joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14045963e
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movzx cx, dil
lea rcx, [rsp + 0x30]
jmp 0x140459651
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
test r11b, dl
add rsp, 0x28
jmp 0x140459668
ret

Function at 0x140459719
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
movsx ax, cl
cmp eax, ecx
push rbp
stc
bts bx, di
mov rbp, rsp
cwde
sub rsp, 0x20
lahf
rcr al, 0x56
mov rax, qword [0x1400b7288]
movabs rbx, 0x2b992ddfa232
test r10w, dx
cmp r10b, 0x69
cmp rax, rbx
jmp 0x140459757
jne 0x140459815
and qword [rbp + 0x18], 0
cmovno cx, ax
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140459779
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
jmp 0x140459790
xor qword [rbp + 0x10], rax
jmp 0x140459799
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x1404597ae
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
setae ch
lea rcx, [rbp + 0x10]
clc
cmp r11b, bl
shl rax, 0x20
clc
xor rax, qword [rbp + 0x20]
test r10w, 0x5825
xor rax, qword [rbp + 0x10]
mov bp, bx
xor rax, rcx
movabs rcx, 0xffffffffffff
and rax, rcx
shr ebp, cl
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
bswap rbp
cmove rax, rcx
shr rbx, cl
sbb ebp, eax
mov qword [0x1400b7288], rax
sub ebp, 0x63a1a40
bt rbx, 0x11
mov rbx, qword [rsp + 0x48]
dec bp
not rax
and bpl, r12b
cmc
sar bpl, 0xd9
mov qword [0x1400b7280], rax
add rsp, 0x20
jmp 0x14045983c
pop rbp
jmp 0x140459842
ret
Function at 0x14046b187
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
not bp
xor bpl, 0xce
movzx bp, al
mov qword [rax + 0x18], rsi
dec bp
cmp ax, 0x4346
cmp cx, r9w
mov qword [rax + 0x20], rdi
and rbp, 0x5be2260
stc
push r14
jmp 0x14046b1c9
sub rsp, 0x20
mov rdi, qword [rsp + 0x50]
sub sil, 0x5c
btc r14w, 0x1d
mov r14, r9
bt esi, ebp
mov rsi, r8
mov rbp, rdx
stc
cmp bpl, dil
test rdi, rdi
jmp 0x14046b1f4
je 0x14046b2de
mov rbx, qword [r8 + 8]
stc
cmp r8d, 0x5e72ec2
jmp 0x14046b20b
test rbx, rbx
jmp 0x14046b213
je 0x14046b2c1
mov rax, qword [rbx + 0x40]
movsx r8d, sp
neg r8w
sar r8d, cl
movzx r8d, word [r14]
cmp qword [rax], 0
jmp 0x14046b235
je 0x14046b281
mov rax, qword [rbx + 0x58]
stc
jmp 0x14046b245
cmp dword [rax], 0
jle 0x14046b281
dec dword [rax]
lahf
movzx edx, cx
mov rcx, qword [rbx + 0x40]
cmova ax, bp
xchg dh, dl
cqo
mov rdx, qword [rcx]
mov ax, r9w
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x14046b273
mov word [rdx], r8w
jmp 0x14046b27c
jmp 0x14046b2b2
mov rax, qword [rbx]
movsx dx, spl
movzx edx, r8w
movsx ecx, r13w
movzx ecx, r12w
mov rcx, rbx
jmp 0x14046b29d
mov rax, qword [rax + 0x18]
call qword [0x1400b8d90]
movzx r8d, ax
not ah
rcr ah, 0x90
xor al, 0x78
mov eax, 0xffff
cmp ax, r8w
jne 0x14046b2cb
mov byte [rsi], 1
cmp r12w, r13w
test di, dx
add r14, 2
sub rdi, 1
jmp 0x14046b2d8
jne 0x14046b20b
movups xmm0, xmmword [rsi]
neg r14d
and r14b, r13b
shr al, 0x4e
mov rbx, qword [rsp + 0x30]
neg r14w
mov rax, rbp
cmc
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
neg r14b
or r14w, 0x880
not r14b
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
jmp 0x14046b31c
add rsp, 0x20
cmovne r14d, r9d
bswap r14w
pop r14
jmp 0x14046b32f
ret
Function at 0x1404720e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
neg bpl
add bp, r15w
ror bl, cl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmovne bp, r9w
mov bl, r10b
push r14
xadd bl, bpl
and sil, r15b
sub rsp, 0x20
shl si, cl
cmp rdi, 0x6a1466cb
mov rsi, r9
rol bpl, cl
setae r14b
rcr bp, 0x40
mov rbx, r8
movsx ebp, r8w
xadd bp, r14w
not bpl
mov r14, rdx
rcr ebp, 0x89
xor rbp, 0x3c6132e1
sal bp, 0xd4
mov rbp, rcx
clc
test r9, r9
jmp 0x14047215d
je 0x140472234
mov rdi, qword [rdx + 8]
test edi, edx
test rdi, rdi
jmp 0x140472171
je 0x140472217
mov rax, qword [rdi + 0x40]
rcl r8w, 0x86
movzx r8d, word [rbx]
test r13, 0x14f64d6e
cmp qword [rax], 0
jmp 0x140472194
je 0x1404721de
mov rax, qword [rdi + 0x58]
cmp r14b, r9b
test r11b, 0x5f
cmp dword [rax], 0
jle 0x1404721de
dec dword [rax]
mov rcx, qword [rdi + 0x40]
bswap ax
movsxd rdx, r12d
mov rdx, qword [rcx]
cdqe
cmovp ax, r11w
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x1404721d0
mov word [rdx], r8w
jmp 0x1404721d9
jmp 0x1404721fc
mov rax, qword [rdi]
cqo
movsx edx, r13w
movzx edx, r8w
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [0x1400b8d90]
movzx r8d, ax
mov eax, 0xffff
test r12d, 0x556d2f08
cmp ax, r8w
jmp 0x140472211
jne 0x14047221d
mov byte [r14], 1
cmp ecx, edx
add rbx, 2
clc
jmp 0x14047222a
sub rsi, 1
jne 0x140472169
movups xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x30]
shr r14w, cl
mov rax, rbp
bsf esi, r15d
add sil, r11b
and r14w, r8w
mov rsi, qword [rsp + 0x40]
not di
mov rdi, qword [rsp + 0x48]
rcr r14b, 0xd5
rol r14b, 0x43
movdqu xmmword [rbp], xmm0
movsx rbp, di
mov rbp, qword [rsp + 0x38]
sbb r14, 0x7b275b31
add rsp, 0x20
movzx r14d, sp
mov r14w, 0x412
pop r14
jmp 0x14047228d
ret
Function at 0x14049e275
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
stc
mov qword [rsp + 0x18], rbp
shl bpl, cl
cmc
push rsi
shld rbp, rbp, 0xb3
btr bp, ax
or bpl, 0xa2
push rdi
dec bpl
sar dil, 0xd1
push r12
bts edi, r12d
xor dil, dil
push r14
push r15
movsxd rbp, r10d
clc
movsx r14w, al
sub rsp, 0x20
rol r15d, 0xec
bsr rsi, rbx
rcr bp, cl
test rdx, rdx
lea r14, [rsp + 0x50]
movsx ebp, ax
mov ebp, 0x2d9525fd
movzx di, dil
mov rsi, rcx
xchg dil, r15b
mov rdi, rcx
bswap r15w
movzx ecx, byte [rcx]
cmovne r14, rdx
mov r15, r9
setnp bpl
xchg bpl, bpl
movzx bp, bl
mov ebp, r8d
jmp 0x14049e2fe
jmp 0x14049e31a
inc rdi
mov cx, 0x25e2
movsx cx, r13b
not cx
movzx ecx, byte [rdi]
jmp 0x14049e31a
call fcn.1404b6e5c
test eax, eax
jmp 0x14049e326
jne 0x14049e303
mov bl, byte [rdi]
sar ax, cl
lea eax, [rbx - 0x2b]
test rsp, 0x5ea1ec4
test al, r9b
stc
test al, 0xfd
jmp 0x14049e346
je 0x14049e358
mov bl, 0x2b
jmp 0x14049e353
jmp 0x14049e35b
inc rdi
mov r9, r15
mov r8d, ebp
cqo
mov dh, 0xa5
mov rdx, r14
mov rcx, rdi
call fcn.14049e4db
mov rcx, rax
ror r12b, 0x7d
btr r12w, 0x94
mov bpl, 0x2d
test r8b, 0xb
movabs r12, 0x8000000000000000
stc
test bp, 0x5e61
cmp rdi, qword [r14]
jmp 0x14049e39d
jne 0x14049e3b0
mov qword [r14], rsi
jmp 0x14049e3ab
jmp 0x14049e3b9
cmp rsi, qword [r14]
jne 0x14049e3c2
test rcx, rcx
jne 0x14049e407
cmp bl, 0x2b
jmp 0x14049e3ca
jne 0x14049e3eb
movabs rax, 0x7fffffffffffffff
test rbp, rbp
cmp rcx, rax
jmp 0x14049e3e5
ja 0x14049e407
cmp bl, bpl
jmp 0x14049e3f3
jne 0x14049e44b
cmp rcx, r12
jmp 0x14049e401
jbe 0x14049e44b
call fcn.1404b434d
mov dword [rax], 0x22
stc
cmp cx, 0x5beb
test r15, r15
jmp 0x14049e420
je 0x14049e431
mov dword [r15], 1
cmc
test bh, 0xa8
sub bl, bpl
neg bl
jmp 0x14049e43b
sbb rax, rax
add rax, r12
jmp 0x14049e446
jmp 0x14049e478
mov rax, rcx
neg rax
xadd r14b, r12b
cmp bl, bpl
movzx r15d, r11w
setns r15b
mov ebp, 0x378142c4
cmove rcx, rax
xor sil, 0xb9
shr bpl, cl
mov rax, rcx
movsx bx, sil
mov rbx, qword [rsp + 0x58]
sal rsi, cl
jmp 0x14049e488
mov rbp, qword [rsp + 0x60]
btc r12w, bx
btr r14, 0xda
add rsp, 0x20
movsx r15d, bx
movsx r15, si
movzx r14, r8w
pop r15
mov r14b, 0x79
jmp 0x14049e4b5
pop r14
movsx rdi, r10w
movzx esi, si
movsx r12w, dl
pop r12
movsx rdi, r10w
movsx di, sil
movzx edi, r15w
pop rdi
movsxd rsi, r8d
movzx esi, ax
pop rsi
ret

Function at 0x14049f4e2
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp r9b, r12b
and dword [rsp + 0x30], 0
jmp 0x14049f4f3
call fcn.1404a96f9
mov r9d, 2
cmovo dx, bx
jmp 0x14049f50a
lea r8, [rsp + 0x30]
not cx
movzx edx, ax
cmovg rcx, rax
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x14049f526
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
jmp 0x14049f536
sub ecx, 0x30
jmp 0x14049f53e
je 0x14049f585
sub ecx, 1
jmp 0x14049f54c
je 0x14049f57b
cmp ecx, 1
jmp 0x14049f55a
je 0x14049f56c
xor eax, eax
jmp 0x14049f567
jmp 0x14049f598
mov eax, 3
jmp 0x14049f576
jmp 0x14049f598
mov eax, 1
jmp 0x14049f598
mov eax, 2
test dil, 0xa9
cmp r12d, 0x6b586221
test r9b, r10b
add rsp, 0x28
jmp 0x14049f5a1
ret
Function at 0x1404ac193
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov bl, r9b
sbb ah, 0x3d
mov qword [rsp + 0x18], rsi
sub ax, 0xa44
rcl rbx, 0x1a
push rdi
and bh, al
sub rsp, 0x50
cmc
sets al
movzx bx, r11b
mov rax, qword [0x1400b7288]
xor rax, rsp
btc bx, 0x99
mov qword [rsp + 0x40], rax
cmp byte [rcx + 0x54], 0
movzx rbx, sp
not rbx
bswap rbx
mov rbx, rcx
jmp 0x1404ac1e5
je 0x1404ac2bc
cmp dword [rcx + 0x50], 0
jmp 0x1404ac1f4
jle 0x1404ac2bc
mov rsi, qword [rcx + 0x48]
and r8b, 2
sub edi, edi
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x34]
shl r8b, 0x99
setp r9b
movzx r9d, word [rsi]
test dx, 0x173f
inc cx
xchg cl, ch
lea rcx, [rsp + 0x30]
rol r8d, cl
and dword [rsp + 0x30], 0
movsx r8w, r9b
jmp 0x1404ac23a
lea rsi, [rsi + 2]
mov r8d, 6
jmp 0x1404ac249
mov qword [rsp + 0x20], rax
jmp 0x1404ac253
call fcn.1404cf984
test eax, eax
jne 0x1404ac2b3
mov r8d, dword [rsp + 0x30]
stc
clc
test r8d, r8d
jmp 0x1404ac26f
je 0x1404ac2b3
lea rax, [rbx + 0x10]
xchg cx, r9w
jmp 0x1404ac282
lea r9, [rbx + 0x28]
cqo
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
lea rdx, [rsp + 0x34]
call fcn.1404aa620
inc edi
cmp edi, dword [rbx + 0x50]
jmp 0x1404ac2a8
jne 0x1404ac204
jmp 0x1404ac2ed
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ac2ed
mov r8d, dword [rbx + 0x50]
lea rax, [rcx + 0x10]
bsr dx, r8w
mov rdx, qword [rbx + 0x48]
clc
lea r9, [rcx + 0x28]
add rcx, 0x468
jmp 0x1404ac2de
mov qword [rsp + 0x20], rax
jmp 0x1404ac2e8
call fcn.1404aa620
mov al, 1
movzx cx, bh
shld cx, r10w, 0x20
ror cx, 0x17
mov rcx, qword [rsp + 0x40]
test r9b, al
xor rcx, rsp
jmp 0x1404ac30d
call fcn.14049eb1e
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
sbb di, bx
add rsp, 0x50
mov di, 0x5cc8
movsx di, r13b
movzx di, dil
pop rdi
jmp 0x1404ac337
ret

Function at 0x1404ae8e6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x1404aea0a
mov qword [rsp + 8], rbx
clc
mov qword [rsp + 0x10], rdi
xor bl, dil
mov r10d, dword [r9]
bsr bx, r8w
cmovne ax, r12w
bt rbx, 0x45
mov dil, dl
mov rbx, rcx
movzx dx, r8b
and al, ah
ror dh, 0x54
xor r11d, r11d
cmovs ax, cx
ror al, cl
mov rdx, qword [rbx]
sal ah, cl
mov rax, qword [rdx + 8]
test r10b, r8b
cmp si, r10w
cmp qword [rdx + 0x10], rax
jmp 0x1404ae941
jne 0x1404ae974
cmp byte [rdx + 0x18], 0
jmp 0x1404ae950
je 0x1404ae95e
inc r10d
jmp 0x1404ae967
or r10d, 0xffffffff
jmp 0x1404ae967
mov dword [r9], r10d
jmp 0x1404ae96f
jmp 0x1404ae9de
lea eax, [r10 + 1]
mov cx, r8w
inc r10b
setp ch
mov dword [r9], eax
not ah
movsx r10d, r9w
movzx cx, al
mov rax, qword [rbx]
movsx r10w, r14b
movsx rcx, si
not r10w
inc qword [rax + 0x10]
movsx rax, r8w
mov cl, dil
mov r10w, 0x4fb0
mov rax, qword [rbx]
movzx r10, bx
inc ch
mov rcx, qword [rax]
movzx r10, ax
jmp 0x1404ae9c4
mov byte [rcx], dil
cbw
cwde
mov rax, qword [rbx]
xchg r10b, r10b
inc qword [rax]
movsx r10d, r13w
mov r10d, dword [r9]
test r8b, spl
stc
cmp r10d, 0xffffffff
je 0x1404aea00
inc r11d
test r14b, r12b
cmp r14b, 0xac
cmp r11d, r8d
jmp 0x1404ae9fa
jl 0x1404ae928
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1404afa85
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
stc
clc
mov qword [rsp + 0x10], rsi
sal sil, cl
mov sil, 0xf9
sar si, 0x72
push rdi
sub rsp, 0x30
bswap si
bts si, r9w
movsx di, r11b
mov edi, edx
bt si, bp
mov rsi, rcx
cmp r8, r15
jmp 0x1404afabe
test r8, r8
jmp 0x1404afac6
jne 0x1404afae8
call fcn.1404b434d
mov dword [rax], 0x16
call fcn.1404b5003
xor eax, eax
jmp 0x1404afae3
jmp 0x1404afbe9
mov rdx, r9
sete ch
mov rcx, r8
jmp 0x1404afaf6
call fcn.1404afc47
mov rbx, rax
test cx, 0x4e9f
test cl, spl
test rax, rax
jmp 0x1404afb0e
je 0x1404afb92
lea rax, [rsp + 0x50]
mov rdx, rdi
xchg r8b, r8b
mov qword [rsp + 0x28], rax
movzx eax, r15w
cdqe
lea r8, [0x140094b24]
movzx r9d, bp
mov eax, dword [rsp + 0x60]
cmove ecx, edi
movsx rcx, r10w
movsx r9w, r11b
mov r9, rbx
movzx ecx, r10w
mov cl, dh
movzx cx, r11b
mov rcx, rsi
jmp 0x1404afb5b
mov dword [rsp + 0x20], eax
jmp 0x1404afb64
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
jmp 0x1404afb72
test rax, rax
jmp 0x1404afb7a
jne 0x1404afc0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404afb8d
call fcn.1404b43af
sub edi, edi
stc
cmc
jmp 0x1404afb9b
test rbx, rbx
je 0x1404afbe0
mov rcx, qword [rbx + 0x10]
test cl, 0x37
cmc
test rcx, rcx
je 0x1404afbbb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404afbc7
je 0x1404afbd3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404afbdb
call fcn.1404c8319
mov rax, rdi
sbb ebx, 0x1aea65df
mov rbx, qword [rsp + 0x40]
neg si
shr sil, cl
mov rsi, qword [rsp + 0x48]
bts di, bp
add rsp, 0x30
sete dil
mov dil, 0xb8
movzx edi, r12w
pop rdi
ret
mov rcx, qword [rsp + 0x68]
stc
test r14b, al
test rcx, rcx
jmp 0x1404afc1f
je 0x1404afc2c
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
cmc
sub ebx, ebx
jmp 0x1404afb9b

Function at 0x1404afeff
Capabilities:
Terminate process

Disassembly:
push rbx
test r8b, 0xfe
shld bx, dx, 0xac
sub rsp, 0x20
jmp 0x1404aff19
mov ebx, ecx
call fcn.1404d18a3
cmp eax, 1
jmp 0x1404aff28
je 0x1404aff74
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
test r12b, 0xe1
cmp rbx, rbx
shr edx, 8
cmc
stc
cmp spl, 0xe1
test dl, 1
jmp 0x1404aff55
jne 0x1404aff74
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebp
jmp 0x1404aff6c
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404aff7b
call fcn.1404afe41
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b5077
Capabilities:
Terminate process

Disassembly:
sub edx, dword [rdi - 0x699b77c1]
invalid
invalid
pop rbp
sbb dword [r15], 0xcad22ea0
adc ah, al
mov ah, byte [rsi]
xor cl, ch
invalid
sbb al, ch
mov edi, 0x14a9924c
xchg rdx, rax
test eax, 0x370e8014
xchg rdx, rax
test eax, 0x370e8014
add edx, dword [rsi]
loopne 0x1401776d0
mov ecx, ecx
leave
adc al, 0xc0
test al, 0x4d
jge 0x1401776f5
invalid
and al, 0x13
loopne 0x1401776d2
stosq qword [rdi], rax
in al, dx
invalid
int 0x15
invalid
xlatb
mov ecx, gs
mov edi, 0x153dcc3e
cmp byte [rcx + rbx], 0x97
invalid
invalid
adc eax, 0x43770584
sti
in eax, dx
add eax, 0xedfb4377
invalid
push 0x5c
invalid
jns 0x1401777f7
xor bh, byte [rax + 0x11e37bc5]
adc byte [rbx], cl
jnp 0x1401777e1
scasd eax, dword [rdi]
sbb dword [rcx], esi
jns 0x1401777c6
invalid
and edi, dword [rdi]
pop rbx
test byte [rsi + 0x63], bh
movabs eax, dword [0x236df3fbd87c8289]
fist dword [rsp + rax*4 - 0x8bbb3ae]
sti
jmp [rbp + rdi*4 + 0x1415aaf3]
invalid
movabs dword [0x70213d6379b1bb6b], eax
sbb edx, esp
and bh, byte [rsi]
sub bl, byte [rdx - 0x42]
mov dword [rcx + 0x637cd2e6], ebp
je 0x140177762
enter 0xfffffffffffff9cd, 0xffffffffffffffa4
enter 0xfffffffffffff9cd, 0xffffffffffffffa4
imul edi, dword [rsi + 0x29], 0x3ac9b209
movsw word [rdi], word [rsi]
cli
pop rbx
test byte [rax + 0x3f57479c], cl
mov byte [rdi + rax*2 + 0x6323f57], bl
xor al, byte [rsi]
pop rbx
xchg byte [rcx - 0x2e09c9dd], al
xlatb
pop rdi
loopne 0x1401777f2
pop rbp
or byte [rsi - 0x6be95c8a], 0xa1
cmp dword [rax + rax*8 - 0x41], 0xda722dfd
movabs eax, dword [0xaa5e49c19257a98e]
push rbp
leave
fucom st(2)
or byte ss:[rbx - 0x2c19f2c0], ah
movsb byte [rdi], byte [rsi]
jo 0x140177850
scasd eax, dword [rdi]
imul edi, dword [rdi - 0x7b], 0x8f4e19a9
jl 0x140177830
test dword [rcx + 0x7c8f4e19], ebp
stc
cmc
invalid
add ah, bl
sub eax, ebp
cld
mov esi, 0x82ead0a5
invalid
sub rsp, 0x28
sete cl
movsx ecx, r10w
mov ch, 0x95
mov ecx, 0x17
jmp 0x1404b508f
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404b50ae
mov ecx, 5
jmp 0x1404b50a7
int 0x29
jmp 0x1404b50ae
mov r8d, 1
movzx cx, bh
mov edx, 0xc0000417
lea ecx, [r8 + 1]
jmp 0x1404b50c6
call fcn.1404b50ee
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
bts dx, sp
mov edx, 0xc0000417
clc
add rsp, 0x28
jmp switch.0x1404b50e7
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404c98b7
Capabilities:
Get thread local storage value

Disassembly:
push rbx
cwd
rcl dl, cl
sub rsp, 0x20
cdq
cqo
mov ebx, ecx
movsx dx, r13b
lea r9, [0x1400c63d0]
mov ecx, 5
cwd
cdq
lea r8, [0x1400c63c8]
setle dl
bswap rdx
lea rdx, [0x1400cf758]
jmp 0x1404c98f3
call fcn.1404ca7c5
mov ecx, ebx
clc
test esp, edi
test rax, rax
jmp 0x1404c9905
je 0x1404c9922
add rsp, 0x20
movzx ebx, r13w
bswap ebx
jmp 0x1404c991a
pop rbx
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsxd rbx, ebp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c9931
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdx, r14
lea r9, [0x1400c63d8]
mov edi, ecx
movsx ecx, sp
lea rdx, [0x1400cf748]
movsx r8d, si
movsxd rcx, r14d
mov ecx, 6
movzx r8, r14w
lea r8, [0x1400c63d0]
jmp 0x1404c9970
call fcn.1404ca7c5
mov rdx, rbx
mov ecx, edi
test rax, rax
jmp 0x1404c9982
je 0x1404c9993
call qword [0x1400b8d90]
jmp 0x1404c9999
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1404c99a8
ret

Function at 0x1404c9b06
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
sbb bpl, 0x92
mov qword [rsp + 0x18], rsi
rol sil, cl
test r9w, r15w
movzx rbp, cx
push rdi
shld bp, di, 0xe3
xor ebp, eax
and bpl, dil
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
xchg sil, r8b
setge sil
mov bp, bp
mov esi, edx
lea r9, [0x1400c63e8]
mov rbp, rcx
cmovne cx, r9w
movzx dx, ch
lea r8, [0x1400c63e0]
mov dl, r14b
movzx dx, r9b
movsx rcx, r13w
lea rdx, [0x1400cf190]
movsx cx, r11b
mov ecx, 0xb
jmp 0x1404c9b81
call fcn.1404ca7c5
mov rcx, rbp
cmc
test rax, rax
jmp 0x1404c9b92
je 0x1404c9bbf
mov r9d, ebx
movsx dx, r13b
movzx edx, ax
mov dh, 0xd6
mov r8, rdi
movzx rdx, r10w
mov edx, esi
jmp 0x1404c9bb4
call qword [0x1400b8d90]
jmp 0x1404c9be6
sub edx, edx
jmp 0x1404c9bc6
call fcn.1404ca257
mov ecx, eax
mov r9d, ebx
mov r8, rdi
movsx rdx, r11w
xchg dh, dh
mov edx, esi
jmp 0x1404c9be0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
and dil, r8b
mov rbp, qword [rsp + 0x48]
xchg sil, sil
mov rsi, qword [rsp + 0x50]
stc
add rsp, 0x30
movsx edi, bx
mov di, 0x23d2
pop rdi
jmp 0x1404c9c0d
ret
Function at 0x1404cd843
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
sar ch, cl
not ecx
mov qword [rax + 0x10], rbp
or cl, 0x59
jmp 0x1404cd861
mov qword [rax + 0x18], rsi
movzx rcx, r14w
mov qword [rax + 0x20], rdi
movzx ecx, r8w
sar cx, 0xc3
movzx rcx, r14w
push r14
sbb cl, dh
sub rsp, 0x90
lea rcx, [rax - 0x78]
jmp 0x1404cd88d
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
sub r14d, r14d
cmc
cmp word [rsp + 0x62], r14w
jmp 0x1404cd8a2
je 0x1404cd9e3
mov rax, qword [rsp + 0x68]
cmc
clc
test rax, rax
jmp 0x1404cd8b7
je 0x1404cd9e3
movsxd rbx, dword [rax]
sub cx, 0x7639
bswap cx
lea rsi, [rax + 4]
mov edi, 0x2000
and ch, 0x21
lea rbx, [rbx + rsi]
cmp dword [rax], edi
cmovl edi, dword [rax]
jmp 0x1404cd8e5
mov ecx, edi
jmp 0x1404cd8ec
call fcn.1400ada04
cmp edi, dword [0x1400bad40]
jmp 0x1404cd8fc
cmovg edi, dword [0x1400bad40]
jmp 0x1404cd908
test edi, edi
jmp 0x1404cd90f
je 0x1404cd9e3
mov ebp, r14d
test al, al
cmp sil, cl
cmp qword [rbx], 0xffffffffffffffff
jmp 0x1404cd926
je 0x1404cd9c5
cmp qword [rbx], 0xfffffffffffffffe
jmp 0x1404cd935
je 0x1404cd9c5
test byte [rsi], 1
jmp 0x1404cd943
je 0x1404cd9c5
test byte [rsi], 8
jne 0x1404cd96d
mov rcx, qword [rbx]
jmp 0x1404cd95a
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jmp 0x1404cd967
je 0x1404cd9c5
mov rax, rbp
movsx r8d, bp
lea r8, [0x1400ba940]
shr ch, cl
xor cl, ch
setp cl
mov rcx, rbp
btr dx, 0x88
bsr edx, edi
cwd
sar rcx, 6
cmovbe dx, sp
and eax, 0x3f
movzx edx, bx
mov rcx, qword [r8 + rcx*8]
lea rdx, [rax + rax*8]
movsx eax, di
cwde
not al
mov rax, qword [rbx]
jmp 0x1404cd9b3
mov qword [rcx + rdx*8 + 0x28], rax
xchg al, al
mov al, byte [rsi]
jmp 0x1404cd9c1
mov byte [rcx + rdx*8 + 0x38], al
inc rbp
jmp 0x1404cd9cd
inc rsi
cmc
cmp r11b, 0xdf
add rbx, 8
sub rdi, 1
jne 0x1404cd91d
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov bp, 0x7378
movsx r14w, r15b
mov rbp, qword [r11 + 0x18]
movzx si, al
mov rsi, qword [r11 + 0x20]
movsxd rdi, r9d
bswap di
mov rdi, qword [r11 + 0x28]
mov rsp, r11
bswap r14d
pop r14
jmp 0x1404cda1b
ret
Function at 0x1404cda1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
shl ch, cl
shld cx, r13w, 0xc5
not cx
mov qword [rax + 8], rbx
sal cx, cl
mov qword [rax + 0x10], rbp
mov rcx, 0x5a92012d
movzx rbx, cx
mov qword [rax + 0x18], rsi
dec bl
mov qword [rax + 0x20], rdi
push r14
cbw
sub rsp, 0x20
btr di, 0xf3
xor esi, esi
sub r14d, r14d
movsxd rcx, esi
lea rdi, [0x1400ba940]
btr bx, 0xa9
sal ah, cl
mov rax, rcx
btr bx, 0xe6
and ecx, 0x3f
sar rax, 6
and bl, r14b
lea rbx, [rcx + rcx*8]
cmp r14b, 0xf8
mov rdi, qword [rdi + rax*8]
bts ax, r13w
btr eax, 0xb2
sar ax, cl
mov rax, qword [rdi + rbx*8 + 0x28]
add rax, 2
cmp spl, 0x60
cmp rax, 1
jmp 0x1404cdaad
jbe 0x1404cdac2
or byte [rdi + rbx*8 + 0x38], 0x80
jmp 0x1404cdabd
jmp 0x1404cdbdd
mov byte [rdi + rbx*8 + 0x38], 0x81
mov ecx, esi
test esi, esi
jmp 0x1404cdad0
je 0x1404cdb08
sub ecx, 1
jmp 0x1404cdade
je 0x1404cdafe
cmp ecx, 1
movsx rcx, di
movzx ecx, r15w
mov ecx, 0xfffffff4
jmp 0x1404cdaf9
jmp 0x1404cdb12
mov ecx, 0xfffffff5
jmp 0x1404cdb12
mov ecx, 0xfffffff6
jmp 0x1404cdb12
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
lea rcx, [rax + 1]
cmp rcx, 1
jmp 0x1404cdb28
jbe 0x1404cdb3c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1404cdb44
xor eax, eax
jmp 0x1404cdb44
test eax, eax
jmp 0x1404cdb4b
je 0x1404cdba1
movzx ecx, al
test dx, 0x1d39
mov qword [rdi + rbx*8 + 0x28], rbp
cmp ecx, 0x3ee5ad7
test r9b, al
cmp ecx, 2
jmp 0x1404cdb6f
jne 0x1404cdb84
or byte [rdi + rbx*8 + 0x38], 0x40
jmp 0x1404cdb7f
jmp 0x1404cdbdd
cmp ecx, 3
jmp 0x1404cdb8c
jne 0x1404cdbdd
or byte [rdi + rbx*8 + 0x38], 8
jmp 0x1404cdb9c
jmp 0x1404cdbdd
or byte [rdi + rbx*8 + 0x38], 0x40
movzx eax, si
mov qword [rdi + rbx*8 + 0x28], 0xfffffffffffffffe
lahf
mov rax, qword [0x1400ba160]
stc
cmc
test bpl, sil
test rax, rax
jmp 0x1404cdbc7
je 0x1404cdbdd
mov rax, qword [r14 + rax]
mov dword [rax + 0x18], 0xfffffffe
jmp 0x1404cdbdd
inc esi
cmp cl, r14b
add r14, 8
test r10b, 0xbd
cmp esi, 3
jmp 0x1404cdbf2
jne 0x1404cda5c
mov rbx, qword [rsp + 0x30]
cmc
neg rdi
mov rbp, qword [rsp + 0x38]
cmp bh, 0xe5
inc r14b
mov rsi, qword [rsp + 0x40]
xor r14b, 0x88
bts r14w, r12w
mov rdi, qword [rsp + 0x48]
sar r14w, 0xfb
ror r14b, cl
bsf r14w, dx
add rsp, 0x20
xchg r14, r14
mov r14b, 0x5b
pop r14
jmp 0x1404cdc3d
ret