joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002acf0
Capabilities:
Set socket configuration

Disassembly:
endbr64
push rbx
add rsp, 0xffffffffffffff80
mov rbx, qword [0x14013cc10]
mov rdx, qword [rcx + 0xb8]
movdqu xmm0, xmmword [rcx + 0xa0]
mov rax, qword [rbx]
mov qword [rsp + 0x78], rax
xor eax, eax
mov r9, rcx
mov rax, qword [rcx + 0xb0]
movups xmmword [rsp + 0x60], xmm0
mov r8, qword [r9 + 0x18]
mov ecx, dword [rcx + 0xa0]
mov dword [r9 + 0x20], 0
mov qword [rsp + 0x70], rax
add r8, rdx
mov qword [r9 + 0x18], r8
test al, 1
je 0x14002ad5a
test ecx, ecx
setne cl
cmp rax, 1
setne al
or cl, al
jne 0x14002ad5f
test rdx, rdx
jne 0x14002ad98
movdqu xmm1, xmmword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea rcx, [r9 + 0x28]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm1
call sym._ZN5boost4asio3ssl6detail5io_opINS0_19basic_stream_socketINS0_2ip3tcpENS0_15any_io_executorEEENS2_21buffered_handshake_opINS0_
mov rax, qword [rsp + 0x78]
sub rax, qword [rbx]
jne 0x14002adee
sub rsp, 0xffffffffffffff80
pop rbx
ret
mov rax, qword [r9 + 0x10]
cmp r8, rax
jae 0x14002ad5f
cmp rax, r8
mov rcx, qword [r9 + 8]
mov rdx, qword [r9]
cmovbe r8, rax
add rcx, r8
sub rax, r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], rcx
mov ecx, 0x10000
cmp rax, rcx
cmova rax, rcx
mov rcx, qword [rdx]
mov qword [rsp + 0x58], rax
lea rax, [rdx + 8]
add rdx, 0x68
add rcx, 0x28
mov qword [rsp + 0x20], rdx
mov rdx, rax
call sym._ZN5boost4asio6detail28win_iocp_socket_service_base10async_sendINS0_15const_buffers_1ENS1_8write_opINS0_19basic_stream_socketI
jmp 0x14002ad85
call dbg.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop
Function at 0x14002cec0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, qword [0x14013cc10]
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, r8
mov rsi, rcx
mov rdi, rdx
sub rbx, rdx
mov qword [rsp + 0x20], rbx
cmp rbx, 0xf
ja 0x14002cf30
mov rcx, qword [rcx]
cmp rbx, 1
jne 0x14002cf28
movzx eax, byte [rdx]
mov byte [rcx], al
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsi]
mov qword [rsi + 8], rbx
mov byte [rcx + rbx], 0
mov rax, qword [rsp + 0x28]
sub rax, qword [rbp]
jne 0x14002cf61
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
test rbx, rbx
je 0x14002cf07
jmp 0x14002cf4c
lea rdx, [rsp + 0x20]
xor r8d, r8d
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_create_unsigned_long_long__unsigned_long_long_
mov qword [rsi], rax
mov rcx, rax
mov rax, qword [rsp + 0x20]
mov qword [rsi + 0x10], rax
mov r8, rbx
mov rdx, rdi
call sym.memcpy
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsi]
jmp 0x14002cf07
call dbg.__stack_chk_fail
nop
nop word [rax + rax]

Function at 0x14002cf70
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
endbr64
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, qword [0x14013cc10]
xor r9d, r9d
mov rdx, qword [rcx + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
xor eax, eax
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x40]
mov word [rsp + 0x40], ax
mov rax, qword [rcx]
mov r8, rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0
add rdx, rax
mov rcx, rax
call sym.boost::filesystem::detail::path_traits::convert_char_const__char_const__std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t_____std::codecvt_wchar_t__char__int__const_
lea rcx, [rsp + 0x28]
xor r8d, r8d
mov rdx, rsi
call sym.boost::filesystem::detail::status_boost::filesystem::path_const__boost::system::error_code_
mov rcx, qword [rsp + 0x30]
cmp dword [rsp + 0x28], 1
seta sil
cmp rcx, rdi
je 0x14002cff5
mov rax, qword [rsp + 0x40]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0x58]
sub rax, qword [rbx]
jne 0x14002d022
mov eax, esi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov rcx, rsi
mov rdi, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::_M_dispose__
mov rax, qword [rsp + 0x58]
sub rax, qword [rbx]
je 0x14002d02d
call dbg.__stack_chk_fail
endbr64
jmp 0x14002d00d
mov rcx, rdi
call sym._Unwind_Resume
nop
nop word cs:[rax + rax]
Function at 0x14002d040
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
endbr64
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa0
mov rbp, qword [0x14013cc10]
xor r8d, r8d
mov rax, qword [rbp]
mov qword [rsp + 0x98], rax
xor eax, eax
lea rax, [rsp + 0x70]
mov rsi, rdx
lea rdi, [rsp + 0x60]
mov rdx, rcx
mov rcx, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0
mov word [rsp + 0x60], r8w
call method.epee::string_tools.utf8_to_utf16_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rax, qword [rsp + 0x70]
lea rbx, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x78]
cmp rax, rbx
je 0x14002d220
movq xmm0, r8
movhps xmm0, qword [rsp + 0x80]
cmp rcx, rdi
je 0x14002d1f8
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
test rcx, rcx
je 0x14002d202
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], 0
xor eax, eax
mov word [rcx], ax
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x14002d11a
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002d1f0
mov r12, qword [rsi + 8]
mov rdx, qword [rsi]
lea r9, [rsp + 0x4c]
mov rcx, rax
mov qword [rsp + 0x20], 0
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp dword [rsp + 0x4c], r12d
je 0x14002d1d0
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x14002d1a4
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0x98]
sub rax, qword [rbp]
jne 0x14002d296
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test esi, esi
setne bl
jmp 0x14002d18b
xor ebx, ebx
jmp 0x14002d18b
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], rbx
lea rbx, [rsp + 0x80]
mov rcx, rbx
jmp 0x14002d0f0
test r8, r8
je 0x14002d240
cmp r8, 1
je 0x14002d260
add r8, r8
mov rdx, rbx
call sym.memcpy
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x58], r8
mov word [rcx + r8*2], dx
mov rcx, qword [rsp + 0x70]
jmp 0x14002d0f0
movzx eax, word [rsp + 0x80]
mov word [rcx], ax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
jmp 0x14002d240
call dbg.__stack_chk_fail
mov rcx, rbx
call sym._Unwind_Resume
nop
nop word cs:[rax + rax]
nop
Function at 0x14002d2b0
Capabilities:
Get file size
Read file on windows

Disassembly:
endbr64
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r12, qword [0x14013cc10]
mov rax, qword [r12]
mov qword [rsp + 0x98], rax
xor eax, eax
lea rax, [rsp + 0x70]
mov rbp, rdx
mov rdi, r8
lea rsi, [rsp + 0x60]
xor r8d, r8d
mov rdx, rcx
mov rcx, rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0
mov word [rsp + 0x60], r8w
call method.epee::string_tools.utf8_to_utf16_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rdx, qword [rsp + 0x70]
lea rbx, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x78]
cmp rdx, rbx
je 0x14002d4a0
movq xmm0, r8
movhps xmm0, qword [rsp + 0x80]
cmp rcx, rsi
je 0x14002d480
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rdx
movups xmmword [rsp + 0x58], xmm0
test rcx, rcx
je 0x14002d48a
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], 0
xor eax, eax
mov word [rcx], ax
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x14002d38f
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002d3ea
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
cmp eax, 0xffffffff
je 0x14002d3e1
mov edx, eax
cmp rdi, rdx
jae 0x14002d430
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x14002d405
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0x98]
sub rax, qword [r12]
jne 0x14002d516
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r8d, r8d
mov rcx, rbp
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::resize_unsigned_long_long__char_
mov rdx, qword [rbp]
lea r9, [rsp + 0x4c]
mov r8d, r13d
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp dword [rsp + 0x4c], r13d
jne 0x14002d3ec
test edi, edi
setne bl
jmp 0x14002d3ec
mov qword [rsp + 0x50], rdx
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], rbx
lea rbx, [rsp + 0x80]
mov rcx, rbx
jmp 0x14002d365
test r8, r8
je 0x14002d4c0
cmp r8, 1
je 0x14002d4e0
add r8, r8
mov rdx, rbx
call sym.memcpy
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x58], r8
mov word [rcx + r8*2], dx
mov rcx, qword [rsp + 0x70]
jmp 0x14002d365
movzx eax, word [rsp + 0x80]
mov word [rcx], ax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
jmp 0x14002d4c0
call dbg.__stack_chk_fail
endbr64
mov rcx, rax
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x14002d3ea
Function at 0x14002d540
Capabilities:
Get file size

Disassembly:
endbr64
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa0
mov rbp, qword [0x14013cc10]
xor r8d, r8d
mov rax, qword [rbp]
mov qword [rsp + 0x98], rax
xor eax, eax
lea rax, [rsp + 0x70]
mov rdi, rdx
lea rsi, [rsp + 0x60]
mov rdx, rcx
mov rcx, rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0
mov word [rsp + 0x60], r8w
call method.epee::string_tools.utf8_to_utf16_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rax, qword [rsp + 0x70]
lea rbx, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x78]
cmp rax, rbx
je 0x14002d710
movq xmm0, r8
movhps xmm0, qword [rsp + 0x80]
cmp rcx, rsi
je 0x14002d6e8
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
test rcx, rcx
je 0x14002d6f2
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], 0
xor eax, eax
mov word [rcx], ax
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x14002d61a
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002d6e0
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r12d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
jne 0x14002d6c0
mov rax, qword [rdi]
test rax, rax
setne bl
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x14002d697
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0x98]
sub rax, qword [rbp]
jne 0x14002d786
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
jmp 0x14002d678
xor ebx, ebx
jmp 0x14002d67e
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], rbx
lea rbx, [rsp + 0x80]
mov rcx, rbx
jmp 0x14002d5f0
test r8, r8
je 0x14002d730
cmp r8, 1
je 0x14002d750
add r8, r8
mov rdx, rbx
call sym.memcpy
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x58], r8
mov word [rcx + r8*2], dx
mov rcx, qword [rsp + 0x70]
jmp 0x14002d5f0
movzx eax, word [rsp + 0x80]
mov word [rcx], ax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
jmp 0x14002d730
call dbg.__stack_chk_fail
mov rcx, rbx
call sym._Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400347b0
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
movzx eax, byte [0x140155f88]
mov ebx, ecx
mov esi, edx
test al, al
je 0x140034860
movzx eax, byte [0x140155f78]
test al, al
je 0x140034820
cmp byte [0x140155f80], 0
je 0x1400347f0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
cmp ebx, 6
ja case.0x140034817.0
lea rax, [0x14013a7ec]
mov edx, ebx
movsxd rdx, dword [rax + rdx*4]
add rdx, rax
jmp rdx
lea rdi, [0x140155f78]
mov rcx, rdi
call sym.__cxa_guard_acquire
test eax, eax
je 0x1400347d5
mov rdx, qword [0x140155f90]
xor eax, eax
test rdx, rdx
je 0x140034847
cmp byte [rdx], 0
setne al
mov rcx, rdi
mov byte [0x140155f80], al
call sym.__cxa_guard_release
jmp 0x1400347d5
lea rdi, [0x140155f88]
mov rcx, rdi
call sym.__cxa_guard_acquire
test eax, eax
je 0x1400347ca
lea rcx, str.NO_COLOR
call sym.getenv
mov rcx, rdi
mov qword [0x140155f90], rax
call sym.__cxa_guard_release
jmp 0x1400347ca
cmp sil, 1
sbb edx, edx
and edx, 0xfffffff8
add edx, 0xa
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp sil, 1
sbb edx, edx
and edx, 0xfffffff8
add edx, 0xc
jmp 0x1400348ac
cmp sil, 1
sbb edx, edx
and edx, 0xfffffff8
add edx, 0xb
jmp 0x1400348ac
cmp sil, 1
sbb edx, edx
and edx, 0xfffffff8
add edx, 0xd
jmp 0x1400348ac
cmp sil, 1
sbb edx, edx
and edx, 0xfffffff8
add edx, 9
jmp 0x1400348ac
cmp sil, 1
sbb edx, edx
and edx, 0xfffffff8
add edx, 0xe
jmp 0x1400348ac
cmp sil, 1
sbb edx, edx
and edx, 0xfffffff8
add edx, 0xf
jmp 0x1400348ac

Function at 0x140037410
Capabilities:
Query environment variable

Disassembly:
mov ecx, edx
movzx edx, r8b
jmp method.el::base::utils.setConsoleColor_el::Color__bool_

Function at 0x140037720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
je 0x140037750
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140037750
shr eax, 4
and eax, 1
test bl, bl
cmovne eax, ebx
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140037760
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
xor eax, eax
cmp qword [rcx + 8], 0
mov rbx, rcx
jne 0x140037790
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400377b2
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, eax
cmp eax, 0xffffffff
je 0x1400377af
and edx, 0x10
mov eax, 1
jne 0x14003777a
mov rcx, qword [rbx]
lea rsi, [0x14013ac9a]
lea r12, [rsp + 0x40]
mov byte [rsp + 0x40], 0
mov rdx, rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0
call sym.strtok
mov rbx, rax
test rax, rax
je 0x140037890
mov r13, qword [sym.imp.msvcrt.dll__mkdir]
lea rdi, [rsp + 0x30]
movabs rbp, 0x3fffffffffffffff
nop dword [rax + rax]
mov rcx, rbx
call sym.strlen
mov r8, rax
mov rax, rbp
sub rax, qword [rsp + 0x38]
cmp rax, r8
jb 0x140037894
mov rdx, rbx
mov rcx, rdi
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_append_char_const__unsigned_long_long_
cmp qword [rsp + 0x38], rbp
je 0x1400378a0
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_append_char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x30]
call r13
mov rdx, rsi
xor ecx, ecx
mov r14d, eax
call sym.strtok
mov rbx, rax
test rax, rax
jne 0x140037800
cmp r14d, 0xffffffff
setne al
mov rcx, qword [rsp + 0x30]
cmp rcx, r12
je 0x14003777a
mov byte [rsp + 0x2f], al
call sym.operator_delete_void_
movzx eax, byte [rsp + 0x2f]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
jmp 0x14003785f
lea rcx, str.basic_string::append
call sym.std::__throw_length_error_char_const_
lea rcx, str.basic_string::append
call sym.std::__throw_length_error_char_const_
mov rbx, rax
mov rcx, rdi
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_dispose__
mov rcx, rbx
call sym._Unwind_Resume
nop

Function at 0x140038de0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [0x140155f40]
mov r8d, 0x32
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
mov eax, 0
cmovne rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140038e30
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rdi, [0x140155f40]
mov rbx, rcx
mov rsi, r8
mov rcx, rdx
mov r8d, 0x32
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140038e68
cmp byte [0x140155f40], 0
jne 0x140038ef0
lea rbp, [rbx + 0x10]
mov qword [rbx], rbp
test rsi, rsi
je 0x140038f1b
mov rcx, rsi
call sym.strlen
mov qword [rsp + 0x28], rax
mov rdi, rax
cmp rax, 0xf
ja 0x140038eb0
cmp rax, 1
je 0x140038f10
test rax, rax
jne 0x140038ecf
mov qword [rbx + 8], rax
mov byte [rbp + rax], 0
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, rbx
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::_M_create_unsigned_long_long__unsigned_long_long_
mov qword [rbx], rax
mov rbp, rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 0x10], rax
mov rcx, rbp
mov r8, rdi
mov rdx, rsi
call sym.memcpy
mov rax, qword [rsp + 0x28]
mov rbp, qword [rbx]
jmp 0x140038e99
mov rdx, rdi
mov rcx, rbx
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx edx, byte [rsi]
mov byte [rbx + 0x10], dl
jmp 0x140038e99
lea rcx, str.basic_string:_construction_from_null_is_not_valid
call sym.std::__throw_logic_error_char_const_
nop
nop dword [rax + rax]

Function at 0x140038f30
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rsi, [0x140155f40]
mov r8d, 0x32
mov rdx, rsi
mov rbx, rcx
lea rcx, str.USERNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140038f63
cmp byte [0x140155f40], 0
jne 0x140038f90
lea rax, [rbx + 0x10]
mov dword [rbx + 0x10], 0x72657375
mov qword [rbx], rax
mov rax, rbx
mov qword [rbx + 8], 4
mov byte [rbx + 0x14], 0
add rsp, 0x28
pop rbx
pop rsi
ret
mov rdx, rsi
mov rcx, rbx
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140038fb0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rsi, [0x140155f40]
mov r8d, 0x32
mov rdx, rsi
mov rbx, rcx
lea rcx, str.COMPUTERNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140038fe3
cmp byte [0x140155f40], 0
jne 0x140039018
lea rax, [rbx + 0x10]
mov dword [rbx + 0x18], 0x74736f68
movabs rdx, 0x2d6e776f6e6b6e75
mov qword [rbx], rax
mov rax, rbx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 8], 0xc
mov byte [rbx + 0x1c], 0
add rsp, 0x28
pop rbx
pop rsi
ret
mov rdx, rsi
mov rcx, rbx
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x140039840
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rax, fcn.140056990
lea rsi, [0x140155f40]
mov rdi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r8d, 0x32
mov rdx, rsi
mov qword [rcx], rax
lea rax, [rcx + 0x20]
mov rbx, rcx
lea rbp, [rcx + 0x78]
mov qword [rcx + 0x10], rax
lea rax, [rcx + 0x40]
mov qword [rcx + 0x30], rax
lea rax, [rcx + 0x60]
mov dword [rcx + 8], 0x3f2
mov qword [rcx + 0x18], 0
mov byte [rcx + 0x20], 0
mov qword [rcx + 0x38], 0
mov byte [rcx + 0x40], 0
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x58], 0
mov byte [rcx + 0x60], 0
mov dword [rcx + 0x70], 0
lea rcx, str.USERNAME
call rdi
test eax, eax
je 0x1400398d2
cmp byte [0x140155f40], 0
jne 0x140039928
lea rdx, str.user
mov rcx, rbp
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
lea r12, [rbx + 0x98]
mov r8d, 0x32
mov rdx, rsi
lea rcx, str.COMPUTERNAME
call rdi
test eax, eax
je 0x140039907
cmp byte [0x140155f40], 0
jne 0x140039938
lea rdx, str.unknown_host
mov rcx, r12
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
nop
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, rsi
mov rcx, rbp
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
jmp 0x1400398e1
mov rdx, rsi
mov rcx, r12
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
nop
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14003b600
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rax, fcn.140056990
lea rsi, [0x140155f40]
mov qword [rcx], rax
lea rax, [rcx + 0x20]
lea rdi, [rcx + 0x10]
mov rbx, rcx
mov qword [rcx + 0x10], rax
mov rax, qword [r8 + 8]
lea r12, [rbx + 0x78]
mov dword [rcx + 8], edx
mov rdx, qword [r8]
mov rcx, rdi
add rax, rdx
mov r8, rax
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char__char__char__std::forward_iterator_tag___clone_.isra.0_
lea rax, [rbx + 0x40]
mov byte [rbx + 0x40], 0
mov rdx, rsi
mov qword [rbx + 0x30], rax
lea rax, [rbx + 0x60]
mov rbp, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r8d, 0x32
mov qword [rbx + 0x38], 0
lea rcx, str.USERNAME
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], 0
mov byte [rbx + 0x60], 0
call rbp
test eax, eax
je 0x14003b696
cmp byte [0x140155f40], 0
jne 0x14003b6f8
lea rdx, str.user
mov rcx, r12
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
lea r13, [rbx + 0x98]
mov r8d, 0x32
mov rdx, rsi
lea rcx, str.COMPUTERNAME
call rbp
test eax, eax
je 0x14003b6cb
cmp byte [0x140155f40], 0
jne 0x14003b708
lea rdx, str.unknown_host
mov rcx, r13
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
mov rdx, rdi
mov rcx, rbx
call method.el::base::LogFormat.parseFromFormat_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
nop
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rsi
mov rcx, r12
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
jmp 0x14003b6a5
mov rdx, rsi
mov rcx, r13
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
jmp 0x14003b6da