joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a328b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
not r10w
mov qword [rax + 8], rbx
cmc
mov qword [rax + 0x10], rbp
dec r10
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
rol r10w, 0xf8
bswap si
dec bl
push r14
sal sil, 0x1f
push r15
rol r10b, cl
movsx bx, r13b
bsr r10, r15
movzx esi, word [rsp + 0x38]
mov r10, r8
sub r15d, r15d
movsxd r8, edx
bt ebx, 0x66
xor bl, r13b
bts rbx, rsi
mov ebx, ecx
xadd rcx, rcx
mov ecx, r8d
test si, si
jne 0x1404a3473
mov rax, qword [r9]
btr r11w, 0x10
jmp 0x1404a32fd
mov r11, qword [r10]
test dil, r14b
cmp rax, 1
jbe 0x1404a3405
mov eax, 0x66666667
mov r8, r11
and rcx, 0x136b6b7a
bswap ecx
inc dl
imul ebx
shld eax, r10d, 0x15
sar edx, 2
mov eax, edx
shl ch, 0x79
movsxd rcx, edx
stc
shr eax, 0x1f
add edx, eax
test r13b, 0xab
btr eax, 0xae
stc
movzx eax, dx
shl ax, 2
test ecx, 0x866058
lea ecx, [rax + rdx]
bt rax, rsp
add cx, cx
sub bx, cx
add bx, 0x30
mov word [r11], bx
shr rbx, 0xec
rcr ebx, cl
add r11, 2
movsxd rbx, r15d
inc bh
mov rax, qword [r9]
mov rbx, r10
mov ebx, edx
jmp 0x1404a337f
dec rax
cmp r8w, 0x169
cmc
jmp 0x1404a338e
mov qword [r9], rax
cmp r12, 0x3aad660e
cmc
test r11b, r11b
test edx, edx
jmp 0x1404a33a3
jle 0x1404a33b3
cmp rax, 1
ja 0x1404a330d
mov rdx, qword [r10]
jmp 0x1404a33bb
mov qword [r10], r11
jmp 0x1404a33c3
jmp 0x1404a33f7
movzx eax, word [rdx]
movzx ecx, word [r8]
stc
test sil, r13b
cmp r11w, dx
mov word [r8], ax
cmp r9, rsp
sub r8, 2
test r8b, al
test bx, 0x6003
mov word [rdx], cx
cmp r13w, 0xbfa
add rdx, 2
cmp rdx, r8
jb 0x1404a33c8
jmp 0x1404a342e
add rax, rax
sub r11, rax
movsx edi, r13w
movsx si, r10b
jmp 0x1404a3419
mov qword [r10], r11
setae dil
mov qword [r9], r15
mov r15w, r9w
setbe r15b
not r15b
mov rbx, qword [rsp + 0x18]
movsxd rdi, r14d
not si
mov rbp, qword [rsp + 0x20]
jmp 0x1404a3448
mov rsi, qword [rsp + 0x28]
movsx edi, si
setnp r14b
mov rdi, qword [rsp + 0x30]
mov r15d, 0x38976c21
movsx r15d, r9w
not r14b
pop r15
not r14
pop r14
jmp 0x1404a3472
ret
cmp r8, qword [r9]
jae 0x1404a3420
dec r8d
mov r11d, r15d
cmp ax, r10w
test ecx, ecx
jmp 0x1404a348d
je 0x1404a3546
movsxd rax, r8d
lea rdi, [rax + rax]
mov r14, qword [r10]
movsx eax, r9w
mov eax, 0x66666667
imul ebx
inc al
movsxd rax, r12d
cbw
mov ebp, r8d
sar edx, 2
shl al, 0x1c
rol rax, cl
mov eax, edx
test di, r13w
cmp dl, 0x35
shr eax, 0x1f
test r9b, dil
add edx, eax
test ebx, ebx
jmp 0x1404a34d3
je 0x1404a3503
movzx eax, dx
test cl, 1
sub ch, dl
bsr rcx, rbp
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
mov al, 0xfb
sub bx, cx
movzx eax, bp
movzx rax, r9w
lea eax, [rbx + 0x30]
jmp 0x1404a3506
movzx eax, si
mov word [rdi + r14], ax
movsx rbx, r13w
inc ebx
movsx ebx, di
inc r11d
shr ebx, cl
bswap bx
sub rdi, 2
movsx ebx, r14w
movsx rbx, r14w
mov bl, dil
dec r8d
btc rbx, r9
jmp 0x1404a3537
mov ebx, edx
test ebp, ebp
jmp 0x1404a3540
jne 0x1404a349a
movsxd rcx, r11d
lea rax, [rcx + rcx]
cmc
add qword [r10], rax
sub qword [r9], rcx
jmp 0x1404a342e
Function at 0x1404a960d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
add bh, bh
mov qword [rsp + 0x18], rsi
not ebx
bts ax, r10w
push rdi
ror bh, 0x99
mov al, 0x86
sub rsp, 0x50
bts bx, r11w
mov rax, qword [0x1400b7288]
rcr bh, cl
bswap bx
xor rax, rsp
movzx rbx, di
mov qword [rsp + 0x40], rax
clc
add ebx, 0xdab7061
rol ebx, 0x88
cmp byte [rcx + 0x54], 0
movzx bx, r13b
movsx rbx, si
not bh
mov rbx, rcx
jmp 0x1404a9668
je 0x1404a9776
cmp dword [rcx + 0x50], 0
jmp 0x1404a9677
jle 0x1404a9776
mov rsi, qword [rcx + 0x48]
xor edi, edi
movsxd rax, ecx
mov r9w, 0x4584
mov rax, qword [rbx + 8]
movzx r8, cx
not r8b
cqo
lea rdx, [rsp + 0x34]
add r9b, 0xee
sar r8b, 0x32
movzx r9d, word [rsi]
movsx ecx, r15w
dec r8b
lea rcx, [rsp + 0x30]
movsx r8w, r13b
and dword [rsp + 0x30], 0
bswap r8
lea rsi, [rsi + 2]
movzx r8, r14w
not r8d
movzx r8d, r8w
mov r8d, 6
mov qword [rsp + 0x20], rax
jmp 0x1404a96e1
call fcn.1404ccf08
test eax, eax
jmp 0x1404a96ed
jne 0x1404a9768
mov r8d, dword [rsp + 0x30]
stc
test r8d, r8d
jmp 0x1404a9701
je 0x1404a9768
lea rax, [rbx + 0x10]
movsxd r9, r10d
jmp 0x1404a971a
lea r9, [rbx + 0x28]
movzx cx, bl
movsx edx, r9w
movsx rcx, r12w
mov qword [rsp + 0x20], rax
cmovbe cx, r15w
cwd
movzx edx, bx
lea rcx, [rbx + 0x468]
cqo
cwd
movzx dx, sil
lea rdx, [rsp + 0x34]
jmp 0x1404a9753
call fcn.1404a7a7f
inc edi
cmp edi, dword [rbx + 0x50]
jne 0x1404a968b
jmp 0x1404a97ae
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404a9771
jmp 0x1404a97ae
mov r8d, dword [rbx + 0x50]
lea rax, [rcx + 0x10]
mov rdx, qword [rbx + 0x48]
btc r9, 0x8c
movsx r9, bx
ror r9w, cl
lea r9, [rcx + 0x28]
add rcx, 0x468
jmp 0x1404a979f
mov qword [rsp + 0x20], rax
jmp 0x1404a97a9
call fcn.1404a7a7f
mov al, 1
adc ecx, 0x49af5e8f
mov rcx, qword [rsp + 0x40]
stc
cmp bpl, r12b
cmp r8w, 0x2d5f
xor rcx, rsp
jmp 0x1404a97cd
call fcn.14049bea6
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
movzx di, r12b
mov di, bp
pop rdi
ret
Function at 0x1404acfcd
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
bt si, r12w
or sil, cl
push rdi
rcr si, 0x50
neg di
cmp rbp, 0x508226b
sub rsp, 0x30
mov edi, edx
mov rsi, rcx
jmp 0x1404acffc
test r8, r8
jne 0x1404ad026
call fcn.1404b187f
mov dword [rax], 0x16
jmp 0x1404ad015
call fcn.1404b2539
xor eax, eax
jmp 0x1404ad021
jmp 0x1404ad12e
mov rdx, r9
movzx cx, cl
movzx ecx, ax
mov rcx, r8
jmp 0x1404ad038
call fcn.1404ad193
mov rbx, rax
cmp r9w, bp
cmp r13b, 3
jmp 0x1404ad04d
test rax, rax
je 0x1404ad0d8
lea rax, [rsp + 0x50]
bswap edx
mov rdx, rdi
movsxd rcx, r10d
not r9b
movzx ecx, r12w
mov qword [rsp + 0x28], rax
movsx ecx, r8w
lahf
setle cl
lea r8, [0x140094b24]
movzx r9, r8w
setle ch
mov eax, dword [rsp + 0x60]
movsx cx, r15b
not ch
mov r9, rbx
setns cl
mov cl, bpl
xchg ecx, ecx
mov rcx, rsi
jmp 0x1404ad0a3
mov dword [rsp + 0x20], eax
jmp 0x1404ad0ac
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp esp, r12d
test rax, rax
jmp 0x1404ad0c0
jne 0x1404ad152
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404ad0d3
call fcn.1404b18ec
xor edi, edi
test r11, 0x438f0fb6
cmp r14b, 0x39
test rbx, rbx
jmp 0x1404ad0ed
je 0x1404ad12b
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1404ad106
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404ad112
je 0x1404ad11e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404ad126
call fcn.1404c598b
mov rax, rdi
mov rbx, qword [rsp + 0x40]
xor di, 0x5711
rcl dil, 0x8d
mov rsi, qword [rsp + 0x48]
rcl rdi, 0x8f
rcr di, cl
add rsp, 0x30
movzx rdi, r11w
pop rdi
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jmp 0x1404ad15f
je 0x1404ad173
mov eax, dword [rsp + 0x50]
test ebx, edx
mov dword [rcx], eax
test bh, 0x69
test dl, r12b
sub ebx, ebx
jmp 0x1404ad17a
jmp 0x1404ad0e5

Function at 0x1404ad453
Capabilities:
Terminate process

Disassembly:
push rbx
sbb bh, 0
xchg bh, bl
dec bl
sub rsp, 0x20
xchg bx, bx
mov ebx, ecx
call fcn.1404cef12
cmp eax, 1
jmp 0x1404ad472
je 0x1404ad4bb
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
test bl, 0x5f
jmp 0x1404ad490
shr edx, 8
clc
cmp rbp, rax
test dl, 1
jmp 0x1404ad49f
jne 0x1404ad4bb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1404ad4b5
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404ad4c2
call fcn.1404ad39e
mov ecx, ebx
jmp 0x1404ad4ce
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404afc8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
clc
mov qword [rsp + 0x18], rdi
shr di, cl
push r14
sub r14b, 0x31
neg dil
bts edi, r15d
sub rsp, 0x20
rcl dil, 0x58
movzx r14, ax
test r13w, 0x492c
sub ebx, ebx
not dil
mov rdi, rdx
test ah, dl
xor r14w, cx
stc
mov r14, rcx
clc
test r13w, 0x2711
test rdx, rdx
jmp 0x1404afcdf
je 0x1404afd4d
movzx esi, word [r14 + rbx*2]
call fcn.1404a7122
mov rdx, rax
sub al, r13b
bts ax, bp
mov al, dil
mov eax, 0xff
clc
cmp si, ax
jmp 0x1404afd0a
ja 0x1404afd25
movzx ecx, word [rdx + rsi*2]
stc
and ecx, 0x103
jmp 0x1404afd20
jmp 0x1404afd27
xor ecx, ecx
test ecx, ecx
jmp 0x1404afd2e
je 0x1404afd85
inc rbx
jmp 0x1404afd3f
cmp rbx, rdi
jmp 0x1404afd47
jb 0x1404afce5
mov al, 1
and bl, 0x5a
ror dil, cl
adc esi, eax
mov rbx, qword [rsp + 0x30]
bsf r14w, r8w
cmc
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
movzx r14w, sil
add rsp, 0x20
movsx r14w, cl
xchg r14, r14
pop r14
jmp 0x1404afd84
ret
xor al, al
jmp 0x1404afd8c
jmp 0x1404afd57

Function at 0x1404b58c4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
clc
test bx, 0xbde
cmc
neg rcx
test r11, r12
test rax, 7
je 0x1404b590d
nop
not dl
mov dl, byte [rax]
jmp 0x1404b58eb
inc rax
cmc
test r15w, sp
test dl, dl
jmp 0x1404b58fa
je 0x1404b59d2
test al, 7
jmp 0x1404b5907
jne 0x1404b58e4
movabs r8, 0x7efefefefefefeff
cmp r8b, 0x44
xor r11w, 0x58e7
movabs r11, 0x8101010101010100
add dl, 0x52
and dx, r14w
mov rdx, qword [rax]
inc r9d
bswap r9w
sub r9, r13
mov r9, r8
clc
add rax, 8
add r9, rdx
not rdx
test r12w, 0x5616
xor rdx, r9
and rdx, r11
je 0x1404b5932
mov rdx, qword [rax - 8]
test dl, dl
je 0x1404b5a1f
test dh, dh
jmp 0x1404b5972
je 0x1404b5a14
shr rdx, 0x10
test dl, dl
jmp 0x1404b5983
je 0x1404b5a09
test dh, dh
jmp 0x1404b5990
je 0x1404b59fe
shr rdx, 0x10
clc
test r12b, 0xe2
test dl, dl
jmp 0x1404b59a6
je 0x1404b59f3
test dh, dh
je 0x1404b59e8
shr edx, 0x10
stc
test dl, dl
jmp 0x1404b59bf
je 0x1404b59dd
test dh, dh
jmp 0x1404b59cc
jne 0x1404b5932
lea rax, [rax + rcx - 1]
jmp 0x1404b59dc
ret
lea rax, [rax + rcx - 2]
jmp 0x1404b59e7
ret
lea rax, [rax + rcx - 3]
jmp 0x1404b59f2
ret
lea rax, [rax + rcx - 4]
jmp 0x1404b59fd
ret
lea rax, [rax + rcx - 5]
jmp 0x1404b5a08
ret
lea rax, [rax + rcx - 6]
jmp 0x1404b5a13
ret
lea rax, [rax + rcx - 7]
jmp 0x1404b5a1e
ret
lea rax, [rax + rcx - 8]
jmp 0x1404b5a29
ret
Function at 0x1404bfe9a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov r10b, 0xd
mov qword [rax + 8], rbx
shl r10, 0x91
test edx, ebx
stc
mov qword [rax + 0x10], rbp
movsx r10, sp
stc
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movzx ebx, r14w
xadd bl, r10b
and bx, r8w
push r14
or ebp, 0xffffffff
mov rbx, r8
movsx r10, r11w
cmp dword [rcx + 0x10], 0
movsxd r10, ecx
not r10w
mov r10, rdx
je 0x1404c007a
movsxd r9, dword [rcx + 0x10]
bswap r14d
rcr r14d, 0xd8
lea r14, [0x140000000]
dec ecx
xchg cx, ax
cmp dil, 0x70
mov rdi, qword [rdx + 8]
neg eax
movsx dx, sil
add al, 0x14
xor esi, esi
lea r9, [r9 + rdi]
inc ah
sub r8d, r8d
movsx rdx, r11w
clc
mov edx, ebp
sal rax, cl
movzx ecx, byte [r9]
and ecx, 0xf
movsx eax, r15w
not r11w
adc ah, 0x39
movsx rax, byte [rcx + r14 + 0xc1a30]
dec r11w
stc
movsx r11w, r14b
mov cl, byte [rcx + r14 + 0xc1a40]
movsx r11d, r13w
sub r9, rax
and r11w, 0x7c4a
sbb r11, r10
mov r11d, dword [r9 - 4]
shr r11d, cl
test ebx, 0x1dfc136b
cmc
test r11d, r11d
jmp 0x1404bff77
je 0x1404c007a
mov rax, qword [r10 + 0x10]
bswap r10
cmovb r10w, di
mov r10d, dword [rax]
ror rcx, 0x2e
bsr rcx, r10
test edi, 0x2a7b4e7f
movzx ecx, byte [r9]
or al, 0x71
and ecx, 0xf
cmc
adc al, 0xcb
or al, spl
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
cmc
test r15d, r13d
sub r9, rax
mov ah, ah
shld eax, edx, 0x6a
mov eax, dword [r9 - 4]
cmp r11b, r13b
shr eax, cl
test r14d, r14d
stc
add esi, eax
mov eax, esi
cmp bp, 0xa81
clc
add rax, r10
clc
cmc
add rax, rdi
test di, bp
cmp rbx, rax
jmp 0x1404bfff1
jb 0x1404c005c
movzx ecx, byte [r9]
not ax
rdtsc
inc r8d
and ecx, 0xf
cmovle ax, r13w
xor dl, bpl
movzx ax, r12b
movsx rax, byte [rcx + r14 + 0xc1a30]
and dx, 0x2e34
mov cl, byte [rcx + r14 + 0xc1a40]
or dl, 0x7e
adc dh, 0x10
and dh, al
sub r9, rax
test spl, 0x8f
movsxd rdx, edx
mov edx, dword [r9 - 4]
test eax, 0x2ed52978
shr edx, cl
jmp 0x1404c004b
dec edx
jmp 0x1404c0053
cmp r8d, r11d
jb 0x1404bff9a
test r8d, r8d
not ax
cmove edx, ebp
movzx rax, bp
cwde
movzx eax, r9w
mov eax, edx
jmp 0x1404c0075
jmp 0x1404c0085
mov eax, ebp
movsx bp, dil
movsx ebx, r8w
mov rbx, qword [rsp + 0x10]
movzx ebp, r9w
mov rbp, qword [rsp + 0x18]
movzx edi, r11w
movsx r14w, r10b
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
bswap r14w
mov r14w, r8w
mov r14, 0x18e6318a
pop r14
jmp 0x1404c00bc
ret
Function at 0x1404c00bd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
setne ah
mov qword [r11 + 0x18], rbx
not ax
mov qword [r11 + 0x20], r9
cbw
btc ax, 0x62
shld ax, si, 0xe8
mov dword [rsp + 0x10], edx
cmovnp ax, dx
push rbp
stc
rcl ebx, 9
xor bl, dh
push rsi
push rdi
bt ax, r13w
stc
movzx esi, si
push r12
push r13
bts ax, si
rcl bh, cl
bsr si, r15w
push r14
bt bx, 0xfe
push r15
shr ax, cl
rcl sil, 0x64
neg bl
sub rsp, 0x20
sbb r15, 0x78ac5526
sar ax, 8
bts si, si
mov rax, qword [rcx + 8]
xor bpl, bpl
xadd bx, r13w
adc si, si
sub r14b, r14b
bt ebx, 0xd
cmp spl, r11b
bt r15w, r13w
mov qword [r11 + 8], rax
or bx, r13w
xor edi, edi
mov r12, r9
or si, 0x71c1
mov r13d, r8d
bsf r15, rdi
test r9, rax
movzx rsi, r10w
mov rbx, rcx
shr sil, 6
bt si, 0x50
sar r15b, cl
lea rsi, [rax - 1]
sar r15d, 0xbc
mov r15, rsi
test eax, r15d
test r13b, 0x98
stc
cmp dword [rcx], edi
jmp 0x1404c018f
jle 0x1404c0224
mov r12d, dword [r11 + 0x10]
cmp ax, 0x27e9
test r9d, 0x7ce5446f
cmp edi, r12d
jne 0x1404c01bd
mov rsi, rax
rol bpl, cl
rol bpl, 0x24
mov bpl, 1
test rax, r10
cmp edi, r13d
jne 0x1404c01cf
mov r15, rax
mov r14b, 1
cmp cl, 0xa0
test bpl, bpl
jmp 0x1404c01d7
je 0x1404c01e6
test r14b, r14b
jne 0x1404c0211
lea rdx, [rsp + 0x60]
mov rcx, rbx
jmp 0x1404c01f3
call fcn.140263559
inc edi
cmp edi, dword [rbx]
jge 0x1404c0211
mov rax, qword [rsp + 0x60]
jmp 0x1404c020c
jmp 0x1404c01a4
mov r12, qword [rsp + 0x78]
not ax
sub r14w, 0x7855
shld r13, r14, 0x83
mov rax, qword [r12]
test dil, 0x7c
mov qword [r12 + 8], rsi
movzx si, dil
cmovp cx, r10w
movups xmm0, xmmword [rbx]
cmp r13w, 0x6ca8
movups xmmword [rax], xmm0
sbb dil, 0x36
test r14d, 0x655820ae
movups xmm1, xmmword [rbx + 0x10]
clc
neg r12w
movups xmmword [rax + 0x10], xmm1
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
mov qword [rax + 8], r15
movups xmm0, xmmword [rbx]
rol r14b, 0x69
movups xmmword [rcx], xmm0
btc rbp, 0xfe
mov bp, 0x1160
movups xmm1, xmmword [rbx + 0x10]
jmp 0x1404c028b
mov rbx, qword [rsp + 0x70]
cmc
sal r14w, 0x5d
movups xmmword [rcx + 0x10], xmm1
movzx r13d, sp
bsr r12, rsp
add rsp, 0x20
not rbp
movzx r13d, r9w
movsx r12, r9w
pop r15
sets dil
pop r14
mov di, 0x5ccd
movsx si, r11b
movsx ebp, sp
pop r13
mov r12d, 0xe675db5
pop r12
pop rdi
pop rsi
jmp 0x1404c02dd
pop rbp
ret

Function at 0x1404c6f60
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movzx r8, cx
rcl ebx, 0xdc
push rdi
rcl bh, 0xa4
sub rsp, 0x20
mov rbx, rdx
movzx rdx, r10w
seta dl
lea r9, [0x1400c63d8]
xchg dl, r8b
mov edi, ecx
mov r8d, r12d
movsx dx, dil
setb r8b
lea rdx, [0x1400cf748]
xchg rcx, rcx
mov ecx, 6
movsxd r8, edx
lea r8, [0x1400c63d0]
jmp 0x1404c6fb4
call fcn.1404c7daa
mov rdx, rbx
test r8b, cl
bt cx, bx
cmovge rcx, rbx
mov ecx, edi
clc
cmc
test rax, rax
jmp 0x1404c6fd3
je 0x1404c6fe4
call qword [case.0x1404c7a96.0]
jmp 0x1404c6fea
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
movsx edi, cx
pop rdi
jmp 0x1404c6ffc
ret
Function at 0x1404c7184
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
ror bh, 0x7d
mov qword [rsp + 0x10], rbp
ror bl, cl
mov qword [rsp + 0x18], rsi
sub bpl, 0xe0
push rdi
bswap edi
shl si, cl
and bpl, 0xd1
sub rsp, 0x30
mov bpl, r13b
movsxd rdi, ebp
mov ebx, r9d
movsx r9w, bl
mov bp, si
xchg r9b, sil
mov rdi, r8
mov esi, edx
cmovl dx, r12w
movsx rbp, r11w
lea r9, [0x1400c63e8]
mov rbp, rcx
lea r8, [0x1400c63e0]
mov dl, 0xf4
movsx cx, dil
lea rdx, [0x1400cf190]
bswap ecx
cmovp ecx, r10d
movsxd rcx, edx
mov ecx, 0xb
jmp 0x1404c71fe
call fcn.1404c7daa
mov rcx, rbp
test dx, 0x3cc6
test rax, rax
jmp 0x1404c7213
je 0x1404c7238
mov r9d, ebx
mov r8b, spl
movzx dx, spl
mov r8, rdi
movzx rdx, r10w
mov edx, esi
call qword [case.0x1404c7a96.0]
jmp 0x1404c7265
sub edx, edx
jmp 0x1404c723f
call fcn.1404c78a2
mov ecx, eax
movsx rdx, sp
mov r9d, ebx
cmovge r8w, r9w
xchg r8w, r8w
not r8b
mov r8, rdi
cdq
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
rcr si, cl
xchg dil, dil
mov rsi, qword [rsp + 0x50]
shl dil, 0xb7
cmp cx, r11w
add rsp, 0x30
movsx rdi, ax
movzx di, al
pop rdi
jmp 0x1404c7294
ret
Function at 0x1404cae0a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
sar ch, cl
mov qword [rax + 0x10], rbp
test r15b, r10b
add rcx, 0x95b4492
mov qword [rax + 0x18], rsi
neg cl
movzx cx, r14b
mov qword [rax + 0x20], rdi
shl cl, 0xac
push r14
rol cx, cl
bt cx, r11w
sub rsp, 0x90
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
sub r14d, r14d
stc
cmp word [rsp + 0x62], r14w
jmp 0x1404cae5d
je 0x1404caf96
mov rax, qword [rsp + 0x68]
test rax, rax
jmp 0x1404cae70
je 0x1404caf96
movsxd rbx, dword [rax]
rcr di, cl
jmp 0x1404cae85
lea rsi, [rax + 4]
ror ecx, 7
and dil, al
mov edi, 0x2000
lea rbx, [rbx + rsi]
cmp di, r8w
sar cl, 0x58
cmp dword [rax], edi
cmovl edi, dword [rax]
mov ecx, edi
jmp 0x1404caeab
call fcn.1400ada04
cmp edi, dword [0x1400bad40]
cmovg edi, dword [0x1400bad40]
clc
test rsi, rsi
test edi, edi
jmp 0x1404caec8
je 0x1404caf96
mov ebp, r14d
cmc
cmp qword [rbx], 0xffffffffffffffff
je 0x1404caf78
cmp qword [rbx], 0xfffffffffffffffe
jmp 0x1404caee5
je 0x1404caf78
test byte [rsi], 1
jmp 0x1404caef3
je 0x1404caf78
test byte [rsi], 8
jmp 0x1404caf01
jne 0x1404caf18
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1404caf78
mov rax, rbp
xor r8w, 0x5ddc
movzx r8d, r15w
lea r8, [0x1400ba940]
ror dl, cl
mov dx, r11w
neg ch
mov rcx, rbp
sar rcx, 6
shld rdx, rsi, 0xb4
and eax, 0x3f
cdq
cqo
mov rcx, qword [r8 + rcx*8]
movzx dx, bpl
cmovo edx, r9d
lea rdx, [rax + rax*8]
cbw
cdqe
not ax
mov rax, qword [rbx]
mov qword [rcx + rdx*8 + 0x28], rax
inc al
mov al, byte [rsi]
jmp 0x1404caf6f
mov byte [rcx + rdx*8 + 0x38], al
jmp 0x1404caf78
inc rbp
jmp 0x1404caf80
inc rsi
add rbx, 8
sub rdi, 1
jmp 0x1404caf90
jne 0x1404caed2
lea r11, [rsp + 0x90]
seto sil
movzx ebx, r15w
mov rbx, qword [r11 + 0x10]
xchg bpl, dil
movsxd rbp, r14d
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
bswap r14w
setl r14b
movsxd r14, eax
mov rsp, r11
pop r14
jmp 0x1404cafd1
ret
Function at 0x1404d2d59
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movzx ebx, bx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
bswap ebx
push rdi
push r14
push r15
sub rsp, 0x20
movzx rbp, r9w
sub edi, edi
shrd bp, cx, 0xa8
xadd ebp, ebx
mov r15, r8
mov bp, 0x6b4b
movzx rbp, r13w
movzx ebp, r15w
mov ebx, edx
test r10b, r15b
setns bpl
sbb bpl, 6
mov rbp, rcx
test sil, r13b
clc
cmc
test edx, edx
jmp 0x1404d2daf
js 0x1404d2e2f
mov rcx, qword [r15]
lea eax, [rdi + rbx]
test r14b, 0xa9
or r14w, ax
cdq
bt r14, rbp
clc
sub eax, edx
mov sil, al
bt dx, r10w
sar eax, 1
shl sil, cl
ror sil, cl
movsxd rsi, eax
movzx rdx, bp
mov r14, rsi
add edx, eax
bsr dx, di
cmove edx, r10d
shl r14, 4
movsx edx, si
setns dh
mov rdx, qword [r14 + rbp]
call fcn.1404c66ed
test eax, eax
je 0x1404d2e7e
jns 0x1404d2e18
lea ebx, [rsi - 1]
jmp 0x1404d2e22
lea edi, [rsi + 1]
stc
test ebx, 0xfa0600a
cmp edi, ebx
jmp 0x1404d2e29
jle 0x1404d2db5
sub al, al
jmp 0x1404d2e36
mov rbx, qword [rsp + 0x40]
movzx di, r14b
rcl r15b, cl
mov rbp, qword [rsp + 0x48]
movsx esi, ax
movzx edi, r8w
shl di, 0x53
mov rsi, qword [rsp + 0x50]
xor dil, r8b
adc r15b, 0xd0
sar dil, cl
add rsp, 0x20
cmovp r15d, r14d
pop r15
movsx rdi, bx
movsx di, r11b
pop r14
pop rdi
jmp 0x1404d2e7d
ret
lea rax, [rbp + 8]
cmp bpl, 0xeb
clc
add rax, r14
jmp 0x1404d2e8f
mov qword [r15], rax
not al
mov al, 1
jmp 0x1404d2e36

Function at 0x1404d39e5
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov bl, 1
sbb ebx, 0x6ee1057b
mov qword [rsp + 0x18], rsi
btc rbx, 0x61
sal bh, 0x9a
btr bx, 0x2d
push rdi
sub rsp, 0x20
xor esi, esi
xor di, 0x5d43
bts ebx, r10d
mov rdi, rdx
neg bh
mov bl, cl
rcl bx, 0x27
mov rbx, rcx
stc
cmc
test rcx, rcx
je 0x1404d3abd
cmp word [rcx], si
jmp 0x1404d3a35
je 0x1404d3abd
lea rdx, [0x1400d1d08]
jmp 0x1404d3a47
call fcn.1401dcbcc
test eax, eax
jmp 0x1404d3a53
je 0x1404d3abd
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404d3a68
call fcn.1401dcbcc
test eax, eax
jmp 0x1404d3a74
jne 0x1404d3ab0
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
mov dx, r8w
movzx edx, bx
cwd
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
jmp 0x1404d3a99
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404d3aef
mov eax, dword [rsp + 0x30]
jmp 0x1404d3b10
mov rcx, rbx
call fcn.1404dc9c4
jmp 0x1404d3b10
mov ecx, dword [rdi + 8]
movzx r9w, r11b
bswap edx
lea r8, [rsp + 0x30]
jmp 0x1404d3ad1
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d3ae9
jne 0x1404d3afb
sub eax, eax
jmp 0x1404d3af6
jmp 0x1404d3b10
mov eax, dword [rsp + 0x30]
cmp r13b, cl
test eax, eax
jne 0x1404d3b10
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
not di
movsxd rdi, esp
pop rdi
jmp 0x1404d3b2a
ret
Function at 0x1404d3b2b
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
inc bh
mov bx, 0x4ca9
sbb ebx, eax
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsx bx, r12b
mov esi, edx
mov ebx, ecx
call fcn.1404c5cb7
mov ecx, ebx
sal edx, 0xd5
sub r8b, r10b
lea r8, [rsp + 0x30]
shl r9w, cl
and ecx, 0x3ff
mov r9d, 2
movzx edi, ax
bswap rdx
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
jmp 0x1404d3b84
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
stc
cmc
test eax, eax
je 0x1404d3c43
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d3ba0
je 0x1404d3c34
test esi, esi
jmp 0x1404d3bad
je 0x1404d3c34
mov r9, qword [rdi + 0x98]
mov r8d, r10d
shr eax, cl
movzx edx, word [r9]
lea rcx, [r9 + 2]
test r9, 0x4094004a
lea eax, [rdx - 0x41]
cmp spl, r14b
stc
cmp ax, 0x19
jmp 0x1404d3bde
jbe 0x1404d3bf7
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404d3bf1
ja 0x1404d3c0e
movzx edx, word [rcx]
inc r8d
test di, r9w
cmp r8w, si
add rcx, 2
jmp 0x1404d3bce
or rcx, 0xffffffffffffffff
inc rcx
stc
cmp word [r9 + rcx*2], r10w
jmp 0x1404d3c20
jne 0x1404d3c12
cmp r8d, ecx
jmp 0x1404d3c2e
je 0x1404d3c43
mov eax, 1
jmp 0x1404d3c3e
jmp 0x1404d3c45
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x1404d3c59
ret