joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800398a0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push rbx
push rbp
push rdi
push r13
sub rsp, 0xa8
xor eax, eax
mov r13d, r8d
mov rdi, rcx
mov qword [rsp + 0x20], rax
movzx r9d, dx
mov qword [rsp + 0x28], rax
lea edx, [rax + 8]
lea r8, [0x18004bb88]
lea rcx, [rsp + 0xe8]
mov ebx, 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x24], eax
call qword [sym.imp.ntdll.dll__snprintf]
cmp byte [rdi], 0x5b
jne 0x18003997a
lea rax, [rdi + 1]
xor edx, edx
xor r10d, r10d
cmp byte [rax], dl
je 0x180039970
movzx ecx, byte [rax]
cmp cl, 0x5d
je 0x180039970
cmp rdx, 0x40
jge 0x180039970
mov byte [rsp + rdx + 0x50], cl
movsxd rcx, ebx
lea r8, [0x18004b860]
mov r9w, word [rcx + rdi]
cmp r9w, word [r8]
jne 0x18003994c
mov r9b, byte [rcx + rdi + 2]
cmp r9b, byte [r8 + 2]
jne 0x18003994c
xor ecx, ecx
jmp 0x180039951
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x18003995c
add ebx, 2
add rax, 2
add rax, 1
add r10d, 1
add rdx, 1
add ebx, 1
cmp byte [rax], 0
jne 0x180039916
movsxd rax, r10d
mov byte [rsp + rax + 0x50], 0
jmp 0x18003998e
lea rcx, [rsp + 0x50]
mov r8d, 0x40
mov rdx, rdi
call qword [sym.imp.ntdll.dll_strncpy]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0xa0], r12
mov byte [rsp + 0x90], 0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov ebp, eax
je 0x1800399cc
or eax, 0xffffffff
jmp 0x180039a70
mov rbx, qword [rsp + 0xd0]
or r12d, 0xffffffff
test rbx, rbx
mov edi, r12d
je 0x180039a56
mov qword [rsp + 0xd8], rsi
nop
nop
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
test eax, eax
mov rdi, rax
js 0x180039a3d
mov rcx, qword [rbx + 0x20]
cmp word [rcx], 0x17
jne 0x180039a1a
test r13d, r13d
je 0x180039a1a
mov dword [rcx + 0x18], r13d
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
movsxd rsi, eax
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov ebp, eax
jns 0x180039a46
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1800399f0
mov rbx, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
jns 0x180039a68
mov eax, r12d
jmp 0x180039a70
test ebp, ebp
cmovs edi, r12d
mov eax, edi
mov r12, qword [rsp + 0xa0]
add rsp, 0xa8
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x18003b544
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov ebp, dword [rcx + 0x39]
mov rdi, rcx
mov edx, dword [rdi + 0x85]
mov ebx, dword [rdi + 0x4d]
mov eax, dword [rdi + 0x39]
sub ebx, dword [rdi + 0x8d]
lea ecx, [rbp + rax - 0x106]
sub ebx, edx
cmp edx, ecx
jb 0x18003b5f9
mov rcx, qword [rdi + 0x45]
mov r8, rbp
lea rdx, [rcx + rbp]
call sub.ntdll.dll_memcpy
mov r9d, dword [rdi + 0x65]
mov rax, qword [rdi + 0x59]
sub dword [rdi + 0x89], ebp
sub dword [rdi + 0x85], ebp
sub dword [rdi + 0x75], ebp
lea r8, [rax + r9*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x18003b5ac
mov rax, qword [rdi + 0x51]
mov r9d, ebp
lea r8, [rax + rbp*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x18003b5d7
add ebx, ebp
mov rsi, qword [rdi]
cmp dword [rsi + 8], 0
je 0x18003b6d0
mov eax, dword [rdi + 0x85]
mov r13d, dword [rdi + 0x8d]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rdi + 0x45]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x18003b67b
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
mov ecx, dword [rax + 0x24]
cmp ecx, 1
jne 0x18003b64d
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x3c]
mov r8d, r12d
call fcn.180048168
jmp 0x18003b660
cmp ecx, 2
jne 0x18003b663
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x3c]
mov r8d, r12d
call fcn.180041650
mov dword [rsi + 0x3c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call sub.ntdll.dll_memcpy
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rdi + 0x8d], r12d
mov r9d, dword [rdi + 0x8d]
cmp r9d, 3
jb 0x18003b6ba
mov eax, dword [rdi + 0x85]
mov rdx, qword [rdi + 0x45]
mov ecx, dword [rdi + 0x71]
movzx r8d, byte [rax + rdx]
add eax, 1
mov dword [rdi + 0x61], r8d
movzx eax, byte [rax + rdx]
shl r8d, cl
xor r8d, eax
and r8d, dword [rdi + 0x6d]
mov dword [rdi + 0x61], r8d
cmp r9d, 0x106
jae 0x18003b6d0
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x18003b562
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x18003e160
Capabilities:
Get number of processors

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov r8, qword [rdx + 0x58]
mov eax, ecx
mov r9, qword [r8 + rax*8]
mov qword [rsp + 0x10], r9
test r9, r9
je 0x18003e263
xor r11d, r11d
mov dword [rsp + 8], r11d
cmp r11d, 0x50
jae 0x18003e263
mov ecx, r11d
cmp dword [r11 + r9], 0xc0000001
jne 0x18003e255
cmp byte [r11 + r9 + 4], 0xeb
jne 0x18003e255
cmp byte [r11 + r9 + 6], 0x48
jne 0x18003e1d0
mov eax, dword [r11 + r9 + 9]
add rax, rcx
mov r10, qword [rax + r9 + 0x35]
jmp 0x18003e1f2
movzx eax, byte [r11 + r9 + 6]
cmp al, 0x50
jb 0x18003e1e9
cmp al, 0x58
ja 0x18003e1e9
add r9, 1
mov qword [rsp + 0x10], r9
jmp 0x18003e1d0
mov rax, qword [r11 + r9 + 8]
mov r10, qword [rax + 0x28]
test r10, r10
je 0x18003e255
xor r8d, r8d
mov dword [rsp + 4], r8d
nop
cmp r8d, 0x30
jae 0x18003e255
mov ecx, r8d
cmp byte [r8 + r10], 0xe8
jne 0x18003e24a
cmp byte [r8 + r10 + 4], 0xff
jne 0x18003e24a
movsxd rax, dword [r8 + r10 + 1]
add rax, rcx
lea rdx, [rax + r10 + 5]
xor eax, eax
mov dword [rsp], eax
nop
nop
cmp eax, 0x20
jae 0x18003e24a
cmp byte [rax + rdx], 0xb8
jne 0x18003e242
movzx eax, word [rax + rdx + 1]
jmp 0x18003e267
add eax, 1
mov dword [rsp], eax
jmp 0x18003e230
add r8d, 1
mov dword [rsp + 4], r8d
jmp 0x18003e200
add r11d, 1
mov dword [rsp + 8], r11d
jmp 0x18003e191
jmp 0x18003e265
xor eax, eax
add rsp, 0x28
ret
Function at 0x18003fc10
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rcx, qword [0x180052eb0]
mov ebp, edx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 0x3c]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rdi
mov rbx, rax
je 0x18003fcd6
xor ecx, ecx
mov qword [rax + 8], rax
mov qword [rax], rax
mov dword [rax + 0x1c], edi
mov dword [rax + 0x20], ebp
call fcn.18001a9f8
mov qword [rbx + 0x24], rax
lea rax, [rbx + 0x18]
lea r8, [0x18003fa64]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x2c], rdi
mov qword [rbx + 0x34], rsi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, rdi
mov qword [rbx + 0x10], rax
je 0x18003fcba
mov rax, qword [rsi + 8]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov qword [rax], rbx
add dword [rsi + 0x28], 1
mov qword [rsi + 8], rbx
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x18003fcdb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x180052eb0]
mov r8, rbx
xor edx, edx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18003fcdb
mov edi, 8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x18004132d
Capabilities:
Execute syscall

Disassembly:
mov r10, rdx
mov rax, rcx
syscall
ret
Function at 0x140039980
Capabilities:
Check for debugger via api
Check for peb ntglobalflag flag

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140039a99
xor ebx, ebx
mov dword [rsp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x1400399c0
cmp dword [rsp + 0x48], ebx
jne 0x140039a7f
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8, [rsp + 0x48]
mov edx, 0x1e
call qword [0x1400a4300]
test eax, eax
jne 0x1400399f8
cmp qword [rsp + 0x48], rbx
jne 0x140039a8c
call fcn.140039ae0
test al, al
jne 0x140039a99
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0xd8]
cmp dword [rdx + rax + 0xc], ebx
jne 0x140039a99
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x30]
call fcn.1400398a0
test eax, eax
mov edx, 0x70
mov ebx, 0x14
cmovne ebx, edx
call fcn.1400398a0
test eax, eax
mov ecx, 0x18
mov edx, 0x74
cmovne ecx, edx
test dword [rbx + rdi], 0xfffffffd
jne 0x140039a99
cmp dword [rcx + rdi], 0
jne 0x140039a99
mov rax, qword gs:[0x60]
test byte [rax + 0xbc], 0x70
jne 0x140039a99
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, str.Sorry__you_cant_use_debuggers_with_this_program.
call fcn.140039ab0
int3
lea rcx, str.Sorry__you_cant_use_debuggers_with_this_program.
call fcn.140039ab0
int3
lea rcx, str.Sorry__you_cant_use_debuggers_with_this_program.
call fcn.140039ab0
int3
Function at 0x140039ae0
Capabilities:
Enumerate pe sections
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x14009e740]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x58], rsi
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov r14d, ebx
mov qword [rsp + 0x48], rbx
xor r15b, r15b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd r8, dword [rax + 0x3c]
add r8, rax
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
add r9, rax
mov edx, ebx
mov dword [rsp + 0x40], ebx
lea r10, [0x140080684]
movzx eax, word [r8 + 6]
cmp edx, eax
jge 0x140039b8e
movsxd rax, edx
lea rcx, [rax + rax*4]
lea rdi, [r9 + rcx*8]
mov rax, rbx
nop dword [rax + rax]
movzx ecx, byte [rdi + rax]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x140039b86
cmp rax, 7
jne 0x140039b70
jmp 0x140039b91
inc edx
mov dword [rsp + 0x40], edx
jmp 0x140039b54
mov rdi, rbx
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140039c5b
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r12d, 1
mov r8d, r12d
mov edx, 0x80000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x140039c5b
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140039c5b
mov ecx, dword [rdi + 0x10]
add ecx, dword [rdi + 0x14]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140039c5b
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0xd8]
sub edx, dword [rdi + 0xc]
add edx, dword [rdi + 0x14]
movzx r15d, r15b
cmp dword [rdx + rax + 0xc], 0
cmovne r15d, r12d
test r14, r14
je 0x140039c69
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test rbx, rbx
je 0x140039c77
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, 0xffffffffffffffff
je 0x140039c86
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r15b
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14005f900
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14005af10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14005fc60
sub rsp, rax
mov rax, qword [0x14009e740]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x14005afd2
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14006e7a4
cmp rax, 1
jne 0x14005b02e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14005afaf
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x14005afa3
cmp rcx, 1
jb 0x14005b02e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14005af70
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14005b003
lea rcx, [rsp + 0x80]
call fcn.1400712a4
jmp 0x14005b005
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14005f900
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140063150
int3
Function at 0x14005f430
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14009e740]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14005f4e1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14006e7a4
cmp rax, 1
jne 0x14005f517
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14005f4bd
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14005f4b0
cmp rcx, 1
jb 0x14005f517
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14005f480
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f900
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140063150
int3
Function at 0x14005f640
Capabilities:
Set environment variable

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0xb0
mov rax, qword [0x14009e740]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x1400a2820]
mov rbx, r8
mov rdi, rdx
mov r15, rcx
test rax, rax
jne 0x14005f690
lea rcx, [0x1400801a4]
call qword [sym.imp.python312.dll_PyImport_ImportModule]
mov qword [0x1400a2820], rax
test rax, rax
je 0x14005f86d
mov qword [rsp + 0xa8], rbp
lea rdx, str.environ
mov qword [rsp + 0xa0], rsi
mov rcx, rax
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r14
call qword [sym.imp.python312.dll_PyObject_GetAttrString]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.python312.dll_PyUnicode_FromString]
mov r14, rax
test rbx, rbx
je 0x14005f737
mov rdx, rbx
mov rcx, rdi
call fcn.14005f430
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.python312.dll_PyUnicode_FromWideChar]
mov rdx, r14
mov rcx, rbp
mov r8, rax
mov rbx, rax
call qword [sym.imp.python312.dll_PyObject_SetItem]
test eax, eax
je 0x14005f71c
mov ecx, 1
call qword [sym.imp.python312.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python312.dll_Py_Exit]
int3
cmp dword [rbx], 0
jl 0x14005f800
sub qword [rbx], 1
jne 0x14005f800
mov rcx, rbx
jmp 0x14005f7fa
movzx eax, byte [rdi]
lea rbx, [rsp + 0x30]
xor r12d, r12d
mov esi, 0x28
mov word [rsp + 0x30], r12w
test al, al
je 0x14005f7c5
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r12b
lea rcx, [rsp + 0x24]
call fcn.14006e7a4
cmp rax, 1
jne 0x14005f867
mov rcx, rsi
mov rax, rbx
cmp word [rbx], r12w
je 0x14005f79d
nop word [rax + rax]
add rax, 2
dec rcx
cmp word [rax], r12w
jne 0x14005f790
cmp rcx, 1
jb 0x14005f867
movzx ecx, word [rsp + 0x24]
inc rdi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r12w
dec rsi
movzx eax, byte [rdi]
test al, al
jne 0x14005f751
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.python312.dll_PyObject_DelItem]
test eax, eax
je 0x14005f800
mov rcx, qword [r15 + 0x60]
mov qword [r15 + 0x60], r12
test rcx, rcx
je 0x14005f800
cmp dword [rcx], r12d
jl 0x14005f800
sub qword [rcx], 1
jne 0x14005f800
call qword [sym.imp.python312.dll__Py_Dealloc]
cmp dword [r14], 0
jl 0x14005f815
sub qword [r14], 1
jne 0x14005f815
mov rcx, r14
call qword [sym.imp.python312.dll__Py_Dealloc]
cmp dword [rbp], 0
jl 0x14005f82b
sub qword [rbp], 1
jne 0x14005f82b
mov rcx, rbp
call qword [sym.imp.python312.dll__Py_Dealloc]
mov r12, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005f900
add rsp, 0xb0
pop r15
pop rdi
pop rbx
ret
call fcn.140063150
int3
call fcn.140063150
int3
Function at 0x1400603f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140060442
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140060442
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140060442
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140060442
cmp dword [rcx + 0x84], 0xe
jbe 0x140060442
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140060444
xor al, al
add rsp, 0x28
ret

Function at 0x140066130
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14006619f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006619f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006619f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006619f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006619f
cmp dword [rcx + 0x84], 0xe
jbe 0x14006619f
cmp dword [rcx + 0xf8], 0
je 0x14006619f
mov ecx, ebx
call fcn.140066250
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14006602c
nop
cmp dword [rbp + 0x20], 0
je 0x1400661ed
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400661f8
int3
xor r8d, r8d
xor edx, edx
jmp 0x140066130

Function at 0x140066334
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14006619f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006619f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006619f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006619f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006619f
cmp dword [rcx + 0x84], 0xe
jbe 0x14006619f
cmp dword [rcx + 0xf8], 0
je 0x14006619f
mov ecx, ebx
call fcn.140066250
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14006602c
nop
cmp dword [rbp + 0x20], 0
je 0x1400661ed
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400661f8
int3
xor r8d, r8d
xor edx, edx
jmp 0x140066130
Function at 0x140075fe0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140076067
mov rsi, rbx
cmp word [rax], bp
je 0x140076026
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140076010
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14007600c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14007233c
mov rdi, rax
test rax, rax
je 0x140076054
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14007bca0
mov rbp, rdi
xor ecx, ecx
call fcn.1400717f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140079418
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14007942e
mov al, 1
jmp 0x14007948e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14007943f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14007948c
mov ecx, dword [rcx + 0x18]
nop
call fcn.140076328
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14007948c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14007948c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14007948c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14007948e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14007baf0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14007bb18
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14007bb18
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140011271
Capabilities:
Terminate process

Disassembly:
jmp 0x140014570
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001130c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400158c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400158e0
xor al, al
jmp 0x140015961
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400158f3
xor al, al
jmp 0x140015961
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001591d
xor al, al
jmp 0x140015961
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015931
xor al, al
jmp 0x140015961
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015943
xor al, al
jmp 0x140015961
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001595f
xor al, al
jmp 0x140015961
mov al, 1
add rsp, 0x38
ret