joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ea9e0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x488
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x14066f258]
mov edx, 0x1c
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140645738], eax
jg 0x1400eabd2
mov ecx, dword [0x140645730]
test ecx, ecx
je 0x1400eaa35
lea eax, [rcx - 1]
test eax, eax
jne 0x1400eaba9
mov qword [rsp + 0x490], rbx
lea rcx, [rsp + 0x260]
xor edx, edx
mov qword [rsp + 0x480], rdi
mov r8d, 0x208
call fcn.140260ab0
lea rdx, [rsp + 0x260]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140260ab0
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor edi, edi
mov edx, edi
mov ecx, edi
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], ecx
mov qword [rsp + 0x30], rdi
cmp word [rsp + 0x50], di
je 0x1400eab0d
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], cx
jne 0x1400eaac0
inc ebx
test ebx, ebx
jle 0x1400eaae3
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140019a30
mov ecx, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x38]
lea eax, [rdx + rbx]
mov dword [rsp + 0x38], eax
cmp eax, ecx
jle 0x1400eaaf8
lea rcx, [rsp + 0x30]
call fcn.1400197d0
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x50]
movsxd r8, ebx
add r8, r8
call fcn.140038f30
lea r9, [0x14028d690]
mov dword [rsp + 0x20], 1
lea r8, [0x140282880]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140027230
mov rbx, rax
lea rax, [0x140645728]
cmp rax, rbx
je 0x1400eab75
mov rcx, qword [0x140645728]
test rcx, rcx
je 0x1400eab52
call fcn.1400556b0
mov rcx, qword [rbx]
mov qword [0x140645728], rcx
mov qword [rbx], rdi
mov eax, dword [rbx + 8]
mov dword [0x140645730], eax
mov eax, dword [rbx + 0xc]
mov dword [0x140645734], eax
mov qword [rbx + 8], rdi
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x480]
mov rbx, qword [rsp + 0x490]
test rcx, rcx
je 0x1400eab94
call fcn.1400556b0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400eaba3
call fcn.1400556b0
mov ecx, dword [0x140645730]
test ecx, ecx
lea rax, [0x140280be0]
cmovne rax, qword [0x140645728]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0x488
ret
lea rcx, [0x140645738]
call fcn.14025e920
cmp dword [0x140645738], 0xffffffff
jne 0x1400eaa20
lea rcx, [0x140270e60]
call fcn.14025e770
lea rcx, [0x140645738]
call fcn.14025e8c0
jmp 0x1400eaa20
Function at 0x1400eb2d0
Capabilities:
Create process memory minidump

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x60
mov rdi, r9
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov dword [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rax, [0x1400e3b90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, esi
mov r8, r14
mov rcx, rbx
call sub.dbghelp.dll_MiniDumpWriteDump
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x98]
mov qword [rcx], 0
jmp 0x1400eb364
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop r14
ret
Function at 0x14011e330
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rcx
and rbx, 0xffffffffffffc000
cmp qword [rbx + 0x60], 0
je 0x14011e4a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [rbx + 0x68]
jne 0x14011e4a0
mov rax, qword [rbx + 0x60]
mov byte [rax + 0x344], 0
mov eax, 0xffff
add word [rbx + 0x74], ax
jne 0x14011e43d
movzx ecx, word [rbx + 0x76]
mov r9, qword [rbx + 0x60]
call fcn.14011ebb0
mov r8d, eax
inc r8
lea rax, [r8 + r8*2]
cmp rbx, qword [r9 + rax*8]
je 0x14011e411
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14011e3a9
mov rax, qword [rbx + 0x40]
mov qword [rcx + 0x40], rax
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14011e3ba
mov rax, qword [rbx + 0x48]
mov qword [rcx + 0x48], rax
mov rcx, qword [rbx + 0x20]
lea rax, [rbx + 0x4000]
xor r8d, r8d
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x40], r8
mov qword [rbx + 0x48], r8
mov qword [rbx + 0x58], r8
mov dword [rbx + 0x74], r8d
mov byte [rbx + 0x78], r8b
mov qword [rbx + 0x60], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
mov ecx, dword [rcx + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rbx
lea rcx, [rax + 0x300]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14011f580
movzx eax, word [rbx + 0x76]
mov rcx, rbx
sub rcx, rax
mov edx, 0x4000
add rcx, rdx
xor r8d, r8d
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], r8
mov byte [rbx + 0x78], r8b
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbx + 0x76]
mov eax, 0x400
cmp cx, ax
jbe 0x14011e481
test dil, 0x7f
jne 0x14011e481
movzx eax, bx
movzx r8d, cx
sub ax, di
mov edx, 0x4000
add ax, dx
xor edx, edx
movzx eax, ax
div r8d
test dx, dx
je 0x14011e478
movzx eax, dx
sub r8d, eax
jmp 0x14011e47b
xor r8d, r8d
movsxd rax, r8d
sub rdi, rax
mov rax, qword [rbx + 0x58]
xor edx, edx
mov qword [rdi], rax
mov rcx, rbx
mov qword [rbx + 0x58], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14011d800
movzx ecx, word [rbx + 0x76]
mov eax, 0x400
cmp cx, ax
jbe 0x14011e4e4
test dil, 0x7f
jne 0x14011e4e4
movzx eax, bx
movzx r8d, cx
sub ax, di
mov edx, 0x4000
add ax, dx
xor edx, edx
movzx eax, ax
div r8d
test dx, dx
je 0x14011e4db
movzx eax, dx
sub r8d, eax
jmp 0x14011e4de
xor r8d, r8d
movsxd rax, r8d
sub rdi, rax
mov rax, qword [rbx + 0x10]
nop dword [rax + rax]
mov qword [rdi], rax
mov rcx, rax
lock cmpxchg qword [rbx + 0x10], rdi
cmp rax, rcx
jne 0x14011e4f0
test rcx, rcx
jne 0x14011e533
mov qword [rsp + 0x30], rsi
mov rsi, qword [rbx + 0x18]
cmp rsi, 1
je 0x14011e52e
lea rcx, [rsi + 0x10]
call fcn.14011d790
mov rax, qword [rsi + 8]
mov qword [rbx + 0x18], rax
mov qword [rsi + 8], rbx
mov byte [rsi + 0x10], 0
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14011ec30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rcx
movzx ebx, dl
mov ecx, dword [rcx + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test bl, bl
je 0x14011ed8a
test rax, rax
jne 0x14011ed8a
mov qword [rsp + 0x30], rdi
lea rdi, [rsi + 0x1f2c0]
mov rcx, rdi
call fcn.14011d790
mov rbx, qword [rdi + 0x18]
test rbx, rbx
je 0x14011ec83
mov rax, qword [rbx]
mov qword [rdi + 0x18], rax
jmp 0x14011ecfe
mov rdx, qword [rdi + 8]
test rdx, rdx
jne 0x14011ecb7
mov edx, 0x348
mov rcx, rsi
call fcn.14011e6a0
mov qword [rdi + 8], rax
mov rdx, rax
test rax, rax
jne 0x14011ecb7
mov byte [rdi], al
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx eax, word [rdx + 0x76]
mov rbx, qword [rdx + 0x50]
mov rcx, rbx
sub rcx, rax
mov qword [rdx + 0x50], rcx
mov rcx, qword [rdi + 8]
lea rax, [rcx + 0x80]
cmp qword [rcx + 0x50], rax
jae 0x14011ecfe
mov qword [rcx + 0x50], 0
mov rax, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov qword [rcx + 0x40], rax
mov rax, qword [rdi + 8]
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], 0
xor edx, edx
mov byte [rdi], 0
mov r8d, 0x348
mov rcx, rbx
call fcn.140260ab0
test rbx, rbx
jne 0x14011ed28
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov qword [rbx + 0x10], rsi
lea rax, [rsi + 0x10]
mov qword [rbx + 0x310], rax
mov rdx, rbx
mov ecx, dword [rsi + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rcx, [rsi + 0x1f090]
mov qword [rbx + 8], 0
call fcn.14011d790
mov rcx, qword [rsi + 0x1f088]
mov qword [rbx], rcx
mov rax, qword [rsi + 0x1f088]
test rax, rax
je 0x14011ed74
mov qword [rax + 8], rbx
mov qword [rsi + 0x1f088], rbx
mov rdi, qword [rsp + 0x30]
mov rax, rbx
mov byte [rsi + 0x1f090], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x14011eda0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [str.0zd_]
mov rbx, rcx
test rdi, rdi
je 0x14011edf3
test rcx, rcx
je 0x14011edf3
call fcn.14011d730
test al, al
je 0x14011edeb
mov ecx, dword [rdi + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, rbx
mov rcx, rdi
mov rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14011f1c0
mov rcx, rbx
call fcn.14011e330
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14011f2e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
test dl, 0x3f
jne 0x14011f399
mov rcx, qword [rdx - 8]
lea r14, [rdx - 0x10]
mov rax, rcx
shr rax, 0x20
test al, 1
je 0x14011f399
mov rax, qword [r14]
test rax, rax
je 0x14011f399
cmp rax, r14
jae 0x14011f399
call fcn.140121c40
cmp rax, r14
jne 0x14011f399
mov r15, qword [r14]
mov r14, qword [r15 + 0x48]
sub r14, rbx
add r14, r15
cmp rdi, r14
ja 0x14011f380
test rsi, rsi
je 0x14011f357
lea rax, [rsi - 1]
test rbx, rax
jne 0x14011f380
lea rcx, [rbp + 0x10]
call fcn.140123a10
xor ecx, ecx
mov rdx, r14
shr rdx, 1
cmp r14, rax
cmova rcx, rdx
cmp rdi, rcx
jbe 0x14011f380
mov qword [r15 + 0x40], rdi
mov rax, rbx
jmp 0x14011f425
mov r14, qword [r15 + 0x40]
mov rdx, rdi
mov rcx, rbp
test rsi, rsi
je 0x14011f3c6
mov r8, rsi
call fcn.14011d930
jmp 0x14011f3cb
mov rcx, rbx
mov rdx, rbx
and rcx, 0xffffffffffffc000
call fcn.14011e2b0
mov r14, rax
cmp rdi, rax
ja 0x14011f384
test rsi, rsi
je 0x14011f3c1
lea rcx, [rsi - 1]
test rbx, rcx
jne 0x14011f384
mov rax, rbx
jmp 0x14011f425
call fcn.14011ee70
mov rsi, rax
test rax, rax
je 0x14011f422
cmp r14, rdi
mov rdx, rbx
mov rcx, rax
cmovb rdi, r14
mov r8, rdi
call fcn.140260aa0
test rbp, rbp
je 0x14011f422
test rbx, rbx
je 0x14011f422
mov rcx, rbx
call fcn.14011d730
test al, al
je 0x14011f41a
mov ecx, dword [rbp + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, rbx
mov rcx, rbp
mov rdx, rax
call fcn.14011f1c0
jmp 0x14011f422
mov rcx, rbx
call fcn.14011e330
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14011f440
Capabilities:
Get thread local storage value

Disassembly:
push r15
sub rsp, 0x40
mov qword [rsp + 0x50], rbx
xor r15b, r15b
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov r13, rcx
add rcx, 0x1f080
call fcn.14011d790
mov rbx, qword [r13 + 0x1f078]
test rbx, rbx
je 0x14011f52e
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x20], r14
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
xor edx, edx
xchg qword [rbx + 0x320], rdx
add rcx, 0x10
test rdx, rdx
je 0x14011f4b0
call fcn.140120ad0
mov r14b, 1
jmp 0x14011f4b3
xor r14b, r14b
xor edi, edi
xor bpl, bpl
xchg qword [rbx + 0x300], rdi
test rdi, rdi
je 0x14011f508
mov bpl, 1
nop word [rax + rax]
mov rcx, qword [rbx + 0x310]
mov rsi, qword [rdi + 0x40]
mov rax, qword [rcx]
cmp qword [rax + 0x1f290], 0
jne 0x14011f4f8
mov rcx, qword [rdi + 0x6c]
call fcn.140121fd0
mov rcx, qword [rbx + 0x310]
mov rdx, rdi
call fcn.140123c10
mov rdi, rsi
test rsi, rsi
jne 0x14011f4d0
mov rbx, qword [rbx]
or bpl, r14b
or r15b, bpl
test rbx, rbx
jne 0x14011f490
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov byte [r13 + 0x1f080], 0
mov ecx, dword [r13 + 0x1f2ac]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
test rax, rax
je 0x14011f569
mov rcx, rax
call fcn.14011de90
or al, r15b
add rsp, 0x40
pop r15
ret
movzx eax, r15b
add rsp, 0x40
pop r15
ret

Function at 0x14011f6c0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test r8, r8
je 0x14011f77f
lea rax, [r8 - 1]
test r8, rax
jne 0x14011f77f
test rcx, rcx
jne 0x14011f6f2
mov rcx, qword [str.0zd_]
call fcn.14011d930
jmp 0x14011f762
test rdx, rdx
jne 0x14011f74d
mov qword [rsp + 0x30], rdi
mov rdi, qword [str.0zd_]
test rdi, rdi
je 0x14011f740
call fcn.14011d730
test al, al
je 0x14011f738
mov ecx, dword [rdi + 0x1f2bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r8, rbx
mov rcx, rdi
mov rdx, rax
call fcn.14011f1c0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.14011e330
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [str.0zd_]
mov r9, r8
mov r8, rdx
mov rdx, rbx
call fcn.14011f2e0
mov rbx, rax
test rax, rax
jne 0x14011f776
call qword [0x140272900]
mov dword [rax], 0xc
mov rax, rbx
add rsp, 0x20
pop rbx
ret
call qword [0x140272900]
mov dword [rax], 0x16
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140126590
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
lea rcx, [fcn.140126590]
xor rax, rcx
xor rax, rbx
mov r8, rax
shr r8, 0x11
xor r8, rax
and r8d, 0xf
add r8, 1
je 0x14012660c
movabs r9, 0xbf58476d1ce4e5b9
movabs r10, 0x94d049bb133111eb
nop
mov rcx, rax
shr rcx, 0x1e
xor rcx, rax
imul rcx, r9
mov rdx, rcx
shr rdx, 0x1b
xor rdx, rcx
imul rdx, r10
mov rax, rdx
shr rax, 0x1f
xor rax, rdx
sub r8, 1
jne 0x1401265e0
add rsp, 0x20
pop rbx
ret

Function at 0x140127a00
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140127a20
mov qword [0x14037b7c0], rax
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x140127a2f
mov qword [0x14037b7c8], rax
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140127a80
lea rdx, str.VirtualAlloc2FromApp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14066cff0], rax
test rax, rax
jne 0x140127a77
lea rdx, str.VirtualAlloc2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14066cff0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140127ab5
lea rdx, str.NtAllocateVirtualMemoryEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x14066cff8], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 5
call fcn.140129520
test al, al
jne 0x140127ad1
mov ecx, 6
call fcn.140129520
test al, al
je 0x140127ad6
call fcn.140128410
add rsp, 0x50
pop rbx
ret
Function at 0x140128bf0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xc0
xor r15d, r15d
lea rsi, [0x14037b7d0]
mov ebp, r15d
lea r14d, [r15 + 0xe]
lea r12d, [r15 + 0x40]
nop
cmp dword [rsi + 4], r15d
jne 0x140128d6d
mov r8, r12
mov byte [rsp + 0x20], r15b
lea rdx, str.mimalloc_
lea rcx, [rsp + 0x20]
call qword [0x140272a28]
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x20]
mov r8, r12
mov byte [rsp + 0x60], r15b
call qword [0x1402729e8]
mov r8d, 0x41
mov byte [rsp + 0x60], r15b
lea rdx, [rsp + 0x70]
mov byte [rsp + 0x70], r15b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
dec rax
cmp rax, 0x3f
ja 0x140128d66
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140128c96
cmp rbx, 0x41
mov rdi, r15
cmovae rbx, r12
test rbx, rbx
je 0x140128cc7
nop
movsx ecx, byte [rsp + rdi + 0x70]
call qword [0x1402729f0]
mov byte [rsp + rdi + 0x20], al
inc rdi
cmp rdi, rbx
jb 0x140128cb0
mov byte [rsp + rbx + 0x20], r15b
cmp byte [rsp + 0x20], r15b
je 0x140128db3
lea rdx, [rsp + 0x20]
lea rcx, str.1_TRUE_YES_ON
call fcn.140260ae0
test rax, rax
jne 0x140128db3
lea rdx, [rsp + 0x20]
lea rcx, str.0_FALSE_NO_OFF
call fcn.140260ae0
test rax, rax
je 0x140128d13
mov dword [rsi], r15d
mov dword [rsi + 4], 2
jmp 0x140128d6d
lea rax, [rsp + 0x20]
mov r8d, 0xa
lea rdx, [rsp + 0xf0]
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0x20]
call qword [0x140272780]
mov rcx, qword [rsp + 0xf0]
cmp byte [rcx], r15b
jne 0x140128d51
mov dword [rsi], eax
mov dword [rsi + 4], 2
jmp 0x140128d6d
mov rdx, qword [rsi + 0x10]
lea r8, [rsp + 0x20]
lea rcx, str.environment_option_mimalloc__s_has_an_invalid_value:__s_n
call fcn.140128ef0
mov dword [rsi + 4], 1
cmp rbp, 2
je 0x140128d86
mov r8d, dword [rsi]
lea rcx, str.option__s:__ld_n
mov rdx, qword [rsi + 0x10]
call fcn.140128dd0
inc rbp
add rsi, 0x18
sub r14, 1
jne 0x140128c20
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov dword [rsi], 1
mov dword [rsi + 4], 2
jmp 0x140128d6d
Function at 0x140129050
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rsi, rcx
mov byte [rsp + 0x20], 0
mov edi, 0x40
lea rdx, str.mimalloc_
mov r8d, edi
lea rcx, [rsp + 0x20]
call qword [0x140272a28]
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0x20]
mov r8d, edi
mov byte [rsp + 0x60], 0
call qword [0x1402729e8]
lea r8d, [rdi + 1]
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x70]
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
dec rax
cmp rax, 0x3f
ja 0x1401291cf
mov qword [rsp + 0xd8], rbx
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1401290d7
cmp rbx, 0x41
cmovae rbx, rdi
xor edi, edi
test rbx, rbx
je 0x140129107
nop
movsx ecx, byte [rsp + rdi + 0x70]
call qword [0x1402729f0]
mov byte [rsp + rdi + 0x20], al
inc rdi
cmp rdi, rbx
jb 0x1401290f0
mov byte [rsp + rbx + 0x20], 0
cmp byte [rsp + 0x20], 0
mov rbx, qword [rsp + 0xd8]
je 0x1401291e7
lea rdx, [rsp + 0x20]
lea rcx, str.1_TRUE_YES_ON
call fcn.140260ae0
test rax, rax
jne 0x1401291e7
lea rdx, [rsp + 0x20]
lea rcx, str.0_FALSE_NO_OFF
call fcn.140260ae0
test rax, rax
je 0x14012916d
mov dword [rsi], 0
mov dword [rsi + 4], 2
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
lea rax, [rsp + 0x20]
mov r8d, 0xa
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0x20]
call qword [0x140272780]
mov rcx, qword [rsp + 0xd0]
cmp byte [rcx], 0
jne 0x1401291ba
mov dword [rsi], eax
mov dword [rsi + 4], 2
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
mov rdx, qword [rsi + 0x10]
lea r8, [rsp + 0x20]
lea rcx, str.environment_option_mimalloc__s_has_an_invalid_value:__s_n
call fcn.140128ef0
mov dword [rsi + 4], 1
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
mov dword [rsi], 1
mov dword [rsi + 4], 2
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
Function at 0x140129340
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0xc0
movsxd rax, ecx
lea rcx, [rax + rax*2]
lea rax, [0x14037b7d0]
cmp dword [rax + rcx*8 + 4], 0
lea rbx, [rax + rcx*8]
jne 0x140129506
mov qword [rsp + 0xd0], rsi
lea rdx, str.mimalloc_
mov esi, 0x40
mov byte [rsp + 0x20], 0
mov r8d, esi
lea rcx, [rsp + 0x20]
call qword [0x140272a28]
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8d, esi
mov byte [rsp + 0x60], 0
call qword [0x1402729e8]
lea r8d, [rsi + 1]
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x70]
mov byte [rsp + 0x70], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
dec rax
cmp rax, 0x3f
ja 0x1401294e1
mov qword [rsp + 0xe0], rdi
lea rax, [rsp + 0x70]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x1401293e5
cmp rdi, 0x41
cmovae rdi, rsi
xor esi, esi
test rdi, rdi
je 0x140129417
nop dword [rax]
movsx ecx, byte [rsp + rsi + 0x70]
call qword [0x1402729f0]
mov byte [rsp + rsi + 0x20], al
inc rsi
cmp rsi, rdi
jb 0x140129400
mov byte [rsp + rdi + 0x20], 0
cmp byte [rsp + 0x20], 0
mov rdi, qword [rsp + 0xe0]
je 0x1401294fb
lea rdx, [rsp + 0x20]
lea rcx, str.1_TRUE_YES_ON
call fcn.140260ae0
test rax, rax
jne 0x1401294fb
lea rdx, [rsp + 0x20]
lea rcx, str.0_FALSE_NO_OFF
call fcn.140260ae0
test rax, rax
je 0x14012947f
mov dword [rbx], 0
mov eax, dword [rbx]
mov rsi, qword [rsp + 0xd0]
mov dword [rbx + 4], 2
add rsp, 0xc0
pop rbx
ret
lea rax, [rsp + 0x20]
mov r8d, 0xa
lea rdx, [rsp + 0xd8]
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0x20]
call qword [0x140272780]
mov rcx, qword [rsp + 0xd8]
cmp byte [rcx], 0
jne 0x1401294cc
mov rsi, qword [rsp + 0xd0]
mov dword [rbx], eax
mov dword [rbx + 4], 2
add rsp, 0xc0
pop rbx
ret
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
lea rcx, str.environment_option_mimalloc__s_has_an_invalid_value:__s_n
call fcn.140128ef0
mov eax, dword [rbx]
mov rsi, qword [rsp + 0xd0]
mov dword [rbx + 4], 1
add rsp, 0xc0
pop rbx
ret
mov dword [rbx], 1
jmp 0x140129465
mov eax, dword [rbx]
add rsp, 0xc0
pop rbx
ret
Function at 0x1401295d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x40
movsd xmm0, qword [0x14066d040]
movaps xmmword [rsp + 0x30], xmm6
xorps xmm6, xmm6
ucomisd xmm0, xmm6
jp 0x14012969a
jne 0x14012969a
lea rcx, [rsp + 0x50]
movaps xmmword [rsp + 0x20], xmm7
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm0, qword [0x14066d048]
comisd xmm6, xmm0
mov rbx, qword [rsp + 0x50]
jb 0x140129636
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x58]
movsd qword [0x14066d048], xmm0
xorps xmm7, xmm7
lea rcx, [rsp + 0x50]
cvtsi2sd xmm7, rbx
divsd xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x14066d048]
comisd xmm6, xmm1
mov rbx, qword [rsp + 0x50]
jb 0x14012967d
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x58]
movsd qword [0x14066d048], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
subsd xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x20]
movsd qword [0x14066d040], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm1, qword [0x14066d048]
mov rbx, qword [rsp + 0x50]
comisd xmm6, xmm1
movaps xmm6, xmmword [rsp + 0x30]
jb 0x1401296da
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x58]
movsd qword [0x14066d048], xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
divsd xmm0, xmm1
add rsp, 0x40
pop rbx
ret