joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14049ddd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
clc
test r10b, 0x51
mov qword [rsp + 0x18], rbp
test r8d, 0x35a95bb9
shr bpl, cl
dec rbp
push rsi
or bpl, r8b
sar esi, cl
dec bp
push rdi
push r12
jmp 0x14049ddfd
push r14
rol dil, 0x94
btc rdi, 0x34
shld si, sp, 0x86
push r15
sub edi, esp
shr r15w, 0x5c
sub rsp, 0x20
xor bpl, 0xa8
btc r15w, r14w
cmovs si, r10w
test rdx, rdx
movsx r15, r10w
lea r14, [rsp + 0x50]
mov sil, al
mov rsi, rcx
movsx r15w, r9b
movzx ebp, bp
mov rdi, rcx
setl bpl
movzx ecx, byte [rcx]
jmp 0x14049de51
cmovne r14, rdx
mov r15, r9
mov ebp, r8d
jmp 0x14049de60
jmp 0x14049de78
inc rdi
not cx
jmp 0x14049de70
movzx ecx, byte [rdi]
jmp 0x14049de78
call fcn.1404b6f1a
test eax, eax
jmp 0x14049de84
jne 0x14049de65
mov bl, byte [rdi]
bts rax, rbx
lea eax, [rbx - 0x2b]
cmc
test r12b, dl
test al, 0xfd
jmp 0x14049de9e
je 0x14049deab
mov bl, 0x2b
jmp 0x14049deb2
inc rdi
cmove r9, r8
mov r9, r15
cdq
jmp 0x14049debe
mov r8d, ebp
jmp 0x14049decb
mov rdx, r14
mov cl, 0xea
mov rcx, rdi
jmp 0x14049ded8
call fcn.14049e025
mov rcx, rax
rcr r12d, 0xc
mov bpl, 0x2d
movabs r12, 0x8000000000000000
test sil, r11b
cmp rdi, qword [r14]
jmp 0x14049defc
jne 0x14049df0f
mov qword [r14], rsi
jmp 0x14049df0a
jmp 0x14049df1d
cmp rsi, qword [r14]
jmp 0x14049df17
jne 0x14049df2b
test rcx, rcx
jmp 0x14049df25
jne 0x14049df74
cmp bl, 0x2b
jmp 0x14049df33
jne 0x14049df58
movabs rax, 0x7fffffffffffffff
cmp r10, 0x7a870da4
cmp rcx, rax
jmp 0x14049df52
ja 0x14049df74
cmp bl, bpl
jmp 0x14049df60
jne 0x14049dfb8
cmp rcx, r12
jmp 0x14049df6e
jbe 0x14049dfb8
call fcn.1404b4263
mov dword [rax], 0x22
cmp r12d, 0x69086d21
test r15, r15
je 0x14049df96
mov dword [r15], 1
sub bl, bpl
jmp 0x14049df9e
neg bl
jmp 0x14049dfa5
sbb rax, rax
test r12b, r10b
jmp 0x14049dfb0
add rax, r12
jmp 0x14049dfeb
mov rax, rcx
sar r14w, 0x64
neg rax
bt r12d, 0x9f
rcr r12, 0x28
shl r15b, cl
cmp bl, bpl
cmove r14w, bp
jmp 0x14049dfdc
cmove rcx, rax
mov rax, rcx
bts r15d, ebp
setbe sil
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
sub r14b, 0x8b
add rsp, 0x20
jmp 0x14049e005
pop r15
movsx si, r15b
movsx esi, bp
pop r14
movsxd r12, r14d
xchg dil, sil
pop r12
pop rdi
movzx rsi, di
pop rsi
jmp 0x14049e024
ret

Function at 0x14049efa7
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test r15b, 0xf5
and dword [rsp + 0x30], 0
jmp 0x14049efb9
call fcn.1404a9401
mov r9d, 2
cmova dx, r10w
not ch
lea r8, [rsp + 0x30]
setl cl
mov rcx, qword [rax + 0x28]
bswap dx
movsxd rdx, esp
lea edx, [r9 + 0x20]
jmp 0x14049efe6
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
jmp 0x14049eff9
je 0x14049f040
sub ecx, 1
jmp 0x14049f007
je 0x14049f036
cmp ecx, 1
jmp 0x14049f015
je 0x14049f027
sub eax, eax
jmp 0x14049f022
jmp 0x14049f04b
mov eax, 3
jmp 0x14049f031
jmp 0x14049f04b
mov eax, 1
jmp 0x14049f04b
mov eax, 2
cmc
jmp 0x14049f04b
add rsp, 0x28
jmp 0x14049f054
ret
Function at 0x14049f055
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
bt si, 0x43
rcr esi, cl
bsr esi, eax
mov qword [rax + 0x18], rdi
shr esi, cl
not sil
bt si, dx
mov qword [rax + 0x20], r14
push r15
shl sil, 0x17
rol r14w, 0xc8
mov si, si
sub rsp, 0x30
xor r15b, 0x61
bts si, bx
mov rdi, r9
and si, sp
rol sil, 0xd5
cmc
mov rsi, rdx
shld r15d, eax, 0x90
btc r15, 0x75
or r15b, sil
sub rsi, rcx
sub r14b, 0x99
sub rdi, r8
not r14b
btr r15, r12
shr r15b, cl
mov r15, rcx
seta ch
sbb cx, 0x3a88
sar rsi, 1
movsx ecx, sp
movsx cx, r14b
mov rcx, qword [rsp + 0x60]
cmp dil, r8b
xor ebx, ebx
btc r14, 0x7c
shld r14d, edi, 0x21
inc r14d
sar rdi, 1
ror r14b, 0xc0
cmc
mov r14, r8
test ah, 0x67
test rcx, rcx
jmp 0x14049f107
jne 0x14049f120
call fcn.1404a9401
mov rcx, qword [rax + 8]
jmp 0x14049f11b
jmp 0x14049f125
mov rcx, qword [rcx + 8]
cmc
test rcx, rcx
jmp 0x14049f12d
jne 0x14049f1ce
cmp esi, edi
movsx cx, r9b
movsxd rcx, r11d
mov eax, edi
movzx cx, r9b
movzx ecx, si
cmovl eax, esi
rcr rcx, cl
movsxd rcx, eax
xor ah, 0xef
movzx ax, dl
mov eax, 1
test rcx, rcx
jmp 0x14049f164
je 0x14049f19b
sub r15, r14
movzx edx, word [r15 + r14]
test r15b, 0x1f
cmp dx, word [r14]
jne 0x14049f1bb
add r14, 2
cmp ebp, edx
cmp r9w, 0xfd8
stc
sub rcx, rax
jmp 0x14049f195
jne 0x14049f16d
cmp esi, edi
je 0x14049f1c2
or ecx, 0xffffffff
stc
cmp esi, edi
jmp 0x14049f1ae
cmovl eax, ecx
jmp 0x14049f1b6
jmp 0x14049f23c
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, eax
mov eax, ebx
jmp 0x14049f1c9
jmp 0x14049f23c
mov dword [rsp + 0x28], edi
movzx r9d, r8w
mov r9w, bp
mov r9d, esi
movzx r8w, r15b
cmova dx, bp
mov r8, r15
not dl
cwd
mov edx, 0x3f376a49
mov qword [rsp + 0x20], r14
mov rdx, rsp
cwd
setl dl
mov edx, 0x1000
jmp 0x14049f209
call fcn.1404c1f42
test eax, eax
jmp 0x14049f215
jne 0x14049f235
call fcn.1404b4263
mov dword [rax], 0x16
mov eax, 0x7fffffff
jmp 0x14049f230
jmp 0x14049f23c
sub eax, 2
sar r15b, 0x97
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
rcr di, 0x40
cmovge r15w, bp
mov rdi, qword [rsp + 0x50]
movsxd r15, ebp
and r15b, dil
mov r14, qword [rsp + 0x58]
cmp dil, 0x46
jmp 0x14049f268
add rsp, 0x30
mov r15w, r12w
movzx r15, r9w
pop r15
jmp 0x14049f27b
ret
Function at 0x1404a0418
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov r11, 0x62943953
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov bl, 0x5f
bswap r11w
mov qword [rax + 0x18], rsi
movsxd r10, esi
mov qword [rax + 0x20], rdi
push r14
mov bl, byte [rcx]
bsr bp, si
lea r10, [rcx + 1]
shl r14d, cl
mov byte [rdx], bl
mov esi, r9d
cmp rax, 0x44015e76
lea r14, [0x140000000]
cmp r12b, 0xd2
movsxd rbp, ebx
bt r11w, 0xe
mov rbp, r8
mov r11, rdx
rol di, cl
mov rdi, rcx
jmp 0x1404a047b
test bl, 4
je 0x1404a04bd
movzx ecx, byte [r10]
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
cmp rdi, r13
mov cl, byte [rcx + r14 + 0xc1a40]
test rbx, rsp
test r9d, 0x41141331
sub r10, rax
mov eax, dword [r10 - 4]
shr eax, cl
mov dword [rdx + 4], eax
jmp 0x1404a04bd
test bl, 8
je 0x1404a04d7
mov eax, dword [r10]
clc
add r10, 4
mov dword [rdx + 8], eax
test esp, 0x3c46a97
test bl, 0x10
jmp 0x1404a04df
je 0x1404a04f8
mov eax, dword [r10]
add r10, 4
movzx r8d, bx
mov dword [rdx + 0xc], eax
btc ax, r13w
movsxd rax, dword [r10]
inc r8d
lea r8, [r10 + 4]
stc
sub r9d, r9d
stc
cmp r15b, al
test ax, r9w
cmp byte [rsp + 0x30], r9b
jmp 0x1404a0518
jne 0x1404a05ce
test bl, 2
je 0x1404a05ce
lea rdx, [rax + rbp]
sub r10b, cl
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
shl r10, cl
setge r10b
mov cl, byte [rcx + r14 + 0xc1a40]
sal r10w, 0xb9
movsxd r10, ebx
sbb r10d, 0x543e7b20
sub rdx, rax
movsx r10, bx
setnp r10b
sar r10b, cl
mov r10d, dword [rdx - 4]
cmp dil, 1
jmp 0x1404a0576
shr r10d, cl
cmc
mov dword [r11 + 0x10], r9d
cmp dil, sil
test r9b, 0x40
test r10d, r10d
jmp 0x1404a058d
je 0x1404a05d6
mov eax, dword [rdx]
movsx cx, r15b
mov ecx, dword [rdx + 4]
lea rdx, [rdx + 8]
cmp al, 0xa2
cmp eax, esi
je 0x1404a05c5
inc r9d
test r8b, bpl
clc
cmp r9d, r10d
jmp 0x1404a05ba
jb 0x1404a0593
jmp 0x1404a05d6
mov dword [r11 + 0x10], ecx
jmp 0x1404a05d6
mov dword [rdx + 0x10], eax
jmp 0x1404a05d6
test bl, 1
jmp 0x1404a05de
je 0x1404a0631
movzx ecx, byte [r8]
bt rdx, 0x68
and ecx, 0xf
sal dx, cl
sal rbp, 0xa2
cwd
movsx rdx, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
sub r8, rdx
test ax, 0x1460
mov edx, dword [r8 - 4]
xor r14w, 0xd9b
movsx rsi, r13w
sub r14w, 0x6edb
shr edx, cl
xchg rbp, rbp
mov dword [r11 + 0x14], edx
bts eax, edi
mov rbx, qword [rsp + 0x10]
mov sil, 0xba
sub r8, rdi
cbw
movzx r14d, r11w
not rax
mov rbp, qword [rsp + 0x18]
movzx r14, ax
bswap edi
sets ah
mov rax, r8
movsx si, r13b
mov rdi, r10
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
movzx r14w, sil
pop r14
jmp 0x1404a0674
ret
Function at 0x1404adc6a
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
rol bl, 0x94
sar bx, 0xb6
mov qword [rsp + 0x18], rbp
add bh, cl
bswap rbx
or ebx, 0x4d877c76
mov qword [rsp + 0x20], rsi
adc rbx, rsi
push rdi
sub rsp, 0x30
dec bh
xor ebp, ebp
bt bx, sp
mov rbx, rcx
test r14d, esp
cmp byte [rcx + 0x54], bpl
jne 0x1404addd5
cmp dword [rcx + 0x50], ebp
jmp 0x1404adcb3
jle 0x1404addd5
mov rsi, qword [rcx + 0x48]
cdq
setge ah
mov edi, ebp
cqo
rdtsc
cwd
mov r9, qword [rbx + 8]
cwd
cwde
movzx eax, dx
lea rcx, [rsp + 0x40]
rdtsc
cmovs rax, rbp
mov word [rsp + 0x40], bp
movzx dx, ch
movsx rdx, di
movsx r8w, r9b
mov rdx, rsi
lahf
mov rax, qword [r9]
bswap r8d
xchg r8b, r8b
movsxd r8, dword [rax + 8]
jmp 0x1404add06
call fcn.1404cf5a1
movsxd r8, eax
cmp r15b, 0x13
cmc
stc
test eax, eax
jle 0x1404addc7
mov rcx, qword [rbx + 0x468]
movzx edx, word [rsp + 0x40]
movzx rax, dx
setno ah
mov rax, qword [rcx + 8]
clc
test di, 0x2dab
cmp qword [rcx + 0x10], rax
jmp 0x1404add42
jne 0x1404add6d
cmp byte [rcx + 0x18], bpl
jmp 0x1404add51
je 0x1404add64
inc dword [rbx + 0x28]
jmp 0x1404add5f
jmp 0x1404adda8
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404adda8
inc dword [rbx + 0x28]
cmovnp ax, si
inc qword [rcx + 0x10]
xor cx, ax
cmp r15w, 0x722f
mov rax, qword [rbx + 0x468]
rol rcx, cl
bsr rcx, rdx
mov rcx, qword [rax]
rcl eax, cl
movsx eax, sp
or ah, ch
mov word [rcx], dx
mov rax, qword [rbx + 0x468]
clc
add qword [rax], 2
add rsi, r8
inc edi
cmp r13, 0xd173b08
cmp edi, dword [rbx + 0x50]
jmp 0x1404addbc
jne 0x1404adcc9
jmp 0x1404ade11
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404addd0
jmp 0x1404ade11
mov r8d, dword [rbx + 0x50]
cmovnp rax, rcx
cbw
lea rax, [rcx + 0x10]
mov rdx, qword [rbx + 0x48]
and r9w, r13w
rcr r9w, cl
bsf r9d, ebp
lea r9, [rcx + 0x28]
cmp r10w, r8w
add rcx, 0x468
jmp 0x1404ade07
mov qword [rsp + 0x20], rax
call fcn.1404ac0fb
mov rbx, qword [rsp + 0x48]
mov al, 1
movzx si, dil
sub si, r11w
mov rbp, qword [rsp + 0x50]
rol dil, 0xdb
bsf esi, ecx
movsx rdi, si
mov rsi, qword [rsp + 0x58]
shld edi, r13d, 0x88
adc di, 0x2205
btc di, r11w
add rsp, 0x30
mov di, 0x4678
movzx rdi, bx
pop rdi
jmp 0x1404ade57
ret
Function at 0x1404af875
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmp dil, 0x64
jmp 0x1404af885
mov qword [rsp + 0x10], rsi
rcl sil, cl
movzx si, al
btr si, si
push rdi
jmp 0x1404af8a3
sub rsp, 0x30
add esi, r13d
xor rdi, 0x5d9b38c3
mov edi, edx
inc sil
mov rsi, rcx
test r8, r8
jmp 0x1404af8c1
jne 0x1404af8e8
call fcn.1404b4263
mov dword [rax], 0x16
jmp 0x1404af8d7
call fcn.1404b4f59
xor eax, eax
jmp 0x1404af8e3
jmp 0x1404af9ec
mov rdx, r9
cmovb ecx, eax
movzx cx, r12b
mov rcx, r8
jmp 0x1404af8fb
call fcn.1404afa3b
mov rbx, rax
stc
cmp cx, r12w
test rax, rax
jmp 0x1404af910
je 0x1404af992
lea rax, [rsp + 0x50]
mov rdx, rdi
mov cl, dil
mov qword [rsp + 0x28], rax
lea r8, [0x140094b24]
movzx r9w, dil
mov eax, dword [rsp + 0x60]
jmp 0x1404af945
mov r9, rbx
movsx rcx, r12w
cmovg rcx, r10
setae cl
mov rcx, rsi
jmp 0x1404af95b
mov dword [rsp + 0x20], eax
jmp 0x1404af964
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
stc
test r13w, sp
test rax, rax
jmp 0x1404af97a
jne 0x1404afa04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404af98d
call fcn.1404b42de
xor edi, edi
cmp r12w, 0x558
test rbx, rbx
jmp 0x1404af9a2
je 0x1404af9e9
mov rcx, qword [rbx + 0x10]
stc
test rcx, rcx
jmp 0x1404af9b5
je 0x1404af9c1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test ecx, r8d
test rcx, rcx
jmp 0x1404af9d0
je 0x1404af9dc
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404af9e4
call fcn.1404c8273
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
xchg dil, dil
cmovbe di, r15w
pop rdi
ret
mov rcx, qword [rsp + 0x68]
clc
test rcx, rcx
je 0x1404afa20
mov eax, dword [rsp + 0x50]
cmp r15w, 0x4022
mov dword [rcx], eax
cmc
sub ebx, ebx
jmp 0x1404afa27
jmp 0x1404af99a

Function at 0x1404afcdb
Capabilities:
Terminate process

Disassembly:
push rbx
sub bl, r10b
rcl bh, 0x27
sal ebx, 0xdd
sub rsp, 0x20
xchg ebx, ebx
movsx rbx, cx
mov ebx, ecx
jmp 0x1404afcf7
call fcn.1404d17e9
cmp eax, 1
jmp 0x1404afd04
je 0x1404afd4a
mov rax, qword gs:[0x60]
cmp esi, 0x8042bef
test bpl, 0xac
mov edx, dword [rax + 0xbc]
clc
shr edx, 8
cmp r14b, r13b
cmc
test dl, 1
jmp 0x1404afd33
jne 0x1404afd4a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404afd51
call fcn.1404afc47
mov ecx, ebx
jmp 0x1404afd5d
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b4fe3
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xchg ch, cl
bswap rcx
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b4ffe
je 0x1404b5010
mov ecx, 5
int 0x29
jmp 0x1404b5010
mov r8d, 1
cdq
cqo
mov dl, r9b
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.1404b504c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
rol dx, 0x71
mov edx, 0xc0000417
add rsp, 0x28
jmp 0x1404b5045
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404c9775
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
rcr rdx, cl
sub rsp, 0x20
movzx bx, r12b
mov rbx, rcx
lea r9, [0x1400c63c0]
movsxd r8, ecx
cwd
mov ecx, 3
jmp 0x1404c97a1
lea r8, [0x1400c63b8]
movsx edx, r11w
lea rdx, [0x1400cfb70]
jmp 0x1404c97b8
call fcn.1404ca734
test rax, rax
jmp 0x1404c97c5
je 0x1404c97e0
mov rcx, rbx
not bx
add rsp, 0x20
setne bl
pop rbx
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsx rbx, r11w
mov bx, sp
pop rbx
jmp 0x1404c97f1
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404c98f4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
shrd r9, r9, 0xa1
push rdi
movzx r9w, spl
sub rsp, 0x20
cmovne r9w, r15w
mov rbx, rdx
cdq
movzx r9d, di
lea r9, [0x1400c63d8]
mov edi, ecx
movsxd rcx, edi
lea rdx, [0x1400cf748]
movsx r8, cx
bswap ecx
movsx ecx, cx
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404c9942
call fcn.1404ca734
mov rdx, rbx
shr cl, 0x85
mov ecx, edi
test rax, rax
jmp 0x1404c9957
je 0x1404c9968
call qword [0x1400b8d90]
jmp 0x1404c996e
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
rcr di, 0xc2
sets dil
xchg dil, dil
add rsp, 0x20
movzx rdi, r11w
movzx di, bpl
jmp 0x1404c9990
pop rdi
jmp 0x1404c9996
ret

Function at 0x1404c9b00
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
shl rbx, cl
movsx bx, spl
mov qword [rsp + 0x10], rbp
mov rbx, rsi
sar bx, cl
jmp 0x1404c9b1d
mov qword [rsp + 0x18], rsi
clc
push rdi
sub rsp, 0x30
mov ebx, r9d
movsxd rsi, r14d
movsx r9, r12w
mov rdi, r8
mov esi, edx
cqo
lea r9, [0x1400c63e8]
cdq
movsx dx, r11b
movsx r8, r15w
mov rbp, rcx
cwd
lea r8, [0x1400c63e0]
not rcx
lea rdx, [0x1400cf190]
movzx ecx, r12w
cmovge cx, r9w
setbe cl
mov ecx, 0xb
jmp 0x1404c9b76
call fcn.1404ca734
mov rcx, rbp
test rax, rax
jmp 0x1404c9b86
je 0x1404c9bb0
mov r9d, ebx
movsxd r8, esi
movsx r8d, r11w
mov r8, rdi
cqo
bswap rdx
mov edx, esi
jmp 0x1404c9ba5
call qword [0x1400b8d90]
jmp 0x1404c9be4
sub edx, edx
jmp 0x1404c9bb7
call fcn.1404ca220
mov ecx, eax
cqo
cdq
mov r9d, ebx
movsx dx, r12b
mov r8, rdi
movsx edx, r8w
sets dh
movzx rdx, r11w
mov edx, esi
jmp 0x1404c9bde
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
adc bpl, 5
mov di, 0x5278
mov rbp, qword [rsp + 0x48]
btc di, r14w
rol rsi, cl
add di, r10w
mov rsi, qword [rsp + 0x50]
or di, ax
add rsp, 0x30
pop rdi
jmp 0x1404c9c14
ret
Function at 0x1404d63bb
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
sar ebx, 0x1e
xadd bh, bh
ror rbx, 0x4c
mov qword [rsp + 0x18], rsi
adc ebx, ebx
xadd bx, bx
push rdi
cmc
movsx bx, r12b
btr bx, 0x65
sub rsp, 0x20
xor esi, esi
bts di, r12w
rol dil, 0xc4
mov rdi, rdx
mov rbx, rcx
test bpl, 0x5f
test rcx, rcx
jmp 0x1404d6402
je 0x1404d64ac
cmp word [rcx], si
jmp 0x1404d6410
je 0x1404d64ac
lea rdx, [0x1400d1d08]
call fcn.14028121f
test eax, eax
jmp 0x1404d6429
je 0x1404d64ac
lea rdx, [0x1400d1d00]
jmp 0x1404d643f
mov rcx, rbx
jmp 0x1404d6447
call fcn.14028121f
test eax, eax
jmp 0x1404d6453
jne 0x1404d649f
mov ecx, dword [rdi + 8]
cdq
movzx r9, bp
movzx r9d, r11w
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
not dx
movsxd rdx, r15d
mov edx, 0x2000000b
jmp 0x1404d647e
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d648b
je 0x1404d64e2
mov eax, dword [rsp + 0x30]
jmp 0x1404d649a
jmp 0x1404d650d
mov rcx, rbx
call fcn.1404df54b
jmp 0x1404d650d
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
cwd
mov r9d, 2
movsx rdx, r12w
movsx dx, r9b
mov edx, 0x20001004
jmp 0x1404d64cf
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d64dc
jne 0x1404d64ee
xor eax, eax
jmp 0x1404d64e9
jmp 0x1404d650d
mov eax, dword [rsp + 0x30]
test bpl, dil
stc
cmp ax, r11w
test eax, eax
jmp 0x1404d6501
jne 0x1404d650d
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
cmovbe rdi, rax
mov rsi, qword [rsp + 0x40]
inc rdi
or dil, r9b
add rsp, 0x20
not dil
movsx rdi, cx
movsxd rdi, r9d
pop rdi
jmp 0x1404d6535
ret

Function at 0x1404d6536
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
cmp bp, di
setl bh
mov qword [rsp + 0x18], rsi
ror si, 0x6c
push rdi
sub rsp, 0x20
movsxd rsi, edx
mov esi, edx
movsx ebx, r14w
mov ebx, ecx
jmp 0x1404d655f
call fcn.1404c85cc
mov ecx, ebx
bsf r8d, esp
add r8b, r10b
lea r8, [rsp + 0x30]
and ecx, 0x3ff
btc dx, ax
mov r9d, 2
jmp 0x1404d6587
bts ecx, 0xa
movsx rdi, ax
cwd
mov edx, 0x20000001
movsxd rdi, r15d
mov rdi, rax
jmp 0x1404d65a1
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test r10b, 0x6b
cmc
test eax, eax
jmp 0x1404d65b6
je 0x1404d6681
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d65c5
je 0x1404d6672
test esi, esi
jmp 0x1404d65d2
je 0x1404d6672
mov r9, qword [rdi + 0x98]
btr cx, r11w
stc
mov r8d, r10d
cdq
movsx rdx, dx
movzx edx, word [r9]
shl cx, 0x6a
rol ah, cl
stc
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jmp 0x1404d6608
jbe 0x1404d6624
sub dx, 0x61
test rax, rbx
cmp dx, 0x19
jmp 0x1404d661e
ja 0x1404d6644
movzx edx, word [rcx]
jmp 0x1404d662c
inc r8d
test r12, 0x777f74aa
add rcx, 2
jmp 0x1404d663f
jmp 0x1404d65fc
or rcx, 0xffffffffffffffff
jmp 0x1404d664d
inc rcx
clc
test dil, r11b
cmp word [r9 + rcx*2], r10w
jmp 0x1404d665e
jne 0x1404d664d
cmp r8d, ecx
jmp 0x1404d666c
je 0x1404d6681
mov eax, 1
jmp 0x1404d667c
jmp 0x1404d6683
xor eax, eax
mov rbx, qword [rsp + 0x38]
neg sil
bts si, ax
mov rsi, qword [rsp + 0x40]
btc di, di
add rsp, 0x20
cmovne rdi, rsi
movzx di, dl
jmp 0x1404d66a9
pop rdi
ret
Function at 0x1404d7e02
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
stc
jmp 0x1404d7e21
mov qword [rax + 0x10], rbp
cmp r15b, 0x3b
cmc
mov qword [rax + 0x18], rsi
clc
stc
test r14w, cx
mov qword [rax + 0x20], rdi
cmp r8b, cl
push r14
test spl, 0x45
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
movsx ebx, di
mov rbx, rax
cmp dx, 0x1fc7
cmp r9, rdi
stc
test rax, rax
jmp 0x1404d7e65
je 0x1404d7fd0
mov rsi, rax
test dil, dil
cmp word [rax], r14w
jmp 0x1404d7e7a
je 0x1404d7eb7
or rax, 0xffffffffffffffff
jmp 0x1404d7e89
inc rax
cmp rcx, rdi
clc
cmp word [rsi + rax*2], r14w
jmp 0x1404d7e9a
jne 0x1404d7e89
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d7eb1
jne 0x1404d7e80
mov qword [rsp + 0x38], r14
sal r8b, 0x86
add r8b, spl
sub rsi, rbx
mov qword [rsp + 0x30], r14
movsxd r9, edi
sal r9b, cl
add rsi, 2
sar rsi, 1
mov r8, rbx
shrd r9w, bp, 0xe8
or r9b, 0x6d
bswap r9w
mov r9d, esi
mov dword [rsp + 0x28], r14d
cmp dl, r14b
xor edx, edx
jmp 0x1404d7efd
mov qword [rsp + 0x20], r14
cmp r15b, r15b
sub ecx, ecx
jmp 0x1404d7f0c
call fcn.1404c83b7
movsxd rbp, eax
cmp spl, bpl
cmp r15, 0x3383612d
jmp 0x1404d7f23
test eax, eax
jmp 0x1404d7f2a
je 0x1404d7fd0
mov rcx, rbp
jmp 0x1404d7f38
call fcn.1404c8301
mov rdi, rax
cmp r14b, dl
clc
jmp 0x1404d7f49
test rax, rax
jmp 0x1404d7f51
je 0x1404d7fb5
mov qword [rsp + 0x38], r14
rol r9w, 0x3e
mov r9d, esi
rcr r8w, 0xbb
sub r8b, r9b
mov qword [rsp + 0x30], r14
test r10w, r12w
mov r8, rbx
jmp 0x1404d7f7e
mov dword [rsp + 0x28], ebp
clc
cmp ax, 0x25a3
sub edx, edx
test ch, 0xeb
xor ecx, ecx
jmp 0x1404d7f93
mov qword [rsp + 0x20], rax
call fcn.1404c83b7
test eax, eax
jmp 0x1404d7fa4
je 0x1404d7fb5
mov rsi, rdi
mov rdi, r14
jmp 0x1404d7fbe
mov rsi, r14
movsx ecx, sp
sete cl
mov rcx, rdi
jmp 0x1404d7fc6
call fcn.1404c8273
jmp 0x1404d7fd8
mov rsi, r14
cmc
stc
cmp r8d, edx
test rbx, rbx
je 0x1404d7fef
mov rcx, rbx
jmp 0x1404d7fe9
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
cwde
mov rax, rsi
shrd r14, rsi, 4
mov rsi, qword [rsp + 0x60]
bt r14, rcx
cmp rdi, rdx
mov rbp, qword [rsp + 0x58]
movsxd rdi, r10d
ror dil, cl
setno r14b
mov rdi, qword [rsp + 0x68]
mov r14, r14
add rsp, 0x40
jmp 0x1404d802d
pop r14
jmp 0x1404d8034
ret
Function at 0x1404d8035
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
clc
cmp esi, r10d
cmp edi, 0x26993b90
mov qword [rsp + 0x10], rbp
test r9w, dx
cmp r14b, sil
mov qword [rsp + 0x18], rsi
jmp 0x1404d805a
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
movzx ebx, bp
sal rbx, cl
mov rbx, rax
test r14b, r13b
jmp 0x1404d8078
test rax, rax
je 0x1404d8136
mov rbp, rax
jmp 0x1404d808a
cmp word [rax], si
jmp 0x1404d8092
je 0x1404d80d1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404d80a9
jne 0x1404d809c
lea rbp, [rbp + rax*2]
add rbp, 2
jmp 0x1404d80c2
cmp word [rbp], si
jmp 0x1404d80cb
jne 0x1404d8098
sub rbp, rbx
add rbp, 2
bsf cx, sp
btr cx, r8w
sar rbp, 1
add rbp, rbp
mov rcx, rbp
jmp 0x1404d80ef
call fcn.1404c8301
mov rdi, rax
test r11d, r8d
test rax, rax
je 0x1404d8121
mov r8, rbp
mov rdx, rbx
setbe cl
movsx cx, r10b
mov rcx, rax
jmp 0x1404d8119
call fcn.1404a222e
mov rsi, rdi
xor ecx, ecx
jmp 0x1404d8128
call fcn.1404c8273
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
rcr ax, cl
cmp r9b, al
shl dil, cl
mov rax, rsi
cmove si, cx
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
rcr dil, cl
add rsp, 0x20
mov dil, 0xd2
pop rdi
jmp 0x1404d8165
ret