joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404b154a
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmp r11d, 0x4d33027d
mov qword [rsp + 0x10], rsi
movsx si, r12b
sub esi, 0x3ecf5d06
xor sil, 0x4c
push rdi
bt rdi, 0x54
sub rsp, 0x30
btr si, si
xchg esi, esi
btc esi, r12d
mov edi, edx
mov rsi, rcx
test r11b, al
cmp r8w, di
test r8, r8
jne 0x1404b15b4
call fcn.1404b5eee
mov dword [rax], 0x16
jmp 0x1404b15a3
call fcn.1404b6b68
xor eax, eax
jmp 0x1404b15af
jmp 0x1404b168f
mov rdx, r9
movsx ecx, r9w
mov rcx, r8
jmp 0x1404b15c3
call fcn.1404b16f9
mov rbx, rax
test rax, rax
je 0x1404b163a
lea rax, [rsp + 0x50]
setle cl
mov rdx, rdi
movsx ecx, sp
setns r9b
mov qword [rsp + 0x28], rax
jmp 0x1404b15f0
lea r8, [0x140094b24]
setb ah
movsxd r9, r14d
mov eax, dword [rsp + 0x60]
bswap rcx
mov r9, rbx
xchg cx, cx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b1622
jne 0x1404b16ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b1635
call fcn.1404b5f64
sub edi, edi
cmc
clc
test rbx, rbx
je 0x1404b1688
mov rcx, qword [rbx + 0x10]
cmc
jmp 0x1404b1651
test rcx, rcx
jmp 0x1404b1659
je 0x1404b1665
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmp r14b, al
test rcx, rcx
je 0x1404b167b
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b1683
call fcn.1404c9bb8
mov rax, rdi
movzx rsi, r8w
mov rbx, qword [rsp + 0x40]
btc rsi, 0xeb
xor dil, 0xff
bt si, r14w
mov rsi, qword [rsp + 0x48]
movzx edi, r11w
movsx rdi, r12w
add rsp, 0x30
pop rdi
jmp 0x1404b16b9
ret
mov rcx, qword [rsp + 0x68]
test r8w, 0x5c41
test rcx, rcx
jmp 0x1404b16cd
je 0x1404b16d9
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
xor ebx, ebx
jmp 0x1404b16e0
jmp 0x1404b163e

Function at 0x1404b199e
Capabilities:
Terminate process

Disassembly:
push rbx
movzx ebx, r10w
sar bx, cl
sub rsp, 0x20
movzx ebx, r14w
xchg bx, bx
movsxd rbx, r15d
mov ebx, ecx
call fcn.1404d3017
cmp eax, 1
jmp 0x1404b19c4
je 0x1404b1a07
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
shr edx, 8
test bl, 0x85
cmc
cmp r11b, al
test dl, 1
jmp 0x1404b19eb
jne 0x1404b1a07
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1404b1a01
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b1a0e
call fcn.1404b18f4
mov ecx, ebx
jmp 0x1404b1a1a
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b6009
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
test r15b, 0xa3
stc
test dl, bpl
sub rsp, 0x20
call fcn.1404cf447
mov rax, qword [0x1400bad68]
jmp 0x1404b6031
lea rbx, [0x1400ba2d8]
test rax, rax
jmp 0x1404b6040
cmovne rbx, rax
inc ah
movzx rax, ax
xor dil, dil
xor ax, 0x60c3
bt ax, 0x4d
mov rax, 0x43bc535a
movzx eax, byte [rbx]
cmp al, 0x20
ja 0x1404b6083
test al, al
jmp 0x1404b606f
je 0x1404b60e5
test dil, dil
jmp 0x1404b607d
je 0x1404b60c4
cmp al, 0x22
jne 0x1404b60a0
test dil, dil
sete dil
movzx rcx, r15w
movsx cx, r8b
movzx cx, r13b
mov ecx, eax
jmp 0x1404b60a7
call fcn.140235571
test eax, eax
je 0x1404b60b7
inc rbx
inc rbx
jmp 0x1404b60bf
jmp 0x1404b605d
cmp al, 0x20
ja 0x1404b60e5
inc rbx
dec al
mov al, byte [rbx]
stc
cmp bpl, 0x6e
test al, al
jmp 0x1404b60df
jne 0x1404b60c4
mov rax, rbx
mov rbx, qword [rsp + 0x30]
cmc
or dil, r15b
add rsp, 0x20
pop rdi
jmp 0x1404b60fb
ret

Function at 0x1404b6bea
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
bswap ecx
mov ch, 0x94
movzx cx, r9b
mov ecx, 0x17
jmp 0x1404b6c02
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404b6c21
mov ecx, 5
jmp 0x1404b6c1a
int 0x29
jmp 0x1404b6c21
mov r8d, 1
setno dl
bswap dx
cwd
mov edx, 0xc0000417
movsx rcx, di
movsxd rcx, r15d
lea ecx, [r8 + 1]
jmp 0x1404b6c44
call fcn.1404b6c66
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
ror dh, 0x91
mov edx, 0xc0000417
clc
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404c31e2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404c31ef
push rdi
rol r11b, cl
or r11, 0xac4113f
sub rsp, 0x20
rol r11d, 0x7a
and rbx, r11
xor r10d, r10d
adc r11b, spl
sub bl, r13b
mov rbx, r8
movzx r11d, di
rol r11b, cl
mov r11, rdx
jmp 0x1404c3220
test r9, r9
jne 0x1404c3297
test rcx, rcx
jmp 0x1404c3231
jne 0x1404c32a5
test rdx, rdx
jmp 0x1404c323f
je 0x1404c3268
call fcn.1404b5eee
mov ebx, 0x16
mov dword [rax], ebx
jmp 0x1404c3256
call fcn.1404b6b68
mov r10d, ebx
setle dil
rcr edi, 0xc2
cmp rsp, r12
mov rbx, qword [rsp + 0x30]
btc di, 9
xor di, bp
sar eax, cl
mov eax, r10d
sbb di, r13w
and di, 0x7b8d
add rsp, 0x20
not dil
xchg dil, dil
movsx edi, di
pop rdi
jmp 0x1404c3296
ret
test rcx, rcx
jmp 0x1404c329f
je 0x1404c3245
test r11, r11
jmp 0x1404c32ad
je 0x1404c3245
test r9, r9
jmp 0x1404c32bb
jne 0x1404c32cf
mov word [rcx], r10w
jmp 0x1404c32ca
jmp 0x1404c3268
test rbx, rbx
jne 0x1404c32e6
mov word [rcx], r10w
jmp 0x1404c32e1
jmp 0x1404c3245
sub rbx, rcx
dec dil
rcl di, 0xe2
movsxd rdx, eax
mov rdx, rcx
mov r8, r11
mov rdi, r9
cmp r9, 0xffffffffffffffff
jmp 0x1404c3305
jne 0x1404c3345
movzx eax, word [rbx + rdx]
test spl, 0xde
mov word [rdx], ax
lea rdx, [rdx + 2]
jmp 0x1404c3323
test ax, ax
jmp 0x1404c332b
je 0x1404c33a5
sub r8, 1
jmp 0x1404c333a
jne 0x1404c330b
jmp 0x1404c33a5
movzx eax, word [rbx + rdx]
cmp r11d, 0x778c73d9
cmc
mov word [rdx], ax
test rcx, 0xf05379f
cmp r13, 0x29ee5550
test esi, eax
lea rdx, [rdx + 2]
jmp 0x1404c3370
test ax, ax
je 0x1404c3392
sub r8, 1
jmp 0x1404c3382
je 0x1404c3392
sub rdi, 1
jne 0x1404c3345
test rdi, rdi
jmp 0x1404c339a
jne 0x1404c33a5
mov word [rdx], r10w
stc
test r8, r8
jmp 0x1404c33ad
jne 0x1404c3268
cmp r9, 0xffffffffffffffff
jmp 0x1404c33bc
jne 0x1404c33dc
mov word [rcx + r11*2 - 2], r10w
bswap r10
movsx r10, r14w
movzx r10d, r12w
lea r10d, [r8 + 0x50]
jmp 0x1404c3268
mov word [rcx], r10w
jmp 0x1404c33e5
call fcn.1404b5eee
mov ebx, 0x22
jmp 0x1404c324f
Function at 0x1404c4532
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], r9
btc rax, rcx
cdqe
mov dword [rsp + 0x10], edx
bsf ebx, r13d
shr rax, 0xdb
cmp dil, sil
push rbp
shr ax, 0xfc
push rsi
cdqe
push rdi
cmp r10b, dil
movzx rbx, r11w
push r12
movsx esi, sp
push r13
push r14
or eax, r8d
btc ebx, 0xba
push r15
bts rax, r10
rcl r15b, cl
shr r15b, cl
sub rsp, 0x20
dec r15d
xchg r15w, bx
sal r13, 0xd
mov rax, qword [rcx + 8]
btr bx, bp
sub bpl, bpl
rcr r12d, 0xbd
sub r14b, r14b
mov qword [r11 + 8], rax
bsr r12w, r9w
dec r13w
sub edi, edi
movsx r12, r13w
mov r12, r9
mov r13d, r8d
mov rbx, rcx
sub r15b, r8b
rcl r15w, cl
lea rsi, [rax - 1]
jmp 0x1404c45d0
mov r15, rsi
cmp dword [rcx], edi
jmp 0x1404c45da
jle 0x1404c4668
mov r12d, dword [r11 + 0x10]
cmp edi, r12d
jmp 0x1404c45ec
jne 0x1404c45fc
mov rsi, rax
xor bpl, 0x21
mov bpl, 1
cmp edi, r13d
jmp 0x1404c4604
jne 0x1404c4614
mov r15, rax
stc
mov r14b, 1
test r12d, eax
test bpl, bpl
jmp 0x1404c461c
je 0x1404c462b
test r14b, r14b
jne 0x1404c4663
lea rdx, [rsp + 0x60]
movzx ecx, bx
movzx rcx, bp
mov rcx, rbx
jmp 0x1404c463f
call fcn.14011bcb9
inc edi
stc
test r13b, r10b
cmp ebp, ebp
cmp edi, dword [rbx]
jge 0x1404c4663
mov rax, qword [rsp + 0x60]
jmp 0x1404c465e
jmp 0x1404c45e4
mov r12, qword [rsp + 0x78]
mov rax, qword [r12]
neg r14d
or cl, 0x89
xadd r14d, ecx
mov qword [r12 + 8], rsi
btr si, di
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
sub cx, si
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
rcr sil, cl
movzx bp, cl
mov qword [rax + 8], r15
movsx r14, r12w
btc r12d, esp
movups xmm0, xmmword [rbx]
cmp r12d, 0x3e7308d0
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
shrd bx, r12w, 0xa4
cmp r9b, r9b
setge r13b
mov rbx, qword [rsp + 0x70]
movups xmmword [rcx + 0x10], xmm1
add rsp, 0x20
movzx r14d, ax
not r14d
bswap r14w
pop r15
jmp 0x1404c46ef
pop r14
setb dil
mov bp, 0x341e
pop r13
movzx rsi, r9w
setge dil
pop r12
movzx di, r12b
movzx ebp, r15w
pop rdi
setns bpl
not bpl
pop rsi
not bpl
movzx rbp, si
xchg bpl, bpl
pop rbp
jmp 0x1404c4727
ret

Function at 0x1404cb190
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
setnp r8b
push rdi
bt edi, r13d
jmp 0x1404cb1a7
sub rsp, 0x20
movsx r9, dx
mov rbx, rdx
bswap r8w
setb dil
lea r9, [0x1400c63d8]
movsxd rdi, r13d
movsx di, r11b
movzx di, r11b
mov edi, ecx
movzx r8d, bx
lea rdx, [0x1400cf748]
mov r8w, bp
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404cb1f0
call fcn.1404cbfce
mov rdx, rbx
bts rcx, rdx
mov ecx, edi
jmp 0x1404cb209
test rax, rax
jmp 0x1404cb211
je 0x1404cb222
call qword [0x1400b8d90]
jmp 0x1404cb228
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add dil, spl
shr edi, 0x6b
add rsp, 0x20
pop rdi
jmp 0x1404cb23d
ret
Function at 0x1404cb397
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
inc rbx
rcl bl, cl
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
test r8b, bpl
rcr ebp, cl
bswap bx
push rdi
sub rsp, 0x30
movzx rbx, sp
mov bx, 0x1bdb
mov ebx, r9d
movsxd rsi, esi
mov rdi, r8
jmp 0x1404cb3d4
mov esi, edx
lea r9, [0x1400c63e8]
movsx bp, al
mov rbp, rcx
lea r8, [0x1400c63e0]
movsxd rdx, r10d
bswap rcx
cmove cx, r13w
lea rdx, [0x1400cf190]
cmovnp cx, si
mov ecx, 0xb
jmp 0x1404cb40b
call fcn.1404cbfce
mov rcx, rbp
test rax, rax
jmp 0x1404cb41b
je 0x1404cb43b
mov r9d, ebx
mov r8, rdi
xchg dl, dh
mov edx, esi
jmp 0x1404cb430
call qword [0x1400b8d90]
jmp 0x1404cb475
xor edx, edx
jmp 0x1404cb442
call fcn.1404cbac9
mov ecx, eax
xchg r8b, dl
movsx r9w, bl
jmp 0x1404cb456
mov r9d, ebx
bswap dx
cqo
setno r8b
mov r8, rdi
setl dl
mov edx, esi
jmp 0x1404cb46f
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
sal bpl, cl
btc esi, 0x4c
mov rbp, qword [rsp + 0x48]
dec sil
sbb sil, sil
cmp r9w, dx
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
movsx rdi, r11w
movsxd rdi, r14d
cmove edi, ebx
pop rdi
jmp 0x1404cb4a9
ret
Function at 0x1404d2d18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
btc ax, r8w
mov qword [r11 + 8], rbx
neg rax
mov qword [r11 + 0x10], rbp
btr bp, 0x75
xor ax, 0x58c6
mov qword [r11 + 0x18], rdi
and di, 0x56b8
or ah, 0xeb
sbb al, ch
push r14
adc al, r13b
movsx bp, bpl
add rdi, 0x119d64e5
sub rsp, 0x50
mov rax, qword [rsp + 0x80]
not bpl
movzx rdi, r15w
mov rbp, r8
movsx edi, r12w
bswap edi
movzx rdi, r9w
mov rcx, qword [rcx]
mov r8, 0x13467f0d
jmp 0x1404d2d82
lea r8, [r11 - 0x18]
movsx rdi, di
mov dil, 0x34
bswap rdi
mov rdi, rdx
mov qword [r11 - 0x38], rax
movsxd rdx, r11d
mov edx, dword [rsp + 0x88]
jmp 0x1404d2da6
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x1404d2db3
call fcn.1404e2265
mov r14d, dword [rsp + 0x44]
xor r9b, 0x55
add r9d, ebx
xor r8d, r8d
cmp dword [rsp + 0x40], 0x2d
cqo
not r9w
movzx bx, r13b
mov r9d, eax
jmp 0x1404d2de2
mov eax, dword [rsp + 0xa0]
setnp cl
cdq
mov rdx, rbp
mov ch, 0xbb
sete r8b
mov dword [rsp + 0x28], eax
sub bl, spl
rcl cl, cl
btc rbx, rcx
sub rdx, r8
mov ebx, ebp
jmp 0x1404d2e11
mov dword [rsp + 0x20], r9d
mov cx, 0xf7
movzx bx, r15b
dec r14d
shld ecx, r9d, 0x26
lea r9, [rsp + 0x40]
bswap bx
cmp rbp, 0xffffffffffffffff
lea rbx, [r8 + rdi]
movzx ecx, r11w
setbe cl
movsx r8w, dil
mov r8d, dword [rsp + 0x88]
movsx rcx, bp
jmp 0x1404d2e54
cmove rdx, rbp
mov cx, di
jmp 0x1404d2e60
mov rcx, rbx
jmp 0x1404d2e68
call fcn.1404e1f67
test eax, eax
jmp 0x1404d2e74
je 0x1404d2e87
mov byte [rdi], 0
jmp 0x1404d2e82
jmp 0x1404d2fa1
mov eax, dword [rsp + 0x44]
jmp 0x1404d2e90
dec eax
clc
cmp eax, 0xfffffffc
jl 0x1404d2f1d
cmp eax, dword [rsp + 0x88]
jmp 0x1404d2ea8
jge 0x1404d2f1d
cmp r14d, eax
jmp 0x1404d2eb6
jge 0x1404d2ed8
mov al, byte [rbx]
inc rbx
test r8b, al
stc
cmp r13d, esp
test al, al
jmp 0x1404d2ecf
jne 0x1404d2ebc
mov byte [rbx - 2], al
mov rax, qword [rsp + 0xa8]
lea r9, [rsp + 0x40]
movsx r8d, r13w
mov r8d, dword [rsp + 0x88]
movzx rcx, r15w
movzx dx, ah
mov rdx, rbp
mov qword [rsp + 0x28], rax
mov rcx, rdi
jmp 0x1404d2f09
mov byte [rsp + 0x20], 1
jmp 0x1404d2f13
call fcn.1404d2a16
jmp 0x1404d2fa1
mov rax, qword [rsp + 0xa8]
jmp 0x1404d2f32
mov rdx, rbp
mov r9b, 0x36
bswap rcx
mov r9b, byte [rsp + 0x90]
movsx r8w, spl
movzx r8d, di
mov rcx, rdi
mov r8d, dword [rsp + 0x88]
jmp 0x1404d2f5c
mov qword [rsp + 0x38], rax
nop
jmp 0x1404d2f6c
lea rax, [rsp + 0x40]
mov byte [rsp + 0x30], 1
jmp 0x1404d2f7b
mov qword [rsp + 0x28], rax
movsx eax, cx
movzx rax, bx
mov eax, dword [rsp + 0x98]
jmp 0x1404d2f93
mov dword [rsp + 0x20], eax
jmp 0x1404d2f9c
call fcn.1404d1a27
mov rbx, qword [rsp + 0x60]
dec bpl
or ebp, ebp
mov rbp, qword [rsp + 0x68]
clc
btc di, si
add dil, 0xe2
mov rdi, qword [rsp + 0x70]
btc r14, 0xd9
and r14w, bp
add rsp, 0x50
pop r14
jmp 0x1404d2fd2
ret
Function at 0x1404d7b5a
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
btr ebx, r10d
movsx bx, r13b
push rdi
sal rdi, 0x74
cmp bx, dx
rcl ebx, 0x1e
sub rsp, 0x20
shl bh, 0x2b
bts di, r10w
sub esi, esi
movsxd rbx, edx
mov rdi, rdx
mov rbx, rcx
jmp 0x1404d7b97
test rcx, rcx
jmp 0x1404d7b9f
je 0x1404d7c40
cmp word [rcx], si
jmp 0x1404d7bad
je 0x1404d7c40
lea rdx, [0x1400d1d08]
jmp 0x1404d7bbf
call fcn.140221943
test eax, eax
jmp 0x1404d7bcb
je 0x1404d7c40
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404d7be0
call fcn.140221943
test eax, eax
jmp 0x1404d7bec
jne 0x1404d7c2e
mov ecx, dword [rdi + 8]
mov dh, pe_nt_image_headers64
movzx r8, r12w
lea r9d, [rsi + 2]
movsx edx, bp
cwd
lea r8, [rsp + 0x30]
movzx edx, bp
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404d7c82
mov eax, dword [rsp + 0x30]
jmp 0x1404d7c29
jmp 0x1404d7caa
mov rcx, rbx
jmp 0x1404d7c36
call fcn.1404e0c2c
jmp 0x1404d7caa
mov ecx, dword [rdi + 8]
jmp 0x1404d7c4e
lea r8, [rsp + 0x30]
cwd
movzx rdx, r10w
mov r9d, 2
movsx edx, dx
mov edx, 0x45d47563
movzx edx, si
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d7c7c
jne 0x1404d7c89
sub eax, eax
jmp 0x1404d7caa
mov eax, dword [rsp + 0x30]
cmp cl, 0x8e
test r9w, bp
cmp bpl, dl
test eax, eax
jmp 0x1404d7c9e
jne 0x1404d7caa
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setge dil
shl di, cl
add rsp, 0x20
jmp 0x1404d7cc4
pop rdi
ret

Function at 0x1404d7cc6
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
btr bx, r10w
bts rbx, rsp
mov qword [rsp + 0x18], rsi
shl bl, cl
neg sil
push rdi
sub rsp, 0x20
jmp 0x1404d7cf0
mov esi, edx
movzx rbx, r15w
xchg bx, bx
mov ebx, ecx
jmp 0x1404d7d00
call fcn.1404c9f00
mov ecx, ebx
lea r8, [rsp + 0x30]
bt r9w, 0xcf
xor r9d, 0x63301890
and ecx, 0x3ff
mov r9d, 2
bswap dx
movsx rdx, bp
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
jmp 0x1404d7d3d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
jmp 0x1404d7d4b
test eax, eax
jmp 0x1404d7d52
je 0x1404d7e1a
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d7d61
je 0x1404d7e10
test esi, esi
jmp 0x1404d7d6e
je 0x1404d7e10
mov r9, qword [rdi + 0x98]
btr ecx, edi
rdtsc
sbb dh, bl
mov r8d, r10d
mov ch, 0x6d
movzx edx, word [r9]
and al, cl
lea rcx, [r9 + 2]
bt rax, 0xca
or al, r8b
cdqe
lea eax, [rdx - 0x41]
stc
cmc
cmp r12b, 0xcb
cmp ax, 0x19
jmp 0x1404d7dae
jbe 0x1404d7dc9
sub dx, 0x61
clc
stc
cmp dx, 0x19
jmp 0x1404d7dc3
ja 0x1404d7de2
movzx edx, word [rcx]
jmp 0x1404d7dd1
inc r8d
add rcx, 2
jmp 0x1404d7ddd
jmp 0x1404d7d9c
or rcx, 0xffffffffffffffff
jmp 0x1404d7deb
inc rcx
test r9b, 0x37
cmp word [r9 + rcx*2], r10w
jmp 0x1404d7dfc
jne 0x1404d7deb
cmp r8d, ecx
jmp 0x1404d7e0a
je 0x1404d7e1a
mov eax, 1
jmp 0x1404d7e1c
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov dil, 0x65
mov rsi, qword [rsp + 0x40]
bsf di, cx
btr edi, 0xea
test r8w, 0x35c
add rsp, 0x20
pop rdi
ret
Function at 0x1404d94d8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
stc
cmp r9b, 0xc
mov qword [rax + 8], rbx
test bpl, al
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
clc
stc
mov qword [rax + 0x20], rdi
cmp r15, 0xd7960ca
push r14
clc
sub rsp, 0x40
jmp 0x1404d9508
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
mov rbx, rax
stc
cmp bpl, 0xe4
test rax, rax
jmp 0x1404d9521
je 0x1404d969a
mov rsi, rax
cmp word [rax], r14w
jmp 0x1404d9533
je 0x1404d957c
or rax, 0xffffffffffffffff
jmp 0x1404d9542
inc rax
test edx, r11d
cmp r10d, ecx
cmp word [rsi + rax*2], r14w
jmp 0x1404d9555
jne 0x1404d9542
lea rsi, [rsi + rax*2]
test r10w, 0x6c8f
test r14b, cl
add rsi, 2
jmp 0x1404d9572
cmp word [rsi], r14w
jne 0x1404d9539
mov qword [rsp + 0x38], r14
movsxd r9, r11d
sub rsi, rbx
mov qword [rsp + 0x30], r14
not r9b
mov r8d, r13d
btc r8, r13
add rsi, 2
sar rsi, 1
or r9b, r14b
cmp bl, 0x92
bsr r9w, di
mov r8, rbx
sal r9b, cl
dec r9w
jmp 0x1404d95b7
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
test bp, r10w
xor ecx, ecx
jmp 0x1404d95d1
call fcn.1404c9d04
movsxd rbp, eax
cmp r9, rdi
cmc
test eax, eax
jmp 0x1404d95e4
je 0x1404d969a
mov rcx, rbp
jmp 0x1404d95f2
call fcn.1404c9c2a
mov rdi, rax
cmp edx, esi
test rax, rax
jmp 0x1404d9604
je 0x1404d9683
mov qword [rsp + 0x38], r14
movzx r8w, r13b
or r9w, r8w
sbb r9b, 9
mov r9d, esi
rcl r8b, 0x9e
rcr r8d, cl
movzx r8d, r12w
mov qword [rsp + 0x30], r14
adc r8w, 0x7d58
cmp dl, sil
bt r8, 0x92
mov r8, rbx
cmp ah, al
mov dword [rsp + 0x28], ebp
test edx, 0x11062fad
sub edx, edx
sub ecx, ecx
jmp 0x1404d9655
mov qword [rsp + 0x20], rax
jmp 0x1404d965f
call fcn.1404c9d04
test eax, eax
jmp 0x1404d966b
je 0x1404d9683
mov rsi, rdi
not edi
mov rdi, r14
jmp 0x1404d967e
jmp 0x1404d9688
mov rsi, r14
xchg cl, ch
mov rcx, rdi
jmp 0x1404d9690
call fcn.1404c9bb8
jmp 0x1404d96a2
mov rsi, r14
cmc
cmp r11b, 0x40
test rbx, rbx
jmp 0x1404d96aa
je 0x1404d96be
mov rcx, rbx
jmp 0x1404d96b8
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
cdqe
mov dil, 0x53
btc rdi, 0xb3
mov rax, rsi
rcl dil, cl
movzx ebp, r12w
movsxd rdi, r12d
mov rsi, qword [rsp + 0x60]
sub r14, rdx
shrd di, r13w, 0xce
bsf di, r12w
mov rbp, qword [rsp + 0x58]
xor di, 0x214f
add r14b, cl
clc
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
movsx r14, bp
pop r14
ret
Function at 0x1404d970b
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
cmc
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
jmp 0x1404d9725
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
mov rbx, rax
jmp 0x1404d9735
test rax, rax
jmp 0x1404d973d
je 0x1404d9803
mov rbp, rax
cmp word [rax], si
jmp 0x1404d974e
je 0x1404d9791
or rax, 0xffffffffffffffff
inc rax
cmc
cmp word [rbp + rax*2], si
jmp 0x1404d9766
jne 0x1404d9758
lea rbp, [rbp + rax*2]
cmp ah, 0x6f
stc
test r13b, 0x24
add rbp, 2
test r14, rax
stc
clc
cmp word [rbp], si
jmp 0x1404d978b
jne 0x1404d9754
sub rbp, rbx
add rbp, 2
cmp r8b, 0xb1
inc ch
sar rbp, 1
dec cl
add rbp, rbp
xchg cx, cx
movzx rcx, cx
mov rcx, rbp
call fcn.1404c9c2a
mov rdi, rax
cmp al, r13b
test r13, rsi
cmc
test rax, rax
jmp 0x1404d97c7
je 0x1404d97e9
mov r8, rbp
cdq
movsx dx, r9b
mov rdx, rbx
mov rcx, rax
jmp 0x1404d97e1
call fcn.1404a3fa8
mov rsi, rdi
sub ecx, ecx
jmp 0x1404d97f0
call fcn.1404c9bb8
mov rcx, rbx
jmp 0x1404d97fd
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
cdqe
movsxd rax, eax
mov rax, rsi
mov rsi, qword [rsp + 0x40]
neg bp
sal bp, 0x23
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1404d982b
ret
Function at 0x1404dc732
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
not ax
xchg ah, ah
push rsi
push rdi
movsx ax, ah
jmp 0x1404dc763
push r14
cbw
mov eax, 0x1450
call fcn.140448c6a
sub rsp, rax
neg r10b
seto bpl
mov rax, qword [0x1400b7288]
shld bp, ax, 0xe3
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
add ax, 0x3d2
mov rdi, rcx
bt r14, 0x76
mov rax, r10
shrd esi, r12d, 0xe3
mov ebp, r9d
sar rax, 6
rcl r14d, 0x53
lea rcx, [0x1400ba940]
or rsi, rsi
bsf r14d, ebx
cmp di, r14w
and r10d, 0x3f
xor r14w, 0x7960
xadd rdx, r14
add rbp, r8
sub r14w, 0x5a63
btc si, r13w
mov rsi, r8
mov rax, qword [rcx + rax*8]
add dx, 0x4ac4
neg edx
lea rdx, [r10 + r10*8]
sbb r14w, 0x115c
not r14
neg r14b
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
jmp 0x1404dc80d
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1404dc91b
lea rbx, [rsp + 0x40]
cmp r12w, 0x6b7
stc
jmp 0x1404dc82d
cmp rsi, rbp
jmp 0x1404dc835
jae 0x1404dc894
mov al, byte [rsi]
jmp 0x1404dc842
inc rsi
stc
test si, cx
cmp al, 0xa
jmp 0x1404dc850
jne 0x1404dc869
inc dword [rdi + 8]
jmp 0x1404dc85e
mov byte [rbx], 0xd
jmp 0x1404dc866
inc rbx
mov byte [rbx], al
inc rbx
sar al, 0x6f
bt ax, 0xc1
lea rax, [rsp + 0x143f]
test sil, 0xd6
cmp dl, bpl
cmc
cmp rbx, rax
jmp 0x1404dc88e
jb 0x1404dc82d
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sbb rdx, r12
jmp 0x1404dc8a7
sub ebx, eax
lea r9, [rsp + 0x30]
mov edx, esi
movsx edx, dx
cqo
mov r8d, ebx
lea rdx, [rsp + 0x40]
movsx cx, r12b
mov ch, 0x50
movzx rcx, bp
mov rcx, r14
jmp 0x1404dc8d1
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dc8de
je 0x1404dc90d
mov eax, dword [rsp + 0x30]
test rdx, 0x415f558f
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404dc8f9
jb 0x1404dc91b
cmp rsi, rbp
jb 0x1404dc81c
jmp 0x1404dc91b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
movsxd rax, ebx
or rcx, rax
mov rax, rdi
xadd cx, cx
mov rcx, qword [rsp + 0x1440]
test ebp, ebp
cmp r12b, dil
xor rcx, rsp
jmp 0x1404dc937
call fcn.1404a0330
lea r11, [rsp + 0x1450]
bswap r14
mov rbx, qword [r11 + 0x20]
movsx esi, ax
bswap di
mov rbp, qword [r11 + 0x30]
mov si, bx
mov r14b, 0x88
mov rsp, r11
movsx r14w, sil
pop r14
pop rdi
mov sil, al
cmova rsi, r14
pop rsi
jmp 0x1404dc973
ret
Function at 0x1404dc974
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, r10w
mov qword [rsp + 0x18], rbp
nop
not eax
setnp ah
push rsi
not al
mov ah, 0x6c
push rdi
xchg ah, ah
movsx eax, di
movzx eax, di
push r14
movzx eax, r10w
bswap ax
mov eax, 0x1450
jmp 0x1404dc9ab
call fcn.140448c6a
sub rsp, rax
mov rax, qword [0x1400b7288]
bsr bp, r11w
movsx r14, bp
btr rsi, r11
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
sal r14b, 0xb5
mov rdi, rcx
sal r14w, 0xc1
bts ebp, edx
sar si, cl
mov rax, r10
shr rsi, cl
bt dx, 0xab
mov ebp, r9d
cmp bp, si
test r14w, 0x2c61
sar rax, 6
bt rcx, rdi
lea rcx, [0x1400ba940]
sal dx, 0xf4
sar dx, 0xa4
rcl r14d, 0xd8
and r10d, 0x3f
movzx r14d, r15w
bswap dx
sub edx, 0x17fd6930
add rbp, r8
cmp esi, eax
mov rsi, r8
bt r14w, r10w
adc dl, spl
btr dx, si
mov rax, qword [rcx + rax*8]
cmp r15d, esi
sub dx, sp
bt dx, 0xe0
lea rdx, [r10 + r10*8]
bts r14w, r14w
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
test dil, r13b
mov dword [rdi + 8], eax
clc
test ax, di
cmp r8, rbp
jmp 0x1404dca72
jae 0x1404dcba0
lea rbx, [rsp + 0x40]
test ah, 0xc2
cmp rsi, rbp
jmp 0x1404dca88
jae 0x1404dcafb
movzx eax, word [rsi]
add rsi, 2
jmp 0x1404dca9a
cmp ax, 0xa
jmp 0x1404dcaa3
jne 0x1404dcad2
add dword [rdi + 8], 2
btc ecx, 0x58
rcr cx, cl
mov ecx, 0xd
clc
cmp rsi, 0x6f953e71
mov word [rbx], cx
cmp spl, spl
test spl, r15b
add rbx, 2
cmp r13b, r10b
cmc
mov word [rbx], ax
cmc
bsr eax, ebx
add rbx, 2
rcl ah, 0xd3
cbw
rcr al, 0x8d
lea rax, [rsp + 0x143e]
cmc
clc
test dil, dl
cmp rbx, rax
jb 0x1404dca80
and qword [rsp + 0x20], 0
btr cx, cx
clc
lea rax, [rsp + 0x40]
rcl r9w, cl
sbb r8b, 0x5d
sub rbx, rax
sub dh, 0xd5
lea r9, [rsp + 0x30]
rcl edx, 0xa3
shl r8b, 0x33
sar ch, 0x52
sar rbx, 1
btc cx, 0x23
lea rdx, [rsp + 0x40]
sal cl, cl
btr r8w, bp
add ebx, ebx
movsx r8w, dil
mov rcx, r14
xchg r8b, r8b
movsxd r8, esi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dcb5c
je 0x1404dcb92
mov eax, dword [rsp + 0x30]
test bpl, 0x9f
add dword [rdi + 4], eax
test r14d, 0x3cc24989
test r9b, r8b
cmp eax, ebx
jb 0x1404dcba0
cmp rsi, rbp
jmp 0x1404dcb87
jb 0x1404dca78
jmp 0x1404dcba0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
inc rax
ror al, 0xdf
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
test cl, 0x5a
xor rcx, rsp
jmp 0x1404dcbb6
call fcn.1404a0330
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movzx rbp, cx
mov rbp, qword [r11 + 0x30]
movzx r14d, bp
movsxd rdi, esi
movsx rsi, r9w
mov rsp, r11
pop r14
xchg esi, esi
pop rdi
movsx rsi, bx
pop rsi
jmp 0x1404dcbec
ret