joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003250
Capabilities:
Get common file path

Disassembly:
push rbx
push rdi
sub rsp, 0x248
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edi, edi
mov qword [rsp + 0x268], rdi
mov ebx, edi
mov qword [rsp + 0x270], rdi
mov dword [rsp + 0x260], edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400032a3
mov dword [rax], 0x1d
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x140003318
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140001510
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0xe
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [0x140005080]
call fcn.140001400
test eax, eax
je 0x140003423
xor ecx, ecx
mov ebx, 0x5a
call fcn.140001000
mov rcx, rax
lea r9, [rsp + 0x260]
lea r8, [rsp + 0x268]
movzx edx, bx
call fcn.140003440
test eax, eax
je 0x140003423
movss xmm0, dword [0x140005008]
mulss xmm0, dword [0x140004100]
mov rdx, qword [0x1400050d8]
mov ecx, dword [0x1400050d0]
cvttss2si rax, xmm0
imul eax, eax, 0x2710
neg rax
mov qword [rsp + 0x278], rax
call fcn.140003910
lea rdx, [rsp + 0x278]
xor ecx, ecx
call fcn.140003932
call fcn.140003520
mov edx, dword [rsp + 0x260]
lea r8, [rsp + 0x270]
mov rcx, qword [rsp + 0x268]
call fcn.140002fa0
test eax, eax
je 0x140003423
mov rcx, qword [rsp + 0x270]
call fcn.140002e70
xor eax, eax
add rsp, 0x248
pop rdi
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x248
pop rdi
pop rbx
ret
Function at 0x1800018b0
Capabilities:
Enumerate process modules

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov qword [rsp + 0x40], 0
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x30], 0
je 0x1800019a5
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x18000199a
cmp dword [rsp + 0x20], 0
je 0x18000199a
mov eax, dword [rsp + 0x20]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000199a
mov eax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 8
div rcx
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x18000198f
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1800019c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
sub rsp, 0x88
mov eax, 4
mov eax, eax
mov ecx, dword [0x1800373c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x1800372f8], eax
jle 0x180001a34
lea rcx, [0x1800372f8]
call fcn.180027e0c
cmp dword [0x1800372f8], 0xffffffff
jne 0x180001a34
lea rcx, [0x1800372e8]
call fcn.18000f4c0
lea rcx, [0x18002a450]
call fcn.180027d4c
nop
lea rcx, [0x1800372f8]
call fcn.180027da0
movzx eax, byte [rsp + 0x90]
test eax, eax
je 0x180001b04
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x60]
lea rcx, [0x1800372e8]
call fcn.180019c10
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x68]
lea rcx, [0x1800372e8]
call fcn.180018a30
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.180011c10
movzx eax, al
test eax, eax
jne 0x180001b04
lea rdx, [rsp + 0x98]
lea rcx, [0x1800372e8]
call fcn.180011ec0
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x98]
lea rcx, [0x1800372e8]
call fcn.180011ec0
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov r9, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdx, [rsp + 0x98]
lea rcx, [0x1800372e8]
call fcn.180018cc0
jmp 0x180001ba9
movzx eax, byte [rsp + 0x90]
test eax, eax
jne 0x180001ba9
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x70]
lea rcx, [0x1800372e8]
call fcn.180019c10
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x78]
lea rcx, [0x1800372e8]
call fcn.180018a30
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.180011c10
movzx eax, al
test eax, eax
je 0x180001ba9
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x98]
lea rcx, [0x1800372e8]
call fcn.180011ec0
mov ecx, dword [rsp + 0x28]
mov dword [rax], ecx
add rsp, 0x88
ret

Function at 0x1800053d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp dword [rsp + 0x48], 1
jne 0x18000540e
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1800040c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1800144d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1800361c0]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x18001450d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x180014514
mov al, 1
jmp 0x18001466c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.180018c40
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.180018c40
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.180018c90
movzx eax, al
test eax, eax
je 0x180014569
xor al, al
jmp 0x18001466c
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1800145d9
cmp dword [rsp + 0x30], 1
je 0x1800145e5
cmp dword [rsp + 0x30], 3
je 0x18001465a
jmp 0x18001466a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x180014631
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x180014631
xor al, al
jmp 0x18001466c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x18001464b
mov dword [rsp + 0x34], 1
jmp 0x180014653
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x18001466c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x18001466c
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180027f90
add rsp, 0xa8
ret
Function at 0x180027480
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x1800274a5
xor eax, eax
jmp 0x18002766b
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x1800274ce
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x18002766b
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x18002756d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.18000d790
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.180018620
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x18002765b
mov rcx, qword [rsp + 0x70]
call fcn.1800162b0
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x18002760e
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x18002760c
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x18002766b
jmp 0x180027593
cmp qword [rsp + 0x20], 0
jbe 0x18002765b
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x180027670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x1800276a9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x180027797
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x18002773f
cmp qword [rsp + 0x20], 0
jle 0x18002773f
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x1800276e9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.180018620
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x180027787
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x180027787
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400d6410]
mov dword [rax], 1
mov rax, qword [0x1400d6420]
mov dword [rax], 1
mov rax, qword [0x1400d6430]
mov dword [rax], 1
mov rax, qword [0x1400d6390]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140039200
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400b28d0
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x1400392c5
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c37ee
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x1400392a6
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140039298
test rsi, rsi
je 0x1400c37ee
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x140039258
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x1400392f4
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140039310
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x1400393cd
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c37f4
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x1400393ae
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x1400393a0
test rsi, rsi
je 0x1400c37f4
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x140039360
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140057b90
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, qword [0x1400e7ed0]
mov rsi, rcx
test rbx, rbx
je 0x140057c10
mov rax, qword [0x1400d6560]
mov rcx, qword [rax + 0x48]
cmp rbx, rcx
je 0x140057c00
mov rdx, qword [0x1400e8108]
test rdx, rdx
je 0x140057d00
mov rcx, rbx
mov rbx, qword [sym.imp.python312.dll_PyNumber_InPlaceAdd]
call rbx
mov rcx, rax
mov rdx, rsi
mov rax, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rbx, qword [sym.imp.python312.dll_PyNumber_InPlaceAdd]
jmp 0x140057be1
lea r15, str.NUITKA_ONEFILE_BINARY
mov rcx, r15
call fcn.140039200
test rax, rax
je 0x140057d20
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r13, r14
lea r12, [r15 + 0x28]
mov word [rsp + 0x40], cx
lea rbp, [rsp + 0x3a]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov eax, 0x4e
nop
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, r15
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c3882
cmp word [r13], 0
movzx edx, word [rsp + 0x3c]
mov rax, r13
je 0x140057cae
nop word [rax + rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x140057ca0
test rbx, rbx
je 0x1400c3882
mov word [rax], dx
add r15, 1
xor edx, edx
add r13, 2
mov word [rax + 2], dx
movzx eax, byte [r15]
test al, al
jne 0x140057c60
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call qword [sym.imp.python312.dll_PyThreadState_Get]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.140057a20
mov rbx, rax
mov qword [0x1400e7ed0], rbx
jmp 0x140057bb2
lea rcx, [0x1400d2a57]
call qword [sym.imp.python312.dll_PyUnicode_FromString]
mov qword [0x1400e8108], rax
mov rdx, rax
jmp 0x140057bd2
mov rbx, qword [0x1400e7ee8]
test rbx, rbx
jne 0x140057cf1
cmp byte [0x1400e8102], 0
jne 0x140057d3f
mov ecx, 1
call fcn.14002b230
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400e7f00]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
mov qword [0x1400e7ee8], rax
mov rbx, rax
test rax, rax
je 0x140057d6d
mov eax, dword [rax]
add eax, 1
je 0x140057cf1
mov dword [rbx], eax
jmp 0x140057cf1
call qword [sym.imp.python312.dll_PyErr_Print]
call sub.msvcrt.dll_abort
nop
nop dword [rax]
call sub.msvcrt.dll_abort
nop
Function at 0x140058600
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rsi, str.NUITKA_ONEFILE_BINARY
mov ebx, ecx
mov rcx, rsi
call fcn.140039200
test rax, rax
je 0x140058750
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r15, r14
lea r12, [rsi + 0x28]
mov word [rsp + 0x40], cx
mov r13, rax
lea rbp, [rsp + 0x3a]
mov eax, 0x4e
lea rdi, [rsp + 0x3c]
nop word [rax + rax]
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, rsi
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c389a
cmp word [r15], 0
movzx edx, word [rsp + 0x3c]
mov rax, r15
je 0x1400586b6
nop dword [rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x1400586a8
test rbx, rbx
je 0x1400c389a
mov word [rax], dx
add rsi, 1
xor edx, edx
add r15, 2
mov word [rax + 2], dx
movzx eax, byte [rsi]
test al, al
jne 0x140058668
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call qword [sym.imp.python312.dll_PyThreadState_Get]
mov rcx, qword [0x1400e8620]
mov rsi, rax
mov rax, qword [0x1400d6560]
mov rbx, qword [rax + 0x1c0]
test rcx, rcx
je 0x1400587c5
mov rdx, rbx
call fcn.1400299f0
mov r8, r13
mov rcx, rsi
mov rbx, rax
mov rdx, rax
call fcn.14004c520
mov rdx, qword [rbx]
test edx, edx
js 0x140058732
sub rdx, 1
mov qword [rbx], rdx
je 0x1400587ad
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x1400e7ee0]
lea rsi, [0x1400e7ee0]
test bl, bl
je 0x140058770
mov rax, qword [0x1400e7ee8]
lea rsi, [0x1400e7ee8]
test rax, rax
jne 0x140058732
cmp byte [0x1400e8102], 0
jne 0x140058786
movzx ecx, bl
call fcn.14002b230
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400e7f00]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
mov qword [rsi], rax
test rax, rax
je 0x1400587ef
mov edx, dword [rax]
add edx, 1
je 0x140058732
mov dword [rax], edx
jmp 0x140058732
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [sym.imp.python312.dll__Py_Dealloc]
mov rax, qword [rsp + 0x28]
jmp 0x140058732
mov rcx, qword [0x1400e8598]
mov rdi, qword [rax + 0x1b0]
test rcx, rcx
je 0x1400587fa
mov rdx, rdi
call fcn.1400299f0
mov qword [0x1400e8620], rax
mov rcx, rax
jmp 0x140058709
call qword [sym.imp.python312.dll_PyErr_Print]
call sub.msvcrt.dll_abort
lea rcx, [0x1400ce1db]
call qword [sym.imp.python312.dll_PyImport_ImportModule]
mov qword [0x1400e8598], rax
mov rcx, rax
test rax, rax
je 0x1400c389a
jmp 0x1400587d8
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop