joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027fd0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x140027ff5
call fcn.140027ad0
mov rdx, rax
movsxd rcx, dword [rbx + 4]
mov eax, dword [rbx + 8]
add rcx, rcx
cmp dword [rdx + rcx*8 + 8], eax
je 0x14002800d
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rax, qword [rdx + rcx*8]
add rsp, 0x20
pop rbx
ret

Function at 0x140029d90
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0x104
mov rdi, rdx
mov rbx, rcx
jae 0x140021f00
cmp qword [rdx + 0x10], 0x104
jae 0x140021f00
cmp qword [rdx + 0x18], 8
jb 0x140021e46
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x140021e50
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140021e6d
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x18], 8
mov ebp, eax
jb 0x140021e8e
mov rcx, qword [rbx]
jmp 0x140021e91
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140021edf
shr eax, 4
and al, 1
je 0x140021edf
mov rdx, rdi
mov rcx, rbx
call fcn.140020740
test al, al
je 0x140021edc
mov dl, 1
mov rcx, rbx
call fcn.140020420
test al, al
je 0x140021edc
mov rbp, qword [rsp + 0x38]
mov sil, 1
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor sil, sil
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x38]
movzx eax, sil
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.14001e1c0
test al, al
jne 0x140029dca
mov rcx, rbx
call fcn.14001e1c0
test al, al
jne 0x140029dca
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140021e10
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140029de0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
xor ebp, ebp
mov r15, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140029e13
cmp qword [rdx + 0x18], 0x10
mov qword [rdx + 0x10], rbp
jb 0x140029e0d
mov rax, qword [rdx]
jmp 0x140029e10
mov rax, rsi
mov byte [rax], bpl
call fcn.14001e1c0
test al, al
je 0x140029e2c
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
mov rcx, rbx
mov qword [rsp + 0x48], r14
call fcn.140021a10
mov r14, rax
test rax, rax
je 0x140029ef3
mov ecx, 0x10000
mov qword [rsp + 0x40], rdi
call fcn.140081370
mov r9, r14
mov edx, 1
mov r8d, 0x10000
mov rcx, rax
mov rbx, rax
call fcn.14008d890
mov rdi, rax
test rax, rax
je 0x140029ec1
test rsi, rsi
je 0x140029e95
mov rcx, r15
mov r8, rdi
sub rcx, rbp
mov rdx, rbx
cmp rcx, rdi
cmovb r8, rcx
mov rcx, rsi
call fcn.1400036a0
mov rax, r15
sub rax, rbp
cmp rax, rdi
jb 0x140029ed2
mov r9, r14
mov edx, 1
mov r8d, 0x10000
mov rcx, rbx
add rbp, rdi
call fcn.14008d890
mov rdi, rax
test rax, rax
jne 0x140029e75
mov rcx, r14
call fcn.14008d42c
test eax, eax
jne 0x140029ed2
mov dil, 1
jmp 0x140029ed5
xor dil, dil
mov rcx, r14
call fcn.140089aec
test rbx, rbx
je 0x140029eea
mov rcx, rbx
call fcn.1400818c0
movzx eax, dil
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x14002b3a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
cmp byte [rdx + 0x90], 0
mov rdi, r8
mov rbx, rdx
mov r9d, ecx
jne 0x14002b484
mov r8, qword [rbx + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx edx, r9b
xor rdx, rax
movzx eax, byte [rsp + 0x31]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x32]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x33]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rbx + 0x38]
and rcx, rdx
mov rdx, qword [rbx + 0x20]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r10, qword [rdx + rcx*8]
lea r11, [rdx + rcx*8]
nop dword [rax + rax]
cmp r10, r8
jne 0x14002b43a
mov rcx, r8
jmp 0x14002b441
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14002b457
cmp r9d, dword [rax + 0x10]
je 0x14002b451
mov rax, qword [rax]
jmp 0x14002b430
cmovne rax, r8
jmp 0x14002b45a
mov rax, r8
cmp rax, r8
je 0x14002b484
lea rdx, [rax + 0x18]
cmp rdi, rdx
je 0x14002b477
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rdi
call fcn.140003170
mov al, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14002b4a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
movzx r9d, cl
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r10d, ecx
movzx eax, byte [rsp + 0x41]
movabs rcx, 0x100000001b3
imul r9, rcx
mov rdi, r8
mov r11, rdx
xor r9, rax
movzx eax, byte [rsp + 0x42]
imul r9, rcx
xor r9, rax
movzx eax, byte [rsp + 0x43]
imul r9, rcx
xor r9, rax
mov rax, qword [rdx + 0x78]
imul r9, rcx
mov rcx, qword [rdx + 0x60]
mov rdx, qword [rdx + 0x50]
and rax, r9
mov rbx, rax
add rbx, rbx
add rax, rax
mov rbx, qword [rcx + rbx*8]
mov r8, qword [rcx + rax*8]
lea r9, [rcx + rax*8]
nop
cmp r8, rdx
jne 0x14002b52a
mov rax, rdx
jmp 0x14002b531
mov rax, qword [r9 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14002b547
cmp r10d, dword [rbx + 0x10]
je 0x14002b541
mov rbx, qword [rbx]
jmp 0x14002b520
cmovne rbx, rdx
jmp 0x14002b54a
mov rbx, rdx
cmp rbx, rdx
je 0x14002b5af
cmp byte [r11 + 0x90], 0
jne 0x14002b58a
lea rcx, [r11 + 8]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
call fcn.14002bcb0
mov rax, qword [rsp + 0x20]
lea rdx, [rbx + 0x18]
lea rcx, [rax + 0x18]
cmp rcx, rdx
je 0x14002b58a
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.140003170
lea rdx, [rbx + 0x18]
cmp rdi, rdx
je 0x14002b5a2
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rdi
call fcn.140003170
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14002b820
Capabilities:
Check if file exists

Disassembly:
mov r9b, 1
xor r8d, r8d
jmp fcn.14002b830
Function at 0x14002b830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rbp - 8], rax
movzx edi, r9b
mov dword [rbp - 0x50], ecx
movzx r14d, r8b
mov rbx, rdx
call fcn.14002b300
xor r15d, r15d
mov qword [rbp - 0x30], 7
or r9, 0xffffffffffffffff
mov qword [rbp - 0x38], r15
xor r8d, r8d
mov word [rbp - 0x48], r15w
mov rdx, rbx
lea rcx, [rbp - 0x48]
mov rsi, rax
call fcn.140003170
test dil, dil
je 0x14002b8bb
cmp qword [rbp - 0x30], 8
lea rcx, [rbp - 0x48]
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002b8bb
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.1400218c0
test al, al
je 0x14002b930
test r14b, r14b
jne 0x14002b934
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.140020330
mov rbx, rax
lea rax, [rbp - 0x48]
cmp rax, rbx
je 0x14002b910
mov r8, qword [rbp - 0x30]
cmp r8, 8
jb 0x14002b8f3
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
inc r8
call fcn.140004d70
mov rdx, rbx
mov qword [rbp - 0x30], 7
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x38], r15
mov word [rbp - 0x48], r15w
call fcn.140006000
mov r8, qword [rbp - 0x10]
cmp r8, 8
jb 0x14002b92a
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x28]
inc r8
call fcn.140004d70
cmp qword [rbp - 0x38], r15
jne 0x14002b934
xor bl, bl
jmp 0x14002b9b1
call fcn.14001e9c0
mov rdx, rax
lea rcx, [rbp - 0x28]
mov r8, rsi
call fcn.14003e220
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea rcx, [rbp - 0x28]
call fcn.14003de10
lea rbx, [rsi + 8]
lea rcx, [rbx + 8]
call fcn.14002baf0
mov edx, 8
mov rcx, rbx
call fcn.14001f9b0
lea rcx, [rsi + 0x48]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x28]
call fcn.14002bcb0
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x48]
add rcx, 0x18
cmp rcx, rax
je 0x14002b9a6
or r9, 0xffffffffffffffff
lea rdx, [rbp - 0x48]
xor r8d, r8d
call fcn.140003170
mov rcx, rsi
mov bl, 1
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov r8, qword [rbp - 0x30]
cmp r8, 8
jb 0x14002b9cb
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
inc r8
call fcn.140004d70
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400812a0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002bbf0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 1]
mov r11, r8
mov rdx, qword [r10 + 0x18]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [r10 + 8]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x30]
and rcx, r9
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r9, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
cmp r9, r8
jne 0x14002bc6f
mov rcx, r8
jmp 0x14002bc76
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14002bc9e
mov ecx, dword [r11]
cmp dword [rax + 0x10], ecx
je 0x14002bc88
mov rax, qword [rax]
jmp 0x14002bc65
mov ecx, dword [rax + 0x10]
cmp dword [r11], ecx
cmovne rax, r8
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 8]
ret
mov qword [rbx], r8
mov rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x14002bdb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov r10, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, r8
xor r9, rax
mov rsi, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [r10 + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and r8, r9
shl r8, 4
mov rax, qword [rcx + r8]
cmp rbx, rax
je 0x14002be4e
mov rbx, qword [rcx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14002be4e
mov ecx, dword [r11]
nop word [rax + rax]
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x14002bea1
cmp rbx, rax
jne 0x14002be40
mov rax, qword [rdi]
cmp rbx, rax
je 0x14002be83
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x14002bec6
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x14002bef2
mov rdx, rdi
mov rcx, r10
call fcn.14002bfe0
mov rax, rsi
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rax, rbx
jne 0x14002bed0
mov qword [rdx], rdi
jmp 0x14002bef2
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14002bef2
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.14002bf20
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002f600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa8
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdi, [rcx + 8]
mov qword [r11 - 0x50], 0xf
mov r14, r8
mov qword [r11 - 0x58], 0
mov rsi, rdx
mov byte [rsp + 0x70], 0
mov rbp, rcx
lea rdx, [r11 - 0x68]
or rbx, 0xffffffffffffffff
mov rcx, rdi
mov r8, rbx
mov r15, r9
call fcn.140029de0
test al, al
jne 0x14002f770
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x20]
cmp ecx, 1
jbe 0x14002f6a3
cmp eax, 5
jne 0x14002f67e
mov ecx, 0x3e8
jmp 0x14002f6a8
cmp qword [rdi + 0x18], 8
jb 0x14002f688
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0x3e9
mov edx, 0x3eb
cmp eax, 0xffffffff
cmove ecx, edx
jmp 0x14002f6a8
mov ecx, 0x3ea
test r14, r14
je 0x14002f6b0
mov dword [r14], ecx
test r15, r15
je 0x14002f711
test ecx, ecx
je 0x14002f6fd
sub ecx, 0x3e8
je 0x14002f6eb
sub ecx, 1
je 0x14002f6e2
sub ecx, 1
je 0x14002f6d9
cmp ecx, 1
jne 0x14002f6fd
lea rdx, str.File_doesnt_exist.
jmp 0x14002f6f2
lea rdx, str.File_locked.
jmp 0x14002f6f2
lea rdx, str.Cant_read_file.
jmp 0x14002f6f2
lea rdx, str.Access_denied.
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14002f6f2
jmp 0x14002f706
lea rdx, [0x1400bf7bd]
xor ebx, ebx
mov r8, rbx
mov rcx, r15
call fcn.140003450
mov rax, qword [rsp + 0x88]
mov qword [rsi], 0
cmp rax, 0x10
jb 0x14002f811
mov rcx, qword [rsp + 0x70]
inc rax
cmp rax, 0x1000
jb 0x14002f80c
test cl, 0x1f
jne 0x14002f834
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002f83a
sub rcx, rax
cmp rcx, 8
jb 0x14002f840
cmp rcx, 0x27
jbe 0x14002f809
jmp 0x14002f846
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
lea rdx, [rsp + 0x58]
mov r8d, dword [rbp + 0x28]
mov r9, r14
cmovae rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [0x1400c8a40]
mov qword [rsp + 0x48], rcx
movups xmm0, xmmword [rsp + 0x40]
mov qword [rbp + 0x30], rcx
mov rcx, rsi
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], r8d
mov qword [rsp + 0x20], r15
call fcn.14002f190
mov rax, qword [rsp + 0x88]
cmp rax, 0x10
jb 0x14002f811
mov rcx, qword [rsp + 0x70]
inc rax
cmp rax, 0x1000
jb 0x14002f80c
test cl, 0x1f
jne 0x14002f84c
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002f852
sub rcx, rax
cmp rcx, 8
jb 0x14002f858
cmp rcx, 0x27
ja 0x14002f85e
mov rcx, rax
call fcn.140080c40
mov rax, rsi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400812a0
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
Function at 0x1400303d0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rbp - 0x18], rax
movaps xmm0, xmmword [rdx]
lea rcx, [rbp - 0x58]
mov r15, rdx
movdqa xmmword [rbp - 0x38], xmm0
lea rdx, [rbp - 0x38]
mov r14, r8
call fcn.140029630
cmp qword [rax + 0x18], 8
jb 0x140030411
mov rax, qword [rax]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r8, qword [rbp - 0x40]
mov esi, eax
cmp r8, 8
jb 0x14003043b
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x58]
inc r8
call fcn.140004d70
test esi, esi
jne 0x140030446
xor al, al
jmp 0x14003058f
mov qword [rsp + 0xa0], rbx
test r14, r14
je 0x140030585
mov eax, 2
mov qword [rsp + 0x70], rdi
mul rsi
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.140081370
movaps xmm0, xmmword [r15]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x58]
movdqa xmmword [rbp - 0x38], xmm0
mov rbx, rax
call fcn.140029630
cmp qword [rax + 0x18], 8
jb 0x14003049a
mov rax, qword [rax]
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r8, qword [rbp - 0x40]
cmp r8, 8
jb 0x1400304c3
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x58]
inc r8
call fcn.140004d70
xor esi, esi
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], rsi
mov word [rbp - 0x38], si
cmp word [rbx], si
jne 0x1400304e0
mov edi, esi
jmp 0x1400304e9
inc rdi
cmp word [rbx + rdi*2], si
jne 0x1400304e0
mov r8, rdi
lea rcx, [rbp - 0x38]
mov rdx, rbx
call fcn.14000b820
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x58]
call fcn.1400294c0
mov rdx, rax
mov rcx, r14
call fcn.140005080
mov rax, qword [rbp - 0x40]
mov rdi, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x140030553
mov rcx, qword [rbp - 0x58]
inc rax
cmp rax, 0x1000
jb 0x14003054e
test cl, 0x1f
jne 0x1400305a6
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400305ac
sub rcx, rax
cmp rcx, 8
jb 0x1400305b2
cmp rcx, 0x27
ja 0x1400305b8
mov rcx, rax
call fcn.140080c40
mov r8, qword [rbp - 0x20]
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], rsi
mov byte [rbp - 0x58], sil
cmp r8, 8
jb 0x14003057d
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
inc r8
call fcn.140004d70
mov rcx, rbx
call fcn.1400818c0
mov rbx, qword [rsp + 0xa0]
mov al, 1
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400812a0
add rsp, 0x78
pop r15
pop r14
pop rsi
pop rbp
ret
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
Function at 0x1400305c0
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp qword [r8 + 0x18], 0x10
jb 0x1400305e7
mov rax, qword [r8]
jmp 0x1400305ea
mov rax, r8
movaps xmm1, xmmword [rdx]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov rax, qword [r8 + 0x10]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
call fcn.140029630
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x140030628
mov rbx, qword [rax]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140029630
cmp qword [rax + 0x18], 8
jb 0x140030641
mov rax, qword [rax]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8, qword [rsp + 0x58]
test eax, eax
setne bl
cmp r8, 8
jb 0x14003066f
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
inc r8
call fcn.140004d70
mov r8, qword [rsp + 0x78]
xor eax, eax
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rax
mov word [rsp + 0x40], ax
cmp r8, 8
jb 0x1400306a1
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
inc r8
call fcn.140004d70
movzx eax, bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400812a0
add rsp, 0x90
pop rbx
ret

Function at 0x140030db0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x1050
call fcn.140081310
sub rsp, rax
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov rdi, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 0x800
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140030efb
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jne 0x140030e6f
cmp word [rsp + 0x40], ax
jne 0x140030e3e
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000b820
mov eax, ebx
jmp 0x140030efb
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140030e50
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000b820
mov eax, ebx
jmp 0x140030efb
cmp ecx, 2
jne 0x140030ef6
mov r8d, 0x400
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x34], eax
dec eax
cmp eax, 0x3ff
ja 0x140030eef
cmp word [rsp + 0x840], 0
jne 0x140030ec0
xor r8d, r8d
lea rdx, [rsp + 0x840]
mov rcx, rdi
call fcn.14000b820
mov eax, ebx
jmp 0x140030efb
lea rax, [rsp + 0x840]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140030ed0
lea rdx, [rsp + 0x840]
mov rcx, rdi
call fcn.14000b820
mov eax, ebx
jmp 0x140030efb
mov eax, 0xea
jmp 0x140030efb
mov eax, 0x3f4
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400812a0
mov rbx, qword [rsp + 0x1078]
add rsp, 0x1050
pop rdi
ret
Function at 0x140032000
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400dc720]
test rax, rax
je 0x140032065
cmp rax, 1
je 0x140032022
mov rax, qword [0x1400dc720]
test rax, rax
je 0x140032065
mov qword [rsp + 0x20], rbx
call fcn.140034030
mov ecx, dword [0x1400d6d18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140032045
call fcn.140027ad0
movsxd rdx, dword [rbx + 4]
shl rdx, 4
add rdx, rax
mov eax, dword [rbx + 8]
mov rbx, qword [rsp + 0x20]
cmp dword [rdx + 8], eax
jne 0x140032065
mov rax, qword [rdx]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400351a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov r10, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, r8
xor r9, rax
mov rsi, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [r10 + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and r8, r9
shl r8, 4
mov rax, qword [rcx + r8]
cmp rbx, rax
je 0x14003523e
mov rbx, qword [rcx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14003523e
mov ecx, dword [r11]
nop word [rax + rax]
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x140035291
cmp rbx, rax
jne 0x140035230
mov rax, qword [rdi]
cmp rbx, rax
je 0x140035273
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x1400352b6
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x1400352e2
mov rdx, rdi
mov rcx, r10
call fcn.140035470
mov rax, rsi
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rax, rbx
jne 0x1400352c0
mov qword [rdx], rdi
jmp 0x1400352e2
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400352e2
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.1400353b0
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret