joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404ce68d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
and cx, 0x3d4b
shl cx, 0x73
btr ecx, 0x3e
mov qword [rax + 8], rbx
movsx ecx, r9w
mov qword [rax + 0x10], rbp
shl bx, 0xac
mov qword [rax + 0x18], rsi
test ebx, 0x6a1a7bab
shr cx, 0x52
mov qword [rax + 0x20], rdi
sbb dil, 0x35
sal dil, 0xe0
rcr cx, cl
push r14
rcl dil, cl
cdqe
movzx rax, r10w
sub rsp, 0x20
xor esi, esi
xor r14d, r14d
movzx rcx, di
sbb al, 0xe3
sub cx, sp
movsxd rcx, esi
xor edi, ebp
lea rdi, [0x1400ba940]
add bx, ax
mov rax, rcx
btc bx, r14w
movzx rbx, r12w
sal bh, 4
and ecx, 0x3f
sar rax, 6
movsx rbx, r12w
sub ebx, r12d
lea rbx, [rcx + rcx*8]
mov rdi, qword [rdi + rax*8]
and al, bl
mov rax, qword [rdi + rbx*8 + 0x28]
clc
cmp r9d, r9d
add rax, 2
cmc
jmp 0x1404ce730
cmp rax, 1
jmp 0x1404ce739
jbe 0x1404ce74e
or byte [rdi + rbx*8 + 0x38], 0x80
jmp 0x1404ce749
jmp 0x1404ce870
mov byte [rdi + rbx*8 + 0x38], 0x81
rcr cx, 0x93
mov ecx, esi
cmp r12w, 0x3e73
jmp 0x1404ce764
test esi, esi
jmp 0x1404ce76b
je 0x1404ce79f
sub ecx, 1
jmp 0x1404ce779
je 0x1404ce790
cmp ecx, 1
mov cl, 0xc5
xchg ch, cl
mov ecx, 0xfffffff4
jmp 0x1404ce7a4
mov ecx, 0xfffffff5
jmp 0x1404ce79a
jmp 0x1404ce7a4
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
add cl, r15b
stc
sal cl, cl
lea rcx, [rax + 1]
test esi, r15d
stc
cmp rcx, 1
jmp 0x1404ce7c4
jbe 0x1404ce7dd
mov rcx, rax
jmp 0x1404ce7d2
call qword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1404ce7df
sub eax, eax
test eax, eax
jmp 0x1404ce7e6
je 0x1404ce829
movzx ecx, al
mov qword [rdi + rbx*8 + 0x28], rbp
cmp ecx, 2
jmp 0x1404ce7fc
jne 0x1404ce811
or byte [rdi + rbx*8 + 0x38], 0x40
jmp 0x1404ce80c
jmp 0x1404ce870
cmp ecx, 3
jne 0x1404ce870
or byte [rdi + rbx*8 + 0x38], 8
jmp 0x1404ce824
jmp 0x1404ce870
or byte [rdi + rbx*8 + 0x38], 0x40
and ax, r8w
sar ah, 0x11
clc
mov qword [rdi + rbx*8 + 0x28], 0xfffffffffffffffe
or rax, 0x4075294b
movsx ax, r15b
mov rax, qword [0x1400ba160]
test r10w, ax
cmc
test rax, rax
je 0x1404ce870
mov rax, qword [r14 + rax]
jmp 0x1404ce869
mov dword [rax + 0x18], 0xfffffffe
inc esi
test r12b, 6
test eax, r13d
clc
add r14, 8
cmp bpl, 0x74
cmp esi, 3
jmp 0x1404ce88a
jne 0x1404ce6e7
mov rbx, qword [rsp + 0x30]
shl bpl, cl
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sub dil, 0x43
cmp al, 0xda
mov rdi, qword [rsp + 0x48]
rcl r14b, cl
shr r14w, 0x97
add rsp, 0x20
jmp 0x1404ce8c5
pop r14
jmp 0x1404ce8cc
ret
Function at 0x1404cf066
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
bsr ebx, r8d
btr bx, 0x6c
mov qword [rsp + 0x10], rbp
cmp r13d, edx
mov qword [rsp + 0x18], rsi
bswap r8w
bt bx, 0xd1
push rdi
bts si, dx
test r9b, r9b
neg bx
sub rsp, 0x20
shld r8, rdi, 0x54
sar bx, 0x5c
lea rbx, [rcx + 0x18]
rcr rbp, 0x6b
ror r8b, cl
mov rsi, rcx
xchg rbp, rbp
shl bp, 7
sal cx, 0xc0
mov ebp, 0x101
mov rcx, rbx
movzx r8, sp
adc r8b, 0x57
mov r8d, ebp
cmp r12w, 0x6f03
cmp sil, r13b
sub edx, edx
jmp 0x1404cf0de
call fcn.1404a3ec0
sub eax, eax
movsx edi, r8w
jmp 0x1404cf0f1
lea rdi, [rsi + 0xc]
movzx ecx, r9w
xchg ch, cl
mov qword [rsi + 4], rax
mov ecx, 6
mov qword [rsi + 0x220], rax
jmp 0x1404cf110
movzx eax, ax
jmp 0x1404cf118
rep stosw word [rdi], ax
sbb al, 0x27
rol dil, 0xd7
lea rdi, [0x1400b77b0]
dec al
sub rdi, rsi
not al
mov al, byte [rdi + rbx]
jmp 0x1404cf137
mov byte [rbx], al
inc rbx
test r14b, 0xba
cmp r15w, 0xcc
sub rbp, 1
jmp 0x1404cf14f
jne 0x1404cf12f
lea rcx, [rsi + 0x119]
mov edx, 0x100
xchg al, al
mov al, byte [rcx + rdi]
jmp 0x1404cf16b
mov byte [rcx], al
inc rcx
cmc
test spl, 0x82
sub rdx, 1
jmp 0x1404cf17e
jne 0x1404cf163
mov rbx, qword [rsp + 0x30]
rcl rbp, 0x29
bts rbp, rcx
mov rbp, qword [rsp + 0x38]
rol sil, 0x8c
test sp, bp
stc
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movsxd rdi, ebx
pop rdi
jmp 0x1404cf1b0
ret
Function at 0x1404d5920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bt dx, r10w
sar dx, 0x5e
cmp ah, 4
push rdi
adc bx, 0x76b9
sub rsp, 0x20
cmc
and dl, 0x76
ror dl, 0x38
mov rdx, qword [rcx]
neg bl
or rbx, rdi
sbb bh, cl
or r8, 0xffffffffffffffff
btr bx, 0x89
sub edi, edi
movzx ebx, r9w
mov rbx, rcx
jmp 0x1404d5963
inc r8
cmp word [rdx + r8*2], di
jne 0x1404d5963
mov eax, edi
shr al, 0xc2
add al, 0x78
cmp r8, 3
not al
sete al
jmp 0x1404d5986
mov dword [rcx + 0x18], eax
jmp 0x1404d598e
jne 0x1404d59a3
mov ecx, 2
jmp 0x1404d599e
jmp 0x1404d5a1f
mov r9d, edi
test rdx, rdx
jmp 0x1404d59ae
jne 0x1404d59c0
mov ecx, edi
jmp 0x1404d59bb
jmp 0x1404d5a1f
mov ecx, 2
bts eax, r13d
xor r8b, r14b
adc al, dil
movzx r8d, word [rdx]
rol ah, 0x86
cmp r14b, 0xbc
sar ah, 0xd8
add rdx, rcx
movzx eax, bp
lea eax, [r8 - 0x41]
cmp ax, 0x19
jmp 0x1404d59f0
jbe 0x1404d5a0b
sub r8w, 0x61
cmp r8w, 0x19
jmp 0x1404d5a05
ja 0x1404d5a18
inc r9d
jmp 0x1404d5a13
jmp 0x1404d59cf
mov ecx, r9d
movzx rdx, dx
sub r9d, r9d
xadd rdx, rdx
mov dword [rbx + 0x14], ecx
shl edx, cl
sub r8d, r8d
lea rcx, [0x1400ab740]
cwd
jmp 0x1404d5a3c
lea edx, [r9 + 3]
jmp 0x1404d5a45
call fcn.1404ca35a
test byte [rbx + 0x10], 4
jne 0x1404d5a60
mov dword [rbx + 0x10], edi
sub rdi, 0x64ab1f04
xchg ebx, edi
mov rbx, qword [rsp + 0x30]
shld edi, ebp, 0x72
cmc
not rdi
add rsp, 0x20
pop rdi
jmp 0x1404d5a77
ret
Function at 0x1404d65f7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsx bx, r13b
mov rbx, rcx
jmp 0x1404d660e
call fcn.1404c92d9
or r8, 0xffffffffffffffff
sub r9d, 0x3b54406b
bts dx, r9w
mov r9, r8
sub edi, edi
lea rdx, [rax + 0x98]
jmp 0x1404d663b
mov rax, qword [rdx]
inc r9
test sil, r9b
cmp word [rax + r9*2], di
jmp 0x1404d664e
jne 0x1404d663e
mov eax, edi
cmp r9, 3
setl al
sete al
jmp 0x1404d6665
mov dword [rdx + 0x18], eax
movsxd rax, r14d
bswap ax
mov rax, qword [rdx + 8]
jmp 0x1404d6677
inc r8
cmp dil, sil
cmp word [rax + r8*2], di
jmp 0x1404d6687
jne 0x1404d6677
cmp r8, 3
mov eax, edi
jmp 0x1404d669b
mov r8d, 2
mov al, r12b
sete al
cmp r9w, 0x67bf
clc
test rsp, 0x75e927fc
mov dword [rdx + 0x1c], eax
mov dword [rbx + 4], edi
stc
test sil, 0x63
cmp dword [rdx + 0x18], edi
jmp 0x1404d66c8
jne 0x1404d6734
mov rcx, qword [rdx]
shl r10b, 0xb8
mov r10d, edi
shld r9d, r12d, 0xa3
bts ax, ax
cmp r15b, r14b
movzx r9d, word [rcx]
shrd ax, dx, 0xd3
bts rax, r8
add rcx, r8
xor al, r13b
lea eax, [r9 - 0x41]
stc
cmp ax, 0x19
jmp 0x1404d6705
jbe 0x1404d6725
sub r9w, 0x61
stc
cmp ax, 0x3357
cmp r9w, 0x19
jmp 0x1404d671f
ja 0x1404d672d
inc r10d
jmp 0x1404d66e4
mov r8d, r10d
movzx rcx, sp
mov dword [rdx + 0x14], r8d
not cx
lea rcx, [0x1400abdd4]
movzx rdx, sp
movzx edx, ax
mov edx, 1
jmp 0x1404d6753
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov ecx, dword [rbx]
rcl dl, cl
shr dl, 0x5c
test r11, 0x51730c03
test cl, 7
setne dl
bt ecx, 9
setl al
jmp 0x1404d6779
setb al
test r10d, edx
and dl, al
bt ecx, 8
setb al
cmc
test al, dl
jmp 0x1404d6790
jne 0x1404d6798
mov dword [rbx], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
movzx edi, si
sete dil
movzx rdi, r11w
pop rdi
jmp 0x1404d67b2
ret
Function at 0x1404d71e6
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
cmp r9b, 0xf6
shr bx, cl
bt bx, sp
mov qword [rsp + 0x18], rsi
stc
rcl bh, 0xd
push rdi
rol bh, 0xe0
bsf rdi, r15
sub rsp, 0x20
and bl, bl
shld di, r11w, 0xb3
xor esi, esi
movzx rbx, r14w
and bl, 2
btr edi, r14d
mov rdi, rdx
mov rbx, rcx
cmp esp, 0x67965a3f
jmp 0x1404d7231
test rcx, rcx
jmp 0x1404d7239
je 0x1404d72e2
cmp word [rcx], si
jmp 0x1404d7247
je 0x1404d72e2
lea rdx, [0x1400d1d08]
jmp 0x1404d7259
call fcn.1400f6665
test eax, eax
jmp 0x1404d7265
je 0x1404d72e2
lea rdx, [0x1400d1d00]
seta cl
mov rcx, rbx
call fcn.1400f6665
test eax, eax
jmp 0x1404d7284
jne 0x1404d72d5
mov ecx, dword [rdi + 8]
movsx r9d, r11w
mov rdx, 0x2ce02ee6
movsxd r8, ecx
lea r9d, [rsi + 2]
movzx edx, r13w
movsxd r8, esp
setp r8b
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d72c1
je 0x1404d730c
mov eax, dword [rsp + 0x30]
jmp 0x1404d72d0
jmp 0x1404d732e
mov rcx, rbx
call fcn.1404e0287
jmp 0x1404d732e
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
movsx r9, cx
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d72fe
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d7313
sub eax, eax
jmp 0x1404d732e
mov eax, dword [rsp + 0x30]
clc
test r8b, sil
test eax, eax
jmp 0x1404d7322
jne 0x1404d732e
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
movzx edi, ax
mov rsi, qword [rsp + 0x40]
movzx edi, cx
add di, 0x1fbe
add rsp, 0x20
movsx edi, sp
pop rdi
jmp 0x1404d7350
ret

Function at 0x1404d7351
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
movzx bx, bpl
movsx bx, bpl
and rbx, rax
mov qword [rsp + 0x18], rsi
bts si, cx
push rdi
movsxd rsi, ebp
movsx bx, al
sub rsp, 0x20
mov esi, edx
not bl
mov ebx, ecx
jmp 0x1404d7383
call fcn.1404c92d9
mov ecx, ebx
xchg rdi, rdx
sar di, cl
lea r8, [rsp + 0x30]
and ecx, 0x3ff
btr dx, 0x37
mov dh, dl
mov r9d, 2
movsxd rdi, r10d
bts ecx, 0xa
mov edx, 0x20000001
mov edi, 0x75ad15d9
movsxd rdi, r10d
mov dil, r8b
mov rdi, rax
jmp 0x1404d73c7
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
stc
clc
cmp sil, spl
test eax, eax
jmp 0x1404d73dc
je 0x1404d7496
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d73eb
je 0x1404d7487
test esi, esi
jmp 0x1404d73f8
je 0x1404d7487
mov r9, qword [rdi + 0x98]
bswap rcx
sbb al, 0xfa
sar r8w, 0xe2
mov r8d, r10d
movzx edx, word [r9]
add cx, 0x57c5
lea rcx, [r9 + 2]
lahf
movsx eax, dx
lea eax, [rdx - 0x41]
stc
jmp 0x1404d742c
cmp ax, 0x19
jbe 0x1404d7449
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404d7443
ja 0x1404d7462
movzx edx, word [rcx]
jmp 0x1404d7451
inc r8d
add rcx, 2
jmp 0x1404d745d
jmp 0x1404d7423
or rcx, 0xffffffffffffffff
inc rcx
jmp 0x1404d746e
cmp word [r9 + rcx*2], r10w
jne 0x1404d7466
cmp r8d, ecx
jmp 0x1404d7481
je 0x1404d7496
mov eax, 1
jmp 0x1404d7491
jmp 0x1404d749d
sub eax, eax
btr bx, r14w
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x1404d74b1
ret
Function at 0x1404d8b60
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test r14d, 0x7e14403c
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
test sil, r14b
cmp r8b, r9b
mov qword [rax + 0x18], rsi
test rbx, 0x75092e4b
mov qword [rax + 0x20], rdi
push r14
cmp r9w, dx
sub rsp, 0x40
jmp 0x1404d8b96
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
cmova bx, r9w
mov rbx, rax
test rax, rax
jmp 0x1404d8baf
je 0x1404d8d3a
mov rsi, rax
cmp dx, 0x6fad
test r13b, 0x75
cmc
cmp word [rax], r14w
jmp 0x1404d8bcb
je 0x1404d8c0c
or rax, 0xffffffffffffffff
jmp 0x1404d8bda
inc rax
jmp 0x1404d8be2
cmp word [rsi + rax*2], r14w
jmp 0x1404d8bec
jne 0x1404d8bda
lea rsi, [rsi + rax*2]
clc
add rsi, 2
cmp al, 0x2f
cmp word [rsi], r14w
jmp 0x1404d8c06
jne 0x1404d8bd1
mov qword [rsp + 0x38], r14
or r8d, 0x624c2dbb
mov r9b, 0xcd
shr r9d, 0xcf
sub rsi, rbx
cmp spl, r14b
rol r8d, cl
mov qword [rsp + 0x30], r14
test r9w, 0x2511
add rsi, 2
movsx r8d, cx
ror r9b, cl
sar rsi, 1
test bpl, 0xb8
mov r8, rbx
sete r9b
btc r9d, 0x9c
test rax, r11
mov r9d, esi
mov dword [rsp + 0x28], r14d
test dil, 0x34
xor edx, edx
test r12b, 0x46
mov qword [rsp + 0x20], r14
cmp r13b, 0x9e
xor ecx, ecx
jmp 0x1404d8c76
call fcn.1404c90bc
movsxd rbp, eax
test eax, eax
jmp 0x1404d8c85
je 0x1404d8d3a
mov rcx, rbp
jmp 0x1404d8c93
call fcn.1404c8ff3
mov rdi, rax
test r12b, r13b
test rax, rax
jmp 0x1404d8ca6
je 0x1404d8d1d
mov qword [rsp + 0x38], r14
rcl r8b, 0xa1
movzx r9d, r14w
bt r9d, r12d
mov r9d, esi
rcl r8b, cl
mov qword [rsp + 0x30], r14
rol r8b, cl
mov r8, rbx
jmp 0x1404d8cd6
mov dword [rsp + 0x28], ebp
cmc
clc
xor edx, edx
cmp r14d, ebx
clc
sub ecx, ecx
jmp 0x1404d8ce9
mov qword [rsp + 0x20], rax
jmp 0x1404d8cf3
call fcn.1404c90bc
test eax, eax
jmp 0x1404d8cff
je 0x1404d8d1d
mov rsi, rdi
jmp 0x1404d8d10
mov rdi, r14
jmp 0x1404d8d18
jmp 0x1404d8d28
mov rsi, r14
setbe cl
movsx cx, r13b
mov rcx, rdi
jmp 0x1404d8d30
call fcn.1404c8f69
jmp 0x1404d8d43
mov rsi, r14
cmc
jmp 0x1404d8d43
test rbx, rbx
je 0x1404d8d5a
mov rcx, rbx
jmp 0x1404d8d54
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
clc
jmp 0x1404d8d6a
mov rax, rsi
movsxd r14, ebp
mov rsi, qword [rsp + 0x60]
btr r14w, 0x92
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
movzx r14d, r10w
or r14b, r15b
add rsp, 0x40
movsx r14d, cx
pop r14
jmp 0x1404d8d9b
ret
Function at 0x1404d8d9c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
jmp 0x1404d8db0
push rdi
jmp 0x1404d8db6
sub rsp, 0x20
jmp 0x1404d8dbf
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
shl rbx, cl
mov rbx, rax
test rax, rax
jmp 0x1404d8dd5
je 0x1404d8ead
mov rbp, rax
cmp word [rax], si
jmp 0x1404d8de6
je 0x1404d8e2a
or rax, 0xffffffffffffffff
jmp 0x1404d8df5
inc rax
cmc
clc
cmp word [rbp + rax*2], si
jmp 0x1404d8e04
jne 0x1404d8df5
lea rbp, [rbp + rax*2]
cmp r12b, 0xfb
clc
add rbp, 2
cmp rsi, 0x391f38fc
cmc
cmp word [rbp], si
jne 0x1404d8dec
sub rbp, rbx
bswap cx
bsf cx, r15w
xadd rcx, rcx
add rbp, 2
setle cl
movzx cx, r8b
xor ch, 0x56
sar rbp, 1
shld rcx, rdi, 0x25
bsr rcx, r8
not cx
add rbp, rbp
mov rcx, rbp
jmp 0x1404d8e62
call fcn.1404c8ff3
mov rdi, rax
cmp dh, 0xb2
cmp bpl, sil
test rax, rax
jmp 0x1404d8e78
je 0x1404d8e93
mov r8, rbp
mov rdx, rbx
movsx rcx, bp
mov rcx, rax
call fcn.1404a3400
mov rsi, rdi
xor ecx, ecx
jmp 0x1404d8e9a
call fcn.1404c8f69
mov rcx, rbx
jmp 0x1404d8ea7
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
cdqe
add edi, 0x7b3c4a3d
shl bp, 0x1f
mov rax, rsi
test cx, bx
rol si, 0xb4
mov rsi, qword [rsp + 0x40]
bt rbp, r8
mov rbp, qword [rsp + 0x38]
adc dil, bl
add rsp, 0x20
pop rdi
jmp 0x1404d8ee3
ret
Function at 0x1404dbd81
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx ax, dil
cbw
mov qword [rsp + 0x18], rbp
bswap ax
mov eax, 0x235f2b34
push rsi
push rdi
lahf
bswap ax
push r14
cbw
mov eax, 0x1450
jmp 0x1404dbdae
call fcn.1404483f4
sub rsp, rax
shrd esi, ebp, 0x74
mov rax, qword [0x1400b7288]
xor sil, 0xf6
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
rol ah, cl
sal ah, 0x26
mov rdi, rcx
add ebp, r13d
mov rax, r10
mov ebp, r9d
cqo
btc r14d, 0x5f
sar rax, 6
cqo
lea rcx, [0x1400ba940]
cdq
and r10d, 0x3f
ror sil, cl
or r14w, 0x564b
add rbp, r8
xor r14b, 0xe3
mov rsi, r8
movzx rdx, dx
mov rax, qword [rcx + rax*8]
jmp 0x1404dbe1d
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
test r11w, dx
sub eax, eax
cmc
cmp bp, 0x352a
mov qword [rdi], rax
cmp r10b, 0x14
mov dword [rdi + 8], eax
test r9b, r12b
cmp r8, rbp
jmp 0x1404dbe47
jae 0x1404dbf3b
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404dbe5a
jae 0x1404dbeac
mov al, byte [rsi]
inc rsi
test cl, 0xb2
cmp al, 0xa
jmp 0x1404dbe6f
jne 0x1404dbe83
inc dword [rdi + 8]
jmp 0x1404dbe7d
mov byte [rbx], 0xd
inc rbx
mov byte [rbx], al
not eax
lahf
nop
inc rbx
movsx ax, dil
ror al, cl
lea rax, [rsp + 0x143f]
cmp cl, sil
cmp rbx, rax
jmp 0x1404dbea6
jb 0x1404dbe52
and qword [rsp + 0x20], 0
bsr dx, si
lea rax, [rsp + 0x40]
xchg rcx, r9
mov r8b, r9b
shld r9, rax, 0x5f
sub ebx, eax
not cl
jmp 0x1404dbed4
lea r9, [rsp + 0x30]
mov dl, r11b
setns dh
mov r8d, ebx
lea rdx, [rsp + 0x40]
setl ch
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404dbf2a
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmc
cmp r8d, 0x3f1a0ac9
cmp eax, ebx
jmp 0x1404dbf11
jb 0x1404dbf3b
cmp rsi, rbp
jmp 0x1404dbf1f
jb 0x1404dbe4d
jmp 0x1404dbf3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bsf cx, cx
rcl ah, cl
bswap rax
mov rax, rdi
ror ch, cl
mov rcx, qword [rsp + 0x1440]
stc
clc
cmc
xor rcx, rsp
jmp 0x1404dbf53
call fcn.14049f715
lea r11, [rsp + 0x1450]
setbe sil
mov rbx, qword [r11 + 0x20]
mov r14b, 0x71
not bpl
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movzx edi, bp
pop r14
bswap rsi
pop rdi
mov si, 0x2bfd
pop rsi
ret
Function at 0x1404dbf84
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
bswap rax
mov qword [rsp + 0x18], rbp
push rsi
push rdi
cwde
movsx rax, r9w
movsxd rax, ebp
push r14
setns ah
lahf
mov eax, 0x1450
jmp 0x1404dbfb1
call fcn.1404483f4
sub rsp, rax
bswap r14w
mov rax, qword [0x1400b7288]
rcr r10w, 5
btc di, 0xd4
sete r14b
xor rax, rsp
movsx r10, r14w
or r10b, bl
movsx r14d, di
mov qword [rsp + 0x1440], rax
movsx ax, dh
movsxd r10, edx
stc
xchg esi, esi
sar dl, 0x7f
mov rdi, rcx
movzx rdx, dx
mov rax, r10
sub r14b, 0x5d
mov ebp, r9d
bsf rsi, r15
sar dh, cl
sar rax, 6
sal r14w, cl
rcl si, 0x24
rcr sil, 0x85
lea rcx, [0x1400ba940]
and r10d, 0x3f
lea rbp, [rbp + r8]
movsxd r14, r14d
shr r14d, 0xab
mov rsi, r8
btr r14d, 0x84
add r14b, 0x7a
sub r14d, 0x297d396f
mov rax, qword [rcx + rax*8]
shld dx, sp, 0xa
lea rdx, [r10 + r10*8]
movzx r14d, r8w
clc
btr r14d, r14d
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x1404dc066
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
test bl, dil
cmc
cmp r8, rbp
jmp 0x1404dc07a
jae 0x1404dc173
lea rbx, [rsp + 0x40]
cmc
jmp 0x1404dc08b
cmp rsi, rbp
jmp 0x1404dc093
jae 0x1404dc0e7
movzx eax, word [rsi]
add rsi, 2
stc
cmp ax, 0xa
jne 0x1404dc0c1
add dword [rdi + 8], 2
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
stc
cmp dil, 0x45
clc
mov word [rbx], ax
ror ah, 0xf2
or ah, 0xa5
add rbx, 2
dec ah
lea rax, [rsp + 0x143e]
test r14w, 0x1011
cmp rbx, rax
jb 0x1404dc08b
and qword [rsp + 0x20], 0
bswap ax
lea rax, [rsp + 0x40]
inc edx
sub rbx, rax
lea r9, [rsp + 0x30]
movsx dx, bl
sar rbx, 1
lea rdx, [rsp + 0x40]
bts r8, rdx
cmp r11b, r9b
add ebx, ebx
movzx rcx, r13w
xchg r8b, cl
movsxd r8, r10d
mov rcx, r14
mov r8w, si
setae r8b
movzx r8w, spl
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dc13e
je 0x1404dc16b
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404dc152
jb 0x1404dc173
cmp rsi, rbp
jmp 0x1404dc160
jb 0x1404dc080
jmp 0x1404dc173
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
inc cl
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404dc188
call fcn.14049f715
lea r11, [rsp + 0x1450]
xchg r14b, bl
mov si, dx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movsx rdi, r12w
not r14b
pop r14
pop rdi
movzx esi, dx
movsx si, bl
xchg rsi, rsi
pop rsi
jmp 0x1404dc1c0
ret
Function at 0x1404dc1c1
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx ax, r14b
movsxd rax, r12d
mov qword [rsp + 0x18], rbp
cdqe
movzx ax, sil
movsx eax, r12w
push rsi
movzx rax, sp
push rdi
sete al
mov al, ah
push r12
movsx ax, dil
movsx eax, si
movsx rax, r14w
push r14
push r15
cmovb eax, r15d
mov eax, 0x1470
jmp 0x1404dc209
call fcn.1404483f4
sub rsp, rax
dec r10b
mov rax, qword [0x1400b7288]
xor rax, rsp
sal rdi, cl
mov qword [rsp + 0x1460], rax
xor rdi, 0x69f85c70
movsxd r10, edx
movsx bx, r15b
mov rbx, rcx
btr r12w, r15w
btc r15, 0xa4
and dx, 0x127b
mov rax, r10
rcr rcx, 0xbe
mov r14d, r9d
cdq
movsx cx, dh
sar rax, 6
lea rcx, [0x1400ba940]
sub dl, 0xa8
adc dl, dil
and r10d, 0x3f
movzx r12w, sil
add r14, r8
btc r15w, 0xd4
mov r15, r8
rcl dil, cl
add dl, 0x4a
mov rdi, r8
test rbp, 0x7fb81547
clc
mov rax, qword [rcx + rax*8]
clc
shld r12w, ax, 0xce
rcr dl, 0xe
lea rdx, [r10 + r10*8]
sal r12b, 0x87
mov r12, qword [rax + rdx*8 + 0x28]
jmp 0x1404dc2b0
sub eax, eax
stc
mov qword [rbx], rax
clc
stc
cmp r8, r14
jmp 0x1404dc2c0
mov dword [rbx + 8], eax
jmp 0x1404dc2c8
jae 0x1404dc46d
lea rax, [rsp + 0x50]
test bpl, 0xed
cmp rdi, r14
jmp 0x1404dc2df
jae 0x1404dc344
movzx ecx, word [rdi]
add rdi, 2
stc
cmp cx, 0xa
jmp 0x1404dc2f6
jne 0x1404dc31f
mov edx, 0xd
cmp r10d, edx
test r12b, 0xf9
cmp rbx, 0x14144f4e
mov word [rax], dx
cmc
add rax, 2
stc
cmp r10, 0x7cbb6b30
mov word [rax], cx
jmp 0x1404dc32a
add rax, 2
lea rcx, [rsp + 0x6f8]
cmp rax, rcx
jmp 0x1404dc33e
jb 0x1404dc2d7
and qword [rsp + 0x38], 0
ror ecx, 0x9e
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
movsx r9, sp
clc
btc r9w, 0x90
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
add cl, bpl
shl cx, 0xe0
btc r9, 0x59
lea rcx, [rsp + 0x700]
movzx r9, r13w
bt r9d, 0xfd
adc r9d, ebx
sar rax, 1
movzx r9d, r9w
shl r9b, cl
mov qword [rsp + 0x20], rcx
rcl r9d, cl
bsr cx, r11w
mov r9d, eax
mov ecx, 0xfde9
xor edx, edx
call fcn.1404c90bc
mov ebp, eax
test eax, eax
jmp 0x1404dc3c2
je 0x1404dc45c
xor esi, esi
clc
jmp 0x1404dc3d0
test eax, eax
jmp 0x1404dc3d7
je 0x1404dc447
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
mov ecx, esi
movsx r8, sp
cmp r10b, 0x8d
lea r9, [rsp + 0x40]
and r8b, 0x8c
or r8b, r14b
xadd r8b, r8b
mov r8d, ebp
test r15d, 0x1d9f3a14
lea rdx, [rdx + rcx]
btr cx, 0xd6
mov rcx, r12
sub r8d, esi
jmp 0x1404dc423
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dc430
je 0x1404dc45c
add esi, dword [rsp + 0x40]
cmp esi, ebp
jmp 0x1404dc441
jb 0x1404dc3dd
mov eax, edi
jmp 0x1404dc44e
sub eax, r15d
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x1404dc2c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
sub ah, 0xd0
adc cl, bpl
sar rax, cl
mov rax, rbx
cmc
and ch, cl
sar ecx, cl
mov rcx, qword [rsp + 0x1460]
test bpl, r14b
clc
xor rcx, rsp
jmp 0x1404dc489
call fcn.14049f715
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
movsx rbp, r14w
movsx bp, r8b
movzx di, bl
mov rbp, qword [r11 + 0x40]
movsx rsi, cx
cmovle di, cx
sete r12b
mov rsp, r11
mov r12w, di
pop r15
pop r14
movsx edi, r10w
movzx rsi, bx
cmovp si, bp
pop r12
cmovne si, r11w
bswap di
pop rdi
mov sil, 0x46
pop rsi
jmp 0x1404dc4e2
ret
Function at 0x1404dfa50
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
test r8b, 0x92
mov rbx, rcx
and dl, r10b
rcr dx, 0x87
btc r9, 0x33
lea r9, [0x1400c8e90]
xor ecx, ecx
movsxd r8, r9d
lea r8, [0x1400c8e88]
cmovo rdx, r8
mov dl, ah
lea rdx, [0x1400cfb70]
jmp 0x1404dfa8e
call fcn.1404dfd0b
test rax, rax
je 0x1404dfab0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1404dfaa9
jmp qword [0x1400b8d90]
add rsp, 0x20
xchg bh, bh
bswap rbx
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404dfb49
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movzx rdx, bx
mov ebx, ecx
cdq
lea r9, [0x1400c8ea0]
mov ecx, 2
cqo
movzx r8w, r15b
not dh
lea r8, [0x1400c8e98]
not dh
lea rdx, [0x1400cf758]
jmp 0x1404dfb80
call fcn.1404dfd0b
mov ecx, ebx
test rax, rax
jmp 0x1404dfb8f
je 0x1404dfba3
add rsp, 0x20
mov bl, bl
pop rbx
push qword [0x1400b8d90]
ret
add rsp, 0x20
pop rbx
jmp 0x1404dfbad
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404dfbb4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movsx r8d, bx
add r8b, r11b
add r9, 0x20e85f0f
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c8ea8]
movzx r8, r9w
mov edi, ecx
lea rdx, [0x1400cf748]
mov ecx, 3
movsx r8w, sil
movsxd r8, r15d
lea r8, [0x1400c8ea0]
jmp 0x1404dfbfc
call fcn.1404dfd0b
mov rdx, rbx
mov ecx, edi
cmp r15b, 0x3b
cmc
test rax, rax
jmp 0x1404dfc13
je 0x1404dfc24
call qword [0x1400b8d90]
jmp 0x1404dfc2a
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add dil, bl
and dil, 0xe8
add rsp, 0x20
movzx di, r13b
cmovg di, r13w
pop rdi
ret