joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56df80
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x56e1e1
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x56e1c5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x56dfcd
xor ebx, ebx
xor ecx, ecx
jmp 0x56dfe0
mov rax, rdx
call fcn.0055ed40
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x56e0f8
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0046fb80
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0073a578]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e500
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x56e0bb
xor eax, eax
lea rbx, [0x0073a790]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006b71d4]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e5e0
jmp 0x56e0e8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0073a638]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e500
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.0046fb80
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x56e188
xor eax, eax
lea rbx, [0x0073a790]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006b71d4]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e5e0
jmp 0x56e1b5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0073a638]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e500
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006b7b91]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00462ca0
mov rax, qword [rsp + 8]
jmp fcn.0056df80
Function at 0x5740e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5742f7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x57420e
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x5742e9
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x574182
mov rax, rdx
mov rcx, rsi
call fcn.00465ca0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x5741ea
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00574580
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x5742e1
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x574214
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x574291
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00574580
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x5742cf
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x5742cb
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00465ca0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.004653c0
mov rax, rdx
mov ecx, 0x40
call fcn.004653c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005740e0
Function at 0x5d90a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5d9175
movdqa xmm0, xmmword [0x0073c570]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5d90e1
movdqa xmm0, xmmword [0x0073c580]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5d91f7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5d91cb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0073be28]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0073c9c0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5e6a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e6bcb
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5e6a47
inc rcx
cmp rbx, rcx
jle 0x5e6bbd
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5e6a44
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.00562020
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x008c8240]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005e2ae0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5e6bad
test rdx, rdx
je 0x5e6b9e
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00929d38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5e6b69
xor eax, eax
lea rbx, [0x0073a790]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006b71d4]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044e5e0
jmp 0x5e6b90
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0073a638]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044e500
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005e6a20
Function at 0x14000101c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400010d6
cmp byte [rbx], 0
je 0x1400010d6
mov edx, 0x5c
mov rcx, rbx
call fcn.140008af0
mov rbx, rax
test rax, rax
je 0x1400010d6
mov rcx, rsi
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1400010a2
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140001098
test rdi, rdi
je 0x140001098
lea rdx, str.CreateDirectory___s_
lea ecx, [rax + 5]
mov r8, rsi
call rdi
jmp 0x1400010a2
mov rdx, rsi
mov ecx, 1
call rdi
test bpl, 0x10
jne 0x1400010c9
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400010c9
lea rdx, str.CreateDirectory___s_
mov r8, rsi
mov ecx, 5
call rdi
mov byte [rbx], 0x5c
add rbx, 1
jne 0x140001042
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140001f08
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rdx, str.PyImport_ImportModule
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyObject_SetAttrString
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyObject_GetAttrString
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyCFunction_New
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_BuildValue
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyArg_ParseTuple
mov rcx, rbx
mov rbp, rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyErr_Format
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyLong_FromVoidPtr
mov rcx, rbx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov qword [rsp + 0x70], rax
cmp rdi, rbx
je 0x14000208d
cmp rsi, rbx
je 0x14000208d
cmp r14, rbx
je 0x14000208d
cmp r15, rbx
je 0x14000208d
cmp rbp, rbx
je 0x14000208d
cmp r12, rbx
je 0x14000208d
cmp r13, rbx
je 0x14000208d
lea rcx, str.builtins
call rdi
mov rdi, rax
cmp rax, rbx
je 0x140002068
lea rdx, str.ValueError
mov rcx, rax
call rsi
lea rdx, str.OSError
mov rcx, rdi
mov qword [0x140038390], rax
call rsi
lea rbp, str.create_shortcut
mov rsi, rbp
mov qword [0x140038748], rax
movsxd rcx, ebx
xor edx, edx
shl rcx, 5
add rcx, rbp
call r15
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rax
call r14
inc ebx
add rsi, 0x20
cmp ebx, 6
jb 0x14000203d
mov rbp, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
mov qword [0x140038610], rbp
mov qword [0x140037328], r12
mov qword [0x140038370], rax
xor eax, eax
mov qword [0x140037330], r13
jmp 0x140002092
mov eax, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400020a8
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x1400342a0]
xor rax, rbp
mov qword [rbp + 0x58], rax
mov rdi, rdx
lea rdx, str.Py_Initialize
mov rbx, r9
movsxd r12, r8d
mov r13, rcx
mov qword [rbp + 8], rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PySys_SetArgv
mov rcx, r13
mov qword [rbp + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyRun_SimpleString
mov rcx, r13
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_Finalize
mov rcx, r13
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_BuildValue
mov rcx, r13
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyCFunction_New
mov rcx, r13
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyArg_ParseTuple
mov rcx, r13
mov qword [rbp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbp + 8]
lea rdx, str.PyErr_Format
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp qword [rbp + 0x18], rcx
je 0x14000232c
cmp r14, rcx
je 0x14000232c
cmp qword [rbp + 0x10], rcx
je 0x14000232c
cmp r15, rcx
je 0x14000232c
cmp rsi, rcx
je 0x14000232c
cmp r13, rcx
je 0x14000232c
cmp rax, rcx
je 0x14000232c
cmp qword [rbp + 0x20], rcx
je 0x14000232c
cmp rdi, rcx
je 0x140002325
cmp byte [rdi], cl
je 0x140002325
xor edx, edx
mov rcx, rdi
call fcn.140022570
mov esi, eax
cmp eax, 0xffffffff
jne 0x140002216
call fcn.14000a4d0
lea rdx, str.Could_not_open_postinstall_script__s_n
mov r8, rdi
lea rcx, [rax + 0x60]
call int.14000a2b0
lea eax, [rsi + 4]
jmp 0x140002331
mov rcx, qword [0x140038620]
lea r8, str.Running_Script...
mov edx, 0x3ec
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
call qword [rbp + 0x18]
mov rcx, qword [rbp + 8]
call fcn.140001f08
lea r13, [0x1400358d0]
xor edx, edx
mov rcx, r13
mov r8d, 0x800
call fcn.140008b20
mov rdi, r12
test r12d, r12d
jle 0x14000228c
mov r12, r13
mov r13, rdi
sub r12, rbx
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002272
call fcn.1400018c4
jmp 0x140002274
xor eax, eax
mov qword [r12 + rbx], rax
add rbx, 8
sub r13, 1
jne 0x140002263
mov r12d, edi
lea r13, [0x1400358d0]
mov rdx, r13
mov ecx, r12d
call r14
xor ebx, ebx
test rdi, rdi
jle 0x1400022b3
mov rcx, qword [r13 + rbx*8]
test rcx, rcx
je 0x1400022ab
call fcn.1400099cc
inc rbx
cmp rbx, rdi
jl 0x14000229c
lea rdx, [rbp + 0x28]
mov ecx, esi
mov ebx, 3
call fcn.140009e70
test eax, eax
jne 0x140002317
mov r8d, dword [rbp + 0x3c]
lea eax, [r8 + 5]
movsxd rcx, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400022e5
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
int3
call r15
mov ecx, esi
call fcn.140017cc4
mov eax, ebx
jmp 0x140002331
mov eax, 2
jmp 0x140002331
mov eax, 1
mov rcx, qword [rbp + 0x58]
xor rcx, rbp
call fcn.1400091a0
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x60]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140002520
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r14, rdx
lea rdx, str.Py_Initialize
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_SetProgramName
mov rcx, r12
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_Finalize
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyRun_SimpleString
mov rcx, r12
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyErr_Print
mov rcx, r12
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test r13, r13
je 0x1400025df
test rbx, rbx
je 0x1400025df
test rdi, rdi
je 0x1400025df
test rbp, rbp
je 0x1400025df
test rax, rax
je 0x1400025df
lea rcx, [0x1400383a0]
call rbx
call r13
mov rcx, r12
call fcn.140001f08
mov rcx, r14
call rbp
mov ebx, eax
test eax, eax
je 0x1400025d9
call rsi
call rdi
mov eax, ebx
jmp 0x1400025e2
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret

Function at 0x140002a9c
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
xor r9d, r9d
mov rsi, rdx
mov dword [rax - 0x20], 0x80
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rax - 0x28], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002ae5
xor eax, eax
jmp 0x140002b4e
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, rbx
lea r8d, [r9 + 2]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x140002ae1
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi], ebp
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400041f0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x1400342a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea r9, [0x140027838]
lea r8, [0x140037100]
lea rdx, str.runas
xor ecx, ecx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x140004268
lea rdx, str.Failed_to_start_elevated_process__ShellExecute_returned__d_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [0x1400282f8]
lea rdx, [rsp + 0x30]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400091a0
add rsp, 0xc8
ret

Function at 0x140004448
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
call fcn.14001e984
mov edx, 0x5b
mov rcx, rax
mov rbp, rax
call fcn.140008af0
mov rdi, rax
test rax, rax
je 0x140004540
lea rcx, [rax + 1]
mov edx, 0x5d
call fcn.140008af0
mov rbx, rax
test rax, rax
je 0x140004540
lea rcx, [rax + 1]
mov edx, 0xa
mov byte [rax], 0
call fcn.140008af0
test rax, rax
je 0x1400044b3
mov byte [rax], 0
mov rcx, qword [section..data]
lea rax, [rsp + 0x48]
lea rdx, [rdi + 1]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400044f9
call qword [sym.imp.USER32.dll_GetFocus]
lea r8, str.Could_not_open_key
xor r9d, r9d
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140004538
mov rcx, qword [rsp + 0x48]
lea rdx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x14000452d
cmp eax, 2
je 0x14000452d
call qword [sym.imp.USER32.dll_GetFocus]
lea r8, str.Could_not_delete_key
xor r9d, r9d
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call fcn.1400099cc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140004558
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
call fcn.14001e984
mov edx, 0x5b
mov rcx, rax
mov rbp, rax
call fcn.140008af0
mov rdi, rax
test rax, rax
je 0x140004654
lea rcx, [rax + 1]
mov edx, 0x5d
call fcn.140008af0
mov rbx, rax
test rax, rax
je 0x140004654
lea rcx, [rax + 1]
mov edx, 0x3d
mov byte [rax], 0
call fcn.140008af0
test rax, rax
je 0x140004654
mov byte [rax], 0
mov rcx, qword [section..data]
lea rax, [rsp + 0x48]
lea rdx, [rdi + 1]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000460d
call qword [sym.imp.USER32.dll_GetFocus]
lea r8, str.Could_not_open_key
xor r9d, r9d
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000464c
mov rcx, qword [rsp + 0x48]
lea rdx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x140004641
cmp eax, 2
je 0x140004641
call qword [sym.imp.USER32.dll_GetFocus]
lea r8, str.Could_not_delete_value
xor r9d, r9d
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call fcn.1400099cc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140004dac
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13d, edx
lea rdx, str.Py_Initialize
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_SetProgramName
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_Finalize
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PyRun_SimpleString
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PySys_GetObject
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Py_OptimizeFlag
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp qword [0x1400360d8], rcx
jne 0x140004e4a
xor eax, eax
jmp 0x140004e91
cmp rdi, rcx
je 0x140004e8e
cmp rsi, rcx
je 0x140004e8e
cmp rbp, rcx
je 0x140004e8e
cmp r12, rcx
je 0x140004e8e
cmp r14, rcx
je 0x140004e8e
cmp rax, rcx
je 0x140004e8e
cmp r13d, ecx
setne cl
mov dword [rax], ecx
lea rcx, [0x1400383a0]
call rsi
call rdi
mov edx, r13d
mov rcx, r12
call fcn.140004c4c
mov ebx, eax
call rbp
mov eax, ebx
jmp 0x140004e91
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret