joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x140013870
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001129e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014bc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014be0
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014bf3
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014c1d
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014c31
xor al, al
jmp 0x140014c61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014c43
xor al, al
jmp 0x140014c61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014c5f
xor al, al
jmp 0x140014c61
mov al, 1
add rsp, 0x38
ret
Function at 0x1400047ba
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012440
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x140004889
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000481f
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000481f
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x1400047fc
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004889
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x140004889
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004866
mov rax, 1
jmp 0x140004895
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006904
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4010f4
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
movabs rax, 0
mov r10, rax
mov rcx, r10
call fcn.004011db
shl rax, 0x20
shr rax, 0x20
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_srand
mov eax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
lea rax, section..text
mov r11, rax
mov eax, 0xd
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_SetWindowsHookExA
mov qword [rbp - 8], rax
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x4011c5
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
call sub.user32.dll_TranslateMessage
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
call sub.user32.dll_DispatchMessageA
jmp 0x40116d
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.user32.dll_UnhookWindowsHookEx
mov eax, 0
leave
ret

Function at 0x4010ff
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
movabs rax, 0
mov r10, rax
mov rcx, r10
call fcn.004011db
shl rax, 0x20
shr rax, 0x20
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_srand
mov eax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
lea rax, section..text
mov r11, rax
mov eax, 0xd
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_SetWindowsHookExA
mov qword [rbp - 8], rax
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x4011c5
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
call sub.user32.dll_TranslateMessage
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
call sub.user32.dll_DispatchMessageA
jmp 0x40116d
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.user32.dll_UnhookWindowsHookEx
mov eax, 0
leave
ret
Function at 0x4012f7
Capabilities:
Accept command line arguments

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [rbp - 0x68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [rbp - 0x2c]
and eax, 1
cmp eax, 0
je 0x401330
movzx eax, word [rbp - 0x28]
mov dword [rbp - 0x7c], eax
jmp 0x401338
mov eax, 0xa
mov dword [rbp - 0x7c], eax
movabs rax, 0
mov qword [rbp - 0x70], rax
call sub.kernel32.dll_GetCommandLineA
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x40137a
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [rbp - 0x78]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strstr
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
cmp rax, 0
jne 0x4013a3
lea rax, [0x00402048]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__strdup
mov qword [rbp - 0x70], rax
jmp 0x4013d4
mov rax, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
cmp rax, rcx
jbe 0x4013d4
mov rax, qword [rbp - 0x70]
add rax, 0xffffffffffffffff
movsx eax, byte [rax]
cmp eax, 0x22
jne 0x4013d4
mov rax, qword [rbp - 0x70]
add rax, 0xffffffffffffffff
mov qword [rbp - 0x70], rax
mov eax, 0x30000
mov r11, rax
mov eax, 0x10000
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__controlfp
mov rax, qword [sym.imp.msvcrt.dll___argc]
mov rcx, qword [sym.imp.msvcrt.dll___argv]
mov rdx, qword [sym.imp.msvcrt.dll__environ]
mov rdx, qword [rdx]
mov r8, rdx
mov rcx, qword [rcx]
mov r11, rcx
mov eax, dword [rax]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401200
movabs rax, 0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [rbp - 0x7c]
mov r9, rcx
mov rcx, qword [rbp - 0x70]
mov r8, rcx
movabs rcx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004010f4
mov dword [rbp - 0x80], eax
call fcn.00401294
mov eax, dword [rbp - 0x80]
leave
ret
Function at 0x401302
Capabilities:
Accept command line arguments

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
lea rax, [rbp - 0x68]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [rbp - 0x2c]
and eax, 1
cmp eax, 0
je 0x401330
movzx eax, word [rbp - 0x28]
mov dword [rbp - 0x7c], eax
jmp 0x401338
mov eax, 0xa
mov dword [rbp - 0x7c], eax
movabs rax, 0
mov qword [rbp - 0x70], rax
call sub.kernel32.dll_GetCommandLineA
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x40137a
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [rbp - 0x78]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strstr
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
cmp rax, 0
jne 0x4013a3
lea rax, [0x00402048]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__strdup
mov qword [rbp - 0x70], rax
jmp 0x4013d4
mov rax, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
cmp rax, rcx
jbe 0x4013d4
mov rax, qword [rbp - 0x70]
add rax, 0xffffffffffffffff
movsx eax, byte [rax]
cmp eax, 0x22
jne 0x4013d4
mov rax, qword [rbp - 0x70]
add rax, 0xffffffffffffffff
mov qword [rbp - 0x70], rax
mov eax, 0x30000
mov r11, rax
mov eax, 0x10000
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__controlfp
mov rax, qword [sym.imp.msvcrt.dll___argc]
mov rcx, qword [sym.imp.msvcrt.dll___argv]
mov rdx, qword [sym.imp.msvcrt.dll__environ]
mov rdx, qword [rdx]
mov r8, rdx
mov rcx, qword [rcx]
mov r11, rcx
mov eax, dword [rax]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401200
movabs rax, 0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [rbp - 0x7c]
mov r9, rcx
mov rcx, qword [rbp - 0x70]
mov r8, rcx
movabs rcx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004010f4
mov dword [rbp - 0x80], eax
call fcn.00401294
mov eax, dword [rbp - 0x80]
leave
ret
Function at 0x140001190
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.WinHTTP_Example_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
test rax, rax
je 0x140001215
xor r9d, r9d
movzx r8d, r14w
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
test rax, rax
je 0x14000120c
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rdi, qword [rsp + 0x48]
sub rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r10, rax
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
sub rdx, r8
je 0x140001265
mov rcx, rax
mov r9, r8
sub r9, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
mov byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
movsxd rax, ebx
cmp rax, rdx
jb 0x140001250
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rdi
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
test r8, r8
je 0x1400012b4
mov rdx, qword [rsp + 0x50]
sub rdx, r8
mov rax, r8
cmp rdx, 0x1000
jb 0x1400012ac
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400012ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.140001e14
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001db0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140002764
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400027ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400027ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400027ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400027ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400027ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400027b0
xor al, al
add rsp, 0x28
ret
Function at 0x180019858
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
lea rsi, [0x180045030]
mov ebp, 0x800
lea r8, str.._._._..._._.__
mov rcx, rsi
mov r9d, 0x1000
mov edx, ebp
call fcn.180019988
xor r14d, r14d
mov eax, r14d
xor byte [rax + rsi], 0x8a
inc rax
cmp rax, rbp
jl 0x18001989a
lea rcx, [rsp + 0x20]
mov r8d, ebp
mov rdx, rsi
call fcn.180014854
jmp 0x18001994a
lea rcx, [rsp + 0x20]
call fcn.180014900
lea rcx, [rsp + 0x20]
movsx ebx, ax
call fcn.180014900
mov rcx, qword [0x180050100]
movsx rdi, di
mov edx, ebx
shl rdi, 4
mov word [rdi + rcx], bx
dec edx
je 0x180019934
dec edx
je 0x18001991d
dec edx
jne 0x18001994a
lea rcx, [rsp + 0x20]
movsx edx, ax
movsx rbx, ax
call fcn.18001489c
mov rcx, qword [0x180050100]
mov r8, rbx
mov rcx, qword [rdi + rcx + 8]
mov rdx, rax
call fcn.18001d860
jmp 0x18001994a
lea rcx, [rsp + 0x20]
call fcn.180014864
mov rcx, qword [0x180050100]
mov dword [rdi + rcx + 8], eax
jmp 0x18001994a
lea rcx, [rsp + 0x20]
call fcn.180014900
mov rdx, qword [0x180050100]
mov word [rdi + rdx + 8], ax
lea rcx, [rsp + 0x20]
call fcn.180014900
movzx edi, ax
test ax, ax
jg 0x1800198bb
mov r8, rbp
xor edx, edx
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp fcn.18001d470

Function at 0x180019988
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x1800199ce
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov ebx, edx
mov r11, rcx
xor r10d, r10d
movsxd rdi, r9d
mov eax, r10d
mov rcx, rdi
inc r10d
cdq
idiv r9d
movsxd rax, edx
sub rcx, rax
mov al, byte [rcx + r8 - 1]
xor byte [r11], al
inc r11
cmp r10d, ebx
jl 0x1800199a1
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1800199d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov ebx, edx
mov r11, rcx
test edx, edx
jle 0x1800199fd
mov eax, r10d
inc r10d
cdq
idiv r9d
movsxd rax, edx
mov cl, byte [rax + r8]
xor byte [r11], cl
inc r11
cmp r10d, ebx
jl 0x1800199e1
mov rbx, qword [rsp + 8]
ret
Function at 0x140001000
Capabilities:
Check os version

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1400241e0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
call fcn.140007610
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r11d, dword [rsp + 0x24]
cmp r11d, 5
ja 0x14000106c
jne 0x140001052
cmp dword [rsp + 0x28], 1
jae 0x14000106c
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400075e0
add rsp, 0xd8
ret
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400075e0
add rsp, 0xd8
ret

Function at 0x140001d40
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x20a0
call fcn.140007710
sub rsp, rax
mov rax, qword [0x1400241e0]
xor rax, rsp
mov qword [rsp + 0x2090], rax
lea rbx, [rcx + 0x3078]
lea rdi, [0x140025c10]
mov rbp, r8
movsxd r13, edx
mov rsi, rcx
mov r9, rbx
sub rdi, rbx
nop dword [rax + rax]
movzx eax, byte [r9]
inc r9
mov byte [rdi + r9 - 1], al
test al, al
jne 0x140001d90
lea rdx, [0x140025c10]
lea rcx, str.PYTHONPATH
call sub.KERNEL32.dll_SetEnvironmentVariableA
lea rcx, str.PYTHONHOME
call fcn.140002230
nop
movzx eax, byte [rbx]
inc rbx
mov byte [rdi + rbx - 1], al
test al, al
jne 0x140001dc0
lea rcx, [0x140025c10]
call qword [0x140027c60]
mov rax, qword [0x140027c28]
mov ebx, 1
mov dword [rax], ebx
mov rax, qword [0x140027c20]
mov rcx, rsi
mov dword [rax], ebx
call fcn.140001c50
lea rcx, [rsi + 0x78]
call qword [0x140027c80]
call qword [0x140027c40]
lea rcx, str.import_sys_n
call qword [0x140027c70]
lea rcx, str.del_sys.path_:__n
call qword [0x140027c70]
lea r11, [rsi + 0x2078]
cmp byte [r11], 0
je 0x140001e77
lea rcx, [rsp + 0x20]
sub rcx, r11
nop dword [rax]
movzx eax, byte [r11]
inc r11
mov byte [rcx + r11 - 1], al
test al, al
jne 0x140001e40
lea r8, [rsp + 0x20]
lea rdx, str.sys.path.append_r__s__
lea rcx, [rsp + 0x1030]
call fcn.140008378
lea rcx, [rsp + 0x1030]
call qword [0x140027c70]
lea rcx, [rsi + 0x1078]
lea r8, [rsp + 0x20]
sub r8, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [r8 + rcx - 1], al
test al, al
jne 0x140001e90
lea r8, [rsp + 0x20]
lea rdx, str.sys.path.append_r__s__
lea rcx, [rsp + 0x1030]
call fcn.140008378
lea rcx, [rsp + 0x1030]
call qword [0x140027c70]
xor ecx, ecx
call qword [0x140027ca0]
lea rdx, [rsi + 0x78]
lea rcx, [0x14001c590]
mov rdi, rax
call qword [0x140027cb0]
mov rcx, rdi
mov rdx, rax
call qword [0x140027ca8]
cmp rbx, r13
jge 0x140001f19
mov rdx, qword [rbp + rbx*8]
lea rcx, [0x14001c590]
call qword [0x140027cb0]
mov rcx, rdi
mov rdx, rax
call qword [0x140027ca8]
inc rbx
cmp rbx, r13
jl 0x140001ef3
lea rcx, [0x14001c58c]
call qword [0x140027c88]
lea rdx, str.argv
mov r8, rdi
mov rcx, rax
call qword [0x140027c98]
call qword [0x140027cf0]
test rax, rax
je 0x140001f53
lea rcx, str.Error_detected_starting_Python_VM.
call fcn.140001270
or eax, 0xffffffff
mov rcx, qword [rsp + 0x2090]
xor rcx, rsp
call fcn.1400075e0
mov rbx, qword [rsp + 0x20d8]
add rsp, 0x20a0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002190
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2038
call fcn.140007710
sub rsp, rax
mov rax, qword [0x1400241e0]
xor rax, rsp
mov qword [rsp + 0x2020], rax
lea rdx, [rsp + 0x20]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140002206
lea rdx, [rsp + 0x1020]
lea rcx, [rsp + 0x20]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x140002206
lea rcx, [rsp + 0x20]
call fcn.140008850
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400075e0
add rsp, 0x2038
ret
xor eax, eax
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400075e0
add rsp, 0x2038
ret

Function at 0x140002240
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x4040
call fcn.140007710
sub rsp, rax
mov rax, qword [0x1400241e0]
xor rax, rsp
mov qword [rsp + 0x4030], rax
mov rsi, rcx
lea rdx, [rsp + 0x30]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x2030]
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea rdx, [rsp + 0x2030]
mov r8d, 0x1000
mov rcx, rsi
call fcn.140003b70
call sub.KERNEL32.dll_GetCurrentProcessId
lea rdx, str._MEI_d
lea rcx, [rsp + 0x20]
mov r8d, eax
call fcn.140008378
xor edi, edi
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400088f4
mov rcx, rax
mov rbx, rax
call fcn.1400088c0
mov rcx, rbx
test eax, eax
je 0x1400022ff
call fcn.140008280
inc edi
cmp edi, 5
jl 0x1400022d0
xor eax, eax
jmp 0x14000231d
sub rsi, rbx
movzx eax, byte [rcx]
inc rcx
mov byte [rsi + rcx - 1], al
test al, al
jne 0x140002302
mov rcx, rbx
call fcn.140008280
mov eax, 1
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.1400075e0
lea r11, [rsp + 0x4040]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400027c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1030
call fcn.140007710
sub rsp, rax
mov rax, qword [0x1400241e0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rbx, rdx
lea rdx, [0x14001c6d4]
mov rdi, r8
call fcn.140004460
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call fcn.140002660
xor ebx, ebx
mov rdi, rax
test rsi, rsi
je 0x1400028b0
test rax, rax
je 0x1400028b0
mov rcx, rsi
call fcn.140009750
test eax, eax
jne 0x14000289c
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov r9, rsi
mov edx, 0x1000
mov r8d, 1
call fcn.140009a80
cmp rax, 0xffffffffffffffff
jne 0x14000285f
mov rcx, rsi
call fcn.140009778
test eax, eax
je 0x140002883
mov rcx, rsi
jmp 0x140002894
lea rcx, [rsp + 0x20]
mov r9, rdi
mov edx, 0x1000
mov r8d, 1
call fcn.1400096c0
mov rcx, rdi
call fcn.140009778
test eax, eax
jne 0x140002891
mov rcx, rsi
call fcn.140009750
test eax, eax
je 0x140002830
jmp 0x14000289c
mov rcx, rdi
call fcn.14000952c
or ebx, 0xffffffff
mov rcx, rsi
call fcn.14000940c
mov rcx, rdi
call fcn.14000940c
mov eax, ebx
jmp 0x1400028b3
or eax, 0xffffffff
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400075e0
add rsp, 0x1030
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400028f0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2110
call fcn.140007710
sub rsp, rax
mov rax, qword [0x1400241e0]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rdx, rcx
lea rcx, [rsp + 0x100]
xor edi, edi
mov r8d, 0x1000
mov dword [rsp + 0x50], edi
call fcn.1400038f0
mov ebx, 1
lea ecx, [rdi + 0x16]
mov edx, ebx
call fcn.14000a00c
lea ecx, [rdi + 2]
mov edx, ebx
call fcn.14000a00c
lea ecx, [rdi + 0xf]
mov edx, ebx
call fcn.14000a00c
lea ecx, [rdi + 0x15]
mov edx, ebx
call fcn.14000a00c
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x58], 0x18
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
mov dword [rsp + 0xcc], 0x101
mov word [rsp + 0xd0], bx
call fcn.14000863c
mov rcx, rax
call fcn.140008614
mov ecx, eax
call fcn.140009bfc
mov qword [rsp + 0xe0], rax
call fcn.14000863c
lea rcx, [rax + 0x30]
call fcn.140008614
mov ecx, eax
call fcn.140009bfc
mov qword [rsp + 0xe8], rax
call fcn.14000863c
lea rcx, [rax + 0x60]
call fcn.140008614
mov ecx, eax
call fcn.140009bfc
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [rsp + 0x58]
mov rdx, rax
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140002a6e
mov rcx, qword [rsp + 0x70]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x50]
jmp 0x140002a7d
lea rcx, str.Error_creating_child_process__n
call fcn.140001270
or eax, 0xffffffff
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.1400075e0
mov rbx, qword [rsp + 0x2128]
add rsp, 0x2110
pop rdi
ret