joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bf33
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001bf5e
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001c017
mov ecx, eax
mov al, 1
test cl, 0x10
jne 0x14001c0b0
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::EnsureDirectory_const_base::FilePath__
lea r8, str..._.._.._third_party_crashpad_client_crash_report_database_win.cc
lea rdi, [rbp - 0x58]
mov rcx, rdi
mov r9d, 0x255
call fcn.14004b54e
lea rdx, str.GetFileAttributes
mov rcx, rdi
call fcn.140002bc9
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14001bfc1
mov rax, qword [rsi]
lea rdx, [rbp + 0xc0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xd0]
call fcn.14004c790
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call fcn.140003113
lea rdx, str.:_not_a_directory
mov rcx, rax
call fcn.140002bc9
lea rcx, [rbp + 0xd0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004ba62
jmp 0x14001c0ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace_::EnsureDirectory_const_base::FilePath__
lea r8, str..._.._.._third_party_crashpad_client_crash_report_database_win.cc
lea rbx, [rbp - 0x58]
mov rcx, rbx
mov r9d, 0x251
call fcn.14004b54e
mov dword [rbx + 0x100], edi
lea rdx, str.GetFileAttributes
mov rcx, rbx
call fcn.140002bc9
mov rdi, rax
cmp qword [rsi + 0x18], 8
mov rax, rsi
jb 0x14001c06c
mov rax, qword [rsi]
lea rdx, [rbp + 0xb0]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xd0]
call fcn.14004c790
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call fcn.140003113
lea rcx, [rbp + 0xd0]
call fcn.1400049ea
lea rcx, [rbp - 0x58]
call fcn.14004bba4
xor eax, eax
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001e6a0
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x120], 0xfffffffffffffffe
mov rdi, rdx
mov r13, rcx
lea rsi, [rbp + 0xf8]
mov rdx, rsi
call fcn.14001c714
mov r14, qword [rsi]
test r14, r14
je 0x14001e753
and qword [rbp + 0x110], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x118], 7
mov qword [rbp + 0xe8], rdi
movups xmm0, xmmword [rdi]
movaps xmmword [rbp - 0x50], xmm0
mov rbx, qword [r14 + 0x50]
mov rdi, qword [r14 + 0x58]
cmp rbx, rdi
je 0x14001e7bf
lea rax, [r14 + 0x50]
mov qword [rbp + 0xf0], rax
lea r12, [rbp - 0x50]
mov r15d, 0x80
mov rsi, rbx
mov rcx, rbx
mov rdx, r12
call fcn.14000cb40
test al, al
jne 0x14001e758
add rbx, r15
add rsi, r15
cmp rbx, rdi
jne 0x14001e737
jmp 0x14001e7bf
push 3
pop rsi
jmp 0x14001e7ce
cmp rbx, rdi
je 0x14001e7bf
add rbx, 0x10
lea r12, [rbp + 0x100]
mov rcx, r12
mov rdx, rbx
call fcn.140011a3a
lea rdx, [rbp + 0xc8]
mov rcx, qword [rbp + 0xf0]
mov r8, rsi
call fcn.14001fb2a
mov byte [r14 + 0x48], 1
cmp qword [rbp + 0x118], 8
jb 0x14001e79f
mov r12, qword [rbp + 0x100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14001e7f0
xor esi, esi
mov rcx, r13
mov rdx, qword [rbp + 0xe8]
call fcn.14001ad48
jmp 0x14001e7c2
push 1
pop rsi
lea rcx, [rbp + 0x100]
call fcn.140004a1e
lea rcx, [rbp + 0xf8]
call fcn.14001d698
mov eax, esi
add rsp, 0x1a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x20], 2
lea rdx, str.virtual_crashpad::_anonymous_namespace_::OperationStatus___cdecl_crashpad::CrashReportDatabaseWin::DeleteReport_const_crashpad::UUID__
lea r8, str..._.._.._third_party_crashpad_client_crash_report_database_win.cc
lea rcx, [rbp - 0x50]
mov r9d, 0x370
call fcn.14004b54e
lea rcx, [rbp - 0x50]
mov dword [rcx + 0x100], esi
lea rdx, str.DeleteFile
call fcn.140002bc9
mov rsi, rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 0x118], 8
jb 0x14001e850
mov rcx, qword [rbp + 0x100]
jmp 0x14001e857
lea rcx, [rbp + 0x100]
lea rdx, [rbp + 0xb8]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
lea rcx, [rbp + 0xc8]
call fcn.14004c790
lea rdx, [rbp + 0xc8]
mov rcx, rsi
call fcn.140003113
lea rcx, [rbp + 0xc8]
call fcn.1400049ea
lea rcx, [rbp - 0x50]
call fcn.14004bba4
push 2
jmp 0x14001e7c1

Function at 0x14001f8d8
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x28], 8
jb 0x14001f8e9
mov rcx, qword [rcx + 0x10]
jmp 0x14001f8ed
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret

Function at 0x14001f90c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [rcx + 0x78]
cmp eax, edx
je fcn.14001f8d8
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
ret
Function at 0x140024c72
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov dword [rcx + 0x78], 0x1003f
mov eax, dword [rdx + 0x234]
mov dword [rcx + 0x7c], eax
mov eax, dword [rdx + 0x238]
mov dword [rcx + 0x80], eax
mov eax, dword [rdx + 0x23c]
mov dword [rcx + 0x84], eax
mov eax, dword [rdx + 0x240]
mov dword [rcx + 0x88], eax
mov eax, dword [rdx + 0x24c]
mov dword [rcx + 0x8c], eax
mov eax, dword [rdx + 0x250]
mov dword [rcx + 0x90], eax
lea rdx, [rcx + 0x94]
lea rbx, [rdi + 0x34]
mov rcx, rbx
call fcn.140051c74
movzx eax, word [rdi + 0x30]
mov dword [rsi + 0x104], eax
movzx eax, word [rdi + 0x2e]
mov dword [rsi + 0x108], eax
movzx eax, word [rdi + 0x2c]
mov dword [rsi + 0x10c], eax
movzx eax, word [rdi + 0x2a]
mov dword [rsi + 0x110], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x114], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x118], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 0x11c], eax
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0x120], eax
mov eax, dword [rdi + 8]
mov dword [rsi + 0x124], eax
mov eax, dword [rdi]
mov dword [rsi + 0x128], eax
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0x12c], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x130], eax
movzx eax, word [rdi + 0x28]
mov dword [rsi + 0x134], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x138], eax
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x13c], eax
movzx eax, word [rdi + 0x32]
mov dword [rsi + 0x140], eax
add rsi, 0x144
mov r8d, 0x200
mov rcx, rsi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14006f9f0
Function at 0x14003fabe
Capabilities:
Parse pe header

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov r14, r8
mov rbx, rdx
mov rsi, rcx
cmp byte [rcx + 0x38], 0
je 0x14003faf3
mov rdx, qword [rsi + 0x28]
jmp 0x14003faf6
mov edx, dword [rsi + 0x20]
push 0x40
pop r8
lea r9, [rbp - 0x58]
mov rcx, rsi
call fcn.140045144
test al, al
je 0x14003fb25
cmp word [rbp - 0x58], 0x5a4d
jne 0x14003fb6c
cmp byte [rsi + 0x38], 0
je 0x14003fbb3
mov rax, qword [rsi + 0x28]
jmp 0x14003fbb6
mov dword [rsp + 0x20], 1
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_NtHeadersType___crashpad::WinVMAddress___const__NtHeadersType___IMAGE_NT_HEADERS64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rbp - 0x18]
mov rcx, rdi
mov r9d, 0x154
call fcn.14004b54e
lea rdx, str.could_not_read_dos_header_from
mov rcx, rdi
call fcn.140002bc9
mov rcx, rax
mov rdx, rsi
call fcn.140003113
jmp 0x14003fc76
mov dword [rsp + 0x20], 1
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_NtHeadersType___crashpad::WinVMAddress___const__NtHeadersType___IMAGE_NT_HEADERS64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rbp - 0x18]
mov rcx, rdi
mov r9d, 0x15a
call fcn.14004b54e
lea rdx, str.invalid_e_magic_in_dos_header_of
mov rcx, rdi
call fcn.140002bc9
mov rcx, rax
mov rdx, rsi
call fcn.140003113
jmp 0x14003fc76
mov eax, dword [rsi + 0x20]
movsxd rdi, dword [rbp - 0x1c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, rbx
call fcn.140045144
test al, al
je 0x14003fbf0
cmp dword [rbx], 0x4550
jne 0x14003fc34
mov al, 1
test r14, r14
je 0x14003fc81
mov qword [r14], rdi
jmp 0x14003fc81
mov dword [rsp + 0x20], 1
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_NtHeadersType___crashpad::WinVMAddress___const__NtHeadersType___IMAGE_NT_HEADERS64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rbp - 0x18]
mov rcx, rdi
mov r9d, 0x162
call fcn.14004b54e
lea rdx, str.could_not_read_nt_headers_from
mov rcx, rdi
call fcn.140002bc9
mov rcx, rax
mov rdx, rsi
call fcn.140003113
jmp 0x14003fc76
mov dword [rsp + 0x20], 1
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_NtHeadersType___crashpad::WinVMAddress___const__NtHeadersType___IMAGE_NT_HEADERS64_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rbp - 0x18]
mov rcx, rdi
mov r9d, 0x168
call fcn.14004b54e
lea rdx, str.invalid_signature_in_nt_headers_of
mov rcx, rdi
call fcn.140002bc9
mov rcx, rax
mov rdx, rsi
call fcn.140003113
lea rcx, [rbp - 0x18]
call fcn.14004ba62
xor eax, eax
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x14003fd40
Capabilities:
Parse pe header

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov r14, r8
mov rbx, rdx
mov rsi, rcx
cmp byte [rcx + 0x38], 0
je 0x14003fd75
mov rdx, qword [rsi + 0x28]
jmp 0x14003fd78
mov edx, dword [rsi + 0x20]
push 0x40
pop r8
lea r9, [rbp - 0x58]
mov rcx, rsi
call fcn.140045144
test al, al
je 0x14003fda7
cmp word [rbp - 0x58], 0x5a4d
jne 0x14003fdee
cmp byte [rsi + 0x38], 0
je 0x14003fe35
mov rax, qword [rsi + 0x28]
jmp 0x14003fe38
mov dword [rsp + 0x20], 1
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_NtHeadersType___crashpad::WinVMAddress___const__NtHeadersType___IMAGE_NT_HEADERS_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rbp - 0x18]
mov rcx, rdi
mov r9d, 0x154
call fcn.14004b54e
lea rdx, str.could_not_read_dos_header_from
mov rcx, rdi
call fcn.140002bc9
mov rcx, rax
mov rdx, rsi
call fcn.140003113
jmp 0x14003fef8
mov dword [rsp + 0x20], 1
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_NtHeadersType___crashpad::WinVMAddress___const__NtHeadersType___IMAGE_NT_HEADERS_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rbp - 0x18]
mov rcx, rdi
mov r9d, 0x15a
call fcn.14004b54e
lea rdx, str.invalid_e_magic_in_dos_header_of
mov rcx, rdi
call fcn.140002bc9
mov rcx, rax
mov rdx, rsi
call fcn.140003113
jmp 0x14003fef8
mov eax, dword [rsi + 0x20]
movsxd rdi, dword [rbp - 0x1c]
add rdi, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, rdi
mov r9, rbx
call fcn.140045144
test al, al
je 0x14003fe72
cmp dword [rbx], 0x4550
jne 0x14003feb6
mov al, 1
test r14, r14
je 0x14003ff03
mov qword [r14], rdi
jmp 0x14003ff03
mov dword [rsp + 0x20], 1
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_NtHeadersType___crashpad::WinVMAddress___const__NtHeadersType___IMAGE_NT_HEADERS_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rbp - 0x18]
mov rcx, rdi
mov r9d, 0x162
call fcn.14004b54e
lea rdx, str.could_not_read_nt_headers_from
mov rcx, rdi
call fcn.140002bc9
mov rcx, rax
mov rdx, rsi
call fcn.140003113
jmp 0x14003fef8
mov dword [rsp + 0x20], 1
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_NtHeadersType___crashpad::WinVMAddress___const__NtHeadersType___IMAGE_NT_HEADERS_
lea r8, str..._.._.._third_party_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rbp - 0x18]
mov rcx, rdi
mov r9d, 0x168
call fcn.14004b54e
lea rdx, str.invalid_signature_in_nt_headers_of
mov rcx, rdi
call fcn.140002bc9
mov rcx, rax
mov rdx, rsi
call fcn.140003113
lea rcx, [rbp - 0x18]
call fcn.14004ba62
xor eax, eax
add rsp, 0x170
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140045b80
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
lea rax, [rsp + 0x40]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x44]
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete al
jne 0x140045bc6
mov ecx, dword [rsp + 0x3c]
mov dword [rsi], ecx
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140045ca0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe0], 0xfffffffffffffffe
lea rsi, [rbp + 0xb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsi + 0x20]
cmp ecx, 0x100
jb 0x140045d1d
mov dword [rsp + 0x20], 1
lea rdx, str.virtual_uint8_t___cdecl_crashpad::internal::SystemSnapshotWin::CPUCount_void__const
lea r8, str..._.._.._third_party_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rbp - 0x50]
mov rcx, rsi
mov r9d, 0x10a
call fcn.14004b54e
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov rcx, rsi
call fcn.140002bc9
lea rcx, [rbp - 0x50]
call fcn.14004ba62
mov ecx, dword [rbp + 0xd0]
cmp ecx, 0x100
mov eax, 0xff
cmovb eax, ecx
add rsp, 0x168
pop rsi
pop rbp
ret

Function at 0x14004bd28
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], 0xfffffffffffffffe
test rdx, rdx
je 0x14004bdd9
mov rsi, rdx
mov rdi, rcx
mov r12d, 0xffffffff
lea rbx, [rbp - 0x50]
lea r13, str.Check_failed:_success
lea r14, [0x14009fc16]
cmp rsi, r12
mov r15d, 0xffffffff
cmovb r15, rsi
mov rcx, rdi
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14004bdd1
mov dword [rsp + 0x20], 4
mov rcx, rbx
lea rdx, str.void___cdecl_base::RandBytes_void___size_t_
lea r8, str..._.._.._third_party_crashpad_third_party_mini_chromium_base_rand_util.cc
push 0x7d
pop r9
call fcn.14004b54e
mov rcx, rbx
mov rdx, r13
call fcn.140002bc9
mov rcx, rax
mov rdx, r14
call fcn.140002bc9
mov rcx, rbx
call fcn.14004ba62
add rdi, r15
sub rsi, r15
jne 0x14004bd75
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140063cb4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x1400c0208]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x1400a3360]
mov rbp, rcx
call fcn.1400714a0
xor edi, edi
test rax, rax
je 0x140063d9a
mov ebx, edi
call fcn.1400629dc
mov r14d, dword [rax]
call fcn.1400629dc
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.140071110
mov rsi, rax
test rax, rax
je 0x140063d2b
call fcn.1400629dc
mov dword [rax], r14d
jmp 0x140063d55
call fcn.1400629dc
cmp dword [rax], 0x22
jne 0x140063d92
call fcn.1400629dc
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140071110
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x140063d92
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x140063d59
cmp rax, 3
je 0x140063d74
mov rcx, rsi
call fcn.140063c10
test al, al
je 0x140063d85
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140063d85
mov dil, 1
mov rcx, rbx
call fcn.14005c540
mov al, dil
jmp 0x140063d9c
mov rcx, rbx
call fcn.14005c540
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140069940
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140069a60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140069aaa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140069aaa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140069aaa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140069aaa
cmp dword [rcx + 0x84], 0xe
jbe 0x140069aaa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140069aac
xor al, al
add rsp, 0x28
ret
Function at 0x140074940
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140074968
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140074968
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400788a0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400788d0
xor eax, eax
jmp 0x140078993
mov rbp, rbx
cmp word [rax], si
je 0x1400788f5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400788dc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400788d8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400787f0
movsxd r14, eax
test eax, eax
jne 0x140078933
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400788c9
mov rcx, r14
call fcn.14006e4f8
mov rdi, rax
test rax, rax
jne 0x14007894c
xor ecx, ecx
call fcn.14006d708
jmp 0x140078928
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400787f0
test eax, eax
jne 0x14007897d
mov rcx, rdi
call fcn.14006d708
jmp 0x140078987
xor ecx, ecx
call fcn.14006d708
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400789b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140078a37
mov rsi, rbx
cmp word [rax], bp
je 0x1400789f6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400789e0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400789dc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14006e4f8
mov rdi, rax
test rax, rax
je 0x140078a24
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14006f9f0
mov rbp, rdi
xor ecx, ecx
call fcn.14006d708
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400806f0
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14005d0b4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14008077a
cmp byte [rbp - 0x21], r15b
je 0x140080775
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400807b0
call fcn.14006d7ac
test eax, eax
jne 0x14008079c
cmp byte [rbp - 0x21], r15b
je 0x140080794
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400807b0
cmp byte [rbp - 0x21], r15b
je 0x1400807ad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140064110
test eax, eax
jne 0x140080850
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14005d0b4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400807ef
cmp byte [rbp - 0x21], r15b
je 0x140080824
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140080824
call fcn.14006d7ac
test eax, eax
jne 0x140080810
cmp byte [rbp - 0x21], r15b
je 0x140080809
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140080824
cmp byte [rbp - 0x21], r15b
je 0x140080821
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140064110
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140080850
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140080853
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140080861
mov rcx, rdi
call fcn.14006d708
cmp byte [rbp + 0x3f], r15b
je 0x140080870
mov rcx, qword [rbp + 0x27]
call fcn.14006d708
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret