joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404c8ce4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
shrd bx, bp, 0x5a
cmc
add r8, rdx
push rdi
or r8b, r12b
sub rsp, 0x20
xchg rbx, rdi
mov dil, r15b
mov rbx, rdx
movsxd rdx, ebp
bswap edx
lea r9, [0x1400c63d8]
mov dil, dil
setp dh
mov edi, ecx
not dh
mov r8b, sil
movsxd r8, r9d
lea rdx, [0x1400cf748]
movsxd r8, esi
mov ecx, 6
not r8b
lea r8, [0x1400c63d0]
jmp 0x1404c8d3d
call fcn.1404c9b82
mov rdx, rbx
or ch, 0x16
sub ch, 0xbb
mov ecx, edi
clc
test rsi, 0x4b3132e7
test rax, rax
je 0x1404c8d69
call qword [0x1400b8d90]
jmp 0x1404c8d6f
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
shr di, 0x4a
neg dil
test ebp, esi
add rsp, 0x20
mov dil, al
bswap di
xchg dil, dil
pop rdi
ret

Function at 0x1404c8ef3
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
cmp r11b, 0x9f
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
rcr bp, 0x4b
push rdi
sub rsp, 0x30
mov rbp, rbx
mov ebx, r9d
movsxd rdi, r12d
movsx edi, r14w
mov rdi, r8
movsx r9d, si
movsx rsi, r8w
xchg rbp, r9
mov esi, edx
cmovns dx, r12w
movsx rbp, r13w
lea r9, [0x1400c63e8]
cqo
movzx rbp, cx
mov rbp, rcx
xchg dl, r8b
lea r8, [0x1400c63e0]
movsx dx, dl
cmovg ecx, r12d
lea rdx, [0x1400cf190]
jmp 0x1404c8f68
mov ecx, 0xb
call fcn.1404c9b82
mov rcx, rbp
clc
cmp ax, bp
test rax, rax
jmp 0x1404c8f81
je 0x1404c8fa8
mov r9d, ebx
mov r8, rdi
jmp 0x1404c8f96
mov edx, esi
jmp 0x1404c8f9d
call qword [0x1400b8d90]
jmp 0x1404c8fcc
sub edx, edx
jmp 0x1404c8faf
call fcn.1404c9662
mov ecx, eax
mov r9d, ebx
mov r8, rdi
movzx edx, dx
mov edx, esi
jmp 0x1404c8fc6
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
rcr bpl, 0x6a
cmp r11b, 0x24
sar bpl, 0x7c
mov rbp, qword [rsp + 0x48]
sbb si, r14w
mov rsi, qword [rsp + 0x50]
rol dil, cl
sar dil, 0x93
rcl dil, 0x6e
add rsp, 0x30
movsx di, bl
setge dil
bswap rdi
pop rdi
jmp 0x1404c900b
ret
Function at 0x1404c9963
Capabilities:
Check http status code

Disassembly:
sub rsp, 0x28
lea r9, [0x1400c63a4]
cmp r14b, dil
bts r8d, edx
rol r8w, cl
xor ecx, ecx
not r8b
movsx dx, bpl
lea r8, [0x1400c63a0]
lea rdx, [0x1400cfbf8]
jmp 0x1404c9996
call fcn.1404c9b82
lea r9, [0x1400c63b0]
mov ecx, 1
cdq
lea r8, [0x1400c63a8]
lea rdx, [0x1400cf1d0]
jmp 0x1404c99bb
call fcn.1404c9b82
lea r9, [0x1400c63b8]
movsx edx, r15w
mov ecx, 2
mov edx, 0x354c190d
cmovns dx, r11w
lea r8, [0x1400c63b0]
bswap dx
lea rdx, [0x1400cf178]
jmp 0x1404c99f0
call fcn.1404c9b82
lea r9, [0x1400c63e0]
mov ecx, 8
lea r8, [0x1400c63d8]
xchg dx, dx
movsx edx, r12w
movsxd rdx, ecx
lea rdx, [0x1400cf158]
jmp 0x1404c9a1e
call fcn.1404c9b82
lea r9, [0x1400c63e8]
mov ecx, 0xb
setns dl
lea r8, [0x1400c63e0]
cdq
mov dl, 0x9b
lea rdx, [0x1400cf190]
jmp 0x1404c9a48
call fcn.1404c9b82
lea r9, [0x1400c63f0]
cdq
mov ecx, 0xe
cwd
lea r8, [0x1400c63e8]
cwd
lea rdx, [0x1400cf168]
call fcn.1404c9b82
lea r9, [0x1400c63f8]
xchg ecx, edx
sete dh
cmovo dx, r9w
mov ecx, 0xf
movsx edx, r10w
jmp 0x1404c9a90
lea r8, [0x1400c63f0]
lea rdx, [0x1400cf800]
jmp 0x1404c9aa3
call fcn.1404c9b82
lea r9, [0x1400c6408]
mov ecx, 0x13
lea r8, [0x1400c6400]
lea rdx, [0x1400cf838]
jmp 0x1404c9ac7
call fcn.1404c9b82
lea r9, [0x1400c6410]
movzx r8, r12w
mov ecx, 0x14
bswap r8w
movsxd r8, r14d
movzx r8w, r10b
lea r8, [0x1400c6408]
movzx rdx, di
lea rdx, [0x1400cf1c0]
jmp 0x1404c9aff
call fcn.1404c9b82
lea r9, [0x1400c6418]
jmp 0x1404c9b12
mov ecx, 0x15
movsx edx, bx
mov dl, 0x91
lea r8, [0x1400c6410]
movzx dx, spl
lea rdx, [0x1400cf820]
jmp 0x1404c9b34
call fcn.1404c9b82
lea r9, [0x1400c6420]
bt cx, ax
bts dx, r12w
shl ch, cl
mov ecx, 0x16
bt r8w, dx
cqo
btr dx, 0xe5
lea r8, [0x1400c6418]
shr dl, cl
cqo
movzx edx, ax
lea rdx, [0x1400cfc08]
cmp r11, r11
cmp r12b, 0x49
clc
add rsp, 0x28
jmp fcn.1404c9b82
Function at 0x1404cccb7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test dx, r9w
mov qword [rax + 8], rbx
rcr ch, cl
bts bx, bx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsx edi, dx
adc dil, 0xaa
push r14
movzx di, bpl
cmp al, spl
bswap rcx
sub rsp, 0x20
sub esi, esi
movsxd rcx, r9d
shrd edi, eax, 0xc0
mov di, 0x3d05
sub r14d, r14d
ror ch, 0xaf
sbb al, ch
and dil, r11b
movsxd rcx, esi
and bh, 0x1b
adc ebx, 0x1b666fb1
lea rdi, [0x1400ba940]
movsx rax, ax
neg bh
mov rax, rcx
bts bx, si
and ecx, 0x3f
add rbx, r8
sar bh, cl
mov bh, 0x11
sar rax, 6
add bl, 0x27
lea rbx, [rcx + rcx*8]
stc
mov rdi, qword [rdi + rax*8]
dec ax
movsx rax, r10w
mov rax, qword [rdi + rbx*8 + 0x28]
stc
add rax, 2
cmp r14w, 0x6e3
cmp rax, 1
jmp 0x1404ccd5f
jbe 0x1404ccd74
or byte [rdi + rbx*8 + 0x38], 0x80
jmp 0x1404ccd6f
jmp 0x1404ccea5
mov byte [rdi + rbx*8 + 0x38], 0x81
or cl, ah
sar cx, 0x45
movsx cx, r15b
mov ecx, esi
test r12w, dx
stc
cmp cl, dil
test esi, esi
je 0x1404ccdcd
sub ecx, 1
jmp 0x1404ccd9e
je 0x1404ccdbe
cmp ecx, 1
cmovae cx, r10w
setne ch
mov ecx, 0xfffffff4
jmp 0x1404ccdb9
jmp 0x1404ccdd7
mov ecx, 0xfffffff5
jmp 0x1404ccdc8
jmp 0x1404ccdd7
mov ecx, 0xfffffff6
jmp 0x1404ccdd7
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
lea rcx, [rax + 1]
cmc
cmp cl, r9b
cmp rcx, 1
jmp 0x1404ccdf1
jbe 0x1404cce0a
mov rcx, rax
jmp 0x1404ccdff
call qword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1404cce10
xor eax, eax
cmp bpl, 0xae
test eax, eax
je 0x1404cce56
movzx ecx, al
stc
mov qword [rdi + rbx*8 + 0x28], rbp
cmp ecx, 2
jmp 0x1404cce29
jne 0x1404cce3e
or byte [rdi + rbx*8 + 0x38], 0x40
jmp 0x1404cce39
jmp 0x1404ccea5
cmp ecx, 3
jne 0x1404ccea5
or byte [rdi + rbx*8 + 0x38], 8
jmp 0x1404cce51
jmp 0x1404ccea5
or byte [rdi + rbx*8 + 0x38], 0x40
movsx eax, bx
movzx rax, bx
add ax, 0xedd
mov qword [rdi + rbx*8 + 0x28], 0xfffffffffffffffe
btc eax, 0xc9
or rax, rdi
jmp 0x1404cce7b
mov rax, qword [0x1400ba160]
clc
test r12w, si
test rax, rax
jmp 0x1404cce8f
je 0x1404ccea5
mov rax, qword [r14 + rax]
mov dword [rax + 0x18], 0xfffffffe
jmp 0x1404ccea5
inc esi
stc
add r14, 8
cmp di, ax
clc
jmp 0x1404cceb5
cmp esi, 3
jmp 0x1404ccebd
jne 0x1404ccd04
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movzx r14d, r8w
mov rsi, qword [rsp + 0x40]
mov dil, bl
xor di, r10w
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x1404cceed
ret
Function at 0x1404d56c5
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
cmp esi, r11d
mov qword [rsp + 0x18], rsi
shld rbx, rbx, 0xd
push rdi
sub rsp, 0x20
btc di, 0xe4
xadd ebx, ebx
sal di, 0xe1
sub esi, esi
mov rdi, rdx
sbb rbx, 0x4b0c5feb
mov rbx, rcx
test rcx, rcx
jmp 0x1404d56ff
je 0x1404d5791
cmp word [rcx], si
jmp 0x1404d570d
je 0x1404d5791
lea rdx, [0x1400d1d08]
jmp 0x1404d571f
call fcn.14023de48
test eax, eax
jmp 0x1404d572b
je 0x1404d5791
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404d5740
call fcn.14023de48
test eax, eax
jne 0x1404d5784
mov ecx, dword [rdi + 8]
xchg edx, r9d
lea r9d, [rsi + 2]
cqo
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d5770
je 0x1404d57bb
mov eax, dword [rsp + 0x30]
jmp 0x1404d577f
jmp 0x1404d57d9
mov rcx, rbx
call fcn.1404de790
jmp 0x1404d57d9
mov ecx, dword [rdi + 8]
cqo
lea r8, [rsp + 0x30]
mov dl, 0xb0
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d57ad
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d57c7
sub eax, eax
jmp 0x1404d57c2
jmp 0x1404d57d9
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1404d57d9
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
sbb si, r13w
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1404d57ed
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
clc
ror ebx, cl
cmc
mov qword [rsp + 0x18], rsi
push rdi
rcr sil, cl
sub rsp, 0x20
movsx rsi, r8w
xchg si, bx
cmovbe si, sp
mov esi, edx
xchg bx, bx
not bl
cmovae bx, r13w
mov ebx, ecx
jmp 0x1404d5821
call fcn.1404c79ec
mov ecx, ebx
and r9b, 0x48
btr r9, rsi
ror edx, 0x49
lea r8, [rsp + 0x30]
shl rdx, cl
btc r9, 0x69
cmc
and ecx, 0x3ff
movsx edi, r8w
bt edi, 0xb0
mov r9d, 2
cmc
movsx edx, r10w
bts ecx, 0xa
movsx rdi, dx
movsx di, dl
mov edx, 0x20000001
movzx rdi, ax
mov rdi, rax
jmp 0x1404d5877
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
stc
cmp r10w, 0x73bd
test eax, eax
je 0x1404d595c
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d5898
je 0x1404d594d
test esi, esi
jmp 0x1404d58a5
je 0x1404d594d
mov r9, qword [rdi + 0x98]
rcr dl, 0xf8
mov r8d, r10d
shrd dx, r10w, 0xbb
sal dl, 0xf4
or edx, edx
movzx edx, word [r9]
lea rcx, [r9 + 2]
sub ax, 0x72ce
cmp ch, 0x70
lea eax, [rdx - 0x41]
clc
cmp ax, 0x19
jmp 0x1404d58df
jbe 0x1404d58ff
sub dx, 0x61
cmp r14, 0x6e076d7a
cmp dx, 0x19
jmp 0x1404d58f9
ja 0x1404d591c
movzx edx, word [rcx]
jmp 0x1404d5907
inc r8d
cmp r13b, r14b
stc
add rcx, 2
jmp 0x1404d5917
jmp 0x1404d58d2
or rcx, 0xffffffffffffffff
jmp 0x1404d5925
inc rcx
clc
cmp r12w, 0x757f
cmp word [r9 + rcx*2], r10w
jmp 0x1404d5939
jne 0x1404d5925
cmp r8d, ecx
jmp 0x1404d5947
je 0x1404d595c
mov eax, 1
jmp 0x1404d5957
jmp 0x1404d5965
sub eax, eax
sbb sil, 0x72
sub rsi, rcx
mov rbx, qword [rsp + 0x38]
ror si, 0x85
mov rsi, qword [rsp + 0x40]
mov rdi, rdx
add rsp, 0x20
pop rdi
jmp 0x1404d5980
ret
Function at 0x1404d7003
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmp al, r8b
test ax, r10w
jmp 0x1404d701c
mov qword [rax + 8], rbx
cmp si, r10w
mov qword [rax + 0x10], rbp
jmp 0x1404d702d
mov qword [rax + 0x18], rsi
test r11d, 0x1e916325
mov qword [rax + 0x20], rdi
jmp 0x1404d7041
push r14
test r15b, cl
sub rsp, 0x40
jmp 0x1404d704f
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
shl ebx, 0x69
movzx rbx, sp
rcr bh, 0x62
mov rbx, rax
test rax, rax
jmp 0x1404d706d
je 0x1404d71bc
mov rsi, rax
stc
clc
jmp 0x1404d707d
cmp word [rax], r14w
je 0x1404d70b8
or rax, 0xffffffffffffffff
jmp 0x1404d7090
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1404d7090
lea rsi, [rsi + rax*2]
cmp cl, 0xbd
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d70b2
jne 0x1404d7087
mov qword [rsp + 0x38], r14
add r8b, 0x1f
btc r9, rsi
rcl r9b, 0x96
sub rsi, rbx
and r8w, 0x57c8
mov qword [rsp + 0x30], r14
shrd r9w, sp, 0xad
add rsi, 2
rcl r9w, cl
bt r8, rbx
sar rsi, 1
mov r8, rbx
setl r9b
mov r9d, esi
mov dword [rsp + 0x28], r14d
clc
sub edx, edx
mov qword [rsp + 0x20], r14
jmp 0x1404d710d
sub ecx, ecx
jmp 0x1404d7114
call fcn.1404c77e2
movsxd rbp, eax
test eax, eax
jmp 0x1404d7123
je 0x1404d71bc
mov rcx, rbp
jmp 0x1404d7131
call fcn.1404c772f
mov rdi, rax
cmp bx, 0x7a4a
test rax, rax
jmp 0x1404d7146
je 0x1404d71a7
mov qword [rsp + 0x38], r14
not r9w
mov r9d, esi
mov qword [rsp + 0x30], r14
or r8b, 0xe5
xor r8b, bl
mov r8, rbx
mov dword [rsp + 0x28], ebp
cmc
stc
sub edx, edx
test r13b, spl
xor ecx, ecx
jmp 0x1404d7179
mov qword [rsp + 0x20], rax
jmp 0x1404d7183
call fcn.1404c77e2
test eax, eax
jmp 0x1404d718f
je 0x1404d71a7
mov rsi, rdi
movsxd rdi, r11d
seto dil
mov rdi, r14
jmp 0x1404d71aa
mov rsi, r14
mov rcx, rdi
jmp 0x1404d71b2
call fcn.1404c769d
jmp 0x1404d71bf
mov rsi, r14
test rbx, rbx
je 0x1404d71d6
mov rcx, rbx
jmp 0x1404d71d0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
or bpl, r11b
mov rax, rsi
mov rsi, qword [rsp + 0x60]
btc r14w, 0xaa
mov rbp, qword [rsp + 0x58]
cmovne edi, r12d
mov rdi, qword [rsp + 0x68]
bt r14w, 0xb4
or r14d, r11d
add rsp, 0x40
mov r14d, r8d
pop r14
jmp 0x1404d7211
ret
Function at 0x1404d7212
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
test cx, r8w
stc
mov qword [rsp + 0x10], rbp
cmc
test spl, r10b
mov qword [rsp + 0x18], rsi
cmc
cmp spl, r12b
cmp r10, 0x784c6b21
push rdi
cmc
cmp r13b, 0xee
sub rsp, 0x20
jmp 0x1404d7244
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
sub bx, r12w
bts ebx, ebx
mov rbx, rax
test rax, rax
jmp 0x1404d725e
je 0x1404d7322
mov rbp, rax
cmp r14w, 0x2853
cmc
cmp word [rax], si
jmp 0x1404d7276
je 0x1404d72ac
or rax, 0xffffffffffffffff
inc rax
test r15, rbx
clc
cmc
cmp word [rbp + rax*2], si
jne 0x1404d7280
lea rbp, [rbp + rax*2]
add rbp, 2
clc
cmp word [rbp], si
jmp 0x1404d72a6
jne 0x1404d727c
sub rbp, rbx
mov cl, sil
and ecx, r12d
shl cl, cl
add rbp, 2
movsx cx, r12b
sar rbp, 1
add rbp, rbp
cmovle cx, sp
mov rcx, rbp
jmp 0x1404d72d2
call fcn.1404c772f
mov rdi, rax
stc
test rax, rax
je 0x1404d7308
mov r8, rbp
movzx edx, r14w
mov rdx, rbx
cmovp cx, bx
setge ch
mov rcx, rax
call fcn.1404a18a1
mov rsi, rdi
test r15w, r14w
cmp eax, r11d
cmc
sub ecx, ecx
jmp 0x1404d730f
call fcn.1404c769d
mov rcx, rbx
jmp 0x1404d731c
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
sar rbp, 0x9f
sar bp, cl
mov rax, rsi
btc ebp, 0x60
mov rsi, qword [rsp + 0x40]
sar dil, 0x3a
add dil, bl
mov rbp, rsp
mov rbp, qword [rsp + 0x38]
adc edi, r11d
or dil, 0xdf
add rsp, 0x20
not dil
jmp 0x1404d735c
pop rdi
jmp 0x1404d7362
ret
Function at 0x1404da24e
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
lahf
movsx rax, bx
mov qword [rsp + 0x18], rbp
movzx ax, sil
seta al
push rsi
lahf
mov ax, dx
push rdi
cmovns eax, eax
cwde
push r14
mov eax, 0x1450
jmp 0x1404da27b
call fcn.140446b6c
sub rsp, rax
cmp cl, 0
mov rax, qword [0x1400b7288]
test bpl, al
not edi
xor rax, rsp
mov qword [rsp + 0x1440], rax
and esi, 0x7e1652ec
movsxd r10, edx
bt edi, r10d
mov rdi, rcx
mov rax, r10
mov ebp, r9d
shld r14d, edx, 0x1b
movsxd rsi, esi
sar rax, 6
lea rcx, [0x1400ba940]
bswap dx
and r10d, 0x3f
or dl, r11b
movzx r14, si
sar r14b, 0x32
lea rbp, [rbp + r8]
bsf si, r8w
sub r14b, 0x7f
adc dl, bpl
mov rsi, r8
test r14w, dx
cqo
sal r14b, 0xc2
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
movzx r14w, r11b
sub r14b, dil
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
test dh, 0x14
mov qword [rdi], rax
mov dword [rdi + 8], eax
clc
cmp r8, rbp
jmp 0x1404da31f
jae 0x1404da407
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404da332
jae 0x1404da382
mov al, byte [rsi]
inc rsi
cmp r10, r12
cmp al, 0xa
jmp 0x1404da347
jne 0x1404da365
inc dword [rdi + 8]
jmp 0x1404da355
mov byte [rbx], 0xd
jmp 0x1404da35d
inc rbx
jmp 0x1404da365
mov byte [rbx], al
inc rbx
cdqe
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x1404da37c
jb 0x1404da32a
and qword [rsp + 0x20], 0
inc al
mov cx, 0x25a9
lea rax, [rsp + 0x40]
and rdx, 0x17e85959
movsx r9w, r9b
sub ebx, eax
xchg r9, rcx
cqo
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
movzx ecx, bx
jmp 0x1404da3bb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404da3cb
je 0x1404da3f9
mov eax, dword [rsp + 0x30]
clc
stc
add dword [rdi + 4], eax
cmp r11w, si
cmp eax, ebx
jmp 0x1404da3e5
jb 0x1404da407
cmp rsi, rbp
jb 0x1404da325
jmp 0x1404da407
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
cwde
cdqe
dec ax
mov rax, rdi
rcl rcx, 0xb2
mov rcx, qword [rsp + 0x1440]
clc
cmc
xor rcx, rsp
jmp 0x1404da420
call fcn.14049dc81
lea r11, [rsp + 0x1450]
not di
movsxd rbx, r15d
jmp 0x1404da438
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
mov rsi, r9
pop r14
not sil
movzx esi, bp
pop rdi
movzx si, bpl
movsx rsi, r9w
movzx esi, r14w
pop rsi
jmp 0x1404da462
ret
Function at 0x1404da463
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov al, dil
mov qword [rsp + 0x18], rbp
movzx rax, bp
movsxd rax, r14d
movzx ax, al
push rsi
push rdi
push r14
nop
movsx rax, r10w
mov eax, 0x1450
call fcn.140446b6c
sub rsp, rax
seta dil
rcl al, 0xf4
sar al, 0xcf
mov rax, qword [0x1400b7288]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
ror bpl, 0x23
bsf bp, di
btc rcx, r13
mov rax, r10
bts rcx, r12
adc rsi, 0x44d50068
mov ebp, r9d
bt dx, 0x74
sar rax, 6
jmp 0x1404da4e2
lea rcx, [0x1400ba940]
btc r14d, 2
ror dh, 0x58
and r10d, 0x3f
and sil, 0x5c
btr r14w, r11w
jmp 0x1404da503
lea rbp, [rbp + r8]
movsxd rsi, r9d
btc si, 0x50
adc r14b, 0x17
mov rsi, r8
add dl, sil
bts rdx, rdi
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
xor r14b, 0x4b
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
cmp sil, spl
test r8b, 0x3c
stc
mov dword [rdi + 8], eax
test r14b, 0x8c
test sil, sil
clc
cmp r8, rbp
jmp 0x1404da54f
jae 0x1404da661
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404da562
jae 0x1404da5d9
movzx eax, word [rsi]
stc
add rsi, 2
cmp ax, 0xa
jmp 0x1404da579
jne 0x1404da5a0
add dword [rdi + 8], 2
rol ch, 0xd7
sar cl, cl
or ch, al
mov ecx, 0xd
stc
jmp 0x1404da595
mov word [rbx], cx
stc
cmp r14b, bpl
add rbx, 2
mov word [rbx], ax
movzx ax, r12b
bt ax, 0xf
add rbx, 2
cmp spl, r12b
sub al, 0xad
shl ax, cl
lea rax, [rsp + 0x143e]
cmp bp, 0xd64
jmp 0x1404da5cb
cmp rbx, rax
jmp 0x1404da5d3
jb 0x1404da55a
and qword [rsp + 0x20], 0
jmp 0x1404da5e4
lea rax, [rsp + 0x40]
adc r9b, bpl
rol r8b, cl
movsx edx, cx
sub rbx, rax
sbb r8b, r10b
lea r9, [rsp + 0x30]
shr dx, 0x30
rcl ch, cl
sar rbx, 1
lea rdx, [rsp + 0x40]
btr r8d, r12d
add ebx, ebx
mov rcx, r14
setp r8b
mov r8d, ebx
jmp 0x1404da620
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404da62d
je 0x1404da656
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmc
cmp eax, ebx
jb 0x1404da661
cmp rsi, rbp
jmp 0x1404da64b
jb 0x1404da555
jmp 0x1404da661
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
xor cl, 0x2e
mov rax, rdi
test r13b, 0xc1
cmovs cx, r15w
mov rcx, qword [rsp + 0x1440]
cmp rsi, rcx
xor rcx, rsp
jmp 0x1404da680
call fcn.14049dc81
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov r14b, 0xaa
movzx r14, di
movzx bp, r14b
mov rbp, qword [r11 + 0x30]
movzx r14, ax
movsx di, bl
movzx r14w, cl
mov rsp, r11
pop r14
movsx di, sil
movsx edi, r14w
mov edi, 0x3fd62fbf
pop rdi
mov esi, r15d
xchg sil, sil
pop rsi
jmp 0x1404da6ce
ret
Function at 0x1404da6cf
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx ax, dil
lahf
mov qword [rsp + 0x18], rbp
push rsi
jmp 0x1404da703
push rdi
cwde
bswap ax
push r12
push r14
push r15
mov eax, 0x1470
jmp 0x1404da718
call fcn.140446b6c
sub rsp, rax
mov rax, qword [0x1400b7288]
stc
xor rax, rsp
shl r10b, cl
mov qword [rsp + 0x1460], rax
xchg bx, ax
btr r10d, r14d
xadd r10w, ax
movsxd r10, edx
rdtsc
mov rbx, rcx
shr r12w, 0xe6
cmp si, r12w
mov rax, r10
neg rcx
shld edi, r12d, 0x47
shl r14w, cl
mov r14d, r9d
shr dx, 0x33
sar rax, 6
adc r12b, spl
shld cx, bp, 0x27
lea rcx, [0x1400ba940]
shr edi, cl
and r10d, 0x3f
add r14, r8
rcl r15, 0x48
mov r15, r8
sar di, cl
bsr r12w, di
mov rdi, r8
cmc
shl dl, 0xde
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
sub eax, eax
stc
mov qword [rbx], rax
test r12b, r9b
cmp esp, 0x648a64da
cmp r8, r14
jmp 0x1404da7be
mov dword [rbx + 8], eax
jae 0x1404da98b
lea rax, [rsp + 0x50]
test ebx, edi
cmp rsi, 0x4fd124a6
cmp rdi, r14
jae 0x1404da840
movzx ecx, word [rdi]
stc
cmc
add rdi, 2
test dil, sil
cmp cx, 0xa
jmp 0x1404da7f3
jne 0x1404da815
mov edx, 0xd
cmp r9b, 0x6b
jmp 0x1404da808
mov word [rax], dx
add rax, 2
jmp 0x1404da815
mov word [rax], cx
add rax, 2
clc
or rcx, 0x472f42af
shr cl, 0x97
lea rcx, [rsp + 0x6f8]
test rsp, r14
cmp rax, rcx
jmp 0x1404da83a
jb 0x1404da7d5
and qword [rsp + 0x38], 0
add cl, bh
sbb r9w, ax
lea rcx, [rsp + 0x50]
sal r8, cl
shr r9w, cl
and qword [rsp + 0x30], 0
btc r9w, r12w
lea r8, [rsp + 0x50]
sub rax, rcx
cmp sp, r13w
movsx ecx, r9w
mov dword [rsp + 0x28], 0xd55
bswap cx
movzx cx, r15b
lea rcx, [rsp + 0x700]
not r9b
sal r9b, cl
add r9b, r13b
sar rax, 1
mov r9b, 0x19
shrd r9, rdi, 0x4e
mov qword [rsp + 0x20], rcx
sub r9b, 0xf4
mov r9d, eax
mov ecx, 0xfde9
test r11, 0x72a24239
cmp ax, 0x388d
sub edx, edx
jmp 0x1404da8c2
call fcn.1404c77e2
mov ebp, eax
cmc
cmp esp, 0xebb7062
test eax, eax
jmp 0x1404da8d7
je 0x1404da97f
xor esi, esi
clc
cmp r11b, 0xc3
jmp 0x1404da8e9
test eax, eax
jmp 0x1404da8f0
je 0x1404da962
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
ror r8d, 0xfe
mov ecx, esi
movsx r8d, cx
ror r8b, cl
adc r8b, 0x97
lea r9, [rsp + 0x40]
rcl r8b, 0x6d
bswap r8w
mov r8d, ebp
cmp r14b, dl
cmc
test spl, 0x82
lea rdx, [rdx + rcx]
mov rcx, r12
clc
cmp r11w, si
sub r8d, esi
jmp 0x1404da941
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404da94e
je 0x1404da97f
add esi, dword [rsp + 0x40]
cmc
stc
cmp esi, ebp
jb 0x1404da8f6
mov eax, edi
cmc
sub eax, r15d
stc
mov dword [rbx + 4], eax
clc
jmp 0x1404da972
cmp rdi, r14
jmp 0x1404da97a
jmp 0x1404da7c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
movzx rax, dx
mov rax, rbx
add ecx, 0x2d5517f3
ror rcx, cl
rcr ecx, 0x99
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
jmp 0x1404da9aa
call fcn.14049dc81
lea r11, [rsp + 0x1470]
movzx r15, r9w
bswap ebx
movzx edi, r8w
mov rbx, qword [r11 + 0x30]
movzx r14d, dx
bswap r15w
mov rbp, qword [r11 + 0x40]
movzx r15, di
mov rsp, r11
movsx r15, r8w
mov si, 0x4ed7
pop r15
pop r14
pop r12
pop rdi
movzx si, r9b
pop rsi
jmp 0x1404da9f2
ret
Function at 0x1404de057
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub ebx, 0x5c80c24
sub r9d, r13d
sub rsp, 0x20
not bh
cmovle r8w, bp
mov ebx, ecx
mov r9w, r14w
not ch
lea r9, [0x1400c8ea0]
jmp 0x1404de087
mov ecx, 2
lea r8, [0x1400c8e98]
cwd
mov rdx, r8
movzx rdx, cx
lea rdx, [0x1400cf758]
jmp 0x1404de0a8
call fcn.1404de23d
mov ecx, ebx
stc
test rax, 0x1e363f97
test rax, rax
je 0x1404de0d2
add rsp, 0x20
movzx rbx, r9w
movzx ebx, di
pop rbx
jmp qword [0x1400b8d90]
add rsp, 0x20
movsx ebx, si
pop rbx
jmp 0x1404de0df
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404de0e6
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsx ebx, cx
mov rbx, rdx
lea r9, [0x1400c8ea8]
movzx r8, r13w
bswap rdx
mov rdi, rcx
mov edi, ecx
movzx r8d, r11w
cmovs edx, esi
lea rdx, [0x1400cf748]
mov ecx, 3
movzx r8d, r13w
movzx r8, r8w
lea r8, [0x1400c8ea0]
jmp 0x1404de130
call fcn.1404de23d
mov rdx, rbx
shld rcx, rsi, 0xeb
mov ecx, edi
test rax, rax
jmp 0x1404de147
je 0x1404de158
call qword [0x1400b8d90]
jmp 0x1404de15e
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movsx rdi, r9w
add rsp, 0x20
mov edi, edx
mov dil, 0x97
movzx rdi, r10w
pop rdi
jmp 0x1404de17a
ret