joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404c0d11
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
btr r10w, r12w
shl r10w, cl
mov qword [rax + 0x10], rbp
btc bx, ax
or bl, r11b
xchg ebx, ebx
mov qword [rax + 0x18], rsi
shr bl, 0x44
movsx ebx, r11w
mov qword [rax + 0x20], rdi
not bh
movzx rbx, r12w
push r14
xchg r10, rbx
bswap ebx
sbb r10b, 0x1e
or ebp, 0xffffffff
movzx r10w, cl
shr ebx, cl
mov rbx, r8
cmc
rol r10w, 0x86
bswap r10
cmp dword [rcx + 0x10], 0
movsx r10, r14w
mov r10, rdx
je 0x1404c0ef9
movsxd r9, dword [rcx + 0x10]
shr dil, cl
cwde
xadd cl, cl
lea r14, [0x140000000]
add eax, 0xeb5088
mov rdi, qword [rdx + 8]
sal rdx, 9
xor esi, esi
bsf ecx, edi
lea r9, [r9 + rdi]
bt eax, r12d
rol cl, 0xf8
shl cx, 0x63
xor r8d, r8d
cmp r11b, 0xfd
rol ax, cl
mov edx, ebp
jmp 0x1404c0dbe
movzx ecx, byte [r9]
btr r11w, 0xaa
shld r11d, r8d, 0x1d
and ecx, 0xf
sal al, 0xa
cmp r11d, 0x29781971
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
sub r9, rax
mov r11b, 0x9e
mov r11d, dword [r9 - 4]
cmc
clc
shr r11d, cl
cmp r11, 0x303c774c
cmc
test r11d, r11d
jmp 0x1404c0e0a
je 0x1404c0ef9
mov rax, qword [r10 + 0x10]
mov r10d, dword [rax]
adc ch, 0x35
movzx ecx, byte [r9]
btc ax, bx
shrd eax, r10d, 0xaa
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
test al, 0xc7
clc
cmp r15b, 0x27
mov cl, byte [rcx + r14 + 0xc1a40]
test r8b, 0xb8
stc
sub r9, rax
mov eax, dword [r9 - 4]
shr eax, cl
clc
stc
add esi, eax
shrd eax, r9d, 0xb
mov eax, esi
stc
lea rax, [rax + r10]
test r13b, 0x60
clc
add rax, rdi
cmp r10b, 9
clc
cmp rbx, rax
jmp 0x1404c0e75
jb 0x1404c0ee6
movzx ecx, byte [r9]
movzx dx, bpl
movsx rax, r8w
inc r8d
xor ax, 0x5728
and ecx, 0xf
rol dl, cl
cmovge rax, r11
or eax, 0x58d412c7
movsx rax, byte [rcx + r14 + 0xc1a30]
not dh
movsx edx, r11w
movzx edx, dx
mov cl, byte [rcx + r14 + 0xc1a40]
shl dh, cl
sub r9, rax
mov edx, dword [r9 - 4]
cmp r13w, 0x7dd9
clc
test sp, 0x1b61
shr edx, cl
jmp 0x1404c0ed3
dec edx
test r15, r13
cmp r8d, r11d
jmp 0x1404c0ee0
jb 0x1404c0e1a
test r8d, r8d
cmove edx, ebp
cwde
mov eax, edx
jmp 0x1404c0ef4
jmp 0x1404c0efb
mov eax, ebp
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
movsxd r14, r12d
movsx r14w, r15b
mov rsi, qword [rsp + 0x20]
movsx rdi, si
movzx di, r13b
mov rdi, qword [rsp + 0x28]
not r14w
xchg r14w, r14w
pop r14
jmp 0x1404c0f2f
ret

Function at 0x1404c7c3c
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
dec r9w
sub rsp, 0x20
movzx r9w, r14b
movsxd r8, eax
movsx r9, r11w
mov rbx, rcx
movsx edx, di
movzx dx, dil
lea r9, [0x1400c63c0]
movzx cx, al
mov ecx, 3
cdq
mov dh, 0x59
lea r8, [0x1400c63b8]
movsx edx, si
lea rdx, [0x1400cfb70]
jmp 0x1404c7c87
call fcn.1404c8c93
test rax, rax
jmp 0x1404c7c94
je 0x1404c7caf
mov rcx, rbx
shr bl, cl
movsx rbx, r9w
add rsp, 0x20
pop rbx
jmp qword [0x1400b8d90]
add rsp, 0x20
pop rbx
jmp 0x1404c7cb9
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1404c7d45
Capabilities:
Get thread local storage value

Disassembly:
push rbx
btc r8d, 0xce
sar r8b, cl
sub rsp, 0x20
mov ebx, ecx
cqo
lea r9, [0x1400c63d0]
mov ecx, 5
mov r8b, r12b
cmovle dx, bp
xchg dh, dh
lea r8, [0x1400c63c8]
lea rdx, [0x1400cf758]
jmp 0x1404c7d7f
call fcn.1404c8c93
mov ecx, ebx
test rax, rax
jmp 0x1404c7d8e
je 0x1404c7db1
add rsp, 0x20
movsx ebx, r13w
movsx rbx, sp
movzx ebx, r15w
pop rbx
jmp 0x1404c7daa
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsx bx, ah
pop rbx
jmp 0x1404c7dbf
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c7dc6
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
btc r9w, 0x8c
push rdi
or bl, 0x76
xor di, sp
bts rdi, r13
sub rsp, 0x20
bswap r9w
mov rbx, rdx
movzx dx, r11b
not dl
mov r9b, r10b
lea r9, [0x1400c63d8]
movsx edx, r12w
mov edi, ecx
movsxd rcx, r11d
movzx cx, r14b
cwd
lea rdx, [0x1400cf748]
movsxd rcx, edi
movsx ecx, r12w
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404c7e27
call fcn.1404c8c93
mov rdx, rbx
rol cl, 0xc5
mov ecx, edi
jmp 0x1404c7e39
test rax, rax
jmp 0x1404c7e41
je 0x1404c7e52
call qword [0x1400b8d90]
jmp 0x1404c7e58
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
bswap di
jmp 0x1404c7e6e
pop rdi
jmp 0x1404c7e74
ret

Function at 0x1404c7ff0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
test rcx, 0x1f2d0a11
movzx rbx, ax
mov qword [rsp + 0x10], rbp
setle bl
mov qword [rsp + 0x18], rsi
xchg sil, sil
btc bx, 0x2a
push rdi
rcl bpl, cl
sub rsp, 0x30
xchg dil, bpl
mov ebx, r9d
mov rdi, r8
movsxd r8, r10d
movzx r8d, ax
mov esi, edx
cqo
lea r9, [0x1400c63e8]
movsxd r8, r8d
movzx rdx, r11w
mov rbp, rcx
movzx ecx, r8w
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
movsxd rcx, r15d
mov ecx, 0xb
jmp 0x1404c8061
call fcn.1404c8c93
mov rcx, rbp
test rsi, 0x12cb18f3
test rax, rax
jmp 0x1404c8078
je 0x1404c809e
mov r9d, ebx
mov r8, rdi
setne dl
jmp 0x1404c808c
mov edx, esi
jmp 0x1404c8093
call qword [0x1400b8d90]
jmp 0x1404c80cc
sub edx, edx
jmp 0x1404c80a5
call fcn.1404c8767
mov ecx, eax
cqo
mov dx, 0x1e0c
movzx rdx, bx
mov r9d, ebx
mov r8, rdi
bswap dx
mov edx, esi
jmp 0x1404c80c6
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
btr edi, 0x78
and dil, r15b
mov rsi, qword [rsp + 0x50]
cmp dl, ch
btr rdi, rbx
dec di
add rsp, 0x30
movsx edi, bx
movzx edi, bp
bswap di
pop rdi
jmp 0x1404c80fe
ret
Function at 0x1404c8a47
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
xor r8b, al
sar r9b, cl
lea r9, [0x1400c63a4]
sub ecx, ecx
bswap dx
mov edx, 0x19bc4db5
lea r8, [0x1400c63a0]
movsx rdx, dx
lea rdx, [0x1400cfbf8]
call fcn.1404c8c93
lea r9, [0x1400c63b0]
movsx r8, cx
cwd
mov ecx, 1
cwd
cdq
movsxd r8, r10d
lea r8, [0x1400c63a8]
not rdx
movsx edx, bx
lea rdx, [0x1400cf1d0]
jmp 0x1404c8aaa
call fcn.1404c8c93
lea r9, [0x1400c63b8]
xchg dh, ch
movsxd r8, edx
mov ecx, 2
movzx r8, di
xchg r8w, dx
cdq
lea r8, [0x1400c63b0]
xchg edx, edx
lea rdx, [0x1400cf178]
jmp 0x1404c8ade
call fcn.1404c8c93
lea r9, [0x1400c63e0]
mov cl, 0xb8
mov ecx, 8
mov r8w, r15w
cmove r8, r11
movzx r8d, bp
lea r8, [0x1400c63d8]
movsxd rdx, r10d
cmovg edx, ebp
movzx dx, r12b
lea rdx, [0x1400cf158]
call fcn.1404c8c93
lea r9, [0x1400c63e8]
mov ecx, 0xb
lea r8, [0x1400c63e0]
movzx rdx, r13w
jmp 0x1404c8b3b
lea rdx, [0x1400cf190]
call fcn.1404c8c93
lea r9, [0x1400c63f0]
movzx r8d, si
mov dh, ch
mov ecx, 0xe
movsx r8w, r12b
lea r8, [0x1400c63e8]
cdq
mov dx, 0x3c2d
lea rdx, [0x1400cf168]
jmp 0x1404c8b76
call fcn.1404c8c93
lea r9, [0x1400c63f8]
mov r8, 0x421c396c
movzx dx, dil
movzx r8d, sp
mov ecx, 0xf
movsx r8w, sil
movsx r8, cx
lea r8, [0x1400c63f0]
movsx dx, bl
movsx rdx, cx
lea rdx, [0x1400cf800]
jmp 0x1404c8bbb
call fcn.1404c8c93
lea r9, [0x1400c6408]
movsxd rcx, edx
cdq
mov ecx, 0x13
lea r8, [0x1400c6400]
movzx dx, r13b
lea rdx, [0x1400cf838]
call fcn.1404c8c93
lea r9, [0x1400c6410]
jmp 0x1404c8bfd
mov ecx, 0x14
movsxd rdx, r15d
mov r8, 0x64791f2a
xchg r8w, dx
lea r8, [0x1400c6408]
cmovp dx, di
lea rdx, [0x1400cf1c0]
jmp 0x1404c8c27
call fcn.1404c8c93
lea r9, [0x1400c6418]
setb dh
jmp 0x1404c8c3b
mov ecx, 0x15
lea r8, [0x1400c6410]
lea rdx, [0x1400cf820]
jmp 0x1404c8c53
call fcn.1404c8c93
lea r9, [0x1400c6420]
add edx, edi
test r9w, 0x595f
bsr cx, sp
mov ecx, 0x16
lea r8, [0x1400c6418]
dec dh
stc
lea rdx, [0x1400cfc08]
clc
cmp cl, dil
add rsp, 0x28
jmp 0x1404c8c8e
jmp fcn.1404c8c93
Function at 0x1404cbf43
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
shr ch, cl
bts cx, r15w
mov qword [rax + 8], rbx
stc
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
shr ch, 0xa9
setnp ch
btr rbx, 0x7e
mov qword [rax + 0x20], rdi
btc bx, r14w
movsx ax, sil
push r14
xor ax, r14w
add ah, 0x57
bts edi, r14d
sub rsp, 0x20
not cx
sbb cx, r14w
shld ebx, ebp, 0x9d
sub esi, esi
xor r14d, r14d
xadd bx, bx
shl ax, cl
movzx ecx, r15w
movsxd rcx, esi
lea rdi, [0x1400ba940]
mov rax, rcx
and ecx, 0x3f
setp bh
sar rax, 6
cmp bpl, sil
sar bl, cl
lea rbx, [rcx + rcx*8]
stc
cmp r14b, bl
mov rdi, qword [rdi + rax*8]
cmc
mov rax, qword [rdi + rbx*8 + 0x28]
jmp 0x1404cbfd2
add rax, 2
cmp rax, 1
jmp 0x1404cbfdf
jbe 0x1404cbfef
or byte [rdi + rbx*8 + 0x38], 0x80
jmp 0x1404cc121
mov byte [rdi + rbx*8 + 0x38], 0x81
dec ch
bt ecx, 0xb1
mov ecx, esi
cmp bx, bp
test esi, esi
jmp 0x1404cc006
je 0x1404cc046
sub ecx, 1
jmp 0x1404cc014
je 0x1404cc037
cmp ecx, 1
setge ch
bswap cx
movzx cx, spl
mov ecx, 0xfffffff4
jmp 0x1404cc032
jmp 0x1404cc050
mov ecx, 0xfffffff5
jmp 0x1404cc041
jmp 0x1404cc050
mov ecx, 0xfffffff6
jmp 0x1404cc050
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
btr rcx, 0x10
lea rcx, [rax + 1]
jmp 0x1404cc067
cmp rcx, 1
jmp 0x1404cc070
jbe 0x1404cc089
mov rcx, rax
jmp 0x1404cc07e
call qword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1404cc092
xor eax, eax
cmp r11b, 0x36
cmp r14b, bpl
test eax, eax
je 0x1404cc0dc
movzx ecx, al
mov qword [rdi + rbx*8 + 0x28], rbp
cmp ecx, 2
jmp 0x1404cc0aa
jne 0x1404cc0bf
or byte [rdi + rbx*8 + 0x38], 0x40
jmp 0x1404cc0ba
jmp 0x1404cc121
cmp ecx, 3
jmp 0x1404cc0c7
jne 0x1404cc121
or byte [rdi + rbx*8 + 0x38], 8
jmp 0x1404cc0d7
jmp 0x1404cc121
or byte [rdi + rbx*8 + 0x38], 0x40
rcr al, 0x9d
movzx eax, cx
mov qword [rdi + rbx*8 + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400ba160]
clc
test r8w, 0x5e5
test rax, rax
jmp 0x1404cc106
je 0x1404cc121
mov rax, qword [r14 + rax]
jmp 0x1404cc115
mov dword [rax + 0x18], 0xfffffffe
jmp 0x1404cc121
inc esi
add r14, 8
cmp esi, 3
jne 0x1404cbf9f
mov rbx, qword [rsp + 0x30]
cmc
mov rbp, qword [rsp + 0x38]
bts r14w, bp
bts rdi, rdi
adc dil, 0x41
mov rsi, qword [rsp + 0x40]
btr r14d, eax
adc dil, cl
stc
mov rdi, qword [rsp + 0x48]
ror r14b, 0x6c
sal r14d, cl
add rsp, 0x20
movsxd r14, edx
sets r14b
pop r14
ret
Function at 0x1404d297a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, 0x37ba5034
movsxd rbx, r12d
push rdi
test r15b, 0xf9
sub rsp, 0x20
mov rdx, qword [rcx]
xor rbx, 0x9a0290
or r8, 0xffffffffffffffff
mov rbx, rcx
xor edi, edi
jmp 0x1404d29aa
mov rcx, r8
jmp 0x1404d29b2
inc rcx
cmp word [rdx + rcx*2], di
jmp 0x1404d29be
jne 0x1404d29b2
mov eax, edi
cmp rcx, 3
sete al
mov dword [rbx + 0x18], eax
mov rax, qword [rbx + 8]
jmp 0x1404d29d9
inc r8
cmp word [rax + r8*2], di
jne 0x1404d29d9
cmp r8, 3
mov al, cl
cwde
movzx ax, r13b
mov eax, edi
mov al, al
sete al
cmc
stc
mov dword [rbx + 0x1c], eax
cmp rcx, 3
jmp 0x1404d2a08
jne 0x1404d2a1d
mov ecx, 2
jmp 0x1404d2a18
jmp 0x1404d2a99
mov r9d, edi
test r10b, 0xd9
test rdx, rdx
jmp 0x1404d2a2c
jne 0x1404d2a39
mov ecx, edi
jmp 0x1404d2a99
mov ecx, 2
btc rax, 0xba
movsx r8w, al
movzx r8d, word [rdx]
shl eax, cl
movzx rax, r11w
add rdx, rcx
movsxd rax, r11d
rcr ah, cl
lea eax, [r8 - 0x41]
stc
cmp r9w, r14w
cmp ax, 0x19
jmp 0x1404d2a6c
jbe 0x1404d2a82
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1404d2a8f
inc r9d
jmp 0x1404d2a8a
jmp 0x1404d2a48
mov ecx, r9d
rcr dh, cl
movsx dx, r8b
xor r9d, r9d
and dl, ah
sub dx, 0x4bef
mov dword [rbx + 0x14], ecx
btc cx, r11w
rcl cx, 0x7e
sub dx, 0x5634
sub r8d, r8d
movzx cx, r13b
lea rcx, [0x1400ab3bc]
xchg dh, dh
lea edx, [r9 + 3]
jmp 0x1404d2ace
call fcn.1404c7b2a
mov ecx, dword [rbx + 0x10]
ror dl, cl
add dl, 0x5a
test cl, 7
setne dl
bt ecx, 9
not al
setb al
and dl, al
xchg al, al
bt ecx, 8
setb al
test al, dl
jmp 0x1404d2afc
jne 0x1404d2b05
mov dword [rbx + 0x10], edi
mov rbx, qword [rsp + 0x30]
xor edi, r8d
shr dil, 0xa9
add rsp, 0x20
setg dil
mov di, bp
pop rdi
jmp 0x1404d2b22
ret
Function at 0x1404d49f9
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
adc bx, r15w
mov qword [rsp + 0x18], rsi
clc
push rdi
sal bx, 0x31
inc bh
sub rsp, 0x20
ror rdi, cl
sub esi, esi
or bl, spl
adc bx, 0x28e4
sal bh, 0xf9
mov rdi, rdx
jmp 0x1404d4a30
mov rbx, rcx
test rcx, rcx
jmp 0x1404d4a3b
je 0x1404d4af8
cmp word [rcx], si
jmp 0x1404d4a49
je 0x1404d4af8
lea rdx, [0x1400d1d08]
call fcn.1402271a0
test eax, eax
jmp 0x1404d4a62
je 0x1404d4af8
lea rdx, [0x1400d1d00]
cmovl cx, r8w
jmp 0x1404d4a7c
mov rcx, rbx
jmp 0x1404d4a84
call fcn.1402271a0
test eax, eax
jmp 0x1404d4a90
jne 0x1404d4ae6
mov ecx, dword [rdi + 8]
jmp 0x1404d4aa6
lea r9d, [rsi + 2]
cdq
movzx r8, r13w
lea r8, [rsp + 0x30]
movsxd rdx, edx
bswap rdx
cdq
mov edx, 0x2000000b
jmp 0x1404d4ac5
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d4ad2
je 0x1404d4b2e
mov eax, dword [rsp + 0x30]
jmp 0x1404d4ae1
jmp 0x1404d4b57
mov rcx, rbx
jmp 0x1404d4aee
call fcn.1404ddc13
jmp 0x1404d4b57
mov ecx, dword [rdi + 8]
cqo
movsx edx, cx
cwd
lea r8, [rsp + 0x30]
cmovno edx, r13d
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d4b1b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d4b28
jne 0x1404d4b3a
xor eax, eax
jmp 0x1404d4b35
jmp 0x1404d4b57
mov eax, dword [rsp + 0x30]
clc
cmc
cmp r12w, sp
test eax, eax
jmp 0x1404d4b4b
jne 0x1404d4b57
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov dil, 0x7b
shr di, cl
add rsp, 0x20
pop rdi
jmp 0x1404d4b71
ret

Function at 0x1404d4b72
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
add rbx, r9
mov qword [rsp + 0x18], rsi
push rdi
shl bh, cl
adc esi, 0x58492ddc
sub rsp, 0x20
mov esi, edx
xchg bl, bl
mov ebx, ecx
jmp 0x1404d4b97
call fcn.1404c6b08
mov ecx, ebx
bt di, bp
ror r8w, cl
lea r8, [rsp + 0x30]
bt r9, r12
btr dx, 0x95
or r9w, r11w
and ecx, 0x3ff
movsx edi, bx
btr rdx, r9
mov r9d, 2
btc dx, r8w
cdq
jmp 0x1404d4bd6
bts ecx, 0xa
not rdx
cmovnp edi, r14d
mov edx, 0x20000001
movsx rdi, bx
mov rdi, rax
jmp 0x1404d4bf2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test eax, eax
jmp 0x1404d4c02
je 0x1404d4cc5
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d4c11
je 0x1404d4cb6
test esi, esi
jmp 0x1404d4c1e
je 0x1404d4cb6
mov r9, qword [rdi + 0x98]
mov r8d, r10d
movzx edx, word [r9]
movsxd rcx, edi
sar ax, cl
cmovb ax, r13w
lea rcx, [r9 + 2]
rcr al, 0x81
lea eax, [rdx - 0x41]
test r14w, r11w
cmp rsp, r9
cmp ax, 0x19
jbe 0x1404d4c6b
sub dx, 0x61
clc
test dil, 0x6b
cmp dx, 0x19
ja 0x1404d4c89
movzx edx, word [rcx]
jmp 0x1404d4c73
inc r8d
test r15w, r14w
cmc
add rcx, 2
jmp 0x1404d4c84
jmp 0x1404d4c44
or rcx, 0xffffffffffffffff
jmp 0x1404d4c92
inc rcx
cmp ch, 0x39
cmp word [r9 + rcx*2], r10w
jmp 0x1404d4ca2
jne 0x1404d4c92
cmp r8d, ecx
jmp 0x1404d4cb0
je 0x1404d4cc5
mov eax, 1
jmp 0x1404d4cc0
jmp 0x1404d4cca
xor eax, eax
or sil, sil
mov rbx, qword [rsp + 0x38]
movzx di, sil
add esi, r10d
mov rsi, qword [rsp + 0x40]
add di, r15w
shrd di, r8w, 0x71
add rsp, 0x20
movzx rdi, ax
movzx edi, r14w
pop rdi
jmp 0x1404d4cf8
ret
Function at 0x1404d642f
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmp r13w, 0x67a2
cmc
mov qword [rax + 8], rbx
cmp bp, r15w
cmc
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
clc
push r14
jmp 0x1404d6457
sub rsp, 0x40
jmp 0x1404d6460
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
setge bl
bt rbx, r9
mov rbx, rax
stc
cmp r15w, 0x548a
test rax, rax
jmp 0x1404d6482
je 0x1404d65f3
mov rsi, rax
stc
test r11b, r13b
cmp word [rax], r14w
jmp 0x1404d6498
je 0x1404d64d7
or rax, 0xffffffffffffffff
jmp 0x1404d64a7
inc rax
cmc
test sp, r8w
cmp word [rsi + rax*2], r14w
jmp 0x1404d64b9
jne 0x1404d64a7
lea rsi, [rsi + rax*2]
add rsi, 2
clc
cmp word [rsi], r14w
jmp 0x1404d64d1
jne 0x1404d649e
mov qword [rsp + 0x38], r14
movsx r8d, cx
sub rsi, rbx
sub r9, rax
stc
mov qword [rsp + 0x30], r14
xchg r8w, r8w
clc
add rsi, 2
rcl r9b, 0x9e
btr r9w, 0x4a
sar rsi, 1
rol r9w, 0xb8
mov r8, rbx
shld r9d, eax, 0xda
cmp r13w, 0x58bc
mov r9d, esi
cmp cl, r12b
stc
mov dword [rsp + 0x28], r14d
test bx, 0x2435
xor edx, edx
stc
test r13b, 0x41
mov qword [rsp + 0x20], r14
test cx, r14w
cmc
test bp, 0x37f5
xor ecx, ecx
jmp 0x1404d6543
call fcn.1404c68fd
movsxd rbp, eax
test bpl, r11b
jmp 0x1404d6554
test eax, eax
je 0x1404d65f3
mov rcx, rbp
call fcn.1404c683b
mov rdi, rax
test rax, rax
je 0x1404d65dc
mov qword [rsp + 0x38], r14
add r9, 0x340904e2
mov r9d, esi
add r8b, 0x7c
shl r8b, 0xcc
mov qword [rsp + 0x30], r14
clc
bts r8d, r10d
mov r8, rbx
mov dword [rsp + 0x28], ebp
test al, 1
test dx, sp
clc
xor edx, edx
jmp 0x1404d65a9
xor ecx, ecx
jmp 0x1404d65b0
mov qword [rsp + 0x20], rax
jmp 0x1404d65ba
call fcn.1404c68fd
test eax, eax
jmp 0x1404d65c6
je 0x1404d65dc
mov rsi, rdi
mov rdi, r14
jmp 0x1404d65d7
jmp 0x1404d65e6
mov rsi, r14
movsxd rcx, r8d
movzx rcx, r12w
mov rcx, rdi
call fcn.1404c67c1
jmp 0x1404d65fc
mov rsi, r14
cmp ebx, 0x17f564e3
test rbx, rbx
je 0x1404d6613
mov rcx, rbx
jmp 0x1404d660d
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
shld r14w, di, 0x16
bts ebp, r11d
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov r14b, r13b
add r14b, bpl
mov rdi, qword [rsp + 0x68]
sbb r14b, r10b
xor r14w, 0x17ea
add rsp, 0x40
cmovne r14, r12
pop r14
jmp 0x1404d6652
ret
Function at 0x1404d6653
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
test r9b, r14b
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
stc
sub rsp, 0x20
jmp 0x1404d6670
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rsi, r10
jmp 0x1404d6686
test rax, rax
jmp 0x1404d668e
je 0x1404d6763
mov rbp, rax
test spl, r8b
cmc
cmp word [rax], si
je 0x1404d66e8
or rax, 0xffffffffffffffff
jmp 0x1404d66ad
inc rax
test r13b, 0xb8
test r10b, r11b
cmp word [rbp + rax*2], si
jmp 0x1404d66c1
jne 0x1404d66ad
lea rbp, [rbp + rax*2]
add rbp, 2
cmp r15b, 0x22
cmp r14w, sp
clc
cmp word [rbp], si
jmp 0x1404d66e2
jne 0x1404d66a4
sub rbp, rbx
add rbp, 2
bts cx, ax
shld rcx, r11, 0x44
cmp spl, spl
sar rbp, 1
add rbp, rbp
mov rcx, rbp
jmp 0x1404d6709
call fcn.1404c683b
mov rdi, rax
cmp dx, dx
test rax, rax
jmp 0x1404d671c
je 0x1404d674e
mov r8, rbp
cqo
movsx edx, r15w
jmp 0x1404d6730
mov rdx, rbx
mov rcx, rax
jmp 0x1404d673b
call fcn.1404a0a3f
mov rsi, rdi
test rsi, 0x5021139a
stc
test sil, r10b
sub ecx, ecx
call fcn.1404c67c1
mov rcx, rbx
jmp 0x1404d675d
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
sar bpl, cl
mov rax, rsi
movsx di, sil
movsx rdi, r8w
mov rsi, qword [rsp + 0x40]
shrd rdi, r8, 0xc0
sar dil, 0xf8
and bp, r9w
mov rbp, qword [rsp + 0x38]
movzx edi, sp
add rsp, 0x20
jmp 0x1404d67a1
pop rdi
jmp 0x1404d67a7
ret
Function at 0x1404d9690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx ax, spl
movzx eax, cx
mov qword [rsp + 0x18], rbp
movzx rax, r11w
cwde
not ax
push rsi
push rdi
push r14
movzx rax, bp
movzx ax, cl
mov eax, 0x1450
call fcn.140445c7d
sub rsp, rax
cmp rsp, rbx
cdqe
mov rax, qword [0x1400b7288]
btr si, r11w
xor rax, rsp
shl sil, cl
mov qword [rsp + 0x1440], rax
movsxd r10, edx
xchg dil, al
mov rdi, rcx
cmovb esi, r10d
xadd si, ax
movzx ecx, bx
mov rax, r10
mov ebp, r9d
shld rcx, r15, 0xc3
sub r14b, dl
sar rax, 6
shld rdx, rax, 0x84
movsx si, bl
lea rcx, [0x1400ba940]
bswap si
and r10d, 0x3f
sub dx, si
movzx si, r15b
sal dl, cl
add rbp, r8
sal r14, 0x43
sar si, cl
mov rsi, r8
bswap dx
sar r14, cl
movzx rdx, bx
mov rax, qword [rcx + rax*8]
sbb edx, 0x2cd87093
movzx r14, bx
lea rdx, [r10 + r10*8]
bsr r14w, r13w
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
mov qword [rdi], rax
stc
cmc
clc
mov dword [rdi + 8], eax
test r9w, bp
cmp r8, rbp
jmp 0x1404d9773
jae 0x1404d987a
lea rbx, [rsp + 0x40]
cmp r13b, bpl
test r12d, 0x297b4bf5
cmp rsi, rbp
jmp 0x1404d9790
jae 0x1404d97ee
mov al, byte [rsi]
jmp 0x1404d979d
inc rsi
cmc
test r12b, bl
cmp al, 0xa
jmp 0x1404d97ab
jne 0x1404d97c9
inc dword [rdi + 8]
jmp 0x1404d97b9
mov byte [rbx], 0xd
jmp 0x1404d97c1
inc rbx
jmp 0x1404d97c9
mov byte [rbx], al
movsx ax, dil
not al
lahf
inc rbx
ror ah, cl
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x1404d97e8
jb 0x1404d9788
and qword [rsp + 0x20], 0
cdq
lea rax, [rsp + 0x40]
btr r9w, 0x81
sub ebx, eax
movzx cx, bpl
movsxd r8, edx
bswap rcx
lea r9, [rsp + 0x30]
movzx rdx, r12w
mov r8d, ebx
bswap dx
movzx rcx, r13w
jmp 0x1404d9825
lea rdx, [rsp + 0x40]
movzx rcx, bp
mov ch, al
mov rcx, r14
jmp 0x1404d9838
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d9872
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
test bx, 0x3bc0
cmp eax, ebx
jmp 0x1404d9859
jb 0x1404d987a
cmp rsi, rbp
jmp 0x1404d9867
jb 0x1404d9779
jmp 0x1404d987a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
not cx
mov rcx, qword [rsp + 0x1440]
cmc
cmp r12b, r13b
xor rcx, rsp
jmp 0x1404d9894
call fcn.14049cefa
lea r11, [rsp + 0x1450]
bswap bp
movsx si, spl
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
jmp 0x1404d98bd
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1404d98c5
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404d98f2
mov qword [rsp + 0x18], rbp
movzx ax, r8b
push rsi
cdqe
cmovne rax, rax
push rdi
movzx rax, sp
movsx rax, dx
push r14
not ax
movsx ax, r11b
mov eax, 0x1450
jmp 0x1404d9920
call fcn.140445c7d
sub rsp, rax
mov rax, qword [0x1400b7288]
cmp eax, 0x10f80ec0
xor rax, rsp
xor r14b, 0x7d
setg bpl
shr esi, 0xaf
mov qword [rsp + 0x1440], rax
movsx r14, cx
movsxd r10, edx
mov rdi, rcx
jmp 0x1404d9959
mov rax, r10
xadd rbp, rcx
mov ebp, r9d
rcl dl, cl
shr r14w, cl
bswap r14d
sar rax, 6
cmp r14d, edx
lea rcx, [0x1400ba940]
shr r14b, cl
cmovno esi, r10d
setl dl
and r10d, 0x3f
inc rsi
shl r14w, cl
xor r14w, 0x4974
lea rbp, [rbp + r8]
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
cmp r14b, r11b
sub eax, eax
mov qword [rdi], rax
jmp 0x1404d99bb
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404d99c6
jae 0x1404d9af0
lea rbx, [rsp + 0x40]
stc
jmp 0x1404d99dc
cmp rsi, rbp
jmp 0x1404d99e4
jae 0x1404d9a47
movzx eax, word [rsi]
test r10b, 0x44
add rsi, 2
cmp r10b, 0xaf
test r14d, 0x4d5c6a01
cmp ax, 0xa
jne 0x1404d9a20
add dword [rdi + 8], 2
sal ch, cl
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
cmp r14b, 0xfe
mov word [rbx], ax
add rbx, 2
or al, 0x37
btc rax, 0x89
cdqe
lea rax, [rsp + 0x143e]
cmp r12w, 0x1297
cmp rbx, rax
jb 0x1404d99dc
and qword [rsp + 0x20], 0
rol r8b, 0xb0
lea rax, [rsp + 0x40]
sub rbx, rax
xor r8d, esi
test r12b, r13b
xchg dh, dh
lea r9, [rsp + 0x30]
btr edx, 0x5f
sar rbx, 1
cqo
sar r8d, cl
and cx, 0x3ce7
lea rdx, [rsp + 0x40]
ror r8b, 0xc9
rcr r8d, cl
test r10, rcx
add ebx, ebx
mov r8b, 0xe1
movzx r8d, r10w
setns r8b
mov rcx, r14
movsxd r8, r13d
movzx r8, si
jmp 0x1404d9aa2
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d9ab2
je 0x1404d9ae3
mov eax, dword [rsp + 0x30]
jmp 0x1404d9ac2
add dword [rdi + 4], eax
cmp sp, bx
cmp eax, ebx
jmp 0x1404d9acf
jb 0x1404d9af0
cmp rsi, rbp
jb 0x1404d99cc
jmp 0x1404d9af0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rcl ax, 0xaa
lahf
mov rax, rdi
movsx cx, r9b
cmovs rcx, r11
mov rcx, qword [rsp + 0x1440]
cmp r14b, cl
test r8b, 0x2a
xor rcx, rsp
call fcn.14049cefa
lea r11, [rsp + 0x1450]
movzx edi, r13w
xchg bx, r14w
mov rbx, qword [r11 + 0x20]
jmp 0x1404d9b32
mov rbp, qword [r11 + 0x30]
movsxd r14, r9d
mov rsp, r11
movzx r14w, dl
movzx rsi, sp
pop r14
pop rdi
movsxd rsi, eax
pop rsi
ret