joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404ce36a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bsf bx, sp
mov r8d, r9d
movsx r8, r14w
mov qword [rsp + 0x10], rbp
movzx rbp, sp
sar bpl, 0x3f
mov qword [rsp + 0x18], rsi
rcl bpl, cl
push rdi
rcl bh, 0x5d
sub rsp, 0x20
ror bpl, cl
sal ebp, cl
lea rbx, [rcx + 0x18]
mov rsi, rcx
xor bp, di
not r8d
mov ebp, 0x101
cmp r8b, sil
sub cx, 0x73b3
shl ch, 2
mov rcx, rbx
setbe r8b
shr r8w, 0x42
cmc
mov r8d, ebp
test r15b, 0x61
jmp 0x1404ce3d2
sub edx, edx
call fcn.1404a317d
sub eax, eax
movsx rcx, r11w
mov dil, 0xe7
not cx
lea rdi, [rsi + 0xc]
xchg ch, cl
mov qword [rsi + 4], rax
movsx rcx, cx
movzx ecx, r15w
mov ecx, 6
jmp 0x1404ce401
mov qword [rsi + 0x220], rax
movzx eax, ax
jmp 0x1404ce410
rep stosw word [rdi], ax
movsxd rdi, esp
lea rdi, [0x1400b77b0]
sub rdi, rsi
xchg al, al
mov al, byte [rdi + rbx]
mov byte [rbx], al
jmp 0x1404ce42c
inc rbx
test bx, 0x5142
sub rbp, 1
jmp 0x1404ce43d
jne 0x1404ce422
lea rcx, [rsi + 0x119]
not al
movzx edx, bp
mov edx, 0x100
jmp 0x1404ce459
mov al, byte [rcx + rdi]
jmp 0x1404ce461
mov byte [rcx], al
jmp 0x1404ce468
inc rcx
cmp r15, 0x5ee24976
cmp r15w, r8w
sub rdx, 1
jmp 0x1404ce47f
jne 0x1404ce459
mov rbx, qword [rsp + 0x30]
rcr ebp, 0xfa
rol sil, 0xf7
shrd ebp, ebp, 0xf9
mov rbp, qword [rsp + 0x38]
bswap esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movsxd rdi, edx
jmp 0x1404ce4ad
pop rdi
jmp 0x1404ce4b3
ret

Function at 0x1404d446c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bsf bx, bx
push rdi
sub rsp, 0x20
shld bx, si, 0x3c
shl bx, cl
shr bx, cl
mov rdx, qword [rcx]
stc
or r8, 0xffffffffffffffff
xadd bh, bh
adc bx, cx
cmc
mov rbx, rcx
movzx cx, r12b
cmp sil, 0xbb
mov cl, 0x46
xor edi, edi
mov cx, 0x3bdc
mov cl, cl
mov rcx, r8
jmp 0x1404d44b2
inc rcx
cmc
test di, 0x46f2
cmp word [rdx + rcx*2], di
jne 0x1404d44b2
mov eax, edi
cmp rcx, 3
mov al, 0xfb
mov al, dil
xchg al, al
sete al
jmp 0x1404d44da
mov dword [rbx + 0x18], eax
movzx rax, r12w
mov rax, qword [rbx + 8]
jmp 0x1404d44ea
inc r8
cmp word [rax + r8*2], di
jmp 0x1404d44f7
jne 0x1404d44ea
cmp r8, 3
mov ax, 0x15c
mov eax, edi
sete al
cmp cl, dh
test r12b, 0
mov dword [rbx + 0x1c], eax
stc
cmp rcx, 3
jmp 0x1404d451d
jne 0x1404d452d
mov ecx, 2
jmp 0x1404d45a5
mov r9d, edi
stc
clc
cmc
test rdx, rdx
jne 0x1404d4543
mov ecx, edi
jmp 0x1404d45a5
mov ecx, 2
lahf
bt r8w, cx
movzx r8d, word [rdx]
dec al
cbw
add rdx, rcx
btr rax, 0xf0
cmc
bts ax, ax
lea eax, [r8 - 0x41]
jmp 0x1404d4573
cmp ax, 0x19
jmp 0x1404d457c
jbe 0x1404d4597
sub r8w, 0x61
cmp r8w, 0x19
jmp 0x1404d4591
ja 0x1404d459f
inc r9d
jmp 0x1404d454e
mov ecx, r9d
mov dh, 0x2e
sub r9d, r9d
movsx dx, r9b
cqo
mov dword [rbx + 0x14], ecx
xor r8d, r8d
lea rcx, [0x1400ab3bc]
xchg dx, dx
movsx rdx, r13w
movzx rdx, r13w
lea edx, [r9 + 3]
jmp 0x1404d45d0
call fcn.1404c967d
mov ecx, dword [rbx + 0x10]
test cl, 7
not al
setne dl
jmp 0x1404d45e5
bt ecx, 9
setb al
setb al
cmc
and dl, al
bt ecx, 8
setb al
clc
cmc
test al, dl
jmp 0x1404d4602
jne 0x1404d460e
mov dword [rbx + 0x10], edi
xor rbx, rsi
mov rbx, qword [rsp + 0x30]
btc edi, 0x82
add rsp, 0x20
not edi
pop rdi
jmp 0x1404d4623
ret
Function at 0x1404d63fc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
btr ebx, r10d
jmp 0x1404d6410
mov qword [rsp + 0x18], rsi
rcr bh, 0xb
neg bx
bts rbx, rax
push rdi
btr bx, 0x8e
sub rsp, 0x20
rcl bh, 0x1d
movzx bx, cl
inc dil
sub esi, esi
sal dil, cl
ror dil, 0xa8
bt ebx, 0x97
mov rdi, rdx
shr rbx, 0x23
add bl, 0x97
xor bx, r14w
mov rbx, rcx
test rcx, rcx
je 0x1404d64fe
cmp word [rcx], si
jmp 0x1404d6462
je 0x1404d64fe
lea rdx, [0x1400d1d08]
jmp 0x1404d6474
call fcn.14013740f
test eax, eax
jmp 0x1404d6480
je 0x1404d64fe
lea rdx, [0x1400d1d00]
cmova cx, r11w
mov rcx, rbx
jmp 0x1404d649a
call fcn.14013740f
test eax, eax
jmp 0x1404d64a6
jne 0x1404d64ec
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
cqo
sete dh
cdq
lea r8, [rsp + 0x30]
xchg dx, dx
cdq
movsx rdx, r9w
mov edx, 0x2000000b
jmp 0x1404d64d0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404d653c
mov eax, dword [rsp + 0x30]
jmp 0x1404d64e7
jmp 0x1404d6563
mov rcx, rbx
jmp 0x1404d64f4
call fcn.1404df54d
jmp 0x1404d6563
mov ecx, dword [rdi + 8]
movsx dx, dil
movsx r9, r14w
lea r8, [rsp + 0x30]
movzx r9w, r14b
mov r9d, 2
cqo
movsx edx, di
mov edx, 0x20001004
jmp 0x1404d6529
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d6536
jne 0x1404d6548
xor eax, eax
jmp 0x1404d6543
jmp 0x1404d6563
mov eax, dword [rsp + 0x30]
test r13b, r8b
clc
test eax, eax
jmp 0x1404d6557
jne 0x1404d6563
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movsx rdi, r10w
mov dil, 0xc6
pop rdi
ret

Function at 0x1404d657a
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
or bh, 0x82
and bl, 0x88
btr ebx, eax
mov qword [rsp + 0x18], rsi
movsxd rsi, r9d
rcr rbx, cl
sub bx, r11w
push rdi
mov bl, 0x4e
sub rsp, 0x20
movsx si, r12b
mov esi, edx
movzx bx, r13b
mov ebx, ecx
call fcn.1404c863e
mov ecx, ebx
movsx r9d, si
shr r8b, cl
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
btr rdi, 0xa0
btr di, bp
mov dh, 0xaf
bts ecx, 0xa
movsx edi, r13w
mov edx, 0x20000001
movzx rdi, r8w
mov rdi, rax
jmp 0x1404d65f0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test eax, eax
je 0x1404d66d2
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d660a
je 0x1404d66c3
test esi, esi
jmp 0x1404d6617
je 0x1404d66c3
mov r9, qword [rdi + 0x98]
sal r8b, cl
btr ax, r15w
shr r8b, 0xea
mov r8d, r10d
lahf
rcr cl, 0x98
xor cx, 0x624a
movzx edx, word [r9]
lea rcx, [r9 + 2]
shl al, cl
clc
bts eax, r15d
lea eax, [rdx - 0x41]
cmp ax, 0x19
jmp 0x1404d6657
jbe 0x1404d6674
sub dx, 0x61
cmp r12b, 0xd9
cmp dx, 0x19
jmp 0x1404d666e
ja 0x1404d6697
movzx edx, word [rcx]
inc r8d
cmp spl, 0x7f
test r8w, 0x38b1
jmp 0x1404d6689
add rcx, 2
jmp 0x1404d6692
jmp 0x1404d664b
or rcx, 0xffffffffffffffff
inc rcx
cmp ecx, 0x68dc54d3
clc
cmp word [r9 + rcx*2], r10w
jmp 0x1404d66af
jne 0x1404d669b
cmp r8d, ecx
jmp 0x1404d66bd
je 0x1404d66d2
mov eax, 1
jmp 0x1404d66cd
jmp 0x1404d66d9
xor eax, eax
and di, 0x6266
mov rbx, qword [rsp + 0x38]
xor di, cx
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
cmovge rdi, r14
jmp 0x1404d66f3
pop rdi
ret
Function at 0x1404d7d78
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
test r13b, 0xf0
jmp 0x1404d7d91
mov qword [rax + 8], rbx
jmp 0x1404d7d9e
mov qword [rax + 0x10], rbp
test bl, r8b
mov qword [rax + 0x18], rsi
test r8w, si
mov qword [rax + 0x20], rdi
clc
push r14
test cl, r8b
sub rsp, 0x40
jmp 0x1404d7dc0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
movsxd rbx, r9d
btc bx, 0xc5
cmp r14w, 0x3d71
mov rbx, rax
test rax, rax
jmp 0x1404d7de2
je 0x1404d7f3c
mov rsi, rax
test r12w, 0x2fcd
cmp word [rax], r14w
jmp 0x1404d7dfa
je 0x1404d7e3c
or rax, 0xffffffffffffffff
jmp 0x1404d7e09
inc rax
cmp sil, cl
clc
cmp word [rsi + rax*2], r14w
jmp 0x1404d7e1a
jne 0x1404d7e09
lea rsi, [rsi + rax*2]
clc
add rsi, 2
test r14b, 0x56
cmp word [rsi], r14w
jmp 0x1404d7e36
jne 0x1404d7e00
mov qword [rsp + 0x38], r14
sub rsi, rbx
neg r8w
mov qword [rsp + 0x30], r14
movzx r9, r13w
add rsi, 2
sar rsi, 1
sub r9b, 0xec
bts r8, rcx
mov r8, rbx
or r9w, sp
adc r9d, 0x51f555c7
sub r9b, 0x61
mov r9d, esi
stc
mov dword [rsp + 0x28], r14d
stc
cmp r14b, cl
sub edx, edx
jmp 0x1404d7e86
mov qword [rsp + 0x20], r14
test rsp, 0x671902e5
clc
sub ecx, ecx
jmp 0x1404d7e9a
call fcn.1404c8440
movsxd rbp, eax
test eax, eax
jmp 0x1404d7ea9
je 0x1404d7f3c
mov rcx, rbp
jmp 0x1404d7eb7
call fcn.1404c8393
mov rdi, rax
stc
test rax, rax
jmp 0x1404d7ec8
je 0x1404d7f28
mov qword [rsp + 0x38], r14
mov r9d, esi
bts r8d, ebp
shl r8w, cl
adc r8b, 0xf3
mov qword [rsp + 0x30], r14
rol r8, cl
setnp r8b
mov r8, rbx
mov dword [rsp + 0x28], ebp
cmp r12b, dil
stc
cmc
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404d7f08
call fcn.1404c8440
test eax, eax
jmp 0x1404d7f14
je 0x1404d7f28
mov rsi, rdi
movsxd rdi, eax
mov rdi, r14
jmp 0x1404d7f2f
mov rsi, r14
movsx rcx, r11w
mov rcx, rdi
call fcn.1404c8319
jmp 0x1404d7f42
mov rsi, r14
cmc
test al, 0x76
test rbx, rbx
jmp 0x1404d7f4a
je 0x1404d7f5e
mov rcx, rbx
jmp 0x1404d7f58
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
and dil, r11b
rcr r14d, 0x72
sar si, cl
mov rsi, qword [rsp + 0x60]
shr rdi, 0xa9
sbb r14w, 0x7a68
mov rbp, qword [rsp + 0x58]
movsxd rdi, r13d
and r14b, 0x7a
xor di, 0x2dc
mov rdi, qword [rsp + 0x68]
btc r14, 0x97
add rsp, 0x40
not r14w
movsxd r14, r10d
movzx r14w, r11b
pop r14
ret
Function at 0x1404d7fad
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
test r12b, r14b
test cl, 0x46
mov qword [rsp + 0x10], rbp
clc
cmp r14b, r15b
mov qword [rsp + 0x18], rsi
test dh, 0x9a
stc
push rdi
clc
cmp sp, 0x3f65
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
sub bl, r11b
mov rbx, rax
cmp spl, 0x7f
test cx, r8w
test rax, rax
jmp 0x1404d7ff3
je 0x1404d80b8
mov rbp, rax
cmp r13, 0x4ddc1b3f
cmp word [rax], si
jmp 0x1404d800b
je 0x1404d8055
or rax, 0xffffffffffffffff
inc rax
cmp r8b, r15b
cmp rsi, 0x7fe731e8
cmc
cmp word [rbp + rax*2], si
jmp 0x1404d802d
jne 0x1404d8015
lea rbp, [rbp + rax*2]
cmc
test ebx, 0x77c45862
add rbp, 2
stc
test bpl, 0x8d
test r12b, bl
cmp word [rbp], si
jne 0x1404d8011
sub rbp, rbx
test r8w, 0x3cdd
add rbp, 2
sar rbp, 1
movsx rcx, r9w
add rbp, rbp
mov cx, bp
mov rcx, rbp
jmp 0x1404d8077
call fcn.1404c8393
mov rdi, rax
cmc
test rax, rax
jmp 0x1404d8088
je 0x1404d80a8
mov r8, rbp
mov rdx, rbx
bswap cx
mov rcx, rax
jmp 0x1404d809f
call fcn.1404a26e1
mov rsi, rdi
clc
sub ecx, ecx
call fcn.1404c8319
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
movzx rax, bx
cmp r15b, 0x9f
mov rax, rsi
sub bpl, cl
neg sil
not ebp
mov rsi, qword [rsp + 0x40]
sub rdi, rsp
shr dil, 0xe7
bts di, sp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
movsxd rdi, eax
mov dil, sil
pop rdi
ret
Function at 0x1404daf5f
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
not ah
mov qword [rsp + 0x18], rbp
push rsi
nop
movzx eax, r14w
setnp ah
push rdi
cwde
push r14
movsx ax, al
mov eax, 0x1450
jmp 0x1404daf8c
call fcn.1404478c5
sub rsp, rax
mov rax, qword [0x1400b7288]
bswap si
sar r10d, 0x94
btc edi, 0x46
xor rax, rsp
movzx rbp, bx
bt si, 0x32
and ebp, 0x32567942
mov qword [rsp + 0x1440], rax
rcl dil, 0xd7
xchg sil, al
movsxd r10, edx
mov rdi, rcx
add sil, dl
mov rax, r10
movsxd rbp, esi
mov ebp, r9d
sbb cl, ch
bt esi, esi
sar rax, 6
adc dl, r15b
rol r14b, 0xa9
or esi, 0x5dfd4852
lea rcx, [0x1400ba940]
cqo
and r10d, 0x3f
shl rdx, cl
xor dh, 0x73
jmp 0x1404db007
lea rbp, [rbp + r8]
mov rsi, r8
btc r14d, 0x90
xadd dl, r14b
movzx edx, sp
mov rax, qword [rcx + rax*8]
btc r14d, 0x6a
ror r14b, cl
lea rdx, [r10 + r10*8]
sbb r14w, 0x7439
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
test r8b, 0x21
stc
test r12b, sil
mov qword [rdi], rax
cmp bx, 0x5642
mov dword [rdi + 8], eax
cmp r10b, 0xab
cmp r8, rbp
jmp 0x1404db057
jae 0x1404db16a
lea rbx, [rsp + 0x40]
clc
jmp 0x1404db068
cmp rsi, rbp
jmp 0x1404db070
jae 0x1404db0c7
mov al, byte [rsi]
jmp 0x1404db07d
inc rsi
cmp al, 0xa
jmp 0x1404db087
jne 0x1404db0a0
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404db098
inc rbx
jmp 0x1404db0a0
mov byte [rbx], al
not al
cmovbe ax, r10w
inc rbx
inc eax
lea rax, [rsp + 0x143f]
test rdi, r9
cmp rbx, rax
jmp 0x1404db0c1
jb 0x1404db068
and qword [rsp + 0x20], 0
bts ecx, ebp
lea rax, [rsp + 0x40]
cmc
stc
sub ebx, eax
movzx cx, ch
cwd
cqo
lea r9, [rsp + 0x30]
not dh
jmp 0x1404db0f1
mov r8d, ebx
movsxd rcx, ebp
jmp 0x1404db0fc
lea rdx, [rsp + 0x40]
mov cx, di
movsx rcx, si
mov rcx, r14
jmp 0x1404db110
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404db11d
je 0x1404db159
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp dx, r10w
cmp rbp, 0x518137ca
test ax, r12w
cmp eax, ebx
jmp 0x1404db140
jb 0x1404db16a
cmp rsi, rbp
jmp 0x1404db14e
jb 0x1404db05d
jmp 0x1404db16a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
shl ax, cl
sar ah, cl
sbb ax, 0x188a
mov rax, rdi
movsx ecx, di
ror ch, 0xa6
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404db183
call fcn.14049eb1e
lea r11, [rsp + 0x1450]
cmovge rbp, r9
movsx edi, r12w
mov rbx, qword [r11 + 0x20]
bswap r14
movzx di, r8b
xchg sil, sil
mov rbp, qword [r11 + 0x30]
setb dil
cmovbe r14, r10
mov rsp, r11
pop r14
movsxd rdi, eax
movzx si, cl
pop rdi
bswap esi
pop rsi
jmp 0x1404db1c8
ret
Function at 0x1404db1c9
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx ax, r15b
mov qword [rsp + 0x18], rbp
push rsi
push rdi
cdqe
cwde
movzx ax, r12b
push r14
mov eax, 0x1450
jmp 0x1404db1f6
call fcn.1404478c5
sub rsp, rax
sar rax, 0x9a
mov rax, qword [0x1400b7288]
rcl rsi, cl
xor rax, rsp
add bp, 0x464b
mov qword [rsp + 0x1440], rax
cmovb rsi, r11
movsx r14w, r13b
movsxd r10, edx
rcl r14w, cl
bswap r14
mov rdi, rcx
setg dl
mov rax, r10
movsx edx, r9w
test r13, rcx
rcl ch, 0xa8
mov ebp, r9d
sar rax, 6
cmp r12w, r13w
rcl cx, cl
lea rcx, [0x1400ba940]
inc r14w
cmp dil, 0x62
shl r14w, cl
and r10d, 0x3f
stc
lea rbp, [rbp + r8]
cmc
mov rsi, r8
mov rax, qword [rcx + rax*8]
sbb dx, 0x2bf8
lea rdx, [r10 + r10*8]
mov r14, rdi
rcr r14, cl
mov r14, qword [rax + rdx*8 + 0x28]
test dil, 0x60
cmc
xor eax, eax
test al, cl
test ecx, 0xf8e2bc8
clc
mov qword [rdi], rax
test r11b, 0xb
jmp 0x1404db2aa
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404db2b5
jae 0x1404db3c1
lea rbx, [rsp + 0x40]
cmp dx, dx
clc
cmp rsi, rbp
jmp 0x1404db2cc
jae 0x1404db32c
movzx eax, word [rsi]
add rsi, 2
test cx, r13w
jmp 0x1404db2e2
cmp ax, 0xa
jne 0x1404db307
add dword [rdi + 8], 2
ror cl, 0x1e
add cx, sp
mov ecx, 0xd
clc
mov word [rbx], cx
cmp r9b, 0x62
add rbx, 2
mov word [rbx], ax
movsxd rax, edi
add rbx, 2
lea rax, [rsp + 0x143e]
cmc
test r8b, 0x51
cmp rbx, rax
jmp 0x1404db326
jb 0x1404db2c4
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
xadd r8w, dx
lea r9, [rsp + 0x30]
sal rdx, 0x93
sar rbx, 1
xor ecx, 0x6268013c
sal r8b, 0x57
bts r8w, dx
lea rdx, [rsp + 0x40]
or r8d, ecx
movsx rcx, r10w
test sp, sp
add ebx, ebx
mov rcx, r14
xchg r8b, r8b
mov r8d, ebx
jmp 0x1404db379
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404db386
je 0x1404db3b4
mov eax, dword [rsp + 0x30]
cmc
jmp 0x1404db396
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1404db3c1
cmp rsi, rbp
jmp 0x1404db3a9
jb 0x1404db2bb
jmp 0x1404db3c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rcl al, cl
movsx ecx, sp
mov rax, rdi
shl rcx, cl
adc cx, r13w
mov rcx, qword [rsp + 0x1440]
cmp rsp, 0x3b77822
cmc
jmp 0x1404db3e0
xor rcx, rsp
jmp 0x1404db3e8
call fcn.14049eb1e
lea r11, [rsp + 0x1450]
movzx rbp, r12w
not sil
movzx r14d, r11w
mov rbx, qword [r11 + 0x20]
movsx di, cl
not dil
movzx rsi, r10w
mov rbp, qword [r11 + 0x30]
bswap r14w
cmovp r14w, r8w
mov rsp, r11
xchg r14d, r14d
bswap r14
movsx rsi, bp
pop r14
not di
movsxd rdi, r11d
movsx esi, dx
pop rdi
movzx si, bl
movzx rsi, r14w
cmova si, si
pop rsi
jmp 0x1404db447
ret
Function at 0x1404dee8b
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
cmp r10w, 0x4c94
sub rsp, 0x20
movzx r8w, r14b
movzx edi, sp
mov rbx, rdx
lea r9, [0x1400c8ea8]
bswap dx
seta dil
movsx edi, si
mov edi, ecx
lea rdx, [0x1400cf748]
movzx rcx, r13w
movzx cx, r13b
jmp 0x1404deece
mov ecx, 3
movsx r8d, r14w
not r8b
mov r8, 0x6a130005
lea r8, [0x1400c8ea0]
jmp 0x1404deeed
call fcn.1404deff3
mov rdx, rbx
mov ecx, edi
stc
test rax, rax
jmp 0x1404def00
je 0x1404def11
call qword [0x1400b8d90]
jmp 0x1404def17
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
rol dil, cl
add rsp, 0x20
mov dil, 0x1b
pop rdi
jmp 0x1404def2c
ret

Function at 0x1404df891
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test rdi, r12
jmp 0x1404df8a5
mov qword [rsp + 0x10], rbp
clc
mov qword [rsp + 0x18], rsi
movsxd rsi, r8d
or sil, r9b
push rdi
sub rsp, 0x30
shl sil, cl
movsxd rdi, r8d
btr rsi, rbp
add sil, 0
mov r8d, ecx
bt si, 0x3b
mov rsi, rdx
test ecx, 0xfffff3ff
jmp 0x1404df8df
jne 0x1404df8f6
cmp ecx, 0xc00
jmp 0x1404df8f0
jne 0x1404dfa6e
test rsi, rsi
jmp 0x1404df8fe
jne 0x1404df911
test edi, edi
jmp 0x1404df90b
jg 0x1404dfa6e
test edi, edi
jmp 0x1404df918
js 0x1404dfa6e
sub r9d, r9d
movsx ecx, cx
lea rbp, reloc.d2d1.dll_Ordinal_1
mov r10d, 0xe3
add al, bpl
bts rdx, r9
sbb eax, r11d
lea eax, [r10 + r9]
xor rdx, r10
sal dl, cl
sar ch, cl
cdq
sub eax, edx
movzx edx, r14w
mov edx, r8d
cmc
btr cx, ax
stc
sar eax, 1
and ecx, 0xd0267ac
shrd cx, r10w, 0xca
cmovs ecx, r12d
movsxd rcx, eax
clc
stc
shl rcx, 4
clc
cmp ch, al
sub edx, dword [rcx + rbp]
je 0x1404df9d7
test edx, edx
movzx rcx, si
not cl
movsx rcx, cx
lea ecx, [rax - 1]
jmp 0x1404df991
cmovns ecx, r10d
inc eax
movzx r10d, r12w
cmovnp r10, rbx
movzx r10w, r13b
test edx, edx
mov r10d, ecx
jmp 0x1404df9ae
cmovns r9d, eax
jmp 0x1404df9bd
cmp r9d, ecx
jmp 0x1404df9c5
jle 0x1404df93b
or eax, 0xffffffff
cmp r13, 0x77ac711f
cmc
stc
test eax, eax
jmp 0x1404df9de
js 0x1404dfa6e
cdqe
cmp bl, r12b
movsx cx, bpl
mov edx, 0x55
bts ecx, r11d
movsx ecx, r9w
add rax, rax
xchg cl, cl
cmove cx, di
bswap rcx
mov rbp, qword [rbp + rax*8 + 8]
not cl
mov rcx, rbp
call fcn.140229510
mov rbx, rax
clc
test edi, edi
jmp 0x1404dfa21
jle 0x1404dfa61
cmp ebx, edi
jmp 0x1404dfa2e
jge 0x1404dfa6e
mov rdx, rdi
not cl
setg ch
bswap rcx
mov r8, rbp
jmp 0x1404dfa47
mov rcx, rsi
jmp 0x1404dfa4f
call fcn.1404c8fee
test eax, eax
jmp 0x1404dfa5b
jne 0x1404dfa99
lea eax, [rbx + 1]
jmp 0x1404dfa69
jmp 0x1404dfa76
xor eax, eax
movsxd rbp, edx
sal sil, cl
mov rbx, qword [rsp + 0x40]
bts si, r13w
mov rbp, qword [rsp + 0x48]
clc
bswap di
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp 0x1404dfa98
ret
and qword [rsp + 0x20], 0
cmc
jmp 0x1404dfaa5
xor r9d, r9d
test dil, r14b
cmp sil, r12b
xor r8d, r8d
test dx, 0x5024
cmp r13w, di
clc
sub edx, edx
xor ecx, ecx
call fcn.1404b5077
int3
Function at 0x1404e4bd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
shr bpl, 0xb9
push rdi
push r12
push r13
btc r13d, r11d
bsf bp, si
push r14
cmp r9b, al
bt ax, di
push r15
sub rsp, 0x40
clc
rol al, 0x97
shr al, cl
mov rax, qword [0x1400b7288]
inc r14d
test bl, bpl
ror r15b, 0xad
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rdx]
mov rbp, r9
mov qword [rsp + 0x20], r9
cmovp r13w, sp
not r14
mov r13, r8
mov r14, rdx
rcl r15b, cl
movsx r15d, di
mov r15, rcx
test rcx, rcx
jmp 0x1404e4c41
je 0x1404e4d66
mov rbx, rcx
neg r12w
or cx, 0x2789
mov rdi, rsi
movzx edx, word [rsi]
bswap r8d
lea r12, [rsp + 0x28]
shr cx, cl
test r14, 0x422f7500
cmp r13, 4
setae r8b
movsx r8w, r15b
mov r8, rbp
xchg cx, cx
movzx cx, r15b
mov ecx, 0x3a971c44
cmovae r12, rbx
not cx
mov ch, ah
movsx cx, cl
mov rcx, r12
jmp 0x1404e4c9d
call fcn.1404e5b1d
mov rbp, rax
cmp rax, 0xffffffffffffffff
jmp 0x1404e4cae
je 0x1404e4d4f
cmp r12, rbx
je 0x1404e4cd8
cmp r13, rax
jb 0x1404e4d30
mov r8, rax
movzx rdx, cx
mov rdx, r12
mov rcx, rbx
call fcn.1404a26e1
test rbp, rbp
je 0x1404e4cf2
lea rax, [rbx + rbp]
cmp edx, r14d
cmp byte [rax - 1], 0
je 0x1404e4d17
add rsi, 2
test rbp, rbp
jmp 0x1404e4cfe
cmovne rdi, rsi
sub r13, rbp
add rbx, rbp
mov rbp, qword [rsp + 0x20]
jmp 0x1404e4d12
jmp 0x1404e4c56
sub edi, edi
btc ebx, 0xb2
sal bl, 0x50
lea rbx, [rax - 1]
bsf rax, r9
shld rax, rdx, 0xd7
setp al
sub rbx, r15
mov qword [r14], rdi
mov ax, 0x1cca
jmp 0x1404e4d42
mov rax, rbx
jmp 0x1404e4d4a
jmp 0x1404e4ddf
mov qword [r14], rdi
cmc
jmp 0x1404e4d58
or rax, 0xffffffffffffffff
jmp 0x1404e4d61
jmp 0x1404e4ddf
sub ebx, ebx
xchg dh, dl
cwd
movzx edx, word [rsi]
cmovp cx, ax
mov r8w, 0x1c73
lea rcx, [rsp + 0x28]
jmp 0x1404e4d82
mov r8, rbp
jmp 0x1404e4d8a
call fcn.1404e5b1d
cmp rax, 0xffffffffffffffff
jmp 0x1404e4d98
je 0x1404e4ddf
test rax, rax
jmp 0x1404e4da6
je 0x1404e4db7
cmp byte [rsp + rax + 0x27], 0
je 0x1404e4dcb
lea rbx, [rbx + rax]
cmc
stc
add rsi, 2
jmp 0x1404e4dc6
jmp 0x1404e4d6c
dec rax
btr ecx, 0xb1
bt ecx, 0x1e
lea rax, [rax + rbx]
btc cx, r13w
mov rcx, qword [rsp + 0x30]
cmp r11b, sil
jmp 0x1404e4dec
xor rcx, rsp
jmp 0x1404e4df4
call fcn.14049eb1e
mov rbx, qword [rsp + 0x90]
movzx bp, r9b
sar dil, cl
bts r15w, r12w
add rsp, 0x40
movzx r12w, r10b
pop r15
movsx r13d, dx
pop r14
cmovge r13, rdi
movzx r12d, r10w
pop r13
movsxd rsi, esi
pop r12
movsx edi, dx
movzx ebp, r14w
xchg edi, esi
pop rdi
movsx si, r10b
pop rsi
pop rbp
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140035860]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140035870]
mov dword [rax], 1
mov rax, qword [0x140035880]
mov dword [rax], 1
mov rax, qword [0x140035810]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140035850]
mov dword [0x14003800c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140035920]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140035900]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400357c0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001450
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp - 4], eax
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
sub eax, dword [rbp - 4]
cmp eax, 0x3e7
jg 0x140001492
mov eax, 0
jmp 0x140001497
mov eax, 1
add rsp, 0x30
pop rbp
ret