joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a226c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
sub r10w, 0x84c
xchg r11b, r10b
movsx r10w, bpl
mov qword [rax + 8], rbx
bt r10w, r15w
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
add r11, 0x773503f3
mov qword [rax + 0x20], rdi
or dil, dl
push r14
mov bl, byte [rcx]
and edi, 0x8f15f29
sub rdi, 0x75c55847
lea r10, [rcx + 1]
mov byte [rdx], bl
ror rdi, 0x60
bts r14, rdi
mov esi, r9d
ror r11b, 0xf0
lea r14, [0x140000000]
mov rbp, r8
mov r11, rdx
movsxd rdi, ebp
mov dil, al
mov rdi, rcx
cmc
cmp bp, ax
test bl, 4
jmp 0x1404a22e4
je 0x1404a2324
movzx ecx, byte [r10]
dec ax
nop
and ecx, 0xf
xadd eax, eax
movsx rax, byte [rcx + r14 + 0xc1a30]
stc
clc
cmp ax, 0x44e
mov cl, byte [rcx + r14 + 0xc1a40]
clc
test sil, 0xc9
sub r10, rax
shr ah, 0xe4
mov eax, dword [r10 - 4]
shr eax, cl
mov dword [rdx + 4], eax
test bl, 8
jmp 0x1404a232c
je 0x1404a234a
mov eax, dword [r10]
cmp r10w, r12w
cmp spl, 0xec
add r10, 4
cmp dil, r8b
clc
stc
mov dword [rdx + 8], eax
stc
test bl, 0x10
je 0x1404a236d
mov eax, dword [r10]
add r10, 4
rcr r8b, 0x70
sal r8b, cl
bsr r8, r15
mov dword [rdx + 0xc], eax
sal ax, cl
not al
movsxd rax, dword [r10]
sal r8, 0x48
cmovs r8, rbp
xor r8b, r15b
lea r8, [r10 + 4]
sub r9d, r9d
cmp byte [rsp + 0x30], r9b
jne 0x1404a243b
test bl, 2
jmp 0x1404a2395
je 0x1404a243b
lea rdx, [rax + rbp]
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
shl r10b, cl
stc
sub r10b, al
mov cl, byte [rcx + r14 + 0xc1a40]
ror r10d, 0x4d
sub rdx, rax
jmp 0x1404a23c9
mov r10d, dword [rdx - 4]
cmc
shr r10d, cl
stc
test ax, r15w
mov dword [r11 + 0x10], r9d
cmp r15b, 0xf5
cmp ax, r10w
test r10d, r10d
jmp 0x1404a23ea
je 0x1404a2441
mov eax, dword [rdx]
xchg cl, ch
adc cl, r15b
or cx, 0x4eb
mov ecx, dword [rdx + 4]
clc
lea rdx, [rdx + 8]
test ax, 0x33b7
cmp eax, esi
jmp 0x1404a240f
je 0x1404a242d
inc r9d
test ecx, 0x1dcf1c37
clc
cmp r9d, r10d
jb 0x1404a23f0
jmp 0x1404a2441
mov dword [r11 + 0x10], ecx
jmp 0x1404a2436
jmp 0x1404a2441
mov dword [rdx + 0x10], eax
test r9b, r12b
test bl, 1
jmp 0x1404a2449
je 0x1404a24a5
movzx ecx, byte [r8]
btr ebp, ecx
or rsi, r9
and ecx, 0xf
shl ax, 0xc0
stc
movsx rdx, byte [rcx + r14 + 0xc1a30]
adc bl, spl
mov cl, byte [rcx + r14 + 0xc1a40]
sub bx, 0x2618
shr r14d, cl
sub r8, rdx
movsx r14, cx
mov edx, dword [r8 - 4]
lahf
sub bp, si
shr edx, cl
shld rbp, rdi, 0xfb
or sil, dl
add ebp, 0x2e5b59da
mov dword [r11 + 0x14], edx
lahf
movsx ebx, r14w
mov rbx, qword [rsp + 0x10]
movzx ax, r11b
cmp bpl, 0x4a
jmp 0x1404a24b8
sub r8, rdi
movsxd rdi, esi
movzx rbp, r12w
cdqe
mov rbp, qword [rsp + 0x18]
not dil
xchg r14w, ax
movsx ax, r12b
mov rax, r8
movsx r14w, r15b
mov rsi, qword [rsp + 0x20]
mov dil, bl
mov rdi, qword [rsp + 0x28]
setns r14b
pop r14
jmp 0x1404a24f4
ret
Function at 0x1404b165a
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
stc
cmc
cmp r15w, di
mov qword [rsp + 0x10], rsi
bts si, r13w
rcr sil, cl
push rdi
sub rsp, 0x30
clc
not dil
mov edi, edx
movsxd rsi, eax
mov rsi, rcx
test r8, r8
jmp 0x1404b168b
jne 0x1404b16b2
call fcn.1404b5e92
mov dword [rax], 0x16
jmp 0x1404b16a1
call fcn.1404b6b16
sub eax, eax
jmp 0x1404b16ad
jmp 0x1404b17a0
mov rdx, r9
mov rcx, r8
jmp 0x1404b16bd
call fcn.1404b1802
mov rbx, rax
test rax, rax
je 0x1404b1741
lea rax, [rsp + 0x50]
movsx rcx, r11w
mov rdx, rdi
jmp 0x1404b16e3
mov qword [rsp + 0x28], rax
movsxd rax, r14d
lahf
setb al
lea r8, [0x140094b24]
lahf
movzx r9, r12w
movzx cx, spl
mov eax, dword [rsp + 0x60]
mov r9, rbx
movzx rcx, dx
movsxd rcx, esi
mov ecx, r15d
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404b171d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b172e
jne 0x1404b17c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404b5f0e
sub edi, edi
cmp al, r11b
test rbx, rbx
je 0x1404b178f
mov rcx, qword [rbx + 0x10]
cmp rbx, r10
test rcx, rcx
jmp 0x1404b175e
je 0x1404b176a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404b1776
je 0x1404b1782
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b178a
call fcn.1404c9d48
mov rax, rdi
cmp rbp, 0x47c2725d
ror dil, 0x6b
shr bh, 0x2e
mov rbx, qword [rsp + 0x40]
stc
rol sil, cl
jmp 0x1404b17ae
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
bswap edi
pop rdi
jmp 0x1404b17bf
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jmp 0x1404b17cd
je 0x1404b17e2
mov eax, dword [rsp + 0x50]
test r13b, 0xde
cmp r15b, 0x4f
mov dword [rcx], eax
cmc
xor ebx, ebx
jmp 0x1404b17e9
jmp 0x1404b1746

Function at 0x1404b1ac6
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
bswap rbx
mov bl, r14b
mov ebx, ecx
jmp 0x1404b1ad9
call fcn.1404d32e1
cmp eax, 1
jmp 0x1404b1ae6
je 0x1404b1b2e
mov rax, qword gs:[0x60]
sub dh, 0x89
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jmp 0x1404b1b09
jne 0x1404b1b2e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movzx rdx, r12w
mov dl, dl
not dx
mov edx, ebx
jmp 0x1404b1b28
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b1b35
call fcn.1404b1a13
mov ecx, ebx
jmp 0x1404b1b41
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b57ce
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r11, rsp
rdtsc
btc r9d, r12d
movsx edx, sp
mov qword [r11 + 8], rcx
rdtsc
bt ecx, 0x53
bsf r8w, bp
sub rsp, 0x38
lea rax, [r11 + 8]
cqo
movsxd rdx, r15d
mov qword [r11 - 0x18], rax
mov r8w, r10w
cqo
cwd
lea r9, [r11 + 0x18]
cwde
movsx edx, r15w
movsxd rdx, r11d
mov eax, 2
cqo
lea r8, [r11 - 0x18]
mov cx, 0x2b44
movsx cx, r14b
movsx ecx, dx
lea rdx, [r11 + 0x20]
movsx ecx, sp
movzx rcx, r15w
mov dword [rsp + 0x50], eax
lea rcx, [r11 + 0x10]
jmp 0x1404b583d
mov dword [rsp + 0x58], eax
jmp 0x1404b5846
call fcn.140096fbc
add rsp, 0x38
jmp 0x1404b5854
ret
Function at 0x1404cb33b
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movsx bx, dil
push rdi
sub rsp, 0x20
mov rbx, rdx
movzx r9d, r13w
xchg dx, di
mov dil, 0x85
lea r9, [0x1400c63d8]
movzx rdi, r9w
movzx dx, spl
mov edi, ecx
cmova r8w, r15w
bswap r8w
lea rdx, [0x1400cf748]
cmovp r8, rdx
movsxd rcx, r9d
mov ecx, 6
bswap r8
not r8b
setle r8b
lea r8, [0x1400c63d0]
jmp 0x1404cb39b
call fcn.1404cc1f4
mov rdx, rbx
movzx cx, r13b
bt rcx, 0xb5
mov ecx, edi
test rax, rax
jmp 0x1404cb3b7
je 0x1404cb3c8
call qword [0x1400b8d90]
jmp 0x1404cb3ce
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
sbb di, r11w
bts di, di
add rsp, 0x20
movzx edi, bp
movsx rdi, r10w
pop rdi
jmp 0x1404cb3ec
ret

Function at 0x1404cb53a
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
add bx, 0x6d59
sbb bpl, 0xd5
shl bl, 0x72
mov qword [rsp + 0x18], rsi
push rdi
xchg bl, bpl
shrd esi, eax, 0x8d
sub rsp, 0x30
movsx si, bl
movsx edi, sp
movsx rsi, cx
mov ebx, r9d
movzx di, r13b
movzx rdi, r10w
mov rdi, r8
mov esi, edx
lea r9, [0x1400c63e8]
mov rbp, rcx
movsx cx, r13b
lea r8, [0x1400c63e0]
movsx rdx, di
lea rdx, [0x1400cf190]
setns ch
mov ecx, 0xb
jmp 0x1404cb5ab
call fcn.1404cc1f4
mov rcx, rbp
test rax, rax
jmp 0x1404cb5bb
je 0x1404cb5e2
mov r9d, ebx
mov r8, rdi
movsx rdx, si
setl dl
cwd
mov edx, esi
jmp 0x1404cb5d7
call qword [0x1400b8d90]
jmp 0x1404cb616
sub edx, edx
jmp 0x1404cb5e9
call fcn.1404cbc83
mov ecx, eax
mov r9d, ebx
movsx r8, r10w
movzx r8w, r10b
xchg dl, r8b
mov r8, rdi
not dl
bswap rdx
mov dl, 0x86
mov edx, esi
jmp 0x1404cb610
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
bsf esi, r8d
inc bp
bts edi, r14d
mov rbp, qword [rsp + 0x48]
movzx esi, cx
mov rsi, qword [rsp + 0x50]
adc rdi, rdx
test r9d, 0x583358f5
mov dil, sil
add rsp, 0x30
pop rdi
jmp 0x1404cb64a
ret
Function at 0x1404d5cca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
test ebx, 0x186e2709
test dx, cx
mov qword [rax + 0x18], rsi
bts si, bp
add esi, 0x360f62a8
mov qword [rax + 0x20], rdi
cmp r8d, 0x204a1931
cdqe
push r12
shl ah, cl
push r14
push r15
movzx di, spl
sub rsp, 0x20
sub ebx, ebx
rcl sil, 0xa4
mov r15, r8
sub rax, r9
movzx r12d, r15w
sbb ax, cx
mov edi, edx
mov r12, rcx
movzx si, cl
rcl eax, 0xc4
shld ax, bp, 0xb5
mov eax, 1
shld rsi, r14, 0xbe
sub rsi, 0x23182c34
add esi, r8d
mov esi, ebx
test edx, edx
jmp 0x1404d5d4b
js 0x1404d5de2
test eax, eax
je 0x1404d5deb
mov rcx, qword [r15]
xor r14, 0x1f5b02cb
lea eax, [rsi + rdi]
movzx rdx, r13w
cdq
add bpl, 0x88
sub eax, edx
rcl dl, 0x42
sar eax, 1
rcl rbp, 4
movsxd rbp, eax
bsf r14w, r13w
bts r14w, si
inc r14b
mov r14, rbp
rol dl, 0xb1
shl r14, 4
not dh
bswap rdx
mov rdx, qword [r14 + r12]
jmp 0x1404d5da2
call fcn.1404caa80
test eax, eax
jne 0x1404d5dc4
lea rcx, [r12 + 8]
add rcx, r14
mov qword [r15], rcx
jmp 0x1404d5dbf
jmp 0x1404d5dda
jns 0x1404d5dd7
lea edi, [rbp - 1]
jmp 0x1404d5dd2
jmp 0x1404d5dda
lea esi, [rbp + 1]
cmp esi, edi
jle 0x1404d5d51
test eax, eax
mov r14w, r13w
cwde
cdqe
mov rbp, qword [rsp + 0x48]
sete bl
mov rsi, qword [rsp + 0x50]
cmc
sub di, r13w
cbw
mov eax, ebx
rol r12, cl
mov rbx, qword [rsp + 0x40]
test r14d, 0x1e3e208c
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
bswap r12d
pop r15
cmove r12, r15
pop r14
movsx r12, bx
pop r12
jmp 0x1404d5e2f
ret
Function at 0x1404d7df1
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
neg ebx
clc
mov qword [rsp + 0x18], rsi
movsxd rbx, r13d
mov bx, r9w
bsf rbx, rdx
push rdi
sbb rbx, 0x46080f70
sub rsp, 0x20
adc dil, bpl
sub esi, esi
movzx edi, ax
shrd bx, r14w, 0xc5
mov rdi, rdx
sub bl, 0xf3
adc bl, 0x58
mov rbx, rcx
clc
cmc
test rcx, rcx
jmp 0x1404d7e39
je 0x1404d7edf
cmp word [rcx], si
jmp 0x1404d7e47
je 0x1404d7edf
lea rdx, [0x1400d1d08]
call fcn.140235d8b
test eax, eax
jmp 0x1404d7e60
je 0x1404d7edf
lea rdx, [0x1400d1d00]
movsx cx, spl
mov rcx, rbx
jmp 0x1404d7e7a
call fcn.140235d8b
test eax, eax
jmp 0x1404d7e86
jne 0x1404d7ecd
mov ecx, dword [rdi + 8]
cdq
not dx
lea r9d, [rsi + 2]
jmp 0x1404d7ea2
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
jmp 0x1404d7eb1
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d7ebe
je 0x1404d7f17
mov eax, dword [rsp + 0x30]
jmp 0x1404d7f3b
mov rcx, rbx
jmp 0x1404d7ed5
call fcn.1404e1029
jmp 0x1404d7f3b
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
bswap r9w
mov r9d, 2
movzx rdx, ax
setb dl
cwd
mov edx, 0x20001004
jmp 0x1404d7f04
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d7f11
jne 0x1404d7f23
sub eax, eax
jmp 0x1404d7f1e
jmp 0x1404d7f3b
mov eax, dword [rsp + 0x30]
cmc
test eax, eax
jmp 0x1404d7f2f
jne 0x1404d7f3b
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
sar dil, 0x10
rol di, cl
movsx si, sil
mov rsi, qword [rsp + 0x40]
shl rdi, 0xac
add rsp, 0x20
mov edi, ecx
movzx di, al
movsx di, cl
pop rdi
jmp 0x1404d7f69
ret

Function at 0x1404d7f6a
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov bl, dil
mov qword [rsp + 0x18], rsi
movzx ebx, bx
not rbx
push rdi
movzx si, bpl
shr bx, cl
rcl sil, cl
sub rsp, 0x20
movsx si, r11b
mov si, r8w
mov esi, edx
mov bx, 0x471b
movsxd rbx, edx
movzx rbx, ax
mov ebx, ecx
jmp 0x1404d7faa
call fcn.1404ca067
mov ecx, ebx
cmc
lea r8, [rsp + 0x30]
sar r9b, 0x38
ror edx, 0x9c
and ecx, 0x3ff
mov r9d, 2
btr di, 0xae
bts ecx, 0xa
mov edx, 0x20000001
movsx edi, bp
mov rdi, rax
jmp 0x1404d7fe3
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
cmp ax, sp
test r9b, 0x4d
cmc
test eax, eax
jmp 0x1404d7ffb
je 0x1404d80bd
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d800a
je 0x1404d80b3
test esi, esi
jmp 0x1404d8017
je 0x1404d80b3
mov r9, qword [rdi + 0x98]
mov r8d, r10d
bt rcx, 0x5b
movzx edx, word [r9]
cmp rsi, 0x6dcd0c18
cwde
or eax, 0x6ff538be
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
test r10b, 0xe3
test bx, r12w
cmp ax, 0x19
jbe 0x1404d806a
sub dx, 0x61
stc
cmp dx, 0x19
jmp 0x1404d8064
ja 0x1404d8088
movzx edx, word [rcx]
inc r8d
cmp r14b, 0xab
cmc
jmp 0x1404d807a
add rcx, 2
jmp 0x1404d8083
jmp 0x1404d8041
or rcx, 0xffffffffffffffff
jmp 0x1404d8091
inc rcx
cmc
jmp 0x1404d809a
cmp word [r9 + rcx*2], r10w
jmp 0x1404d80a4
jne 0x1404d8091
cmp r8d, ecx
je 0x1404d80bd
mov eax, 1
jmp 0x1404d80c6
sub eax, eax
ror sil, 0x61
ror di, cl
mov rbx, qword [rsp + 0x38]
bts di, sp
btc edi, esi
rcl sil, cl
mov rsi, qword [rsp + 0x40]
add dil, 0xfc
add rsp, 0x20
cmovno di, r8w
movsx edi, sp
movzx rdi, bx
pop rdi
ret
Function at 0x1404d9896
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
cmc
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
test r8d, r11d
cmc
mov qword [rax + 0x20], rdi
stc
test r10, rbp
push r14
cmp r14w, 0x8a0
jmp 0x1404d98bf
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
sal bh, cl
cmova bx, r12w
xadd bh, bh
mov rbx, rax
jmp 0x1404d98e1
test rax, rax
je 0x1404d9a39
mov rsi, rax
cmp word [rax], r14w
jmp 0x1404d98f6
je 0x1404d9930
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jmp 0x1404d990d
jne 0x1404d9900
lea rsi, [rsi + rax*2]
clc
jmp 0x1404d991d
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d992a
jne 0x1404d98fc
mov qword [rsp + 0x38], r14
btc r8w, r9w
adc r9b, 0xcf
sub rsi, rbx
sub r9b, r8b
mov qword [rsp + 0x30], r14
bsf r8w, r14w
add rsi, 2
bsr r8w, r14w
mov r8b, dl
sar rsi, 1
mov r8, rbx
sar r9b, cl
mov r9d, esi
stc
clc
mov dword [rsp + 0x28], r14d
xor edx, edx
cmp r9d, 0x12d8329e
clc
cmc
mov qword [rsp + 0x20], r14
cmp cl, 0x33
xor ecx, ecx
jmp 0x1404d9987
call fcn.1404c9e75
movsxd rbp, eax
cmc
jmp 0x1404d9999
test eax, eax
jmp 0x1404d99a0
je 0x1404d9a39
mov rcx, rbp
jmp 0x1404d99ae
call fcn.1404c9db8
mov rdi, rax
cmp r9b, bpl
test rax, rax
jmp 0x1404d99c1
je 0x1404d9a1e
mov qword [rsp + 0x38], r14
or r8, 0x772849cf
mov r9d, esi
btc r8, r12
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
test r8, rdx
sub ecx, ecx
jmp 0x1404d99f2
mov qword [rsp + 0x20], rax
jmp 0x1404d99fc
call fcn.1404c9e75
test eax, eax
je 0x1404d9a1e
mov rsi, rdi
jmp 0x1404d9a11
mov rdi, r14
jmp 0x1404d9a19
jmp 0x1404d9a27
mov rsi, r14
bswap rcx
mov ch, 0x7f
mov rcx, rdi
jmp 0x1404d9a2f
call fcn.1404c9d48
jmp 0x1404d9a3d
mov rsi, r14
cmc
test rbx, rbx
je 0x1404d9a54
mov rcx, rbx
jmp 0x1404d9a4e
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
sar di, 0xa3
mov rax, rsi
mov rsi, qword [rsp + 0x60]
ror bpl, 0x5d
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
rcr r14, 0x95
add rsp, 0x40
bswap r14
mov r14w, r9w
pop r14
jmp 0x1404d9a89
ret
Function at 0x1404d9a8a
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
stc
test r10b, al
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
test ch, 0x14
cmp r8b, bl
push rdi
sub rsp, 0x20
jmp 0x1404d9aad
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
movsx bx, r10b
shr bx, 0xc1
xor ebx, r8d
mov rbx, rax
clc
cmc
test al, r10b
test rax, rax
jmp 0x1404d9ad1
je 0x1404d9b9e
mov rbp, rax
cmp word [rax], si
jmp 0x1404d9ae2
je 0x1404d9b1d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1404d9aec
lea rbp, [rbp + rax*2]
clc
stc
test ecx, 0x779e2fbe
add rbp, 2
test r14b, dil
cmp word [rbp], si
jmp 0x1404d9b17
jne 0x1404d9ae8
sub rbp, rbx
shl ch, cl
movzx cx, r15b
add rbp, 2
sar rbp, 1
add rbp, rbp
movsx ecx, sp
mov rcx, rbp
jmp 0x1404d9b3c
call fcn.1404c9db8
mov rdi, rax
jmp 0x1404d9b4d
test rax, rax
jmp 0x1404d9b55
je 0x1404d9b84
mov r8, rbp
movsx dx, r12b
movsx rdx, r8w
movsx ecx, si
mov rdx, rbx
movzx ecx, r13w
mov rcx, rax
call fcn.1404a40af
mov rsi, rdi
cmp dil, 0xc2
test dil, 0xe
sub ecx, ecx
jmp 0x1404d9b8b
call fcn.1404c9d48
mov rcx, rbx
jmp 0x1404d9b98
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
add dil, 0x77
setae al
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
cmovle di, r14w
pop rdi
jmp 0x1404d9bc6
ret
Function at 0x1404dca2b
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cmovno eax, edx
xchg al, ah
movzx ax, r13b
mov qword [rsp + 0x18], rbp
movsx eax, cx
cmovnp ax, sp
push rsi
cmovo ax, cx
push rdi
push r14
mov eax, 0x1450
jmp 0x1404dca58
call fcn.140449554
sub rsp, rax
movzx rsi, r9w
sbb r10b, bpl
mov rax, qword [0x1400b7288]
sar dil, cl
neg dil
xor bp, 0x5255
xor rax, rsp
mov qword [rsp + 0x1440], rax
adc r14, r9
xadd r10d, eax
bsr si, si
movsxd r10, edx
shrd ebp, esp, 0xaa
test bp, 0x158d
bsr r14d, r10d
mov rdi, rcx
rcr ax, cl
shrd cx, dx, 0x8f
mov rax, r10
mov ebp, r9d
test sp, dx
btc rsi, rsi
shr r14, cl
sar rax, 6
dec dl
lea rcx, [0x1400ba940]
xadd rdx, rsi
shl si, 0x26
movsxd rsi, r11d
and r10d, 0x3f
add rbp, r8
cmc
sar r14w, 0x9c
test bx, 0x6661
mov rsi, r8
movsx r14, cx
rcl dl, cl
mov rax, qword [rcx + rax*8]
bts dx, r13w
lea rdx, [r10 + r10*8]
jmp 0x1404dcaff
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
jmp 0x1404dcb0b
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp dil, r13b
cmp r8, rbp
jmp 0x1404dcb1c
jae 0x1404dcc1e
lea rbx, [rsp + 0x40]
clc
stc
cmp rsi, rbp
jmp 0x1404dcb31
jae 0x1404dcb92
mov al, byte [rsi]
jmp 0x1404dcb3e
inc rsi
test r10b, 0xae
cmc
jmp 0x1404dcb4b
cmp al, 0xa
jmp 0x1404dcb52
jne 0x1404dcb70
inc dword [rdi + 8]
jmp 0x1404dcb60
mov byte [rbx], 0xd
jmp 0x1404dcb68
inc rbx
jmp 0x1404dcb70
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
cmc
cmp ah, 0x8f
test esp, r13d
cmp rbx, rax
jmp 0x1404dcb8c
jb 0x1404dcb29
and qword [rsp + 0x20], 0
shl al, 0x93
xor dl, r15b
lea rax, [rsp + 0x40]
test dx, 0x6703
sub ebx, eax
lea r9, [rsp + 0x30]
xchg dh, dl
movzx r8w, r10b
mov r8d, ebx
movsxd rcx, r13d
movzx rdx, r9w
lea rdx, [rsp + 0x40]
movsx cx, r9b
bswap rcx
mov rcx, r14
jmp 0x1404dcbd5
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404dcc0c
mov eax, dword [rsp + 0x30]
test r11b, bl
cmp r10b, 0x24
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1404dcc1e
cmp rsi, rbp
jmp 0x1404dcc01
jb 0x1404dcb22
jmp 0x1404dcc1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bt rcx, 0xc3
mov eax, r13d
cdqe
mov rax, rdi
cmp r9b, 0x90
not cx
xadd ch, ch
mov rcx, qword [rsp + 0x1440]
test r9b, 0x9d
stc
xor rcx, rsp
jmp 0x1404dcc40
call fcn.1404a0519
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
jmp 0x1404dcc5e
mov rbp, qword [r11 + 0x30]
mov rsi, 0x7a1f3aca
mov edi, r15d
movzx r14d, cx
mov rsp, r11
movsx esi, r12w
movzx r14, r10w
pop r14
movsx rsi, bp
pop rdi
movzx esi, r8w
movsx rsi, dx
pop rsi
jmp 0x1404dcc90
ret
Function at 0x1404dcc91
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, eax
cdqe
mov qword [rsp + 0x18], rbp
push rsi
cmovnp eax, ecx
movzx ax, bpl
push rdi
push r14
bswap ax
mov eax, 0x1450
call fcn.140449554
sub rsp, rax
neg dil
sbb ax, bp
shld edi, r9d, 0x66
mov rax, qword [0x1400b7288]
shld si, cx, 0xcb
movzx r10, r9w
xor rax, rsp
test r14b, 0xf
mov qword [rsp + 0x1440], rax
cmp bl, 0x8d
test spl, 0x5a
bsf edi, esp
movsxd r10, edx
mov rdi, rcx
cdq
mov rax, r10
rol r14w, cl
movzx r14w, r9b
mov ebp, r9d
sar rax, 6
cwd
lea rcx, [0x1400ba940]
sar r14, 0x11
clc
and r10d, 0x3f
shrd esi, esp, 0x27
lea rbp, [rbp + r8]
rol r14b, 0xd4
adc r14w, 0x740f
mov rsi, r8
mov rax, qword [rcx + rax*8]
bts r14w, r13w
btc rdx, rbp
btr edx, 0xdc
lea rdx, [r10 + r10*8]
mov r14b, 0x98
rcl r14b, 0xad
xchg r14b, r14b
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
cmp r13w, 0x7cfa
cmc
test ax, r8w
mov qword [rdi], rax
test al, bl
mov dword [rdi + 8], eax
stc
clc
cmp r8, rbp
jae 0x1404dce7e
lea rbx, [rsp + 0x40]
cmp dx, 0x2f60
stc
cmp rsi, rbp
jae 0x1404dcdde
movzx eax, word [rsi]
clc
cmp r15b, r10b
add rsi, 2
cmc
cmp ax, 0xa
jne 0x1404dcdb3
add dword [rdi + 8], 2
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
stc
cmp eax, edi
mov word [rbx], ax
bt eax, 0xab
dec al
cbw
add rbx, 2
movzx eax, bp
clc
lea rax, [rsp + 0x143e]
clc
cmc
cmp rbx, rax
jmp 0x1404dcdd8
jb 0x1404dcd81
and qword [rsp + 0x20], 0
movsxd r9, esp
and r8w, bx
lea rax, [rsp + 0x40]
or r8b, 0
adc ch, 0xbf
sub rbx, rax
test r11w, 0x475c
cmp dil, 6
lea r9, [rsp + 0x30]
rcr cx, cl
shl ch, 0x79
mov dl, bl
sar rbx, 1
bt cx, 0x7d
lea rdx, [rsp + 0x40]
inc r8w
and ecx, esi
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x1404dce31
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dce3e
je 0x1404dce70
mov eax, dword [rsp + 0x30]
cmp bp, 0x117e
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404dce57
jb 0x1404dce7e
cmp rsi, rbp
jmp 0x1404dce65
jb 0x1404dcd76
jmp 0x1404dce7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
ror ax, cl
xor al, r12b
mov rax, rdi
xor ecx, edx
inc ecx
mov rcx, qword [rsp + 0x1440]
stc
xor rcx, rsp
jmp 0x1404dce96
call fcn.1404a0519
lea r11, [rsp + 0x1450]
mov rdi, r9
mov rbx, qword [r11 + 0x20]
movzx r14, ax
movzx esi, r11w
mov rbp, qword [r11 + 0x30]
movzx si, dil
movzx rsi, r12w
mov rsp, r11
pop r14
xchg di, di
pop rdi
movsxd rsi, r15d
setnp sil
movsx rsi, r13w
pop rsi
jmp 0x1404dced9
ret
Function at 0x1404e0249
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rax, rsp
stc
push rbp
movsx ebp, cx
dec rbp
push rbx
sbb bpl, 0xae
sar ebx, 0x7b
push rsi
rcl sil, 0xc8
btc ebx, 0xd7
push rdi
not bpl
push r14
ror rdi, 0x18
lea rbp, [rax - 0x37]
sub rsp, 0xf0
sub rbx, 0x32e96644
inc sil
movaps xmmword [rax - 0x38], xmm6
and r14w, 0x801
shrd rax, rsi, 0x5f
bt di, 0xee
mov rax, qword [0x1400b7288]
sub r14b, sil
xor rax, rsp
seta sil
movzx si, dil
movsx si, spl
mov qword [rbp - 0x11], rax
mov esi, edx
mov r14, rcx
cwd
xchg di, di
movsx rdi, ax
mov edx, 0xffc0
movsxd rbx, r15d
mov ecx, 0x1f80
xchg bl, dil
bswap di
jmp 0x1404e02de
mov edi, r9d
movzx rbx, r13w
mov rbx, r8
jmp 0x1404e02ed
call fcn.1404db535
mov ecx, dword [rbp + 0x5f]
xchg rdx, rdx
mov qword [rsp + 0x48], rax
cqo
movzx dx, dil
cdq
mov dword [rsp + 0x50], ebx
movsx rdx, r14w
mov dx, bx
movss xmm0, dword [rsp + 0x50]
movzx rdx, r8w
movzx edx, r13w
cmovo rdx, rcx
mov rdx, qword [rsp + 0x48]
jmp 0x1404e032c
movss dword [rsp + 0x40], xmm0
call fcn.1404e00c2
movss xmm6, dword [rbp + 0x77]
cmp di, bp
test eax, eax
jne 0x1404e03c8
cmp dword [rbp + 0x7f], 2
jmp 0x1404e0350
jne 0x1404e0380
mov eax, dword [rbp - 0x41]
and eax, 0xffffffe1
movzx r9, r12w
btr r8w, r15w
movss dword [rbp - 0x51], xmm6
adc cx, di
rcl cx, 0x9d
or eax, 1
jmp 0x1404e037d
mov dword [rbp - 0x41], eax
mov r8d, dword [rbp + 0x5f]
mov cx, 0x6e35
movsx eax, cx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lahf
cdq
lea rdx, [rsp + 0x48]
lea rax, [rbp + 0x6f]
movzx r9w, cl
mov r9d, esi
movsx rcx, cx
movsxd rcx, r8d
lea rcx, [rsp + 0x60]
jmp 0x1404e03b9
mov qword [rsp + 0x20], rax
jmp 0x1404e03c3
call fcn.1404ddb62
call fcn.1401cf62a
test al, al
je 0x1404e044a
test edi, edi
jmp 0x1404e03dc
je 0x1404e044a
movss xmm0, dword [rsp + 0x40]
movsx r8d, r15w
lahf
mov r8, r14
movzx cx, dil
movsx edx, bp
rdtsc
movss xmm3, dword [rbp + 0x6f]
not dx
mov ecx, edi
lahf
mov dh, 0xb7
rdtsc
mov rax, qword [rsp + 0x48]
movsx dx, r14b
jmp 0x1404e041a
mov edx, dword [rbp + 0x67]
mov qword [rsp + 0x30], rax
cvtps2pd xmm0, xmm0
cvtps2pd xmm1, xmm6
movsd qword [rsp + 0x28], xmm0
cvtps2pd xmm3, xmm3
movsd qword [rsp + 0x20], xmm1
jmp 0x1404e043c
call fcn.1404e000a
cvtsd2ss xmm0, xmm0
jmp 0x1404e0479
mov ecx, edi
jmp 0x1404e0451
call fcn.1404dd671
mov rcx, qword [rsp + 0x48]
mov edx, 0xffc0
jmp 0x1404e0465
call fcn.1404db535
movss xmm0, dword [rsp + 0x40]
movsx ecx, r12w
ror ch, cl
shl cl, 0xe
mov rcx, qword [rbp - 0x11]
cmc
cmp bp, 0x1258
xor rcx, rsp
call fcn.1404a0519
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop r14
bswap rdi
pop rdi
movzx rsi, r12w
jmp 0x1404e04ad
pop rsi
movsxd rbp, r9d
pop rbx
not rbp
pop rbp
ret