joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e6a00
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400e6a2a
xor eax, eax
xor r9d, r9d
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1400e6a0a
movzx eax, r9b
neg eax
shr eax, 8
and eax, 1
ret
xor eax, eax
jmp 0x1400e6a21

Function at 0x1400e6c20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140186028]
xor rax, rsp
mov qword [rsp + 0x50], rax
vmovups ymm0, ymmword [rcx]
vmovups ymm1, ymmword [rcx + 0x10]
vmovups ymmword [rsp + 0x30], ymm1
vmovups ymmword [rsp + 0x20], ymm0
test rdx, rdx
je 0x1400e6c5f
xor eax, eax
mov cl, byte [rdx + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x30
jne 0x1400e6c4f
vxorps xmm0, xmm0, xmm0
vmovups ymmword [0x14019cfe8], ymm0
vmovups ymmword [0x14019cfd8], ymm0
lea rcx, [rsp + 0x20]
vzeroupper
call fcn.1400e6c9d
mov dword [0x14019d008], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14009c2d0
nop
add rsp, 0x58
ret

Function at 0x1400e6c9d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140186028]
xor rax, rsp
mov qword [rsp + 0x60], rax
vpbroadcastb ymm0, byte [0x14015c7b1]
vmovdqu ymmword [rsp + 0x40], ymm0
vmovdqu ymmword [rsp + 0x30], ymm0
xor r12d, r12d
lea rdi, [0x14019cfd8]
lea rbx, [rsp + 0x28]
lea r14, [0x14019cff8]
jmp 0x1400e6d3b
inc cl
mov byte [rax + rdi + 0x20], cl
mov rax, r12
shl rax, 4
lea r15, [rsp + rax]
add r15, 0x30
mov qword [rsp + 0x28], 0
mov rcx, rdi
mov rdx, rbx
vzeroupper
call fcn.1400e5797
mov edx, 0x10
mov rcx, r14
mov r8, rdi
mov r9, r15
call fcn.1400e57fc
mov rcx, qword [rsp + 0x28]
call fcn.1400e57ce
inc r12
cmp r12, 3
je 0x1400e6d57
mov eax, 0xf
mov eax, eax
mov cl, byte [rax + rdi + 0x20]
cmp cl, 0xff
jne 0x1400e6ce9
mov byte [rax + rdi + 0x20], 0
add eax, 0xffffffff
jb 0x1400e6d40
jmp 0x1400e6cef
test rsi, rsi
je 0x1400e6d6e
xor eax, eax
mov cl, byte [rsi + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x30
jne 0x1400e6d5e
vmovups ymm0, ymmword [rsp + 0x30]
vmovups ymmword [0x14019cfd8], ymm0
vmovaps xmm0, xmmword [rsp + 0x50]
vmovups xmmword [0x14019cff8], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
vzeroupper
call fcn.14009c2d0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400eeb86
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400eebac
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1400eeb90
xor eax, eax
test r9b, r9b
setne al
ret
xor eax, eax
ret

Function at 0x1400eebaf
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400eebd6
neg r9b
xor eax, eax
mov r10b, byte [rcx + rax]
mov r11b, byte [rdx + rax]
xor r11b, r10b
and r11b, r9b
xor r11b, r10b
mov byte [rcx + rax], r11b
inc rax
cmp r8, rax
jne 0x1400eebb9
ret
Function at 0x140106950
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140186028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1401069c1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1401069cb
mov dil, 1
test bl, bl
je 0x1401069aa
cmp byte [rsi + 8], 0
je 0x1401069c6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14009c2d0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
jmp 0x14010697d
mov rcx, qword [rsi]
jmp 0x14010699f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x1401069f3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1401069f8
xor edi, edi
jmp 0x1401069aa
mov rcx, qword [rsi]
jmp 0x1401069e0
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x140106a1f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x1401069aa
mov rcx, qword [rsi]
jmp 0x140106a0f
Function at 0x140106fd0
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x140186028]
xor rax, rsp
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [0x140157be0]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x219
call fcn.140043b60
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140049860
mov al, byte [rsi + 0x17]
test al, al
jns 0x14010704e
cmp qword [rsi + 8], 0x103
ja 0x14010706c
test al, al
jns 0x140107055
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.1400498c0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14009c2d0
mov eax, edi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140107390
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebp, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140186028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x140157be0]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.PathHasAccess
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x2cc
call fcn.140043b60
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.140049860
cmp byte [rdi + 0x17], 0
jns 0x140107412
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140107490
test al, 0x10
cmove esi, ebp
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, esi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rsi, [rsp + 0x40]
mov qword [rsi], rbx
mov rcx, rsi
mov rdx, rax
call fcn.14003f920
mov rax, qword [rsi]
inc rax
test rax, 0xfffffffffffffffe
setne bl
cmp rax, 2
jb 0x140107490
call fcn.140043b80
mov rcx, qword [rsp + 0x40]
call fcn.14003f990
lea rcx, [rsp + 0x60]
call fcn.1400498c0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14009c2d0
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14010b640
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010b670
cmp rbx, 2
jb 0x14010b758
lea r14, [rdi + 0x80]
mov r15d, 1
movdqa xmm6, xmmword [0x1401636e0]
movdqa xmm7, xmmword [0x1401636f0]
movdqa xmm8, xmmword [0x140163700]
movdqa xmm9, xmmword [0x140163710]
mov rcx, rsi
call fcn.14011c630
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm0
pand xmm1, xmm6
pshufd xmm2, xmm0, 0x39
pand xmm2, xmm7
por xmm2, xmm1
pshufd xmm1, xmm0, 0x4e
pand xmm0, xmm8
movdqa xmm3, xmm0
pslldq xmm3, 4
psrldq xmm0, 0xc
por xmm0, xmm3
pand xmm1, xmm9
por xmm1, xmm0
por xmm1, xmm2
movdqa xmmword [rsi + rax], xmm1
add rax, 0x10
cmp rax, 0x80
jne 0x14010b6ce
mov rcx, rsi
call fcn.14011cb10
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010b72c
inc r15
sub r14, 0xffffffffffffff80
cmp r15, rbx
jne 0x14010b6c4
mov rcx, rsi
call fcn.14011c630
xor eax, eax
movdqa xmm0, xmmword [0x1401636e0]
movdqa xmm1, xmmword [0x1401636f0]
movdqa xmm2, xmmword [0x140163700]
movdqa xmm3, xmmword [0x140163710]
movdqa xmm4, xmmword [rsi + rax]
movdqa xmm5, xmm4
pand xmm5, xmm0
pshufd xmm6, xmm4, 0x39
pand xmm6, xmm1
por xmm6, xmm5
pshufd xmm5, xmm4, 0x4e
pand xmm4, xmm2
movdqa xmm7, xmm4
pslldq xmm7, 4
psrldq xmm4, 0xc
por xmm4, xmm7
pand xmm5, xmm3
por xmm5, xmm4
por xmm5, xmm6
movdqa xmmword [rsi + rax], xmm5
add rax, 0x10
cmp rax, 0x80
jne 0x14010b782
shl rbx, 7
add rdi, rbx
xor eax, eax
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [rdi + rax]
movdqa xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x80
jne 0x14010b7dd
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1401186c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x140186028]
xor rax, rsp
mov qword [rsp + 0x80], rax
movsxd r8, dword [rcx + 0x108]
lea ecx, [rdx + 4]
mov r11d, ecx
shr r11d, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x14011871f
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x14011873b
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14d, ecx
shr r14d, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x140118765
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x140118786
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov r11d, edx
shr r11d, 6
xor r10d, r10d
cmp r11, r8
jae 0x1401187a8
mov ecx, edx
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x1401187ce
dec edx
mov r10d, edx
shr r10d, 6
xor ecx, ecx
cmp r10, r8
jae 0x1401187cc
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14d, 5
mov ecx, r14d
dec ecx
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov eax, r15d
shr eax, 1
and r15d, 1
add r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.14009e420
mov r8, r12
xor r8, r15
dec r8
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.140115090
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x14011880a
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x140157be0]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
mov eax, dword [rdi + 0x148]
test eax, eax
jle 0x1401188db
xor ecx, ecx
xor edx, edx
or rdx, qword [rsi + rcx*8]
inc rcx
cmp rax, rcx
jne 0x140118876
test rdx, rdx
sete dl
test rax, rax
je 0x14011892c
movsxd rcx, eax
mov rax, qword [rdi + 0x140]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x1401188b0
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x1401188b0
sbb r10, r10
movsxd rax, dword [rdi + 0x148]
mov ecx, eax
test rax, rax
jle 0x1401188fa
xor r8d, r8d
jmp 0x1401188ef
mov dl, 1
jmp 0x140118888
xor r9d, r9d
mov qword [rsp + r8*8 + 0x30], r9
inc r8
cmp rcx, r8
je 0x1401188fa
test dl, dl
jne 0x1401188df
mov r9, qword [rsp + r8*8 + 0x30]
jmp 0x1401188e2
test rcx, rcx
je 0x14011892c
and r14d, 1
neg r14
mov rcx, r14
not rcx
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, r14
mov r9, qword [rsi + rdx*8]
and r9, rcx
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x14011890e
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14009c2d0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140119870
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140186028]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x140157be0]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
test r9, r9
je 0x1401198d8
xor edi, edi
cmp r9, 0x30
ja 0x1401198fa
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r9, rax
jne 0x1401198c8
mov r8d, 0x30
mov rcx, rsi
call fcn.1400706b0
test eax, eax
je 0x140119910
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14009c2d0
mov eax, edi
add rsp, 0x58
pop rdi
pop rsi
ret
xor edi, edi
jmp 0x1401198fa

Function at 0x14011f890
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x14011f8a0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x14011f8c1
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14011f8e1
cmp byte [r14 + 0x50], 0
je 0x14011f9a5
or edi, 0x80000000
test dil, 8
je 0x14011f8f8
cmp byte [r14 + 0x68], 0
je 0x14011f9b0
or edi, 0x40000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x14011f90c
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x14011f91d
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
je 0x14011f930
lea rcx, [r14 + 0x20]
call fcn.140060af0
mov r15, rax
cmp byte [r14 + 0x18], 0
je 0x14011f9a0
mov rcx, r14
call fcn.140060af0
mov r9, rax
cmp ebx, 4
ja case.default.0x14011f95b
mov eax, ebx
lea rcx, [0x140165aac]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x14011f98b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r9d, r9d
jmp 0x14011f942
or edi, 0x20000000
jmp 0x14011f8e1
or edi, 0x10000000
jmp 0x14011f8f8
mov edx, 6
jmp 0x14011f962
mov edx, 1
jmp 0x14011f962
mov edx, 4
jmp 0x14011f962
xor edx, edx
jmp 0x14011f962
Function at 0x14014b30f
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14014b34e
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14014b31e
mov dword [rsi], 7
jmp 0x14014b31e
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14009391f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14014b32a
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14014b32a
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x14014b400
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x14014b320
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14014b31e
Function at 0x1400341c8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14004c350], eax
call fcn.140034c70
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x14004c350], 0
jne case.default.0x14003421e
mov ecx, 1
call fcn.140034c70
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
jb 0x140083cf7
xor byte [rbp + 0x5c], cl
in al, 0x1e
invalid
or dword [rdi + 0x77], edi
lahf
cld
pop rdi
cld
invalid
Function at 0x140058410
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.14005cc00
sub rsp, rax
mov rax, qword [0x14009bc78]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x1400584d2
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14005847d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140058470
cmp rcx, 1
jb 0x14005852a
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400584a0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14006bd14
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140058460
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140058503
lea rcx, [rsp + 0x80]
call fcn.14006eb54
jmp 0x140058505
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14005c930
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140060ae8
int3
Function at 0x14005c420
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14009bc78]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x14005c4c5
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14005c47d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14005c470
cmp rcx, 1
jb 0x14005c4f6
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14005c493
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14006bd14
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14005c460
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005c930
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.140060ae8
int3
Function at 0x14005c600
Capabilities:
Set environment variable

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0xb0
mov rax, qword [0x14009bc78]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x14009f8d8]
mov rbp, r8
mov rsi, rdx
mov r14, rcx
test rax, rax
jne 0x14005c650
lea rcx, [0x14007ce3c]
call qword [sym.imp.python310.dll_PyImport_ImportModule]
mov qword [0x14009f8d8], rax
test rax, rax
je 0x14005c88a
mov qword [rsp + 0xa8], rbx
lea rdx, str.environ
mov qword [rsp + 0xa0], rdi
mov rcx, rax
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x90], r15
call qword [sym.imp.python310.dll_PyObject_GetAttrString]
mov rcx, rsi
mov r15, rax
call qword [sym.imp.python310.dll_PyUnicode_FromString]
movzx edx, byte [rsi]
lea rbx, [rsp + 0x30]
xor ecx, ecx
mov r13, rax
mov word [rsp + 0x30], cx
lea edi, [rcx + 0x28]
test rbp, rbp
je 0x14005c786
test dl, dl
je 0x14005c722
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14005c6cd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14005c6c0
cmp rcx, 1
jb 0x14005c890
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14005c6f0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14006bd14
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14005c6b0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, rbp
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov rdx, r13
mov rcx, r15
mov r8, rax
mov rbx, rax
call qword [sym.imp.python310.dll_PyObject_SetItem]
test eax, eax
je 0x14005c76d
mov ecx, 1
call qword [sym.imp.python310.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python310.dll_Py_Exit]
int3
sub qword [rbx], 1
jne 0x14005c827
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x14005c827
test dl, dl
je 0x14005c802
nop word [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14005c7ad
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14005c7a0
cmp rcx, 1
jb 0x14005c884
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14005c7d0
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14006bd14
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14005c790
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.python310.dll_PyObject_DelItem]
test eax, eax
je 0x14005c827
mov rcx, r14
call fcn.14000fc20
sub qword [r13], 1
jne 0x14005c838
mov rax, qword [r13 + 8]
mov rcx, r13
call qword [rax + 0x30]
sub qword [r15], 1
jne 0x14005c848
mov rax, qword [r15 + 8]
mov rcx, r15
call qword [rax + 0x30]
mov r13, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005c930
add rsp, 0xb0
pop r14
pop rsi
pop rbp
ret
call fcn.140060ae8
int3
call fcn.140060ae8
int3
call fcn.140060ae8
int3
Function at 0x14005d378
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005d3c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005d3c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005d3c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005d3c2
cmp dword [rcx + 0x84], 0xe
jbe 0x14005d3c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005d3c4
xor al, al
add rsp, 0x28
ret

Function at 0x140062358
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400621c3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400621c3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400621c3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400621c3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400621c3
cmp dword [rcx + 0x84], 0xe
jbe 0x1400621c3
cmp dword [rcx + 0xf8], 0
je 0x1400621c3
mov ecx, ebx
call fcn.140062274
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140062050
nop
cmp dword [rbp + 0x20], 0
je 0x140062211
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14006221c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140062154