joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404c9781
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x1404c979f
mov qword [rax + 8], rbx
bsr r10w, r13w
rcr bh, 0xc
mov qword [rax + 0x10], rbp
btr r10, rsp
rcr rbx, cl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xchg bl, bl
push r14
btc ebx, 0x33
xchg bx, r10w
or ebp, 0xffffffff
mov rbx, r8
and r10b, 0xca
neg r10b
cmp dword [rcx + 0x10], 0
movzx r10d, bx
mov r10w, r12w
mov r10, rdx
jmp 0x1404c97eb
je 0x1404c9969
movsxd r9, dword [rcx + 0x10]
not ch
xadd r14w, r14w
rol r14b, 0x56
lea r14, [0x140000000]
adc r11w, 0x3e6e
shl r11b, 0x21
lahf
mov rdi, qword [rdx + 8]
xor esi, esi
add r9, rdi
bsf eax, eax
xor cl, 0x1e
xor r8d, r8d
dec r11b
xadd r11b, al
ror ch, cl
mov edx, ebp
stc
movzx ecx, byte [r9]
and ecx, 0xf
xadd r11w, ax
stc
movsx rax, byte [rcx + r14 + 0xc1a30]
movzx r11d, sp
mov cl, byte [rcx + r14 + 0xc1a40]
or r11w, 0x59f9
sub r9, rax
setae r11b
rol r11w, 0xd5
mov r11d, dword [r9 - 4]
cmp r15b, 0xd2
cmp dx, bx
cmc
shr r11d, cl
jmp 0x1404c987c
test r11d, r11d
je 0x1404c9969
mov rax, qword [r10 + 0x10]
inc r10w
bts r10w, r15w
mov r10d, dword [rax]
movzx ecx, byte [r9]
cbw
shl eax, cl
stc
and ecx, 0xf
sets ah
rcl ax, cl
neg ah
movsx rax, byte [rcx + r14 + 0xc1a30]
cmp dil, 0x3f
mov cl, byte [rcx + r14 + 0xc1a40]
test dx, di
sub r9, rax
bsf rax, rdi
mov eax, dword [r9 - 4]
clc
test r10b, 0x61
shr eax, cl
test r10, 0x5c413a18
add esi, eax
btc rax, 0xb9
mov eax, esi
cmc
add rax, r10
cmc
clc
lea rax, [rax + rdi]
cmp cx, 0x603a
cmp rbx, rax
jb 0x1404c9951
movzx ecx, byte [r9]
cmovae dx, r15w
inc r8d
xadd rax, rax
and ecx, 0xf
dec ah
and eax, ecx
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
sbb dh, 0x4d
sub r9, rax
and edx, 0x66657f86
sar rdx, cl
movsxd rdx, edi
mov edx, dword [r9 - 4]
clc
shr edx, cl
dec edx
jmp 0x1404c9943
cmp r8d, r11d
jmp 0x1404c994b
jb 0x1404c9895
test r8d, r8d
movsx eax, ax
bswap ax
cmove edx, ebp
mov eax, edx
jmp 0x1404c9964
jmp 0x1404c996b
mov eax, ebp
mov rbx, qword [rsp + 0x10]
bswap rdi
mov dil, cl
mov rbp, qword [rsp + 0x18]
movsx rsi, r9w
mov rsi, qword [rsp + 0x20]
mov dil, 0x99
movsxd r14, r9d
mov rdi, qword [rsp + 0x28]
mov r14d, ebp
movzx r14d, cx
jmp 0x1404c999b
pop r14
jmp 0x1404c99a2
ret
Function at 0x1404cb601
Capabilities:
Check for software breakpoints

Disassembly:
mov rax, rsp
clc
cmc
test r9, rsp
mov qword [rax + 8], rbx
clc
jmp 0x1404cb61a
mov qword [rax + 0x10], rbp
bts ebp, ecx
rcl bp, 0xb6
mov qword [rax + 0x18], rsi
sbb ebp, 0x3efd1f4f
add bp, r10w
shld bp, bp, 0x18
mov qword [rax + 0x20], rdi
push r14
sal rbp, cl
sub rsp, 0x20
bts r14w, r9w
sub r14w, bx
btc di, r13w
xor ebx, ebx
dec r14b
not r14b
mov r14, r8
mov rbp, rdx
rcr edi, 0x6a
clc
mov rdi, rcx
cmp dword [rcx + 4], ebx
je 0x1404cb861
movsxd rsi, dword [rcx + 4]
jmp 0x1404cb67a
call fcn.1404a84dd
mov r9, rax
cmp r10b, 0xcc
test dl, 0xce
test rbx, rsi
add r9, rsi
jmp 0x1404cb694
je 0x1404cb861
test esi, esi
jmp 0x1404cb6a1
je 0x1404cb6c3
movsxd rsi, dword [rdi + 4]
jmp 0x1404cb6b0
call fcn.1404a84dd
lea rcx, [rsi + rax]
jmp 0x1404cb6be
jmp 0x1404cb6d2
mov rcx, rbx
movsxd rsi, esp
sbb sil, bl
not sil
mov esi, ebx
clc
cmp byte [rcx + 0x10], bl
jmp 0x1404cb6da
je 0x1404cb861
test byte [rdi], 0x80
jmp 0x1404cb6e8
je 0x1404cb6fd
test byte [rbp], 0x10
jmp 0x1404cb6f7
jne 0x1404cb861
test esi, esi
jmp 0x1404cb704
je 0x1404cb72e
call fcn.1404a84dd
mov rsi, rax
rol al, cl
movzx eax, r15w
and al, 0x16
movsxd rax, dword [rdi + 4]
test dx, bp
add rsi, rax
jmp 0x1404cb729
jmp 0x1404cb731
mov rsi, rbx
call fcn.1404a8510
mov rcx, rax
movsxd rax, dword [rbp + 4]
stc
cmp r9w, 0x6774
lea rcx, [rcx + rax]
cmp rsi, rcx
jmp 0x1404cb750
je 0x1404cb7eb
cmp dword [rdi + 4], ebx
jmp 0x1404cb75e
je 0x1404cb77a
call fcn.1404a84dd
mov rsi, rax
not al
movsxd rax, dword [rdi + 4]
add rsi, rax
jmp 0x1404cb782
mov rsi, rbx
jmp 0x1404cb782
call fcn.1404a8510
movsxd r8, dword [rbp + 4]
shl edx, 0xdb
add r8, 0x10
lea r8, [r8 + rax]
cmova dx, r8w
jmp 0x1404cb7a0
lea rax, [rsi + 0x10]
cqo
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
stc
clc
cmc
sub ecx, edx
jmp 0x1404cb7bb
jne 0x1404cb7d2
inc rax
cmc
test edx, edx
jmp 0x1404cb7cc
jne 0x1404cb7a9
test ecx, ecx
jmp 0x1404cb7d9
je 0x1404cb7eb
xor eax, eax
jmp 0x1404cb7e6
jmp 0x1404cb866
mov al, 2
test r9w, 0x1296
test byte [rbp], al
jmp 0x1404cb7fb
je 0x1404cb80a
test byte [rdi], 8
je 0x1404cb855
test byte [r14], 1
jmp 0x1404cb813
je 0x1404cb822
test byte [rdi], 1
je 0x1404cb855
test byte [r14], 4
jmp 0x1404cb82b
je 0x1404cb83a
test byte [rdi], 4
je 0x1404cb855
test byte [r14], al
je 0x1404cb850
test byte [rdi], al
jmp 0x1404cb84a
je 0x1404cb855
mov ebx, 1
mov eax, ebx
jmp 0x1404cb85c
jmp 0x1404cb866
mov eax, 1
mov rbx, qword [rsp + 0x30]
and r14b, r10b
dec rsi
inc rsi
mov rbp, qword [rsp + 0x38]
and sil, 0xf4
bsf si, di
mov rsi, qword [rsp + 0x40]
bsf r14w, r15w
bt r14w, di
sal dil, cl
mov rdi, qword [rsp + 0x48]
neg r14b
movzx r14w, r8b
add rsp, 0x20
pop r14
jmp 0x1404cb8ab
ret
Function at 0x1404d068f
Capabilities:
Get thread local storage value

Disassembly:
push rbx
movsxd rbx, esp
sub rsp, 0x20
mov ebx, ecx
sets dh
movzx edx, bx
movsx r9w, sil
lea r9, [0x1400c63d0]
mov ecx, 5
mov dx, r14w
movzx r8d, sp
lea r8, [0x1400c63c8]
movsx edx, ax
lea rdx, [0x1400cf758]
jmp 0x1404d06cf
call fcn.1404d1560
mov ecx, ebx
test rax, rax
jmp 0x1404d06de
je 0x1404d06f8
add rsp, 0x20
movzx ebx, ax
pop rbx
jmp 0x1404d06f1
push qword [0x1400b8d90]
ret
add rsp, 0x20
not rbx
pop rbx
jmp 0x1404d0705
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404d070c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
adc bl, r15b
push rdi
sub bl, 0x93
sub rsp, 0x20
cmovns bx, bx
movsxd r8, ebx
mov rbx, rdx
not edx
lea r9, [0x1400c63d8]
mov edi, ecx
lea rdx, [0x1400cf748]
movsx r8d, bp
jmp 0x1404d0741
mov ecx, 6
movzx r8w, r13b
movsx r8w, dl
movzx r8, ax
lea r8, [0x1400c63d0]
jmp 0x1404d0760
call fcn.1404d1560
mov rdx, rbx
mov ecx, edi
stc
cmp spl, bl
test rax, rax
je 0x1404d0782
call qword [case.0x14044e461.0]
jmp 0x1404d0788
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movzx di, r8b
add rsp, 0x20
movzx di, sil
bswap edi
pop rdi
ret

Function at 0x1404d0916
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xor bh, dh
shrd bx, r15w, 0x94
not rbx
mov qword [rsp + 0x18], rsi
btc ebx, r9d
push rdi
bts bp, di
movzx bp, r14b
movsx si, cl
sub rsp, 0x30
mov di, 0x165b
mov ebx, r9d
movzx r9d, bx
setge r9b
mov rdi, r8
movzx bp, r13b
bswap r8d
mov esi, edx
bswap r9w
movsx r9d, ax
not dl
lea r9, [0x1400c63e8]
xchg bpl, dl
movzx r8w, bl
mov bpl, al
mov rbp, rcx
lea r8, [0x1400c63e0]
cqo
not dl
lea rdx, [0x1400cf190]
bswap rcx
movsx rcx, bp
movsx cx, al
mov ecx, 0xb
call fcn.1404d1560
mov rcx, rbp
test rax, rax
je 0x1404d09d4
mov r9d, ebx
movsx r8w, r14b
mov r8, rdi
movsxd rdx, r9d
mov edx, esi
jmp 0x1404d09c9
call qword [case.0x14044e461.0]
jmp 0x1404d09f9
sub edx, edx
jmp 0x1404d09db
call fcn.1404d104a
mov ecx, eax
movzx r8, r14w
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x1404d09f3
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
sar rbp, 0xb9
rcr sil, cl
stc
mov rbp, qword [rsp + 0x48]
rol dil, 0xed
rol sil, cl
adc di, r11w
mov rsi, qword [rsp + 0x50]
test r10b, r11b
add rsp, 0x30
mov rdi, r8
cmovl di, r15w
pop rdi
jmp 0x1404d0a30
ret
Function at 0x1404d3d78
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
cmp r11w, cx
cmc
clc
push rdi
sub rsp, 0x70
not dil
movsx edi, sp
movzx rbx, bp
mov rsi, rdx
cmovns bx, r15w
movsx rbx, r10w
mov rbx, r9
mov rdx, rcx
seta cl
movsx edi, si
mov edi, r8d
lea rcx, [rsp + 0x50]
jmp 0x1404d3dbc
call fcn.1404aa23f
mov eax, dword [rsp + 0xc0]
lea rcx, [rsp + 0x58]
cwd
mov r9b, r15b
mov dword [rsp + 0x40], eax
rdtsc
bswap edx
mov r9, rbx
bswap r8
rdtsc
mov eax, dword [rsp + 0xb8]
mov r8d, edi
movsxd rdx, r15d
bswap edx
movsx dx, r12b
mov dword [rsp + 0x38], eax
lahf
bswap eax
mov rdx, rsi
movsxd rax, ebx
movzx rax, ax
mov eax, dword [rsp + 0xb0]
jmp 0x1404d3e13
mov dword [rsp + 0x30], eax
xchg ah, ah
mov rax, qword [rsp + 0xa8]
jmp 0x1404d3e26
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xa0]
jmp 0x1404d3e37
mov dword [rsp + 0x20], eax
jmp 0x1404d3e40
call fcn.1404d3e92
cmp byte [rsp + 0x68], 0
jmp 0x1404d3e4f
je 0x1404d3e6e
mov rcx, qword [rsp + 0x50]
and dword [rcx + 0x3a8], 0xfffffffd
mov dil, 8
movsx r11w, spl
jmp 0x1404d3e6e
lea r11, [rsp + 0x70]
xchg rdi, rsi
mov rbx, qword [r11 + 0x10]
setne sil
mov rsi, qword [r11 + 0x18]
mov rsp, r11
bswap rdi
not dil
pop rdi
jmp 0x1404d3e91
ret
Function at 0x1404d45bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r12b, r10b
or ecx, 0xcfc7a6c
bsf cx, r8w
mov qword [rax + 8], rbx
dec ch
btc cx, sp
adc cl, r8b
mov qword [rax + 0x10], rbp
sub cx, 0x7c12
shrd ecx, r14d, 0x31
mov qword [rax + 0x18], rsi
sar cl, 0xe9
mov qword [rax + 0x20], rdi
xadd ecx, ecx
add cl, 9
mov ecx, ebx
push r14
ror rcx, cl
bsr rcx, rax
xor cx, r11w
sub rsp, 0x90
lea rcx, [rax - 0x78]
jmp 0x1404d4618
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
sub r14d, r14d
test r15d, ebp
cmp word [rsp + 0x62], r14w
jmp 0x1404d462f
je 0x1404d476d
mov rax, qword [rsp + 0x68]
cmp r14, r15
test rax, rax
jmp 0x1404d4645
je 0x1404d476d
movsxd rbx, dword [rax]
bsf rcx, rax
lea rsi, [rax + 4]
add dil, 0x94
shr dil, 0x2b
sub cl, r14b
mov edi, 0x2000
lea rbx, [rbx + rsi]
sal ch, cl
cmp dword [rax], edi
movzx cx, r8b
cmovl edi, dword [rax]
movzx cx, r15b
mov ecx, edi
jmp 0x1404d4682
call fcn.1400ada04
cmp edi, dword [0x1400bad40]
jmp 0x1404d4692
cmovg edi, dword [0x1400bad40]
clc
test edi, edi
je 0x1404d476d
mov ebp, r14d
cmp r13d, 0x9104fd0
cmp qword [rbx], 0xffffffffffffffff
je 0x1404d474a
cmp qword [rbx], 0xfffffffffffffffe
jmp 0x1404d46bf
je 0x1404d474a
test byte [rsi], 1
jmp 0x1404d46cd
je 0x1404d474a
test byte [rsi], 8
jmp 0x1404d46db
jne 0x1404d46fc
mov rcx, qword [rbx]
jmp 0x1404d46e9
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jmp 0x1404d46f6
je 0x1404d474a
mov rax, rbp
xadd ecx, edx
bt cx, 0xce
sub dx, r13w
lea r8, [0x1400ba940]
btc dx, r9w
mov rcx, rbp
movzx dx, dil
sar rcx, 6
sbb dh, dl
and eax, 0x3f
movsx dx, r13b
mov rcx, qword [r8 + rcx*8]
cqo
lea rdx, [rax + rax*8]
mov rax, qword [rbx]
mov qword [rcx + rdx*8 + 0x28], rax
mov al, byte [rsi]
jmp 0x1404d4746
mov byte [rcx + rdx*8 + 0x38], al
inc rbp
jmp 0x1404d4752
inc rsi
cmp spl, 5
add rbx, 8
stc
sub rdi, 1
jmp 0x1404d4767
jne 0x1404d46ac
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
movzx di, r13b
seta r14b
movsx rsi, bx
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
xchg di, r14w
movsx r14d, r15w
seto dil
mov rdi, qword [r11 + 0x28]
movsx r14d, r15w
not r14b
mov rsp, r11
pop r14
jmp 0x1404d47af
ret
Function at 0x1404d8376
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
movsx eax, cx
mov qword [r11 + 8], rbx
btr rax, 0xf4
or ax, bx
mov qword [r11 + 0x10], rbp
bt ebp, 0xea
neg eax
shrd bp, r10w, 0x6e
mov qword [r11 + 0x18], rdi
ror rdi, cl
push r14
bts ax, r10w
xor di, 0x3ace
sub rsp, 0x50
cbw
mov rax, qword [rsp + 0x80]
movzx edi, r10w
mov rbp, r8
mov r8b, cl
movsx rdi, bp
jmp 0x1404d83cc
mov rcx, qword [rcx]
movzx r8d, ax
movsx rdi, r12w
lea r8, [r11 - 0x18]
movsx di, dl
bswap di
mov rdi, rbx
mov rdi, rdx
movsx dx, r13b
xchg dh, dh
mov qword [r11 - 0x38], rax
setns dh
mov dl, spl
movzx edx, bp
mov edx, dword [rsp + 0x88]
jmp 0x1404d8408
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x1404d8415
call fcn.1404e7a44
mov r14d, dword [rsp + 0x44]
movsx rdx, r8w
bswap bx
xor r8d, r8d
movzx r9w, spl
cmp r11w, cx
cmp dword [rsp + 0x40], 0x2d
mov r9d, eax
mov eax, dword [rsp + 0xa0]
movzx dx, r9b
mov rdx, rbp
movsx rcx, ax
sete r8b
mov dword [rsp + 0x28], eax
shr ch, 0xb6
sub rcx, r8
xor ecx, 0x41c310b8
sub rdx, r8
setg ch
mov ebx, ebx
movzx rbx, r10w
mov dword [rsp + 0x20], r9d
dec r14d
lea r9, [rsp + 0x40]
dec rbx
sal cl, cl
shr bh, cl
cmp rbp, 0xffffffffffffffff
movzx ecx, bx
movsx cx, bl
movzx cx, sil
lea rbx, [r8 + rdi]
mov r8b, r9b
movsx r8, r14w
mov r8d, dword [rsp + 0x88]
jmp 0x1404d84af
cmove rdx, rbp
movzx ecx, bp
mov ecx, edi
movzx rcx, r12w
mov rcx, rbx
jmp 0x1404d84c4
call fcn.1404e7759
test eax, eax
jmp 0x1404d84d0
je 0x1404d84e3
mov byte [rdi], 0
jmp 0x1404d84de
jmp 0x1404d85ed
mov eax, dword [rsp + 0x44]
jmp 0x1404d84ec
dec eax
cmp r13b, r12b
test dl, 0xf1
cmp eax, 0xfffffffc
jl 0x1404d8580
cmp eax, dword [rsp + 0x88]
jmp 0x1404d8509
jge 0x1404d8580
cmp r14d, eax
jmp 0x1404d8517
jge 0x1404d8535
mov al, byte [rbx]
inc rbx
test bl, r10b
test al, al
jmp 0x1404d852c
jne 0x1404d851d
mov byte [rbx - 2], al
mov rax, qword [rsp + 0xa8]
mov r8b, 0x22
jmp 0x1404d8545
lea r9, [rsp + 0x40]
movsx rdx, cx
movzx r8d, si
not edx
mov r8d, dword [rsp + 0x88]
mov cl, 0x8a
mov rdx, rbp
movsxd rcx, ebx
mov qword [rsp + 0x28], rax
mov rcx, rdi
jmp 0x1404d8571
mov byte [rsp + 0x20], 1
call fcn.1404d8059
jmp 0x1404d85ed
mov rax, qword [rsp + 0xa8]
movzx ecx, dx
mov rdx, rbp
mov r9b, byte [rsp + 0x90]
setbe r8b
movsx r8d, r15w
mov rcx, rdi
xchg r8w, r8w
movsx r8w, bpl
mov r8d, dword [rsp + 0x88]
mov qword [rsp + 0x38], rax
movsx ax, r8b
movsx rax, sp
lea rax, [rsp + 0x40]
jmp 0x1404d85ca
mov byte [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
cmovnp eax, r14d
mov eax, dword [rsp + 0x98]
jmp 0x1404d85e4
mov dword [rsp + 0x20], eax
call fcn.1404d7055
mov rbx, qword [rsp + 0x60]
add r14b, 0
movzx ebp, si
mov rbp, qword [rsp + 0x68]
and r14b, 0xa3
and dil, spl
shl r14b, 0x84
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
jmp 0x1404d8619
ret
Function at 0x1404dc764
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
ror bl, 0x40
btr bx, 0xa2
stc
push rdi
bsf bx, cx
movzx ebx, r8w
sub rsp, 0x20
movsx rbx, r13w
mov rbx, rcx
jmp 0x1404dc78b
call fcn.1404cf477
or r8, 0xffffffffffffffff
cwd
mov r9, r8
jmp 0x1404dc79e
sub edi, edi
cqo
lea rdx, [rax + 0x98]
mov ax, bx
cbw
mov ax, 0x4239
mov rax, qword [rdx]
inc r9
cmp r14w, 0x4a02
cmp bp, sp
cmp word [rax + r9*2], di
jmp 0x1404dc7cb
jne 0x1404dc7b5
mov eax, edi
cmp r9, 3
sete al
jmp 0x1404dc7df
mov dword [rdx + 0x18], eax
mov rax, qword [rdx + 8]
jmp 0x1404dc7eb
inc r8
cmp r12b, r8b
cmp word [rax + r8*2], di
jmp 0x1404dc7fb
jne 0x1404dc7eb
cmp r8, 3
not r8b
lahf
jmp 0x1404dc80e
mov eax, edi
not al
mov r8d, 2
sete al
sete al
mov dword [rdx + 0x1c], eax
test bpl, r13b
cmp r11, rbx
jmp 0x1404dc82c
mov dword [rbx + 4], edi
cmp dword [rdx + 0x18], edi
jmp 0x1404dc837
jne 0x1404dc8ac
mov rcx, qword [rdx]
sal r10d, 0x3a
lahf
rcr r10w, cl
mov r10d, edi
btr ax, di
shl r9b, cl
movzx r9d, word [rcx]
add ax, r15w
add rcx, r8
lea eax, [r9 - 0x41]
test ax, 0x6df6
jmp 0x1404dc871
cmp ax, 0x19
jmp 0x1404dc87a
jbe 0x1404dc895
sub r9w, 0x61
cmp r9w, 0x19
jmp 0x1404dc88f
ja 0x1404dc8a2
inc r10d
jmp 0x1404dc89d
jmp 0x1404dc853
mov r8d, r10d
cmovg ecx, r11d
bswap rcx
mov dword [rdx + 0x14], r8d
movzx dx, r11b
movzx edx, r12w
bswap rdx
lea rcx, [0x1400abdd4]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov ecx, dword [rbx]
shl al, 0x78
xor dl, r12b
test cl, 7
mov dl, r15b
setne dl
setbe al
mov al, 0xa0
bt ecx, 9
setb al
and dl, al
mov al, r12b
xchg al, al
bt ecx, 8
xchg al, al
setb al
stc
cmp r10w, r15w
test al, dl
jne 0x1404dc914
mov dword [rbx], edi
add edi, 0x51ef2eaa
movsxd rdi, edx
stc
mov rbx, qword [rsp + 0x30]
cmc
cmp r10b, r13b
add rsp, 0x20
bswap rdi
movsx edi, ax
pop rdi
ret
Function at 0x1404dd302
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
add bl, bh
cmp r15b, spl
btc ebx, ebp
mov qword [rsp + 0x18], rsi
push rdi
movzx di, al
movsx di, r15b
bt rdi, 0x57
sub rsp, 0x20
adc dil, al
and dil, 0xa6
sub esi, esi
mov rdi, rdx
shl bh, 0x23
cmp r15b, r14b
btr rbx, r8
mov rbx, rcx
stc
test rcx, rcx
je 0x1404dd3f2
cmp word [rcx], si
jmp 0x1404dd352
je 0x1404dd3f2
lea rdx, [0x1400d1d08]
jmp 0x1404dd364
call fcn.14028ca18
test eax, eax
jmp 0x1404dd370
je 0x1404dd3f2
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404dd385
call fcn.14028ca18
test eax, eax
jmp 0x1404dd391
jne 0x1404dd3e0
mov ecx, dword [rdi + 8]
cmovg dx, di
cdq
setne r8b
lea r9d, [rsi + 2]
mov edx, 0x79db4d52
lea r8, [rsp + 0x30]
movzx dx, bpl
cdq
seto dl
mov edx, 0x2000000b
jmp 0x1404dd3c4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404dd427
mov eax, dword [rsp + 0x30]
jmp 0x1404dd3db
jmp 0x1404dd44a
mov rcx, rbx
jmp 0x1404dd3e8
call fcn.1404e6448
jmp 0x1404dd44a
mov ecx, dword [rdi + 8]
cmovnp rdx, r15
mov dh, 0x7e
movsxd rdx, eax
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404dd414
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dd421
jne 0x1404dd433
sub eax, eax
jmp 0x1404dd42e
jmp 0x1404dd44a
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x1404dd43e
jne 0x1404dd44a
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
bts edi, r14d
movsx edi, r12w
dec di
add rsp, 0x20
jmp 0x1404dd46e
pop rdi
jmp 0x1404dd474
ret

Function at 0x1404dd475
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
movsx si, spl
push rdi
test r14d, 0x5147d01
cmp rsp, r15
sal sil, cl
sub rsp, 0x20
mov esi, edx
xchg bx, bx
movsx bx, al
jmp 0x1404dd4a4
mov ebx, ecx
call fcn.1404cf477
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
not dx
clc
cwd
bts ecx, 0xa
movzx edx, r12w
setp dl
xchg dl, dil
mov edx, 0x20000001
mov dil, r10b
mov rdi, rax
jmp 0x1404dd4e2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
stc
cmp r10b, r13b
test eax, eax
je 0x1404dd5a3
cmp ebx, dword [rsp + 0x30]
jmp 0x1404dd500
je 0x1404dd599
test esi, esi
jmp 0x1404dd50d
je 0x1404dd599
mov r9, qword [rdi + 0x98]
mov r8d, r10d
movzx edx, word [r9]
shrd rax, r8, 0xbf
shr cl, cl
rcl cl, cl
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
clc
cmp ax, 0x19
jmp 0x1404dd53b
jbe 0x1404dd558
sub dx, 0x61
cmp r14b, dil
stc
cmp dx, 0x19
jmp 0x1404dd552
ja 0x1404dd56c
movzx edx, word [rcx]
jmp 0x1404dd560
inc r8d
add rcx, 2
jmp 0x1404dd52e
or rcx, 0xffffffffffffffff
jmp 0x1404dd575
inc rcx
test r8b, r12b
cmp word [r9 + rcx*2], r10w
jmp 0x1404dd585
jne 0x1404dd575
cmp r8d, ecx
jmp 0x1404dd593
je 0x1404dd5a3
mov eax, 1
jmp 0x1404dd5a8
sub eax, eax
movsxd rdi, ebp
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sar rdi, 0x26
adc dil, r10b
add rsp, 0x20
movzx rdi, bx
pop rdi
jmp 0x1404dd5c7
ret
Function at 0x1404dec88
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
cmp r9b, 0x3f
mov qword [rax + 0x20], rdi
cmc
push r14
cmp rdx, r12
stc
sub rsp, 0x40
jmp 0x1404decb0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
mov rbx, rax
test r12w, r11w
test rax, rax
jmp 0x1404decc8
je 0x1404dee4b
mov rsi, rax
cmp r13b, 0xc0
cmp word [rax], r14w
jmp 0x1404decde
je 0x1404ded21
or rax, 0xffffffffffffffff
jmp 0x1404deced
inc rax
cmp ebx, 0x2bff264c
cmp word [rsi + rax*2], r14w
jne 0x1404deced
lea rsi, [rsi + rax*2]
cmp r15b, bl
cmc
jmp 0x1404ded0e
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404ded1b
jne 0x1404dece4
mov qword [rsp + 0x38], r14
sub rsi, rbx
test rcx, 0x6ff750ab
stc
rol r9w, 0x44
mov qword [rsp + 0x30], r14
movsx r8, ax
shl r9b, cl
btr r8, r13
add rsi, 2
mov r9w, 0x1e51
shr r9b, 0x36
bts r8w, r9w
sar rsi, 1
mov r8, rbx
mov r9d, esi
cmp r13b, 0x96
stc
cmp bpl, r8b
mov dword [rsp + 0x28], r14d
xor edx, edx
stc
cmp r14w, 0x7f8e
mov qword [rsp + 0x20], r14
test r10b, 0xb2
stc
xor ecx, ecx
jmp 0x1404ded88
call fcn.1404cf280
movsxd rbp, eax
test r11, rsi
test eax, eax
jmp 0x1404ded9a
je 0x1404dee4b
mov rcx, rbp
jmp 0x1404deda8
call fcn.1404cf1c4
mov rdi, rax
test rax, rax
jmp 0x1404dedb8
je 0x1404dee31
mov qword [rsp + 0x38], r14
bts r9d, esi
adc r8d, 0x586c567c
sbb r9, 0x44672e06
mov r9d, esi
mov qword [rsp + 0x30], r14
shr r8b, cl
mov r8, rbx
jmp 0x1404dede8
mov dword [rsp + 0x28], ebp
cmp r15b, r15b
clc
xor edx, edx
cmc
stc
cmp r14b, al
xor ecx, ecx
jmp 0x1404dedfe
mov qword [rsp + 0x20], rax
jmp 0x1404dee08
call fcn.1404cf280
test eax, eax
jmp 0x1404dee14
je 0x1404dee31
mov rsi, rdi
cmove edi, r15d
not di
mov rdi, r14
jmp 0x1404dee2c
jmp 0x1404dee39
mov rsi, r14
jmp 0x1404dee39
mov rcx, rdi
jmp 0x1404dee41
call fcn.1404cf14b
jmp 0x1404dee4e
mov rsi, r14
test rbx, rbx
jmp 0x1404dee56
je 0x1404dee65
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
dec bpl
jmp 0x1404dee72
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
shl r14b, 0x74
add rsp, 0x40
not r14b
mov r14w, 0x2a26
pop r14
jmp 0x1404dee9b
ret
Function at 0x1404dee9c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
stc
mov qword [rsp + 0x10], rbp
jmp 0x1404deeb3
mov qword [rsp + 0x18], rsi
clc
push rdi
sub rsp, 0x20
jmp 0x1404deec3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
stc
test esp, 0x4af70841
test rax, rax
jmp 0x1404deedd
je 0x1404defb8
mov rbp, rax
jmp 0x1404deeeb
cmp word [rax], si
jmp 0x1404deef3
je 0x1404def2d
or rax, 0xffffffffffffffff
jmp 0x1404def02
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404def0f
jne 0x1404def02
lea rbp, [rbp + rax*2]
stc
add rbp, 2
cmp cl, 3
clc
cmp word [rbp], si
jne 0x1404deef9
sub rbp, rbx
xor rcx, 0x1f0d53f3
add rbp, 2
shl ecx, cl
sar cl, cl
not cl
sar rbp, 1
sbb cx, 0x3f8
add rbp, rbp
jmp 0x1404def54
mov rcx, rbp
jmp 0x1404def5c
call fcn.1404cf1c4
mov rdi, rax
stc
jmp 0x1404def6a
test rax, rax
jmp 0x1404def72
je 0x1404def9e
mov r8, rbp
movzx cx, r13b
movsx rdx, sp
mov rdx, rbx
movsx cx, r11b
movzx ecx, cx
mov rcx, rax
call fcn.1404a922d
mov rsi, rdi
test sp, r12w
xor ecx, ecx
jmp 0x1404defa5
call fcn.1404cf14b
mov rcx, rbx
jmp 0x1404defb2
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
bt ax, 0xb0
sal bpl, cl
mov rax, rsi
bsf si, bx
mov rsi, qword [rsp + 0x40]
shr bp, cl
shr bpl, 0xaf
stc
mov rbp, qword [rsp + 0x38]
or dil, sil
mov dil, 0xdd
dec edi
add rsp, 0x20
not dil
pop rdi
jmp 0x1404deff3
ret
Function at 0x1404e1eb7
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
bswap ax
mov qword [rsp + 0x18], rbp
bswap ax
push rsi
movsx eax, r15w
push rdi
push r14
setne ah
bswap eax
mov eax, 0x1450
jmp 0x1404e1ee4
call fcn.14044e565
sub rsp, rax
lahf
setle sil
mov rax, qword [0x1400b7288]
bsf bp, r10w
xor rax, rsp
shrd esi, edx, 4
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
test dil, bl
mov rax, r10
mov ebp, r9d
mov esi, r14d
sar rax, 6
and ecx, eax
lea rcx, [0x1400ba940]
and r10d, 0x3f
or r14, 0x56d55ed6
bts si, r13w
bt r14w, r8w
add rbp, r8
xor r14b, 0x42
rol r14, 0x1a
mov rsi, r8
mov rax, qword [rcx + rax*8]
bsr dx, r10w
lea rdx, [r10 + r10*8]
bt r14, r11
ror r14b, cl
sub r14w, 0x6ed5
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
mov qword [rdi], rax
cmp r8b, 0x60
test di, 0x3577
stc
mov dword [rdi + 8], eax
cmc
cmp r8b, 0x6f
cmp r8, rbp
jmp 0x1404e1f8c
jae 0x1404e207f
lea rbx, [rsp + 0x40]
jmp 0x1404e1f9f
cmp rsi, rbp
jmp 0x1404e1fa7
jae 0x1404e1ff7
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jmp 0x1404e1fb9
jne 0x1404e1fd2
inc dword [rdi + 8]
jmp 0x1404e1fc7
mov byte [rbx], 0xd
jmp 0x1404e1fcf
inc rbx
mov byte [rbx], al
dec ah
inc rbx
stc
lea rax, [rsp + 0x143f]
cmp r14, rsi
test r9b, 0xb2
cmp rbx, rax
jmp 0x1404e1ff1
jb 0x1404e1f9f
and qword [rsp + 0x20], 0
cbw
lea rax, [rsp + 0x40]
rcl r9w, 0xa
movsx r8, bx
bsr cx, r8w
sub ebx, eax
movsxd rdx, r11d
mov edx, ebx
movsx r9, r11w
lea r9, [rsp + 0x30]
mov r8d, ebx
movsx dx, r13b
lea rdx, [rsp + 0x40]
bswap ecx
cmovo cx, bx
mov cx, 0x6c20
mov rcx, r14
jmp 0x1404e2041
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404e2077
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmc
cmp eax, ebx
jmp 0x1404e205e
jb 0x1404e207f
cmp rsi, rbp
jmp 0x1404e206c
jb 0x1404e1f92
jmp 0x1404e207f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
xor ch, 0xac
test dh, 0x4a
mov rcx, qword [rsp + 0x1440]
clc
xor rcx, rsp
jmp 0x1404e2099
call fcn.1404a55f8
lea r11, [rsp + 0x1450]
movsx r14w, sil
mov rbx, qword [r11 + 0x20]
movzx ebp, di
cmovl bp, bp
mov rbp, qword [r11 + 0x30]
movsx edi, r14w
bswap esi
mov rsp, r11
mov di, r9w
pop r14
pop rdi
not rsi
cmovns si, ax
pop rsi
jmp 0x1404e20d7
ret