joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404291e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
btc rsi, 0x92
inc sil
clc
push rdi
movsx di, r15b
bswap esi
shl si, cl
sub rsp, 0x28
mov rsi, rcx
movzx edi, dx
movzx edx, word [rcx + rdi*4 + 0x834]
clc
cmc
test dx, dx
jmp 0x140429214
js 0x140429227
mov rcx, rsi
jmp 0x140429222
call fcn.1404291e3
movsxd rcx, dword [rsi + 0x8860]
test r12d, esi
cmc
clc
cmp ecx, dword [rsi + 0x8858]
jmp 0x14042923e
jge 0x140429409
movsxd rax, dword [rsi + 0x885c]
cmp sil, r15b
setns dh
cwd
add rax, rcx
stc
sar edx, cl
mov r8, qword [rsi + 8]
movzx dx, dh
sbb cx, 0x22b4
sub ecx, 0x7b5b4a2e
lea edx, [rax + 3]
shl ch, cl
movsx cx, r12b
add cl, bh
test eax, eax
cmovns edx, eax
bsr ecx, ebp
movsx rcx, bx
xadd cx, cx
mov rcx, qword [rsi + 0x18]
clc
cmp r12d, 0x25a43e4a
sar edx, 2
cmp edx, 0x6ad72600
movsxd rdx, edx
cmp r14b, r13b
clc
test r8b, 0x5b
mov byte [rcx + rdx], 1
xor dx, r15w
dec rdx
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
cmc
clc
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x1404292ce
jb 0x140429324
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
adc ch, 0xf0
cmc
movzx ecx, byte [rdx + rdi*4 + 1]
jmp 0x1404292eb
mov byte [r8 + rax + 1], cl
not ecx
movzx ecx, byte [rdx + rdi*4]
test r10b, 0xdd
mov byte [r8 + rax + 2], cl
sub ch, 0x9a
cmc
movzx ecx, byte [rdx + rdi*4 + 3]
cmp si, r14w
cmp spl, 0xb2
jmp 0x140429315
mov byte [r8 + rax + 3], cl
rcr eax, 0x68
or al, r8b
rol rax, 0x8e
mov eax, dword [rsi + 0x885c]
clc
add eax, 4
mov dword [rsi + 0x885c], eax
test sp, sp
cmp eax, dword [rsi + 0x8854]
jl 0x140429409
mov ecx, dword [rsi + 0x884c]
rcl ah, 0xce
shr ax, 0x35
mov eax, dword [rsi + 0x8858]
mov dword [rsi + 0x885c], ecx
sub ch, bh
shl cl, cl
movzx rcx, di
mov ecx, dword [rsi + 0x8860]
test r13w, r11w
add ecx, dword [rsi + 0x8844]
test bl, 0x7d
stc
mov dword [rsi + 0x8860], ecx
cmc
jmp 0x140429384
cmp ecx, eax
jmp 0x14042938b
jl 0x140429409
mov ecx, dword [rsi + 0x8840]
clc
nop dword [rax]
test ecx, ecx
jmp 0x1404293a6
jle 0x140429409
mov edx, dword [rsi + 0x8864]
shl edx, cl
cmp r9b, 4
clc
jmp 0x1404293be
mov dword [rsi + 0x8844], edx
jmp 0x1404293c9
sar edx, 1
jmp 0x1404293d4
add edx, dword [rsi + 0x8850]
jmp 0x1404293df
mov dword [rsi + 0x8860], edx
jmp 0x1404293ea
dec ecx
cmp rcx, rbp
cmc
mov dword [rsi + 0x8840], ecx
test esi, 0x1ad52887
cmp edx, eax
jmp 0x140429403
jge 0x14042939f
add rsp, 0x28
jmp 0x140429412
pop rdi
movzx rsi, dx
setne sil
pop rsi
jmp 0x140429421
ret
Function at 0x140429422
Capabilities:
Check for software breakpoints
Encrypt data using rc4 prga

Disassembly:
push r15
movsxd r15, ecx
bts r15w, sp
ror r15w, cl
push r14
push r12
rcr r14b, cl
rol r14w, 0xdc
push rsi
push rdi
add r15b, dl
push rbp
movsx bp, cl
btr r12d, r14d
push rbx
movsx r15, bx
sub rsp, 0x20
cmc
rcl dil, cl
mov r12, r8
mov edi, edx
mov rbx, rcx
lea r14, [rcx + 0x38]
lea r15, [rcx + 0x39]
bt rbp, rbx
mov ebp, 0x80
cmc
sub esi, esi
jmp 0x1404294ae
lea rcx, [rax + 1]
jmp 0x140429481
mov qword [rbx + 0xc0], rcx
movzx eax, byte [rax]
jmp 0x140429490
mov byte [r12 + rsi], al
jmp 0x140429499
inc rsi
test esi, ebp
cmp sil, 0xcc
shr ebp, 1
cmp rsi, 4
je 0x140429614
test ebp, edi
jmp 0x1404294b5
je 0x140429499
cmp qword [rbx + 0x10], 0
jmp 0x1404294c5
je 0x1404294ee
mov rcx, qword [rbx + 0x28]
jmp 0x1404294d4
call qword [rbx + 0x20]
test eax, eax
je 0x140429586
cmp dword [rbx + 0x30], 0
jmp 0x1404294e8
je 0x140429607
mov rax, qword [rbx + 0xc0]
movsxd rcx, ecx
xor cl, r9b
mov rcx, qword [rbx + 0xc8]
test bpl, 0x52
clc
cmp r10w, r11w
cmp rax, rcx
jmp 0x140429513
jae 0x140429607
cmp rax, rcx
jb 0x140429478
cmp dword [rbx + 0x30], 0
jmp 0x14042952b
je 0x1404295af
mov r8d, dword [rbx + 0x34]
mov rcx, qword [rbx + 0x28]
mov dh, dh
cmovno edx, r9d
movsxd rdx, r9d
mov rdx, r14
jmp 0x14042954a
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
clc
jmp 0x140429559
sub ecx, dword [rbx + 0xd0]
clc
add dword [rbx + 0xb8], ecx
cmc
stc
test eax, eax
je 0x1404295bb
movsxd rcx, eax
adc al, 0xbe
add rcx, r14
movzx eax, byte [r14]
jmp 0x140429581
jmp 0x1404295ea
mov rax, qword [rbx + 0xc0]
cmovl rcx, rsp
shr ch, 0x69
mov rcx, qword [rbx + 0xc8]
clc
cmp rax, rcx
jmp 0x1404295a4
jae 0x140429522
jmp 0x140429478
sub eax, eax
jmp 0x1404295b6
jmp 0x140429490
mov dword [rbx + 0x30], 0
shld cx, r13w, 0x32
shl cx, 0x2c
movsx rcx, sp
mov byte [rbx + 0x38], 0
xchg cl, ch
xor eax, eax
setg cl
movsx rcx, r9w
movzx ecx, bx
mov rcx, r15
jmp 0x1404295ea
mov qword [rbx + 0xc8], rcx
jmp 0x1404295f6
mov qword [rbx + 0xc0], r15
jmp 0x140429602
jmp 0x140429490
sub r12d, r12d
cdqe
ror bl, 0x16
shrd bp, bp, 0x60
mov rax, r12
or di, 0x2bcf
sub bl, r10b
add rsp, 0x20
setb bpl
movzx r14, cx
jmp 0x140429630
pop rbx
not dil
movzx r12w, r11b
movzx r14d, r9w
pop rbp
setg r15b
movsxd r12, ebp
pop rdi
bswap r14
mov r15d, r10d
movzx r14, r11w
pop rsi
mov r12w, r8w
bswap r15
pop r12
jmp 0x140429668
pop r14
movzx r15d, si
cmovns r15w, ax
xchg r15d, r15d
pop r15
ret
Function at 0x14042b755
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
bsf ax, r14w
sub rsp, 0x20
movzx rsi, r10w
rcr ah, cl
cmc
mov rsi, rcx
movzx eax, byte [rcx + 0x4828]
stc
cmp al, 0xff
jmp 0x14042b77a
je 0x14042b791
mov byte [rsi + 0x4828], 0xff
jmp 0x14042b78c
jmp 0x14042b8c1
mov rbx, qword [rsi]
cmovs ax, r9w
mov rax, qword [rbx + 0xc0]
test r10b, 0xc1
cmp rax, qword [rbx + 0xc8]
jmp 0x14042b7b0
jae 0x14042b7df
lea rcx, [rax + 1]
jmp 0x14042b7bf
mov qword [rbx + 0xc0], rcx
movzx cx, bpl
bswap cx
movzx ecx, r9w
movzx ecx, byte [rax]
jmp 0x14042b7da
jmp 0x14042b8ab
cmp dword [rbx + 0x30], 0
jmp 0x14042b7e8
je 0x14042b857
mov r8d, dword [rbx + 0x34]
cdq
lea rdi, [rbx + 0x38]
movsx edx, r11w
movzx rcx, r9w
mov rcx, qword [rbx + 0x28]
xchg dh, dh
cqo
mov rdx, rdi
jmp 0x14042b80f
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
test rbx, rdi
clc
sub ecx, dword [rbx + 0xd0]
stc
test r12b, 0xc5
add dword [rbx + 0xb8], ecx
test eax, eax
je 0x14042b863
cdqe
add rax, rdi
mov rcx, 0x43e83e7a
jmp 0x14042b84a
movzx ecx, byte [rdi]
jmp 0x14042b852
jmp 0x14042b88d
mov al, 0xff
jmp 0x14042b85e
jmp 0x14042b8c1
mov dword [rbx + 0x30], 0
btc rax, 7
shr al, cl
lea rax, [rbx + 0x39]
cmp r10b, 0x7f
test spl, r15b
mov byte [rbx + 0x38], 0
cmp dil, dl
sub ecx, ecx
cmc
test ecx, 0x589a0fee
stc
mov qword [rbx + 0xc8], rax
lea rax, [rbx + 0x39]
jmp 0x14042b8a2
mov qword [rbx + 0xc0], rax
xor al, dl
mov al, 0xff
cmp esi, 0x1f3c7274
cmp cl, 0xff
jmp 0x14042b8bb
je 0x14042b91a
add rsp, 0x20
movzx rdi, di
setnp sil
xchg esi, edi
pop rbx
movzx si, r10b
mov dil, bl
movzx esi, r15w
pop rdi
mov si, bx
movzx rsi, r11w
movsx rsi, r10w
pop rsi
jmp 0x14042b8ee
ret
lea rcx, [rax + 1]
cmc
mov qword [rbx + 0xc0], rcx
clc
movzx eax, byte [rax]
jmp 0x14042b90d
cmp al, 0xff
jmp 0x14042b914
jne 0x14042b8c1
mov rbx, qword [rsi]
sal al, 0xd6
mov rax, qword [rbx + 0xc0]
jmp 0x14042b92c
cmp rax, qword [rbx + 0xc8]
jmp 0x14042b938
jb 0x14042b8ef
cmp dword [rbx + 0x30], 0
jmp 0x14042b947
je 0x14042b9fe
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
seta cl
mov rcx, qword [rbx + 0x28]
movzx edx, r12w
mov rdx, rdi
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
cmp r15b, 0xe
jmp 0x14042b984
test eax, eax
je 0x14042b9a3
movsxd rcx, eax
cbw
and ax, r13w
add rcx, rdi
cmovg eax, edx
movzx eax, byte [rdi]
jmp 0x14042b9c8
mov dword [rbx + 0x30], 0
rol cx, 0x86
shl rcx, 0x2f
or cl, ch
lea rcx, [rbx + 0x39]
mov byte [rbx + 0x38], 0
cmp bh, 3
cmc
sub eax, eax
cmp r11b, spl
cmp bh, 0xec
mov qword [rbx + 0xc8], rcx
lea rcx, [rbx + 0x39]
clc
test r13b, 0x7d
cmp bx, si
mov qword [rbx + 0xc0], rcx
clc
test sp, r14w
jmp 0x14042b9ec
cmp al, 0xff
jmp 0x14042b9f3
je 0x14042b91a
jmp 0x14042b8c1
xor eax, eax
jmp 0x14042ba05
jmp 0x14042b8c1
Function at 0x140432760
Capabilities:
Check for software breakpoints

Disassembly:
push r14
push rsi
btr esi, 0x79
sub si, 0x1653
push rdi
stc
push rbx
sub rsp, 0x28
sar si, cl
sbb sil, 0xcd
bts esi, edx
mov rsi, rcx
bt edi, r12d
and edi, edx
btc edi, r12d
mov rdi, qword [rcx + 0x28]
test rdi, rdi
jmp 0x140432796
je 0x140432890
lea r14, [rsi + 0x28]
test dl, r10b
shr bl, cl
mov rbx, qword [rsi + 0x30]
cmp bpl, 0xcc
stc
clc
cmp rdi, rbx
jne 0x1404327d2
jmp 0x140432817
add rdi, 0x40
cmp bl, r14b
cmp rdi, rbx
jmp 0x1404327cc
je 0x140432814
mov rcx, qword [rdi + 0x38]
clc
jmp 0x1404327dd
test rcx, rcx
jmp 0x1404327e5
je 0x1404327bd
cmp rdi, rcx
setne dl
cdqe
movsx ax, cl
mov rax, qword [rcx]
jmp 0x1404327ff
call qword [rax + 0x20]
mov qword [rdi + 0x38], 0
jmp 0x14043280f
jmp 0x1404327bd
mov rdi, qword [r14]
mov rdx, qword [rsi + 0x38]
jmp 0x140432820
sub rdx, rdi
test bpl, 0xa3
clc
cmp rdx, 0x1000
jmp 0x140432834
jb 0x140432867
mov rax, qword [rdi - 8]
cmp r11d, edx
stc
add rdi, 0xfffffffffffffff8
test r15b, bpl
stc
sub rdi, rax
cmp rdi, 0x20
jae 0x1404328e4
or rdx, 0x27
mov rdi, rax
movsx ecx, r9w
movzx cx, spl
mov rcx, rdi
jmp 0x14043286f
call fcn.14013be3f
xorps xmm0, xmm0
movups xmmword [r14], xmm0
bts ecx, esi
rcl ch, 0x79
mov qword [r14 + 0x10], 0
test r13b, 0x3e
not cx
mov rcx, qword [rsi + 0x10]
test r11b, 0xdb
test rcx, rcx
jmp 0x1404328a0
je 0x1404328b9
mov rax, qword [rcx]
jmp 0x1404328ae
call qword [rax + 0x10]
mov qword [rsi + 0x10], 0
add rsp, 0x28
movsxd rbx, ecx
movsx r14d, bp
not bl
pop rbx
movsx r14, cx
pop rdi
bswap r14d
seta sil
pop rsi
movsx r14, r11w
setno r14b
pop r14
jmp 0x1404328e3
ret
call fcn.1404b3a18
int3
Function at 0x14043d6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sal r15w, cl
push r14
push rsi
sbb r15b, dl
or r14b, dil
bsr r15w, r13w
push rdi
not r14
push rbp
sbb r15b, bpl
push rbx
ror bh, cl
mov r14w, 0x1a6b
btc ebx, 0x87
sub rsp, 0x28
mov r15d, r9d
btc ebx, r12d
mov ebp, r8d
rcl r14w, cl
movsx r14d, sp
movsx r14w, r14b
mov r14, rdx
adc rbx, 0x608d7392
shrd bx, r12w, 0x78
add bx, dx
mov rbx, rcx
rol cx, cl
movzx ecx, r13w
btc cx, bp
lea rcx, [rdx + 0x20]
mov edx, r8d
btc r8w, r11w
mov r8d, r9d
jmp 0x14043d759
xor r9d, r9d
jmp 0x14043d761
call fcn.14043d8f3
test r15d, r15d
jle 0x14043d814
test rax, rax
jmp 0x14043d777
je 0x14043d814
movsxd rsi, ebp
movzx rdx, bp
mov ecx, r15d
inc dh
cmp cx, 0x325a
movzx rdx, r13w
sub ebp, ebp
movsxd rdx, esp
movsx rdx, r11w
jmp 0x14043d7a0
mov rdx, rsi
jmp 0x14043d7a8
jmp 0x14043d7dc
movzx edi, word [rdi + rdx*2]
jmp 0x14043d7b6
mov word [rax + rbp*2], di
jmp 0x14043d7bf
inc rbp
inc rdx
test r14w, 0x8f7
test rsi, r8
cmp rcx, rbp
jmp 0x14043d7d6
je 0x14043d817
mov di, 0x2a
test byte [rbx + 0x1c], 4
jmp 0x14043d7e9
jne 0x14043d7b6
mov rdi, qword [rbx]
cmp qword [rdi + 0x10], rdx
jmp 0x14043d7fb
jbe 0x14043d8e8
cmp qword [rdi + 0x18], 8
jb 0x14043d7ad
mov rdi, qword [rdi]
jmp 0x14043d7ad
movsxd rsi, ebp
mov rbx, qword [rbx]
rcl cl, 0xb9
mov rdi, qword [rbx + 0x10]
btr rcx, 0xf6
ror cl, cl
mov rcx, rdi
sub rcx, rsi
jb 0x14043d8e8
movsxd rax, r15d
cmp rcx, rax
jmp 0x14043d83f
cmovb rax, rcx
xor rcx, r14
sar cl, 0x35
sar cl, cl
cmp qword [rbx + 0x18], 8
cmovno cx, r8w
jmp 0x14043d85d
mov rcx, rbx
jb 0x14043d86c
mov rcx, qword [rbx]
neg r8b
lea rcx, [rcx + rsi*2]
cmc
sub rdi, rax
shr bpl, 0x24
sub dh, 0x68
test r12w, r10w
mov rbp, rdi
sub rbp, rsi
lea rdx, [rcx + rax*2]
adc r8b, 0xd2
movsxd r8, ebp
rcl r8, 0xac
lea r8, [rbp + 2]
clc
add r8, rbp
jmp 0x14043d8a5
call fcn.1404a0f31
mov qword [rbx + 0x10], rdi
sal r15, 0xa5
cmc
mov byte [r14 + 0x16], 0
add rsp, 0x28
pop rbx
pop rbp
movzx si, r11b
movsx rdi, r8w
cmovge rdi, rdi
pop rdi
movsx r14, di
movzx rsi, r9w
pop rsi
pop r14
mov r15w, 0x717c
movsx r15, r15w
pop r15
jmp 0x14043d8e7
ret
call fcn.14043cd30
int3
Function at 0x14044183a
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140441843
movzx ecx, cx
jmp 0x14044184b
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
test r14b, al
stc
cmp eax, 0x100
setae al
test bl, 0x95
clc
stc
add rsp, 0x28
ret

Function at 0x140443036
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movsx ax, bh
mov al, 0xe5
seta ah
mov rcx, qword [rcx]
jmp 0x14044304b
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
je 0x140443086
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
mov dl, 3
adc r9w, 0x59d2
mov r9d, 0x2a
cmp di, dx
stc
test r11w, 0x7071
add rsp, 0x28
jmp fcn.1403acbcd
nop
cmc
add rsp, 0x28
ret

Function at 0x1404445a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
mov rax, r15
push rdi
ror dil, 0xfb
cmp r14b, dl
sub rsp, 0x88
cbw
movaps xmmword [rsp + 0x70], xmm9
xchg si, ax
setg sil
bswap eax
movaps xmmword [rsp + 0x60], xmm8
mov rsi, 0x7fee4c4a
mov si, si
movaps xmmword [rsp + 0x50], xmm7
setnp dil
movzx rax, r9w
not rax
movaps xmmword [rsp + 0x40], xmm6
movsxd rax, ecx
mov esi, edi
movaps xmm8, xmm3
movsxd rsi, r13d
mov rdi, rdx
movsx eax, bp
rdtsc
movzx esi, bp
mov rsi, rcx
cdq
cdqe
mov dx, r13w
mov rcx, qword [rcx + 0x20]
cwde
movsx edx, r15w
movsx dx, r9b
movups xmm0, xmmword [r8]
rdtsc
cdqe
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rcx]
mov dh, 0x2a
lea rdx, [rsp + 0x20]
jmp 0x14044463f
call qword [rax + 0x40]
movsd xmm6, qword [rdi]
jmp 0x14044464b
movaps xmm0, xmm6
jmp 0x140444653
call fcn.1404b5e14
movaps xmm9, xmm0
jmp 0x140444661
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x14044466d
call fcn.1404b5e14
unpcklps xmm9, xmm0
addps xmm9, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm9
movlps qword [rsp + 0x20], xmm9
movsd xmm6, qword [rdi + 8]
jmp 0x140444692
movaps xmm0, xmm6
call fcn.1404b5e14
movaps xmm7, xmm0
jmp 0x1404446a2
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x1404446ae
call fcn.1404b5e14
movss dword [rdi + 8], xmm7
unpcklps xmm7, xmm0
movss dword [rdi + 0xc], xmm0
addps xmm7, xmm9
movlps qword [rsp + 0x28], xmm7
movss dword [rsp + 0x30], xmm8
cdq
setae ch
movss dword [rsp + 0x34], xmm8
movsx edx, r15w
cbw
mov rcx, qword [rsi + 0x18]
mov r8, r14
mov r8b, 0x17
cwde
mov r8, qword [rsi + 0x20]
cbw
mov rax, qword [rcx]
cmovle dx, r15w
movzx rdx, sp
lea rdx, [rsp + 0x20]
call qword [rax + 0x98]
movaps xmm6, xmmword [rsp + 0x40]
cmova di, r10w
movaps xmm7, xmmword [rsp + 0x50]
bsr rsi, rax
movsxd rsi, esp
sbb si, dx
movaps xmm8, xmmword [rsp + 0x60]
adc dil, sil
jmp 0x140444733
movaps xmm9, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
movzx esi, dx
cmovg si, sp
pop rsi
ret
Function at 0x140445f26
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
or r8, 0x562910d6
mov r8, rcx
movsx eax, bp
cdqe
mov eax, 0x5a4d
test rbp, 0x7a8f55de
cmp spl, cl
cmp word [0x140000000], ax
jmp 0x140445f54
jne 0x140446087
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
test r13d, r15d
lea rcx, [rcx + rdx]
stc
cmp rdi, 0x5d01640b
test dil, 0xc6
cmp dword [rcx], 0x4550
jmp 0x140445f86
jne 0x140446087
mov eax, 0x20b
cmp r13b, 0x4f
cmp ebx, ebp
jmp 0x140445f9c
cmp word [rcx + 0x18], ax
jmp 0x140445fa5
jne 0x140446087
sub r8, rdx
movzx edx, word [rcx + 0x14]
movsx r9w, r11b
rcl ax, cl
not ax
add rdx, 0x18
movzx rax, bx
sar ah, cl
xadd rax, r9
add rdx, rcx
movzx eax, word [rcx + 6]
rol cl, cl
xchg r9b, cl
movsx r9w, r10b
lea rcx, [rax + rax*4]
sar r9, 0xa6
movsxd r9, esi
lea r9, [rdx + rcx*8]
cmp sil, sil
mov qword [rsp], rdx
test r9b, r13b
cmp rdx, r9
jmp 0x140445ffd
je 0x140446043
mov ecx, dword [rdx + 0xc]
test r11b, cl
clc
stc
cmp r8, rcx
jb 0x140446035
mov eax, dword [rdx + 8]
test r9, 0x448e353a
cmp r11d, r15d
cmp r11b, 0xfc
add eax, ecx
cmp r8, rax
jmp 0x14044602f
jb 0x140446046
add rdx, 0x28
jmp 0x14044603e
jmp 0x140445fee
xor edx, edx
cmc
test rdx, rdx
jmp 0x14044604e
jne 0x140446060
xor al, al
jmp 0x14044605b
jmp 0x140446090
cmp dword [rdx + 0x24], 0
jmp 0x140446069
jge 0x14044607b
xor al, al
jmp 0x140446076
jmp 0x140446090
mov al, 1
jmp 0x140446082
jmp 0x140446090
xor al, al
jmp 0x140446090
add rsp, 0x18
jmp 0x140446099
ret
Function at 0x140457ca9
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
ror bl, 0x8c
push rbp
mov rbp, rsp
ror bl, 0x23
add bx, 0x4f23
inc bh
sub rsp, 0x20
clc
bt bx, 0xfd
bsf eax, r9d
mov rax, qword [0x1400b7288]
movsx bx, r13b
bts rbx, rsi
movabs rbx, 0x2b992ddfa232
test r13b, 0xa9
clc
cmp rax, rbx
jmp 0x140457cf4
jne 0x140457de5
and qword [rbp + 0x18], 0
movsx cx, sil
movsxd rcx, edi
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140457d1a
mov qword [rbp + 0x10], rax
jmp 0x140457d23
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
test r12b, cl
xor qword [rbp + 0x10], rax
jmp 0x140457d37
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
bsr rcx, r13
lea rcx, [rbp + 0x20]
test r8, 0x594a209d
xor qword [rbp + 0x10], rax
jmp 0x140457d57
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
neg ch
sub cl, 0xc2
rcr cx, cl
lea rcx, [rbp + 0x10]
test r8b, r15b
shl rax, 0x20
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
sal bpl, 0xfa
xor bpl, r9b
jmp 0x140457d87
xor rax, rcx
rol ecx, cl
sbb bp, 0x130c
bt ecx, 0x8c
movabs rcx, 0xffffffffffff
rcl bpl, cl
and rax, rcx
bsf bp, r13w
rcr ecx, 0xa3
movabs rcx, 0x2b992ddfa233
xadd bpl, bpl
bsr bp, r11w
cmp rax, rbx
cmovs bp, sp
mov bx, 0x7dc6
sete bpl
cmove rax, rcx
mov qword [0x1400b7288], rax
shl rbp, 0xb6
movsx rbx, di
bswap bx
mov rbx, qword [rsp + 0x48]
not rax
sbb bpl, r12b
mov qword [0x1400b7280], rax
add rsp, 0x20
movzx ebp, cx
pop rbp
jmp 0x140457e04
ret

Function at 0x140457e99
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
jmp 0x140457ea4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140457f32
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x140457ec0
jne 0x140457f32
movsxd rcx, dword [rax + 0x3c]
cmp r8b, 0xbf
add rcx, rax
jmp 0x140457ed6
cmp dword [rcx], 0x4550
jmp 0x140457ee1
jne 0x140457f32
mov eax, 0x20b
stc
jmp 0x140457ef5
cmp word [rcx + 0x18], ax
jmp 0x140457efe
jne 0x140457f32
cmp dword [rcx + 0x84], 0xe
jmp 0x140457f10
jbe 0x140457f32
cmp dword [rcx + 0xf8], 0
setnp al
jmp 0x140457f25
setne al
jmp 0x140457f2d
jmp 0x140457f3d
xor al, al
test r14, rbp
jmp 0x140457f3d
add rsp, 0x28
jmp 0x140457f46
ret
Function at 0x140469b45
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp bpl, 0x95
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
shr bpl, cl
shrd bp, r8w, 0x5b
cmp r9b, 0xac
mov qword [rax + 0x18], rsi
stc
btr bp, dx
sete sil
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, qword [rsp + 0x50]
test r9d, 0x5f0000be
xadd bpl, dil
movzx r14d, r9w
not di
mov rdi, r8
mov rbp, rdx
cmc
test rsi, rsi
je 0x140469c74
mov rbx, qword [r8 + 8]
cmp r8b, r15b
test dl, dil
test rbx, rbx
jmp 0x140469bb1
je 0x140469c67
mov rax, qword [rbx + 0x40]
cmp qword [rax], 0
jmp 0x140469bc4
je 0x140469c29
mov rax, qword [rbx + 0x58]
clc
test r15d, ecx
cmc
cmp dword [rax], 0
jmp 0x140469bdb
jle 0x140469c29
dec dword [rax]
mov rcx, qword [rbx + 0x40]
cwde
cqo
cbw
mov rdx, qword [rcx]
cmove eax, r8d
mov ax, 0x2053
movsx rax, dx
lea rax, [rdx + 2]
jmp 0x140469c04
mov qword [rcx], rax
movzx ax, r13b
movsxd rax, r13d
bswap ax
movzx eax, r14w
jmp 0x140469c1b
mov word [rdx], r14w
jmp 0x140469c24
jmp 0x140469c53
mov rax, qword [rbx]
xchg cl, ch
movsxd rcx, eax
movzx edx, r14w
mov rcx, r14
movzx rcx, di
mov rcx, rbx
jmp 0x140469c44
mov rax, qword [rax + 0x18]
jmp 0x140469c4d
call qword [case.0x1404c8daf.0]
mov ecx, 0xffff
clc
cmp cx, ax
jmp 0x140469c61
jne 0x140469c6a
mov byte [rdi], 1
sub rsi, 1
jne 0x140469ba9
movups xmm0, xmmword [rdi]
mov rbx, qword [rsp + 0x30]
rcl si, 0xc3
mov rax, rbp
mov rsi, qword [rsp + 0x40]
sbb r14b, r15b
mov rdi, qword [rsp + 0x48]
xor r14w, ax
shr r14b, 0x93
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r14
jmp 0x140469cad
ret
Function at 0x14049c2ef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14049c308
mov qword [rax + 0x10], rbx
cmc
test rbx, 0x4bb02709
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
and bpl, r13b
bsr esi, ecx
push rdi
push r14
push r15
sub rsp, 0x20
sal r14w, cl
add rdi, 0x7fc86249
bts r14w, r13w
test rdx, rdx
not si
movsx r14, di
setne r14b
lea r14, [rax + 8]
setne bpl
movzx r15, bp
movsxd r15, r11d
mov rbp, rcx
xchg di, di
setge r15b
movzx edi, di
mov rdi, rcx
xchg r15w, r15w
movzx ecx, byte [rcx]
jmp 0x14049c377
cmovne r14, rdx
mov r15, r9
cmovp si, r11w
mov esi, r8d
jmp 0x14049c39f
inc rdi
cmovno cx, r14w
movsx rcx, ax
movzx ecx, byte [rdi]
jmp 0x14049c39f
call fcn.1404b5923
test eax, eax
jmp 0x14049c3ab
jne 0x14049c38b
mov bl, byte [rdi]
shr al, cl
sar ah, cl
lea eax, [rbx - 0x2b]
cmc
clc
test al, 0xfd
jmp 0x14049c3c3
je 0x14049c3d5
mov bl, 0x2b
jmp 0x14049c3d0
jmp 0x14049c3dc
inc rdi
cmovo r8, r9
mov r9, r15
cdq
cwd
mov r8d, esi
mov edx, 0x73043d38
mov rdx, r14
mov rcx, rdi
jmp 0x14049c3f5
call fcn.14049c51d
mov ecx, eax
mov esi, 0x7fffffff
cmp rdi, qword [r14]
jmp 0x14049c409
jne 0x14049c417
mov qword [r14], rbp
jmp 0x14049c420
cmp rbp, qword [r14]
jne 0x14049c42d
test ecx, ecx
jmp 0x14049c427
jne 0x14049c462
cmp bl, 0x2b
jmp 0x14049c435
jne 0x14049c448
cmp ecx, esi
jmp 0x14049c442
ja 0x14049c462
cmp bl, 0x2d
jne 0x14049c4ab
cmp ecx, 0x80000000
jmp 0x14049c45c
jbe 0x14049c4ab
call fcn.1404b2d1c
mov dword [rax], 0x22
cmc
test r15, r15
je 0x14049c47e
mov dword [r15], 1
mov eax, 0x80000000
cmc
cmp r13w, r11w
jmp 0x14049c48d
cmp bl, 0x2d
cmove esi, eax
movsx eax, r10w
cmovs ax, r8w
mov al, r14b
mov eax, esi
jmp 0x14049c4a6
jmp 0x14049c4d1
neg eax
sbb r15, rsp
and sil, 0x25
sub r14b, 0xb9
cmp bl, 0x2d
not di
bswap rbp
movsx si, cl
cmove ecx, eax
xor si, r9w
mov eax, ecx
bswap rdi
mov rbx, qword [rsp + 0x48]
btr r14, rsi
or r15w, r11w
btc ebp, r10d
mov rbp, qword [rsp + 0x50]
rcr r14, 0x3b
mov rsi, qword [rsp + 0x58]
cmp r15b, spl
add rsp, 0x20
mov r14b, r13b
movsx r14w, al
setne r15b
pop r15
movsxd rdi, edi
movzx r14w, dil
cmovs di, dx
pop r14
movzx di, al
movzx rdi, cx
pop rdi
ret

Function at 0x14049db9c
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp r10w, 0x76cc
and dword [rsp + 0x30], 0
call fcn.1404a812c
mov r9d, 2
cdq
mov r8b, 0xb4
lea r8, [rsp + 0x30]
cdq
cqo
movzx rcx, sp
mov rcx, qword [rax + 0x28]
movzx dx, al
cqo
movsxd rdx, r9d
lea edx, [r9 + 0x20]
jmp 0x14049dbdc
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
test cx, 0x6ca7
sub ecx, 0x30
je 0x14049dc2c
sub ecx, 1
jmp 0x14049dbfd
je 0x14049dc22
cmp ecx, 1
je 0x14049dc18
sub eax, eax
jmp 0x14049dc13
jmp 0x14049dc31
mov eax, 3
jmp 0x14049dc31
mov eax, 1
jmp 0x14049dc31
mov eax, 2
add rsp, 0x28
jmp 0x14049dc3a
ret