joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404714a1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp ecx, ebx
test r12, r11
jmp 0x1404714ba
mov qword [rax + 8], rbx
xor bh, 0x52
cmp rdx, 0x7be6b70
movsxd rbx, r14d
mov qword [rax + 0x10], rbp
rcl ebx, 0xc3
bt ebp, eax
mov qword [rax + 0x18], rsi
inc esi
shr bpl, cl
mov qword [rax + 0x20], rdi
push r14
sar bh, 0x4a
btr r14, 0xb2
rol rsi, cl
sub rsp, 0x20
mov rsi, r9
rcl r14d, 0x94
mov rbx, r8
rcl bp, cl
mov r14, rdx
jmp 0x14047150b
mov rbp, rcx
test r8w, r9w
jmp 0x140471517
test r9, r9
jmp 0x14047151f
je 0x14047160f
mov rdi, qword [rdx + 8]
test rdi, rdi
jmp 0x140471531
je 0x1404715ed
mov rax, qword [rdi + 0x40]
xadd r8w, r8w
shrd r8w, bp, 4
movzx r8d, word [rbx]
clc
cmp qword [rax], 0
je 0x14047158d
mov rax, qword [rdi + 0x58]
cmp dword [rax], 0
jle 0x14047158d
dec dword [rax]
xchg rcx, rax
movsxd rcx, edi
cdqe
mov rcx, qword [rdi + 0x40]
sets al
mov rdx, qword [rcx]
bswap ax
lea rax, [rdx + 2]
jmp 0x140471581
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x1404715cd
mov rax, qword [rdi]
movzx edx, r15w
setne dh
mov rdx, r15
movzx edx, r8w
movsx cx, r10b
movsx rcx, cx
mov rcx, rax
mov rcx, rdi
jmp 0x1404715b2
mov rax, qword [rax + 0x18]
jmp 0x1404715bb
call qword [0x1400b8d90]
movzx r8d, ax
bts ax, cx
rcr ax, 0xf4
mov eax, 0xffff
clc
cmp r14w, 0x1b94
jmp 0x1404715de
cmp ax, r8w
jmp 0x1404715e7
jne 0x1404715fb
mov byte [r14], 1
test ax, 0x40c4
stc
jmp 0x1404715fb
add rbx, 2
cmc
sub rsi, 1
jmp 0x140471609
jne 0x140471529
movups xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x30]
neg sil
mov rax, rbp
and dil, 0x67
shl dil, 0xb3
mov rsi, qword [rsp + 0x40]
btc r14w, si
add dil, 0xcc
rcl dil, 0xda
mov rdi, qword [rsp + 0x48]
sar r14w, 0xb
shl r14w, cl
movdqu xmmword [rbp], xmm0
mov bpl, al
shl r14b, 0x1c
mov rbp, qword [rsp + 0x38]
movsx r14w, r13b
sbb r14b, bl
sbb r14b, 0x23
add rsp, 0x20
movzx r14d, sp
movsxd r14, esp
pop r14
ret
Function at 0x140471671
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
test ebx, 0x75d3303b
cmc
mov qword [rax + 8], rbx
test r15b, r10b
jmp 0x14047168a
mov qword [rax + 0x10], rbp
xadd bpl, bpl
sal bpl, cl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
shr rdi, cl
xor sil, spl
bt bp, 0xbc
push r14
sal rsi, cl
mov bpl, r8b
setno r14b
sub rsp, 0x20
mov rsi, r9
movzx r14d, r8w
mov rdi, rdx
rcr bpl, cl
cmovnp bp, si
mov rbp, rcx
test r9, r9
je 0x140471786
mov rbx, qword [rdx + 8]
clc
test rbx, rbx
jmp 0x1404716e2
je 0x140471779
mov rax, qword [rbx + 0x40]
cmp qword [rax], 0
jmp 0x1404716f5
je 0x140471740
mov rax, qword [rbx + 0x58]
cmp ax, r8w
cmp dword [rax], 0
jle 0x140471740
dec dword [rax]
setne cl
movsxd rax, r13d
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
setp al
lea rax, [rdx + 2]
jmp 0x140471727
mov qword [rcx], rax
cmovne ax, r12w
movsx eax, r13w
movzx eax, r14w
mov word [rdx], r14w
jmp 0x14047175f
mov rax, qword [rbx]
movzx edx, r14w
movzx ecx, r15w
bswap ecx
mov rcx, rbx
mov rax, qword [rax + 0x18]
jmp 0x140471759
call qword [0x1400b8d90]
mov ecx, 0xffff
cmp r14b, r13b
test r8b, r12b
cmp ebx, 0x3b6d33e1
cmp cx, ax
jne 0x14047177c
mov byte [rdi], 1
sub rsi, 1
jne 0x1404716da
movups xmm0, xmmword [rdi]
test bl, r8b
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
btc di, dx
adc r14d, 0x490c31f0
movsxd r14, edi
mov rdi, qword [rsp + 0x48]
jmp 0x1404717b1
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
bts r14, rbx
test edx, 0x1fe30642
add rsp, 0x20
movzx r14w, r8b
mov r14b, 0xb6
cmovne r14, rsp
pop r14
jmp 0x1404717dc
ret
Function at 0x14049cd56
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
btr bp, 0xa7
mov qword [rax + 0x20], rsi
not bpl
movsx rbp, r11w
push rdi
push r14
sbb r14w, 0x68a4
push r15
rcr bpl, 0x71
sar rdi, cl
sub rsp, 0x20
btr r14, 0xa2
add dil, dl
adc r15w, 0x5b03
test rdx, rdx
movzx r15, r8w
movzx r14w, dl
movsx r15d, r12w
lea r14, [rax + 8]
mov r15d, esp
jmp 0x14049cdb4
mov rbp, rcx
setae sil
mov rdi, rcx
setnp r15b
movsx si, r13b
movzx rsi, bx
movzx ecx, byte [rcx]
setb r15b
movzx r15w, r9b
cmovne r14, rdx
movsx r15d, r9w
movsx rsi, r8w
mov r15, r9
movzx si, r15b
setp sil
movsx rsi, ax
mov esi, r8d
jmp 0x14049cdfb
jmp 0x14049ce0b
inc rdi
movzx ecx, byte [rdi]
jmp 0x14049ce0b
call fcn.1404b61fd
test eax, eax
jmp 0x14049ce17
jne 0x14049ce00
mov bl, byte [rdi]
sbb ax, 0x6446
test r14w, sp
rcr ax, cl
lea eax, [rbx - 0x2b]
stc
clc
test al, 3
test al, 0xfd
je 0x14049ce40
mov bl, 0x2b
jmp 0x14049ce45
inc rdi
not dh
mov r9, r15
mov r8d, esi
mov rdx, r14
mov rcx, rdi
jmp 0x14049ce56
call fcn.14049cf81
mov ecx, eax
rol sil, 0x43
cmp al, r10b
mov esi, 0x1878486b
mov esi, 0x7fffffff
cmp ax, 0x40a5
cmp rdi, qword [r14]
jne 0x14049ce88
mov qword [r14], rbp
jmp 0x14049ce83
jmp 0x14049ce96
cmp rbp, qword [r14]
jmp 0x14049ce90
jne 0x14049cea3
test ecx, ecx
jmp 0x14049ce9d
jne 0x14049ced3
cmp bl, 0x2b
jne 0x14049ceb4
cmp ecx, esi
ja 0x14049ced3
cmp bl, 0x2d
jmp 0x14049cebc
jne 0x14049cf15
cmp ecx, 0x80000000
jmp 0x14049cecd
jbe 0x14049cf15
call fcn.1404b368d
mov dword [rax], 0x22
cmc
test r15, r15
je 0x14049ceef
mov dword [r15], 1
mov eax, 0x80000000
cmp dl, 0x41
cmc
stc
cmp bl, 0x2d
jmp 0x14049cf01
cmove esi, eax
movzx eax, r8w
cwde
mov eax, esi
jmp 0x14049cf10
jmp 0x14049cf34
neg eax
cmp bl, 0x2d
cmovl esi, r11d
bswap ebp
cmove ecx, eax
rcr bpl, 0xad
mov rsi, 0x4eb2616c
rcl r15d, 0x80
mov eax, ecx
mov rbx, qword [rsp + 0x48]
btr r14d, ecx
mov rbp, qword [rsp + 0x50]
movsxd r14, r15d
mov rsi, qword [rsp + 0x58]
or r14w, cx
xor r15, 0x616a2efc
btr edi, r15d
add rsp, 0x20
mov r15, rdx
movzx r14w, r12b
xchg r15b, r15b
pop r15
movsxd r14, ebp
pop r14
movzx edi, r8w
movsx di, cl
xchg dil, dil
pop rdi
jmp 0x14049cf80
ret
Function at 0x14049d392
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
clc
stc
test r9b, dil
mov qword [rsp + 0x18], rbp
mov rbp, 0x4c3726a3
push rsi
push rdi
shr si, 0xcf
push r12
rcl bpl, 0x59
btc rsi, r8
shld rdi, r14, 0xf2
push r14
ror bp, 0xaa
xchg si, bp
add r14b, bl
push r15
sub rsp, 0x20
test rdx, rdx
movsx bp, r13b
lea r14, [rsp + 0x50]
bswap ebp
mov rsi, rcx
mov rdi, rcx
movsx bp, dil
movzx r15w, cl
jmp 0x14049d3f3
movzx ecx, byte [rcx]
cmovne r14, rdx
movsx rbp, cx
jmp 0x14049d408
mov r15, r9
movsx bp, r14b
setne bpl
xchg rbp, rbp
mov ebp, r8d
jmp 0x14049d41f
jmp 0x14049d432
inc rdi
bswap cx
movzx ecx, byte [rdi]
jmp 0x14049d432
call fcn.1404b61fd
test eax, eax
jmp 0x14049d43e
jne 0x14049d424
mov bl, byte [rdi]
setno al
lea eax, [rbx - 0x2b]
cmp cl, sil
clc
test al, 0xfd
jmp 0x14049d457
je 0x14049d464
mov bl, 0x2b
jmp 0x14049d46e
inc rdi
cqo
cmovge dx, r8w
mov r9, r15
cwd
mov r8d, ebp
not cx
cwd
movzx rdx, di
mov rdx, r14
mov rcx, rdi
jmp 0x14049d48a
call fcn.14049d5e2
mov rcx, rax
movsx r12d, cx
movzx r12, r11w
mov bpl, 0x2d
mov r12b, bpl
sbb r12b, bl
movabs r12, 0x8000000000000000
clc
cmp rdi, qword [r14]
jmp 0x14049d4b6
jne 0x14049d4c9
mov qword [r14], rsi
jmp 0x14049d4c4
jmp 0x14049d4d7
cmp rsi, qword [r14]
jmp 0x14049d4d1
jne 0x14049d4e5
test rcx, rcx
jmp 0x14049d4df
jne 0x14049d528
cmp bl, 0x2b
jmp 0x14049d4ed
jne 0x14049d511
movabs rax, 0x7fffffffffffffff
stc
jmp 0x14049d503
cmp rcx, rax
jmp 0x14049d50b
ja 0x14049d528
cmp bl, bpl
jmp 0x14049d519
jne 0x14049d570
cmp rcx, r12
jbe 0x14049d570
call fcn.1404b368d
mov dword [rax], 0x22
test r15, r15
jmp 0x14049d53b
je 0x14049d54e
mov dword [r15], 1
clc
stc
cmp spl, 0x71
sub bl, bpl
jmp 0x14049d557
neg bl
sbb rax, rax
clc
cmp r9w, 0x4056
add rax, r12
jmp 0x14049d56b
jmp 0x14049d5a5
mov rax, rcx
add r12w, 0x2a95
or si, bx
adc dil, dl
neg rax
bt di, 0x24
xor r12w, 0x2c6b
cmp bl, bpl
not r12b
cmove rcx, rax
sar dil, 0xa3
mov rax, rcx
bswap r14w
rcl rbx, cl
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
and r15b, 0xfb
add rsp, 0x20
cmovs edi, r12d
pop r15
movzx r14d, r11w
pop r14
jmp 0x14049d5cf
pop r12
pop rdi
cmovs si, r9w
setae sil
pop rsi
jmp 0x14049d5e1
ret

Function at 0x14049e5c5
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x14049e5d3
call fcn.1404a8915
mov r9d, 2
lea r8, [rsp + 0x30]
mov rcx, qword [rax + 0x28]
movsx dx, r9b
lea edx, [r9 + 0x20]
jmp 0x14049e5f5
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmc
sub ecx, 0x30
jmp 0x14049e609
je 0x14049e655
sub ecx, 1
jmp 0x14049e617
je 0x14049e646
cmp ecx, 1
jmp 0x14049e625
je 0x14049e637
sub eax, eax
jmp 0x14049e632
jmp 0x14049e65a
mov eax, 3
jmp 0x14049e641
jmp 0x14049e65a
mov eax, 1
jmp 0x14049e650
jmp 0x14049e65a
mov eax, 2
add rsp, 0x28
jmp 0x14049e663
ret
Function at 0x14049e664
Capabilities:
Check for software breakpoints
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r12, rsi
cmc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
movzx si, r10b
sub sil, al
mov qword [rax + 0x18], rdi
test dx, 0xd03
movzx esi, bx
mov qword [rax + 0x20], r14
shl r14, cl
push r15
movzx r14d, bp
sub rsp, 0x30
shrd rsi, rcx, 0x1b
sal r15, 0x5f
movzx r15, r10w
mov rdi, r9
movsxd r15, eax
xor r15d, edx
ror si, 0x77
mov rsi, rdx
adc r14b, 0xff
sub rsi, rcx
sub rdi, r8
mov r15, rcx
bsf cx, dx
bt rcx, 0x1e
sbb r14, rcx
sar rsi, 1
sbb cl, 0x4d
shld r14, r10, 0x11
bts r14d, esp
mov rcx, qword [rsp + 0x60]
sub ebx, ebx
adc r14b, 0xf4
bts r14, rsp
sar rdi, 1
movsx r14w, r14b
ror r14b, cl
btc r14w, di
mov r14, r8
cmp sil, 0xcc
stc
test rcx, rcx
jmp 0x14049e70c
jne 0x14049e725
call fcn.1404a8915
mov rcx, qword [rax + 8]
jmp 0x14049e720
jmp 0x14049e72d
mov rcx, qword [rcx + 8]
cmc
cmp spl, dl
test rcx, rcx
jmp 0x14049e735
jne 0x14049e7c9
cmp esi, edi
mov eax, edi
xchg cx, cx
cmovl eax, esi
btr cx, di
jmp 0x14049e751
movsxd rcx, eax
mov eax, 1
test rcx, rcx
jmp 0x14049e761
je 0x14049e790
sub r15, r14
movzx edx, word [r15 + r14]
cmp dx, word [r14]
jne 0x14049e7af
add r14, 2
jmp 0x14049e782
sub rcx, rax
jmp 0x14049e78a
jne 0x14049e76a
cmp esi, edi
jmp 0x14049e797
je 0x14049e7bd
or ecx, 0xffffffff
cmp esi, edi
jmp 0x14049e7a7
cmovl eax, ecx
jmp 0x14049e822
sbb ebx, ebx
and ebx, 0xfffffffe
cmp bp, 0x1fc
add ebx, eax
not ah
mov eax, ebx
jmp 0x14049e7c4
jmp 0x14049e822
mov dword [rsp + 0x28], edi
movzx r9w, r8b
mov r9d, esi
movzx rdx, di
mov r8, r15
mov qword [rsp + 0x20], r14
mov edx, 0x1000
jmp 0x14049e7eb
call fcn.1404c1388
test eax, eax
jmp 0x14049e7f7
jne 0x14049e818
call fcn.1404b368d
mov dword [rax], 0x16
movzx eax, bx
cwde
cbw
mov eax, 0x7fffffff
jmp 0x14049e822
sub eax, 2
dec r15b
setp r14b
mov rbx, qword [rsp + 0x40]
sal sil, cl
btc r14, 0xcd
shr sil, 0x1d
mov rsi, qword [rsp + 0x48]
bts r15w, r15w
mov rdi, qword [rsp + 0x50]
movsx r14, r13w
setb r15b
movzx r14, bx
mov r14, qword [rsp + 0x58]
add rsp, 0x30
movzx r15w, r14b
bswap r15w
pop r15
jmp 0x14049e867
ret
Function at 0x14049fedf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
cmp spl, bpl
clc
push rdi
push r12
sub dil, dl
cmovno r12w, dx
movsx r12w, r10b
push r14
movsx edi, dx
btr r12, 0xf3
sub si, si
push r15
sub rsp, 0x20
jmp 0x14049ff1e
mov esi, dword [r8 + 0xc]
movsx r15w, r15b
movzx r12w, cl
mov r12, rcx
movzx edi, si
not r15b
mov cx, 0x1d30
mov rcx, r8
movsx r15, ax
mov rdi, r9
mov r14, r8
movzx r15w, cl
mov r15, rdx
call fcn.140211b7c
mov r10, qword [r12]
mov ebp, eax
mov qword [rdi], r10
test esi, esi
jmp 0x14049ff63
je 0x1404a0097
movsxd rax, dword [r14 + 0x10]
lea ecx, [rsi - 1]
btc si, 0xe5
ror rsi, cl
mov esi, ecx
bts bx, r15w
bt ebx, 0x73
and bx, r14w
lea rcx, [rcx + rcx*4]
xor bx, 0x45f4
stc
lea rbx, [rax + rcx*4]
clc
test rsi, 0x284b0021
cmp spl, 0xdb
add rbx, qword [r15 + 8]
clc
cmp spl, 0x47
cmp ebp, dword [rbx + 4]
jle 0x14049ff5c
cmp ebp, dword [rbx + 8]
jmp 0x14049ffbb
jg 0x14049ff5c
mov rcx, qword [r15]
rcl dl, cl
lea rdx, [rsp + 0x50]
cmp ax, r14w
test r11, 0x1939696c
sub r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
xor ecx, ecx
shl r10w, cl
movsxd r10, eax
add r8, qword [rsp + 0x50]
ror r9w, cl
test dh, 0xca
movzx r9, r10w
mov r9d, dword [rbx + 0xc]
movzx r10w, dil
bswap r10d
mov r10d, dword [rax]
jmp 0x1404a0011
test r9d, r9d
jmp 0x1404a0019
je 0x1404a0051
lea rdx, [r8 + 0xc]
sar eax, cl
ror al, 0x12
movsxd rax, dword [rdx]
stc
test r10b, 0x48
cmp rax, r10
je 0x1404a0051
inc ecx
cmp bl, 0xaf
stc
add rdx, 0x14
cmp ecx, r9d
jmp 0x1404a004b
jb 0x1404a0028
cmp ecx, r9d
jmp 0x1404a0059
jae 0x14049ff5c
mov rax, qword [r12]
xor r14b, r14b
or sil, 0xe8
mov r14, rax
lea rcx, [rcx + rcx*4]
shr rsi, 0xb7
rcl r14w, cl
movsxd rcx, dword [r8 + rcx*4 + 0x10]
xchg bpl, bpl
cmovae bx, dx
mov rcx, qword [rcx + rax]
bts ebx, esp
mov qword [rdi], rcx
btc rsi, r15
movzx r15, r13w
mov rbx, qword [rsp + 0x58]
sub al, 0xd
xchg r14d, r14d
mov rax, rdi
rcl r15w, 0xdb
rcr dil, cl
movsxd r14, esp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
sete sil
pop r15
mov si, r10w
movsx r12d, r8w
pop r14
not r12d
pop r12
movsx di, r9b
movzx rsi, r8w
pop rdi
movzx rsi, di
movsx rsi, ax
pop rsi
jmp 0x1404a00e5
ret
Function at 0x1404a133f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmc
mov qword [rsp + 0x10], rsi
mov rsi, 0x6b236476
and si, sp
mov qword [rsp + 0x18], rdi
setle sil
rcl rsi, cl
push r14
sal sil, 0xea
bsf si, r13w
bsr r14, rsp
sub rsp, 0x20
add sil, r15b
cmp byte [rcx + 8], 0
cmovne r14w, bp
mov r14, rdx
movzx esi, r10w
movsx si, cl
movsx rsi, r8w
mov rsi, rcx
jmp 0x1404a1396
je 0x1404a1439
mov rax, qword [rcx]
cmp r10w, sp
test rax, rax
jmp 0x1404a13ab
je 0x1404a1439
or rdi, 0xffffffffffffffff
jmp 0x1404a13ba
inc rdi
cmp byte [rax + rdi], 0
jmp 0x1404a13c6
jne 0x1404a13ba
lea rcx, [rdi + 1]
jmp 0x1404a13d5
call fcn.1401f3ea3
mov rbx, rax
clc
test rax, rax
je 0x1404a1427
mov r8, qword [rsi]
movzx edx, r9w
movzx dx, dil
lea rdx, [rdi + 1]
movzx ecx, r9w
mov rcx, rax
call fcn.1404c74a4
mov rax, rbx
cmovo cx, bx
inc cl
mov byte [r14 + 8], 1
mov qword [r14], rax
btc rcx, 0x6b
bswap cx
sar cl, 0x9a
sub ebx, ebx
movsxd rcx, r14d
bswap rcx
mov rcx, rbx
jmp 0x1404a142f
call fcn.140107928
jmp 0x1404a144e
mov rax, qword [rcx]
mov qword [rdx], rax
mov byte [rdx + 8], 0
xor sil, al
rcl rsi, 0xf3
and r14b, 0x3f
mov rbx, qword [rsp + 0x30]
test r15b, bpl
mov rsi, qword [rsp + 0x38]
rol di, 0x6d
sal dil, cl
mov rdi, qword [rsp + 0x40]
sbb r14w, cx
rcr r14b, 0x5f
shl r14b, cl
add rsp, 0x20
movsx r14, r15w
bswap r14
mov r14d, 0x626e2dd0
pop r14
jmp 0x1404a148a
ret
Function at 0x1404ad15b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
ror bx, cl
xadd bl, bh
mov qword [rsp + 0x20], rsi
test r9d, ebx
sbb ebx, 0x1a8c679e
push rdi
xadd bh, bh
sub rsp, 0x30
cmp eax, r11d
or bx, 0x20dc
adc bx, 0xcea
xor ebp, ebp
mov rbx, rcx
cmp r15b, sil
clc
test r9, 0x770b142c
cmp byte [rcx + 0x54], bpl
jmp 0x1404ad1a7
jne 0x1404ad2d2
cmp dword [rcx + 0x50], ebp
jmp 0x1404ad1b5
jle 0x1404ad2d2
mov rsi, qword [rcx + 0x48]
mov edi, ebp
setnp r8b
mov r9, qword [rbx + 8]
lea rcx, [rsp + 0x40]
movsx rax, dx
cmovno edx, eax
mov word [rsp + 0x40], bp
cwd
bswap eax
mov rdx, rsi
cwde
movsx r8d, cx
setb al
mov rax, qword [r9]
setae r8b
movsxd r8, dword [rax + 8]
jmp 0x1404ad1f9
call fcn.1404ce89b
movsxd r8, eax
test eax, eax
jmp 0x1404ad208
jle 0x1404ad2c4
mov rcx, qword [rbx + 0x468]
movzx edx, word [rsp + 0x40]
mov rax, qword [rcx + 8]
test r8b, r12b
cmp qword [rcx + 0x10], rax
jmp 0x1404ad22a
jne 0x1404ad255
cmp byte [rcx + 0x18], bpl
jmp 0x1404ad239
je 0x1404ad24c
inc dword [rbx + 0x28]
jmp 0x1404ad247
jmp 0x1404ad2a0
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ad2a0
inc dword [rbx + 0x28]
cbw
cmove eax, r10d
inc qword [rcx + 0x10]
add al, bpl
shrd ax, r15w, 0x11
movzx ecx, r11w
mov rax, qword [rbx + 0x468]
stc
shrd cx, r12w, 0xf1
mov rcx, qword [rax]
shr al, 0xaf
or ax, r11w
movzx ax, r12b
mov word [rcx], dx
mov rax, qword [rbx + 0x468]
add qword [rax], 2
cmp rdx, r13
test r15, r9
add rsi, r8
jmp 0x1404ad2a8
inc edi
jmp 0x1404ad2b1
cmp edi, dword [rbx + 0x50]
jmp 0x1404ad2b9
jne 0x1404ad1c5
jmp 0x1404ad31b
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ad2cd
jmp 0x1404ad31b
mov r8d, dword [rbx + 0x50]
shrd r9d, ecx, 0x92
lea rax, [rcx + 0x10]
sub r9, 0x68b07427
sal r9w, 0xb7
ror dh, 0x42
mov rdx, qword [rbx + 0x48]
bt r9w, 0xdf
bt r9, r12
lea r9, [rcx + 0x28]
add rcx, 0x468
jmp 0x1404ad30c
mov qword [rsp + 0x20], rax
jmp 0x1404ad316
call fcn.1404ab61d
mov rbx, qword [rsp + 0x48]
mov al, 1
shr dil, 0x81
rcl dil, 0xbe
mov rbp, qword [rsp + 0x50]
xor si, r11w
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
movzx di, r8b
pop rdi
jmp 0x1404ad347
ret
Function at 0x1404ae09d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword [rcx + 0x460]
mov r10, rcx
rcr bx, 0x3b
movzx ebx, r8w
add rcx, 0x58
mov ebx, r8d
sbb r11w, r14w
movsx r11, bp
bt r11w, 0x85
mov r11d, edx
cmp r11w, sp
test bpl, 5
jmp 0x1404ae0d9
test rax, rax
jmp 0x1404ae0e1
jne 0x1404ae0f1
mov eax, 0x100
jmp 0x1404ae108
mov rcx, rax
sub ax, 0x550d
sal al, cl
mov rax, qword [r10 + 0x458]
shr rax, 2
not r8d
lea rax, [rax - 1]
bswap r8w
movzx r8w, r10b
cmp r14b, 0xf9
lea r8, [rcx + rax*2]
movzx eax, dx
and al, r13b
shld rcx, rax, 0x7d
mov qword [r10 + 0x48], r8
inc ch
movsx eax, r11w
mov rax, r8
bt cx, r8w
mov ecx, dword [r10 + 0x38]
clc
jmp 0x1404ae144
test ecx, ecx
jg 0x1404ae155
test r11d, r11d
je 0x1404ae1f8
xor edx, edx
cmc
lea eax, [rcx - 1]
stc
mov dword [r10 + 0x38], eax
sbb al, 0x74
btr ax, 0x1c
mov eax, r11d
sbb r11b, 0x72
div ebx
sub r11b, 0xe
btc r11w, r9w
movzx r11d, r15w
add dx, 0x30
mov r11d, eax
cmp r8b, dil
cmc
cmp dx, 0x39
jmp 0x1404ae191
jbe 0x1404ae1c1
mov al, r9b
bsf rcx, r12
movsx rcx, r15w
xor al, 1
shrd cx, si, 0x44
adc rcx, r11
shr ch, cl
shl al, 5
add al, 7
add al, dl
movsx dx, ah
xadd edx, edx
ror cl, cl
movsx edx, al
mov rax, qword [r10 + 0x48]
rol cx, cl
sbb cx, 0x26e0
movsx ecx, dl
stc
mov word [rax], cx
movzx eax, ax
movsx ax, r12b
rol eax, cl
add qword [r10 + 0x48], 0xfffffffffffffffe
movsx eax, r9w
movsx rax, r14w
movzx rax, r12w
mov rax, qword [r10 + 0x48]
jmp 0x1404ae13a
mov rbx, qword [rsp + 8]
stc
test rcx, 0x408137e7
sub r8, rax
sar r8, 1
mov dword [r10 + 0x50], r8d
add qword [r10 + 0x48], 2
jmp 0x1404ae219
ret
Function at 0x1404aed4b
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmc
cmp r12b, 0xfa
clc
mov qword [rsp + 0x10], rsi
shr sil, cl
push rdi
ror dil, 0x16
sub rsp, 0x30
sub rdi, 0x32190451
mov edi, edx
not si
mov rsi, rcx
test r8, r8
jmp 0x1404aed7e
jne 0x1404aeda5
call fcn.1404b368d
mov dword [rax], 0x16
jmp 0x1404aed94
call fcn.1404b4310
xor eax, eax
jmp 0x1404aeda0
jmp 0x1404aee92
mov rdx, r9
mov rcx, r8
jmp 0x1404aedb0
call fcn.1404aef03
mov rbx, rax
stc
test al, sil
test rax, rax
jmp 0x1404aedc4
je 0x1404aee2b
lea rax, [rsp + 0x50]
mov rdx, rdi
movzx r9d, r12w
mov r9w, r11w
mov qword [rsp + 0x28], rax
lea r8, [0x140094b24]
cwde
mov eax, dword [rsp + 0x60]
mov r9, rbx
movsx rcx, bp
movzx ecx, bx
mov rcx, rsi
jmp 0x1404aedfd
mov dword [rsp + 0x20], eax
jmp 0x1404aee06
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmc
test rax, rax
jmp 0x1404aee18
jne 0x1404aeeb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404b3703
xor edi, edi
test ebx, 0x74bb14b1
stc
test rbx, rbx
jmp 0x1404aee3c
je 0x1404aee86
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jmp 0x1404aee4e
je 0x1404aee5a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
jmp 0x1404aee6a
test rcx, rcx
jmp 0x1404aee72
je 0x1404aee7e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1404c769d
mov rax, rdi
clc
adc di, 0x2416
rcl dil, cl
mov rbx, qword [rsp + 0x40]
bt edi, esi
add di, r12w
mov rsi, qword [rsp + 0x48]
shr edi, 0x46
shrd di, di, 0x97
add rsp, 0x30
pop rdi
jmp 0x1404aeeb5
ret
mov rcx, qword [rsp + 0x68]
clc
test r13b, r14b
test rcx, rcx
jmp 0x1404aeec7
je 0x1404aeee3
mov eax, dword [rsp + 0x50]
cmp r14w, 0x41fd
jmp 0x1404aeedc
mov dword [rcx], eax
test cx, 0x129d
sub ebx, ebx
jmp 0x1404aeeea
jmp 0x1404aee34

Function at 0x1404af184
Capabilities:
Terminate process

Disassembly:
push rbx
btc ebx, 0x43
and rbx, 0x4c2671ec
bt bx, 0x4f
sub rsp, 0x20
mov ebx, ecx
call fcn.1404d0b85
cmp eax, 1
je 0x1404af1f9
mov rax, qword gs:[0x60]
jmp 0x1404af1bd
mov edx, dword [rax + 0xbc]
test cl, 0xa3
test r12b, bl
shr edx, 8
jmp 0x1404af1d4
test dl, 1
jmp 0x1404af1dc
jne 0x1404af1f9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
cdq
mov edx, ebx
jmp 0x1404af1f3
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404af200
call fcn.1404af0db
mov ecx, ebx
jmp 0x1404af20c
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404c1c34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
stc
mov qword [rax + 0x10], rbp
bsf rbx, r14
mov qword [rax + 0x18], rsi
sub bh, 0xed
movzx ebx, bp
mov qword [rax + 0x20], rdi
push r14
or ebp, 0xffffffff
setl r10b
mov rbx, r8
rol r10b, 0x84
cmp r10b, 0x27
cmp dword [rcx + 0x10], 0
mov r10, rdx
jmp 0x1404c1c72
je 0x1404c1dda
movsxd r9, dword [rcx + 0x10]
or r11b, r8b
adc di, r13w
lea r14, [0x140000000]
mov rdi, qword [rdx + 8]
cmovo cx, bp
and ax, r10w
sub esi, esi
lea r9, [r9 + rdi]
sar ch, 8
sal r11b, cl
jmp 0x1404c1ca7
xor r8d, r8d
mov edx, ebp
bts r11w, r8w
movzx ecx, byte [r9]
or al, 0x64
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
mov r11w, bx
btr r11w, 0x66
mov cl, byte [rcx + r14 + 0xc1a40]
sub r9, rax
xor r11w, 0x508f
mov r11d, dword [r9 - 4]
test dh, 0x62
shr r11d, cl
clc
test r11d, r11d
jmp 0x1404c1cf1
je 0x1404c1dda
mov rax, qword [r10 + 0x10]
adc r10b, dil
bts cx, di
mov r10d, dword [rax]
bt rcx, r14
movzx ecx, byte [r9]
movzx rax, r12w
xadd al, al
stc
and ecx, 0xf
btr rax, 0xe3
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
clc
jmp 0x1404c1d38
sub r9, rax
mov eax, dword [r9 - 4]
shr eax, cl
test spl, 0xa2
cmc
add esi, eax
adc ax, di
rol ah, cl
mov eax, esi
lea rax, [rax + r10]
lea rax, [rax + rdi]
cmp rbx, rax
jmp 0x1404c1d5f
jb 0x1404c1dc0
movzx ecx, byte [r9]
not ah
inc r8d
movsx eax, bx
or dx, 0x6022
sar dl, cl
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
shr dx, cl
bts dx, dx
mov cl, byte [rcx + r14 + 0xc1a40]
mov dh, 0x84
sub r9, rax
mov dl, 0x2a
test bpl, r13b
mov edx, dword [r9 - 4]
cmp bl, 0xa1
cmp r8b, r9b
shr edx, cl
jmp 0x1404c1daf
dec edx
cmc
cmp r8d, r11d
jmp 0x1404c1dba
jb 0x1404c1d09
test r8d, r8d
mov ax, cx
cdqe
cmove edx, ebp
movsxd rax, r14d
cbw
mov al, bpl
mov eax, edx
jmp 0x1404c1ddf
mov eax, ebp
movsxd rbx, esp
mov rbx, qword [rsp + 0x10]
mov bpl, r15b
movzx ebp, ax
mov rbp, qword [rsp + 0x18]
movsx edi, r8w
movzx r14, r15w
xchg r14, rsi
mov rsi, qword [rsp + 0x20]
mov r14b, al
movsx r14d, sp
mov rdi, qword [rsp + 0x28]
mov r14b, sil
movsx r14, r11w
pop r14
ret

Function at 0x1404c8b47
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
setnp dh
movzx r8, r9w
mov rbx, rcx
lea r9, [0x1400c63c0]
cmovbe r8, r8
mov r8b, al
mov ecx, 3
movzx dx, cl
movzx r8d, si
lea r8, [0x1400c63b8]
cmovo dx, r8w
lea rdx, [0x1400cfb70]
jmp 0x1404c8b8a
call fcn.1404c9b82
test rax, rax
jmp 0x1404c8b97
je 0x1404c8bbb
mov rcx, rbx
add rsp, 0x20
movzx bx, spl
jmp 0x1404c8bae
pop rbx
jmp 0x1404c8bb4
jmp qword [0x1400b8d90]
add rsp, 0x20
mov bh, 0x6f
movzx rbx, r9w
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]