joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Hl_toperaciones_tyomama_tproducts_tebiz_tbannerad_tuploadsuser_tanime_tphotoalbum_tpub_tstile_ttestsearch_tlinkman_tkristi_tclipper_tkgb_ttrebor_ttier_tdwg_tangerine_tcompanysearch_txtcommerce_tkindeditor_tavia_tconvergelocal_tfaith_trose_tski_tguestbook_tempresa_ttemplatefiles_tlanguage_tscriptlibrary_tmonica_tiecssfix_tscuba_tdns_thotcock_tcams_tuserads_toverlib_tinterim_twebstorecpanel_tphoenix_thotelclient_tcatinfo_tfonds_tcpm_tmn_tadimg_tintroductions_twireframe_tomniture_tskinacp_tResearch_tmce
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
add r11d, 6
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0xc]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140005cf0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x4001b
mov dword [rbp - 0x1c], 0x3006c
mov dword [rbp - 0x18], 0x56001c
mov dword [rbp - 0x14], 0x4f0040
mov dword [rbp - 0x10], 0x50007
mov dword [rbp - 0xc], 0x6e0003
call fcn.140002e40
mov rcx, rax
call rbx
mov rbx, qword [0x1400171c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400171a0], rax
mov dword [rbp - 0x20], 0x5001f
mov dword [rbp - 0x1c], 0x60067
mov dword [rbp - 0x18], 0x1e
mov dword [rbp - 0x14], 0x4f0006
mov dword [rbp - 0x10], 0x50007
mov dword [rbp - 0xc], 0x6e0003
call fcn.140002e40
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140015970]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400171b0], rax
mov word [rbp - 0x10], 0x3a19
mov byte [rbp - 0xe], 0x61
call fcn.140005220
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x36c041b
mov dword [rbp - 0x1c], 0x40a201c
mov dword [rbp - 0x18], 0xb1b1c00
mov word [rbp - 0x14], 0x7332
call fcn.140001180
mov rcx, qword [0x1400171a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140017130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xa7d0201
mov dword [rbp - 0x1c], 0x15170b02
mov dword [rbp - 0x18], 0xa192c
mov word [rbp - 0x14], 0x7324
call fcn.140001180
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400159c0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e8], rax
mov byte [rbp - 0x10], 0x6f
call fcn.140004e60
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015910]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170f0], rax
mov dword [rbp - 0x10], 0x6d04010b
call fcn.1400029f0
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015950]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170e0], rax
mov byte [rbp - 0x10], 0x6f
call fcn.140004e60
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400158b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400170d8], rax
mov dword [rbp - 0x10], 0x2c0f0206
mov byte [rbp - 0xc], 0x61
call fcn.140003790
mov rcx, qword [0x1400171b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400158f0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140017130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2c01
mov byte [rbp - 0xe], 0x61
call fcn.140005220
mov rcx, qword [0x1400171b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x14000a2b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000a312
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000c730
test al, al
jne 0x14000a324
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000a2e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6f
mov dword [rbp - 0x20], 0x290003
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x21005b
mov dword [rbp - 0x18], 0x290035
mov dword [rbp - 0x14], 0x200030
mov dword [rbp - 0x10], 0x2c0030
call fcn.140005e60
mov rcx, rax
call 0x14000a2b0
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x63
mov dword [rbp - 0x20], 0x290003
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x21005b
mov dword [rbp - 0x18], 0x290035
mov dword [rbp - 0x14], 0x530041
call fcn.140002590
mov rcx, rax
call 0x14000a2b0
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x180026
mov dword [rbp - 0x1c], 0x3006d
mov dword [rbp - 0x18], 0x65001c
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000a2b0
Function at 0x14000b950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000bb7e
mov word [rbp + 0x50], 0x6c48
mov word [rbp + 0x58], 0x6c48
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000ba04
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000b9f0
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000ba35
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000ba20
cmp rdi, rbx
jne 0x14000bb52
mov r13, rsi
mov word [rbp - 0x50], 0x6c48
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000ba76
lea rcx, [rbp - 0x50]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000ba62
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000bb78
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x6c0029
call fcn.1400027f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000bae8
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x6c0032
call fcn.1400027f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000bae8
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x6c0029
mov dword [rbp - 0x42], 0x6c0009
call fcn.1400027f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x6c0029
call fcn.1400027f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000bb45
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x6c0032
call fcn.1400027f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000bb45
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x6c0029
mov dword [rbp - 0x32], 0x6c0009
call fcn.1400027f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000bb52
inc r14
jmp 0x14000ba50
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000bb7e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000b9c0
mov rax, qword [rbp - 8]
jmp 0x14000bb80
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000a312
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000c730
test al, al
jne 0x14000a324
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000a2e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6f
mov dword [rbp - 0x20], 0x290003
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x21005b
mov dword [rbp - 0x18], 0x290035
mov dword [rbp - 0x14], 0x200030
mov dword [rbp - 0x10], 0x2c0030
call fcn.140005e60
mov rcx, rax
call 0x14000a2b0
mov qword [0x1400171b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x63
mov dword [rbp - 0x20], 0x290003
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x21005b
mov dword [rbp - 0x18], 0x290035
mov dword [rbp - 0x14], 0x530041
call fcn.140002590
mov rcx, rax
call 0x14000a2b0
lea rcx, [rbp - 0x20]
mov qword [0x1400171a8], rax
mov dword [rbp - 0x20], 0x180026
mov dword [rbp - 0x1c], 0x3006d
mov dword [rbp - 0x18], 0x65001c
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000a2b0
Function at 0x1406d80b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406d8237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406d80e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d80c7
add dl, dl
jne 0x1406d80ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d814e
xor eax, eax
add dl, dl
jne 0x1406d80fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406d8205
add dl, dl
jne 0x1406d810e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d811b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d8128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d8135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406d8142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406d80d6
mov eax, 1
add dl, dl
jne 0x1406d815e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406d816b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d8153
sub eax, ebx
mov ebx, 1
jne 0x1406d81a4
mov ecx, 1
add dl, dl
jne 0x1406d8186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406d8193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d817b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d80d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406d81c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406d81cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406d81b5
cmp eax, 0x7d00
jae 0x1406d81f3
cmp eax, 0x500
jb 0x1406d81ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d80d6
cmp eax, 0x7f
ja 0x1406d81f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406d80d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406d822a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406d80d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001bcd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.14001fbf0
sub rsp, rax
mov rax, qword [0x14005aa20]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x14001bd92
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14001bd3d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14001bd30
cmp rcx, 1
jb 0x14001bdea
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14001bd60
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14002e9dc
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14001bd20
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14001bdc3
lea rcx, [rsp + 0x80]
call fcn.140031818
jmp 0x14001bdc5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14001f920
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14002e788
int3
Function at 0x14001f410
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14005aa20]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x14001f4b5
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14001f46d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14001f460
cmp rcx, 1
jb 0x14001f4e6
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14001f483
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14002e9dc
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14001f450
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14001f920
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.14002e788
int3
Function at 0x14001f5f0
Capabilities:
Set environment variable

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0xb0
mov rax, qword [0x14005aa20]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x14005c680]
mov rbp, r8
mov rsi, rdx
mov r14, rcx
test rax, rax
jne 0x14001f640
lea rcx, [0x14003ec74]
call qword [sym.imp.python310.dll_PyImport_ImportModule]
mov qword [0x14005c680], rax
test rax, rax
je 0x14001f87a
mov qword [rsp + 0xa8], rbx
lea rdx, str.environ
mov qword [rsp + 0xa0], rdi
mov rcx, rax
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x90], r15
call qword [sym.imp.python310.dll_PyObject_GetAttrString]
mov rcx, rsi
mov r15, rax
call qword [sym.imp.python310.dll_PyUnicode_FromString]
movzx edx, byte [rsi]
lea rbx, [rsp + 0x30]
xor ecx, ecx
mov r13, rax
mov word [rsp + 0x30], cx
lea edi, [rcx + 0x28]
test rbp, rbp
je 0x14001f776
test dl, dl
je 0x14001f712
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14001f6bd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14001f6b0
cmp rcx, 1
jb 0x14001f880
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14001f6e0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14002e9dc
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14001f6a0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, rbp
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov rdx, r13
mov rcx, r15
mov r8, rax
mov rbx, rax
call qword [sym.imp.python310.dll_PyObject_SetItem]
test eax, eax
je 0x14001f75d
mov ecx, 1
call qword [sym.imp.python310.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python310.dll_Py_Exit]
int3
sub qword [rbx], 1
jne 0x14001f817
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x14001f817
test dl, dl
je 0x14001f7f2
nop word [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14001f79d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14001f790
cmp rcx, 1
jb 0x14001f874
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14001f7c0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14002e9dc
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14001f780
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.python310.dll_PyObject_DelItem]
test eax, eax
je 0x14001f817
mov rcx, r14
call fcn.14000d390
sub qword [r13], 1
jne 0x14001f828
mov rax, qword [r13 + 8]
mov rcx, r13
call qword [rax + 0x30]
sub qword [r15], 1
jne 0x14001f838
mov rax, qword [r15 + 8]
mov rcx, r15
call qword [rax + 0x30]
mov r13, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14001f920
add rsp, 0xb0
pop r14
pop rsi
pop rbp
ret
call fcn.14002e788
int3
call fcn.14002e788
int3
call fcn.14002e788
int3
Function at 0x140020368
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400203b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400203b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400203b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400203b2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400203b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400203b4
xor al, al
add rsp, 0x28
ret

Function at 0x140024ecc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140024d2b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140024d2b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140024d2b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140024d2b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140024d2b
cmp dword [rcx + 0x84], 0xe
jbe 0x140024d2b
cmp dword [rcx + 0xf8], 0
je 0x140024d2b
mov ecx, ebx
call fcn.140024de8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140024bb8
nop
cmp dword [rbp + 0x20], 0
je 0x140024d79
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140024d84
int3
xor r8d, r8d
xor edx, edx
jmp 0x140024cbc
Function at 0x1400368c4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003694b
mov rsi, rbx
cmp word [rax], bp
je 0x14003690a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400368f4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400368f0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140031904
mov rdi, rax
test rax, rax
je 0x140036938
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020710
mov rbp, rdi
xor ecx, ecx
call fcn.1400326dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret