joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18013b420
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x1801ca118]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
or r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18013b4cf
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x18013b597
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x18013b585
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x18013b585
shr ecx, 1
je 0x18013b543
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
nop
cmp word [rax], 0x2f
jne 0x18013b539
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x18013b530
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.18013b2b0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.18013af10
jmp 0x18013b59f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.18013b5c0
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.180137e50
add rsp, 0xae0
pop rbx
ret
Function at 0x18013b6a0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1801ca118]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x18015b240]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x18015b244]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x18015b228]
mov word [rsp + 0x6c], ax
mov eax, Ordinal_50
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x18015b238]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x18013b7a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18013b758
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x18013b7c7
inc ax
mov word [rsp + 0x6a], ax
jmp 0x18013b773
cmp eax, 0xe7
jne 0x18013b7c7
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x18013b7c7
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x18013b738
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180137e50
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x18013b7a9

Function at 0x18013b7d0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x18013b7f0
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x18013b7e6
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18013b7e6
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18013b87b
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x18013b890
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x18013b864
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call fcn.18013b610
mov rbp, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x18013b8a0
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
jne 0x18013b8b6
mov al, 1
add rsp, 0x30
pop rdi
ret
test rcx, rcx
jne 0x18013b8c3
xor al, al
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18013b8bb
test rdx, rdx
je 0x18013b8bb
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x50]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18013b8fa
cmp dword [rsp + 0x50], edi
jne 0x18013b8fa
mov ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180140520
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x18025d93c]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x180140567
mov rax, qword [0x18025d930]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180140574
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x180140550
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x180140567
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.1801408a0
mov edi, eax
test eax, eax
jne 0x18014065d
mov r9d, dword [0x18025d93c]
cmp ebx, r9d
jae 0x1801405ec
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x18025d930]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x1801405e5
mov edx, esi
mov ecx, ebx
call fcn.180140790
mov edi, eax
test eax, eax
jne 0x1801405ec
mov r9d, dword [0x18025d93c]
inc ebx
cmp ebx, r9d
jb 0x1801405b0
cmp qword [rsp + 0x20], 0
je 0x18014065b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180140647
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180140638
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180140610
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18025c640]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x180140790
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x30]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x18025d930]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1801407f4
mov eax, 0xa
jmp 0x180140883
test esi, esi
je 0x180140816
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180140839
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180140839
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180140832
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180140839
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
movzx eax, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1801408a0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1801ca118]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov r14d, edx
xor edx, edx
mov qword [rcx], r15
mov rbx, rcx
mov qword [rcx + 8], r15
mov ebp, r8d
mov edi, r15d
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180140a48
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_30
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1801409e5
lea edi, [r15 + 1]
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x1801409a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x1801409a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x1801409a0
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180140962
mov dword [rbx + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x18025c640]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x1801409c8
jmp 0x180140993
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180140993
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [rbx + 8], eax
mov rcx, qword [0x18025c640]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x1801409c8
mov qword [rbx], rax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_30
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180140910
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1801409e5
mov r8, qword [rbx]
mov edi, r15d
test r8, r8
je 0x1801409e5
mov rcx, qword [0x18025c640]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x180140a48
cmp qword [rbx], r15
je 0x180140a43
mov edi, r15d
cmp dword [rbx + 0xc], r15d
jbe 0x180140a43
mov rax, qword [rbx]
xor edx, edx
mov ecx, edi
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180140a3c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.180141030
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180140a00
mov eax, r15d
jmp 0x180140a4d
mov eax, 9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180137e50
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801411e0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rcx
je 0x18014124f
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x180141238
mov qword [rsp + 0x38], rsi
mov rax, qword [rdi]
xor edx, edx
mov r8d, dword [rax + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18014122c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x180141200
mov rsi, qword [rsp + 0x38]
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x18025c640]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180141310
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x180141350
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x18025d920]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18014138e
cmp rsi, r14
jb 0x180141386
cmp rsi, r15
jae 0x180141386
cmp qword [rsi + 8], 0
jne 0x180141557
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180141371
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x180141422
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x180141419
nop word [rax + rax]
mov r8d, Ordinal_50
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180141419
cmp dword [rsp + 0x70], 0x10000
je 0x18014149b
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x180141419
sub rbx, rbp
cmp rbx, r14
jae 0x1801413e0
test rsi, rsi
jne 0x180141500
cmp rdi, r15
ja 0x18014153f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18014153f
mov r8d, Ordinal_50
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18014153f
cmp dword [rsp + 0x70], 0x10000
je 0x1801414d1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x180141452
jmp 0x18014153f
test rbx, rbx
je 0x180141419
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180141500
cmp rbx, r14
jae 0x1801413c0
jmp 0x180141422
test rdi, rdi
je 0x18014153f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180141500
cmp rdi, r15
jbe 0x180141430
jmp 0x18014153f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x180141510
mov rax, qword [0x18025d920]
mov qword [rsi], rax
mov qword [0x18025d920], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x140002180
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10088
call fcn.140021150
sub rsp, rax
mov rax, qword [0x14005a958]
xor rax, rsp
mov qword [rsp + 0x10070], rax
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.14001c520
mov r8d, 0x10000
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400021fd
lea rcx, [rsp + 0x70]
call fcn.1400332c0
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.1400211b0
add rsp, 0x10088
ret
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.1400211b0
add rsp, 0x10088
ret

Function at 0x1400022b0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14005a958]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [0x140041020]
call fcn.140002180
xor edi, edi
mov qword [0x14005bf10], rax
lea rdx, [0x140041020]
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x20]
lea r8d, [rdi + 0x28]
call fcn.14001c520
lea rdx, [0x140041028]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.140002180
mov cl, 1
mov qword [0x14005bf18], rax
call fcn.14001d6d0
lea r8d, [rdi + 0x28]
mov word [rsp + 0x20], di
lea rdx, str.PYTHONHOME
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14001c520
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov cl, 1
call fcn.14001d6d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400211b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140002840
Capabilities:
Set environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14005a958]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rsi, rdx
mov rbp, rcx
call fcn.14000f450
lea rdx, str.environ
mov rcx, rax
call qword [sym.imp.python311.dll_PyObject_GetAttrString]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.python311.dll_PyUnicode_FromString]
mov rdx, rsi
lea rcx, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.14001c520
lea rcx, [rsp + 0x20]
test r14, r14
je 0x140002903
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, r14
call sub.python311.dll_PyUnicode_FromWideChar
mov r8, rax
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.python311.dll_PyObject_SetItem]
test eax, eax
je 0x1400028f1
mov ecx, 1
call qword [sym.imp.python311.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python311.dll_Py_Exit]
int3
sub qword [rsi], 1
jne 0x140002923
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140002923
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.python311.dll_PyObject_DelItem]
test eax, eax
je 0x140002923
mov rcx, rbp
call fcn.140001c60
sub qword [rdi], 1
jne 0x140002933
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
sub qword [rbx], 1
jne 0x140002943
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400211b0
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001c5d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
test edx, edx
je 0x14001c694
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub r9, 1
jne 0x14001c5f0
not eax
ret
Function at 0x140021bc8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140021c12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140021c12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140021c12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140021c12
cmp dword [rcx + 0x84], 0xe
jbe 0x140021c12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140021c14
xor al, al
add rsp, 0x28
ret

Function at 0x140026b58
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400269c3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400269c3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400269c3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400269c3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400269c3
cmp dword [rcx + 0x84], 0xe
jbe 0x1400269c3
cmp dword [rcx + 0xf8], 0
je 0x1400269c3
mov ecx, ebx
call fcn.140026a74
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140026850
nop
cmp dword [rbp + 0x20], 0
je 0x140026a11
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140026a1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140026954
Function at 0x140038440
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400384c7
mov rsi, rbx
cmp word [rax], bp
je 0x140038486
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140038470
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003846c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400333ac
mov rdi, rax
test rax, rax
je 0x1400384b4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140021ef0
mov rbp, rdi
xor ecx, ecx
call fcn.1400342e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003bbe0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003bbf6
mov al, 1
jmp 0x14003bc56
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003bc07
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003bc54
mov ecx, dword [rcx + 0x18]
nop
call fcn.140038788
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003bc54
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003bc54
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003bc54
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003bc56
xor al, al
add rsp, 0x20
pop rbx
ret