joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404ab9ed
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
bts bx, sp
clc
test r9b, bpl
mov qword [rsp + 0x20], rsi
movzx rbx, r15w
push rdi
bsf bx, r10w
rol bl, 1
sub rsp, 0x30
adc bl, r8b
or bl, r14b
sub ebp, ebp
bts ebx, r12d
ror bx, 0xfe
rol rbx, cl
mov rbx, rcx
clc
test r15w, sp
cmp byte [rcx + 0x54], bpl
jmp 0x1404aba38
jne 0x1404abb69
cmp dword [rcx + 0x50], ebp
jmp 0x1404aba46
jle 0x1404abb69
mov rsi, qword [rcx + 0x48]
lahf
cbw
mov edi, ebp
cmovge dx, sp
mov r9, qword [rbx + 8]
setle ch
cdq
rdtsc
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], bp
rdtsc
cwde
movsxd rax, r9d
mov rdx, rsi
xchg al, r8b
movsx r8d, r11w
mov rax, qword [r9]
movzx r8d, cx
mov r8b, 0x7b
movsxd r8, dword [rax + 8]
jmp 0x1404aba90
call fcn.1404cd178
movsxd r8, eax
test dx, 0x19e5
cmp esi, eax
test bx, r9w
test eax, eax
jle 0x1404abb60
mov rcx, qword [rbx + 0x468]
movsx rax, bp
movzx edx, word [rsp + 0x40]
sub al, bh
bsr ax, r11w
mov rax, qword [rcx + 8]
cmc
cmp qword [rcx + 0x10], rax
jmp 0x1404abad0
jne 0x1404abafb
cmp byte [rcx + 0x18], bpl
jmp 0x1404abadf
je 0x1404abaf2
inc dword [rbx + 0x28]
jmp 0x1404abaed
jmp 0x1404abb41
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404abb41
inc dword [rbx + 0x28]
lahf
mov ax, di
inc qword [rcx + 0x10]
btc cx, 0xb4
ror al, cl
or rcx, 0xca33e4a
mov rax, qword [rbx + 0x468]
mov rcx, qword [rax]
jmp 0x1404abb23
mov word [rcx], dx
shrd rax, rax, 0x52
movsx ax, r15b
cmovne ax, r8w
mov rax, qword [rbx + 0x468]
stc
add qword [rax], 2
add rsi, r8
jmp 0x1404abb49
inc edi
test ebp, ebp
cmp edi, dword [rbx + 0x50]
jmp 0x1404abb55
jne 0x1404aba59
jmp 0x1404abba4
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404abba4
mov r8d, dword [rbx + 0x50]
rcr r9w, 0xc3
lea rax, [rcx + 0x10]
stc
clc
bts edx, r9d
mov rdx, qword [rbx + 0x48]
cmp sp, 0x7ece
sar r9, cl
stc
lea r9, [rcx + 0x28]
clc
add rcx, 0x468
mov qword [rsp + 0x20], rax
jmp 0x1404abb9f
call fcn.1404a9e3e
mov rbx, qword [rsp + 0x48]
cmc
mov al, 1
rcr sil, cl
movsx si, spl
rcr edi, 0x47
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
bt di, si
mov edi, 0x58425dd1
add rsp, 0x30
pop rdi
jmp 0x1404abbd4
ret
Function at 0x1404ad5df
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmc
cmp r14, 0x5f0b082a
test ax, 0x16da
mov qword [rsp + 0x10], rsi
shr sil, 0x96
push rdi
sub rsp, 0x30
shr dil, 0xe2
shrd di, r8w, 0x7b
bsf esi, edi
mov edi, edx
dec sil
mov rsi, rcx
jmp 0x1404ad619
test r8, r8
jmp 0x1404ad621
jne 0x1404ad648
call fcn.1404b1f42
mov dword [rax], 0x16
jmp 0x1404ad637
call fcn.1404b2c43
xor eax, eax
jmp 0x1404ad643
jmp 0x1404ad72c
mov rdx, r9
mov rcx, r8
call fcn.1404ad795
mov rbx, rax
cmp spl, 0xf5
cmp r9, r14
test rax, rax
jmp 0x1404ad665
je 0x1404ad6cc
lea rax, [rsp + 0x50]
movzx r9d, r11w
mov rdx, rdi
mov qword [rsp + 0x28], rax
movsx r9, dx
movzx r9d, r10w
lea r8, [0x140094b24]
mov eax, dword [rsp + 0x60]
movzx ecx, r9w
xchg cl, cl
mov r9, rbx
movsx ecx, r8w
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404ad6a8
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1404ad757
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404ad6c7
call fcn.1404b1fac
sub edi, edi
test rbx, rbx
jmp 0x1404ad6d6
je 0x1404ad725
mov rcx, qword [rbx + 0x10]
cmp cx, 0x183
stc
test rcx, rcx
jmp 0x1404ad6ee
je 0x1404ad6fa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
stc
jmp 0x1404ad704
test rcx, rcx
jmp 0x1404ad70c
je 0x1404ad718
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404ad720
call fcn.1404c5f1c
mov rax, rdi
rol si, 0x53
mov rbx, qword [rsp + 0x40]
setne dil
mov rsi, qword [rsp + 0x48]
movsxd rdi, eax
sal rdi, 0x1a
sub dil, al
add rsp, 0x30
movsx rdi, r15w
movzx rdi, si
pop rdi
jmp 0x1404ad756
ret
mov rcx, qword [rsp + 0x68]
clc
cmp bpl, spl
test rcx, rcx
jmp 0x1404ad768
je 0x1404ad77a
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
jmp 0x1404ad77a
xor ebx, ebx
jmp 0x1404ad6ce

Function at 0x1404ada2e
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
movsx ebx, r12w
movsx rbx, r10w
movsx bx, r12b
mov ebx, ecx
jmp 0x1404ada48
call fcn.1404cf3c0
cmp eax, 1
jmp 0x1404ada55
je 0x1404adaa4
mov rax, qword gs:[0x60]
sub dl, dil
mov edx, dword [rax + 0xbc]
jmp 0x1404ada73
shr edx, 8
cmc
cmp r12b, r10b
test dl, 1
jmp 0x1404ada82
jne 0x1404adaa4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xchg rdx, rdx
movzx edx, di
mov edx, ebx
jmp 0x1404ada9e
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404adaab
call fcn.1404ad9a1
mov ecx, ebx
jmp 0x1404adab7
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b2cd7
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movzx rcx, ax
mov ecx, 0x17
jmp 0x1404b2ce9
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b2cf6
je 0x1404b2d0d
mov ecx, 5
jmp 0x1404b2d06
int 0x29
jmp 0x1404b2d0d
mov r8d, 1
xchg dx, dx
mov edx, 0xc0000417
cmovge cx, r15w
lea ecx, [r8 + 1]
call fcn.1404b2d46
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
shl rdx, cl
mov edx, 0xc0000417
cmc
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b4519
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
btc rcx, r15
push rsi
btr cx, 0x79
push rdi
push r14
add cl, 3
mov ecx, edi
and sil, 0x44
sub rsp, 0x60
mov rsi, r9
mov rdi, r8
movsxd rcx, r10d
mov ecx, dword [rdx]
jmp 0x1404b454d
call fcn.140235a29
nop
test ax, r14w
mov rbx, qword [0x1400ba160]
sar r14, cl
movsxd rax, dword [0x1400ba158]
neg r14w
xor r14d, r15d
lea r14, [rbx + rax*8]
cmp r8w, 0x64f6
mov qword [rsp + 0x38], rbx
cmp rbx, r14
jmp 0x1404b4586
je 0x1404b4692
mov rax, qword [rbx]
movsx dx, ch
xchg dl, dl
mov qword [rsp + 0x20], rax
rol edx, 0xd3
mov rdx, qword [rdi]
test sil, r12b
jmp 0x1404b45a8
test rax, rax
jmp 0x1404b45b0
je 0x1404b4604
mov ecx, dword [rax + 0x14]
movzx eax, r12w
movsx ax, r8b
mov eax, ecx
shr eax, 0xd
test al, 1
jmp 0x1404b45ce
je 0x1404b4604
mov eax, ecx
and al, 3
cmp al, 2
jne 0x1404b45e9
test cl, 0xc0
jne 0x1404b4612
bt ecx, 0xb
jmp 0x1404b45f2
jb 0x1404b4612
inc dword [rdx]
test dil, cl
test r9b, 0x18
cmp r14b, bpl
add rbx, 8
jmp 0x1404b460d
jmp 0x1404b4579
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
movsx r9w, r11b
mov rax, qword [rdi]
mov r8d, ebx
lea r8, [rsp + 0x20]
movzx r9, bx
mov qword [rsp + 0x40], r8
movzx r9, r13w
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
cdqe
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0x20]
cdq
xchg cl, dh
mov qword [rsp + 0x28], rax
cwd
mov qword [rsp + 0x30], rax
movzx r8, r10w
movsx edx, bx
cmovg dx, r12w
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x40]
movsx rcx, di
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x88]
jmp 0x1404b4688
call fcn.1404b43aa
jmp 0x1404b4604
mov ecx, dword [rsi]
jmp 0x1404b4699
call fcn.1401b4320
mov rbx, qword [rsp + 0x80]
adc di, r13w
xchg r14b, sil
add rsp, 0x60
setb r14b
cmova rdi, r12
pop r14
jmp 0x1404b46c0
pop rdi
movsx rsi, r13w
movzx rsi, r9w
cmovo rsi, r13
pop rsi
ret
Function at 0x1404c06ef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
lahf
xchg al, ah
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], r9
mov dword [rsp + 0x10], edx
push rbp
cmovle rax, r12
bt ebx, r14d
push rsi
push rdi
cdqe
setne al
push r12
rcl r12w, 0xde
push r13
bt rax, 7
shrd rbx, r9, 0x11
bsr bx, r14w
push r14
rcl bx, 0x62
sub r12b, r10b
rcr bh, cl
push r15
sub r13w, r12w
inc r15
sub rsp, 0x20
shl r12b, cl
cdqe
bt r15d, edx
mov rax, qword [rcx + 8]
or r12b, 0x27
shr r15b, cl
xchg bx, bx
sub bpl, bpl
sub r14b, r14b
mov qword [r11 + 8], rax
sal r12b, cl
xor r12b, 0x76
sub edi, edi
mov r12, r9
shl rbx, 0xc0
test r13w, 0x5ec5
rcl r13b, 0x9d
mov r13d, r8d
mov rbx, rcx
rol sil, 0x9e
and sil, bpl
lea rsi, [rax - 1]
mov r15, rsi
stc
test r9w, r15w
cmp dword [rcx], edi
jle 0x1404c0835
mov r12d, dword [r11 + 0x10]
stc
test bp, r11w
jmp 0x1404c07ab
cmp edi, r12d
jne 0x1404c07c2
mov rsi, rax
mov bpl, 1
clc
stc
test r13w, 0x6739
cmp edi, r13d
jmp 0x1404c07ca
jne 0x1404c07de
mov r15, rax
mov r14b, 1
test cl, r8b
cmp r9w, dx
stc
test bpl, bpl
jmp 0x1404c07e6
je 0x1404c07fa
test r14b, r14b
jmp 0x1404c07f4
jne 0x1404c0828
lea rdx, [rsp + 0x60]
xchg rcx, rcx
mov rcx, rbx
call fcn.140194998
inc edi
cmp edi, dword [rbx]
jmp 0x1404c0813
jge 0x1404c0828
mov rax, qword [rsp + 0x60]
jmp 0x1404c0823
jmp 0x1404c07ab
mov r12, qword [rsp + 0x78]
or dil, 0x63
xadd al, dil
mov rax, qword [r12]
mov qword [r12 + 8], rsi
movups xmm0, xmmword [rbx]
bswap r12
movups xmmword [rax], xmm0
test esi, esp
sal r13b, cl
movsxd rsi, edx
movups xmm1, xmmword [rbx + 0x10]
cmp r8d, ecx
movups xmmword [rax + 0x10], xmm1
inc r13w
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
mov qword [rax + 8], r15
neg r13b
sal rdi, cl
btr edi, 0xeb
movups xmm0, xmmword [rbx]
rcl esi, cl
btr di, 0x11
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
sbb r15d, 0x24bd6220
add di, 0x1884
not sil
mov rbx, qword [rsp + 0x70]
clc
rcr si, 0x33
movups xmmword [rcx + 0x10], xmm1
shl r13w, cl
add rsp, 0x20
movzx bp, cl
movzx esi, bp
xchg bpl, r14b
pop r15
xchg dil, dil
pop r14
movsxd r12, r9d
not bp
movzx rdi, r9w
pop r13
movzx r12d, r13w
movsx ebp, cx
bswap rbp
pop r12
pop rdi
pop rsi
not bp
movsxd rbp, edx
pop rbp
jmp 0x1404c08e4
ret
Function at 0x1404c739d
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov r9b, 0x75
cdq
mov rbx, rcx
movzx dx, r14b
lea r9, [0x1400c63c0]
mov ecx, 3
cqo
movzx r8, si
cdq
lea r8, [0x1400c63b8]
lea rdx, [0x1400cfb70]
call fcn.1404c8366
test rax, rax
je 0x1404c73fa
mov rcx, rbx
add rsp, 0x20
cmovne rbx, rsp
mov bx, r9w
pop rbx
jmp 0x1404c73f3
push qword [0x1400b8d90]
ret
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404c74e7
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
movzx r8, sp
sub rsp, 0x20
mov rbx, rdx
movsx r8w, r10b
lea r9, [0x1400c63d8]
cdq
not edi
cmovs rdx, r10
mov edi, ecx
cdq
movsx ecx, si
lea rdx, [0x1400cf748]
movzx r8w, sil
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404c752e
call fcn.1404c8366
mov rdx, rbx
shl rcx, cl
mov ecx, edi
test rax, rax
jmp 0x1404c7543
je 0x1404c7554
call qword [0x1400b8d90]
jmp 0x1404c755a
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add dil, 0x23
add rsp, 0x20
sete dil
mov dil, 0x42
bswap di
pop rdi
ret

Function at 0x1404c76cf
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
btr rbx, 0x8a
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
clc
sub rsp, 0x30
movsx di, r13b
movzx ebp, r12w
mov ebx, r9d
mov rdi, r8
mov esi, edx
cmovno edx, r15d
movsx r9, r13w
lea r9, [0x1400c63e8]
mov rbp, rcx
bswap r8w
lea r8, [0x1400c63e0]
not rdx
lea rdx, [0x1400cf190]
setb cl
movsxd rcx, edi
jmp 0x1404c772c
mov ecx, 0xb
jmp 0x1404c7736
call fcn.1404c8366
mov rcx, rbp
test rax, rax
je 0x1404c7769
mov r9d, ebx
mov r8, rdi
cwd
movsx edx, bx
movsx dx, spl
mov edx, esi
jmp 0x1404c775e
call qword [0x1400b8d90]
jmp 0x1404c77af
xor edx, edx
jmp 0x1404c7770
call fcn.1404c7e1e
mov ecx, eax
cmovbe r8w, r12w
sete r8b
cwd
mov r9d, ebx
movzx dx, r12b
cmovp dx, r13w
movsx rdx, r13w
mov r8, rdi
movzx dx, spl
movsx edx, r11w
mov dl, r13b
mov edx, esi
jmp 0x1404c77a9
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
neg sil
bt rbp, 0x87
add dil, r15b
mov rbp, qword [rsp + 0x48]
btc rdi, r8
bswap di
adc sil, 0x1b
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp 0x1404c77de
ret
Function at 0x1404cf0fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
sbb al, 0x24
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
xchg al, ah
bsr ax, r10w
sal ax, cl
mov qword [r11 + 0x18], rdi
movsx edi, di
push r14
sub rsp, 0x50
mov rax, qword [rsp + 0x80]
mov rbp, r8
movsx rdi, r14w
mov rcx, qword [rcx]
mov r8, r8
mov dil, 0xbc
movzx rdi, dx
lea r8, [r11 - 0x18]
mov rdi, rdx
mov qword [r11 - 0x38], rax
not rdx
cqo
mov dh, 0x7c
mov edx, dword [rsp + 0x88]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x1404cf161
call fcn.1404de5a1
mov r14d, dword [rsp + 0x44]
cmp al, r15b
xor r8d, r8d
sete cl
xadd bh, ch
add cx, r13w
cmp dword [rsp + 0x40], 0x2d
movsx ebx, r12w
mov r9d, eax
mov eax, dword [rsp + 0xa0]
mov r8b, 0xd7
jmp 0x1404cf196
mov rdx, rbp
movzx rcx, r12w
sete r8b
sbb cx, r10w
mov dword [rsp + 0x28], eax
sal cx, 0x89
and cl, r9b
bsr rcx, r10
sub rdx, r8
movzx rbx, bp
mov ch, 0x7a
mov dword [rsp + 0x20], r9d
mov r9b, 0x7e
inc rcx
movsx cx, sil
dec r14d
lea r9, [rsp + 0x40]
xor bl, r15b
cmp rbp, 0xffffffffffffffff
movzx bx, r13b
lea rbx, [r8 + rdi]
movsx rcx, bx
mov cx, 0x2639
mov r8d, dword [rsp + 0x88]
bswap cx
movzx cx, r10b
cmove rdx, rbp
movsx ecx, dx
cmovns cx, bp
mov ecx, 0x7c072c9d
mov rcx, rbx
jmp 0x1404cf216
call fcn.1404de296
test eax, eax
jmp 0x1404cf222
je 0x1404cf230
mov byte [rdi], 0
jmp 0x1404cf346
mov eax, dword [rsp + 0x44]
dec eax
test di, 0x1396
cmp eax, 0xfffffffc
jmp 0x1404cf243
jl 0x1404cf2da
cmp eax, dword [rsp + 0x88]
jge 0x1404cf2da
cmp r14d, eax
jmp 0x1404cf25e
jge 0x1404cf28a
mov al, byte [rbx]
jmp 0x1404cf26b
inc rbx
test al, al
jmp 0x1404cf275
jne 0x1404cf264
mov byte [rbx - 2], al
movsx edx, r10w
movzx r9w, sil
bswap cx
mov rax, qword [rsp + 0xa8]
lea r9, [rsp + 0x40]
not r8w
cqo
mov r8d, dword [rsp + 0x88]
movsx edx, di
mov rdx, rbp
movsx cx, r10b
mov cx, 0x4c94
movzx cx, r12b
mov qword [rsp + 0x28], rax
mov rcx, rdi
jmp 0x1404cf2c6
mov byte [rsp + 0x20], 1
jmp 0x1404cf2d0
call fcn.1404cee06
jmp 0x1404cf346
mov rax, qword [rsp + 0xa8]
mov rdx, rbp
movzx cx, r8b
xchg r8w, cx
setl r8b
mov r9b, byte [rsp + 0x90]
bswap rcx
mov rcx, rdi
mov r8, 0x6de5744b
bswap r8w
movsxd r8, edi
mov r8d, dword [rsp + 0x88]
mov qword [rsp + 0x38], rax
cbw
lea rax, [rsp + 0x40]
jmp 0x1404cf327
mov byte [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x20], eax
jmp 0x1404cf341
call fcn.1404cde3f
mov rbx, qword [rsp + 0x60]
movzx ebp, r8w
movzx r14w, bpl
mov rbp, qword [rsp + 0x68]
rcr dil, 0xa
mov rdi, qword [rsp + 0x70]
cmp r10b, 0xaf
bts r14, rdx
add rsp, 0x50
mov r14b, bpl
pop r14
jmp 0x1404cf378
ret
Function at 0x1404d3edf
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
sbb rbx, 0x7c9e335f
movsx rbx, si
mov qword [rsp + 0x18], rsi
push rdi
movsx di, dl
or di, r9w
btr rbx, 0x56
sub rsp, 0x20
xchg dil, dil
xor esi, esi
btc edi, r12d
rcr bh, cl
mov rdi, rdx
movsx bx, r10b
rcr bx, 6
mov rbx, rcx
test r11b, r12b
test rcx, rcx
je 0x1404d3fc3
cmp word [rcx], si
jmp 0x1404d3f34
je 0x1404d3fc3
lea rdx, [0x1400d1d08]
jmp 0x1404d3f46
call fcn.14023292c
test eax, eax
jmp 0x1404d3f52
je 0x1404d3fc3
lea rdx, [0x1400d1d00]
movsx ecx, dx
movzx ecx, bx
mov rcx, rbx
call fcn.14023292c
test eax, eax
jmp 0x1404d3f74
jne 0x1404d3fb6
mov ecx, dword [rdi + 8]
mov r9w, di
lea r9d, [rsi + 2]
movsxd r8, r10d
xchg dl, r8b
cqo
lea r8, [rsp + 0x30]
movsxd rdx, eax
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d3fa7
je 0x1404d3ffd
mov eax, dword [rsp + 0x30]
jmp 0x1404d4025
mov rcx, rbx
call fcn.1404dcf8a
jmp 0x1404d4025
mov ecx, dword [rdi + 8]
movzx r8d, r13w
movzx r9w, r12b
lea r8, [rsp + 0x30]
jmp 0x1404d3fdf
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d3fef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d4009
sub eax, eax
jmp 0x1404d4004
jmp 0x1404d4025
mov eax, dword [rsp + 0x30]
jmp 0x1404d4012
test eax, eax
jmp 0x1404d4019
jne 0x1404d4025
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov sil, r11b
movsx esi, r8w
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movzx rdi, dx
bswap di
not di
pop rdi
jmp 0x1404d404a
ret

Function at 0x1404d404b
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
bsr bx, cx
push rdi
sub rsp, 0x20
movsx esi, r11w
movzx ebx, sp
mov esi, edx
mov bx, 0x6212
movsxd rbx, edx
mov ebx, ecx
jmp 0x1404d4075
call fcn.1404c625b
mov ecx, ebx
bts r8w, r14w
rcr r8b, cl
lea r8, [rsp + 0x30]
cdq
rol r9b, 0x20
and ecx, 0x3ff
movsx r9, r14w
btc r9w, 0xf0
bswap rdx
mov r9d, 2
movsx rdx, si
mov dil, 0x36
bts ecx, 0xa
movzx di, r14b
cwd
movzx edi, di
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
jmp 0x1404d40d5
test eax, eax
jmp 0x1404d40dc
je 0x1404d418a
cmp ebx, dword [rsp + 0x30]
je 0x1404d417b
test esi, esi
jmp 0x1404d40f3
je 0x1404d417b
mov r9, qword [rdi + 0x98]
and dl, 0xee
mov r8d, r10d
movzx edx, word [r9]
lea rcx, [r9 + 2]
shrd ax, bp, 0xf8
lea eax, [rdx - 0x41]
clc
cmp bp, 0x6932
cmp ax, 0x19
jmp 0x1404d4125
jbe 0x1404d4145
sub dx, 0x61
cmp spl, bl
test r15b, 0x82
cmp dx, 0x19
jmp 0x1404d413f
ja 0x1404d4156
movzx edx, word [rcx]
inc r8d
clc
stc
add rcx, 2
jmp 0x1404d4113
or rcx, 0xffffffffffffffff
jmp 0x1404d415f
inc rcx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d416c
jne 0x1404d415f
cmp r8d, ecx
je 0x1404d418a
mov eax, 1
jmp 0x1404d4185
jmp 0x1404d418c
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
and dil, 0x63
sar dil, 0xc3
add rsp, 0x20
movsx rdi, dx
pop rdi
jmp 0x1404d41ac
ret
Function at 0x1404d588b
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
stc
test dil, 0x3c
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmp r15b, 0xe1
push r14
sub rsp, 0x40
jmp 0x1404d58b3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
btr bx, r10w
mov rbx, r10
mov rbx, rax
stc
clc
test rax, rax
je 0x1404d5a58
mov rsi, rax
cmp word [rax], r14w
jmp 0x1404d58de
je 0x1404d591e
or rax, 0xffffffffffffffff
inc rax
cmp bp, dx
jmp 0x1404d58f3
cmp word [rsi + rax*2], r14w
jmp 0x1404d58fd
jne 0x1404d58e8
lea rsi, [rsi + rax*2]
cmc
add rsi, 2
stc
clc
cmc
cmp word [rsi], r14w
jmp 0x1404d5918
jne 0x1404d58e4
mov qword [rsp + 0x38], r14
bts r9, rbx
test r10, 0x43b70ab
xchg r8b, r9b
sub rsi, rbx
mov qword [rsp + 0x30], r14
cmc
cmovo r9w, si
add rsi, 2
not r8b
sar rsi, 1
or r8b, 0x87
mov r8, rbx
rcr r9w, 0xd2
sub r9b, spl
mov r9d, esi
jmp 0x1404d596a
mov dword [rsp + 0x28], r14d
clc
xor edx, edx
jmp 0x1404d5978
mov qword [rsp + 0x20], r14
test esi, 0x70ae6051
test r8w, ax
sub ecx, ecx
jmp 0x1404d598e
call fcn.1404c6054
movsxd rbp, eax
cmp r13, r14
stc
test eax, eax
jmp 0x1404d59a1
je 0x1404d5a58
mov rcx, rbp
jmp 0x1404d59af
call fcn.1404c5f9c
mov rdi, rax
test rax, rax
jmp 0x1404d59bf
je 0x1404d5a3d
mov qword [rsp + 0x38], r14
not r9b
adc r9b, 0x11
mov r9d, esi
sub r8w, cx
test sil, 0x9f
bt r8w, 0x85
mov qword [rsp + 0x30], r14
btc r8d, r8d
xor r8b, cl
mov r8, rbx
test r9d, r10d
jmp 0x1404d59fa
mov dword [rsp + 0x28], ebp
stc
sub edx, edx
sub ecx, ecx
jmp 0x1404d5a08
mov qword [rsp + 0x20], rax
jmp 0x1404d5a12
call fcn.1404c6054
test eax, eax
jmp 0x1404d5a1e
je 0x1404d5a3d
mov rsi, rdi
movzx di, r9b
sets dil
mov rdi, r14
jmp 0x1404d5a38
jmp 0x1404d5a46
mov rsi, r14
cmovs cx, di
mov cl, 0xf5
mov rcx, rdi
jmp 0x1404d5a4e
call fcn.1404c5f1c
jmp 0x1404d5a5c
mov rsi, r14
clc
test rbx, rbx
jmp 0x1404d5a64
je 0x1404d5a78
mov rcx, rbx
jmp 0x1404d5a72
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
btr rbp, r14
rcr r14b, cl
mov rax, rsi
bsf r14, rcx
rcl bpl, cl
add r14d, ebp
mov rsi, qword [rsp + 0x60]
bswap edi
xadd r14b, bpl
xor ebp, r9d
mov rbp, qword [rsp + 0x58]
sbb dil, r13b
add r14b, r11b
mov rdi, qword [rsp + 0x68]
rol r14b, 0x73
rcr r14w, 0xd0
bswap r14
add rsp, 0x40
movsxd r14, esi
bswap r14w
pop r14
ret
Function at 0x1404d5ac9
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
clc
test r10b, 0x81
cmc
mov qword [rsp + 0x10], rbp
cmp cl, r8b
mov qword [rsp + 0x18], rsi
cmp r10b, bl
jmp 0x1404d5aea
push rdi
sub rsp, 0x20
jmp 0x1404d5af4
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
movzx rbx, r13w
sbb bl, bpl
mov rbx, rax
clc
test rax, rax
jmp 0x1404d5b0f
je 0x1404d5be5
mov rbp, rax
cmp rax, 0x780d4852
cmp word [rax], si
jmp 0x1404d5b27
je 0x1404d5b76
or rax, 0xffffffffffffffff
jmp 0x1404d5b36
inc rax
cmp ebp, 0x60854add
test r13b, r15b
cmc
cmp word [rbp + rax*2], si
jmp 0x1404d5b4d
jne 0x1404d5b36
lea rbp, [rbp + rax*2]
clc
cmp r10w, 0x11a2
add rbp, 2
test r15b, 0xe6
cmp word [rbp], si
jmp 0x1404d5b70
jne 0x1404d5b2d
sub rbp, rbx
cmp r10w, dx
movsx ecx, r14w
sub cx, 0x3544
add rbp, 2
sar rbp, 1
add rbp, rbp
xchg rcx, rcx
mov rcx, rbp
jmp 0x1404d5b9b
call fcn.1404c5f9c
mov rdi, rax
test rax, rax
jmp 0x1404d5bab
je 0x1404d5bd0
mov r8, rbp
movzx cx, bl
mov rdx, rbx
mov rcx, rax
jmp 0x1404d5bc3
call fcn.14049ffae
mov rsi, rdi
jmp 0x1404d5bd0
xor ecx, ecx
call fcn.1404c5f1c
mov rcx, rbx
jmp 0x1404d5bdf
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
rcl ax, 0xf8
sbb al, dil
btc di, r14w
mov rax, rsi
btc si, 0xe
bswap edi
xadd di, si
mov rsi, qword [rsp + 0x40]
sal di, 0xe7
mov rbp, qword [rsp + 0x38]
cmp rcx, 0x184619d9
rcr dil, 0x2c
movsx di, r9b
add rsp, 0x20
pop rdi
jmp 0x1404d5c2c
ret
Function at 0x1404d8a28
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
xchg ah, ah
mov rax, 0x26e26ea7
push rdi
push r14
movzx eax, di
movzx ax, r15b
cmovl ax, r8w
mov eax, 0x1450
jmp 0x1404d8a56
call fcn.1404452b6
sub rsp, rax
cmp r9, r10
sub rax, r15
mov rax, qword [0x1400b7288]
btc r10, 0xcd
cmc
xor rax, rsp
mov qword [rsp + 0x1440], rax
cmovns rdi, r11
adc bpl, 0x73
movsxd r10, edx
sal dl, 0xf0
adc bpl, 0x6a
mov rdi, rcx
mov rax, r10
neg rcx
mov ebp, r9d
cmc
bswap si
sar rax, 6
movzx rsi, r12w
rol r14d, cl
btc edx, 0xa9
lea rcx, [0x1400ba940]
or r14d, r12d
mov r14d, eax
and r10d, 0x3f
sal edx, cl
add r14b, r8b
add rbp, r8
and rsi, r8
mov rsi, r8
mov rax, qword [rcx + rax*8]
rcl r14d, 0x7d
ror r14d, 0x51
lea rdx, [r10 + r10*8]
sub r14b, r9b
ror r14b, cl
mov r14, qword [rax + rdx*8 + 0x28]
stc
jmp 0x1404d8aed
sub eax, eax
mov qword [rdi], rax
stc
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404d8afe
jae 0x1404d8bf8
lea rbx, [rsp + 0x40]
jmp 0x1404d8b0f
cmp rsi, rbp
jae 0x1404d8b77
mov al, byte [rsi]
jmp 0x1404d8b1f
inc rsi
test r8d, r8d
cmp r10w, bp
cmp al, 0xa
jmp 0x1404d8b30
jne 0x1404d8b49
inc dword [rdi + 8]
jmp 0x1404d8b3e
mov byte [rbx], 0xd
inc rbx
jmp 0x1404d8b49
mov byte [rbx], al
jmp 0x1404d8b53
inc rbx
cmove eax, edx
and al, r9b
lea rax, [rsp + 0x143f]
cmc
test dx, r12w
cmp rbx, rax
jmp 0x1404d8b71
jb 0x1404d8b0f
and qword [rsp + 0x20], 0
xor r9d, r14d
lea rax, [rsp + 0x40]
adc rcx, rbp
sub ebx, eax
mov r9d, ebp
lea r9, [rsp + 0x30]
movzx r8d, r12w
mov r8d, ebx
movsx edx, sp
movzx cx, sil
lea rdx, [rsp + 0x40]
not cl
mov rcx, r14
jmp 0x1404d8bb0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d8bbd
je 0x1404d8bf0
mov eax, dword [rsp + 0x30]
jmp 0x1404d8bcd
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404d8bd7
jb 0x1404d8bf8
cmp rsi, rbp
jmp 0x1404d8be5
jb 0x1404d8b04
jmp 0x1404d8bf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
movzx cx, r10b
mov rcx, qword [rsp + 0x1440]
clc
stc
xor rcx, rsp
call fcn.14049c411
lea r11, [rsp + 0x1450]
jmp 0x1404d8c1f
mov rbx, qword [r11 + 0x20]
movsx bp, r12b
not si
mov rbp, qword [r11 + 0x30]
movsx r14d, r8w
jmp 0x1404d8c3b
mov rsp, r11
movsx si, r12b
pop r14
pop rdi
bswap si
mov si, 0x543a
pop rsi
ret