joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404afb6d
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
sar sil, 0x6f
push rdi
sub rsp, 0x30
movsxd rdi, r10d
sal dil, cl
mov edi, edx
rcl si, 0xcd
btr si, 0xbf
mov rsi, rcx
test r8, r8
jne 0x1404afbbe
call fcn.1404b449b
mov dword [rax], 0x16
jmp 0x1404afbad
call fcn.1404b5134
xor eax, eax
jmp 0x1404afbb9
jmp 0x1404afc99
mov rdx, r9
mov rcx, r8
call fcn.1404afd13
mov rbx, rax
cmp r15b, r15b
cmc
test r9b, 9
test rax, rax
jmp 0x1404afbdc
je 0x1404afc3d
lea rax, [rsp + 0x50]
movsx dx, r11b
cwd
mov rdx, rdi
mov qword [rsp + 0x28], rax
movsx rcx, ax
lea r8, [0x140094b24]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rsi
jmp 0x1404afc10
mov dword [rsp + 0x20], eax
jmp 0x1404afc19
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1404afcd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404afc38
call fcn.1404b450a
sub edi, edi
stc
test rbx, rbx
jmp 0x1404afc48
je 0x1404afc89
mov rcx, qword [rbx + 0x10]
jmp 0x1404afc57
test rcx, rcx
je 0x1404afc66
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
jmp 0x1404afc72
test rcx, rcx
je 0x1404afc81
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1404c81ee
mov rax, rdi
movzx di, dl
xor si, 0xcf1
cmovg edi, r8d
mov rbx, qword [rsp + 0x40]
sub si, 0x6269
sbb sil, 0x60
bts di, sp
mov rsi, qword [rsp + 0x48]
rcl di, 0x46
sbb dil, 0x4e
add rsp, 0x30
movsx edi, r12w
movzx di, r13b
movsx di, dil
pop rdi
jmp 0x1404afcd0
ret
mov rcx, qword [rsp + 0x68]
test dx, r8w
test rcx, rcx
jmp 0x1404afce2
je 0x1404afcf3
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
cmp r10, r13
clc
stc
xor ebx, ebx
jmp 0x1404afcfa
jmp 0x1404afc40

Function at 0x1404aff9f
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404affac
call fcn.1404d1796
cmp eax, 1
jmp 0x1404affb9
je 0x1404b0010
mov rax, qword gs:[0x60]
or dx, bp
sub dl, 0x6e
mov edx, dword [rax + 0xbc]
test r14w, 0x76ff
stc
shr edx, 8
cmp sil, 0x15
test dl, 1
jmp 0x1404affea
jne 0x1404b0010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx dx, r12b
jmp 0x1404b0003
mov edx, ebx
jmp 0x1404b000a
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404afef8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b51bd
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
setp cl
mov ecx, 0x17
jmp 0x1404b51ce
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404b51ed
mov ecx, 5
jmp 0x1404b51e6
int 0x29
jmp 0x1404b51ed
mov r8d, 1
mov edx, 0xc0000417
movsx cx, bh
lea ecx, [r8 + 1]
jmp 0x1404b5205
call fcn.1404b5233
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx rdx, bx
shld rdx, rbp, 0xaf
mov edx, 0xc0000417
cmc
stc
cmp si, 0x12af
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404c8a9d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbp
cmc
or ah, 0x52
mov rbp, rsp
btr rdx, 0x4a
movzx eax, r10w
cbw
sub rsp, 0x50
and r9b, 0x5b
mov qword [rbp - 0x28], rcx
shld ax, dx, 0x71
add ax, cx
bts rax, r13
lea rax, [rbp - 0x28]
shr r8d, cl
sbb r9b, 0x60
sar r8b, 0x37
mov qword [rbp - 0x18], rax
cqo
rdtsc
inc r8b
lea r9, [rbp + 0x20]
rdtsc
clc
neg ah
mov edx, 1
mov eax, 0x69a3a62
lea r8, [rbp - 0x18]
mov eax, 5
mov dword [rbp + 0x20], eax
test edx, r13d
mov dword [rbp + 0x28], eax
xadd eax, eax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 8], rax
not eax
mov al, r9b
mov eax, 4
cmc
mov dword [rbp - 0x30], eax
test eax, 0x227815db
cmp ah, 0xde
mov dword [rbp - 0x2c], eax
lea rax, [0x1400ba680]
stc
jmp 0x1404c8b41
mov qword [rbp - 0x20], rax
mov dword [rcx + 0x28], edx
sar ax, cl
lea rcx, [0x1400c2f20]
mov rax, qword [rbp - 0x28]
mov qword [rax], rcx
sar ax, cl
mov cx, r10w
lea rcx, [0x1400b77b0]
cmovo rax, r15
movsx eax, r12w
mov rax, qword [rbp - 0x28]
test r13b, al
mov dword [rax + 0x3a8], edx
neg eax
mov rax, qword [rbp - 0x28]
mov qword [rax + 0x88], rcx
bswap cx
ror rcx, 0x80
bts cx, ax
lea ecx, [rdx + 0x42]
mov rax, qword [rbp - 0x28]
movzx edx, r13w
shrd dx, sp, 0x92
lea rdx, [rbp + 0x28]
cmp rcx, 0x5d86121
mov word [rax + 0xbc], cx
movsxd rax, r10d
movsx rax, r11w
mov rax, qword [rbp - 0x28]
cmp r10b, 0xb0
mov word [rax + 0x1c2], cx
xadd ch, cl
sub ch, 0x49
shrd cx, bp, 0x61
lea rcx, [rbp + 0x18]
bts ax, bx
movsxd rax, esp
mov rax, qword [rbp - 0x28]
cmp dil, bpl
and qword [rax + 0x3a0], 0
jmp 0x1404c8bf6
call fcn.1400a5238
lea r9, [rbp - 0x30]
bswap ecx
movzx cx, sil
cmovle cx, dx
lea r8, [rbp - 0x10]
movzx rcx, si
lea rdx, [rbp - 0x2c]
movzx rcx, cx
movsx ecx, r8w
jmp 0x1404c8c23
lea rcx, [rbp + 0x18]
jmp 0x1404c8c2c
call fcn.1400a5278
add rsp, 0x50
pop rbp
ret

Function at 0x1404c9785
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movzx r8, sp
xchg r9w, r9w
movsx rdx, sp
mov ebx, ecx
not dh
cmovno rdx, rbx
movzx rdx, r9w
lea r9, [0x1400c63d0]
mov ecx, 5
movsx r8, cx
movsxd r8, esp
movzx rdx, sp
lea r8, [0x1400c63c8]
mov dl, dil
movzx rdx, di
lea rdx, [0x1400cf758]
call fcn.1404ca6b6
mov ecx, ebx
cmp r12, rdi
cmc
test rax, rax
jmp 0x1404c97e2
je 0x1404c97fb
add rsp, 0x20
movzx rbx, r13w
movzx ebx, dx
pop rbx
jmp qword [0x1400b8d90]
add rsp, 0x20
movsxd rbx, r15d
movzx rbx, dx
pop rbx
jmp 0x1404c980c
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c9813
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
btc r8d, r14d
movzx r9d, bp
movsx r8w, cl
push rdi
sal r8w, 0x17
clc
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c63d8]
mov edi, ecx
movzx edx, cx
lea rdx, [0x1400cf748]
jmp 0x1404c9854
mov ecx, 6
bswap r8w
cmove r8w, r13w
mov r8w, dx
lea r8, [0x1400c63d0]
jmp 0x1404c9872
call fcn.1404ca6b6
mov rdx, rbx
btc ecx, r11d
not cl
mov ecx, edi
clc
cmc
test r13b, 0x22
test rax, rax
je 0x1404c989c
call qword [0x1400b8d90]
jmp 0x1404c98a2
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov di, 0x695b
add rsp, 0x20
pop rdi
jmp 0x1404c98b5
ret
Function at 0x1404c9a28
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
movzx ebx, r10w
bswap rbx
and bh, 0x4f
mov qword [rsp + 0x10], rbp
movzx ebp, si
sal bpl, cl
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsx ebp, bp
movsx di, sil
xchg si, bp
mov ebx, r9d
movzx si, spl
mov rdi, r8
mov si, 0x67f3
movsx r8d, r8w
mov esi, edx
cdq
lea r9, [0x1400c63e8]
movsx ebp, r10w
movzx r8w, r15b
mov rbp, rcx
mov cl, r10b
lea r8, [0x1400c63e0]
movzx ecx, r13w
movsx rdx, bp
cmovno ecx, r9d
lea rdx, [0x1400cf190]
movsx cx, r8b
movzx ecx, r10w
mov rcx, 0x5b824786
mov ecx, 0xb
jmp 0x1404c9ab7
call fcn.1404ca6b6
mov rcx, rbp
clc
stc
cmc
test rax, rax
jmp 0x1404c9aca
je 0x1404c9ae6
mov r9d, ebx
mov r8, rdi
movsx edx, bx
mov edx, esi
call qword [0x1400b8d90]
jmp 0x1404c9b17
xor edx, edx
jmp 0x1404c9aed
call fcn.1404ca184
mov ecx, eax
mov r8w, bp
movzx r9w, r15b
mov r9d, ebx
cdq
movzx rdx, dx
movsx r8w, r10b
mov r8, rdi
cqo
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
sub dil, r9b
add rsp, 0x30
pop rdi
jmp 0x1404c9b33
ret
Function at 0x1404cd8bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
bswap rcx
mov qword [rax + 8], rbx
bts rcx, r14
mov qword [rax + 0x10], rbp
movsx rbx, r9w
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
btr di, 0xa2
bsr ecx, r11d
jmp 0x1404cd8eb
push r14
sub rsp, 0x20
inc rdi
movzx rbx, r11w
setb dil
xor esi, esi
rcl di, 0xac
sub r14d, r14d
sal di, 0x9b
shrd ebx, ebx, 0xb5
sar ch, cl
movsxd rcx, esi
lea rdi, [0x1400ba940]
rol ebx, cl
mov rax, rcx
xor bx, 0x59db
movzx rbx, r11w
and ecx, 0x3f
movzx ebx, r9w
sar rax, 6
neg bl
lea rbx, [rcx + rcx*8]
mov rdi, qword [rdi + rax*8]
shld rax, rax, 0xc6
mov rax, qword [rdi + rbx*8 + 0x28]
clc
test bx, r11w
cmp spl, bl
add rax, 2
cmp rax, 1
jmp 0x1404cd95b
jbe 0x1404cd970
or byte [rdi + rbx*8 + 0x38], 0x80
jmp 0x1404cd96b
jmp 0x1404cdaa8
mov byte [rdi + rbx*8 + 0x38], 0x81
rcl cl, 0x98
mov ecx, esi
stc
cmp spl, r13b
test esi, esi
jmp 0x1404cd985
je 0x1404cd9bf
sub ecx, 1
jmp 0x1404cd993
je 0x1404cd9b0
cmp ecx, 1
cmovns ecx, ecx
xchg ecx, ecx
mov ecx, 0xfffffff4
jmp 0x1404cd9ab
jmp 0x1404cd9c9
mov ecx, 0xfffffff5
jmp 0x1404cd9ba
jmp 0x1404cd9c9
mov ecx, 0xfffffff6
jmp 0x1404cd9c9
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
lea rcx, [rax + 1]
stc
cmp rcx, 1
jmp 0x1404cd9e0
jbe 0x1404cd9f9
mov rcx, rax
jmp 0x1404cd9ee
call qword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1404cd9fe
sub eax, eax
test r9d, edx
test eax, eax
jmp 0x1404cda05
je 0x1404cda5a
movzx ecx, al
clc
cmp ch, 0x90
mov qword [rdi + rbx*8 + 0x28], rbp
test r13w, 0x4616
test r10b, r9b
jmp 0x1404cda25
cmp ecx, 2
jmp 0x1404cda2d
jne 0x1404cda3d
or byte [rdi + rbx*8 + 0x38], 0x40
jmp 0x1404cdaa8
cmp ecx, 3
jmp 0x1404cda45
jne 0x1404cdaa8
or byte [rdi + rbx*8 + 0x38], 8
jmp 0x1404cda55
jmp 0x1404cdaa8
or byte [rdi + rbx*8 + 0x38], 0x40
rcl ah, cl
and ax, r14w
xchg al, ah
mov qword [rdi + rbx*8 + 0x28], 0xfffffffffffffffe
bts ax, dx
movzx ax, cl
rcl al, cl
mov rax, qword [0x1400ba160]
test spl, 0xa5
test rax, rax
jmp 0x1404cda8d
je 0x1404cdaa8
mov rax, qword [r14 + rax]
jmp 0x1404cda9c
mov dword [rax + 0x18], 0xfffffffe
jmp 0x1404cdaa8
inc esi
clc
test r9w, di
add r14, 8
jmp 0x1404cdab8
cmp esi, 3
jne 0x1404cd90f
mov rbx, qword [rsp + 0x30]
cmp ebp, r14d
bt rbp, r9
btr rbp, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
xchg r14b, r14b
mov r14b, r12b
pop r14
ret
Function at 0x1404d4b4e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
shl bh, 0x3f
sbb dl, r12b
sbb dx, 0x483
sub rsp, 0x20
movsxd rbx, esi
cmc
mov rdx, qword [rcx]
btr rbx, r14
sal bx, cl
rcr ebx, 0xc9
or r8, 0xffffffffffffffff
sar bl, cl
movzx ebx, bx
sub edi, edi
not ebx
xchg ebx, ebx
mov rbx, rcx
jmp 0x1404d4b8b
inc r8
cmp word [rdx + r8*2], di
jne 0x1404d4b8b
mov eax, edi
cmp r8, 3
not al
sete al
jmp 0x1404d4ba9
mov dword [rcx + 0x18], eax
jmp 0x1404d4bb1
jne 0x1404d4bc1
mov ecx, 2
jmp 0x1404d4c3b
mov r9d, edi
stc
clc
test rdx, rdx
jmp 0x1404d4bce
jne 0x1404d4be0
mov ecx, edi
jmp 0x1404d4bdb
jmp 0x1404d4c3b
mov ecx, 2
movzx r8d, word [rdx]
shl ah, cl
xor al, r14b
add rdx, rcx
not al
movzx rax, r15w
and al, 0x87
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1404d4c22
sub r8w, 0x61
jmp 0x1404d4c12
cmp r8w, 0x19
jmp 0x1404d4c1c
ja 0x1404d4c2f
inc r9d
jmp 0x1404d4c2a
jmp 0x1404d4be5
mov ecx, r9d
mov dx, 0x79c5
adc dh, ch
rcr dx, cl
sub r9d, r9d
mov dword [rbx + 0x14], ecx
xor r8d, r8d
cmova rdx, rdx
movzx edx, ax
movsxd rdx, r15d
lea rcx, [0x1400ab740]
movzx edx, r14w
lea edx, [r9 + 3]
jmp 0x1404d4c62
call fcn.1404c9536
test byte [rbx + 0x10], 4
jmp 0x1404d4c70
jne 0x1404d4c79
mov dword [rbx + 0x10], edi
mov rbx, qword [rsp + 0x30]
rcl dil, 0xab
add rsp, 0x20
cmove di, r11w
movzx edi, r13w
movsx di, cl
pop rdi
jmp 0x1404d4c99
ret
Function at 0x1404d63b6
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
movsxd rbx, r14d
inc ebx
and bx, 0x68b8
mov qword [rsp + 0x18], rsi
sbb bx, ax
xchg bh, bl
push rdi
btc edi, 0x25
sub rsp, 0x20
and di, r9w
cmc
bt ebx, 0x39
sub esi, esi
mov dil, 0x27
mov rdi, rdx
cmp cx, 0x154
sal bx, 0xf9
mov rbx, rcx
test rcx, rcx
jmp 0x1404d63fd
je 0x1404d6496
cmp word [rcx], si
jmp 0x1404d640b
je 0x1404d6496
lea rdx, [0x1400d1d08]
jmp 0x1404d641d
call fcn.1400e4b64
test eax, eax
jmp 0x1404d6429
je 0x1404d6496
lea rdx, [0x1400d1d00]
mov rcx, rbx
call fcn.1400e4b64
test eax, eax
jne 0x1404d6489
mov ecx, dword [rdi + 8]
movsx rdx, dx
cdq
lea r9d, [rsi + 2]
not edx
cwd
cmovp r8d, r15d
lea r8, [rsp + 0x30]
movzx rdx, cx
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d6475
je 0x1404d64c8
mov eax, dword [rsp + 0x30]
jmp 0x1404d6484
jmp 0x1404d64f2
mov rcx, rbx
call fcn.1404df4cb
jmp 0x1404d64f2
mov ecx, dword [rdi + 8]
cmovo rdx, r14
mov r8w, 0x42fa
lea r8, [rsp + 0x30]
mov dl, 0x51
xchg dl, r9b
bswap r9d
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d64d4
xor eax, eax
jmp 0x1404d64cf
jmp 0x1404d64f2
mov eax, dword [rsp + 0x30]
jmp 0x1404d64e4
test eax, eax
jne 0x1404d64f2
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
xadd sil, dil
mov rsi, qword [rsp + 0x40]
bt di, sp
or edi, eax
add rsp, 0x20
setg dil
mov dil, 0x3d
movzx di, bl
pop rdi
jmp 0x1404d651b
ret

Function at 0x1404d651c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
bsf rbx, r12
mov qword [rsp + 0x18], rsi
sar sil, cl
bsf esi, r14d
push rdi
sub rsp, 0x20
movsx esi, r9w
mov esi, edx
movzx ebx, r13w
mov ebx, ecx
call fcn.1404c852c
mov ecx, ebx
or r8b, r10b
lea r8, [rsp + 0x30]
sbb di, r10w
btc r9, 0xb6
movsx rdi, r12w
and ecx, 0x3ff
cdq
bt r9w, 0x9e
jmp 0x1404d6570
mov r9d, 2
bts ecx, 0xa
movsx dx, bl
movzx rdi, ax
bswap di
mov edx, 0x20000001
mov rdi, rax
jmp 0x1404d6592
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test eax, eax
jmp 0x1404d65a2
je 0x1404d6669
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d65b1
je 0x1404d665f
test esi, esi
je 0x1404d665f
mov r9, qword [rdi + 0x98]
mov r8d, r10d
stc
bts dx, r12w
xadd al, al
movzx edx, word [r9]
stc
shl cl, 0x89
movsx rax, ax
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jmp 0x1404d65ee
jbe 0x1404d6611
sub dx, 0x61
jmp 0x1404d6602
cmp dx, 0x19
jmp 0x1404d660b
ja 0x1404d6632
movzx edx, word [rcx]
jmp 0x1404d6619
inc r8d
test r14b, cl
jmp 0x1404d6624
add rcx, 2
jmp 0x1404d662d
jmp 0x1404d65e2
or rcx, 0xffffffffffffffff
jmp 0x1404d663b
inc rcx
jmp 0x1404d6646
cmp word [r9 + rcx*2], r10w
jne 0x1404d663b
cmp r8d, ecx
jmp 0x1404d6659
je 0x1404d6669
mov eax, 1
jmp 0x1404d6672
xor eax, eax
cmp rax, rbp
movsx ebx, r13w
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
rol dil, 0x65
add rsp, 0x20
pop rdi
jmp 0x1404d668a
ret
Function at 0x1404d7d95
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
jmp 0x1404d7dae
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
jmp 0x1404d7dc7
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
or bx, r11w
btc bx, 6
mov rbx, rax
test r10b, 0x17
test r13b, r15b
test rax, rax
je 0x1404d7f47
mov rsi, rax
test sil, 0x9c
cmp r13b, 0x37
cmp word [rax], r14w
je 0x1404d7e3f
or rax, 0xffffffffffffffff
jmp 0x1404d7e0e
inc rax
test bx, 0x4d7a
stc
cmp word [rsi + rax*2], r14w
jmp 0x1404d7e21
jne 0x1404d7e0e
lea rsi, [rsi + rax*2]
jmp 0x1404d7e30
add rsi, 2
stc
cmp word [rsi], r14w
jne 0x1404d7e05
mov qword [rsp + 0x38], r14
shr r9, cl
btc r9d, 0xc8
sub rsi, rbx
movzx r8, sp
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
dec r9w
add r9b, cl
adc r8b, r15b
mov r8, rbx
adc r9, rdx
movzx r9w, bpl
mov r9b, 0x6a
mov r9d, esi
mov dword [rsp + 0x28], r14d
test r9w, bp
cmp dl, sil
sub edx, edx
stc
mov qword [rsp + 0x20], r14
clc
cmp dh, cl
xor ecx, ecx
jmp 0x1404d7e98
call fcn.1404c8312
movsxd rbp, eax
test eax, eax
jmp 0x1404d7ea7
je 0x1404d7f47
mov rcx, rbp
jmp 0x1404d7eb5
call fcn.1404c8260
mov rdi, rax
test rax, rax
jmp 0x1404d7ec5
je 0x1404d7f2d
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
bsf r8w, dx
sbb r8b, 0x4c
mov r8, rbx
test r11, r12
mov dword [rsp + 0x28], ebp
stc
xor edx, edx
jmp 0x1404d7ef4
xor ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404d7f00
call fcn.1404c8312
test eax, eax
jmp 0x1404d7f0c
je 0x1404d7f2d
mov rsi, rdi
setl dil
xchg di, di
movzx edi, r8w
mov rdi, r14
jmp 0x1404d7f28
jmp 0x1404d7f35
mov rsi, r14
mov cl, r12b
not cl
mov rcx, rdi
jmp 0x1404d7f3d
call fcn.1404c81ee
jmp 0x1404d7f4b
mov rsi, r14
clc
test rbx, rbx
jmp 0x1404d7f53
je 0x1404d7f67
mov rcx, rbx
jmp 0x1404d7f61
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
sar edi, 0xbb
shr dil, cl
mov rbp, qword [rsp + 0x58]
xadd r14w, di
rcl rdi, cl
btc r14w, 0xeb
mov rdi, qword [rsp + 0x68]
rol r14b, 0xae
rcr r14b, 0xb2
bt r14, r12
add rsp, 0x40
not r14
cmovle r14w, r10w
xchg r14b, r14b
pop r14
jmp 0x1404d7fb4
ret
Function at 0x1404d7fb5
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmp rbp, r11
test r10b, r10b
jmp 0x1404d7fc9
mov qword [rsp + 0x10], rbp
test r13b, 0xaa
mov qword [rsp + 0x18], rsi
stc
jmp 0x1404d7fe0
push rdi
sub rsp, 0x20
jmp 0x1404d7fea
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
bswap rbx
mov rbx, rax
stc
test r9, 0x493828a8
test rax, rax
jmp 0x1404d8008
je 0x1404d80c8
mov rbp, rax
cmp r10w, 0x29fe
cmp word [rax], si
jmp 0x1404d801f
je 0x1404d805f
or rax, 0xffffffffffffffff
jmp 0x1404d802e
inc rax
jmp 0x1404d8036
cmp word [rbp + rax*2], si
jmp 0x1404d8040
jne 0x1404d802e
lea rbp, [rbp + rax*2]
jmp 0x1404d8051
add rbp, 2
cmp word [rbp], si
jne 0x1404d8025
sub rbp, rbx
ror cl, 0x29
shr cl, cl
bt rcx, r10
add rbp, 2
sar rbp, 1
add rbp, rbp
mov rcx, rbp
jmp 0x1404d807d
call fcn.1404c8260
mov rdi, rax
test rax, rax
jmp 0x1404d808d
je 0x1404d80ae
mov r8, rbp
cqo
mov rdx, rbx
mov rcx, rax
jmp 0x1404d80a3
call fcn.1404a2569
mov rsi, rdi
cmp r14b, dil
xor ecx, ecx
jmp 0x1404d80b5
call fcn.1404c81ee
mov rcx, rbx
jmp 0x1404d80c2
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
xchg bpl, bpl
bts rdi, rsi
mov rax, rsi
inc rbp
bsf rbp, rax
mov rsi, qword [rsp + 0x40]
btr rbp, rax
adc bpl, r14b
sal bpl, cl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
bswap di
cmovp edi, ebx
movsx rdi, r14w
pop rdi
jmp 0x1404d8106
ret
Function at 0x1404daf80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
lahf
cdqe
movsx ax, al
mov qword [rsp + 0x18], rbp
movsx ax, r12b
movsx eax, dx
cwde
push rsi
push rdi
cbw
push r14
movsx ax, bpl
movzx eax, r11w
mov eax, 0x1450
jmp 0x1404dafb3
call fcn.140447851
sub rsp, rax
mov rax, qword [0x1400b7288]
or sil, sil
xor rax, rsp
sbb r10w, dx
mov qword [rsp + 0x1440], rax
movsxd r10, edx
movzx esi, r10w
mov rdi, rcx
dec dh
movzx cx, r13b
mov rax, r10
mov ebp, r9d
sub cl, r14b
shl si, cl
sar rax, 6
lea rcx, [0x1400ba940]
bt edx, r11d
and edx, esi
and r10d, 0x3f
btc rsi, 0x57
shrd si, r11w, 0xf1
shl r14b, 0x5f
lea rbp, [rbp + r8]
sar r14, cl
movsx r14d, dx
mov rsi, r8
rcr dl, cl
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
sub r14b, 0x43
test ecx, r13d
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x1404db041
xor eax, eax
stc
jmp 0x1404db04d
mov qword [rdi], rax
jmp 0x1404db057
mov dword [rdi + 8], eax
test rdx, 0x484a1073
cmp sil, spl
cmp r8, rbp
jmp 0x1404db06c
jae 0x1404db152
lea rbx, [rsp + 0x40]
cmp bpl, 0xbd
cmp rsi, rbp
jmp 0x1404db083
jae 0x1404db0d7
mov al, byte [rsi]
jmp 0x1404db090
inc rsi
cmp r9b, 0x6f
cmc
cmp al, 0xa
jne 0x1404db0b3
inc dword [rdi + 8]
jmp 0x1404db0a8
mov byte [rbx], 0xd
inc rbx
jmp 0x1404db0b3
mov byte [rbx], al
cmovnp rax, r15
inc rbx
lea rax, [rsp + 0x143f]
test cx, 0x49ef
cmp rbx, rax
jmp 0x1404db0d1
jb 0x1404db07b
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
btc ecx, r9d
sub ebx, eax
lea r9, [rsp + 0x30]
movsx edx, bp
mov r8d, ebx
jmp 0x1404db0f8
lea rdx, [rsp + 0x40]
movzx cx, r9b
movzx ecx, r8w
mov rcx, r14
jmp 0x1404db10e
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404db11b
je 0x1404db143
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404db12f
jb 0x1404db152
cmp rsi, rbp
jb 0x1404db072
jmp 0x1404db152
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
movsxd rax, r14d
ror ax, 0xc
mov rax, rdi
or cl, r10b
bsf rcx, r13
mov rcx, qword [rsp + 0x1440]
jmp 0x1404db170
xor rcx, rsp
jmp 0x1404db178
call fcn.14049e949
lea r11, [rsp + 0x1450]
movsx ebx, r12w
xchg bl, bl
movzx di, r15b
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movsx rdi, r8w
movzx rdi, r10w
pop r14
movzx edi, r10w
pop rdi
mov sil, 0x18
xchg esi, esi
pop rsi
jmp 0x1404db1b5
ret
Function at 0x1404db1b6
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
lahf
mov qword [rsp + 0x18], rbp
movsx ax, bpl
push rsi
push rdi
not ah
bswap ax
push r14
mov eax, 0x1450
call fcn.140447851
sub rsp, rax
shr rdi, 0x5b
dec r14b
xor bp, r8w
mov rax, qword [0x1400b7288]
xor rax, rsp
shl r14b, 0xd3
xor bpl, dl
mov qword [rsp + 0x1440], rax
movsxd r10, edx
movsx bp, r10b
shld edi, ecx, 0x2d
mov rdi, rcx
rdtsc
xor bp, 0x6349
rcr rcx, 0xda
mov rax, r10
sar r14b, cl
mov ebp, r9d
shrd dx, r15w, 0xb4
or dx, dx
sar rax, 6
lea rcx, [0x1400ba940]
and r10d, 0x3f
cdq
add rbp, r8
mov rsi, r8
xadd r14d, r14d
rcl dx, cl
mov rax, qword [rcx + rax*8]
rol edx, 0x7a
lea rdx, [r10 + r10*8]
adc r14, 0x6fa529d0
mov r14b, sil
bt r14, rdi
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
test di, cx
mov qword [rdi], rax
clc
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1404db3ad
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404db289
jae 0x1404db300
movzx eax, word [rsi]
test al, r14b
add rsi, 2
jmp 0x1404db29f
cmp ax, 0xa
jmp 0x1404db2a8
jne 0x1404db2dc
add dword [rdi + 8], 2
cmp r9b, r14b
sal cx, 0x81
and ecx, 0x1a9e21bc
mov ecx, 0xd
cmc
cmp bpl, 0xce
test r13b, 0x2d
mov word [rbx], cx
test r12, rsp
clc
add rbx, 2
test r8b, 9
mov word [rbx], ax
btr eax, edi
add rbx, 2
rcl al, cl
adc ah, 0xc1
btc ax, di
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x1404db281
and qword [rsp + 0x20], 0
cmc
bt rax, 0x2d
shl r9d, cl
lea rax, [rsp + 0x40]
shl r9b, cl
bsf r8, rsp
sub rbx, rax
add r9b, r10b
cmc
rcl r8, 0x10
lea r9, [rsp + 0x30]
mov r8d, r12d
movzx rcx, cx
bts ecx, r9d
sar rbx, 1
ror cl, cl
btc r8d, esp
lea rdx, [rsp + 0x40]
shl r8b, 0xf7
shr ecx, 0xde
add ebx, ebx
movsx r8w, dil
mov rcx, r14
movzx r8d, r14w
not r8b
mov r8d, ebx
jmp 0x1404db364
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404db3a0
mov eax, dword [rsp + 0x30]
jmp 0x1404db37c
add dword [rdi + 4], eax
stc
cmp eax, ebx
jmp 0x1404db387
jb 0x1404db3ad
cmp rsi, rbp
jmp 0x1404db395
jb 0x1404db27c
jmp 0x1404db3ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
movzx ax, r11b
mov rax, rdi
neg cl
sal ch, 0x3a
mov ecx, edi
mov rcx, qword [rsp + 0x1440]
jmp 0x1404db3c4
xor rcx, rsp
jmp 0x1404db3cc
call fcn.14049e949
lea r11, [rsp + 0x1450]
movzx ebp, cx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
cmovl si, r14w
movzx r14, bp
mov rsp, r11
movsx rsi, bx
movzx di, cl
xchg di, si
pop r14
bswap edi
not edi
xchg esi, esi
pop rdi
movzx si, bl
jmp 0x1404db40d
pop rsi
jmp 0x1404db413
ret