joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404ad506
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
and rbx, 0x14d34ec0
sbb bl, 0x26
sar bh, cl
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
not bl
cmp r9b, 0xcc
push rdi
jmp 0x1404ad535
sub rsp, 0x30
and bh, 0x36
test r15b, r9b
xor ebp, ebp
movzx ebx, r13w
shld bx, dx, 0x24
rol rbx, 0xac
mov rbx, rcx
cmp ah, ch
jmp 0x1404ad558
cmp byte [rcx + 0x54], bpl
jne 0x1404ad66f
cmp dword [rcx + 0x50], ebp
jmp 0x1404ad56a
jle 0x1404ad66f
mov rsi, qword [rcx + 0x48]
mov edi, ebp
movsxd rax, r9d
movsx rax, bp
mov r9, qword [rbx + 8]
xchg cl, r8b
not al
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], bp
setge r8b
cdq
mov rdx, rsi
mov rax, qword [r9]
movsxd r8, dword [rax + 8]
jmp 0x1404ad5a4
call fcn.1404ce990
movsxd r8, eax
cmc
cmp r13b, 0xf9
test eax, eax
jle 0x1404ad661
mov rcx, qword [rbx + 0x468]
movzx edx, word [rsp + 0x40]
neg al
bt ax, dx
mov rax, qword [rcx + 8]
jmp 0x1404ad5d7
cmp qword [rcx + 0x10], rax
jne 0x1404ad60b
cmp byte [rcx + 0x18], bpl
jmp 0x1404ad5ea
je 0x1404ad5fd
inc dword [rbx + 0x28]
jmp 0x1404ad5f8
jmp 0x1404ad643
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ad606
jmp 0x1404ad643
inc dword [rbx + 0x28]
lahf
cbw
inc qword [rcx + 0x10]
cdqe
mov rax, qword [rbx + 0x468]
mov rcx, qword [rax]
mov word [rcx], dx
ror al, 0x8e
mov rax, qword [rbx + 0x468]
test r9w, 0x2c79
test al, r13b
cmp r10, rdx
add qword [rax], 2
test si, 0x1905
add rsi, r8
jmp 0x1404ad64b
inc edi
clc
cmp edi, dword [rbx + 0x50]
jmp 0x1404ad656
jne 0x1404ad57d
jmp 0x1404ad6ae
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ad66a
jmp 0x1404ad6ae
mov r8d, dword [rbx + 0x50]
test r8w, 0x46fb
movsx rdx, r11w
cqo
lea rax, [rcx + 0x10]
mov rdx, qword [rbx + 0x48]
shl r9d, 0xc0
lea r9, [rcx + 0x28]
cmp bpl, 0x9d
add rcx, 0x468
jmp 0x1404ad69f
mov qword [rsp + 0x20], rax
jmp 0x1404ad6a9
call fcn.1404ab97a
mov rbx, qword [rsp + 0x48]
btr si, 0x79
mov al, 1
xadd sil, bpl
btc rdi, 0xf2
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
sub rdi, 0x4a34890
movsx rdi, bp
add rsp, 0x30
movzx di, r14b
pop rdi
jmp 0x1404ad6e7
ret
Function at 0x1404adfb2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x1404ae0c2
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
bswap eax
xor r10d, 0x39c975b7
ror dil, cl
mov r10d, dword [r9]
sbb dil, r11b
stc
setne al
mov dil, dl
movsx ebx, r15w
mov rbx, rcx
bswap ax
btc edx, 0xae
xor r11d, r11d
mov rdx, qword [rbx]
mov rax, qword [rdx + 8]
cmc
cmp qword [rdx + 0x10], rax
jmp 0x1404ae000
jne 0x1404ae02e
cmp byte [rdx + 0x18], 0
jmp 0x1404ae00f
je 0x1404ae01d
inc r10d
jmp 0x1404ae026
or r10d, 0xffffffff
jmp 0x1404ae026
mov dword [r9], r10d
jmp 0x1404ae08b
lea eax, [r10 + 1]
movzx r10, r15w
mov ecx, 0x827622b
mov dword [r9], eax
jmp 0x1404ae048
mov rax, qword [rbx]
dec rcx
cmovns r10w, r10w
inc qword [rax + 0x10]
lahf
mov rax, qword [rbx]
bswap cx
not r10d
movzx cx, r13b
mov rcx, qword [rax]
setl al
mov byte [rcx], dil
cdqe
movsx ax, r8b
movzx eax, bp
mov rax, qword [rbx]
inc qword [rax]
bt r10w, bp
mov r10d, dword [r9]
clc
test r15b, spl
cmp r10d, 0xffffffff
je 0x1404ae0ac
inc r11d
jmp 0x1404ae09e
cmp r11d, r8d
jmp 0x1404ae0a6
jl 0x1404adfef
mov rbx, qword [rsp + 8]
movzx di, r11b
not edi
mov rdi, qword [rsp + 0x10]
jmp 0x1404ae0c2
ret

Function at 0x1404af1ae
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
bsr si, sp
or rsi, 0x1f6c41f5
shld si, cx, 0xf4
push rdi
sub rsp, 0x30
and dil, 0x1f
mov edi, edx
seto sil
bswap si
mov rsi, rcx
cmp r12b, 0xd5
test r8, r8
jmp 0x1404af1e9
jne 0x1404af20b
call fcn.1404b3a01
mov dword [rax], 0x16
call fcn.1404b4719
sub eax, eax
jmp 0x1404af206
jmp 0x1404af310
mov rdx, r9
movzx rcx, r14w
mov rcx, r8
jmp 0x1404af21a
call fcn.1404af371
mov rbx, rax
test rax, rax
jmp 0x1404af22a
je 0x1404af2ae
lea rax, [rsp + 0x50]
mov rcx, r15
mov rdx, rdi
not r9w
bswap r9d
movzx r8w, r11b
mov qword [rsp + 0x28], rax
movsx rax, di
lea r8, [0x140094b24]
seta cl
mov eax, dword [rsp + 0x60]
xchg r9w, r9w
bswap rcx
mov r9, rbx
movsx ecx, r13w
movsx cx, al
mov rcx, rsi
jmp 0x1404af278
mov dword [rsp + 0x20], eax
jmp 0x1404af281
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
jmp 0x1404af293
test rax, rax
jmp 0x1404af29b
jne 0x1404af32d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404b3a89
sub edi, edi
cmc
cmp r11w, 0x414
test rbx, rbx
jmp 0x1404af2bf
je 0x1404af306
mov rcx, qword [rbx + 0x10]
stc
jmp 0x1404af2cf
test rcx, rcx
jmp 0x1404af2d7
je 0x1404af2e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmp r9b, dil
test rcx, rcx
je 0x1404af2f9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404af301
call fcn.1404c761b
mov rax, rdi
movzx edi, ax
movsx rbx, r10w
mov rbx, qword [rsp + 0x40]
neg dil
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
jmp 0x1404af326
pop rdi
jmp 0x1404af32c
ret
mov rcx, qword [rsp + 0x68]
cmc
stc
test rcx, rcx
jmp 0x1404af33c
je 0x1404af351
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
test cl, 0xaf
cmp rsi, r10
test bp, cx
xor ebx, ebx
jmp 0x1404af358
jmp 0x1404af2b7
Function at 0x1404af60f
Capabilities:
Get number of processors
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmovle bx, ax
mov ebx, ecx
jmp 0x1404af620
call fcn.1404d0ce8
cmp eax, 1
jmp 0x1404af62d
je 0x1404af671
mov rax, qword gs:[0x60]
movzx rdx, r9w
mov edx, dword [rax + 0xbc]
shr edx, 8
cmc
clc
test dl, 1
jmp 0x1404af653
jne 0x1404af671
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dl, 0xb8
movzx rdx, bp
cdq
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404af678
call fcn.1404af56c
mov ecx, ebx
jmp 0x1404af684
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b1e3f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
clc
mov qword [rsp + 0x10], rsi
cmp bpl, 0xe8
mov qword [rsp + 0x18], rdi
movzx di, cl
neg dil
ror dil, cl
push r14
shld r14w, bp, 0xcb
bt r14w, 0x5e
movzx r14w, r11b
sub rsp, 0x20
shl r14b, 0x50
ror r14b, cl
movsx rdi, bx
sub ebx, ebx
mov rdi, rdx
bsf r14w, r12w
mov r14, rcx
stc
test rdx, rdx
jmp 0x1404b1e95
je 0x1404b1f0b
movzx esi, word [r14 + rbx*2]
jmp 0x1404b1ea5
call fcn.1404a92c7
mov rdx, rax
and ax, 0x43e5
bswap eax
sal ah, cl
mov eax, 0xff
cmp r13w, r10w
test r8, rax
cmp si, ax
jmp 0x1404b1ec9
ja 0x1404b1ee0
movzx ecx, word [rdx + rsi*2]
cmc
stc
and ecx, 0x103
jmp 0x1404b1ee7
xor ecx, ecx
jmp 0x1404b1ee7
test ecx, ecx
jmp 0x1404b1eee
je 0x1404b1f44
inc rbx
stc
cmc
cmp r12w, dx
cmp rbx, rdi
jmp 0x1404b1f05
jb 0x1404b1e9b
mov al, 1
xor r14b, r13b
movsx r14, dx
btc r14w, 0x67
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
rol r14b, 0xa2
test dx, r15w
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
movzx r14, r13w
movsxd r14, edi
pop r14
jmp 0x1404b1f43
ret
sub al, al
jmp 0x1404b1f4b
jmp 0x1404b1f1a

Function at 0x1404b47b4
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
setnp cl
mov ecx, 0x17
jmp 0x1404b47c5
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b47d2
je 0x1404b47e9
mov ecx, 5
jmp 0x1404b47e2
int 0x29
jmp 0x1404b47e9
mov r8d, 1
movzx ecx, r9w
setne dh
movsx ecx, sp
mov edx, 0xc0000417
mov cl, r12b
mov rcx, 0x517720e3
setg cl
lea ecx, [r8 + 1]
jmp 0x1404b4814
call fcn.1404b484c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
bt edx, 0x3c
movzx edx, si
mov edx, 0xc0000417
cmp r13b, r9b
cmp rsi, 0x5fb0966
test r9w, si
add rsp, 0x28
jmp 0x1404b4845
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404c8b89
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sbb r8w, 0x5925
shld rbx, r12, 0x13
movsx r8, sp
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1400c63c0]
mov ecx, 3
cdq
lea r8, [0x1400c63b8]
lea rdx, [0x1400cfb70]
jmp 0x1404c8bc1
call fcn.1404c9bd6
test rax, rax
jmp 0x1404c8bce
je 0x1404c8bf0
mov rcx, rbx
add rsp, 0x20
movsx ebx, r9w
movzx rbx, dx
pop rbx
jmp 0x1404c8be9
jmp qword [0x1400b8d90]
add rsp, 0x20
xchg bl, bh
pop rbx
jmp 0x1404c8bfc
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404c8c88
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rdx, r8d
xchg r9w, dx
mov ebx, ecx
cqo
lea r9, [0x1400c63d0]
movzx rdx, bx
mov dx, si
mov ecx, 5
lea r8, [0x1400c63c8]
movsxd rdx, esi
movzx edx, di
lea rdx, [0x1400cf758]
call fcn.1404c9bd6
mov ecx, ebx
cmp ah, al
test rax, rax
jmp 0x1404c8cd1
je 0x1404c8ce8
add rsp, 0x20
pop rbx
jmp 0x1404c8ce1
jmp qword [0x1400b8d90]
add rsp, 0x20
not bh
setae bl
pop rbx
jmp 0x1404c8cf7
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c8cfe
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9w, r8b
mov r9w, r13w
movzx r9, bx
mov rbx, rdx
movzx r9d, sp
cwd
lea r9, [0x1400c63d8]
setne r8b
mov edi, ecx
lea rdx, [0x1400cf748]
cmovbe rcx, rbx
xchg rcx, rcx
movsx cx, r14b
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404c8d4f
call fcn.1404c9bd6
mov rdx, rbx
movzx rcx, di
shl ch, cl
sbb rcx, rax
mov ecx, edi
test rax, rax
je 0x1404c8d76
call qword [0x1400b8d90]
jmp 0x1404c8d7c
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
not dil
pop rdi
jmp 0x1404c8d8e
ret

Function at 0x1404c8f14
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
movsx rbx, ax
shr bx, 0x41
or bx, si
mov qword [rsp + 0x10], rbp
neg bp
and rbx, 0x39bb5070
mov qword [rsp + 0x18], rsi
push rdi
btr rbp, 0x17
sub rsp, 0x30
setns sil
mov ebx, r9d
cmovno di, r8w
mov rsi, rdx
mov rsi, 0x4e443671
mov rdi, r8
mov esi, 0x372d22a4
movsx r9, bx
movzx ebp, r14w
mov esi, edx
cqo
movsx edx, si
xchg r9b, dl
lea r9, [0x1400c63e8]
mov rbp, rcx
movzx edx, r13w
mov ecx, 0x7f772a96
movsx edx, sp
lea r8, [0x1400c63e0]
cmovg dx, si
lea rdx, [0x1400cf190]
mov ecx, 0xb
jmp 0x1404c8fa4
call fcn.1404c9bd6
mov rcx, rbp
jmp 0x1404c8fb2
test rax, rax
jmp 0x1404c8fba
je 0x1404c8fe0
mov r9d, ebx
cqo
mov r8, rdi
movsx edx, r12w
cqo
mov edx, esi
jmp 0x1404c8fd5
call qword [0x1400b8d90]
jmp 0x1404c900e
sub edx, edx
jmp 0x1404c8fe7
call fcn.1404c9696
mov ecx, eax
movsx r9d, r13w
mov r9d, ebx
bswap edx
mov r8, rdi
movsx rdx, bp
movzx edx, di
mov edx, esi
jmp 0x1404c9008
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
shr sil, 0x71
mov rsi, qword [rsp + 0x50]
adc dil, 0x87
bts rdi, rbx
add rsp, 0x30
xchg rdi, rdi
not dil
pop rdi
ret
Function at 0x1404d09de
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
cdqe
movsx rax, r15w
mov qword [r11 + 8], rbx
adc ah, 0x57
xor eax, 0x11e44d84
sbb ah, 0x98
mov qword [r11 + 0x10], rbp
rol bpl, cl
mov qword [r11 + 0x18], rdi
cmp r13b, 0x99
push r14
sub rsp, 0x50
cbw
mov rax, qword [rsp + 0x80]
movsxd rdi, ecx
mov rbp, r8
movzx r8w, r9b
xchg dil, r8b
mov rcx, qword [rcx]
lea r8, [r11 - 0x18]
mov rdi, rdx
movsx rdx, cx
mov qword [r11 - 0x38], rax
mov edx, dword [rsp + 0x88]
jmp 0x1404d0a41
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
call fcn.1404dfe04
mov r14d, dword [rsp + 0x44]
jmp 0x1404d0a5d
xor r8d, r8d
add bl, dil
test r12, 0x3ff93f0d
cmp dword [rsp + 0x40], 0x2d
movsx cx, r15b
mov r9d, eax
cqo
movsx rcx, si
mov rax, 0x14503cbd
mov eax, dword [rsp + 0xa0]
movsx dx, bpl
movsxd rdx, r15d
movzx ecx, r13w
mov rdx, rbp
movzx rcx, sp
movzx ecx, r14w
movsx ecx, bp
sete r8b
xor bx, 0x7156
mov dword [rsp + 0x28], eax
cmp rsp, 0x2b20951
jmp 0x1404d0ac2
sub rdx, r8
jmp 0x1404d0ad3
mov dword [rsp + 0x20], r9d
movsx rbx, r12w
dec r14d
lea r9, [rsp + 0x40]
neg ch
add bl, r8b
cmp sp, 0x30c0
cmp rbp, 0xffffffffffffffff
movsx rbx, r10w
movsx ebx, r12w
movzx rbx, bp
lea rbx, [r8 + rdi]
cmovnp rcx, rcx
not rcx
jmp 0x1404d0b0e
mov r8d, dword [rsp + 0x88]
cmovp cx, r13w
movsx cx, r13b
cmove rdx, rbp
movzx ecx, r8w
mov rcx, rbx
jmp 0x1404d0b30
call fcn.1404dfb0c
test eax, eax
jmp 0x1404d0b3c
je 0x1404d0b4a
mov byte [rdi], 0
jmp 0x1404d0c74
mov eax, dword [rsp + 0x44]
jmp 0x1404d0b53
dec eax
test sil, 0xdc
clc
cmp r15, 0x37e2816
cmp eax, 0xfffffffc
jmp 0x1404d0b69
jl 0x1404d0bed
cmp eax, dword [rsp + 0x88]
jge 0x1404d0bed
cmp r14d, eax
jmp 0x1404d0b84
jge 0x1404d0b9f
mov al, byte [rbx]
jmp 0x1404d0b91
inc rbx
test al, al
jne 0x1404d0b8a
mov byte [rbx - 2], al
mov rax, qword [rsp + 0xa8]
lea r9, [rsp + 0x40]
jmp 0x1404d0bb5
mov r8d, dword [rsp + 0x88]
mov rdx, rbp
movsx cx, dil
jmp 0x1404d0bca
mov qword [rsp + 0x28], rax
movzx rcx, di
movsx ecx, di
mov rcx, rdi
mov byte [rsp + 0x20], 1
jmp 0x1404d0be3
call fcn.1404d06e8
jmp 0x1404d0c74
mov rax, qword [rsp + 0xa8]
mov ch, 0xbc
movsxd rcx, ecx
mov dl, r13b
mov rdx, rbp
xchg cl, cl
movsx r8d, r12w
mov r9b, byte [rsp + 0x90]
setl r8b
jmp 0x1404d0c1c
mov rcx, rdi
mov r8d, dword [rsp + 0x88]
jmp 0x1404d0c2c
mov qword [rsp + 0x38], rax
movsx eax, si
cmove eax, eax
lea rax, [rsp + 0x40]
jmp 0x1404d0c41
mov byte [rsp + 0x30], 1
jmp 0x1404d0c4b
mov qword [rsp + 0x28], rax
movzx ax, dh
cmovno eax, r12d
mov al, 0xb6
mov eax, dword [rsp + 0x98]
jmp 0x1404d0c66
mov dword [rsp + 0x20], eax
jmp 0x1404d0c6f
call fcn.1404cf66c
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add r14w, ax
mov rdi, qword [rsp + 0x70]
shr r14b, 0xc1
sbb r14b, r8b
shr r14b, cl
add rsp, 0x50
movsx r14, sp
bswap r14d
mov r14w, 0x5043
pop r14
jmp 0x1404d0ca8
ret
Function at 0x1404d3ef5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx]
test sp, 0x3e4d
inc bx
shld ebx, r10d, 0x6e
or r8, 0xffffffffffffffff
ror rbx, 0xca
sub edi, edi
mov rbx, rcx
inc r8
test edx, r15d
cmp word [rdx + r8*2], di
jmp 0x1404d3f2c
jne 0x1404d3f1c
mov eax, edi
sub al, 0x84
sbb al, 0x40
cmp r8, 3
sete al
jmp 0x1404d3f44
mov dword [rcx + 0x18], eax
jmp 0x1404d3f4c
jne 0x1404d3f61
mov ecx, 2
jmp 0x1404d3f5c
jmp 0x1404d3fe5
mov r9d, edi
cmp bp, bx
test rdx, rdx
jmp 0x1404d3f6f
jne 0x1404d3f7c
mov ecx, edi
jmp 0x1404d3fe5
mov ecx, 2
bts ax, di
jmp 0x1404d3f8e
movzx r8d, word [rdx]
sbb al, dil
sub al, r10b
lea rdx, [rdx + rcx]
and al, 0x5d
mov ax, 0x7d20
shld ax, r12w, 0x14
lea eax, [r8 - 0x41]
test r11w, r9w
cmp ax, 0x19
jbe 0x1404d3fcf
sub r8w, 0x61
cmp r8w, 0x19
jmp 0x1404d3fc9
ja 0x1404d3fdc
inc r9d
jmp 0x1404d3fd7
jmp 0x1404d3f8e
mov ecx, r9d
stc
adc dh, ch
xor dx, si
sub r9d, r9d
cdq
mov dword [rbx + 0x14], ecx
movzx dx, r13b
xor r8d, r8d
mov dh, bh
jmp 0x1404d3ffb
lea rcx, [0x1400ab740]
cmovno dx, r14w
jmp 0x1404d400c
lea edx, [r9 + 3]
jmp 0x1404d4015
call fcn.1404c8a4d
test byte [rbx + 0x10], 4
jne 0x1404d4030
mov dword [rbx + 0x10], edi
rcr bl, cl
bswap di
btc ebx, 0x22
mov rbx, qword [rsp + 0x30]
movsx di, bpl
movzx di, r15b
movzx edi, r13w
add rsp, 0x20
not dil
pop rdi
ret
Function at 0x1404d5744
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
test dil, r11b
clc
movsx rbx, r13w
mov qword [rsp + 0x18], rsi
shld bx, bp, 0x6c
movsx ebx, di
movsx rbx, r14w
push rdi
bt ebx, 0x56
sub rsp, 0x20
btr rbx, rsi
movzx ebx, r12w
xor esi, esi
cmc
mov rbx, 0x55a95515
mov rdi, rdx
clc
test r9, 0xdca5722
mov rbx, rcx
cmc
test rcx, rcx
jmp 0x1404d5794
je 0x1404d583d
cmp word [rcx], si
je 0x1404d583d
lea rdx, [0x1400d1d08]
jmp 0x1404d57af
call fcn.1401ced3d
test eax, eax
je 0x1404d583d
lea rdx, [0x1400d1d00]
mov cx, 0x1ed0
movsx cx, r12b
bswap cx
mov rcx, rbx
jmp 0x1404d57d7
call fcn.1401ced3d
test eax, eax
jmp 0x1404d57e3
jne 0x1404d5830
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
cmovne dx, sp
movzx rdx, r12w
movsxd rdx, r14d
lea r8, [rsp + 0x30]
movsx edx, bx
movzx rdx, r10w
not dx
mov edx, 0x2000000b
jmp 0x1404d5814
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404d587a
mov eax, dword [rsp + 0x30]
jmp 0x1404d582b
jmp 0x1404d58a4
mov rcx, rbx
call fcn.1404de776
jmp 0x1404d58a4
mov ecx, dword [rdi + 8]
movsx r8, r8w
jmp 0x1404d584d
lea r8, [rsp + 0x30]
cmove dx, di
movzx edx, r8w
mov r9, 0x4f21263d
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d5886
sub eax, eax
jmp 0x1404d5881
jmp 0x1404d58a4
mov eax, dword [rsp + 0x30]
test r15w, 0x300d
stc
test eax, eax
jmp 0x1404d5898
jne 0x1404d58a4
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
jmp 0x1404d58ba
add rsp, 0x20
movsx di, bl
movzx edi, r13w
pop rdi
jmp 0x1404d58cc
ret

Function at 0x1404d58cd
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
bt ebx, ebx
neg bh
mov qword [rsp + 0x18], rsi
shl esi, 0x74
push rdi
test r15b, 0x26
sub rsp, 0x20
mov esi, edx
movsx rbx, r13w
mov bl, al
cmovg rbx, r13
mov ebx, ecx
call fcn.1404c7952
mov ecx, ebx
cdq
and r9b, 0x54
lea r8, [rsp + 0x30]
sal r9b, cl
and ecx, 0x3ff
xchg rdx, r9
bts r9w, dx
cwd
mov r9d, 2
clc
bts edi, edx
btr rdx, 0xc7
bts ecx, 0xa
cmovb rdi, rbp
mov edx, 0x20000001
jmp 0x1404d593b
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
jmp 0x1404d594c
test eax, eax
je 0x1404d5a0f
cmp ebx, dword [rsp + 0x30]
je 0x1404d5a00
test esi, esi
jmp 0x1404d5965
je 0x1404d5a00
mov r9, qword [rdi + 0x98]
btr rdx, 0x30
mov r8d, r10d
clc
movzx edx, word [r9]
rcr cx, cl
cdqe
lea rcx, [r9 + 2]
rcr ax, cl
inc al
lea eax, [rdx - 0x41]
jmp 0x1404d5995
cmp ax, 0x19
jmp 0x1404d599e
jbe 0x1404d59bd
sub dx, 0x61
test al, bpl
cmp r9b, sil
cmp dx, 0x19
jmp 0x1404d59b7
ja 0x1404d59d6
movzx edx, word [rcx]
jmp 0x1404d59c5
inc r8d
add rcx, 2
jmp 0x1404d59d1
jmp 0x1404d598d
or rcx, 0xffffffffffffffff
inc rcx
cmp dx, 0x5e53
cmp word [r9 + rcx*2], r10w
jmp 0x1404d59ec
jne 0x1404d59da
cmp r8d, ecx
jmp 0x1404d59fa
je 0x1404d5a0f
mov eax, 1
jmp 0x1404d5a0a
jmp 0x1404d5a1e
xor eax, eax
movsx esi, r8w
inc bx
test edx, 0x20c16148
mov rbx, qword [rsp + 0x38]
sal sil, cl
rcr si, 0x8f
bsf edi, eax
mov rsi, qword [rsp + 0x40]
and edi, 0x2a413a51
or dil, r10b
sal dil, 0x11
add rsp, 0x20
pop rdi
jmp 0x1404d5a49
ret
Function at 0x1404d7180
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
jmp 0x1404d719a
mov qword [rax + 8], rbx
test r14w, r8w
cmc
cmp r11b, r9b
mov qword [rax + 0x10], rbp
test dil, 0xad
mov qword [rax + 0x18], rsi
clc
test cx, r11w
jmp 0x1404d71bc
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x1404d71cb
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
movsx ebx, dx
setge bl
mov rbx, rax
test r10d, r15d
jmp 0x1404d71e6
test rax, rax
jmp 0x1404d71ee
je 0x1404d735d
mov rsi, rax
cmp word [rax], r14w
jmp 0x1404d7200
je 0x1404d723c
or rax, 0xffffffffffffffff
inc rax
clc
stc
cmc
cmp word [rsi + rax*2], r14w
jmp 0x1404d721a
jne 0x1404d720a
lea rsi, [rsi + rax*2]
add rsi, 2
jmp 0x1404d722d
cmp word [rsi], r14w
jmp 0x1404d7236
jne 0x1404d7206
mov qword [rsp + 0x38], r14
bts r8w, r12w
bts r8w, ax
stc
sub rsi, rbx
mov qword [rsp + 0x30], r14
not r9w
rol r9d, cl
sbb r8w, 0x7d62
add rsi, 2
bswap r9d
and r9b, 0xf8
mov r9b, 0xbd
sar rsi, 1
mov r8, rbx
inc r9b
mov r9d, esi
mov dword [rsp + 0x28], r14d
test di, r10w
xor edx, edx
test rcx, r13
mov qword [rsp + 0x20], r14
clc
test r9w, r10w
cmc
sub ecx, ecx
jmp 0x1404d729b
call fcn.1404c7748
movsxd rbp, eax
test r10b, dl
test eax, eax
jmp 0x1404d72ad
je 0x1404d735d
mov rcx, rbp
jmp 0x1404d72bb
call fcn.1404c7689
mov rdi, rax
test rax, rax
jmp 0x1404d72cb
je 0x1404d7340
mov qword [rsp + 0x38], r14
mov r9d, esi
rcr r8w, 0x3c
rol r8w, cl
mov qword [rsp + 0x30], r14
ror r8w, 0xe9
stc
bt r8d, 0x3e
mov r8, rbx
mov dword [rsp + 0x28], ebp
cmp sil, 0x34
cmp cl, r10b
xor edx, edx
test dx, 0xbb9
sub ecx, ecx
jmp 0x1404d730e
mov qword [rsp + 0x20], rax
jmp 0x1404d7318
call fcn.1404c7748
test eax, eax
jmp 0x1404d7324
je 0x1404d7340
mov rsi, rdi
movzx rdi, si
movsx rdi, r9w
bswap rdi
mov rdi, r14
jmp 0x1404d734b
mov rsi, r14
jmp 0x1404d734b
mov rcx, rdi
jmp 0x1404d7353
call fcn.1404c761b
jmp 0x1404d7360
mov rsi, r14
test rbx, rbx
jmp 0x1404d7368
je 0x1404d737c
mov rcx, rbx
jmp 0x1404d7376
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
add bp, ax
mov rax, rsi
test sp, bx
mov rsi, qword [rsp + 0x60]
bts r14w, r15w
mov rbp, qword [rsp + 0x58]
or r14b, 0xa7
sub edi, 0x30ed0b51
shrd edi, ebp, 0xa3
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
movsx r14d, r9w
sete r14b
bswap r14w
pop r14
ret
Function at 0x1404d73bf
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404d73d3
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
cmc
push rdi
cmp r9b, 0xd6
sub rsp, 0x20
jmp 0x1404d73ec
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
bts bx, cx
mov rbx, rax
cmp r15b, r15b
test r10w, r14w
test rax, rax
jmp 0x1404d740a
je 0x1404d74dd
mov rbp, rax
cmp word [rax], si
jmp 0x1404d741b
je 0x1404d7464
or rax, 0xffffffffffffffff
jmp 0x1404d742a
inc rax
test r9b, r13b
jmp 0x1404d7435
cmp word [rbp + rax*2], si
jne 0x1404d742a
lea rbp, [rbp + rax*2]
cmp r12b, 0x50
test ch, 0x79
add rbp, 2
cmc
test r14w, 0x34e6
test bl, spl
cmp word [rbp], si
jne 0x1404d7421
sub rbp, rbx
xadd ecx, ecx
add rbp, 2
xchg rcx, rcx
sub ecx, 0x49b60252
mov cx, r11w
sar rbp, 1
bsf ecx, eax
clc
xchg cl, cl
add rbp, rbp
movzx ecx, r10w
mov rcx, rbp
jmp 0x1404d7493
call fcn.1404c7689
mov rdi, rax
test rax, rax
jmp 0x1404d74a3
je 0x1404d74c8
mov r8, rbp
jmp 0x1404d74b1
mov rdx, rbx
mov ecx, 0x7e3d3b13
xchg cl, ch
mov rcx, rax
call fcn.1404a1c3e
mov rsi, rdi
cmp ah, ah
xor ecx, ecx
jmp 0x1404d74cf
call fcn.1404c761b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
cdqe
add ebp, esi
inc dil
mov rax, rsi
and bp, r11w
mov rsi, qword [rsp + 0x40]
sbb bpl, dl
mov rbp, qword [rsp + 0x38]
ror di, cl
xchg dil, dil
add rsp, 0x20
pop rdi
jmp 0x1404d750d
ret
Function at 0x1404da39a
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov al, r9b
mov qword [rsp + 0x18], rbp
push rsi
movzx rax, r9w
movsxd rax, r13d
push rdi
movsx ax, r13b
mov ax, r8w
lahf
push r14
movsx ax, r13b
mov eax, 0x1450
jmp 0x1404da3cb
call fcn.140446882
sub rsp, rax
bts rsi, r12
not bp
mov rax, qword [0x1400b7288]
movsx di, r8b
xor rax, rsp
bts r14d, r14d
sets dil
clc
mov qword [rsp + 0x1440], rax
movsxd r10, edx
rol ah, 0xab
mov rdi, rcx
shr al, cl
xadd rdx, r14
movsx esi, cx
mov rax, r10
shrd ebp, ebp, 0x5d
test bl, 0xcc
shl r14b, cl
mov ebp, r9d
sar rax, 6
rcl r14b, cl
btr si, 0xf4
bts r14, r13
lea rcx, [0x1400ba940]
shl sil, cl
and r10d, 0x3f
lea rbp, [rbp + r8]
neg dx
bts rsi, r15
mov rsi, r8
rcl r14, 0x34
mov rax, qword [rcx + rax*8]
mov rdx, rcx
bt r14w, 6
bswap dx
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
stc
jmp 0x1404da46c
sub eax, eax
mov qword [rdi], rax
cmp al, r13b
test r11b, 0xe2
jmp 0x1404da47d
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404da488
jae 0x1404da574
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jae 0x1404da4ee
mov al, byte [rsi]
jmp 0x1404da4a3
inc rsi
clc
cmp r8b, 0xb1
cmp al, 0xa
jmp 0x1404da4b2
jne 0x1404da4cb
inc dword [rdi + 8]
jmp 0x1404da4c0
mov byte [rbx], 0xd
inc rbx
jmp 0x1404da4cb
mov byte [rbx], al
cdqe
inc rbx
xor rax, r9
add rax, 0x5b5d7cad
cwde
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x1404da493
and qword [rsp + 0x20], 0
cwd
lea rax, [rsp + 0x40]
cmc
sbb dl, dil
sub ebx, eax
xchg ecx, r9d
lea r9, [rsp + 0x30]
movzx rcx, ax
mov r8d, ebx
lea rdx, [rsp + 0x40]
cmovnp ecx, esi
setb cl
mov rcx, r14
jmp 0x1404da523
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404da530
je 0x1404da564
mov eax, dword [rsp + 0x30]
clc
cmp bh, al
add dword [rdi + 4], eax
test r10w, r10w
cmp eax, ebx
jmp 0x1404da54b
jb 0x1404da574
cmp rsi, rbp
jmp 0x1404da559
jb 0x1404da48e
jmp 0x1404da574
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
sal cx, 0xdb
movzx ax, ah
mov rax, rdi
adc cl, 0xe4
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404da58a
call fcn.14049e054
lea r11, [rsp + 0x1450]
movsx edi, r8w
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movzx edi, r10w
xchg edi, r14d
movsxd rsi, r14d
mov rsp, r11
movsx r14, r14w
movzx esi, r15w
movsx edi, r8w
pop r14
pop rdi
pop rsi
jmp 0x1404da5c5
ret