joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180021c34
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180021ad4
call fcn.180015a94
mov dword [rax], 0x16
call fcn.1800142b0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180021abc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180021abc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x180021b06
lock or dword [rax + 0x14], 0x10
jmp 0x180021abc
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180021b23
mov rcx, qword [rbp + 0x10]
call fcn.180022f40
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.18001d8d4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.180022824
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x180021b7a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x180021abc
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x180021be6
mov rcx, qword [rbp + 0x10]
call fcn.18001d8d4
cmp eax, 0xffffffff
je 0x180021bcd
mov rcx, qword [rbp + 0x10]
call fcn.18001d8d4
cmp eax, 0xfffffffe
je 0x180021bcd
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.18001d8d4
movsxd rdi, eax
lea rsi, [0x18004c530]
mov rcx, rbx
sar rdi, 6
call fcn.18001d8d4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x180021bd4
lea rax, [0x180045250]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180021be6
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x180021c1c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x180021c18
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x180021c18
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x180021abf
jmp 0x180021a8c
Function at 0x140009570
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140025528]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x10], 0
je 0x140009626
call fcn.14000eb70
test al, al
jne 0x140009626
mov rcx, rbx
call fcn.14000a0d0
test al, al
je 0x140009601
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000d640
nop
mov rcx, rax
call fcn.140009570
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140009601
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400095fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009676
call fcn.140014350
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000960e
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140009626
mov rcx, rbx
call fcn.14000eb70
test al, al
je 0x140009639
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140014470
add rsp, 0x50
pop rbx
ret
lea rcx, str.Failure_processing_application_bundle.
call fcn.14000c960
mov rcx, rbx
call fcn.1400091b0
mov rdx, rax
lea rcx, str.Failed_to_create_directory___s__for_extracting_bundled_files
call fcn.14000c960
mov dword [rsp + 0x20], 0x800080a0
lea rdx, [0x1400234b8]
lea rcx, [rsp + 0x20]
call fcn.14001533c
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x140009e60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x2040
call fcn.1400144e0
sub rsp, rax
mov rax, qword [0x140025528]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov rbx, rdx
mov r14, rcx
add rdx, 0x18
call fcn.140009680
mov edx, dword [rbx]
xor r8d, r8d
mov rcx, qword [r14]
mov rsi, rax
mov rdi, qword [rbx + 8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
jne 0x140009f5d
mov r9, qword [r14]
lea rcx, [rsp + 0x30]
mov ebx, 0x2000
mov edx, 1
cmp rdi, rbx
cmovle rbx, rdi
mov r8, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rbx
jne 0x140009f2b
mov r9, rsi
lea rcx, [rsp + 0x30]
mov r8, rbx
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, rbx
jne 0x140009f8f
sub rdi, rbx
test rdi, rdi
jg 0x140009eb3
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140014470
mov rbx, qword [rsp + 0x2070]
add rsp, 0x2040
pop r14
pop rdi
pop rsi
ret
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c960
lea rcx, str.I_O_failure_reading_contents_of_the_bundle.
call fcn.14000c960
lea rdx, [0x1400234b8]
mov dword [rsp + 0x20], 0x800080a0
lea rcx, [rsp + 0x20]
call fcn.14001533c
int3
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c960
lea rcx, str.I_O_seek_failure_within_the_bundle.
call fcn.14000c960
lea rdx, [0x1400234b8]
mov dword [rsp + 0x20], 0x800080a0
lea rcx, [rsp + 0x20]
call fcn.14001533c
int3
lea rcx, str.Failure_extracting_contents_of_the_application_bundle.
call fcn.14000c960
lea rcx, str.I_O_failure_when_writing_extracted_files.
call fcn.14000c960
lea rdx, [0x1400234b8]
mov dword [rsp + 0x20], 0x800080a0
lea rcx, [rsp + 0x20]
call fcn.14001533c
int3

Function at 0x140009fd0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
movsx rbx, cl
test cl, cl
js 0x140009fe3
mov rax, rbx
jmp 0x14000a01a
mov r9, rdx
mov byte [rsp + 0x30], 0
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, 1
jne 0x14000a02d
movsx eax, byte [rsp + 0x30]
test al, al
js 0x14000a05f
shl eax, 7
mov rcx, rbx
cdqe
and ecx, 0x7f
or rax, rcx
lea rcx, [rax - 1]
cmp rcx, 0x103
ja 0x14000a091
add rsp, 0x20
pop rbx
ret
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c960
lea rcx, str.I_O_failure_reading_contents_of_the_bundle.
call fcn.14000c960
lea rdx, [0x1400234b8]
mov dword [rsp + 0x40], 0x800080a0
lea rcx, [rsp + 0x40]
call fcn.14001533c
int3
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c960
lea rcx, str.Path_length_encoding_read_beyond_two_bytes
call fcn.14000c960
lea rdx, [0x1400234b8]
mov dword [rsp + 0x40], 0x8000809f
lea rcx, [rsp + 0x40]
call fcn.14001533c
int3
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c960
lea rcx, str.Path_length_is_zero_or_too_long
call fcn.14000c960
lea rdx, [0x1400234b8]
mov dword [rsp + 0x30], 0x8000809f
lea rcx, [rsp + 0x30]
call fcn.14001533c
int3
Function at 0x14000a130
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, r8
mov rbx, rdx
mov r8, rdx
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rbx
jne 0x14000a154
add rsp, 0x20
pop rbx
ret
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c960
lea rcx, str.I_O_failure_reading_contents_of_the_bundle.
call fcn.14000c960
lea rdx, [0x1400234b8]
mov dword [rsp + 0x38], 0x800080a0
lea rcx, [rsp + 0x38]
call fcn.14001533c
int3

Function at 0x14000a190
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
lea rcx, [rdx + 1]
call fcn.1400144bc
mov rbx, rax
mov qword [rsp + 0x58], rax
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rsi
jne 0x14000a1f8
mov byte [rbx + rsi], 0
mov rdx, rbp
mov rcx, rbx
call fcn.14000eb40
nop
test rbx, rbx
je 0x14000a1eb
mov rcx, rbx
call fcn.140014350
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c960
lea rcx, str.I_O_failure_reading_contents_of_the_bundle.
call fcn.14000c960
mov dword [rsp + 0x48], 0x800080a0
lea rdx, [0x1400234b8]
lea rcx, [rsp + 0x48]
call fcn.14001533c
int3
Function at 0x14000a6b0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov qword [rsp + 0x30], rsi
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14000a6e2
mov rdx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x14000a6ef
mov rcx, qword [rdi]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__wrename
test eax, eax
je 0x14000a757
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov rcx, rbx
mov esi, dword [rax]
call fcn.14000eb70
test al, al
jne 0x14000a74f
cmp esi, 0xd
jne 0x14000a74b
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x14000a71d
mov r8, qword [rbx]
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x14000a72a
mov rdx, qword [rdi]
lea rcx, str.Retrying_Rename___s__to___s__due_to_EACCES_error
call fcn.14000cc40
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0x1f4
jl 0x14000a6d5
xor al, al
jmp 0x14000a759
mov byte [r14], 1
xor al, al
jmp 0x14000a759
mov al, 1
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000c4c0
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140025528]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rdx
mov rsi, rcx
lea rdx, str..NET_Runtime
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbp, rax
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r14w
lea r8d, [r14 + 0x2d]
lea rdx, str.Description:_A_.NET_Core_application_failed._n
lea rcx, [rsp + 0x58]
call fcn.14000b1a0
lea r8d, [r14 + 0xd]
lea rdx, str.Application:
lea rcx, [rsp + 0x58]
call fcn.14000b1a0
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x14000c550
mov rdx, rdi
mov rcx, rax
call fcn.14000b1a0
mov edi, 1
mov r8d, edi
lea rdx, [0x14001b6a8]
mov rcx, rax
call fcn.14000b1a0
lea r8d, [rdi + 5]
lea rdx, str.Path:
lea rcx, [rsp + 0x58]
call fcn.14000b1a0
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14000c592
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14000b1a0
mov r8, rdi
lea rdx, [0x14001b6a8]
mov rcx, rax
call fcn.14000b1a0
mov r8d, 9
lea rdx, str.Message:
lea rcx, [rsp + 0x58]
call fcn.14000b1a0
lea rdx, [0x140025038]
cmp qword [0x140025050], 8
cmovae rdx, qword [0x140025038]
mov r8, qword [0x140025048]
mov rcx, rax
call fcn.14000b1a0
mov r8, rdi
lea rdx, [0x14001b6a8]
mov rcx, rax
call fcn.14000b1a0
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x28], di
mov qword [rsp + 0x20], r14
mov r9d, 0x3ff
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14000c69b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c696
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c6c0
call fcn.140014350
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140014470
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x14000e500
Capabilities:
Query environment variable

Disassembly:
movzx eax, byte [str.d38cc827_e34f_4453_9df4_1e796e9f1d07]
cmp al, 0x65
je 0x14000e50e
xor al, al
ret
jmp fcn.14000ffc0

Function at 0x14000eef0
Capabilities:
Create directory
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140025528]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14000efab
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000ef32
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140005820
xor edx, edx
mov rcx, rbx
call fcn.140010ad0
test al, al
je 0x14000efab
lea rdx, str..net
mov rcx, rbx
call fcn.14000d230
xor edx, edx
mov rcx, rbx
call fcn.140010ad0
test al, al
je 0x14000ef79
mov al, 1
jmp 0x14000efad
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14000ef86
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000ef9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000efab
xor edx, edx
mov rcx, rbx
call fcn.140010ad0
jmp 0x14000efad
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140014470
add rsp, 0x240
pop rbx
ret
Function at 0x14000ffc0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, rcx
mov rsi, rdx
xor ecx, ecx
mov rax, rdx
mov qword [rdx + 0x10], rcx
cmp qword [rdx + 0x18], 8
jb 0x14000ffe9
mov rax, qword [rdx]
mov word [rax], cx
xor r8d, r8d
mov rcx, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x140010045
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140010032
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140010020
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
mov rdx, rbp
call fcn.14000c960
xor al, al
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbx
mov eax, 2
mul r14
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
cmovo rax, rbx
mov rcx, rax
call fcn.1400144bc
mov r8d, r14d
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1400100b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140010092
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
mov rdx, rbp
call fcn.14000c960
xor al, al
jmp 0x1400100d2
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400100b0
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140005820
mov rcx, rdi
call fcn.140014350
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400bff80]
mov dword [rax], 1
mov rax, qword [0x1400bff90]
mov dword [rax], 1
mov rax, qword [0x1400bffa0]
mov dword [rax], 1
mov rax, qword [0x1400bfec0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14001cca0
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14009a5b0
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x14001cd6d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop word cs:[rax + rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400ab824
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14001cd4e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x14001cd40
test rsi, rsi
je 0x1400ab824
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x14001cd00
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x14001cd9c
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14001cdb0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x14001ce6d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400ab82a
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14001ce4e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x14001ce40
test rsi, rsi
je 0x1400ab82a
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x14001ce00
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001cea0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor edx, edx
movzx eax, byte [rcx]
mov word [rsp + 0x30], dx
mov rbp, rcx
lea r15, [rsp + 0x30]
test al, al
je 0x14001cf5d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop word cs:[rax + rax]
nop
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400ab830
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14001cf3e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x14001cf30
test rsi, rsi
je 0x1400ab830
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x14001cef0
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140052c60
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rsi, str.NUITKA_ONEFILE_BINARY
mov ebx, ecx
mov rcx, rsi
call fcn.14001cca0
test rax, rax
je 0x140052d70
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x30]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r15, r14
lea r12, [rsi + 0x28]
mov word [rsp + 0x30], cx
mov r13, rax
lea rbp, [rsp + 0x2a]
mov eax, 0x4e
lea rdi, [rsp + 0x2c]
nop word cs:[rax + rax]
nop dword [rax]
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, rsi
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400ab8c0
cmp word [r15], 0
movzx edx, word [rsp + 0x2c]
mov rax, r15
je 0x140052d1e
nop dword [rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x140052d10
test rbx, rbx
je 0x1400ab8c0
mov word [rax], dx
add rsi, 1
xor edx, edx
add r15, 2
mov word [rax + 2], dx
movzx eax, byte [rsi]
test al, al
jne 0x140052cd0
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call qword [sym.imp.python312.dll_PyThreadState_Get]
mov rdx, r13
mov rcx, rax
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140052ae0
mov rax, qword [0x1400d13e8]
lea rsi, [0x1400d13e8]
test bl, bl
je 0x140052d90
mov rax, qword [0x1400d13f0]
lea rsi, [0x1400d13f0]
test rax, rax
je 0x140052da9
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [0x1400d1622], 0
je 0x140052dd9
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400d1420]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
mov qword [rsi], rax
test rax, rax
je 0x140052de3
mov edx, dword [rax]
add edx, 1
je 0x140052d95
mov dword [rax], edx
jmp 0x140052d95
movzx ecx, bl
call fcn.14001d610
jmp 0x140052db2
call qword [sym.imp.python312.dll_PyErr_Print]
call sub.msvcrt.dll_abort
nop
nop
Function at 0x140052df0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, qword [0x1400d13e0]
mov rsi, rcx
test rbx, rbx
je 0x140052e70
mov rax, qword [0x1400c00c0]
mov rcx, qword [rax + 0x48]
cmp rbx, rcx
je 0x140052e60
mov rdx, qword [0x1400d1628]
test rdx, rdx
je 0x140052f60
mov rcx, rbx
mov rbx, qword [sym.imp.python312.dll_PyNumber_InPlaceAdd]
call rbx
mov rcx, rax
mov rdx, rsi
mov rax, rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rbx, qword [sym.imp.python312.dll_PyNumber_InPlaceAdd]
jmp 0x140052e41
lea r15, str.NUITKA_ONEFILE_BINARY
mov rcx, r15
call fcn.14001cca0
test rax, rax
je 0x140052f80
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r13, r14
lea r12, [r15 + 0x28]
mov word [rsp + 0x40], cx
lea rbp, [rsp + 0x3a]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov eax, 0x4e
nop
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, r15
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400ab8c6
cmp word [r13], 0
movzx edx, word [rsp + 0x3c]
mov rax, r13
je 0x140052f0e
nop word [rax + rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x140052f00
test rbx, rbx
je 0x1400ab8c6
mov word [rax], dx
add r15, 1
xor edx, edx
add r13, 2
mov word [rax + 2], dx
movzx eax, byte [r15]
test al, al
jne 0x140052ec0
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call qword [sym.imp.python312.dll_PyThreadState_Get]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.140052ae0
mov rbx, rax
mov qword [0x1400d13e0], rbx
jmp 0x140052e12
lea rcx, [0x1400bc2e2]
call qword [sym.imp.python312.dll_PyUnicode_FromString]
mov qword [0x1400d1628], rax
mov rdx, rax
jmp 0x140052e32
mov rbx, qword [0x1400d13f0]
test rbx, rbx
jne 0x140052f51
cmp byte [0x1400d1622], 0
je 0x140052fc3
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400d1420]
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
mov qword [0x1400d13f0], rax
mov rbx, rax
test rax, rax
je 0x140052fcf
mov eax, dword [rax]
add eax, 1
je 0x140052f51
mov dword [rbx], eax
jmp 0x140052f51
mov ecx, 1
call fcn.14001d610
jmp 0x140052f95
call qword [sym.imp.python312.dll_PyErr_Print]
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]