joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r9
mov rbx, rdx
mov r15, rcx
movzx eax, byte [r9 + 8]
test al, 0xfd
jne 0x18000c526
lea rax, str.true
lea r12, str.false
test r8b, r8b
cmovne r12, rax
movzx esi, r8b
xor rsi, 5
mov eax, dword [rdi]
xor ebp, ebp
sub rax, rsi
cmovae rbp, rax
movzx eax, byte [rdi + 9]
and eax, 0xf
lea rcx, [0x18001e211]
movzx ecx, byte [rax + rcx]
mov r14, rbp
shr r14, cl
movzx eax, byte [rdi + 0xf]
imul rax, rbp
mov rdx, qword [rbx + 8]
add rdx, rsi
add rdx, rax
cmp qword [rbx + 0x10], rdx
jae 0x18000c374
mov rcx, rbx
call qword [rbx + 0x18]
add rdi, 0xb
test r14, r14
mov qword [rsp + 0x28], r15
je 0x18000c39a
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, r14
mov r9, rdi
call fcn.18000aaa0
mov rbx, qword [rsp + 0x30]
mov r15, rbp
sub r15, r14
add rsi, r12
mov rax, qword [rbx + 8]
jmp 0x18000c3c7
mov rax, qword [rbx + 8]
add rax, rcx
mov qword [rbx + 8], rax
add r12, rcx
cmp r12, rsi
je 0x18000c4ff
mov r13, rsi
sub r13, r12
lea rdx, [rax + r13]
mov rcx, qword [rbx + 0x10]
cmp rcx, rdx
jae 0x18000c3e8
mov rcx, rbx
call qword [rbx + 0x18]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, r13
cmovae rcx, r13
test rcx, rcx
je 0x18000c3b4
mov rdx, qword [rbx]
lea r8, [rdx + rax]
cmp rcx, 8
jb 0x18000c410
mov r9, r8
sub r9, r12
cmp r9, 0x20
jae 0x18000c477
xor r9d, r9d
mov r11, rcx
mov r10, r9
and r11, 3
je 0x18000c441
mov r10, r9
nop word cs:[rax + rax]
movzx r13d, byte [r12 + r10]
mov byte [r8 + r10], r13b
inc r10
dec r11
jne 0x18000c430
not r9
add r9, rcx
cmp r9, 3
jb 0x18000c3b0
add rax, rdx
add rax, 3
nop dword [rax + rax]
mov edx, dword [r12 + r10]
mov dword [rax + r10 - 3], edx
add r10, 4
cmp rcx, r10
jne 0x18000c460
jmp 0x18000c3b0
cmp rcx, 0x20
jae 0x18000c482
xor r9d, r9d
jmp 0x18000c4d1
mov r9, rcx
and r9, 0xffffffffffffffe0
lea r10, [rdx + rax]
add r10, 0x10
xor r11d, r11d
nop word cs:[rax + rax]
movups xmm0, xmmword [r12 + r11]
movups xmm1, xmmword [r12 + r11 + 0x10]
movups xmmword [r10 + r11 - 0x10], xmm0
movups xmmword [r10 + r11], xmm1
add r11, 0x20
cmp r9, r11
jne 0x18000c4a0
cmp rcx, r9
je 0x18000c3b0
test cl, 0x18
je 0x18000c413
mov r10, r9
mov r9, rcx
and r9, 0xfffffffffffffff8
nop dword [rax + rax]
mov r11, qword [r12 + r10]
mov qword [r8 + r10], r11
add r10, 8
cmp r9, r10
jne 0x18000c4e0
cmp rcx, r9
je 0x18000c3b0
jmp 0x18000c413
cmp rbp, r14
je 0x18000c51c
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, r15
mov r9, rdi
call fcn.18000aaa0
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
mov qword [r15], rbx
jmp 0x18000c580
test byte [rdi + 0xa], 2
movzx r14d, r8b
je 0x18000c554
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], r14d
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.180006d10
test al, al
jne 0x18000c521
movzx eax, byte [rdi + 9]
shr eax, 4
and eax, 7
lea rcx, [0x18001d990]
mov eax, dword [rcx + rax*4]
shl rax, 0x20
or r14, rax
mov rcx, r15
mov rdx, rbx
mov r8, r14
mov r9, rdi
call fcn.18000c5a0
mov rax, r15
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140011bc0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x9f8
mov rax, qword [0x140407040]
xor rax, rsp
mov qword [rsp + 0x9f0], rax
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x90], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x120]
xor ecx, ecx
mov r8d, 0x400
call qword [0x1403fc340]
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
jne 0x140011e94
lea rcx, [rsp + 0x108]
xor edx, edx
mov r8d, 0x18
call fcn.140077780
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x68
call fcn.140077780
mov dword [rsp + 0xa0], 0x68
lea rcx, [rsp + 0x120]
xor eax, eax
lea rax, [rsp + 0xa0]
lea r10, [rsp + 0x108]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r10
call qword [0x1403fc220]
cmp eax, 0
je 0x140011e92
mov dword [rsp + 0x550], 0x10000b
mov rcx, qword [rsp + 0x110]
lea rdx, [rsp + 0x520]
call qword [0x1403fc3a0]
cmp eax, 0
je 0x140011e90
mov rdx, qword [rsp + 0x5a8]
add rdx, 0x10
mov rcx, qword [rsp + 0x108]
lea r8, [rsp + 0x98]
mov r9d, 8
mov qword [rsp + 0x20], 0
call qword [0x1403fc490]
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax + 0x50]
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rsp + 0x108]
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
call qword [0x1403fc548]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x60]
mov r9d, dword [rax + 0x54]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x20], 0
call qword [0x1403fc588]
mov dword [rsp + 0x5c], 0
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x140011e11
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
add rax, 0x108
movsxd rcx, dword [rsp + 0x5c]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov r9d, dword [rax + 0x10]
mov r8, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x14]
add r8, rax
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0xc]
add rdx, rax
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x20], 0
call qword [0x1403fc588]
mov eax, dword [rsp + 0x5c]
add eax, 1
mov dword [rsp + 0x5c], eax
jmp 0x140011d85
mov r8, qword [rsp + 0x60]
add r8, 0x18
add r8, 0x18
mov rdx, qword [rsp + 0x5a8]
add rdx, 0x10
mov rcx, qword [rsp + 0x108]
mov r9d, 8
mov qword [rsp + 0x20], 0
call qword [0x1403fc588]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x28]
add rax, rcx
mov qword [rsp + 0x5a0], rax
mov rcx, qword [rsp + 0x110]
lea rdx, [rsp + 0x520]
call qword [0x1403fc4f0]
mov rcx, qword [rsp + 0x110]
call qword [0x1403fc4a0]
mov dword [rsp + 0x84], 0
jmp 0x140011e9f
jmp 0x140011e92
jmp 0x140011e94
mov dword [rsp + 0x84], 0xffffffff
mov rcx, qword [rsp + 0x9f0]
xor rcx, rsp
call fcn.140039430
nop
add rsp, 0x9f8
ret
Function at 0x14002dd50
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140407040]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx ebp, dl
mov rsi, rcx
lea rdx, [rcx + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140002df0
nop
xor ebx, ebx
xor r14d, r14d
mov rdi, qword [rsi + 0x38]
sub rdi, qword [rsi + 0x30]
je 0x14002de00
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x14002dfd4
cmp rdi, 0x1000
jb 0x14002ddde
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14002dfda
call fcn.140024d5c
test rax, rax
je 0x14002dfce
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14002dde9
mov rcx, rdi
call fcn.140024d5c
mov rbx, rax
lea r14, [rbx + rdi]
mov r8, qword [rsi + 0x38]
mov rdx, qword [rsi + 0x30]
sub r8, rdx
mov rcx, rbx
call fcn.1400770e0
mov rax, qword [rsi + 0x38]
sub rax, qword [rsi + 0x30]
mov r15, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x28]
cmp rax, 1
jne 0x14002de1d
cmp byte [rbx], 0xcc
jmp 0x14002de2c
cmp rax, 2
jb 0x14002de32
cmp byte [rbx], 0xf3
jne 0x14002de32
cmp byte [rbx + 1], 0xc3
je 0x14002dfc6
lea rcx, [rsp + 0x28]
cmp r15, 0x10
cmovae rcx, rsi
mov rdi, qword [rsp + 0x38]
cmp rdi, 3
jne 0x14002de66
mov r8, rdi
lea rdx, [0x1403f22a0]
call fcn.140076fe0
test eax, eax
jne 0x14002de66
test bpl, bpl
je 0x14002dfc6
lea rcx, [rsp + 0x28]
cmp r15, 0x10
cmovae rcx, rsi
cmp rdi, 3
jne 0x14002de90
mov r8, rdi
lea rdx, [0x1403f1c58]
call fcn.140076fe0
test eax, eax
je 0x14002dfc6
lea rbp, [rsp + 0x28]
cmp r15, 0x10
cmovae rbp, rsi
cmp rdi, 4
jb 0x14002df28
lea r8, [rdi - 3]
add r8, rbp
sub r8, rbp
mov edx, 0x69
mov rcx, rbp
call fcn.140076f40
mov r9, rax
test rax, rax
je 0x14002df28
lea r12, [0x1403f1c50]
nop dword [rax]
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [r12 + rcx - 1]
jne 0x14002def9
cmp rcx, 4
jne 0x14002dee0
xor eax, eax
jmp 0x14002defe
sbb eax, eax
or eax, 1
test eax, eax
je 0x14002dfbd
inc r9
lea r8, [rdi - 3]
add r8, rbp
sub r8, r9
mov edx, 0x69
mov rcx, r9
call fcn.140076f40
mov r9, rax
test rax, rax
jne 0x14002ded0
xor dil, dil
test rbx, rbx
je 0x14002df60
sub r14, rbx
cmp r14, 0x1000
jb 0x14002df54
add r14, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14002dfce
mov rbx, rcx
mov rdx, r14
mov rcx, rbx
call fcn.140024da0
nop
cmp r15, 0x10
jb 0x14002df93
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14002df8b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002dfe0
mov rcx, rsi
call fcn.140024da0
movzx eax, dil
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140039430
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp r9, rbp
jne 0x14002df28
mov dil, 1
jmp 0x14002df2b
call fcn.14005dd98
int3
call fcn.14000cef0
int3
call fcn.140002150
nop
call fcn.14005dd98
int3
Function at 0x14002e590
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14002e76f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14002e780
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14002e734
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14002e6ac
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14002e723
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14002e6e9
mov r10, qword [rdx]
cmp r10, rax
je 0x14002e6e3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14002e723
cmp r9, rdx
je 0x14002e6ff
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14002e749
cmp r9, rdx
jne 0x14002e6f0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14002e630
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002e723
lea rcx, [0x1403f4308]
call fcn.1400253b8
int3
Function at 0x14002ea20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
movzx r9d, dl
movabs r14, 0xcbf29ce484222325
xor r9, r14
movabs rsi, 0x100000001b3
imul r9, rsi
movzx eax, byte [rbp + 0x29]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2a]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2b]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2c]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2d]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2e]
xor r9, rax
imul r9, rsi
movzx eax, byte [rbp + 0x2f]
xor r9, rax
imul r9, rsi
mov rcx, qword [rcx + 0x50]
and rcx, r9
shl rcx, 4
add rcx, qword [rbx + 0x38]
mov rax, qword [rcx + 8]
mov r9, qword [rbx + 0x28]
cmp rax, r9
je 0x14002eae1
mov rcx, qword [rcx]
cmp rdx, qword [rax + 0x10]
je 0x14002eae3
nop
cmp rax, rcx
je 0x14002eae1
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x14002ead0
jmp 0x14002eae3
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x14002eb36
lea rbx, [rax + 0x18]
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x14002eb12
mov rdx, r8
mov rcx, rax
call fcn.140015b60
add qword [rbx + 8], 0xa8
jmp 0x14002eb1d
mov rdx, rax
mov rcx, rbx
call fcn.140023840
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.140023840
lea r9, [rbp - 0x20]
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x30]
lea rcx, [rbx + 0x20]
call fcn.14002ed30
mov r8, qword [rbp + 0x28]
movzx edx, r8b
xor rdx, r14
imul rdx, rsi
movzx eax, byte [rbp + 0x29]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2a]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2b]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2c]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2d]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2e]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [rbp + 0x2f]
xor rdx, rax
imul rdx, rsi
mov rcx, qword [rbx + 0x50]
and rcx, rdx
shl rcx, 4
add rcx, qword [rbx + 0x38]
mov rax, qword [rcx + 8]
cmp rax, qword [rbx + 0x28]
je 0x14002ec97
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x14002ec03
nop dword [rax + rax]
cmp rax, rcx
je 0x14002ec97
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x14002ebf0
lea r14, [rax + 0x18]
mov rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x14002ec89
mov rbx, rdi
mov rsi, qword [rbp - 0x18]
cmp rdi, rsi
je 0x14002ec34
nop dword [rax]
mov rcx, rbx
call fcn.140015a10
add rbx, 0xa8
cmp rbx, rsi
jne 0x14002ec20
mov rcx, qword [rbp - 0x10]
sub rcx, rdi
movabs rax, 0xc30c30c30c30c30d
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0xa8
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002ec81
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ec91
mov rcx, rdi
call fcn.140024da0
mov rax, r14
jmp 0x14002eb20
call fcn.14005dd98
nop
lea rcx, [0x1403f3b98]
call fcn.1400253dc
int3
Function at 0x140039bf8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1403fc358]
test rax, rax
je 0x140039c42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140039c42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140039c42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140039c42
cmp dword [rcx + 0x84], 0xe
jbe 0x140039c42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140039c44
xor al, al
add rsp, 0x28
ret
Function at 0x14005af70
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14005b0b8
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14005b127
xor ecx, ecx
call qword [0x1403fc358]
test rax, rax
je 0x14005b127
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005b127
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005b127
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005b127
cmp dword [rcx + 0x84], 0xe
jbe 0x14005b127
cmp dword [rcx + 0xf8], 0
je 0x14005b127
mov ecx, ebx
call fcn.14005aff0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14005b24c
nop
cmp dword [rbp + 0x20], 0
je 0x14005b175
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14005b084
int3
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400d8d40]
mov dword [rax], 1
mov rax, qword [0x1400d8d50]
mov dword [rax], 1
mov rax, qword [0x1400d8d60]
mov dword [rax], 1
mov rax, qword [0x1400d8ce0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140052990
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400b5aa0
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x140052a55
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c69a8
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x140052a36
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140052a28
test rsi, rsi
je 0x1400c69a8
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x1400529e8
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140052a84
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140052aa0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x140052b5d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c69ae
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x140052b3e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140052b30
test rsi, rsi
je 0x1400c69ae
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x140052af0
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140069860
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, qword [0x1400f5310]
mov rsi, rcx
test rbx, rbx
je 0x1400698e0
mov rax, qword [0x1400d8e90]
mov rcx, qword [rax + 0x48]
cmp rbx, rcx
je 0x1400698d0
mov rdx, qword [0x1400f5548]
test rdx, rdx
je 0x1400699d8
mov rcx, rbx
mov rbx, qword [sym.imp.python310.dll_PyNumber_InPlaceAdd]
call rbx
mov rcx, rax
mov rdx, rsi
mov rax, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rbx, qword [sym.imp.python310.dll_PyNumber_InPlaceAdd]
jmp 0x1400698b1
lea r15, str.NUITKA_ONEFILE_BINARY
mov rcx, r15
call fcn.140052990
test rax, rax
je 0x1400699f8
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r13, r14
lea r12, [r15 + 0x28]
mov word [rsp + 0x40], cx
lea rbp, [rsp + 0x3a]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov eax, 0x4e
nop
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, r15
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c6a60
cmp word [r13], 0
movzx edx, word [rsp + 0x3c]
mov rax, r13
je 0x14006997e
nop word [rax + rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x140069970
test rbx, rbx
je 0x1400c6a60
mov word [rax], dx
add r15, 1
xor edx, edx
add r13, 2
mov word [rax + 2], dx
movzx eax, byte [r15]
test al, al
jne 0x140069930
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python310.dll__PyRuntime]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rax + 0x1f0]
call fcn.1400697a0
mov rbx, rax
mov qword [0x1400f5310], rbx
jmp 0x140069882
lea rcx, [0x1400d54d0]
call qword [sym.imp.python310.dll_PyUnicode_FromString]
mov qword [0x1400f5548], rax
mov rdx, rax
jmp 0x1400698a2
mov rbx, qword [0x1400f5328]
test rbx, rbx
jne 0x1400699c6
cmp byte [0x1400f5542], 0
je 0x140069a36
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400f5340]
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov qword [0x1400f5328], rax
mov rbx, rax
test rax, rax
je 0x140069a42
add qword [rax], 1
jmp 0x1400699c6
mov ecx, 1
call fcn.1400535b0
jmp 0x140069a0d
call qword [sym.imp.python310.dll_PyErr_Print]
call sub.msvcrt.dll_abort
nop
nop
call sub.msvcrt.dll_abort
nop