joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14049796d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp al, 0x3a
jmp 0x140497988
mov qword [rax + 0x10], rbx
jmp 0x140497994
mov qword [rax + 0x18], rbp
and bpl, 0x7f
bts bp, r13w
mov qword [rax + 0x20], rsi
shrd bp, ax, 0x3a
push rdi
rcl sil, 0xef
push r14
adc sil, 0x4b
rol di, cl
movzx r14w, r8b
push r15
bsr si, di
shld r14w, cx, 0x31
movsx si, r13b
sub rsp, 0x20
shl sil, 0x3a
shr r14b, 0x40
test rdx, rdx
movzx r15d, ax
not bpl
lea r14, [rax + 8]
bswap si
mov rsi, 0x3afa44bf
movsx ebp, r14w
mov rbp, rcx
cmovno si, r8w
mov rdi, rcx
movsxd r15, r13d
movzx ecx, byte [rcx]
mov r15d, r8d
movzx esi, r10w
bswap esi
cmovne r14, rdx
mov r15d, r15d
mov r15, r9
bswap esi
setge sil
mov esi, r8d
jmp 0x140497a28
jmp 0x140497a38
inc rdi
movzx ecx, byte [rdi]
jmp 0x140497a38
call fcn.1404b0e70
test eax, eax
jmp 0x140497a44
jne 0x140497a2d
mov bl, byte [rdi]
lea eax, [rbx - 0x2b]
cmp r10b, 0xb6
cmc
test al, 0xfd
jmp 0x140497a5b
je 0x140497a6d
mov bl, 0x2b
jmp 0x140497a68
jmp 0x140497a76
inc rdi
cqo
movsx rcx, di
mov r9, r15
movsx rcx, r15w
cmove r8d, ebx
mov r8d, esi
cqo
movsx cx, r9b
mov rdx, r14
mov cl, 0x93
mov cl, r11b
mov rcx, rdi
jmp 0x140497a9b
call fcn.140497bc9
mov ecx, eax
mov esi, 0x7fffffff
cmp bpl, spl
test r9b, r12b
jmp 0x140497ab2
cmp rdi, qword [r14]
jne 0x140497ac3
mov qword [r14], rbp
jmp 0x140497acc
cmp rbp, qword [r14]
jne 0x140497ad4
test ecx, ecx
jne 0x140497b09
cmp bl, 0x2b
jne 0x140497aea
cmp ecx, esi
jmp 0x140497ae4
ja 0x140497b09
cmp bl, 0x2d
jmp 0x140497af2
jne 0x140497b5a
cmp ecx, 0x80000000
jmp 0x140497b03
jbe 0x140497b5a
call fcn.1404ae2e2
mov dword [rax], 0x22
cmc
cmp spl, bpl
jmp 0x140497b1d
test r15, r15
jmp 0x140497b25
je 0x140497b3a
mov dword [r15], 1
test r14b, cl
inc eax
or ah, 0x67
mov eax, 0x80000000
cmp bl, 0x2d
jmp 0x140497b47
cmove esi, eax
movzx eax, r11w
mov eax, esi
jmp 0x140497b55
jmp 0x140497b85
neg eax
cmp bl, 0x2d
movsx esi, di
movzx r15, ax
mov si, 0x5a45
cmove ecx, eax
ror dil, cl
shr al, cl
sal r15w, 0x13
mov eax, ecx
movsx r15w, r14b
sbb r15d, 0x3d214a6
mov rbx, qword [rsp + 0x48]
btc r14d, edx
mov rbp, qword [rsp + 0x50]
cmp rbx, 0x19910d39
shr r15b, cl
xor edi, r11d
mov rsi, qword [rsp + 0x58]
shr r15d, cl
add rsp, 0x20
movsxd rdi, r13d
mov r14b, 0xc
pop r15
movzx r14w, al
pop r14
not dil
movsx rdi, di
pop rdi
jmp 0x140497bc8
ret
Function at 0x140497ff5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test r13d, r15d
stc
cmc
mov qword [rsp + 0x18], rbp
push rsi
movsxd rsi, r8d
bsf si, dx
push rdi
movsx ebp, r10w
xadd di, di
push r12
movsxd rsi, esp
push r14
add rdi, 0x44c46a9c
sar r14b, 0x5a
cmp r10b, 0x74
push r15
xor bp, r10w
add di, r13w
sub rsp, 0x20
shrd ebp, edi, 0x2f
sub ebp, ebx
btr esi, 0x42
test rdx, rdx
xchg si, r15w
lea r14, [rsp + 0x50]
mov rsi, rcx
movsx edi, r14w
mov rdi, rcx
movzx ecx, byte [rcx]
movzx ebp, bp
cmovne r14, rdx
mov r15, r9
bswap bp
mov ebp, r8d
jmp 0x14049807f
inc rdi
mov ch, 0x1f
movzx ecx, byte [rdi]
jmp 0x14049807f
call fcn.1404b0e70
test eax, eax
jmp 0x14049808b
jne 0x140498071
mov bl, byte [rdi]
shr ax, cl
sar ah, 0xc9
and al, r8b
lea eax, [rbx - 0x2b]
clc
cmp al, r13b
test al, 0xfd
jmp 0x1404980aa
je 0x1404980b7
mov bl, 0x2b
jmp 0x1404980bf
inc rdi
cqo
not r8d
mov r9, r15
cmovne rdx, r9
mov r8d, ebp
setle ch
mov ecx, eax
mov rdx, r14
movsx ecx, sp
not rcx
movsxd rcx, ebx
mov rcx, rdi
jmp 0x1404980e2
call fcn.140498213
mov rcx, rax
shl bpl, cl
mov bpl, 0x2d
movabs r12, 0x8000000000000000
cmc
stc
cmp rdi, qword [r14]
jne 0x14049810d
mov qword [r14], rsi
jmp 0x140498116
cmp rsi, qword [r14]
jne 0x140498124
test rcx, rcx
jmp 0x14049811e
jne 0x140498167
cmp bl, 0x2b
jmp 0x14049812c
jne 0x14049814b
movabs rax, 0x7fffffffffffffff
test rax, 0x18aa22d5
cmp rcx, rax
ja 0x140498167
cmp bl, bpl
jmp 0x140498153
jne 0x1404981ab
cmp rcx, r12
jmp 0x140498161
jbe 0x1404981ab
call fcn.1404ae2e2
mov dword [rax], 0x22
test r15, r15
jmp 0x14049817a
je 0x14049818d
mov dword [r15], 1
cmp r10w, 0x7e92
sub bl, bpl
cmp dl, 0x8b
neg bl
jmp 0x14049819a
sbb rax, rax
clc
add rax, r12
jmp 0x1404981a6
jmp 0x1404981db
mov rax, rcx
neg rax
shrd r12w, bx, 0x34
sbb r12b, 2
stc
cmp bl, bpl
movzx ebp, r11w
mov r14b, spl
cmove rcx, rax
btr rsi, rdi
mov rax, rcx
cmp dx, 0x3512
jmp 0x1404981db
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add edi, 0x3b693ce2
movsx r15, r9w
add rsp, 0x20
movsxd r15, r8d
pop r15
pop r14
movzx esi, ax
bswap rsi
pop r12
movzx esi, r14w
pop rdi
xchg si, si
movsx esi, r8w
movsxd rsi, ebp
pop rsi
ret

Function at 0x1404991e1
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
clc
cmp bpl, 0x46
and dword [rsp + 0x30], 0
call fcn.1404a367c
mov r9d, 2
movzx edx, bp
lea r8, [rsp + 0x30]
cdq
movzx cx, r11b
cwd
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x140499217
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
jmp 0x14049922a
je 0x140499271
sub ecx, 1
jmp 0x140499238
je 0x140499262
cmp ecx, 1
je 0x140499253
sub eax, eax
jmp 0x14049924e
jmp 0x14049927e
mov eax, 3
jmp 0x14049925d
jmp 0x14049927e
mov eax, 1
jmp 0x14049926c
jmp 0x14049927e
mov eax, 2
test r9w, sp
cmp sil, 0x9b
add rsp, 0x28
ret
Function at 0x14049fd68
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
sal r10w, 0xe8
sar r10b, 0x65
xor r10b, dl
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
sbb bh, 0x57
mov qword [rax + 0x18], rsi
movzx rsi, si
ror r10w, cl
movsxd r10, r8d
mov qword [rax + 0x20], rdi
seto bl
rcl r10b, cl
mov bh, ah
push r14
sbb r10, 0x172c54d1
push r15
test ecx, 0xa791f2f
bt bx, 0x66
shld r10w, r10w, 0x67
movzx esi, word [rsp + 0x38]
ror r10b, cl
mov r10, r8
adc r8w, 0x5105
xor r15d, r15d
movsxd r8, edx
shr bh, cl
adc bx, 0x2968
mov ebx, ecx
sal ecx, cl
mov ecx, r8d
test si, si
jne 0x14049ff50
mov rax, qword [r9]
mov r11, qword [r10]
cmc
cmp bh, 0xa7
cmp rax, 1
jmp 0x14049fdfa
jbe 0x14049fef3
mov eax, 0x66666667
mov r8, r11
imul ebx
sar edx, 2
mov eax, edx
sar ch, cl
shr eax, 0x1f
add edx, eax
movzx rcx, r10w
btr eax, 0xe1
add ecx, 0x22a8575b
movzx eax, dx
shr rcx, 0x53
cmovno cx, cx
shl ax, 2
rol rcx, cl
shl cl, cl
btr rcx, r15
lea ecx, [rax + rdx]
sar ax, 0x3e
bt eax, esi
add cx, cx
or ax, 0x85d
cmovle ax, si
sub bx, cx
movsx ax, ch
mov eax, r13d
bsr eax, r11d
add bx, 0x30
sar al, cl
mov word [r11], bx
stc
add r11, 2
mov rax, qword [r9]
movsx rbx, cx
mov ebx, edx
dec rax
cmp r10b, spl
test bpl, 0xc5
mov qword [r9], rax
test edx, edx
jmp 0x14049fe8b
jle 0x14049fea0
cmp rax, 1
jmp 0x14049fe9a
ja 0x14049fe00
mov rdx, qword [r10]
jmp 0x14049fea8
mov qword [r10], r11
jmp 0x14049feb0
jmp 0x14049fee5
movzx eax, word [rdx]
add cl, 0x44
sal ecx, 0xe6
bt cx, r13w
movzx ecx, word [r8]
cmp sil, 0x12
mov word [r8], ax
sub r8, 2
mov word [rdx], cx
cmp spl, 0x69
clc
add rdx, 2
test r8w, 0x4bcb
cmp rdx, r8
jb 0x14049feb5
jmp 0x14049ff0a
add rax, rax
sub r11, rax
jmp 0x14049ff01
mov qword [r10], r11
xchg bl, dil
mov qword [r9], r15
mov rbx, qword [rsp + 0x18]
movzx ebp, cx
not r15b
cmovge r15d, edx
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
xchg r15b, dil
movsx r15d, r13w
cmovp r15, r15
mov rdi, qword [rsp + 0x30]
not r14b
mov r15b, 0x88
pop r15
jmp 0x14049ff48
pop r14
jmp 0x14049ff4f
ret
cmp r8, qword [r9]
jae 0x14049ff07
dec r8d
sbb r11w, 0x630b
stc
movzx r11, r12w
mov r11d, r15d
test rbx, 0x69297dbe
jmp 0x14049ff77
test ecx, ecx
jmp 0x14049ff7e
je 0x1404a003f
movsxd rax, r8d
lea rdi, [rax + rax]
bts dx, r15w
mov r14, qword [r10]
mov eax, 0x66666667
imul ebx
stc
mov ebp, r8d
test al, 0x45
and eax, r13d
movzx rax, bx
sar edx, 2
mov eax, edx
cmp dil, 0x8c
shr eax, 0x1f
add edx, eax
test ebx, ebx
jmp 0x14049ffbc
je 0x1404a0002
movzx eax, dx
cmove ecx, ebp
shl ax, 2
movzx cx, bpl
shr rcx, 0x90
bsr rcx, rsi
lea ecx, [rax + rdx]
shld rax, rdx, 0x7d
btc ax, r8w
movzx ax, bpl
add cx, cx
rcr ah, 0x62
cmc
sub bx, cx
lea eax, [rbx + 0x30]
jmp 0x14049fffd
jmp 0x1404a000e
movzx eax, si
movzx bx, r14b
movsx ebx, r10w
mov word [rdi + r14], ax
movsx bx, dil
inc r11d
movsx rbx, r14w
sub rdi, 2
xchg ebx, ebx
dec r8d
btc rbx, r12
mov ebx, edx
test r8w, sp
test ebp, ebp
jmp 0x1404a0039
jne 0x14049ff90
movsxd rcx, r11d
lea rax, [rcx + rcx]
test sil, r14b
cmp r15w, 0x68a0
cmp dl, r15b
add qword [r10], rax
jmp 0x1404a005b
sub qword [r9], rcx
jmp 0x1404a0063
jmp 0x14049ff0a
Function at 0x1404a99f6
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmc
mov qword [rsp + 0x10], rsi
test ax, sp
push rdi
setl dil
sub di, 0x146a
sub rsp, 0x30
movzx edi, bx
btr di, di
sub sil, r15b
mov edi, edx
mov rsi, rcx
test r8, r8
jne 0x1404a9a46
call fcn.1404ae2e2
mov dword [rax], 0x16
jmp 0x1404a9a3a
call fcn.1404aef46
xor eax, eax
jmp 0x1404a9b44
mov rdx, r9
movzx rcx, r14w
bswap ecx
mov rcx, r8
call fcn.1404a9b9f
mov rbx, rax
cmp r11w, 0x1ed3
test rax, rax
jmp 0x1404a9a68
je 0x1404a9aee
lea rax, [rsp + 0x50]
movsx r9w, sil
not edx
mov rdx, rdi
movzx r8, cx
mov r9b, 0x61
movsx r9, ax
mov qword [rsp + 0x28], rax
movsx rax, r14w
lea r8, [0x140094b24]
xchg al, al
mov ch, 0xb9
mov eax, dword [rsp + 0x60]
setns r9b
mov r9, rbx
movzx cx, ah
mov rcx, rsi
jmp 0x1404a9ab4
mov dword [rsp + 0x20], eax
jmp 0x1404a9abd
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
stc
cmp rdi, 0x49b019ec
test rax, rax
jmp 0x1404a9ad6
jne 0x1404a9b5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404a9ae9
call fcn.1404ae349
xor edi, edi
cmc
jmp 0x1404a9afa
test rbx, rbx
jmp 0x1404a9b02
je 0x1404a9b40
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1404a9b1b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404a9b27
je 0x1404a9b33
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404a9b3b
call fcn.1404c222f
mov rax, rdi
cmc
mov rbx, qword [rsp + 0x40]
movsx esi, r15w
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
movzx di, r8b
pop rdi
ret
mov rcx, qword [rsp + 0x68]
test edi, 0x66336c3e
jmp 0x1404a9b6d
test rcx, rcx
jmp 0x1404a9b75
je 0x1404a9b84
mov eax, dword [rsp + 0x50]
cmp rcx, rbx
mov dword [rcx], eax
sub ebx, ebx
jmp 0x1404a9b8b
jmp 0x1404a9afa

Function at 0x1404a9e26
Capabilities:
Terminate process

Disassembly:
push rbx
xor rbx, 0x59eb6203
cmovle bx, di
neg ebx
sub rsp, 0x20
cmova bx, cx
mov ebx, ecx
jmp 0x1404a9e44
call fcn.1404cb9e1
cmp eax, 1
jmp 0x1404a9e51
je 0x1404a9e97
mov rax, qword gs:[0x60]
dec dx
sal dx, 0x64
movzx edx, ax
mov edx, dword [rax + 0xbc]
clc
shr edx, 8
test dh, bh
cmp r10w, cx
cmc
test dl, 1
jne 0x1404a9e97
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
cwd
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404a9e9e
call fcn.1404a9d6c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404bc96b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
xchg al, al
mov qword [r11 + 0x18], rbx
neg eax
movzx eax, ax
shr ax, cl
mov qword [r11 + 0x20], r9
sal bh, cl
ror ax, 0x61
ror ax, cl
mov dword [rsp + 0x10], edx
mov ax, 0x1e31
sbb bh, 0xa9
push rbp
push rsi
adc ax, di
rcl eax, cl
rol sil, cl
push rdi
shl ax, cl
cwde
movzx rax, r13w
push r12
btr rax, r9
lahf
push r13
rcr bh, cl
bsr rbx, rbp
push r14
bts r12w, bx
push r15
shr bx, 0x54
sub rsp, 0x20
movsxd rsi, r14d
bts r12, rsi
movsx si, bl
mov rax, qword [rcx + 8]
xor r12b, 0xb4
xor bpl, bpl
sbb r15d, edi
shrd r12w, r15w, 0xdb
cmp r10b, r9b
sub r14b, r14b
clc
rcr bh, cl
bt r15w, 0x7e
mov qword [r11 + 8], rax
xor edi, edi
movzx ebx, r14w
btr rbx, rdi
rol r12w, 0xf3
mov r12, r9
mov r13d, r8d
mov rbx, rcx
btc esi, 0x1c
bsr r15, rbx
lea rsi, [rax - 1]
mov r15, rsi
stc
cmp dword [rcx], edi
jmp 0x1404bca28
jle 0x1404bcac1
mov r12d, dword [r11 + 0x10]
cmc
test r8b, 0xa1
test bx, cx
cmp edi, r12d
jmp 0x1404bca42
jne 0x1404bca55
mov rsi, rax
rol bpl, cl
shl bpl, 0xdd
mov bpl, 1
cmp edi, r13d
jne 0x1404bca73
mov r15, rax
shr r14b, 0x91
test di, bx
mov r14b, 1
clc
test r8, 0x2962613
test bpl, bpl
je 0x1404bca8a
test r14b, r14b
jmp 0x1404bca84
jne 0x1404bcab2
lea rdx, [rsp + 0x60]
mov rcx, rbx
jmp 0x1404bca97
call fcn.1401209e3
inc edi
clc
stc
cmp edi, dword [rbx]
jge 0x1404bcab2
mov rax, qword [rsp + 0x60]
jmp 0x1404bca3a
mov r12, qword [rsp + 0x78]
bt ecx, 0xe4
shld rdi, rdi, 0x2c
cwde
mov rax, qword [r12]
mov qword [r12 + 8], rsi
shr r12w, cl
ror r14w, cl
movups xmm0, xmmword [rbx]
test r11b, 0xf5
clc
sal r12, 0x26
movups xmmword [rax], xmm0
movsxd rdi, esp
dec r12w
movups xmm1, xmmword [rbx + 0x10]
rcr r14w, cl
movups xmmword [rax + 0x10], xmm1
rol rsi, 0x8c
neg si
mov rax, qword [rsp + 0x80]
movzx rcx, r13w
bt cx, 0x54
mov rcx, qword [rax]
sar ebp, 0xf7
btr r12d, 0x79
bsf ebp, ebx
mov qword [rax + 8], r15
rcr r13b, 0x81
ror rsi, cl
stc
movups xmm0, xmmword [rbx]
shr r12b, cl
movups xmmword [rcx], xmm0
sub r13w, 0x6284
movups xmm1, xmmword [rbx + 0x10]
sar dil, 0x7d
rcr r15b, cl
btc r14, 0xe3
mov rbx, qword [rsp + 0x70]
cmp ch, 0xb2
adc r14b, sil
movups xmmword [rcx + 0x10], xmm1
rol r14b, 0x3a
add rsp, 0x20
movsx esi, r14w
not di
pop r15
pop r14
mov di, 0x29d2
movsxd rdi, esp
pop r13
pop r12
mov dil, spl
movzx esi, bx
pop rdi
not rsi
pop rsi
movzx rbp, ax
pop rbp
jmp 0x1404bcb87
ret

Function at 0x1404c3823
Capabilities:
Get thread local storage value

Disassembly:
push rbx
bt edx, 0x7f
shr dh, 0x10
adc dx, 0x1796
sub rsp, 0x20
mov bl, sil
cwd
movzx rdx, sp
mov ebx, ecx
xchg r9b, dl
mov r9, r10
bswap dx
lea r9, [0x1400c63d0]
mov ecx, 5
cwd
lea r8, [0x1400c63c8]
lea rdx, [0x1400cf758]
jmp 0x1404c386a
call fcn.1404c47a8
mov ecx, ebx
test rax, rax
je 0x1404c3893
add rsp, 0x20
jmp 0x1404c388b
pop rbx
jmp qword [case.0x140441720.0]
add rsp, 0x20
pop rbx
jmp 0x1404c389d
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1404c38a4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
xor r9d, r9d
push rdi
neg edi
ror dil, 0x2e
bsf edi, r12d
sub rsp, 0x20
mov rbx, rdx
movsx r8w, spl
cdq
movsx edi, r11w
lea r9, [0x1400c63d8]
bswap dx
movzx r8, dx
mov edi, ecx
movsxd rdx, edi
cwd
lea rdx, [0x1400cf748]
mov cx, 0x577c
movsx ecx, si
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404c38fc
call fcn.1404c47a8
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1404c391a
call qword [case.0x140441720.0]
jmp 0x1404c3920
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
cmova di, r11w
add rsp, 0x20
movzx edi, r8w
pop rdi
jmp 0x1404c3938
ret

Function at 0x1404c3ab2
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
movzx rbx, ax
clc
btc bx, 0xf2
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
sal bp, 0x30
sar esi, 0x5d
push rdi
rcl sil, cl
sbb esi, eax
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
cmovg si, sp
mov esi, edx
movzx r9d, si
movsx edx, r13w
lea r9, [0x1400c63e8]
movzx r8w, spl
movzx rdx, r9w
mov rbp, rcx
cdq
movsx cx, r12b
lea r8, [0x1400c63e0]
movzx rcx, bp
mov cx, 0x853
lea rdx, [0x1400cf190]
mov ecx, 0xb
jmp 0x1404c3b29
call fcn.1404c47a8
mov rcx, rbp
test ax, 0x2cd7
cmc
test rax, rax
jmp 0x1404c3b3e
je 0x1404c3b60
mov r9d, ebx
mov r8, rdi
movsx dx, bl
mov edx, esi
jmp 0x1404c3b55
call qword [case.0x140441720.0]
jmp 0x1404c3b8e
xor edx, edx
jmp 0x1404c3b67
call fcn.1404c4241
mov ecx, eax
mov r9d, ebx
cdq
mov r8, rdi
jmp 0x1404c3b81
mov edx, esi
jmp 0x1404c3b88
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
bt rbp, r9
sar rsi, 0xf9
inc bpl
mov rbp, qword [rsp + 0x48]
movsx esi, ax
rcl sil, 0xdf
dec rdi
mov rsi, qword [rsp + 0x50]
neg rdi
xchg dil, dil
add rsp, 0x30
bswap rdi
pop rdi
ret
Function at 0x1404ce589
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
clc
shl ebx, cl
push rdi
sub rsp, 0x20
cmovno rbx, rdi
mov dx, 0x63f2
bts rbx, rsp
mov rdx, qword [rcx]
or r8, 0xffffffffffffffff
mov rbx, rcx
xor cx, 0x6a22
cmp ah, 0x7f
xor edi, edi
movzx ecx, r11w
movzx cx, spl
mov rcx, r8
inc rcx
cmc
test r12w, 0x24f1
cmp word [rdx + rcx*2], di
jne 0x1404ce5c2
mov eax, edi
test al, 0
adc al, 0x94
cmp rcx, 3
jmp 0x1404ce5e5
sete al
mov dword [rbx + 0x18], eax
cdqe
jmp 0x1404ce5f5
mov rax, qword [rbx + 8]
jmp 0x1404ce5fe
inc r8
cmp edx, r10d
cmp word [rax + r8*2], di
jne 0x1404ce5fe
cmp r8, 3
movsxd rax, edx
cdqe
mov eax, edi
sete al
test r9w, r15w
mov dword [rbx + 0x1c], eax
test al, r11b
cmp rcx, 3
jmp 0x1404ce630
jne 0x1404ce645
mov ecx, 2
jmp 0x1404ce640
jmp 0x1404ce6c5
mov r9d, edi
cmc
test rdx, rdx
jmp 0x1404ce651
jne 0x1404ce663
mov ecx, edi
jmp 0x1404ce65e
jmp 0x1404ce6c5
mov ecx, 2
sbb r8w, cx
cbw
movzx r8d, word [rdx]
shr rax, 0x9f
add rdx, rcx
lea eax, [r8 - 0x41]
stc
test al, dil
cmp ax, 0x19
jmp 0x1404ce68a
jbe 0x1404ce6a9
sub r8w, 0x61
test r10b, bl
stc
cmp r8w, 0x19
jmp 0x1404ce6a3
ja 0x1404ce6b6
inc r9d
jmp 0x1404ce6b1
jmp 0x1404ce66e
mov ecx, r9d
bsf dx, sp
test sp, 0x38ac
ror dx, cl
sub r9d, r9d
test r9b, spl
mov dword [rbx + 0x14], ecx
sub r8d, r8d
lea rcx, [0x1400ab3bc]
setae dh
lea edx, [r9 + 3]
jmp 0x1404ce6e4
call fcn.1404c35de
mov ecx, dword [rbx + 0x10]
test cl, 7
xchg dl, al
setne dl
bt ecx, 9
jmp 0x1404ce6fd
setb al
cmp bh, 0x10
and dl, al
not al
bt ecx, 8
mov al, 0xef
setb al
cmp bl, sil
test al, dl
jmp 0x1404ce71a
jne 0x1404ce723
mov dword [rbx + 0x10], edi
mov rbx, qword [rsp + 0x30]
xor dil, 0xa0
add rsp, 0x20
movzx rdi, bx
not di
mov di, 0x9f
pop rdi
jmp 0x1404ce741
ret
Function at 0x1404cf9a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
or bl, dil
push rdi
sub bh, 3
adc rbx, 0x341d44c5
sub rsp, 0x20
movsxd rbx, edx
mov ebx, edi
mov rbx, rcx
jmp 0x1404cf9cd
call fcn.1404c2576
or r8, 0xffffffffffffffff
mov r9, r8
add rdx, 0xd59300a
movzx rdx, bp
sub edi, edi
movsx rdx, bp
movsx dx, sil
cdq
lea rdx, [rax + 0x98]
movsx eax, si
mov ax, r11w
movzx ax, bpl
mov rax, qword [rdx]
jmp 0x1404cfa0b
inc r9
cmp word [rax + r9*2], di
jmp 0x1404cfa18
jne 0x1404cfa0b
mov eax, edi
or al, 0xe6
sal al, 0x44
cmc
cmp r9, 3
sete al
mov dword [rdx + 0x18], eax
jmp 0x1404cfa35
mov rax, qword [rdx + 8]
jmp 0x1404cfa3e
inc r8
cmc
cmp r12d, edi
cmp r8b, 0x3f
cmp word [rax + r8*2], di
jmp 0x1404cfa53
jne 0x1404cfa3e
cmp r8, 3
lahf
mov eax, edi
mov r8w, 0x1f1d
jmp 0x1404cfa6a
mov r8d, 2
mov al, r10b
xchg al, al
sete al
mov dword [rdx + 0x1c], eax
test si, di
cmp r10b, 0x11
test ebp, 0x135d579e
mov dword [rbx + 4], edi
test r9, 0x2a52743a
stc
cmp dword [rdx + 0x18], edi
jmp 0x1404cfa9b
jne 0x1404cfb0c
mov rcx, qword [rdx]
shr r9w, 6
shl r10b, cl
mov r10d, edi
setp r9b
movzx r9d, word [rcx]
test r8d, 0xd9e369a
xor ax, cx
setp al
lea rcx, [rcx + r8]
xchg ah, al
bsr eax, edx
bt eax, r12d
lea eax, [r9 - 0x41]
jmp 0x1404cfadc
cmp ax, 0x19
jmp 0x1404cfae5
jbe 0x1404cfb01
sub r9w, 0x61
cmc
cmp r9w, 0x19
jmp 0x1404cfafb
ja 0x1404cfb09
inc r10d
jmp 0x1404cfab3
mov r8d, r10d
mov dword [rdx + 0x14], r8d
mov cx, 0x4ad
lea rcx, [0x1400abdd4]
movsx rdx, sp
setl dl
cdq
mov edx, 1
jmp 0x1404cfb2d
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov ecx, dword [rbx]
shr al, 0xbb
dec dl
rcl dl, cl
test cl, 7
setne dl
bt ecx, 9
mov al, 0x97
setb al
stc
jmp 0x1404cfb51
and dl, al
clc
bt ecx, 8
mov al, dl
setb al
test al, dl
jmp 0x1404cfb64
jne 0x1404cfb70
mov dword [rbx], edi
rcr rdi, 0xf5
mov rbx, qword [rsp + 0x30]
shld rdi, r8, 0x44
bt di, 0x96
not dil
add rsp, 0x20
movzx edi, r12w
not dil
setns dil
pop rdi
ret
Function at 0x1404d05c2
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
sub bh, 0x74
bt rbx, 0x19
shl rbx, 0x98
mov qword [rsp + 0x18], rsi
rol bh, 0x1c
ror bx, cl
sar bl, cl
push rdi
rcr rdi, 0xc2
sub rsp, 0x20
rcl rbx, cl
xor esi, esi
sbb dil, r10b
sar bx, cl
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jmp 0x1404d0602
je 0x1404d068d
cmp word [rcx], si
je 0x1404d068d
lea rdx, [0x1400d1d08]
jmp 0x1404d061d
call fcn.140232b70
test eax, eax
je 0x1404d068d
lea rdx, [0x1400d1d00]
movzx ecx, r8w
mov rcx, rbx
call fcn.140232b70
test eax, eax
jmp 0x1404d0644
jne 0x1404d0680
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
movzx rdx, bp
mov edx, 0x2000000b
jmp 0x1404d0664
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d0671
je 0x1404d06d3
mov eax, dword [rsp + 0x30]
jmp 0x1404d06f6
mov rcx, rbx
call fcn.1404d972f
jmp 0x1404d06f6
mov ecx, dword [rdi + 8]
cwd
jmp 0x1404d069b
lea r8, [rsp + 0x30]
mov r9w, r12w
movsx r9, bx
mov dl, 0xe3
mov r9d, 2
movsx rdx, dx
cqo
cmovle dx, r11w
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d06cd
jne 0x1404d06df
xor eax, eax
jmp 0x1404d06da
jmp 0x1404d06f6
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x1404d06ea
jne 0x1404d06f6
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
shrd edi, r14d, 0x73
rcl rsi, cl
rol dil, cl
mov rsi, qword [rsp + 0x40]
xor dil, sil
add rsp, 0x20
movzx edi, bx
pop rdi
ret

Function at 0x1404d0717
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
rol bh, 0xb0
mov qword [rsp + 0x18], rsi
neg esi
push rdi
xor sil, 0x14
sbb rsi, r10
sub rsp, 0x20
mov esi, edx
movsx bx, bpl
cmovg rbx, r14
setl bh
mov ebx, ecx
jmp 0x1404d0747
call fcn.1404c2576
mov ecx, ebx
lea r8, [rsp + 0x30]
movzx rdi, ax
and ecx, 0x3ff
setns r9b
xchg rdi, rdx
mov r9d, 2
btr rdx, 0x69
setle dil
movsx rdx, r9w
bts ecx, 0xa
mov edx, 0x20000001
not dil
movsx edi, ax
movzx rdi, dx
mov rdi, rax
jmp 0x1404d0792
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
stc
test eax, eax
je 0x1404d0851
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d07ad
je 0x1404d0847
test esi, esi
jmp 0x1404d07ba
je 0x1404d0847
mov r9, qword [rdi + 0x98]
shrd dx, bx, 0x42
mov r8d, r10d
sar cl, 0xc2
movzx edx, word [r9]
lea rcx, [r9 + 2]
shl al, cl
bsr ax, di
btr eax, r12d
lea eax, [rdx - 0x41]
test dil, 0x82
cmp ah, 0xf8
cmp ax, 0x19
jmp 0x1404d07f7
jbe 0x1404d080b
sub dx, 0x61
cmp dx, 0x19
ja 0x1404d0822
movzx edx, word [rcx]
jmp 0x1404d0813
inc r8d
test r8b, al
add rcx, 2
jmp 0x1404d07e4
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d0833
jne 0x1404d0826
cmp r8d, ecx
jmp 0x1404d0841
je 0x1404d0851
mov eax, 1
jmp 0x1404d0859
sub eax, eax
shr rdi, cl
rol edi, 0x97
mov rbx, qword [rsp + 0x38]
movzx si, bpl
mov rsi, qword [rsp + 0x40]
rcr dil, cl
shr di, cl
add rsp, 0x20
movsxd rdi, ebx
sete dil
pop rdi
jmp 0x1404d087f
ret
Function at 0x1404d1f37
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test al, ah
clc
mov qword [rax + 8], rbx
cmp rsi, rbx
clc
mov qword [rax + 0x10], rbp
test rcx, 0x7adc3c29
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmc
cmp r9w, 0x448
stc
push r14
cmc
sub rsp, 0x40
jmp 0x1404d1f6c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
mov rbx, rax
test rax, rax
je 0x1404d20f9
mov rsi, rax
stc
cmp word [rax], r14w
jmp 0x1404d1f8e
je 0x1404d1fd8
or rax, 0xffffffffffffffff
jmp 0x1404d1f9d
inc rax
test r12, r11
test r8, 0x4a3257ad
cmp word [rsi + rax*2], r14w
jmp 0x1404d1fb4
jne 0x1404d1f9d
lea rsi, [rsi + rax*2]
add rsi, 2
test r13b, 0x77
test bl, r13b
cmp word [rsi], r14w
jmp 0x1404d1fd2
jne 0x1404d1f94
mov qword [rsp + 0x38], r14
sub rsi, rbx
sub r8b, 0x7c
shl r8b, 0x64
sal r8d, 0x11
mov qword [rsp + 0x30], r14
movsx r8, r12w
shl r8d, cl
add rsi, 2
shld r9d, esp, 0xf
bsf r9w, bx
sbb r8, r13
sar rsi, 1
shr r8b, 0xea
movzx r8w, r13b
sub r9, 0x7b9d36f7
mov r8, rbx
mov r9d, esi
jmp 0x1404d202b
mov dword [rsp + 0x28], r14d
test r8, r11
sub edx, edx
mov qword [rsp + 0x20], r14
sub ecx, ecx
call fcn.1404c235c
movsxd rbp, eax
jmp 0x1404d204a
test eax, eax
jmp 0x1404d2051
je 0x1404d20f9
mov rcx, rbp
jmp 0x1404d205f
call fcn.1404c22ba
mov rdi, rax
clc
test rax, rax
jmp 0x1404d2070
je 0x1404d20db
mov qword [rsp + 0x38], r14
dec r8w
mov r9d, esi
dec r8w
btc r8w, r14w
mov qword [rsp + 0x30], r14
neg r8w
mov r8, rbx
clc
mov dword [rsp + 0x28], ebp
cmp cl, 0x52
xor edx, edx
sub ecx, ecx
jmp 0x1404d20a8
mov qword [rsp + 0x20], rax
call fcn.1404c235c
test eax, eax
jmp 0x1404d20b9
je 0x1404d20db
mov rsi, rdi
cmovae rdi, r11
movzx di, dil
not dil
mov rdi, r14
jmp 0x1404d20d6
jmp 0x1404d20e7
mov rsi, r14
cmova ecx, r13d
movzx cx, bpl
mov rcx, rdi
jmp 0x1404d20ef
call fcn.1404c222f
jmp 0x1404d2103
mov rsi, r14
cmp bl, 0x9a
test sp, r13w
test rbx, rbx
jmp 0x1404d210b
je 0x1404d211f
mov rcx, rbx
jmp 0x1404d2119
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
test cl, 0x3e
btr r14w, 0xa5
cmp bl, bpl
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rdi, r14
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
movsx r14, r10w
pop r14
ret