joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a51f3
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp r12b, 0xb2
jmp 0x1404a5200
and dword [rsp + 0x30], 0
call fcn.1404af4f3
mov r9d, 2
cdq
lea r8, [rsp + 0x30]
mov rcx, qword [rax + 0x28]
cwd
mov edx, 0xa6f314f
movsx edx, bp
lea edx, [r9 + 0x20]
jmp 0x1404a522d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
stc
sub ecx, 0x30
jmp 0x1404a5241
je 0x1404a5283
sub ecx, 1
jmp 0x1404a524f
je 0x1404a5279
cmp ecx, 1
jmp 0x1404a525d
je 0x1404a526a
xor eax, eax
jmp 0x1404a528a
mov eax, 3
jmp 0x1404a5274
jmp 0x1404a528a
mov eax, 1
jmp 0x1404a528a
mov eax, 2
cmc
clc
add rsp, 0x28
jmp 0x1404a5293
ret
Function at 0x1404b1f85
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
btc rbx, 0x89
mov qword [rsp + 0x18], rsi
sub bx, ax
push rdi
sbb al, 0xde
sbb al, r11b
sub rsp, 0x50
sbb rax, 0x67737c77
mov rax, qword [0x1400b7288]
shr bl, cl
sal bl, cl
xor rax, rsp
mov qword [rsp + 0x40], rax
or bx, 0x293d
cmp byte [rcx + 0x54], 0
not bh
movzx ebx, bx
mov rbx, rcx
jmp 0x1404b1fd1
je 0x1404b20bb
cmp dword [rcx + 0x50], 0
jmp 0x1404b1fe0
jle 0x1404b20bb
mov rsi, qword [rcx + 0x48]
btr dx, r13w
bts ecx, r9d
xor edi, edi
bt r9, 0xba
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x34]
sar ecx, 0xc0
movzx r9d, word [rsi]
bt ecx, ecx
lea rcx, [rsp + 0x30]
adc r8, rax
and dword [rsp + 0x30], 0
movzx r8w, r12b
movsx r8, ax
lea rsi, [rsi + 2]
mov r8b, bpl
mov r8b, 0x61
mov r8d, 6
mov qword [rsp + 0x20], rax
jmp 0x1404b203d
call fcn.1404d5788
test eax, eax
jmp 0x1404b2049
jne 0x1404b20ad
mov r8d, dword [rsp + 0x30]
cmp r12b, bl
test r8d, r8d
jmp 0x1404b205f
je 0x1404b20ad
lea rax, [rbx + 0x10]
bswap cx
setle dl
lea r9, [rbx + 0x28]
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
cwd
movsx dx, bh
lea rdx, [rsp + 0x34]
jmp 0x1404b208f
call fcn.1404b03f4
inc edi
test spl, dil
stc
cmp edi, dword [rbx + 0x50]
jmp 0x1404b20a2
jne 0x1404b1ffa
jmp 0x1404b20e4
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b20b6
jmp 0x1404b20e4
mov r8d, dword [rbx + 0x50]
lea rax, [rcx + 0x10]
add dl, 0x4f
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
add rcx, 0x468
jmp 0x1404b20da
mov qword [rsp + 0x20], rax
call fcn.1404b03f4
mov al, 1
xadd cx, cx
mov rcx, qword [rsp + 0x40]
cmp r11b, 0x9b
xor rcx, rsp
jmp 0x1404b20fb
call fcn.1404a4949
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
shr rdi, 0
rol dil, cl
add rsp, 0x50
movzx di, spl
movzx rdi, ax
movsx edi, r11w
pop rdi
ret
Function at 0x1404b33d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movzx rdx, r14w
mov qword [rsp + 0x10], rsi
cdq
test bp, si
push rdi
cdq
bts si, r15w
sub rsp, 0x20
cmc
bsr ax, si
add ebx, 0x41eb1e1b
add qword [rcx + 0x20], 8
movzx rsi, r8w
btc ax, 0xb3
sub eax, ebx
mov rdi, rcx
cqo
shld r8w, sp, 0x62
lahf
mov rax, qword [rcx + 0x20]
test r13b, dl
sal bx, 0xa2
mov esi, dword [rcx + 0x38]
cmovp ebx, r13d
cmp esi, 0xffffffff
mov r8d, dword [rcx + 0x3c]
movsx ebx, r14w
mov dx, r13w
movzx edx, word [rcx + 0x42]
mov bl, r15b
mov rbx, qword [rax - 8]
mov al, r14b
mov ah, 0xe5
cmovp ax, r10w
mov eax, 0x7fffffff
mov qword [rcx + 0x48], rbx
jmp 0x1404b3462
cmove esi, eax
jmp 0x1404b346a
mov rcx, qword [rcx]
jmp 0x1404b3472
call fcn.140271667
test al, al
jmp 0x1404b347e
je 0x1404b34bb
test rbx, rbx
jmp 0x1404b348c
jne 0x1404b349d
lea rbx, [0x1400d25f0]
mov qword [rdi + 0x48], rbx
movsxd rdx, esi
bswap ecx
movsx ecx, sp
mov rcx, rbx
mov byte [rdi + 0x54], 1
jmp 0x1404b34b1
call fcn.140121224
jmp 0x1404b3575
test rbx, rbx
jmp 0x1404b34c3
jne 0x1404b34db
lea rbx, [0x1400ced98]
test r9, 0x57b066b1
mov qword [rdi + 0x48], rbx
sub r9d, r9d
clc
stc
cmc
test esi, esi
jmp 0x1404b34e8
jle 0x1404b356c
cmp byte [rbx], 0
jmp 0x1404b34f6
je 0x1404b356c
mov rax, qword [rdi + 8]
and rdx, 0x62b75552
movsx rcx, si
rol dx, cl
movzx edx, byte [rbx]
mov rcx, qword [rax]
mov rax, qword [rcx]
bsf r8d, ebx
rol cl, cl
movsx cx, r14b
lea rcx, [rbx + 1]
or r8b, r10b
cmp dl, 0xb
movzx r8d, word [rax + rdx*2]
cmc
clc
test al, 0x8a
and r8d, 0x8000
cmove rcx, rbx
not bl
movzx bx, r9b
inc r9d
shl bl, 0x50
btr rbx, rdi
lea rbx, [rcx + 1]
cmp ecx, ecx
test sil, 0x45
test rcx, rbx
cmp r9d, esi
jmp 0x1404b3566
jl 0x1404b34ee
mov eax, r9d
shr rsi, cl
movzx esi, dx
mov dword [rdi + 0x50], eax
cmovge si, r15w
rcr edi, cl
xchg bl, sil
mov al, 1
bt di, 0x74
cmc
xor sil, dil
mov rbx, qword [rsp + 0x30]
shrd rsi, rsi, 0xa8
test ebp, 0x261d58d8
sal di, cl
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
movsx rdi, di
mov dil, dl
pop rdi
jmp 0x1404b35b6
ret
Function at 0x1404b582b
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
jmp 0x1404b583b
sub rsp, 0x30
shld si, r10w, 0x78
btc edi, r8d
mov edi, edx
movzx rsi, r13w
shl rsi, 0xba
mov rsi, rcx
cmc
test r8, r8
jne 0x1404b5881
call fcn.1404ba199
mov dword [rax], 0x16
jmp 0x1404b5870
call fcn.1404bae47
sub eax, eax
jmp 0x1404b587c
jmp 0x1404b5976
mov rdx, r9
movsx ecx, r14w
mov rcx, r8
jmp 0x1404b5890
call fcn.1404b59cb
mov rbx, rax
cmp rsp, 0x297815f0
test rax, rax
jmp 0x1404b58a7
je 0x1404b5922
lea rax, [rsp + 0x50]
movzx r8, r10w
setns dh
jmp 0x1404b58be
mov rdx, rdi
cmovp rcx, r8
xchg r9b, r8b
mov qword [rsp + 0x28], rax
movzx rax, bp
lea r8, [0x140094b24]
xchg cx, r9w
mov ch, 0xa3
mov eax, dword [rsp + 0x60]
cmovl r9d, r8d
setne ch
mov r9, rbx
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404b58f9
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b590a
jne 0x1404b5999
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b591d
call fcn.1404ba211
sub edi, edi
test rbx, rbx
jmp 0x1404b592c
je 0x1404b5973
mov rcx, qword [rbx + 0x10]
test r11w, dx
test rcx, rcx
jmp 0x1404b5942
je 0x1404b594e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404b595a
je 0x1404b5966
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b596e
call fcn.1404ce159
mov rax, rdi
mov rbx, qword [rsp + 0x40]
adc di, 0x4adc
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
movsx di, dl
movzx di, r10b
pop rdi
jmp 0x1404b5998
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1404b59b0
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
cmp edx, r11d
xor ebx, ebx
jmp 0x1404b5924

Function at 0x1404b5c63
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
sete bh
mov bl, spl
mov ebx, ecx
jmp 0x1404b5c76
call fcn.1404d76a1
cmp eax, 1
je 0x1404b5cd2
mov rax, qword gs:[0x60]
sbb dl, r13b
mov edx, dword [rax + 0xbc]
clc
test al, spl
stc
shr edx, 8
test r11b, r9b
test rcx, 0x6f54369c
test dl, 1
jmp 0x1404b5cb0
jne 0x1404b5cd2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsxd rdx, r14d
setp dh
mov edx, ebx
jmp 0x1404b5ccc
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b5cd9
call fcn.1404b5bb1
mov ecx, ebx
jmp 0x1404b5ce5
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404ca2b9
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
stc
test r13b, al
mov qword [rsp + 0x18], rbp
sal bp, 0x22
setle bpl
mov qword [rsp + 0x20], rsi
neg bpl
sar bpl, 0xf
push rdi
bswap bp
push r12
bsr rbp, rdi
movzx ebp, r12w
rcr bp, cl
push r13
push r14
mov r13b, r9b
push r15
movsx bp, r8b
sub rsp, 0x20
cmc
inc bp
or r13b, sil
mov rbp, rdx
movsx r13w, r9b
movsx r13d, r11w
mov r13, rcx
test rdx, rdx
jmp 0x1404ca31c
je 0x1404ca49a
xor r15b, r15b
cmc
cmp rcx, rbx
stc
xor esi, esi
jmp 0x1404ca331
cmp dword [rdx], esi
jmp 0x1404ca338
jle 0x1404ca441
call fcn.1404a7735
mov rdx, rax
and ah, 0xb6
cwde
movzx r12w, r15b
mov rax, qword [r13 + 0x30]
sbb r12, 0x7b5709ad
btc r12, r11
add r12d, 0x189c0500
movsxd r12, dword [rax + 0xc]
stc
add r12, 4
add r12, rdx
jmp 0x1404ca376
call fcn.1404a7735
mov rdx, rax
mov rax, qword [r13 + 0x30]
movsxd rcx, dword [rax + 0xc]
mov r14d, dword [rdx + rcx]
stc
cmp rsp, r14
cmc
test r14d, r14d
jle 0x1404ca436
movsxd rax, esi
jmp 0x1404ca3a0
lea rax, [rax + rax*4]
mov qword [rsp + 0x58], rax
jmp 0x1404ca3ae
call fcn.1404a7735
mov rbx, qword [r13 + 0x30]
mov rdi, rax
movzx eax, r8w
cmp r13d, 0x4703261a
movsxd rax, dword [r12]
cmp ecx, 0x153b2e35
add rdi, rax
jmp 0x1404ca3d7
call fcn.1404a76de
mov rdx, qword [rsp + 0x58]
mov r8, rbx
add cx, 0x313f
and ch, cl
sub cl, r14b
movsxd rcx, dword [rbp + 4]
cmp bpl, 0xcc
cmc
lea rax, [rax + rdx*4]
shl dl, cl
sal dh, 0x5b
mov rdx, rdi
add rcx, rax
call fcn.1404ca65e
test eax, eax
jne 0x1404ca433
dec r14d
cmp dil, bl
add r12, 4
test bpl, r10b
test r14d, r14d
jmp 0x1404ca428
jg 0x1404ca3ae
jmp 0x1404ca436
mov r15b, 1
inc esi
cmp esi, dword [rbp]
jl 0x1404ca33e
mov rbx, qword [rsp + 0x50]
mov al, r15b
jmp 0x1404ca453
mov rbp, qword [rsp + 0x60]
sar di, cl
bswap r13d
mov rsi, qword [rsp + 0x68]
btr di, 0x60
or r13b, r8b
bt r14d, edx
add rsp, 0x20
movzx r12d, bx
bswap r14d
pop r15
pop r14
not r12w
movsx rdi, bx
pop r13
xchg edi, edi
not r12d
movsx edi, r14w
pop r12
pop rdi
jmp 0x1404ca499
ret
call fcn.1404bc0f7
int3
Function at 0x1404cf658
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
test r14b, 0x78
sub rsp, 0x20
not ebx
movsx edx, r15w
mov r9, 0x72e85809
mov rbx, rcx
mov cl, r14b
not cl
lea r9, [0x1400c63c0]
movzx edx, cx
mov ecx, 3
bswap dx
cwd
lea r8, [0x1400c63b8]
lea rdx, [0x1400cfb70]
jmp 0x1404cf69e
call fcn.1404d0664
test rax, rax
jmp 0x1404cf6ab
je 0x1404cf6cf
mov rcx, rbx
rcr bl, 0x1d
rol bh, 0xf4
test r12b, 0
add rsp, 0x20
pop rbx
jmp 0x1404cf6c8
push qword [0x1400b8d90]
ret
add rsp, 0x20
movzx bx, r10b
not bl
movsx bx, bpl
pop rbx
jmp 0x1404cf6e5
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404cf817
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, cl
test edx, 0x21c51445
shl bh, 0x75
push rdi
neg r8d
btr di, 0xf8
sub rsp, 0x20
movsx bx, r14b
xchg r9d, r8d
mov rbx, rdx
movsxd r9, r13d
lea r9, [0x1400c63d8]
movsx r8, r11w
movsx edx, r9w
mov edi, ecx
seta ch
cmovno ecx, r14d
movsx dx, r11b
lea rdx, [0x1400cf748]
setge r8b
mov ecx, 6
mov r8b, 0x98
movsx r8w, spl
setne r8b
lea r8, [0x1400c63d0]
jmp 0x1404cf888
call fcn.1404d0664
mov rdx, rbx
adc cx, 0x2816
mov ecx, edi
test r13b, cl
cmp r14w, 0x2233
test rax, rax
jmp 0x1404cf8a8
je 0x1404cf8b9
call qword [0x1400b8d90]
jmp 0x1404cf8bf
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movsx di, r13b
btc di, 0x74
shld edi, r12d, 0x25
add rsp, 0x20
pop rdi
jmp 0x1404cf8dd
ret

Function at 0x1404cfa5f
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
inc bh
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
dec bx
shl sil, 0xdf
rcl sil, cl
push rdi
sub rsp, 0x30
movsx ebp, r9w
mov ebx, r9d
movzx esi, r12w
movzx bp, r9b
mov rdi, r8
movzx r8w, r10b
mov esi, edx
lea r9, [0x1400c63e8]
cqo
movsx r8, si
cwd
mov rbp, rcx
lea r8, [0x1400c63e0]
mov ecx, eax
lea rdx, [0x1400cf190]
mov ecx, 0xb
jmp 0x1404cfac5
call fcn.1404d0664
mov rcx, rbp
cmp r14w, bp
test rax, rax
jmp 0x1404cfad9
je 0x1404cfafc
mov r9d, ebx
mov r8, rdi
movzx rdx, r11w
cdq
mov edx, esi
jmp 0x1404cfaf1
call qword [0x1400b8d90]
jmp 0x1404cfb30
sub edx, edx
jmp 0x1404cfb03
call fcn.1404d016d
mov ecx, eax
movzx r9, sp
cmovg r8, rax
mov r9d, ebx
mov dl, r10b
movsxd r8, r8d
mov r8, rdi
setg dl
cwd
mov edx, esi
jmp 0x1404cfb2a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
rcl sil, cl
mov rbp, qword [rsp + 0x48]
test r8, 0xf4d5fcb
mov rsi, qword [rsp + 0x50]
rcr di, cl
add rsp, 0x30
movsx edi, bx
movsx rdi, di
not di
pop rdi
ret
Function at 0x1404d73a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
xor ax, 0x1fb5
inc rax
mov qword [r11 + 8], rbx
bt ax, 0x60
cmp dl, r8b
btc rax, r11
mov qword [r11 + 0x10], rbp
shl rax, cl
mov qword [r11 + 0x18], rdi
adc edi, ebp
adc rdi, 0x15441cfd
push r14
xor di, 0x76f2
bts ax, r10w
sub rsp, 0x50
movsx bp, r10b
cwde
mov rax, qword [rsp + 0x80]
mov rbp, r8
mov rcx, qword [rcx]
mov r8w, 0x2393
not r8b
lea r8, [r11 - 0x18]
mov dil, cl
not dil
mov rdi, rdx
setge dh
cmovo rdx, r12
mov edx, 0x609408ed
mov qword [r11 - 0x38], rax
mov edx, dword [rsp + 0x88]
jmp 0x1404d742a
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x1404d7437
call fcn.1404e67fb
mov r14d, dword [rsp + 0x44]
xchg r9w, bx
cmp r8w, r15w
shl bl, 0x92
sub r8d, r8d
bt r9w, r9w
xchg r8b, bl
sub cx, di
cmp dword [rsp + 0x40], 0x2d
mov r9d, eax
cqo
mov eax, dword [rsp + 0xa0]
mov rdx, rbp
mov bl, r13b
jmp 0x1404d747a
sete r8b
mov bh, 0xd2
not ch
mov dword [rsp + 0x28], eax
jmp 0x1404d748c
sub rdx, r8
jmp 0x1404d7497
mov dword [rsp + 0x20], r9d
dec bl
movsx r9d, r15w
dec r14d
xor r9w, si
lea r9, [rsp + 0x40]
ror rbx, 0xf6
xadd bx, bx
mov cl, 0xe2
cmp rbp, 0xffffffffffffffff
movsx ecx, bx
cmovs ebx, r12d
movzx rcx, r10w
lea rbx, [r8 + rdi]
sets r8b
jmp 0x1404d74d4
mov r8d, dword [rsp + 0x88]
bswap rcx
mov rcx, 0x61235231
cmove rdx, rbp
mov cx, 0x601
mov rcx, rbx
jmp 0x1404d74f6
call fcn.1404e650f
test eax, eax
jmp 0x1404d7502
je 0x1404d7515
mov byte [rdi], 0
jmp 0x1404d7510
jmp 0x1404d762b
mov eax, dword [rsp + 0x44]
jmp 0x1404d751e
dec eax
jmp 0x1404d7526
cmp eax, 0xfffffffc
jmp 0x1404d752e
jl 0x1404d75b7
cmp eax, dword [rsp + 0x88]
jmp 0x1404d7540
jge 0x1404d75b7
cmp r14d, eax
jmp 0x1404d754e
jge 0x1404d756b
mov al, byte [rbx]
inc rbx
test al, al
jmp 0x1404d7560
jne 0x1404d7554
mov byte [rbx - 2], al
cbw
mov rax, qword [rsp + 0xa8]
movsx r9, dx
lea r9, [rsp + 0x40]
xchg r8b, dl
mov r8d, dword [rsp + 0x88]
not ecx
mov rdx, rbp
movzx cx, bh
mov qword [rsp + 0x28], rax
bswap cx
cmovns rcx, r8
movsx rcx, r15w
mov rcx, rdi
mov byte [rsp + 0x20], 1
jmp 0x1404d75ad
call fcn.1404d708b
jmp 0x1404d762b
mov rax, qword [rsp + 0xa8]
mov rdx, rbp
jmp 0x1404d75c7
mov r9b, byte [rsp + 0x90]
jmp 0x1404d75d4
mov rcx, rdi
movzx r8, ax
mov r8w, 0x4723
jmp 0x1404d75e5
mov r8d, dword [rsp + 0x88]
jmp 0x1404d75f2
mov qword [rsp + 0x38], rax
bswap rax
movsxd rax, ecx
lea rax, [rsp + 0x40]
jmp 0x1404d7607
mov byte [rsp + 0x30], 1
jmp 0x1404d7611
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x20], eax
jmp 0x1404d7626
call fcn.1404d60d3
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
rcr r14b, cl
cmp di, r12w
add rsp, 0x50
setp r14b
movzx r14, ax
movsx r14, r9w
pop r14
jmp 0x1404d7658
ret
Function at 0x1404dc1e1
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
adc ebx, 0xb6d6d12
mov qword [rsp + 0x18], rsi
push rdi
sal dil, cl
btr bx, 0xea
xor bx, r12w
sub rsp, 0x20
add bx, 0x47f
cmp di, 0x1892
xor esi, esi
mov rdi, rdx
rcl bh, cl
mov rbx, rcx
cmp cx, r13w
test rcx, rcx
jmp 0x1404dc222
je 0x1404dc2cc
cmp word [rcx], si
jmp 0x1404dc230
je 0x1404dc2cc
lea rdx, [0x1400d1d08]
jmp 0x1404dc242
call fcn.1401ce85f
test eax, eax
jmp 0x1404dc24e
je 0x1404dc2cc
lea rdx, [0x1400d1d00]
movzx cx, bh
xchg ch, ch
mov rcx, rbx
call fcn.1401ce85f
test eax, eax
jne 0x1404dc2ba
mov ecx, dword [rdi + 8]
movzx r9d, r9w
movzx r9w, r14b
xchg dx, dx
lea r9d, [rsi + 2]
not r8b
bswap rdx
lea r8, [rsp + 0x30]
not dx
cqo
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dc2a6
je 0x1404dc2f2
mov eax, dword [rsp + 0x30]
jmp 0x1404dc2b5
jmp 0x1404dc31b
mov rcx, rbx
jmp 0x1404dc2c2
call fcn.1404e5209
jmp 0x1404dc31b
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dc2ec
jne 0x1404dc2fe
sub eax, eax
jmp 0x1404dc2f9
jmp 0x1404dc31b
mov eax, dword [rsp + 0x30]
cmc
test esp, r10d
cmp r12, 0x37535af2
test eax, eax
jne 0x1404dc31b
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
sal sil, 0xe5
btc rdi, r11
cmovno rdi, r9
mov rsi, qword [rsp + 0x40]
adc edi, 0x1b0e5071
add di, 0x2e1f
sar rdi, 0x43
add rsp, 0x20
bswap di
pop rdi
jmp 0x1404dc34d
ret

Function at 0x1404dc34e
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
inc ebx
movzx rbx, bx
mov qword [rsp + 0x18], rsi
push rdi
sub rsi, 0x195e3f52
and rsi, rax
sub rsp, 0x20
bswap si
movsx ebx, r8w
mov esi, edx
mov ebx, ecx
jmp 0x1404dc37d
call fcn.1404ce4cd
mov ecx, ebx
shl dh, 0xf9
mov di, 0x6109
bts rdx, rdi
lea r8, [rsp + 0x30]
mov r9b, 0x37
ror rdi, cl
and ecx, 0x3ff
bt rdi, r9
cqo
mov r9d, 2
bts ecx, 0xa
movsx di, r15b
mov edx, 0x20000001
mov rdi, rax
jmp 0x1404dc3c2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test ebx, 0x41932a19
clc
cmp r13w, 0x11d4
test eax, eax
jmp 0x1404dc3df
je 0x1404dc4aa
cmp ebx, dword [rsp + 0x30]
jmp 0x1404dc3ee
je 0x1404dc49b
test esi, esi
jmp 0x1404dc3fb
je 0x1404dc49b
mov r9, qword [rdi + 0x98]
movsx r8d, bp
or r8w, r9w
mov r8d, r10d
setae dh
rol ax, 0xad
movzx edx, word [r9]
cmc
lea rcx, [r9 + 2]
ror ah, 0xab
lea eax, [rdx - 0x41]
test r10b, 0x2e
cmp ax, 0x19
jmp 0x1404dc436
jbe 0x1404dc44f
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404dc449
ja 0x1404dc467
movzx edx, word [rcx]
inc r8d
test r8b, r9b
cmc
add rcx, 2
jmp 0x1404dc462
jmp 0x1404dc426
or rcx, 0xffffffffffffffff
jmp 0x1404dc470
inc rcx
test r11b, r9b
clc
test r12w, 0x6696
cmp word [r9 + rcx*2], r10w
jmp 0x1404dc487
jne 0x1404dc470
cmp r8d, ecx
jmp 0x1404dc495
je 0x1404dc4aa
mov eax, 1
jmp 0x1404dc4a5
jmp 0x1404dc4af
xor eax, eax
sub bl, spl
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
btc di, 0xf6
add rsp, 0x20
movsx di, spl
jmp 0x1404dc4cf
pop rdi
jmp 0x1404dc4d5
ret
Function at 0x1404ddc19
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
jmp 0x1404ddc32
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmp r15w, bx
push r14
cmp r11, r15
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
movzx bx, dil
rcr bh, cl
xor rbx, 0x1e064dea
mov rbx, rax
cmp r10d, edx
test rax, rax
jmp 0x1404ddc74
je 0x1404dddc3
mov rsi, rax
stc
test r11b, r15b
cmp dx, r9w
cmp word [rax], r14w
je 0x1404ddcc0
or rax, 0xffffffffffffffff
inc rax
cmp bx, sp
cmp word [rsi + rax*2], r14w
jmp 0x1404ddca3
jne 0x1404ddc93
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404ddcba
jne 0x1404ddc8f
mov qword [rsp + 0x38], r14
xor r9b, r15b
movzx r9w, dl
sub rsi, rbx
mov r8b, 0x3b
bt r8w, 0x9d
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
shr r8b, cl
clc
adc r8b, dl
mov r8, rbx
add r9b, r14b
mov r9d, esi
cmp edi, 0x6fa640d9
mov dword [rsp + 0x28], r14d
cmp r8d, eax
sub edx, edx
test rcx, rax
mov qword [rsp + 0x20], r14
xor ecx, ecx
jmp 0x1404ddd14
call fcn.1404ce2ab
movsxd rbp, eax
test eax, eax
jmp 0x1404ddd23
je 0x1404dddc3
mov rcx, rbp
jmp 0x1404ddd31
call fcn.1404ce1e5
mov rdi, rax
cmc
cmp rsi, 0x3a0012d2
stc
test rax, rax
jmp 0x1404ddd4a
je 0x1404ddda2
mov qword [rsp + 0x38], r14
mov r9d, esi
stc
mov qword [rsp + 0x30], r14
mov r8, rbx
clc
cmp ch, 0x3a
mov dword [rsp + 0x28], ebp
cmp ch, 0xea
xor edx, edx
cmp rbx, rbx
sub ecx, ecx
jmp 0x1404ddd78
mov qword [rsp + 0x20], rax
jmp 0x1404ddd82
call fcn.1404ce2ab
test eax, eax
je 0x1404ddda2
mov rsi, rdi
mov dil, 0x53
mov rdi, r14
jmp 0x1404ddd9d
jmp 0x1404dddb1
mov rsi, r14
jmp 0x1404dddb1
mov rcx, rdi
jmp 0x1404dddb9
call fcn.1404ce159
jmp 0x1404dddcc
mov rsi, r14
test rdi, r8
cmp esp, r15d
test rbx, rbx
jmp 0x1404dddd4
je 0x1404ddde8
mov rcx, rbx
jmp 0x1404ddde2
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
sete dil
stc
mov rax, rsi
rcr bp, 0x4b
mov rsi, qword [rsp + 0x60]
cmp r14b, sil
mov rbp, qword [rsp + 0x58]
dec edi
sub r14d, edx
mov rdi, qword [rsp + 0x68]
sal r14d, cl
mov r14b, 0x44
add rsp, 0x40
mov r14b, dl
pop r14
jmp 0x1404dde24
ret
Function at 0x1404dde25
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
clc
mov qword [rsp + 0x18], rsi
cmc
push rdi
sub rsp, 0x20
jmp 0x1404dde40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
mov rbx, rax
jmp 0x1404dde57
test rax, rax
jmp 0x1404dde5f
je 0x1404ddf1f
mov rbp, rax
clc
cmp word [rax], si
je 0x1404ddea7
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1404dde76
lea rbp, [rbp + rax*2]
test sp, r8w
add rbp, 2
cmp ebp, 0xcee33d2
clc
cmp word [rbp], si
jmp 0x1404ddea1
jne 0x1404dde72
sub rbp, rbx
add rbp, 2
ror ecx, cl
sar rbp, 1
add rbp, rbp
mov rcx, 0x782057b9
not rcx
bswap cx
mov rcx, rbp
jmp 0x1404ddecb
call fcn.1404ce1e5
mov rdi, rax
clc
test r13b, cl
test rax, rax
je 0x1404ddf0a
mov r8, rbp
bswap edx
movsx rcx, r13w
mov edx, 0x76f4340b
mov rdx, rbx
mov rcx, rax
jmp 0x1404ddef9
call fcn.1404a8457
mov rsi, rdi
test r11b, bl
test di, 0xaeb
clc
xor ecx, ecx
call fcn.1404ce159
mov rcx, rbx
jmp 0x1404ddf19
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
sal bp, 0x3e
sub bpl, 0xc7
sets sil
mov rsi, qword [rsp + 0x40]
test rdi, r11
mov rbp, qword [rsp + 0x38]
dec rdi
movzx di, r11b
sbb rdi, 0x72354973
add rsp, 0x20
cmovns edi, r15d
mov dil, bpl
pop rdi
ret
Function at 0x1404e0d46
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cwde
lahf
mov ax, 0x5b34
mov qword [rsp + 0x18], rbp
not eax
push rsi
jmp 0x1404e0d78
push rdi
movsxd rax, ecx
movsx eax, bx
lahf
push r14
mov eax, 0x1450
jmp 0x1404e0d8c
call fcn.14044d420
sub rsp, rax
and r10b, 0x40
movzx r10d, r8w
adc sil, 1
mov rax, qword [0x1400b7288]
xor rax, rsp
mov qword [rsp + 0x1440], rax
cmovae eax, r12d
and r10, 0x18e748b0
movsxd r10, edx
cdq
mov rdi, rcx
not r14b
mov r14w, r10w
mov rax, r10
jmp 0x1404e0ddb
mov ebp, r9d
or edx, 0x48ab55c7
cdq
sar rax, 6
movsx si, dil
or r14w, bx
bsr dx, di
lea rcx, [0x1400ba940]
sar dl, 0xd8
inc dh
and r10d, 0x3f
inc sil
and r14b, cl
lea rbp, [rbp + r8]
shl sil, cl
mov rsi, r8
and r14b, cl
mov rax, qword [rcx + rax*8]
xchg dx, r14w
cmp r11b, 0x12
adc dx, 0xeb3
lea rdx, [r10 + r10*8]
sub r14b, bl
xchg r14b, r14b
sar r14b, cl
mov r14, qword [rax + rdx*8 + 0x28]
stc
xor eax, eax
jmp 0x1404e0e48
mov qword [rdi], rax
test bx, bp
cmp r15b, r8b
cmc
mov dword [rdi + 8], eax
clc
cmp r13b, al
cmp r8, rbp
jmp 0x1404e0e61
jae 0x1404e0f58
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404e0e74
jae 0x1404e0ed6
mov al, byte [rsi]
jmp 0x1404e0e81
inc rsi
stc
jmp 0x1404e0e8a
cmp al, 0xa
jmp 0x1404e0e91
jne 0x1404e0eaf
inc dword [rdi + 8]
jmp 0x1404e0e9f
mov byte [rbx], 0xd
jmp 0x1404e0ea7
inc rbx
jmp 0x1404e0eaf
mov byte [rbx], al
lahf
movzx eax, r12w
movsxd rax, ecx
inc rbx
dec al
lea rax, [rsp + 0x143f]
clc
cmc
cmp rbx, rax
jmp 0x1404e0ed0
jb 0x1404e0e6c
and qword [rsp + 0x20], 0
lahf
lea rax, [rsp + 0x40]
cdq
bsr r9w, si
or r9w, sp
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
movzx dx, bpl
lea rdx, [rsp + 0x40]
movzx cx, ah
mov cl, r14b
mov rcx, r14
jmp 0x1404e0f0f
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404e0f1c
je 0x1404e0f4e
mov eax, dword [rsp + 0x30]
cmc
add dword [rdi + 4], eax
cmp r10b, al
stc
cmp eax, ebx
jmp 0x1404e0f35
jb 0x1404e0f58
cmp rsi, rbp
jmp 0x1404e0f43
jb 0x1404e0e67
jmp 0x1404e0f58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
shr cl, cl
mov rax, rdi
btr cx, 0xd7
cmovno cx, cx
xor cx, 0x5a06
mov rcx, qword [rsp + 0x1440]
cmp sil, bpl
xor rcx, rsp
jmp 0x1404e0f7c
call fcn.1404a4949
lea r11, [rsp + 0x1450]
jmp 0x1404e0f96
mov rbx, qword [r11 + 0x20]
movsx rsi, r15w
movzx si, dl
movzx rbp, cx
mov rbp, qword [r11 + 0x30]
movsx r14, dx
cmovo r14w, di
mov dil, 0x37
mov rsp, r11
not esi
mov sil, 0xdb
xchg dil, r14b
pop r14
cmovnp si, r9w
mov si, r14w
movsx si, sil
pop rdi
jmp 0x1404e0fd7
pop rsi
jmp 0x1404e0fdd
ret
Function at 0x1404e0fde
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx eax, si
mov ah, ah
cmovle ax, dx
mov qword [rsp + 0x18], rbp
bswap rax
movzx ax, bl
push rsi
xchg ah, al
cwde
push rdi
not ah
push r14
mov al, spl
mov eax, 0x1450
jmp 0x1404e100e
call fcn.14044d420
sub rsp, rax
xor r10d, 0xe344ebf
mov rax, qword [0x1400b7288]
cmovge rbp, rdx
xor rax, rsp
mov qword [rsp + 0x1440], rax
rcr bpl, cl
bt di, 0xc1
xor ax, 0x1d78
movsxd r10, edx
and ebp, 0x45f55fa4
mov rdi, rcx
bt bp, ax
mov rax, r10
sar bp, 0x62
mov ebp, r9d
not r14b
or sil, sil
sar rax, 6
lea rcx, [0x1400ba940]
setns dl
and r10d, 0x3f
cmp bp, bx
lea rbp, [rbp + r8]
cmovae si, r12w
mov rsi, r8
test r8b, 0xb0
mov rax, qword [rcx + rax*8]
or r14, 0x4a90243c
cdq
xadd r14b, r14b
lea rdx, [r10 + r10*8]
sal r14d, cl
btr r14w, 0x1b
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
test dx, 0x7de2
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404e10bc
jae 0x1404e11a7