joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14046419a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
sub r10b, r10b
mov rax, qword [rcx + 0x460]
mov r10, rcx
not bx
add rcx, 0x58
movzx rbx, r13w
mov ebx, r8d
sar r11, cl
movzx r11d, r12w
mov r11, rdx
cmp bp, ax
test bpl, 0xca
test rax, rax
jmp 0x1404641d3
jne 0x1404641e3
mov eax, 0x200
jmp 0x140464204
mov rcx, rax
dec ax
ror r8, 0x4e
or al, spl
mov rax, qword [r10 + 0x458]
add r8b, r12b
mov r8b, dil
movsx r8d, r12w
shr rax, 1
lea r8, [rcx - 1]
jmp 0x14046420d
lea r8, [r8 + rax]
rcr al, 0x84
sub eax, 0x4ece1e64
mov qword [r10 + 0x48], r8
mov eax, dword [r10 + 0x38]
clc
test r11b, r10b
test eax, eax
jmp 0x14046422c
jg 0x14046423b
test r11, r11
je 0x1404642d1
dec eax
jmp 0x140464242
xor edx, edx
cmp di, 0x3954
mov dword [r10 + 0x38], eax
xadd al, ah
mov rax, r11
movsx r11, r9w
shr r11, cl
cmove r11d, edx
div rbx
movzx r11, di
add dl, 0x30
jmp 0x140464277
mov r11, rax
test r13b, r14b
cmp dl, 0x39
jmp 0x140464285
jle 0x1404642b3
mov al, r9b
test r8b, 0x6c
stc
xor al, 1
test r9w, sp
shl al, 5
add al, 7
test r13d, ecx
cmp r8b, 0xed
cmp ebx, r10d
add dl, al
movzx ax, dil
movzx eax, r8w
mov rax, qword [r10 + 0x48]
jmp 0x1404642bc
mov byte [rax], dl
jmp 0x1404642c3
dec qword [r10 + 0x48]
jmp 0x1404642cc
jmp 0x14046421d
sub r8d, dword [r10 + 0x48]
cmovg ebx, r11d
movsxd rbx, ebx
mov rbx, qword [rsp + 8]
jmp 0x1404642e6
mov dword [r10 + 0x50], r8d
jmp 0x1404642ef
inc qword [r10 + 0x48]
ret

Function at 0x140464cd7
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
cmp spl, r11b
clc
push rdi
bts rsi, r15
cmc
mov sil, r14b
sub rsp, 0x30
adc sil, 0x4c
sar sil, cl
mov edi, edx
or sil, 0xdd
test r13d, r13d
mov rsi, rcx
cmp r12b, r15b
test r8, r8
jne 0x140464d2d
call fcn.14046958d
mov dword [rax], 0x16
jmp 0x140464d21
call fcn.14046a24c
sub eax, eax
jmp 0x140464e1e
mov rdx, r9
movzx cx, bl
movzx ecx, r12w
jmp 0x140464d3d
mov rcx, r8
call fcn.140464e77
mov rbx, rax
test rax, rax
jmp 0x140464d50
je 0x140464daa
lea rax, [rsp + 0x50]
cdq
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14009254c]
mov eax, dword [rsp + 0x60]
mov r9, rbx
xchg cx, cx
mov rcx, rsi
jmp 0x140464d7d
mov dword [rsp + 0x20], eax
jmp 0x140464d86
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x140464e3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x140464da5
call fcn.1404695f2
sub edi, edi
cmp rsi, 0x53d8621b
jmp 0x140464db8
test rbx, rbx
jmp 0x140464dc0
je 0x140464e0d
mov rcx, qword [rbx + 0x10]
stc
test r15b, 2
jmp 0x140464dd4
test rcx, rcx
je 0x140464de3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmp r9b, dl
cmc
clc
test rcx, rcx
jmp 0x140464df4
je 0x140464e00
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x140464e08
call fcn.14047c775
mov rax, rdi
jmp 0x140464e1e
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
shl dil, 0x25
add rsp, 0x30
movsxd rdi, ebp
pop rdi
jmp 0x140464e39
ret
mov rcx, qword [rsp + 0x68]
cmp dx, r14w
test rcx, rcx
jmp 0x140464e4b
je 0x140464e5c
mov eax, dword [rsp + 0x50]
jmp 0x140464e5a
mov dword [rcx], eax
xor ebx, ebx
jmp 0x140464e63
jmp 0x140464db8
Function at 0x140465132
Capabilities:
Terminate process

Disassembly:
push rbx
and ebx, r13d
cmc
sbb bx, 0x337d
sub rsp, 0x20
cmovg bx, dx
movsx bx, r8b
movzx ebx, di
mov ebx, ecx
jmp 0x140465154
call fcn.140485cf8
cmp eax, 1
jmp 0x140465161
je 0x1404651aa
mov rax, qword gs:[0x60]
bswap dx
mov edx, dword [rax + 0xbc]
cmc
shr edx, 8
test dl, 1
jmp 0x140465185
jne 0x1404651aa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14046519d
mov edx, ebx
jmp 0x1404651a4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404651b1
call fcn.14046507a
mov ecx, ebx
jmp 0x1404651bd
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14046a2e9
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movzx rcx, dx
bswap cx
mov ecx, 0x17
jmp 0x14046a2fe
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x14046a30b
je 0x14046a31d
mov ecx, 5
int 0x29
jmp 0x14046a31d
mov r8d, 1
movzx cx, r13b
cqo
movzx rdx, r13w
mov edx, 0xc0000417
lea ecx, [r8 + 1]
jmp 0x14046a33c
call fcn.14046a366
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
inc rdx
mov edx, 0xc0000417
test r9w, di
add rsp, 0x28
jmp 0x14046a35f
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140472d75
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xor al, dl
clc
mov r9b, r11b
push rdi
btc rdi, 0xe4
xchg al, bl
shl bx, cl
sub rsp, 0x30
rcr r9b, 0x49
shrd r11w, r12w, 0x12
adc r11w, r13w
mov r9b, byte [rdx + 8]
shrd r11w, r12w, 0x74
mov rbx, rcx
inc al
sal di, cl
mov al, r9b
sal r11w, 0xc5
rcr r11, 0
cmovbe r11, rax
xor ecx, ecx
sal dil, cl
neg al
movzx rdi, dx
cwde
mov rdi, rdx
movzx r11w, r13b
movsx rax, r11w
cdqe
mov eax, dword [rbx + 4]
lea r11, [rbx + 8]
mov r8d, 0x319a32bc
movzx r8w, al
movsx r8w, cl
sbb r10d, r10d
mov r8b, bpl
adc r8w, bx
rol r8b, 0x47
lea r8, [rbx + 8]
and r10d, 0x1d
test dil, dil
add r11, rax
add r10d, 0x17
add r10d, dword [rbx]
jmp 0x140472e18
cmp r8, r11
jmp 0x140472e20
je 0x140472e7f
neg r9b
movsx rax, ax
movabs rax, 0x1fffffff000000
jmp 0x140472e3c
sbb rdx, rdx
and rdx, rax
stc
add rdx, 0xffffff
cmc
clc
cmp rcx, rdx
ja 0x140472e7f
movzx eax, byte [r8]
sub r10d, 4
cmp bl, sil
cmc
shl rcx, 4
jmp 0x140472e6a
inc r8
lea rcx, [rcx + rax]
cmp r8, r11
jmp 0x140472e79
jne 0x140472e4c
mov r9b, 1
jmp 0x140472eb9
test r9b, r9b
jmp 0x140472e8f
je 0x140472ec7
mov al, byte [r8]
inc r8
or r9b, 0x62
sbb r9b, 0x76
test al, al
xchg r9b, r9b
sete r9b
jmp 0x140472eb9
cmp r8, r11
jmp 0x140472ec1
jne 0x140472e87
mov r8b, byte [rbx + 0x308]
movsx dx, r13b
jmp 0x140472edd
mov edx, r10d
jmp 0x140472ee5
mov qword [rsp + 0x20], rdi
jmp 0x140472eef
call fcn.14046e658
mov rbx, qword [rsp + 0x40]
dec rdi
neg di
add rsp, 0x30
mov dil, 0xe6
pop rdi
ret
Function at 0x14047dd3a
Capabilities:
Get thread local storage value

Disassembly:
push rbx
bt r8d, eax
sub r8b, r9b
sub rsp, 0x20
movsxd r8, esp
mov r9b, sil
mov ebx, ecx
mov cl, spl
not r8
lea r9, [0x1400c33c0]
mov ecx, 5
movsx rdx, r8w
movzx edx, r9w
setge dh
lea r8, [0x1400c33b8]
movzx rdx, si
cwd
bswap dx
lea rdx, [0x1400cc860]
call fcn.14047ec23
mov ecx, ebx
cmc
test r10b, spl
test rax, rax
jmp 0x14047dd96
je 0x14047ddad
add rsp, 0x20
pop rbx
jmp 0x14047dda6
jmp qword [case.0x1403fcc95.0]
add rsp, 0x20
movzx bx, r13b
pop rbx
jmp 0x14047ddbc
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x14047ddc3
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
add dil, dl
sub rsp, 0x20
jmp 0x14047ddd5
mov rbx, rdx
movzx edx, cx
lea r9, [0x1400c33c8]
mov edi, ecx
movzx ecx, si
lea rdx, [0x1400cc850]
mov ecx, 6
setge r8b
lea r8, [0x1400c33c0]
jmp 0x14047de03
call fcn.14047ec23
mov rdx, rbx
movsx rcx, di
xor cl, r11b
not cx
mov ecx, edi
cmp r8w, 0x4c00
test rax, rax
je 0x14047de31
call qword [case.0x1403fcc95.0]
jmp 0x14047de37
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movsx rdi, r11w
sal edi, cl
add rsp, 0x20
mov edi, 0x233d4333
pop rdi
jmp 0x14047de51
ret

Function at 0x14047dfed
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
stc
mov qword [rsp + 0x10], rbp
clc
xor bl, 0x8c
movsx bp, cl
mov qword [rsp + 0x18], rsi
xor bl, 7
push rdi
test ax, bx
sub rsp, 0x30
xchg bp, bp
sets bpl
mov rbp, rax
mov ebx, r9d
mov rdi, r8
mov esi, edx
bswap edx
mov dx, 0x16a5
jmp 0x14047e02d
lea r9, [0x1400c33d8]
setl dl
mov bpl, 0xe7
mov rbp, rcx
movsx rdx, sp
movsx r8w, cl
movsx ecx, cx
lea r8, [0x1400c33d0]
movsxd rdx, edi
setge dl
lea rdx, [0x1400cc0b8]
xchg cx, cx
mov ecx, 0xb
jmp 0x14047e06a
call fcn.14047ec23
mov rcx, rbp
test rax, rax
jmp 0x14047e07a
je 0x14047e09a
mov r9d, ebx
mov r8, rdi
cwd
mov edx, esi
jmp 0x14047e08f
call qword [case.0x1403fcc95.0]
jmp 0x14047e0c1
sub edx, edx
call fcn.14047e6e6
mov ecx, eax
movzx r8w, bpl
not r9d
movsxd rdx, r14d
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x14047e0bb
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
sbb edi, 0x356b4d72
btr di, 2
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
btr di, r9w
add rsp, 0x30
movsxd rdi, r12d
movzx rdi, dx
jmp 0x14047e0f0
pop rdi
ret
Function at 0x14047e9db
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
btc dx, r15w
stc
lea r9, [0x1400c3394]
or edx, ebx
dec dl
xor ecx, ecx
sete dl
movsx r8d, r10w
lea r8, [0x1400c3390]
bswap dx
cqo
lea rdx, [0x1400ccdd8]
jmp 0x14047ea11
call fcn.14047ec23
lea r9, [0x1400c33a0]
movsxd rcx, r11d
mov ecx, 1
lea r8, [0x1400c3398]
mov dx, r14w
not dl
lea rdx, [0x1400cc0f8]
jmp 0x14047ea3e
call fcn.14047ec23
lea r9, [0x1400c33a8]
cwd
xchg dx, dx
mov ecx, 2
movsx r8w, r12b
lea r8, [0x1400c33a0]
movzx edx, di
cmovne rdx, r14
lea rdx, [0x1400cc0a0]
jmp 0x14047ea73
call fcn.14047ec23
lea r9, [0x1400c33d0]
mov ecx, 8
lea r8, [0x1400c33c8]
jmp 0x14047ea95
lea rdx, [0x1400cc080]
jmp 0x14047eaa1
call fcn.14047ec23
lea r9, [0x1400c33d8]
movzx dx, sil
cdq
mov ecx, 0xb
xchg edx, r8d
lea r8, [0x1400c33d0]
lea rdx, [0x1400cc0b8]
jmp 0x14047eace
call fcn.14047ec23
lea r9, [0x1400c33e0]
cqo
cwd
not cx
mov ecx, 0xe
movzx r8w, r9b
mov rdx, 0x3e485f03
mov r8b, r9b
lea r8, [0x1400c33d8]
cqo
not dx
movsx dx, r13b
lea rdx, [0x1400cc090]
jmp 0x14047eb12
call fcn.14047ec23
lea r9, [0x1400c33e8]
bswap r8w
cqo
movsx r8w, bl
mov ecx, 0xf
lea r8, [0x1400c33e0]
cmovnp dx, r9w
lea rdx, [0x1400cc908]
call fcn.14047ec23
lea r9, [0x1400c33f8]
mov ecx, 0x13
movsx r8d, r11w
cmovo r8w, r14w
movsxd rdx, r12d
lea r8, [0x1400c33f0]
movzx dx, dl
lea rdx, [0x1400cc940]
jmp 0x14047eb75
call fcn.14047ec23
lea r9, [0x1400c3400]
cmovle r8d, ebp
movsx r8, ax
mov ecx, 0x14
cmovbe r8, rbx
movsx dx, r10b
movsx r8, r13w
lea r8, [0x1400c33f8]
cwd
movzx edx, r8w
not dh
lea rdx, [0x1400cc0e8]
jmp 0x14047ebb6
call fcn.14047ec23
lea r9, [0x1400c3408]
setns r8b
cdq
mov ecx, 0x15
jmp 0x14047ebd1
lea r8, [0x1400c3400]
xchg dl, dh
lea rdx, [0x1400cc928]
jmp 0x14047ebe6
call fcn.14047ec23
lea r9, [0x1400c3410]
movzx r8, r13w
mov ecx, 0x16
sete dl
mov dh, 0xd9
lea r8, [0x1400c3408]
cmc
clc
movzx edx, di
lea rdx, [0x1400ccde8]
cmc
add rsp, 0x28
jmp 0x14047ec1e
jmp fcn.14047ec23
Function at 0x140489d29
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
btr bx, r15w
sub rsp, 0x20
movzx bx, dh
mov rbx, rcx
jmp 0x140489d44
call fcn.14047cad3
or r8, 0xffffffffffffffff
movsx edx, si
mov r9, r8
or edx, r10d
sub edi, edi
movsx edx, cx
movsx dx, dil
not dl
lea rdx, [rax + 0x98]
bswap eax
movsx rax, di
mov rax, qword [rdx]
jmp 0x140489d77
inc r9
test sp, 0x638
jmp 0x140489d84
cmp word [rax + r9*2], di
jmp 0x140489d8e
jne 0x140489d77
mov eax, edi
sub al, bpl
cmp r9, 3
mov al, al
seta al
sete al
jmp 0x140489daa
mov dword [rdx + 0x18], eax
cdqe
movsx ax, r9b
mov rax, qword [rdx + 8]
jmp 0x140489dbd
inc r8
test r8w, 0x6461
cmp word [rax + r8*2], di
jmp 0x140489dd0
jne 0x140489dbd
cmp r8, 3
mov eax, r12d
cwde
mov eax, edi
setp r8b
mov r8d, 2
jmp 0x140489def
sete al
test r10b, cl
jmp 0x140489dfa
mov dword [rdx + 0x1c], eax
mov dword [rbx + 4], edi
stc
cmp dword [rdx + 0x18], edi
jmp 0x140489e09
jne 0x140489e65
mov rcx, qword [rdx]
movsx r10d, sp
mov r10d, edi
movzx r9d, word [rcx]
ror ah, cl
lea rcx, [rcx + r8]
adc al, r11b
lea eax, [r9 - 0x41]
cmp ax, 0x19
jbe 0x140489e4e
sub r9w, 0x61
cmp r9d, ebx
cmc
stc
cmp r9w, 0x19
jmp 0x140489e48
ja 0x140489e5b
inc r10d
jmp 0x140489e56
jmp 0x140489e19
mov r8d, r10d
xchg ch, cl
not ch
movsxd rcx, r8d
mov dword [rdx + 0x14], r8d
not rcx
lea rcx, [0x1400a9000]
movzx edx, si
jmp 0x140489e7d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov ecx, dword [rbx]
test cl, 7
mov al, 0x80
not al
setne dl
jmp 0x140489e9c
bt ecx, 9
setb al
and dl, al
bt ecx, 8
setb al
clc
test al, dl
jmp 0x140489eb4
jne 0x140489ec9
mov dword [rbx], edi
xor edi, 0x35e974b8
and bl, r15b
shl bx, 0x47
mov rbx, qword [rsp + 0x30]
neg di
movzx edi, dx
add rsp, 0x20
mov di, di
pop rdi
jmp 0x140489ee1
ret
Function at 0x14048a8be
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
xor rbx, r9
mov qword [rsp + 0x18], rsi
ror ebx, 0x2e
ror ebx, cl
mov bl, 0x7c
push rdi
sub rsp, 0x20
sub dil, 0x8f
bts bx, r13w
xor esi, esi
xor bx, bp
bt bx, r9w
mov rdi, rdx
xchg bx, bx
rcl rbx, cl
cmp r11b, dl
mov rbx, rcx
cmc
test rcx, rcx
jmp 0x14048a902
je 0x14048a98d
cmp word [rcx], si
je 0x14048a98d
lea rdx, [0x1400ceef8]
call fcn.1401f5694
test eax, eax
je 0x14048a98d
lea rdx, [0x1400ceef0]
sets cl
mov rcx, rbx
jmp 0x14048a937
call fcn.1401f5694
test eax, eax
jne 0x14048a97b
mov ecx, dword [rdi + 8]
movzx dx, bpl
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x14048a967
je 0x14048a9bd
mov eax, dword [rsp + 0x30]
jmp 0x14048a976
jmp 0x14048a9e0
mov rcx, rbx
jmp 0x14048a983
call fcn.140493b15
jmp 0x14048a9e0
mov ecx, dword [rdi + 8]
bswap r8d
lea r8, [rsp + 0x30]
xchg dh, dh
mov r9d, 2
mov edx, 0x20001004
jmp 0x14048a9aa
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x14048a9b7
jne 0x14048a9c9
sub eax, eax
jmp 0x14048a9c4
jmp 0x14048a9e0
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x14048a9d4
jne 0x14048a9e0
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
sal rdi, cl
or dil, r10b
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
setl dil
xchg dil, dil
pop rdi
jmp 0x14048aa01
ret

Function at 0x14048aa02
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
sal bl, 0xb
mov qword [rsp + 0x18], rsi
cmc
or ebx, r9d
shr esi, cl
push rdi
stc
shld bx, r10w, 0xef
sub rsp, 0x20
mov sil, 0x46
xchg sil, sil
mov esi, edx
mov ebx, ecx
jmp 0x14048aa30
call fcn.14047cad3
mov ecx, ebx
sbb dil, r15b
stc
lea r8, [rsp + 0x30]
bt edx, ebx
and ecx, 0x3ff
cqo
movzx rdx, cx
stc
mov r9d, 2
movzx rdi, sp
bts edi, r12d
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
jmp 0x14048aa6f
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test eax, 0xc514de9
test eax, eax
jmp 0x14048aa84
je 0x14048ab42
cmp ebx, dword [rsp + 0x30]
jmp 0x14048aa93
je 0x14048ab33
test esi, esi
jmp 0x14048aaa0
je 0x14048ab33
mov r9, qword [rdi + 0x98]
lahf
bt r8w, 0xcd
movzx rax, r14w
mov r8d, r10d
bswap dx
stc
movzx edx, word [r9]
sal ecx, 0xc9
sbb al, r8b
lea rcx, [r9 + 2]
inc ax
lea eax, [rdx - 0x41]
test r14b, bpl
cmp ax, 0x19
jbe 0x14048aaf4
sub dx, 0x61
cmc
cmp dx, 0x19
jmp 0x14048aaee
ja 0x14048ab13
movzx edx, word [rcx]
inc r8d
test r10d, r10d
jmp 0x14048ab05
add rcx, 2
jmp 0x14048ab0e
jmp 0x14048aad0
or rcx, 0xffffffffffffffff
jmp 0x14048ab1c
inc rcx
cmp word [r9 + rcx*2], r10w
jne 0x14048ab1c
cmp r8d, ecx
je 0x14048ab42
mov eax, 1
jmp 0x14048ab3d
jmp 0x14048ab44
sub eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
btr edi, r14d
movzx di, r13b
add rsp, 0x20
jmp 0x14048ab64
pop rdi
jmp 0x14048ab6a
ret
Function at 0x14048c269
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test dl, 9
cmp rdx, 0x1ad74463
jmp 0x14048c282
mov qword [rax + 8], rbx
jmp 0x14048c28f
mov qword [rax + 0x10], rbp
cmp cx, 0x59c7
stc
cmp spl, r12b
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
test bl, r9b
push r14
test r12b, 0xbd
sub rsp, 0x40
jmp 0x14048c2b6
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
shr bh, 0xa2
add bx, r10w
sal rbx, 0xd8
mov rbx, rax
test rax, rax
jmp 0x14048c2d5
je 0x14048c45b
mov rsi, rax
test al, r9b
clc
cmp word [rax], r14w
je 0x14048c323
or rax, 0xffffffffffffffff
jmp 0x14048c2f5
inc rax
cmp r12w, r14w
cmp word [rsi + rax*2], r14w
jmp 0x14048c306
jne 0x14048c2f5
lea rsi, [rsi + rax*2]
stc
add rsi, 2
cmp r13w, sp
cmp word [rsi], r14w
jne 0x14048c2ec
mov qword [rsp + 0x38], r14
or r9, 0x6ccd2a36
sub rsi, rbx
stc
sar r8d, cl
mov qword [rsp + 0x30], r14
shr r8b, cl
add rsi, 2
bts r9w, r12w
rcr r8, 0x66
movsx r9d, r15w
sar rsi, 1
dec r8b
stc
btr r9w, 0xd3
mov r8, rbx
dec r9b
mov r9d, esi
clc
test r8b, 0xb4
test spl, r11b
mov dword [rsp + 0x28], r14d
jmp 0x14048c37b
xor edx, edx
jmp 0x14048c385
mov qword [rsp + 0x20], r14
test ax, 0x2f23
sub ecx, ecx
call fcn.14047c8b4
movsxd rbp, eax
cmp sil, 0xa8
stc
cmp bpl, sil
test eax, eax
jmp 0x14048c3a7
je 0x14048c45b
mov rcx, rbp
jmp 0x14048c3b5
call fcn.14047c7fa
mov rdi, rax
cmp r13w, si
cmc
test rax, rax
jmp 0x14048c3ca
je 0x14048c43c
mov qword [rsp + 0x38], r14
xadd r9b, r8b
btc r9w, r12w
xor r8b, r13b
mov r9d, esi
xchg r8, r8
movsx r8, cx
mov qword [rsp + 0x30], r14
mov r8, rbx
cmp r12d, r15d
stc
mov dword [rsp + 0x28], ebp
clc
sub edx, edx
clc
cmc
cmp r15b, cl
sub ecx, ecx
jmp 0x14048c40a
mov qword [rsp + 0x20], rax
jmp 0x14048c414
call fcn.14047c8b4
test eax, eax
jmp 0x14048c420
je 0x14048c43c
mov rsi, rdi
mov dil, cl
mov dil, 0x70
mov rdi, r14
jmp 0x14048c437
jmp 0x14048c449
mov rsi, r14
movzx cx, al
xchg cx, cx
movsxd rcx, r15d
mov rcx, rdi
jmp 0x14048c451
call fcn.14047c775
jmp 0x14048c45f
mov rsi, r14
stc
test rbx, rbx
je 0x14048c476
mov rcx, rbx
jmp 0x14048c470
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
bt rdi, r8
sal bpl, 0xdc
mov rax, rsi
shld rbp, r15, 0xd
shr di, cl
mov rsi, qword [rsp + 0x60]
cmc
add r14w, cx
mov rbp, qword [rsp + 0x58]
movzx r14w, r10b
mov rdi, qword [rsp + 0x68]
add r14w, 0x1c9b
add rsp, 0x40
xchg r14d, r14d
mov r14b, bl
not r14d
pop r14
jmp 0x14048c4c1
ret
Function at 0x14048c4c2
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
jmp 0x14048c4d8
mov qword [rsp + 0x18], rsi
cmc
jmp 0x14048c4e4
push rdi
cmc
test dx, 0x4759
cmp r10b, r10b
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test r13b, 0x15
stc
test rax, rax
je 0x14048c5cf
mov rbp, rax
jmp 0x14048c514
cmp word [rax], si
je 0x14048c560
or rax, 0xffffffffffffffff
jmp 0x14048c526
inc rax
cmp word [rbp + rax*2], si
jmp 0x14048c533
jne 0x14048c526
lea rbp, [rbp + rax*2]
cmp di, cx
cmc
test dh, 0x85
add rbp, 2
test rdx, 0x2de53e37
clc
cmp word [rbp], si
jmp 0x14048c55a
jne 0x14048c51d
sub rbp, rbx
add rbp, 2
or rcx, 0x226b0faf
jmp 0x14048c573
sar rbp, 1
add rbp, rbp
movzx ecx, sp
xchg cl, ch
mov rcx, rbp
jmp 0x14048c586
call fcn.14047c7fa
mov rdi, rax
cmp sp, 0x5fe
test rax, rax
je 0x14048c5b5
mov r8, rbp
movsx ecx, ax
mov cl, bl
mov rdx, rbx
mov cl, sil
mov rcx, rax
call fcn.140457667
mov rsi, rdi
xor ecx, ecx
jmp 0x14048c5bc
call fcn.14047c775
mov rcx, rbx
jmp 0x14048c5c9
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
stc
sar bpl, 0x9d
bsf ebp, edx
mov rax, rsi
rcr bpl, cl
mov rsi, qword [rsp + 0x40]
movsx di, r12b
sub ebp, edi
rcr dil, cl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14048f502
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov ax, dx
movzx rax, ax
movzx eax, bp
mov qword [rsp + 0x18], rbp
cwde
movzx rax, r15w
lahf
push rsi
push rdi
movzx ax, r9b
cbw
mov ax, sp
push r14
not al
jmp 0x14048f533
mov eax, 0x1450
jmp 0x14048f53d
call fcn.1403fcd88
sub rsp, rax
mov rax, qword [0x1400b4278]
bsf di, bp
cmp r11b, al
xor rax, rsp
movzx rsi, cx
rol r14b, cl
mov qword [rsp + 0x1440], rax
shrd r14, rsi, 8
rol si, cl
or bpl, 0x39
movsxd r10, edx
mov rdi, rcx
sbb esi, 0x4c591be3
rdtsc
mov rax, r10
shl cl, 0x7f
xchg dl, sil
rcl si, 0x54
mov ebp, r9d
add dl, dl
cmc
sar rax, 6
rcr dh, cl
btr si, 0x17
lea rcx, [0x1400b7aa0]
test dl, sil
shld r14, r14, 0x31
and r10d, 0x3f
lea rbp, [rbp + r8]
sbb r14b, 0x54
cmc
shl sil, cl
mov rsi, r8
mov rax, qword [rcx + rax*8]
shr r14w, 0xa7
dec rdx
rcr r14, cl
lea rdx, [r10 + r10*8]
jmp 0x14048f5d8
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
jmp 0x14048f5ea
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x14048f5f5
jae 0x14048f6f2
lea rbx, [rsp + 0x40]
stc
cmp rsi, rbp
jmp 0x14048f609
jae 0x14048f669
mov al, byte [rsi]
jmp 0x14048f616
inc rsi
cmp edx, 0x79b16d5b
cmp al, 0xa
jmp 0x14048f626
jne 0x14048f644
inc dword [rdi + 8]
jmp 0x14048f634
mov byte [rbx], 0xd
jmp 0x14048f63c
inc rbx
jmp 0x14048f644
mov byte [rbx], al
dec rax
nop
inc rbx
adc rax, rax
inc ah
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x14048f663
jb 0x14048f601
and qword [rsp + 0x20], 0
movzx eax, r13w
sar r9b, cl
lea rax, [rsp + 0x40]
sal cx, 0xc9
sar cx, 0xe8
bts ecx, ebp
sub ebx, eax
cqo
lea r9, [rsp + 0x30]
mov r8d, ebx
cdq
cmovne edx, r15d
lea rdx, [rsp + 0x40]
xchg cl, cl
movsxd rcx, eax
mov rcx, r14
jmp 0x14048f6a9
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x14048f6b6
je 0x14048f6e5
mov eax, dword [rsp + 0x30]
test cl, ch
test r14d, 0x26de7303
cmp cl, 0x9c
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x14048f6f2
cmp rsi, rbp
jb 0x14048f5fb
jmp 0x14048f6f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
cmp r11w, ax
clc
mov rax, rdi
movzx rcx, r15w
btr rcx, 0x35
mov rcx, qword [rsp + 0x1440]
cmc
xor rcx, rsp
jmp 0x14048f70f
call fcn.1404525ed
lea r11, [rsp + 0x1450]
movsxd rbp, r12d
movzx edi, r15w
movsx di, r11b
mov rbx, qword [r11 + 0x20]
not dil
mov rbp, qword [r11 + 0x30]
movsx rsi, bp
xchg esi, r14d
mov rsp, r11
pop r14
pop rdi
movsx esi, r8w
mov rsi, rsi
pop rsi
jmp 0x14048f74d
ret
Function at 0x14048f74e
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cbw
xchg ah, al
movzx eax, r14w
mov qword [rsp + 0x18], rbp
movzx rax, dx
movsx ax, ch
movsxd rax, r8d
push rsi
not al
push rdi
cwde
movzx ax, r15b
push r14
cwde
not rax
mov eax, 0x1450
jmp 0x14048f785
call fcn.1403fcd88
sub rsp, rax
rol rsi, 0xfb
rcl r14b, cl
mov rax, qword [0x1400b4278]
shl rdi, 0x9a
shld si, r8w, 0x6a
bsf rsi, rbp
xor rax, rsp
bswap di
mov qword [rsp + 0x1440], rax
movzx rbp, r12w
rol di, 2
clc
movsxd r10, edx
mov rdi, rcx
bt cx, r15w
bt bp, 0x10
movzx esi, r9w
mov rax, r10
cwd
sal bpl, 0x5f
mov ebp, r9d
sar rax, 6
sar r14w, cl
lea rcx, [0x1400b7aa0]
and r10d, 0x3f
add rbp, r8
bts r14w, r14w
cmp r13b, r8b
adc dx, ax
mov rsi, r8
sbb r14w, 0x47a2
mov rax, qword [rcx + rax*8]
movsxd rdx, r8d
xchg r14b, r14b
movsx rdx, si
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x14048f82a
sub eax, eax
cmp r15d, 0xbab2241
mov qword [rdi], rax
cmp r15, 0x7af47706
cmc
stc
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x14048f84a
jae 0x14048f96b
lea rbx, [rsp + 0x40]
cmp bl, 0xab
cmp rsi, rbp
jmp 0x14048f860
jae 0x14048f8cc
movzx eax, word [rsi]
test bp, r15w
stc
add rsi, 2
test sil, 0x68
jmp 0x14048f87c
cmp ax, 0xa
jne 0x14048f8ac
add dword [rdi + 8], 2
test bx, 0x7710
add cl, bpl
movsxd rcx, r15d
mov ecx, 0xd
test cl, 0x82
mov word [rbx], cx
cmp r13w, r9w
add rbx, 2
cmp ch, 0x20
clc
mov word [rbx], ax
rol eax, 0x58
cmc
add rbx, 2
test dl, dil
lea rax, [rsp + 0x143e]
stc
cmp rbx, rax
jb 0x14048f858
and qword [rsp + 0x20], 0
and r8w, 0x1338
lea rax, [rsp + 0x40]
shl r8b, 0xcf
add r9b, r15b
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
adc r8w, r9w
movzx ecx, r12w
lea rdx, [rsp + 0x40]
rol r8b, cl
and r8d, 0x55f20135
add ebx, ebx
movsx ecx, r9w
mov cl, 0xf4
not r8d
mov rcx, r14
cmovge r8d, r10d
movsxd r8, esp
mov r8d, ebx
jmp 0x14048f923
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x14048f930
je 0x14048f963
mov eax, dword [rsp + 0x30]
cmp spl, 0x81
cmp cx, r9w
add dword [rdi + 4], eax
test rbx, r10
cmp eax, ebx
jmp 0x14048f94f
jb 0x14048f96b
cmp rsi, rbp
jb 0x14048f850
jmp 0x14048f96b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
ror ecx, cl
mov rcx, qword [rsp + 0x1440]
cmc
xor rcx, rsp
jmp 0x14048f981
call fcn.1404525ed
lea r11, [rsp + 0x1450]
movsx rbp, sp
movsxd rbx, ebp
movsx r14w, r11b
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
mov r14w, bx
movsx rdi, bx
movzx rsi, bp
pop r14
movzx esi, r13w
pop rdi
movsxd rsi, r9d
pop rsi
jmp 0x14048f9c1
ret