joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404bb0fb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bts cx, r11w
rol ecx, cl
sal ch, 0x69
mov qword [rsp + 0x20], r9
and ch, 0x82
push rsi
push rdi
push r14
xor cx, sp
cmp dx, di
rcr rsi, cl
sub rsp, 0x60
cmovae esi, ebx
xchg dil, sil
bswap ecx
mov rsi, r9
bswap ecx
movzx di, bl
mov rdi, r8
mov ecx, dword [rdx]
jmp 0x1404bb13e
call fcn.1400f317c
nop
mov rbx, qword [0x1400ba160]
not ah
btc r14w, r12w
ror ah, 0xd9
movsxd rax, dword [0x1400ba158]
lea r14, [rbx + rax*8]
mov qword [rsp + 0x38], rbx
cmp ch, 0xc2
test bl, r13b
stc
cmp rbx, r14
jmp 0x1404bb174
je 0x1404bb283
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
cqo
mov rdx, qword [rdi]
test r12b, r10b
test rax, rax
jmp 0x1404bb192
je 0x1404bb1e5
mov ecx, dword [rax + 0x14]
bt ax, r13w
mov eax, ecx
shr eax, 0xd
stc
test al, 1
jmp 0x1404bb1ad
je 0x1404bb1e5
mov eax, ecx
cmc
stc
and al, 3
test bx, dx
cmp al, 2
jne 0x1404bb1d2
test cl, 0xc0
jmp 0x1404bb1cc
jne 0x1404bb1f3
bt ecx, 0xb
jmp 0x1404bb1db
jb 0x1404bb1f3
inc dword [rdx]
cmc
stc
add rbx, 8
jmp 0x1404bb1ee
jmp 0x1404bb160
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
movsx r8w, cl
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
movzx r9w, r11b
mov qword [rsp + 0x40], r8
movsx r9, r11w
mov r8w, r14w
jmp 0x1404bb21f
mov qword [rsp + 0x48], rax
cmovs ax, si
mov qword [rsp + 0x50], rcx
movsxd r9, esp
movsx r9d, r10w
mov qword [rsp + 0x58], rdx
not dx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
not r8
movzx r9, cx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x28]
movzx rcx, r12w
movsx r8, r14w
movsxd r8, edx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x88]
jmp 0x1404bb279
call fcn.1404baf79
jmp 0x1404bb1e5
mov ecx, dword [rsi]
jmp 0x1404bb28a
call fcn.140291a98
mov rbx, qword [rsp + 0x80]
adc r14b, r15b
setl dil
add rsp, 0x60
pop r14
cmovno di, ax
movzx rsi, di
movsx rsi, cx
pop rdi
pop rsi
ret
Function at 0x1404cdf5f
Capabilities:
Get thread local storage value

Disassembly:
push rbx
mov r9b, 0xb9
bsf bx, cx
movzx rdx, bp
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1400c63d0]
not rcx
movsx rcx, r9w
mov ecx, 5
cwd
cqo
cmovbe edx, r9d
lea r8, [0x1400c63c8]
movsx dx, r14b
movsx rdx, r8w
mov dl, bh
lea rdx, [0x1400cf758]
jmp 0x1404cdfab
call fcn.1404cee94
mov ecx, ebx
cmp r14w, r8w
stc
test rax, rax
jmp 0x1404cdfbf
je 0x1404cdfdd
add rsp, 0x20
movsx rbx, sp
movzx ebx, di
pop rbx
jmp 0x1404cdfd6
push qword [0x1400b8d90]
ret
add rsp, 0x20
bswap bx
pop rbx
jmp 0x1404cdfea
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404cdff1
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
dec r8b
rol bl, 0x80
push rdi
sub rsp, 0x20
movzx edi, r14w
mov r9b, bpl
mov rbx, rdx
cqo
movzx di, dil
lea r9, [0x1400c63d8]
mov edi, ecx
movsx r8d, r9w
lea rdx, [0x1400cf748]
cmova r8d, r10d
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404ce03b
call fcn.1404cee94
mov rdx, rbx
movzx rcx, sp
movsxd rcx, r8d
mov ecx, edi
test r14b, 0x59
jmp 0x1404ce055
test rax, rax
jmp 0x1404ce05d
je 0x1404ce06e
call qword [case.0x14044bb9c.0]
jmp 0x1404ce074
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rdi, 0x5145b05
ror dil, 0x7e
bts di, bx
add rsp, 0x20
movsxd rdi, r8d
movsx edi, r8w
cmovg rdi, rcx
pop rdi
jmp 0x1404ce09d
ret

Function at 0x1404ce242
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
movzx rbx, dx
mov qword [rsp + 0x18], rsi
btr bx, 0xd3
push rdi
shr bx, 0xe6
sub rsp, 0x30
movsx rbx, si
seta bpl
movzx ebx, cx
mov ebx, r9d
movsx si, r13b
mov r9b, r12b
mov rdi, r8
mov esi, edx
cdq
lea r9, [0x1400c63e8]
movsx rbp, bp
bswap r8w
movzx r8d, sp
mov rbp, rcx
bswap rdx
movsx rdx, bp
lea r8, [0x1400c63e0]
movsx rdx, si
not dl
lea rdx, [0x1400cf190]
jmp 0x1404ce2b9
mov ecx, 0xb
call fcn.1404cee94
mov rcx, rbp
clc
test rax, rax
je 0x1404ce2e9
mov r9d, ebx
cdq
mov r8, rdi
mov edx, esi
jmp 0x1404ce2de
call qword [case.0x14044bb9c.0]
jmp 0x1404ce302
xor edx, edx
call fcn.1404ce97a
mov ecx, eax
mov r9d, ebx
mov r8, rdi
cqo
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
cmp r14b, bpl
rcl si, 0x16
mov rbp, qword [rsp + 0x48]
movsx rdi, bp
shl sil, 0x22
mov rsi, qword [rsp + 0x50]
bsf di, r10w
cmp r12b, dil
add rsp, 0x30
movsx rdi, sp
movsxd rdi, ebx
not dil
pop rdi
jmp 0x1404ce33c
ret
Function at 0x1404dab91
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
rcl bx, cl
movsxd rbx, r15d
mov qword [rsp + 0x18], rsi
bt bx, 0x3f
push rdi
sub rsp, 0x20
sub esi, esi
mov rdi, rdx
mov rbx, rcx
test ax, 0x4ef6
cmp sp, 0x60b1
test rcx, rcx
jmp 0x1404dabc4
je 0x1404dac5e
cmp word [rcx], si
je 0x1404dac5e
lea rdx, [0x1400d1d08]
jmp 0x1404dabdf
call fcn.1401e47f3
test eax, eax
jmp 0x1404dabeb
je 0x1404dac5e
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404dac00
call fcn.1401e47f3
test eax, eax
jmp 0x1404dac0c
jne 0x1404dac4c
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
movsx dx, r10b
mov dl, r10b
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dac38
je 0x1404dac88
mov eax, dword [rsp + 0x30]
jmp 0x1404dac47
jmp 0x1404dacab
mov rcx, rbx
jmp 0x1404dac54
call fcn.1404e3b98
jmp 0x1404dacab
mov ecx, dword [rdi + 8]
bswap r9
lea r8, [rsp + 0x30]
bswap r9w
cwd
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404dac94
xor eax, eax
jmp 0x1404dac8f
jmp 0x1404dacab
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x1404dac9f
jne 0x1404dacab
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
xor si, di
cmovp rsi, r10
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
not di
cmova edi, r12d
pop rdi
ret

Function at 0x1404dacc9
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
or bx, r11w
mov qword [rsp + 0x18], rsi
shld bx, r14w, 0x79
movsx bx, sil
push rdi
sbb rbx, r8
sub rsp, 0x20
setle bl
movsx esi, r11w
jmp 0x1404dacf6
mov esi, edx
movsxd rbx, ebp
not bh
mov ebx, ecx
jmp 0x1404dad04
call fcn.1404ccd41
mov ecx, ebx
sar r8, cl
lea r8, [rsp + 0x30]
and ecx, 0x3ff
bswap di
movsx edx, sp
movzx rdi, sp
mov r9d, 2
btr rdi, 0xc1
movsx rdx, dx
bts ecx, 0xa
bswap dx
mov edx, 0x20000001
mov dil, 0xaa
jmp 0x1404dad49
mov rdi, rax
jmp 0x1404dad51
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test eax, eax
jmp 0x1404dad61
je 0x1404dae26
cmp ebx, dword [rsp + 0x30]
jmp 0x1404dad70
je 0x1404dae1c
test esi, esi
je 0x1404dae1c
mov r9, qword [rdi + 0x98]
cdq
xchg rdx, rdx
bts r8, r10
mov r8d, r10d
sal rdx, 0xed
rol ecx, 0x40
movzx edx, word [r9]
btc rax, 0x5c
movsx rcx, r15w
rcr cl, 0xe1
lea rcx, [r9 + 2]
ror al, 0xe6
lea eax, [rdx - 0x41]
clc
cmp ax, 0x19
jmp 0x1404dadbb
jbe 0x1404dadd5
sub dx, 0x61
cmc
test dx, 0x5935
cmp dx, 0x19
ja 0x1404dadee
movzx edx, word [rcx]
jmp 0x1404daddd
inc r8d
add rcx, 2
jmp 0x1404dade9
jmp 0x1404dadae
or rcx, 0xffffffffffffffff
jmp 0x1404dadf7
inc rcx
cmp sil, 3
cmp word [r9 + rcx*2], r10w
jmp 0x1404dae08
jne 0x1404dadf7
cmp r8d, ecx
jmp 0x1404dae16
je 0x1404dae26
mov eax, 1
jmp 0x1404dae2b
sub eax, eax
sar di, cl
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add edi, ebp
sar dil, 0xa
add rsp, 0x20
xchg dil, dil
mov dil, dl
pop rdi
jmp 0x1404dae4b
ret
Function at 0x1404dc4cd
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmp ebx, 0x538a6bf4
cmp sp, r15w
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
cmp r13b, 0x62
mov qword [rax + 0x18], rsi
cmc
test rbx, rsi
mov qword [rax + 0x20], rdi
jmp 0x1404dc4f7
push r14
sub rsp, 0x40
jmp 0x1404dc502
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
jmp 0x1404dc516
je 0x1404dc675
mov rsi, rax
cmc
stc
cmp word [rax], r14w
je 0x1404dc566
or rax, 0xffffffffffffffff
jmp 0x1404dc534
inc rax
cmp ah, 0x6b
cmp word [rsi + rax*2], r14w
jmp 0x1404dc544
jne 0x1404dc534
lea rsi, [rsi + rax*2]
cmc
add rsi, 2
test r11b, 0x21
cmp word [rsi], r14w
jmp 0x1404dc560
jne 0x1404dc52b
mov qword [rsp + 0x38], r14
setl r9b
rol r8d, cl
bsr r9, r8
sub rsi, rbx
rcl r9, 0x15
xadd r8d, r8d
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
ror r8d, cl
inc r8b
or r8b, spl
mov r8, rbx
mov r9d, esi
clc
mov dword [rsp + 0x28], r14d
clc
xor edx, edx
mov qword [rsp + 0x20], r14
stc
cmp bl, bpl
test rcx, 0x758e362b
sub ecx, ecx
jmp 0x1404dc5bc
call fcn.1404ccb19
movsxd rbp, eax
cmp bpl, 0x70
test eax, eax
jmp 0x1404dc5cf
je 0x1404dc675
mov rcx, rbp
call fcn.1404cca61
mov rdi, rax
test ax, 0x6557
stc
test rax, rax
jmp 0x1404dc5ed
je 0x1404dc65b
mov qword [rsp + 0x38], r14
ror r8b, cl
movzx r9w, sil
mov r9d, esi
add r8w, r9w
dec r8w
mov qword [rsp + 0x30], r14
movzx r8, r12w
bt r8w, r11w
or r8d, 0x253a207f
mov r8, rbx
cmp bh, 0xcf
mov dword [rsp + 0x28], ebp
cmp r9, rdi
test bl, 0xb1
sub edx, edx
test bp, 0x3e71
xor ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404dc643
call fcn.1404ccb19
test eax, eax
je 0x1404dc65b
mov rsi, rdi
mov rdi, r14
jmp 0x1404dc668
mov rsi, r14
movzx ecx, ax
movzx rcx, r8w
xchg cx, cx
mov rcx, rdi
call fcn.1404cc9fa
jmp 0x1404dc680
mov rsi, r14
cmc
stc
cmp r8w, 0x2a3a
test rbx, rbx
je 0x1404dc697
mov rcx, rbx
jmp 0x1404dc691
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
bt ax, 0xb2
ror r14b, cl
mov rax, rsi
shr r14w, 0xb8
add r14w, 0x527e
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov dil, 0x5f
mov rdi, qword [rsp + 0x68]
shr r14d, cl
add rsp, 0x40
mov r14b, 0x8f
movsx r14w, dil
mov r14b, bpl
pop r14
jmp 0x1404dc6dd
ret
Function at 0x1404dc6de
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
cmp r14b, 0x2c
cmp cx, cx
mov qword [rsp + 0x18], rsi
cmp r12b, 0xc5
cmc
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
bsf rbx, rcx
shld ebx, r13d, 0x6b
movzx bx, al
mov rbx, rax
stc
test rax, rax
jmp 0x1404dc71f
je 0x1404dc7ed
mov rbp, rax
cmp word [rax], si
jmp 0x1404dc730
je 0x1404dc776
or rax, 0xffffffffffffffff
jmp 0x1404dc73f
inc rax
cmp di, 0x7232
cmc
cmp word [rbp + rax*2], si
jmp 0x1404dc752
jne 0x1404dc73f
lea rbp, [rbp + rax*2]
test r8, rdi
add rbp, 2
test r14b, r14b
cmp word [rbp], si
jmp 0x1404dc770
jne 0x1404dc736
sub rbp, rbx
add rbp, 2
ror cx, cl
ror ecx, 0x20
sar rbp, 1
xchg cl, cl
dec rcx
mov cl, r15b
add rbp, rbp
movsx rcx, cx
bswap ecx
xchg rcx, rcx
mov rcx, rbp
jmp 0x1404dc7a2
call fcn.1404cca61
mov rdi, rax
cmp rsp, 0x213f0c5b
test rax, rax
jmp 0x1404dc7b9
je 0x1404dc7dd
mov r8, rbp
mov rdx, rbx
not cx
mov rcx, rax
jmp 0x1404dc7d0
call fcn.1404a6cac
mov rsi, rdi
cmc
cmp r13w, di
xor ecx, ecx
call fcn.1404cc9fa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
bt di, r8w
mov rsi, qword [rsp + 0x40]
xor dil, r13b
or bp, 0x7e8c
mov rbp, qword [rsp + 0x38]
shl dil, 0xf7
btr di, 0x47
rol dil, 0x1c
add rsp, 0x20
movzx rdi, r15w
setl dil
pop rdi
ret
Function at 0x1404df6ab
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
nop
push rdi
push r14
mov eax, 0x1450
call fcn.14044bc13
sub rsp, rax
cmovno rdi, rdi
mov rax, qword [0x1400b7288]
add r14, 0x3bad138b
rcr bp, cl
shr r10d, 0xbf
xor rax, rsp
stc
neg r10w
mov qword [rsp + 0x1440], rax
shr dil, 0xa9
stc
bt r14w, 0x2a
movsxd r10, edx
sal ah, cl
not al
mov rdi, rcx
cbw
movsxd r14, ecx
mov rax, r10
shr r14b, cl
adc cx, r12w
mov ebp, r9d
rcr r14, cl
jmp 0x1404df720
sar rax, 6
xor r14b, sil
lea rcx, [0x1400ba940]
bt r14d, 0x81
movzx rsi, r11w
adc si, sp
and r10d, 0x3f
neg edx
rol dx, 0x47
add rbp, r8
mov rsi, r8
rol r14b, cl
movsxd r14, r9d
test r8, rdi
mov rax, qword [rcx + rax*8]
add dx, r15w
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x1404df769
xor eax, eax
test r11b, 0xc9
mov qword [rdi], rax
cmc
cmp cx, 0x301f
stc
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404df784
jae 0x1404df862
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404df797
jae 0x1404df7eb
mov al, byte [rsi]
inc rsi
test ebp, r15d
clc
cmp al, 0xa
jmp 0x1404df7ad
jne 0x1404df7c6
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404df7be
inc rbx
jmp 0x1404df7c6
mov byte [rbx], al
inc rbx
xadd rax, rax
mov ax, 0x3f18
lea rax, [rsp + 0x143f]
stc
cmc
cmp rbx, rax
jmp 0x1404df7e5
jb 0x1404df78f
and qword [rsp + 0x20], 0
jmp 0x1404df7f6
lea rax, [rsp + 0x40]
btr cx, bx
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404df816
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404df823
je 0x1404df854
mov eax, dword [rsp + 0x30]
test r8b, r15b
stc
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404df83b
jb 0x1404df862
cmp rsi, rbp
jmp 0x1404df849
jb 0x1404df78a
jmp 0x1404df862
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
inc rcx
rol cl, 0xc2
mov rax, rdi
bsr ecx, eax
add cx, 0x324e
mov rcx, qword [rsp + 0x1440]
jmp 0x1404df87e
xor rcx, rsp
jmp 0x1404df886
call fcn.1404a30f1
lea r11, [rsp + 0x1450]
movzx r14d, ax
mov ebp, r10d
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movzx r14, di
cmovge rsi, r9
movsx r14d, r8w
mov rsp, r11
pop r14
mov di, 0x428f
movsx esi, r13w
movsx rsi, bx
pop rdi
movsxd rsi, r15d
movsx esi, r9w
movsx si, r12b
pop rsi
jmp 0x1404df8d2
ret
Function at 0x1404df8d3
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov eax, edx
push rsi
jmp 0x1404df905
push rdi
push r14
movzx eax, r12w
cmovno ax, bx
mov eax, 0x1450
jmp 0x1404df91a
call fcn.14044bc13
sub rsp, rax
jmp 0x1404df92b
mov rax, qword [0x1400b7288]
bsf esi, ecx
rcl bpl, 0x7e
movsx r10, di
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
ror sil, cl
sar cl, cl
sar rax, 6
bsr r14d, eax
sal ch, cl
lea rcx, [0x1400ba940]
test r14, 0x1fed39a2
rcl dl, 0x8b
and r10d, 0x3f
add rbp, r8
shld edx, edi, 0xe7
adc r14b, r14b
movzx r14, si
mov rsi, r8
setno dl
clc
mov rax, qword [rcx + rax*8]
btr r14d, r8d
lea rdx, [r10 + r10*8]
xchg r14b, r14b
setge r14b
mov r14, qword [rax + rdx*8 + 0x28]
cmc
xor eax, eax
stc
test bx, 0x7c4
jmp 0x1404df9b3
mov qword [rdi], rax
jmp 0x1404df9be
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1404dfac3
lea rbx, [rsp + 0x40]
stc
cmp rsi, rbp
jmp 0x1404df9d8
jae 0x1404dfa46
movzx eax, word [rsi]
add rsi, 2
test r12b, cl
cmp ax, 0xa
jne 0x1404dfa1f
add dword [rdi + 8], 2
sal cl, 0x23
cmp r11, 0x469b74b8
neg rcx
mov ecx, 0xd
test r9w, 0x59ad
mov word [rbx], cx
test sp, bx
add rbx, 2
cmc
test edi, 0xf996997
mov word [rbx], ax
rcr rax, 0x79
add rbx, 2
inc al
ror rax, 0xec
lea rax, [rsp + 0x143e]
cmp rbx, rax
jmp 0x1404dfa40
jb 0x1404df9d0
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
inc cx
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
sbb r8b, r10b
add ebx, ebx
mov rcx, r14
xchg r8b, r8b
bswap r8w
mov r8d, ebx
jmp 0x1404dfa7b
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dfa88
je 0x1404dfabb
mov eax, dword [rsp + 0x30]
cmp r11, r9
add dword [rdi + 4], eax
cmp bh, 0xf9
cmp eax, ebx
jmp 0x1404dfaa2
jb 0x1404dfac3
cmp rsi, rbp
jmp 0x1404dfab0
jb 0x1404df9ca
jmp 0x1404dfac3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
test dil, 0x19
mov rcx, qword [rsp + 0x1440]
stc
test r13, rbx
xor rcx, rsp
call fcn.1404a30f1
lea r11, [rsp + 0x1450]
setbe bl
movsx r14, r13w
mov rbx, qword [r11 + 0x20]
movzx r14, r12w
bswap di
mov rbp, qword [r11 + 0x30]
movsx si, r8b
mov rsp, r11
not rdi
xchg dil, dil
movsx si, cl
pop r14
movsx esi, bx
pop rdi
movsx si, bpl
movsx rsi, bp
pop rsi
jmp 0x1404dfb23
ret
Function at 0x1404e3429
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
movsx r8d, dx
lea r9, [0x1400c8ea0]
not dh
mov ecx, 2
not r8b
mov dl, dil
lea r8, [0x1400c8e98]
cmovne dx, cx
lea rdx, [0x1400cf758]
call fcn.1404e3611
mov ecx, ebx
test rax, rax
jmp 0x1404e346a
je 0x1404e3485
add rsp, 0x20
movsx rbx, di
pop rbx
jmp 0x1404e347e
push qword [0x1400b8d90]
ret
add rsp, 0x20
pop rbx
jmp 0x1404e348f
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404e3496
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
setno r8b
movzx r9d, di
ror ebx, 0x8c
push rdi
sub rsp, 0x20
movsx r8w, dil
movzx rdi, r12w
mov rbx, rdx
movsx rdi, di
lea r9, [0x1400c8ea8]
cmovno r8w, r9w
not rdx
movsx dx, r11b
mov edi, ecx
cdq
not ecx
lea rdx, [0x1400cf748]
mov ecx, 3
mov r8w, di
movsx r8, r10w
mov r8, 0x1a1324d5
lea r8, [0x1400c8ea0]
call fcn.1404e3611
mov rdx, rbx
movzx cx, r14b
sub rcx, 0x2e903c86
bswap cx
mov ecx, edi
test r8b, r10b
jmp 0x1404e3517
test rax, rax
je 0x1404e352b
call qword [case.0x14044bb9c.0]
jmp 0x1404e3531
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
rol edi, cl
ror dil, cl
btc edi, ebx
add rsp, 0x20
pop rdi
jmp 0x1404e3548
ret
Function at 0x1404e7820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
rcl r10b, cl
xor r10b, 0xd8
ror r10, cl
sub rsp, 0x30
rcr r10, 0xf8
sub eax, eax
ror r10d, cl
rcl r10d, cl
xadd r10b, r10b
mov r10d, ecx
test bp, 0x2e8b
jmp 0x1404e7850
test rdx, rdx
jmp 0x1404e7858
jne 0x1404e7895
call fcn.1404b8b59
mov ebx, 0x16
jmp 0x1404e786d
mov dword [rax], ebx
jmp 0x1404e7874
call fcn.1404b9845
mov eax, ebx
movsx ebx, r11w
movsxd rbx, edi
add rsp, 0x30
not bl
xchg bx, bx
movsx ebx, ax
pop rbx
jmp 0x1404e7894
ret
test r8, r8
jmp 0x1404e789d
je 0x1404e785e
movzx ecx, byte [rsp + 0x60]
clc
stc
jmp 0x1404e78af
mov word [rdx], ax
lea rax, [rcx + 1]
jmp 0x1404e78bf
cmp r8, rax
jmp 0x1404e78c7
ja 0x1404e78dc
call fcn.1404b8b59
mov ebx, 0x22
jmp 0x1404e786d
lea eax, [r9 - 2]
sbb rbx, 0x2f2a36dd
shld bx, bp, 0x5f
sar bl, cl
mov ebx, 0x22
stc
clc
cmp eax, ebx
jmp 0x1404e78fc
ja 0x1404e785e
mov byte [rsp + 0x60], cl
jmp 0x1404e7910
mov ecx, r10d
rcl rbx, cl
mov ebx, r12d
add rsp, 0x30
mov bl, sil
movsx rbx, dx
bswap bx
pop rbx
jmp 0x1404e792d
jmp 0x1404e7932
mov qword [rsp + 8], rbx
or r11w, ax
btr r10, rbp
shld ebx, r9d, 0xe4
mov qword [rsp + 0x10], rbp
sub bpl, r12b
cmp r15w, 0x12f3
mov qword [rsp + 0x18], rsi
bt r10d, r12d
adc bl, r11b
push rdi
movsx r11w, al
sar rbp, 0x31
push r14
push r15
movsx rbp, sp
sal r10d, 0xa6
test dl, 0xc5
sub rsp, 0x20
movsx bp, r10b
cmovge r10w, r10w
stc
sub r15d, r15d
add r10b, 0x9b
movzx ebx, bx
mov ebp, r9d
rcr bx, cl
and bl, dil
mov rdi, r8
sal r11b, cl
sbb r10b, r13b
test rsi, 0x132f7eda
mov r11, rdx
setb bh
mov r10, rdx
bts ebx, r12d
mov ebx, r15d
stc
test r12d, 0x53750f40
cmp byte [rsp + 0x60], r15b
je 0x1404e79f3
lea eax, [r15 + 0x2d]
not si
neg ecx
mov word [rdx], ax
and ebx, edi
lea ebx, [rax - 0x2c]
sar r9w, cl
lea r10, [rdx + 2]
cdqe
bts r9w, r14w
sbb r9d, 0x3a726576
mov r8, r10
shl eax, cl
xor edx, edx
btc si, di
lahf
neg r9w
lea rsi, [r10 + 2]
and r14w, 0x7c43
mov eax, ecx
btr cx, 0x92
mov r9, r10
xor r14b, bl
sbb r14w, 0x3e8d
sal r14d, 0x1d
div ebp
mov ecx, eax
cwde
sbb al, r8b
cmp edx, 9
bswap r14w
mov eax, 0x57
bswap r14d
lea r14d, [rax - 0x27]
jmp 0x1404e7a44
cmovbe ax, r14w
jmp 0x1404e7a4e
inc rbx
cmc
add ax, dx
test sil, 0xef
mov word [r10], ax
cmp sp, r15w
test sil, dil
test ecx, ecx
jmp 0x1404e7a6b
je 0x1404e7a83
mov r10, rsi
cmc
cmp rbx, rdi
jmp 0x1404e7a7d
jb 0x1404e79f8
cmp rbx, rdi
jmp 0x1404e7a8b
jb 0x1404e7ab7
mov word [r11], r15w
jmp 0x1404e7a9a
call fcn.1404b8b59
mov ebx, 0x22
jmp 0x1404e7aa9
mov dword [rax], ebx
call fcn.1404b9845
mov eax, ebx
jmp 0x1404e7b0b
mov word [rsi], r15w
movzx eax, word [r8]
clc
add cx, r9w
bswap cx
movzx ecx, word [r9]
stc
mov word [r9], ax
cmp esi, r9d
cmp r9b, 0x46
cmc
sub r9, 2
test rdi, rcx
jmp 0x1404e7ae4
mov word [r8], cx
cmp dl, bpl
stc
add r8, 2
cmp r8, r9
jmp 0x1404e7af8
jb 0x1404e7abb
xor eax, eax
adc rdi, rbx
neg bpl
movsx r14w, r14b
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
dec r15
mov rsi, qword [rsp + 0x50]
and rdi, rsi
rol r15w, 1
add rsp, 0x20
movsxd r15, ebx
jmp 0x1404e7b34
pop r15
mov r14w, 0x1d50
movzx r14w, al
movsx rdi, r8w
pop r14
not dil
pop rdi
jmp 0x1404e7b4f
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14002ca30]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14002ca40]
mov dword [rax], 1
mov rax, qword [0x14002ca50]
mov dword [rax], 1
mov rax, qword [0x14002c9d0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14002ca20]
mov dword [0x14003600c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x14002cb00]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x14002cae0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x14002c790]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001870
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0xa
mov edx, 0x409
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
mov rsi, rax
je 0x1400018e0
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rcx, rax
je 0x1400018f0
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140001900
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp], eax
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.Resource_not_found.
xor edi, edi
call sym.puts
jmp 0x1400018d3
lea rcx, str.Failed_to_load_resource.
xor edi, edi
call sym.puts
jmp 0x1400018d3
lea rcx, str.Failed_to_lock_resource.
xor edi, edi
call sym.puts
jmp 0x1400018d3

Function at 0x1400019c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [0x140029078]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.VirtualAllocExNuma
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov dword [rsp + 0x28], 0
mov r9d, 0x3000
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r8d, 0x3e8
call rbx
test rax, rax
sete al
movzx eax, al
add rsp, 0x30
pop rbx
ret
Function at 0x140001a20
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
sub rsp, 0x98
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp dword [rsp + 0x40], 1
jbe 0x140001a60
mov dword [rsp + 0x50], 0x40
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x58]
shr rax, 0x1e
cmp eax, 1
seta al
movzx eax, al
add rsp, 0x98
ret
Function at 0x140002000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov esi, dword [rcx + rax + 0x88]
mov rdi, rdx
mov rbx, rcx
add rsi, rcx
mov edx, dword [rsi + 0x18]
mov r13d, dword [rsi + 0x1c]
mov eax, dword [rsi + 0x20]
mov r14d, dword [rsi + 0x24]
test edx, edx
je 0x140002080
mov rbp, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
lea r12, [rcx + rax]
xor r15d, r15d
jmp 0x14000205a
add r15, 1
cmp r15d, dword [rsi + 0x18]
jae 0x140002080
mov ecx, dword [r12 + r15*4]
mov rdx, rdi
add rcx, rbx
call rbp
test eax, eax
jne 0x140002050
lea rax, [rbx + r15*2]
movzx eax, word [rax + r14]
lea rax, [rbx + rax*4]
mov eax, dword [rax + r13]
add rax, rbx
jmp 0x140002082
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret