joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14049f8a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
cmp bl, 0xf8
mov qword [rax + 0x18], rbp
movsx bp, r13b
rcr bpl, 0xa
mov qword [rax + 0x20], rsi
mov sil, r9b
cmp bl, sil
movsx ebp, bp
push rdi
mov edi, edi
or bpl, bl
push r14
push r15
adc dil, 0x87
bsf r14d, esi
shr sil, cl
sub rsp, 0x20
shr r15b, 0x59
btr si, 0x2a
test rdx, rdx
lea r14, [rax + 8]
mov rbp, rcx
bswap esi
movzx di, r15b
mov rdi, rcx
movsx esi, cx
mov sil, r10b
movzx ecx, byte [rcx]
not r15w
movzx r15w, r8b
bswap r15w
cmovne r14, rdx
movzx r15d, bp
movsxd r15, r15d
mov r15, r9
xchg sil, sil
cmovae si, r13w
mov rsi, r12
mov esi, r8d
jmp 0x14049f945
inc rdi
movsxd rcx, r11d
not ecx
movzx ecx, byte [rdi]
call fcn.1404b8cf1
test eax, eax
jne 0x14049f93a
mov bl, byte [rdi]
lea eax, [rbx - 0x2b]
cmp r12w, 0x1665
jmp 0x14049f962
test al, 0xfd
jmp 0x14049f969
je 0x14049f976
mov bl, 0x2b
jmp 0x14049f97b
inc rdi
cwd
mov r9, r15
jmp 0x14049f983
mov r8d, esi
xchg ecx, ecx
mov ch, 0x14
mov rdx, r14
mov rcx, rdi
jmp 0x14049f996
call fcn.14049fac3
mov ecx, eax
bsf rsi, rdx
ror si, 0xc5
mov esi, 0x7fffffff
cmp rdi, qword [r14]
jmp 0x14049f9b2
jne 0x14049f9c5
mov qword [r14], rbp
jmp 0x14049f9c0
jmp 0x14049f9d3
cmp rbp, qword [r14]
jmp 0x14049f9cd
jne 0x14049f9e0
test ecx, ecx
jmp 0x14049f9da
jne 0x14049fa1a
cmp bl, 0x2b
jmp 0x14049f9e8
jne 0x14049f9fb
cmp ecx, esi
jmp 0x14049f9f5
ja 0x14049fa1a
cmp bl, 0x2d
jmp 0x14049fa03
jne 0x14049fa5d
cmp ecx, 0x80000000
jmp 0x14049fa14
jbe 0x14049fa5d
call fcn.1404b60e7
mov dword [rax], 0x22
test r15, r15
jmp 0x14049fa2d
je 0x14049fa40
mov dword [r15], 1
rol al, cl
stc
rcl eax, 0x94
mov eax, 0x80000000
cmp r14w, 0x7e07
cmp bl, 0x2d
cmove esi, eax
mov eax, esi
jmp 0x14049fa58
jmp 0x14049fa85
neg eax
sar bpl, cl
not bp
cmp bl, 0x2d
setno sil
cmove ecx, eax
cmc
cmp r10b, spl
movzx ebx, r9w
mov eax, ecx
jmp 0x14049fa85
mov rbx, qword [rsp + 0x48]
adc r14w, dx
mov rbp, qword [rsp + 0x50]
cmove r15, r10
xor r15d, r8d
mov rsi, qword [rsp + 0x58]
cmc
add rsp, 0x20
movzx rdi, sp
movzx r14w, r15b
pop r15
jmp 0x14049faba
pop r14
pop rdi
jmp 0x14049fac2
ret
Function at 0x14049fef7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
clc
test r8w, r9w
mov qword [rsp + 0x18], rbp
movsxd rbp, esp
or bpl, 0xe2
cmp bl, ah
push rsi
cmp dl, r11b
or sil, dil
adc esi, r10d
push rdi
inc bpl
shld di, si, 0xba
push r12
bsf esi, r11d
cmovs ebp, r13d
xor bpl, 0xbb
push r14
sal sil, cl
mov bpl, 0xdb
adc r14b, 0xb3
push r15
sub rsp, 0x20
test rdx, rdx
movzx r14d, cx
movsx ebp, r9w
movsxd rsi, r12d
lea r14, [rsp + 0x50]
mov r15b, r12b
mov rsi, rcx
mov rdi, rcx
movsx bp, r8b
movzx ecx, byte [rcx]
not r15w
movsx ebp, r8w
cmovne r14, rdx
sete bpl
xchg r15d, r15d
mov r15, r9
jmp 0x14049ff81
mov ebp, r8d
jmp 0x14049ff89
jmp 0x14049ff9d
inc rdi
movsx rcx, di
movzx ecx, byte [rdi]
jmp 0x14049ff9d
call fcn.1404b8cf1
test eax, eax
jmp 0x14049ffa9
jne 0x14049ff8e
mov bl, byte [rdi]
test di, bp
xor ah, 0xcc
lea eax, [rbx - 0x2b]
cmp r13w, sp
test al, 0xfd
jmp 0x14049ffc5
je 0x14049ffd7
mov bl, 0x2b
jmp 0x14049ffd2
jmp 0x14049ffe0
inc rdi
movzx ecx, bp
mov r8b, 0xd5
mov r9, r15
bswap edx
mov r8d, ebp
mov dl, r14b
mov rdx, 0x9c95436
mov rdx, r14
xchg ecx, ecx
movsxd rcx, esi
movsx rcx, sp
mov rcx, rdi
jmp 0x1404a0006
call fcn.1404a0133
mov rcx, rax
mov bpl, 0x2d
adc r12b, bl
add r12, 0x58b20556
test rax, r15
movabs r12, 0x8000000000000000
cmp rdi, qword [r14]
jne 0x1404a003e
mov qword [r14], rsi
jmp 0x1404a0039
jmp 0x1404a004c
cmp rsi, qword [r14]
jmp 0x1404a0046
jne 0x1404a005a
test rcx, rcx
jmp 0x1404a0054
jne 0x1404a0092
cmp bl, 0x2b
jne 0x1404a0076
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1404a0092
cmp bl, bpl
jmp 0x1404a007e
jne 0x1404a00c9
cmp rcx, r12
jmp 0x1404a008c
jbe 0x1404a00c9
call fcn.1404b60e7
mov dword [rax], 0x22
test r15, r15
je 0x1404a00ae
mov dword [r15], 1
stc
sub bl, bpl
cmc
neg bl
jmp 0x1404a00b9
sbb rax, rax
add rax, r12
jmp 0x1404a00c4
jmp 0x1404a00f7
mov rax, rcx
sub rsi, 0x497d0133
adc r15b, dl
jmp 0x1404a00db
neg rax
clc
cmp bl, bpl
cmova ebp, r15d
movzx r15, r12w
cmove rcx, rax
xchg rsi, rsi
mov rax, rcx
cmp ah, 0xb1
mov rbx, qword [rsp + 0x58]
rcl r14b, cl
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
mov si, 0x16a8
pop r15
movsx r14w, r9b
mov r14b, 0x53
seta r12b
pop r14
mov dil, sil
seta dil
pop r12
pop rdi
cmovb esi, ebx
movsxd rsi, edi
pop rsi
jmp 0x1404a0132
ret

Function at 0x1404a10eb
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp dl, 0x52
cmc
and dword [rsp + 0x30], 0
jmp 0x1404a10fd
call fcn.1404ab42c
mov r9d, 2
movsx rcx, r9w
lea r8, [rsp + 0x30]
movsx edx, sp
mov cl, r9b
mov rcx, qword [rax + 0x28]
xchg dh, dh
mov dl, 0xf0
lea edx, [r9 + 0x20]
jmp 0x1404a1128
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
stc
sub ecx, 0x30
jmp 0x1404a113c
je 0x1404a1183
sub ecx, 1
jmp 0x1404a114a
je 0x1404a1174
cmp ecx, 1
jmp 0x1404a1158
je 0x1404a116a
sub eax, eax
jmp 0x1404a1165
jmp 0x1404a1189
mov eax, 3
jmp 0x1404a1189
mov eax, 1
jmp 0x1404a117e
jmp 0x1404a1189
mov eax, 2
cmc
add rsp, 0x28
jmp 0x1404a1192
ret
Function at 0x1404a1e1d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
movsx ebx, di
sbb bx, 0x53c7
rol bl, 0x74
push rsi
btc rbx, r8
sbb ebx, esp
push rdi
sub rsp, 0x40
mov bl, 0xf1
mov rbx, rcx
jmp 0x1404a1e40
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rsi, qword [rbx + 0xf8]
inc edx
neg dx
sbb dl, r14b
xor edi, edi
xor cl, 0x80
or rcx, 0x207f6cda
cmc
xor r8d, r8d
movzx ecx, r12w
movzx cx, spl
cdq
lea rdx, [rsp + 0x60]
mov rcx, rsi
jmp 0x1404a1e7c
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
jmp 0x1404a1e8a
je 0x1404a1f08
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
movzx r8w, r11b
sal r8d, 0x84
shl r9b, 0x45
mov r9, rax
mov qword [rsp + 0x30], rcx
rol r8b, 0xc3
bsr r8, r8
movsx rcx, r10w
mov r8, rsi
xchg ch, ch
cmp r13b, bl
lea rcx, [rsp + 0x70]
cmc
cmp r13b, bl
mov qword [rsp + 0x28], rcx
cmp r15w, sp
jmp 0x1404a1ee0
xor ecx, ecx
jmp 0x1404a1ee7
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
inc edi
jmp 0x1404a1efa
cmp edi, 2
jmp 0x1404a1f02
jl 0x1404a1e62
add rsp, 0x40
jmp 0x1404a1f1a
pop rdi
movsx esi, cx
pop rsi
movzx ebx, di
movsx rbx, r10w
movsx bx, r15b
pop rbx
jmp 0x1404a1f31
ret

Function at 0x1404a1f32
Capabilities:
Terminate process

Disassembly:
push rbx
cmp ebp, r12d
adc bx, 0x2b5b
sub rsp, 0x20
movzx rbx, ax
jmp 0x1404a1f4a
mov rbx, rcx
test r13b, r11b
test ch, 0x4f
cmp r15b, r10b
sub ecx, ecx
jmp 0x1404a1f5d
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a1f6b
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or dl, r12b
cqo
mov edx, 0xc0000409
movzx rbx, r12w
test r9w, 0x7601
stc
add rsp, 0x20
movsx rbx, dx
bswap rbx
pop rbx
jmp 0x1404a1fa0
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404adec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
shr eax, cl
not bx
mov qword [rsp + 0x18], rsi
push rdi
neg ax
sar ah, cl
stc
sub rsp, 0x50
cmp ax, r8w
movsxd rbx, r8d
mov rax, qword [0x1400b7288]
rcr bx, cl
neg bx
test rbx, rax
xor rax, rsp
shrd ebx, eax, 0xb6
rcl bl, cl
mov qword [rsp + 0x40], rax
adc bx, r11w
cmp byte [rcx + 0x54], 0
movsxd rbx, r14d
seta bl
mov rbx, rcx
jmp 0x1404adf15
je 0x1404ae017
cmp dword [rcx + 0x50], 0
jmp 0x1404adf24
jle 0x1404ae017
mov rsi, qword [rcx + 0x48]
shr r9b, cl
xor edi, edi
xor r8b, r8b
mov rax, qword [rbx + 8]
not dl
sar r8b, 0xbe
xchg r8, r8
lea rdx, [rsp + 0x34]
sbb r8b, r10b
movzx r9d, word [rsi]
bt ecx, r10d
jmp 0x1404adf58
lea rcx, [rsp + 0x30]
movzx r8, r13w
and dword [rsp + 0x30], 0
mov r8d, 0x30810b0a
movzx r8d, dx
movsx r8, r15w
lea rsi, [rsi + 2]
mov r8d, 6
jmp 0x1404adf83
mov qword [rsp + 0x20], rax
jmp 0x1404adf8d
call fcn.1404d1889
test eax, eax
jmp 0x1404adf99
jne 0x1404ae009
mov r8d, dword [rsp + 0x30]
test spl, 0xbc
cmp r8d, r9d
test r8d, r8d
jmp 0x1404adfb3
je 0x1404ae009
lea rax, [rbx + 0x10]
mov r9, 0x7518577d
lea r9, [rbx + 0x28]
movzx cx, r11b
movsx edx, r8w
mov qword [rsp + 0x20], rax
movsx rdx, si
not ecx
lea rcx, [rbx + 0x468]
bswap dx
lea rdx, [rsp + 0x34]
jmp 0x1404adff0
call fcn.1404ac31d
inc edi
test r13b, 0x3d
cmp edi, dword [rbx + 0x50]
jne 0x1404adf36
jmp 0x1404ae04d
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ae012
jmp 0x1404ae04d
mov r8d, dword [rbx + 0x50]
mov rax, r15
lea rax, [rcx + 0x10]
xadd dl, r9b
btc edx, 0xe1
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
jmp 0x1404ae037
add rcx, 0x468
jmp 0x1404ae043
mov qword [rsp + 0x20], rax
call fcn.1404ac31d
mov al, 1
sete cl
movsx cx, r9b
mov rcx, qword [rsp + 0x40]
clc
xor rcx, rsp
jmp 0x1404ae065
call fcn.1404a07bb
mov rbx, qword [rsp + 0x68]
bt rdi, 0xaa
shr edi, cl
xadd si, si
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp 0x1404ae089
ret
Function at 0x1404b1843
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, edx
shl si, cl
mov rsi, rcx
jmp 0x1404b1866
test r8, r8
jmp 0x1404b186e
jne 0x1404b1895
call fcn.1404b60e7
mov dword [rax], 0x16
jmp 0x1404b1884
call fcn.1404b6d9b
sub eax, eax
jmp 0x1404b1890
jmp 0x1404b1991
mov rdx, r9
mov rcx, r8
jmp 0x1404b18a0
call fcn.1404b19f8
mov rbx, rax
test r13b, 0x60
jmp 0x1404b18b2
test rax, rax
jmp 0x1404b18ba
je 0x1404b193d
lea rax, [rsp + 0x50]
cmova r8d, r9d
mov rdx, rdi
movzx r9d, r10w
not r8b
mov qword [rsp + 0x28], rax
not r9b
movsx eax, dx
lea r8, [0x140094b24]
movsx cx, r15b
mov rax, rbx
mov eax, dword [rsp + 0x60]
movsx rcx, bp
movzx rcx, sp
jmp 0x1404b18fe
mov r9, rbx
cmovne rcx, rbp
mov rcx, r12
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404b1914
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b1925
jne 0x1404b19bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b1938
call fcn.1404b6162
sub edi, edi
test rbx, rbx
je 0x1404b1986
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jmp 0x1404b1954
je 0x1404b1960
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
stc
test rcx, rcx
jmp 0x1404b196d
je 0x1404b1979
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b1981
call fcn.1404ca156
mov rax, rdi
test bl, r9b
bt di, 0xc1
mov rbx, qword [rsp + 0x40]
movzx esi, r15w
mov rsi, qword [rsp + 0x48]
rol dil, cl
add rsp, 0x30
bswap di
mov rdi, 0x5b1d5186
seta dil
pop rdi
jmp 0x1404b19ba
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jmp 0x1404b19c8
je 0x1404b19dd
mov eax, dword [rsp + 0x50]
clc
jmp 0x1404b19d9
mov dword [rcx], eax
cmp al, 0x59
xor ebx, ebx
jmp 0x1404b193f

Function at 0x1404b1c77
Capabilities:
Terminate process

Disassembly:
push rbx
neg rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404b1c87
call fcn.1404d3889
cmp eax, 1
jmp 0x1404b1c94
je 0x1404b1cd1
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
stc
shr edx, 8
jmp 0x1404b1cb2
test dl, 1
jmp 0x1404b1cba
jne 0x1404b1cd1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b1cd8
call fcn.1404b1bdf
mov ecx, ebx
jmp 0x1404b1ce4
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b6e2f
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b6e45
je 0x1404b6e57
mov ecx, 5
int 0x29
jmp 0x1404b6e57
mov r8d, 1
mov edx, 0xc0000417
movsx ecx, cx
movzx ecx, dx
lea ecx, [r8 + 1]
jmp 0x1404b6e71
call fcn.1404b6e99
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
btc dx, 0xf1
cmp ah, 0xc7
mov edx, 0xc0000417
clc
cmc
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1404ba150
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmc
clc
neg rcx
clc
test r12w, dx
test r8b, 0x6b
test rax, 7
jmp 0x1404ba16c
je 0x1404ba19c
nop
jmp 0x1404ba179
mov dl, byte [rax]
jmp 0x1404ba180
inc rax
cmc
cmp r12, rsi
test dl, dl
jmp 0x1404ba18e
je 0x1404ba268
test al, 7
jne 0x1404ba179
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
setbe r9b
bts r9, rbx
mov r9, r8
cmp r9w, 0x1f6b
add rax, 8
test r15w, r8w
test dx, 0x2bda
add r9, rdx
test r15b, r15b
not rdx
xor rdx, r9
clc
test rsp, r13
and rdx, r11
je 0x1404ba1b0
mov rdx, qword [rax - 8]
test r12b, 0x73
cmp r13b, r8b
test dl, dl
jmp 0x1404ba1fc
je 0x1404ba2ab
test dh, dh
jmp 0x1404ba209
je 0x1404ba2a5
shr rdx, 0x10
test r14w, 0x3da7
test dl, dl
je 0x1404ba29a
test dh, dh
jmp 0x1404ba228
je 0x1404ba28f
shr rdx, 0x10
stc
test dl, dl
je 0x1404ba289
test dh, dh
je 0x1404ba27e
shr edx, 0x10
jmp 0x1404ba24e
test dl, dl
jmp 0x1404ba255
je 0x1404ba273
test dh, dh
jmp 0x1404ba262
jne 0x1404ba1b0
lea rax, [rax + rcx - 1]
jmp 0x1404ba272
ret
lea rax, [rax + rcx - 2]
jmp 0x1404ba27d
ret
lea rax, [rax + rcx - 3]
jmp 0x1404ba288
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
jmp 0x1404ba299
ret
lea rax, [rax + rcx - 6]
jmp 0x1404ba2a4
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
jmp 0x1404ba2b5
ret
Function at 0x1404c4729
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
bswap rbx
bts bx, cx
btr r10d, 0x62
mov qword [rax + 0x10], rbp
sar rbx, 0x60
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
rol r10b, 0xec
cmc
cmove r10w, cx
push r14
ror r10b, cl
add r10b, bpl
or ebp, 0xffffffff
mov rbx, r8
btc r10w, r8w
rcr r10, cl
movsxd r10, ecx
cmp dword [rcx + 0x10], 0
jmp 0x1404c477c
mov r10, rdx
jmp 0x1404c4784
je 0x1404c48f6
movsxd r9, dword [rcx + 0x10]
sal di, 0xaa
movsx di, r13b
lea r14, [0x140000000]
add al, 0x8d
shl r11b, 0xe9
mov rdi, qword [rdx + 8]
sal r11b, cl
xor esi, esi
add r11b, spl
stc
cmovns dx, sp
lea r9, [r9 + rdi]
bsf rdx, r9
xor r8d, r8d
rdtsc
xadd r11, rdx
mov edx, ebp
cmc
or ah, dh
cmp dh, cl
movzx ecx, byte [r9]
mov ah, 0x4c
and ecx, 0xf
rcr ah, cl
inc ax
rcl r11d, cl
movsx rax, byte [rcx + r14 + 0xc1a30]
movzx r11, r14w
mov cl, byte [rcx + r14 + 0xc1a40]
xadd r11b, r11b
sub r9, rax
mov r11d, dword [r9 - 4]
shr r11d, cl
test sil, 0xc9
stc
cmc
test r11d, r11d
jmp 0x1404c4810
je 0x1404c48f6
mov rax, qword [r10 + 0x10]
mov r10d, dword [rax]
cmp bpl, 0x7a
sbb cx, r15w
movzx ecx, byte [r9]
or eax, 0xa8105b8
and al, sil
mov ax, r13w
and ecx, 0xf
sbb al, 0x6d
movsx rax, byte [rcx + r14 + 0xc1a30]
test r13b, bl
mov cl, byte [rcx + r14 + 0xc1a40]
test esp, ecx
sub r9, rax
xor ax, 0x487c
mov eax, dword [r9 - 4]
shr eax, cl
test sil, 0xd0
cmp bh, 0x8e
add esi, eax
bt ax, 0xfd
adc ah, 0x50
cmp r11b, r8b
mov eax, esi
add rax, r10
stc
add rax, rdi
clc
cmp rbx, rax
jmp 0x1404c4883
jb 0x1404c48e5
movzx ecx, byte [r9]
cwde
xchg dx, ax
movsx eax, r10w
inc r8d
inc dl
movsx rdx, bx
cdqe
and ecx, 0xf
neg ah
movsx rax, byte [rcx + r14 + 0xc1a30]
cqo
mov cl, byte [rcx + r14 + 0xc1a40]
sub r9, rax
cmp bx, r10w
bt edx, esp
neg edx
mov edx, dword [r9 - 4]
shr edx, cl
jmp 0x1404c48ce
dec edx
clc
jmp 0x1404c48d7
cmp r8d, r11d
jmp 0x1404c48df
jb 0x1404c4825
test r8d, r8d
cmove edx, ebp
movzx eax, r15w
mov eax, edx
jmp 0x1404c48f8
mov eax, ebp
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
movzx r14d, r14w
mov rsi, qword [rsp + 0x20]
mov rdi, r10
mov rdi, qword [rsp + 0x28]
movzx r14d, r14w
movsx r14, bx
mov r14b, 0x3e
pop r14
ret

Function at 0x1404cb7dc
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
shrd bx, r14w, 0xee
movsxd r9, edi
push rdi
sub rsp, 0x20
mov rbx, rdx
movzx r9, cx
lea r9, [0x1400c63d8]
cmovnp rdx, r11
mov edi, ecx
bswap cx
lea rdx, [0x1400cf748]
movsxd rcx, ecx
movzx cx, r15b
mov ecx, 6
cmovge r8d, ebx
setle r8b
movzx r8w, r9b
lea r8, [0x1400c63d0]
jmp 0x1404cb833
call fcn.1404cc69b
mov rdx, rbx
adc cx, bp
sbb cl, r10b
cmovnp rcx, rcx
mov ecx, edi
stc
cmp r15w, 0x2365
test rax, rax
jmp 0x1404cb856
je 0x1404cb867
call qword [0x1400b8d90]
jmp 0x1404cb86d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1404cb87c
ret
Function at 0x1404cba0a
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
movsx rbx, r13w
adc bl, 0xf7
add bl, sil
mov qword [rsp + 0x10], rbp
btr ebp, 0xb0
xor ebx, 0x5b8b5e43
mov bl, r11b
mov qword [rsp + 0x18], rsi
xadd bl, bl
push rdi
rol di, cl
dec dil
sub rsp, 0x30
xchg bl, bpl
mov ebx, r9d
mov rdi, r8
mov esi, edx
seto r8b
movzx r8d, r13w
lea r9, [0x1400c63e8]
movsx r8, r14w
movzx r8w, dl
cwd
mov rbp, rcx
movzx r8w, r9b
lea r8, [0x1400c63e0]
movsx rdx, cx
lea rdx, [0x1400cf190]
mov ecx, 0xb
call fcn.1404cc69b
mov rcx, rbp
test rdx, 0x5e163496
test rax, rax
jmp 0x1404cba99
je 0x1404cbabe
mov r9d, ebx
mov r8, rdi
mov dh, ah
jmp 0x1404cbaac
mov edx, esi
jmp 0x1404cbab3
call qword [0x1400b8d90]
jmp 0x1404cbaec
sub edx, edx
call fcn.1404cc18d
mov ecx, eax
movzx r9, sp
xchg rdx, r8
mov r9d, ebx
movzx edx, si
mov r8, rdi
mov dh, 0xc4
cqo
seta dh
mov edx, esi
jmp 0x1404cbae6
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
btc si, 0xd3
mov rbp, qword [rsp + 0x48]
movzx si, dil
sbb si, cx
mov rsi, qword [rsp + 0x50]
movsx rdi, r12w
cmp r11, rbp
add rsp, 0x30
cmovne rdi, rbx
movzx rdi, bp
mov dil, r9b
pop rdi
ret

Function at 0x1404cef42
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
jmp 0x1404cef51
push rdi
sbb sil, r10b
setge bl
not sil
sub rsp, 0x70
movsx rsi, dx
mov rsi, rdx
movsx edx, sp
mov rbx, r9
mov rdx, rcx
movsx rdi, bp
bswap di
movsx ecx, r12w
mov edi, r8d
mov cl, 0xc
movsx ecx, di
lea rcx, [rsp + 0x50]
call fcn.1404a52d5
mov eax, dword [rsp + 0xc0]
lea rcx, [rsp + 0x58]
mov r8b, 0x76
movsxd r9, ecx
mov dword [rsp + 0x40], eax
mov r9, rbx
rdtsc
movsxd r8, r12d
not r8
mov eax, dword [rsp + 0xb8]
mov r8d, edi
not dl
mov dword [rsp + 0x38], eax
rdtsc
movsx rax, r13w
jmp 0x1404cefc8
mov rdx, rsi
cmovs eax, ebx
lahf
setle al
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xa8]
jmp 0x1404cefea
mov qword [rsp + 0x28], rax
mov ax, 0x4e1e
movsx rax, r14w
jmp 0x1404ceffc
mov eax, dword [rsp + 0xa0]
jmp 0x1404cf008
mov dword [rsp + 0x20], eax
call fcn.1404cf05f
cmp byte [rsp + 0x68], 0
jmp 0x1404cf01b
je 0x1404cf02d
mov rcx, qword [rsp + 0x50]
and dword [rcx + 0x3a8], 0xfffffffd
lea r11, [rsp + 0x70]
jmp 0x1404cf03a
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, r10
cmovg di, r13w
movzx edi, r13w
mov rsp, r11
mov rdi, rsp
mov di, 0x11fc
pop rdi
jmp 0x1404cf05e
ret
Function at 0x1404cf796
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
xor cl, bl
mov qword [rax + 8], rbx
movsx rcx, r9w
bts cx, r9w
mov qword [rax + 0x10], rbp
add cx, r13w
btc rcx, r8
mov qword [rax + 0x18], rsi
stc
rcl ch, 0xb2
add cx, bp
mov qword [rax + 0x20], rdi
xadd cx, cx
push r14
not rcx
sub rsp, 0x90
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
sub r14d, r14d
test r15, 0x19bb5d86
cmp word [rsp + 0x62], r14w
je 0x1404cf952
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1404cf952
movsxd rbx, dword [rax]
clc
dec cx
not dil
lea rsi, [rax + 4]
cmovge cx, r8w
mov edi, 0x2000
lea rbx, [rbx + rsi]
movzx ecx, r13w
cmp dword [rax], edi
jmp 0x1404cf82b
cmovl edi, dword [rax]
movzx rcx, r8w
mov ecx, edi
jmp 0x1404cf839
call fcn.1400ada04
cmp edi, dword [0x1400bad40]
jmp 0x1404cf849
cmovg edi, dword [0x1400bad40]
cmc
test edi, edi
jmp 0x1404cf858
je 0x1404cf952
mov ebp, r14d
test r14b, 0x3b
cmp bp, 0x10ed
cmp qword [rbx], 0xffffffffffffffff
jmp 0x1404cf873
je 0x1404cf930
cmp qword [rbx], 0xfffffffffffffffe
je 0x1404cf930
test byte [rsi], 1
jmp 0x1404cf88b
je 0x1404cf930
test byte [rsi], 8
jmp 0x1404cf899
jne 0x1404cf8ba
mov rcx, qword [rbx]
jmp 0x1404cf8a7
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jmp 0x1404cf8b4
je 0x1404cf930
mov rax, rbp
mov ch, 0x52
setbe dh
lea r8, [0x1400ba940]
inc dx
sar dh, cl
and dx, 0x441
mov rcx, rbp
mov rdx, 0x64d56967
ror dl, cl
sar rcx, 6
jmp 0x1404cf8ee
and eax, 0x3f
movsx dx, ch
bswap edx
mov rcx, qword [r8 + rcx*8]
cqo
movzx dx, bpl
cwd
lea rdx, [rax + rax*8]
movsx rax, r10w
dec ax
mov rax, qword [rbx]
jmp 0x1404cf917
mov qword [rcx + rdx*8 + 0x28], rax
not al
dec al
mov al, byte [rsi]
jmp 0x1404cf927
mov byte [rcx + rdx*8 + 0x38], al
jmp 0x1404cf930
inc rbp
jmp 0x1404cf938
inc rsi
cmp sil, 0xfa
add rbx, 8
sub rdi, 1
jmp 0x1404cf94c
jne 0x1404cf86a
lea r11, [rsp + 0x90]
movzx rbx, r11w
xchg r14w, bx
movzx bp, r11b
mov rbx, qword [r11 + 0x10]
movzx r14w, al
movsx r14, bp
mov rbp, qword [r11 + 0x18]
bswap r14
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movsxd r14, r10d
mov rsp, r11
movzx r14d, r14w
cmove r14d, r9d
movsx r14d, ax
pop r14
ret
Function at 0x1404d841c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
shl bh, 0x45
mov qword [rsp + 0x18], rsi
mov bl, r12b
stc
neg bh
push rdi
ror edi, cl
test bl, r9b
inc bh
sub rsp, 0x20
rcr bh, 0x32
movsx di, dil
movsx edi, r12w
sub esi, esi
and bl, 0x13
inc edi
mov rdi, rdx
mov rbx, rcx
stc
clc
test rcx, rcx
jmp 0x1404d845e
je 0x1404d84f8
cmp word [rcx], si
je 0x1404d84f8
lea rdx, [0x1400d1d08]
jmp 0x1404d8479
call fcn.14023a8b8
test eax, eax
jmp 0x1404d8485
je 0x1404d84f8
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404d849a
call fcn.14023a8b8
test eax, eax
jmp 0x1404d84a6
jne 0x1404d84e6
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
not dh
movsx dx, dh
cwd
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d84d2
je 0x1404d8533
mov eax, dword [rsp + 0x30]
jmp 0x1404d84e1
jmp 0x1404d8551
mov rcx, rbx
jmp 0x1404d84ee
call fcn.1404e13bd
jmp 0x1404d8551
mov ecx, dword [rdi + 8]
cmovo r9w, r12w
movsx r8, r14w
lea r8, [rsp + 0x30]
mov r9d, 2
bswap rdx
cqo
not edx
mov edx, 0x20001004
jmp 0x1404d8520
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d852d
jne 0x1404d853a
sub eax, eax
jmp 0x1404d8551
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x1404d8545
jne 0x1404d8551
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movsxd rdi, r10d
movzx di, spl
pop rdi
jmp 0x1404d856d
ret

Function at 0x1404d856e
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
xor bl, r10b
push rdi
sub sil, dl
or sil, r9b
and bx, si
sub rsp, 0x20
mov esi, edx
mov bl, 0x82
jmp 0x1404d8592
mov ebx, ecx
call fcn.1404ca4a3
mov ecx, ebx
lea r8, [rsp + 0x30]
xadd rdx, rdx
and ecx, 0x3ff
cwd
btc di, si
bt edx, ebx
mov r9d, 2
bts ecx, 0xa
movsx di, r14b
mov dl, r15b
mov edx, 0x20000001
mov dil, 0xa3
movzx di, bpl
movsx edi, cx
mov rdi, rax
jmp 0x1404d85dd
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
cmp r15w, 0x6662
test r9, 0x2f103a2e
test eax, eax
je 0x1404d86ba
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d8604
je 0x1404d86ab
test esi, esi
je 0x1404d86ab
mov r9, qword [rdi + 0x98]
bswap ax
lahf
rcl r8b, cl
mov r8d, r10d
adc ax, di
and dh, cl
bsf dx, ax
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
test rsi, r8
cmp ax, 0x19
jbe 0x1404d865e
sub dx, 0x61
cmp r9w, ax
jmp 0x1404d8654
cmp dx, 0x19
ja 0x1404d867e
movzx edx, word [rcx]
inc r8d
cmp r14b, 0xa2
cmp rbx, r8
jmp 0x1404d8670
add rcx, 2
jmp 0x1404d8679
jmp 0x1404d8634
or rcx, 0xffffffffffffffff
jmp 0x1404d8687
inc rcx
test r10b, r10b
jmp 0x1404d8692
cmp word [r9 + rcx*2], r10w
jne 0x1404d8687
cmp r8d, ecx
jmp 0x1404d86a5
je 0x1404d86ba
mov eax, 1
jmp 0x1404d86b5
jmp 0x1404d86bc
sub eax, eax
mov rbx, qword [rsp + 0x38]
test r14b, spl
bswap rdi
mov rsi, qword [rsp + 0x40]
movsx edi, dx
add rsp, 0x20
seto dil
pop rdi
jmp 0x1404d86dd
ret