joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14045ec84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
mov qword [rax + 0x10], rbx
test rbx, rax
jmp 0x14045ec9b
mov qword [rax + 0x18], rbp
movsx bp, r12b
stc
btr rbp, 0x9f
push rsi
xor bpl, 0xb
cmp cl, r14b
cmovae bp, di
push rdi
bswap rbp
mov bp, 0x62a1
push r12
test r11w, 0x1ffa
sar bp, 0xf1
movzx bp, r9b
push r14
test r11w, 0x2ad5
push r15
dec bp
bt r15, rax
sub rsp, 0x40
not rbp
sub r12d, r12d
adc r15b, r10b
btr r15w, sp
ror rbp, 0xd5
mov r15, r8
adc bp, 0x1084
rol ebp, 0x19
shr bpl, cl
mov qword [rax + 0x20], r12
test r14w, di
or rdi, 0xffffffffffffffff
movzx bp, r12b
mov bp, 0x3b43
movsx ebp, cx
mov rbp, rcx
jmp 0x14045ed24
inc rdi
stc
cmp byte [rdi + rcx], r12b
jmp 0x14045ed31
jne 0x14045ed24
add rdi, 1
movzx bx, r8b
xchg bl, r14b
movsx rbx, si
mov rbx, r12
movsx r14w, al
mov r14w, 0x4911
mov rsi, rdi
mov r14, rcx
jmp 0x14045ed5f
je 0x14045edbf
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], r15
movzx r8, ax
sete r8b
movsx r8w, r12b
mov r8, rsi
lea rcx, [rsp + 0x70]
xchg dx, dx
mov rdx, r14
call fcn.140459391
test eax, eax
jmp 0x14045ed99
jle 0x14045edbf
cdqe
jmp 0x14045eda6
inc rbx
cmp bx, 0x49b7
add r14, rax
sub rsi, rax
jmp 0x14045edb9
jne 0x14045ed65
inc rbx
movsx dx, r15b
sets cl
mov edx, 2
xchg cx, cx
jmp 0x14045edd7
mov rcx, rbx
call fcn.14020e8f7
mov r14, rax
test r13b, r10b
test rax, rax
jmp 0x14045eded
je 0x14045eef1
mov qword [rsp + 0x30], r12
mov si, 0xb81
cmp r12b, r12b
mov rsi, rax
test rbx, rbx
jmp 0x14045ee0a
je 0x14045ee7e
lea r9, [rsp + 0x30]
movzx r8w, bpl
cmove r8w, sp
mov qword [rsp + 0x20], r15
movsx r8d, r14w
movzx rdx, bp
mov r8, rdi
cmovs cx, r14w
mov rdx, rbp
movsx rcx, bx
xchg ch, cl
mov rcx, rbx
mov rcx, rsi
jmp 0x14045ee48
call fcn.140459391
test eax, eax
jmp 0x14045ee54
jle 0x14045ee7e
cdqe
cmc
test r10b, spl
add rsi, 2
cmc
lea rbp, [rbp + rax]
test r15d, r14d
cmp al, 0x1c
sub rbx, 1
jmp 0x14045ee78
jne 0x14045ee10
lea r11, [rsp + 0x40]
bswap ax
movzx di, r13b
mov word [rsi], r12w
movsx ebx, r13w
movsx si, dl
movzx r15, r12w
mov rbx, qword [r11 + 0x38]
movzx r12, bx
bswap edi
mov rax, r14
cmovo r12d, r12d
not bpl
movsx r12w, r11b
mov rbp, qword [r11 + 0x40]
mov sil, r10b
jmp 0x14045eec0
mov rsp, r11
jmp 0x14045eecd
pop r15
movsx rdi, r11w
pop r14
movsx esi, r14w
jmp 0x14045eede
pop r12
pop rdi
movsx si, r10b
cmovnp rsi, rbp
pop rsi
jmp 0x14045eef0
ret
call fcn.140458bab
int3
Function at 0x140472b34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x140472b51
mov qword [rax + 8], rbx
rcr bx, 0x79
movzx ebx, r8w
mov qword [rax + 0x10], rbp
rcr ebx, 0x26
cmp bpl, r9b
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmovb ebx, r9d
push r14
stc
adc bpl, cl
movzx rbx, cx
sub rsp, 0x20
mov rsi, r9
movzx bx, spl
and r14b, r8b
mov rbx, r8
bt rbp, r15
cmc
bts r14w, r12w
mov r14, rdx
mov rbp, rcx
test r9, r9
je 0x140472c6c
mov rdi, qword [rdx + 8]
test rdi, rdi
jmp 0x140472bb4
je 0x140472c53
mov rax, qword [rdi + 0x40]
sar r8d, cl
bt r8w, bx
bsr r8w, r10w
movzx r8d, word [rbx]
cmp qword [rax], 0
jmp 0x140472bd8
je 0x140472c1d
mov rax, qword [rdi + 0x58]
test r9, r11
cmp dword [rax], 0
jmp 0x140472bed
jle 0x140472c1d
dec dword [rax]
not ah
mov rcx, qword [rdi + 0x40]
rdtsc
mov rdx, qword [rcx]
seto ah
lea rax, [rdx + 2]
jmp 0x140472c0c
mov qword [rcx], rax
jmp 0x140472c14
mov word [rdx], r8w
jmp 0x140472c3f
mov rax, qword [rdi]
movzx edx, r8w
mov rcx, rdi
jmp 0x140472c2c
mov rax, qword [rax + 0x18]
jmp 0x140472c35
call qword [case.0x1404cb1ca.0]
movzx r8d, ax
mov eax, 0xffff
cmp ax, r8w
jmp 0x140472c4d
jne 0x140472c5b
mov byte [r14], 1
cmp r11w, r15w
add rbx, 2
cmp r8b, bpl
sub rsi, 1
jne 0x140472bac
movups xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x30]
mov rax, rbp
and rsi, 0x1eec2a0b
xchg sil, sil
or sil, 0xfc
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor r14w, 0x668b
movdqu xmmword [rbp], xmm0
cmc
mov rbp, qword [rsp + 0x38]
shld r14d, ebp, 0xa0
sub r14w, sp
add rsp, 0x20
xchg r14, r14
setg r14b
not r14b
pop r14
jmp 0x140472cbf
ret
Function at 0x140472cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
sar bp, cl
ror bpl, 0xda
cmc
mov qword [rax + 0x18], rsi
not rsi
sal bpl, 0x1d
mov qword [rax + 0x20], rdi
rcl ebp, 0x73
xor sil, al
mov dil, 0xda
push r14
rol si, 0xd9
sub rsp, 0x20
cmc
shl bp, cl
ror rsi, 0x61
mov rsi, r9
shrd edi, eax, 0x1b
not bp
xadd di, r14w
movzx r14d, r8w
mov rdi, rdx
bt bp, r10w
bts ebp, r14d
mov rbp, rcx
cmp r11d, esi
test r9, r9
jmp 0x140472d2b
je 0x140472df3
mov rbx, qword [rdx + 8]
test rbx, rbx
jmp 0x140472d3d
je 0x140472dda
mov rax, qword [rbx + 0x40]
stc
cmc
test sil, r13b
cmp qword [rax], 0
jmp 0x140472d55
je 0x140472d98
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0
jmp 0x140472d67
jle 0x140472d98
dec dword [rax]
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx ax, ah
movzx eax, r14w
jmp 0x140472d8a
mov word [rdx], r14w
jmp 0x140472d93
jmp 0x140472dc7
mov rax, qword [rbx]
movzx rdx, si
movsx cx, bl
movzx edx, r14w
bswap cx
xchg cl, ch
movsx rcx, r15w
mov rcx, rbx
jmp 0x140472db8
mov rax, qword [rax + 0x18]
jmp 0x140472dc1
call qword [case.0x1404cb1ca.0]
mov ecx, 0xffff
cmp cx, ax
jmp 0x140472dd4
jne 0x140472de4
mov byte [rdi], 1
cmp r11d, 0x5bc30b66
sub rsi, 1
jmp 0x140472ded
jne 0x140472d35
movups xmm0, xmmword [rdi]
movzx rsi, bx
mov rbx, qword [rsp + 0x30]
sal r14w, 0xd0
sbb al, 0x52
mov rax, rbp
bts edi, edx
mov esi, 0x11e35207
rcl di, cl
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
bsf r14d, eax
rcr r14d, cl
ror r14, cl
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
movzx r14, ax
test r15w, r10w
add rsp, 0x20
cmovns r14w, dx
pop r14
ret
Function at 0x14049ff0e
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
stc
test r10w, di
and dword [rsp + 0x30], 0
call fcn.1404aa33e
mov r9d, 2
movzx r8w, r15b
setle ch
jmp 0x14049ff34
lea r8, [rsp + 0x30]
setb dh
cqo
cmovbe dx, r13w
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x14049ffa5
sub ecx, 1
jmp 0x14049ff67
je 0x14049ff96
cmp ecx, 1
jmp 0x14049ff75
je 0x14049ff87
xor eax, eax
jmp 0x14049ff82
jmp 0x14049ffaa
mov eax, 3
jmp 0x14049ff91
jmp 0x14049ffaa
mov eax, 1
jmp 0x14049ffa0
jmp 0x14049ffaa
mov eax, 2
add rsp, 0x28
jmp 0x14049ffb3
ret

Function at 0x1404a0d7d
Capabilities:
Terminate process

Disassembly:
or esi, dword [rbx + rdi]
jmp 0x117df1725
cwde
in al, dx
xchg esp, eax
adc ebp, dword [rcx]
ud2
retf 0x12
adc al, byte [rax]
outsb dx, byte [rsi]
xchg esp, eax
mov ch, al
invalid
xchg edx, eax
and ch, byte [rbp + rbp*4 - 0xc]
mov ebp, 0x57988292
pop rcx
invalid
je 0x140177703
mov ch, 0x82
in al, 2
stc
invalid
sub dword [rsi + 0x4adfd84], ebp
mov dl, 0x67
mov ch, 0xd5
sbb al, 0xde
lea eax, [rdx + 0x777f1698]
sbb ebp, dword [rcx]
xchg esi, eax
and r10b, byte [r8 + 0x34]
in eax, 0xce
in al, dx
sbb dword [rdi + 0x173ae590], 0x2e4ebd29
pop si
invalid
nop
in eax, 0x3a
invalid
loopne 0x140177746
and bh, al
invalid
movsd dword [rdi], dword [rsi]
and ecx, ebp
lock add ecx, dword cs:[0x144ee5ebb]
imul ecx, dword [rdx + rax*2 - 0x7e0d15b9], 0xc0384cb3
xor dword [rbx + 0x2ec0384c], 0xcb78d0bc
out 0xa9, eax
loop 0x140177760
jb 0x14017776c
xor dword [rbx + 0x2ec0384c], 0xcb78d0bc
out 0xa9, eax
loop 0x140177760
jb 0x14017776c
invalid
mov byte [rcx + 0x101bb40b], ch
sub dword [rsi + rsi*2], ebp
xchg dword [rcx + 0x13], esp
jne 0x1401777fe
or esp, dword [rdx + rcx]
or byte [rsi - 0x6d], dl
or cl, byte [rax]
push rsi
xchg ebx, eax
jbe 0x1401777d3
adc byte [rcx], ch
jno 0x140177798
test al, 0x40
push r11
invalid
out 0x30, al
or ch, byte [rcx]
rol dword [rdi - 0x66d6ea97], 0x9e
lea ebx, [rax + 0x66]
sbb dword [rax + 0x68], esi
invalid
sub dword [rsi + 0x38], eax
pop rdx
sub dword [rdx + 0x3f], 0x26
in eax, dx
invalid
push rbx
sub rsp, 0x20
rol ebx, cl
mov rbx, rcx
test r13w, 0x50d3
test al, r11b
sub ecx, ecx
jmp 0x1404a0d98
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a0da6
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
cmovs rbx, rdx
btr bx, 0xe4
add rsp, 0x20
movsx bx, r14b
movsx rbx, r11w
pop rbx
jmp switch.0x1404a0dd6
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404a1849
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
clc
test r15w, 0x4f0e
push rsi
cmp bx, 0x5ee9
push rdi
mov sil, r14b
dec dil
push r12
sub r12, rcx
push r14
push r15
sub rsp, 0x20
not sil
mov esi, dword [r8 + 0xc]
movzx r14d, bp
mov r12, 0x43975476
jmp 0x1404a188b
mov r12, rcx
movsxd rdi, r8d
mov r15w, 0xe8c
movzx r15, ax
mov rcx, r8
bswap r15w
mov rdi, r9
mov r14, r8
movzx r15, r14w
mov r15, rdx
jmp 0x1404a18b3
call fcn.14028821b
mov r10, qword [r12]
mov ebp, eax
mov qword [rdi], r10
test rsi, rsp
test esi, esi
jmp 0x1404a18cb
je 0x1404a19fb
movsxd rax, dword [r14 + 0x10]
adc bx, 0x11fa
movsx rbx, r10w
lea ecx, [rsi - 1]
or bh, 0xc8
mov esi, ecx
lea rcx, [rcx + rcx*4]
bts ebx, r10d
add bl, 0x59
sbb bx, 0x23b5
lea rbx, [rax + rcx*4]
cmp r13d, r9d
test r13w, 0x40fc
add rbx, qword [r15 + 8]
test r14b, 0xf3
cmp r8d, ecx
stc
cmp ebp, dword [rbx + 4]
jle 0x1404a18c4
cmp ebp, dword [rbx + 8]
jmp 0x1404a1920
jg 0x1404a18c4
mov rcx, qword [r15]
cmovnp dx, r12w
lea rdx, [rsp + 0x50]
stc
cmp r13, r11
sub r8d, r8d
jmp 0x1404a193f
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
movzx r10, dx
neg r9b
xor r10b, spl
xor ecx, ecx
sar r9, cl
rcr r9b, 0x7a
movzx r10, r12w
add r8, qword [rsp + 0x50]
or r9d, 0x364a55e3
ror r10w, 0xf9
mov r9d, dword [rbx + 0xc]
sal r10w, cl
mov r10d, dword [rax]
test r9d, r9d
jmp 0x1404a1984
je 0x1404a19bd
lea rdx, [r8 + 0xc]
btr ax, r11w
btc ax, 4
movsxd rax, dword [rdx]
cmc
cmp cl, 0x3f
cmp rax, r10
jmp 0x1404a19a7
je 0x1404a19bd
inc ecx
clc
add rdx, 0x14
cmp ecx, r9d
jb 0x1404a1998
cmp ecx, r9d
jmp 0x1404a19c5
jae 0x1404a18c4
mov rax, qword [r12]
lea rcx, [rcx + rcx*4]
rol r14b, cl
movsx si, r14b
movzx rbp, r13w
movsxd rcx, dword [r8 + rcx*4 + 0x10]
mov rcx, qword [rcx + rax]
xadd ebx, r12d
bt bx, r10w
mov qword [rdi], rcx
adc sil, r13b
sar sil, 0x41
mov rbx, qword [rsp + 0x58]
cwde
mov rax, rdi
setle bpl
shl sil, cl
mov rbp, qword [rsp + 0x60]
bsr r14w, si
shl si, cl
and r12w, r12w
add rsp, 0x20
pop r15
movzx r14d, r8w
pop r14
setbe r12b
movsx r12w, sil
pop r12
not di
jmp 0x1404a1a3b
pop rdi
movsx rsi, ax
xchg si, si
pop rsi
jmp 0x1404a1a49
ret
Function at 0x1404acdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
cmp r14b, 0x32
cbw
bts rbx, r8
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
shl rax, cl
bsf bx, r13w
mov rax, qword [0x1400b7288]
inc bh
cmp r15b, 0x42
xor rax, rsp
sbb bh, 0x97
sal bx, 0x65
mov qword [rsp + 0x40], rax
cmp byte [rcx + 0x54], 0
movzx rbx, r13w
xchg bl, bh
mov rbx, rcx
jmp 0x1404ace0f
je 0x1404acf0a
cmp dword [rcx + 0x50], 0
jmp 0x1404ace1e
jle 0x1404acf0a
mov rsi, qword [rcx + 0x48]
sar edx, 0xe1
sbb dl, r14b
xor edi, edi
sub r9d, r11d
btr ecx, r11d
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x34]
rol r8w, 0x8b
bts cx, bx
movzx r9d, word [rsi]
btc cx, 0x1b
lea rcx, [rsp + 0x30]
dec r8b
bts r8, r11
and dword [rsp + 0x30], 0
cmovo r8d, r13d
movsx r8, r12w
movsx r8w, bpl
lea rsi, [rsi + 2]
mov r8w, bp
mov r8b, 0x24
mov r8d, 6
mov qword [rsp + 0x20], rax
jmp 0x1404ace8b
call fcn.1404d05aa
test eax, eax
jne 0x1404acf01
mov r8d, dword [rsp + 0x30]
test r8d, r8d
jmp 0x1404acea5
je 0x1404acf01
lea rax, [rbx + 0x10]
movzx dx, cl
mov cx, r12w
lea r9, [rbx + 0x28]
not cl
xchg cl, cl
mov qword [rsp + 0x20], rax
movsx edx, r10w
movzx rcx, r8w
lea rcx, [rbx + 0x468]
movzx dx, r11b
lea rdx, [rsp + 0x34]
jmp 0x1404acee2
call fcn.1404ab266
inc edi
cmp r8d, r14d
test ch, al
cmp edi, dword [rbx + 0x50]
jmp 0x1404acef6
jne 0x1404ace37
jmp 0x1404acf3f
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404acf3f
mov r8d, dword [rbx + 0x50]
cbw
bts edx, edi
rcr dl, 0xa5
lea rax, [rcx + 0x10]
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
cmp r10d, 0x69df7924
add rcx, 0x468
mov qword [rsp + 0x20], rax
jmp 0x1404acf3a
call fcn.1404ab266
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
jmp 0x1404acf4e
call fcn.14049f5cb
mov rbx, qword [rsp + 0x68]
sal di, 0xb2
rcl esi, cl
mov rsi, qword [rsp + 0x70]
ror dil, 0xe9
bsf di, r8w
cmp r11, r8
add rsp, 0x50
pop rdi
jmp 0x1404acf79
ret

Function at 0x1404af53a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x1404af64d
mov qword [rsp + 8], rbx
sub ebx, 0x25916fd3
rol r10w, 0xc2
shl bh, 0x24
mov qword [rsp + 0x10], rdi
stc
cdqe
shr al, cl
mov r10d, dword [r9]
clc
shr ax, cl
movzx rax, r11w
mov dil, dl
mov rbx, rcx
clc
sub r11d, r11d
xor ah, 0xf7
mov rdx, qword [rbx]
movsx ax, r8b
mov rax, qword [rdx + 8]
cmp qword [rdx + 0x10], rax
jmp 0x1404af58d
jne 0x1404af5c0
cmp byte [rdx + 0x18], 0
je 0x1404af5aa
inc r10d
jmp 0x1404af5a5
jmp 0x1404af5b3
or r10d, 0xffffffff
jmp 0x1404af5b3
mov dword [r9], r10d
jmp 0x1404af5bb
jmp 0x1404af61d
lea eax, [r10 + 1]
movzx r10d, r9w
dec r10b
mov dword [r9], eax
mov rax, qword [rbx]
movzx rcx, r10w
inc qword [rax + 0x10]
movzx ecx, r14w
cwde
mov rax, qword [rbx]
mov cx, 0x58c1
movsxd rcx, edi
mov rcx, qword [rax]
mov rax, 0x523241f0
movzx r10w, r13b
bswap r10w
mov byte [rcx], dil
mov rax, qword [rbx]
movsx r10w, spl
movzx r10d, ax
inc qword [rax]
or r10b, cl
movsx r10d, ax
bts r10w, r8w
mov r10d, dword [r9]
cmc
cmp r10d, 0xffffffff
jmp 0x1404af626
je 0x1404af63e
inc r11d
clc
cmp r11d, r8d
jmp 0x1404af638
jl 0x1404af578
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
jmp 0x1404af64d
ret
Function at 0x1404afbd2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bsf r11d, esp
or ax, 0x26b
inc ah
mov rax, qword [rcx + 0x460]
bswap r10
add r11b, 0xa1
mov r10, rcx
add rcx, 0x58
movsx r11d, r9w
mov ebx, r8d
movzx r11, dx
mov r11, rdx
clc
test rax, rax
jne 0x1404afc18
mov eax, 0x200
jmp 0x1404afc36
mov rcx, rax
adc r8b, 0x96
movzx r8d, r13w
mov rax, qword [r10 + 0x458]
test cl, dl
movsx r8d, r14w
shr rax, 1
shr r8d, cl
lea r8, [rcx - 1]
add r8, rax
mov qword [r10 + 0x48], r8
movzx eax, dx
btc ax, 0x9a
bswap ax
mov eax, dword [r10 + 0x38]
test sil, r10b
stc
test eax, eax
jg 0x1404afc65
test r11, r11
je 0x1404afcd3
dec eax
sub edx, edx
stc
cmc
test r8, r15
mov dword [r10 + 0x38], eax
mov rax, r11
div rbx
ror r11d, 0x5d
bsf r11d, r11d
add dl, 0x30
shr r11, cl
dec r11w
mov r11, rax
test bl, sil
cmp dl, 0x39
jmp 0x1404afc98
jle 0x1404afcba
mov al, r9b
cmp r8d, 0x2d571aa5
xor al, 1
cmp r8d, ecx
shl al, 5
add al, 7
cmp esp, 0x45241454
add dl, al
mov rax, qword [r10 + 0x48]
jmp 0x1404afcc3
mov byte [rax], dl
jmp 0x1404afcca
dec qword [r10 + 0x48]
jmp 0x1404afc4c
sub r8d, dword [r10 + 0x48]
movzx bx, r9b
mov ebx, eax
mov rbx, qword [rsp + 8]
jmp 0x1404afce8
mov dword [r10 + 0x50], r8d
jmp 0x1404afcf1
inc qword [r10 + 0x48]
jmp 0x1404afcfa
ret

Function at 0x1404b06bb
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
xor sil, 0xbe
neg sil
push rdi
shl sil, 0x14
sub rsp, 0x30
rol sil, cl
mov edi, edx
mov rsi, rcx
test r8, r8
jmp 0x1404b06e5
jne 0x1404b070c
call fcn.1404b5034
mov dword [rax], 0x16
jmp 0x1404b06fb
call fcn.1404b5d4e
xor eax, eax
jmp 0x1404b0707
jmp 0x1404b0809
mov rdx, r9
movzx cx, bpl
mov rcx, rax
movzx rcx, si
mov rcx, r8
jmp 0x1404b0723
call fcn.1404b086e
mov rbx, rax
test rax, rax
je 0x1404b07b3
lea rax, [rsp + 0x50]
mov rdx, rdi
mov r9b, 0xe3
movsx r9d, dx
mov qword [rsp + 0x28], rax
movsx r9d, r13w
movzx r8, r11w
lea r8, [0x140094b24]
cmove r9, r8
cbw
bswap rcx
mov eax, dword [rsp + 0x60]
cmovo rcx, rsp
movzx r9, r11w
movzx r9d, sp
mov r9, rbx
movzx ecx, r10w
xchg rcx, rcx
mov rcx, rsi
jmp 0x1404b0782
mov dword [rsp + 0x20], eax
jmp 0x1404b078b
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp r15b, 0x7c
test rax, rax
jmp 0x1404b07a0
jne 0x1404b0830
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404b50b2
xor edi, edi
clc
test rsi, r14
test rbx, rbx
jmp 0x1404b07c1
je 0x1404b0806
mov rcx, qword [rbx + 0x10]
clc
stc
test rcx, rcx
jmp 0x1404b07d5
je 0x1404b07e1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404b07ed
je 0x1404b07f9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b0801
call fcn.1404c8fed
mov rax, rdi
mov rbx, qword [rsp + 0x40]
inc esi
movsxd rsi, r8d
mov rsi, qword [rsp + 0x48]
not dil
neg dil
add rsp, 0x30
mov dil, sil
movzx edi, r8w
pop rdi
jmp 0x1404b082f
ret
mov rcx, qword [rsp + 0x68]
stc
test rcx, rcx
jmp 0x1404b083e
je 0x1404b084e
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
cmp r9b, 0x80
xor ebx, ebx
jmp 0x1404b0855
jmp 0x1404b07b9
Function at 0x1404b0af9
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 0x2bf02d7b
setne bl
movzx ebx, sp
mov ebx, ecx
jmp 0x1404b0b11
call fcn.1404d24fb
cmp eax, 1
jmp 0x1404b0b1e
je 0x1404b0b5d
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
jmp 0x1404b0b3b
shr edx, 8
test dl, 1
jmp 0x1404b0b46
jne 0x1404b0b5d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404b0a46
mov ecx, ebx
jmp 0x1404b0b6b
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b1c2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x1404b1cf3
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x20], r9
sbb r8b, 0x3b
push rbx
push rbp
bswap r8d
sal rbp, 0x92
push rsi
clc
sar bpl, cl
push rdi
sub rsp, 0x38
stc
lea rdi, [rsp + 0x78]
xor bp, 0x5a71
sub ebx, ebx
and r8, 0x34b855fe
inc r8b
add rdi, 0xfffffffffffffff8
bswap r8
movsx ebp, r9w
movzx r8d, r11w
mov rsi, rdx
movzx bp, r9b
movzx r8, r15w
not r8d
mov rbp, rcx
lea rdi, [rdi + 8]
mov rdx, rsi
mov r8w, 0x5ca8
mov r8, qword [rdi]
cmovl rcx, rax
mov rcx, rbp
jmp 0x1404b1cab
call fcn.1404d4319
test eax, eax
jmp 0x1404b1cb7
jne 0x1404b1cf4
inc ebx
cmp ebx, dword [rsp + 0x70]
jmp 0x1404b1cc8
jl 0x1404b1c90
add rsp, 0x38
movsx rdi, r10w
mov bpl, al
cmovns si, r10w
pop rdi
mov bpl, r12b
pop rsi
cmovno rbp, rdx
movzx bx, r9b
pop rbp
cmovb bx, r15w
pop rbx
ret
and qword [rsp + 0x20], 0
cmc
test r9b, r13b
stc
xor r9d, r9d
test r15b, 0xa
test di, r14w
xor r8d, r8d
sub edx, edx
cmp r12d, ebx
cmc
sub ecx, ecx
jmp 0x1404b1d1a
call fcn.1404b5ded
int3
Function at 0x1404b489c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rdx
rdtsc
cwde
mov qword [rsp + 8], rcx
push rbp
rol cx, cl
jmp 0x1404b48b7
mov rbp, rsp
and r8w, 0x57ef
bt edx, 0x1c
sar ah, 0x75
sub rsp, 0x40
sets al
bswap r9d
rdtsc
lea rax, [rbp + 0x10]
movsx rcx, r8w
cwd
mov r8b, 0x17
mov qword [rbp - 0x18], rax
setbe cl
movsx r8d, sp
xchg cl, cl
lea r9, [rbp + 0x28]
cmovae ax, dx
lea rax, [rbp + 0x18]
setb dl
mov qword [rbp - 0x10], rax
cmova dx, r8w
lea r8, [rbp - 0x18]
lahf
movsx rdx, bx
mov eax, 2
not dl
sets cl
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x20]
jmp 0x1404b4925
mov dword [rbp + 0x28], eax
jmp 0x1404b492d
mov dword [rbp - 0x20], eax
jmp 0x1404b4935
call fcn.140096f80
add rsp, 0x40
bswap bp
mov bpl, 0x6c
pop rbp
jmp 0x1404b494a
ret

Function at 0x1404b5ded
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov cl, 0x3a
cmove ecx, r15d
mov ecx, 0x17
jmp 0x1404b5e01
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404b5e1b
mov ecx, 5
int 0x29
jmp 0x1404b5e1b
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.1404b5e52
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
jmp 0x1404b5e42
add rsp, 0x28
jmp 0x1404b5e4b
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b7633
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
btc ecx, r9d
mov qword [rsp + 0x20], r9
shr ch, 0x69
rcl rcx, 0xf2
shl rcx, 1
push rsi
shr ch, cl
push rdi
push r14
clc
sub rsp, 0x60
mov rsi, r9
mov rdi, r8
jmp 0x1404b7667
mov ecx, dword [rdx]
jmp 0x1404b766e
call fcn.140194400
nop
cwde
add eax, 0x23326236
mov rbx, qword [0x1400ba160]
movsxd rax, dword [0x1400ba158]
lea r14, [rbx + rax*8]
mov qword [rsp + 0x38], rbx
stc
test bpl, 0x64
cmp rbx, r14
jmp 0x1404b769e
je 0x1404b77dd
mov rax, qword [rbx]
sub dl, r9b
sar dx, 0
rcr dl, 0xa8
mov qword [rsp + 0x20], rax
mov dx, 0x5adc
mov rdx, qword [rdi]
cmp sp, 0x535b
test rax, rax
jmp 0x1404b76ca
je 0x1404b7728
mov ecx, dword [rax + 0x14]
cbw
xor al, r9b
ror ah, cl
mov eax, ecx
test bl, r13b
shr eax, 0xd
cmp sil, r15b
jmp 0x1404b76ea
test al, 1
jmp 0x1404b76f1
je 0x1404b7728
mov eax, ecx
clc
and al, 3
cmp al, 2
jmp 0x1404b7703
jne 0x1404b7717
test cl, 0xc0
jmp 0x1404b7711
jne 0x1404b7736
bt ecx, 0xb
jmp 0x1404b7720
jb 0x1404b7736
inc dword [rdx]
add rbx, 8
jmp 0x1404b7731
jmp 0x1404b768c
mov rdx, qword [rdi + 0x10]
movsx r8d, sp
movzx cx, r11b
lahf
mov rcx, qword [rdi + 8]
cwde
movsx rax, r13w
mov rax, qword [rdi]
movsxd r9, r8d
lea r8, [rsp + 0x20]
movsx r9, di
mov qword [rsp + 0x40], r8
xchg r8b, r9b
movsx r8d, r11w
movzx r9d, si
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
bswap cx
setnp ch
mov qword [rsp + 0x58], rdx
setg r8b
cbw
mov rax, qword [rsp + 0x20]
movzx rcx, r12w
movzx r9w, bl
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
movzx ecx, ax
mov r8b, 0x8f
setl r8b
lea r9, [rsp + 0x28]
movsx rdx, r15w
lea r8, [rsp + 0x40]
movzx rcx, r14w
lea rdx, [rsp + 0x30]
mov cl, 0x75
jmp 0x1404b77cb
lea rcx, [rsp + 0x88]
call fcn.1404b74c3
jmp 0x1404b7728
mov ecx, dword [rsi]
call fcn.140102a81
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r14
pop rdi
movsx si, cl
jmp 0x1404b77fc
pop rsi
jmp 0x1404b7802
ret
Function at 0x1404ca47d
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
cdq
movzx ebx, r12w
not r8b
mov rbx, rcx
movzx r9, r14w
lea r9, [0x1400c63c0]
movzx edx, r15w
mov ecx, 3
movsx rdx, r15w
movzx r8w, spl
bswap rdx
lea r8, [0x1400c63b8]
mov rdx, r12
setne dh
lea rdx, [0x1400cfb70]
jmp 0x1404ca4c7
call fcn.1404cb457
test rax, rax
jmp 0x1404ca4d4
je 0x1404ca4f0
mov rcx, rbx
cmc
add rsp, 0x20
xchg bx, bx
bswap bx
pop rbx
jmp qword [case.0x1404cb1ca.0]
add rsp, 0x20
mov rbx, r9
cmovbe ebx, r11d
movsx rbx, r10w
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404ca60c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sbb r8b, r10b
movzx r8d, r8w
push rdi
add dil, 0x59
sub rsp, 0x20
mov rbx, rdx
movzx rdi, r9w
lea r9, [0x1400c63d8]
setl dl
movsx edi, r8w
jmp 0x1404ca63b
mov edi, ecx
lea rdx, [0x1400cf748]
mov ecx, 6
not r8b
bswap r8
lea r8, [0x1400c63d0]
jmp 0x1404ca65b
call fcn.1404cb457
mov rdx, rbx
stc
bts cx, sp
mov ecx, edi
cmc
test r15w, 0x4366
test rax, rax
jmp 0x1404ca679
je 0x1404ca68a
call qword [case.0x1404cb1ca.0]
jmp 0x1404ca690
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
bswap di
add rsp, 0x20
mov dil, 0xab
movzx di, cl
movsx di, sil
pop rdi
jmp 0x1404ca6ae
ret

Function at 0x1404ca823
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
shr bh, 0xa2
cmova bx, di
mov qword [rsp + 0x18], rsi
adc bh, 0x7d
movsxd rsi, r14d
mov bl, spl
push rdi
cmp dil, bpl
cmp r11b, 0x97
sub rsp, 0x30
mov ebx, r9d
mov sil, r10b
mov rdi, r8
cmovae bp, r13w
movzx rbp, r12w
movzx esi, sp
mov esi, edx
cmovbe r8, rdx
bswap edx
lea r9, [0x1400c63e8]
mov rbp, rcx
jmp 0x1404ca87f
lea r8, [0x1400c63e0]
cmovne rdx, rsi
movsx edx, sp
movsx cx, r15b
lea rdx, [0x1400cf190]
mov ecx, 0xb
call fcn.1404cb457
mov rcx, rbp
jmp 0x1404ca8ab
test rax, rax
jmp 0x1404ca8b3
je 0x1404ca8da
mov r9d, ebx
cqo
mov r8, rdi
mov dh, 0xa3
movsx rdx, sp
mov edx, esi
jmp 0x1404ca8cf
call qword [case.0x1404cb1ca.0]
jmp 0x1404ca8f6
sub edx, edx
call fcn.1404caf56
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x1404ca8f0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret