joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404cd915
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x28
adc r8, 0x50937b72
sal r9b, cl
sal dx, 1
lea r9, [0x1400c63a4]
sub ecx, ecx
jmp 0x1404cd93b
lea r8, [0x1400c63a0]
jmp 0x1404cd947
lea rdx, [0x1400cfbf8]
jmp 0x1404cd953
call fcn.1404cdb77
lea r9, [0x1400c63b0]
movzx ecx, r10w
cqo
xchg dh, dl
mov ecx, 1
movsx rdx, dx
movzx dx, r12b
setp r8b
lea r8, [0x1400c63a8]
movzx rdx, si
mov edx, 0x45e7169b
movzx dx, spl
lea rdx, [0x1400cf1d0]
jmp 0x1404cd99a
call fcn.1404cdb77
lea r9, [0x1400c63b8]
cqo
movsx ecx, dx
mov ecx, 2
movsx r8, r10w
lea r8, [0x1400c63b0]
cwd
lea rdx, [0x1400cf178]
jmp 0x1404cd9c9
call fcn.1404cdb77
lea r9, [0x1400c63e0]
mov r8d, r14d
cwd
movsxd rdx, edx
mov ecx, 8
xchg dl, r8b
jmp 0x1404cd9ea
lea r8, [0x1400c63d8]
movzx edx, di
lea rdx, [0x1400cf158]
jmp 0x1404cda00
call fcn.1404cdb77
lea r9, [0x1400c63e8]
mov ecx, 0xb
lea r8, [0x1400c63e0]
cmovnp dx, r10w
movzx edx, r10w
mov edx, 0x2f6926e5
lea rdx, [0x1400cf190]
jmp 0x1404cda32
call fcn.1404cdb77
lea r9, [0x1400c63f0]
not edx
mov ecx, 0xe
cdq
lea r8, [0x1400c63e8]
movsx dx, r9b
lea rdx, [0x1400cf168]
jmp 0x1404cda5e
call fcn.1404cdb77
lea r9, [0x1400c63f8]
mov r8w, bp
movsx r8, r9w
movsx r8w, r11b
mov ecx, 0xf
movzx r8, r12w
cqo
setbe r8b
lea r8, [0x1400c63f0]
lea rdx, [0x1400cf800]
jmp 0x1404cda99
call fcn.1404cdb77
lea r9, [0x1400c6408]
jmp 0x1404cdaae
mov ecx, 0x13
jmp 0x1404cdabb
lea r8, [0x1400c6400]
lea rdx, [0x1400cf838]
jmp 0x1404cdace
call fcn.1404cdb77
lea r9, [0x1400c6410]
bswap r8d
cmovno rcx, r15
movzx rcx, bx
mov ecx, 0x14
movzx r8d, r8w
cdq
lea r8, [0x1400c6408]
movsx dx, r11b
movzx dx, r12b
lea rdx, [0x1400cf1c0]
jmp 0x1404cdb0c
call fcn.1404cdb77
lea r9, [0x1400c6418]
movzx dx, r14b
mov ecx, 0x15
not dx
movzx dx, r8b
cdq
lea r8, [0x1400c6410]
movsx dx, r10b
mov edx, r14d
lea rdx, [0x1400cf820]
call fcn.1404cdb77
lea r9, [0x1400c6420]
rcr cl, 0xb7
mov ecx, 0x16
lea r8, [0x1400c6418]
lea rdx, [0x1400cfc08]
jmp 0x1404cdb69
add rsp, 0x28
jmp 0x1404cdb72
jmp fcn.1404cdb77
Function at 0x1404d173b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
adc r8b, 0xc9
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
bswap ebx
bsr si, r8w
push rdi
sub rsp, 0x20
xor bx, dx
not bp
lea rbx, [rcx + 0x18]
mov rsi, rcx
btc ebp, 0x63
cmovns rbp, r12
movzx ebp, r11w
mov ebp, 0x101
mov rcx, rbx
shld r8, rcx, 0xc3
mov r8d, ebp
xor edx, edx
jmp 0x1404d178a
call fcn.1404a6391
xor eax, eax
movzx ecx, bx
movzx rcx, bx
lea rdi, [rsi + 0xc]
not ch
movzx rcx, sp
jmp 0x1404d17a7
mov qword [rsi + 4], rax
mov cx, 0x1fe7
mov ecx, 6
jmp 0x1404d17b9
mov qword [rsi + 0x220], rax
jmp 0x1404d17c5
movzx eax, ax
jmp 0x1404d17cd
rep stosw word [rdi], ax
shl al, 0xa9
lea rdi, [0x1400b77b0]
sub rdi, rsi
xchg al, al
mov al, r9b
mov al, 0x92
mov al, byte [rdi + rbx]
jmp 0x1404d17ec
mov byte [rbx], al
jmp 0x1404d17f3
inc rbx
clc
cmp r10b, r11b
sub rbp, 1
jmp 0x1404d1803
jne 0x1404d17e4
lea rcx, [rsi + 0x119]
mov edx, 0x6ccc1b90
cqo
movsx dx, spl
mov edx, 0x100
dec al
inc al
mov al, byte [rcx + rdi]
mov byte [rcx], al
jmp 0x1404d182f
inc rcx
cmp r15b, 0xf5
stc
cmp rbx, rsi
sub rdx, 1
jmp 0x1404d1843
jne 0x1404d1825
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
not di
adc di, bp
bt rdi, 0x42
add rsp, 0x20
xchg dil, dil
movsx rdi, di
setg dil
pop rdi
jmp 0x1404d1878
ret
Function at 0x1404d48c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
sal eax, cl
ror ah, cl
xadd eax, eax
mov qword [r11 + 8], rbx
rcr ax, 0xc2
shr ah, 0xbb
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
dec dil
rcl di, cl
push r14
sub rsp, 0x50
mov eax, edi
lahf
mov rax, qword [rsp + 0x80]
xchg bpl, bpl
movzx di, r13b
jmp 0x1404d4904
mov rbp, r8
movzx edi, dx
movsx r8d, cx
mov r8d, esp
mov rcx, qword [rcx]
movsxd r8, edi
lea r8, [r11 - 0x18]
mov rdi, rdx
movsx dx, r14b
jmp 0x1404d492c
mov qword [r11 - 0x38], rax
bswap dx
mov edx, dword [rsp + 0x88]
jmp 0x1404d493f
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
call fcn.1404e3ea3
mov r14d, dword [rsp + 0x44]
mov rbx, rdi
adc r9w, 0x5971
shrd bx, ax, 0xc8
xor r8d, r8d
movsx rbx, r10w
cdq
cmp dword [rsp + 0x40], 0x2d
movsxd rdx, r11d
setp dh
mov r9d, eax
not rcx
mov eax, dword [rsp + 0xa0]
cdq
mov rdx, rbp
xchg r8b, bl
movsx bx, ch
mov cl, 0x82
sete r8b
add cx, di
neg bh
mov dword [rsp + 0x28], eax
movzx cx, bpl
xor cx, 0x15d
clc
sub rdx, r8
xchg cx, bx
movsxd rcx, r10d
bswap bx
mov dword [rsp + 0x20], r9d
not r9b
movsx ebx, sp
dec r14d
lea r9, [rsp + 0x40]
and bl, 0x6e
bts rcx, r13
ror cl, 0x83
cmp rbp, 0xffffffffffffffff
movsx ecx, r15w
movzx ecx, r13w
lea rbx, [r8 + rdi]
movzx cx, dl
movsx rcx, r15w
jmp 0x1404d49ea
mov r8d, dword [rsp + 0x88]
movsx ecx, sp
movzx ecx, r8w
cmove rdx, rbp
not cl
mov rcx, rbx
jmp 0x1404d4a07
call fcn.1404e3b8a
test eax, eax
je 0x1404d4a1c
mov byte [rdi], 0
jmp 0x1404d4b1e
mov eax, dword [rsp + 0x44]
jmp 0x1404d4a25
dec eax
cmp dl, r10b
test bpl, bl
cmp eax, 0xfffffffc
jl 0x1404d4abe
cmp eax, dword [rsp + 0x88]
jmp 0x1404d4a42
jge 0x1404d4abe
cmp r14d, eax
jmp 0x1404d4a50
jge 0x1404d4a72
mov al, byte [rbx]
jmp 0x1404d4a5d
inc rbx
cmc
clc
test al, al
jmp 0x1404d4a69
jne 0x1404d4a56
mov byte [rbx - 2], al
mov rax, qword [rsp + 0xa8]
lea r9, [rsp + 0x40]
movsxd r8, esi
mov r8d, dword [rsp + 0x88]
bswap ecx
seto ch
movsx ecx, r11w
mov rdx, rbp
movsx rcx, r11w
mov qword [rsp + 0x28], rax
movsxd rcx, esp
mov rcx, rdi
jmp 0x1404d4aaa
mov byte [rsp + 0x20], 1
jmp 0x1404d4ab4
call fcn.1404d45dd
jmp 0x1404d4b1e
mov rax, qword [rsp + 0xa8]
mov rdx, rbp
movsx ecx, r8w
mov r9b, byte [rsp + 0x90]
movzx r8w, bpl
xchg ecx, ecx
movsx ecx, ax
mov rcx, rdi
movzx r8w, bpl
mov r8d, dword [rsp + 0x88]
jmp 0x1404d4af4
mov qword [rsp + 0x38], rax
cwde
lea rax, [rsp + 0x40]
mov byte [rsp + 0x30], 1
jmp 0x1404d4b09
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x20], eax
call fcn.1404d3663
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
ror r14, 0x1f
mov rdi, qword [rsp + 0x70]
rol r14b, cl
add r14b, 0x2a
not r14
add rsp, 0x50
bswap r14
movsx r14w, r10b
pop r14
jmp 0x1404d4b4e
ret
Function at 0x1404d91c7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
rcl rbx, cl
movsx ebx, r9w
push rdi
or rbx, rbp
bsf ebx, esi
sub rsp, 0x20
movsxd rbx, esp
cmovg bx, sp
movzx bx, cl
mov rbx, rcx
jmp 0x1404d91f1
call fcn.1404cba1b
or r8, 0xffffffffffffffff
add dl, r8b
add dl, 0x4b
mov r10, rax
movsx rdx, r15w
xor edi, edi
movzx dx, r10b
movsx edx, di
xchg dx, dx
mov rdx, qword [rax + 0x98]
inc r8
test r12, 0x77475ac1
stc
cmp word [rdx + r8*2], di
jmp 0x1404d9230
jne 0x1404d921b
mov eax, edi
sal al, 0x48
cmp r8, 3
cmovs cx, r12w
movzx rcx, r8w
mov ecx, 2
xchg al, al
sete al
mov dword [r10 + 0xb0], eax
je 0x1404d92cb
mov r9d, edi
and r8w, r8w
not r8b
adc r8w, 0x55ac
movzx r8d, word [rdx]
cmp r14b, 0x32
rcl al, cl
lea rdx, [rdx + rcx]
xor ah, 0xf9
sbb ah, 0xeb
lea eax, [r8 - 0x41]
jmp 0x1404d928c
cmp ax, 0x19
jmp 0x1404d9295
jbe 0x1404d92b5
sub r8w, 0x61
cmp r9b, 0x72
clc
cmp r8w, 0x19
jmp 0x1404d92af
ja 0x1404d92c2
inc r9d
jmp 0x1404d92bd
jmp 0x1404d926f
mov ecx, r9d
jmp 0x1404d92cb
mov dword [r10 + 0xac], ecx
jmp 0x1404d92d7
mov edx, 1
movzx ecx, r11w
seta cl
not cl
lea rcx, [0x1400ac0b8]
jmp 0x1404d92f1
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
test byte [rbx], 4
jmp 0x1404d92ff
jne 0x1404d930f
mov dword [rbx], edi
sal ebx, cl
mov bl, spl
rcr dil, cl
mov rbx, qword [rsp + 0x30]
ror dil, 0xc5
add rsp, 0x20
mov dil, 0xad
pop rdi
jmp 0x1404d9325
ret

Function at 0x1404d9702
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
jmp 0x1404d9711
mov qword [rsp + 0x18], rsi
inc bx
btr rbx, 0xe1
shl bl, 3
push rdi
movsx bx, al
cmp bx, r9w
sub rsp, 0x20
xor esi, esi
or ebx, ecx
cmovbe ebx, r9d
bswap rdi
mov rdi, rdx
rcr bl, cl
mov rbx, rcx
cmp r12b, 0x4f
jmp 0x1404d974a
test rcx, rcx
je 0x1404d97ff
cmp word [rcx], si
jmp 0x1404d975b
je 0x1404d97ff
lea rdx, [0x1400d1d08]
jmp 0x1404d976d
call fcn.1401d3a81
test eax, eax
jmp 0x1404d9779
je 0x1404d97ff
lea rdx, [0x1400d1d00]
mov cx, cx
not cl
cmovne rcx, rsp
mov rcx, rbx
jmp 0x1404d9797
call fcn.1401d3a81
test eax, eax
jmp 0x1404d97a3
jne 0x1404d97f2
mov ecx, dword [rdi + 8]
setge r8b
jmp 0x1404d97b8
lea r9d, [rsi + 2]
movzx rdx, si
movsxd r8, r9d
lea r8, [rsp + 0x30]
bswap rdx
cdq
mov edx, 0x2000000b
jmp 0x1404d97d6
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d97e3
je 0x1404d9834
mov eax, dword [rsp + 0x30]
jmp 0x1404d9858
mov rcx, rbx
call fcn.1404e289e
jmp 0x1404d9858
mov ecx, dword [rdi + 8]
bswap rdx
lea r8, [rsp + 0x30]
mov r9d, 2
setns dl
movsx rdx, r15w
mov edx, 0x20001004
jmp 0x1404d9821
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d982e
jne 0x1404d9840
sub eax, eax
jmp 0x1404d983b
jmp 0x1404d9858
mov eax, dword [rsp + 0x30]
test bl, 0x8b
cmp rdi, r10
test eax, eax
jne 0x1404d9858
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
shr sil, cl
stc
mov rsi, qword [rsp + 0x40]
shr di, cl
ror di, 0x41
add rsp, 0x20
pop rdi
jmp 0x1404d9877
ret
Function at 0x1404d9878
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
shrd rbx, rsp, 0x48
stc
mov bl, r11b
mov qword [rsp + 0x18], rsi
test rbp, rdi
and bx, r11w
push rdi
shl sil, 0xcf
xor sil, 0xb2
xadd bx, si
sub rsp, 0x20
setnp bh
mov esi, edx
mov ebx, ecx
jmp 0x1404d98af
call fcn.1404cba1b
mov ecx, ebx
lea r8, [rsp + 0x30]
movzx r9d, r9w
bswap r9w
stc
and ecx, 0x3ff
mov r9d, 2
btc edx, 2
bts ecx, 0xa
mov di, r10w
mov edx, 0x20000001
cmova di, ax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
stc
cmp r13b, 0xd7
test eax, eax
jmp 0x1404d98fd
je 0x1404d99b0
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d990c
je 0x1404d99a6
test esi, esi
jmp 0x1404d9919
je 0x1404d99a6
mov r9, qword [rdi + 0x98]
mov r8d, r10d
ror dl, 0xb6
shld rdx, r10, 0x84
movzx eax, bx
movzx edx, word [r9]
cbw
lea rcx, [r9 + 2]
add ax, dx
ror ax, 9
cmp r12w, r11w
lea eax, [rdx - 0x41]
cmp ax, 0x19
jbe 0x1404d9967
sub dx, 0x61
cmp al, r8b
cmp dx, 0x19
ja 0x1404d997b
movzx edx, word [rcx]
jmp 0x1404d996f
inc r8d
add rcx, 2
jmp 0x1404d9949
or rcx, 0xffffffffffffffff
jmp 0x1404d9984
inc rcx
test r13b, sil
cmp dil, cl
cmp word [r9 + rcx*2], r10w
jne 0x1404d9984
cmp r8d, ecx
jmp 0x1404d99a0
je 0x1404d99b0
mov eax, 1
jmp 0x1404d99bc
xor eax, eax
and rbx, 0x41f542c9
mov si, bp
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
movsx di, r9b
add rsp, 0x20
movsxd rdi, r13d
pop rdi
jmp 0x1404d99d8
ret
Function at 0x1404db038
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmp r13b, 0x87
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
cmp r15b, sil
test eax, 0xa4d192e
cmc
mov qword [rax + 0x18], rsi
cmp rbp, 0x57ff420e
mov qword [rax + 0x20], rdi
test cx, r9w
push r14
cmp r14b, 0x84
test dl, 0x4d
test r8b, r15b
sub rsp, 0x40
jmp 0x1404db078
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
bt bx, 0x2d
adc bl, bpl
add bx, 0x4b8d
mov rbx, rax
cmp r11b, 0xe7
stc
test rax, rax
je 0x1404db219
mov rsi, rax
cmp word [rax], r14w
jmp 0x1404db0ab
je 0x1404db0eb
or rax, 0xffffffffffffffff
jmp 0x1404db0ba
inc rax
jmp 0x1404db0c3
cmp word [rsi + rax*2], r14w
jmp 0x1404db0cd
jne 0x1404db0ba
lea rsi, [rsi + rax*2]
add rsi, 2
cmc
jmp 0x1404db0e1
cmp word [rsi], r14w
jne 0x1404db0b1
mov qword [rsp + 0x38], r14
movsx r9d, bp
shl r9b, 0x83
sub rsi, rbx
neg r8b
mov qword [rsp + 0x30], r14
bswap r8
dec r8b
not r8
add rsi, 2
sub r9d, r14d
cmp r13b, 0x11
add r8, rbx
sar rsi, 1
xadd r8, r8
jmp 0x1404db12a
mov r8, rbx
btc r9w, r13w
mov r9d, esi
mov dword [rsp + 0x28], r14d
jmp 0x1404db146
xor edx, edx
mov qword [rsp + 0x20], r14
jmp 0x1404db156
sub ecx, ecx
jmp 0x1404db15d
call fcn.1404cb81e
movsxd rbp, eax
test eax, eax
je 0x1404db219
mov rcx, rbp
jmp 0x1404db175
call fcn.1404cb738
mov rdi, rax
test rax, rax
jmp 0x1404db185
je 0x1404db204
mov qword [rsp + 0x38], r14
clc
mov r9d, esi
shl r8w, cl
jmp 0x1404db19d
mov qword [rsp + 0x30], r14
sub r8b, 0xde
mov r8, rbx
mov dword [rsp + 0x28], ebp
test al, bpl
cmp r14b, spl
test rsi, 0x479a693f
sub edx, edx
cmp r15, 0x6c6c6f46
test bp, di
cmp r15w, bp
sub ecx, ecx
jmp 0x1404db1d1
mov qword [rsp + 0x20], rax
jmp 0x1404db1db
call fcn.1404cb81e
test eax, eax
je 0x1404db204
mov rsi, rdi
cmova rdi, r12
jmp 0x1404db1f7
mov rdi, r14
jmp 0x1404db1ff
jmp 0x1404db207
mov rsi, r14
mov rcx, rdi
jmp 0x1404db20f
call fcn.1404cb6be
jmp 0x1404db21d
mov rsi, r14
clc
test rbx, rbx
je 0x1404db234
mov rcx, rbx
jmp 0x1404db22e
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
ror bpl, 0xfc
test cl, 0xfc
mov rax, rsi
mov rsi, qword [rsp + 0x60]
xchg rbp, rdi
dec bpl
mov rbp, qword [rsp + 0x58]
bt edi, 0x53
clc
mov rdi, qword [rsp + 0x68]
xor r14b, 0xaa
and r14b, bl
add rsp, 0x40
pop r14
jmp 0x1404db26f
ret
Function at 0x1404db270
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404db285
mov qword [rsp + 0x10], rbp
cmp ebp, ebp
mov qword [rsp + 0x18], rsi
push rdi
clc
jmp 0x1404db298
sub rsp, 0x20
jmp 0x1404db2a1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
adc bl, sil
mov rbx, rax
jmp 0x1404db2b4
test rax, rax
jmp 0x1404db2bc
je 0x1404db373
mov rbp, rax
cmp word [rax], si
jmp 0x1404db2cd
je 0x1404db30b
or rax, 0xffffffffffffffff
jmp 0x1404db2dc
inc rax
cmp word [rbp + rax*2], si
jmp 0x1404db2e9
jne 0x1404db2dc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp spl, 0xff
cmp word [rbp], si
jmp 0x1404db305
jne 0x1404db2d3
sub rbp, rbx
or cx, 0x3093
add rbp, 2
sar rbp, 1
shr cx, cl
adc rcx, r8
add rbp, rbp
movsx cx, r9b
movsxd rcx, esi
not cl
mov rcx, rbp
jmp 0x1404db335
call fcn.1404cb738
mov rdi, rax
clc
test rax, rax
je 0x1404db35e
mov r8, rbp
mov rdx, rbx
mov rcx, rax
jmp 0x1404db355
call fcn.1404a58cd
mov rsi, rdi
clc
xor ecx, ecx
call fcn.1404cb6be
mov rcx, rbx
jmp 0x1404db36d
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
rol bp, 0x3b
mov rax, rsi
shr bpl, cl
mov rsi, qword [rsp + 0x40]
adc bp, 0x6941
movsx ebp, ax
mov rbp, qword [rsp + 0x38]
bts di, ax
mov dil, r8b
add rsp, 0x20
pop rdi
jmp 0x1404db3a5
ret
Function at 0x1404de326
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, edi
setno al
lahf
mov qword [rsp + 0x18], rbp
movsx ax, r8b
movzx rax, r15w
push rsi
not ax
push rdi
setbe ah
movsx eax, r9w
cbw
push r14
movzx ax, r14b
lahf
mov ax, 0x507d
mov eax, 0x1450
jmp 0x1404de364
call fcn.14044aca0
sub rsp, rax
neg al
cmp r12w, 0x4656
ror sil, 0x50
mov rax, qword [0x1400b7288]
sub sil, 5
adc r14w, 0x4805
jmp 0x1404de38e
xor rax, rsp
and r14d, 0x76de663f
ror di, 0x87
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
sal sil, cl
bts ecx, r10d
bt cx, bp
mov rax, r10
shr bpl, cl
mov ebp, r9d
shl rcx, 0xb
bsf si, cx
btr r14d, r15d
sar rax, 6
xor dx, 0x40a2
setne cl
lea rcx, [0x1400ba940]
and sil, dil
cmp r10d, 0x633848ef
adc r14b, sil
and r10d, 0x3f
lea rbp, [rbp + r8]
clc
ror r14, 0xd6
mov rsi, r8
btr rdx, 0xc0
movsx r14, bp
mov rax, qword [rcx + rax*8]
rol dl, cl
lea rdx, [r10 + r10*8]
shrd r14w, r15w, 0x21
mov r14, qword [rax + rdx*8 + 0x28]
cmc
xor eax, eax
stc
jmp 0x1404de423
mov qword [rdi], rax
mov dword [rdi + 8], eax
clc
cmp rdi, rcx
test dl, spl
cmp r8, rbp
jae 0x1404de51a
lea rbx, [rsp + 0x40]
jmp 0x1404de443
cmp rsi, rbp
jmp 0x1404de44b
jae 0x1404de48f
mov al, byte [rsi]
jmp 0x1404de458
inc rsi
cmp sil, 0x53
cmp al, 0xa
jmp 0x1404de466
jne 0x1404de475
inc dword [rdi + 8]
mov byte [rbx], 0xd
inc rbx
mov byte [rbx], al
movzx rax, dx
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x1404de443
and qword [rsp + 0x20], 0
stc
lea rax, [rsp + 0x40]
sub ebx, eax
not rcx
lea r9, [rsp + 0x30]
setns cl
mov r8d, ebx
movsx rcx, r14w
mov cx, 0x6764
movzx dx, bl
lea rdx, [rsp + 0x40]
cmova cx, r13w
movsx cx, dil
movsx ecx, bx
mov rcx, r14
jmp 0x1404de4d1
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404de4de
je 0x1404de512
mov eax, dword [rsp + 0x30]
test rsi, 0x39cd275e
add dword [rdi + 4], eax
jmp 0x1404de4f7
cmp eax, ebx
jmp 0x1404de4fe
jb 0x1404de51a
cmp rsi, rbp
jb 0x1404de439
jmp 0x1404de51a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov cx, 0x2886
sbb cl, 0x1c
bsf cx, r8w
mov rcx, qword [rsp + 0x1440]
cmc
clc
xor rcx, rsp
jmp 0x1404de53b
call fcn.1404a1da3
lea r11, [rsp + 0x1450]
cmovo bp, si
bswap bp
mov rbx, qword [r11 + 0x20]
sete dil
bswap r14w
mov rbp, qword [r11 + 0x30]
movsxd rsi, edx
not sil
mov rsp, r11
mov r14w, 0x7a44
not r14b
movsx r14d, bp
pop r14
movsx edi, r11w
mov di, 0x456e
pop rdi
jmp 0x1404de588
pop rsi
jmp 0x1404de58e
ret
Function at 0x1404de58f
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov al, 9
jmp 0x1404de5bc
push rsi
push rdi
cbw
push r14
xchg ah, ah
movsx rax, cx
mov eax, 0x1450
jmp 0x1404de5d2
call fcn.14044aca0
sub rsp, rax
or rax, rdi
sal r14w, cl
ror ax, 0x9b
mov rax, qword [0x1400b7288]
clc
xor rax, rsp
bsf rdi, r10
ror r10b, cl
bsr bp, r13w
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
jmp 0x1404de616
mov ebp, r9d
test r8d, ebp
sar rax, 6
test r11w, r15w
lea rcx, [0x1400ba940]
movzx si, dl
shr r14w, 9
shr rdx, cl
and r10d, 0x3f
lea rbp, [rbp + r8]
cmc
mov rsi, r8
shrd rdx, r11, 0xd7
mov rax, qword [rcx + rax*8]
bswap rdx
cmp dil, 0x5e
shld r14w, r10w, 0x5d
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
test r13, 0x4ee071ad
cmc
cmp r10b, 0xe9
xor eax, eax
clc
mov qword [rdi], rax
cmp sil, 0x6f
test si, r8w
mov dword [rdi + 8], eax
test r8b, r11b
cmp r15b, spl
cmp r8, rbp
jae 0x1404de7a8
lea rbx, [rsp + 0x40]
jmp 0x1404de699
cmp rsi, rbp
jmp 0x1404de6a1
jae 0x1404de70d
movzx eax, word [rsi]
cmc
cmp r10b, 0x12
test r11w, 0x6a86
add rsi, 2
test r9d, eax
cmc
cmp ax, 0xa
jmp 0x1404de6c6
jne 0x1404de6e8
add dword [rdi + 8], 2
sar ch, 0x2d
test r13w, bp
movzx cx, r14b
mov ecx, 0xd
mov word [rbx], cx
add rbx, 2
mov word [rbx], ax
add rbx, 2
ror eax, 0x63
adc eax, esp
lea rax, [rsp + 0x143e]
test dh, 9
cmp rbx, rax
jmp 0x1404de707
jb 0x1404de699
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
clc
movsx dx, r11b
lea r9, [rsp + 0x30]
bts dx, cx
movsx r8d, dx
sar rbx, 1
xor r8, 0x233511ab
test dl, 0x12
sar edx, 0xca
lea rdx, [rsp + 0x40]
sar r8b, 0xec
add ebx, ebx
movsx r8, r12w
mov rcx, r14
movzx r8w, al
mov r8w, r10w
mov r8d, ebx
jmp 0x1404de761
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404de76e
je 0x1404de79d
mov eax, dword [rsp + 0x30]
cmc
cmp dl, r8b
add dword [rdi + 4], eax
cmp r10b, r13b
cmp eax, ebx
jmp 0x1404de789
jb 0x1404de7a8
cmp rsi, rbp
jb 0x1404de68f
jmp 0x1404de7a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
movzx eax, ax
mov rax, rdi
cmp r10, r9
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404de7be
call fcn.1404a1da3
lea r11, [rsp + 0x1450]
bswap esi
jmp 0x1404de7d5
mov rbx, qword [r11 + 0x20]
xchg dil, r14b
not ebp
movzx esi, cx
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movsx di, r13b
bswap esi
pop r14
movsx si, r10b
movzx rdi, r8w
pop rdi
movzx esi, dx
jmp 0x1404de803
pop rsi
jmp 0x1404de809
ret
Function at 0x1404de80a
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx ax, spl
mov qword [rsp + 0x18], rbp
lahf
movsx rax, r11w
push rsi
mov ax, r12w
push rdi
push r12
mov ax, r9w
push r14
lahf
movsx eax, cx
push r15
mov eax, 0x1470
call fcn.14044aca0
sub rsp, rax
xchg r15, r12
mov rax, qword [0x1400b7288]
rcl r12d, cl
btr r14d, 0x10
xadd r15b, r12b
xor rax, rsp
movzx di, r14b
sar r12w, cl
rcr bh, 0xe8
mov qword [rsp + 0x1460], rax
movsx rbx, ax
movsxd r10, edx
movsx r14, r12w
movsx bx, r13b
btc r14w, r11w
mov rbx, rcx
mov rax, r10
mov r14d, r9d
sar rax, 6
inc edi
neg r15b
and edx, r15d
lea rcx, [0x1400ba940]
and r10d, 0x3f
btr rdi, 0xf9
add r14, r8
add r15d, 0x33654e85
add r15b, r11b
mov r15, r8
movsxd rdx, eax
mov rdi, r8
mov rax, qword [rcx + rax*8]
setns r12b
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
cmp r13b, 0x28
test cx, 0x2017
xor eax, eax
mov qword [rbx], rax
test r12w, r10w
cmp r8, r14
jmp 0x1404de8e7
mov dword [rbx + 8], eax
jmp 0x1404de8ef
jae 0x1404deaa7
lea rax, [rsp + 0x50]
cmp rdi, r14
jmp 0x1404de902
jae 0x1404de960
movzx ecx, word [rdi]
cmp cl, 0xc9
add rdi, 2
stc
clc
cmp cx, 0xa
jmp 0x1404de91d
jne 0x1404de938
mov edx, 0xd
mov word [rax], dx
jmp 0x1404de930
add rax, 2
cmp r8w, cx
mov word [rax], cx
bt ecx, r15d
add rax, 2
movsxd rcx, r15d
and cx, sp
lea rcx, [rsp + 0x6f8]
stc
cmp rax, rcx
jmp 0x1404de95a
jb 0x1404de8fa
and qword [rsp + 0x38], 0
rcl r8w, cl
xor r8, 0x5df3983
shrd rcx, r11, 0x86
lea rcx, [rsp + 0x50]
bts r8, r8
and qword [rsp + 0x30], 0
add r8w, 0x187a
ror r9w, cl
lea r8, [rsp + 0x50]
bt r9d, r11d
shl r9b, 0x23
sub rax, rcx
shld r9w, si, 0xc6
mov dword [rsp + 0x28], 0xd55
test r10b, 8
bts rcx, rbp
lea rcx, [rsp + 0x700]
sar rax, 1
ror r9b, 0x48
mov qword [rsp + 0x20], rcx
clc
mov r9d, eax
adc cl, bpl
sal ecx, cl
xadd ecx, ecx
mov ecx, 0xfde9
test r14, 0x310b37d7
test sil, r8b
sub edx, edx
call fcn.1404cb81e
mov ebp, eax
cmc
test eax, eax
jmp 0x1404de9f5
je 0x1404dea9a
xor esi, esi
test eax, eax
jmp 0x1404dea04
je 0x1404dea77
and qword [rsp + 0x20], 0
cdq
shrd cx, r12w, 0x31
lea rdx, [rsp + 0x700]
rcl r8b, 0x62
test dl, r12b
rol r8w, cl
mov ecx, esi
bts r8, r9
lea r9, [rsp + 0x40]
adc r8b, spl
mov r8d, ebp
jmp 0x1404dea40
lea rdx, [rdx + rcx]
mov rcx, r12
sub r8d, esi
jmp 0x1404dea4f
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dea5c
je 0x1404dea9a
add esi, dword [rsp + 0x40]
cmp r11b, dil
clc
cmp esi, ebp
jmp 0x1404dea71
jb 0x1404dea0a
mov eax, edi
test r13w, 0x1004
sub eax, r15d
cmp spl, r11b
jmp 0x1404dea8a
mov dword [rbx + 4], eax
clc
test r15w, r13w
cmp rdi, r14
jmp 0x1404de8ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
movsx ax, r8b
mov rax, rbx
mov rcx, qword [rsp + 0x1460]
test esp, 0x2ea7ee2
clc
xor rcx, rsp
jmp 0x1404deac1
call fcn.1404a1da3
lea r11, [rsp + 0x1470]
setbe bpl
mov rbx, qword [r11 + 0x30]
setl dil
movsxd r15, r13d
movzx r12d, bp
mov rbp, qword [r11 + 0x40]
mov rsp, r11
not r15b
movsx r12w, r15b
xchg sil, r14b
pop r15
xchg edi, esi
pop r14
pop r12
movzx di, spl
pop rdi
movsxd rsi, r11d
bswap si
pop rsi
jmp 0x1404deb0d
ret
Function at 0x1404e21b0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
bts r8w, bp
push rdi
rcl r9b, cl
mov r9, rbp
sub rsp, 0x20
movzx ebx, bx
movzx di, r12b
bswap ebx
mov rbx, rdx
bswap r8w
lea r9, [0x1400c8ea8]
movsx rdi, si
mov edi, ecx
lea rdx, [0x1400cf748]
movzx r8d, r12w
cmovnp ecx, r15d
movsxd r8, edi
mov ecx, 3
lea r8, [0x1400c8ea0]
call fcn.1404e22f1
mov rdx, rbx
mov ecx, edi
clc
test spl, 0x4d
test rax, rax
jmp 0x1404e2218
je 0x1404e2229
call qword [case.0x14044ab9b.0]
jmp 0x1404e222f
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
shr rdi, 0xb
sub dil, spl
add rsp, 0x20
cmovp di, si
bswap edi
pop rdi
ret