joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010d890
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 3
call fcn.14011c950
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x14010da24
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x14010da5b
lea rdx, [0x1402cb93e]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14010da49
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [0x140320008]
mov r14, rax
movsxd r12, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r12, r12
je 0x14010da51
test r12d, r12d
js 0x14010dac6
shl r12, 3
lea r15, [r12 + r12*2]
mov rcx, r15
call fcn.1401d4088
mov rbx, rax
mov qword [rsp + 0x30], rax
add r15, rax
mov qword [rsp + 0x40], r15
xor r13d, r13d
xor r15d, r15d
mov rcx, rbx
add rcx, r13
je 0x14010da6e
mov rdx, qword [r14 + r15]
call fcn.1402138f0
add r15, 8
add r13, 0x18
cmp r12, r15
jne 0x14010d992
mov r15, rbx
add r15, r13
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14010d350
movups xmmword [rsi], xmm6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x14010d9e6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x14010da24
cmp r15, rbx
je 0x14010da1c
add r15, 0xffffffffffffffe8
jmp 0x14010da0a
mov rcx, qword [r15]
call fcn.1401d40d8
lea rax, [r15 - 0x18]
cmp r15, rbx
mov r15, rax
je 0x14010da1c
test r15, r15
je 0x14010da9a
cmp byte [r15 + 0x17], 0
jns 0x14010d9fe
jmp 0x14010d9f6
mov rcx, rbx
call fcn.1401d40d8
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401d5680
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x14010d944
xor r15d, r15d
xor ebx, ebx
jmp 0x14010d9bf
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x14010d941
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.140215d40
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x41
call fcn.140215d40
lea rcx, [rsp + 0x30]
call fcn.140215bc0
int3
Function at 0x1401117d0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401d77d0
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140111865
mov eax, eax
inc rax
cmp rax, 1
je 0x140111865
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x140111831
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140111852
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.1401f1048
test eax, eax
je 0x14011199e
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1401118c6
mov eax, eax
inc rax
cmp rax, 1
je 0x1401118c6
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x140111892
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1401118b3
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.1401f1048
test eax, eax
je 0x14011196f
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140111923
mov eax, eax
inc rax
cmp rax, 1
je 0x140111923
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x1401118f3
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140111914
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
call fcn.1401f1048
test eax, eax
je 0x140111944
xor ebx, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401d5680
mov eax, ebx
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx eax, byte [rsi + 0x17]
test al, al
js 0x140111951
and eax, 0x7f
jmp 0x140111955
mov rax, qword [rsi + 8]
mov bl, 1
cmp rax, r14
je 0x140111925
mov rcx, rsi
mov rdx, r14
call fcn.14022e4d0
cmp word [rax], 0x5c
jne 0x140111923
jmp 0x140111925
movzx eax, byte [rsi + 0x17]
test al, al
js 0x14011197c
and eax, 0x7f
jmp 0x140111980
mov rax, qword [rsi + 8]
mov bl, 1
cmp rax, r14
je 0x140111925
mov rcx, rsi
mov rdx, r14
call fcn.14022e4d0
cmp word [rax], 0x5c
jne 0x1401118c6
jmp 0x140111925
movzx eax, byte [rsi + 0x17]
test al, al
js 0x1401119ab
and eax, 0x7f
jmp 0x1401119af
mov rax, qword [rsi + 8]
mov bl, 1
cmp rax, r14
je 0x140111925
mov rcx, rsi
mov rdx, r14
call fcn.14022e4d0
cmp word [rax], 0x5c
jne 0x140111865
jmp 0x140111925
Function at 0x1401122c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1401123e9
mov ebx, eax
mov r15d, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [0x1402bb8f0]
movaps xmmword [rsp + 0x20], xmm0
cmp ebx, 0xb
jae 0x1401123f9
lea r14, [rsp + 0x20]
mov byte [r14 + 0x17], bl
lea r8, [r15 + r15]
mov rcx, r14
xor edx, edx
call fcn.1401d77d0
mov word [r14 + r15*2], 0
cmp byte [rsp + 0x37], 0
js 0x14011234d
lea rdx, [rsp + 0x20]
jmp 0x140112352
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1401123cd
mov edx, eax
movzx eax, byte [rsp + 0x37]
test al, al
js 0x140112372
and eax, 0x7f
jmp 0x140112377
mov rax, qword [rsp + 0x28]
cmp rax, rdx
jbe 0x1401123cd
lea rdi, [rsp + 0x20]
mov rcx, rdi
xor r8d, r8d
call fcn.1401893b0
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
xorps xmm0, xmm0
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
cmp byte [rsp + 0x37], 0
js 0x1401123dd
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401d5680
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x1401123a8
mov rcx, qword [rsp + 0x20]
call fcn.1401d40d8
jmp 0x1401123af
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x1401123af
mov r12, r15
or r12, 7
lea rcx, [r12*2 + 2]
call fcn.1401d4088
mov r14, rax
mov qword [rsp + 0x20], rax
movabs rax, 0x8000000000000001
add rax, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
jmp 0x14011232a
Function at 0x1401176a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x1401176ba
test r8d, r8d
jne 0x1401176b3
call fcn.140132120
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.140116e70

Function at 0x140117a00
Capabilities:
Initialize winsock library

Disassembly:
push rsi
sub rsp, 0x1c0
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov rax, qword [0x14030ae90]
cmp rax, 1
jbe 0x140117a41
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1401d5680
nop
add rsp, 0x1c0
pop rsi
ret
lea rcx, [0x14030ae90]
call fcn.14011c590
test al, al
je 0x140117a98
lea rsi, [rsp + 0x20]
mov r8d, 0x198
mov rcx, rsi
mov dl, 0xaa
call fcn.1401d77d0
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140117a7d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [0x14030ae98]
lea rcx, [0x14030ae90]
xor r8d, r8d
mov r9, rcx
call fcn.14011c650
jmp 0x140117a27
mov rax, qword [0x14030ae90]
jmp 0x140117a27
Function at 0x14011d030
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14030b088]
mov ecx, dword [0x1402ffa30]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14011d06b
movzx eax, word [0x14030b058]
cmp eax, 9
jne 0x14011d0b3
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x14030b088]
call fcn.1401d4200
cmp dword [0x14030b088], 0xffffffff
jne 0x14011d055
xorps xmm0, xmm0
movups xmmword [0x14030b078], xmm0
movups xmmword [0x14030b068], xmm0
movups xmmword [0x14030b058], xmm0
lea rcx, [0x14030b058]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14030b088]
call fcn.1401d4298
jmp 0x14011d055
test eax, eax
je 0x14011d066
cmp eax, 6
jne 0x14011d0c3
mov eax, 2
jmp 0x14011d066
cmp eax, 0xc
jne 0x14011d0cf
mov eax, 3
jmp 0x14011d066
mov eax, 4
jmp 0x14011d066

Function at 0x14011fe80
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x50]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x1402bb8f0]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.MapImageToMemory
lea r8, str....._base_filesmemory_mapped_file_win.cc
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0x1b
call fcn.14019f4e0
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140193890
mov rcx, rsi
call fcn.140190e10
test al, al
je 0x14011fffd
mov rcx, rsi
call fcn.1400fe670
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x11000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
cmp qword [rsi + 0x40], rax
je 0x14011ff7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x40]
inc rax
cmp rax, 2
jae 0x140120026
mov rax, rdi
inc rax
cmp rax, 2
jb 0x14011ff6f
mov qword [rsi + 0x40], rdi
call fcn.14019f500
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsi + 0x40]
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140120041
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov rcx, qword [rsi + 0x30]
movabs rbx, 0xfffffffc00000000
mov rax, rcx
and rax, rbx
cmp rax, qword [0x1402efec8]
je 0x140120045
and rbx, rdi
cmp rbx, qword [0x1402efec8]
je 0x14012004f
mov qword [rsi + 0x30], rdi
test rdi, rdi
je 0x140120041
lea rax, fcn.1402206f0
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], rdi
call fcn.1401364c0
mov eax, dword [rax + 0x50]
mov qword [rsi + 0x38], rax
mov dil, 1
lea rcx, [rsp + 0x50]
call fcn.140193ad0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401d5680
mov eax, edi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14019f500
mov rcx, qword [rsi + 0x40]
call fcn.14018b8d0
mov qword [rsi + 0x40], 0
jmp 0x14011ff5a
xor edi, edi
jmp 0x14011fffd
call fcn.14016bfa0
jmp 0x14011ffc6
mov rcx, rdi
call fcn.14016baa0
jmp 0x14011ffd2
Function at 0x140125e60
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rcx + 0x10]
cmp r14, qword [rcx + 0x18]
je 0x140125ebc
test r14, r14
je 0x140125fbb
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401d5680
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x140125f06
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r15, [rax + rcx]
inc r15
shr r15, 1
shl r15, 3
mov rcx, rbx
sub rcx, r15
mov r8, r14
sub r8, rbx
mov rdx, rbx
call fcn.1401d7120
sub r14, r15
mov qword [rsi + 0x10], r14
sub qword [rsi + 8], r15
jmp 0x140125e8c
mov rax, r14
sub rax, r15
sar rax, 2
cmp r14, r15
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x140125fe7
lea rcx, [r12*8]
call fcn.1401d4088
mov rcx, r12
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x140125f86
mov rcx, r9
sar rcx, 3
and r9, 0xfffffffffffffff8
mov r8, r9
add r8, rdx
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x140125fbb
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x140125f6e
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], r15
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r14
call fcn.140255e20
mov r14, qword [rsi + 0x10]
jmp 0x140125e8c
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.140215d40
call fcn.140213770
int3
Function at 0x140126bf0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1402ff774]
cmp ecx, 0xffffffff
je 0x140126cca
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x140126cca
mov eax, dword [0x14030c950]
mov ecx, dword [0x1402ffa30]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140126cd4
mov rbx, qword [0x14030c948]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x140126d1a
mov rax, qword [0x14030b130]
inc rax
xor ecx, ecx
lea rdx, [0x14030b140]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x140126d27
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x14030c940]
inc ecx
mov dword [0x14030c940], ecx
mov dword [rax + 0x14], ecx
mov qword [0x14030b130], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x140126d3c
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140126d40
jmp 0x140126c1a
lea rcx, [0x14030c950]
call fcn.1401d4200
cmp dword [0x14030c950], 0xffffffff
jne 0x140126c3f
mov ecx, 8
call fcn.1401d4088
mov rbx, rax
mov rcx, rax
call fcn.140184320
mov qword [0x14030c948], rbx
lea rcx, [0x14030c950]
call fcn.1401d4298
jmp 0x140126c3f
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x140126c57
inc rcx
cmp rcx, 0x100
jne 0x140126c6a
jmp 0x140126cb0
int3

Function at 0x140126d40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1401d5620
sub rsp, rax
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1402ff774]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x140126df4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140126e57
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1401d77d0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1401d411c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1401d7120
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401d5680
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1401402d0
test al, al
je 0x140126e5a
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140126e32
mov eax, 0xffffffff
lock cmpxchg dword [0x1402ff774], ecx
je 0x140126d78
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1402ff774]
mov dword [rsp + 0x2c], ecx
jmp 0x140126d78
lea rcx, [rsp + 0x2c]
call fcn.1401402d0
test al, al
je 0x140126e5d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140126e5d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x140126e0b
int3
int3
int3
Function at 0x140126e70
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1402ff774]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140126eae
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140126ea7
call fcn.140126d40
jmp 0x140126e8e

Function at 0x14012a8d0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x1402bb8f0]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x14012aa4c
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x14030cf00]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.1401fe5e0
mov rcx, rbx
call fcn.1401fc5f4
sub r14, rax
lea rdx, [0x1402c7418]
mov rcx, rbx
mov r8, r14
call fcn.1401fe5e0
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1401d77d0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14012a9ac
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401fe628
test eax, eax
je 0x14012aa74
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14012a9e7
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1401fe628
test eax, eax
je 0x14012aa74
xor eax, eax
mov byte [0x14030caf1], al
mov dword [rsp + 0x30], 0
lea rcx, [0x1402c7072]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402d4064]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14012aa70
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x140320008]
test eax, eax
je 0x14012aa70
cmp dword [rsp + 0x30], 0
setne al
mov byte [0x14030d100], al
mov byte [0x14030caf0], 1
test esi, esi
setns bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401d5680
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x14012aa3f
mov al, 1
jmp 0x14012a9e9
Function at 0x14012ad20
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x14012ad53
mov rax, qword [rsi + 8]
test rax, rax
je 0x14012ae47
bt ebx, 8
jae 0x14012ad6f
mov eax, ebx
and eax, 0x200
jne 0x14012ae47
cmp edi, 2
lea rax, [0x14030cb00]
lea rcx, [0x14030cd00]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14012ae47
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x14012ae47
cmp byte [0x14030d100], 0
setne al
bt ebx, 8
jb 0x14012ae47
shr ebx, 9
and ebx, 1
or bl, al
je 0x14012ae47
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.tB__
cmove r12, rax
movzx ebp, byte [rsi + 0x17]
test bpl, bpl
jns 0x14012ae66
mov r14, qword [rsi]
mov rbp, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov r13, rbp
sub r13, r15
jb 0x14012ae34
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
call fcn.1401f1048
test eax, eax
je 0x14012ae91
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x14012ae14
cmp dword [rsp + 0x2c], 0
jne 0x14012ae6b
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401d5680
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rsi
jmp 0x14012adf7
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x14012ae77
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, rsi
mov r8, qword [rsp + 0x38]
call fcn.140243330
jmp 0x14012ae47
movzx ecx, word [r14 + r15*2]
cmp ecx, 0x5c
je 0x14012ae9f
test ecx, ecx
jne 0x14012ae34
lea rax, [r14 + r15*2]
mov edx, dword [r12 + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x14012aece
cmp dword [rsp + 0x2c], 2
jne 0x14012aedf
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x14012aedf
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
cmp cx, 0x5c
jne 0x14012aef8
lea r14, [rax + 2]
dec r13
cmp word [rax + 2], 0x5c
mov rax, r14
je 0x14012aee5
jmp 0x14012aefb
mov r14, rax
mov rdi, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
xor ebx, ebx
mov rbp, r13
jmp 0x14012ae3b
Function at 0x14012bb20
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rax, qword [0x1402ef038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x30], xmm0
movzx eax, byte [r8 + 0x17]
test al, al
js 0x14012bb52
and eax, 0x7f
jmp 0x14012bb59
mov rax, qword [r8 + 8]
mov r8, qword [r8]
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], rax
test rax, rax
js 0x14012bc1a
test r8, r8
jne 0x14012bb7a
test rax, rax
jne 0x14012bc46
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140195590
cmp byte [rsi + 0x17], 0
jns 0x14012bb9d
mov rsi, qword [rsp + 0x80]
movaps xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rdi, [rsp + 0x58]
mov rcx, rdi
call fcn.140195590
cmp byte [rdi + 0x17], 0
jns 0x14012bbc2
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [rsp + 0x6f], 0
jns 0x14012bbe1
mov rcx, qword [rsp + 0x58]
call fcn.1401d40d8
cmp byte [rsp + 0x97], 0
jns 0x14012bbf8
mov rcx, qword [rsp + 0x80]
call fcn.1401d40d8
test esi, esi
setne bl
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401d5680
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.140215d40
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.140215d40
int3