joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404c6d28
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
add r11w, r13w
movzx ebx, dx
push rdi
sub rsp, 0x20
cmovg ebx, r11d
xor r10d, r10d
shl r11b, cl
cmp spl, 0xf4
sbb rbx, r10
mov rbx, r8
movzx r11w, al
sub r11d, 0x78563822
adc r11b, bpl
mov r11, rdx
clc
test r15, r8
test r9, r9
jne 0x1404c6dc2
test rcx, rcx
jmp 0x1404c6d74
jne 0x1404c6dd0
test rdx, rdx
je 0x1404c6da2
call fcn.1404b98a4
mov ebx, 0x16
mov dword [rax], ebx
call fcn.1404ba568
mov r10d, ebx
add dil, r13b
xor bl, r10b
movsx bx, r8b
mov rbx, qword [rsp + 0x30]
rol dil, cl
sar ax, cl
mov eax, r10d
inc di
add rsp, 0x20
movsx di, spl
movsx edi, r8w
pop rdi
ret
test rcx, rcx
jmp 0x1404c6dca
je 0x1404c6d83
test r11, r11
jmp 0x1404c6dd8
je 0x1404c6d83
test r9, r9
jmp 0x1404c6de6
jne 0x1404c6dfa
mov word [rcx], r10w
jmp 0x1404c6df5
jmp 0x1404c6da2
test rbx, rbx
jne 0x1404c6e11
mov word [rcx], r10w
jmp 0x1404c6e0c
jmp 0x1404c6d83
sub rbx, rcx
shr dil, cl
or r8b, 0x49
mov rdx, rcx
movsx di, r14b
clc
test cl, r12b
mov r8, r11
movsx rdi, cx
jmp 0x1404c6e35
mov rdi, r9
test r13b, 0x9c
cmp r9, 0xffffffffffffffff
jmp 0x1404c6e45
jne 0x1404c6e85
movzx eax, word [rbx + rdx]
clc
jmp 0x1404c6e56
mov word [rdx], ax
clc
jmp 0x1404c6e5f
lea rdx, [rdx + 2]
test ax, ax
jmp 0x1404c6e6b
je 0x1404c6eda
sub r8, 1
jmp 0x1404c6e7a
jne 0x1404c6e4b
jmp 0x1404c6eda
movzx eax, word [rbx + rdx]
test cl, 6
mov word [rdx], ax
stc
cmp cx, r10w
lea rdx, [rdx + 2]
test ax, ax
jmp 0x1404c6ea0
je 0x1404c6ec4
sub r8, 1
jmp 0x1404c6eaf
je 0x1404c6ec4
sub rdi, 1
jmp 0x1404c6ebe
jne 0x1404c6e85
test rdi, rdi
jne 0x1404c6eda
mov word [rdx], r10w
test al, 0x3e
cmp r11, 0x783575aa
test r8, r8
jmp 0x1404c6ee2
jne 0x1404c6da2
cmp r9, 0xffffffffffffffff
jne 0x1404c6f01
mov word [rcx + r11*2 - 2], r10w
lea r10d, [r8 + 0x50]
jmp 0x1404c6da2
mov word [rcx], r10w
jmp 0x1404c6f0a
call fcn.1404b98a4
mov ebx, 0x22
jmp 0x1404c6f19
jmp 0x1404c6d8d
Function at 0x1404c7e27
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
ror r10d, cl
bswap r10d
mov qword [rax + 0x18], rsi
movzx bx, r11b
btc r10w, r11w
cmp r14w, 0xbb7
mov qword [rax + 0x20], rdi
push r14
bsr r10w, r8w
btr bx, r15w
rol r10b, cl
or ebp, 0xffffffff
sbb rbx, rsi
btc bx, di
mov rbx, r8
cmp dword [rcx + 0x10], 0
xchg r10d, r10d
mov r10b, 0x6a
movsx r10d, r10w
mov r10, rdx
je 0x1404c800d
movsxd r9, dword [rcx + 0x10]
btr ecx, 0x27
and edi, 0x77a9355b
lea r14, [0x140000000]
cmovo eax, r9d
mov rdi, qword [rdx + 8]
sub esi, esi
movzx cx, r9b
cdq
rol dl, cl
lea r9, [r9 + rdi]
rcr dl, cl
shld edx, ecx, 0xc8
sub r8d, r8d
not cl
movsx r11w, dil
mov edx, ebp
movzx ecx, byte [r9]
jmp 0x1404c7ec9
and ecx, 0xf
shl r11b, 0x24
shrd rax, rdi, 0xfa
sal ax, cl
movsx rax, byte [rcx + r14 + 0xc1a30]
btc r11w, 0x37
mov cl, byte [rcx + r14 + 0xc1a40]
movsxd r11, r9d
sub r9, rax
mov r11d, dword [r9 - 4]
shr r11d, cl
test cx, 0x5c48
test r11d, r11d
je 0x1404c800d
mov rax, qword [r10 + 0x10]
or ch, 0xf2
sub r10b, cl
mov r10d, dword [rax]
sar ecx, 0x32
btr ecx, 0xfc
movzx ecx, byte [r9]
xor ah, 0x58
btr eax, 0x2b
not rax
and ecx, 0xf
add al, 0xd5
movsx rax, byte [rcx + r14 + 0xc1a30]
clc
jmp 0x1404c7f40
mov cl, byte [rcx + r14 + 0xc1a40]
sub r9, rax
and ax, 0x57d8
mov eax, dword [r9 - 4]
cmc
stc
clc
shr eax, cl
add esi, eax
mov eax, esi
clc
lea rax, [rax + r10]
add rax, rdi
cmp r13d, 0xc3f5c33
cmp rbx, rax
jmp 0x1404c7f73
jb 0x1404c7fe3
movzx ecx, byte [r9]
movzx edx, ax
movsx eax, r8w
setl dh
inc r8d
test bpl, bl
movsx dx, dil
add al, r10b
and ecx, 0xf
cwde
mov ah, 0xea
movsx rax, byte [rcx + r14 + 0xc1a30]
rcl dl, cl
mov cl, byte [rcx + r14 + 0xc1a40]
rcr dx, 0x65
bt dx, r10w
sub r9, rax
movsxd rdx, eax
mov edx, dword [r9 - 4]
cmp r13b, r10b
shr edx, cl
jmp 0x1404c7fcc
dec edx
test r8b, r9b
test r11b, 0x47
cmp r8d, r11d
jmp 0x1404c7fdd
jb 0x1404c7f1e
test r8d, r8d
bswap rax
movzx rax, r13w
movsx ax, r10b
cmove edx, ebp
mov ax, 0x1b8c
jmp 0x1404c8001
mov eax, edx
jmp 0x1404c8008
jmp 0x1404c8012
mov eax, ebp
movsxd rbp, r14d
mov rbx, qword [rsp + 0x10]
jmp 0x1404c8023
mov rbp, qword [rsp + 0x18]
movzx r14w, r9b
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
movsx r14, r12w
pop r14
jmp 0x1404c8042
ret

Function at 0x1404cec94
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
movsx r8d, r14w
cdq
mov rbx, rcx
lea r9, [0x1400c63c0]
movzx rdx, r11w
mov ecx, 3
not edx
cdq
xchg r8, rdx
lea r8, [0x1400c63b8]
cqo
lea rdx, [0x1400cfb70]
call fcn.1404cfca7
test rax, rax
jmp 0x1404cecd5
je 0x1404cecff
mov rcx, rbx
sar bx, 0x57
movsx ebx, r9w
bt bx, r15w
add rsp, 0x20
movsxd rbx, r15d
pop rbx
jmp 0x1404cecf8
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsxd rbx, r15d
jmp 0x1404ced0b
pop rbx
jmp 0x1404ced11
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1404ced94
Capabilities:
Get thread local storage value

Disassembly:
push rbx
stc
cmovns r8w, cx
bsf r9, r13
sub rsp, 0x20
xchg rdx, rdx
cqo
movsx rdx, r15w
mov ebx, ecx
movsxd rdx, r9d
lea r9, [0x1400c63d0]
bswap r8
cqo
mov ecx, 5
bswap dx
mov r8b, r15b
xchg r8b, r8b
lea r8, [0x1400c63c8]
movsx rdx, r15w
lea rdx, [0x1400cf758]
jmp 0x1404cede3
call fcn.1404cfca7
mov ecx, ebx
test bpl, 0x47
test spl, r12b
test rax, rax
jmp 0x1404cedf9
je 0x1404cee14
add rsp, 0x20
not bh
mov bh, al
pop rbx
jmp 0x1404cee0d
jmp qword [0x1400b8d90]
add rsp, 0x20
movsxd rbx, esp
pop rbx
jmp 0x1404cee21
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404cee28
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
xor r8d, r8d
clc
movsx rbx, r11w
push rdi
sub rsp, 0x20
movsx rdi, r10w
movzx rdi, ax
setne r8b
mov rbx, rdx
movsx r8, r10w
lea r9, [0x1400c63d8]
not dil
mov edi, ecx
movzx rcx, di
movsx rcx, dx
lea rdx, [0x1400cf748]
bswap cx
movzx ecx, sp
movzx r8, r10w
mov ecx, 6
mov r8w, 0x2d59
jmp 0x1404cee81
lea r8, [0x1400c63d0]
jmp 0x1404cee8d
call fcn.1404cfca7
mov rdx, rbx
bts rcx, r9
clc
mov ecx, edi
test rax, rax
jmp 0x1404ceea4
je 0x1404ceeb5
call qword [0x1400b8d90]
jmp 0x1404ceebb
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
adc rdi, 0x3dce37b6
add rsp, 0x20
not di
jmp 0x1404ceed3
pop rdi
jmp 0x1404ceed9
ret

Function at 0x1404cf05c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
btc rbx, 0xb9
mov qword [rsp + 0x10], rbp
bsf bx, bp
movsx ebx, si
mov qword [rsp + 0x18], rsi
cmovl rbp, rdi
movzx ebx, r14w
adc bpl, r15b
push rdi
sub rsp, 0x30
xchg bpl, bpl
movsx rsi, r11w
movzx rdi, r15w
mov ebx, r9d
mov rdi, r8
seta bpl
mov esi, edx
setno r8b
mov r9w, 0x2a63
lea r9, [0x1400c63e8]
jmp 0x1404cf0b3
mov rbp, rcx
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
movzx rcx, r15w
cmovb cx, di
jmp 0x1404cf0d1
mov ecx, 0xb
jmp 0x1404cf0db
call fcn.1404cfca7
mov rcx, rbp
clc
test rax, rax
je 0x1404cf10a
mov r9d, ebx
mov r8, rdi
cmovno edx, r12d
cdq
mov edx, esi
jmp 0x1404cf0ff
call qword [0x1400b8d90]
jmp 0x1404cf139
sub edx, edx
jmp 0x1404cf111
call fcn.1404cf75d
mov ecx, eax
movzx r9, r10w
movsx r9, r9w
mov r9b, 0xf5
mov r9d, ebx
xchg dl, r8b
mov r8, rdi
mov edx, esi
jmp 0x1404cf133
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
neg dil
mov rbp, qword [rsp + 0x48]
sbb edi, 0x424824d6
rcl rsi, cl
mov rsi, qword [rsp + 0x50]
btc edi, 0xed
btc edi, ecx
btr di, 0xe2
add rsp, 0x30
movzx rdi, r10w
jmp 0x1404cf16d
pop rdi
jmp 0x1404cf173
ret
Function at 0x1404cfa66
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
bts r8, rcx
and r9d, 0x41837e16
clc
lea r9, [0x1400c63a4]
bswap r8w
sub ecx, ecx
not dl
cmovp r8w, di
movsx r8w, r9b
lea r8, [0x1400c63a0]
movsx rdx, r14w
not dh
lea rdx, [0x1400cfbf8]
call fcn.1404cfca7
lea r9, [0x1400c63b0]
mov ecx, 1
cmovbe r8d, r11d
seto r8b
movsx edx, r15w
lea r8, [0x1400c63a8]
cmovb edx, r9d
cwd
lea rdx, [0x1400cf1d0]
call fcn.1404cfca7
lea r9, [0x1400c63b8]
mov ecx, 2
lea r8, [0x1400c63b0]
cmovl dx, dx
bswap dx
setns dl
lea rdx, [0x1400cf178]
jmp 0x1404cfb02
call fcn.1404cfca7
lea r9, [0x1400c63e0]
xchg cx, dx
mov ecx, 8
movzx r8w, r9b
movzx r8d, r14w
movzx r8, di
lea r8, [0x1400c63d8]
movzx dx, r11b
lea rdx, [0x1400cf158]
jmp 0x1404cfb3b
call fcn.1404cfca7
lea r9, [0x1400c63e8]
mov ecx, 0xb
bswap dx
mov dx, 0x38e9
cwd
lea r8, [0x1400c63e0]
movzx dx, bpl
lea rdx, [0x1400cf190]
jmp 0x1404cfb6d
call fcn.1404cfca7
lea r9, [0x1400c63f0]
cdq
movzx r8d, sp
mov ecx, 0xe
lea r8, [0x1400c63e8]
mov edx, 0x5cda2cc4
mov rdx, rdi
setno dl
lea rdx, [0x1400cf168]
jmp 0x1404cfba1
call fcn.1404cfca7
lea r9, [0x1400c63f8]
cqo
mov ecx, 0xf
cwd
movsxd rdx, r11d
mov r8b, 0x95
lea r8, [0x1400c63f0]
movsxd rdx, r14d
setae dl
lea rdx, [0x1400cf800]
jmp 0x1404cfbd5
call fcn.1404cfca7
lea r9, [0x1400c6408]
mov ecx, 0x13
cqo
movsx r8d, r11w
lea r8, [0x1400c6400]
lea rdx, [0x1400cf838]
jmp 0x1404cfbff
call fcn.1404cfca7
lea r9, [0x1400c6410]
mov ecx, 0x14
movsxd r8, ebp
xchg r8b, r8b
movzx r8, r13w
lea r8, [0x1400c6408]
movzx rdx, sp
cwd
xchg dh, dl
lea rdx, [0x1400cf1c0]
jmp 0x1404cfc35
call fcn.1404cfca7
lea r9, [0x1400c6418]
movzx r8d, cx
mov cx, 0x3fa0
mov ecx, 0x15
bswap r8d
lea r8, [0x1400c6410]
xchg dh, dl
mov dl, r15b
lea rdx, [0x1400cf820]
jmp 0x1404cfc69
call fcn.1404cfca7
lea r9, [0x1400c6420]
bts rdx, r14
sal r8w, 0x97
mov ecx, 0x16
lea r8, [0x1400c6418]
sar edx, 0xf6
lea rdx, [0x1400cfc08]
cmp r14b, al
cmp rax, 0x5f8a6538
add rsp, 0x28
jmp fcn.1404cfca7
Function at 0x1404db447
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsx rbx, r14w
mov bx, cx
mov rbx, rcx
call fcn.1404cdafb
or r8, 0xffffffffffffffff
ror edx, 0x4f
movsx r10d, r10w
btr dx, bx
mov r10, rax
cmp bpl, r15b
cqo
movzx edx, di
xor edi, edi
cwd
jmp 0x1404db487
mov rdx, qword [rax + 0x98]
jmp 0x1404db493
inc r8
clc
cmp word [rdx + r8*2], di
jmp 0x1404db4a1
jne 0x1404db493
mov eax, edi
shl al, 0xe1
shl ecx, cl
cmp r8, 3
sets al
mov ecx, 2
sete al
mov dword [r10 + 0xb0], eax
jmp 0x1404db4c9
je 0x1404db530
mov r9d, edi
jmp 0x1404db4e1
movzx r8d, word [rdx]
rol rax, cl
clc
movsxd rax, ebx
add rdx, rcx
xor ah, bh
rcl eax, cl
lea eax, [r8 - 0x41]
test dil, r14b
cmp ax, 0x19
jmp 0x1404db503
jbe 0x1404db519
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1404db526
inc r9d
jmp 0x1404db521
jmp 0x1404db4e1
mov ecx, r9d
xchg dx, dx
movzx rdx, r13w
mov dword [r10 + 0xac], ecx
movsx edx, ax
movzx ecx, r13w
mov edx, 1
lea rcx, [0x1400ac0b8]
jmp 0x1404db54f
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
test byte [rbx], 4
jne 0x1404db569
mov dword [rbx], edi
sbb bl, al
setns dil
sub rdi, rcx
mov rbx, qword [rsp + 0x30]
shr di, cl
rcr rdi, cl
add rsp, 0x20
pop rdi
ret

Function at 0x1404db965
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
test r12b, 0x14
xchg bl, dil
sal bl, cl
sub rsp, 0x20
seta dil
sbb dil, r14b
bsr rdi, rbx
sub esi, esi
bt di, r9w
shr dil, 0xab
mov rdi, rdx
sar bx, 0xe2
ror bl, cl
mov rbx, rcx
test bl, 0xe2
test rcx, rcx
jmp 0x1404db9aa
je 0x1404dba5b
cmp word [rcx], si
jmp 0x1404db9b8
je 0x1404dba5b
lea rdx, [0x1400d1d08]
jmp 0x1404db9ca
call fcn.14011ca83
test eax, eax
jmp 0x1404db9d6
je 0x1404dba5b
lea rdx, [0x1400d1d00]
movsx rcx, di
xchg ch, cl
movsxd rcx, r15d
mov rcx, rbx
jmp 0x1404db9f4
call fcn.14011ca83
test eax, eax
jmp 0x1404dba00
jne 0x1404dba49
mov ecx, dword [rdi + 8]
movzx r8d, ax
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
cmovp rdx, r14
movzx edx, r9w
mov edx, 0x2000000b
jmp 0x1404dba28
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dba35
je 0x1404dba8d
mov eax, dword [rsp + 0x30]
jmp 0x1404dba44
jmp 0x1404dbab2
mov rcx, rbx
jmp 0x1404dba51
call fcn.1404e4946
jmp 0x1404dbab2
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
movsx rdx, r13w
mov dl, r9b
mov edx, 0x20001004
jmp 0x1404dba7a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dba87
jne 0x1404dba99
sub eax, eax
jmp 0x1404dba94
jmp 0x1404dbab2
mov eax, dword [rsp + 0x30]
test r14d, 0x765f0d75
test eax, eax
jne 0x1404dbab2
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
bsr rdi, rsp
add rsp, 0x20
setb dil
movzx edi, ax
pop rdi
jmp 0x1404dbad1
ret
Function at 0x1404dbad2
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
btc bx, r12w
rcr bx, 0xf
bsr ebx, esi
mov qword [rsp + 0x18], rsi
and ebx, 0x459d15b2
push rdi
sub rsp, 0x20
not si
bswap bx
movzx esi, r12w
mov esi, edx
movsx bx, dh
movzx rbx, ax
mov bx, 0x30c
mov ebx, ecx
jmp 0x1404dbb12
call fcn.1404cdafb
mov ecx, ebx
ror dh, cl
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9w, r12w
movsx rdi, r13w
btc r9d, 0x2d
mov r9d, 2
bts ecx, 0xa
setno dil
mov edx, 0x20000001
movzx rdi, sp
mov rdi, rax
jmp 0x1404dbb52
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test eax, eax
jmp 0x1404dbb62
je 0x1404dbc1d
cmp ebx, dword [rsp + 0x30]
jmp 0x1404dbb71
je 0x1404dbc13
test esi, esi
jmp 0x1404dbb7e
je 0x1404dbc13
mov r9, qword [rdi + 0x98]
btr edx, r9d
rcl r8b, 0x8d
mov r8d, r10d
cbw
sbb al, 0x5c
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
test r11b, r11b
cmp sil, dl
cmp ax, 0x19
jmp 0x1404dbbb4
jbe 0x1404dbbd3
sub dx, 0x61
clc
stc
cmp r15w, bp
cmp dx, 0x19
jmp 0x1404dbbcd
ja 0x1404dbbe8
movzx edx, word [rcx]
jmp 0x1404dbbdb
inc r8d
stc
add rcx, 2
jmp 0x1404dbba2
or rcx, 0xffffffffffffffff
jmp 0x1404dbbf1
inc rcx
cmc
cmp word [r9 + rcx*2], r10w
jmp 0x1404dbbff
jne 0x1404dbbf1
cmp r8d, ecx
jmp 0x1404dbc0d
je 0x1404dbc1d
mov eax, 1
jmp 0x1404dbc22
xor eax, eax
test r8b, spl
mov rbx, qword [rsp + 0x38]
cmove edi, r13d
mov rsi, qword [rsp + 0x40]
inc dil
sbb dil, 0xe7
add rsp, 0x20
pop rdi
jmp 0x1404dbc41
ret
Function at 0x1404dd304
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
test r13b, r10b
mov qword [rax + 0x18], rsi
cmp sp, si
cmc
mov qword [rax + 0x20], rdi
test r13b, r8b
clc
jmp 0x1404dd328
push r14
test eax, 0x17e2746b
cmp r10b, r14b
sub rsp, 0x40
jmp 0x1404dd33b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
clc
test r11b, r14b
test rax, rax
jmp 0x1404dd353
je 0x1404dd4b1
mov rsi, rax
cmp word [rax], r14w
jmp 0x1404dd365
je 0x1404dd3a6
or rax, 0xffffffffffffffff
jmp 0x1404dd374
inc rax
clc
cmp word [rsi + rax*2], r14w
jmp 0x1404dd382
jne 0x1404dd374
lea rsi, [rsi + rax*2]
add rsi, 2
test r13d, 0x31b73b95
cmp word [rsi], r14w
jmp 0x1404dd3a0
jne 0x1404dd36b
mov qword [rsp + 0x38], r14
adc r9, rsp
sub rsi, rbx
mov r8d, r8d
rol r9b, 0xc0
btr r9w, 0xad
mov qword [rsp + 0x30], r14
inc r9b
clc
xadd r8b, r8b
add rsi, 2
mov r9d, r12d
test r13b, 0x84
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
cmc
test al, 0xdb
sub edx, edx
mov qword [rsp + 0x20], r14
sub ecx, ecx
jmp 0x1404dd3f5
call fcn.1404cd8ec
movsxd rbp, eax
cmp r12d, 0x636c7e57
test eax, eax
jmp 0x1404dd40b
je 0x1404dd4b1
mov rcx, rbp
call fcn.1404cd83a
mov rdi, rax
test rax, rax
jmp 0x1404dd424
je 0x1404dd497
mov qword [rsp + 0x38], r14
and r8b, 0xf2
mov r9d, esi
movzx r8, dx
or r8b, 0x6a
sar r8b, cl
mov qword [rsp + 0x30], r14
movzx r8d, r8w
mov r8, rbx
mov dword [rsp + 0x28], ebp
jmp 0x1404dd456
sub edx, edx
sub ecx, ecx
jmp 0x1404dd45f
mov qword [rsp + 0x20], rax
jmp 0x1404dd469
call fcn.1404cd8ec
test eax, eax
jmp 0x1404dd475
je 0x1404dd497
mov rsi, rdi
jmp 0x1404dd48a
mov rdi, r14
jmp 0x1404dd492
jmp 0x1404dd49f
mov rsi, r14
seto ch
xchg ch, cl
mov rcx, rdi
jmp 0x1404dd4a7
call fcn.1404cd7c2
jmp 0x1404dd4c1
mov rsi, r14
jmp 0x1404dd4c1
test rbx, rbx
jmp 0x1404dd4c9
je 0x1404dd4dd
mov rcx, rbx
jmp 0x1404dd4d7
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
bt edi, r14d
adc al, 0x1f
mov rax, rsi
adc bp, bx
cmp dil, r14b
mov rsi, qword [rsp + 0x60]
test cl, sil
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
xor r14b, r15b
add rsp, 0x40
mov r14b, al
not r14d
pop r14
jmp 0x1404dd517
ret
Function at 0x1404dd518
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
clc
cmp sil, 0x8f
mov qword [rsp + 0x10], rbp
stc
cmc
mov qword [rsp + 0x18], rsi
test r12b, r11b
push rdi
sub rsp, 0x20
jmp 0x1404dd53b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
xadd bh, bh
mov rbx, rax
cmp bpl, 0xc6
test rax, rax
jmp 0x1404dd555
je 0x1404dd635
mov rbp, rax
clc
cmp word [rax], si
jmp 0x1404dd567
je 0x1404dd5a7
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404dd57e
jne 0x1404dd571
lea rbp, [rbp + rax*2]
clc
add rbp, 2
cmp r15b, 0x77
clc
jmp 0x1404dd598
cmp word [rbp], si
jmp 0x1404dd5a1
jne 0x1404dd56d
sub rbp, rbx
sal ch, cl
or cl, spl
sbb ch, dl
add rbp, 2
shr rcx, cl
xor ch, ch
add cx, r13w
sar rbp, 1
setl cl
and cx, 0x25bb
bsr rcx, r10
add rbp, rbp
not cl
movsx cx, dil
bswap cx
mov rcx, rbp
jmp 0x1404dd5e2
call fcn.1404cd83a
mov rdi, rax
clc
test rax, rax
je 0x1404dd61b
mov r8, rbp
mov ch, 0x2c
cwd
jmp 0x1404dd601
mov rdx, rbx
mov rcx, rax
jmp 0x1404dd60c
call fcn.1404a79e3
mov rsi, rdi
test r14d, esi
test r9b, 0x77
xor ecx, ecx
jmp 0x1404dd622
call fcn.1404cd7c2
mov rcx, rbx
jmp 0x1404dd62f
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov dil, 0xcc
shl ax, cl
sar bpl, cl
mov rax, rsi
btc di, di
mov rsi, qword [rsp + 0x40]
sal bpl, 0x50
cmc
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
setno dil
pop rdi
jmp 0x1404dd667
ret
Function at 0x1404e0412
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
setg ah
movsx ax, al
mov qword [rsp + 0x18], rbp
push rsi
movzx ax, r11b
cbw
push rdi
push r14
movzx ax, bpl
mov eax, 0x1450
jmp 0x1404e043f
call fcn.14044cb06
sub rsp, rax
movsxd r14, r11d
or r14b, r10b
rcr bp, cl
mov rax, qword [0x1400b7288]
movsx r10w, r8b
movsxd r14, esp
not bpl
xor rax, rsp
mov qword [rsp + 0x1440], rax
shld r14, r13, 0xa7
or bpl, r12b
movsxd r10, edx
movsx r14, r10w
mov rdi, rcx
ror bpl, 0xae
bsf si, di
mov rax, r10
mov ebp, r9d
cwd
bt cx, r12w
sar rax, 6
lea rcx, [0x1400ba940]
rcl sil, 0xda
jmp 0x1404e04ab
and r10d, 0x3f
shrd r14, r13, 0x7c
clc
sbb r14, rcx
lea rbp, [rbp + r8]
mov rsi, r8
shld dx, sp, 0
adc rdx, rdi
mov rax, qword [rcx + rax*8]
cmc
ror edx, cl
lea rdx, [r10 + r10*8]
btr r14w, sp
or r14b, 0x66
and r14b, 0x70
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
test spl, 6
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404e04f9
jae 0x1404e05f6
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404e050c
jae 0x1404e0567
mov al, byte [rsi]
jmp 0x1404e0519
inc rsi
cmp al, 0xa
jmp 0x1404e0523
jne 0x1404e053c
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404e0534
inc rbx
jmp 0x1404e053c
mov byte [rbx], al
inc rbx
add al, bpl
rol eax, 0x15
bt ax, 0xe
lea rax, [rsp + 0x143f]
clc
test r8b, 0xba
cmp rbx, rax
jmp 0x1404e0561
jb 0x1404e0504
and qword [rsp + 0x20], 0
stc
bsr rdx, rax
rcr r8b, cl
lea rax, [rsp + 0x40]
btc rdx, rdi
sub ebx, eax
xchg ch, cl
cqo
movsx r9, bp
lea r9, [rsp + 0x30]
not dx
movsx r8d, sp
mov r8d, ebx
mov dl, 0x24
mov dl, cl
cwd
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404e05aa
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404e05b7
je 0x1404e05ee
mov eax, dword [rsp + 0x30]
test r11w, 0x7375
cmc
add dword [rdi + 4], eax
cmp al, dil
cmp eax, ebx
jmp 0x1404e05d5
jb 0x1404e05f6
cmp rsi, rbp
jmp 0x1404e05e3
jb 0x1404e04ff
jmp 0x1404e05f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
stc
jmp 0x1404e060b
xor rcx, rsp
call fcn.1404a3da6
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movsxd rbp, r10d
mov rbp, qword [r11 + 0x30]
jmp 0x1404e0632
mov rsp, r11
movzx r14d, bp
movsxd rsi, edx
pop r14
movzx di, dl
pop rdi
not si
movsx si, r12b
pop rsi
jmp 0x1404e0651
ret
Function at 0x1404e0652
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
setbe al
movzx ax, bpl
cbw
push rdi
cbw
xchg ah, ah
lahf
push r14
movzx ax, bpl
bswap ax
mov eax, 0x1450
jmp 0x1404e0681
call fcn.14044cb06
sub rsp, rax
adc r10d, 0x1c3f075d
xor al, r13b
mov rax, qword [0x1400b7288]
xor r14b, 0xcf
xadd bpl, bpl
xor rax, rsp
bt r10w, 0x63
mov qword [rsp + 0x1440], rax
sar dil, 0x44
cdqe
bts r14w, bp
movsxd r10, edx
adc bpl, al
mov rdi, rcx
or sil, r15b
mov rax, r10
shld esi, r15d, 0x4f
sub rdx, 0x194f06ea
rol bpl, cl
mov ebp, r9d
cmovs dx, ax
sal r14b, cl
btc rdx, r12
sar rax, 6
bt r14w, 0x76
lea rcx, [0x1400ba940]
cmc
movsx r14w, r15b
and r10d, 0x3f
or r14w, 0x7631
cdq
sub edx, r11d
add rbp, r8
bt edx, r14d
sar dh, 0x1b
mov rsi, r8
sal dx, 0x19
rcl r14b, 0xd4
bt edx, 0x97
mov rax, qword [rcx + rax*8]
sar dl, cl
lea rdx, [r10 + r10*8]
and r14, r9
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
cmc
clc
mov qword [rdi], rax
clc
mov dword [rdi + 8], eax
test di, bp
cmp r8, rbp
jmp 0x1404e0750
jae 0x1404e088a
lea rbx, [rsp + 0x40]
clc
jmp 0x1404e0761
cmp rsi, rbp
jmp 0x1404e0769
jae 0x1404e07e4
movzx eax, word [rsi]
cmc
add rsi, 2
test r13b, r8b
cmp ax, 0xa
jmp 0x1404e0783
jne 0x1404e07b2
add dword [rdi + 8], 2
test ax, 0x6467
movsx rcx, r8w
mov ecx, 0xd
cmc
cmp r8, 0x23cb210a
test dx, dx
mov word [rbx], cx
jmp 0x1404e07ae
add rbx, 2
mov word [rbx], ax
not ax
ror eax, 0xd2
add rbx, 2
rol ah, cl
or eax, 0x53861a44
lea rax, [rsp + 0x143e]
cmp r10w, bx
jmp 0x1404e07db
cmp rbx, rax
jb 0x1404e0761
and qword [rsp + 0x20], 0
adc al, 0xe3
xor r9d, eax
rcl r9b, 0xf9
lea rax, [rsp + 0x40]
shl ch, cl
sub rbx, rax
movzx r9w, spl
movsx ecx, di
lea r9, [rsp + 0x30]
xor dl, sil
sar rbx, 1
dec cx
xchg cl, dl
lea rdx, [rsp + 0x40]
bsf cx, bx
add ebx, ebx
movsx ecx, r14w
movzx ecx, r15w
mov rcx, r14
setp r8b
bswap r8w
movzx r8w, r10b
mov r8d, ebx
jmp 0x1404e0840
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404e084d
je 0x1404e0882
mov eax, dword [rsp + 0x30]
test r15b, r9b
add dword [rdi + 4], eax
cmc
test r12b, 0x8c
jmp 0x1404e0867
cmp eax, ebx
jmp 0x1404e086e
jb 0x1404e088a
cmp rsi, rbp
jb 0x1404e0756
jmp 0x1404e088a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
test r10b, dl
bswap cx
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404e08a3
call fcn.1404a3da6
lea r11, [rsp + 0x1450]
not esi
mov rbx, qword [r11 + 0x20]
movsxd rbp, r14d
mov rbp, qword [r11 + 0x30]
movsxd r14, esi
mov sil, dl
mov sil, 0x40
mov rsp, r11
jmp 0x1404e08d4
pop r14
jmp 0x1404e08db
pop rdi
movsx esi, r13w
movsx si, al
pop rsi
jmp 0x1404e08ea
ret