joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140457ce1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
mov al, 0x4e
push rbp
bswap eax
cmc
mov rbp, rsp
lahf
sbb bl, r9b
sal rax, cl
sub rsp, 0x20
cmp r8b, r10b
cdqe
cmp r14b, 0xa
mov rax, qword [0x1400b7288]
movzx rbx, cx
movabs rbx, 0x2b992ddfa232
stc
cmp rax, rbx
jmp 0x140457d21
jne 0x140457df4
and qword [rbp + 0x18], 0
not cx
movzx cx, r11b
lea rcx, [rbp + 0x18]
jmp 0x140457d3d
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140457d4c
mov qword [rbp + 0x10], rax
jmp 0x140457d55
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
cmp r9b, r11b
clc
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
and cl, 3
lea rcx, [rbp + 0x20]
cmc
xor qword [rbp + 0x10], rax
jmp 0x140457d7e
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
shld ecx, edx, 0x97
neg cx
lea rcx, [rbp + 0x10]
shl rax, 0x20
xor rax, qword [rbp + 0x20]
cmp spl, dl
cmp r11w, 0x53e1
test dl, r8b
xor rax, qword [rbp + 0x10]
xor bpl, r13b
shl bpl, cl
setb bpl
xor rax, rcx
test ecx, esp
xor bpl, 0x8d
movabs rcx, 0xffffffffffff
and rax, rcx
movabs rcx, 0x2b992ddfa233
shl bp, 0x83
cmp r15d, r8d
cmp rax, rbx
jmp 0x140457de7
cmove rax, rcx
shl ebx, cl
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
rol bpl, 0x9a
dec bpl
sar bp, 0xfe
not rax
stc
shr bp, cl
mov qword [0x1400b7280], rax
not bp
add rsp, 0x20
movzx bp, spl
not bp
pop rbp
jmp 0x140457e27
ret
Function at 0x140469958
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x140469972
mov qword [rax + 8], rbx
test rsp, rsp
mov qword [rax + 0x10], rbp
sbb ebp, r12d
cmc
mov qword [rax + 0x18], rsi
shrd esi, r8d, 0xd6
mov qword [rax + 0x20], rdi
btr edi, 0x73
rcr di, cl
shld si, r11w, 0x23
push r14
movsx esi, r13w
not esi
adc sil, bpl
sub rsp, 0x20
mov rsi, qword [rsp + 0x50]
bt bp, r9w
shrd rbp, rsi, 0xb6
test rsi, 0x229c624e
movzx r14d, r9w
shl bpl, 0xba
rcl bpl, cl
mov rdi, r8
sal bpl, 0xfa
sar bpl, 0xb4
mov rbp, rdx
cmp sil, 0xde
test rsi, rsi
jmp 0x1404699e5
je 0x140469aaf
mov rbx, qword [r8 + 8]
test rbx, rbx
jmp 0x1404699f7
je 0x140469a95
mov rax, qword [rbx + 0x40]
cmp r8, 0xce96d2d
cmp qword [rax], 0
jmp 0x140469a11
je 0x140469a6b
mov rax, qword [rbx + 0x58]
test r12w, 0x75ee
cmp spl, 0xc8
cmp dword [rax], 0
jle 0x140469a6b
dec dword [rax]
not dl
movsx rdx, r12w
cbw
mov rcx, qword [rbx + 0x40]
mov eax, ebx
movsx rax, di
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
bswap ax
movzx ax, bpl
movzx eax, r14w
jmp 0x140469a5d
mov word [rdx], r14w
jmp 0x140469a66
jmp 0x140469a81
mov rax, qword [rbx]
cwd
movzx edx, r14w
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x1404c7fc4.0]
mov ecx, 0xffff
cmc
cmp cx, ax
jmp 0x140469a8f
jne 0x140469aa0
mov byte [rdi], 1
jmp 0x140469aa0
sub rsi, 1
jmp 0x140469aa9
jne 0x1404699ef
movups xmm0, xmmword [rdi]
cwde
mov rbx, qword [rsp + 0x30]
mov rax, rbp
xadd esi, r14d
mov rsi, qword [rsp + 0x40]
and r14, r13
dec dil
sal di, cl
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
btc r14w, 0x1c
mov rbp, qword [rsp + 0x38]
xor r14b, 0xf5
stc
add rsp, 0x20
bswap r14
movsx r14w, cl
pop r14
jmp 0x140469afa
ret
Function at 0x140470a61
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
stc
cmc
jmp 0x140470a7a
mov qword [rax + 0x10], rbp
bsr bp, di
xor bp, di
mov qword [rax + 0x18], rsi
sar rbp, cl
mov qword [rax + 0x20], rdi
btc si, bp
push r14
sub rsp, 0x20
mov rsi, r9
and bpl, 0xaf
movzx r14d, r8w
add bpl, 0xbf
mov rdi, rdx
add bpl, r14b
mov rbp, rcx
cmp r11b, sil
cmc
jmp 0x140470abb
test r9, r9
jmp 0x140470ac3
je 0x140470b81
mov rbx, qword [rdx + 8]
test rbx, rbx
je 0x140470b69
mov rax, qword [rbx + 0x40]
cmp r14, 0x7ccd7223
cmp qword [rax], 0
jmp 0x140470aea
je 0x140470b33
mov rax, qword [rbx + 0x58]
stc
cmp dword [rax], 0
jmp 0x140470afd
jle 0x140470b33
dec dword [rax]
mov cl, 0xf6
cbw
mov rcx, qword [rbx + 0x40]
movsx edx, r12w
cdq
mov rdx, qword [rcx]
cmovnp ax, sp
lahf
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx eax, r14w
mov word [rdx], r14w
jmp 0x140470b2e
jmp 0x140470b56
mov rax, qword [rbx]
movzx edx, r14w
jmp 0x140470b3f
mov rcx, rbx
jmp 0x140470b47
mov rax, qword [rax + 0x18]
jmp 0x140470b50
call qword [case.0x1404c7fc4.0]
mov ecx, 0xffff
cmp cx, ax
jmp 0x140470b63
jne 0x140470b77
mov byte [rdi], 1
test r11w, 0x2425
jmp 0x140470b77
sub rsi, 1
jne 0x140470acd
movups xmm0, xmmword [rdi]
mov rbx, qword [rsp + 0x30]
bswap r14w
movsx r14d, cx
mov rax, rbp
bt edi, r15d
mov rsi, qword [rsp + 0x40]
sub edi, r15d
shld rdi, rbp, 0x22
cmovb rdi, r11
mov rdi, qword [rsp + 0x48]
sal r14b, 0xa6
clc
shl r14b, cl
movdqu xmmword [rbp], xmm0
shr r14b, 0x7a
mov rbp, qword [rsp + 0x38]
add r14b, 0xcc
sal r14, cl
add rsp, 0x20
movzx r14d, r8w
pop r14
ret
Function at 0x14048f52e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test spl, 0x57
mov qword [rax + 8], rbx
setl bh
movzx bx, r13b
dec bl
mov qword [rax + 0x10], rbp
adc bl, 0xcb
mov qword [rax + 0x18], rsi
cmp dil, r15b
movzx rbx, bx
mov qword [rax + 0x20], rdi
push r14
sub r14b, 0xa2
add r14b, dil
shld si, r14w, 0xa6
sub rsp, 0x20
movzx ebx, bx
mov rsi, r9
mov r14, r8
rol bx, cl
mov rbx, rdx
shl rbp, cl
mov rbp, rcx
cmp r8w, ax
cmp rdx, r8
jmp 0x14048f58d
je 0x14048f677
mov rdi, qword [r9 + 8]
test rdi, rdi
jmp 0x14048f59f
je 0x14048f65b
mov rax, qword [rdi + 0x40]
movzx r8d, word [rbx]
cmc
cmp qword [rax], 0
jmp 0x14048f5b7
je 0x14048f60b
mov rax, qword [rdi + 0x58]
cmp ax, 0x5ab1
cmp dword [rax], 0
jmp 0x14048f5cd
jle 0x14048f60b
dec dword [rax]
movsxd rdx, r13d
mov rcx, qword [rdi + 0x40]
cdq
movsx edx, r10w
not dl
mov rdx, qword [rcx]
movsxd rax, r8d
cmove rax, rcx
movzx rax, ax
lea rax, [rdx + 2]
jmp 0x14048f5fa
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x14048f606
jmp 0x14048f63f
mov rax, qword [rdi]
movsx cx, cl
movsx ecx, r10w
movzx rcx, r9w
movzx edx, r8w
mov rcx, rdi
jmp 0x14048f626
mov rax, qword [rax + 0x18]
jmp 0x14048f62f
call qword [case.0x1404c7fc4.0]
movzx r8d, ax
sar rax, 0xd5
sar al, cl
mov eax, 0xffff
test r14b, 0x7a
clc
cmp al, r9b
cmp ax, r8w
jmp 0x14048f655
jne 0x14048f665
mov byte [rsi], 1
clc
cmp r9w, 0xaad
add rbx, 2
cmp rbx, r14
jmp 0x14048f671
jne 0x14048f597
movups xmm0, xmmword [rsi]
mov rbx, qword [rsp + 0x30]
test di, di
mov rax, rbp
mov rsi, qword [rsp + 0x40]
btr di, bx
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
xor bp, ax
mov rbp, qword [rsp + 0x38]
bt r14w, dx
movsx r14, r10w
rol r14w, cl
add rsp, 0x20
bswap r14
mov r14b, r13b
pop r14
jmp 0x14048f6be
ret

Function at 0x14049d982
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x14049d990
call fcn.1404a7daf
mov r9d, 2
bswap ecx
movsxd rcx, r12d
lea r8, [rsp + 0x30]
movsx rcx, r12w
movsx cx, r12b
mov rcx, qword [rax + 0x28]
jmp 0x14049d9bb
lea edx, [r9 + 0x20]
jmp 0x14049d9c4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
jmp 0x14049d9d7
je 0x14049da23
sub ecx, 1
jmp 0x14049d9e5
je 0x14049da14
cmp ecx, 1
jmp 0x14049d9f3
je 0x14049da05
sub eax, eax
jmp 0x14049da00
jmp 0x14049da2e
mov eax, 3
jmp 0x14049da0f
jmp 0x14049da2e
mov eax, 1
jmp 0x14049da1e
jmp 0x14049da2e
mov eax, 2
cmp di, 0x100f
stc
add rsp, 0x28
ret
Function at 0x14049f1c2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
cmp rdi, rax
jmp 0x14049f1d9
mov qword [rsp + 0x18], rbp
cmp cl, r13b
jmp 0x14049f1eb
push rsi
xor rsi, r12
and sil, 0x4a
adc esi, 0x12510c04
push rdi
bt rsi, 0x7f
push r12
push r14
sal r14b, cl
bts edi, esp
btc r14d, 0xea
push r15
bts r14w, r12w
rcr dil, 0x49
btr esi, r12d
sub rsp, 0x20
movzx edi, r9w
movzx r14, cx
mov esi, dword [r8 + 0xc]
mov r12b, bpl
mov r12, rcx
cmovge rcx, r10
bswap r14w
mov rcx, r8
movsx rdi, r15w
setge r14b
mov rdi, r9
mov r15w, 0x3bd
mov r14, r8
movzx r15d, ax
not r15w
mov r15, rdx
jmp 0x14049f261
call fcn.1402469e4
mov r10, qword [r12]
mov ebp, eax
stc
mov qword [rdi], r10
test r12b, r11b
test esi, esi
jmp 0x14049f27a
je 0x14049f38a
movsxd rax, dword [r14 + 0x10]
mov bl, dil
or ecx, r15d
sub bx, 0x23b6
lea ecx, [rsi - 1]
mov esi, ecx
not ebx
lea rcx, [rcx + rcx*4]
lea rbx, [rax + rcx*4]
add rbx, qword [r15 + 8]
stc
test r13w, r14w
cmp ebp, dword [rbx + 4]
jmp 0x14049f2af
jle 0x14049f273
cmp ebp, dword [rbx + 8]
jmp 0x14049f2bd
jg 0x14049f273
mov rcx, qword [r15]
rcr dx, cl
lea rdx, [rsp + 0x50]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
shrd r9w, r15w, 2
xor ecx, ecx
add r8, qword [rsp + 0x50]
bt r9d, 0x26
bswap r9d
dec r9b
mov r9d, dword [rbx + 0xc]
or r10b, dl
mov r10d, dword [rax]
cmp r8b, 0xa5
clc
test dx, r13w
test r9d, r9d
jmp 0x14049f30e
je 0x14049f34b
lea rdx, [r8 + 0xc]
movsxd rax, eax
adc al, sil
btr ax, cx
movsxd rax, dword [rdx]
stc
jmp 0x14049f32e
cmp rax, r10
jmp 0x14049f336
je 0x14049f34b
inc ecx
add rdx, 0x14
cmp ecx, r9d
jb 0x14049f322
cmp ecx, r9d
jmp 0x14049f353
jae 0x14049f273
mov rax, qword [r12]
and r15, r14
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
sal r14w, 0xaf
sar r12, cl
shl bpl, 0x3b
mov rcx, qword [rcx + rax]
shr sil, cl
movsx r12w, bl
btr r14w, 0x63
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x58]
movsx r12, di
rol r15d, 0x42
mov rax, rdi
or r12b, r8b
mov rbp, qword [rsp + 0x60]
adc rdi, 0x914797
not r12w
movzx r15w, r8b
add rsp, 0x20
movsx r15, r14w
mov r12b, dl
pop r15
cmovnp rdi, rsp
movzx r12, r10w
pop r14
cmovl esi, ebp
movzx di, cl
movsx rdi, bx
pop r12
bswap di
pop rdi
pop rsi
ret
Function at 0x1404aa8fb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
rcr bl, cl
mov qword [rsp + 0x18], rsi
push rdi
sal rbx, cl
bsr eax, r12d
sub rsp, 0x50
sal bl, cl
clc
mov rax, qword [0x1400b7288]
dec rbx
xor rax, rsp
rcl rbx, cl
mov qword [rsp + 0x40], rax
btc bx, r11w
btc ebx, 0xdf
cmp spl, bl
cmp byte [rcx + 0x54], 0
movzx bx, bpl
mov rbx, rcx
jmp 0x1404aa948
je 0x1404aaa3b
cmp dword [rcx + 0x50], 0
jmp 0x1404aa957
jle 0x1404aaa3b
mov rsi, qword [rcx + 0x48]
cbw
test edx, esi
mov r8w, r11w
sub edi, edi
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x34]
add r9b, r10b
adc r8b, r13b
movzx r9d, word [rsi]
lea rcx, [rsp + 0x30]
sbb r8, 0x6bb257fe
and dword [rsp + 0x30], 0
mov r8w, r9w
movsx r8w, r10b
not r8b
lea rsi, [rsi + 2]
movsxd r8, r11d
sets r8b
movzx r8w, r10b
mov r8d, 6
jmp 0x1404aa9b6
mov qword [rsp + 0x20], rax
jmp 0x1404aa9c0
call fcn.1404ce130
test eax, eax
jmp 0x1404aa9cc
jne 0x1404aaa2d
mov r8d, dword [rsp + 0x30]
test r13w, 0x919
test r8d, r8d
jmp 0x1404aa9e5
je 0x1404aaa2d
lea rax, [rbx + 0x10]
lea r9, [rbx + 0x28]
movsx dx, bpl
cmovno edx, ecx
cqo
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
movzx dx, bpl
lea rdx, [rsp + 0x34]
jmp 0x1404aaa18
call fcn.1404a8d56
inc edi
cmp edi, dword [rbx + 0x50]
jne 0x1404aa96b
jmp 0x1404aaa68
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404aaa36
jmp 0x1404aaa68
mov r8d, dword [rbx + 0x50]
shr dh, 0x2c
sbb r9w, 0x5860
lea rax, [rcx + 0x10]
mov rdx, qword [rbx + 0x48]
shl r9, cl
lea r9, [rcx + 0x28]
add rcx, 0x468
mov qword [rsp + 0x20], rax
call fcn.1404a8d56
mov al, 1
mov rcx, qword [rsp + 0x40]
stc
xor rcx, rsp
jmp 0x1404aaa78
call fcn.14049cfde
mov rbx, qword [rsp + 0x68]
clc
sal dil, 0x93
mov rsi, qword [rsp + 0x70]
bts rdi, rsp
dec di
shr di, 0x97
add rsp, 0x50
bswap di
mov di, 0x3fc
pop rdi
jmp 0x1404aaaa8
ret
Function at 0x1404ae1bf
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
stc
mov qword [rsp + 0x10], rsi
movzx si, r9b
bswap rsi
or rsi, rdi
push rdi
sal si, cl
movzx rdi, r14w
xor dil, r11b
sub rsp, 0x30
rcr sil, cl
mov edi, edx
shr si, cl
add sil, r8b
shld si, ax, 0x74
mov rsi, rcx
cmc
test r8, r8
jmp 0x1404ae200
jne 0x1404ae222
call fcn.1404b2a34
mov dword [rax], 0x16
jmp 0x1404ae216
call fcn.1404b36f7
xor eax, eax
jmp 0x1404ae322
mov rdx, r9
mov cx, dx
mov rcx, r8
jmp 0x1404ae230
call fcn.1404ae38c
mov rbx, rax
test rax, rax
jmp 0x1404ae240
je 0x1404ae2c4
lea rax, [rsp + 0x50]
movsx rdx, r13w
mov dh, cl
movzx edx, r12w
mov rdx, rdi
movsxd rcx, r11d
mov qword [rsp + 0x28], rax
jmp 0x1404ae26b
lea r8, [0x140094b24]
movsx eax, r15w
movsx r9w, dil
mov eax, dword [rsp + 0x60]
not cx
mov r9, rbx
mov cl, 0x6d
movzx cx, r8b
xchg cx, cx
mov rcx, rsi
jmp 0x1404ae297
mov dword [rsp + 0x20], eax
jmp 0x1404ae2a0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1404ae354
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404ae2bf
call fcn.1404b2ab6
sub edi, edi
cmc
test rbx, rbx
jmp 0x1404ae2cf
je 0x1404ae318
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jmp 0x1404ae2e1
je 0x1404ae2ed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test r10b, 0x4e
stc
cmc
test rcx, rcx
jmp 0x1404ae2ff
je 0x1404ae30b
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404ae313
call fcn.1404c6aa1
mov rax, rdi
rol si, cl
rcl sil, 0xe6
mov rbx, qword [rsp + 0x40]
dec dil
movsxd rdi, edi
mov rsi, qword [rsp + 0x48]
sub edi, 0x60a23a52
xchg rdi, rdi
shr dil, 0x97
add rsp, 0x30
movsx rdi, r9w
mov dil, 0x44
not dil
pop rdi
jmp 0x1404ae353
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1404ae36c
mov eax, dword [rsp + 0x50]
cmc
mov dword [rcx], eax
test r14b, dl
sub ebx, ebx
jmp 0x1404ae373
jmp 0x1404ae2c7

Function at 0x1404ae644
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404ae651
call fcn.1404d00b7
cmp eax, 1
jmp 0x1404ae65e
je 0x1404ae6ad
mov rax, qword gs:[0x60]
not dl
cmp ax, bp
mov edx, dword [rax + 0xbc]
cmp bx, r8w
shr edx, 8
cmp r14b, 6
test dl, 1
jmp 0x1404ae68b
jne 0x1404ae6ad
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dl, sil
cqo
cdq
mov edx, ebx
jmp 0x1404ae6a7
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404ae6b4
call fcn.1404ae596
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b37a8
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
bswap cx
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b37c1
je 0x1404b37d8
mov ecx, 5
jmp 0x1404b37d1
int 0x29
jmp 0x1404b37d8
mov r8d, 1
cdq
cmovle rcx, r12
mov edx, 0xc0000417
mov cl, r12b
movzx rcx, bx
lea ecx, [r8 + 1]
jmp 0x1404b37f8
call fcn.1404b3828
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
ror rdx, 0x1a
mov edx, 0xc0000417
test dil, 0x4a
jmp 0x1404b3818
add rsp, 0x28
jmp 0x1404b3821
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404c0ff5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
shl r10, 0x12
sub r10w, cx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
jmp 0x1404c100f
mov qword [rax + 0x18], rsi
cmovno ebx, edi
ror bl, cl
btc rbx, 0x72
mov qword [rax + 0x20], rdi
push r14
add r10d, 0x4237276d
and r10, rbp
or ebp, 0xffffffff
btr bx, 0x91
or r10, 0x60c12bb8
mov rbx, r8
cmp dword [rcx + 0x10], 0
movzx r10d, r13w
setle r10b
mov r10, rdx
jmp 0x1404c1053
je 0x1404c11b2
movsxd r9, dword [rcx + 0x10]
lea r14, [0x140000000]
sal ah, 0x25
mov rdi, qword [rdx + 8]
adc cl, r11b
btr r11w, si
movzx rdx, r9w
sub esi, esi
shrd rax, rax, 0x34
add r9, rdi
adc rax, 0x63583b54
xor r8d, r8d
cmp r13b, dl
movzx ax, r10b
mov edx, ebp
movzx ecx, byte [r9]
and ecx, 0xf
rcr rax, 0xa6
movsx rax, byte [rcx + r14 + 0xc1a30]
bsr r11w, bp
shr r11b, cl
mov cl, byte [rcx + r14 + 0xc1a40]
sub r9, rax
bt r11w, bp
rcl r11b, 0xc5
mov r11d, dword [r9 - 4]
stc
shr r11d, cl
test r12w, 0x5cc0
stc
jmp 0x1404c10d9
test r11d, r11d
je 0x1404c11b2
mov rax, qword [r10 + 0x10]
add r10b, r9b
dec ecx
mov r10d, dword [rax]
cmp bx, sp
test al, 0x43
bt rax, 4
movzx ecx, byte [r9]
mov rax, 0x462d4dab
and ecx, 0xf
neg ah
xor ah, 0x1f
movsx rax, byte [rcx + r14 + 0xc1a30]
stc
cmp r8b, 0xef
test bp, r9w
mov cl, byte [rcx + r14 + 0xc1a40]
sub r9, rax
mov eax, dword [r9 - 4]
cmp r9b, 0x22
test dl, r11b
cmc
shr eax, cl
cmc
add esi, eax
mov eax, esi
add rax, r10
test edi, esi
add rax, rdi
stc
test rbx, rsp
jmp 0x1404c114c
cmp rbx, rax
jb 0x1404c119a
movzx ecx, byte [r9]
cdq
cmovno ax, bp
inc r8d
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
adc dl, 0x61
btc edx, edx
mov cl, byte [rcx + r14 + 0xc1a40]
sub r9, rax
mov edx, dword [r9 - 4]
cmc
shr edx, cl
jmp 0x1404c118a
dec edx
cmp r8d, r11d
jmp 0x1404c1194
jb 0x1404c10f8
test r8d, r8d
movsx eax, r14w
movzx ax, r12b
cmove edx, ebp
not ah
mov eax, edx
jmp 0x1404c11b4
mov eax, ebp
mov rbx, qword [rsp + 0x10]
movzx bp, r10b
cmove r14, r9
mov rbp, qword [rsp + 0x18]
jmp 0x1404c11d3
mov rsi, qword [rsp + 0x20]
movsx edi, di
movsx di, bpl
movzx edi, bx
mov rdi, qword [rsp + 0x28]
movsxd r14, r9d
movzx r14, r12w
pop r14
jmp 0x1404c11f6
ret

Function at 0x1404c7f71
Capabilities:
Allocate thread local storage

Disassembly:
jmp rax
jmp loc.1404e4790
push rbx
bt bx, cx
btr r9w, 0xde
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1400c63c0]
mov r8, 0x2d086e34
mov ecx, 3
cqo
lea r8, [0x1400c63b8]
movzx rdx, cx
lea rdx, [0x1400cfb70]
call fcn.1404c8ee8
test rax, rax
je case.default.0x1404c7fc4
mov rcx, rbx
add bl, r15b
add rsp, 0x20
pop rbx
jmp qword [case.0x1404c7fc4.0]
add rsp, 0x20
pop rbx
jmp 0x1404c7fd5
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1404c8058
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
jmp 0x1404c8064
mov ebx, ecx
lea r9, [0x1400c63d0]
cdq
movzx dx, bpl
mov ecx, 0xe7220b5
mov ecx, 5
jmp 0x1404c8086
lea r8, [0x1400c63c8]
movsx rdx, bx
cwd
lea rdx, [0x1400cf758]
jmp 0x1404c809f
call fcn.1404c8ee8
mov ecx, ebx
test r8w, r11w
cmp r15b, bpl
jmp 0x1404c80b2
test rax, rax
jmp 0x1404c80ba
je 0x1404c80d1
add rsp, 0x20
pop rbx
jmp 0x1404c80ca
push qword [0x1400b8d90]
ret
add rsp, 0x20
movzx bx, r8b
movzx ebx, r14w
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c80e6
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
or r8b, sil
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c63d8]
mov di, 0x7d57
mov edi, ecx
movsx r8w, r12b
not r8b
lea rdx, [0x1400cf748]
movsx r8, ax
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404c8127
call fcn.1404c8ee8
mov rdx, rbx
mov ecx, edi
cmp al, 0xaa
test rax, rax
je 0x1404c8147
call qword [case.0x1404c7fc4.0]
jmp 0x1404c814d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
seto dil
mov dil, bpl
pop rdi
jmp 0x1404c8163
ret

Function at 0x1404c82a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
stc
or ebp, 0x12b24eb9
shr ebp, cl
mov qword [rsp + 0x18], rsi
or rbp, rbp
push rdi
bsf si, r12w
sub rsp, 0x30
mov bpl, r12b
bswap ebp
movzx di, r15b
mov ebx, r9d
mov r9b, 0x1d
movsxd rdi, r12d
mov rdi, r8
mov esi, edx
cwd
movzx ebp, si
lea r9, [0x1400c63e8]
mov dx, 0x7a75
mov rbp, rcx
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
bswap cx
movsx rcx, r15w
mov ecx, 0xb
jmp 0x1404c830f
call fcn.1404c8ee8
mov rcx, rbp
test rax, rax
jmp 0x1404c831f
je 0x1404c8342
mov r9d, ebx
mov r8w, bp
mov r8, rdi
movsx rdx, r10w
cwd
mov edx, esi
call qword [case.0x1404c7fc4.0]
jmp 0x1404c8377
sub edx, edx
call fcn.1404c89c4
mov ecx, eax
xchg rdx, r9
movsxd r8, r10d
mov r9w, 0x3a30
mov r9d, ebx
movsx r8, bx
movsxd r8, r12d
mov r8, rdi
movsx edx, bx
movsxd rdx, r10d
cdq
mov edx, esi
jmp 0x1404c8371
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
rcr dil, 0x3d
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
bt edi, 0xcf
rcl di, cl
sub dil, 0x81
add rsp, 0x30
pop rdi
jmp 0x1404c839f
ret
Function at 0x1404d2c45
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test dh, 0xaf
sbb bl, bh
push rdi
bswap bx
ror bx, 0x14
sub rsp, 0x20
stc
mov rdx, qword [rcx]
bt bx, 0x4f
sal rbx, cl
or r8, 0xffffffffffffffff
rcl ebx, 0x8f
add bl, 0xe4
mov rbx, rcx
neg rcx
xor edi, edi
mov rcx, r8
jmp 0x1404d2c81
inc rcx
cmp r10b, r12b
test r8w, 0x7173
cmp word [rdx + rcx*2], di
jmp 0x1404d2c96
jne 0x1404d2c81
mov eax, edi
xor al, r9b
and al, 0x26
rcl al, cl
cmp rcx, 3
setl al
sete al
mov dword [rbx + 0x18], eax
movzx rax, bx
mov rax, qword [rbx + 8]
jmp 0x1404d2cbf
inc r8
cmp rbx, 0x319f13fe
jmp 0x1404d2cce
cmp word [rax + r8*2], di
jne 0x1404d2cbf
cmp r8, 3
movsxd rax, r9d
mov eax, edi
sete al
jmp 0x1404d2ceb
mov dword [rbx + 0x1c], eax
cmc
test bpl, 0x7b
cmp rcx, 3
jmp 0x1404d2cfc
jne 0x1404d2d11
mov ecx, 2
jmp 0x1404d2d0c
jmp 0x1404d2d88
mov r9d, edi
cmc
test rcx, r13
test rdx, rdx
jmp 0x1404d2d20
jne 0x1404d2d32
mov ecx, edi
jmp 0x1404d2d2d
jmp 0x1404d2d88
mov ecx, 2
movzx r8d, word [rdx]
shr ah, cl
ror ah, 0x2d
ror rax, cl
lea rdx, [rdx + rcx]
bsf rax, r8
lea eax, [r8 - 0x41]
cmp r14, 0x634c5b68
cmp ax, 0x19
jmp 0x1404d2d5f
jbe 0x1404d2d7a
sub r8w, 0x61
cmp r8w, 0x19
jmp 0x1404d2d74
ja 0x1404d2d82
inc r9d
jmp 0x1404d2d37
mov ecx, r9d
or dh, 0x14
xor r9d, r9d
mov dword [rbx + 0x14], ecx
adc cl, r11b
sar cx, 0x36
sub r8d, r8d
cdq
lea rcx, [0x1400ab3bc]
movsx dx, r10b
movsxd rdx, ebx
not edx
lea edx, [r9 + 3]
jmp 0x1404d2db3
call fcn.1404c7e3f
mov ecx, dword [rbx + 0x10]
not dl
test cl, 7
not al
setne dl
jmp 0x1404d2dca
bt ecx, 9
setb al
cmp dl, 0xd5
test di, bx
clc
and dl, al
bt ecx, 8
setb al
cmp si, 0x5e80
test al, dl
jmp 0x1404d2ded
jne 0x1404d2dfe
mov dword [rbx + 0x10], edi
movzx edi, r8w
cmp r10b, 0xd2
mov rbx, qword [rsp + 0x30]
clc
add rsp, 0x20
movzx rdi, bp
xchg di, di
mov dil, dil
pop rdi
jmp 0x1404d2e18
ret

Function at 0x1404d3755
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xf0
not bl
rcl rax, 0x2e
mov rax, qword [0x1400b7288]
xor rax, rsp
rcl dx, cl
movzx bx, r8b
mov qword [rsp + 0xe0], rax
cmc
setno dl
bts rbx, r9
or dword [rcx + 0x10], 0x104
cmovge dx, ax
mov rbx, rcx
lea rcx, [rsp + 0x30]
movzx rdx, r10w
movsx rdx, r11w
mov edx, 0x55
jmp 0x1404d37af
call fcn.1404c8507
cmp eax, 1
jmp 0x1404d37bc
jle 0x1404d3826
or r9, 0xffffffffffffffff
sbb ax, 0x6250
lea rax, [rsp + 0x30]
stc
test cx, bx
sub edi, edi
jmp 0x1404d37da
inc r9
cmp word [rax + r9*2], di
jmp 0x1404d37e7
jne 0x1404d37da
inc r9
movzx ecx, cx
movsxd r8, eax
lea rcx, [rbx + 0x258]
cdq
movsx r8w, r13b
cqo
lea r8, [rsp + 0x30]
mov edx, 0x55
jmp 0x1404d3814
call fcn.1404bff60
test eax, eax
jmp 0x1404d3820
jne 0x1404d386b
mov rcx, qword [rsp + 0xe0]
test si, 0x5874
cmp r13w, ax
cmp al, 0x51
xor rcx, rsp
jmp 0x1404d3841
call fcn.14049cfde
mov rbx, qword [rsp + 0x108]
shrd di, dx, 0x31
sal dil, cl
add rsp, 0xf0
movsx edi, bp
movzx rdi, si
pop rdi
jmp 0x1404d386a
ret
xor r9d, r9d
test dil, 0x1c
mov qword [rsp + 0x20], rdi
cmp rdi, 0x55bb139e
test r11b, r12b
xor r8d, r8d
cmc
xor edx, edx
jmp 0x1404d388f
sub ecx, ecx
jmp 0x1404d3896
call fcn.1404b37a8
int3