joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404c3771
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
test r12w, 0x7835
shld bx, r8w, 0xfa
sub rsp, 0x20
cqo
movzx r8d, si
mov rbx, rcx
cdq
lea r9, [0x1400c63c0]
xchg r8b, r8b
mov ecx, 3
setp dl
cmovle edx, r9d
movsxd rdx, ecx
lea r8, [0x1400c63b8]
jmp 0x1404c37b5
lea rdx, [0x1400cfb70]
jmp 0x1404c37c1
call fcn.1404c476f
test rax, rax
jmp 0x1404c37ce
je 0x1404c37f2
mov rcx, rbx
cmp r8b, r15b
add rsp, 0x20
mov bl, r10b
cmovae rbx, r14
pop rbx
jmp switch.0x1404c37eb
jmp qword [case.0x140441677.0]
add rsp, 0x20
pop rbx
jmp 0x1404c37fc
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404c387f
Capabilities:
Get thread local storage value

Disassembly:
push rbx
cmp di, 0x58a9
movsx ebx, r14w
sub rsp, 0x20
mov ebx, ecx
movzx cx, bpl
xchg rcx, r8
mov r8w, 0x7df5
lea r9, [0x1400c63d0]
mov ecx, 5
bswap dx
lea r8, [0x1400c63c8]
lea rdx, [0x1400cf758]
jmp 0x1404c38bf
call fcn.1404c476f
mov ecx, ebx
cmp r11w, 0x3b6a
test rax, rax
jmp 0x1404c38d4
je 0x1404c38f1
add rsp, 0x20
movzx ebx, di
mov bl, r13b
pop rbx
jmp 0x1404c38ea
jmp qword [case.0x140441677.0]
add rsp, 0x20
movsxd rbx, r9d
movzx rbx, r15w
pop rbx
jmp 0x1404c3902
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c3909
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c63d8]
movsx di, r10b
movzx rdi, si
mov edi, ecx
lea rdx, [0x1400cf748]
mov cx, 0x4405
mov r8b, r14b
bswap cx
mov ecx, 6
lea r8, [0x1400c63d0]
call fcn.1404c476f
mov rdx, rbx
sal cl, 0x45
or cl, 0x2e
mov ecx, edi
test rax, rax
jmp 0x1404c395d
je 0x1404c396e
call qword [case.0x140441677.0]
jmp 0x1404c3974
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
movsxd rdi, eax
pop rdi
jmp 0x1404c3986
ret

Function at 0x1404c3b0e
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
sbb bh, ah
rol rbx, cl
mov qword [rsp + 0x10], rbp
sal bpl, cl
xor bl, 0xbc
sal bpl, 0xf3
mov qword [rsp + 0x18], rsi
push rdi
movsxd rsi, ebp
sub ebp, edi
sub rsp, 0x30
movzx rdi, bp
mov ebx, r9d
bswap di
mov rdi, r8
movzx r9, bp
mov esi, edx
lea r9, [0x1400c63e8]
not r8b
cqo
movsx r8d, r9w
mov rbp, rcx
movsx cx, al
movsxd rcx, r11d
bswap r8w
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
mov ecx, 0xb
jmp 0x1404c3b7f
call fcn.1404c476f
mov rcx, rbp
cmp r8w, 0x3c01
test rax, rax
jmp 0x1404c3b95
je 0x1404c3bb9
mov r9d, ebx
movzx rdx, di
cqo
mov r8, rdi
mov edx, esi
jmp 0x1404c3bae
call qword [case.0x140441677.0]
jmp 0x1404c3be0
sub edx, edx
jmp 0x1404c3bc0
call fcn.1404c4253
mov ecx, eax
cwd
movzx r9d, r8w
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x1404c3bda
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
rcr dil, cl
mov rbp, qword [rsp + 0x48]
shr sil, 0x52
mov edi, edx
mov rsi, qword [rsp + 0x50]
add di, 0xbfc
ror dil, 0xac
add rsp, 0x30
movzx edi, cx
movsx di, sil
pop rdi
jmp 0x1404c3c13
ret
Function at 0x1404c453e
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x28
lea r9, [0x1400c63a4]
adc r8w, bp
cmp sil, 0x25
bt r8d, eax
xor ecx, ecx
lea r8, [0x1400c63a0]
lea rdx, [0x1400cfbf8]
jmp 0x1404c456a
call fcn.1404c476f
lea r9, [0x1400c63b0]
xchg r8w, r8w
cmove rcx, r9
movzx r8w, bpl
mov ecx, 1
mov dx, si
lea r8, [0x1400c63a8]
cdq
movsxd rdx, ebx
movzx rdx, r11w
lea rdx, [0x1400cf1d0]
call fcn.1404c476f
lea r9, [0x1400c63b8]
mov ecx, 2
mov rdx, rbp
movsxd r8, esi
cqo
lea r8, [0x1400c63b0]
cdq
movsxd rdx, r13d
cwd
lea rdx, [0x1400cf178]
jmp 0x1404c45d3
call fcn.1404c476f
lea r9, [0x1400c63e0]
bswap rdx
mov ecx, 8
lea r8, [0x1400c63d8]
lea rdx, [0x1400cf158]
call fcn.1404c476f
lea r9, [0x1400c63e8]
movsx edx, r8w
movsx r8, bx
mov r8w, 0x3346
mov ecx, 0xb
lea r8, [0x1400c63e0]
movsx edx, r8w
xchg edx, edx
lea rdx, [0x1400cf190]
jmp 0x1404c462c
call fcn.1404c476f
lea r9, [0x1400c63f0]
mov cl, r9b
mov ecx, 0xe
movzx r8w, bl
movzx r8, di
lea r8, [0x1400c63e8]
lea rdx, [0x1400cf168]
call fcn.1404c476f
lea r9, [0x1400c63f8]
movzx r8w, bl
mov ecx, 0xf
setle dl
mov rdx, 0x4df74f99
lea r8, [0x1400c63f0]
cwd
lea rdx, [0x1400cf800]
jmp 0x1404c468c
call fcn.1404c476f
lea r9, [0x1400c6408]
not rcx
cmovbe ecx, edx
cqo
mov ecx, 0x13
mov dl, spl
movzx r8d, si
lea r8, [0x1400c6400]
not dh
mov rdx, 0x25d7642b
cmove dx, r14w
lea rdx, [0x1400cf838]
jmp 0x1404c46cd
call fcn.1404c476f
lea r9, [0x1400c6410]
cmova rdx, r12
movsxd rdx, r10d
cqo
mov ecx, 0x14
lea r8, [0x1400c6408]
movsx edx, di
lea rdx, [0x1400cf1c0]
call fcn.1404c476f
lea r9, [0x1400c6418]
setp r8b
movsx dx, ch
movzx r8d, si
mov ecx, 0x15
movsx r8w, cl
lea r8, [0x1400c6410]
jmp 0x1404c472a
lea rdx, [0x1400cf820]
call fcn.1404c476f
lea r9, [0x1400c6420]
mov ecx, 0x16
cmc
lea r8, [0x1400c6418]
shl dl, cl
sub dx, 0x2ed8
movzx rdx, r9w
lea rdx, [0x1400cfc08]
cmp r11w, r12w
cmc
add rsp, 0x28
jmp 0x1404c476a
jmp fcn.1404c476f
Function at 0x1404cb615
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
and ah, 0xac
adc al, r10b
clc
mov qword [r11 + 8], rbx
sal rax, 0xa7
sar al, 0x57
shr al, 0x85
mov qword [r11 + 0x10], rbp
ror ax, 0xb2
mov qword [r11 + 0x18], rdi
btr bp, r9w
btc bp, sp
push r14
movzx bp, r14b
btr ax, si
xadd di, di
sub rsp, 0x50
movsxd rax, r10d
movzx edi, r8w
bswap rax
mov rax, qword [rsp + 0x80]
jmp 0x1404cb670
mov rbp, r8
mov rcx, qword [rcx]
movzx edi, r13w
lea r8, [r11 - 0x18]
mov dil, 0x9b
not edi
setg dil
mov rdi, rdx
mov qword [r11 - 0x38], rax
mov edx, dword [rsp + 0x88]
jmp 0x1404cb69a
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x1404cb6a7
call fcn.1404dad21
mov r14d, dword [rsp + 0x44]
sbb r9b, sil
and r9b, 0xbc
sub r8d, r8d
cmp dword [rsp + 0x40], 0x2d
mov r9d, eax
xchg edx, eax
movzx edx, r15w
rdtsc
mov eax, dword [rsp + 0xa0]
mov rdx, rbp
sete r8b
movsxd rbx, r13d
mov dword [rsp + 0x28], eax
mov bl, sil
rcr rbx, cl
shrd bx, r8w, 0xa0
sub rdx, r8
jmp 0x1404cb6f3
mov dword [rsp + 0x20], r9d
dec r14d
cmc
lea r9, [rsp + 0x40]
sub cx, r15w
shl ebx, 0xc
movsx bx, spl
cmp rbp, 0xffffffffffffffff
movsx cx, r12b
movsx rcx, r13w
lea rbx, [r8 + rdi]
movzx r8d, di
movzx r8w, bl
mov r8d, dword [rsp + 0x88]
movsx ecx, si
cmovbe ecx, r8d
movzx rcx, r10w
cmove rdx, rbp
mov rcx, rbx
jmp 0x1404cb746
call fcn.1404daa0a
test eax, eax
jmp 0x1404cb752
je 0x1404cb765
mov byte [rdi], 0
jmp 0x1404cb760
jmp 0x1404cb8a5
mov eax, dword [rsp + 0x44]
jmp 0x1404cb76e
dec eax
test bh, 0xf0
test r12d, r12d
cmc
cmp eax, 0xfffffffc
jl 0x1404cb826
cmp eax, dword [rsp + 0x88]
jmp 0x1404cb78c
jge 0x1404cb826
cmp r14d, eax
jmp 0x1404cb79a
jge 0x1404cb7c8
mov al, byte [rbx]
jmp 0x1404cb7a7
inc rbx
test ax, 0x13ed
cmp bx, 0x15cd
test al, al
jmp 0x1404cb7ba
jne 0x1404cb7a0
mov byte [rbx - 2], al
movsxd rcx, edi
xchg r8d, eax
mov rax, qword [rsp + 0xa8]
cqo
movsxd rcx, r9d
mov r8d, r14d
lea r9, [rsp + 0x40]
movzx cx, dl
cdq
mov rcx, 0x75263c71
mov r8d, dword [rsp + 0x88]
movzx cx, ch
mov rdx, rsi
mov rdx, rbp
movsxd rcx, r10d
mov qword [rsp + 0x28], rax
not cl
movzx cx, r10b
mov rcx, rdi
jmp 0x1404cb812
mov byte [rsp + 0x20], 1
jmp 0x1404cb81c
call fcn.1404cb2e4
jmp 0x1404cb8a5
mov rax, qword [rsp + 0xa8]
jmp 0x1404cb836
mov rdx, rbp
jmp 0x1404cb841
mov r9b, byte [rsp + 0x90]
jmp 0x1404cb851
mov rcx, rdi
movsx r8w, r14b
mov r8b, 0x79
not r8b
mov r8d, dword [rsp + 0x88]
jmp 0x1404cb86c
mov qword [rsp + 0x38], rax
cwde
lea rax, [rsp + 0x40]
jmp 0x1404cb87c
mov byte [rsp + 0x30], 1
jmp 0x1404cb886
mov qword [rsp + 0x28], rax
jmp 0x1404cb890
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x20], eax
jmp 0x1404cb8a0
call fcn.1404ca305
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
xor dil, dl
cmp r8b, 0x28
sar dil, 0xb2
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
bswap r14w
pop r14
ret
Function at 0x1404d051d
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
btc rbx, rax
sar bx, cl
push rdi
movzx bx, r11b
cmc
or edi, 0xa044197
sub rsp, 0x20
btc ebx, r8d
xor esi, esi
shld rbx, rbx, 0x46
mov rdi, rdx
xadd bx, bx
mov rbx, rcx
test r15b, r12b
test rcx, rcx
jmp 0x1404d055f
je 0x1404d0602
cmp word [rcx], si
jmp 0x1404d056d
je 0x1404d0602
lea rdx, [0x1400d1d08]
jmp 0x1404d057f
call fcn.14026a594
test eax, eax
jmp 0x1404d058b
je 0x1404d0602
lea rdx, [0x1400d1d00]
bswap cx
mov rcx, rbx
jmp 0x1404d05a3
call fcn.14026a594
test eax, eax
jmp 0x1404d05af
jne 0x1404d05f0
mov ecx, dword [rdi + 8]
mov r9d, 0x60761b3
lea r9d, [rsi + 2]
movsxd r8, esp
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
jmp 0x1404d05d4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d05e1
je 0x1404d0639
mov eax, dword [rsp + 0x30]
jmp 0x1404d065c
mov rcx, rbx
jmp 0x1404d05f8
call fcn.1404d9776
jmp 0x1404d065c
mov ecx, dword [rdi + 8]
movsxd r8, edx
movsx r9w, r14b
lea r8, [rsp + 0x30]
mov r9d, 2
movsx rdx, r9w
mov edx, 0x20001004
jmp 0x1404d0626
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d0633
jne 0x1404d0645
xor eax, eax
jmp 0x1404d0640
jmp 0x1404d065c
mov eax, dword [rsp + 0x30]
jmp 0x1404d064e
test eax, eax
jne 0x1404d065c
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
rcr sil, 0x90
mov rsi, qword [rsp + 0x40]
mov edi, 0x493701e3
movsx rdi, r8w
add di, r10w
add rsp, 0x20
cmovbe di, r11w
xchg di, di
mov rdi, 0x60eb6b82
pop rdi
jmp 0x1404d0690
ret

Function at 0x1404d0691
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
or ebx, 0x36f66617
shld bx, ax, 0xc3
mov qword [rsp + 0x18], rsi
push rdi
mov si, 0x291a
sub rsp, 0x20
movzx esi, si
movsx rbx, r10w
mov esi, edx
movzx ebx, cx
cmovns bx, r9w
mov ebx, ecx
jmp 0x1404d06c7
call fcn.1404c2697
mov ecx, ebx
or r8b, 0xb3
lea r8, [rsp + 0x30]
clc
cqo
bts rdx, rdx
and ecx, 0x3ff
movsx edx, di
mov r9d, 2
bswap dx
movzx rdi, bx
bt edi, esi
bts ecx, 0xa
not dh
mov dil, r15b
mov edx, 0x20000001
mov rdi, rax
jmp 0x1404d070d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
cmc
test eax, eax
jmp 0x1404d071e
je 0x1404d07d7
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d072d
je 0x1404d07c8
test esi, esi
jmp 0x1404d073a
je 0x1404d07c8
mov r9, qword [rdi + 0x98]
rdtsc
cbw
mov r8d, r10d
cmc
movzx edx, word [r9]
clc
sub cx, 0x5fb8
btr eax, 0x2f
lea rcx, [r9 + 2]
rcr ah, 0xd5
movsx ax, bl
lea eax, [rdx - 0x41]
cmp ax, 0x19
jmp 0x1404d0774
jbe 0x1404d0789
sub dx, 0x61
stc
cmp dx, 0x19
ja 0x1404d079e
movzx edx, word [rcx]
inc r8d
stc
test bp, 0x5eda
add rcx, 2
jmp 0x1404d0768
or rcx, 0xffffffffffffffff
jmp 0x1404d07a7
inc rcx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d07b4
jne 0x1404d07a7
cmp r8d, ecx
jmp 0x1404d07c2
je 0x1404d07d7
mov eax, 1
jmp 0x1404d07d2
jmp 0x1404d07de
xor eax, eax
movzx di, r15b
mov rbx, qword [rsp + 0x38]
xchg si, si
mov rsi, qword [rsp + 0x40]
not dil
add rsp, 0x20
xchg di, di
pop rdi
jmp 0x1404d07fb
ret
Function at 0x1404d1f2d
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test cx, cx
mov qword [rax + 8], rbx
cmp sp, r9w
stc
mov qword [rax + 0x10], rbp
test r10, 0x1860269d
mov qword [rax + 0x18], rsi
cmc
cmp r14b, sil
mov qword [rax + 0x20], rdi
test dh, 0xe6
cmc
push r14
clc
cmc
sub rsp, 0x40
jmp 0x1404d1f64
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
sar bx, 0x13
bt rbx, 0xfd
mov rbx, rax
jmp 0x1404d1f7f
test rax, rax
je 0x1404d20fa
mov rsi, rax
cmc
cmp word [rax], r14w
jmp 0x1404d1f95
je 0x1404d1fcf
or rax, 0xffffffffffffffff
jmp 0x1404d1fa4
inc rax
cmp r13w, r13w
clc
cmp word [rsi + rax*2], r14w
jne 0x1404d1fa4
lea rsi, [rsi + rax*2]
clc
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d1fc9
jne 0x1404d1f9b
mov qword [rsp + 0x38], r14
rcr r9w, cl
sub rsi, rbx
rcr r9b, cl
mov qword [rsp + 0x30], r14
bt r9, 0xd1
bsf r8d, r14d
cmp rsi, rbx
add rsi, 2
dec r9b
bsf r9w, r14w
shr r9w, cl
sar rsi, 1
inc r9w
test r10, 0x70712695
jmp 0x1404d2012
mov r8, rbx
mov r9d, esi
stc
mov dword [rsp + 0x28], r14d
test r8w, r8w
xor edx, edx
mov qword [rsp + 0x20], r14
cmp edi, 0x68d976ab
xor ecx, ecx
jmp 0x1404d2036
call fcn.1404c2479
movsxd rbp, eax
cmc
cmp ax, 0xe84
clc
test eax, eax
jmp 0x1404d204b
je 0x1404d20fa
mov rcx, rbp
jmp 0x1404d2059
call fcn.1404c23c3
mov rdi, rax
test rax, rax
jmp 0x1404d2069
je 0x1404d20da
mov qword [rsp + 0x38], r14
shld r9, r14, 0x25
xchg r9b, r8b
mov r9d, esi
mov qword [rsp + 0x30], r14
or r8b, bpl
movzx r8w, sil
sub r8b, 0x3d
mov r8, rbx
test cl, 0xaa
mov dword [rsp + 0x28], ebp
cmp rcx, 0x6e787895
stc
sub edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404d20b0
call fcn.1404c2479
test eax, eax
je 0x1404d20da
mov rsi, rdi
movzx rdi, r8w
movsx rdi, r14w
jmp 0x1404d20cd
mov rdi, r14
jmp 0x1404d20d5
jmp 0x1404d20e8
mov rsi, r14
setbe cl
mov ch, 0x7e
jmp 0x1404d20e8
mov rcx, rdi
jmp 0x1404d20f0
call fcn.1404c2337
jmp 0x1404d210b
mov rsi, r14
cmp r11w, 0x173e
test r11b, r11b
jmp 0x1404d210b
test rbx, rbx
jmp 0x1404d2113
je 0x1404d2127
mov rcx, rbx
jmp 0x1404d2121
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
bswap r14w
add r14b, 0x51
movsx ax, al
mov rax, rsi
bts rdi, r15
mov rsi, qword [rsp + 0x60]
shr bpl, 0x8c
rcl r14b, cl
mov rbp, qword [rsp + 0x58]
shrd r14d, r14d, 0x65
stc
mov r14b, r12b
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
setl r14b
movzx r14, r9w
movsx r14, r15w
pop r14
jmp 0x1404d2175
ret
Function at 0x1404d2176
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404d218a
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
cmp dl, 0xb6
cmc
push rdi
cmp r9b, cl
jmp 0x1404d21a1
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
sal bx, 0xa6
ror bx, cl
mov rbx, rax
cmp rbx, r8
test rax, rax
jmp 0x1404d21c2
je 0x1404d22a5
mov rbp, rax
cmp word [rax], si
jmp 0x1404d21d3
je 0x1404d2217
or rax, 0xffffffffffffffff
jmp 0x1404d21e2
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404d21ef
jne 0x1404d21e2
lea rbp, [rbp + rax*2]
jmp 0x1404d2204
add rbp, 2
cmp word [rbp], si
jmp 0x1404d2211
jne 0x1404d21d9
sub rbp, rbx
cmp di, 0x5e14
add rbp, 2
sal ch, 1
btr cx, 0xc7
bsr cx, r11w
sar rbp, 1
inc cx
add rbp, rbp
movzx ecx, r8w
jmp 0x1404d2241
mov rcx, rbp
jmp 0x1404d2249
call fcn.1404c23c3
mov rdi, rax
jmp 0x1404d2259
test rax, rax
jmp 0x1404d2261
je 0x1404d2290
mov r8, rbp
cqo
mov ecx, 0x2ad2461c
mov rdx, rbx
mov rcx, rax
jmp 0x1404d227c
call fcn.14049c447
mov rsi, rdi
cmp r15b, bpl
test spl, 0xce
jmp 0x1404d2290
xor ecx, ecx
call fcn.1404c2337
mov rcx, rbx
jmp 0x1404d229f
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
not dil
sal ebp, 0x16
mov rax, rsi
adc rsi, rcx
setp sil
mov rsi, qword [rsp + 0x40]
sar bpl, cl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1404d22d1
ret
Function at 0x1404d51f1
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
bswap ax
cdqe
mov qword [rsp + 0x18], rbp
movzx ax, al
movsxd rax, edi
movsx ax, r12b
push rsi
movsx eax, r11w
movzx ax, r15b
push rdi
bswap eax
push r14
setne ah
bswap ax
mov eax, 0x1450
jmp 0x1404d522b
call fcn.14044177c
sub rsp, rax
sbb ax, 0x2e32
mov rax, qword [0x1400b7288]
movsx esi, r14w
xor si, dx
xor rax, rsp
adc bp, 0x717f
clc
movzx r14d, r13w
mov qword [rsp + 0x1440], rax
ror dil, cl
and sil, spl
or r14b, 0x31
movsxd r10, edx
btc eax, esi
adc r14b, 0x7b
mov rdi, rcx
rcr al, 0x8d
sar ax, 0xa
mov rax, r10
sub rbp, rcx
cmp r9b, cl
sar ch, 0x5b
mov ebp, r9d
test r10b, sil
adc r14w, cx
sar rax, 6
test bh, 0x9a
bts dx, r13w
lea rcx, [0x1400ba940]
shr sil, 0x52
btc r14, rcx
and r10d, 0x3f
movsx dx, r14b
shl r14b, 0xb4
add rbp, r8
add esi, edx
cmp bpl, sil
xor dl, 0xa6
mov rsi, r8
bswap dx
mov rax, qword [rcx + rax*8]
jmp 0x1404d52d6
lea rdx, [r10 + r10*8]
sbb r14b, 0x11
dec r14b
shl r14b, cl
mov r14, qword [rax + rdx*8 + 0x28]
stc
xor eax, eax
mov qword [rdi], rax
cmp sil, 0x7f
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404d52fe
jae 0x1404d53fe
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404d5311
jae 0x1404d537c
mov al, byte [rsi]
jmp 0x1404d531e
inc rsi
clc
cmc
cmp al, 0xa
jmp 0x1404d532a
jne 0x1404d5348
inc dword [rdi + 8]
jmp 0x1404d5338
mov byte [rbx], 0xd
jmp 0x1404d5340
inc rbx
jmp 0x1404d5348
mov byte [rbx], al
movzx rax, r8w
dec ah
inc rbx
sbb eax, 0x1ffe7171
cmovne ax, ax
lea rax, [rsp + 0x143f]
jmp 0x1404d536e
cmp rbx, rax
jmp 0x1404d5376
jb 0x1404d5309
and qword [rsp + 0x20], 0
cwde
lea rax, [rsp + 0x40]
seto cl
and dl, r15b
cdq
sub ebx, eax
movsx dx, r8b
movsx ecx, bp
movzx r8, bp
lea r9, [rsp + 0x30]
movzx dx, bh
mov r8d, ebx
movsxd rcx, ebx
mov ch, 0x21
lea rdx, [rsp + 0x40]
movsxd rcx, r12d
movzx rcx, ax
mov rcx, r14
jmp 0x1404d53c3
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d53f6
mov eax, dword [rsp + 0x30]
cmc
test al, bl
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404d53e2
jb 0x1404d53fe
cmp rsi, rbp
jb 0x1404d5304
jmp 0x1404d53fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
setno ch
clc
neg cl
mov rcx, qword [rsp + 0x1440]
clc
jmp 0x1404d5415
xor rcx, rsp
jmp 0x1404d541d
call fcn.1404988af
lea r11, [rsp + 0x1450]
movzx edi, r12w
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
setl r14b
not r14b
movsx si, r8b
mov rsp, r11
pop r14
movsx di, cl
mov si, sp
pop rdi
pop rsi
jmp 0x1404d5455
ret
Function at 0x1404d5456
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movsx eax, r9w
cbw
push rsi
xchg ah, ah
not rax
cbw
push rdi
xchg ah, al
movzx ax, r13b
push r14
movsxd rax, r8d
xchg al, ah
cdqe
mov eax, 0x1450
jmp 0x1404d5489
call fcn.14044177c
sub rsp, rax
mov rax, qword [0x1400b7288]
add sil, r15b
xor rax, rsp
bt esi, r10d
sar ebp, cl
mov qword [rsp + 0x1440], rax
xadd r10b, r10b
movsxd r10, edx
xor bpl, r11b
mov rdi, rcx
and edx, esi
ror ah, cl
mov rax, r10
mov ebp, r9d
sub dl, 0x14
sar rax, 6
inc dl
movsxd rcx, ebx
lea rcx, [0x1400ba940]
btr dx, sp
rcl rsi, 0x39
cmc
and r10d, 0x3f
or sil, r13b
movzx dx, al
test edi, 0x597058ee
lea rbp, [rbp + r8]
mov rsi, r8
btr r14w, 0xdb
mov rax, qword [rcx + rax*8]
and dh, ch
cmovb dx, r8w
stc
lea rdx, [r10 + r10*8]
mov r14d, r10d
xchg r14d, r14d
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x1404d5521
xor eax, eax
mov qword [rdi], rax
cmc
clc
mov dword [rdi + 8], eax
cmc
cmp r13b, bpl
cmp r8, rbp
jae 0x1404d563f
lea rbx, [rsp + 0x40]
jmp 0x1404d5542
cmp rsi, rbp
jae 0x1404d55a2
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jmp 0x1404d555b
jne 0x1404d5576
add dword [rdi + 8], 2
rcl ch, 0x6e
shl ch, cl
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
mov word [rbx], ax
cmp edi, 0x5c6a1016
bsr eax, esp
add rbx, 2
lea rax, [rsp + 0x143e]
jmp 0x1404d5594
cmp rbx, rax
jmp 0x1404d559c
jb 0x1404d5542
and qword [rsp + 0x20], 0
clc
cwde
sal r8w, 0x1d
lea rax, [rsp + 0x40]
bsf r9d, esi
sub rbx, rax
lea r9, [rsp + 0x30]
or r8d, 0x2dd67bc8
rcr cx, 0x2d
sar rbx, 1
sub dl, 0xb3
lea rdx, [rsp + 0x40]
add ebx, ebx
sets r8b
movzx ecx, r8w
mov rcx, r14
mov r8d, ebx
jmp 0x1404d55eb
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d55f8
je 0x1404d5630
mov eax, dword [rsp + 0x30]
test ah, 0xc0
clc
add dword [rdi + 4], eax
test r15d, 0x7457762e
cmp eax, ebx
jmp 0x1404d5617
jb 0x1404d563f
cmp rsi, rbp
jmp 0x1404d5625
jb 0x1404d5538
jmp 0x1404d563f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bt cx, bp
lahf
dec cl
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
test bpl, r12b
cmp r11b, 0x7a
xor rcx, rsp
jmp 0x1404d5659
call fcn.1404988af
lea r11, [rsp + 0x1450]
cmovno rdi, rax
not edi
movsx r14d, ax
mov rbx, qword [r11 + 0x20]
bswap r14
cmovg edi, edx
mov rbp, qword [r11 + 0x30]
mov r14w, r10w
bswap rsi
not r14d
mov rsp, r11
jmp 0x1404d5690
pop r14
pop rdi
mov esi, r15d
pop rsi
jmp 0x1404d569c
ret
Function at 0x1404d569d
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
setg ah
cbw
movzx eax, bx
mov qword [rsp + 0x18], rbp
push rsi
nop
push rdi
mov ah, 0x82
push r12
movzx eax, dx
cmove ax, ax
movzx ax, r15b
push r14
bswap ax
jmp 0x1404d56ce
push r15
cwde
jmp 0x1404d56d6
mov eax, 0x1470
jmp 0x1404d56e0
call fcn.14044177c
sub rsp, rax
and r15b, cl
mov rax, qword [0x1400b7288]
sbb bl, r14b
xor r14b, 0x99
xor rax, rsp
cmp rax, rbp
mov qword [rsp + 0x1460], rax
bts rdi, rbx
movzx r12d, cx
movsxd r10, edx
movsxd r15, r13d
btr eax, 0xdb
mov rbx, rcx
xor dl, cl
mov rax, r10
mov r14d, r9d
jmp 0x1404d572d
sar rax, 6
lea rcx, [0x1400ba940]
rcl r12, 0x58
and r10d, 0x3f
cmp rax, rax
add r14, r8
movzx rdi, cx
mov r15, r8
or dl, r11b
ror dx, cl
cmp r15b, 0x54
mov rdi, r8
mov rax, qword [rcx + rax*8]
and dl, r11b
cdq
dec dl
lea rdx, [r10 + r10*8]
sbb r12b, r11b
rcl r12, cl
cmp r11b, bl
mov r12, qword [rax + rdx*8 + 0x28]
sub eax, eax
cmc
cmp ax, bp
clc
mov qword [rbx], rax
cmp edx, 0xc745d57
cmp r12b, spl
cmp r8, r14
jmp 0x1404d5791
mov dword [rbx + 8], eax
jmp 0x1404d5799
jae 0x1404d5940
lea rax, [rsp + 0x50]
cmp rdi, r14
jmp 0x1404d57ac
jae 0x1404d5805
movzx ecx, word [rdi]
add rdi, 2
stc
cmp cx, 0xa
jmp 0x1404d57c3
jne 0x1404d57e8
mov edx, 0xd
stc
cmp r8b, 5
mov word [rax], dx
cmp dl, r11b
cmc
cmp r9b, 0x54
add rax, 2
cmp r15w, 0x5461
mov word [rax], cx
add rax, 2
bswap ecx
shr ch, cl
lea rcx, [rsp + 0x6f8]
clc
cmp rax, rcx
jb 0x1404d57a4
and qword [rsp + 0x38], 0
not r8b
or r9w, 0xe9a
xor r9d, eax
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
movsxd r9, esp
rol r9, 0x4b
sub rax, rcx
cmc
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
movzx r9, r15w
cmp di, di
sar rax, 1
bts r9w, r10w
movzx r9, sp
mov qword [rsp + 0x20], rcx
shrd ecx, esp, 0xc1
mov r9d, eax
mov ecx, 0xfde9
test r11d, r8d
cmc
sub edx, edx
jmp 0x1404d5871
call fcn.1404c2479
mov ebp, eax
test r11b, al
test eax, eax
jmp 0x1404d5882
je 0x1404d592b
xor esi, esi
cmc
test eax, eax
jmp 0x1404d5892
je 0x1404d5914
and qword [rsp + 0x20], 0
cdq
shr rcx, cl
lea rdx, [rsp + 0x700]
mov ecx, esi
sar r9b, 0xad
rol r8d, cl
mov r8w, di
lea r9, [rsp + 0x40]
shrd r8w, bx, 0x4d
shr r8d, 0x46
mov r8d, ebp
cmp r9w, r14w
clc
lea rdx, [rdx + rcx]
or ch, 0x69
bsf cx, dx
movsxd rcx, ebx
mov rcx, r12
cmc
test di, 0x5895
sub r8d, esi
jmp 0x1404d58ed
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d58fa
je 0x1404d592b
add esi, dword [rsp + 0x40]
cmp bpl, al
cmp esi, ebp
jmp 0x1404d590e
jb 0x1404d5898
mov eax, edi
sub eax, r15d
mov dword [rbx + 4], eax
cmc
clc
cmp rdi, r14
jmp 0x1404d5926
jmp 0x1404d5799
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
sal cx, 0x3d
bts ax, si
shrd rcx, rsp, 0x5f
mov rax, rbx
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call fcn.1404988af
lea r11, [rsp + 0x1470]
xchg r12, rdi
jmp 0x1404d5965
mov rbx, qword [r11 + 0x30]
movzx rsi, r13w
movsxd r12, ebx
movsx esi, si
mov rbp, qword [r11 + 0x40]
mov sil, 0xed
mov rsp, r11
bswap di
mov r12b, 0x4c
movsxd r14, edi
pop r15
mov sil, al
setno dil
pop r14
pop r12
movsx rsi, r15w
pop rdi
setbe sil
movsx esi, r10w
pop rsi
jmp 0x1404d59a6
ret