joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f730
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.14000caf8
test al, al
jne 0x14000f781
mov rdx, qword [rsi]
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rcx, [0x14006ce28]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectID]
test eax, eax
jns 0x14000f793
lfence
mov edx, eax
lea rcx, [0x140014a60]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov r8, qword [rsi + 8]
lea r9, [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14006ce50]
and dword [rsp + 0x70], 0
call fcn.1400105c0
test al, al
je 0x14000f781
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov ecx, dword [rsp + 0x70]
lea r8, [0x140014ca0]
mov dword [rsp + 0x40], ecx
mov edx, 2
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea ecx, [rdx + 0x4b]
mov qword [rsp + 0x28], rdi
movzx r9d, bl
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 0xc0000225
jmp 0x14000f783

Function at 0x14000f8a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.14000caf8
test al, al
jne 0x14000f8f1
mov rdx, qword [rdi]
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rcx, [0x14006ce28]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectID]
test eax, eax
jns 0x14000f900
lfence
mov edx, eax
lea rcx, [0x140014a60]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
xor ebx, ebx
cmp dword [rdi + 0x10], ebx
jbe 0x14000f8f1
mov r8, qword [rdi + 8]
lea rax, [rbx + rbx*2]
and dword [rsp + 0x80], 0
lea r9, [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [0x14006ce50]
mov r8, qword [r8 + rax*8]
mov esi, ebx
call fcn.1400105c0
test al, al
jne 0x14000f946
inc ebx
cmp ebx, dword [rdi + 0x10]
jb 0x14000f907
jmp 0x14000f8f1
mov rbx, cr8
mov rdi, qword [rdi + 8]
lea rsi, [rsi + rsi*2]
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rbp, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov ecx, dword [rsp + 0x80]
lea r8, [0x140014da0]
mov dword [rsp + 0x40], ecx
mov edx, 2
mov rcx, qword [rdi + rsi*8]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x30], rcx
lea ecx, [rdx + 0x4b]
mov qword [rsp + 0x28], rbp
movzx r9d, bl
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 0xc0000225
jmp 0x14000f8f3
Function at 0x14000f9b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.14000caf8
test al, al
jne 0x14000fa01
mov rdx, qword [rsi]
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rcx, [0x14006ce28]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectID]
test eax, eax
jns 0x14000fa13
lfence
mov edx, eax
lea rcx, [0x140014a60]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov r8, qword [rsi + 8]
lea r9, [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14006ce50]
and dword [rsp + 0x70], 0
call fcn.1400105c0
test al, al
je 0x14000fa01
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov ecx, dword [rsp + 0x70]
lea r8, [0x140014d20]
mov dword [rsp + 0x40], ecx
mov edx, 2
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea ecx, [rdx + 0x4b]
mov qword [rsp + 0x28], rdi
movzx r9d, bl
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 0xc0000225
jmp 0x14000fa03

Function at 0x14000fa94
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.14000caf8
test al, al
jne 0x14000fae5
mov rdx, qword [rsi]
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rcx, [0x14006ce28]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectID]
test eax, eax
jns 0x14000faf7
lfence
mov edx, eax
lea rcx, [0x140014a60]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov r8, qword [rsi + 8]
lea r9, [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [0x14006ce50]
and dword [rsp + 0x70], 0
call fcn.1400105c0
test al, al
je 0x14000fae5
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov ecx, dword [rsp + 0x70]
lea r8, [0x140014c20]
mov dword [rsp + 0x40], ecx
mov edx, 2
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea ecx, [rdx + 0x4b]
mov qword [rsp + 0x28], rdi
movzx r9d, bl
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 0xc0000225
jmp 0x14000fae7
Function at 0x14000fe80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rbx, rdx
mov rdi, r8
mov rdx, rcx
lea rcx, [rbp + 0xf]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, rbx
lea rcx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0x27], 0
lea rax, [rbp + 0xf]
xorps xmm0, xmm0
mov qword [rbp + 0x2f], rax
lea r8, [rbp + 0x1f]
mov dword [rbp + 0x1f], 0x30
mov edx, 0xf003f
mov dword [rbp + 0x37], 0x40
lea rcx, [rbp - 9]
movdqu xmmword [rbp + 0x3f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x14000ff64
mov rcx, qword [rbp - 9]
lea rax, [rbp + 0x7f]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea rdx, [rbp - 1]
lea r8d, [r9 + 2]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000034
je 0x14000ff64
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x14000ff64
mov edx, eax
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
lea rcx, [rbp + 0x7f]
mov r8d, 2
mov qword [rsp + 0x28], rcx
lea rdx, [rbp - 1]
mov ecx, dword [rbp + 0x7f]
mov r9, rax
mov dword [rsp + 0x20], ecx
mov rbx, rax
mov rcx, qword [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x14000ff64
mov qword [rdi], rbx
mov al, 1
jmp 0x14000ff66
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14000ff7c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x57]
sub rsp, 0x90
mov rbx, rdx
mov rdi, r9
mov rdx, rcx
mov esi, r8d
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, rbx
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0x1f], 0
lea rax, [rbp - 9]
xorps xmm0, xmm0
mov qword [rbp + 0x27], rax
lea r8, [rbp + 0x17]
mov dword [rbp + 0x17], 0x30
mov edx, 0xf003f
mov dword [rbp + 0x2f], 0x40
lea rcx, [rbp - 0x11]
movdqu xmmword [rbp + 0x37], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x140010038
lea rcx, [0x140015340]
call fcn.14000bb0c
mov eax, dword [rbp + 0x7f]
lea rdx, [rbp + 7]
mov rcx, qword [rbp - 0x11]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
jmp 0x140010046
lea rcx, [0x140015390]
call fcn.14000bb0c
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400101bc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
mov r15, r9
lea rcx, [0x140015440]
mov edi, r8d
mov r14, rdx
call sub.ntoskrnl.exe_DbgPrint
mov edx, dword [rbx + 0x54]
cmp edx, edi
je 0x140010210
mov r8d, edi
lea rcx, [0x140015470]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc000017b
jmp 0x14001035e
movzx ecx, word [r14]
mov r12d, 1
movzx eax, cx
mov edx, 0x3fe
sub ax, r12w
cmp ax, dx
ja 0x14001034b
mov ebp, ecx
call fcn.14000b588
mov ecx, eax
lea rdx, [rbp + 0x52]
mov r8d, 0x4c637845
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r13d, r13d
mov rsi, rax
test rax, rax
jne 0x140010267
mov rdx, rbx
lea rcx, [0x1400154d0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140010359
lea r8, [rbp + 0x52]
xor edx, edx
mov rcx, rsi
call fcn.1400115c0
lea rax, [rsi + 0x50]
mov word [rsp + 0x20], r13w
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
movzx eax, word [r14]
mov rdx, r14
mov word [rsp + 0x22], ax
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x20]
call fcn.1400106b0
test al, al
jne 0x1400102bd
mov edx, 0x4c637845
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140010253
lea eax, [rdi - 2]
cmp eax, r12d
jbe 0x1400102ca
mov rdi, rbx
jmp 0x1400102ec
mov rdi, qword [rbx]
jmp 0x1400102e7
lea rdx, [rdi + 0x20]
mov r8b, r12b
lea rcx, [rsi + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jle 0x1400102ec
mov rdi, qword [rdi]
cmp rdi, rbx
jne 0x1400102cf
mov rax, qword [rsp + 0x80]
lea rcx, [rbx + 0x10]
mov qword [rsi + 0x18], rax
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
cmp qword [rsi + 0x18], r13
je 0x14001030c
add dword [rbx + 0x50], r12d
mov rax, qword [rbx + 0x48]
mov qword [rsi + 0x10], rax
add qword [rbx + 0x48], r12
mov rax, qword [rdi + 8]
cmp qword [rax], rdi
je 0x140010328
mov ecx, 3
int 0x29
mov qword [rsi], rdi
lea rcx, [rbx + 0x10]
mov qword [rsi + 8], rax
mov qword [rax], rsi
mov qword [rdi + 8], rsi
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov rax, qword [rsi + 0x10]
mov qword [r15], rax
xor eax, eax
jmp 0x14001035e
mov edx, ecx
lea rcx, [0x1400154a0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000022
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140010754
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
cmp edx, 4
jb 0x140010783
lfence
lea rcx, [0x1400153d0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc000017b
jmp 0x1400107f5
call fcn.14000b588
mov ecx, eax
mov edx, 0x58
mov r8d, 0x4c637845
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x1400107b9
mov rdx, rsi
lea rcx, [0x140015400]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000022
jmp 0x1400107f5
and qword [rax + 0x18], 0
lea rcx, [rax + 0x28]
and dword [rax + 0x20], 0
xor r8d, r8d
mov qword [rax + 8], rbx
mov qword [rax], rbx
mov dword [rax + 0x10], 1
lea edx, [r8 + 1]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
and dword [rbx + 0x50], 0
mov qword [rbx + 0x48], 1
xor eax, eax
mov dword [rbx + 0x54], edi
mov qword [rsi], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140010808
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x778]
sub rsp, 0x870
mov rax, qword [0x14006cb38]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x800
call fcn.1400115c0
mov eax, dword [rbx + 0x54]
xor esi, esi
test eax, eax
jne 0x14001086d
lea rcx, [0x140015630]
call fcn.14000bb0c
lea rcx, [0x140015590]
jmp 0x1400108b9
cmp eax, 1
jne 0x140010887
lea rcx, [0x140015650]
call fcn.14000bb0c
lea rcx, [0x1400155b0]
jmp 0x1400108b9
cmp eax, 2
jne 0x1400108a1
lea rcx, [0x140015670]
call fcn.14000bb0c
lea rcx, [0x1400155d0]
jmp 0x1400108b9
cmp eax, 3
jne 0x1400108c3
lea rcx, [0x140015690]
call fcn.14000bb0c
lea rcx, [0x1400155f0]
lea rdx, [rsp + 0x60]
call fcn.14000fd70
lea rcx, [rsp + 0x60]
call fcn.14000bb0c
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140010ce4
mov qword [rsp + 0x20], rax
jmp 0x140010972
mov rdx, rbx
lea rcx, [0x1400156c0]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x1400156e0]
call fcn.14000bb0c
mov rcx, rbx
call fcn.14000bb0c
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], si
jne 0x140010920
cmp rax, 5
jbe 0x140010972
lea rdx, [0x140015510]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400103dc
lea rdx, [rsp + 0x30]
lea rcx, [0x1400156f0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x40]
mov rax, rdi
lea rcx, [rsp + 0x30]
call qword [0x1400162b8]
lea rdx, [0x1400156b0]
lea rcx, [rsp + 0x20]
call fcn.140010d4c
mov rbx, rax
test rax, rax
jne 0x1400108f9
mov al, 1
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.140011110
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140010b1c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x778]
sub rsp, 0x870
mov rax, qword [0x14006cb38]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov rbx, rcx
add rcx, 0x10
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov edi, 0x800
lea rcx, [rsp + 0x60]
mov r8d, edi
xor edx, edx
call fcn.1400115c0
xorps xmm0, xmm0
lea rax, [rsp + 0x60]
movups xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x22], di
mov rdi, qword [rbx]
mov qword [rsp + 0x28], rax
cmp rdi, rbx
je 0x140010bff
movups xmm0, xmmword [rdi + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [0x140015520]
movdqu xmmword [rsp + 0x30], xmm0
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rax, qword [rdi]
cmp rax, rbx
je 0x140010bf7
mov eax, dword [0x140015550]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x40]
movzx eax, word [0x140015554]
mov word [rsp + 0x54], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbx
jne 0x140010b8b
lea rcx, [rbx + 0x10]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
lea rdx, [rsp + 0x20]
lea rcx, [0x140015560]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rbx + 0x54]
test eax, eax
jne 0x140010c36
lea rcx, [0x140015590]
call fcn.14000bb0c
lea rcx, [0x140015590]
jmp 0x140010c82
cmp eax, 1
jne 0x140010c50
lea rcx, [0x1400155b0]
call fcn.14000bb0c
lea rcx, [0x1400155b0]
jmp 0x140010c82
cmp eax, 2
jne 0x140010c6a
lea rcx, [0x1400155d0]
call fcn.14000bb0c
lea rcx, [0x1400155d0]
jmp 0x140010c82
cmp eax, 3
jne 0x140010c8c
lea rcx, [0x1400155f0]
call fcn.14000bb0c
lea rcx, [0x1400155f0]
lea rdx, [rsp + 0x60]
call fcn.140010060
xor al, al
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.140011110
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140010dc4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov qword [0x14006ce30], rcx
lea rcx, [0x140015940]
mov rdi, rdx
call fcn.14000bb0c
mov rcx, qword [rdi + 8]
call fcn.14000bb0c
lea rcx, [0x140015980]
call fcn.14000bb0c
mov eax, 1
mov rcx, rdi
xchg dword [0x14006ce38], eax
mov rax, qword [0x14006ce30]
and qword [rax + 0x68], 0
call fcn.140001248
test eax, eax
jns 0x140010e2b
lea rcx, [0x140015990]
call sub.ntoskrnl.exe_DbgPrint
call fcn.14000111c
movzx ecx, al
xor edx, edx
xchg dword [0x14006ce38], ecx
test al, al
lea rcx, [0x140010ef0]
mov rax, qword [0x14006ce30]
cmove rdx, rcx
mov qword [rax + 0x68], rdx
call fcn.14000b878
mov rcx, rbx
call fcn.14000c738
test eax, eax
jns 0x140010e70
lea rcx, [0x1400159c0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rbx
call fcn.14000aae0
test eax, eax
jns 0x140010e88
lea rcx, [0x1400159f0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rbx
call fcn.14000ef9c
test eax, eax
jns 0x140010ea0
lea rcx, [0x140015a30]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rbx
call fcn.140001a48
test eax, eax
jns 0x140010eb8
lea rcx, [0x140015a60]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, rdi
mov rcx, rbx
call fcn.140010f38
test eax, eax
jns 0x140010ed3
lea rcx, [0x140015a90]
call sub.ntoskrnl.exe_DbgPrint
call fcn.140001144
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140010f38
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
call fcn.140001130
xor ebp, ebp
test al, al
je 0x1400110a0
mov rdi, qword [rbx + 0x28]
lea ecx, [rbp + 1]
mov eax, 0x200
mov word [rsp + 0x30], bp
mov r8d, 0x6e646448
add ax, word [rdi + 0x48]
movzx edx, ax
mov word [rsp + 0x32], dx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithQuotaTag]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140010fb6
lea rcx, [0x140015710]
call fcn.14000bb0c
lea rcx, [0x140012430]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc00000a0
jmp 0x1400110a2
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0x48]
call fcn.14000b02c
mov ebx, eax
test eax, eax
jns 0x140011002
lfence
lea rcx, [0x140015760]
call fcn.14000bb0c
lea r8, [rdi + 0x48]
mov edx, ebx
lea rcx, [0x140013820]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x38]
mov edx, 0x6e646448
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x1400110a2
lea rdx, [0x14006ce48]
lea rcx, [rsp + 0x30]
call fcn.140009da8
test eax, eax
jns 0x14001102f
lea rcx, [0x1400157c0]
call fcn.14000bb0c
lea rcx, [0x140015840]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x38]
mov edx, 0x6e646448
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x14006ce40]
mov rcx, rsi
call fcn.14000eae4
test eax, eax
jns 0x14001106a
lea rcx, [0x140015870]
call fcn.14000bb0c
lea rcx, [0x140015840]
call sub.ntoskrnl.exe_DbgPrint
mov rdi, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
movzx r9d, dil
mov qword [rsp + 0x28], rbx
lea r8, [0x1400158d0]
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140026e70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14002b110
sub rsp, rax
mov rax, qword [0x140069540]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140026f32
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003a05c
cmp rax, 1
jne 0x140026f8e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140026f0f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140026f03
cmp rcx, 1
jb 0x140026f8e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140026ed0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140026f63
lea rcx, [rsp + 0x80]
call fcn.14003cb64
jmp 0x140026f65
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14002ae40
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140039e08
int3
Function at 0x140027c20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14006b21e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x140027ca5
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x14006afe0], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x14006afe0], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x14006afe0], rdx
call fcn.140025bc0
cmp eax, ebx
jne 0x140027e0d
mov byte [0x14006b21e], 1
lea rdx, [0x14004b5d0]
mov rcx, rsi
call fcn.14003bad0
test eax, eax
je 0x140027d30
cmp byte [0x14006b21d], 1
je 0x140027d30
call qword [sym.imp.python313.dll_PyDict_New]
mov qword [0x14006bf90], rax
call qword [sym.imp.python313.dll_PyDict_New]
mov qword [0x14006bf98], rax
call qword [sym.imp.python313.dll_PyDict_New]
mov qword [0x14006bfa0], rax
call qword [sym.imp.python313.dll_PyDict_New]
mov qword [0x14006bfa8], rax
call qword [sym.imp.python313.dll_PyDict_New]
mov qword [0x14006bfb0], rax
call qword [sym.imp.python313.dll_PyDict_New]
mov qword [0x14006bfb8], rax
call qword [sym.imp.python313.dll_PyDict_New]
mov qword [0x14006bfc0], rax
call qword [sym.imp.python313.dll_PyDict_New]
mov qword [0x14006bfc8], rax
mov byte [0x14006b21d], 1
mov r8, qword [0x14006afe0]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140027d57
inc rax
test cl, cl
jne 0x140027d40
mov ecx, r9d
jmp 0x140027d5c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140027d63
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x140027dc8
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x140027da5
inc rax
test cl, cl
jne 0x140027d90
mov ecx, r9d
jmp 0x140027daa
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x140027db1
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x140027d80
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x140027df8
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1400242f0
add rdi, 8
sub rbx, 1
jne 0x140027de0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.140036844
call fcn.140039e08
int3