joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14042abb4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
cmp bp, 0x6474
push rbx
neg rax
sal sil, cl
cmp ebp, 0x691903f4
sub rsp, 0x20
bswap rax
test bpl, 0x8b
mov rsi, rcx
movzx eax, byte [rcx + 0x4828]
cmp bx, 0x56bb
test eax, 0x2b224078
cmp al, 0xff
jmp 0x14042abee
je 0x14042ac05
mov byte [rsi + 0x4828], 0xff
jmp 0x14042ac00
jmp 0x14042ad05
mov rbx, qword [rsi]
btr ax, ax
bswap ax
mov rax, qword [rbx + 0xc0]
cmc
stc
jmp 0x14042ac1d
cmp rax, qword [rbx + 0xc8]
jmp 0x14042ac29
jae 0x14042ac42
lea rcx, [rax + 1]
mov qword [rbx + 0xc0], rcx
movzx ecx, byte [rax]
jmp 0x14042acf3
cmp dword [rbx + 0x30], 0
je 0x14042acb4
mov r8d, dword [rbx + 0x34]
cqo
lea rdi, [rbx + 0x38]
cqo
setnp ch
mov edx, r8d
mov rcx, qword [rbx + 0x28]
movsx rdx, bx
cwd
mov rdx, rdi
jmp 0x14042ac70
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
cmp r14d, 0x227b5739
sub ecx, dword [rbx + 0xd0]
test r9b, r9b
stc
add dword [rbx + 0xb8], ecx
test r10b, r15b
cmp ah, 0x17
test eax, eax
je 0x14042acc0
cdqe
adc cl, r9b
not cx
mov cx, cx
add rax, rdi
movzx ecx, byte [rdi]
jmp 0x14042acd8
mov al, 0xff
jmp 0x14042acbb
jmp 0x14042ad05
mov dword [rbx + 0x30], 0
lea rax, [rbx + 0x39]
test eax, r10d
mov byte [rbx + 0x38], 0
sub ecx, ecx
clc
test ch, 0x88
mov qword [rbx + 0xc8], rax
lea rax, [rbx + 0x39]
cmc
test dx, 0x10ce
mov qword [rbx + 0xc0], rax
sar al, 0xa0
mov al, 0xff
clc
stc
cmp cl, 0xff
jmp 0x14042acff
je 0x14042ad44
add rsp, 0x20
cmovbe rsi, rbp
movzx ebx, sp
pop rbx
movsxd rsi, r9d
pop rdi
movzx si, bl
pop rsi
ret
lea rcx, [rax + 1]
clc
stc
mov qword [rbx + 0xc0], rcx
cmp r9b, 0xc2
jmp 0x14042ad31
movzx eax, byte [rax]
cmp r14, r12
cmp al, 0xff
jmp 0x14042ad3e
jne 0x14042ad05
mov rbx, qword [rsi]
sar rax, 0x99
mov rax, qword [rbx + 0xc0]
jmp 0x14042ad57
cmp rax, qword [rbx + 0xc8]
jb 0x14042ad1b
cmp dword [rbx + 0x30], 0
je 0x14042ae12
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
movsx dx, r14b
mov rdx, rdi
jmp 0x14042ad87
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
clc
sub ecx, dword [rbx + 0xd0]
clc
jmp 0x14042ad9d
add dword [rbx + 0xb8], ecx
stc
test esi, ebp
test eax, eax
jmp 0x14042adad
je 0x14042adcf
movsxd rcx, eax
xor al, sil
adc al, r15b
stc
add rcx, rdi
cbw
movzx eax, byte [rdi]
jmp 0x14042adca
jmp 0x14042ade9
mov dword [rbx + 0x30], 0
xchg ch, cl
lea rcx, [rbx + 0x39]
mov byte [rbx + 0x38], 0
cmp sil, r9b
test r11b, 0xa7
xor eax, eax
mov qword [rbx + 0xc8], rcx
lea rcx, [rbx + 0x39]
jmp 0x14042adf9
mov qword [rbx + 0xc0], rcx
cmp al, 0xff
jmp 0x14042ae07
je 0x14042ad44
jmp 0x14042ad05
xor eax, eax
jmp 0x14042ad05
Function at 0x14043cb94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
btr r14, r14
shl r14w, cl
rcr r14b, cl
push rsi
inc r14b
xadd r15b, r15b
movzx r14w, r11b
push rdi
btr r15d, esp
and r14w, 0x87f
movzx r15d, di
push rbp
test ebx, edi
btc r15, 0x42
movzx ebp, r13w
push rbx
sub rsp, 0x28
rcr bp, cl
mov r15d, r9d
xor bx, r13w
mov ebp, r8d
dec bh
bsf bx, r14w
bt r14, rax
mov r14, rdx
mov ebx, ebp
sar bh, cl
bsr bx, sp
mov rbx, rcx
neg cx
adc cx, 0x2a69
lea rcx, [rdx + 0x20]
sbb dh, 0xde
cwd
cqo
mov edx, r8d
shrd r8w, ax, 0x98
shr r8b, cl
mov r8d, r9d
test rbx, 0x321e0582
stc
jmp 0x14043cc25
xor r9d, r9d
jmp 0x14043cc2d
call fcn.14043cdbc
test r15d, r15d
jmp 0x14043cc3a
jle 0x14043ccc3
test rax, rax
jmp 0x14043cc48
je 0x14043ccc3
movsxd rsi, ebp
not ch
mov ecx, r15d
shr dl, cl
xor ebp, ebp
xchg dh, dl
mov rdx, rsi
jmp 0x14043cc64
jmp 0x14043cc85
movzx edi, word [rdi + rdx*2]
mov word [rax + rbp*2], di
inc rbp
jmp 0x14043cc79
inc rdx
cmp rcx, rbp
je 0x14043cccf
mov di, 0x2a
cmp dl, al
test byte [rbx + 0x1c], 4
jne 0x14043cc6d
mov rdi, qword [rbx]
test r13w, cx
cmp qword [rdi + 0x10], rdx
jbe 0x14043cdb1
cmp qword [rdi + 0x18], 8
jmp 0x14043ccb0
jb 0x14043cc69
mov rdi, qword [rdi]
jmp 0x14043ccbe
jmp 0x14043cc69
movsxd rsi, ebp
sar dil, 0x31
neg cl
shl dil, cl
mov rbx, qword [rbx]
mov rdi, qword [rbx + 0x10]
rcl cl, cl
btr rcx, 0x49
bsr rcx, rsp
mov rcx, rdi
cmc
clc
sub rcx, rsi
jb 0x14043cdb1
movsxd rax, r15d
test r8b, 0x8f
clc
cmp rcx, rax
cmovb rax, rcx
xadd ecx, ecx
cmp qword [rbx + 0x18], 8
jmp 0x14043cd12
mov rcx, rbx
jmp 0x14043cd1a
jb 0x14043cd30
mov rcx, qword [rbx]
movzx ebp, r8w
btc rbp, 0x21
sub bp, r10w
lea rcx, [rcx + rsi*2]
movsx bp, r15b
movsxd r8, esi
bts r8, rbx
sub rdi, rax
bts r8w, cx
mov rbp, rdi
cmp dh, cl
adc edx, 0x4e0821d9
shl dh, 0xab
sub rbp, rsi
shl dh, cl
lea rdx, [rcx + rax*2]
dec r8b
lea r8, [rbp + 2]
jmp 0x14043cd6f
add r8, rbp
jmp 0x14043cd77
call fcn.14049ffae
mov qword [rbx + 0x10], rdi
clc
mov byte [r14 + 0x16], 0
dec si
stc
add rsp, 0x28
movzx rbx, r8w
pop rbx
xchg bp, r15w
pop rbp
pop rdi
movsx rsi, si
jmp 0x14043cda6
pop rsi
pop r14
pop r15
jmp 0x14043cdb0
ret
call fcn.14043c223
int3
Function at 0x140440d37
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140440d40
movzx ecx, cx
jmp 0x140440d48
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
add rsp, 0x28
jmp 0x140440d62
ret

Function at 0x140442479
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
not ax
mov rcx, qword [rcx]
movsx eax, r8w
mov ax, r15w
movzx eax, ax
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jmp 0x14044249b
je 0x1404424de
mov ecx, eax
sub dl, r10b
sal dl, 0xd4
sub dl, 0x23
movabs r8, 0xcafa59766d7f94e
mov dl, 3
movsx r9w, dl
shld r9w, dx, 0xf6
mov r9d, 0x2a
cmc
jmp 0x1404424d0
add rsp, 0x28
jmp 0x1404424d9
jmp fcn.1403ac354
nop
add rsp, 0x28
jmp 0x1404424e8
ret

Function at 0x140443655
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
and r14w, 0x5def
push rsi
bts si, r15w
rol r14b, cl
push rdi
rcl ah, 0xcc
push rbp
xor dil, 0x59
sal eax, cl
push rbx
shl bx, 0x30
shld r14w, r15w, 0xa
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
movzx r14d, si
jmp 0x14044368e
mov r14, r9
mov rbx, r8
mov rdi, rdx
lahf
movzx ax, r12b
movzx ebp, cx
mov rsi, rcx
not bp
movzx eax, si
rdtsc
movss xmm6, dword [rsp + 0xb0]
mov dl, r10b
movzx ebp, byte [rsp + 0xb8]
not dh
mov rax, rsi
cdqe
mov qword [rsp + 0x38], 0
cmovae rax, r14
cwde
movzx eax, r10w
mov rcx, qword [rcx + 8]
rdtsc
mov rax, qword [rcx]
movsx dx, r13b
movzx edx, r13w
lea rdx, [rsp + 0x38]
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
movsx ax, r15b
movsxd rcx, r10d
movzx ecx, di
mov rcx, qword [rsp + 0x38]
cdq
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
jmp 0x140443719
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
cdqe
mov rdx, qword [rdi]
mov r8d, 0x4cfe3f1f
mov rax, qword [rcx]
not r8
mov r8d, 1
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
movsx r8, cx
mov rax, qword [rcx]
cqo
cmovp rdx, rbx
mov rdx, rdi
setle r8b
mov r8d, ebx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov al, r11b
movzx edx, bpl
mov eax, 0x30f80cd1
bswap ax
lahf
mov rax, qword [rcx]
jmp 0x14044377a
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
jmp 0x14044378a
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
setl dh
cwd
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
jmp 0x1404437ab
lea rdx, [rsp + 0x40]
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
lahf
bswap r8w
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
jmp 0x1404437cd
mov qword [rsp + 0x20], 0
jmp 0x1404437db
movaps xmm3, xmm6
jmp 0x1404437e3
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
cdqe
movzx ax, r15b
movsxd rax, r14d
mov rax, qword [rcx]
jmp 0x140443800
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
not rax
mov rax, qword [rcx]
jmp 0x140443813
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
setnp bpl
movzx bp, bpl
pop rbx
mov r14w, sp
mov dil, 0xe8
pop rbp
pop rdi
setno sil
pop rsi
setne r14b
movsx r14w, r14b
movsx r14, r13w
pop r14
jmp 0x14044384b
ret
Function at 0x140443a32
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
cmovl ax, r15w
push rdi
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm9
movsx ax, dh
mov sil, 0xcc
movaps xmmword [rsp + 0x60], xmm8
cmovle rsi, rsp
movzx rsi, dx
movsx di, r14b
movaps xmmword [rsp + 0x50], xmm7
setae dil
mov sil, sil
movaps xmmword [rsp + 0x40], xmm6
movaps xmm8, xmm3
mov rdi, rdx
xchg esi, eax
mov rsi, rcx
rdtsc
movzx rdx, r12w
mov rcx, qword [rcx + 0x20]
rdtsc
mov rax, 0x3e930d79
bswap dx
movups xmm0, xmmword [r8]
movaps xmmword [rsp + 0x20], xmm0
rdtsc
cbw
mov rax, qword [rcx]
mov edx, r9d
cqo
movzx edx, di
lea rdx, [rsp + 0x20]
call qword [rax + 0x40]
movsd xmm6, qword [rdi]
jmp 0x140443abf
movaps xmm0, xmm6
jmp 0x140443ac7
call fcn.1404b5065
movaps xmm9, xmm0
jmp 0x140443ad5
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
call fcn.1404b5065
unpcklps xmm9, xmm0
addps xmm9, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm9
movlps qword [rsp + 0x20], xmm9
movsd xmm6, qword [rdi + 8]
movaps xmm0, xmm6
jmp 0x140443b04
call fcn.1404b5065
movaps xmm7, xmm0
jmp 0x140443b11
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x140443b1d
call fcn.1404b5065
movss dword [rdi + 8], xmm7
unpcklps xmm7, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x140443b34
addps xmm7, xmm9
movlps qword [rsp + 0x28], xmm7
movss dword [rsp + 0x30], xmm8
cwd
cwde
movss dword [rsp + 0x34], xmm8
movzx rax, dx
xchg rdx, r8
mov rcx, qword [rsi + 0x18]
cdqe
movzx r8w, bpl
mov r8, qword [rsi + 0x20]
mov rax, qword [rcx]
movsxd rdx, ebp
lea rdx, [rsp + 0x20]
jmp 0x140443b74
call qword [rax + 0x98]
movaps xmm6, xmmword [rsp + 0x40]
rcr sil, cl
rcl dil, cl
bts rdi, r13
movaps xmm7, xmmword [rsp + 0x50]
bswap rdi
xadd dil, sil
movaps xmm8, xmmword [rsp + 0x60]
stc
ror esi, cl
movaps xmm9, xmmword [rsp + 0x70]
xor rdi, 0x37ea323c
and sil, 0xe4
add rsp, 0x88
pop rdi
pop rsi
jmp 0x140443bbd
ret
Function at 0x14044540a
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
movzx ax, r11b
mov r8, rcx
bsr ax, r10w
mov eax, 0x5a4d
clc
cmp word [0x140000000], ax
jmp 0x14044542d
jne 0x140445556
movsxd rcx, dword [0x14000003c]
cmp di, 0x2e57
lea rdx, [0x140000000]
clc
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140445556
mov eax, 0x20b
cmp dl, 0x59
cmp word [rcx + 0x18], ax
jmp 0x140445467
jne 0x140445556
sub r8, rdx
sal r9b, cl
xor dl, r12b
rcl rdx, cl
movzx edx, word [rcx + 0x14]
rcl r9b, 0x72
bts ax, cx
shrd r9d, r8d, 0x85
add rdx, 0x18
cmp r13b, dl
or ah, 0xa8
add rdx, rcx
movzx eax, word [rcx + 6]
xor r9b, r14b
ror r9b, 0x82
lea rcx, [rax + rax*4]
dec r9d
jmp 0x1404454ae
lea r9, [rdx + rcx*8]
jmp 0x1404454bb
mov qword [rsp], rdx
stc
test cl, r15b
cmp rdx, r9
jmp 0x1404454cb
je 0x14044550e
mov ecx, dword [rdx + 0xc]
cmc
jmp 0x1404454db
cmp r8, rcx
jb 0x140445500
mov eax, dword [rdx + 8]
clc
test r14b, 0x27
add eax, ecx
jmp 0x1404454f7
cmp r8, rax
jb 0x14044551a
add rdx, 0x28
jmp 0x140445509
jmp 0x1404454bb
xor edx, edx
stc
jmp 0x14044551a
test rdx, rdx
jmp 0x140445522
jne 0x14044552f
sub al, al
jmp 0x140445569
cmp dword [rdx + 0x24], 0
jmp 0x140445538
jge 0x14044554a
sub al, al
jmp 0x140445545
jmp 0x140445569
mov al, 1
jmp 0x140445551
jmp 0x140445569
xor al, al
jmp 0x14044555d
jmp 0x140445569
add rsp, 0x18
ret
Function at 0x14044fdce
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x14044fdd8
push rdi
bts di, bx
sub rsp, 0x20
bt di, cx
bts rdi, rax
mov rdi, rcx
jmp 0x14044fdf8
xor ebx, ebx
jmp 0x14044fdff
mov rcx, qword [rcx]
clc
stc
test rcx, rcx
jmp 0x14044fe0c
je 0x14044fe86
mov rax, qword [rcx + 0x38]
cmp qword [rax], rbx
jmp 0x14044fe1e
je 0x14044fe61
mov rax, qword [rcx + 0x50]
cmp dword [rax], ebx
jle 0x14044fe61
dec dword [rax]
rdtsc
movsxd rdx, r14d
mov rcx, qword [rcx + 0x38]
rdtsc
cbw
mov rdx, qword [rcx]
cbw
movzx ax, spl
cwde
lea rax, [rdx + 1]
jmp 0x14044fe53
mov qword [rcx], rax
not al
lahf
movzx eax, byte [rdx]
jmp 0x14044fe78
mov rax, qword [rcx]
jmp 0x14044fe69
mov rax, qword [rax + 0x38]
jmp 0x14044fe72
call qword [0x1400b8d90]
cmp eax, 0xffffffff
jmp 0x14044fe80
jne 0x14044fe98
mov qword [rdi], rbx
inc bl
rcr bl, cl
mov bl, 1
jmp 0x14044fe98
mov byte [rdi + 8], bl
bts di, r10w
shr bh, cl
mov rbx, qword [rsp + 0x30]
or edi, r13d
sal dil, cl
add rsp, 0x20
cmovne di, r9w
bswap rdi
movzx edi, r10w
pop rdi
jmp 0x14044fec3
ret

Function at 0x140456ec5
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
sub eax, esi
cmc
push rbp
sub bl, 0x55
movzx rbx, ax
rol bp, 0x33
mov rbp, rsp
xadd eax, ebx
cdqe
adc al, 0x6a
sub rsp, 0x20
lahf
mov rax, qword [0x1400b7288]
movabs rbx, 0x2b992ddfa232
test bp, 0x22a5
cmp rax, rbx
jmp 0x140456f06
jne 0x140456fed
and qword [rbp + 0x18], 0
movsx ecx, r14w
mov rcx, 0x7be83225
lea rcx, [rbp + 0x18]
jmp 0x140456f25
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140456f34
mov qword [rbp + 0x10], rax
jmp 0x140456f3d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x140456f4e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
mov cl, bl
shl cx, 0x28
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x140456f69
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
mov cx, 0x3035
movzx cx, r11b
xadd cx, cx
lea rcx, [rbp + 0x10]
shl rax, 0x20
xor rax, qword [rbp + 0x20]
clc
xor rax, qword [rbp + 0x10]
btc bp, di
cmp ax, 0x744d
ror bp, cl
xor rax, rcx
rcr ch, cl
movabs rcx, 0xffffffffffff
jmp 0x140456fb4
and rax, rcx
movabs rcx, 0x2b992ddfa233
mov rbp, rsi
adc ebp, 0x5936767e
btc ebp, 0x7d
cmp rax, rbx
movsx ebx, si
cmove rax, rcx
rol bh, 0x99
mov qword [0x1400b7288], rax
cmp r15, r14
cmp r12b, 0x52
bt ebp, 0xa8
mov rbx, qword [rsp + 0x48]
shr rbp, 0x2e
test r11b, r10b
movsx ebp, bx
not rax
btr bp, 0xc7
movzx bp, bpl
mov qword [0x1400b7280], rax
cmc
jmp 0x14045701a
add rsp, 0x20
pop rbp
jmp 0x140457024
ret
Function at 0x14045709e
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
stc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404570b3
je 0x14045711f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14045711f
movsxd rcx, dword [rax + 0x3c]
cmc
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jmp 0x1404570db
jne 0x14045711f
mov eax, 0x20b
cmp r10b, 0x49
jmp 0x1404570ef
cmp word [rcx + 0x18], ax
jmp 0x1404570f8
jne 0x14045711f
cmp dword [rcx + 0x84], 0xe
jmp 0x14045710a
jbe 0x14045711f
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140457121
xor al, al
add rsp, 0x28
jmp 0x14045712a
ret
Function at 0x14046fb43
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
or bpl, cl
add bp, r15w
mov qword [rax + 0x18], rsi
xor bx, r8w
movzx si, dl
bts rbx, r8
mov qword [rax + 0x20], rdi
push r14
movsx r14, r8w
sub rsp, 0x20
cmp r8b, spl
mov rsi, r9
neg rbx
shrd bp, r13w, 0x4f
mov rbx, r8
test r11b, 0x6d
stc
cmp bpl, bl
mov r14, rdx
cmovp bp, r8w
mov rbp, rcx
test r9, r9
jmp 0x14046fba1
je 0x14046fc6d
mov rdi, qword [rdx + 8]
stc
cmp al, 0x2b
cmp bl, dl
test rdi, rdi
je 0x14046fc4b
mov rax, qword [rdi + 0x40]
cmc
btr r8w, 0xc5
movzx r8d, word [rbx]
test sil, sil
cmp qword [rax], 0
jmp 0x14046fbd4
je 0x14046fc1b
mov rax, qword [rdi + 0x58]
cmp r12b, r10b
test spl, 5
cmp dword [rax], 0
jmp 0x14046fbed
jle 0x14046fc1b
dec dword [rax]
xchg dx, dx
mov rcx, qword [rdi + 0x40]
lahf
movsx rdx, bp
rdtsc
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x14046fc16
jmp 0x14046fc3c
mov rax, qword [rdi]
movzx edx, r8w
movzx rcx, si
mov rcx, rdi
jmp 0x14046fc2e
mov rax, qword [rax + 0x18]
call qword [0x1400b8d90]
movzx r8d, ax
mov eax, 0xffff
cmp ax, r8w
jne 0x14046fc55
mov byte [r14], 1
jmp 0x14046fc55
add rbx, 2
jmp 0x14046fc5e
sub rsi, 1
jmp 0x14046fc67
jne 0x14046fbb0
movups xmm0, xmmword [r14]
clc
jmp 0x14046fc77
mov rbx, qword [rsp + 0x30]
xadd ax, si
btc edi, eax
mov rax, rbp
rol dil, cl
sub rsi, 0x78da6a89
mov rsi, qword [rsp + 0x40]
rcl r14w, 4
mov rdi, qword [rsp + 0x48]
movsxd r14, ecx
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
movsx r14d, bp
cmovnp r14w, r13w
movsxd r14, edx
pop r14
jmp 0x14046fcc3
ret
Function at 0x14046fcc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14046fcdd
mov qword [rax + 8], rbx
jmp 0x14046fce6
mov qword [rax + 0x10], rbp
rcr bp, cl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
and si, 0x6aa3
push r14
add bpl, 0x17
sar r14b, 0x35
shrd r14w, bx, 0x93
sub rsp, 0x20
shr bpl, 0x46
mov ebp, 0x470189
mov bpl, spl
mov rsi, r9
jmp 0x14046fd26
movzx r14d, r8w
xor rbp, rax
xadd di, di
mov rdi, rdx
xadd bp, bp
ror bpl, cl
sal bpl, cl
mov rbp, rcx
cmp spl, r9b
clc
test r9, r9
jmp 0x14046fd4d
je 0x14046fe14
mov rbx, qword [rdx + 8]
test rbx, rbx
jmp 0x14046fd5f
je 0x14046fe02
mov rax, qword [rbx + 0x40]
test bl, 0xc6
cmp qword [rax], 0
jmp 0x14046fd75
je 0x14046fdba
mov rax, qword [rbx + 0x58]
jmp 0x14046fd85
cmp dword [rax], 0
jmp 0x14046fd8d
jle 0x14046fdba
dec dword [rax]
mov rcx, qword [rbx + 0x40]
cdq
movsx edx, r15w
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx eax, r14w
mov word [rdx], r14w
jmp 0x14046fdb5
jmp 0x14046fde9
mov rax, qword [rbx]
xchg dh, dl
movsx rcx, r12w
movzx edx, r14w
movsxd rcx, r13d
movzx rcx, si
movsx rcx, ax
mov rcx, rbx
jmp 0x14046fdda
mov rax, qword [rax + 0x18]
jmp 0x14046fde3
call qword [0x1400b8d90]
mov ecx, 0xffff
jmp 0x14046fdf4
cmp cx, ax
jmp 0x14046fdfc
jne 0x14046fe05
mov byte [rdi], 1
sub rsi, 1
jmp 0x14046fe0e
jne 0x14046fd57
movups xmm0, xmmword [rdi]
bswap bx
shr r14w, cl
add sil, 0x71
mov rbx, qword [rsp + 0x30]
sub dil, cl
ror dil, 0xe9
inc eax
mov rax, rbp
add r14w, 0x51ec
adc dil, r11b
mov rsi, qword [rsp + 0x40]
movsx rdi, r8w
mov rdi, qword [rsp + 0x48]
or r14d, 0x49c2480a
sbb r14w, r9w
movdqu xmmword [rbp], xmm0
mov r14w, 0x796
mov rbp, qword [rsp + 0x38]
adc r14b, 0xe1
bswap r14w
add rsp, 0x20
movzx r14w, spl
movsx r14w, r9b
pop r14
ret
Function at 0x14049b4e5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
clc
cmc
mov qword [rax + 0x18], rbp
adc bpl, bpl
movsx rbp, sp
mov qword [rax + 0x20], rsi
or rbp, rdx
push rdi
movzx bp, r14b
push r14
and esi, r9d
sbb sil, r12b
push r15
cmp r8d, 0x5964203d
or r15b, dl
sub r15w, 0x1046
sub rsp, 0x20
test rdx, rdx
jmp 0x14049b52c
lea r14, [rax + 8]
mov rbp, rcx
mov rdi, rcx
setp r15b
movzx ecx, byte [rcx]
not r15w
cmovne r14, rdx
movsxd rsi, ebx
not si
jmp 0x14049b550
mov r15, r9
movzx rsi, bx
mov esi, r8d
jmp 0x14049b55f
jmp 0x14049b571
inc rdi
movsxd rcx, esp
movsx ecx, r11w
movzx ecx, byte [rdi]
call fcn.1404b4b5b
test eax, eax
jmp 0x14049b57d
jne 0x14049b564
mov bl, byte [rdi]
adc al, dil
rcr ax, 0x62
sbb al, 0xdc
lea eax, [rbx - 0x2b]
cmp r11b, dil
jmp 0x14049b599
test al, 0xfd
jmp 0x14049b5a0
je 0x14049b5b2
mov bl, 0x2b
jmp 0x14049b5ad
jmp 0x14049b5c1
inc rdi
movsxd r9, esp
cmovno dx, sp
jmp 0x14049b5c1
mov r9, r15
movsx dx, r8b
movzx ecx, sp
mov r8d, esi
cdq
movsx edx, r9w
movzx dx, r13b
mov rdx, r14
cmovae cx, r12w
mov rcx, rdi
jmp 0x14049b5e9
call fcn.14049b72a
mov ecx, eax
bsf rsi, r14
mov esi, 0x7fffffff
cmc
cmp rdi, qword [r14]
jmp 0x14049b602
jne 0x14049b615
mov qword [r14], rbp
jmp 0x14049b610
jmp 0x14049b623
cmp rbp, qword [r14]
jmp 0x14049b61d
jne 0x14049b630
test ecx, ecx
jmp 0x14049b62a
jne 0x14049b665
cmp bl, 0x2b
jmp 0x14049b638
jne 0x14049b64b
cmp ecx, esi
jmp 0x14049b645
ja 0x14049b665
cmp bl, 0x2d
jmp 0x14049b653
jne 0x14049b6b3
cmp ecx, 0x80000000
jbe 0x14049b6b3
call fcn.1404b1f42
mov dword [rax], 0x22
jmp 0x14049b676
test r15, r15
jmp 0x14049b67e
je 0x14049b68b
mov dword [r15], 1
mov eax, 0x80000000
jmp 0x14049b69c
cmp bl, 0x2d
jmp 0x14049b6a4
cmove esi, eax
mov eax, esi
jmp 0x14049b6ae
jmp 0x14049b6de
neg eax
sbb r15b, 0x9f
bsf bp, r10w
cmp bl, 0x2d
bswap rbp
movsxd r15, r13d
not r14b
cmove ecx, eax
ror r15w, 0x39
and rbp, 0x590a3a63
mov eax, ecx
movsx esi, ax
mov rbx, qword [rsp + 0x48]
xor rdi, 0xd3a6f86
mov rbp, qword [rsp + 0x50]
rcl r14b, 0x58
sal di, 0x4d
mov rsi, qword [rsp + 0x58]
add r15b, 0x1b
add rsp, 0x20
not r14w
bswap di
movsx rdi, r14w
pop r15
bswap r14w
pop r14
cmovnp rdi, r14
setns dil
movzx di, bl
pop rdi
jmp 0x14049b729
ret

Function at 0x14049cd32
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test r8b, 0xc7
and dword [rsp + 0x30], 0
jmp 0x14049cd44
call fcn.1404a70d1
mov r9d, 2
cqo
lea r8, [rsp + 0x30]
mov rcx, qword [rax + 0x28]
cqo
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
jmp 0x14049cd73
je 0x14049cdbf
sub ecx, 1
jmp 0x14049cd81
je 0x14049cdb0
cmp ecx, 1
jmp 0x14049cd8f
je 0x14049cda1
xor eax, eax
jmp 0x14049cd9c
jmp 0x14049cdc6
mov eax, 3
jmp 0x14049cdab
jmp 0x14049cdc6
mov eax, 1
jmp 0x14049cdba
jmp 0x14049cdc6
mov eax, 2
cmc
clc
add rsp, 0x28
jmp 0x14049cdcf
ret
Function at 0x1404ab10e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
rcr r8b, 0
dec bl
btc eax, 0xf
push rdi
sub rsp, 0x20
dec sil
cmp spl, 4
add qword [rcx + 0x20], 8
cwd
mov rdi, rcx
bt r8d, eax
xor si, 0x325c
shrd bx, r9w, 0x83
mov rax, qword [rcx + 0x20]
cwd
mov esi, dword [rcx + 0x38]
add bh, 0xad
cmp esi, 0xffffffff
mov r8d, dword [rcx + 0x3c]
cwd
movzx edx, word [rcx + 0x42]
jmp 0x1404ab16a
mov rbx, qword [rax - 8]
mov ah, 0x52
mov eax, 0x7fffffff
jmp 0x1404ab17b
mov qword [rcx + 0x48], rbx
jmp 0x1404ab184
cmove esi, eax
jmp 0x1404ab18c
mov rcx, qword [rcx]
jmp 0x1404ab194
call fcn.140118939
test al, al
je 0x1404ab1e4
test rbx, rbx
jmp 0x1404ab1a9
jne 0x1404ab1c8
lea rbx, [0x1400d25f0]
movsxd rcx, ecx
mov qword [rdi + 0x48], rbx
jmp 0x1404ab1c8
movsxd rdx, esi
movzx ecx, dx
mov rcx, rbx
mov byte [rdi + 0x54], 1
jmp 0x1404ab1da
call fcn.140251200
jmp 0x1404ab27f
test rbx, rbx
jne 0x1404ab200
lea rbx, [0x1400ced98]
stc
mov qword [rdi + 0x48], rbx
cmp r8d, 0x1b9114e9
sub r9d, r9d
test esi, esi
jmp 0x1404ab20a
jle 0x1404ab271
cmp byte [rbx], 0
je 0x1404ab271
mov rax, qword [rdi + 8]
rcl dl, cl
movzx edx, byte [rbx]
shr rcx, 0x2a
mov rcx, qword [rax]
movzx r8d, dx
mov rax, qword [rcx]
rol r8b, 0xd7
lea rcx, [rbx + 1]
ror r8w, 0x9f
xor r8b, r12b
movzx r8d, word [rax + rdx*2]
clc
and r8d, 0x8000
cmove rcx, rbx
inc bl
not bh
movzx bx, r8b
inc r9d
cmc
lea rbx, [rcx + 1]
stc
cmp r9d, esi
jmp 0x1404ab26b
jl 0x1404ab210
mov eax, r9d
shl ebx, 0x6d
movsx esi, r10w
sar rsi, 0x3b
mov dword [rdi + 0x50], eax
mov al, 1
movsx rdi, cx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
bt rdi, rbp
rcl di, 5
shrd di, bp, 0xc3
add rsp, 0x20
cmove di, bp
movsx edi, bx
pop rdi
jmp 0x1404ab2b0
ret