joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a05fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmc
cmp r15w, si
test r13w, r10w
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
and sil, 0x94
btc esi, 0xd3
mov qword [rax + 0x18], rdi
shr di, 0xa6
neg dil
xor dil, 0x99
mov qword [rax + 0x20], r14
not dil
test r8b, bl
push r15
sub rsp, 0x30
sub r14b, 0x3c
bts rsi, r12
mov rdi, r9
shld si, r10w, 0x19
mov rsi, rdx
rcr r14b, cl
bts r14, r12
sub rsi, rcx
movsxd r14, eax
cmovs r14w, dx
sub rdi, r8
and r14, 0x6e6c2b64
mov r15, rcx
movzx rcx, r11w
cmp dil, dil
sar rsi, 1
adc cx, 0xea4
add r14w, 3
cmovbe cx, dx
mov rcx, qword [rsp + 0x60]
movzx r14, dx
cmc
xor ebx, ebx
bt r14d, esp
sar rdi, 1
rcr r14b, cl
mov r14, r8
test rcx, rcx
jne 0x1404a06b8
call fcn.1404aa951
mov rcx, qword [rax + 8]
jmp 0x1404a06b3
jmp 0x1404a06c1
mov rcx, qword [rcx + 8]
clc
cmp r8b, 0x66
test rcx, rcx
jmp 0x1404a06c9
jne 0x1404a0781
cmp esi, edi
mov eax, edi
cmovl eax, esi
xor cl, 0x68
movzx rcx, r12w
movsxd rcx, eax
cmovle ax, ax
cmp eax, 0x3a6a789e
mov eax, 1
cmp rdx, 0x53bf0508
cmc
test rcx, rcx
je 0x1404a0733
sub r15, r14
movsxd rdx, esp
movzx edx, word [r15 + r14]
test bx, 0x385b
clc
cmp dx, word [r14]
jmp 0x1404a0719
jne 0x1404a0758
add r14, 2
cmp ebx, 0x15011153
stc
sub rcx, rax
jne 0x1404a0705
cmp esi, edi
jmp 0x1404a073a
je 0x1404a0775
or ecx, 0xffffffff
stc
cmp esi, edi
jmp 0x1404a074b
cmovl eax, ecx
jmp 0x1404a0753
jmp 0x1404a07e9
sbb ebx, ebx
test edi, r12d
and ebx, 0xfffffffe
stc
cmp r13w, r8w
jmp 0x1404a076a
add ebx, eax
not ah
movsx eax, r12w
movsxd rax, ecx
mov eax, ebx
jmp 0x1404a077c
jmp 0x1404a07e9
mov dword [rsp + 0x28], edi
bswap dx
mov r9d, esi
movzx r8, bp
movsxd rdx, edi
cwd
mov r8, r15
movsx dx, dl
mov qword [rsp + 0x20], r14
movzx edx, bx
mov edx, 0x1000
jmp 0x1404a07ad
call fcn.1404c3343
test eax, eax
jmp 0x1404a07b9
jne 0x1404a07dd
call fcn.1404b575b
mov dword [rax], 0x16
xchg al, ah
movsx eax, r10w
setno ah
mov eax, 0x7fffffff
jmp 0x1404a07e9
sub eax, 2
bt r14, r14
btc r14d, 7
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
cmc
ror dil, 0x48
sar r15w, 0x8b
mov rdi, qword [rsp + 0x50]
add r15b, dl
btc r15, r10
mov r14, qword [rsp + 0x58]
sub r15w, 0x2dee
add r15w, sp
add rsp, 0x30
pop r15
jmp 0x1404a0823
ret

Function at 0x1404a13db
Capabilities:
Terminate process

Disassembly:
push rbx
inc bh
sub rsp, 0x20
seta bh
btc ebx, r11d
adc rbx, r12
mov rbx, rcx
sub ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
rol rbx, 0xf4
ror bl, 0xf8
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404a19d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
bts r11, rsi
mov qword [rax + 8], rbx
cmp cx, r13w
sbb r10, rsi
mov qword [rax + 0x10], rbp
xor rbp, 0x43a06593
sal r10b, cl
mov qword [rax + 0x18], rsi
rcr r10b, cl
mov qword [rax + 0x20], rdi
adc r11w, bp
sar r10, 0x7e
push r14
movzx r10d, r15w
adc r11b, 0xf5
shl dil, 0xff
mov bl, byte [rcx]
shl r14b, 0x9b
bswap r10d
btr r11d, r9d
lea r10, [rcx + 1]
add r11d, 0x1f213026
adc esi, edi
mov byte [rdx], bl
sar rsi, 0xeb
btr di, r9w
mov esi, r9d
inc r14w
rol r14b, 0x25
sar bp, 0x99
lea r14, [0x140000000]
shr dil, 0x55
cmp bl, r14b
mov rbp, r8
setg dil
mov r11, rdx
mov rdi, rcx
test r10, 0x3a07040c
test bl, 4
jmp 0x1404a1a78
je 0x1404a1ab4
movzx ecx, byte [r10]
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
clc
stc
mov cl, byte [rcx + r14 + 0xc1a40]
jmp 0x1404a1aa2
sub r10, rax
mov eax, dword [r10 - 4]
stc
shr eax, cl
stc
test r8w, ax
mov dword [rdx + 4], eax
test bl, 8
je 0x1404a1ad3
mov eax, dword [r10]
clc
cmp al, bh
add r10, 4
cmc
mov dword [rdx + 8], eax
cmp rsi, 0x1e83655f
stc
test bl, 0x10
je 0x1404a1af4
mov eax, dword [r10]
adc r8b, r12b
add r10, 4
xchg r8w, r8w
ror r8b, cl
rol r8d, 0xc5
mov dword [rdx + 0xc], eax
movsxd rax, dword [r10]
lea r8, [r10 + 4]
test r13b, r13b
sub r9d, r9d
clc
stc
cmp byte [rsp + 0x30], r9b
jne 0x1404a1bc4
test bl, 2
je 0x1404a1bc4
lea rdx, [rax + rbp]
not r10b
movzx ecx, byte [rdx]
adc al, spl
and ecx, 0xf
sub r10d, 0x728e336b
bt ax, 0x10
movsx rax, byte [rcx + r14 + 0xc1a30]
ror r10, cl
shr r10, 0x38
mov cl, byte [rcx + r14 + 0xc1a40]
sub rdx, rax
add r10b, r9b
movsx r10d, si
mov r10d, dword [rdx - 4]
shr r10d, cl
stc
mov dword [r11 + 0x10], r9d
cmp dl, dil
cmc
test r10d, r10d
jmp 0x1404a1b6d
je 0x1404a1bcc
mov eax, dword [rdx]
mov cl, 0x11
shr ch, 0x92
setp ch
mov ecx, dword [rdx + 4]
test dx, bx
lea rdx, [rdx + 8]
clc
test r8d, 0x6e1c648a
cmp r15b, r10b
cmp eax, esi
jmp 0x1404a1b99
je 0x1404a1bb6
inc r9d
stc
cmp r9d, r10d
jmp 0x1404a1bab
jb 0x1404a1b73
jmp 0x1404a1bcc
mov dword [r11 + 0x10], ecx
jmp 0x1404a1bbf
jmp 0x1404a1bcc
mov dword [rdx + 0x10], eax
clc
cmp spl, 0xd9
test bl, 1
jmp 0x1404a1bd4
je 0x1404a1c25
movzx ecx, byte [r8]
bswap bp
add rbp, 0x745f6ff3
and ecx, 0xf
movsx rdx, byte [rcx + r14 + 0xc1a30]
xor si, 0x2c1b
add bp, r10w
cmc
mov cl, byte [rcx + r14 + 0xc1a40]
sub r8, rdx
movzx dx, r14b
mov edx, dword [r8 - 4]
cmovs bp, ax
shr edx, cl
test eax, 0x28036dde
mov dword [r11 + 0x14], edx
btr eax, r12d
mov rbx, qword [rsp + 0x10]
cmp rdx, 0x78464c81
sub rax, r13
sub r8, rdi
mov rbp, qword [rsp + 0x18]
mov rax, r8
movsx r14d, ax
mov rsi, qword [rsp + 0x20]
setno dil
mov rdi, qword [rsp + 0x28]
mov r14b, r8b
seto r14b
movzx r14, r9w
pop r14
jmp 0x1404a1c63
ret
Function at 0x1404b0e1b
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
bsr si, r12w
or sil, r15b
push rdi
bt si, r12w
neg edi
sub rsp, 0x30
cmovl rdi, rdx
add sil, 0x3c
mov rsi, 0x328357ce
mov edi, edx
sub si, 0x1cd
mov rsi, rcx
test r8, r8
jne 0x1404b0e77
call fcn.1404b575b
mov dword [rax], 0x16
call fcn.1404b63d2
sub eax, eax
jmp 0x1404b0e72
jmp 0x1404b0f5f
mov rdx, r9
mov rcx, r8
jmp 0x1404b0e82
call fcn.1404b0fc3
mov rbx, rax
test bh, 0x27
test rax, rax
je 0x1404b0f09
lea rax, [rsp + 0x50]
mov cl, bpl
mov rcx, 0x2ae97736
movzx r8w, r15b
mov rdx, rdi
setne r8b
movzx cx, r10b
mov qword [rsp + 0x28], rax
not r9d
movsx r8w, bl
lahf
lea r8, [0x140094b24]
movzx eax, r14w
mov eax, dword [rsp + 0x60]
xchg r9b, r9b
mov r9, rbx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b0ef1
jne 0x1404b0f7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b0f04
call fcn.1404b57cb
xor edi, edi
test rbx, rbx
jmp 0x1404b0f13
je 0x1404b0f55
mov rcx, qword [rbx + 0x10]
clc
stc
cmc
test rcx, rcx
jmp 0x1404b0f28
je 0x1404b0f34
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
clc
test rcx, rcx
je 0x1404b0f48
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b0f50
call fcn.1404c963e
mov rax, rdi
rol bl, 0x32
bts bx, bp
mov rbx, qword [rsp + 0x40]
and dil, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
cmovno di, bp
pop rdi
jmp 0x1404b0f7a
ret
mov rcx, qword [rsp + 0x68]
stc
test sp, 0x6eba
test rcx, rcx
jmp 0x1404b0f8e
je 0x1404b0fa3
mov eax, dword [rsp + 0x50]
test r10b, dil
mov dword [rcx], eax
test r10b, 0x94
cmc
clc
xor ebx, ebx
jmp 0x1404b0faa
jmp 0x1404b0f0b

Function at 0x1404b1278
Capabilities:
Terminate process

Disassembly:
push rbx
not bh
rcl bl, cl
add bx, 0x51f0
sub rsp, 0x20
jmp 0x1404b128c
mov ebx, ecx
jmp 0x1404b1293
call fcn.1404d2c10
cmp eax, 1
jmp 0x1404b12a0
je 0x1404b12ef
mov rax, qword gs:[0x60]
shrd rdx, r14, 0xb4
dec dh
mov edx, dword [rax + 0xbc]
stc
test bl, 0x6c
cmp r11w, 0x5484
shr edx, 8
clc
test dl, 1
jmp 0x1404b12d2
jne 0x1404b12ef
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
cdq
mov edx, ebx
jmp 0x1404b12e9
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b12f6
call fcn.1404b11ce
mov ecx, ebx
jmp 0x1404b1302
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b261f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
adc r8d, 0x17af7fb8
inc r8d
mov qword [rsp + 0x10], rbp
bt ebx, 0xf
bts rbp, r12
rcl bp, cl
mov qword [rsp + 0x18], rsi
sbb rbx, 0x4e0c6d8f
movsx r8d, r8w
push rdi
or bpl, 0xfa
sub bl, 0xef
btc r8w, 0xf7
push r14
push r15
and r8, rax
movzx r8w, bl
shl rbp, cl
sub rsp, 0x30
mov rbx, rdx
ror r8b, 0x60
mov ebp, 0x35301d6d
bt r8, 0xf6
mov r8d, 0x1ca
bts ebp, r13d
adc rbp, rcx
xor bp, 0x728c
sub edx, edx
not bpl
mov bp, r12w
mov rbp, rcx
jmp 0x1404b26a3
call fcn.1404a432a
xor r15d, r15d
cmp word [rbx], r15w
jmp 0x1404b26b4
jne 0x1404b26c6
xor eax, eax
jmp 0x1404b26c1
jmp 0x1404b289e
cmp word [rbx], 0x2e
jne 0x1404b2721
lea r8, [rbx + 2]
cmp r9w, 0x2665
cmp word [r8], r15w
jmp 0x1404b26e3
je 0x1404b2721
mov edx, 0x10
movzx rcx, r15w
lea rcx, [rbp + 0x100]
movsx r9w, r14b
lea r9d, [rdx - 1]
jmp 0x1404b2707
call fcn.1404c2ac0
test eax, eax
jne 0x1404b28db
mov word [rbp + 0x11e], r15w
jmp 0x1404b26ba
mov edi, r15d
jmp 0x1404b2729
jmp 0x1404b2875
lea r14, [rbx + rax*2]
shl sil, cl
movzx esi, word [r14]
stc
test edi, edi
jmp 0x1404b2741
jne 0x1404b27a2
cmp rax, 0x40
jmp 0x1404b2750
jae 0x1404b2892
mov r9, rax
movsx ecx, si
cdq
mov dx, cx
lea edx, [rdi + 0x40]
movzx rcx, ax
xchg cl, r8b
mov r8, rbx
mov rcx, rbp
call fcn.1404c2ac0
test eax, eax
jmp 0x1404b277c
jne 0x1404b28db
cmp si, 0x2e
not dil
cmovl di, r13w
mov edi, r15d
not dil
sete dil
jmp 0x1404b279d
jmp 0x1404b2848
cmp edi, 1
jne 0x1404b27d8
cmp rax, 0x40
jmp 0x1404b27b4
jae 0x1404b2892
cmp si, 0x5f
jmp 0x1404b27c3
je 0x1404b2892
lea rcx, [rbp + 0x80]
lea edx, [rdi + 0x3f]
jmp 0x1404b2827
cmp edi, 2
jmp 0x1404b27e0
jne 0x1404b2892
cmp rax, 0x10
jmp 0x1404b27ef
jae 0x1404b2892
test si, si
jmp 0x1404b27fd
je 0x1404b2812
cmp si, 0x2c
jmp 0x1404b280c
jne 0x1404b2892
lea rcx, [rbp + 0x100]
cqo
mov edx, 0x10
movsxd r9, r12d
movzx r9, r8w
mov r9, rax
bswap r8d
mov r8b, 0x28
movsxd r8, r11d
mov r8, rbx
call fcn.1404c2ac0
test eax, eax
jmp 0x1404b2842
jne 0x1404b28db
cmp si, 0x2c
jmp 0x1404b2851
je 0x1404b26ba
test si, si
jmp 0x1404b285f
je 0x1404b26ba
lea rbx, [r14 + 2]
inc edi
mov rdx, 0x49d41117
xchg cx, cx
lea rdx, [0x1400d25e8]
jmp 0x1404b2881
mov rcx, rbx
call fcn.140129168
test rax, rax
jne 0x1404b272e
or eax, 0xffffffff
test rdi, rbp
sbb r14w, 0x5d32
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
bts rdi, rdx
shr r14b, 0xb9
add rsp, 0x30
mov dil, dl
movzx r15w, spl
bswap r15w
pop r15
not di
pop r14
xchg rdi, rdi
cmovae di, r8w
pop rdi
jmp 0x1404b28da
ret
sub r9d, r9d
cmp cx, 0x674f
test dil, spl
mov qword [rsp + 0x20], r15
cmp r10b, 0xc7
xor r8d, r8d
clc
test r11, rsi
sub edx, edx
test r12d, r12d
cmp r9w, r8w
sub ecx, ecx
jmp 0x1404b2906
call fcn.1404b6457
int3
Function at 0x1404b6457
Capabilities:
Terminate process

Disassembly:
mov esp, 0xae1ede25
xlatb
cmp dword [rdx + 0x1cfac2c3], edx
add byte [rax], al
add byte [rbp + 0x5d], cl
inc byte [rdi + rbx*4 + 0x5d]
pop rbp
pop rbp
jae 0x14017771b
movsd dword [rdi], dword [rsi]
push 0xffffffffa9f0523d
invalid
invalid
jb 0x140177760
xor dl, dh
invalid
shr byte [rax], 1
stc
sub cl, bh
invalid
invalid
test byte [rsi + 0x39], 0xf0
mov edi, 0x5f7d1223
sbb byte [rdx - 0x4e84013f], ch
jno 0x14017777b
sti
imul byte [0x19aeff326]
sbb al, 0
add byte [rax + 0x23e0d290], al
nop
shl al, cl
and esi, dword [rcx]
invalid
mov bh, 0x8c
std
stosd dword [rdi], eax
jb 0x140177795
nop
shl al, cl
and esi, dword [rcx]
invalid
sal dword [rsi], 0x8a
insd dword [rdi], dx
adc dword [rax], esp
adc al, 0x7b
invalid
outsd dx, dword [rsi]
outsd dx, dword [rsi]
ja 0x14017779b
invalid
int1
retf
pop rbp
loope 0x140177778
stosd dword [rdi], eax
ror ebp, 0x77
jne 0x1401777cb
ja 0x140177812
sub eax, 0x6e1e3b0f
invalid
cmp al, 0xe6
adc edx, dword [rax]
jp 0x1401777da
mov byte gs:[rcx + 0x7a], al
push rdi
adc dword [rsi + 0x5d23fddf], 0x29
call 0x12a97299b
invalid
or cl, byte [rdi + 0x1d5414bf]
invalid
jb 0x1401777f5
push rax
invalid
clc
add byte [rax - 0x6d], bl
jne 0x1401777fb
add ebp, edx
invalid
add al, byte [rdi + rdi*8]
add al, 0x8f
invalid
sub rsp, 0x28
xchg ch, cl
movsxd rcx, r11d
setbe ch
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404b6487
mov ecx, 5
jmp 0x1404b6480
int 0x29
jmp 0x1404b6487
mov r8d, 1
mov edx, 0xc0000417
movzx ecx, r12w
movsx ecx, r11w
not ch
lea ecx, [r8 + 1]
jmp 0x1404b64a5
call fcn.1404b64d1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx dx, ah
clc
bts dx, bp
mov edx, 0xc0000417
add rsp, 0x28
jmp switch.0x1404b64ca
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b9786
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
jmp 0x1404b9797
je 0x1404b97c8
nop
mov dl, byte [rax]
jmp 0x1404b97a6
inc rax
test edi, 0x11b3761a
clc
test rax, rsp
test dl, dl
je 0x1404b98b0
test al, 7
jmp 0x1404b97c2
jne 0x1404b979f
movabs r8, 0x7efefefefefefeff
rcl dx, 0xca
sbb r9d, r10d
movabs r11, 0x8101010101010100
adc dx, 0xc01
movzx r9d, r14w
cdq
mov rdx, qword [rax]
rol r9w, 0x57
mov r9, r8
add rax, 8
lea r9, [r9 + rdx]
test r11b, r13b
clc
cmp r8, 0x63130dbf
not rdx
test r11b, bl
xor rdx, r9
test r14, 0x2e80132d
cmp r8w, 0x74c
clc
and rdx, r11
je 0x1404b97ed
mov rdx, qword [rax - 8]
cmc
jmp 0x1404b9838
test dl, dl
jmp 0x1404b983f
je 0x1404b98f8
test dh, dh
jmp 0x1404b984c
je 0x1404b98f2
shr rdx, 0x10
clc
test r10w, 0x6632
test dl, dl
jmp 0x1404b9864
je 0x1404b98e7
test dh, dh
je 0x1404b98dc
shr rdx, 0x10
test dl, dl
jmp 0x1404b987d
je 0x1404b98d1
test dh, dh
jmp 0x1404b988a
je 0x1404b98c6
shr edx, 0x10
cmp r9w, sp
cmc
test dx, dx
test dl, dl
jmp 0x1404b98a2
je 0x1404b98bb
test dh, dh
jne 0x1404b97ed
lea rax, [rax + rcx - 1]
jmp 0x1404b98ba
ret
lea rax, [rax + rcx - 2]
jmp 0x1404b98c5
ret
lea rax, [rax + rcx - 3]
jmp 0x1404b98d0
ret
lea rax, [rax + rcx - 4]
jmp 0x1404b98db
ret
lea rax, [rax + rcx - 5]
jmp 0x1404b98e6
ret
lea rax, [rax + rcx - 6]
jmp 0x1404b98f1
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
jmp 0x1404b9902
ret
Function at 0x1404caa4f
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
shr dh, 0x60
rcr bh, 0x17
sub rsp, 0x20
mov bx, si
mov rbx, rcx
jmp 0x1404caa66
lea r9, [0x1400c63c0]
movsxd rdx, ebp
movsx dx, r8b
not r8
mov ecx, 3
movsx rdx, r8w
lea r8, [0x1400c63b8]
cdq
bswap dx
lea rdx, [0x1400cfb70]
jmp 0x1404caa98
call fcn.1404cba6c
test rax, rax
jmp 0x1404caaa5
je 0x1404caac2
mov rcx, rbx
add rsp, 0x20
movsx ebx, bp
pop rbx
jmp 0x1404caabb
push qword [0x1400b8d90]
ret
add rsp, 0x20
pop rbx
jmp 0x1404caacc
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404cab63
Capabilities:
Get thread local storage value

Disassembly:
push rbx
or r9b, bpl
cmp r9d, 0x618145aa
sub rsp, 0x20
movsxd r9, edx
mov ebx, ecx
mov cl, r9b
bswap dx
lea r9, [0x1400c63d0]
mov ecx, 5
lea r8, [0x1400c63c8]
movzx edx, bx
movsx edx, ax
lea rdx, [0x1400cf758]
jmp 0x1404caba3
call fcn.1404cba6c
mov ecx, ebx
jmp 0x1404cabb0
test rax, rax
jmp 0x1404cabb8
je 0x1404cabd5
add rsp, 0x20
movsx ebx, si
movsxd rbx, r12d
pop rbx
jmp 0x1404cabce
push qword [0x1400b8d90]
ret
add rsp, 0x20
cmovge rbx, rsi
movzx ebx, r9w
movzx bx, spl
pop rbx
jmp 0x1404cabec
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404cabf3
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
rcl r8b, 0xd5
bsf rbx, rcx
shld r8w, dx, 0xee
push rdi
shl rdi, 0x18
btr rdi, r9
sar bx, cl
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c63d8]
setl dil
movzx rdx, dx
mov edi, ecx
lea rdx, [0x1400cf748]
movsx cx, r14b
bswap r8d
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404cac4a
call fcn.1404cba6c
mov rdx, rbx
sbb cx, dx
mov ecx, edi
cmp r9b, 0x4a
test rax, rax
jmp 0x1404cac63
je 0x1404cac74
call qword [0x1400b8d90]
jmp 0x1404cac7a
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
rcl di, 0x37
bts rdi, rbx
add rsp, 0x20
mov di, 0x50bd
bswap di
movsx rdi, r8w
pop rdi
jmp 0x1404cac9c
ret

Function at 0x1404cadea
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
test r9w, 0x57bf
mov qword [rsp + 0x18], rsi
sar rbp, cl
shl si, cl
push rdi
sub dil, 0x16
rcl bx, cl
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
setne r9b
mov si, r15w
xchg r8b, bpl
mov esi, edx
movzx edx, r11w
lea r9, [0x1400c63e8]
movsx dx, dl
movzx rbp, r9w
cwd
mov rbp, rcx
lea r8, [0x1400c63e0]
not ch
lea rdx, [0x1400cf190]
seta ch
mov ecx, eax
mov ch, 0xbc
mov ecx, 0xb
jmp 0x1404cae5e
call fcn.1404cba6c
mov rcx, rbp
cmp r12, 0x23585c9e
test rax, rax
je 0x1404cae91
mov r9d, ebx
mov r8d, r13d
mov r8, rdi
mov edx, esi
jmp 0x1404cae86
call qword [0x1400b8d90]
jmp 0x1404caec8
sub edx, edx
jmp 0x1404cae98
call fcn.1404cb544
mov ecx, eax
movsx r9d, cx
mov r9d, ebx
xchg r8b, r8b
not r8d
jmp 0x1404caeb1
mov r8, rdi
movsx rdx, r14w
movzx edx, ax
mov edx, esi
jmp 0x1404caec2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov bpl, r15b
mov dil, 0x97
mov rbp, qword [rsp + 0x48]
shrd esi, r11d, 0x96
or si, r8w
rcl edi, cl
mov rsi, qword [rsp + 0x50]
or rdi, r8
rcl di, 0x24
movsxd rdi, esp
add rsp, 0x30
setl dil
pop rdi
jmp 0x1404caf00
ret
Function at 0x1404cecc2
Capabilities:
Check for software breakpoints

Disassembly:
mov rax, rsp
rcr rcx, 0x24
shrd cx, sp, 0xfc
movsxd rcx, r9d
mov qword [rax + 8], rbx
btr rbx, rsi
sal rcx, cl
bsf cx, r14w
mov qword [rax + 0x10], rbp
sal rcx, cl
bt cx, ax
mov qword [rax + 0x18], rsi
sal cl, 0x97
btr bx, 5
mov qword [rax + 0x20], rdi
adc di, 0x7e0d
push r14
cbw
sub rsp, 0x20
jmp 0x1404ced13
xor esi, esi
and dil, al
sar bh, 0xea
sal al, 0x99
xor r14d, r14d
clc
adc dil, 0x6d
bt rax, r9
movsxd rcx, esi
sub al, r10b
lea rdi, [0x1400ba940]
rol bx, cl
mov rax, rcx
and ecx, 0x3f
sar rax, 6
bt bx, r11w
sets bh
shl ebx, 0xd5
lea rbx, [rcx + rcx*8]
mov rdi, qword [rdi + rax*8]
cbw
mov rax, qword [rdi + rbx*8 + 0x28]
test ebx, 0x380f0903
cmp r11, r12
cmp sil, 0xcd
add rax, 2
jmp 0x1404ced74
cmp rax, 1
jmp 0x1404ced7d
jbe 0x1404ced92
or byte [rdi + rbx*8 + 0x38], 0x80
jmp 0x1404ced8d
jmp 0x1404ceeba
mov byte [rdi + rbx*8 + 0x38], 0x81
rcr cx, cl
and cx, r9w
mov ecx, esi
stc
test esi, esi
jmp 0x1404ceda8
je 0x1404cede7
sub ecx, 1
jmp 0x1404cedb6
je 0x1404cedd8
cmp ecx, 1
sete ch
mov ch, 0x33
movsx rcx, si
mov ecx, 0xfffffff4
jmp 0x1404cedd3
jmp 0x1404cedec
mov ecx, 0xfffffff5
jmp 0x1404cede2
jmp 0x1404cedec
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
rcr cx, cl
shl ch, 0x9e
lea rcx, [rax + 1]
cmc
cmp rcx, 1
jmp 0x1404cee09
jbe 0x1404cee22
mov rcx, rax
jmp 0x1404cee17
call qword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1404cee24
sub eax, eax
test eax, eax
jmp 0x1404cee2b
je 0x1404cee76
movzx ecx, al
cmc
stc
mov qword [rdi + rbx*8 + 0x28], rbp
test r10w, 0x51e5
cmp ecx, 2
jmp 0x1404cee49
jne 0x1404cee59
or byte [rdi + rbx*8 + 0x38], 0x40
jmp 0x1404ceeba
cmp ecx, 3
jmp 0x1404cee61
jne 0x1404ceeba
or byte [rdi + rbx*8 + 0x38], 8
jmp 0x1404cee71
jmp 0x1404ceeba
or byte [rdi + rbx*8 + 0x38], 0x40
test r12, 0x788a6379
mov qword [rdi + rbx*8 + 0x28], 0xfffffffffffffffe
shld ax, r12w, 0x83
mov rax, qword [0x1400ba160]
test esi, r8d
clc
test rax, rax
jmp 0x1404ceea4
je 0x1404ceeba
mov rax, qword [r14 + rax]
mov dword [rax + 0x18], 0xfffffffe
jmp 0x1404ceeba
inc esi
add r14, 8
cmp esi, 3
jne 0x1404ced2a
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
or di, r11w
cmovno si, bx
shr rsi, 0x72
mov rsi, qword [rsp + 0x40]
stc
not dil
mov rdi, qword [rsp + 0x48]
and r14d, edx
rcr r14w, cl
add rsp, 0x20
movzx r14d, r9w
movsxd r14, eax
pop r14
ret
Function at 0x1404d571f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test sil, r14b
setl dl
push rdi
sub rsp, 0x20
mov rdx, qword [rcx]
bswap rbx
cmp r12w, 0x7708
or r8, 0xffffffffffffffff
rcr bl, cl
test esp, r13d
mov rbx, rcx
xor edi, edi
movsx rcx, bp
movzx rcx, bp
jmp 0x1404d5756
mov rcx, r8
jmp 0x1404d575e
inc rcx
cmc
jmp 0x1404d5767
cmp word [rdx + rcx*2], di
jmp 0x1404d5770
jne 0x1404d575e
mov eax, edi
sbb al, dil
inc al
cmp rcx, 3
mov al, 0xa5
sete al
jmp 0x1404d578b
mov dword [rbx + 0x18], eax
mov rax, qword [rbx + 8]
jmp 0x1404d5797
inc r8
cmp word [rax + r8*2], di
jne 0x1404d5797
cmp r8, 3
mov eax, 0x33e12699
movzx rax, r10w
movsx ax, sil
mov eax, edi
sete al
mov dword [rbx + 0x1c], eax
jmp 0x1404d57c6
cmp rcx, 3
jne 0x1404d57df
mov ecx, 2
jmp 0x1404d57da
jmp 0x1404d5863
mov r9d, edi
cmp dx, 0x4664
test rdx, rdx
jmp 0x1404d57ef
jne 0x1404d5801
mov ecx, edi
jmp 0x1404d57fc
jmp 0x1404d5863
mov ecx, 2
bsr r8w, r12w
movzx r8d, word [rdx]
shrd rax, r12, 0xf
sbb rax, rsp
lea rdx, [rdx + rcx]
rol eax, cl
and al, 0x99
mov ax, r13w
lea eax, [r8 - 0x41]
test r12b, 0x6a
cmp ch, 0x95
cmp ax, 0x19
jmp 0x1404d5837
jbe 0x1404d584d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1404d585a
inc r9d
jmp 0x1404d5855
jmp 0x1404d580b
mov ecx, r9d
test r9b, spl
movzx edx, cx
xor r9d, r9d
rcl dx, 0xb5
xor rdx, 0xc9d0180
adc dl, al
mov dword [rbx + 0x14], ecx
movsx ecx, r12w
shr ch, 0x34
sub r8d, r8d
movsx edx, r11w
movzx dx, r14b
lea rcx, [0x1400ab3bc]
not dh
movzx dx, r15b
cqo
lea edx, [r9 + 3]
jmp 0x1404d58a2
call fcn.1404ca923
mov ecx, dword [rbx + 0x10]
sbb al, 0xaf
or al, dl
test cl, 7
jmp 0x1404d58b9
setne dl
bt ecx, 9
setb al
cmp r13b, 0x5d
and dl, al
bt ecx, 8
setb al
test al, dl
jmp 0x1404d58d7
jne 0x1404d58e7
mov dword [rbx + 0x10], edi
bts di, di
shr edi, 0xd9
mov rbx, qword [rsp + 0x30]
mov dil, r14b
movsxd rdi, r11d
add rsp, 0x20
movzx di, spl
not dil
bswap di
pop rdi
jmp 0x1404d5907
ret