joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bf60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47c17f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x47c090
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x47c171
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x47c002
mov rax, rdx
mov rcx, rsi
call fcn.00462640
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x47c06c
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0047c400
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x47c169
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x47c096
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x47c115
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.0047c400
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x47c158
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x47c154
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
nop dword [rax + rax]
call fcn.00462640
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
call fcn.00461d60
mov rax, rdx
mov ecx, 0x40
call fcn.00461d60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f5c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0047bf60
Function at 0x140011474
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e190
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011596
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001ecc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001ece0
xor al, al
jmp 0x14001ed61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001ecf3
xor al, al
jmp 0x14001ed61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001ed1d
xor al, al
jmp 0x14001ed61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001ed31
xor al, al
jmp 0x14001ed61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001ed43
xor al, al
jmp 0x14001ed61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001ed5f
xor al, al
jmp 0x14001ed61
mov al, 1
add rsp, 0x38
ret
Function at 0x14005120d
Capabilities:
Query service status

Disassembly:
push rax
pushf
mov eax, 0x34ba19d
pushf
not eax
add eax, 0x12f5f4ad
xor eax, 0x178a9103
rol eax, 0x63
popf
pushf
not eax
add eax, 0x46938244
xor eax, 0x5b7645a3
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x3cfafe2f
xor eax, 0x4a059aaa
rol eax, 0xd1
popf
pushf
not eax
add eax, 0x486e336b
xor eax, 0x6d33e0b0
rol eax, 0xbe
popf
cmp eax, 0
jne 0x140051270
popf
pop rax
jmp 0x140051270
sub rsp, 0x68
lea rax, [rsp + 0x78]
mov r9d, 0xc1cc9250
pushf
not r9d
add r9d, 0x1998e675
xor r9d, 0x4729a54e
rol r9d, 0xf
popf
pushf
not r9d
add r9d, 0x1782ab59
xor r9d, 0x1d29626e
rol r9d, 0xb6
popf
pushf
not r9d
add r9d, 0x4989510b
xor r9d, 0x278a17da
rol r9d, 0x14
popf
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
jmp 0x1400512d7
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
mov ecx, 0x11421a75
pushf
not ecx
add ecx, 0x226d4cb2
xor ecx, 0x7e6f0aae
rol ecx, 0xb4
popf
pushf
not ecx
add ecx, 0x5c0b4944
xor ecx, 0x3b498f39
rol ecx, 0x58
popf
pushf
not ecx
add ecx, 0x2c1c1c82
xor ecx, 0x7b307c52
rol ecx, 0x45
popf
pushf
not ecx
add ecx, 0x4e9c8d94
xor ecx, 0x2e5a2ee6
rol ecx, 0xfe
popf
cmovne ecx, dword [rsp + 0x34]
mov eax, ecx
add rsp, 0x68
ret
Function at 0x140059bcb
Capabilities:
Delete file

Disassembly:
push rax
pushf
mov eax, 0x6e9c9359
pushf
not eax
add eax, 0x2040e4b4
xor eax, 0x14746853
rol eax, 0xa3
popf
pushf
not eax
add eax, 0x50f36848
xor eax, 0x22719ffa
rol eax, 0xec
popf
cmp eax, 0
jne 0x140059c08
popf
pop rax
jmp 0x140059c26
cmp eax, 2
jne 0x140059c17
popf
pop rax
jmp 0x140059d67
cmp eax, 1
jne 0x140059c26
popf
pop rax
jmp 0x140059ce5
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
mov rdx, qword [0x14002fa90]
lea rcx, [rsp + 0x20]
add rdx, 0x47c
call fcn.140041acc
xor edi, edi
lea rbx, [rsp + 0x20]
cmp word [rsp + 0x20], di
je 0x140059c8c
push rax
pushf
mov eax, 0x6982ca59
pushf
not eax
add eax, 0x6d932016
xor eax, 0x7828fec4
rol eax, 0x84
popf
pushf
not eax
add eax, 0x3045877e
xor eax, 0x6caacff6
rol eax, 0xcc
popf
jmp 0x140059bf9
push rax
pushf
mov eax, 0x811f1fac
pushf
not eax
add eax, 0x6717e5
xor eax, 0x525f1a6e
rol eax, 0xb
popf
pushf
not eax
add eax, 0x5e189331
xor eax, 0x5ea874e1
rol eax, 0x11
popf
pushf
not eax
add eax, 0x3966e9e0
xor eax, 0x74821689
rol eax, 3
popf
pushf
not eax
add eax, 0x2aa9a658
xor eax, 0x4e1fadec
rol eax, 0x96
popf
jmp 0x140059bf9
add rbx, 2
cmp word [rbx], di
jne 0x140059d34
push rax
pushf
mov eax, 0x506b3d7f
pushf
not eax
add eax, 0x1a4eafa3
xor eax, 0x2e6c5f02
rol eax, 0x21
popf
pushf
not eax
add eax, 0x181ea694
xor eax, 0x3a52c770
rol eax, 0x73
popf
pushf
not eax
add eax, 0x7bf6831c
xor eax, 0x62f2e887
rol eax, 0xc3
popf
jmp 0x140059bf9
push rax
pushf
mov eax, 0xd259f1c6
pushf
not eax
add eax, 0x33d12fd9
xor eax, 0x1f76262c
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x1f41ff09
xor eax, 0x3761ed05
rol eax, 0x99
popf
jmp 0x140059bf9
lea rax, [rsp + 0x20]
push rax
not rax
add rbx, rax
pop rax
add rbx, 1
lea rdx, [0x198f5fe9b]
pushf
sub rdx, 0x58f37f53
popf
lea rcx, [rsp + 0x20]
sar rbx, 1
call fcn.1400415c6
lea rcx, [rsp + 0x20]
jmp 0x140059d9d
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0xeaee59f8
pushf
not ecx
add ecx, 0x29ec5b28
xor ecx, 0x4644463c
rol ecx, 0x5c
popf
pushf
not ecx
add ecx, 0x22454bc
xor ecx, 0x65acb83d
rol ecx, 0x26
popf
pushf
not ecx
add ecx, 0x2908a5a6
xor ecx, 0x1ab7b73e
rol ecx, 0x70
popf
pushf
not ecx
add ecx, 0x4ebd5a2c
xor ecx, 0x6339137a
rol ecx, 0xb
popf
jmp 0x140059dfd
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x19a2f316d]
pushf
sub rdx, 0x5a2cb23d
popf
mov word [rsp + rbx*2 + 0x20], di
lea rcx, [rsp + 0x20]
call fcn.1400415c6
lea rcx, [rsp + 0x20]
jmp 0x140059e2a
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1b893f77c]
pushf
sub rdx, 0x7891785c
popf
mov word [rsp + rbx*2 + 0x20], di
lea rcx, [rsp + 0x20]
call fcn.1400415c6
lea rcx, [rsp + 0x20]
jmp 0x140059e57
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret
Function at 0x14006922b
Capabilities:
Set registry value

Disassembly:
push rax
pushf
mov eax, 0xaabbf5c
pushf
not eax
add eax, 0x8ebbbe5
xor eax, 0x41ee653b
rol eax, 0x86
popf
pushf
not eax
add eax, 0x333e20c7
xor eax, 0x3ed7b3d7
rol eax, 0x69
popf
cmp eax, 0
jne 0x140069268
popf
pop rax
jmp 0x140069295
cmp eax, 3
jne 0x140069277
popf
pop rax
jmp 0x1400693b5
cmp eax, 2
jne 0x140069286
popf
pop rax
jmp 0x140069379
cmp eax, 1
jne 0x140069295
popf
pop rax
jmp 0x140069338
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor eax, eax
mov rbx, r9
mov rdi, rcx
test rdx, rdx
je 0x1400692f2
push rax
pushf
mov eax, 0x7a0f192
pushf
not eax
add eax, 0x30e3c457
xor eax, 0x48e612b1
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x4ca73888
xor eax, 0x5997d497
rol eax, 0x14
popf
pushf
not eax
add eax, 0x4292bc41
xor eax, 0x72b7f1a3
rol eax, 0x14
popf
jmp 0x140069259
push rax
pushf
mov eax, 0xd94c9c9f
pushf
not eax
add eax, 0x2b2b1bb7
xor eax, 0x195a6ba1
rol eax, 0x34
popf
pushf
not eax
add eax, 0x38db4ffb
xor eax, 0x29ce19d4
rol eax, 3
popf
pushf
not eax
add eax, 0x33e89a46
xor eax, 0xe20a6d7
rol eax, 0xf1
popf
jmp 0x140069259
lea rcx, [rsp + 0x30]
jmp 0x14006933e
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x1400693b5
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
push rax
pushf
mov eax, 0xcf97d546
pushf
not eax
add eax, 0x42c250ff
xor eax, 0x734bc3d1
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x48c9e47
xor eax, 0x750682c0
rol eax, 0x29
popf
jmp 0x140069259
mov eax, dword [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 0x48a7ee1a
pushf
not r9d
add r9d, 0x43abc9dc
xor r9d, 0x11f00913
rol r9d, 0xb0
popf
pushf
not r9d
add r9d, 0x142de279
xor r9d, 0x43a8356f
rol r9d, 0x80
popf
pushf
not r9d
add r9d, 0x350659e2
xor r9d, 0x361396f7
rol r9d, 0xe6
popf
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rdi
jmp 0x14006941f
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14006a121
Capabilities:
Create process on windows

Disassembly:
push rax
pushf
mov eax, 0x7cc6fbef
pushf
not eax
add eax, 0x3382f0c6
xor eax, 0x11805cd
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x48773c09
xor eax, 0x15bdf9a1
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x76e39422
xor eax, 0xd8e39f9
rol eax, 0xe3
popf
cmp eax, 0
jne 0x14006a171
popf
pop rax
jmp 0x14006a171
push rdi
sub rsp, 0x90
mov r10, rcx
lea rdi, [rsp + 0x20]
xor eax, eax
lea r11d, [rax + 0x70]
mov ecx, r11d
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x24], 0x440
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x50], r9d
mov qword [rsp + 0x30], r8
jmp 0x14006a1b4
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb rax, rax
and rax, qword [rsp + 0x88]
add rsp, 0x90
pop rdi
ret
Function at 0x1400800ee
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xc124ecb2
pushf
not eax
add eax, 0x572cfdad
xor eax, 0x2f630860
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x1e6b15f4
xor eax, 0x1497796d
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x5fb2de16
xor eax, 0x657413c7
rol eax, 0x22
popf
pushf
not eax
add eax, 0x1778dfab
xor eax, 0x3855edc5
rol eax, 0x43
popf
cmp eax, 1
jne 0x140080151
popf
pop rax
jmp 0x14008028b
cmp eax, 0
jne 0x140080160
popf
pop rax
jmp 0x14008016f
cmp eax, 2
jne 0x14008016f
popf
pop rax
jmp 0x1400802f0
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1b1a8b15d]
pushf
sub r9, 0x71a6e6dd
popf
mov ecx, 0x49e3bf02
pushf
not ecx
add ecx, 0x3eaafcb7
xor ecx, 0x2dd42779
rol ecx, 0xf5
popf
pushf
not ecx
add ecx, 0x3b7915e8
xor ecx, 0x548d16e8
rol ecx, 0xee
popf
pushf
not ecx
add ecx, 0x6e59d370
xor ecx, 0x1c27c5da
rol ecx, 0x68
popf
pushf
not ecx
add ecx, 0x35b88c14
xor ecx, 0x5c5492fb
rol ecx, 0x1d
popf
lea r8, [0x183619f28]
pushf
sub r8, 0x435fd4b0
popf
lea rdx, [0x18886be57]
pushf
sub rdx, 0x4884f3d7
popf
call fcn.140010e58
mov ecx, ebx
test rax, rax
je 0x140080258
push rax
pushf
mov eax, 0xd2f84d3a
pushf
not eax
add eax, 0x7e10c234
xor eax, 0x325405f
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x419af21b
xor eax, 0x9c16fe1
rol eax, 8
popf
pushf
not eax
add eax, 0x7cb8c3d6
xor eax, 0x7c332e30
rol eax, 0x86
popf
jmp 0x140080142
push rax
pushf
mov eax, 0x3bcd528e
pushf
not eax
add eax, 0x67a6868d
xor eax, 0x26b52b46
rol eax, 0x61
popf
pushf
not eax
add eax, 0x38d48528
xor eax, 0xdfc53b7
rol eax, 5
popf
jmp 0x140080142
add rsp, 0x20
pop rbx
jmp qword [0x14001c888]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1400802fc
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xa2e8808
pushf
not eax
add eax, 0x594f3240
xor eax, 0x13beb822
rol eax, 0x76
popf
pushf
not eax
add eax, 0x1b1e4a9d
xor eax, 0x789dbb23
rol eax, 0xff
popf
pushf
not eax
add eax, 0x63ce05e1
xor eax, 0x6d20b9c3
rol eax, 0xad
popf
cmp eax, 2
jne 0x14008034c
popf
pop rax
jmp 0x1400804c8
cmp eax, 3
jne 0x14008035b
popf
pop rax
jmp 0x140080514
cmp eax, 1
jne 0x14008036a
popf
pop rax
jmp 0x140080489
cmp eax, 0
jne 0x140080379
popf
pop rax
jmp 0x140080379
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x18cef648e]
pushf
sub r9, 0x4ced99f6
popf
mov edi, ecx
lea rdx, [0x1b795437e]
pushf
sub rdx, 0x779378e6
popf
mov ecx, 0x3ec38db6
pushf
not ecx
add ecx, 0x1af11310
xor ecx, 0x2adf8ccc
rol ecx, 0xa2
popf
pushf
not ecx
add ecx, 0x4269b96
xor ecx, 0x285e750e
rol ecx, 0x9c
popf
lea r8, [0x1b2e8ae67]
pushf
sub r8, 0x72e6e3d7
popf
call fcn.140010e58
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x140080442
push rax
pushf
mov eax, 0xad2394e0
pushf
not eax
add eax, 0x2b5efcac
xor eax, 0x7da2f34f
rol eax, 0xac
popf
pushf
not eax
add eax, 0x543cd249
xor eax, 0x44caad6f
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x310844de
xor eax, 0x114074f1
rol eax, 0x75
popf
jmp 0x14008033d
push rax
pushf
mov eax, 0x3a65152b
pushf
not eax
add eax, 0x47322ecf
xor eax, 0x1016a058
rol eax, 0x12
popf
pushf
not eax
add eax, 0x3e15842f
xor eax, 0x3a182d89
rol eax, 0xf3
popf
pushf
not eax
add eax, 0x47b87deb
xor eax, 0x5ded1c61
rol eax, 0xaa
popf
jmp 0x14008033d
call qword [0x14001c888]
jmp 0x140080514
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0x2aac5767
pushf
not eax
add eax, 0x6e2c3a8e
xor eax, 0x2eef729d
rol eax, 0xbd
popf
pushf
not eax
add eax, 0x6ca03c3d
xor eax, 0x5a9c97ce
rol eax, 0xae
popf
pushf
not eax
add eax, 0x82c8c2d
xor eax, 0x5939a310
rol eax, 0x69
popf
jmp 0x14008033d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140082586
Capabilities:
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x828cd83d
pushf
not eax
add eax, 0x433fea08
xor eax, 0x68fe78c
rol eax, 0x94
popf
pushf
not eax
add eax, 0x3dd02244
xor eax, 0x56835dac
rol eax, 0x22
popf
pushf
not eax
add eax, 0x6f1b460c
xor eax, 0x2f97b6a9
rol eax, 9
popf
cmp eax, 0
jne 0x1400825d6
popf
pop rax
jmp 0x1400825d6
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140011328
Function at 0x1400933c4
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x8116f98b
pushf
not eax
add eax, 0x58ebf574
xor eax, 0x5cb97286
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x42176767
xor eax, 0x7f177363
rol eax, 0xc8
popf
pushf
not eax
add eax, 0x2c121a6a
xor eax, 0x1412e34f
rol eax, 0x50
popf
cmp eax, 0
jne 0x140093414
popf
pop rax
jmp 0x140093414
sub rsp, 0x28
call fcn.140086a3f
lea rdx, [0x1bc6ac583]
pushf
sub rdx, 0x7c67d5db
popf
mov rcx, rax
add rsp, 0x28
jmp fcn.14009299c
Function at 0x14009f0cb
Capabilities:
Encrypt data using chaskey

Disassembly:
push rax
pushf
mov eax, 0xd3438f6d
pushf
not eax
add eax, 0x5899b836
xor eax, 0x4e8fd535
rol eax, 0x82
popf
pushf
not eax
add eax, 0x6dc2fde8
xor eax, 0x614de6a0
rol eax, 0x28
popf
pushf
not eax
add eax, 0x7a758772
xor eax, 0x63923712
rol eax, 0x9f
popf
cmp eax, 0
jne 0x14009f11b
popf
pop rax
jmp 0x14009f11b
mov r8, qword [rdx]
jmp fcn.14009f123
Function at 0x140001fd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002022
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002022
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002022
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002022
cmp dword [rcx + 0x84], 0xe
jbe 0x140002022
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002024
xor al, al
add rsp, 0x28
ret
Function at 0x140060290
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.14008ecf0
sub rsp, rax
mov rax, qword [0x1400a7040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x140060352
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1400602fd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1400602f0
cmp rcx, 1
jb 0x1400603aa
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140060320
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400822c8
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1400602e0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140060383
lea rcx, [rsp + 0x80]
call fcn.140083a9c
jmp 0x140060385
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140073250
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140077830
int3

Function at 0x1400603b0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400a7040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], ax
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov dl, 0x4e
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14006040d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140060400
cmp rcx, 1
jb 0x140060487
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140060423
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400822c8
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1400603f0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140073250
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140077830
int3
Function at 0x140073c20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140073c6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140073c6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140073c6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140073c6a
cmp dword [rcx + 0x84], 0xe
jbe 0x140073c6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140073c6c
xor al, al
add rsp, 0x28
ret

Function at 0x140077b90
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400779fb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400779fb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400779fb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400779fb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400779fb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400779fb
cmp dword [rcx + 0xf8], 0
je 0x1400779fb
mov ecx, ebx
call fcn.140077aac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140077888
nop
cmp dword [rbp + 0x20], 0
je 0x140077a49
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140077a54
int3
xor r8d, r8d
xor edx, edx
jmp 0x14007798c
Function at 0x1400887c4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14008884b
mov rsi, rbx
cmp word [rax], bp
je 0x14008880a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400887f4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400887f0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14008604c
mov rdi, rax
test rax, rax
je 0x140088838
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14008f350
mov rbp, rdi
xor ecx, ecx
call fcn.14008441c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14008c3c0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14008c3d6
mov al, 1
jmp 0x14008c436
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14008c3e7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14008c434
mov ecx, dword [rcx + 0x18]
nop
call fcn.140088f68
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008c434
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14008c434
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14008c434
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14008c436
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14008ec00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14008ec28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14008ec28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret