joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d4f8e
Capabilities:
Encrypt data using rc4 prga
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
not rbx
shl sil, cl
push rdi
sub rsp, 0x20
movsxd rsi, esi
mov esi, edx
not ebx
mov ebx, ecx
jmp 0x1404d4fb1
call fcn.1404c6f70
mov ecx, ebx
and dil, 0x6d
sal dx, 0x6f
lea r8, [rsp + 0x30]
and ecx, 0x3ff
movsxd r9, esi
setne dil
mov r9d, 2
cwd
movzx edi, ax
bts ecx, 0xa
cdq
movzx edi, dx
mov edx, 0x20000001
movsxd rdi, esi
mov dil, r9b
sets dil
mov rdi, rax
jmp 0x1404d4ffc
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
stc
cmc
test eax, eax
je 0x1404d50c3
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d5018
je 0x1404d50b4
test esi, esi
jmp 0x1404d5025
je 0x1404d50b4
mov r9, qword [rdi + 0x98]
inc rcx
cdqe
xor r8b, 0x24
mov r8d, r10d
btc ecx, 0x90
stc
movzx edx, word [r9]
movsxd rax, r9d
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
test dl, r15b
cmp r9d, 0x63dc3be0
cmp ax, 0x19
jbe 0x1404d5079
sub dx, 0x61
stc
cmp dx, 0x19
jmp 0x1404d5073
ja 0x1404d508e
movzx edx, word [rcx]
jmp 0x1404d5081
inc r8d
clc
add rcx, 2
jmp 0x1404d504e
or rcx, 0xffffffffffffffff
jmp 0x1404d5097
inc rcx
stc
cmp word [r9 + rcx*2], r10w
jmp 0x1404d50a5
jne 0x1404d5097
cmp r8d, ecx
je 0x1404d50c3
mov eax, 1
jmp 0x1404d50be
jmp 0x1404d50c7
sub eax, eax
sar edi, cl
mov rbx, qword [rsp + 0x38]
movzx rdi, r10w
movsxd rdi, edx
bts di, r10w
mov rsi, qword [rsp + 0x40]
inc di
add rsp, 0x20
movsx rdi, cx
movsxd rdi, esi
jmp 0x1404d50f0
pop rdi
jmp 0x1404d50f6
ret
Function at 0x1404d6711
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
test r12d, 0x624104c3
push r14
cmc
test r9b, dil
sub rsp, 0x40
jmp 0x1404d673a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub r14d, r14d
xor ebx, 0x4d8e1f8d
clc
mov rbx, rax
test rax, rax
jmp 0x1404d6755
je 0x1404d68ac
mov rsi, rax
test r14b, 0xfe
clc
cmp word [rax], r14w
jmp 0x1404d676c
je 0x1404d67a8
or rax, 0xffffffffffffffff
jmp 0x1404d677b
inc rax
cmp word [rsi + rax*2], r14w
jmp 0x1404d6788
jne 0x1404d677b
lea rsi, [rsi + rax*2]
cmp edi, r10d
add rsi, 2
cmp word [rsi], r14w
jmp 0x1404d67a2
jne 0x1404d6772
mov qword [rsp + 0x38], r14
not r8
sub rsi, rbx
rcr r9b, 0x48
mov qword [rsp + 0x30], r14
add rsi, 2
clc
sar rsi, 1
mov r8, rbx
mov r9d, esi
stc
mov dword [rsp + 0x28], r14d
cmp r11b, 0x5c
test r15b, r15b
sub edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
jmp 0x1404d67e5
call fcn.1404c6d5a
movsxd rbp, eax
cmp r14d, r15d
stc
test eax, eax
jmp 0x1404d67f8
je 0x1404d68ac
mov rcx, rbp
call fcn.1404c6c94
mov rdi, rax
stc
clc
test rax, rax
jmp 0x1404d6813
je 0x1404d6890
mov qword [rsp + 0x38], r14
bt r8, 0xa
cmc
mov r9d, esi
rol r8w, 0xba
rcl r8, cl
mov qword [rsp + 0x30], r14
cmp spl, 0xa2
bts r8d, r15d
mov r8, rbx
test ecx, 0x63f10da1
cmp r8, r12
cmp esi, 0x554676f3
mov dword [rsp + 0x28], ebp
clc
stc
cmc
sub edx, edx
cmc
sub ecx, ecx
mov qword [rsp + 0x20], rax
jmp 0x1404d6864
call fcn.1404c6d5a
test eax, eax
jmp 0x1404d6870
je 0x1404d6890
mov rsi, rdi
cmova di, di
xchg edi, edi
movzx rdi, r13w
mov rdi, r14
jmp 0x1404d688b
jmp 0x1404d689a
mov rsi, r14
movzx rcx, ax
mov cl, r15b
mov rcx, rdi
jmp 0x1404d68a2
call fcn.1404c6c19
jmp 0x1404d68b0
mov rsi, r14
clc
test rbx, rbx
jmp 0x1404d68b8
je 0x1404d68c7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
sub dil, 0x67
shl r14b, cl
mov rdi, qword [rsp + 0x68]
bsf r14, rbp
add rsp, 0x40
cmovns r14w, r12w
pop r14
jmp 0x1404d68f9
ret
Function at 0x1404d68fa
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
jmp 0x1404d690e
mov qword [rsp + 0x18], rsi
stc
test bp, 0x4712
push rdi
cmp r12b, dl
test ebx, r15d
sub rsp, 0x20
jmp 0x1404d6929
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
rcr bh, 0xa5
mov rbx, rax
cmc
test rax, rax
je 0x1404d6a01
mov rbp, rax
cmp al, 0xc7
test r12b, 0xf7
clc
cmp word [rax], si
je 0x1404d6984
or rax, 0xffffffffffffffff
inc rax
cmp dh, bh
stc
cmp word [rbp + rax*2], si
jne 0x1404d6958
lea rbp, [rbp + rax*2]
clc
test ah, 0xb2
add rbp, 2
cmp r13b, 0x6a
cmp word [rbp], si
jne 0x1404d6954
sub rbp, rbx
movzx cx, spl
sar cx, cl
add rbp, 2
movsx ecx, r13w
sub cx, 0x6646
or ch, 0xda
sar rbp, 1
cmp cx, 0x5944
movzx rcx, r14w
dec cx
add rbp, rbp
mov cx, r10w
mov rcx, rbp
jmp 0x1404d69bd
call fcn.1404c6c94
mov rdi, rax
test rax, rax
je 0x1404d69ec
mov r8, rbp
movzx rcx, bx
mov ecx, r8d
mov rdx, rbx
mov rcx, rax
jmp 0x1404d69e3
call fcn.1404a0f31
mov rsi, rdi
cmc
xor ecx, ecx
jmp 0x1404d69f3
call fcn.1404c6c19
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
btc ebp, esi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
setne dil
movzx edi, si
dec dil
add rsp, 0x20
setge dil
pop rdi
jmp 0x1404d6a2e
ret
Function at 0x1404d9906
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx rax, r14w
movzx ax, dil
cwde
mov qword [rsp + 0x18], rbp
movzx rax, bp
mov al, 0x91
push rsi
cbw
movsx rax, r11w
lahf
push rdi
not al
movzx rax, di
mov al, dil
push r14
cwde
cmovne ax, bp
jmp 0x1404d993e
mov eax, 0x1450
jmp 0x1404d9948
call fcn.140445df4
sub rsp, rax
mov bpl, 0xec
rol sil, 8
mov rax, qword [0x1400b7288]
shr bp, cl
xor rax, rsp
ror bpl, 0xf8
cmp cl, ah
xor bp, cx
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
rcr ch, cl
btc ax, cx
rcl cl, cl
mov rax, r10
shr rsi, cl
bsr esi, eax
shld dx, r8w, 0x73
mov ebp, r9d
test cx, 0x38b9
sar rax, 6
lea rcx, [0x1400ba940]
movsxd rdx, r15d
neg dx
sbb rsi, rcx
and r10d, 0x3f
movsxd r14, r11d
cmp r11d, 0x6f2a4b70
sar si, 0x9e
add rbp, r8
bt si, r11w
btc si, 0x99
mov rsi, r8
mov r14, 0x6962039e
mov rax, qword [rcx + rax*8]
movsx edx, r11w
rcr dl, cl
lea rdx, [r10 + r10*8]
and r14b, 0x66
mov r14, qword [rax + rdx*8 + 0x28]
cmp cl, r15b
clc
sub eax, eax
clc
cmc
mov qword [rdi], rax
stc
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1404d9aeb
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404d9a13
jae 0x1404d9a66
mov al, byte [rsi]
jmp 0x1404d9a20
inc rsi
stc
test r11w, 0x4fb
cmp al, 0xa
jmp 0x1404d9a31
jne 0x1404d9a4a
inc dword [rdi + 8]
jmp 0x1404d9a3f
mov byte [rbx], 0xd
jmp 0x1404d9a47
inc rbx
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
clc
cmp rbx, rax
jmp 0x1404d9a60
jb 0x1404d9a0b
and qword [rsp + 0x20], 0
cbw
shr eax, 0x18
lea rax, [rsp + 0x40]
cmovg r9w, r11w
btc r9w, 0xdd
sub ebx, eax
movsx r9w, r15b
setp r9b
lea r9, [rsp + 0x30]
mov dh, 0xb8
movsx r8, sp
mov r8d, ebx
movsx ecx, r12w
lea rdx, [rsp + 0x40]
movzx rcx, si
movzx cx, sil
mov cl, bpl
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d9ae3
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1404d9aeb
cmp rsi, rbp
jmp 0x1404d9ad8
jb 0x1404d9a06
jmp 0x1404d9aeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
and cl, 0x2e
adc rcx, rdx
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14049d217
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movzx bp, cl
not r14w
mov rbp, qword [r11 + 0x30]
jmp 0x1404d9b26
mov rsp, r11
pop r14
pop rdi
movsxd rsi, ebx
pop rsi
ret
Function at 0x1404d9b31
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx ax, r14b
bswap rax
mov qword [rsp + 0x18], rbp
push rsi
movsx eax, si
cwde
movzx rax, r15w
push rdi
jmp 0x1404d9b60
push r14
bswap ax
movzx rax, r8w
cmovl ax, dx
mov eax, 0x1450
jmp 0x1404d9b77
call fcn.140445df4
sub rsp, rax
and rdi, 0x10f67fb5
bt r10d, 9
mov rax, qword [0x1400b7288]
xor rax, rsp
not dil
sub sil, al
mov qword [rsp + 0x1440], rax
inc r10
movsxd r10, edx
xchg dx, r14w
mov rdi, rcx
cqo
rol r14w, 0x4f
or bp, 0x4a05
mov rax, r10
bts rcx, rsp
sub si, 0x32b0
mov ebp, r9d
shl dx, 0xa5
ror dl, 0xf8
rcl esi, cl
sar rax, 6
bts r14w, r13w
movzx si, sil
lea rcx, [0x1400ba940]
and r10d, 0x3f
bsf esi, r13d
lea rbp, [rbp + r8]
mov dl, r12b
rcr dh, cl
test r12b, bpl
mov rsi, r8
bt dx, 0xe8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
rcl r14w, 0x4f
mov r14, qword [rax + rdx*8 + 0x28]
clc
sub eax, eax
cmp ecx, 0x66c24b33
mov qword [rdi], rax
cmp ecx, 0x67ce7100
mov dword [rdi + 8], eax
clc
test dil, bpl
cmp eax, 0x2beb18a4
cmp r8, rbp
jmp 0x1404d9c3e
jae 0x1404d9d5d
lea rbx, [rsp + 0x40]
test ebx, r9d
clc
cmp rsi, rbp
jmp 0x1404d9c55
jae 0x1404d9cd3
movzx eax, word [rsi]
stc
add rsi, 2
cmc
test rsp, 0x4ae50887
cmp ax, 0xa
jmp 0x1404d9c74
jne 0x1404d9c9f
add dword [rdi + 8], 2
add cl, bpl
neg rcx
xadd rcx, rcx
mov ecx, 0xd
test di, 0x8d7
mov word [rbx], cx
cmp r8b, 0x55
add rbx, 2
stc
clc
mov word [rbx], ax
and ax, 0x2fe6
bt ax, 0x59
add rbx, 2
sbb ah, 0xef
movsx eax, ax
cmovge ax, r11w
lea rax, [rsp + 0x143e]
cmp dl, r9b
cmp rbx, rax
jmp 0x1404d9ccd
jb 0x1404d9c4d
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
ror r8d, 0x80
or r8, r11
sar rbx, 1
mov r8, rbp
not ch
clc
lea rdx, [rsp + 0x40]
add ebx, ebx
cmovl rcx, r15
movsxd r8, r11d
mov rcx, r14
mov r8d, ebx
jmp 0x1404d9d0f
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404d9d4c
mov eax, dword [rsp + 0x30]
stc
test ch, 0xf5
jmp 0x1404d9d2a
add dword [rdi + 4], eax
cmp dl, 0xfd
cmc
cmp eax, ebx
jmp 0x1404d9d38
jb 0x1404d9d5d
cmp rsi, rbp
jb 0x1404d9c44
jmp 0x1404d9d5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
movzx eax, r13w
rcr ax, cl
xchg ah, al
mov rax, rdi
cmc
adc ch, 0xa6
or cl, 0x2f
mov rcx, qword [rsp + 0x1440]
jmp 0x1404d9d74
xor rcx, rsp
call fcn.14049d217
lea r11, [rsp + 0x1450]
not rbp
mov rbx, qword [r11 + 0x20]
cmovne r14w, bx
bswap si
movsx r14w, r15b
mov rbp, qword [r11 + 0x30]
not r14w
mov rsp, r11
pop r14
pop rdi
movsxd rsi, esi
movzx si, cl
pop rsi
jmp 0x1404d9db3
ret
Function at 0x1404d9db4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404d9de5
mov qword [rsp + 0x18], rbp
cwde
mov ax, ax
push rsi
setp al
movsx rax, r11w
cdqe
push rdi
movzx ax, r11b
cdqe
push r12
push r14
push r15
cdqe
mov eax, 0x1470
jmp 0x1404d9e12
call fcn.140445df4
sub rsp, rax
mov rax, qword [0x1400b7288]
xor rax, rsp
mov qword [rsp + 0x1460], rax
movzx r14, bx
test dx, r11w
movsxd r10, edx
mov rbx, rcx
mov rax, r10
sub dx, di
mov r14d, r9d
sar rax, 6
mov r15b, 0xab
xor dil, 0xd8
btr rcx, 0x8d
lea rcx, [0x1400ba940]
movsx edi, r15w
and r10d, 0x3f
and r15b, 0x5b
btc r15w, 0xdd
lea r14, [r14 + r8]
mov r15, r8
bswap dx
and edi, 0x7ae941a5
rcr r12b, cl
mov rdi, r8
mov rax, qword [rcx + rax*8]
adc r12, 0x57549eb
xor dl, 0x2c
movsx r12d, r14w
lea rdx, [r10 + r10*8]
movzx r12d, dx
test sp, cx
sub r12b, al
mov r12, qword [rax + rdx*8 + 0x28]
sub eax, eax
cmc
test r11d, 0x72267489
jmp 0x1404d9eb6
mov qword [rbx], rax
cmp r8, r14
mov dword [rbx + 8], eax
jmp 0x1404d9ec4
jae 0x1404da077
lea rax, [rsp + 0x50]
test si, bx
jmp 0x1404d9ed7
cmp rdi, r14
jae 0x1404d9f3e
movzx ecx, word [rdi]
test r12d, edx
add rdi, 2
cmp cx, 0xa
jmp 0x1404d9ef3
jne 0x1404d9f13
mov edx, 0xd
test dl, 0x8c
cmp r15d, 0x690029e7
mov word [rax], dx
add rax, 2
stc
cmp r14b, r13b
mov word [rax], cx
sar cl, 0x64
btc cx, si
add rax, 2
sal rcx, cl
movsx rcx, r12w
lea rcx, [rsp + 0x6f8]
cmp rax, rcx
jmp 0x1404d9f38
jb 0x1404d9ed7
and qword [rsp + 0x38], 0
bt ecx, eax
cmp esp, 0x719a24d9
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
mov r9, rbx
ror r9b, 0xf
lea r8, [rsp + 0x50]
bsr r9, r11
sub rax, rcx
movsxd r9, r15d
test r15b, 0x3c
shl ch, cl
mov dword [rsp + 0x28], 0xd55
xchg ecx, r9d
lea rcx, [rsp + 0x700]
or r9d, 0x64490637
sar rax, 1
mov qword [rsp + 0x20], rcx
inc ch
mov r9d, eax
stc
mov ecx, 0xfde9
test dil, dl
cmp al, 0xec
cmp r11w, r15w
xor edx, edx
jmp 0x1404d9fb1
call fcn.1404c6d5a
mov ebp, eax
jmp 0x1404d9fc2
test eax, eax
je 0x1404da06a
xor esi, esi
cmp rsi, r14
jmp 0x1404d9fd4
test eax, eax
jmp 0x1404d9fdb
je 0x1404da043
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
movsx r8, bp
mov ecx, esi
lea r9, [rsp + 0x40]
rcr r8w, cl
mov r8d, ebp
stc
cmp rdx, rax
clc
lea rdx, [rdx + rcx]
cmp r8w, 0x786b
jmp 0x1404da015
mov rcx, r12
sub r8d, esi
jmp 0x1404da020
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404da06a
add esi, dword [rsp + 0x40]
test si, r11w
cmp esi, ebp
jmp 0x1404da03d
jb 0x1404d9fe1
mov eax, edi
cmc
stc
cmp bx, cx
sub eax, r15d
test r15, 0x2f362c13
mov dword [rbx + 4], eax
cmp r10w, 0x18bd
cmp rdi, r14
jmp 0x1404da065
jmp 0x1404d9ec4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
jmp 0x1404da077
mov rax, rbx
cmp r8w, r13w
mov rcx, qword [rsp + 0x1460]
clc
xor rcx, rsp
call fcn.14049d217
lea r11, [rsp + 0x1470]
cmovbe r15d, r11d
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
jmp 0x1404da0ab
mov rsp, r11
pop r15
pop r14
mov dil, 0x7f
mov dil, al
pop r12
bswap di
cmovg esi, r9d
not si
pop rdi
pop rsi
jmp 0x1404da0cb
ret
Function at 0x1404dd7be
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
test r13b, r13b
not rbx
or r9w, 0x6af
sub rsp, 0x20
not r9d
movzx r8d, cx
movsx rbx, r9w
mov rbx, rdx
lea r9, [0x1400c8ea8]
movsxd r8, ebp
movsx r8, sp
movzx r8, bp
mov edi, ecx
cwd
lea rdx, [0x1400cf748]
movsxd r8, esp
mov ecx, 3
cmovb r8w, r14w
lea r8, [0x1400c8ea0]
jmp 0x1404dd818
call fcn.1404dd91a
mov rdx, rbx
movzx ecx, cx
sub cl, sil
btr rcx, r9
mov ecx, edi
clc
test rax, rax
je 0x1404dd841
call qword [case.0x1404c8daf.0]
jmp 0x1404dd847
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movsx rdi, bx
adc rdi, rbx
movsxd rdi, ecx
add rsp, 0x20
mov di, 0x24df
cmovle rdi, r8
pop rdi
jmp 0x1404dd868
ret
Function at 0x1404dd91a
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
setle ah
movzx rax, r11w
mov qword [rsp + 0x10], rbp
rol ebp, cl
mov qword [rsp + 0x18], rsi
neg bpl
xor bp, di
push rdi
push r12
sar edi, cl
push r13
btr ax, 0x8b
push r14
ror r12b, cl
xadd di, ax
sub r12, 0x4ee1b72
push r15
shr rax, 0x25
sub rsp, 0x20
mov edi, ecx
lea r15, [0x140000000]
shr r13b, cl
rcr r12d, cl
btr r12w, dx
or r14, 0xffffffffffffffff
shr r12b, cl
mov r12, r9
bsr ebp, r10d
lahf
mov rbp, r8
seta r13b
ror r13b, 0x86
mov r13, rdx
bts rax, r8
movsxd rax, r11d
rcr ax, 0xba
mov rax, qword [r15 + rdi*8 + 0xbae00]
nop
cmc
cmp rax, r14
jmp 0x1404dd9ac
je 0x1404ddb60
test rax, rax
jmp 0x1404dd9ba
jne 0x1404ddb65
cmp r8, r9
je 0x1404ddb4d
mov esi, dword [rbp]
bts rbx, rax
or bh, 0x8f
mov rbx, qword [r15 + rsi*8 + 0xbade8]
cmp spl, 0x17
nop
test rbx, rbx
jmp 0x1404dd9e8
je 0x1404dda01
cmp rbx, r14
jmp 0x1404dd9f6
jne 0x1404ddb12
jmp 0x1404ddac8
mov r15, qword [r15 + rsi*8 + 0xc8e70]
sal r8w, 0x16
xor edx, edx
mov rcx, r15
mov r8d, 0x800
jmp 0x1404dda1e
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test r12b, 0x99
test rax, rax
jmp 0x1404dda33
jne 0x1404ddadf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1404ddaa6
lea r8d, [rbx + 7]
mov rcx, r15
movzx rdx, r12w
jmp 0x1404dda58
lea rdx, [0x1400d25d8]
call fcn.14020f3c0
test eax, eax
je 0x1404ddaa6
sub r8d, r8d
btc cx, 0x51
cmp bp, r8w
sub edx, edx
xchg cx, cx
movsx ecx, ax
movzx cx, r14b
mov rcx, r15
jmp 0x1404dda8d
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
clc
stc
test rax, rax
jmp 0x1404ddaa0
jne 0x1404ddadf
mov rax, r14
cmc
movsx r15, bp
cmp dx, si
lea r15, [0x140000000]
cmp r11b, r15b
xchg qword [r15 + rsi*8 + 0xbade8], rax
jmp 0x1404ddac8
add rbp, 4
stc
jmp 0x1404ddad2
cmp rbp, r12
jmp 0x1404ddada
jmp 0x1404dd9c3
mov rax, rbx
rcl r15, 0xec
rcr r15w, 0xbf
lea r15, [0x140000000]
clc
xchg qword [r15 + rsi*8 + 0xbade8], rax
test rax, rax
jmp 0x1404ddb03
je 0x1404ddb12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, r13
xchg ch, cl
mov rcx, rbx
jmp 0x1404ddb1f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jmp 0x1404ddb2d
je 0x1404ddb4d
mov rcx, rax
jmp 0x1404ddb3b
xchg qword [r15 + rdi*8 + 0xbae00], rcx
jmp 0x1404ddb48
jmp 0x1404ddb65
xchg qword [r15 + rdi*8 + 0xbae00], r14
shl sil, 0x61
adc r13w, r10w
mov r13d, r10d
xor eax, eax
test ah, 0x13
mov rbx, qword [rsp + 0x50]
add r12d, 0x63002d20
shl r12b, 0x84
mov rbp, qword [rsp + 0x58]
cmp r9b, r11b
mov rsi, qword [rsp + 0x60]
mov r15b, al
test bpl, 0xc8
btr r14w, 0x22
add rsp, 0x20
cmovp di, dx
setbe r12b
pop r15
pop r14
cmovno r13d, r13d
pop r13
setno r12b
pop r12
movsx edi, dx
movzx rdi, r10w
pop rdi
ret
Function at 0x1404deabc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
cmp r14w, 0x59d
clc
cmc
mov qword [rsp + 0x18], rbp
ror bpl, cl
push rdi
shl dil, cl
rol dil, cl
sbb rdi, 0xf550c9c
push r12
rcr bpl, cl
cmp r11w, 0x685a
btc edi, edi
push r13
bt r12d, r13d
push r14
push r15
sub rsp, 0x20
rcl r12w, cl
mov rdi, qword [rdx]
sub r13d, r13d
rcl r14b, cl
sar r15d, 0x6a
and r14b, 0x2c
mov r12, r9
movsx r15d, dx
rcl bp, cl
mov rbp, r8
rcl r15b, 0x3c
adc r14b, 0x13
ror r15b, 0xff
mov r14, rdx
mov r15, rcx
test rcx, rcx
jmp 0x1404deb37
je 0x1404ded2d
mov rbx, rcx
jmp 0x1404deb45
test r8, r8
jmp 0x1404deb4d
je 0x1404dec93
cmp byte [rdi], r13b
jmp 0x1404deb5b
jne 0x1404deb71
mov r8d, 1
jmp 0x1404deb6c
jmp 0x1404debaf
cmp byte [rdi + 1], r13b
jmp 0x1404deb7a
jne 0x1404deb90
mov r8d, 2
jmp 0x1404deb8b
jmp 0x1404debaf
mov al, byte [rdi + 2]
sar ch, 0x49
neg al
mov dx, r9w
movzx rcx, r11w
dec dl
sbb r8, r8
neg r8
sal r9b, cl
add r8, 3
mov r9, r12
setns dh
movzx dx, r14b
lea rcx, [rsp + 0x50]
mov rdx, rdi
jmp 0x1404debc7
call fcn.1404e3961
mov rdx, rax
clc
cmp rax, 0xffffffffffffffff
jmp 0x1404debd9
je 0x1404deccc
test rax, rax
je 0x1404decbb
mov ecx, dword [rsp + 0x50]
cmp ecx, 0xffff
jbe 0x1404dec72
cmp rbp, 1
jmp 0x1404dec01
jbe 0x1404dec93
add ecx, 0xffff0000
test sp, ax
xor al, 0x64
mov r8d, 0xd800
mov eax, ecx
mov dword [rsp + 0x50], ecx
stc
test bl, r13b
cmp ax, 0x53ab
shr eax, 0xa
dec rbp
cmp dx, r11w
stc
or ax, r8w
cmp si, sp
cmc
mov word [rbx], ax
nop
sbb ax, bp
mov eax, 0x3ff
and cx, ax
adc al, 0xdf
bt ax, r14w
add rbx, 2
bsr ax, r11w
mov eax, 0xdc00
jmp 0x1404dec6a
or cx, ax
jmp 0x1404dec72
mov word [rbx], cx
test rdx, rsi
lea rdi, [rdi + rdx]
test r10b, 0x80
add rbx, 2
sub rbp, 1
jmp 0x1404dec8d
jne 0x1404deb53
sub rbx, r15
sal ax, 0x24
btc ax, 0x30
mov qword [r14], rdi
rcl al, 0x45
bsf ax, cx
sar rbx, 1
cbw
mov rax, rbx
jmp 0x1404decb6
jmp 0x1404deced
mov rdi, r13
mov word [rbx], r13w
jmp 0x1404decc7
jmp 0x1404dec93
mov qword [r14], rdi
call fcn.1404b2d1c
mov dword [rax], 0x2a
btr r12w, r9w
sar r15b, cl
or rax, 0xffffffffffffffff
bswap r12
movzx r13, ax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
cmove r15w, cx
bsr r13, r15
sal r15b, 0x34
add rsp, 0x20
movsxd r12, ebx
pop r15
movsx r13, r10w
pop r14
pop r13
movzx di, r9b
pop r12
movsxd rdi, esp
movsx rdi, r12w
movzx edi, bp
pop rdi
jmp 0x1404ded2c
ret
mov rbx, r13
stc
cmp byte [rdi], r13b
jne 0x1404ded4a
mov r8d, 1
jmp 0x1404ded45
jmp 0x1404ded84
cmp byte [rdi + 1], r13b
jmp 0x1404ded53
jne 0x1404ded69
mov r8d, 2
jmp 0x1404ded64
jmp 0x1404ded84
mov al, byte [rdi + 2]
neg al
inc r9b
sbb r8, r8
test al, 0x32
btr r9w, bx
neg r8
add dl, cl
add r8, 3
mov r9, r12
mov rdx, rdi
xor ecx, ecx
jmp 0x1404ded91
call fcn.1404e3961
cmp rax, 0xffffffffffffffff
je 0x1404deccf
test rax, rax
jmp 0x1404deda8
je 0x1404decae
cmp rax, 4
jne 0x1404dedc0
inc rbx
cmp r10w, r12w
cmc
add rdi, rax
inc rbx
jmp 0x1404ded31
Function at 0x1404e18ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sal r10d, cl
sub rsp, 0x30
sub r10, 0xb78341c
xor eax, eax
shr r10b, 0xf6
bswap r10w
mov r10d, ecx
cmp r10b, al
test rdx, rdx
jmp 0x1404e18d5
jne 0x1404e1916
call fcn.1404b2d1c
mov ebx, 0x16
jmp 0x1404e18ea
mov dword [rax], ebx
call fcn.1404b39ea
mov eax, ebx
bts bx, r9w
shld bx, di, 0x6b
movsx ebx, bx
add rsp, 0x30
setbe bl
movsx rbx, r15w
movsx ebx, r15w
pop rbx
jmp 0x1404e1915
ret
test r8, r8
jmp 0x1404e191e
je 0x1404e18db
movzx ecx, byte [rsp + 0x60]
jmp 0x1404e192e
mov word [rdx], ax
bt ax, 0xaf
movsx ax, r8b
rol al, 0xf6
lea rax, [rcx + 1]
clc
cmp r11w, si
cmp r8, rax
ja 0x1404e1964
call fcn.1404b2d1c
mov ebx, 0x22
jmp 0x1404e195f
jmp 0x1404e18ea
lea eax, [r9 - 2]
mov ebx, 0x22
cmp eax, ebx
ja 0x1404e18db
mov byte [rsp + 0x60], cl
stc
mov ecx, r10d
or ebx, edi
cmp r9, rdx
or bh, 0x83
add rsp, 0x30
pop rbx
jmp 0x1404e198f
jmp 0x1404e1994
mov qword [rsp + 8], rbx
test r12b, 0xe5
rol r10d, 0x58
mov qword [rsp + 0x10], rbp
shld r10w, r13w, 0x9b
rcl bpl, 0xdf
mov qword [rsp + 0x18], rsi
push rdi
mov r11d, 0x619c4273
push r14
push r15
xor r10w, cx
sub rsp, 0x20
movsx r11w, r8b
or r10b, 0x25
xor r15d, r15d
mov ebp, r9d
mov rdi, r8
shl r10, cl
mov r11, rdx
add bh, 0x93
mov r10, rdx
mov ebx, r15d
clc
cmp byte [rsp + 0x60], r15b
jmp 0x1404e19f4
je 0x1404e1a20
lea eax, [r15 + 0x2d]
neg ecx
and r10w, dx
shr r9, 0x14
shl sil, 0xc3
mov word [rdx], ax
sub r8b, 0x44
shr rbx, 0x1c
stc
lea ebx, [rax - 0x2c]
stc
lea r10, [rdx + 2]
mov r8, r10
add r9b, dl
shld ax, dx, 0x13
mov sil, 0x9c
sub edx, edx
bts r14, rbp
bsr rax, rbp
lea rsi, [r10 + 2]
sub r9b, 0x2f
mov eax, ecx
bsf cx, sp
mov r9, r10
add rcx, 0x3aa16e0f
mov cx, 0x49c7
setge cl
div ebp
sub r14b, spl
mov ecx, eax
and al, 0xde
bt ax, 0x11
cmp edx, 9
movsx r14, ax
movzx r14w, r9b
mov eax, 0x57
xchg r14d, r14d
jmp 0x1404e1a7e
lea r14d, [rax - 0x27]
jmp 0x1404e1a87
cmovbe ax, r14w
jmp 0x1404e1a91
inc rbx
jmp 0x1404e1a9b
add ax, dx
mov word [r10], ax
test ah, 0x51
test ecx, ecx
jmp 0x1404e1aac
je 0x1404e1ad4
mov r10, rsi
test r14d, 0x287d0b78
cmp r13, 0x69fa0e58
cmp r12b, bpl
cmp rbx, rdi
jmp 0x1404e1ace
jb 0x1404e1a2e
cmp rbx, rdi
jmp 0x1404e1adc
jb 0x1404e1b12
mov word [r11], r15w
jmp 0x1404e1aeb
call fcn.1404b2d1c
mov ebx, 0x22
jmp 0x1404e1afa
mov dword [rax], ebx
jmp 0x1404e1b01
call fcn.1404b39ea
mov eax, ebx
jmp 0x1404e1b0d
jmp 0x1404e1b59
mov word [rsi], r15w
rcl ah, 0xf7
rol ah, 0xe1
movzx eax, word [r8]
shl cl, cl
movzx ecx, word [r9]
stc
mov word [r9], ax
clc
cmp r8d, 0x4da0636e
sub r9, 2
test rsp, 0x73646758
mov word [r8], cx
stc
add r8, 2
stc
clc
cmp r8, r9
jmp 0x1404e1b51
jb 0x1404e1b1c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
movzx si, spl
rcl r14b, cl
mov rsi, qword [rsp + 0x50]
rcl dil, cl
rcl r14d, 0x2d
rol dil, 0x61
add rsp, 0x20
movzx r14w, r10b
cmovno di, ax
setg r15b
pop r15
movzx r14, r12w
pop r14
mov edi, r11d
movsx edi, r10w
movsxd rdi, r8d
pop rdi
ret