joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140448bd7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
movsxd r9, r8d
btr esi, 0x72
push rdi
sub rsp, 0x68
xor rsi, 0x5aa31304
adc dil, bpl
neg r9b
mov rdi, rcx
adc sil, 0x40
add sil, r14b
ror r9w, 0x3a
movabs rsi, 0xad4a5352d2edebd0
sub dh, 0xe6
movsx dx, r10b
sal r9, cl
lea r9, [rcx + 8]
lea rdx, [0x1400bff18]
xor ecx, ecx
cmc
sub r8d, r8d
jmp 0x140448c2b
call sub.d2d1.dll_Ordinal_1
test eax, eax
jmp 0x140448c37
je 0x140448c56
mov ecx, eax
mov dl, 3
movzx r8d, r10w
mov r8, rsi
mov r9b, cl
mov r9d, 0x22
call fcn.1403b22f3
mov rcx, qword [rdi]
mov dx, 0x6d04
lea rdx, [rsp + 0x20]
jmp 0x140448c67
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x28]
cdq
mov ecx, dword [rsp + 0x2c]
bsf r9d, esp
movsx r9w, r9b
test r13b, 0xd4
sub ecx, dword [rsp + 0x24]
bsf r9w, r12w
and r9w, bx
sub eax, dword [rsp + 0x20]
shl r9b, 0xc
movsx rdx, r11w
shl rcx, 0x20
jmp 0x140448ca5
or rax, rcx
mov rcx, qword [rdi + 8]
movzx rdx, bp
cwd
lea r9, [rdi + 0x10]
cqo
mov rdx, qword [rdi]
jmp 0x140448cc0
mov qword [rsp + 0x50], rdx
jmp 0x140448cca
mov qword [rsp + 0x58], rax
jmp 0x140448cd4
mov dword [rsp + 0x60], 0
jmp 0x140448ce1
xorps xmm0, xmm0
movups xmmword [rsp + 0x3c], xmm0
movaps xmmword [rsp + 0x30], xmm0
movsxd r8, edx
cmovo edx, edi
mov rax, qword [rcx]
cdq
lea rdx, [rsp + 0x30]
seto r8b
movsx r8w, r13b
lea r8, [rsp + 0x50]
jmp 0x140448d10
call qword [rax + 0x70]
test eax, eax
jmp 0x140448d1a
je 0x140448d3e
mov ecx, eax
mov dl, 3
mov r8, rsi
movzx r9d, r14w
movzx r9w, r13b
movsxd r9, r11d
mov r9d, 0x31
call fcn.1403b22f3
mov rcx, qword [rdi + 0x10]
xchg rdx, rdx
rdtsc
mov r8, r11
lea r8, [rdi + 0x18]
movsx rdx, cx
rdtsc
mov rax, qword [rcx]
xchg dh, dl
movzx dx, r10b
lea rdx, [0x1400bff08]
jmp 0x140448d6a
call qword [rax]
test eax, eax
je 0x140448da6
mov ecx, eax
mov dl, 3
cmovns r8d, r8d
movsx r9w, r8b
mov r8w, bx
mov r8, rsi
movsx r9w, r13b
movsx r9, r10w
jmp 0x140448d96
mov r9d, 0x37
jmp 0x140448da1
call fcn.1403b22f3
mov rcx, qword [rdi + 0x18]
neg r9b
btc r9w, r13w
add rdi, 0x20
sal eax, cl
rcr r9w, cl
sar dl, cl
movaps xmm0, xmmword [0x1400bd390]
xchg dl, r9b
sal al, cl
movaps xmmword [rsp + 0x30], xmm0
sar r9d, 0x85
mov rax, qword [rcx]
and dx, r14w
lea rdx, [rsp + 0x30]
sub r8d, r8d
cmovae r9, rbp
movzx r9d, cx
mov r9, rdi
jmp 0x140448df2
call qword [rax + 0x40]
test eax, eax
jmp 0x140448dfc
je 0x140448e26
mov ecx, eax
setnp dl
mov dl, 3
movzx r8, r11w
xchg r8d, r8d
mov r8, rsi
mov r9b, 4
mov r9d, 0x3a
jmp 0x140448e21
call fcn.1403b22f3
nop
btr edi, r12d
add rsp, 0x68
mov rsi, 0x3a4a7d9a
bswap edi
setne sil
pop rdi
pop rsi
jmp 0x140448e43
ret
Function at 0x14044a56b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
and ax, r12w
bts ax, ax
xor r15b, r12b
push r14
neg r15w
push rsi
bts ax, sp
push rdi
push rbp
push rbx
bt r14w, r11w
movzx r14d, bx
ror bl, cl
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm8
jmp 0x14044a5a7
movaps xmmword [rsp + 0x60], xmm7
not r14d
cmovb r14, rsp
movaps xmmword [rsp + 0x50], xmm6
lahf
bswap r15w
mov r14, r8
mov rbx, rdx
mov r15, rcx
cwd
movsx rbp, sp
rdtsc
mov rsi, qword [rsp + 0xe0]
xchg dx, dx
mov ebp, dword [rsp + 0xf0]
lahf
bswap rdi
mov edx, dword [rsp + 0xe8]
movzx rax, r11w
cmova di, r11w
lahf
mov rdi, qword [r9]
movsx ecx, si
mov rax, qword [rdi]
movzx rcx, dx
movsxd rcx, esp
xchg cx, cx
mov rcx, rdi
jmp 0x14044a610
call qword [rax + 0x18]
mov rax, qword [rdi]
mov rcx, rdi
movsx edx, r9w
movzx edx, si
mov edx, ebp
jmp 0x14044a627
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
movups xmm0, xmmword [r14]
mov ax, r10w
cdqe
bswap ax
movaps xmmword [rsp + 0x40], xmm0
movsx eax, r10w
movzx dx, r10b
mov rax, qword [rcx]
lea r14, [rsp + 0x40]
mov rdx, r14
jmp 0x14044a659
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x14044a665
movaps xmm0, xmm7
jmp 0x14044a66d
call fcn.1404bb428
movaps xmm8, xmm0
jmp 0x14044a67b
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x14044a687
call fcn.1404bb428
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
jmp 0x14044a6ac
movaps xmm0, xmm7
jmp 0x14044a6b4
call fcn.1404bb428
movaps xmm6, xmm0
jmp 0x14044a6c1
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x14044a6cd
call fcn.1404bb428
movss dword [rbx + 8], xmm6
jmp 0x14044a6dc
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
movsx cx, r8b
mov rcx, qword [r15 + 0x18]
movzx eax, r9w
mov eax, esp
mov rax, qword [r15 + 0x20]
jmp 0x14044a6fc
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
sub r8d, r8d
jmp 0x14044a711
nop
clc
cmc
cmp word [rsi + r8*2], 0
lea r8, [r8 + 1]
jne 0x14044a714
dec r8d
mov rbp, qword [rcx]
cdq
cmovp dx, r13w
movsx dx, r11b
mov qword [rsp + 0x28], rax
cqo
movzx r9w, r11b
movsx r9d, sp
mov qword [rsp + 0x20], r14
movzx edx, dx
movzx r9w, r9b
movzx rdx, dx
mov dword [rsp + 0x38], 0
movsx r9, bx
cmovne r9d, r9d
movsx edx, di
mov dword [rsp + 0x30], 2
movsx rdx, r14w
mov rdx, rsi
movsx r9, r10w
setge r9b
mov r9, rdi
jmp 0x14044a788
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
movzx edi, r11w
or sil, 0x5e
test spl, 0xc0
movaps xmm7, xmmword [rsp + 0x60]
cmc
cmp r14b, dil
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0x88
movzx di, bl
movsx r15, r14w
movsxd r15, r11d
pop rbx
movsx r14, ax
movsx esi, cx
xchg dil, sil
pop rbp
movzx r14, r13w
movzx r14w, bl
mov r14w, sp
pop rdi
xchg r14w, r15w
movzx rsi, r14w
bswap si
pop rsi
not r15d
pop r14
movzx r15d, r10w
pop r15
jmp 0x14044a7f6
ret
Function at 0x14044b816
Capabilities:
Encrypt data using rc4 prga
Parse pe header

Disassembly:
sub rsp, 0x18
shl r8w, 0x46
mov r8, rcx
xor ah, bl
and eax, r11d
sub al, sil
mov eax, 0x5a4d
clc
jmp 0x14044b835
cmp word [0x140000000], ax
jmp 0x14044b841
jne 0x14044b953
movsxd rcx, dword [0x14000003c]
movzx dx, bpl
xchg rdx, rdx
lea rdx, [0x140000000]
add rcx, rdx
test r10b, 0x55
cmp dword [rcx], 0x4550
jne 0x14044b953
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x14044b87e
jne 0x14044b953
sub r8, rdx
cmovb r9d, eax
movzx edx, word [rcx + 0x14]
cmp cl, 0x85
movzx rax, r10w
add rdx, 0x18
lea rdx, [rdx + rcx]
or eax, ebp
add r9b, 0x95
movsx r9d, r12w
movzx eax, word [rcx + 6]
shl ch, cl
lea rcx, [rax + rax*4]
shl r9b, 0x89
btr r9w, 0x6e
xadd r9b, r9b
lea r9, [rdx + rcx*8]
test dx, si
cmp cx, r14w
mov qword [rsp], rdx
cmp r14w, r12w
cmp r10, 0x481f5b4f
cmp rdx, r9
jmp 0x14044b8e2
je 0x14044b91a
mov ecx, dword [rdx + 0xc]
stc
test ch, 0xab
cmc
cmp r8, rcx
jmp 0x14044b8f8
jb 0x14044b90c
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14044b91c
add rdx, 0x28
jmp 0x14044b915
jmp 0x14044b8cb
sub edx, edx
test rdx, rdx
jne 0x14044b931
sub al, al
jmp 0x14044b92c
jmp 0x14044b962
cmp dword [rdx + 0x24], 0
jmp 0x14044b93a
jge 0x14044b94c
xor al, al
jmp 0x14044b947
jmp 0x14044b962
mov al, 1
jmp 0x14044b962
xor al, al
jmp 0x14044b95a
jmp 0x14044b962
add rsp, 0x18
jmp 0x14044b96b
ret
Function at 0x14045d20e
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsx rcx, sp
mov ecx, r13d
lea rcx, [rsp + 0x30]
jmp 0x14045d223
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
stc
add rsp, 0x28
jmp 0x14045d238
ret

Function at 0x14045d302
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
bt rax, 0x5c
mov rbp, rsp
cmc
movzx rbx, r13w
sub rsp, 0x20
clc
sar rbx, cl
mov rax, qword [0x1400b7288]
cmovb rbx, rbp
rcr bh, 0x13
movabs rbx, 0x2b992ddfa232
test r15b, 0xb7
cmp rax, rbx
jmp 0x14045d341
jne 0x14045d439
and qword [rbp + 0x18], 0
movzx rcx, bx
lea rcx, [rbp + 0x18]
jmp 0x14045d359
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045d368
mov qword [rbp + 0x10], rax
jmp 0x14045d371
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
stc
cmc
xor qword [rbp + 0x10], rax
jmp 0x14045d384
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
xor cx, 0x10a9
bt rcx, 0x10
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x14045d3a3
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
shld cx, dx, 0x29
xor ecx, ecx
lea rcx, [rbp + 0x10]
cmp r11d, 0x3bc20e76
clc
shl rax, 0x20
test rbp, 0x61ec196e
xor rax, qword [rbp + 0x20]
cmc
cmp cx, 0x5d4
xor rax, qword [rbp + 0x10]
sub bp, r8w
xor rax, rcx
xadd ebp, ebp
dec cx
btc cx, sp
movabs rcx, 0xffffffffffff
bt rbp, 0xd4
and rax, rcx
shl ebp, 0xa0
bsf ecx, r12d
bt rcx, rbx
movabs rcx, 0x2b992ddfa233
or bp, cx
sar bp, cl
cmp rax, rbx
movsx rbx, r13w
movzx rbp, bx
xchg bpl, bl
cmove rax, rcx
mov qword [0x1400b7288], rax
bts bp, r15w
shld bx, cx, 0xea
mov rbx, qword [rsp + 0x48]
not rax
movzx ebp, r12w
not bp
mov qword [0x1400b7280], rax
shr bp, cl
ror bp, cl
bts bp, si
add rsp, 0x20
mov bpl, 0x68
cmovae bp, di
movzx rbp, si
pop rbp
ret

Function at 0x14045d505
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
cmc
xor ecx, ecx
jmp 0x14045d511
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x14045d51f
je 0x14045d59e
mov ecx, 0x5a4d
cmc
cmp r14, rdx
cmp word [rax], cx
jmp 0x14045d536
jne 0x14045d59e
movsxd rcx, dword [rax + 0x3c]
cmp cx, 0x6bbf
lea rcx, [rcx + rax]
test ah, 0x93
clc
cmp dword [rcx], 0x4550
jmp 0x14045d558
jne 0x14045d59e
mov eax, 0x20b
stc
jmp 0x14045d569
cmp word [rcx + 0x18], ax
jmp 0x14045d572
jne 0x14045d59e
cmp dword [rcx + 0x84], 0xe
jmp 0x14045d584
jbe 0x14045d59e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14045d599
jmp 0x14045d5a0
sub al, al
add rsp, 0x28
jmp 0x14045d5a9
ret
Function at 0x14046f079
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
mov qword [rax + 8], rbx
test si, bp
mov qword [rax + 0x10], rbp
rcr bpl, 0xa6
and bp, 0x5563
mov qword [rax + 0x18], rsi
add ebp, ecx
not si
mov qword [rax + 0x20], rdi
not di
btr ebp, esi
push r14
jmp 0x14046f0ab
sub rsp, 0x20
bswap r14w
movsx rdi, ax
cmovbe si, cx
mov rsi, qword [rsp + 0x50]
movzx r14d, r9w
btr bp, r11w
mov rdi, r8
and bp, dx
mov rbp, rdx
test rsi, rsi
je 0x14046f19a
mov rbx, qword [r8 + 8]
cmp al, r14b
test rbx, rbx
jmp 0x14046f0ea
je 0x14046f188
mov rax, qword [rbx + 0x40]
cmp qword [rax], 0
jmp 0x14046f0fd
je 0x14046f153
mov rax, qword [rbx + 0x58]
cmp r13b, r9b
cmp dword [rax], 0
jle 0x14046f153
dec dword [rax]
rdtsc
mov al, 0xd0
mov rcx, qword [rbx + 0x40]
cqo
mov al, r15b
movzx rax, r8w
mov rdx, qword [rcx]
movsx ax, sil
cbw
lea rax, [rdx + 2]
jmp 0x14046f139
mov qword [rcx], rax
movzx eax, r14w
jmp 0x14046f145
mov word [rdx], r14w
jmp 0x14046f14e
jmp 0x14046f16c
mov rax, qword [rbx]
movzx edx, r14w
mov rcx, rbx
jmp 0x14046f162
mov rax, qword [rax + 0x18]
call qword [case.0x14044b608.0]
mov ecx, 0xffff
test dil, 0xe9
jmp 0x14046f17a
cmp cx, ax
jmp 0x14046f182
jne 0x14046f18b
mov byte [rdi], 1
sub rsi, 1
jmp 0x14046f194
jne 0x14046f0e2
movups xmm0, xmmword [rdi]
cmovne r14, r14
mov rbx, qword [rsp + 0x30]
rol si, cl
sar r14d, cl
mov rax, rbp
sar r14w, cl
mov rsi, qword [rsp + 0x40]
movsx edi, sp
adc r14w, 0x5cb9
bts r14, r9
mov rdi, qword [rsp + 0x48]
rcr r14b, cl
movdqu xmmword [rbp], xmm0
cmp dil, r13b
xor bpl, r9b
movzx bp, sil
mov rbp, qword [rsp + 0x38]
xadd r14w, r14w
add rsp, 0x20
pop r14
jmp 0x14046f1f2
ret
Function at 0x1404a316d
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x1404a317b
call fcn.1404ad527
mov r9d, 2
bswap edx
movsx rdx, bx
lea r8, [rsp + 0x30]
movsx ecx, si
mov edx, ebx
mov rcx, qword [rax + 0x28]
mov rdx, r14
lea edx, [r9 + 0x20]
jmp 0x1404a31a6
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
jmp 0x1404a31b9
je 0x1404a31fb
sub ecx, 1
je 0x1404a31ec
cmp ecx, 1
je 0x1404a31dd
sub eax, eax
jmp 0x1404a31d8
jmp 0x1404a3205
mov eax, 3
jmp 0x1404a31e7
jmp 0x1404a3205
mov eax, 1
jmp 0x1404a31f6
jmp 0x1404a3205
mov eax, 2
cmp al, 0x46
cmp dl, r10b
add rsp, 0x28
jmp 0x1404a320e
ret

Function at 0x1404a3fa5
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
jmp 0x1404a3fb3
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a3fc6
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
bsr rbx, rbp
mov edx, 0xc0000409
or bl, cl
xor ebx, r15d
dec bh
add rsp, 0x20
xchg bh, bl
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b3aaf
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
test r11w, r8w
mov qword [rsp + 0x10], rsi
push rdi
clc
sub rsp, 0x30
mov edi, edx
shrd rsi, r14, 0xed
shl sil, 0xa5
test r10b, r13b
mov rsi, rcx
cmc
test r8, r8
jmp 0x1404b3add
jne 0x1404b3aff
call fcn.1404b83a5
mov dword [rax], 0x16
call fcn.1404b904e
xor eax, eax
jmp 0x1404b3afa
jmp 0x1404b3bfb
mov rdx, r9
movzx rcx, r9w
seta ch
mov rcx, r8
jmp 0x1404b3b11
call fcn.1404b3c5d
mov rbx, rax
test rax, rax
jmp 0x1404b3b21
je 0x1404b3ba3
lea rax, [rsp + 0x50]
movsx rdx, ax
movsxd rcx, esp
movzx r8w, dl
mov rdx, rdi
movzx r8w, bpl
not r9b
mov qword [rsp + 0x28], rax
movzx r8w, r9b
lea r8, [0x140094b24]
mov eax, dword [rsp + 0x60]
mov r9, rbx
movsx ecx, di
mov rcx, rsi
jmp 0x1404b3b66
mov dword [rsp + 0x20], eax
jmp 0x1404b3b6f
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp r10d, 0x6b694833
cmp cl, r13b
stc
test rax, rax
jmp 0x1404b3b8b
jne 0x1404b3c17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b3b9e
call fcn.1404b8418
sub edi, edi
stc
test rbx, rbx
jmp 0x1404b3bae
je 0x1404b3bf0
mov rcx, qword [rbx + 0x10]
clc
cmp r8b, al
test rcx, rcx
je 0x1404b3bcb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404b3bd7
je 0x1404b3be3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b3beb
call fcn.1404cc356
mov rax, rdi
btc si, di
sal dil, 0x92
mov rbx, qword [rsp + 0x40]
cmp r13, rbx
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
setp dil
pop rdi
jmp 0x1404b3c16
ret
mov rcx, qword [rsp + 0x68]
test edx, 0x5d3740b0
test rcx, rcx
jmp 0x1404b3c2a
je 0x1404b3c3d
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
cmp al, 0xc0
jmp 0x1404b3c3d
xor ebx, ebx
jmp 0x1404b3c44
jmp 0x1404b3ba6

Function at 0x1404b3f01
Capabilities:
Terminate process

Disassembly:
push rbx
and bl, dil
mov bl, r10b
bt bx, r14w
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404b3f19
call fcn.1404d5840
cmp eax, 1
jmp 0x1404b3f26
je 0x1404b3f78
mov rax, qword gs:[0x60]
sete dh
cmp rdi, rsp
mov edx, dword [rax + 0xbc]
jmp 0x1404b3f47
shr edx, 8
cmp bpl, 0x87
test dl, 1
jmp 0x1404b3f56
jne 0x1404b3f78
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dh, 0x4e
cdq
xchg dh, dh
mov edx, ebx
jmp 0x1404b3f72
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b3f7f
call fcn.1404b3e57
mov ecx, ebx
jmp 0x1404b3f8b
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404bc379
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
clc
neg rcx
test rax, 7
jmp 0x1404bc38b
je 0x1404bc3b3
nop
mov dl, byte [rax]
jmp 0x1404bc39a
inc rax
stc
test dl, dl
je 0x1404bc481
test al, 7
jmp 0x1404bc3ad
jne 0x1404bc393
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
rol r9w, cl
mov r9, r8
test bl, r13b
add rax, 8
test r13, rdx
test bx, 0xe3a
add r9, rdx
not rdx
cmp dl, al
test r11b, 0xd9
xor rdx, r9
clc
cmp dil, 0xf2
and rdx, r11
je 0x1404bc3c7
mov rdx, qword [rax - 8]
cmp r13w, 0x40ee
test dl, dl
jmp 0x1404bc40e
je 0x1404bc4c9
test dh, dh
jmp 0x1404bc41b
je 0x1404bc4be
shr rdx, 0x10
cmc
clc
stc
test dl, dl
jmp 0x1404bc42f
je 0x1404bc4b3
test dh, dh
je 0x1404bc4ad
shr rdx, 0x10
jmp 0x1404bc44d
test dl, dl
je 0x1404bc4a2
test dh, dh
je 0x1404bc497
shr edx, 0x10
cmp r9b, 0xd6
cmp di, cx
test dl, dl
jmp 0x1404bc46e
je 0x1404bc48c
test dh, dh
jmp 0x1404bc47b
jne 0x1404bc3c7
lea rax, [rax + rcx - 1]
jmp 0x1404bc48b
ret
lea rax, [rax + rcx - 2]
jmp 0x1404bc496
ret
lea rax, [rax + rcx - 3]
jmp 0x1404bc4a1
ret
lea rax, [rax + rcx - 4]
jmp 0x1404bc4ac
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
jmp 0x1404bc4bd
ret
lea rax, [rax + rcx - 7]
jmp 0x1404bc4c8
ret
lea rax, [rax + rcx - 8]
jmp 0x1404bc4d3
ret
Function at 0x1404cd7a5
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, r10w
mov r9w, 0x33ef
bswap r8
mov rbx, rcx
movzx r9w, r9b
movzx ecx, r15w
movsx dx, dh
lea r9, [0x1400c63c0]
movzx cx, dl
jmp 0x1404cd7da
mov ecx, 3
cwd
movzx dx, dl
movsx r8d, r9w
lea r8, [0x1400c63b8]
movzx dx, r15b
lea rdx, [0x1400cfb70]
jmp 0x1404cd801
call fcn.1404ce79a
test rax, rax
jmp 0x1404cd80e
je 0x1404cd828
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1404cd821
jmp qword [case.0x14044b608.0]
add rsp, 0x20
setg bl
movzx ebx, ax
jmp 0x1404cd837
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404cd8d8
Capabilities:
Get thread local storage value

Disassembly:
push rbx
and dl, r12b
sub rsp, 0x20
movzx rbx, cx
mov ebx, ecx
lea r9, [0x1400c63d0]
movsx r8, cx
bswap rcx
movsxd r8, ebp
mov ecx, 5
lea r8, [0x1400c63c8]
movzx dx, sil
jmp 0x1404cd90e
lea rdx, [0x1400cf758]
jmp 0x1404cd91a
call fcn.1404ce79a
mov ecx, ebx
cmc
test rax, rax
je 0x1404cd93c
add rsp, 0x20
pop rbx
jmp 0x1404cd935
push qword [0x1400b8d90]
ret
add rsp, 0x20
setnp bh
movsx ebx, r12w
pop rbx
jmp 0x1404cd94d
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404cd954
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, esi
adc r9d, r15d
push rdi
sub rsp, 0x20
movzx rdi, sp
mov rbx, rdx
cwd
cqo
lea r9, [0x1400c63d8]
bswap r8w
xchg edi, edx
movsxd r8, esi
mov edi, ecx
xchg r8b, dl
cqo
movsx r8w, r9b
lea rdx, [0x1400cf748]
mov ecx, 6
bswap r8d
cmovns r8w, r12w
mov r8w, r12w
lea r8, [0x1400c63d0]
call fcn.1404ce79a
mov rdx, rbx
dec cx
test sil, 0x1c
mov ecx, edi
test rax, rax
jmp 0x1404cd9c3
je 0x1404cd9d4
call qword [case.0x14044b608.0]
jmp 0x1404cd9da
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movzx edi, bp
add rsp, 0x20
movsx edi, bx
pop rdi
jmp 0x1404cd9ef
ret

Function at 0x1404cdb53
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
bswap bx
movsxd rbx, r9d
neg ebx
mov qword [rsp + 0x18], rsi
push rdi
rcl di, 0x83
bsf rsi, rbx
movzx rbx, r8w
sub rsp, 0x30
jmp 0x1404cdb83
mov ebx, r9d
mov dil, r13b
mov rdi, r8
mov esi, edx
setne r8b
movzx bp, cl
movsx rdx, cx
lea r9, [0x1400c63e8]
xchg r8w, bp
cqo
mov rbp, rcx
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
mov ecx, 0xb
call fcn.1404ce79a
mov rcx, rbp
cmp dh, 0x87
cmc
test rax, rax
jmp 0x1404cdbd1
je 0x1404cdbfb
mov r9d, ebx
mov r8, rdi
cmovo rdx, r11
mov dx, 0x7958
movzx rdx, r8w
mov edx, esi
jmp 0x1404cdbf0
call qword [case.0x14044b608.0]
jmp 0x1404cdc20
sub edx, edx
jmp 0x1404cdc02
call fcn.1404ce27b
mov ecx, eax
mov r9d, ebx
mov r8, rdi
movzx dx, ch
mov edx, esi
jmp 0x1404cdc1a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
sbb sil, 0xce
bts rsi, r13
mov rbp, qword [rsp + 0x48]
movzx di, r11b
mov rsi, qword [rsp + 0x50]
movzx edi, si
not di
add rsp, 0x30
pop rdi
jmp 0x1404cdc4c
ret
Function at 0x1404da40b
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
bt bx, r10w
add bx, 0x502e
mov qword [rsp + 0x18], rsi
btc bx, dx
setns bh
ror bh, 0xd0
push rdi
sub rsp, 0x20
cmc
sub esi, esi
mov dil, 0x8a
shl dil, cl
adc rdi, rsp
mov rdi, rdx
movzx bx, spl
shrd bx, r10w, 0x9b
mov rbx, rcx
test si, r9w
cmc
cmp r10w, r13w
test rcx, rcx
jmp 0x1404da45c
je 0x1404da505
cmp word [rcx], si
jmp 0x1404da46a
je 0x1404da505
lea rdx, [0x1400d1d08]
jmp 0x1404da47c
call fcn.1400ef064
test eax, eax
jmp 0x1404da488
je 0x1404da505
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404da49d
call fcn.1400ef064
test eax, eax
jmp 0x1404da4a9
jne 0x1404da4f3
mov ecx, dword [rdi + 8]
movzx dx, bpl
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
cdq
movzx edx, dx
movsx dx, ah
mov edx, 0x2000000b
jmp 0x1404da4d2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404da4df
je 0x1404da535
mov eax, dword [rsp + 0x30]
jmp 0x1404da4ee
jmp 0x1404da55e
mov rcx, rbx
jmp 0x1404da4fb
call fcn.1404e35c8
jmp 0x1404da55e
mov ecx, dword [rdi + 8]
movzx rdx, bp
lea r8, [rsp + 0x30]
mov r9d, 2
not dh
movzx dx, ah
mov edx, 0x20001004
jmp 0x1404da527
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404da541
xor eax, eax
jmp 0x1404da53c
jmp 0x1404da55e
mov eax, dword [rsp + 0x30]
jmp 0x1404da54b
test eax, eax
jmp 0x1404da552
jne 0x1404da55e
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
sar sil, cl
rcr rdi, cl
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movzx rdi, bx
pop rdi
ret

Function at 0x1404da578
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
shrd ebx, ebp, 0x55
rol rbx, cl
ror ebx, 0xae
mov qword [rsp + 0x18], rsi
btc si, r8w
push rdi
not bh
btc si, sp
sub rsp, 0x20
mov esi, edx
movsx bx, cl
mov ebx, ecx
jmp 0x1404da5a9
call fcn.1404cc699
mov ecx, ebx
not r8
lea r8, [rsp + 0x30]
bt r9, rdx
and ecx, 0x3ff
btr dx, r15w
mov r9d, 2
clc
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
jmp 0x1404da5df
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test eax, eax
jmp 0x1404da5ef
je 0x1404da6a5
cmp ebx, dword [rsp + 0x30]
je 0x1404da696
test esi, esi
jmp 0x1404da606
je 0x1404da696
mov r9, qword [rdi + 0x98]
mov r8d, r10d
and dx, 0x3f1e
bts rax, rdi
movzx edx, word [r9]
lea rcx, [r9 + 2]
dec eax
lea eax, [rdx - 0x41]
stc
jmp 0x1404da633
cmp ax, 0x19
jmp 0x1404da63c
jbe 0x1404da657
sub dx, 0x61
cmc
test r12w, 0x5409
cmp dx, 0x19
ja 0x1404da673
movzx edx, word [rcx]
jmp 0x1404da65f
inc r8d
stc
test bh, cl
add rcx, 2
jmp 0x1404da66e
jmp 0x1404da629
or rcx, 0xffffffffffffffff
inc rcx
test bpl, r8b
cmp word [r9 + rcx*2], r10w
jne 0x1404da677
cmp r8d, ecx
jmp 0x1404da690
je 0x1404da6a5
mov eax, 1
jmp 0x1404da6a0
jmp 0x1404da6ad
sub eax, eax
shr dil, cl
rol bl, 0x8c
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
bsr edi, r14d
add rsp, 0x20
movsxd rdi, esp
xchg di, di
not edi
pop rdi
jmp 0x1404da6cd
ret
Function at 0x1404dbd5a
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
stc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
test ebx, 0x4d283101
mov qword [rax + 0x20], rdi
push r14
cmp r13b, 0xcd
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
cmp r8b, 0xe7
mov rbx, rax
test sil, bl
cmp edx, 0x65791186
test rax, rax
jmp 0x1404dbd9f
je 0x1404dbf22
mov rsi, rax
cmp word [rax], r14w
jmp 0x1404dbdb1
je 0x1404dbdf0
or rax, 0xffffffffffffffff
jmp 0x1404dbdc0
inc rax
clc
cmp word [rsi + rax*2], r14w
jmp 0x1404dbdce
jne 0x1404dbdc0
lea rsi, [rsi + rax*2]
cmc
test ch, 0x64
stc
add rsi, 2
jmp 0x1404dbde6
cmp word [rsi], r14w
jne 0x1404dbdb7
mov qword [rsp + 0x38], r14
shl r8, cl
sub rsi, rbx
movzx r8, r12w
test r15b, al
mov qword [rsp + 0x30], r14
add rsi, 2
neg r9b
shld r9, rcx, 0x1f
sal r9b, 0
sar rsi, 1
movsx r8, ax
bsr r8, r11
mov r8, rbx
movsxd r9, esi
mov r9d, esi
mov dword [rsp + 0x28], r14d
test bpl, 0xff
jmp 0x1404dbe39
sub edx, edx
mov qword [rsp + 0x20], r14
test r15b, dil
cmc
xor ecx, ecx
jmp 0x1404dbe4b
call fcn.1404cc485
movsxd rbp, eax
cmp r14w, 0x5442
test eax, eax
je 0x1404dbf22
mov rcx, rbp
jmp 0x1404dbe69
call fcn.1404cc3c2
mov rdi, rax
jmp 0x1404dbe76
test rax, rax
jmp 0x1404dbe7e
je 0x1404dbf0f
mov qword [rsp + 0x38], r14
btr r8w, r11w
btc r8w, 0xc6
xor r9w, r11w
mov r9d, esi
bsf r8w, r12w
mov qword [rsp + 0x30], r14
shr r8b, 0x9a
cmp bpl, r9b
btr r8w, r12w
mov r8, rbx
cmp r12d, 0x7c57276d
test r15b, 0x52
cmc
mov dword [rsp + 0x28], ebp
cmc
test bpl, r13b
xor edx, edx
cmc
test bx, 0x4757
stc
xor ecx, ecx
jmp 0x1404dbed8
mov qword [rsp + 0x20], rax
jmp 0x1404dbee2
call fcn.1404cc485
test eax, eax
jmp 0x1404dbeee
je 0x1404dbf0f
mov rsi, rdi
movsx di, r10b
mov dil, 0x9b
bswap di
mov rdi, r14
jmp 0x1404dbf0a
jmp 0x1404dbf15
mov rsi, r14
setg cl
mov rcx, rdi
call fcn.1404cc356
jmp 0x1404dbf26
mov rsi, r14
clc
test rbx, rbx
jmp 0x1404dbf2e
je 0x1404dbf3d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
rcr ah, cl
cmovnp di, r9w
mov rax, rsi
mov rsi, qword [rsp + 0x60]
shr rdi, 0xec
mov rbp, qword [rsp + 0x58]
xchg di, di
and di, ax
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp 0x1404dbf70
ret