joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14049e368
Capabilities:
Terminate process

Disassembly:
rol byte [rdi + 0x4b], 1
jne 0x1401776a9
jl 0x1401776b9
enter 0xfffffffffffff6a4, 0xfffffffffffffffd
loope 0x1401776c4
add eax, 0x2c3f51e
push rsi
and al, 0x33
call [rsi*2 - 0x208ac16]
fsubp st(6)
invalid
mov edi, 0xa21c74ae
sbb al, 0xa2
nop
out 9, eax
cmpsd dword [rsi], dword [rdi]
in eax, dx
cmp eax, 0x80bcc7dd
pop rdi
jmp 0xe94e7beb
in eax, 0xfa
cld
push r8
invalid
enter 0x155d, 0x37
lodsb al, byte [rsi]
movsb byte [rdi], byte [rsi]
cli
outsb dx, byte [rsi]
ja 0x140177775
invalid
test al, 0x91
test dword [rdi + rdi*2 + 0x29a79445], eax
cmpsd dword [rsi], dword [rdi]
invalid
invalid
cmpsd dword [rsi], dword [rdi]
sub dword [rdx + 7], esp
invalid
add al, 0x11
mov ecx, 0x46f2c177
test byte [rbx - 0x36f7863c], dl
push rbx
jae 0x14017772d
jae 0x14017772d
jae 0x14017772d
clc
xchg ebx, eax
sub eax, 0x655d58fd
mov fs, word [edi + 0x20]
cmp byte [rsp + rdi*2 - 0x44], cl
test dword [rax + 0xe], 0x4b5447c0
in al, 0x8e
mov edi, es
out dx, eax
sub eax, 0x89a1751d
nop
insd dword [rdi], dx
invalid
push rbx
xchg bh, bh
cmp rsi, r13
rol bl, 0x4f
sub rsp, 0x20
rol bx, 0x74
dec bh
mov rbx, rcx
xor ecx, ecx
jmp 0x14049e386
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x14049e394
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
xadd bh, bh
cmovle ebx, ecx
btr rbx, 0x7e
add rsp, 0x20
movzx ebx, r13w
bswap ebx
movzx rbx, di
pop rbx
jmp switch.0x14049e3c7
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x14049f1e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bsr ebx, r12d
bswap bx
shl ebx, 0xcb
mov qword [rsp + 0x10], rbp
bsf rbp, r12
bt bp, 0x25
mov qword [rsp + 0x18], rsi
add bl, 0x15
rol bl, 0xe7
add ebp, ebx
push rdi
rcr rdi, 0xd2
rol dil, cl
movzx rdi, r8w
push r12
rcl bl, cl
mov dil, 0x9f
push r13
push r14
cmc
push r15
sbb r15w, di
sub rsp, 0x40
mov rbx, qword [rsp + 0x90]
mov r12, rdx
movsx edi, r12w
mov rbp, rcx
movsx rdi, r13w
xchg r15b, r15b
movzx edi, bx
mov rdx, r9
mov rcx, rbx
movsx r14d, cx
movzx edi, ax
movsxd r15, r15d
mov rdi, r9
mov r15d, r8d
mov r14b, dl
cmovl r14d, ebp
mov r14d, dword [rbx + 0xc]
call fcn.14027d908
sub r10d, r10d
mov esi, eax
cmp ebp, 0x208d5e11
test r9b, 0x49
test r14d, r14d
jmp 0x14049f289
je 0x14049f4c2
mov r11, qword [rdi + 8]
bt dx, 0xb
dec r8w
or eax, 0xffffffff
xor r8, r13
movzx cx, bpl
movsxd r13, r8d
movsxd rbx, dword [rbx + 0x10]
sbb r9b, r14b
rol r8b, cl
mov r9d, eax
bt rcx, 0x7f
sub r8b, 0x3f
cmp r14b, dl
mov r13d, eax
rol r8w, 0x19
mov edx, r14d
lea r8d, [rdx - 1]
sal ch, cl
lea rcx, [r8 + r8*4]
shl rax, cl
cbw
lea rax, [r11 + rcx*4]
cmp r13, r9
cmp esi, dword [rax + rbx + 4]
jle 0x14049f2fd
cmp esi, dword [rax + rbx + 8]
jmp 0x14049f2f7
jle 0x14049f318
mov edx, r8d
cmp r12b, r8b
test sil, 0x31
test cl, r8b
test r8d, r8d
jmp 0x14049f312
jne 0x14049f2ce
mov r8d, r10d
test edx, edx
je 0x14049f34c
lea eax, [rdx - 1]
bt dx, 0x41
sar dl, cl
lea rax, [rax + rax*4]
lea rdx, [rbx + rax*4]
cmp ebp, 0x7b6967db
test r12w, r14w
add rdx, r11
jmp 0x14049f347
jmp 0x14049f357
mov rdx, r10
rcr ch, 0x34
bswap ecx
cmp esp, r9d
lea rcx, [r11 + rbx]
cmc
test bpl, spl
cmp r10b, r9b
or r11d, 0xffffffff
cmc
test bpl, dl
test rdx, rdx
je 0x14049f39b
mov eax, dword [rdx + 4]
cmp dword [rcx], eax
jmp 0x14049f37d
jle 0x14049f3c6
mov eax, dword [rdx + 8]
test sil, dil
test dh, 0xe0
cmc
cmp dword [rcx + 4], eax
jmp 0x14049f395
jg 0x14049f3c6
cmp r15d, dword [rcx]
jl 0x14049f3c6
cmp r15d, dword [rcx + 4]
jmp 0x14049f3ad
jg 0x14049f3c6
cmp r9d, r11d
mov eax, r8d
mov r13b, 0x49
mov r13d, r8d
cmovne eax, r9d
mov r9d, eax
inc r8d
cmp r11b, r8b
add rcx, 0x14
test r13, 0x7a7d7fc1
cmp r8d, r14d
jb 0x14049f36a
cmp r9d, r11d
cwde
mov qword [rsp + 0x20], r12
mov eax, r10d
mov qword [rsp + 0x30], r12
movsx esi, r10w
mov dil, r12b
jmp 0x14049f3fd
cmovne eax, r9d
movsxd rbx, r14d
movsx r14w, dl
lea r11, [rsp + 0x40]
jmp 0x14049f41b
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, r15
jmp 0x14049f42f
mov dword [rsp + 0x28], eax
movzx r12, r9w
lea eax, [r13 + 1]
movsx rdi, cx
movups xmm0, xmmword [rsp + 0x20]
xchg r13w, r13w
movzx r14w, dl
movzx r15, cx
cmovne r10d, eax
movsx r12w, spl
cmovnp r14w, sp
movsx rdi, bx
mov rax, rbp
not r12b
movzx r14, di
mov dword [rsp + 0x38], r10d
not r12b
movups xmm1, xmmword [rsp + 0x30]
movdqu xmmword [rbp], xmm0
not r12b
movzx r13d, bp
movdqu xmmword [rbp + 0x10], xmm1
jmp 0x14049f490
mov rbp, qword [r11 + 0x38]
xchg r13w, di
bswap r12d
cmovg r12d, r11d
mov rsp, r11
setp r13b
movsx r14d, r15w
pop r15
pop r14
movsx rdi, r15w
pop r13
movsx edi, r13w
mov di, dx
pop r12
mov dil, 0xca
pop rdi
ret
call fcn.1404b4569
int3
Function at 0x1404ac0bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
bt ebx, r15d
sal bh, cl
cmp r8b, 0x78
mov qword [rsp + 0x18], rbp
xor bh, 0x22
mov ebx, 0x49f92bd0
mov qword [rsp + 0x20], rsi
push rdi
movzx rbx, dx
sub rsp, 0x30
movzx bx, ah
xor ebp, ebp
movzx rbx, r15w
bsf ebx, edi
sal bh, cl
mov rbx, rcx
test bl, r12b
cmc
cmp byte [rcx + 0x54], bpl
jne 0x1404ac222
cmp dword [rcx + 0x50], ebp
jmp 0x1404ac10d
jle 0x1404ac222
mov rsi, qword [rcx + 0x48]
rdtsc
mov al, 0x20
jmp 0x1404ac120
mov edi, ebp
mov r9, qword [rbx + 8]
lea rcx, [rsp + 0x40]
cwde
not r8w
mov word [rsp + 0x40], bp
cbw
jmp 0x1404ac142
mov rdx, rsi
mov rax, qword [r9]
setb r8b
movsxd r8, dword [rax + 8]
jmp 0x1404ac155
call fcn.1404cd9f7
movsxd r8, eax
test eax, eax
jmp 0x1404ac164
jle 0x1404ac219
mov rcx, qword [rbx + 0x468]
movzx edx, word [rsp + 0x40]
rol ax, 0x26
rcl ax, cl
mov rax, qword [rcx + 8]
jmp 0x1404ac186
cmp qword [rcx + 0x10], rax
jmp 0x1404ac18f
jne 0x1404ac1bf
cmp byte [rcx + 0x18], bpl
jmp 0x1404ac19e
je 0x1404ac1b1
inc dword [rbx + 0x28]
jmp 0x1404ac1ac
jmp 0x1404ac1f5
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ac1ba
jmp 0x1404ac1f5
inc dword [rbx + 0x28]
setne ah
inc qword [rcx + 0x10]
mov cx, r15w
mov rax, qword [rbx + 0x468]
sal cl, 0xe0
mov rcx, qword [rax]
sub ax, r8w
mov word [rcx], dx
cmc
mov rax, qword [rbx + 0x468]
cmp rbp, r8
add qword [rax], 2
jmp 0x1404ac1f5
add rsi, r8
jmp 0x1404ac1fd
inc edi
test bpl, al
test dil, 0xc7
cmp edi, dword [rbx + 0x50]
jmp 0x1404ac20e
jne 0x1404ac122
jmp 0x1404ac255
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ac255
mov r8d, dword [rbx + 0x50]
cmc
lea rax, [rcx + 0x10]
add dl, 0x35
mov dh, 0xf
rcl r9w, cl
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
stc
cmc
add rcx, 0x468
jmp 0x1404ac24b
mov qword [rsp + 0x20], rax
call fcn.1404aa55a
mov rbx, qword [rsp + 0x48]
movzx edi, r10w
mov al, 1
or bp, r10w
bts esi, r12d
or sil, 0xbb
mov rbp, qword [rsp + 0x50]
xor si, 0x639d
stc
mov rsi, qword [rsp + 0x58]
rcl dil, 0xf1
add rsp, 0x30
cmovp edi, r8d
pop rdi
jmp 0x1404ac28e
ret
Function at 0x1404add09
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmp al, r15b
clc
mov qword [rsp + 0x10], rsi
push rdi
ror dil, 0xfe
sub rsp, 0x30
sete dil
xor sil, sil
mov edi, edx
sal sil, 0x51
movsx esi, r8w
mov rsi, rcx
test al, 0x79
test bx, r8w
test r8, r8
jmp 0x1404add42
jne 0x1404add69
call fcn.1404b26aa
mov dword [rax], 0x16
jmp 0x1404add58
call fcn.1404b331d
sub eax, eax
jmp 0x1404add64
jmp 0x1404ade56
mov rdx, r9
movzx cx, ch
movsxd rcx, r12d
movzx rcx, r10w
mov rcx, r8
jmp 0x1404add7f
call fcn.1404adeb5
mov rbx, rax
clc
test rax, rax
je 0x1404ade03
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x28], rax
mov ecx, 0x39476bcd
lea r8, [0x140094b24]
movsx r9w, r10b
movzx eax, bp
mov eax, dword [rsp + 0x60]
not r9b
mov r9, rbx
mov cl, 0x4f
cmovo rcx, r8
movzx ecx, r15w
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404addd2
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
jmp 0x1404adde3
test rax, rax
jmp 0x1404addeb
jne 0x1404ade72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404addfe
call fcn.1404b271e
sub edi, edi
test r13b, bl
stc
test rbx, rbx
jmp 0x1404ade11
je 0x1404ade4a
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1404ade2a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404ade36
je 0x1404ade42
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1404c65b7
mov rax, rdi
shld si, r14w, 0x94
sub bl, 8
mov rbx, qword [rsp + 0x40]
ror dil, cl
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
setbe dil
pop rdi
jmp 0x1404ade71
ret
mov rcx, qword [rsp + 0x68]
jmp 0x1404ade7c
test rcx, rcx
jmp 0x1404ade84
je 0x1404ade9a
mov eax, dword [rsp + 0x50]
cmp r8d, 0x91322f
mov dword [rcx], eax
test bpl, r14b
xor ebx, ebx
jmp 0x1404ade09

Function at 0x1404ae15f
Capabilities:
Terminate process

Disassembly:
push rbx
rcr bx, 0x52
movzx rbx, r13w
sub rsp, 0x20
movsx ebx, r9w
sets bh
xchg bx, bx
mov ebx, ecx
call fcn.1404cfbcc
cmp eax, 1
jmp 0x1404ae186
je 0x1404ae1cd
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jmp 0x1404ae1a6
jne 0x1404ae1cd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movzx rdx, r12w
movsxd rdx, edx
movsx dx, bh
mov edx, ebx
jmp 0x1404ae1c7
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404ae1d4
call fcn.1404ae0b4
mov ecx, ebx
jmp 0x1404ae1e0
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b15c9
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
movsx ecx, r15w
mov qword [rsp + 0x10], rsi
add ecx, r12d
movzx cx, sil
mov qword [rsp + 0x20], r9
sbb cx, 0x5e33
cmp rdx, rsp
push rdi
and dil, 0xf6
clc
sub rsp, 0x30
movzx cx, dil
movsx rcx, bp
not cx
mov rdi, r9
mov rcx, rdx
xchg ch, ch
movsx ecx, di
mov ecx, dword [rdx]
jmp 0x1404b1614
call fcn.14017e9aa
nop
lea rbx, [0x1400ba680]
bsr esi, r13d
cmp bpl, 0xcc
lea rsi, [0x1400b7480]
add ax, r14w
mov qword [rsp + 0x20], rbx
lea rax, [0x1400ba688]
jmp 0x1404b1647
cmp rbx, rax
jmp 0x1404b164f
je 0x1404b167e
cmp qword [rbx], rsi
je 0x1404b1675
mov rdx, rsi
movsx ecx, r10w
mov rcx, rbx
jmp 0x1404b166d
call fcn.1404d20e5
mov qword [rbx], rax
add rbx, 8
jmp 0x1404b1634
mov ecx, dword [rdi]
call fcn.140206c1f
mov rbx, qword [rsp + 0x40]
shr sil, 0x7a
shld edi, eax, 0x8c
ror sil, cl
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
movsx di, bpl
jmp 0x1404b16ac
pop rdi
jmp 0x1404b16b2
ret

Function at 0x1404b2e3c
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
cmc
shl r8b, 0x3f
mov qword [rsp + 0x10], rbp
or r8w, r11w
and edx, 0x685d463d
mov qword [rsp + 0x18], rsi
cmc
not r8w
push rdi
sub dx, 0x7a89
sub dx, si
sal edx, 0x2f
push r14
push r15
jmp 0x1404b2e74
sub rsp, 0x30
bsf dx, si
mov r14, rcx
rcl rcx, 0x5a
stc
sub esi, esi
movsxd rdx, ebp
xchg r8, rcx
mov ecx, esi
cwd
not r8
mov r8, r14
setbe dh
movzx edx, r13w
movzx edx, word [r14]
jmp 0x1404b2ea6
jmp 0x1404b2eef
cmp dx, 0x3d
xchg al, ah
movsx eax, ax
not ah
lea rax, [rcx + 1]
jmp 0x1404b2ebf
cmove rax, rcx
and cx, r11w
bt rcx, rbx
mov rcx, rax
cmc
test ah, bh
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], si
jne 0x1404b2ed5
lea r8, [r8 + rax*2]
add r8, 2
movzx edx, word [r8]
test dx, dx
jmp 0x1404b2ef7
jne 0x1404b2eab
inc rcx
mov edx, 8
jmp 0x1404b2f0a
call fcn.1404ca7ce
mov rbx, rax
cmc
test rax, rax
jmp 0x1404b2f1b
je 0x1404b2ff5
mov r15, rax
ror al, cl
movzx eax, word [r14]
test ax, ax
je 0x1404b2fec
or rbp, 0xffffffffffffffff
jmp 0x1404b2f3c
inc rbp
cmc
cmp word [r14 + rbp*2], si
jmp 0x1404b2f4a
jne 0x1404b2f3c
inc rbp
jmp 0x1404b2f59
cmp ax, 0x3d
je 0x1404b2fc0
mov edx, 2
movsx rcx, si
movsx cx, sil
mov rcx, rbp
call fcn.1404ca7ce
mov rdi, rax
test esi, esi
jmp 0x1404b2f84
test rax, rax
je 0x1404b2fce
mov r8, r14
mov rdx, rbp
setne cl
xchg cl, cl
mov rcx, rax
jmp 0x1404b2fa0
call fcn.1404c72b6
sub ecx, ecx
test eax, eax
jmp 0x1404b2fae
jne 0x1404b3045
mov qword [r15], rdi
add r15, 8
call fcn.1404c65b7
lea r14, [r14 + rbp*2]
jmp 0x1404b2fc9
jmp 0x1404b2f26
mov rcx, rbx
jmp 0x1404b2fd6
call fcn.1404b2b75
sub ecx, ecx
jmp 0x1404b2fe2
call fcn.1404c65b7
jmp 0x1404b2ff5
mov rsi, rbx
cmc
cmp r11b, 0x37
stc
sub ecx, ecx
jmp 0x1404b2ffc
call fcn.1404c65b7
mov rbx, qword [rsp + 0x50]
mov rax, rsi
sar si, 5
add r14b, 0xd0
bswap r15w
mov rsi, qword [rsp + 0x60]
jmp 0x1404b301f
mov rbp, qword [rsp + 0x58]
movzx r15, si
shr r15b, cl
rol r15b, cl
add rsp, 0x30
mov dil, 0x5d
pop r15
pop r14
movsx di, spl
pop rdi
jmp 0x1404b3044
ret
sub r9d, r9d
mov qword [rsp + 0x20], rsi
cmp r14b, 0x1c
xor r8d, r8d
cmc
xor edx, edx
call fcn.1404b33a8
int3
Function at 0x1404c7bfa
Capabilities:
Get thread local storage value

Disassembly:
push rbx
adc r9w, 0x6b1e
sub rsp, 0x20
mov ebx, ecx
movsx edx, bx
jmp 0x1404c7c10
lea r9, [0x1400c63d0]
movzx dx, dl
cqo
movzx ecx, bx
mov ecx, 5
cwd
lea r8, [0x1400c63c8]
cmove rdx, rax
lea rdx, [0x1400cf758]
call fcn.1404c8b47
mov ecx, ebx
test dl, spl
test rax, rax
jmp 0x1404c7c4b
je 0x1404c7c6a
add rsp, 0x20
movsx ebx, r12w
cmovs ebx, r15d
movsx bx, r11b
pop rbx
jmp qword [0x1400b8d90]
add rsp, 0x20
xchg ebx, ebx
seto bl
movzx bx, ch
pop rbx
jmp 0x1404c7c7d
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c7c84
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
bsr bx, cx
btc r8, rsp
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c63d8]
movsx edx, r9w
mov edi, ecx
movsxd r8, r15d
not cx
lea rdx, [0x1400cf748]
movzx rcx, cx
mov ecx, 6
movsx r8w, sil
not r8w
lea r8, [0x1400c63d0]
jmp 0x1404c7cd1
call fcn.1404c8b47
mov rdx, rbx
mov cl, spl
bts cx, r10w
mov ecx, edi
test rax, rax
je 0x1404c7cf7
call qword [0x1400b8d90]
jmp 0x1404c7cfd
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
cmc
rol rdi, 0x91
adc edi, 0x4c655891
add rsp, 0x20
pop rdi
ret

Function at 0x1404c7ebc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
add bx, si
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
xadd dil, bl
cmp edi, ebp
mov sil, r12b
sub rsp, 0x30
mov bpl, cl
mov di, 0x1c19
seta bpl
mov ebx, r9d
mov rdi, r8
movsx r9d, bp
mov esi, edx
cmovb edx, ebx
movsx edx, bp
lea r9, [0x1400c63e8]
mov rbp, rcx
lea r8, [0x1400c63e0]
movsx cx, spl
lea rdx, [0x1400cf190]
cmovb cx, si
mov ecx, 0xb
jmp 0x1404c7f24
call fcn.1404c8b47
mov rcx, rbp
cmp r12w, 0x6125
test rax, rax
jmp 0x1404c7f3a
je 0x1404c7f5d
mov r9d, ebx
mov r8, rdi
movsx rdx, sp
setl dh
movzx edx, di
mov edx, esi
call qword [0x1400b8d90]
jmp 0x1404c7f91
sub edx, edx
call fcn.1404c8622
mov ecx, eax
mov r8d, r12d
cwd
mov r9d, ebx
mov r8d, r15d
movsx edx, si
bswap edx
mov r8, rdi
movsx edx, r9w
movzx edx, bx
mov dx, 0x143e
mov edx, esi
jmp 0x1404c7f8b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
xadd bp, bp
bts rsi, r8
or di, 0x192b
mov rbp, qword [rsp + 0x48]
shld rdi, rbx, 0xcc
btr si, 0x39
mov rsi, qword [rsp + 0x50]
rcr edi, cl
add rsp, 0x30
jmp 0x1404c7fc5
pop rdi
ret
Function at 0x1404d47aa
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
add bh, ch
neg bh
sal bx, cl
push rdi
sal edi, 0xcd
sub rsp, 0x20
cmc
sub esi, esi
rcl dil, cl
btc bx, r8w
add ebx, ebp
mov rdi, rdx
mov bl, r12b
xor ebx, r9d
movzx bx, r9b
mov rbx, rcx
jmp 0x1404d47e6
test rcx, rcx
jmp 0x1404d47ee
je 0x1404d488f
cmp word [rcx], si
je 0x1404d488f
lea rdx, [0x1400d1d08]
call fcn.1401ebfd5
test eax, eax
je 0x1404d488f
lea rdx, [0x1400d1d00]
movsxd rcx, ebx
movsx rcx, r13w
mov rcx, rbx
jmp 0x1404d4827
call fcn.1401ebfd5
test eax, eax
jmp 0x1404d4833
jne 0x1404d487d
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
mov r8d, r13d
mov dl, 0xa6
movsx r8d, r10w
lea r8, [rsp + 0x30]
mov dx, 0x59c0
cwd
not dx
mov edx, 0x2000000b
jmp 0x1404d4861
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d486e
je 0x1404d48c2
mov eax, dword [rsp + 0x30]
jmp 0x1404d48e8
mov rcx, rbx
jmp 0x1404d4885
call fcn.1404dd9d3
jmp 0x1404d48e8
mov ecx, dword [rdi + 8]
mov r9b, spl
cqo
lea r8, [rsp + 0x30]
mov r9d, r12d
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d48af
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d48bc
jne 0x1404d48ce
xor eax, eax
jmp 0x1404d48c9
jmp 0x1404d48e8
mov eax, dword [rsp + 0x30]
cmp cl, 0x25
test eax, eax
jmp 0x1404d48dc
jne 0x1404d48e8
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
ror dil, cl
movzx si, r13b
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movsxd rdi, r13d
cmova di, r10w
pop rdi
jmp 0x1404d490c
ret

Function at 0x1404d490d
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
adc bx, dx
shr bh, 0xb4
mov qword [rsp + 0x18], rsi
bsf bx, r9w
shld rbx, rdi, 0x34
push rdi
sub rsp, 0x20
not sil
movsx rbx, r13w
movsxd rbx, r10d
mov esi, edx
mov ebx, ecx
jmp 0x1404d493f
call fcn.1404c6930
mov ecx, ebx
neg dil
cmp bpl, bl
stc
lea r8, [rsp + 0x30]
shld r9w, r8w, 0xba
and ecx, 0x3ff
bts edi, edi
mov edi, edi
movsxd rdi, r11d
mov r9d, 2
not dil
bts ecx, 0xa
mov edx, 0x20000001
not dil
movzx rdi, r11w
mov rdi, rax
jmp 0x1404d4987
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test r13b, 0xc7
test eax, eax
jmp 0x1404d499b
je 0x1404d4a61
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d49aa
je 0x1404d4a52
test esi, esi
jmp 0x1404d49b7
je 0x1404d4a52
mov r9, qword [rdi + 0x98]
sbb al, dh
or cl, r11b
lahf
mov r8d, r10d
not cx
add rcx, 0x7ac2001
movzx edx, word [r9]
lea rcx, [r9 + 2]
cmp r14, rsp
movsx eax, r15w
add eax, 0xb336149
lea eax, [rdx - 0x41]
clc
cmp ax, 0x19
jmp 0x1404d49f8
jbe 0x1404d4a11
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404d4a0b
ja 0x1404d4a28
movzx edx, word [rcx]
inc r8d
clc
stc
cmp r11w, 0x5529
add rcx, 2
jmp 0x1404d49eb
or rcx, 0xffffffffffffffff
jmp 0x1404d4a31
inc rcx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d4a3e
jne 0x1404d4a31
cmp r8d, ecx
jmp 0x1404d4a4c
je 0x1404d4a61
mov eax, 1
jmp 0x1404d4a5c
jmp 0x1404d4a6d
sub eax, eax
sal esi, 0x50
bt di, ax
and bl, 0x86
mov rbx, qword [rsp + 0x38]
or sil, 0xf0
shr dil, 0xc5
mov rsi, qword [rsp + 0x40]
neg dil
bts di, r15w
bsr rdi, rcx
add rsp, 0x20
mov di, 0xe52
movsxd rdi, r14d
movsx edi, r8w
pop rdi
ret
Function at 0x1404d6169
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
stc
cmp r9b, 0xc4
mov qword [rax + 8], rbx
cmc
cmp dx, si
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmc
cmp spl, dil
test dx, r15w
push r14
jmp 0x1404d6194
sub rsp, 0x40
jmp 0x1404d619d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
mov rbx, rax
cmp bh, 0x19
stc
test rax, rax
jmp 0x1404d61b5
je 0x1404d6327
mov rsi, rax
cmp word [rax], r14w
jmp 0x1404d61c7
je 0x1404d620a
or rax, 0xffffffffffffffff
jmp 0x1404d61d6
inc rax
cmp word [rsi + rax*2], r14w
jmp 0x1404d61e3
jne 0x1404d61d6
lea rsi, [rsi + rax*2]
add rsi, 2
test cx, 0x3ce2
jmp 0x1404d61fb
cmp word [rsi], r14w
jmp 0x1404d6204
jne 0x1404d61cd
mov qword [rsp + 0x38], r14
sub rsi, rbx
bt r9w, 0x23
add r9b, bpl
mov qword [rsp + 0x30], r14
bt r9w, r11w
bsf r8w, di
add rsi, 2
cmp al, 0x79
neg r8b
test ecx, ebp
sar rsi, 1
mov r8, rbx
neg r9b
adc r9d, 0x2f880dfd
sub r9, rax
mov r9d, esi
clc
cmp r15, 0x68c2214e
mov dword [rsp + 0x28], r14d
cmc
test r14, rax
jmp 0x1404d6261
sub edx, edx
jmp 0x1404d6269
mov qword [rsp + 0x20], r14
cmc
sub ecx, ecx
jmp 0x1404d6276
call fcn.1404c6710
movsxd rbp, eax
stc
clc
test eax, eax
jmp 0x1404d6287
je 0x1404d6327
mov rcx, rbp
jmp 0x1404d6295
call fcn.1404c6651
mov rdi, rax
cmp bp, r12w
test bp, cx
test rax, rax
je 0x1404d6312
mov qword [rsp + 0x38], r14
mov r9d, esi
shl r8b, 0xe2
shld r8, r13, 0x5d
movzx r8d, r13w
mov qword [rsp + 0x30], r14
sar r8b, cl
bts r8d, r8d
bsr r8, r14
mov r8, rbx
clc
mov dword [rsp + 0x28], ebp
clc
cmc
sub edx, edx
xor ecx, ecx
jmp 0x1404d62e5
mov qword [rsp + 0x20], rax
jmp 0x1404d62ef
call fcn.1404c6710
test eax, eax
je 0x1404d6312
mov rsi, rdi
setle dil
movzx rdi, sp
xchg rdi, rdi
mov rdi, r14
jmp 0x1404d6315
mov rsi, r14
mov rcx, rdi
jmp 0x1404d631d
call fcn.1404c65b7
jmp 0x1404d632d
mov rsi, r14
cmp r12b, r8b
test rbx, rbx
jmp 0x1404d6335
je 0x1404d6344
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
btc bp, 0xce
mov rsi, qword [rsp + 0x60]
shl dil, 0x6e
shr rbp, 0x89
adc r14w, 0x6060
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
bts r14d, r8d
rcl r14w, cl
bsf r14d, edi
add rsp, 0x40
pop r14
ret
Function at 0x1404d6381
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
cmp r11b, 0xda
mov qword [rsp + 0x18], rsi
cmp edi, 0x3c011751
stc
push rdi
test r11w, 0x4bcd
sub rsp, 0x20
jmp 0x1404d63ab
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test r9b, r8b
test rax, rax
jmp 0x1404d63c1
je 0x1404d6486
mov rbp, rax
cmc
test si, 0x4330
cmp word [rax], si
jmp 0x1404d63d8
je 0x1404d641b
or rax, 0xffffffffffffffff
inc rax
cmp r11w, 0x6773
cmp word [rbp + rax*2], si
jmp 0x1404d63f5
jne 0x1404d63e2
lea rbp, [rbp + rax*2]
cmp r12, 0x39850fdc
cmc
add rbp, 2
cmp word [rbp], si
jmp 0x1404d6415
jne 0x1404d63de
sub rbp, rbx
clc
add rbp, 2
shr cl, cl
sar rbp, 1
add rbp, rbp
mov cx, r9w
mov rcx, rbp
jmp 0x1404d6437
call fcn.1404c6651
mov rdi, rax
test rax, rax
jmp 0x1404d6447
je 0x1404d646c
mov r8, rbp
cmovno cx, sp
movzx edx, r14w
mov rdx, rbx
mov rcx, rax
jmp 0x1404d6463
call fcn.1404a0829
mov rsi, rdi
cmc
xor ecx, ecx
jmp 0x1404d6473
call fcn.1404c65b7
mov rcx, rbx
jmp 0x1404d6480
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
sal di, cl
xor dil, 0x1b
shl dil, cl
mov rbp, qword [rsp + 0x38]
test r8w, 0x806
add rsp, 0x20
pop rdi
ret
Function at 0x1404d895c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
btr eax, 5
shl al, 0xe0
sar al, 0x9e
push rbp
lahf
or rax, 0x23b47e76
cmp r9w, 0x1d7d
push rsi
cmp r10b, 0xa4
and ebp, 0x2b284bd2
push rdi
shl bpl, cl
shr ah, cl
adc ax, dx
push r12
xor al, 0xb2
dec si
push r13
push r14
cmovp rsi, r10
clc
push r15
cwde
lea rbp, [rsp - 0x27]
cdqe
sub rsp, 0x100
inc r14w
not r15w
bswap esi
mov rax, qword [0x1400b7288]
movsx r12d, r8w
xor rax, rsp
neg r14b
mov qword [rbp + 0x17], rax
rcr rax, 0x6b
shl r14b, 0x57
movsxd rsi, edx
adc r13b, 0x2b
sar ax, cl
add r15w, 0x736b
mov r15, r8
mov rax, rsi
shl r12b, cl
xchg r13, r14
mov qword [rbp - 9], rcx
mov r13b, 0xd4
rcl r12b, cl
mov qword [rbp - 0x11], rax
or r14w, 0x282e
ror cl, cl
lea rcx, [0x140000000]
and eax, 0x3f
mov r13d, r9d
btc r14d, ebp
add r13, r8
mov qword [rbp - 0x21], r8
rcr r14d, 0x23
mov r12, rsi
rcr r14b, cl
btr r14d, 0xef
mov qword [rbp - 0x51], r13
bt r14d, r14d
dec r14b
sar r12, 6
lea r14, [rax + rax*8]
movzx rax, r12w
mov rax, qword [rcx + r12*8 + 0xba940]
jmp 0x1404d8a53
mov rax, qword [rax + r14*8 + 0x28]
mov qword [rbp - 0x49], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xor edx, edx
movsx ecx, r14w
lea rcx, [rsp + 0x50]
mov dword [rbp - 0x59], eax
call fcn.1404a1808
mov rcx, qword [rsp + 0x58]
xor r11d, r11d
cmovle dx, r11w
mov dword [rbp - 0x69], r11d
mov ebx, r11d
cmp r11w, 0x42a4
mov dword [rbp - 0x65], ebx
ror edi, cl
adc dl, r8b
mov rdi, r15
ror dx, cl
mov edx, dword [rcx + 0xc]
mov ecx, r11d
mov dword [rsp + 0x40], ecx
cmp bp, di
mov dword [rbp - 0x55], edx
jmp 0x1404d8ab2
cmp r15, r13
jmp 0x1404d8aba
jae 0x1404d929b
mov rax, rsi
rcr si, 0x77
movsx esi, r15w
rcl cl, cl
mov rsi, r15
cmp rdx, r14
shl r15d, cl
sar rax, 6
shld r15d, r9d, 0xe7
cmp r13w, r14w
sar r15b, cl
mov qword [rbp - 0x19], rax
dec r15b