joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140428cdd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
add r15b, 0x66
rcl r15w, 0x5f
push r14
jmp 0x140428cf7
push r12
and r12b, 0x56
sal r15d, 0xe4
push rsi
movsx r12, si
not r15b
push rdi
sar r14w, 8
push rbp
adc r14w, r13w
xor r14w, r10w
push rbx
jmp 0x140428d1e
sub rsp, 0x20
inc bpl
shld r12w, si, 0x8a
mov r12, r8
movzx ebp, r13w
xchg r15b, r14b
mov edi, edx
mov rbx, rcx
lea r14, [rcx + 0x38]
adc r15, 0x45ca77ee
movzx r15d, r14w
setb bpl
lea r15, [rcx + 0x39]
mov ebp, 0x80
stc
sub esi, esi
jmp 0x140428d5e
jmp 0x140428d9d
lea rcx, [rax + 1]
jmp 0x140428d6c
mov qword [rbx + 0xc0], rcx
jmp 0x140428d78
movzx eax, byte [rax]
jmp 0x140428d80
mov byte [r12 + rsi], al
jmp 0x140428d89
inc rsi
shr ebp, 1
cmc
test r11b, 0x66
cmp rsi, 4
je 0x140428ef2
test ebp, edi
jmp 0x140428da4
je 0x140428d89
cmp qword [rbx + 0x10], 0
jmp 0x140428db4
je 0x140428de2
mov rcx, qword [rbx + 0x28]
jmp 0x140428dc3
call qword [rbx + 0x20]
test eax, eax
jmp 0x140428dcd
je 0x140428e89
cmp dword [rbx + 0x30], 0
jmp 0x140428ddc
je 0x140428ee8
mov rax, qword [rbx + 0xc0]
or cl, 0xb8
mov rcx, qword [rbx + 0xc8]
stc
cmp r14b, 0xa
cmc
cmp rax, rcx
jmp 0x140428e01
jae 0x140428ee8
cmp rax, rcx
jb 0x140428d63
cmp dword [rbx + 0x30], 0
jmp 0x140428e19
je 0x140428eab
mov r8d, dword [rbx + 0x34]
sete ch
cqo
cwd
mov rcx, qword [rbx + 0x28]
movzx rdx, r9w
mov dh, 0xf5
bswap dx
mov rdx, r14
jmp 0x140428e40
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
cmc
cmp ch, 0x92
test r12w, 0x221f
sub ecx, dword [rbx + 0xd0]
clc
add dword [rbx + 0xb8], ecx
stc
test eax, eax
je 0x140428eb2
movsxd rcx, eax
cmovns ax, r9w
sal rax, cl
add rcx, r14
movzx rax, bx
cdqe
seto ah
movzx eax, byte [r14]
jmp 0x140428ed0
mov rax, qword [rbx + 0xc0]
bsf ecx, ebx
ror ch, 0x82
mov rcx, qword [rbx + 0xc8]
cmp rax, rcx
jae 0x140428e10
jmp 0x140428d63
sub eax, eax
jmp 0x140428d80
mov dword [rbx + 0x30], 0
rcl rcx, cl
sar rcx, cl
mov byte [rbx + 0x38], 0
xor eax, eax
not cx
mov rcx, r15
jmp 0x140428ed0
mov qword [rbx + 0xc8], rcx
mov qword [rbx + 0xc0], r15
jmp 0x140428ee3
jmp 0x140428d80
xor r12d, r12d
sal rsi, cl
btr eax, 0x74
mov rax, r12
rol bpl, cl
add rsp, 0x20
pop rbx
xchg r12d, r12d
bswap di
pop rbp
movsxd r14, esi
movsx rsi, bp
pop rdi
movsxd r15, r10d
setne r14b
pop rsi
setne r15b
cmovno r15, r12
not r15w
pop r12
movzx r14, r8w
movzx r15w, r11b
pop r14
sets r15b
not r15b
movzx r15, cx
pop r15
jmp 0x140428f3f
ret
Function at 0x14042b0d8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov ah, 0x27
nop
push rdi
dec ax
push rbx
sub rsp, 0x20
and si, 0x762c
rcl sil, cl
mov rsi, rcx
movzx eax, byte [rcx + 0x4828]
cmp al, 0xff
jmp 0x14042b100
je 0x14042b117
mov byte [rsi + 0x4828], 0xff
jmp 0x14042b112
jmp 0x14042b237
mov rbx, qword [rsi]
bts eax, r14d
mov rax, qword [rbx + 0xc0]
clc
cmp rax, qword [rbx + 0xc8]
jmp 0x14042b132
jae 0x14042b15f
lea rcx, [rax + 1]
jmp 0x14042b141
mov qword [rbx + 0xc0], rcx
movzx ecx, ax
mov cl, r10b
cmove rcx, r13
movzx ecx, byte [rax]
jmp 0x14042b15a
jmp 0x14042b224
cmp dword [rbx + 0x30], 0
jmp 0x14042b168
je 0x14042b1e1
mov r8d, dword [rbx + 0x34]
movsxd rdi, edi
lea rdi, [rbx + 0x38]
mov cl, r8b
cwd
mov rcx, qword [rbx + 0x28]
bswap dx
movsx edx, r11w
movzx edx, di
mov rdx, rdi
jmp 0x14042b194
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
test r9b, 0x6e
clc
sub ecx, dword [rbx + 0xd0]
jmp 0x14042b1ad
add dword [rbx + 0xb8], ecx
clc
test spl, 0x9f
test eax, eax
jmp 0x14042b1bf
je 0x14042b1ed
cdqe
ror ch, cl
add rax, rdi
movsx ecx, sp
setle cl
not ecx
movzx ecx, byte [rdi]
jmp 0x14042b1dc
jmp 0x14042b200
mov al, 0xff
jmp 0x14042b1e8
jmp 0x14042b237
mov dword [rbx + 0x30], 0
lea rax, [rbx + 0x39]
clc
stc
mov byte [rbx + 0x38], 0
xor ecx, ecx
mov qword [rbx + 0xc8], rax
adc al, ah
bsf ax, r9w
lea rax, [rbx + 0x39]
test r9, rsi
jmp 0x14042b21b
mov qword [rbx + 0xc0], rax
xor al, 0x54
mov al, 0xff
test bpl, r9b
cmp cl, 0xff
jmp 0x14042b231
je 0x14042b27c
add rsp, 0x20
cmovne ebx, eax
pop rbx
jmp 0x14042b24b
pop rdi
pop rsi
jmp 0x14042b252
ret
lea rcx, [rax + 1]
cmc
clc
cmp dil, r14b
mov qword [rbx + 0xc0], rcx
test ebp, ecx
cmp dl, spl
movzx eax, byte [rax]
clc
test r15b, r14b
cmp al, 0xff
jmp 0x14042b276
jne 0x14042b237
mov rbx, qword [rsi]
ror rax, 0xb0
bsr eax, r14d
btc ax, sp
mov rax, qword [rbx + 0xc0]
jmp 0x14042b29a
cmp rax, qword [rbx + 0xc8]
jmp 0x14042b2a6
jb 0x14042b253
cmp dword [rbx + 0x30], 0
je 0x14042b36d
mov r8d, dword [rbx + 0x34]
movzx rcx, r9w
movsxd rdx, r11d
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
movzx rdx, r8w
mov rdx, rdi
jmp 0x14042b2d5
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xd0]
stc
cmp ecx, 0x5a9017b1
jmp 0x14042b2f0
add dword [rbx + 0xb8], ecx
clc
test eax, eax
jmp 0x14042b2fe
je 0x14042b328
movsxd rcx, eax
adc al, r13b
or ax, r8w
add rcx, rdi
movzx eax, r11w
movsx rax, r12w
cbw
movzx eax, byte [rdi]
jmp 0x14042b323
jmp 0x14042b33e
mov dword [rbx + 0x30], 0
bts ecx, r13d
lea rcx, [rbx + 0x39]
mov byte [rbx + 0x38], 0
cmc
sub eax, eax
mov qword [rbx + 0xc8], rcx
rcr cx, 0x68
sar cx, 0xa9
lea rcx, [rbx + 0x39]
test sp, 0x73fb
mov qword [rbx + 0xc0], rcx
cmp r12d, r10d
cmp al, 0xff
je 0x14042b27c
jmp 0x14042b237
xor eax, eax
jmp 0x14042b237
Function at 0x14043212a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
rcr dil, 0x12
push rbx
rol sil, cl
sub rsp, 0x28
mov rsi, rcx
btr rdi, 0x7d
mov rdi, qword [rcx + 0x28]
cmc
jmp 0x14043214e
test rdi, rdi
jmp 0x140432156
je 0x140432247
lea r14, [rsi + 0x28]
rcl bh, 0x95
sar bx, cl
mov rbx, qword [rsi + 0x30]
cmp rdi, rbx
jmp 0x140432172
jne 0x14043218f
jmp 0x1404321d2
add rdi, 0x40
cmp rdi, rbx
jmp 0x140432189
je 0x1404321cc
mov rcx, qword [rdi + 0x38]
jmp 0x140432199
test rcx, rcx
jmp 0x1404321a1
je 0x14043217d
cmp rdi, rcx
not dl
setne dl
mov rax, qword [rcx]
jmp 0x1404321b7
call qword [rax + 0x20]
mov qword [rdi + 0x38], 0
jmp 0x1404321c7
jmp 0x14043217d
mov rdi, qword [r14]
xor dx, di
mov rdx, qword [rsi + 0x38]
clc
sub rdx, rdi
cmc
clc
test sil, 0x98
cmp rdx, 0x1000
jmp 0x1404321ec
jb 0x14043221d
mov rax, qword [rdi - 8]
cmc
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jmp 0x140432207
jae 0x1404322a4
or rdx, 0x27
mov rdi, rax
movzx ecx, ax
movsxd rcx, r8d
mov cl, r11b
mov rcx, rdi
jmp 0x140432225
call fcn.140237311
xorps xmm0, xmm0
movups xmmword [r14], xmm0
test bp, 0x1555
shr cx, cl
not rcx
mov qword [r14 + 0x10], 0
sbb ch, 0x9c
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jmp 0x140432253
je 0x140432275
mov rax, qword [rcx]
jmp 0x140432261
call qword [rax + 0x10]
mov qword [rsi + 0x10], 0
bsf di, dx
ror r14w, 0x35
add rsp, 0x28
cmovs r14w, di
pop rbx
movzx r14d, r15w
mov di, 0x574c
movsxd rsi, r15d
pop rdi
movzx si, bpl
pop rsi
movsx r14, r11w
movzx r14, cx
mov r14b, 0xfa
pop r14
jmp 0x1404322a3
ret
call fcn.1404b3352
int3
Function at 0x14044129d
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x1404412a6
movzx ecx, cx
jmp 0x1404412ae
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
jmp 0x1404412c1
setae al
test r8w, bp
cmp r14b, r14b
clc
add rsp, 0x28
jmp 0x1404412d5
ret

Function at 0x1404429a7
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx ax, r8b
mov rax, qword [rcx]
jmp 0x1404429bb
call qword [rax + 0x28]
test eax, eax
jmp 0x1404429c5
je 0x140442a06
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
ror dl, 0xa2
not dl
setb r9b
mov dl, 3
bsr r9d, eax
rcl r9b, cl
mov r9d, 0x2a
jmp 0x1404429f8
add rsp, 0x28
jmp 0x140442a01
jmp fcn.1403ac523
nop
add rsp, 0x28
ret
Function at 0x140444510
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
push r15
cdqe
and ax, 0x646f
push r14
bts ax, r15w
xor ax, r10w
sbb al, 0x7e
push rsi
jmp 0x14044452f
push rdi
bsr si, sp
push rbp
btr ax, r9w
rcl r15d, 0xfa
push rbx
sub rsp, 0x88
mov r15w, 0x2b00
movaps xmmword [rsp + 0x70], xmm8
jmp 0x140444558
movaps xmmword [rsp + 0x60], xmm7
movzx ebx, di
movaps xmmword [rsp + 0x50], xmm6
cbw
cmove rbp, r12
setle dil
mov r14, r8
movsxd rsi, ebx
mov rbx, rdx
cqo
rdtsc
cbw
mov r15, rcx
mov si, 0x50c0
cwd
mov rsi, qword [rsp + 0xe0]
rdtsc
not dil
mov al, 0xf5
mov ebp, dword [rsp + 0xf0]
cwd
mov edx, dword [rsp + 0xe8]
mov rdi, qword [r9]
cwde
cbw
xchg al, ah
mov rax, qword [rdi]
movsx ecx, r8w
mov rcx, 0x73da0c63
mov rcx, rdi
call qword [rax + 0x18]
mov rax, qword [rdi]
mov rcx, rdi
movsxd rdx, edi
movzx dx, r10b
cmovb edx, r13d
mov edx, ebp
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
mov rax, 0x73906357
movsx rax, cx
movups xmm0, xmmword [r14]
lahf
movsxd rdx, r14d
movaps xmmword [rsp + 0x40], xmm0
cbw
mov r14d, 0x50ed7159
cqo
mov rax, qword [rcx]
movzx r14w, r8b
lea r14, [rsp + 0x40]
not rdx
mov rdx, r14
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x14044461e
movaps xmm0, xmm7
call fcn.1404b56dc
movaps xmm8, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404b56dc
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
jmp 0x140444656
movaps xmm0, xmm7
call fcn.1404b56dc
movaps xmm6, xmm0
jmp 0x140444666
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140444672
call fcn.1404b56dc
movss dword [rbx + 8], xmm6
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
not ah
mov rcx, qword [r15 + 0x18]
setns ah
movsx ax, r15b
mov rax, qword [r15 + 0x20]
jmp 0x14044469b
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
sub r8d, r8d
nop
cmp word [rsi + r8*2], 0
jmp 0x1404446b3
lea r8, [r8 + 1]
jmp 0x1404446bc
jne 0x1404446a8
dec r8d
mov r9b, bpl
mov rbp, qword [rcx]
mov dh, 5
mov qword [rsp + 0x28], rax
movzx r9, r15w
mov qword [rsp + 0x20], r14
jmp 0x1404446e1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 2
not dl
mov rdx, rsi
movzx r9, r13w
mov r9, rdi
jmp 0x140444702
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
xchg r14d, ebp
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0x88
bswap r14
pop rbx
movsxd r15, r9d
bswap ebp
movzx si, r11b
pop rbp
movsx rdi, si
xchg sil, r15b
jmp 0x14044473d
pop rdi
movsx rsi, r15w
movzx r15w, dil
not sil
pop rsi
pop r14
pop r15
jmp 0x140444754
ret
Function at 0x1404457ce
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
clc
mov r8, rcx
cmp r15b, 0x2e
shr ah, cl
xor ah, cl
mov eax, 0x5a4d
test r8w, r10w
cmp word [0x140000000], ax
jmp 0x1404457f3
jne 0x14044592c
movsxd rcx, dword [0x14000003c]
movsx edx, bx
bsr dx, ax
lea rdx, [0x140000000]
jmp 0x140445816
lea rcx, [rcx + rdx]
cmc
cmp spl, r13b
cmp dword [rcx], 0x4550
jmp 0x140445829
jne 0x14044592c
mov eax, 0x20b
jmp 0x140445840
cmp word [rcx + 0x18], ax
jmp 0x140445849
jne 0x14044592c
sub r8, rdx
rol rdx, cl
movsx dx, spl
and r9b, 0xc6
movzx edx, word [rcx + 0x14]
btc r9, 0xed
add rdx, 0x18
btr ax, r9w
sal eax, 0x30
lea rdx, [rdx + rcx]
movsx ax, r13b
shrd rax, r10, 0xc1
lahf
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
bsf r9w, bx
movsxd r9, r15d
adc r9d, ebx
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp r10b, 0x5b
cmp rdx, r9
jmp 0x1404458a9
je 0x1404458f0
mov ecx, dword [rdx + 0xc]
cmp r13b, 0xf9
jmp 0x1404458bb
cmp r8, rcx
jb 0x1404458e2
mov eax, dword [rdx + 8]
add eax, ecx
cmp r14b, bl
jmp 0x1404458d4
cmp r8, rax
jmp 0x1404458dc
jb 0x1404458f5
add rdx, 0x28
jmp 0x1404458eb
jmp 0x140445899
xor edx, edx
test r8b, al
test rdx, rdx
jne 0x140445905
sub al, al
jmp 0x140445935
cmp dword [rdx + 0x24], 0
jmp 0x14044590e
jge 0x140445920
sub al, al
jmp 0x14044591b
jmp 0x140445935
mov al, 1
jmp 0x140445927
jmp 0x140445935
xor al, al
jmp 0x140445935
add rsp, 0x18
jmp 0x14044593e
ret
Function at 0x140456640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test r13b, sil
push rdi
clc
cmp sil, 0xae
cmp r15, r10
sub rsp, 0x20
jmp 0x14045665a
xorps xmm0, xmm0
sub eax, eax
movzx bx, sil
bswap ebx
movups xmmword [rcx], xmm0
cmovge ebx, r11d
not bl
mov rbx, rcx
movups xmmword [rcx + 0x10], xmm0
mov qword [rcx + 0x20], rax
jmp 0x14045667f
mov dword [rcx + 0x28], eax
jmp 0x140456687
call fcn.1404a7995
mov dword [rbx], eax
jmp 0x140456693
call fcn.1404a6d16
mov dword [rbx + 4], eax
call fcn.1404a794a
xor edi, edi
movsx rcx, sp
dec cx
mov rcx, qword [rax + 0x10]
sbb rax, 0x2eef1f7a
mov eax, edi
ror al, cl
xor al, 0xc1
test rcx, rcx
setae al
not al
sete al
test rcx, r11
jmp 0x1404566cd
mov dword [rbx + 8], eax
cmp r11b, al
test rcx, rcx
jmp 0x1404566db
je 0x140456777
call fcn.1404a7f59
mov r9, rax
bsf r10w, r8w
rcr r8w, 2
mov r8b, 0xf2
mov r8d, edi
movzx r10d, r9w
neg r10w
sub r10b, 0xce
mov r10d, edi
cmc
cmp dil, 0x85
cmp word [r9], di
jge 0x140456756
mov rdx, r10
movsxd rcx, r9d
not ah
movsx ax, r8b
mov eax, r8d
movzx ecx, r15w
shr rdx, 3
and eax, 7
bts ecx, r15d
jmp 0x14045673b
movzx ecx, byte [rdx + rbx + 0xc]
jmp 0x140456745
bts ecx, eax
jmp 0x14045674d
mov byte [rdx + rbx + 0xc], cl
jmp 0x140456756
inc r8d
jmp 0x14045675e
inc r10
add r9, 2
cmp r8d, 0x100
jmp 0x140456771
jl 0x14045670d
mov rax, rbx
mov rbx, qword [rsp + 0x30]
movzx rdi, ax
add rsp, 0x20
setb dil
pop rdi
jmp 0x140456791
ret

Function at 0x1404572fd
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
jmp 0x14045730b
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
test esi, edi
cmp rbx, r15
add rsp, 0x28
ret
Function at 0x1404573cc
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
bswap ebx
shl bx, cl
movsx rbx, r11w
push rbp
not bp
xor bpl, 0xf3
mov rbp, rsp
sub rsp, 0x20
xadd bh, bl
movzx bx, r14b
add bh, dh
mov rax, qword [0x1400b7288]
rcr bl, 0x2d
movzx bx, r9b
not bx
movabs rbx, 0x2b992ddfa232
jmp 0x140457414
cmp rax, rbx
jmp 0x14045741c
jne 0x140457507
and qword [rbp + 0x18], 0
seto ch
movsx rcx, r12w
lea rcx, [rbp + 0x18]
jmp 0x140457437
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140457446
mov qword [rbp + 0x10], rax
jmp 0x14045744f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
jmp 0x140457460
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
shrd ecx, r12d, 0xc4
lea rcx, [rbp + 0x20]
test r9b, r9b
xor qword [rbp + 0x10], rax
jmp 0x140457481
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
sub cx, 0x7fdc
shl cl, 0xb
shrd cx, r10w, 0xd7
lea rcx, [rbp + 0x10]
clc
shl rax, 0x20
xor rax, qword [rbp + 0x20]
test r9b, 0x39
cmc
xor rax, qword [rbp + 0x10]
xor bpl, 0x86
rcl bpl, cl
xor rax, rcx
btc ecx, ebp
movzx rcx, sp
sbb rcx, 0x206a30a8
movabs rcx, 0xffffffffffff
setne bpl
sal bpl, cl
cmp dil, r11b
and rax, rcx
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
setne bh
movsx bx, r15b
jmp 0x1404574f7
cmove rax, rcx
mov qword [0x1400b7288], rax
shrd rbp, r10, 0xe3
mov rbx, qword [rsp + 0x48]
sub rbp, 0x5ce84ca6
ror bpl, cl
setnp bpl
not rax
btr bp, 0xed
btr bp, di
btc bp, 0xcd
mov qword [0x1400b7280], rax
or bp, 0x324f
not bp
adc bpl, r10b
add rsp, 0x20
mov bpl, r13b
pop rbp
jmp 0x14045754a
ret
Function at 0x14045bfe3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14045bffa
mov qword [rax + 0x10], rbx
cmp r9w, dx
clc
mov qword [rax + 0x18], rbp
push rsi
xor bp, r10w
push rdi
push r12
test spl, 0x6b
push r14
shl bpl, 0xe4
add bpl, r10b
xchg bpl, bpl
push r15
bt bp, r8w
btr r15d, 0xf0
add r15w, 0x5c04
sub rsp, 0x40
add ebp, 0x4cb929e4
xchg r15b, r15b
bt r15w, sp
sub r12d, r12d
movsx bp, al
sal r15, cl
shrd r15w, r11w, 0x3c
mov r15, r8
bts bp, sp
mov ebp, 0xabe2d16
sar ebp, cl
mov qword [rax + 0x20], r12
stc
or rdi, 0xffffffffffffffff
setnp bpl
xchg bpl, bpl
movsx ebp, ax
mov rbp, rcx
inc rdi
cmp byte [rdi + rcx], r12b
jne 0x14045c077
add rdi, 1
mov bl, r12b
mov rbx, r12
movsx rsi, si
not r14w
mov rsi, rdi
not r14b
mov r14, rcx
jmp 0x14045c0a4
je 0x14045c106
lea r9, [rsp + 0x88]
movzx ecx, r13w
movsxd rcx, eax
mov qword [rsp + 0x20], r15
mov r8b, 0x4e
not dl
movsx dx, dl
mov r8, rsi
not dx
xchg dh, ch
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.140456888
test eax, eax
jmp 0x14045c0e3
jle 0x14045c106
cdqe
jmp 0x14045c0f0
inc rbx
stc
jmp 0x14045c0f9
lea r14, [r14 + rax]
sub rsi, rax
jne 0x14045c0aa
inc rbx
cqo
mov edx, 2
seto ch
jmp 0x14045c118
mov rcx, rbx
call fcn.14012a2c0
mov r14, rax
test rax, rax
jmp 0x14045c12b
je 0x14045c209
mov qword [rsp + 0x30], r12
mov rsi, rax
cmp al, 0xf0
cmc
test rbx, rbx
jmp 0x14045c144
je 0x14045c190
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
jmp 0x14045c162
call fcn.140456888
test eax, eax
jmp 0x14045c16e
jle 0x14045c190
cdqe
clc
test dl, r14b
add rsi, 2
add rbp, rax
sub rbx, 1
jmp 0x14045c18a
jne 0x14045c14a
lea r11, [rsp + 0x40]
mov bh, dh
movzx rbp, r8w
cdqe
mov word [rsi], r12w
movzx r12d, r15w
setle r15b
movsxd rbp, ebp
mov rbx, qword [r11 + 0x38]
bswap r12
not r12b
movzx si, bpl
mov rax, r14
movsx bp, r14b
movsx r15, sp
movsx r12d, bx
mov rbp, qword [r11 + 0x40]
movzx rsi, di
cmovp r15d, r14d
mov rsp, r11
movsx esi, bp
mov r15b, 0x89
pop r15
xchg rdi, r12
jmp 0x14045c1ef
pop r14
pop r12
movsx rdi, bp
pop rdi
movzx si, r9b
xchg esi, esi
bswap rsi
pop rsi
jmp 0x14045c208
ret
call fcn.140456010
int3
Function at 0x1404701bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
test r10b, 0x38
btr rbp, r10
mov qword [rax + 0x18], rsi
add rsi, rax
xor ebp, esi
mov qword [rax + 0x20], rdi
sub bpl, 0x5a
rol dil, 0xc8
clc
push r14
btc di, 0xc
bts rbp, rsp
sub rsp, 0x20
test r9w, 0x3001
mov rsi, r9
movzx r14d, r8w
xadd bpl, bpl
bsr edi, r8d
bt bp, 0x94
mov rdi, rdx
add bpl, cl
stc
mov rbp, rcx
test r9, r9
jmp 0x140470220
je 0x1404702f1
mov rbx, qword [rdx + 8]
cmp r13w, r10w
test rbx, rbx
je 0x1404702e3
mov rax, qword [rbx + 0x40]
cmc
test r14b, r13b
cmp qword [rax], 0
jmp 0x140470248
je 0x14047029f
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0
jmp 0x14047025a
jle 0x14047029f
dec dword [rax]
mov rcx, qword [rbx + 0x40]
mov dx, r10w
cdqe
mov rdx, qword [rcx]
movzx eax, r12w
movsx eax, r15w
lea rax, [rdx + 2]
mov qword [rcx], rax
cwde
mov ax, 0x32c0
jmp 0x140470288
movzx eax, r14w
jmp 0x140470291
mov word [rdx], r14w
jmp 0x14047029a
jmp 0x1404702d0
mov rax, qword [rbx]
cdq
movsx edx, r9w
mov dl, r10b
movzx edx, r14w
cmovs cx, r13w
seta cl
movsxd rcx, r13d
mov rcx, rbx
jmp 0x1404702c1
mov rax, qword [rax + 0x18]
jmp 0x1404702ca
call qword [0x1400b8d90]
mov ecx, 0xffff
cmp cx, ax
jmp 0x1404702dd
jne 0x1404702e7
mov byte [rdi], 1
cmc
sub rsi, 1
jne 0x14047022e
movups xmm0, xmmword [rdi]
test r15b, 0xd7
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
bswap r14w
xor di, 0x73c8
mov rdi, qword [rsp + 0x48]
sub r14b, 0x70
movdqu xmmword [rbp], xmm0
shrd ebp, r11d, 0xcd
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
not r14b
xchg r14b, r14b
movsx r14w, r13b
pop r14
ret
Function at 0x14048f254
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp al, dil
cmc
mov qword [rax + 8], rbx
bt rbx, 0xb7
test bpl, cl
mov qword [rax + 0x10], rbp
cmovnp bx, bx
sal ebx, cl
rol rbx, cl
mov qword [rax + 0x18], rsi
xor bh, 0xf4
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, r9
adc r14w, r10w
sbb bl, sil
shl r14b, cl
mov r14, r8
btr rbx, 0xba
mov rbx, rdx
and bp, 0x93a
xor bpl, r11b
mov rbp, rcx
clc
stc
jmp 0x14048f2af
cmp rdx, r8
jmp 0x14048f2b7
je 0x14048f393
mov rdi, qword [r9 + 8]
test al, r12b
cmc
test rdi, rdi
jmp 0x14048f2cd
je 0x14048f380
mov rax, qword [rdi + 0x40]
and r8b, dl
movzx r8d, word [rbx]
test r11b, 0x32
cmp rdx, 0x1a5d2136
cmp qword [rax], 0
jmp 0x14048f2f2
je 0x14048f33f
mov rax, qword [rdi + 0x58]
cmp rax, r10
test al, sil
cmp dword [rax], 0
jmp 0x14048f30a
jle 0x14048f33f
dec dword [rax]
mov rcx, qword [rdi + 0x40]
cbw
movzx ax, r13b
mov rdx, qword [rcx]
lea rax, [rdx + 2]
jmp 0x14048f329
mov qword [rcx], rax
jmp 0x14048f331
mov word [rdx], r8w
jmp 0x14048f33a
jmp 0x14048f370
mov rax, qword [rdi]
movzx edx, sp
movsxd rcx, r15d
movzx edx, r8w
mov cl, 0xe
xchg cx, cx
jmp 0x14048f356
mov rcx, rdi
mov rax, qword [rax + 0x18]
jmp 0x14048f362
call qword [0x1400b8d90]
movzx r8d, ax
cmp r13w, r10w
mov eax, 0xffff
cmc
cmp ax, r8w
jne 0x14048f386
mov byte [rsi], 1
test r11b, sil
add rbx, 2
cmp rbx, r14
jne 0x14048f2c5
movups xmm0, xmmword [rsi]
cmovg r14d, ebx
sub r14b, r14b
mov rbx, qword [rsp + 0x30]
sbb dil, 0x30
clc
mov rax, rbp
mov rsi, qword [rsp + 0x40]
sub rdi, 0x2d4449db
shr rdi, cl
mov rdi, qword [rsp + 0x48]
sal r14b, cl
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
movzx r14d, r14w
xchg r14d, r14d
not r14
pop r14
jmp 0x14048f3e0
ret
Function at 0x14049bcfa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r13b, 0x3d
mov qword [rax + 0x10], rbx
jmp 0x14049bd12
mov qword [rax + 0x18], rbp
rcl bpl, 0x40
shl bpl, cl
mov qword [rax + 0x20], rsi
movsx ebp, r14w
push rdi
push r14
rcr rbp, cl
push r15
sub rsp, 0x20
bts r15w, r12w
bsf ebp, edi
adc edi, 0xd4291d
test rdx, rdx
lea r14, [rax + 8]
movsx rsi, r15w
movsx r15w, bl
movzx r15d, bx
mov rbp, rcx
movzx rsi, r15w
mov sil, 0x88
mov rdi, rcx
movsx r15, r11w
movzx ecx, byte [rcx]
cmovne r14, rdx
movzx si, r8b
not r15b
mov r15, r9
mov esi, r8d
jmp 0x14049bd8c
inc rdi
not rcx
movzx ecx, byte [rdi]
jmp 0x14049bd8c
call fcn.1404b5217
test eax, eax
jmp 0x14049bd98
jne 0x14049bd7e
mov bl, byte [rdi]
cdqe
sub ax, r9w
bt eax, r14d
lea eax, [rbx - 0x2b]
test al, 0xfd
jmp 0x14049bdb4
je 0x14049bdc6
mov bl, 0x2b
jmp 0x14049bdc1
jmp 0x14049bdd1
inc rdi
mov r9b, spl
cwd
xchg r8b, dl
mov r9, r15
mov r8d, esi
cqo
movzx edx, r9w
mov rdx, r14
bswap cx
movzx cx, r14b
jmp 0x14049bded
mov rcx, rdi
jmp 0x14049bdf5
call fcn.14049bf20
mov ecx, eax
stc
cmp esp, 0x584622ac
rol esi, 0xd7
mov esi, 0x7fffffff
cmp rdi, qword [r14]
jne 0x14049be1c
mov qword [r14], rbp
jmp 0x14049be2a
cmp rbp, qword [r14]
jmp 0x14049be24
jne 0x14049be32
test ecx, ecx
jne 0x14049be67
cmp bl, 0x2b
jmp 0x14049be3a
jne 0x14049be48
cmp ecx, esi
ja 0x14049be67
cmp bl, 0x2d
jmp 0x14049be50
jne 0x14049beb7
cmp ecx, 0x80000000
jmp 0x14049be61
jbe 0x14049beb7
call fcn.1404b26aa
mov dword [rax], 0x22
clc
test dh, 0x19
test r15, r15
jmp 0x14049be7e
je 0x14049be8d
mov dword [r15], 1
cwde
nop
mov eax, 0x80000000
test r13, 0x304f3839
cmp bl, 0x2d
jmp 0x14049bea1
cmove esi, eax
bswap ax
cmove rax, r15
mov eax, esi
jmp 0x14049beb2
jmp 0x14049bedc
neg eax
rcr bp, 0x6f
cmp bl, 0x2d
bswap bx
cmove ecx, eax
bsr bx, r9w
bts rbp, r11
adc di, r9w
mov eax, ecx
neg r14b
bt bp, di
mov rbx, qword [rsp + 0x48]
bt r14w, 0xb1
xor r14b, 0xbf
shl r15b, cl
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
sete r14b
movzx r15, r12w
xchg dil, dil
pop r15
movsxd r14, ebx
cmovno di, r14w
pop r14
xchg dil, dil
movsxd rdi, edi
pop rdi
jmp 0x14049bf1f
ret

Function at 0x14049d545
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test bh, 0x61
and dword [rsp + 0x30], 0
call fcn.1404a794a
mov r9d, 2
movsx rdx, dx
movsx dx, r14b
lea r8, [rsp + 0x30]
mov cl, r8b
mov rcx, qword [rax + 0x28]
movsxd rdx, r13d
movsx rdx, dx
cwd
lea edx, [r9 + 0x20]
jmp 0x14049d583
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
clc
cmp bh, 0xd8
sub ecx, 0x30
je 0x14049d5dc
sub ecx, 1
jmp 0x14049d5a3
je 0x14049d5cd
cmp ecx, 1
jmp 0x14049d5b1
je 0x14049d5be
sub eax, eax
jmp 0x14049d5e1
mov eax, 3
jmp 0x14049d5c8
jmp 0x14049d5e1
mov eax, 1
jmp 0x14049d5d7
jmp 0x14049d5e1
mov eax, 2
add rsp, 0x28
jmp 0x14049d5ea
ret