joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003530c
Capabilities:
Write file on windows

Disassembly:
jmp 0x14005b340
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14016c05f]
call fcn.140036d15
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14005b398
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14005b4aa
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14005b443
cmp qword [rbp + 0x28], 0
jle 0x14005b443
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14005b3e1
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140036b4e
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14005b499
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14005b499
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400357d5
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1400486b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14016c087]
call fcn.140036d15
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x138
jne 0x1400486ee
mov rcx, qword [rbp + 0x100]
call fcn.14003557d
nop
jmp 0x14004870a
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jb 0x14004870a
mov rcx, qword [rbp + 0x100]
call fcn.140035eba
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx + rax*8 + 8]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov rax, qword [rbp + 8]
shr rax, 0x1d
mov rcx, qword [rbp + 0x100]
and rax, qword [rcx + 0x1388]
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x25
movabs rcx, 0xfff7eee000000000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shr rax, 0x2b
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140035eba
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14004b9e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14016c087]
call fcn.140036d15
nop
mov qword [rbp + 8], 0x137
mov qword [rbp + 0x28], 0x9c
mov qword [rbp + 0x48], 0
jmp 0x14004ba25
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0x9c
jae 0x14004bace
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
and rax, 1
test rax, rax
je 0x14004ba8d
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14004ba98
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0x68]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor rax, qword [rcx + rdx*8 + 0xea8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14004ba1a
mov qword [rbp + 0x88], 0x9c
jmp 0x14004baec
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x137
jae 0x14004bbad
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
and rax, 1
test rax, rax
je 0x14004bb63
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14004bb6e
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xa8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor rax, qword [rcx + rdx*8 - 0x4d8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14004badb
mov qword [rbp + 0xc8], 0x137
mov eax, 8
imul rax, rax, 0x26f
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rcx + rax + 8]
and rax, 0xffffffff80000000
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov rcx, qword [rdx + rcx + 8]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
and rax, 1
test rax, rax
je 0x14004bc1f
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14004bc2a
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xe8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov ecx, 8
imul rcx, rcx, 0x9b
mov rdx, qword [rbp + 0x1e0]
xor rax, qword [rdx + rcx + 8]
mov ecx, 8
imul rcx, rcx, 0x137
mov rdx, qword [rbp + 0x1e0]
mov qword [rdx + rcx + 8], rax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x1400360b8
Capabilities:
Terminate process

Disassembly:
jmp 0x14009bfe0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14003642d
Capabilities:
Parse pe header

Disassembly:
jmp 0x14009c830
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14009c850
xor al, al
jmp 0x14009c8d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14009c863
xor al, al
jmp 0x14009c8d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14009c88d
xor al, al
jmp 0x14009c8d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14009c8a1
xor al, al
jmp 0x14009c8d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14009c8b3
xor al, al
jmp 0x14009c8d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14009c8cf
xor al, al
jmp 0x14009c8d1
mov al, 1
add rsp, 0x38
ret
Function at 0x140036cb1
Capabilities:
Write file on windows

Disassembly:
jmp 0x140049df0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x14015d040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14016c05f]
call fcn.140036d15
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x140049e57
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140049e5e
mov al, 1
jmp 0x140049fae
call fcn.1400358a2
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.1400358a2
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.1400366e9
movzx eax, al
test eax, eax
je 0x140049eaf
xor al, al
jmp 0x140049fae
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x140049f14
cmp dword [rbp + 0x154], 1
je 0x140049f1f
cmp dword [rbp + 0x154], 3
je 0x140049f9d
jmp 0x140049fac
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140049f6f
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140049f6f
xor al, al
jmp 0x140049fae
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140049f8a
mov dword [rbp + 0x154], 1
jmp 0x140049f94
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140049fae
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140049fae
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400ac4c0]
call fcn.1400367f7
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140035dfc
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x14009a630
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140036e3c
movzx eax, al
test eax, eax
jne 0x14009a650
mov ecx, 7
call fcn.140036838
nop
mov byte [rsp + 0x20], 0
call fcn.1400368c4
mov byte [rsp + 0x21], al
cmp dword [0x14015dc00], 1
jne 0x14009a674
mov ecx, 7
call fcn.140036838
nop
jmp 0x14009a6cc
cmp dword [0x14015dc00], 0
jne 0x14009a6c7
mov dword [0x14015dc00], 1
lea rdx, [0x1400a8880]
lea rcx, [0x1400a8550]
call fcn.140035dbb
test eax, eax
je 0x14009a6a8
mov eax, 0xff
jmp 0x14009a7d1
lea rdx, [0x1400a8440]
lea rcx, [section..rdata]
call fcn.1400368a1
mov dword [0x14015dc00], 2
jmp 0x14009a6cc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400367d4
call fcn.1400364cd
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14009a729
mov rcx, qword [rsp + 0x30]
call fcn.140035b81
movzx eax, al
test eax, eax
je 0x14009a729
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14016d020]
nop
call fcn.14003663a
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14009a75d
mov rcx, qword [rsp + 0x38]
call fcn.140035b81
movzx eax, al
test eax, eax
je 0x14009a75d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140036c48
nop
call fcn.14009a840
mov dword [rsp + 0x28], eax
call fcn.14003642d
movzx eax, al
test eax, eax
jne 0x14009a77c
mov ecx, dword [rsp + 0x28]
call fcn.140035258
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14009a78b
call fcn.140036c93
nop
xor edx, edx
mov cl, 1
call fcn.140035acd
mov eax, dword [rsp + 0x28]
jmp 0x14009a7d1
add rsp, 0x68
ret
Function at 0x180001360
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
test edx, edx
je 0x1800014f6
cmp edx, 1
jne 0x180001593
lea rcx, str.hook.dll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800013a1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor edx, edx
lea rcx, [0x1800046a0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x208
lea r8, [0x1800046a0]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea rcx, [0x1800046a0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, str.explorer.exe
lea rcx, [0x1800046a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18000146d
lea r8, str.NtQueryDirectoryFile
lea rcx, str.windows.storage.dll
call fcn.180001200
mov edx, 8
mov qword [0x180004680], rax
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov rbx, rax
mov rcx, qword [rax]
mov qword [0x180004690], rcx
lea r8d, [rdx - 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180001593
lea rax, [0x180001090]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov edx, 8
mov qword [rbx], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180001593
lea rdx, str.taskmgr.exe
lea rcx, [0x1800046a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1800014a1
lea rdx, str.ProcessHacker.exe
lea rcx, [0x1800046a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180001593
lea r8, str.NtQuerySystemInformation
xor ecx, ecx
call fcn.180001200
mov edx, 8
mov qword [0x180004688], rax
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov rbx, rax
mov rcx, qword [rax]
mov qword [0x180004698], rcx
lea r8d, [rdx - 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180001593
lea rax, [0x180001170]
jmp 0x18000144d
xor edx, edx
lea rcx, [0x1800046a0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x208
lea r8, [0x1800046a0]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea rdx, str.explorer.exe
lea rcx, [0x1800046a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180001550
mov rdx, qword [0x180004690]
mov rcx, qword [0x180004680]
jmp 0x18000158e
lea rdx, str.taskmgr.exe
lea rcx, [0x1800046a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180001580
lea rdx, str.ProcessHacker.exe
lea rcx, [0x1800046a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180001593
mov rdx, qword [0x180004698]
mov rcx, qword [0x180004688]
call fcn.1800012d0
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800015c0
add rsp, 0x30
pop rbx
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400d37f0]
mov dword [rax], 1
mov rax, qword [0x1400d3800]
mov dword [rax], 1
mov rax, qword [0x1400d3810]
mov dword [rax], 1
mov rax, qword [0x1400d3770]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14004ea20
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400b1270
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x14004eae5
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c2194
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14004eac6
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x14004eab8
test rsi, rsi
je 0x1400c2194
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x14004ea78
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x14004eb14
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14004eb30
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x14004ebed
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c219a
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14004ebce
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x14004ebc0
test rsi, rsi
je 0x1400c219a
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x14004eb80
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140065aa0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rsi, str.NUITKA_ONEFILE_BINARY
mov ebx, ecx
mov rcx, rsi
call fcn.14004ea20
test rax, rax
je 0x140065c00
mov rcx, rax
mov rdx, 0xffffffffffffffff
lea r14, [rsp + 0x40]
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
xor ecx, ecx
mov r15, r14
lea r12, [rsi + 0x28]
mov word [rsp + 0x40], cx
mov r13, rax
lea rbp, [rsp + 0x3a]
mov eax, 0x4e
lea rdi, [rsp + 0x3c]
nop word [rax + rax]
mov rbx, r12
mov r8d, 2
mov rdx, rbp
mov rcx, rdi
sub rbx, rsi
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x1400c2252
cmp word [r15], 0
movzx edx, word [rsp + 0x3c]
mov rax, r15
je 0x140065b56
nop dword [rax]
add rax, 2
sub rbx, 1
cmp word [rax], 0
jne 0x140065b48
test rbx, rbx
je 0x1400c2252
mov word [rax], dx
add rsi, 1
xor edx, edx
add r15, 2
mov word [rax + 2], dx
movzx eax, byte [rsi]
test al, al
jne 0x140065b08
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, qword [sym.imp.python310.dll__PyRuntime]
mov rdx, qword [0x1400ef900]
mov rsi, qword [rax + 0x1f0]
mov rax, qword [0x1400d3920]
mov rbx, qword [rax + 0x1c0]
test rdx, rdx
je 0x140065c58
mov r8, rbx
mov rcx, rsi
call fcn.1400515d0
mov r8, r13
mov rcx, rsi
mov rbx, rax
mov rdx, rax
call fcn.140062ab0
sub qword [rbx], 1
jne 0x140065be4
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rcx, rbx
call qword [rdx + 0x30]
mov rax, qword [rsp + 0x28]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x1400ef1c0]
lea rsi, [0x1400ef1c0]
test bl, bl
je 0x140065c20
mov rax, qword [0x1400ef1c8]
lea rsi, [0x1400ef1c8]
test rax, rax
jne 0x140065be4
cmp byte [0x1400ef3e2], 0
jne 0x140065c36
movzx ecx, bl
call fcn.14002f230
mov rdx, 0xffffffffffffffff
lea rcx, [0x1400ef1e0]
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov qword [rsi], rax
test rax, rax
je 0x140065c85
add qword [rax], 1
jmp 0x140065be4
mov rdx, qword [0x1400ef878]
mov rdi, qword [rax + 0x1b0]
test rdx, rdx
je 0x140065c90
mov r8, rdi
mov rcx, rsi
call fcn.1400515d0
mov qword [0x1400ef900], rax
mov rdx, rax
jmp 0x140065bae
call qword [sym.imp.python310.dll_PyErr_Print]
call sub.msvcrt.dll_abort
lea rcx, [0x1400cc3d6]
call qword [sym.imp.python310.dll_PyImport_ImportModule]
mov qword [0x1400ef878], rax
mov rdx, rax
test rax, rax
je 0x1400c2252
jmp 0x140065c6b
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call qword [sym.imp.python310.dll_PyErr_NoMemory]
call sub.msvcrt.dll_abort
nop