joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a304c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1401a2d65
call fcn.140192894
mov dword [rax], 0x16
call fcn.140192758
jmp 0x1401a2ec1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
mov ebp, 1
test bpl, al
je 0x1401a2ec1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test bpl, al
jne 0x1401a2ec1
mov eax, dword [rcx + 0x14]
shr eax, 1
test bpl, al
je 0x1401a2d9c
lock or dword [rcx + 0x14], 0x10
jmp 0x1401a2ec1
lock or dword [rcx + 0x14], ebp
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1401a2daf
call fcn.1401a3838
mov r14d, dword [rbx + 0x10]
cmp r14d, ebp
jne 0x1401a2dc0
mov rax, qword [rbx]
mov r15b, byte [rax]
jmp 0x1401a2dc3
xor r15b, r15b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.14019ada8
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.140196648
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1401a2eaf
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1401a2e56
mov rcx, rbx
call fcn.14019ada8
cmp eax, 0xffffffff
je 0x1401a2e41
mov rcx, rbx
call fcn.14019ada8
cmp eax, 0xfffffffe
je 0x1401a2e41
mov rcx, rbx
call fcn.14019ada8
movsxd rdi, eax
lea rsi, [0x1402402c0]
mov rcx, rbx
sar rdi, 6
call fcn.14019ada8
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1401a2e48
lea rdx, [0x140237410]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401a2e56
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1401a2e7c
mov eax, dword [rbx + 0x14]
shr eax, 6
test bpl, al
je 0x1401a2e7c
mov eax, dword [rbx + 0x14]
shr eax, 8
test bpl, al
jne 0x1401a2e7c
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp r14d, ebp
jne 0x1401a2e97
movzx ecx, byte [rdx]
shl cx, 8
movzx eax, r15b
or cx, ax
dec dword [rbx + 0x10]
jmp 0x1401a2ea3
movzx ecx, word [rdx]
mov ebp, 2
add dword [rbx + 0x10], 0xfffffffe
lea rax, [rdx + rbp]
mov qword [rbx], rax
movzx eax, cx
jmp 0x1401a2ec6
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
jmp 0x1401a2d30
Function at 0x1401a7164
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1401a29b8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1401a29b8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1401a72b4
cmp rax, 0xffffffffffffffff
je 0x1401a72b4
xor edi, edi
test rbp, rbp
jle 0x1401a725f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14019b5f0
mov rbx, rax
test rax, rax
jne 0x1401a71ec
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1401a7255
mov edx, 0x8000
mov ecx, r14d
call fcn.140199864
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14019851c
cmp eax, 0xffffffff
je 0x1401a7235
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1401a71fc
mov edx, r15d
mov ecx, r14d
call fcn.140199864
jmp 0x1401a7255
cmp byte [rsi + 0x38], dil
je 0x1401a724c
cmp dword [rsi + 0x34], 5
jne 0x1401a724c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1401a7255
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14019a95c
jmp 0x1401a72c8
jns 0x1401a72c8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1401a29b8
cmp rax, 0xffffffffffffffff
jne 0x1401a7280
cmp byte [rsi + 0x30], dil
je 0x1401a72c8
mov edi, dword [rsi + 0x2c]
jmp 0x1401a72c8
mov ecx, r14d
call fcn.1401a26d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1401a72c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1401a72c8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1401a72c1
mov eax, dword [rsi + 0x2c]
jmp 0x1401a72c6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1401a29b8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x1400112ee
Capabilities:
Terminate process

Disassembly:
jmp 0x140015c20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400113c0
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016f70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016f90
xor al, al
jmp 0x140017011
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016fa3
xor al, al
jmp 0x140017011
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140016fcd
xor al, al
jmp 0x140017011
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016fe1
xor al, al
jmp 0x140017011
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016ff3
xor al, al
jmp 0x140017011
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001700f
xor al, al
jmp 0x140017011
mov al, 1
add rsp, 0x38
ret
Function at 0x140014e50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011555
movzx eax, al
test eax, eax
jne 0x140014e70
mov ecx, 7
call fcn.140011497
nop
mov byte [rsp + 0x20], 0
call fcn.1400114ab
mov byte [rsp + 0x21], al
cmp dword [0x140021868], 1
jne 0x140014e94
mov ecx, 7
call fcn.140011497
nop
jmp 0x140014eec
cmp dword [0x140021868], 0
jne 0x140014ee7
mov dword [0x140021868], 1
lea rdx, [0x14001d660]
lea rcx, [0x14001d330]
call fcn.14001128a
test eax, eax
je 0x140014ec8
mov eax, 0xff
jmp 0x140014ff1
lea rdx, [0x14001d220]
lea rcx, [section..rdata]
call fcn.1400114a1
mov dword [0x140021868], 2
jmp 0x140014eec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001147e
call fcn.1400113ed
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140014f49
mov rcx, qword [rsp + 0x30]
call fcn.14001121c
movzx eax, al
test eax, eax
je 0x140014f49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140028020]
nop
call fcn.140011433
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140014f7d
mov rcx, qword [rsp + 0x38]
call fcn.14001121c
movzx eax, al
test eax, eax
je 0x140014f7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011505
nop
call fcn.1400150a0
mov dword [rsp + 0x28], eax
call fcn.1400113c0
movzx eax, al
test eax, eax
jne 0x140014f9c
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140014fab
call fcn.14001150f
nop
xor edx, edx
mov cl, 1
call fcn.140011208
mov eax, dword [rsp + 0x28]
jmp 0x140014ff1
add rsp, 0x68
ret

Function at 0x1400018f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001942
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001942
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001942
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001942
cmp dword [rcx + 0x84], 0xe
jbe 0x140001942
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001944
xor al, al
add rsp, 0x28
ret
Function at 0x1800027ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
test rcx, rcx
je 0x18000283f
movsxd rax, dword [rcx + 0x3c]
mov esi, dword [rcx + rax + 0x88]
add rsi, rcx
mov eax, dword [rsi + 0x18]
mov r8d, dword [rsi + 0x20]
test eax, eax
je 0x18000283f
movzx ebx, byte [rdx]
lea ebp, [rax - 1]
xor eax, eax
lea rdi, [rcx + r8]
mov r9d, dword [rdi + rax*4]
cmp byte [rcx + r9], bl
jne 0x180002814
test bl, bl
je 0x180002822
lea r11, [rcx + r9]
xor r8d, r8d
jmp 0x180002802
test r10b, r10b
je 0x180002822
lea r9d, [r8 + 1]
movzx r10d, byte [r11 + r9]
mov r8, r9
cmp r10b, byte [rdx + r9]
je 0x1800027fd
lea r8, [rax + 1]
cmp rbp, rax
je 0x18000283f
mov rax, r8
jmp 0x1800027df
mov edx, dword [rsi + 0x24]
lea rax, [rcx + rax*2]
movzx edx, word [rax + rdx]
mov eax, dword [rsi + 0x1c]
lea rdx, [rcx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rcx
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x18000284d
Capabilities:
Access peb ldr_data
Get file size
Read file on windows
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
movaps xmmword [rsp + 0xc0], xmm6
mov r11d, dword [0x1803e7dc4]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
lea r10, [rax + 0x10]
cmp r10, r8
je 0x1800028cd
test r11d, r11d
je 0x1800028d1
mov rdx, qword [r8 + 0x60]
movzx eax, word [rdx]
test ax, ax
je 0x1800028c5
add rdx, 2
xor ecx, ecx
lea r9d, [rax - 0x41]
cmp r9w, 0x19
ja 0x1800028b1
add eax, 0x20
movzx eax, ax
add rdx, 2
add ecx, eax
movzx eax, word [rdx - 2]
test ax, ax
jne 0x1800028a0
cmp r11d, ecx
je 0x1800028d1
mov r8, qword [r8]
cmp r10, r8
jne 0x18000288e
xor ebx, ebx
jmp 0x1800028d5
mov rbx, qword [r8 + 0x30]
xor ecx, ecx
mov edx, dword [0x1803e7de8]
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x1803e7de8]
mov rsi, rax
lea rdx, [rax + rcx]
test rcx, rcx
je 0x18000290d
mov byte [rax], 0
add rax, 1
cmp rax, rdx
jne 0x180002901
mov r8d, 0x104
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx r8d, word [rsi]
test r8w, r8w
je 0x180002e02
xor eax, eax
lea edx, [rax + 1]
cmp word [rsi + rdx*2], 0
mov rax, rdx
jne 0x18000292e
mov r9, qword [0x1803e7dd8]
xor edx, edx
jmp 0x180002952
mov r8d, ecx
mov edx, eax
lea ecx, [rdx + 1]
mov rax, rcx
movzx ecx, word [rsi + rcx*2]
test cx, cx
jne 0x18000294d
cmp r8w, 0x5c
jne 0x180002970
jmp 0x180002e2d
mov edx, r8d
lea r8d, [rdx - 1]
xor ecx, ecx
mov word [rsi + rax*2], cx
cmp word [rsi + r8*2], 0x5c
mov eax, edx
jne 0x18000296d
movsx ax, byte [r9]
xor ecx, ecx
test al, al
je fcn.1800029a8
lea r8d, [rdx + rcx]
mov word [rsi + r8*2], ax
lea eax, [rcx + 1]
mov rcx, rax
movsx ax, byte [r9 + rax]
test al, al
jne 0x18000298f
movabs rax, 0x1fffffffe
mov r9, qword [0x1803e7dd8]
mov edx, 0xffffffff
movzx r8d, word [rsi + rax]
xor eax, eax
cmp r8w, 0x5c
jne 0x180002970
nop dword [rax]
mov edx, eax
jmp 0x180002984
Function at 0x180002a44
Capabilities:
Terminate process

Disassembly:
add byte [rax], al
add byte [rbp + rcx*4 - 0x74], cl
and al, 0x98
add byte [rax], al
add bh, bh
adc eax, 0x239933

Function at 0x1800030f8
Capabilities:
Get thread local storage value

Disassembly:
cmp qword [rcx + 0x10], 0
je 0x180003108
add rcx, 0x18
jmp sym.python310.dll_PyThread_tss_get
xor eax, eax
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140228150]
mov dword [rax], 1
mov rax, qword [0x140228160]
mov dword [rax], 1
mov rax, qword [str._Q__]
mov dword [rax], 1
mov rax, qword [0x1402280f0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14019d460
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1402033c0
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x14019d525
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1402142a8
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14019d506
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x14019d4f8
test rsi, rsi
je 0x1402142a8
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x14019d4b8
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x14019d554
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14019d570
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x14019d62d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1402142ae
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14019d60e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x14019d600
test rsi, rsi
je 0x1402142ae
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x14019d5c0
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401bbf00
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, qword [0x140244438]
mov rsi, rcx
test rbx, rbx
je 0x1401bbf80
mov rax, qword [0x1402282a0]
mov rcx, qword [rax + 0x48]
cmp rbx, rcx
je 0x1401bbf70
mov rdx, qword [0x140244668]
test rdx, rdx
je 0x1401bc070
mov rcx, rbx
mov rbx, qword [sym.imp.python37.dll_PyNumber_InPlaceAdd]
call rbx
mov rcx, rax
mov rdx, rsi
mov rax, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rbx, qword [sym.imp.python37.dll_PyNumber_InPlaceAdd]
jmp 0x1401bbf51
lea r15, str.NUITKA_ONEFILE_BINARY
mov rcx, r15
call fcn.14019d460
test rax, rax
je 0x1401bc090
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python37.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r13, r14
lea r12, [r15 + 0x28]
mov word [rsp + 0x40], cx
lea rbp, [rsp + 0x3a]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov eax, 0x4e
nop
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, r15
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14021434a
cmp word [r13], 0
movzx edx, word [rsp + 0x3c]
mov rax, r13
je 0x1401bc01e
nop word [rax + rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x1401bc010
test rbx, rbx
je 0x14021434a
mov word [rax], dx
add r15, 1
xor edx, edx
add r13, 2
mov word [rax + 2], dx
movzx eax, byte [r15]
test al, al
jne 0x1401bbfd0
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call qword [sym.imp.python37.dll_PyThreadState_Get]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.1401bbbf0
mov rbx, rax
mov qword [0x140244438], rbx
jmp 0x1401bbf22
lea rcx, [0x1402248bb]
call qword [sym.imp.python37.dll_PyUnicode_FromString]
mov qword [0x140244668], rax
mov rdx, rax
jmp 0x1401bbf42
mov rbx, qword [0x140244450]
test rbx, rbx
jne 0x1401bc061
cmp byte [0x140244662], 0
jne 0x1401bc0af
mov ecx, 1
call fcn.1401851f0
mov rdx, 0xffffffffffffffff
lea rcx, [0x140244460]
call qword [sym.imp.python37.dll_PyUnicode_FromWideChar]
mov qword [0x140244450], rax
mov rbx, rax
test rax, rax
je 0x1401bc0d8
add qword [rax], 1
jmp 0x1401bc061
call qword [sym.imp.python37.dll_PyErr_Print]
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
nop
call sub.msvcrt.dll_abort
nop
Function at 0x1401c5200
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rsi, str.NUITKA_ONEFILE_BINARY
mov ebx, ecx
mov rcx, rsi
call fcn.14019d460
test rax, rax
je 0x1401c5358
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python37.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r15, r14
lea r12, [rsi + 0x28]
mov word [rsp + 0x40], cx
mov r13, rax
lea rbp, [rsp + 0x3a]
mov eax, 0x4e
lea rdi, [rsp + 0x3c]
nop word [rax + rax]
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, rsi
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x140214380
cmp word [r15], 0
movzx edx, word [rsp + 0x3c]
mov rax, r15
je 0x1401c52b6
nop dword [rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x1401c52a8
test rbx, rbx
je 0x140214380
mov word [rax], dx
add rsi, 1
xor edx, edx
add r15, 2
mov word [rax + 2], dx
movzx eax, byte [rsi]
test al, al
jne 0x1401c5268
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call qword [sym.imp.python37.dll_PyThreadState_Get]
mov rdx, qword [0x140244b78]
mov rsi, rax
mov rax, qword [0x1402282a0]
mov rbx, qword [rax + 0x1c0]
test rdx, rdx
je 0x1401c53b3
mov r8, rbx
mov rcx, rsi
call fcn.1401a9680
mov r8, r13
mov rcx, rsi
mov rbx, rax
mov rdx, rax
call fcn.1401b89c0
sub qword [rbx], 1
je 0x1401c533f
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [rdx + 0x30]
mov rax, qword [rsp + 0x28]
jmp 0x1401c532b
mov rax, qword [0x140244448]
lea rsi, [0x140244448]
test bl, bl
je 0x1401c5378
mov rax, qword [0x140244450]
lea rsi, [0x140244450]
test rax, rax
jne 0x1401c532b
cmp byte [0x140244662], 0
jne 0x1401c538e
movzx ecx, bl
call fcn.1401851f0
mov rdx, 0xffffffffffffffff
lea rcx, [0x140244460]
call qword [sym.imp.python37.dll_PyUnicode_FromWideChar]
mov qword [rsi], rax
test rax, rax
je 0x1401c53e0
add qword [rax], 1
jmp 0x1401c532b
mov rdx, qword [0x140244af8]
mov rdi, qword [rax + 0x1b0]
test rdx, rdx
je 0x1401c53eb
mov r8, rdi
mov rcx, rsi
call fcn.1401a9680
mov qword [0x140244b78], rax
mov rdx, rax
jmp 0x1401c5309
call qword [sym.imp.python37.dll_PyErr_Print]
call sub.msvcrt.dll_abort
lea rcx, [0x140220d93]
call qword [sym.imp.python37.dll_PyImport_ImportModule]
mov qword [0x140244af8], rax
mov rdx, rax
test rax, rax
je 0x140214380
jmp 0x1401c53c6
Function at 0x1401ffbf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [0x140244431], 0
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x1401ffc78
lea rdx, [0x1402242ba]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1401ffce0
mov rbx, qword [0x1402442d8]
jmp 0x1401ffc35
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x1401ffc30
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, rbp
mov rdx, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1401eea60
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x1402442d8], rax
mov ebx, dword [rax]
mov qword [0x1402442d8], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x1402442d8], rdx
call fcn.1401fed20
cmp eax, ebx
jne 0x1401ffd7a
mov byte [0x140244431], 1
jmp 0x1401ffc0e
cmp byte [0x140244430], 0
jne 0x1401ffc25
mov rbx, qword [sym.imp.python37.dll_PyDict_New]
lea rsi, [0x140243ac8]
call rbx
mov qword [0x140244d68], rax
call rbx
mov qword [0x140244d60], rax
call rbx
mov qword [0x140244d58], rax
call rbx
mov qword [0x140244d50], rax
call rbx
mov qword [0x140244d48], rax
call rbx
mov qword [0x140244d40], rax
call rbx
mov qword [0x140244d38], rax
call rbx
mov r13, qword [sym.imp.python37.dll_PyLong_FromLong]
mov rbx, 0xfffffffffffffffb
mov qword [0x140244d30], rax
nop dword [rax]
mov ecx, ebx
call r13
mov qword [rsi + rbx*8], rax
add rbx, 1
cmp rbx, 0x101
jne 0x1401ffd58
mov byte [0x140244430], 1
jmp 0x1401ffc25
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1402020a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140213780
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140213780
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop