joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14045c5d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14045c5e7
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
bt rbp, r13
adc bp, 0x1fd5
clc
push rsi
xchg bpl, bpl
sal bp, 0xdf
cmovs ebp, edx
push rdi
bt rbp, 0x19
bsr rbp, r8
push r12
cmovo rbp, rax
xor bpl, 0x33
btc bp, 0x93
push r14
shld bp, r8w, 0x72
btc bp, ax
movsx rbp, di
push r15
cmovl bp, r15w
sub rsp, 0x40
xchg r15b, r15b
and r15d, 0x4af10cd0
sub ebp, 0x70113487
xor r12d, r12d
rol ebp, 0xe0
mov r15, r8
sbb bpl, r10b
rcr bp, cl
mov qword [rax + 0x20], r12
rcl bpl, cl
bsf bp, sp
btr ebp, 0x39
or rdi, 0xffffffffffffffff
mov rbp, rcx
jmp 0x14045c672
inc rdi
cmc
cmp byte [rdi + rcx], r12b
jmp 0x14045c67f
jne 0x14045c672
add rdi, 1
mov rbx, r12
mov rsi, rdi
setb r14b
mov r14, rcx
jmp 0x14045c69b
je 0x14045c703
lea r9, [rsp + 0x88]
movsxd rdx, r15d
mov qword [rsp + 0x20], r15
setle dh
cdq
mov r8w, 0x3829
mov r8, rsi
lea rcx, [rsp + 0x70]
cmovs dx, sp
movsxd rdx, eax
mov rdx, r14
call fcn.140456dfd
test eax, eax
jmp 0x14045c6d8
jle 0x14045c703
cdqe
jmp 0x14045c6e5
inc rbx
jmp 0x14045c6f0
lea r14, [r14 + rax]
cmc
sub rsi, rax
jmp 0x14045c6fd
jne 0x14045c6a1
inc rbx
setp ch
movzx ecx, r8w
mov edx, 2
mov ch, 0xf9
not cx
movzx cx, sil
mov rcx, rbx
call fcn.1401d642c
mov r14, rax
cmp sp, 0x3f47
clc
cmp bpl, al
test rax, rax
je 0x14045c822
mov qword [rsp + 0x30], r12
not sil
mov rsi, 0x704b6063
mov rsi, rax
clc
test rbx, rbx
jmp 0x14045c755
je 0x14045c7c4
lea r9, [rsp + 0x30]
movsxd r8, r13d
jmp 0x14045c768
mov qword [rsp + 0x20], r15
xchg edx, ecx
movsx r8, r15w
movsx ecx, bp
mov r8, rdi
jmp 0x14045c787
mov rdx, rbp
movzx rcx, si
mov rcx, rsi
jmp 0x14045c796
call fcn.140456dfd
test eax, eax
jmp 0x14045c7a2
jle 0x14045c7c4
cdqe
cmp dil, r8b
add rsi, 2
add rbp, rax
test edx, r15d
cmp r10b, al
sub rbx, 1
jne 0x14045c75b
lea r11, [rsp + 0x40]
mov word [rsi], r12w
cwde
mov rbx, qword [r11 + 0x38]
movzx r15d, r11w
mov rax, r14
setp r12b
xchg r14b, r12b
mov rbp, qword [r11 + 0x40]
movzx r15w, spl
movsx r14, r11w
mov rsp, r11
movzx edi, bx
xchg r15w, r15w
pop r15
pop r14
bswap r12w
movsxd r12, eax
cmovge edi, ebp
pop r12
bswap esi
mov esi, esp
pop rdi
mov rsi, 0x39ac47b6
cmovp si, di
movsx rsi, sp
pop rsi
jmp 0x14045c821
ret
call fcn.14045654f
int3
Function at 0x14049d7e9
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp r13w, 0x5d1
and dword [rsp + 0x30], 0
jmp 0x14049d7fd
call fcn.1404a7b05
mov r9d, 2
lea r8, [rsp + 0x30]
movsxd rcx, r9d
mov rcx, qword [rax + 0x28]
cwd
lea edx, [r9 + 0x20]
jmp 0x14049d81f
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmc
sub ecx, 0x30
jmp 0x14049d833
je 0x14049d87a
sub ecx, 1
jmp 0x14049d841
je 0x14049d86b
cmp ecx, 1
jmp 0x14049d84f
je 0x14049d861
xor eax, eax
jmp 0x14049d85c
jmp 0x14049d882
mov eax, 3
jmp 0x14049d882
mov eax, 1
jmp 0x14049d875
jmp 0x14049d882
mov eax, 2
cmp cx, dx
add rsp, 0x28
jmp 0x14049d88b
ret

Function at 0x14049d88c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
sbb si, di
rcl dil, cl
mov qword [rax + 0x20], r14
rcr r14b, 0x14
shr r14b, 0x16
push r15
rcl r14, 0x91
sub si, 0x103b
xadd r15b, r15b
sub rsp, 0x30
btc rdi, 0xdf
sar di, cl
mov rdi, r9
or r15b, spl
mov rsi, rdx
adc r14b, 0xc7
xchg r14w, r15w
movzx r14d, r12w
sub rsi, rcx
btc r14w, 0x96
sub rdi, r8
movsx r15d, bx
mov r15, rcx
cmc
movsx r14d, di
rol ecx, cl
sar rsi, 1
test esp, r10d
sar cl, cl
bswap r14d
mov rcx, qword [rsp + 0x60]
sub ebx, ebx
cmovs r14, rdi
add r14w, cx
sar rdi, 1
add r14b, 0x99
clc
mov r14, r8
test eax, edi
test rcx, rcx
jne 0x14049d93a
call fcn.1404a7b05
mov rcx, qword [rax + 8]
jmp 0x14049d935
jmp 0x14049d944
mov rcx, qword [rcx + 8]
test esp, 0xb3324cb
test rcx, rcx
jmp 0x14049d94c
jne 0x14049d9e6
cmp esi, edi
mov cx, 0x65e5
mov eax, edi
cmovl eax, esi
movzx ecx, r10w
movsxd rcx, eax
mov eax, 1
test sil, r11b
test rcx, rcx
jmp 0x14049d974
je 0x14049d9ad
sub r15, r14
bsr edx, edx
btr dx, ax
movzx edx, word [r15 + r14]
cmp dx, word [r14]
jmp 0x14049d992
jne 0x14049d9cc
add r14, 2
cmp ax, di
sub rcx, rax
jmp 0x14049d9a7
jne 0x14049d984
cmp esi, edi
jmp 0x14049d9b4
je 0x14049d9da
or ecx, 0xffffffff
cmp esi, edi
jmp 0x14049d9c4
cmovl eax, ecx
jmp 0x14049da42
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, eax
bswap eax
setbe al
cdqe
mov eax, ebx
jmp 0x14049d9e1
jmp 0x14049da42
mov dword [rsp + 0x28], edi
xchg r9b, r9b
mov r9d, esi
mov r8, r15
jmp 0x14049d9f8
mov qword [rsp + 0x20], r14
cqo
mov edx, 0x1000
jmp 0x14049da09
call fcn.1404c04d8
test eax, eax
jmp 0x14049da15
jne 0x14049da3b
call fcn.1404b275a
mov dword [rax], 0x16
mov rax, 0xc723938
movzx eax, r8w
mov eax, 0x7fffffff
jmp 0x14049da42
sub eax, 2
movsx ebx, r8w
mov rbx, qword [rsp + 0x40]
sal rsi, cl
cmova si, ax
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
xor r14b, 0xe7
shl r15w, 0x4c
mov r14, qword [rsp + 0x58]
add rsp, 0x30
not r15w
pop r15
jmp 0x14049da75
ret
Function at 0x14049e4db
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
and rbx, 0x24fc6c82
xadd bl, bh
cmp r10w, ax
push rdi
sub rsp, 0x40
movsx ebx, bp
mov bh, 0xc7
mov rbx, rcx
jmp 0x14049e4ff
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rsi, qword [rbx + 0xf8]
sbb cx, cx
movzx edx, si
sub edi, edi
bswap edx
movsxd rdx, ecx
sub r8d, r8d
jmp 0x14049e524
lea rdx, [rsp + 0x60]
not cx
bswap rcx
movzx ecx, cx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
jmp 0x14049e543
je 0x14049e5cc
and qword [rsp + 0x38], 0
bsr r9w, bx
mov dx, r15w
lea rcx, [rsp + 0x68]
sub r9w, 0x4ed0
sbb rdx, 0x6c0d5fbb
mov rdx, qword [rsp + 0x60]
sar r9b, 0xe6
mov r9, rax
mov qword [rsp + 0x30], rcx
movzx cx, r8b
xor ch, 0x9d
mov r8, rsi
cmp r11, 0x57cd06be
sbb rcx, rsi
adc cx, 0x240d
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
sub ecx, ecx
jmp 0x14049e5a6
mov qword [rsp + 0x20], rbx
jmp 0x14049e5b0
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
inc edi
jmp 0x14049e5be
cmp edi, 2
jmp 0x14049e5c6
jl 0x14049e519
add rsp, 0x40
pop rdi
movzx rbx, r9w
movsx si, r11b
pop rsi
movsxd rbx, r14d
not bl
cmova bx, si
pop rbx
jmp 0x14049e5ea
ret
Function at 0x14049ebd3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
bts r10d, ebp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
btc r10w, 0xb2
movsx rbp, cx
mov qword [rax + 0x18], rsi
neg r10b
mov qword [rax + 0x20], rdi
xor r10w, di
mov dil, 0x9f
xadd r10b, bl
push r14
mov bl, byte [rcx]
sal r14b, 0xaf
btr r11w, 0x9f
lea r10, [rcx + 1]
adc r11w, dx
bsr bp, r9w
mov byte [rdx], bl
mov esi, r9d
shrd edi, r8d, 0xa2
lea r14, [0x140000000]
ror edi, cl
mov rbp, r8
seto r11b
rcl dil, 0xf0
mov r11, rdx
movzx edi, r8w
and dil, 0x55
sar dil, 0xd7
mov rdi, rcx
test bpl, 0xf8
cmc
test bl, 4
jmp 0x14049ec5a
je 0x14049ecb1
movzx ecx, byte [r10]
shl al, 0xeb
and ecx, 0xf
and eax, 0xf6d6c5f
movsx rax, byte [rcx + r14 + 0xc1a30]
cmp r10b, r9b
jmp 0x14049ec80
mov cl, byte [rcx + r14 + 0xc1a40]
test spl, spl
sub r10, rax
mov eax, dword [r10 - 4]
cmp si, 0xf09
clc
jmp 0x14049ec9d
shr eax, cl
cmp r13d, 0x34e441c8
mov dword [rdx + 4], eax
test r11b, r11b
jmp 0x14049ecb1
test bl, 8
jmp 0x14049ecb9
je 0x14049ecc9
mov eax, dword [r10]
add r10, 4
mov dword [rdx + 8], eax
test bl, 0x10
jmp 0x14049ecd1
je 0x14049ecf6
mov eax, dword [r10]
xadd r8d, r8d
add r10, 4
movzx r8w, dil
ror r8, 0xcb
sbb r8b, 0xf5
mov dword [rdx + 0xc], eax
not r8d
cwde
movsxd rax, dword [r10]
sub r8b, 0x2d
sbb r8d, 0x3a644f45
lea r8, [r10 + 4]
sub r9d, r9d
cmp r9w, 0x2b53
cmp dl, sil
cmp byte [rsp + 0x30], r9b
jmp 0x14049ed1e
jne 0x14049edd0
test bl, 2
je 0x14049edd0
lea rdx, [rax + rbp]
sbb cx, r14w
btc rcx, r9
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0xc1a30]
or r10b, 0x78
rcl r10d, 0xf6
mov cl, byte [rcx + r14 + 0xc1a40]
sub rdx, rax
shld r10w, si, 0xdf
and r10d, r11d
mov r10d, dword [rdx - 4]
stc
shr r10d, cl
test si, r8w
mov dword [r11 + 0x10], r9d
cmc
test rbp, r15
test r10d, r10d
je 0x14049eddc
mov eax, dword [rdx]
adc rcx, rdi
mov ecx, dword [rdx + 4]
test r10b, 0xbe
test sil, r8b
lea rdx, [rdx + 8]
test r10, 0x40d85075
cmp eax, esi
jmp 0x14049eda2
je 0x14049edc2
inc r9d
cmp r12b, 0xcb
cmp r9d, r10d
jmp 0x14049edb7
jb 0x14049ed81
jmp 0x14049eddc
mov dword [r11 + 0x10], ecx
jmp 0x14049edcb
jmp 0x14049eddc
mov dword [rdx + 0x10], eax
jmp 0x14049eddc
test bl, 1
je 0x14049ee3b
movzx ecx, byte [r8]
and ecx, 0xf
shl ah, cl
mov al, 0x8e
movsx si, r15b
movsx rdx, byte [rcx + r14 + 0xc1a30]
movzx bp, dl
mov cl, byte [rcx + r14 + 0xc1a40]
btc r14, rdi
not ax
rol esi, cl
sub r8, rdx
cmc
sbb r14w, 0x2ac5
sal bpl, cl
mov edx, dword [r8 - 4]
inc bpl
shr edx, cl
sal bx, cl
rcr ax, 0x7c
xadd bl, bl
mov dword [r11 + 0x14], edx
shr r14b, 0x89
mov rbx, qword [rsp + 0x10]
sub r8, rdi
movzx r14, r12w
mov rbp, qword [rsp + 0x18]
cwde
mov rax, r8
movzx r14, r13w
mov r14d, 0x49725dea
mov sil, r9b
mov rsi, qword [rsp + 0x20]
movzx r14d, r14w
movsx edi, dx
movsx di, r14b
mov rdi, qword [rsp + 0x28]
movzx r14, bx
jmp 0x14049ee7c
pop r14
jmp 0x14049ee83
ret
Function at 0x1404aa560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
setns ah
mov qword [rsp + 0x18], rsi
push rdi
shl ah, cl
sbb al, 0x8f
sub rsp, 0x50
bt rax, r10
mov rax, qword [0x1400b7288]
neg bl
and bl, r15b
xor rax, rsp
bsr bx, bp
mov bl, 0x46
mov qword [rsp + 0x40], rax
adc bh, 0xb0
mov bl, r13b
cmp byte [rcx + 0x54], 0
movsx bx, r11b
movsxd rbx, edx
setge bl
mov rbx, rcx
jmp 0x1404aa5b1
je 0x1404aa68d
cmp dword [rcx + 0x50], 0
jle 0x1404aa68d
mov rsi, qword [rcx + 0x48]
xor edi, edi
rcl rdx, 0x59
test ebx, ebp
movzx eax, dx
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x34]
sar r9b, cl
add r8, r11
shl ecx, cl
movzx r9d, word [rsi]
adc ecx, r15d
xchg cx, cx
lea rcx, [rsp + 0x30]
rol r8w, 0xe2
clc
and dword [rsp + 0x30], 0
cmove r8w, r15w
lea rsi, [rsi + 2]
movzx r8, bx
not r8b
mov r8d, 6
jmp 0x1404aa616
mov qword [rsp + 0x20], rax
call fcn.1404cdeb8
test eax, eax
jmp 0x1404aa627
jne 0x1404aa684
mov r8d, dword [rsp + 0x30]
test spl, r13b
test r8d, r8d
jmp 0x1404aa63d
je 0x1404aa684
lea rax, [rbx + 0x10]
not r9
jmp 0x1404aa64f
lea r9, [rbx + 0x28]
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
lea rdx, [rsp + 0x34]
call fcn.1404a89b0
inc edi
cmp r10w, 0x75e5
cmp edi, dword [rbx + 0x50]
jmp 0x1404aa679
jne 0x1404aa5d0
jmp 0x1404aa6c8
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404aa6c8
mov r8d, dword [rbx + 0x50]
movzx eax, r13w
cwde
lea rax, [rcx + 0x10]
bts dx, r15w
mov rdx, qword [rbx + 0x48]
movzx r9d, ax
bt r9w, 2
lea r9, [rcx + 0x28]
cmc
add rcx, 0x468
mov qword [rsp + 0x20], rax
jmp 0x1404aa6c3
call fcn.1404a89b0
mov al, 1
movsx cx, r8b
mov rcx, qword [rsp + 0x40]
cmc
cmp r9b, 0x59
jmp 0x1404aa6de
xor rcx, rsp
jmp 0x1404aa6e6
call fcn.14049cefa
mov rbx, qword [rsp + 0x68]
bt si, 0x4c
mov rsi, qword [rsp + 0x70]
ror dil, 0xa
mov dil, 0xd2
add rsp, 0x50
pop rdi
jmp 0x1404aa70b
ret
Function at 0x1404ab972
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
rol bl, cl
bts r8w, r9w
mov qword [rsp + 0x10], rsi
bt si, bx
movsx r8, r9w
push rdi
sub dil, 0xcb
sal dl, cl
sub rsp, 0x20
btc ebx, ebp
cmp r10b, 0x83
add qword [rcx + 0x20], 8
mov rdi, rcx
shrd dx, r15w, 0xd6
bsr r8w, di
mov rax, qword [rcx + 0x20]
sub r8d, 0x7d193122
shrd rbx, r8, 0x52
adc r8, rbp
mov esi, dword [rcx + 0x38]
cmp esi, 0xffffffff
cqo
setl dl
movsxd rdx, r8d
mov r8d, dword [rcx + 0x3c]
movzx edx, word [rcx + 0x42]
mov bx, 0x39ca
mov rbx, qword [rax - 8]
mov eax, 0x7fffffff
mov qword [rcx + 0x48], rbx
jmp 0x1404ab9ef
cmove esi, eax
jmp 0x1404ab9f7
mov rcx, qword [rcx]
jmp 0x1404ab9ff
call fcn.14023cb31
test al, al
jmp 0x1404aba0b
je 0x1404aba5f
test rbx, rbx
jmp 0x1404aba19
jne 0x1404aba3a
lea rbx, [0x1400d25f0]
movzx dx, r11b
mov rcx, r8
mov qword [rdi + 0x48], rbx
movzx rcx, r11w
cmove rcx, r14
movsxd rdx, esi
cmovs cx, r15w
movsx rcx, r14w
movsxd rcx, r14d
mov rcx, rbx
jmp 0x1404aba51
mov byte [rdi + 0x54], 1
call fcn.14012a72c
jmp 0x1404abafd
test rbx, rbx
jmp 0x1404aba67
jne 0x1404aba80
lea rbx, [0x1400ced98]
test dil, dl
jmp 0x1404aba7c
mov qword [rdi + 0x48], rbx
xor r9d, r9d
clc
stc
test esi, esi
jmp 0x1404aba8c
jle 0x1404abafa
cmp byte [rbx], 0
jmp 0x1404aba9a
je 0x1404abafa
mov rax, qword [rdi + 8]
movzx edx, byte [rbx]
jmp 0x1404abaac
mov rcx, qword [rax]
btr r8d, 0xa8
cmovle r8d, ebp
adc eax, 0xf6836e6
mov rax, qword [rcx]
lea rcx, [rbx + 1]
movsx r8d, si
ror r8b, cl
movzx r8d, word [rax + rdx*2]
clc
and r8d, 0x8000
jmp 0x1404abadd
cmove rcx, rbx
inc r9d
rol ebx, 0x99
lea rbx, [rcx + 1]
cmc
cmp r9d, esi
jmp 0x1404abaf4
jl 0x1404aba92
mov eax, r9d
mov dword [rdi + 0x50], eax
mov al, 1
neg di
sub di, 0x7476
bts si, r8w
mov rbx, qword [rsp + 0x30]
shl dil, cl
xor sil, 0x7f
mov rsi, qword [rsp + 0x38]
xadd di, di
btc rdi, 0x34
add rsp, 0x20
setge dil
jmp 0x1404abb3a
pop rdi
jmp 0x1404abb40
ret
Function at 0x1404aded0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
cmp r8b, 0x42
sub rsp, 0x30
test spl, bpl
sar edi, 0x7f
btc si, 0x18
mov edi, edx
sbb esi, 0x38a465ee
shld si, ax, 0x1d
bt si, bx
mov rsi, rcx
test r8, r8
jmp 0x1404adf0a
jne 0x1404adf2c
call fcn.1404b275a
mov dword [rax], 0x16
jmp 0x1404adf20
call fcn.1404b343b
xor eax, eax
jmp 0x1404ae015
mov rdx, r9
mov rcx, r8
jmp 0x1404adf37
call fcn.1404ae06d
mov rbx, rax
jmp 0x1404adf49
test rax, rax
jmp 0x1404adf51
je 0x1404adfbc
lea rax, [rsp + 0x50]
mov rdx, rdi
movsx rcx, r12w
mov qword [rsp + 0x28], rax
movsx r9, r8w
xchg r9b, al
lea r8, [0x140094b24]
mov cl, r14b
mov eax, dword [rsp + 0x60]
movsxd r9, r12d
movzx r9, r10w
mov r9, rbx
movsx cx, r14b
mov rcx, rsi
mov dword [rsp + 0x20], eax
jmp 0x1404adf98
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404adfa9
jne 0x1404ae03b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404b27d0
xor edi, edi
test rbx, rbx
je 0x1404ae00a
mov rcx, qword [rbx + 0x10]
clc
cmp r14b, al
test rcx, rcx
jmp 0x1404adfd7
je 0x1404adfe3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
cmp cl, r10b
cmp r8b, 0x15
test rcx, rcx
je 0x1404adffd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404ae005
call fcn.1404c67c1
mov rax, rdi
or bx, 0xec8
sbb sil, r13b
mov rbx, qword [rsp + 0x40]
sub dil, 0x51
mov rsi, qword [rsp + 0x48]
sbb di, 0x6f5a
add rsp, 0x30
movsx edi, dx
jmp 0x1404ae034
pop rdi
jmp 0x1404ae03a
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1404ae052
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
test r12b, r9b
sub ebx, ebx
jmp 0x1404adfbe

Function at 0x1404ae321
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404ae32e
call fcn.1404cfe8f
cmp eax, 1
jmp 0x1404ae33b
je 0x1404ae38f
mov rax, qword gs:[0x60]
or dx, 0x2a43
movsx dx, r9b
mov edx, dword [rax + 0xbc]
jmp 0x1404ae35f
shr edx, 8
jmp 0x1404ae367
test dl, 1
jmp 0x1404ae36f
jne 0x1404ae38f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movzx rdx, ax
mov edx, ebx
jmp 0x1404ae389
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404ae396
call fcn.1404ae28a
mov ecx, ebx
jmp 0x1404ae3a2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404af46d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x1404af53d
mov dword [rsp + 0x18], r8d
cmp dil, r14b
movsx r8w, sil
mov qword [rsp + 0x20], r9
movzx r8d, r10w
shld r8, rsi, 0xde
or r8b, sil
push rbx
or r8w, 0x6c4b
movzx r8, di
btc r8w, 0x39
push rbp
shr bp, 0xb2
xor r8d, r11d
push rsi
push rdi
sub rsp, 0x38
lea rdi, [rsp + 0x78]
add bp, 0x5db9
inc rbp
xor ebx, ebx
btr r8d, 0xbd
add rdi, 0xfffffffffffffff8
mov esi, 0x720d6af0
movzx rsi, ax
mov rsi, rdx
movzx ebp, di
mov rbp, rcx
movsx edx, r12w
cwd
movzx r8d, si
lea rdi, [rdi + 8]
mov rdx, rsi
mov r8, qword [rdi]
mov rcx, rbp
call fcn.1404d1c58
test eax, eax
jne 0x1404af53e
inc ebx
cmp ebx, dword [rsp + 0x70]
jmp 0x1404af50c
jl 0x1404af4e7
add rsp, 0x38
movsx bx, ah
jmp 0x1404af521
pop rdi
movsxd rbx, r11d
movsx bp, r8b
pop rsi
movsx ebp, ax
pop rbp
cmove rbx, r12
movsx bx, r15b
movzx rbx, r8w
pop rbx
ret
and qword [rsp + 0x20], 0
stc
cmc
cmp r8b, 0x72
xor r9d, r9d
jmp 0x1404af552
xor r8d, r8d
test bpl, 0x46
stc
sub edx, edx
xor ecx, ecx
jmp 0x1404af563
call fcn.1404b34d0
int3

Function at 0x1404b34d0
Capabilities:
Terminate process

Disassembly:
movabs dword [0x498c348655083504], eax
push rax
invalid
rcr dword [rdi - 0x74], 0x33
mov ch, 0x68
jp 0x140177717
invalid
jns 0x1401776a6
mov ecx, 0xb82c98bc
mov ecx, 0xa2b60e05
invalid
call 0x151571c7b
invalid
push rsp
invalid
movabs al, byte [0x288641a2f0d88648]
retf
sub cl, ch
xchg byte [r15 - 0x79b48a8f], spl
imul edx, dword [rbx], 0x4d
mov dl, 0xf9
fist dword [0x190112734]
jnp 0x1401776e2
mov ecx, 0xd591a6f9
xchg r9b, r14b
and eax, 0x8806495b
int3
invalid
mov dh, 0xf9
invalid
mov bh, bh
pop rcx
ja 0x1401777eb
pop rbp
lodsd eax, dword [rsi]
cmpsb byte [rsi], byte [rdi]
cmpsd dword [rsi], dword [rdi]
jo case.0x1404b3540.6
outsb dx, byte [rsi]
movabs byte [0x7b9e2ebcfb8e9897], al
sahf
jnp 0x14017779f
jbe 0x140177767
sahf
jnp 0x14017779f
jbe 0x140177767
fld xword [rdx - 0x69eab9fa]
jp 0x14017773a
insb byte [rdi], dx
in al, dx
pop rsp
fadd dword [rbp + 0x19]
mov ah, 0xef
and dword [rcx + 0x61913200], eax
lodsb al, byte [rsi]
xchg dl, al
jl 0x1401777b5
sub al, 0x43
sub al, 0x43
adc byte [r9 - 0x33d31010], al
mov ch, byte [rbx]
mov esp, 0x7162fcb8
xor dword [rsi + 0x45], eax
test dl, al
pushfq
lea ebx, [rsp - 0x10d2bbc4]
imul esi, eax, 0xa3160702
outsb dx, byte [rsi]
invalid
ret 0x8d9c
invalid
sub rsp, 0x28
mov ecx, 0x17
jmp 0x1404b34de
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b34eb
je 0x1404b3502
mov ecx, 5
jmp 0x1404b34fb
int 0x29
jmp 0x1404b3502
mov r8d, 1
mov edx, 0xc0000417
cmovp cx, cx
lea ecx, [r8 + 1]
call fcn.1404b3547
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
bts rdx, r11
add rdx, rcx
mov edx, 0xc0000417
cmc
test rsp, 0x13467bbf
add rsp, 0x28
jmp switch.0x1404b3540
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404b4d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
sub cx, 0x914
bsf ecx, ebp
add cl, dl
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r14
clc
sbb cl, r12b
sub rsp, 0x60
movsx rdi, di
mov rsi, r9
movzx rcx, r10w
setnp ch
mov rdi, r8
jmp 0x1404b4d3f
mov ecx, dword [rdx]
jmp 0x1404b4d46
call fcn.1401c5614
nop
btr r14, 0x24
sar r14b, cl
rcr rbx, 0x91
mov rbx, qword [0x1400ba160]
shl r14w, cl
cmp r13w, di
xor r14w, 0x28e0
movsxd rax, dword [0x1400ba158]
shl r14w, cl
sub r14b, 0xde
shl r14b, 0xc9
lea r14, [rbx + rax*8]
mov qword [rsp + 0x38], rbx
stc
clc
cmp rbx, r14
jmp 0x1404b4d93
je 0x1404b4ed4
mov rax, qword [rbx]
cmp r9w, 0x2fdb
stc
mov qword [rsp + 0x20], rax
mov rdx, qword [rdi]
stc
cmp r13b, bl
test rax, rax
jmp 0x1404b4db7
je 0x1404b4e19
mov ecx, dword [rax + 0x14]
mov eax, ecx
shr eax, 0xd
cmp r13, r13
test al, 1
jmp 0x1404b4dcf
je 0x1404b4e19
mov eax, ecx
test r14b, 0x2b
cmp r13w, 0x1c58
stc
and al, 3
cmp r13b, r15b
stc
cmc
cmp al, 2
jmp 0x1404b4df0
jne 0x1404b4e04
test cl, 0xc0
jmp 0x1404b4dfe
jne 0x1404b4e27
bt ecx, 0xb
jmp 0x1404b4e0d
jb 0x1404b4e27
inc dword [rdx]
test r8b, 0xaf
add rbx, 8
jmp 0x1404b4e22
jmp 0x1404b4d84
mov rdx, qword [rdi + 0x10]
setp r8b
mov rcx, qword [rdi + 8]
movsx ax, spl
mov r9, r14
not r9b
mov rax, qword [rdi]
movzx r9d, bp
lea r8, [rsp + 0x20]
movsxd r9, edx
bswap r9
movsx r9, r11w
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rax
movzx r8w, r13b
cbw
mov qword [rsp + 0x50], rcx
movzx ecx, r11w
cmovge r9d, r12d
xchg r9, r8
mov qword [rsp + 0x58], rdx
mov dh, 0xff
movzx r8, si
lahf
mov rax, qword [rsp + 0x20]
movzx r8, r13w
mov qword [rsp + 0x28], rax
bswap r8
mov dl, 0x22
cmovs dx, r15w
mov qword [rsp + 0x30], rax
cmovne rdx, rsp
lea r9, [rsp + 0x28]
cmovno edx, eax
lea r8, [rsp + 0x40]
movzx rcx, r12w
lea rdx, [rsp + 0x30]
movzx rcx, bx
lea rcx, [rsp + 0x88]
jmp 0x1404b4eca
call fcn.1404b4b89
jmp 0x1404b4e19
mov ecx, dword [rsi]
jmp 0x1404b4edb
call fcn.1401f9b18
mov rbx, qword [rsp + 0x80]
movsx rsi, bp
add rsp, 0x60
xchg r14, r14
movsx di, r11b
pop r14
movsxd rdi, r15d
xchg esi, edi
movzx rsi, si
pop rdi
movsxd rsi, eax
movzx si, r14b
movsx si, bpl
pop rsi
jmp 0x1404b4f17
ret
Function at 0x1404bbd33
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
and r8d, 0x470a25b0
push rdi
sub rsp, 0x30
movsx r8w, al
neg r11b
inc dil
mov r9b, byte [rdx + 8]
mov rbx, rcx
rcl di, 0x35
mov al, r9b
bts r11w, bp
sub ecx, ecx
bt r8w, ax
sar r8w, 0x97
neg al
movsx rax, bp
movzx r8, r12w
movzx ax, r14b
mov rdi, rdx
inc r8w
jmp 0x1404bbd89
mov eax, dword [rbx + 4]
inc r11b
lea r11, [rbx + 8]
movsx r8w, cl
setp r8b
sbb r10d, r10d
xor r8b, bpl
movzx r8, cx
lea r8, [rbx + 8]
and r10d, 0x1d
cmc
lea r11, [r11 + rax]
test r10b, bpl
stc
add r10d, 0x17
add r10d, dword [rbx]
cmc
cmp r8, r11
je 0x1404bbe39
neg r9b
jmp 0x1404bbdd6
movabs rax, 0x1fffffff000000
sbb rdx, rdx
test rsi, 0x56cf3837
cmp dil, 0x91
and rdx, rax
test r11, r15
test r14w, 0x457
add rdx, 0xffffff
cmp rcx, rdx
jmp 0x1404bbe09
ja 0x1404bbe39
movzx eax, byte [r8]
jmp 0x1404bbe1b
sub r10d, 4
shl rcx, 4
inc r8
stc
cmc
lea rcx, [rcx + rax]
cmp bpl, r11b
stc
cmp r8, r11
jne 0x1404bbe01
mov r9b, 1
jmp 0x1404bbe41
jmp 0x1404bbe71
test r9b, r9b
jmp 0x1404bbe4e
je 0x1404bbe7f
mov al, byte [r8]
mov r9b, 0x92
mov r9b, dil
inc r8
and r9b, 0xdb
test al, al
setnp r9b
sete r9b
test spl, r12b
cmp r8, r11
jmp 0x1404bbe79
jne 0x1404bbe46
mov r8b, byte [rbx + 0x308]
movzx dx, spl
movsx edx, sp
mov edx, r10d
jmp 0x1404bbe96
mov qword [rsp + 0x20], rdi
jmp 0x1404bbea0
call fcn.1404b76fd
mov rbx, qword [rsp + 0x40]
add dil, r9b
movsxd rdi, r8d
add rsp, 0x30
movsxd rdi, edi
cmovl di, r14w
not di
pop rdi
jmp 0x1404bbec5
ret