rbx
call fcn.6f8a19b0
mov rcx, qword [rbx]
lea r8, [0x6fa24f41]
mov edx, 1
call fcn.6f8a19c0
nop
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret