joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140456a4b
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movzx cx, dil
lea rcx, [rsp + 0x30]
jmp 0x140456a5e
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmp r14b, 0xc7
cmc
test r13, 0x246c1ce6
add rsp, 0x28
jmp 0x140456a7e
ret
Function at 0x14046f7f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp sp, 0x7b26
test spl, r10b
clc
mov qword [rax + 8], rbx
shrd bx, cx, 0x57
cmovbe bx, r14w
mov qword [rax + 0x10], rbp
bts bx, r10w
mov qword [rax + 0x18], rsi
rol bpl, cl
mov qword [rax + 0x20], rdi
and bpl, r10b
shl bp, 0xfb
push r14
sub rsp, 0x20
inc rbp
mov rsi, r9
mov rbx, r8
movsxd r14, r12d
mov r14, rdx
inc bpl
sal bpl, cl
xor bpl, 0x2d
mov rbp, rcx
cmc
jmp 0x14046f856
test r9, r9
jmp 0x14046f85e
je 0x14046f930
mov rdi, qword [rdx + 8]
cmp eax, r8d
test ebx, 0x1664343d
cmc
test rdi, rdi
jmp 0x14046f87a
je 0x14046f91d
mov rax, qword [rdi + 0x40]
movzx r8d, word [rbx]
stc
cmp qword [rax], 0
jmp 0x14046f892
je 0x14046f8d9
mov rax, qword [rdi + 0x58]
cmp dword [rax], 0
jle 0x14046f8d9
dec dword [rax]
mov ch, 0xf
mov rcx, qword [rdi + 0x40]
jmp 0x14046f8b8
mov rdx, qword [rcx]
movzx rax, r13w
lea rax, [rdx + 2]
jmp 0x14046f8c8
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x14046f8d4
jmp 0x14046f904
mov rax, qword [rdi]
mov dl, ch
movzx edx, r8w
movzx rcx, si
mov rcx, rdi
jmp 0x14046f8ee
mov rax, qword [rax + 0x18]
jmp 0x14046f8f7
call qword [case.0x1400f3ca8.0]
movzx r8d, ax
add ah, 0xe9
mov eax, 0xffff
cmc
test dil, 0x1f
cmp ax, r8w
jmp 0x14046f917
jne 0x14046f922
mov byte [r14], 1
cmc
add rbx, 2
sub rsi, 1
jne 0x14046f872
movups xmm0, xmmword [r14]
cmp bl, 0xe2
movsxd rbx, edx
mov rbx, qword [rsp + 0x30]
rcl dil, cl
mov rax, rbp
mov rsi, qword [rsp + 0x40]
shl rdi, cl
bts r14, r14
add r14b, 0xb
mov rdi, qword [rsp + 0x48]
test r8, 0x69ec6cb8
ror r14w, 0xa2
movdqu xmmword [rbp], xmm0
inc ebp
rol bpl, cl
mov bp, 0x1501
mov rbp, qword [rsp + 0x38]
sar r14b, cl
add rsp, 0x20
not r14
movsxd r14, r14d
pop r14
jmp 0x14046f98d
ret
Function at 0x14049b896
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
adc bpl, bpl
sub bpl, al
push rsi
rcl rbp, 0xe
push rdi
rcl dil, cl
clc
push r12
shl rbp, 0x45
xor ebp, r9d
sal di, 0xb
push r14
bsr r14w, r15w
push r15
and sil, dil
sub rsp, 0x20
test rdx, rdx
movsxd r14, r12d
lea r14, [rsp + 0x50]
movsx ebp, cx
mov rsi, rcx
movzx ebp, r9w
xchg dil, dil
mov rdi, rcx
not bp
cmovne r15, r15
movzx ecx, byte [rcx]
movsx r15, bp
movsxd r15, r8d
bswap r15w
cmovne r14, rdx
mov bpl, 0xbd
movsx r15d, r15w
mov r15, r9
mov ebp, r8d
jmp 0x14049b913
jmp 0x14049b91e
inc rdi
movzx ecx, byte [rdi]
call fcn.1404b48b1
test eax, eax
jmp 0x14049b92a
jne 0x14049b918
mov bl, byte [rdi]
btc eax, 0xfb
mov rax, 0x27f66952
lahf
lea eax, [rbx - 0x2b]
cmp dx, r12w
test al, 0xfd
jmp 0x14049b94c
je 0x14049b959
mov bl, 0x2b
jmp 0x14049b95f
inc rdi
movsxd r8, r12d
mov r9, r15
cqo
movzx r8, ax
movsx ecx, r9w
mov r8d, ebp
movzx ecx, sp
mov rdx, r14
not cl
movzx ecx, r8w
movzx rcx, dx
mov rcx, rdi
jmp 0x14049b987
call fcn.14049bad3
mov rcx, rax
mov bpl, 0x2d
sub r12b, cl
ror r12, cl
movabs r12, 0x8000000000000000
or byte [rcx - 9], 0xc3
shr dword [rdx], cl
or eax, 0x3b49f803
notrack jmp 0x14049b9b2

Function at 0x14049ca15
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
clc
and dword [rsp + 0x30], 0
jmp 0x14049ca24
call fcn.1404a6f20
mov r9d, 2
lea r8, [rsp + 0x30]
movzx dx, r15b
bswap dx
mov rcx, qword [rax + 0x28]
cdq
lea edx, [r9 + 0x20]
jmp 0x14049ca4a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp r11b, 0xbc
clc
sub ecx, 0x30
jmp 0x14049ca62
je 0x14049caa9
sub ecx, 1
jmp 0x14049ca70
je 0x14049ca9a
cmp ecx, 1
je 0x14049ca8b
sub eax, eax
jmp 0x14049ca86
jmp 0x14049cab1
mov eax, 3
jmp 0x14049ca95
jmp 0x14049cab1
mov eax, 1
jmp 0x14049caa4
jmp 0x14049cab1
mov eax, 2
cmp r13b, r8b
add rsp, 0x28
jmp 0x14049caba
ret
Function at 0x14049e795
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
dec ebx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
and edi, 0x45b914e8
push r14
push r15
ror bx, cl
sub rsp, 0x40
cmovae r12w, r15w
movsx di, dl
mov rbx, qword [rsp + 0x90]
mov r12, rdx
movsx r14d, r9w
cwd
setns r14b
mov rbp, rcx
movzx r14d, bp
movsx edi, r10w
mov rdx, r9
xchg r15, r14
mov rcx, rbx
mov rdi, r9
movzx r15, si
mov r15d, r8d
jmp 0x14049e7fd
mov r14d, dword [rbx + 0xc]
jmp 0x14049e806
call fcn.14024abbc
sub r10d, r10d
cmp r12b, 0x65
stc
not sil
mov esi, eax
test r14d, r14d
jmp 0x14049e820
je 0x14049ea69
mov r11, qword [rdi + 8]
sub r13w, di
cwd
or eax, 0xffffffff
and r13w, 0x2d14
adc cl, r9b
movsxd rcx, r14d
movsxd rbx, dword [rbx + 0x10]
sar dx, cl
bts dx, sp
mov r9d, eax
bswap dx
mov r13d, eax
mov edx, r14d
bt ax, 0
lea r8d, [rdx - 1]
xor al, 0x8e
jmp 0x14049e866
lea rcx, [r8 + r8*4]
rcr ah, 0xbc
lea rax, [r11 + rcx*4]
cmp esi, dword [rax + rbx + 4]
jmp 0x14049e87a
jle 0x14049e88f
cmp esi, dword [rax + rbx + 8]
jmp 0x14049e889
jle 0x14049e8a3
mov edx, r8d
test r10b, spl
test r8d, r8d
jmp 0x14049e89d
jne 0x14049e85b
mov r8d, r10d
test si, r15w
test edx, edx
je 0x14049e8dc
lea eax, [rdx - 1]
bsf dx, si
lea rax, [rax + rax*4]
stc
cqo
lea rdx, [rbx + rax*4]
cmp r13b, spl
cmp r13b, 0xa8
test sil, 0x98
add rdx, r11
jmp 0x14049e8d7
jmp 0x14049e8e2
mov rdx, r10
test eax, edx
stc
lea rcx, [r11 + rbx]
or r11d, 0xffffffff
stc
test rdx, rdx
jmp 0x14049e8f3
je 0x14049e91b
mov eax, dword [rdx + 4]
cmp dword [rcx], eax
jmp 0x14049e903
jle 0x14049e955
mov eax, dword [rdx + 8]
clc
cmp dword [rcx + 4], eax
jmp 0x14049e915
jg 0x14049e955
cmp r15d, dword [rcx]
jl 0x14049e955
cmp r15d, dword [rcx + 4]
jmp 0x14049e92d
jg 0x14049e955
cmp r9d, r11d
cdqe
mov eax, r8d
mov r13d, r8d
jmp 0x14049e943
cmovne eax, r9d
mov r9b, 0xfd
movsx r9, sp
movzx r9, sp
mov r9d, eax
inc r8d
stc
add rcx, 0x14
cmp r10w, r8w
test rbx, 0x348f79cb
cmp r10b, 0xf0
cmp r8d, r14d
jb 0x14049e8eb
cmp r9d, r11d
xchg r14, rax
mov qword [rsp + 0x20], r12
movsx ax, bpl
cmovae di, ax
mov eax, r10d
movsxd r11, r14d
cmovne edi, r12d
mov qword [rsp + 0x30], r12
setbe bh
movzx si, dl
cmovne eax, r9d
lea r11, [rsp + 0x40]
movzx esi, r12w
movsx r15d, r10w
not r15w
mov rbx, qword [r11 + 0x30]
movsx r12d, r11w
movzx r15, di
mov rsi, qword [r11 + 0x40]
setno r15b
mov dword [rsp + 0x28], eax
cmovno r15w, sp
bswap eax
movsx r12w, r8b
lea eax, [r13 + 1]
movups xmm0, xmmword [rsp + 0x20]
cmovne r10d, eax
sete r12b
mov r14b, r11b
movzx edi, r8w
mov rax, rbp
bswap rdi
jmp 0x14049e9fe
mov dword [rsp + 0x38], r10d
movups xmm1, xmmword [rsp + 0x30]
jmp 0x14049ea11
movdqu xmmword [rbp], xmm0
movdqu xmmword [rbp + 0x10], xmm1
movsx bp, sil
bswap r12
movzx r12, r9w
mov rbp, qword [r11 + 0x38]
mov rsp, r11
movzx r13w, bl
mov r13, rdx
pop r15
xchg r13w, r14w
movsx r12d, r11w
movsx r13, r13w
pop r14
mov di, 0x2f93
cmovne r13w, r8w
movzx rdi, r13w
pop r13
pop r12
cmova di, bx
movzx rdi, sp
mov rdi, rsp
pop rdi
jmp 0x14049ea68
ret
call fcn.1404b3be1
int3
Function at 0x1404a3555
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x1404a3577
mov qword [rax + 8], rbx
rol bh, cl
sal bl, 0x31
bts r10d, r8d
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
shr si, 0xa7
ror bx, cl
adc r10w, r9w
mov qword [rax + 0x20], rdi
push r14
adc r10b, r8b
sal r10, 0xf1
push r15
bts rsi, rdi
movzx esi, word [rsp + 0x38]
dec bh
mov r10, r8
bsf r8, rbx
bswap r8
shl bx, 0x53
xor r15d, r15d
ror rbx, 0xf4
shl bh, 0xed
movsxd r8, edx
bsf bx, r12w
mov ebx, ecx
ror cl, 0xa8
not ch
mov ecx, r8d
test ch, 0x8e
test si, si
jne 0x1404a3764
mov rax, qword [r9]
mov r11, qword [r10]
stc
cmp rax, 1
jmp 0x1404a35f7
jbe 0x1404a36fa
mov eax, 0x66666667
cwd
test edx, 0x2b897e12
mov r8, r11
bswap rcx
imul ebx
sar edx, 2
mov eax, edx
bts rcx, r14
shr eax, 0x1f
neg cx
add edx, eax
xadd ch, ch
sbb al, r11b
movsxd rcx, esp
movzx eax, dx
rcr ch, cl
mov ch, 0xa8
movsx cx, bpl
shl ax, 2
btr ecx, r13d
lea ecx, [rax + rdx]
movzx rax, r14w
add cx, cx
btr rax, rdx
sub bx, cx
btr rax, 0x8f
add bx, 0x30
movsx eax, r9w
rcr al, cl
mov word [r11], bx
or bx, bx
or ebx, 0x8c278eb
add r11, 2
mov rax, qword [r9]
movsx ebx, ax
bswap ebx
mov ebx, edx
dec rax
jmp 0x1404a3685
mov qword [r9], rax
test edx, edx
jle 0x1404a369f
cmp rax, 1
jmp 0x1404a3699
ja 0x1404a35fd
mov rdx, qword [r10]
jmp 0x1404a36a7
mov qword [r10], r11
jmp 0x1404a36e7
movzx eax, word [rdx]
btc rcx, r12
movzx rcx, ax
cmovns cx, r10w
movzx ecx, word [r8]
cmp r15w, 0x49cf
clc
jmp 0x1404a36cf
mov word [r8], ax
test r14b, 0xd2
sub r8, 2
mov word [rdx], cx
add rdx, 2
test di, 0x1a66
cmp rdx, r8
jmp 0x1404a36ef
jb 0x1404a36af
jmp 0x1404a3729
lea rax, [rax + rax]
rcr rsi, 0x2b
inc bl
sub r11, rax
movsxd r14, r9d
bswap rbx
mov qword [r10], r11
movzx esi, r10w
movsx rbx, bp
mov qword [r9], r15
mov bp, 0x5ceb
movzx bx, sil
cmove r15w, ax
mov rbx, qword [rsp + 0x18]
jmp 0x1404a3733
mov rbp, qword [rsp + 0x20]
xchg r14, rdi
movzx r14w, al
movzx r14d, bp
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
movsx r14d, di
movsx r15, r8w
movzx r14d, dx
pop r15
pop r14
jmp 0x1404a3763
ret
cmp r8, qword [r9]
jae 0x1404a3718
dec r8d
sub r11b, cl
clc
mov r11d, r15d
test sil, r12b
test ecx, ecx
jmp 0x1404a3781
je 0x1404a383a
movsxd rax, r8d
adc rdx, 0x64fa7ffc
bts r14w, di
lea rdi, [rax + rax]
test rsi, r14
mov r14, qword [r10]
dec dx
mov eax, 0x66666667
cqo
shld rdx, r12, 0xdf
imul ebx
btc bp, r12w
mov ebp, r8d
dec ah
xor al, r12b
sar edx, 2
mov ah, 0x5d
mov eax, edx
cmc
shr eax, 0x1f
add edx, eax
test ebx, ebx
je 0x1404a3811
movzx eax, dx
sbb cx, 0x73f1
bsf ecx, r15d
add cl, 0xfb
shl ax, 2
mov rcx, rdx
bts cx, di
lea ecx, [rax + rdx]
add cx, cx
bsf ax, r10w
stc
adc rax, r11
sub bx, cx
not al
movsxd rax, ebp
movzx rax, r12w
lea eax, [rbx + 0x30]
jmp 0x1404a3819
movzx eax, si
jmp 0x1404a3819
mov word [rdi + r14], ax
inc r11d
sub rdi, 2
movzx bx, bl
dec r8d
adc bl, 0x1c
mov ebx, edx
stc
test ebp, ebp
jne 0x1404a379d
movsxd rcx, r11d
movsx eax, ax
sar ax, 0xaa
lea rax, [rcx + rcx]
add qword [r10], rax
sub qword [r9], rcx
jmp 0x1404a3853
jmp 0x1404a3729
Function at 0x1404ab6a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
adc bl, dh
sbb bl, r15b
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
rcl bh, 0x6c
movsxd rbx, r10d
push rdi
xchg bx, bx
movsxd rbx, r12d
sub rsp, 0x30
bsr ebx, r11d
rol ebx, 0x11
xor ebp, ebp
btr ebx, 0xe
test sil, r12b
movzx bx, r10b
mov rbx, rcx
cmp di, 0x3915
cmp byte [rcx + 0x54], bpl
jmp 0x1404ab6f0
jne 0x1404ab817
cmp dword [rcx + 0x50], ebp
jle 0x1404ab817
mov rsi, qword [rcx + 0x48]
rdtsc
mov edi, ebp
jmp 0x1404ab710
mov r9, qword [rbx + 8]
movsx ecx, r15w
jmp 0x1404ab71d
lea rcx, [rsp + 0x40]
mov r8b, 7
cbw
not r8w
mov word [rsp + 0x40], bp
cmova r8, r9
mov rdx, rsi
not al
bswap rax
mov rax, qword [r9]
setg r8b
movzx r8d, r11w
bswap r8
movsxd r8, dword [rax + 8]
call fcn.1404ccf9f
movsxd r8, eax
stc
cmc
test eax, eax
jmp 0x1404ab75f
jle 0x1404ab809
mov rcx, qword [rbx + 0x468]
btr dx, r15w
movzx edx, word [rsp + 0x40]
cmp r8w, si
sub ax, 0x2b74
mov rax, qword [rcx + 8]
cmp qword [rcx + 0x10], rax
jne 0x1404ab7b1
cmp byte [rcx + 0x18], bpl
je 0x1404ab7a3
inc dword [rbx + 0x28]
jmp 0x1404ab79e
jmp 0x1404ab7e8
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ab7ac
jmp 0x1404ab7e8
inc dword [rbx + 0x28]
inc qword [rcx + 0x10]
neg ch
mov rax, qword [rbx + 0x468]
or cx, bp
sal ecx, 0xc3
movsx ecx, bx
mov rcx, qword [rax]
adc rax, 0x4dbc133c
mov word [rcx], dx
sub eax, 0x4f6c4d75
stc
mov rax, qword [rbx + 0x468]
add qword [rax], 2
add rsi, r8
jmp 0x1404ab7f0
inc edi
cmp r15b, cl
stc
cmp edi, dword [rbx + 0x50]
jmp 0x1404ab7fe
jne 0x1404ab710
jmp 0x1404ab856
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ab812
jmp 0x1404ab856
mov r8d, dword [rbx + 0x50]
clc
jmp 0x1404ab825
lea rax, [rcx + 0x10]
rol r9w, 0xa0
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
jmp 0x1404ab83b
add rcx, 0x468
jmp 0x1404ab847
mov qword [rsp + 0x20], rax
jmp 0x1404ab851
call fcn.1404a9b87
mov rbx, qword [rsp + 0x48]
or dil, dl
xor dil, 0xc9
mov al, 1
cmp r13d, 0x5e2b224d
add rdi, 0x42f51b65
rcr dil, cl
mov rbp, qword [rsp + 0x50]
rcl dil, 0xc1
movzx rdi, bx
bsr si, si
mov rsi, qword [rsp + 0x58]
shl di, cl
setno dil
sbb dil, dl
add rsp, 0x30
bswap di
movsx di, r15b
pop rdi
jmp 0x1404ab8a7
ret
Function at 0x1404ad2e7
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
clc
mov qword [rsp + 0x10], rsi
push rdi
xadd dil, sil
sub esi, edx
rcl dil, cl
sub rsp, 0x30
mov edi, edx
mov rsi, rcx
test r8, r8
jmp 0x1404ad30d
jne 0x1404ad334
call fcn.1404b1cac
mov dword [rax], 0x16
jmp 0x1404ad323
call fcn.1404b290a
xor eax, eax
jmp 0x1404ad32f
jmp 0x1404ad42c
mov rdx, r9
mov rcx, rcx
mov cx, 0x5059
mov rcx, r8
jmp 0x1404ad346
call fcn.1404ad495
mov rbx, rax
cmp r11b, 0x27
stc
test rax, rax
jmp 0x1404ad35b
je 0x1404ad3cd
lea rax, [rsp + 0x50]
cwd
movsx cx, r14b
bswap r9d
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x140094b24]
lahf
mov eax, dword [rsp + 0x60]
movzx ecx, dx
mov r9, rbx
sets cl
movzx ecx, r8w
not cl
mov rcx, rsi
jmp 0x1404ad39b
mov dword [rsp + 0x20], eax
jmp 0x1404ad3a4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404ad3b5
jne 0x1404ad451
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404ad3c8
call fcn.1404b1d18
xor edi, edi
test rbx, rbx
jmp 0x1404ad3d7
je 0x1404ad41f
mov rcx, qword [rbx + 0x10]
cmp sil, 0x1a
test rcx, rcx
jmp 0x1404ad3ed
je 0x1404ad3f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmc
test rcx, rcx
jmp 0x1404ad406
je 0x1404ad412
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404ad41a
call fcn.1404c5b87
mov rax, rdi
jmp 0x1404ad42c
mov rbx, qword [rsp + 0x40]
bsr di, si
mov rsi, qword [rsp + 0x48]
bswap di
add rsp, 0x30
movsx di, spl
movzx edi, r15w
pop rdi
jmp 0x1404ad450
ret
mov rcx, qword [rsp + 0x68]
jmp 0x1404ad462
test rcx, rcx
jmp 0x1404ad46a
je 0x1404ad47a
mov eax, dword [rsp + 0x50]
cmc
test r14b, r14b
mov dword [rcx], eax
sub ebx, ebx
jmp 0x1404ad481
jmp 0x1404ad3cf

Function at 0x1404ad72c
Capabilities:
Terminate process

Disassembly:
push rbx
btr bx, r11w
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404ad73e
call fcn.1404cf20c
cmp eax, 1
jmp 0x1404ad74b
je 0x1404ad793
mov rax, qword gs:[0x60]
cmp dil, r9b
and dl, 0xaa
movsx rdx, bp
mov edx, dword [rax + 0xbc]
stc
shr edx, 8
clc
test dl, 1
jmp 0x1404ad777
jne 0x1404ad793
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1404ad78d
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404ad79a
call fcn.1404ad67f
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404c6ffe
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
cdq
movsx rbx, r9w
setl r8b
mov rbx, rcx
movsx r8d, r14w
movsx dx, r10b
jmp 0x1404c701e
lea r9, [0x1400c63c0]
movsx edx, r10w
mov ecx, 3
lea r8, [0x1400c63b8]
not dh
lea rdx, [0x1400cfb70]
jmp 0x1404c7043
call fcn.1404c8071
test rax, rax
jmp 0x1404c7050
je 0x1404c707f
mov rcx, rbx
inc bh
jmp 0x1404c7063
add rsp, 0x20
movsx rbx, r9w
cmovb rbx, rdi
not bx
pop rbx
jmp 0x1404c7078
jmp qword [case.0x1400f3ca8.0]
add rsp, 0x20
movsxd rbx, eax
jmp 0x1404c708e
pop rbx
jmp 0x1404c7094
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404c7126
Capabilities:
Get thread local storage value

Disassembly:
push rbx
dec bh
sub rsp, 0x20
jmp 0x1404c7133
mov ebx, ecx
movzx r9d, r10w
lea r9, [0x1400c63d0]
mov ecx, 5
movsx rdx, sp
bswap edx
movsx r8d, r14w
lea r8, [0x1400c63c8]
lea rdx, [0x1400cf758]
jmp 0x1404c7162
call fcn.1404c8071
mov ecx, ebx
jmp 0x1404c716e
test rax, rax
jmp 0x1404c7176
je 0x1404c7192
add rsp, 0x20
mov bl, r9b
xchg bl, bh
pop rbx
jmp 0x1404c718b
jmp qword [case.0x1400f3ca8.0]
add rsp, 0x20
movzx rbx, di
pop rbx
jmp 0x1404c71a0
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c71a7
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
btc bx, 0xcb
sub rsp, 0x20
movzx rdi, si
mov rbx, rdx
lea r9, [0x1400c63d8]
mov edi, ecx
cmovae rdx, r8
setns r8b
movsx r8d, r10w
lea rdx, [0x1400cf748]
cmove r8w, sp
xchg cl, cl
bswap ecx
mov ecx, 6
not r8
cmovbe r8w, si
mov r8b, 0x6e
lea r8, [0x1400c63d0]
call fcn.1404c8071
mov rdx, rbx
rcl cl, cl
stc
mov ecx, edi
cmc
test rax, rax
je 0x1404c721b
call qword [case.0x1400f3ca8.0]
jmp 0x1404c7221
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
btr rdi, rax
xor dil, 2
ror edi, 0xae
add rsp, 0x20
mov dil, 0xef
pop rdi
jmp 0x1404c723e
ret

Function at 0x1404c73b4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
add rbx, 0x688a3133
rol bl, 0x48
ror bx, cl
mov qword [rsp + 0x10], rbp
movsx bx, ch
cmp rbx, rax
ror bpl, cl
mov qword [rsp + 0x18], rsi
or bx, r12w
shl sil, cl
push rdi
sal rsi, 0x78
bts esi, r8d
sub rsp, 0x30
xchg si, bx
cmovge rsi, rcx
mov ebx, r9d
movzx r9w, bl
bswap r9
mov rdi, r8
mov esi, edx
lea r9, [0x1400c63e8]
mov rbp, rcx
cwd
lea r8, [0x1400c63e0]
movzx edx, di
lea rdx, [0x1400cf190]
jmp 0x1404c742a
mov ecx, 0xb
jmp 0x1404c7434
call fcn.1404c8071
mov rcx, rbp
test rax, rax
jmp 0x1404c7444
je 0x1404c7469
mov r9d, ebx
bswap r8
mov r8, rdi
movsx edx, r12w
mov edx, esi
jmp 0x1404c745e
call qword [case.0x1400f3ca8.0]
jmp 0x1404c7499
xor edx, edx
jmp 0x1404c7470
call fcn.1404c7b0e
mov ecx, eax
mov r9d, ebx
movsxd r8, r12d
xchg r8w, r8w
movsx r8d, r12w
mov r8, rdi
movsx rdx, r8w
mov edx, esi
jmp 0x1404c7493
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
sal rsi, 0xa7
mov rbp, qword [rsp + 0x48]
cmp dil, r9b
sub dil, 1
mov rsi, qword [rsp + 0x50]
cmp sp, 0x5e51
bsf di, cx
add rsp, 0x30
movsx edi, r14w
setno dil
pop rdi
jmp 0x1404c74ce
ret
Function at 0x1404cb16b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
xor cx, r14w
mov qword [rax + 0x10], rbp
mov cl, r15b
mov qword [rax + 0x18], rsi
dec ch
rol cl, 0xed
mov qword [rax + 0x20], rdi
rol cx, cl
or ecx, r11d
movsxd rcx, esp
push r14
mov ch, 0x2f
sub rsp, 0x90
jmp 0x1404cb1a4
lea rcx, [rax - 0x78]
jmp 0x1404cb1ad
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor r14d, r14d
cmp word [rsp + 0x62], r14w
je 0x1404cb313
mov rax, qword [rsp + 0x68]
jmp 0x1404cb1cc
test rax, rax
jmp 0x1404cb1d4
je 0x1404cb313
movsxd rbx, dword [rax]
add edi, r11d
lea rsi, [rax + 4]
movsxd rcx, eax
xchg cx, cx
mov edi, 0x2000
test cl, bpl
bt rcx, r8
movzx ecx, si
lea rbx, [rbx + rsi]
cmp dword [rax], edi
cmovl edi, dword [rax]
mov cx, di
xchg rcx, rcx
mov ecx, edi
jmp 0x1404cb20f
call fcn.1400ada04
cmp edi, dword [0x1400bad40]
jmp 0x1404cb21f
cmovg edi, dword [0x1400bad40]
test edi, edi
jmp 0x1404cb22d
je 0x1404cb313
mov ebp, r14d
cmp qword [rbx], 0xffffffffffffffff
jmp 0x1404cb23f
je 0x1404cb2e8
cmp qword [rbx], 0xfffffffffffffffe
jmp 0x1404cb24e
je 0x1404cb2e8
test byte [rsi], 1
jmp 0x1404cb25c
je 0x1404cb2e8
test byte [rsi], 8
jmp 0x1404cb26a
jne 0x1404cb28b
mov rcx, qword [rbx]
jmp 0x1404cb278
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jmp 0x1404cb285
je 0x1404cb2e8
mov rax, rbp
xchg r8w, r8w
lea r8, [0x1400ba940]
mov rcx, rbp
movzx dx, r10b
sar rcx, 6
cqo
jmp 0x1404cb2ae
and eax, 0x3f
inc dh
dec edx
movzx rdx, r10w
mov rcx, qword [r8 + rcx*8]
movsxd rdx, r13d
lea rdx, [rax + rax*8]
movzx eax, dx
xchg al, ah
mov rax, qword [rbx]
jmp 0x1404cb2d1
mov qword [rcx + rdx*8 + 0x28], rax
xchg al, al
mov al, byte [rsi]
jmp 0x1404cb2df
mov byte [rcx + rdx*8 + 0x38], al
jmp 0x1404cb2e8
inc rbp
jmp 0x1404cb2f0
inc rsi
test bp, 0x64cd
jmp 0x1404cb2fd
add rbx, 8
test r13b, dl
sub rdi, 1
jmp 0x1404cb30d
jne 0x1404cb236
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
movsx rdi, r9w
movzx r14d, dx
movzx rdi, bx
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
xchg r14, r14
mov r14w, 0x4429
movzx r14, r14w
mov rsp, r11
jmp 0x1404cb34e
pop r14
jmp 0x1404cb355
ret
Function at 0x1404d3cda
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
ror bx, cl
bts bx, cx
mov qword [rsp + 0x18], rsi
cmp si, 0x3433
ror bx, cl
shr bh, cl
push rdi
add di, 0x13b8
sub rsp, 0x20
xor esi, esi
bswap rbx
adc dil, 0x27
mov rdi, rdx
not bh
shl bh, 6
mov rbx, rcx
cmp r8b, r12b
cmp r14, 0x15800d83
test rcx, rcx
jmp 0x1404d3d25
je 0x1404d3dcd
cmp word [rcx], si
jmp 0x1404d3d33
je 0x1404d3dcd
lea rdx, [0x1400d1d08]
jmp 0x1404d3d45
call fcn.1401cbf33
test eax, eax
je 0x1404d3dcd
lea rdx, [0x1400d1d00]
movzx ecx, sp
mov rcx, rbx
call fcn.1401cbf33
test eax, eax
jmp 0x1404d3d6b
jne 0x1404d3dbb
mov ecx, dword [rdi + 8]
movzx r8d, r8w
lea r9d, [rsi + 2]
bswap dx
mov r8, 0x6e35c26
lea r8, [rsp + 0x30]
mov dx, 0x64d8
movsx rdx, r14w
not dh
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d3da7
je 0x1404d3dfd
mov eax, dword [rsp + 0x30]
jmp 0x1404d3db6
jmp 0x1404d3e28
mov rcx, rbx
jmp 0x1404d3dc3
call fcn.1404dce71
jmp 0x1404d3e28
mov ecx, dword [rdi + 8]
cmove r8d, edx
mov dh, 0x32
lea r8, [rsp + 0x30]
setle dl
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d3def
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d3e09
xor eax, eax
jmp 0x1404d3e04
jmp 0x1404d3e28
mov eax, dword [rsp + 0x30]
cmp r10b, 0x84
cmp di, bp
clc
test eax, eax
jmp 0x1404d3e1c
jne 0x1404d3e28
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
rcl si, cl
test r10b, 0x5e
mov rsi, qword [rsp + 0x40]
btr di, 0x56
rol edi, 0x1d
add rsp, 0x20
mov edi, 0x30933c08
not edi
movsx rdi, ax
pop rdi
ret

Function at 0x1404d3e52
Capabilities:
Encrypt data using rc4 prga
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
movzx bx, ch
btr bx, 0x36
mov qword [rsp + 0x18], rsi
movsx ebx, r8w
push rdi
sub rsp, 0x20
movzx rbx, r14w
mov esi, edx
setp bh
bswap ebx
movzx rbx, sp
mov ebx, ecx
jmp 0x1404d3e84
call fcn.1404c5ee2
mov ecx, ebx
rcr r9w, cl
lea r8, [rsp + 0x30]
cmc
and ecx, 0x3ff
movsx di, dil
setp r9b
mov r9d, 2
jmp 0x1404d3eb8
bts ecx, 0xa
cqo
cmovbe dx, si
mov edx, 0x20000001
movsx di, r10b
mov rdi, rax
jmp 0x1404d3ed4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
cmc
test eax, eax
je 0x1404d3fa5
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d3eef
je 0x1404d3f96
test esi, esi
je 0x1404d3f96
mov r9, qword [rdi + 0x98]
btr cx, 0xe3
inc r8w
mov r8d, r10d
sar dl, cl
rdtsc
movzx edx, word [r9]
lea rcx, [r9 + 2]
rol al, 0x8a
lea eax, [rdx - 0x41]
test ebx, 0x2d0f656a
cmp ax, 0x19
jbe 0x1404d3f49
sub dx, 0x61
cmc
test spl, sil
cmp dx, 0x19
jmp 0x1404d3f43
ja 0x1404d3f63
movzx edx, word [rcx]
jmp 0x1404d3f51
inc r8d
cmc
add rcx, 2
jmp 0x1404d3f5e
jmp 0x1404d3f1f
or rcx, 0xffffffffffffffff
jmp 0x1404d3f6c
inc rcx
cmp dh, bl
test r15d, 0x15e91314
cmp word [r9 + rcx*2], r10w
jmp 0x1404d3f82
jne 0x1404d3f6c
cmp r8d, ecx
jmp 0x1404d3f90
je 0x1404d3fa5
mov eax, 1
jmp 0x1404d3fa0
jmp 0x1404d3fa7
sub eax, eax
mov rbx, qword [rsp + 0x38]
bsr si, r14w
mov rsi, qword [rsp + 0x40]
add di, r15w
movsxd rdi, r12d
xor edi, esp
add rsp, 0x20
movzx di, dl
pop rdi
jmp 0x1404d3fcd
ret