joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000427d
Capabilities:
Query environment variable

Disassembly:
jmp 0x140087890
sub rsp, 0x138
mov edx, dword [0x14018d9b0]
or edx, dword [0x14018d9b4]
or edx, dword [0x14018d9a8]
mov rax, qword [0x14016fb98]
xor rax, rsp
mov qword [rsp + 0x128], rax
or edx, dword [0x14018d9ac]
jne 0x140087ad9
lea rcx, str.FORT_BLOCKSIZE
lea rdx, [rsp + 0x24]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
je 0x1400878fc
cmp rax, 0x104
jae 0x1400878f5
inc rax
je 0x140087903
jmp 0x14008790f
mov byte [rsp + 0x24], 0
jmp 0x14008790f
mov byte [rsp + 0x24], 0
jne 0x14008790f
mov dword [0x14018d9b0], 0xffffffff
jmp 0x140087958
dec rax
lea rcx, [rsp + 0x24]
mov edx, eax
mov r8d, 2
lea r9, [rsp + 0x20]
call fcn.14000445d
test eax, eax
jne 0x14008793c
mov eax, dword [rsp + 0x20]
test eax, eax
jl 0x14008793c
cmp eax, 0x7fffc000
jle 0x140087948
mov dword [0x14018d9b0], 0xfffffffe
jmp 0x140087958
add eax, 0x1ff
and eax, 0xfffffe00
mov dword [0x14018d9b0], eax
lea rcx, str.FORT_BUFFERCOUNT
lea rdx, [rsp + 0x24]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
je 0x14008798d
cmp rax, 0x104
jae 0x140087986
inc rax
je 0x140087994
jmp 0x1400879a0
mov byte [rsp + 0x24], 0
jmp 0x1400879a0
mov byte [rsp + 0x24], 0
jne 0x1400879a0
mov dword [0x14018d9b4], 0xffffffff
jmp 0x1400879d9
dec rax
lea rcx, [rsp + 0x24]
mov edx, eax
mov r8d, 2
lea r9, [rsp + 0x20]
call fcn.14000445d
test eax, eax
jne 0x1400879c7
mov eax, dword [rsp + 0x20]
cmp eax, 0x7f
jbe 0x1400879d3
mov dword [0x14018d9b4], 0xfffffffe
jmp 0x1400879d9
mov dword [0x14018d9b4], eax
lea rcx, str.FORT_FMT_RECL
lea rdx, [rsp + 0x24]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
je 0x140087a0e
cmp rax, 0x104
jae 0x140087a07
inc rax
je 0x140087a15
jmp 0x140087a21
mov byte [rsp + 0x24], 0
jmp 0x140087a21
mov byte [rsp + 0x24], 0
jne 0x140087a21
mov dword [0x14018d9a8], 0xffffffff
jmp 0x140087a59
dec rax
lea rcx, [rsp + 0x24]
mov edx, eax
mov r8d, 2
lea r9, [rsp + 0x20]
call fcn.14000445d
test eax, eax
jne 0x140087a4f
mov eax, dword [rsp + 0x20]
test eax, eax
jl 0x140087a4f
mov dword [0x14018d9a8], eax
jmp 0x140087a59
mov dword [0x14018d9a8], 0xfffffffe
lea rcx, str.FORT_UFMT_RECL
lea rdx, [rsp + 0x24]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
je 0x140087a8e
cmp rax, 0x104
jae 0x140087a87
inc rax
je 0x140087a95
jmp 0x140087aa1
mov byte [rsp + 0x24], 0
jmp 0x140087aa1
mov byte [rsp + 0x24], 0
jne 0x140087aa1
mov dword [0x14018d9ac], 0xffffffff
jmp 0x140087ad9
dec rax
lea rcx, [rsp + 0x24]
mov edx, eax
mov r8d, 2
lea r9, [rsp + 0x20]
call fcn.14000445d
test eax, eax
jne 0x140087acf
mov eax, dword [rsp + 0x20]
test eax, eax
jl 0x140087acf
mov dword [0x14018d9ac], eax
jmp 0x140087ad9
mov dword [0x14018d9ac], 0xfffffffe
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x140087af5
add rsp, 0x138
ret
call fcn.140003bcf
nop
nop dword [rax + rax]
int3
Function at 0x140014e50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140014e50
push r14
push r15
push rbp
sub rsp, 0x30
mov r15, rcx
mov qword [rsp + 0x28], 0
mov r14d, 1
xor ebp, ebp
lea rdx, [0x1401719d0]
mov eax, 1
xchg dword [rdx], eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140014eb5
mov eax, 0x66666667
imul r14d
sar edx, 2
lea r8d, [rdx + rdx*4]
add r8d, r8d
cmp r8d, r14d
jne 0x140014eb5
mov eax, 1
cmp r14d, 0x2710
cmovg ebp, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140014ec9
inc r14d
cmp r14d, 0x7ffffff
jl 0x140014e6d
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140014ee3
mov dword [rsp + 0x20], 0x98
lea rcx, [rsp + 0x20]
call fcn.140001974
mov eax, dword [0x1401719d4]
test eax, eax
jne 0x140014f16
cmp dword [0x14016d170], 1
je 0x140015010
call fcn.1400150c0
mov dword [0x1401719d4], 1
cmp dword [0x14016d170], 1
je 0x140014ff1
mov ecx, dword [0x1401719cc]
mov dword [0x1401719d0], 0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014f40
mov qword [r15], rax
xor eax, eax
add rsp, 0x30
pop rbp
pop r15
pop r14
ret
mov ecx, 0x88
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
call fcn.140003fc1
test eax, eax
je 0x140014f6b
mov qword [r15], 0
add rsp, 0x30
pop rbp
pop r15
pop r14
ret
mov r9, qword [rsp + 0x28]
mov r8d, 0x80
mov rax, qword [0x14016d120]
mov qword [r9 + 0x80], rax
lea rax, [0x140000000]
mov rdx, rax
mov rcx, rax
mov rbp, rax
movups xmm0, xmmword [rax + r8 + 0x16d090]
movups xmmword [r9 + r8 - 0x10], xmm0
movups xmm1, xmmword [rdx + r8 + 0x16d080]
movups xmmword [r9 + r8 - 0x20], xmm1
movups xmm2, xmmword [rcx + r8 + 0x16d070]
movups xmmword [r9 + r8 - 0x30], xmm2
movups xmm3, xmmword [rbp + r8 + 0x16d060]
movups xmmword [r9 + r8 - 0x40], xmm3
sub r8, 0x40
jne 0x140014f84
mov rdx, qword [rsp + 0x28]
mov ecx, dword [0x1401719cc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [rsp + 0x28]
jmp 0x140014f31
mov ecx, 2
mov rdx, rbp
call fcn.1400028ba
mov ecx, 0x16
mov rdx, r14
call fcn.1400028ba
jmp 0x140014f16
mov ecx, 2
mov edx, 1
call fcn.1400028ba
mov rbp, rax
mov ecx, 0x16
mov edx, 1
call fcn.1400028ba
mov r14, rax
jmp 0x140014efa

Function at 0x1400150c0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
cmp dword [0x1401719c0], 0
jne 0x1400150f3
mov dword [0x1401719c0], 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1401719cc], eax
cmp eax, 0xffffffff
jne 0x1400150f8
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
add rsp, 0x28
ret
lea rcx, [0x140003c0b]
call fcn.140002969
lea rcx, [0x140002c07]
call fcn.140002969
add rsp, 0x28
ret
Function at 0x140015140
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x140015140
push r14
push r15
push rbp
sub rsp, 0x30
mov rbp, rcx
mov qword [rsp + 0x28], 0
mov r15d, 1
xor r14d, r14d
lea rdx, [0x1401719d0]
mov eax, 1
xchg dword [rdx], eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1400151a8
mov eax, 0x66666667
imul r15d
sar edx, 2
lea r8d, [rdx + rdx*4]
add r8d, r8d
cmp r8d, r15d
jne 0x1400151a8
mov eax, 1
cmp r15d, 0x2710
cmovg r14d, eax
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1400151bc
inc r15d
cmp r15d, 0x7ffffff
jl 0x14001515e
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1400151d6
mov dword [rsp + 0x20], 0x98
lea rcx, [rsp + 0x20]
call fcn.140001974
mov eax, dword [0x1401719d4]
test eax, eax
jne 0x140015209
cmp dword [0x14016d170], 1
je 0x140015339
call fcn.1400150c0
mov dword [0x1401719d4], 1
cmp dword [0x14016d170], 1
je 0x14001531a
mov ecx, dword [0x1401719cc]
mov dword [0x1401719d0], 0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov qword [rsp + 0x28], r14
test r14, r14
je 0x14001526d
mov qword [rbp], r14
cmp dword [0x14016d170], 1
je 0x140015245
xor eax, eax
add rsp, 0x30
pop rbp
pop r15
pop r14
ret
mov ecx, 2
mov edx, 1
call fcn.1400028ba
mov ecx, 0x16
mov edx, 1
mov qword [r14 + 0x68], rax
call fcn.1400028ba
mov qword [r14 + 0x70], rax
jmp 0x140015239
mov ecx, 0x88
xor edx, edx
lea r8, [rsp + 0x28]
call fcn.140003fc1
test eax, eax
je 0x140015294
mov qword [rbp], 0
add rsp, 0x30
pop rbp
pop r15
pop r14
ret
mov r10, qword [rsp + 0x28]
mov r9d, 0x80
mov rax, qword [0x14016d120]
mov qword [r10 + 0x80], rax
lea rax, [0x140000000]
mov rdx, rax
mov rcx, rax
mov r8, rax
movups xmm0, xmmword [rax + r9 + 0x16d090]
movups xmmword [r10 + r9 - 0x10], xmm0
movups xmm1, xmmword [rdx + r9 + 0x16d080]
movups xmmword [r10 + r9 - 0x20], xmm1
movups xmm2, xmmword [rcx + r9 + 0x16d070]
movups xmmword [r10 + r9 - 0x30], xmm2
movups xmm3, xmmword [r8 + r9 + 0x16d060]
movups xmmword [r10 + r9 - 0x40], xmm3
sub r9, 0x40
jne 0x1400152ad
mov rdx, qword [rsp + 0x28]
mov ecx, dword [0x1401719cc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r14, qword [rsp + 0x28]
jmp 0x14001522c
mov ecx, 2
mov rdx, r14
call fcn.1400028ba
mov ecx, 0x16
mov rdx, r15
call fcn.1400028ba
jmp 0x140015209
mov ecx, 2
mov edx, 1
call fcn.1400028ba
mov r14, rax
mov ecx, 0x16
mov edx, 1
call fcn.1400028ba
mov r15, rax
jmp 0x1400151ed
Function at 0x140025c10
Capabilities:
Query environment variable

Disassembly:
push r12
sub rsp, 0x130
lea rcx, [0x140171c70]
mov rax, qword [0x14016fb98]
xor rax, rsp
mov qword [rsp + 0x128], rax
call fcn.140003788
mov eax, dword [0x140171c74]
test eax, eax
jne 0x140025cb3
lea rcx, str.FORT0
lea rdx, [rsp + 0x20]
mov r8d, 0x105
mov dword [0x140171c74], 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
jbe 0x140025c78
cmp rax, 0x105
jae 0x140025c78
mov al, byte [rsp + 0x20]
jmp 0x140025c7f
mov byte [rsp + 0x20], 0
xor al, al
test al, al
je 0x140025cb3
cmp qword [0x14016fbe0], 0
je 0x140025ce0
mov r12, qword [0x14016feb0]
mov rax, qword [0x14016fc10]
call rax
add rax, 0x60
lea rcx, [rsp + 0x20]
lea rdx, [0x140149420]
mov r8, rax
call r12
mov dword [0x140171c70], 0
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x140025cdb
add rsp, 0x130
pop r12
ret
call fcn.140003bcf
call fcn.140002eb4
mov r12, qword [0x14016feb0]
cmp qword [0x14016fbe0], 0
jne 0x140025c94
call fcn.140002eb4
jmp 0x140025c94
Function at 0x140038050
Capabilities:
Query environment variable

Disassembly:
jmp 0x140038050
push r12
sub rsp, 0x140
xor r12d, r12d
mov rax, qword [0x14016fb98]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rcx, rcx
je 0x14003816c
mov r8d, 0x105
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
jbe 0x1400380a5
cmp rax, 0x105
jae 0x14003809c
inc rax
jmp 0x1400380aa
mov byte [rsp + 0x2c], 0
xor ecx, ecx
jmp 0x1400380b4
mov byte [rsp + 0x2c], 0
test rax, rax
je 0x1400380f7
movsx ecx, byte [rsp + 0x2c]
test ecx, ecx
je 0x1400380f7
call fcn.140001d6b
movsx rdx, al
cmp edx, 0x74
je 0x140038158
cmp edx, 0x79
je 0x140038158
mov qword [rsp + 0x20], rbx
lea rax, [rsp + 0x2c]
mov rbx, rax
jmp 0x1400380e5
inc rbx
movsx ecx, byte [rbx]
test ecx, ecx
je 0x14003811f
call fcn.1400037f6
test eax, eax
je 0x140038118
jmp 0x1400380e2
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x140038167
mov eax, r12d
add rsp, 0x140
pop r12
ret
mov rbx, qword [rsp + 0x20]
jmp 0x1400380f7
mov rbx, qword [rsp + 0x20]
mov dword [rsp + 0x28], 0
cmp qword [0x14016fbe0], 0
je 0x140038160
mov r9, qword [0x14016fce0]
lea rdx, [0x14014a838]
lea rcx, [rsp + 0x2c]
lea r8, [rsp + 0x28]
call r9
cmp dword [rsp + 0x28], 0
je 0x1400380f7
mov r12d, 1
jmp 0x1400380f7
call fcn.140002eb4
jmp 0x140038136
call fcn.140003bcf
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x140038167
xor eax, eax
add rsp, 0x140
pop r12
ret
Function at 0x140048700
Capabilities:
Query environment variable

Disassembly:
jmp 0x140048700
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov r14d, r9d
mov r13d, r8d
mov r15d, edx
mov r12, rcx
mov eax, 0x190
pxor xmm0, xmm0
movups xmmword [rsp + rax + 0x10], xmm0
movups xmmword [rsp + rax], xmm0
movups xmmword [rsp + rax - 0x10], xmm0
movups xmmword [rsp + rax - 0x20], xmm0
movups xmmword [rsp + rax - 0x30], xmm0
sub rax, 0x50
jne 0x140048727
lea rcx, str.FOR_TYPE
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
lea rcx, str.FOR_PRINT
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
lea rcx, str.FOR_ACCEPT
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
lea rcx, str.FOR_READ
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r9d, eax
mov r10b, byte [r12 + 0x279]
mov al, r10b
and al, 0x18
shr al, 3
je 0x140048903
cmp al, 2
je 0x140048ab7
mov ecx, dword [r12 + 0x1d0]
add ecx, 4
cmp ecx, 0xa
ja 0x1400487f5
lea r8, [0x140000000]
movzx eax, word [r8 + rcx*2 + 0x14c07c]
lea rax, [r8 + rax + 0x487de]
jmp rax
mov ecx, 8
mov edx, 2
lea r8, str.for_open.c
mov r9d, 0x4ba
call fcn.1400035df
jmp 0x140048903
test byte [r12 + 0x27c], 0x10
jne 0x140048936
jmp 0x140048971
mov rax, qword [r12 + 0x1c8]
mov rcx, qword [r12 + 0x180]
mov rbx, qword [r12 + 0xb0]
movsx rsi, byte [r12 + 0x269]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rsi
movsxd r14, r14d
movsxd r15, r15d
movsxd r13, r13d
mov qword [rsp + 0x20], r15
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x120], 1
cmp r14d, 1
je 0x1400489c8
jmp 0x140048a97
mov al, byte [r12 + 0x26b]
test al, al
je 0x1400489f8
cmp al, 0x27
jne 0x1400489e6
mov qword [rsp + 0x100], 1
jmp 0x140048a04
cmp al, 0x22
jne 0x140048a04
mov qword [rsp + 0x100], 3
jmp 0x140048a04
mov qword [rsp + 0x100], 2
test byte [r12 + 0x27b], 0x20
je 0x140048a1a
mov qword [rsp + 0x38], 2
jmp 0x140048a23
mov qword [rsp + 0x38], 0
test byte [r12 + 0x27e], 2
jne 0x140048a39
test byte [r12 + 0x278], 2
je 0x140048a47
mov qword [rsp + 0x108], 2
jmp 0x140048a53
mov qword [rsp + 0x108], 1
movzx eax, byte [r12 + 0x271]
movzx ecx, byte [r12 + 0x273]
movzx ebx, byte [r12 + 0x275]
movzx esi, byte [r12 + 0x277]
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], rsi
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.1400026d5
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp r15d, 0xffffffff
jne 0x140048903
xor eax, eax
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004bd60
Capabilities:
Clear file content

Disassembly:
jmp 0x14004bd60
push rbx
push rbp
sub rsp, 0x38
mov rbp, rcx
mov rax, qword [rbp + 0x80]
mov rbx, qword [rbp + 0x78]
test rax, rax
je 0x14004bd7e
sub rbx, rax
jmp 0x14004bd85
mov rax, qword [rbp + 0x70]
sub rbx, rax
lea rax, [rbx + 4]
cmp rax, qword [rbp + 0x1a8]
ja 0x14004c2b7
movzx eax, word [rbp + 0x264]
test eax, eax
jg 0x14004c01b
movsx edx, byte [rbp + 0x266]
cmp edx, 8
ja 0x14004bfa0
lea r10, [0x140000000]
movzx eax, word [r10 + rdx*2 + 0x14c9b4]
lea rax, [r10 + rax + 0x4bdcf]
jmp rax
mov ecx, 8
mov edx, 2
lea r8, str.for_put.c
mov r9d, 0x31d
call fcn.1400035df
mov rdx, qword [rbp + 0x80]
test rdx, rdx
je 0x14004c28f
mov rcx, rbp
mov r8, rbx
call fcn.140002469
and byte [rbp + 0x27c], 0xbf
cmp eax, 0xffffffff
je 0x14004c277
test byte [rbp + 0x27d], 8
je 0x14004c03f
mov rcx, qword [rbp + 0x198]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14004c261
and byte [rbp + 0x27d], 0xf7
test ebx, ebx
je 0x14004c03f
mov eax, ebx
add rsp, 0x38
pop rbp
pop rbx
ret
mov rdx, qword [rbp + 0x80]
test rdx, rdx
je 0x14004c2a3
mov rcx, rbp
mov r8, rbx
call fcn.140002469
cmp eax, 0xffffffff
je 0x14004c277
xor eax, eax
add rsp, 0x38
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1a0], eax
mov ebx, 0x26
jmp 0x14004c007
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1a0], eax
mov eax, 0x26
add rsp, 0x38
pop rbp
pop rbx
ret
mov rcx, rbp
mov r8, rbx
mov rdx, qword [rbp + 0x70]
call fcn.140002469
jmp 0x14004bfd7
mov rcx, rbp
mov r8, rbx
mov rdx, qword [rbp + 0x70]
call fcn.140002469
jmp 0x14004c036
mov rcx, rbp
mov edx, 0x200
call fcn.14000155a
test eax, eax
je 0x14004bd96
mov rcx, rbp
mov edx, 4
call fcn.14000155a
test eax, eax
je 0x14004bd96
cmp rbx, qword [rbp + 0x1a8]
ja 0x14004c2f7
cmp byte [rbp + 0x266], 1
je 0x14004bd96
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x14004c36a
test byte [rax + 0x74], 2
je 0x14004c33a
mov edx, 0x42
mov dword [rax + 0x68], edx
mov rax, qword [rbp + 0x30]
mov dword [rax + 0x6c], edx
mov rax, qword [rbp + 0xd0]
test rax, rax
je 0x14004c32e
xor edx, edx
mov qword [rax + 8], rdx
mov qword [rbp + 0xd0], rdx
mov eax, 0x42
add rsp, 0x38
pop rbp
pop rbx
ret
mov rax, rsp
mov rcx, rbp
movzx r8d, byte [rbp + 0x27c]
mov edx, 0xffffffff
and r8d, 7
mov r9d, 0x42
mov dword [rax + 0x20], 0x42
call fcn.140001447
add rsp, 0x38
pop rbp
pop rbx
ret
mov edx, 0x42
mov ecx, 1
mov r8d, edx
mov r9, rbp
call fcn.1400026fd
add rsp, 0x38
pop rbp
pop rbx
ret
Function at 0x140087530
Capabilities:
Query environment variable

Disassembly:
jmp 0x140087530
push rsi
push rdi
sub rsp, 0x48
mov edx, 0xfffffffc
mov rax, qword [0x14016fb98]
lea r8, [0x14018d9e0]
xor rax, rsp
mov r9d, 0xfffffffd
mov qword [rsp + 0x40], rax
lea r11, [0x14018dc80]
mov cl, byte [0x14018dc59]
mov eax, 0xffffffff
mov dword [0x14018dbb0], edx
and cl, 0xe7
mov dword [0x14018da20], edx
add cl, 8
mov r10b, byte [0x14018def9]
mov esi, 0xfffffffe
mov dl, byte [0x14018e199]
and r10b, 0xe7
mov dil, byte [0x14018e439]
and dl, 0xe7
and dil, 0xe7
add r10b, 8
add dl, 8
add dil, 8
mov byte [0x14018dc59], cl
lea rcx, [0x14018df20]
mov qword [0x14017ba18], r8
mov qword [0x140191b50], r8
lea r8, [0x14018e1c0]
mov dword [0x14018de50], r9d
mov dword [0x14018dcc0], r9d
mov byte [0x14018def9], r10b
mov qword [0x14017ba50], r11
mov qword [0x140191b58], r11
mov dword [0x14018e0f0], eax
mov dword [0x14018df60], eax
mov byte [0x14018e199], dl
mov qword [0x14017bac0], rcx
mov qword [0x140191b68], rcx
mov dword [0x14018e390], esi
mov dword [0x14018e200], esi
mov byte [0x14018e439], dil
mov qword [0x14017ba88], r8
mov qword [0x140191b60], r8
cmp qword [0x14016fbe0], 0
je 0x1400877cc
lea rdi, [0x14016fcc0]
mov rax, qword [rdi]
lea rdx, str.FORT_d
lea rcx, [rsp + 0x20]
xor r8d, r8d
call rax
xor eax, eax
lea rcx, [rsp + 0x20]
xor edx, edx
xor r8d, r8d
mov dword [0x14018e630], eax
mov dword [0x14018e4a0], eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, 8
test eax, eax
mov eax, 0x10
lea rcx, [0x14018e460]
movzx edx, byte [0x14018e6d9]
cmove eax, esi
and edx, 0xffffffe7
or edx, eax
mov byte [0x14018e6d9], dl
mov qword [0x14017baf8], rcx
mov qword [0x140191b70], rcx
cmp qword [0x14016fbe0], 0
je 0x1400877c2
mov rax, qword [rdi]
lea rdx, str.FORT_d
lea rcx, [rsp + 0x20]
mov r8d, 5
call rax
xor edx, edx
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov eax, 5
mov dword [0x14018e8d0], eax
mov dword [0x14018e740], eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
mov eax, 0x10
movzx edx, byte [0x14018e979]
lea rcx, [0x14018e700]
cmove eax, esi
and edx, 0xffffffe7
or edx, eax
mov byte [0x14018e979], dl
mov qword [0x14017bc10], rcx
mov qword [0x140191b98], rcx
cmp qword [0x14016fbe0], 0
je 0x1400877b8
mov rax, qword [rdi]
lea rdx, str.FORT_d
lea rcx, [rsp + 0x20]
mov r8d, 6
call rax
xor edx, edx
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov eax, 6
mov dword [0x14018eb70], eax
mov dword [0x14018e9e0], eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
mov eax, 0x10
movzx edx, byte [0x14018ec19]
lea rcx, [0x14018e9a0]
cmove eax, esi
and edx, 0xffffffe7
or edx, eax
mov byte [0x14018ec19], dl
mov qword [0x14017bc48], rcx
mov qword [0x140191ba0], rcx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x1400877b3
add rsp, 0x48
pop rdi
pop rsi
ret
call fcn.140003bcf
call fcn.140002eb4
jmp 0x140087732
call fcn.140002eb4
jmp 0x1400876bb
call fcn.140002eb4
jmp 0x14008763e
Function at 0x140087890
Capabilities:
Query environment variable

Disassembly:
jmp 0x140087890
sub rsp, 0x138
mov edx, dword [0x14018d9b0]
or edx, dword [0x14018d9b4]
or edx, dword [0x14018d9a8]
mov rax, qword [0x14016fb98]
xor rax, rsp
mov qword [rsp + 0x128], rax
or edx, dword [0x14018d9ac]
jne 0x140087ad9
lea rcx, str.FORT_BLOCKSIZE
lea rdx, [rsp + 0x24]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
je 0x1400878fc
cmp rax, 0x104
jae 0x1400878f5
inc rax
je 0x140087903
jmp 0x14008790f
mov byte [rsp + 0x24], 0
jmp 0x14008790f
mov byte [rsp + 0x24], 0
jne 0x14008790f
mov dword [0x14018d9b0], 0xffffffff
jmp 0x140087958
dec rax
lea rcx, [rsp + 0x24]
mov edx, eax
mov r8d, 2
lea r9, [rsp + 0x20]
call fcn.14000445d
test eax, eax
jne 0x14008793c
mov eax, dword [rsp + 0x20]
test eax, eax
jl 0x14008793c
cmp eax, 0x7fffc000
jle 0x140087948
mov dword [0x14018d9b0], 0xfffffffe
jmp 0x140087958
add eax, 0x1ff
and eax, 0xfffffe00
mov dword [0x14018d9b0], eax
lea rcx, str.FORT_BUFFERCOUNT
lea rdx, [rsp + 0x24]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
je 0x14008798d
cmp rax, 0x104
jae 0x140087986
inc rax
je 0x140087994
jmp 0x1400879a0
mov byte [rsp + 0x24], 0
jmp 0x1400879a0
mov byte [rsp + 0x24], 0
jne 0x1400879a0
mov dword [0x14018d9b4], 0xffffffff
jmp 0x1400879d9
dec rax
lea rcx, [rsp + 0x24]
mov edx, eax
mov r8d, 2
lea r9, [rsp + 0x20]
call fcn.14000445d
test eax, eax
jne 0x1400879c7
mov eax, dword [rsp + 0x20]
cmp eax, 0x7f
jbe 0x1400879d3
mov dword [0x14018d9b4], 0xfffffffe
jmp 0x1400879d9
mov dword [0x14018d9b4], eax
lea rcx, str.FORT_FMT_RECL
lea rdx, [rsp + 0x24]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
je 0x140087a0e
cmp rax, 0x104
jae 0x140087a07
inc rax
je 0x140087a15
jmp 0x140087a21
mov byte [rsp + 0x24], 0
jmp 0x140087a21
mov byte [rsp + 0x24], 0
jne 0x140087a21
mov dword [0x14018d9a8], 0xffffffff
jmp 0x140087a59
dec rax
lea rcx, [rsp + 0x24]
mov edx, eax
mov r8d, 2
lea r9, [rsp + 0x20]
call fcn.14000445d
test eax, eax
jne 0x140087a4f
mov eax, dword [rsp + 0x20]
test eax, eax
jl 0x140087a4f
mov dword [0x14018d9a8], eax
jmp 0x140087a59
mov dword [0x14018d9a8], 0xfffffffe
lea rcx, str.FORT_UFMT_RECL
lea rdx, [rsp + 0x24]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
je 0x140087a8e
cmp rax, 0x104
jae 0x140087a87
inc rax
je 0x140087a95
jmp 0x140087aa1
mov byte [rsp + 0x24], 0
jmp 0x140087aa1
mov byte [rsp + 0x24], 0
jne 0x140087aa1
mov dword [0x14018d9ac], 0xffffffff
jmp 0x140087ad9
dec rax
lea rcx, [rsp + 0x24]
mov edx, eax
mov r8d, 2
lea r9, [rsp + 0x20]
call fcn.14000445d
test eax, eax
jne 0x140087acf
mov eax, dword [rsp + 0x20]
test eax, eax
jl 0x140087acf
mov dword [0x14018d9ac], eax
jmp 0x140087ad9
mov dword [0x14018d9ac], 0xfffffffe
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x140087af5
add rsp, 0x138
ret
call fcn.140003bcf
nop
nop dword [rax + rax]
int3