joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801249e8
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
add rcx, 0x40
xor edx, edx
mov r8d, 0x126
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x40
lea rdx, [0x1802556c0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
lea rdx, [rdi + 6]
sub r8, rdi
mov r9d, 8
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
lea rdx, [rdx + 8]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx - 9]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx - 0xa]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx - 0xb]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx - 0xc]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx - 0xd]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx - 0xe]
shl rcx, 8
or rcx, rax
xor qword [r8 + rdx - 0xe], rcx
sub r9, 1
jne 0x180124a2e
mov al, byte [rdi]
mov byte [rbx + 0x164], al
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18012ed40
Capabilities:
Write file on windows

Disassembly:
test rdx, rdx
je 0x18012eda0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r10, qword [r8 + 0x18]
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r10, r10
je 0x18012ed91
mov rax, qword [r8 + 0x20]
mov r9, qword [r8]
sub rax, r10
test r9, r9
jne 0x1801ccf74
cmp rdx, rax
jg 0x18012eda1
mov rcx, qword [rbx + 0x18]
mov r8, rdi
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x18], rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
sub rdx, rax
mov rcx, rbx
call fcn.18012edb4
test eax, eax
jne 0x18012ed7e
jmp 0x18012ed91
cmp rdi, rax
jg 0x1801ccf81
mov rcx, r10
jmp 0x18012ed82
mov rcx, qword [r8 + 0x28]
mov edx, 1
sub r10, rcx
mov r8, r10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 0x28]
mov r8, rdi
mov r9, qword [rbx]
mov edx, 1
mov rcx, rsi
mov qword [rbx + 0x18], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
nop
jmp 0x18012ed91
Function at 0x18012edb4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x18]
xor edi, edi
mov r14, rdx
mov rbx, rcx
test rsi, rsi
je 0x1801ccfc4
cmp qword [rcx], rdi
jne 0x1801ccfcb
sub rsi, qword [rcx + 0x28]
lea r15, [rcx + 0x10]
mov rax, qword [r15]
mov rbp, qword [rax + 0x10]
mov rcx, rbp
sar rcx, 3
cmp rbp, 0x1000000
lea rax, [rbp + 0x400]
cmovle rcx, rax
movabs rax, 0x7fffffffffffffff
cmp rcx, rdx
cmovg r14, rcx
sub rax, rbp
cmp r14, rax
jg 0x1801cd000
add rbp, r14
mov rcx, r15
mov rdx, rbp
call sym.python310.dll__PyBytes_Resize
test eax, eax
jne 0x1801ccfb8
mov rcx, qword [r15]
add rcx, 0x20
mov qword [rbx + 0x28], rcx
lea rax, [rcx + rsi]
mov qword [rbx + 0x18], rax
lea rax, [rcx + rbp]
mov qword [rbx + 0x20], rax
lea eax, [rdi + 1]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
xor eax, eax
jmp 0x18012ee63
mov rcx, qword [rcx + 0x28]
mov edx, 1
mov r9, qword [rbx]
sub rsi, rcx
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
sub rdx, rcx
mov qword [rbx + 0x18], rcx
cmp r14, rdx
setle dil
mov eax, edi
jmp 0x18012ee63
mov dword [rbx + 8], 3
jmp 0x1801ccfc4

Function at 0x180142f6c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13d, ecx
mov rbx, r8
lea rcx, [0x180180fb0]
mov r12, rdx
xor esi, esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_thread_local_invalid_parameter_handler]
mov r14d, 0x7fffffff
mov r15, rax
cmp rbx, r14
cmovbe r14d, ebx
call sym.python310.dll_PyEval_SaveThread
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r8d, r14d
mov rdx, r12
mov ecx, r13d
and dword [rax], 0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd rbp, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rbx
mov edi, dword [rax]
call sym.python310.dll_PyEval_RestoreThread
test rbp, rbp
js 0x1801d1480
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_thread_local_invalid_parameter_handler]
test esi, esi
jne 0x1801d14ae
test rbp, rbp
js 0x1801d149d
mov rax, rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp edi, 4
jne 0x180142fec
call sym.python310.dll_PyErr_CheckSignals
mov esi, eax
test eax, eax
je 0x180142fb0
jmp 0x180142fec
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
xor edx, edx
call sym.python310.dll_PyErr_SetFromErrnoWithFilenameObjects
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
or rax, 0xffffffffffffffff
jmp 0x180143009
Function at 0x1801455c8
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1803e3008]
xor rax, rsp
mov qword [rsp + 0x240], rax
movabs rax, 0x3a0078003d
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edi, edi
test eax, eax
je 0x1801456c2
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rsi, eax
test eax, eax
je 0x1801456c2
mov rcx, rsi
cmp rsi, 0x104
ja 0x1801d1de2
mov r8d, 2
lea rdx, [0x180242618]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x180145687
mov r8d, 2
lea rdx, [0x180242620]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x180145687
movzx eax, word [rbx]
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov word [rsp + 0x22], ax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
lea rax, [rsp + 0x30]
cmp rbx, rax
jne 0x1801d1e2c
test esi, esi
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180181080
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor eax, eax
jmp 0x18014569d
add rcx, rcx
call sym.python310.dll_PyMem_RawMalloc
mov rbx, rax
test rax, rax
jne 0x1801d1e01
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
jmp 0x1801456c2
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x18014563b
mov rcx, qword [0x1803fc5d0]
mov rdx, rbx
call qword [case.0x18005bf29.3]
nop
jmp 0x1801456c2
mov rcx, qword [0x1803fc5d0]
mov rdx, rbx
call qword [case.0x18005bf29.3]
nop
jmp 0x180145695
Function at 0x18014f844
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x18014f8c5
mov rcx, rbx
call sym.python310.dll_PyModule_GetState
mov rcx, rax
call fcn.18014f944
mov rbx, rax
test rax, rax
je 0x1801d5aa7
lea rcx, [rax + 0x10]
and dword [rcx + 0x18], 0
and qword [rcx], 0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov rax, qword [0x18044f1f0]
cmp qword [rax + 0x58], 0
jne 0x1801d5a97
test rdi, rdi
jne 0x18014f906
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rdx + 8]
test dword [rax + 0xa8], 0x10000000
jne 0x18014f921
mov rcx, rdi
call sym.python310.dll_PyObject_CheckBuffer
test eax, eax
je 0x18014f93b
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sym.python310.dll_PyObject_GetBuffer
cmp eax, 0xffffffff
je 0x18014f934
cmp dword [rsp + 0x44], 1
jle 0x18014f859
jmp 0x1801d5a74
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
call fcn.18014fb94
lea rcx, [rsp + 0x20]
call sym.python310.dll_PyBuffer_Release
jmp 0x18014f8b4
lea rdx, str.Strings_must_be_encoded_before_hashing
mov rcx, qword [sym.python310.dll_PyExc_TypeError]
call sym.python310.dll_PyErr_SetString
xor eax, eax
jmp 0x18014f8b7
lea rdx, str.object_supporting_the_buffer_API_required
jmp 0x18014f928
mov rcx, qword [sym.python310.dll_PyExc_BufferError]
lea rdx, str.Buffer_must_be_single_dimension
call sym.python310.dll_PyErr_SetString
lea rcx, [rsp + 0x20]
call sym.python310.dll_PyBuffer_Release
nop
jmp 0x18014f934
sub qword [rbx], 1
jne 0x1801d5aa7
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
test rdi, rdi
je 0x18014f934
jmp 0x1801d5a87
Function at 0x1801515a0
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
xor edx, edx
lea rcx, str._winapi.CreatePipe
mov ebx, r8d
call sym.python310.dll_PySys_Audit
test eax, eax
js 0x18015162d
call sym.python310.dll_PyEval_SaveThread
mov r9d, ebx
lea rdx, [rsp + 0x38]
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rcx, rdi
mov ebx, eax
call sym.python310.dll_PyEval_RestoreThread
test ebx, ebx
je 0x1801d5dc6
mov rcx, qword [rsp + 0x38]
call sym.python310.dll_PyLong_FromUnsignedLongLong
mov rcx, qword [rsp + 0x30]
mov rbx, rax
call sym.python310.dll_PyLong_FromUnsignedLongLong
mov rdx, rax
lea rcx, [0x180242fdc]
mov r8, rbx
call sym.python310.dll_Py_BuildValue
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x180151622
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, eax
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
nop
jmp 0x180151622

Function at 0x18016214c
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
mov rbp, rcx
test eax, eax
lea rcx, str.replace
mov rsi, rdx
lea rdx, str.rename
cmove rcx, rdx
xor ebx, ebx
test eax, eax
setne bl
cmp r8d, 0xffffff9c
jne 0x1801db1ee
cmp r9d, r8d
jne 0x1801db1ee
mov r9, qword [rsi + 0x30]
lea rdx, str.OOii
mov r8, qword [rbp + 0x30]
lea rcx, str.os.rename
or eax, 0xffffffff
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call sym.python310.dll_PySys_Audit
test eax, eax
js 0x180162210
call sym.python310.dll_PyEval_SaveThread
mov rdx, qword [rsi + 0x18]
mov r8d, ebx
mov rcx, qword [rbp + 0x18]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, rdi
mov ebx, eax
call sym.python310.dll_PyEval_RestoreThread
test ebx, ebx
je 0x1801db1d2
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor eax, eax
jmp 0x1801621fb
mov r9, qword [rsi + 0x30]
xor edx, edx
mov r8, qword [rbp + 0x30]
mov rcx, qword [sym.python310.dll_PyExc_OSError]
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilenameObjects
nop
jmp 0x1801621fb
lea rdx, str.src_dir_fd_and_dst_dir_fd
call fcn.1801f2974
nop
jmp 0x180162210
Function at 0x180173608
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
or r9d, 0xffffffff
lea rcx, str.os.rmdir
cmp r8d, 0xffffff9c
mov rsi, rdx
cmovne r9d, r8d
mov r8, qword [rdx + 0x30]
lea rdx, [0x18023d540]
call sym.python310.dll_PySys_Audit
test eax, eax
js 0x180173688
call sym.python310.dll_PyEval_SaveThread
mov rcx, qword [rsi + 0x18]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor ebx, ebx
mov rcx, rdi
test eax, eax
sete bl
call sym.python310.dll_PyEval_RestoreThread
test ebx, ebx
jne 0x1801dfbae
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x180173678
mov r8, qword [rsi + 0x30]
xor r9d, r9d
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor edx, edx
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilenameObjects
nop
jmp 0x180173678

Function at 0x180180c60
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor ecx, ecx
cmp dword [0x180424a18], ecx
je 0x180180c79
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1801eb9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
movsxd rdi, r8d
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm6
mov rdx, qword [rdx + 0x10]
mov r8d, edi
mov r13d, ebx
mov r14d, ebx
xorps xmm6, xmm6
mov r15d, ebx
call fcn.1801ebedc
test eax, eax
jne 0x1801eb9eb
xor eax, eax
jmp 0x1801ebaf9
mov r10, qword [rsi + 0x10]
cmp r10, rdi
jg 0x1801eba00
xor ecx, ecx
call sym.python310.dll_PyLong_FromLong
jmp 0x1801ebaf9
mov rdx, qword [rsi]
cmp edi, 1
jne 0x1801eba0d
movsx ecx, byte [rdx]
jmp 0x1801eba35
cmp edi, 2
jne 0x1801eba17
movsx ecx, word [rdx]
jmp 0x1801eba35
cmp edi, 3
jne 0x1801eba33
movzx eax, byte [rdx + 1]
movsx ecx, byte [rdx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
add ecx, eax
jmp 0x1801eba35
mov ecx, dword [rdx]
mov r8, rdi
mov r9d, send
mov rsi, rdx
cmp edi, 1
jne 0x1801eba4d
movsx r11d, byte [rsi + r8]
jmp 0x1801eba83
cmp edi, 2
jne 0x1801eba59
movsx r11d, word [rsi + r8]
jmp 0x1801eba83
cmp edi, 3
jne 0x1801eba7f
movzx eax, byte [rdx + r8 + 1]
movsx r11d, byte [rdx + r8 + 2]
shl r11d, 8
add r11d, eax
movzx eax, byte [rsi + r8]
shl r11d, 8
add r11d, eax
jmp 0x1801eba83
mov r11d, dword [rsi + r8]
cmp r11d, ecx
je 0x1801ebacf
mov r12d, ebx
setl r12b
mov eax, r12d
xor eax, 1
cmp r9d, eax
jne 0x1801ebac9
test r13d, r13d
je 0x1801ebac0
xorps xmm0, xmm0
cmp ecx, r14d
jge 0x1801ebaaf
sub r14d, ecx
mov eax, r14d
jmp 0x1801ebab4
mov eax, ecx
sub eax, r14d
cvtsi2sd xmm0, rax
inc r15d
addsd xmm6, xmm0
mov r13d, 1
mov r14d, ecx
mov ecx, r11d
mov r9d, r12d
add r8, rdi
cmp r8, r10
jl 0x1801eba41
test r15d, r15d
je 0x1801ebaf2
movd xmm0, r15d
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
cvttsd2si rbx, xmm6
mov ecx, ebx
call sym.python310.dll_PyLong_FromUnsignedLong
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801ed730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movsxd rbx, r8d
mov rsi, rdx
mov rdx, qword [rdx + 0x10]
mov r8d, ebx
xor r12d, r12d
xor edi, edi
xor r14d, r14d
call fcn.1801ebedc
test eax, eax
jne 0x1801ed772
xor eax, eax
jmp 0x1801ed860
mov r10, qword [rsi + 0x10]
cmp r10, rbx
jg 0x1801ed787
xor ecx, ecx
call sym.python310.dll_PyLong_FromLong
jmp 0x1801ed860
mov rdx, qword [rsi]
cmp ebx, 1
jne 0x1801ed794
movsx ecx, byte [rdx]
jmp 0x1801ed7bc
cmp ebx, 2
jne 0x1801ed79e
movsx ecx, word [rdx]
jmp 0x1801ed7bc
cmp ebx, 3
jne 0x1801ed7ba
movzx eax, byte [rdx + 1]
movsx ecx, byte [rdx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
add ecx, eax
jmp 0x1801ed7bc
mov ecx, dword [rdx]
mov r9, rbx
mov r8d, send
mov rsi, rdx
cmp ebx, 1
jne 0x1801ed7d4
movsx r11d, byte [rsi + r9]
jmp 0x1801ed80a
cmp ebx, 2
jne 0x1801ed7e0
movsx r11d, word [rsi + r9]
jmp 0x1801ed80a
cmp ebx, 3
jne 0x1801ed806
movzx eax, byte [rdx + r9 + 1]
movsx r11d, byte [rdx + r9 + 2]
shl r11d, 8
add r11d, eax
movzx eax, byte [rsi + r9]
shl r11d, 8
add r11d, eax
jmp 0x1801ed80a
mov r11d, dword [rsi + r9]
cmp r11d, ecx
je 0x1801ed84c
xor r15d, r15d
cmp r11d, ecx
setl r15b
mov eax, r15d
xor eax, 1
cmp r8d, eax
jne 0x1801ed846
test r12d, r12d
je 0x1801ed83e
cmp ecx, edi
jge 0x1801ed831
sub edi, ecx
jmp 0x1801ed837
mov eax, ecx
sub eax, edi
mov edi, eax
cmp edi, r14d
cmova r14d, edi
mov r12d, 1
mov edi, ecx
mov ecx, r11d
mov r8d, r15d
add r9, rbx
cmp r9, r10
jl 0x1801ed7c8
mov ecx, r14d
call sym.python310.dll_PyLong_FromUnsignedLong
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1801f2390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r9
mov r11, rdx
mov rax, qword [rsp + 0x18]
xor r9d, r9d
mov r10d, r9d
mov rbx, rdx
cmp r8, rax
jne 0x1801f23b8
mov r10, rcx
mov byte [rsp + 0x10], r9b
mov rax, qword [rsp + 0x18]
cmp r8, rax
je 0x1801f23ca
mov r10, r11
mov byte [rsp + 0x10], 1
mov rax, qword [rsp + 0x18]
test rax, rax
jle 0x1801f23fc
sub r10, r11
mov cl, byte [rbx]
mov al, byte [r10 + rbx]
inc rbx
xor cl, al
mov rdx, rbx
mov al, byte [rsp + 0x10]
sub rdx, r11
or cl, al
mov byte [rsp + 0x10], cl
mov rcx, qword [rsp + 0x18]
cmp rdx, rcx
jl 0x1801f23d7
mov cl, byte [rsp + 0x10]
mov rbx, qword [rsp + 8]
test cl, cl
sete r9b
mov eax, r9d
ret
Function at 0x1801f3248
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rdx
xor ebp, ebp
call sym.python310.dll_PyEval_SaveThread
mov rcx, qword [rsi + 0x18]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov rbx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rcx, rbx
mov r14d, eax
call sym.python310.dll_PyEval_RestoreThread
test r14d, r14d
jne 0x1801f3355
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x10b
jne 0x1801f333b
mov rcx, qword [rsi + 0x28]
movabs rdx, 0x3fffffffffffffff
lea rax, [rcx + 1]
cmp rax, rdx
ja 0x1801f334e
lea rcx, [rcx*2 + 2]
call sym.python310.dll_PyMem_Malloc
mov rdi, rax
test rax, rax
je 0x1801f334e
mov rdx, qword [rsi + 0x28]
mov rcx, rax
mov r8, qword [rsi + 0x18]
inc rdx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rcx, rdi
call fcn.1801f27f8
cmp eax, 0xffffffff
je 0x1801f331e
call sym.python310.dll_PyEval_SaveThread
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x58]
mov rbx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rcx, rbx
mov r14d, eax
call sym.python310.dll_PyEval_RestoreThread
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1803fc5f8]
mov rdx, rdi
mov ebp, eax
call qword [case.0x180096615.3]
test r14d, r14d
jne 0x1801f3355
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, ebp
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x1801f336b
call sym.python310.dll_PyErr_NoMemory
jmp 0x1801f336b
mov r8, qword [rsp + 0x50]
lea rcx, str._LL_
mov rdx, qword [rsp + 0x58]
call sym.python310.dll__Py_BuildValue_SizeT
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1801f38a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
lea rcx, str.access
mov edx, dword [rsp + 0x58]
mov esi, r8d
call fcn.1800bb82c
test eax, eax
je 0x1801f38ce
or eax, 0xffffffff
jmp 0x1801f3929
cmp dword [rsp + 0x50], 0
je 0x1801f38ea
lea rdx, str.effective_ids
lea rcx, str.access
call fcn.1801f2974
jmp 0x1801f38c9
call sym.python310.dll_PyEval_SaveThread
mov rcx, qword [rdi + 0x18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
mov edi, eax
call sym.python310.dll_PyEval_RestoreThread
cmp edi, 0xffffffff
je 0x1801f3925
and dil, 0x11
mov edx, 1
cmp dil, dl
sete cl
test sil, 2
setne al
test al, cl
je 0x1801f3927
xor edx, edx
mov eax, edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1801f4440
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
lea rcx, str.os.kill
mov r9, r8
mov edi, edx
mov r8d, edx
lea rdx, [0x180370d58]
call sym.python310.dll_PySys_Audit
test eax, eax
jns 0x1801f4473
xor eax, eax
jmp 0x1801f4523
cmp ebx, 1
ja 0x1801f449d
mov edx, edi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x1801f44ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, eax
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x1801f44de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, eax
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x1801f4523
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
jmp 0x1801f4523
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1801f4509
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.python310.dll_PyExc_OSError]
xor r8d, r8d
mov edx, eax
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
mov rbx, rax
jmp 0x1801f4517
inc qword [sym.python310.dll__Py_NoneStruct]
lea rbx, sym.python310.dll__Py_NoneStruct
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1801f5d38
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
lea rcx, str.os.system
mov r8, rdx
lea rdx, [0x18038a160]
call sym.python310.dll_PySys_Audit
test eax, eax
jns 0x1801f5d69
or eax, 0xffffffff
jmp 0x1801f5d9f
call sym.python310.dll_PyEval_SaveThread
lea rcx, [0x180180fb0]
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_thread_local_invalid_parameter_handler]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_thread_local_invalid_parameter_handler]
mov rcx, rsi
call sym.python310.dll_PyEval_RestoreThread
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180202c5c
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rdx
test r8d, r8d
je 0x180202c86
call fcn.180204c0c
mov rdi, rax
test rax, rax
je 0x180202d21
call sym.python310.dll_PyEval_SaveThread
lea r8, [rdi + 0x10]
mov rcx, rdi
neg rcx
mov rbx, rax
mov rcx, rsi
sbb rdx, rdx
and rdx, r8
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov rcx, rbx
mov esi, eax
call sym.python310.dll_PyEval_RestoreThread
test rdi, rdi
je 0x180202d08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
jne 0x180202cce
mov dword [rdi + 0x38], 1
jmp 0x180202ce0
cmp ebx, 0x217
jne 0x180202ce5
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, rdi
jmp 0x180202d21
sub qword [rdi], 1
jne 0x180202cf5
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
xor r8d, r8d
mov edx, ebx
mov rcx, qword [sym.python310.dll_PyExc_OSError]
call sym.python310.dll_PyErr_SetExcFromWindowsErrWithFilename
jmp 0x180202d21
test esi, esi
jne 0x180202d13
xor r8d, r8d
xor edx, edx
jmp 0x180202cfa
inc qword [sym.python310.dll__Py_NoneStruct]
lea rax, sym.python310.dll__Py_NoneStruct
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret