joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a8f0b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
sar dx, 0xf8
rcr rdx, cl
and dx, 0x2534
mov qword [rsp + 0x10], rsi
push rdi
bt rdi, r13
sub rsp, 0x20
bsr rax, rsi
mov r8d, 0xdb25600
add qword [rcx + 0x20], 8
movsx r8d, cx
mov rdi, rcx
shrd bx, bp, 0xa9
bswap ebx
mov rax, qword [rcx + 0x20]
mov esi, dword [rcx + 0x38]
or r8b, 0x87
cmp esi, 0xffffffff
jmp 0x1404a8f5f
mov r8d, dword [rcx + 0x3c]
jmp 0x1404a8f6a
movzx edx, word [rcx + 0x42]
movzx ebx, dx
movsx rbx, di
mov rbx, qword [rax - 8]
not ax
movzx ax, dh
mov ax, dx
mov eax, 0x7fffffff
jmp 0x1404a8f8d
mov qword [rcx + 0x48], rbx
jmp 0x1404a8f96
cmove esi, eax
jmp 0x1404a8f9e
mov rcx, qword [rcx]
jmp 0x1404a8fa6
call fcn.1401ca76a
test al, al
jmp 0x1404a8fb2
je 0x1404a8ff7
test rbx, rbx
jmp 0x1404a8fc0
jne 0x1404a8fd9
lea rbx, [0x1400d25f0]
mov qword [rdi + 0x48], rbx
mov cx, 0x644f
movzx ecx, r10w
movsxd rdx, esi
mov rcx, rbx
jmp 0x1404a8fe4
mov byte [rdi + 0x54], 1
jmp 0x1404a8fed
call fcn.1401bb5c0
jmp 0x1404a90a4
test rbx, rbx
jmp 0x1404a8fff
jne 0x1404a9010
lea rbx, [0x1400ced98]
mov qword [rdi + 0x48], rbx
xor r9d, r9d
stc
clc
test esi, esi
jle 0x1404a9099
cmp byte [rbx], 0
jmp 0x1404a9025
je 0x1404a9099
mov rax, qword [rdi + 8]
movsx r8, r9w
movzx edx, byte [rbx]
btr r8w, 0x24
mov rcx, qword [rax]
sub ax, r9w
btc ax, 0x4a
mov rax, qword [rcx]
lea rcx, [rbx + 1]
xor r8d, r13d
btr r8, rdi
bswap r8
movzx r8d, word [rax + rdx*2]
and r8d, 0x8000
jmp 0x1404a906a
cmove rcx, rbx
mov bx, 0x1c3
movsx ebx, r13w
mov bx, r9w
inc r9d
movsx ebx, r10w
shr bh, cl
lea rbx, [rcx + 1]
stc
cmp r9b, r9b
cmp r9d, esi
jmp 0x1404a9093
jl 0x1404a901d
mov eax, r9d
not rsi
test r12b, 0x39
cmc
mov dword [rdi + 0x50], eax
sbb si, 0x3db1
mov al, 1
mov rbx, qword [rsp + 0x30]
btc rsi, 0xfe
sub si, r12w
mov rsi, qword [rsp + 0x38]
bts rdi, rdi
shr dil, 0x73
bt di, 0x2b
add rsp, 0x20
jmp 0x1404a90da
pop rdi
jmp 0x1404a90e0
ret
Function at 0x1404a9858
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
rcl bh, cl
add ebx, r14d
mov qword [rsp + 0x18], rbp
btr ebx, r11d
mov qword [rsp + 0x20], rsi
test r11, rbp
bts ebx, r13d
xadd bl, bl
push rdi
movzx bx, dh
test r11w, 0x2777
movzx rbx, r13w
sub rsp, 0x30
sub ebp, ebp
bt ebx, 0x41
xor rbx, 0x1f273c78
movsxd rbx, r11d
mov rbx, rcx
jmp 0x1404a98aa
cmp byte [rcx + 0x54], bpl
jmp 0x1404a98b3
jne 0x1404a99e3
cmp dword [rcx + 0x50], ebp
jmp 0x1404a98c1
jle 0x1404a99e3
mov rsi, qword [rcx + 0x48]
movsx edi, r9w
mov r9w, 0x5846
cbw
mov edi, ebp
mov r8, 0x549d479d
movzx rax, r8w
mov r9, qword [rbx + 8]
movsx ax, ah
setae cl
lea rcx, [rsp + 0x40]
movzx edx, r12w
nop
movsx r8, bp
mov word [rsp + 0x40], bp
rdtsc
mov rdx, rsi
mov rax, qword [r9]
cmovs r8w, bp
movsx r8d, r13w
movsxd r8, dword [rax + 8]
jmp 0x1404a991b
call fcn.1404caf98
movsxd r8, eax
stc
test eax, eax
jmp 0x1404a992b
jle 0x1404a99d5
mov rcx, qword [rbx + 0x468]
movzx dx, r10b
movzx edx, word [rsp + 0x40]
and rax, r13
mov rax, qword [rcx + 8]
clc
cmp qword [rcx + 0x10], rax
jne 0x1404a9979
cmp byte [rcx + 0x18], bpl
je 0x1404a996b
inc dword [rbx + 0x28]
jmp 0x1404a9966
jmp 0x1404a99b8
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404a9974
jmp 0x1404a99b8
inc dword [rbx + 0x28]
lahf
dec eax
inc qword [rcx + 0x10]
mov rax, qword [rbx + 0x468]
mov rcx, qword [rax]
xor al, 0xa3
shld ax, cx, 0x7e
adc al, r8b
mov word [rcx], dx
ror al, cl
not rax
neg ax
mov rax, qword [rbx + 0x468]
jmp 0x1404a99af
add qword [rax], 2
cmp edx, esi
test r12d, r9d
add rsi, r8
jmp 0x1404a99c0
inc edi
cmc
test sil, 9
cmp edi, dword [rbx + 0x50]
jne 0x1404a98e3
jmp 0x1404a9a12
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404a99de
jmp 0x1404a9a12
mov r8d, dword [rbx + 0x50]
bswap rdx
lea rax, [rcx + 0x10]
neg dx
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
test r14b, r13b
add rcx, 0x468
mov qword [rsp + 0x20], rax
jmp 0x1404a9a0d
call fcn.1404a7cc4
mov rbx, qword [rsp + 0x48]
mov al, 1
movsx rdi, bp
sub rbp, 0x4e251fb8
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
rol dil, cl
mov edi, 0x67f3344c
cmp r9, rdx
add rsp, 0x30
movzx edi, r11w
pop rdi
jmp 0x1404a9a47
ret
Function at 0x1404aa1d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jmp 0x1404aa1e8
jle 0x1404aa2ff
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, dword [r9]
rol ax, 0xcb
xadd di, di
mov rbx, rcx
movzx edi, r10w
movsx edi, dl
rcr dx, 0x12
btr rdx, 0x8d
xor r11d, r11d
add ax, 0x1534
seto ah
cmovle ax, di
mov rdx, qword [rbx]
mov rax, qword [rdx + 8]
test r8b, bl
stc
cmp qword [rdx + 0x10], rax
jmp 0x1404aa238
jne 0x1404aa26b
cmp byte [rdx + 0x18], 0
jmp 0x1404aa247
je 0x1404aa25a
inc r10d
jmp 0x1404aa255
jmp 0x1404aa25e
or r10d, 0xffffffff
mov dword [r9], r10d
jmp 0x1404aa266
jmp 0x1404aa2bc
lea eax, [r10 + 1]
movzx r10w, cl
movsx ecx, dx
movsxd r10, esp
mov dword [r9], eax
mov rax, qword [rbx]
inc qword [rax + 0x10]
mov rax, qword [rbx]
xor cl, sil
xchg cx, r10w
mov rcx, qword [rax]
rcr r10d, 0xf
bt r10w, 0x71
movzx r10w, spl
mov word [rcx], di
stc
clc
mov rax, qword [rbx]
cmc
movsx r10, r8w
movzx r10, di
add qword [rax], 2
setnp r10b
mov r10d, dword [r9]
cmp r10d, 0xffffffff
jmp 0x1404aa2c5
je 0x1404aa2e4
inc r11d
jmp 0x1404aa2d6
cmp r11d, r8d
jmp 0x1404aa2de
jl 0x1404aa224
mov rbx, qword [rsp + 8]
cmovge di, r10w
movzx rdi, r10w
not dil
mov rdi, qword [rsp + 0x10]
jmp 0x1404aa2ff
ret

Function at 0x1404ab500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404ab515
mov qword [rsp + 0x10], rsi
push rdi
sub di, 0x5cd1
sub rsp, 0x30
mov edi, edx
bsf esi, esp
rol esi, cl
sar sil, cl
mov rsi, rcx
cmc
cmp r9, r9
test r8, r8
jmp 0x1404ab53d
jne 0x1404ab55f
call fcn.1404afe81
mov dword [rax], 0x16
call fcn.1404b0b68
sub eax, eax
jmp 0x1404ab55a
jmp 0x1404ab678
mov rdx, r9
mov cl, spl
mov rcx, r8
jmp 0x1404ab56d
call fcn.1404ab6ce
mov rbx, rax
clc
test r9b, 0x5a
cmp rcx, 0x53053faf
test rax, rax
jmp 0x1404ab589
je 0x1404ab61b
lea rax, [rsp + 0x50]
not r9
cmovns r8, rbx
movsxd r9, esp
mov rdx, rdi
movsx r9d, r14w
cmovb ecx, r13d
bswap r8d
mov qword [rsp + 0x28], rax
cmovge r9, r12
movsx r8w, spl
lea r8, [0x140094b24]
movzx rax, cx
movsx r9, cx
bswap rcx
mov eax, dword [rsp + 0x60]
movzx r9w, r9b
movsx r9d, r9w
mov r9, rbx
movsx rcx, r14w
cmovb ecx, edx
mov ecx, ebp
mov rcx, rsi
jmp 0x1404ab5ed
mov dword [rsp + 0x20], eax
jmp 0x1404ab5f6
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmc
test rax, rax
jmp 0x1404ab608
jne 0x1404ab69a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404aff01
xor edi, edi
test rbx, rbx
jmp 0x1404ab625
je 0x1404ab675
mov rcx, qword [rbx + 0x10]
cmp edx, 0x59392bf0
jmp 0x1404ab63a
test rcx, rcx
jmp 0x1404ab642
je 0x1404ab64e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
stc
clc
test rcx, rcx
jmp 0x1404ab65c
je 0x1404ab668
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404ab670
call fcn.1404c3cef
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
shl dil, 0x30
add rsp, 0x30
movzx edi, ax
movsx edi, sp
bswap di
pop rdi
jmp 0x1404ab699
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1404ab6ae
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
sub ebx, ebx
jmp 0x1404ab6b5
jmp 0x1404ab61d
Function at 0x1404ab98c
Capabilities:
Terminate process

Disassembly:
push rbx
setbe bl
xadd ebx, ebx
cmp sil, sil
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404ab9a2
call fcn.1404cd1f6
cmp eax, 1
jmp 0x1404ab9af
je 0x1404ab9f2
mov rax, qword gs:[0x60]
adc edx, 0x61117df9
shr dl, cl
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jne 0x1404ab9f2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dx, 0x3424
mov edx, ebx
jmp 0x1404ab9ec
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404ab9f9
call fcn.1404ab8e3
mov ecx, ebx
jmp 0x1404aba05
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404aca48
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jmp 0x1404aca5f
jle 0x1404acb1f
mov dword [rsp + 0x18], r8d
btr r8, 0xcb
xor r8b, 8
rcr r8b, cl
mov qword [rsp + 0x20], r9
shrd r8, r11, 0x87
sbb r8w, 0x1664
push rbx
push rbp
push rsi
rol r8, 0x8d
inc bp
shl sil, cl
push rdi
movzx ebp, dx
sub rsp, 0x38
rcl ebp, cl
rol r8d, 0xbb
lea rdi, [rsp + 0x78]
sub ebx, ebx
add rdi, 0xfffffffffffffff8
mov rsi, rdx
cqo
jmp 0x1404acab9
mov rbp, rcx
lea rdi, [rdi + 8]
mov rdx, rsi
mov cl, 0xc8
jmp 0x1404acaca
mov r8, qword [rdi]
movzx cx, r14b
movsxd rcx, r14d
mov rcx, rbp
jmp 0x1404acadd
call fcn.1404cf0a3
test eax, eax
jmp 0x1404acae9
jne 0x1404acb20
inc ebx
cmp r13b, 0x9c
cmp ebx, dword [rsp + 0x70]
jmp 0x1404acafe
jl 0x1404acabc
add rsp, 0x38
xchg si, bx
movzx edi, r11w
pop rdi
pop rsi
not bh
movzx ebx, dx
bswap ebp
pop rbp
movsx bx, r10b
pop rbx
ret
and qword [rsp + 0x20], 0
sub r9d, r9d
xor r8d, r8d
test r10w, 0x7ebf
sub edx, edx
xor ecx, ecx
jmp 0x1404acb3b
call fcn.1404b0bf5
int3
Function at 0x1404b237e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
rol cl, 0xa6
bt cx, r9w
mov qword [rsp + 0x20], r9
bsr cx, r9w
push rsi
shrd rsi, r12, 0xd5
btc cx, si
ror si, 0x35
push rdi
sub rcx, 0x4255409d
btc si, di
rol cx, 0xef
push r14
sub rsp, 0x60
jmp 0x1404b23c2
mov rsi, r9
cmovo cx, si
mov rdi, r8
movsx rcx, r8w
movsx ecx, si
mov ecx, dword [rdx]
call fcn.14026de3e
nop
shl ebx, cl
adc r14b, bpl
mov rbx, qword [0x1400ba160]
stc
or al, r11b
movsxd rax, dword [0x1400ba158]
bsf r14w, sp
lea r14, [rbx + rax*8]
clc
test esp, 0x7dc66be6
mov qword [rsp + 0x38], rbx
test r14b, r9b
cmp rbx, r14
je 0x1404b255d
mov rax, qword [rbx]
cmc
rcl rdx, cl
xor dl, bpl
mov qword [rsp + 0x20], rax
inc edx
shl dh, cl
mov rdx, qword [rdi]
test rax, rax
jmp 0x1404b2431
je 0x1404b2492
mov ecx, dword [rax + 0x14]
sal rax, 0x5f
rcl al, cl
shld ax, bx, 0x82
mov eax, ecx
clc
shr eax, 0xd
clc
test eax, ebp
test al, 1
jmp 0x1404b2455
je 0x1404b2492
mov eax, ecx
cmp r9d, 0x15785822
and al, 3
cmc
cmp al, 2
jne 0x1404b247d
test cl, 0xc0
jmp 0x1404b2477
jne 0x1404b24a0
bt ecx, 0xb
jmp 0x1404b2486
jb 0x1404b24a0
inc dword [rdx]
cmc
cmp r8d, r11d
add rbx, 8
jmp 0x1404b249b
jmp 0x1404b2402
mov rdx, qword [rdi + 0x10]
setns r8b
movsx r9w, r13b
mov rcx, qword [rdi + 8]
movsx rax, r8w
movsx r8w, al
movzx r8w, r9b
mov rax, qword [rdi]
cmovge r8w, r11w
movzx r9d, r8w
lea r8, [rsp + 0x20]
mov qword [rsp + 0x40], r8
movsxd r8, edx
movsx r8w, dil
movzx r9w, r8b
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
movsx r9w, dl
mov qword [rsp + 0x58], rdx
movsx rdx, r13w
bswap r9d
mov rax, qword [rsp + 0x20]
bswap r8w
mov qword [rsp + 0x28], rax
jmp 0x1404b2510
mov qword [rsp + 0x30], rax
cqo
setne cl
cwd
lea r9, [rsp + 0x28]
cwd
mov dl, r11b
cqo
lea r8, [rsp + 0x40]
movzx rdx, r10w
setns dh
movsxd rcx, eax
lea rdx, [rsp + 0x30]
cmovo rcx, r10
mov cl, r15b
setno cl
lea rcx, [rsp + 0x88]
jmp 0x1404b2553
call fcn.1404b21fa
jmp 0x1404b2492
mov ecx, dword [rsi]
jmp 0x1404b2564
call fcn.14010e8dc
mov rbx, qword [rsp + 0x80]
movzx rsi, r12w
sar dil, cl
shr r14b, cl
add rsp, 0x60
pop r14
movzx rdi, bx
movsx di, bpl
jmp 0x1404b258f
pop rdi
bswap esi
movzx si, dil
pop rsi
jmp 0x1404b259d
ret
Function at 0x1404be38f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
or r10w, 0x4772
mov qword [rax + 8], rbx
sal r10w, cl
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
add r10w, 0x5d6f
push r14
or ebp, 0xffffffff
mov rbx, r8
cmp dword [rcx + 0x10], 0
bswap r10d
movsx r10w, r10b
mov r10, rdx
jmp 0x1404be3ce
je 0x1404be563
movsxd r9, dword [rcx + 0x10]
shl r14w, 0xdc
sub dil, r9b
cbw
lea r14, [0x140000000]
mov rdi, qword [rdx + 8]
sar rcx, 0x75
movzx rcx, r9w
sub esi, esi
shr dh, cl
adc r11b, r14b
shrd r11, rdx, 0x43
add r9, rdi
bswap rcx
sub r8d, r8d
shr r11w, 0x23
mov edx, ebp
bt r11d, 0x9a
btc cx, bp
shld rax, rax, 0x6a
movzx ecx, byte [r9]
cmovp eax, ebp
movzx r11, r13w
movzx eax, r12w
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
movsx r11w, bl
mov cl, byte [rcx + r14 + 0xc1a40]
mov r11b, 0x30
shrd r11d, r9d, 0x87
sub r9, rax
shld r11w, r8w, 0x19
mov r11d, dword [r9 - 4]
shr r11d, cl
stc
jmp 0x1404be465
test r11d, r11d
jmp 0x1404be46d
je 0x1404be563
mov rax, qword [r10 + 0x10]
bts ecx, edi
mov r10d, dword [rax]
bts cx, r8w
cmc
btr ax, dx
movzx ecx, byte [r9]
and ecx, 0xf
sub eax, 0x28280aa7
mov ah, 0x99
movsx rax, byte [rcx + r14 + 0xc1a30]
cmp r15w, 0x3bc6
test sp, 0xdf6
stc
mov cl, byte [rcx + r14 + 0xc1a40]
cmp r14b, 0x61
stc
sub r9, rax
xor al, cl
mov eax, dword [r9 - 4]
stc
shr eax, cl
cmp al, r13b
clc
add esi, eax
cmovae ax, r14w
movsx ax, r8b
mov eax, esi
cmp cl, r12b
lea rax, [rax + r10]
test r13b, 0xfa
clc
jmp 0x1404be4e7
lea rax, [rax + rdi]
cmp r14w, 0x64ad
cmp rsp, rcx
cmp rbx, rax
jb 0x1404be546
movzx ecx, byte [r9]
inc r8d
and ecx, 0xf
mov dx, 0x3892
shr rax, cl
movsx rax, byte [rcx + r14 + 0xc1a30]
mov edx, edi
and edx, 0x518d7ecd
mov cl, byte [rcx + r14 + 0xc1a40]
and dx, 0x4d03
sub r9, rax
mov edx, dword [r9 - 4]
cmc
shr edx, cl
jmp 0x1404be53b
dec edx
cmp r8d, r11d
jb 0x1404be487
test r8d, r8d
movzx rax, dx
cbw
cwde
cmove edx, ebp
bswap ax
not rax
mov al, r8b
mov eax, edx
jmp 0x1404be565
mov eax, ebp
mov rbx, qword [rsp + 0x10]
movzx edi, si
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov r14b, 0x25
movsx r14w, dl
mov rdi, qword [rsp + 0x28]
movzx r14d, r8w
cmovns r14w, si
pop r14
ret

Function at 0x1404c5236
Capabilities:
Get thread local storage value

Disassembly:
push rbx
and dh, 0x37
add dx, 0x234d
or r9, r15
sub rsp, 0x20
not r9d
bswap r8w
mov bx, r12w
mov ebx, ecx
cmovp r9d, r13d
lea r9, [0x1400c63d0]
movsx r8d, di
jmp 0x1404c5268
mov ecx, 5
bswap rdx
cdq
lea r8, [0x1400c63c8]
movzx dx, ah
mov dx, r10w
movzx edx, si
lea rdx, [0x1400cf758]
jmp 0x1404c528f
call fcn.1404c61aa
mov ecx, ebx
stc
cmp r9d, 0x6a75273a
test r13b, 0x25
test rax, rax
jmp 0x1404c52aa
je 0x1404c52c4
add rsp, 0x20
mov bl, r9b
pop rbx
jmp 0x1404c52bd
push qword [0x1400b8d90]
ret
add rsp, 0x20
xchg ebx, ebx
pop rbx
jmp 0x1404c52d0
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1404c52d7
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
bts bx, di
rcl bx, 0xcb
rcl r8d, cl
push rdi
mov r8w, bp
ror di, cl
test r13b, 0xbb
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c63d8]
bswap edx
mov edi, ecx
sets cl
movsxd rcx, ecx
lea rdx, [0x1400cf748]
movsx cx, r14b
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404c5328
call fcn.1404c61aa
mov rdx, rbx
bswap ecx
cmovg cx, r9w
mov ecx, edi
cmp r13b, 0x6f
jmp 0x1404c5343
test rax, rax
je 0x1404c5357
call qword [case.0x1404430d4.0]
jmp 0x1404c535d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov edi, r11d
add rsp, 0x20
movzx di, r15b
movsx rdi, ax
pop rdi
jmp 0x1404c5378
ret

Function at 0x1404c5379
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
bts bx, r10w
inc bh
mov qword [rsp + 0x10], rbp
rol bl, 0xfc
rcl rbp, cl
mov qword [rsp + 0x18], rsi
bts rbp, rsi
push rdi
ror si, cl
sub rsp, 0x40
movsx si, bl
mov rbx, r9
mov r9b, spl
not rbp
cmovle si, r15w
mov rdi, r8
mov esi, edx
movsx r8d, r11w
lea r9, [0x1400c63e0]
cqo
movzx dx, sil
movsx r8d, r9w
mov rbp, rcx
lea r8, [0x1400c63d8]
movzx dx, r15b
lea rdx, [0x1400cf158]
movzx cx, r11b
mov ecx, 8
jmp 0x1404c53f3
call fcn.1404c61aa
test rax, rax
je 0x1404c5456
mov r8, qword [rsp + 0x80]
cdq
mov r9, rbx
mov ecx, dword [rsp + 0x78]
mov edx, esi
jmp 0x1404c5418
mov qword [rsp + 0x30], r8
mov r8, rdi
jmp 0x1404c5425
mov dword [rsp + 0x28], ecx
not cl
xchg ecx, ecx
movsx cx, spl
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
setl ch
movsx rcx, r14w
mov rcx, rbp
jmp 0x1404c544b
call qword [case.0x1404430d4.0]
jmp 0x1404c54bc
sub edx, edx
cmove ecx, r12d
setno cl
mov rcx, rbp
call fcn.1404c5c54
mov ecx, eax
rdtsc
lahf
mov r8w, r13w
mov r9, rbx
rdtsc
cmovs r8w, r10w
mov eax, dword [rsp + 0x78]
movzx r8, r13w
movsx rdx, r13w
movsx edx, r9w
mov r8, rdi
mov dl, dil
mov dword [rsp + 0x28], eax
rdtsc
movzx rdx, r15w
movsxd rax, r14d
mov edx, esi
cwde
cdqe
movzx ax, r11b
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
jmp 0x1404c54b6
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov rbx, qword [rsp + 0x50]
rcl sil, 0xfb
movzx edi, dx
movsx rdi, r13w
mov rbp, qword [rsp + 0x58]
bt di, 0xa9
movsx di, sil
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
cmovl rdi, r15
pop rdi
ret
Function at 0x1404c54ea
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
cmc
ror bh, 0x16
rol bh, cl
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
bswap rbp
btc ebx, 0x65
sbb bx, r15w
push rdi
btc di, 0xfa
rcr sil, 0x33
movsx rdi, r13w
sub rsp, 0x30
xchg bpl, sil
mov bp, r13w
mov ebx, r9d
mov rdi, r8
mov esi, edx
movzx ebp, r14w
jmp 0x1404c5538
lea r9, [0x1400c63e8]
not r8d
bswap ebp
cdq
mov rbp, rcx
not r8b
cqo
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
movsx ecx, r11w
mov ecx, edx
not cl
mov ecx, 0xb
jmp 0x1404c556d
call fcn.1404c61aa
mov rcx, rbp
test dx, 0x67c1
cmp r8b, r11b
test rax, rax
jmp 0x1404c5585
je 0x1404c55b5
mov r9d, ebx
xchg r8w, r8w
movzx r8w, sil
mov r8, rdi
cmovp rdx, r14
movzx dx, sil
mov edx, esi
jmp 0x1404c55aa
call qword [case.0x1404430d4.0]
jmp 0x1404c55e3
xor edx, edx
jmp 0x1404c55bc
call fcn.1404c5c54
mov ecx, eax
not r8b
xchg dl, r9b
mov r9d, ebx
movsx rdx, r15w
mov r8, rdi
mov dh, 0x88
mov edx, esi
jmp 0x1404c55dd
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
stc
btc si, 0x39
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
shr rdi, cl
sbb dil, dl
add rsp, 0x30
movsx edi, di
movsx di, r11b
bswap edi
pop rdi
jmp 0x1404c5612
ret
Function at 0x1404cfc47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
cmp dil, 0x9b
stc
test edi, 0x4f3e7f95
mov qword [rax + 0x10], rbp
jmp 0x1404cfc6a
mov qword [rax + 0x18], rsi
test bl, r8b
mov qword [rax + 0x20], rdi
movsx ax, bpl
xor eax, 0x3abe63b7
push r12
sbb sil, 0xbc
push r14
push r15
shl r15d, 0xbb
sub rsp, 0x20
bt eax, 0xf7
sar al, cl
shr r15d, 0x10
sub ebx, ebx
sar al, cl
mov r15, r8
mov edi, edx
cmovnp rsi, r12
ror r12b, cl
and ah, 0xc1
mov r12, rcx
test rbx, 0x1de66b09
mov eax, 1
rcl esi, 0xc8
mov esi, ebx
stc
test edx, edx
js 0x1404cfd5d
test eax, eax
jmp 0x1404cfcd2
je 0x1404cfd5f
mov rcx, qword [r15]
lea eax, [rsi + rdi]
cdq
test r10d, r9d
xchg bp, r14w
movzx r14, r11w
sub eax, edx
shr bpl, cl
sar eax, 1
movsxd rbp, eax
mov r14b, sil
rcl dx, cl
mov r14, rbp
shl r14, 4
not dx
mov rdx, qword [r14 + r12]
jmp 0x1404cfd0d
call fcn.1404c4a50
test eax, eax
jmp 0x1404cfd19
jne 0x1404cfd3f
lea rcx, [r12 + 8]
cmp r12b, 0x9c
stc
clc
add rcx, r14
jmp 0x1404cfd32
mov qword [r15], rcx
jmp 0x1404cfd3a
jmp 0x1404cfd50
jns 0x1404cfd4d
lea edi, [rbp - 1]
jmp 0x1404cfd50
lea esi, [rbp + 1]
cmp esi, edi
jmp 0x1404cfd57
jle 0x1404cfccb
test eax, eax
mov rbp, qword [rsp + 0x48]
movsx r12, r10w
sete bl
mov rsi, qword [rsp + 0x50]
jmp 0x1404cfd79
mov eax, ebx
mov rbx, qword [rsp + 0x40]
shld r12w, bx, 0xe8
sal di, cl
mov rdi, qword [rsp + 0x58]
rcr r14, cl
add rsp, 0x20
movsx r15w, sil
movzx r14w, r12b
movzx r12d, r9w
pop r15
movsx r12w, r8b
pop r14
movzx r12d, sp
jmp 0x1404cfdb5
pop r12
jmp 0x1404cfdbc
ret
Function at 0x1404d128b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bt bx, 0x86
shld bx, r8w, 0xf0
movzx bx, ah
push rdi
sub rsp, 0x20
jmp 0x1404d12b0
mov rbx, rcx
jmp 0x1404d12b8
call fcn.1404c403e
or r8, 0xffffffffffffffff
cmc
movzx r9, r14w
jmp 0x1404d12cb
mov r9, r8
shld dx, r14w, 0x26
xor edi, edi
movzx edx, bp
movsx edx, r12w
movsx rdx, r14w
lea rdx, [rax + 0x98]
cdqe
mov rax, qword [rdx]
inc r9
test edi, 0x220d3c2d
cmp r14w, 0x3b62
cmp spl, r13b
cmp word [rax + r9*2], di
jmp 0x1404d1309
jne 0x1404d12ed
mov eax, edi
xor al, 0xc0
sar al, cl
xadd al, al
cmp r9, 3
sete al
mov dword [rdx + 0x18], eax
cwde
movsx eax, di
mov rax, qword [rdx + 8]
jmp 0x1404d132f
inc r8
jmp 0x1404d1337
cmp word [rax + r8*2], di
jmp 0x1404d1341
jne 0x1404d132f
cmp r8, 3
lahf
mov eax, edi
mov al, 0x6c
xchg r8, r8
setle r8b
mov r8d, 2
sete al
cmp r10w, dx
mov dword [rdx + 0x1c], eax
cmp spl, spl
mov dword [rbx + 4], edi
stc
cmp cx, r13w
test ebp, 0x1d3434c8
cmp dword [rdx + 0x18], edi
jne 0x1404d13d2
mov rcx, qword [rdx]
mov r10d, edi
movzx r9d, r9w
movzx r9d, word [rcx]
shr ax, cl
lea rcx, [rcx + r8]
lea eax, [r9 - 0x41]
cmp ax, 0x19
jmp 0x1404d13a3
jbe 0x1404d13c7
sub r9w, 0x61
test bx, si
jmp 0x1404d13b7
cmp r9w, 0x19
jmp 0x1404d13c1
ja 0x1404d13cf
inc r10d
jmp 0x1404d138b
mov r8d, r10d
mov dword [rdx + 0x14], r8d
lea rcx, [0x1400abdd4]
setns dh
movsxd rdx, r15d
mov edx, 1
jmp 0x1404d13ed
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov ecx, dword [rbx]
test cl, 7
mov al, 0x6c
setne dl
clc
bt ecx, 9
setnp al
setb al
cmp r9b, r14b
and dl, al
not al
bt ecx, 8
xchg al, al
setb al
clc
test r10b, 0x2a
stc
test al, dl
jmp 0x1404d1425
jne 0x1404d1439
mov dword [rbx], edi
btr bx, r12w
jmp 0x1404d1439
mov rbx, qword [rsp + 0x30]
shrd rdi, rbp, 0x1d
ror di, cl
add rsp, 0x20
movsx di, bl
movsxd rdi, r12d
pop rdi
jmp 0x1404d1457
ret
Function at 0x1404d1e46
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
movzx di, dil
sub rsp, 0x20
btc rdi, r13
sub esi, esi
mov rdi, rdx
seta bh
xchg bx, bx
mov rbx, rcx
test rcx, rcx
je 0x1404d1f1a
cmp word [rcx], si
je 0x1404d1f1a
lea rdx, [0x1400d1d08]
jmp 0x1404d1e8a
call fcn.1402348f0
test eax, eax
jmp 0x1404d1e96
je 0x1404d1f1a
lea rdx, [0x1400d1d00]
not ecx
movsx cx, r12b
movsxd rcx, edx
mov rcx, rbx
jmp 0x1404d1eb5
call fcn.1402348f0
test eax, eax
jmp 0x1404d1ec1
jne 0x1404d1f0d
mov ecx, dword [rdi + 8]
xchg r8b, r8b
lea r9d, [rsi + 2]
movzx dx, spl
cmovne r8d, eax
lea r8, [rsp + 0x30]
movzx edx, sp
mov edx, 0x2000000b
jmp 0x1404d1eec
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d1ef9
je 0x1404d1f5b
mov eax, dword [rsp + 0x30]
jmp 0x1404d1f08
jmp 0x1404d1f81
mov rcx, rbx
call fcn.1404daf8f
jmp 0x1404d1f81
mov ecx, dword [rdi + 8]
not r8b
cqo
lea r8, [rsp + 0x30]
jmp 0x1404d1f34
mov r9d, 2
movsx rdx, cx
mov edx, 0x20001004
jmp 0x1404d1f48
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d1f55
jne 0x1404d1f67
sub eax, eax
jmp 0x1404d1f62
jmp 0x1404d1f81
mov eax, dword [rsp + 0x30]
cmp eax, r15d
test eax, eax
jmp 0x1404d1f75
jne 0x1404d1f81
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
cmc
stc
add rsp, 0x20
movsx edi, r9w
movzx rdi, r12w
mov dil, 0x60
pop rdi
jmp 0x1404d1fa2
ret

Function at 0x1404d1fa3
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
test dil, r14b
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx ebx, r8w
mov esi, edx
setne bh
xchg ebx, ebx
mov ebx, ecx
jmp 0x1404d1fc7
call fcn.1404c403e
mov ecx, ebx
bsr r8w, bp
movzx dx, r13b
lea r8, [rsp + 0x30]
and ecx, 0x3ff
movsx edi, r15w
cwd
mov r9d, 2
btr edi, 0x8c
cdq
bts ecx, 0xa
mov edx, 0x20000001
setnp dil
jmp 0x1404d2006
mov rdi, rax
jmp 0x1404d200e
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test eax, eax
jmp 0x1404d201e
je 0x1404d20db
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d202d
je 0x1404d20cc
test esi, esi
jmp 0x1404d203a
je 0x1404d20cc
mov r9, qword [rdi + 0x98]
or al, dil
sub al, r12b
mov r8d, r10d
movzx edx, word [r9]
sub ch, 0xe7
lea rcx, [r9 + 2]
test r14d, ebp
lea eax, [rdx - 0x41]
clc
jmp 0x1404d2067
cmp ax, 0x19
jbe 0x1404d2089
sub dx, 0x61
cmp esp, ebp
test r10, r13
cmp dx, 0x19
jmp 0x1404d2083
ja 0x1404d209d
movzx edx, word [rcx]
inc r8d
add rcx, 2
jmp 0x1404d2098
jmp 0x1404d205e
or rcx, 0xffffffffffffffff
jmp 0x1404d20a6
inc rcx
jmp 0x1404d20ae
cmp word [r9 + rcx*2], r10w
jmp 0x1404d20b8
jne 0x1404d20a6
cmp r8d, ecx
jmp 0x1404d20c6
je 0x1404d20db
mov eax, 1
jmp 0x1404d20d6
jmp 0x1404d20dd
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
btr edi, 0x55
jmp 0x1404d20f0
add rsp, 0x20
pop rdi
ret