joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000266c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, dword [rcx + 0x20]
mov rdi, rcx
mov ecx, 0x400
mov r8d, 0x326373
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x140006050], rax
test rax, rax
jne 0x1400026a3
mov eax, 0xc0000001
jmp 0x140002766
lea rax, [0x140002360]
sub eax, dword [rdi + 0x18]
lea rbx, [0x1400027b0]
mov dword [0x140006058], eax
lea rax, [0x140002360]
sub eax, dword [rdi + 0x18]
mov dword [0x14000605c], eax
lea rax, [0x140002380]
sub eax, dword [rdi + 0x18]
mov dword [0x140006064], eax
lea rax, [0x140002780]
mov r8d, dword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
sub ebx, dword [rdi + 0x18]
mov qword [rdi + 0x68], rax
mov rcx, qword [0x140006050]
call fcn.140003e80
mov rcx, qword [0x140006050]
xor edx, edx
mov r8d, 0x1000
call fcn.140004140
xorps xmm0, xmm0
lea rdx, [0x1400043f0]
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, ebx
lea rcx, [rsp + 0x20]
add rdx, qword [0x140006050]
call sub.ntoskrnl.exe_IoCreateDriver
test eax, eax
jns 0x140002758
mov rcx, qword [0x140006050]
mov edx, 0x326373
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140002699
lea rcx, [0x140004410]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400028b0
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x50], 0
xorps xmm0, xmm0
and qword [rbp - 0x48], 0
mov rdi, r8
mov qword [rbp - 0x40], rdx
lea rdx, [rbp - 0x50]
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x14000290d
lea rcx, [0x140004460]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x14000296a
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea r9, [rbp - 0x40]
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rbp - 0x48]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov rcx, qword [rbp - 0x48]
xor edx, edx
mov r8, qword [rbp - 0x40]
mov ebx, eax
mov qword [rdi], rcx
call fcn.140004140
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140003bf0
add rsp, 0x80
pop rdi
pop rbx
pop rbp
ret
Function at 0x140002c24
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x50], 0
xorps xmm0, xmm0
and qword [rbp - 0x48], 0
mov qword [rbp - 0x40], rdx
lea rdx, [rbp - 0x50]
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002c7d
lea rcx, [0x140004460]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x140002cbb
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9d, 0x8000
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x40]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
lea rcx, [rbp - 0x38]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140003bf0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rbp
ret
Function at 0x14000341c
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r9
mov edi, r8d
mov r14, rdx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x38], r9
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r15d, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140003491
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140004140
mov eax, 0xc0000001
jmp 0x140003510
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test r15d, r15d
jns 0x1400034aa
lea rcx, [0x140004460]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000348a
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400034d4
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000347d
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.140003e80
mov dword [rsp + 0x20], ebx
jmp 0x140003503
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140003bf0
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000352c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r15d, r8d
mov qword [rax - 0x28], rbx
mov r14, r9
mov qword [rax - 0x20], rbx
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbp, rax
test rax, rax
je 0x1400035c8
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400035c8
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400035c8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov r9, r14
mov byte [rsp + 0x28], bl
mov r8, rbp
mov rdx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
test eax, eax
mov ecx, 0xc0000001
cmovs ebx, ecx
mov eax, ebx
jmp 0x1400035cd
mov eax, 0xc0000001
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400036d8
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov qword [rsp + 0x28], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov esi, r8d
mov edx, r8d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140003748
lea rcx, [0x140004440]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x1400037f0
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call fcn.140003e80
lea rdx, [rsp + 0x28]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140003781
lea rcx, [0x140004460]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14000373e
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400037ab
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000373e
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.140003e80
mov dword [rsp + 0x20], ebx
jmp 0x1400037cd
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140003bf0
add rsp, 0x78
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000380c
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [rsp + 0x20], 0
lea rax, [rdx - 0x10001]
xorps xmm0, xmm0
mov rbx, rcx
movabs rcx, 0x7ffffffefffe
mov r14, r9
mov rdi, rdx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
cmp rax, rcx
ja 0x14000398d
mov edx, r8d
xor ecx, ecx
mov ebp, r8d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x140003883
lea rcx, [0x140004440]
jmp 0x140003994
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.140003e80
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x1400038c1
lea rcx, [0x140004460]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140003999
lfence
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400038f1
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140003999
lfence
mov r8, rbp
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_MmCreateMdl]
mov rdi, rax
test rax, rax
je 0x140003968
lfence
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rbx, rax
test rax, rax
je 0x14000395a
lfence
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call fcn.140003e80
mov cl, 2
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov cl, al
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
xor ebx, ebx
jmp 0x14000395f
mov ebx, 0xc0000001
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x14000399e
lea rcx, [0x1400044a0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003bf0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140003a7c
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [rsp + 0x20], 0
xorps xmm0, xmm0
mov rbx, rdx
mov edi, r8d
mov rbp, rcx
mov edx, r8d
xor ecx, ecx
mov r14, r9
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x140003ade
lea rcx, [0x140004440]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003bc1
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.140003e80
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x20]
mov r14d, eax
test rcx, rcx
je 0x140003bb4
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003ba9
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov r8d, 4
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov rbp, rax
test rax, rax
je 0x140003ba9
mov cl, 2
call qword [sym.imp.ntoskrnl.exe_KfRaiseIrql]
mov bl, al
mov rcx, cr0
btr rcx, 0x10
mov cr0, rcx
cli
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.140003e80
mov rcx, cr0
sti
bts rcx, 0x10
mov cr0, rcx
mov cl, bl
call qword [sym.imp.ntoskrnl.exe_KeLowerIrql]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmUnmapIoSpace]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, r14d
jmp 0x140003bc6
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140004140
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003bf0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140131ecd
Capabilities:
Hash data using fnv

Disassembly:
call fcn.1401334d0
test dil, dil
jne 0x1401324a2
add byte [rax], al
lea r9, [rbp + 0x120]
jmp 0x140131e39
mov dword [rsp + 0x20], 2
lea r8, [rbp + 0x1a0]
mov edx, r14d
mov rcx, rsi
jne 0x140131e8e
je 0x140131e8e
rol r13d, 0xa4
dec rsi
call rcx
lea ebp, [rbp - 0xda6a]
jle 0x140132c80
lea ebx, [rbp - 0x4947]
cmp rbx, rdx
mov r9d, 0x644efef2
pause
lea ebx, [rcx - 0xb7bc]
call rcx
cmp rbp, rbp
pushf
lea r14d, [rcx + 0xa7c7]
movabs rbp, 0x2aa8bbfffffe8be9
call rax
div r9
ja 0x14013137a
jmp 0x140131d1e
ret 0x38
dec byte [rcx - 0x6c]
mov qword [rsp + 0x20], r12
xchg r12, rax
xchg r14, r9
mov qword [rsp + 0x30], r9
jmp 0x140132017
xchg r14, r9
call r12
cmp eax, 0xc000008c
jne 0x140131d4a
int3
or al, 0xf
test dh, dh
invalid
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400dada0]
mov dword [rax], 1
mov rax, qword [0x1400dadb0]
mov dword [rax], 1
mov rax, qword [0x1400dadc0]
mov dword [rax], 1
mov rax, qword [0x1400dad40]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140057070
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400b7e40
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x140057135
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c8d4e
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x140057116
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140057108
test rsi, rsi
je 0x1400c8d4e
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x1400570c8
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140057164
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140057180
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x14005723d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c8d54
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14005721e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140057210
test rsi, rsi
je 0x1400c8d54
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x1400571d0
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14006d7a0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, qword [0x1400ecfe8]
mov rsi, rcx
test rbx, rbx
je 0x14006d820
mov rax, qword [0x1400daef0]
mov rcx, qword [rax + 0x48]
cmp rbx, rcx
je 0x14006d810
mov rdx, qword [0x1400ed228]
test rdx, rdx
je 0x14006d918
mov rcx, rbx
mov rbx, qword [sym.imp.python39.dll_PyNumber_InPlaceAdd]
call rbx
mov rcx, rax
mov rdx, rsi
mov rax, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rbx, qword [sym.imp.python39.dll_PyNumber_InPlaceAdd]
jmp 0x14006d7f1
lea r15, str.NUITKA_ONEFILE_BINARY
mov rcx, r15
call fcn.140057070
test rax, rax
je 0x14006d938
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python39.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r13, r14
lea r12, [r15 + 0x28]
mov word [rsp + 0x40], cx
lea rbp, [rsp + 0x3a]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov eax, 0x4e
nop
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, r15
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c8df0
cmp word [r13], 0
movzx edx, word [rsp + 0x3c]
mov rax, r13
je 0x14006d8be
nop word [rax + rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x14006d8b0
test rbx, rbx
je 0x1400c8df0
mov word [rax], dx
add r15, 1
xor edx, edx
add r13, 2
mov word [rax + 2], dx
movzx eax, byte [r15]
test al, al
jne 0x14006d870
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python39.dll__PyRuntime]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rax + 0x1f0]
call fcn.14006d4a0
mov rbx, rax
mov qword [0x1400ecfe8], rbx
jmp 0x14006d7c2
lea rcx, [0x1400d7530]
call qword [sym.imp.python39.dll_PyUnicode_FromString]
mov qword [0x1400ed228], rax
mov rdx, rax
jmp 0x14006d7e2
mov rbx, qword [0x1400ed000]
test rbx, rbx
jne 0x14006d906
cmp byte [0x1400ed222], 0
jne 0x14006d957
mov ecx, 1
call fcn.140038ff0
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400ed020]
call qword [sym.imp.python39.dll_PyUnicode_FromWideChar]
mov qword [0x1400ed000], rax
mov rbx, rax
test rax, rax
je 0x14006d980
add qword [rax], 1
jmp 0x14006d906
call qword [sym.imp.python39.dll_PyErr_Print]
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x14006f710
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rsi, str.NUITKA_ONEFILE_BINARY
mov ebx, ecx
mov rcx, rsi
call fcn.140057070
test rax, rax
je 0x14006f870
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python39.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r15, r14
lea r12, [rsi + 0x28]
mov word [rsp + 0x40], cx
mov r13, rax
lea rbp, [rsp + 0x3a]
mov eax, 0x4e
lea rdi, [rsp + 0x3c]
nop word [rax + rax]
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, rsi
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c8e0e
cmp word [r15], 0
movzx edx, word [rsp + 0x3c]
mov rax, r15
je 0x14006f7c6
nop dword [rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x14006f7b8
test rbx, rbx
je 0x1400c8e0e
mov word [rax], dx
add rsi, 1
xor edx, edx
add r15, 2
mov word [rax + 2], dx
movzx eax, byte [rsi]
test al, al
jne 0x14006f778
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python39.dll__PyRuntime]
mov rdx, qword [0x1400ed740]
mov rsi, qword [rax + 0x1f0]
mov rax, qword [0x1400daef0]
mov rbx, qword [rax + 0x1c0]
test rdx, rdx
je 0x14006f8c8
mov r8, rbx
mov rcx, rsi
call fcn.14005aa30
mov r8, r13
mov rcx, rsi
mov rbx, rax
mov rdx, rax
call fcn.14006a840
sub qword [rbx], 1
jne 0x14006f854
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [rdx + 0x30]
mov rax, qword [rsp + 0x28]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x1400ecff8]
lea rsi, [0x1400ecff8]
test bl, bl
je 0x14006f890
mov rax, qword [0x1400ed000]
lea rsi, [0x1400ed000]
test rax, rax
jne 0x14006f854
cmp byte [0x1400ed222], 0
jne 0x14006f8a6
movzx ecx, bl
call fcn.140038ff0
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400ed020]
call qword [sym.imp.python39.dll_PyUnicode_FromWideChar]
mov qword [rsi], rax
test rax, rax
je 0x14006f8f5
add qword [rax], 1
jmp 0x14006f854
mov rdx, qword [0x1400ed6b8]
mov rdi, qword [rax + 0x1b0]
test rdx, rdx
je 0x14006f900
mov r8, rdi
mov rcx, rsi
call fcn.14005aa30
mov qword [0x1400ed740], rax
mov rdx, rax
jmp 0x14006f81e
call qword [sym.imp.python39.dll_PyErr_Print]
call sub.msvcrt.dll_abort
lea rcx, [0x1400d3be6]
call qword [sym.imp.python39.dll_PyImport_ImportModule]
mov qword [0x1400ed6b8], rax
mov rdx, rax
test rax, rax
je 0x1400c8e0e
jmp 0x14006f8db