joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404a1039
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmc
clc
mov qword [rax + 8], rbx
clc
mov qword [rax + 0x10], rsi
movsx esi, r14w
add sil, sil
mov qword [rax + 0x18], rdi
movsxd rdi, eax
stc
setno dil
mov qword [rax + 0x20], r14
sets dil
test r11, rbp
push r15
movzx edi, r11w
sbb r14b, 0xe8
add sil, 0x35
sub rsp, 0x30
and di, r10w
shld r15w, bx, 0x11
shl r14b, 0xf3
mov rdi, r9
movsx rsi, r8w
dec r14b
mov rsi, rdx
sub rsi, rcx
sub rdi, r8
shrd r15d, ecx, 0xb6
mov r14b, 0x4d
adc r14b, spl
mov r15, rcx
shl ch, cl
sar rsi, 1
add r14, r14
rcl rcx, 0x81
mov rcx, qword [rsp + 0x60]
bsr r14w, r9w
btc r14w, 0x69
sub ebx, ebx
sar rdi, 1
mov r14, r8
test rsp, 0x466607cf
cmc
test rcx, rcx
jmp 0x1404a10da
jne 0x1404a10ee
call fcn.1404ab4ed
mov rcx, qword [rax + 8]
jmp 0x1404a10f4
mov rcx, qword [rcx + 8]
cmc
stc
test rcx, rcx
jmp 0x1404a10fc
jne 0x1404a11c0
cmp esi, edi
mov eax, edi
movzx ecx, r11w
movzx cx, r15b
mov cl, dh
cmovl eax, esi
shr cl, 0x80
movsxd rcx, eax
btr eax, esp
mov al, 0xc5
cwde
mov eax, 1
jmp 0x1404a112d
test rcx, rcx
je 0x1404a117a
sub r15, r14
shrd dx, r15w, 0xf2
adc dh, 0xdc
movsx dx, r9b
movzx edx, word [r15 + r14]
test ebp, r8d
clc
cmc
cmp dx, word [r14]
jmp 0x1404a115a
jne 0x1404a119e
add r14, 2
stc
test rsi, 0x35eb3cf4
sub rcx, rax
jmp 0x1404a1174
jne 0x1404a1147
cmp esi, edi
jmp 0x1404a1181
je 0x1404a11b4
or ecx, 0xffffffff
cmp esi, edi
jmp 0x1404a1191
cmovl eax, ecx
jmp 0x1404a1199
jmp 0x1404a1239
sbb ebx, ebx
and ebx, 0xfffffffe
test dh, 0xce
cmp r15b, 0x53
jmp 0x1404a11af
add ebx, eax
movsxd rax, r8d
mov eax, ebx
jmp 0x1404a11bb
jmp 0x1404a1239
mov dword [rsp + 0x28], edi
xchg edx, r8d
movzx r8w, r12b
movsx edx, si
mov r9d, esi
movsx rdx, r13w
cqo
mov r8, r15
movzx dx, r15b
movzx rdx, r11w
mov qword [rsp + 0x20], r14
mov rdx, 0x1f3a6030
movsx dx, bpl
jmp 0x1404a11fa
mov edx, 0x1000
jmp 0x1404a1204
call fcn.1404c3c78
test eax, eax
jmp 0x1404a1210
jne 0x1404a1236
call fcn.1404b615c
mov dword [rax], 0x16
mov al, bl
movzx rax, sp
mov eax, 0x7fffffff
jmp 0x1404a1231
jmp 0x1404a1239
sub eax, 2
mov rbx, qword [rsp + 0x40]
sbb r14w, 0x2e95
cmp ax, r12w
xor r15b, r8b
mov rsi, qword [rsp + 0x48]
movsx r14d, ax
shl dil, 0x79
mov rdi, qword [rsp + 0x50]
stc
mov r14, qword [rsp + 0x58]
xadd r15d, r15d
add rsp, 0x30
mov r15w, 0x6831
not r15w
movsx r15d, bx
pop r15
jmp 0x1404a127f
ret
Function at 0x1404a1dbc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rbx, r13
bts bx, si
push rsi
test r15b, cl
bts bx, r13w
push rdi
bsf rbx, rdi
bswap rbx
sub rsp, 0x40
not bl
movzx ebx, r13w
setg bl
mov rbx, rcx
jmp 0x1404a1deb
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rsi, qword [rbx + 0xf8]
not ecx
xor dl, r12b
ror cx, 0xb9
xor edi, edi
xor r8d, r8d
movsx rdx, dx
movsx dx, bh
cqo
lea rdx, [rsp + 0x60]
mov rcx, rsi
jmp 0x1404a1e1d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
jmp 0x1404a1e2b
je 0x1404a1eb5
and qword [rsp + 0x38], 0
cmc
mov ch, 0x91
sar rcx, 0x26
lea rcx, [rsp + 0x68]
not r9d
movzx r8w, dil
or r8, 0x5bb224da
mov rdx, qword [rsp + 0x60]
add r9, r12
mov r9, rax
mov qword [rsp + 0x30], rcx
or rcx, 0xe83a74
sal cl, 0x52
mov r8, rsi
bsf cx, si
cmc
cmp bpl, r14b
lea rcx, [rsp + 0x70]
stc
clc
cmp r10b, 0x8d
mov qword [rsp + 0x28], rcx
test eax, 0x13e938b7
cmc
xor ecx, ecx
jmp 0x1404a1e95
mov qword [rsp + 0x20], rbx
jmp 0x1404a1e9f
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
inc edi
cmp edi, 2
jmp 0x1404a1eaf
jl 0x1404a1e03
add rsp, 0x40
movzx esi, di
pop rdi
setge sil
movzx rsi, bx
pop rsi
pop rbx
jmp 0x1404a1ecc
ret

Function at 0x1404a1ecd
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, r9d
bts rbx, r13
shld rbx, r15, 0x25
mov rbx, rcx
xor ecx, ecx
jmp 0x1404a1ee9
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a1ef7
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
jmp 0x1404a1f18
pop rbx
jmp 0x1404a1f1e
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404adf3e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
shrd bx, r9w, 0x68
add bl, 0xba
bswap rax
mov qword [rsp + 0x18], rsi
btc rbx, rbx
push rdi
shr eax, 0x5e
sub rsp, 0x50
mov rax, qword [0x1400b7288]
xor rax, rsp
mov bx, di
rcr bh, cl
rol bx, 0x60
mov qword [rsp + 0x40], rax
sbb bx, r15w
cmp byte [rcx + 0x54], 0
mov bx, r15w
movsx ebx, r8w
not bl
mov rbx, rcx
jmp 0x1404adf92
je 0x1404ae084
cmp dword [rcx + 0x50], 0
jle 0x1404ae084
mov rsi, qword [rcx + 0x48]
dec al
movsx r9, r13w
sal r9b, cl
sub edi, edi
rdtsc
movzx r9w, r9b
mov rax, qword [rbx + 8]
bsf r9, rdi
sbb cx, sp
btc edx, 0xb8
lea rdx, [rsp + 0x34]
rol r8b, 0x99
xadd r8b, r9b
setl r8b
movzx r9d, word [rsi]
lea rcx, [rsp + 0x30]
sub r8d, 0x527246b9
add r8w, bx
and dword [rsp + 0x30], 0
mov r8b, bpl
movsx r8d, ax
jmp 0x1404adffd
lea rsi, [rsi + 2]
mov r8d, 6
jmp 0x1404ae00c
mov qword [rsp + 0x20], rax
jmp 0x1404ae016
call fcn.1404d1413
test eax, eax
jne 0x1404ae07b
mov r8d, dword [rsp + 0x30]
cmc
cmp r8, r10
test ch, 0x40
test r8d, r8d
je 0x1404ae07b
lea rax, [rbx + 0x10]
movzx cx, r14b
mov ch, 0xc8
lea r9, [rbx + 0x28]
cwd
jmp 0x1404ae053
mov qword [rsp + 0x20], rax
cdq
lea rcx, [rbx + 0x468]
lea rdx, [rsp + 0x34]
call fcn.1404ac3f7
inc edi
stc
cmp edi, dword [rbx + 0x50]
jne 0x1404adfb8
jmp 0x1404ae0c9
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ae0c9
mov r8d, dword [rbx + 0x50]
test r12b, bpl
btr eax, 0x5d
lea rax, [rcx + 0x10]
movzx edx, sp
or r9b, 0x58
mov rdx, qword [rbx + 0x48]
cmp r8w, 0x5d9
lea r9, [rcx + 0x28]
test rbp, 0x7dc75ed3
cmp r13w, ax
add rcx, 0x468
jmp 0x1404ae0bf
mov qword [rsp + 0x20], rax
call fcn.1404ac3f7
mov al, 1
rol ecx, 0x35
shld cx, r10w, 0xe4
test r13w, 0x29dc
mov rcx, qword [rsp + 0x40]
cmc
cmp si, 0x51a8
xor rcx, rsp
call fcn.1404a0622
mov rbx, qword [rsp + 0x68]
dec dil
mov rsi, qword [rsp + 0x70]
bts di, r11w
shr dil, 0xf6
xadd dil, dil
add rsp, 0x50
movsx di, r14b
mov dil, 0x97
pop rdi
jmp 0x1404ae119
ret
Function at 0x1404b189c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
stc
jmp 0x1404b18ab
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
test dil, 0xc6
btr di, si
mov edi, edx
mov rsi, rcx
jmp 0x1404b18ce
test r8, r8
jmp 0x1404b18d6
jne 0x1404b18f8
call fcn.1404b615c
mov dword [rax], 0x16
jmp 0x1404b18ec
call fcn.1404b6dc7
sub eax, eax
jmp 0x1404b19da
mov rdx, r9
mov ecx, 0x21dd58f2
mov rcx, r8
call fcn.1404b1a41
mov rbx, rax
test rax, rax
jmp 0x1404b1913
je 0x1404b1981
lea rax, [rsp + 0x50]
mov rdx, rdi
bswap r9w
movsx r8w, r15b
mov qword [rsp + 0x28], rax
seta ch
lea r8, [0x140094b24]
lahf
jmp 0x1404b1941
mov eax, dword [rsp + 0x60]
movsx rcx, r15w
setge cl
bswap ecx
mov r9, rbx
mov rcx, rsi
jmp 0x1404b1959
mov dword [rsp + 0x20], eax
jmp 0x1404b1962
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x1404b1a02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404b61d2
xor edi, edi
test r8w, 0x1c64
test rbx, rbx
jmp 0x1404b1991
je 0x1404b19d7
mov rcx, qword [rbx + 0x10]
test dil, 0x49
cmc
cmp r10b, sil
test rcx, rcx
je 0x1404b19b2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
clc
test r14b, 0x56
test rcx, rcx
jmp 0x1404b19c3
je 0x1404b19cf
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1404c9e81
mov rax, rdi
mov rbx, qword [rsp + 0x40]
btr edi, 0x47
or sil, bl
mov rsi, qword [rsp + 0x48]
inc edi
movzx di, bl
cmp r15b, sil
add rsp, 0x30
mov dil, r13b
pop rdi
jmp 0x1404b1a01
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1404b1a21
mov eax, dword [rsp + 0x50]
test spl, 0xd5
mov dword [rcx], eax
cmp dil, 0x34
test dil, cl
sub ebx, ebx
jmp 0x1404b1a28
jmp 0x1404b1989

Function at 0x1404b1cfc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, r9w
movsx ebx, r11w
mov bl, 0x9d
mov ebx, ecx
jmp 0x1404b1d13
call fcn.1404d33c6
cmp eax, 1
jmp 0x1404b1d20
je 0x1404b1d61
mov rax, qword gs:[0x60]
setno dh
mov dl, 0xeb
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jmp 0x1404b1d45
jne 0x1404b1d61
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1404b1d5b
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b1d68
call fcn.1404b1c40
mov ecx, ebx
jmp 0x1404b1d74
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404b6e50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xchg cx, cx
movsxd rcx, esi
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b6e6c
je 0x1404b6e83
mov ecx, 5
jmp 0x1404b6e7c
int 0x29
jmp 0x1404b6e83
mov r8d, 1
cmovs dx, di
movzx cx, r9b
mov edx, 0xc0000417
not cl
mov cl, r8b
lea ecx, [r8 + 1]
jmp 0x1404b6ea5
call fcn.1404b6ed0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
shld edx, r9d, 0x46
test al, r11b
bts dx, cx
mov edx, 0xc0000417
cmc
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1404ba17c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
jmp 0x1404ba18b
neg rcx
test rax, 7
je 0x1404ba1c6
nop
jmp 0x1404ba1a3
mov dl, byte [rax]
jmp 0x1404ba1aa
inc rax
cmp dil, 0x57
test dl, dl
jmp 0x1404ba1b8
je 0x1404ba2af
test al, 7
jne 0x1404ba1a3
movabs r8, 0x7efefefefefefeff
adc r9w, dx
inc r9b
movabs r11, 0x8101010101010100
xor dl, r8b
cmovb r9d, edi
xchg r9, rdx
mov rdx, qword [rax]
test eax, 0x5be77396
bsr r9d, r11d
mov r9, r8
add rax, 8
cmp r9d, esi
cmp r15, 0x11c55b56
add r9, rdx
clc
cmp ch, 0x27
not rdx
xor rdx, r9
and rdx, r11
je 0x1404ba1eb
mov rdx, qword [rax - 8]
test ebp, 0x7abc22bb
jmp 0x1404ba22d
test dl, dl
jmp 0x1404ba234
je 0x1404ba2f7
test dh, dh
jmp 0x1404ba241
je 0x1404ba2ec
shr rdx, 0x10
cmp r9, 0x2dc553b8
cmp r8b, r9b
test dl, dl
jmp 0x1404ba25c
je 0x1404ba2e1
test dh, dh
je 0x1404ba2db
shr rdx, 0x10
test r9w, 0x48ea
jmp 0x1404ba279
test dl, dl
jmp 0x1404ba280
je 0x1404ba2d0
test dh, dh
jmp 0x1404ba28d
je 0x1404ba2c5
shr edx, 0x10
cmp dh, 0x3f
clc
test dl, dl
je 0x1404ba2ba
test dh, dh
jmp 0x1404ba2a9
jne 0x1404ba1eb
lea rax, [rax + rcx - 1]
jmp 0x1404ba2b9
ret
lea rax, [rax + rcx - 2]
jmp 0x1404ba2c4
ret
lea rax, [rax + rcx - 3]
jmp 0x1404ba2cf
ret
lea rax, [rax + rcx - 4]
jmp 0x1404ba2da
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
jmp 0x1404ba2eb
ret
lea rax, [rax + rcx - 7]
jmp 0x1404ba2f6
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1404c33b9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
stc
sal bx, 0x4e
push rdi
inc bx
adc rbx, r13
sub rsp, 0x20
xor r10d, r10d
cmovp bx, ax
bsf r11, rsp
mov rbx, r8
mov r11, rdx
test dl, 0x92
test r9, r9
jmp 0x1404c33ea
jne 0x1404c3454
test rcx, rcx
jmp 0x1404c33f8
jne 0x1404c3462
test rdx, rdx
je 0x1404c3429
call fcn.1404b615c
mov ebx, 0x16
jmp 0x1404c3416
mov dword [rax], ebx
jmp 0x1404c341d
call fcn.1404b6dc7
mov r10d, ebx
xor ah, 0xcc
cwde
mov rbx, qword [rsp + 0x30]
cmp ax, r14w
mov eax, r10d
movzx di, spl
adc edi, 0x7e5546ed
add rsp, 0x20
setne dil
movzx di, r11b
pop rdi
jmp 0x1404c3453
ret
test rcx, rcx
jmp 0x1404c345c
je 0x1404c3407
test r11, r11
jmp 0x1404c346a
je 0x1404c3407
test r9, r9
jmp 0x1404c3478
jne 0x1404c348c
mov word [rcx], r10w
jmp 0x1404c3487
jmp 0x1404c3429
test rbx, rbx
jmp 0x1404c3494
jne 0x1404c34a8
mov word [rcx], r10w
jmp 0x1404c34a3
jmp 0x1404c3407
sub rbx, rcx
movzx rdi, bp
rcr di, cl
rol rdx, cl
mov rdx, rcx
or r8b, r11b
mov r8, r11
bts di, ax
or di, 0x79f0
mov rdi, r9
cmp r9, 0xffffffffffffffff
jmp 0x1404c34d3
jne 0x1404c3510
movzx eax, word [rbx + rdx]
cmp cx, 0x7b04
clc
cmp sil, dl
mov word [rdx], ax
lea rdx, [rdx + 2]
stc
test ax, ax
jmp 0x1404c34f6
je 0x1404c3560
sub r8, 1
jmp 0x1404c3505
jne 0x1404c34d9
jmp 0x1404c3560
movzx eax, word [rbx + rdx]
cmc
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jmp 0x1404c3524
je 0x1404c3548
sub r8, 1
jmp 0x1404c3533
je 0x1404c3548
sub rdi, 1
jmp 0x1404c3542
jne 0x1404c3510
test rdi, rdi
jmp 0x1404c3550
jne 0x1404c3560
mov word [rdx], r10w
jmp 0x1404c3560
test r8, r8
jmp 0x1404c3568
jne 0x1404c3429
cmp r9, 0xffffffffffffffff
jmp 0x1404c3577
jne 0x1404c3594
mov word [rcx + r11*2 - 2], r10w
not r10b
lea r10d, [r8 + 0x50]
jmp 0x1404c358f
jmp 0x1404c3429
mov word [rcx], r10w
call fcn.1404b615c
mov ebx, 0x22
jmp 0x1404c35a7
jmp 0x1404c3416

Function at 0x1404cb33e
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
shl dl, 0x74
cmp esp, ecx
sub rsp, 0x20
movzx ebx, dx
mov r8, rsi
mov rbx, rcx
bswap r9w
not cl
cdq
lea r9, [0x1400c63c0]
mov r8b, cl
mov ecx, 3
lea r8, [0x1400c63b8]
lea rdx, [0x1400cfb70]
jmp 0x1404cb37b
call fcn.1404cc2ea
test rax, rax
je 0x1404cb3a8
mov rcx, rbx
xadd bx, bx
adc bx, r9w
add rsp, 0x20
mov bl, r10b
pop rbx
jmp 0x1404cb3a1
push qword [0x1400b8d90]
ret
add rsp, 0x20
xchg bx, bx
pop rbx
jmp 0x1404cb3b5
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404cb439
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sar r8b, 0xdd
rcl dh, 0x28
sub rsp, 0x20
cdq
cqo
movzx ebx, di
mov ebx, ecx
lea r9, [0x1400c63d0]
movsxd r8, r10d
mov ecx, 5
xchg r8b, dl
movsx rdx, r13w
lea r8, [0x1400c63c8]
lea rdx, [0x1400cf758]
jmp 0x1404cb477
call fcn.1404cc2ea
mov ecx, ebx
cmp r8b, 0xd
cmc
test rax, rax
jmp 0x1404cb48b
je 0x1404cb4a4
add rsp, 0x20
bswap ebx
movzx bx, dil
pop rbx
push qword [0x1400b8d90]
ret
add rsp, 0x20
pop rbx
jmp 0x1404cb4ae
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1404cb4b5
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
clc
stc
rcl bx, 0x73
push rdi
sal r9b, cl
sub rsp, 0x20
movzx edi, cx
mov r9b, r11b
mov rbx, rdx
mov dil, r10b
lea r9, [0x1400c63d8]
mov edi, ecx
cqo
cmova r8d, esi
movsxd rcx, r15d
lea rdx, [0x1400cf748]
not r8b
mov ch, 0x5e
mov ecx, 6
lea r8, [0x1400c63d0]
jmp 0x1404cb504
call fcn.1404cc2ea
mov rdx, rbx
cmovnp rcx, r13
movzx rcx, bx
shrd rcx, rcx, 0xd3
mov ecx, edi
clc
test rax, rax
jmp 0x1404cb524
je 0x1404cb535
call qword [0x1400b8d90]
jmp 0x1404cb53b
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
cmc
rol dil, 0x1b
adc dil, 0x54
add rsp, 0x20
xchg rdi, rdi
movzx rdi, bp
pop rdi
jmp 0x1404cb55a
ret

Function at 0x1404cb6c4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
sal rbx, 0x1c
bts bx, si
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
dec bpl
ror di, 0x9b
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
movzx r9w, spl
movsxd rbp, r12d
not r8
mov esi, edx
bswap dx
movzx r8, cx
movsx r8, r8w
lea r9, [0x1400c63e8]
bswap edx
jmp 0x1404cb713
mov rbp, rcx
lea r8, [0x1400c63e0]
lea rdx, [0x1400cf190]
mov ecx, 0xb
jmp 0x1404cb72e
call fcn.1404cc2ea
mov rcx, rbp
jmp 0x1404cb745
test rax, rax
jmp 0x1404cb74d
je 0x1404cb769
mov r9d, ebx
movsx edx, ax
mov r8, rdi
mov edx, esi
call qword [0x1400b8d90]
jmp 0x1404cb795
sub edx, edx
jmp 0x1404cb770
call fcn.1404cbdc2
mov ecx, eax
not rdx
mov r9d, ebx
xchg r8b, r8b
mov r8, rdi
bswap dx
movsx rdx, cx
movzx edx, ax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
sar dil, cl
add rsp, 0x30
seta dil
movsx rdi, r13w
pop rdi
jmp 0x1404cb7b9
ret
Function at 0x1404d7f7c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
sub rbx, 0x748a5137
btc bx, dx
mov qword [rsp + 0x18], rsi
push rdi
btc di, bp
sub rsp, 0x20
shr bh, cl
rcr dil, cl
btc ebx, r10d
sub esi, esi
rcl di, 0
mov rdi, rdx
test edi, 0xed364e4
and bl, 0x3a
mov rbx, rcx
clc
test rcx, rcx
je 0x1404d8065
cmp word [rcx], si
jmp 0x1404d7fca
je 0x1404d8065
lea rdx, [0x1400d1d08]
call fcn.140203869
test eax, eax
je 0x1404d8065
lea rdx, [0x1400d1d00]
jmp 0x1404d7ff6
mov rcx, rbx
jmp 0x1404d7ffe
call fcn.140203869
test eax, eax
jne 0x1404d8053
mov ecx, dword [rdi + 8]
movzx r9, bx
cdq
bswap r9w
lea r9d, [rsi + 2]
cmovb r8d, eax
cqo
movzx dx, r14b
lea r8, [rsp + 0x30]
cwd
mov edx, 0x2000000b
jmp 0x1404d8037
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1404d80a5
mov eax, dword [rsp + 0x30]
jmp 0x1404d804e
jmp 0x1404d80c3
mov rcx, rbx
jmp 0x1404d805b
call fcn.1404e1107
jmp 0x1404d80c3
mov ecx, dword [rdi + 8]
movsx edx, si
setle dl
cmovne dx, bx
lea r8, [rsp + 0x30]
cqo
mov r9d, 0x597b623a
sete dh
mov r9d, 2
mov edx, 0x20001004
jmp 0x1404d8092
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d809f
jne 0x1404d80b1
sub eax, eax
jmp 0x1404d80ac
jmp 0x1404d80c3
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1404d80c3
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
rcr dil, 0xa1
shrd rsi, rsi, 0xe
mov rsi, qword [rsp + 0x40]
sub dil, r13b
neg edi
btr rdi, rax
add rsp, 0x20
bswap rdi
movzx di, r9b
mov dil, 0x3e
pop rdi
ret

Function at 0x1404d80f0
Capabilities:
Encrypt data using rc4 prga
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
not rbx
rcr bl, cl
mov qword [rsp + 0x18], rsi
rol sil, 0x53
movzx rbx, r12w
bts ebx, r11d
push rdi
not sil
sub rsp, 0x20
movsxd rbx, r12d
setae bl
not bx
mov esi, edx
movzx rbx, r13w
mov ebx, ecx
jmp 0x1404d8129
call fcn.1404ca1d7
mov ecx, ebx
lea r8, [rsp + 0x30]
ror di, 0xc6
mov r9b, dl
rcl rdi, cl
and ecx, 0x3ff
bt di, r9w
movsx di, cl
mov r9d, 2
btc dx, 0x3c
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
jmp 0x1404d816a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test eax, eax
jmp 0x1404d817a
je 0x1404d8241
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d8189
je 0x1404d8237
test esi, esi
jmp 0x1404d8196
je 0x1404d8237
mov r9, qword [rdi + 0x98]
sal al, 0xb4
movsx edx, bp
bts rax, r9
mov r8d, r10d
movzx edx, word [r9]
bts cx, bx
rcl ax, cl
lea rcx, [r9 + 2]
cwde
btr rax, r12
or ah, 0xe7
lea eax, [rdx - 0x41]
jmp 0x1404d81cf
cmp ax, 0x19
jmp 0x1404d81d8
jbe 0x1404d81f4
sub dx, 0x61
cmp r13, r8
cmp dx, 0x19
jmp 0x1404d81ee
ja 0x1404d820d
movzx edx, word [rcx]
jmp 0x1404d81fc
inc r8d
add rcx, 2
jmp 0x1404d8208
jmp 0x1404d81c7
or rcx, 0xffffffffffffffff
jmp 0x1404d8216
inc rcx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d8223
jne 0x1404d8216
cmp r8d, ecx
jmp 0x1404d8231
je 0x1404d8241
mov eax, 1
jmp 0x1404d8243
xor eax, eax
mov rbx, qword [rsp + 0x38]
xor di, 0x4490
rol dil, 0x3a
sub sil, r13b
mov rsi, qword [rsp + 0x40]
test r12, r8
stc
xchg dil, dil
add rsp, 0x20
movzx rdi, bp
movsx edi, r8w
jmp 0x1404d8271
pop rdi
ret
Function at 0x1404d9971
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
jmp 0x1404d998e
mov qword [rax + 8], rbx
cmp bp, 0x1c96
clc
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
test r13d, r12d
cmp rbx, rdx
mov qword [rax + 0x20], rdi
stc
cmp r8b, r8b
jmp 0x1404d99b3
push r14
jmp 0x1404d99ba
sub rsp, 0x40
jmp 0x1404d99c3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
jmp 0x1404d99d7
je 0x1404d9b4d
mov rsi, rax
cmc
cmp word [rax], r14w
jmp 0x1404d99ea
je 0x1404d9a31
or rax, 0xffffffffffffffff
jmp 0x1404d99f9
inc rax
test rsi, rcx
jmp 0x1404d9a04
cmp word [rsi + rax*2], r14w
jne 0x1404d99f9
lea rsi, [rsi + rax*2]
test r10b, al
jmp 0x1404d9a1b
add rsi, 2
test r14b, r8b
cmp word [rsi], r14w
jmp 0x1404d9a2b
jne 0x1404d99f0
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
sal r8w, 0xa
movsx r9, r8w
btr r9d, 0x4d
add rsi, 2
sal r9w, cl
ror r8d, cl
sar rsi, 1
sal r8w, cl
mov r8, rbx
test r10d, r14d
ror r9w, 0xa
mov r9d, esi
test rbx, rdx
jmp 0x1404d9a74
mov dword [rsp + 0x28], r14d
cmp r14w, ax
clc
stc
sub edx, edx
test bpl, 0xc5
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.1404c9fc1
movsxd rbp, eax
clc
stc
test eax, eax
jmp 0x1404d9a9d
je 0x1404d9b4d
mov rcx, rbp
jmp 0x1404d9aab
call fcn.1404c9f05
mov rdi, rax
cmc
test rax, rax
jmp 0x1404d9abc
je 0x1404d9b30
mov qword [rsp + 0x38], r14
and r9b, r10b
sal r8, 0x83
movzx r9w, r8b
mov r9d, esi
and r8b, 6
btr r8, 0xd7
mov qword [rsp + 0x30], r14
mov r8, rbx
clc
mov dword [rsp + 0x28], ebp
stc
cmp r11, 0x79a65946
sub edx, edx
xor ecx, ecx
jmp 0x1404d9afd
mov qword [rsp + 0x20], rax
jmp 0x1404d9b07
call fcn.1404c9fc1
test eax, eax
jmp 0x1404d9b13
je 0x1404d9b30
mov rsi, rdi
mov di, r13w
bswap di
mov rdi, r14
jmp 0x1404d9b2b
jmp 0x1404d9b3b
mov rsi, r14
movsxd rcx, esp
cmovo cx, r15w
mov rcx, rdi
jmp 0x1404d9b43
call fcn.1404c9e81
jmp 0x1404d9b55
mov rsi, r14
jmp 0x1404d9b55
test rbx, rbx
jmp 0x1404d9b5d
je 0x1404d9b6c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
dec bp
mov rax, rsi
or bp, 0x18df
mov rsi, qword [rsp + 0x60]
movsxd rdi, r15d
mov rbp, qword [rsp + 0x58]
jmp 0x1404d9b8e
mov rdi, qword [rsp + 0x68]
btc r14, 0xca
adc r14b, r13b
add rsp, 0x40
xchg r14d, r14d
cmovb r14d, esp
movzx r14d, r15w
pop r14
jmp 0x1404d9bb1
ret
Function at 0x1404d9bb2
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
test r8b, r8b
test r12b, 0x8b
mov qword [rsp + 0x18], rsi
push rdi
test ax, 0x165f
cmp r13w, r14w
sub rsp, 0x20
jmp 0x1404d9bda
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jmp 0x1404d9bed
je 0x1404d9ccb
mov rbp, rax
test ah, 0xaf
jmp 0x1404d9bfe
cmp word [rax], si
je 0x1404d9c42
or rax, 0xffffffffffffffff
jmp 0x1404d9c10
inc rax
jmp 0x1404d9c19
cmp word [rbp + rax*2], si
jmp 0x1404d9c23
jne 0x1404d9c10
lea rbp, [rbp + rax*2]
stc
add rbp, 2
cmp word [rbp], si
jmp 0x1404d9c3c
jne 0x1404d9c07
sub rbp, rbx
test r9b, 0x77
rcl rcx, cl
add rbp, 2
and cl, 0xb3
sar rbp, 1
movsxd rcx, r13d
add rbp, rbp
movsxd rcx, ecx
movzx cx, r13b
mov rcx, rbp
jmp 0x1404d9c6c
call fcn.1404c9f05
mov rdi, rax
clc
test rax, rax
jmp 0x1404d9c7d
je 0x1404d9cb1
mov r8, rbp
cmovns rcx, rdi
cwd
mov dl, r12b
mov rdx, rbx
movzx rcx, si
cmovo cx, sp
bswap ecx
mov rcx, rax
jmp 0x1404d9ca4
call fcn.1404a4307
mov rsi, rdi
test si, 0x4a16
sub ecx, ecx
jmp 0x1404d9cb8
call fcn.1404c9e81
mov rcx, rbx
jmp 0x1404d9cc5
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov ah, 0xf4
cmp cl, r11b
mov rax, rsi
rcl bp, 0xf3
mov rsi, qword [rsp + 0x40]
neg bpl
mov rbp, qword [rsp + 0x38]
shr dil, 0x70
mov rdi, 0x42f62164
add rsp, 0x20
pop rdi
jmp 0x1404d9cff
ret