joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140447b54
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140447b5d
movzx ecx, cx
jmp 0x140447b65
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp dil, bpl
cmc
cmp eax, 0x100
setae al
test cl, r14b
clc
add rsp, 0x28
jmp 0x140447b87
ret

Function at 0x1404492ef
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movsx eax, sp
movsx rax, si
mov rcx, qword [rcx]
movsx rax, bx
mov ah, 0x17
mov rax, qword [rcx]
jmp 0x14044930c
call qword [rax + 0x28]
test eax, eax
jmp 0x140449316
je 0x14044935f
mov ecx, eax
not r9b
ror r8b, 0x9a
btc r9w, r13w
movabs r8, 0xcafa59766d7f94e
shl r9d, 0x44
mov dl, 3
mov r9w, 0x225b
btc r9w, 0xd7
add r9w, 0xd77
mov r9d, 0x2a
add rsp, 0x28
jmp 0x14044935a
jmp fcn.1403b2e1b
nop
cmp r10b, 0xfd
stc
add rsp, 0x28
ret

Function at 0x1404493f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
inc sil
push rdi
xor al, 0x43
ror sil, cl
push rbp
movsx rsi, ax
btr ax, 0x2f
rol si, 0x19
push rbx
sub rsp, 0x48
cdqe
sub rsi, 0x5805966
mov rax, r9
rcr bx, 0x6d
mov rsi, rdx
mov rdx, rcx
mov ebx, dword [rsp + 0xa0]
test cl, bpl
clc
inc cx
mov qword [rsp + 0x40], 0
sal r9d, 0xfb
bsf cx, sp
sar cx, 0xd1
mov rcx, qword [0x1400b9300]
movss xmm0, dword [r8]
movss xmm1, dword [r8 + 4]
clc
rcl r9, 0xe
mov r9, qword [rdx]
cmp ebx, 0xffffffff
jmp 0x14044946b
je 0x14044947e
mov r8d, ebx
jmp 0x140449479
jmp 0x1404494b9
mov rdx, 0xffffffffffffffff
shr r8w, cl
xor r8b, bpl
nop word [rax + rax]
adc r8b, 0x95
movsxd r8, r10d
lea r8, [rdx + 1]
jmp 0x1404494a5
cmp word [rax + rdx*2 + 2], 0
mov rdx, r8
jmp 0x1404494b3
jne 0x14044949c
mov ebp, dword [rsp + 0x98]
xchg dl, dil
mov ebx, dword [rsp + 0x90]
movsxd rdi, esp
cqo
movsx di, r12b
mov rdi, qword [rcx]
mov dh, ah
lea rdx, [rsp + 0x40]
jmp 0x1404494e3
mov qword [rsp + 0x30], rdx
movss dword [rsp + 0x28], xmm1
cqo
movzx dx, r14b
movss dword [rsp + 0x20], xmm0
mov rdx, rax
call qword [rdi + 0x90]
test eax, eax
jmp 0x14044950b
je 0x14044953c
mov ecx, eax
movzx r8w, sil
setbe r9b
movabs r8, 0xcafa59766d7f94e
movsx r9, sp
mov dl, 3
mov r9d, 0x41
jmp 0x140449537
call fcn.1403b2e1b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
not rdx
movzx edx, r14w
mov edx, ebx
jmp 0x140449552
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
movzx rdx, si
movsx rdx, r13w
movzx edx, r10w
mov rax, qword [rcx]
xchg dl, dh
movzx rdx, r9w
movsx rdx, r9w
mov edx, ebp
jmp 0x14044957a
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
sbb bpl, r11b
mov qword [rsi], rax
and al, r11b
movzx bx, r9b
mov rax, rsi
bt ebp, r11d
bsr rbx, rdx
add rsp, 0x48
movzx bp, dil
movsxd rsi, edi
pop rbx
pop rbp
pop rdi
setb sil
movsxd rsi, ebx
movsx rsi, di
pop rsi
ret
Function at 0x140449d84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
sal al, 0x3c
push rbx
cbw
bt ax, 0x7e
sub rsp, 0x58
mov rax, r9
mov r14, rdx
bswap r9w
mov r9w, dx
movsx r9, dx
mov r9d, dword [rsp + 0xa0]
jmp 0x140449db6
movd xmm0, r8d
shr r8, 0x20
jmp 0x140449dc4
movd xmm1, r8d
mov qword [rdx], 0
jmp 0x140449dd5
cvttss2si r8d, xmm1
test r8d, r8d
jmp 0x140449de2
jle 0x140449f1c
cvttss2si r10d, xmm0
xor r11d, r11d
cmc
movss xmm2, dword [0x1400bf4c0]
jmp 0x140449e06
sub ebx, ebx
jmp 0x140449e0d
jmp 0x140449e38
inc ebx
stc
jmp 0x140449e1d
add r11d, r9d
cmc
jmp 0x140449e2a
cmp ebx, r8d
jmp 0x140449e32
je 0x140449f1c
mov rsi, r10
mov edx, r11d
clc
test r10d, r10d
jmp 0x140449e47
jg 0x140449edc
jmp 0x140449e12
movzx edi, dil
jmp 0x140449e5b
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
jmp 0x140449e6f
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
movzx edi, byte [rax + rdx + 1]
jmp 0x140449e8c
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
not di
movzx edi, byte [rax + rdx + 2]
jmp 0x140449ead
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
cmp r12, 0xf704cc4
cmp r8d, r10d
add edx, 4
jmp 0x140449ed3
dec rsi
je 0x140449e12
mov edx, edx
rcr dil, 0x54
sar edi, cl
movzx rdi, di
movzx edi, byte [rax + rdx + 3]
cmc
cmp edi, 0xff
je 0x140449ecb
test edi, edi
jmp 0x140449f01
jne 0x140449e52
mov byte [rax + rdx + 2], 0
jmp 0x140449f11
mov word [rax + rdx], 0
jmp 0x140449ecb
mov rcx, qword [rcx + 0x18]
cmovp rdx, rbx
cdq
cqo
movabs rdx, 0x10000001c
mov qword [rsp + 0x38], rdx
jmp 0x140449f3b
movsd xmm2, qword [0x1400bfee0]
jmp 0x140449f48
movsd qword [rsp + 0x40], xmm2
jmp 0x140449f53
mov dword [rsp + 0x48], 0
jmp 0x140449f60
mov qword [rsp + 0x50], 0
jmp 0x140449f6e
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
mov edx, edx
or rdx, rbx
mov rbx, qword [rcx]
jmp 0x140449f89
mov qword [rsp + 0x28], r14
setg r8b
movzx di, dil
lea rdi, [rsp + 0x38]
bswap r8
movzx r8, sp
mov qword [rsp + 0x20], rdi
movsxd r8, r8d
mov r8b, 0xaf
movsx r8d, bx
mov r8, rax
jmp 0x140449fba
call qword [rbx + 0x1c8]
test eax, eax
jmp 0x140449fc7
je 0x140449ff8
mov ecx, eax
movsx r9, si
jmp 0x140449fd8
movabs r8, 0xad4a5352d2edebd0
bswap r9w
mov dl, 3
mov r9d, 0xd4
jmp 0x140449ff3
call fcn.1403b2e1b
mov rax, r14
xor r14b, 0x63
not si
add rsp, 0x58
movsx bx, bl
jmp 0x14044a00f
pop rbx
xchg r14w, r14w
mov si, 0x1b5
movsxd rdi, esp
pop rdi
movsxd r14, r13d
mov sil, 0x62
pop rsi
movsx r14d, r12w
movsxd r14, ecx
pop r14
jmp 0x14044a031
ret
Function at 0x14044a514
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
sub ax, r13w
push rsi
btc si, 0x12
push rdi
bts r14w, r12w
rcl r14b, cl
and si, 0x1ff9
push rbp
lahf
shrd eax, r14d, 0x75
cbw
push rbx
btr ebx, r8d
movsx ebx, sp
sub rsp, 0x60
movzx esi, bx
cwde
movaps xmmword [rsp + 0x50], xmm6
mov r14, r9
mov rbx, r8
movsx rbp, r8w
mov rdi, rdx
mov rsi, rcx
cbw
cqo
movss xmm6, dword [rsp + 0xb0]
cdq
cwde
movzx ebp, byte [rsp + 0xb8]
cwde
movzx ax, cl
mov qword [rsp + 0x38], 0
setp al
not dx
mov rcx, qword [rcx + 8]
rdtsc
movsx rax, r15w
cdq
mov rax, qword [rcx]
movsx rdx, bp
lea rdx, [rsp + 0x38]
jmp 0x14044a5a3
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
cdqe
mov rcx, qword [rsp + 0x38]
cwd
movzx eax, sp
mov rax, qword [rcx]
cdq
movsxd rdx, ebx
movsx edx, r14w
lea rdx, [rsp + 0x30]
jmp 0x14044a5d0
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
cwde
cwd
mov rdx, qword [rdi]
movzx rax, r10w
mov rax, qword [rcx]
movsx r8, bx
not r8b
movzx r8w, r12b
mov r8d, 1
jmp 0x14044a5ff
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
seta dh
bswap dx
cqo
mov rdx, rdi
mov r8d, ebx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
movzx edx, bpl
bswap ax
movsx ax, r13b
mov rax, qword [rcx]
jmp 0x14044a634
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
movzx ax, r9b
lahf
mov rax, qword [rcx]
jmp 0x14044a64a
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
cbw
movzx eax, sp
movups xmm0, xmmword [r14]
cwde
rdtsc
not ah
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
jmp 0x14044a66c
lea rdx, [rsp + 0x40]
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
mov al, r9b
mov r8, qword [rsi + 0x20]
cdqe
mov rdx, qword [rsp + 0x38]
movsxd rax, r13d
cbw
mov rax, qword [rcx]
jmp 0x14044a693
mov qword [rsp + 0x20], 0
jmp 0x14044a6a1
movaps xmm3, xmm6
jmp 0x14044a6a9
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
jmp 0x14044a6be
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
jmp 0x14044a6d1
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
ror r14b, 0xe7
btc bp, 0xa7
add rsp, 0x60
setp bh
pop rbx
movsx edi, dx
pop rbp
cmovno r14d, ecx
mov r14w, 0x6cc9
movsx si, sil
pop rdi
movzx esi, bx
pop rsi
movzx r14, dx
not r14b
mov r14b, 0x6b
pop r14
ret
Function at 0x14044b247
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
clc
movzx rsi, r13w
rol sil, cl
push rdi
btr rsi, r10
inc si
shr dil, 0x50
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm8
movaps xmmword [rsp + 0x50], xmm7
mov sil, r14b
movaps xmmword [rsp + 0x40], xmm6
setl sil
mov rsi, r9
jmp 0x14044b28a
mov rdi, rcx
jmp 0x14044b292
movd xmm6, edx
shr rdx, 0x20
jmp 0x14044b29f
movd xmm7, edx
mov rcx, qword [rcx + 0x20]
rdtsc
mov al, 0xd9
cbw
movups xmm0, xmmword [r8]
movzx eax, bp
movaps xmmword [rsp + 0x30], xmm0
movsxd rax, r11d
rdtsc
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
jmp 0x14044b2cb
call qword [rax + 0x40]
movdqa xmm0, xmm6
call fcn.1404bbc0a
movdqa xmm6, xmm0
movss xmm8, dword [0x1400bd480]
jmp 0x14044b2e9
addss xmm6, xmm8
movdqa xmm0, xmm7
call fcn.1404bbc0a
addss xmm0, xmm8
mov rcx, qword [rdi + 0x18]
cmovae r8w, r9w
mov r9, qword [rdi + 0x20]
not r8b
mov r8, rbx
mov r8, qword [rsi]
jmp 0x14044b317
movd edx, xmm6
movd eax, xmm0
shl rax, 0x20
or rdx, rax
movzx rax, bp
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
jmp 0x14044b33a
call qword [rax + 0xe0]
movaps xmm6, xmmword [rsp + 0x40]
shld si, di, 0x31
movsxd rdi, eax
mov si, 0x331
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
btr di, r8w
ror rdi, 0x24
cmp ax, r11w
add rsp, 0x78
xchg sil, sil
sets sil
movsx rdi, r12w
pop rdi
movsx si, r15b
pop rsi
jmp 0x14044b384
ret

Function at 0x14044c2cf
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
adc al, spl
sal ax, 0xce
mov eax, 0x5a4d
cmp bh, 0xd2
clc
cmp word [0x140000000], ax
jmp 0x14044c2f2
jne 0x14044c40b
movsxd rcx, dword [0x14000003c]
rol dh, cl
cdq
lea rdx, [0x140000000]
cmc
add rcx, rdx
cmp dword [rcx], 0x4550
jmp 0x14044c318
jne 0x14044c40b
mov eax, 0x20b
clc
cmp r14, r8
cmp word [rcx + 0x18], ax
jmp 0x14044c330
jne 0x14044c40b
sub r8, rdx
movsxd r9, ebx
test r10, rbp
movsx rax, cx
movzx edx, word [rcx + 0x14]
cmovp ax, di
bt r9d, 0x7e
add rdx, 0x18
ror al, cl
bts r9w, si
add rdx, rcx
bswap ax
cbw
bsr ax, sp
movzx eax, word [rcx + 6]
shl r9, 0x9f
clc
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp esp, 0x2bea33f6
jmp 0x14044c383
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x14044c38f
je 0x14044c3c7
mov ecx, dword [rdx + 0xc]
clc
cmp r8, rcx
jmp 0x14044c3a1
jb 0x14044c3be
mov eax, dword [rdx + 8]
add eax, ecx
test r11b, 0x8e
cmp r8, rax
jmp 0x14044c3b8
jb 0x14044c3ca
add rdx, 0x28
jmp 0x14044c383
sub edx, edx
stc
test rdx, rdx
jmp 0x14044c3d2
jne 0x14044c3e4
sub al, al
jmp 0x14044c3df
jmp 0x14044c419
cmp dword [rdx + 0x24], 0
jmp 0x14044c3ed
jge 0x14044c3ff
sub al, al
jmp 0x14044c3fa
jmp 0x14044c419
mov al, 1
jmp 0x14044c406
jmp 0x14044c419
xor al, al
jmp 0x14044c412
jmp 0x14044c419
add rsp, 0x18
jmp 0x14044c422
ret
Function at 0x14045d1ed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
cmp cl, ch
sub rsp, 0x20
jmp 0x14045d1fe
xorps xmm0, xmm0
xor eax, eax
movzx bx, bpl
xchg bx, bx
movsx bx, ah
movups xmmword [rcx], xmm0
mov rbx, rcx
jmp 0x14045d21a
movups xmmword [rcx + 0x10], xmm0
mov qword [rcx + 0x20], rax
jmp 0x14045d227
mov dword [rcx + 0x28], eax
jmp 0x14045d22f
call fcn.1404adbfa
mov dword [rbx], eax
jmp 0x14045d23b
call fcn.1404acf5b
mov dword [rbx + 4], eax
jmp 0x14045d248
call fcn.1404adba6
sub edi, edi
test r9w, 0x3647
add cl, 0xf
sar ch, cl
mov rcx, qword [rax + 0x10]
adc al, 0xf2
mov eax, edi
test rcx, rcx
sete al
clc
stc
mov dword [rbx + 8], eax
test dil, 3
cmp r12w, ax
test rcx, rcx
jmp 0x14045d27d
je 0x14045d2fb
call fcn.1404ae1b3
mov r9, rax
mov r8d, edi
shr r10b, cl
cmp rbp, 0x25256d08
shrd r10, rbp, 0x9d
mov r10d, edi
cmc
test si, bx
cmp bpl, 0x5f
cmp word [r9], di
jge 0x14045d2de
mov rdx, r10
mov eax, r8d
mov cx, r9w
xchg cl, ch
shr cl, 0xd5
shr rdx, 3
and eax, 7
movzx cx, r13b
movzx ecx, byte [rdx + rbx + 0xc]
bts ecx, eax
mov byte [rdx + rbx + 0xc], cl
jmp 0x14045d2de
inc r8d
jmp 0x14045d2e6
inc r10
stc
add r9, 2
cmp r8d, 0x100
jl 0x14045d2a8
mov rax, rbx
clc
mov rbx, qword [rsp + 0x30]
not dil
rol dil, 0x51
xor dil, 1
add rsp, 0x20
movzx rdi, r11w
cmovl rdi, r13
pop rdi
jmp 0x14045d321
ret

Function at 0x14045de57
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsx ecx, r15w
movzx cx, r9b
lea rcx, [rsp + 0x30]
jmp 0x14045de6e
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
add rsp, 0x28
jmp 0x14045de82
ret
Function at 0x14045df42
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
bswap rbx
neg ebx
rol rbx, 0xad
push rbp
mov rbp, rsp
sub rsp, 0x20
cwde
mov rax, qword [0x1400b7288]
btr rbx, rsi
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x14045df76
jne 0x14045e05b
and qword [rbp + 0x18], 0
bswap rcx
setg cl
not cl
lea rcx, [rbp + 0x18]
jmp 0x14045df92
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045dfa1
mov qword [rbp + 0x10], rax
jmp 0x14045dfaa
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x14045dfbb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
sal cl, 0x72
lea rcx, [rbp + 0x20]
cmp r13, 0x2b7111f2
xor qword [rbp + 0x10], rax
jmp 0x14045dfda
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
test cx, 0x6dc9
mov ch, 0xfd
test bx, r15w
lea rcx, [rbp + 0x10]
cmp r14b, 0xf7
shl rax, 0x20
cmc
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
or bpl, 0xa8
xor rax, rcx
mov ebp, 0x6e080a0f
clc
rcr ecx, 0xa0
movabs rcx, 0xffffffffffff
xchg bpl, bpl
movzx ebp, r9w
movzx bp, r8b
and rax, rcx
sub cl, ah
bt rcx, r12
shl ecx, 0xc0
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
movsx rbx, r8w
cmovnp ebp, r8d
cmove rax, rcx
movsx rbp, r10w
mov qword [0x1400b7288], rax
clc
mov rbx, qword [rsp + 0x48]
or rbp, 0x41c35e71
movsx ebp, r10w
shl bpl, cl
not rax
ror rbp, 0xfb
mov qword [0x1400b7280], rax
sal bpl, 0xa6
neg bpl
add rsp, 0x20
pop rbp
jmp 0x14045e08d
ret
Function at 0x140462b18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x140462b2f
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
shl ebp, 0x83
push rdi
rcr bpl, 0x80
stc
xor bpl, 0xb5
push r12
shr rbp, cl
shl ebp, cl
push r14
stc
push r15
cmovg r15w, bx
sub rsp, 0x40
sub r12d, r12d
mov r15, r8
and bpl, r9b
mov qword [rax + 0x20], r12
or rdi, 0xffffffffffffffff
mov rbp, rcx
jmp 0x140462b73
inc rdi
cmp r9, r10
cmp byte [rdi + rcx], r12b
jne 0x140462b73
add rdi, 1
jmp 0x140462b90
mov rbx, r12
mov rsi, rdi
jmp 0x140462b9b
mov r14, rcx
jmp 0x140462ba3
je 0x140462c07
lea r9, [rsp + 0x88]
mov dh, 0xfa
movzx r8, dx
mov qword [rsp + 0x20], r15
movzx dx, r15b
jmp 0x140462bcc
mov r8, rsi
lea rcx, [rsp + 0x70]
xchg edx, edx
mov rdx, r14
call fcn.14045d425
test eax, eax
jmp 0x140462be5
jle 0x140462c07
cdqe
jmp 0x140462bf2
inc rbx
lea r14, [r14 + rax]
sub rsi, rax
jmp 0x140462c01
jne 0x140462ba9
inc rbx
movzx cx, r8b
cqo
cwd
mov edx, 2
movsxd rcx, r14d
mov rcx, rbx
call fcn.14025670a
mov r14, rax
cmp r12b, r15b
test rax, rax
jmp 0x140462c31
je 0x140462d09
mov qword [rsp + 0x30], r12
mov rsi, rax
jmp 0x140462c45
test rbx, rbx
je 0x140462ca3
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
movsx rcx, sp
mov r8, rdi
cdq
movsxd rdx, esi
movsx dx, r9b
mov rdx, rbp
bswap rcx
movsxd rcx, eax
mov rcx, rsi
call fcn.14045d425
test eax, eax
jmp 0x140462c80
jle 0x140462ca3
cdqe
add rsi, 2
jmp 0x140462c91
add rbp, rax
cmc
test r13b, 0x74
sub rbx, 1
jne 0x140462c4e
lea r11, [rsp + 0x40]
mov word [rsi], r12w
not al
mov r15b, 0xf5
jmp 0x140462cb6
mov rbx, qword [r11 + 0x38]
mov rax, r14
movsx r15d, r14w
mov rbp, qword [r11 + 0x40]
movsx rsi, r8w
movsx edi, sp
mov rsp, r11
movzx rdi, r9w
movzx r15w, bl
xchg rsi, rdi
pop r15
jmp 0x140462ce2
pop r14
movsx r12w, r9b
movsx edi, sp
pop r12
movsx di, cl
movzx rdi, sp
not di
pop rdi
movsxd rsi, esp
mov esi, 0x19471364
pop rsi
jmp 0x140462d08
ret
call fcn.14045cbf7
int3
Function at 0x1404a3827
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp r14w, 0x635e
and dword [rsp + 0x30], 0
jmp 0x1404a383b
call fcn.1404adba6
mov r9d, 2
mov cx, 0xb85
lea r8, [rsp + 0x30]
movsxd rcx, ebp
movzx cx, ch
mov rcx, qword [rax + 0x28]
movzx rdx, r9w
lea edx, [r9 + 0x20]
jmp 0x1404a3867
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
jmp 0x1404a387a
je 0x1404a38c6
sub ecx, 1
jmp 0x1404a3888
je 0x1404a38b7
cmp ecx, 1
jmp 0x1404a3896
je 0x1404a38a8
xor eax, eax
jmp 0x1404a38a3
jmp 0x1404a38ce
mov eax, 3
jmp 0x1404a38b2
jmp 0x1404a38ce
mov eax, 1
jmp 0x1404a38c1
jmp 0x1404a38ce
mov eax, 2
test r8b, spl
add rsp, 0x28
jmp 0x1404a38d7
ret
Function at 0x1404b4137
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmp di, r14w
mov qword [rsp + 0x10], rsi
or sil, cl
shld rsi, r14, 0xb8
sar sil, 0x5c
push rdi
stc
btc si, 0xa4
sub rsp, 0x30
sar edi, cl
bswap di
neg sil
mov edi, edx
add rsi, r10
sub si, bp
xchg sil, sil
mov rsi, rcx
cmp dx, 0x77d3
test r8, r8
jne 0x1404b41a1
call fcn.1404b8a35
mov dword [rax], 0x16
jmp 0x1404b4190
call fcn.1404b970a
sub eax, eax
jmp 0x1404b419c
jmp 0x1404b428a
mov rdx, r9
not cl
jmp 0x1404b41ab
mov rcx, r8
jmp 0x1404b41b3
call fcn.1404b42f4
mov rbx, rax
stc
test rax, rax
jmp 0x1404b41c4
je 0x1404b4228
lea rax, [rsp + 0x50]
mov rdx, rdi
movsx r8, sp
mov qword [rsp + 0x28], rax
lea r8, [0x140094b24]
movzx cx, dh
mov cl, r15b
mov eax, dword [rsp + 0x60]
movsx ecx, r15w
mov r9, rbx
movzx rcx, r13w
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b4210
jne 0x1404b42b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b4223
call fcn.1404b8aaf
xor edi, edi
clc
cmp edi, r15d
test r12w, ax
test rbx, rbx
je 0x1404b427d
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jmp 0x1404b4247
je 0x1404b4253
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
jmp 0x1404b425c
test rcx, rcx
jmp 0x1404b4264
je 0x1404b4270
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b4278
call fcn.1404cca27
mov rax, rdi
ror dil, 5
or bx, 0x7521
clc
mov rbx, qword [rsp + 0x40]
btc edi, 0xca
mov rsi, qword [rsp + 0x48]
not di
shr dil, 0xbd
add rsp, 0x30
not di
movzx rdi, sp
movsx di, spl
pop rdi
ret
mov rcx, qword [rsp + 0x68]
jmp 0x1404b42bb
test rcx, rcx
jmp 0x1404b42c3
je 0x1404b42d9
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
jmp 0x1404b42d9
xor ebx, ebx
jmp 0x1404b4232

Function at 0x1404b45a8
Capabilities:
Terminate process

Disassembly:
push rbx
sbb rbx, 0x36a033cf
cmc
sub rsp, 0x20
mov ebx, ecx
call fcn.1404d5f6e
cmp eax, 1
je 0x1404b4600
mov rax, qword gs:[0x60]
cmc
mov edx, dword [rax + 0xbc]
shr edx, 8
test r9b, dl
test dl, 1
jne 0x1404b4600
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movzx edx, si
cqo
mov edx, ebx
jmp 0x1404b45fa
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404b44fd
mov ecx, ebx
jmp 0x1404b460e
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404ce006
Capabilities:
Get thread local storage value

Disassembly:
push rbx
rcr r8d, cl
sub rsp, 0x20
mov rdx, rdx
not r9d
mov ebx, ecx
cqo
not r8w
lea r9, [0x1400c63d0]
movzx r8w, bpl
bswap ecx
mov ecx, 5
lea r8, [0x1400c63c8]
not dh
movzx edx, bx
lea rdx, [0x1400cf758]
jmp 0x1404ce048
call fcn.1404cee90
mov ecx, ebx
test rax, rax
jmp 0x1404ce057
je 0x1404ce06e
add rsp, 0x20
setns bh
bswap ebx
pop rbx
jmp qword [case.0x1404e35ce.0]
add rsp, 0x20
mov bx, 0x2bd9
movzx ebx, si
pop rbx
jmp 0x1404ce07f
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404ce086
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sal r8b, cl
movzx bx, sil
push rdi
sub rsp, 0x20
xchg r8b, dil
mov rbx, rdx
lea r9, [0x1400c63d8]
bswap edx
xchg dil, r8b
mov edi, esp
mov edi, ecx
movzx dx, spl
movzx ecx, r10w
lea rdx, [0x1400cf748]
mov cl, 0xd7
movzx r8d, cx
setg r8b
mov ecx, 6
movzx r8d, ax
movsxd r8, edi
lea r8, [0x1400c63d0]
jmp 0x1404ce0e0
call fcn.1404cee90
mov rdx, rbx
rcl cx, 0x73
mov ecx, edi
test rax, rax
jmp 0x1404ce0f6
je 0x1404ce107
call qword [case.0x1404e35ce.0]
jmp 0x1404ce10d
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1404ce11c
ret

Function at 0x1404ce27f
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
and rbx, rax
adc bl, 0xa6
test r15d, eax
mov qword [rsp + 0x10], rbp
or rbp, rdi
mov qword [rsp + 0x18], rsi
push rdi
xchg bl, sil
not sil
sub rsp, 0x30
movzx rsi, r14w
movsx rbp, r12w
mov sil, r15b
mov ebx, r9d
mov rdi, r8
movsx esi, r10w
mov r8b, r9b
movsx r9w, r14b
mov esi, edx
lea r9, [0x1400c63e8]
mov rbp, rcx
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
movzx rcx, r13w
movsx cx, bpl
mov ecx, 0xb
jmp 0x1404ce2ef
call fcn.1404cee90
mov rcx, rbp
jmp 0x1404ce2fc
test rax, rax
je 0x1404ce324
mov r9d, ebx
bswap r8d
cwd
mov r8, rdi
xchg dh, dh
cdq
movsx edx, r15w
mov edx, esi
call qword [case.0x1404e35ce.0]
jmp 0x1404ce34f
sub edx, edx
jmp 0x1404ce32b
call fcn.1404ce984
mov ecx, eax
jmp 0x1404ce337
mov r9d, ebx
movzx edx, dx
mov r8, rdi
cwd
mov edx, esi
jmp 0x1404ce349
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
or rsi, 0xe3f4a61
bt si, r8w
mov rsi, qword [rsp + 0x50]
btr rdi, rdx
add rsp, 0x30
xchg rdi, rdi
movsx di, spl
movsxd rdi, ebp
pop rdi
ret
Function at 0x1404dab64
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
btc rbx, rcx
movsx rbx, bp
push rdi
neg bh
xor dil, dil
sub rsp, 0x20
xor esi, esi
jmp 0x1404dab87
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jmp 0x1404dab95
je 0x1404dac2d
cmp word [rcx], si
je 0x1404dac2d
lea rdx, [0x1400d1d08]
call fcn.1401e48fa
test eax, eax
jmp 0x1404dabb7
je 0x1404dac2d
lea rdx, [0x1400d1d00]
movzx cx, cl
mov rcx, rbx
jmp 0x1404dabd0
call fcn.1401e48fa
test eax, eax
jmp 0x1404dabdc
jne 0x1404dac1b
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
bswap dx
movsx rdx, r10w
mov edx, 0x2000000b
jmp 0x1404dabff
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404dac5d
mov eax, dword [rsp + 0x30]
jmp 0x1404dac16
jmp 0x1404dac7b
mov rcx, rbx
jmp 0x1404dac23
call fcn.1404e3c86
jmp 0x1404dac7b
mov ecx, dword [rdi + 8]
movsx edx, r9w
cdq
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404dac4a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404dac57
jne 0x1404dac64
xor eax, eax
jmp 0x1404dac7b
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x1404dac6f
jne 0x1404dac7b
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
sar di, 0xe6
rol rsi, cl
movsx rsi, sp
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
xchg edi, edi
setb dil
jmp 0x1404dac9f
pop rdi
jmp 0x1404daca5
ret

Function at 0x1404daca6
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
jmp 0x1404dacb8
mov qword [rsp + 0x18], rsi
push rdi
adc bx, dx
xchg rbx, rbx
sub rsp, 0x20
sete bh
mov esi, edx
mov ebx, ecx
jmp 0x1404dacd4
call fcn.1404ccdab
mov ecx, ebx
movsx r8d, r8w
or dil, r15b
lea r8, [rsp + 0x30]
cwd
bsr r9, r11
and ecx, 0x3ff
not edx
cwd
cmc
mov r9d, 2
movsxd rdx, r13d
cmovns rdi, r10
bt dx, 0x36
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
jmp 0x1404dad1b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test di, r13w
test r10w, 0x795
test eax, eax
jmp 0x1404dad35
je 0x1404daded
cmp ebx, dword [rsp + 0x30]
jmp 0x1404dad44
je 0x1404dadde
test esi, esi
jmp 0x1404dad51
je 0x1404dadde
mov r9, qword [rdi + 0x98]
clc
ror r8, 1
mov r8d, r10d
movsxd rax, edx
jmp 0x1404dad71
movzx edx, word [r9]
test al, 0xbb
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jbe 0x1404dad9c
sub dx, 0x61
clc
cmp dx, 0x19
jmp 0x1404dad96
ja 0x1404dadb0
movzx edx, word [rcx]
jmp 0x1404dada4
inc r8d
add rcx, 2
jmp 0x1404dad7b
or rcx, 0xffffffffffffffff
jmp 0x1404dadb9
inc rcx
test dl, 0x97
cmc
cmp word [r9 + rcx*2], r10w
jmp 0x1404dadca
jne 0x1404dadb9
cmp r8d, ecx
jmp 0x1404dadd8
je 0x1404daded
mov eax, 1
jmp 0x1404dade8
jmp 0x1404dadef
sub eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
rcr di, 0xea
xadd di, di
add rsp, 0x20
pop rdi
ret