joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403e7d96
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
stc
movzx r15, dx
jmp 0x1403e7dab
push r14
bts r15d, ecx
push r13
movsxd r13, eax
push r12
push rsi
push rdi
movzx r14, r15w
push rbp
bts r13w, r8w
sub r15, 0x247775ff
movzx r12, bx
push rbx
and r14d, r8d
dec r14b
sub rsp, 0x38
bts r12d, edi
movzx r14, ax
movaps xmmword [rsp + 0x20], xmm6
bts r12w, sp
mov r14, r9
or r12w, 0x3b6a
mov r15, r8
sal r13b, 0x76
inc r12b
mov r12, rdx
shrd bx, sp, 0x71
mov r13, rcx
adc bl, r14b
btc bx, 0x74
mov rbx, qword [rcx]
test rbx, rbx
jmp 0x1403e7e1d
je 0x1403e7f85
mov rdi, qword [r13 + 8]
clc
cmp r12w, 0x7ce3
cmp r12b, r11b
cmp rbx, rdi
jmp 0x1403e7e39
je 0x1403e7f2e
lea rbp, [0x1400bed10]
jmp 0x1403e7e4b
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e7e57
jmp 0x1403e7e8e
call fcn.14027afd4
movups xmmword [rbx + 0x20], xmm6
test r13w, 0x2af2
mov byte [rbx + 0x10], 0
jmp 0x1403e7e78
add rbx, 0x50
test r12, rdx
clc
cmp rbx, rdi
jmp 0x1403e7e88
je 0x1403e7f2a
mov qword [rbx], rbp
movsx rcx, r14w
movzx cx, cl
not ch
lea rcx, [rbx + 0x38]
jmp 0x1403e7ea4
call fcn.1403e5263
mov rax, qword [rbx + 0x28]
cmp r12b, r10b
clc
test r10w, di
cmp rax, 0x10
jmp 0x1403e7ebe
jb 0x1403e7e61
mov rcx, qword [rbx + 0x10]
shl dl, 0x34
lea rdx, [rax + 1]
clc
cmp al, 0xcb
jmp 0x1403e7ed7
cmp rdx, 0x1000
jb 0x1403e7e5c
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
test r13b, r11b
sub rcx, rsi
cmc
test r14b, 0xd7
cmp rcx, 0x20
jmp 0x1403e7f00
jae 0x1403e802f
add rax, 0x28
cwd
xchg cl, ch
movsx rcx, bp
mov rdx, rax
movsx ecx, r11w
movzx ecx, r8w
mov rcx, rsi
jmp 0x1403e7f25
jmp 0x1403e7e5c
mov rbx, qword [r13]
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
stc
cmp rdx, 0x1000
jmp 0x1403e7f42
jb 0x1403e7f78
mov rax, qword [rbx - 8]
clc
cmp r8b, 0x6c
add rbx, 0xfffffffffffffff8
cmc
test si, r15w
sub rbx, rax
test r8w, 0x52b6
cmp rbx, 0x20
jae 0x1403e802f
add rdx, 0x27
cmovo ebx, r14d
mov rbx, rax
mov rcx, rbx
jmp 0x1403e7f80
call fcn.14027afd4
mov qword [r13], r12
lea rax, [r15 + r15*4]
rol bx, 0xe5
rcl rbx, cl
shl rax, 4
lea rax, [rax + r12]
or sil, r8b
setle dil
cmc
mov qword [r13 + 8], rax
xor bh, 0x72
shld bx, r12w, 0x3f
lea rax, [r14 + r14*4]
setns r15b
movzx bx, r13b
movsx esi, r9w
shl rax, 4
cmp al, spl
movsx bp, r11b
stc
add rax, r12
stc
dec r12b
mov qword [r13 + 0x10], rax
cmc
shl bpl, cl
movaps xmm6, xmmword [rsp + 0x20]
btr ebx, r15d
dec bpl
sal bp, 0x79
add rsp, 0x38
pop rbx
jmp 0x1403e7ffc
pop rbp
mov dil, 0x4b
movsx r15, r10w
movsx r13w, cl
pop rdi
cmovb esi, eax
pop rsi
bswap r14w
pop r12
movsx r13d, r15w
movsxd r14, esi
pop r13
mov r15b, bpl
pop r14
jmp 0x1403e8027
pop r15
jmp 0x1403e802e
ret
call fcn.1404b6b57
int3
Function at 0x1403ea26b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
add ax, 0x2e1d
bsr ax, r14w
xadd rax, rax
push r14
setp r14b
push rsi
push rdi
push rbx
rcl r14w, 0x91
sub rsp, 0x20
not al
clc
sar r14b, cl
mov r14, rcx
mov eax, dword [rcx + 8]
cmp r13b, 0xa4
test al, 2
jmp 0x1403ea2a3
jne 0x1403ea2b5
sub esi, esi
jmp 0x1403ea2b0
jmp 0x1403ea357
mov rdi, qword [r14 + 0x10]
mov r15, qword [r14 + 0x18]
movzx si, cl
mov rsi, r15
jmp 0x1403ea2c9
sub rsi, rdi
jmp 0x1403ea2d1
sar rsi, 5
jmp 0x1403ea2da
cmp r15, rdi
jmp 0x1403ea2e2
je 0x1403ea357
mov rax, qword [rdi]
bswap cx
mov rcx, rdi
call qword [rax + 0x10]
or rax, 1
rcl bx, 0xd6
setb bl
stc
bsr rax, rax
lea rbx, [rax + rax*8]
rcl cl, 0x75
add rbx, 0x49
xadd eax, ecx
movzx eax, r11w
shr rbx, 6
not ch
mov rax, qword [rdi]
movsxd rcx, r11d
setno ch
mov rcx, rdi
jmp 0x1403ea32d
call qword [rax + 0x10]
lea rsi, [rsi + rax]
cmc
add rsi, rbx
jmp 0x1403ea33d
add rdi, 0x20
cmp rdi, r15
jne 0x1403ea2e8
mov eax, dword [r14 + 8]
cmp bpl, 0x91
jmp 0x1403ea357
test al, 4
jne 0x1403ea36c
mov rdi, rsi
jmp 0x1403ea367
jmp 0x1403ea432
mov rbx, qword [r14 + 0x28]
rol di, cl
dec r15b
rcr r15w, cl
mov r15, qword [r14 + 0x30]
movzx edi, r8w
bswap di
jmp 0x1403ea38a
mov rdi, r15
test sil, r9b
sub rdi, rbx
sar rdi, 5
lea rdi, [rdi + rsi]
test r10b, 0x77
test r14, r15
stc
cmp r15, rbx
jmp 0x1403ea3ab
je 0x1403ea432
nop dword [rax]
movsx rcx, r8w
mov rax, qword [rbx]
cmovae ecx, eax
movzx ecx, r8w
mov rcx, rbx
jmp 0x1403ea3cb
call qword [rax + 0x10]
or rax, 1
bsr rax, rax
lea rsi, [rax + rax*8]
cdqe
rol rcx, cl
movsx cx, r9b
add rsi, 0x49
shr rsi, 6
mov cx, di
setbe ah
mov rax, qword [rbx]
xchg rcx, rcx
mov rcx, rbx
jmp 0x1403ea400
call qword [rax + 0x10]
lea rdi, [rdi + rax]
cmp r14b, spl
add rdi, rsi
cmc
add rbx, 0x20
test r13w, r10w
cmp r8b, 0x8c
cmp rbx, r15
jmp 0x1403ea422
jne 0x1403ea3b9
mov eax, dword [r14 + 8]
cmp bx, 0x54b8
stc
test al, 8
jmp 0x1403ea439
je 0x1403ea517
mov rbx, qword [r14 + 0x40]
setg r15b
mov r14, qword [r14 + 0x48]
ror r15b, cl
adc r15, rbp
mov r15, r14
sub r15, rbx
cmp bl, r12b
test esp, 0x34647343
sar r15, 5
lea r15, [r15 + rdi]
test bx, 0x3e5b
cmp r14, rbx
jmp 0x1403ea475
je 0x1403ea514
nop word [rax + rax]
mov rax, qword [rbx]
movzx ecx, r10w
setp ch
mov rcx, rbx
jmp 0x1403ea496
call qword [rax + 0x10]
or rax, 1
test rbx, 0xe2e7b88
rcr ch, cl
sbb rcx, 0xbb03090
bsr rax, rax
inc cl
cmp r9b, bpl
sub rsi, rbx
lea rsi, [rax + rax*8]
add rsi, 0x49
shr rsi, 6
mov rax, qword [rbx]
movsxd rcx, edx
bswap ecx
movsx rcx, r11w
mov rcx, rbx
jmp 0x1403ea4d9
call qword [rax + 0x10]
mov rdi, rax
cmc
cmp ecx, r11d
lea rdi, [rdi + r15]
clc
sal r15, cl
lea rdi, [rdi + rsi]
test si, cx
xor r15b, al
sar r15w, 0xe6
add rbx, 0x20
mov r15, rdi
jmp 0x1403ea506
cmp rbx, r14
jne 0x1403ea484
jmp 0x1403ea517
mov rdi, r15
mov rax, rdi
bsr r15w, ax
add rsp, 0x20
pop rbx
movzx r14d, r14w
pop rdi
mov r14d, 0x9c53ff9
pop rsi
mov r15w, 0x5132
cmovo r15w, dx
pop r14
bswap r15
cmovp r15w, r10w
pop r15
jmp 0x1403ea54b
ret
Function at 0x1403f5243
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
movsx r15w, r9b
push r14
push r13
cmc
sbb r15d, 0x67e66541
push r12
cmp r12b, dil
xchg r13b, r15b
push rsi
movzx r15, bx
push rdi
bsr r14w, r8w
btc si, r8w
bswap r14w
push rbx
cmovl r14w, bx
sub rsp, 0x30
not r12w
movaps xmmword [rsp + 0x20], xmm6
sal r15b, cl
mov r15, r9
inc r12b
xor r14b, 0xf
btr r13, r8
mov r12, r8
mov r14, rdx
mov r13, rcx
movzx esi, cx
mov rsi, qword [rcx]
test rsi, rsi
je 0x1403f53d3
mov rbx, qword [r13 + 8]
jmp 0x1403f52bd
cmp rsi, rbx
jmp 0x1403f52c5
je 0x1403f537a
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f52d7
jmp 0x1403f52fd
call fcn.14027afd4
movups xmmword [rsi + 0x10], xmm6
cmp sil, r11b
mov byte [rsi], 0
add rsi, 0x20
cmp rsi, rbx
jmp 0x1403f52f7
je 0x1403f5372
mov rax, qword [rsi + 0x18]
test r12b, bl
cmp rax, 0x10
jmp 0x1403f530d
jb 0x1403f52e1
mov rcx, qword [rsi]
not dx
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403f5329
jb 0x1403f52dc
mov rdi, qword [rcx - 8]
cmp dh, 0x5a
add rcx, 0xfffffffffffffff8
jmp 0x1403f533f
sub rcx, rdi
test esp, r9d
cmp rcx, 0x20
jmp 0x1403f534e
jae 0x1403f545f
add rax, 0x28
xchg edx, edx
movzx rcx, si
mov rdx, rax
cmovne ecx, r13d
mov rcx, rdi
jmp 0x1403f536d
jmp 0x1403f52dc
mov rsi, qword [r13]
bt dx, sp
mov rdx, qword [r13 + 0x10]
cmc
sub rdx, rsi
cmp dl, 0x17
cmp rdx, 0x1000
jb 0x1403f53c6
mov rax, qword [rsi - 8]
stc
cmp rax, rdi
add rsi, 0xfffffffffffffff8
jmp 0x1403f53a3
sub rsi, rax
cmp r13, 0xed96eed
cmp rsi, 0x20
jmp 0x1403f53b6
jae 0x1403f545f
add rdx, 0x27
movsx ecx, ax
mov rsi, rax
mov rcx, rsi
jmp 0x1403f53ce
call fcn.14027afd4
mov qword [r13], r14
cmc
movsxd rsi, r11d
shl r12, 5
setl bl
sub di, 0x7325
add edi, 0x2e5e6bd0
lea r12, [r12 + r14]
mov qword [r13 + 8], r12
shr bh, cl
shl r15, 5
cmp bp, si
lea r15, [r15 + r14]
and bh, cl
mov qword [r13 + 0x10], r15
rcr r15b, 0x8e
sar bl, 0xdb
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
not r12b
pop rbx
movsx r12, r12w
jmp 0x1403f5429
pop rdi
movzx r13, r13w
movsx esi, sp
cmovb r13w, dx
pop rsi
setae r13b
movsx r14d, r12w
pop r12
mov r14b, r15b
movsx r14d, r15w
movsx r15, r10w
pop r13
pop r14
movsxd r15, r13d
setbe r15b
pop r15
jmp 0x1403f545e
ret
call fcn.1404b6b57
int3
Function at 0x14043fa8a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
rol ah, cl
push rdi
bswap si
push rbx
sub ah, 0xb7
cdqe
btc di, 0x97
sub rsp, 0x90
add dil, dil
movaps xmmword [rsp + 0x80], xmm7
movzx rdi, bp
btr di, dx
movsx rax, r14w
movaps xmmword [rsp + 0x70], xmm6
shrd ax, r8w, 0x20
bsr di, r12w
cmp ch, cl
mov rdi, rdx
inc sil
mov rsi, rcx
mov rax, qword [rdx]
jmp 0x14043fadf
cmp qword [rax + 0x18], 8
jb 0x14043faed
mov rax, qword [rax]
movsxd rcx, r8d
movsx r9, r13w
lea r9, [rax + rcx*2]
movsx eax, r8w
sbb al, bl
sub ebx, ebx
cmc
shl ax, 0x1a
movzx eax, r11w
nop word cs:[rax + rax]
lahf
movzx eax, word [r9 + rbx*2]
cmp eax, 0xa
jmp 0x14043fb24
je 0x14043fb44
test eax, eax
jmp 0x14043fb31
je 0x14043fb44
inc rbx
jmp 0x14043fb3f
jmp 0x14043fb17
test byte [rdi + 0x1c], 4
jmp 0x14043fb4d
jne 0x14043fcc8
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi + 8]
bswap r8d
movsd xmm0, qword [rax + 8]
cwd
movsd qword [rsp + 0x40], xmm0
mov r8b, 0xd
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 2
movsx rdx, sp
cmovge dx, r9w
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x38]
xchg r8b, r8b
setle r8b
lea r8, [rsp + 0x40]
jmp 0x14043fba1
call fcn.140446801
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x1e0]
test eax, eax
je 0x14043fc09
mov ecx, eax
movzx r9w, r8b
movabs r8, 0xe31b45c42a775183
movsx r9d, r11w
mov dl, 3
movzx r9, r14w
jmp 0x14043fbf9
mov r9d, 0x4f
jmp 0x14043fc04
call fcn.1403b08dd
movss xmm6, dword [rsp + 0x4c]
bts dx, r12w
movss xmm7, dword [rsp + 0x50]
bsf dx, r10w
cmp r12w, 0x603c
movzx ecx, ax
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x40]
cmp r12d, esp
stc
xor r8d, r8d
call fcn.140440046
movss xmm0, dword [rdi + 0x18]
jmp 0x14043fc48
movss dword [rsi], xmm0
jmp 0x14043fc51
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
cmp r13b, r9b
movss xmm0, dword [rsp + 0x50]
shrd ecx, esp, 0x6f
sar cx, 0xa2
xor ecx, 0x519a4947
movss dword [rsi + 8], xmm0
jmp 0x14043fc7b
mov dword [rsi + 0xc], 0
movsx cx, dh
adc cx, r11w
movss dword [rsi + 0x10], xmm7
sar ecx, 0xa0
adc cl, 0xb4
mov dword [rsi + 0x14], ebx
shld ecx, r13d, 0x4a
test bp, 0x2fca
sar rcx, 0xed
mov rcx, qword [rsp + 0x38]
test r12b, r15b
stc
test rcx, rcx
je 0x14043fd2a
mov rax, qword [rcx]
jmp 0x14043fcc0
call qword [rax + 0x10]
jmp 0x14043fd2a
movss xmm0, dword [rdi + 0x18]
jmp 0x14043fcd2
movss dword [rsi], xmm0
jmp 0x14043fcdb
cvtsi2ss xmm1, ebx
mulss xmm1, dword [0x1400bfc14]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
jmp 0x14043fcf5
movss xmm0, dword [0x1400bfc94]
movlps qword [rsi + 8], xmm0
mov rax, qword [rdi + 8]
jmp 0x14043fd0a
movss xmm0, dword [rax + 0xc]
jmp 0x14043fd14
addss xmm0, dword [0x1400bfbd0]
movss dword [rsi + 0x10], xmm0
mov dword [rsi + 0x14], ebx
and bl, sil
dec si
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
or bl, 7
add rsp, 0x90
pop rbx
cmovle esi, r15d
pop rdi
movzx esi, r8w
pop rsi
ret
Function at 0x140444fb4
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140444fbd
movzx ecx, cx
jmp 0x140444fc5
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
jmp 0x140444fd6
cmp eax, 0x100
setae al
cmp r9b, bpl
clc
jmp 0x140444fe7
add rsp, 0x28
ret
Function at 0x1404466ed
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
bswap rax
movsx eax, si
movzx rax, ax
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jmp 0x14044670b
je 0x140446745
mov ecx, eax
bts r9w, bp
and dl, 0xea
movabs r8, 0xcafa59766d7f94e
movsx r9w, r8b
mov dl, 3
shl r9b, 0xee
shld r9w, r9w, 0x7c
mov r9d, 0x2a
add rsp, 0x28
jmp fcn.1403b08dd
nop
cmp r13w, r13w
stc
cmp r9b, 0x3f
add rsp, 0x28
ret

Function at 0x1404478ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
and r14b, r9b
movsxd r14, ebx
cmp sp, r10w
push rsi
cmovle si, ax
test r13b, 0x4a
or r14, 0x62163c68
push rdi
shld si, r10w, 0xa5
push rbp
rcl sil, cl
push rbx
sal r14b, 0xd7
shld r14w, si, 0x15
shl dil, cl
sub rsp, 0x60
setne ah
movsx rbp, r8w
movaps xmmword [rsp + 0x50], xmm6
movsxd rbp, r8d
cwde
bswap rsi
mov r14, r9
jmp 0x14044793e
mov rbx, r8
cdqe
movzx bp, r14b
mov rdi, rdx
mov rsi, rcx
bswap edx
movss xmm6, dword [rsp + 0xb0]
cdqe
movzx rbp, cx
movzx ebp, byte [rsp + 0xb8]
cdq
xchg edx, eax
not al
mov qword [rsp + 0x38], 0
movsxd rax, r14d
setae al
rdtsc
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
cqo
mov rdx, r11
movsx rdx, r15w
lea rdx, [rsp + 0x38]
jmp 0x140447996
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
movzx ax, al
mov ch, bh
cdqe
mov rcx, qword [rsp + 0x38]
movsxd rdx, edi
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
jmp 0x1404479bf
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rdi]
bswap r8w
movzx r8d, dx
mov rax, qword [rcx]
bswap r8w
movzx r8w, r8b
movzx r8d, bp
mov r8d, 1
jmp 0x1404479f0
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
not dh
mov rax, qword [rcx]
mov rdx, rdi
mov r8d, ebx
jmp 0x140447a08
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
cbw
movsx dx, dil
not dx
movzx edx, bpl
mov al, bl
cdqe
setle ah
mov rax, qword [rcx]
jmp 0x140447a2d
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
jmp 0x140447a3d
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
movsx rax, sp
movups xmm0, xmmword [r14]
rdtsc
cwde
setbe dh
movaps xmmword [rsp + 0x40], xmm0
movsx rax, bx
bswap edx
mov ax, r10w
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
jmp 0x140447a6e
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
cdq
movsx r8d, cx
movsxd rdx, ebp
mov r8, qword [rsi + 0x20]
mov al, bpl
cmovne ax, bx
not dx
mov rdx, qword [rsp + 0x38]
movsxd rax, ebp
mov rax, qword [rcx]
jmp 0x140447a9b
mov qword [rsp + 0x20], 0
jmp 0x140447aa9
movaps xmm3, xmm6
jmp 0x140447ab1
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
not ah
movzx ax, dh
cbw
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
movsx rax, ax
not ax
cwde
mov rax, qword [rcx]
jmp 0x140447adf
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
shl si, 0x67
shld ebp, ebx, 0x6c
add rsp, 0x60
pop rbx
cmovle r14w, bx
mov dil, 0x2c
pop rbp
movsx si, dl
cmovge si, cx
pop rdi
pop rsi
movzx r14w, r8b
movsxd r14, r8d
pop r14
ret
Function at 0x140449694
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
test r10b, dl
movzx eax, r15w
mov eax, 0x5a4d
cmc
cmp word [0x140000000], ax
jmp 0x1404496b4
jne 0x1404497ac
movsxd rcx, dword [0x14000003c]
not dh
lea rdx, [0x140000000]
cmc
lea rcx, [rcx + rdx]
cmp dword [rcx], 0x4550
jmp 0x1404496da
jne 0x1404497ac
mov eax, 0x20b
jmp 0x1404496ed
cmp word [rcx + 0x18], ax
jmp 0x1404496f6
jne 0x1404497ac
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
cwde
rol r9b, 0x79
lea rdx, [rdx + rcx]
cwde
movzx rax, bp
movzx eax, word [rcx + 6]
sal r9b, 0x94
bt r9w, r9w
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x140449736
je 0x14044976e
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x140449747
jb 0x140449760
mov eax, dword [rdx + 8]
test spl, 0xd6
cmc
add eax, ecx
cmp r8, rax
jb 0x140449775
add rdx, 0x28
jmp 0x140449769
jmp 0x14044972a
sub edx, edx
test sil, 0x52
stc
test rdx, rdx
jmp 0x14044977d
jne 0x14044978f
sub al, al
jmp 0x14044978a
jmp 0x1404497ba
cmp dword [rdx + 0x24], 0
jge 0x1404497a5
xor al, al
jmp 0x1404497a0
jmp 0x1404497ba
mov al, 1
jmp 0x1404497ba
xor al, al
jmp 0x1404497b3
jmp 0x1404497ba
add rsp, 0x18
jmp 0x1404497c3
ret
Function at 0x14045b060
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
jmp 0x14045b06f
lea rcx, [rsp + 0x30]
jmp 0x14045b079
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmp r10, r8
test r10b, 0x15
add rsp, 0x28
jmp 0x14045b094
ret

Function at 0x14045b144
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
btr bx, si
jmp 0x14045b156
mov rbp, rsp
inc ah
sub rsp, 0x20
neg bx
sar bl, cl
rcr ax, cl
mov rax, qword [0x1400b7288]
movabs rbx, 0x2b992ddfa232
cmp rbx, r8
test sp, r12w
cmp rax, rbx
jmp 0x14045b187
jne 0x14045b250
and qword [rbp + 0x18], 0
movzx rcx, di
mov cl, cl
lea rcx, [rbp + 0x18]
jmp 0x14045b1a1
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
jmp 0x14045b1b4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
cmc
cmp r10d, r14d
xor qword [rbp + 0x10], rax
jmp 0x14045b1c9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
cmc
xor qword [rbp + 0x10], rax
jmp 0x14045b1df
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
lea rcx, [rbp + 0x10]
shl rax, 0x20
test spl, 0x73
jmp 0x14045b1f9
xor rax, qword [rbp + 0x20]
cmc
jmp 0x14045b206
xor rax, qword [rbp + 0x10]
xor rax, rcx
movabs rcx, 0xffffffffffff
xchg bpl, bpl
clc
rcr bp, cl
and rax, rcx
btc ecx, ebp
movabs rcx, 0x2b992ddfa233
bswap bp
sbb ebp, ebp
cmp rax, rbx
movsxd rbx, r12d
movsx bp, r10b
cmove rax, rcx
not bh
mov qword [0x1400b7288], rax
add bp, 0x7d76
mov rbx, qword [rsp + 0x48]
adc ebp, 0x6b4a5655
xor bp, ax
not rax
xchg ebp, ebp
mov qword [0x1400b7280], rax
rcr bpl, cl
add rsp, 0x20
pop rbp
jmp 0x14045b277
ret

Function at 0x14045b302
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
stc
sub ecx, ecx
jmp 0x14045b30e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x14045b31c
je 0x14045b397
mov ecx, 0x5a4d
clc
cmp word [rax], cx
jmp 0x14045b330
jne 0x14045b397
movsxd rcx, dword [rax + 0x3c]
jmp 0x14045b341
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jmp 0x14045b350
jne 0x14045b397
mov eax, 0x20b
test r11b, 0x9b
cmp word [rcx + 0x18], ax
jmp 0x14045b368
jne 0x14045b397
cmp dword [rcx + 0x84], 0xe
jmp 0x14045b37a
jbe 0x14045b397
cmp dword [rcx + 0xf8], 0
mov al, dil
setne al
jmp 0x14045b392
jmp 0x14045b39f
sub al, al
stc
jmp 0x14045b39f
add rsp, 0x28
jmp 0x14045b3a8
ret
Function at 0x14045fca8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
bts rbp, rsi
rcr bpl, 0xf4
push rsi
btc rbp, 0xb2
adc ebp, r9d
push rdi
push r12
adc bpl, 4
add bpl, 0x6b
rcr bp, cl
push r14
or bpl, 0x75
bsr bp, r11w
rcl bpl, 0xc8
push r15
sub rsp, 0x40
shr bp, 0x1b
xor r12d, r12d
test dil, dl
bt r15w, si
mov r15, r8
mov qword [rax + 0x20], r12
cmp r8w, r13w
sar ebp, cl
or rdi, 0xffffffffffffffff
mov bpl, 0x84
mov bpl, r13b
mov rbp, rcx
jmp 0x14045fd16
inc rdi
clc
test sil, r14b
cmp byte [rdi + rcx], r12b
jne 0x14045fd16
add rdi, 1
mov rbx, r12
mov rsi, rdi
mov r14b, spl
jmp 0x14045fd39
mov r14, rcx
jmp 0x14045fd41
je 0x14045fdab
lea r9, [rsp + 0x88]
movsx cx, r15b
mov qword [rsp + 0x20], r15
cwd
movsx rcx, di
not r8w
mov r8, rsi
lea rcx, [rsp + 0x70]
movsx rdx, dx
movzx rdx, r14w
mov rdx, r14
jmp 0x14045fd7b
call fcn.14045a62f
test eax, eax
jmp 0x14045fd87
jle 0x14045fdab
cdqe
jmp 0x14045fd94
inc rbx
cmc
clc
lea r14, [r14 + rax]
sub rsi, rax
jmp 0x14045fda5
jne 0x14045fd47
inc rbx
movzx cx, bpl
mov edx, 2
movsx ecx, dx
movsx cx, bpl
mov rcx, rbx
jmp 0x14045fdc8
call fcn.140173310
mov r14, rax
clc
cmc
test rax, rax
je 0x14045feaa
mov qword [rsp + 0x30], r12
xor esi, r9d
rol rsi, 0x62
mov rsi, rax
test r11b, r15b
test rbx, rbx
jmp 0x14045fdf5
je 0x14045fe51
lea r9, [rsp + 0x30]
bswap r8d
cmovle r8, r14
not dh
mov qword [rsp + 0x20], r15
cmovge r8, rdi
mov r8, rdi
movsxd rdx, esp
mov rdx, rbp
mov rcx, rsi
jmp 0x14045fe23
call fcn.14045a62f
test eax, eax
jmp 0x14045fe2f
jle 0x14045fe51
cdqe
add rsi, 2
stc
lea rbp, [rbp + rax]
cmc
sub rbx, 1
jmp 0x14045fe4b
jne 0x14045fdfb
lea r11, [rsp + 0x40]
mov word [rsi], r12w
setle bl
mov rbx, qword [r11 + 0x38]
cmovge eax, r12d
jmp 0x14045fe6a
mov rax, r14
mov rbp, qword [r11 + 0x40]
jmp 0x14045fe76
mov rsp, r11
cmovne r14w, di
pop r15
movzx di, al
sets r12b
pop r14
mov r12w, dx
pop r12
jmp 0x14045fe9a
pop rdi
movzx si, r15b
mov si, dx
pop rsi
jmp 0x14045fea9
ret
call fcn.140459db5
int3
Function at 0x140473b1f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
neg bx
dec ebx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov bh, 0xda
shr sil, 0x75
add si, dx
mov qword [rax + 0x20], rdi
movzx esi, cx
dec sil
push r14
sub rsp, 0x20
xor r14, rax
mov rsi, r9
stc
sub bp, 0xad5
mov rbx, r8
bts r14w, bx
mov r14, rdx
mov rbp, rcx
jmp 0x140473b6c
test r9, r9
je 0x140473c5d
mov rdi, qword [rdx + 8]
test ah, 0x8c
test rdi, rdi
jmp 0x140473b84
je 0x140473c3a
mov rax, qword [rdi + 0x40]
xchg r8b, r8b
sar r8b, cl
neg r8b
movzx r8d, word [rbx]
cmp qword [rax], 0
je 0x140473bf7
mov rax, qword [rdi + 0x58]
test r9w, r13w
jmp 0x140473bb5
cmp dword [rax], 0
jmp 0x140473bbd
jle 0x140473bf7
dec dword [rax]
movzx dx, dl
mov rcx, qword [rdi + 0x40]
cdqe
cqo
xchg dx, ax
mov rdx, qword [rcx]
cbw
lea rax, [rdx + 2]
jmp 0x140473be1
mov qword [rcx], rax
jmp 0x140473be9
mov word [rdx], r8w
jmp 0x140473bf2
jmp 0x140473c26
mov rax, qword [rdi]
movzx edx, r8w
movsxd rcx, edi
not cl
movsx ecx, sp
mov rcx, rdi
jmp 0x140473c0e
mov rax, qword [rax + 0x18]
jmp 0x140473c17
call qword [0x1400b8d90]
movzx r8d, ax
shld ax, bx, 0x86
mov eax, 0xffff
cmp ax, r8w
jmp 0x140473c34
jne 0x140473c43
mov byte [r14], 1
clc
test spl, 0x2f
add rbx, 2
cmc
cmp r11w, 0x7cf2
sub rsi, 1
jmp 0x140473c57
jne 0x140473b7c
movups xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x30]
clc
sub dil, r11b
and al, r13b
mov rax, rbp
mov rsi, qword [rsp + 0x40]
cmp dil, r8b
bts di, di
mov rdi, qword [rsp + 0x48]
sal r14w, cl
movdqu xmmword [rbp], xmm0
and r14b, 0x74
mov rbp, qword [rsp + 0x38]
bswap r14d
bt r14, r11
add rsp, 0x20
setno r14b
movsx r14d, ax
mov r14, 0x112356e0
pop r14
jmp 0x140473cb4
ret
Function at 0x1404a0e6d
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x1404a0e7b
call fcn.1404ab212
mov r9d, 2
jmp 0x1404a0e8f
lea r8, [rsp + 0x30]
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x1404a0ea1
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp dl, cl
test r10d, r11d
sub ecx, 0x30
jmp 0x1404a0eb9
je 0x1404a0f05
sub ecx, 1
jmp 0x1404a0ec7
je 0x1404a0ef6
cmp ecx, 1
jmp 0x1404a0ed5
je 0x1404a0ee7
xor eax, eax
jmp 0x1404a0ee2
jmp 0x1404a0f0f
mov eax, 3
jmp 0x1404a0ef1
jmp 0x1404a0f0f
mov eax, 1
jmp 0x1404a0f00
jmp 0x1404a0f0f
mov eax, 2
jmp 0x1404a0f0f
add rsp, 0x28
jmp 0x1404a0f18
ret

Function at 0x1404a1cc4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
btc ebx, ebx
movsxd rbx, esp
not bl
mov rbx, rcx
sub ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a1ce5
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
shr dl, cl
rcl rdx, 0xe6
mov edx, 0xc0000409
add rsp, 0x20
jmp 0x1404a1d0c
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]