joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14045deef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
ror ax, 0x74
inc rbx
not bh
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
xchg rbx, rax
movsx bx, sil
sub rsp, 0x80
rcr eax, cl
lahf
mov rax, qword [0x1400b7288]
shl bh, cl
xor rax, rsp
mov qword [rbp - 0x10], rax
stc
mov rax, qword [rcx + 8]
add bx, 0x43c6
setge bh
mov rbx, rdx
mov qword [rbp - 0x58], rdx
clc
stc
test rax, rax
jmp 0x14045df4a
je 0x14045dfe0
mov rdx, qword [rax + 0x28]
test bpl, 0xab
clc
test rdx, rdx
jmp 0x14045df61
jne 0x14045df70
lea rdx, [rax + 0x30]
jmp 0x14045df70
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x30], xmm0
cmp al, 0x40
or r8, 0xffffffffffffffff
jmp 0x14045df85
movdqu xmmword [rbp - 0x20], xmm1
jmp 0x14045df8f
inc r8
cmp byte [rdx + r8], 0
jmp 0x14045df9c
jne 0x14045df8f
lea rcx, [rbp - 0x30]
jmp 0x14045dfab
call fcn.140456668
sub r8d, r8d
cdqe
cwde
lea rax, [rbp - 0x30]
movsx rdx, r13w
mov di, r12w
movzx edx, sp
lea rcx, [rbp - 0x20]
xchg dh, dl
lea rdx, [rbp - 0x18]
not dil
lea edi, [r8 + 1]
jmp 0x14045dfdb
jmp 0x14045e020
movdqa xmm1, xmmword [0x1400bd400]
lea rax, [rbp - 0x50]
sub edi, edi
cmovb cx, r13w
lea rcx, [rbp - 0x40]
jmp 0x14045dffc
xorps xmm0, xmm0
lea rdx, [rbp - 0x38]
movups xmmword [rbp - 0x50], xmm0
shl r8b, 0xa7
mov byte [rbp - 0x50], 0
rcl r8b, cl
lea r8d, [rdi + 2]
movdqu xmmword [rbp - 0x40], xmm1
test rsp, r12
cmc
stc
movups xmm0, xmmword [rax]
jmp 0x14045e029
movups xmm1, xmmword [rax + 0x10]
cmp dil, 0x45
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
cmp r9w, sp
and qword [rcx], 0
jmp 0x14045e045
mov qword [rdx], 0xf
clc
test r9, 0x20c32c34
mov byte [rax], 0
test ah, 0x97
test r8d, r8d
jmp 0x14045e062
je 0x14045e0d3
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14045e0d3
mov rcx, qword [rbp - 0x50]
movzx rax, r15w
inc rdx
movzx eax, r14w
xadd al, ah
mov al, r14b
mov rax, rcx
stc
cmp r10b, 0xcb
test dl, r13b
cmp rdx, 0x1000
jmp 0x14045e0a2
jb 0x14045e0ce
mov rcx, qword [rcx - 8]
add rdx, 0x27
jmp 0x14045e0b7
sub rax, rcx
cmc
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jmp 0x14045e0c8
ja 0x14045e192
call fcn.140232287
test edi, edi
jmp 0x14045e0da
je 0x14045e14f
mov rdx, qword [rbp - 0x18]
jmp 0x14045e0e9
cmp rdx, 0x10
jmp 0x14045e0f2
jb 0x14045e14f
mov rcx, qword [rbp - 0x30]
jmp 0x14045e101
inc rdx
rol ax, 2
or ax, 0x7b77
mov rax, rcx
test dil, r12b
cmp rdx, 0x1000
jmp 0x14045e11e
jb 0x14045e14a
mov rcx, qword [rcx - 8]
stc
cmc
add rdx, 0x27
sub rax, rcx
stc
jmp 0x14045e137
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jmp 0x14045e144
ja 0x14045e192
call fcn.140232287
mov rax, rbx
movzx cx, r15b
mov cl, r9b
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14049edb0
lea r11, [rsp + 0x80]
setp bpl
movzx di, r13b
mov rbx, qword [r11 + 0x20]
bswap bp
movzx ebp, di
mov rdi, qword [r11 + 0x28]
mov rsp, r11
mov ebp, r10d
pop rbp
jmp 0x14045e191
ret
call fcn.1404b549a
int3
Function at 0x14045e19d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
cmc
jmp 0x14045e1b4
mov qword [rax + 0x18], rbp
dec bp
shl bp, 0xc
xchg bpl, bpl
push rsi
push rdi
movsx bp, r15b
shl bpl, cl
or ebp, eax
push r12
push r14
movsx rbp, bp
xor bp, ax
push r15
btr r15w, 0x8e
rcl r15w, 0xf1
test r9b, 0x56
sub rsp, 0x40
xor r12d, r12d
btr bp, 0x66
stc
mov r15, r8
rcr rbp, cl
mov qword [rax + 0x20], r12
sar ebp, 8
rol bpl, 0x99
or rdi, 0xffffffffffffffff
mov rbp, rcx
jmp 0x14045e214
inc rdi
cmp ah, 0xf1
clc
cmp byte [rdi + rcx], r12b
jne 0x14045e214
add rdi, 1
mov rbx, r12
mov rsi, rdi
cmovp r14, rbp
mov r14, rcx
je 0x14045e2a2
lea r9, [rsp + 0x88]
movsxd rdx, r15d
movzx edx, r8w
cdq
mov qword [rsp + 0x20], r15
movzx r8d, r14w
not edx
jmp 0x14045e25c
mov r8, rsi
lea rcx, [rsp + 0x70]
bswap dx
mov rdx, r14
call fcn.140458b31
test eax, eax
jmp 0x14045e276
jle 0x14045e2a2
cdqe
jmp 0x14045e283
inc rbx
test r11b, r11b
cmp rdi, rcx
jmp 0x14045e291
add r14, rax
sub rsi, rax
jmp 0x14045e29c
jne 0x14045e23c
inc rbx
movsxd rdx, eax
movzx ecx, bx
jmp 0x14045e2b0
mov edx, 2
mov cl, r13b
movsxd rcx, r8d
jmp 0x14045e2c0
mov rcx, rbx
jmp 0x14045e2c8
call fcn.1401212e0
mov r14, rax
cmp r14b, bl
test al, r8b
test rax, rax
jmp 0x14045e2de
je 0x14045e3af
mov qword [rsp + 0x30], r12
mov rsi, rax
test rbx, rbx
jmp 0x14045e2f4
je 0x14045e344
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
cdq
movsx rcx, si
mov r8, rdi
xchg rcx, rdx
cqo
not cl
mov rdx, rbp
cmovnp ecx, edx
mov rcx, rsi
call fcn.140458b31
test eax, eax
jle 0x14045e344
cdqe
add rsi, 2
lea rbp, [rbp + rax]
stc
sub rbx, 1
jmp 0x14045e33e
jne 0x14045e2fa
lea r11, [rsp + 0x40]
bswap ax
mov word [rsi], r12w
movzx rbp, bx
movzx bp, dil
mov rbx, qword [r11 + 0x38]
mov al, sil
movsx ax, sil
lahf
mov rax, r14
setns sil
mov r15, 0x77e378cc
bswap bp
mov rbp, qword [r11 + 0x40]
mov rsp, r11
movsx si, r13b
bswap r12w
pop r15
movsx r14d, r13w
movsxd rsi, ebx
cmovno esi, ecx
pop r14
xchg dil, dil
pop r12
xchg dil, dil
pop rdi
movsx rsi, dx
movzx rsi, r14w
bswap esi
pop rsi
jmp 0x14045e3ae
ret
call fcn.1404582cd
int3
Function at 0x1404910bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
test ax, 0x3367
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
bt ebx, 0x61
or bl, 0xbc
xor bx, 0x555b
mov qword [rax + 0x20], rdi
rcl bpl, 0x61
sar ebx, cl
rol bpl, 0x66
push r14
movsx bx, r8b
btr bp, 0x69
sal bh, 9
sub rsp, 0x20
mov rsi, r9
ror r14w, cl
sar r14b, 0xb1
bts r14w, cx
mov r14, r8
shld rbx, rsp, 0xca
shr bl, 0x5c
clc
mov rbx, rdx
ror bp, 0xb4
rol bpl, cl
mov rbp, rcx
test ah, cl
jmp 0x14049112c
cmp rdx, r8
je 0x14049120e
mov rdi, qword [r9 + 8]
test rdi, rdi
jmp 0x140491141
je 0x1404911f3
mov rax, qword [rdi + 0x40]
sbb r8d, r10d
bts r8, r15
and r8d, r12d
movzx r8d, word [rbx]
cmp qword [rax], 0
jmp 0x140491162
je 0x1404911b1
mov rax, qword [rdi + 0x58]
clc
cmp dword [rax], 0
jmp 0x140491175
jle 0x1404911b1
dec dword [rax]
movzx rcx, dx
cdq
cmove rdx, r14
mov rcx, qword [rdi + 0x40]
mov rdx, qword [rcx]
mov al, r12b
cbw
movzx ax, r12b
lea rax, [rdx + 2]
jmp 0x1404911a0
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x1404911ac
jmp 0x1404911df
mov rax, qword [rdi]
movzx ecx, bp
movzx edx, r8w
movsx ecx, cx
xchg cl, ch
mov cx, 0x67fb
mov rcx, rdi
jmp 0x1404911cc
mov rax, qword [rax + 0x18]
jmp 0x1404911d5
call qword [0x1400b8d90]
movzx r8d, ax
mov eax, 0xffff
cmp ax, r8w
jmp 0x1404911ed
jne 0x1404911fb
mov byte [rsi], 1
jmp 0x1404911fb
add rbx, 2
jmp 0x140491205
cmp rbx, r14
jne 0x140491139
movups xmm0, xmmword [rsi]
mov al, sil
lahf
mov rbx, qword [rsp + 0x30]
and edi, r11d
test edi, 0x6b3008a1
shl di, cl
mov rax, rbp
rcr dil, 0x12
btc si, r9w
xadd r14b, r14b
mov rsi, qword [rsp + 0x40]
ror r14b, 0x95
mov rdi, qword [rsp + 0x48]
shrd r14, r9, 0x85
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
xor r14b, dl
and r14w, dx
adc r14, 0x5dcc2fb1
add rsp, 0x20
mov r14b, 0xf1
pop r14
jmp 0x14049126f
ret
Function at 0x14049de5e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp sil, sil
mov qword [rax + 0x10], rbx
cmp r12w, 0x4c52
mov qword [rax + 0x18], rbp
sal rbp, 0x15
sbb bpl, bl
mov qword [rax + 0x20], rsi
btr bp, bx
mov bpl, 0xfd
neg si
push rdi
btr di, r13w
push r14
push r15
and sil, 0x8c
movzx r14w, cl
sub rsp, 0x20
or si, r8w
bsr r14d, esp
cmovbe di, r9w
test rdx, rdx
lea r14, [rax + 8]
jmp 0x14049deb7
mov rbp, rcx
mov rdi, rcx
movsx esi, r14w
movzx ecx, byte [rcx]
xchg r15w, r15w
movzx r15, dx
bswap r15w
cmovne r14, rdx
movsx esi, si
movsx si, r12b
mov r15, r9
movsx esi, sp
movzx esi, sp
mov esi, r8d
jmp 0x14049def8
inc rdi
movzx ecx, byte [rdi]
jmp 0x14049def8
call fcn.1404b73cf
test eax, eax
jmp 0x14049df04
jne 0x14049deed
mov bl, byte [rdi]
cmovns rax, r12
movsx ax, sil
lea eax, [rbx - 0x2b]
cmp r13b, 0x6c
stc
test al, 0xfd
je 0x14049df31
mov bl, 0x2b
jmp 0x14049df2c
jmp 0x14049df34
inc rdi
mov r9, r15
mov r8d, esi
mov rdx, r14
mov rcx, rdi
call fcn.14049e071
mov ecx, eax
xchg rsi, rsi
test bpl, r14b
neg sil
mov esi, 0x7fffffff
cmc
cmp sil, r11b
cmp rdi, qword [r14]
jne 0x14049df6f
mov qword [r14], rbp
jmp 0x14049df6a
jmp 0x14049df7d
cmp rbp, qword [r14]
jmp 0x14049df77
jne 0x14049df8a
test ecx, ecx
jmp 0x14049df84
jne 0x14049dfc4
cmp bl, 0x2b
jmp 0x14049df92
jne 0x14049dfa5
cmp ecx, esi
jmp 0x14049df9f
ja 0x14049dfc4
cmp bl, 0x2d
jmp 0x14049dfad
jne 0x14049e00f
cmp ecx, 0x80000000
jmp 0x14049dfbe
jbe 0x14049e00f
call fcn.1404b4780
mov dword [rax], 0x22
stc
jmp 0x14049dfd6
test r15, r15
jmp 0x14049dfde
je 0x14049dfeb
mov dword [r15], 1
mov eax, 0x80000000
test r13b, 0x1a
clc
cmp bl, 0x2d
jmp 0x14049dffd
cmove esi, eax
movsxd rax, r10d
jmp 0x14049e008
mov eax, esi
jmp 0x14049e027
neg eax
setg sil
xor bp, r10w
cmp bl, 0x2d
not r15
movsxd r14, ebp
cmove ecx, eax
mov eax, ecx
mov rbx, qword [rsp + 0x48]
shl r14b, cl
mov rbp, qword [rsp + 0x50]
sub esi, 0x295814b2
shld rsi, r11, 0x13
mov rsi, qword [rsp + 0x58]
bsf r15d, r13d
test r14b, 0x26
sub r15b, 0x9d
add rsp, 0x20
movsx edi, bp
bswap di
pop r15
setp r14b
pop r14
movsx edi, r10w
movzx edi, r9w
pop rdi
jmp 0x14049e070
ret

Function at 0x14049f701
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
jmp 0x14049f70a
and dword [rsp + 0x30], 0
jmp 0x14049f714
call fcn.1404a9a6e
mov r9d, 2
bswap dx
lea r8, [rsp + 0x30]
jmp 0x14049f731
mov rcx, qword [rax + 0x28]
mov dx, 0x4063
movzx dx, r9b
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp dl, 0x13
stc
sub ecx, 0x30
jmp 0x14049f759
je 0x14049f7a0
sub ecx, 1
jmp 0x14049f767
je 0x14049f791
cmp ecx, 1
je 0x14049f782
sub eax, eax
jmp 0x14049f77d
jmp 0x14049f7a8
mov eax, 3
jmp 0x14049f78c
jmp 0x14049f7a8
mov eax, 1
jmp 0x14049f79b
jmp 0x14049f7a8
mov eax, 2
cmp r12b, al
add rsp, 0x28
jmp 0x14049f7b1
ret
Function at 0x1404a05d5
Capabilities:
Terminate process

Disassembly:
add dword [rax], eax
add byte [rsi + 0x33f6d08a], ah
sbb dword [rdi - 0x6edff30d], edx
fdiv st(2)
invalid
mov edi, 0xe1a71c6b
rcr dword [rax + 0x1f77d3d], 0x90
mov edi, 0x4d313857
lodsb al, byte [rsi]
xor byte [rax + 0x5d], dl
add ch, bh
out dx, eax
out dx, eax
invalid
or dword [rbx + 0xfd], ebp
jbe case.0x1404a0622.9
mov dword [rax + 0x5b], esp
mul bh
jae 0x140177759
invalid
invalid
invalid
add byte [rdi], ch
add byte [rdi - 0x5c3c44dd], cl
invalid
and edi, dword [rbx - 0x1db05c3d]
invalid
invalid
cwde
cld
sar byte [rdx], 1
invalid
jmp [rbx - 0x1bf81be9]
mov edx, dword [rsi - 0xe]
add dword [rbp + 0x6b], edx
invalid
pop rsp
jl 0x140177745
test eax, 0xb1f4d192
iretd
invalid
fsub st(5), st(0)
invalid
invalid
push rbx
movsxd rbx, ebx
sub rsp, 0x20
or bh, bl
mov rbx, rcx
xor ecx, ecx
jmp 0x1404a05ea
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a05f8
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
sbb dx, 0x4296
rcl ebx, cl
mov edx, 0xc0000409
stc
bts rbx, rdx
add rsp, 0x20
pop rbx
jmp switch.0x1404a0622
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404a1412
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bt rbx, rbp
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
btr bx, 0x91
shl bpl, 0xf0
movzx rbx, si
push rdi
push r12
push r13
movzx rdi, di
sal r12, cl
push r14
test ebp, 0x6d597562
push r15
xor dil, spl
sub rsp, 0x40
mov r15, rsp
not rbp
mov rbx, qword [rsp + 0x90]
movzx rdi, si
movsx rbp, r10w
not r14b
mov r12, rdx
cdq
cwd
cmovnp edi, edi
mov rbp, rcx
movsx cx, spl
xchg r15b, r14b
mov rdx, r9
mov rdi, 0x47b612bf
mov rcx, rbx
movsx edi, r15w
not r15b
mov rdi, r9
mov r15d, r8d
cmovae r14w, ax
movsx r14, r9w
mov r14d, dword [rbx + 0xc]
jmp 0x1404a14a8
call fcn.14012e26c
sub r10d, r10d
cmp r14b, r14b
mov esi, eax
clc
stc
test r14d, r14d
jmp 0x1404a14bf
je 0x1404a1705
mov r11, qword [rdi + 8]
rcr rdx, 0x62
or eax, 0xffffffff
or r13b, cl
btr r9, rbx
ror r9b, 0xa
movsxd rbx, dword [rbx + 0x10]
sal dh, 0xcc
mov r9d, eax
clc
sbb r8w, 0x5c5c
mov r13d, eax
movsx ax, r9b
mov edx, r14d
lea r8d, [rdx - 1]
shr cx, 0x3b
lea rcx, [r8 + r8*4]
and ax, ax
rol ax, cl
lea rax, [r11 + rcx*4]
cmp esi, dword [rax + rbx + 4]
jmp 0x1404a1516
jle 0x1404a1526
cmp esi, dword [rax + rbx + 8]
jle 0x1404a1537
mov edx, r8d
test r8d, r8d
jmp 0x1404a1531
jne 0x1404a14f7
mov r8d, r10d
jmp 0x1404a1542
test edx, edx
jmp 0x1404a1549
je 0x1404a1573
lea eax, [rdx - 1]
shld dx, si, 0x8f
lea rax, [rax + rax*4]
lea rdx, [rbx + rax*4]
cmp r13, 0xfd732c8
add rdx, r11
jmp 0x1404a156e
jmp 0x1404a1582
mov rdx, r10
bsr cx, r8w
rcl cl, 0x41
btc ecx, 0x8c
lea rcx, [r11 + rbx]
cmp r14b, r10b
stc
or r11d, 0xffffffff
jmp 0x1404a1597
test rdx, rdx
jmp 0x1404a159f
je 0x1404a15ca
mov eax, dword [rdx + 4]
jmp 0x1404a15ad
cmp dword [rcx], eax
jle 0x1404a1601
mov eax, dword [rdx + 8]
cmp sil, r8b
jmp 0x1404a15c1
cmp dword [rcx + 4], eax
jg 0x1404a1601
cmp r15d, dword [rcx]
jmp 0x1404a15d2
jl 0x1404a1601
cmp r15d, dword [rcx + 4]
jmp 0x1404a15e1
jg 0x1404a1601
cmp r9d, r11d
mov eax, r8d
cmovl r13w, cx
mov r13d, r8d
jmp 0x1404a15fa
cmovne eax, r9d
mov r9d, eax
inc r8d
add rcx, 0x14
cmc
jmp 0x1404a1611
cmp r8d, r14d
jmp 0x1404a1619
jb 0x1404a1597
cmp r9d, r11d
movzx di, al
jmp 0x1404a162b
mov qword [rsp + 0x20], r12
mov di, di
mov eax, r10d
movsx rbx, r10w
mov bh, 0x3e
mov qword [rsp + 0x30], r12
setbe r12b
movsx r12, r13w
cmovne eax, r9d
seto sil
mov sil, r13b
lea r11, [rsp + 0x40]
setle sil
xchg bl, dil
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
jmp 0x1404a1672
mov dword [rsp + 0x28], eax
movsx di, r15b
lea eax, [r13 + 1]
movsx r13, si
cmovg r13, rax
mov r12d, r15d
movups xmm0, xmmword [rsp + 0x20]
xchg r12d, edi
cmovne r10d, eax
movsx r14, bx
movsx di, r11b
movsxd rax, edx
mov rax, rbp
movsx r14w, cl
mov r14, 0x5a464aee
bswap r12
mov dword [rsp + 0x38], r10d
movups xmm1, xmmword [rsp + 0x30]
xchg r15b, r13b
movdqu xmmword [rbp], xmm0
movdqu xmmword [rbp + 0x10], xmm1
setg r15b
mov rbp, qword [r11 + 0x38]
not r14w
mov rsp, r11
pop r15
movzx r12w, r12b
movsx r12, r9w
pop r14
bswap r13
movsx rdi, r13w
mov edi, esi
pop r13
movsx di, r8b
pop r12
cmovg di, r10w
pop rdi
jmp 0x1404a1704
ret
call fcn.1404b6712
int3
Function at 0x1404ae29f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
shr bh, cl
mov qword [rsp + 0x18], rbp
shld rbx, r9, 0x55
sub bx, sp
btr bx, bx
mov qword [rsp + 0x20], rsi
test r13, rdx
xadd bx, bx
push rdi
or bl, r12b
sub rsp, 0x30
adc bx, 0x4527
xchg bh, bh
sal bl, 0xb6
sub ebp, ebp
mov bl, bh
sar bl, cl
mov rbx, rcx
jmp 0x1404ae2e5
cmp byte [rcx + 0x54], bpl
jmp 0x1404ae2ee
jne 0x1404ae406
cmp dword [rcx + 0x50], ebp
jmp 0x1404ae2fc
jle 0x1404ae406
mov rsi, qword [rcx + 0x48]
mov edi, ebp
movsx rdx, si
mov cl, dil
not cl
mov r9, qword [rbx + 8]
lea rcx, [rsp + 0x40]
movzx rax, r15w
movsx rax, r11w
mov word [rsp + 0x40], bp
mov rdx, rsi
movzx r8, r15w
cwde
mov rax, qword [r9]
not r8b
movsxd r8, dword [rax + 8]
jmp 0x1404ae33e
call fcn.1404cf9d3
movsxd r8, eax
test eax, eax
jmp 0x1404ae34d
jle 0x1404ae3f8
mov rcx, qword [rbx + 0x468]
neg ax
bswap dx
movzx edx, word [rsp + 0x40]
mov rax, qword [rcx + 8]
cmc
cmp qword [rcx + 0x10], rax
jmp 0x1404ae373
jne 0x1404ae3a3
cmp byte [rcx + 0x18], bpl
jmp 0x1404ae382
je 0x1404ae395
inc dword [rbx + 0x28]
jmp 0x1404ae390
jmp 0x1404ae3e0
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ae39e
jmp 0x1404ae3e0
inc dword [rbx + 0x28]
movsx ax, r8b
not rax
mov ax, bx
inc qword [rcx + 0x10]
mov rax, qword [rbx + 0x468]
sub cx, r15w
rcr ch, 0x65
mov rcx, qword [rax]
mov word [rcx], dx
bts ax, cx
movsx rax, r12w
sal ah, 0xa3
mov rax, qword [rbx + 0x468]
add qword [rax], 2
cmc
add rsi, r8
inc edi
cmp edi, dword [rbx + 0x50]
jmp 0x1404ae3ed
jne 0x1404ae311
jmp 0x1404ae442
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ae401
jmp 0x1404ae442
mov r8d, dword [rbx + 0x50]
btr r9w, r15w
lea rax, [rcx + 0x10]
xor r9, rcx
inc edx
mov rdx, qword [rbx + 0x48]
xchg r9d, r9d
lea r9, [rcx + 0x28]
test r8b, 0x19
add rcx, 0x468
jmp 0x1404ae433
mov qword [rsp + 0x20], rax
jmp 0x1404ae43d
call fcn.1404ac6b5
mov rbx, qword [rsp + 0x48]
movzx edi, si
adc bpl, 0xee
mov al, 1
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
sub di, r9w
add rsp, 0x30
seta dil
mov di, r8w
pop rdi
jmp 0x1404ae470
ret
Function at 0x1404afea2
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
clc
mov qword [rsp + 0x10], rsi
rcl si, cl
push rdi
sub rsp, 0x30
shr di, 0xb1
bt edi, ecx
mov edi, edx
sbb rsi, 0x674a5adf
xadd si, si
not sil
mov rsi, rcx
cmc
clc
test cx, r8w
test r8, r8
jne 0x1404afefa
call fcn.1404b4780
mov dword [rax], 0x16
call fcn.1404b545c
xor eax, eax
jmp 0x1404afef5
jmp 0x1404affee
mov rdx, r9
mov cx, r8w
mov rcx, r8
jmp 0x1404aff09
call fcn.1404b004d
mov rbx, rax
cmp ah, 0x64
stc
clc
test rax, rax
je 0x1404aff93
lea rax, [rsp + 0x50]
not r9b
cwd
mov rdx, rdi
not ch
cmovbe r9w, r9w
mov qword [rsp + 0x28], rax
mov r8w, r11w
cdqe
lea r8, [0x140094b24]
mov eax, dword [rsp + 0x60]
not r9b
mov r9, rbx
movsx cx, r10b
not ecx
mov rcx, rsi
jmp 0x1404aff5e
mov dword [rsp + 0x20], eax
jmp 0x1404aff67
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test r15b, r10b
test rax, rax
jmp 0x1404aff7b
jne 0x1404b0013
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404aff8e
call fcn.1404b47fd
xor edi, edi
cmp esi, r9d
cmp cx, 0x3b04
clc
test rbx, rbx
jmp 0x1404affa6
je 0x1404affe8
mov rcx, qword [rbx + 0x10]
test r8b, 0x36
test rcx, rcx
jmp 0x1404affbc
je 0x1404affc8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1404affdb
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404affe3
call fcn.1404c874f
mov rax, rdi
sbb sil, sil
mov rbx, qword [rsp + 0x40]
and sil, r9b
mov rsi, qword [rsp + 0x48]
jmp 0x1404b0004
add rsp, 0x30
cmove rdi, rcx
pop rdi
jmp 0x1404b0012
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jmp 0x1404b0020
je 0x1404b0032
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
clc
jmp 0x1404b0032
sub ebx, ebx
jmp 0x1404aff9e

Function at 0x1404b030b
Capabilities:
Terminate process

Disassembly:
push rbx
sbb rbx, 0x3a1e0d0f
sub bh, 0x36
movsx ebx, si
sub rsp, 0x20
not bx
movsxd rbx, edx
movsx bx, r10b
mov ebx, ecx
jmp 0x1404b0330
call fcn.1404d1c75
cmp eax, 1
je 0x1404b037d
mov rax, qword gs:[0x60]
test rcx, 0x2cf820f9
btr dx, r13w
cwd
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jne 0x1404b037d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1404b0377
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b0384
call fcn.1404b025a
mov ecx, ebx
jmp 0x1404b0390
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b6d9d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
shl ecx, 0xc
movzx rcx, r11w
mov qword [rsp + 0x20], r9
sal cl, cl
test sil, dil
push rsi
bts rsi, r8
push rdi
bts si, r14w
btc rsi, r8
push r14
inc dil
sub rsp, 0x60
mov rsi, r9
xchg ecx, ecx
mov rdi, r8
mov cl, al
movsx cx, r14b
mov ecx, dword [rdx]
call fcn.1401200e2
nop
mov rbx, qword [0x1400ba160]
test bx, r10w
xor al, 0x89
movsxd rax, dword [0x1400ba158]
or r14b, r10b
stc
lea r14, [rbx + rax*8]
jmp 0x1404b6e04
mov qword [rsp + 0x38], rbx
test r10w, bp
cmp rbx, r14
je 0x1404b6f49
mov rax, qword [rbx]
bswap dx
btc dx, 0xba
add rdx, 0x1216523c
mov qword [rsp + 0x20], rax
neg edx
movsx edx, r14w
sbb edx, 0x21cf5bd0
mov rdx, qword [rdi]
test rax, rax
je 0x1404b6e95
mov ecx, dword [rax + 0x14]
mov eax, ecx
shr eax, 0xd
test al, 1
jmp 0x1404b6e54
je 0x1404b6e95
mov eax, ecx
jmp 0x1404b6e61
and al, 3
test cx, 0x522a
cmp al, 2
jmp 0x1404b6e6f
jne 0x1404b6e83
test cl, 0xc0
jmp 0x1404b6e7d
jne 0x1404b6ea3
bt ecx, 0xb
jmp 0x1404b6e8c
jb 0x1404b6ea3
inc dword [rdx]
stc
add rbx, 8
jmp 0x1404b6e9e
jmp 0x1404b6e04
mov rdx, qword [rdi + 0x10]
movsx eax, di
setg ah
mov rcx, qword [rdi + 8]
bswap rax
movsx r9w, bpl
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
movsxd r9, r10d
jmp 0x1404b6ecf
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rax
jmp 0x1404b6ee3
mov qword [rsp + 0x50], rcx
xchg rcx, rax
mov r9b, spl
cbw
mov qword [rsp + 0x58], rdx
cwd
mov rax, qword [rsp + 0x20]
movsx edx, r13w
mov qword [rsp + 0x28], rax
mov cl, r14b
mov qword [rsp + 0x30], rax
cdq
lea r9, [rsp + 0x28]
not dh
movzx r8w, bpl
cqo
lea r8, [rsp + 0x40]
cwd
movzx dx, cl
lea rdx, [rsp + 0x30]
movzx cx, ch
movsxd rcx, r15d
lea rcx, [rsp + 0x88]
jmp 0x1404b6f3f
call fcn.1404b6c46
jmp 0x1404b6e95
mov ecx, dword [rsi]
call fcn.1401cc818
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r14
pop rdi
not sil
pop rsi
jmp 0x1404b6f68
ret
Function at 0x1404c9b5c
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
clc
sub rsp, 0x20
cmovnp dx, r12w
mov rbx, rcx
movsx r8d, bx
not r8
jmp 0x1404c9b77
lea r9, [0x1400c63c0]
mov ecx, 3
movsx r8d, bp
lea r8, [0x1400c63b8]
lea rdx, [0x1400cfb70]
jmp 0x1404c9b9a
call fcn.1404cab4e
test rax, rax
jmp 0x1404c9ba7
je 0x1404c9bcb
mov rcx, rbx
xor bl, spl
seta bh
cmovp rbx, rbp
add rsp, 0x20
pop rbx
jmp 0x1404c9bc4
jmp qword [0x1400b8d90]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404c9c47
Capabilities:
Get thread local storage value

Disassembly:
push rbx
and bl, 0x1d
sub rsp, 0x20
cdq
mov ebx, ecx
movsx r8, r11w
lea r9, [0x1400c63d0]
movsxd rdx, edi
mov ecx, 5
movzx r8w, bpl
lea r8, [0x1400c63c8]
movsx edx, sp
lea rdx, [0x1400cf758]
jmp 0x1404c9c81
call fcn.1404cab4e
mov ecx, ebx
test rax, rax
jmp 0x1404c9c90
je 0x1404c9caf
add rsp, 0x20
movsx rbx, bx
movzx rbx, di
pop rbx
jmp 0x1404c9ca8
jmp qword [0x1400b8d90]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c9cbb
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
shr r9b, 0xf4
rcl r8b, 0xcc
btc bx, 0xa1
sub rsp, 0x20
xchg r9, rdi
mov rbx, rdx
setge dil
lea r9, [0x1400c63d8]
mov di, 0x3a3f
bswap r8
jmp 0x1404c9cef
mov edi, ecx
cqo
lea rdx, [0x1400cf748]
xchg rcx, r8
movzx r8, r10w
mov ecx, 6
movzx r8d, bp
movsx r8d, bx
lea r8, [0x1400c63d0]
jmp 0x1404c9d1a
call fcn.1404cab4e
mov rdx, rbx
sar cx, cl
mov ecx, edi
clc
jmp 0x1404c9d2d
test rax, rax
jmp 0x1404c9d35
je 0x1404c9d46
call qword [0x1400b8d90]
jmp 0x1404c9d4c
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov dil, 0x4e
add rsp, 0x20
movzx di, bl
pop rdi
jmp 0x1404c9d62
ret

Function at 0x1404c9ed7
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
sal bl, 0xce
mov qword [rsp + 0x10], rbp
movsx rbp, r10w
shl bl, cl
mov qword [rsp + 0x18], rsi
sub rbp, rdx
push rdi
sub rsp, 0x30
mov ebx, r9d
movzx edi, si
mov rdi, r8
mov esi, edx
cwd
not dx
bswap r9w
lea r9, [0x1400c63e8]
jmp 0x1404c9f1b
mov rbp, rcx
cqo
mov ecx, 0x7e006522
movsx dx, r15b
lea r8, [0x1400c63e0]
movzx rcx, sp
cmovnp cx, cx
xchg dl, ch
lea rdx, [0x1400cf190]
movzx rcx, r13w
mov ecx, 0xb
jmp 0x1404c9f50
call fcn.1404cab4e
mov rcx, rbp
cmc
clc
test rax, rax
je 0x1404c9f8f
mov r9d, ebx
movzx dx, r14b
cqo
mov r8, rdi
mov edx, 0xc59296f
movzx rdx, r9w
movsx rdx, r9w
mov edx, esi
jmp 0x1404c9f84
call qword [0x1400b8d90]
jmp 0x1404c9fc3
sub edx, edx
jmp 0x1404c9f96
call fcn.1404ca5e7
mov ecx, eax
cwd
mov dh, 0xd1
movsx r9d, r12w
mov r9d, ebx
mov r8w, 0x70ae
movzx r8w, bl
mov r8, rdi
mov edx, esi
jmp 0x1404c9fbd
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
sub rsi, 0x4a2e472e
mov rsi, qword [rsp + 0x50]
btr edi, edi
movzx di, bpl
add rsp, 0x30
setg dil
movzx rdi, di
movzx edi, r8w
pop rdi
jmp 0x1404c9ff7
ret