joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404c5f11
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
movsx ebx, sp
mov qword [r11 + 0x20], r9
mov dword [rsp + 0x10], edx
movsx rbx, si
push rbp
movsx rax, dx
adc ebx, eax
push rsi
push rdi
clc
push r12
push r13
test r10b, r14b
cmp al, sil
mov bl, 0xe1
push r14
push r15
ror bh, cl
rol r13w, 0x4b
ror ax, 0x32
sub rsp, 0x20
mov rax, qword [rcx + 8]
dec r12w
setge r12b
sub bpl, bpl
sub si, 0x2da0
and sil, r12b
bsr r12w, r11w
sub r14b, r14b
or r13w, 0x183e
add r15b, 0x74
bts r13d, r8d
mov qword [r11 + 8], rax
inc r12
btr r12w, 0x13
xor edi, edi
ror si, 0xc8
xor r15b, 0x75
shl bh, cl
mov r12, r9
mov r13d, r8d
shr rbx, 0x55
mov rbx, rcx
lea rsi, [rax - 1]
movzx r15d, bp
adc r15w, 0x7175
mov r15, rsi
test di, 0x546a
cmp r8, 0x55be4393
cmp dword [rcx], edi
jmp 0x1404c5fc7
jle 0x1404c6067
mov r12d, dword [r11 + 0x10]
test dil, r10b
cmp edi, r12d
jmp 0x1404c5fdc
jne 0x1404c5fec
mov rsi, rax
sar bpl, cl
mov bpl, 1
stc
cmp edi, r13d
jmp 0x1404c5ff4
jne 0x1404c6007
mov r15, rax
sbb r14b, r9b
mov r14b, 1
test sil, 0x8f
test bpl, bpl
jmp 0x1404c600f
je 0x1404c601e
test r14b, r14b
jne 0x1404c6054
lea rdx, [rsp + 0x60]
movzx cx, sil
movsxd rcx, eax
mov cx, si
mov rcx, rbx
call fcn.140132bbc
inc edi
cmc
test bpl, 0x3d
cmp edi, dword [rbx]
jge 0x1404c6054
mov rax, qword [rsp + 0x60]
jmp 0x1404c604f
jmp 0x1404c5fd4
mov r12, qword [rsp + 0x78]
sbb r13b, 0x5f
bts ax, r14w
rcl r14w, 0xb
mov rax, qword [r12]
bts rcx, r11
test r12w, 0x30
mov qword [r12 + 8], rsi
xadd bpl, cl
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
rcr esi, cl
ror dil, 0xbb
movups xmmword [rax + 0x10], xmm1
cmovns r12w, r12w
cmp rbp, r10
shr cx, 0x5b
mov rax, qword [rsp + 0x80]
or r12b, 0x13
bts ebp, r11d
sbb r14b, 0xe8
mov rcx, qword [rax]
clc
adc r12w, 0x26ec
mov qword [rax + 8], r15
xchg r13b, dil
jmp 0x1404c60cb
movups xmm0, xmmword [rbx]
rol rbp, 0xcc
movzx rsi, ax
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movzx r13d, r10w
sar dil, cl
sbb r12b, bl
mov rbx, qword [rsp + 0x70]
dec r12b
movups xmmword [rcx + 0x10], xmm1
test r14, 0x27ea51ef
test si, sp
sbb sil, cl
add rsp, 0x20
movzx r13w, r14b
pop r15
bswap ebp
movsx r12, bx
jmp 0x1404c6116
pop r14
movzx rsi, r15w
movsx r13d, sp
pop r13
pop r12
movzx edi, bx
movsx esi, ax
not bpl
pop rdi
movsx rbp, r11w
setbe bpl
pop rsi
pop rbp
jmp 0x1404c613d
ret
Function at 0x1404ccc95
Capabilities:
Get thread local storage value

Disassembly:
push rbx
inc r9b
sar r9b, cl
sub rsp, 0x20
mov ebx, ecx
mov dl, bpl
mov cx, 0x427b
lea r9, [0x1400c63d0]
movsx ecx, r8w
mov ecx, 5
movzx rdx, sp
movsxd rdx, edi
movzx r8w, r15b
lea r8, [0x1400c63c8]
cqo
setg dl
movsx rdx, sp
lea rdx, [0x1400cf758]
jmp 0x1404ccce2
call fcn.1404cdc06
mov ecx, ebx
cmp ebp, 0x32f91c0b
stc
test rax, rax
jmp 0x1404cccf8
je 0x1404ccd0f
add rsp, 0x20
pop rbx
jmp 0x1404ccd08
push qword [0x1400b8d90]
ret
add rsp, 0x20
bswap ebx
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404ccd1d
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movzx r9, r8w
push rdi
xchg r9w, r8w
setg r8b
and r8w, r10w
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c63d8]
setns r8b
jmp 0x1404ccd4f
mov edi, ecx
lea rdx, [0x1400cf748]
mov ecx, 6
xchg r8d, r8d
movsx r8d, di
lea r8, [0x1400c63d0]
jmp 0x1404ccd70
call fcn.1404cdc06
mov rdx, rbx
bts ecx, r11d
shrd rcx, rdi, 0xe7
neg cx
mov ecx, edi
cmc
test spl, 0x4d
stc
test rax, rax
jmp 0x1404ccd94
je 0x1404ccda5
call qword [0x1400b8d90]
jmp 0x1404ccdab
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
xchg di, di
mov dil, 0x64
not di
pop rdi
jmp 0x1404ccdc3
ret

Function at 0x1404ccf59
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
bts rbx, r12
bsf bx, r13w
rcr rbx, cl
mov qword [rsp + 0x18], rsi
dec esi
bt si, ax
push rdi
shr di, 0xcd
and di, bx
bsr edi, ebx
sub rsp, 0x30
mov dil, spl
cmovp ebp, eax
bswap ebx
mov ebx, r9d
setb sil
movsx rsi, si
mov r9b, 0x32
mov rdi, r8
movsx r8d, bx
bswap bp
mov esi, edx
movzx rdx, r9w
lea r9, [0x1400c63e8]
cqo
movsx edx, sp
mov rbp, rcx
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
jmp 0x1404ccfd3
mov ecx, 0xb
call fcn.1404cdc06
mov rcx, rbp
test r11w, r11w
stc
jmp 0x1404ccfea
test rax, rax
je 0x1404cd00e
mov r9d, ebx
mov r8, rdi
movsx edx, cx
mov edx, esi
jmp 0x1404cd003
call qword [0x1400b8d90]
jmp 0x1404cd039
xor edx, edx
jmp 0x1404cd015
call fcn.1404cd6a9
mov ecx, eax
bswap rdx
movzx r9d, sp
mov r9d, ebx
cdq
mov r8, rdi
movzx edx, bp
cmovbe dx, ax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
btr esi, r8d
bsf edi, r13d
adc sil, r9b
mov rsi, qword [rsp + 0x50]
sal rdi, cl
add dil, 0x2b
add rsp, 0x30
xchg dil, dil
mov rdi, r12
not edi
pop rdi
jmp 0x1404cd06c
ret
Function at 0x1404cd400
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
shr bh, 0xb6
clc
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xadd esi, ebp
movzx rsi, bx
push rdi
movsx esi, sp
movsx rbx, r9w
sub rsp, 0x50
movsx esi, di
jmp 0x1404cd42e
mov ebx, r9d
movzx di, r12b
movsxd rsi, r8d
mov rdi, r8
jmp 0x1404cd44b
mov esi, edx
lea r9, [0x1400c6410]
xchg bpl, dl
movzx dx, dil
mov rbp, rcx
jmp 0x1404cd46a
lea r8, [0x1400c6408]
lea rdx, [0x1400cf1c0]
mov ecx, 0x14
jmp 0x1404cd482
call fcn.1404cdc06
test rax, rax
je 0x1404cd528
mov r8, qword [rsp + 0xa0]
jmp 0x1404cd4a1
mov r9d, ebx
cmovbe rcx, rdi
mov rcx, qword [rsp + 0x98]
movsx rdx, r10w
mov edx, esi
mov qword [rsp + 0x40], r8
movsx r8, sp
movzx r8d, dx
mov r8, rdi
jmp 0x1404cd4cb
mov qword [rsp + 0x38], rcx
movzx cx, r14b
mov rcx, qword [rsp + 0x90]
jmp 0x1404cd4e2
mov qword [rsp + 0x30], rcx
xchg cx, cx
setae ch
movsx cx, al
mov ecx, dword [rsp + 0x88]
jmp 0x1404cd4fd
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x80]
jmp 0x1404cd50e
mov qword [rsp + 0x20], rcx
xchg cl, cl
mov rcx, rbp
jmp 0x1404cd51d
call qword [0x1400b8d90]
jmp 0x1404cd582
sub edx, edx
mov rcx, rbp
jmp 0x1404cd532
call fcn.1404cd6a9
mov ecx, eax
rdtsc
cdq
bswap ax
mov r9d, ebx
jmp 0x1404cd54f
mov eax, dword [rsp + 0x88]
setae dl
mov r8, rdi
mov dword [rsp + 0x28], eax
mov ax, 0x6d1f
cqo
rdtsc
mov edx, esi
mov rax, qword [rsp + 0x80]
jmp 0x1404cd577
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov rbx, qword [rsp + 0x60]
xor dil, r10b
mov rbp, qword [rsp + 0x68]
ror edi, 0x12
cmovb di, bp
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
movzx di, dl
movsx rdi, si
xchg edi, edi
pop rdi
jmp 0x1404cd5af
ret

Function at 0x1404d1773
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bts r8w, di
add bx, 0x3e92
xchg r8w, bx
mov qword [rsp + 0x10], rbp
rcl r8b, cl
shl bpl, cl
rol r8b, 0xea
mov qword [rsp + 0x18], rsi
not bp
bt bp, si
push rdi
bts rsi, rbx
btr rbx, 0x5e
shl bpl, cl
sub rsp, 0x20
lea rbx, [rcx + 0x18]
cmp rsp, rsi
movzx si, r11b
mov rsi, rcx
mov ebp, 0x101
adc r8, rbx
rol r8b, cl
xor r8b, r15b
mov rcx, rbx
mov r8d, ebp
clc
jmp 0x1404d17dc
xor edx, edx
jmp 0x1404d17e3
call fcn.1404a65a5
xor eax, eax
lea rdi, [rsi + 0xc]
movzx cx, dil
mov qword [rsi + 4], rax
mov ecx, 6
jmp 0x1404d1801
mov qword [rsi + 0x220], rax
movzx eax, ax
jmp 0x1404d1810
rep stosw word [rdi], ax
lea rdi, [0x1400b77b0]
sub rdi, rsi
setnp al
mov al, byte [rdi + rbx]
jmp 0x1404d1828
mov byte [rbx], al
jmp 0x1404d182f
inc rbx
clc
sub rbp, 1
jmp 0x1404d183c
jne 0x1404d1820
lea rcx, [rsi + 0x119]
movsx edx, r8w
cqo
mov edx, 0x100
dec al
not al
mov al, byte [rcx + rdi]
mov byte [rcx], al
jmp 0x1404d1862
inc rcx
sub rdx, 1
jne 0x1404d1858
mov rbx, qword [rsp + 0x30]
sar bpl, cl
test bp, 0x2eb7
mov rbp, qword [rsp + 0x38]
sal sil, 0xb9
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movzx edi, di
bswap di
pop rdi
ret
Function at 0x1404d49a4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
sub al, 0xb4
rcr rax, cl
inc al
mov qword [r11 + 8], rbx
lahf
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
jmp 0x1404d49c8
push r14
btr bp, r9w
cbw
sub rsp, 0x50
mov rax, qword [rsp + 0x80]
not bpl
movsxd rbp, esp
mov bp, 0x31de
mov rbp, r8
cmovno rdi, r13
mov rcx, qword [rcx]
mov r8w, 0x25cc
movsx edi, r11w
lea r8, [r11 - 0x18]
mov rdi, rdx
movzx rdx, sp
movzx edx, ax
mov dl, dil
mov qword [r11 - 0x38], rax
jmp 0x1404d4a17
mov edx, dword [rsp + 0x88]
jmp 0x1404d4a23
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x1404d4a30
call fcn.1404e3fea
mov r14d, dword [rsp + 0x44]
sbb bx, 0x621a
rcr ch, cl
xor r8d, r8d
cqo
cmp dword [rsp + 0x40], 0x2d
movzx ecx, r9w
not r9b
movsx rdx, cx
mov r9d, eax
cwde
mov eax, dword [rsp + 0xa0]
mov rdx, rbp
xchg cl, r8b
mov bh, 0xe8
sete r8b
test r8b, 0x8a
cmp r8, 0x328b3c9d
mov dword [rsp + 0x28], eax
sub bl, cl
xor bl, 0x50
btr bx, si
sub rdx, r8
movzx cx, r10b
movsx bx, dh
bswap ecx
mov dword [rsp + 0x20], r9d
movsx ebx, r9w
dec r14d
cmc
lea r9, [rsp + 0x40]
shl cx, 0xac
or rcx, 0x425d1391
cmp rbp, 0xffffffffffffffff
movsx cx, dil
cmovg ecx, r11d
lea rbx, [r8 + rdi]
mov r8d, dword [rsp + 0x88]
movsx cx, dl
bswap rcx
movsxd rcx, r10d
cmove rdx, rbp
mov rcx, rbx
jmp 0x1404d4ae0
call fcn.1404e3d01
test eax, eax
jmp 0x1404d4aec
je 0x1404d4aff
mov byte [rdi], 0
jmp 0x1404d4afa
jmp 0x1404d4c23
mov eax, dword [rsp + 0x44]
jmp 0x1404d4b08
dec eax
cmc
jmp 0x1404d4b10
cmp eax, 0xfffffffc
jmp 0x1404d4b18
jl 0x1404d4bb3
cmp eax, dword [rsp + 0x88]
jmp 0x1404d4b2a
jge 0x1404d4bb3
cmp r14d, eax
jmp 0x1404d4b38
jge 0x1404d4b5b
mov al, byte [rbx]
inc rbx
test al, al
jmp 0x1404d4b4a
jne 0x1404d4b3e
mov byte [rbx - 2], al
jmp 0x1404d4b5b
mov rax, qword [rsp + 0xa8]
cmovg r9, r9
lea r9, [rsp + 0x40]
mov r8b, 0x4c
movsx cx, r9b
movzx ecx, dx
mov r8d, dword [rsp + 0x88]
xchg cl, dh
movzx cx, r15b
mov rdx, rbp
movsx cx, r9b
mov qword [rsp + 0x28], rax
movzx rcx, r9w
mov rcx, rdi
jmp 0x1404d4b9f
mov byte [rsp + 0x20], 1
jmp 0x1404d4ba9
call fcn.1404d4670
jmp 0x1404d4c23
mov rax, qword [rsp + 0xa8]
mov cl, 0x8d
jmp 0x1404d4bc2
mov rdx, rbp
not ch
mov r9b, byte [rsp + 0x90]
movsx cx, bl
jmp 0x1404d4bda
mov rcx, rdi
movsx r8d, r8w
bswap r8w
mov r8d, dword [rsp + 0x88]
jmp 0x1404d4bf2
mov qword [rsp + 0x38], rax
bswap ax
lea rax, [rsp + 0x40]
mov byte [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x98]
jmp 0x1404d4c15
mov dword [rsp + 0x20], eax
jmp 0x1404d4c1e
call fcn.1404d3675
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
btr r14w, si
sub dil, cl
mov rdi, qword [rsp + 0x70]
inc r14b
add rsp, 0x50
pop r14
jmp 0x1404d4c48
ret
Function at 0x1404d982b
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sar bx, 0x6e
jmp 0x1404d983f
sub rsp, 0x20
ror ebx, cl
xor esi, esi
dec di
shr bl, 0x9f
xadd di, bx
mov rdi, rdx
bts bx, r10w
bts bx, r15w
btc bx, di
mov rbx, rcx
cmc
stc
test rcx, rcx
jmp 0x1404d986f
je 0x1404d9909
cmp word [rcx], si
jmp 0x1404d987d
je 0x1404d9909
lea rdx, [0x1400d1d08]
jmp 0x1404d988f
call fcn.140116ce4
test eax, eax
jmp 0x1404d989b
je 0x1404d9909
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404d98b0
call fcn.140116ce4
test eax, eax
jmp 0x1404d98bc
jne 0x1404d98f7
mov ecx, dword [rdi + 8]
setge dl
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d98e3
je 0x1404d993d
mov eax, dword [rsp + 0x30]
jmp 0x1404d98f2
jmp 0x1404d9960
mov rcx, rbx
jmp 0x1404d98ff
call fcn.1404e29e9
jmp 0x1404d9960
mov ecx, dword [rdi + 8]
movsx r8w, r9b
cdq
movsxd r8, ecx
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d992a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d9937
jne 0x1404d9949
xor eax, eax
jmp 0x1404d9944
jmp 0x1404d9960
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x1404d9954
jne 0x1404d9960
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1404d9970
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
bts bx, si
movsx ebx, r13w
movzx esi, cx
sub rsp, 0x20
bswap esi
movsxd rbx, esp
not sil
mov esi, edx
mov ebx, ecx
call fcn.1404cba92
mov ecx, ebx
shrd di, bp, 0x9f
lea r8, [rsp + 0x30]
and ecx, 0x3ff
bts r9w, r12w
mov r9d, 2
bts ecx, 0xa
jmp 0x1404d99c8
mov edx, 0x20000001
jmp 0x1404d99d5
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
cmc
test eax, eax
je 0x1404d9aa6
cmp ebx, dword [rsp + 0x30]
je 0x1404d9a97
test esi, esi
jmp 0x1404d99fb
je 0x1404d9a97
mov r9, qword [rdi + 0x98]
mov r8d, r10d
test r10w, 0x2c9f
shr cl, cl
clc
movzx edx, word [r9]
or al, sil
lea rcx, [r9 + 2]
sub al, 0x86
bts eax, eax
lea eax, [rdx - 0x41]
test r15b, 0x92
cmp ax, 0x19
jmp 0x1404d9a34
jbe 0x1404d9a4e
sub dx, 0x61
stc
cmp dx, 0x19
jmp 0x1404d9a48
ja 0x1404d9a6a
movzx edx, word [rcx]
jmp 0x1404d9a56
inc r8d
test rcx, rdx
add rcx, 2
jmp 0x1404d9a65
jmp 0x1404d9a24
or rcx, 0xffffffffffffffff
jmp 0x1404d9a73
inc rcx
cmp dx, dx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d9a83
jne 0x1404d9a73
cmp r8d, ecx
jmp 0x1404d9a91
je 0x1404d9aa6
mov eax, 1
jmp 0x1404d9aa1
jmp 0x1404d9ab4
sub eax, eax
or esi, r13d
movsx si, r14b
bt ebx, r9d
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test r9b, cl
movzx edi, bp
btr di, 0x56
add rsp, 0x20
movzx rdi, r9w
movzx di, spl
pop rdi
jmp 0x1404d9adc
ret
Function at 0x1404db1b0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
stc
test ebx, r13d
mov qword [rax + 8], rbx
jmp 0x1404db1cc
mov qword [rax + 0x10], rbp
test r14b, 0x51
test r10w, r14w
jmp 0x1404db1dd
mov qword [rax + 0x18], rsi
stc
mov qword [rax + 0x20], rdi
cmp r14, rsp
jmp 0x1404db1ee
push r14
sub rsp, 0x40
jmp 0x1404db1f9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
mov rbx, rax
test r14b, 0xd2
jmp 0x1404db20f
test rax, rax
je 0x1404db39d
mov rsi, rax
stc
test bh, 0x7b
cmp word [rax], r14w
jmp 0x1404db228
je 0x1404db261
or rax, 0xffffffffffffffff
inc rax
stc
cmp word [rsi + rax*2], r14w
jmp 0x1404db240
jne 0x1404db232
lea rsi, [rsi + rax*2]
add rsi, 2
clc
cmp r15, rax
cmp word [rsi], r14w
jmp 0x1404db25b
jne 0x1404db22e
mov qword [rsp + 0x38], r14
bswap r8w
test dl, 0x1a
sub rsi, rbx
cmovp r8w, r14w
mov qword [rsp + 0x30], r14
setb r9b
add rsi, 2
btr r9w, 9
jmp 0x1404db28d
sar rsi, 1
clc
mov r8, rbx
sar r9b, 0x8e
shr r9w, 0x2c
mov r9d, esi
cmc
test r9b, 0x5e
mov dword [rsp + 0x28], r14d
cmp r8b, al
test bp, 0x2bab
xor edx, edx
stc
test r10b, 0x33
test sp, bp
mov qword [rsp + 0x20], r14
jmp 0x1404db2cb
xor ecx, ecx
call fcn.1404cb883
movsxd rbp, eax
cmp r13w, 0x56f6
stc
cmp bx, r11w
test eax, eax
jmp 0x1404db2e7
je 0x1404db39d
mov rcx, rbp
jmp 0x1404db2f5
call fcn.1404cb7c2
mov rdi, rax
test edi, 0x49886389
test rax, rax
jmp 0x1404db30b
je 0x1404db385
mov qword [rsp + 0x38], r14
bsf r8, rcx
xadd r8w, r9w
bswap r8w
mov r9d, esi
adc r8w, 0x893
movsx r8w, cl
neg r8w
mov qword [rsp + 0x30], r14
movsx r8d, si
mov r8, rbx
stc
mov dword [rsp + 0x28], ebp
cmp r9b, r8b
xor edx, edx
test rdi, 0x40ea5535
cmc
jmp 0x1404db358
sub ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404db364
call fcn.1404cb883
test eax, eax
jmp 0x1404db370
je 0x1404db385
mov rsi, rdi
cmovo rdi, r10
mov rdi, r14
jmp 0x1404db390
mov rsi, r14
movsx cx, cl
movzx rcx, r11w
mov rcx, rdi
call fcn.1404cb744
jmp 0x1404db3a6
mov rsi, r14
test ah, cl
cmc
test dl, 0x6c
test rbx, rbx
jmp 0x1404db3ae
je 0x1404db3c2
mov rcx, rbx
jmp 0x1404db3bc
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
rcr r14w, 0xd9
mov rax, rsi
mov rsi, rsp
mov bpl, 0xa4
movzx r14, r11w
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
cmovl di, sp
rcl dil, 0xda
mov rdi, qword [rsp + 0x68]
movzx r14d, r10w
movzx r14w, spl
add rsp, 0x40
pop r14
jmp 0x1404db404
ret
Function at 0x1404db405
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmc
cmp r9b, 0x19
mov qword [rsp + 0x10], rbp
cmc
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
jmp 0x1404db424
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
mov rbx, rax
test r12b, 0xdd
jmp 0x1404db438
test rax, rax
jmp 0x1404db440
je 0x1404db50c
mov rbp, rax
cmc
jmp 0x1404db44f
cmp word [rax], si
je 0x1404db47e
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1404db45c
lea rbp, [rbp + rax*2]
add rbp, 2
cmc
cmp word [rbp], si
jne 0x1404db458
sub rbp, rbx
movzx cx, r8b
bts cx, dx
add rbp, 2
bsf cx, cx
sar rcx, cl
sar rbp, 1
xadd rcx, rcx
movsx ecx, di
add rbp, rbp
jmp 0x1404db4aa
mov rcx, rbp
jmp 0x1404db4b2
call fcn.1404cb7c2
mov rdi, rax
clc
cmp r8, r14
jmp 0x1404db4c3
test rax, rax
jmp 0x1404db4cb
je 0x1404db4f7
mov r8, rbp
setbe cl
mov rdx, rbx
jmp 0x1404db4e6
mov rcx, rax
call fcn.1404a5b19
mov rsi, rdi
cmp bx, 0x511b
clc
sub ecx, ecx
jmp 0x1404db4fe
call fcn.1404cb744
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rdi, 0x54ab04b9
stc
add rbp, 0x47922c4a
mov rsi, qword [rsp + 0x40]
shl bpl, cl
or bpl, 0xe3
movzx bp, r10b
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
not dil
jmp 0x1404db545
pop rdi
jmp 0x1404db54b
ret
Function at 0x1404de3c5
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cbw
movzx ax, dh
nop
mov qword [rsp + 0x18], rbp
movzx rax, r11w
movzx ax, cl
xchg al, ah
push rsi
movzx eax, r8w
movsxd rax, esp
cwde
push rdi
movzx rax, r8w
seto ah
mov al, 0x92
push r14
cdqe
mov rax, r14
mov eax, 0x1450
call fcn.14044aa15
sub rsp, rax
sub r14, 0x3b514939
mov rax, qword [0x1400b7288]
sal r10b, cl
shrd di, r8w, 0x27
xor rax, rsp
xor bpl, r8b
mov qword [rsp + 0x1440], rax
rol r14b, 0xc6
xor r10b, 0xc5
movsxd r10, edx
cmp bpl, al
mov rdi, rcx
shl dh, 0xa7
rcl sil, 0x5f
mov rax, r10
mov ebp, r9d
movsx rsi, r14w
bts cx, r12w
add rdx, r8
sar rax, 6
btc r14w, bx
ror ch, cl
lea rcx, [0x1400ba940]
cmc
shld r14d, ecx, 0x89
and r10d, 0x3f
shrd r14w, ax, 0x2f
cqo
add rbp, r8
mov rsi, r8
or r14b, bl
movzx r14d, ax
movsxd rdx, edi
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
btc r14, 0xea
mov r14, qword [rax + rdx*8 + 0x28]
clc
cmp bpl, r13b
xor eax, eax
stc
jmp 0x1404de4a9
mov qword [rdi], rax
cmp r15w, 0x6cb1
jmp 0x1404de4b7
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404de4c2
jae 0x1404de5a8
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jae 0x1404de533
mov al, byte [rsi]
jmp 0x1404de4dd
inc rsi
cmc
jmp 0x1404de4e6
cmp al, 0xa
jmp 0x1404de4ed
jne 0x1404de50b
inc dword [rdi + 8]
jmp 0x1404de4fb
mov byte [rbx], 0xd
jmp 0x1404de503
inc rbx
jmp 0x1404de50b
mov byte [rbx], al
movzx ax, r14b
inc rbx
shld rax, r13, 0x2e
lea rax, [rsp + 0x143f]
cmp rdi, r9
jmp 0x1404de52a
cmp rbx, rax
jb 0x1404de4cd
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
movzx cx, r13b
movzx r9d, r13w
lea r9, [rsp + 0x30]
cwd
mov r8d, ebx
movsx cx, bl
movzx cx, dh
movsx ecx, bx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1404de56b
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404de5a0
mov eax, dword [rsp + 0x30]
jmp 0x1404de582
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404de58c
jb 0x1404de5a8
cmp rsi, rbp
jb 0x1404de4c8
jmp 0x1404de5a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
bt rcx, 0x67
shl cl, cl
test r15b, r8b
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404de5c5
call fcn.1404a2014
lea r11, [rsp + 0x1450]
movsx r14, r12w
xchg rbp, rbx
movzx rbx, bp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov di, si
jmp 0x1404de5f0
mov rsp, r11
jmp 0x1404de600
pop r14
movzx rdi, sp
pop rdi
xchg sil, sil
not sil
sete sil
pop rsi
jmp 0x1404de617
ret
Function at 0x1404de618
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cbw
cmova eax, r12d
mov qword [rsp + 0x18], rbp
push rsi
mov ax, 0x186d
lahf
push rdi
movzx ax, dil
cwde
push r14
movzx eax, r9w
mov al, al
mov eax, 0x1450
call fcn.14044aa15
sub rsp, rax
cmovp bp, cx
movsx rbp, r15w
mov rax, qword [0x1400b7288]
xor rax, rsp
sal bpl, 0xc0
mov qword [rsp + 0x1440], rax
not bp
movsxd r10, edx
rol r14d, cl
rcl bpl, 0x6f
mov di, r10w
mov rdi, rcx
bt bp, r12w
shl bp, 0x6f
mov rax, r10
cmovno rcx, rdi
mov ebp, r9d
sar rax, 6
bswap r14w
lea rcx, [0x1400ba940]
test r12w, r10w
and r10d, 0x3f
movsx dx, spl
add r14b, r10b
lea rbp, [rbp + r8]
cwd
movsx rdx, cx
mov rsi, r8
mov rax, qword [rcx + rax*8]
ror r14d, cl
movzx r14, r12w
btr dx, 0x26
lea rdx, [r10 + r10*8]
not r14b
bsf r14d, r10d
mov r14, qword [rax + rdx*8 + 0x28]
clc
cmp r13b, r8b
xor eax, eax
test cx, cx
mov qword [rdi], rax
stc
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404de6f4
jae 0x1404de81c
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404de707
jae 0x1404de76d
movzx eax, word [rsi]
add rsi, 2
cmp r10b, 0x99
cmp r8, rsi
stc
cmp ax, 0xa
jne 0x1404de73a
add dword [rdi + 8], 2
ror ch, 0x43
mov ecx, 0xd
mov word [rbx], cx
stc
add rbx, 2
mov word [rbx], ax
dec ax
jmp 0x1404de74a
add rbx, 2
xchg al, ah
cmc
lea rax, [rsp + 0x143e]
test r13w, 0x6b44
cmp rbx, rax
jmp 0x1404de767
jb 0x1404de6ff
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
jmp 0x1404de783
sub rbx, rax
bsf r9, rdi
ror dh, 0xb6
movsx dx, r13b
lea r9, [rsp + 0x30]
xadd r8d, r8d
xor r8, r8
sar rbx, 1
seta dl
ror edx, 0xc
lea rdx, [rsp + 0x40]
bt r8, r9
btc r8w, r14w
add ebx, ebx
movsx r8d, sp
mov rcx, r14
setl r8b
xchg r8b, r8b
movsx r8w, r10b
mov r8d, ebx
jmp 0x1404de7d2
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404de7df
je 0x1404de814
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
test sil, al
jmp 0x1404de7f4
cmp eax, ebx
jmp 0x1404de7fb
jb 0x1404de81c
cmp rsi, rbp
jmp 0x1404de809
jb 0x1404de6fa
jmp 0x1404de81c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
jmp 0x1404de824
mov rcx, qword [rsp + 0x1440]
jmp 0x1404de831
xor rcx, rsp
jmp 0x1404de839
call fcn.1404a2014
lea r11, [rsp + 0x1450]
jmp 0x1404de84e
mov rbx, qword [r11 + 0x20]
not rsi
bswap r14w
mov rbp, qword [r11 + 0x30]
movzx di, spl
mov rsp, r11
bswap si
not r14w
cmovg r14w, di
pop r14
jmp 0x1404de87d
pop rdi
movsx rsi, r12w
pop rsi
ret