joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14046bd31
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp bh, 0xa0
jmp 0x14046bd4b
mov qword [rax + 8], rbx
test rax, 0x44413c0a
stc
cmc
mov qword [rax + 0x10], rbp
sbb bpl, spl
sar bpl, cl
shl bpl, 0xef
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
setp bpl
and bpl, r12b
push r14
cmc
sub rsp, 0x20
btr rdi, r8
clc
mov rsi, qword [rsp + 0x50]
movzx r14d, r9w
mov rdi, r8
cmp r8b, 0x96
dec bpl
mov rbp, rdx
test di, 0x56b
jmp 0x14046bda1
test rsi, rsi
jmp 0x14046bda9
je 0x14046be75
mov rbx, qword [r8 + 8]
test r10b, cl
cmp bpl, dl
cmc
test rbx, rbx
jmp 0x14046bdc2
je 0x14046be62
mov rax, qword [rbx + 0x40]
cmp qword [rax], 0
je 0x14046be2a
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0
jmp 0x14046bde2
jle 0x14046be2a
dec dword [rax]
lahf
movzx cx, r13b
movzx rcx, r10w
mov rcx, qword [rbx + 0x40]
movsx rdx, r8w
mov edx, 0x161d3422
mov rdx, qword [rcx]
cdqe
setnp al
lea rax, [rdx + 2]
jmp 0x14046be12
mov qword [rcx], rax
bswap ax
movzx eax, r14w
jmp 0x14046be21
mov word [rdx], r14w
jmp 0x14046be50
mov rax, qword [rbx]
movzx ecx, dx
movzx edx, r14w
movzx cx, r8b
mov rcx, rbx
jmp 0x14046be41
mov rax, qword [rax + 0x18]
jmp 0x14046be4a
call qword [0x1400b8d90]
mov ecx, 0xffff
test r13w, si
cmp cx, ax
jne 0x14046be66
mov byte [rdi], 1
cmc
sub rsi, 1
jmp 0x14046be6f
jne 0x14046bdba
movups xmm0, xmmword [rdi]
rcl sil, 0x2c
add di, 0x58e1
mov ax, 0x367e
mov rbx, qword [rsp + 0x30]
xchg r14, r14
movsx r14d, bp
shrd r14, rbx, 0xa3
mov rax, rbp
mov rsi, qword [rsp + 0x40]
rcl dil, 0x1e
xor r14, rdx
rcr dil, 0x7e
mov rdi, qword [rsp + 0x48]
sub r14b, bpl
xadd r14b, r14b
bswap r14w
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
ror r14, cl
test r10, 0x7a2b5cca
or r14b, 0xf6
add rsp, 0x20
not r14w
jmp 0x14046bede
pop r14
jmp 0x14046bee5
ret
Function at 0x140491bdf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r9w, di
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
and ebx, esp
sar bx, cl
xor bl, dil
mov qword [rax + 0x18], rsi
bswap bx
rcr rsi, cl
mov qword [rax + 0x20], rdi
sar bl, cl
rcl bx, cl
stc
push r14
sub rsp, 0x20
mov rsi, r9
sbb bh, 0xc7
movsxd rbx, edx
mov r14, r8
sbb rbp, 0x3ae45648
mov rbx, rdx
rcr bpl, 0x57
btr ebp, 0xdf
mov rbp, rcx
test r13, r13
cmp r13w, 0x1a83
cmp rdx, r8
je 0x140491d1b
mov rdi, qword [r9 + 8]
test rdi, rdi
jmp 0x140491c4f
je 0x140491d02
mov rax, qword [rdi + 0x40]
bsr r8w, r10w
movzx r8d, word [rbx]
clc
cmp edx, 0x9d044b5
cmp qword [rax], 0
je 0x140491cbc
mov rax, qword [rdi + 0x58]
jmp 0x140491c7c
cmp dword [rax], 0
jmp 0x140491c84
jle 0x140491cbc
dec dword [rax]
mov rcx, qword [rdi + 0x40]
not al
mov rdx, qword [rcx]
movzx ax, bh
movzx rax, bx
lea rax, [rdx + 2]
jmp 0x140491ca6
mov qword [rcx], rax
jmp 0x140491cae
mov word [rdx], r8w
jmp 0x140491cb7
jmp 0x140491cea
mov rax, qword [rdi]
movzx edx, bp
movzx edx, r8w
movsx cx, dil
movzx rcx, r10w
mov rcx, rdi
jmp 0x140491cd7
mov rax, qword [rax + 0x18]
jmp 0x140491ce0
call qword [0x1400b8d90]
movzx r8d, ax
mov eax, 0xffff
cmp r9w, si
cmp ax, r8w
jmp 0x140491cfc
jne 0x140491d05
mov byte [rsi], 1
add rbx, 2
clc
cmp r8, r12
cmp rbx, r14
jmp 0x140491d15
jne 0x140491c47
movups xmm0, xmmword [rsi]
btr r14d, 0x79
or di, 0x4400
cmovb rsi, rsi
mov rbx, qword [rsp + 0x30]
sub r14w, 0x63e5
btr rsi, 0x7b
mov rax, rbp
movsx esi, si
shr si, 0x92
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
rol r14d, 0x80
shl r14w, cl
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
rcr r14, cl
add r14b, r10b
add rsp, 0x20
movzx r14, dx
pop r14
jmp 0x140491d77
ret
Function at 0x1404a009e
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x1404a00ac
call fcn.1404aa617
mov r9d, 2
jmp 0x1404a00c0
lea r8, [rsp + 0x30]
cmovnp cx, r13w
movzx dx, dil
movsx rcx, r8w
mov rcx, qword [rax + 0x28]
movsx edx, ax
cdq
lea edx, [r9 + 0x20]
jmp 0x1404a00e4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
test edx, edi
clc
sub ecx, 0x30
je 0x1404a013c
sub ecx, 1
jmp 0x1404a0103
je 0x1404a0132
cmp ecx, 1
jmp 0x1404a0111
je 0x1404a0123
xor eax, eax
jmp 0x1404a011e
jmp 0x1404a0142
mov eax, 3
jmp 0x1404a012d
jmp 0x1404a0142
mov eax, 1
jmp 0x1404a0142
mov eax, 2
clc
add rsp, 0x28
jmp 0x1404a014b
ret

Function at 0x1404a014c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp r14b, 0x76
test r9b, r11b
mov qword [rax + 8], rbx
test cl, r14b
clc
cmc
mov qword [rax + 0x10], rsi
or si, 0x394f
sbb si, 0x4577
mov qword [rax + 0x18], rdi
test eax, 0xaa65324
mov qword [rax + 0x20], r14
ror rdi, 0xe3
bsf si, cx
push r15
xor dil, 0x4b
sub rsp, 0x30
jmp 0x1404a0196
mov rdi, r9
movzx r15w, bl
mov rsi, rdx
neg r14b
movsx r15w, r14b
xor r15d, 0x61f97022
sub rsi, rcx
cmp r15d, 0x346d70f1
rcr r14w, 0x96
sub rdi, r8
mov r15, rcx
shld cx, r13w, 0xde
sar rsi, 1
sar cl, cl
xchg r14b, r14b
movzx r14, si
mov rcx, qword [rsp + 0x60]
xchg r14b, r14b
sub ebx, ebx
or r14w, r9w
and r14, 0x497a5314
sar rdi, 1
rcr r14d, cl
mov r14, r8
test rcx, rcx
jmp 0x1404a01fd
jne 0x1404a0216
call fcn.1404aa617
mov rcx, qword [rax + 8]
jmp 0x1404a0211
jmp 0x1404a0226
mov rcx, qword [rcx + 8]
cmp r8b, 0x8d
test rdi, 0x2d1e3f1c
stc
test rcx, rcx
jmp 0x1404a022e
jne 0x1404a02ef
cmp esi, edi
cbw
mov eax, edi
movzx ecx, r10w
cmovl eax, esi
adc ecx, 0x115646e9
movsx rcx, bx
btc ecx, 0x9e
movsxd rcx, eax
sub ax, dx
mov eax, 1
cmc
test rcx, rcx
jmp 0x1404a0263
je 0x1404a02a4
sub r15, r14
movzx edx, word [r15 + r14]
cmp r15w, 0x73ed
stc
test dil, dil
cmp dx, word [r14]
jmp 0x1404a0284
jne 0x1404a02c8
add r14, 2
jmp 0x1404a0296
sub rcx, rax
jmp 0x1404a029e
jne 0x1404a026c
cmp esi, edi
jmp 0x1404a02ab
je 0x1404a02e3
or ecx, 0xffffffff
cmp esi, edi
jmp 0x1404a02bb
cmovl eax, ecx
jmp 0x1404a02c3
jmp 0x1404a0369
sbb ebx, ebx
and ebx, 0xfffffffe
test rbp, rdi
jmp 0x1404a02db
add ebx, eax
movsx eax, r8w
cdqe
mov eax, ebx
jmp 0x1404a02ea
jmp 0x1404a0369
mov dword [rsp + 0x28], edi
movsx r9d, bp
xchg r8w, dx
movzx r9, r14w
mov r9d, esi
movzx dx, r10b
movzx r8d, r12w
movsx r8w, r8b
mov r8, r15
movzx edx, r10w
movsx dx, dil
movsx edx, cx
mov qword [rsp + 0x20], r14
mov edx, 0x1000
call fcn.1404c2d08
test eax, eax
jmp 0x1404a0335
jne 0x1404a035e
call fcn.1404b51b5
mov dword [rax], 0x16
movsx ax, r13b
movzx ax, ah
mov eax, 0x7fffffff
jmp 0x1404a0359
jmp 0x1404a0369
sub eax, 2
sbb bl, ch
bsf esi, eax
movsxd rbx, r10d
mov rbx, qword [rsp + 0x40]
movzx rsi, bp
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
movzx r14d, r9w
not r14w
bsf r15w, dx
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
jmp 0x1404a0399
ret
Function at 0x1404a1990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
jmp 0x1404a19aa
mov qword [rsp + 0x18], rbp
push rsi
sub rsi, 0x5e0b3a1a
btc rsi, rcx
push rdi
bswap si
push r12
push r14
btr r14, 0x53
bts r12w, r15w
sbb dil, 0xd9
push r15
and di, 0x3dad
add sil, sil
sub rsp, 0x20
movzx rsi, r15w
mov esi, dword [r8 + 0xc]
movsx r12d, r8w
not rdi
movsx r15w, spl
mov r12, rcx
mov rcx, r8
mov r14b, r14b
mov rdi, r9
mov r14, r8
movsx r15w, spl
movzx r15w, bpl
mov r15, rdx
jmp 0x1404a1a14
call fcn.14028fd5e
mov r10, qword [r12]
inc rbp
mov ebp, eax
mov qword [rdi], r10
cmc
test esi, esi
jmp 0x1404a1a2d
je 0x1404a1b6e
movsxd rax, dword [r14 + 0x10]
shrd rbx, rax, 0xff
sbb bx, r10w
xor ebx, 0x330f1669
lea ecx, [rsi - 1]
shr rbx, cl
adc esi, 0x42324a98
mov esi, ecx
and bl, bpl
btc bx, sp
movzx ebx, ax
lea rcx, [rcx + rcx*4]
bswap bx
lea rbx, [rax + rcx*4]
test ebp, r12d
add rbx, qword [r15 + 8]
cmc
cmp r10w, 0x6509
cmp r13d, edi
cmp ebp, dword [rbx + 4]
jmp 0x1404a1a82
jle 0x1404a1a26
cmp ebp, dword [rbx + 8]
jmp 0x1404a1a90
jg 0x1404a1a26
mov rcx, qword [r15]
stc
rol dh, cl
lea rdx, [rsp + 0x50]
test r10w, bp
sub r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
mov r9d, r14d
add r9, 0x579173c9
xor ecx, ecx
btr r9w, si
cmp rdi, rbp
add r8, qword [rsp + 0x50]
rcl r10d, cl
sub r10w, 0xaba
stc
mov r9d, dword [rbx + 0xc]
sal r10b, cl
and r10b, bl
rcl r10w, cl
mov r10d, dword [rax]
cmp r11d, r13d
test cx, 0x31f6
test r9d, r9d
jmp 0x1404a1af6
je 0x1404a1b28
lea rdx, [r8 + 0xc]
movsxd rax, dword [rdx]
test r9, r14
cmp rax, r10
jmp 0x1404a1b0e
je 0x1404a1b28
inc ecx
add rdx, 0x14
cmp ecx, r9d
jmp 0x1404a1b22
jb 0x1404a1b00
cmp ecx, r9d
jmp 0x1404a1b30
jae 0x1404a1a26
mov rax, qword [r12]
movzx r15, r12w
bts r12d, ebp
sub r14b, 0xcb
lea rcx, [rcx + rcx*4]
movzx r15, bx
movsxd rcx, dword [r8 + rcx*4 + 0x10]
rol r15w, cl
mov rcx, qword [rcx + rax]
rol si, 0x17
cdqe
bswap bx
mov qword [rdi], rcx
test bx, sp
movzx bp, cl
mov rbx, qword [rsp + 0x58]
bt r15w, 0xe2
dec r14w
movsx eax, r10w
mov rax, rdi
mov rbp, qword [rsp + 0x60]
cmp sil, r10b
rcl r14b, 0x74
add rsp, 0x20
setno r12b
pop r15
movsx edi, bp
pop r14
jmp 0x1404a1ba4
pop r12
not si
jmp 0x1404a1bb2
pop rdi
jmp 0x1404a1bbf
pop rsi
jmp 0x1404a1bc5
ret
Function at 0x1404a1ddb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
ror bl, cl
mov qword [rsp + 0x10], rbp
btr bp, 0x15
mov qword [rsp + 0x18], rsi
movsxd rbp, esi
push rdi
inc bx
push r12
cmp r11d, edx
push r13
stc
push r14
xor bx, di
push r15
mov r12b, r14b
setae bpl
sub rsp, 0x40
mov di, 0x66b6
mov rbx, qword [rsp + 0x90]
setnp bpl
movsx rbp, r8w
mov r12, rdx
mov rbp, rsp
movsx r15d, r12w
movsxd r14, esp
mov rbp, rcx
movsx cx, r13b
mov rdx, r9
movsx r14d, cx
cmove di, r12w
mov rcx, rbx
movsx r15, r12w
bswap r14
movsx r14d, r10w
mov rdi, r9
movsx r15w, dl
jmp 0x1404a1e66
mov r15d, r8d
not r14d
movsxd r14, r15d
mov r14b, r11b
mov r14d, dword [rbx + 0xc]
jmp 0x1404a1e7b
call fcn.14028fd5e
xor r10d, r10d
mov esi, eax
test r14d, r14d
jmp 0x1404a1e8d
je 0x1404a20c0
mov r11, qword [rdi + 8]
rol edx, cl
add cl, 0x17
bts r13d, ebx
or eax, 0xffffffff
cmc
movsxd rbx, dword [rbx + 0x10]
sbb r8b, 0x74
mov r9d, eax
rcr r13b, cl
movsx r13d, sp
movsx dx, r11b
mov r13d, eax
bt dx, 0x4e
add dl, 0xf8
neg dh
mov edx, r14d
lea r8d, [rdx - 1]
adc rax, rdx
dec ch
shr cl, cl
lea rcx, [r8 + r8*4]
lea rax, [r11 + rcx*4]
stc
cmp esi, dword [rax + rbx + 4]
jmp 0x1404a1ee8
jle 0x1404a1efd
cmp esi, dword [rax + rbx + 8]
jmp 0x1404a1ef7
jle 0x1404a1f0e
mov edx, r8d
test r8d, r8d
jmp 0x1404a1f08
jne 0x1404a1ecb
mov r8d, r10d
test di, 0x4d96
test edx, edx
jmp 0x1404a1f1d
je 0x1404a1f45
lea eax, [rdx - 1]
rcr dh, 0xca
btr dx, r9w
cwd
lea rax, [rax + rax*4]
lea rdx, [rbx + rax*4]
add rdx, r11
jmp 0x1404a1f40
jmp 0x1404a1f48
mov rdx, r10
lea rcx, [r11 + rbx]
cmp ch, 0xa
stc
or r11d, 0xffffffff
cmp al, 0x70
test spl, cl
cmc
test rdx, rdx
je 0x1404a1f83
mov eax, dword [rdx + 4]
stc
test r14b, r15b
cmp dword [rcx], eax
jmp 0x1404a1f71
jle 0x1404a1fc1
mov eax, dword [rdx + 8]
cmp dword [rcx + 4], eax
jg 0x1404a1fc1
cmp r15d, dword [rcx]
jmp 0x1404a1f8b
jl 0x1404a1fc1
cmp r15d, dword [rcx + 4]
jg 0x1404a1fc1
cmp r9d, r11d
mov eax, r8d
mov r13b, 0x15
movsxd r13, ebp
mov r13d, r8d
jmp 0x1404a1faf
cmovne eax, r9d
not r9b
mov r9b, bpl
cmovo r9w, r10w
mov r9d, eax
inc r8d
cmc
test edi, r13d
add rcx, 0x14
cmp rdi, 0x66a57fc6
cmp r8d, r14d
jb 0x1404a1f5a
cmp r9d, r11d
mov qword [rsp + 0x20], r12
movzx di, dl
cwde
cdqe
mov eax, r10d
movzx bx, r14b
mov qword [rsp + 0x30], r12
movsx rbx, dx
cmovne eax, r9d
xchg r11d, edi
movsxd r15, r14d
movsx esi, r12w
lea r11, [rsp + 0x40]
movsx r15, r13w
not r12w
setle r15b
mov rbx, qword [r11 + 0x30]
sete sil
mov rsi, qword [r11 + 0x40]
movsx r12, r9w
movsx r15d, dx
movzx r14d, r8w
mov dword [rsp + 0x28], eax
cmovne r14, r11
lea eax, [r13 + 1]
movups xmm0, xmmword [rsp + 0x20]
cmovne r10d, eax
movsxd r14, r8d
seto dil
movzx r15, r8w
mov rax, rbp
movzx r13, dx
mov dword [rsp + 0x38], r10d
movups xmm1, xmmword [rsp + 0x30]
movsx r12, r9w
movdqu xmmword [rbp], xmm0
movsx r13w, r13b
bswap di
xchg r13, r14
movdqu xmmword [rbp + 0x10], xmm1
movsx rbp, dx
not r14w
mov rbp, qword [r11 + 0x38]
mov rsp, r11
movzx r13w, r10b
pop r15
not r14b
movsx rdi, di
pop r14
movzx r12, r10w
pop r13
xchg r12w, di
jmp 0x1404a20ab
pop r12
movzx rdi, ax
jmp 0x1404a20b9
pop rdi
jmp 0x1404a20bf
ret
call fcn.1404b7097
int3
Function at 0x1404b096f
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
test r12w, r13w
mov qword [rsp + 0x10], rsi
cmp r9w, r14w
cmp ah, 0x71
push rdi
sub sil, al
stc
sub rsp, 0x30
sub si, 0x1a68
btr si, bp
mov edi, edx
rcl sil, cl
xor sil, r11b
neg sil
mov rsi, rcx
cmp si, dx
test cx, sp
test rsi, 0x4652045e
test r8, r8
jmp 0x1404b09b9
jne 0x1404b09e0
call fcn.1404b51b5
mov dword [rax], 0x16
jmp 0x1404b09cf
call fcn.1404b5e04
sub eax, eax
jmp 0x1404b09db
jmp 0x1404b0ac7
mov rdx, r9
movzx rcx, r15w
jmp 0x1404b09ef
mov rcx, r8
call fcn.1404b0b25
mov rbx, rax
clc
test rax, rax
jmp 0x1404b0a03
je 0x1404b0a75
lea rax, [rsp + 0x50]
mov rcx, r10
movsx r9, ax
movsxd rcx, esi
mov rdx, rdi
movsxd rcx, r12d
mov r8d, r9d
movzx r9d, dx
mov qword [rsp + 0x28], rax
not r9b
lea r8, [0x140094b24]
mov eax, dword [rsp + 0x60]
movzx r9, di
mov r9, rbx
xchg ch, cl
movzx cx, dh
mov rcx, rsi
jmp 0x1404b0a4d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b0a62
jne 0x1404b0ae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404b5228
sub edi, edi
cmp ebx, esi
cmc
test rbx, rbx
je 0x1404b0ac4
mov rcx, qword [rbx + 0x10]
test r13, r12
clc
test rcx, rcx
jmp 0x1404b0a93
je 0x1404b0a9f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404b0aab
je 0x1404b0ab7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b0abf
call fcn.1404c8f69
mov rax, rdi
mov rbx, qword [rsp + 0x40]
movzx edi, r10w
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x1404b0adf
ret
mov rcx, qword [rsp + 0x68]
cmp si, 0x6ff7
test rcx, rcx
jmp 0x1404b0af2
je 0x1404b0b05
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
cmp rdx, 0x5cb7cb4
sub ebx, ebx
jmp 0x1404b0b0c
jmp 0x1404b0a7a

Function at 0x1404b0d95
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
movsx rbx, dx
mov ebx, ecx
call fcn.1404d25c0
cmp eax, 1
je 0x1404b0dfb
mov rax, qword gs:[0x60]
bts dx, r14w
cwd
shrd rdx, r9, 0x78
mov edx, dword [rax + 0xbc]
cmp rdi, r8
cmp bpl, 0x29
shr edx, 8
test dl, 1
jmp 0x1404b0ddc
jne 0x1404b0dfb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
setae dh
mov edx, ebx
jmp 0x1404b0df5
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b0e02
call fcn.1404b0ceb
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b3585
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404b359a
mov qword [rsp + 0x10], rsi
cmc
test rbx, rax
mov qword [rsp + 0x18], rdi
bts di, r9w
movzx edi, sp
push r14
sub rsp, 0x20
xor r14, rbx
adc dil, al
rol r14b, 0xd7
sub ebx, ebx
mov rdi, rdx
btc r14w, ax
add r14b, r11b
mov r14, rcx
cmp bpl, 0x13
stc
test rdx, rdx
jmp 0x1404b35dd
je 0x1404b3658
movzx esi, word [r14 + rbx*2]
jmp 0x1404b35ed
call fcn.1404aac06
mov rdx, rax
mov eax, 0xff
jmp 0x1404b35ff
cmp si, ax
jmp 0x1404b3607
ja 0x1404b362a
movzx ecx, word [rdx + rsi*2]
clc
jmp 0x1404b361a
and ecx, 0x103
jmp 0x1404b3625
jmp 0x1404b3632
sub ecx, ecx
clc
jmp 0x1404b3632
test ecx, ecx
jmp 0x1404b3639
je 0x1404b3697
inc rbx
test ch, 0xe8
stc
test r11w, r11w
cmp rbx, rdi
jmp 0x1404b3652
jb 0x1404b35e3
mov al, 1
adc bl, 0x39
mov rbx, qword [rsp + 0x30]
bsf rdi, rsi
mov rsi, qword [rsp + 0x38]
movzx r14w, spl
bt r14, 0x91
bts rdi, rdx
mov rdi, qword [rsp + 0x40]
movsx r14, r9w
add rsp, 0x20
movsx r14d, r11w
movzx r14w, bpl
pop r14
jmp 0x1404b3696
ret
sub al, al
jmp 0x1404b365d

Function at 0x1404b49f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rdx
rdtsc
lahf
jmp 0x1404b4a0b
mov qword [rsp + 8], rcx
clc
bswap r9w
btr cx, 0x8a
push rbp
rcr cx, 0xaf
mov rbp, rsp
sub rsp, 0x40
lea rax, [rbp + 0x10]
bswap dx
cmovg r8w, sp
mov cx, 0x5aed
mov qword [rbp - 0x18], rax
jmp 0x1404b4a43
lea r9, [rbp + 0x28]
lea rax, [rbp + 0x18]
mov qword [rbp - 0x10], rax
lea r8, [rbp - 0x18]
movzx rdx, si
rdtsc
mov eax, 2
cwd
not dl
cmovle cx, r10w
lea rdx, [rbp - 0x20]
mov ch, 0x6c
movzx ecx, si
movsx cx, bpl
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x28], eax
jmp 0x1404b4a82
mov dword [rbp - 0x20], eax
call fcn.140096f80
add rsp, 0x40
movzx rbp, r9w
not bpl
pop rbp
jmp 0x1404b4a9b
ret

Function at 0x1404b5e92
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 0x17
jmp 0x1404b5ea0
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b5ead
je 0x1404b5ec4
mov ecx, 5
jmp 0x1404b5ebd
int 0x29
jmp 0x1404b5ec4
mov r8d, 1
mov cl, spl
mov edx, 0xc0000417
movzx rcx, r14w
lea ecx, [r8 + 1]
call fcn.1404b5efd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp 0x1404b5ef6
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404c356f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
and r10b, r9b
mov qword [rax + 0x10], rbp
add r10b, dil
rcl bh, cl
mov qword [rax + 0x18], rsi
shl bx, 0x33
mov qword [rax + 0x20], rdi
rcr r10b, cl
sal r10b, cl
push r14
or ebp, 0xffffffff
mov rbx, r8
movsx r10w, sil
bt r10, 0x2b
sub r10d, 0x7d617721
cmp dword [rcx + 0x10], 0
movsx r10w, bl
movzx r10, bp
xchg r10b, r10b
mov r10, rdx
jmp 0x1404c35c5
je 0x1404c3761
movsxd r9, dword [rcx + 0x10]
lahf
lea r14, [0x140000000]
mov rdi, qword [rdx + 8]
sub esi, esi
mov r11b, 0x11
add r9, rdi
and r11w, r12w
clc
or edx, 0x4ac36de8
xor r8d, r8d
btc ecx, r8d
shrd ax, r15w, 0x17
mov dl, bpl
mov edx, ebp
movzx ecx, byte [r9]
sets r11b
sub al, sil
and ecx, 0xf
clc
sar r11b, 0xa5
add r11b, 0x22
movsx rax, byte [rcx + r14 + 0xc1a30]
sbb r11, 0x7d2f31c2
mov cl, byte [rcx + r14 + 0xc1a40]
bsr r11w, r15w
bt r11d, 0x8d
sub r9, rax
mov r11d, dword [r9 - 4]
shr r11d, cl
cmp dil, r11b
test r13w, bp
test r11d, r11d
jmp 0x1404c3652
je 0x1404c3761
mov rax, qword [r10 + 0x10]
shld cx, r13w, 0x29
shr r10, cl
sal r10, cl
mov r10d, dword [rax]
shrd rax, rax, 0x55
btr cx, cx
cmovl cx, r10w
movzx ecx, byte [r9]
xor al, bpl
test rax, r12
and ecx, 0xf
bt rax, rbp
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
jmp 0x1404c36a3
sub r9, rax
mov eax, dword [r9 - 4]
test ebx, 0x9010b4c
jmp 0x1404c36b5
shr eax, cl
test r8, r14
add esi, eax
mov eax, esi
jmp 0x1404c36c7
add rax, r10
lea rax, [rax + rdi]
cmc
cmp rbx, rax
jmp 0x1404c36d7
jb 0x1404c3748
movzx ecx, byte [r9]
cdq
inc r8d
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
or dl, r12b
inc dx
movzx rdx, si
mov cl, byte [rcx + r14 + 0xc1a40]
movsx rdx, r13w
shr dx, cl
bt rdx, r15
sub r9, rax
cqo
sal dx, 0xfc
test r11w, r11w
mov edx, dword [r9 - 4]
jmp 0x1404c372a
shr edx, cl
jmp 0x1404c3731
dec edx
clc
jmp 0x1404c373a
cmp r8d, r11d
jmp 0x1404c3742
jb 0x1404c3679
test r8d, r8d
cmove edx, ebp
setbe ah
movzx rax, ax
mov eax, edx
jmp 0x1404c375c
jmp 0x1404c376b
mov eax, ebp
mov di, r11w
movzx ebx, r12w
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
movsx si, r8b
movzx si, dl
setb sil
mov rsi, qword [rsp + 0x20]
movsx r14, r15w
movsx di, r15b
mov r14d, 0x221e24ac
mov rdi, qword [rsp + 0x28]
pop r14
jmp 0x1404c37a2
ret

Function at 0x1404ca47f
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
bt r9w, r8w
sub rsp, 0x20
cwd
movzx r9, r15w
setns r9b
mov rbx, rcx
lea r9, [0x1400c63c0]
cmovne rcx, r11
mov ecx, 3
cdq
movzx edx, dx
movsx r8, r11w
lea r8, [0x1400c63b8]
cqo
lea rdx, [0x1400cfb70]
jmp 0x1404ca4c4
call fcn.1404cb433
test rax, rax
je 0x1404ca4e4
mov rcx, rbx
add rsp, 0x20
movsxd rbx, esp
pop rbx
jmp qword [0x1400b8d90]
add rsp, 0x20
movsx ebx, si
movsx rbx, r13w
movsxd rbx, edx
pop rbx
jmp 0x1404ca4f8
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1404ca5fd
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movsx r8, dx
btc r8d, 0x7f
push rdi
sub rsp, 0x20
setg r8b
jmp 0x1404ca619
mov rbx, rdx
setnp r8b
not rdi
lea r9, [0x1400c63d8]
mov edi, ecx
movsx rcx, bp
movzx edx, r13w
lea rdx, [0x1400cf748]
xchg cx, cx
movzx cx, bpl
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404ca654
call fcn.1404cb433
mov rdx, rbx
mov ecx, edi
cmp cx, 0x1a13
test rax, rax
jmp 0x1404ca66b
je 0x1404ca67c
call qword [0x1400b8d90]
jmp 0x1404ca682
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
movsx edi, di
movsx rdi, di
pop rdi
jmp 0x1404ca698
ret

Function at 0x1404ca80d
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
rcr bx, 0x59
mov qword [rsp + 0x10], rbp
shr bpl, 0x9f
mov qword [rsp + 0x18], rsi
and si, 0x5c44
rcr bpl, 0xb2
push rdi
movzx bx, r12b
sub rsp, 0x30
movzx bx, r12b
not sil
cmovo edi, r12d
mov ebx, r9d
movsx esi, ax
mov rdi, r8
movsx r9, sp
movsx esi, di
jmp 0x1404ca858
mov esi, edx
lea r9, [0x1400c63e8]
movsx edx, sp
cdq
setle dh
mov rbp, rcx
cmove r8w, r15w
movsx r8w, r8b
movzx cx, r11b
lea r8, [0x1400c63e0]
setno cl
movsx rcx, r13w
mov cx, 0x706d
lea rdx, [0x1400cf190]
movsx ecx, r11w
jmp 0x1404ca89c
mov ecx, 0xb
jmp 0x1404ca8a6
call fcn.1404cb433
mov rcx, rbp
test rax, rax
jmp 0x1404ca8b6
je 0x1404ca8e4
mov r9d, ebx
xchg r8b, r8b
movzx edx, r8w
cwd
mov r8, rdi
movzx rdx, bx
not rdx
mov edx, esi
jmp 0x1404ca8d9
call qword [0x1400b8d90]
jmp 0x1404ca909
sub edx, edx
call fcn.1404caf26
mov ecx, eax
mov r9d, ebx
setno r8b
movzx dx, r8b
mov r8, rdi
cdq
movsx rdx, r11w
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
bsf si, bp
sub bp, 0x27e7
xchg esi, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
mov dil, 0x99
pop rdi
jmp 0x1404ca930
ret
Function at 0x1404cb209
Capabilities:
Authenticate hmac

Disassembly:
sub rsp, 0x28
not r9b
bsr r8, r9
lea r9, [0x1400c63a4]
not r8w
stc
sub ecx, ecx
cdq
movzx r8d, si
mov r8w, cx
lea r8, [0x1400c63a0]
movsx dx, bl
cwd
lea rdx, [0x1400cfbf8]
jmp 0x1404cb244
call fcn.1404cb433
lea r9, [0x1400c63b0]
movzx ecx, cx
bswap r8d
mov ecx, 1
bswap dx
movzx r8, cx
cmovge r8, r10
lea r8, [0x1400c63a8]
cdq
lea rdx, [0x1400cf1d0]
call fcn.1404cb433
lea r9, [0x1400c63b8]
xchg dx, cx
mov r8b, 0x72
mov ecx, 2
seto r8b
lea r8, [0x1400c63b0]
lea rdx, [0x1400cf178]
call fcn.1404cb433
lea r9, [0x1400c63e0]
cmovge cx, r10w
movsxd rdx, edx
movsx r8w, sil
mov ecx, 8
lea r8, [0x1400c63d8]
xchg dh, dl
bswap dx
lea rdx, [0x1400cf158]
jmp 0x1404cb2d4
call fcn.1404cb433
lea r9, [0x1400c63e8]
jmp 0x1404cb2eb
mov ecx, 0xb
movsx dx, r15b
cdq
mov r8b, 0xa0
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
jmp 0x1404cb30c
call fcn.1404cb433
lea r9, [0x1400c63f0]
mov ecx, 0xe
cmovo dx, r11w
lea r8, [0x1400c63e8]
lea rdx, [0x1400cf168]
jmp 0x1404cb335
call fcn.1404cb433
lea r9, [0x1400c63f8]
movzx ecx, di
mov ecx, 0xf
movsx rdx, r9w
lea r8, [0x1400c63f0]
movsx rdx, bx
lea rdx, [0x1400cf800]
call fcn.1404cb433
lea r9, [0x1400c6408]
movzx r8, dx
cdq
movzx edx, cx
mov ecx, 0x13
xchg rdx, r8
movzx edx, r15w
lea r8, [0x1400c6400]
jmp 0x1404cb391
lea rdx, [0x1400cf838]
call fcn.1404cb433
lea r9, [0x1400c6410]
mov ecx, 0x14
movsx dx, r11b
lea r8, [0x1400c6408]
lea rdx, [0x1400cf1c0]
jmp 0x1404cb3c1
call fcn.1404cb433
lea r9, [0x1400c6418]
mov ecx, 0x15
setbe r8b
cwd
bswap r8
lea r8, [0x1400c6410]
lea rdx, [0x1400cf820]
jmp 0x1404cb3ee
call fcn.1404cb433
lea r9, [0x1400c6420]
mov ecx, 0x16
cmp cl, r9b
lea r8, [0x1400c6418]
cmove rdx, rbx
neg dl
movsx edx, r13w
lea rdx, [0x1400cfc08]
cmp r14b, sil
test r10, 0x6aa61325
stc
add rsp, 0x28
jmp 0x1404cb42e
jmp fcn.1404cb433