joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013e70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov rbx, qword [0x14003da78]
mov rax, qword [rbx]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor ecx, ecx
call r14
mov rdi, rax
xor ecx, ecx
call r14
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov ecx, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__isatty
mov esi, eax
test eax, eax
je 0x140013eef
mov ecx, 1
call r14
lea rcx, str.Please_enter_your_password:_n
mov edx, 0x1c
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 1
call r14
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0xe0], 0
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov ecx, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__isatty
test eax, eax
je 0x140013fbf
lea rdi, [rsp + 0x20]
mov r15d, 0xc8
mov ebp, 0x2401
mov r14, rdi
nop word cs:[rax + rax]
call sub.api_ms_win_crt_conio_l1_1_0.dll__getch
cmp eax, 8
jne 0x140013fa0
cmp rdi, r14
sbb r14, 0
cmp eax, 0xd
jbe 0x140013fb8
jmp 0x140013f80
lea ecx, [r15 - 1]
cmp r15d, 2
jl 0x140013fb0
mov byte [r14], al
inc r14
mov r15d, ecx
cmp eax, 0xd
ja 0x140013f80
bt ebp, eax
jae 0x140013f80
jmp 0x140013fd6
lea rcx, [rsp + 0x20]
mov edx, 0xc8
mov r8, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fgets
test rax, rax
je 0x140014040
test esi, esi
je 0x140013ff2
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
lea rsi, [rsp + 0x20]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
movzx ecx, byte [rax + rsi - 1]
cmp ecx, 0xd
je 0x14001400e
cmp ecx, 0xa
jne 0x140014013
mov byte [rsp + rax + 0x1f], 0
lea rcx, [rsp + 0x20]
call sub.nss3.dll_PORT_Strdup
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
mov rdx, qword [rbx]
cmp rdx, rcx
jne 0x140014069
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.QUIET_FGETS_failed_n
mov edx, 0x13
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
xor eax, eax
jmp 0x14001401d
call fcn.140018700
int3
Function at 0x140014070
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
xor r14d, r14d
test edx, edx
jne 0x14001429d
mov rdi, r8
test r8, r8
je 0x14001429d
mov rbx, rcx
mov ecx, 0x1000
call sub.nss3.dll_PORT_ZAlloc
test rax, rax
je 0x14001410c
mov rsi, rax
mov rcx, rdi
mov edx, 1
xor r8d, r8d
call qword [sym.imp.nss3.dll_PR_Open]
test rax, rax
je 0x140014114
mov r14, rax
mov rcx, rax
mov rdx, rsi
mov r8d, 0x1000
call qword [sym.imp.nss3.dll_PR_Read]
mov edi, eax
mov rcx, r14
call qword [sym.imp.nss3.dll_PR_Close]
test edi, edi
je 0x14001426d
xor r13d, r13d
test rbx, rbx
je 0x140014136
mov rcx, rbx
call sub.nss3.dll_PK11_GetTokenName
test rax, rax
je 0x140014136
mov rbx, rax
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
jmp 0x14001413a
xor r14d, r14d
jmp 0x14001429d
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.No_password_file___s__exists._n
mov rcx, rax
mov r8, rdi
call fcn.140018b90
jmp 0x140014292
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x30], rax
cdqe
mov qword [rsp + 0x28], rax
movsxd rbp, edi
mov r14, rbp
neg r14
jmp 0x14001416a
test r12b, 1
je 0x140014260
movsxd r15, r13d
cmp edi, r15d
mov r13d, r15d
cmovg r13d, edi
mov rax, r15
nop word [rax + rax]
movzx ecx, byte [rsi + rax]
cmp ecx, 0xa
je 0x1400141a0
cmp ecx, 0xd
je 0x1400141a0
cmp rax, rbp
jge 0x1400141b1
inc rax
jmp 0x140014180
cmp edi, eax
jle 0x1400141c0
lea r13d, [rax + 1]
mov byte [rsi + rax], 0
cmp r13d, edi
jl 0x1400141c8
xor r12d, r12d
jmp 0x140014213
mov r13d, eax
cmp r13d, edi
jge 0x1400141b1
movsxd rax, r13d
inc rax
mov r12b, 1
jmp 0x1400141ff
mov byte [rsi + rax - 1], 0
cmp rax, rbp
setl r12b
inc r13d
lea rcx, [r14 + rax]
inc rcx
inc rax
cmp rcx, 1
je 0x140014210
movzx ecx, byte [rsi + rax - 1]
cmp ecx, 0xd
je 0x1400141e0
cmp ecx, 0xa
je 0x1400141e0
jmp 0x140014213
mov r13d, edi
add r15, rsi
test rbx, rbx
je 0x140014260
mov rcx, r15
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
jne 0x140014160
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp dword [rsp + 0x30], eax
jge 0x140014160
mov rax, qword [rsp + 0x28]
cmp byte [r15 + rax], 0x3a
jne 0x140014160
mov rax, qword [rsp + 0x28]
add r15, rax
inc r15
mov rcx, r15
call sub.nss3.dll_PORT_Strdup
mov r14, rax
jmp 0x140014295
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.password_file_contains_no_data_n
mov edx, 0x1f
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
xor r14d, r14d
mov rcx, rsi
call sub.nss3.dll_PORT_Free
mov rax, r14
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140016510
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x60], r8
mov rbx, qword [0x14003da78]
mov rax, qword [rbx]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp qword [rcx], 0
je 0x14001658d
mov rdi, rdx
mov rsi, rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rcx]
lea rcx, str._Warning:
mov edx, 0xd
mov r8d, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, qword [rsi]
mov r8, qword [rsp + 0x20]
mov rdx, rdi
call fcn.140018c90
mov r9, qword [rsi]
lea rcx, str._n
mov edx, 4
mov r8d, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rax, qword [rsp + 0x28]
xor rax, rsp
mov rcx, qword [rbx]
cmp rcx, rax
jne 0x1400165a5
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call fcn.140018700
int3
Function at 0x1400165b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rsi, rcx
mov rax, qword [0x14003da78]
mov rax, qword [rax]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x40], 0
lea rdi, [rsp + 0x50]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x104
mov rcx, rdi
mov rdx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
mov qword [rsp + 0x48], 0
lea rdx, [0x1400412f4]
lea r8, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x1400167ff
mov rsi, rax
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea r12, [0x1400412f4]
lea rbx, [rsp + 0x48]
mov rbp, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov r14, qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [rsp + 0x40], eax
jmp 0x140016687
test edi, edi
jne 0x1400167ff
xor ecx, ecx
mov rdx, r12
mov r8, rbx
call rbp
mov r15, rax
mov rcx, rsi
mov rdx, rax
call r14
test r15, r15
je 0x1400167f7
mov rcx, rsi
call r13
test eax, 0x400
je 0x140016668
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140016768
mov rbx, r12
mov ecx, 0x4000
call fcn.140017740
mov r12, rax
mov r8d, 0x4000
mov rcx, rax
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x44], 0
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x4000
mov rcx, r15
mov edx, 0x900a8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov bpl, 1
mov edi, 1
test eax, eax
je 0x1400167be
mov eax, dword [r12]
cmp eax, 0xa000000c
je 0x14001677f
cmp eax, 0xa0000003
jne 0x1400167be
cmp word [r12 + 0xa], 5
jb 0x140016788
movzx eax, word [r12 + 8]
and eax, 0xfffffffe
lea rcx, [r12 + rax]
add rcx, 0x10
jmp 0x14001679d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
setne al
mov dword [rsp + 0x40], eax
mov edi, 1
jmp 0x1400167d9
cmp word [r12 + 0xa], 5
jae 0x14001678c
xor ebp, ebp
jmp 0x1400167be
movzx eax, word [r12 + 8]
and eax, 0xfffffffe
lea rcx, [r12 + rax]
add rcx, 0x14
mov r8d, 4
lea rdx, [0x1400412f8]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncmp
xor edi, edi
test eax, eax
setne dil
mov ebp, dword [rsp + 0x40]
or bpl, dil
mov rcx, r12
call fcn.1400177b0
mov dword [rsp + 0x40], ebp
mov r12, rbx
lea rbx, [rsp + 0x48]
mov rbp, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov rax, r15
inc rax
cmp rax, 2
jb 0x140016660
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140016660
mov dword [rsp + 0x40], 0
mov rax, qword [rsp + 0x260]
xor rax, rsp
mov rcx, qword [0x14003da78]
mov rcx, qword [rcx]
cmp rcx, rax
jne 0x140016833
mov eax, dword [rsp + 0x40]
and al, 1
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140018700
int3
Function at 0x140016e80
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rdi, rcx
mov r15, qword [0x14003da78]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x258], rax
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140016f05
mov rsi, rax
mov dword [rsp + 0x20], 0x238
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140016f2d
lea rbx, [rsp + 0x4c]
lea r14, [rsp + 0x20]
nop
mov rcx, rdi
mov rdx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsicmp
test eax, eax
je 0x140016f37
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140016ee0
mov edi, 0x490
jmp 0x140016f39
mov rax, qword [rsp + 0x258]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne case.default.0x140016f26
add rsp, 0x260
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140016f39
xor edi, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x258]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne case.default.0x140016f26
mov eax, edi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140018700
int3

Function at 0x1400170f0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x278
mov rsi, rcx
mov rdi, qword [0x14003da78]
mov rax, qword [rdi]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14001713c
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140017154
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x14001719a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x14001718c
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x140017179
lea rdx, [rsp + 0x4c]
lea rsi, [0x14005c49e]
mov r8d, 0x105
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
mov word [0x14005c6a6], 0
jmp 0x14001719c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp esi, 2
jne 0x140017194
mov dword [rax], 2
jmp 0x14001719a
mov dword [rax], 9
xor esi, esi
mov rax, qword [rsp + 0x270]
xor rax, rsp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x1400171bc
mov rax, rsi
add rsp, 0x278
pop rdi
pop rsi
ret
call fcn.140018700
int3
Function at 0x1400180b0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.140018c90
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x140018700
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, str._stack_smashing_detected_:_terminated_n
mov ecx, 2
mov r8d, 0x2c
call sub.api_ms_win_crt_stdio_l1_1_0.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x140018730
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3

Function at 0x140019140
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, [0x14004c1b4]
mov edx, 0xb
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call fcn.140018c90
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x14001d480
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14003d010]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14001d4ec
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14001d4ec
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14001d4ec
movzx edx, word [rax + 6]
test edx, edx
je 0x14001d4ec
sub rcx, qword [0x14003d010]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x14001d4d8
add rax, 0x28
dec edx
je 0x14001d4ec
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x14001d4d0
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x14001d4d0
jmp 0x14001d4ee
xor eax, eax
ret

Function at 0x14001d4f0
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14003d010]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x14001d525
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x14001d525
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x14001d525
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x14001d5a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14003d010]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14001d5cc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14001d5cc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x14001d5ce
xor eax, eax
ret
Function at 0x14001d730
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, str._buffer_overflow_detected_:_terminated_n
mov ecx, 2
mov r8d, 0x2d
call sub.api_ms_win_crt_stdio_l1_1_0.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x14001d760
mov ecx, 8
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3

Function at 0x14001d910
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rdx
mov rsi, rcx
cmp byte [0x14005c8fb], 1
jne 0x14001d935
cmp byte [0x14005c8fa], 0
jne 0x14001d954
jmp 0x14001d974
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14005c8fb], 1
test rax, rax
setne byte [0x14005c8fa]
je 0x14001d974
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_init_local_cursor_p__context_p__n
mov rcx, rax
mov r8, rsi
mov r9, rdi
call fcn.140018b90
lea rax, [0x14004c7a8]
mov qword [rsi], rax
lea rax, [0x14005c8ec]
mov qword [rsi + 8], rax
xorps xmm0, xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], 0
lea rax, [rsi + 0x580]
lea rcx, [rsi + 0xb0]
movaps xmmword [rsi + 0x580], xmm0
movaps xmmword [rsi + 0x590], xmm0
movaps xmmword [rsi + 0x5a0], xmm0
movaps xmmword [rsi + 0x5b0], xmm0
movaps xmmword [rsi + 0x5c0], xmm0
movaps xmmword [rsi + 0x5d0], xmm0
movaps xmmword [rsi + 0x5e0], xmm0
movaps xmmword [rsi + 0x5f0], xmm0
movaps xmmword [rsi + 0x600], xmm0
movaps xmmword [rsi + 0x610], xmm0
movaps xmmword [rsi + 0x620], xmm0
movaps xmmword [rsi + 0x630], xmm0
movaps xmmword [rsi + 0x640], xmm0
movups xmmword [rsi + 0x649], xmm0
mov qword [rsi + 0x80], rcx
mov qword [rsi + 0x98], rax
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi + 0x80]
movups xmm0, xmmword [rdi + 0x10]
movdqu xmm1, xmmword [rdi + 0x30]
pshufd xmm1, xmm1, 0x4e
movdqu xmm2, xmmword [rdi + 0x20]
pshufd xmm2, xmm2, 0x4e
movups xmm3, xmmword [rdi + 0x40]
movups xmm4, xmmword [rdi + 0x50]
movups xmm5, xmmword [rdi + 0x60]
movups xmm6, xmmword [rdi + 0x70]
mov dword [rsi + 0xe0], 0x10000b
mov qword [rsi + 0x128], rax
movaps xmmword [rsi + 0x130], xmm0
mov qword [rsi + 0x140], rcx
movdqu xmmword [rsi + 0x148], xmm1
movdqu xmmword [rsi + 0x158], xmm2
movups xmmword [rsi + 0x168], xmm3
movups xmmword [rsi + 0x178], xmm4
movups xmmword [rsi + 0x188], xmm5
movups xmmword [rsi + 0x198], xmm6
mov qword [rsi + 0x1a8], rdx
test rdx, rdx
je 0x14001dabb
mov rcx, rsi
call fcn.14001a270
test al, al
jne 0x14001dac2
mov byte [rsi + 0x658], 1
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14001dad0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x14005c8fb], 1
jne 0x14001daec
cmp byte [0x14005c8fa], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x14005c8fa]
mov byte [0x14005c8fb], 1
add rsp, 0x28
ret

Function at 0x14001db20
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov edi, edx
mov rbx, rcx
cmp byte [0x14005c8fb], 1
jne 0x14001db43
cmp byte [0x14005c8fa], 0
jne 0x14001db62
jmp 0x14001db87
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14005c8fb], 1
test rax, rax
setne byte [0x14005c8fa]
je 0x14001db87
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.140018b90
mov rax, qword [rbx]
mov rcx, rbx
mov edx, edi
call qword [rax + 0x10]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x14001dbad
mov rax, qword [rbx]
mov rcx, rbx
mov edx, edi
call qword [rax + 0x18]
mov qword [rsi], rax
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001dbc0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rbx, r8
mov edi, edx
mov rsi, rcx
cmp byte [0x14005c8fb], 1
jne 0x14001dbe4
cmp byte [0x14005c8fa], 0
jne 0x14001dc03
jmp 0x14001dc28
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14005c8fb], 1
test rax, rax
setne byte [0x14005c8fa]
je 0x14001dc28
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x20], rbx
lea rdx, str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_llx__n
mov rcx, rax
mov r8, rsi
mov r9d, edi
call fcn.140018b90
mov rax, qword [rsi]
mov rcx, rsi
mov edx, edi
call qword [rax + 0x10]
mov ebp, 0xffffe672
test al, al
je 0x14001dc99
mov rax, qword [rsi]
mov rcx, rsi
mov edx, edi
mov r8, rbx
call qword [rax + 0x20]
xor ebp, ebp
cmp edi, 0xffffffff
jne 0x14001dc99
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [rax + 0x48]
mov rax, qword [rsi]
xor ebp, ebp
mov rcx, rsi
xor edx, edx
call qword [rax + 0x68]
cmp qword [rsp + 0x50], 0
je 0x14001dc99
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xfffffffe
call qword [rax + 0x18]
add rax, qword [rsp + 0x50]
mov r9, qword [rsi]
mov rcx, rsi
mov edx, 0xfffffffe
mov r8, rax
call qword [r9 + 0x20]
mov eax, ebp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14001ddf0
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [0x14005c8fb], 1
jne 0x14001de0c
cmp byte [0x14005c8fa], 0
jne 0x14001de2b
jmp 0x14001de48
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14005c8fb], 1
test rax, rax
setne byte [0x14005c8fa]
je 0x14001de48
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_step_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.140018b90
mov rax, qword [rsi]
mov rax, qword [rax + 0x40]
mov rcx, rsi
xor edx, edx
add rsp, 0x20
pop rsi
jmp rax

Function at 0x14001ded0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
cmp byte [0x14005c8fb], 1
jne 0x14001def0
cmp byte [0x14005c8fa], 0
jne 0x14001df0f
jmp 0x14001df2f
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14005c8fb], 1
test rax, rax
setne byte [0x14005c8fa]
je 0x14001df2f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.140018b90
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [rax + 0x48]
xor ecx, ecx
cmp qword [rsi + 8], 0
mov eax, 0xffffe66b
cmovne eax, ecx
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14001df60
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [0x14005c8fb], 1
jne 0x14001df7c
cmp byte [0x14005c8fa], 0
jne 0x14001df9b
jmp 0x14001dfb8
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14005c8fb], 1
test rax, rax
setne byte [0x14005c8fa]
je 0x14001dfb8
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_resume_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.140018b90
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
mov eax, 0xffffe674
add rsp, 0x20
pop rsi
ret

Function at 0x14001dfd0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [0x14005c8fb], 1
jne 0x14001dff9
cmp byte [0x14005c8fa], 0
jne 0x14001e018
jmp 0x14001e03c
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov byte [0x14005c8fb], 1
test rax, rax
setne byte [0x14005c8fa]
je 0x14001e03c
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], edi
lea rdx, str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
mov rcx, rax
mov r8, r14
mov r9, rbx
call fcn.140018b90
mov rax, qword [r14]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [rax + 0x60]
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret