joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002e90
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov ebx, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14001f18e
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x14001f1ad
inc ebx
cmp ebx, 5
jg 0x14001f1cc
lea ecx, [rax + 0x13]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001f1be
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
jmp 0x140002eb2
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]

Function at 0x1400035f8
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
lea rax, fcn.14000322c
xorps xmm0, xmm0
mov qword [0x14005fc60], rax
xor eax, eax
cmp dword [0x14005f3ec], eax
mov qword [0x14005fc68], rax
movdqa xmmword [0x14005fc70], xmm0
mov dword [0x14005fc80], eax
mov dword [0x14005fc88], eax
jne 0x14000363f
lea rcx, [0x14005f3e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [0x14005fc60]
add rsp, 0x28
ret

Function at 0x14000364c
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and dword [rdx], 0
mov rsi, rdx
and dword [rax + 0x18], 0
lea rdx, [rax + 0x10]
and dword [rax + 0x10], 0
mov rdi, r8
and qword [rax + 0x20], 0
mov r14, rcx
and dword [r8], 0
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebp, eax
test eax, eax
je 0x1400036e0
mov ecx, ebp
call fcn.140007230
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, r14
mov rbx, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1400036d2
lea r9, [rsp + 0x60]
mov rcx, rbx
lea r8, [rsp + 0x68]
lea rdx, [0x14002fd70]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400036d2
mov rcx, qword [rsp + 0x68]
mov eax, dword [rcx + 0xc]
mov dword [rsi], eax
mov eax, dword [rcx + 8]
mov dword [rdi], eax
test rbx, rbx
je 0x1400036e0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140006374
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
lea eax, [rcx - 1]
xor r12d, r12d
mov rsi, rdx
mov r14d, ecx
cmp eax, 1
ja 0x1400200d4
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov rcx, rax
call fcn.140007e90
test eax, eax
jne 0x1400200e0
lea rcx, [rsp + 0x88]
call fcn.140007e3c
test eax, eax
jne 0x1400200ef
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov qword [rsp + 0x38], r12
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x30], r12
mov r9d, edi
mov dword [rsp + 0x28], r12d
mov r8, rsi
xor edx, edx
mov qword [rsp + 0x20], r12
mov ecx, eax
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rcx, rbx
call fcn.140007230
mov qword [rsp + 0x38], r12
mov r9d, edi
mov qword [rsp + 0x30], r12
mov r8, rsi
mov dword [rsp + 0x28], ebx
xor edx, edx
mov ecx, r15d
mov qword [rsp + 0x20], rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 1
jl 0x140006469
lea r8d, [rax - 1]
mov rdx, rbp
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
test rbp, rbp
je 0x140006450
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
xor ecx, ecx
call fcn.14000c824
int3
call qword [sym.imp.KERNEL32.dll_GetACP]
nop
jmp 0x1400063d0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__cputws]
nop
jmp 0x140006450
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], r12w
jne 0x1400200f3
mov rcx, qword [rsp + 0x88]
lea r8d, [rdi + rdi]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], r12
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
jmp 0x140006450

Function at 0x140007e3c
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
xor r8d, r8d
lea rcx, str.VS_UNICODE_OUTPUT
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140020a04
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140011450
add rsp, 0xb0
pop rbx
ret
mov r8d, 0x40
lea rdx, [rsp + 0x20]
lea rcx, str.VS_UNICODE_OUTPUT
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi64]
mov qword [rbx], rax
mov eax, 1
jmp 0x140007e74
Function at 0x140008310
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp word [rcx], 0
mov rdi, rcx
mov rbx, rcx
je 0x14000833e
add rbx, 2
cmp word [rbx], 0
jne 0x140008334
sub rbx, 4
lea r15, str.0123456789abcdef
xor r14d, r14d
mov ebp, r14d
mov rcx, qword [0x14005da90]
lea r8, [rsp + 0x40]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140020b1e
movzx ecx, byte [rsp + 0x40]
lea r8, [0x14002fed0]
mov eax, ecx
mov rdx, rbx
and eax, 0xf
shr rcx, 4
movzx eax, word [r15 + rax*2]
mov word [rbx - 2], ax
movzx eax, word [r15 + rcx*2]
movzx ecx, byte [rsp + 0x41]
mov word [rbx - 4], ax
mov eax, ecx
and eax, 0xf
shr rcx, 4
movzx eax, word [r15 + rax*2]
mov word [rbx - 6], ax
movzx eax, word [r15 + rcx*2]
movzx ecx, byte [rsp + 0x42]
mov word [rbx - 8], ax
mov eax, ecx
and eax, 0xf
shr rcx, 4
movzx eax, word [r15 + rax*2]
mov word [rbx - 0xa], ax
movzx eax, word [r15 + rcx*2]
movzx ecx, byte [rsp + 0x43]
mov word [rbx - 0xc], ax
mov eax, ecx
and eax, 0xf
shr rcx, 4
movzx eax, word [r15 + rax*2]
mov word [rbx - 0xe], ax
movzx eax, word [r15 + rcx*2]
mov rcx, rdi
mov word [rbx - 0x10], ax
call fcn.1400084c4
test eax, eax
jne 0x140020b2e
lea r8, [0x14002fec8]
mov rdx, rbx
mov rcx, rdi
call fcn.1400084c4
test eax, eax
jne 0x140020b2e
lea r8, [0x14002fec0]
mov rdx, rbx
mov rcx, rdi
call fcn.1400084c4
test eax, eax
jne 0x140020b2e
lea r8, [0x14002feb8]
mov rdx, rbx
mov rcx, rdi
call fcn.1400084c4
test eax, eax
jne 0x140020b2e
lea r8, [0x14002feb0]
mov rdx, rbx
mov rcx, rdi
call fcn.1400084c4
test eax, eax
jne 0x140020b2e
lea r8, [0x14002fea8]
mov rdx, rbx
mov rcx, rdi
call fcn.1400084c4
test eax, eax
jne 0x140020b2e
lea r8, [0x14002fea0]
mov rdx, rbx
mov rcx, rdi
call fcn.1400084c4
test eax, eax
jne 0x140020b2e
mov word [rbx], r14w
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov ecx, 0x1f65
call fcn.14000c824
nop
jmp 0x14000836e
inc ebp
cmp ebp, 0x64
jl 0x14000834f
mov ecx, 0x1f65
call fcn.14000c824
xor eax, eax
jmp 0x1400084ab

Function at 0x1400085a4
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8d, 0xa
lea rdx, [rsp + 0x20]
lea rcx, str.MPCL_SERVER_373011
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ebx, ebx
test eax, eax
je 0x140008608
lea rdx, str.bananana
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
sete bl
mov dword [0x14005fc4c], ebx
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140011450
add rsp, 0x40
pop rbx
ret
xor eax, eax
jmp 0x1400085f5
Function at 0x14000c1b4
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov edi, dword [0x14005b070]
xor r15d, r15d
mov eax, 0xc7
mov r14, rcx
cmp edi, eax
movzx esi, r15w
mov ebx, r15d
mov ebp, r15d
cmovg edi, eax
lea r12d, [r15 + 0x5c]
mov rax, qword [rcx + 0x40]
cmp word [rax + 2], 0x3a
lea rcx, [rax + 4]
jne 0x140021bc0
cmp word [rcx], r12w
jne 0x140021bc0
mov rbx, rcx
test rbx, rbx
je 0x14000c222
add rbx, 2
movzx esi, word [rbx]
mov word [rbx], r15w
mov rbp, qword [r14 + 0x40]
xor r9d, r9d
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14000c250
mov rcx, qword [rsp + 0x50]
imul edx, edi, 0x2dc6c0
cmp rcx, rdx
jb 0x140021bff
mov dword [0x14005b070], edi
test rbx, rbx
je 0x14000c25e
mov word [rbx], si
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp word [rax], r12w
jne 0x14000c222
cmp word [rax + 2], r12w
jne 0x14000c222
mov edx, r12d
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbx, rax
test rax, rax
je 0x14000c222
mov edx, r12d
lea rcx, [rax + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbx, rax
jmp 0x14000c20e
movabs rax, 0x65e9f80f292119e5
mul rcx
sub rcx, rdx
shr rcx, 1
lea rdi, [rdx + rcx]
shr rdi, 0x15
jmp 0x14000c250
Function at 0x14000c774
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
xor edi, edi
mov rcx, qword [0x14005f3d0]
test rcx, rcx
je 0x14000c7e8
mov eax, ebx
mov r8d, 6
shr eax, 4
inc ax
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000c818
mov rcx, qword [0x14005f3d0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000c818
and ebx, 0xf
je 0x14000c7d4
movzx ecx, word [rax]
lea rax, [rax + rcx*2]
add rax, 2
add ebx, 0xffffffff
jne 0x14000c7c4
cmp word [rax], di
je 0x14000c818
add rax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [0x14005da88], edi
jne 0x140021eb6
mov word [0x14005e2c0], di
call fcn.1400021ec
mov qword [0x14005f3d0], rax
mov rcx, rax
test rax, rax
jne 0x14000c78e
jmp 0x140021f19
lea rax, [0x14002fe44]
jmp 0x14000c7dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140021edc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
mov eax, dword [rax]
test eax, eax
jne 0x140021edc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
test eax, eax
je 0x14000c7f4
jle 0x140021ee6
movzx eax, ax
or eax, 0x80070000
cmp eax, 0x8007000e
je 0x140021ef8
cmp eax, 0x80070008
jne 0x14000c7f4
mov r8d, 0x1c
lea rdx, [0x140039340]
lea ecx, [r8 - 0x1a]
call fcn.140006374
mov ecx, 4
call fcn.14000c8c0
int3
lea rdx, str.fatal_error_C1510:_Cannot_load_language_resource_clui.dll._n
mov ecx, 1
call fcn.140007ecc
mov ecx, 4
call fcn.14000c8c0
int3

Function at 0x14000c8c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [0x140061480], 0x80
mov ebp, ecx
jne 0x140021f50
lea rcx, [0x14005f3a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call fcn.140008164
lea rbx, [0x14005b080]
mov esi, 0x12
mov rdi, rbx
cmp word [rbx + 0x10], 0x32
je 0x14000c956
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x14000c94e
add rdi, 0x40
add rbx, 0x40
sub rsi, 1
jne 0x14000c906
mov rcx, qword [0x14005da90]
test rcx, rcx
je 0x14000c938
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [0x14005f3a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000c916
mov rdx, qword [rbx]
xor r8d, r8d
mov rcx, rdi
call fcn.14000c968
jmp 0x14000c90d
lea rdx, [0x140030a08]
call fcn.140027504
nop
jmp 0x14000c8e3
Function at 0x14000d760
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov dword [rbp - 0x15], 1
mov rbx, rcx
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x15]
mov r8d, 4
call fcn.14000d7f0
mov rcx, qword [rbx]
lea r9, [rbp - 0x19]
and qword [rsp + 0x20], 0
mov rdx, rdi
mov esi, dword [rax]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140022534
cmp dword [rbp - 0x19], esi
jne 0x14002255e
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140011450
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140054eb8]
lea rcx, [rbp - 9]
call fcn.14002e130
lea rdx, [0x140057f28]
lea rcx, [rbp - 9]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.WriteFile_returned_incorrect_message_length:
lea rcx, [rbp + 0x17]
call fcn.14002d9c4
mov edx, dword [rbp - 0x19]
lea rcx, [rbp - 9]
call fcn.14002d934
cmp qword [rbp + 0xf], 0x10
lea rdx, [rbp - 9]
mov r8, qword [rbp + 7]
lea rcx, [rbp + 0x17]
cmovae rdx, qword [rbp - 9]
call fcn.14002e5c0
lea rcx, [rbp - 9]
call fcn.14002de84
cmp qword [rbp + 0x2f], 0x10
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
cmovae rdx, qword [rbp + 0x17]
call fcn.14002db80
lea rdx, [0x140057f28]
lea rcx, [rbp - 9]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14000db00
Capabilities:
Hash data using fnv

Disassembly:
cmp rdx, r8
je 0x14000dc8b
mov rax, rsp
push rbx
push rdi
push r15
sub rsp, 0x50
mov qword [rax + 8], rbp
mov r15, r8
mov qword [rax + 0x18], r12
mov rbx, rdx
mov qword [rax - 0x20], r13
mov rdi, rcx
mov qword [rax + 0x10], rsi
movabs r13, 0x492492492492492
mov qword [rax - 0x28], r14
xor r12d, r12d
movzx ebp, byte [rbx]
lea rdx, [rsp + 0x20]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rbp, rax
mov r8, rbx
movzx eax, byte [rbx + 1]
imul rbp, rcx
xor rbp, rax
movzx eax, byte [rbx + 2]
imul rbp, rcx
xor rbp, rax
movzx eax, byte [rbx + 3]
imul rbp, rcx
xor rbp, rax
imul rbp, rcx
mov rcx, rdi
mov r9, rbp
call fcn.14000dd00
cmp qword [rsp + 0x28], r12
jne 0x14000dc5a
cmp qword [rdi + 0x10], r13
je 0x14002261d
mov ecx, 0x38
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140022600
mov ecx, dword [rbx]
lea rdx, [rbx + 8]
mov dword [rsi + 0x10], ecx
lea rcx, [rsi + 0x18]
mov qword [rcx], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
call fcn.14000dd60
mov r8, qword [rdi + 0x10]
xorps xmm0, xmm0
lea rcx, [r8 + 1]
test rcx, rcx
js 0x14000dcc8
cvtsi2ss xmm0, rcx
mov rcx, qword [rdi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14000dce2
cvtsi2ss xmm1, rcx
divss xmm0, xmm1
comiss xmm0, dword [rdi]
ja 0x14000dc9b
mov rdx, qword [rsp + 0x20]
lea rax, [r8 + 1]
mov r9, qword [rdx + 8]
mov qword [rdi + 0x10], rax
mov qword [rsi], rdx
mov qword [rsi + 8], r9
mov qword [r9], rsi
mov qword [rdx + 8], rsi
mov rax, qword [rdi + 0x30]
mov r8, qword [rdi + 0x18]
and rax, rbp
mov rcx, rax
add rax, rax
add rcx, rcx
mov r10, qword [r8 + rcx*8]
cmp r10, qword [rdi + 8]
jne 0x14000dc8c
mov qword [r8 + rcx*8], rsi
mov qword [r8 + rax*8 + 8], rsi
add rbx, 0x28
cmp rbx, r15
jne 0x14000db3e
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x40]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x48]
add rsp, 0x50
pop r15
pop rdi
pop rbx
ret
cmp r10, rdx
jne 0x14002260d
mov qword [r8 + rcx*8], rsi
jmp 0x14000dc5a
mov rcx, rdi
call fcn.14000de40
mov r9, rbp
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000dd00
mov r8, qword [rdi + 0x10]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
jmp 0x14000dc14
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
jmp 0x14000dbf2
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
jmp 0x14000dc07
xor ecx, ecx
call fcn.14000c824
nop
jmp 0x14000dbbc
cmp qword [r8 + rax*8 + 8], r9
jne 0x14000dc5a
jmp 0x14000dc55
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
Function at 0x14000ed90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov qword [rdx + 0x18], 7
xor ebp, ebp
mov rbx, rdx
mov qword [rdx], rbp
xor r8d, r8d
mov qword [rdx + 0x10], rbp
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140022a3e
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea edx, [rax - 1]
mov rcx, rbx
cmp rdx, qword [rbx + 0x10]
ja 0x140022a5e
cmp qword [rbx + 0x18], 8
jb 0x140022a54
mov rcx, qword [rbx]
mov qword [rbx + 0x10], rdx
mov word [rcx + rdx*2], bp
jmp 0x140022a67
sub rdx, qword [rbx + 0x10]
call fcn.14002e6a4
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x140022a74
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop
jmp 0x14000edd3
Function at 0x14000fcc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x40
and qword [r11 + 0x10], 0
lea rax, [r11 + 0x10]
mov r9d, 0x201
mov qword [r11 - 0x28], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftVSCommon15.0SQM_vctip14.29.30148.0
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400230c6
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
and qword [rsp + 0x60], 0
lea r8, str.LastCrash
mov qword [rsp + 0x30], rax
mov r9d, 0x40
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 8
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140023149
cmp dword [rsp + 0x50], 8
jne 0x140023149
mov rdi, qword [rsp + 0x60]
test rbx, rbx
je 0x140023129
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x14000fd02
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rdi
cmp rax, 0x36ee80
setb al
jmp 0x14000fd04
test rbx, rbx
je 0x14000fd02
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x14000fd02

Function at 0x14000fd10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x120], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9d, 0x201
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Client
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000fdf8
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, str.Version
lea rax, [rsp + 0x50]
mov edi, 0xc8
mov qword [rsp + 0x28], rax
mov r9d, 2
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], edi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000fdfc
cmp dword [rsp + 0x40], edi
ja 0x14000fdfc
lea rdx, [0x140030378]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
setns dil
test rbx, rbx
je 0x14000fdd4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, dil
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140011450
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
xor al, al
jmp 0x14000fdd7
xor dil, dil
jmp 0x14000fdc6
Function at 0x140010300
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], r8d
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
movdqa xmm0, xmmword [0x1400423e0]
movdqu xmmword [rax - 0x18], xmm0
mov ecx, 0x18
call fcn.140007230
mov rdi, rax
test rax, rax
je 0x1400103c4
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 4
and dword [rax + 0x14], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x140009614]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400103c8
mov rax, qword [rbx + 8]
mov qword [rsp + 0x38], rax
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x1400103b1
mov ebx, dword [rdi + 0x14]
lea edx, [rax + 0x18]
mov rcx, rdi
call fcn.140011470
test ebx, ebx
jne 0x1400103e1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor edi, edi
jmp 0x14001034f
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x1400103f2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140010ab8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r14, dword [0x14005b504]
mov r12d, 1
dec r14
mov r15, 0xffffffffffffffff
mov rax, r14
mov rdx, r14
shr rdx, 6
and eax, 0x3f
lea rcx, [rax + rdx]
cmp rcx, 0x40
lea rsi, [rdx + 1]
cmovbe r12d, eax
mov eax, 8
add r12, rdx
cmp rcx, 0x40
cmovbe rsi, rdx
mul r14
cmovo rax, r15
mov rcx, rax
call fcn.140011964
xor ebx, ebx
mov rdi, rax
test r14, r14
je 0x140010b65
and qword [rsp + 0x28], 0
lea eax, [rbx + 1]
movsxd r9, eax
lea r8, [fcn.140009658]
mov edx, 0x100000
mov dword [rsp + 0x20], 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + rbx*8], rax
inc rbx
cmp rbx, r14
jb 0x140010b31
mov eax, 8
mul r12
cmovo rax, r15
mov rcx, rax
call fcn.140011964
xor ebp, ebp
mov rbx, rax
test rsi, rsi
jne 0x140023492
mov rdx, r12
sub rdx, rsi
je 0x140010bb1
imul rcx, rsi, 0x1f8
lea r8, [rbx + rsi*8]
sub rcx, rbx
add rcx, rdi
mov rax, qword [rcx + r8]
mov qword [r8], rax
lea r8, [r8 + 8]
sub rdx, 1
jne 0x140010ba0
xor ecx, ecx
call fcn.140009658
mov rax, qword gs:[0x58]
or r9d, 0xffffffff
mov ecx, 8
mov r8d, 1
mov rdx, qword [rax]
mov dword [rcx + rdx], r15d
mov rdx, rbx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor ebp, ebp
test rsi, rsi
jne 0x14002350f
xor esi, esi
test r14, r14
je 0x140010c07
mov rcx, qword [rdi + rsi*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rsi
cmp rsi, r14
jb 0x140010bf5
test rbx, rbx
je 0x140010c14
mov rcx, rbx
call fcn.140011470
test rdi, rdi
je 0x140010c21
mov rcx, rdi
call fcn.140011470
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r13d, r13d
mov r15, rdi
mov ecx, 0x40
mov rax, r14
sub rax, r13
cmp rax, rcx
cmovb rcx, rax
mov qword [rsp + 0x60], rcx
mov ecx, 0x10
call fcn.140007230
test rax, rax
je 0x1400234ca
mov rcx, qword [rsp + 0x60]
mov qword [rax + 8], rcx
mov qword [rax], r15
and qword [rsp + 0x28], 0
lea r8, [0x14002ae38]
mov r9, rax
mov dword [rsp + 0x20], 0x10000
mov edx, 0x100000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + rbp*8], rax
add r13, 0x40
inc rbp
add r15, 0x200
cmp rbp, rsi
jb 0x140023498
or r15, 0xffffffffffffffff
jmp 0x140010b87
mov rcx, qword [rbx + rbp*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rbp
cmp rbp, rsi
jb 0x14002350f
jmp 0x140010bee

Function at 0x140010cd8
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
xor r8d, r8d
lea rcx, str._CL_NOWILDCARD
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
neg eax
sbb eax, eax
add eax, 2
add rsp, 0x28
ret