joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63012700
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6363c940]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6363c920]
test rbx, rbx
je 0x63012754
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x6301274b
test r12, r12
je 0x6301274b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x63012730
lea rcx, [0x6363c940]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x63012a90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x631c4a10]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x63012b09
mov rcx, r10
call fcn.63012960
test eax, eax
je 0x63012b09
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x63012b06
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x63012afd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x63012b09
add r8, 0x28
cmp r8, r9
jne 0x63012ae8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x63012e60
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x6363c928]
mov edi, ecx
mov rsi, rdx
test eax, eax
jne 0x63012790
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x18
mov ecx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
test rax, rax
je 0x630127e3
mov dword [rax], edi
lea rcx, [0x6363c940]
mov qword [rax + 8], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x6363c920]
lea rcx, [0x6363c940]
mov qword [0x6363c920], rbx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
or eax, 0xffffffff
jmp 0x63012786
push r12
push rbx
sub rsp, 0x28
mov rbx, rcx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
cmp eax, 0xffffffff
je 0x63012e90
mov rdx, r12
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop r12
jmp 0x63021680
add rsp, 0x28
pop rbx
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
test rdx, rdx
jne 0x63021690
xor eax, eax
ret
jmp 0x63012770

Function at 0x63012ed0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r12d
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x63012f10
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x63012f28
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x63023040
Capabilities:
Query environment variable

Disassembly:
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [0x631b7b2e]
jmp fcn.63026010

Function at 0x63023080
Capabilities:
Query environment variable

Disassembly:
lea r8, str.src_Window.cpp
mov r9d, edx
mov rdx, rcx
lea rcx, [0x631b768d]
jmp fcn.63025dc0

Function at 0x630230a0
Capabilities:
Query environment variable

Disassembly:
lea r8, str.src_NanoVG.cpp
mov r9d, edx
mov rdx, rcx
lea rcx, [0x631b834d]
jmp fcn.63026150

Function at 0x63025830
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x631b56cb]
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x63025871
lea rdx, [0x631b56e6]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
jne 0x63025874
jmp 0x63025871
mov rax, rbx
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x63025880
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x631b6a60]
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x630258c1
lea rdx, [0x631b6a7b]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
jne 0x630258c4
jmp 0x630258c1
mov rax, rbx
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x630258d0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x631b7860]
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x63025911
lea rdx, [0x631b787b]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
jne 0x63025914
jmp 0x63025911
mov rax, rbx
add rsp, 0x28
pop rbx
pop r12
ret

Function at 0x63025920
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b3480]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x630259b4
lea rcx, [0x631b3480]
call fcn.6305c610
test eax, eax
je 0x630259b4
mov ecx, 2
call rsi
lea rcx, [0x631b536e]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x63025990
lea rdx, [0x631b5389]
lea rcx, [0x631b538c]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b3480]
mov qword [0x631b3d30], rbx
call fcn.6305c720
jmp 0x630259b4
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x631b3d30]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x63025a04
lea rdx, [0x631b53a1]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3d30]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b53ad]
jmp 0x63025a2b
lea rdx, [0x631b53b3]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3d30]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b53ba]
mov rcx, qword [0x631b3d30]
call fcn.63022f50
mov rcx, qword [0x631b3d30]
call sub.msvcrt.dll_fflush
jmp 0x63025a53
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x63025a60
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b3490]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x63025af4
lea rcx, [0x631b3490]
call fcn.6305c610
test eax, eax
je 0x63025af4
mov ecx, 2
call rsi
lea rcx, [0x631b54f0]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x63025ad0
lea rdx, [0x631b550b]
lea rcx, [0x631b550e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b3490]
mov qword [0x631b3d40], rbx
call fcn.6305c720
jmp 0x63025af4
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x631b3d40]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x63025b44
lea rdx, [0x631b5523]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3d40]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b552f]
jmp 0x63025b6b
lea rdx, [0x631b5535]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3d40]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b553c]
mov rcx, qword [0x631b3d40]
call fcn.63022f50
mov rcx, qword [0x631b3d40]
call sub.msvcrt.dll_fflush
jmp 0x63025b93
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x63025dc0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b3500]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x63025e54
lea rcx, [0x631b3500]
call fcn.6305c610
test eax, eax
je 0x63025e54
mov ecx, 2
call rsi
lea rcx, [0x631b7630]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x63025e30
lea rdx, [0x631b764b]
lea rcx, [0x631b764e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b3500]
mov qword [0x631b3db0], rbx
call fcn.6305c720
jmp 0x63025e54
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x631b3db0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x63025ea4
lea rdx, [0x631b7663]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3db0]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b766f]
jmp 0x63025ecb
lea rdx, [0x631b7675]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3db0]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b767c]
mov rcx, qword [0x631b3db0]
call fcn.63022f50
mov rcx, qword [0x631b3db0]
call sub.msvcrt.dll_fflush
jmp 0x63025ef3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x63026010
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b3520]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x630260a4
lea rcx, [0x631b3520]
call fcn.6305c610
test eax, eax
je 0x630260a4
mov ecx, 2
call rsi
lea rcx, [0x631b7ae0]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x63026080
lea rdx, [0x631b7afb]
lea rcx, [0x631b7afe]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b3520]
mov qword [0x631b3dd0], rbx
call fcn.6305c720
jmp 0x630260a4
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x631b3dd0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x630260f4
lea rdx, [0x631b7b13]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3dd0]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b7b1f]
jmp 0x6302611b
lea rdx, [0x631b7b25]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3dd0]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b7b2c]
mov rcx, qword [0x631b3dd0]
call fcn.63022f50
mov rcx, qword [0x631b3dd0]
call sub.msvcrt.dll_fflush
jmp 0x63026143
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x63026150
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b3530]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x630261e4
lea rcx, [0x631b3530]
call fcn.6305c610
test eax, eax
je 0x630261e4
mov ecx, 2
call rsi
lea rcx, [0x631b82f0]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x630261c0
lea rdx, [0x631b830b]
lea rcx, [0x631b830e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b3530]
mov qword [0x631b3de0], rbx
call fcn.6305c720
jmp 0x630261e4
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x631b3de0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x63026234
lea rdx, [0x631b8323]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3de0]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b832f]
jmp 0x6302625b
lea rdx, [0x631b8335]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3de0]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b833c]
mov rcx, qword [0x631b3de0]
call fcn.63022f50
mov rcx, qword [0x631b3de0]
call sub.msvcrt.dll_fflush
jmp 0x63026283
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x63026290
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b3540]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x63026324
lea rcx, [0x631b3540]
call fcn.6305c610
test eax, eax
je 0x63026324
mov ecx, 2
call rsi
lea rcx, [0x631b9ded]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x63026300
lea rdx, [0x631b9e08]
lea rcx, [0x631b9e0b]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b3540]
mov qword [0x631b3df0], rbx
call fcn.6305c720
jmp 0x63026324
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x631b3df0]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x63026374
lea rdx, [0x631b9e20]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3df0]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b9e2c]
jmp 0x6302639b
lea rdx, [0x631b9e32]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3df0]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631b9e39]
mov rcx, qword [0x631b3df0]
call fcn.63022f50
mov rcx, qword [0x631b3df0]
call sub.msvcrt.dll_fflush
jmp 0x630263c3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret

Function at 0x630263d0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x68], rdx
mov r12, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b3560]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x63026464
lea rcx, [0x631b3560]
call fcn.6305c610
test eax, eax
je 0x63026464
mov ecx, 2
call rsi
lea rcx, str.DPF_CAPTURE_CONSOLE_OUTPUT
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x63026440
lea rdx, [0x631ba44b]
lea rcx, str._tmp_dpf.stderr2.log
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b3560]
mov qword [0x631b3e10], rbx
call fcn.6305c720
jmp 0x63026464
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x631b3e10]
mov qword [rsp + 0x28], r8
cmp rcx, rax
jne 0x630264b4
lea rdx, str.e_31m_dpf_
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3e10]
mov rdx, r12
call fcn.63013c90
lea rdx, str.e_0m_n
jmp 0x630264db
lea rdx, str._dpf_
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3e10]
mov rdx, r12
call fcn.63013c90
lea rdx, [0x631ba47c]
mov rcx, qword [0x631b3e10]
call fcn.63022f50
mov rcx, qword [0x631b3e10]
call sub.msvcrt.dll_fflush
jmp 0x63026503
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
Function at 0x63026660
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b34d0]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x630266ef
lea rcx, [0x631b34d0]
call fcn.6305c610
test eax, eax
je 0x630266ef
mov ecx, 2
call rsi
lea rcx, [0x631b7380]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x630266cb
lea rdx, [0x631b739b]
lea rcx, [0x631b739e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b34d0]
mov qword [0x631b3d80], rbx
call fcn.6305c720
jmp 0x630266ef
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov r9, qword [0x631b3d80]
mov rcx, rax
mov qword [rsp + 0x28], r8
cmp rax, r9
jne 0x63026746
lea rdx, [0x631b73b3]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3d80]
lea rdx, [0x631b73bf]
call fcn.63013c90
lea rdx, [0x631b73eb]
jmp 0x63026774
mov rcx, r9
lea rdx, [0x631b73f1]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3d80]
lea rdx, [0x631b73bf]
call fcn.63013c90
lea rdx, [0x631b73f8]
mov rcx, qword [0x631b3d80]
call fcn.63022f50
mov rcx, qword [0x631b3d80]
call sub.msvcrt.dll_fflush
jmp 0x6302679c
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x63026900
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b34f0]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x6302698f
lea rcx, [0x631b34f0]
call fcn.6305c610
test eax, eax
je 0x6302698f
mov ecx, 2
call rsi
lea rcx, [0x631b7580]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6302696b
lea rdx, [0x631b759b]
lea rcx, [0x631b759e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b34f0]
mov qword [0x631b3da0], rbx
call fcn.6305c720
jmp 0x6302698f
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov r9, qword [0x631b3da0]
mov rcx, rax
mov qword [rsp + 0x28], r8
cmp rax, r9
jne 0x630269e6
lea rdx, [0x631b75b3]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3da0]
lea rdx, [0x631b75bf]
call fcn.63013c90
lea rdx, [0x631b75eb]
jmp 0x63026a14
mov rcx, r9
lea rdx, [0x631b75f1]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3da0]
lea rdx, [0x631b75bf]
call fcn.63013c90
lea rdx, [0x631b75f8]
mov rcx, qword [0x631b3da0]
call fcn.63022f50
mov rcx, qword [0x631b3da0]
call sub.msvcrt.dll_fflush
jmp 0x63026a3c
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x63026a50
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov al, byte [0x631b3550]
test al, al
mov rsi, qword [fcn.630214e0]
jne 0x63026adf
lea rcx, [0x631b3550]
call fcn.6305c610
test eax, eax
je 0x63026adf
mov ecx, 2
call rsi
lea rcx, [0x631ba330]
mov rbx, rax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x63026abb
lea rdx, [0x631ba34b]
lea rcx, [0x631ba34e]
call sub.msvcrt.dll_fopen
test rax, rax
cmovne rbx, rax
lea rcx, [0x631b3550]
mov qword [0x631b3e00], rbx
call fcn.6305c720
jmp 0x63026adf
lea rax, [rsp + 0x68]
mov ecx, 1
mov qword [rsp + 0x38], rax
call rsi
mov r8, qword [rsp + 0x38]
mov r9, qword [0x631b3e00]
mov rcx, rax
mov qword [rsp + 0x28], r8
cmp rax, r9
jne 0x63026b36
lea rdx, [0x631ba363]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3e00]
lea rdx, [0x631ba36f]
call fcn.63013c90
lea rdx, [0x631ba39b]
jmp 0x63026b64
mov rcx, r9
lea rdx, [0x631ba3a1]
call fcn.63022f50
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x631b3e00]
lea rdx, [0x631ba36f]
call fcn.63013c90
lea rdx, [0x631ba3a8]
mov rcx, qword [0x631b3e00]
call fcn.63022f50
mov rcx, qword [0x631b3e00]
call sub.msvcrt.dll_fflush
jmp 0x63026b8c
add rsp, 0x48
pop rbx
pop rsi
ret

Function at 0x63028340
Capabilities:
Query environment variable

Disassembly:
mov r8, rdx
test rdx, rdx
je 0x6302835f
cmp byte [rdx], 0
je 0x6302835f
mov rcx, qword [rcx]
test rcx, rcx
je 0x6302837f
mov edx, 1
jmp fcn.6302f700
mov r9d, 0xc0
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, [0x631b742d]
lea rcx, [0x631b73bf]
jmp fcn.63026660
ret
mov rcx, qword [rcx + 8]
jmp 0x63028340

Function at 0x630283a0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [rcx + 0x10]
test eax, eax
jne 0x630283c7
mov r9d, 0x70
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, str.visibleWindows___0
lea rcx, [0x631b73bf]
jmp fcn.63026660
dec eax
mov dword [rcx + 0x10], eax
jne 0x630283d2
mov byte [rcx + 9], 1
ret

Function at 0x630284f0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x20
cmp dl, 1
mov esi, edx
mov rbx, rcx
sbb edx, edx
lea r13, [rbx + 0x20]
lea r14, [rbx + 0x38]
xor ecx, ecx
inc edx
cmp sil, 1
setb cl
call fcn.63029a30
mov byte [rbx + 8], sil
mov qword [rbx], rax
mov dword [rbx + 9], 0x10000
mov dword [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rbx]
mov qword [rbx + 0x28], r13
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], r13
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x38], r14
mov qword [rbx + 0x48], 0
test rcx, rcx
jne 0x63028591
mov r9d, 0x45
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, str.world___nullptr
lea rcx, [0x631b73bf]
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp fcn.63026660
mov rdx, rbx
call fcn.6302f6f0
mov rcx, qword [rbx]
lea r8, [0x631b7461]
mov edx, 1
call fcn.6302f700
nop
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x630286a0
Capabilities:
Query environment variable

Disassembly:
mov r8, rdx
test rdx, rdx
je 0x6302835f
cmp byte [rdx], 0
je 0x6302835f
mov rcx, qword [rcx]
test rcx, rcx
je 0x6302837f
mov edx, 1
jmp fcn.6302f700
mov r9d, 0xc0
lea r8, str.src_ApplicationPrivateData.cpp
lea rdx, [0x631b742d]
lea rcx, [0x631b73bf]
jmp fcn.63026660
ret
mov rcx, qword [rcx + 8]
jmp 0x63028340

Function at 0x63028b90
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
sub rsp, 0x38
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r12, rcx
call fcn.6303c850
lea rdx, [r12 + 0x20]
mov ecx, 1
lea rax, fcn.63028da0
mov qword [r12], rax
mov word [r12 + 0x1c], 0x100
mov dword [r12 + 0x20], 0
call sub.OPENGL32.dll_glGenTextures
cmp dword [r12 + 0x20], 0
jne 0x63028c10
mov r8d, 0x1c3
lea rdx, str.src_OpenGL.cpp
lea rcx, [0x631b7c1d]
add rsp, 0x38
pop r12
pop r13
jmp fcn.63023040
add rsp, 0x38
pop r12
pop r13
ret

Function at 0x63028cc0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
call fcn.6303c890
lea rdx, [r12 + 0x20]
mov ecx, 1
lea rax, fcn.63028da0
mov qword [r12], rax
mov word [r12 + 0x1c], 0x100
mov dword [r12 + 0x20], 0
call sub.OPENGL32.dll_glGenTextures
cmp dword [r12 + 0x20], 0
jne 0x63028d38
mov r8d, 0x1d7
lea rdx, str.src_OpenGL.cpp
lea rcx, [0x631b7c1d]
add rsp, 0x28
pop r12
pop r13
jmp fcn.63023040
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x6302d460
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, rdx
call fcn.63028de0
lea r13, [r12 + 0x28]
lea rdx, [rbx + 0x28]
mov rcx, r13
call fcn.63028de0
mov al, byte [rbx + 0x50]
mov rcx, r13
mov byte [r12 + 0x50], al
mov rax, qword [rbx + 0x58]
mov qword [r12 + 0x58], rax
call fcn.63050fe0
mov rcx, r12
mov r13, rax
call fcn.63050fe0
mov rdx, r13
mov rcx, rax
call fcn.6304f440
test al, al
jne 0x6302d4da
mov r8d, 0x36c
lea rdx, str.src_ImageBaseWidgets.cpp
lea rcx, str.imageNormal.getSize____imageDown.getSize__
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.63023040
add rsp, 0x20
pop rbx
pop r12
pop r13
ret

Function at 0x6302d530
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, rdx
call fcn.63028cc0
lea r13, [r12 + 0x28]
lea rdx, [rbx + 0x28]
mov rcx, r13
call fcn.63028cc0
mov al, byte [rbx + 0x50]
mov rcx, r13
mov byte [r12 + 0x50], al
mov rax, qword [rbx + 0x58]
mov qword [r12 + 0x58], rax
call fcn.63050fe0
mov rcx, r12
mov r13, rax
call fcn.63050fe0
mov rdx, r13
mov rcx, rax
call fcn.6304f440
test al, al
jne 0x6302d5be
mov r8d, 0x363
lea rdx, str.src_ImageBaseWidgets.cpp
lea rcx, str.imageNormal.getSize____imageDown.getSize__
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.63023040
add rsp, 0x20
pop rbx
pop r12
pop r13
ret