joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401eb435
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0xa0]
mov rax, qword [0x1405b1300]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x1401eb4d8
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
mov r8, rbx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1401eb501
mov rcx, rdi
mov rdx, rbx
mov r8, r15
mov r9, r14
call 0x1401eb534
test al, al
je 0x1401eb513
mov rcx, qword [r15]
test rcx, rcx
je 0x1401eb530
xor edx, edx
mov r8d, 0xa
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstol
cmp eax, 1
jmp 0x1401eb506
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140286e70
mov rcx, rdi
mov rdx, rbx
mov r8, r15
mov r9, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x1401eb534
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
jmp 0x1401eb515
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140286e70
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor eax, eax
jmp 0x1401eb509
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1405b1300]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x1401eb5c5
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.1401eabfe
mov rcx, r15
call fcn.1401eadbc
mov qword [r14], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140286e70
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1401eb534
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0xa0]
mov rax, qword [0x1405b1300]
xor rax, rsp
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x1401eb4d8
lea rax, [rsp + 0x44]
mov dword [rax], 0
lea rcx, [rsp + 0x40]
mov dword [rcx], 4
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
mov r8, rbx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1401eb501
mov rcx, rdi
mov rdx, rbx
mov r8, r15
mov r9, r14
call 0x1401eb534
test al, al
je 0x1401eb513
mov rcx, qword [r15]
test rcx, rcx
je 0x1401eb530
xor edx, edx
mov r8d, 0xa
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstol
cmp eax, 1
jmp 0x1401eb506
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140286e70
mov rcx, rdi
mov rdx, rbx
mov r8, r15
mov r9, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x1401eb534
cmp dword [rsp + 0x44], 1
sete al
movzx eax, al
mov dword [rsi], eax
mov sil, 1
jmp 0x1401eb515
xor esi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140286e70
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor eax, eax
jmp 0x1401eb509
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1405b1300]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x3c]
mov dword [rax], 0x104
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
mov r8, rbx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x1401eb5c5
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.1401eabfe
mov rcx, r15
call fcn.1401eadbc
mov qword [r14], rax
test ebx, ebx
sete bl
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140286e70
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1401eb69b
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, r9
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
mov rax, qword [0x1405b1300]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1401eb715
mov rdi, rax
lea rdx, str.CreateWebViewEnvironmentWithOptionsInternal
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401eb7aa
mov rcx, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rcx
mov ecx, r14d
mov edx, ebp
mov r8, rsi
call qword [0x14029b978]
mov esi, eax
mov dword [rsp + 0x54], eax
jmp 0x1401eb82c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rbp, [rsp + 0x54]
mov dword [rbp], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1404bbec0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.1401eab08
mov edx, 4
mov rcx, rbp
mov r8b, 1
mov r9, rdi
call fcn.1401eb5ec
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
mov rbp, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call rbp
mov rcx, rdi
call fcn.1401eadbc
mov rcx, rax
call rbp
lea rcx, str._path
call rbp
mov rcx, rbx
call rbp
lea rcx, [0x1404bc512]
call rbp
mov rcx, rdi
call fcn.1401eab1a
jmp 0x1401eb84a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rbp, [rsp + 0x54]
mov dword [rbp], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x30]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1404bbec0]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.1401eab08
mov edx, 4
mov rcx, rbp
mov r8b, 1
mov r9, rbx
call fcn.1401eb5ec
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
mov rbp, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call rbp
mov rcx, rbx
call fcn.1401eadbc
mov rcx, rax
call rbp
lea rcx, [0x1404bc512]
call rbp
mov rcx, rbx
call fcn.1401eab1a
lea rdx, str.DllCanUnloadNow
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401eb84a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140286e70
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1401eb864
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1401eb8b8
mov ebx, eax
mov edx, eax
mov rcx, rsi
call fcn.1401eab76
test al, al
je 0x1401eb8b8
mov rcx, rsi
call fcn.1401eadbc
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1401eacc0
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401ef390
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
nop word [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1401ef3a0
test al, 1
je 0x1401ef3bf
test al, 2
jne 0x1401ef3d7
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1404bd448]
mov edx, 0x23
call fcn.140299f60
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1404bd488]
mov edx, 0x25
call fcn.140299f60
int3

Function at 0x1401f0b70
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rbp + 0x18], rcx
mov rax, qword [rcx]
nop
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1401f0b90
test al, 1
je 0x1401f0c59
test al, 2
jne 0x1401f0c71
xor rax, 3
mov qword [rbp], rax
mov rcx, rbp
lea rdx, [rbp + 0x18]
call fcn.1401fbba0
test rax, rax
je 0x1401f0bee
mov qword [rbp + 0x10], rax
mov rcx, rax
mov qword [rbp + 0x20], rdx
call qword [rdx]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
mov rcx, qword [rbp + 0x10]
je 0x1401f0bee
mov r8, qword [rax + 0x10]
call fcn.140115a00
mov rcx, qword [rbp + 0x18]
mov qword [rbp + 8], 1
mov rax, 0xffffffffffffffc0
lock xadd qword [rcx], rax
shr rax, 6
cmp rax, qword [rbp + 8]
jb 0x1401f0c89
jne 0x1401f0c4f
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x20], rax
lea rcx, [rax + 0x28]
call fcn.1401edab0
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x58]
test rax, rax
je 0x1401f0c3b
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x60]
call qword [rax + 0x18]
mov edx, 0x80
mov r8d, 0x80
mov rcx, qword [rbp + 0x20]
call fcn.140115a00
nop
add rsp, 0xb0
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1404bd448]
mov edx, 0x23
call fcn.140299f60
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x1404bd488]
mov edx, 0x25
call fcn.140299f60
mov qword [rbp - 8], rax
lea rax, [rbp - 8]
mov qword [rbp - 0x28], rax
lea rax, [fcn.140286070]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 8]
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.current:___sub:
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 2
mov qword [rbp - 0x38], 0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 2
lea rdx, [0x1404bd4d0]
lea rcx, [rbp - 0x58]
call fcn.140299e90
int3

Function at 0x140207500
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140221c00
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
cmp qword [rcx + 0x18], 0
je 0x140221cf0
mov eax, dword [rdx]
mov edx, eax
shr edx, 0x10
mov r8d, eax
shr r8d, 0x18
movzx r9d, al
movabs r10, 0xcbf29ce484222325
xor r10, r9
movabs r9, 0x100000001b3
imul r10, r9
movzx esi, ah
xor rsi, r10
imul rsi, r9
movzx edx, dl
xor rdx, rsi
imul rdx, r9
xor rdx, r8
imul rdx, r9
mov r8, qword [rcx]
mov rcx, qword [rcx + 8]
mov r9, rdx
shr r9, 0x39
movd xmm0, r9d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r9d, r9d
pcmpeqd xmm1, xmm1
and rdx, rcx
movdqu xmm2, xmmword [r8 + rdx]
movdqa xmm3, xmm2
pcmpeqb xmm3, xmm0
pmovmskb r10d, xmm3
nop word cs:[rax + rax]
test r10w, r10w
je 0x140221cd0
tzcnt r11d, r10d
lea esi, [r10 - 1]
and esi, r10d
add r11, rdx
and r11, rcx
shl r11, 2
mov rdi, r8
sub rdi, r11
mov r10d, esi
cmp eax, dword [rdi - 4]
jne 0x140221ca0
jmp 0x140221ceb
pcmpeqb xmm2, xmm1
pmovmskb r10d, xmm2
test r10d, r10d
jne 0x140221cf0
add rdx, r9
add rdx, 0x10
add r9, 0x10
jmp 0x140221c7d
mov al, 1
pop rdi
pop rsi
ret
xor eax, eax
pop rdi
pop rsi
ret

Function at 0x140221d00
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, edx
shr eax, 0x10
mov r8d, edx
shr r8d, 0x18
movzx r9d, dl
movabs r10, 0xcbf29ce484222325
xor r10, r9
movabs r9, 0x100000001b3
imul r10, r9
movzx esi, dh
xor rsi, r10
imul rsi, r9
movzx edi, al
xor rdi, rsi
imul rdi, r9
xor rdi, r8
imul rdi, r9
cmp qword [rcx + 0x10], 0
je 0x140221e0f
mov rax, qword [rcx]
mov r9, qword [rcx + 8]
mov r8, rdi
shr r8, 0x39
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor esi, esi
pcmpeqd xmm1, xmm1
xor ebx, ebx
and rdi, r9
movdqu xmm2, xmmword [rax + rdi]
movdqa xmm3, xmm2
pcmpeqb xmm3, xmm0
pmovmskb ebp, xmm3
nop word [rax + rax]
mov r11d, ebp
test bp, bp
je 0x140221dd0
tzcnt r14d, r11d
lea ebp, [r11 - 1]
and ebp, r11d
add r14, rdi
and r14, r9
shl r14, 2
mov r15, rax
sub r15, r14
cmp dword [r15 - 4], edx
jne 0x140221da0
jmp 0x140221e72
cmp rbx, 1
mov ebx, 1
je 0x140221df3
pmovmskb r10d, xmm2
xor ebx, ebx
test r10d, r10d
setne bl
tzcnt r10d, r10d
add r10, rdi
and r10, r9
pcmpeqb xmm2, xmm1
pmovmskb ebp, xmm2
test ebp, ebp
jne 0x140221e2c
add rdi, rsi
add rdi, 0x10
add rsi, 0x10
jmp 0x140221d86
lea r8, [rcx + 0x20]
mov ebx, edx
mov edx, 1
mov rsi, rcx
call fcn.1402964a0
mov rcx, rsi
mov edx, ebx
jmp 0x140221d5d
movzx ebx, byte [rax + r10]
test bl, bl
js 0x140221e48
movdqa xmm0, xmmword [rax]
pmovmskb r10d, xmm0
tzcnt r10d, r10d
movzx ebx, byte [rax + r10]
and bl, 1
movzx esi, bl
sub qword [rcx + 0x10], rsi
lea rsi, [r10 - 0x10]
and rsi, r9
mov byte [rax + r10], r8b
mov byte [rax + rsi + 0x10], r8b
inc qword [rcx + 0x18]
shl r10, 2
neg r10
mov dword [rax + r10 - 4], edx
test r11w, r11w
setne al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14022c400
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14022c472
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
jmp 0x14022c438
add rdi, rbx
sub rsi, rbx
je 0x14022c472
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x14022c430
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x14022c430
and ebp, 0x7fffffff
jmp 0x14022c474
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1402594b0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], 0
mov qword [rbp + 0x400], 2
mov qword [rbp + 0x408], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140259550
jmp 0x14025953f
jae 0x14025960f
cmp r8, 0x201
jae 0x140259550
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x1402595a7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14025957f
lea rcx, [rbp + 0x3f8]
mov rdx, rbx
call fcn.1402989f0
mov rsi, qword [rbp + 0x3f8]
mov rax, qword [rbp + 0x400]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x408], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3e8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1402595d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140259689
mov r8d, r13d
cmp r12, r8
jne 0x140259530
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1402596bd
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14025953f
jmp 0x140259550
cmp r14, r8
jb 0x1402596d7
lea rcx, [rbp + 0x3c8]
mov rdx, r15
call fcn.14025d600
movups xmm0, xmmword [rbp + 0x3c8]
movups xmm1, xmmword [rbp + 0x3d8]
movaps xmmword [rbp + 0x3b0], xmm1
movaps xmmword [rbp + 0x3a0], xmm0
mov rsi, qword [rbp + 0x3f0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
je 0x140259672
mov rcx, qword [rbp + 0x400]
add rdx, rdx
mov r8d, 2
call fcn.140115a00
mov rax, rsi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3f0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
jne 0x14025965d
jmp 0x140259672
lea rcx, str.internal_error:_entered_unreachable_code0LR_
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140299f60
jmp 0x1402596ec
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14029a3a0
ud2
Function at 0x140259c20
Capabilities:
Set environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rdi, r9
mov rbx, r8
mov r8, rdx
mov rdx, rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], r8
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], r9
lea rsi, [rbp - 8]
mov rcx, rsi
call fcn.14026f1f0
mov rax, qword [rbp - 8]
mov rcx, qword [rbp]
movabs r15, 0x8000000000000000
cmp rax, r15
jne 0x140259c83
mov rdi, rcx
jmp 0x140259d02
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rax
lea rcx, [rbp - 8]
mov rdx, rbx
mov r8, rdi
call fcn.14026f1f0
mov r14, qword [rbp - 8]
mov rbx, qword [rbp]
cmp r14, r15
jne 0x140259cb9
mov rdi, rbx
mov rdx, qword [rbp + 0x38]
test rdx, rdx
mov r15, qword [rbp + 0x30]
jne 0x140259cf1
jmp 0x140259d02
mov r15, qword [rbp + 0x30]
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x140259d17
xor edi, edi
test r14, r14
je 0x140259ce8
add r14, r14
mov r8d, 2
mov rcx, rbx
mov rdx, r14
call fcn.140115a00
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x140259d02
add rdx, rdx
mov r8d, 2
mov rcx, r15
call fcn.140115a00
test rdi, rdi
jne 0x140259d2e
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
test r14, r14
jne 0x140259cd4
jmp 0x140259ce8
mov qword [rbp + 0x28], rdi
lea rax, [rbp - 0x18]
mov qword [rbp - 8], rax
lea rax, [0x14025abf0]
mov qword [rbp], rax
lea rcx, [rbp - 0x28]
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp + 0x18], rax
lea rax, [fcn.14025b960]
mov qword [rbp + 0x20], rax
lea rax, [0x1405258b8]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 3
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 3
lea rdx, str.library_std_srcenv.rsfailed_to_set_environment_variable____to___:
lea rcx, [rbp - 0x58]
call fcn.140299e90
ud2
Function at 0x14025ad90
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x14025ada0
mov rcx, rdx
mov rdx, r8
jmp fcn.14025adb0
mov rcx, rdx
mov rdx, r8
jmp fcn.140265cc0

Function at 0x140261920
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.140286de0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x140268480]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
mov r8d, 0x1000
mov rcx, r15
mov rdx, r12
call case.0x14025e91d.287
mov r15, rdx
mov qword [rbp + 0xfd8], rax
mov qword [rbp + 0xfe0], rdx
test rax, rax
jne 0x140261b10
test r15, r15
je 0x140261adc
cmp r15, 0x1000
ja 0x140261b32
xor r12d, r12d
nop word cs:[rax + rax]
mov r8d, r15d
sub r8d, r12d
lea rdx, [r12 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r13
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbp + 0x1008]
mov r9, r14
call rsi
test eax, eax
je 0x140261ab0
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x140261a40
mov ecx, dword [rbp + 0x1000]
mov eax, dword [rbp + 0x1004]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xfe8], r8
mov qword [rbp + 0xff0], rdx
jne 0x140261ad0
add r12, rax
cmp r12, r15
je 0x140261aa0
jbe 0x1402619f0
jmp 0x140261b1e
mov r15, qword [rbp + 0x1010]
lea r12, [rbp - 0x50]
jmp 0x14026199e
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe8], 1
mov qword [rbp + 0xff0], rax
lea rcx, [rbp + 0xff0]
call fcn.140252480
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xfe0]
call fcn.140252480
jmp 0x140261adc
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.14029a3b0
jmp 0x140261b46
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.14029a3a0
ud2
Function at 0x140265cc0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.14026f1f0
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140265d25
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.140270c60
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rdi, rbx
jne 0x140265d30
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140265d5c
test rdi, rdi
je 0x140265d88
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140115a00
xor eax, eax
jmp 0x140265d28
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x140265d28
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.140115a00
jmp 0x140265d25
xor eax, eax
jmp 0x140265d28

Function at 0x140266810
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x1405272c8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140266848
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1402668aa
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1402668b5
xor edx, edx
jmp 0x1402668c5
cmp eax, 0x103
je 0x1402668f0
test eax, eax
js 0x1402668d0
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.14025d230
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.140252d80
mov ecx, 7
int 0x29
ud2