joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a87fd
Capabilities:
Check for software breakpoints
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
rcl r10b, cl
sal r10b, 0x5a
rcr r10w, cl
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
or bx, 0x4103
mov qword [rax + 0x20], rdi
btc r10w, sp
push r14
and r10, r11
sbb r10b, 0xcd
bsr bx, cx
push r15
movzx esi, word [rsp + 0x38]
mov r10, r8
and r8d, 0x36532b55
rcl bx, cl
sub r15d, r15d
mov r8, 0x652d365e
bt r8, 0x7c
movsxd r8, edx
mov bl, 0x83
movzx rbx, r10w
mov ebx, ecx
mov ecx, r8d
test r13w, dx
cmc
test si, si
jmp 0x1404a8870
jne 0x1404a89d0
mov rax, qword [r9]
test rcx, 0xcad128c
btc r11w, 0xfd
mov r11, qword [r10]
test r14b, bpl
cmp rax, 1
jbe 0x1404a895f
mov eax, 0x66666667
rol r8b, 6
mov r8, r11
imul ebx
sar edx, 2
movsxd rax, r10d
movzx cx, ah
mov eax, edx
movzx rcx, r8w
or rcx, rax
shr eax, 0x1f
stc
add edx, eax
movzx eax, dx
rcl ecx, 0xc5
bsr rcx, rcx
shl ax, 2
rcr cx, 0xa6
xor ch, dh
or cx, 0x212c
lea ecx, [rax + rdx]
add cx, cx
sub bx, cx
add bx, 0x30
neg eax
mov word [r11], bx
add r11, 2
mov rax, qword [r9]
mov ebx, edx
jmp 0x1404a88f7
dec rax
mov qword [r9], rax
test edx, edx
jle 0x1404a8914
cmp rax, 1
jmp 0x1404a890e
ja 0x1404a8896
mov rdx, qword [r10]
jmp 0x1404a891c
mov qword [r10], r11
jmp 0x1404a8924
jmp 0x1404a8951
movzx eax, word [rdx]
movzx ecx, word [r8]
cmp eax, 0x30160bdb
mov word [r8], ax
sub r8, 2
test r9b, r11b
mov word [rdx], cx
jmp 0x1404a8949
add rdx, 2
test r11w, r11w
cmp rdx, r8
jb 0x1404a8929
jmp 0x1404a8989
lea rax, [rax + rax]
movsxd rbx, r10d
sub r11, rax
sete dil
movsx edi, ax
mov qword [r10], r11
setno dil
movsx rbx, r13w
mov esi, r12d
mov qword [r9], r15
movsxd rbx, r8d
mov bl, cl
not di
mov rbx, qword [rsp + 0x18]
xchg bpl, r14b
movzx esi, r10w
cmova r15d, esp
mov rbp, qword [rsp + 0x20]
mov r15b, 0xd8
jmp 0x1404a89a6
mov rsi, qword [rsp + 0x28]
movsxd r15, ecx
movzx r14, bp
xchg r14w, r15w
mov rdi, qword [rsp + 0x30]
movsxd r14, ecx
movzx r14d, cx
pop r15
movzx r14, si
movzx r14w, al
pop r14
ret
cmp r8, qword [r9]
jmp 0x1404a89d8
jae 0x1404a897e
dec r8d
rcl r11b, 0x90
sub r11w, si
ror r11b, cl
mov r11d, r15d
test ecx, ecx
jmp 0x1404a89f6
je 0x1404a8acd
movsxd rax, r8d
inc bp
bswap bp
lea rdi, [rax + rax]
setnp dh
movzx rax, bx
movsx ebp, di
mov r14, qword [r10]
sar al, 0xba
rol edx, cl
mov eax, 0x66666667
imul ebx
ror ah, cl
sal rbp, 0x7d
or al, bpl
mov ebp, r8d
add eax, 0x338454e2
sar edx, 2
sar al, 0x41
cmc
mov eax, edx
jmp 0x1404a8a41
shr eax, 0x1f
test bpl, 0x17
stc
add edx, eax
cmp r14w, 0x26f0
cmc
test ebx, ebx
jmp 0x1404a8a59
je 0x1404a8a90
movzx eax, dx
shl ax, 2
dec cl
lea ecx, [rax + rdx]
add cx, cx
and al, sil
jmp 0x1404a8a7d
sub bx, cx
movzx ax, r9b
setb ah
lea eax, [rbx + 0x30]
jmp 0x1404a8a9a
movzx eax, si
bswap bx
movsx rbx, bp
mov word [rdi + r14], ax
movzx ebx, bp
movsx ebx, r14w
bswap bx
inc r11d
sub rdi, 2
not ebx
movsx rbx, r15w
dec r8d
mov ebx, edx
cmc
test bpl, 0x89
test ebp, ebp
jmp 0x1404a8ac7
jne 0x1404a8a13
movsxd rcx, r11d
cmovs rax, r11
and al, r12b
cmp dl, 0xcc
lea rax, [rcx + rcx]
cmc
add qword [r10], rax
test r11w, 0x33d2
sub qword [r9], rcx
jmp 0x1404a8af0
jmp 0x1404a8989
Function at 0x1404aeb64
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
shl bx, 0xbb
bt rax, 0x44
push rdi
sbb eax, 0xc031e2e
bsr eax, edx
movzx rax, r10w
sub rsp, 0x50
neg bx
mov rax, qword [0x1400b7288]
xchg bx, bx
and bh, 0x9d
xor rax, rsp
bt bx, r13w
not ebx
shl bl, 0x93
mov qword [rsp + 0x40], rax
bt bx, 0xf
inc rbx
rcr ebx, 0xc1
cmp byte [rcx + 0x54], 0
jmp 0x1404aebbe
mov rbx, rcx
jmp 0x1404aebc6
je 0x1404aecbd
cmp dword [rcx + 0x50], 0
jmp 0x1404aebd5
jle 0x1404aecbd
mov rsi, qword [rcx + 0x48]
rcr ah, 0x42
sub edi, edi
and al, 0x91
sal dl, 0xec
and al, dil
mov rax, qword [rbx + 8]
sbb dx, r14w
lea rdx, [rsp + 0x34]
btc r8w, 0x6a
movzx r9d, word [rsi]
clc
add cx, r9w
lea rcx, [rsp + 0x30]
sub r8b, dl
and dword [rsp + 0x30], 0
jmp 0x1404aec1f
lea rsi, [rsi + 2]
mov r8b, 0x45
mov r8b, spl
movzx r8w, cl
mov r8d, 6
jmp 0x1404aec39
mov qword [rsp + 0x20], rax
call fcn.1404d2111
test eax, eax
jmp 0x1404aec4a
jne 0x1404aecaf
mov r8d, dword [rsp + 0x30]
clc
test r8d, r8d
je 0x1404aecaf
lea rax, [rbx + 0x10]
mov r9b, 0x47
movsx cx, r11b
lea r9, [rbx + 0x28]
movsx cx, r8b
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
movsx rdx, r8w
movzx dx, r8b
cwd
lea rdx, [rsp + 0x34]
jmp 0x1404aec95
call fcn.1404acf6f
inc edi
cmp edi, dword [rbx + 0x50]
jmp 0x1404aeca4
jne 0x1404aebec
jmp 0x1404aecfb
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404aecb8
jmp 0x1404aecfb
mov r8d, dword [rbx + 0x50]
cdqe
shr r9, cl
lea rax, [rcx + 0x10]
mov rdx, qword [rbx + 0x48]
shr r9b, cl
lea r9, [rcx + 0x28]
test r14b, spl
jmp 0x1404aece0
add rcx, 0x468
jmp 0x1404aecec
mov qword [rsp + 0x20], rax
jmp 0x1404aecf6
call fcn.1404acf6f
mov al, 1
adc rcx, rdx
mov rcx, qword [rsp + 0x40]
stc
cmp r12w, 0x8b5
xor rcx, rsp
jmp 0x1404aed14
call fcn.1404a1418
mov rbx, qword [rsp + 0x68]
xadd dil, sil
btc edi, 0x52
inc sil
mov rsi, qword [rsp + 0x70]
sar dil, cl
bsf rdi, r12
sal rdi, cl
add rsp, 0x50
pop rdi
ret
Function at 0x1404b08d3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
sar bl, cl
bsf bx, r10w
neg ebx
mov qword [rsp + 0x18], rbp
add bx, di
bt rbx, 0xb7
mov qword [rsp + 0x20], rsi
inc bx
movzx rbx, dx
shrd ebx, r13d, 0xd2
push rdi
rcr rbx, 0xf3
rcl rbx, 0x47
add bl, bpl
sub rsp, 0x30
or bh, 0x5c
rcr bh, cl
xor ebp, ebp
stc
movsxd rbx, eax
mov rbx, rcx
cmp r13w, r15w
cmc
cmp byte [rcx + 0x54], bpl
jmp 0x1404b092b
jne 0x1404b0a50
cmp dword [rcx + 0x50], ebp
jmp 0x1404b0939
jle 0x1404b0a50
mov rsi, qword [rcx + 0x48]
jmp 0x1404b094a
mov edi, ebp
movzx r9, bp
movzx r8d, r10w
mov r9, qword [rbx + 8]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], bp
lahf
cmovns ax, r11w
cbw
mov rdx, rsi
mov rax, qword [r9]
movsxd r8, dword [rax + 8]
jmp 0x1404b0979
call fcn.1404d1e1d
movsxd r8, eax
test eax, eax
jmp 0x1404b0988
jle 0x1404b0a42
mov rcx, qword [rbx + 0x468]
cmp r10b, 0x6f
movzx edx, word [rsp + 0x40]
cwde
and al, r8b
mov rax, qword [rcx + 8]
cmc
cmp bpl, r10b
cmp qword [rcx + 0x10], rax
jmp 0x1404b09b3
jne 0x1404b09d9
cmp byte [rcx + 0x18], bpl
je 0x1404b09cb
inc dword [rbx + 0x28]
jmp 0x1404b0a22
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b09d4
jmp 0x1404b0a22
inc dword [rbx + 0x28]
movzx ax, bpl
inc qword [rcx + 0x10]
mov rax, qword [rbx + 0x468]
sbb cx, r14w
ror cx, cl
mov rcx, qword [rax]
shrd ax, r14w, 0xc6
btc ax, 0x26
mov word [rcx], dx
bts ax, r14w
movsx ax, sil
not al
mov rax, qword [rbx + 0x468]
add qword [rax], 2
test rsi, 0x2fee1932
add rsi, r8
jmp 0x1404b0a2a
inc edi
test ah, 9
cmp edi, dword [rbx + 0x50]
jmp 0x1404b0a37
jne 0x1404b0954
jmp 0x1404b0a8a
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b0a4b
jmp 0x1404b0a8a
mov r8d, dword [rbx + 0x50]
movsx rax, r10w
and r9b, 0x9d
lea rax, [rcx + 0x10]
bt rdx, 0xec
mov rdx, qword [rbx + 0x48]
not r9b
adc r9w, r13w
lea r9, [rcx + 0x28]
add rcx, 0x468
mov qword [rsp + 0x20], rax
jmp 0x1404b0a85
call fcn.1404aed3e
mov rbx, qword [rsp + 0x48]
sal bpl, cl
not dil
mov al, 1
dec bpl
test r13b, 0x4f
xchg esi, esi
mov rbp, qword [rsp + 0x50]
xor sil, r13b
jmp 0x1404b0aad
mov rsi, qword [rsp + 0x58]
mov dil, 0x85
add rsp, 0x30
movsxd rdi, edx
movsx rdi, r10w
movzx edi, r9w
pop rdi
ret
Function at 0x1404b24c4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
clc
cmp r15b, dl
mov qword [rsp + 0x10], rsi
dec si
adc sil, r10b
push rdi
sbb sil, 0x18
sub rsp, 0x30
and rdi, 0x783b146f
or si, r11w
movzx esi, r8w
mov edi, edx
mov rsi, rcx
test r8, r8
jne 0x1404b251a
call fcn.1404b6d2b
mov dword [rax], 0x16
jmp 0x1404b250e
call fcn.1404b79b7
xor eax, eax
jmp 0x1404b2614
mov rdx, r9
mov rcx, r11
movzx ecx, r15w
jmp 0x1404b2529
mov rcx, r8
jmp 0x1404b2531
call fcn.1404b2670
mov rbx, rax
stc
test rax, rax
jmp 0x1404b2542
je 0x1404b25c0
lea rax, [rsp + 0x50]
movzx cx, sil
movsxd r9, r10d
movzx r8, sp
mov rdx, rdi
mov cl, sil
movzx ecx, cx
mov qword [rsp + 0x28], rax
lea r8, [0x140094b24]
movsx rax, r11w
mov eax, dword [rsp + 0x60]
mov r9b, al
movsx r9, r10w
mov r9, rbx
mov rcx, rsi
jmp 0x1404b2588
mov dword [rsp + 0x20], eax
jmp 0x1404b2591
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
clc
jmp 0x1404b25a0
test rax, rax
jmp 0x1404b25a8
jne 0x1404b2637
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b25bb
call fcn.1404b6da0
sub edi, edi
test rbx, rbx
jmp 0x1404b25ca
je 0x1404b2611
mov rcx, qword [rbx + 0x10]
stc
test r9d, r11d
test rcx, rcx
jmp 0x1404b25e0
je 0x1404b25ec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404b25f8
je 0x1404b2604
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b260c
call fcn.1404caa97
mov rax, rdi
mov rbx, qword [rsp + 0x40]
bt rdi, 0xc1
rcl sil, cl
adc si, bx
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
mov dil, r14b
pop rdi
jmp 0x1404b2636
ret
mov rcx, qword [rsp + 0x68]
test r13w, cx
test rcx, rcx
jmp 0x1404b2648
je 0x1404b265a
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
test ecx, 0x18284a35
sub ebx, ebx
jmp 0x1404b25c2

Function at 0x1404b2921
Capabilities:
Terminate process

Disassembly:
push rbx
bts bx, r13w
shl ebx, cl
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404b2935
call fcn.1404d407f
cmp eax, 1
jmp 0x1404b2942
je 0x1404b2981
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
clc
shr edx, 8
stc
clc
test dl, 1
jmp 0x1404b2965
jne 0x1404b2981
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1404b297b
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b2988
call fcn.1404b2874
mov ecx, ebx
jmp 0x1404b2994
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b7a4f
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movsx cx, dl
movsxd rcx, r8d
mov ecx, 0x17
jmp 0x1404b7a64
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b7a71
je 0x1404b7a88
mov ecx, 5
jmp 0x1404b7a81
int 0x29
jmp 0x1404b7a88
mov r8d, 1
bswap cx
movzx dx, r11b
movsx rcx, di
mov edx, 0xc0000417
movzx ecx, bx
not cx
movzx cx, r15b
lea ecx, [r8 + 1]
call fcn.1404b7ada
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
rol dh, 0x2e
mov edx, 0xc0000417
cmp r11w, 0x3b80
add rsp, 0x28
jmp 0x1404b7ad3
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404c0228
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
setns dil
xor al, r8b
movzx rbx, r11w
sub rsp, 0x30
mov r9b, byte [rdx + 8]
cmp bh, ah
adc dil, r12b
jmp 0x1404c024b
mov rbx, rcx
btc r11d, 0x97
mov al, r9b
rol r8b, cl
xor ecx, ecx
movzx r11w, r8b
bswap r11
sbb r11b, 0x31
neg al
cdqe
bswap r11w
mov rdi, rdx
not r11w
mov r11w, r14w
mov eax, dword [rbx + 4]
movsxd r11, edx
dec r11b
lea r11, [rbx + 8]
mov r8b, r8b
movzx r8d, r8w
sbb r10d, r10d
btc r8, rsp
mov r8b, spl
rcl r8b, 0x2b
lea r8, [rbx + 8]
cmc
clc
test spl, dl
and r10d, 0x1d
stc
test ebp, r10d
cmp r8w, 0x50b4
lea r11, [r11 + rax]
cmp r15, 0x18a95e60
add r10d, 0x17
add r10d, dword [rbx]
cmp r8, r11
jmp 0x1404c02cd
je 0x1404c0339
neg r9b
movabs rax, 0x1fffffff000000
jmp 0x1404c02e5
sbb rdx, rdx
clc
and rdx, rax
cmp sil, bpl
cmc
jmp 0x1404c02f5
add rdx, 0xffffff
clc
test ax, r8w
cmp rcx, rdx
jmp 0x1404c0309
ja 0x1404c0339
movzx eax, byte [r8]
cmp dl, r11b
sub r10d, 4
stc
shl rcx, 4
inc r8
lea rcx, [rcx + rax]
cmc
cmp r14w, di
cmp r8, r11
jmp 0x1404c0333
jne 0x1404c0301
mov r9b, 1
jmp 0x1404c0341
jmp 0x1404c0365
test r9b, r9b
je 0x1404c0373
mov al, byte [r8]
inc r8
test al, al
mov r9b, 0xb4
not r9b
sete r9b
clc
test ax, sp
cmp r8, r11
jmp 0x1404c036d
jne 0x1404c0346
mov r8b, byte [rbx + 0x308]
mov dx, 0x7683
mov edx, r10d
jmp 0x1404c0386
mov qword [rsp + 0x20], rdi
jmp 0x1404c0390
call fcn.1404bbc2b
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
xchg dil, dil
jmp 0x1404c03a6
pop rdi
jmp 0x1404c03ac
ret
Function at 0x1404c50a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
ror r10w, 0xc1
mov qword [rax + 8], rbx
cmc
stc
btc ebx, esp
mov qword [rax + 0x10], rbp
xadd r10b, bl
movzx ebx, r11w
sbb r10b, 0xc0
mov qword [rax + 0x18], rsi
inc bx
mov qword [rax + 0x20], rdi
adc bl, r10b
ror rbx, cl
add r10w, 0x2016
push r14
bswap r10d
shl r10d, 0x4b
or ebp, 0xffffffff
jmp 0x1404c50f9
mov rbx, r8
cmp dword [rcx + 0x10], 0
movsxd r10, r10d
jmp 0x1404c5108
mov r10, rdx
jmp 0x1404c5110
je 0x1404c528f
movsxd r9, dword [rcx + 0x10]
btc r11w, r15w
lea r14, [0x140000000]
mov rdi, qword [rdx + 8]
xor esi, esi
rol rdx, 0x49
test r15w, 0x2f6f
cmove r11, r11
lea r9, [r9 + rdi]
rcr rax, cl
and r11b, r13b
not dh
sub r8d, r8d
rcr cl, 0x94
movsx cx, r12b
xadd dl, r11b
mov edx, ebp
sal r11w, 0x64
movzx ecx, byte [r9]
bsf r11w, bp
and ecx, 0xf
btc ax, 0xd5
movsx rax, byte [rcx + r14 + 0xc1a30]
bt r11w, 4
inc r11b
mov cl, byte [rcx + r14 + 0xc1a40]
sal r11, cl
sub r9, rax
shl r11b, 0x4f
sets r11b
ror r11d, cl
mov r11d, dword [r9 - 4]
stc
test r15b, r14b
clc
shr r11d, cl
cmc
test r11d, r11d
jmp 0x1404c51ad
je 0x1404c528f
mov rax, qword [r10 + 0x10]
adc r10d, ebp
mov r10d, dword [rax]
and cl, 0xb6
movzx ecx, byte [r9]
cwde
and ecx, 0xf
cdqe
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
clc
cmp ebp, edi
sub r9, rax
mov eax, dword [r9 - 4]
shr eax, cl
cmp ebx, 0x6e2059b8
clc
add esi, eax
bsf rax, rdi
mov eax, esi
clc
cmp r11b, 0x18
jmp 0x1404c5200
add rax, r10
cmp r11b, r14b
add rax, rdi
cmp rbx, rax
jmp 0x1404c5211
jb 0x1404c5272
movzx ecx, byte [r9]
bswap rax
cbw
inc r8d
shrd rax, r12, 0xdc
not dl
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
shr dh, cl
sal dl, 0x56
xor dx, 0x16ba
mov cl, byte [rcx + r14 + 0xc1a40]
movsx edx, di
sbb dh, bh
sub r9, rax
mov edx, dword [r9 - 4]
test sil, 0x2f
shr edx, cl
dec edx
jmp 0x1404c5264
cmp r8d, r11d
jmp 0x1404c526c
jb 0x1404c51c0
test r8d, r8d
lahf
not al
cmove edx, ebp
bswap ax
cmovb ax, r14w
mov eax, edx
jmp 0x1404c528a
jmp 0x1404c529a
mov eax, ebp
sets r14b
mov bl, 0xfc
movzx esi, dx
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov sil, dil
mov rsi, qword [rsp + 0x20]
movsx edi, bx
cmovno di, si
mov di, 0x1127
mov rdi, qword [rsp + 0x28]
pop r14
jmp 0x1404c52c3
ret

Function at 0x1404cc0ce
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
and bx, 0x366f
movzx bx, r9b
sub rsp, 0x20
xchg dil, r9b
movsx r9, r9w
movzx r9, ax
mov rbx, rdx
mov r9b, r13b
movzx rdi, cx
cwd
lea r9, [0x1400c63d8]
movzx dx, r14b
movsx r8, cx
mov edi, ecx
movzx r8d, ax
cmovbe r8d, r12d
movsx dx, bh
lea rdx, [0x1400cf748]
not cx
mov ecx, 6
mov r8b, 0xf6
movzx r8d, r9w
movzx r8, sp
lea r8, [0x1400c63d0]
jmp 0x1404cc13d
call fcn.1404ccfb3
mov rdx, rbx
mov ecx, edi
cmp si, ax
test r9b, sil
clc
test rax, rax
jmp 0x1404cc156
je 0x1404cc167
call qword [0x1400b8d90]
jmp 0x1404cc16d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
shrd di, bx, 0xa7
add di, 0x2d40
rcl dil, 0xe0
add rsp, 0x20
pop rdi
jmp 0x1404cc18a
ret
Function at 0x1404cc31f
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
neg ebx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
stc
sub rsp, 0x30
mov ebx, r9d
movzx rdi, cx
mov dil, 0x97
mov rdi, r8
mov r9b, 0xd1
mov esi, edx
lea r9, [0x1400c63e8]
movsx r8d, r13w
movsx r8, r11w
mov rbp, rcx
movsx r8d, r10w
lea r8, [0x1400c63e0]
cqo
movzx rcx, r8w
lea rdx, [0x1400cf190]
movsx cx, sil
mov ecx, 0xb
call fcn.1404ccfb3
mov rcx, rbp
test r14b, cl
test rax, rax
jmp 0x1404cc38f
je 0x1404cc3bb
mov r9d, ebx
movzx edx, sp
xchg dl, r8b
jmp 0x1404cc3a3
mov r8, rdi
movsxd rdx, edi
mov edx, esi
jmp 0x1404cc3b0
call qword [0x1400b8d90]
jmp 0x1404cc3e4
sub edx, edx
call fcn.1404cca85
mov ecx, eax
cdq
bswap dx
mov r9d, ebx
mov r8d, 0x4eeb4baa
movsxd r8, r8d
mov r8, rdi
mov edx, esi
jmp 0x1404cc3de
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
sbb dil, 0x26
jmp 0x1404cc3f7
mov rbp, qword [rsp + 0x48]
ror di, cl
bsr di, r12w
mov rsi, qword [rsp + 0x50]
rcr rdi, 0x11
cmp spl, 0xfa
add rsp, 0x30
not rdi
pop rdi
jmp 0x1404cc41e
ret
Function at 0x1404d76d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
neg ebx
push rdi
rol dh, cl
sub rsp, 0xf0
movzx ax, r8b
rcl ah, cl
rcr dx, cl
mov rax, qword [0x1400b7288]
cdq
xchg bh, bh
clc
xor rax, rsp
sbb bh, ch
bsf rbx, r10
mov qword [rsp + 0xe0], rax
rcl dl, cl
or edx, ecx
or dword [rcx + 0x10], 0x104
cmovns rbx, r14
mov rbx, rcx
cqo
movsxd rdx, r8d
lea rcx, [rsp + 0x30]
setno dl
movsx rdx, dx
movzx rdx, r10w
mov edx, 0x55
jmp 0x1404d773d
call fcn.1404cc581
cmp eax, 1
jmp 0x1404d774a
jle 0x1404d77b9
or r9, 0xffffffffffffffff
movsx ax, dl
clc
lea rax, [rsp + 0x30]
cmc
test r15w, 0x56d1
stc
sub edi, edi
jmp 0x1404d776d
inc r9
cmp word [rax + r9*2], di
jmp 0x1404d777a
jne 0x1404d776d
inc r9
lea rcx, [rbx + 0x258]
movzx r8w, dil
movsx r8, bp
cdq
lea r8, [rsp + 0x30]
movzx edx, r12w
mov edx, 0x55
jmp 0x1404d77a7
call fcn.1404c3f96
test eax, eax
jmp 0x1404d77b3
jne 0x1404d77f4
mov rcx, qword [rsp + 0xe0]
test sil, r9b
xor rcx, rsp
call fcn.1404a1418
mov rbx, qword [rsp + 0x108]
movsx di, dil
shr rdi, cl
xchg dil, dil
add rsp, 0xf0
movzx rdi, r8w
movzx edi, bx
pop rdi
jmp 0x1404d77f3
ret
xor r9d, r9d
test esi, 0xc36229a
mov qword [rsp + 0x20], rdi
xor r8d, r8d
cmp r12, 0x71c315e5
test r8b, 0x9b
sub edx, edx
sub ecx, ecx
call fcn.1404b7a4f
int3
Function at 0x1404d8ced
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
sub bx, 0x250
mov qword [rsp + 0x18], rsi
movsx bx, r15b
bt bx, r10w
push rdi
cmp r13b, 0x2c
sub rsp, 0x20
btr edi, esp
add rdi, r11
sub esi, esi
neg bh
movzx rbx, r14w
mov rdi, rdx
mov rbx, rcx
jmp 0x1404d8d2f
test rcx, rcx
jmp 0x1404d8d37
je 0x1404d8ddc
cmp word [rcx], si
jmp 0x1404d8d45
je 0x1404d8ddc
lea rdx, [0x1400d1d08]
jmp 0x1404d8d57
call fcn.1402259ba
test eax, eax
jmp 0x1404d8d63
je 0x1404d8ddc
lea rdx, [0x1400d1d00]
mov rcx, rbx
jmp 0x1404d8d78
call fcn.1402259ba
test eax, eax
jmp 0x1404d8d84
jne 0x1404d8dcf
mov ecx, dword [rdi + 8]
cwd
jmp 0x1404d8d97
lea r9d, [rsi + 2]
setl r8b
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
jmp 0x1404d8dae
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d8dbb
je 0x1404d8e10
mov eax, dword [rsp + 0x30]
jmp 0x1404d8dca
jmp 0x1404d8e34
mov rcx, rbx
call fcn.1404e1e13
jmp 0x1404d8e34
mov ecx, dword [rdi + 8]
jmp 0x1404d8de4
lea r8, [rsp + 0x30]
mov r9d, 2
movsx rdx, r15w
mov edx, 0x20001004
jmp 0x1404d8dfd
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d8e0a
jne 0x1404d8e1c
sub eax, eax
jmp 0x1404d8e17
jmp 0x1404d8e34
mov eax, dword [rsp + 0x30]
clc
test eax, eax
jmp 0x1404d8e28
jne 0x1404d8e34
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
xor dil, 0xf1
bsf esi, esi
mov rsi, qword [rsp + 0x40]
movsx rdi, r14w
or dil, 0xdf
add rsp, 0x20
not edi
pop rdi
jmp 0x1404d8e59
ret

Function at 0x1404d8e5a
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
or bx, 0x679e
and bl, r15b
mov qword [rsp + 0x18], rsi
movsx esi, r11w
push rdi
sub rsp, 0x20
movzx si, r8b
mov si, sp
mov esi, edx
mov bl, r12b
mov ebx, ecx
jmp 0x1404d8e89
call fcn.1404cade7
mov ecx, ebx
rcl dil, 0xb0
movsxd r8, r12d
lea r8, [rsp + 0x30]
stc
shrd r9w, bp, 0xb0
shl dh, 0x69
and ecx, 0x3ff
mov r9d, 2
movzx edx, r15w
bswap dx
movsx edx, r8w
bts ecx, 0xa
mov edx, 0x20000001
not rdi
xchg dil, dil
mov rdi, rax
jmp 0x1404d8ed4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
stc
test eax, eax
jmp 0x1404d8ee5
je 0x1404d8fa0
cmp ebx, dword [rsp + 0x30]
je 0x1404d8f91
test esi, esi
jmp 0x1404d8efc
je 0x1404d8f91
mov r9, qword [rdi + 0x98]
xadd cl, dh
mov r8d, r10d
xor ah, 0x86
movzx edx, word [r9]
lea rcx, [r9 + 2]
setp al
lea eax, [rdx - 0x41]
cmp spl, 0x28
cmp ax, 0x19
jmp 0x1404d8f2d
jbe 0x1404d8f47
sub dx, 0x61
stc
cmp dx, 0x19
jmp 0x1404d8f41
ja 0x1404d8f67
movzx edx, word [rcx]
jmp 0x1404d8f4f
inc r8d
cmp r8b, 0x79
cmp sil, r15b
add rcx, 2
jmp 0x1404d8f62
jmp 0x1404d8f1d
or rcx, 0xffffffffffffffff
jmp 0x1404d8f70
inc rcx
jmp 0x1404d8f78
cmp word [r9 + rcx*2], r10w
jne 0x1404d8f70
cmp r8d, ecx
jmp 0x1404d8f8b
je 0x1404d8fa0
mov eax, 1
jmp 0x1404d8f9b
jmp 0x1404d8fa9
xor eax, eax
xor bx, r9w
bswap rbx
mov rbx, qword [rsp + 0x38]
movsx edi, r8w
mov rsi, qword [rsp + 0x40]
btr rdi, rax
btr di, 0xca
add rsp, 0x20
movzx rdi, sp
cmovbe di, dx
pop rdi
jmp 0x1404d8fd2
ret
Function at 0x1404da6b6
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
test ecx, r8d
mov qword [rax + 0x10], rbp
cmp rbx, rbx
test spl, r9b
cmc
mov qword [rax + 0x18], rsi
jmp 0x1404da6d8
mov qword [rax + 0x20], rdi
test r14b, 0xa1
jmp 0x1404da6e5
push r14
cmc
sub rsp, 0x40
jmp 0x1404da6f1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
cmp ah, 0x34
test ch, 0x70
test rax, rax
jmp 0x1404da70b
je 0x1404da8ab
mov rsi, rax
stc
cmp r10w, 0x4b0a
cmp word [rax], r14w
jmp 0x1404da724
je 0x1404da777
or rax, 0xffffffffffffffff
jmp 0x1404da733
inc rax
test r9w, 0x47f5
test bl, r14b
cmp r14b, 0xdd
cmp word [rsi + rax*2], r14w
jmp 0x1404da74d
jne 0x1404da733
lea rsi, [rsi + rax*2]
cmp spl, spl
add rsi, 2
cmp r10d, 0x477f4439
test rdx, rcx
cmp word [rsi], r14w
jmp 0x1404da771
jne 0x1404da72a
mov qword [rsp + 0x38], r14
test r9b, 0x2d
shrd r9w, r11w, 0x8a
sub rsi, rbx
mov qword [rsp + 0x30], r14
xor r8w, r9w
add rsi, 2
and r9d, 0x360d6195
rcr r9w, 0xf6
adc r9w, r8w
sar rsi, 1
sbb r8w, 0x2a68
shl r9d, cl
bts r9w, r12w
mov r8, rbx
rcl r9b, cl
mov r9d, esi
cmp ecx, 0xf2a138b
clc
mov dword [rsp + 0x28], r14d
stc
test rbx, 0x3db31a1
cmp r11w, 0x5702
sub edx, edx
cmp r8w, 0x6935
cmc
mov qword [rsp + 0x20], r14
test r9d, ebp
cmp spl, 0x8c
test ecx, 0x386950b6
xor ecx, ecx
jmp 0x1404da7fc
call fcn.1404cabd1
movsxd rbp, eax
cmc
test eax, eax
jmp 0x1404da80c
je 0x1404da8ab
mov rcx, rbp
jmp 0x1404da81a
call fcn.1404cab11
mov rdi, rax
stc
test rax, rax
jmp 0x1404da82b
je 0x1404da88d
mov qword [rsp + 0x38], r14
movsx r8w, r14b
test r10w, bx
mov r9d, esi
mov qword [rsp + 0x30], r14
xor r8b, al
mov r8, rbx
mov dword [rsp + 0x28], ebp
cmc
cmp r8d, r14d
xor edx, edx
cmc
clc
sub ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404da865
call fcn.1404cabd1
test eax, eax
jmp 0x1404da871
je 0x1404da88d
mov rsi, rdi
mov dil, 0x79
bswap di
mov rdi, r14
jmp 0x1404da888
jmp 0x1404da899
mov rsi, r14
mov cl, 0x80
movzx ecx, si
cmove rcx, rbp
mov rcx, rdi
jmp 0x1404da8a1
call fcn.1404caa97
jmp 0x1404da8af
mov rsi, r14
stc
test rbx, rbx
jmp 0x1404da8b7
je 0x1404da8cb
mov rcx, rbx
jmp 0x1404da8c5
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
not r14b
mov rax, rsi
movsx si, r14b
mov rsi, qword [rsp + 0x60]
rcr dil, 0xa7
xchg dil, dil
mov rbp, qword [rsp + 0x58]
dec edi
mov rdi, qword [rsp + 0x68]
cmc
adc r14b, r15b
add rsp, 0x40
xchg r14w, r14w
pop r14
jmp 0x1404da906
ret
Function at 0x1404da907
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
test di, 0x2ba1
mov qword [rsp + 0x10], rbp
test spl, 0xdb
mov qword [rsp + 0x18], rsi
cmp r12, r9
push rdi
clc
jmp 0x1404da929
sub rsp, 0x20
jmp 0x1404da932
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
bt rbx, rdx
mov rbx, rax
cmp r13b, sil
test rax, rax
jmp 0x1404da94c
je 0x1404daa1b
mov rbp, rax
cmp word [rax], si
jmp 0x1404da95d
je 0x1404da99e
or rax, 0xffffffffffffffff
jmp 0x1404da96c
inc rax
cmp r10, r12
stc
cmp word [rbp + rax*2], si
jmp 0x1404da97d
jne 0x1404da96c
lea rbp, [rbp + rax*2]
add rbp, 2
cmc
clc
test r10w, 0xf1b
cmp word [rbp], si
jne 0x1404da963
sub rbp, rbx
shld rcx, rdi, 0xbc
cmovb ecx, r12d
add rbp, 2
shld cx, r15w, 0x4b
rol cl, cl
setae ch
sar rbp, 1
bts cx, bp
add rbp, rbp
movzx ecx, r13w
movzx rcx, r15w
bswap cx
mov rcx, rbp
call fcn.1404cab11
mov rdi, rax
test rax, rax
jmp 0x1404da9e1
je 0x1404daa06
mov r8, rbp
mov rdx, rbx
movsxd rcx, r8d
mov rcx, rax
jmp 0x1404da9f8
call fcn.1404a4fce
mov rsi, rdi
cmp sp, 0x7683
clc
xor ecx, ecx
jmp 0x1404daa0d
call fcn.1404caa97
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
movzx edi, si
cmp r9b, 0x65
mov rax, rsi
setb dil
mov rsi, qword [rsp + 0x40]
ror dil, 0xbf
and di, r8w
mov rbp, qword [rsp + 0x38]
xor di, 0x778
clc
sar di, 0x82
add rsp, 0x20
pop rdi
jmp 0x1404daa54
ret