joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140454046
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
jmp 0x140454054
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmp cx, r10w
add rsp, 0x28
jmp 0x14045406c
ret

Function at 0x140454109
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
ror bl, 0xe9
push rbp
bsf bx, r9w
mov rbp, rsp
bts eax, eax
and al, 0xd9
sub rsp, 0x20
mov rax, qword [0x1400b7288]
movabs rbx, 0x2b992ddfa232
test esi, 0x6b7719da
cmp rax, rbx
jmp 0x140454142
jne 0x140454227
and qword [rbp + 0x18], 0
not rcx
xchg rcx, rcx
movzx ecx, sp
lea rcx, [rbp + 0x18]
jmp 0x14045415f
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045416e
mov qword [rbp + 0x10], rax
jmp 0x140454177
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
clc
cmp r13b, 0x3d
xor qword [rbp + 0x10], rax
jmp 0x14045418d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
stc
xor qword [rbp + 0x10], rax
jmp 0x1404541a3
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
neg cx
lea rcx, [rbp + 0x10]
test r13b, 0x95
cmp r9b, spl
cmc
shl rax, 0x20
stc
xor rax, qword [rbp + 0x20]
test dl, bl
xor rax, qword [rbp + 0x10]
xor rax, rcx
add cx, 0x18bf
stc
cmova bp, r15w
movabs rcx, 0xffffffffffff
movsxd rbp, ecx
cmp rdx, 0x48782239
and rax, rcx
bswap ecx
rol bpl, 0xae
movabs rcx, 0x2b992ddfa233
adc bpl, r11b
cmp rax, rbx
cmovnp bx, r9w
movsxd rbx, r11d
cmove rax, rcx
test r15w, r15w
mov qword [0x1400b7288], rax
add bpl, 0xca
btr bp, 0x16
ror ebx, cl
mov rbx, qword [rsp + 0x48]
movsx ebp, si
inc bp
movzx ebp, r11w
not rax
sar bp, cl
rcl ebp, cl
mov qword [0x1400b7280], rax
shl bp, 0xa2
movsxd rbp, esp
ror bpl, 0xcb
add rsp, 0x20
movsx rbp, di
jmp 0x140454261
pop rbp
jmp 0x140454267
ret

Function at 0x140454300
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
stc
test r9b, r8b
xor ecx, ecx
jmp 0x14045430f
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x14045431d
je 0x140454396
mov ecx, 0x5a4d
clc
test cl, 0xd7
cmp word [rax], cx
jmp 0x140454334
jne 0x140454396
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp r13b, 0x78
cmp dword [rcx], 0x4550
jmp 0x140454350
jne 0x140454396
mov eax, 0x20b
cmp sil, r9b
test esi, r8d
cmp word [rcx + 0x18], ax
jne 0x140454396
cmp dword [rcx + 0x84], 0xe
jmp 0x140454377
jbe 0x140454396
cmp dword [rcx + 0xf8], 0
jmp 0x140454389
setne al
jmp 0x140454391
jmp 0x1404543a1
sub al, al
jmp 0x1404543a1
add rsp, 0x28
jmp 0x1404543aa
ret
Function at 0x140458cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
cmp r11b, 0xda
cmp bh, bh
mov qword [rax + 0x18], rbp
push rsi
movsx bp, r15b
mov bp, 0x1397
neg bpl
push rdi
test r15b, 0xf3
dec bpl
push r12
movzx rbp, di
or rbp, r9
push r14
xor bpl, r14b
rol bp, cl
sub bp, si
push r15
sub r15, rdx
movzx r15, ax
rol bpl, 0x8b
sub rsp, 0x40
bswap rbp
bsf rbp, r9
xor r12d, r12d
mov r15, r8
xchg bp, bp
sbb bpl, 0x17
mov qword [rax + 0x20], r12
rol ebp, 0xb7
add bpl, r12b
or rdi, 0xffffffffffffffff
xchg bpl, bpl
bswap bp
mov bpl, 0x3c
mov rbp, rcx
jmp 0x140458d6e
inc rdi
cmp r8, rbp
cmp byte [rdi + rcx], r12b
jmp 0x140458d7d
jne 0x140458d6e
add rdi, 1
seto sil
movzx r14w, r12b
mov rbx, r12
movsx r14d, sp
mov r14w, 0x1c3f
cmovge si, di
mov rsi, rdi
movzx r14d, r14w
movzx r14w, sil
mov r14, rcx
jmp 0x140458db4
je 0x140458e11
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], r15
mov cx, 0x322c
not dx
mov r8, rsi
lea rcx, [rsp + 0x70]
mov rdx, r14
jmp 0x140458dde
call fcn.1404535cb
test eax, eax
jmp 0x140458dea
jle 0x140458e11
cdqe
jmp 0x140458df7
inc rbx
jmp 0x140458dff
lea r14, [r14 + rax]
sub rsi, rax
jmp 0x140458e0b
jne 0x140458dba
inc rbx
setbe ch
mov edx, 2
setne cl
cmovbe cx, r14w
mov rcx, rbx
call fcn.1400ffba6
mov r14, rax
jmp 0x140458e34
test rax, rax
jmp 0x140458e3c
je 0x140458f12
mov qword [rsp + 0x30], r12
sar si, 7
bsr si, bp
mov rsi, rax
test r12b, r14b
cmp r8b, 0xcf
test rbx, rbx
je 0x140458ebf
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
movsx edx, r14w
mov r8, rdi
mov rdx, rbp
xchg ch, ch
mov cl, r13b
not ch
mov rcx, rsi
jmp 0x140458e85
call fcn.1404535cb
test eax, eax
jmp 0x140458e91
jle 0x140458ebf
cdqe
cmp r15b, r11b
clc
add rsi, 2
cmc
lea rbp, [rbp + rax]
test dil, spl
jmp 0x140458eb0
sub rbx, 1
jmp 0x140458eb9
jne 0x140458e62
lea r11, [rsp + 0x40]
bswap r15d
mov word [rsi], r12w
jmp 0x140458ed3
mov rbx, qword [r11 + 0x38]
seta bpl
mov rax, r14
mov rbp, qword [r11 + 0x40]
movsx rsi, ax
mov rsp, r11
movsx di, bpl
movzx r15, si
pop r15
movsxd r12, eax
bswap r14
pop r14
movzx di, r8b
pop r12
pop rdi
movsxd rsi, ecx
cmovle rsi, r8
pop rsi
jmp 0x140458f11
ret
call fcn.140452d4c
int3
Function at 0x140499fc5
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x140499fd3
call fcn.1404a4258
mov r9d, 2
movsx ecx, bp
xchg dx, dx
cwd
lea r8, [rsp + 0x30]
jmp 0x140499ff0
mov rcx, qword [rax + 0x28]
cwd
lea edx, [r9 + 0x20]
jmp 0x140499fff
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp sp, 0x40d8
sub ecx, 0x30
jmp 0x14049a017
je 0x14049a059
sub ecx, 1
je 0x14049a04a
cmp ecx, 1
jmp 0x14049a02e
je 0x14049a03b
sub eax, eax
jmp 0x14049a064
mov eax, 3
jmp 0x14049a045
jmp 0x14049a064
mov eax, 1
jmp 0x14049a054
jmp 0x14049a064
mov eax, 2
jmp 0x14049a064
add rsp, 0x28
jmp 0x14049a06d
ret
Function at 0x14049b404
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
sal bl, 0xc3
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov sil, sil
sal si, 0x57
mov qword [rax + 0x20], rdi
sub sil, 0x31
sub bp, r15w
clc
push r14
btr di, dx
movzx di, cl
mov bl, byte [rcx]
lea r10, [rcx + 1]
bswap r14d
and r11, rsp
mov byte [rdx], bl
movsxd rdi, edx
mov esi, r9d
lea r14, [0x140000000]
mov rbp, r8
or r11b, r13b
rcr di, 0x96
mov r11, rdx
movzx di, r11b
mov dil, 0x87
rol di, cl
mov rdi, rcx
cmp dil, dl
test bh, 0x25
cmc
test bl, 4
jmp 0x14049b479
je 0x14049b4ba
movzx ecx, byte [r10]
and ecx, 0xf
setb al
movsx rax, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
jmp 0x14049b4a0
sub r10, rax
rcl ax, 0x56
rcr al, 0x4c
mov eax, dword [r10 - 4]
shr eax, cl
clc
cmp r9d, edx
mov dword [rdx + 4], eax
cmp dil, al
test bl, 8
jmp 0x14049b4c2
je 0x14049b4dd
mov eax, dword [r10]
add r10, 4
mov dword [rdx + 8], eax
cmp bx, 0x519a
test dil, al
cmp dl, sil
test bl, 0x10
je 0x14049b502
mov eax, dword [r10]
and r8b, bpl
movzx r8w, al
inc r8
add r10, 4
test r13d, edx
rcr r8b, 0x71
mov dword [rdx + 0xc], eax
movsxd rax, dword [r10]
bsr r8w, r9w
rcr r8b, cl
lea r8, [r10 + 4]
stc
clc
xor r9d, r9d
cmp r8w, r13w
clc
cmp byte [rsp + 0x30], r9b
jmp 0x14049b525
jne 0x14049b5f9
test bl, 2
jmp 0x14049b533
je 0x14049b5f9
lea rdx, [rax + rbp]
movzx ecx, byte [rdx]
sub rax, 0x49d06432
and ecx, 0xf
shr ah, 0x5e
adc ax, r11w
cmp ch, 0xb1
movsx rax, byte [rcx + r14 + 0xc1a30]
adc r10b, r10b
btr r10w, 0x24
mov cl, byte [rcx + r14 + 0xc1a40]
bt r10w, r12w
sbb r10b, dil
mov r10w, 0x6590
sub rdx, rax
shld r10d, r10d, 0x89
add r10b, r15b
mov r10d, dword [rdx - 4]
jmp 0x14049b590
shr r10d, cl
test r15w, 0x4d5b
mov dword [r11 + 0x10], r9d
test r14b, spl
test r10d, r10d
jmp 0x14049b5a8
je 0x14049b5fc
mov eax, dword [rdx]
xor rcx, rdi
mov ecx, dword [rdx + 4]
clc
test r15b, dl
stc
lea rdx, [rdx + 8]
stc
jmp 0x14049b5c8
cmp eax, esi
jmp 0x14049b5cf
je 0x14049b5eb
inc r9d
cmp r9d, r10d
jmp 0x14049b5e0
jb 0x14049b5ae
jmp 0x14049b5fc
mov dword [r11 + 0x10], ecx
jmp 0x14049b5f4
jmp 0x14049b5fc
mov dword [rdx + 0x10], eax
test bl, 1
jmp 0x14049b604
je 0x14049b650
movzx ecx, byte [r8]
cmovs ax, sp
and ecx, 0xf
bts rdx, rcx
sal ah, 0x8b
movsx ebp, r12w
movsx rdx, byte [rcx + r14 + 0xc1a30]
mov cl, byte [rcx + r14 + 0xc1a40]
bts ebp, ebp
sub r8, rdx
cdqe
sal sil, 0x72
mov edx, dword [r8 - 4]
shr edx, cl
cbw
lahf
mov dword [r11 + 0x14], edx
bswap eax
sal r14b, 0xe0
mov rbx, qword [rsp + 0x10]
bts si, bp
movzx ebp, bp
sub r8, rdi
not sil
setb dil
mov rbp, qword [rsp + 0x18]
setae sil
jmp 0x14049b674
mov rax, r8
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
jmp 0x14049b688
ret
Function at 0x14049b8d2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test r12b, 0xdc
mov qword [rsp + 0x18], rbp
clc
test di, dx
push rsi
push rdi
movsx rsi, r13w
push r12
and r12, rbx
push r14
clc
sal di, cl
btr si, r14w
push r15
movsx rdi, r9w
stc
sbb r12b, r11b
sub rsp, 0x20
mov r14b, 0xb3
mov esi, dword [r8 + 0xc]
cmovl edi, eax
movsxd r14, esp
movzx r15, r11w
mov r12, rcx
mov rcx, r8
mov r14w, r10w
mov rdi, r9
bswap r14w
mov r14, r8
not r15b
bswap r15d
mov r15, rdx
jmp 0x14049b93b
call fcn.140207084
mov r10, qword [r12]
btr bp, 0x71
and bpl, r12b
mov ebp, eax
jmp 0x14049b957
mov qword [rdi], r10
cmp r9w, r8w
test esi, esi
jmp 0x14049b965
je 0x14049ba48
movsxd rax, dword [r14 + 0x10]
lea ecx, [rsi - 1]
mov esi, ecx
lea rcx, [rcx + rcx*4]
ror bl, cl
stc
lea rbx, [rax + rcx*4]
add rbx, qword [r15 + 8]
jmp 0x14049b989
cmp ebp, dword [rbx + 4]
jmp 0x14049b991
jle 0x14049b95e
cmp ebp, dword [rbx + 8]
jg 0x14049b95e
mov rcx, qword [r15]
cqo
lea rdx, [rsp + 0x50]
test sil, 0xe
cmp rbp, rdi
xor r8d, r8d
jmp 0x14049b9b9
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
adc r9b, r15b
xadd r10, r9
xor ecx, ecx
rcr r10, cl
xor r9, r10
add r8, qword [rsp + 0x50]
adc r10b, 0xa0
mov r9d, dword [rbx + 0xc]
mov r10d, dword [rax]
test r9d, r9d
jmp 0x14049b9ea
je 0x14049ba20
lea rdx, [r8 + 0xc]
movsxd rax, dword [rdx]
test dx, 0xd7b
cmp rax, r10
jmp 0x14049ba04
je 0x14049ba20
inc ecx
cmp r15d, r12d
stc
add rdx, 0x14
cmp cl, 7
cmp ecx, r9d
jb 0x14049b9f4
cmp ecx, r9d
jae 0x14049b95e
mov rax, qword [r12]
movsxd rbx, ecx
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
shr r12w, cl
sar esi, cl
cmc
mov rcx, qword [rcx + rax]
cwde
mov qword [rdi], rcx
mov rbx, qword [rsp + 0x58]
bts r15w, r11w
shr sil, cl
mov rax, rdi
add si, 0x5a9e
add sil, r8b
mov rbp, qword [rsp + 0x60]
movsx si, r10b
bsr edi, r10d
movsx r12d, r12w
add rsp, 0x20
not dil
pop r15
movzx rsi, r10w
pop r14
movzx rdi, r9w
movzx di, bl
movzx edi, sp
pop r12
xchg rsi, rsi
mov dil, r8b
movsx si, r8b
pop rdi
movsx si, cl
pop rsi
jmp 0x14049baa4
ret
Function at 0x1404a7ec3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rbx
test spl, r8b
dec bl
mov qword [rsp + 0x18], rsi
add dh, 0xdb
shr dx, 0xc
push rdi
rdtsc
sub dl, 0x5d
sub rsp, 0x20
cmove ax, cx
btr dx, bp
mov byte [rcx + 0x54], 1
clc
lea rdi, [rcx + 0x58]
clc
add qword [rcx + 0x20], 8
mov dl, 0x23
rdtsc
movsxd rdx, edi
mov rbx, rcx
lahf
mov rax, qword [rcx + 0x20]
cdq
not dx
mov r8d, dword [rcx + 0x3c]
not si
cqo
movzx dx, r10b
movzx edx, word [rcx + 0x42]
movsx si, sil
movzx esi, di
mov rcx, qword [rcx]
xchg sil, sil
bswap si
movzx esi, word [rax - 8]
jmp 0x1404a7f39
call fcn.1401fb8dc
mov rcx, qword [rdi + 0x408]
clc
cmc
test al, al
jmp 0x1404a7f4e
jne 0x1404a7fb7
mov r9, qword [rbx + 8]
xor dl, 0xe5
shld r8d, r8d, 0x63
shl dh, cl
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x30], sil
bt r8d, 0x97
test rcx, rcx
not r8b
mov byte [rsp + 0x31], al
cmove rcx, rdi
movzx r8w, r14b
cdqe
not r8b
mov rax, qword [r9]
movsx r8d, ax
mov r8b, r12b
movsxd r8, dword [rax + 8]
jmp 0x1404a7f9c
call fcn.1404ca4d9
test eax, eax
jns 0x1404a7fc3
mov byte [rbx + 0x40], 1
jmp 0x1404a7fb2
jmp 0x1404a7fc3
test rcx, rcx
cmove rcx, rdi
neg al
mov word [rcx], si
mov rcx, qword [rdi + 0x408]
mov al, 1
movzx esi, r14w
movzx rsi, dx
xor si, r15w
mov rsi, qword [rsp + 0x40]
cmp r9w, r14w
test rbp, r11
test rcx, rcx
jmp 0x1404a7fec
mov dword [rbx + 0x50], 1
jmp 0x1404a7ff8
cmove rcx, rdi
test r11, rcx
mov qword [rbx + 0x48], rcx
btc di, r13w
sal edi, cl
mov rbx, qword [rsp + 0x38]
bsr di, r13w
add rsp, 0x20
cmovae edi, ecx
movzx rdi, bx
jmp 0x1404a8024
pop rdi
jmp 0x1404a802a
ret
Function at 0x1404aa6c4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404aa6d4
mov qword [rsp + 0x10], rsi
movsx rsi, r11w
push rdi
sbb edi, 0x5f11159e
sub rsp, 0x30
bt esi, edi
rol rdi, cl
mov edi, edx
mov rsi, rcx
test r8, r8
jmp 0x1404aa6fb
jne 0x1404aa71d
call fcn.1404aeff3
mov dword [rax], 0x16
call fcn.1404afcfc
xor eax, eax
jmp 0x1404aa718
jmp 0x1404aa7ff
mov rdx, r9
mov rcx, r8
call fcn.1404aa862
mov rbx, rax
clc
test dil, r9b
stc
test rax, rax
jmp 0x1404aa738
je 0x1404aa7a8
lea rax, [rsp + 0x50]
mov rdx, rdi
movsx r8, sp
movzx r8w, spl
mov rcx, 0x484b40ab
mov qword [rsp + 0x28], rax
mov cl, r10b
cwde
lea r8, [0x140094b24]
lahf
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rsi
jmp 0x1404aa776
mov dword [rsp + 0x20], eax
jmp 0x1404aa77f
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404aa790
jne 0x1404aa825
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404aa7a3
call fcn.1404af05f
sub edi, edi
jmp 0x1404aa7af
test rbx, rbx
je 0x1404aa7fc
mov rcx, qword [rbx + 0x10]
cmp r15b, bl
clc
test r8w, si
test rcx, rcx
jmp 0x1404aa7cc
je 0x1404aa7d8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmc
test bh, 0xa0
test rcx, rcx
je 0x1404aa7ef
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404aa7f7
call fcn.1404c3032
mov rax, rdi
mov rbx, qword [rsp + 0x40]
sal si, cl
jmp 0x1404aa80f
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
jmp 0x1404aa823
pop rdi
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jmp 0x1404aa832
je 0x1404aa842
mov eax, dword [rsp + 0x50]
cmc
stc
mov dword [rcx], eax
clc
stc
sub ebx, ebx
jmp 0x1404aa849
jmp 0x1404aa7af

Function at 0x1404aab48
Capabilities:
Terminate process

Disassembly:
push rbx
and bl, 0xc3
bt ebx, r14d
shrd ebx, esi, 0xd4
sub rsp, 0x20
mov ebx, ecx
call fcn.1404cc7dd
cmp eax, 1
jmp 0x1404aab68
je 0x1404aabb6
mov rax, qword gs:[0x60]
sal rdx, 0xd
mov edx, dword [rax + 0xbc]
shr edx, 8
test al, r10b
test dl, 1
jmp 0x1404aab8f
jne 0x1404aabb6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
sete dh
movsx dx, dil
movsxd rdx, edi
mov edx, ebx
jmp 0x1404aabb0
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404aaa9a
mov ecx, ebx
jmp 0x1404aabc4
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404afd83
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov cx, r11w
jmp 0x1404afd95
mov ecx, 0x17
jmp 0x1404afd9f
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404afdac
je 0x1404afdc3
mov ecx, 5
jmp 0x1404afdbc
int 0x29
jmp 0x1404afdc3
mov r8d, 1
cdq
cqo
movzx rdx, dx
mov edx, 0xc0000417
movsx ecx, si
lea ecx, [r8 + 1]
jmp 0x1404afde1
call fcn.1404afe07
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
sbb dl, ah
mov edx, 0xc0000417
stc
add rsp, 0x28
jmp 0x1404afe00
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404bd7e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
not ah
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], r9
add rax, 0x3518720b
sal bh, cl
mov dword [rsp + 0x10], edx
push rbp
push rsi
btr rax, rbx
push rdi
add bx, r11w
xor si, r13w
movsx eax, r11w
push r12
push r13
btr si, sp
setbe bh
push r14
push r15
movsx r13w, r10b
sal r13b, 0x13
sub rsp, 0x20
or ah, cl
mov rax, qword [rcx + 8]
setbe sil
stc
xor bpl, bpl
rol r13b, cl
xor r14b, r14b
cmovne r13d, ebx
mov qword [r11 + 8], rax
sub edi, edi
or r15w, 0x32b1
sub esi, r10d
mov r13b, 0xf
mov r12, r9
mov r13d, r8d
adc si, r14w
mov rbx, rcx
cmovs rsi, rbp
test bl, bpl
lea rsi, [rax - 1]
mov r15, rsi
cmc
cmp dword [rcx], edi
jmp 0x1404bd87d
jle 0x1404bd90d
mov r12d, dword [r11 + 0x10]
cmp edi, r12d
jmp 0x1404bd88f
jne 0x1404bd8a9
mov rsi, rax
cmp r15w, 0x35c
sub bpl, r13b
mov bpl, 1
stc
clc
cmp rdi, r9
cmp edi, r13d
jmp 0x1404bd8b1
jne 0x1404bd8c1
mov r15, rax
mov r14b, 1
cmp r11b, 0x4c
test bpl, bpl
je 0x1404bd8d8
test r14b, r14b
jmp 0x1404bd8d2
jne 0x1404bd908
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140226be4
inc edi
jmp 0x1404bd8f1
cmp edi, dword [rbx]
jge 0x1404bd908
mov rax, qword [rsp + 0x60]
jmp 0x1404bd903
jmp 0x1404bd887
mov r12, qword [rsp + 0x78]
mov rax, qword [r12]
rol r14b, 0xbb
mov qword [r12 + 8], rsi
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
sub r13w, 0x4a06
clc
movups xmm1, xmmword [rbx + 0x10]
test r8b, 0xc3
bts si, r11w
movups xmmword [rax + 0x10], xmm1
rol r14b, cl
sal esi, 0x1c
cmp r10w, r13w
mov rax, qword [rsp + 0x80]
movzx ebp, r11w
sar r14b, 0
mov rcx, qword [rax]
bts si, r11w
mov qword [rax + 8], r15
ror bp, cl
rol rbp, cl
sub rbp, 0x1e112693
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
sbb r13, 0x44201344
shl sil, cl
inc r13b
movups xmm1, xmmword [rbx + 0x10]
and r15, rbx
mov rbx, qword [rsp + 0x70]
sal r13b, cl
movups xmmword [rcx + 0x10], xmm1
btc si, r10w
add rsp, 0x20
mov sil, r13b
pop r15
movzx rsi, r11w
pop r14
jmp 0x1404bd9b0
pop r13
movsxd r12, r13d
movzx rdi, bp
pop r12
not si
movsxd rsi, r8d
cmovge rdi, r14
pop rdi
jmp 0x1404bd9cb
pop rsi
movsx bp, bpl
movzx rbp, ax
movsxd rbp, r9d
pop rbp
jmp 0x1404bd9de
ret

Function at 0x1404c4501
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
rol r9b, cl
movsx bx, dil
neg bl
sub rsp, 0x20
cqo
cwd
mov rbx, rcx
lea r9, [0x1400c63c0]
xchg ch, ch
cwd
setae cl
mov ecx, 3
lea r8, [0x1400c63b8]
lea rdx, [0x1400cfb70]
jmp 0x1404c453e
call fcn.1404c55ae
test rax, rax
je 0x1404c4576
mov rcx, rbx
or bx, cx
ror bx, 0x5c
cmp r10, 0x713e3513
add rsp, 0x20
bswap ebx
cmovno ebx, ebx
movzx ebx, ax
pop rbx
jmp 0x1404c456f
push qword [0x1400b8d90]
ret
add rsp, 0x20
pop rbx
jmp 0x1404c4580
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1404c46bf
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
xchg r8b, r9b
adc bh, 0x30
push rdi
sub r9b, spl
rcr di, cl
movsx ebx, si
sub rsp, 0x20
movsx bx, r11b
jmp 0x1404c46e2
mov rbx, rdx
lea r9, [0x1400c63d8]
mov edi, ecx
xchg ecx, edx
mov dl, r11b
lea rdx, [0x1400cf748]
mov ecx, 6
movsxd r8, esp
lea r8, [0x1400c63d0]
jmp 0x1404c470e
call fcn.1404c55ae
mov rdx, rbx
neg cx
bsr cx, si
mov ecx, edi
clc
cmc
test rax, rax
jmp 0x1404c4729
je 0x1404c473a
call qword [case.0x14044236c.0]
jmp 0x1404c4740
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
shr di, cl
add rsp, 0x20
mov di, r8w
bswap di
pop rdi
ret

Function at 0x1404c48ef
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
add bl, cl
movzx ebx, r11w
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
btc rsi, 0xd7
movsx esi, ax
test edx, r15d
push rdi
rcl sil, cl
shl bpl, cl
sub rsp, 0x30
mov ebx, r9d
movsx ebp, r15w
setb dil
movzx di, r8b
mov rdi, r8
not esi
mov r8w, 0x15bf
movsx ebp, di
mov esi, edx
mov r8b, 0x82
cmovae r9, rdi
lea r9, [0x1400c63e8]
mov rbp, rcx
not r8
lea r8, [0x1400c63e0]
setne dl
movzx rcx, di
lea rdx, [0x1400cf190]
movzx cx, bpl
mov cl, bh
mov ecx, 0xb
jmp 0x1404c4973
call fcn.1404c55ae
mov rcx, rbp
test sil, sil
test rax, rax
je 0x1404c49a3
mov r9d, ebx
mov r8, rdi
mov dl, 0x59
cqo
mov edx, esi
jmp 0x1404c4998
call qword [case.0x14044236c.0]
jmp 0x1404c49d2
sub edx, edx
jmp 0x1404c49aa
call fcn.1404c505a
mov ecx, eax
mov r8b, 0xc3
mov r9d, ebx
mov r8, rdi
cwd
movzx dx, bpl
movsx rdx, r11w
mov edx, esi
jmp 0x1404c49cc
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
ror bpl, 0xb1
btc esi, eax
bt bp, 0x50
mov rbp, qword [rsp + 0x48]
not di
mov rsi, qword [rsp + 0x50]
sub di, 0x3287
add rsp, 0x30
cmovp di, r10w
setb dil
mov di, r12w
pop rdi
ret
Function at 0x1404d0f23
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, 0x30d32196
and bx, 0x6a5
movzx bx, spl
push rdi
rcr ebx, cl
cmc
adc ebx, ebx
sub rsp, 0x20
mov rbx, rcx
jmp 0x1404d0f49
call fcn.1404c3385
or r8, 0xffffffffffffffff
movzx r10, sp
xor r10b, 0xe
clc
mov r10, rax
mov rdx, 0x3dec121d
xor edi, edi
mov rdx, qword [rax + 0x98]
jmp 0x1404d0f73
inc r8
clc
test al, 0xa0
cmp word [rdx + r8*2], di
jmp 0x1404d0f83
jne 0x1404d0f73
mov eax, edi
cmp r8, 3
bswap cx
mov al, 0xbc
mov ecx, 2
sete al
jmp 0x1404d0fa1
mov dword [r10 + 0xb0], eax
je 0x1404d1015
mov r9d, edi
add al, 0xdf
btr r8d, esi
ror r8, 0x5e
movzx r8d, word [rdx]
lea rdx, [rdx + rcx]
bt rax, rsi
rcl eax, 0x3c
nop
lea eax, [r8 - 0x41]
cmp ax, 0x19
jmp 0x1404d0fd8
jbe 0x1404d0ff9
sub r8w, 0x61
cmp r8b, 0xae
stc
clc
cmp r8w, 0x19
jmp 0x1404d0ff3
ja 0x1404d1006
inc r9d
jmp 0x1404d1001
jmp 0x1404d0fbb
mov ecx, r9d
xchg dx, dx
movzx edx, r10w
movsx dx, r9b
mov dword [r10 + 0xac], ecx
mov edx, 1
lea rcx, [0x1400ac0b8]
jmp 0x1404d102d
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
test byte [rbx], 4
jne 0x1404d1041
mov dword [rbx], edi
rol edi, 0x63
mov rbx, qword [rsp + 0x30]
sbb edi, r13d
add rsp, 0x20
mov dil, dl
xchg dil, dil
jmp 0x1404d1058
pop rdi
jmp 0x1404d105e
ret

Function at 0x1404d1475
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
movzx ebx, di
shrd bx, bp, 7
movsx ebx, r9w
mov qword [rsp + 0x18], rsi
shr bh, cl
not bx
push rdi
movsx rdi, cx
sub rsp, 0x20
sub esi, esi
mov rdi, rdx
movsxd rbx, r10d
mov rbx, rcx
cmc
cmp eax, r9d
clc
test rcx, rcx
jmp 0x1404d14b1
je 0x1404d1555
cmp word [rcx], si
je 0x1404d1555
lea rdx, [0x1400d1d08]
jmp 0x1404d14cc
call fcn.1400fcbd0
test eax, eax
jmp 0x1404d14d8
je 0x1404d1555
lea rdx, [0x1400d1d00]
movzx rcx, r10w
mov rcx, rbx
call fcn.1400fcbd0
test eax, eax
jmp 0x1404d14f8
jne 0x1404d1543
mov ecx, dword [rdi + 8]
movsx rdx, r9w
cqo
lea r9d, [rsi + 2]
movzx edx, r10w
lea r8, [rsp + 0x30]
cmovle dx, ax
mov edx, 0x2000000b
jmp 0x1404d1522
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d152f
je 0x1404d1582
mov eax, dword [rsp + 0x30]
jmp 0x1404d153e
jmp 0x1404d15a7
mov rcx, rbx
jmp 0x1404d154b
call fcn.1404da441
jmp 0x1404d15a7
mov ecx, dword [rdi + 8]
mov r8w, r9w
cwd
lea r8, [rsp + 0x30]
not dl
movzx r9d, cx
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1404d158e
xor eax, eax
jmp 0x1404d1589
jmp 0x1404d15a7
mov eax, dword [rsp + 0x30]
stc
cmp r15w, 0x7100
test eax, eax
jne 0x1404d15a7
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
btr di, bp
test r14b, 0x47
mov rsi, qword [rsp + 0x40]
sar edi, 0x66
add rsp, 0x20
jmp 0x1404d15c5
pop rdi
jmp 0x1404d15cb
ret
Function at 0x1404d15cc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
btc si, 0x18
push rdi
rol sil, cl
bsr rbx, r11
sub rsp, 0x20
not sil
sets bh
mov bl, 0x94
mov esi, edx
setle bh
mov ebx, ecx
call fcn.1404c3385
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
setnp dil
btr rdi, 0xbf
mov r9d, 2
bt rdx, rdx
movzx edx, di
bts ecx, 0xa
bswap dx
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r10d, r10d
test eax, eax
jmp 0x1404d163d
je 0x1404d1714
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d164c
je 0x1404d170a
test esi, esi
je 0x1404d170a
mov r9, qword [rdi + 0x98]
xor r8d, 0x2e01763f
dec eax
mov r8d, r10d
btr eax, r14d
xchg dx, cx
dec ch
movzx edx, word [r9]
jmp 0x1404d1686
lea rcx, [r9 + 2]
btc rax, 0xc7
movsxd rax, r14d
lea eax, [rdx - 0x41]
test r10w, r8w
cmp ax, 0x19
jmp 0x1404d16a2
jbe 0x1404d16bb
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404d16b5
ja 0x1404d16de
movzx edx, word [rcx]
jmp 0x1404d16c3
inc r8d
stc
cmp r13w, 0x405f
test r10b, r14b
add rcx, 2
jmp 0x1404d16d9
jmp 0x1404d1692
or rcx, 0xffffffffffffffff
jmp 0x1404d16e7
inc rcx
test ecx, edx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d16f6
jne 0x1404d16e7
cmp r8d, ecx
jmp 0x1404d1704
je 0x1404d1714
mov eax, 1
jmp 0x1404d171c
sub eax, eax
cmp r11w, 0x38de
mov rbx, qword [rsp + 0x38]
btr esi, 0x49
rcr sil, cl
mov rsi, qword [rsp + 0x40]
sub di, 0x7b16
add rsp, 0x20
mov edi, 0x104330c4
bswap di
jmp 0x1404d1743
pop rdi
jmp 0x1404d1749
ret