joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140044020
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
movsxd rdx, dword [rdx + 8]
test rdx, rdx
je 0x140044160
mov rsi, rcx
mov rax, qword [rdi]
xor ecx, ecx
xor r8d, r8d
or r8, qword [rax + rcx*8]
inc rcx
cmp rdx, rcx
jne 0x140044042
test r8, r8
je 0x140044160
test edx, edx
jle 0x1400441a7
mov rax, qword [rdi]
test byte [rax], 1
je 0x1400441a7
cmp dword [rdi + 0x10], 0
jne 0x140044227
cmp edx, 0x401
jae 0x1400441e7
lea rbx, [rsi + 0x18]
cmp rbx, rdi
je 0x1400440c5
mov rcx, rbx
call fcn.1400421e0
test eax, eax
je 0x1400441c7
movsxd r8, dword [rdi + 8]
test r8, r8
je 0x140044198
shl r8, 3
mov rcx, qword [rbx]
mov rdx, qword [rdi]
call fcn.1400d3630
mov eax, dword [rdi + 8]
mov dword [rsi + 0x20], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x28], eax
mov rdi, rbx
test rdi, rdi
je 0x1400441c7
mov eax, dword [rsi + 0x20]
test eax, eax
jle 0x14004419f
mov rcx, qword [rbx]
mov edx, eax
cmp qword [rcx + rdx*8 - 8], 0
jne 0x1400440f5
lea edx, [rax - 1]
cmp eax, 1
mov eax, edx
jg 0x1400440dc
jmp 0x140044185
mov dword [rsi + 0x20], eax
mov rax, qword [rbx]
mov rax, qword [rax]
mov r9d, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov r10d, r9d
and r10d, 1
neg r10
mov r11, rax
and r11, r10
mov rdi, r11
xor rdi, r9
shr rdi, 1
and r11, r9
add r11, rdi
and r10, r8
shr rcx, 1
or rcx, r10
mov r9, r11
dec rdx
jne 0x140044115
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov dword [rsp + 0x20], 0xaa
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.140120220
jmp 0x140044156
mov dword [rsi + 0x20], 0
mov dword [rsi + 0x28], 0
jmp 0x1400440f8
xor eax, eax
jmp 0x1400440b9
jne 0x1400440f8
jmp 0x14004418c
mov dword [rsp + 0x20], 0xae
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14004417e
mov dword [rsp + 0x20], 0xbc
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14004417e
mov r8d, 0x400
xor ecx, ecx
or rcx, qword [rax + r8*8]
inc r8
cmp rdx, r8
jne 0x1400441ef
test rcx, rcx
je 0x140044081
mov dword [rsp + 0x20], 0xb6
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x66
jmp 0x14004417e
mov dword [rsp + 0x20], 0xb2
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14004417e
Function at 0x140044590
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
mov r13, qword [rsp + 0xb0]
mov rax, qword [0x140178040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
xor r14d, r14d
test r13, r13
je 0x140044600
mov ecx, dword [r13 + 0x2c]
call fcn.140087010
test rax, rax
je 0x1400446e1
mov r12, rax
xor ecx, ecx
call fcn.140087070
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r14, r12
mov rax, qword [r13 + 0x10]
lea rcx, [0x140114330]
cmp rax, rcx
jne 0x1400446d1
xorps xmm0, xmm0
movups xmmword [r14 + 0x5c], xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movaps xmm0, xmmword [0x140160930]
movups xmmword [r14], xmm0
movaps xmm0, xmmword [0x140160940]
movups xmmword [r14 + 0x10], xmm0
mov dword [r14 + 0x6c], 0x20
lea r14, [rsp + 0x20]
mov rax, qword [r14]
mov rax, qword [rax + 0x18]
mov rcx, r14
mov rdx, r15
mov r8, rbx
call qword [str.P4_r_]
mov rax, qword [r14]
mov rax, qword [rax + 0x20]
mov rcx, r14
mov rdx, rdi
call qword [str.P4_r_]
mov rax, qword [r14]
test rsi, rsi
je 0x14004468a
mov ecx, dword [rax + 4]
mov dword [rsi], ecx
mov edx, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x28]
call fcn.1400870b0
mov r14d, 1
mov rcx, qword [rsp + 0x28]
call fcn.140087070
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x1400446e5
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a15d0
mov eax, r14d
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x20]
call qword [str.P4_r_]
jmp 0x14004464f
xor ecx, ecx
jmp 0x1400446a2
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
call qword [str.P4_r_]
jmp 0x1400446b1

Function at 0x140044750
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx], rdx
je 0x140044782
mov ecx, dword [rdi + 0x2c]
call fcn.140087010
test rax, rax
je 0x1400447e1
mov rbx, rax
mov rcx, qword [rsi + 8]
call fcn.140087070
mov qword [rsi + 8], rbx
mov qword [rsi], rdi
mov rax, qword [rdi + 0x10]
lea rcx, [0x140114330]
cmp rax, rcx
jne 0x1400447d6
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140160930]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x140160940]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [str.P4_r_]
jmp 0x1400447c9
xor eax, eax
jmp 0x1400447ce
Function at 0x140044880
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0
jne 0x1400448b7
mov rcx, qword [rsp + 0x80]
mov rdx, r9
call fcn.14004ee70
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400449ca
mov ebp, dword [rsp + 0x88]
lea rcx, [0x14018bf88]
lea rdx, [0x140047f80]
call fcn.14008b6d0
lea rax, [0x14018bf90]
mov qword [rdi + 0x18], rax
mov rcx, qword [rdi + 0x10]
cmp ebp, 1
jne 0x1400449ce
call fcn.14004f170
test eax, eax
je 0x1400449ca
test rbx, rbx
je 0x14004490f
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.14004b800
test eax, eax
je 0x1400449ca
xor eax, eax
test ebp, ebp
setne al
mov rcx, qword [rdi + 0x10]
mov rcx, qword [rcx]
shl eax, 4
cmp qword [rcx + rax + 0x28], 0
je 0x1400449a1
test rbx, rbx
je 0x1400449d8
cmp qword [rdi], rbx
je 0x14004495a
mov ecx, dword [rbx + 0x2c]
call fcn.140087010
test rax, rax
je 0x1400449ca
mov r14, rax
mov rcx, qword [rdi + 8]
call fcn.140087070
mov qword [rdi + 8], r14
mov qword [rdi], rbx
mov rax, qword [rbx + 0x10]
lea rcx, [0x140114330]
cmp rax, rcx
jne 0x1400449bf
mov rax, qword [rdi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140160930]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x140160940]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov ebx, 1
test rsi, rsi
je 0x1400449b2
mov rax, qword [rdi + 0x10]
mov qword [rsi], rax
mov eax, ebx
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
call qword [str.P4_r_]
jmp 0x1400449a1
xor ebx, ebx
jmp 0x1400449b2
call fcn.140120390
jmp 0x1400448ee
mov dword [rsp + 0x20], 0x6d
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestsigndigestsign.c
xor ebx, ebx
mov ecx, 6
xor edx, edx
mov r8d, 0x77
call fcn.140120220
jmp 0x1400449b2
Function at 0x140046570
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x140178040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x1400466b9
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x14014d460]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [str.P4_r_]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [str.P4_r_]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [str.P4_r_]
test r14, r14
je 0x140046653
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x140046643
mov ecx, 1
call fcn.1400832f0
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x1400466bd
call fcn.140002fe0
lea rax, [0x140001d60]
lea rcx, section..text
mov qword [rsi + 0xf8], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a15d0
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x14004669c
bt eax, 9
jae 0x1400466d8
call fcn.1400040d0
lea rax, [0x1400045a0]
lea rcx, [0x1400042a0]
jmp 0x140046683
call fcn.1400ffb40
lea rax, [0x140100340]
lea rcx, [0x1400ffa20]
jmp 0x140046683
Function at 0x140046700
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm8
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0x28], r9
mov rax, qword [0x140178040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov esi, 1
test rdx, rdx
je 0x1400468cb
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov rsi, qword [rsp + 0x150]
mov r13d, dword [rsi + 4]
xor r14d, r14d
movaps xmm7, xmmword [0x140160930]
movaps xmm8, xmmword [0x140160940]
lea r12, [rsp + 0x30]
mov eax, r14d
bswap eax
mov dword [rsp + 0x5c], eax
cmp qword [rsp + 0x30], rsi
je 0x1400467c2
mov ecx, dword [rsi + 0x2c]
call fcn.140087010
test rax, rax
je 0x14004692e
mov rbp, rax
mov rcx, qword [rsp + 0x38]
call fcn.140087070
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rsi
mov rax, qword [rsi + 0x10]
lea rcx, [0x140114330]
cmp rax, rcx
jne 0x14004691e
mov rax, qword [rsp + 0x38]
movups xmmword [rax + 0x5c], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax], xmm7
movups xmmword [rax + 0x10], xmm8
mov dword [rax + 0x6c], 0x20
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov rcx, r12
mov rdx, r15
mov r8, qword [rsp + 0x28]
call qword [str.P4_r_]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov r8d, 4
mov rcx, r12
lea rdx, [rsp + 0x5c]
call qword [str.P4_r_]
cmp rdi, r13
jb 0x140046872
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov rcx, r12
mov rdx, rbx
call qword [str.P4_r_]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rax + 0x2c]
call fcn.1400870b0
add rbx, r13
inc r14d
sub rdi, r13
jne 0x14004678a
jmp 0x1400468c6
movaps xmm0, xmmword [0x14014d460]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea r15, [rsp + 0x30]
mov rax, qword [r15]
mov rax, qword [rax + 0x20]
mov rcx, r15
mov rdx, r14
call qword [str.P4_r_]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov edx, dword [rax + 0x2c]
call fcn.1400870b0
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.1400d3630
mov esi, 1
mov rcx, qword [rsp + 0x38]
call fcn.140087070
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x140046932
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400a15d0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x30]
call qword [str.P4_r_]
jmp 0x1400467fe
xor esi, esi
jmp 0x1400468cb
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [str.P4_r_]
jmp 0x1400468df
Function at 0x140047c90
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 2
call fcn.1400832f0
mov ebp, eax
bt eax, 0x1d
jb 0x140047cd3
not ebp
test ebp, 0x128
jne 0x140047cf9
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140010eb0
mov ecx, 1
call fcn.1400832f0
bt eax, 9
jae 0x140047cb3
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000ef40
mov ecx, 1
call fcn.1400832f0
mov ebp, eax
bt eax, 0x1c
jae 0x140047d18
xor ecx, ecx
call fcn.1400832f0
bt eax, 0x1e
jb 0x140047d42
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
bt ebp, 9
jb 0x140047d34
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000df00
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14000f210
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.1400100b0

Function at 0x140047db0
Capabilities:
Encode data using xor
Hash data using sha256 via x86 extensions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 2
call fcn.1400832f0
bt eax, 0x1d
jb 0x140047e30
mov ecx, 1
call fcn.1400832f0
mov ebp, eax
bt eax, 0x1c
jae 0x140047e06
xor ecx, ecx
call fcn.1400832f0
bt eax, 0x1e
jae 0x140047e06
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140014f40
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
bt ebp, 9
jb 0x140047e22
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140012a80
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140014000
mov ecx, 1
call fcn.1400832f0
bt eax, 9
jae 0x140047dd1
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140013c40
Function at 0x140048760
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x140048770
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x140048791
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400487b1
cmp byte [r14 + 0x50], 0
jne 0x14004883c
or edi, 0x20000000
test dil, 8
jne 0x140048847
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x1400487cf
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x1400487e0
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
jne 0x14004886e
cmp byte [r14 + 0x18], 0
jne 0x14004887f
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x14004888f
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x140048864
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x1400487b1
cmp byte [r14 + 0x68], 0
je 0x140048859
or edi, 0x40000000
jmp 0x1400487bb
or edi, 0x10000000
jmp 0x1400487bb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140048827
lea rcx, [r14 + 0x20]
call fcn.14002af40
mov r15, rax
jmp 0x1400487eb
mov rcx, r14
call fcn.14002af40
mov r9, rax
jmp 0x1400487f9
cmp ebx, 4
jne 0x14004889e
mov edx, 6
jmp 0x140048806
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400488b0
mov edx, 7
jmp 0x140048806
cmp ebx, 1
jne 0x1400488bf
mov edx, 4
jmp 0x140048806
xor edx, edx
jmp 0x140048806
Function at 0x140048770
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x140048770
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x140048791
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400487b1
cmp byte [r14 + 0x50], 0
jne 0x14004883c
or edi, 0x20000000
test dil, 8
jne 0x140048847
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x1400487cf
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x1400487e0
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
jne 0x14004886e
cmp byte [r14 + 0x18], 0
jne 0x14004887f
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x14004888f
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x140048864
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x1400487b1
cmp byte [r14 + 0x68], 0
je 0x140048859
or edi, 0x40000000
jmp 0x1400487bb
or edi, 0x10000000
jmp 0x1400487bb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140048827
lea rcx, [r14 + 0x20]
call fcn.14002af40
mov r15, rax
jmp 0x1400487eb
mov rcx, r14
call fcn.14002af40
mov r9, rax
jmp 0x1400487f9
cmp ebx, 4
jne 0x14004889e
mov edx, 6
jmp 0x140048806
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400488b0
mov edx, 7
jmp 0x140048806
cmp ebx, 1
jne 0x1400488bf
mov edx, 4
jmp 0x140048806
xor edx, edx
jmp 0x140048806

Function at 0x1400488d0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x140048908
cmp byte [r15 + 0x50], 0
jne 0x14004899f
or edi, 0x20000000
test dil, 8
jne 0x1400489aa
xor r14d, r14d
cmp byte [r15 + 0x60], 0
mov r12d, 0
je 0x140048926
mov r12, qword [r15 + 0x58]
cmp byte [r15 + 0x48], 0
mov r13d, 0
je 0x140048937
mov r13, qword [r15 + 0x40]
cmp byte [r15 + 0x38], 0
jne 0x1400489d1
cmp byte [r15 + 0x18], 0
jne 0x1400489e2
xor r9d, r9d
cmp ebx, 4
jne 0x140048990
mov edx, 6
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x1400489c7
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400489f2
mov edx, 7
jmp 0x14004895a
or edi, 0x80000000
jmp 0x140048908
cmp byte [r15 + 0x68], 0
je 0x1400489bc
or edi, 0x40000000
jmp 0x140048912
or edi, 0x10000000
jmp 0x140048912
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14004897b
lea rcx, [r15 + 0x20]
call fcn.14002af40
mov r14, rax
jmp 0x140048942
mov rcx, r15
call fcn.14002af40
mov r9, rax
jmp 0x140048950
mov edx, 1
test ebx, ebx
je 0x14004895a
cmp ebx, 1
jne 0x140048a0e
mov edx, 4
jmp 0x14004895a
xor edx, edx
jmp 0x14004895a
Function at 0x1400494b0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140178040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.1400724e0
cmp byte [rdi + 0x17], 0
jns 0x1400494f1
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x6f], 0
jns 0x140049512
mov rcx, qword [rsp + 0x58]
call fcn.1400a02e8
test rsi, rsi
je 0x1400495b9
test edi, edi
je 0x1400495b9
mov ecx, edi
add rcx, rcx
call fcn.1400a031c
mov rbx, rax
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea r14, [rsp + 0x58]
mov rcx, r14
call fcn.1400724e0
cmp byte [r14 + 0x17], 0
jns 0x140049555
mov r14, qword [rsp + 0x58]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x6f], 0
jns 0x140049575
mov rcx, qword [rsp + 0x58]
call fcn.1400a02e8
mov qword [rsp + 0x20], rbx
test rbx, rbx
je 0x1400495d7
mov rcx, rbx
call fcn.1400bcf98
lea rdx, [rsp + 0x20]
mov qword [rdx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.140072510
cmp byte [rsi + 0x17], 0
js 0x1400495ea
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.1400a0324
test edi, edi
setne bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a15d0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x14014d516]
lea rdx, str....._third_partylibc_srcinclude_string_view:267:_assertion___s___nullptr_failed:_null_pointer_passed_to_non_null_argument_of_char_traits_..._::length_n
call fcn.1400d6d70
mov rcx, qword [rsi]
call fcn.1400a02e8
jmp 0x1400495a0

Function at 0x1400499c0
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x140049a37
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x14017a6a0], rax
jne 0x140049a3a
mov rsi, rcx
call fcn.140050210
mov edx, 0x568
mov rcx, rax
xor r8d, r8d
call fcn.140049a50
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.140085620
mov ecx, dword [0x14018ca50]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x140186798]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x150], rdi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
int3
int3