joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140436111
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cdqe
push r14
shr ah, cl
clc
push rsi
clc
push rdi
sbb si, 0x291d
push rbp
sar ah, cl
rol ax, cl
add eax, 0x70f44e78
push rbx
sbb esi, 0x19584447
sub rsp, 0x78
movzx esi, di
movaps xmmword [rsp + 0x60], xmm8
cmovl si, dx
movsx si, r13b
cdqe
movaps xmmword [rsp + 0x50], xmm7
movsxd rax, edx
cwde
movzx rax, si
movaps xmmword [rsp + 0x40], xmm6
movsx ax, r13b
lahf
mov rax, qword [rcx]
movsx rsi, bp
mov esi, dword [rax + 0x10]
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
jmp 0x140436188
test esi, esi
jmp 0x14043618f
jle 0x140436388
movaps xmm7, xmm2
movzx r15w, bpl
not r15b
movaps xmm8, xmm1
movsx r15, r9w
not r15b
mov r15, rcx
jmp 0x1404361b3
xorps xmm6, xmm6
sub edi, edi
movsx dx, r9b
mov dx, r14w
lea r14, [rsp + 0x28]
setnp r8b
bswap cx
nop word cs:[rax + rax]
seta cl
movsxd r8, edi
movsx dx, r12b
mov rcx, r14
mov r8b, 0xa
mov rdx, r15
movzx r8w, dl
mov r8d, edi
jmp 0x1404361fb
call fcn.140435e0d
mov ebx, dword [rsp + 0x3c]
test ebx, ebx
jmp 0x14043620b
jle 0x140436388
test edi, edi
jmp 0x140436218
jne 0x140436236
movss xmm0, dword [rsp + 0x34]
jmp 0x140436229
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043637b
movss xmm0, dword [rsp + 0x38]
jmp 0x140436241
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x140436268
add edi, ebx
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x14043625d
jl 0x1404361e5
jmp 0x140436388
movss xmm6, dword [rsp + 0x28]
jmp 0x140436273
ucomiss xmm6, xmm8
jbe 0x140436284
mov esi, edi
jmp 0x140436388
movss xmm0, dword [rsp + 0x2c]
jmp 0x14043628f
ucomiss xmm0, xmm8
jbe 0x140436305
sub ebp, ebp
cwd
setb sil
mov esi, edi
movaps xmm7, xmm6
movzx edx, si
nop word cs:[rax + rax]
movsxd rdx, r8d
movsx r8d, r9w
mov rcx, r15
mov dl, r8b
mov edx, edi
movsx r8, r13w
jmp 0x1404362cd
mov r8d, ebp
jmp 0x1404362d5
call fcn.1404365e3
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x1404363d8
inc ebp
inc esi
test bh, 0xe6
cmp r11d, r9d
movaps xmm6, xmm7
test r14b, 0xeb
cmp bx, r8w
cmp ebx, ebp
jne 0x1404362bc
test byte [r15 + 0x1c], 4
jmp 0x14043630f
jne 0x140436367
lea esi, [rbx + rdi]
movsx ecx, r8w
movzx eax, ax
dec esi
shld ax, r11w, 0xa3
and ax, ax
shr eax, cl
mov rax, qword [r15]
movsxd rcx, esi
test rsi, r10
cmp qword [rax + 0x10], rcx
jmp 0x14043633e
jbe 0x1404363f5
cmp qword [rax + 0x18], 8
jmp 0x14043634e
jb 0x140436357
mov rax, qword [rax]
cmp word [rax + rcx*2], 0xa
jmp 0x140436361
je 0x140436388
add ebx, edi
movsx rsi, bp
cmovns rsi, r8
not sil
mov esi, ebx
jmp 0x140436388
sub esi, esi
movzx rbp, bp
ror di, cl
sal bpl, 0x65
mov eax, esi
rcr bpl, cl
xor r15b, 0x5b
rol sil, cl
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
sar sil, 0x59
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x78
movsx r14w, r8b
pop rbx
not bpl
pop rbp
xchg r14b, r14b
bswap r15d
pop rdi
movzx si, spl
movsx r15w, cl
mov r15w, r8w
pop rsi
movsxd r15, r13d
pop r14
movzx r15d, ax
pop r15
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x140436388
inc esi
jmp 0x140436388
call fcn.1404367b1
int3
Function at 0x140437141
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
rcl r15w, cl
push rdi
not r15b
cmp si, r8w
cmp r12, 0x382b6bfe
push rbp
bsr bp, ax
adc bp, 0x3e57
push rbx
rol ebp, 0x9b
xor r14w, r9w
ror r14w, cl
sub rsp, 0x28
rol bpl, cl
mov r15d, r9d
shrd bx, cx, 0xa5
mov ebp, r8d
jmp 0x14043718a
mov r14, rdx
mov rbx, rcx
lea rcx, [rdx + 0x20]
setl dh
cdq
movzx edx, bp
mov edx, r8d
stc
mov r8d, r9d
sub r9d, r9d
jmp 0x1404371aa
call fcn.140437323
test r15d, r15d
jle 0x14043724b
test rax, rax
jmp 0x1404371c0
je 0x14043724b
movsxd rsi, ebp
and cl, r9b
rcl dl, cl
mov ecx, r15d
xor ebp, ebp
mov rdx, rsi
jmp 0x140437201
movzx edi, word [rdi + rdx*2]
mov word [rax + rbp*2], di
jmp 0x1404371e8
inc rbp
jmp 0x1404371f0
inc rdx
cmp rcx, rbp
jmp 0x1404371fb
je 0x140437250
mov di, 0x2a
cmp r14w, r11w
jmp 0x14043720f
test byte [rbx + 0x1c], 4
jmp 0x140437218
jne 0x1404371df
mov rdi, qword [rbx]
test cl, r12b
cmp qword [rdi + 0x10], rdx
jmp 0x14043722d
jbe 0x140437318
cmp qword [rdi + 0x18], 8
jmp 0x14043723d
jb 0x1404371db
mov rdi, qword [rdi]
jmp 0x1404371db
movsxd rsi, ebp
not ecx
mov rbx, qword [rbx]
or di, 0x5245
shrd rcx, rsp, 0x51
rol cl, 0xc1
mov rdi, qword [rbx + 0x10]
mov rcx, rdi
test cx, 0x26e1
cmc
sub rcx, rsi
jb 0x140437318
movsxd rax, r15d
cmp r15, r11
cmp rcx, rax
jmp 0x140437284
cmovb rax, rcx
movzx ecx, r15w
test rbx, r13
sbb cx, r15w
cmp qword [rbx + 0x18], 8
movzx ecx, si
not ch
mov rcx, rbx
jmp 0x1404372a5
jb 0x1404372b2
mov rcx, qword [rbx]
ror dh, 0xdd
clc
lea rcx, [rcx + rsi*2]
sub rdi, rax
btr bp, r13w
mov rbp, rdi
sub rbp, rsi
lea rdx, [rcx + rax*2]
or r8, 0x7a2f3f48
lea r8, [rbp + 2]
test r14b, r15b
add r8, rbp
call fcn.14049a9c2
mov qword [rbx + 0x10], rdi
not bpl
btc rdi, 0xa9
mov byte [r14 + 0x16], 0
add rsp, 0x28
movzx rbp, bx
xchg r14b, bpl
pop rbx
pop rbp
jmp 0x140437309
pop rdi
pop rsi
setp r14b
movsx r15, r11w
pop r14
pop r15
ret
call fcn.1404367b1
int3
Function at 0x14043b266
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14043b26f
movzx ecx, cx
jmp 0x14043b277
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
stc
cmp dx, 0x7179
cmp eax, 0x100
xchg al, al
seta al
setae al
add rsp, 0x28
jmp 0x14043b29c
ret

Function at 0x14043ca41
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rax, rbp
mov rcx, qword [rcx]
mov rax, qword [rcx]
jmp 0x14043ca53
call qword [rax + 0x28]
test eax, eax
je 0x14043ca96
mov ecx, eax
shr dl, cl
mov dl, r10b
movabs r8, 0xcafa59766d7f94e
mov dl, 3
cmc
sbb r9w, 0xec1
bsf r9, rsi
mov r9d, 0x2a
clc
cmp sil, 0xc6
stc
add rsp, 0x28
jmp 0x14043ca91
jmp fcn.1403a6a1c
nop
add rsp, 0x28
ret
Function at 0x14043d494
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
xor r14w, bp
clc
push rsi
adc r14b, 0x1f
add ax, r13w
push rdi
bts rax, rsi
push rbx
or ax, r8w
sub rsp, 0x58
movzx rax, r10w
lahf
setg r14b
mov rax, r9
movsx r9, r13w
xchg r9w, r9w
mov r14, rdx
mov r9d, dword [rsp + 0xa0]
jmp 0x14043d4d6
movd xmm0, r8d
shr r8, 0x20
jmp 0x14043d4e4
movd xmm1, r8d
mov qword [rdx], 0
jmp 0x14043d4f5
cvttss2si r8d, xmm1
test r8d, r8d
jmp 0x14043d502
jle 0x14043d61f
cvttss2si r10d, xmm0
sub r11d, r11d
movss xmm2, dword [0x1400bf4c0]
xor ebx, ebx
jmp 0x14043d51f
jmp 0x14043d537
inc ebx
add r11d, r9d
cmp ebx, r8d
jmp 0x14043d531
je 0x14043d61f
mov rsi, r10
and dh, 0x99
test bh, 0xa0
mov edx, r11d
test r10d, r10d
jmp 0x14043d54b
jg 0x14043d5dd
jmp 0x14043d524
movzx edi, dil
jmp 0x14043d55f
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
movzx edi, byte [rax + rdx + 1]
jmp 0x14043d58b
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
mov dil, r9b
movzx edi, byte [rax + rdx + 2]
jmp 0x14043d5ac
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
test r11b, 0x81
cmp r10, r9
add edx, 4
jmp 0x14043d5cf
dec rsi
jmp 0x14043d5d7
je 0x14043d524
mov edx, edx
movzx edi, byte [rax + rdx + 3]
cmp rsp, rbx
jmp 0x14043d5ec
cmp edi, 0xff
je 0x14043d5c7
test edi, edi
jmp 0x14043d5ff
jne 0x14043d556
mov byte [rax + rdx + 2], 0
jmp 0x14043d60f
mov word [rax + rdx], 0
jmp 0x14043d61a
jmp 0x14043d5c7
mov rcx, qword [rcx + 0x18]
xchg dh, dl
movabs rdx, 0x10000001c
jmp 0x14043d634
mov qword [rsp + 0x38], rdx
movsd xmm2, qword [0x1400bfee0]
movsd qword [rsp + 0x40], xmm2
mov dword [rsp + 0x48], 0
jmp 0x14043d654
mov qword [rsp + 0x50], 0
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
btr di, cx
mov edx, edx
or di, bx
or rdx, rbx
xchg bl, dil
movsx di, r15b
movzx rbx, cx
mov rbx, qword [rcx]
not di
mov dil, r10b
mov qword [rsp + 0x28], r14
movzx r8w, r15b
lea rdi, [rsp + 0x38]
movsxd r8, r15d
mov qword [rsp + 0x20], rdi
movzx r8w, dl
movsxd r8, r9d
mov r8, rax
jmp 0x14043d6b3
call qword [rbx + 0x1c8]
test eax, eax
jmp 0x14043d6c0
je 0x14043d6f7
mov ecx, eax
movabs r8, 0xad4a5352d2edebd0
movzx r9, r15w
not r9b
mov dl, 3
movsx r9, r14w
xchg r9w, r9w
movsx r9d, r15w
mov r9d, 0xd4
jmp 0x14043d6f2
call fcn.1403a6a1c
mov rax, r14
shr rsi, cl
and r14b, r11b
movzx r14, r10w
add rsp, 0x58
jmp 0x14043d70d
pop rbx
movzx si, r11b
movsxd rsi, edi
pop rdi
pop rsi
movzx r14w, r11b
mov r14b, r11b
movzx r14d, di
pop r14
jmp 0x14043d72b
ret
Function at 0x14043f8d8
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
bts eax, r13d
ror ax, 0x8e
mov eax, 0x5a4d
jmp 0x14043f8f4
cmp word [0x140000000], ax
jmp 0x14043f900
jne 0x14043fa0f
movsxd rcx, dword [0x14000003c]
shl dl, cl
shl rdx, 0x33
rcr rdx, cl
lea rdx, [0x140000000]
cmp r14b, 0xdd
add rcx, rdx
cmp dword [rcx], 0x4550
jmp 0x14043f92f
jne 0x14043fa0f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x14043f943
jne 0x14043fa0f
sub r8, rdx
movzx dx, ch
shl r9w, cl
sub r9b, 0x8b
movzx edx, word [rcx + 0x14]
lahf
add rdx, 0x18
add rdx, rcx
bt rax, 0x74
sal r9w, cl
dec r9w
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
test rsp, rax
clc
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x14043f98d
je 0x14043f9ce
mov ecx, dword [rdx + 0xc]
cmp r14, 0x2a632a26
cmc
cmp r8, rcx
jmp 0x14043f9a6
jb 0x14043f9c0
mov eax, dword [rdx + 8]
add eax, ecx
stc
cmp r8, rax
jmp 0x14043f9ba
jb 0x14043f9d3
add rdx, 0x28
jmp 0x14043f9c9
jmp 0x14043f981
xor edx, edx
test r14d, r11d
test rdx, rdx
jne 0x14043f9e8
sub al, al
jmp 0x14043f9e3
jmp 0x14043fa1d
cmp dword [rdx + 0x24], 0
jmp 0x14043f9f1
jge 0x14043fa03
sub al, al
jmp 0x14043f9fe
jmp 0x14043fa1d
mov al, 1
jmp 0x14043fa0a
jmp 0x14043fa1d
xor al, al
jmp 0x14043fa16
jmp 0x14043fa1d
add rsp, 0x18
jmp 0x14043fa26
ret
Function at 0x140451487
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
add bpl, r13b
mov rbp, rsp
and al, 0xd
sub rsp, 0x20
mov rax, qword [0x1400b7288]
btr rbx, r10
movabs rbx, 0x2b992ddfa232
cmp r13w, r8w
cmp rax, rbx
jmp 0x1404514ba
jne 0x1404515a3
and qword [rbp + 0x18], 0
xchg ch, ch
mov cl, r13b
lea rcx, [rbp + 0x18]
jmp 0x1404514d3
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
jmp 0x1404514e6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
test esp, 0x13db3148
xor qword [rbp + 0x10], rax
jmp 0x1404514fd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
seto cl
cmc
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x140451516
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
jmp 0x14045152c
lea rcx, [rbp + 0x10]
shl rax, 0x20
stc
xor rax, qword [rbp + 0x20]
test r11w, r13w
xor rax, qword [rbp + 0x10]
xadd ebp, ebp
sbb bpl, spl
xor rax, rcx
rol cl, 0xcc
movzx bp, bpl
rol ecx, cl
movabs rcx, 0xffffffffffff
and rax, rcx
movabs rcx, 0x2b992ddfa233
rol bpl, 0xce
dec bpl
btc bp, r11w
cmp rax, rbx
movsx bp, r8b
bswap ebp
movzx ebx, bx
cmove rax, rcx
btr ebx, esi
sbb ebx, 0x178d2f75
movzx rbx, dx
mov qword [0x1400b7288], rax
bsf bp, r10w
mov bh, cl
mov rbx, qword [rsp + 0x48]
bsr bp, r11w
movsx ebp, r12w
not rax
clc
mov qword [0x1400b7280], rax
add rsp, 0x20
movsx rbp, r8w
xchg ebp, ebp
cmovns ebp, r8d
pop rbp
ret
Function at 0x140456108
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
clc
test r13w, 0x7c1c
jmp 0x14045611f
mov qword [rax + 0x18], rbp
sub ebp, r13d
push rsi
rcl bpl, 0x44
cmp rbp, rax
xor bp, dx
push rdi
push r12
ror bp, 0xb6
rcr rbp, cl
movsx rbp, r13w
push r14
push r15
movsx r15d, r8w
sub rsp, 0x40
mov bpl, 0xe2
sal bp, 0xff
dec r15d
sub r12d, r12d
and r15w, sp
sar bpl, 0x30
adc r15d, 0x82644b0
mov r15, r8
mov qword [rax + 0x20], r12
xchg bpl, bpl
or rdi, 0xffffffffffffffff
dec bpl
mov rbp, rcx
jmp 0x140456180
inc rdi
cmp byte [rdi + rcx], r12b
jne 0x140456180
add rdi, 1
mov rbx, r12
movzx si, r9b
movzx r14d, r10w
cmovs r14w, r13w
mov rsi, rdi
movsx r14w, sil
mov r14, rcx
jmp 0x1404561b2
je 0x14045621d
lea r9, [rsp + 0x88]
cwd
mov qword [rsp + 0x20], r15
cwd
mov r8, rsi
movsxd rdx, r15d
cqo
lea rcx, [rsp + 0x70]
not dx
cmove dx, ax
mov rdx, r14
jmp 0x1404561e5
call fcn.140450935
test eax, eax
jmp 0x1404561f1
jle 0x14045621d
cdqe
jmp 0x1404561fe
inc rbx
cmp r8b, 0xca
cmc
cmp bl, r8b
lea r14, [r14 + rax]
clc
cmc
sub rsi, rax
jmp 0x140456217
jne 0x1404561b8
inc rbx
mov edx, 2
mov cx, r8w
setge cl
mov rcx, rbx
jmp 0x140456234
call fcn.1401d0b3e
mov r14, rax
test r9b, 0xb3
cmp edi, 0x6517358a
cmc
test rax, rax
je 0x140456327
mov qword [rsp + 0x30], r12
bts rsi, r11
sbb sil, r15b
clc
mov rsi, rax
clc
stc
test rbx, rbx
jmp 0x14045626a
je 0x1404562d0
lea r9, [rsp + 0x30]
cwd
bswap cx
setns cl
mov qword [rsp + 0x20], r15
mov r8, rdi
mov rdx, rbp
movsx cx, r12b
movzx rcx, bx
mov cx, 0x1676
mov rcx, rsi
jmp 0x14045629d
call fcn.140450935
test eax, eax
jmp 0x1404562a9
jle 0x1404562d0
cdqe
add rsi, 2
cmp cl, 0x40
lea rbp, [rbp + rax]
test r12, rbx
stc
sub rbx, 1
jmp 0x1404562ca
jne 0x140456270
lea r11, [rsp + 0x40]
mov al, ch
mov word [rsi], r12w
movzx rbp, si
mov bl, r15b
movsx rsi, cx
mov rbx, qword [r11 + 0x38]
movsx bp, r14b
mov rax, r14
movzx edi, bx
bswap r15
jmp 0x1404562fd
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
setle r12b
pop r12
movsx esi, dx
mov rdi, 0x7c2c4d08
pop rdi
jmp 0x140456325
pop rsi
ret
call fcn.1404500d1
int3
Function at 0x140463115
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14046312f
mov qword [rax + 8], rbx
cmp spl, 0xcf
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
sal si, cl
add dil, spl
push r14
sets dil
sub bpl, dil
btc rbp, 0xac
sub rsp, 0x20
shl bpl, cl
stc
cmc
mov rdi, qword [rsp + 0x50]
btc r14w, 0x4f
cmp r8b, r10b
sal si, 0x2d
mov r14, r9
mov rsi, r8
xor bpl, cl
mov rbp, rdx
test dil, 0x43
cmp edx, 0x90f0884
stc
test rdi, rdi
jmp 0x140463191
je 0x14046326b
mov rbx, qword [r8 + 8]
test rbx, rbx
jmp 0x1404631a3
je 0x14046324c
mov rax, qword [rbx + 0x40]
movzx r8d, word [r14]
test ah, 0x51
cmp qword [rax], 0
jmp 0x1404631bd
je 0x140463203
mov rax, qword [rbx + 0x58]
test bl, r13b
cmp dword [rax], 0
jmp 0x1404631d2
jle 0x140463203
dec dword [rax]
mov rcx, 0xf8f2c17
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
cmovno eax, r13d
cbw
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x1404631fa
mov word [rdx], r8w
jmp 0x140463233
mov rax, qword [rbx]
movsx edx, si
movzx edx, r8w
movzx cx, dh
mov cl, 0xd5
mov rcx, rbx
jmp 0x14046321b
mov rax, qword [rax + 0x18]
jmp 0x140463224
call qword [case.0x1404c1b3d.0]
movzx r8d, ax
jmp 0x140463233
mov eax, 0xffff
stc
test rcx, r12
clc
cmp ax, r8w
jmp 0x140463246
jne 0x140463257
mov byte [rsi], 1
stc
cmp r10d, 0x47de4511
add r14, 2
stc
sub rdi, 1
jmp 0x140463265
jne 0x14046319b
movups xmm0, xmmword [rsi]
mov rbx, qword [rsp + 0x30]
mov rax, rbp
neg dil
mov rsi, qword [rsp + 0x40]
not di
mov rdi, qword [rsp + 0x48]
test r10b, r8b
btr r14w, 0x9c
movdqu xmmword [rbp], xmm0
test r11b, 0x29
bswap r14w
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
mov r14b, 0xb1
mov r14, rdx
pop r14
ret
Function at 0x1404890f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
adc bpl, 0x29
sub bh, 0x48
mov qword [rax + 0x18], rsi
movzx rbx, r12w
sub bx, 0x37c8
jmp 0x140489116
mov qword [rax + 0x20], rdi
btr rbx, 0xe9
sub bp, 0x25e4
push r14
sal sil, 7
sub rsp, 0x20
rol ebx, 0x29
mov rsi, r9
stc
sal bl, 0x8c
mov r14, r8
neg bh
movzx bp, bl
mov rbx, rdx
mov rbp, rcx
cmp dx, r12w
cmp rdx, 0x5c302690
cmp rdx, r8
jmp 0x14048915a
je 0x140489249
mov rdi, qword [r9 + 8]
test di, 0x1d35
test rdi, rdi
jmp 0x140489171
je 0x140489235
mov rax, qword [rdi + 0x40]
movsx r8w, r10b
sal r8, 0xf
movzx r8d, word [rbx]
cmp qword [rax], 0
jmp 0x140489191
je 0x1404891d7
mov rax, qword [rdi + 0x58]
stc
clc
cmp dword [rax], 0
jle 0x1404891d7
dec dword [rax]
cdq
mov rcx, qword [rdi + 0x40]
xchg dl, al
mov dl, 0xae
cqo
mov rdx, qword [rcx]
movzx eax, r11w
movsxd rax, edx
lea rax, [rdx + 2]
jmp 0x1404891c6
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x1404891d2
jmp 0x140489216
mov rax, qword [rdi]
movsx edx, r9w
cmovp cx, r13w
movzx dx, ah
movzx edx, r8w
jmp 0x1404891f4
mov rcx, rdi
jmp 0x1404891fc
mov rax, qword [rax + 0x18]
jmp 0x140489205
call qword [case.0x1404c1b3d.0]
movzx r8d, ax
movzx ax, ah
rcr al, 0xe8
mov eax, 0xffff
cmp bpl, 0x10
test r8b, 0x10
test r10, r12
cmp ax, r8w
jmp 0x14048922f
jne 0x140489238
mov byte [rsi], 1
add rbx, 2
test r12b, 0x1d
cmp rbx, r14
jne 0x140489169
movups xmm0, xmmword [rsi]
add r14w, 0x2fce
mov rbx, qword [rsp + 0x30]
mov rax, rbp
shrd edi, r13d, 0xf0
movzx esi, r12w
or di, ax
mov rsi, qword [rsp + 0x40]
adc dil, spl
jmp 0x140489276
mov rdi, qword [rsp + 0x48]
cmc
movdqu xmmword [rbp], xmm0
sal bpl, 0x7e
mov rbp, qword [rsp + 0x38]
xor r14w, 0x840
add rsp, 0x20
movsx r14d, bp
mov r14b, 0xd9
pop r14
jmp 0x1404892a2
ret
Function at 0x140497636
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp r13b, 0x4c
and dword [rsp + 0x30], 0
jmp 0x140497648
call fcn.1404a1aaf
mov r9d, 2
movsx cx, spl
jmp 0x14049765f
lea r8, [rsp + 0x30]
movzx rcx, r13w
cdq
mov rcx, qword [rax + 0x28]
not dx
mov rdx, 0x2175484c
xchg dh, dl
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
jmp 0x140497690
je 0x1404976dc
sub ecx, 1
jmp 0x14049769e
je 0x1404976cd
cmp ecx, 1
jmp 0x1404976ac
je 0x1404976be
xor eax, eax
jmp 0x1404976b9
jmp 0x1404976e5
mov eax, 3
jmp 0x1404976c8
jmp 0x1404976e5
mov eax, 1
jmp 0x1404976d7
jmp 0x1404976e5
mov eax, 2
cmp cx, r13w
add rsp, 0x28
ret
Function at 0x140498a99
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
movzx r10d, sp
shld r11w, di, 0x96
mov qword [rax + 8], rbx
shld r10, r15, 0xa3
neg r11w
movsx r10d, r9w
mov qword [rax + 0x10], rbp
bt r10w, 0xca
jmp 0x140498ac6
mov qword [rax + 0x18], rsi
and rbp, 0x39b72b88
inc bl
mov qword [rax + 0x20], rdi
xor bpl, 0xab
movzx rbp, bp
cmp ebp, r12d
push r14
mov bl, byte [rcx]
bts r11w, r13w
lea r10, [rcx + 1]
shl sil, cl
bts r14, rdi
mov byte [rdx], bl
bt di, 0xe1
mov esi, r9d
rcl dil, cl
sal di, 0x9f
lea r14, [0x140000000]
mov rbp, r8
bt di, 0x33
cmovg r11d, ebp
not r11d
mov r11, rdx
shr edi, cl
mov rdi, rcx
test bl, 4
jmp 0x140498b2d
je 0x140498b83
movzx ecx, byte [r10]
btr rax, 0x64
lahf
bswap rax
and ecx, 0xf
or al, dil
neg al
movsx rax, byte [rcx + r14 + 0xc1a30]
stc
test r12b, r15b
mov cl, byte [rcx + r14 + 0xc1a40]
cmc
test r14b, 0x5c
jmp 0x140498b67
sub r10, rax
sar al, 0xef
mov eax, dword [r10 - 4]
test r8d, 0x5f33903
clc
shr eax, cl
jmp 0x140498b80
mov dword [rdx + 4], eax
test bl, 8
jmp 0x140498b8b
je 0x140498ba1
mov eax, dword [r10]
add r10, 4
mov dword [rdx + 8], eax
cmp dl, 0x67
cmp rax, r8
test bl, 0x10
jmp 0x140498ba9
je 0x140498bc3
mov eax, dword [r10]
btr r8d, esp
add r10, 4
mov r8b, 0xc3
mov dword [rdx + 0xc], eax
xchg r8b, al
movsxd rax, dword [r10]
mov r8, rbx
xadd r8b, r8b
inc r8w
lea r8, [r10 + 4]
xor r9d, r9d
cmp byte [rsp + 0x30], r9b
jmp 0x140498be2
jne 0x140498ca5
test bl, 2
jmp 0x140498bf0
je 0x140498ca5
lea rdx, [rax + rbp]
movzx ecx, byte [rdx]
and ecx, 0xf
shld r10, r8, 0xa1
rcr ah, 0x35
movsx rax, byte [rcx + r14 + 0xc1a30]
stc
rol r10b, 0x80
mov cl, byte [rcx + r14 + 0xc1a40]
and r10, 0x707f243e
movzx r10, r10w
sub r10b, 0xb1
sub rdx, rax
mov r10d, dword [rdx - 4]
test cx, sp
clc
shr r10d, cl
mov dword [r11 + 0x10], r9d
test r10d, r10d
jmp 0x140498c47
je 0x140498cb4
mov eax, dword [rdx]
setle cl
mov ecx, dword [rdx + 4]
cmp r8w, 0x5d82
jmp 0x140498c60
lea rdx, [rdx + 8]
cmp eax, esi
jmp 0x140498c6b
je 0x140498c97
inc r9d
test r8, 0x27bc2700
jmp 0x140498c84
cmp r9d, r10d
jmp 0x140498c8c
jb 0x140498c4d
jmp 0x140498cb4
mov dword [r11 + 0x10], ecx
jmp 0x140498ca0
jmp 0x140498cb4
mov dword [rdx + 0x10], eax
test bp, 0x4f0a
cmp rdx, 0x649c4776
test bl, 1
jmp 0x140498cbc
je 0x140498d0c
movzx ecx, byte [r8]
sal ah, cl
and ecx, 0xf
or rax, rax
movsxd rdx, ecx
movsx rdx, byte [rcx + r14 + 0xc1a30]
btr si, bp
mov cl, byte [rcx + r14 + 0xc1a40]
shr ebx, cl
setae bl
sub r8, rdx
dec r14w
mov r14b, r10b
bts ax, sp
mov edx, dword [r8 - 4]
movzx si, cl
bt rax, 0x58
shr edx, cl
mov dword [r11 + 0x14], edx
mov rbx, qword [rsp + 0x10]
shr r14w, 0x27
sub r8, rdi
lahf
mov rbp, qword [rsp + 0x18]
setns r14b
mov r14b, 0xe
mov rax, r8
mov rsi, qword [rsp + 0x20]
movsx r14w, bl
mov r14b, 0xc9
mov rdi, qword [rsp + 0x28]
movsx r14w, r13b
pop r14
ret
Function at 0x1404a4579
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
shld ax, dx, 0xee
mov qword [rsp + 0x18], rsi
sar bl, cl
and al, sil
cbw
push rdi
sub rsp, 0x50
shl ah, cl
rcl bl, cl
mov rax, qword [0x1400b7288]
sub rbx, 0x53fe0837
xor rax, rsp
movsx ebx, r13w
test r12w, 0x47bf
mov qword [rsp + 0x40], rax
shr bh, 0x31
bt bx, 0x27
cmp byte [rcx + 0x54], 0
mov rbx, rcx
jmp 0x1404a45cc
je 0x1404a46b2
cmp dword [rcx + 0x50], 0
jmp 0x1404a45db
jle 0x1404a46b2
mov rsi, qword [rcx + 0x48]
xor edi, edi
stc
shl al, cl
mov rax, qword [rbx + 8]
rcl r9b, cl
lea rdx, [rsp + 0x34]
ror r9d, cl
movzx r9d, word [rsi]
xadd r8w, cx
lea rcx, [rsp + 0x30]
rol r8b, cl
and dword [rsp + 0x30], 0
movzx r8, ax
lea rsi, [rsi + 2]
movzx r8w, bl
mov r8d, 6
jmp 0x1404a4627
mov qword [rsp + 0x20], rax
jmp 0x1404a4631
call fcn.1404c7d73
test eax, eax
jmp 0x1404a463d
jne 0x1404a46a4
mov r8d, dword [rsp + 0x30]
cmp r11b, 0x3a
stc
test r8d, r8d
jmp 0x1404a4655
je 0x1404a46a4
lea rax, [rbx + 0x10]
movsx rcx, di
cdq
jmp 0x1404a4669
lea r9, [rbx + 0x28]
movsx ecx, ax
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
cqo
cdq
movzx dx, r15b
lea rdx, [rsp + 0x34]
call fcn.1404a29cd
inc edi
jmp 0x1404a4696
cmp edi, dword [rbx + 0x50]
jne 0x1404a45ea
jmp 0x1404a46e6
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404a46ad
jmp 0x1404a46e6
mov r8d, dword [rbx + 0x50]
sar r9b, 0x89
cdq
rcr r9w, cl
lea rax, [rcx + 0x10]
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
add rcx, 0x468
jmp 0x1404a46d7
mov qword [rsp + 0x20], rax
jmp 0x1404a46e1
call fcn.1404a29cd
mov al, 1
and cl, 0x8e
mov rcx, qword [rsp + 0x40]
cmp rdx, 0xc830039
stc
xor rcx, rsp
jmp 0x1404a4700
call fcn.140496cc6
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
sub di, r12w
movsx edi, sp
movzx rdi, di
add rsp, 0x50
movsx di, dil
pop rdi
jmp 0x1404a4729
ret
Function at 0x1404a59b7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
bsf ebx, esi
btr r8d, 0xde
push rdi
bt edi, r10d
sub rsp, 0x20
ror rdi, cl
shl rdx, 0x76
add qword [rcx + 0x20], 8
bsf si, di
mov rdi, rcx
bt dx, ax
and si, r8w
or ax, bx
mov rax, qword [rcx + 0x20]
mov esi, dword [rcx + 0x38]
cmp esi, 0xffffffff
mov r8d, dword [rcx + 0x3c]
sets bh
xchg edx, edx
cqo
movzx edx, word [rcx + 0x42]
mov rbx, qword [rax - 8]
movsx rax, r9w
movzx eax, r12w
movsxd rax, r10d
mov eax, 0x7fffffff
mov qword [rcx + 0x48], rbx
jmp 0x1404a5a26
cmove esi, eax
mov rcx, qword [rcx]
jmp 0x1404a5a31
call fcn.1400f71aa
test al, al
jmp 0x1404a5a3d
je 0x1404a5a8f
test rbx, rbx
jmp 0x1404a5a4b
jne 0x1404a5a6a
lea rbx, [0x1400d25f0]
jmp 0x1404a5a63
mov qword [rdi + 0x48], rbx
bswap edx
cdq
movsxd rdx, esi
cmovne ecx, ecx
movzx rcx, r11w
mov rcx, rbx
jmp 0x1404a5a7c
mov byte [rdi + 0x54], 1
jmp 0x1404a5a85
call fcn.1400fe5f1
jmp 0x1404a5b3e
test rbx, rbx
jne 0x1404a5ab1
lea rbx, [0x1400ced98]
jmp 0x1404a5aa4
mov qword [rdi + 0x48], rbx
test spl, 0x9d
jmp 0x1404a5ab1
sub r9d, r9d
jmp 0x1404a5ac0
test esi, esi
jmp 0x1404a5ac7
jle 0x1404a5b34
cmp byte [rbx], 0
jmp 0x1404a5ad5
je 0x1404a5b34
mov rax, qword [rdi + 8]
sal cx, 0x9d
cmp r10w, dx
bsr edx, r13d
movzx edx, byte [rbx]
inc r8b
cmc
movsxd r8, esp
mov rcx, qword [rax]
mov rax, qword [rcx]
lea rcx, [rbx + 1]
movzx r8d, word [rax + rdx*2]
and r8d, 0x8000
jmp 0x1404a5b10
cmove rcx, rbx
bswap ebx
movsxd rbx, r13d
inc r9d
lea rbx, [rcx + 1]
stc
cmp r14b, 0x94
cmc
cmp r9d, esi
jmp 0x1404a5b2e
jl 0x1404a5acd
mov eax, r9d
btc rsi, rbx
or bh, 2
mov dword [rdi + 0x50], eax
mov al, 1
neg bx
mov rbx, qword [rsp + 0x30]
sal dil, 0xd9
mov edi, 0x5605542e
cmp r13w, si
mov rsi, qword [rsp + 0x38]
xor di, bx
add rsp, 0x20
jmp 0x1404a5b6c
pop rdi
ret