joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14049d7ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rax, rsp
cmp r15b, 0x43
movzx r10, r12w
mov qword [rax + 8], rbx
clc
btc r10w, r9w
mov qword [rax + 0x10], rbp
and r11d, 0x20273433
not bpl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
inc rbp
adc sil, bpl
shrd rsi, r14, 0x46
push r14
mov bl, byte [rcx]
neg esi
bsf bp, r8w
bsr rbp, r10
lea r10, [rcx + 1]
shr bpl, cl
jmp 0x14049d801
mov byte [rdx], bl
mov esi, r9d
adc dil, r11b
inc r14b
lea r14, [0x140000000]
mov rbp, r8
setb dil
shrd r11w, r8w, 0xb5
rcr di, 0x80
mov r11, rdx
xor di, r12w
mov rdi, rcx
jmp 0x14049d836
test bl, 4
jmp 0x14049d83e
je 0x14049d87a
movzx ecx, byte [r10]
xor ah, 0xec
and ecx, 0xf
or al, spl
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
sub r10, rax
mov eax, dword [r10 - 4]
jmp 0x14049d86e
shr eax, cl
clc
jmp 0x14049d876
mov dword [rdx + 4], eax
clc
test bl, 8
jmp 0x14049d882
je 0x14049d89f
mov eax, dword [r10]
test r11b, 0xae
jmp 0x14049d894
add r10, 4
mov dword [rdx + 8], eax
stc
cmp dl, r9b
test bl, 0x10
jmp 0x14049d8a7
je 0x14049d8c5
mov eax, dword [r10]
bts r8w, bx
add r10, 4
bts r8w, cx
mov dword [rdx + 0xc], eax
btr r8d, r10d
movsxd rax, dword [r10]
lea r8, [r10 + 4]
clc
xor r9d, r9d
clc
stc
cmp byte [rsp + 0x30], r9b
jne 0x14049d9a2
test bl, 2
jmp 0x14049d8e5
je 0x14049d9a2
lea rdx, [rax + rbp]
adc ax, 0x3fce
ror r10, cl
movzx ecx, byte [rdx]
sub ax, r13w
and ecx, 0xf
test r13, r13
movsx rax, byte [rcx + r14 + 0xc1a30]
and r10w, 0xa2c
bt r10w, ax
mov cl, byte [rcx + r14 + 0xc1a40]
movzx r10w, spl
cmovae r10d, eax
sub rdx, rax
movsx r10, si
mov r10d, dword [rdx - 4]
clc
shr r10d, cl
mov dword [r11 + 0x10], r9d
cmp si, 0x5d81
clc
test r10d, r10d
jmp 0x14049d949
je 0x14049d9a6
mov eax, dword [rdx]
movsx ecx, r15w
rol cl, 0xb9
mov ecx, dword [rdx + 4]
cmp spl, dl
clc
lea rdx, [rdx + 8]
test r13, 0x27e61204
test rsp, r12
clc
cmp eax, esi
jmp 0x14049d975
je 0x14049d999
inc r9d
test r15b, 0x1e
test bp, r8w
cmp r9d, r10d
jmp 0x14049d98e
jb 0x14049d94f
jmp 0x14049d9a6
mov dword [r11 + 0x10], ecx
jmp 0x14049d9a6
mov dword [rdx + 0x10], eax
stc
test bl, 1
je 0x14049d9fc
movzx ecx, byte [r8]
rdtsc
bsf bx, r8w
and ecx, 0xf
cmc
sal bl, 0x70
movsx rdx, byte [rcx + r14 + 0xc1a30]
ror ax, cl
sal ax, cl
mov cl, byte [rcx + r14 + 0xc1a40]
sub r8, rdx
rdtsc
sal rax, cl
mov edx, dword [r8 - 4]
btc si, 0xf0
shr edx, cl
jmp 0x14049d9f4
mov dword [r11 + 0x14], edx
bts rsi, rbx
mov rbx, qword [rsp + 0x10]
or bp, r9w
sub r8, rdi
cbw
jmp 0x14049da0f
mov rbp, qword [rsp + 0x18]
movsxd rdi, ebx
setg r14b
jmp 0x14049da20
mov rax, r8
movsxd rsi, edi
mov rsi, qword [rsp + 0x20]
jmp 0x14049da36
mov rdi, qword [rsp + 0x28]
pop r14
jmp 0x14049da42
ret
Function at 0x1404abf3b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
setl bl
cwde
mov rax, qword [rcx + 0x460]
cmp edx, edi
mov r10, rcx
movsx rbx, r13w
shr r11, 0xa5
add rcx, 0x58
mov ebx, r8d
bts r11d, ecx
mov r11d, edx
test rax, rax
jmp 0x1404abf6e
jne 0x1404abf83
mov eax, 0x100
jmp 0x1404abf7e
jmp 0x1404abfa8
mov rcx, rax
mov ah, 0x10
btc ax, 0xf1
mov rax, qword [r10 + 0x458]
shld r8d, r14d, 0x52
cmp bh, 0xcb
mov r8b, 0xde
shr rax, 2
xadd r8d, r8d
lea rax, [rax - 1]
lea r8, [rcx + rax*2]
cmc
sub cl, ch
ror ah, 0xef
mov qword [r10 + 0x48], r8
btc ax, ax
sal ax, 0x73
mov rax, r8
rol ch, cl
sub cx, 0x51d2
cmp r10b, 0xc3
mov ecx, dword [r10 + 0x38]
test ecx, ecx
jmp 0x1404abfdb
jg 0x1404abfea
test r11d, r11d
je 0x1404ac096
sub edx, edx
movzx ax, spl
lea eax, [rcx - 1]
stc
cmp r10b, r15b
mov dword [r10 + 0x38], eax
mov eax, r11d
div ebx
shld r11d, r13d, 0xc1
add dx, 0x30
movzx r11w, r10b
rcr r11, cl
mov r11d, eax
stc
cmp dx, 0x39
jmp 0x1404ac01f
jbe 0x1404ac059
mov al, r9b
shr cl, cl
xor ch, ch
xor al, 1
shl al, 5
sbb rcx, 0x4b2044c5
mov ecx, 0x5a821de9
btc cx, r14w
add al, 7
add al, dl
and cl, 0x3d
jmp 0x1404ac04e
movsx edx, al
sal ch, cl
bt cx, r15w
cwde
mov rax, qword [r10 + 0x48]
bt rcx, 0x40
neg cx
movsx ecx, dl
test ebx, 0x48da4901
stc
mov word [rax], cx
sub rax, rsp
movzx ax, bpl
add qword [r10 + 0x48], 0xfffffffffffffffe
movzx eax, r15w
movsx eax, r9w
lahf
mov rax, qword [r10 + 0x48]
jmp 0x1404ac091
jmp 0x1404abfd0
mov rbx, qword [rsp + 8]
test al, dl
jmp 0x1404ac0a8
sub r8, rax
clc
jmp 0x1404ac0b2
sar r8, 1
cmp di, bp
test ah, 4
stc
mov dword [r10 + 0x50], r8d
jmp 0x1404ac0c5
add qword [r10 + 0x48], 2
ret
Function at 0x1404acc94
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
xchg esi, esi
bsr rsi, r11
sub esi, 0x59fa7bfb
push rdi
sub rsp, 0x30
mov edi, edx
test r15w, r10w
sub esi, 0x79e16919
mov rsi, rcx
test r8, r8
jmp 0x1404accc6
jne 0x1404acce8
call fcn.1404b152a
mov dword [rax], 0x16
jmp 0x1404accdc
call fcn.1404b2217
sub eax, eax
jmp 0x1404acde7
mov rdx, r9
movsx cx, r13b
jmp 0x1404accf5
mov rcx, r8
jmp 0x1404accfd
call fcn.1404ace4d
mov rbx, rax
jmp 0x1404acd0b
test rax, rax
jmp 0x1404acd13
je 0x1404acd8b
lea rax, [rsp + 0x50]
mov rdx, rdi
movzx r8d, si
mov qword [rsp + 0x28], rax
cbw
movsx rax, bp
cdqe
lea r8, [0x140094b24]
mov eax, dword [rsp + 0x60]
xchg cl, r9b
not r9b
movsx cx, bpl
mov r9, rbx
mov cx, bx
mov rcx, rsi
jmp 0x1404acd56
mov dword [rsp + 0x20], eax
jmp 0x1404acd5f
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test r10b, r11b
test rax, rax
jmp 0x1404acd73
jne 0x1404ace16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404acd86
call fcn.1404b15a5
xor edi, edi
test rbx, rbx
jmp 0x1404acd95
je 0x1404acddf
mov rcx, qword [rbx + 0x10]
stc
test rcx, rcx
jmp 0x1404acda8
je 0x1404acdb4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
jmp 0x1404acdbe
test rcx, rcx
jmp 0x1404acdc6
je 0x1404acdd2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404acdda
call fcn.1404c558c
mov rax, rdi
test dl, 0xf6
neg edi
mov rbx, qword [rsp + 0x40]
movzx si, r10b
btc si, ax
mov rsi, qword [rsp + 0x48]
add dil, r15b
xor di, r8w
add rsp, 0x30
not dil
movzx di, cl
xchg di, di
pop rdi
jmp 0x1404ace15
ret
mov rcx, qword [rsp + 0x68]
test sp, cx
test rcx, rcx
je 0x1404ace2d
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
sub ebx, ebx
jmp 0x1404ace34
jmp 0x1404acd8d

Function at 0x1404ad0f7
Capabilities:
Terminate process

Disassembly:
push rbx
ror bx, 0x5a
btr rbx, rbx
ror ebx, cl
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404ad10e
call fcn.1404cea75
cmp eax, 1
je 0x1404ad164
mov rax, qword gs:[0x60]
shl dh, 0x30
xor dh, 0xda
ror edx, 0x95
mov edx, dword [rax + 0xbc]
clc
stc
shr edx, 8
test dl, 1
jmp 0x1404ad141
jne 0x1404ad164
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsxd rdx, r14d
cmovg edx, eax
cdq
mov edx, ebx
jmp 0x1404ad15e
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404ad060
mov ecx, ebx
jmp 0x1404ad172
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b3a9a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
shl cx, 0x56
rcr ch, cl
mov qword [rsp + 0x20], r9
jmp 0x1404b3ab4
push rsi
or cx, di
push rdi
shld rdi, r12, 0x2c
push r14
adc dil, 0xa6
or rdi, rdi
sub rsp, 0x60
movzx ecx, r14w
bswap rsi
movsx esi, ax
mov rsi, r9
mov rdi, r8
mov ecx, dword [rdx]
call fcn.14024027a
nop
add al, 0x50
mov rbx, qword [0x1400ba160]
add r14b, 0x5e
movsxd rax, dword [0x1400ba158]
sar r14w, 0xf1
bts r14w, si
lea r14, [rbx + rax*8]
cmp spl, 0xd5
clc
mov qword [rsp + 0x38], rbx
cmp rbx, r14
jmp 0x1404b3b17
je 0x1404b3c4e
mov rax, qword [rbx]
rcl dh, cl
mov qword [rsp + 0x20], rax
sbb dx, 0x16b7
xor edx, r12d
mov rdx, qword [rdi]
test rax, rax
jmp 0x1404b3b3a
je 0x1404b3ba2
mov ecx, dword [rax + 0x14]
bts ax, r15w
bsr ax, r14w
bt eax, 0xcc
mov eax, ecx
cmp sil, 0x3a
shr eax, 0xd
cmp r9d, 0x7ce03520
test r8w, cx
test al, 1
je 0x1404b3ba2
mov eax, ecx
and al, 3
clc
cmp ax, 0x359d
cmp al, 2
jmp 0x1404b3b7d
jne 0x1404b3b91
test cl, 0xc0
jmp 0x1404b3b8b
jne 0x1404b3bb0
bt ecx, 0xb
jmp 0x1404b3b9a
jb 0x1404b3bb0
inc dword [rdx]
add rbx, 8
jmp 0x1404b3bab
jmp 0x1404b3b0a
mov rdx, qword [rdi + 0x10]
movzx rax, r13w
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
jmp 0x1404b3bc9
lea r8, [rsp + 0x20]
mov qword [rsp + 0x40], r8
cmovno r9w, si
mov qword [rsp + 0x48], rax
movzx r8d, r13w
mov qword [rsp + 0x50], rcx
xchg r9w, ax
cwde
mov qword [rsp + 0x58], rdx
movzx r8, di
jmp 0x1404b3bfc
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
xchg r9b, r9b
movsxd r9, r10d
jmp 0x1404b3c11
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x28]
movzx ecx, r9w
lea r8, [rsp + 0x40]
movzx cx, cl
movsxd rcx, edi
movzx rdx, si
lea rdx, [rsp + 0x30]
movsxd rcx, edx
lea rcx, [rsp + 0x88]
jmp 0x1404b3c44
call fcn.1404b395b
jmp 0x1404b3ba2
mov ecx, dword [rsi]
jmp 0x1404b3c55
call fcn.1400e0230
mov rbx, qword [rsp + 0x80]
or dil, 0xe1
add rsp, 0x60
pop r14
pop rdi
mov si, ax
jmp 0x1404b3c79
pop rsi
jmp 0x1404b3c7f
ret
Function at 0x1404bfb07
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
add r10w, 0x631
rol r10w, 0xd7
mov qword [rax + 8], rbx
rcr r10b, cl
dec r10b
mov qword [rax + 0x10], rbp
test al, 0xe2
mov bx, si
sal r10b, 0x39
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
dec r10b
or bx, r11w
or ebp, 0xffffffff
mov rbx, r8
sub r10d, 0xfb84fbc
cmp dword [rcx + 0x10], 0
movzx r10d, r11w
movzx r10, r15w
mov r10, rdx
jmp 0x1404bfb5e
je 0x1404bfcdf
movsxd r9, dword [rcx + 0x10]
or ch, 0xc5
test r9w, cx
lea r14, [0x140000000]
mov rdi, qword [rdx + 8]
adc ax, bp
rcr rdx, 0xaa
shr dl, 1
xor esi, esi
or cl, sil
adc r11b, dil
lea r9, [r9 + rdi]
cmovns dx, r8w
dec al
sub r8d, r8d
rcl dx, cl
movzx r11d, r12w
mov edx, ebp
xchg r11, rcx
movzx ecx, byte [r9]
sbb ah, 0xe3
bswap ax
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
btc r11d, r12d
sub r11b, r12b
mov cl, byte [rcx + r14 + 0xc1a40]
xor r11b, dil
bsf r11, rax
or r11d, 0x50c61270
sub r9, rax
sar r11b, cl
mov r11d, dword [r9 - 4]
cmp r9w, cx
clc
test ecx, 0x540d2b64
shr r11d, cl
test r11d, r11d
jmp 0x1404bfbf8
je 0x1404bfcdf
mov rax, qword [r10 + 0x10]
mov r10d, dword [rax]
mov al, r10b
movzx ecx, byte [r9]
sal ax, 0x2a
and ecx, 0xf
rol al, cl
shld ax, r13w, 0x4f
movsx rax, byte [rcx + r14 + 0xc1a30]
clc
stc
cmp bh, 0xa4
mov cl, byte [rcx + r14 + 0xc1a40]
cmc
test cx, cx
sub r9, rax
sub eax, 0x72fb7766
cmc
mov eax, dword [r9 - 4]
shr eax, cl
add esi, eax
mov eax, esi
stc
add rax, r10
add rax, rdi
stc
test bx, 0x25f
cmp rbx, rax
jmp 0x1404bfc5d
jb 0x1404bfcc3
movzx ecx, byte [r9]
inc r8d
and ecx, 0xf
or ax, 0x7397
btr dx, 0xdb
rcl rax, 0x5f
movsx rax, byte [rcx + r14 + 0xc1a30]
btr rdx, rax
movzx rdx, bp
and edx, 0x39987bef
mov cl, byte [rcx + r14 + 0xc1a40]
movzx rdx, sp
sub r9, rax
mov edx, dword [r9 - 4]
test r12w, di
cmp r11, r11
shr edx, cl
jmp 0x1404bfcb2
dec edx
clc
cmp r8d, r11d
jmp 0x1404bfcbd
jb 0x1404bfc08
test r8d, r8d
lahf
cmove edx, ebp
cwde
movzx rax, dx
cmove eax, r10d
mov eax, edx
jmp 0x1404bfcda
jmp 0x1404bfce5
mov eax, ebp
movsx esi, r13w
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
xchg rsi, rsi
mov dil, r10b
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
xchg r14, r14
movzx r14w, r12b
jmp 0x1404bfd0c
pop r14
ret

Function at 0x1404c69dd
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
adc r9b, bl
sub rsp, 0x20
cwd
movzx dx, dil
mov rbx, rcx
bswap r8w
movsx rdx, dx
cwd
lea r9, [0x1400c63c0]
mov ecx, 3
lea r8, [0x1400c63b8]
xchg dl, dh
bswap dx
lea rdx, [0x1400cfb70]
call fcn.1404c79d7
test rax, rax
jmp 0x1404c6a26
je 0x1404c6a42
mov rcx, rbx
or bl, 0x88
movzx rbx, r8w
add rsp, 0x20
pop rbx
jmp qword [case.0x140162398.0]
add rsp, 0x20
pop rbx
jmp 0x1404c6a4c
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1404c6ae9
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsx r9w, r14b
cdq
mov ebx, ecx
lea r9, [0x1400c63d0]
mov ecx, 5
mov r8w, 0x4846
jmp 0x1404c6b0d
lea r8, [0x1400c63c8]
setns dl
cmovae edx, r13d
xchg dx, dx
lea rdx, [0x1400cf758]
jmp 0x1404c6b2a
call fcn.1404c79d7
mov ecx, ebx
cmp esp, ebp
stc
test rax, rax
je 0x1404c6b51
add rsp, 0x20
mov bh, 0x62
pop rbx
jmp 0x1404c6b4a
push qword [0x1400b8d90]
ret
add rsp, 0x20
movsx bx, r13b
movzx bx, r11b
pop rbx
jmp 0x1404c6b65
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c6b6c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
btr r9d, ebp
jmp 0x1404c6b7a
push rdi
cmc
sub rsp, 0x20
not edi
movzx r8d, cx
mov rbx, rdx
cdq
lea r9, [0x1400c63d8]
cqo
movsx edx, ax
mov r8b, 0xb
mov edi, ecx
cmovge r8, rbx
setno ch
lea rdx, [0x1400cf748]
xchg ecx, r8d
mov ecx, 6
mov r8w, sp
setae r8b
xchg r8d, r8d
lea r8, [0x1400c63d0]
jmp 0x1404c6bc8
call fcn.1404c79d7
mov rdx, rbx
mov ecx, edi
stc
clc
test sil, 2
test rax, rax
je 0x1404c6bec
call qword [case.0x140162398.0]
jmp 0x1404c6bf2
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
not di
pop rdi
jmp 0x1404c6c04
ret

Function at 0x1404c6d66
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
shl ebx, 0x2c
mov qword [rsp + 0x10], rbp
rol ebp, 0x55
rol ebx, cl
bsf ebx, r10d
mov qword [rsp + 0x18], rsi
sub bpl, 0x72
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
setl r8b
movzx ebp, ax
movsx r9, r9w
mov esi, edx
bswap r9
not r8
movzx r9w, r11b
lea r9, [0x1400c63e8]
setno bpl
mov rbp, rcx
bswap dx
movzx r8d, r8w
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
xchg cx, cx
mov ecx, 0xb
jmp 0x1404c6dd8
call fcn.1404c79d7
mov rcx, rbp
test bl, r9b
test rax, rax
jmp 0x1404c6deb
je 0x1404c6e19
mov r9d, ebx
movsx edx, cx
mov r8, rdi
movzx dx, r15b
cdq
mov rdx, 0x6ea70731
mov edx, esi
jmp 0x1404c6e0e
call qword [case.0x140162398.0]
jmp 0x1404c6e45
sub edx, edx
call fcn.1404c748e
mov ecx, eax
cdq
mov r9d, ebx
mov rdx, 0x8844a3a
movsx r8d, ax
cdq
mov r8, rdi
mov rdx, rsi
mov edx, esi
jmp 0x1404c6e3f
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
movsx rbp, r8w
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rdi, r9d
not edi
add rsp, 0x30
movsx di, r15b
mov di, 0x59c5
pop rdi
jmp 0x1404c6e70
ret
Function at 0x1404d1434
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
stc
mov qword [rax + 0x10], rbp
stc
cmp r13b, dil
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
or sil, r8b
add si, 0x1f0a
push r12
push r14
shrd rax, rsi, 0x8f
push r15
stc
rcr al, cl
sub rsp, 0x20
sbb sil, cl
cmovg rax, r8
rcl dil, cl
xor ebx, ebx
mov rax, r10
shld si, r15w, 0xeb
mov r15, r8
mov edi, edx
movsx ax, r8b
mov r12, rcx
clc
btr si, 0xcb
movzx ax, r11b
mov eax, 1
or rsi, 0x5b7a1190
mov esi, ebx
test edx, edx
js 0x1404d1552
test eax, eax
jmp 0x1404d14b0
je 0x1404d1554
mov rcx, qword [r15]
cdq
inc r14w
lea eax, [rsi + rdi]
add edx, r9d
sub r14d, esp
bsr dx, r10w
cdq
movsxd r14, r11d
sub eax, edx
sar eax, 1
test bpl, 0xc6
xor r14b, 0xef
btr dx, 0x4f
movsxd rbp, eax
or dx, 0x2f23
mov r14, rbp
or dl, r14b
ror dh, 0xf7
shl r14, 4
mov rdx, qword [r14 + r12]
jmp 0x1404d14ff
call fcn.1404c630b
test eax, eax
jmp 0x1404d150b
jne 0x1404d152e
lea rcx, [r12 + 8]
clc
cmp r11, r15
test r10b, 7
add rcx, r14
jmp 0x1404d1526
mov qword [r15], rcx
jmp 0x1404d1545
jns 0x1404d1541
lea edi, [rbp - 1]
jmp 0x1404d153c
jmp 0x1404d1545
lea esi, [rbp + 1]
clc
cmp esi, edi
jmp 0x1404d154c
jle 0x1404d14a9
test eax, eax
mov rbp, qword [rsp + 0x48]
movsx r15w, r11b
movsx rdi, r9w
movzx r14, r12w
sete bl
shr al, cl
movzx ax, r9b
rcr di, cl
mov rsi, qword [rsp + 0x50]
mov al, dh
lahf
movzx r15w, r10b
mov eax, ebx
sar r14d, 0x4a
mov rbx, qword [rsp + 0x40]
movzx rdi, r11w
add dil, 0x81
test r10b, 0x98
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
movsx r14w, bl
movzx r14d, r8w
mov r14b, bl
pop r15
pop r14
cmovle r12w, dx
xchg r12b, r12b
movzx r12d, sp
pop r12
jmp 0x1404d15c3
ret
Function at 0x1404d35fe
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
add bh, 0x84
or bx, 0x58c0
mov qword [rsp + 0x18], rsi
movzx ebx, cx
shr bl, cl
push rdi
sal edi, 0xd
sub rsp, 0x20
btr rdi, rax
xor esi, esi
movsx rbx, r10w
rcl bl, 0x48
mov rdi, rdx
rcl bh, cl
mov rbx, rcx
jmp 0x1404d3637
test rcx, rcx
jmp 0x1404d363f
je 0x1404d36e2
cmp word [rcx], si
jmp 0x1404d364d
je 0x1404d36e2
lea rdx, [0x1400d1d08]
jmp 0x1404d365f
call fcn.1400e8374
test eax, eax
jmp 0x1404d366b
je 0x1404d36e2
lea rdx, [0x1400d1d00]
movzx rcx, si
jmp 0x1404d3684
mov rcx, rbx
call fcn.1400e8374
test eax, eax
jmp 0x1404d3693
jne 0x1404d36d5
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
mov dl, bh
cmovg r8, r9
cqo
lea r8, [rsp + 0x30]
xchg dl, dl
mov edx, 0x2000000b
jmp 0x1404d36b9
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d36c6
je 0x1404d371d
mov eax, dword [rsp + 0x30]
jmp 0x1404d3741
mov rcx, rbx
call fcn.1404dc643
jmp 0x1404d3741
mov ecx, dword [rdi + 8]
movsxd rdx, ebp
not r8w
lea r8, [rsp + 0x30]
cwd
movzx r9w, r8b
mov r9d, 2
not dh
jmp 0x1404d3705
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d3717
jne 0x1404d3729
sub eax, eax
jmp 0x1404d3724
jmp 0x1404d3741
mov eax, dword [rsp + 0x30]
stc
test eax, eax
jmp 0x1404d3735
jne 0x1404d3741
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
xor sil, 0x48
and sil, r15b
mov rsi, qword [rsp + 0x40]
movsx rdi, si
add rsp, 0x20
movsx edi, r8w
movzx di, bl
movsxd rdi, eax
pop rdi
jmp 0x1404d376b
ret

Function at 0x1404d376c
Capabilities:
Encrypt data using rc4 prga
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
stc
btc ebx, esi
mov qword [rsp + 0x18], rsi
movsx esi, r11w
rcr bl, 0x42
test r15b, 0x72
push rdi
bts esi, esp
rcr sil, cl
cmc
sub rsp, 0x20
cmovo si, bp
mov esi, edx
movsx bx, r14b
movsx ebx, r13w
mov ebx, ecx
jmp 0x1404d37a7
call fcn.1404c5905
mov ecx, ebx
xor edi, r12d
lea r8, [rsp + 0x30]
shl dil, 0x67
and ecx, 0x3ff
cqo
btc r9, rdi
stc
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
movzx di, bpl
movsxd rdi, ebp
movsx edi, r15w
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test r8w, sp
cmp si, 0x5133
stc
test eax, eax
jmp 0x1404d37ff
je 0x1404d38b5
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d380e
je 0x1404d38a6
test esi, esi
je 0x1404d38a6
mov r9, qword [rdi + 0x98]
mov r8d, r10d
movzx edx, word [r9]
lea rcx, [r9 + 2]
sbb rax, rbp
lea eax, [rdx - 0x41]
cmp r10d, r15d
cmp rbx, 0x489f68ae
cmp ax, 0x19
jmp 0x1404d3847
jbe 0x1404d3866
sub dx, 0x61
clc
jmp 0x1404d3857
cmp dx, 0x19
jmp 0x1404d3860
ja 0x1404d3886
movzx edx, word [rcx]
jmp 0x1404d386e
inc r8d
clc
cmp edx, 0x937073d
add rcx, 2
jmp 0x1404d3881
jmp 0x1404d3831
or rcx, 0xffffffffffffffff
jmp 0x1404d388f
inc rcx
cmp word [r9 + rcx*2], r10w
jne 0x1404d388f
cmp r8d, ecx
je 0x1404d38b5
mov eax, 1
jmp 0x1404d38b0
jmp 0x1404d38c1
sub eax, eax
movzx rsi, si
ror rdi, cl
neg dil
mov rbx, qword [rsp + 0x38]
rcr dil, cl
shld di, ax, 0xa1
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
xchg dil, dil
pop rdi
jmp 0x1404d38e0
ret
Function at 0x1404d4f1f
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
stc
jmp 0x1404d4f38
mov qword [rax + 0x18], rsi
test ch, al
mov qword [rax + 0x20], rdi
push r14
jmp 0x1404d4f49
sub rsp, 0x40
jmp 0x1404d4f52
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
dec bh
mov rbx, rax
test sil, r15b
test rax, rax
je 0x1404d50c9
mov rsi, rax
cmc
cmp word [rax], r14w
je 0x1404d4fb1
or rax, 0xffffffffffffffff
jmp 0x1404d4f83
inc rax
cmp word [rsi + rax*2], r14w
jmp 0x1404d4f90
jne 0x1404d4f83
lea rsi, [rsi + rax*2]
cmp r10b, 0x47
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d4fab
jne 0x1404d4f7a
mov qword [rsp + 0x38], r14
btr r9w, 0xf6
sal r9d, cl
shld r9w, cx, 0x91
sub rsi, rbx
adc r8b, r11b
sub r8b, r9b
sbb r8b, r9b
mov qword [rsp + 0x30], r14
add rsi, 2
rcr r8, 0xca
ror r9w, 0x99
movzx r9d, r11w
sar rsi, 1
mov r8, rbx
test r8b, r8b
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
test r12w, r12w
mov qword [rsp + 0x20], r14
sub ecx, ecx
jmp 0x1404d500a
call fcn.1404c56bb
movsxd rbp, eax
cmp rdi, rsi
test eax, eax
je 0x1404d50c9
mov rcx, rbp
jmp 0x1404d5025
call fcn.1404c5607
mov rdi, rax
test r14d, r13d
clc
test rax, rax
je 0x1404d50a6
mov qword [rsp + 0x38], r14
btr r8d, 5
mov r9d, esi
mov qword [rsp + 0x30], r14
movsx r8d, r9w
dec r8b
mov r8, rbx
test r9b, 0xf
cmp r9w, 0x485e
cmc
mov dword [rsp + 0x28], ebp
cmp dil, r13b
test r13, 0x67ae01ef
sub edx, edx
cmp esi, esi
xor ecx, ecx
jmp 0x1404d507a
mov qword [rsp + 0x20], rax
jmp 0x1404d5084
call fcn.1404c56bb
test eax, eax
jmp 0x1404d5090
je 0x1404d50a6
mov rsi, rdi
mov rdi, r14
jmp 0x1404d50a1
jmp 0x1404d50b7
mov rsi, r14
movsx ecx, r11w
jmp 0x1404d50b7
mov rcx, rdi
jmp 0x1404d50bf
call fcn.1404c558c
jmp 0x1404d50d2
mov rsi, r14
cmp r14w, 0x4c6e
test rbx, rbx
jmp 0x1404d50da
je 0x1404d50ee
mov rcx, rbx
jmp 0x1404d50e8
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
btc rdi, rbp
mov rax, rsi
mov rsi, qword [rsp + 0x60]
btr r14, rdi
movsx bp, dil
clc
mov rbp, qword [rsp + 0x58]
bts r14d, esp
mov rdi, qword [rsp + 0x68]
btc r14d, 0x2e
test r14w, di
sal r14d, cl
add rsp, 0x40
setno r14b
pop r14
jmp 0x1404d5132
ret
Function at 0x1404d5133
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmp si, r13w
cmp bh, 0x1b
mov qword [rsp + 0x10], rbp
test r10w, 0xf7a
jmp 0x1404d5152
mov qword [rsp + 0x18], rsi
test r14, r9
stc
push rdi
cmp r13d, ebx
cmc
sub rsp, 0x20
jmp 0x1404d5169
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
bsf bx, sp
mov rbx, r14
mov rbx, rax
cmp r13w, 0x3dfa
stc
test rax, rax
jmp 0x1404d518a
je 0x1404d526b
mov rbp, rax
cmp spl, 0xfb
cmp word [rax], si
jmp 0x1404d519f
je 0x1404d51e7
or rax, 0xffffffffffffffff
inc rax
clc
cmp ax, 0x5412
cmp rsp, r12
cmp word [rbp + rax*2], si
jmp 0x1404d51be
jne 0x1404d51a9
lea rbp, [rbp + rax*2]
jmp 0x1404d51d4
add rbp, 2
cmp word [rbp], si
jmp 0x1404d51e1
jne 0x1404d51a5
sub rbp, rbx
rol cl, 4
add rbp, 2
btr ecx, 0x55
shr ch, cl
ror ch, 0x1c
sar rbp, 1
movsx rcx, r14w
add rbp, rbp
mov rcx, rbp
jmp 0x1404d520c
call fcn.1404c5607
mov rdi, rax
cmc
test rax, rax
jmp 0x1404d521d
je 0x1404d5251
mov r8, rbp
movzx edx, r14w
cqo
xchg cx, cx
mov rdx, rbx
movzx rcx, r13w
movsx rcx, bp
mov rcx, rax
jmp 0x1404d5242
call fcn.14049f5b0
mov rsi, rdi
cmp r15d, ecx
test r14b, 0x39
xor ecx, ecx
jmp 0x1404d5258
call fcn.1404c558c
mov rcx, rbx
jmp 0x1404d5265
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
rcl bpl, cl
mov rsi, qword [rsp + 0x40]
ror ebp, 0xc9
mov rbp, qword [rsp + 0x38]
cmc
add rsp, 0x20
pop rdi
ret