joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14046d41d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xadd bp, bp
movsx bp, r10b
xor rbp, 0x5a2c2554
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
not bpl
sal sil, 0xae
push r14
neg r14w
xchg dil, dil
sub rsp, 0x20
mov rsi, r9
sal r14, 0xfe
shr edi, 0xe
movzx r14d, r8w
mov rdi, rdx
shl bp, cl
adc bpl, bpl
bswap ebp
mov rbp, rcx
test r9, r9
jmp 0x14046d479
je 0x14046d520
mov rbx, qword [rdx + 8]
cmp r8b, dl
test rbx, rbx
jmp 0x14046d48e
je 0x14046d50e
mov rax, qword [rbx + 0x40]
jmp 0x14046d49d
cmp qword [rax], 0
jmp 0x14046d4a6
je 0x14046d4e7
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0
jle 0x14046d4e7
dec dword [rax]
mov rcx, qword [rbx + 0x40]
xchg dl, dl
cbw
mov rdx, qword [rcx]
movsx eax, dx
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx eax, r14w
jmp 0x14046d4d9
mov word [rdx], r14w
jmp 0x14046d4e2
jmp 0x14046d4ff
mov rax, qword [rbx]
cmove edx, r10d
movzx edx, r14w
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x1404c5688.0]
mov ecx, 0xffff
stc
cmp cx, ax
jne 0x14046d511
mov byte [rdi], 1
sub rsi, 1
jmp 0x14046d51a
jne 0x14046d486
movups xmm0, xmmword [rdi]
setns sil
mov rbx, qword [rsp + 0x30]
cmovge ax, cx
mov rax, rbp
shl di, 0xd
bsr edi, r8d
mov rsi, qword [rsp + 0x40]
movsxd rdi, r15d
sal r14b, 0x56
mov rdi, qword [rsp + 0x48]
movsxd r14, esi
btr r14w, 0x4e
or r14b, 0x9b
movdqu xmmword [rbp], xmm0
add r14b, 0xca
mov rbp, qword [rsp + 0x38]
movsx r14w, cl
xor r14b, al
add rsp, 0x20
movzx r14d, r8w
movsx r14, r8w
sets r14b
pop r14
jmp 0x14046d586
ret
Function at 0x14048ba08
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
test rdx, r9
cmovnp rcx, rbp
movsx rcx, bx
mov qword [rsp + 0x10], rbp
adc ebp, 0xbe664b1
mov rbp, 0x60df718e
mov qword [rsp + 0x18], rsi
jmp 0x14048ba3e
push rdi
movzx rcx, r13w
adc sil, bpl
bt si, r10w
push r14
cmc
adc cl, 0x9d
push r15
sub rsp, 0x20
mov rsi, qword [rsp + 0x60]
not ebp
mov rbp, r8
mov r14, rdx
movsx dx, r9b
cwd
jmp 0x14048ba70
mov rbx, r9
setne cl
mov rdx, rbp
movsxd r8, ebp
mov rcx, r14
setp r8b
movzx r8, cx
bswap r15w
lea r15, [rsi + rsi]
movsx r8, r14w
mov r8, r15
jmp 0x14048ba9b
call fcn.14049d8a6
mov r10, qword [rsp + 0x68]
shl dil, 0xb0
xchg di, di
adc di, 0x6cb0
lea rdi, [r15 + r14]
jmp 0x14048babe
test r10, r10
jmp 0x14048bac6
je 0x14048badb
movzx eax, word [rsp + 0x70]
mov rcx, r10
rep stosw word [rdi], ax
shr dil, 7
sub rbx, rsi
or r8w, sp
lea rax, [rsi + r10]
cmp spl, 0x4a
lea rdx, [r15 + rbp]
shr bp, cl
test edi, r15d
sbb ecx, r13d
lea rcx, [r14 + rax*2]
sbb r15w, r8w
shl edi, 0x61
lea r8, [rbx*2 + 2]
dec esi
sal bpl, 0xe1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
or sil, 0xa5
mov rsi, qword [rsp + 0x50]
xadd di, r14w
btr r14, rdi
add rsp, 0x20
cmovs rdi, r10
bswap r14
pop r15
mov r14, rbp
not r14b
pop r14
bswap di
xchg edi, edi
pop rdi
jmp fcn.14049d8a6
Function at 0x14049a631
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp dl, 0x17
jmp 0x14049a641
and dword [rsp + 0x30], 0
jmp 0x14049a64b
call fcn.1404a49b0
mov r9d, 2
cmovge dx, r9w
movsx rdx, r8w
lea r8, [rsp + 0x30]
bswap ecx
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x14049a673
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
clc
sub ecx, 0x30
jmp 0x14049a687
je 0x14049a6c4
sub ecx, 1
je 0x14049a6ba
cmp ecx, 1
jmp 0x14049a69e
je 0x14049a6b0
xor eax, eax
jmp 0x14049a6ab
jmp 0x14049a6cd
mov eax, 3
jmp 0x14049a6cd
mov eax, 1
jmp 0x14049a6cd
mov eax, 2
cmp r15b, 0xff
add rsp, 0x28
jmp 0x14049a6d6
ret

Function at 0x14049beec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
test r11b, 0xe
push rsi
push rdi
xchg sil, sil
ror sil, 0x54
movsxd rsi, r11d
push r12
movsx edi, r14w
shl edi, 0xd7
push r14
xadd r12w, r12w
dec di
xor rsi, 0x37f50fe8
push r15
jmp 0x14049bf27
sub rsp, 0x20
mov r12w, r14w
mov esi, dword [r8 + 0xc]
cmovo r15w, r12w
movsxd r12, esi
mov r12, rcx
xchg r14, rcx
mov rcx, r8
movsx r15d, r13w
mov rdi, r9
mov r14b, r13b
movzx r14, di
mov r14, r8
seto r15b
movsx r15w, r14b
mov r15, rdx
call fcn.14026c538
mov r10, qword [r12]
sub bp, r10w
dec bpl
btr bp, r10w
mov ebp, eax
mov qword [rdi], r10
test esi, esi
jmp 0x14049bf82
je 0x14049c0a7
movsxd rax, dword [r14 + 0x10]
sal ecx, 0x37
xor bl, 0x3c
shl cl, cl
lea ecx, [rsi - 1]
jmp 0x14049bfa4
mov esi, ecx
lea rcx, [rcx + rcx*4]
lea rbx, [rax + rcx*4]
jmp 0x14049bfb6
add rbx, qword [r15 + 8]
cmp ebp, dword [rbx + 4]
jmp 0x14049bfc2
jle 0x14049bf7b
cmp ebp, dword [rbx + 8]
jmp 0x14049bfd0
jg 0x14049bf7b
mov rcx, qword [r15]
rcr rdx, 0xd6
sbb dl, r9b
lea rdx, [rsp + 0x50]
sub r8d, r8d
jmp 0x14049bfed
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
rcl r10b, 0x16
sub ecx, ecx
btc r9d, esp
sub r10b, 0xcc
add r8, qword [rsp + 0x50]
or r10b, r11b
movsx r9, r10w
mov r9d, dword [rbx + 0xc]
shrd r10w, di, 0xf9
not r10b
movsx r10, dx
mov r10d, dword [rax]
cmp al, 0xb7
jmp 0x14049c02c
test r9d, r9d
jmp 0x14049c034
je 0x14049c05f
lea rdx, [r8 + 0xc]
movsxd rax, dword [rdx]
jmp 0x14049c046
cmp rax, r10
je 0x14049c05f
inc ecx
add rdx, 0x14
cmc
cmp ecx, r9d
jb 0x14049c03e
cmp ecx, r9d
jmp 0x14049c067
jae 0x14049bf7b
mov rax, qword [r12]
rcr ebp, cl
rol r12w, 0xfd
bts r15, r11
lea rcx, [rcx + rcx*4]
ror bpl, cl
movsxd rcx, dword [r8 + rcx*4 + 0x10]
bt si, 0xb5
mov rcx, qword [rcx + rax]
neg r12b
shl bl, 0
test ecx, eax
mov qword [rdi], rcx
sub bl, r10b
mov r15w, 0x26a1
shl bpl, cl
mov rbx, qword [rsp + 0x58]
add bpl, r8b
xadd sil, sil
lahf
mov rax, rdi
bts bp, r9w
bt r12w, 0x89
movzx r14d, sp
mov rbp, qword [rsp + 0x60]
inc r15b
add rsp, 0x20
movsx edi, si
pop r15
movzx si, bl
not sil
pop r14
movzx edi, r13w
movsx esi, sp
pop r12
pop rdi
movsx rsi, r9w
cmova si, r9w
pop rsi
jmp 0x14049c0f9
ret
Function at 0x1404a7499
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
jmp 0x1404a74bd
mov qword [rsp + 0x18], rsi
and bx, r13w
rol rax, 0xb0
inc al
push rdi
ror bx, 0xa5
btc rax, r15
add bx, 0x62c0
sub rsp, 0x50
movzx bx, r11b
mov rax, qword [0x1400b7288]
and bx, r9w
rol bx, 6
shl bh, 0xfd
xor rax, rsp
shl bl, 0x80
movsx rbx, r10w
ror bh, cl
mov qword [rsp + 0x40], rax
cmovo rbx, rsp
add bl, 0xb1
adc ebx, esi
cmp byte [rcx + 0x54], 0
not bh
movsx bx, bl
mov rbx, rcx
jmp 0x1404a7521
je 0x1404a760f
cmp dword [rcx + 0x50], 0
jmp 0x1404a7530
jle 0x1404a760f
mov rsi, qword [rcx + 0x48]
movsx r8d, cx
sar eax, cl
sub edi, edi
rcl r9w, cl
mov rax, qword [rbx + 8]
bts dx, r14w
mov dx, 0x1545
lea rdx, [rsp + 0x34]
movzx r9, r12w
movzx r9d, word [rsi]
rol r8b, 0xcd
shl ch, cl
movzx r8d, r8w
lea rcx, [rsp + 0x30]
sal r8w, cl
and dword [rsp + 0x30], 0
movsx r8d, r12w
lea rsi, [rsi + 2]
mov r8d, 6
jmp 0x1404a758b
mov qword [rsp + 0x20], rax
jmp 0x1404a7595
call fcn.1404caafb
test eax, eax
jne 0x1404a7601
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x1404a7601
lea rax, [rbx + 0x10]
not r9b
lea r9, [rbx + 0x28]
movsx cx, r13b
movzx dx, r14b
mov qword [rsp + 0x20], rax
cqo
not dl
lea rcx, [rbx + 0x468]
setp dl
movzx edx, r14w
lea rdx, [rsp + 0x34]
jmp 0x1404a75e6
call fcn.1404a5905
inc edi
cmc
cmp edi, dword [rbx + 0x50]
jmp 0x1404a75f6
jne 0x1404a7546
jmp 0x1404a7650
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404a760a
jmp 0x1404a7650
mov r8d, dword [rbx + 0x50]
sub r9b, 0x8e
lea rax, [rcx + 0x10]
mov r9b, 0xfb
and r9b, cl
mov r9b, bpl
mov rdx, qword [rbx + 0x48]
shr r9, 0xe4
btc r9, 0x6b
bswap r9w
lea r9, [rcx + 0x28]
cmc
add rcx, 0x468
mov qword [rsp + 0x20], rax
jmp 0x1404a764b
call fcn.1404a5905
mov al, 1
xchg cx, cx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140499d06
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movsx di, sil
movsxd rdi, edi
add rsp, 0x50
mov dil, 0x86
setns dil
pop rdi
ret
Function at 0x1404a88e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsx ax, r11b
sal r8, 0x19
mov qword [rsp + 0x10], rsi
setge dh
cdqe
push rdi
sub rsp, 0x20
movzx ax, r12b
cwde
sete bh
add qword [rcx + 0x20], 8
adc dil, r14b
lahf
mov rdi, rcx
shl r8w, cl
sar ebx, 0x74
mov sil, r9b
mov rax, qword [rcx + 0x20]
xor r8w, 0x4a7c
mov esi, dword [rcx + 0x38]
and edx, r10d
test dx, bp
rcr dl, 0xa4
cmp esi, 0xffffffff
not r8w
movsxd r8, r10d
mov r8d, dword [rcx + 0x3c]
movzx edx, word [rcx + 0x42]
movsxd rbx, ebp
movzx rbx, r8w
movsx bx, r12b
mov rbx, qword [rax - 8]
mov eax, 0x7fffffff
mov qword [rcx + 0x48], rbx
jmp 0x1404a8966
cmove esi, eax
jmp 0x1404a896e
mov rcx, qword [rcx]
call fcn.1400f7256
test al, al
je 0x1404a89d0
test rbx, rbx
jmp 0x1404a8986
jne 0x1404a89a9
lea rbx, [0x1400d25f0]
cdq
jmp 0x1404a899b
mov qword [rdi + 0x48], rbx
cqo
movsx ecx, r10w
movsx rcx, r14w
movsxd rdx, esi
not ecx
cmovae rcx, rsp
bswap cx
mov rcx, rbx
jmp 0x1404a89bd
mov byte [rdi + 0x54], 1
jmp 0x1404a89c6
call fcn.1400fd2f6
jmp 0x1404a8a5b
test rbx, rbx
jne 0x1404a89ed
lea rbx, [0x1400ced98]
stc
clc
cmp r15b, r9b
mov qword [rdi + 0x48], rbx
cmp r8b, spl
clc
sub r9d, r9d
stc
test esi, esi
jmp 0x1404a89f8
jle 0x1404a8a58
cmp byte [rbx], 0
je 0x1404a8a58
mov rax, qword [rdi + 8]
movzx edx, byte [rbx]
mov rcx, qword [rax]
mov rax, qword [rcx]
inc r8w
lea rcx, [rbx + 1]
bts r8w, dx
movzx r8d, word [rax + rdx*2]
cmc
and r8d, 0x8000
jmp 0x1404a8a33
cmove rcx, rbx
movsxd rbx, r8d
mov rbx, r8
inc r9d
shr bh, cl
movsx ebx, r14w
lea rbx, [rcx + 1]
cmp r9d, esi
jmp 0x1404a8a52
jl 0x1404a89fe
mov eax, r9d
mov dword [rdi + 0x50], eax
add di, 0x3e8c
bswap bx
mov al, 1
and sil, 0xbf
adc dil, r12b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
rol di, cl
add rsp, 0x20
mov dil, 0xda
pop rdi
ret
Function at 0x1404aae25
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404aae35
mov qword [rsp + 0x10], rsi
sar esi, cl
sub sil, r14b
push rdi
adc di, 0x611a
sub rdi, 0x349f46a9
bts di, r8w
sub rsp, 0x30
bt edi, r8d
mov di, cx
rcl edi, 5
mov edi, edx
bsf si, cx
sar sil, 0xdd
mov rsi, rcx
test r11b, sil
cmp cl, sil
cmc
test r8, r8
jmp 0x1404aae7b
jne 0x1404aae9d
call fcn.1404af716
mov dword [rax], 0x16
call fcn.1404b03df
xor eax, eax
jmp 0x1404aae98
jmp 0x1404aaf82
mov rdx, r9
setne cl
mov rcx, r8
jmp 0x1404aaeab
call fcn.1404aaff1
mov rbx, rax
clc
cmp r12, 0x58e6974
cmc
test rax, rax
jmp 0x1404aaec4
je 0x1404aaf1e
lea rax, [rsp + 0x50]
mov rdx, rdi
jmp 0x1404aaed7
mov qword [rsp + 0x28], rax
lea r8, [0x140094b24]
mov r9b, 7
mov eax, dword [rsp + 0x60]
mov r9b, r9b
mov r9, rbx
mov rcx, rsi
jmp 0x1404aaef8
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp cl, 0xdd
test rax, rax
jne 0x1404aafaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404af793
xor edi, edi
test r8b, 0x90
test rbx, rbx
jmp 0x1404aaf2c
je 0x1404aaf74
mov rcx, qword [rbx + 0x10]
test r14w, r9w
cmc
test rcx, rcx
jmp 0x1404aaf43
je 0x1404aaf4f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404aaf5b
je 0x1404aaf67
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404aaf6f
call fcn.1404c3583
mov rax, rdi
or sil, 0x13
not dil
movzx edi, r15w
mov rbx, qword [rsp + 0x40]
sbb dil, spl
btc rdi, 0xe0
or dil, bpl
mov rsi, qword [rsp + 0x48]
movzx rdi, dx
add rsp, 0x30
movsx edi, r9w
pop rdi
jmp 0x1404aafa9
ret
mov rcx, qword [rsp + 0x68]
cmp rdx, 0x2a0b5ed5
cmp rdx, rsp
test rcx, rcx
jmp 0x1404aafc1
je 0x1404aafd1
mov eax, dword [rsp + 0x50]
cmc
clc
stc
mov dword [rcx], eax
cmc
xor ebx, ebx
jmp 0x1404aafd8
jmp 0x1404aaf24

Function at 0x1404ab2ab
Capabilities:
Terminate process

Disassembly:
push rbx
rcl bh, cl
sub rsp, 0x20
movsx bx, r15b
setno bh
jmp 0x1404ab2c0
mov ebx, ecx
call fcn.1404ccb1a
cmp eax, 1
jmp 0x1404ab2cf
je 0x1404ab31b
mov rax, qword gs:[0x60]
btr dx, sp
jmp 0x1404ab2eb
mov edx, dword [rax + 0xbc]
test spl, al
shr edx, 8
test dl, 1
jmp 0x1404ab2ff
jne 0x1404ab31b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1404ab315
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404ab1f1
mov ecx, ebx
jmp 0x1404ab329
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b0492
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movsx cx, r15b
movzx ecx, cx
mov ecx, 0x17
jmp 0x1404b04a8
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b04b5
je 0x1404b04cc
mov ecx, 5
jmp 0x1404b04c5
int 0x29
jmp 0x1404b04cc
mov r8d, 1
bswap dx
setle ch
mov edx, 0x7388372b
mov edx, 0xc0000417
mov cl, bl
mov cl, 0x80
lea ecx, [r8 + 1]
jmp 0x1404b04ef
call fcn.1404b051a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
cmp sil, bpl
jmp 0x1404b050a
add rsp, 0x28
jmp 0x1404b0513
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404bdbfe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
xadd r10w, r10w
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
sub rbx, 0x5bd37d8f
rcr r10b, cl
dec r10d
mov qword [rax + 0x20], rdi
adc r10, r9
push r14
or ebp, 0xffffffff
sub r10w, 0x64d
add bl, dil
sar r10d, 0x14
mov rbx, r8
cmp dword [rcx + 0x10], 0
mov r10, rdx
jmp 0x1404bdc47
je 0x1404bddc8
movsxd r9, dword [rcx + 0x10]
inc ch
shr al, cl
lea r14, [0x140000000]
btc rdi, r11
bts cx, r8w
mov rdi, qword [rdx + 8]
sbb r11d, r13d
movsx rcx, r13w
sar ch, 0x38
xor esi, esi
bt rax, 0x89
lea r9, [r9 + rdi]
shr al, 0xb6
sub r8d, r8d
sbb dx, 0x7215
mov edx, ebp
lahf
or r11b, r8b
movzx ecx, byte [r9]
and ecx, 0xf
rol al, 0x29
movsxd r11, edx
movsx rax, byte [rcx + r14 + 0xc1a30]
sar r11w, cl
mov cl, byte [rcx + r14 + 0xc1a40]
dec r11d
sub r9, rax
movzx r11w, bl
test r13d, 0x3e5b1ca1
and r11, 0x46cc424f
mov r11d, dword [r9 - 4]
cmp r13d, 0x3af27da0
shr r11d, cl
cmp al, r10b
clc
test r11d, r11d
jmp 0x1404bdce4
je 0x1404bddc8
mov rax, qword [r10 + 0x10]
mov r10d, dword [rax]
movzx ecx, byte [r9]
btc rax, 0x8e
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
cmp ebx, ebx
sub r9, rax
cmp r8b, r12b
mov eax, dword [r9 - 4]
jmp 0x1404bdd23
shr eax, cl
clc
add esi, eax
shl ah, 0x37
xor al, r8b
movzx ax, r11b
mov eax, esi
lea rax, [rax + r10]
add rax, rdi
test rsi, 0x4b9e7c23
cmp dx, si
jmp 0x1404bdd4b
cmp rbx, rax
jb 0x1404bdda8
movzx ecx, byte [r9]
lahf
movzx edx, bp
dec ax
inc r8d
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
bt edx, 0xff
btc edx, 0xbb
sub r9, rax
test r12b, bpl
movzx edx, dx
not dl
mov edx, dword [r9 - 4]
test rdx, r14
shr edx, cl
dec edx
jmp 0x1404bdd9a
cmp r8d, r11d
jmp 0x1404bdda2
jb 0x1404bdcf1
test r8d, r8d
cmova ax, cx
cwde
seto ah
cmove edx, ebp
bswap rax
mov rax, r8
mov eax, edx
jmp 0x1404bddc3
jmp 0x1404bddce
mov eax, ebp
movzx rbp, r9w
mov rbx, qword [rsp + 0x10]
movsx si, bpl
mov rbp, qword [rsp + 0x18]
movsx r14, r8w
mov rsi, qword [rsp + 0x20]
mov r14d, r8d
mov rdi, qword [rsp + 0x28]
pop r14
jmp 0x1404bddf5
ret

Function at 0x1404c4a25
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
shr r8b, 0xc2
sub rsp, 0x20
mov rbx, rcx
cdq
movzx edx, r8w
cwd
lea r9, [0x1400c63c0]
movsxd r8, r11d
jmp 0x1404c4a48
mov ecx, 3
lea r8, [0x1400c63b8]
jmp 0x1404c4a60
lea rdx, [0x1400cfb70]
jmp 0x1404c4a6c
call fcn.1404c59c8
test rax, rax
jmp 0x1404c4a79
je 0x1404c4aa8
mov rcx, rbx
xor bx, 0x649f
cmp bpl, 0x21
add rsp, 0x20
bswap rbx
jmp 0x1404c4a9b
pop rbx
jmp 0x1404c4aa1
jmp qword [case.0x1404c5688.0]
add rsp, 0x20
pop rbx
jmp 0x1404c4ab2
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1404c4b4e
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sal bx, cl
shr r8b, 0x62
shrd r8d, r14d, 0x20
sub rsp, 0x20
xchg bl, r8b
cwd
not bl
mov ebx, ecx
lea r9, [0x1400c63d0]
mov cx, 0x643c
bswap dx
movzx cx, sil
mov ecx, 5
mov dl, r12b
movsx r8d, si
jmp 0x1404c4b8d
lea r8, [0x1400c63c8]
lea rdx, [0x1400cf758]
call fcn.1404c59c8
mov ecx, ebx
test rax, rax
je 0x1404c4bb7
add rsp, 0x20
pop rbx
push qword [0x1400b8d90]
ret
add rsp, 0x20
pop rbx
jmp 0x1404c4bc1
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c4bc8
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov bl, 0xa6
push rdi
movsxd r8, ebx
sbb r9d, ebx
rol bh, cl
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c63d8]
xchg dx, r8w
movsxd r8, r11d
mov edi, ecx
lea rdx, [0x1400cf748]
bswap r8d
mov ecx, 6
lea r8, [0x1400c63d0]
call fcn.1404c59c8
mov rdx, rbx
sar rcx, cl
mov ecx, edi
test rax, rax
je 0x1404c4c26
call qword [case.0x1404c5688.0]
jmp 0x1404c4c2c
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
bswap di
pop rdi
jmp 0x1404c4c3e
ret

Function at 0x1404c4d92
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
not bh
bswap bx
mov qword [rsp + 0x10], rbp
not ebp
xadd bpl, bpl
xor bl, r15b
mov qword [rsp + 0x18], rsi
push rdi
shl rdi, 0xd8
sal edi, cl
movsx rdi, bp
sub rsp, 0x30
xchg sil, dil
movzx ebx, bx
setg bl
mov ebx, r9d
mov rbp, 0x72df38e6
mov rdi, r8
xchg ebp, r8d
jmp 0x1404c4ddc
mov esi, edx
lea r9, [0x1400c63e8]
cmovl r8w, r12w
cqo
mov rbp, rcx
lea r8, [0x1400c63e0]
movsx edx, si
bswap ecx
movzx edx, di
lea rdx, [0x1400cf190]
movsx cx, bpl
movsxd rcx, r10d
mov ecx, 0xb
jmp 0x1404c4e17
call fcn.1404c59c8
mov rcx, rbp
cmp ebp, r14d
test rax, rax
jmp 0x1404c4e2a
je 0x1404c4e50
mov r9d, ebx
mov r8, rdi
mov edx, 0x3e2411b1
cmovbe dx, r12w
movzx edx, bx
mov edx, esi
call qword [case.0x1404c5688.0]
jmp 0x1404c4e79
sub edx, edx
jmp 0x1404c4e57
call fcn.1404c54a0
mov ecx, eax
mov dh, 0x33
cwd
mov r9d, r13d
mov r9d, ebx
jmp 0x1404c4e6e
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rsi, r8
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
cmove di, si
mov di, r12w
pop rdi
jmp 0x1404c4e9d
ret
Function at 0x1404c89d2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
bsf rcx, rcx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xor rcx, rcx
rol cl, 9
movsx rcx, r8w
mov qword [rax + 0x18], rsi
xor cl, r14b
test r13b, r8b
mov qword [rax + 0x20], rdi
sbb ch, 0x7c
xor ecx, 0x2a73341c
shr rcx, cl
push r14
xadd cl, cl
xchg ecx, ecx
mov ch, 0xe2
sub rsp, 0x90
movzx cx, r11b
lea rcx, [rax - 0x78]
jmp 0x1404c8a24
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor r14d, r14d
cmp word [rsp + 0x62], r14w
jmp 0x1404c8a38
je 0x1404c8b81
mov rax, qword [rsp + 0x68]
cmp r9w, r9w
test rax, rax
je 0x1404c8b81
movsxd rbx, dword [rax]
btc ecx, ebx
adc cl, r15b
lea rsi, [rax + 4]
mov di, sp
sal di, 0x9b
mov edi, 0x2000
xadd ch, ch
add rbx, rsi
cmp dword [rax], edi
movzx ecx, r15w
movsx cx, r9b
cmovl edi, dword [rax]
mov ecx, edi
call fcn.1400ada04
cmp edi, dword [0x1400bad40]
cmovg edi, dword [0x1400bad40]
cmc
test edi, edi
jmp 0x1404c8a99
je 0x1404c8b81
mov ebp, r14d
cmp qword [rbx], 0xffffffffffffffff
jmp 0x1404c8aab
je 0x1404c8b5d
cmp qword [rbx], 0xfffffffffffffffe
jmp 0x1404c8aba
je 0x1404c8b5d
test byte [rsi], 1
jmp 0x1404c8ac8
je 0x1404c8b5d
test byte [rsi], 8
jmp 0x1404c8ad6
jne 0x1404c8af7
mov rcx, qword [rbx]
jmp 0x1404c8ae4
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jmp 0x1404c8af1
je 0x1404c8b5d
mov rax, rbp
lea r8, [0x1400ba940]
sbb cl, bpl
rcr cl, 0x5a
mov rcx, rbp
cmovp dx, r15w
mov rdx, 0x54773cc4
setbe dl
sar rcx, 6
and eax, 0x3f
jmp 0x1404c8b25
mov rcx, qword [r8 + rcx*8]
jmp 0x1404c8b30
lea rdx, [rax + rax*8]
movsx rax, r13w
cbw
movzx ax, dl
mov rax, qword [rbx]
jmp 0x1404c8b46
mov qword [rcx + rdx*8 + 0x28], rax
mov al, 9
mov al, byte [rsi]
jmp 0x1404c8b54
mov byte [rcx + rdx*8 + 0x38], al
jmp 0x1404c8b5d
inc rbp
jmp 0x1404c8b65
inc rsi
cmp r13w, 0x272e
add rbx, 8
sub rdi, 1
jmp 0x1404c8b7b
jne 0x1404c8aa2
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
bswap di
movzx rbp, si
mov rbp, qword [r11 + 0x18]
setae sil
mov rsi, qword [r11 + 0x20]
cmovle rdi, rbx
movsx r14w, r11b
mov rdi, qword [r11 + 0x28]
bswap r14w
mov rsp, r11
pop r14
jmp 0x1404c8bbb
ret
Function at 0x1404d11f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bt rbx, rbx
sal rbx, 0x9e
add bx, bp
push rdi
shld bx, si, 0xf4
sub rsp, 0x20
movsx rbx, si
movzx rbx, sp
mov rbx, rcx
jmp 0x1404d121d
call fcn.1404c389d
or r8, 0xffffffffffffffff
mov r10, rax
bsr dx, dx
bts rdx, rcx
xor edi, edi
mov rdx, qword [rax + 0x98]
jmp 0x1404d123f
inc r8
cmc
cmp sil, bl
cmp word [rdx + r8*2], di
jmp 0x1404d1250
jne 0x1404d123f
mov eax, edi
bswap rcx
shl cl, 0x16
cmp r8, 3
mov ecx, 2
sete al
jmp 0x1404d126f
mov dword [r10 + 0xb0], eax
jmp 0x1404d127b
je 0x1404d12e2
mov r9d, edi
bts r8, rdx
neg r8b
movzx r8d, word [rdx]
rcr ax, 0x9f
lea rdx, [rdx + rcx]
xor rax, rcx
sub al, r15b
bswap eax
lea eax, [r8 - 0x41]
cmp r8w, 0x28b1
test r12w, 0x560c
cmp cx, r14w
cmp ax, 0x19
jbe 0x1404d12d2
sub r8w, 0x61
cmp r8w, 0x19
jmp 0x1404d12cc
ja 0x1404d12df
inc r9d
jmp 0x1404d12da
jmp 0x1404d128b
mov ecx, r9d
mov dword [r10 + 0xac], ecx
movzx ecx, r10w
movsx cx, ch
movzx dx, dl
mov edx, 1
movsx rcx, r14w
movzx cx, r10b
lea rcx, [0x1400ac0b8]
jmp 0x1404d130f
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
test byte [rbx], 4
jmp 0x1404d131d
jne 0x1404d132d
mov dword [rbx], edi
clc
sar bx, cl
bts bx, bp
mov rbx, qword [rsp + 0x30]
cmp dl, 0x79
clc
add rsp, 0x20
pop rdi
jmp 0x1404d1340
ret

Function at 0x1404d173a
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
movzx ebx, bp
sub bl, r13b
adc bl, 0x38
mov qword [rsp + 0x18], rsi
bswap bx
adc bl, r13b
push rdi
movsx rbx, bp
sub rsp, 0x20
shr ebx, cl
xor esi, esi
not dil
mov rdi, rdx
not bh
xchg ebx, ebx
mov rbx, rcx
test rcx, rcx
jmp 0x1404d1775
je 0x1404d181e
cmp word [rcx], si
jmp 0x1404d1783
je 0x1404d181e
lea rdx, [0x1400d1d08]
jmp 0x1404d1795
call fcn.140229384
test eax, eax
jmp 0x1404d17a1
je 0x1404d181e
lea rdx, [0x1400d1d00]
mov cx, 0x5f0d
movsx ecx, sp
mov rcx, rbx
jmp 0x1404d17bd
call fcn.140229384
test eax, eax
jmp 0x1404d17c9
jne 0x1404d180c
mov ecx, dword [rdi + 8]
movsx r9w, bl
bswap r9w
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
not dh
mov edx, 0x2000000b
jmp 0x1404d17f0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d17fd
je 0x1404d1864
mov eax, dword [rsp + 0x30]
jmp 0x1404d1883
mov rcx, rbx
jmp 0x1404d1814
call fcn.1404daa64
jmp 0x1404d1883
mov ecx, dword [rdi + 8]
cmovg r9w, di
xchg r8w, r9w
cwd
lea r8, [rsp + 0x30]
movzx r9, dx
cdq
mov r9d, 2
setnp dl
movsx rdx, r13w
movzx rdx, r13w
mov edx, 0x20001004
jmp 0x1404d1851
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d185e
jne 0x1404d1870
xor eax, eax
jmp 0x1404d186b
jmp 0x1404d1883
mov eax, dword [rsp + 0x30]
stc
test eax, eax
jne 0x1404d1883
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
movsx rdi, r15w
test r8d, ebx
add dil, 0x92
add rsp, 0x20
pop rdi
ret
Function at 0x1404d189e
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
cmp r8b, 0xd9
rcl bl, 0xf4
sal rbx, cl
mov qword [rsp + 0x18], rsi
neg si
ror bh, cl
push rdi
ror sil, 0xb7
sub rsp, 0x20
movzx rbx, sp
movzx esi, dx
movzx bx, r10b
mov esi, edx
sets bl
mov ebx, ecx
jmp 0x1404d18d8
call fcn.1404c389d
mov ecx, ebx
cqo
btc r9w, 0xc8
adc r9, 0x6fd845b2
lea r8, [rsp + 0x30]
and ecx, 0x3ff
bt r9d, r13d
mov r9d, 2
bts ecx, 0xa
cqo
xchg dil, dil
cdq
mov edx, 0x20000001
jmp 0x1404d1920
mov rdi, rax
jmp 0x1404d1928
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test esp, ebp
test eax, eax
jmp 0x1404d193a
je 0x1404d19f5
cmp ebx, dword [rsp + 0x30]
je 0x1404d19e6
test esi, esi
jmp 0x1404d1951
je 0x1404d19e6
mov r9, qword [rdi + 0x98]
shr rax, 0xba
rcl dh, 0x73
mov r8d, r10d
shl ch, 0x5d
cbw
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp r10b, 1
clc
cmp ax, 0x19
jmp 0x1404d1986
jbe 0x1404d199f
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404d1999
ja 0x1404d19b9
movzx edx, word [rcx]
jmp 0x1404d19a7
inc r8d
stc
add rcx, 2
jmp 0x1404d19b4
jmp 0x1404d1975
or rcx, 0xffffffffffffffff
jmp 0x1404d19c2
inc rcx
test bl, 0x31
cmp word [r9 + rcx*2], r10w
jmp 0x1404d19d2
jne 0x1404d19c2
cmp r8d, ecx
jmp 0x1404d19e0
je 0x1404d19f5
mov eax, 1
jmp 0x1404d19f0
jmp 0x1404d19fa
xor eax, eax
add dil, dl
mov rbx, qword [rsp + 0x38]
sal sil, 0xcd
mov rsi, qword [rsp + 0x40]
movsx rdi, r11w
stc
add rsp, 0x20
pop rdi
jmp 0x1404d1a17
ret