joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073950
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov bpl, 1
test dl, dl
je 0x140073a3b
mov rbx, qword [rcx + 8]
movsx rdi, dl
mov al, byte [0x1401502f0]
test al, al
je 0x140073a5d
add rdi, rbx
mov esi, dword [0x140152800]
mov rax, rbx
shr rax, 0x20
je 0x1400739ac
mov rax, rbx
xor edx, edx
div rsi
mov rcx, rax
jmp 0x1400739b4
mov eax, ebx
xor edx, edx
div esi
mov ecx, eax
mov rax, rdi
shr rax, 0x20
je 0x1400739cc
mov rax, rdi
xor edx, edx
div rsi
cmp rcx, rax
jne 0x1400739d7
jmp 0x140073a3b
mov eax, edi
xor edx, edx
div esi
cmp rcx, rax
je 0x140073a3b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
mov rdx, rdi
xor r8d, r8d
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x140073a2b
xor ebp, ebp
cmp qword [rsp + 0x60], 0
je 0x140073a3b
cmp dword [rsp + 0x40], 0
je 0x140073a3b
cmp dword [rsp + 0x50], 0x1000
jne 0x140073a3b
cmp dword [rsp + 0x54], 1
setne bpl
jmp 0x140073a3b
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
xor ebp, ebp
mov rax, qword [rsp + 0x68]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140073a58
mov eax, ebp
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400763e0
lea rcx, [0x1401502f0]
call fcn.1400c0fd4
test eax, eax
je 0x14007398d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c10ab
jmp 0x14007398d
Function at 0x140073aa0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, r9d
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [0x1400f7448]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov al, byte [0x1401502f8]
test al, al
je 0x140073b88
mov ebx, dword [0x140152804]
mov dword [rsp + 0x20], ebp
lea rcx, [rsp + 0x30]
mov rdx, r14
mov r8d, ebx
mov r9, rdi
call fcn.140010a60
mov al, byte [0x140150268]
test al, al
je 0x140073bc2
lea rcx, [0x140151fd8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140152000]
lea rdx, [rsp + 0x30]
call fcn.140073c10
test rax, rax
je 0x140073b49
mov rdi, rax
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, ebx
call fcn.140074260
test eax, eax
je 0x140073b49
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov byte [rsi + 0x10], 1
jmp 0x140073b57
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
lea rcx, [0x140151fd8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x60]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x140073c06
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1401502f8]
call fcn.1400c0fd4
test eax, eax
je 0x140073ad8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x58]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c10ab
jmp 0x140073ad8
lea rcx, [0x140150268]
call fcn.1400c0fd4
test eax, eax
je 0x140073b03
lea rcx, [0x140151fd8]
mov edx, 0xfa0
mov r8d, 0x1000000
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x140152658], 1
lea rcx, [0x140150268]
call fcn.1400c10ab
jmp 0x140073b03
call fcn.1400763e0
int3

Function at 0x140074260
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x68], rax
test edx, edx
je 0x1400742e8
mov rsi, rcx
cmp qword [rcx], 0
jne 0x1400742e3
mov rdi, r8
mov ebp, edx
mov al, byte [0x1401502f8]
test al, al
je 0x14007430c
mov ecx, dword [0x140152804]
xor ebx, ebx
mov eax, ebp
xor edx, edx
div ecx
sub ecx, edx
test edx, edx
cmove ecx, edx
add ecx, ebp
mov dword [rsi + 8], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, dword [rsi + 8]
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
mov rcx, rsi
mov rdx, rax
call fcn.140074350
mov qword [rsi], rax
test rax, rax
je 0x1400742ea
mov ebx, dword [rsi + 8]
jmp 0x1400742ea
xor ebx, ebx
mov rax, qword [rsp + 0x68]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140074307
mov eax, ebx
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400763e0
lea rcx, [0x1401502f8]
call fcn.1400c0fd4
test eax, eax
je 0x140074298
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c10ab
jmp 0x140074298
Function at 0x140074710
Capabilities:
Allocate or change rwx memory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebx, dword [rdx + 0x10]
shl ebx, 7
mov rcx, rdx
mov edx, ebx
mov r8d, 0x80
call fcn.140074860
test al, al
je 0x1400747d5
mov ecx, ebx
add rcx, qword [rdi]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x28]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0x80
mov byte [rsp + 0x4c], 1
mov edx, 0x80
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400747a3
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1400747ed
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x28]
mov r8b, byte [rsp + 0x4c]
test rdx, rdx
je 0x140074804
test rbx, rbx
je 0x140074804
test ecx, ecx
je 0x140074804
test r8b, r8b
jne 0x140074800
jmp 0x140074804
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x30], 0
jmp 0x14007482f
mov ecx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov r8b, byte [rsp + 0x4c]
add dword [rdi + 0x10], 1
mov qword [rsi], rax
mov dword [rsi + 8], ecx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rbx
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0x20], eax
mov eax, dword [rsp + 0x44]
mov dword [rsi + 0x24], eax
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x28], eax
mov byte [rsi + 0x2c], r8b
mov byte [rsi + 0x30], 1
mov rax, qword [rsp + 0x50]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x14007484c
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400763e0
int3
Function at 0x140074860
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, qword [0x1400f7448]
mov rax, qword [rbx]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rcx]
test rdi, rdi
je 0x1400748e3
mov rsi, rcx
add edx, r8d
add edx, 0xffffffff
mov ecx, dword [rcx + 0xc]
mov al, 1
cmp edx, ecx
jb 0x1400748e5
cmp ecx, dword [rsi + 8]
jae 0x1400748e3
add rdi, rcx
mov al, byte [0x1401502f0]
test al, al
je 0x140074902
mov edx, dword [0x140152800]
mov rcx, rdi
mov r8d, 0x1000
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400748db
mov al, byte [0x1401502f0]
test al, al
je 0x140074938
mov eax, dword [0x140152800]
add dword [rsi + 0xc], eax
test rdi, rdi
setne al
jmp 0x1400748e5
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
mov rdx, qword [rbx]
cmp rdx, rcx
jne 0x1400748fd
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
call fcn.1400763e0
lea rcx, [0x1401502f0]
call fcn.1400c0fd4
test eax, eax
je 0x1400748a5
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c10ab
jmp 0x1400748a5
lea rcx, [0x1401502f0]
call fcn.1400c0fd4
test eax, eax
je 0x1400748d2
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c10ab
jmp 0x1400748d2
Function at 0x140075fd0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14, rcx
mov r15, qword [0x1400f7448]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov al, byte [0x1401502f0]
test al, al
je 0x140076088
mov rdi, qword [r14 + 8]
mov rsi, qword [r14 + 0x10]
test rsi, rsi
je 0x14007604e
mov r13d, dword [0x140152800]
shl rsi, 4
xor ebx, ebx
lea r12, [rsp + 0x20]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop dword [rax]
mov rcx, qword [rdi + rbx + 8]
mov r8d, dword [rdi + rbx]
mov rdx, r13
mov r9, r12
call rbp
add rbx, 0x10
cmp rsi, rbx
jne 0x140076030
mov rdi, qword [r14 + 8]
mov qword [r14 + 0x10], 0
add r14, 0x20
cmp rdi, r14
je 0x140076067
mov rcx, rdi
call sub.mozglue.dll_free
mov rax, qword [rsp + 0x50]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x1400760c2
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1401502f0]
call fcn.1400c0fd4
test eax, eax
je 0x140076003
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c10ab
jmp 0x140076003
call fcn.1400763e0
int3
Function at 0x14008c210
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
xor edi, edi
cmp qword [rcx + 0x78], 0
je 0x14008c359
mov rsi, rcx
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x14008c3de
mov eax, dword [rsi + 0x9c]
test al, 0x10
jne 0x14008c274
test al, 8
je 0x14008c359
mov rax, qword [rsi + 0x90]
mov qword [rsp + 0x30], rax
cmp byte [rsi + 0xa2], 0
je 0x14008c312
mov rbx, qword [rsi + 0x20]
sub rbx, qword [rsi + 0x18]
jmp 0x14008c338
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x28]
je 0x14008c29a
mov rax, qword [rsi]
mov edi, 0xffffffff
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x68]
cmp eax, 0xffffffff
je 0x14008c359
lea r14, [rsi + 0x88]
lea r15, [rsp + 0x30]
nop word cs:[rax + rax]
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
mov r9, qword [rsi + 0x60]
add r9, r8
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, r14
call qword [rax + 0x28]
mov ebx, eax
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi + 0x40]
mov r9, qword [rsi + 0x78]
sub rdi, rcx
mov edx, 1
mov r8, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, rdi
jne 0x14008c354
cmp ebx, 1
je 0x14008c2b0
cmp ebx, 2
je 0x14008c354
mov rcx, qword [rsi + 0x78]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov edi, 0
test eax, eax
jne 0x14008c354
jmp 0x14008c359
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r9, qword [rsi + 0x48]
mov rbx, qword [rsi + 0x50]
sub rbx, r9
test eax, eax
jle 0x14008c3a0
mov rcx, qword [rsi + 0x20]
sub rcx, qword [rsi + 0x18]
mov eax, eax
imul rcx, rax
add rbx, rcx
xor ebp, ebp
mov rcx, qword [rsi + 0x78]
neg rbx
mov rdx, rbx
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
je 0x14008c368
mov edi, 0xffffffff
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
test bpl, bpl
je 0x14008c379
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x88], rax
mov rax, qword [rsi + 0x40]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x9c], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
jmp 0x14008c359
mov rax, qword [rsi + 0x18]
cmp rax, qword [rsi + 0x20]
je 0x14008c338
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x80]
sub rax, qword [rsi + 0x10]
mov rbp, qword [rcx]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
call qword [rbp + 0x40]
cdqe
add rbx, qword [rsi + 0x48]
add rax, qword [rsi + 0x40]
sub rbx, rax
mov bpl, 1
jmp 0x14008c33a
call fcn.14008bc60
int3
Function at 0x1400c1be0
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call fcn.1400c2de0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x1400ccc70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rdi
lea rcx, str.libcabi:
mov edx, 0xb
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov ecx, 2
call rdi
mov r8, qword [rsp + 0x20]
mov rcx, rax
mov rdx, rsi
call fcn.1400c2de0
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x1400cd100
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r8, qword [sym.firefox.exe_Ordinal_0]
movzx edx, word [r8]
cmp edx, 0x5a4d
jne 0x1400cd16d
movsxd rdx, dword [r8 + 0x3c]
cmp dword [r8 + rdx], 0x4550
jne 0x1400cd16d
add r8, rdx
movzx edx, word [r8 + 0x18]
cmp edx, 0x20b
jne 0x1400cd16d
movzx edx, word [r8 + 6]
test edx, edx
je 0x1400cd16d
sub rcx, qword [sym.firefox.exe_Ordinal_0]
movzx eax, word [r8 + 0x14]
add rax, r8
add rax, 0x18
jmp 0x1400cd159
add rax, 0x28
add edx, 0xffffffff
je 0x1400cd16d
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x1400cd150
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x1400cd150
jmp 0x1400cd16f
xor eax, eax
ret

Function at 0x1400cd170
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [sym.firefox.exe_Ordinal_0]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x1400cd1a6
movsxd r8, dword [rcx + 0x3c]
cmp dword [rcx + r8], 0x4550
jne 0x1400cd1a6
movzx edx, word [rcx + r8 + 0x18]
cmp edx, 0x20b
jne 0x1400cd1a6
movzx eax, word [rcx + r8 + 6]
ret

Function at 0x1400cd220
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [sym.firefox.exe_Ordinal_0]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400cd24c
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400cd24c
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400cd24e
xor eax, eax
ret
Function at 0x1400cd9f0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.1400cde40
test al, al
je 0x1400cda2d
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:__Unwind_SetGR_context_p__reg_d__value0x_0llx__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.1400ccfc0
mov rcx, rbx
mov edx, edi
mov r8, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.1400cdf20

Function at 0x1400cdaa0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.1400cde40
test al, al
je 0x1400cdad5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:__Unwind_SetIP_context_p__value0x_0llx__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.1400ccfc0
mov rcx, rdi
mov edx, 0xffffffff
mov r8, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400cdf20
Function at 0x1400cdc70
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rdx
mov rsi, rcx
cmp byte [0x140152262], 1
jne 0x1400cdc96
mov al, byte [0x140152261]
test al, al
jne 0x1400cdcba
jmp 0x1400cdcda
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140152261]
mov byte [0x140152262], 1
test al, al
je 0x1400cdcda
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_init_local_cursor_p__context_p__n
mov rcx, rax
mov r8, rsi
mov r9, rdi
call fcn.1400ccfc0
lea rax, [0x14010d8a0]
mov qword [rsi], rax
lea rax, [0x1401520b0]
mov qword [rsi + 8], rax
xorps xmm0, xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], 0
lea rax, [rsi + 0x580]
lea rcx, [rsi + 0xb0]
movaps xmmword [rsi + 0x580], xmm0
movaps xmmword [rsi + 0x590], xmm0
movaps xmmword [rsi + 0x5a0], xmm0
movaps xmmword [rsi + 0x5b0], xmm0
movaps xmmword [rsi + 0x5c0], xmm0
movaps xmmword [rsi + 0x5d0], xmm0
movaps xmmword [rsi + 0x5e0], xmm0
movaps xmmword [rsi + 0x5f0], xmm0
movaps xmmword [rsi + 0x600], xmm0
movaps xmmword [rsi + 0x610], xmm0
movaps xmmword [rsi + 0x620], xmm0
movaps xmmword [rsi + 0x630], xmm0
movaps xmmword [rsi + 0x640], xmm0
movups xmmword [rsi + 0x649], xmm0
mov qword [rsi + 0x80], rcx
mov qword [rsi + 0x98], rax
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
movups xmm0, xmmword [rdi + 0x10]
movdqu xmm1, xmmword [rdi + 0x20]
movdqu xmm2, xmmword [rdi + 0x30]
movups xmm3, xmmword [rdi + 0x40]
movups xmm4, xmmword [rdi + 0x50]
movups xmm5, xmmword [rdi + 0x60]
movups xmm6, xmmword [rdi + 0x70]
mov rdx, qword [rdi + 0x80]
mov dword [rsi + 0xe0], 0x10000b
mov qword [rsi + 0x128], rax
movaps xmmword [rsi + 0x130], xmm0
mov qword [rsi + 0x140], rcx
pshufd xmm0, xmm2, 0x4e
movdqu xmmword [rsi + 0x148], xmm0
pshufd xmm0, xmm1, 0x4e
movdqu xmmword [rsi + 0x158], xmm0
movups xmmword [rsi + 0x168], xmm3
movups xmmword [rsi + 0x178], xmm4
movups xmmword [rsi + 0x188], xmm5
movups xmmword [rsi + 0x198], xmm6
mov qword [rsi + 0x1a8], rdx
test rdx, rdx
je 0x1400cde21
mov rcx, rsi
call fcn.1400c46f0
test al, al
jne 0x1400cde28
mov byte [rsi + 0x658], 1
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400cde40
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x140152262], 1
jne 0x1400cde58
mov al, byte [0x140152261]
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140152261]
mov byte [0x140152262], 1
add rsp, 0x28
ret
Function at 0x1400cde80
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov edi, edx
mov rbx, rcx
cmp byte [0x140152262], 1
jne 0x1400cdea4
mov al, byte [0x140152261]
test al, al
jne 0x1400cdec8
jmp 0x1400cdeed
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140152261]
mov byte [0x140152262], 1
test al, al
je 0x1400cdeed
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x20], rsi
lea rdx, str.libunwind:___unw_get_reg_cursor_p__regNum_d__value_p__n
mov rcx, rax
mov r8, rbx
mov r9d, edi
call fcn.1400ccfc0
mov rax, qword [rbx]
mov rcx, rbx
mov edx, edi
call qword [rax + 0x10]
mov ecx, eax
mov eax, 0xffffe672
test cl, cl
je 0x1400cdf13
mov rax, qword [rbx]
mov rcx, rbx
mov edx, edi
call qword [rax + 0x18]
mov qword [rsi], rax
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400cdf20
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rbx, r8
mov edi, edx
mov rsi, rcx
cmp byte [0x140152262], 1
jne 0x1400cdf45
mov al, byte [0x140152261]
test al, al
jne 0x1400cdf69
jmp 0x1400cdf8e
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140152261]
mov byte [0x140152262], 1
test al, al
je 0x1400cdf8e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x20], rbx
lea rdx, str.libunwind:___unw_set_reg_cursor_p__regNum_d__value0x_llx__n
mov rcx, rax
mov r8, rsi
mov r9d, edi
call fcn.1400ccfc0
mov rax, qword [rsi]
mov rcx, rsi
mov edx, edi
call qword [rax + 0x10]
mov ebp, 0xffffe672
test al, al
je 0x1400cdffe
mov rax, qword [rsi]
mov rcx, rsi
mov edx, edi
mov r8, rbx
call qword [rax + 0x20]
xor ebp, ebp
cmp edi, 0xffffffff
jne 0x1400cdffe
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [rax + 0x48]
mov rax, qword [rsi]
xor ebp, ebp
mov rcx, rsi
xor edx, edx
call qword [rax + 0x68]
cmp qword [rsp + 0x50], 0
je 0x1400cdffe
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xfffffffe
call qword [rax + 0x18]
add rax, qword [rsp + 0x50]
mov rbx, qword [rsi]
mov rcx, rsi
mov edx, 0xfffffffe
mov r8, rax
call qword [rbx + 0x20]
mov eax, ebp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400ce160
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [0x140152262], 1
jne 0x1400ce17d
mov al, byte [0x140152261]
test al, al
jne 0x1400ce1a1
jmp 0x1400ce1be
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140152261]
mov byte [0x140152262], 1
test al, al
je 0x1400ce1be
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_step_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.1400ccfc0
mov rax, qword [rsi]
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp qword [rax + 0x40]
Function at 0x1400ce1d0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
cmp byte [0x140152262], 1
jne 0x1400ce1f1
mov al, byte [0x140152261]
test al, al
jne 0x1400ce215
jmp 0x1400ce235
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140152261]
mov byte [0x140152262], 1
test al, al
je 0x1400ce235
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.1400ccfc0
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, rsi
call qword [rax + 0x48]
xor ecx, ecx
cmp qword [rsi + 8], 0
mov eax, 0xffffe66b
cmovne eax, ecx
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400ce260
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [0x140152262], 1
jne 0x1400ce27d
mov al, byte [0x140152261]
test al, al
jne 0x1400ce2a1
jmp 0x1400ce2be
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140152261]
mov byte [0x140152262], 1
test al, al
je 0x1400ce2be
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.libunwind:___unw_resume_cursor_p__n
mov rcx, rax
mov r8, rsi
call fcn.1400ccfc0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
mov eax, 0xffffe674
add rsp, 0x20
pop rsi
ret

Function at 0x1400ce2e0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp byte [0x140152262], 1
jne 0x1400ce30a
mov al, byte [0x140152261]
test al, al
jne 0x1400ce32e
jmp 0x1400ce352
lea rcx, str.LIBUNWIND_PRINT_APIS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140152261]
mov byte [0x140152262], 1
test al, al
je 0x1400ce352
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], edi
lea rdx, str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
mov rcx, rax
mov r8, rsi
mov r9, rbx
call fcn.1400ccfc0
mov rax, qword [rsi]
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [rax + 0x60]
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400ce4f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x140152251], 1
jne 0x1400ce508
mov al, byte [0x140152250]
add rsp, 0x28
ret
lea rcx, str.LIBUNWIND_PRINT_UNWINDING
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
setne al
setne byte [0x140152250]
mov byte [0x140152251], 1
add rsp, 0x28
ret