joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3440
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b357e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x005efbf0]
call sym.internal_godebug._Setting_.Value
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
lea rcx, [sym.net.goDebugNetDNS.func1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0063d930]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4b3542
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4b3578
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
nop dword [rax]
cmp rbx, rcx
jb 0x4b356d
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAlen
nop
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.net.goDebugNetDNS
Function at 0x140011221
Capabilities:
Terminate process

Disassembly:
jmp 0x140013350
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112b7
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400146a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400146c0
xor al, al
jmp 0x140014741
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400146d3
xor al, al
jmp 0x140014741
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400146fd
xor al, al
jmp 0x140014741
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014711
xor al, al
jmp 0x140014741
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014723
xor al, al
jmp 0x140014741
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001473f
xor al, al
jmp 0x140014741
mov al, 1
add rsp, 0x38
ret
Function at 0x1400112e9
Capabilities:
Hide graphical window

Disassembly:
jmp 0x140011bc0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x208
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x228]
mov rax, qword [0x14001e0c0]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x1400240bf]
call fcn.1400113c0
nop
mov dword [rbp + 0x10], 0x50
mov dword [rbp + 0x14], 3
lea rax, [0x140011226]
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], 0
mov dword [rbp + 0x24], 0
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x28], rax
mov edx, 0x7f00
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x30], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], 6
mov qword [rbp + 0x48], 0
lea rax, [0x14001e090]
mov qword [rbp + 0x50], rax
mov edx, 0x7f00
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x1c0]
mov qword [0x14001e280], rax
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x1c0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x1f4
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
lea r8, str.AnyDesks
lea rdx, [0x14001e090]
mov ecx, 0x80
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbp + 0x78], rax
xor edx, edx
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
call fcn.140011429
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x98]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140011d6a
lea rcx, [rbp + 0x98]
call qword [sym.imp.USER32.dll_TranslateMessage]
nop
lea rcx, [rbp + 0x98]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop
jmp 0x140011d33
mov eax, dword [rbp + 0xa8]
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001ac70]
call fcn.140011352
mov eax, edi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.1400111d6
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x140011429
Capabilities:
Get common file path
Write file on windows

Disassembly:
jmp 0x140011850
push rbp
push rdi
sub rsp, 0x478
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e0c0]
xor rax, rbp
mov qword [rbp + 0x428], rax
lea rcx, [0x1400240bf]
call fcn.1400113c0
nop
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400119a4
lea r8, str.hello.txt
mov edx, 0x104
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x238], rax
cmp qword [rbp + 0x238], 0xffffffffffffffff
jne 0x140011924
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Could_not_create_file_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
jmp 0x1400119a2
lea rax, str.Hello__Windows_desktop_
mov qword [rbp + 0x258], rax
xor eax, eax
mov word [rbp + 0x294], ax
jmp 0x14001194e
movzx eax, word [rbp + 0x294]
inc ax
mov word [rbp + 0x294], ax
movzx eax, word [rbp + 0x294]
cmp eax, 0x64
jge 0x140011994
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.ucrtbased.dll_wcslen]
shl rax, 1
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x274]
mov r8d, eax
mov rdx, qword [rbp + 0x258]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
jmp 0x14001193d
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1400119be
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Could_not_get_desktop_path_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ae20]
call fcn.140011352
mov rcx, qword [rbp + 0x428]
xor rcx, rbp
call fcn.1400111d6
lea rsp, [rbp + 0x438]
pop rdi
pop rbp
ret
Function at 0x140012580
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113e8
movzx eax, al
test eax, eax
jne 0x1400125a0
mov ecx, 7
call fcn.14001135c
nop
mov byte [rsp + 0x20], 0
call fcn.140011370
mov byte [rsp + 0x21], al
cmp dword [0x14001e948], 1
jne 0x1400125c4
mov ecx, 7
call fcn.14001135c
nop
jmp 0x14001261c
cmp dword [0x14001e948], 0
jne 0x140012617
mov dword [0x14001e948], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111c2
test eax, eax
je 0x1400125f8
mov eax, 0xff
jmp 0x140012721
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011366
mov dword [0x14001e948], 2
jmp 0x14001261c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011348
call fcn.1400112da
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012679
mov rcx, qword [rsp + 0x30]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x140012679
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.140011311
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400126ad
mov rcx, qword [rsp + 0x38]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x1400126ad
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113a7
nop
call fcn.1400127d0
mov dword [rsp + 0x28], eax
call fcn.1400112b7
movzx eax, al
test eax, eax
jne 0x1400126cc
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400126db
call fcn.1400113b1
nop
xor edx, edx
mov cl, 1
call fcn.14001115e
mov eax, dword [rsp + 0x28]
jmp 0x140012721
add rsp, 0x68
ret
Function at 0x1400edaa0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.1400f2310
sub rsp, rax
mov rax, qword [0x140134a80]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x1400edb62
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140100e64
cmp rax, 1
jne 0x1400edbbe
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1400edb3f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1400edb33
cmp rcx, 1
jb 0x1400edbbe
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400edb00
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400edb93
lea rcx, [rsp + 0x80]
call fcn.140103a0c
jmp 0x1400edb95
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400f2040
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400f57d0
int3
Function at 0x1400eea70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp byte [0x14013ce8e], 0
mov rbp, r8
mov rsi, rdx
mov r14, rcx
jne 0x1400eeb00
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x14013cc70], rax
mov ebx, dword [rax]
lea rcx, [rax + 4]
mov qword [0x14013cc70], rcx
lea rdi, [rcx + 4]
mov r8d, dword [rcx]
mov rdx, rdi
xor ecx, ecx
mov qword [0x14013cc70], rdi
call fcn.1400ec990
cmp eax, ebx
jne 0x1400eeca3
mov byte [0x14013ce8e], 1
jmp 0x1400eeb07
mov rdi, qword [0x14013cc70]
lea rdx, [0x140112958]
mov rcx, rbp
call fcn.140100910
test eax, eax
je 0x1400eebc1
cmp byte [0x14013ce8d], 1
je 0x1400eebc1
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x14013dbb0], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x14013dbb8], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x14013dbc0], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x14013dbc8], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x14013dbd0], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x14013dbd8], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x14013dbe0], rax
call qword [sym.imp.python310.dll_PyDict_New]
mov qword [0x14013dbe8], rax
mov rax, qword [sym.imp.python310.dll__PyRuntime]
mov rax, qword [rax + 0x1f0]
mov rdi, qword [0x14013cc70]
mov byte [0x14013ce8d], 1
mov rcx, qword [rax + 0x10]
add rcx, 0xda0
mov qword [0x14013efa0], rcx
mov rdx, rdi
mov rax, rbp
sub rdx, rbp
nop word [rax + rax]
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x1400eebe7
inc rax
test cl, cl
jne 0x1400eebd0
mov ecx, r9d
jmp 0x1400eebec
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [rdi + rax + 1], r9b
lea rax, [rax + 1]
jne 0x1400eebf3
lea rdx, [rdi + rax]
mov eax, dword [rdi + rax + 1]
add rdx, 5
test ecx, ecx
je 0x1400eec58
nop
add rdx, rax
mov rax, rbp
mov r8, rdx
sub r8, rbp
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x1400eec35
inc rax
test cl, cl
jne 0x1400eec20
mov ecx, r9d
jmp 0x1400eec3a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x1400eec41
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x1400eec10
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x1400eec88
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rsi
mov rcx, r14
call fcn.1400eb1d0
add rsi, 8
sub rbx, 1
jne 0x1400eec70
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.1400fd624
call fcn.1400f57d0
int3
Function at 0x1400f1bf0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140134a80]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x1400f1ca1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140100e64
cmp rax, 1
jne 0x1400f1cd7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x1400f1c7d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x1400f1c70
cmp rcx, 1
jb 0x1400f1cd7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400f1c40
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400f2040
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1400f57d0
int3
Function at 0x1400f1da0
Capabilities:
Set environment variable

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0xb0
mov rax, qword [0x140134a80]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x14013d2d0]
mov rbx, r8
mov rdi, rdx
mov r15, rcx
test rax, rax
jne 0x1400f1df0
lea rcx, [0x1401125bc]
call qword [sym.imp.python310.dll_PyImport_ImportModule]
mov qword [0x14013d2d0], rax
test rax, rax
je 0x1400f1fad
mov qword [rsp + 0xa8], rbp
lea rdx, str.environ
mov qword [rsp + 0xa0], rsi
mov rcx, rax
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r14
call qword [sym.imp.python310.dll_PyObject_GetAttrString]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.python310.dll_PyUnicode_FromString]
mov r14, rax
test rbx, rbx
je 0x1400f1e95
mov rdx, rbx
mov rcx, rdi
call fcn.1400f1bf0
mov rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov rdx, r14
mov rcx, rbp
mov r8, rax
mov rbx, rax
call qword [sym.imp.python310.dll_PyObject_SetItem]
test eax, eax
je 0x1400f1e7c
mov ecx, 1
call qword [sym.imp.python310.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python310.dll_Py_Exit]
int3
sub qword [rbx], 1
jne 0x1400f1f4a
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x1400f1f4a
movzx eax, byte [rdi]
lea rbx, [rsp + 0x30]
xor r12d, r12d
mov esi, 0x28
mov word [rsp + 0x30], r12w
test al, al
je 0x1400f1f25
nop
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r12b
lea rcx, [rsp + 0x24]
call fcn.140100e64
cmp rax, 1
jne 0x1400f1fa7
mov rcx, rsi
mov rax, rbx
cmp word [rbx], r12w
je 0x1400f1efd
nop dword [rax]
nop dword [rax + rax]
add rax, 2
dec rcx
cmp word [rax], r12w
jne 0x1400f1ef0
cmp rcx, 1
jb 0x1400f1fa7
movzx ecx, word [rsp + 0x24]
inc rdi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r12w
dec rsi
movzx eax, byte [rdi]
test al, al
jne 0x1400f1eb0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.python310.dll_PyObject_DelItem]
test eax, eax
je 0x1400f1f4a
mov rcx, r15
call fcn.1400016a0
sub qword [r14], 1
jne 0x1400f1f5a
mov rax, qword [r14 + 8]
mov rcx, r14
call qword [rax + 0x30]
sub qword [rbp], 1
jne 0x1400f1f6b
mov rax, qword [rbp + 8]
mov rcx, rbp
call qword [rax + 0x30]
mov r12, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400f2040
add rsp, 0xb0
pop r15
pop rdi
pop rbx
ret
call fcn.1400f57d0
int3
call fcn.1400f57d0
int3

Function at 0x1400f2a74
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f2abe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f2abe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f2abe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f2abe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f2abe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400f2ac0
xor al, al
add rsp, 0x28
ret
Function at 0x1400f6a2c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400f6a9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f6a9b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f6a9b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f6a9b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f6a9b
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f6a9b
cmp dword [rcx + 0xf8], 0
je 0x1400f6a9b
mov ecx, ebx
call fcn.1400f6b4c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400f6928
nop
cmp dword [rbp + 0x20], 0
je 0x1400f6ae9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400f6af4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400f6a2c

Function at 0x1400f6c30
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400f6a9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f6a9b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f6a9b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f6a9b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f6a9b
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f6a9b
cmp dword [rcx + 0xf8], 0
je 0x1400f6a9b
mov ecx, ebx
call fcn.1400f6b4c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400f6928
nop
cmp dword [rbp + 0x20], 0
je 0x1400f6ae9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400f6af4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400f6a2c
Function at 0x140108830
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1401088b7
mov rsi, rbx
cmp word [rax], bp
je 0x140108876
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140108860
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14010885c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140103ee4
mov rdi, rax
test rax, rax
je 0x1401088a4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14010ebb0
mov rbp, rdi
xor ecx, ecx
call fcn.1401048f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14010afbc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14010afd2
mov al, 1
jmp 0x14010b032
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14010afe3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14010b030
mov ecx, dword [rcx + 0x18]
nop
call fcn.140108fd4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14010b030
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14010b030
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14010b030
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14010b032
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14010e990
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14010e9b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14010e9b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rcx
push rsi
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov ecx, dword [rax + 0x18]
push rax
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021