joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404b3283
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
shl al, cl
cmp eax, r8d
cmp ebx, 0x4ec35f64
mov qword [rsp + 0x10], rsi
add edx, 0x653e7e1d
not dx
push rdi
clc
sub rsp, 0x20
add qword [rcx + 0x20], 8
add ax, 0xb87
mov rdi, rcx
mov rax, qword [rcx + 0x20]
bsf rdx, r11
rcr dl, cl
mov esi, dword [rcx + 0x38]
movsx ebx, r8w
xor dx, bp
cmp r10b, r10b
cmp esi, 0xffffffff
mov r8d, dword [rcx + 0x3c]
movsx rbx, r9w
movsx edx, r8w
movzx edx, word [rcx + 0x42]
setns bh
jmp 0x1404b32e9
mov rbx, qword [rax - 8]
movzx ax, ah
cmovle rax, rax
mov eax, 0x7fffffff
jmp 0x1404b32ff
mov qword [rcx + 0x48], rbx
jmp 0x1404b3308
cmove esi, eax
mov rcx, qword [rcx]
jmp 0x1404b3313
call fcn.140129171
test al, al
jmp 0x1404b331f
je 0x1404b3368
test rbx, rbx
jmp 0x1404b332d
jne 0x1404b333e
lea rbx, [0x1400d25f0]
mov qword [rdi + 0x48], rbx
movsxd rdx, esi
cmovb cx, r13w
movzx ecx, r12w
setnp ch
mov rcx, rbx
jmp 0x1404b3355
mov byte [rdi + 0x54], 1
jmp 0x1404b335e
call fcn.14011c131
jmp 0x1404b342e
test rbx, rbx
jmp 0x1404b3370
jne 0x1404b3388
lea rbx, [0x1400ced98]
cmp r10b, r12b
cmp r13b, 0xf8
mov qword [rdi + 0x48], rbx
xor r9d, r9d
test esi, esi
jmp 0x1404b3392
jle 0x1404b341f
cmp byte [rbx], 0
jmp 0x1404b33a0
je 0x1404b341f
mov rax, qword [rdi + 8]
and cl, sil
cmp bl, 0x78
movzx edx, byte [rbx]
xadd cl, r8b
movsx cx, bpl
mov rcx, qword [rax]
btc r8w, 0x43
sal r8w, 0x10
mov rax, qword [rcx]
movsx cx, dil
lea rcx, [rbx + 1]
rcl r8d, 0x3c
movzx r8d, word [rax + rdx*2]
cmp ebx, r13d
stc
and r8d, 0x8000
jmp 0x1404b33ef
cmove rcx, rbx
cmovle bx, bp
movzx bx, r15b
inc r9d
sal ebx, 0x1a
neg rbx
add bl, 7
lea rbx, [rcx + 1]
test si, 0x46d9
cmp r13b, r9b
cmp al, 0x15
cmp r9d, esi
jl 0x1404b3398
mov eax, r9d
add sil, 0x45
shr sil, cl
movzx bx, spl
mov dword [rdi + 0x50], eax
or si, 0x4578
cmp esi, r13d
mov al, 1
sal bl, cl
mov edi, 0x7cca1e16
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
inc dil
add rsp, 0x20
pop rdi
jmp 0x1404b3459
ret
Function at 0x1404b3b61
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
shl rbx, 0x78
add bl, 0x9d
btc rbx, 0x13
mov qword [rsp + 0x18], rbp
bswap rbx
rcl bl, 0x88
bts ebx, ecx
mov qword [rsp + 0x20], rsi
bts bx, r15w
add bl, 0xcc
push rdi
sub rsp, 0x30
cmc
btr bx, sp
sub ebp, ebp
inc bh
mov rbx, rcx
cmp byte [rcx + 0x54], bpl
jmp 0x1404b3ba7
jne 0x1404b3cdd
cmp dword [rcx + 0x50], ebp
jle 0x1404b3cdd
mov rsi, qword [rcx + 0x48]
mov r8, 0x3fd55c4b
mov edi, ebp
movsx r8d, r8w
mov r9, qword [rbx + 8]
rdtsc
lea rcx, [rsp + 0x40]
rdtsc
bswap r8w
jmp 0x1404b3bdd
mov word [rsp + 0x40], bp
lahf
not r8d
mov rdx, rsi
cwde
cbw
mov rax, qword [r9]
movzx r8d, cx
cmovg r8, r13
movsx r8d, r8w
movsxd r8, dword [rax + 8]
jmp 0x1404b3c04
call fcn.1404d53e6
movsxd r8, eax
clc
test eax, eax
jmp 0x1404b3c14
jle 0x1404b3ccf
mov rcx, qword [rbx + 0x468]
movsx rdx, r15w
movzx edx, word [rsp + 0x40]
cdqe
sal ax, cl
mov rax, qword [rcx + 8]
clc
stc
cmp qword [rcx + 0x10], rax
jmp 0x1404b3c3e
jne 0x1404b3c69
cmp byte [rcx + 0x18], bpl
jmp 0x1404b3c4d
je 0x1404b3c60
inc dword [rbx + 0x28]
jmp 0x1404b3c5b
jmp 0x1404b3cb7
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b3cb7
inc dword [rbx + 0x28]
movsxd rax, r10d
inc qword [rcx + 0x10]
shr al, cl
cdqe
sbb ecx, 0x41f846fa
mov rax, qword [rbx + 0x468]
movsx cx, r15b
sar ecx, 0x39
and ecx, 0x1ff808ff
mov rcx, qword [rax]
rcl ah, cl
neg ah
adc rax, 0x6c7f4a33
mov word [rcx], dx
sbb eax, r14d
shr ah, cl
adc ax, 0x588a
mov rax, qword [rbx + 0x468]
add qword [rax], 2
add rsi, r8
inc edi
cmp edi, dword [rbx + 0x50]
jmp 0x1404b3cc4
jne 0x1404b3bc7
jmp 0x1404b3d0e
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b3cd8
jmp 0x1404b3d0e
mov r8d, dword [rbx + 0x50]
bswap edx
movsx eax, r15w
lea rax, [rcx + 0x10]
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
jmp 0x1404b3cf8
add rcx, 0x468
mov qword [rsp + 0x20], rax
jmp 0x1404b3d09
call fcn.1404b1fda
mov rbx, qword [rsp + 0x48]
cmc
movzx rsi, r13w
inc sil
mov al, 1
jmp 0x1404b3d22
mov rbp, qword [rsp + 0x50]
sal dil, 0xd
mov rsi, qword [rsp + 0x58]
rol dil, 0x63
btc di, r10w
add rsp, 0x30
movsx di, sil
pop rdi
jmp 0x1404b3d48
ret
Function at 0x1404b5706
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmp r14, 0x456929c8
test bp, r9w
mov qword [rsp + 0x10], rsi
btc si, r9w
setnp sil
bt esi, 0x8b
push rdi
bsf di, r10w
movzx di, r9b
sub rsp, 0x30
mov edi, edx
bt si, bp
mov rsi, rcx
stc
test r8w, r11w
cmc
test r8, r8
jmp 0x1404b574e
jne 0x1404b5770
call fcn.1404ba009
mov dword [rax], 0x16
call fcn.1404bac79
sub eax, eax
jmp 0x1404b576b
jmp 0x1404b5871
mov rdx, r9
jmp 0x1404b5778
mov rcx, r8
call fcn.1404b58d6
mov rbx, rax
test r9b, r15b
jmp 0x1404b578b
test rax, rax
jmp 0x1404b5793
je 0x1404b5810
lea rax, [rsp + 0x50]
movzx r9d, r15w
mov r9w, bp
mov rdx, rdi
mov r8b, r14b
mov qword [rsp + 0x28], rax
setno r8b
mov rax, r10
lea r8, [0x140094b24]
cbw
movzx ecx, bp
mov eax, dword [rsp + 0x60]
mov r9, rbx
xchg cx, cx
bswap ecx
mov rcx, rsi
jmp 0x1404b57d8
mov dword [rsp + 0x20], eax
jmp 0x1404b57e1
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
clc
jmp 0x1404b57f0
test rax, rax
jmp 0x1404b57f8
jne 0x1404b5895
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b580b
call fcn.1404ba084
xor edi, edi
test rbx, rbx
jmp 0x1404b581a
je 0x1404b5863
mov rcx, qword [rbx + 0x10]
jmp 0x1404b5829
test rcx, rcx
jmp 0x1404b5831
je 0x1404b583d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
clc
test rcx, rcx
jmp 0x1404b584a
je 0x1404b5856
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b585e
call fcn.1404ce047
mov rax, rdi
sar rdi, cl
sub dil, 0x2c
movsx si, bl
mov rbx, qword [rsp + 0x40]
btc edi, 0xe
xor rsi, r12
stc
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
movsx edi, bx
movzx di, al
pop rdi
jmp 0x1404b5894
ret
mov rcx, qword [rsp + 0x68]
jmp 0x1404b589f
test rcx, rcx
jmp 0x1404b58a7
je 0x1404b58b6
mov eax, dword [rsp + 0x50]
test r15b, r14b
mov dword [rcx], eax
sub ebx, ebx
jmp 0x1404b58bd
jmp 0x1404b5812

Function at 0x1404b5b92
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
movsx rbx, r13w
mov ebx, ecx
call fcn.1404d7666
cmp eax, 1
jmp 0x1404b5bab
je 0x1404b5be4
mov rax, qword gs:[0x60]
mov dx, si
mov edx, dword [rax + 0xbc]
test bx, ax
cmc
shr edx, 8
test dl, 1
jne 0x1404b5be4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b5beb
call fcn.1404b5ae6
mov ecx, ebx
jmp 0x1404b5bf7
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404bad14
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movsx rcx, r13w
bswap cx
movzx cx, ch
mov ecx, 0x17
jmp 0x1404bad2d
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404bad47
mov ecx, 5
int 0x29
jmp 0x1404bad47
mov r8d, 1
mov edx, 0xc0000417
mov cx, 0x166
cmovg cx, sp
movsx rcx, bx
lea ecx, [r8 + 1]
jmp 0x1404bad67
call fcn.1404bad93
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor dh, 0x27
mov edx, 0x3c0366ef
mov edx, 0xc0000417
cmc
add rsp, 0x28
jmp 0x1404bad8c
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404bbdc8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmc
cmp sil, 0x73
test bpl, sil
mov qword [rsp + 0x10], rbp
cmp r11w, 0x5b3d
jmp 0x1404bbde6
mov qword [rsp + 0x18], rsi
stc
cmp ebp, 0x3b9b044d
push rdi
movzx rdi, r13w
sub rsp, 0x30
movzx rdi, r10w
xor ebp, ebp
sar di, 0x2e
mov rdi, rcx
cmp r14d, 0x112729d1
test ebx, ecx
test rcx, rcx
je 0x1404bbe94
or rbx, 0xffffffffffffffff
jmp 0x1404bbe23
inc rbx
clc
cmp word [rcx + rbx*2], bp
jmp 0x1404bbe30
jne 0x1404bbe23
inc rbx
bswap ecx
lea rcx, [rbx + rbx]
jmp 0x1404bbe44
call fcn.1401a0fe4
mov rsi, rax
cmc
test rax, rax
jmp 0x1404bbe55
je 0x1404bbe94
mov r8, rdi
mov rdx, rbx
xchg rcx, rcx
jmp 0x1404bbe6d
mov rcx, rax
jmp 0x1404bbe75
call fcn.1404cecce
test eax, eax
jmp 0x1404bbe81
jne 0x1404bbec5
mov rax, rsi
jmp 0x1404bbe8f
jmp 0x1404bbe9e
sub eax, eax
clc
xchg ebp, edi
xor si, 0x5528
mov rbx, qword [rsp + 0x40]
sar sil, cl
bswap edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
movzx edi, bx
movzx di, r9b
pop rdi
jmp 0x1404bbec4
ret
xor r9d, r9d
cmp sil, 0x52
jmp 0x1404bbed1
mov qword [rsp + 0x20], rbp
jmp 0x1404bbedb
xor r8d, r8d
stc
clc
jmp 0x1404bbee5
sub edx, edx
stc
sub ecx, ecx
jmp 0x1404bbeef
call fcn.1404bad14
int3
Function at 0x1404c8891
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
rcr bl, cl
shl ax, cl
cmp r8b, 0x27
mov qword [r11 + 0x20], r9
shl al, cl
or ebx, 0x4df006f2
rcr al, 9
mov dword [rsp + 0x10], edx
push rbp
adc eax, 0x6222674c
rcr al, cl
push rsi
push rdi
push r12
bswap ebx
cwde
cmp r12b, r10b
push r13
push r14
push r15
rcr rbx, cl
bts bx, r8w
sub rsp, 0x20
add r13b, 0xa1
mov rax, qword [rcx + 8]
sub bpl, bpl
bt r15w, 0xbf
xchg r12w, bx
sub r14b, r14b
test dil, r14b
mov bx, r8w
mov qword [r11 + 8], rax
bt r12w, bx
sub edi, edi
shr sil, 0xe
rol r15w, cl
mov r12, r9
xor bh, 0x31
mov r13d, r8d
sal bl, cl
cmp r12b, r12b
movzx rsi, sp
mov rbx, rcx
bt rsi, rbp
lea rsi, [rax - 1]
movsx r15, r13w
bt r15w, dx
and r15b, 0x7c
mov r15, rsi
test r14b, r13b
stc
cmp dword [rcx], edi
jmp 0x1404c8942
jle 0x1404c89e5
mov r12d, dword [r11 + 0x10]
test r12b, r10b
cmp edi, r12d
jmp 0x1404c8957
jne 0x1404c8964
mov rsi, rax
clc
mov bpl, 1
cmp edi, r13d
jmp 0x1404c896c
jne 0x1404c8985
mov r15, rax
sar r14b, 0xd3
mov r14b, 1
jmp 0x1404c8985
test bpl, bpl
jmp 0x1404c898d
je 0x1404c89a1
test r14b, r14b
jmp 0x1404c899b
jne 0x1404c89dd
lea rdx, [rsp + 0x60]
xchg cl, cl
cmovg rcx, rdi
mov cl, r12b
mov rcx, rbx
jmp 0x1404c89b7
call fcn.14019dda9
inc edi
test r14b, bpl
cmp edi, dword [rbx]
jmp 0x1404c89c8
jge 0x1404c89dd
mov rax, qword [rsp + 0x60]
jmp 0x1404c89d8
jmp 0x1404c894f
mov r12, qword [rsp + 0x78]
neg r14d
mov rax, qword [r12]
mov qword [r12 + 8], rsi
cmp ch, 0x35
sar di, cl
cmp dl, r12b
movups xmm0, xmmword [rbx]
shl rbp, 0x68
btr r12w, 0xc5
movups xmmword [rax], xmm0
movzx esi, dx
inc r12w
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
sub r12b, 0xc5
mov rax, qword [rsp + 0x80]
rcr r14b, 0xcb
sbb dil, dil
or r14d, 0x47293fa7
mov rcx, qword [rax]
rol si, cl
mov qword [rax + 8], r15
bsf r14d, ecx
bts r15w, si
movups xmm0, xmmword [rbx]
mov r12w, r12w
bts r13, r13
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
btc r14, 0x26
mov rbx, qword [rsp + 0x70]
movups xmmword [rcx + 0x10], xmm1
rcr r15w, 0xd6
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
movzx rdi, r9w
movzx di, bl
cmovne rbp, rcx
pop rdi
cmovbe bp, r10w
movzx esi, dx
setb sil
pop rsi
jmp 0x1404c8a93
pop rbp
jmp 0x1404c8a99
ret

Function at 0x1404cf64d
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
adc r8b, 0xfc
movsx r8w, r9b
sbb bh, 0xf7
push rdi
bts r9, rdi
test rbx, 0x3b9d6ef5
sub rsp, 0x20
movsxd rdi, r11d
mov rbx, rdx
movsx r9d, ax
lea r9, [0x1400c63d8]
cwd
cmovs rdx, r13
mov r8d, 0x75db7e64
mov edi, ecx
lea rdx, [0x1400cf748]
movsxd rcx, eax
setns r8b
mov ecx, 6
lea r8, [0x1400c63d0]
call fcn.1404d051d
mov rdx, rbx
mov ecx, edi
cmp ebp, 0xa2d3f43
clc
test rax, rax
jmp 0x1404cf6c0
je 0x1404cf6d1
call qword [case.0x14044d43c.0]
jmp 0x1404cf6d7
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
not rdi
pop rdi
jmp 0x1404cf6e9
ret
Function at 0x1404cf86e
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
rcl ebx, 2
shrd ebx, r9d, 0xd7
mov qword [rsp + 0x10], rbp
ror bh, 0x7a
mov qword [rsp + 0x18], rsi
mov bl, bpl
push rdi
cmovbe edi, ecx
bt rdi, r11
bts di, si
sub rsp, 0x30
mov ebx, r9d
setp r9b
cmovp r9d, r8d
not bp
mov rdi, r8
mov esi, edx
lea r9, [0x1400c63e8]
mov r8b, sil
cqo
mov rbp, rcx
cmovnp r8, r15
movzx rdx, di
movsx edx, bp
lea r8, [0x1400c63e0]
movzx rcx, r8w
mov dl, r10b
lea rdx, [0x1400cf190]
not rcx
mov ecx, 0xb
jmp 0x1404cf8ea
call fcn.1404d051d
mov rcx, rbp
test r9d, r13d
test rax, rax
je 0x1404cf91a
mov r9d, ebx
mov r8, rdi
movzx rdx, sp
mov edx, esi
jmp 0x1404cf90f
call qword [case.0x14044d43c.0]
jmp 0x1404cf93a
sub edx, edx
jmp 0x1404cf921
call fcn.1404cffd0
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov dx, r12w
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
shr di, 0x79
adc bp, 0x5742
mov rbp, qword [rsp + 0x48]
btc si, bp
sar si, 0xef
mov esi, r13d
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1404da272
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
ror bl, cl
mov rdx, qword [rcx]
cmova bx, si
or bx, di
or r8, 0xffffffffffffffff
sbb bl, sil
mov rbx, rcx
mov cx, sp
neg cx
add cx, bx
xor edi, edi
movzx ecx, di
xchg rcx, rcx
not cl
mov rcx, r8
inc rcx
test spl, r8b
stc
test rbx, 0x509d6114
cmp word [rdx + rcx*2], di
jmp 0x1404da2bf
jne 0x1404da2a8
mov eax, edi
shr al, 6
inc al
cmp rcx, 3
not al
sete al
jmp 0x1404da2da
mov dword [rbx + 0x18], eax
movzx ax, r14b
cbw
mov rax, qword [rbx + 8]
jmp 0x1404da2ed
inc r8
cmp word [rax + r8*2], di
jne 0x1404da2ed
cmp r8, 3
cwde
movsx eax, r13w
mov eax, edi
mov al, al
sete al
jmp 0x1404da311
mov dword [rbx + 0x1c], eax
jmp 0x1404da323
cmp rcx, 3
jmp 0x1404da32c
jne 0x1404da341
mov ecx, 2
jmp 0x1404da33c
jmp 0x1404da3ce
mov r9d, edi
jmp 0x1404da349
test rdx, rdx
jmp 0x1404da351
jne 0x1404da363
mov ecx, edi
jmp 0x1404da35e
jmp 0x1404da3ce
mov ecx, 2
shld eax, r8d, 0x22
rcl r8b, 0x22
bt ax, r15w
movzx r8d, word [rdx]
sbb eax, r15d
lea rdx, [rdx + rcx]
cmova ax, r9w
rcr al, cl
btc ax, 0xf9
lea eax, [r8 - 0x41]
stc
test rax, 0x48142e5e
cmp ax, 0x19
jbe 0x1404da3bd
sub r8w, 0x61
stc
jmp 0x1404da3ad
cmp r8w, 0x19
jmp 0x1404da3b7
ja 0x1404da3ca
inc r9d
jmp 0x1404da3c5
jmp 0x1404da376
mov ecx, r9d
clc
sub r9d, r9d
movsx edx, bp
mov dword [rbx + 0x14], ecx
shrd cx, r10w, 0xaa
shr dl, 0xe9
xor r8d, r8d
xchg rdx, rcx
cwd
lea rcx, [0x1400ab3bc]
movsx dx, r12b
lea edx, [r9 + 3]
jmp 0x1404da3fd
call fcn.1404cf36c
mov ecx, dword [rbx + 0x10]
test cl, 7
setne dl
stc
xchg al, al
bt ecx, 9
mov al, 0x15
setb al
clc
stc
cmp spl, sil
and dl, al
bt ecx, 8
mov al, al
setb al
cmp rsp, r10
cmc
test rcx, r8
test al, dl
jmp 0x1404da435
jne 0x1404da441
mov dword [rbx + 0x10], edi
xor dil, cl
mov rbx, qword [rsp + 0x30]
mov dil, 0xb1
add rsp, 0x20
movzx edi, cx
pop rdi
jmp 0x1404da456
ret
Function at 0x1404db739
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx rbx, r11w
mov bh, 0xda
mov rbx, rcx
jmp 0x1404db752
call fcn.1404ce37c
or r8, 0xffffffffffffffff
ror dl, cl
movzx r9w, r14b
mov r9, r8
sub edi, edi
inc dx
lea rdx, [rax + 0x98]
jmp 0x1404db77c
mov rax, qword [rdx]
inc r9
test cl, 0xdd
cmc
cmp word [rax + r9*2], di
jmp 0x1404db790
jne 0x1404db77f
mov eax, edi
test r12d, 0x23de1ddc
cmp r9, 3
sete al
jmp 0x1404db7ab
mov dword [rdx + 0x18], eax
lahf
mov rax, qword [rdx + 8]
jmp 0x1404db7b8
inc r8
cmp rsp, 0x7ed45530
jmp 0x1404db7c7
cmp word [rax + r8*2], di
jne 0x1404db7b8
cmp r8, 3
movzx r8, si
jmp 0x1404db7e0
mov eax, edi
mov r8d, 2
mov al, sil
sete al
clc
mov dword [rdx + 0x1c], eax
cmp r14b, 0xd2
mov dword [rbx + 4], edi
cmp r8w, r12w
cmp dword [rdx + 0x18], edi
jmp 0x1404db805
jne 0x1404db876
mov rcx, qword [rdx]
mov r10b, 0x56
inc r10b
xor r10w, sp
mov r10d, edi
movzx r9d, word [rcx]
sub al, spl
sbb rax, 0x30473094
lea rcx, [rcx + r8]
movzx eax, bp
lea eax, [r9 - 0x41]
cmp sp, 0x500b
cmp ax, 0x19
jmp 0x1404db842
jbe 0x1404db866
sub r9w, 0x61
cmp rsi, r11
cmc
jmp 0x1404db856
cmp r9w, 0x19
jmp 0x1404db860
ja 0x1404db873
inc r10d
jmp 0x1404db86e
jmp 0x1404db81b
mov r8d, r10d
mov dword [rdx + 0x14], r8d
setle cl
movzx edx, si
mov dx, bp
lea rcx, [0x1400abdd4]
seto dl
bswap edx
cwd
mov edx, 1
jmp 0x1404db89b
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov ecx, dword [rbx]
test cl, 7
setne dl
jmp 0x1404db8ae
bt ecx, 9
setb al
test r15d, r12d
and dl, al
bt ecx, 8
xchg al, al
setb al
test al, dl
jmp 0x1404db8ca
jne 0x1404db8d9
mov dword [rbx], edi
movsx ebx, r15w
setle bh
mov rbx, qword [rsp + 0x30]
bt edi, r9d
bts edi, esp
add rsp, 0x20
setp dil
movzx edi, r13w
bswap rdi
pop rdi
ret
Function at 0x1404dc2ba
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
inc bx
mov qword [rsp + 0x18], rsi
shl bl, 0x1a
cmc
push rdi
sub rsp, 0x20
sub esi, esi
mov rdi, rdx
cmp esi, 0x48bb6038
shr ebx, cl
mov rbx, rcx
cmp r9w, 0x44e3
test rcx, rcx
jmp 0x1404dc2ee
je 0x1404dc399
cmp word [rcx], si
jmp 0x1404dc2fc
je 0x1404dc399
lea rdx, [0x1400d1d08]
jmp 0x1404dc30e
call fcn.14025f80d
test eax, eax
jmp 0x1404dc31a
je 0x1404dc399
lea rdx, [0x1400d1d00]
movzx rcx, r13w
jmp 0x1404dc330
mov rcx, rbx
jmp 0x1404dc338
call fcn.14025f80d
test eax, eax
jmp 0x1404dc344
jne 0x1404dc387
mov ecx, dword [rdi + 8]
movsxd rdx, ebx
xchg r8b, dl
lea r9d, [rsi + 2]
jmp 0x1404dc35c
lea r8, [rsp + 0x30]
bswap dx
not dh
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404dc3ca
mov eax, dword [rsp + 0x30]
jmp 0x1404dc382
jmp 0x1404dc3f3
mov rcx, rbx
jmp 0x1404dc38f
call fcn.1404e5507
jmp 0x1404dc3f3
mov ecx, dword [rdi + 8]
movsxd r8, r10d
lea r8, [rsp + 0x30]
setns dh
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404dc3b7
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dc3c4
jne 0x1404dc3d1
sub eax, eax
jmp 0x1404dc3f3
mov eax, dword [rsp + 0x30]
stc
cmp bp, 0x7d
jmp 0x1404dc3e0
test eax, eax
jmp 0x1404dc3e7
jne 0x1404dc3f3
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
test di, 0x7d30
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
bswap edi
movzx edi, r12w
movzx rdi, sp
pop rdi
jmp 0x1404dc416
ret

Function at 0x1404dc417
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
sbb rbx, 0x67895543
add rbx, r15
push rdi
sub rsp, 0x20
cmovl bx, r13w
movsxd rsi, r11d
mov esi, edx
movsx rbx, r15w
mov ebx, ecx
jmp 0x1404dc445
call fcn.1404ce37c
mov ecx, ebx
bswap rdx
shr dh, 0x95
sar rdx, 0xc5
lea r8, [rsp + 0x30]
cdq
and ecx, 0x3ff
cmc
mov r9d, 2
clc
bt edx, r10d
movzx edi, r14w
bts ecx, 0xa
movsx rdi, sp
mov edx, 0x20000001
cmove di, r10w
mov rdi, rax
jmp 0x1404dc48c
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
cmc
stc
clc
test eax, eax
jmp 0x1404dc49f
je 0x1404dc552
cmp ebx, dword [rsp + 0x30]
jmp 0x1404dc4ae
je 0x1404dc543
test esi, esi
jmp 0x1404dc4bb
je 0x1404dc543
mov r9, qword [rdi + 0x98]
lahf
shl dx, cl
mov r8d, r10d
cwde
rcl rdx, cl
add cl, r14b
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmc
stc
cmp r11w, 0x6de7
cmp ax, 0x19
jbe 0x1404dc506
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404dc500
ja 0x1404dc522
movzx edx, word [rcx]
inc r8d
cmp r12d, 0x16d549e9
stc
add rcx, 2
jmp 0x1404dc51d
jmp 0x1404dc4de
or rcx, 0xffffffffffffffff
inc rcx
stc
cmp word [r9 + rcx*2], r10w
jne 0x1404dc526
cmp r8d, ecx
jmp 0x1404dc53d
je 0x1404dc552
mov eax, 1
jmp 0x1404dc54d
jmp 0x1404dc556
sub eax, eax
neg edi
mov rbx, qword [rsp + 0x38]
shld rdi, r14, 0x40
bt rdi, rdx
neg di
mov rsi, qword [rsp + 0x40]
mov di, 0x590
movsx edi, bp
bt edi, esi
add rsp, 0x20
pop rdi
ret
Function at 0x1404ddcb2
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
cmc
clc
cmp si, 0x6b7f
mov qword [rax + 0x10], rbp
stc
clc
mov qword [rax + 0x18], rsi
cmp r13, 0x39fd7799
mov qword [rax + 0x20], rdi
test r9b, 0xd1
push r14
sub rsp, 0x40
jmp 0x1404ddce4
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
movzx bx, dl
bswap rbx
mov rbx, rax
jmp 0x1404ddcfc
test rax, rax
jmp 0x1404ddd04
je 0x1404dde93
mov rsi, rax
test r8, 0x79cc43d4
cmp word [rax], r14w
jmp 0x1404ddd1d
je 0x1404ddd5e
or rax, 0xffffffffffffffff
jmp 0x1404ddd2c
inc rax
cmp word [rsi + rax*2], r14w
jmp 0x1404ddd39
jne 0x1404ddd2c
lea rsi, [rsi + rax*2]
jmp 0x1404ddd4b
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404ddd58
jne 0x1404ddd23
mov qword [rsp + 0x38], r14
adc r8w, r9w
movzx r9d, r9w
adc r9, 0x249732d6
sub rsi, rbx
mov qword [rsp + 0x30], r14
rcl r8w, 0x3f
add rsi, 2
movsxd r9, r10d
sar rsi, 1
add r8w, dx
and r9, rsi
sar r9, cl
mov r8, rbx
rol r9b, cl
not r9b
mov r9d, esi
cmp r14b, 0xb9
mov dword [rsp + 0x28], r14d
xor edx, edx
cmp r9b, 0xd8
mov qword [rsp + 0x20], r14
cmp ax, r13w
xor ecx, ecx
jmp 0x1404dddbe
call fcn.1404ce18c
movsxd rbp, eax
cmc
test eax, eax
jmp 0x1404dddce
je 0x1404dde93
mov rcx, rbp
jmp 0x1404ddddc
call fcn.1404ce0d6
mov rdi, rax
cmp dx, r15w
test rsi, 0x7ec373d9
test rax, rax
je 0x1404dde73
mov qword [rsp + 0x38], r14
dec r9
rol r8b, 0xc6
mov r9d, esi
sub r8, 0x2c2222ee
bt r8, r10
sbb r8w, r10w
mov qword [rsp + 0x30], r14
sub r8b, r14b
shr r8w, cl
movsx r8, dx
mov r8, rbx
mov dword [rsp + 0x28], ebp
jmp 0x1404dde35
xor edx, edx
test r12w, r15w
cmp r8w, 0x6122
cmc
sub ecx, ecx
jmp 0x1404dde49
mov qword [rsp + 0x20], rax
jmp 0x1404dde53
call fcn.1404ce18c
test eax, eax
jmp 0x1404dde5f
je 0x1404dde73
mov rsi, rdi
mov dil, r12b
mov rdi, r14
jmp 0x1404dde81
mov rsi, r14
not cx
cmovne ecx, r8d
movsx ecx, r8w
mov rcx, rdi
jmp 0x1404dde89
call fcn.1404ce047
jmp 0x1404dde9b
mov rsi, r14
jmp 0x1404dde9b
test rbx, rbx
jmp 0x1404ddea3
je 0x1404ddeb7
mov rcx, rbx
jmp 0x1404ddeb1
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
stc
ror r14d, 0xd5
rol di, 0x7e
mov rax, rsi
movzx bp, r11b
mov rsi, qword [rsp + 0x60]
mov edi, r12d
ror bpl, 0xd0
adc bp, 0x689c
mov rbp, qword [rsp + 0x58]
bswap di
rcl r14b, cl
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
seto r14b
movzx r14w, bpl
pop r14
jmp 0x1404ddf02
ret
Function at 0x1404ddf03
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmp esi, 0x3af45d2d
cmp spl, r14b
mov qword [rsp + 0x10], rbp
test bpl, 0x27
clc
mov qword [rsp + 0x18], rsi
jmp 0x1404ddf25
push rdi
test r14b, 0x65
sub rsp, 0x20
jmp 0x1404ddf33
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
mov rbx, rax
test rax, rax
jmp 0x1404ddf46
je 0x1404de031
mov rbp, rax
stc
cmp dil, sil
cmp word [rax], si
jmp 0x1404ddf5b
je 0x1404ddfa1
or rax, 0xffffffffffffffff
jmp 0x1404ddf6a
inc rax
test dx, bp
clc
cmp word [rbp + rax*2], si
jmp 0x1404ddf7b
jne 0x1404ddf6a
lea rbp, [rbp + rax*2]
test ebp, 0x375738f2
stc
add rbp, 2
clc
cmp word [rbp], si
jmp 0x1404ddf9b
jne 0x1404ddf61
sub rbp, rbx
cmc
bts cx, ax
add rbp, 2
bsf cx, r12w
btr cx, 0xc2
xadd cx, cx
sar rbp, 1
bts rcx, rbx
sar ecx, cl
add rbp, rbp
bswap ecx
cmovg cx, di
mov rcx, rbp
jmp 0x1404ddfd5
call fcn.1404ce0d6
mov rdi, rax
test r15d, esi
stc
clc
test rax, rax
jmp 0x1404ddfea
je 0x1404de017
mov r8, rbp
setno dh
not dl
cwd
mov rdx, rbx
setl cl
mov rcx, rax
jmp 0x1404de008
call fcn.1404a81fb
mov rsi, rdi
cmp r13d, 0x231b36e0
sub ecx, ecx
jmp 0x1404de01e
call fcn.1404ce047
mov rcx, rbx
jmp 0x1404de02b
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
shl bpl, cl
sar al, cl
btr rax, 0xe
mov rax, rsi
adc rdi, 0x36876ada
cmc
mov rsi, qword [rsp + 0x40]
bt edi, 0x10
cmp r11b, r9b
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
movsx di, r15b
movzx edi, r10w
pop rdi
ret