joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14047fa79
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
and r9b, 0x22
btc r8d, 0x9a
sub rsp, 0x20
not dx
movsx edx, r10w
movsx rdx, di
mov rbx, rcx
movsxd rcx, edi
lea r9, [0x1400c53b0]
mov ecx, 3
movzx r8, ax
movsx r8, di
lea r8, [0x1400c53a8]
lea rdx, [0x1400cece8]
jmp 0x14047fac0
call fcn.140480a59
test rax, rax
jmp 0x14047facd
je 0x14047faed
mov rcx, rbx
movsx ebx, bx
add rsp, 0x20
movzx ebx, ax
pop rbx
jmp 0x14047fae6
jmp qword [case.0x140480642.0]
add rsp, 0x20
mov bx, r11w
movzx rbx, r12w
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x14047fc05
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sar r9b, cl
push rdi
bsf r8d, ebx
btc r8w, 0x41
sub rsp, 0x20
mov rbx, rdx
cqo
xchg r9b, dl
cdq
lea r9, [0x1400c53c8]
movsx rdx, cx
movzx r8d, bp
mov edi, ecx
mov r8b, dil
lea rdx, [0x1400ce850]
jmp 0x14047fc45
mov ecx, 6
movzx r8d, sp
cmovno r8w, r11w
xchg r8b, r8b
lea r8, [0x1400c53c0]
call fcn.140480a59
mov rdx, rbx
adc cl, dil
neg cl
mov ecx, edi
test bh, 0x65
cmc
cmp esi, 0x4a5371cc
test rax, rax
je 0x14047fc8a
call qword [case.0x140480642.0]
jmp 0x14047fc90
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
setbe dil
movzx edi, r14w
pop rdi
ret

Function at 0x14047fe1c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
test bpl, 0x66
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
adc bh, 0x2f
add rdi, 0x229512f9
sub rsp, 0x30
movzx edi, r14w
mov ebx, r9d
jmp 0x14047fe4a
mov rdi, r8
movsx bp, r15b
movsx r8, r8w
mov esi, edx
jmp 0x14047fe64
lea r9, [0x1400c53d8]
mov edx, 0xd6f680e
xchg dl, r8b
movsx rbp, bp
mov rbp, rcx
lea r8, [0x1400c53d0]
movsx edx, r11w
bswap ecx
lea rdx, [0x1400ce0b8]
mov ecx, 0xb
jmp 0x14047fe98
call fcn.140480a59
mov rcx, rbp
cmp r14b, bpl
jmp 0x14047fea8
test rax, rax
jmp 0x14047feb0
je 0x14047feda
mov r9d, ebx
movzx r8w, al
movsx dx, r8b
mov r8, rdi
cwd
mov edx, esi
jmp 0x14047fecf
call qword [case.0x140480642.0]
jmp 0x14047ff08
xor edx, edx
jmp 0x14047fee1
call fcn.140480554
mov ecx, eax
cwd
jmp 0x14047fef3
mov r9d, ebx
movzx r8d, r14w
setnp dl
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
cmp r15w, 0x32b4
add di, bp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
movzx rdi, r8w
bswap rdi
not di
pop rdi
jmp 0x14047ff34
ret
Function at 0x14048a4ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
rcr si, cl
mov qword [rax + 0x20], rdi
push r12
xor r12w, dx
shr r12b, 0xb8
push r14
mov r12w, 0x7c05
movzx ax, sil
bswap si
push r15
xor r15d, 0x1d5b755c
shrd eax, r9d, 0xc
shr ah, 0xc2
sub rsp, 0x20
rol r15b, cl
or al, r11b
shrd rdi, rdx, 0xfb
sub ebx, ebx
inc r15b
cdqe
mov r15, r8
cbw
setnp r12b
mov edi, edx
mov r12, rcx
stc
mov eax, 1
mov esi, ebx
test edx, edx
jmp 0x14048a561
js 0x14048a60b
test eax, eax
jmp 0x14048a56e
je 0x14048a618
mov rcx, qword [r15]
adc rbp, rsp
lea eax, [rsi + rdi]
cdq
sar bpl, cl
sub eax, edx
movzx edx, r14w
shld dx, bp, 0xf9
shr r14w, 0xd
sar eax, 1
rcr dl, cl
movsxd rbp, eax
or dl, sil
and r14b, r8b
btc dx, 0x6a
mov r14, rbp
test bpl, 0x36
movsx edx, r10w
btr dx, 0xba
shl r14, 4
movzx rdx, dx
mov rdx, qword [r14 + r12]
call fcn.14047f3af
test eax, eax
jmp 0x14048a5cb
jne 0x14048a5eb
lea rcx, [r12 + 8]
add rcx, r14
jmp 0x14048a5de
mov qword [r15], rcx
jmp 0x14048a5e6
jmp 0x14048a603
jns 0x14048a5f9
lea edi, [rbp - 1]
jmp 0x14048a603
lea esi, [rbp + 1]
test di, r13w
cmp edx, r13d
cmp esi, edi
jle 0x14048a567
test eax, eax
setb sil
xchg r12b, r14b
movsx r12, r10w
mov rbp, qword [rsp + 0x48]
cmove esi, eax
cwde
xchg bl, bl
sete bl
movzx rax, ax
mov rsi, qword [rsp + 0x50]
mov eax, ebx
rcr rdi, 0x1b
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
shld r14d, r10d, 0x25
sbb r12b, 0x54
movzx r12d, r13w
add rsp, 0x20
pop r15
movzx r14, r15w
cmovl r12w, r9w
setl r12b
pop r14
movsx r12w, r14b
cmovae r12d, r13d
movzx r12d, sp
pop r12
ret
Function at 0x14048c65c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
sub bl, r12b
mov qword [rsp + 0x18], rsi
bsr bx, r8w
ror bh, 0x62
rol bx, 0x9c
push rdi
test sil, 0x6c
sar dil, 0xda
rol dil, 0x45
sub rsp, 0x20
sar bx, cl
shl dil, 0x99
add bx, 0x3286
xor esi, esi
neg bl
mov rdi, rdx
bsf bx, bp
mov rbx, rcx
jmp 0x14048c6a6
test rcx, rcx
jmp 0x14048c6ae
je 0x14048c74e
cmp word [rcx], si
je 0x14048c74e
lea rdx, [0x1400d0ef8]
jmp 0x14048c6c9
call fcn.1401d7158
test eax, eax
je 0x14048c74e
lea rdx, [0x1400d0ef0]
movzx cx, spl
mov rcx, rbx
jmp 0x14048c6ea
call fcn.1401d7158
test eax, eax
jne 0x14048c73c
mov ecx, dword [rdi + 8]
movzx r9, r8w
lea r9d, [rsi + 2]
movzx rdx, ax
lea r8, [rsp + 0x30]
xchg dh, dh
movsx dx, bh
mov edx, 0x2000000b
jmp 0x14048c71b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x14048c728
je 0x14048c77c
mov eax, dword [rsp + 0x30]
jmp 0x14048c737
jmp 0x14048c79f
mov rcx, rbx
jmp 0x14048c744
call fcn.1404955bf
jmp 0x14048c79f
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
sets dh
mov edx, 0x20001004
jmp 0x14048c769
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x14048c776
jne 0x14048c788
sub eax, eax
jmp 0x14048c783
jmp 0x14048c79f
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x14048c793
jne 0x14048c79f
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
sal si, cl
sar dil, cl
xor dil, 0x54
mov rsi, qword [rsp + 0x40]
sal rdi, cl
movsx rdi, r14w
add rsp, 0x20
pop rdi
ret

Function at 0x14048c7c0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov bh, 0x1b
xchg bx, bx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx rbx, cx
mov esi, edx
mov bl, r13b
movsx rbx, r12w
mov ebx, ecx
jmp 0x14048c7e9
call fcn.14047e94e
mov ecx, ebx
lea r8, [rsp + 0x30]
clc
bt dx, cx
or r9d, r12d
and ecx, 0x3ff
mov r9d, 2
cwd
btc edx, r10d
btr dx, cx
bts ecx, 0xa
movsx edx, sp
movsx di, r10b
mov edx, 0x20000001
movzx di, r11b
mov rdi, rax
jmp 0x14048c831
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
cmp r13w, ax
test eax, eax
je 0x14048c901
cmp ebx, dword [rsp + 0x30]
jmp 0x14048c84f
je 0x14048c8f7
test esi, esi
jmp 0x14048c85c
je 0x14048c8f7
mov r9, qword [rdi + 0x98]
cqo
movsx edx, sp
mov r8d, r10d
movzx edx, word [r9]
shl cl, cl
movzx eax, r14w
shr cl, 0x5c
lea rcx, [r9 + 2]
neg ah
lea eax, [rdx - 0x41]
jmp 0x14048c88f
cmp ax, 0x19
jmp 0x14048c898
jbe 0x14048c8b2
sub dx, 0x61
cmc
cmp dx, 0x19
jmp 0x14048c8ac
ja 0x14048c8cb
movzx edx, word [rcx]
jmp 0x14048c8ba
inc r8d
add rcx, 2
jmp 0x14048c8c6
jmp 0x14048c884
or rcx, 0xffffffffffffffff
jmp 0x14048c8d4
inc rcx
cmp r14b, 0xc7
test cl, 0x25
cmp word [r9 + rcx*2], r10w
jmp 0x14048c8e8
jne 0x14048c8d4
cmp r8d, ecx
je 0x14048c901
mov eax, 1
jmp 0x14048c905
xor eax, eax
rcr bl, cl
mov rbx, qword [rsp + 0x38]
shld di, dx, 0x63
bt di, r14w
bts si, r9w
mov rsi, qword [rsp + 0x40]
btr di, r15w
add rsp, 0x20
pop rdi
jmp 0x14048c92d
ret
Function at 0x14048dfde
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmc
jmp 0x14048dffb
mov qword [rax + 8], rbx
jmp 0x14048e00b
mov qword [rax + 0x10], rbp
cmc
mov qword [rax + 0x18], rsi
test cl, r12b
stc
mov qword [rax + 0x20], rdi
test edi, ecx
push r14
cmc
sub rsp, 0x40
jmp 0x14048e02a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
cmovno bx, r15w
bts ebx, esi
mov rbx, rax
test rax, rax
jmp 0x14048e046
je 0x14048e1ab
mov rsi, rax
cmp word [rax], r14w
jmp 0x14048e058
je 0x14048e098
or rax, 0xffffffffffffffff
inc rax
test ch, 0x68
stc
cmp word [rsi + rax*2], r14w
jmp 0x14048e073
jne 0x14048e062
lea rsi, [rsi + rax*2]
test spl, 0xe9
add rsi, 2
cmp spl, 0x75
cmp word [rsi], r14w
jmp 0x14048e092
jne 0x14048e05e
mov qword [rsp + 0x38], r14
inc r8b
bsr r9w, cx
xadd r9b, r9b
sub rsi, rbx
rcr r9b, 0xae
mov qword [rsp + 0x30], r14
movzx r9w, dil
movzx r8, r15w
add rsi, 2
ror r8b, 0xa3
sar rsi, 1
mov r8b, 0xbb
movsx r8, sp
mov r8, rbx
movsx r9, di
bt r9w, 0xdf
test bpl, spl
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
jmp 0x14048e0f6
call fcn.14047e71f
movsxd rbp, eax
test eax, eax
jmp 0x14048e105
je 0x14048e1ab
mov rcx, rbp
jmp 0x14048e113
call fcn.14047e662
mov rdi, rax
test rax, rax
jmp 0x14048e123
je 0x14048e191
mov qword [rsp + 0x38], r14
and r8b, 0xe3
stc
sal r8w, cl
mov r9d, esi
ror r8d, 0xdb
xor r8b, dil
mov qword [rsp + 0x30], r14
clc
adc r8w, bp
mov r8, rbx
mov dword [rsp + 0x28], ebp
cmc
sub edx, edx
sub ecx, ecx
jmp 0x14048e15c
mov qword [rsp + 0x20], rax
jmp 0x14048e166
call fcn.14047e71f
test eax, eax
jmp 0x14048e172
je 0x14048e191
mov rsi, rdi
jmp 0x14048e189
mov rdi, r14
jmp 0x14048e199
mov rsi, r14
mov ecx, 0x21887e00
mov rcx, rdi
jmp 0x14048e1a1
call fcn.14047e5e7
jmp 0x14048e1b8
mov rsi, r14
cmp sp, si
test r9d, 0x11351591
test rbx, rbx
jmp 0x14048e1c0
je 0x14048e1cf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
sub r14w, ax
bts di, r12w
or ebp, r9d
mov rsi, qword [rsp + 0x60]
test r12, 0xca11663
btr bp, 0xed
mov rbp, qword [rsp + 0x58]
btc r14d, r11d
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
movzx r14d, r15w
movsx r14, sp
pop r14
jmp 0x14048e215
ret
Function at 0x14048e216
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmc
cmp rax, r12
clc
mov qword [rsp + 0x10], rbp
test r13b, 0xf9
cmp r10d, esi
clc
mov qword [rsp + 0x18], rsi
jmp 0x14048e237
push rdi
cmp r13b, 0x3f
test r10b, 0x69
sub rsp, 0x20
jmp 0x14048e249
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
cmp al, 0xe4
cmc
test rax, rax
jmp 0x14048e25f
je 0x14048e328
mov rbp, rax
clc
cmp dl, r14b
cmp word [rax], si
jmp 0x14048e274
je 0x14048e2ab
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jmp 0x14048e28b
jne 0x14048e27e
lea rbp, [rbp + rax*2]
add rbp, 2
clc
test edx, 0x19b03541
cmp word [rbp], si
jne 0x14048e27a
sub rbp, rbx
movzx cx, spl
xor ch, 0xa9
add rbp, 2
shr cx, cl
sar rbp, 1
add rbp, rbp
movsxd rcx, ebx
cmovnp cx, r14w
movsx ecx, bx
mov rcx, rbp
jmp 0x14048e2d6
call fcn.14047e662
mov rdi, rax
clc
jmp 0x14048e2e6
test rax, rax
jmp 0x14048e2ee
je 0x14048e313
mov r8, rbp
movzx edx, r11w
xchg cl, cl
mov rdx, rbx
mov cx, si
mov rcx, rax
jmp 0x14048e30b
call fcn.140459a26
mov rsi, rdi
xor ecx, ecx
jmp 0x14048e31a
call fcn.14047e5e7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
bt edi, r11d
add di, 0x4714
mov rax, rsi
mov rsi, qword [rsp + 0x40]
xor bp, 0x686c
mov rbp, qword [rsp + 0x38]
adc dil, 0x85
rcr di, cl
add rsp, 0x20
pop rdi
jmp 0x14048e359
ret
Function at 0x140491165
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
bswap rax
cwde
cdqe
mov qword [rsp + 0x18], rbp
bswap ax
mov al, spl
nop
push rsi
push rdi
push r14
movzx ax, sil
mov eax, 0x1450
jmp 0x140491192
call fcn.1403ff6b8
sub rsp, rax
mov rax, qword [0x1400b6278]
or di, 0x38e
mov r14w, 0x368c
xor rax, rsp
mov qword [rsp + 0x1440], rax
clc
movsxd r10, edx
jmp 0x1404911c4
mov rdi, rcx
dec ax
rcr si, cl
mov rax, r10
btc ecx, 0x23
shr ecx, cl
test r10w, 0x4476
mov ebp, r9d
clc
bswap cx
sar rax, 6
lea rcx, [0x1400b9aa0]
and r10d, 0x3f
add rbp, r8
adc esi, r13d
bswap r14d
jmp 0x140491200
mov rsi, r8
cmovne r14w, bx
shrd dx, r12w, 0x63
mov rax, qword [rcx + rax*8]
sub dx, 0xdbe
lea rdx, [r10 + r10*8]
rol r14w, cl
movsx r14, bp
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
test r12b, r14b
clc
jmp 0x140491233
mov qword [rdi], rax
test r13w, bx
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x140491245
jae 0x140491345
lea rbx, [rsp + 0x40]
test sp, r11w
cmp rsi, rbp
jmp 0x14049125c
jae 0x1404912c1
mov al, byte [rsi]
jmp 0x140491269
inc rsi
cmc
cmp al, 0xa
jmp 0x140491274
jne 0x140491292
inc dword [rdi + 8]
jmp 0x140491282
mov byte [rbx], 0xd
jmp 0x14049128a
inc rbx
jmp 0x140491292
mov byte [rbx], al
movsx ax, bh
jmp 0x14049129f
inc rbx
lea rax, [rsp + 0x143f]
cmc
test dh, 0x32
jmp 0x1404912b3
cmp rbx, rax
jmp 0x1404912bb
jb 0x140491254
and qword [rsp + 0x20], 0
adc dx, r8w
movzx r9, r13w
lea rax, [rsp + 0x40]
sub ebx, eax
cwd
not r8b
cmovg ecx, ebp
lea r9, [rsp + 0x30]
movzx cx, bpl
movzx r8, r15w
mov r8d, ebx
mov cl, 0x8d
cwd
lea rdx, [rsp + 0x40]
movzx rcx, bx
mov rcx, r14
jmp 0x140491304
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x140491311
je 0x14049133d
mov eax, dword [rsp + 0x30]
cmp sil, r11b
add dword [rdi + 4], eax
clc
cmp eax, ebx
jmp 0x140491329
jb 0x140491345
cmp rsi, rbp
jb 0x14049124b
jmp 0x140491345
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov cx, 0x2f03
sub cx, dx
sar cl, cl
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x140491361
call fcn.140454a7f
lea r11, [rsp + 0x1450]
movsx si, r9b
mov bpl, spl
movsx rbx, r13w
mov rbx, qword [r11 + 0x20]
mov si, 0x7cfc
mov rbp, qword [r11 + 0x30]
movsx di, r12b
setle sil
mov rsp, r11
cmove r14w, bp
pop r14
movsx di, r13b
movzx si, r10b
pop rdi
movsx esi, r9w
not rsi
pop rsi
jmp 0x1404913b1
ret
Function at 0x1404913b2
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx rax, r14w
cbw
mov qword [rsp + 0x18], rbp
jmp 0x1404913e2
push rsi
cdqe
cmovns ax, bp
not eax
push rdi
mov al, r9b
push r14
mov eax, 0x1450
call fcn.1403ff6b8
sub rsp, rax
mov rax, qword [0x1400b6278]
test rax, r14
shr bp, cl
test rdi, 0x37807674
xor rax, rsp
bsf si, r12w
mov qword [rsp + 0x1440], rax
movsxd rdi, ebx
btr ax, 0xb9
movsxd r10, edx
sbb r14b, 0x65
mov rdi, rcx
xor cl, 0x7e
btc bp, 0x13
mov rax, r10
sbb cl, r10b
bts rbp, rsi
mov ebp, r9d
shl r14w, 0xbb
sar rax, 6
or sil, 0x4b
sal r14b, cl
lea rcx, [0x1400b9aa0]
cmovnp si, r14w
or si, 0x2d4f
and r10d, 0x3f
dec r14b
sbb edx, 0x49fd600b
cdq
lea rbp, [rbp + r8]
mov rsi, r8
or r14, 0x713b421f
rol dl, cl
shrd r14w, di, 0x68
mov rax, qword [rcx + rax*8]
sal dh, 8
shl dh, 0xb1
lea rdx, [r10 + r10*8]
sub r14d, 0xd447973
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x1404914b4
sub eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404914c4
jae 0x1404915c8
lea rbx, [rsp + 0x40]
cmp dx, 0x1681
test rax, 0x16233d46
cmp rsi, rbp
jae 0x14049153a
movzx eax, word [rsi]
cmp ebp, r10d
add rsi, 2
clc
test r8b, 0xb8
cmc
cmp ax, 0xa
jmp 0x1404914fc
jne 0x140491516
add dword [rdi + 8], 2
and cl, r15b
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
clc
mov word [rbx], ax
bsr ax, ax
btc rax, 0xc8
add rbx, 2
lea rax, [rsp + 0x143e]
cmp r14, r9
cmp rbx, rax
jb 0x1404914da
and qword [rsp + 0x20], 0
ror ecx, cl
cdqe
lea rax, [rsp + 0x40]
add ch, 5
movzx cx, r10b
sub rbx, rax
bt r8d, 0xa0
sub dh, 0x50
add dx, di
lea r9, [rsp + 0x30]
or r8b, 0x17
inc dh
setnp r8b
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
xchg r8b, r8b
mov rcx, r14
cmovno r8w, r14w
mov r8d, ebx
jmp 0x14049158b
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x140491598
je 0x1404915c0
mov eax, dword [rsp + 0x30]
stc
add dword [rdi + 4], eax
test bx, r11w
cmp eax, ebx
jb 0x1404915c8
cmp rsi, rbp
jb 0x1404914ca
jmp 0x1404915c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
sub cx, r11w
add cx, 0x5350
sar cl, 2
mov rcx, qword [rsp + 0x1440]
cmp bpl, r11b
test r8d, 0x74a11f1e
xor rcx, rsp
jmp 0x1404915f1
call fcn.140454a7f
lea r11, [rsp + 0x1450]
cmovns bp, ax
movsx r14w, cl
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movzx si, r12b
setp dil
mov sil, r13b
pop r14
pop rdi
pop rsi
jmp 0x140491627
ret
Function at 0x140491628
Capabilities:
Authenticate hmac
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
setns al
cbw
mov qword [rsp + 0x18], rbp
cdqe
cwde
push rsi
mov eax, 0x34147428
bswap rax
push rdi
push r12
cdqe
push r14
push r15
mov eax, 0x1470
jmp 0x140491659
call fcn.1403ff6b8
sub rsp, rax
movsxd r15, r11d
mov rax, qword [0x1400b6278]
rcl bl, cl
xor rax, rsp
mov qword [rsp + 0x1460], rax
movsxd r10, edx
mov rbx, rcx
cbw
mov rax, r10
sar rdi, cl
xchg r15w, cx
mov r14d, r9d
sar rax, 6
movsx rdi, ax
sbb dil, 0x6f
bt r12w, r12w
lea rcx, [0x1400b9aa0]
and r10d, 0x3f
lea r14, [r14 + r8]
mov r15, r8
mov rdi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
rcl r12w, 0x5d
mov r12, qword [rax + rdx*8 + 0x28]
stc
test r15w, r9w
xor eax, eax
mov qword [rbx], rax
test bp, bx
cmp cl, 0x68
cmp r8, r14
mov dword [rbx + 8], eax
jmp 0x1404916e0
jae 0x14049185a
lea rax, [rsp + 0x50]
cmp rdi, r14
jmp 0x1404916f3
jae 0x14049174b
movzx ecx, word [rdi]
add rdi, 2
cmc
cmp cx, 0xa
jmp 0x14049170a
jne 0x140491721
mov edx, 0xd
clc
mov word [rax], dx
cmp spl, r12b
stc
add rax, 2
mov word [rax], cx
rol cx, cl
cmp bl, 0x5c
add rax, 2
or cl, 0x90
movsxd rcx, eax
test cl, 0x1b
lea rcx, [rsp + 0x6f8]
test sil, r13b
cmp rax, rcx
jb 0x1404916eb
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
shr r9w, cl
xadd r9, r8
lea r8, [rsp + 0x50]
sub rax, rcx
clc
neg r9b
adc r9b, bl
mov dword [rsp + 0x28], 0xd55
mov cx, r15w
lea rcx, [rsp + 0x700]
sbb r9, 0x7c0a143c
sar rax, 1
mov qword [rsp + 0x20], rcx
movsxd rcx, r11d
mov r9d, eax
mov ecx, 0xfde9
xor edx, edx
jmp 0x1404917a8
call fcn.14047e71f
mov ebp, eax
stc
test eax, eax
je 0x14049184d
xor esi, esi
test eax, eax
jmp 0x1404917c1
je 0x14049182c
and qword [rsp + 0x20], 0
ror cl, cl
bts r8d, ebp
bsf r9, rdx
lea rdx, [rsp + 0x700]
and r9b, r14b
mov ecx, esi
shl r9b, 0x82
bts r9d, r8d
cmp al, dil
lea r9, [rsp + 0x40]
shl r8d, 0x36
mov r8d, ebp
lea rdx, [rdx + rcx]
mov rcx, r12
sub r8d, esi
jmp 0x14049180a
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14049184d
add esi, dword [rsp + 0x40]
test r8, rcx
cmp esi, ebp
jmp 0x140491826
jb 0x1404917c7
mov eax, edi
test cx, 0x51b4
stc
cmp rcx, r13
sub eax, r15d
mov dword [rbx + 4], eax
test rbx, r9
cmp rdi, r14
jmp 0x140491848
jmp 0x1404916e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
add al, 2
sar cx, cl
mov rax, rbx
mov rcx, qword [rsp + 0x1460]
stc
jmp 0x14049186e
xor rcx, rsp
jmp 0x140491876
call fcn.140454a7f
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
jmp 0x140491897
mov rsp, r11
setp dil
pop r15
movzx r12, r8w
mov r12w, dx
movsx r14w, dil
pop r14
movzx r12d, r10w
not r12b
cmovp rdi, r9
pop r12
pop rdi
pop rsi
ret
Function at 0x140494e51
Capabilities:
Get thread local storage value

Disassembly:
push rbx
bt dx, 0x49
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1400c7e90]
mov ecx, 2
cqo
bswap r8w
cdq
lea r8, [0x1400c7e88]
lea rdx, [0x1400ce860]
call fcn.140495034
mov ecx, ebx
cmp r13d, ebp
jmp 0x140494e8e
test rax, rax
jmp 0x140494e96
je 0x140494eb1
add rsp, 0x20
movsx rbx, r8w
pop rbx
jmp 0x140494eaa
jmp qword [case.0x140480642.0]
add rsp, 0x20
pop rbx
jmp 0x140494ebb
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x140494ec2
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
bsf r9, r15
ror r9w, 0x6c
or r9, 0x28b401f6
push rdi
or dil, 0xfa
btr r8d, ebx
sub rsp, 0x20
movsx ebx, r12w
mov r8, r11
bswap r9w
mov rbx, rdx
movsxd rdx, r14d
movsx r8d, r14w
lea r9, [0x1400c7e98]
movzx r8, r11w
movzx dx, bl
mov edi, ecx
mov rcx, 0xecd200e
movsx edx, ax
cwd
lea rdx, [0x1400ce850]
xchg r8b, r8b
mov ecx, 3
lea r8, [0x1400c7e90]
jmp 0x140494f31
call fcn.140495034
mov rdx, rbx
bswap cx
bsr cx, r14w
mov ecx, edi
test rax, rax
je 0x140494f57
call qword [case.0x140480642.0]
jmp 0x140494f5d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
movzx edi, sp
pop rdi
jmp 0x140494f6f
ret
Function at 0x140495912
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
stc
cmp bpl, 0x82
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
movzx rsi, cx
push rdi
test r12b, 0x97
cmp sil, 9
rcl dil, cl
sub rsp, 0x30
movzx di, r12b
adc si, r12w
movsxd rdi, r8d
bts r8w, r10w
test r13w, 0x4fd5
mov r8d, ecx
mov rsi, rdx
cmc
test ecx, 0xfffff3ff
jmp 0x140495963
jne 0x140495975
cmp ecx, 0xc00
jne 0x140495ae3
test rsi, rsi
jne 0x14049598b
test edi, edi
jmp 0x140495985
jg 0x140495ae3
test edi, edi
jmp 0x140495992
js 0x140495ae3
sub r9d, r9d
cmovne rax, r14
rol dx, cl
lea rbp, reloc.d2d1.dll_Ordinal_1
cmp r8b, 0x7c
mov r10d, 0xe3
lea eax, [r10 + r9]
ror dx, 0xf
jmp 0x1404959c4
cdq
bsr rcx, r14
sub eax, edx
mov edx, r8d
not cx
cmove rcx, r10
sub ecx, esi
sar eax, 1
shrd cx, bx, 0xf
sal ch, 0x93
movsxd rcx, eax
cmp r11w, r12w
test dil, 0xed
cmc
shl rcx, 4
test r8w, bx
sub edx, dword [rcx + rbp]
jmp 0x1404959fd
je 0x140495a52
test edx, edx
movzx ecx, r11w
lea ecx, [rax - 1]
jmp 0x140495a11
cmovns ecx, r10d
not r10d
movsxd r10, esi
inc eax
rol r10w, 0xe2
rcr r10w, cl
shl r10w, 0xb6
test edx, edx
mov r10b, r10b
mov r10d, ecx
cmovns r9d, eax
cmp eax, ebp
cmp r9d, ecx
jmp 0x140495a41
jle 0x1404959b3
or eax, 0xffffffff
jmp 0x140495a52
test eax, eax
jmp 0x140495a59
js 0x140495ae3
cdqe
bts dx, r9w
mov edx, 0x55
movsx ecx, r8w
add rax, rax
mov rbp, qword [rbp + rax*8 + 8]
movzx cx, r10b
mov rcx, rbp
jmp 0x140495a84
call fcn.1400e2d47
mov rbx, rax
test r15b, 0x90
cmp di, sp
test edi, edi
jmp 0x140495a9a
jle 0x140495ad6
cmp ebx, edi
jmp 0x140495aa7
jge 0x140495ae3
mov rdx, rdi
bswap r8
xchg r8d, r8d
mov r8, rbp
setne cl
mov rcx, rsi
jmp 0x140495ac4
call fcn.14047f2e1
test eax, eax
jmp 0x140495ad0
jne 0x140495b25
lea eax, [rbx + 1]
jmp 0x140495ade
jmp 0x140495aee
xor eax, eax
xor esi, 0x58c77dfb
dec bpl
mov rbx, qword [rsp + 0x40]
add sil, 0xba
setl dil
mov rbp, qword [rsp + 0x48]
jmp 0x140495b0e
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
movzx di, r14b
movzx edi, r10w
movsx edi, sp
pop rdi
ret
and qword [rsp + 0x20], 0
cmp cl, dil
cmp r13w, 0x5af8
xor r9d, r9d
cmp bx, r12w
sub r8d, r8d
test r9b, dil
cmp cx, si
sub edx, edx
sub ecx, ecx
call fcn.14046c3bb
int3
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, [0x14002a574]
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.1400099a0
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, [0x14002a580]
call fcn.140001c50
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.14001415c
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, [0x14002a5d0]
lea rcx, [0x14002a614]
call fcn.140001c10
jmp 0x14000126c
mov ecx, 0x2000
call fcn.14001415c
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, [0x14002a620]
lea rcx, [0x14002a614]
call fcn.140001c10
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi]
mov eax, 0x2000
cmp r12, rax
mov rbx, r12
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000e96c
cmp rax, rbx
jne 0x14000125e
mov rcx, qword [rdi]
call fcn.14000e6e0
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140007df0
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.14000f0ac
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14000e6e0
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000aed0
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, [0x14002a670]
add rdx, 0x12
mov r8d, edi
call fcn.140001c50
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.140009680
mov rcx, r13
call fcn.140014148
mov rcx, rbp
call fcn.140014148
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret