joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69597fb0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x696330a0]
mov rbx, qword [str._AYi]
test al, al
je 0x69598040
mov rcx, qword [0x696339a0]
lea rax, [rsp + 0x58]
lea rdx, [0x69636795]
mov qword [rsp + 0x28], rax
call fcn.69594440
mov r8, qword [rsp + 0x28]
mov rcx, qword [0x696339a0]
lea rdx, str.Got_event__d_while_waitingForClipboardEvents
call fcn.6958db40
mov rcx, qword [0x696339a0]
lea rdx, [0x6963679c]
call fcn.69594440
mov ecx, 1
call rbx
mov rcx, qword [0x696339a0]
cmp rcx, rax
je 0x69598038
call sub.msvcrt.dll_fflush
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, [0x696330a0]
call fcn.695f59f0
test eax, eax
je 0x69597fd7
mov ecx, 1
call rbx
lea rcx, [0x69636750]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x6959808b
lea rdx, [0x6963676b]
lea rcx, str._tmp_dpf.stdout.log
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x696330a0]
mov qword [0x696339a0], rax
call fcn.695f5b00
jmp 0x69597fd7

Function at 0x695980d0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x696330b0]
mov rbx, qword [str._AYi]
test al, al
je 0x69598170
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov rcx, qword [0x696339b0]
mov rbx, qword [rsp + 0x28]
cmp rcx, rax
je 0x695981e0
lea rdx, [0x69634077]
call fcn.69594440
mov rcx, qword [0x696339b0]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x696339b0]
lea rdx, [0x6963407e]
call fcn.69594440
mov rcx, qword [0x696339b0]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x696330b0]
call fcn.695f59f0
test eax, eax
je 0x695980fc
mov ecx, 2
call rbx
lea rcx, [0x69634032]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x695981bf
lea rdx, [0x6963404d]
lea rcx, [0x69634050]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x696330b0]
mov qword [0x696339b0], rax
call fcn.695f5b00
jmp 0x695980fc
lea rdx, [0x69634065]
call fcn.69594440
mov rcx, qword [0x696339b0]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x696339b0]
lea rdx, [0x69634071]
call fcn.69594440
jmp 0x69598153
Function at 0x69598240
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x696330c0]
mov rbx, qword [str._AYi]
test al, al
je 0x695982e0
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov rcx, qword [0x696339c0]
mov rbx, qword [rsp + 0x28]
cmp rcx, rax
je 0x69598350
lea rdx, [0x696349a0]
call fcn.69594440
mov rcx, qword [0x696339c0]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x696339c0]
lea rdx, [0x696349a7]
call fcn.69594440
mov rcx, qword [0x696339c0]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x696330c0]
call fcn.695f59f0
test eax, eax
je 0x6959826c
mov ecx, 2
call rbx
lea rcx, [0x6963495b]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x6959832f
lea rdx, [0x69634976]
lea rcx, [0x69634979]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x696330c0]
mov qword [0x696339c0], rax
call fcn.695f5b00
jmp 0x6959826c
lea rdx, [0x6963498e]
call fcn.69594440
mov rcx, qword [0x696339c0]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x696339c0]
lea rdx, [0x6963499a]
call fcn.69594440
jmp 0x695982c3

Function at 0x695983b0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x696330d0]
mov rbx, qword [str._AYi]
test al, al
je 0x69598450
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov rcx, qword [0x696339d0]
mov rbx, qword [rsp + 0x28]
cmp rcx, rax
je 0x695984c0
lea rdx, [0x69634c6d]
call fcn.69597f80
mov rcx, qword [0x696339d0]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x696339d0]
lea rdx, [0x69634c74]
call fcn.69597f80
mov rcx, qword [0x696339d0]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x696330d0]
call fcn.695f59f0
test eax, eax
je 0x695983dc
mov ecx, 2
call rbx
lea rcx, [0x69634c28]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x6959849f
lea rdx, [0x69634c43]
lea rcx, [0x69634c46]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x696330d0]
mov qword [0x696339d0], rax
call fcn.695f5b00
jmp 0x695983dc
lea rdx, [0x69634c5b]
call fcn.69597f80
mov rcx, qword [0x696339d0]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x696339d0]
lea rdx, [0x69634c67]
call fcn.69597f80
jmp 0x69598433
Function at 0x69598520
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x69633110]
mov rbx, qword [str._AYi]
test al, al
je 0x695985c0
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov rcx, qword [0x69633a10]
mov rbx, qword [rsp + 0x28]
cmp rcx, rax
je 0x69598630
lea rdx, [0x69636135]
call fcn.69594440
mov rcx, qword [0x69633a10]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a10]
lea rdx, [0x6963613c]
call fcn.69594440
mov rcx, qword [0x69633a10]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x69633110]
call fcn.695f59f0
test eax, eax
je 0x6959854c
mov ecx, 2
call rbx
lea rcx, [0x696360f0]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x6959860f
lea rdx, [0x6963610b]
lea rcx, [0x6963610e]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x69633110]
mov qword [0x69633a10], rax
call fcn.695f5b00
jmp 0x6959854c
lea rdx, [0x69636123]
call fcn.69594440
mov rcx, qword [0x69633a10]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a10]
lea rdx, [0x6963612f]
call fcn.69594440
jmp 0x695985a3

Function at 0x69598690
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x69633140]
mov rbx, qword [str._AYi]
test al, al
je 0x69598730
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov rcx, qword [0x69633a40]
mov rbx, qword [rsp + 0x28]
cmp rcx, rax
je 0x695987a0
lea rdx, [0x69636515]
call fcn.69594440
mov rcx, qword [0x69633a40]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a40]
lea rdx, [0x6963651c]
call fcn.69594440
mov rcx, qword [0x69633a40]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x69633140]
call fcn.695f59f0
test eax, eax
je 0x695986bc
mov ecx, 2
call rbx
lea rcx, [0x696364d0]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x6959877f
lea rdx, [0x696364eb]
lea rcx, [0x696364ee]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x69633140]
mov qword [0x69633a40], rax
call fcn.695f5b00
jmp 0x695986bc
lea rdx, [0x69636503]
call fcn.69594440
mov rcx, qword [0x69633a40]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a40]
lea rdx, [0x6963650f]
call fcn.69594440
jmp 0x69598713
Function at 0x69598800
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x69633150]
mov rbx, qword [str._AYi]
test al, al
je 0x695988a0
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov rcx, qword [0x69633a50]
mov rbx, qword [rsp + 0x28]
cmp rcx, rax
je 0x69598910
lea rdx, [0x69636795]
call fcn.69594440
mov rcx, qword [0x69633a50]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a50]
lea rdx, [0x6963679c]
call fcn.69594440
mov rcx, qword [0x69633a50]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x69633150]
call fcn.695f59f0
test eax, eax
je 0x6959882c
mov ecx, 2
call rbx
lea rcx, [0x69636750]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x695988ef
lea rdx, [0x6963676b]
lea rcx, [0x6963676e]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x69633150]
mov qword [0x69633a50], rax
call fcn.695f5b00
jmp 0x6959882c
lea rdx, [0x69636783]
call fcn.69594440
mov rcx, qword [0x69633a50]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a50]
lea rdx, [0x6963678f]
call fcn.69594440
jmp 0x69598883

Function at 0x69598970
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x69633160]
mov rbx, qword [str._AYi]
test al, al
je 0x69598a10
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov rcx, qword [0x69633a60]
mov rbx, qword [rsp + 0x28]
cmp rcx, rax
je 0x69598a80
lea rdx, [0x69636ab4]
call fcn.69594440
mov rcx, qword [0x69633a60]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a60]
lea rdx, [0x69636a6d]
call fcn.695944a0
mov rcx, qword [0x69633a60]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x69633160]
call fcn.695f59f0
test eax, eax
je 0x6959899c
mov ecx, 2
call rbx
lea rcx, [0x69636a6f]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x69598a5f
lea rdx, [0x69636a8a]
lea rcx, [0x69636a8d]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x69633160]
mov qword [0x69633a60], rax
call fcn.695f5b00
jmp 0x6959899c
lea rdx, [0x69636aa2]
call fcn.69594440
mov rcx, qword [0x69633a60]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a60]
lea rdx, [0x69636aae]
call fcn.69594440
jmp 0x695989f3
Function at 0x69598ae0
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x69633170]
mov rbx, qword [str._AYi]
test al, al
je 0x69598b80
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov rcx, qword [0x69633a70]
mov rbx, qword [rsp + 0x28]
cmp rcx, rax
je 0x69598bf0
lea rdx, [0x696375b1]
call fcn.69594440
mov rcx, qword [0x69633a70]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a70]
lea rdx, [0x696375b8]
call fcn.69594440
mov rcx, qword [0x69633a70]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x69633170]
call fcn.695f59f0
test eax, eax
je 0x69598b0c
mov ecx, 2
call rbx
lea rcx, [0x6963756c]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x69598bcf
lea rdx, [0x69637587]
lea rcx, [0x6963758a]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x69633170]
mov qword [0x69633a70], rax
call fcn.695f5b00
jmp 0x69598b0c
lea rdx, [0x6963759f]
call fcn.69594440
mov rcx, qword [0x69633a70]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a70]
lea rdx, [0x696375ab]
call fcn.69594440
jmp 0x69598b63

Function at 0x69598c50
Capabilities:
Query environment variable

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x69633180]
mov rbx, qword [str._AYi]
test al, al
je 0x69598cf0
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov rcx, qword [0x69633a80]
mov rbx, qword [rsp + 0x28]
cmp rcx, rax
je 0x69598d60
lea rdx, str._dpf_
call fcn.69594440
mov rcx, qword [0x69633a80]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a80]
lea rdx, [0x6963939c]
call fcn.69594440
mov rcx, qword [0x69633a80]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x69633180]
call fcn.695f59f0
test eax, eax
je 0x69598c7c
mov ecx, 2
call rbx
lea rcx, str.DPF_CAPTURE_CONSOLE_OUTPUT
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x69598d3f
lea rdx, [0x6963936b]
lea rcx, str._tmp_dpf.stderr2.log
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x69633180]
mov qword [0x69633a80], rax
call fcn.695f5b00
jmp 0x69598c7c
lea rdx, str.e_31m_dpf_
call fcn.69594440
mov rcx, qword [0x69633a80]
mov rdx, r12
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a80]
lea rdx, str.e_0m_n
call fcn.69594440
jmp 0x69598cd3
Function at 0x69598f40
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x696330f0]
mov rbx, qword [str._AYi]
test al, al
je 0x69598fe0
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov r9, qword [0x696339f0]
mov rbx, qword [rsp + 0x28]
cmp rax, r9
je 0x69599050
mov rcx, r9
lea rdx, [0x69635ea2]
call fcn.69594440
mov rcx, qword [0x696339f0]
lea rdx, [0x69635e70]
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x696339f0]
lea rdx, [0x69635ea9]
call fcn.69594440
mov rcx, qword [0x696339f0]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, [0x696330f0]
call fcn.695f59f0
test eax, eax
je 0x69598f67
mov ecx, 2
call rbx
lea rcx, [0x69635e30]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x6959902f
lea rdx, [0x69635e4b]
lea rcx, [0x69635e4e]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x696330f0]
mov qword [0x696339f0], rax
call fcn.695f5b00
jmp 0x69598f67
lea rdx, [0x69635e63]
mov rcx, rax
call fcn.69594440
mov rcx, qword [0x696339f0]
mov r8, rbx
lea rdx, [0x69635e70]
call fcn.6958db40
mov rcx, qword [0x696339f0]
lea rdx, [0x69635e9c]
call fcn.69594440
jmp 0x69598fc5

Function at 0x695990c0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x69633100]
mov rbx, qword [str._AYi]
test al, al
je 0x69599160
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov r9, qword [0x69633a00]
mov rbx, qword [rsp + 0x28]
cmp rax, r9
je 0x695991d0
mov rcx, r9
lea rdx, [0x69636002]
call fcn.69594440
mov rcx, qword [0x69633a00]
lea rdx, [0x69635fd0]
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a00]
lea rdx, [0x69636009]
call fcn.69594440
mov rcx, qword [0x69633a00]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, [0x69633100]
call fcn.695f59f0
test eax, eax
je 0x695990e7
mov ecx, 2
call rbx
lea rcx, [0x69635f90]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x695991af
lea rdx, [0x69635fab]
lea rcx, [0x69635fae]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x69633100]
mov qword [0x69633a00], rax
call fcn.695f5b00
jmp 0x695990e7
lea rdx, [0x69635fc3]
mov rcx, rax
call fcn.69594440
mov rcx, qword [0x69633a00]
mov r8, rbx
lea rdx, [0x69635fd0]
call fcn.6958db40
mov rcx, qword [0x69633a00]
lea rdx, [0x69635ffc]
call fcn.69594440
jmp 0x69599145
Function at 0x695993c0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
movzx eax, byte [0x69633130]
mov rbx, qword [str._AYi]
test al, al
je 0x69599460
lea rax, [rsp + 0x58]
mov ecx, 1
mov qword [rsp + 0x28], rax
call rbx
mov r9, qword [0x69633a30]
mov rbx, qword [rsp + 0x28]
cmp rax, r9
je 0x695994d0
mov rcx, r9
lea rdx, [0x69636452]
call fcn.69594440
mov rcx, qword [0x69633a30]
lea rdx, [0x69636420]
mov r8, rbx
call fcn.6958db40
mov rcx, qword [0x69633a30]
lea rdx, [0x69636459]
call fcn.69594440
mov rcx, qword [0x69633a30]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, [0x69633130]
call fcn.695f59f0
test eax, eax
je 0x695993e7
mov ecx, 2
call rbx
lea rcx, [0x696363e0]
mov rsi, rax
call sub.msvcrt.dll_getenv
mov r8, rax
mov rax, rsi
test r8, r8
je 0x695994af
lea rdx, [0x696363fb]
lea rcx, [0x696363fe]
call sub.msvcrt.dll_fopen
test rax, rax
cmove rax, rsi
lea rcx, [0x69633130]
mov qword [0x69633a30], rax
call fcn.695f5b00
jmp 0x695993e7
lea rdx, [0x69636413]
mov rcx, rax
call fcn.69594440
mov rcx, qword [0x69633a30]
mov r8, rbx
lea rdx, [0x69636420]
call fcn.6958db40
mov rcx, qword [0x69633a30]
lea rdx, [0x6963644c]
call fcn.69594440
jmp 0x69599445
Function at 0x695a1980
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
movups xmmword [rsp + 0x80], xmm6
movups xmmword [rsp + 0x90], xmm7
movups xmmword [rsp + 0xa0], xmm8
pxor xmm7, xmm7
mov rsi, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movupd xmm6, xmm1
lea rdi, [rsp + 0x30]
mov rbx, rcx
mov rcx, rdi
call rsi
comisd xmm7, xmm6
mov rdx, qword [rbx]
mov rax, qword [rsp + 0x30]
movsd xmm2, qword [rbx + 0x10]
movsd xmm3, qword [rdx]
ja 0x695a1bb0
movsd xmm1, qword [0x69639a60]
comisd xmm1, xmm6
jae 0x695a1ab0
pxor xmm0, xmm0
subsd xmm6, xmm1
cvtsi2sd xmm0, rax
divsd xmm0, xmm3
subsd xmm0, xmm2
addsd xmm6, xmm0
comisd xmm0, xmm6
jae 0x695a1ba0
mov r14, qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov r15, qword [sym.imp.USER32.dll_WaitMessage]
lea r13, [rbx + 0x18]
lea rbp, [rbx + 0x20]
movsd xmm8, qword [0x69639a68]
jmp 0x695a1a94
mulsd xmm0, xmm8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x4bf
cvttsd2si r9, xmm0
call r14
mov rdx, rbp
mov rcx, r13
call fcn.695c82e0
mov r12d, eax
test eax, eax
jne 0x695a1ac0
mov rcx, rdi
call rsi
mov rax, qword [rbx]
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x30]
divsd xmm0, qword [rax]
subsd xmm0, qword [rbx + 0x10]
comisd xmm0, xmm6
jae 0x695a1ba0
movupd xmm4, xmm6
subsd xmm4, xmm0
comisd xmm7, xmm4
movupd xmm0, xmm4
jbe 0x695a1a40
call r15
jmp 0x695a1a5c
lea rdx, [rbx + 0x20]
lea rcx, [rbx + 0x18]
call fcn.695c82e0
mov r12d, eax
xor esi, esi
cmp qword [rbx + 0x18], 0
mov rbp, qword [sym.imp.USER32.dll_UpdateWindow]
je 0x695a1af7
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + rsi*8]
mov eax, dword [rcx + 0x48]
and eax, 0x11
cmp eax, 1
je 0x695a1b30
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0x30]
add rsi, 1
call rbp
cmp qword [rbx + 0x18], rsi
ja 0x695a1ad0
movups xmm6, xmmword [rsp + 0x80]
movups xmm7, xmmword [rsp + 0x90]
mov eax, r12d
movups xmm8, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x30], 0
mov rdx, rdi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x30], 4
call qword [rcx + 0x20]
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + rsi*8]
mov rax, qword [rax + 0x10]
jmp 0x695a1ae7
xor r12d, r12d
jmp 0x695a1ac0
call qword [sym.imp.USER32.dll_WaitMessage]
lea rdx, [rbx + 0x20]
lea rcx, [rbx + 0x18]
call fcn.695c82e0
mov r12d, eax
jmp 0x695a1ac0

Function at 0x695a1bd0
Capabilities:
Query environment variable

Disassembly:
test rdx, rdx
je 0x695a1bf8
cmp byte [rdx], 0
je 0x695a1bf8
mov rcx, qword [rcx]
test rcx, rcx
je 0x695a1bf0
mov r8, rdx
mov edx, 1
jmp fcn.695af180
ret
mov r9d, 0xc0
lea r8, str._home_runner_work_trnr_plugins_trnr_plugins_lib_dpf_dgl_src_ApplicationPrivateData.cpp
lea rdx, [0x69635f60]
lea rcx, [0x69635e70]
jmp fcn.69598f40
mov rcx, qword [rcx + 8]
jmp 0x695a1bd0
Function at 0x695a1c40
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [rcx + 0x10]
test eax, eax
je 0x695a1c58
sub eax, 1
mov dword [rcx + 0x10], eax
jne 0x695a1c53
mov byte [rcx + 9], 1
ret
mov r9d, 0x70
lea r8, str._home_runner_work_trnr_plugins_trnr_plugins_lib_dpf_dgl_src_ApplicationPrivateData.cpp
lea rdx, str.visibleWindows___0
lea rcx, [0x69635e70]
jmp fcn.69598f40

Function at 0x695a1e20
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dl, 1
mov esi, edx
mov rbx, rcx
sbb edx, edx
xor ecx, ecx
lea rdi, [rbx + 0x38]
add edx, 1
cmp sil, 1
setb cl
call fcn.695a3be0
mov byte [rbx + 8], sil
lea rsi, [rbx + 0x20]
mov qword [rbx], rax
mov dword [rbx + 9], 0x10000
mov dword [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
movq xmm0, rdi
mov rcx, qword [rbx]
mov qword [rbx + 0x28], rsi
punpcklqdq xmm0, xmm0
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x48], 0
movups xmmword [rbx + 0x38], xmm0
test rcx, rcx
je 0x695a1ec8
mov rdx, rbx
call fcn.695af170
mov rcx, qword [rbx]
lea r8, [0x69635f18]
mov edx, 1
call fcn.695af180
nop
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9d, 0x45
lea r8, str._home_runner_work_trnr_plugins_trnr_plugins_lib_dpf_dgl_src_ApplicationPrivateData.cpp
lea rdx, str.world___nullptr
lea rcx, [0x69635e70]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.69598f40

Function at 0x695a2080
Capabilities:
Query environment variable

Disassembly:
test rdx, rdx
je 0x695a1bf8
cmp byte [rdx], 0
je 0x695a1bf8
mov rcx, qword [rcx]
test rcx, rcx
je 0x695a1bf0
mov r8, rdx
mov edx, 1
jmp fcn.695af180
ret
mov r9d, 0xc0
lea r8, str._home_runner_work_trnr_plugins_trnr_plugins_lib_dpf_dgl_src_ApplicationPrivateData.cpp
lea rdx, [0x69635f60]
lea rcx, [0x69635e70]
jmp fcn.69598f40
mov rcx, qword [rcx + 8]
jmp 0x695a1bd0

Function at 0x695a7e50
Capabilities:
Query environment variable

Disassembly:
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0x10]
jmp fcn.695c02a0

Function at 0x695ad460
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x40
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
mov rbx, qword [rcx + 8]
comiss xmm1, xmm2
movups xmm6, xmm1
movups xmm7, xmm2
jae 0x695ad4e0
movss xmm0, dword [rbx + 0x28]
comiss xmm1, xmm0
ja 0x695ad4c0
comiss xmm0, xmm2
jbe 0x695ad4a1
mov rcx, qword [rbx + 8]
movss dword [rbx + 0x28], xmm2
movss dword [rbx + 0x30], xmm2
mov rax, qword [rcx]
call qword [rax + 0x10]
movss dword [rbx + 0x1c], xmm6
movss dword [rbx + 0x20], xmm7
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rbx + 8]
movss dword [rbx + 0x28], xmm1
movss dword [rbx + 0x30], xmm1
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x695ad4a1
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
mov r9d, 0x222
lea r8, str._home_runner_work_trnr_plugins_trnr_plugins_lib_dpf_dgl_src_EventHandlers.cpp
lea rdx, str.max___min
lea rcx, [0x696361f8]
add rsp, 0x40
pop rbx
jmp fcn.69598520