joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14046cabe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14046cade
mov qword [rax + 8], rbx
cmp eax, r9d
cmc
mov qword [rax + 0x10], rbp
ror bpl, 0xcd
clc
mov qword [rax + 0x18], rsi
sar sil, 0x53
inc bp
mov qword [rax + 0x20], rdi
push r14
xor dil, 0xde
bt r14w, si
sub rsp, 0x20
bsf esi, eax
jmp 0x14046cb19
mov rdi, qword [rsp + 0x50]
ror bpl, cl
mov r14, r9
adc bp, r10w
mov rsi, r8
rcr bpl, cl
bt ebp, 0xaa
mov rbp, rdx
cmp r10, rax
test rdi, rdi
jmp 0x14046cb40
je 0x14046cc18
mov rbx, qword [r8 + 8]
cmp rbp, 0x45305367
test rbx, rbx
jmp 0x14046cb59
je 0x14046cbf8
mov rax, qword [rbx + 0x40]
btc r8d, r13d
sub r8d, 0x3ff91b48
movzx r8d, word [r14]
cmp qword [rax], 0
jmp 0x14046cb7b
je 0x14046cbb8
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0
jle 0x14046cbb8
dec dword [rax]
cqo
mov rcx, qword [rbx + 0x40]
cdqe
mov rdx, qword [rcx]
seta al
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x14046cbaa
mov word [rdx], r8w
jmp 0x14046cbb3
jmp 0x14046cbe9
mov rax, qword [rbx]
movzx edx, r8w
mov cl, 1
sete cl
movsx rcx, di
mov rcx, rbx
jmp 0x14046cbd0
mov rax, qword [rax + 0x18]
jmp 0x14046cbd9
call qword [case.0x1404cbcda.0]
movzx r8d, ax
shr al, 0x68
and ah, 0x23
mov eax, 0xffff
cmp ax, r8w
jne 0x14046cc01
mov byte [rsi], 1
cmp ecx, 0x4c973b4b
add r14, 2
cmp dil, bl
clc
sub rdi, 1
jmp 0x14046cc12
jne 0x14046cb51
movups xmm0, xmmword [rsi]
sub r14b, spl
or dil, 0xc4
mov rbx, qword [rsp + 0x30]
xchg sil, r14b
sal edi, 0x79
mov rax, rbp
btc rsi, rbx
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
not bpl
mov rbp, qword [rsp + 0x38]
shr r14w, cl
add rsp, 0x20
movsx r14d, bx
movzx r14d, r8w
pop r14
jmp 0x14046cc62
ret
Function at 0x14046cc63
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
stc
cmp r13b, sil
mov qword [rax + 8], rbx
test r10w, cx
test r10b, 0x9a
cmc
mov qword [rax + 0x10], rbp
rcr bpl, cl
ror bpl, 0xbf
shr bpl, 0xd3
mov qword [rax + 0x18], rsi
adc rsi, r15
btc si, r15w
sal sil, cl
mov qword [rax + 0x20], rdi
and sil, 0xd3
ror sil, cl
sal bp, 0xc5
push r14
shl dil, cl
cmp esp, eax
sal di, 0xd3
sub rsp, 0x20
cmp r14b, r11b
movsx di, dil
mov rsi, qword [rsp + 0x50]
shld rbp, rax, 0x97
movzx r14d, r9w
btr rdi, 0xa3
clc
mov rdi, r8
ror ebp, 0x73
add bp, 0x481b
jmp 0x14046cce0
mov rbp, rdx
cmc
test bpl, al
test rsi, rsi
je 0x14046cd9d
mov rbx, qword [r8 + 8]
test rbx, rbx
je 0x14046cd8c
mov rax, qword [rbx + 0x40]
cmc
cmp ah, 0xd6
cmp qword [rax], 0
je 0x14046cd49
mov rax, qword [rbx + 0x58]
stc
cmc
cmp dword [rax], 0
jmp 0x14046cd1d
jle 0x14046cd49
dec dword [rax]
lahf
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
mov al, r12b
lea rax, [rdx + 2]
mov qword [rcx], rax
not ax
bswap eax
movzx eax, r14w
mov word [rdx], r14w
jmp 0x14046cd76
mov rax, qword [rbx]
cmovl rdx, rsp
movzx edx, r14w
movsx ecx, di
movsx cx, dil
xchg cx, cx
mov rcx, rbx
jmp 0x14046cd67
mov rax, qword [rax + 0x18]
jmp 0x14046cd70
call qword [case.0x1404cbcda.0]
mov ecx, 0xffff
stc
cmp edi, ebp
cmp cx, ax
jmp 0x14046cd86
jne 0x14046cd93
mov byte [rdi], 1
stc
cmp dh, 0xce
sub rsi, 1
jne 0x14046ccf4
movups xmm0, xmmword [rdi]
mov rbx, qword [rsp + 0x30]
movsx r14, r12w
mov rax, rbp
movzx r14d, cx
movzx r14w, r15b
shld esi, edx, 0xf2
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
xor bp, 0x288e
mov rbp, qword [rsp + 0x38]
inc r14
ror r14b, 0xac
test r10, 0x3a314793
add rsp, 0x20
mov r14w, r13w
pop r14
jmp 0x14046cdef
ret
Function at 0x14046e53d
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
test sil, r15b
test r12d, 0x13fe653f
mov qword [rsp + 0x18], rbp
and bp, 0x4b3a
cmovno bp, cx
mov qword [rsp + 0x20], rsi
rcl bpl, 0x74
ror bp, 0x13
push rdi
shrd rdi, r10, 0x69
movzx edi, r10w
cmp ch, 0xa
sub rsp, 0x90
shl rbp, 0xa3
adc bpl, r9b
rcl dil, cl
mov rbp, rdx
rol di, cl
add dil, 0xae
mov rdi, rcx
test r10b, 0xc8
test dl, al
sub esi, esi
clc
test bp, 0x1bc2
mov dword [rsp + 0xa0], esi
test bp, si
test di, 0x1c2c
test rcx, rcx
jmp 0x14046e5b7
je 0x14046e6ad
cmp qword [rcx], rsi
jmp 0x14046e5c5
jne 0x14046e6ad
lea ecx, [rsi + 0x10]
jmp 0x14046e5d3
call fcn.14044878a
mov rbx, rax
clc
mov qword [rsp + 0xa0], rax
jmp 0x14046e5e9
test rax, rax
je 0x14046e67e
mov rax, qword [rbp + 8]
cmc
cmp si, 0x617d
stc
test rax, rax
jmp 0x14046e605
je 0x14046e62b
mov rdx, qword [rax + 0x28]
test rdx, rdx
jmp 0x14046e617
jne 0x14046e63b
lea rdx, [rax + 0x30]
jmp 0x14046e626
jmp 0x14046e63b
lea rdx, [0x1400ceb16]
movzx cx, r13b
movsx rcx, ax
lea rcx, [rsp + 0x20]
jmp 0x14046e645
call fcn.14044a8a2
mov esi, 1
bts ax, r11w
movzx eax, r10w
and dword [rbx + 8], 0
mov ax, r9w
not ah
movsxd rax, r13d
lea rax, [0x1400c07b0]
jmp 0x14046e671
mov qword [rbx], rax
jmp 0x14046e679
jmp 0x14046e682
sub ebx, ebx
cmc
stc
mov qword [rdi], rbx
test sp, 0x7113
jmp 0x14046e68f
test sil, 1
jmp 0x14046e698
je 0x14046e6ad
lea rcx, [rsp + 0x20]
jmp 0x14046e6a8
call fcn.1403b2047
mov eax, 3
jmp 0x14046e6b7
lea r11, [rsp + 0x90]
cmove rdi, r9
mov bp, 0x3fa9
mov rbx, qword [r11 + 0x18]
movzx esi, di
movsx edi, cx
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp 0x14046e6e2
ret
Function at 0x14049f617
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
cmc
mov qword [rax + 0x18], rbp
sub bpl, r13b
mov qword [rax + 0x20], rsi
movzx rsi, sp
shl bpl, cl
push rdi
movzx rbp, r15w
or dil, 0x9c
btc si, r11w
push r14
shr r14, 0x72
push r15
and r14w, 0xcfd
bsf r15w, dx
bt ebp, 0xef
sub rsp, 0x20
test rdx, rdx
movsx si, r15b
movsxd rsi, r14d
lea r14, [rax + 8]
mov rbp, rcx
setg r15b
mov rdi, rcx
movzx ecx, byte [rcx]
cmovne r14, rdx
movzx r15w, cl
movsxd r15, r11d
mov r15, r9
mov esi, r8d
jmp 0x14049f68d
jmp 0x14049f69c
inc rdi
movzx ecx, r15w
movzx ecx, byte [rdi]
call fcn.1404b88f9
test eax, eax
jne 0x14049f692
mov bl, byte [rdi]
lea eax, [rbx - 0x2b]
cmp r12w, r15w
test al, 0xfd
je 0x14049f6c6
mov bl, 0x2b
jmp 0x14049f6c1
jmp 0x14049f6cf
inc rdi
bswap r9
xchg dl, r8b
mov r9, r15
cmovs cx, r9w
mov r8d, esi
jmp 0x14049f6df
mov rdx, r14
bswap cx
movzx rcx, cx
movsx cx, dl
mov rcx, rdi
jmp 0x14049f6f5
call fcn.14049f81f
mov ecx, eax
setge sil
shl sil, 0x1e
mov esi, 0x7fffffff
test rdx, 0x6de13ac
cmp rdi, qword [r14]
jne 0x14049f726
mov qword [r14], rbp
jmp 0x14049f721
jmp 0x14049f734
cmp rbp, qword [r14]
jmp 0x14049f72e
jne 0x14049f741
test ecx, ecx
jmp 0x14049f73b
jne 0x14049f776
cmp bl, 0x2b
jmp 0x14049f749
jne 0x14049f75c
cmp ecx, esi
jmp 0x14049f756
ja 0x14049f776
cmp bl, 0x2d
jmp 0x14049f764
jne 0x14049f7b9
cmp ecx, 0x80000000
jbe 0x14049f7b9
call fcn.1404b5dd6
mov dword [rax], 0x22
cmc
test r15, r15
je 0x14049f798
mov dword [r15], 1
sar rax, cl
xor al, dh
stc
mov eax, 0x80000000
jmp 0x14049f7a2
cmp bl, 0x2d
jmp 0x14049f7aa
cmove esi, eax
mov eax, esi
jmp 0x14049f7b4
jmp 0x14049f7de
neg eax
cmp bl, 0x2d
movsxd r15, esi
mov dil, 0xfe
cmove ecx, eax
bts di, r11w
bts bx, r13w
mov eax, ecx
bts ebx, r13d
rcl r14w, cl
ror ebp, 0xf2
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
bswap esi
mov rsi, qword [rsp + 0x58]
add r14w, 0x391f
btr di, 0x42
add rsp, 0x20
cmovae r15, rax
movsx r15w, r12b
movzx r14, r15w
pop r15
cmovg di, r8w
movsx rdi, r11w
pop r14
pop rdi
jmp 0x14049f81e
ret

Function at 0x1404a0e22
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
call fcn.1404ab1cd
mov r9d, 2
movsx ecx, r10w
setp cl
lea r8, [rsp + 0x30]
movsx edx, r14w
movsx dx, r10b
movsxd rdx, r11d
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x1404a0e5b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp rdx, 0x7fa65cb0
sub ecx, 0x30
jmp 0x1404a0e75
je 0x1404a0ec1
sub ecx, 1
jmp 0x1404a0e83
je 0x1404a0eb2
cmp ecx, 1
jmp 0x1404a0e91
je 0x1404a0ea3
sub eax, eax
jmp 0x1404a0e9e
jmp 0x1404a0ec7
mov eax, 3
jmp 0x1404a0ead
jmp 0x1404a0ec7
mov eax, 1
jmp 0x1404a0ebc
jmp 0x1404a0ec7
mov eax, 2
stc
add rsp, 0x28
jmp 0x1404a0ed0
ret
Function at 0x1404a1cce
Capabilities:
Terminate process

Disassembly:
push rbx
cmp r12w, si
btc ebx, 0xfe
sub rsp, 0x20
mov rbx, 0x910691d
mov rbx, rcx
clc
cmc
sub ecx, ecx
jmp 0x1404a1cef
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a1cfd
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movzx rdx, r9w
sal dx, 0x26
mov edx, 0xc0000409
movzx ebx, r15w
bts bx, bx
add rsp, 0x20
mov rbx, 0x271c3bf8
movsxd rbx, ecx
xchg bh, bh
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b0932
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
clc
btr bx, 0xa3
mov rax, qword [rcx + 0x460]
rol bx, cl
mov r10, rcx
movzx bx, bl
add rcx, 0x58
mov ebx, r8d
xchg r11d, r11d
sbb r11d, r12d
mov r11d, edx
jmp 0x1404b0963
test rax, rax
jmp 0x1404b096b
jne 0x1404b0980
mov eax, 0x100
jmp 0x1404b097b
jmp 0x1404b0991
mov rcx, rax
sbb ax, bx
mov rax, qword [r10 + 0x458]
shr rax, 2
lea rax, [rax - 1]
movsx r8, si
bts r8, r9
add r8b, sil
lea r8, [rcx + rax*2]
cmp rdi, r9
movzx rcx, di
mov qword [r10 + 0x48], r8
bsr ax, r11w
movsx ax, r9b
mov rax, r8
sar ch, 0x8f
mov ecx, dword [r10 + 0x38]
cmp dx, 0x2bd6
test cl, r14b
test r10b, 0x60
test ecx, ecx
jg 0x1404b09e5
test r11d, r11d
jmp 0x1404b09df
je 0x1404b0a8f
sub edx, edx
movzx eax, dx
dec ax
btr eax, 0x60
lea eax, [rcx - 1]
cmc
cmp sil, r11b
stc
mov dword [r10 + 0x38], eax
mov eax, r11d
neg r11w
test dh, 0xfd
div ebx
rcl r11w, 0xe9
dec r11b
add dx, 0x30
test r14, rsi
mov r11d, eax
cmp dx, 0x39
jmp 0x1404b0a24
jbe 0x1404b0a55
mov al, r9b
xor al, 1
ror cx, cl
shl al, 5
shl rcx, 0x4a
movzx rcx, ax
add al, 7
btc cx, ax
bswap rcx
add al, dl
ror ecx, cl
sub cx, si
movsx edx, al
jmp 0x1404b0a55
mov rax, qword [r10 + 0x48]
bt cx, cx
movsx ecx, dl
test cx, ax
clc
test ax, 0x39be
mov word [rax], cx
btr ax, si
jmp 0x1404b0a78
add qword [r10 + 0x48], 0xfffffffffffffffe
movsx rax, bp
mov rax, qword [r10 + 0x48]
jmp 0x1404b0a8a
jmp 0x1404b09bf
mov rbx, qword [rsp + 8]
cmp rcx, rdi
cmc
sub r8, rax
cmc
sar r8, 1
cmp r14b, al
jmp 0x1404b0aa7
mov dword [r10 + 0x50], r8d
add qword [r10 + 0x48], 2
jmp 0x1404b0ab5
ret
Function at 0x1404b1601
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
test spl, r12b
mov qword [rsp + 0x10], rsi
push rdi
sbb esi, r13d
rcr si, cl
sub rsp, 0x30
not sil
mov edi, edx
rol sil, cl
mov rsi, rcx
jmp 0x1404b162f
test r8, r8
jmp 0x1404b1637
jne 0x1404b1659
call fcn.1404b5dd6
mov dword [rax], 0x16
jmp 0x1404b164d
call fcn.1404b6a2e
xor eax, eax
jmp 0x1404b1758
mov rdx, r9
xchg cl, cl
mov rcx, r8
jmp 0x1404b1666
call fcn.1404b17b2
mov rbx, rax
clc
jmp 0x1404b1674
test rax, rax
je 0x1404b16fa
lea rax, [rsp + 0x50]
mov rdx, rdi
movzx r8, ax
movzx r9w, r13b
cmovnp cx, r10w
mov qword [rsp + 0x28], rax
movsxd rax, r14d
cmova rcx, r8
movsx cx, r8b
lea r8, [0x140094b24]
mov cl, 0x52
mov eax, dword [rsp + 0x60]
movzx r9, cx
movsx r9d, di
cmovnp r9d, esp
mov r9, rbx
setl cl
not ecx
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404b16d1
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
jmp 0x1404b16df
test rax, rax
jne 0x1404b177d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b16f5
call fcn.1404b5e4b
sub edi, edi
test rbx, rbx
jmp 0x1404b1704
je 0x1404b174e
mov rcx, qword [rbx + 0x10]
jmp 0x1404b1714
test rcx, rcx
je 0x1404b1723
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
clc
test di, 0x1a9c
test rcx, rcx
jmp 0x1404b1735
je 0x1404b1741
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b1749
call fcn.1404c9a89
mov rax, rdi
bts rdi, rsi
inc dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
bts rdi, rbp
add rsp, 0x30
movsx rdi, r15w
mov di, 0x50a7
movzx rdi, r11w
pop rdi
jmp 0x1404b177c
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jmp 0x1404b178a
je 0x1404b1797
mov eax, dword [rsp + 0x50]
cmc
mov dword [rcx], eax
sub ebx, ebx
jmp 0x1404b179e
jmp 0x1404b16fc

Function at 0x1404b1a37
Capabilities:
Terminate process

Disassembly:
push rbx
movsx ebx, bp
bts bx, r12w
shl bx, 0xca
sub rsp, 0x20
mov bl, r12b
mov ebx, ecx
jmp 0x1404b1a53
call fcn.1404d2fa1
cmp eax, 1
je 0x1404b1aaf
mov rax, qword gs:[0x60]
and dx, 0x4d09
rcl dh, 0x87
mov edx, dword [rax + 0xbc]
shr edx, 8
test r12w, dx
cmp esi, r10d
test dl, 1
jmp 0x1404b1a8a
jne 0x1404b1aaf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dx, r14w
movzx dx, r10b
mov edx, ebx
jmp 0x1404b1aa9
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b1ab6
call fcn.1404b199c
mov ecx, ebx
jmp 0x1404b1ac2
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b6ac6
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 0x17
jmp 0x1404b6ad4
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b6ae1
je 0x1404b6af8
mov ecx, 5
jmp 0x1404b6af1
int 0x29
jmp 0x1404b6af8
mov r8d, 1
cwd
mov edx, 0xc0000417
movsx cx, spl
lea ecx, [r8 + 1]
jmp 0x1404b6b13
call fcn.1404b6b36
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp 0x1404b6b2f
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b7b4d
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
cmp r15w, 0x3033
mov qword [rsp + 0x10], rbp
cmp r13d, r14d
cmp dil, 0x90
mov qword [rsp + 0x18], rsi
test sil, r11b
cmp r9b, 0xcc
push rdi
mov di, r9w
adc dil, 0x28
sub rsp, 0x30
inc di
sub rdi, rbx
xor ebp, ebp
shr dil, cl
mov rdi, rcx
test rcx, rcx
jmp 0x1404b7b93
je 0x1404b7c1b
or rbx, 0xffffffffffffffff
inc rbx
jmp 0x1404b7bac
cmp word [rcx + rbx*2], bp
jmp 0x1404b7bb5
jne 0x1404b7b9d
inc rbx
setbe cl
not ch
xchg ch, ch
lea rcx, [rbx + rbx]
jmp 0x1404b7bce
call fcn.1402692a0
mov rsi, rax
stc
cmp r12d, ecx
test rax, rax
jmp 0x1404b7be2
je 0x1404b7c1b
mov r8, rdi
mov rdx, rbx
movzx cx, r14b
bswap cx
cmovbe ecx, ecx
mov rcx, rax
jmp 0x1404b7c01
call fcn.1404ca768
test eax, eax
jne 0x1404b7c5a
mov rax, rsi
jmp 0x1404b7c16
jmp 0x1404b7c23
xor eax, eax
mov bp, sp
sal bl, 0x8a
mov rbx, qword [rsp + 0x40]
rcr bp, cl
ror bpl, cl
stc
mov rbp, qword [rsp + 0x48]
bt rdi, 0x41
mov rsi, qword [rsp + 0x50]
sub dil, r13b
shrd di, r12w, 0xf
add rsp, 0x30
movzx di, r14b
not di
movsx di, r11b
pop rdi
ret
sub r9d, r9d
cmc
mov qword [rsp + 0x20], rbp
sub r8d, r8d
test dil, 0x3d
xor edx, edx
cmp spl, r12b
clc
sub ecx, ecx
jmp 0x1404b7c77
call fcn.1404b6ac6
int3
Function at 0x1404cb0d1
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
not r9
movsx rbx, ax
mov rbx, rdx
not r9
cqo
movzx r8, si
lea r9, [0x1400c63d8]
mov edi, ecx
movsx r8d, r14w
lea rdx, [0x1400cf748]
bswap rcx
movsxd r8, esp
jmp 0x1404cb10d
mov ecx, 6
xchg r8b, r8b
jmp 0x1404cb11e
lea r8, [0x1400c63d0]
call fcn.1404cc009
mov rdx, rbx
bswap rcx
mov ecx, edi
test r13b, 0x43
jmp 0x1404cb141
test rax, rax
jmp 0x1404cb149
je 0x1404cb15a
call qword [case.0x1404cbcda.0]
jmp 0x1404cb160
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov edi, r9d
rol di, cl
rol di, 0x3f
add rsp, 0x20
mov di, 0x4781
pop rdi
jmp 0x1404cb17d
ret

Function at 0x1404cb2fb
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg bpl, bpl
sal bx, 0x76
or bp, 0x1ea1
mov qword [rsp + 0x18], rsi
bt rsi, 0x93
movzx bx, r10b
xor bpl, 0x8d
push rdi
sub rsp, 0x30
movsx edi, cx
mov ebx, r9d
movzx r9w, spl
xchg dil, sil
movsx r9d, ax
mov rdi, r8
movsx r9, r11w
movzx r8, r13w
mov esi, edx
lea r9, [0x1400c63e8]
movzx r8d, di
mov rbp, rcx
movsx cx, r11b
mov dh, 0xe1
cqo
lea r8, [0x1400c63e0]
movsxd rdx, r10d
cwd
lea rdx, [0x1400cf190]
not cx
mov ecx, 0xb
jmp 0x1404cb380
call fcn.1404cc009
mov rcx, rbp
test rax, rax
je 0x1404cb3bd
mov r9d, ebx
movzx dx, r10b
movsx r8w, spl
mov r8, rdi
mov rdx, 0x527c637e
cmovs edx, ebx
mov edx, esi
jmp 0x1404cb3b2
call qword [case.0x1404cbcda.0]
jmp 0x1404cb3ef
xor edx, edx
jmp 0x1404cb3c4
call fcn.1404cbad4
mov ecx, eax
jmp 0x1404cb3d0
mov r9d, ebx
movsx dx, bpl
cmovae dx, bp
mov r8b, r14b
mov r8, rdi
mov edx, esi
jmp 0x1404cb3e9
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
setp dil
bt di, si
mov rbp, qword [rsp + 0x48]
mov sil, 0xda
bt rdi, r15
xadd edi, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp 0x1404cb41a
ret
Function at 0x1404d7b0e
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
movzx ebx, bp
shld bx, bx, 2
test cl, 0x4f
mov qword [rsp + 0x18], rsi
cmovae rbx, rbx
xchg bh, bh
xor bx, 0x6dc0
push rdi
sal dil, cl
rol rbx, cl
sub rsp, 0x20
sub esi, esi
sub di, 0x341a
not dil
xor rbx, 0x7250bf6
mov rdi, rdx
sub ebx, 0x9951e43
rol bx, 0xd8
or bl, spl
mov rbx, rcx
test rcx, rcx
jmp 0x1404d7b65
je 0x1404d7c0b
cmp word [rcx], si
jmp 0x1404d7b73
je 0x1404d7c0b
lea rdx, [0x1400d1d08]
jmp 0x1404d7b85
call fcn.14028245c
test eax, eax
jmp 0x1404d7b91
je 0x1404d7c0b
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404d7ba6
call fcn.14028245c
test eax, eax
jne 0x1404d7bf9
mov ecx, dword [rdi + 8]
movsxd r9, ecx
cmovno r9d, r10d
lea r9d, [rsi + 2]
cwd
xchg dh, dh
movsx dx, bl
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
jmp 0x1404d7bd8
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d7be5
je 0x1404d7c4d
mov eax, dword [rsp + 0x30]
jmp 0x1404d7bf4
jmp 0x1404d7c71
mov rcx, rbx
jmp 0x1404d7c01
call fcn.1404e0af0
jmp 0x1404d7c71
mov ecx, dword [rdi + 8]
movsx r8d, cx
movzx rdx, r8w
xchg r9, rdx
lea r8, [rsp + 0x30]
cwd
jmp 0x1404d7c25
mov r9d, 2
movzx edx, r13w
mov dl, r14b
xchg dx, dx
mov edx, 0x20001004
jmp 0x1404d7c3f
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d7c59
sub eax, eax
jmp 0x1404d7c54
jmp 0x1404d7c71
mov eax, dword [rsp + 0x30]
stc
test bx, 0x5092
test eax, eax
jne 0x1404d7c71
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
shr edi, cl
bsr di, cx
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movsxd rdi, edx
pop rdi
jmp 0x1404d7c8e
ret

Function at 0x1404d7c8f
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
dec bl
btc bx, r12w
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmovae si, r15w
movsx esi, di
xchg bh, bh
mov esi, edx
mov ebx, ecx
jmp 0x1404d7cb8
call fcn.1404c9dd7
mov ecx, ebx
btc dx, 0x73
bt r8, rdi
shr r9, cl
lea r8, [rsp + 0x30]
xchg edx, edi
and ecx, 0x3ff
cmc
btc rdx, rax
mov r9d, 2
bts ecx, 0xa
jmp 0x1404d7cf3
mov edx, 0x20000001
mov rdi, rax
jmp 0x1404d7d00
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
clc
cmp r11b, r8b
test eax, eax
jmp 0x1404d7d14
je 0x1404d7dc5
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d7d23
je 0x1404d7dbb
test esi, esi
je 0x1404d7dbb
mov r9, qword [rdi + 0x98]
rcl dh, 0xae
xchg cx, ax
mov dh, dl
mov r8d, r10d
movzx edx, word [r9]
bt ecx, edi
or ax, 0x4c64
rol eax, 0xaa
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jmp 0x1404d7d60
jbe 0x1404d7d82
sub dx, 0x61
test r13b, 0x13
jmp 0x1404d7d73
cmp dx, 0x19
jmp 0x1404d7d7c
ja 0x1404d7d91
movzx edx, word [rcx]
inc r8d
add rcx, 2
jmp 0x1404d7d54
or rcx, 0xffffffffffffffff
jmp 0x1404d7d9a
inc rcx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d7da7
jne 0x1404d7d9a
cmp r8d, ecx
jmp 0x1404d7db5
je 0x1404d7dc5
mov eax, 1
jmp 0x1404d7dd5
xor eax, eax
shl bx, 0xf7
sub rsi, 0x14f14fe6
dec bx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xadd dil, dil
add rsp, 0x20
jmp 0x1404d7dec
pop rdi
ret
Function at 0x1404d9482
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
cmp r9b, spl
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
clc
stc
mov qword [rax + 0x20], rdi
push r14
jmp 0x1404d94a2
sub rsp, 0x40
jmp 0x1404d94ab
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
sal rbx, cl
mov rbx, rax
test dx, 0x7c4b
cmp ebx, 0x5fbe3d81
test rax, rax
jmp 0x1404d94cd
je 0x1404d962b
mov rsi, rax
test r8b, 0x87
clc
cmp word [rax], r14w
jmp 0x1404d94e4
je 0x1404d9520
or rax, 0xffffffffffffffff
jmp 0x1404d94f3
inc rax
cmp word [rsi + rax*2], r14w
jmp 0x1404d9500
jne 0x1404d94f3
lea rsi, [rsi + rax*2]
cmc
test bl, 0xe5
add rsi, 2
cmp cl, r12b
clc
cmp word [rsi], r14w
jne 0x1404d94ea
mov qword [rsp + 0x38], r14
movsx r8d, dx
dec r8w
sub rsi, rbx
sar r9w, cl
shld r9w, ax, 0xf0
mov qword [rsp + 0x30], r14
rcr r9, 0x3f
mov r8b, 0xaf
clc
add rsi, 2
sar rsi, 1
bsr r9w, ax
mov r8, rbx
mov r9d, esi
cmc
mov dword [rsp + 0x28], r14d
cmc
sub edx, edx
test r8d, 0x103d26b8
clc
mov qword [rsp + 0x20], r14
xor ecx, ecx
jmp 0x1404d9576
call fcn.1404c9bd0
movsxd rbp, eax
test dh, 0x29
cmc
test eax, eax
je 0x1404d962b
mov rcx, rbp
jmp 0x1404d9592
call fcn.1404c9b10
mov rdi, rax
stc
test rax, rax
jmp 0x1404d95a3
je 0x1404d9616
mov qword [rsp + 0x38], r14
not r9b
bswap r9w
sbb r8b, 0xc2
mov r9d, esi
shld r8d, ebp, 0xd9
mov qword [rsp + 0x30], r14
xchg r8b, r8b
rcr r8w, 0x75
mov r8, rbx
mov dword [rsp + 0x28], ebp
test r14b, 0xe8
xor edx, edx
stc
cmp r9d, r14d
xor ecx, ecx
jmp 0x1404d95e6
mov qword [rsp + 0x20], rax
jmp 0x1404d95f0
call fcn.1404c9bd0
test eax, eax
jmp 0x1404d95fc
je 0x1404d9616
mov rsi, rdi
mov di, r11w
mov rdi, r14
jmp 0x1404d9611
jmp 0x1404d9619
mov rsi, r14
mov rcx, rdi
jmp 0x1404d9621
call fcn.1404c9a89
jmp 0x1404d9631
mov rsi, r14
cmp bl, r8b
test rbx, rbx
jmp 0x1404d9639
je 0x1404d964d
mov rcx, rbx
jmp 0x1404d9647
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
test r10d, r15d
ror r14w, cl
clc
mov rax, rsi
rcl r14b, cl
movsx ebp, bx
xchg r14b, sil
mov rsi, qword [rsp + 0x60]
shrd rbp, rax, 9
mov rbp, qword [rsp + 0x58]
movsx r14, sp
movzx r14w, bpl
rcl r14w, cl
mov rdi, qword [rsp + 0x68]
rcr r14b, cl
clc
sub r14, r11
add rsp, 0x40
xchg r14w, r14w
movsx r14, r9w
pop r14
jmp 0x1404d96a1
ret
Function at 0x1404d96a2
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
stc
clc
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
rcl bx, cl
add bl, 0x40
adc bx, r10w
mov rbx, rax
test rax, rax
jmp 0x1404d96d5
je 0x1404d97ab
mov rbp, rax
cmp word [rax], si
je 0x1404d9722
or rax, 0xffffffffffffffff
jmp 0x1404d96f0
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404d96fd
jne 0x1404d96f0
lea rbp, [rbp + rax*2]
jmp 0x1404d970d
add rbp, 2
cmp bh, bl
cmp word [rbp], si
jmp 0x1404d971c
jne 0x1404d96e7
sub rbp, rbx
add cx, r12w
and cx, 0x7583
add rbp, 2
movsx rcx, r15w
sal cl, cl
btc rcx, r14
sar rbp, 1
add rbp, rbp
mov rcx, rbp
jmp 0x1404d974a
call fcn.1404c9b10
mov rdi, rax
jmp 0x1404d975a
test rax, rax
jmp 0x1404d9762
je 0x1404d9791
mov r8, rbp
mov rdx, rbx
setle cl
movsx rcx, r10w
movzx ecx, ax
mov rcx, rax
jmp 0x1404d9780
call fcn.1404a40ed
mov rsi, rdi
cmp r12b, 0x14
jmp 0x1404d9791
xor ecx, ecx
jmp 0x1404d9798
call fcn.1404c9a89
mov rcx, rbx
jmp 0x1404d97a5
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
neg ah
cbw
mov rax, rsi
mov rsi, qword [rsp + 0x40]
test r12w, r8w
rol dil, cl
mov rbp, qword [rsp + 0x38]
sub dil, 0x92
add rsp, 0x20
movzx edi, sp
mov edi, 0x6fc3702d
movsxd rdi, esi
pop rdi
jmp 0x1404d97e1
ret