joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066f30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x1c0
mov rax, qword [0x14009e7a0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, qword [rcx + 0x10]
mov rsi, rdx
mov r9, qword [rbx + 0x98]
cmp r9, 0xffffffffffffffff
je 0x140067080
mov rax, qword [rdx + 0x20]
mov rcx, qword [rax + 0x360]
test dword [rcx + 0x8c], 0x800
jne 0x140067080
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
mov rcx, r9
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14006700e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.14001a500
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140033020
mov eax, 2
jmp 0x140067082
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x140]
lea r8, [rbx + 0x10e]
lea rcx, [rsp + 0x30]
call fcn.140035800
test al, al
jne 0x140067080
mov qword [rsp + 0x1e0], rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.14001a500
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140033020
mov rdi, qword [rsp + 0x1e0]
mov eax, 2
jmp 0x140067082
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14007b5d0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rsi
ret
Function at 0x14007a0f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov r14, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
jne 0x14007a135
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x50], rdi
cmp r15d, dword [rbp + 0x1c]
jbe 0x14007a180
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rbp + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbp + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor esi, esi
test r15, r15
je 0x14007a1e2
mov rsi, r15
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rbp + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rbp + reloc.WS2_32.dll_htonl]
sub r15, 1
jne 0x14007a1a0
mov eax, dword [rbp + 0x1c]
cmp rsi, rax
jae 0x14007a223
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x14008f209]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x14008f20a]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov eax, dword [rbp + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14007a1f0
mov rdi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x14007a240
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov r12, r9
mov rcx, r8
mov r14, rdx
call fcn.140036c70
mov r8d, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x20]
add rcx, 0x18
mov r15d, eax
lea r9d, [r8 + r8]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
je 0x14007a3e6
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x58], rsi
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x60], rdi
cmp r15d, dword [rbp + 0x1c]
jbe 0x14007a2d0
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, r14
call qword [rbp + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbp + 0x18]
add r14, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor esi, esi
test r15, r15
je 0x14007a332
mov rsi, r15
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 8]
call qword [rbp + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x50]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x50], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rbp + reloc.WS2_32.dll_htonl]
sub r15, 1
jne 0x14007a2f0
mov eax, dword [rbp + 0x1c]
cmp rsi, rax
jae 0x14007a373
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x14008f209]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x14008f20a]
mov r8d, 1
call qword [rbp + reloc.WS2_32.dll_htonl]
mov eax, dword [rbp + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14007a340
mov rcx, qword [rsp + 0x70]
call fcn.140036c70
mov r9, qword [rbx]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, r12
call qword [r9 + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rbx]
test rdi, rdi
jne 0x14007a3a2
mov edi, dword [rsi + 0x18]
add rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
mov r8d, dword [rsi + 0x20]
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call qword [rsi + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
mov rcx, rbx
call qword [case.0x14002593b.0]
mov rdi, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
mov eax, reloc.WLDAP32.dll_Ordinal_27
add rsp, 0x20
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
Function at 0x14007a510
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14009e7a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, Ordinal_27
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14007a55c
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x14007a62e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14007a5a0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x14007a62e
mov rcx, rbp
call fcn.140036c70
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x14007a60a
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14007a61a
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14007a62c
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14007b5d0
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14007b3e0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x14007b445
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x14007b3f0
ret

Function at 0x14007c2d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007c322
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007c322
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007c322
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007c322
cmp dword [rcx + 0x84], 0xe
jbe 0x14007c322
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007c324
xor al, al
add rsp, 0x28
ret
Function at 0x140112840
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.140116e40
sub rsp, rax
mov rax, qword [0x140159700]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140112902
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140125994
cmp rax, 1
jne 0x14011295e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1401128df
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1401128d3
cmp rcx, 1
jb 0x14011295e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1401128a0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140112933
lea rcx, [rsp + 0x80]
call fcn.14012853c
jmp 0x140112935
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140116b70
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14011a300
int3
Function at 0x1401137c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
cmp byte [0x1401641b6], 0
mov rbp, r8
mov rsi, rdx
mov r14, rcx
jne 0x140113846
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140163fc0], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x140163fc0], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x140163fc0], rdx
call fcn.140111740
cmp eax, ebx
jne 0x1401139ee
mov byte [0x1401641b6], 1
lea rdx, [0x1401377a8]
mov rcx, rbp
call fcn.140125440
test eax, eax
je 0x140113908
cmp byte [0x1401641b5], 1
je 0x140113908
mov qword [rsp + 0x30], rdi
call qword [sym.imp.python38.dll_PyDict_New]
mov qword [0x140164ee0], rax
call qword [sym.imp.python38.dll_PyDict_New]
mov qword [0x140164ee8], rax
call qword [sym.imp.python38.dll_PyDict_New]
mov qword [0x140164ef0], rax
call qword [sym.imp.python38.dll_PyDict_New]
mov qword [0x140164ef8], rax
call qword [sym.imp.python38.dll_PyDict_New]
mov qword [0x140164f00], rax
call qword [sym.imp.python38.dll_PyDict_New]
mov qword [0x140164f08], rax
call qword [sym.imp.python38.dll_PyDict_New]
mov qword [0x140164f10], rax
call qword [sym.imp.python38.dll_PyDict_New]
mov qword [0x140164f18], rax
mov ebx, 0xfffffffb
lea rdi, [0x1401662c0]
mov ecx, ebx
call qword [sym.imp.python38.dll_PyLong_FromLong]
inc ebx
mov qword [rdi], rax
lea rdi, [rdi + 8]
cmp ebx, 0x101
jl 0x1401138e3
mov rdi, qword [rsp + 0x30]
mov byte [0x1401641b5], 1
mov r8, qword [0x140163fc0]
mov rax, rbp
mov rdx, r8
sub rdx, rbp
nop dword [rax + rax]
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140113937
inc rax
test cl, cl
jne 0x140113920
mov ecx, r9d
jmp 0x14011393c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140113943
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x1401139a8
nop
add rdx, rax
mov rax, rbp
mov r8, rdx
sub r8, rbp
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x140113985
inc rax
test cl, cl
jne 0x140113970
mov ecx, r9d
jmp 0x14011398a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x140113991
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x140113960
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x1401139d8
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rsi
mov rcx, r14
call fcn.140110060
add rsi, 8
sub rbx, 1
jne 0x1401139c0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.140122154
call fcn.14011a300
int3
Function at 0x140116780
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140159700]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x140116831
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140125994
cmp rax, 1
jne 0x140116867
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14011680d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140116800
cmp rcx, 1
jb 0x140116867
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1401167d0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140116b70
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14011a300
int3
Function at 0x1401168d0
Capabilities:
Set environment variable

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0xb0
mov rax, qword [0x140159700]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x1401645f8]
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
test rax, rax
jne 0x14011691f
lea rcx, [0x140137554]
call qword [sym.imp.python38.dll_PyImport_ImportModule]
mov qword [0x1401645f8], rax
test rax, rax
je 0x140116adb
mov qword [rsp + 0xa8], rsi
lea rdx, str.environ
mov qword [rsp + 0xa0], r12
mov rcx, rax
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x90], r15
call qword [sym.imp.python38.dll_PyObject_GetAttrString]
mov rcx, rdi
mov r14, rax
call qword [sym.imp.python38.dll_PyUnicode_FromString]
mov r15, rax
test rbx, rbx
je 0x1401169c4
mov rdx, rbx
mov rcx, rdi
call fcn.140116780
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.python38.dll_PyUnicode_FromWideChar]
mov rdx, r15
mov rcx, r14
mov r8, rax
mov rbx, rax
call qword [sym.imp.python38.dll_PyObject_SetItem]
test eax, eax
je 0x1401169ab
mov ecx, 1
call qword [sym.imp.python38.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python38.dll_Py_Exit]
int3
sub qword [rbx], 1
jne 0x140116a7a
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x140116a7a
movzx eax, byte [rdi]
lea rbx, [rsp + 0x30]
xor r12d, r12d
mov esi, 0x28
mov word [rsp + 0x30], r12w
test al, al
je 0x140116a55
nop
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r12b
lea rcx, [rsp + 0x28]
call fcn.140125994
cmp rax, 1
jne 0x140116ad5
mov rcx, rsi
mov rax, rbx
cmp word [rbx], r12w
je 0x140116a2d
nop dword [rax]
nop dword [rax + rax]
add rax, 2
dec rcx
cmp word [rax], r12w
jne 0x140116a20
cmp rcx, 1
jb 0x140116ad5
movzx ecx, word [rsp + 0x28]
inc rdi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r12w
dec rsi
movzx eax, byte [rdi]
test al, al
jne 0x1401169e0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.python38.dll_PyObject_DelItem]
test eax, eax
je 0x140116a7a
mov rcx, rbp
call fcn.1400fa2f0
sub qword [r15], 1
jne 0x140116a8a
mov rax, qword [r15 + 8]
mov rcx, r15
call qword [rax + 0x30]
sub qword [r14], 1
jne 0x140116a9a
mov rax, qword [r14 + 8]
mov rcx, r14
call qword [rax + 0x30]
mov r14, qword [rsp + 0x98]
mov r12, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140116b70
add rsp, 0xb0
pop rdi
pop rbp
pop rbx
ret
call fcn.14011a300
int3
call fcn.14011a300
int3

Function at 0x1401175a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401175ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401175ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401175ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401175ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1401175ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401175f0
xor al, al
add rsp, 0x28
ret
Function at 0x14011b55c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14011b5cb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14011b5cb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011b5cb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011b5cb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011b5cb
cmp dword [rcx + 0x84], 0xe
jbe 0x14011b5cb
cmp dword [rcx + 0xf8], 0
je 0x14011b5cb
mov ecx, ebx
call fcn.14011b67c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14011b458
nop
cmp dword [rbp + 0x20], 0
je 0x14011b619
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14011b624
int3
xor r8d, r8d
xor edx, edx
jmp 0x14011b55c

Function at 0x14011b760
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14011b5cb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14011b5cb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011b5cb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011b5cb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011b5cb
cmp dword [rcx + 0x84], 0xe
jbe 0x14011b5cb
cmp dword [rcx + 0xf8], 0
je 0x14011b5cb
mov ecx, ebx
call fcn.14011b67c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14011b458
nop
cmp dword [rbp + 0x20], 0
je 0x14011b619
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14011b624
int3
xor r8d, r8d
xor edx, edx
jmp 0x14011b55c
Function at 0x14012d360
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14012d3e7
mov rsi, rbx
cmp word [rax], bp
je 0x14012d3a6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14012d390
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14012d38c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140128a14
mov rdi, rax
test rax, rax
je 0x14012d3d4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1401336e0
mov rbp, rdi
xor ecx, ecx
call fcn.140129424
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14012faec
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14012fb02
mov al, 1
jmp 0x14012fb62
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14012fb13
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14012fb60
mov ecx, dword [rcx + 0x18]
nop
call fcn.14012db04
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14012fb60
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14012fb60
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14012fb60
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14012fb62
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401334c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401334e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401334e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret