joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d7022
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
stc
xor bl, bl
mov ebx, 0x2f132b7b
mov qword [rsp + 0x18], rsi
sbb ebx, 0x1b2d7687
push rdi
sub rsp, 0x20
adc dil, r12b
xor esi, esi
sub di, 0x6efa
movsx di, cl
mov rdi, rdx
setne bl
cmc
shr rbx, cl
mov rbx, rcx
test r11b, r8b
test rcx, rcx
jmp 0x1404d7065
je 0x1404d710b
cmp word [rcx], si
je 0x1404d710b
lea rdx, [0x1400d1d08]
jmp 0x1404d7080
call fcn.14026ba83
test eax, eax
je 0x1404d710b
lea rdx, [0x1400d1d00]
mov cl, r8b
mov rcx, rbx
jmp 0x1404d709f
call fcn.14026ba83
test eax, eax
jmp 0x1404d70ab
jne 0x1404d70f9
mov ecx, dword [rdi + 8]
mov dh, 0x41
xchg r8b, dl
cdq
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
setae dl
bswap dx
movzx edx, r9w
mov edx, 0x2000000b
jmp 0x1404d70d8
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d70e5
je 0x1404d7140
mov eax, dword [rsp + 0x30]
jmp 0x1404d70f4
jmp 0x1404d715e
mov rcx, rbx
jmp 0x1404d7101
call fcn.1404e019c
jmp 0x1404d715e
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
movsx rdx, r9w
movzx dx, r14b
bswap rdx
mov r9d, 2
mov dh, 0x6a
mov edx, 0x20001004
jmp 0x1404d7132
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d714c
sub eax, eax
jmp 0x1404d7147
jmp 0x1404d715e
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1404d715e
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
bsr edi, esp
rcl sil, cl
mov rsi, qword [rsp + 0x40]
xchg dil, dil
add rsp, 0x20
movzx di, r14b
pop rdi
jmp 0x1404d7180
ret

Function at 0x1404d7181
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
movzx rbx, r9w
btc bx, 0x50
mov qword [rsp + 0x18], rsi
push rdi
movzx ebx, ax
rol rsi, 0x31
sub rsp, 0x20
xchg rbx, rsi
movzx rsi, r11w
movzx ebx, si
mov esi, edx
mov ebx, ecx
jmp 0x1404d71b3
call fcn.1404c931e
mov ecx, ebx
jmp 0x1404d71bf
lea r8, [rsp + 0x30]
and ecx, 0x3ff
movzx rdi, r8w
movzx dx, r11b
bswap r9w
mov r9d, 2
cdq
movzx dx, ah
movsx di, bl
bts ecx, 0xa
movsx edx, bp
mov dil, 0x8c
mov edx, 0x20000001
mov rdi, 0x207a63ac
mov rdi, rax
jmp 0x1404d7204
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test eax, eax
jmp 0x1404d7214
je 0x1404d72d3
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d7223
je 0x1404d72c4
test esi, esi
jmp 0x1404d7230
je 0x1404d72c4
mov r9, qword [rdi + 0x98]
bsf cx, r14w
mov r8d, r10d
movzx edx, word [r9]
sal ah, cl
lea rcx, [r9 + 2]
ror al, 0xfa
bts eax, ebp
lea eax, [rdx - 0x41]
cmp ax, 0x19
jmp 0x1404d7261
jbe 0x1404d727a
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404d7274
ja 0x1404d729a
movzx edx, word [rcx]
jmp 0x1404d7282
inc r8d
test al, 0x27
jmp 0x1404d728c
add rcx, 2
jmp 0x1404d7295
jmp 0x1404d7255
or rcx, 0xffffffffffffffff
jmp 0x1404d72a3
inc rcx
jmp 0x1404d72ab
cmp word [r9 + rcx*2], r10w
jmp 0x1404d72b5
jne 0x1404d72a3
cmp r8d, ecx
je 0x1404d72d3
mov eax, 1
jmp 0x1404d72ce
jmp 0x1404d72d9
sub eax, eax
bsf rbx, rax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
movsx edi, ax
sal dil, cl
add rsp, 0x20
movzx di, bl
pop rdi
jmp 0x1404d72f7
ret
Function at 0x1404d89cc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test r8b, al
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
cmp r10d, edi
mov qword [rax + 0x18], rsi
clc
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x1404d89f1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
clc
test rax, rax
je 0x1404d8b93
mov rsi, rax
clc
cmp cx, 0x906
stc
cmp word [rax], r14w
jmp 0x1404d8a1a
je 0x1404d8a60
or rax, 0xffffffffffffffff
jmp 0x1404d8a29
inc rax
test rbx, r13
cmp r9w, bp
cmp word [rsi + rax*2], r14w
jmp 0x1404d8a3d
jne 0x1404d8a29
lea rsi, [rsi + rax*2]
clc
jmp 0x1404d8a4d
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d8a5a
jne 0x1404d8a20
mov qword [rsp + 0x38], r14
sub rsi, rbx
movzx r8d, r8w
btc r9, 0x3e
shld r8w, dx, 0x54
mov qword [rsp + 0x30], r14
sal r9d, 0xd0
bts r8d, edi
add rsi, 2
shl r9d, cl
adc r9b, r8b
test r13d, 0x559f4064
sar rsi, 1
mov r8, rbx
add r9d, 0x3e93124d
xor r9w, ax
btc r9w, bp
mov r9d, esi
mov dword [rsp + 0x28], r14d
cmc
stc
clc
sub edx, edx
mov qword [rsp + 0x20], r14
test bpl, r13b
cmc
sub ecx, ecx
jmp 0x1404d8ac8
call fcn.1404c912f
movsxd rbp, eax
cmc
clc
test eax, eax
jmp 0x1404d8ad9
je 0x1404d8b93
mov rcx, rbp
jmp 0x1404d8ae7
call fcn.1404c9076
mov rdi, rax
clc
cmc
stc
test rax, rax
je 0x1404d8b78
mov qword [rsp + 0x38], r14
btr r9d, 0x9f
movzx r9d, r15w
mov r8b, al
mov r9d, esi
btr r8w, di
btc r8d, 6
mov qword [rsp + 0x30], r14
test r8, rax
btr r8w, r15w
ror r8w, cl
mov r8, rbx
mov dword [rsp + 0x28], ebp
test dl, ah
cmc
xor edx, edx
cmp spl, spl
xor ecx, ecx
jmp 0x1404d8b40
mov qword [rsp + 0x20], rax
jmp 0x1404d8b4a
call fcn.1404c912f
test eax, eax
jmp 0x1404d8b56
je 0x1404d8b78
mov rsi, rdi
xchg dil, dil
movsx di, dl
movzx di, r9b
mov rdi, r14
jmp 0x1404d8b73
jmp 0x1404d8b81
mov rsi, r14
movsx rcx, dx
xchg cl, ch
mov rcx, rdi
jmp 0x1404d8b89
call fcn.1404c8fed
jmp 0x1404d8b96
mov rsi, r14
test rbx, rbx
jmp 0x1404d8b9e
je 0x1404d8bb2
mov rcx, rbx
jmp 0x1404d8bac
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
sar ax, cl
mov rax, rsi
movsxd r14, r8d
mov rsi, qword [rsp + 0x60]
rcr bpl, cl
mov rbp, qword [rsp + 0x58]
adc rdi, rbx
shr r14d, 0xfc
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
movsx r14, r11w
pop r14
ret
Function at 0x1404d8be4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
test r14d, r15d
cmp r12d, 0x6f3132b2
sub rsp, 0x20
jmp 0x1404d8c07
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
stc
bswap bx
btr bx, 0x49
mov rbx, rax
test rax, rax
je 0x1404d8cd3
mov rbp, rax
stc
cmp word [rax], si
jmp 0x1404d8c30
je 0x1404d8c6a
or rax, 0xffffffffffffffff
jmp 0x1404d8c3f
inc rax
cmc
cmp word [rbp + rax*2], si
jmp 0x1404d8c4d
jne 0x1404d8c3f
lea rbp, [rbp + rax*2]
cmp r10, rbx
add rbp, 2
clc
cmp word [rbp], si
jne 0x1404d8c36
sub rbp, rbx
add rbp, 2
movzx ecx, cx
test esi, 0xb202c6e
shl cl, cl
sar rbp, 1
add rbp, rbp
mov rcx, rbp
jmp 0x1404d8c8a
call fcn.1404c9076
mov rdi, rax
test r13w, r15w
test rax, rax
jmp 0x1404d8c9e
je 0x1404d8cbe
mov r8, rbp
mov cx, r13w
mov rdx, rbx
mov rcx, rax
jmp 0x1404d8cb6
call fcn.1404a31ea
mov rsi, rdi
sub ecx, ecx
jmp 0x1404d8cc5
call fcn.1404c8fed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
stc
btr di, sp
cmc
mov rax, rsi
or si, dx
bsf edi, r8d
mov rsi, qword [rsp + 0x40]
sbb dil, 0x41
mov rbp, qword [rsp + 0x38]
not rdi
add rsp, 0x20
movzx edi, sp
mov di, r14w
pop rdi
jmp 0x1404d8d0a
ret
Function at 0x1404dbb97
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cwde
lahf
movzx ax, bl
mov qword [rsp + 0x18], rbp
push rsi
seta al
cbw
push rdi
cdqe
push r14
movsx ax, r11b
mov eax, 0x1450
jmp 0x1404dbbc4
call fcn.140448245
sub rsp, rax
movsx r14d, r13w
mov rax, qword [0x1400b7288]
shl esi, 0x9f
mov rbp, 0x7ace3512
xor rax, rsp
mov qword [rsp + 0x1440], rax
sal rax, 0xe2
cmp spl, 0x68
sar eax, cl
movsxd r10, edx
sub sil, 0x24
btc di, 0x5c
mov rdi, rcx
mov rax, r10
mov cl, 0x1f
cdq
mov ebp, r9d
movzx r14d, dx
add r14b, 0xd
sar rax, 6
xchg dx, si
lea rcx, [0x1400ba940]
add r14b, r13b
bsf rdx, rsp
or r14b, r13b
and r10d, 0x3f
and dh, 0xe1
or r14d, edi
rcl sil, cl
add rbp, r8
neg sil
mov rsi, r8
mov rax, qword [rcx + rax*8]
btr r14w, 0x14
shl dh, 0xc8
lea rdx, [r10 + r10*8]
not r14b
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
test bpl, 0x90
cmp r8w, r12w
mov qword [rdi], rax
cmp r15b, 0xdc
test dx, 0x381f
mov dword [rdi + 8], eax
jmp 0x1404dbc7b
cmp r8, rbp
jae 0x1404dbd75
lea rbx, [rsp + 0x40]
jmp 0x1404dbc91
cmp rsi, rbp
jmp 0x1404dbc99
jae 0x1404dbcea
mov al, byte [rsi]
jmp 0x1404dbca6
inc rsi
clc
cmp al, 0xa
jmp 0x1404dbcb1
jne 0x1404dbcca
inc dword [rdi + 8]
jmp 0x1404dbcbf
mov byte [rbx], 0xd
inc rbx
jmp 0x1404dbcca
mov byte [rbx], al
inc rbx
clc
xor ax, r15w
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x1404dbce4
jb 0x1404dbc91
and qword [rsp + 0x20], 0
bsf r9w, r12w
lea rax, [rsp + 0x40]
sub ebx, eax
not r9b
movzx r8w, bl
movsx r8, cx
lea r9, [rsp + 0x30]
cdq
bswap r8w
mov r8d, ebx
xchg rdx, rdx
movsx rcx, r15w
not dl
lea rdx, [rsp + 0x40]
xchg cx, cx
mov rcx, r14
jmp 0x1404dbd2e
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dbd3b
je 0x1404dbd67
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp r10, rdx
cmc
cmp eax, ebx
jmp 0x1404dbd53
jb 0x1404dbd75
cmp rsi, rbp
jb 0x1404dbc84
jmp 0x1404dbd75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
sar cl, cl
rcr rcx, cl
clc
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
stc
jmp 0x1404dbd86
xor rcx, rsp
call fcn.14049f5cb
lea r11, [rsp + 0x1450]
movsx bp, dil
mov rbx, qword [r11 + 0x20]
movzx r14w, r11b
mov sil, bpl
mov rbp, qword [r11 + 0x30]
xchg sil, sil
mov r14b, sil
mov rsp, r11
pop r14
sete sil
bswap rdi
pop rdi
pop rsi
jmp 0x1404dbdc4
ret
Function at 0x1404dbdc5
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
bswap ax
cdqe
mov qword [rsp + 0x18], rbp
push rsi
cmovo ax, bp
push rdi
cmovns eax, r12d
jmp 0x1404dbdf2
push r14
mov eax, 0x1450
jmp 0x1404dbdfe
call fcn.140448245
sub rsp, rax
mov rax, qword [0x1400b7288]
bsf r14w, bx
xor rax, rsp
sub r10b, dil
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
shld ax, bx, 0x62
sal r14d, cl
movzx ax, r14b
mov rax, r10
sub cx, r14w
test r8b, r15b
setnp r14b
mov ebp, r9d
inc sil
sar rax, 6
rcr r14w, cl
movsx rsi, di
lea rcx, [0x1400ba940]
and r10d, 0x3f
btr rsi, 0x99
cdq
lea rbp, [rbp + r8]
ror sil, 0xbd
mov rsi, r8
movsxd rdx, ebp
mov rax, qword [rcx + rax*8]
movzx edx, r11w
rol r14b, cl
mov r14b, 0xd2
lea rdx, [r10 + r10*8]
btc r14, r15
mov r14, qword [rax + rdx*8 + 0x28]
cmc
test r8, 0x4cdb2759
test bp, r10w
xor eax, eax
test r10b, 0x44
mov qword [rdi], rax
jmp 0x1404dbeaa
mov dword [rdi + 8], eax
test ax, 0x1d49
cmp r8, rbp
jae 0x1404dbfb0
lea rbx, [rsp + 0x40]
stc
cmc
cmp rsi, rbp
jmp 0x1404dbec9
jae 0x1404dbf2d
movzx eax, word [rsi]
cmc
jmp 0x1404dbed9
add rsi, 2
cmp r9b, 0xca
cmp ax, 0xa
jmp 0x1404dbeea
jne 0x1404dbf08
add dword [rdi + 8], 2
mov ecx, 0xd
cmp esi, r12d
mov word [rbx], cx
clc
add rbx, 2
clc
cmp cl, r10b
mov word [rbx], ax
test r8b, 0xa2
rcr ah, cl
add rbx, 2
cwde
btc eax, 0x37
lea rax, [rsp + 0x143e]
stc
cmc
cmp rbx, rax
jb 0x1404dbec1
and qword [rsp + 0x20], 0
bt cx, ax
mov r8w, 0x6dfc
lea rax, [rsp + 0x40]
bswap ecx
sub rbx, rax
btc cx, sp
bt dx, r9w
lea r9, [rsp + 0x30]
sar rbx, 1
inc r8
lea rdx, [rsp + 0x40]
inc cx
add ebx, ebx
setge r8b
mov rcx, r14
jmp 0x1404dbf70
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404dbfa8
mov eax, dword [rsp + 0x30]
clc
add dword [rdi + 4], eax
cmp si, r12w
cmp eax, ebx
jmp 0x1404dbf94
jb 0x1404dbfb0
cmp rsi, rbp
jb 0x1404dbeba
jmp 0x1404dbfb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
not cx
mov rcx, qword [rsp + 0x1440]
stc
xor rcx, rsp
call fcn.14049f5cb
lea r11, [rsp + 0x1450]
bswap rsi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
not di
mov rsp, r11
xchg di, r14w
pop r14
pop rdi
movzx si, r14b
pop rsi
jmp 0x1404dbff2
ret
Function at 0x1404dcd1e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movsd qword [rsp + 0x20], xmm3
cdqe
setne al
movsd qword [rsp + 0x18], xmm2
push rbx
btr eax, 0xec
movzx eax, r10w
or ah, 0xfa
sub rsp, 0x50
lea r9, [0x1400c6cb0]
bt bx, 0x7f
cdqe
btr bx, 0xe9
mov ebx, ecx
xor al, r9b
sar ax, 0x93
mov rax, r9
cmp cx, 0x46a2
sub r8d, r8d
cmp dword [rax], edx
jmp 0x1404dcd6d
je 0x1404dcda9
inc r8d
clc
lea rcx, [0x1400c6e80]
clc
cmc
add rax, 0x10
cmp r9, 0x16aa619d
cmp r8w, r15w
cmp rax, rcx
jmp 0x1404dcd97
jl 0x1404dcd66
xor eax, eax
jmp 0x1404dcda4
jmp 0x1404dcdc8
movsxd rax, r8d
cmp r12w, 0x7fe6
rol cx, cl
lea rax, [rax + rax]
bts edx, edi
bsf cx, di
rcr edx, 0xa7
mov rax, qword [r9 + rax*8 + 8]
mov rcx, qword [rsp + 0x88]
rcl dl, cl
mov edx, 0xffc0
test ch, 0x4a
jmp 0x1404dcddf
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1404dce92
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
not eax
cwde
mov eax, dword [rsp + 0x74]
jmp 0x1404dce01
mov dword [rsp + 0x34], eax
mov ax, 0x7316
movzx rax, di
cbw
mov eax, dword [rsp + 0x78]
jmp 0x1404dce18
mov dword [rsp + 0x38], eax
not al
mov eax, dword [rsp + 0x7c]
jmp 0x1404dce27
mov dword [rsp + 0x3c], eax
cwde
cdqe
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x40], eax
not ax
mov eax, dword [rsp + 0x84]
jmp 0x1404dce48
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x20], ebx
jmp 0x1404dce55
call fcn.1404da681
lea rcx, [rsp + 0x20]
jmp 0x1404dce64
call fcn.14027ce78
test eax, eax
jmp 0x1404dce70
jne 0x1404dce82
mov ecx, ebx
jmp 0x1404dce7d
call fcn.1404dc7bc
movsd xmm0, qword [rsp + 0x40]
jmp 0x1404dce8d
jmp 0x1404dceb4
call fcn.1404da681
mov ecx, ebx
jmp 0x1404dce9e
call fcn.1404dc7bc
movsd xmm0, qword [rsp + 0x80]
movzx bx, r10b
ror bl, 0xd8
add rsp, 0x50
movzx rbx, di
pop rbx
jmp 0x1404dcec2
ret

Function at 0x1404df8f3
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
cmp r13b, r14b
cwd
sub rsp, 0x20
movsx bx, r9b
mov rbx, rcx
lea r9, [0x1400c8e90]
cmc
sub ecx, ecx
mov r8w, dx
movzx dx, r10b
lea r8, [0x1400c8e88]
movzx edx, r15w
movzx rdx, r12w
movsx dx, r13b
lea rdx, [0x1400cfb70]
jmp 0x1404df939
call fcn.1404dfbf5
test rax, rax
jmp 0x1404df946
je 0x1404df96c
mov rcx, rbx
movsx ebx, r8w
bts ebx, r12d
sbb bh, 0xb2
add rsp, 0x20
movsx ebx, bx
xchg bx, bx
pop rbx
jmp qword [case.0x1404cb1ca.0]
add rsp, 0x20
movzx bx, r14b
movsx ebx, ax
cmova bx, r15w
pop rbx
jmp 0x1404df983
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404dfa9b
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
test dl, 3
push rdi
sub rsp, 0x20
setg bl
bswap r9w
xchg dil, r8b
mov rbx, rdx
lea r9, [0x1400c8ea8]
movzx r8d, r15w
movsx edx, r11w
mov edi, ecx
lea rdx, [0x1400cf748]
movsx r8d, cx
jmp 0x1404dfad6
mov ecx, 3
movzx r8d, bx
bswap r8
lea r8, [0x1400c8ea0]
jmp 0x1404dfaee
call fcn.1404dfbf5
mov rdx, rbx
btc rcx, 0x87
xor ecx, r14d
mov ecx, edi
test rax, rax
jmp 0x1404dfb08
je 0x1404dfb19
call qword [case.0x1404cb1ca.0]
jmp 0x1404dfb1f
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
cmc
add rsp, 0x20
movsxd rdi, esi
jmp 0x1404dfb31
pop rdi
jmp 0x1404dfb37
ret
Function at 0x1404e1282
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
and r8w, 0x105
xor r9d, r9d
movsx r8d, r13w
mov r8, rcx
stc
test edx, edx
jmp 0x1404e129f
jne 0x1404e1306
mov rdx, rcx
test al, r8b
and r8d, 0xf
and rdx, 0xfffffffffffffff0
cmc
or r10d, 0xffffffff
xorps xmm0, xmm0
mov ecx, r8d
shl r10d, cl
jmp 0x1404e12c6
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and eax, r10d
jne 0x1404e12f3
add rdx, 0x10
jmp 0x1404e12e0
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
test eax, eax
je 0x1404e12d7
bsf eax, eax
cmp rsp, r9
add rax, rdx
jmp 0x1404e1301
jmp 0x1404e144f
cmp dword [reloc.d2d1.dll_Ordinal_1], 2
jmp 0x1404e1312
jge 0x1404e148a
movzx eax, dl
cmp cx, si
ror r11w, 3
or r10d, 0xffffffff
shl r11b, cl
movsxd r11, edi
mov ecx, eax
clc
dec r11
ror r11b, cl
mov r11, r8
shl ecx, 8
and r11, 0xfffffffffffffff0
cmp al, r12b
or ecx, eax
and r8d, 0xf
movzx rax, r9w
movzx eax, r8w
mov eax, r10d
jmp 0x1404e1359
movd xmm0, ecx
mov ecx, r8d
jmp 0x1404e1365
pshuflw xmm1, xmm0, 0
xorps xmm0, xmm0
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm0
shl r10d, cl
jmp 0x1404e137e
pshufd xmm2, xmm1, 0
movdqa xmm0, xmm2
shl eax, cl
jmp 0x1404e138e
pcmpeqb xmm0, xmmword [r11]
pmovmskb edx, xmm0
and edx, r10d
cmp r9w, 0x296a
test bpl, bl
test r8b, 0xe
and ebx, eax
jne 0x1404e13fa
bsr ecx, edx
jmp 0x1404e13b7
xorps xmm1, xmm1
movdqa xmm0, xmm2
add rcx, r11
jmp 0x1404e13c6
test edx, edx
jmp 0x1404e13cd
cmovne r9, rcx
clc
jmp 0x1404e13d7
add r11, 0x10
jmp 0x1404e13e0
pcmpeqb xmm1, xmmword [r11]
pcmpeqb xmm0, xmmword [r11]
pmovmskb ebx, xmm1
pmovmskb edx, xmm0
test ebx, ebx
je 0x1404e13af
mov eax, ebx
btr cx, r12w
clc
movzx rcx, si
neg eax
and eax, ebx
dec eax
and edx, eax
sar eax, cl
bsr ecx, edx
rol bl, 0x5a
and rax, 0x6b0d1a6f
shl bx, 0x90
add rcx, r11
mov bx, 0x42c9
xor bl, 0x59
btc bx, 0xd8
test edx, edx
mov bl, 0
bswap ax
seta bl
cmovne r9, rcx
bswap rbx
movzx bx, dl
mov rax, r9
cmovae ebx, r13d
movsxd rbx, eax
mov rbx, qword [rsp + 8]
jmp 0x1404e1459
ret
movsx eax, byte [r8]
clc
jmp 0x1404e1464
cmp eax, edx
jmp 0x1404e146b
cmove r9, r8
jmp 0x1404e1474
cmp byte [r8], 0
jmp 0x1404e147d
je 0x1404e1445
inc r8
cmp r9b, r8b
cmc
test r8b, 0xf
jne 0x1404e145a
movzx eax, dl
movd xmm0, eax
pcmpistri xmm0, xmmword [r8], 0x40
jae 0x1404e14ba
movsxd r9, ecx
add r9, r8
jmp 0x1404e14b3
pcmpistri xmm0, xmmword [r8], 0x40
je 0x1404e1445
add r8, 0x10
jmp 0x1404e14c9
jmp 0x1404e149b
Function at 0x1404e3bff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
test r14b, 0x15
mov r10d, ecx
cmp al, bh
clc
test r13b, 0xdf
test rdx, rdx
jmp 0x1404e3c1d
jne 0x1404e3c47
call fcn.1404b5034
mov ebx, 0x16
mov dword [rax], ebx
jmp 0x1404e3c34
call fcn.1404b5d4e
mov eax, ebx
rol bx, 0x5e
rcr bl, cl
add rsp, 0x30
pop rbx
ret
test r8, r8
jmp 0x1404e3c4f
je 0x1404e3c23
movzx ecx, byte [rsp + 0x60]
cmp spl, bpl
mov word [rdx], ax
bt ax, bx
rcl ah, cl
btr ax, r12w
lea rax, [rcx + 1]
cmc
stc
cmp r8, rax
jmp 0x1404e3c79
ja 0x1404e3c93
call fcn.1404b5034
mov ebx, 0x22
jmp 0x1404e3c8e
jmp 0x1404e3c2d
lea eax, [r9 - 2]
rcl ebx, 0x25
sar bl, 0x89
movzx ebx, cx
mov ebx, 0x22
test r10d, 0x43542cc
cmp eax, ebx
jmp 0x1404e3cb3
ja 0x1404e3c23
mov byte [rsp + 0x60], cl
mov ecx, r10d
not ebx
add rsp, 0x30
pop rbx
jmp 0x1404e3ccc
jmp 0x1404e3cd1
mov qword [rsp + 8], rbx
rcr bl, cl
stc
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
shl rbx, 0x2e
push rdi
cmovle r11w, r11w
test bp, di
shld ebx, esi, 0x2f
push r14
dec r11b
add rbp, 0x3dc84d8f
push r15
rol r10b, 0xa2
btc r11d, r8d
sub rsp, 0x20
adc r10w, ax
xor r15d, r15d
neg r10d
btr rbx, 8
mov ebp, r9d
mov rdi, r8
inc bl
rol r11w, cl
or r11w, 0x247d
mov r11, rdx
cmp r15b, cl
bt r10, 9
mov r10, rdx
rcl rbx, cl
xchg bh, bh
mov ebx, r15d
test r8w, 0x6232
cmc
cmp byte [rsp + 0x60], r15b
jmp 0x1404e3d56
je 0x1404e3d76
lea eax, [r15 + 0x2d]
ror r8, cl
or r10b, 0x50
neg ecx
mov word [rdx], ax
lea ebx, [rax - 0x2c]
lea r10, [rdx + 2]
bswap r9d
mov r8, r10
bt ax, 0x31
dec r14b
xor edx, edx
btc ax, 0xb5
lea rsi, [r10 + 2]
xor r14w, 0x164e
sar r14b, cl
mov eax, ecx
mov r9, r10
div ebp
add cl, 0x79
movsxd rcx, eax
mov ecx, eax
cmovns r14w, r8w
cmp edx, 9
xchg r14b, r14b
mov eax, 0x57
lea r14d, [rax - 0x27]
jmp 0x1404e3dbd
cmovbe ax, r14w
jmp 0x1404e3dc7
inc rbx
cmp spl, sil
test r13b, 7
add ax, dx
stc
cmp dil, 7
mov word [r10], ax
jmp 0x1404e3de4
test ecx, ecx
jmp 0x1404e3deb
je 0x1404e3e02
mov r10, rsi
cmp rbx, rdi
jmp 0x1404e3dfc
jb 0x1404e3d81
cmp rbx, rdi
jb 0x1404e3e3b
mov word [r11], r15w
jmp 0x1404e3e14
call fcn.1404b5034
mov ebx, 0x22
jmp 0x1404e3e23
mov dword [rax], ebx
jmp 0x1404e3e2a
call fcn.1404b5d4e
mov eax, ebx
jmp 0x1404e3e36
jmp 0x1404e3e6a
mov word [rsi], r15w
movzx eax, word [r8]
test ecx, eax
movzx ecx, word [r9]
clc
mov word [r9], ax
sub r9, 2
cmc
mov word [r8], cx
clc
add r8, 2
cmp r8, r9
jb 0x1404e3e3f
xor eax, eax
inc rsi
mov rbx, qword [rsp + 0x40]
dec r14w
movsx si, al
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
sub r14b, cl
shrd r15d, edx, 0xc8
bt r14w, r9w
add rsp, 0x20
bswap r15
pop r15
mov rdi, 0x2b0472f1
movsxd r14, edi
mov r14w, ax
pop r14
setns dil
movzx di, spl
pop rdi
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005440]
mov dword [rax], 1
mov rax, qword [0x140005450]
mov dword [rax], 1
mov rax, qword [0x140005460]
mov dword [rax], 1
mov rax, qword [0x1400053f0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001b20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x1400027f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140008108]
test eax, eax
je 0x14000288a
lea rax, [0x1400080e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140008110]
mov qword [rbp - 8], rax
jmp 0x14000286e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002862
cmp qword [rbp - 0x10], 0
je 0x140002862
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002828
lea rax, [0x1400080e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000288b
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140002990
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400029b8
mov eax, 0
jmp 0x140002a06
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400029e1
mov eax, 0
jmp 0x140002a06
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002a01
mov eax, 0
jmp 0x140002a06
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140002a0c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140002a8a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002a81
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002a81
mov rax, qword [rbp - 8]
jmp 0x140002a9f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002a54
mov eax, 0
add rsp, 0x20
pop rbp
ret