joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012b40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x140012b98
sub r9d, edi
je 0x140012b91
sub r9d, edi
je 0x140012b8a
sub r9d, edi
je 0x140012b83
cmp r9d, edi
je 0x140012b7c
mov ebx, edi
jmp 0x140012b9d
mov ebx, 0xffff
jmp 0x140012b9d
mov ebx, 0x40
jmp 0x140012b9d
mov ebx, 2
jmp 0x140012b9d
mov ebx, 8
jmp 0x140012b9d
mov ebx, 0x10
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140012bcd
mov rdx, rsi
lea rcx, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s.
call fcn.140013010
xor eax, eax
jmp 0x140012c2e
mov rax, qword [rsp + 0x88]
mov r9d, ebx
mov rcx, qword [rsp + 0x40]
mov r8, rbp
mov qword [rsp + 0x30], rax
xor edx, edx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140012c21
mov rdx, rbp
lea rcx, str.ReadRegKey_RegGetValue_failed_for_value___s.
call fcn.140013010
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140013010
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x250
cmp byte [0x140091758], 0
mov rbx, rcx
je 0x1400130ab
mov qword [rax - 0x10], rdi
lea rcx, [rsp + 0x40]
xor edx, edx
lea rdi, [rax + 0x10]
mov r8d, 0x200
call fcn.1400144d0
call fcn.140002a20
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
mov ebx, 0x1ff
mov rcx, qword [rax]
mov r9d, ebx
lea r8d, [rbx + 1]
call fcn.140046894
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, ecx
lea rcx, [rsp + 0x40]
cmove eax, ebx
cdqe
mov byte [rsp + rax + 0x40], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdi, qword [rsp + 0x248]
add rsp, 0x250
pop rbx
ret

Function at 0x140013fd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001401e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001401e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001401e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001401e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001401e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140014020
xor al, al
add rsp, 0x28
ret

Function at 0x14004ce5c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004cbec
Function at 0x14005f428
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14005f458
xor eax, eax
jmp 0x14005f51b
mov rbp, rbx
cmp word [rax], si
je 0x14005f47d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14005f464
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14005f460
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14005b080
movsxd r14, eax
test eax, eax
jne 0x14005f4bb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14005f451
mov rcx, r14
call fcn.140052dbc
mov rdi, rax
test rax, rax
jne 0x14005f4d4
xor ecx, ecx
call fcn.140052d80
jmp 0x14005f4b0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14005b080
test eax, eax
jne 0x14005f505
mov rcx, rdi
call fcn.140052d80
jmp 0x14005f50f
xor ecx, ecx
call fcn.140052d80
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140069538
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14006954e
mov al, 1
jmp 0x1400695ba
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14006955f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400695b8
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400608d8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400695b8
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400695b8
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400695b8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400695ba
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14006a3c4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400923a0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14006a41b
cmp word [rdx], r13w
jne 0x14006a41b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14006a420
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14006a551
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14006a572
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14006a459
mov rdx, r9
mov word [rbx], cx
jmp 0x14006a480
cmp r9, r8
jae 0x14006a490
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14006a43a
jmp 0x14006a551
lea r9, [rsp + 0x80]
mov word [rsp + 0x70], si
mov r8d, r12d
mov dword [rsp + 0x80], esi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rsi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006a546
cmp dword [rsp + 0x80], esi
je 0x14006a546
lea r8, [0x1400923a0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14006a51e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14006a4ee
mov word [rbx], r13w
jmp 0x14006a54e
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14006a4fb
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14006a54e
cmp word [rsp + 0x70], r13w
jne 0x14006a52b
cmp rbx, r14
je 0x14006a4e8
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14006a078
cmp word [rsp + 0x70], r13w
je 0x14006a551
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400923a0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14006a54b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14006a551
Function at 0x14006d038
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400477ec
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14006d0c2
cmp byte [rbp - 0x21], r15b
je 0x14006d0bd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14006d0f8
call fcn.140057a40
test eax, eax
jne 0x14006d0e4
cmp byte [rbp - 0x21], r15b
je 0x14006d0dc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14006d0f8
cmp byte [rbp - 0x21], r15b
je 0x14006d0f5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14005c4cc
test eax, eax
jne 0x14006d198
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400477ec
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14006d137
cmp byte [rbp - 0x21], r15b
je 0x14006d16c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14006d16c
call fcn.140057a40
test eax, eax
jne 0x14006d158
cmp byte [rbp - 0x21], r15b
je 0x14006d151
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14006d16c
cmp byte [rbp - 0x21], r15b
je 0x14006d169
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14005c4cc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14006d198
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14006d19b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14006d1a9
mov rcx, rdi
call fcn.140052d80
cmp byte [rbp + 0x3f], r15b
je 0x14006d1b8
mov rcx, qword [rbp + 0x27]
call fcn.140052d80
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14006f938
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14006a078
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14006a078
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14006fa88
cmp rax, 0xffffffffffffffff
je 0x14006fa88
xor edi, edi
test rbp, rbp
jle 0x14006fa33
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140056d08
mov rbx, rax
test rax, rax
jne 0x14006f9c0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14006fa29
mov edx, 0x8000
mov ecx, r14d
call fcn.14004d008
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14005a324
cmp eax, 0xffffffff
je 0x14006fa09
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14006f9d0
mov edx, r15d
mov ecx, r14d
call fcn.14004d008
jmp 0x14006fa29
cmp byte [rsi + 0x38], dil
je 0x14006fa20
cmp dword [rsi + 0x34], 5
jne 0x14006fa20
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14006fa29
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140052d80
jmp 0x14006fa9c
jns 0x14006fa9c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14006a078
cmp rax, 0xffffffffffffffff
jne 0x14006fa54
cmp byte [rsi + 0x30], dil
je 0x14006fa9c
mov edi, dword [rsi + 0x2c]
jmp 0x14006fa9c
mov ecx, r14d
call fcn.1400608d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14006fa9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14006fa9c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14006fa95
mov eax, dword [rsi + 0x2c]
jmp 0x14006fa9a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14006a078
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14052e040]
mov dword [rax], 1
mov rax, qword [0x14052e050]
mov dword [rax], 1
mov rax, qword [0x14052e060]
mov dword [rax], 1
mov rax, qword [0x14052dfc0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140495850
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140500520
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x140495915
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x140511412
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x1404958f6
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x1404958e8
test rsi, rsi
je 0x140511412
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x1404958a8
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140495944
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140495960
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x140495a1d
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x140511418
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x1404959fe
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x1404959f0
test rsi, rsi
je 0x140511418
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x1404959b0
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1404f67b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x14056a901], 0
mov rbp, rcx
mov rdi, rdx
mov r12, r8
je 0x1404f6858
lea rdx, [0x140529dc2]
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1404f68c0
mov rbx, qword [0x14056a7a0]
jmp 0x1404f67f5
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, r12
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x1404f67f0
movzx eax, word [rdx + 4]
lea r8, [rdx + 6]
test ax, ax
je 0x1404f6847
lea rbx, [rdi + rax*8]
nop word cs:[rax + rax]
mov rdx, rdi
mov rcx, rbp
add rdi, 8
call fcn.1404e5b90
mov r8, rax
cmp rdi, rbx
jne 0x1404f6830
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x14056a7a0], rax
mov ebx, dword [rax]
mov qword [0x14056a7a0], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x14056a7a0], rdx
call fcn.1404f58e0
cmp eax, ebx
jne 0x1404f6928
mov byte [0x14056a901], 1
jmp 0x1404f67d0
cmp byte [0x14056a900], 0
jne 0x1404f67e7
mov rbx, qword [sym.imp.python311.dll_PyDict_New]
call rbx
mov qword [0x14056b4a8], rax
call rbx
mov qword [0x14056b4a0], rax
call rbx
mov qword [0x14056b498], rax
call rbx
mov qword [0x14056b490], rax
call rbx
mov qword [0x14056b488], rax
call rbx
mov qword [0x14056b480], rax
call rbx
mov qword [0x14056b478], rax
call rbx
mov byte [0x14056a900], 1
mov qword [0x14056b470], rax
jmp 0x1404f67e7
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1404ff200
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140510990
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140510990
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x1404ffed2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14056b968]
test eax, eax
je 0x1404fff6a
lea rax, [0x14056b940]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14056b970]
mov qword [rbp - 8], rax
jmp 0x1404fff4e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1404fff42
cmp qword [rbp - 0x10], 0
je 0x1404fff42
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1404fff08
lea rax, [0x14056b940]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1404fff6b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140500070
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140500098
mov eax, 0
jmp 0x1405000e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1405000c1
mov eax, 0
jmp 0x1405000e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1405000e1
mov eax, 0
jmp 0x1405000e6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1405000ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14050016a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140500161
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140500161
mov rax, qword [rbp - 8]
jmp 0x14050017f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140500134
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140005600]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140005610]
mov dword [rax], 1
mov rax, qword [0x140005620]
mov dword [rax], 1
mov rax, qword [0x140005580]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400055f0]
mov dword [0x14000800c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400056c0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400056a0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140005560]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a