joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140122c90
Capabilities:
Create service
Delete service
Start service

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x70
mov r14, r9
mov r12, r8
xor bpl, bpl
xor r15b, r15b
call fcn.140122b00
mov ebx, eax
add eax, 0x3ffffff2
cmp eax, 0x2c
ja 0x140122e8e
movabs rcx, 0x104000000003
bt rcx, rax
jae 0x140122e8e
mov qword [rsp + 0xa0], rsi
xor edx, edx
mov qword [rsp + 0xa8], rdi
xor ecx, ecx
mov qword [rsp + 0xb0], r13
mov r13d, 1
mov r8d, r13d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140122d5f
lea r8d, [r13 + 0xf]
mov rcx, rax
lea rdx, str.KDeltrixHacker3
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140122d49
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movzx ebp, bpl
mov rcx, rdi
test eax, eax
cmovne ebp, r13d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bpl, bpl
jne 0x140122e4b
mov rcx, r12
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
je 0x140122e76
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140122e76
lea rax, [0x140192200]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
lea r8, str.KDeltrixHacker3
xor eax, eax
lea rdx, str.KDeltrixHacker3
mov qword [rsp + 0x58], rax
mov rcx, rsi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x140122e25
mov rcx, rax
movzx r15d, r13b
call fcn.140123150
test r14, r14
je 0x140122e08
mov rdx, r14
call fcn.140122ea0
mov ebx, eax
test eax, eax
js 0x140122e61
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x140122e25
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140122e4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140122e3d
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bpl, bpl
je 0x140122e57
nop dword [rax + rax]
call fcn.140122b00
mov ebx, eax
test r15b, r15b
je 0x140122e76
test rdi, rdi
je 0x140122e76
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r13, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov eax, ebx
add rsp, 0x70
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
Function at 0x1401232d0
Capabilities:
Create service
Delete service
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rsi, r8
mov rdi, rdx
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x140123325
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x14012341d
movzx eax, ax
or eax, 0xc0070000
jmp 0x14012341d
lea rax, [0x140192200]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
lea r8, str.KDeltrixHacker3
mov qword [rsp + 0x58], rbx
lea rdx, str.KDeltrixHacker3
mov qword [rsp + 0x50], rbx
mov rcx, rbp
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x1401233fb
mov rcx, rax
call fcn.140123150
nop dword [rax + rax]
test rsi, rsi
je 0x1401233b8
mov rdx, rsi
call fcn.140122ea0
mov ebx, eax
test eax, eax
jns 0x1401233b8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140123412
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1401233f0
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1401233e7
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140123412
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140123412
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140123409
mov ebx, eax
jmp 0x140123412
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140123440
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14012348c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140123518
movzx eax, ax
or eax, 0xc0070000
jmp 0x140123518
mov r8d, 0x10020
mov qword [rsp + 0x60], rdi
lea rdx, str.KDeltrixHacker3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1401234f3
lea r8, ds:[rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1401234e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1401234e8
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140123508
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140123508
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140161390
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0xcca058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00cca1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xcca089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xcca06f
add dl, dl
jne 0xcca096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xcca0f6
xor eax, eax
add dl, dl
jne 0xcca0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xcca1ad
add dl, dl
jne 0xcca0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcca0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcca0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcca0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xcca0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xcca07e
mov eax, 1
add dl, dl
jne 0xcca106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcca113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xcca0fb
sub eax, ebx
mov ebx, 1
jne 0xcca14c
mov ecx, 1
add dl, dl
jne 0xcca12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcca13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xcca123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xcca07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcca168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcca175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xcca15d
cmp eax, 0x7d00
jae 0xcca19b
cmp eax, 0x500
jb 0xcca196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xcca07e
cmp eax, 0x7f
ja 0xcca19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xcca07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xcca1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xcca07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001da0
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0xc8]
call fcn.140002950
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140002930
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 1
mov rcx, qword [rsp + 0x88]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x140001e57
lea rdx, [0x140027fe0]
mov rcx, qword [rsp + 0xc0]
call fcn.140002810
mov eax, dword [rsp + 0x78]
or eax, 1
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0xc0]
jmp 0x140001f71
mov eax, dword [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140002e50
nop
lea rcx, [rsp + 0x40]
call fcn.140002f40
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140002950
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140002930
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x90]
mov r9, rcx
mov r8d, 1
mov rcx, qword [rsp + 0x98]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x140001f13
lea rdx, [0x140027fe1]
mov rcx, qword [rsp + 0xc0]
call fcn.140002810
mov eax, dword [rsp + 0x78]
or eax, 1
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x40]
call fcn.140002eb0
mov rax, qword [rsp + 0xc0]
jmp 0x140001f71
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140002f10
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140002ee0
mov rcx, qword [rsp + 0xa0]
mov r8, qword [rcx]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0xc0]
call fcn.140007e40
mov eax, dword [rsp + 0x78]
or eax, 1
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x40]
call fcn.140002eb0
mov rax, qword [rsp + 0xc0]
add rsp, 0xb8
ret
Function at 0x140001f80
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x1068
call fcn.1400141e0
sub rsp, rax
mov rax, qword [0x14002d0d0]
xor rax, rsp
mov qword [rsp + 0x1058], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.WinInetExample
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x1048], rax
cmp qword [rsp + 0x1048], 0
jne 0x140001fe3
xor al, al
jmp 0x140002100
mov rcx, qword [rsp + 0x1070]
call fcn.140002930
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x1048]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rsp + 0x1040], rax
cmp qword [rsp + 0x1040], 0
jne 0x140002040
mov rcx, qword [rsp + 0x1048]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
jmp 0x140002100
mov rcx, qword [rsp + 0x1078]
call fcn.140002930
lea rdx, [0x140027ff8]
mov rcx, rax
call fcn.14000a500
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140002089
mov rcx, qword [rsp + 0x1040]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x1048]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
jmp 0x140002100
lea r9, [rsp + 0x1050]
mov r8d, 0x1000
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x1040]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400020d8
cmp dword [rsp + 0x1050], 0
je 0x1400020d8
mov eax, dword [rsp + 0x1050]
mov r9, qword [rsp + 0x30]
mov r8d, eax
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.14000a70c
jmp 0x140002089
mov rcx, qword [rsp + 0x30]
call fcn.14000a908
mov rcx, qword [rsp + 0x1040]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x1048]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x1058]
xor rcx, rsp
call fcn.140009cb0
add rsp, 0x1068
ret
Function at 0x14000ac47
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14002d0d0]
jne 0x140009cca
rol rcx, 0x10
test cx, 0xffff
jne 0x140009cc6
repz ret
ror rcx, 0x10
jmp 0x14000aba0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14002f060]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14002f158]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000ac25
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14002f060]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000ac47
mov rax, qword [rsp + 0x88]
mov qword [0x14002f158], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14002f0f8], rax
mov rax, qword [0x14002f158]
mov qword [0x14002efd0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14002f0e0], rax
mov dword [0x14002efc0], 0xc0000409
mov dword [0x14002efc4], 1
mov rax, qword [0x14002d0d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14002d0d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14002f058], eax
mov ecx, 1
call fcn.14000ef50
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400244b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14002f058], 0
jne 0x14000acce
mov ecx, 1
call fcn.14000ef50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14000bc14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x14000bc3e
call fcn.14000af6c
and dword [rax], 0
call fcn.14000af4c
mov ebx, 0x16
mov dword [rax], ebx
call fcn.14000aee4
mov eax, ebx
jmp 0x14000bc8e
test edx, 0xfffffff9
jne 0x14000bc21
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000bc67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000af8c
call fcn.14000af4c
mov eax, dword [rax]
jmp 0x14000bc8e
test al, 0x10
jne 0x14000bc8c
test al, 1
je 0x14000bc8c
test bl, 2
je 0x14000bc8c
call fcn.14000af6c
mov dword [rax], 5
call fcn.14000af4c
mov dword [rax], 0xd
jmp 0x14000bc5e
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14000e16c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000dfdc
Function at 0x140014ca8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14002d0d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000c1b8
xor ebx, ebx
cmp qword [0x140030018], rbx
mov rdi, rax
jne 0x140014dbb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140014e92
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014e92
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140030018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140030020], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140030028], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140030038], rax
test rax, rax
je 0x140014db2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140030030], rax
jmp 0x140014dc2
mov rax, qword [0x140030030]
jmp 0x140014dc9
mov rax, qword [0x140030030]
mov r11, qword [0x140030038]
cmp rax, rdi
je 0x140014e30
cmp r11, rdi
je 0x140014e30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140030038]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140014e30
test rax, rax
je 0x140014e30
call rsi
test rax, rax
je 0x140014e2a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140014e2a
test byte [rsp + 0x40], 1
jne 0x140014e30
bts ebp, 0x15
jmp 0x140014e70
mov rcx, qword [0x140030020]
cmp rcx, rdi
je 0x140014e70
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140014e70
call rax
mov rbx, rax
test rax, rax
je 0x140014e70
mov rcx, qword [0x140030028]
cmp rcx, rdi
je 0x140014e70
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140014e70
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140030018]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140014e92
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140014e94
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140009cb0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400b8500]
mov dword [rax], 1
mov rax, qword [0x1400b8510]
mov dword [rax], 1
mov rax, qword [0x1400b8520]
mov dword [rax], 1
mov rax, qword [0x1400b8480]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400192a0
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140093100
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x140019365
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400a4012
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x140019346
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140019338
test rsi, rsi
je 0x1400a4012
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x1400192f8
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140019394
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400193b0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x14001946d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400a4018
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14001944e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140019440
test rsi, rsi
je 0x1400a4018
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x140019400
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140038270
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, qword [0x1400c9230]
mov rsi, rcx
test rbx, rbx
je 0x1400382f0
mov rax, qword [0x1400b8630]
mov rcx, qword [rax + 0x48]
cmp rbx, rcx
je 0x1400382e0
mov rdx, qword [0x1400c9468]
test rdx, rdx
je 0x1400383e0
mov rcx, rbx
mov rbx, qword [sym.imp.python312.dll_PyNumber_InPlaceAdd]
call rbx
mov rcx, rax
mov rdx, rsi
mov rax, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rbx, qword [sym.imp.python312.dll_PyNumber_InPlaceAdd]
jmp 0x1400382c1
lea r15, str.NUITKA_ONEFILE_BINARY
mov rcx, r15
call fcn.1400192a0
test rax, rax
je 0x140038400
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r13, r14
lea r12, [r15 + 0x28]
mov word [rsp + 0x40], cx
lea rbp, [rsp + 0x3a]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov eax, 0x4e
nop
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, r15
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400a40b2
cmp word [r13], 0
movzx edx, word [rsp + 0x3c]
mov rax, r13
je 0x14003838e
nop word [rax + rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x140038380
test rbx, rbx
je 0x1400a40b2
mov word [rax], dx
add r15, 1
xor edx, edx
add r13, 2
mov word [rax + 2], dx
movzx eax, byte [r15]
test al, al
jne 0x140038340
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call qword [sym.imp.python312.dll_PyThreadState_Get]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.140038100
mov rbx, rax
mov qword [0x1400c9230], rbx
jmp 0x140038292
lea rcx, [0x1400b4b52]
call qword [sym.imp.python312.dll_PyUnicode_FromString]
mov qword [0x1400c9468], rax
mov rdx, rax
jmp 0x1400382b2
mov rbx, qword [0x1400c9248]
test rbx, rbx
jne 0x1400383d1
cmp byte [0x1400c9462], 0
je 0x140038443
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400c9260]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
mov qword [0x1400c9248], rax
mov rbx, rax
test rax, rax
je 0x14003844f
mov eax, dword [rax]
add eax, 1
je 0x1400383d1
mov dword [rbx], eax
jmp 0x1400383d1
mov ecx, 1
call fcn.140019f20
jmp 0x140038415
call qword [sym.imp.python312.dll_PyErr_Print]
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
call sub.msvcrt.dll_abort
nop