joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a7eab
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmc
test sil, 0xcf
mov qword [rsp + 0x10], rsi
sub sil, 0xc8
shrd rsi, r14, 0x87
push rdi
sub rsp, 0x30
rol sil, cl
mov edi, edx
xor esi, 0x3ce04f8f
stc
mov rsi, rcx
test r8, r8
jne 0x1404a7f01
call fcn.1404ac6b8
mov dword [rax], 0x16
jmp 0x1404a7ef0
call fcn.1404ad32a
xor eax, eax
jmp 0x1404a7efc
jmp 0x1404a7fea
mov rdx, r9
setge cl
cmovp rcx, r11
mov rcx, r8
jmp 0x1404a7f13
call fcn.1404a8056
mov rbx, rax
test rax, rax
je 0x1404a7f93
lea rax, [rsp + 0x50]
cwd
movzx r8, r12w
setbe dh
mov rdx, rdi
mov qword [rsp + 0x28], rax
movzx r8w, dl
lea r8, [0x140094b24]
mov eax, dword [rsp + 0x60]
movzx r9w, r11b
movzx rcx, r11w
mov r9, rbx
cmovo rcx, r14
movsx cx, bpl
movsx rcx, r10w
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404a7f6f
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404a7f80
jne 0x1404a8008
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404ac729
xor edi, edi
cmp cx, di
test rdi, 0x1dc87330
test rbx, rbx
jmp 0x1404a7fa7
je 0x1404a7fe7
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jmp 0x1404a7fb9
je 0x1404a7fc5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
clc
stc
test rcx, rcx
jmp 0x1404a7fd3
je 0x1404a7fdf
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1404c061b
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
or dil, al
shr dil, cl
xor di, si
add rsp, 0x30
pop rdi
jmp 0x1404a8007
ret
mov rcx, qword [rsp + 0x68]
cmp dx, di
jmp 0x1404a8015
test rcx, rcx
jmp 0x1404a801d
je 0x1404a8036
mov eax, dword [rsp + 0x50]
cmc
jmp 0x1404a802d
mov dword [rcx], eax
test bl, spl
test r9b, 0x9d
sub ebx, ebx
jmp 0x1404a803d
jmp 0x1404a7f9f

Function at 0x1404a82de
Capabilities:
Terminate process

Disassembly:
push rbx
sbb ebx, 0x29f66868
sal rbx, cl
movzx ebx, r11w
sub rsp, 0x20
movsx rbx, r9w
movsx bx, r12b
mov ebx, ecx
call fcn.1404c9d2f
cmp eax, 1
jmp 0x1404a8309
je 0x1404a835d
mov rax, qword gs:[0x60]
sets dl
shr dx, 0xbe
mov edx, dword [rax + 0xbc]
test di, 0x4b25
shr edx, 8
test dl, 1
jmp 0x1404a8335
jne 0x1404a835d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dx, 0x2cb3
movzx dx, dil
cmovge edx, ecx
mov edx, ebx
jmp 0x1404a8357
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404a823d
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404a93bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x1404a94a8
mov dword [rsp + 0x18], r8d
bswap r8w
adc r8, r15
stc
mov qword [rsp + 0x20], r9
sub r8d, 0x22447706
shrd r8d, esi, 0x30
seto r8b
push rbx
xor r8, 0x6dbe24ad
test bx, 0x91e
push rbp
bt r8w, 0x96
push rsi
clc
mov bp, bp
movzx esi, bx
push rdi
add edi, ecx
bt r8, r14
sub r8w, r13w
sub rsp, 0x38
lea rdi, [rsp + 0x78]
cmc
sub ebx, ebx
add rdi, 0xfffffffffffffff8
movzx bp, cl
mov r8d, r13d
mov rsi, rdx
movsx bp, dl
cdq
mov bpl, r14b
mov rbp, rcx
lea rdi, [rdi + 8]
mov r8d, r11d
mov rdx, rsi
movsx rcx, r15w
cmovs r8, r14
mov r8, qword [rdi]
movzx cx, spl
mov rcx, rbp
call fcn.1404cbbea
test eax, eax
jne 0x1404a94a9
inc ebx
test r15w, r15w
cmp ebx, dword [rsp + 0x70]
jmp 0x1404a946f
jl 0x1404a9436
add rsp, 0x38
movzx rsi, r15w
setbe dil
movzx bp, dl
pop rdi
movsx bx, cl
movsx esi, r14w
mov sil, r9b
pop rsi
movzx rbx, cx
pop rbp
setge bl
bswap bx
jmp 0x1404a94a2
pop rbx
jmp 0x1404a94a8
ret
and qword [rsp + 0x20], 0
test rdx, r15
test r15b, 0x94
xor r9d, r9d
stc
xor r8d, r8d
test r14w, 0x360e
cmc
test r11b, r11b
sub edx, edx
cmp r12, r13
xor ecx, ecx
jmp 0x1404a94d3
call fcn.1404ad3bc
int3

Function at 0x1404ad3bc
Capabilities:
Terminate process

Disassembly:
cmp al, byte [rsi - 0x24]
fdiv st(4)
xchg byte [rdi], ch
cld
invalid
add dword [rbp + 0x45db45ed], ecx
int1
out dx, eax
mov r12b, 0x2a
retf
mov dword [rdi + 0x4a], esp
cld
loope 0x140177734
cli
invalid
sub ah, byte [rsi + 0x1442]
add byte [rax], al
add ebx, dword [rcx + 0x64]
push rcx
adc al, 0
add byte [rax], al
add byte [rbx], al
pop rcx
push rcx
int1
loope 0x14017771e
invalid
clc
clc
not ebx
movsb byte [rdi], byte [rsi]
sub ch, byte [rdx + 0x6a4152bd]
out dx, al
push 0xffffffffffffffee
fcomp dword [rax + 0x7c]
mov bh, bh
in eax, dx
jmp 0x14017776e
invalid
xchg ecx, eax
invalid
invalid
sti
in al, 0x76
xchg ebp, eax
adc bh, bh
push 5
adc ah, dh
jmp 0x1401777f4
not dword [rbp - 0x240e75e3]
xchg ebp, eax
jmp 0xd4ad9ef6
push 0xfffffffffffffff6
test eax, 0xb3965633
insb byte [rdi], dx
cdq
mov ebx, 0xa318fd95
sub dl, byte [rbp - 0x764b84da]
push 0x28
invalid
or al, 0x46
pop rdx
outsb dx, byte [rsi]
cld
invalid
and eax, 0x5c51f3c6
mov cl, 0x13
or al, 0x26
ja 0x1401777e2
mov ecx, 0xc31b4ac
test eax, 0xf3caec1c
adc dword [rcx + 0x12f3dcf6], esp
sti
mov bh, 0xe0
jmp 0x1401777dd
sub rsp, 0x28
jmp 0x1404ad3c8
mov ecx, 0x17
jmp 0x1404ad3d2
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404ad3f1
mov ecx, 5
jmp 0x1404ad3ea
int 0x29
jmp 0x1404ad3f1
mov r8d, 1
mov edx, 0xc0000417
movsxd rcx, r8d
movzx ecx, si
lea ecx, [r8 + 1]
jmp 0x1404ad40b
call fcn.1404ad43f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
sbb dx, r10w
setge dl
mov edx, 0xc0000417
cmp dil, spl
test r14, 0x6bb3bf1
add rsp, 0x28
jmp switch.0x1404ad438
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b06c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
clc
test rax, 7
jmp 0x1404b06d2
je 0x1404b06f4
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1404b07c0
test al, 7
jmp 0x1404b06ee
jne 0x1404b06da
movabs r8, 0x7efefefefefefeff
sar r9, cl
bsr r11w, bx
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
sbb r9b, 0x67
stc
mov r9, r8
cmp r9b, r15b
add rax, 8
cmc
lea r9, [r9 + rdx]
cmc
test r8b, 0x3b
not rdx
cmp r8d, 0x267c5602
xor rdx, r9
and rdx, r11
je 0x1404b0710
mov rdx, qword [rax - 8]
cmp r8w, r13w
clc
jmp 0x1404b0750
test dl, dl
jmp 0x1404b0757
je 0x1404b0803
test dh, dh
je 0x1404b07fd
shr rdx, 0x10
cmc
cmp r12, rsp
test dl, dl
je 0x1404b07f2
test dh, dh
je 0x1404b07e7
shr rdx, 0x10
cmp r15d, 0x3631fa
cmc
test dl, dl
jmp 0x1404b0790
je 0x1404b07dc
test dh, dh
jmp 0x1404b079d
je 0x1404b07d6
shr edx, 0x10
test dl, dl
jmp 0x1404b07ad
je 0x1404b07cb
test dh, dh
jmp 0x1404b07ba
jne 0x1404b0710
lea rax, [rax + rcx - 1]
jmp 0x1404b07ca
ret
lea rax, [rax + rcx - 2]
jmp 0x1404b07d5
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
jmp 0x1404b07e6
ret
lea rax, [rax + rcx - 5]
jmp 0x1404b07f1
ret
lea rax, [rax + rcx - 6]
jmp 0x1404b07fc
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
jmp 0x1404b080d
ret
Function at 0x1404bc87b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmp spl, 0x10
mov qword [rsp + 0x10], rbp
cmc
test r15d, 0x5fc37dde
mov qword [rsp + 0x18], rsi
jmp 0x1404bc89f
push rdi
sub rsp, 0x20
and edi, 0xbb10760
shr edi, cl
xor ebp, ebp
mov rdi, rcx
cmp dword [rcx], ebp
jmp 0x1404bc8b8
jle 0x1404bc94e
sub esi, esi
jmp 0x1404bc8c5
call fcn.140499c61
movsxd rcx, dword [rdi + 4]
lea rax, [rax + rsi]
cmp dword [rcx + rax + 4], 0
jmp 0x1404bc8dc
je 0x1404bc90d
call fcn.140499c61
movsxd rcx, dword [rdi + 4]
add rax, rsi
movzx ebx, si
movsxd rbx, dword [rcx + rax + 4]
jmp 0x1404bc8fb
call fcn.140499c61
add rax, rbx
jmp 0x1404bc908
jmp 0x1404bc919
sub eax, eax
cwd
movzx rdx, r8w
movsx dx, cl
lea rcx, [rax + 8]
lea rdx, [0x1400b7f78]
jmp 0x1404bc929
call fcn.140201cec
test eax, eax
jmp 0x1404bc935
je 0x1404bc988
inc ebp
add rsi, 0x14
cmp ebp, dword [rdi]
jmp 0x1404bc948
jl 0x1404bc8c5
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
sbb si, 0x4967
mov rsi, qword [rsp + 0x40]
add rdi, 0x5ca46daf
xor dil, 0x79
add rsp, 0x20
mov edi, 0x42930bc
movzx rdi, r9w
movzx di, r8b
pop rdi
jmp 0x1404bc987
ret
mov al, 1
jmp 0x1404bc98f
jmp 0x1404bc950

Function at 0x1404c1ad3
Capabilities:
Allocate thread local storage

Disassembly:
jmp rax
jmp loc.1404de156
push rbx
stc
adc edx, ebx
mov bl, 0x88
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1400c63c0]
cmovp dx, r14w
mov ecx, 3
movzx r8w, r12b
movsx dx, r13b
lea r8, [0x1400c63b8]
mov dx, 0x486c
movsx edx, r14w
lea rdx, [0x1400cfb70]
jmp 0x1404c1b17
call fcn.1404c2b87
test rax, rax
je 0x1404c1b44
mov rcx, rbx
seta bl
bts bx, r8w
add rsp, 0x20
not rbx
pop rbx
jmp switch.0x1404c1b3d
jmp qword [case.0x1404c1b3d.0]
add rsp, 0x20
not bx
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404c1beb
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sbb bl, 0x28
stc
movsx r9w, r9b
sub rsp, 0x20
cdq
cmovne dx, r8w
mov ebx, ecx
cqo
lea r9, [0x1400c63d0]
mov ecx, 5
xchg r8, r8
movzx edx, r12w
lea r8, [0x1400c63c8]
xchg dh, dh
lea rdx, [0x1400cf758]
call fcn.1404c2b87
mov ecx, ebx
cmp ax, di
test rax, rax
jmp 0x1404c1c39
je 0x1404c1c52
add rsp, 0x20
not bh
pop rbx
jmp 0x1404c1c4b
push qword [0x1400b8d90]
ret
add rsp, 0x20
cmovs rbx, rdx
movzx ebx, r13w
jmp 0x1404c1c63
pop rbx
jmp 0x1404c1c69
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c1c70
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
stc
jmp 0x1404c1c7f
push rdi
xor r9b, 0xe9
sub rsp, 0x20
movsx rbx, bp
mov rbx, rdx
cdq
movzx r9w, bpl
lea r9, [0x1400c63d8]
movzx r8w, r12b
mov edi, ecx
cqo
mov cl, 0x38
movsxd r8, eax
lea rdx, [0x1400cf748]
movzx cx, r14b
jmp 0x1404c1cbb
mov ecx, 6
bswap r8w
lea r8, [0x1400c63d0]
jmp 0x1404c1cd0
call fcn.1404c2b87
mov rdx, rbx
and cl, dl
adc cx, 0x1e57
mov ecx, edi
cmp edi, r10d
stc
test rax, rax
jmp 0x1404c1ced
je 0x1404c1cfe
call qword [case.0x1404c1b3d.0]
jmp 0x1404c1d04
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1404c1d13
ret
Function at 0x1404c1eb2
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
shl bx, 0x6f
sub bx, 0x13b8
mov qword [rsp + 0x10], rbp
sub bp, r10w
rol bpl, 0x6d
mov qword [rsp + 0x18], rsi
bt rbp, r8
inc bpl
push rdi
sub rsp, 0x30
movzx rbx, sp
mov ebx, r9d
movsx si, r13b
mov r9b, 0x9e
mov rdi, r8
movsxd rsi, ecx
sete r9b
mov esi, edx
xchg r8w, r9w
setg dl
lea r9, [0x1400c63e8]
movzx bp, cl
cmovbe r8w, di
cdq
mov rbp, rcx
mov dl, dl
lea r8, [0x1400c63e0]
cmove cx, cx
movsxd rcx, r13d
movzx dx, dh
lea rdx, [0x1400cf190]
movzx cx, spl
movzx rcx, bx
mov ecx, r13d
mov ecx, 0xb
jmp 0x1404c1f45
call fcn.1404c2b87
mov rcx, rbp
cmp si, si
jmp 0x1404c1f55
test rax, rax
je 0x1404c1f7f
mov r9d, ebx
mov r8, rdi
movsx rdx, ax
movzx dx, r12b
mov edx, esi
jmp 0x1404c1f74
call qword [case.0x1404c1b3d.0]
jmp 0x1404c1faf
xor edx, edx
call fcn.1404c2629
mov ecx, eax
cdq
mov r9d, ebx
mov r8w, 0x2f28
movsx edx, cx
movzx edx, r13w
mov r8, rdi
not dh
movzx dx, r11b
mov edx, esi
jmp 0x1404c1fa9
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
bsf di, r15w
mov rbp, qword [rsp + 0x48]
test dh, 0x8e
mov rsi, qword [rsp + 0x50]
shl dil, 0xab
btr di, 0xc7
add rsp, 0x30
pop rdi
jmp 0x1404c1fd9
ret
Function at 0x1404cc7dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
test edi, eax
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
rcl rsi, cl
neg si
mov qword [rax + 0x20], rdi
shrd di, di, 0x80
setl dil
shld ax, r10w, 0x1e
push r12
cwde
shrd r12w, r10w, 0x34
movsx rdi, cx
push r14
push r15
btc eax, r9d
cmp ax, r9w
ror dil, cl
sub rsp, 0x20
ror ah, cl
sub ebx, ebx
test r13, 0x39bc233a
ror sil, cl
mov r15, r8
clc
dec ah
mov edi, edx
btc rax, r13
mov r12, rcx
mov eax, 1
stc
shld si, r8w, 0x96
xor sil, r11b
mov esi, ebx
test edx, edx
jmp 0x1404cc85b
js 0x1404cc908
test eax, eax
jmp 0x1404cc868
je 0x1404cc90a
mov rcx, qword [r15]
movzx rax, bp
btr rbp, r15
and bp, 0x7f09
lea eax, [rsi + rdi]
cdq
sal r14d, cl
movsx ebp, r13w
rcl bp, cl
sub eax, edx
movzx bp, r14b
btr r14, 0xc6
sar eax, 1
bt bp, r14w
movsxd rbp, eax
bt dx, r10w
add edx, 0x3ba12598
xchg r14b, r14b
mov r14, rbp
dec dx
shl r14, 4
mov rdx, qword [r14 + r12]
call fcn.1404c141f
test eax, eax
jmp 0x1404cc8ca
jne 0x1404cc8e5
lea rcx, [r12 + 8]
add rcx, r14
mov qword [r15], rcx
jmp 0x1404cc8e0
jmp 0x1404cc8fb
jns 0x1404cc8f8
lea edi, [rbp - 1]
jmp 0x1404cc8f3
jmp 0x1404cc8fb
lea esi, [rbp + 1]
cmp esi, edi
jmp 0x1404cc902
jle 0x1404cc861
test eax, eax
mov rbp, qword [rsp + 0x48]
movzx r15, sp
sete bl
bts eax, r8d
not di
ror r14d, cl
mov rsi, qword [rsp + 0x50]
ror di, 0x51
btr r12, 0x8b
mov eax, ebx
adc dil, bl
neg bx
btr ebx, 0x4a
mov rbx, qword [rsp + 0x40]
btc r12, rsp
mov r14, 0x33566e09
bt edi, 0xce
mov rdi, qword [rsp + 0x58]
rcl r14b, cl
shrd r12w, r9w, 0x8a
add rsp, 0x20
not r15b
pop r15
movsx r12d, cx
pop r14
mov r12w, r14w
movzx r12w, r13b
pop r12
jmp 0x1404cc97b
ret
Function at 0x1404ce913
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
shr bx, 0x9c
mov qword [rsp + 0x18], rsi
mov rbx, r10
shl bl, cl
movsx ebx, r10w
push rdi
clc
movsx edi, r13w
sub rsp, 0x20
or dil, r10b
movsxd rdi, esp
sub esi, esi
test bpl, r10b
sub bl, sil
mov rdi, rdx
mov rbx, rcx
test r15b, bpl
test rcx, rcx
jmp 0x1404ce953
je 0x1404ce9fa
cmp word [rcx], si
jmp 0x1404ce961
je 0x1404ce9fa
lea rdx, [0x1400d1d08]
jmp 0x1404ce973
call fcn.1401eac7c
test eax, eax
jmp 0x1404ce97f
je 0x1404ce9fa
lea rdx, [0x1400d1d00]
movzx cx, bh
mov cl, r10b
mov rcx, rbx
jmp 0x1404ce99b
call fcn.1401eac7c
test eax, eax
jmp 0x1404ce9a7
jne 0x1404ce9e8
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
movsx r8d, r9w
lea r8, [rsp + 0x30]
movsx dx, r13b
mov edx, 0x2000000b
jmp 0x1404ce9cc
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404ce9d9
je 0x1404cea32
mov eax, dword [rsp + 0x30]
jmp 0x1404cea4b
mov rcx, rbx
jmp 0x1404ce9f0
call fcn.1404d787b
jmp 0x1404cea4b
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
cwd
cmovno edx, r13d
sete dh
mov r9d, 2
movzx dx, r10b
movzx rdx, ax
mov edx, 0x20001004
jmp 0x1404cea24
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404cea39
sub eax, eax
jmp 0x1404cea4b
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1404cea4b
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
shrd si, r13w, 0xe8
bts si, r9w
mov rsi, qword [rsp + 0x40]
jmp 0x1404cea6d
add rsp, 0x20
movzx rdi, di
movsx rdi, dx
pop rdi
jmp 0x1404cea7f
ret

Function at 0x1404cea80
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
rol esi, cl
test r14b, 0xac
push rdi
movsx bx, dil
sub rsp, 0x20
movzx esi, ax
mov bl, r11b
movsx si, al
mov esi, edx
movzx ebx, dx
movsxd rbx, r11d
mov bl, cl
mov ebx, ecx
call fcn.1404c095d
mov ecx, ebx
ror dx, 0xbb
lea r8, [rsp + 0x30]
shrd dx, ax, 1
and ecx, 0x3ff
mov r9d, 2
cmovnp di, r13w
bts ecx, 0xa
cqo
mov edx, 0x20000001
setp dil
movsx rdi, si
mov rdi, rax
jmp 0x1404ceaf1
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
stc
cmp spl, 0x39
test eax, eax
jmp 0x1404ceb06
je 0x1404cebce
cmp ebx, dword [rsp + 0x30]
jmp 0x1404ceb15
je 0x1404cebc4
test esi, esi
jmp 0x1404ceb22
je 0x1404cebc4
mov r9, qword [rdi + 0x98]
clc
mov r8d, r10d
sub ecx, r9d
sal ch, 0xd7
movzx edx, word [r9]
and ch, 0x95
lea rcx, [r9 + 2]
bt rax, rbx
btr eax, r13d
btc eax, r12d
lea eax, [rdx - 0x41]
test ebp, 0x1cc57abb
cmc
cmp ax, 0x19
jmp 0x1404ceb63
jbe 0x1404ceb81
sub dx, 0x61
cmp di, 0xd69
cmp dx, 0x19
jmp 0x1404ceb7b
ja 0x1404ceb9f
movzx edx, word [rcx]
jmp 0x1404ceb89
inc r8d
cmp r12b, 0x96
cmc
add rcx, 2
jmp 0x1404ceb9a
jmp 0x1404ceb50
or rcx, 0xffffffffffffffff
jmp 0x1404ceba8
inc rcx
cmp word [r9 + rcx*2], r10w
jne 0x1404ceba8
cmp r8d, ecx
jmp 0x1404cebbe
je 0x1404cebce
mov eax, 1
jmp 0x1404cebda
sub eax, eax
btc si, 0x52
bts bx, r11w
mov rbx, qword [rsp + 0x38]
dec edi
ror si, 0xb2
mov rsi, qword [rsp + 0x40]
sal dil, 0x37
add rsp, 0x20
pop rdi
jmp 0x1404cebf8
ret
Function at 0x1404d01d7
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test al, 0xd2
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
cmp edi, 0x51501c0b
jmp 0x1404d01f1
mov qword [rax + 0x18], rsi
test bpl, spl
stc
mov qword [rax + 0x20], rdi
jmp 0x1404d0203
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
adc ebx, 0x713d4697
mov rbx, rax
jmp 0x1404d0221
test rax, rax
jmp 0x1404d0229
je 0x1404d03a0
mov rsi, rax
cmc
jmp 0x1404d023b
cmp word [rax], r14w
jmp 0x1404d0244
je 0x1404d0288
or rax, 0xffffffffffffffff
jmp 0x1404d0253
inc rax
cmp word [rsi + rax*2], r14w
jmp 0x1404d0260
jne 0x1404d0253
lea rsi, [rsi + rax*2]
cmc
test r14, 0x4fb8763e
add rsi, 2
test r9, r11
cmp word [rsi], r14w
jmp 0x1404d0282
jne 0x1404d024a
mov qword [rsp + 0x38], r14
test r11, 0x4a5c53bd
sub rsi, rbx
mov qword [rsp + 0x30], r14
bsf r8d, esi
add rsi, 2
btc r9w, 0xb0
sar rsi, 1
test r11b, r11b
sub r8d, 0x444b45cf
rol r9b, cl
mov r8, rbx
bswap r9w
cmovs r9w, r15w
add r9, 0x2c013cff
mov r9d, esi
cmp r8d, 0x31384a45
test r8w, 0xd44
mov dword [rsp + 0x28], r14d
clc
cmc
cmp r13b, dil
xor edx, edx
mov qword [rsp + 0x20], r14
cmp r14b, r14b
xor ecx, ecx
call fcn.1404c0740
movsxd rbp, eax
test eax, eax
jmp 0x1404d0302
je 0x1404d03a0
mov rcx, rbp
jmp 0x1404d0310
call fcn.1404c067c
mov rdi, rax
test bp, sp
test rax, rax
je 0x1404d0386
mov qword [rsp + 0x38], r14
stc
test dx, di
jmp 0x1404d0332
mov r9d, esi
dec r8b
xchg r8w, r8w
rcr r8d, cl
mov qword [rsp + 0x30], r14
mov r8, rbx
stc
mov dword [rsp + 0x28], ebp
clc
cmc
xor edx, edx
test rbp, rdi
xor ecx, ecx
jmp 0x1404d035a
mov qword [rsp + 0x20], rax
jmp 0x1404d0364
call fcn.1404c0740
test eax, eax
jmp 0x1404d0370
je 0x1404d0386
mov rsi, rdi
mov rdi, r14
jmp 0x1404d0381
jmp 0x1404d038e
mov rsi, r14
movsx cx, r11b
mov rcx, rdi
jmp 0x1404d0396
call fcn.1404c061b
jmp 0x1404d03a4
mov rsi, r14
clc
test rbx, rbx
jmp 0x1404d03ac
je 0x1404d03c0
mov rcx, rbx
jmp 0x1404d03ba
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
cmp bl, 0x4b
mov rax, rsi
xchg edi, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
neg r14b
add rsp, 0x40
movsx r14w, bl
pop r14
jmp 0x1404d03ef
ret
Function at 0x1404d03f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
stc
cmp r8b, spl
clc
mov qword [rsp + 0x18], rsi
push rdi
cmc
sub rsp, 0x20
jmp 0x1404d040f
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
sal bh, 0x13
dec ebx
mov rbx, rax
test rax, rax
je 0x1404d04f5
mov rbp, rax
test rcx, 0x20a0b32
cmp word [rax], si
jmp 0x1404d043a
je 0x1404d047a
or rax, 0xffffffffffffffff
jmp 0x1404d0449
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404d0456
jne 0x1404d0449
lea rbp, [rbp + rax*2]
test cx, cx
add rbp, 2
test r11d, esi
cmp word [rbp], si
jmp 0x1404d0474
jne 0x1404d0440
sub rbp, rbx
shld cx, r10w, 0x6f
shl cx, 0xd6
add rbp, 2
adc cx, di
bt cx, 0x49
sar rbp, 1
add rbp, rbp
movsx rcx, bx
mov cl, r12b
bswap ecx
mov rcx, rbp
jmp 0x1404d04aa
call fcn.1404c067c
mov rdi, rax
jmp 0x1404d04b8
test rax, rax
je 0x1404d04e0
mov r8, rbp
mov ecx, 0x5640f99
mov rdx, rbx
mov rcx, rax
jmp 0x1404d04d4
call fcn.14049a9c2
mov rsi, rdi
test r12, rax
cmc
xor ecx, ecx
jmp 0x1404d04e7
call fcn.1404c061b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
ror rax, cl
sub eax, r15d
adc rdi, rdx
mov rax, rsi
mov bpl, 0x21
neg di
mov rsi, qword [rsp + 0x40]
shld rbp, rcx, 0xa3
or bpl, 0xc9
mov rbp, qword [rsp + 0x38]
shr dil, cl
shr dil, 0x47
add rsp, 0x20
xchg dil, dil
movsx di, r13b
mov edi, r11d
pop rdi
jmp 0x1404d053b
ret
Function at 0x1404d332d
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cbw
nop
movzx eax, di
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
movzx rax, r13w
cwde
not al
mov eax, 0x1450
jmp 0x1404d335a
call fcn.14043f7af
sub rsp, rax
cmc
mov rax, qword [0x1400b7288]
sal bpl, 0xd1
xor rax, rsp
movzx r14d, cx
inc bpl
sal r14b, 0xc7
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
not rcx
mov rax, r10
sub cx, bp
mov ebp, r9d
sar rax, 6
xadd sil, dl
movsx rdx, r9w
lea rcx, [0x1400ba940]
shl si, cl
stc
movsx r14, r13w
and r10d, 0x3f
sar r14w, 0x57
bswap r14w
lea rbp, [rbp + r8]
shrd dx, r13w, 0x38
mov rsi, r8
cmovo dx, r8w
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
rol r14, 0xf0
shr r14w, cl
btr r14, rdi
mov r14, qword [rax + rdx*8 + 0x28]
cmp rsp, rbp
cmp esi, 0x200d4f60
clc
sub eax, eax
mov qword [rdi], rax
clc
mov dword [rdi + 8], eax
cmc
cmp r8, rbp
jae 0x1404d350d
lea rbx, [rsp + 0x40]
cmc
clc
jmp 0x1404d3413
cmp rsi, rbp
jmp 0x1404d341b
jae 0x1404d3481
mov al, byte [rsi]
jmp 0x1404d3428
inc rsi
cmp al, 0xa
jmp 0x1404d3432
jne 0x1404d3450
inc dword [rdi + 8]
jmp 0x1404d3440
mov byte [rbx], 0xd
jmp 0x1404d3448
inc rbx
jmp 0x1404d3450
mov byte [rbx], al
movzx ax, al
movsx ax, r14b
inc rbx
jmp 0x1404d346a
lea rax, [rsp + 0x143f]
stc
cmp rbx, rax
jmp 0x1404d347b
jb 0x1404d3413
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
rcr cl, cl
sub ebx, eax
cwd
lea r9, [rsp + 0x30]
xchg r8w, cx
movsxd r8, r13d
not ch
mov r8d, ebx
mov dl, r9b
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404d34b3
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d34c0
je 0x1404d34fe
mov eax, dword [rsp + 0x30]
test si, r15w
add dword [rdi + 4], eax
clc
cmp rbp, 0x12d70abc
jmp 0x1404d34de
cmp eax, ebx
jmp 0x1404d34e5
jb 0x1404d350d
cmp rsi, rbp
jmp 0x1404d34f3
jb 0x1404d3407
jmp 0x1404d350d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
cbw
sbb cx, 0x6b9
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
test r14b, 0x5d
cmc
xor rcx, rsp
jmp 0x1404d3525
call fcn.140496cc6
lea r11, [rsp + 0x1450]
setbe bh
movzx bx, r8b
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
mov r14w, r12w
not r14b
mov r14w, 0x42cf
pop r14
setl sil
movsxd rdi, r13d
pop rdi
jmp 0x1404d3560
pop rsi
jmp 0x1404d3566
ret
Function at 0x1404d3567
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx ax, bpl
movsxd rax, edx
mov qword [rsp + 0x18], rbp
push rsi
nop
mov ax, cx
movsx ax, cl
push rdi
nop
cdqe
push r14
movsxd rax, r14d
mov eax, 0x1450
jmp 0x1404d3597
call fcn.14043f7af
sub rsp, rax
mov rax, qword [0x1400b7288]
rol sil, cl
bswap r14w
xor rax, rsp
mov qword [rsp + 0x1440], rax
rcl rsi, cl
sbb r10b, 0xdd
not r14d
movsxd r10, edx
cdq
mov rdi, rcx
mov rax, r10
mov ebp, r9d
movsx r14w, dl
sar rax, 6
sbb sil, 0x52
lea rcx, [0x1400ba940]
bts si, ax
and r10d, 0x3f
lea rbp, [rbp + r8]
mov rsi, r8
cmovl rdx, rsp
test r13w, 0x4641
mov rax, qword [rcx + rax*8]
and dx, ax
xchg dh, dh
bt r14w, 0xfe
lea rdx, [r10 + r10*8]
movzx r14d, sp
movsxd r14, eax
bt r14w, r14w
mov r14, qword [rax + rdx*8 + 0x28]
stc
test sp, r15w
sub eax, eax
test r10w, 0xebf
stc
mov qword [rdi], rax
test r12w, di
cmp r14b, cl
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1404d3776
lea rbx, [rsp + 0x40]
cmc
stc
test di, r11w
cmp rsi, rbp
jmp 0x1404d3658
jae 0x1404d36ba
movzx eax, word [rsi]
stc
test r14b, 0xb1
add rsi, 2
cmp ax, 0xa
jne 0x1404d3691
add dword [rdi + 8], 2
inc ecx
mov ecx, 0xd
cmp bpl, sil
mov word [rbx], cx
jmp 0x1404d368c
add rbx, 2
clc
mov word [rbx], ax
movzx rax, dx
xadd ax, ax
bsr ax, r11w
add rbx, 2
lahf
and ax, si
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x1404d3650
and qword [rsp + 0x20], 0
cwd
shl rcx, cl
sbb ax, r10w
lea rax, [rsp + 0x40]
ror r9, 0x8d
sub rbx, rax
cmove r8w, dx
shrd edx, r12d, 0x69
bts dx, sp
lea r9, [rsp + 0x30]
bts edx, r8d
movzx r8d, bp
sar rbx, 1
movzx rdx, r10w
lea rdx, [rsp + 0x40]
test dil, r11b
bt cx, 0x71
rcr ch, 0x79
add ebx, ebx
movsx r8, cx
mov cl, 0x5e
mov rcx, r14
cmovbe r8, rdi
mov r8b, r10b
movsx r8w, r10b
mov r8d, ebx
jmp 0x1404d3726
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d3733
je 0x1404d376e
mov eax, dword [rsp + 0x30]
jmp 0x1404d374a
add dword [rdi + 4], eax
cmc
cmp eax, ebx
jmp 0x1404d3755
jb 0x1404d3776
cmp rsi, rbp
jmp 0x1404d3763
jb 0x1404d3645
jmp 0x1404d3776
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
test r12w, r15w
xor rcx, rsp
jmp 0x1404d378d
call fcn.140496cc6
lea r11, [rsp + 0x1450]
mov sil, 0xf7
mov rbx, qword [r11 + 0x20]
setle bpl
bswap di
movzx si, spl
mov rbp, qword [r11 + 0x30]
not sil
mov rsp, r11
pop r14
pop rdi
movsx si, r15b
pop rsi
jmp 0x1404d37c5
ret