joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14049d34e
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
shr bl, 0x55
sal bl, cl
mov rbx, rcx
clc
cmp r10w, 0x4dd
sub ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x14049d373
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
adc ebx, 0x32bf2d16
cmp r13w, 0x63b8
mov edx, 0xc0000409
and bh, 0xc2
movsxd rbx, r13d
add rsp, 0x20
cmovge bx, cx
movzx rbx, r11w
pop rbx
jmp 0x14049d3ab
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14049dddf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
cmp sil, sil
mov qword [rsp + 0x18], rbp
cmc
jmp 0x14049ddf5
push rsi
push rdi
test bx, 0x58cf
push r12
xor r12w, cx
adc r12b, cl
neg r12b
push r14
push r15
sub rsp, 0x20
jmp 0x14049de1d
mov esi, dword [r8 + 0xc]
seta r14b
mov r12, rcx
xchg r14b, r14b
mov r15w, 0x70fb
seto cl
mov rcx, r8
movzx di, r9b
setbe dil
mov rdi, r9
cmovle r14, r13
movsxd r14, ebp
mov r14, r8
movzx r15w, cl
mov r15, rdx
jmp 0x14049de59
call fcn.140261878
mov r10, qword [r12]
cmp r14b, 0x3d
rcl bp, cl
mov ebp, eax
cmp r10b, cl
mov qword [rdi], r10
test esi, esi
jmp 0x14049de78
je 0x14049dfac
movsxd rax, dword [r14 + 0x10]
sbb ecx, 0x528716e6
sar ecx, cl
rol bl, 0x38
lea ecx, [rsi - 1]
rcl bx, cl
inc esi
sar si, 0x6a
mov esi, ecx
add bx, 0x1df
lea rcx, [rcx + rcx*4]
lea rbx, [rax + rcx*4]
test r11w, r10w
add rbx, qword [r15 + 8]
test di, 0x5762
cmp ebp, dword [rbx + 4]
jmp 0x14049debd
jle 0x14049de71
cmp ebp, dword [rbx + 8]
jmp 0x14049decb
jg 0x14049de71
mov rcx, qword [r15]
rcr rdx, 0x71
bsf rdx, rax
bt dx, r8w
lea rdx, [rsp + 0x50]
stc
xor r8d, r8d
jmp 0x14049deef
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
and r10, 0x7c804808
xor ecx, ecx
jmp 0x14049df07
add r8, qword [rsp + 0x50]
btr r10w, 1
mov r9d, dword [rbx + 0xc]
jmp 0x14049df21
mov r10d, dword [rax]
test dl, r10b
cmp ebx, 0x6cfc3b51
test r9d, r9d
jmp 0x14049df35
je 0x14049df72
lea rdx, [r8 + 0xc]
btc eax, r12d
rcl ax, 0x53
bts rax, r15
movsxd rax, dword [rdx]
cmc
cmp rax, r10
je 0x14049df72
inc ecx
stc
add rdx, 0x14
cmp r12, rdi
test rcx, 0x35a629ec
cmp ecx, r9d
jb 0x14049df4b
cmp ecx, r9d
jmp 0x14049df7a
jae 0x14049de71
mov rax, qword [r12]
bsf r15, r12
adc si, 0x723c
sub ebp, r10d
lea rcx, [rcx + rcx*4]
inc r15b
movsxd rcx, dword [r8 + rcx*4 + 0x10]
mov rcx, qword [rcx + rax]
mov qword [rdi], rcx
bt r14, 0x8c
rcl r12w, cl
mov rbx, qword [rsp + 0x58]
xadd rbp, r14
bsr si, r8w
adc sil, 0x7f
mov rax, rdi
sub rbp, 0x3d997812
btr r14w, 0xf3
shrd r12d, r15d, 0xd
mov rbp, qword [rsp + 0x60]
cmp r10w, 0x7a5d
add rsp, 0x20
movsx r12, cx
pop r15
pop r14
mov esi, 0x5635765f
movsxd rsi, r15d
movsx di, dil
pop r12
movzx si, r12b
cmovl di, r13w
mov sil, 0xd6
pop rdi
movzx esi, r12w
not sil
mov sil, bpl
pop rsi
jmp 0x14049e017
ret
Function at 0x14049e222
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xadd bl, bpl
sar bp, 0xb4
push rdi
movsx bx, al
rol rbp, cl
push r12
sbb bl, dil
add rbx, 0x47047b38
btc ebp, 0x70
push r13
adc r12b, spl
stc
push r14
rcr r14b, 0xd4
bsr bx, r15w
or bh, 0x6e
push r15
btc rdi, 0x5a
sub rsp, 0x40
cmovg r15w, cx
bswap r14
movzx bp, spl
mov rbx, qword [rsp + 0x90]
movzx ebp, r9w
mov r12, rdx
bswap rdx
mov rbp, rcx
xchg dx, r15w
mov rdx, r9
jmp 0x14049e2a6
mov rcx, rbx
mov rdi, r9
jmp 0x14049e2b1
mov r15d, r8d
movsx r14d, r13w
mov r14d, r11d
mov r14d, dword [rbx + 0xc]
jmp 0x14049e2c4
call fcn.140261878
xor r10d, r10d
add sil, bl
movsxd rsi, esp
cmc
mov esi, eax
test r14d, r14d
jmp 0x14049e2dd
je 0x14049e51c
mov r11, qword [rdi + 8]
cmovns rdx, r11
xor r8b, 0x43
or eax, 0xffffffff
movsxd rbx, dword [rbx + 0x10]
cmp r15w, 0x7d97
mov r9d, eax
shr rdx, cl
not rdx
mov r13d, eax
mov edx, r14d
cmp dl, r13b
clc
bt cx, 0xe6
lea r8d, [rdx - 1]
lea rcx, [r8 + r8*4]
and al, r8b
neg ah
lea rax, [r11 + rcx*4]
cmp esi, dword [rax + rbx + 4]
jmp 0x14049e32e
jle 0x14049e343
cmp esi, dword [rax + rbx + 8]
jmp 0x14049e33d
jle 0x14049e355
mov edx, r8d
cmc
test r8d, r8d
jmp 0x14049e34f
jne 0x14049e314
mov r8d, r10d
stc
cmp bl, 0xf4
test edx, edx
jmp 0x14049e363
je 0x14049e381
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdx, [rbx + rax*4]
add rdx, r11
jmp 0x14049e37c
jmp 0x14049e38a
mov rdx, r10
movsx ecx, r14w
rol cl, cl
lea rcx, [r11 + rbx]
test rdi, rdi
cmp bpl, r9b
cmp sil, 0x67
or r11d, 0xffffffff
clc
test rdx, rdx
jmp 0x14049e3a5
je 0x14049e3d5
mov eax, dword [rdx + 4]
cmc
cmp dword [rcx], eax
jmp 0x14049e3b6
jle 0x14049e429
mov eax, dword [rdx + 8]
stc
test r10w, sp
cmp rdi, rbp
cmp dword [rcx + 4], eax
jmp 0x14049e3cf
jg 0x14049e429
cmp r15d, dword [rcx]
jmp 0x14049e3dd
jl 0x14049e429
cmp r15d, dword [rcx + 4]
jg 0x14049e429
cmp r9d, r11d
movzx r13, r8w
mov eax, 0x690125cc
mov eax, r8d
movsx r13d, r12w
movzx r13, di
movsx r13, ax
mov r13d, r8d
jmp 0x14049e410
cmovne eax, r9d
cmovns r9w, r15w
not r9
movzx r9w, spl
mov r9d, eax
jmp 0x14049e429
inc r8d
test spl, 0x34
stc
add rcx, 0x14
clc
cmp r8d, r14d
jmp 0x14049e43e
jb 0x14049e39d
cmp r9d, r11d
mov qword [rsp + 0x20], r12
movsx r14w, r12b
mov eax, r10d
movsx r11w, r15b
movzx rdi, r9w
mov qword [rsp + 0x30], r12
xchg r15b, r15b
cmovne eax, r9d
not rdi
movsx ebx, bx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
not dil
cmovl r12w, bx
mov rsi, qword [r11 + 0x40]
mov dword [rsp + 0x28], eax
jmp 0x14049e48f
lea eax, [r13 + 1]
movzx r13w, r10b
cmovns r15d, esp
movsx di, r15b
movups xmm0, xmmword [rsp + 0x20]
jmp 0x14049e4b3
cmovne r10d, eax
movsx edi, bx
bswap r15d
not rdi
mov rax, rbp
mov dword [rsp + 0x38], r10d
xchg r15b, r13b
movups xmm1, xmmword [rsp + 0x30]
mov r15b, r15b
movdqu xmmword [rbp], xmm0
mov edi, 0x3c0113df
movzx edi, di
movzx rdi, r11w
movdqu xmmword [rbp + 0x10], xmm1
mov r15w, 0x3a73
jmp 0x14049e4f7
mov rbp, qword [r11 + 0x38]
movzx r13w, r14b
mov rsp, r11
pop r15
pop r14
setp r12b
pop r13
pop r12
movzx edi, r11w
movsx rdi, r9w
mov dil, 0x64
pop rdi
ret
call fcn.1404b36b7
int3
Function at 0x1404a307d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
mov r10w, 0x3b44
or r10w, 0x6920
mov qword [rax + 8], rbx
bts rbx, rsp
shld r10d, edi, 0x75
adc rbx, rbx
mov qword [rax + 0x10], rbp
shld bx, r10w, 0x98
mov qword [rax + 0x18], rsi
ror r10w, cl
sal r10b, 0xc9
mov qword [rax + 0x20], rdi
movzx si, r12b
shr bh, 0x98
push r14
bswap esi
bt r10, r11
push r15
movzx esi, word [rsp + 0x38]
movsx r10w, r10b
mov r10, r8
add ebx, edx
xor r15d, r15d
rcr bx, cl
movsxd r8, edx
bsr bx, bx
bts bx, r13w
bswap rbx
mov ebx, ecx
jmp 0x1404a30fb
mov ecx, r8d
clc
test si, si
jmp 0x1404a3107
jne 0x1404a3279
mov rax, qword [r9]
mov r11, qword [r10]
clc
cmp rax, 1
jmp 0x1404a311d
jbe 0x1404a3216
mov eax, 0x66666667
dec dx
test dl, dh
rol ch, 0x89
mov r8, r11
bts rdx, r13
imul ebx
xor ah, 0x27
ror ax, 0xa0
sar edx, 2
cbw
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
test dx, 0x43ba
bt rcx, 0xb7
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub bx, cx
jmp 0x1404a3171
add bx, 0x30
xchg al, ah
mov word [r11], bx
xchg ebx, eax
add r11, 2
mov rax, qword [r9]
mov ebx, edx
jmp 0x1404a318a
dec rax
cmp r9, r9
clc
mov qword [r9], rax
cmp r9b, 0x15
test edx, edx
jmp 0x1404a319f
jle 0x1404a31b4
cmp rax, 1
jmp 0x1404a31ae
ja 0x1404a3123
mov rdx, qword [r10]
jmp 0x1404a31bc
mov qword [r10], r11
jmp 0x1404a31c4
jmp 0x1404a3203
movzx eax, word [rdx]
and rcx, 0x10c90b94
or cx, 0x15e7
movzx cx, r10b
movzx ecx, word [r8]
mov word [r8], ax
jmp 0x1404a31ea
sub r8, 2
test r9d, 0x311450d7
mov word [rdx], cx
test al, r9b
add rdx, 2
test r12b, 0xfe
cmp rdx, r8
jmp 0x1404a320b
jb 0x1404a31c9
jmp 0x1404a3245
lea rax, [rax + rax]
and bl, bpl
and sil, 0x1e
bt r14d, r15d
sub r11, rax
movzx r14w, bl
movsx bx, r12b
mov qword [r10], r11
jmp 0x1404a323f
mov qword [r9], r15
setae bh
mov rbx, qword [rsp + 0x18]
movsx r14w, bl
not r15b
bswap di
mov rbp, qword [rsp + 0x20]
jmp 0x1404a3266
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
movsx r14d, cx
pop r15
pop r14
ret
cmp r8, qword [r9]
jmp 0x1404a3281
jae 0x1404a323f
dec r8d
mov r11d, r15d
test ecx, ecx
je 0x1404a3376
movsxd rax, r8d
movsx rbp, r11w
shl di, cl
neg r14b
lea rdi, [rax + rax]
bt r14, 0x66
test sp, 0x5a3a
mov r14, qword [r10]
mov dx, bx
add bpl, 0x93
shr ebp, cl
mov eax, 0x66666667
cqo
mov rdx, 0x922e01
sub dl, 0x4d
imul ebx
shl bpl, 0x1c
bts bp, r10w
mov ebp, r8d
sal eax, cl
sar al, cl
sub al, 0x1d
sar edx, 2
movzx ax, ch
sar ax, cl
btr rax, 0x2d
mov eax, edx
shr eax, 0x1f
test bl, 0x24
jmp 0x1404a32fe
add edx, eax
cmp dl, 0xa8
test ebx, ebx
jmp 0x1404a330a
je 0x1404a3342
movzx eax, dx
or cx, cx
movzx rcx, r13w
btr rcx, r9
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
shl ah, cl
mov ax, bx
bts eax, ecx
sub bx, cx
cdqe
lea eax, [rbx + 0x30]
jmp 0x1404a333d
jmp 0x1404a3348
movzx eax, si
not bx
mov word [rdi + r14], ax
mov bl, 0x82
jmp 0x1404a3357
inc r11d
not bx
and bl, r9b
sub bh, bh
sub rdi, 2
dec bh
dec r8d
mov ebx, edx
clc
test ebp, ebp
jne 0x1404a32b0
movsxd rcx, r11d
cmc
movzx rax, r13w
movzx eax, r9w
lea rax, [rcx + rcx]
cmc
test r14w, r9w
add qword [r10], rax
cmc
cmp dl, 0xc2
sub qword [r9], rcx
jmp 0x1404a339a
jmp 0x1404a3245
Function at 0x1404acd95
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmc
mov qword [rsp + 0x10], rsi
btr si, bp
push rdi
shl sil, cl
and si, dx
movsx rsi, r10w
sub rsp, 0x30
rol si, cl
btc edi, r11d
seta dil
mov edi, edx
cmp ah, 0x2b
mov rsi, rcx
jmp 0x1404acdce
test r8, r8
jmp 0x1404acdd6
jne 0x1404acdfd
call fcn.1404b1712
mov dword [rax], 0x16
jmp 0x1404acdec
call fcn.1404b2420
sub eax, eax
jmp 0x1404acdf8
jmp 0x1404aceda
mov rdx, r9
movsx cx, spl
jmp 0x1404ace0a
mov rcx, r8
call fcn.1404acf49
mov rbx, rax
test rax, rax
jmp 0x1404ace1d
je 0x1404ace7e
lea rax, [rsp + 0x50]
mov rdx, rdi
not r9w
mov qword [rsp + 0x28], rax
lea r8, [0x140094b24]
movsxd rax, r12d
mov eax, dword [rsp + 0x60]
mov r9, rbx
xchg cx, cx
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404ace54
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
stc
test rax, rax
jmp 0x1404ace66
jne 0x1404acf0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404ace79
call fcn.1404b177f
xor edi, edi
test sp, r9w
test dil, 0x28
test rbx, rbx
jmp 0x1404ace90
je 0x1404aced7
mov rcx, qword [rbx + 0x10]
test r11b, 0x5e
test rcx, rcx
jmp 0x1404acea6
je 0x1404aceb2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404acebe
je 0x1404aceca
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404aced2
call fcn.1404c5689
mov rax, rdi
mov rbx, qword [rsp + 0x40]
or si, 0x5027
mov rsi, qword [rsp + 0x48]
cmp r8, 0x7a550145
bsr rdi, rcx
add rsp, 0x30
mov di, r15w
cmovo edi, r9d
movsxd rdi, esp
pop rdi
jmp 0x1404acf09
ret
mov rcx, qword [rsp + 0x68]
cmp r11w, 0x5807
stc
test rcx, rcx
je 0x1404acf29
mov eax, dword [rsp + 0x50]
clc
mov dword [rcx], eax
test r8b, dil
xor ebx, ebx
jmp 0x1404acf30
jmp 0x1404ace88

Function at 0x1404ad230
Capabilities:
Terminate process

Disassembly:
push rbx
neg bh
movsx rbx, si
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404ad243
call fcn.1404cecc4
cmp eax, 1
je 0x1404ad298
mov rax, qword gs:[0x60]
jmp 0x1404ad25f
mov edx, dword [rax + 0xbc]
shr edx, 8
test si, r12w
test dl, 0x4e
clc
test dl, 1
jne 0x1404ad298
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xchg dl, dl
movzx rdx, r14w
bswap rdx
mov edx, ebx
jmp 0x1404ad292
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404ad29f
call fcn.1404ad177
mov ecx, ebx
jmp 0x1404ad2ab
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b24c0
Capabilities:
Terminate process

Disassembly:
jmp 0x177be9b09
invalid
fsubr qword [rdx + rsi*8 + 0x5b]
pop r10
sub al, 0xe5
cwde
in eax, 0xed
in eax, dx
in eax, dx
out 0x37, al
fmul st(5), st(0)
mov ch, 0xb3
invalid
jrcxz 0x14017771e
movsb byte [rdi], byte [rsi]
jl 0x140177781
add edx, dword [rcx - 0x735b2cb2]
xor al, 0xb4
mov ah, 0x4d
outsb dx, byte [rsi]
mov ah, 0x4d
outsb dx, byte [rsi]
and ecx, dword [rax + 0x37]
invalid
add byte [rax], al
add byte [rax], al
retf 0x169b
add byte [rdx + 0x36], al
pop rbp
jae 0x14017778f
xor al, 0xbd
pop rcx
xchg ebp, eax
invalid
out dx, al
int1
mov esi, 0xc612d0fb
adc al, dh
idiv byte [rbx + 0x50]
pop rbp
mov cl, 0xf6
fnstenv [rsi + 0x28]
mov bh, 0x7a
stosb byte [rdi], al
invalid
sbb esi, ecx
cmp rax, 0xffffffffb5655e57
invalid
mov cl, 0xa8
retf 0x3d5c
sub rsp, 0x28
not cl
movsx rcx, dx
mov ecx, 0x17
jmp 0x1404b24d4
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404b24f3
mov ecx, 5
jmp 0x1404b24ec
int 0x29
jmp 0x1404b24f3
mov r8d, 1
cmovb cx, r9w
mov edx, 0xc0000417
movsxd rcx, esi
movzx ecx, cx
lea ecx, [r8 + 1]
jmp 0x1404b2512
call fcn.1404b2539
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
stc
mov edx, 0xc0000417
cmp bh, 0x56
add rsp, 0x28
jmp switch.0x1404b2532
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404beb1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
not r11b
sal r11b, 0xbf
push rdi
sub rsp, 0x20
bt bx, bx
sub r10d, r10d
jmp 0x1404beb3c
mov rbx, r8
mov r11, rdx
test ecx, r14d
cmc
test r10b, 0xdd
test r9, r9
jmp 0x1404beb52
jne 0x1404bebae
test rcx, rcx
jne 0x1404bebbc
test rdx, rdx
jmp 0x1404beb69
je 0x1404beb8e
call fcn.1404b1712
mov ebx, 0x16
jmp 0x1404beb7e
mov dword [rax], ebx
call fcn.1404b2420
mov r10d, ebx
xchg bl, dil
xor di, bx
mov rbx, qword [rsp + 0x30]
mov eax, r10d
btc di, r11w
add rsp, 0x20
movsxd rdi, r11d
movzx di, r15b
pop rdi
jmp 0x1404bebad
ret
test rcx, rcx
jmp 0x1404bebb6
je 0x1404beb6f
test r11, r11
jmp 0x1404bebc4
je 0x1404beb6f
test r9, r9
jmp 0x1404bebd2
jne 0x1404bebe1
mov word [rcx], r10w
jmp 0x1404beb8e
test rbx, rbx
jmp 0x1404bebe9
jne 0x1404bebfd
mov word [rcx], r10w
jmp 0x1404bebf8
jmp 0x1404beb6f
sub rbx, rcx
bswap dx
bt di, 0x1d
sal edx, 0x3d
mov rdx, rcx
sub di, r13w
mov r8, r11
movzx rdi, bx
and di, bp
sbb di, sp
mov rdi, r9
cmp r9, 0xffffffffffffffff
jne 0x1404bec63
movzx eax, word [rbx + rdx]
test r13b, 0x19
mov word [rdx], ax
jmp 0x1404bec3c
lea rdx, [rdx + 2]
cmc
test ax, ax
jmp 0x1404bec49
je 0x1404becb6
sub r8, 1
jmp 0x1404bec58
jne 0x1404bec2c
jmp 0x1404becb6
movzx eax, word [rbx + rdx]
test r12d, 0x64937444
clc
mov word [rdx], ax
stc
lea rdx, [rdx + 2]
stc
test ax, ax
jmp 0x1404bec80
je 0x1404beca4
sub r8, 1
jmp 0x1404bec8f
je 0x1404beca4
sub rdi, 1
jmp 0x1404bec9e
jne 0x1404bec63
test rdi, rdi
jne 0x1404becb6
mov word [rdx], r10w
cmc
cmp r13b, 0xa0
test r8, r8
jne 0x1404beb8e
cmp r9, 0xffffffffffffffff
jne 0x1404becdd
mov word [rcx + r11*2 - 2], r10w
lea r10d, [r8 + 0x50]
jmp 0x1404becd8
jmp 0x1404beb8e
mov word [rcx], r10w
jmp 0x1404bece6
call fcn.1404b1712
mov ebx, 0x22
jmp 0x1404beb7e
Function at 0x1404c0091
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
sal rbx, 0x85
rcl sil, cl
neg r10b
push rdi
bt r10w, r15w
or bh, 0x30
sub rsp, 0x30
ror dil, 0xf6
rcl bl, cl
mov rdi, qword [rsp + 0x60]
movzx ebx, r15w
not r10d
and sil, 0x13
mov ebx, edx
stc
sal dx, 0x87
mov rsi, r8
neg r10b
cwd
sub dx, r12w
mov r10, rcx
mov rdx, qword [rdi + 8]
test r13, 0x3c8e45e9
cmp rdx, qword [r8 + 8]
ja 0x1404c01e0
cmp qword [rcx + 8], rdx
jmp 0x1404c00fc
ja 0x1404c01e0
mov rax, qword [r8 + 8]
mov rcx, rdx
cmc
clc
sub rcx, qword [r10 + 8]
sub rax, rdx
cmc
test cx, 0x5f97
cmp rcx, rax
jge 0x1404c0175
movups xmm0, xmmword [r10]
clc
movups xmmword [rsp + 0x20], xmm0
cmp rdx, qword [r10 + 8]
jmp 0x1404c0134
jbe 0x1404c01d4
mov rcx, qword [rsp + 0x20]
jmp 0x1404c0146
lea rdx, [rsp + 0x28]
jmp 0x1404c0150
call fcn.1401d3231
mov rax, qword [rsp + 0x28]
jmp 0x1404c015f
inc ebx
jmp 0x1404c0166
cmp qword [rdi + 8], rax
ja 0x1404c013a
jmp 0x1404c01d4
mov ebx, r9d
stc
test r15b, 0xc9
movups xmm0, xmmword [rdi]
test sp, bx
test r14w, 0x594d
movups xmmword [rsp + 0x20], xmm0
cmp qword [r8 + 8], rdx
jbe 0x1404c01d4
mov rcx, qword [rsp + 0x20]
cmovns edx, r9d
jmp 0x1404c01a6
lea rdx, [rsp + 0x28]
jmp 0x1404c01b0
call fcn.1401d3231
mov rcx, qword [rsp + 0x28]
jmp 0x1404c01bf
dec ebx
cmc
test r8d, eax
cmp qword [rsi + 8], rcx
jmp 0x1404c01ce
ja 0x1404c0198
mov eax, ebx
jmp 0x1404c01db
jmp 0x1404c01e7
or eax, 0xffffffff
rol sil, 0x6e
mov rbx, qword [rsp + 0x40]
adc rsi, rbx
xor si, 0x14e4
and si, r12w
mov rsi, qword [rsp + 0x48]
movzx rdi, bx
sal di, 0x95
mov dil, r12b
add rsp, 0x30
movzx rdi, r11w
movzx edi, bx
setne dil
pop rdi
jmp 0x1404c021d
ret
Function at 0x1404c6cae
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
shr edi, cl
add r8w, 0x5de
test bh, 0x98
sub rsp, 0x20
movzx rdi, cx
mov rbx, rdx
movsx r9d, bx
cdq
mov dil, 0x4b
lea r9, [0x1400c63d8]
cmovo rdx, r13
xchg dil, dl
movsx r8, r14w
mov edi, ecx
mov cl, 0x9b
lea rdx, [0x1400cf748]
not ch
mov ecx, 6
jmp 0x1404c6cff
lea r8, [0x1400c63d0]
jmp 0x1404c6d0b
call fcn.1404c7b0b
mov rdx, rbx
sal ecx, cl
mov ecx, edi
cmp r14w, r12w
clc
test rax, rax
jmp 0x1404c6d24
je 0x1404c6d35
call qword [case.0x140444828.0]
jmp 0x1404c6d3b
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
stc
mov di, 0x77f4
add rsp, 0x20
movsx rdi, r8w
movzx edi, r12w
pop rdi
jmp 0x1404c6d57
ret

Function at 0x1404c6eda
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404c6ef2
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xor bl, bl
clc
adc rbx, r12
push rdi
rol dil, 0xbb
movsx rsi, r15w
shr sil, cl
sub rsp, 0x30
movsxd rbx, ecx
movsx rbx, si
mov ebx, r9d
mov rdi, r8
jmp 0x1404c6f24
mov esi, edx
lea r9, [0x1400c63e8]
mov rbp, rcx
jmp 0x1404c6f35
lea r8, [0x1400c63e0]
jmp 0x1404c6f45
lea rdx, [0x1400cf190]
mov ecx, 0xb
jmp 0x1404c6f56
call fcn.1404c7b0b
mov rcx, rbp
clc
test rax, rax
jmp 0x1404c6f67
je 0x1404c6f90
mov r9d, ebx
cdq
movsx r8w, r11b
bswap dx
mov r8, rdi
bswap edx
mov edx, esi
jmp 0x1404c6f85
call qword [case.0x140444828.0]
jmp 0x1404c6fbb
xor edx, edx
jmp 0x1404c6f97
call fcn.1404c75ff
mov ecx, eax
cqo
mov r9d, ebx
mov r8, rdi
movsx edx, si
cqo
sets dh
mov edx, esi
jmp 0x1404c6fb5
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
bts bp, r8w
add di, ax
setae dil
mov rbp, qword [rsp + 0x48]
not di
add si, 0x4bc
mov rsi, qword [rsp + 0x50]
ror dil, 0x6e
shld edi, r12d, 0x5d
ror dil, cl
add rsp, 0x30
movsx edi, si
sete dil
mov dil, bpl
pop rdi
jmp 0x1404c6ffe
ret
Function at 0x1404c78d4
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
xor r8d, 0x5472924
xchg r8w, dx
lea r9, [0x1400c63a4]
bsr r8w, r15w
sub r8w, r12w
neg r8d
xor ecx, ecx
xchg r8b, dl
jmp 0x1404c7904
lea r8, [0x1400c63a0]
lea rdx, [0x1400cfbf8]
jmp 0x1404c7917
call fcn.1404c7b0b
lea r9, [0x1400c63b0]
mov r8w, r13w
setl r8b
mov ecx, 1
cwd
setg dh
lea r8, [0x1400c63a8]
mov dl, dil
movsx edx, r11w
movzx rdx, r10w
lea rdx, [0x1400cf1d0]
jmp 0x1404c7953
call fcn.1404c7b0b
lea r9, [0x1400c63b8]
mov dh, bh
mov ecx, 2
lea r8, [0x1400c63b0]
movsx edx, si
movsx dx, dh
xchg dh, dh
lea rdx, [0x1400cf178]
jmp 0x1404c7982
call fcn.1404c7b0b
lea r9, [0x1400c63e0]
mov dl, 0x92
mov ecx, 8
mov r8b, r15b
cwd
not rdx
lea r8, [0x1400c63d8]
cmovae rdx, r10
cwd
lea rdx, [0x1400cf158]
call fcn.1404c7b0b
lea r9, [0x1400c63e8]
setle dl
jmp 0x1404c79c6
mov ecx, 0xb
movsxd rdx, r8d
cdq
movsx r8w, cl
lea r8, [0x1400c63e0]
cqo
lea rdx, [0x1400cf190]
call fcn.1404c7b0b
lea r9, [0x1400c63f0]
movsx edx, r11w
cwd
mov ecx, 0xe
lea r8, [0x1400c63e8]
movzx edx, si
movsx dx, r8b
lea rdx, [0x1400cf168]
jmp 0x1404c7a16
call fcn.1404c7b0b
lea r9, [0x1400c63f8]
mov dx, si
not dx
mov ecx, 0xf
cwd
mov rdx, rdx
lea r8, [0x1400c63f0]
cwd
not dx
lea rdx, [0x1400cf800]
call fcn.1404c7b0b
lea r9, [0x1400c6408]
movzx r8, bx
jmp 0x1404c7a5a
mov ecx, 0x13
lea r8, [0x1400c6400]
lea rdx, [0x1400cf838]
jmp 0x1404c7a72
call fcn.1404c7b0b
lea r9, [0x1400c6410]
cqo
mov ecx, 0x14
xchg r8b, r8b
setne dh
cmova rdx, r11
lea r8, [0x1400c6408]
lea rdx, [0x1400cf1c0]
jmp 0x1404c7aa2
call fcn.1404c7b0b
lea r9, [0x1400c6418]
mov r8b, bpl
movzx rcx, r11w
mov ecx, 0x15
mov dh, 0x74
jmp 0x1404c7ac2
lea r8, [0x1400c6410]
lea rdx, [0x1400cf820]
jmp 0x1404c7ad5
call fcn.1404c7b0b
lea r9, [0x1400c6420]
mov ecx, 0x16
add r8w, r10w
lea r8, [0x1400c6418]
lea rdx, [0x1400cfc08]
jmp 0x1404c7afd
add rsp, 0x28
jmp 0x1404c7b06
jmp fcn.1404c7b0b
Function at 0x1404ce9fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
or al, bh
and ax, 0x2ed6
mov qword [r11 + 8], rbx
jmp 0x1404cea0f
mov qword [r11 + 0x10], rbp
rcr eax, cl
shl bpl, 0x6a
mov qword [r11 + 0x18], rdi
cmp dh, 0xad
push r14
sub rsp, 0x50
mov rax, qword [rsp + 0x80]
movsxd rbp, edx
movzx di, r13b
mov rbp, r8
mov rcx, qword [rcx]
movzx di, r15b
not di
movsxd rdi, r9d
lea r8, [r11 - 0x18]
seto dil
not edi
mov rdi, rdx
movsx edx, r15w
mov dh, 0xbe
mov qword [r11 - 0x38], rax
jmp 0x1404cea64
mov edx, dword [rsp + 0x88]
jmp 0x1404cea70
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
call fcn.1404dde7b
mov r14d, dword [rsp + 0x44]
sal r9w, 0xc6
bt dx, r14w
sub r8d, r8d
cmp dword [rsp + 0x40], 0x2d
mov r9d, eax
bswap bx
mov eax, dword [rsp + 0xa0]
movzx cx, r13b
mov rdx, rbp
mov rcx, 0x28f509ac
xchg r8b, bl
bswap bx
sete r8b
rol cl, cl
adc ecx, r9d
movzx rbx, cx
mov dword [rsp + 0x28], eax
sbb bx, r12w
shrd ecx, ecx, 0x2d
sub rdx, r8
mov dword [rsp + 0x20], r9d
inc bx
xchg ch, bl
dec r14d
lea r9, [rsp + 0x40]
xor bx, r8w
rcr bx, cl
cmp dl, spl
cmp rbp, 0xffffffffffffffff
cmova bx, cx
bswap cx
movsx cx, r10b
lea rbx, [r8 + rdi]
not cx
mov cx, di
jmp 0x1404ceb0d
mov r8d, dword [rsp + 0x88]
movsx ecx, r10w
movzx rcx, r12w
cmovo cx, si
cmove rdx, rbp
movzx cx, r12b
mov rcx, rbx
jmp 0x1404ceb32
call fcn.1404ddb56
test eax, eax
je 0x1404ceb4c
mov byte [rdi], 0
jmp 0x1404ceb47
jmp 0x1404cec55
mov eax, dword [rsp + 0x44]
dec eax
cmp eax, 0xfffffffc
jmp 0x1404ceb5a
jl 0x1404cebf2
cmp eax, dword [rsp + 0x88]
jmp 0x1404ceb6c
jge 0x1404cebf2
cmp r14d, eax
jmp 0x1404ceb7a
jge 0x1404ceba0
mov al, byte [rbx]
jmp 0x1404ceb87
inc rbx
jmp 0x1404ceb8f
test al, al
jmp 0x1404ceb96
jne 0x1404ceb80
mov byte [rbx - 2], al
lahf
mov rax, qword [rsp + 0xa8]
mov dl, 0x2f
lea r9, [rsp + 0x40]
movsx rdx, bp
mov r8b, 0x86
mov r8d, dword [rsp + 0x88]
movzx dx, spl
mov rdx, rbp
mov rcx, rdi
jmp 0x1404cebd1
mov qword [rsp + 0x28], rax
mov rcx, rdi
jmp 0x1404cebde
mov byte [rsp + 0x20], 1
jmp 0x1404cebe8
call fcn.1404ce6bd
jmp 0x1404cec55
mov rax, qword [rsp + 0xa8]
cdq
mov r8, r13
mov dh, 0x1d
mov rdx, rbp
mov r8b, 0xe8
xchg cl, r8b
mov r9b, byte [rsp + 0x90]
mov rcx, rdi
setne r8b
mov r8d, dword [rsp + 0x88]
jmp 0x1404cec26
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
mov byte [rsp + 0x30], 1
jmp 0x1404cec3a
mov qword [rsp + 0x28], rax
nop
mov eax, dword [rsp + 0x98]
jmp 0x1404cec4c
mov dword [rsp + 0x20], eax
call fcn.1404cd667
mov rbx, qword [rsp + 0x60]
test r11w, r8w
and r14w, di
cmp bp, ax
mov rbp, qword [rsp + 0x68]
mov di, 0x103c
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
mov r14w, 0x40c
setg r14b
pop r14
jmp 0x1404cec87
ret