joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4589c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0052d1e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0052cf6d], 0
je 0x4589f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0052d520]
aesenc xmm0, xmmword [0x0052d530]
aesenc xmm0, xmmword [0x0052d540]
movq rax, xmm0
ret
jmp 0x408640

Function at 0x45a3a0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0052d4a0]
mov qword [rsp + 8], rdx
lea r8d, [0x0052cf84]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.004588a0
add rsp, 0x30
ret

Function at 0x45a8e0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45a90c
call fcn.004588a0
shl rcx, 3
add rcx, 0x1480
mov qword [0x0052d140], rcx
ret
Function at 0x1800024e0
Capabilities:
Link many functions at runtime
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x440
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180005b70
mov rdi, qword [0x18001fd50]
cmp dword [rdi + 0x20], 0
je 0x18000252c
mov rcx, qword [0x18001fd60]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x180002693
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call fcn.180005b70
mov rcx, qword [rdi + 0x24]
lea rdx, [rsp + 0x230]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x1800026d5
lea rcx, str.shlwapi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.PathIsRelativeW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000263b
lea rcx, [rsp + 0x230]
call rax
test eax, eax
je 0x18000263b
mov rcx, qword [0x18001fd60]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, str.shlwapi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.PathRemoveFileSpecW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800025df
lea rcx, [rsp + 0x20]
call rax
lea rcx, str.shlwapi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.PathAddBackslashW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180002608
lea rcx, [rsp + 0x20]
call rax
lea rcx, str.shlwapi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.PathAppendW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180002693
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
call rax
jmp 0x180002693
lea rcx, [rsp + 0x230]
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x180002643
lea rax, [rsp + 0x230]
sub rcx, rax
sar rcx, 1
cmp rcx, 0x104
ja 0x180002693
mov qword [rsp + 0x450], rsi
pushfq
pop rax
btr rax, 0xa
push rax
popfq
add rcx, rcx
lea rdi, [rsp + 0x20]
lea rsi, [rsp + 0x230]
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x450]
lea rcx, str.shlwapi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.PathCanonicalizeW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800026bf
lea rdx, [rsp + 0x20]
mov rcx, rbx
call rax
mov eax, 1
mov rbx, qword [rsp + 0x458]
add rsp, 0x440
pop rdi
ret
mov rbx, qword [rsp + 0x458]
xor eax, eax
add rsp, 0x440
pop rdi
ret
Function at 0x180003590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
push r12
push r14
push r15
sub rsp, 0x248
xor ebx, ebx
mov r15d, edx
cmp dword [0x18001fd74], ebx
mov r12, r8
mov r14, rcx
jne 0x1800035f1
lea rcx, str.ntdll
mov dword [0x18001fd80], 0x11c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800035e7
lea rcx, [0x18001fd80]
call rax
mov dword [0x18001fd74], 1
mov eax, dword [0x18001fd84]
mov qword [rsp + 0x270], rbp
mov qword [rsp + 0x278], rsi
mov qword [rsp + 0x240], rdi
lea ecx, [rax + rax*4]
mov eax, dword [0x18001fd88]
lea edx, [rax + rcx*2]
cmp edx, 0x3e
jbe 0x1800036f3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.kernel32
mov dword [rsp + 0x20], ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetProcessMitigationPolicy
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800036f3
mov r9d, 4
lea r8, [rsp + 0x20]
mov rcx, rdi
lea edx, [r9 + 3]
call rax
test eax, eax
je 0x1800036f3
mov eax, dword [rsp + 0x20]
and eax, 1
je 0x1800036f3
mov edi, ebx
call fcn.1800033f0
mov rbp, rax
test rax, rax
je 0x1800036eb
mov edx, 5
mov dword [rsp + 0x288], ebx
lea r9, [rsp + 0x288]
mov rcx, rax
lea r8d, [rdx + 0x3b]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
pushfq
pop rcx
btr rcx, 0xa
push rcx
popfq
mov r8d, dword [rsp + 0x288]
lea rsi, [0x18001eb04]
mov rdi, rbp
lea r9, [rsp + 0x288]
mov ecx, 5
mov edx, 5
rep movsb byte [rdi], byte [rsi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, 1
test edi, edi
je 0x180003789
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180005b70
lea r9, [rsp + 0x288]
mov dword [rsp + 0x288], ebx
lea r8, [rsp + 0x30]
mov ecx, r15d
call fcn.1800032b0
test eax, eax
je 0x180003789
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x180003789
mov ebp, dword [rsp + 0x288]
lea r9, [rsp + 0x20]
add rbp, rax
mov dword [rsp + 0x20], ebx
mov rcx, rbp
mov r8d, 0x40
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test rbp, rbp
je 0x180003780
test r14, r14
je 0x180003780
pushfq
pop rax
btr rax, 0xa
push rax
popfq
mov rdi, rbp
mov rsi, r14
mov rcx, r15
rep movsb byte [rdi], byte [rsi]
mov qword [r12], rbp
mov ebx, 1
mov rdi, qword [rsp + 0x240]
mov eax, ebx
mov rsi, qword [rsp + 0x278]
mov rbp, qword [rsp + 0x270]
add rsp, 0x248
pop r15
pop r14
pop r12
pop rbx
ret
Function at 0x18000c4d0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000c500
xor eax, eax
jmp 0x18000c5c3
mov rbp, rbx
cmp word [rax], si
je 0x18000c525
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000c50c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000c508
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000c420
movsxd r14, eax
test eax, eax
jne 0x18000c563
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000c4f9
mov rcx, r14
call fcn.18000d2b8
mov rdi, rax
test rax, rax
jne 0x18000c57c
xor ecx, ecx
call fcn.18000aa88
jmp 0x18000c558
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000c420
test eax, eax
jne 0x18000c5ad
mov rcx, rdi
call fcn.18000aa88
jmp 0x18000c5b7
xor ecx, ecx
call fcn.18000aa88
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x2fc4c4c40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4c5d00
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4c5642
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ea108]
test eax, eax
je 0x2fc4c56da
lea rax, [0x2fc4ea0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ea110]
mov qword [rbp - 8], rax
jmp 0x2fc4c56be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c56b2
cmp qword [rbp - 0x10], 0
je 0x2fc4c56b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c5678
lea rax, [0x2fc4ea0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c56db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c57e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c5808
mov eax, 0
jmp 0x2fc4c5856
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c5831
mov eax, 0
jmp 0x2fc4c5856
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c5851
mov eax, 0
jmp 0x2fc4c5856
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c585c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c58da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c58d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c58d1
mov rax, qword [rbp - 8]
jmp 0x2fc4c58ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c58a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c4c60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4c5d20
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4c5662
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ea108]
test eax, eax
je 0x2fc4c56fa
lea rax, [0x2fc4ea0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ea110]
mov qword [rbp - 8], rax
jmp 0x2fc4c56de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c56d2
cmp qword [rbp - 0x10], 0
je 0x2fc4c56d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c5698
lea rax, [0x2fc4ea0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c56fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c5800
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c5828
mov eax, 0
jmp 0x2fc4c5876
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c5851
mov eax, 0
jmp 0x2fc4c5876
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c5871
mov eax, 0
jmp 0x2fc4c5876
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c587c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c58fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c58f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c58f1
mov rax, qword [rbp - 8]
jmp 0x2fc4c590f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c58c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1401e7680]
mov dword [rax], 1
mov rax, qword [0x1401e7690]
mov dword [rax], 1
mov rax, qword [0x1401e76a0]
mov dword [rax], 1
mov rax, qword [0x1401e7600]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140161bd0
Capabilities:
Query environment variable

Disassembly:
push r14
mov eax, 0x10080
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401c35d0
sub rsp, rax
xor eax, eax
xor edx, edx
xor esi, esi
mov r14d, 0x28
movzx edi, byte [rcx]
mov word [rsp + 0x80], ax
mov r12, rcx
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x2e]
mov word [rsp + 0x30], dx
test dil, dil
je 0x140161c79
nop dword [rax]
mov rax, r14
lea rbx, [rbp + rsi*2]
sub rax, rsi
cmp word [rbp + rsi*2], 0
je 0x140161c3e
nop dword [rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140161c30
test rax, rax
je 0x1401d4440
mov rcx, rbx
add rsi, 1
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r13
mov byte [rsp + 0x2e], dil
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
movzx edi, byte [r12 + rsi]
test dil, dil
jne 0x140161c18
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140161ca8
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10080
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140161cc0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor eax, eax
xor esi, esi
mov r13d, 0x28
movzx edi, byte [rcx]
mov word [rsp + 0x30], ax
mov rbp, rcx
mov r14, rdx
lea r15, [rsp + 0x30]
lea r12, [rsp + 0x2e]
test dil, dil
je 0x140161d61
nop word [rax + rax]
mov rax, r13
lea rbx, [r15 + rsi*2]
sub rax, rsi
cmp word [r15 + rsi*2], 0
je 0x140161d26
nop word [rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140161d18
test rax, rax
je 0x1401d4446
mov rcx, rbx
add rsi, 1
call sub.msvcrt.dll_wcslen
mov r8d, 2
mov rdx, r12
mov byte [rsp + 0x2e], dil
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x2f], 0
call sub.msvcrt.dll_mbstowcs
movzx edi, byte [rbp + rsi]
test dil, dil
jne 0x140161d00
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401b9b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [0x1401fe9b9], 0
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x1401b9bb8
lea rdx, [0x1401e366a]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1401b9c20
mov rbx, qword [0x1401fe878]
jmp 0x1401b9b75
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x1401b9b70
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, rbp
mov rdx, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1401a8e40
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x1401fe878], rax
mov ebx, dword [rax]
mov qword [0x1401fe878], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x1401fe878], rdx
call fcn.1401b8c60
cmp eax, ebx
jne 0x1401b9cba
mov byte [0x1401fe9b9], 1
jmp 0x1401b9b4e
cmp byte [0x1401fe9b8], 0
jne 0x1401b9b65
mov rbx, qword [sym.imp.python38.dll_PyDict_New]
lea rsi, [0x1401fe068]
call rbx
mov qword [0x1401ff308], rax
call rbx
mov qword [0x1401ff300], rax
call rbx
mov qword [0x1401ff2f8], rax
call rbx
mov qword [0x1401ff2f0], rax
call rbx
mov qword [0x1401ff2e8], rax
call rbx
mov qword [0x1401ff2e0], rax
call rbx
mov qword [0x1401ff2d8], rax
call rbx
mov r13, qword [sym.imp.python38.dll_PyLong_FromLong]
mov rbx, 0xfffffffffffffffb
mov qword [0x1401ff2d0], rax
nop dword [rax]
mov ecx, ebx
call r13
mov qword [rsi + rbx*8], rax
add rbx, 1
cmp rbx, 0x101
jne 0x1401b9c98
mov byte [0x1401fe9b8], 1
jmp 0x1401b9b65
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1401c22b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1401d39a0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1401d39a0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x1401c2f82
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1401ff768]
test eax, eax
je 0x1401c301a
lea rax, [0x1401ff740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1401ff770]
mov qword [rbp - 8], rax
jmp 0x1401c2ffe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1401c2ff2
cmp qword [rbp - 0x10], 0
je 0x1401c2ff2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1401c2fb8
lea rax, [0x1401ff740]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1401c301b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1401c3120
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1401c3148
mov eax, 0
jmp 0x1401c3196
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1401c3171
mov eax, 0
jmp 0x1401c3196
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1401c3191
mov eax, 0
jmp 0x1401c3196
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1401c319c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1401c321a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1401c3211
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1401c3211
mov rax, qword [rbp - 8]
jmp 0x1401c322f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1401c31e4
mov eax, 0
add rsp, 0x20
pop rbp
ret