joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140496216
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp sil, 0x4e
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
shld bx, bx, 0xac
jmp 0x14049622f
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
rcr bp, 0x7f
and bh, 0x73
sub rsp, 0x20
movzx rsi, r11w
mov rsi, r9
bsr bp, r15w
shrd bx, dx, 0xc4
mov r14, r8
sbb ebx, eax
mov rbx, rdx
stc
mov rbp, rcx
cmp rdx, r8
jmp 0x140496269
je 0x140496337
mov rdi, qword [r9 + 8]
test cx, r13w
cmp rbp, 0xeb1d96
test rdi, rdi
je 0x14049631e
mov rax, qword [rdi + 0x40]
movzx r8d, word [rbx]
clc
stc
cmp r15b, sil
cmp qword [rax], 0
jmp 0x14049629d
je 0x1404962de
mov rax, qword [rdi + 0x58]
cmp dword [rax], 0
jle 0x1404962de
dec dword [rax]
jmp 0x1404962b7
mov rcx, qword [rdi + 0x40]
cbw
lahf
mov rdx, qword [rcx]
mov rax, rsp
lea rax, [rdx + 2]
jmp 0x1404962cd
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x1404962d9
jmp 0x140496305
mov rax, qword [rdi]
cmovo cx, ax
movzx edx, r8w
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x1404cf978.0]
movzx r8d, ax
xor rax, r10
movsx rax, r11w
test sil, 0xbf
mov eax, 0xffff
test ax, 0x4576
clc
jmp 0x140496314
cmp ax, r8w
jne 0x140496324
mov byte [rsi], 1
test r8b, r15b
add rbx, 2
clc
cmp rbx, r14
jmp 0x140496331
jne 0x14049627e
movups xmm0, xmmword [rsi]
dec ax
mov rbx, qword [rsp + 0x30]
sal rsi, cl
mov rax, rbp
btc r14w, 0xc
mov rsi, qword [rsp + 0x40]
ror r14b, 0x81
test al, r14b
mov rdi, qword [rsp + 0x48]
movsx r14d, r13w
clc
movdqu xmmword [rbp], xmm0
xchg bpl, r14b
sal r14b, 0x27
sbb bp, 0xb51
mov rbp, qword [rsp + 0x38]
xadd r14, r14
mov r14w, 0x6e05
add rsp, 0x20
pop r14
ret
Function at 0x1404a46aa
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x1404a46b8
call fcn.1404ae91a
mov r9d, 2
lea r8, [rsp + 0x30]
jmp 0x1404a46cd
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x1404a46da
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp dl, r13b
test esp, r10d
sub ecx, 0x30
jmp 0x1404a46f3
je 0x1404a473f
sub ecx, 1
jmp 0x1404a4701
je 0x1404a4730
cmp ecx, 1
jmp 0x1404a470f
je 0x1404a4721
xor eax, eax
jmp 0x1404a471c
jmp 0x1404a474d
mov eax, 3
jmp 0x1404a472b
jmp 0x1404a474d
mov eax, 1
jmp 0x1404a473a
jmp 0x1404a474d
mov eax, 2
cmp di, 0x481b
test r13b, 0xfc
add rsp, 0x28
jmp 0x1404a4756
ret

Function at 0x1404a54f7
Capabilities:
Terminate process

Disassembly:
push rbx
sar bl, 0x70
jmp 0x1404a5502
sub rsp, 0x20
movsx rbx, r13w
mov rbx, rcx
jmp 0x1404a5516
sub ecx, ecx
jmp 0x1404a551d
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a552b
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
add dl, 0xec
mov edx, 0xc0000409
sub bx, 0x3582
xor bl, 0xc8
add rsp, 0x20
sete bl
movsx rbx, dx
xchg bl, bh
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b145a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
movsx rax, r9w
sal rax, 8
mov qword [rsp + 0x18], rsi
push rdi
adc bl, 0xdd
sub rsp, 0x50
shld bx, bx, 0x4d
dec al
btr ax, r14w
mov rax, qword [0x1400b7288]
shr bh, 0xb4
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp byte [rcx + 0x54], 0
cmovae bx, ax
movzx ebx, r13w
mov bx, bp
mov rbx, rcx
jmp 0x1404b14a9
je 0x1404b1597
cmp dword [rcx + 0x50], 0
jmp 0x1404b14b8
jle 0x1404b1597
mov rsi, qword [rcx + 0x48]
xor edi, edi
mov rax, qword [rbx + 8]
xadd dx, r8w
lea rdx, [rsp + 0x34]
movsx rcx, r11w
movzx r9d, word [rsi]
sar r8b, cl
bt rcx, 0xaa
lea rcx, [rsp + 0x30]
cmovl r8, rcx
shl r8w, cl
and dword [rsp + 0x30], 0
lea rsi, [rsi + 2]
movsx r8w, bl
movzx r8d, r9w
bswap r8
mov r8d, 6
jmp 0x1404b150f
mov qword [rsp + 0x20], rax
jmp 0x1404b1519
call fcn.1404d4e5f
test eax, eax
jne 0x1404b1589
mov r8d, dword [rsp + 0x30]
test r8d, r8d
jmp 0x1404b1533
je 0x1404b1589
lea rax, [rbx + 0x10]
movsx rdx, si
movsxd rdx, eax
mov r9, rsi
lea r9, [rbx + 0x28]
xchg edx, ecx
jmp 0x1404b1552
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
movzx rdx, dx
not dx
jmp 0x1404b156a
lea rdx, [rsp + 0x34]
call fcn.1404af851
inc edi
cmp edi, dword [rbx + 0x50]
jmp 0x1404b157e
jne 0x1404b14c4
jmp 0x1404b15d2
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b1592
jmp 0x1404b15d2
mov r8d, dword [rbx + 0x50]
lea rax, [rcx + 0x10]
or rdx, 0x7bc24c83
not dl
mov rdx, qword [rbx + 0x48]
cmovl r9, rsp
dec r9w
sal r9d, 0x23
lea r9, [rcx + 0x28]
add rcx, 0x468
jmp 0x1404b15c8
mov qword [rsp + 0x20], rax
call fcn.1404af851
mov al, 1
or ch, bh
btc cx, 0x1c
rol cx, 0xd8
mov rcx, qword [rsp + 0x40]
cmc
xor rcx, rsp
jmp 0x1404b15ed
call fcn.1404a3d69
mov rbx, qword [rsp + 0x68]
sal sil, 0xba
inc di
not sil
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
jmp 0x1404b1614
pop rdi
jmp 0x1404b161a
ret
Function at 0x1404b421b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
rcl r11b, 0x31
bts rbx, rax
mov rax, qword [rcx + 0x460]
mov r10, rcx
add rcx, 0x58
test ch, 0x8f
jmp 0x1404b423e
mov ebx, r8d
cmp r8, r10
mov r11, rdx
test rax, rax
jmp 0x1404b424f
jne 0x1404b425f
mov eax, 0x200
jmp 0x1404b4270
mov rcx, rax
mov rax, qword [r10 + 0x458]
shr rax, 1
add r8w, r15w
lea r8, [rcx - 1]
add r8, rax
neg al
movzx rax, si
cwde
mov qword [r10 + 0x48], r8
test r15b, r10b
mov eax, dword [r10 + 0x38]
cmp dh, 0xa4
test eax, eax
jg 0x1404b42a2
test r11, r11
jmp 0x1404b429c
je 0x1404b4322
dec eax
sub edx, edx
mov dword [r10 + 0x38], eax
mov rax, r11
div rbx
rcr r11d, 0x40
stc
movzx r11, di
add dl, 0x30
shl r11b, 0xe4
mov r11b, r8b
and r11w, si
mov r11, rax
test sil, dil
cmp dl, 0x39
jmp 0x1404b42d5
jle 0x1404b4309
mov al, r9b
xor al, 1
test r13w, 0x6b11
test si, si
shl al, 5
test r14b, 0x23
stc
jmp 0x1404b42f6
add al, 7
cmp ebp, 0xdc3add
stc
add dl, al
cwde
movsx eax, bx
movzx rax, dx
mov rax, qword [r10 + 0x48]
jmp 0x1404b4312
mov byte [rax], dl
jmp 0x1404b4319
dec qword [r10 + 0x48]
jmp 0x1404b4285
sub r8d, dword [r10 + 0x48]
movsx rbx, dx
xchg bx, bx
movzx bx, r14b
mov rbx, qword [rsp + 8]
jmp 0x1404b433c
mov dword [r10 + 0x50], r8d
jmp 0x1404b4345
inc qword [r10 + 0x48]
jmp 0x1404b434e
ret

Function at 0x1404b4d44
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
sub sil, r15b
not sil
push rdi
xor si, 0x456b
movzx di, dil
add edi, ebp
sub rsp, 0x30
mov esi, 0xd5d204b
mov edi, edx
inc si
bt si, bp
mov rsi, rcx
test sil, dil
test rcx, 0x45d71b5f
test r8, r8
jne 0x1404b4daa
call fcn.1404b95c8
mov dword [rax], 0x16
jmp 0x1404b4d99
call fcn.1404ba291
sub eax, eax
jmp 0x1404b4da5
jmp 0x1404b4e9a
mov rdx, r9
bswap rcx
movsxd rcx, r13d
mov rcx, r8
call fcn.1404b4efc
mov rbx, rax
test r14b, sil
cmp r15, rsi
jmp 0x1404b4dc9
test rax, rax
jmp 0x1404b4dd1
je 0x1404b4e40
lea rax, [rsp + 0x50]
mov rdx, rdi
movsx r8w, dl
mov qword [rsp + 0x28], rax
movzx r9, r13w
cbw
movsx rax, bp
lea r8, [0x140094b24]
cbw
xchg ah, ch
movsxd rax, ebx
mov eax, dword [rsp + 0x60]
mov r9, rbx
setns cl
movzx rcx, ax
not cx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp rbp, r13
test rax, rax
jmp 0x1404b4e2d
jne 0x1404b4eb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404b964d
sub edi, edi
test rbx, rbx
jmp 0x1404b4e4a
je 0x1404b4e97
mov rcx, qword [rbx + 0x10]
test r9b, spl
test rcx, rcx
jmp 0x1404b4e5f
je 0x1404b4e6b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmp r9w, r12w
test r15b, r12b
test rcx, rcx
jmp 0x1404b4e7e
je 0x1404b4e8a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b4e92
call fcn.1404cd66f
mov rax, rdi
mov rbx, qword [rsp + 0x40]
sar si, 0x72
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x1404b4eb2
ret
mov rcx, qword [rsp + 0x68]
stc
test rcx, rcx
jmp 0x1404b4ec1
je 0x1404b4edc
mov eax, dword [rsp + 0x50]
stc
clc
cmp bx, r9w
mov dword [rcx], eax
jmp 0x1404b4edc
sub ebx, ebx
jmp 0x1404b4ee3
jmp 0x1404b4e42
Function at 0x1404b51ae
Capabilities:
Terminate process

Disassembly:
push rbx
rcl bl, 0xf0
shr bh, 0x66
sub rsp, 0x20
bswap bx
mov ebx, ecx
jmp 0x1404b51c4
call fcn.1404d6d80
cmp eax, 1
jmp 0x1404b51d1
je 0x1404b5214
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
cmp al, bpl
clc
shr edx, 8
test dl, 1
jmp 0x1404b51f5
jne 0x1404b5214
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dl, r9b
mov edx, ebx
jmp 0x1404b520e
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b521b
call fcn.1404b510d
mov ecx, ebx
jmp 0x1404b5227
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404ba334
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xchg ch, ch
mov cl, bl
mov ecx, 0x17
jmp 0x1404ba346
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404ba353
je 0x1404ba36a
mov ecx, 5
jmp 0x1404ba363
int 0x29
jmp 0x1404ba36a
mov r8d, 1
xchg dl, dh
movsxd rdx, esi
cwd
mov edx, 0xc0000417
lea ecx, [r8 + 1]
jmp 0x1404ba385
call fcn.1404ba3ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xadd dx, dx
mov edx, 0xc0000417
add rsp, 0x28
jmp 0x1404ba3a5
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404bbb4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
shl cx, 0x3b
rol cx, 0xf9
mov qword [rsp + 0x20], r9
rol ch, 0x2b
ror cl, cl
push rsi
and cx, 0x619b
and rcx, rcx
push rdi
xor cl, dil
push r14
adc cl, 0x20
sal ch, cl
sub rsp, 0x60
movsx si, r9b
mov rsi, r9
cmovno di, r13w
not cl
mov rdi, r8
mov ecx, dword [rdx]
jmp 0x1404bbb94
call fcn.1401816d0
nop
jmp 0x1404bbb9f
mov rbx, qword [0x1400ba160]
movsxd rax, dword [0x1400ba158]
btc r14, 0x37
test r9w, 0x4b8b
lea r14, [rbx + rax*8]
mov qword [rsp + 0x38], rbx
stc
test r14b, 0xda
cmp rbx, r14
jmp 0x1404bbbce
je 0x1404bbcfa
mov rax, qword [rbx]
sar edx, cl
jmp 0x1404bbbde
mov qword [rsp + 0x20], rax
bsr dx, ax
and dl, sil
mov rdx, qword [rdi]
test rax, rax
je 0x1404bbc57
mov ecx, dword [rax + 0x14]
btc ax, 0x6b
shr ah, 0x46
mov eax, ecx
cmp r10b, 0xf2
cmc
shr eax, 0xd
cmp rax, 0x737d1602
test al, 1
jmp 0x1404bbc19
je 0x1404bbc57
mov eax, ecx
cmp rsi, 0x6485554b
and al, 3
stc
cmp al, 2
jmp 0x1404bbc32
jne 0x1404bbc46
test cl, 0xc0
jmp 0x1404bbc40
jne 0x1404bbc65
bt ecx, 0xb
jmp 0x1404bbc4f
jb 0x1404bbc65
inc dword [rdx]
add rbx, 8
jmp 0x1404bbc60
jmp 0x1404bbbbc
mov rdx, qword [rdi + 0x10]
mov r9b, 0x16
mov rcx, qword [rdi + 8]
mov r8b, r12b
cbw
movzx r8, dx
mov rax, qword [rdi]
movsx r8d, r8w
lea r8, [rsp + 0x20]
movzx r9d, bp
mov r9b, 0xac
mov qword [rsp + 0x40], r8
movzx r9w, al
cmovp r9d, ecx
mov qword [rsp + 0x48], rax
seto r8b
mov qword [rsp + 0x50], rcx
mov r9b, 0x42
mov qword [rsp + 0x58], rdx
not cx
movsx ecx, r8w
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
not dl
movzx edx, ax
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x28]
mov dl, r14b
lea r8, [rsp + 0x40]
setno dh
lea rdx, [rsp + 0x30]
movzx ecx, di
lea rcx, [rsp + 0x88]
jmp 0x1404bbcf0
call fcn.1404bb9d8
jmp 0x1404bbc57
mov ecx, dword [rsi]
call fcn.140170814
mov rbx, qword [rsp + 0x80]
sar r14d, 0xd6
add dil, 0x57
jmp 0x1404bbd16
add rsp, 0x60
pop r14
pop rdi
movsxd rsi, r15d
not si
pop rsi
jmp 0x1404bbd29
ret
Function at 0x1404ced04
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
shr r8b, cl
sal r8, cl
or r9b, r13b
sub rsp, 0x20
mov r8, r15
xchg r8b, r9b
not r8b
mov rbx, rdx
movzx edi, di
movsx r8, dx
sete r8b
lea r9, [0x1400c63d8]
mov edi, ecx
bswap ecx
movsx rdx, bp
movzx r8, r10w
lea rdx, [0x1400cf748]
mov ecx, 6
movsx r8, r12w
jmp 0x1404ced56
lea r8, [0x1400c63d0]
call fcn.1404cfc12
mov rdx, rbx
xor ch, 0x3b
movzx cx, bpl
sar cl, 0xc7
mov ecx, edi
jmp 0x1404ced7b
test rax, rax
jmp 0x1404ced83
je 0x1404ced94
call qword [case.0x1404cf978.0]
jmp 0x1404ced9a
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
or di, bx
rcl dil, 0x14
add rsp, 0x20
bswap di
jmp 0x1404cedb2
pop rdi
jmp 0x1404cedb8
ret

Function at 0x1404cef1b
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
sbb bh, 0x16
mov qword [rsp + 0x18], rsi
shl si, cl
push rdi
sub rsp, 0x30
movzx rdi, bx
cmovbe edi, r11d
mov ebx, r9d
movsx di, bpl
cmovle si, r15w
mov rdi, r8
movsx rsi, r14w
movzx r8w, r14b
mov esi, edx
bswap r8
lea r9, [0x1400c63e8]
movsx r8w, bpl
mov rbp, rcx
cwd
movzx r8w, r13b
lea r8, [0x1400c63e0]
cmovbe rdx, rsi
setb ch
movsxd rcx, ebx
lea rdx, [0x1400cf190]
movsx ecx, bp
mov ecx, 0xb
jmp 0x1404cef96
call fcn.1404cfc12
mov rcx, rbp
test rax, rax
jmp 0x1404cefa6
je 0x1404cefc9
mov r9d, ebx
cdq
xchg r8w, dx
mov r8, rdi
mov edx, esi
jmp 0x1404cefbe
call qword [case.0x1404cf978.0]
jmp 0x1404ceff5
xor edx, edx
jmp 0x1404cefd0
call fcn.1404cf6a5
mov ecx, eax
movsxd r9, r11d
mov r9d, ebx
cdq
not r8w
mov r8, rdi
cwd
bswap edx
movsx edx, r10w
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
shr bp, 4
mov rbp, qword [rsp + 0x48]
cmp r11w, r10w
shld di, bx, 0x8d
bts rsi, rsp
mov rsi, qword [rsp + 0x50]
xchg rdi, rdi
sete dil
bsf di, r9w
add rsp, 0x30
pop rdi
jmp 0x1404cf02b
ret
Function at 0x1404dba1c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
ror rbx, 0xf
bt ebx, 0x94
ror bh, cl
mov qword [rsp + 0x18], rsi
shr bx, 0x52
sar rbx, cl
push rdi
sub rsp, 0x20
sub esi, esi
and dil, bl
xadd rdi, rdi
mov rdi, rdx
sbb bl, r12b
xor bl, r14b
mov rbx, rcx
test rcx, rcx
jmp 0x1404dba59
je 0x1404dbb03
cmp word [rcx], si
jmp 0x1404dba67
je 0x1404dbb03
lea rdx, [0x1400d1d08]
call fcn.140260e3b
test eax, eax
jmp 0x1404dba80
je 0x1404dbb03
lea rdx, [0x1400d1d00]
cmovno rcx, rbx
movsx cx, bh
mov rcx, rbx
jmp 0x1404dba9d
call fcn.140260e3b
test eax, eax
jne 0x1404dbaf1
mov ecx, dword [rdi + 8]
jmp 0x1404dbab8
lea r9d, [rsi + 2]
movsx r8, r8w
lea r8, [rsp + 0x30]
movzx rdx, r11w
bswap dx
movsx edx, r12w
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404dbb34
mov eax, dword [rsp + 0x30]
jmp 0x1404dbaec
jmp 0x1404dbb5c
mov rcx, rbx
jmp 0x1404dbaf9
call fcn.1404e4ad0
jmp 0x1404dbb5c
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
movzx dx, sil
xchg dx, dx
movsxd rdx, r8d
mov edx, 0x20001004
jmp 0x1404dbb26
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404dbb40
xor eax, eax
jmp 0x1404dbb3b
jmp 0x1404dbb5c
mov eax, dword [rsp + 0x30]
test di, 0xf2a
test eax, eax
jmp 0x1404dbb50
jne 0x1404dbb5c
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
and dil, 0x5e
bswap di
add rsp, 0x20
mov dil, sil
movzx di, al
movzx edi, sp
pop rdi
jmp 0x1404dbb81
ret

Function at 0x1404dbb82
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
xor bl, r15b
add bl, 0x21
sub bx, dx
mov qword [rsp + 0x18], rsi
inc esi
push rdi
sub rsp, 0x20
mov si, 0x56c5
mov esi, edx
not bx
jmp 0x1404dbbaa
mov ebx, ecx
jmp 0x1404dbbb1
call fcn.1404cd9f1
mov ecx, ebx
bts r9d, edi
lea r8, [rsp + 0x30]
and r9w, 0x3799
add dx, 0xe14
bt r9d, ebx
and ecx, 0x3ff
cdq
movsx rdx, r13w
mov r9d, 2
btr dx, 0x15
cmovg dx, ax
bts ecx, 0xa
not dx
movsx edx, sp
bswap rdi
mov edx, 0x20000001
movsxd rdi, esi
mov rdi, rax
jmp 0x1404dbc07
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
cmp r14b, 0xf6
cmc
test eax, eax
jmp 0x1404dbc1c
je 0x1404dbcda
cmp ebx, dword [rsp + 0x30]
jmp 0x1404dbc2b
je 0x1404dbccb
test esi, esi
je 0x1404dbccb
mov r9, qword [rdi + 0x98]
sub r8b, r10b
cmp r14, 0x3d9a3452
xor edx, 0x4373164e
mov r8d, r10d
movzx edx, word [r9]
btc ax, cx
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jmp 0x1404dbc6b
jbe 0x1404dbc89
sub dx, 0x61
jmp 0x1404dbc7a
cmp dx, 0x19
jmp 0x1404dbc83
ja 0x1404dbca8
movzx edx, word [rcx]
jmp 0x1404dbc91
inc r8d
cmp r9w, 0x5fc8
add rcx, 2
jmp 0x1404dbca3
jmp 0x1404dbc5f
or rcx, 0xffffffffffffffff
jmp 0x1404dbcb1
inc rcx
cmp bpl, dil
cmp word [r9 + rcx*2], r10w
jne 0x1404dbcb1
cmp r8d, ecx
je 0x1404dbcda
mov eax, 1
jmp 0x1404dbcd5
jmp 0x1404dbce1
xor eax, eax
or di, 0x74e1
mov rbx, qword [rsp + 0x38]
xor sil, 0x81
add si, dx
mov rsi, qword [rsp + 0x40]
rol di, cl
add rsp, 0x20
mov dil, r12b
mov edi, 0x3b9f7eb2
movzx edi, r8w
pop rdi
jmp 0x1404dbd0b
ret
Function at 0x1404dd390
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmc
mov qword [rax + 8], rbx
cmp edx, 0x2a7e5610
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
test esp, 0x6a854108
push r14
test ebx, eax
sub rsp, 0x40
jmp 0x1404dd3bd
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
movzx bx, r15b
and bl, 0x1f
clc
mov rbx, rax
test r13w, si
test rax, rax
jmp 0x1404dd3de
je 0x1404dd55b
mov rsi, rax
stc
cmc
cmp word [rax], r14w
jmp 0x1404dd3f2
je 0x1404dd43a
or rax, 0xffffffffffffffff
jmp 0x1404dd401
inc rax
test cl, 0xb9
test dl, r9b
cmp word [rsi + rax*2], r14w
jmp 0x1404dd414
jne 0x1404dd401
lea rsi, [rsi + rax*2]
cmp r12b, al
add rsi, 2
clc
cmp di, 0x9ca
cmp word [rsi], r14w
jmp 0x1404dd434
jne 0x1404dd3f8
mov qword [rsp + 0x38], r14
movsx r8d, r13w
dec r8w
sal r9w, 0x6a
sub rsi, rbx
mov qword [rsp + 0x30], r14
test r10b, r8b
add rsi, 2
adc r8, rcx
bts r9, rax
sar rsi, 1
mov r8, rbx
bts r9d, esp
and r9w, r9w
rol r9b, cl
mov r9d, esi
clc
test r13d, 0x6fa5684c
mov dword [rsp + 0x28], r14d
cmp r8b, 0x21
sub edx, edx
cmc
mov qword [rsp + 0x20], r14
stc
cmp r13b, 0x4a
cmp r8b, dl
sub ecx, ecx
jmp 0x1404dd49e
call fcn.1404cd7ac
movsxd rbp, eax
test r12b, 0x1f
test bl, al
test eax, eax
jmp 0x1404dd4b3
je 0x1404dd55b
mov rcx, rbp
jmp 0x1404dd4c1
call fcn.1404cd6e6
mov rdi, rax
test r9b, 0xf7
test rax, rax
jmp 0x1404dd4d5
je 0x1404dd53c
mov qword [rsp + 0x38], r14
jmp 0x1404dd4ec
mov r9d, esi
movzx r8w, r15b
mov qword [rsp + 0x30], r14
mov r8, rbx
clc
cmp rbx, r11
mov dword [rsp + 0x28], ebp
sub edx, edx
jmp 0x1404dd50e
sub ecx, ecx
jmp 0x1404dd515
mov qword [rsp + 0x20], rax
jmp 0x1404dd51f
call fcn.1404cd7ac
test eax, eax
je 0x1404dd53c
mov rsi, rdi
mov rdi, r14
jmp 0x1404dd537
jmp 0x1404dd549
mov rsi, r14
movsx cx, sil
jmp 0x1404dd549
mov rcx, rdi
jmp 0x1404dd551
call fcn.1404cd66f
jmp 0x1404dd55e
mov rsi, r14
test rbx, rbx
jmp 0x1404dd566
je 0x1404dd575
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
bts rdi, r9
cmp bh, 0x10
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
shl dil, cl
add r14, 0x721628b2
mov rdi, qword [rsp + 0x68]
movzx r14w, bpl
xor r14b, 0x3f
add rsp, 0x40
pop r14
ret
Function at 0x1404dd5ad
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmp dil, dl
mov qword [rsp + 0x10], rbp
cmc
mov qword [rsp + 0x18], rsi
clc
test r12b, spl
push rdi
sub rsp, 0x20
jmp 0x1404dd5ce
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
mov rbx, rax
jmp 0x1404dd5df
test rax, rax
jmp 0x1404dd5e7
je 0x1404dd6a6
mov rbp, rax
cmp rdx, rsp
cmc
test r8d, 0x108976e6
cmp word [rax], si
je 0x1404dd63c
or rax, 0xffffffffffffffff
jmp 0x1404dd60d
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404dd61a
jne 0x1404dd60d
lea rbp, [rbp + rax*2]
cmc
cmp cl, r11b
add rbp, 2
cmp word [rbp], si
jmp 0x1404dd636
jne 0x1404dd604
sub rbp, rbx
bts cx, sp
add rbp, 2
inc cx
sar rbp, 1
add rbp, rbp
movzx ecx, cx
mov rcx, rbp
call fcn.1404cd6e6
mov rdi, rax
jmp 0x1404dd665
test rax, rax
jmp 0x1404dd66d
je 0x1404dd691
mov r8, rbp
mov rdx, rbx
cmovge cx, r15w
movsxd rcx, esp
mov rcx, rax
jmp 0x1404dd689
call fcn.1404a79a8
mov rsi, rdi
xor ecx, ecx
call fcn.1404cd66f
mov rcx, rbx
jmp 0x1404dd6a0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
sar bpl, cl
test r15, rbp
mov rax, rsi
mov sil, r14b
sar dil, 0xa3
mov rsi, qword [rsp + 0x40]
ror bp, 0xe5
btr rdi, r8
movzx ebp, dx
mov rbp, qword [rsp + 0x38]
shl dil, cl
sar rdi, cl
add rsp, 0x20
pop rdi
jmp 0x1404dd6e0
ret
Function at 0x1404e052d
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov ah, 0x95
movsx eax, dx
mov qword [rsp + 0x18], rbp
push rsi
movsx rax, r8w
nop
push rdi
bswap ax
push r14
not ax
lahf
movsx rax, sp
mov eax, 0x1450
call fcn.14044cd9c
sub rsp, rax
btr bp, 0x5c
sub bp, r10w
or bpl, r10b
mov rax, qword [0x1400b7288]
cmovo bp, r14w
stc
bt r10w, sp
xor rax, rsp
rcl r14b, 0xf2
rol di, 0x17
bts di, r11w
mov qword [rsp + 0x1440], rax
rcr si, 0x7c
movsxd r10, edx
shr edx, 0x22
sub bpl, 0x9a
bswap r14
mov rdi, rcx
test r15w, cx
cdq
mov rax, r10
mov ebp, r9d
btr si, 0xc9
stc
sar rax, 6
btc esi, ebp
lea rcx, [0x1400ba940]
movsx si, al
and r10d, 0x3f
lea rbp, [rbp + r8]
mov rsi, r8
mov rax, qword [rcx + rax*8]
btr r14w, bp
lea rdx, [r10 + r10*8]
rol r14w, 0x39
or r14d, 0x19324d51
mov r14, qword [rax + rdx*8 + 0x28]
stc
sub eax, eax
cmp r14b, r13b
cmc
cmp bl, 0x84
mov qword [rdi], rax
stc
test sil, al
mov dword [rdi + 8], eax
cmc
cmp bx, 0x1e5c
cmp r8, rbp
jmp 0x1404e0618
jae 0x1404e0726
lea rbx, [rsp + 0x40]
test r15b, 0x7e
clc
cmp rsi, rbp
jmp 0x1404e0630
jae 0x1404e0693
mov al, byte [rsi]
jmp 0x1404e063d
inc rsi
cmp dh, ah
jmp 0x1404e0647
cmp al, 0xa
jmp 0x1404e064e
jne 0x1404e066c
inc dword [rdi + 8]
jmp 0x1404e065c
mov byte [rbx], 0xd
jmp 0x1404e0664
inc rbx
jmp 0x1404e066c
mov byte [rbx], al
inc rbx
rcr al, cl
or ax, 0x16f5
shrd ax, r10w, 0x76
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x1404e068d
jb 0x1404e0628
and qword [rsp + 0x20], 0
bsr rcx, r14
cmp spl, 0xed
lea rax, [rsp + 0x40]
bts r9, r15
jmp 0x1404e06af
sub ebx, eax
mov r8w, r12w
lea r9, [rsp + 0x30]
movsx ecx, r15w
mov r8d, ebx
xchg rcx, rcx
not ecx
movsx rdx, r14w
lea rdx, [rsp + 0x40]
movzx cx, r12b
mov rcx, r14
jmp 0x1404e06dc
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404e071e
mov eax, dword [rsp + 0x30]
jmp 0x1404e06f4
add dword [rdi + 4], eax
cmc
test r10b, r10b
cmp r14b, spl
cmp eax, ebx
jmp 0x1404e0705
jb 0x1404e0726
cmp rsi, rbp
jmp 0x1404e0713
jb 0x1404e061e
jmp 0x1404e0726
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
shr ch, 0x8b
not cl
add ecx, 0x15600b21
mov rcx, qword [rsp + 0x1440]
cmp ebp, esi
xor rcx, rsp
jmp 0x1404e0746
call fcn.1404a3d69
lea r11, [rsp + 0x1450]
jmp 0x1404e075f
mov rbx, qword [r11 + 0x20]
mov sil, bl
movsx r14w, spl
mov rbp, qword [r11 + 0x30]
jmp 0x1404e0779
mov rsp, r11
jmp 0x1404e0787
pop r14
movzx rdi, r8w
mov si, 0x67da
bswap esi
pop rdi
movsx rsi, ax
xchg sil, sil
movsxd rsi, ebp
pop rsi
jmp 0x1404e07a4
ret