joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403f676e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
stc
clc
cmp r11b, 0x69
push r14
clc
shr r14b, cl
push r12
rol r14b, 0x88
bts r14w, cx
push rsi
clc
shr r14b, cl
push rdi
xadd r14w, r14w
sar r14b, 0xc8
push rbx
bt r14w, r15w
bsf r14d, r15d
rcl r14b, cl
sub rsp, 0x28
adc r14b, 0xde
movzx r14w, bl
mov r14, r8
test bp, r12w
test rdx, rdx
jmp 0x1403f67bf
je 0x1403f69b7
mov rdi, rdx
mov r12, rcx
cmc
clc
xor ebx, ebx
jmp 0x1403f6806
mov rcx, r15
movzx dx, r9b
setg dh
movzx edx, si
mov rdx, rsi
jmp 0x1403f67ea
call fcn.1403bb94b
add rbx, 0x50
jmp 0x1403f67f8
dec rdi
jmp 0x1403f6800
je 0x1403f69a6
mov eax, dword [r12 + rbx + 8]
mov dword [r14 + rbx + 8], eax
jmp 0x1403f6815
cmp r14, r12
jmp 0x1403f681d
je 0x1403f67ef
cmp qword [r12 + rbx + 0x28], 0x10
jmp 0x1403f682e
jb 0x1403f683e
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403f6851
lea r9, [r12 + rbx]
btr si, r15w
adc al, r11b
xor r15b, r15b
add r9, 0x10
lea r15, [r14 + rbx]
btr esi, r8d
add r15, 0x10
mov si, 0x7b6d
dec sil
mov rsi, qword [r12 + rbx + 0x20]
bsr ax, r8w
btr ax, r14w
sub eax, 0x5eaa7f5a
mov rax, qword [r14 + rbx + 0x28]
test ebx, 0x4f180611
cmp rax, rsi
jmp 0x1403f688b
jae 0x1403f68a7
mov rcx, r15
cdq
mov rdx, rsi
jmp 0x1403f689d
call fcn.1403bb94b
jmp 0x1403f68f9
cmp rax, 0x10
jb 0x1403f68bf
mov r15, qword [r14 + rbx + 0x10]
movsx rdx, bx
mov r8b, 0x51
cqo
mov qword [r14 + rbx + 0x20], rsi
movsxd rcx, ecx
cmova rdx, r8
mov rcx, r15
movzx r8d, di
mov rdx, r9
cmovg r8w, r14w
movsxd r8, eax
mov r8, rsi
jmp 0x1403f68e5
call fcn.1404a4307
mov byte [r15 + rsi], 0
bts si, ax
rcr rsi, cl
rol sil, cl
mov rsi, qword [r12 + rbx + 0x40]
stc
cmp qword [r12 + rbx + 0x48], 0x10
jmp 0x1403f690a
jb 0x1403f691a
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403f6925
lea r9, [r12 + rbx]
sar r15b, cl
add r9, 0x30
lea r15, [r14 + rbx]
xadd rax, rax
add r15, 0x30
xor al, 0x49
rol ah, cl
sbb al, r8b
mov rax, qword [r14 + rbx + 0x48]
cmp rax, 0x21a8497b
cmp rax, rsi
jmp 0x1403f694c
jb 0x1403f67d4
cmp rax, 0x10
jmp 0x1403f695b
jb 0x1403f696d
mov r15, qword [r14 + rbx + 0x30]
mov dl, r10b
movzx cx, ah
mov qword [r14 + rbx + 0x40], rsi
xchg r8, rcx
cdq
bswap dx
mov rcx, r15
mov rdx, r9
jmp 0x1403f698a
mov r8, rsi
jmp 0x1403f6992
call fcn.1404a4307
mov byte [r15 + rsi], 0
jmp 0x1403f69a1
jmp 0x1403f67ef
add r14, rbx
cmp r13d, 0x50d82e6f
ror bx, 0x41
or rax, rax
mov rax, r14
cmp r8b, 0x41
bsf ebx, r15d
add rsp, 0x28
mov bl, r8b
pop rbx
not r12b
movsxd r15, r12d
pop rdi
mov r12w, di
pop rsi
pop r12
mov r14d, r12d
pop r14
movzx r15, si
bswap r15w
pop r15
jmp 0x1403f69ec
ret
Function at 0x14042c48b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r11b, 4
bt r15d, 0xa3
push r14
sar r15w, 0xeb
push r12
push rsi
movzx r12, r12w
add r12, rsi
sub r15w, 0x3390
push rdi
shl r15d, 0xac
push rbp
push rbx
sub rsp, 0x20
or r15b, 0xc4
inc bh
mov r12, r8
mov edi, edx
mov rbx, rcx
lea r14, [rcx + 0x38]
movsx r15d, sp
rol r15w, 0x13
rcr bp, 0x72
lea r15, [rcx + 0x39]
xor bpl, bl
test r9b, 0xd6
shl bpl, cl
mov ebp, 0x80
sub esi, esi
jmp 0x14042c4f1
jmp 0x14042c526
lea rcx, [rax + 1]
jmp 0x14042c4ff
mov qword [rbx + 0xc0], rcx
movzx eax, byte [rax]
jmp 0x14042c50e
mov byte [r12 + rsi], al
inc rsi
shr ebp, 1
cmp rsi, 4
jmp 0x14042c520
je 0x14042c66e
test ebp, edi
jmp 0x14042c52d
je 0x14042c512
cmp qword [rbx + 0x10], 0
je 0x14042c561
mov rcx, qword [rbx + 0x28]
call qword [rbx + 0x20]
test eax, eax
jmp 0x14042c54c
je 0x14042c602
cmp dword [rbx + 0x30], 0
jmp 0x14042c55b
je 0x14042c66b
mov rax, qword [rbx + 0xc0]
btr cx, 0x46
add cx, 0xd61
clc
mov rcx, qword [rbx + 0xc8]
test r11b, 0xe9
cmp rax, rcx
jmp 0x14042c586
jae 0x14042c66b
cmp rax, rcx
jmp 0x14042c594
jb 0x14042c4f6
cmp dword [rbx + 0x30], 0
jmp 0x14042c5a3
je 0x14042c62e
mov r8d, dword [rbx + 0x34]
setle dl
mov dx, bx
mov rcx, qword [rbx + 0x28]
cmovg dx, r11w
cqo
movsx edx, sp
mov rdx, r14
jmp 0x14042c5c9
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
test r14d, 0x3b3871f0
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
test eax, eax
je 0x14042c63a
movsxd rcx, eax
clc
add rcx, r14
movzx eax, byte [r14]
jmp 0x14042c5fd
jmp 0x14042c653
mov rax, qword [rbx + 0xc0]
movsxd rcx, ecx
ror ecx, cl
mov rcx, qword [rbx + 0xc8]
jmp 0x14042c61b
cmp rax, rcx
jmp 0x14042c623
jae 0x14042c59a
jmp 0x14042c4f6
xor eax, eax
jmp 0x14042c635
jmp 0x14042c50e
mov dword [rbx + 0x30], 0
mov byte [rbx + 0x38], 0
xor eax, eax
movzx ecx, r12w
mov rcx, r15
jmp 0x14042c653
mov qword [rbx + 0xc8], rcx
jmp 0x14042c65f
mov qword [rbx + 0xc0], r15
jmp 0x14042c50e
sub r12d, r12d
mov rax, r12
mov r12d, 0x7cf51f32
add rsp, 0x20
setnp bpl
pop rbx
movzx r12w, r13b
jmp 0x14042c68f
pop rbp
mov r15b, r13b
setp r14b
bswap r14w
pop rdi
movzx r14, ax
cmovns r14, r11
pop rsi
movsx r15, r12w
mov r14w, r13w
pop r12
pop r14
movsxd r15, r10d
movzx r15d, cx
pop r15
jmp 0x14042c6bf
ret
Function at 0x14043f7a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
and eax, r10d
and al, 0x35
sar ax, cl
push r14
push rsi
push rdi
movsx rax, r9w
push rbp
push rbx
rcr sil, cl
rol rax, 0x1b
sub rsp, 0x78
movzx si, r13b
movaps xmmword [rsp + 0x60], xmm8
movsx rsi, dx
not sil
movaps xmmword [rsp + 0x50], xmm7
movzx esi, r14w
movaps xmmword [rsp + 0x40], xmm6
not ah
mov rax, qword [rcx]
movzx si, r8b
movsx esi, si
mov esi, dword [rax + 0x10]
jmp 0x14043f7fb
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
cmp r10b, 0xe5
test esi, esi
jle 0x14043f9dd
movaps xmm7, xmm2
movsx r15, r11w
movaps xmm8, xmm1
bswap r15d
movsxd r15, esi
seto r15b
mov r15, rcx
jmp 0x14043f839
xorps xmm6, xmm6
sub edi, edi
lea r14, [rsp + 0x28]
nop word cs:[rax + rax]
movsxd r8, r10d
setno cl
mov rcx, r14
setnp dh
xchg dl, r8b
mov rdx, r15
movsx r8d, r15w
mov r8d, edi
jmp 0x14043f86e
call fcn.14043f4a8
mov ebx, dword [rsp + 0x3c]
clc
test ebx, ebx
jmp 0x14043f87f
jle 0x14043f9dd
test edi, edi
jmp 0x14043f88c
jne 0x14043f8aa
movss xmm0, dword [rsp + 0x34]
jmp 0x14043f89d
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043f9db
movss xmm0, dword [rsp + 0x38]
jmp 0x14043f8b5
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043f8dc
add edi, ebx
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x14043f8d1
jl 0x14043f856
jmp 0x14043f9dd
movss xmm6, dword [rsp + 0x28]
ucomiss xmm6, xmm8
jbe 0x14043f8f8
mov esi, edi
jmp 0x14043f8f3
jmp 0x14043f9dd
movss xmm0, dword [rsp + 0x2c]
jmp 0x14043f903
ucomiss xmm0, xmm8
jbe 0x14043f966
sub ebp, ebp
movsx r8d, dx
mov r8w, 0x32c3
cqo
mov esi, edi
cwd
movaps xmm7, xmm6
nop word cs:[rax + rax]
mov rcx, r15
mov edx, edi
mov r8w, 0x798c
mov r8d, ebp
call fcn.14043fc90
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x14043fa36
inc ebp
jmp 0x14043f954
inc esi
movaps xmm6, xmm7
cmp ebx, ebp
jmp 0x14043f960
jne 0x14043f92d
test byte [r15 + 0x1c], 4
jmp 0x14043f970
jne 0x14043f9c1
lea esi, [rbx + rdi]
bswap cx
movzx rcx, r13w
dec esi
mov rax, qword [r15]
movsxd rcx, esi
cmp bpl, cl
test r10b, sil
clc
cmp qword [rax + 0x10], rcx
jmp 0x14043f998
jbe 0x14043fa58
cmp qword [rax + 0x18], 8
jmp 0x14043f9a8
jb 0x14043f9b1
mov rax, qword [rax]
cmp word [rax + rcx*2], 0xa
jmp 0x14043f9bb
je 0x14043f9dd
add ebx, edi
setle sil
movsx rsi, bx
mov si, 0x3c81
mov esi, ebx
jmp 0x14043f9d6
jmp 0x14043f9dd
xor esi, esi
mov eax, esi
movsx r15w, dil
and di, ax
btc rdi, rbp
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
xor sil, 0xd3
bts r14d, r9d
movzx rbx, r8w
add rsp, 0x78
pop rbx
pop rbp
movsx di, bpl
movzx edi, r13w
cmovnp esi, ebp
pop rdi
pop rsi
mov r15b, r11b
pop r14
cmovl r15w, r13w
movzx r15w, r13b
movsx r15d, r11w
pop r15
jmp 0x14043fa35
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x14043f9dd
inc esi
jmp 0x14043fa53
jmp 0x14043f9dd
call fcn.14043fe0f
int3
Function at 0x140444991
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044499a
movzx ecx, cx
jmp 0x1404449a2
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
add rsp, 0x28
jmp 0x1404449bc
ret
Function at 0x1404460e3
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movzx ax, r13b
mov rcx, qword [rcx]
cdqe
cwde
mov rax, qword [rcx]
jmp 0x1404460fa
call qword [rax + 0x28]
test eax, eax
jmp 0x140446104
je 0x14044613b
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
sal dl, 0x49
mov dl, 3
inc r9
mov r9d, 0x2a
test r13b, 0x10
jmp 0x14044612d
add rsp, 0x28
jmp 0x140446136
jmp fcn.1403aff5a
nop
stc
add rsp, 0x28
jmp 0x140446146
ret

Function at 0x1404461eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sbb ax, r8w
push rdi
cmp rbx, 0x1f5f5eac
rol sil, 0x1a
push rbp
clc
movzx rsi, r14w
add al, r15b
push rbx
sub rsp, 0x48
neg rbx
shr bh, cl
mov rax, r9
test r10b, 0x95
add sil, 0xbd
mov rsi, rdx
stc
ror bh, 0x9b
rcl dx, cl
mov rdx, rcx
mov ebx, dword [rsp + 0xa0]
sal cx, cl
sar rcx, cl
test ah, 0xb1
mov qword [rsp + 0x40], 0
mov r9b, 0x8c
movzx r9d, r13w
mov rcx, qword [0x1400b9300]
sub r9b, 0xa2
sal r9b, cl
movss xmm0, dword [r8]
clc
movss xmm1, dword [r8 + 4]
btc r9w, r13w
bsf r9w, ax
xor r9w, 0x3411
mov r9, qword [rdx]
cmp ebx, 0xffffffff
je 0x14044628a
mov r8d, ebx
jmp 0x140446285
jmp 0x1404462cb
mov rdx, 0xffffffffffffffff
mov r8, rcx
cmp di, r14w
movsx r8, di
nop word [rax + rax]
lea r8, [rdx + 1]
test ebx, 0x69d66e95
cmp word [rax + rdx*2 + 2], 0
movsx edx, r10w
bswap edx
cwd
mov rdx, r8
jmp 0x1404462c5
jne 0x1404462a5
mov ebp, dword [rsp + 0x98]
bswap ebx
movsx edi, r13w
mov ebx, dword [rsp + 0x90]
cmovp di, r10w
movsxd rdx, r12d
mov rdi, qword [rcx]
cdq
movsx rdx, cx
lea rdx, [rsp + 0x40]
jmp 0x1404462f9
mov qword [rsp + 0x30], rdx
mov dx, 0x5044
movss dword [rsp + 0x28], xmm1
cmovb dx, si
movzx dx, r8b
movss dword [rsp + 0x20], xmm0
cdq
sete dl
not dh
mov rdx, rax
jmp 0x140446325
call qword [rdi + 0x90]
test eax, eax
jmp 0x140446332
je 0x140446366
mov ecx, eax
movsxd r9, r14d
cmovle r8w, r13w
movabs r8, 0xcafa59766d7f94e
movsx r9d, dx
mov dl, 3
movsx r9d, ax
mov r9d, 0x41
jmp 0x140446361
call fcn.1403aff5a
mov rcx, qword [rsp + 0x40]
setbe al
mov rax, qword [rcx]
not dx
mov dx, r9w
mov edx, ebx
jmp 0x14044637f
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
cdq
mov rax, qword [rcx]
jmp 0x140446390
mov edx, ebp
jmp 0x140446397
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
ror di, 0xf4
sar rbp, cl
mov rax, rsi
sub bpl, r10b
or rdi, rdx
btc ebx, ecx
add rsp, 0x48
xchg sil, dil
not sil
jmp 0x1404463c4
pop rbx
bswap rdi
movzx rdi, si
pop rbp
movsxd rdi, eax
movsx rdi, r12w
pop rdi
pop rsi
jmp 0x1404463db
ret
Function at 0x14044712a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm12
jmp 0x14044716c
movaps xmmword [rsp + 0x90], xmm11
movsx si, cl
movaps xmmword [rsp + 0x80], xmm10
jmp 0x140447191
movaps xmmword [rsp + 0x70], xmm9
movaps xmmword [rsp + 0x60], xmm8
movsxd rsi, r13d
movsx esi, r13w
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm6
cmovb si, r11w
mov rsi, rcx
jmp 0x1404471bb
movss xmm11, dword [rsp + 0xe0]
movd xmm7, edx
shr rdx, 0x20
jmp 0x1404471d2
movd xmm6, edx
movd xmm9, r8d
shr r8, 0x20
jmp 0x1404471e4
movd xmm8, r8d
mov rcx, qword [rcx + 0x20]
rdtsc
movups xmm0, xmmword [r9]
movaps xmmword [rsp + 0x30], xmm0
rdtsc
mov rax, qword [rcx]
cmovl dx, r12w
lea rdx, [rsp + 0x30]
call qword [rax + 0x40]
movdqa xmm0, xmm7
call fcn.1404b91ee
movdqa xmm10, xmm0
movss xmm12, dword [0x1400bd480]
jmp 0x140447226
addss xmm10, xmm12
movdqa xmm0, xmm6
call fcn.1404b91ee
movdqa xmm6, xmm0
addss xmm6, xmm12
movdqa xmm0, xmm9
call fcn.1404b91ee
movdqa xmm7, xmm0
addss xmm7, xmm12
movdqa xmm0, xmm8
call fcn.1404b91ee
addss xmm0, xmm12
mov rcx, qword [rsi + 0x18]
mov r9, qword [rsi + 0x20]
movd r8d, xmm7
movd eax, xmm0
movd edx, xmm10
movd esi, xmm6
shl rsi, 0x20
cmp cx, dx
stc
or rdx, rsi
stc
shl rax, 0x20
or r8, rax
mov rax, qword [rcx]
jmp 0x140447294
movss dword [rsp + 0x20], xmm11
jmp 0x1404472a0
mov qword [rsp + 0x28], 0
jmp 0x1404472ae
call qword [rax + pe_nt_image_headers64]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
rcr esi, cl
sbb si, 0x3a23
mov sil, 0xdd
movaps xmm8, xmmword [rsp + 0x60]
mov esi, 0x1cda5649
movaps xmm9, xmmword [rsp + 0x70]
sub sil, r10b
add esi, 0x4ef6206d
movsx si, dl
movaps xmm10, xmmword [rsp + 0x80]
stc
and rsi, rbp
movaps xmm11, xmmword [rsp + 0x90]
movaps xmm12, xmmword [rsp + 0xa0]
add rsp, 0xb0
movsxd rsi, r10d
movzx si, spl
cmova esi, edi
pop rsi
ret
Function at 0x1404490ef
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
btr ax, dx
movsx ax, r9b
rcl ax, 0x39
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14044923e
movsxd rcx, dword [0x14000003c]
bswap edx
bts edx, r14d
lea rdx, [0x140000000]
cmp ebx, 0x4d8c7d19
add rcx, rdx
jmp 0x14044913d
cmp dword [rcx], 0x4550
jmp 0x140449148
jne 0x14044923e
mov eax, 0x20b
test ax, 0x4191
cmp r11w, sp
cmp word [rcx + 0x18], ax
jmp 0x140449164
jne 0x14044923e
sub r8, rdx
sbb r9w, di
sar dl, 0x74
movzx edx, word [rcx + 0x14]
cmovle r9w, si
movsx r9, r12w
add rdx, 0x18
lea rdx, [rdx + rcx]
test ax, 0x2d8d
movsx r9w, sil
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
test r8w, 0x4c9f
mov qword [rsp], rdx
cmp si, 0x5080
cmp r13w, dx
cmp rdx, r9
jmp 0x1404491b9
je 0x1404491ef
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1404491e1
mov eax, dword [rdx + 8]
jmp 0x1404491d6
add eax, ecx
cmp r8, rax
jb 0x1404491fd
add rdx, 0x28
jmp 0x1404491ea
jmp 0x1404491a4
xor edx, edx
test ebp, 0x32040d42
cmp sp, 0x2754
cmc
test rdx, rdx
jmp 0x140449205
jne 0x140449217
xor al, al
jmp 0x140449212
jmp 0x14044924c
cmp dword [rdx + 0x24], 0
jmp 0x140449220
jge 0x140449232
sub al, al
jmp 0x14044922d
jmp 0x14044924c
mov al, 1
jmp 0x140449239
jmp 0x14044924c
sub al, al
jmp 0x140449245
jmp 0x14044924c
add rsp, 0x18
jmp 0x140449255
ret

Function at 0x140449a99
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
jmp 0x140449aaa
push rdi
sub rsp, 0x20
rcl dil, cl
mov rdi, rcx
cmp ah, 0x57
xor edx, edx
mov cx, bp
not ecx
movzx ecx, cx
lea rcx, [rsp + 0x30]
call fcn.1404494ef
mov rbx, qword [rdi + 0x18]
jmp 0x140449ad5
jmp 0x140449b57
mov rax, qword [rdi + 0x10]
dec rbx
movsxd rcx, r12d
xor ch, bh
mov rcx, qword [rax + rbx*8]
cmp r8w, 0x2ed9
stc
test rcx, rcx
je 0x140449b57
mov rax, qword [rcx]
jmp 0x140449b02
mov rax, qword [rax + 0x10]
jmp 0x140449b0b
call qword [0x1400b8d90]
mov r8, rax
clc
test rax, rax
jmp 0x140449b1d
je 0x140449b57
mov rcx, qword [rax]
movsx rax, r14w
movzx edx, r8w
movsx eax, bx
mov edx, 1
movzx eax, r11w
cmovg ax, r10w
mov rax, qword [rcx]
mov ecx, eax
movzx cx, r13b
mov rcx, r8
jmp 0x140449b51
call qword [0x1400b8d90]
test rbx, rbx
jmp 0x140449b5f
jne 0x140449ada
mov rcx, qword [rdi + 0x10]
jmp 0x140449b6e
call fcn.140206508
lea rcx, [rsp + 0x30]
call fcn.14044956c
mov rbx, qword [rsp + 0x38]
cmp r14, r8
sets dil
dec di
add rsp, 0x20
movzx rdi, ax
movsx edi, di
mov di, r9w
pop rdi
jmp 0x140449ba1
ret
Function at 0x14045abf5
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
jmp 0x14045ac03
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
test cl, 0x46
jmp 0x14045ac1b
add rsp, 0x28
jmp 0x14045ac24
ret

Function at 0x14045ae72
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
jmp 0x14045ae7d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14045af06
mov ecx, 0x5a4d
clc
cmp word [rax], cx
jmp 0x14045ae9a
jne 0x14045af06
movsxd rcx, dword [rax + 0x3c]
test r12d, 0x3a661c97
jmp 0x14045aeb0
lea rcx, [rcx + rax]
clc
jmp 0x14045aeba
cmp dword [rcx], 0x4550
jmp 0x14045aec5
jne 0x14045af06
mov eax, 0x20b
jmp 0x14045aed9
cmp word [rcx + 0x18], ax
jne 0x14045af06
cmp dword [rcx + 0x84], 0xe
jbe 0x14045af06
cmp dword [rcx + 0xf8], 0
xchg al, al
setne al
jmp 0x14045af01
jmp 0x14045af08
xor al, al
add rsp, 0x28
jmp 0x14045af11
ret
Function at 0x14046cb18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp cl, spl
mov qword [rax + 8], rbx
cmp rsi, 0x1a4c0a0e
mov qword [rax + 0x10], rbp
bt bp, si
movsxd rbp, ecx
mov qword [rax + 0x18], rsi
neg esi
mov qword [rax + 0x20], rdi
sub bpl, r15b
push r14
rcl edi, cl
neg sil
rcr dil, cl
sub rsp, 0x20
cmc
bt esi, 4
mov rsi, qword [rsp + 0x50]
btc r14w, r10w
btr bp, 0x62
shrd rbp, rbx, 0x4c
movzx r14d, r9w
xor dil, 0x44
mov rdi, r8
mov rbp, rdx
jmp 0x14046cb7f
test rsi, rsi
jmp 0x14046cb87
je 0x14046cc5e
mov rbx, qword [r8 + 8]
test rbx, rbx
jmp 0x14046cb99
je 0x14046cc48
mov rax, qword [rbx + 0x40]
cmc
stc
cmp qword [rax], 0
jmp 0x14046cbae
je 0x14046cc01
mov rax, qword [rbx + 0x58]
clc
cmp dword [rax], 0
jmp 0x14046cbc1
jle 0x14046cc01
dec dword [rax]
bswap ecx
movzx rcx, bp
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
movsx ax, r13b
lea rax, [rdx + 2]
mov qword [rcx], rax
movsx ax, ah
mov eax, r11d
lahf
movzx eax, r14w
jmp 0x14046cbf3
mov word [rdx], r14w
jmp 0x14046cbfc
jmp 0x14046cc29
mov rax, qword [rbx]
cwd
cdq
movsxd rcx, ebp
movzx edx, r14w
cmovb ecx, r15d
mov rcx, rbx
jmp 0x14046cc1a
mov rax, qword [rax + 0x18]
jmp 0x14046cc23
call qword [0x1400b8d90]
mov ecx, 0xffff
jmp 0x14046cc3a
cmp cx, ax
jmp 0x14046cc42
jne 0x14046cc4f
mov byte [rdi], 1
cmp r9b, 0x6d
sub rsi, 1
jmp 0x14046cc58
jne 0x14046cb91
movups xmm0, xmmword [rdi]
sub sil, 0x4e
adc bl, r15b
bt bx, r14w
mov rbx, qword [rsp + 0x30]
xadd r14b, sil
mov rax, rbp
ror r14d, 0x89
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
movzx ebp, di
sar bpl, 0xae
not ebp
mov rbp, qword [rsp + 0x38]
clc
btc r14, r8
movzx r14w, r10b
add rsp, 0x20
movsx r14, di
bswap r14w
pop r14
jmp 0x14046ccb7
ret
Function at 0x140473cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
stc
cmp r12b, 0x33
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
ror bpl, cl
sar bp, cl
bts si, r12w
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor bpl, r12b
mov dil, r12b
not bp
mov rsi, r9
rcl dil, cl
test rax, 0x298922b0
movzx r14d, r8w
bsr ebp, r13d
clc
mov rdi, rdx
shld bp, r8w, 0xf
dec bpl
movzx rbp, bx
mov rbp, rcx
cmp rsi, 0x33197296
cmp r14b, r11b
test r9, r9
jmp 0x140473d3c
je 0x140473e1c
mov rbx, qword [rdx + 8]
jmp 0x140473d4c
test rbx, rbx
jmp 0x140473d54
je 0x140473e07
mov rax, qword [rbx + 0x40]
cmp r11b, 0x34
cmp qword [rax], 0
jmp 0x140473d6b
je 0x140473dc7
mov rax, qword [rbx + 0x58]
cmc
cmp rbx, 0x659d2399
test r11b, 0x56
cmp dword [rax], 0
jmp 0x140473d89
jle 0x140473dc7
dec dword [rax]
cbw
mov rcx, qword [rbx + 0x40]
cwd
rdtsc
mov al, 0xf5
mov rdx, qword [rcx]
cwde
setns al
lea rax, [rdx + 2]
jmp 0x140473dad
mov qword [rcx], rax
movzx eax, r14w
jmp 0x140473db9
mov word [rdx], r14w
jmp 0x140473dc2
jmp 0x140473df0
mov rax, qword [rbx]
movsx rdx, bx
movzx edx, r14w
movzx ecx, bx
movzx rcx, r14w
jmp 0x140473dde
mov rcx, rbx
mov rax, qword [rax + 0x18]
jmp 0x140473dea
call qword [0x1400b8d90]
mov ecx, 0xffff
cmp r9w, r12w
cmp cx, ax
jmp 0x140473e01
jne 0x140473e0d
mov byte [rdi], 1
cmp r8, rbp
sub rsi, 1
jmp 0x140473e16
jne 0x140473d4c
movups xmm0, xmmword [rdi]
cmovg r14w, r15w
mov rbx, qword [rsp + 0x30]
mov rax, rbp
rol di, 5
mov rsi, qword [rsp + 0x40]
stc
jmp 0x140473e3f
mov rdi, qword [rsp + 0x48]
bts r14, r13
movdqu xmmword [rbp], xmm0
bts r14w, si
setnp r14b
shl bpl, cl
mov rbp, qword [rsp + 0x38]
rol r14w, cl
sbb r14b, r9b
neg r14d
add rsp, 0x20
movsx r14d, bx
movsxd r14, r9d
movsx r14, bx
pop r14
jmp 0x140473e7e
ret
Function at 0x140492b0b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x140492b29
mov qword [rax + 8], rbx
add bx, 0x714a
or ebx, r10d
mov qword [rax + 0x10], rbp
rcr ebx, cl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
sal sil, 0x57
mov esi, 0x2ba83b01
bts ebp, r8d
push r14
sub rsp, 0x20
shr rbx, 0x61
mov rsi, r9
movsx bp, dil
mov r14, r8
mov rbx, rdx
sal bpl, 0x3e
mov rbp, rcx
cmp rdx, r8
jmp 0x140492b77
je 0x140492c51
mov rdi, qword [r9 + 8]
clc
test rdi, rdi
jmp 0x140492b8a
je 0x140492c34
mov rax, qword [rdi + 0x40]
adc r8b, r9b
movzx r8d, word [rbx]
clc
cmp qword [rax], 0
jmp 0x140492ba5
je 0x140492bf3
mov rax, qword [rdi + 0x58]
cmp bx, r9w
test r10b, 0
cmp dword [rax], 0
jle 0x140492bf3
dec dword [rax]
mov rcx, qword [rdi + 0x40]
jmp 0x140492bcd
mov rdx, qword [rcx]
movzx ax, al
xchg al, al
seta al
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x140492be5
mov word [rdx], r8w
jmp 0x140492bee
jmp 0x140492c1e
mov rax, qword [rdi]
jmp 0x140492bff
movzx edx, r8w
mov rcx, rdi
jmp 0x140492c0b
mov rax, qword [rax + 0x18]
jmp 0x140492c14
call qword [0x1400b8d90]
movzx r8d, ax
mov eax, 0xffff
clc
cmp r8w, 0x51f
cmp ax, r8w
jne 0x140492c3c
mov byte [rsi], 1
cmp bp, r14w
stc
add rbx, 2
cmp ch, 0xf
cmp rbx, r14
jmp 0x140492c4b
jne 0x140492b82
movups xmm0, xmmword [rsi]
sete bl
bsr eax, r15d
mov rbx, qword [rsp + 0x30]
bsr di, r8w
mov rax, rbp
xchg r14b, sil
shr r14w, cl
btc si, 0x61
mov rsi, qword [rsp + 0x40]
adc r14b, r12b
setb r14b
xor dil, al
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
shrd bp, di, 0xdf
mov rbp, qword [rsp + 0x38]
movsxd r14, r14d
add rsp, 0x20
mov r14b, r10b
not r14
pop r14
jmp 0x140492cab
ret
Function at 0x14049f6d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r12b, spl
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
btr rsi, r14
adc sil, r11b
add rbp, 0x1e0b652e
push rdi
movzx ebp, r8w
push r14
push r15
sub rsp, 0x20
or dil, r8b
ror r15b, 0x39
test rdx, rdx
lea r14, [rax + 8]
mov rbp, rcx
movsxd rsi, r14d
mov rdi, rcx
movzx r15, sp
movzx si, dl
jmp 0x14049f728
movzx ecx, byte [rcx]
movsx si, r12b
mov esi, 0x5e2201a2
xchg rsi, r15
cmovne r14, rdx
movzx rsi, r15w
mov r15d, r13d
mov r15, r9
mov esi, r8d
jmp 0x14049f74e
jmp 0x14049f768
inc rdi
xchg cl, ch
movsx cx, r15b
setp cl
movzx ecx, byte [rdi]
jmp 0x14049f768
call fcn.1404b8d0b
test eax, eax
jne 0x14049f753
mov bl, byte [rdi]
shl al, cl
cmp dh, dh
sar eax, 0xe
lea eax, [rbx - 0x2b]
clc
test al, 0xfd
jmp 0x14049f789
je 0x14049f79b
mov bl, 0x2b
jmp 0x14049f796
jmp 0x14049f79e
inc rdi
mov r9, r15
mov cx, bp
mov r8d, esi
mov edx, 0x1df4221b
movzx edx, cx
mov rdx, r14
xchg cx, cx
mov ch, 0x84
setge cl
mov rcx, rdi
jmp 0x14049f7c3
call fcn.14049f8d5
mov ecx, eax
mov esi, 0x7fffffff
clc
stc
cmp rdi, qword [r14]
jmp 0x14049f7d9
jne 0x14049f7ec
mov qword [r14], rbp
jmp 0x14049f7e7
jmp 0x14049f7fa
cmp rbp, qword [r14]
jmp 0x14049f7f4
jne 0x14049f802
test ecx, ecx
jne 0x14049f837
cmp bl, 0x2b
jne 0x14049f818
cmp ecx, esi
jmp 0x14049f812
ja 0x14049f837
cmp bl, 0x2d
jmp 0x14049f820
jne 0x14049f87d
cmp ecx, 0x80000000
jmp 0x14049f831
jbe 0x14049f87d
call fcn.1404b615c
mov dword [rax], 0x22
cmp dl, 0xb6
test r15, r15
jmp 0x14049f84d
je 0x14049f85e
mov dword [r15], 1
stc
seta ah
mov eax, 0x80000000
clc
cmp bl, 0x2d
cmove esi, eax
not ax
movsxd rax, r8d
cwde
mov eax, esi
jmp 0x14049f878
jmp 0x14049f89c
neg eax
sal r14b, cl
rcr r14b, 0x2b
cmp bl, 0x2d
bswap esi
cmove ecx, eax
rol si, 0xae
sub ax, 0x698
mov eax, ecx
movsx rbp, cx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
sub di, r11w
sal r14b, cl
xor r15b, 0x5d
add rsp, 0x20
bswap r15w
movsx r14w, sil
pop r15
pop r14
movzx edi, r15w
cmovo edi, esi
pop rdi
jmp 0x14049f8d4
ret

Function at 0x1404a0f8e
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x1404a0f9c
call fcn.1404ab4ed
mov r9d, 2
movsx r8w, r11b
cwd
cdq
lea r8, [rsp + 0x30]
cdq
sete dh
jmp 0x1404a0fbd
mov rcx, qword [rax + 0x28]
cqo
bswap dx
lea edx, [r9 + 0x20]
jmp 0x1404a0fcf
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
stc
sub ecx, 0x30
jmp 0x1404a0fe3
je 0x1404a102a
sub ecx, 1
jmp 0x1404a0ff1
je 0x1404a101b
cmp ecx, 1
jmp 0x1404a0fff
je 0x1404a100c
xor eax, eax
jmp 0x1404a102f
mov eax, 3
jmp 0x1404a1016
jmp 0x1404a102f
mov eax, 1
jmp 0x1404a1025
jmp 0x1404a102f
mov eax, 2
add rsp, 0x28
jmp 0x1404a1038
ret