joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007710
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov dword [rsp + 0x60], 4
mov rdi, rcx
lea rax, [rsp + 0x68]
lea rdx, str.SoftwareAMDEEU
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140007795
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140007783
lea r9, str.SoftwareAMDEEU
mov dword [rsp + 0x20], eax
lea r8, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s_with_error_code_0x_08x.
lea edx, [rbx + 7]
call fcn.140006ae0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r9d, 0x10
mov qword [rsp + 0x28], rsi
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x1400077f5
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x1400077f3
mov dword [rsp + 0x28], eax
lea r8, str.ReadRegKey_RegGetValue_failed_for_value___s_and_ulSize___d_with_error_code_0x_08x.
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov edx, 8
mov dword [rsp + 0x20], eax
call fcn.140006ae0
xor ebx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140007820
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x14000786c
sub r9d, edi
je 0x140007865
sub r9d, edi
je 0x14000785e
cmp r9d, edi
je 0x140007857
mov ebx, edi
jmp 0x140007871
mov ebx, 0x20
jmp 0x140007871
mov ebx, 2
jmp 0x140007871
mov ebx, 8
jmp 0x140007871
mov ebx, 0x10
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400078b6
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x1400078b2
mov r9, rsi
mov dword [rsp + 0x20], eax
lea r8, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140006ae0
xor eax, eax
jmp 0x140007935
mov rax, qword [rsp + 0x80]
mov r9d, ebx
mov rsi, qword [rsp + 0x88]
mov r8, rbp
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov edx, eax
test eax, eax
je 0x140007928
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140007926
mov eax, 0xffffffff
test rsi, rsi
je 0x14000790a
mov eax, dword [rsi]
mov dword [rsp + 0x28], edx
lea r8, str.ReadRegKey_RegGetValue_failed_for_value___s_and_ulSize___d_with_error_code_0x_08x.
mov edx, 8
mov dword [rsp + 0x20], eax
mov r9, rbp
call fcn.140006ae0
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140007cb0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x140007ced
sub r9d, edi
je 0x140007ce6
cmp r9d, edi
je 0x140007ce2
xor ebx, ebx
jmp 0x140007cf2
mov ebx, edi
jmp 0x140007cf2
mov ebx, 3
jmp 0x140007cf2
mov ebx, 4
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140007d56
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140007d52
mov r9, rsi
mov dword [rsp + 0x20], eax
lea r8, str.WriteRegKey_RegCreateKeyEx_failed_for_pcPath___s_with_error_code_0x_08x.
mov edx, 8
call fcn.140006ae0
xor eax, eax
jmp 0x140007dbd
mov rax, qword [rsp + 0x90]
mov r9d, ebx
mov esi, dword [rsp + 0x98]
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140007db0
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140007dae
mov dword [rsp + 0x28], eax
lea r8, str.WriteRegKey_RegSetValueEx_failed_for_value___s_and_ulSize___d_with_error_code_0x_08x.
mov r9, rbp
mov dword [rsp + 0x20], esi
mov edx, 8
call fcn.140006ae0
xor edi, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140007de0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x28], 0
lea rax, [r11 - 0x18]
mov qword [r11 - 0x30], rax
mov rbp, r9
mov qword [r11 - 0x38], 0
mov rsi, r8
mov dword [rsp + 0x28], 0x20006
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov rdi, rdx
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140007e60
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140007e5c
mov r9, rdi
mov dword [rsp + 0x20], eax
lea r8, str.WriteUCODEStringRegKey_RegCreateKeyEx_failed_for_pcPath___s_with_error_code_0x_08x.
lea edx, [rbx + 7]
call fcn.140006ae0
xor eax, eax
jmp 0x140007ebf
mov edi, dword [rsp + 0x90]
mov r9d, ebx
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140007eb2
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140007eb0
mov dword [rsp + 0x28], eax
lea r8, str.WriteUCODEStringRegKey_RegSetValueExW_failed_for_value___s_and_ulSize___d_with_error_code_0x_08x.
mov r9, rsi
mov dword [rsp + 0x20], edi
mov edx, 8
call fcn.140006ae0
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140009d60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x140009d8a
mov edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi], rax
test rdi, rdi
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140009dd0
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
test rcx, rcx
jne 0x140009e02
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140009e35
lea r8, str.ConnectPipe_hPipe_.
mov edx, 1
call fcn.140006ca0
xor eax, eax
add rsp, 0x28
ret
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x140009e3c
lea rcx, [rsp + 0x30]
call fcn.140007ee0
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140009e35
lea r8, str.Client_failed_to_connect.
mov edx, 1
call fcn.140006ca0
xor eax, eax
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret

Function at 0x140009e50
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, rcx
test rcx, rcx
jne 0x140009e76
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140009ee0
lea r8, str.CreatePipe_Empty_Pipe_Name.
jmp 0x140009ed6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140007f10
mov edx, 3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 0x2c
lea r9d, [rdx + 0x1b]
mov dword [rsp + 0x20], 0x620
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
jne 0x140009ee2
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140009ee0
lea r8, str.Invalid_handle_to_pipe.
mov edx, 1
call fcn.140006ca0
xor eax, eax
add rsp, 0x80
pop rbx
ret

Function at 0x140009ef0
Capabilities:
Print debug messages

Disassembly:
test rcx, rcx
jne 0x140009f12
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140009f19
lea r8, str.DisconnectPipe_hPipe_is_NULL.
mov edx, 1
jmp fcn.140006ca0
jmp qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
ret

Function at 0x140009f30
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, 0x620
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140009f66
cmp dword [rsp + 0x50], 0x620
jne 0x140009f66
mov eax, 1
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x140009f89
lea r8, str.ReadPipe_ReadFile_failed.
mov edx, 1
call fcn.140006ae0
xor eax, eax
add rsp, 0x38
ret

Function at 0x140009fe0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, 0x2c
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000a013
cmp dword [rsp + 0x50], 0x2c
jne 0x14000a013
mov eax, 1
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14008fd90]
test rcx, rcx
je 0x14000a039
mov r9d, eax
lea r8, str.WritePipe_Failed._Error_Mesg:___d
mov edx, 1
call fcn.140006ca0
xor eax, eax
add rsp, 0x38
ret
Function at 0x14000d240
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
lea rdx, str.agfb_0x_x
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
mov r8d, eax
movups xmmword [rsp + 0x20], xmm0
call fcn.140002b10
lea r8, [rsp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x14000d2a1
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000d2a9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x14000d800
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov byte [rdx], 0
mov rdi, rdx
cmp byte [0x14008fe2c], 0
mov rbx, rcx
je 0x14000d87d
mov r9, rcx
mov qword [rsp + 0x28], 0
xor ecx, ecx
mov dword [rsp + 0x20], 0
lea r8, [0x14000d2c0]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14000d872
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx + 0x24]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [0x14008fe10]
test rax, rax
jne 0x14000d8d8
call fcn.140011370
mov rdx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000d8be
mov qword [0x14008fe10], rax
mov byte [rdi], 1
mov rax, qword [0x14008fe10]
mov qword [rbx + 0x24], rax
mov rax, rdx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [0x14008fe10]
xor edx, edx
mov qword [rbx + 0x24], rax
mov eax, edx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov qword [rbx + 0x24], rax
mov rdx, rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140011410
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, [0x140077698]
mov byte [rcx + 8], 0
mov qword [rcx], rax
mov rbx, rcx
xor edi, edi
mov qword [rcx + 0x10], rdi
lea rcx, str.gdi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140011548
lea rdx, str.D3DKMTCloseAdapter
mov qword [rbx + 0x18], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.D3DKMTEnumAdapters
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.D3DKMTEscape
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.D3DKMTInvalidateActiveVidPn
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.D3DKMTOpenAdapterFromDeviceName
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.D3DKMTOpenAdapterFromHdc
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.D3DKMTOpenAdapterFromGdiDisplayName
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.D3DKMTOpenAdapterFromLuid
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.D3DKMTPollDisplayChildren
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.D3DKMTQueryAdapterInfo
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
mov byte [rbx + 8], 1
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140012110
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x140012168
sub r9d, edi
je 0x140012161
sub r9d, edi
je 0x14001215a
sub r9d, edi
je 0x140012153
cmp r9d, edi
je 0x14001214c
mov ebx, edi
jmp 0x14001216d
mov ebx, 0xffff
jmp 0x14001216d
mov ebx, 0x40
jmp 0x14001216d
mov ebx, 2
jmp 0x14001216d
mov ebx, 8
jmp 0x14001216d
mov ebx, 0x10
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14001219d
mov rdx, rsi
lea rcx, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s.
call fcn.1400125e0
xor eax, eax
jmp 0x1400121fe
mov rax, qword [rsp + 0x88]
mov r9d, ebx
mov rcx, qword [rsp + 0x40]
mov r8, rbp
mov qword [rsp + 0x30], rax
xor edx, edx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x1400121f1
mov rdx, rbp
lea rcx, str.ReadRegKey_RegGetValue_failed_for_value___s.
call fcn.1400125e0
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400125e0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x250
cmp byte [0x1400905c8], 0
mov rbx, rcx
je 0x14001267b
mov qword [rax - 0x10], rdi
lea rcx, [rsp + 0x40]
xor edx, edx
lea rdi, [rax + 0x10]
mov r8d, 0x200
call fcn.140013b00
call fcn.140002a20
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
mov ebx, 0x1ff
mov rcx, qword [rax]
mov r9d, ebx
lea r8d, [rbx + 1]
call fcn.140045b90
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, ecx
lea rcx, [rsp + 0x40]
cmove eax, ebx
cdqe
mov byte [rsp + rax + 0x40], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdi, qword [rsp + 0x248]
add rsp, 0x250
pop rbx
ret

Function at 0x14001360c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013656
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013656
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013656
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013656
cmp dword [rcx + 0x84], 0xe
jbe 0x140013656
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013658
xor al, al
add rsp, 0x28
ret
Function at 0x14005e8cc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14005e8fc
xor eax, eax
jmp 0x14005e9bf
mov rbp, rbx
cmp word [rax], si
je 0x14005e921
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14005e908
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14005e904
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14005a574
movsxd r14, eax
test eax, eax
jne 0x14005e95f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14005e8f5
mov rcx, r14
call fcn.140052078
mov rdi, rax
test rax, rax
jne 0x14005e978
xor ecx, ecx
call fcn.14005203c
jmp 0x14005e954
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14005a574
test eax, eax
jne 0x14005e9a9
mov rcx, rdi
call fcn.14005203c
jmp 0x14005e9b3
xor ecx, ecx
call fcn.14005203c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400689f4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140068a0a
mov al, 1
jmp 0x140068a6a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140068a1b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140068a68
mov ecx, dword [rcx + 0x18]
nop
call fcn.14005fd7c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140068a68
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140068a68
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140068a68
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140068a6a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400698b4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140091210]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14006990b
cmp word [rdx], r13w
jne 0x14006990b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140069910
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140069a35
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140069a56
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140069949
mov rdx, r9
mov word [rbx], cx
jmp 0x140069970
cmp r9, r8
jae 0x140069980
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14006992a
jmp 0x140069a35
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140069a2a
cmp dword [rsp + 0x80], esi
je 0x140069a2a
lea r8, [0x140091210]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140069a02
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400699d2
mov word [rbx], r13w
jmp 0x140069a32
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400699df
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140069a32
cmp word [rsp + 0x70], r13w
jne 0x140069a0f
cmp rbx, r14
je 0x1400699cc
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140069578
cmp word [rsp + 0x70], r13w
je 0x140069a35
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140091210]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140069a2f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140069a35
Function at 0x14006c548
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140046ae8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14006c5d2
cmp byte [rbp - 0x21], r15b
je 0x14006c5cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14006c608
call fcn.140056c58
test eax, eax
jne 0x14006c5f4
cmp byte [rbp - 0x21], r15b
je 0x14006c5ec
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14006c608
cmp byte [rbp - 0x21], r15b
je 0x14006c605
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14005b9c0
test eax, eax
jne 0x14006c6a8
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140046ae8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14006c647
cmp byte [rbp - 0x21], r15b
je 0x14006c67c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14006c67c
call fcn.140056c58
test eax, eax
jne 0x14006c668
cmp byte [rbp - 0x21], r15b
je 0x14006c661
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14006c67c
cmp byte [rbp - 0x21], r15b
je 0x14006c679
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14005b9c0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14006c6a8
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14006c6ab
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14006c6b9
mov rcx, rdi
call fcn.14005203c
cmp byte [rbp + 0x3f], r15b
je 0x14006c6c8
mov rcx, qword [rbp + 0x27]
call fcn.14005203c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret