joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140184a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x28], 0x71
mov byte [rsp + 0x29], 0x78
mov byte [rsp + 0x2a], 0x6b
mov byte [rsp + 0x2b], 0x7d
mov byte [rsp + 0x2c], 0x6e
mov byte [rsp + 0x2d], 0x78
mov byte [rsp + 0x2e], 0x6b
mov byte [rsp + 0x2f], 0x7c
mov byte [rsp + 0x30], 0x19
mov byte [rsp + 0x31], 0x69
mov byte [rsp + 0x32], 0x6b
mov byte [rsp + 0x33], 0x76
mov byte [rsp + 0x34], 0x7f
mov byte [rsp + 0x35], 0x70
mov byte [rsp + 0x36], 0x75
mov byte [rsp + 0x37], 0x7c
mov byte [rsp + 0x38], 0x19
mov byte [rsp + 0x39], 0x7e
mov byte [rsp + 0x3a], 0x6c
mov byte [rsp + 0x3b], 0x70
mov byte [rsp + 0x3c], 0x7d
mov byte [rsp + 0x3d], 3
mov byte [rsp + 0x3e], 0x19
mov byte [rsp + 0x3f], 0x39
lea rcx, [rsp + 0x28]
call fcn.140060ea0
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401b0e40]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x60
pop rdi
ret

Function at 0x140184cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x20]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x28], 0x6a
mov byte [rsp + 0x29], 0x60
mov byte [rsp + 0x2a], 0x6a
mov byte [rsp + 0x2b], 0x6d
mov byte [rsp + 0x2c], 0x7c
mov byte [rsp + 0x2d], 0x74
mov byte [rsp + 0x2e], 0x19
mov byte [rsp + 0x2f], 0x77
mov byte [rsp + 0x30], 0x78
mov byte [rsp + 0x31], 0x74
mov byte [rsp + 0x32], 0x7c
mov byte [rsp + 0x33], 3
mov byte [rsp + 0x34], 0x19
mov byte [rsp + 0x35], 0x39
lea rcx, [rsp + 0x28]
call fcn.140060f60
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401b0fc0]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x60
pop rdi
ret
Function at 0x140184d80
Capabilities:
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3e0
lea rdi, [rsp + 0x20]
mov ecx, 0xf0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3f0]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov dword [rsp + 0x144], 0x100
lea rax, [rsp + 0x170]
mov rdi, rax
xor eax, eax
mov ecx, 0x7c
rep stosb byte [rdi], al
lea rdx, [rsp + 0x144]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x140184eb0
lea rcx, [rsp + 0x368]
call fcn.140184c50
mov qword [rsp + 0x370], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x1f8]
call fcn.140002760
mov qword [rsp + 0x378], rax
lea rcx, [rsp + 0x369]
call fcn.140184cd0
mov qword [rsp + 0x380], rax
mov r8, qword [rsp + 0x378]
mov rdx, qword [rsp + 0x380]
lea rcx, [rsp + 0x220]
call fcn.140018b40
mov qword [rsp + 0x388], rax
mov r8, qword [rsp + 0x370]
mov rdx, qword [rsp + 0x388]
lea rcx, [rsp + 0x248]
call fcn.140018af0
mov rdx, rax
mov rcx, qword [rsp + 0x3f0]
call fcn.14000a410
lea rcx, [rsp + 0x248]
call fcn.140002650
lea rcx, [rsp + 0x220]
call fcn.140002650
lea rcx, [rsp + 0x1f8]
call fcn.140002650
nop
lea rdx, [rsp + 0x144]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140184f89
lea rcx, [rsp + 0x36a]
call fcn.140184b40
mov qword [rsp + 0x390], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x270]
call fcn.140002760
mov qword [rsp + 0x398], rax
lea rcx, [rsp + 0x36b]
call fcn.140184bc0
mov qword [rsp + 0x3a0], rax
mov r8, qword [rsp + 0x398]
mov rdx, qword [rsp + 0x3a0]
lea rcx, [rsp + 0x298]
call fcn.140018b40
mov qword [rsp + 0x3a8], rax
mov r8, qword [rsp + 0x390]
mov rdx, qword [rsp + 0x3a8]
lea rcx, [rsp + 0x2c0]
call fcn.140018af0
mov rdx, rax
mov rcx, qword [rsp + 0x3f0]
call fcn.14000a410
lea rcx, [rsp + 0x2c0]
call fcn.140002650
lea rcx, [rsp + 0x298]
call fcn.140002650
lea rcx, [rsp + 0x270]
call fcn.140002650
nop
lea rcx, [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x140185060
lea rcx, [rsp + 0x36c]
call fcn.1401849e0
mov qword [rsp + 0x3b0], rax
lea rdx, [rsp + 0x174]
lea rcx, [rsp + 0x2e8]
call fcn.140002760
mov qword [rsp + 0x3b8], rax
lea rcx, [rsp + 0x36d]
call fcn.140184a60
mov qword [rsp + 0x3c0], rax
mov r8, qword [rsp + 0x3b8]
mov rdx, qword [rsp + 0x3c0]
lea rcx, [rsp + 0x310]
call fcn.140018b40
mov qword [rsp + 0x3c8], rax
mov r8, qword [rsp + 0x3b0]
mov rdx, qword [rsp + 0x3c8]
lea rcx, [rsp + 0x338]
call fcn.140018af0
mov rdx, rax
mov rcx, qword [rsp + 0x3f0]
call fcn.14000a410
lea rcx, [rsp + 0x338]
call fcn.140002650
lea rcx, [rsp + 0x310]
call fcn.140002650
lea rcx, [rsp + 0x2e8]
call fcn.140002650
nop
mov rcx, rsp
lea rdx, [0x1401b10b0]
call fcn.140185b40
nop
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x3e0
pop rdi
ret
Function at 0x1401853a0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
lea rdi, [rsp + 0x50]
mov ecx, 0x84
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x270]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.VCRUNTIME140D.dll_memset]
mov dword [rsp + 0x1d0], 0x68
mov rax, qword [0x1401e7d58]
mov qword [rsp + 0x228], rax
mov rax, qword [0x1401e7d58]
mov qword [rsp + 0x230], rax
mov dword [rsp + 0x20c], 0x101
xor eax, eax
mov word [rsp + 0x210], ax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1401854e8
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x50], 1
movzx eax, byte [rsp + 0x50]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1401b1270]
call fcn.140185b40
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x260
pop rdi
ret
Function at 0x140185520
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1118
call fcn.140185cf0
sub rsp, rax
lea rdi, [rsp + 0x30]
mov ecx, 0x43a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1130]
mov rax, qword [0x1401db040]
xor rax, rsp
mov qword [rsp + 0x1100], rax
cmp qword [0x1401e7d50], 0xffffffffffffffff
jne 0x140185607
lea rcx, [rsp + 0x10b0]
call fcn.140004010
mov qword [rsp + 0x10f0], rax
mov byte [rsp + 0x10a4], 0
lea rax, [rsp + 0x10a5]
mov r8, rax
lea rdx, [rsp + 0x10a4]
lea rcx, [rsp + 0x10b8]
call fcn.140014290
lea rcx, [rsp + 0x10c8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x10e0]
lea rcx, [rsp + 0x10c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x10f0]
lea rdx, [rsp + 0x10e0]
mov rcx, qword [rsp + 0x1130]
call fcn.1400144a0
nop
mov rax, qword [rsp + 0x1130]
jmp 0x1401856f9
mov byte [rsp + 0x1064], 0
lea rcx, [rsp + 0x1078]
call fcn.14000a5f0
nop
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1401e7d50]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x14018564e
jmp 0x1401856cf
cmp dword [rsp + 0x34], 0
jne 0x140185657
jmp 0x1401856cf
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1401e7d50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14018568b
mov byte [rsp + 0x10f8], 1
jmp 0x140185693
mov byte [rsp + 0x10f8], 0
movzx eax, byte [rsp + 0x10f8]
mov byte [rsp + 0x1064], al
movzx eax, byte [rsp + 0x1064]
test eax, eax
je 0x1401856b5
cmp dword [rsp + 0x34], 0
jne 0x1401856b7
jmp 0x1401856cf
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1078]
call fcn.14001ceb0
nop
jmp 0x14018561d
lea rdx, [rsp + 0x1078]
mov rcx, qword [rsp + 0x1130]
call fcn.14000a4c0
lea rcx, [rsp + 0x1078]
call fcn.140002650
mov rax, qword [rsp + 0x1130]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401b1360]
call fcn.140185b40
mov rax, rdi
mov rcx, qword [rsp + 0x1100]
xor rcx, rsp
call fcn.140061a30
add rsp, 0x1118
pop rdi
pop rsi
ret
Function at 0x14000bbb0
Capabilities:
Check for debugger via api
Check for peb ntglobalflag flag

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000bcc9
xor ebx, ebx
mov dword [rsp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x14000bbf0
cmp dword [rsp + 0x48], ebx
jne 0x14000bcaf
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8, [rsp + 0x48]
mov edx, 0x1e
call qword [0x140075968]
test eax, eax
jne 0x14000bc28
cmp qword [rsp + 0x48], rbx
jne 0x14000bcbc
call fcn.14000bd10
test al, al
jne 0x14000bcc9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0xd8]
cmp dword [rdx + rax + 0xc], ebx
jne 0x14000bcc9
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x30]
call fcn.14000bad0
test eax, eax
mov edx, 0x70
mov ebx, 0x14
cmovne ebx, edx
call fcn.14000bad0
test eax, eax
mov ecx, 0x18
mov edx, 0x74
cmovne ecx, edx
test dword [rbx + rdi], 0xfffffffd
jne 0x14000bcc9
cmp dword [rcx + rdi], 0
jne 0x14000bcc9
mov rax, qword gs:[0x60]
test byte [rax + 0xbc], 0x70
jne 0x14000bcc9
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, str.Sorry__you_cant_use_debuggers_with_this_program.
call fcn.14000bce0
int3
lea rcx, str.Sorry__you_cant_use_debuggers_with_this_program.
call fcn.14000bce0
int3
lea rcx, str.Sorry__you_cant_use_debuggers_with_this_program.
call fcn.14000bce0
int3
Function at 0x14000bd10
Capabilities:
Enumerate pe sections
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x140071540]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x58], rsi
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov r14d, ebx
mov qword [rsp + 0x48], rbx
xor r15b, r15b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd r8, dword [rax + 0x3c]
add r8, rax
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
add r9, rax
mov edx, ebx
mov dword [rsp + 0x40], ebx
lea r10, [0x140053394]
movzx eax, word [r8 + 6]
cmp edx, eax
jge 0x14000bdbe
movsxd rax, edx
lea rcx, [rax + rax*4]
lea rdi, [r9 + rcx*8]
mov rax, rbx
nop dword [rax + rax]
movzx ecx, byte [rdi + rax]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x14000bdb6
cmp rax, 7
jne 0x14000bda0
jmp 0x14000bdc1
inc edx
mov dword [rsp + 0x40], edx
jmp 0x14000bd84
mov rdi, rbx
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000be8b
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r12d, 1
mov r8d, r12d
mov edx, 0x80000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x14000be8b
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000be8b
mov ecx, dword [rdi + 0x10]
add ecx, dword [rdi + 0x14]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000be8b
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0xd8]
sub edx, dword [rdi + 0xc]
add edx, dword [rdi + 0x14]
movzx r15d, r15b
cmp dword [rdx + rax + 0xc], 0
cmovne r15d, r12d
test r14, r14
je 0x14000be99
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test rbx, rbx
je 0x14000bea7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, 0xffffffffffffffff
je 0x14000beb6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r15b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400305b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000c230
Capabilities:
Terminate process
Terminate thread

Disassembly:
push rbp
sub rsp, 0x30
mov ebp, 1
xor r9d, r9d
mov edx, ebp
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r8d, r8d
mov qword [0x140073520], rax
test rax, rax
jne 0x14000c26f
mov edx, 8
mov ecx, ebp
call fcn.14000c930
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x50], rsi
mov ecx, 4
mov qword [rsp + 0x58], rdi
call fcn.14000c930
mov rax, qword [0x140073520]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov rax, qword [0x140075958]
xor r8d, r8d
mov ecx, 2
mov qword [rsp + 0x28], rax
mov byte [0x1400734f0], bpl
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14000c2dc
call sub.KERNEL32.dll_GetLastError
mov edx, eax
lea rcx, str.SvcInit___WaitForMultipleObjects
call fcn.14002f210
mov rcx, qword [0x140075958]
lea rdx, [rsp + 0x40]
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14000c309
mov eax, dword [rsp + 0x40]
cmp eax, 0x103
je 0x14000c309
test eax, eax
je 0x14000c33f
mov ebx, ebp
jmp 0x14000c33f
call sub.python312.dll_PyErr_SetInterrupt
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x140075958]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14000c33f
mov eax, dword [rsp + 0x40]
cmp eax, 0x103
je 0x14000c33f
test eax, eax
cmovne ebx, ebp
test esi, esi
mov ecx, ebp
cmovne edi, ebx
xor r8d, r8d
mov edx, edi
call fcn.14000c930
mov rcx, qword [0x140075958]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x14000c620
Capabilities:
Create thread
Set current directory
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [0x140075958]
mov rcx, rax
mov dword [rsp + 0x28], 1
mov r8, rdi
mov dword [rsp + 0x20], 0
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea r8, [0x14000c840]
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000c6b9
call sub.KERNEL32.dll_GetLastError
mov edx, eax
lea rcx, str.service_thread_creation
call fcn.14002f210
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x1400734f0], 0
jne 0x14000c6d6
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400734f0], 0
je 0x14000c6c2
cmp byte [0x14006e6a0], 0
je 0x14000c6ef
xor ecx, ecx
call fcn.14002c0b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp 0x14000cd10
push rbx
sub rsp, 0x20
call qword [sym.imp.python312.dll_PyThreadState_Get]
xor r8d, r8d
lea rdx, str.__main__
mov rcx, rax
mov rbx, rax
call fcn.14000c9e0
mov rcx, rbx
call fcn.14000cab0
mov ecx, eax
call qword [sym.imp.python312.dll_Py_Exit]
int3

Function at 0x14000c760
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x140071540]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rdi, rcx
lea rsi, str.otis_bridge_guardian
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14000c814
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rdi
lea r8, str._s_failed_with__d
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov edx, 0x800
call fcn.14000c090
xor ecx, ecx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov edx, 1
mov qword [rsp + 0x38], rax
mov r9d, 0xc0020001
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], 2
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1400305b0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002c280
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.140030670
sub rsp, rax
mov rax, qword [0x140071540]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x14002c342
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.1400417d4
cmp rax, 1
jne 0x14002c39e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14002c31f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x14002c313
cmp rcx, 1
jb 0x14002c39e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14002c2e0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14002c373
lea rcx, [rsp + 0x80]
call fcn.1400442d4
jmp 0x14002c375
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400305b0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140033e00
int3
Function at 0x14002d010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1400737fe], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x14002d0a4
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rax
mov qword [0x140073798], rax
call fcn.14000bf40
mov qword [0x140073798], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x140073798], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x140073798], rdx
call fcn.14002b020
cmp eax, ebx
jne 0x14002d20d
mov byte [0x1400737fe], 1
lea rdx, str..bytecode
mov rcx, rsi
call fcn.140043240
test eax, eax
je 0x14002d12f
cmp byte [0x1400737fd], 1
je 0x14002d12f
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140074558], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140074560], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140074568], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140074570], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140074578], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140074580], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140074588], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140074590], rax
mov byte [0x1400737fd], 1
mov r8, qword [0x140073798]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
nop
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x14002d157
inc rax
test cl, cl
jne 0x14002d140
mov ecx, r9d
jmp 0x14002d15c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x14002d163
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x14002d1c8
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x14002d1a5
inc rax
test cl, cl
jne 0x14002d190
mov ecx, r9d
jmp 0x14002d1aa
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x14002d1b1
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x14002d180
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x14002d1f8
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140029610
add rdi, 8
sub rbx, 1
jne 0x14002d1e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.140040b58
call fcn.140033e00
int3
Function at 0x140030140
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140071540]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x1400301f1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1400417d4
cmp rax, 1
jne 0x140030227
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x1400301cd
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x1400301c0
cmp rcx, 1
jb 0x140030227
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140030190
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400305b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140033e00
int3