joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cd5b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x1400cd5db
mov rcx, qword [rsp + 0x90]
call fcn.1400cc080
mov rcx, qword [rsp + 0x88]
call fcn.1400c8da0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x1400cd626
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.1400d2b20
mov rax, qword [rsp + 0x80]
jmp 0x1400cd719
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
call fcn.1400cc3f0
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
and eax, 0x400
test eax, eax
je 0x1400cd6b6
mov rcx, qword [rsp + 0x88]
call fcn.1400d29c0
movzx eax, al
test eax, eax
je 0x1400cd677
mov r8d, dword [rsp + 0x24]
mov edx, 4
lea rcx, [rsp + 0x48]
call fcn.1400d2de0
mov qword [rsp + 0x28], rax
jmp 0x1400cd690
mov r8d, dword [rsp + 0x24]
mov edx, 9
lea rcx, [rsp + 0x50]
call fcn.1400d2de0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call fcn.1400cb6e0
mov rax, qword [rsp + 0x80]
jmp 0x1400cd719
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x1400cd6dc
mov r8d, dword [rsp + 0x24]
mov edx, 3
lea rcx, [rsp + 0x58]
call fcn.1400d2de0
mov qword [rsp + 0x30], rax
jmp 0x1400cd6f5
mov r8d, dword [rsp + 0x24]
mov edx, 2
lea rcx, [rsp + 0x60]
call fcn.1400d2de0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.1400cb6e0
mov rax, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x1400cfab0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x60], 0
je 0x1400cfad5
mov rcx, qword [rsp + 0x60]
call fcn.1400cc080
cmp qword [rsp + 0x58], 0
je 0x1400cfb10
mov rcx, qword [rsp + 0x50]
call fcn.1400c8da0
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x58]
call fcn.1400c8da0
xor r8d, r8d
mov rcx, qword [rsp + 0x28]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
mov dword [rsp + 0x20], eax
jmp 0x1400cfb29
mov rcx, qword [rsp + 0x50]
call fcn.1400c8da0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400cfb34
mov al, 1
jmp 0x1400cfb7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x30]
call fcn.140012630
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.1400d3680
movzx eax, al
test eax, eax
je 0x1400cfb62
xor al, al
jmp 0x1400cfb7e
lea r9, str.boost::filesystem::create_directory
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x24]
call fcn.1400d46e0
xor al, al
add rsp, 0x48
ret

Function at 0x1400cfe20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x28], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1400cfe53
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov eax, 2
mov rcx, qword [rsp + 0x38]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba300
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14008d540
nop
lea rcx, [rsp + 0x30]
call fcn.14008b4f0
mov rdx, rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1400cfeb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
jmp 0x1400cfec0
mov dword [rsp + 0x24], 0
lea r8, [0x140170a50]
mov rdx, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x24]
call fcn.1400d32e0
lea rcx, [rsp + 0x30]
call fcn.14008b4f0
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.1400c8730
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x30]
call fcn.1400c4300
mov rax, qword [rsp + 0x60]
add rsp, 0x58
ret

Function at 0x1400cff20
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.1400c8da0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x1400cff51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x1400cff59
mov dword [rsp + 0x20], 0
lea r9, str.boost::filesystem::current_path
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x20]
call fcn.1400cc270
add rsp, 0x38
ret
Function at 0x1400d2500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.1400c8da0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x1400d254a
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x2c]
call fcn.1400d2b20
mov rcx, rax
call fcn.140012600
jmp 0x1400d25c5
cmp qword [rsp + 0x58], 0
je 0x1400d255c
mov rcx, qword [rsp + 0x58]
call fcn.1400cc080
mov eax, dword [rsp + 0x20]
and eax, 0x400
test eax, eax
je 0x1400d25a4
mov rcx, qword [rsp + 0x50]
call fcn.1400d29c0
movzx eax, al
test eax, eax
je 0x1400d259d
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x1400d258f
mov dword [rsp + 0x24], listen
jmp 0x1400d2597
mov dword [rsp + 0x24], 4
mov eax, dword [rsp + 0x24]
jmp 0x1400d25c5
mov eax, 9
jmp 0x1400d25c5
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x1400d25b9
mov dword [rsp + 0x28], 3
jmp 0x1400d25c1
mov dword [rsp + 0x28], 2
mov eax, dword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x1400d37b0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.1400c8da0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400d37ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400d3750
movzx eax, al
test eax, eax
jne 0x1400d37ee
mov dword [rsp + 0x20], 0
jmp 0x1400d37f6
mov dword [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400d3800
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call fcn.1400c8da0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400d383e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400d3750
movzx eax, al
test eax, eax
jne 0x1400d383e
mov dword [rsp + 0x20], 0
jmp 0x1400d3846
mov dword [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400d3850
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14008d540
nop
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x1400d38e0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400d38e0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400d38e0
mov dword [rsp + 0x40], 1
jmp 0x1400d38e8
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x48]
call fcn.1400d2e50
mov eax, dword [rsp + 0x44]
add rsp, 0x68
ret
Function at 0x1400d3a30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jbe 0x1400d3b01
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x30], rax
mov eax, 2
mov rcx, qword [rsp + 0x30]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba300
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.14008d540
nop
lea rcx, [rsp + 0x28]
call fcn.14008b4f0
mov r8d, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x1400d3af7
lea rcx, [rsp + 0x28]
call fcn.14008b4f0
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.140005b50
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x28]
call fcn.1400c4300
mov rax, qword [rsp + 0x50]
jmp 0x1400d3b1b
lea rcx, [rsp + 0x28]
call fcn.1400c4300
mov rcx, qword [rsp + 0x50]
call fcn.140005690
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x1400eedb0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400ee890
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400eedef
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140167720]
jmp 0x1400eedf9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14010f3b0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400bb800
sub rsp, rax
mov rax, qword [0x1401bf0a0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1401c6780]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, listen
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14010f5a2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14010f4f6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14010f4f6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14010f4db
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14010f478
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14010f562
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, listen
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14010f5c1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14010f59d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, listen
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14010f5c1
jmp 0x14010f44e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, listen
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400ba210
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14010f5e0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400bb800
sub rsp, rax
mov rax, qword [0x1401bf0a0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1401c6780]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, listen
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14010f7ed
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14010f739
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14010f739
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14010f719
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, reloc.WS2_32.dll_listen
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14010f6a8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14010f7ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, listen
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14010f80c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14010f7e8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, listen
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14010f80c
jmp 0x14010f67e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, listen
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400ba210
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140112fe0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14011300c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14010bab0
mov eax, 0xffffffff
jmp 0x14011300e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140132610
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140131a00
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140132677
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140167728]
jmp 0x140132699
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140132ad0
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x14013a2d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140149aa0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14008d540
lea rcx, [rsp + 0x20]
call fcn.140149990
movzx eax, al
test eax, eax
jne 0x140149ae5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140149970
mov rax, qword [rsp + 0x40]
jmp 0x140149bdf
lea rcx, [rsp + 0x20]
call fcn.14008b4f0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140149a10
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140108610
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14008d540
lea rcx, [rsp + 0x28]
call fcn.1400b9620
movzx eax, al
test eax, eax
jne 0x140149b7f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400b9600
lea rcx, [rsp + 0x20]
call fcn.140149970
mov rax, qword [rsp + 0x50]
jmp 0x140149bdf
lea rcx, [rsp + 0x20]
call fcn.14008b4f0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14008b4f0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400d8c00
lea rcx, [rsp + 0x28]
call fcn.1400d6960
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400b9600
lea rcx, [rsp + 0x20]
call fcn.140149970
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x14014a780
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x14003c490]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x14003c4a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.14001c9b0
jmp 0x14000123c
mov rax, qword [0x14003c4a0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x14003c4a0]
mov dword [rax], 1
mov rax, qword [0x14003c4e0]
mov rdx, rax
mov rax, qword [0x14003c4d0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000123c
mov dword [0x140040024], 1
mov rax, qword [0x14003c4a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x14003c4c0]
mov rdx, rax
mov rax, qword [0x14003c4b0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov rax, qword [0x14003c4a0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x14003c490]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x14003c3e0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x14003c3e0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.14001bc38
mov rax, qword [0x14003c520]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x14003c480]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.14001b430
mov eax, dword [0x140040004]
lea rdx, [0x140040008]
mov ecx, eax
call fcn.14000147c
call fcn.14001b1c7
mov rax, qword [0x14003c410]
mov rax, qword [rax]
mov rdx, qword [0x140040010]
mov qword [rax], rdx
mov rcx, qword [0x140040010]
mov rdx, qword [0x140040008]
mov eax, dword [0x140040004]
mov r8, rcx
mov ecx, eax
call fcn.1400016d0
mov dword [0x14004001c], eax
mov eax, dword [0x140040020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14004001c]
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x140040024]
test eax, eax
jne 0x14000136c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x14004001c]
add rsp, 0x70
pop rbp
ret