joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802034e8
Capabilities:
Create pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov edi, r9d
mov dword [rax - 0x28], r9d
mov r9d, r8d
lea rcx, str._winapi.CreateNamedPipe
mov esi, r8d
mov rbp, rdx
mov r8, rdx
lea rdx, [0x18038d754]
call sym.python310.dll_PySys_Audit
test eax, eax
jns 0x18020352c
or rax, 0xffffffffffffffff
jmp 0x180203597
call sym.python310.dll_PyEval_SaveThread
mov rcx, qword [rsp + 0x90]
mov r8d, edi
mov r9d, dword [rsp + 0x70]
mov edx, esi
mov qword [rsp + 0x38], rcx
mov rbx, rax
mov ecx, dword [rsp + 0x88]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x80]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x20], ecx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rcx, rbx
mov rdi, rax
call sym.python310.dll_PyEval_RestoreThread
cmp rdi, 0xffffffffffffffff
jne 0x180203594
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
xor edx, edx
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180203f6c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov r15d, r8d
mov r14, rcx
mov edx, r8d
xor ecx, ecx
mov ebx, r9d
xor esi, esi
call sym.python310.dll_PyBytes_FromStringAndSize
mov qword [rsp + 0x30], rax
mov rdi, rax
test rax, rax
je 0x180203fd0
test ebx, ebx
je 0x180203fef
mov rdx, rbp
mov rcx, r14
call fcn.180204c0c
mov rsi, rax
test rax, rax
jne 0x180203feb
sub qword [rdi], 1
jne 0x180203fd0
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov qword [rax + 0x40], rdi
call sym.python310.dll_PyEval_SaveThread
lea rdx, [rsi + 0x10]
mov rcx, rsi
neg rcx
lea r9, [rsp + 0x70]
mov rcx, rbp
mov rbx, rax
sbb r8, r8
and r8, rdx
lea rdx, [rdi + 0x20]
mov qword [rsp + 0x20], r8
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
mov ebp, eax
call sym.python310.dll_PyEval_RestoreThread
test ebp, ebp
je 0x180204033
xor ebx, ebx
jmp 0x18020403b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rsi, rsi
je 0x180204098
test ebp, ebp
jne 0x180204053
cmp ebx, 0x3e5
jne 0x18020406a
mov dword [rsi + 0x38], 1
mov rdx, rsi
mov r8d, ebx
lea rcx, [0x18038d8dc]
call sym.python310.dll_Py_BuildValue
jmp 0x180203fd2
cmp ebx, 0xea
je 0x180204053
sub qword [rsi], 1
jne 0x180204082
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
xor edx, edx
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x180203fd2
test ebp, ebp
jne 0x1802040b3
cmp ebx, 0xea
je 0x1802040b3
sub qword [rdi], 1
jne 0x180204082
mov rax, qword [rdi + 8]
mov rcx, rdi
jmp 0x18020407f
mov edx, dword [rsp + 0x70]
lea rcx, [rsp + 0x30]
call sym.python310.dll__PyBytes_Resize
test eax, eax
jne 0x180203fd0
mov rdx, qword [rsp + 0x30]
jmp 0x180204056

Function at 0x18020428c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
lea rcx, str._winapi.TerminateProcess
mov r9d, r8d
mov rdi, rdx
mov r8, rdx
lea rdx, [0x18038d8e0]
call sym.python310.dll_PySys_Audit
test eax, eax
jns 0x1802042bd
xor eax, eax
jmp 0x1802042f3
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1802042e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, eax
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x1802042f3
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18020ecc8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rbp, rdx
mov rsi, rcx
xor edi, edi
call sym.python310.dll_PyErr_CheckSignals
test eax, eax
je 0x18020ecf8
or eax, 0xffffffff
jmp 0x18020ee3d
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
test rsi, rsi
jne 0x18020ed2a
call sym.python310.dll_PyEval_SaveThread
lea rdx, str._nil_
mov rcx, rbp
mov rbx, rax
call fcn.1801734c8
mov rcx, rbx
call sym.python310.dll_PyEval_RestoreThread
jmp 0x18020ee11
cmp qword [rsi], rdi
jg 0x18020ed4e
call sym.python310.dll_PyEval_SaveThread
mov r8d, dword [rsi]
lea rdx, str._refcnt__ld_at__p_
mov r9, rsi
mov rcx, rbp
mov rbx, rax
call fcn.1801734c8
jmp 0x18020ed1d
mov rcx, rsi
test bl, 1
je 0x18020ed5d
call sym.python310.dll_PyObject_Str
jmp 0x18020ed62
call sym.python310.dll_PyObject_Repr
mov rbx, rax
test rax, rax
je 0x18020ee38
mov r8, qword [rax + 8]
mov eax, dword [r8 + 0xa8]
bt eax, 0x1b
jae 0x18020ed97
mov r8, qword [rbx + 0x10]
lea rcx, [rbx + 0x20]
mov r9, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18020edfd
bt eax, 0x1c
jae 0x18020ede3
lea r8, str.backslashreplace
mov rcx, rbx
lea rdx, str.utf_8
call sym.python310.dll_PyUnicode_AsEncodedString
mov rsi, rax
test rax, rax
je 0x18020edfa
mov r8, qword [rax + 0x10]
lea rcx, [rax + 0x20]
mov r9, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub qword [rsi], 1
jne 0x18020edfd
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x18020edfd
mov r8, qword [r8 + 0x18]
lea rdx, str.str___or_repr___returned__.100s
mov rcx, qword [sym.python310.dll_PyExc_TypeError]
call sym.python310.dll_PyErr_Format
or edi, 0xffffffff
sub qword [rbx], 1
jne 0x18020ee0d
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
test edi, edi
jne 0x18020ee3b
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x18020ee3b
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
xor edx, edx
call sym.python310.dll_PyErr_SetFromErrnoWithFilenameObjects
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
or edi, 0xffffffff
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180222934
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, r9d
lea rcx, str.winreg.DeleteKey
mov r9, r8
mov qword [rax - 0x18], rdi
mov rsi, r8
mov rbp, rdx
mov r8, rdx
lea rdx, [0x180240dac]
call sym.python310.dll_PySys_Audit
test eax, eax
jns 0x180222976
xor eax, eax
jmp 0x1802229c1
call sym.python310.dll_PyEval_SaveThread
mov r9d, dword [rsp + 0x60]
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov rcx, rbx
mov edi, eax
call sym.python310.dll_PyEval_RestoreThread
test edi, edi
je 0x1802229b3
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, edi
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x1802229c1
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1802229d8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x20], 0
lea rcx, str.winreg.DeleteKey
mov rdi, r8
mov r9, r8
mov r8, rdx
mov rsi, rdx
lea rdx, [0x180240dac]
call sym.python310.dll_PySys_Audit
test eax, eax
jns 0x180222a14
xor eax, eax
jmp 0x180222a57
call sym.python310.dll_PyEval_SaveThread
mov rdx, rdi
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rbx
mov edi, eax
call sym.python310.dll_PyEval_RestoreThread
test edi, edi
je 0x180222a49
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, edi
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x180222a57
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180222b1c
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
lea rcx, str.winreg.DeleteValue
mov r9, r8
mov rsi, rdx
mov r8, rdx
lea rdx, [0x18039685c]
call sym.python310.dll_PySys_Audit
test eax, eax
jns 0x180222b52
xor eax, eax
jmp 0x180222b95
call sym.python310.dll_PyEval_SaveThread
mov rdx, rdi
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, rbx
mov edi, eax
call sym.python310.dll_PyEval_RestoreThread
test edi, edi
je 0x180222b87
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, edi
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x180222b95
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180222f8c
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov r9d, r8d
lea rcx, str.winreg.EnumValue
mov r8, rdx
mov r12, rdx
lea rdx, [0x180396874]
call sym.python310.dll_PySys_Audit
xor edi, edi
test eax, eax
jns 0x180222fd7
xor eax, eax
jmp 0x18022317c
mov qword [rsp + 0x58], rdi
lea rax, [rbp + 0x48]
mov qword [rsp + 0x50], rdi
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0x60]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, r12
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x180223032
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, eax
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x18022317c
mov r13d, dword [rbp + 0x60]
mov r15d, dword [rbp + 0x48]
inc r13d
mov ecx, r13d
inc r15d
add rcx, rcx
mov dword [rbp + 0x60], r13d
mov dword [rbp + 0x48], r15d
call sym.python310.dll_PyMem_Malloc
mov r14, rax
test rax, rax
jne 0x180223065
call sym.python310.dll_PyErr_NoMemory
jmp 0x18022317c
mov ecx, dword [rbp + 0x48]
call sym.python310.dll_PyMem_Malloc
mov rsi, rax
test rax, rax
jne 0x180223087
mov rcx, qword [0x1803fc5f8]
mov rdx, r14
call qword [case.0x180096615.3]
jmp 0x18022305b
call sym.python310.dll_PyEval_SaveThread
mov edx, dword [rbp + 0x58]
lea r9, [rbp + 0x60]
mov rbx, rax
mov r8, r14
lea rax, [rbp + 0x48]
mov rcx, r12
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov rcx, rbx
mov r12d, eax
call sym.python310.dll_PyEval_RestoreThread
cmp r12d, 0xea
jne 0x1802230fd
add r15d, r15d
mov rcx, rsi
mov edx, r15d
call sym.python310.dll_PyMem_Realloc
test rax, rax
je 0x1802230f6
mov r12, qword [rbp + 0x50]
mov rsi, rax
mov dword [rbp + 0x48], r15d
mov dword [rbp + 0x60], r13d
jmp 0x180223087
call sym.python310.dll_PyErr_NoMemory
jmp 0x180223159
test r12d, r12d
je 0x180223119
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, r12d
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
mov rdi, rax
jmp 0x180223159
mov r8d, dword [rbp - 0x18]
mov rcx, rsi
mov edx, dword [rbp + 0x48]
call fcn.1800fa53c
mov rbx, rax
test rax, rax
je 0x180223159
mov r9d, dword [rbp - 0x18]
lea rcx, [0x18039689c]
mov r8, rax
mov rdx, r14
call sym.python310.dll__Py_BuildValue_SizeT
sub qword [rbx], 1
mov rdi, rax
jne 0x180223159
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, qword [0x1803fc5f8]
mov rdx, r14
call qword [case.0x180096615.3]
mov rcx, qword [0x1803fc5f8]
mov rdx, rsi
call qword [case.0x180096615.3]
mov rax, rdi
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1802231e8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
lea rcx, str.winreg.ExpandEnvironmentStrings
mov r8, rdx
lea rdx, [0x1802403c8]
call sym.python310.dll_PySys_Audit
xor ebp, ebp
test eax, eax
jns 0x180223222
xor eax, eax
jmp 0x1802232b8
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
jne 0x180223249
xor r8d, r8d
xor edx, edx
mov rcx, qword [sym.python310.dll_PyExc_OSError]
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x1802232b8
mov rcx, rbx
add rcx, rcx
call sym.python310.dll_PyMem_Malloc
mov rdi, rax
test rax, rax
jne 0x180223263
call sym.python310.dll_PyErr_NoMemory
jmp 0x1802232b8
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x18022328d
mov rcx, qword [0x1803fc5f8]
mov rdx, rdi
call qword [case.0x180096615.3]
xor r8d, r8d
mov edx, ebx
jmp 0x18022323b
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], bp
jne 0x180223291
mov rcx, rdi
call sym.python310.dll_PyUnicode_FromWideChar
mov rcx, qword [0x1803fc5f8]
mov rdx, rdi
mov rbx, rax
call qword [case.0x180096615.3]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180223918
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, r8
lea rcx, str.winreg.QueryValue
mov r9, r8
mov r14, rdx
mov r8, rdx
xor r15d, r15d
lea rdx, [0x180240554]
mov dword [rax + 8], r15d
mov qword [rax - 0x28], r15
call sym.python310.dll_PySys_Audit
test eax, eax
jns 0x180223969
xor eax, eax
jmp 0x180223a4f
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
cmp eax, 0xea
jne 0x18022398d
lea ebx, [rax + 0x16]
mov dword [rsp + 0x50], ebx
jmp 0x1802239ab
test eax, eax
je 0x1802239a7
mov edx, eax
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x180223a4f
mov ebx, dword [rsp + 0x50]
mov ecx, ebx
call sym.python310.dll_PyMem_Malloc
mov rdi, rax
test rax, rax
jne 0x1802239d8
call sym.python310.dll_PyErr_NoMemory
jmp 0x180223a4f
add ebx, ebx
mov rcx, rdi
mov edx, ebx
call sym.python310.dll_PyMem_Realloc
test rax, rax
je 0x180223a11
mov rdi, rax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], ebx
mov r8, rax
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov esi, eax
cmp eax, 0xea
je 0x1802239c4
test eax, eax
je 0x180223a23
mov rcx, qword [0x1803fc5f8]
mov rdx, rdi
call qword [case.0x180096615.3]
mov edx, esi
jmp 0x180223993
mov rcx, qword [0x1803fc5f8]
mov rdx, rdi
call qword [case.0x180096615.3]
jmp 0x1802239ba
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], r15w
jne 0x180223a27
mov rcx, rdi
call sym.python310.dll_PyUnicode_FromWideChar
mov rcx, qword [0x1803fc5f8]
mov rdx, rdi
mov rbx, rax
call qword [case.0x180096615.3]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180223cb4
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov esi, dword [rsp + 0x70]
lea r9, [rax + 0x20]
mov rbx, qword [rsp + 0x78]
mov rbp, r8
mov r14, rdx
lea r8, [rax + 8]
mov edx, esi
mov rcx, rbx
call fcn.180221fd8
test eax, eax
jne 0x180223d1c
mov rax, qword [0x18044f1f0]
cmp qword [rax + 0x58], 0
jne 0x180223d15
mov rcx, qword [sym.python310.dll_PyExc_ValueError]
lea rdx, str.Could_not_convert_the_data_to_the_specified_type.
call sym.python310.dll_PyErr_SetString
xor eax, eax
jmp 0x180223dc2
mov qword [rsp + 0x28], rbx
lea rdx, str.nunO
mov r9, rbp
mov qword [rsp + 0x20], rsi
mov r8, r14
lea rcx, str.winreg.SetValue
call sym.python310.dll_PySys_Audit
test eax, eax
jns 0x180223d57
mov rdx, qword [rsp + 0x50]
mov rcx, qword [0x1803fc5f8]
call qword [case.0x180096615.3]
jmp 0x180223d15
call sym.python310.dll_PyEval_SaveThread
mov ecx, dword [rsp + 0x68]
mov r9d, esi
mov rbx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rbx
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov esi, eax
call sym.python310.dll_PyEval_RestoreThread
mov rcx, qword [0x1803fc5f8]
mov rdx, rbx
call qword [case.0x180096615.3]
test esi, esi
je 0x180223db4
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, esi
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x180223dc2
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180223dd8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
cmp r9d, 1
je 0x180223e23
mov rcx, qword [sym.python310.dll_PyExc_TypeError]
lea rdx, str.type_must_be_winreg.REG_SZ
call sym.python310.dll_PyErr_SetString
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x60]
call sym.python310.dll_PyUnicode_AsUnicodeAndSize
mov rsi, rax
test rax, rax
je 0x180223e0e
mov rdi, qword [rsp + 0x60]
mov ecx, edi
cmp rcx, rdi
je 0x180223e59
mov rcx, qword [sym.python310.dll_PyExc_OverflowError]
lea rdx, str.value_is_too_long
jmp 0x180223e09
mov qword [rsp + 0x30], rdi
lea rdx, str.nunu
mov qword [rsp + 0x28], rsi
lea rcx, str.winreg.SetValue
mov r9, rbp
mov qword [rsp + 0x20], 1
mov r8, r14
call sym.python310.dll_PySys_Audit
test eax, eax
js 0x180223e0e
call sym.python310.dll_PyEval_SaveThread
lea ecx, [rdi + 1]
mov r9, rsi
mov dword [rsp + 0x20], ecx
mov r8d, 1
mov rcx, r14
mov rdx, rbp
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov rcx, rbx
mov edi, eax
call sym.python310.dll_PyEval_RestoreThread
test edi, edi
je 0x180223ed1
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, edi
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x180223e10
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
jmp 0x180223e10

Function at 0x180227bec
Capabilities:
Generate random numbers via winapi

Disassembly:
mov r9d, 1
jmp fcn.1800db354

Function at 0x180227bf8
Capabilities:
Generate random numbers via winapi

Disassembly:
mov r9d, 1
jmp fcn.1800db354

Function at 0x18022da60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
lea rdx, [rsp + 0x20]
call sym.python310.dll__Py_fstat_noraise
test eax, eax
jne 0x18022daed
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x7fffffff
jge 0x18022daed
lea eax, [rdx - 1]
cmp eax, 0x3ffff
ja 0x18022daed
movsxd rsi, edx
mov rcx, rsi
call sym.python310.dll_PyMem_Malloc
mov rdi, rax
test rax, rax
je 0x18022daed
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdx, rax
mov rcx, rdi
call sym.python310.dll_PyMarshal_ReadObjectFromString
mov rcx, qword [0x1803fc5f8]
mov rdx, rdi
mov rbx, rax
call qword [case.0x180096615.3]
mov rax, rbx
jmp 0x18022daf5
mov rcx, rbx
call sym.python310.dll_PyMarshal_ReadObjectFromFile
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18022dc14
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
xor r9d, r9d
mov qword [rbp - 0x40], rdx
lea rax, [rbp + 0x20]
mov qword [rbp - 0x34], r9
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x20]
mov dword [rbp - 0x2c], r9d
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x24]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], r9
mov dword [rbp - 4], r9d
mov dword [rbp - 0x38], r9d
mov dword [rbp - 8], r8d
call fcn.1800672cc
mov rcx, qword [rbp - 0x18]
mov edx, 1
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x40]
sub r8, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsp, 0x60
pop rbp
ret

Function at 0x18022dc80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1803e3008]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov ebx, r8d
mov r9d, r8d
mov r8, rcx
mov rsi, rdx
mov rdi, rcx
lea rdx, [0x18023d540]
lea rcx, str.marshal.dumps
call sym.python310.dll_PySys_Audit
test eax, eax
js 0x18022dd5f
and qword [rsp + 0x2c], 0
lea rax, [rsp + 0x60]
and dword [rsp + 0x34], 0
lea rcx, [rsp + 0x20]
and qword [rsp + 0x50], 0
mov edx, ebx
and dword [rsp + 0x5c], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x58], ebx
call fcn.1800f24c4
test eax, eax
jne 0x18022dd5f
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800662b4
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18022dd42
call sym.python310.dll__Py_hashtable_destroy
mov r8, qword [rsp + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x20]
sub r8, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.180181080
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret

Function at 0x18022e1ac
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [r8 + 0x20]
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [r8 + 0x18], rax
jne 0x18022e1df
mov edx, 1
mov rcx, rbx
call fcn.18012edb4
test eax, eax
je 0x18022e1ea
mov rax, qword [rbx + 0x18]
mov byte [rax], dil
inc qword [rbx + 0x18]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18012ed40

Function at 0x18022e9f8
Capabilities:
Get thread local storage value

Disassembly:
lea rcx, [0x18044f1e8]
jmp fcn.1800030f8

Function at 0x180236df8
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmove eax, ecx
add rsp, 0x28
ret
Function at 0x180236e24
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180236ea8
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret