joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a0eb2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
jmp 0x1404a0ed2
mov qword [rax + 0x18], rbp
inc bp
xadd bp, bp
btc rbp, 0x7a
mov qword [rax + 0x20], rsi
sbb bpl, r10b
shl esi, cl
push rdi
mov bpl, 0x46
shld rdi, r12, 0xff
btc di, r12w
push r14
adc bp, 0x1250
push r15
sbb bp, sp
mov r15b, cl
sar si, cl
sub rsp, 0x20
btc di, ax
test rdx, rdx
movzx si, dil
movsx esi, r10w
lea r14, [rax + 8]
mov rbp, rcx
not r15b
movsx r15d, r12w
mov rdi, rcx
movzx rsi, sp
movsx esi, r14w
movzx ecx, byte [rcx]
cmovne r14, rdx
not r15d
setl sil
jmp 0x1404a0f4b
mov r15, r9
mov esi, r8d
jmp 0x1404a0f56
jmp 0x1404a0f6f
inc rdi
xchg ecx, ecx
movzx rcx, di
setnp ch
movzx ecx, byte [rdi]
jmp 0x1404a0f6f
call fcn.1404ba1c1
test eax, eax
jmp 0x1404a0f7b
jne 0x1404a0f5b
mov bl, byte [rdi]
xor rax, 0x77cd60e7
lea eax, [rbx - 0x2b]
test bl, 0x66
cmp al, 0x6e
test al, 0xfd
jmp 0x1404a0f99
je 0x1404a0fab
mov bl, 0x2b
jmp 0x1404a0fa6
jmp 0x1404a0fb3
inc rdi
jmp 0x1404a0fb3
mov r9, r15
cqo
cdq
not r8w
mov r8d, esi
movsx rcx, bx
movzx rcx, ax
setle ch
mov rdx, r14
xchg cx, cx
mov rcx, rdi
jmp 0x1404a0fd9
call fcn.1404a10e5
mov ecx, eax
shld si, si, 0x74
shl sil, cl
mov esi, 0x7fffffff
jmp 0x1404a0ff4
cmp rdi, qword [r14]
jmp 0x1404a0ffc
jne 0x1404a100f
mov qword [r14], rbp
jmp 0x1404a100a
jmp 0x1404a101d
cmp rbp, qword [r14]
jmp 0x1404a1017
jne 0x1404a1025
test ecx, ecx
jne 0x1404a105a
cmp bl, 0x2b
jmp 0x1404a102d
jne 0x1404a1040
cmp ecx, esi
jmp 0x1404a103a
ja 0x1404a105a
cmp bl, 0x2d
jne 0x1404a10a4
cmp ecx, 0x80000000
jmp 0x1404a1054
jbe 0x1404a10a4
call fcn.1404b7622
mov dword [rax], 0x22
test r15, r15
je 0x1404a107f
mov dword [r15], 1
neg al
cmp r8, 0x753a19ce
lahf
mov eax, 0x80000000
clc
cmp bl, 0x2d
jmp 0x1404a108d
cmove esi, eax
movzx ax, cl
movzx rax, cx
jmp 0x1404a109d
mov eax, esi
jmp 0x1404a10b7
neg eax
bt ebp, eax
cmp bl, 0x2d
cmove ecx, eax
cmp edx, 0x17bd1f22
mov eax, ecx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
rcl dil, cl
movsx edi, r12w
mov rsi, qword [rsp + 0x58]
or r15b, 0x7b
add rsp, 0x20
pop r15
pop r14
bswap edi
cmovns edi, ebp
pop rdi
jmp 0x1404a10e4
ret
Function at 0x1404a1502
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
cmc
clc
mov qword [rsp + 0x18], rbp
shr bp, 0x78
adc bp, 0x6c41
push rsi
push rdi
clc
push r12
bts rbp, r12
not dil
push r14
test spl, 0xd6
movzx si, spl
shrd di, si, 0x7e
push r15
btc bp, 0x23
rol r15b, 0x67
sub rsp, 0x20
sbb r15b, 0x52
movsx rdi, r14w
ror r15b, 0xe3
test rdx, rdx
lea r14, [rsp + 0x50]
movsxd rdi, r10d
xchg di, bp
mov rsi, rcx
movsx edi, di
not rbp
mov rdi, rcx
movzx ecx, byte [rcx]
jmp 0x1404a1574
cmovne r14, rdx
mov r15, r9
mov ebp, r8d
jmp 0x1404a1583
jmp 0x1404a159b
inc rdi
cmovno cx, si
movzx rcx, r11w
movzx ecx, byte [rdi]
jmp 0x1404a159b
call fcn.1404ba1c1
test eax, eax
jmp 0x1404a15a7
jne 0x1404a1588
mov bl, byte [rdi]
xor ax, 0x7651
mov eax, esp
bts eax, ebp
lea eax, [rbx - 0x2b]
test r8d, r13d
test r15, 0x1eee0e68
test al, 0xfd
je 0x1404a15d4
mov bl, 0x2b
jmp 0x1404a15d8
inc rdi
cdq
mov r9, r15
mov r8d, ebp
mov rdx, r14
bswap cx
mov rcx, rdi
jmp 0x1404a15ec
call fcn.1404a1742
mov rcx, rax
shl r12b, 0x53
mov bpl, 0x2d
movabs r12, 0x8000000000000000
jmp 0x1404a160a
cmp rdi, qword [r14]
jmp 0x1404a1612
jne 0x1404a1625
mov qword [r14], rsi
jmp 0x1404a1620
jmp 0x1404a1633
cmp rsi, qword [r14]
jmp 0x1404a162d
jne 0x1404a1641
test rcx, rcx
jmp 0x1404a163b
jne 0x1404a1689
cmp bl, 0x2b
jmp 0x1404a1649
jne 0x1404a166d
movabs rax, 0x7fffffffffffffff
stc
jmp 0x1404a165f
cmp rcx, rax
jmp 0x1404a1667
ja 0x1404a1689
cmp bl, bpl
jmp 0x1404a1675
jne 0x1404a16d6
cmp rcx, r12
jmp 0x1404a1683
jbe 0x1404a16d6
call fcn.1404b7622
mov dword [rax], 0x22
test r15, r15
jmp 0x1404a169c
je 0x1404a16b3
mov dword [r15], 1
stc
cmp si, r9w
cmp bp, 0x231e
sub bl, bpl
clc
cmc
neg bl
jmp 0x1404a16bf
sbb rax, rax
cmp r15, 0x6e85401f
add rax, r12
jmp 0x1404a16d1
jmp 0x1404a16fd
mov rax, rcx
bt si, bp
neg rax
movsxd rdi, esi
cmp bl, bpl
mov sil, r9b
cmove rcx, rax
mov rax, rcx
jmp 0x1404a16fd
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
cmp dl, 0xea
test di, 0x7b37
add rsp, 0x20
movsx r14w, sil
pop r15
cmovge esi, edx
xchg r14b, r14b
pop r14
xchg rsi, r12
movsxd rdi, edx
pop r12
movsx esi, bx
pop rdi
movsx rsi, bx
movsx si, r13b
setge sil
pop rsi
jmp 0x1404a1741
ret

Function at 0x1404a26b6
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test rcx, 0x58705a9e
and dword [rsp + 0x30], 0
jmp 0x1404a26cb
call fcn.1404ac87a
mov r9d, 2
lea r8, [rsp + 0x30]
movsxd rdx, ecx
movsx cx, spl
cdq
mov rcx, qword [rax + 0x28]
movsx edx, dx
xchg dx, dx
lea edx, [r9 + 0x20]
jmp 0x1404a26f7
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmc
sub ecx, 0x30
jmp 0x1404a270b
je 0x1404a274d
sub ecx, 1
je 0x1404a273e
cmp ecx, 1
je 0x1404a272f
sub eax, eax
jmp 0x1404a272a
jmp 0x1404a2752
mov eax, 3
jmp 0x1404a2739
jmp 0x1404a2752
mov eax, 1
jmp 0x1404a2748
jmp 0x1404a2752
mov eax, 2
add rsp, 0x28
jmp 0x1404a275b
ret
Function at 0x1404a275c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
bts si, di
mov qword [rax + 0x18], rdi
dec dil
or dil, bpl
mov qword [rax + 0x20], r14
shr r14w, cl
push r15
sar r15w, 0x97
btr r14, r13
sub rsp, 0x30
mov rdi, r9
mov rsi, rdx
setae r15b
sbb r15d, ebp
test bpl, 0x48
sub rsi, rcx
test r14b, r12b
add r15, 0x10d97ac6
stc
sub rdi, r8
and r15b, spl
xor r14b, 0xde
mov r15, rcx
cmp bpl, r14b
and r14b, 0x67
sar rsi, 1
sub r14b, r14b
bt cx, 0xd
xadd cl, r14b
mov rcx, qword [rsp + 0x60]
xor ebx, ebx
shrd r14w, r13w, 0xb4
sar rdi, 1
cmova r14, rsp
neg r14b
mov r14, r8
cmc
clc
test rcx, rcx
jmp 0x1404a27f3
jne 0x1404a280c
call fcn.1404ac87a
mov rcx, qword [rax + 8]
jmp 0x1404a2807
jmp 0x1404a2815
mov rcx, qword [rcx + 8]
jmp 0x1404a2815
test rcx, rcx
jmp 0x1404a281d
jne 0x1404a28b4
cmp esi, edi
mov eax, edi
movzx cx, al
movsxd rcx, r10d
mov cx, 0x2bee
cmovl eax, esi
sbb rcx, 0x77620640
sub cl, bpl
movsxd rcx, eax
or rax, 0x1ee06bb3
mov eax, 1
test rcx, rcx
jmp 0x1404a2856
je 0x1404a2886
sub r15, r14
movzx edx, word [r15 + r14]
cmp dx, word [r14]
jmp 0x1404a286d
jne 0x1404a28a5
add r14, 2
clc
jmp 0x1404a287d
sub rcx, rax
jne 0x1404a285f
cmp esi, edi
je 0x1404a28ad
or ecx, 0xffffffff
cmp esi, edi
jmp 0x1404a2898
cmovl eax, ecx
jmp 0x1404a28a0
jmp 0x1404a291e
sbb ebx, ebx
stc
and ebx, 0xfffffffe
add ebx, eax
mov eax, ebx
jmp 0x1404a291e
mov dword [rsp + 0x28], edi
xchg rdx, r8
movsx r9w, r8b
jmp 0x1404a28c5
mov r9d, esi
mov dh, 0xdd
xchg r8w, dx
cmovs dx, sp
mov r8, r15
movsx dx, spl
mov qword [rsp + 0x20], r14
movzx dx, r12b
mov edx, 0x1000
jmp 0x1404a28ef
call fcn.1404c53db
test eax, eax
jmp 0x1404a28fb
jne 0x1404a2916
call fcn.1404b7622
mov dword [rax], 0x16
mov eax, 0x7fffffff
jmp 0x1404a291e
sub eax, 2
bt di, 0x43
mov rbx, qword [rsp + 0x40]
sar sil, cl
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
xadd r15d, r15d
bt r14, 0xaf
mov r14, qword [rsp + 0x58]
cmp r10d, 0x18476fd4
btr r15w, r11w
add rsp, 0x30
movzx r15, dx
not r15
pop r15
jmp 0x1404a295c
ret

Function at 0x1404a34bc
Capabilities:
Terminate process

Disassembly:
push rbx
rcl bx, 0x8e
cmp r13b, 0x79
and bh, 0xf2
sub rsp, 0x20
btr rbx, r13
bswap bx
mov rbx, rcx
clc
xor ecx, ecx
jmp 0x1404a34df
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a34ed
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
sar dx, 0xc
bsr rdx, rbp
xchg bl, dh
mov edx, 0xc0000409
rcr bl, cl
bswap rbx
ror bx, cl
add rsp, 0x20
movsx ebx, cx
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404a3f24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
rcl si, cl
cmp r15b, spl
inc esi
push rdi
movzx esi, si
dec rdi
push r12
add r12w, bx
push r14
push r15
rcl r12d, cl
btc r15w, dx
add r12b, 0x4b
sub rsp, 0x20
movzx r15w, r12b
mov r15b, r12b
mov esi, dword [r8 + 0xc]
movsxd rdi, r12d
movzx r12, r9w
mov r12, rcx
not r15b
setne r14b
mov rcx, r8
mov rdi, r9
movzx r15d, r9w
setp r15b
mov r14, r8
movsx r15d, r14w
mov r15, rdx
jmp 0x1404a3f92
call fcn.1401b589d
mov r10, qword [r12]
rcl rbp, 0x56
mov ebp, eax
mov qword [rdi], r10
test rdi, rsp
cmp dx, cx
test esi, esi
jmp 0x1404a3fb1
je 0x1404a40d2
movsxd rax, dword [r14 + 0x10]
cmp r10b, 4
sub ch, 0xdb
lea ecx, [rsi - 1]
btc rbx, 0xc4
mov esi, ecx
shl bl, 0xb0
test r9, 0x1dcf3328
lea rcx, [rcx + rcx*4]
shr bh, cl
lea rbx, [rax + rcx*4]
cmc
add rbx, qword [r15 + 8]
cmc
clc
jmp 0x1404a3fec
cmp ebp, dword [rbx + 4]
jmp 0x1404a3ff4
jle 0x1404a3faa
cmp ebp, dword [rbx + 8]
jg 0x1404a3faa
mov rcx, qword [r15]
setb dh
lea rdx, [rsp + 0x50]
test ax, 0x4cf3
sub r8d, r8d
jmp 0x1404a401a
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
xor ecx, ecx
movzx r10w, dl
bts r10, r12
add r8, qword [rsp + 0x50]
sar r10b, 0x6f
btc r9w, r10w
jmp 0x1404a4042
mov r9d, dword [rbx + 0xc]
btc r10d, r12d
btr r10, r14
mov r10, r8
mov r10d, dword [rax]
test r9d, r9d
je 0x1404a4091
lea rdx, [r8 + 0xc]
xadd ax, ax
movsxd rax, dword [rdx]
stc
jmp 0x1404a406e
cmp rax, r10
jmp 0x1404a4076
je 0x1404a4091
inc ecx
jmp 0x1404a4084
add rdx, 0x14
cmp ecx, r9d
jb 0x1404a4065
cmp ecx, r9d
jmp 0x1404a4099
jae 0x1404a3faa
mov rax, qword [r12]
and rbp, 0x24a541f5
movsx bx, r15b
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
clc
btr rbp, r9
mov rcx, qword [rcx + rax]
lahf
cbw
sbb r12b, 0xf2
mov qword [rdi], rcx
ror r15b, 0xdd
rcr r15b, cl
mov rbx, qword [rsp + 0x58]
rcr sil, 0x92
add r15w, 0x34a2
mov rax, rdi
sal r15b, cl
add r15b, 0xc7
mov rbp, qword [rsp + 0x60]
xor r12w, 0x6c66
btc r14w, 0xfe
mov si, cx
add rsp, 0x20
not r14b
pop r15
setno r14b
pop r14
mov edi, 0x1c40777e
pop r12
xchg si, di
not dil
movzx rsi, r8w
pop rdi
movzx si, r11b
pop rsi
jmp 0x1404a412b
ret
Function at 0x1404a48d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp ah, 0xd9
clc
cmp rcx, r8
mov qword [rax + 8], rbx
cmp eax, 0x13ad6186
mov qword [rax + 0x10], rbp
clc
jmp 0x1404a48fa
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
clc
push r14
sub rsp, 0x60
cmp dil, 0x1d
mov qword [rsp + 0x20], rdx
bts di, r15w
sar rbp, cl
mov rdi, rdx
sal bpl, cl
bsr bp, r13w
movaps xmmword [rax - 0x18], xmm6
test sil, cl
sbb bpl, r12b
mov rbp, rcx
mov qword [rsp + 0x30], rdx
sub dl, r10b
xor ebx, ebx
movsx cx, r15b
mov dword [rsp + 0x28], ebx
movsx rcx, sp
movzx cx, r14b
lea rdx, [rax - 0x28]
movaps xmm6, xmmword [rsp + 0x20]
seto ch
movsx ecx, r13w
movsx cx, r9b
mov rcx, rdi
movdqa xmmword [rax - 0x28], xmm6
mov r14d, r8d
xor esi, esi
jmp 0x1404a4975
call fcn.1401a9507
mov r9d, dword [rdi]
jmp 0x1404a4988
xor edx, edx
cmp r8w, 0x3968
cmp r13b, r12b
test r9d, r9d
jmp 0x1404a499b
je 0x1404a4b0e
mov r8, qword [rdi + 8]
lea r10, [0x140000000]
mov rax, qword [rdi + 0x18]
mov ecx, ebx
cmp r14d, eax
jmp 0x1404a49ba
jl 0x1404a4a06
shr rax, 0x20
test r12b, sil
clc
cmp r14d, eax
jg 0x1404a4a06
test ecx, ecx
jmp 0x1404a49dd
mov ebx, edx
lahf
jmp 0x1404a49e6
mov esi, edx
movzx ax, cl
movzx eax, di
mov ax, r11w
cmove ebx, ecx
mov dword [rsp + 0x28], ebx
mov cl, 0xfc
jmp 0x1404a4a01
movaps xmm6, xmmword [rsp + 0x20]
movzx ecx, byte [r8]
cmovs ax, r8w
inc edx
bsf ax, cx
bsr ax, bx
test r14d, 0x65e403e5
and ecx, 0xf
movsx rax, byte [rcx + r10 + 0xc1a30]
stc
cmp r12b, r8b
mov cl, byte [rcx + r10 + 0xc1a40]
sub r8, rax
rcl ah, cl
movsxd rax, esi
mov eax, dword [r8 - 4]
test r8w, r14w
shr eax, cl
movzx rcx, ax
mov qword [rdi + 8], r8
shr rcx, 0xbe
mov dword [rdi + 0x18], eax
ror ax, cl
rol ax, 0x52
movzx ecx, byte [r8]
or ax, r12w
shl rax, 0x66
and ecx, 0xf
movsx rax, r13w
movsx rax, byte [rcx + r10 + 0xc1a30]
mov cl, byte [rcx + r10 + 0xc1a40]
sub r8, rax
btc ax, r14w
rcl al, 0x9f
mov eax, dword [r8 - 4]
shr eax, cl
mov qword [rdi + 8], r8
mov dword [rdi + 0x1c], eax
xor cx, dx
movzx ecx, byte [r8]
add ax, ax
rcl ah, cl
and ecx, 0xf
movsx rax, byte [rcx + r10 + 0xc1a30]
test r8w, 0x59ee
mov cl, byte [rcx + r10 + 0xc1a40]
sub r8, rax
cmc
adc rax, 0x565b5d38
mov eax, dword [r8 - 4]
shr eax, cl
mov qword [rdi + 8], r8
mov dword [rdi + 0x20], eax
sar rax, 0xdd
cwde
movsx ax, r8b
mov eax, dword [r8]
cmp sil, 0x1b
add r8, 4
clc
jmp 0x1404a4af5
mov qword [rdi + 8], r8
cmc
test r10, rdi
mov dword [rdi + 0x24], eax
cmp edx, r9d
jmp 0x1404a4b08
jne 0x1404a49ac
inc esi
movdqa xmmword [rsp + 0x40], xmm6
lea rdx, [rsp + 0x40]
not ecx
mov dword [rsp + 0x38], esi
mov rcx, rdi
call fcn.1401a9507
movups xmm0, xmmword [rsp + 0x30]
lea r11, [rsp + 0x60]
mov eax, eax
mov rax, rbp
mov r14w, 0x3e0b
setne sil
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
movsx edi, cx
mov rdi, qword [r11 + 0x28]
setl r14b
movdqu xmmword [rbp], xmm6
mov r14b, 0xf
movaps xmm6, xmmword [rsp + 0x50]
setnp r14b
not r14b
cmovp r14, r14
movdqu xmmword [rbp + 0x10], xmm0
mov bpl, 0x3a
mov rbp, qword [r11 + 0x18]
movsx r14, r12w
mov rsp, r11
setg r14b
mov r14b, dil
movzx r14d, r10w
pop r14
ret
Function at 0x1404b0834
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bswap r8
mov qword [rsp + 0x10], rsi
push rdi
adc dil, 0xb7
sub rsp, 0x20
add qword [rcx + 0x20], 8
movsx r8w, bpl
mov rdi, rcx
mov rax, qword [rcx + 0x20]
inc rsi
bsf r8w, r8w
movsx dx, r8b
mov esi, dword [rcx + 0x38]
movzx bx, r14b
btc dx, r14w
cmp esi, 0xffffffff
mov rdx, 0x1d6c6668
cwd
cmova dx, di
mov r8d, dword [rcx + 0x3c]
movzx edx, word [rcx + 0x42]
bswap rbx
jmp 0x1404b0895
mov rbx, qword [rax - 8]
mov eax, 0x7fffffff
jmp 0x1404b08a3
mov qword [rcx + 0x48], rbx
jmp 0x1404b08ac
cmove esi, eax
jmp 0x1404b08b4
mov rcx, qword [rcx]
jmp 0x1404b08bc
call fcn.14021f0b4
test al, al
jmp 0x1404b08c8
je 0x1404b0920
test rbx, rbx
jmp 0x1404b08d6
jne 0x1404b08fc
lea rbx, [0x1400d25f0]
movzx cx, r8b
jmp 0x1404b08ef
mov qword [rdi + 0x48], rbx
movzx edx, si
cmovge cx, r12w
cdq
movsxd rdx, esi
movsxd rcx, r15d
cmovp ecx, esi
mov rcx, rbx
jmp 0x1404b090d
mov byte [rdi + 0x54], 1
jmp 0x1404b0916
call fcn.1401cd178
jmp 0x1404b09c5
test rbx, rbx
jmp 0x1404b0928
jne 0x1404b093c
lea rbx, [0x1400ced98]
cmp al, dl
mov qword [rdi + 0x48], rbx
clc
xor r9d, r9d
test esi, esi
jle 0x1404b09b9
cmp byte [rbx], 0
jmp 0x1404b094f
je 0x1404b09b9
mov rax, qword [rdi + 8]
mov r8b, r14b
movzx edx, byte [rbx]
rol ch, 0x8a
and r8b, 0xc3
mov rcx, qword [rax]
bt eax, r10d
movzx rax, sp
sub al, r14b
mov rax, qword [rcx]
bswap r8d
movsx ecx, si
lea rcx, [rbx + 1]
and r8, r9
movsx r8w, r15b
movzx r8d, word [rax + rdx*2]
stc
cmc
and r8d, 0x8000
jmp 0x1404b099c
cmove rcx, rbx
sets bl
inc bx
inc r9d
lea rbx, [rcx + 1]
test r12b, r11b
cmp r9d, esi
jl 0x1404b0947
mov eax, r9d
and rbx, rsp
adc rsi, rsp
xor bl, r13b
mov dword [rdi + 0x50], eax
shr al, 0xd
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
rol dil, 0xa0
add rsp, 0x20
movzx di, bl
xchg rdi, rdi
pop rdi
jmp 0x1404b09ec
ret
Function at 0x1404b2cf5
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmc
test r15w, 0x266a
mov qword [rsp + 0x10], rsi
push rdi
inc di
sub rsp, 0x30
movsxd rdi, edi
mov edi, edx
adc si, 0x410b
mov rsi, rcx
cmp sil, bl
test r8, r8
jmp 0x1404b2d26
jne 0x1404b2d48
call fcn.1404b7622
mov dword [rax], 0x16
jmp 0x1404b2d3c
call fcn.1404b8312
xor eax, eax
jmp 0x1404b2e61
mov rdx, r9
movsxd rcx, r10d
xchg cx, cx
mov cx, r13w
mov rcx, r8
call fcn.1404b2ec7
mov rbx, rax
cmp esi, esi
cmp ebp, 0x2097924
test rax, rax
jmp 0x1404b2d70
je 0x1404b2df8
lea rax, [rsp + 0x50]
cmovle r9d, edx
movsxd rdx, r15d
movsx r9d, bp
mov rdx, rdi
movsx r9d, r10w
movsx cx, r10b
mov qword [rsp + 0x28], rax
movsxd rax, r12d
cwde
lea r8, [0x140094b24]
cmovs r9w, ax
jmp 0x1404b2dac
mov eax, dword [rsp + 0x60]
mov ecx, 0x16de508e
movsx r9, r10w
not rcx
mov r9, rbx
movzx rcx, ax
mov rcx, rsi
jmp 0x1404b2dcb
mov dword [rsp + 0x20], eax
jmp 0x1404b2dd4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1404b2e84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b2df3
call fcn.1404b7695
sub edi, edi
jmp 0x1404b2e03
test rbx, rbx
jmp 0x1404b2e0b
je 0x1404b2e53
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jmp 0x1404b2e1d
je 0x1404b2e29
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmc
test bx, r15w
test rcx, rcx
jmp 0x1404b2e3a
je 0x1404b2e46
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b2e4e
call fcn.1404cb6be
mov rax, rdi
test r13b, 0x5d
shr bx, cl
movsx si, dl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
cmp r9, 0x79b068f7
sbb rdi, r15
sal dil, 0x5a
add rsp, 0x30
pop rdi
jmp 0x1404b2e83
ret
mov rcx, qword [rsp + 0x68]
stc
test ecx, r14d
cmp al, bl
test rcx, rcx
jmp 0x1404b2e97
je 0x1404b2ea7
mov eax, dword [rsp + 0x50]
stc
mov dword [rcx], eax
test r12b, r15b
xor ebx, ebx
jmp 0x1404b2eae
jmp 0x1404b2e03

Function at 0x1404b31b5
Capabilities:
Terminate process

Disassembly:
push rbx
or bx, dx
sub rsp, 0x20
movsx bx, bl
mov ebx, ecx
call fcn.1404d4b9a
cmp eax, 1
je 0x1404b321b
mov rax, qword gs:[0x60]
btr rdx, r12
mov edx, dword [rax + 0xbc]
cmc
cmp di, dx
shr edx, 8
test r14b, r15b
jmp 0x1404b31f4
test dl, 1
jne 0x1404b321b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dl, 0x17
cwd
cmovae rdx, r15
mov edx, ebx
jmp 0x1404b3215
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404b30ea
mov ecx, ebx
jmp 0x1404b3229
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b6e67
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rdx
rdtsc
xadd r9w, r9w
mov qword [rsp + 8], rcx
push rbp
bt r8w, r8w
sal r9b, 0x95
cmp r10d, r10d
mov rbp, rsp
dec ah
sub rsp, 0x40
cwd
movsx r9, si
rdtsc
lea rax, [rbp + 0x10]
movzx r8w, dil
jmp 0x1404b6ea4
mov qword [rbp - 0x18], rax
cdq
xchg dx, ax
seto r9b
lea r9, [rbp + 0x28]
movsx ax, r10b
rdtsc
lea rax, [rbp + 0x18]
cdq
mov qword [rbp - 0x10], rax
cwde
movzx rax, r13w
cdq
lea r8, [rbp - 0x18]
bswap eax
mov eax, 2
cqo
movzx cx, ch
setle ch
lea rdx, [rbp - 0x20]
jmp 0x1404b6eea
lea rcx, [rbp + 0x20]
jmp 0x1404b6ef3
mov dword [rbp + 0x28], eax
jmp 0x1404b6efb
mov dword [rbp - 0x20], eax
jmp 0x1404b6f03
call fcn.140096f80
add rsp, 0x40
mov bpl, r12b
bswap ebp
movsx bp, dl
pop rbp
jmp 0x1404b6f1b
ret

Function at 0x1404b8398
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movsxd rcx, r10d
mov ecx, 0x17
jmp 0x1404b83a9
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b83b6
je 0x1404b83cd
mov ecx, 5
jmp 0x1404b83c6
int 0x29
jmp 0x1404b83cd
mov r8d, 1
movzx dx, sil
movsx ecx, bx
mov edx, 0xc0000417
movsxd rcx, edx
xchg rcx, rcx
lea ecx, [r8 + 1]
call fcn.1404b8416
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor dl, 0x98
and rdx, r8
sub edx, r14d
mov edx, 0xc0000417
add rsp, 0x28
jmp 0x1404b840f
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b9b9c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
shl cl, 0xa6
sar cx, cl
mov qword [rsp + 0x20], r9
xor cl, r9b
push rsi
rol cl, cl
and sil, dl
btr si, 0xfa
push rdi
movsx si, r9b
push r14
shrd rsi, rbx, 0xfe
sbb sil, 0x8f
rcr sil, 0x28
sub rsp, 0x60
not sil
movzx edi, si
jmp 0x1404b9bde
mov rsi, r9
mov rdi, r8
mov ch, 0xa9
mov ecx, dword [rdx]
jmp 0x1404b9bee
call fcn.1401af387
nop
mov rbx, qword [0x1400ba160]
lahf
bt r14w, 0xa4
movsxd rax, dword [0x1400ba158]
lea r14, [rbx + rax*8]
stc
mov qword [rsp + 0x38], rbx
jmp 0x1404b9c1c
cmp rbx, r14
jmp 0x1404b9c24
je 0x1404b9d44
mov rax, qword [rbx]
movzx rdx, si
mov qword [rsp + 0x20], rax
mov rdx, qword [rdi]
test rax, rax
jmp 0x1404b9c41
je 0x1404b9c8c
mov ecx, dword [rax + 0x14]
neg ax
sbb al, 0x76
mov eax, ecx
stc
cmc
shr eax, 0xd
test al, 1
je 0x1404b9c8c
mov eax, ecx
cmc
and al, 3
cmp al, 2
jne 0x1404b9c79
test cl, 0xc0
jmp 0x1404b9c73
jne 0x1404b9c9a
bt ecx, 0xb
jb 0x1404b9c9a
inc dword [rdx]
cmc
test r8w, 0x6114
add rbx, 8
jmp 0x1404b9c95
jmp 0x1404b9c0e
mov rdx, qword [rdi + 0x10]
cmovb ax, si
xchg r9w, r8w
movsx ecx, r14w
mov rcx, qword [rdi + 8]
movzx ax, sil
movsxd rax, r8d
cbw
mov rax, qword [rdi]
mov r9d, esi
not r9
jmp 0x1404b9cc6
lea r8, [rsp + 0x20]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
jmp 0x1404b9cdf
mov qword [rsp + 0x58], rdx
jmp 0x1404b9ce9
mov rax, qword [rsp + 0x20]
jmp 0x1404b9cfd
mov qword [rsp + 0x28], rax
mov r8b, r10b
jmp 0x1404b9d0a
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x28]
xchg r8w, r8w
lea r8, [rsp + 0x40]
jmp 0x1404b9d28
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x88]
jmp 0x1404b9d3a
call fcn.1404b9a47
jmp 0x1404b9c8c
mov ecx, dword [rsi]
jmp 0x1404b9d4b
call fcn.1400e7e86
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r14
movsxd rdi, r11d
pop rdi
movzx si, bpl
pop rsi
ret
Function at 0x1404ccc2d
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movzx rdx, r10w
cmovg dx, cx
mov r9w, 0x28f3
mov ebx, ecx
bswap r9w
lea r9, [0x1400c63d0]
movsxd rdx, esp
mov ecx, 5
cqo
bswap dx
mov r8, rdi
lea r8, [0x1400c63c8]
lea rdx, [0x1400cf758]
jmp 0x1404ccc70
call fcn.1404cdb77
mov ecx, ebx
cmp r14d, 0x1af8001c
test rax, rax
je 0x1404ccc9d
add rsp, 0x20
jmp 0x1404ccc90
pop rbx
jmp 0x1404ccc96
jmp qword [case.0x14044ab9b.0]
add rsp, 0x20
bswap bx
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404cccac
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sal r8b, cl
sub bl, bpl
push rdi
bsf r8w, r9w
sub rsp, 0x20
mov rbx, rdx
movsxd rdi, r15d
lea r9, [0x1400c63d8]
cwd
setae dh
mov edi, ecx
movsxd r8, r12d
mov cl, r9b
lea rdx, [0x1400cf748]
not ch
xchg cl, r8b
mov ecx, 6
bswap r8w
lea r8, [0x1400c63d0]
call fcn.1404cdb77
mov rdx, rbx
mov ecx, edi
test rax, rax
jmp 0x1404ccd09
je 0x1404ccd1a
call qword [case.0x14044ab9b.0]
jmp 0x1404ccd20
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
rcr dil, 0x8b
sub dil, 0x61
rcl dil, cl
add rsp, 0x20
jmp 0x1404ccd3f
pop rdi
ret

Function at 0x1404ccea2
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
rcl ebx, cl
movsx rbx, r14w
mov qword [rsp + 0x10], rbp
mov bpl, dil
bt ebp, 0xb0
sal bl, 0xa
mov qword [rsp + 0x18], rsi
cmovs bp, r14w
push rdi
bswap edi
clc
sub rsp, 0x30
movsx ebx, r15w
bswap bp
mov ebx, r9d
mov rdi, r8
mov esi, edx
cdq
movzx r8, r12w
lea r9, [0x1400c63e8]
mov dx, 0x4534
mov rbp, rcx
movsx r8, di
lea r8, [0x1400c63e0]
cqo
lea rdx, [0x1400cf190]
movsx cx, spl
movzx ecx, ax
mov ecx, 0xb
jmp 0x1404ccf16
call fcn.1404cdb77
mov rcx, rbp
test rax, rax
jmp 0x1404ccf26
je 0x1404ccf4a
mov r9d, ebx
mov r8, rdi
movsx dx, dh
cwd
mov edx, esi
jmp 0x1404ccf3f
call qword [case.0x14044ab9b.0]
jmp 0x1404ccf72
sub edx, edx
call fcn.1404cd5fe
mov ecx, eax
cdq
movsx r8d, bx
mov r9d, ebx
mov r8, rdi
cwd
not dh
bswap dx
mov edx, esi
jmp 0x1404ccf6c
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
adc dil, 0x41
movsx ebp, r10w
mov rbp, qword [rsp + 0x48]
cmc
mov rsi, qword [rsp + 0x50]
shld di, r14w, 0x5c
ror dil, cl
add rsp, 0x30
movzx rdi, r15w
movsxd rdi, esp
not edi
pop rdi
jmp 0x1404ccfa6
ret