joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404dce65
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
rcl bl, cl
mov bx, 0x1355
push rdi
sub rsp, 0x20
xor esi, esi
adc bl, 0xc9
bsr di, r10w
mov rdi, rdx
rcl ebx, 0xc8
mov rbx, rcx
cmc
test rcx, rcx
jmp 0x1404dce96
je 0x1404dcf39
cmp word [rcx], si
je 0x1404dcf39
lea rdx, [0x1400d1d08]
jmp 0x1404dceb1
call fcn.1400ea292
test eax, eax
jmp 0x1404dcebd
je 0x1404dcf39
lea rdx, [0x1400d1d00]
movsxd rcx, ebp
movzx ecx, r14w
mov rcx, rbx
jmp 0x1404dced9
call fcn.1400ea292
test eax, eax
jmp 0x1404dcee5
jne 0x1404dcf27
mov ecx, dword [rdi + 8]
movsx dx, r8b
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
cwd
mov dl, r8b
mov edx, 0x2000000b
jmp 0x1404dcf0b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dcf18
je 0x1404dcf73
mov eax, dword [rsp + 0x30]
jmp 0x1404dcf90
mov rcx, rbx
jmp 0x1404dcf2f
call fcn.1404e604d
jmp 0x1404dcf90
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
cdq
xchg r9b, r9b
mov r9d, 2
movsx edx, cx
mov dl, r10b
jmp 0x1404dcf56
mov edx, 0x20001004
jmp 0x1404dcf60
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dcf6d
jne 0x1404dcf7a
sub eax, eax
jmp 0x1404dcf90
mov eax, dword [rsp + 0x30]
test bl, r8b
stc
test eax, eax
jne 0x1404dcf90
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
or dil, bl
shld edi, edi, 0x11
mov rsi, qword [rsp + 0x40]
bt rdi, r10
ror rdi, cl
add rsp, 0x20
movzx di, r11b
pop rdi
jmp 0x1404dcfb7
ret

Function at 0x1404dcfb8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
sbb sil, 0xb4
xadd sil, bl
push rdi
mov sil, r12b
bsr rbx, rax
sub rsp, 0x20
movsxd rbx, esi
movsx si, sil
movsx esi, r13w
mov esi, edx
seta bl
mov ebx, ecx
jmp 0x1404dcfee
call fcn.1404cf003
mov ecx, ebx
xadd r9b, r8b
movzx rdi, r15w
lea r8, [rsp + 0x30]
movzx r9, r13w
rol r9b, cl
and ecx, 0x3ff
btr rdx, 0xa5
setns r9b
mov r9d, 2
bts ecx, 0xa
movsx rdi, cx
movzx dx, r12b
movzx rdx, r10w
mov edx, 0x20000001
movsxd rdi, r13d
jmp 0x1404dd03f
mov rdi, rax
jmp 0x1404dd047
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test ebx, 0x328d30ca
cmc
cmp bpl, r14b
test eax, eax
jmp 0x1404dd061
je 0x1404dd119
cmp ebx, dword [rsp + 0x30]
jmp 0x1404dd070
je 0x1404dd10a
test esi, esi
je 0x1404dd10a
mov r9, qword [rdi + 0x98]
mov r8d, r10d
or dl, r8b
movsx edx, r8w
movzx edx, word [r9]
lea rcx, [r9 + 2]
neg eax
jmp 0x1404dd09e
lea eax, [rdx - 0x41]
cmp r14b, bpl
cmp ax, 0x19
jmp 0x1404dd0ad
jbe 0x1404dd0c8
sub dx, 0x61
test r13b, bpl
test r11b, 0x87
cmp dx, 0x19
ja 0x1404dd0e5
movzx edx, word [rcx]
inc r8d
clc
test dil, bpl
jmp 0x1404dd0d7
add rcx, 2
jmp 0x1404dd0e0
jmp 0x1404dd09e
or rcx, 0xffffffffffffffff
jmp 0x1404dd0ee
inc rcx
cmp word [r9 + rcx*2], r10w
jmp 0x1404dd0fb
jne 0x1404dd0ee
cmp r8d, ecx
je 0x1404dd119
mov eax, 1
jmp 0x1404dd114
jmp 0x1404dd11b
sub eax, eax
mov rbx, qword [rsp + 0x38]
movsx di, al
rol dil, 0xb
mov rsi, qword [rsp + 0x40]
sbb di, 0x1aed
sal di, cl
add rsp, 0x20
movzx rdi, bx
movsx di, cl
pop rdi
jmp 0x1404dd147
ret
Function at 0x1404de87e
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmp dx, r10w
jmp 0x1404de897
mov qword [rax + 8], rbx
jmp 0x1404de8a4
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmp r15w, di
test sil, 0x1d
test r9w, r9w
push r14
sub rsp, 0x40
jmp 0x1404de8c7
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
mov rbx, rax
test esi, edi
test rax, rax
jmp 0x1404de8dd
je 0x1404dea6c
mov rsi, rax
cmc
cmp di, 0x2917
cmp word [rax], r14w
jmp 0x1404de8f5
je 0x1404de93e
or rax, 0xffffffffffffffff
jmp 0x1404de904
inc rax
jmp 0x1404de90f
cmp word [rsi + rax*2], r14w
jmp 0x1404de919
jne 0x1404de904
lea rsi, [rsi + rax*2]
test r12b, 0x96
cmc
add rsi, 2
cmp si, si
cmp word [rsi], r14w
jmp 0x1404de938
jne 0x1404de8fb
mov qword [rsp + 0x38], r14
sub rsi, rbx
sal r9b, 0xf5
mov qword [rsp + 0x30], r14
bts r8w, r10w
jmp 0x1404de95f
add rsi, 2
btc r8d, 0x95
cmovl r9d, ecx
sar rsi, 1
bsr r9d, r15d
mov r8, rbx
sbb r9w, 0x7a24
mov r9d, esi
mov dword [rsp + 0x28], r14d
test r9w, 0x5782
clc
sub edx, edx
test bpl, 0x6c
jmp 0x1404de996
mov qword [rsp + 0x20], r14
test r13b, 0xa4
clc
sub ecx, ecx
jmp 0x1404de9a7
call fcn.1404cedf0
movsxd rbp, eax
clc
cmp cx, r9w
test eax, eax
jmp 0x1404de9bb
je 0x1404dea6c
mov rcx, rbp
jmp 0x1404de9c9
call fcn.1404ced2f
mov rdi, rax
test rax, rax
jmp 0x1404de9d9
je 0x1404dea4b
mov qword [rsp + 0x38], r14
btr r8, r14
mov r9d, esi
rol r8b, cl
movzx r8, r15w
mov qword [rsp + 0x30], r14
bswap r8w
rcl r8w, cl
mov r8, rbx
mov dword [rsp + 0x28], ebp
jmp 0x1404dea0b
xor edx, edx
test r15d, 0x12792cd6
xor ecx, ecx
jmp 0x1404dea1b
mov qword [rsp + 0x20], rax
jmp 0x1404dea25
call fcn.1404cedf0
test eax, eax
jmp 0x1404dea31
je 0x1404dea4b
mov rsi, rdi
movsx di, r8b
movsx edi, r12w
mov rdi, r14
jmp 0x1404dea5a
mov rsi, r14
movsx ecx, r15w
movzx ecx, r11w
movsx rcx, si
mov rcx, rdi
jmp 0x1404dea62
call fcn.1404cecb1
jmp 0x1404dea79
mov rsi, r14
cmp r13b, 0x78
jmp 0x1404dea79
test rbx, rbx
jmp 0x1404dea81
je 0x1404dea95
mov rcx, rbx
jmp 0x1404dea8f
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
or bp, 0x377
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov di, 0x2cd
shr r14, cl
mov rbp, qword [rsp + 0x58]
btr r14, 0x60
mov rdi, qword [rsp + 0x68]
mov r14d, 0x2e6279c7
bsf r14w, r8w
or r14b, al
add rsp, 0x40
pop r14
jmp 0x1404dead6
ret
Function at 0x1404dead7
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmp r9w, r13w
cmc
stc
mov qword [rsp + 0x10], rbp
stc
mov qword [rsp + 0x18], rsi
jmp 0x1404deaf2
push rdi
cmp dx, r11w
sub rsp, 0x20
jmp 0x1404deb00
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
mov rbx, rax
test rax, rax
jmp 0x1404deb13
je 0x1404debe9
mov rbp, rax
cmp r14b, r11b
cmp word [rax], si
jmp 0x1404deb27
je 0x1404deb69
or rax, 0xffffffffffffffff
jmp 0x1404deb36
inc rax
jmp 0x1404deb3e
cmp word [rbp + rax*2], si
jmp 0x1404deb48
jne 0x1404deb36
lea rbp, [rbp + rax*2]
test r15b, al
add rbp, 2
cmp word [rbp], si
jmp 0x1404deb63
jne 0x1404deb2d
sub rbp, rbx
btc ecx, 0xc4
cmc
bsf cx, bx
add rbp, 2
bswap rcx
cmp ax, 0x3b6d
sar rbp, 1
add rbp, rbp
xchg ecx, ecx
movsx cx, r8b
mov rcx, rbp
jmp 0x1404deb95
call fcn.1404ced2f
mov rdi, rax
test rax, rax
jmp 0x1404deba5
je 0x1404debcf
mov r8, rbp
bswap edx
mov rdx, rbx
not cl
mov cx, r14w
mov rcx, rax
jmp 0x1404debc1
call fcn.1404a8f08
mov rsi, rdi
clc
jmp 0x1404debcf
xor ecx, ecx
jmp 0x1404debd6
call fcn.1404cecb1
mov rcx, rbx
jmp 0x1404debe3
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
ror bpl, cl
bts di, bx
cmp sil, cl
mov rax, rsi
test r15w, sp
mov rsi, qword [rsp + 0x40]
btr bp, sp
xor dil, dil
mov rbp, qword [rsp + 0x38]
shl rdi, 0xe
xor dil, dl
add rsp, 0x20
bswap rdi
pop rdi
jmp 0x1404dec24
ret
Function at 0x1404e1af6
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
nop
cbw
cmovge ax, bx
mov qword [rsp + 0x18], rbp
movsx rax, r9w
push rsi
push rdi
cwde
not ax
push r14
movsxd rax, ecx
cwde
movsx rax, bx
mov eax, 0x1450
call fcn.14044df68
sub rsp, rax
and si, r8w
sal r14b, cl
mov rax, qword [0x1400b7288]
shl r14b, cl
xor r14, 0xb797a04
btr r14d, r14d
xor rax, rsp
shr r14w, 0xe
mov qword [rsp + 0x1440], rax
sete r10b
sal al, 0x8d
movsxd r10, edx
btc si, r12w
mov rdi, rcx
mov rax, r10
shl r14d, cl
sal r14w, cl
mov ebp, r9d
movzx rdx, r13w
mov r14b, r11b
sar rax, 6
inc r14b
xchg r14w, r14w
dec sil
lea rcx, [0x1400ba940]
rcl si, 0xe9
rcl si, cl
dec dx
and r10d, 0x3f
test r10, rsp
xor sil, sil
cdq
lea rbp, [rbp + r8]
mov sil, 7
shr r14, 0xc2
or r14b, 0x38
mov rsi, r8
mov rax, qword [rcx + rax*8]
adc dl, r9b
dec rdx
lea rdx, [r10 + r10*8]
cmc
cmp r12b, 0x3e
add r14b, 2
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x1404e1bd9
sub eax, eax
jmp 0x1404e1be0
mov qword [rdi], rax
cmp sil, r11b
mov dword [rdi + 8], eax
clc
test bpl, 0xaf
cmc
cmp r8, rbp
jae 0x1404e1d0b
lea rbx, [rsp + 0x40]
cmp bh, 0x83
test r14b, cl
cmp rsi, rbp
jmp 0x1404e1c0b
jae 0x1404e1c71
mov al, byte [rsi]
jmp 0x1404e1c18
inc rsi
cmc
cmp al, 0xa
jmp 0x1404e1c23
jne 0x1404e1c3c
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404e1c34
inc rbx
jmp 0x1404e1c3c
mov byte [rbx], al
bswap ax
movzx eax, si
movzx rax, di
inc rbx
btc rax, 0x9a
ror ah, 0xe8
lea rax, [rsp + 0x143f]
cmc
test sil, spl
test r13b, 0x4d
cmp rbx, rax
jmp 0x1404e1c6b
jb 0x1404e1c03
and qword [rsp + 0x20], 0
shr cl, 0x28
lea rax, [rsp + 0x40]
movzx rdx, r11w
sal r8, cl
sub ebx, eax
sets dh
cdq
movsxd rcx, r14d
lea r9, [rsp + 0x30]
movzx r8w, r10b
mov edx, 0x33ab79c2
movsx rcx, cx
mov r8d, ebx
movsx ecx, r9w
lea rdx, [rsp + 0x40]
movsxd rcx, edi
mov rcx, r14
jmp 0x1404e1cb9
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404e1cc6
je 0x1404e1d00
mov eax, dword [rsp + 0x30]
cmc
jmp 0x1404e1cd9
add dword [rdi + 4], eax
test r15b, 0x7d
cmp eax, ebx
jmp 0x1404e1ce7
jb 0x1404e1d0b
cmp rsi, rbp
jmp 0x1404e1cf5
jb 0x1404e1bf8
jmp 0x1404e1d0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rcl al, 0xf7
mov rax, rdi
btc rcx, 0x89
mov rcx, qword [rsp + 0x1440]
cmp r10d, r10d
stc
xor rcx, rsp
call fcn.1404a5381
lea r11, [rsp + 0x1450]
movsxd rbp, r9d
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
mov sil, 0x50
xchg si, si
pop r14
pop rdi
pop rsi
ret
Function at 0x1404e1d48
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
movsxd rax, edx
push rdi
movsx ax, r14b
push r14
mov eax, 0x1450
call fcn.14044df68
sub rsp, rax
or r14, 0x3dc4493b
mov sil, r9b
rol bpl, cl
mov rax, qword [0x1400b7288]
clc
xor rax, rsp
sbb r10, r13
xor dil, bl
test di, 0x2a6c
mov qword [rsp + 0x1440], rax
shl bpl, cl
cmovl eax, r8d
dec si
movsxd r10, edx
rcr r14b, 0x6d
btr ebp, r15d
movsx esi, r8w
mov rdi, rcx
mov rax, r10
movzx ecx, r8w
xor cl, r10b
mov ebp, r9d
sub edx, r11d
sbb dl, 7
sar rax, 6
lea rcx, [0x1400ba940]
adc r14b, 0x70
rcr dx, 0x10
and r10d, 0x3f
xadd r14b, dl
btc rdx, 0x56
add rbp, r8
shr r14, cl
mov rsi, r8
mov rax, qword [rcx + rax*8]
shl dl, 0xc9
bt r14w, cx
sal dh, cl
lea rdx, [r10 + r10*8]
shr r14, cl
mov r14, qword [rax + rdx*8 + 0x28]
clc
test r11w, 0x371
cmp r11b, 0x38
xor eax, eax
clc
mov qword [rdi], rax
test ah, 0x27
cmc
clc
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404e1e29
jae 0x1404e1f22
lea rbx, [rsp + 0x40]
clc
cmp rsi, rbp
jmp 0x1404e1e3d
jae 0x1404e1e94
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jmp 0x1404e1e53
jne 0x1404e1e7b
add dword [rdi + 8], 2
mov ecx, 0xd
cmp r14b, r14b
jmp 0x1404e1e6b
mov word [rbx], cx
test bx, 0x5e19
cmc
cmp eax, r9d
add rbx, 2
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmc
cmp rbx, rax
jb 0x1404e1e35
and qword [rsp + 0x20], 0
sal dx, 0xea
lea rax, [rsp + 0x40]
bts r8d, r10d
cmp r9b, al
sub rbx, rax
sub r9b, 0xeb
lea r9, [rsp + 0x30]
movsx rdx, sp
sar rdx, 0xf1
sar rbx, 1
movzx r8, bp
lea rdx, [rsp + 0x40]
and cl, r12b
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x1404e1eda
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404e1ee7
je 0x1404e1f1a
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmc
jmp 0x1404e1efa
cmp eax, ebx
jmp 0x1404e1f01
jb 0x1404e1f22
cmp rsi, rbp
jmp 0x1404e1f0f
jb 0x1404e1e2f
jmp 0x1404e1f22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
bts cx, si
dec rcx
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404e1f3c
call fcn.1404a5381
lea r11, [rsp + 0x1450]
setno bpl
not bl
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
mov si, 0x16e
bswap rsi
movzx di, r9b
pop r14
movzx si, r8b
pop rdi
not sil
pop rsi
jmp 0x1404e1f77
ret
Function at 0x1404e1f78
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cdqe
mov qword [rsp + 0x18], rbp
jmp 0x1404e1fab
push rsi
push rdi
lahf
push r12
cdqe
push r14
push r15
movsx rax, si
movzx eax, r8w
setg al
mov eax, 0x1470
call fcn.14044df68
sub rsp, rax
shr r12b, cl
cwde
mov rax, qword [0x1400b7288]
not rbx
rcl bl, 0x80
stc
xor rax, rsp
mov qword [rsp + 0x1460], rax
cmp r14b, r11b
movsxd r10, edx
sal r12w, cl
sar al, cl
mov rbx, rcx
mov rax, r10
xadd dx, r14w
movsx r15d, sp
mov r14d, r9d
rol di, 0xea
ror dl, cl
bswap edx
sar rax, 6
lea rcx, [0x1400ba940]
bts r15, rdx
btr r15d, r9d
and r10d, 0x3f
add r14, r8
jmp 0x1404e2038
mov r15, r8
cwd
mov rdi, r8
bt rdx, 0xce
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
sbb r12b, 0x53
mov r12, qword [rax + rdx*8 + 0x28]
test r9b, 0x20
cmp ah, cl
cmp r9b, 0x26
xor eax, eax
cmp r15b, r10b
test esp, ebx
cmc
mov qword [rbx], rax
cmp r8, r14
mov dword [rbx + 8], eax
jae 0x1404e2209
lea rax, [rsp + 0x50]
cmp rdi, r14
jmp 0x1404e2084
jae 0x1404e20e1
movzx ecx, word [rdi]
stc
test cx, 0x7231
add rdi, 2
test rsp, r10
cmp cx, 0xa
jmp 0x1404e20a3
jne 0x1404e20bc
mov edx, 0xd
cmc
mov word [rax], dx
stc
jmp 0x1404e20b8
add rax, 2
mov word [rax], cx
add rax, 2
and cl, 0xe2
lea rcx, [rsp + 0x6f8]
clc
cmp bpl, 0xc8
cmp rax, rcx
jmp 0x1404e20db
jb 0x1404e207c
and qword [rsp + 0x38], 0
sal ecx, cl
lea rcx, [rsp + 0x50]
sal r9b, cl
xor r8w, r9w
and qword [rsp + 0x30], 0
bt r8, rdi
dec r8b
cmc
lea r8, [rsp + 0x50]
sub rax, rcx
adc r9w, di
mov dword [rsp + 0x28], 0xd55
stc
rcl cl, cl
lea rcx, [rsp + 0x700]
shr r9, cl
sar rax, 1
not r9b
mov qword [rsp + 0x20], rcx
bsf rcx, r13
movsx rcx, bx
clc
mov r9d, eax
mov ecx, 0xfde9
cmp bpl, 0x4f
stc
xor edx, edx
call fcn.1404cedf0
mov ebp, eax
test eax, eax
jmp 0x1404e2156
je 0x1404e21fd
sub esi, esi
test eax, eax
jmp 0x1404e2165
je 0x1404e21e0
and qword [rsp + 0x20], 0
rol r8d, cl
bt r8w, 0xe4
lea rdx, [rsp + 0x700]
movsx cx, r14b
mov ecx, esi
movzx r8d, r12w
shl r8b, cl
lea r9, [rsp + 0x40]
movzx r8, r12w
rcr r8w, cl
rcl r8b, cl
mov r8d, ebp
test ch, 0x5f
add rdx, rcx
mov rcx, r12
sub r8d, esi
jmp 0x1404e21b4
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404e21c1
je 0x1404e21fd
add esi, dword [rsp + 0x40]
cmp bpl, 0x10
cmc
test r15d, r8d
cmp esi, ebp
jmp 0x1404e21da
jb 0x1404e216b
mov eax, edi
sub eax, r15d
test r15w, r12w
mov dword [rbx + 4], eax
cmp r9d, ebp
stc
cmp rdi, r14
jmp 0x1404e21f8
jmp 0x1404e2071
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
rcl ah, cl
sub ah, bh
mov rax, rbx
ror cx, cl
or rcx, 0xc8931cd
rcr cl, cl
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call fcn.1404a5381
lea r11, [rsp + 0x1470]
xchg r14b, dil
movsx bx, r13b
movzx r12w, dl
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
movsx r12w, bl
mov rsp, r11
setne dil
movsx rsi, cx
pop r15
movsxd r14, r12d
movzx r12d, bx
movzx si, r15b
pop r14
movsx esi, cx
pop r12
bswap esi
cmovo si, r14w
movzx edi, r10w
pop rdi
movsx esi, sp
pop rsi
jmp 0x1404e227f
ret
Function at 0x1404e592f
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cdq
bswap r9w
movzx r9d, dx
mov ebx, ecx
movzx r9d, r13w
mov r9b, r14b
lea r9, [0x1400c8ea0]
cdq
cmovs edx, edx
mov ecx, 2
not r8b
lea r8, [0x1400c8e98]
jmp 0x1404e596d
lea rdx, [0x1400cf758]
jmp 0x1404e5979
call fcn.1404e5b0f
mov ecx, ebx
test dil, dil
stc
test rax, rax
je 0x1404e59a3
add rsp, 0x20
mov bh, al
xchg rbx, rbx
pop rbx
jmp 0x1404e599c
push qword [0x1400b8d90]
ret
add rsp, 0x20
sets bh
movsx ebx, dx
movsx bx, r14b
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404e59ba
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
movzx r8, dx
sub rsp, 0x20
cmovno rdi, rdx
mov rbx, rdx
movsx r8, bp
movzx dx, r12b
lea r9, [0x1400c8ea8]
mov edi, ecx
cqo
lea rdx, [0x1400cf748]
movzx rcx, cx
bswap ecx
mov ecx, 3
setnp r8b
movsx r8d, bp
lea r8, [0x1400c8ea0]
jmp 0x1404e5a09
call fcn.1404e5b0f
mov rdx, rbx
xor cl, 0xd3
add cl, bl
mov ecx, edi
test rax, rax
jmp 0x1404e5a20
je 0x1404e5a31
call qword [case.0x1404e588a.0]
jmp 0x1404e5a37
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
mov di, 0x1d72
movzx edi, r14w
pop rdi
jmp 0x1404e5a4e
ret
Function at 0x1404ec663
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp fcn.1404e6fe6
push rbx
sub rsp, 0x20
mov bl, r8b
adc bl, r9b
test r8, r8
cmovp ax, dx
jmp 0x1404ec67b
movzx r9d, dx
rdtsc
cdqe
setns dh
lea rbx, [0x1400bae30]
rdtsc
mov edx, 0x2400
cmovne rbx, r8
movsxd rax, r15d
mov eax, 0x3ff
jmp 0x1404ec6a6
add edx, r9d
test spl, r12b
cmp dword [rbx], 0
jmp 0x1404ec6b4
jne 0x1404ec74b
cmp dx, ax
jmp 0x1404ec6c2
ja 0x1404ec6eb
and qword [rbx], 0
call fcn.1404bac3d
mov dword [rax], 0x2a
jmp 0x1404ec6dd
or rax, 0xffffffffffffffff
jmp 0x1404ec6e6
jmp 0x1404ec794
mov r8d, 0x2800
add edx, r13d
btc edx, 0x52
mov edx, r9d
test dx, r15w
jmp 0x1404ec704
add r9w, r8w
cmp r9w, ax
ja 0x1404ec735
shl edx, 0xa
test r12, r12
cmp r10b, r11b
and edx, 0xfc9ffc00
add edx, 0x10000
mov dword [rbx], edx
xor eax, eax
jmp 0x1404ec730
jmp 0x1404ec794
mov r8, rbx
movsx ebx, r13w
add rsp, 0x20
pop rbx
jmp 0x1404ec746
jmp 0x1401dc5bd
cmp dx, ax
jmp 0x1404ec753
ja 0x1404ec6c8
and qword [rsp + 0x40], 0
rcl r8w, 0x3f
bsf r8w, r12w
sal dl, cl
lea r8, [rsp + 0x40]
mov edx, r9d
stc
and edx, 0xffff23ff
add edx, dword [rbx]
jmp 0x1404ec781
call 0x1401dc5bd
and qword [rbx], 0
bts bx, r10w
btc rbx, 0xa2
add rsp, 0x20
mov rbx, r15
movzx ebx, r15w
movsx ebx, si
pop rbx
jmp 0x1404ec7a8
ret

Function at 0x140004000
Capabilities:
Encode data using xor

Disassembly:
xor rcx, rcx
sub rcx, 0xffffffffffffff86
lea rax, [entry0]
movabs rbx, 0x46c98642a0fd6d08
xor qword [rax + 0x27], rbx
sub rax, 0xfffffffffffffff8
loop 0x14000401b
pop rsp
xor al, 0xe8
ret
Function at 0x140005c2d
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1c8
call fcn.140017170
mov dword [0x1400ed000], 0
mov ecx, 0x2dc
call fcn.1400bb710
mov rbx, rax
lea rdi, [rsp + 0x20]
lea rsi, [0x1400c0540]
mov ecx, 0x32
rep movsq qword [rdi], qword [rsi]
movzx eax, word [rsi]
mov word [rdi], ax
lea rcx, [rsp + 0x20]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x4bda12f7
sar rax, 0x24
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x36
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x30]
xor word [rcx], ax
add edx, 1
add rcx, 2
cmp edx, 0xc9
jne 0x140005c78
lea rbp, [rsp + 0x20]
mov r8, rbp
mov edx, 0x16e
mov rcx, rbx
call sub.msvcrt.dll_swprintf_s
lea rcx, [0x1400ec040]
call fcn.1400247f0
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax]
mov rax, qword [rax]
mov r8d, 0
mov edx, 0
mov ecx, 0
call qword [rax]
mov r9d, eax
lea rsi, [0x1400c03a0]
mov ecx, 0x32
mov rdi, rbp
rep movsq qword [rdi], qword [rsi]
mov eax, dword [rsi]
mov dword [rdi], eax
movzx eax, word [0x1400c0534]
mov word [rdi + 4], ax
mov r8, rbp
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x4bda12f7
sar rax, 0x24
mov ecx, edx
sar ecx, 0x1f
sub eax, ecx
imul eax, eax, 0x36
mov ecx, edx
sub ecx, eax
lea eax, [rcx + 0x30]
xor word [r8], ax
add edx, 1
add r8, 2
cmp edx, 0xcb
jne 0x140005d20
lea r8, [rsp + 0x20]
mov edx, 0x16e
mov rcx, rbx
call sub.msvcrt.dll_swprintf_s
mov rcx, rbx
call fcn.1400bb6e0
mov eax, dword [0x1400ed000]
add rsp, 0x1c8
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140005eca
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2b0
mov rbx, rcx
mov rdi, rdx
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
mov ecx, 0x410
call fcn.1400bb710
mov rsi, rax
mov word [rsp + 0x2a0], 0x15
mov word [rsp + 0x2a2], 0x46
mov word [rsp + 0x2a4], 0x41
mov word [rsp + 0x2a6], 0x6f
mov word [rsp + 0x2a8], 0x1e
mov word [rsp + 0x2aa], 0x1b
mov word [rsp + 0x2ac], 0x1c
mov word [rsp + 0x2ae], 0x37
lea rcx, [rsp + 0x2a0]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x4bda12f7
sar rax, 0x24
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x36
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x30]
xor word [rcx], ax
add edx, 1
add rcx, 2
cmp edx, 8
jne 0x140005f62
mov r9, rdi
lea r8, [rsp + 0x2a0]
mov edx, 0x208
mov rcx, rsi
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov rax, qword [0x1400c68e0]
call qword [rax + 0x168]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140006119
lea r12, [rsp + 0x40]
lea r13, [rsp + 0x7c]
mov rbp, qword [0x1400c68e0]
jmp 0x1400060ca
mov qword [rsp + 0x30], r12
mov rcx, r13
call sub.msvcrt.dll_wcslen
lea rdi, [rax + rax]
mov r14, rdi
sar r14, 1
mov qword [rsp + 0x28], r14
cmp rdi, 0xe
ja 0x14000605c
mov rcx, qword [rsp + 0x30]
cmp r14, 1
jne 0x140006082
movzx eax, word [rsp + 0x7c]
mov word [rcx], ax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x30]
mov word [rdx + rax*2], 0
mov rcx, qword [rbx + 8]
cmp rcx, qword [rbx + 0x10]
je 0x1400060b4
lea rax, [rcx + 0x10]
mov qword [rcx], rax
mov rdx, qword [rsp + 0x30]
mov r9d, 0
mov rax, qword [rsp + 0x38]
lea r8, [rdx + rax*2]
call fcn.1400aa5d0
jmp 0x140006094
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov r8d, 0
call fcn.1400ac3c0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
jmp 0x140006008
test r14, r14
je 0x14000601b
mov r8, rdi
mov rdx, r13
call sub.msvcrt.dll_memcpy
jmp 0x14000601b
add qword [rbx + 8], 0x20
mov rcx, qword [rsp + 0x30]
cmp rcx, r12
je 0x1400060d5
mov rax, qword [rsp + 0x40]
lea rdx, [rax + rax + 2]
call fcn.1400bb700
jmp 0x1400060d5
lea r8, [rsp + 0x30]
mov rdx, rcx
mov rcx, rbx
call fcn.1400a55c0
jmp 0x140006099
test eax, eax
je 0x1400060e5
test byte [rsp + 0x50], 0x10
je 0x140005fe6
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [rbp + 0x170]
jmp 0x1400060c6
mov rcx, rsi
mov rax, qword [0x1400c68e0]
call qword [rax + 0x178]
jmp 0x140006119
mov rax, rbx
add rsp, 0x2b0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140007816
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r10d, dword [rcx + rax + 0x88]
add r10, rcx
mov r9d, dword [r10 + 0x20]
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140007893
mov r8d, r8d
mov edx, 0
add r9, rcx
jmp 0x140007848
add rdx, 1
cmp rdx, r8
je 0x14000789a
mov eax, dword [r9 + rdx*4]
add rax, rcx
cmp dword [rax], 0x50746547
jne 0x14000783f
cmp dword [rax + 4], 0x41636f72
jne 0x14000783f
cmp dword [rax + 8], 0x65726464
jne 0x14000783f
cmp word [rax + 0xc], 0x7373
jne 0x14000783f
cmp byte [rax + 0xe], 0
jne 0x14000783f
mov eax, dword [r10 + 0x24]
lea rdx, [rcx + rdx*2]
movzx edx, word [rdx + rax]
mov eax, dword [r10 + 0x1c]
lea rdx, [rcx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rcx
jmp 0x14000789f
mov eax, 0
jmp 0x14000789f
mov eax, 0
ret