joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14049c209
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
jmp 0x14049c212
and dword [rsp + 0x30], 0
jmp 0x14049c21c
call fcn.1404a6500
mov r9d, 2
setbe r8b
bswap r8d
movsx r8, r15w
lea r8, [rsp + 0x30]
movsx ecx, r15w
movsx cx, dil
jmp 0x14049c245
mov rcx, qword [rax + 0x28]
movzx edx, r9w
cdq
lea edx, [r9 + 0x20]
jmp 0x14049c257
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
test r9w, r12w
cmp al, spl
sub ecx, 0x30
jmp 0x14049c271
je 0x14049c2ae
sub ecx, 1
jmp 0x14049c27f
je 0x14049c29f
cmp ecx, 1
je 0x14049c295
sub eax, eax
jmp 0x14049c2b3
mov eax, 3
jmp 0x14049c2b3
mov eax, 1
jmp 0x14049c2a9
jmp 0x14049c2b3
mov eax, 2
add rsp, 0x28
jmp 0x14049c2bc
ret

Function at 0x14049c2bd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp r9d, r11d
clc
mov qword [rax + 8], rbx
clc
cmp sp, bx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
bts r14w, r9w
btc r14, 0x83
push r15
movsx di, dl
sub rsp, 0x30
add dil, 0x36
mov rdi, r9
movsx r15, ax
bsr esi, edx
jmp 0x14049c2ff
mov rsi, rdx
add r14b, 0xc2
sub rsi, rcx
movzx r14d, r11w
sub rdi, r8
sbb r14w, 0x7aef
xor r15w, 0x5cc9
bts r14, r8
mov r15, rcx
cmc
or r14b, r11b
sbb cx, r9w
sar rsi, 1
mov rcx, qword [rsp + 0x60]
sub ebx, ebx
movsx r14d, bp
sal r14b, 0xd
bsf r14, r13
sar rdi, 1
mov r14b, 0x9c
movsx r14, si
inc r14d
mov r14, r8
stc
test rcx, rcx
jne 0x14049c36e
call fcn.1404a6500
mov rcx, qword [rax + 8]
jmp 0x14049c369
jmp 0x14049c376
mov rcx, qword [rcx + 8]
cmp r10b, 0xc4
test rcx, rcx
jmp 0x14049c37e
jne 0x14049c42b
cmp esi, edi
mov eax, edi
xchg ch, ch
cmovl eax, esi
dec cx
mov cl, r8b
movsxd rcx, eax
mov eax, 1
cmp r14b, spl
test r15d, esp
cmc
test rcx, rcx
jmp 0x14049c3aa
je 0x14049c3e2
sub r15, r14
cdq
cmove rdx, r11
movzx edx, word [r15 + r14]
test spl, 0xf8
jmp 0x14049c3c6
cmp dx, word [r14]
jne 0x14049c401
add r14, 2
sub rcx, rax
jmp 0x14049c3dc
jne 0x14049c3b8
cmp esi, edi
jmp 0x14049c3e9
je 0x14049c41f
or ecx, 0xffffffff
cmp esi, edi
cmovl eax, ecx
jmp 0x14049c3fc
jmp 0x14049c493
sbb ebx, ebx
cmp r13, 0x26bd6477
test r15w, bp
and ebx, 0xfffffffe
cmp cl, spl
jmp 0x14049c419
add ebx, eax
movzx rax, r10w
mov eax, ebx
jmp 0x14049c426
jmp 0x14049c493
mov dword [rsp + 0x28], edi
not dl
xchg r9w, r8w
mov r9d, esi
cwd
cqo
mov r8, r15
cmovo rdx, rcx
movsx rdx, ax
xchg dx, dx
mov qword [rsp + 0x20], r14
xchg dx, dx
cqo
movzx rdx, r12w
mov edx, 0x1000
jmp 0x14049c462
call fcn.1404bec31
test eax, eax
jmp 0x14049c46e
jne 0x14049c48e
call fcn.1404b1162
mov dword [rax], 0x16
mov eax, 0x7fffffff
jmp 0x14049c489
jmp 0x14049c493
sub eax, 2
neg bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
sar r14b, 0x32
xadd r15b, r14b
mov r14, qword [rsp + 0x58]
inc r15b
add rsp, 0x30
pop r15
jmp 0x14049c4bd
ret
Function at 0x14049d034
Capabilities:
Terminate process

Disassembly:
push rcx
pop rdi
jg 0x1401776b0
jnp 0x1401776bb
mov bl, 0xad
mov bh, 0xae
mov bl, 0x86
imul ecx, dword [rax - 0x4c], 0x1f
sar dword [rbx], 0x50
cmp byte [rbx], bh
xchg ecx, eax
pop rbx
invalid
sbb al, 0x3d
add qword [rdx - 0x214fec48], rdi
invalid
sub al, 0x65
cmpsb byte [rsi], byte [rdi]
or dh, byte [rsi - 0x78]
jns 0x1401776a1
invalid
mov ecx, 0x1cb8c07e
pop rbp
movabs al, byte [0x7ab881827836899b]
jp 0x140177789
rcr al, 1
loop 0x140177710
sar byte [rax - 0x645fa2e4], 0x89
js case.0x1404c6d46.32
cmp dword [rax - 0x2fc19486], 0xf1ede2d8
jp 0x140177789
rcr al, 1
loop 0x140177710
int1
mov eax, ebp
invalid
lea esp, [rbx]
sal byte [rcx + 0x4928e15], 0x6d
invalid
invalid
mov eax, 0xfcfb83f5
invalid
jno 0x1401777bb
jne 0x140177796
hlt
jmp 0x140177796
int3
jmp 0x1401777ad
invalid
add bh, byte [rax - 0x58]
in eax, 0x43
mov dl, ch
test dword [rcx + 0x3d], esp
or byte [0x1b2a934bc], dh
ret 0x67fe
push rbx
neg bx
sub rsp, 0x20
sar bl, cl
adc bh, 8
shl bx, cl
mov rbx, rcx
test r14b, r10b
cmp r13b, 0x37
xor ecx, ecx
jmp 0x14049d056
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x14049d064
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
and dl, 0x2d
add dl, dil
mov edx, 0xc0000409
bts ebx, r9d
bswap bx
neg ebx
add rsp, 0x20
pop rbx
jmp switch.0x14049d091
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404ac890
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
shrd rsi, r11, 0x7c
sub rsp, 0x30
mov edi, edx
test r13b, 0x74
mov rsi, rcx
test r8, r8
jne 0x1404ac8d7
call fcn.1404b1162
mov dword [rax], 0x16
jmp 0x1404ac8c6
call fcn.1404b1e49
xor eax, eax
jmp 0x1404ac8d2
jmp 0x1404ac9ba
mov rdx, r9
bswap cx
movsx cx, r11b
mov rcx, r8
jmp 0x1404ac8ea
call fcn.1404aca26
mov rbx, rax
stc
test rax, rax
jmp 0x1404ac8fb
je 0x1404ac95f
lea rax, [rsp + 0x50]
bswap r8w
cdq
movzx ecx, r9w
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x140094b24]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rsi
jmp 0x1404ac92d
mov dword [rsp + 0x20], eax
jmp 0x1404ac936
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404ac947
jne 0x1404ac9e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404ac95a
call fcn.1404b11d4
sub edi, edi
test rbx, rbx
jmp 0x1404ac969
je 0x1404ac9ad
mov rcx, qword [rbx + 0x10]
cmp bl, r12b
clc
test rcx, rcx
jmp 0x1404ac97f
je 0x1404ac98b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmc
clc
test rcx, rcx
jmp 0x1404ac999
je 0x1404ac9a5
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1404c5041
mov rax, rdi
bswap di
sbb sil, 0xb1
sub dil, sil
mov rbx, qword [rsp + 0x40]
shrd di, cx, 0x33
mov rsi, qword [rsp + 0x48]
shl dil, 0x18
add rsp, 0x30
movsx rdi, r15w
movsx di, r8b
pop rdi
jmp 0x1404ac9e0
ret
mov rcx, qword [rsp + 0x68]
stc
cmp sp, dx
test r8b, 0x52
test rcx, rcx
jmp 0x1404ac9f6
je 0x1404aca0b
mov eax, dword [rsp + 0x50]
cmc
mov dword [rcx], eax
cmp dh, dl
clc
test di, 0xa3c
xor ebx, ebx
jmp 0x1404aca12
jmp 0x1404ac961

Function at 0x1404acc9c
Capabilities:
Terminate process

Disassembly:
push rbx
rcl bh, 0xa
movsx rbx, r11w
sub rsp, 0x20
cmovno rbx, rbx
mov ebx, ecx
jmp 0x1404accb4
call fcn.1404ce511
cmp eax, 1
jmp 0x1404accc1
je 0x1404acd06
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
shr edx, 8
cmc
jmp 0x1404accdf
test dl, 1
jne 0x1404acd06
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx dx, dil
setge dl
mov edx, ebx
jmp 0x1404acd00
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404acd0d
call fcn.1404acc03
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404c6663
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
jmp 0x1404c6679
lea r9, [0x1400c63d8]
movsx di, r14b
mov edi, ecx
lea rdx, [0x1400cf748]
mov ecx, 6
movzx r8, cx
movzx r8d, r15w
cmovno r8, rcx
lea r8, [0x1400c63d0]
jmp 0x1404c66ab
call fcn.1404c74f4
mov rdx, rbx
mov ecx, edi
jmp 0x1404c66ba
test rax, rax
jmp 0x1404c66c2
je 0x1404c66d3
call qword [0x1400b8d90]
jmp 0x1404c66d9
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
sub edi, eax
add rsp, 0x20
movzx edi, di
pop rdi
jmp 0x1404c66ed
ret

Function at 0x1404c686e
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
dec ebx
mov qword [rsp + 0x18], rsi
shr rsi, 0xa8
movzx rbx, r10w
push rdi
shld ebx, r9d, 0x42
or bpl, 0xf5
sub rsp, 0x30
mov ebx, r9d
not di
xchg bpl, sil
bswap r9w
mov rdi, r8
movsxd rsi, r11d
mov esi, edx
lea r9, [0x1400c63e8]
jmp 0x1404c68be
mov rbp, rcx
movzx dx, r11b
bswap dx
cmovns rcx, rbp
lea r8, [0x1400c63e0]
movsx rcx, r14w
movzx dx, bh
sets dl
lea rdx, [0x1400cf190]
movsx cx, r15b
mov ecx, 0xb
jmp 0x1404c68f5
call fcn.1404c74f4
mov rcx, rbp
test rax, rax
jmp 0x1404c6905
je 0x1404c692f
mov r9d, ebx
movsx dx, r12b
movsx r8d, r13w
bswap r8
mov r8, rdi
jmp 0x1404c6922
mov edx, esi
call qword [0x1400b8d90]
jmp 0x1404c695a
sub edx, edx
jmp 0x1404c6936
call fcn.1404c6fee
mov ecx, eax
not r8b
cwd
movzx edx, bp
mov r9d, ebx
xchg dl, dl
mov r8, rdi
mov edx, esi
jmp 0x1404c6954
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
rcl sil, cl
xor bp, 0x7683
sub sil, 0xec
mov rbp, qword [rsp + 0x48]
clc
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1404c6d4d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
cmove bp, dx
mov qword [rsp + 0x18], rsi
stc
and si, si
or bl, spl
push rdi
sbb di, r13w
bt di, 0xe2
sub rsp, 0x50
movzx bx, r14b
mov bpl, r10b
mov ebx, r9d
cmova r9, rax
xchg sil, r9b
not bp
mov rdi, r8
mov bp, 0x136e
movzx si, bl
mov esi, edx
movsx rbp, r13w
mov bpl, 0xbf
movzx edx, r15w
lea r9, [0x1400c6410]
mov rbp, rcx
cmovle rcx, r15
xchg ch, dh
movzx r8, bp
lea r8, [0x1400c6408]
lea rdx, [0x1400cf1c0]
mov ecx, 0x14
jmp 0x1404c6dce
call fcn.1404c74f4
test rax, rax
jmp 0x1404c6ddb
je 0x1404c6e76
mov r8, qword [rsp + 0xa0]
not ch
setns cl
mov r9d, ebx
sets dl
movzx rdx, di
cmovo cx, r9w
mov rcx, qword [rsp + 0x98]
setle dh
movsx dx, bl
cwd
mov edx, esi
jmp 0x1404c6e15
mov qword [rsp + 0x40], r8
mov r8, rdi
jmp 0x1404c6e22
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x90]
jmp 0x1404c6e34
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0x88]
mov dword [rsp + 0x28], ecx
cmovae cx, r11w
jmp 0x1404c6e51
mov rcx, qword [rsp + 0x80]
jmp 0x1404c6e5e
mov qword [rsp + 0x20], rcx
mov rcx, rbp
jmp 0x1404c6e6b
call qword [0x1400b8d90]
jmp 0x1404c6eeb
xor edx, edx
xchg cx, cx
movsx rcx, r13w
mov rcx, rbp
jmp 0x1404c6e87
call fcn.1404c6fee
mov ecx, eax
cwd
mov r9d, ebx
movsx r8w, sil
cwd
rdtsc
mov eax, dword [rsp + 0x88]
xchg r8d, r8d
movsx edx, r15w
sets r8b
mov r8, rdi
movsx edx, bp
mov dl, r12b
cdq
mov dword [rsp + 0x28], eax
rdtsc
movsx dx, bpl
mov edx, esi
movzx eax, r11w
xchg ah, al
mov ah, 0x8e
mov rax, qword [rsp + 0x80]
jmp 0x1404c6edb
mov qword [rsp + 0x20], rax
jmp 0x1404c6ee5
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov rbx, qword [rsp + 0x60]
rcl dil, cl
shld edi, edi, 0xe2
mov rbp, qword [rsp + 0x68]
btc si, r14w
mov rsi, qword [rsp + 0x70]
sub dil, r9b
cmc
add rsp, 0x50
xchg di, di
cmovno rdi, rsp
not dil
pop rdi
jmp 0x1404c6f1e
ret
Function at 0x1404d24d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
rol bh, cl
push rdi
movsx bx, cl
movzx rbx, si
btr bx, r8w
sub rsp, 0x20
movsx ebx, r12w
not bh
mov rbx, rcx
jmp 0x1404d24fc
call fcn.1404c5377
or r8, 0xffffffffffffffff
cmc
mov r9b, spl
btc edx, edi
mov r9, r8
and rdx, 0x44e56948
movsx dx, r13b
rcr dh, 0xf5
sub edi, edi
bswap edx
jmp 0x1404d2529
lea rdx, [rax + 0x98]
mov rax, qword [rdx]
jmp 0x1404d2538
inc r9
cmp al, r14b
cmp word [rax + r9*2], di
jmp 0x1404d2548
jne 0x1404d2538
mov eax, edi
cmp r9, 3
sete al
jmp 0x1404d255c
mov dword [rdx + 0x18], eax
lahf
jmp 0x1404d2565
mov rax, qword [rdx + 8]
jmp 0x1404d256e
inc r8
cmp eax, r12d
cmp word [rax + r8*2], di
jmp 0x1404d257e
jne 0x1404d256e
cmp r8, 3
mov eax, edi
not al
mov r8d, 2
sete al
stc
cmp r12b, 0x5a
mov dword [rdx + 0x1c], eax
test r9, rbx
stc
mov dword [rbx + 4], edi
jmp 0x1404d25ac
cmp dword [rdx + 0x18], edi
jne 0x1404d261d
mov rcx, qword [rdx]
xor r9w, bx
or eax, 0x2af82341
not r9b
mov r10d, edi
cmp r8b, r15b
sar ah, cl
nop
movzx r9d, word [rcx]
mov al, dil
lea rcx, [rcx + r8]
and eax, 0x51876fc2
add ah, 0xd2
lea eax, [r9 - 0x41]
test spl, al
cmp ax, 0x19
jmp 0x1404d25f1
jbe 0x1404d2607
sub r9w, 0x61
cmp r9w, 0x19
ja 0x1404d2614
inc r10d
jmp 0x1404d260f
jmp 0x1404d25ce
mov r8d, r10d
movsxd rcx, edx
mov cl, r12b
mov dword [rdx + 0x14], r8d
lea rcx, [0x1400abdd4]
movsxd rdx, edx
movsx rdx, dx
movzx dx, r11b
mov edx, 1
jmp 0x1404d263e
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov ecx, dword [rbx]
sub al, r13b
test cl, 7
setb dl
setne dl
jmp 0x1404d2658
bt ecx, 9
mov al, 8
setb al
cmp r13b, 0x33
and dl, al
bt ecx, 8
mov al, bpl
setb al
test al, dl
jmp 0x1404d2678
jne 0x1404d2689
mov dword [rbx], edi
clc
bts bx, sp
rcr bx, 0xdf
mov rbx, qword [rsp + 0x30]
adc dil, bpl
cmp ebp, esi
bswap di
add rsp, 0x20
movzx di, r10b
movsx rdi, r10w
pop rdi
jmp 0x1404d26a9
ret
Function at 0x1404d308c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
movsx rbx, r11w
neg bh
push rdi
sub rsp, 0x20
movzx bx, ch
btc edi, 0xd1
sub esi, esi
and dil, dl
btc di, dx
mov rdi, rdx
bt bx, 0xe5
bsr rbx, rax
mov rbx, rcx
cmc
test rcx, rcx
jmp 0x1404d30ca
je 0x1404d3161
cmp word [rcx], si
je 0x1404d3161
lea rdx, [0x1400d1d08]
jmp 0x1404d30e5
call fcn.14020a704
test eax, eax
jmp 0x1404d30f1
je 0x1404d3161
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404d3106
call fcn.14020a704
test eax, eax
jmp 0x1404d3112
jne 0x1404d3154
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
cqo
movsx edx, r8w
movsx r8, r14w
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
jmp 0x1404d3138
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404d319b
mov eax, dword [rsp + 0x30]
jmp 0x1404d314f
jmp 0x1404d31c1
mov rcx, rbx
call fcn.1404dc044
jmp 0x1404d31c1
mov ecx, dword [rdi + 8]
mov r8b, r8b
cmovp edx, r15d
lea r8, [rsp + 0x30]
mov r9d, 2
movzx dx, dil
bswap rdx
movsx dx, dil
mov edx, 0x20001004
jmp 0x1404d318d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d31a7
sub eax, eax
jmp 0x1404d31a2
jmp 0x1404d31c1
mov eax, dword [rsp + 0x30]
cmp rdi, rsi
test eax, eax
jmp 0x1404d31b5
jne 0x1404d31c1
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
cmove rdi, rdx
mov rsi, qword [rsp + 0x40]
and edi, ebx
and edi, 0x3a1a49ff
bt edi, r13d
add rsp, 0x20
movsxd rdi, r13d
pop rdi
jmp 0x1404d31e8
ret

Function at 0x1404d31e9
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
shrd bx, r8w, 0x4f
btr bx, 0xb0
mov qword [rsp + 0x18], rsi
push rdi
test r12b, 0x5e
sub rsp, 0x20
jmp 0x1404d320c
mov esi, edx
movsx ebx, r14w
mov ebx, ecx
jmp 0x1404d3219
call fcn.1404c5377
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9w, 0x5331
movzx r9w, sil
mov r9d, 2
btr edx, r10d
cmc
movsx rdx, r13w
bts ecx, 0xa
cdq
bswap dx
not dh
mov edx, 0x20000001
xchg dil, dil
jmp 0x1404d325b
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test eax, eax
jmp 0x1404d326e
je 0x1404d3323
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d327d
je 0x1404d3319
test esi, esi
jmp 0x1404d328a
je 0x1404d3319
mov r9, qword [rdi + 0x98]
mov r8d, r10d
and ax, 0x40d
movzx edx, word [r9]
lea rcx, [r9 + 2]
movsx eax, r14w
lea eax, [rdx - 0x41]
jmp 0x1404d32b2
cmp ax, 0x19
jmp 0x1404d32bb
jbe 0x1404d32d4
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404d32ce
ja 0x1404d32ed
movzx edx, word [rcx]
jmp 0x1404d32dc
inc r8d
add rcx, 2
jmp 0x1404d32e8
jmp 0x1404d32aa
or rcx, 0xffffffffffffffff
jmp 0x1404d32f6
inc rcx
cmc
clc
cmp word [r9 + rcx*2], r10w
jmp 0x1404d3305
jne 0x1404d32f6
cmp r8d, ecx
jmp 0x1404d3313
je 0x1404d3323
mov eax, 1
jmp 0x1404d332d
xor eax, eax
cmc
btc ebx, ebp
shr bx, 0x45
mov rbx, qword [rsp + 0x38]
movzx edi, r11w
bt rdi, 0xca
add dil, 0x51
mov rsi, qword [rsp + 0x40]
sbb di, r12w
add rsp, 0x20
mov dil, 0x70
cmovl di, r9w
bswap di
pop rdi
ret
Function at 0x1404d49cf
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
stc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
cmp bl, 0x96
stc
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
cmc
test al, dl
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test r9b, bl
test rax, rax
je 0x1404d4b67
mov rsi, rax
cmp di, si
cmc
test dl, r8b
cmp word [rax], r14w
je 0x1404d4a54
or rax, 0xffffffffffffffff
jmp 0x1404d4a25
inc rax
cmp word [rsi + rax*2], r14w
jmp 0x1404d4a32
jne 0x1404d4a25
lea rsi, [rsi + rax*2]
cmp dx, 0x945
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d4a4e
jne 0x1404d4a1c
mov qword [rsp + 0x38], r14
mov r8, 0x773d3e4f
sub rsi, rbx
not r8b
mov qword [rsp + 0x30], r14
jmp 0x1404d4a74
add rsi, 2
adc r9, r8
bsf r8w, r8w
movsx r9d, r14w
sar rsi, 1
cmp r14b, 0xca
rcl r9, cl
test r13b, 0xc6
mov r8, rbx
btr r9w, r12w
mov r9d, esi
mov dword [rsp + 0x28], r14d
cmc
xor edx, edx
cmc
cmp r9d, r15d
mov qword [rsp + 0x20], r14
cmc
cmp al, r8b
xor ecx, ecx
call fcn.1404c5188
movsxd rbp, eax
test r12b, r8b
clc
test eax, eax
je 0x1404d4b67
mov rcx, rbp
jmp 0x1404d4ad0
call fcn.1404c50cd
mov rdi, rax
test rax, rax
jmp 0x1404d4ae0
je 0x1404d4b49
mov qword [rsp + 0x38], r14
and r8d, 0x35ff5c8c
mov r9d, esi
sbb r8, r9
mov qword [rsp + 0x30], r14
rol r8b, cl
cmc
shrd r8w, r12w, 0x9f
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
clc
jmp 0x1404d4b16
xor ecx, ecx
jmp 0x1404d4b1d
mov qword [rsp + 0x20], rax
jmp 0x1404d4b27
call fcn.1404c5188
test eax, eax
jmp 0x1404d4b33
je 0x1404d4b49
mov rsi, rdi
mov rdi, r14
jmp 0x1404d4b44
jmp 0x1404d4b55
mov rsi, r14
cmove cx, sp
seto ch
bswap ecx
mov rcx, rdi
jmp 0x1404d4b5d
call fcn.1404c5041
jmp 0x1404d4b6f
mov rsi, r14
jmp 0x1404d4b6f
test rbx, rbx
jmp 0x1404d4b77
je 0x1404d4b86
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov dil, dl
mov rax, rsi
mov rsi, qword [rsp + 0x60]
btc bp, 0xaf
mov rbp, qword [rsp + 0x58]
test r8b, 0x88
rcr r14w, cl
shrd di, cx, 0x23
mov rdi, qword [rsp + 0x68]
or r14, 0x3c702ca4
add rsp, 0x40
pop r14
ret
Function at 0x1404d4bc0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmp r8b, 0x69
mov qword [rsp + 0x10], rbp
test r13w, r11w
cmp r8b, 0xf0
mov qword [rsp + 0x18], rsi
push rdi
stc
cmp ebp, 0x1b354512
cmc
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
shld rbx, rbx, 0x7c
mov rbx, rax
test rax, rax
jmp 0x1404d4c00
je 0x1404d4cc9
mov rbp, rax
jmp 0x1404d4c0e
cmp word [rax], si
jmp 0x1404d4c16
je 0x1404d4c51
or rax, 0xffffffffffffffff
jmp 0x1404d4c25
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404d4c32
jne 0x1404d4c25
lea rbp, [rbp + rax*2]
add rbp, 2
cmc
cmp word [rbp], si
jmp 0x1404d4c4b
jne 0x1404d4c1c
sub rbp, rbx
rol ch, cl
add rbp, 2
cmove ecx, r15d
movsx ecx, sp
sar rbp, 1
movzx ecx, di
xadd cl, cl
movzx rcx, dx
add rbp, rbp
movzx rcx, sp
movsxd rcx, ebp
mov rcx, rbp
jmp 0x1404d4c80
call fcn.1404c50cd
mov rdi, rax
cmp ah, 0x4a
stc
test rax, rax
jmp 0x1404d4c94
je 0x1404d4cb4
mov r8, rbp
mov rdx, rbx
movzx ecx, r10w
mov rcx, rax
jmp 0x1404d4cac
call fcn.14049f3a4
mov rsi, rdi
sub ecx, ecx
call fcn.1404c5041
mov rcx, rbx
jmp 0x1404d4cc3
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
bts di, sp
sbb di, sp
rcl bp, cl
mov rax, rsi
seto dil
test ebx, 0x5d2d1d8f
inc ebp
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov dil, bpl
cmc
add rsp, 0x20
xchg dil, dil
not edi
pop rdi
jmp 0x1404d4d04
ret
Function at 0x1404d7b03
Capabilities:
Encode data using base64
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov rax, r8
mov qword [rsp + 0x18], rbp
push rsi
movsx eax, r8w
push rdi
push r14
movsx ax, r13b
jmp 0x1404d7b30
mov eax, 0x1450
jmp 0x1404d7b3a
call fcn.140444962
sub rsp, rax
rcr dil, cl
or bp, 0x63b2
mov rax, qword [0x1400b7288]
xor rax, rsp
add esi, 0x46147360
rol rsi, cl
mov qword [rsp + 0x1440], rax
jmp 0x1404d7b6f
movsxd r10, edx
shl r14b, 0x4a
mov rdi, rcx
mov esi, 0xbdc506c
mov rax, r10
rol bp, cl
sbb ecx, 0x3fd71f17
mov ebp, r9d
cmp rsp, rdi
sub si, di
clc
sar rax, 6
lea rcx, [0x1400ba940]
and r10d, 0x3f
sar dx, 0x8b
rcl r14b, cl
xadd rsi, rsi
lea rbp, [rbp + r8]
movsx r14, r14w
shld r14w, r14w, 0x3d
sub dx, 0x3933
mov rsi, r8
movzx dx, bpl
and r14b, 0x4f
shr r14b, cl
mov rax, qword [rcx + rax*8]
inc edx
bsr r14w, bp
lea rdx, [r10 + r10*8]
movzx r14d, r14w
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
cmp ax, 0x5887
mov qword [rdi], rax
mov dword [rdi + 8], eax
jmp 0x1404d7c00
cmp r8, rbp
jae 0x1404d7d0f
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jae 0x1404d7c76
mov al, byte [rsi]
jmp 0x1404d7c1e
inc rsi
cmp r12b, cl
cmp sil, 0x95
test ecx, 0x402a3fa5
cmp al, 0xa
jmp 0x1404d7c35
jne 0x1404d7c4e
inc dword [rdi + 8]
jmp 0x1404d7c43
mov byte [rbx], 0xd
inc rbx
jmp 0x1404d7c4e
mov byte [rbx], al
inc rbx
inc al
sbb rax, rbx
lea rax, [rsp + 0x143f]
test r12d, r8d
jmp 0x1404d7c68
cmp rbx, rax
jmp 0x1404d7c70
jb 0x1404d7c0e
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
btr dx, si
rcl dl, 0x2c
movsx rdx, r9w
sub ebx, eax
lea r9, [rsp + 0x30]
jmp 0x1404d7ca1
mov r8d, ebx
seto dl
mov cx, 0x540d
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404d7cb8
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d7cc5
je 0x1404d7d00
mov eax, dword [rsp + 0x30]
cmp rbp, 0x6de9624e
test bh, 0xd6
add dword [rdi + 4], eax
cmp bpl, 0xb0
cmp eax, ebx
jmp 0x1404d7ce7
jb 0x1404d7d0f
cmp rsi, rbp
jmp 0x1404d7cf5
jb 0x1404d7c09
jmp 0x1404d7d0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
or cl, 0x10
cbw
cdqe
mov rax, rdi
shl cx, 0xd5
mov rcx, qword [rsp + 0x1440]
cmp al, r8b
stc
xor rcx, rsp
jmp 0x1404d7d2a
call fcn.14049b928
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movzx bp, dil
movsx r14d, cx
setae dil
mov rbp, qword [r11 + 0x30]
movsx si, r12b
mov rsp, r11
pop r14
bswap esi
movsx di, dl
not di
pop rdi
movsx esi, r11w
pop rsi
jmp 0x1404d7d6a
ret
Function at 0x1404d7d6b
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
movzx eax, bx
cwde
push rdi
mov al, 0x55
not ah
movzx eax, r10w
push r14
cdqe
mov eax, 0x1450
jmp 0x1404d7d98
call fcn.140444962
sub rsp, rax
mov r14, 0x706a55a0
cmp r15b, 0x75
btr r14w, r14w
mov rax, qword [0x1400b7288]
xor r14w, 0x300a
movsx r10d, r11w
or rbp, r13
xor rax, rsp
adc bp, r8w
add sil, 0x5d
mov qword [rsp + 0x1440], rax
btr r14, 0x42
mov r10w, r10w
shr r10d, cl
movsxd r10, edx
mov rdi, rcx
jmp 0x1404d7dee
mov rax, r10
mov ebp, r9d
bt cx, 3
btr r14w, bx
sar rax, 6
cmp r8b, 0xc0
seta r14b
lea rcx, [0x1400ba940]
shl r14w, 0x27
sbb dx, 0x7695
and r10d, 0x3f
add r14d, esi
and r14b, r11b
lea rbp, [rbp + r8]
xadd dl, sil
sar dl, cl
sub esi, r14d
mov rsi, r8
btc dx, r13w
neg rdx
mov rax, qword [rcx + rax*8]
bt r14w, r9w
lea rdx, [r10 + r10*8]
rol r14b, 0x54
mov r14, qword [rax + rdx*8 + 0x28]
test r15b, 0x86
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
test r10, r13
cmp r8, rbp
jmp 0x1404d7e6b
jae 0x1404d7f8b
lea rbx, [rsp + 0x40]
cmc
test r11, 0x7bb55e98
cmp rsi, rbp
jmp 0x1404d7e86
jae 0x1404d7ef0
movzx eax, word [rsi]
cmc
add rsi, 2
cmp sil, 0xc1
test r11b, spl
cmp ax, 0xa
jne 0x1404d7ec6
add dword [rdi + 8], 2
mov ecx, 0xd
mov word [rbx], cx
cmp rdi, 0x53838d5
cmp cl, r9b
add rbx, 2
cmp r12, rbx
test ah, 0x9e
cmc
mov word [rbx], ax
stc
add rbx, 2
add al, 0xac
btc eax, r13d
cdqe
lea rax, [rsp + 0x143e]
test r12b, r11b
cmc
cmp rbx, rax
jmp 0x1404d7eea
jb 0x1404d7e7e
and qword [rsp + 0x20], 0
adc eax, 0x7f1a03f6
shr dl, 0x50
lea rax, [rsp + 0x40]
bt cx, ax
xor r9, rbp
or dl, 0x64
sub rbx, rax
sbb r8b, r8b
and cl, r10b
lea r9, [rsp + 0x30]
sar rbx, 1
sal ecx, cl
lea rdx, [rsp + 0x40]
rcl r8b, cl
movsx r8w, r13b
or cl, spl
add ebx, ebx
movzx r8w, r15b
mov rcx, r14
movzx r8d, r15w
mov r8d, 0x1ede43ae
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d7f83
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
test r15b, spl
cmp r13b, bl
cmc
cmp eax, ebx
jmp 0x1404d7f6a
jb 0x1404d7f8b
cmp rsi, rbp
jmp 0x1404d7f78
jb 0x1404d7e71
jmp 0x1404d7f8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
shl cl, cl
mov rcx, qword [rsp + 0x1440]
stc
xor rcx, rsp
jmp 0x1404d7fa1
call fcn.14049b928
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
cmovp rdi, r13
mov rbp, qword [r11 + 0x30]
movzx si, r15b
setb sil
mov rsp, r11
mov r14, rbx
pop r14
pop rdi
movsx esi, r12w
pop rsi
ret