joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404ca90b
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
shrd r9, r8, 0xa6
xor r9w, r12w
lea r9, [0x1400c63a4]
test r11b, 0x64
sub ecx, ecx
jmp 0x1404ca92a
lea r8, [0x1400c63a0]
mov edx, esi
movzx dx, r10b
lea rdx, [0x1400cfbf8]
jmp 0x1404ca944
call fcn.1404cab4e
lea r9, [0x1400c63b0]
movzx r8, sp
mov ecx, 1
movzx rdx, di
movsx r8, r11w
movzx r8d, sp
lea r8, [0x1400c63a8]
movzx edx, dx
cqo
bswap rdx
lea rdx, [0x1400cf1d0]
jmp 0x1404ca980
call fcn.1404cab4e
lea r9, [0x1400c63b8]
movsx r8, r10w
cqo
mov ecx, 2
movzx r8d, bp
jmp 0x1404ca9a5
lea r8, [0x1400c63b0]
xchg dh, dh
movzx dx, al
movzx edx, r12w
lea rdx, [0x1400cf178]
jmp 0x1404ca9c2
call fcn.1404cab4e
lea r9, [0x1400c63e0]
cmovnp cx, bp
mov ecx, 8
movzx r8, si
lea r8, [0x1400c63d8]
lea rdx, [0x1400cf158]
jmp 0x1404ca9ee
call fcn.1404cab4e
lea r9, [0x1400c63e8]
mov ecx, 0xb
cqo
lea r8, [0x1400c63e0]
bswap dx
mov edx, ecx
movsxd rdx, edi
lea rdx, [0x1400cf190]
jmp 0x1404caa1c
call fcn.1404cab4e
lea r9, [0x1400c63f0]
mov ecx, 0xe
bswap r8
movzx r8, r13w
movsx dx, dh
lea r8, [0x1400c63e8]
xchg dl, dl
cwd
lea rdx, [0x1400cf168]
jmp 0x1404caa4f
call fcn.1404cab4e
lea r9, [0x1400c63f8]
mov ecx, 0xf
jmp 0x1404caa69
lea r8, [0x1400c63f0]
lea rdx, [0x1400cf800]
jmp 0x1404caa7c
call fcn.1404cab4e
lea r9, [0x1400c6408]
cwd
cmovae cx, ax
movzx r8d, r12w
mov ecx, 0x13
movsx edx, sp
lea r8, [0x1400c6400]
cmove dx, r9w
cwd
lea rdx, [0x1400cf838]
jmp 0x1404caab4
call fcn.1404cab4e
lea r9, [0x1400c6410]
cqo
movsx rdx, cx
cmovae dx, r13w
mov ecx, 0x14
cdq
lea r8, [0x1400c6408]
movsx rdx, ax
lea rdx, [0x1400cf1c0]
call fcn.1404cab4e
lea r9, [0x1400c6418]
xchg r8b, cl
mov ecx, 0x15
bswap r8w
lea r8, [0x1400c6410]
lea rdx, [0x1400cf820]
call fcn.1404cab4e
lea r9, [0x1400c6420]
adc rdx, 0x3d763c77
movsxd r8, eax
mov ecx, 0x16
shrd dx, r9w, 0x6c
adc r8, r14
lea r8, [0x1400c6418]
lea rdx, [0x1400cfc08]
test di, r15w
cmc
add rsp, 0x28
jmp 0x1404cab49
jmp fcn.1404cab4e
Function at 0x1404d4fcd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
cwd
cmovne rbx, rsi
sub rsp, 0x20
shl edx, cl
mov rdx, qword [rcx]
movsxd rbx, edi
not rbx
or r8, 0xffffffffffffffff
sub edi, edi
inc bl
movzx rbx, di
mov rbx, rcx
inc r8
cmc
jmp 0x1404d5000
cmp word [rdx + r8*2], di
jmp 0x1404d500a
jne 0x1404d4ff7
mov eax, edi
cmp r8, 3
not al
sete al
mov dword [rcx + 0x18], eax
jmp 0x1404d5023
jne 0x1404d5038
mov ecx, 2
jmp 0x1404d5033
jmp 0x1404d50b3
mov r9d, edi
jmp 0x1404d5041
test rdx, rdx
jmp 0x1404d5049
jne 0x1404d505b
mov ecx, edi
jmp 0x1404d5056
jmp 0x1404d50b3
mov ecx, 2
rol ax, cl
rcr r8d, 0x70
test r14b, r12b
movzx r8d, word [rdx]
sal al, 0x61
clc
xor al, dl
lea rdx, [rdx + rcx]
rcl eax, 0xf0
ror ah, cl
lea eax, [r8 - 0x41]
cmp ax, 0x19
jmp 0x1404d508a
jbe 0x1404d50a5
sub r8w, 0x61
cmp r8w, 0x19
jmp 0x1404d509f
ja 0x1404d50ad
inc r9d
jmp 0x1404d506a
mov ecx, r9d
cdq
neg edx
xor r9d, r9d
add dl, r9b
shr dh, 0x20
mov dword [rbx + 0x14], ecx
shl edx, 0xa2
sub r8d, r8d
movzx ecx, bp
movsx edx, r15w
lea rcx, [0x1400ab740]
movsx dx, r15b
movzx dx, r12b
lea edx, [r9 + 3]
jmp 0x1404d50e6
call fcn.1404c9a67
test byte [rbx + 0x10], 4
jmp 0x1404d50f4
jne 0x1404d50fd
mov dword [rbx + 0x10], edi
mov rbx, qword [rsp + 0x30]
add dil, spl
xadd dil, dil
add rsp, 0x20
pop rdi
jmp 0x1404d5113
ret
Function at 0x1404d6815
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
rcr bl, cl
adc rbx, rsi
and bh, 0xf6
mov qword [rsp + 0x18], rsi
push rdi
movzx rbx, si
xor dil, al
movsxd rbx, ecx
sub rsp, 0x20
clc
bts rdi, rdi
sar bh, cl
sub esi, esi
mov rdi, rdx
or bh, 0x31
movsx rbx, r11w
btc ebx, r8d
mov rbx, rcx
cmp sp, 0xb09
test rcx, rcx
jmp 0x1404d685d
je 0x1404d6905
cmp word [rcx], si
je 0x1404d6905
lea rdx, [0x1400d1d08]
jmp 0x1404d6878
call fcn.1401ea938
test eax, eax
jmp 0x1404d6884
je 0x1404d6905
lea rdx, [0x1400d1d00]
movsx ecx, dx
mov rcx, rbx
jmp 0x1404d689c
call fcn.1401ea938
test eax, eax
jmp 0x1404d68a8
jne 0x1404d68f3
mov ecx, dword [rdi + 8]
movsxd rdx, esi
movsx rdx, si
movzx r8w, r8b
lea r9d, [rsi + 2]
cdq
lea r8, [rsp + 0x30]
movsxd rdx, r12d
movzx edx, bx
mov edx, 0x2000000b
jmp 0x1404d68d7
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d68e4
je 0x1404d6931
mov eax, dword [rsp + 0x30]
jmp 0x1404d695a
mov rcx, rbx
jmp 0x1404d68fb
call fcn.1404df923
jmp 0x1404d695a
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
cdq
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d691e
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d692b
jne 0x1404d693d
sub eax, eax
jmp 0x1404d6938
jmp 0x1404d695a
mov eax, dword [rsp + 0x30]
test r8, 0x66904d99
cmp r12b, 0xb3
test eax, eax
jne 0x1404d695a
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
add sil, 0x2d
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movsx edi, di
setae dil
mov dil, 0x3b
pop rdi
jmp 0x1404d697c
ret

Function at 0x1404d697d
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
movsx rsi, dx
push rdi
xchg bx, bx
rcl bh, cl
sub rsp, 0x20
movzx rbx, ax
movsxd rbx, esp
movsx esi, r13w
mov esi, edx
jmp 0x1404d69a7
mov ebx, ecx
jmp 0x1404d69ae
call fcn.1404c8a90
mov ecx, ebx
lea r8, [rsp + 0x30]
movsx edi, sp
and ecx, 0x3ff
bt edi, 0xdd
jmp 0x1404d69d0
mov r9d, 2
bts ecx, 0xa
cmovge rdi, rdi
mov edx, 0x20000001
movsx edi, r13w
cmovne rdi, r15
mov rdi, 0x689f2db8
mov rdi, rax
jmp 0x1404d69fa
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
cmc
test eax, eax
je 0x1404d6abd
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d6a15
je 0x1404d6aae
test esi, esi
jmp 0x1404d6a22
je 0x1404d6aae
mov r9, qword [rdi + 0x98]
mov r8d, r10d
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
test r14, 0x31fb3dcc
cmp r11b, 0x66
cmp ax, 0x19
jmp 0x1404d6a51
jbe 0x1404d6a66
sub dx, 0x61
stc
cmp dx, 0x19
ja 0x1404d6a85
movzx edx, word [rcx]
jmp 0x1404d6a6e
inc r8d
cmp esp, 0x2ba16d36
add rcx, 2
jmp 0x1404d6a80
jmp 0x1404d6a3a
or rcx, 0xffffffffffffffff
jmp 0x1404d6a8e
inc rcx
clc
cmp cl, r14b
cmp word [r9 + rcx*2], r10w
jmp 0x1404d6a9f
jne 0x1404d6a8e
cmp r8d, ecx
je 0x1404d6abd
mov eax, 1
jmp 0x1404d6ab8
jmp 0x1404d6abf
sub eax, eax
mov rbx, qword [rsp + 0x38]
adc di, ax
rol si, cl
mov rsi, qword [rsp + 0x40]
neg dil
add rsp, 0x20
pop rdi
jmp 0x1404d6adc
ret
Function at 0x1404d80c5
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test r13b, r11b
mov qword [rax + 8], rbx
cmc
test dil, dil
cmp rax, r14
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
cmp r11, 0x8972c50
cmp r14w, r15w
mov qword [rax + 0x20], rdi
cmc
test r14b, r13b
push r14
test ebx, 0x4cd40d03
sub rsp, 0x40
jmp 0x1404d8102
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
mov rbx, rax
cmc
test rax, rax
jmp 0x1404d8117
je 0x1404d8273
mov rsi, rax
stc
jmp 0x1404d8126
cmp word [rax], r14w
je 0x1404d8170
or rax, 0xffffffffffffffff
jmp 0x1404d8139
inc rax
cmp rdx, rax
jmp 0x1404d8144
cmp word [rsi + rax*2], r14w
jmp 0x1404d814e
jne 0x1404d8139
lea rsi, [rsi + rax*2]
stc
add rsi, 2
cmp r10b, 7
cmp word [rsi], r14w
jmp 0x1404d816a
jne 0x1404d8130
mov qword [rsp + 0x38], r14
xor r8b, r13b
sub rsi, rbx
dec r9b
btr r9w, bp
mov qword [rsp + 0x30], r14
sar r8w, cl
dec r9d
add rsi, 2
xadd r8d, r8d
btc r9, 0xf5
shld r9w, r11w, 0x9f
sar rsi, 1
mov r8, rbx
bts r9w, bp
mov r9d, esi
cmc
jmp 0x1404d81b6
mov dword [rsp + 0x28], r14d
jmp 0x1404d81c6
xor edx, edx
mov qword [rsp + 0x20], r14
test r11, rax
sub ecx, ecx
jmp 0x1404d81d7
call fcn.1404c888d
movsxd rbp, eax
cmp bp, 0x2e8b
test eax, eax
jmp 0x1404d81eb
je 0x1404d8273
mov rcx, rbp
jmp 0x1404d81f9
call fcn.1404c87b9
mov rdi, rax
cmp sp, 0x6ef4
test rax, rax
jmp 0x1404d820e
je 0x1404d8263
mov qword [rsp + 0x38], r14
mov r9d, esi
rcr r8w, cl
mov qword [rsp + 0x30], r14
shld r8, rax, 0x18
mov r8, rbx
mov dword [rsp + 0x28], ebp
cmp r8b, sil
sub edx, edx
clc
xor ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404d8243
call fcn.1404c888d
test eax, eax
jmp 0x1404d824f
je 0x1404d8263
mov rsi, rdi
bswap rdi
mov rdi, r14
jmp 0x1404d8266
mov rsi, r14
mov rcx, rdi
call fcn.1404c874f
jmp 0x1404d8279
mov rsi, r14
test r9, rbx
test rbx, rbx
jmp 0x1404d8281
je 0x1404d8295
mov rcx, rbx
jmp 0x1404d828f
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
bswap rbp
mov rax, rsi
neg bpl
mov rsi, qword [rsp + 0x60]
dec bpl
bsr rdi, rsi
mov rbp, qword [rsp + 0x58]
not r14w
setp r14b
mov rdi, qword [rsp + 0x68]
not r14b
btr r14w, ax
add rsp, 0x40
not r14b
mov r14b, dil
movzx r14d, bx
pop r14
jmp 0x1404d82de
ret
Function at 0x1404d82df
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
test r14b, r11b
mov qword [rsp + 0x18], rsi
cmp cl, r13b
cmp r15b, 0x36
push rdi
test r8d, r12d
test r13b, 0xd
sub rsp, 0x20
jmp 0x1404d8309
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
sbb bl, r13b
movzx rbx, cx
not bl
mov rbx, rax
cmp r14b, r11b
test rax, rax
jmp 0x1404d8328
je 0x1404d83f9
mov rbp, rax
stc
clc
cmp r8b, cl
cmp word [rax], si
je 0x1404d837b
or rax, 0xffffffffffffffff
inc rax
test r11w, ax
cmc
cmp word [rbp + rax*2], si
jmp 0x1404d8355
jne 0x1404d8343
lea rbp, [rbp + rax*2]
cmc
add rbp, 2
stc
test r8b, dl
cmp spl, bl
cmp word [rbp], si
jmp 0x1404d8375
jne 0x1404d833f
sub rbp, rbx
sbb rcx, 0x3c546b40
jmp 0x1404d838d
add rbp, 2
add cx, r8w
rcr ecx, 0x75
neg ch
sar rbp, 1
xor cx, 0x31ef
add rbp, rbp
mov rcx, rbp
jmp 0x1404d83ad
call fcn.1404c87b9
mov rdi, rax
cmp di, r14w
cmc
test rax, rax
je 0x1404d83e4
mov r8, rbp
mov rdx, rbx
movsxd rcx, r11d
movsx ecx, bp
bswap ecx
mov rcx, rax
jmp 0x1404d83d9
call fcn.1404a29dd
mov rsi, rdi
test r15b, bl
xor ecx, ecx
call fcn.1404c874f
mov rcx, rbx
jmp 0x1404d83f3
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
rcl rdi, cl
rcl bpl, 0xf3
mov rax, rsi
shr rbp, 0xaa
mov rsi, qword [rsp + 0x40]
movzx di, cl
rol dil, 0xf1
add dil, 0xbe
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1404d842c
ret
Function at 0x1404db3ec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cwde
cmovp rax, r9
movsx rax, r11w
mov qword [rsp + 0x18], rbp
jmp 0x1404db421
push rsi
not al
mov ah, 0xac
push rdi
bswap rax
cbw
cdqe
push r14
mov eax, 0x1450
jmp 0x1404db43b
call fcn.140447b04
sub rsp, rax
movzx di, cl
mov rax, qword [0x1400b7288]
shl sil, 0x4c
rol bpl, cl
xor rax, rsp
btc di, 0xec
mov si, dx
bsr esi, esi
mov qword [rsp + 0x1440], rax
movsxd r10, edx
adc di, 0x2017
mov rdi, rcx
cdq
rcl dh, cl
mov rax, r10
rol sil, cl
mov ebp, r9d
or dx, r9w
sar rax, 6
xor sil, 0xc2
lea rcx, [0x1400ba940]
sal r14b, 0xde
not sil
test dil, 0x7b
and r10d, 0x3f
add rbp, r8
sub sil, r8b
or si, 0x187c
mov rsi, r8
bswap rdx
mov rax, qword [rcx + rax*8]
rol r14w, 0x6f
rol dl, cl
sar r14d, cl
lea rdx, [r10 + r10*8]
movsx r14, r9w
movsxd r14, eax
add r14w, 0x2cf8
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
cmp r13w, 0x6dac
jmp 0x1404db4e6
mov qword [rdi], rax
test r8b, spl
cmc
stc
mov dword [rdi + 8], eax
test cx, 0x3891
cmp r8, rbp
jmp 0x1404db4fe
jae 0x1404db602
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jae 0x1404db565
mov al, byte [rsi]
jmp 0x1404db519
inc rsi
cmp al, 0xa
jmp 0x1404db523
jne 0x1404db541
inc dword [rdi + 8]
jmp 0x1404db531
mov byte [rbx], 0xd
jmp 0x1404db539
inc rbx
jmp 0x1404db541
mov byte [rbx], al
movsxd rax, r12d
bswap ax
not al
inc rbx
clc
shl eax, 0xb6
lea rax, [rsp + 0x143f]
cmc
clc
cmp rbx, rax
jb 0x1404db509
and qword [rsp + 0x20], 0
btc rdx, 0x8c
xor r9b, 0xf6
lea rax, [rsp + 0x40]
or r8d, r10d
rcr rdx, cl
or r8, 0x1f4417f0
sub ebx, eax
xchg r8b, r8b
lea r9, [rsp + 0x30]
movsx r8, r13w
jmp 0x1404db599
mov r8d, ebx
movsxd rdx, r8d
xchg ch, dh
lea rdx, [rsp + 0x40]
movsx rcx, bx
mov rcx, r14
mov rcx, r14
jmp 0x1404db5b5
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404db5c2
je 0x1404db5f4
mov eax, dword [rsp + 0x30]
test r14, 0x600301e7
cmp dil, spl
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1404db602
cmp rsi, rbp
jmp 0x1404db5e9
jb 0x1404db504
jmp 0x1404db602
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
sub eax, r9d
sar ax, cl
mov rax, rdi
xor cl, 0x46
mov rcx, qword [rsp + 0x1440]
cmc
xor rcx, rsp
jmp 0x1404db619
call fcn.14049edb0
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
xchg r14d, edi
movzx di, dl
mov rbp, qword [r11 + 0x30]
mov di, ax
movsxd rdi, esp
mov rsp, r11
sets dil
mov dil, 0x76
pop r14
not sil
cmove edi, ebx
pop rdi
setle sil
movsxd rsi, r10d
pop rsi
ret
Function at 0x1404db657
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movzx eax, bx
push rsi
setl ah
movzx eax, bx
cdqe
push rdi
not al
movzx rax, bx
cwde
push r14
movsx eax, r11w
movsxd rax, edx
jmp 0x1404db684
mov eax, 0x1450
jmp 0x1404db68e
call fcn.140447b04
sub rsp, rax
mov rax, qword [0x1400b7288]
xor rax, rsp
bt si, 0xcb
or r10b, 0x6a
mov qword [rsp + 0x1440], rax
cwde
bsr r10, rdi
movsxd r10, edx
test ch, dh
xadd r14b, al
cbw
mov rdi, rcx
sal r14b, cl
mov si, 0x45fd
or sil, r15b
mov rax, r10
test r12d, edi
test r8d, 0x56e5642f
mov ebp, r9d
shrd rcx, r8, 0xbd
sar rax, 6
sal ch, 0xc5
movsx r14, bp
lea rcx, [0x1400ba940]
and r10d, 0x3f
not dl
sbb r14b, r11b
bt r14, r13
add rbp, r8
mov rsi, r8
sub r14b, al
mov rax, qword [rcx + rax*8]
cqo
cmc
bt r14w, r11w
lea rdx, [r10 + r10*8]
xchg r14, r14
mov r14w, 0x7db
test r13b, r15b
mov r14, qword [rax + rdx*8 + 0x28]
test ah, 0xf3
cmp r15w, bp
sub eax, eax
cmc
cmp r13, 0x52ee1379
test r8b, 0x59
mov qword [rdi], rax
cmp r13, 0x2a63d38
stc
mov dword [rdi + 8], eax
clc
test r11w, 0x736a
cmp r8, rbp
jmp 0x1404db75d
jae 0x1404db86d
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404db770
jae 0x1404db7cd
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x1404db79d
add dword [rdi + 8], 2
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
test esp, 0x6ba25b5e
mov word [rbx], ax
btc eax, 0xb1
add rbx, 2
sub ax, ax
bt eax, 0x91
lea rax, [rsp + 0x143e]
jmp 0x1404db7bf
cmp rbx, rax
jmp 0x1404db7c7
jb 0x1404db768
and qword [rsp + 0x20], 0
and dh, 0x2e
btr r9, r10
sar al, cl
lea rax, [rsp + 0x40]
shr dl, 0xa5
sub rbx, rax
movzx r9w, al
ror ecx, 0x93
shl r9b, 0x38
lea r9, [rsp + 0x30]
cdq
cwd
sar rbx, 1
shr cl, cl
lea rdx, [rsp + 0x40]
shld r8d, esi, 0xa0
add ebx, ebx
bswap cx
movzx ecx, si
movsxd rcx, r13d
mov rcx, r14
mov r8b, bpl
jmp 0x1404db820
mov r8d, ebx
jmp 0x1404db828
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404db863
mov eax, dword [rsp + 0x30]
test r13w, dx
add dword [rdi + 4], eax
clc
stc
cmp eax, ebx
jmp 0x1404db84a
jb 0x1404db86d
cmp rsi, rbp
jmp 0x1404db858
jb 0x1404db763
jmp 0x1404db86d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
sbb ch, ch
mov rax, rdi
clc
bts cx, r8w
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14049edb0
lea r11, [rsp + 0x1450]
movzx esi, ax
movsx ebp, di
jmp 0x1404db899
mov rbx, qword [r11 + 0x20]
movsx si, spl
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
bswap rdi
pop rdi
pop rsi
jmp 0x1404db8b5
ret
Function at 0x1404db8b6
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cwde
mov qword [rsp + 0x18], rbp
movzx rax, ax
push rsi
not al
push rdi
mov ah, 0x97
nop
lahf
push r12
cwde
push r14
push r15
not al
movsx eax, sp
cmovne ax, bx
mov eax, 0x1470
jmp 0x1404db8e9
call fcn.140447b04
sub rsp, rax
btc r14w, ax
lahf
mov rax, qword [0x1400b7288]
bswap r12
xadd r14w, bx
xor rax, rsp
shr bl, cl
adc r15, 0x79ec3925
bswap r12
mov qword [rsp + 0x1460], rax
movsxd r10, edx
mov rbx, rcx
shr cl, cl
cqo
bt r14w, cx
mov rax, r10
rcr r14d, 0xd5
shld edx, r10d, 0xd2
adc cl, r9b
mov r14d, r9d
ror edi, cl
sar rax, 6
sal rdi, cl
cmp sil, 4
lea rcx, [0x1400ba940]
clc
xor dx, 0x2f90
and r10d, 0x3f
add r14, r8
jmp 0x1404db964
mov r15, r8
bswap di
movsx r12w, r15b
mov rdi, r8
and r12, r14
mov rax, qword [rcx + rax*8]
sar r12, cl
or r12b, 0xa5
lea rdx, [r10 + r10*8]
or r12w, r15w
ror r12b, cl
mov r12, qword [rax + rdx*8 + 0x28]
cmp ch, 0x74
xor eax, eax
stc
mov qword [rbx], rax
test rsp, 0x22a2093f
stc
cmp r8, r14
jmp 0x1404db9a9
mov dword [rbx + 8], eax
jmp 0x1404db9b1
jae 0x1404dbb4e
lea rax, [rsp + 0x50]
cmp r14b, sil
cmp rdi, r14
jmp 0x1404db9c7
jae 0x1404dba1f
movzx ecx, word [rdi]
cmc
add rdi, 2
cmp cx, 0xa
jmp 0x1404db9de
jne 0x1404db9f5
mov edx, 0xd
mov word [rax], dx
add rax, 2
jmp 0x1404db9f5
mov word [rax], cx
ror ecx, cl
add rax, 2
shrd cx, r12w, 0xf8
lea rcx, [rsp + 0x6f8]
cmc
cmp r13w, di
cmp rax, rcx
jmp 0x1404dba19
jb 0x1404db9bf
and qword [rsp + 0x38], 0
sbb r9w, 0x525e
bswap cx
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
sub r9, 0x57ae6bd1
bswap r9
xor r9w, 0x765
sub rax, rcx
adc cl, sil
clc
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
sar rax, 1
cmp dil, 0xc9
neg r9b
ror r9b, 0xdc
mov qword [rsp + 0x20], rcx
shld r9d, r8d, 0x29
btc r9w, 0x42
mov r9d, eax
shld cx, di, 0x3f
movzx rcx, di
mov ecx, 0xfde9
cmp r15b, 0x61
xor edx, edx
jmp 0x1404dba9f
call fcn.1404c888d
mov ebp, eax
test eax, eax
jmp 0x1404dbaad
je 0x1404dbb42
xor esi, esi
cmp al, ah
stc
test eax, eax
jmp 0x1404dbabf
je 0x1404dbb2a
and qword [rsp + 0x20], 0
cqo
lea rdx, [rsp + 0x700]
shl r9b, cl
mov ecx, esi
rcl r9w, 0x39
cmp bp, bx
lea r9, [rsp + 0x40]
test rax, rax
mov r8d, ebp
test cl, 0x94
lea rdx, [rdx + rcx]
mov rcx, r12
cmc
sub r8d, esi
jmp 0x1404dbb00
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dbb0d
je 0x1404dbb42
add esi, dword [rsp + 0x40]
cmp esi, r10d
cmp ch, 0x26
cmp esi, ebp
jmp 0x1404dbb24
jb 0x1404dbac5
mov eax, edi
test bl, r9b
sub eax, r15d
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x1404dbb3d
jmp 0x1404db9b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
sal cx, 0x43
mov rax, rbx
add cl, 0xdd
adc cl, 0xd3
or ecx, ecx
mov rcx, qword [rsp + 0x1460]
clc
cmp r10w, 0x4898
xor rcx, rsp
call fcn.14049edb0
lea r11, [rsp + 0x1470]
bswap bx
movzx r12d, r8w
movsx rbp, dx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
setne r15b
mov dil, sil
mov rsp, r11
pop r15
pop r14
movzx si, dl
bswap rdi
pop r12
movsx rdi, r14w
movsx esi, r15w
pop rdi
seto sil
movzx si, bpl
pop rsi
ret
Function at 0x1404df170
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
not bl
movsx r9w, bpl
movsx r9d, cx
mov ebx, ecx
not dh
cmovbe r9w, r12w
movzx r9, ax
lea r9, [0x1400c8ea0]
mov ecx, 2
movsxd r8, r9d
lea r8, [0x1400c8e98]
xchg dh, dl
bswap dx
lea rdx, [0x1400cf758]
call fcn.1404df362
mov ecx, ebx
test ah, 0xef
test rax, rax
jmp 0x1404df1c2
je 0x1404df1d9
add rsp, 0x20
pop rbx
jmp 0x1404df1d2
jmp qword [0x1400b8d90]
add rsp, 0x20
cmovno bx, bx
pop rbx
jmp 0x1404df1e7
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404df1ee
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
neg rbx
adc r9, 0x4ace6319
push rdi
movzx r9d, dx
sub rsp, 0x20
jmp 0x1404df20f
mov rbx, rdx
jmp 0x1404df217
lea r9, [0x1400c8ea8]
setne dil
cmovge rdi, r14
mov edi, ecx
cwd
lea rdx, [0x1400cf748]
mov ecx, 3
cmovno r8, rdx
lea r8, [0x1400c8ea0]
call fcn.1404df362
mov rdx, rbx
mov ecx, edi
cmp r12w, 0x1222
test rax, rax
jmp 0x1404df259
je 0x1404df26a
call qword [0x1400b8d90]
jmp 0x1404df270
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
neg di
sbb dil, dl
sub rdi, 0x57ed7390
add rsp, 0x20
movsx rdi, bx
movsx di, bpl
cmovnp rdi, r12
pop rdi
jmp 0x1404df299
ret
Function at 0x2fc4d7010
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d80f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d7a12
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d7aaa
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d7a8e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7a82
cmp qword [rbp - 0x10], 0
je 0x2fc4d7a82
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d7a48
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d7aab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7bb0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7bd8
mov eax, 0
jmp 0x2fc4d7c26
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7c01
mov eax, 0
jmp 0x2fc4d7c26
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d7c21
mov eax, 0
jmp 0x2fc4d7c26
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d7c2c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d7caa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d7ca1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d7ca1
mov rax, qword [rbp - 8]
jmp 0x2fc4d7cbf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d7c74
mov eax, 0
add rsp, 0x20
pop rbp
ret