joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180119c00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [0x180516f20], 0
jne 0x180119c21
xor ecx, ecx
call fcn.180110ca0
mov qword [0x180516f20], rax
test rax, rax
je 0x180119c8f
lea rcx, sym.extension.dll_PyUnicode_Type
call sym.extension.dll_PyType_Ready
test eax, eax
jns 0x180119c3d
lea rcx, str.Cant_initialize_unicode
call sym.extension.dll_Py_FatalError
lea rcx, reloc.WS2_32.dll_accept
mov dword [0x1804e83c4], 0x70002720
call sym.extension.dll_PyType_Ready
lea rcx, reloc.WS2_32.dll_accept
call sym.extension.dll_PyType_Ready
test eax, eax
jns 0x180119c6f
lea rcx, str.Cant_initialize_field_name_iterator_type
call sym.extension.dll_Py_FatalError
lea rcx, reloc.WS2_32.dll_accept
call sym.extension.dll_PyType_Ready
test eax, eax
jns 0x180119c8f
lea rcx, str.Cant_initialize_formatter_iter_type
add rsp, 0x28
jmp sym.extension.dll_Py_FatalError
add rsp, 0x28
ret

Function at 0x180121590
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1801215c4
lea rdx, str.GetCurrentActCtx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180517820], rax
jmp 0x1801215cb
mov rax, qword [0x180517820]
test rax, rax
je 0x18012162c
lea rdx, str.ActivateActCtx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeactivateActCtx
mov rcx, rbx
mov qword [0x180517828], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AddRefActCtx
mov rcx, rbx
mov qword [0x180517830], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReleaseActCtx
mov rcx, rbx
mov qword [0x180517838], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180517840], rax
add rsp, 0x20
pop rbx
ret

Function at 0x180121640
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x180517818]
mov qword [rsp + 0x30], 0
test rcx, rcx
je 0x18012167d
mov rax, qword [0x180517828]
test rax, rax
je 0x18012167d
lea rdx, [rsp + 0x30]
call rax
test eax, eax
jne 0x180121684
lea rcx, str.Python_failed_to_activate_the_activation_context_before_loading_a_DLL_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add rsp, 0x28
ret
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x1801216a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1801216d2
mov rax, qword [0x180517830]
test rax, rax
je 0x1801216d2
mov rdx, rcx
xor ecx, ecx
call rax
test eax, eax
jne 0x1801216d2
lea rcx, str.Python_failed_to_de_activate_the_activation_context_n
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x28
ret
Function at 0x1801216e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x18012175d
dec edx
jne 0x180121772
lea r9d, [rdx + 0x10]
lea r8, [0x180517800]
mov edx, 0x3e8
mov qword [0x180517810], rcx
call qword [sym.imp.USER32.dll_LoadStringA]
call fcn.180121590
mov rax, qword [0x180517820]
test rax, rax
je 0x180121772
cmp qword [0x180517838], 0
je 0x180121772
lea rcx, [0x180517818]
call rax
test eax, eax
je 0x180121772
mov rcx, qword [0x180517818]
call qword [0x180517838]
test eax, eax
jne 0x180121772
lea rcx, str.Python_failed_to_load_the_default_activation_context_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x28
ret
mov rax, qword [0x180517840]
test rax, rax
je 0x180121772
mov rcx, qword [0x180517818]
call rax
mov eax, 1
add rsp, 0x28
ret
Function at 0x180121ed0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
lea rcx, str.PATH
call fcn.180236e9c
mov rsi, rax
call sym.extension.dll_Py_GetProgramName
mov rcx, qword [0x180517810]
mov rbp, rax
mov r15d, 0x100
test rcx, rcx
je 0x180121f2b
lea rdx, [0x180517a80]
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx ecx, byte [0x180517a80]
xor edx, edx
test eax, eax
cmove ecx, edx
mov byte [0x180517a80], cl
lea r14, [0x180517970]
mov r8d, r15d
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x180122012
test rbp, rbp
je 0x180121f52
cmp byte [rbp], al
jne 0x180121f59
lea rbp, str.python
mov edx, 0x5c
mov rcx, rbp
call fcn.18023635c
test rax, rax
jne 0x180122037
lea edx, [rax + 0x2f]
mov rcx, rbp
call fcn.18023635c
test rax, rax
jne 0x180122037
test rsi, rsi
je 0x180122021
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
nop word [rax + rax]
mov edx, 0x3b
mov rcx, rsi
call fcn.18023635c
mov rdx, rsi
mov rcx, r14
mov rdi, rax
test rax, rax
je 0x180121fd7
mov rbx, rax
sub rbx, rsi
cmp rbx, r15
cmova rbx, r15
mov r8, rbx
call fcn.18023bf70
mov byte [rbx + r14], 0
jmp 0x180121fdf
mov r8, r15
call fcn.18023bf70
mov rdx, rbp
mov rcx, r14
call fcn.180121960
mov rcx, r14
call fcn.1801218a0
test eax, eax
jne 0x180122008
test rdi, rdi
je 0x180122001
lea rsi, [rdi + 1]
jmp 0x180121fa0
mov byte [0x180517970], 0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov byte [0x180517970], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov r8, r15
mov rdx, rbp
mov rcx, r14
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
jmp fcn.18023bf70
Function at 0x1801225e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov r14, r9
mov r9, qword [0x1804ec4e0]
mov qword [rbp + 0x40], rdi
mov r15, rdx
mov rdi, r8
mov rbx, rcx
mov byte [rbp + 0x48], 0
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [r9 + rax + 1], 0
lea rax, [rax + 1]
jne 0x180122620
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x180122630
lea rdx, [rax + 0x25]
add rdx, rcx
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x180122653
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.18023d0d0
sub rsp, rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rsi, [rsp + 0x30]
lea r8, str.SoftwarePythonPythonCore_sModules_s_s
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call sym.extension.dll_PyOS_snprintf
lea r9, [rbp]
mov r8, rdi
mov rdx, rsi
mov rcx, 0xffffffff80000001
mov dword [rbp], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x1801226bf
lea r9, [rbp]
mov r8, rdi
mov rdx, rsi
mov rcx, 0xffffffff80000002
mov dword [rbp], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x18012271c
mov rbx, qword [0x1805189d0]
mov rax, qword [rbx]
test rax, rax
je 0x18012271c
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1801226d2
movsxd rcx, dword [rbp]
cmp rcx, r8
jbe 0x1801226fa
sub rcx, r8
mov rdx, rax
dec rcx
add rcx, rdi
call fcn.180259558
test eax, eax
je 0x180122700
add rbx, 0x18
jmp 0x1801226c6
cmp qword [rbx], 0
je 0x18012271c
mov rdx, qword [rbx + 8]
mov rcx, rdi
call fcn.1802367ac
test rax, rax
je 0x18012271e
mov qword [r15], rbx
jmp 0x18012271e
xor eax, eax
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x40]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop rbp
ret

Function at 0x180134af0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180134b0a
lea rcx, str.PyEval_AcquireThread:_NULL_new_thread_state
call sym.extension.dll_Py_FatalError
mov rcx, qword [0x180517d08]
mov edx, 1
call sym.extension.dll_PyThread_acquire_lock
mov rcx, rbx
call sym.extension.dll_PyThreadState_Swap
test rax, rax
je 0x180134b39
lea rcx, str.PyEval_AcquireThread:_non_NULL_old_thread_state
add rsp, 0x20
pop rbx
jmp sym.extension.dll_Py_FatalError
add rsp, 0x20
pop rbx
ret

Function at 0x18013b8a0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x20
dec dword [rcx + 0x24]
mov rdi, rcx
mov rcx, qword [rcx + 0x28]
call fcn.18013b770
mov rcx, qword [rdi + 0x30]
mov eax, dword [rcx + 0x10]
dec eax
js 0x18013b906
mov qword [rsp + 0x30], rbx
movsxd rbx, eax
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + rbx*8]
lea rdx, str.compile.c_compiler_unit
call sym.extension.dll_PyCapsule_GetPointer
mov rcx, qword [rdi + 0x30]
mov rdx, rbx
mov qword [rdi + 0x28], rax
call sym.extension.dll_PySequence_DelItem
mov rbx, qword [rsp + 0x30]
test eax, eax
jns 0x18013b90e
lea rcx, str.compiler_exit_scope__
add rsp, 0x20
pop rdi
jmp sym.extension.dll_Py_FatalError
mov qword [rdi + 0x28], 0
add rsp, 0x20
pop rdi
ret
Function at 0x18014b260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18014b27d
test al, 0x10
je 0x18014b27d
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x18014cb30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
cmp dword [sym.extension.dll_Py_IgnoreEnvironmentFlag], 0
mov rdi, r9
mov rsi, r8
mov rbx, rcx
jne 0x18014cb6c
lea rcx, str.PYTHONCASEOK
call fcn.180236e9c
test rax, rax
je 0x18014cb6c
mov eax, 1
jmp 0x18014cbbf
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
jne 0x18014cb9d
mov rcx, qword [sym.extension.dll_PyExc_NameError]
lea rdx, str.Cant_find_file_for_module__.100s_n_filename__.300s_
mov r9, rbx
mov r8, rdi
call sym.extension.dll_PyErr_Format
xor eax, eax
jmp 0x18014cbbf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x4c]
mov r8, rsi
mov rdx, rdi
call fcn.18023bee0
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18014eb30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.180150eb0
lea edx, [rax - 1]
cmp edx, 0x3ffff
ja 0x18014ebba
movsxd rdi, eax
movabs rcx, 0x7fffffffffffffff
cmp rdi, rcx
ja 0x18014ebba
mov ecx, 1
test eax, eax
cmovne ecx, eax
movsxd rcx, ecx
call fcn.180230da8
mov rsi, rax
test rax, rax
je 0x18014ebba
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1802304fc
mov rcx, rsi
mov rdx, rax
call sym.extension.dll_PyMarshal_ReadObjectFromString
mov rcx, rsi
mov rbx, rax
call fcn.180230d68
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp sym.extension.dll_PyMarshal_ReadObjectFromFile

Function at 0x18014ecf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [r8]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test r9, r9
je 0x18014ed2c
mov r8, rdx
mov edx, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180230754
dec rsi
js 0x18014ed6b
mov rdx, qword [rbx]
test rdx, rdx
je 0x18014ed43
movsx ecx, byte [rdi]
call fcn.180241314
jmp 0x18014ed63
mov rcx, qword [rbx + 0x18]
cmp rcx, qword [rbx + 0x20]
je 0x18014ed58
movzx eax, byte [rdi]
mov byte [rcx], al
inc qword [rbx + 0x18]
jmp 0x18014ed63
movsx ecx, byte [rdi]
mov rdx, rbx
call fcn.18014ec40
inc rdi
dec rsi
jns 0x18014ed31
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18014ef30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x7fffffff
jle 0x18014ef6d
dec dword [r8 + 0xc]
mov dword [r8 + 8], 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov ecx, edi
call fcn.18014ee30
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18014ecf0

Function at 0x18014fe40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [r8]
mov rdi, r8
mov rbx, rdx
mov rax, rcx
test r9, r9
je 0x18014fe72
mov r8, rdx
mov edx, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1802304fc
mov rdx, qword [r8 + 0x18]
mov rcx, qword [r8 + 0x20]
sub rcx, rdx
cmp rcx, rbx
cmovl rbx, rcx
mov rcx, rax
mov r8, rbx
call fcn.180230800
add qword [rdi + 0x18], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180153d60
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp rcx, qword [sym.extension.dll__PyThreadState_Current]
mov rbx, rcx
jne 0x180153d7e
lea rcx, str.PyThreadState_Delete:_tstate_is_still_current
call sym.extension.dll_Py_FatalError
mov rcx, rbx
call fcn.180154390
cmp qword [0x180518a38], 0
je 0x180153db0
mov ecx, dword [0x180518a40]
call sym.extension.dll_PyThread_get_key_value
cmp rax, rbx
jne 0x180153db0
mov ecx, dword [0x180518a40]
add rsp, 0x20
pop rbx
jmp sym.extension.dll_PyThread_delete_key_value
add rsp, 0x20
pop rbx
ret

Function at 0x1801540a0
Capabilities:
Get thread local storage value

Disassembly:
cmp qword [0x180518a38], 0
jne 0x1801540ad
xor eax, eax
ret
mov ecx, dword [0x180518a40]
jmp sym.extension.dll_PyThread_get_key_value

Function at 0x180154490
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call sym.extension.dll_PyThread_create_key
mov rcx, rdi
mov qword [0x180518a38], rbx
mov dword [0x180518a40], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180154200

Function at 0x180162990
Capabilities:
Query environment variable

Disassembly:
mov rax, qword [0x180518eb0]
test rax, rax
jne 0x1801629b0
cmp dword [sym.extension.dll_Py_IgnoreEnvironmentFlag], eax
jne 0x1801629b0
lea rcx, str.PYTHONHOME
jmp fcn.180236e9c
ret

Function at 0x1801629c0
Capabilities:
Query environment variable

Disassembly:
mov ecx, 1
jmp sym.extension.dll_Py_InitializeEx
Function at 0x180164e20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
xor edi, edi
mov rbp, rcx
mov qword [rsp + 0x40], rbx
mov edx, edi
lea rcx, [0x1803419ac]
nop dword [rax]
movzx eax, byte [r8 + rdx]
inc rdx
cmp al, byte [rcx + rdx - 1]
jne 0x180164e67
cmp rdx, 5
jne 0x180164e40
lea eax, [rdx - 4]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
lea rdx, [0x180341aa4]
movzx eax, byte [r8 + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x180164e98
cmp rcx, 5
jne 0x180164e71
lea eax, [rcx - 4]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test r9d, r9d
je 0x180164f07
mov qword [rsp + 0x48], rsi
call sym.extension.dll_PyImport_GetMagicNumber
mov rcx, rbp
movzx esi, ax
call fcn.18023e820
test eax, eax
jne 0x180164ef0
mov ebx, 1
lea r8d, [rax + 2]
lea rcx, [rsp + 0x20]
mov edx, ebx
mov r9, rbp
call fcn.1802304fc
cmp rax, 2
jne 0x180164ee8
movzx edx, byte [rsp + 0x21]
movzx ecx, byte [rsp + 0x20]
shl edx, 8
or edx, ecx
cmp edx, esi
cmove edi, ebx
mov rcx, rbp
call fcn.180242394
mov eax, edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x180165620
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x180518fd0], 0
jne 0x180165706
cmp dword [sym.extension.dll_Py_HashRandomizationFlag], 0
mov dword [0x180518fd0], 1
jne 0x180165652
xor eax, eax
mov qword [sym.extension.dll__Py_HashSecret], rax
add rsp, 0x28
ret
cmp dword [sym.extension.dll_Py_IgnoreEnvironmentFlag], 0
jne 0x180165694
lea rcx, str.PYTHONHASHSEED
call fcn.180236e9c
test rax, rax
je 0x180165694
cmp byte [rax], 0
je 0x180165694
xor edx, edx
lea r8, str.random
nop word [rax + rax]
movzx ecx, byte [rax + rdx]
inc rdx
cmp cl, byte [r8 + rdx - 1]
jne 0x1801656ab
cmp rdx, 7
jne 0x180165680
xor r8d, r8d
lea rcx, [sym.extension.dll__Py_HashSecret]
lea edx, [r8 + 8]
add rsp, 0x28
jmp fcn.180165880
lea rdx, [rsp + 0x30]
mov r8d, 0xa
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
call fcn.18023520c
mov rcx, qword [rsp + 0x30]
mov ebx, eax
cmp byte [rcx], 0
jne 0x1801656e8
cmp eax, 0xffffffff
ja 0x1801656e8
call fcn.18023193c
cmp dword [rax], 0x22
jne 0x1801656f4
cmp ebx, 0xffffffff
jne 0x1801656f4
lea rcx, str.PYTHONHASHSEED_must_be__random__or_an_integer_in_range__0__4294967295_
call sym.extension.dll_Py_FatalError
test ebx, ebx
jne 0x18016570b
mov rbx, qword [rsp + 0x20]
xor eax, eax
mov qword [sym.extension.dll__Py_HashSecret], rax
add rsp, 0x28
ret
lea rdx, [sym.extension.dll__Py_HashSecret]
mov r8d, 8
mov ecx, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp 0x180165950
xor r9d, r9d
test r8, r8
je 0x18016597e
nop dword [rax + rax]
imul ecx, ecx, 0x343fd
inc r9
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
mov byte [r9 + rdx - 1], al
cmp r9, r8
jb 0x180165960
ret
Function at 0x18016b1e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [0x1805195b8], 0
mov rdi, rdx
mov rsi, rcx
jne 0x18016b203
call sym.extension.dll_PyThread_init_thread
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x18016b233
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edx, dword [0x1805195b0]
mov qword [rax], rsi
mov qword [rax + 8], rdi
lea rax, [rsp + 0x50]
lea r8, [0x18016b640]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.180242b38
test rax, rax
jne 0x18016b29d
call fcn.18023193c
mov dword [rsp + 0x50], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18016b3e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18016b407
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x20
pop rdi
ret

Function at 0x18016b430
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18016d7e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.1802352b8
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18016d830
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180248c74
lea r8, [0x180322554]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180242de8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18016f080
add rsp, 0x438
ret
Function at 0x18016e1b0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
lea rcx, str._PYTHON__clearing_list__p
call fcn.18016d7e0
mov rax, qword [0x180519628]
lea rdx, [fcn.180230d68]
mov rcx, rbx
call qword [rax + 0x318]
lea rcx, str._PYTHON__cleared_list__p
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18016d7e0

Function at 0x18016e200
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._PYTHON__initializing_handlers
call fcn.18016d7e0
cmp qword [0x180519608], 0
jne 0x18016e22e
mov rax, qword [0x180519628]
call qword [rax + 0x348]
mov qword [0x180519608], rax
cmp qword [0x180519610], 0
jne 0x18016e24c
mov rax, qword [0x180519628]
call qword [rax + 0x348]
mov qword [0x180519610], rax
lea rcx, str._PYTHON__initialized_handlers
add rsp, 0x28
jmp fcn.18016d7e0

Function at 0x18016e270
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._PYTHON__destroying_handlers
call fcn.18016d7e0
mov rcx, qword [0x180519608]
call fcn.18016e1b0
mov rax, qword [0x180519628]
mov rcx, qword [0x180519608]
call qword [rax + 0x368]
mov rcx, qword [0x180519610]
mov qword [0x180519608], 0
call fcn.18016e1b0
mov rax, qword [0x180519628]
mov rcx, qword [0x180519610]
call qword [rax + 0x368]
lea rcx, str._PYTHON__destroyed_handlers
mov qword [0x180519610], 0
add rsp, 0x28
jmp fcn.18016d7e0

Function at 0x18016e2f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.1802352b8
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18016e340
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180248c74
lea r8, [0x180322554]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180242de8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18016f080
add rsp, 0x438
ret