joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000e0fc
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18000e156
mov r11b, 0x23
lea rbx, [0x180058c50]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x18000e140
cmp rdx, 2
jb 0x18000e140
cmp byte [r10], r11b
jne 0x18000e140
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x18000e11e
jmp 0x18000e197
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18000e197
mov r11b, 0x23
lea rbx, [0x180058c50]
cmp dl, r11b
jne 0x18000e17b
cmp byte [r10], r11b
jne 0x18000e17b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x18000e169
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x1400013f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13f0
call fcn.140004ea0
sub rsp, rax
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov ecx, 0x40
call fcn.140003f50
mov rsi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x3e
mov qword [rsp + 0x48], 0x3f
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400065e0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400065f0]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x140006600]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x140006608]
mov dword [rsi + 0x38], eax
movzx eax, word [0x14000660c]
mov word [rsi + 0x3c], ax
mov byte [rsi + 0x3e], dil
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov ecx, 1
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x1400014c0
mov dword [rsp + 0x50], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
mov edi, 0xa
mov ebp, 0x80000000
nop
lea rcx, [rsp + 0x50]
call fcn.140003d40
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x14000153a
lea rcx, [rsp + 0x50]
call fcn.140003d40
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x140001525
shr rax, 0x20
add rax, rbp
xor rax, rbp
movzx r9d, byte [rax + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140001575
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14000156a
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000157d
mov rcx, rbx
call fcn.1400039a0
sub rdi, 1
jne 0x140001510
mov edx, 0x40
mov rcx, rsi
call fcn.140003f8c
mov rax, rbx
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.140003f30
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140002a60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140002a91
xor eax, eax
jmp 0x140002bdb
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140002ace
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x140002ace
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x140002bdb
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140002bd0
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140002b15
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002b23
movzx ecx, di
jmp 0x140002b77
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002b90
sub eax, 1
je 0x140002b90
cmp eax, 2
jne 0x140002bd0
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140002bd3
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x140002bbe
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140002bd0
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003f30
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002e90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002f65
cmp byte [rcx + 0x72], 0
je 0x140002f65
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140002f61
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002f26
sub eax, 1
je 0x140002f2a
cmp eax, 2
jne 0x140002f61
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003f30
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002f58
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002f61
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140002f0e
xor al, al
jmp 0x140002f0e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003f30
add rsp, 0x60
pop rbx
ret
Function at 0x140003d40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140003da1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140003d60
mov ecx, dword [r9]
jmp 0x140003e8b
cmp ecx, 0x4e0
jb 0x140003e8b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140003dc0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140003e10
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x1400048b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400048fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400048fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400048fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400048fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400048fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400048fc
xor al, al
add rsp, 0x28
ret
Function at 0x14003a900
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0xffffffff
test edx, edx
je 0x14003a93b
mov r9d, edx
lea r10, [0x1400656a0]
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rcx]
lea rcx, [rcx + 1]
movzx edx, al
xor r8, rdx
shr eax, 8
xor eax, dword [r10 + r8*4]
sub r9, 1
jne 0x14003a920
not eax
ret

Function at 0x14003a940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov ebx, 0xffffffff
xor esi, esi
call qword [0x140056bb8]
test rax, rax
jle 0x14003a9aa
mov ebp, esi
lea r14, [0x1400656a0]
nop word [rax + rax]
mov rdx, rbp
mov rcx, rdi
call qword [0x140056bf8]
xor al, bl
movzx ecx, al
shr ebx, 8
xor ebx, dword [r14 + rcx*4]
inc esi
mov ebp, esi
mov rcx, rdi
call qword [0x140056bb8]
cmp rbp, rax
jl 0x14003a980
not ebx
mov rcx, rdi
call qword [0x140056c18]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x14003a9d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbp, rcx
lea rdx, [rsp + 0x20]
call qword [0x1400567a0]
nop
mov ebx, 0xffffffff
xor edi, edi
lea rcx, [rsp + 0x20]
call qword [0x140056bb8]
test rax, rax
jle 0x14003aa51
mov esi, edi
lea r14, [0x1400656a0]
nop word [rax + rax]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call qword [0x140056bf0]
movzx ecx, bl
xor cl, byte [rax]
movzx eax, cl
shr ebx, 8
xor ebx, dword [r14 + rax*4]
inc edi
mov esi, edi
lea rcx, [rsp + 0x20]
call qword [0x140056bb8]
cmp rsi, rax
jl 0x14003aa20
not ebx
lea rcx, [rsp + 0x20]
call qword [0x140056c18]
nop
mov rcx, rbp
call qword [0x140056ba0]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140043304
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140056018]
test rax, rax
je 0x14004334e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004334e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004334e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004334e
cmp dword [rcx + 0x84], 0xe
jbe 0x14004334e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140043350
xor al, al
add rsp, 0x28
ret
Function at 0x140002820
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140056040]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rsi, [0x140049950]
mov rcx, rsi
call fcn.1400147d0
xor ebp, ebp
mov qword [0x14005ee60], rax
mov word [rsp + 0x30], bp
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov al, 0x50
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003134c
cmp rax, 1
jne 0x14000295a
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1400028bf
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1400028b3
cmp rcx, 1
jb 0x14000295a
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140002880
lea rdx, [0x140049958]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.1400147d0
mov cl, 1
mov qword [0x14005ee88], rax
call fcn.1400156c0
mov rdx, rax
lea rcx, str.PYTHONHOME
call fcn.140014900
mov cl, 1
call fcn.1400156c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400224f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140025c20
int3
Function at 0x1400147d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14003d8f0
sub rsp, rax
mov rax, qword [0x140056040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140014892
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003134c
cmp rax, 1
jne 0x1400148ee
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001486f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140014863
cmp rcx, 1
jb 0x1400148ee
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140014830
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400148c3
lea rcx, [rsp + 0x80]
call fcn.14003287c
jmp 0x1400148c5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400224f0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140025c20
int3

Function at 0x140014900
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140056040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x1400149b1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14003134c
cmp rax, 1
jne 0x1400149e7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14001498d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140014980
cmp rcx, 1
jb 0x1400149e7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140014950
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400224f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140025c20
int3
Function at 0x1400149f0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140056040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x140014a9f
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003134c
cmp rax, 1
jne 0x140014ad5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140014a7c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140014a70
cmp rcx, 1
jb 0x140014ad5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140014a40
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400224f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140025c20
int3
Function at 0x14001d6e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14005e1ee], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x14001d763
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x14005e1c0], rax
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x14005e1c0], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x14005e1c0], rdx
call fcn.14001bae0
cmp eax, ebx
jne 0x14001d8cd
mov byte [0x14005e1ee], 1
lea rdx, [0x140049940]
mov rcx, rsi
call fcn.14003dab0
test eax, eax
je 0x14001d7ee
cmp byte [0x14005e1ef], 1
je 0x14001d7ee
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x14005f1f8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x14005f6b8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x14005ef18], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x14005ee90], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x14005f710], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x14005ef98], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x14005f6c0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x14005f6d0], rax
mov byte [0x14005e1ef], 1
mov r8, qword [0x14005e1c0]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
nop
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x14001d817
inc rax
test cl, cl
jne 0x14001d800
mov ecx, r9d
jmp 0x14001d81c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x14001d823
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x14001d888
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x14001d865
inc rax
test cl, cl
jne 0x14001d850
mov ecx, r9d
jmp 0x14001d86a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x14001d871
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x14001d840
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x14001d8b8
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14001c7e0
add rdi, 8
sub rbx, 1
jne 0x14001d8a0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.14002de74
call fcn.140025c20
int3

Function at 0x140022ec8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140022f12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140022f12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140022f12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140022f12
cmp dword [rcx + 0x84], 0xe
jbe 0x140022f12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140022f14
xor al, al
add rsp, 0x28
ret
Function at 0x140025d7c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140025deb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025deb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140025deb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140025deb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140025deb
cmp dword [rcx + 0x84], 0xe
jbe 0x140025deb
cmp dword [rcx + 0xf8], 0
je 0x140025deb
mov ecx, ebx
call fcn.140025e9c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140025c78
nop
cmp dword [rbp + 0x20], 0
je 0x140025e39
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140025e44
int3
xor r8d, r8d
xor edx, edx
jmp 0x140025d7c

Function at 0x140025f80
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140025deb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025deb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140025deb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140025deb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140025deb
cmp dword [rcx + 0x84], 0xe
jbe 0x140025deb
cmp dword [rcx + 0xf8], 0
je 0x140025deb
mov ecx, ebx
call fcn.140025e9c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140025c78
nop
cmp dword [rbp + 0x20], 0
je 0x140025e39
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140025e44
int3
xor r8d, r8d
xor edx, edx
jmp 0x140025d7c
Function at 0x1400373c8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003744f
mov rsi, rbx
cmp word [rax], bp
je 0x14003740e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400373f8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400373f4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140034fd0
mov rdi, rax
test rax, rax
je 0x14003743c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14003df50
mov rbp, rdi
xor ecx, ecx
call fcn.140032ee8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret