joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a060
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1402a0480]
xor rax, rsp
mov qword [rsp + 0x150], rax
movzx edi, r8b
mov qword [rsp + 0x38], 0
mov rbx, rcx
mov qword [rsp + 0x40], 0x80
lea rax, [rsp + 0x48]
mov r9d, 0xf8
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.1400302d0
cmp dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x30]
je 0x14002a0cd
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
jmp 0x14002a10b
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002a0f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14002a0eb
test dil, dil
jne 0x14002a0f7
mov edx, eax
mov rcx, rbx
call fcn.14003de40
jmp 0x14002a106
mov dword [rbx], 0
call fcn.140005800
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
cmp rcx, rax
je 0x14002a11b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401842c0
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret

Function at 0x14002a140
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1402a0480]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x48]
mov rsi, rdx
mov edx, 0x104
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x40], rdx
mov rdi, rcx
mov qword [rsp + 0x38], rax
mov ecx, edx
mov ebx, ecx
cmp rbx, rax
je 0x14002a1b5
jb 0x14002a1ad
cmp rdx, rbx
jae 0x14002a1ad
mov r9d, 2
lea rdx, [rsp + 0x48]
mov r8d, ebx
lea rcx, [rsp + 0x30]
call fcn.140022b50
mov rax, rbx
mov qword [rsp + 0x38], rbx
mov rdx, qword [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
test eax, eax
je 0x14002a21f
mov rax, qword [rsp + 0x38]
mov r8d, ecx
cmp rcx, rax
jbe 0x14002a1dc
mov rdx, qword [rsp + 0x40]
jmp 0x14002a187
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r9, rsi
mov qword [rsp + 0x38], r8
call fcn.1400289e0
cmp dword [rsp + 0x20], 0
je 0x14002a204
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
jmp 0x14002a22f
xor edx, edx
mov rcx, rsi
call fcn.14002cca0
mov dword [rdi], 0
call fcn.140005800
mov qword [rdi + 8], rax
jmp 0x14002a22f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call fcn.14003de40
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
cmp rcx, rax
je 0x14002a244
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1401842c0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002b1a0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rdx
mov qword [rsp + 0x20], 0
mov edx, 0x8000
lea r9, [rsp + 0x20]
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
je 0x14002b1d0
xor al, al
add rsp, 0x40
pop rsi
ret
mov rdx, qword [rsp + 0x20]
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002b1f0
mov r9, rsi
lea rcx, [rsp + 0x28]
call fcn.1400289e0
mov rcx, qword [rsp + 0x20]
mov ebx, dword [rax]
test ebx, ebx
sete dil
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
mov rbx, qword [rsp + 0x60]
jne 0x14002b22e
xor edx, edx
mov rcx, rsi
call fcn.14002cca0
movzx eax, dil
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret

Function at 0x14002b770
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x1402a0480]
xor rax, rsp
mov qword [rsp + 0x850], rax
lea rax, [rsp + 0x48]
mov rsi, rdx
mov edx, 0x400
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov ebx, edx
cmp rbx, rax
je 0x14002b7e3
jb 0x14002b7db
cmp rdx, rbx
jae 0x14002b7db
mov r9d, 2
lea rdx, [rsp + 0x48]
mov r8, rbx
lea rcx, [rsp + 0x30]
call fcn.140022b50
mov rax, rbx
mov qword [rsp + 0x38], rbx
mov rdx, qword [rsp + 0x30]
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x14002b82d
mov rax, qword [rsp + 0x38]
cmp rbx, rax
jbe 0x14002b80b
mov rdx, qword [rsp + 0x40]
jmp 0x14002b7b7
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r9, rsi
mov qword [rsp + 0x38], rbx
mov r8, rbx
call fcn.1400289e0
cmp dword [rax], 0
sete bl
jmp 0x14002b82f
xor bl, bl
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
cmp rcx, rax
je 0x14002b844
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, bl
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.1401842c0
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002c300
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1402a0480]
xor rax, rsp
mov qword [rbp + 0x40], rax
xor r15d, r15d
mov eax, 0x80
mov rsi, rdx
mov qword [rsp + 0x28], r15
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov r14, r8
mov qword [rsp + 0x20], rdx
mov rdi, rcx
mov r8d, r15d
mov ebx, eax
cmp rbx, r8
je 0x14002c3ab
jb 0x14002c3a3
cmp rax, rbx
jae 0x14002c37e
mov r9d, 2
lea rdx, [rsp + 0x38]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.140022b50
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx + rbx*2]
lea rax, [rdx + r8*2]
cmp rax, rcx
je 0x14002c3a3
nop dword [rax + rax]
xor edx, edx
mov word [rax], dx
add rax, 2
cmp rax, rcx
jne 0x14002c390
mov rdx, qword [rsp + 0x20]
mov r8, rbx
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x14002c3e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002c3da
mov rax, qword [rsp + 0x30]
add rbx, rbx
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
jmp 0x14002c350
mov edx, eax
mov rcx, rdi
call fcn.14003de40
jmp 0x14002c480
mov rcx, qword [rsp + 0x28]
lea r8, [rcx + 1]
cmp r8, qword [rsp + 0x30]
jbe 0x14002c413
mov r9d, 2
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140022b50
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov word [rax + rcx*2], r15w
mov rax, 0xffffffffffffffff
inc qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
nop
inc rax
cmp word [rcx + rax*2], r15w
jne 0x14002c430
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 2
je 0x14002c471
sub eax, 1
je 0x14002c46b
sub eax, 1
je 0x14002c471
sub eax, 1
je 0x14002c471
cmp eax, 1
je 0x14002c471
mov dword [rdi], 2
call fcn.1400057f0
jmp 0x14002c47c
mov byte [r14], 1
jmp 0x14002c474
mov byte [r14], r15b
mov dword [rdi], r15d
call fcn.140005800
mov qword [rdi + 8], rax
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x14002c495
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rdi
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1401842c0
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002d190
Capabilities:
Timestomp file

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xa8
mov rax, qword [0x1402a0480]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov ebp, dword [rsp + 0xf0]
mov rsi, rcx
mov r11d, ebp
mov rdi, rdx
shr r11d, 4
mov edx, ebp
mov ecx, r9d
and r11b, 1
mov ebx, r8d
call fcn.14002ceb0
mov ecx, ebx
mov r10d, eax
call fcn.14002cee0
mov byte [rsp + 0x30], r11b
lea rcx, [rsp + 0x50]
mov r9d, eax
mov dword [rsp + 0x28], 0x80
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], r10d
mov rdx, rdi
call fcn.14002d340
cmp dword [rsp + 0x50], 0
je 0x14002d23b
movaps xmm0, xmmword [rsp + 0x50]
lea rdx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x40]
call fcn.1400270a0
or byte [rsi + 8], 1
mov rcx, qword [rax]
mov qword [rsi], rcx
mov qword [rax], 0
jmp 0x14002d2bd
mov rdi, qword [rsp + 0x40]
test bpl, 0x20
je 0x14002d2b6
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x14002d282
xor r9d, r9d
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x14002d2b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.14003de40
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x60], xmm0
jmp 0x14002d220
and byte [rsi + 8], 0xfe
mov qword [rsi], rdi
mov rax, rsi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401842c0
add rsp, 0xa8
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14002d6a0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [r8 + 8]
mov r10, r8
mov r8d, 0xffffffff
mov qword [rsp + 0x20], r9
mov r11, rdx
mov dword [rsp + 0x80], 0
cmp rax, r8
lea r9, [rsp + 0x80]
mov rdx, qword [r10]
mov rbx, rcx
cmovb r8d, eax
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002d735
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x14002d735
cmp eax, 0x26
je 0x14002d735
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.14003de40
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
call fcn.1400270a0
or byte [rbx + 8], 1
mov rcx, qword [rax]
mov qword [rbx], rcx
mov qword [rax], 0
mov rax, rbx
add rsp, 0x60
pop rbx
ret
mov eax, dword [rsp + 0x80]
and byte [rbx + 8], 0xfe
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x60
pop rbx
ret
Function at 0x14002f8b0
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x1402a0480]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], 0x80
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov r9d, 0x104
lea r8, [rsp + 0x30]
call fcn.1400302d0
cmp dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x30]
je 0x14002f915
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
jmp 0x14002f945
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14002f931
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14003de40
jmp 0x14002f940
mov dword [rbx], 0
call fcn.140005800
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
cmp rcx, rax
je 0x14002f955
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401842c0
add rsp, 0x160
pop rbx
ret
Function at 0x14002fab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
movaps xmmword [rsp + 0x250], xmm6
mov rax, qword [0x1402a0480]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rsi, rcx
mov qword [rbp - 0x70], 0x80
mov rax, rdx
mov qword [rbp + 0x30], 0x80
lea rcx, [rbp - 0x68]
mov rdi, r8
mov qword [rbp - 0x80], rcx
lea r8, [rbp - 0x80]
lea rcx, [rbp + 0x38]
xor r15d, r15d
mov qword [rbp + 0x20], rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
mov qword [rbp - 0x78], r15
movzx r14d, r9b
mov qword [rbp + 0x28], r15
call fcn.140030070
movaps xmm6, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm6
call fcn.14002bf10
test al, al
je 0x14002fb72
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov dword [rdi + 0x18], 6
mov qword [rdi + 0x1c], 0xffff
mov dword [rdi + 0x24], r15d
mov qword [rdi + 0x28], r15
mov dword [rsi], r15d
call fcn.140005800
mov qword [rsi + 8], rax
jmp 0x14002fbb2
movq qword [rsp + 0x50], xmm6
lea r8, [rbp + 0x20]
psrldq xmm6, 8
lea rdx, [rsp + 0x50]
mov r9d, 0x104
movq qword [rsp + 0x58], xmm6
lea rcx, [rsp + 0x40]
mov word [rsp + 0x70], 0x105
call fcn.1400302d0
cmp dword [rsp + 0x40], r15d
je 0x14002fbe1
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x38]
cmp rcx, rax
je 0x14002fbc5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
cmp rcx, rax
je 0x14002fc9e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14002fc9e
mov qword [rsp + 0x2a8], rbx
mov ebx, 0x2000000
test r14b, r14b
jne 0x14002fc22
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002fc16
mov r8, rdi
mov rdx, 0xffffffffffffffff
mov rcx, rsi
call fcn.14002b450
jmp 0x14002fc70
bt eax, 0xa
mov eax, 0x2200000
cmovb ebx, eax
mov rcx, qword [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8, rdi
mov rcx, rsi
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14002fc5f
mov rdx, rax
call fcn.14002b450
jmp 0x14002fc70
mov rdx, rbx
call fcn.14002b450
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x38]
cmp rcx, rax
je 0x14002fc83
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x68]
cmp rcx, rax
je 0x14002fc96
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x2a8]
mov rax, rsi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1401842c0
movaps xmm6, xmmword [rsp + 0x250]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003e3d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rbx, qword [0x1402df568]
movzx edi, dl
mov r14, qword [0x1402df570]
mov rsi, rcx
test rbx, rbx
je 0x14003e469
lea rdx, [rbp - 0x39]
call fcn.14003ecc0
cmp qword [rax + 0x18], 0xf
jbe 0x14003e416
mov rax, qword [rax]
movzx r8d, dil
mov rdx, rax
mov rcx, r14
call rbx
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14003e582
mov rcx, qword [rbp - 0x39]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e45f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e45f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140183f7c
jmp 0x14003e582
lea rax, [rbp - 1]
mov qword [rbp - 9], 0x40
mov qword [rbp - 0x19], rax
lea rcx, [rsp + 0x20]
xor eax, eax
mov dword [rbp - 0x51], 1
mov qword [rbp - 0x11], rax
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov byte [rbp - 0x61], al
xor edx, edx
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x71], rax
mov qword [rbp - 0x79], rax
lea rax, [0x1401a8318]
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x19]
mov qword [rbp - 0x49], rax
call fcn.140023e20
mov rax, qword [rbp - 0x71]
mov rcx, qword [rbp - 0x69]
sub rax, rcx
cmp rax, 0xc
jae 0x14003e4f0
mov r8d, 0xc
lea rdx, str.LLVM_ERROR:
lea rcx, [rsp + 0x20]
call fcn.1400250d0
mov rbx, rax
jmp 0x14003e50f
movsd xmm0, qword [str.LLVM_ERROR:]
lea rbx, [rsp + 0x20]
movsd qword [rcx], xmm0
mov eax, dword [0x1401a8c78]
mov dword [rcx + 8], eax
add qword [rbp - 0x69], 0xc
mov rdx, rbx
mov rcx, rsi
call fcn.14003eac0
mov rcx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x18]
sub rax, rcx
cmp rax, 1
jae 0x14003e542
mov r8d, 1
lea rdx, [0x1401a6c30]
mov rcx, rbx
call fcn.1400250d0
jmp 0x14003e54f
movzx eax, word [0x1401a6c30]
mov byte [rcx], al
inc qword [rbx + 0x20]
mov r8, qword [rbp - 0x49]
mov ecx, 2
mov rdx, qword [r8]
mov r8d, dword [r8 + 8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
lea rcx, [rsp + 0x20]
call fcn.140023850
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 1]
cmp rcx, rax
je 0x14003e582
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.140042c40
test dil, dil
je 0x14003e593
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140041f30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x1402a0480]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400420ec
xor r14d, r14d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, str.DumpFolder
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x40], r14d
lea r9d, [r14 + 2]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400420ec
mov qword [rsp + 0x4e0], rbx
lea rcx, [rsp + 0x78]
mov ebx, dword [rsp + 0x40]
mov eax, r14d
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 0x104
test rbx, rbx
je 0x140042019
cmp rbx, 0x104
jbe 0x140041ff4
lea r9d, [r14 + 2]
mov r8d, ebx
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.140022b50
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + rbx*2]
lea rax, [rcx + rax*2]
cmp rax, rdx
je 0x140042014
xor ecx, ecx
mov word [rax], cx
add rax, 2
cmp rax, rdx
jne 0x140042001
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
lea rax, [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x30], rax
lea r8, str.DumpFolder
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400420c8
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
je 0x1400420c8
mov edx, ebx
lea rcx, [rbp + 0x180]
call fcn.140041600
mov rdx, qword [rbp + 0x180]
mov r8d, ebx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp ebx, eax
jne 0x1400420ab
mov rdx, qword [rbp + 0x180]
lea r8d, [rbx - 1]
mov r9, rsi
lea rcx, [rsp + 0x48]
call fcn.1400289e0
cmp dword [rax], r14d
jne 0x1400420ab
mov bl, 1
jmp 0x1400420ad
xor bl, bl
mov rcx, qword [rbp + 0x180]
lea rax, [rbp + 0x198]
cmp rcx, rax
je 0x1400420ca
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400420ca
xor bl, bl
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x78]
cmp rcx, rax
je 0x1400420df
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, bl
mov rbx, qword [rsp + 0x4e0]
jmp 0x1400420ee
xor al, al
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1401842c0
mov rsi, qword [rsp + 0x4e8]
add rsp, 0x4b0
pop r14
pop rdi
pop rbp
ret
Function at 0x140042120
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400421e6
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x30], rax
lea r8, str.DumpType
xor esi, esi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400421e6
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x14004219d
sub eax, 1
je 0x140042191
cmp eax, 1
jne 0x1400421e6
mov dword [rbx], 2
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov dword [rbx], esi
mov al, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsp + 0x60]
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x30], rax
lea r8, str.CustomDumpFlags
lea rax, [rsp + 0x70]
mov r9d, 0x10
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400421e6
mov eax, dword [rsp + 0x70]
mov dword [rbx], eax
mov al, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
xor al, al
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140042a20
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
movups xmm0, xmmword [rcx]
movups xmmword [0x1402df980], xmm0
test dl, dl
jne 0x140042a44
lea rcx, str.LLVM_DISABLE_CRASH_REPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140042a49
call fcn.14004d3f0
call fcn.140041ca0
call fcn.140042a70
lea rcx, [0x1402df930]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400443d0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x1401a9150]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1400444d5
lea rdx, str.MiniDumpWriteDump
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StackWalk64
mov rcx, rbx
mov qword [0x1402df8e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleBase64
mov rcx, rbx
mov qword [0x1402df8e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetSymFromAddr64
mov rcx, rbx
mov qword [0x1402df8f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetLineFromAddr64
mov rcx, rbx
mov qword [0x1402df8f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymGetModuleInfo64
mov rcx, rbx
mov qword [0x1402df900], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymFunctionTableAccess64
mov rcx, rbx
mov qword [0x1402df908], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymSetOptions
mov rcx, rbx
mov qword [0x1402df910], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SymInitialize
mov rcx, rbx
mov qword [0x1402df918], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumerateLoadedModules64
mov rcx, rbx
mov qword [0x1402df920], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402df928], rax
add rsp, 0x20
pop rbx
jmp fcn.1400443a0