joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d9280
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push r15
mov eax, 0x42f8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401d92a0
sub rsp, rax
mov rdi, qword [0x14022c040]
mov rax, qword [rdi]
mov qword [rsp + 0x42e8], rax
xor eax, eax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x3c], 0
call fcn.1400d8ef0
test eax, eax
jne 0x1400d92db
movzx eax, word [rsp + 0x46]
and ax, 0xf000
cmp ax, 0xa000
je 0x1400d94ec
call fcn.1400d1230
mov rdx, qword [rsp + 0x28]
lea rdi, [rsp + 0x2e0]
mov r9d, 0xffffffff
mov r8d, 0x1000
mov rcx, rdi
mov qword [rsp + 0x20], rdi
mov ebx, eax
call fcn.1400d25c0
test eax, eax
js 0x1400d94bd
mov r9d, ebx
mov r8d, 0x104
mov edx, eax
mov rcx, rdi
call fcn.1400d3b90
test eax, eax
js 0x1400d9457
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [rax]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.msvcrt.dll__wrmdir]
test eax, eax
je 0x1400d94d5
call r15
cmp eax, 5
je 0x1400d9488
cmp eax, 0x20
je 0x1400d9488
call r15
mov r14, qword [sym.imp.msvcrt.dll__errno]
mov esi, eax
call r14
mov ecx, esi
mov rbx, rax
call fcn.1400d0b80
mov dword [rbx], eax
call r14
cmp dword [rax], 0xd
jne 0x1400d9457
lea rbx, [rsp + 0x22e0]
mov rdx, qword [rsp + 0x20]
lea rdi, [rsp + 0x90]
mov rcx, rbx
lea rbp, [0x140205f7a]
lea r13, [0x140205f7e]
call sub.msvcrt.dll_wcscpy
mov rcx, rbx
lea rdx, [0x140205f74]
call sub.msvcrt.dll_wcscat
mov rcx, rbx
mov rdx, rdi
lea rbx, [rsp + 0xbc]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400d94ac
nop word [rax + rax]
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400d9412
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400d9498
mov rdx, rdi
mov rcx, rsi
call r12
test eax, eax
jne 0x1400d93f0
call r15
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp ebx, 0x12
sete al
test eax, eax
je 0x1400d94a1
mov r8, qword [rsp + 0x28]
lea rcx, [rsp + 0x3c]
lea rdx, str.Deletion_of_directory__s_failed._Should_I_try_again_
call fcn.1400d3470
test eax, eax
jne 0x1400d9340
mov eax, 0xffffffff
mov rdi, qword [0x14022c040]
mov rdx, qword [rsp + 0x42e8]
sub rdx, qword [rdi]
jne 0x1400d94e7
add rsp, 0x42f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r14, qword [sym.imp.msvcrt.dll__errno]
jmp 0x1400d9383
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
call r14
mov dword [rax], 0x29
jmp 0x1400d9457
call r15
cmp eax, 0x12
sete al
movzx eax, al
jmp 0x1400d9435
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
jne 0x1400d9457
call rbx
mov dword [rax], 0x26
jmp 0x1400d9457
mov dword [rsp + 0x20], eax
call fcn.14009cd70
mov eax, dword [rsp + 0x20]
jmp 0x1400d945c
call fcn.1401d96b0
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x14
jmp 0x1400d9457
Function at 0x1400d9ba0
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [0x14022c040]
mov qword [rsp + 0x60], r8
mov rbx, rcx
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x58], rdx
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
xor edx, edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, edi
mov rsi, rax
call fcn.1400d0b80
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
mov dword [rsi], eax
call fcn.1400b69e0
nop
nop dword [rax]
Function at 0x1400db830
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
mov qword [rcx + 0x10], r9
mov rbx, rcx
mov r9, rcx
mov qword [rcx + 8], r8
lea r8, [0x1400db800]
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
xor edx, edx
mov qword [rbx], rax
test rax, rax
je 0x1400db880
mov eax, edx
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov edx, dword [rax]
mov eax, edx
add rsp, 0x30
pop rbx
ret
Function at 0x1400dcd00
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x14025ae28]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
test rax, rax
je 0x1400dcd21
mov eax, dword [rax]
test eax, eax
jg 0x1400dcd30
mov eax, edx
add rsp, 0x20
pop rbx
ret
movsx eax, byte [rbx]
cmp eax, 0x2f
je 0x1400dcd50
cmp eax, 0x5c
je 0x1400dcd50
mov rcx, rbx
call fcn.1400db080
xor edx, edx
test eax, eax
sete dl
jmp 0x1400dcd21
xor edx, edx
mov eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x1400dcd60
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov edx, 0xffffffff
mov rbx, rcx
lea rcx, str.GIT_TEST_FSCACHE
call fcn.1400414b0
cmp eax, 0xffffffff
je 0x1400dce80
mov rdx, qword [0x14022c350]
mov dword [rdx], eax
test eax, eax
jne 0x1400dcda0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [0x14025ae00]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x14025ae2c]
test eax, eax
jne 0x1400dcdfb
mov eax, dword [0x14025ae28]
test eax, eax
je 0x1400dce90
mov rax, qword [0x14022c720]
lea rdx, [0x1400dca20]
mov qword [rax], rdx
mov rax, qword [0x14022c660]
lea rdx, [0x1400dc7a0]
mov qword [rax], rdx
mov rax, qword [0x14022cab0]
lea rdx, [0x1400dcb60]
mov qword [rax], rdx
mov eax, dword [0x14025ae2c]
mov rcx, rsi
add eax, 1
mov dword [0x14025ae2c], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x14025ae28]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400dceb8
mov edx, dword [rax]
add edx, 1
mov dword [rax], edx
movabs rax, 0x1ffffffff
movabs rdx, 0x100000000
and rax, qword [0x1401e49f8]
cmp rax, rdx
je 0x1400dcd90
lea r9, str.fscache:_enable_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x215
lea rcx, str.compat_win32_fscache.c
call fcn.14009f750
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [0x14022c350]
mov eax, dword [rax]
jmp 0x1400dcd8c
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14025ae28], eax
cmp eax, 0xffffffff
jne 0x1400dcdc8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400dcd90
mov edx, 0x10060
mov ecx, 1
call fcn.1400bd320
xor r8d, r8d
lea r9, [rbx*4]
lea rdx, [fcn.1400dbcd0]
mov dword [rax], 1
mov rsi, rax
lea rcx, [rax + 8]
call fcn.140029400
xor edx, edx
lea rcx, [rsi + 0x38]
call fcn.14015e2c0
mov ecx, dword [0x14025ae28]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400dce2f
lea r8, str.TlsSetValue_error
mov edx, 0x212
lea rcx, str.compat_win32_fscache.c
call fcn.1400b6d50
nop
nop word cs:[rax + rax]
Function at 0x1400dcf30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14022c350]
mov eax, dword [rax]
test eax, eax
jne 0x1400dcf50
add rsp, 0x40
pop rbx
ret
mov ecx, dword [0x14025ae28]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400dd0d9
mov eax, dword [rax]
test eax, eax
je 0x1400dd0c1
mov eax, dword [rbx]
sub eax, 1
mov dword [rbx], eax
mov eax, dword [rbx]
test eax, eax
je 0x1400dd030
lea rbx, [0x14025ae00]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x14025ae2c]
sub eax, 1
mov dword [0x14025ae2c], eax
mov eax, dword [0x14025ae2c]
test eax, eax
jne 0x1400dcfdf
mov rax, qword [0x14022c720]
mov rdx, qword [0x14022c3f0]
mov qword [rax], rdx
mov rax, qword [0x14022c660]
mov rdx, qword [fcn.1400d8ef0]
mov qword [rax], rdx
mov rax, qword [0x14022cab0]
mov rdx, qword [fcn.1400d6a80]
mov qword [rax], rdx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movabs rax, 0x1ffffffff
and rax, qword [0x1401e49f8]
movabs rdx, 0x100000000
cmp rax, rdx
je 0x1400dcf42
lea r9, str.fscache:_disable_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x240
lea rcx, str.compat_win32_fscache.c
add rsp, 0x40
pop rbx
jmp fcn.14009f750
xor edx, edx
mov ecx, dword [0x14025ae28]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
movabs rax, 0x1ffffffff
and rax, qword [0x1401e49f8]
movabs rdx, 0x100000000
cmp rax, rdx
je 0x1400dd099
mov eax, dword [rbx + 0x5c]
lea r9, str.fscache_disable:_lstat__u__opendir__u__total_requests_misses__u__u_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x22c
lea rcx, str.compat_win32_fscache.c
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x54]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x50]
mov dword [rsp + 0x20], eax
call fcn.14009f750
lea rcx, [rbx + 0x38]
xor edx, edx
call fcn.14015e390
lea rcx, [rbx + 8]
mov rdx, 0xffffffffffffffff
call fcn.140029540
mov rcx, rbx
call fcn.1400eaf30
jmp 0x1400dcf83
lea r8, str.fscache_disable___called_on_an_fscache_that_is_already_disabled
mov edx, 0x228
lea rcx, str.compat_win32_fscache.c
call fcn.1400b6d50
lea r8, str.fscache_disable___called_on_a_thread_where_fscache_has_not_been_initialized
mov edx, 0x226
lea rcx, str.compat_win32_fscache.c
call fcn.1400b6d50
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400dd100
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ecx, dword [0x14025ae28]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400dd120
mov eax, dword [rax]
test eax, eax
jne 0x1400dd130
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
xor edx, edx
mov rcx, rsi
call fcn.14015e390
xor edx, edx
mov rcx, rsi
lea rsi, [rbx + 8]
call fcn.14015e2c0
mov rcx, rsi
mov rdx, 0xffffffffffffffff
call fcn.140029540
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea rdx, [fcn.1400dbcd0]
call fcn.140029400
pxor xmm0, xmm0
movups xmmword [rbx + 0x50], xmm0
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400dd190
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r12, qword [0x14022c040]
mov rbp, rcx
mov rcx, qword [r12]
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x14025ae28]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rbp, rbp
je 0x1400dd2e0
test rax, rax
je 0x1400dd303
xor edx, edx
mov ecx, dword [0x14025ae28]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
movabs rax, 0x1ffffffff
and rax, qword [0x1401e49f8]
movabs rdx, 0x100000000
cmp rax, rdx
jne 0x1400dd2a0
lea r13, [0x14025ae00]
lea rbx, [rsp + 0x40]
mov rcx, r13
lea rdi, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsi + 8]
mov rdx, rbx
call fcn.140029890
jmp 0x1400dd238
mov rcx, rdi
call fcn.140029680
mov rcx, rbx
call fcn.1400298b0
mov rdx, rax
test rax, rax
jne 0x1400dd230
lea rdx, [rsi + 0x38]
lea rcx, [rbp + 0x38]
call fcn.14015e7c0
movdqu xmm0, xmmword [rbp + 0x50]
movdqu xmm1, xmmword [rsi + 0x50]
mov rcx, r13
mov eax, dword [0x14025ae2c]
paddd xmm0, xmm1
sub eax, 1
movups xmmword [rbp + 0x50], xmm0
mov dword [0x14025ae2c], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call fcn.1400eaf30
mov rax, qword [rsp + 0x58]
sub rax, qword [r12]
jne 0x1400dd2fe
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, dword [rsi + 0x5c]
lea r9, str.fscache_merge:_lstat__u__opendir__u__total_requests_misses__u__u_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x30a
lea rcx, str.compat_win32_fscache.c
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rsi + 0x54]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 0x50]
mov dword [rsp + 0x20], eax
call fcn.14009f750
jmp 0x1400dd202
mov rax, qword [rsp + 0x58]
sub rax, qword [r12]
jne 0x1400dd2fe
xor ecx, ecx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400dcd60
call fcn.1401d96b0
lea r8, str.fscache_merge___called_on_a_thread_where_fscache_has_not_been_initialized
mov edx, 0x307
lea rcx, str.compat_win32_fscache.c
call fcn.1400b6d50
nop
nop
nop
nop
nop
Function at 0x1400dd3a0
Capabilities:
Get file attributes

Disassembly:
push rbp
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0xc0]
mov r12, qword [0x14022c040]
mov rax, qword [r12]
mov qword [rbp - 8], rax
xor eax, eax
mov rdi, r8
test rdx, rdx
js 0x1400dd405
lea rbx, [rdx + rdx + 2]
lea rax, [rbx + 0xf]
and rax, 0xfffffffffffffff0
call fcn.1401d92a0
sub rsp, rax
mov rdx, rcx
lea r8, [rbx - 2]
lea r9, [rsp + 0x40]
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov r9, rax
xor eax, eax
mov word [r9 + rbx - 2], ax
mov rcx, r9
mov dword [rsp + 0x28], 0x2200000
xor r9d, r9d
mov r8d, 7
mov edx, 0x100008
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400dd4a0
mov dword [rsp + 0x20], 0x46
lea rdx, [rbp - 0x80]
lea r8, [rbp - 0x70]
mov rcx, rax
mov r9d, 0x60
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
test eax, eax
jne 0x1400dd490
test byte [rbp - 0x28], 4
jne 0x1400dd488
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 8]
sub rax, qword [r12]
jne 0x1400dd4a7
mov eax, esi
mov rsp, rbp
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
mov eax, dword [rbp - 0x1c]
mov word [rdi], ax
jmp 0x1400dd466
mov esi, 0xffffffff
jmp 0x1400dd466
mov esi, 0xffffffff
jmp 0x1400dd46f
call fcn.1401d96b0
nop
nop dword [rax]

Function at 0x1400dd560
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0xb8
mov rsi, qword [0x14022c040]
mov r9d, 0x60
mov rbx, rdx
lea r8, [rsp + 0x40]
mov rdx, qword [rsi]
mov qword [rsp + 0xa8], rdx
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x46
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jne 0x1400dd5d8
test byte [rsp + 0x88], 4
jne 0x1400dd5c8
mov rdx, qword [rsp + 0xa8]
sub rdx, qword [rsi]
jne 0x1400dd5df
add rsp, 0xb8
pop rbx
pop rsi
ret
mov edx, dword [rsp + 0x94]
mov word [rbx], dx
jmp 0x1400dd5aa
mov eax, 0xffffffff
jmp 0x1400dd5aa
call fcn.1401d96b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop word cs:[rax + rax]
nop word [rax + rax]
Function at 0x1400dd720
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14022c040]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rcx
mov rbx, rcx
test rcx, rcx
je 0x1400dd890
lea rcx, [rsp + 0x20]
call fcn.1400db0f0
mov r8d, eax
mov rax, qword [rsp + 0x20]
movzx edx, byte [rax]
test r8d, r8d
je 0x1400dd76a
test dl, dl
je 0x1400dd800
movsx ecx, dl
cmp dl, 0x5c
je 0x1400dd7d8
xor r11d, r11d
cmp ecx, 0x2f
jne 0x1400dd795
jmp 0x1400dd7d8
movsx ecx, dl
cmp dl, 0x2f
je 0x1400dd848
cmp ecx, 0x5c
je 0x1400dd848
mov r10, rax
add rax, 1
mov qword [rsp + 0x20], rax
movzx edx, byte [rax - 1]
test dl, dl
jne 0x1400dd780
test r11, r11
je 0x1400dd800
mov byte [r11], 0
mov rax, rbx
nop word cs:[rax + rax]
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rsi]
jne 0x1400dd8d7
add rsp, 0x38
pop rbx
pop rsi
ret
movzx edx, byte [rax + 1]
test dl, dl
je 0x1400dd7b2
movsx ecx, dl
cmp dl, 0x2f
je 0x1400dd8c8
cmp ecx, 0x5c
je 0x1400dd8c8
lea r11, [rax + 1]
mov rax, r11
jmp 0x1400dd795
mov rax, qword [0x1401e4a20]
cmp rax, qword [0x14022c910]
mov qword [0x1401e4a18], 0
je 0x1400dd8a0
mov byte [rax], 0
mov r9, rbx
lea rdx, str._.s.
lea rcx, [0x1401e4a10]
call fcn.14008fc00
mov rax, qword [0x1401e4a20]
jmp 0x1400dd7c0
movsx edx, byte [r10 + 1]
mov ecx, edx
cmp dl, 0x5c
je 0x1400dd859
cmp edx, 0x2f
jne 0x1400dd87f
lea rdx, [r10 + 2]
nop dword [rax]
mov qword [rsp + 0x20], rdx
movsx r9d, byte [rdx]
mov rax, rdx
add rdx, 1
mov ecx, r9d
cmp r9b, 0x2f
je 0x1400dd860
cmp r9d, 0x5c
je 0x1400dd860
test cl, cl
cmovne r11, r10
jmp 0x1400dd795
lea rax, [0x140206920]
jmp 0x1400dd7c0
cmp byte [rax], 0
je 0x1400dd822
mov r8d, 0xac
lea rdx, str.compat_.._strbuf.h
lea rcx, [0x140206935]
call qword [sym.imp.msvcrt.dll__assert]
nop dword [rax + rax]
cmp byte [rax + 2], 0
jne 0x1400dd7f5
jmp 0x1400dd7b2
call fcn.1401d96b0
nop
nop
nop
nop
Function at 0x1400de2f0
Capabilities:
Set environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov esi, r8d
test rcx, rcx
je 0x1400de3c0
mov edx, 0x3d
call sub.msvcrt.dll_strchr
test rdi, rdi
je 0x1400de3c0
test rax, rax
jne 0x1400de3c0
test esi, esi
jne 0x1400de350
mov rcx, rbx
call fcn.1400d3040
xor edx, edx
test rax, rax
je 0x1400de350
mov eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rcx, rdi
mov rbp, rax
call sub.msvcrt.dll_strlen
lea r13, [rbp + rax]
mov r12, rax
lea rcx, [r13 + 2]
call fcn.1400eab00
mov rsi, rax
test rax, rax
je 0x1400de3d6
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov byte [rsi + rbp], 0x3d
mov r8, r12
mov rdx, rdi
lea rcx, [rsi + rbp + 1]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
mov byte [rsi + r13 + 1], 0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400d2a40
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov edx, 0xffffffff
jmp 0x1400de33d
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xc
jmp 0x1400de3cc
Function at 0x1400de430
Capabilities:
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r12, qword [0x14022c040]
mov rdi, qword [rsp + 0xb8]
mov r13, qword [r12]
mov qword [rsp + 0x38], r13
mov r13, rdi
mov rsi, rdx
mov rbp, rcx
mov r14d, r8d
mov ecx, dword [rsp + 0xb0]
mov r15d, r9d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea rdx, [rsp + 0x30]
mov rbx, rax
mov rcx, rax
shr r13, 0x20
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400de5ff
mov rax, qword [rsp + 0x30]
lea rdx, [rdi + rsi]
cmp rax, rdx
jb 0x1400de550
and r15d, 1
je 0x1400de5ee
cmp r14d, 1
je 0x1400de568
mov rcx, rbx
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x1400de5e0
mov edx, 1
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov r9d, edi
mov r8d, r13d
mov qword [rsp + 0x28], rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400de5a0
test rsi, rsi
je 0x1400de5b5
mov rax, qword [rsp + 0x38]
sub rax, qword [r12]
jne 0x1400de5fa
mov rax, rsi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub rax, rdi
js 0x1400de60b
mov rsi, rax
jmp 0x1400de4a3
mov rcx, rbx
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x1400de5e0
mov edx, 4
jmp 0x1400de4ed
lea rcx, str.unable_to_close_file_mapping_handle
call fcn.1400b6cc0
test rsi, rsi
jne 0x1400de523
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x5af
sete bl
call qword [sym.imp.msvcrt.dll__errno]
lea ebx, [rbx + rbx*4 + 0x16]
mov dword [rax], ebx
mov rsi, 0xffffffffffffffff
jmp 0x1400de523
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400de5d1
lea rcx, str.Invalid_usage_of_mmap_when_built_with_USE_WIN32_MMAP
call fcn.1400b6950
call fcn.1401d96b0
lea rcx, str.mmap:_could_not_determine_filesize
call fcn.1400b6950
lea rcx, [0x140206993]
call fcn.1400b6950
nop
nop dword [rax + rax]
Function at 0x1400ee0b0
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
lea rcx, [0x1401e6040]
jmp 0x1400f19b0
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rdi, qword [0x14022c040]
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
xor eax, eax
mov eax, 0x100
mov byte [rcx + 0x1a], 1
mov rbx, rcx
mov word [rcx + 0x18], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1400f19f1
mov qword [rbx], rax
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400f19fd
mov qword [rbx + 0x10], rax
mov rbp, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.kernelbase.dll
call rbp
mov rsi, rax
test rax, rax
je 0x1400f1a42
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualAlloc2FromApp
mov rcx, rax
call r12
mov qword [0x1402633a8], rax
test rax, rax
je 0x1400f1b40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.ntdll.dll
call rbp
mov rsi, rax
test rax, rax
je 0x1400f1a73
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemoryEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
mov qword [0x1402633a0], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.kernel32.dll
call rbp
mov rsi, rax
test rax, rax
je 0x1400f1ae0
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCurrentProcessorNumberEx
mov rcx, rax
call rbp
lea rdx, str.GetNumaProcessorNodeEx
mov rcx, rsi
mov qword [0x140263398], rax
call rbp
lea rdx, str.GetNumaNodeProcessorMaskEx
mov rcx, rsi
mov qword [0x140263390], rax
call rbp
mov rcx, rsi
lea rdx, str.GetNumaProcessorNode
mov qword [0x140263388], rax
call rbp
mov rcx, rsi
mov qword [0x140263380], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 6
call fcn.1400ed770
test al, al
jne 0x1400f1b18
mov ecx, 7
call fcn.1400ed770
test al, al
jne 0x1400f1b18
mov rax, qword [rsp + 0x58]
sub rax, qword [rdi]
jne 0x1400f1b59
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp byte [0x140263368], 0
jne 0x1400f1b30
lea rcx, [rbx + 8]
call fcn.1400f1860
jmp 0x1400f1afc
call fcn.1400edf60
jmp 0x1400f1afc
lea rdx, str.VirtualAlloc2
mov rcx, rsi
call r12
mov qword [0x1402633a8], rax
jmp 0x1400f1a39
call fcn.1401d96b0
nop
nop
Function at 0x1400f1690
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov edx, 1
jmp 0x1400f0e50
Function at 0x1400f16f0
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov r12, qword [0x14022c040]
mov rbx, rdx
mov rsi, rcx
mov ebp, r8d
mov rdx, qword [r12]
mov qword [rsp + 0x68], rdx
mov rdx, rcx
mov rcx, rbx
call fcn.1400ee0c0
mov rdi, rax
test rax, rax
je 0x1400f1784
mov r9d, 4
mov r8d, ebp
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1400f1760
mov rdx, qword [rsp + 0x68]
sub rdx, qword [r12]
jne 0x1400f185a
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], ebp
mov r9, rdi
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov r8d, eax
lea rcx, str.warning:_unable_to_allocate_hinted_aligned_OS_memory___zu_bytes__error_code:_0x_x__address:__p__alignment:__zu__flags:_0x_x__n
call fcn.1400ed690
cmp rbx, 1
jbe 0x1400f1830
call fcn.1400edf50
xor edx, edx
mov rcx, rax
mov rax, rbx
div rcx
test rdx, rdx
jne 0x1400f1830
mov rdi, qword [0x1402633a8]
test rdi, rdi
je 0x1400f1830
pxor xmm0, xmm0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x40], 1
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov r9d, ebp
mov r8, rsi
mov rcx, rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call rdi
test rax, rax
jne 0x1400f1740
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], ebp
xor r9d, r9d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov r8d, eax
lea rcx, str.unable_to_allocate_aligned_OS_memory___zu_bytes__error_code:_0x_x__address:__p__alignment:__zu__flags:_0x_x__n
call fcn.1400ed990
nop
mov rax, qword [rsp + 0x68]
sub rax, qword [r12]
jne 0x1400f185a
mov r9d, 4
mov r8d, ebp
mov rdx, rsi
xor ecx, ecx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call fcn.1401d96b0
nop