joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005560
Capabilities:
Create directory
Query environment variable

Disassembly:
push rdi
mov eax, 0x4030
call fcn.140009c80
sub rsp, rax
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140006b00
mov rdi, rax
test rax, rax
jne 0x1400055a9
lea rcx, str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.140001d00
xor eax, eax
jmp 0x140005692
mov r8d, 0x1000
mov qword [rsp + 0x4048], rbx
lea rdx, [rsp + 0x2020]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.140010050
test ebx, ebx
jne 0x1400055e9
lea rcx, str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.140001d00
xor eax, eax
jmp 0x14000568a
mov r8d, 0x1000
lea rdx, [rsp + 0x2020]
xor ecx, ecx
call fcn.140011158
mov rbx, rax
test rax, rax
jne 0x140005616
lea rcx, str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.140001d00
xor eax, eax
jmp 0x14000568a
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
call fcn.14000b2f0
mov edx, 0x5c
mov rcx, rbx
call fcn.14000b244
mov rdi, rax
test rax, rax
je 0x14000567c
nop dword [rax]
mov r8, rdi
lea rcx, [rsp + 0x20]
sub r8, rbx
mov rdx, rbx
sar r8, 1
inc r8
call fcn.140011cfc
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x5c
lea rcx, [rdi + 2]
call fcn.14000b244
mov rdi, rax
test rax, rax
jne 0x140005640
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, rbx
mov rbx, qword [rsp + 0x4048]
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140009ce0
add rsp, 0x4030
pop rdi
ret

Function at 0x1400056b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1030
call fcn.140009c80
sub rsp, rax
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [0x140025530]
call fcn.140002d80
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call fcn.140005af0
xor edi, edi
mov rbx, rax
test rsi, rsi
je 0x1400057a3
mov rcx, rsi
test rax, rax
je 0x1400057ab
call fcn.14000bee0
test eax, eax
jne 0x14000578f
nop word [rax + rax]
mov r9, rsi
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call fcn.14000c198
test rax, rax
jne 0x14000574e
mov rcx, rsi
call fcn.14000bf0c
test eax, eax
je 0x140005774
mov rcx, rsi
jmp 0x140005785
mov r9, rbx
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 1
call fcn.14000cba0
test rax, rax
je 0x140005782
mov rcx, rbx
call fcn.14000bf0c
test eax, eax
jne 0x140005782
mov rcx, rsi
call fcn.14000bee0
test eax, eax
je 0x140005720
jmp 0x14000578f
mov rcx, rbx
call fcn.140013648
mov edi, 0xffffffff
mov rcx, rsi
call fcn.14000be7c
mov rcx, rbx
call fcn.14000be7c
mov eax, edi
jmp 0x1400057b5
test rbx, rbx
je 0x1400057b0
mov rcx, rbx
call fcn.14000be7c
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140009ce0
add rsp, 0x1030
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005830
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x2060
call fcn.140009c80
sub rsp, rax
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x2050], rax
mov rbp, rdx
mov r14, rcx
test rdx, rdx
je 0x1400058bb
lea rcx, [0x140027a04]
call fcn.140005a40
mov rcx, rbp
mov rsi, rax
call fcn.140005560
mov rdi, rax
test rax, rax
je 0x14000598f
mov rdx, rax
lea rcx, [0x140027a08]
call fcn.1400123f0
mov rcx, rdi
mov ebx, eax
call fcn.140010050
test ebx, ebx
je 0x1400058c0
lea rcx, str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
call fcn.140001d00
xor eax, eax
jmp 0x140005a18
mov rsi, qword [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
mov r9d, eax
lea r8, str._MEI_d
mov edx, 0x10
lea rcx, [rsp + 0x28]
call fcn.1400063d0
xor ebx, ebx
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.14001362c
mov rcx, rax
mov rdi, rax
call fcn.1400067b0
test eax, eax
je 0x140005996
mov rcx, rdi
call fcn.140010050
inc ebx
cmp ebx, 5
jl 0x1400058f0
test rbp, rbp
je 0x14000598f
xor r8d, r8d
lea rdx, [0x140027a04]
xor ecx, ecx
call fcn.140006b00
test rsi, rsi
je 0x140005979
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140006b00
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400123f0
mov rcx, rdi
call fcn.140010050
mov rcx, rbx
call fcn.140010050
mov rcx, rsi
call fcn.140010050
xor eax, eax
jmp 0x140005a18
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.140010050
xor eax, eax
jmp 0x140005a18
mov r8d, 0x1000
mov rdx, rdi
mov rcx, r14
call fcn.140006c10
mov rcx, rdi
call fcn.140010050
test rbp, rbp
je 0x140005a13
xor r8d, r8d
lea rdx, [0x140027a04]
xor ecx, ecx
call fcn.140006b00
test rsi, rsi
je 0x1400059fd
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140006b00
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400123f0
mov rcx, rdi
call fcn.140010050
mov rcx, rbx
call fcn.140010050
mov rcx, rsi
jmp 0x140005a0e
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.140010050
mov eax, 1
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.140009ce0
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140005a40
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4038
call fcn.140009c80
sub rsp, rax
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140006b00
mov r8d, 0x2000
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140005ad6
mov r8d, 0x2000
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.140006c10
test rax, rax
je 0x140005ad6
cmp byte [rax], 0
je 0x140005ad6
mov rcx, rax
call fcn.140014d40
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140009ce0
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140009ce0
add rsp, 0x4038
ret

Function at 0x140005fe0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140006b00
xor edx, edx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rdi
mov ebx, eax
call fcn.140010050
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006020
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2110
call fcn.140009c80
sub rsp, rax
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rdx, rcx
xor edi, edi
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x50], edi
mov r8d, 0x1000
call fcn.140006b00
mov ebx, 1
lea ecx, [rdi + 0x16]
mov edx, ebx
call fcn.14001308c
mov edx, ebx
lea ecx, [rdi + 2]
call fcn.14001308c
mov edx, ebx
lea ecx, [rdi + 0xf]
call fcn.14001308c
mov edx, ebx
lea ecx, [rdi + 0x15]
call fcn.14001308c
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x58], 0x18
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
mov qword [rsp + 0x98], rdi
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xcc], 0x101
mov word [rsp + 0xd0], bx
call fcn.140010220
mov rcx, rax
call fcn.140014db8
mov ecx, eax
call fcn.140012c34
mov ecx, ebx
mov qword [rsp + 0xe0], rax
call fcn.140010220
mov rcx, rax
call fcn.140014db8
mov ecx, eax
call fcn.140012c34
lea ecx, [rdi + 2]
mov qword [rsp + 0xe8], rax
call fcn.140010220
mov rcx, rax
call fcn.140014db8
mov ecx, eax
call fcn.140012c34
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x100]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400061a1
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x50]
jmp 0x1400061b9
lea rdx, str.Error_creating_child_process__n
lea rcx, [0x140027b08]
call fcn.140001d60
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.140009ce0
mov rbx, qword [rsp + 0x2128]
add rsp, 0x2110
pop rdi
ret
Function at 0x1400067b0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2070
call fcn.140009c80
sub rsp, rax
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor ebx, ebx
mov qword [rsp + 0x38], 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
mov rdi, rcx
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x38]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140006881
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140006838
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140006881
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.140010048
mov rbx, rax
test rax, rax
je 0x140006881
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r8, rbx
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140006881
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov rcx, rbx
call fcn.140010050
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x14000689a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
lea r9, str.S_1_3_4
test rbx, rbx
lea r8, str.D:_A__FA____s_
mov edx, 0x1000
lea rcx, [rsp + 0x60]
cmovne r9, rbx
call fcn.140006520
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
mov dword [rsp + 0x48], 0x18
lea r8, [rsp + 0x50]
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x60]
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x14000690c
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000690c
xor eax, eax
jmp 0x140006911
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.140009ce0
mov rbx, qword [rsp + 0x2088]
add rsp, 0x2070
pop rdi
ret
Function at 0x140012428
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140012448
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140011c6c
or eax, 0xffffffff
jmp 0x14001244a
xor eax, eax
add rsp, 0x28
ret

Function at 0x140012778
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x1400124b7
call fcn.140011cdc
mov dword [rax], 0x16
call fcn.140015afc
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140009ce0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x14001247e
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140012525
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1400124f8
cmp eax, 3
jbe 0x140012515
cmp eax, 8
je 0x140012505
cmp eax, 0x12
je 0x140012515
call fcn.140011cdc
mov dword [rax], 0x16
jmp 0x14001248e
call fcn.140011cdc
mov dword [rax], 0xc
jmp 0x14001248e
call fcn.140011cdc
mov dword [rax], 2
jmp 0x14001248e
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.1400126c0
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.1400126c0
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.1400126c0
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14001b280
test eax, eax
jne 0x140012583
mov rax, rdi
jmp 0x140012492
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140015b1c
int3
jmp 0x140012450
Function at 0x140012780
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140037008]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rbx, rdx
test rcx, rcx
jne 0x1400125f5
call fcn.140011cdc
mov dword [rax], 0x16
call fcn.140015afc
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140009ce0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
cmp rcx, 0xffffffffffffffff
je 0x1400125c1
test rbx, rbx
je 0x1400125c1
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140012650
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140012629
cmp eax, 3
jbe 0x140012643
cmp eax, 8
je 0x140012636
cmp eax, 0x12
je 0x140012643
call fcn.140011cdc
mov dword [rax], 0x16
jmp 0x1400125d1
call fcn.140011cdc
mov dword [rax], 0xc
jmp 0x1400125d1
call fcn.140011cdc
mov dword [rax], 2
jmp 0x1400125d1
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, edi
mov dword [rbx], eax
call fcn.1400126c0
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.1400126c0
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.1400126c0
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14001b280
test eax, eax
je 0x1400125d4
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140015b1c
int3
jmp 0x140012598

Function at 0x140013268
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140013288
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140011c6c
or eax, 0xffffffff
jmp 0x14001328a
xor eax, eax
add rsp, 0x28
ret

Function at 0x14001460c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140014438
Function at 0x142225058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1422251df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142225089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14222506f
add dl, dl
jne 0x142225096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1422250f6
xor eax, eax
add dl, dl
jne 0x1422250a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1422251ad
add dl, dl
jne 0x1422250b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422250c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422250d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422250dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1422250ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14222507e
mov eax, 1
add dl, dl
jne 0x142225106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142225113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1422250fb
sub eax, ebx
mov ebx, 1
jne 0x14222514c
mov ecx, 1
add dl, dl
jne 0x14222512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14222513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142225123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14222507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142225168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142225175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14222515d
cmp eax, 0x7d00
jae 0x14222519b
cmp eax, 0x500
jb 0x142225196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14222507e
cmp eax, 0x7f
ja 0x14222519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14222507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1422251d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14222507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x100006598
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1000065e5
cmp rcx, 0xffffffffffffffff
je 0x1000065e5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000065dd
cmp dword [rcx + 0x3c], edx
jl 0x1000065dd
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000065dd
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1000065e5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14019ba30
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140202040]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rsi, [0x1401f0098]
mov rcx, rsi
call fcn.1401ae780
mov qword [0x140223cf8], rax
lea rbx, [rsp + 0x30]
xor eax, eax
mov edi, 0x28
mov word [rsp + 0x30], ax
mov dl, 0x50
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14019ba9d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14019ba90
cmp rcx, 1
jb 0x14019bb70
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14019bac0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1401d64d8
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14019ba80
lea rdx, [0x1401f00a0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.1401ae780
mov cl, 1
mov qword [0x140223d10], rax
call fcn.1401afb80
mov rdx, rax
lea rcx, str.PYTHONHOME
call fcn.1401ae8a0
mov cl, 1
call fcn.1401afb80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rax, qword [sym.imp.python310.dll__Py_path_config]
mov dword [rax + 0x30], 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401c7ef0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.1401cb620
int3
Function at 0x1401ae780
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.1401e3030
sub rsp, rax
mov rax, qword [0x140202040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov edi, 0x28
mov word [rsp + 0x30], ax
test dl, dl
je 0x1401ae842
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1401ae7ed
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1401ae7e0
cmp rcx, 1
jb 0x1401ae89a
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1401ae810
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1401d64d8
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1401ae7d0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1401ae873
lea rcx, [rsp + 0x80]
call fcn.1401d7c9c
jmp 0x1401ae875
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1401c7ef0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1401cb620
int3

Function at 0x1401ae8a0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140202040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
mov edi, 0x28
test dl, dl
je 0x1401ae945
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1401ae8fd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1401ae8f0
cmp rcx, 1
jb 0x1401ae976
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1401ae913
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1401d64d8
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1401ae8e0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401c7ef0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.1401cb620
int3
Function at 0x1401ae980
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140202040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x30], ax
mov edi, 0x28
test dl, dl
je 0x1401aea25
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1401ae9dd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1401ae9d0
cmp rcx, 1
jb 0x1401aea57
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1401ae9f3
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1401d64d8
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1401ae9c0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401c7ef0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1401cb620
int3