joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a28be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test r11b, 0x81
test ecx, eax
cmp ebx, 0x13ee1154
mov qword [rsp + 0x18], rbp
cmc
cmp sil, 0x23
push rsi
bts rsi, r8
mov si, 0x2b92
btc rsi, 0x3c
push rdi
bsr edi, r15d
shr si, cl
push r12
sbb esi, 0x11f273a4
push r14
push r15
sub rsp, 0x20
mov esi, dword [r8 + 0xc]
mov r12, rcx
xchg r14w, r15w
movzx cx, dh
mov rcx, r8
movzx r14w, bpl
movzx r14d, r8w
mov rdi, r9
jmp 0x1404a2925
mov r14, r8
setle r15b
mov r15, rdx
jmp 0x1404a2934
call fcn.1401225d9
mov r10, qword [r12]
sar bpl, cl
jmp 0x1404a2945
mov ebp, eax
mov qword [rdi], r10
test r11d, eax
test esi, esi
jmp 0x1404a2954
je 0x1404a2a6a
movsxd rax, dword [r14 + 0x10]
lea ecx, [rsi - 1]
sal bx, cl
mov esi, ecx
adc bx, 0x3320
test r11b, 0x9a
lea rcx, [rcx + rcx*4]
cmc
lea rbx, [rax + rcx*4]
add rbx, qword [r15 + 8]
clc
cmp r9b, r13b
test r12b, al
cmp ebp, dword [rbx + 4]
jmp 0x1404a298b
jle 0x1404a294d
cmp ebp, dword [rbx + 8]
jmp 0x1404a2999
jg 0x1404a294d
mov rcx, qword [r15]
lea rdx, [rsp + 0x50]
xor r8d, r8d
jmp 0x1404a29af
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
bsr r9, rdi
adc r10, r10
bts r10w, r14w
sub ecx, ecx
add r8, qword [rsp + 0x50]
mov r9d, dword [rbx + 0xc]
btc r10w, 0x74
cmovl r10d, r14d
mov r10d, dword [rax]
stc
test r9d, r9d
je 0x1404a2a22
lea rdx, [r8 + 0xc]
cdqe
movsxd rax, esp
rcl al, cl
movsxd rax, dword [rdx]
cmp rax, r10
jmp 0x1404a29fd
je 0x1404a2a22
inc ecx
cmp r8w, 0x2738
test r11w, dx
add rdx, 0x14
cmc
cmp ecx, r9d
jmp 0x1404a2a1c
jb 0x1404a29f2
cmp ecx, r9d
jae 0x1404a294d
mov rax, qword [r12]
cmp esp, 0x5e2142c9
btr r15w, r13w
sbb r15b, 0xc0
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
movsx r14w, r11b
mov rcx, qword [rcx + rax]
movzx rax, ax
bsr si, bx
dec r14b
mov qword [rdi], rcx
movsx esi, di
rcl rsi, 0x85
sub bx, 0x4628
mov rbx, qword [rsp + 0x58]
cmp r15b, r12b
movzx r12, sp
mov rax, rdi
movsx r15w, dl
cmp ah, 0xfa
mov rbp, qword [rsp + 0x60]
xor r15d, esp
add rsp, 0x20
pop r15
not r14b
movsx r14w, r12b
pop r14
pop r12
pop rdi
mov sil, bl
jmp 0x1404a2aa4
pop rsi
jmp 0x1404a2aaa
ret
Function at 0x1404a7aae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
sal r10d, cl
movsxd r10, r8d
not r10b
mov qword [rax + 0x10], rbp
not r10w
mov qword [rax + 0x18], rsi
btr rsi, 0x9f
sal bh, cl
stc
mov qword [rax + 0x20], rdi
shl r10b, cl
cmp r9b, cl
push r14
push r15
movzx esi, word [rsp + 0x38]
shl bx, cl
sar bl, cl
bts r10w, bp
mov r10, r8
test r11w, r14w
setl bl
movsx rbx, r9w
sub r15d, r15d
movsxd r8, edx
mov ebx, ecx
shld cx, r11w, 0x55
mov ecx, r8d
test si, si
jmp 0x1404a7b16
jne 0x1404a7ca0
mov rax, qword [r9]
btc r11w, bx
bts r11w, r10w
sal r11b, 0xa1
mov r11, qword [r10]
cmp rax, 1
jmp 0x1404a7b39
jbe 0x1404a7c51
mov eax, 0x66666667
jmp 0x1404a7b4c
mov r8, r11
bts dx, r12w
inc cl
imul ebx
dec rax
lahf
sal al, 0x84
sar edx, 2
mov eax, edx
shr eax, 0x1f
or rcx, 0x7f375b01
add edx, eax
adc ax, 0x4a48
bt cx, r14w
movzx rax, r8w
movzx eax, dx
shl ax, 2
sar ch, cl
mov ch, 0x18
sub cx, 0x7f18
lea ecx, [rax + rdx]
movsx ax, spl
test r11w, r8w
add cx, cx
movzx rax, cx
shld rax, rdx, 0xc8
btr eax, 0x9e
sub bx, cx
bts ax, cx
rcl ax, 0x25
lahf
add bx, 0x30
mov word [r11], bx
rol bx, cl
xor ax, 0x3d48
add r11, 2
mov ax, 0x7bca
cdqe
mov rax, qword [r9]
inc bl
setno bh
movzx ebx, r14w
mov ebx, edx
dec rax
mov qword [r9], rax
test edx, edx
jmp 0x1404a7bea
jle 0x1404a7bfa
cmp rax, 1
ja 0x1404a7b3f
mov rdx, qword [r10]
jmp 0x1404a7c02
mov qword [r10], r11
jmp 0x1404a7c0a
jmp 0x1404a7c3e
movzx eax, word [rdx]
or ch, 0x4a
movzx ecx, word [r8]
test bpl, 0xcc
test r11w, r15w
mov word [r8], ax
cmp sil, 0xc5
clc
test r12w, bp
sub r8, 2
cmc
mov word [rdx], cx
cmc
add rdx, 2
test sil, r11b
cmp rdx, r8
jmp 0x1404a7c46
jb 0x1404a7c0f
jmp 0x1404a7c72
lea rax, [rax + rax]
and ebp, ebp
rol bpl, 0x70
bswap si
sub r11, rax
mov qword [r10], r11
not r14w
movsx bp, dl
xchg bpl, bpl
mov qword [r9], r15
mov rbx, qword [rsp + 0x18]
movzx rbp, sp
bswap r14d
jmp 0x1404a7c83
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
movsx r15, r15w
pop r15
pop r14
jmp 0x1404a7c9f
ret
cmp r8, qword [r9]
jmp 0x1404a7ca8
jae 0x1404a7c6f
dec r8d
clc
mov r11d, r15d
stc
test ecx, ecx
jmp 0x1404a7cbd
je 0x1404a7d7b
movsxd rax, r8d
shr rdi, 0xe7
neg edx
lea rdi, [rax + rax]
shl ax, cl
mov r14, qword [r10]
btr rax, rcx
mov eax, 0x66666667
imul ebx
mov ebp, r8d
clc
cmp r11d, r15d
sar edx, 2
adc ax, r11w
mov eax, edx
cmc
shr eax, 0x1f
test r9w, 0x6445
add edx, eax
clc
test ebx, ebx
jmp 0x1404a7d05
je 0x1404a7d47
movzx eax, dx
or ch, 0xa8
movzx rcx, r14w
shl ax, 2
rol cx, cl
lea ecx, [rax + rdx]
movsx ax, r9b
movsx eax, r12w
neg ax
add cx, cx
shr rax, 0xd0
and ah, cl
sub bx, cx
setnp al
lea eax, [rbx + 0x30]
jmp 0x1404a7d42
jmp 0x1404a7d50
movzx eax, si
movzx rbx, bx
not bh
mov word [rdi + r14], ax
movsxd rbx, esp
inc r11d
sub rdi, 2
dec r8d
sar rbx, cl
cmp r14w, bp
mov ebx, edx
cmp r12b, dl
test ebp, ebp
jmp 0x1404a7d75
jne 0x1404a7cd3
movsxd rcx, r11d
ror eax, 0x93
lea rax, [rcx + rcx]
add qword [r10], rax
cmp bl, spl
stc
sub qword [r9], rcx
jmp 0x1404a7d94
jmp 0x1404a7c72
Function at 0x1404b19a2
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404b19b2
mov qword [rsp + 0x10], rsi
test cl, r8b
push rdi
cmp esi, 0x2d181bc8
sub rsp, 0x30
bsf di, r10w
cmp cx, r8w
mov edi, edx
dec sil
mov rsi, rcx
cmc
test r8, r8
jmp 0x1404b19df
jne 0x1404b1a06
call fcn.1404b6235
mov dword [rax], 0x16
jmp 0x1404b19f5
call fcn.1404b6edf
xor eax, eax
jmp 0x1404b1a01
jmp 0x1404b1b0e
mov rdx, r9
cmovle rcx, rdi
bswap cx
mov rcx, r8
call fcn.1404b1b80
mov rbx, rax
test rax, rax
jmp 0x1404b1a23
je 0x1404b1aac
lea rax, [rsp + 0x50]
movzx rdx, r13w
mov rdx, rdi
movsxd r8, r14d
mov qword [rsp + 0x28], rax
cmovle r9, r10
movzx r8w, bpl
cbw
lea r8, [0x140094b24]
cmova r9d, ebx
movzx ecx, cx
bswap ax
mov eax, dword [rsp + 0x60]
mov r9d, 0x361857f9
mov r9, rbx
movsxd rcx, esi
sete cl
mov rcx, rsi
jmp 0x1404b1a74
mov dword [rsp + 0x20], eax
jmp 0x1404b1a7d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
stc
cmp bx, 0x2584
jmp 0x1404b1a91
test rax, rax
jne 0x1404b1b35
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b1aa7
call fcn.1404b6297
sub edi, edi
test r9, r10
cmc
test rbx, rbx
jmp 0x1404b1aba
je 0x1404b1b04
mov rcx, qword [rbx + 0x10]
cmp edx, r13d
test r8b, al
test rcx, rcx
jmp 0x1404b1ad2
je 0x1404b1ade
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
jmp 0x1404b1ae8
test rcx, rcx
je 0x1404b1af7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b1aff
call fcn.1404ca184
mov rax, rdi
clc
bsf edi, edx
sar dil, cl
mov rbx, qword [rsp + 0x40]
btr esi, esi
mov rsi, qword [rsp + 0x48]
test sil, al
mov edi, r11d
bt di, 0x17
add rsp, 0x30
sete dil
pop rdi
jmp 0x1404b1b34
ret
mov rcx, qword [rsp + 0x68]
cmp r15d, edx
test r9d, 0x1d414873
test rcx, rcx
jmp 0x1404b1b4c
je 0x1404b1b60
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
cmp bh, dl
test r14w, 0x7aa1
sub ebx, ebx
jmp 0x1404b1b67
jmp 0x1404b1ab2

Function at 0x1404b1e2f
Capabilities:
Terminate process

Disassembly:
push rbx
shl bh, 0x33
neg ebx
btc rbx, 9
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404b1e46
call fcn.1404d389c
cmp eax, 1
jmp 0x1404b1e53
je 0x1404b1e91
mov rax, qword gs:[0x60]
movsx dx, dil
mov edx, dword [rax + 0xbc]
clc
shr edx, 8
cmc
test dl, 1
jne 0x1404b1e91
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1404b1e8b
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404b1d7f
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b6f80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movsxd rcx, ecx
mov ecx, 0x17
jmp 0x1404b6f91
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b6f9e
je 0x1404b6fb5
mov ecx, 5
jmp 0x1404b6fae
int 0x29
jmp 0x1404b6fb5
mov r8d, 1
bswap rcx
mov edx, 0xc0000417
not ch
lea ecx, [r8 + 1]
jmp 0x1404b6fce
call fcn.1404b6ff7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
cwd
movsx edx, r14w
mov edx, 0xc0000417
cmp sil, 0xa7
cmc
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404c0ef8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
ror ebx, cl
cmc
rol bx, 0x3b
mov qword [rsp + 0x10], rbp
and bx, r15w
rcr ebx, 0xfe
cmp r11, 0x533f22b8
mov qword [rsp + 0x18], rsi
push r14
shld ebx, esp, 0xe1
sub rsp, 0x20
rcl bl, cl
mov rbx, rdx
xor si, 0x1584
cmp bpl, bl
lea rbp, [0x140000000]
or r14, 0x5d542607
mov dl, r12b
sbb r14d, 0x340b6e32
mov dl, byte [rcx]
cmp dx, r9w
mov r14, rcx
mov cl, dl
mov rsi, r8
sub r9d, r9d
cmc
cmp dl, byte [r9 + rbp + 0xc58dc]
jmp 0x1404c0f6a
je 0x1404c0f83
cmp dl, byte [r9 + rbp + 0xc58e0]
jmp 0x1404c0f7d
jne 0x1404c10e3
mov rax, qword [rbx]
inc r9
mov dl, byte [rax]
inc rax
xchg cl, cl
mov qword [rbx], rax
rcr cl, cl
rol cl, cl
mov cl, dl
mov byte [r14], dl
cmp r9, 3
jmp 0x1404c0fa5
jne 0x1404c0f5d
mov rsi, qword [rbx]
jmp 0x1404c0fb3
dec rsi
cmp bx, r13w
stc
mov qword [rbx], rsi
test dl, dl
jmp 0x1404c0fc5
je 0x1404c0fe6
cmp byte [rsi], dl
je 0x1404c0fe6
call fcn.1404b6235
mov dword [rax], 0x16
call fcn.1404b6edf
mov rsi, qword [rbx]
mov cl, byte [rsi]
xor al, 0x16
lea rax, [rsi + 1]
ror r8b, 0x56
mov qword [rbx], rax
stc
rcl r8b, 0xcb
sub edx, edx
dec r8b
mov byte [r14], cl
mov r8b, cl
test r9b, dil
cmp cl, byte [rdx + rbp + 0xc58e4]
jmp 0x1404c1014
je 0x1404c102c
cmp cl, byte [rdx + rbp + 0xc58ec]
jmp 0x1404c1026
jne 0x1404c113b
mov rax, qword [rbx]
jmp 0x1404c1037
inc rdx
not r8b
inc cl
mov cl, byte [rax]
inc rax
mov qword [rbx], rax
test cx, 0x6929
mov r8b, cl
mov byte [r14], cl
cmp rdx, 5
jmp 0x1404c105b
jne 0x1404c1008
mov rax, qword [rbx]
dec rax
stc
clc
mov qword [rbx], rax
test si, cx
cmp edi, eax
stc
test cl, cl
jmp 0x1404c1079
je 0x1404c10a1
cmp byte [rax], cl
jmp 0x1404c1086
je 0x1404c10a1
call fcn.1404b6235
mov dword [rax], 0x16
jmp 0x1404c109c
call fcn.1404b6edf
mov eax, 3
mov rbx, qword [rsp + 0x30]
rol r14b, 0x9a
bt r14w, cx
movzx si, r14b
mov rbp, qword [rsp + 0x38]
adc r14b, r12b
mov rsi, qword [rsp + 0x40]
movsx r14, di
movzx r14, bp
xadd r14w, r14w
add rsp, 0x20
movzx r14, cx
pop r14
jmp 0x1404c10e2
ret
mov rax, qword [rbx]
jmp 0x1404c10eb
dec rax
clc
stc
mov qword [rbx], rax
test cl, cl
jmp 0x1404c10fa
je 0x1404c111d
cmp byte [rax], cl
je 0x1404c111d
call fcn.1404b6235
mov dword [rax], 0x16
jmp 0x1404c1118
call fcn.1404b6edf
mov byte [r14], 0
movzx eax, ax
mov eax, 7
jmp 0x1404c112e
mov qword [rbx], rsi
jmp 0x1404c1136
jmp 0x1404c10a6
mov rax, qword [rbx]
dec rax
mov qword [rbx], rax
test r8b, r8b
jmp 0x1404c114c
je 0x1404c116b
cmp byte [rax], r8b
je 0x1404c116b
call fcn.1404b6235
mov dword [rax], 0x16
call fcn.1404b6edf
mov byte [r14], 0
jmp 0x1404c1174
mov qword [rbx], rsi
jmp 0x1404c117c
jmp 0x1404c10a1
Function at 0x1404c4926
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
sal al, 0xbb
sal bx, cl
ror bx, 0xfb
mov qword [r11 + 0x20], r9
rol al, cl
btr rbx, rsp
shrd ebx, esp, 0x45
mov dword [rsp + 0x10], edx
push rbp
shr ah, cl
push rsi
cmp r12b, cl
rcr esi, cl
push rdi
sub al, r10b
push r12
push r13
movsxd rbx, r13d
or r13b, bl
shr bh, 0xc6
push r14
test r15b, r15b
neg r12b
push r15
sub rsp, 0x20
btr r15, 0x98
mov rax, qword [rcx + 8]
xchg r12b, bl
sub bpl, bpl
rol r13b, 2
btc r13w, 0x68
adc r12d, 0x3f327ef3
sub r14b, r14b
mov qword [r11 + 8], rax
rol bx, 0x9c
sub edi, edi
mov r12, r9
adc ebx, 0x7dea0c9c
xor sil, 0x63
mov r13d, r8d
and ebx, 0x25456d6d
movsx si, dl
mov rbx, rcx
setge r15b
sar sil, cl
shr r15w, 0xd8
lea rsi, [rax - 1]
adc r15b, bl
rcl r15b, cl
mov r15, rsi
cmp dword [rcx], edi
jmp 0x1404c49db
jle 0x1404c4a77
mov r12d, dword [r11 + 0x10]
cmp spl, 0xaa
clc
cmp edi, r12d
jmp 0x1404c49f2
jne 0x1404c4a01
mov rsi, rax
mov bpl, pe_nt_image_headers64
mov bpl, 1
cmp edi, r13d
jne 0x1404c4a18
mov r15, rax
rcr r14b, cl
mov r14b, 1
cmc
test ax, 0x24b2
test bpl, bpl
jmp 0x1404c4a20
je 0x1404c4a34
test r14b, r14b
jmp 0x1404c4a2e
jne 0x1404c4a67
lea rdx, [rsp + 0x60]
mov cx, sp
mov rcx, rbx
jmp 0x1404c4a44
call fcn.14028873f
inc edi
cmp edi, dword [rbx]
jmp 0x1404c4a52
jge 0x1404c4a67
mov rax, qword [rsp + 0x60]
jmp 0x1404c4a62
jmp 0x1404c49ea
mov r12, qword [rsp + 0x78]
shl dil, cl
rol bpl, cl
bts ax, r12w
mov rax, qword [r12]
mov qword [r12 + 8], rsi
movups xmm0, xmmword [rbx]
test r11w, si
sal r14b, cl
movups xmmword [rax], xmm0
add cx, r11w
bts r14w, r12w
movups xmm1, xmmword [rbx + 0x10]
or r12w, bx
stc
movups xmmword [rax + 0x10], xmm1
mov rax, qword [rsp + 0x80]
rcl ebp, cl
test r11w, 0x23b8
xadd rbp, r14
mov rcx, qword [rax]
movzx rsi, cx
movsx si, r13b
movsx edi, cx
mov qword [rax + 8], r15
not r13b
sbb si, r13w
mov r14d, esp
movups xmm0, xmmword [rbx]
btc ebp, 0x1d
movups xmmword [rcx], xmm0
cmp cl, bl
bsf r14w, r13w
adc r13, 0x3ca918d4
movups xmm1, xmmword [rbx + 0x10]
clc
mov rbx, qword [rsp + 0x70]
movups xmmword [rcx + 0x10], xmm1
rcr r15d, 0xdf
shl r13b, 0x1e
add rsp, 0x20
jmp 0x1404c4b0f
pop r15
movzx ebp, bx
movsx r14w, r9b
pop r14
bswap bp
cmovb rdi, r11
movsxd rdi, r11d
pop r13
movzx r12, r12w
jmp 0x1404c4b35
pop r12
pop rdi
not rbp
pop rsi
movzx rbp, r13w
pop rbp
jmp 0x1404c4b46
ret
Function at 0x1404cb647
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
xchg r9b, dl
bts bx, ax
sal bx, cl
sub rsp, 0x20
movsxd rbx, ebx
not r9b
setno bh
mov rbx, rcx
cwd
movzx rdx, dx
cqo
lea r9, [0x1400c63c0]
movsxd r8, r11d
jmp 0x1404cb67f
mov ecx, 3
xchg dl, r8b
lea r8, [0x1400c63b8]
movsxd rdx, r14d
lea rdx, [0x1400cfb70]
jmp 0x1404cb69d
call fcn.1404cc695
test rax, rax
je 0x1404cb6c3
mov rcx, rbx
add rsp, 0x20
movzx rbx, r14w
pop rbx
jmp 0x1404cb6bc
push qword [0x1400b8d90]
ret
add rsp, 0x20
mov bx, 0x473e
pop rbx
jmp 0x1404cb6d1
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404cb76f
Capabilities:
Get thread local storage value

Disassembly:
push rbx
stc
movsx rdx, r8w
sub rsp, 0x20
cwd
mov ebx, ecx
cdq
lea r9, [0x1400c63d0]
cdq
xchg r8b, r8b
mov ecx, 5
mov r8b, r9b
lea r8, [0x1400c63c8]
movsx edx, di
movsx rdx, r10w
movzx dx, r15b
lea rdx, [0x1400cf758]
jmp 0x1404cb7b1
call fcn.1404cc695
mov ecx, ebx
test rax, rax
jmp 0x1404cb7c0
je 0x1404cb7e4
add rsp, 0x20
setno bl
jmp 0x1404cb7d7
pop rbx
jmp 0x1404cb7dd
push qword [0x1400b8d90]
ret
add rsp, 0x20
movzx bx, r8b
mov bh, 6
movzx rbx, dx
pop rbx
jmp 0x1404cb7fa
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404cb801
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
shl r9b, 0x83
and r8, 0x32e6131b
push rdi
inc r8w
sub rsp, 0x20
not di
xchg r8b, dil
bswap r9d
mov rbx, rdx
movsx edi, bx
movsx rdx, r9w
cmovbe r8w, r10w
lea r9, [0x1400c63d8]
cmovbe rdi, rdx
mov edi, ecx
movzx ecx, r12w
lea rdx, [0x1400cf748]
movsx r8w, r11b
movzx r8d, dx
movzx r8, si
mov ecx, 6
jmp 0x1404cb861
lea r8, [0x1400c63d0]
jmp 0x1404cb86d
call fcn.1404cc695
mov rdx, rbx
btc cx, r9w
mov ecx, edi
test esi, 0x2ead4e0f
test rax, rax
jmp 0x1404cb88a
je 0x1404cb89b
call qword [0x1400b8d90]
jmp 0x1404cb8a1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
clc
shl di, 0xba
add rsp, 0x20
mov dil, r12b
pop rdi
ret

Function at 0x1404cba4a
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
or rbx, rcx
shrd rbp, r10, 0xd6
add bpl, bl
mov qword [rsp + 0x18], rsi
push rdi
bsf bx, cx
shr bpl, cl
mov dil, r11b
sub rsp, 0x30
mov ebx, r9d
not bpl
mov rdi, r8
mov esi, edx
setp bpl
lea r9, [0x1400c63e8]
setne bpl
cqo
movsx dx, r8b
mov rbp, rcx
mov dl, r10b
movzx cx, al
lea r8, [0x1400c63e0]
cqo
lea rdx, [0x1400cf190]
not cl
mov ecx, 0xb
jmp 0x1404cbaba
call fcn.1404cc695
mov rcx, rbp
cmp di, 0x3e30
test rax, rax
jmp 0x1404cbacf
je 0x1404cbaf5
mov r9d, ebx
mov r8, rdi
movzx dx, r9b
bswap dx
mov edx, esi
jmp 0x1404cbaea
call qword [0x1400b8d90]
jmp 0x1404cbb27
sub edx, edx
jmp 0x1404cbafc
call fcn.1404cc155
mov ecx, eax
cdq
mov r9d, ebx
not dl
movsx r8w, r9b
mov dl, r12b
mov r8, rdi
movzx rdx, di
cwd
mov edx, esi
jmp 0x1404cbb21
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
cmc
xadd si, di
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
bts edi, r14d
movsxd rdi, esi
rcl di, cl
add rsp, 0x30
jmp 0x1404cbb51
pop rdi
jmp 0x1404cbb57
ret
Function at 0x1404cf9ab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
btc rcx, 0x85
mov qword [rax + 8], rbx
movsx rcx, cx
mov qword [rax + 0x10], rbp
xadd cl, bl
or bl, r10b
rcl ebx, 0xc7
mov qword [rax + 0x18], rsi
sal rbx, cl
movzx ecx, r12w
mov qword [rax + 0x20], rdi
sub cl, spl
bts rdi, rdx
push r14
sub rsp, 0x20
cdqe
sbb ch, 0xdc
xor esi, esi
or edi, 0x7f11463c
stc
shl ebx, cl
sub r14d, r14d
and rdi, r9
movsxd rcx, esi
shr rbx, cl
add ah, 0x72
lea rdi, [0x1400ba940]
mov rax, rcx
bt ebx, 0xc2
sbb bl, r14b
and ecx, 0x3f
bts ebx, ecx
sar rax, 6
shrd ebx, r10d, 0x2e
xor ebx, 0x60d7022a
lea rbx, [rcx + rcx*8]
cmc
test r10w, 0x4e2
mov rdi, qword [rdi + rax*8]
movsx eax, r12w
movsxd rax, edi
cmp r8b, r13b
mov rax, qword [rdi + rbx*8 + 0x28]
cmc
cmp sil, 0x8d
add rax, 2
cmc
cmp rax, 1
jbe 0x1404cfa6a
or byte [rdi + rbx*8 + 0x38], 0x80
jmp 0x1404cfa65
jmp 0x1404cfb83
mov byte [rdi + rbx*8 + 0x38], 0x81
movzx ecx, r10w
mov ecx, esi
jmp 0x1404cfa7b
test esi, esi
jmp 0x1404cfa82
je 0x1404cfab7
sub ecx, 1
jmp 0x1404cfa90
je 0x1404cfaa8
cmp ecx, 1
mov ecx, 0xfffffff4
jmp 0x1404cfaa3
jmp 0x1404cfac1
mov ecx, 0xfffffff5
jmp 0x1404cfab2
jmp 0x1404cfac1
mov ecx, 0xfffffff6
jmp 0x1404cfac1
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
add rcx, rcx
xadd ch, ch
lea rcx, [rax + 1]
clc
cmp rcx, 1
jmp 0x1404cfade
jbe 0x1404cfaf7
mov rcx, rax
jmp 0x1404cfaec
call qword [sym.imp.KERNEL32.dll_GetFileType]
jmp 0x1404cfaf9
xor eax, eax
test eax, eax
jmp 0x1404cfb00
je 0x1404cfb49
movzx ecx, al
mov qword [rdi + rbx*8 + 0x28], rbp
cmc
cmp ecx, 2
jmp 0x1404cfb17
jne 0x1404cfb2c
or byte [rdi + rbx*8 + 0x38], 0x40
jmp 0x1404cfb27
jmp 0x1404cfb83
cmp ecx, 3
jmp 0x1404cfb34
jne 0x1404cfb83
or byte [rdi + rbx*8 + 0x38], 8
jmp 0x1404cfb44
jmp 0x1404cfb83
or byte [rdi + rbx*8 + 0x38], 0x40
mov qword [rdi + rbx*8 + 0x28], 0xfffffffffffffffe
movzx ax, r11b
bswap rax
btr eax, 0xee
mov rax, qword [0x1400ba160]
test rax, rax
je 0x1404cfb83
mov rax, qword [r14 + rax]
mov dword [rax + 0x18], 0xfffffffe
jmp 0x1404cfb83
inc esi
cmp r12b, 0x6f
add r14, 8
cmp esi, 3
jmp 0x1404cfb95
jne 0x1404cf9fa
mov rbx, qword [rsp + 0x30]
and sil, 0x70
shr si, 0x64
mov rbp, qword [rsp + 0x38]
movsx di, spl
inc sil
adc dil, 0xa4
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
btr r14, rsi
add rsp, 0x20
setg r14b
mov r14b, 0xf
movsxd r14, edi
pop r14
jmp 0x1404cfbdc
ret
Function at 0x1404d039f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
btc rbx, 0x2d
btr bx, 9
mov qword [rsp + 0x10], rbp
movzx bp, r11b
add r8b, 0x9b
mov qword [rsp + 0x18], rsi
xor bpl, r10b
push rdi
sub rsp, 0x20
shl rbp, cl
btr bp, 0xfa
lea rbx, [rcx + 0x18]
inc r8
btr bp, bx
mov rsi, rcx
cmp ebx, edx
or r8b, 0xc7
and bpl, 0xfd
mov ebp, 0x101
add r8b, r15b
cmovno cx, r14w
mov rcx, rbx
mov r8d, ebp
test cx, cx
cmp r10w, si
clc
sub edx, edx
jmp 0x1404d040b
call fcn.1404a4d25
sub eax, eax
movzx cx, sil
cmovp rdi, r14
lea rdi, [rsi + 0xc]
movsx rcx, dx
mov qword [rsi + 4], rax
movzx ecx, di
movzx cx, r9b
mov ecx, 6
mov qword [rsi + 0x220], rax
jmp 0x1404d0440
movzx eax, ax
jmp 0x1404d0448
rep stosw word [rdi], ax
sbb dil, dil
bt di, bx
lea rdi, [0x1400b77b0]
sub rdi, rsi
mov al, byte [rdi + rbx]
jmp 0x1404d0464
mov byte [rbx], al
jmp 0x1404d046b
inc rbx
sub rbp, 1
jmp 0x1404d0477
jne 0x1404d045c
lea rcx, [rsi + 0x119]
mov edx, 0x100
mov al, byte [rcx + rdi]
jmp 0x1404d0491
mov byte [rcx], al
jmp 0x1404d0498
inc rcx
cmp rcx, rdx
test rsi, r8
sub rdx, 1
jmp 0x1404d04aa
jne 0x1404d0489
mov rbx, qword [rsp + 0x30]
inc bp
bts si, dx
mov rbp, qword [rsp + 0x38]
sub esi, r12d
movsxd rdi, ebp
mov rsi, qword [rsp + 0x40]
rcl dil, cl
rcr dil, cl
ror rdi, cl
add rsp, 0x20
pop rdi
jmp 0x1404d04df
ret
Function at 0x1404d848c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
ror bl, cl
movsx rbx, sp
mov qword [rsp + 0x18], rsi
sbb bx, r15w
btr ebx, edi
push rdi
bswap di
sub rsp, 0x20
shr bh, cl
stc
xor esi, esi
adc di, 0x553d
bsf bx, r10w
bswap di
mov rdi, rdx
bt bx, r14w
mov ebx, 0x564b75cc
shl ebx, 0x70
mov rbx, rcx
cmc
cmp al, cl
test rcx, rcx
jmp 0x1404d84db
je 0x1404d858f
cmp word [rcx], si
jmp 0x1404d84e9
je 0x1404d858f
lea rdx, [0x1400d1d08]
jmp 0x1404d84fb
call fcn.140112fe4
test eax, eax
jmp 0x1404d8507
je 0x1404d858f
lea rdx, [0x1400d1d00]
xchg rcx, rcx
bswap cx
jmp 0x1404d851f
mov rcx, rbx
jmp 0x1404d8527
call fcn.140112fe4
test eax, eax
jmp 0x1404d8533
jne 0x1404d857d
mov ecx, dword [rdi + 8]
movzx r8w, r10b
movzx r9d, r12w
cdq
lea r9d, [rsi + 2]
mov dl, dil
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
jmp 0x1404d855c
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d8569
je 0x1404d85c6
mov eax, dword [rsp + 0x30]
jmp 0x1404d8578
jmp 0x1404d85ee
mov rcx, rbx
jmp 0x1404d8585
call fcn.1404e1554
jmp 0x1404d85ee
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9, 0x58724034
cdq
movzx dx, cl
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d85b3
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d85c0
jne 0x1404d85d2
sub eax, eax
jmp 0x1404d85cd
jmp 0x1404d85ee
mov eax, dword [rsp + 0x30]
cmc
test dil, r15b
stc
test eax, eax
jmp 0x1404d85e2
jne 0x1404d85ee
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
xadd rdi, rdi
adc si, r15w
clc
mov rsi, qword [rsp + 0x40]
rol di, cl
btc di, 0xa9
adc edi, 0x38176623
add rsp, 0x20
movsx rdi, r13w
movsxd rdi, edi
pop rdi
jmp 0x1404d8620
ret
Function at 0x1404d8621
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
shr ebx, 0x6b
mov qword [rsp + 0x18], rsi
adc si, 0x2a3e
neg bh
push rdi
dec rsi
test cl, r14b
rol esi, 0xd9
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
jmp 0x1404d864c
call fcn.1404ca4a6
mov ecx, ebx
movsx r9d, r9w
cmc
shrd rdx, rsi, 0xf5
lea r8, [rsp + 0x30]
and rdi, rsi
setno r9b
and ecx, 0x3ff
movsxd r9, r12d
btc edi, 8
mov r9d, 2
cwd
setle dh
bts ecx, 0xa
movzx rdx, bx
cdq
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test eax, eax
jmp 0x1404d86a2
je 0x1404d876c
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d86b1
je 0x1404d875d
test esi, esi
je 0x1404d875d
mov r9, qword [rdi + 0x98]
movzx r8d, bx
cbw
btc dx, r14w
mov r8d, r10d
shld edx, r15d, 0xa0
shl ah, 0x5b
movzx edx, word [r9]
mov eax, eax
btr cx, 0xec
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
jmp 0x1404d86f3
cmp ax, 0x19
jmp 0x1404d86fc
jbe 0x1404d871b
sub dx, 0x61
clc
test ax, r11w
stc
cmp dx, 0x19
jmp 0x1404d8715
ja 0x1404d872f
movzx edx, word [rcx]
inc r8d
add rcx, 2
jmp 0x1404d872a
jmp 0x1404d86eb
or rcx, 0xffffffffffffffff
jmp 0x1404d8738
inc rcx
cmp bp, r13w
cmp word [r9 + rcx*2], r10w
jmp 0x1404d8749
jne 0x1404d8738
cmp r8d, ecx
jmp 0x1404d8757
je 0x1404d876c
mov eax, 1
jmp 0x1404d8767
jmp 0x1404d8778
sub eax, eax
bts si, sp
xchg dil, bl
or dil, al
mov rbx, qword [rsp + 0x38]
cmp r12b, 0x27
or dil, 0xeb
cmovns di, r10w
mov rsi, qword [rsp + 0x40]
movsx edi, bp
add rsp, 0x20
pop rdi
jmp 0x1404d879c
ret