joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400140e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
push rcx
pop rsi
nop
mov r8, qword [rcx]
test r8, r8
je 0x14001413b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14001413b
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x140014156
cmp eax, 0x42
jne 0x14001413b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140014206
cmp byte [r8 + r11], 0x5f
jne 0x140014206
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14001426e
push rsi
nop
pop rcx
xor edx, edx
call fcn.14000fb70
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
push rsi
nop
pop rcx
sub edx, edx
call fcn.14000fb70
test al, al
jne 0x140014301
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140014192
lea rdx, [0x1400b484b]
mov r8d, 1
call fcn.140004960
test al, al
jne 0x140014301
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14001414a
xor r14d, r14d
lea rbx, [0x1400b4bb9]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400141c4
cmp byte [rax + rcx], 0x45
je 0x140014323
sub r14, 1
jb 0x1400141e9
mov rcx, qword [rsi + 0x20]
or rcx, rcx
je 0x1400141e9
mov r8d, 2
push rbx
pop rdx
nop
call fcn.140004960
test al, al
jne 0x140014301
push rsi
pop rcx
nop
call fcn.140011390
test al, al
jne 0x140014301
mov rax, qword [rsi]
test rax, rax
jne 0x1400141b0
jmp 0x14001414a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r9b, 1
cmp r11, r10
jae 0x1400142c8
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x140014262
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14001424c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14001423b
add dl, 0xa9
jmp 0x14001424a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1400142c8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1400142c8
movzx edx, bl
add rax, rdx
jae 0x140014210
jmp 0x1400142c8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1400142c8
cmp rax, rcx
jae 0x1400142c5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14001431b
cmp qword [rsi + 0x20], 0
je 0x140014314
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.1400140e0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14001414c
mov r9b, 1
sub edi, edi
mov rcx, qword [rsi + 0x20]
or rcx, rcx
je 0x140014309
mov eax, r9d
xor al, 1
movzx eax, al
lea r8, [rax + rax*8]
add r8, 0x10
lea rax, str.invalid_syntaxrecursion_limit_reached_for_______::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x1400b4b98]
test r9b, r9b
cmovne rdx, rax
call fcn.140004960
test al, al
je 0x140014309
mov dil, 2
jmp 0x14001414a
mov qword [rsi], 0
mov byte [rsi + 8], dil
sub edi, edi
jmp 0x14001414a
mov dil, 1
xor r9d, r9d
jmp 0x1400142ca
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14001414a
Function at 0x1400175b0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
nop
push rcx
pop rsi
cmp qword [rcx], 0
je 0x140017635
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
nop
push rbx
pop rcx
sub edx, edx
sub r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x140017676
cmp dword [rsp + 0x2c], 0
je 0x14001765a
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14001768e
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x1400bf108]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1400bf108], rsi
jne 0x140017610
mov byte [0x1400bf100], 1
nop
push rbx
pop rcx
sub edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14001766c
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x1400176d8
mov ecx, eax
inc ecx
sub eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14001765f
mov edi, dword [rsp + 0x28]
jmp 0x14001766c
mov edi, dword [rsi + 0x18]
jmp 0x14001766a
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140017cb0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.pv_v_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_std_src_threadlocal.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syspalwindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.140003e30
lea rax, str.pv_v_
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_std_src_threadlocal.rs
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140017d00
int3
Function at 0x140017b90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x1400490f0]
test ecx, ecx
je 0x140017c69
dec ecx
call fcn.140046554
cmp rax, 2
jb 0x140017bc4
mov rdi, rax
cmp qword [rax + 8], 0
je 0x140017bc4
add rdi, 0x10
jmp 0x140017c5f
mov ecx, dword [0x1400490f0]
or ecx, ecx
je 0x140017c7c
dec ecx
call fcn.140046554
cmp rax, 1
je 0x140017c5d
push rax
nop
pop rsi
test rax, rax
jne 0x140017c2c
movzx eax, byte [0x1400bf128]
mov edx, 0x18
sub ecx, ecx
call fcn.140036e50
or rax, rax
je 0x140017c9f
nop
push rax
pop rsi
lea rax, [0x1400490d8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1400490f0]
test ecx, ecx
je 0x140017c8f
dec ecx
mov rdx, rsi
call fcn.14004654c
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x140017c5f
or rcx, rcx
je 0x140017c5f
lock dec qword [rcx]
jne 0x140017c5f
call fcn.140017560
jmp 0x140017c5f
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1400490d8]
call fcn.1400175b0
mov ecx, eax
jmp 0x140017ba6
lea rcx, [0x1400490d8]
call fcn.1400175b0
mov ecx, eax
jmp 0x140017bd4
lea rcx, [0x1400490d8]
call fcn.1400175b0
mov ecx, eax
jmp 0x140017c24
mov ecx, 8
mov edx, 0x18
call fcn.1400032e0
int3
Function at 0x140018e30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov ecx, dword [0x1400490d0]
or ecx, ecx
je 0x140018eea
dec ecx
call fcn.140046554
cmp rax, 2
jb 0x140018e60
cmp qword [rax + 8], 0
je 0x140018e60
add rax, 0x10
jmp 0x140018ee4
mov ecx, dword [0x1400490d0]
or ecx, ecx
je 0x140018efd
dec ecx
call fcn.140046554
cmp rax, 1
je 0x140018ee2
push rax
pop rsi
nop
or rax, rax
jne 0x140018ec8
movzx eax, byte [0x1400bf128]
mov edx, 0x20
sub ecx, ecx
call fcn.140036e50
or rax, rax
je 0x140018f20
mov rsi, rax
lea rax, [0x1400490b8]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x1400490d0]
test ecx, ecx
je 0x140018f10
dec ecx
push rsi
nop
pop rdx
call fcn.14004654c
mov qword [rsi + 8], 1
lea rax, [rsi + 0x10]
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
jmp 0x140018ee4
sub eax, eax
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1400490b8]
call fcn.1400175b0
mov ecx, eax
jmp 0x140018e45
lea rcx, [0x1400490b8]
call fcn.1400175b0
mov ecx, eax
jmp 0x140018e70
lea rcx, [0x1400490b8]
call fcn.1400175b0
mov ecx, eax
jmp 0x140018ec0
mov ecx, 8
mov edx, 0x20
call fcn.1400032e0
int3
Function at 0x140034d30
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
push rcx
pop rsi
nop
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0x98]
call fcn.140019380
mov rax, qword [rsp + 0x98]
cmp rax, rdi
jne 0x140034d7f
mov rcx, qword [rsp + 0xa0]
call fcn.140016e00
mov qword [rsi], rdi
jmp 0x140034f35
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x58], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
sub ebx, ebx
mov esi, 0xffffffff
xor r14d, r14d
xor r13d, r13d
cmp r8, 0x201
jae 0x140034e10
jmp 0x140034def
jae 0x140034ebb
cmp r8, 0x201
jae 0x140034e10
mov edi, 0x200
lea rbp, [rsp + 0x98]
mov r12, r8
jmp 0x140034e57
sub r8, r13
sub r14, r13
cmp r14, r8
jae 0x140034e37
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.140019800
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp rbx, rsi
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rsp + 0x58], r13
mov r14, rbx
mov rdi, r13
mov rbp, qword [rsp + 0x28]
mov r12, r13
sub ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, qword [rsp + 0x30]
push rbp
pop rdx
nop
mov r8d, r12d
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov r15d, eax
test eax, eax
jne 0x140034e82
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140034f69
mov r8d, r15d
cmp r12, r8
jne 0x140034de0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140034f93
add r12, r12
cmp r12, rsi
cmovae r12, rsi
mov r8, r12
cmp r8, 0x201
jb 0x140034def
jmp 0x140034e10
cmp rdi, r8
jb 0x140034fad
lea rcx, [rsp + 0x78]
mov rdx, rbp
call fcn.14001aac0
movabs r14, 0x8000000000000000
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x60], xmm0
test rbx, rbx
je 0x140034f09
mov edx, 2
mov rcx, qword [rsp + 0x28]
call fcn.140002e00
cmp rsi, r14
jne 0x140034f4a
mov rax, qword [rsp + 0x38]
mov qword [rax], r14
mov rcx, rdi
call fcn.140016e00
cmp qword [rsp + 0x40], 0
je 0x140034f35
mov edx, 2
mov rcx, qword [rsp + 0x30]
call fcn.140002e00
nop
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x38]
mov qword [rax], rsi
mov qword [rax + 8], rdi
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm0
cmp qword [rsp + 0x40], 0
jne 0x140034f26
jmp 0x140034f35
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
movabs r14, 0x8000000000000000
mov rsi, r14
test rbx, rbx
jne 0x140034efa
jmp 0x140034f09
lea rcx, str.internal_error:_entered_unreachable_code_home_torcrypt_.cargo_registry_src_index.crates.io_6f17d22bba15001f_rayon_core_1.12.1_src_job.rs
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.140004c80
jmp 0x140034fc2
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
push rdi
pop rdx
nop
mov r8, rax
call fcn.1400048e0
ud2
Function at 0x1400361b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, dword [0x140049130]
or ecx, ecx
je 0x140036289
dec ecx
call fcn.140046554
cmp rax, 2
jb 0x1400361e4
mov rdi, rax
cmp qword [rax + 8], 0
je 0x1400361e4
add rdi, 0x10
jmp 0x14003627f
mov ecx, dword [0x140049130]
test ecx, ecx
je 0x14003629c
dec ecx
call fcn.140046554
cmp rax, 1
je 0x14003627d
push rax
nop
pop rsi
test rax, rax
jne 0x14003624c
movzx eax, byte [0x1400bf128]
mov edx, 0x18
xor ecx, ecx
call fcn.140036e50
or rax, rax
je 0x1400362bf
push rax
pop rsi
nop
lea rax, [0x140049118]
mov qword [rsi], rax
mov qword [rsi + 8], 0
mov ecx, dword [0x140049130]
test ecx, ecx
je 0x1400362af
dec ecx
push rsi
nop
pop rdx
call fcn.14004654c
lea rdi, [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
cmp qword [rsi + 8], 0
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], 0
je 0x14003627f
or rcx, rcx
je 0x14003627f
lock dec qword [rcx]
jne 0x14003627f
call fcn.1400362d0
jmp 0x14003627f
sub edi, edi
push rdi
nop
pop rax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140049118]
call fcn.1400175b0
mov ecx, eax
jmp 0x1400361c6
lea rcx, [0x140049118]
call fcn.1400175b0
mov ecx, eax
jmp 0x1400361f4
lea rcx, [0x140049118]
call fcn.1400175b0
mov ecx, eax
jmp 0x140036244
mov ecx, 8
mov edx, 0x18
call fcn.1400032e0
int3

Function at 0x140036880
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400368b6
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [0x140035930]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syspalwindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.140003e30
ud2
Function at 0x14003e7a2
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
push rdx
pop rax
nop
mov rsi, rcx
lea rdx, [rsp + 0x2c]
push rax
nop
pop rcx
call sub.SHELL32.dll_CommandLineToArgvW
test rax, rax
je 0x14003e83e
push rax
pop rdi
nop
lea rbx, [rsp + 0x30]
and qword [rbx], 0
mov qword [rbx + 8], 8
and qword [rbx + 0x10], 0
movsxd r12, dword [rsp + 0x2c]
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x14003e823
mov r15, qword [rdi + r13]
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14003bcb4
push rbx
nop
pop rcx
mov rdx, r14
call fcn.14003eaab
add r13, 8
jmp 0x14003e7f3
push rdi
nop
pop rcx
call sub.KERNEL32.dll_LocalFree
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
jmp 0x14003e84f
and qword [rsi], 0
mov qword [rsi + 8], 8
and qword [rsi + 0x10], 0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140044d99
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
push rcx
nop
pop rsi
mov ecx, dword [0x140049150]
test ecx, ecx
je 0x140044ea6
dec ecx
call fcn.140046554
cmp rax, 2
jb 0x140044dd4
cmp qword [rax + 8], 0
je 0x140044dd4
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
jmp 0x140044e87
mov ecx, dword [0x140049150]
or ecx, ecx
je 0x140044eb9
dec ecx
call fcn.140046554
push rax
pop rdi
nop
cmp rax, 1
je 0x140044e9c
or rdi, rdi
jne 0x140044e40
mov al, byte [0x1400bf128]
mov edx, 0x20
sub ecx, ecx
call fcn.140036e50
or rax, rax
je 0x140044edf
nop
push rax
pop rdi
lea rax, [0x140049138]
mov qword [rdi], rax
and qword [rdi + 8], 0
mov ecx, dword [0x140049150]
test ecx, ecx
je 0x140044ecc
dec ecx
push rdi
pop rdx
nop
call fcn.14004654c
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
or eax, eax
js 0x140044e6e
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140044e73
call fcn.140036880
mov qword [rdi + 8], 1
lea rcx, [rdi + 0x10]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rdx
mov rdx, qword [rcx + 8]
lea r8, [rax + 1]
mov qword [rcx], r8
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
sub edi, edi
mov qword [rsi], rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x140049138]
call fcn.1400175b0
mov ecx, eax
jmp 0x140044db2
lea rcx, [0x140049138]
call fcn.1400175b0
mov ecx, eax
jmp 0x140044de4
lea rcx, [0x140049138]
call fcn.1400175b0
mov ecx, eax
jmp 0x140044e38
mov ecx, 8
mov edx, 0x20
call fcn.1400032e0
int3
Function at 0x140045d63
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
and qword [rsp + 0x38], 0
push rdx
nop
pop rsi
push rcx
nop
pop rdi
cmp qword [rdx + 0x10], 0
je 0x140045e27
lea rcx, [0x1400b8442]
call sub.OLEAUT32.dll_SysAllocString
push rax
pop rbx
nop
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.OLEAUT32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
nop
push rbx
pop rdx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
nop
push rbx
pop rcx
call sub.OLEAUT32.dll_SysFreeString
mov rcx, r14
call sub.OLEAUT32.dll_SysFreeString
or ebp, ebp
js 0x140045e27
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call fcn.140040a9c
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x140045e36
mov qword [rdi], 2
nop
push rsi
pop rcx
call fcn.140040a20
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140047260
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140048070
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140048070
mov rdx, r12
push rax
nop
pop rcx
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x1400472d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1400bf1b4]
mov r12, rcx
push rdx
pop rsi
nop
mov rbx, r8
test edi, edi
jle 0x140047480
mov rax, qword [0x1400bf1b8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14004731c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400473a7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x140047300
mov rcx, r12
call fcn.140047d80
nop
push rax
pop rbp
or rax, rax
je 0x1400474dd
mov rax, qword [0x1400bf1b8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140047eb0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400bf1b8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
or rax, rax
je 0x1400474c2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400473a0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140047430
add dword [0x1400bf1b4], 1
cmp ebx, 8
jae 0x1400473d8
test bl, 4
jne 0x140047490
test ebx, ebx
je 0x1400473c9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x1400474b0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x1400473c9
and ebx, 0xfffffff8
sub eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x14004740a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x1400bf1b8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
or eax, eax
jne 0x1400473a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140047260
xor edi, edi
jmp 0x140047327
mov eax, dword [rsi]
push rax
pop rax
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x1400473c9
push rdx
pop rdx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x1400473c9
mov rax, qword [0x1400bf1b8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140047260
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140047260
nop
nop dword [rax]
Function at 0x1400479f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400bf220]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400bf200]
or rbx, rbx
je 0x140047a44
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140047a3b
test r12, r12
je 0x140047a3b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140047a20
lea rcx, [0x1400bf220]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140047d80
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1400b90a0]
sub r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140047df9
mov rcx, r10
call fcn.140047c50
test eax, eax
je 0x140047df9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140047df6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
push rdx
nop
pop rax
cmp rcx, rdx
jb 0x140047ded
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140047df9
add r8, 0x28
cmp r8, r9
jne 0x140047dd8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x1400039a0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10088
call fcn.1400242a0
sub rsp, rax
mov rax, qword [0x14005f980]
xor rax, rsp
mov qword [rsp + 0x10070], rax
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.14001f690
mov r8d, 0x10000
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140003a1d
lea rcx, [rsp + 0x70]
call fcn.140036a20
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.140024300
add rsp, 0x10088
ret
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.140024300
add rsp, 0x10088
ret

Function at 0x140003ad0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14005f980]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [0x140045140]
call fcn.1400039a0
xor edi, edi
mov qword [0x140061048], rax
lea rdx, [0x140045140]
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x20]
lea r8d, [rdi + 0x28]
call fcn.14001f690
lea rdx, [0x140045148]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.1400039a0
mov cl, 1
mov qword [0x140061050], rax
call fcn.140020840
lea r8d, [rdi + 0x28]
mov word [rsp + 0x20], di
lea rdx, str.PYTHONHOME
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14001f690
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov cl, 1
call fcn.140020840
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140024300
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret