joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404788de
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
test bpl, sil
mov qword [rax + 0x10], rbp
movsx bp, dil
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
ror si, cl
setl dil
push r14
sub rsp, 0x20
sal edi, 0x49
movsx si, dl
sar bpl, cl
mov rsi, r9
xadd r14b, bpl
test cx, 0x117a
sub rdi, 0xc570819
movzx r14d, r8w
test r14d, 0x4d6148ee
movzx edi, si
mov rdi, rdx
mov rbp, rcx
cmp r15, rdx
clc
test r9, r9
jmp 0x140478943
je 0x1404789f9
mov rbx, qword [rdx + 8]
test rbx, rbx
jmp 0x140478955
je 0x1404789e6
mov rax, qword [rbx + 0x40]
cmp r11b, 0xe2
cmp r15d, r11d
cmp qword [rax], 0
je 0x1404789a7
mov rax, qword [rbx + 0x58]
test dl, 0xf
cmp dword [rax], 0
jle 0x1404789a7
dec dword [rax]
mov rcx, qword [rbx + 0x40]
cwd
bswap dx
mov rdx, qword [rcx]
cbw
lahf
cdqe
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx eax, r14w
mov word [rdx], r14w
jmp 0x1404789c7
mov rax, qword [rbx]
xchg dh, dh
movzx edx, r14w
mov rcx, rbx
jmp 0x1404789b8
mov rax, qword [rax + 0x18]
jmp 0x1404789c1
call qword [case.0x1404e588a.0]
mov ecx, 0xffff
jmp 0x1404789d8
cmp cx, ax
jmp 0x1404789e0
jne 0x1404789ea
mov byte [rdi], 1
clc
sub rsi, 1
jmp 0x1404789f3
jne 0x14047894d
movups xmm0, xmmword [rdi]
sub bh, 0xc0
mov rbx, qword [rsp + 0x30]
xor dil, r11b
adc si, 0x62ba
mov rax, rbp
or r14b, r13b
test r13w, r15w
mov rsi, qword [rsp + 0x40]
rcr r14, cl
test rbx, rdi
mov rdi, qword [rsp + 0x48]
sar r14w, 0xb0
movdqu xmmword [rbp], xmm0
bswap r14w
setl bpl
mov rbp, qword [rsp + 0x38]
and r14w, 0x7c17
movzx r14d, di
add rsp, 0x20
pop r14
jmp 0x140478a52
ret
Function at 0x1404976fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r12b, r8b
stc
mov qword [rax + 8], rbx
movzx bx, r11b
rcl rbx, 0x58
and bl, bpl
mov qword [rax + 0x10], rbp
rol bp, 0x70
bt bx, 0xb0
shld rbx, rsp, 0x16
mov qword [rax + 0x18], rsi
rcr ebp, cl
mov qword [rax + 0x20], rdi
btc bx, r15w
rol esi, cl
movsxd rsi, edx
push r14
shr bl, 0xa9
sbb esi, r9d
sar bpl, 0x32
sub rsp, 0x20
or r14, rax
ror bx, cl
xor sil, 0x62
mov rsi, r9
test r12w, 0x1f40
sar r14w, 1
rcr bl, 0xb
mov r14, r8
test spl, r8b
movsx ebx, ax
mov rbx, rdx
btc bp, 0x5b
setne bpl
add bpl, al
mov rbp, rcx
stc
cmp rdx, r8
jmp 0x140497785
je 0x140497866
mov rdi, qword [r9 + 8]
test sp, r15w
cmc
test sil, 0xf
test rdi, rdi
jmp 0x1404977a0
je 0x140497850
mov rax, qword [rdi + 0x40]
bts r8w, r8w
bts r8w, r13w
xchg r8, r8
movzx r8d, word [rbx]
cmp si, bp
cmp qword [rax], 0
je 0x140497812
mov rax, qword [rdi + 0x58]
test r10b, bl
stc
cmp ecx, esi
cmp dword [rax], 0
jmp 0x1404977da
jle 0x140497812
dec dword [rax]
movsx edx, ax
mov rcx, qword [rdi + 0x40]
cmovb ax, dx
cwd
mov rdx, qword [rcx]
mov al, r12b
bswap rax
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x140497804
mov word [rdx], r8w
jmp 0x14049780d
jmp 0x14049783b
mov rax, qword [rdi]
movzx edx, r8w
movsx ecx, bp
mov rcx, rdi
jmp 0x140497824
mov rax, qword [rax + 0x18]
jmp 0x14049782d
call qword [case.0x1404e588a.0]
movzx r8d, ax
cmovo rax, r13
mov eax, 0xffff
cmp ebp, 0x22c45560
cmp ax, r8w
jne 0x140497854
mov byte [rsi], 1
clc
add rbx, 2
cmp rbx, r14
jmp 0x140497860
jne 0x140497798
movups xmm0, xmmword [rsi]
adc ax, 0x61ec
ror r14d, 0x69
mov rbx, qword [rsp + 0x30]
cmc
mov rax, rbp
rcl r14w, cl
and r14b, sil
adc r14b, 0xe0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
movsx r14w, dl
add r14b, 0xe4
shl r14d, cl
movdqu xmmword [rbp], xmm0
rcl r14b, cl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
bswap r14w
pop r14
jmp 0x1404978b7
ret
Function at 0x1404a4ad4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test dil, r14b
mov qword [rsp + 0x18], rbp
bsr bp, cx
cmp rbx, 0x744024fe
bswap rbp
push rsi
cmova esi, edx
rcr bpl, 0xdc
sar ebp, 0xd9
push rdi
cmovne edi, esi
adc dil, 0x2d
push r12
push r14
shr si, cl
ror r14, 0xb
push r15
sar bpl, cl
sub rsp, 0x20
sar bp, 0x2d
sar dil, cl
or dil, cl
test rdx, rdx
movzx r15w, r12b
lea r14, [rsp + 0x50]
mov dil, r15b
bswap esi
mov rsi, rcx
movzx r15w, r14b
movzx edi, dx
mov rdi, rcx
movzx ecx, byte [rcx]
movsx r15d, si
cmovne r14, rdx
movsx ebp, r9w
bswap ebp
movsx r15, r13w
mov r15, r9
mov ebp, r8d
jmp 0x1404a4b6b
inc rdi
movzx ecx, byte [rdi]
jmp 0x1404a4b6b
call fcn.1404bd920
test eax, eax
jmp 0x1404a4b77
jne 0x1404a4b60
mov bl, byte [rdi]
xor rax, 0x16e5307
cmovnp eax, edi
lea eax, [rbx - 0x2b]
test r13b, al
cmp al, 0x9f
test al, 0xfd
jmp 0x1404a4b98
je 0x1404a4baa
mov bl, 0x2b
jmp 0x1404a4ba5
jmp 0x1404a4bad
inc rdi
mov r9, r15
movsx rdx, bx
xchg r8d, ecx
mov r8d, ebp
mov dx, 0x795c
mov rdx, r14
movsx cx, r10b
mov cl, 0x2e
mov rcx, rdi
jmp 0x1404a4bd0
call fcn.1404a4d10
mov rcx, rax
clc
movzx r12d, r10w
sal r12d, cl
mov bpl, 0x2d
movzx r12, r13w
movabs r12, 0x8000000000000000
stc
cmp rdi, qword [r14]
jmp 0x1404a4bfa
jne 0x1404a4c0d
mov qword [r14], rsi
jmp 0x1404a4c08
jmp 0x1404a4c1b
cmp rsi, qword [r14]
jmp 0x1404a4c15
jne 0x1404a4c24
test rcx, rcx
jne 0x1404a4c5c
cmp bl, 0x2b
jmp 0x1404a4c2c
jne 0x1404a4c45
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1404a4c5c
cmp bl, bpl
jmp 0x1404a4c4d
jne 0x1404a4ca6
cmp rcx, r12
jbe 0x1404a4ca6
call fcn.1404bac3d
mov dword [rax], 0x22
cmp di, 0x433
cmc
test r15, r15
jmp 0x1404a4c75
je 0x1404a4c89
mov dword [r15], 1
cmp sil, dl
test r12b, 0xb4
sub bl, bpl
neg bl
jmp 0x1404a4c93
sbb rax, rax
cmp r13b, r12b
add rax, r12
jmp 0x1404a4ca1
jmp 0x1404a4cc9
mov rax, rcx
neg rax
or r14w, r11w
stc
shr r15b, 0xb7
cmp bl, bpl
cmove rcx, rax
adc r14, rbx
rol si, cl
mov rax, rcx
sar bx, cl
cmc
mov rbx, qword [rsp + 0x58]
sal bp, 0x4e
movsx esi, r8w
mov rbp, qword [rsp + 0x60]
sub r14b, r9b
movsx di, dil
xchg r14w, r12w
add rsp, 0x20
bswap di
pop r15
xchg r12b, sil
pop r14
movsx r12w, r10b
not dil
movsxd rdi, edx
pop r12
pop rdi
mov sil, bpl
movsxd rsi, ebx
pop rsi
jmp 0x1404a4d0f
ret

Function at 0x1404a5cb8
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp r15, r11
and dword [rsp + 0x30], 0
call fcn.1404aff17
mov r9d, 2
lea r8, [rsp + 0x30]
jmp 0x1404a5cdc
mov rcx, qword [rax + 0x28]
movsx dx, r11b
mov dx, r11w
cwd
lea edx, [r9 + 0x20]
jmp 0x1404a5cf4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
stc
cmp r8, rcx
sub ecx, 0x30
je 0x1404a5d52
sub ecx, 1
jmp 0x1404a5d14
je 0x1404a5d43
cmp ecx, 1
jmp 0x1404a5d22
je 0x1404a5d34
xor eax, eax
jmp 0x1404a5d2f
jmp 0x1404a5d57
mov eax, 3
jmp 0x1404a5d3e
jmp 0x1404a5d57
mov eax, 1
jmp 0x1404a5d4d
jmp 0x1404a5d57
mov eax, 2
add rsp, 0x28
jmp 0x1404a5d60
ret
Function at 0x1404a7505
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
clc
mov qword [rsp + 0x18], rbp
push rsi
push rdi
shr esi, 0xf5
not dil
push r12
bt rsi, r15
push r14
add r14w, 0x3248
test cl, bpl
push r15
sub rsp, 0x20
mov esi, dword [r8 + 0xc]
mov r14b, 0xff
jmp 0x1404a753b
mov r12, rcx
mov rcx, r8
movsx r14d, r15w
movsx di, r11b
not di
mov rdi, r9
mov r14, r8
mov r15, rdx
jmp 0x1404a755b
call fcn.1402817bf
mov r10, qword [r12]
shrd ebp, r14d, 0xa1
mov ebp, eax
test r11w, ax
stc
mov qword [rdi], r10
test esi, esi
jmp 0x1404a757a
je 0x1404a7686
movsxd rax, dword [r14 + 0x10]
bt cx, 0xe2
xchg rbx, rbx
bswap rbx
lea ecx, [rsi - 1]
movzx ebx, bp
shrd si, r8w, 0x13
mov esi, ecx
or ebx, 0x7b733dab
lea rcx, [rcx + rcx*4]
rol bl, cl
shr bx, 0x47
cmp r12b, 0xdb
lea rbx, [rax + rcx*4]
add rbx, qword [r15 + 8]
cmp ebp, dword [rbx + 4]
jle 0x1404a7573
cmp ebp, dword [rbx + 8]
jmp 0x1404a75ca
jg 0x1404a7573
mov rcx, qword [r15]
rol rdx, 0x45
not dl
movzx dx, r11b
lea rdx, [rsp + 0x50]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
xor ecx, ecx
movzx r9, ax
add r8, qword [rsp + 0x50]
mov r9d, dword [rbx + 0xc]
btr r10d, 0xa2
bswap r10d
shrd r10d, esp, 0x19
mov r10d, dword [rax]
test r9d, r9d
jmp 0x1404a7617
je 0x1404a7644
lea rdx, [r8 + 0xc]
bt eax, edx
movsxd rax, dword [rdx]
cmp rax, r10
jmp 0x1404a762f
je 0x1404a7644
inc ecx
add rdx, 0x14
cmp ecx, r9d
jb 0x1404a7624
cmp ecx, r9d
jmp 0x1404a764c
jae 0x1404a7573
mov rax, qword [r12]
ror r15b, 0x2a
bswap rbx
xor r12w, 0x57c2
lea rcx, [rcx + rcx*4]
setns r12b
sbb r12, rbx
movsxd rcx, dword [r8 + rcx*4 + 0x10]
btr r14d, 0xd6
mov rcx, qword [rcx + rax]
jmp 0x1404a7683
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x58]
movzx esi, cx
cmc
mov rax, rdi
shld bp, r11w, 0xb2
btc r15w, r8w
mov rbp, qword [rsp + 0x60]
movzx r14d, di
add rsp, 0x20
pop r15
jmp 0x1404a76ba
pop r14
jmp 0x1404a76c6
pop r12
not si
movsx si, r10b
pop rdi
jmp 0x1404a76d8
pop rsi
jmp 0x1404a76de
ret
Function at 0x1404ac726
Capabilities:
Check for software breakpoints

Disassembly:
mov rax, rsp
setl r10b
bt r10w, r12w
clc
mov qword [rax + 8], rbx
ror bx, 0xd9
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
add si, 0x161d
sbb r10b, 9
bsf ebx, edi
push r14
test eax, 0x5af26837
push r15
shrd si, di, 0x57
movzx esi, word [rsp + 0x38]
sbb ebx, 0x289a062e
mov r10, r8
xor r15d, r15d
cmp rsi, 0x48c002e
xchg r8d, r8d
clc
movsxd r8, edx
mov ebx, ecx
add cl, r12b
and cx, dx
mov ecx, r8d
cmp r11w, r11w
stc
test si, si
jmp 0x1404ac798
jne 0x1404ac8fb
mov rax, qword [r9]
sub r11b, 3
rcl r11b, 0x9d
mov r11, qword [r10]
cmp rax, 1
jbe 0x1404ac8b7
mov eax, 0x66666667
sal ch, 0xe8
test rdi, r9
mov r8, r11
imul ebx
and al, al
sar edx, 2
mov eax, edx
shr eax, 0x1f
sub ch, 0x21
add edx, eax
bt rax, rax
shr ah, cl
xadd ah, al
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
shl ah, 0x5c
cmovbe rax, rsi
add cx, cx
sar al, 0x80
movzx ax, spl
movzx eax, r15w
sub bx, cx
sar ax, 0x19
bts ax, r14w
add bx, 0x30
not ax
cmc
and eax, 0x236a4dbe
mov word [r11], bx
movzx rax, si
add r11, 2
jmp 0x1404ac828
mov rax, qword [r9]
movsx ebx, r12w
sets bh
mov rbx, rdi
mov ebx, edx
jmp 0x1404ac83c
dec rax
test r12d, r8d
mov qword [r9], rax
cmp r12b, spl
clc
test edx, edx
jmp 0x1404ac850
jle 0x1404ac865
cmp rax, 1
jmp 0x1404ac85f
ja 0x1404ac7b6
mov rdx, qword [r10]
jmp 0x1404ac86d
mov qword [r10], r11
jmp 0x1404ac8a9
movzx eax, word [rdx]
movzx ecx, word [r8]
jmp 0x1404ac881
mov word [r8], ax
jmp 0x1404ac88b
sub r8, 2
mov word [rdx], cx
cmp r10b, 0x74
test bp, 0x681
add rdx, 2
cmp sp, ax
test r10d, 0xda331e
cmp rdx, r8
jb 0x1404ac875
jmp 0x1404ac8cf
add rax, rax
sub r11, rax
not sil
movsx di, r10b
mov qword [r10], r11
movsx rbp, r8w
mov qword [r9], r15
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov sil, 0xba
not r15w
movsx r15w, r10b
mov rsi, qword [rsp + 0x28]
movzx rdi, bx
mov rdi, qword [rsp + 0x30]
pop r15
not r14b
pop r14
ret
cmp r8, qword [r9]
jmp 0x1404ac903
jae 0x1404ac8cc
dec r8d
mov r11d, r15d
stc
cmp cl, 0xcc
test ecx, ecx
jmp 0x1404ac91a
je 0x1404ac9ea
movsxd rax, r8d
btr di, 0x9f
movsx r14d, r15w
lea rdi, [rax + rax]
not bpl
cwd
mov r14, qword [r10]
mov eax, 0x66666667
cmc
clc
jmp 0x1404ac944
imul ebx
sar rax, cl
sub ax, 0x16f7
shr ax, cl
mov ebp, r8d
shr al, cl
sar edx, 2
mov eax, edx
test rsi, r14
cmp r14b, r10b
shr eax, 0x1f
add edx, eax
stc
jmp 0x1404ac96b
test ebx, ebx
jmp 0x1404ac972
je 0x1404ac9b2
movzx eax, dx
mov cx, r12w
bts ecx, r9d
sar ch, 0x8a
shl ax, 2
or rcx, 0x6c5a2489
lea ecx, [rax + rdx]
movsx rax, di
or ax, 0x5263
add cx, cx
movzx eax, cx
sub bx, cx
jmp 0x1404ac9aa
lea eax, [rbx + 0x30]
jmp 0x1404ac9b7
movzx eax, si
dec ebx
mov word [rdi + r14], ax
movsxd rbx, r10d
inc r11d
sub rdi, 2
dec r8d
shl bh, 0x6f
bt bx, 0x43
rcr bh, 0xec
mov ebx, edx
cmp cx, di
test r14b, 0xe7
test ebp, ebp
jmp 0x1404ac9e4
jne 0x1404ac935
movsxd rcx, r11d
lea rax, [rcx + rcx]
add qword [r10], rax
sub qword [r9], rcx
jmp 0x1404ac8cf
Function at 0x1404b46a1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
inc ebx
xadd bl, bh
rcr bh, cl
mov qword [rsp + 0x18], rbp
bt ebx, 0xcf
mov qword [rsp + 0x20], rsi
add ebx, r8d
movzx ebx, ax
push rdi
rol bx, cl
cmc
sub rsp, 0x30
neg bl
sbb ebx, r13d
bt bx, 6
sub ebp, ebp
ror rbx, 3
mov rbx, rcx
cmp sp, di
cmp byte [rcx + 0x54], bpl
jmp 0x1404b46e9
jne 0x1404b4810
cmp dword [rcx + 0x50], ebp
jmp 0x1404b46f7
jle 0x1404b4810
mov rsi, qword [rcx + 0x48]
setno al
mov edi, ebp
not dx
bswap eax
cqo
mov r9, qword [rbx + 8]
cwde
movsx ecx, si
cmovge edx, r9d
lea rcx, [rsp + 0x40]
xchg r8w, ax
mov word [rsp + 0x40], bp
cbw
cwde
movzx rdx, r11w
mov rdx, rsi
bswap r8
mov eax, 0x7330267b
xchg r8d, eax
mov rax, qword [r9]
movzx r8, r12w
movsxd r8, dword [rax + 8]
jmp 0x1404b474a
call fcn.1404d6142
movsxd r8, eax
test eax, eax
jmp 0x1404b4759
jle 0x1404b4807
mov rcx, qword [rbx + 0x468]
mov rax, r10
sub dl, r15b
test spl, al
movzx edx, word [rsp + 0x40]
sub al, 0xed
xor al, bpl
rcr eax, cl
mov rax, qword [rcx + 8]
cmp r9b, 0x65
cmp qword [rcx + 0x10], rax
jne 0x1404b47ad
cmp byte [rcx + 0x18], bpl
je 0x1404b47a4
inc dword [rbx + 0x28]
jmp 0x1404b479f
jmp 0x1404b47e8
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b47e8
inc dword [rbx + 0x28]
mov eax, edx
inc al
inc qword [rcx + 0x10]
mov rax, qword [rbx + 0x468]
mov rcx, qword [rax]
sal rax, 0x16
mov eax, r10d
sar ax, 0xcb
mov word [rcx], dx
add al, 0x58
bsf rax, r10
mov rax, qword [rbx + 0x468]
test r14b, 0xc6
add qword [rax], 2
cmp rcx, r8
add rsi, r8
jmp 0x1404b47f0
inc edi
test ecx, ebx
cmp edi, dword [rbx + 0x50]
jmp 0x1404b47fc
jne 0x1404b470d
jmp 0x1404b4849
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b4849
mov r8d, dword [rbx + 0x50]
btc rax, r13
lahf
lea rax, [rcx + 0x10]
adc r9w, 0x24d9
cmp spl, bl
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
add rcx, 0x468
jmp 0x1404b483a
mov qword [rsp + 0x20], rax
jmp 0x1404b4844
call fcn.1404b2bc9
mov rbx, qword [rsp + 0x48]
mov al, 1
btr bp, r12w
rcr si, cl
movsx rsi, r10w
mov rbp, qword [rsp + 0x50]
test r11b, 0x8f
mov dil, 0x3d
add esi, 0x26b72bbd
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
movzx edi, dx
movsxd rdi, ebp
pop rdi
jmp 0x1404b4883
ret
Function at 0x1404b6294
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404b62a3
mov qword [rsp + 0x10], rsi
sub sil, 0x6d
push rdi
bsf si, dx
movsx edi, bp
sub rsp, 0x30
ror dil, 0x92
shr dil, 0xfc
mov edi, edx
shrd esi, esi, 0x2e
xadd sil, sil
mov rsi, rcx
test r8, r8
jne 0x1404b62f7
call fcn.1404bac3d
mov dword [rax], 0x16
jmp 0x1404b62e6
call fcn.1404bb95a
xor eax, eax
jmp 0x1404b62f2
jmp 0x1404b63fa
mov rdx, r9
not cx
mov rcx, r8
jmp 0x1404b6305
call fcn.1404b645d
mov rbx, rax
stc
test rax, rax
je 0x1404b6397
lea rax, [rsp + 0x50]
mov r8b, 0xcf
mov rdx, rdi
setg r8b
movzx r9w, dil
mov qword [rsp + 0x28], rax
movzx rcx, bx
lea r8, [0x140094b24]
movzx ax, dh
mov eax, dword [rsp + 0x60]
cmovb ecx, r14d
bswap rcx
mov r9, rbx
setae cl
cmovbe ecx, esi
movsx rcx, di
mov rcx, rsi
jmp 0x1404b635f
mov dword [rsp + 0x20], eax
jmp 0x1404b6368
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp eax, 0x54285369
stc
test rax, rax
jmp 0x1404b637f
jne 0x1404b641b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b6392
call fcn.1404bacbf
xor edi, edi
test rbx, rbx
jmp 0x1404b63a1
je 0x1404b63eb
mov rcx, qword [rbx + 0x10]
cmp r12b, r8b
test r11b, 0x5d
test rcx, rcx
jmp 0x1404b63ba
je 0x1404b63c6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x1404b63d2
je 0x1404b63de
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b63e6
call fcn.1404cecb1
mov rax, rdi
movsx rdi, bx
mov bx, r8w
bt edi, 0x59
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
movsx di, r11b
xchg dil, dil
setnp dil
pop rdi
jmp 0x1404b641a
ret
mov rcx, qword [rsp + 0x68]
cmc
test rcx, rcx
je 0x1404b643d
mov eax, dword [rsp + 0x50]
test rdi, 0x227c2863
cmc
mov dword [rcx], eax
jmp 0x1404b643d
sub ebx, ebx
jmp 0x1404b6444
jmp 0x1404b6399

Function at 0x1404b670d
Capabilities:
Terminate process

Disassembly:
push rbx
movsx bx, bh
sub rsp, 0x20
movzx rbx, cx
mov ebx, ecx
jmp 0x1404b6722
call fcn.1404d8328
cmp eax, 1
je 0x1404b6776
mov rax, qword gs:[0x60]
test bx, r15w
mov edx, dword [rax + 0xbc]
shr edx, 8
cmp r14, 0x8771955
stc
jmp 0x1404b6753
test dl, 1
jmp 0x1404b675b
jne 0x1404b6776
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
not dl
mov edx, ebp
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b677d
call fcn.1404b6652
mov ecx, ebx
jmp 0x1404b6789
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404c4388
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
dec bx
push rdi
inc bh
sub rsp, 0x30
mov r9b, byte [rdx + 8]
mov rbx, rcx
ror dil, 0x54
rcr di, cl
mov al, r9b
sub ecx, ecx
xchg r11b, r8b
sub r11w, 0x3cb2
bsf r8, rsp
neg al
mov rax, rax
not al
mov rdi, rdx
movzx r8w, r13b
movsx r8w, r9b
movzx eax, di
mov eax, dword [rbx + 4]
setge r8b
lea r11, [rbx + 8]
setg r8b
sbb r10d, r10d
test r13w, 0x5778
movzx r8, r11w
rol r8, 0x72
lea r8, [rbx + 8]
test dx, di
and r10d, 0x1d
test r9w, r15w
add r11, rax
cmp dl, bpl
add r10d, 0x17
stc
test rbp, 0x4edb214b
add r10d, dword [rbx]
cmc
jmp 0x1404c4418
cmp r8, r11
je 0x1404c4490
neg r9b
sete al
movsx rax, bp
cbw
movabs rax, 0x1fffffff000000
jmp 0x1404c443c
sbb rdx, rdx
and rdx, rax
stc
test sil, bl
add rdx, 0xffffff
jmp 0x1404c4452
cmp rcx, rdx
ja 0x1404c4490
movzx eax, byte [r8]
clc
sub r10d, 4
stc
test r11b, dl
shl rcx, 4
jmp 0x1404c4471
inc r8
lea rcx, [rcx + rax]
cmp r8b, 0xaa
cmp ax, r15w
test rcx, 0x4887123a
cmp r8, r11
jne 0x1404c4452
mov r9b, 1
jmp 0x1404c4498
jmp 0x1404c44bd
test r9b, r9b
jmp 0x1404c44a5
je 0x1404c44cb
mov al, byte [r8]
inc r8
sbb r9b, r11b
test al, al
sete r9b
cmp dl, 0xe8
cmp r8, r11
jmp 0x1404c44c5
jne 0x1404c449d
mov r8b, byte [rbx + 0x308]
movsxd rdx, r11d
mov edx, r10d
jmp 0x1404c44dd
mov qword [rsp + 0x20], rdi
jmp 0x1404c44e7
call fcn.1404bfc65
mov rbx, qword [rsp + 0x40]
xor dil, spl
or edi, 0x6e0b61ef
bts rdi, rbp
add rsp, 0x30
movzx rdi, r9w
pop rdi
jmp 0x1404c450c
ret
Function at 0x1404c8037
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
rcr r11b, 0x7f
push rdi
sal r11w, cl
sub rsp, 0x20
xchg ebx, ebx
xor r10d, r10d
rcr r11b, cl
shr r11b, cl
neg rbx
mov rbx, rdx
cmove r11d, r10d
bt r11w, r11w
shr r11w, cl
mov r11, rcx
cmp al, r9b
test r9, r9
jmp 0x1404c8075
jne 0x1404c80d2
test rcx, rcx
jmp 0x1404c8083
jne 0x1404c80e0
test rdx, rdx
je 0x1404c80b7
call fcn.1404bac3d
mov ebx, 0x16
mov dword [rax], ebx
jmp 0x1404c80a3
call fcn.1404bb95a
mov r10d, ebx
test ax, r9w
movzx ax, bl
test r14b, 0x76
mov rbx, qword [rsp + 0x30]
xor ah, 0xa3
inc al
mov eax, r10d
add rsp, 0x20
movsxd rdi, esi
pop rdi
jmp 0x1404c80d1
ret
test r11, r11
jmp 0x1404c80da
je 0x1404c8092
test rbx, rbx
jmp 0x1404c80e8
je 0x1404c8092
test r9, r9
jmp 0x1404c80f6
je 0x1404c8113
test r8, r8
jne 0x1404c8113
mov word [rcx], r10w
jmp 0x1404c810e
jmp 0x1404c8092
mov rdi, r9
clc
cmp r14b, 0x19
cmp word [rcx], r10w
je 0x1404c8136
add rcx, 2
test r8d, ebx
sub rdx, 1
jne 0x1404c811b
test rdx, rdx
jne 0x1404c814d
mov word [r11], r10w
jmp 0x1404c8148
jmp 0x1404c8092
cmp r9, 0xffffffffffffffff
jne 0x1404c818f
sub r8, rcx
or ax, 0x24bc
movzx eax, word [r8 + rcx]
mov word [rcx], ax
cmp bpl, 0xc5
lea rcx, [rcx + 2]
cmp r8b, cl
cmc
test ax, ax
je 0x1404c81ee
sub rdx, 1
jmp 0x1404c8184
jne 0x1404c815e
jmp 0x1404c81ee
test r9, r9
jmp 0x1404c8197
je 0x1404c81de
movzx eax, word [r8]
lea r8, [r8 + 2]
test r8, r12
jmp 0x1404c81ad
mov word [rcx], ax
test ecx, edx
add rcx, 2
stc
test ax, ax
jmp 0x1404c81bf
je 0x1404c81de
sub rdx, 1
je 0x1404c81de
sub rdi, 1
jmp 0x1404c81d8
jne 0x1404c819d
test rdi, rdi
jne 0x1404c81ee
mov word [rcx], r10w
cmp dl, bpl
test rdx, rdx
jmp 0x1404c81f6
jne 0x1404c80b7
cmp r9, 0xffffffffffffffff
jmp 0x1404c8205
jne 0x1404c822a
mov word [r11 + rbx*2 - 2], r10w
movzx r10d, bp
movsx r10d, r14w
movsxd r10, r12d
lea r10d, [rdx + 0x50]
jmp 0x1404c8225
jmp 0x1404c80b7
mov word [r11], r10w
jmp 0x1404c8233
call fcn.1404bac3d
mov ebx, 0x22
jmp 0x1404c8242
jmp 0x1404c809c
Function at 0x1404c9544
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
rcr ax, 5
dec eax
mov qword [r11 + 0x20], r9
neg ah
cmp r11b, 0x50
ror rbx, cl
mov dword [rsp + 0x10], edx
cmovo ax, bx
push rbp
push rsi
adc bl, sil
push rdi
shr rbx, 0x3b
push r12
inc ah
movsxd rax, r14d
bswap r12d
push r13
push r14
push r15
movzx r12d, di
and sil, bl
shr r12, 0x54
sub rsp, 0x20
dec r15
cbw
and sil, r8b
mov rax, qword [rcx + 8]
ror esi, 0x85
bt r15, 0x5f
sub bpl, bpl
xor r14b, r14b
btr r13w, cx
mov qword [r11 + 8], rax
rcl r12, 0xa4
test r10w, r10w
rol r12b, cl
xor edi, edi
stc
btr ebx, 0x53
cmc
mov r12, r9
mov r13d, r8d
xchg bx, si
sar bh, cl
bt r15w, 0xce
mov rbx, rcx
adc sil, 0x96
lea rsi, [rax - 1]
mov r15, rsi
cmp dword [rcx], edi
jmp 0x1404c95eb
jle 0x1404c9670
mov r12d, dword [r11 + 0x10]
test r8, r9
cmp edi, r12d
jne 0x1404c960c
mov rsi, rax
mov bpl, 1
jmp 0x1404c960c
cmp edi, r13d
jne 0x1404c9624
mov r15, rax
xadd r14b, r14b
mov r14b, 1
jmp 0x1404c9624
test bpl, bpl
je 0x1404c9636
test r14b, r14b
jne 0x1404c9666
lea rdx, [rsp + 0x60]
mov rcx, rbx
jmp 0x1404c9643
call fcn.1402999dd
inc edi
cmp edi, dword [rbx]
jmp 0x1404c9651
jge 0x1404c9666
mov rax, qword [rsp + 0x60]
jmp 0x1404c9661
jmp 0x1404c95f8
mov r12, qword [rsp + 0x78]
jmp 0x1404c9670
mov rax, qword [r12]
mov qword [r12 + 8], rsi
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movsx r13, si
xor dil, 0xa7
movups xmmword [rax + 0x10], xmm1
or al, 0x86
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
rcr r12w, cl
mov qword [rax + 8], r15
bswap r15w
movups xmm0, xmmword [rbx]
shl bp, cl
and bp, 0x617a
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
mov rbx, qword [rsp + 0x70]
mov r13b, r14b
movups xmmword [rcx + 0x10], xmm1
shr si, cl
or r15b, r10b
add rsp, 0x20
movsx edi, r11w
pop r15
movsx di, r13b
pop r14
pop r13
pop r12
movzx si, cl
pop rdi
movzx esi, r8w
mov bp, 0x1159
not bpl
pop rsi
cmovae bp, si
movzx bp, r15b
movsxd rbp, eax
pop rbp
jmp 0x1404c9704
ret

Function at 0x1404d0154
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sbb rdx, 0x61850fa
shl rdx, cl
xor dl, sil
sub rsp, 0x20
mov rbx, rcx
cdq
xchg r9, rdx
lea r9, [0x1400c63c0]
mov ecx, 3
lea r8, [0x1400c63b8]
movzx edx, r13w
bswap dx
mov dx, 0x48e8
lea rdx, [0x1400cfb70]
jmp 0x1404d0198
call fcn.1404d1192
test rax, rax
jmp 0x1404d01a5
je 0x1404d01c2
mov rcx, rbx
add rsp, 0x20
movsxd rbx, ecx
pop rbx
jmp 0x1404d01bb
jmp qword [case.0x1404e588a.0]
add rsp, 0x20
setle bl
movzx rbx, si
not rbx
pop rbx
jmp 0x1404d01d6
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1404d02d2
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
xchg dil, r9b
btr di, bp
bswap rdi
sub rsp, 0x20
movsxd r9, r9d
movzx r9, r11w
cmovl di, r13w
mov rbx, rdx
movsx r9d, r12w
lea r9, [0x1400c63d8]
jmp 0x1404d0308
mov edi, ecx
lea rdx, [0x1400cf748]
mov ecx, 6
movzx r8, si
lea r8, [0x1400c63d0]
jmp 0x1404d0326
call fcn.1404d1192
mov rdx, rbx
rcl rcx, cl
add ecx, 0x5da13069
shr rcx, cl
mov ecx, edi
cmc
cmp rsp, r9
test spl, 0x88
test rax, rax
jmp 0x1404d034c
je 0x1404d035d
call qword [case.0x1404e588a.0]
jmp 0x1404d0363
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
bswap edi
btc rdi, r8
add edi, esp
add rsp, 0x20
not rdi
setbe dil
pop rdi
jmp 0x1404d0381
ret

Function at 0x1404d0544
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
and bl, r14b
and bh, 0x26
test cl, r10b
mov qword [rsp + 0x10], rbp
adc bp, 0x4233
mov qword [rsp + 0x18], rsi
adc bpl, 0xa3
movzx rsi, dx
push rdi
sub rsp, 0x30
setno dil
mov ebx, r9d
movzx rsi, sp
movsxd rsi, eax
jmp 0x1404d0581
mov rdi, r8
mov esi, edx
movzx r8w, bl
lea r9, [0x1400c63e8]
mov bp, 0x6a6d
movsxd rbp, r13d
movzx ebp, r8w
mov rbp, rcx
movsx ecx, cx
movsx rdx, sp
mov cl, 0x33
lea r8, [0x1400c63e0]
not dl
mov edx, 0x6dac4f66
lea rdx, [0x1400cf190]
movsx rcx, r14w
mov cl, r15b
movzx cx, sil
mov ecx, 0xb
jmp 0x1404d05d4
call fcn.1404d1192
mov rcx, rbp
test rax, rax
jmp 0x1404d05e4
je 0x1404d0609
mov r9d, ebx
setge dl
mov r8, rdi
bswap dx
movsx rdx, bx
cqo
mov edx, esi
call qword [case.0x1404e588a.0]
jmp 0x1404d062f
sub edx, edx
call fcn.1404d0c60
mov ecx, eax
mov r9d, ebx
mov r8w, 0x7cc8
movzx dx, r11b
mov r8, rdi
mov edx, esi
jmp 0x1404d0629
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
movsxd rbp, eax
mov rbp, qword [rsp + 0x48]
or dil, 0x59
stc
mov rsi, qword [rsp + 0x50]
bt rdi, 0x6d
add rsp, 0x30
pop rdi
jmp 0x1404d0655
ret