joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14042f6eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
movsx r15, di
neg r15w
sbb r15b, 0x89
push r14
ror r15, 0x17
rcl r15b, cl
push rsi
push rdi
movsx r15d, ax
push rbx
bswap r15d
movzx r15w, r14b
shr r15b, cl
sub rsp, 0x20
bswap r15w
movzx r15, bp
mov r15, rcx
jmp 0x14042f728
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
rcl bh, cl
stc
mov qword [rcx + 0x10], 0
movzx cx, ah
bts cx, r11w
bt ebx, ecx
mov rcx, qword [rdx + 8]
shl al, 0xb5
mov ebx, r9d
mov rax, qword [rdx]
ror rbx, 0x4b
bts ebx, r14d
mov rbx, rcx
sub rbx, rax
test r12w, bx
cmc
sub rcx, rax
jmp 0x14042f76d
je 0x14042f871
js 0x14042f8b2
mov r14, rdx
cmp r13b, r8b
test bl, sil
sar rbx, 6
cmp rcx, 0xfc1
jmp 0x14042f792
jb 0x14042f7bc
or rcx, 0x27
jmp 0x14042f7a1
call fcn.140442816
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
jmp 0x14042f7b3
mov qword [rdi - 8], rax
jmp 0x14042f7cf
call fcn.140442816
mov rdi, rax
xchg si, si
ror sil, 0x49
adc sil, 0xd8
mov qword [r15], rdi
shl sil, 0xc1
movsx rsi, si
xadd sil, sil
mov qword [r15 + 8], rdi
shl rbx, 6
shr sil, cl
bts esi, r15d
add rbx, rdi
mov qword [r15 + 0x10], rbx
movzx esi, r8w
movsx rsi, r14w
mov rbx, qword [r14]
movsx si, r9b
jmp 0x14042f809
mov rsi, qword [r14 + 8]
jmp 0x14042f812
jmp 0x14042f829
add rdi, 0x40
test dl, sil
cmp si, cx
add rbx, 0x40
test spl, r13b
cmc
cmp rbx, rsi
jmp 0x14042f831
je 0x14042f86a
mov qword [rdi + 0x38], 0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14042f817
mov rax, qword [rcx]
bswap dx
mov rdx, rdi
jmp 0x14042f85a
call qword [rax]
mov qword [rdi + 0x38], rax
jmp 0x14042f865
jmp 0x14042f817
mov qword [r15 + 8], rdi
shl ebx, 0x80
mov rax, r15
rcr bx, cl
xor bx, 0xc1e
add rsp, 0x20
xchg r14b, bl
cmovl r14d, esi
pop rbx
jmp 0x14042f890
pop rdi
movzx esi, r14w
pop rsi
mov r14d, esi
movzx r15w, dil
bswap r15
pop r14
movzx r15, r8w
mov r15b, 0xc2
jmp 0x14042f8af
pop r15
ret
call fcn.1403b61db
int3
Function at 0x14043eaf1
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14043eafa
movzx ecx, cx
jmp 0x14043eb02
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
stc
cmp eax, 0x100
mov al, 0x5f
setae al
jmp 0x14043eb1c
add rsp, 0x28
jmp 0x14043eb25
ret

Function at 0x14044028a
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
setp al
mov rcx, qword [rcx]
cmovg ax, sp
seta ah
movsx eax, r14w
mov rax, qword [rcx]
jmp 0x1404402a7
call qword [rax + 0x28]
test eax, eax
jmp 0x1404402b1
je 0x1404402e4
mov ecx, eax
dec r9d
btc r8d, r9d
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9d, 0x2a
cmp r12b, 0x45
add rsp, 0x28
jmp 0x1404402df
jmp fcn.1403a9fbd
nop
test bp, bx
jmp 0x1404402f1
add rsp, 0x28
ret

Function at 0x14044038c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
rcr al, cl
sbb al, 0xa8
push rdi
or si, 0x6849
bsr rsi, rbp
push rbp
bt si, di
xor sil, bpl
push rbx
shl si, 0xf9
sub rsp, 0x48
mov rax, r9
shl bl, 0xb
sub bl, r11b
mov rsi, rdx
mov rdx, rcx
sal bx, 0x1b
adc r9, 0x1c2e6cdf
mov ebx, dword [rsp + 0xa0]
or ecx, 0x6dae4131
and cl, r13b
mov qword [rsp + 0x40], 0
bsf r9w, r12w
mov rcx, qword [0x1400b9300]
movss xmm0, dword [r8]
shl r9w, 0x5d
sbb r9b, 0xef
adc r9b, r15b
movss xmm1, dword [r8 + 4]
mov r9, qword [rdx]
cmp ebx, 0xffffffff
jmp 0x14044040d
je 0x140440420
mov r8d, ebx
jmp 0x14044041b
jmp 0x14044046d
mov rdx, 0xffffffffffffffff
sar r8d, cl
xadd r8, r8
shrd r8, r14, 0xee
nop word [rax + rax]
test r10b, r13b
cmp eax, 0x74ef4471
sal r8, cl
lea r8, [rdx + 1]
stc
test bpl, 0x28
cmp word [rax + rdx*2 + 2], 0
movsx edx, r8w
movzx dx, bpl
mov rdx, r8
jmp 0x140440467
jne 0x140440447
mov ebp, dword [rsp + 0x98]
mov dx, bp
bswap dx
mov ebx, dword [rsp + 0x90]
cmovg dx, ax
movzx edi, cx
cqo
mov rdi, qword [rcx]
movzx edx, r15w
lea rdx, [rsp + 0x40]
jmp 0x14044049b
mov qword [rsp + 0x30], rdx
movzx dx, r13b
movsxd rdx, r14d
jmp 0x1404404ad
movss dword [rsp + 0x28], xmm1
movss dword [rsp + 0x20], xmm0
mov rdx, rax
jmp 0x1404404c1
call qword [rdi + 0x90]
test eax, eax
jmp 0x1404404ce
je 0x140440505
mov ecx, eax
movsx r8d, r11w
sete dl
movabs r8, 0xcafa59766d7f94e
mov dl, 3
setl r9b
movsx r9d, ax
movsx r9, r14w
mov r9d, 0x41
jmp 0x140440500
call fcn.1403a9fbd
mov rcx, qword [rsp + 0x40]
cqo
mov dl, bpl
bswap rdx
mov rax, qword [rcx]
cqo
jmp 0x140440520
mov edx, ebx
jmp 0x140440527
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
movsx rax, r13w
mov edx, 0x1c9d6c41
movsx dx, spl
mov rax, qword [rcx]
cmovns dx, r15w
mov edx, ebp
jmp 0x14044054c
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
bt ebx, 0xbc
and bx, bx
btr bp, ax
mov qword [rsi], rax
btc rbp, 0xbc
rol di, cl
mov rax, rsi
shld edi, ecx, 0xf4
add rsp, 0x48
bswap bp
pop rbx
not dil
pop rbp
movsx di, cl
mov si, r10w
pop rdi
mov sil, r13b
pop rsi
jmp 0x14044058f
ret
Function at 0x1404414af
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
sar r14b, 4
movsx r14d, r13w
movzx ax, r13b
push rsi
setp sil
push rdi
movzx edi, sp
movsx rdi, r12w
shld eax, ebp, 0x16
push rbp
sal bpl, cl
push rbx
sal bx, 1
sub rsp, 0x60
cdqe
movaps xmmword [rsp + 0x50], xmm6
mov r14, r9
cwde
cmovno eax, r15d
movzx rbp, bp
mov rbx, r8
mov rdi, rdx
cmovo esi, r9d
mov rsi, rcx
movsxd rax, ecx
not bpl
movss xmm6, dword [rsp + 0xb0]
cbw
movsx ebp, di
movzx ebp, byte [rsp + 0xb8]
cwd
movsxd rdx, edx
mov qword [rsp + 0x38], 0
mov rcx, qword [rcx + 8]
xchg dx, ax
movsx ax, r14b
cdqe
mov rax, qword [rcx]
movsx rdx, ax
lea rdx, [rsp + 0x38]
jmp 0x140441543
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
cdqe
xchg dl, cl
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
cmove edx, ebp
xchg edx, edx
lea rdx, [rsp + 0x30]
jmp 0x14044156a
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
rdtsc
jmp 0x14044157c
mov rdx, qword [rdi]
mov rax, qword [rcx]
movsx r8d, r15w
mov r8d, 1
jmp 0x140441591
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
movzx r8, cx
movsx rdx, bx
mov rax, qword [rcx]
cmovg r8w, dx
movsxd rdx, r11d
mov rdx, rdi
movsx r8d, r13w
mov r8w, 0x1ab1
cmovle r8w, di
mov r8d, ebx
jmp 0x1404415c5
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
not dh
movzx edx, bpl
movsx ax, r9b
movsx eax, sp
movsx rax, r14w
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
cbw
cdqe
mov rax, qword [rcx]
jmp 0x1404415f6
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
movups xmm0, xmmword [r14]
mov dl, 0xf8
rdtsc
movaps xmmword [rsp + 0x40], xmm0
movsx edx, sp
movsx rax, bx
cdq
mov rax, qword [rcx]
cqo
lea rdx, [rsp + 0x40]
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
movzx rax, dx
mov r8, qword [rsi + 0x20]
rdtsc
mov rdx, qword [rsp + 0x38]
movzx rax, r11w
movsxd rax, r13d
jmp 0x14044163e
mov rax, qword [rcx]
jmp 0x140441646
mov qword [rsp + 0x20], 0
jmp 0x140441654
movaps xmm3, xmm6
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
xchg al, al
mov rax, qword [rcx]
jmp 0x140441677
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
mov sil, 0xdc
movsx edi, r12w
pop rbx
movsx di, dil
mov r14, 0x28b7011a
movsxd r14, eax
pop rbp
jmp 0x1404416a4
pop rdi
not r14b
cmovp r14d, edi
mov r14, r11
pop rsi
movsx r14d, r11w
pop r14
ret
Function at 0x140443298
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
xchg r8, r8
adc ah, 0x6d
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jmp 0x1404432b6
jne 0x1404433d9
movsxd rcx, dword [0x14000003c]
bt edx, 0x21
btc edx, r15d
lea rdx, [0x140000000]
cmp rcx, rbp
add rcx, rdx
cmp dword [rcx], 0x4550
jmp 0x1404432e3
jne 0x1404433d9
mov eax, 0x20b
clc
stc
cmp word [rcx + 0x18], ax
jmp 0x1404432f9
jne 0x1404433d9
sub r8, rdx
bswap ax
shl r9, cl
movzx edx, word [rcx + 0x14]
sar r9b, cl
and r9w, 0x5680
add rdx, 0x18
cmp spl, 0xb0
stc
cmc
lea rdx, [rdx + rcx]
movzx eax, word [rcx + 6]
not r9
lea rcx, [rax + rax*4]
movzx r9, ax
or r9d, 0x697f4a19
sub r9b, bl
lea r9, [rdx + rcx*8]
stc
jmp 0x140443346
mov qword [rsp], rdx
stc
cmp rdx, r9
jmp 0x140443353
je 0x140443396
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x140443364
jb 0x140443388
mov eax, dword [rdx + 8]
cmp r15w, bp
add eax, ecx
test r9b, 0xb5
cmp cl, r12b
cmp r8, rax
jmp 0x140443382
jb 0x14044339d
add rdx, 0x28
jmp 0x140443391
jmp 0x140443346
sub edx, edx
test eax, 0x5192408e
test rdx, rdx
jmp 0x1404433a5
jne 0x1404433b7
sub al, al
jmp 0x1404433b2
jmp 0x1404433e6
cmp dword [rdx + 0x24], 0
jge 0x1404433cd
xor al, al
jmp 0x1404433c8
jmp 0x1404433e6
mov al, 1
jmp 0x1404433d4
jmp 0x1404433e6
sub al, al
jmp 0x1404433e6
add rsp, 0x18
ret

Function at 0x140443a5e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x140443a6e
mov qword [rsp + 0x10], rsi
sbb si, r9w
shr sil, cl
and si, r12w
push rdi
sub rsp, 0x20
rcr sil, cl
dec si
mov rsi, rcx
movsxd rdi, r12d
and dil, 0xdf
mov rdi, rdx
clc
cmp edi, 0x55e62174
mov rcx, qword [rcx]
cmp r12b, r12b
cmp rcx, rdx
je 0x140443b46
test rcx, rcx
jmp 0x140443ab4
je 0x140443abf
call fcn.1401eb7e8
and qword [rsi], 0
jmp 0x140443ac9
test rdi, rdi
jmp 0x140443ad1
je 0x140443b46
cmp byte [rdi], 0
mov rbx, rdi
je 0x140443af9
inc rbx
jmp 0x140443aeb
cmp byte [rbx], 0
jmp 0x140443af3
jne 0x140443ae3
sub rbx, rdi
not cx
movsxd rcx, eax
lea rcx, [rbx + 1]
jmp 0x140443b0b
call fcn.1401810f0
mov qword [rsi], rax
cmp bp, 0x4461
clc
cmc
test rax, rax
jmp 0x140443b22
je 0x140443b46
lea r8, [rbx + 1]
cdq
movzx rdx, r8w
mov rdx, rdi
movzx cx, sil
mov rcx, rax
jmp 0x140443b41
call fcn.14049decb
mov rbx, qword [rsp + 0x30]
mov rax, rsi
inc dil
xor sil, 0x41
mov rsi, qword [rsp + 0x38]
movzx rdi, ax
add rsp, 0x20
mov dil, 0x8d
movsxd rdi, edi
movzx di, dl
pop rdi
jmp 0x140443b72
ret
Function at 0x1404535b2
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
bswap eax
test al, 0x8e
mov qword [rsp + 0x18], rsi
or sil, 0x24
cdqe
push rdi
bts si, ax
ror dil, cl
sub rsp, 0x60
mov al, 0xb0
mov sil, r13b
jmp 0x1404535dc
mov rax, qword [0x1400b7288]
bts rdi, r10
bsf ebx, esi
xor rax, rsp
movsx esi, r13w
xchg bl, dil
mov qword [rsp + 0x50], rax
mov rdi, r8
movsx ebx, bp
mov esi, edx
mov bl, sil
seta bl
movzx rbx, di
mov rbx, rcx
jmp 0x140453613
mov qword [rsp + 0x20], rcx
jmp 0x14045361d
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
jmp 0x14045362a
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
clc
or r8, 0xffffffffffffffff
inc r8
cmc
cmp byte [r9 + r8], 0
jne 0x140453638
mov rdx, r9
mov rcx, 0x3e6b6d48
lea rcx, [rsp + 0x30]
jmp 0x14045365b
call fcn.140451e59
nop
jmp 0x140453666
mov dword [rsp + 0x20], esi
jmp 0x14045366f
mov qword [rsp + 0x28], rdi
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x14045367e
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x30]
movzx cx, r11b
lea rdx, [rsp + 0x20]
movsx rcx, bp
movsx ecx, r9w
movzx ecx, sp
mov rcx, rbx
jmp 0x1404536a6
call fcn.14045327a
nop
movsx edx, r13w
setns dl
add rdx, r11
mov rdx, qword [rsp + 0x48]
jmp 0x1404536c3
cmp rdx, 0x10
jmp 0x1404536cc
jb 0x140453727
inc rdx
sbb al, sil
bts cx, r8w
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp dil, 0xcc
cmp rdx, 0x1000
jmp 0x1404536f5
jb 0x140453722
add rdx, 0x27
cmc
mov rcx, qword [rcx - 8]
jmp 0x140453709
sub rax, rcx
jmp 0x140453711
add rax, 0xfffffffffffffff8
test dl, 0xb1
cmp rax, 0x1f
ja 0x14045378c
call fcn.1401216d4
lea rax, [0x1400c02f0]
test r12b, 0x62
mov qword [rbx], rax
mov rax, rbx
and cl, 0x7b
not ecx
xor ch, 0x81
mov rcx, qword [rsp + 0x50]
stc
cmp bx, 0x2e42
test r14d, 0x16ac6cb8
xor rcx, rsp
jmp 0x14045375a
call fcn.14049a18d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov dil, spl
movzx esi, si
setle dil
mov rsi, qword [r11 + 0x20]
setl dil
movsx rdi, r13w
movsx edi, r12w
mov rsp, r11
pop rdi
jmp 0x14045378b
ret
call fcn.1404b0b96
int3

Function at 0x140454d90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movzx ecx, r9w
lea rcx, [rsp + 0x30]
jmp 0x140454da2
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
clc
add rsp, 0x28
ret
Function at 0x140454e5f
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
shl ah, cl
sub rsp, 0x20
mov rax, qword [0x1400b7288]
xadd bl, bl
shrd bx, r9w, 0xdd
movzx bx, r9b
movabs rbx, 0x2b992ddfa232
jmp 0x140454e92
cmp rax, rbx
jmp 0x140454e9a
jne 0x140454f5b
and qword [rbp + 0x18], 0
xchg rcx, rcx
mov cl, 0xb7
movzx ecx, r10w
lea rcx, [rbp + 0x18]
jmp 0x140454eb7
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140454ec6
mov qword [rbp + 0x10], rax
jmp 0x140454ecf
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x140454ef0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
bts ecx, ebx
lea rcx, [rbp + 0x10]
jmp 0x140454f05
shl rax, 0x20
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
rcl bp, cl
xor rax, rcx
shld cx, ax, 0x7a
movabs rcx, 0xffffffffffff
btr bp, 0xcd
bt bp, 0x93
and rax, rcx
test r10d, edx
bswap bp
movabs rcx, 0x2b992ddfa233
btr bp, cx
cmp rax, rbx
cmove rax, rcx
xor bl, 0xd
mov qword [0x1400b7288], rax
cmp r12, r11
mov rbx, qword [rsp + 0x48]
rcl bpl, 0xb4
or bp, bx
movsxd rbp, eax
not rax
sub bpl, 0xb0
btc bp, 0
sar bp, cl
mov qword [0x1400b7280], rax
add rsp, 0x20
bswap rbp
xchg ebp, ebp
pop rbp
jmp 0x140454f8f
ret

Function at 0x14045500f
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
sub ecx, ecx
jmp 0x14045501a
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14045509a
mov ecx, 0x5a4d
clc
test r9b, bl
cmp word [rax], cx
jmp 0x14045503a
jne 0x14045509a
movsxd rcx, dword [rax + 0x3c]
cmp bp, r10w
add rcx, rax
cmp ch, 0x16
cmc
cmp dword [rcx], 0x4550
jmp 0x14045505a
jne 0x14045509a
mov eax, 0x20b
cmp bx, 0x74b8
cmp word [rcx + 0x18], ax
jne 0x14045509a
cmp dword [rcx + 0x84], 0xe
jmp 0x140455080
jbe 0x14045509a
cmp dword [rcx + 0xf8], 0
mov al, r11b
not al
setne al
jmp 0x14045509d
xor al, al
cmc
add rsp, 0x28
jmp 0x1404550a6
ret
Function at 0x140466737
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test spl, 0x89
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xor bpl, bl
mov qword [rax + 0x18], rsi
rol sil, cl
jmp 0x140466755
mov qword [rax + 0x20], rdi
mov edi, 0x274d279d
and dil, 0x98
add di, r13w
push r14
btc bp, 0x68
sub rsp, 0x20
btc r14w, 0x8d
movsxd rdi, r12d
mov rdi, qword [rsp + 0x50]
rcr bpl, 0xc9
sar sil, 0x55
btc esi, r12d
mov r14, r9
inc bpl
cmovbe bp, dx
rcl bpl, cl
mov rsi, r8
movzx rbp, r14w
mov rbp, rdx
test rdi, rdi
jmp 0x1404667aa
je 0x14046689e
mov rbx, qword [r8 + 8]
stc
test rbx, rbx
jmp 0x1404667bd
je 0x140466881
mov rax, qword [rbx + 0x40]
rcr r8b, 0x6c
rcr r8b, cl
movzx r8d, word [r14]
test r15b, 0x27
jmp 0x1404667dc
cmp qword [rax], 0
je 0x140466834
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0
jmp 0x1404667f2
jle 0x140466834
dec dword [rax]
mov rdx, r9
movsx rcx, cx
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
mov rax, 0x4b3c0787
not ax
movsx eax, ax
lea rax, [rdx + 2]
jmp 0x14046681e
mov qword [rcx], rax
jmp 0x140466826
mov word [rdx], r8w
jmp 0x14046682f
jmp 0x140466865
mov rax, qword [rbx]
movsx edx, dx
not cx
cmovns dx, r15w
movzx edx, r8w
movzx rcx, sp
mov rcx, rbx
jmp 0x140466852
mov rax, qword [rax + 0x18]
jmp 0x14046685b
call qword [case.0x1404430d4.0]
movzx r8d, ax
mov eax, 0xffff
jmp 0x140466872
cmp ax, r8w
jmp 0x14046687b
jne 0x14046688b
mov byte [rsi], 1
test rcx, 0x5e946e3c
add r14, 2
sub rdi, 1
jmp 0x140466898
jne 0x1404667b5
movups xmm0, xmmword [rsi]
clc
rcr di, 0x9c
mov rbx, qword [rsp + 0x30]
inc ah
neg r14
movsx di, r13b
mov rax, rbp
sal sil, 0xf
sete dil
xor r14b, 0x52
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
adc r14b, cl
sbb r14, 0x187a6d7a
rcr r14b, cl
movdqu xmmword [rbp], xmm0
sbb bpl, r8b
mov rbp, qword [rsp + 0x38]
bsf r14, rdx
add rsp, 0x20
movsx r14, r14w
mov r14b, spl
movsx r14d, bp
pop r14
ret
Function at 0x1404668fe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
cmp r9, 0x59ed2724
mov qword [rax + 0x10], rbp
bsr bp, r10w
movsx rbp, r14w
cmc
mov qword [rax + 0x18], rsi
cmp al, r15b
rol ebp, cl
mov qword [rax + 0x20], rdi
shld rsi, rcx, 0x52
xor bpl, r12b
rcr dil, cl
push r14
movzx di, r8b
or dil, cl
sub rsp, 0x20
sbb dil, bl
movsxd rsi, r10d
mov rsi, qword [rsp + 0x50]
sbb r14b, 0xb7
movzx r14d, r9w
test r9b, 0x53
mov rdi, r8
mov rbp, rdx
cmp edi, 0x49d71af2
test rsi, rsi
jmp 0x14046696b
je 0x140466a32
mov rbx, qword [r8 + 8]
cmp r10w, dx
test rbx, rbx
jmp 0x140466981
je 0x140466a1d
mov rax, qword [rbx + 0x40]
jmp 0x140466994
cmp qword [rax], 0
jmp 0x14046699d
je 0x1404669eb
mov rax, qword [rbx + 0x58]
stc
cmp dword [rax], 0
jmp 0x1404669b0
jle 0x1404669eb
dec dword [rax]
bswap ax
rdtsc
mov rcx, qword [rbx + 0x40]
movsx ax, dh
xchg dx, ax
mov rdx, qword [rcx]
not al
cmovnp eax, edi
lea rax, [rdx + 2]
mov qword [rcx], rax
movsxd rax, r14d
movzx eax, r14w
jmp 0x1404669e2
mov word [rdx], r14w
jmp 0x140466a07
mov rax, qword [rbx]
movzx edx, r14w
bswap cx
mov rcx, rbx
mov rax, qword [rax + 0x18]
jmp 0x140466a01
call qword [case.0x1404430d4.0]
mov ecx, 0xffff
clc
test r9d, 0xaf243b8
cmp cx, ax
jne 0x140466a23
mov byte [rdi], 1
cmp rax, rax
sub rsi, 1
jmp 0x140466a2c
jne 0x140466979
movups xmm0, xmmword [rdi]
sal bh, cl
bsf si, r15w
mov rbx, qword [rsp + 0x30]
btc di, 0x90
mov rax, rbp
add di, 0x2bf6
mov si, sp
mov rsi, qword [rsp + 0x40]
add r14w, 0x7d18
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
add r14w, 0x3669
mov rbp, qword [rsp + 0x38]
rol r14b, 0
add rsp, 0x20
movsxd r14, esi
movsx r14d, r12w
movzx r14, bx
pop r14
jmp 0x140466a8b
ret
Function at 0x14046d981
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
test r9w, r13w
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
bts ebp, r8d
shld bp, sp, 0xe5
inc bpl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor si, 0x68f8
mov dil, r13b
adc bp, 0x87b
push r14
movzx bp, spl
sub rsp, 0x20
shl dil, cl
shld r14, rax, 0x3a
mov rsi, r9
movzx r14d, r8w
mov rdi, rdx
setno bpl
mov rbp, rcx
test r9, r9
je 0x14046daa7
mov rbx, qword [rdx + 8]
stc
test rbx, rbx
jmp 0x14046d9ec
je 0x14046da91
mov rax, qword [rbx + 0x40]
cmp spl, r8b
cmp qword [rax], 0
jmp 0x14046da02
je 0x14046da4f
mov rax, qword [rbx + 0x58]
test r11w, 0x29b
cmp dword [rax], 0
jle 0x14046da4f
dec dword [rax]
mov rcx, qword [rbx + 0x40]
cdq
mov rdx, qword [rcx]
not rax
movzx eax, r10w
setl al
lea rax, [rdx + 2]
jmp 0x14046da38
mov qword [rcx], rax
not al
movzx eax, r14w
mov word [rdx], r14w
jmp 0x14046da4a
jmp 0x14046da79
mov rax, qword [rbx]
mov dl, bpl
movsx cx, bpl
movzx edx, r14w
movzx rcx, r8w
not cl
movsxd rcx, r8d
mov rcx, rbx
jmp 0x14046da6f
mov rax, qword [rax + 0x18]
call qword [case.0x1404430d4.0]
mov ecx, 0xffff
jmp 0x14046da88
cmp cx, ax
jne 0x14046da98
mov byte [rdi], 1
cmp dh, ch
clc
cmc
sub rsi, 1
jmp 0x14046daa1
jne 0x14046d9e4
movups xmm0, xmmword [rdi]
cmc
sub si, 0x4fa8
mov rbx, qword [rsp + 0x30]
and rax, r14
mov rax, rbp
sub sil, 0xa7
cmp r13b, 0x77
mov rsi, qword [rsp + 0x40]
sbb dil, sil
movzx r14, r14w
xor edi, 0x59f558c1
mov rdi, qword [rsp + 0x48]
bt r14d, 0x2f
movdqu xmmword [rbp], xmm0
cmc
bt bp, dx
mov rbp, qword [rsp + 0x38]
rcr r14b, 0x25
ror r14b, 0xaa
shl r14, cl
add rsp, 0x20
jmp 0x14046db02
pop r14
jmp 0x14046db09
ret
Function at 0x14048c079
Capabilities:
Encrypt data using speck

Disassembly:
mov qword [rsp + 8], rbx
sub rbx, r10
mov qword [rsp + 0x10], rbp
cmp r12b, 0x5b
xor bh, bl
movsx cx, bpl
mov qword [rsp + 0x18], rsi
xchg cx, si
movsx ecx, dx
push rdi
sbb ch, al
setb ch
push r14
bts ecx, ebx
bswap bp
push r15
cmovno bx, r12w
sal cx, 0x21
rcl r15b, cl
sub rsp, 0x20
movzx r15, r15w
mov rsi, qword [rsp + 0x60]
setne cl
mov rbp, r8
movsx cx, dh
mov r14, rdx
cdq
movsx edx, si
not ch
mov rbx, r9
cqo
movsx r8d, r8w
mov rdx, rbp
movsx r15, r11w
mov rcx, r14
setae r8b
not r8
lea r15, [rsi + rsi]
mov r8, r15
jmp 0x14048c0fe
call fcn.14049decb
mov r10, qword [rsp + 0x68]
rol di, 0xf1
cmovge di, bx
lea rdi, [r15 + r14]
jmp 0x14048c11a
test r10, r10
jmp 0x14048c122
je 0x14048c13a
movzx eax, word [rsp + 0x70]
cwd
mov rcx, r10
cdq
rep stosw word [rdi], ax
movsx r8d, r15w
sub rbx, rsi
rol al, 0xe2
bt cx, 0xc0
bsf dx, bp
lea rax, [rsi + r10]
test r12w, r15w
lea rdx, [r15 + rbp]
inc r8b
lea rcx, [r14 + rax*2]
movzx r8, si
shrd r14w, di, 0xe1
lea r8, [rbx*2 + 2]
not ebx
mov rbx, qword [rsp + 0x40]
sar dil, 0xd4
btr esi, 0x5d
xor r15b, dl
mov rbp, qword [rsp + 0x48]
xor sil, r12b
bsf esi, r13d
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
mov r14d, 0x3e514375
jmp 0x14048c1a4
pop r15
pop r14
mov di, r12w
pop rdi
jmp 0x14048c1b2
jmp fcn.14049decb
Function at 0x14049ab0f
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x14049ab1d
call fcn.1404a4fee
mov r9d, 2
xchg r8w, cx
movsx dx, dil
movzx rdx, r13w
lea r8, [rsp + 0x30]
cwd
movzx rdx, si
setge cl
mov rcx, qword [rax + 0x28]
movsx edx, r14w
cmovle edx, ebx
setge dh
lea edx, [r9 + 0x20]
jmp 0x14049ab5a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
test r11w, 0x3e11
clc
sub ecx, 0x30
jmp 0x14049ab74
je 0x14049abb6
sub ecx, 1
jmp 0x14049ab82
je 0x14049aba7
cmp ecx, 1
je 0x14049ab9d
xor eax, eax
jmp 0x14049ab98
jmp 0x14049abbb
mov eax, 3
jmp 0x14049abbb
mov eax, 1
jmp 0x14049abb1
jmp 0x14049abbb
mov eax, 2
add rsp, 0x28
jmp 0x14049abc4
ret

Function at 0x14049c4f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
stc
clc
mov qword [rsp + 0x18], rbp
clc
stc
push rsi
bts esi, edx
or sil, 0x9e
sub esi, 0x57532f54
push rdi
adc dil, 0xfc
ror si, cl
sub di, r9w
push r12
push r14
shl r14w, 0x6b
movzx rdi, dx
movzx r14d, cx
push r15
adc r15d, 0x708d270b
inc edi
not rsi
sub rsp, 0x20
mov r14b, r8b
seto r15b
not sil
mov esi, dword [r8 + 0xc]
movsx r15, r10w
movsx r14d, r12w
mov r12, rcx
jmp 0x14049c55e
mov rcx, r8
setle r15b
bswap r14w
mov rdi, r9
mov r14, r8
mov r15, rdx
jmp 0x14049c577
call fcn.1401d51c8
mov r10, qword [r12]
neg bp
sbb bp, 0x541
bts rbp, rbp
mov ebp, eax
test r11w, sp
cmp r12d, 0x5f356149
test dx, 0x694d
mov qword [rdi], r10
clc
test dl, 0x7a
test esi, esi
je 0x14049c6a0
movsxd rax, dword [r14 + 0x10]
cmp cl, r15b
lea ecx, [rsi - 1]
xor si, ax
mov esi, ecx
bts ebx, edx
lea rcx, [rcx + rcx*4]
sar bl, cl
movsx ebx, r12w
lea rbx, [rax + rcx*4]
clc
add rbx, qword [r15 + 8]
cmp rsi, rax
cmp ebp, dword [rbx + 4]
jle 0x14049c5a5
cmp ebp, dword [rbx + 8]
jmp 0x14049c5e6
jg 0x14049c5a5
mov rcx, qword [r15]
lea rdx, [rsp + 0x50]
jmp 0x14049c5f9
sub r8d, r8d
jmp 0x14049c601
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
rcl r10b, cl
xor ecx, ecx
add r8, qword [rsp + 0x50]
mov r9d, dword [rbx + 0xc]
mov r10d, dword [rax]
cmc
stc
test r9d, r9d
jmp 0x14049c626
je 0x14049c662
lea rdx, [r8 + 0xc]
btr ax, 0x84
adc rax, r11
mov ah, 0xb8
movsxd rax, dword [rdx]
test bx, 0x7ce5
cmp rax, r10
je 0x14049c662
inc ecx
clc
add rdx, 0x14
cmc
cmp ecx, r9d
jmp 0x14049c65c
jb 0x14049c63b
cmp ecx, r9d
jae 0x14049c5a5
mov rax, qword [r12]
movzx rbp, dx
not r15b
sal r12b, cl
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
shl r15b, cl
shl r14b, 0xbd
bsr ebp, r9d
mov rcx, qword [rcx + rax]
xchg r15w, ax
btc r12w, ax
mov qword [rdi], rcx
rol sil, 0xe
mov rbx, qword [rsp + 0x58]
and r14w, r9w
mov rax, rdi
or r14w, r8w
mov rbp, qword [rsp + 0x60]
btr si, 0x4a
rcl r15w, cl
add rsp, 0x20
movzx r14w, r11b
movsx rsi, di
movsx r12w, r8b
pop r15
mov r12b, bpl
movzx r14, r14w
pop r14
pop r12
movsx di, dl
mov si, 0x149e
not edi
pop rdi
movsxd rsi, edi
movsx si, r13b
pop rsi
ret