joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008b200
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401c1030]
cmp rax, qword [0x140207c90]
mov qword [0x1401c1028], 0
je 0x14008b238
mov byte [rax], 0
mov dword [0x1401c1038], 0
add rsp, 0x28
ret
cmp byte [rax], 0
je 0x14008b222
mov r8d, 0xac
lea rdx, [0x1401da260]
lea rcx, [0x1401da269]
call qword [sym.imp.msvcrt.dll__assert]
nop
nop dword [rax + rax]
sub rsp, 0x28
call sub.msvcrt.dll__rmdir
test eax, eax
je 0x14008b278
add rsp, 0x28
ret
mov rdx, qword [0x1401c1030]
cmp rdx, qword [0x140207c90]
mov qword [0x1401c1028], 0
je 0x14008b2a8
mov byte [rdx], 0
mov dword [0x1401c1038], 0
add rsp, 0x28
ret
cmp byte [rdx], 0
je 0x14008b296
mov r8d, 0xac
lea rdx, [0x1401da260]
lea rcx, [0x1401da269]
call qword [sym.imp.msvcrt.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe0
mov r13, qword [0x140207cf0]
mov r12, qword [0x140207460]
mov rax, qword [r12]
mov qword [rsp + 0xd8], rax
xor eax, eax
mov rsi, rcx
mov rcx, qword [r13]
mov rdi, rdx
mov ebp, r8d
mov rdx, rsi
xor r8d, r8d
call fcn.14002a210
mov dword [rsp + 0x28], eax
cmp eax, 4
jne 0x14008b460
mov rcx, qword [r13]
lea r9, [rsp + 0x2c]
lea r8, [rsp + 0x28]
mov rdx, rsi
call fcn.14002a2f0
mov rbx, rax
test rax, rax
je 0x14008b488
lea rsi, [rsp + 0x70]
mov ecx, 0xc
lea r14, [rsp + 0x50]
mov rax, qword [0x140207c90]
mov rdi, rsi
lea r13, [rsp + 0x30]
mov r9, r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], rax
mov r8, r13
mov qword [rsp + 0x60], rax
xor eax, eax
rep stosq qword [rdi], rax
mov edi, dword [rsp + 0x2c]
mov rcx, rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov rdx, rdi
call fcn.1401219c0
test eax, eax
je 0x14008b440
lea rdx, [rsp + 0x78]
mov rcx, r13
mov dword [rsp + 0x80], 2
call fcn.14007d860
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
mov qword [rsp + 0x70], rax
call fcn.140121730
mov edi, eax
test bpl, 4
je 0x14008b430
mov rcx, rsi
call fcn.1401216a0
mov rcx, r13
call fcn.14007d7e0
mov rcx, r14
call fcn.14007d7e0
mov rcx, rbx
call fcn.1400d2670
mov rax, qword [rsp + 0xd8]
sub rax, qword [r12]
jne 0x14008b4e6
mov eax, edi
add rsp, 0xe0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, ebp
mov rcx, rsi
call fcn.1401218d0
jmp 0x14008b3e9
and ebp, 1
jne 0x14008b49e
lea rcx, str.no_signature_found
mov edi, 0xffffffff
call fcn.1400a0b40
jmp 0x14008b401
mov ecx, eax
call fcn.14002edb0
mov rbx, rax
test rdi, rdi
je 0x14008b4b0
mov r8, rbx
mov rdx, rdi
lea rcx, str._s:_cannot_verify_a_non_tag_object_of_type__s.
call fcn.1400a0b40
mov edi, 0xffffffff
jmp 0x14008b409
test rdi, rdi
je 0x14008b4cb
mov rdx, rdi
lea rcx, str._s:_unable_to_read_file.
call fcn.1400a0b40
jmp 0x14008b481
mov r8, rdi
mov rdx, rbx
mov ecx, 1
call fcn.1400a6690
jmp 0x14008b445
mov rax, qword [0x140207780]
mov rcx, qword [r13]
mov rdx, rsi
mov r8d, dword [rax]
call fcn.14002ce30
mov rdi, rax
jmp 0x14008b46f
mov rax, qword [0x140207780]
mov rcx, qword [r13]
mov rdx, rsi
mov r8d, dword [rax]
call fcn.14002ce30
mov rdi, rax
jmp 0x14008b48d
call fcn.1401be670
nop
nop dword [rax]
Function at 0x14008b260
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401c1030]
cmp rax, qword [0x140207c90]
mov qword [0x1401c1028], 0
je 0x14008b238
mov byte [rax], 0
mov dword [0x1401c1038], 0
add rsp, 0x28
ret
cmp byte [rax], 0
je 0x14008b222
mov r8d, 0xac
lea rdx, [0x1401da260]
lea rcx, [0x1401da269]
call qword [sym.imp.msvcrt.dll__assert]
nop
nop dword [rax + rax]
sub rsp, 0x28
call sub.msvcrt.dll__rmdir
test eax, eax
je 0x14008b278
add rsp, 0x28
ret
mov rdx, qword [0x1401c1030]
cmp rdx, qword [0x140207c90]
mov qword [0x1401c1028], 0
je 0x14008b2a8
mov byte [rdx], 0
mov dword [0x1401c1038], 0
add rsp, 0x28
ret
cmp byte [rdx], 0
je 0x14008b296
mov r8d, 0xac
lea rdx, [0x1401da260]
lea rcx, [0x1401da269]
call qword [sym.imp.msvcrt.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe0
mov r13, qword [0x140207cf0]
mov r12, qword [0x140207460]
mov rax, qword [r12]
mov qword [rsp + 0xd8], rax
xor eax, eax
mov rsi, rcx
mov rcx, qword [r13]
mov rdi, rdx
mov ebp, r8d
mov rdx, rsi
xor r8d, r8d
call fcn.14002a210
mov dword [rsp + 0x28], eax
cmp eax, 4
jne 0x14008b460
mov rcx, qword [r13]
lea r9, [rsp + 0x2c]
lea r8, [rsp + 0x28]
mov rdx, rsi
call fcn.14002a2f0
mov rbx, rax
test rax, rax
je 0x14008b488
lea rsi, [rsp + 0x70]
mov ecx, 0xc
lea r14, [rsp + 0x50]
mov rax, qword [0x140207c90]
mov rdi, rsi
lea r13, [rsp + 0x30]
mov r9, r14
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], rax
mov r8, r13
mov qword [rsp + 0x60], rax
xor eax, eax
rep stosq qword [rdi], rax
mov edi, dword [rsp + 0x2c]
mov rcx, rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov rdx, rdi
call fcn.1401219c0
test eax, eax
je 0x14008b440
lea rdx, [rsp + 0x78]
mov rcx, r13
mov dword [rsp + 0x80], 2
call fcn.14007d860
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
mov qword [rsp + 0x70], rax
call fcn.140121730
mov edi, eax
test bpl, 4
je 0x14008b430
mov rcx, rsi
call fcn.1401216a0
mov rcx, r13
call fcn.14007d7e0
mov rcx, r14
call fcn.14007d7e0
mov rcx, rbx
call fcn.1400d2670
mov rax, qword [rsp + 0xd8]
sub rax, qword [r12]
jne 0x14008b4e6
mov eax, edi
add rsp, 0xe0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, ebp
mov rcx, rsi
call fcn.1401218d0
jmp 0x14008b3e9
and ebp, 1
jne 0x14008b49e
lea rcx, str.no_signature_found
mov edi, 0xffffffff
call fcn.1400a0b40
jmp 0x14008b401
mov ecx, eax
call fcn.14002edb0
mov rbx, rax
test rdi, rdi
je 0x14008b4b0
mov r8, rbx
mov rdx, rdi
lea rcx, str._s:_cannot_verify_a_non_tag_object_of_type__s.
call fcn.1400a0b40
mov edi, 0xffffffff
jmp 0x14008b409
test rdi, rdi
je 0x14008b4cb
mov rdx, rdi
lea rcx, str._s:_unable_to_read_file.
call fcn.1400a0b40
jmp 0x14008b481
mov r8, rdi
mov rdx, rbx
mov ecx, 1
call fcn.1400a6690
jmp 0x14008b445
mov rax, qword [0x140207780]
mov rcx, qword [r13]
mov rdx, rsi
mov r8d, dword [rax]
call fcn.14002ce30
mov rdi, rax
jmp 0x14008b46f
mov rax, qword [0x140207780]
mov rcx, qword [r13]
mov rdx, rsi
mov r8d, dword [rax]
call fcn.14002ce30
mov rdi, rax
jmp 0x14008b48d
call fcn.1401be670
nop
nop dword [rax]
Function at 0x14008c5d0
Capabilities:
Get system information on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [0x140207460]
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rdi, rcx
mov ecx, 0x48
mov esi, edx
call fcn.1400a5fa0
xor edx, edx
mov dword [rax + 0x10], 0xffffffff
lea r12, [rax + 0x28]
mov rbx, rax
mov qword [rax + 0x18], 0
mov rcx, r12
mov qword [rax + 0x20], 0
mov qword [rax + 8], rax
mov qword [rax], rax
call fcn.14007dae0
mov rdx, rdi
mov rcx, r12
mov qword [rsp + 0x20], rbx
mov qword [rbx + 0x40], 0
call fcn.1400de560
mov rcx, qword [rbx + 0x38]
mov r8d, esi
mov edx, 0x582
call fcn.1400c0420
mov dword [rbx + 0x10], eax
mov eax, dword [rbx + 0x10]
test eax, eax
js 0x14008c710
mov eax, dword [rbx + 0x10]
test eax, eax
js 0x14008c740
mov eax, dword [0x14023dca0]
test eax, eax
je 0x14008c6e0
mov rax, qword [0x1401c1070]
mov qword [rax + 8], rbx
mov rax, qword [0x1401c1070]
mov qword [rbx], rax
lea rax, [0x1401c1070]
mov qword [rbx + 8], rax
mov qword [0x1401c1070], rbx
call sub.msvcrt.dll__getpid
mov rcx, qword [rbx + 0x38]
cdqe
mov qword [rbx + 0x20], rax
call fcn.140038160
test eax, eax
jne 0x14008c770
mov rax, qword [rsp + 0x28]
sub rax, qword [rbp]
jne 0x14008c7a0
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [0x14008bbc0]
call fcn.14007b180
lea rcx, [0x14008bbb0]
call fcn.140001410
mov dword [0x14023dca0], 1
jmp 0x14008c676
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x16
jne 0x14008c661
mov rcx, qword [rbx + 0x38]
mov r8d, esi
mov edx, 0x502
call fcn.1400c0420
mov dword [rbx + 0x10], eax
jmp 0x14008c661
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov rcx, r12
mov qword [rdx + 8], rax
mov qword [rax], rdx
call fcn.14007d7e0
mov rcx, qword [rbx + 0x40]
call fcn.1400d2670
mov rcx, rbx
xor ebx, ebx
call fcn.1400d2670
jmp 0x14008c6b9
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
mov rdx, qword [rbx + 0x38]
lea rcx, str.cannot_fix_permission_bits_on__s
xor ebx, ebx
mov edi, dword [rax]
call fcn.1400a0b40
lea rcx, [rsp + 0x20]
call fcn.14008c560
call rsi
mov dword [rax], edi
jmp 0x14008c6b9
call fcn.1401be670
nop
nop word cs:[rax + rax]
Function at 0x14008c7b0
Capabilities:
Get system information on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, rcx
mov rdi, rdx
test rbx, rbx
je 0x14008c849
mov rcx, rbx
call fcn.14008c470
test eax, eax
jne 0x14008c820
mov rcx, qword [rbx + 0x38]
mov rdx, rdi
call fcn.1400c12a0
mov edi, eax
test eax, eax
jne 0x14008c830
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
lea rcx, [rbx + 0x28]
mov qword [rdx + 8], rax
mov qword [rax], rdx
call fcn.14007d7e0
mov rcx, qword [rbx + 0x40]
call fcn.1400d2670
mov rcx, rbx
call fcn.1400d2670
mov qword [rsi], 0
mov eax, edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rsi
call fcn.14008c560
mov edi, 0xffffffff
jmp 0x14008c816
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
mov rcx, rsi
mov edi, dword [rax]
call fcn.14008c560
call rbx
mov dword [rax], edi
jmp 0x14008c828
lea r8, str.rename_tempfile_called_for_inactive_object
mov edx, 0x151
lea rcx, str.tempfile.c
call fcn.1400a0ca0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x14008c870
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov edx, 1
test eax, eax
cmovle eax, edx
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rbx]
jne 0x14008c8af
add rsp, 0x60
pop rbx
ret
call fcn.1401be670
nop
nop word cs:[rax + rax]
Function at 0x14008e180
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp qword [0x14023dcd8], 1
ja 0x14008e2d0
je 0x14008e280
lea rdi, [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call fcn.1400ba1c0
movsxd rbx, dword [rsp + 0x20]
imul eax, dword [rsp + 0x24], 0x3e8
imul rbx, rbx, 0x3b9aca00
cdqe
add rbx, rax
mov eax, dword [0x14023dcd0]
test eax, eax
jne 0x14008e248
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14008e2c0
movabs rax, 0x3b9aca0000000000
xor edx, edx
mov ecx, 0xffffffff
mov dword [0x14023dcd0], 0x20
div qword [rsp + 0x20]
mov qword [0x14023dcc8], rax
mov qword [0x14023dcc0], rax
cmp rcx, rax
jae 0x14008e248
mov edx, 0x20
nop word [rax + rax]
shr rax, 1
sub edx, 1
cmp rcx, rax
jb 0x14008e230
mov qword [0x14023dcc0], rax
mov dword [0x14023dcd0], edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rsp + 0x20]
mov ecx, dword [0x14023dcd0]
imul rax, qword [0x14023dcc0]
movsxd rdx, dword [rsp + 0x24]
imul rdx, qword [0x14023dcc8]
shr rax, cl
add rax, rdx
je 0x14008e2c0
mov rdx, rbx
sub rdx, rax
jmp 0x14008e2c5
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1400ba1c0
movsxd rbx, dword [rsp + 0x20]
imul eax, dword [rsp + 0x24], 0x3e8
imul rbx, rbx, 0x3b9aca00
cdqe
add rbx, rax
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14008e386
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov edx, 1
mov qword [0x14023dcd8], rdx
jmp 0x14008e2a5
mov edx, dword [0x14023dcd0]
lea rdi, [rsp + 0x20]
test edx, edx
jne 0x14008e34c
mov rcx, rdi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14008e37a
movabs rax, 0x3b9aca0000000000
xor edx, edx
mov ecx, 0xffffffff
mov dword [0x14023dcd0], 0x20
div qword [rsp + 0x20]
mov qword [0x14023dcc8], rax
mov qword [0x14023dcc0], rax
cmp rcx, rax
jae 0x14008e34c
mov edx, 0x1f
nop word [rax + rax]
shr rax, 1
mov r8d, edx
sub edx, 1
cmp rcx, rax
jb 0x14008e330
mov qword [0x14023dcc0], rax
mov dword [0x14023dcd0], r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [rsp + 0x20]
mov ecx, dword [0x14023dcd0]
imul rbx, qword [0x14023dcc0]
movsxd rax, dword [rsp + 0x24]
imul rax, qword [0x14023dcc8]
shr rbx, cl
add rbx, rax
add rbx, qword [0x14023dcd8]
jmp 0x14008e2a5
call fcn.1401be670
nop
nop dword [rax]
Function at 0x14008e760
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [0x1401daa80]
mov r15, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xd8]
mov r13, qword [rsp + 0xe0]
mov dword [rsp + 0x54], edx
mov r12, rcx
mov rsi, r9
mov qword [rsp + 0x58], r8
call fcn.14008e180
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
mov rbx, rdx
shr rbx, 4
mov rcx, rbx
call fcn.140097b20
mov rdi, qword [0x140207d30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rdi]
call fcn.140090be0
test eax, eax
je 0x14008e80e
mov rax, qword [rdi + 0xb8]
test rax, rax
je 0x14008e80e
mov qword [rsp + 0x38], r13
mov r9, qword [rsp + 0x58]
mov rcx, r12
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x54]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
call rax
mov rdi, qword [rbp + 8]
add rbp, 8
test rdi, rdi
jne 0x14008e7cf
mov rcx, rbx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140097870

Function at 0x14008efd0
Capabilities:
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rcx, [0x1401ca3b7]
mov rsi, rdx
call fcn.140037910
xor r9d, r9d
mov r8, rsi
mov rdx, rbx
mov dword [rsp + 0x20], 0
mov rcx, rax
call fcn.14000cf00
mov r9, rsi
mov r8, rbx
mov edx, 0xcde
lea rcx, str.config.c
add rsp, 0x38
pop rbx
pop rsi
jmp 0x14008efd0
mov eax, dword [0x14023dd6c]
test eax, eax
jne 0x14008efe0
ret
jmp 0x140090150
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x68], rax
xor eax, eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov rbx, r8
mov qword [rsp + 0x28], rax
mov eax, dword [0x14023dd80]
mov rsi, r9
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0xffffffff
mov qword [rsp + 0x4c], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x38], edx
test eax, eax
je 0x1400901e0
mov eax, dword [0x14023dd84]
test eax, eax
jle 0x1400901cd
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
mov rdx, rsi
mov rcx, rbx
call fcn.14008fcb0
mov rax, qword [rsp + 0x68]
sub rax, qword [rdi]
jne 0x1400901e7
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
call fcn.14008fd30
jmp 0x1400901b4
call fcn.1401be670
nop
nop
nop
nop

Function at 0x14008f750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [0x140207460]
mov r11d, dword [0x14023dd6c]
mov r10, qword [rsp + 0x80]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rax
test r11d, r11d
je 0x14008f79f
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r10
call fcn.14008e840
mov rax, qword [rsp + 0x48]
sub rax, qword [rbx]
jne 0x14008f7af
add rsp, 0x50
pop rbx
ret
call fcn.1401be670
nop
nop word cs:[rax + rax]
Function at 0x14008f7c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, qword [0x140207460]
mov r10, qword [rsp + 0x80]
mov r11, qword [rsp + 0x88]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rax, [rsp + 0x90]
cmp dword [0x14023dd6c], 0
mov qword [rsp + 0x40], rax
je 0x14008f810
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r10
call fcn.14008e840
mov rax, qword [rsp + 0x48]
sub rax, qword [rbx]
jne 0x14008f820
add rsp, 0x50
pop rbx
ret
call fcn.1401be670
nop
nop word cs:[rax + rax]

Function at 0x14008f830
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [0x14023dd6c]
mov rsi, rcx
mov ebp, edx
test eax, eax
jne 0x14008f860
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call fcn.1400977c0
test eax, eax
jne 0x14008f928
call fcn.14008e180
lea rdi, [0x1401daa80]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
mov rbx, rdx
shr rbx, 4
mov rcx, rbx
call fcn.140097b20
mov r13, rax
call fcn.1400979d0
mov rcx, rbx
call fcn.140097ab0
lea rcx, [0x14008e580]
mov r12, rax
call fcn.140097e70
lea rcx, [0x14008e520]
call fcn.1400903e0
call fcn.140097c90
call fcn.140097de0
call fcn.1400903a0
call fcn.140097ca0
mov rbx, qword [0x140207d30]
mov rcx, qword [rbx]
call fcn.140090be0
test eax, eax
je 0x14008f904
mov rax, qword [rbx + 0x90]
test rax, rax
je 0x14008f904
mov r9, r12
mov r8, r13
mov edx, ebp
mov rcx, rsi
call rax
mov rbx, qword [rdi + 8]
add rdi, 8
test rbx, rbx
jne 0x14008f8df
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp 0x1400977f0
lea rax, str.thread_proc_on_main
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], 0
call fcn.14008f7c0
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
push rbx
sub rsp, 0x20
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140097838
xor edx, edx
mov ecx, dword [0x14023de44]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx]
call fcn.1400d2670
mov rcx, qword [rbx + 8]
call fcn.1400d2670
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d2670
call fcn.14008e180
lea rcx, [0x1401db6f4]
movabs rdx, 0x20c49ba5e353f7cf
shr rax, 3
mul rdx
shr rdx, 4
call fcn.1400975c0
mov rbx, rax
jmp 0x140097809
Function at 0x140090150
Capabilities:
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rcx, [0x1401ca3b7]
mov rsi, rdx
call fcn.140037910
xor r9d, r9d
mov r8, rsi
mov rdx, rbx
mov dword [rsp + 0x20], 0
mov rcx, rax
call fcn.14000cf00
mov r9, rsi
mov r8, rbx
mov edx, 0xcde
lea rcx, str.config.c
add rsp, 0x38
pop rbx
pop rsi
jmp 0x14008efd0
mov eax, dword [0x14023dd6c]
test eax, eax
jne 0x14008efe0
ret
jmp 0x140090150
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x68], rax
xor eax, eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov rbx, r8
mov qword [rsp + 0x28], rax
mov eax, dword [0x14023dd80]
mov rsi, r9
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0xffffffff
mov qword [rsp + 0x4c], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x38], edx
test eax, eax
je 0x1400901e0
mov eax, dword [0x14023dd84]
test eax, eax
jle 0x1400901cd
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
mov rdx, rsi
mov rcx, rbx
call fcn.14008fcb0
mov rax, qword [rsp + 0x68]
sub rax, qword [rdi]
jne 0x1400901e7
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
call fcn.14008fd30
jmp 0x1400901b4
call fcn.1401be670
nop
nop
nop
nop

Function at 0x1400901f0
Capabilities:
Set environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rdi, str.GIT_TRACE2_PARENT_NAME
mov rsi, rcx
mov rcx, rdi
call fcn.1400bbaa0
mov qword [0x1401c1118], 0
mov rbx, rax
mov rax, qword [0x1401c1120]
cmp rax, qword [0x140207c90]
je 0x1400902e0
mov byte [rax], 0
lea rbp, [0x1401c1110]
test rbx, rbx
je 0x140090240
cmp byte [rbx], 0
jne 0x140090278
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rdx, rsi
mov rcx, rbp
mov r8, rax
call fcn.14007e800
mov rdx, qword [0x1401c1120]
mov r8d, 1
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400c6200
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rdx, rbx
mov rcx, rbp
mov r8, rax
call fcn.14007e800
mov rdx, qword [0x1401c1110]
test rdx, rdx
jne 0x140090308
mov edx, 1
mov rcx, rbp
call fcn.14007da40
mov rax, qword [0x1401c1118]
lea rdx, [rax + 1]
mov qword [0x1401c1118], rdx
mov rdx, qword [0x1401c1120]
mov byte [rdx + rax], 0x2f
mov rdx, qword [0x1401c1120]
mov rax, qword [0x1401c1118]
mov byte [rdx + rax], 0
jmp 0x140090240
cmp byte [rax], 0
je 0x14009022f
mov r8d, 0xac
lea rdx, [0x1401daaf7]
lea rcx, [0x1401dab02]
call qword [sym.imp.msvcrt.dll__assert]
nop dword [rax + rax]
mov rax, qword [0x1401c1118]
sub rdx, rax
cmp rdx, 1
jne 0x1400902ae
jmp 0x14009029a
Function at 0x140090f80
Capabilities:
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rsi, str.GIT_TRACE2_PARENT_SID
mov rcx, rsi
call fcn.1400bbaa0
mov rbx, rax
test rax, rax
je 0x140091050
movzx ecx, byte [rax]
test cl, cl
je 0x140091050
mov eax, dword [0x14023ddf0]
mov r8, rbx
xor edx, edx
nop word [rax + rax]
cmp cl, 0x2f
jne 0x140090fcd
add eax, 1
mov edx, 1
movzx ecx, byte [r8 + 1]
add r8, 1
test cl, cl
jne 0x140090fc0
test dl, dl
je 0x140090fe4
mov dword [0x14023ddf0], eax
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rdx, rbx
lea rbx, [0x1401c11d0]
mov r8, rax
mov rcx, rbx
call fcn.14007e800
mov rdx, qword [0x1401c11d0]
test rdx, rdx
jne 0x140091070
mov edx, 1
mov rcx, rbx
call fcn.14007da40
mov rax, qword [0x1401c11d8]
lea rdx, [rax + 1]
add dword [0x14023ddf0], 1
mov qword [0x1401c11d8], rdx
mov rdx, qword [0x1401c11e0]
mov byte [rdx + rax], 0x2f
mov rdx, qword [0x1401c11e0]
mov rax, qword [0x1401c11d8]
mov byte [rdx + rax], 0
call fcn.140090d70
mov rdx, qword [0x1401c11e0]
mov r8d, 1
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400c6200
mov rax, qword [0x1401c11d8]
sub rdx, rax
cmp rdx, 1
jne 0x140091021
jmp 0x14009100d

Function at 0x1400975c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, qword [0x140207460]
lea r13, [0x14023de60]
mov rax, qword [rbp]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rdi, rdx
mov rsi, rcx
mov edx, 0xb8
mov ecx, 1
call fcn.1400a6220
mov edx, 8
mov ecx, 0x64
mov r12, qword [0x140207c90]
mov qword [rsp + 0x28], 0
mov rbx, rax
mov qword [rsp + 0x30], r12
mov qword [rax + 0x10], 0x64
mov qword [rsp + 0x20], 0
call fcn.1400a6220
mov rdx, qword [rbx + 0x18]
mov qword [rbx + 8], rax
lea rcx, [rdx + 1]
mov qword [rbx + 0x18], rcx
mov rcx, r13
mov qword [rax + rdx*8], rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x14023de40]
mov rcx, r13
lea eax, [rdi + 1]
mov dword [0x14023de40], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rbx + 0x20], edi
lea rdi, [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call fcn.14007dae0
mov r8d, dword [rbx + 0x20]
test r8d, r8d
jne 0x1400976e0
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rdx, rsi
mov rcx, rdi
mov r8, rax
call fcn.14007e800
cmp qword [rsp + 0x28], 0x18
ja 0x1400976f8
xor edx, edx
mov rcx, rdi
call fcn.14007d860
mov ecx, dword [0x14023de44]
mov rdx, rbx
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [rsp + 0x38]
sub rax, qword [rbp]
jne 0x14009775d
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [0x1401db6b0]
mov rcx, rdi
call fcn.14007ed40
jmp 0x140097682
cmp qword [rsp + 0x20], 0x18
jbe 0x140097745
mov qword [rsp + 0x28], 0x18
mov rax, qword [rsp + 0x30]
cmp rax, r12
je 0x140097720
mov byte [rax + 0x18], 0
jmp 0x1400976a0
cmp byte [r12], 0
je 0x1400976a0
mov r8d, 0xac
lea rdx, [0x1401db6d6]
lea rcx, [0x1401db6e1]
call qword [sym.imp.msvcrt.dll__assert]
lea r8, [0x1401db6b8]
mov edx, 0xa7
lea rcx, [0x1401db6d6]
call fcn.1400a0ca0
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop