joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e1780
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x14012d038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1401422c8]
test rax, rax
jne 0x1400e17c4
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1401422c8]
test rax, rax
je 0x1400e17b1
cmp eax, 2
jne 0x1400e181c
mov ecx, 2
call fcn.14006d880
test al, al
je 0x1400e1879
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x90
mov r9d, 2
call fcn.140032aa0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
call fcn.1400c3d60
mov rcx, rsi
call fcn.1400330f0
jmp 0x1400e1879
mov eax, 1
lock xadd qword [0x140142300], rax
inc rax
cmp rax, 2
jl 0x1400e1840
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140142284], eax
mov qword [0x14014227c], rsi
mov rcx, qword [0x14012f208]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.14006d880
test al, al
jne 0x1400e18a9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140090cc0
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpadclientcrashpad_client_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xbc
mov r9d, 2
call fcn.140032aa0
lea rcx, [rsp + 0x38]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
jmp 0x1400e180d

Function at 0x1400e8860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x14012d038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rdi, qword [rcx + 0x50]
mov r12, qword [rcx + 0x58]
mov ebx, 1
cmp rdi, r12
je 0x1400e88f4
mov rsi, r8
mov r14, rcx
lea r15, [rsp + 0x20]
mov rcx, rdi
mov rdx, r15
call fcn.1400e8170
test al, al
jne 0x1400e88bc
add rdi, 0x70
cmp rdi, r12
jne 0x1400e88a1
mov rdi, r12
cmp rdi, qword [r14 + 0x58]
je 0x1400e88f4
cmp byte [rdi + 0x27], 0
js 0x1400e88ce
lea rcx, [rdi + 0x10]
jmp 0x1400e88d2
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov ebx, 1
cmovne ebx, ecx
test ebx, ebx
jne 0x1400e88f4
mov qword [rsi], rdi
xor ebx, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140090cc0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400f09f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14012d038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1400f0a1a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f0a39
mov edi, eax
bt eax, 0xa
jae 0x1400f0a31
test bl, bl
je 0x1400f0a47
and edi, 0x10
shr edi, 4
jmp 0x1400f0a49
mov ecx, 2
call fcn.14006d880
test al, al
jne 0x1400f0a66
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140090cc0
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.1400dec20
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400c3d60
mov rcx, rax
mov rdx, rsi
call fcn.1400df950
mov rcx, rdi
call fcn.1400deca0
jmp 0x1400f0a47

Function at 0x1400f0ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x14012d038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1400f0ae7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f0b17
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140090cc0
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.14006d880
test al, al
jne 0x1400f0b29
xor esi, esi
jmp 0x1400f0afb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.1400dec20
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400c3d60
mov rcx, rax
mov rdx, rsi
call fcn.1400df950
mov rcx, rdi
call fcn.1400deca0
jmp 0x1400f0b25
Function at 0x1400f0b80
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x14012d038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x1400f0ba7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400f0bbe
and eax, 0x410
cmp eax, 0x410
je 0x1400f0c03
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400f0bca
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x1400f0be7
mov ecx, 2
call fcn.14006d880
test al, al
jne 0x1400f0c24
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140090cc0
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140090cc0
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.1400f0c80
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.1400dec20
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1400c3d60
mov rcx, rax
mov rdx, rsi
call fcn.1400df950
mov rcx, rdi
call fcn.1400deca0
jmp 0x1400f0be5

Function at 0x1400f0c80
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14012d038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1400f0ca8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x1400f0cc2
mov ecx, 2
call fcn.14006d880
test al, al
jne 0x1400f0ce4
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140090cc0
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.1400dec20
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400c3d60
mov rcx, rax
mov rdx, rsi
call fcn.1400df950
mov rcx, rbx
call fcn.1400deca0
jmp 0x1400f0cc2

Function at 0x1400fbe00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x1400fbe13
cmp dword [0x14014fe50], ecx
jle 0x1400fbe1a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.1400fbe60
test edi, edi
je 0x1400fbe13
cmp byte [rsi + rdi - 1], 0xa
je 0x1400fbe13
lea rcx, [0x14010caa9]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400fbe60
Function at 0x1400fbe60
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14012d038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400fbeae
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x1400fbeec
cmp rdi, rsi
jae 0x1400fbeec
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x1400fbea7
jmp 0x1400fbea4
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140090cc0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400011e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x140018030]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.winhttp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [rsp + 0x20], 0x117000
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x12f6a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, [0x14001802c]
lea rcx, str.Dump1.mem
call fcn.140002cf0
mov qword [rsp + 0x30], rax
mov r9, qword [rsp + 0x30]
mov r8d, 0x117000
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.140002f7c
mov rcx, qword [rsp + 0x30]
call fcn.140002bb4
call qword [rsp + 0x38]
xor eax, eax
add rsp, 0x48
ret

Function at 0x140001684
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140001715
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140001715
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001715
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400016f9
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400016f3
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400016fb
add rdx, 0x28
jmp 0x1400016d8
xor edx, edx
test rdx, rdx
jne 0x140001704
xor al, al
jmp 0x14000171b
test dword [rdx + 0x24], 0x80000000
je 0x140001711
xor al, al
jmp 0x14000171b
mov al, 1
jmp 0x14000171b
xor al, al
jmp 0x14000171b
add rsp, 0x18
ret
Function at 0x140003cec
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140003ac0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003ac0
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003ac0
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003ac0
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003ac0
cmp dword [rcx + 0x84], 0xe
jbe 0x140003ac0
cmp dword [rcx + 0xf8], esi
je 0x140003ac0
mov ecx, r14d
call fcn.140003c08
mov ecx, 2
call fcn.140007ce4
nop
cmp byte [0x140018e48], 0
jne 0x140003b8a
mov r15d, 1
mov eax, r15d
xchg dword [0x140018e38], eax
test ebx, ebx
jne 0x140003b33
mov rdi, qword [0x140018088]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140018e40]
cmp rcx, rax
je 0x140003b2a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140002a04]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140018e88]
jmp 0x140003b3f
cmp ebx, r15d
jne 0x140003b45
lea rcx, [0x140018ea0]
call fcn.140004344
nop
test ebx, ebx
jne 0x140003b5c
lea rdx, [0x14000f2e0]
lea rcx, [0x14000f2c0]
call fcn.140003980
lea rdx, [0x14000f2f0]
lea rcx, [0x14000f2e8]
call fcn.140003980
movzx eax, byte [0x140018e48]
test esi, esi
cmove eax, r15d
mov byte [0x140018e48], al
jmp 0x140003b8a
mov ecx, 2
call fcn.140007d38
test esi, esi
jne 0x140003ba1
mov ecx, r14d
call fcn.140003bbc
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140003a50
Function at 0x1400061dc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14000607c
call fcn.140004b1c
mov dword [rax], 0x16
call fcn.1400049fc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140006064
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140006064
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400060ae
lock or dword [rax + 0x14], 0x10
jmp 0x140006064
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400060cb
mov rcx, qword [rbp + 0x10]
call fcn.14000b7b0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140004d10
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140005ab4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140006122
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140006064
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14000618e
mov rcx, qword [rbp + 0x10]
call fcn.140004d10
cmp eax, 0xffffffff
je 0x140006175
mov rcx, qword [rbp + 0x10]
call fcn.140004d10
cmp eax, 0xfffffffe
je 0x140006175
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140004d10
movsxd rdi, eax
lea rsi, [0x1400192c0]
mov rcx, rbx
sar rdi, 6
call fcn.140004d10
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14000617c
lea rax, [0x140018860]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14000618e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400061c4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400061c0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400061c0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140006067
jmp 0x140006034
Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
push rcx
mov bl, 0x14
invalid
xor cl, byte [r10]
or eax, esp
or esi, dword [rsp + rcx*2 - 0x13]
in al, 0x63
xor esp, dword [rdi + 0x1a]
out 0xc4, eax
mov cl, 0x85
or eax, 0x3d2ac996
in al, 0x49
jmp 0x14001acb7
xchg esi, eax
leave
sub bh, byte [0x12b4b910a]
test dword [rcx + 0x44b068a6], 0x720c2829
xchg dword [rdi - 2], ebp
movsd dword [rdi], dword [rsi]
invalid
jle 0x14001ac5c
xchg dword [0x11dfd49ad], ecx
sbb byte [rsi - 0xc05be4f], bl
jp 0x14001aca2
fstp qword [rax]
sahf
mov cl, 0x41
cli
jp 0x14001aca2
ret
jns 0x14001acda
adc eax, 0x8e8324a8
push rdi
and al, 0x94
cmpsd dword [rsi], dword [rdi]
int 0x44
sub ecx, dword [rbx + 0x2e]
push rdi
fst qword [0xca996513]
in eax, 0x82
sbb al, 0xc8
pop rsi
jo 0x14001acd3
je 0x14001ad06
or dword [rax], 0xffffffa5
mov cl, ah
invalid
Function at 0x14002e3d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x10090
call fcn.14005b580
sub rsp, rax
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x10080], rax
xor eax, eax
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x80], ax
lea rbx, [rsp + 0x30]
mov word [rsp + 0x30], ax
mov edi, 0x28
mov dl, 0x4e
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14002e43d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14002e430
cmp rcx, 1
jb 0x14002e4ea
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14002e460
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14004f3d0
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14002e420
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14002e4e6
lea rcx, [rsp + 0x80]
call fcn.140050a70
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140040840
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
xor eax, eax
jmp 0x14002e4c1
call fcn.1400448f8
int3

Function at 0x14002e4f0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140072010]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], ax
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov dl, 0x4e
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14002e54d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14002e540
cmp rcx, 1
jb 0x14002e5c7
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14002e563
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14004f3d0
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14002e530
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140040840
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.1400448f8
int3
Function at 0x140041258
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400412a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400412a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400412a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400412a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400412a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400412a4
xor al, al
add rsp, 0x28
ret

Function at 0x140044c58
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140044ac3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140044ac3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140044ac3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140044ac3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140044ac3
cmp dword [rcx + 0x84], 0xe
jbe 0x140044ac3
cmp dword [rcx + 0xf8], 0
je 0x140044ac3
mov ecx, ebx
call fcn.140044b74
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140044950
nop
cmp dword [rbp + 0x20], 0
je 0x140044b11
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140044b1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140044a54
Function at 0x140055914
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14005599b
mov rsi, rbx
cmp word [rax], bp
je 0x14005595a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140055944
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140055940
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140052f34
mov rdi, rax
test rax, rax
je 0x140055988
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400429e0
mov rbp, rdi
xor ecx, ecx
call fcn.1400513f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400590b4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400590ca
mov al, 1
jmp 0x14005912a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400590db
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140059128
mov ecx, dword [rcx + 0x18]
nop
call fcn.140055c5c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140059128
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140059128
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140059128
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14005912a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14005b490
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005b4b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14005b4b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret