joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c934
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov edi, dword [0x14005b070]
xor r15d, r15d
mov eax, 0xc7
mov r14, rcx
cmp edi, eax
movzx esi, r15w
mov ebx, r15d
mov ebp, r15d
cmovg edi, eax
lea r12d, [r15 + 0x5c]
mov rax, qword [rcx + 0x40]
cmp word [rax + 2], 0x3a
lea rcx, [rax + 4]
jne 0x140021f82
cmp word [rcx], r12w
jne 0x140021f82
mov rbx, rcx
test rbx, rbx
je 0x14000c9a2
add rbx, 2
movzx esi, word [rbx]
mov word [rbx], r15w
mov rbp, qword [r14 + 0x40]
xor r9d, r9d
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x14000c9d0
mov rcx, qword [rsp + 0x50]
imul edx, edi, 0x2dc6c0
cmp rcx, rdx
jb 0x140021fc1
mov dword [0x14005b070], edi
test rbx, rbx
je 0x14000c9de
mov word [rbx], si
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp word [rax], r12w
jne 0x14000c9a2
cmp word [rax + 2], r12w
jne 0x14000c9a2
mov edx, r12d
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbx, rax
test rax, rax
je 0x14000c9a2
mov edx, r12d
lea rcx, [rax + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbx, rax
jmp 0x14000c98e
movabs rax, 0x65e9f80f292119e5
mul rcx
sub rcx, rdx
shr rcx, 1
lea rdi, [rdx + rcx]
shr rdi, 0x15
jmp 0x14000c9d0
Function at 0x14000cef4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
xor edi, edi
mov rcx, qword [0x14005f3e0]
test rcx, rcx
je 0x14000cf68
mov eax, ebx
mov r8d, 6
shr eax, 4
inc ax
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14000cf98
mov rcx, qword [0x14005f3e0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000cf98
and ebx, 0xf
je 0x14000cf54
movzx ecx, word [rax]
lea rax, [rax + rcx*2]
add rax, 2
add ebx, 0xffffffff
jne 0x14000cf44
cmp word [rax], di
je 0x14000cf98
add rax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [0x14005db00], edi
jne 0x140022278
mov word [0x14005e330], di
call fcn.140002490
mov qword [0x14005f3e0], rax
mov rcx, rax
test rax, rax
jne 0x14000cf0e
jmp 0x1400222db
lea rax, [0x14002fecc]
jmp 0x14000cf5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002229e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
mov eax, dword [rax]
test eax, eax
jne 0x14002229e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
test eax, eax
je 0x14000cf74
jle 0x1400222a8
movzx eax, ax
or eax, 0x80070000
cmp eax, 0x8007000e
je 0x1400222ba
cmp eax, 0x80070008
jne 0x14000cf74
mov r8d, 0x1c
lea rdx, [0x140039538]
lea ecx, [r8 - 0x1a]
call fcn.140006a6c
mov ecx, 4
call fcn.14000d040
int3
lea rdx, str.fatal_error_C1510:_Cannot_load_language_resource_clui.dll._n
mov ecx, 1
call fcn.1400085cc
mov ecx, 4
call fcn.14000d040
int3

Function at 0x14000d040
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [0x1400614c0], 0x80
mov ebp, ecx
jne 0x140022312
lea rcx, [0x14005f3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call fcn.140008864
lea rbx, [0x14005b080]
mov esi, 0x12
mov rdi, rbx
cmp word [rbx + 0x10], 0x32
je 0x14000d0d6
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x14000d0ce
add rdi, 0x40
add rbx, 0x40
sub rsi, 1
jne 0x14000d086
mov rcx, qword [0x14005db08]
test rcx, rcx
je 0x14000d0b8
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [0x14005f3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000d096
mov rdx, qword [rbx]
xor r8d, r8d
mov rcx, rdi
call fcn.14000d0e8
jmp 0x14000d08d
lea rdx, [0x140030aa8]
call fcn.140027598
nop
jmp 0x14000d063
Function at 0x14000d8a4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x120], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9d, 0x201
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Client
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000d98c
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, str.Version
lea rax, [rsp + 0x50]
mov edi, 0xc8
mov qword [rsp + 0x28], rax
mov r9d, 2
and qword [rsp + 0x20], 0
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x40], edi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000d990
cmp dword [rsp + 0x40], edi
ja 0x14000d990
lea rdx, [0x140030188]
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
setns dil
test rbx, rbx
je 0x14000d968
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, dil
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140011610
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rdi
ret
xor al, al
jmp 0x14000d96b
xor dil, dil
jmp 0x14000d95a

Function at 0x14000d998
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x40
and qword [r11 + 0x10], 0
lea rax, [r11 + 0x10]
mov r9d, 0x201
mov qword [r11 - 0x28], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftVSCommon15.0SQM_vctip14.29.30148.0
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000d9df
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
and qword [rsp + 0x60], 0
lea r8, str.LastCrash
mov qword [rsp + 0x30], rax
mov r9d, 0x40
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 8
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000da47
cmp dword [rsp + 0x50], 8
jne 0x14000da47
mov rdi, qword [rsp + 0x60]
test rbx, rbx
je 0x14000da42
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
jmp 0x14000d9d4
xor edi, edi
jmp 0x14000da34
Function at 0x14000f0a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov qword [rdx + 0x18], 7
xor ebp, ebp
mov rbx, rdx
mov qword [rdx], rbp
xor r8d, r8d
mov qword [rdx + 0x10], rbp
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140022e38
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea edx, [rax - 1]
mov rcx, rbx
cmp rdx, qword [rbx + 0x10]
ja 0x140022e58
cmp qword [rbx + 0x18], 8
jb 0x140022e4e
mov rcx, qword [rbx]
mov qword [rbx + 0x10], rdx
mov word [rcx + rdx*2], bp
jmp 0x140022e61
sub rdx, qword [rbx + 0x10]
call fcn.14002e6f8
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x140022e6e
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop
jmp 0x14000f0e3
Function at 0x14000f430
Capabilities:
Hash data using fnv

Disassembly:
cmp rdx, r8
je 0x14000f5bb
mov rax, rsp
push rbx
push rdi
push r15
sub rsp, 0x50
mov qword [rax + 8], rbp
mov r15, r8
mov qword [rax + 0x18], r12
mov rbx, rdx
mov qword [rax - 0x20], r13
mov rdi, rcx
mov qword [rax + 0x10], rsi
movabs r13, 0x492492492492492
mov qword [rax - 0x28], r14
xor r12d, r12d
movzx ebp, byte [rbx]
lea rdx, [rsp + 0x20]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rbp, rax
mov r8, rbx
movzx eax, byte [rbx + 1]
imul rbp, rcx
xor rbp, rax
movzx eax, byte [rbx + 2]
imul rbp, rcx
xor rbp, rax
movzx eax, byte [rbx + 3]
imul rbp, rcx
xor rbp, rax
imul rbp, rcx
mov rcx, rdi
mov r9, rbp
call fcn.14000f630
cmp qword [rsp + 0x28], r12
jne 0x14000f58a
cmp qword [rdi + 0x10], r13
je 0x140022ecf
mov ecx, 0x38
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140022eb2
mov ecx, dword [rbx]
lea rdx, [rbx + 8]
mov dword [rsi + 0x10], ecx
lea rcx, [rsi + 0x18]
mov qword [rcx], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
call fcn.14000f690
mov r8, qword [rdi + 0x10]
xorps xmm0, xmm0
lea rcx, [r8 + 1]
test rcx, rcx
js 0x14000f5f8
cvtsi2ss xmm0, rcx
mov rcx, qword [rdi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14000f612
cvtsi2ss xmm1, rcx
divss xmm0, xmm1
comiss xmm0, dword [rdi]
ja 0x14000f5cb
mov rdx, qword [rsp + 0x20]
lea rax, [r8 + 1]
mov r9, qword [rdx + 8]
mov qword [rdi + 0x10], rax
mov qword [rsi], rdx
mov qword [rsi + 8], r9
mov qword [r9], rsi
mov qword [rdx + 8], rsi
mov rax, qword [rdi + 0x30]
mov r8, qword [rdi + 0x18]
and rax, rbp
mov rcx, rax
add rax, rax
add rcx, rcx
mov r10, qword [r8 + rcx*8]
cmp r10, qword [rdi + 8]
jne 0x14000f5bc
mov qword [r8 + rcx*8], rsi
mov qword [r8 + rax*8 + 8], rsi
add rbx, 0x28
cmp rbx, r15
jne 0x14000f46e
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x40]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x48]
add rsp, 0x50
pop r15
pop rdi
pop rbx
ret
cmp r10, rdx
jne 0x140022ebf
mov qword [r8 + rcx*8], rsi
jmp 0x14000f58a
mov rcx, rdi
call fcn.14000f770
mov r9, rbp
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000f630
mov r8, qword [rdi + 0x10]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
jmp 0x14000f544
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
jmp 0x14000f522
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
jmp 0x14000f537
xor ecx, ecx
call fcn.14000cfa4
nop
jmp 0x14000f4ec
cmp qword [r8 + rax*8 + 8], r9
jne 0x14000f58a
jmp 0x14000f585
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
Function at 0x14000fba8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov dword [rbp - 0x15], 1
mov rbx, rcx
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x15]
mov r8d, 4
call fcn.14000fc38
mov rcx, qword [rbx]
lea r9, [rbp - 0x19]
and qword [rsp + 0x20], 0
mov rdx, rdi
mov esi, dword [rax]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400230ee
cmp dword [rbp - 0x19], esi
jne 0x140023118
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140011610
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140055478]
lea rcx, [rbp - 9]
call fcn.14002e184
lea rdx, [0x1400584e8]
lea rcx, [rbp - 9]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.WriteFile_returned_incorrect_message_length:
lea rcx, [rbp + 0x17]
call fcn.14002da58
mov edx, dword [rbp - 0x19]
lea rcx, [rbp - 9]
call fcn.14002d9c8
cmp qword [rbp + 0xf], 0x10
lea rdx, [rbp - 9]
mov r8, qword [rbp + 7]
lea rcx, [rbp + 0x17]
cmovae rdx, qword [rbp - 9]
call fcn.14002e614
lea rcx, [rbp - 9]
call fcn.14002ded8
cmp qword [rbp + 0x2f], 0x10
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
cmovae rdx, qword [rbp + 0x17]
call fcn.14000d864
lea rdx, [0x1400584e8]
lea rcx, [rbp - 9]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140010160
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], r8d
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
movdqa xmm0, xmmword [0x1400425d0]
movdqu xmmword [rax - 0x18], xmm0
mov ecx, 0x18
call fcn.140007930
mov rdi, rax
test rax, rax
je 0x140010224
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 4
and dword [rax + 0x14], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x140009d14]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140010228
mov rax, qword [rbx + 8]
mov qword [rsp + 0x38], rax
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x140010211
mov ebx, dword [rdi + 0x14]
lea edx, [rax + 0x18]
mov rcx, rdi
call fcn.140011630
test ebx, ebx
jne 0x140010241
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor edi, edi
jmp 0x1400101af
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x140010252
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140010950
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r14, dword [0x14005b504]
mov r12d, 1
dec r14
mov r15, 0xffffffffffffffff
mov rax, r14
mov rdx, r14
shr rdx, 6
and eax, 0x3f
lea rcx, [rax + rdx]
cmp rcx, 0x40
lea rsi, [rdx + 1]
cmovbe r12d, eax
mov eax, 8
add r12, rdx
cmp rcx, 0x40
cmovbe rsi, rdx
mul r14
cmovo rax, r15
mov rcx, rax
call fcn.140011b24
xor ebx, ebx
mov rdi, rax
test r14, r14
je 0x1400109fd
and qword [rsp + 0x28], 0
lea eax, [rbx + 1]
movsxd r9, eax
lea r8, [fcn.140009d58]
mov edx, 0x100000
mov dword [rsp + 0x20], 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + rbx*8], rax
inc rbx
cmp rbx, r14
jb 0x1400109c9
mov eax, 8
mul r12
cmovo rax, r15
mov rcx, rax
call fcn.140011b24
xor ebp, ebp
mov rbx, rax
test rsi, rsi
jne 0x1400234be
mov rdx, r12
sub rdx, rsi
je 0x140010a49
imul rcx, rsi, 0x1f8
lea r8, [rbx + rsi*8]
sub rcx, rbx
add rcx, rdi
mov rax, qword [rcx + r8]
mov qword [r8], rax
lea r8, [r8 + 8]
sub rdx, 1
jne 0x140010a38
xor ecx, ecx
call fcn.140009d58
mov rax, qword gs:[0x58]
or r9d, 0xffffffff
mov ecx, 8
mov r8d, 1
mov rdx, qword [rax]
mov dword [rcx + rdx], r15d
mov rdx, rbx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor ebp, ebp
test rsi, rsi
jne 0x14002353b
xor esi, esi
test r14, r14
je 0x140010a9f
mov rcx, qword [rdi + rsi*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rsi
cmp rsi, r14
jb 0x140010a8d
test rbx, rbx
je 0x140010aac
mov rcx, rbx
call fcn.140011630
test rdi, rdi
je 0x140010ab9
mov rcx, rdi
call fcn.140011630
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r13d, r13d
mov r15, rdi
mov ecx, 0x40
mov rax, r14
sub rax, r13
cmp rax, rcx
cmovb rcx, rax
mov qword [rsp + 0x60], rcx
mov ecx, 0x10
call fcn.140007930
test rax, rax
je 0x1400234f6
mov rcx, qword [rsp + 0x60]
mov qword [rax + 8], rcx
mov qword [rax], r15
and qword [rsp + 0x28], 0
lea r8, [0x14002aecc]
mov r9, rax
mov dword [rsp + 0x20], 0x10000
mov edx, 0x100000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + rbp*8], rax
add r13, 0x40
inc rbp
add r15, 0x200
cmp rbp, rsi
jb 0x1400234c4
or r15, 0xffffffffffffffff
jmp 0x140010a1f
mov rcx, qword [rbx + rbp*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rbp
cmp rbp, rsi
jb 0x14002353b
jmp 0x140010a86

Function at 0x140010b70
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
xor r8d, r8d
lea rcx, str._CL_NOWILDCARD
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
neg eax
sbb eax, eax
add eax, 2
add rsp, 0x28
ret
Function at 0x140010f50
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x278
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x260], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, str.MPCL_MUTEX__d
mov edx, 0x100
mov r9d, eax
lea rcx, [rsp + 0x60]
call fcn.14000350c
and qword [rsp + 0x28], 0
lea r8, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x20], 0x18
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x30], 1
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
lea r8, str._.16X
mov edx, 0x14
lea rcx, [rsp + 0x38]
mov qword [0x14005f430], rax
mov r9, rax
call fcn.14000350c
lea rdx, [rsp + 0x38]
lea rcx, str.MPCL_MUTEX_HANDLE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140011610
add rsp, 0x278
ret

Function at 0x14002460c
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0xb
lea rdx, [rsp + 0x40]
lea rcx, str.MSVCETW_PARENT_CONTEXT_THREAD_ID
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
test eax, eax
je 0x1400246a7
movdqa xmm0, xmmword [0x1400425b0]
lea rax, [rsp + 0x40]
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rcx
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], cx
jne 0x140024659
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000eb44
test byte [0x1400614c0], 0x80
je 0x14002469b
lea rcx, [rsp + 0x20]
call fcn.1400270b8
mov rcx, qword [0x140060920]
lea rdx, [0x140054230]
mov r8d, eax
call fcn.1400275ac
lea rcx, [rsp + 0x20]
call fcn.14000f064
jmp 0x1400246c6
test byte [0x1400614c0], 0x80
je 0x1400246c6
mov rcx, qword [0x140060920]
lea rdx, [0x140054230]
xor r8d, r8d
call fcn.1400275ac
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140011610
add rsp, 0x68
ret
Function at 0x1400251b8
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14005b018]
xor rax, rsp
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.14000eaac
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
lea rcx, str.MSVCETW_PARENT_CONTEXT_THREAD_ID
cmovae rdx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
call fcn.14000f064
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140011610
add rsp, 0x58
ret

Function at 0x140025334
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x20
mov rsi, rdx
lea r8, str._CL_
xor r14d, r14d
lea rcx, [rax + 0x10]
xor edx, edx
mov qword [rax + 0x10], r14
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
mov rax, qword [rsi]
mov rbx, rsi
test rax, rax
je 0x140025462
lea r12d, [r14 + 0x5c]
movzx edx, word [rax]
mov rcx, r14
test dx, dx
je 0x140025452
cmp dx, 0x22
jne 0x1400253ae
inc rcx
mov rdx, rax
cmp rax, qword [rbx]
je 0x1400253ae
sub rdx, 2
cmp word [rdx], r12w
jne 0x1400253ae
inc rcx
cmp rdx, qword [rbx]
jne 0x14002539c
add rax, 2
movzx edx, word [rax]
test dx, dx
jne 0x14002538b
test rcx, rcx
je 0x140025452
sub rax, qword [rbx]
lea rbp, [rcx + 1]
sar rax, 1
mov rcx, 0xffffffffffffffff
add rbp, rax
mov eax, 2
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.140011b24
mov rdi, rax
test rax, rax
jne 0x1400253fd
mov ecx, 0x1f6a
call fcn.14000cfa4
mov rdx, qword [rbx]
lea r8, [rdi + rbp*2]
mov rcx, rdi
cmp rdi, r8
jae 0x14002544f
movzx eax, word [rdx]
cmp ax, 0x22
jne 0x14002543f
mov rax, rdx
cmp rdx, qword [rbx]
je 0x140025434
sub rax, 2
cmp word [rax], r12w
jne 0x140025434
mov word [rcx], r12w
add rcx, 2
cmp rax, qword [rbx]
jne 0x14002541d
mov word [rcx], r12w
add rcx, 2
movzx eax, word [rdx]
mov word [rcx], ax
add rdx, 2
add rcx, 2
cmp rcx, r8
jb 0x14002540c
mov qword [rbx], rdi
add rbx, 8
mov rax, qword [rbx]
test rax, rax
jne 0x14002537c
cmp dword [0x14005f36c], r14d
jne 0x14002547f
mov r8, qword [rsp + 0x48]
lea r9, str._hybrid:x86native__noover__c__Gy__GL___Oy___Ob0__d2globaldataref__d2nodllexport
mov rdx, rsi
call fcn.1400254d4
mov r8, qword [rsp + 0x48]
lea r9, str._hybrid:x86arm64__nologo__Oy_
mov rdx, rsi
call fcn.1400254d4
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400254b5
lea rcx, str._CL_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test byte [0x1400614c0], 0x80
je 0x1400254ca
lea rdx, [0x140030aa8]
call fcn.140027598
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400254d4
Capabilities:
Resolve path using msvcrt
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
or rbx, 0xffffffffffffffff
mov rbp, r9
xor r15d, r15d
mov rdi, r8
mov r14, rdx
inc rbx
cmp word [r9 + rbx*2], r15w
jne 0x1400254fc
add rbx, 2
test rdi, rdi
je 0x140025520
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], r15w
jne 0x140025513
add rbx, rax
lea rcx, [rbx + rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x14002553c
mov ecx, 0x1f6a
call fcn.14000cfa4
mov rdx, rbx
mov rcx, rsi
test rdi, rdi
je 0x140025574
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x14002ffa8]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x14002557d
mov r8, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rdx, rsi
lea rcx, str._CL_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
lea rax, str.cl.exe
mov qword [r14], rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__wpgmptr]
mov r8, r14
xor ecx, ecx
mov rdx, qword [rax]
call qword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnv]
test rax, rax
je 0x1400255e4
test rdi, rdi
je 0x1400255c5
mov rdx, rdi
lea rcx, str._CL_
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
test byte [0x1400614c0], 0x80
je 0x1400255da
lea rdx, [0x140030aa8]
call fcn.140027598
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret