joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18015bedc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
stc
jmp 0x18015befc
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
stc
cmc
mov qword [rax + 0x20], rdi
stc
push r14
clc
sub rsp, 0x40
jmp 0x18015bf17
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
shr bx, cl
sar ebx, cl
mov rbx, rax
stc
test rax, rax
jmp 0x18015bf30
jne 0x18015bf42
xor eax, eax
jmp 0x18015bf3d
jmp 0x18015c0cd
mov rbp, rbx
cmp sp, r14w
cmp word [rax], si
je 0x18015bf8b
or rax, 0xffffffffffffffff
jmp 0x18015bf5b
inc rax
cmp word [rbp + rax*2], si
jmp 0x18015bf68
jne 0x18015bf5b
lea rbp, [rbp + rax*2]
test bp, 0x7324
add rbp, 2
cmp word [rbp], si
jmp 0x18015bf85
jne 0x18015bf52
mov qword [rsp + 0x38], rsi
movsx r8w, r13b
sal r9b, cl
add r9, 0x6e982c4c
sub rbp, rbx
shrd r9d, r12d, 9
mov qword [rsp + 0x30], rsi
rol r8b, cl
add rbp, 2
or r9w, 0x4d29
sar rbp, 1
adc r9w, 0x577d
ror r9b, 0x9a
bt r9d, eax
mov r8, rbx
mov r9d, ebp
jmp 0x18015bfd5
mov dword [rsp + 0x28], esi
sub edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
jmp 0x18015bfe7
call fcn.18015bcdc
movsxd r14, eax
jmp 0x18015bff8
test eax, eax
jmp 0x18015bfff
jne 0x18015c018
mov rcx, rbx
jmp 0x18015c00d
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18015bf36
mov rcx, r14
jmp 0x18015c020
call fcn.180158884
mov rdi, rax
jmp 0x18015c02d
test rax, rax
jmp 0x18015c035
jne 0x18015c04c
xor ecx, ecx
jmp 0x18015c042
call fcn.180158be0
jmp 0x18015c005
mov qword [rsp + 0x38], rsi
bsf r8d, r10d
shrd r9w, r12w, 0x37
shr r8b, cl
mov r9d, ebp
mov r8b, 0xe0
mov qword [rsp + 0x30], rsi
mov r8, rbx
cmc
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
jmp 0x18015c07b
mov qword [rsp + 0x20], rdi
jmp 0x18015c085
call fcn.18015bcdc
test eax, eax
jmp 0x18015c091
jne 0x18015c0a9
mov rcx, rdi
jmp 0x18015c09f
call fcn.180158be0
jmp 0x18015c0bc
sub ecx, ecx
jmp 0x18015c0b0
call fcn.180158be0
mov rsi, rdi
movzx rcx, r11w
mov rcx, rbx
jmp 0x18015c0c4
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
rcr si, 0x1a
xchg bp, bp
btc rdi, r15
mov rbp, qword [rsp + 0x58]
xadd dil, r14b
rcr dil, cl
adc dil, 0x1f
mov rsi, qword [rsp + 0x60]
shr di, 0xc6
bts di, bx
stc
mov rdi, qword [rsp + 0x68]
sal r14b, cl
rcr r14b, cl
add rsp, 0x40
mov r14, rdx
pop r14
ret
Function at 0x18015cb63
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
xadd ch, ch
mov qword [rax + 8], rbx
xchg cx, cx
rcl ch, cl
inc cx
mov qword [rax + 0x10], rbp
shr cx, cl
cmc
mov qword [rax + 0x18], rsi
seto ch
clc
btr ecx, esi
mov qword [rax + 0x20], rdi
xor ch, 0xf9
push r14
shl ch, cl
bsr rcx, r14
btc cx, si
sub rsp, 0x90
lea rcx, [rax - 0x78]
jmp 0x18015cbab
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor r14d, r14d
cmp word [rsp + 0x62], r14w
jmp 0x18015cbbf
je 0x18015cd1c
mov rax, qword [rsp + 0x68]
test rax, rax
jmp 0x18015cbd2
je 0x18015cd1c
movsxd rbx, dword [rax]
neg sil
lea rsi, [rax + 4]
rcr rdi, cl
or dil, 0xdc
mov edi, 0x2000
rol cx, 0xfe
add rbx, rsi
cmp dword [rax], edi
movzx ecx, r15w
mov cx, 0x439a
cmovl edi, dword [rax]
jmp 0x18015cc10
mov ecx, edi
call fcn.1801613e9
cmp edi, dword [0x180096e50]
jmp 0x18015cc22
cmovg edi, dword [0x180096e50]
stc
test edi, edi
jmp 0x18015cc31
je 0x18015cd1c
mov ebp, r14d
clc
stc
cmp rsp, 0x763f45ba
cmp qword [rbx], 0xffffffffffffffff
jmp 0x18015cc4c
je 0x18015ccfa
cmp qword [rbx], 0xfffffffffffffffe
jmp 0x18015cc5b
je 0x18015ccfa
test byte [rsi], 1
jmp 0x18015cc69
je 0x18015ccfa
test byte [rsi], 8
jmp 0x18015cc77
jne 0x18015cc98
mov rcx, qword [rbx]
jmp 0x18015cc85
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jmp 0x18015cc92
je 0x18015ccfa
mov rax, rbp
movsxd rdx, r9d
xor dl, dil
lea r8, [0x180096a50]
movsxd rdx, ebx
mov rcx, rbp
sar rcx, 6
test spl, 0xcb
sal dl, cl
and edx, 0x4fa12713
and eax, 0x3f
mov rcx, qword [r8 + rcx*8]
cwd
movzx dx, r12b
movsx edx, di
lea rdx, [rax + rax*8]
not ax
movsx rax, r14w
mov rax, qword [rbx]
jmp 0x18015cce2
mov qword [rcx + rdx*8 + 0x28], rax
mov al, r14b
mov al, byte [rsi]
jmp 0x18015ccf1
mov byte [rcx + rdx*8 + 0x38], al
jmp 0x18015ccfa
inc rbp
jmp 0x18015cd02
inc rsi
add rbx, 8
test dil, 0xb7
sub rdi, 1
jmp 0x18015cd16
jne 0x18015cc43
lea r11, [rsp + 0x90]
not r14b
cmovs r14d, ecx
movsx ebx, r12w
mov rbx, qword [r11 + 0x10]
setp dil
movzx edi, r9w
movsx rsi, r13w
mov rbp, qword [r11 + 0x18]
cmovns edi, r13d
movsx rsi, r12w
mov rsi, qword [r11 + 0x20]
cmovge edi, ebx
movzx r14w, bpl
mov rdi, qword [r11 + 0x28]
movsx r14, r11w
mov rsp, r11
movzx r14d, r14w
setnp r14b
pop r14
jmp 0x18015cd71
ret
Function at 0x180162326
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, r8d
mov qword [rsp + 0x18], rbp
push rsi
cwde
cbw
setbe ah
push rdi
movsxd rax, ecx
push r14
movzx eax, di
cbw
movsxd rax, eax
mov eax, 0x1450
jmp 0x180162353
call fcn.180165bd8
sub rsp, rax
xchg al, sil
shrd ax, sp, 0x5d
mov rax, qword [0x180094010]
movsxd rdi, r12d
and di, 0x256b
xor rax, rsp
mov qword [rsp + 0x1440], rax
ror bp, 0x56
movsxd r10, edx
sar dx, 0xb3
btr esi, 0x93
mov rdi, rcx
mov rax, r10
mov ebp, r9d
or dl, 0xa7
sar rax, 6
rcr r14b, cl
bts rsi, r8
movsx rdx, di
lea rcx, [0x180096a50]
movzx r14d, r15w
sal dl, 0x54
and r10d, 0x3f
rcl r14b, 0x5c
lea rbp, [rbp + r8]
rcr esi, 0xc2
shr esi, 0x46
mov rsi, r8
bsf dx, bp
cmp r8, 0x2f201fcf
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
btr r14w, 0xf7
bsr r14, rsi
rcr r14b, cl
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
cmp dil, 0xcb
cmc
mov dword [rdi + 8], eax
test rax, 0x17671b66
stc
cmp r8, rbp
jae 0x1801624f0
lea rbx, [rsp + 0x40]
clc
cmc
cmp rsi, rbp
jmp 0x18016241c
jae 0x180162473
mov al, byte [rsi]
jmp 0x180162429
inc rsi
cmp al, 0xa
jmp 0x180162433
jne 0x180162451
inc dword [rdi + 8]
jmp 0x180162441
mov byte [rbx], 0xd
jmp 0x180162449
inc rbx
jmp 0x180162451
mov byte [rbx], al
movzx rax, r10w
cwde
inc rbx
or eax, ecx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x18016246d
jb 0x180162414
and qword [rsp + 0x20], 0
lahf
lea rax, [rsp + 0x40]
bt edx, 0x3c
sub ebx, eax
setle r8b
lea r9, [rsp + 0x30]
mov r8w, 0x7ff1
cdq
not cx
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1801624a7
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1801624b4
je 0x1801624e5
mov eax, dword [rsp + 0x30]
test r10b, dl
cmc
add dword [rdi + 4], eax
test r13w, r15w
stc
cmp eax, ebx
jb 0x1801624f0
cmp rsi, rbp
jmp 0x1801624da
jb 0x18016240d
jmp 0x1801624f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
ror ah, 0x72
mov rax, rdi
btr rcx, 0xbe
and cl, bpl
sbb cl, r9b
mov rcx, qword [rsp + 0x1440]
clc
xor rcx, rsp
jmp 0x18016250f
call fcn.18014946c
lea r11, [rsp + 0x1450]
movsx r14w, sil
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movsx r14w, dil
jmp 0x180162533
mov rsp, r11
movsxd rdi, ebp
xchg dil, sil
mov rdi, 0x792149b6
pop r14
mov edi, edx
movsxd rsi, edi
pop rdi
movzx rsi, sp
pop rsi
jmp 0x180162555
ret
Function at 0x180162556
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
lahf
movzx ax, r12b
push rsi
push rdi
movsxd rax, r8d
mov ax, 0x79bf
push r14
xchg al, al
movzx ax, bpl
movsxd rax, edi
mov eax, 0x1450
jmp 0x180162585
call fcn.180165bd8
sub rsp, rax
btc bp, r13w
adc di, r10w
mov rax, qword [0x180094010]
cmp r13b, sil
xor rax, rsp
bts esi, ecx
cmovno r14, r13
mov qword [rsp + 0x1440], rax
shr sil, 0x6f
sbb r14b, spl
movsxd r10, edx
sbb rax, 0x14b60221
rcr dh, cl
lahf
mov rdi, rcx
and dl, 0x73
mov rax, r10
mov ebp, r9d
shl r14d, cl
sar rax, 6
rcr cx, 0x87
lea rcx, [0x180096a50]
add dl, r14b
and r10d, 0x3f
shl sil, 0x57
cwd
add rbp, r8
mov rsi, r8
sal dl, 0xe6
shl dh, 0xd5
mov rax, qword [rcx + rax*8]
movzx r14d, si
and r14b, dl
lea rdx, [r10 + r10*8]
btr r14w, 0xb2
shl r14d, 0x8b
mov r14, qword [rax + rdx*8 + 0x28]
test ah, 0x1e
xor eax, eax
cmp dl, 0xd7
jmp 0x180162628
mov qword [rdi], rax
stc
mov dword [rdi + 8], eax
test r9b, 0x37
cmp r8, rbp
jae 0x18016275e
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x180162649
jae 0x1801626d2
movzx eax, word [rsi]
cmp esi, 0x2508663d
test ebx, 0x6ead42ef
add rsi, 2
cmp r15b, 0xe2
stc
cmp ax, 0xa
jmp 0x180162670
jne 0x18016269b
add dword [rdi + 8], 2
rcl ch, cl
cmp ebp, 0x1d9a3d11
mov ecx, 0xd
jmp 0x18016268c
mov word [rbx], cx
jmp 0x180162694
add rbx, 2
cmp r10b, r12b
mov word [rbx], ax
movzx ax, r14b
movsx rax, cx
add rbx, 2
add rax, r15
btc ax, 0x1e
lea rax, [rsp + 0x143e]
jmp 0x1801626c4
cmp rbx, rax
jmp 0x1801626cc
jb 0x180162641
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
dec r8
sar rbx, 1
xadd rcx, rcx
lea rdx, [rsp + 0x40]
or cx, r10w
mov r8b, sil
add cx, sp
add ebx, ebx
not r8b
setnp ch
mov rcx, r14
mov r8d, ebx
jmp 0x180162711
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18016274b
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
test r14b, 0xc3
clc
cmp eax, ebx
jmp 0x180162732
jb 0x18016275e
cmp rsi, rbp
jmp 0x180162740
jb 0x18016263c
jmp 0x18016275e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
test r9b, r13b
xadd ah, al
sub cx, 0x353f
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x180162771
call fcn.18014946c
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movzx di, r14b
movsx si, spl
mov rbp, qword [r11 + 0x30]
xchg sil, dil
mov rsp, r11
movsx edi, cx
movzx r14, r11w
pop r14
mov di, 0x47ca
xchg dil, sil
mov rdi, r13
pop rdi
bswap si
mov sil, spl
pop rsi
jmp 0x1801627b6
ret
Function at 0x1801627b7
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
cbw
jmp 0x1801627e8
push rsi
push rdi
mov al, r12b
movsxd rax, r15d
nop
push r12
push r14
bswap ax
movsx eax, bx
push r15
mov eax, 0x1470
call fcn.180165bd8
sub rsp, rax
btr r12d, 0x8b
sal r10d, 0x9a
btc bx, 0xec
mov rax, qword [0x180094010]
sbb r12b, sil
xor rax, rsp
bt bx, r10w
bt di, 6
mov qword [rsp + 0x1460], rax
bsf r10, r14
neg r14d
movzx ebx, di
movsxd r10, edx
mov rbx, rcx
sub dil, spl
movzx rdx, r8w
mov rax, r10
xadd cl, r15b
mov r14d, r9d
movsx r15, dx
sar rax, 6
adc dil, r14b
cmp ecx, 0x15937bbf
btc edx, eax
lea rcx, [0x180096a50]
and r10d, 0x3f
or edx, eax
add r15, 0x33f4356f
rol r12d, 0x32
add r14, r8
add dil, bl
inc di
adc r12b, dil
mov r15, r8
mov rdi, r8
not rdx
shld r12d, ebx, 0x28
setp r12b
mov rax, qword [rcx + rax*8]
or r12b, 0xe0
movzx r12, di
ror dh, cl
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
cmp r14d, 0x657a2553
sub eax, eax
stc
mov qword [rbx], rax
cmp bp, 0x434e
stc
cmp r8, r14
jmp 0x1801628d4
mov dword [rbx + 8], eax
jmp 0x1801628dc
jae 0x180162a82
lea rax, [rsp + 0x50]
test r8w, 0x7273
cmp rdi, r14
jmp 0x1801628f5
jae 0x180162959
movzx ecx, word [rdi]
jmp 0x180162903
add rdi, 2
cmp cx, 0xa
jmp 0x180162910
jne 0x18016292c
mov edx, 0xd
jmp 0x180162924
mov word [rax], dx
clc
add rax, 2
mov word [rax], cx
movzx cx, ch
sar rcx, 0x77
shld cx, r8w, 0x93
add rax, 2
lea rcx, [rsp + 0x6f8]
test esi, 0x5dc934a6
cmc
cmp rax, rcx
jb 0x1801628ed
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
rcr r8b, 0x1f
xadd r9, r9
rol r8w, 0xb
and qword [rsp + 0x30], 0
or r8b, r13b
lea r8, [rsp + 0x50]
setg r9b
bt r9w, 0x19
sub rax, rcx
sar ch, cl
mov dword [rsp + 0x28], 0xd55
shld r9, r12, 0x51
rcl ch, 0x97
btc rcx, rbp
lea rcx, [rsp + 0x700]
sar rax, 1
rol r9b, cl
movsxd r9, r14d
or r9b, 0x6d
mov qword [rsp + 0x20], rcx
mov cx, 0x6c3b
mov r9d, eax
bts cx, bp
shld rcx, r12, 0x67
mov ecx, 0xfde9
clc
stc
xor edx, edx
call fcn.18015bcdc
mov ebp, eax
test eax, eax
jmp 0x1801629e3
je 0x180162a70
sub esi, esi
cmc
test ch, 0x12
test eax, eax
jmp 0x1801629f6
je 0x180162a49
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
rcr r9d, 0xd6
mov ecx, esi
lea r9, [rsp + 0x40]
mov r8d, ebp
add rdx, rcx
neg rcx
mov rcx, r12
clc
sub r8d, esi
jmp 0x180162a2a
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180162a70
add esi, dword [rsp + 0x40]
cmp esi, ebp
jmp 0x180162a43
jb 0x1801629fc
mov eax, edi
jmp 0x180162a53
sub eax, r15d
cmp cx, 0x3234
mov dword [rbx + 4], eax
cmp r10, rbx
test r12d, 0x29b247f3
cmp rdi, r14
jmp 0x1801628dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
btc rax, 0xcb
shrd cx, bp, 0x13
mov rax, rbx
rcr cl, 0xbe
and ch, 0xfe
shld cx, r9w, 0
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
jmp 0x180162aa1
call fcn.18014946c
lea r11, [rsp + 0x1470]
movsxd rbx, r9d
not r14
mov rbx, qword [r11 + 0x30]
movsx r12d, di
mov rbp, qword [r11 + 0x40]
movsx edi, r8w
bswap r15
mov rsp, r11
movzx r15w, cl
not r12w
jmp 0x180162ad8
pop r15
cmovo r12w, sp
pop r14
pop r12
movsxd rsi, r12d
pop rdi
jmp 0x180162af3
pop rsi
jmp 0x180162af9
ret
Function at 0x140003960
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140051680]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
mov edi, ecx
call fcn.140003580
call fcn.1400034c0
mov rax, qword [sym.imp.python310.dll_Py_DebugFlag]
xor esi, esi
mov r8b, 1
mov qword [0x1400532b0], rbx
mov rdx, rbx
mov dword [0x1400532b8], edi
mov ecx, edi
mov dword [rax], esi
mov rax, qword [sym.imp.python310.dll_Py_InspectFlag]
mov dword [rax], esi
mov rax, qword [sym.imp.python310.dll_Py_InteractiveFlag]
mov dword [rax], esi
mov rax, qword [sym.imp.python310.dll_Py_OptimizeFlag]
mov dword [rax], esi
mov rax, qword [sym.imp.python310.dll_Py_DontWriteBytecodeFlag]
mov dword [rax], esi
mov rax, qword [sym.imp.python310.dll_Py_NoUserSiteDirectory]
mov dword [rax], 1
mov rax, qword [sym.imp.python310.dll_Py_IgnoreEnvironmentFlag]
mov dword [rax], esi
mov rax, qword [sym.imp.python310.dll_Py_VerboseFlag]
mov dword [rax], esi
mov rax, qword [sym.imp.python310.dll_Py_BytesWarningFlag]
mov dword [rax], esi
mov rax, qword [sym.imp.python310.dll_Py_UTF8Mode]
mov dword [rax], esi
mov rax, qword [sym.imp.python310.dll_Py_FrozenFlag]
mov dword [rax], 1
mov rax, qword [sym.imp.python310.dll_Py_NoSiteFlag]
mov dword [rax], 1
call fcn.1400035e0
call qword [sym.imp.python310.dll_Py_Initialize]
call fcn.1400035b0
mov rax, qword [sym.imp.python310.dll_Py_NoSiteFlag]
xor r8d, r8d
mov rdx, rbx
mov ecx, edi
mov dword [rax], 1
call fcn.1400035e0
mov rdx, qword [0x1400532b0]
mov ecx, edi
call qword [sym.imp.python310.dll_PySys_SetArgv]
call fcn.14000f7a0
call fcn.140001480
call fcn.1400018d0
call fcn.14000fa20
call fcn.140003f40
call fcn.14001c290
call fcn.14000ff80
call fcn.14000ffa0
call fcn.14001c270
call fcn.140010350
call fcn.140010410
call fcn.140011fb0
call fcn.14001cbb0
call fcn.14001cb90
call fcn.140003700
call fcn.1400129b0
call fcn.1400159c0
mov rcx, qword [sym.imp.python310.dll_PyImport_FrozenModules]
mov rax, qword [0x1400532c0]
mov qword [rcx], rax
call fcn.140001650
call qword [sym.imp.python310.dll__PyWarnings_Init]
call fcn.14001c910
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
mov r8d, 0x80
lea rcx, str.NUITKA_ONEFILE_PARENT
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x7d
ja 0x140003b51
lea rcx, [rsp + 0x30]
call fcn.140021f80
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140003450]
mov dword [0x1400532d0], eax
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.python310.dll_PyImport_GetModuleDict]
mov rcx, rax
lea rdx, str.__main__
call qword [sym.imp.python310.dll_PyDict_DelItemString]
lea rcx, str.__main__
call fcn.1400033a0
call fcn.1400033b0
mov ecx, eax
call qword [sym.imp.python310.dll_Py_Exit]
int3
Function at 0x1400116e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
test edx, edx
je 0x1400117a4
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub r9, 1
jne 0x140011700
not eax
ret
Function at 0x14001d6ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001d6f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001d6f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001d6f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001d6f6
cmp dword [rcx + 0x84], 0xe
jbe 0x14001d6f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001d6f8
xor al, al
add rsp, 0x28
ret

Function at 0x140027d58
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140027b54
Function at 0x14002d4e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002d567
mov rsi, rbx
cmp word [rax], bp
je 0x14002d526
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14002d510
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14002d50c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400285d8
mov rdi, rax
test rax, rax
je 0x14002d554
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140033ec0
mov rbp, rdi
xor ecx, ecx
call fcn.140029378
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ff90
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14002ffa6
mov al, 1
jmp 0x140030006
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14002ffb7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140030004
mov ecx, dword [rcx + 0x18]
nop
call fcn.14002dda0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140030004
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140030004
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140030004
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140030006
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140033ca0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140033cc8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140033cc8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140004870
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
cmp byte [rcx + 0x12c], 0
je 0x140004a59
lea rdi, [rcx + 0x128]
cmp dword [rdi], 0
jne 0x1400048e0
cmp byte [0x14005b310], 0
je 0x140004a46
call fcn.1400092f0
lea rcx, str.wsudo_bridge:_parent_process_id0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0x21
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140009370
xor al, al
jmp 0x140004a5b
mov rdx, rdi
lea rcx, str.wsudo_bridge_FreeConsole._parentid:__d
call fcn.140006c50
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_AttachConsole]
cmp eax, 1
je 0x140004995
lea rax, [0x1400338b0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140001230
nop
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, str.wsudo_bridge:_AttachConsole_parent__d_error:__s
call fcn.140006de0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140004a46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a79
jmp 0x140004a41
cmp qword [rbx + 0x118], 0
je 0x140004a4a
lea rcx, [rbx + 0x108]
cmp qword [rcx + 0x18], 8
jb 0x1400049b4
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, 1
je 0x140004a4a
lea rax, [0x1400338b0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140001230
nop
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, str.wsudo_bridge:_SetCurrentDirectoryW_parent__d_error:__s
call fcn.140006de0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140004a46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a73
call fcn.140014f34
xor al, al
jmp 0x140004a5b
mov rdx, rdi
lea rcx, str.wsudo_bridge_AttachConsole_done._parentid:__d
call fcn.140006c50
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140014ed0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.14001bb3c
int3
call fcn.14001bb3c
int3
Function at 0x140006990
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 7
mov word [rcx], bp
mov dword [rsp + 0x30], 1
movaps xmm0, xmmword [rdx]
movdqa xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x20], bp
mov r9d, 0x100
movzx r8d, byte [rsp + 0x60]
mov edx, r9d
call fcn.1400074f0
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400069f9
mov rdx, qword [rbx]
mov r8d, 0x100
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140006a3d
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x140006a1d
mov rax, qword [rbx]
mov qword [rbx + 0x10], rbp
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rdx, rdi
xor r8d, r8d
mov rcx, rbx
call fcn.140005f80
cmp edi, 0x100
jb 0x140006a7f
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140006a60
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, edi
jae 0x140006a7f
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.140005f80
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret