joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14049dc3b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14049dc54
mov qword [rax + 8], rbx
cmp al, bh
stc
jmp 0x14049dc60
mov qword [rax + 0x10], rsi
movzx esi, cx
rcl si, cl
jmp 0x14049dc6f
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
test dh, 0xa6
cmc
push r15
sub rsp, 0x30
bts r15w, r15w
mov rdi, r9
sub r15w, dx
cmc
bsf r15d, edx
mov rsi, rdx
sal r14b, cl
sub rsi, rcx
shr r14b, cl
sub rdi, r8
clc
test rcx, 0x5c777434
shrd r15, r11, 0x92
mov r15, rcx
movzx cx, r11b
sar rsi, 1
mov rcx, qword [rsp + 0x60]
movsxd r14, ecx
shr r14b, 0xb
xchg r14w, r14w
sub ebx, ebx
dec r14w
cmp r15w, 0x35f3
sar rdi, 1
sub r14b, 0xf8
btr r14, 0xc2
mov r14, r8
test rcx, rcx
jmp 0x14049dcec
jne 0x14049dd05
call fcn.1404a812c
mov rcx, qword [rax + 8]
jmp 0x14049dd00
jmp 0x14049dd09
mov rcx, qword [rcx + 8]
test rcx, rcx
jmp 0x14049dd11
jne 0x14049ddbc
cmp esi, edi
movzx ecx, r13w
cdqe
mov eax, edi
cmovl eax, esi
cmp al, r13b
rol ecx, 0xb0
movsxd rcx, eax
cmp ah, 0x6c
mov eax, 1
cmp r9w, 0x4d16
clc
test rcx, rcx
je 0x14049dd77
sub r15, r14
xor rdx, r12
movzx edx, word [r15 + r14]
cmp cl, spl
clc
cmp dx, word [r14]
jmp 0x14049dd5d
jne 0x14049dd9b
add r14, 2
stc
cmp r13w, 0x44f1
sub rcx, rax
jne 0x14049dd4b
cmp esi, edi
jmp 0x14049dd7e
je 0x14049ddb0
or ecx, 0xffffffff
cmp esi, edi
jmp 0x14049dd8e
cmovl eax, ecx
jmp 0x14049dd96
jmp 0x14049de25
sbb ebx, ebx
clc
cmp r10b, r14b
cmp rdi, 0x721f466b
and ebx, 0xfffffffe
add ebx, eax
mov ax, sp
mov eax, ebx
jmp 0x14049ddb7
jmp 0x14049de25
mov dword [rsp + 0x28], edi
movsxd rdx, r10d
jmp 0x14049ddc8
mov r9d, esi
mov r8, r15
movsx edx, dx
mov qword [rsp + 0x20], r14
movzx dx, dil
movsxd rdx, edx
mov dl, r10b
mov edx, 0x1000
jmp 0x14049ddeb
call fcn.1404c0905
test eax, eax
jmp 0x14049ddf7
jne 0x14049de1d
call fcn.1404b2d1c
mov dword [rax], 0x16
cdqe
movzx rax, r10w
mov eax, 0x7fffffff
jmp 0x14049de18
jmp 0x14049de25
sub eax, 2
rcr esi, cl
not di
mov rbx, qword [rsp + 0x40]
sbb dil, 0x33
mov rsi, qword [rsp + 0x48]
sal r14, 0xe3
add dil, 0xa5
mov rdi, qword [rsp + 0x50]
sub r14b, r15b
not r15w
mov r14, qword [rsp + 0x58]
add rsp, 0x30
mov r15d, 0x37482863
bswap r15w
movzx r15, r8w
pop r15
jmp 0x14049de65
ret
Function at 0x14049ea78
Capabilities:
Terminate process

Disassembly:
xchg edi, eax
in eax, 0x75
xor eax, 0x2ee59709
jl 0x140177745
sbb dh, byte [0x15a63c7e7]
xor eax, 0x1a4c50f1
mov dl, 0x2e
sub al, 0x64
sbb ch, ah
jne 0x140177772
mov fs, ebp
pop rdx
jb 0x1401776f1
lahf
in eax, 0xc2
out dx, al
or eax, 0xa050e598
setge ch
in eax, 0xfc
in eax, 0xfc
push 0xffffffffa2e59e90
wait
cli
jle 0x140177733
fldenv [r9]
outsd dx, dword [rsi]
sbb cl, byte [rbp + 0x14]
nop
test ebp, esp
lea ecx, [rax - 0x46]
add dword [r8], r8d
add byte [rax - 0x672b546], ch
test al, 0xba
invalid
invalid
stc
retf 0x1ce1
test al, 0xba
invalid
sbb ebx, dword [rcx + riz*2 - 0x19]
add ch, bl
in al, dx
invalid
cwde
sub eax, 0xa593cb90
retf
xchg ebx, eax
movsd dword [rdi], dword [rsi]
mov edi, 0xc166b228
jg 0x140177739
retf
xchg esi, eax
movsd dword [rdi], dword [rsi]
sub al, 0xd3
invalid
cmp eax, 0xa585af05
mov ah, 0x7b
mov al, 0xcb
xor eax, 0x92e0f849
movsd dword [rdi], dword [rsi]
out dx, al
stosb byte [rdi], al
invalid
or ch, byte [rsi]
sub eax, 0x897d0e77
mov ch, 0x46
push 0x38
sbb byte [rcx], bh
push rbp
hlt
mov dword [rbx + riz*8 - 0x5b], ebp
invalid
int 0x54
invalid
push rbx
or bx, di
sub rsp, 0x20
btr bx, 0xa0
mov bx, si
cmp r14b, 0x32
mov rbx, rcx
xor ecx, ecx
jmp 0x14049ea97
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x14049eaa5
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
btc rdx, 0x80
mov edx, 0xc0000409
xadd bh, bl
add rsp, 0x20
not bl
movzx bx, r15b
pop rbx
jmp switch.0x14049ead2
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x14049f54d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
cmp r8b, r15b
stc
push rsi
btr rsi, 0xe3
push rdi
movsxd rsi, edx
push r12
jmp 0x14049f56c
push r14
push r15
shl r15w, 0x6e
btr si, 0xfb
sub rsp, 0x20
movsx r12d, ax
mov esi, dword [r8 + 0xc]
mov r15, 0x6ff90f07
movzx r14, si
mov r12, rcx
mov di, 0x2035
cmovo cx, r15w
mov rcx, r8
cmovle r15, r13
mov rdi, r9
mov r14, r8
cmove r15, rbx
mov r15, rdx
jmp 0x14049f5b6
call fcn.1400fac34
mov r10, qword [r12]
mov ebp, eax
cmc
mov qword [rdi], r10
test ch, 0xd2
clc
test esi, esi
jmp 0x14049f5d0
je 0x14049f6df
movsxd rax, dword [r14 + 0x10]
movzx ecx, di
lea ecx, [rsi - 1]
rcl bl, cl
mov esi, ecx
inc bl
lea rcx, [rcx + rcx*4]
adc bl, 0xa8
setl bl
cmp al, bpl
lea rbx, [rax + rcx*4]
add rbx, qword [r15 + 8]
test r14, rsi
test r11b, 0x40
cmp ebp, dword [rbx + 4]
jmp 0x14049f60a
jle 0x14049f5c9
cmp ebp, dword [rbx + 8]
jmp 0x14049f618
jg 0x14049f5c9
mov rcx, qword [r15]
lea rdx, [rsp + 0x50]
test dx, di
sub r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
rcr r9d, cl
ror r9b, cl
movsxd r10, r8d
sub ecx, ecx
add r8, qword [rsp + 0x50]
mov r9d, dword [rbx + 0xc]
sal r10b, cl
or r10w, dx
mov r10d, dword [rax]
test ebp, 0x7f8a7e23
clc
test r9d, r9d
jmp 0x14049f663
je 0x14049f6a2
lea rdx, [r8 + 0xc]
mov ax, r12w
xadd ah, al
movsxd rax, dword [rdx]
clc
cmp bpl, bl
jmp 0x14049f680
cmp rax, r10
jmp 0x14049f688
je 0x14049f6a2
inc ecx
add rdx, 0x14
clc
cmc
test ch, 0x2b
cmp ecx, r9d
jb 0x14049f674
cmp ecx, r9d
jmp 0x14049f6aa
jae 0x14049f5c9
mov rax, qword [r12]
movzx r15w, dl
lea rcx, [rcx + rcx*4]
sar bl, 0x5f
stc
movsxd rcx, dword [r8 + rcx*4 + 0x10]
clc
sub bl, 0x4b
mov rcx, qword [rcx + rax]
dec si
shr bh, cl
mov qword [rdi], rcx
rcl r12d, 0x4c
movsx r12w, r12b
mov rbx, qword [rsp + 0x58]
bts esi, r12d
not r15b
cwde
mov rax, rdi
mov rbp, qword [rsp + 0x60]
bt rdi, rax
xor r12d, 0x6f2c6e2b
shl r15b, cl
add rsp, 0x20
movzx r12d, bp
xchg r15b, r12b
pop r15
movsx r14, bp
movzx edi, r12w
cmovge si, dx
pop r14
bswap esi
not r12b
pop r12
movsx si, r10b
pop rdi
movzx rsi, di
movsx esi, r14w
movsxd rsi, esi
pop rsi
jmp 0x14049f73b
ret
Function at 0x14049f948
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
neg bp
mov qword [rsp + 0x18], rsi
cmp si, dx
bswap rbp
push rdi
and dil, r13b
xor bpl, 0x8d
btc di, di
push r12
push r13
movsxd rdi, r13d
bt bx, di
movzx edi, r9w
push r14
xor bl, r15b
setns bpl
push r15
sub rsp, 0x40
jmp 0x14049f993
mov rbx, qword [rsp + 0x90]
mov r12, rdx
cmovs edi, r9d
setae dl
mov rbp, rcx
movzx r14w, r8b
mov rdx, r9
movsxd rdi, r10d
xchg r15w, r14w
movsx r15w, r9b
mov rcx, rbx
setb dil
movzx di, cl
mov rdi, r9
movsx r14, cx
movzx r14d, ax
cmovnp r15w, r11w
mov r15d, r8d
movsx r14, si
movsxd r14, edi
mov r14d, dword [rbx + 0xc]
jmp 0x14049f9ea
call fcn.1400fac34
xor r10d, r10d
bt rsi, r12
not sil
movsx esi, r13w
mov esi, eax
jmp 0x14049fa05
test r14d, r14d
je 0x14049fc22
mov r11, qword [rdi + 8]
or eax, 0xffffffff
rcl r9b, cl
adc rdx, 0x512b0774
movsxd rbx, dword [rbx + 0x10]
movsx r8d, r11w
cmc
mov r9d, eax
mov r13d, eax
jmp 0x14049fa33
mov edx, r14d
not ax
lea r8d, [rdx - 1]
lea rcx, [r8 + r8*4]
lea rax, [r11 + rcx*4]
cmc
cmp esi, dword [rax + rbx + 4]
jmp 0x14049fa4f
jle 0x14049fa5f
cmp esi, dword [rax + rbx + 8]
jle 0x14049fa7a
mov edx, r8d
clc
test r8b, r14b
test r10w, 0x471c
test r8d, r8d
jmp 0x14049fa74
jne 0x14049fa39
mov r8d, r10d
test edx, edx
jmp 0x14049fa84
je 0x14049faa8
lea eax, [rdx - 1]
shl dl, 0xfe
add dh, al
lea rax, [rax + rax*4]
lea rdx, [rbx + rax*4]
stc
add rdx, r11
jmp 0x14049faa3
jmp 0x14049faaf
mov rdx, r10
movsx cx, cl
lea rcx, [r11 + rbx]
or r11d, 0xffffffff
stc
test rdx, rdx
jmp 0x14049fac0
je 0x14049fae6
mov eax, dword [rdx + 4]
clc
cmp dword [rcx], eax
jmp 0x14049fad1
jle 0x14049fb2f
mov eax, dword [rdx + 8]
test sp, di
cmp dword [rcx + 4], eax
jg 0x14049fb2f
cmp r15d, dword [rcx]
jmp 0x14049faee
jl 0x14049fb2f
cmp r15d, dword [rcx + 4]
jmp 0x14049fafd
jg 0x14049fb2f
cmp r9d, r11d
movsx rax, si
mov eax, r15d
mov ah, 0x4f
mov eax, r8d
setne r13b
mov r13d, r8d
jmp 0x14049fb1f
cmovne eax, r9d
movzx r9, bp
mov r9d, eax
jmp 0x14049fb2f
inc r8d
test ch, dh
clc
add rcx, 0x14
cmc
stc
cmp r8d, r14d
jmp 0x14049fb43
jb 0x14049fab8
cmp r9d, r11d
mov dil, 0xe8
cbw
movzx r14w, r15b
mov qword [rsp + 0x20], r12
movzx esi, r9w
mov r15b, 0x86
movsx eax, r11w
mov eax, r10d
movzx bx, r8b
mov qword [rsp + 0x30], r12
cmovne eax, r9d
cmovbe r11d, esi
bswap ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov r12w, r14w
mov dword [rsp + 0x28], eax
cbw
lea eax, [r13 + 1]
bswap r13
movzx r15w, r8b
movups xmm0, xmmword [rsp + 0x20]
cmovne r10d, eax
not r13b
mov r14w, 0x1bd7
movzx di, dl
mov rax, rbp
movzx r14d, dx
mov dword [rsp + 0x38], r10d
xchg dil, r14b
cmovae r12d, eax
movups xmm1, xmmword [rsp + 0x30]
movdqu xmmword [rbp], xmm0
movsx di, r10b
mov r14b, bpl
movsx r15, sp
movdqu xmmword [rbp + 0x10], xmm1
cmovg rbp, rdi
mov rbp, qword [r11 + 0x38]
movsx r12w, sil
movzx di, r11b
movzx r12d, r13w
mov rsp, r11
pop r15
mov dil, 0xb6
mov r14w, sp
pop r14
movzx edi, ax
movsx r13, sp
pop r13
movzx r12w, spl
pop r12
movsx di, bl
pop rdi
jmp 0x14049fc21
ret
call fcn.1404b4c79
int3
Function at 0x1404ae489
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404ae498
mov qword [rsp + 0x10], rsi
and sil, 0x8a
push rdi
neg di
sub rsp, 0x30
xor edi, edx
mov edi, edx
setl sil
cmp dl, r10b
bsf si, r11w
mov rsi, rcx
jmp 0x1404ae4c5
test r8, r8
jmp 0x1404ae4cd
jne 0x1404ae4f4
call fcn.1404b2d1c
mov dword [rax], 0x16
jmp 0x1404ae4e3
call fcn.1404b39ea
sub eax, eax
jmp 0x1404ae4ef
jmp 0x1404ae5df
mov rdx, r9
cmovbe ecx, r11d
bswap cx
movzx ecx, ax
mov rcx, r8
jmp 0x1404ae509
call fcn.1404ae642
mov rbx, rax
test rax, rax
jmp 0x1404ae519
je 0x1404ae58f
lea rax, [rsp + 0x50]
movzx rcx, ax
mov rdx, rdi
jmp 0x1404ae530
mov qword [rsp + 0x28], rax
movsx ecx, ax
movsxd r8, esp
lea r8, [0x140094b24]
jmp 0x1404ae54b
mov eax, dword [rsp + 0x60]
mov r9, rbx
cmova rcx, r14
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404ae562
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp r15b, bpl
stc
test rax, rax
jmp 0x1404ae577
jne 0x1404ae601
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404ae58a
call fcn.1404b2d89
sub edi, edi
test rbx, rbx
jmp 0x1404ae599
je 0x1404ae5dc
mov rcx, qword [rbx + 0x10]
test r13b, 0xf6
test rcx, rcx
je 0x1404ae5b6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmc
test rcx, rcx
jmp 0x1404ae5c3
je 0x1404ae5cf
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404ae5d7
call fcn.1404c6c19
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
bts di, r11w
sbb dil, bpl
rol dil, cl
add rsp, 0x30
not dil
movsx edi, r8w
pop rdi
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jmp 0x1404ae60e
je 0x1404ae622
mov eax, dword [rsp + 0x50]
clc
stc
mov dword [rcx], eax
test r10w, 0x130e
sub ebx, ebx
jmp 0x1404ae629
jmp 0x1404ae591

Function at 0x1404ae8ff
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404ae90c
call fcn.1404d024f
cmp eax, 1
jmp 0x1404ae919
je 0x1404ae954
mov rax, qword gs:[0x60]
test bh, 0xa4
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jne 0x1404ae954
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx rdx, r11w
xchg dh, dl
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404ae859
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b25c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rdx
movsxd r8, r8d
sar ax, cl
bt r9w, 0xc8
mov qword [rsp + 8], rcx
push rbp
add rcx, 0x5c2a36dd
sal bpl, cl
mov rbp, rsp
mov cx, cx
rdtsc
sub rsp, 0x40
lahf
rdtsc
lea rax, [rbp + 0x10]
mov qword [rbp - 0x18], rax
cbw
mov ax, bx
movzx edx, r9w
lea r9, [rbp + 0x28]
lea rax, [rbp + 0x18]
not dh
mov qword [rbp - 0x10], rax
movzx r8d, cx
cdqe
mov cl, 7
lea r8, [rbp - 0x18]
cbw
not rax
jmp 0x1404b2626
mov eax, 2
movsx rdx, r13w
movsx cx, bpl
movsxd rcx, r13d
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x28], eax
jmp 0x1404b2647
mov dword [rbp - 0x20], eax
call fcn.140096f80
add rsp, 0x40
mov rbp, rsp
cmove bp, si
bswap bp
pop rbp
jmp 0x1404b2663
ret
Function at 0x1404bfe5e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
bt bx, r10w
bts r11w, r12w
adc r11b, 0x25
sub rsp, 0x20
xor r10d, r10d
movzx r11w, r13b
movzx r11, r15w
or r11, rax
mov rbx, rdx
adc r11d, r10d
mov r11, rcx
test r9, r9
jmp 0x1404bfe96
jne 0x1404bfeed
test rcx, rcx
jmp 0x1404bfea4
jne 0x1404bfefb
test rdx, rdx
jmp 0x1404bfeb2
je 0x1404bfed6
call fcn.1404b2d1c
mov ebx, 0x16
jmp 0x1404bfec7
mov dword [rax], ebx
call fcn.1404b39ea
mov r10d, ebx
xor di, 0x1a0e
mov rbx, qword [rsp + 0x30]
mov eax, r10d
add rsp, 0x20
movsx rdi, r15w
jmp 0x1404bfeeb
pop rdi
ret
test r11, r11
jmp 0x1404bfef5
je 0x1404bfeb8
test rbx, rbx
je 0x1404bfeb8
test r9, r9
jmp 0x1404bff0c
je 0x1404bff29
test r8, r8
jmp 0x1404bff1a
jne 0x1404bff29
mov word [rcx], r10w
jmp 0x1404bfeb8
mov rdi, r9
jmp 0x1404bff35
cmp word [rcx], r10w
jmp 0x1404bff3e
je 0x1404bff54
add rcx, 2
clc
cmc
sub rdx, 1
jne 0x1404bff35
test rdx, rdx
jmp 0x1404bff5c
jne 0x1404bff70
mov word [r11], r10w
jmp 0x1404bff6b
jmp 0x1404bfeb8
cmp r9, 0xffffffffffffffff
jmp 0x1404bff79
jne 0x1404bffb7
sub r8, rcx
movzx eax, word [r8 + rcx]
cmp r13, r10
mov word [rcx], ax
cmp bp, r10w
cmp di, 0x60cc
lea rcx, [rcx + 2]
test ax, ax
jmp 0x1404bffa2
je 0x1404c001f
sub rdx, 1
jne 0x1404bff82
jmp 0x1404c001f
test r9, r9
jmp 0x1404bffbf
je 0x1404c0011
movzx eax, word [r8]
lea r8, [r8 + 2]
cmp edx, 0x650a5311
mov word [rcx], ax
cmc
add rcx, 2
cmp r14d, ebp
jmp 0x1404bffea
test ax, ax
jmp 0x1404bfff2
je 0x1404c0011
sub rdx, 1
je 0x1404c0011
sub rdi, 1
jmp 0x1404c000b
jne 0x1404bffc5
test rdi, rdi
jne 0x1404c001f
mov word [rcx], r10w
stc
test rdx, rdx
jne 0x1404bfed6
cmp r9, 0xffffffffffffffff
jne 0x1404c0048
mov word [r11 + rbx*2 - 2], r10w
seta r10b
bswap r10d
lea r10d, [rdx + 0x50]
jmp 0x1404bfed6
mov word [r11], r10w
jmp 0x1404c0051
call fcn.1404b2d1c
mov ebx, 0x22
jmp 0x1404bfec7
Function at 0x1404c11b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
bswap r10
mov qword [rax + 0x10], rbp
rcr bx, 0x6e
mov qword [rax + 0x18], rsi
test di, r10w
neg r10b
setge bl
mov qword [rax + 0x20], rdi
cmovge ebx, r11d
push r14
shr r10, 0x53
not r10b
or ebp, 0xffffffff
sar bx, cl
mov rbx, r8
rol r10w, 0x45
mov r10b, 0xbc
sbb r10b, 0xe8
cmp dword [rcx + 0x10], 0
bswap r10w
xchg r10, r10
mov r10, rdx
je 0x1404c137a
movsxd r9, dword [rcx + 0x10]
xadd eax, ecx
dec dil
lea r14, [0x140000000]
cmc
rcl al, 0x6c
rcr cx, cl
mov rdi, qword [rdx + 8]
bswap r11w
clc
xor esi, esi
and dl, 0xcd
cdqe
shr cl, cl
add r9, rdi
and r11b, dil
xor r8d, r8d
movzx ax, bh
xor r11w, 0x5b75
sal ax, 0x3e
mov edx, ebp
cmc
bsf ax, bp
movzx ecx, byte [r9]
sal ah, cl
movsx eax, r15w
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
btr r11w, r13w
adc r11b, al
sub r9, rax
mov r11d, dword [r9 - 4]
cmp rcx, rdi
shr r11d, cl
cmc
test r11d, r11d
je 0x1404c137a
mov rax, qword [r10 + 0x10]
mov r10d, dword [rax]
movsxd rax, edx
movsx cx, dil
btc rax, r15
movzx ecx, byte [r9]
and ecx, 0xf
shrd eax, eax, 0x4f
cbw
not al
movsx rax, byte [rcx + r14 + 0xc1a30]
test ax, 0x611d
mov cl, byte [rcx + r14 + 0xc1a40]
sub r9, rax
shrd eax, r10d, 0xa7
shl ah, 0x7e
ror ax, cl
mov eax, dword [r9 - 4]
cmc
shr eax, cl
cmp esp, 0x10bc545f
add esi, eax
cmc
test ax, r8w
lahf
mov eax, esi
add rax, r10
cmp r15b, 0x5b
lea rax, [rax + rdi]
jmp 0x1404c12ff
cmp rbx, rax
jmp 0x1404c1307
jb 0x1404c1369
movzx ecx, byte [r9]
movzx rax, r10w
movsx dx, r15b
mov edx, r9d
inc r8d
clc
bt eax, ecx
cmp al, sil
and ecx, 0xf
sar eax, cl
cdq
sal dl, cl
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
sub r9, rax
movzx dx, cl
xadd dx, dx
rcr edx, 2
mov edx, dword [r9 - 4]
shr edx, cl
jmp 0x1404c1359
dec edx
cmp r8d, r11d
jmp 0x1404c1363
jb 0x1404c12a6
test r8d, r8d
cmove edx, ebp
bswap eax
cdqe
mov eax, edx
jmp 0x1404c1380
mov eax, ebp
seta dil
mov rbx, qword [rsp + 0x10]
movzx di, dil
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
jmp 0x1404c13a0
ret
Function at 0x1404c8166
Capabilities:
Get thread local storage value

Disassembly:
push rbx
test cx, dx
sub rsp, 0x20
movsx bx, r13b
mov ebx, ecx
movsxd r9, ecx
lea r9, [0x1400c63d0]
movzx r8w, r15b
mov ecx, 5
movsx r8, r11w
cqo
lea r8, [0x1400c63c8]
movsx edx, cx
cwd
lea rdx, [0x1400cf758]
call fcn.1404c904a
mov ecx, ebx
jmp 0x1404c81b4
test rax, rax
jmp 0x1404c81bc
je 0x1404c81d7
add rsp, 0x20
mov bx, r15w
pop rbx
jmp 0x1404c81d0
jmp qword [case.0x1404c8daf.0]
add rsp, 0x20
pop rbx
jmp 0x1404c81e1
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404c81e8
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
bsr r9d, r12d
sub bh, 0x95
push rdi
cmove bx, r12w
sub rsp, 0x20
cmovge r8d, r12d
movsx rdi, bx
setnp dil
mov rbx, rdx
movsx edx, r13w
cqo
lea r9, [0x1400c63d8]
movzx edx, dx
movzx di, bl
bswap r8w
mov edi, ecx
cwd
lea rdx, [0x1400cf748]
jmp 0x1404c8235
mov ecx, 6
xchg r8b, r8b
jmp 0x1404c8242
lea r8, [0x1400c63d0]
jmp 0x1404c824e
call fcn.1404c904a
mov rdx, rbx
mov ecx, edi
test rax, rax
jmp 0x1404c8260
je 0x1404c8271
call qword [case.0x1404c8daf.0]
jmp 0x1404c8277
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
bsr edi, r11d
or rdi, r8
add rsp, 0x20
movzx di, bpl
mov edi, 0x367946ac
pop rdi
ret

Function at 0x1404c8428
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
test bl, 8
shr ebx, 0x45
mov qword [rsp + 0x10], rbp
rcr bh, 0x1b
mov qword [rsp + 0x18], rsi
stc
movzx si, dl
push rdi
jmp 0x1404c844b
sub rsp, 0x30
mov ebx, 0x17cc40de
setns dil
mov ebx, r9d
mov rdi, r8
movsxd rbp, r9d
movzx ebp, r12w
mov esi, edx
cqo
lea r9, [0x1400c63e8]
cwd
setl bpl
movzx rbp, r14w
mov rbp, rcx
bswap r8w
sete r8b
movsx edx, r9w
lea r8, [0x1400c63e0]
movzx rdx, dx
lea rdx, [0x1400cf190]
movsx rcx, sp
xchg cx, cx
mov ecx, 0xb
jmp 0x1404c84ac
call fcn.1404c904a
mov rcx, rbp
test rax, rax
jmp 0x1404c84bc
je 0x1404c84f0
mov r9d, ebx
movsx r8w, r14b
movzx r8, bx
bswap rdx
mov r8, rdi
movzx dx, al
movsx edx, cx
seto dh
mov edx, esi
jmp 0x1404c84e5
call qword [case.0x1404c8daf.0]
jmp 0x1404c8522
xor edx, edx
jmp 0x1404c84f7
call fcn.1404c8b3b
mov ecx, eax
cdq
movsx r9d, bp
movsxd rdx, r14d
mov r9d, ebx
jmp 0x1404c8512
mov r8, rdi
mov edx, esi
jmp 0x1404c851c
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
rcl bpl, cl
movsxd rbp, r13d
mov rbp, qword [rsp + 0x48]
btc rsi, 0xf3
inc di
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp 0x1404c8549
ret
Function at 0x1404d390b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
bsr ebx, r8d
push rdi
sub rsp, 0xf0
movsx edx, bp
mov rax, qword [0x1400b7288]
xadd edx, ebx
adc rdx, r13
xor rax, rsp
btc rbx, 0xe3
movsx bx, r11b
movzx ebx, cx
mov qword [rsp + 0xe0], rax
movsx rbx, ax
sub bx, 0x2572
or dword [rcx + 0x10], 0x104
not dl
setno dl
movzx rbx, bx
mov rbx, rcx
cmovp ecx, r13d
lea rcx, [rsp + 0x30]
setnp dh
cwd
mov edx, 0x55
jmp 0x1404d3978
call fcn.1404c86b1
cmp eax, 1
jmp 0x1404d3985
jle 0x1404d39de
or r9, 0xffffffffffffffff
lea rax, [rsp + 0x30]
jmp 0x1404d3999
sub edi, edi
jmp 0x1404d39a0
inc r9
cmp word [rax + r9*2], di
jmp 0x1404d39ad
jne 0x1404d39a0
inc r9
lea rcx, [rbx + 0x258]
lea r8, [rsp + 0x30]
jmp 0x1404d39c7
mov edx, 0x55
jmp 0x1404d39d1
call fcn.1404c0060
test eax, eax
jne 0x1404d3a11
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14049d217
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
movsx di, r8b
movzx edi, r13w
movzx rdi, r10w
pop rdi
jmp 0x1404d3a10
ret
xor r9d, r9d
stc
test r12b, cl
mov qword [rsp + 0x20], rdi
sub r8d, r8d
cmp bpl, 0x48
test r13b, 5
test rcx, rbp
sub edx, edx
sub ecx, ecx
call fcn.1404b3a60
int3
Function at 0x1404d4188
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xchg bh, bl
stc
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
shl rbx, cl
push r15
xadd bpl, r15b
cmc
sub rsp, 0x20
xor edi, edi
mov r15, r8
xadd bx, bx
mov ebx, edx
sar bp, 0x48
sal bpl, 0x83
mov rbp, rcx
test edx, edx
jmp 0x1404d41c8
js 0x1404d425a
mov rcx, qword [r15]
rcr r14b, 0xe5
lea eax, [rdi + rbx]
xor r14w, r11w
test r12d, 0x16675f0d
adc edx, ecx
cdq
bt esi, edi
stc
sub eax, edx
sub r14b, spl
movsxd rsi, ecx
sar eax, 1
stc
test r9b, 0x9d
movsxd rsi, eax
bsf r14w, r9w
cmove r14w, ax
shl edx, cl
mov r14, rsi
bswap dx
rol dh, cl
shl r14, 4
setl dl
movsx dx, bl
movzx dx, r14b
mov rdx, qword [r14 + rbp]
jmp 0x1404d4229
call fcn.1404c7963
test eax, eax
jmp 0x1404d4235
je 0x1404d42b2
jns 0x1404d424e
lea ebx, [rsi - 1]
jmp 0x1404d4249
jmp 0x1404d4252
lea edi, [rsi + 1]
clc
cmp edi, ebx
jle 0x1404d41ce
xor al, al
cmp r14w, ax
sar r15d, 0xe4
and rbx, 0x70584a
mov rbx, qword [rsp + 0x40]
adc dil, r9b
or r14d, 0x7b7a167f
mov rbp, qword [rsp + 0x48]
movzx r15d, r9w
mov esi, 0x23c9417a
movsxd rsi, edi
mov rsi, qword [rsp + 0x50]
bt edi, 0x5f
add rsp, 0x20
movzx rdi, bx
pop r15
pop r14
movsx edi, r8w
movzx rdi, r11w
movzx edi, di
pop rdi
jmp 0x1404d42b1
ret
lea rax, [rbp + 8]
test spl, 0x54
cmp bpl, 0xad
add rax, r14
jmp 0x1404d42c6
mov qword [r15], rax
mov al, 0xb1
mov al, 1
jmp 0x1404d426b

Function at 0x1404d4df4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
dec rbx
cmp r14b, 0x1d
adc bl, bpl
mov qword [rsp + 0x18], rsi
cmc
bswap rbx
rcr ebx, cl
push rdi
bts di, sp
bts edi, edi
sub rsp, 0x20
shld di, bp, 0x2c
xor esi, esi
adc bh, 0x85
sar dil, 0xf4
bts ebx, r15d
mov rdi, rdx
bt rbx, rsp
not bh
movzx rbx, di
mov rbx, rcx
cmp r15d, r8d
clc
test rcx, rcx
jmp 0x1404d4e48
je 0x1404d4f07
cmp word [rcx], si
jmp 0x1404d4e56
je 0x1404d4f07
lea rdx, [0x1400d1d08]
jmp 0x1404d4e68
call fcn.1402649cd
test eax, eax
jmp 0x1404d4e74
je 0x1404d4f07
lea rdx, [0x1400d1d00]
bswap cx
movsx cx, al
movzx rcx, ax
mov rcx, rbx
jmp 0x1404d4e94
call fcn.1402649cd
test eax, eax
jmp 0x1404d4ea0
jne 0x1404d4ef5
mov ecx, dword [rdi + 8]
not dh
mov dl, 0x83
mov r9b, dl
lea r9d, [rsi + 2]
bswap edx
mov r8w, r11w
lea r8, [rsp + 0x30]
setl dl
cmovns dx, dx
movzx rdx, dx
mov edx, 0x2000000b
jmp 0x1404d4ed4
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d4ee1
je 0x1404d4f42
mov eax, dword [rsp + 0x30]
jmp 0x1404d4ef0
jmp 0x1404d4f61
mov rcx, rbx
jmp 0x1404d4efd
call fcn.1404dde90
jmp 0x1404d4f61
mov ecx, dword [rdi + 8]
movzx rdx, si
setg r8b
lea r8, [rsp + 0x30]
cwd
mov r9d, 2
cwd
cmovg rdx, rsi
mov edx, 0x20001004
jmp 0x1404d4f2f
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d4f3c
jne 0x1404d4f4e
xor eax, eax
jmp 0x1404d4f49
jmp 0x1404d4f61
mov eax, dword [rsp + 0x30]
stc
test eax, eax
jne 0x1404d4f61
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
adc edi, 0xa913eaa
bts esi, ecx
or di, cx
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movzx rdi, r10w
not rdi
movsx di, r11b
pop rdi
jmp 0x1404d4f8d
ret