joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000aee0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002bd58]
test rcx, rcx
je 0x14000af1b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000af0e
mov rcx, qword [0x14002bd58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002bd58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002bd68], 0
je 0x14000b00e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140026950]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140034590]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000afef
test al, 0x10
je 0x14000afef
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000af95
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000bed4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bf1e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bf1e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bf1e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bf1e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bf1e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bf20
xor al, al
add rsp, 0x28
ret

Function at 0x14000dd3c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000dbcf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000dbcf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000dbcf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000dbcf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000dbcf
cmp dword [rcx + 0x84], 0xe
jbe 0x14000dbcf
cmp dword [rcx + 0xf8], 0
je 0x14000dbcf
mov ecx, ebx
call fcn.14000dc70
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000da60
cmp dword [rbp + 0x20], 0
je 0x14000dc1c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000dc24
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000db68
Function at 0x14001c4d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001c4f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001c4f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140de3687
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
call fcn.140e1b3a3
mov rbp, qword [rsp + rbx - 0x11]
movsxd r11, r11d
lea rcx, [rdi + rcx*4 + 0x379ce8b2]
mov qword [rsp + rbx - 0x11], 0xffffffffc4bf959c
mov word [rsp + rbx - 0xc], cx
add r10, r11
rol dword [rsp + rbx - 0x10], cl
call fcn.140e0ca96
mov ebx, 0x30ab92bc
ror bx, 0xa1
mov rdx, rsi
mov qword [rbx + rsi - 0x30ab4966], rdx
movzx r11d, bx
sar r11d, 0x91
mov edi, dword [r11 + r9 - 4]
mov ecx, 0x57a21489
ror bx, 0x84
je 0x140e9e6fc
neg edi
sub ax, 0x5413
not edi
setl r8b
sbb edi, r8d
shl r11b, 0xe4
rol edi, 3
push rbp
xor dword [rsp + r8 - 1], edi
dec r8
movsx ebp, ax
pop rbp
movzx ecx, bl
jns 0x140dd97d5
mov rbp, qword [rsp + rdx - 0x89d6]
xor edi, ebp
dec bl
lea rdx, [r11*8 - 0x7ada9970]
bswap edi
movzx r8d, bx
dec edi
shl dl, 0xa6
not edi
inc edi
xadd r11w, bx
push rbp
lea rbp, [rcx*2 - 0x17501f44]
movzx eax, r11b
xor dword [rsp + r11 - 0xe494], edi
pop rbp
sal ebx, 0xe3
movsxd rdi, edi
ja 0x140deadfb
sal r8, cl
adc r10, rdi
lea r8, [rdx + r11*2 - 0x76e60d4b]
mov rcx, qword [r9 + r11 - 0xe4a0]
lea rdx, [rbx*4 + 0x2db18901]
lea r9, [r9 + r11*2 - 0x1c934]
rol r8, 0x54
xor rcx, rbp
dec r8d
call fcn.140e60c52

Function at 0x140df30a8
Capabilities:
Encode data using xor

Disassembly:
xor ebp, ebp
mov qword [rsp], 0x1c8ddab3
test rcx, rcx
lea rsp, [rsp + 0x18]
je 0x140df3133
push r9
mov r9d, 0x10b68b12
movsx ebx, r9b
shr ebx, 0xf1
lea r9, [0x140e5d7c0]
push 0x7c3cde2f
mov ebx, dword [rsp]
movzx ebx, byte [r8 + rbx - 0x7c3cde2f]
xor ebx, ebp
and ebx, 0xff
not dword [rsp + 1]
mov ebx, dword [r9 + rbx*4]
shr ebp, 8
xor ebp, ebx
inc r8
sar qword [rsp], 0xec
xor ebp, 0x400229a
push 0x1d0740af
sal qword [rsp + 8], 0x2c
dec rcx
push 0xffffffffbe221d33
lea rsp, [rsp + 0x18]
jne 0x140df30d6
mov r9d, 0xeb14fc16
mov r10d, r9d
pop r9
mov edx, 0x67b82f1e
mov ebx, edx
mov r8d, edx
not ebp
lea rcx, [rbx*4 - 0x7145165b]
movzx eax, cx
or dx, 0xb10a
mov dword [rdx + rdi - 0x67b8bf1e], ebp
jle 0x140dfb410

Function at 0x140e02382
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rdx - 0x74a24ae4], r11
lea rcx, [rdi + rbx*8 + 0x44899531]
movzx edx, byte [r9 + rbx*4 - 0x480383d]
mov eax, dword [rsp + rbx*2 - 0x2401c1a]
ror r8, 4
dec qword [rsp + rbx - 0x1200e0e]
xor dl, bpl
xadd qword [rsp + rbx - 0x1200e0e], r11
not bl
sub rcx, rcx
ror dl, 1
pop rcx
sar bl, 0x61
xchg al, r11b
sub dl, 0x14
and edi, 0xe2b96b39
sub r8, r11
xadd di, r8w
ror dl, 1
dec dl
not dl
ror ax, cl
or bl, 0xb5
sal edi, 0xfb
ror dl, 1
and r11b, dil
xchg rcx, rdi
dec r8b
xor bpl, dl
add r11d, r11d
lea rcx, [rax*2 + 0xabfc2ac]
movzx r11d, byte [rbx + r9 - 0x1200f03]
ja 0x140e5572a
rol cl, 0x81
xor r11b, bpl
neg r11b
inc r11b
xor r11b, 0x96
neg r11b
dec r11b
or di, 0x4f0c
call fcn.140e64834
Function at 0x140e0bb2e
Capabilities:
Authenticate hmac

Disassembly:
sbb r8, r8
xor dword [rsp + rcx - 0x3c02], eax
mov qword [rsp + rcx - 0x3c12], rcx
dec dl
movzx ebp, r8b
mov rsi, qword [rsp + rcx*2 - 0x7814]
push r8
sets r10b
lea rdi, [rdi + rcx*2 - 0x7828]
mov dword [rdi + rcx*2 - 0x7824], eax
push rcx
xchg ch, cl
sal r8b, 0xc5
lea r9, [r9 + rcx*2 - 0x247c]
lea rbx, [rdx + r10*4 - 0xe65fc6]
movsx eax, dl
sub qword [rsp + rcx - 0x1237], rcx
mov edx, dword [r9 + rcx*4 - 0x48f0]
xor edx, esi
xor edx, 0x8f08d13f
and rbp, r8
lea edx, [r10 + rdx + 0x4765b38a]
xor edx, eax
call fcn.140ded9ee
Function at 0x140e35a11
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rcx, qword [rdi + rdx*2 - 0x40529f18]
inc dl
neg rdx
and dl, dh
mov rbx, qword gs:[rcx + rdx*2 + 0x40529fa0]
movzx r10d, dl
movzx r8d, r10b
push r10
mov qword [rdi + rdx*2 + 0x40529fa0], rbx
movsx ebx, byte [rsp + rdx + 0x20294fd1]
push rdx
or byte [rsp + r10 - 0x28], bl
lea r9, [r9 + rdx*2 + 0x40529f9c]
sub byte [rsp + rdx*2 + 0x40529fab], 0xa1
mov eax, dword [r9 + r10*8 - 0x180]
and r8b, byte [rsp + r10 - 0x2d]
lea rdx, [rbx + rdx + 0x109a522b]
xor eax, esi
movzx ebp, word [rsp + rdx + 0xf8efdad]
rol eax, 1
sal rbp, 0x67
xor eax, 0x5e25aa17
lea rdx, [r8 - 0x70dd86ee]
call fcn.140e4d25f
lea rdi, [rdi + r10 - 0x90]
dec r8d
call fcn.140dfb082
call fcn.140ea4649
push rbp
mov qword [rsp + r10*2 + 2], rsi
ror dx, 0x47
mov esi, 0xc59e758c
xor dword [rsp + r10*2 + 2], eax
xchg dx, bp
lea r8, [rdx + rsi*4 - 0x4874346e]
mov rsi, qword [rsp + r10*2 + 2]
movsxd rax, eax
add r11, rax
sar rbp, 0x2c
mov rdx, qword [rdi + r10*4 - 0xc]
shl r10b, 0x63
lea rax, [rbp - 0x68eae7dc]
mov r8d, dword [rdi + r10*2 - 0x28]
jne 0x140e48461
mov edx, 0x20294f8c
jmp 0x140de55ee
sal dx, 0xce
mov rsi, qword [rsp + rbp - 0x241e4e2b]
ror rax, 0xe6
adc r8, 0xffffffffa3a43ea9
mov dword [rdi + rbp*2 - 0x483c9c6a], ecx
bswap eax
mov edx, dword [rbp + r9 - 0x241e4e3b]
lea r9, [rbp + r9 - 0x241e4e3b]
sub bpl, r8b
xor edx, esi
mov qword [rsp + rax - 0xc4], 0xfffffffff8b2bc0c
movzx ebx, bpl
xor edx, 0x8f08d13f
movsx ecx, r10w
dec qword [rsp + rbp - 0x241e4e82]
lea edx, [rdx + r8 + 0x5c5088e2]
rol r10b, 0xc6
not edx
pop rbp
inc r10w
lea edx, [rdx + r8 + 0x1ed9650f]
sal dword [rsp + rax - 0xc9], 0xe2
jnp 0x140e5451d
mov dword [rdx + r10 - 0x18], r8d
mov qword [rsp + r10*2 - 0x28], r10
xchg dword [rsp + r10 - 0x17], r10d
xor r10b, byte [r9 + r10 - 5]
movsx edx, word [rsp + rbp + 2]
movsx ecx, dl
add rax, rcx
lea r9, [r9 + rbp*2 - 5]
sbb qword [rsp + rbp*2 + 8], rax
xor r10b, sil
jmp 0x140e72b09
movzx ebp, bl
movsxd rdx, edx
xchg ebx, r10d
add r11, rdx
lea rbp, [rsp + r10 + 0x46]
mov ecx, dword [rbp + r10*2 - 0x114]
and r10, rax
mov dword [rdi + r10*2 - 0x118], ecx
inc r8w
movzx ecx, r8b
jno 0x140e07458
mov qword [rsp + rax - 0xcc], rsi
neg r10d
xor dword [rsp + r10 - 0x11c4c3f1], edx
pop rsi
jmp 0x140e4ce65
not edx
xor byte [rsp + rbp*2], dl
inc r10b
pop rbx
rol qword [rsp + rbp*8], 0xee
and bl, 0x9d
ror r10b, 1
call fcn.140e0b2cc
jmp 0x140e20cdd
Function at 0x140e5c033
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rdx - 0x2ef6fc50], rdx
shr ebx, 0x66
movsxd r11, r11d
neg byte [rsp + rbx - 0x2ddb993]
rol qword [rsp + rdx - 0x2ef6fc58], 0xa7
adc dword [rsp + rdx - 0x2ef6fc4e], edx
adc r10, r11
mov ebx, dword [rdx + rsi - 0x2ef6fc5c]
call fcn.140dda2dd
mov qword [rsp + rax*8 - 0x10500], 0x5c872537
xor bp, r11w
lea r11, [rsp + r11 + 0x18]
jmp 0x140e7ca1e
call fcn.140e583d6
neg r11d
mov qword [rsp + rdx*2 - 0x5dedf8b8], rdx
mov qword [rsp + rdx*2 - 0x5dedf8b0], rbp
mov qword [rsp + rdx - 0x2ef6fc60], rdi
xor dword [rsp + rdx - 0x2ef6fc50], r11d
mov rbp, qword [rsp + rdx*2 - 0x5dedf8b0]
jmp 0x140e094f4
lea r9, [r9 + rdi - 0x12227697]
xadd cl, al
jp 0x140e7a12b
jle 0x140e6af51
xor r8d, ebp
movsx r11d, dl
lea rax, [rdi + rbx*2 - 0x40f21ddb]
ror r8d, 2
shl al, 0xe1
jp 0x140e7891d
movzx bx, byte [r11 + rax*2 - 0x4140]
lea rsi, [rsi + rax - 0x20a2]
xor qword [rsp + rax - 0x2090], rcx
xadd byte [rsp + rax - 0x2093], cl
mov word [rsi + rax - 0x20a0], bx
pop rdi
pop rcx
pop r11
jp fcn.140e31de9
mov edi, 0x12227693
mov r11d, dword [rsi + rdi*4 - 0x4889da4c]
mov ecx, dword [rsi + rdi*2 - 0x2444ed22]
mov eax, edi
add r11d, ecx
mov dword [rdi + rsi - 0x1222768f], r11d
lea rbx, [rax*8 + 0x5f225f9c]
xadd bl, ah
movzx edx, al
mov r8d, dword [r9 + rdi*4 - 0x4889da50]
mov ecx, ebx
shr rcx, cl
jbe 0x140e6e4a0

Function at 0x140e62465
Capabilities:
Encode data using base64

Disassembly:
rol r8, 0x1f
ror bl, 0xe3
mov qword [rsp + rdi + 0x5f423a74], rbp
sbb rax, r8
jb 0x140e354df

Function at 0x140e62710
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx - 0x422da24], r11
ret 8
inc dx
mov dword [r8 + rbp*8 - 0x7b808], ebx
cmovge bp, word [rsp + rbp*2 - 0x1edfd]
neg bpl
rol r10w, 0x61
mov r8, qword [rbp + r9 - 0xe]
lea r9, [r9 + rbp*8 - 0xe]
call fcn.140e41d88
xor r8b, 0x91
inc r8b
pop rcx
xor r8b, 2
xor sil, r8b
shl byte [rsp + rbp - 0xf77d], 0xa5
not r10
setne bpl
lea r8, [rsp + r8 + 0x10]
js 0x140e0984e
jmp 0x140e5e20e
or ecx, dword [rsp + rax - 0x28a17940]
mov qword [rdi + rcx*2 - 0x845b448], rbx
pop r8
jge 0x140dcc451
rol r8b, 1
sal bpl, 0xa1
sal cx, 0x83
adc r8b, 0x1e
rol rbp, cl
sar dword [rsp + rbp - 0xf780], cl
jne 0x140e269d1
movzx r8d, byte [rsp + rax*2 - 0x5142f284]
shl qword [rsp + rax - 0x28a17940], 0x98
adc rbx, rbp
jmp 0x140e39032
shr rdx, 0xf8
add ebx, dword [rdi + rbp*8 - 0x87c]
mov qword [rsp + rbp - 0x110], 0x3f9bf49b
not bpl
movzx r8d, byte [r9 + rbp - 0x1f5]
xadd cx, dx
dec qword [rsp + rbp - 0x1e7]
mov qword [rsp + rbp - 0x1df], 0xffffffff9f33620b
xor r8b, sil
add cl, 0x18
sal rbp, cl
sal cx, 0xe1
inc r8b
movzx r10d, dl
jmp 0x140e31ca7

Function at 0x140e86c19
Capabilities:
Authenticate hmac

Disassembly:
movsx ecx, bl
ror r10d, 3
xor r10d, 0xb52325a5
call fcn.140e5390a
Function at 0x140e89ed1
Capabilities:
Manually build aes constants

Disassembly:
not ebx
shl cl, 5
rol rdx, cl
not r10
bswap ebx
rol ebx, 1
not al
ror ebp, 0x1a
push rsi
shl r10, 0x1b
xor dword [rsp + rax*2 - 0x56b8], ebx
inc r10
shr rax, 0x5c
pop rsi
cmovae r8w, cx
movsxd rbx, ebx
sub ax, cx
call fcn.140ea9def
adc cl, 0x96
mov qword [rsp], r8
push rbx
xor edx, 0xc385ce9b
xor bpl, cl
lea rcx, [rsp + rcx + 0x28]
or dword [rsp + rdx - 0x5085ce89], edi
setl byte [rsp + rdx - 0x5085ce8b]
call fcn.140de7449
mov ebp, 0xba3bb700
mov r8d, ebp
mov r10, qword [rdi]
rol ebp, 0x8c
movzx edx, bp
mov dl, byte [rdx + rdi - 0xb9b]
movzx ebx, bp
movzx eax, r8b
lea rdi, [rdi + rbx*4 - 0x2e82]
sal rbx, 0x33
setae al
movsx ecx, bp
mov byte ss:[r10 + rax - 1], dl
mov edx, ebp
ror ax, cl
adc rax, rcx
lea r9, [rax + r9 - 0x2ba7]
add ebx, dword [rax + r9 - 0x2ba3]
mov r10d, ecx
xor ebx, esi
xor ebx, 0x70106c9f
xor r8, rcx
setle r8b
jno 0x140e16415

Function at 0x140e9b596
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0xffffffffc52b592d
dec ebx
push 0xfffffffff71bf405
lea rsp, [rsp + 0x10]
jne 0x140e178b3
Function at 0x140c22058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c221df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c22089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c2206f
add dl, dl
jne 0x140c22096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c220f6
xor eax, eax
add dl, dl
jne 0x140c220a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c221ad
add dl, dl
jne 0x140c220b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c220c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c220d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c220dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c220ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c2207e
mov eax, 1
add dl, dl
jne 0x140c22106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c22113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c220fb
sub eax, ebx
mov ebx, 1
jne 0x140c2214c
mov ecx, 1
add dl, dl
jne 0x140c2212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c2213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c22123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c2207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c22168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c22175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c2215d
cmp eax, 0x7d00
jae 0x140c2219b
cmp eax, 0x500
jb 0x140c22196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c2207e
cmp eax, 0x7f
ja 0x140c2219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c2207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c221d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c2207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1401e85f0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10088
call fcn.14021ac70
sub rsp, rax
mov rax, qword [0x14025a700]
xor rax, rsp
mov qword [rsp + 0x10070], rax
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.1402156e0
mov r8d, 0x10000
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1401e866d
lea rcx, [rsp + 0x70]
call fcn.14022a420
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.14021ac40
add rsp, 0x10088
ret
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.14021ac40
add rsp, 0x10088
ret

Function at 0x1401e8720
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14025a700]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [0x140239470]
call fcn.1401e85f0
xor edi, edi
mov qword [0x14026c0f0], rax
lea rdx, [0x140239470]
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x20]
lea r8d, [rdi + 0x28]
call fcn.1402156e0
lea rdx, [0x140239478]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.1401e85f0
mov cl, 1
mov qword [0x14026c0f8], rax
call fcn.140216890
lea r8d, [rdi + 0x28]
mov word [rsp + 0x20], di
lea rdx, str.PYTHONHOME
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.1402156e0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov cl, 1
call fcn.140216890
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14021ac40
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x1401e8cb0
Capabilities:
Set environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14025a700]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rsi, rdx
mov rbp, rcx
call fcn.1401fd960
lea rdx, str.environ
mov rcx, rax
call qword [sym.imp.python311.dll_PyObject_GetAttrString]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.python311.dll_PyUnicode_FromString]
mov rdx, rsi
lea rcx, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.1402156e0
lea rcx, [rsp + 0x20]
test r14, r14
je 0x1401e8d73
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, r14
call sub.python311.dll_PyUnicode_FromWideChar
mov r8, rax
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.python311.dll_PyObject_SetItem]
test eax, eax
je 0x1401e8d61
mov ecx, 1
call qword [sym.imp.python311.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python311.dll_Py_Exit]
int3
sub qword [rsi], 1
jne 0x1401e8d93
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1401e8d93
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.python311.dll_PyObject_DelItem]
test eax, eax
je 0x1401e8d93
mov rcx, rbp
call fcn.1400f9500
sub qword [rdi], 1
jne 0x1401e8da3
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
sub qword [rbx], 1
jne 0x1401e8db3
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14021ac40
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140215790
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
test edx, edx
je 0x140215854
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub r9, 1
jne 0x1402157b0
not eax
ret
Function at 0x14021b6a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14021b6ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14021b6ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14021b6ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14021b6ee
cmp dword [rcx + 0x84], 0xe
jbe 0x14021b6ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14021b6f0
xor al, al
add rsp, 0x28
ret

Function at 0x14021e9cc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14021e85f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14021e85f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14021e85f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14021e85f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14021e85f
cmp dword [rcx + 0x84], 0xe
jbe 0x14021e85f
cmp dword [rcx + 0xf8], 0
je 0x14021e85f
mov ecx, ebx
call fcn.14021e900
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14021e6f0
cmp dword [rbp + 0x20], 0
je 0x14021e8ac
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14021e8b4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14021e7f8
Function at 0x1402347c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1402347e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1402347e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret