joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14041e30a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov r10, qword [rcx]
rol sil, cl
movzx rsi, r8w
shl r9d, cl
mov rsi, qword [rcx + 0x18]
not r9b
rol r9b, 0x5f
rcl r9w, cl
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
cmc
cmp r8d, 2
jmp 0x14041e339
jne 0x14041e4a2
test r9d, r9d
jmp 0x14041e347
je 0x14041e54f
lea ecx, [r9 - 1]
cmp bh, 0x40
cmp ecx, 3
jmp 0x14041e35c
jb 0x14041e42d
mov r11d, r9d
and r11d, 0xfffffffc
movsxd r8, r15d
or r8, 0x2fce23ab
nop word cs:[rax + rax]
movzx r8d, word [rsi]
movzx r10d, word [rsi + 4]
sub ecx, ecx
and cl, 0xd8
cmp r8w, word [rdx]
setne cl
or r8w, 0x375b
dec r8b
add r8w, 0x2e86
neg ecx
cmc
add r8w, 0x37d7
cmovo r8w, r10w
mov word [rsi + 2], cx
sub ecx, ecx
rcl cl, cl
setnp cl
stc
cmp r10w, word [rdx]
setne cl
cmp esi, edi
add r8b, spl
neg ecx
mov word [rsi + 6], cx
add r8w, r14w
movzx r8d, word [rsi + 8]
test dil, r12b
cmc
sub ecx, ecx
cmp r8w, word [rdx]
setne cl
or r8w, dx
sal r8b, cl
neg ecx
sbb r8w, 0x52a9
mov word [rsi + 0xa], cx
cmc
movsx r8d, ax
movzx r8d, word [rsi + 0xc]
cmp ch, 3
sub ecx, ecx
cmp r8w, word [rdx]
setne cl
clc
neg ecx
mov word [rsi + 0xe], cx
clc
add rsi, 0x10
cmp sil, cl
add r11d, 0xfffffffc
jmp 0x14041e427
jne 0x14041e380
test r9b, 3
jmp 0x14041e436
je 0x14041e54f
and r9d, 3
shr r8, 0xb0
test di, 0x6164
xor ecx, ecx
jmp 0x14041e458
nop word cs:[rax + rax]
xor r8d, eax
ror r8d, 0x68
rcl r8b, cl
movzx r8d, word [rsi + rcx*4]
cmc
clc
xor eax, eax
and al, r15b
mov al, dl
cmp r8w, word [rdx]
xchg al, al
setne al
stc
neg eax
mov word [rsi + rcx*4 + 2], ax
jmp 0x14041e491
inc rcx
cmp r9d, ecx
jne 0x14041e46d
jmp 0x14041e54f
test r9d, r9d
je 0x14041e54f
movzx r10d, word [rdx]
ror r8w, cl
setg r8b
mov r8d, r9d
jmp 0x14041e4bf
xor ecx, ecx
jmp 0x14041e4c6
jmp 0x14041e4ee
inc rcx
jmp 0x14041e4e0
cmp r8d, ecx
jmp 0x14041e4e8
je 0x14041e54f
cmp word [rsi + rcx*8], r10w
jmp 0x14041e4f8
jne 0x14041e4cb
movzx eax, word [rsi + rcx*8 + 2]
cmp r11b, 0x51
cmp ax, word [rdx + 2]
jne 0x14041e4cb
movzx eax, word [rsi + rcx*8 + 4]
cmp r12d, 0x73a65c1f
cmc
stc
cmp ax, word [rdx + 4]
jmp 0x14041e528
jne 0x14041e4cb
mov word [rsi + rcx*8 + 6], 0
movsx r10d, ax
mov r10b, 0xeb
movzx r10w, r9b
movzx r10d, word [rdx]
jmp 0x14041e54a
jmp 0x14041e4cb
pop rsi
jmp 0x14041e555
ret
Function at 0x140427b1e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rcr r15b, cl
mov r15w, 0x285
push r14
shld r14, r14, 0xa4
sbb r15d, edi
push r12
not r12w
mov r15b, 0xcb
setae r14b
push rsi
ror r15b, cl
push rdi
push rbp
not r14b
push rbx
sub rsp, 0x20
seto bh
rol r15b, 0x8d
mov r12, r8
mov edi, edx
sub r14b, sil
mov rbx, rcx
movzx r14d, si
cmp cl, spl
lea r14, [rcx + 0x38]
or r15d, 0x42b36bc9
movsx bp, r14b
lea r15, [rcx + 0x39]
shr bpl, 0xe2
mov ebp, 0x80
jmp 0x140427b89
sub esi, esi
jmp 0x140427bcd
lea rcx, [rax + 1]
jmp 0x140427b99
mov qword [rbx + 0xc0], rcx
jmp 0x140427ba5
movzx eax, byte [rax]
jmp 0x140427bad
mov byte [r12 + rsi], al
jmp 0x140427bb6
inc rsi
shr ebp, 1
cmp dl, r12b
cmp rsi, 4
jmp 0x140427bc7
je 0x140427d2f
test ebp, edi
jmp 0x140427bd4
je 0x140427bb6
cmp qword [rbx + 0x10], 0
jmp 0x140427be4
je 0x140427c0d
mov rcx, qword [rbx + 0x28]
jmp 0x140427bf3
call qword [rbx + 0x20]
test eax, eax
je 0x140427cbd
cmp dword [rbx + 0x30], 0
jmp 0x140427c07
je 0x140427d20
mov rax, qword [rbx + 0xc0]
shrd rcx, rcx, 0x6c
inc ecx
rcl cx, 0xee
mov rcx, qword [rbx + 0xc8]
cmp rax, rcx
jmp 0x140427c2e
jae 0x140427d20
cmp rax, rcx
jmp 0x140427c3c
jb 0x140427b90
cmp dword [rbx + 0x30], 0
jmp 0x140427c4b
je 0x140427ce3
mov r8d, dword [rbx + 0x34]
cdq
cqo
mov rcx, qword [rbx + 0x28]
mov rdx, r14
jmp 0x140427c64
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
clc
test r8, 0x56940c98
cmp r11b, 0xae
sub ecx, dword [rbx + 0xd0]
cmc
add dword [rbx + 0xb8], ecx
jmp 0x140427c8b
test eax, eax
jmp 0x140427c92
je 0x140427cef
movsxd rcx, eax
not ax
jmp 0x140427ca6
add rcx, r14
cwde
mov eax, 0x4523361a
movzx eax, byte [r14]
jmp 0x140427cb8
jmp 0x140427d03
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
jmp 0x140427cd0
cmp rax, rcx
jmp 0x140427cd8
jae 0x140427c42
jmp 0x140427b90
xor eax, eax
jmp 0x140427cea
jmp 0x140427bad
mov dword [rbx + 0x30], 0
mov byte [rbx + 0x38], 0
xor eax, eax
cmovle cx, bx
mov rcx, r15
mov qword [rbx + 0xc8], rcx
jmp 0x140427d0f
mov qword [rbx + 0xc0], r15
jmp 0x140427d1b
jmp 0x140427bad
sub r12d, r12d
bts bx, r10w
xor rsi, 0x757a24ab
mov rax, r12
ror di, 0x3d
sub r14b, 0xc
add rsp, 0x20
movzx r15, sp
pop rbx
movsxd r14, r13d
movzx r14w, bpl
pop rbp
setno sil
pop rdi
mov r15b, 0xe9
movsx si, r13b
bswap r15w
pop rsi
movsx r15w, cl
movzx r15, r11w
movsx r15d, r8w
pop r12
pop r14
pop r15
jmp 0x140427d76
ret
Function at 0x14043be8d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sal r15b, 0x17
inc r15b
push r14
stc
push rsi
btr r15w, 0xf6
push rdi
sar r14w, 0x49
sub r14w, 0x532f
or r14b, 0xc9
push rbp
rol bpl, 0x7c
rol rbp, cl
bt ebp, r12d
push rbx
bsr r14d, esp
sub rsp, 0x28
bsr bx, sp
neg bh
mov r15d, r9d
cmovb rbx, rdx
xor bpl, r11b
mov ebp, r8d
shr ebx, cl
shl bh, cl
jmp 0x14043bee1
mov r14, rdx
sal bx, 0x26
rcr bh, 0xed
movzx ebx, r8w
mov rbx, rcx
lea rcx, [rdx + 0x20]
mov edx, r8d
mov r8d, r9d
cmp r11b, 0x7d
sub r9d, r9d
jmp 0x14043bf08
call fcn.14043c0a4
test r15d, r15d
jle 0x14043bfb7
test rax, rax
jmp 0x14043bf1e
je 0x14043bfb7
movsxd rsi, ebp
sal dx, 0xfa
cdq
bts rcx, rbx
mov ecx, r15d
shrd dx, r15w, 0xa2
sub ebp, ebp
movsxd rdx, r12d
not dh
mov rdx, rsi
jmp 0x14043bf48
jmp 0x14043bf7f
movzx edi, word [rdi + rdx*2]
jmp 0x14043bf56
mov word [rax + rbp*2], di
jmp 0x14043bf5f
inc rbp
jmp 0x14043bf67
inc rdx
cmp r13w, r11w
test r10b, bl
cmp rcx, rbp
jmp 0x14043bf79
je 0x14043bfbd
mov di, 0x2a
test byte [rbx + 0x1c], 4
jmp 0x14043bf8c
jne 0x14043bf56
mov rdi, qword [rbx]
cmp qword [rdi + 0x10], rdx
jbe 0x14043c099
cmp qword [rdi + 0x18], 8
jb 0x14043bf4d
mov rdi, qword [rdi]
jmp 0x14043bfb2
jmp 0x14043bf4d
movsxd rsi, ebp
rcr rdi, cl
mov rbx, qword [rbx]
shr ecx, 0xa4
mov rdi, qword [rbx + 0x10]
mov rcx, rdi
cmp r11b, 0x3a
jmp 0x14043bfd3
sub rcx, rsi
jmp 0x14043bfdb
jb 0x14043c099
movsxd rax, r15d
test r10b, 0xe1
cmp rcx, rax
cmovb rax, rcx
movsx rcx, si
sbb ch, 0x58
test r11b, 0x39
cmp qword [rbx + 0x18], 8
mov ecx, 0x1a057317
movzx rcx, dx
sete cl
mov rcx, rbx
jb 0x14043c019
mov rcx, qword [rbx]
cwd
lea rcx, [rcx + rsi*2]
sub rdi, rax
bswap r8d
movzx rdx, di
mov rbp, rdi
cqo
sub rbp, rsi
add r8d, 0x1d500569
movsx edx, r15w
lea rdx, [rcx + rax*2]
test r13b, 0xac
test r11b, spl
sal r8b, cl
lea r8, [rbp + 2]
clc
add r8, rbp
jmp 0x14043c059
call fcn.14049f5b0
mov qword [rbx + 0x10], rdi
adc r15w, 0x45b1
mov byte [r14 + 0x16], 0
add rsp, 0x28
not bpl
pop rbx
jmp 0x14043c081
pop rbp
movsxd r14, esi
movzx r14, r15w
movsx si, dl
pop rdi
pop rsi
pop r14
pop r15
jmp 0x14043c098
ret
call fcn.14043b4ea
int3
Function at 0x140440082
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044008b
movzx ecx, cx
jmp 0x140440093
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
stc
cmp eax, 0x100
not al
setle al
setae al
jmp 0x1404400af
add rsp, 0x28
ret

Function at 0x140441871
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
mov rax, qword [rcx]
jmp 0x140441880
call qword [rax + 0x28]
test eax, eax
jmp 0x14044188a
je 0x1404418c0
mov ecx, eax
sal dl, 0x73
movabs r8, 0xcafa59766d7f94e
test ebp, 0x1ad142a
or dl, 0xac
mov dl, 3
stc
mov r9d, 0x2a
cmc
add rsp, 0x28
jmp 0x1404418bb
jmp fcn.1403ab708
nop
clc
cmp eax, 0x2f7b2cdf
add rsp, 0x28
ret

Function at 0x1404429df
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
push rsi
or r14b, 0xf1
push rdi
cwde
push rbp
clc
push rbx
shr si, 0x62
bt si, 0x16
sub rsp, 0x60
mov sil, r12b
jmp 0x140442a00
movaps xmmword [rsp + 0x50], xmm6
jmp 0x140442a0d
mov r14, r9
cwde
movsx si, r8b
mov rbx, r8
lahf
mov rdi, rdx
mov rsi, rcx
cqo
movss xmm6, dword [rsp + 0xb0]
movzx ebp, byte [rsp + 0xb8]
mov qword [rsp + 0x38], 0
movsxd rdx, esi
movzx ax, dil
setae ah
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
jmp 0x140442a58
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
movsx dx, dl
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
jmp 0x140442a7a
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rdi]
bswap ax
movzx r8w, bl
mov rax, qword [rcx]
mov r8d, 1
jmp 0x140442a9e
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
xchg r8d, eax
movzx r8d, cx
cwde
mov rax, qword [rcx]
not r8
mov rdx, rdi
setp r8b
mov r8d, ebx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
movzx edx, bpl
mov rax, qword [rcx]
jmp 0x140442ad1
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
cwde
mov rax, qword [rcx]
jmp 0x140442ae2
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
movzx edx, bp
rdtsc
movups xmm0, xmmword [r14]
rdtsc
movzx ax, r13b
movzx eax, ax
movaps xmmword [rsp + 0x40], xmm0
cmovbe rdx, rax
mov rax, qword [rcx]
movsx dx, sil
lea rdx, [rsp + 0x40]
jmp 0x140442b17
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
jmp 0x140442b2f
mov qword [rsp + 0x20], 0
jmp 0x140442b3d
movaps xmm3, xmm6
jmp 0x140442b45
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
mov ax, r13w
mov rax, qword [rcx]
jmp 0x140442b5c
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
movsx rax, sp
mov rax, qword [rcx]
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
mov bpl, 0x48
cmp rsi, rsp
add rsp, 0x60
mov r14w, sp
cmovnp di, r14w
pop rbx
movsxd rbp, r10d
mov r14b, 0x1c
cmova bp, r13w
pop rbp
movzx di, dl
movzx r14d, r10w
pop rdi
movzx r14w, r9b
pop rsi
movsx r14w, r11b
pop r14
jmp 0x140442bae
ret
Function at 0x140442db9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
bt rsi, 0x14
btr edi, r11d
sub rsp, 0x88
lahf
cmova rax, r12
movaps xmmword [rsp + 0x70], xmm9
cmovg eax, r9d
setno ah
movaps xmmword [rsp + 0x60], xmm8
movzx rax, dx
mov si, bx
cmovg rsi, rsp
movaps xmmword [rsp + 0x50], xmm7
cdqe
movsx si, r9b
movaps xmmword [rsp + 0x40], xmm6
movzx si, r8b
mov al, 0x28
mov di, r11w
movaps xmm8, xmm3
cbw
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx + 0x20]
rdtsc
movups xmm0, xmmword [r8]
movzx eax, di
movsx dx, bpl
movaps xmmword [rsp + 0x20], xmm0
bswap dx
cbw
nop
mov rax, qword [rcx]
sets dl
movsx dx, r8b
mov dx, r11w
lea rdx, [rsp + 0x20]
call qword [rax + 0x40]
movsd xmm6, qword [rdi]
jmp 0x140442e58
movaps xmm0, xmm6
jmp 0x140442e60
call fcn.1404b45bc
movaps xmm9, xmm0
jmp 0x140442e6e
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x140442e7a
call fcn.1404b45bc
unpcklps xmm9, xmm0
addps xmm9, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm9
movlps qword [rsp + 0x20], xmm9
movsd xmm6, qword [rdi + 8]
jmp 0x140442e9f
movaps xmm0, xmm6
jmp 0x140442ea7
call fcn.1404b45bc
movaps xmm7, xmm0
jmp 0x140442eb4
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x140442ec0
call fcn.1404b45bc
movss dword [rdi + 8], xmm7
jmp 0x140442ecf
unpcklps xmm7, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x140442edc
addps xmm7, xmm9
movlps qword [rsp + 0x28], xmm7
movss dword [rsp + 0x30], xmm8
rdtsc
cdqe
xchg al, r8b
movss dword [rsp + 0x34], xmm8
mov rcx, qword [rsi + 0x18]
movzx r8w, bl
cdq
mov r8, qword [rsi + 0x20]
not al
mov rax, qword [rcx]
xchg edx, edx
cmovno edx, r11d
lea rdx, [rsp + 0x20]
jmp 0x140442f1d
call qword [rax + 0x98]
movaps xmm6, xmmword [rsp + 0x40]
stc
rol dil, cl
sub dil, 0x43
movaps xmm7, xmmword [rsp + 0x50]
adc edi, 0x6b8d05e5
movaps xmm8, xmmword [rsp + 0x60]
mov rdi, rsp
sbb rdi, 0x742c62ab
movaps xmm9, xmmword [rsp + 0x70]
bts esi, r15d
add rsp, 0x88
pop rdi
movzx si, r8b
cmovs rsi, r8
pop rsi
jmp 0x140442f6c
ret
Function at 0x14044348b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sub r15b, 0xbf
or r15w, 0x5571
xor eax, r12d
push r14
or r15w, r8w
sal rax, cl
shr r14b, 0x85
push rsi
adc rax, rdi
sbb r14b, r14b
push rdi
push rbp
push rbx
sub rsp, 0x88
cmovge r14w, bp
xchg rsi, rbp
movzx rbx, bx
movaps xmmword [rsp + 0x70], xmm8
movsx si, bl
mov dil, 0x41
movaps xmmword [rsp + 0x60], xmm7
not r14b
movzx esi, r9w
movsx r14d, dx
movaps xmmword [rsp + 0x50], xmm6
movsx eax, ax
mov r14, r8
mov rbx, rdx
cbw
mov r15, rcx
movzx rcx, cx
movzx edi, r8w
lahf
mov rsi, qword [rsp + 0xe0]
cdq
movzx rdx, r9w
mov ebp, dword [rsp + 0xf0]
movzx ax, r15b
cdqe
movsx dx, ch
mov edx, dword [rsp + 0xe8]
movsx rax, sp
mov rdi, qword [r9]
movsx ecx, r15w
cdqe
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x14044353b
call qword [rax + 0x18]
mov rax, qword [rdi]
mov rcx, rdi
movsx rdx, r11w
cwd
mov edx, ebp
jmp 0x140443551
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
xchg al, al
movups xmm0, xmmword [r14]
cwde
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
mov r14b, r10b
movsx edx, sp
bswap r14
lea r14, [rsp + 0x40]
bswap edx
mov dl, 0xce
mov rdx, r14
jmp 0x140443581
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x14044358d
movaps xmm0, xmm7
jmp 0x140443595
call fcn.1404b45bc
movaps xmm8, xmm0
jmp 0x1404435a3
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x1404435af
call fcn.1404b45bc
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
jmp 0x1404435d4
movaps xmm0, xmm7
jmp 0x1404435dc
call fcn.1404b45bc
movaps xmm6, xmm0
jmp 0x1404435e9
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x1404435f5
call fcn.1404b45bc
movss dword [rbx + 8], xmm6
jmp 0x140443604
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
lahf
movsx rcx, bp
mov rcx, qword [r15 + 0x18]
not al
mov rax, qword [r15 + 0x20]
jmp 0x140443620
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
xor r8d, r8d
jmp 0x140443631
nop
cmp word [rsi + r8*2], 0
lea r8, [r8 + 1]
jmp 0x140443641
jne 0x140443632
dec r8d
mov rbp, qword [rcx]
movsx dx, r11b
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
movzx r9w, bl
not r9w
mov dword [rsp + 0x38], 0
cdq
movsxd r9, r10d
mov dword [rsp + 0x30], 2
movsx r9d, si
mov rdx, rsi
movzx r9, bx
xchg r9b, r9b
cmovge r9w, bx
mov r9, rdi
jmp 0x140443694
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
inc r14w
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x70]
shrd bx, r13w, 0x61
test r13d, 0x367b49dd
add rsp, 0x88
pop rbx
movzx r15d, r8w
pop rbp
pop rdi
bswap esi
pop rsi
movzx r15, bx
pop r14
not r15
bswap r15
sets r15b
pop r15
jmp 0x1404436e3
ret
Function at 0x14044472e
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
lahf
rcr al, 0x1e
mov r8, rcx
movzx eax, r9w
mov eax, 0x5a4d
cmp word [0x140000000], ax
jmp 0x14044474e
jne 0x14044485c
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x14044485c
mov eax, 0x20b
clc
jmp 0x14044477d
cmp word [rcx + 0x18], ax
jmp 0x140444786
jne 0x14044485c
sub r8, rdx
xadd ah, al
shr dx, cl
cdqe
movzx edx, word [rcx + 0x14]
jmp 0x1404447a0
add rdx, 0x18
setge r9b
adc r9b, spl
add rdx, rcx
shr ax, cl
or eax, 0x6c3c76ca
sub ah, 0x74
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
clc
mov qword [rsp], rdx
test rdi, r12
clc
cmp rdx, r9
jmp 0x1404447d6
je 0x140444819
mov ecx, dword [rdx + 0xc]
stc
cmp r10d, 0x5b2a2d7d
cmp r8, rcx
jmp 0x1404447ef
jb 0x140444810
mov eax, dword [rdx + 8]
add eax, ecx
jmp 0x140444802
cmp r8, rax
jmp 0x14044480a
jb 0x14044481b
add rdx, 0x28
jmp 0x1404447c6
sub edx, edx
test rdx, rdx
jmp 0x140444823
jne 0x140444835
xor al, al
jmp 0x140444830
jmp 0x14044486e
cmp dword [rdx + 0x24], 0
jmp 0x14044483e
jge 0x140444850
xor al, al
jmp 0x14044484b
jmp 0x14044486e
mov al, 1
jmp 0x140444857
jmp 0x14044486e
xor al, al
jmp 0x140444863
jmp 0x14044486e
add rsp, 0x18
ret
Function at 0x140456119
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
bswap cx
setnp cl
lea rcx, [rsp + 0x30]
jmp 0x14045612d
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
test ax, 0x79f0
jmp 0x140456141
add rsp, 0x28
jmp 0x14045614a
ret

Function at 0x14045620a
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
xor eax, 0x128901cc
dec ebx
push rbp
mov rbp, rsp
shl al, cl
sub rsp, 0x20
mov rax, qword [0x1400b7288]
jmp 0x14045622d
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x14045623f
jne 0x140456325
and qword [rbp + 0x18], 0
movsx rcx, dx
movsx ecx, r9w
not ch
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
jmp 0x14045626b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x14045627c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
ror cx, cl
sar ecx, cl
lea rcx, [rbp + 0x20]
jmp 0x140456296
xor qword [rbp + 0x10], rax
jmp 0x14045629f
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
lea rcx, [rbp + 0x10]
test r8w, cx
stc
shl rax, 0x20
test eax, 0x54bb4327
xor rax, qword [rbp + 0x20]
cmp edx, esi
xor rax, qword [rbp + 0x10]
neg bpl
shl bp, 0x98
btr rbp, 0xda
xor rax, rcx
shl ebp, cl
movabs rcx, 0xffffffffffff
add bp, 0x44aa
mov ebp, 0x68a86b2c
and rax, rcx
mov bpl, cl
shr bp, cl
ror rbp, cl
movabs rcx, 0x2b992ddfa233
sub bp, 0x2fa8
sal bpl, cl
adc bpl, 0x13
cmp rax, rbx
cmove rax, rcx
jmp 0x14045631b
mov qword [0x1400b7288], rax
rol bp, cl
mov rbx, qword [rsp + 0x48]
rcr bpl, cl
sbb bpl, r14b
not rax
adc bp, r9w
xor bpl, 0x92
shl bpl, 0x19
mov qword [0x1400b7280], rax
rol bp, cl
movzx ebp, sp
add rsp, 0x20
movzx rbp, r15w
setb bpl
mov ebp, 0x1da151b1
pop rbp
jmp 0x140456363
ret

Function at 0x1404563ed
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
jmp 0x1404563fa
sub ecx, ecx
jmp 0x140456401
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x14045640f
je 0x140456486
mov ecx, 0x5a4d
test r11b, cl
jmp 0x140456426
cmp word [rax], cx
jmp 0x14045642e
jne 0x140456486
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
test r11w, r14w
cmp dword [rcx], 0x4550
jne 0x140456486
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x14045645a
jne 0x140456486
cmp dword [rcx + 0x84], 0xe
jmp 0x14045646c
jbe 0x140456486
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140456481
jmp 0x140456488
sub al, al
add rsp, 0x28
jmp 0x140456491
ret
Function at 0x14045cb3d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
stc
test bl, 0x52
cmp r14b, 0x42
mov qword [rsp + 0x10], rbp
clc
mov qword [rsp + 0x18], rsi
clc
xor sil, bl
push rdi
movsxd rsi, esi
sub rsp, 0x20
or rbx, 0xffffffffffffffff
sub sil, al
movzx si, spl
movsxd rsi, ebx
mov rsi, rcx
xor ebp, ebp
jmp 0x14045cb7a
inc rbx
cmp r10b, 0x55
cmp cl, dil
cmp word [rcx + rbx*2], bp
jmp 0x14045cb8d
jne 0x14045cb7a
inc rbx
movzx dx, r10b
mov edx, 2
cmovle cx, sp
movzx rcx, bx
movzx ecx, r10w
mov rcx, rbx
jmp 0x14045cbb4
call fcn.140100c7b
mov rdi, rax
jmp 0x14045cbc7
test rax, rax
jmp 0x14045cbcf
je 0x14045cc2d
lea r8, [rbx + rbx]
movzx cx, dil
jmp 0x14045cbe3
mov rdx, rsi
mov cx, 0x63e5
cmovo ecx, r11d
mov rcx, rax
jmp 0x14045cbf6
call fcn.14049f5b0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
not sil
rol esi, cl
mov rbp, qword [rsp + 0x38]
movzx si, r15b
mov rsi, qword [rsp + 0x40]
neg dil
bt edi, 0x66
add rsp, 0x20
mov di, 1
pop rdi
jmp 0x14045cc2c
ret
call fcn.140454e2e
int3
Function at 0x14049c3bd
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
jmp 0x14049c3cb
and dword [rsp + 0x30], 0
jmp 0x14049c3d5
call fcn.1404a675f
mov r9d, 2
movsx rdx, r13w
lea r8, [rsp + 0x30]
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x14049c3f6
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x14049c44b
sub ecx, 1
jmp 0x14049c412
je 0x14049c43c
cmp ecx, 1
jmp 0x14049c420
je 0x14049c432
xor eax, eax
jmp 0x14049c42d
jmp 0x14049c452
mov eax, 3
jmp 0x14049c452
mov eax, 1
jmp 0x14049c446
jmp 0x14049c452
mov eax, 2
clc
cmc
add rsp, 0x28
jmp 0x14049c45b
ret

Function at 0x14049c45c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test bl, 0xbf
stc
mov qword [rax + 8], rbx
test dil, 1
cmp r11w, 0xc63
cmp cx, bp
mov qword [rax + 0x10], rsi
add si, 0x65b2
xor si, 0x6fcd
or sil, 0
mov qword [rax + 0x18], rdi
shr dil, cl
btr di, 0x79
mov qword [rax + 0x20], r14
push r15
and sil, spl
xadd sil, r15b
sub rsp, 0x30
clc
mov rdi, r9
cmovle si, r12w
mov rsi, rdx
sub rsi, rcx
movsxd r15, eax
shl r14d, cl
sar r14b, cl
sub rdi, r8
adc r15b, r9b
mov r15, rcx
xor r14, r12
mov ecx, esi
shld cx, r11w, 0x9a
sar rsi, 1
bts cx, r15w
mov rcx, qword [rsp + 0x60]
add r14b, bpl
adc r14b, 0
movzx r14, r15w
xor ebx, ebx
mov r14d, edx
cmp rsi, 0x5a402cd2
bt r14w, 0x8e
sar rdi, 1
xchg r14b, r14b
mov r14, r8
test rcx, rcx
jmp 0x14049c50a
jne 0x14049c523
call fcn.1404a675f
mov rcx, qword [rax + 8]
jmp 0x14049c51e
jmp 0x14049c533
mov rcx, qword [rcx + 8]
cmp r15, 0x10f7eeb
jmp 0x14049c533
test rcx, rcx
jmp 0x14049c53b
jne 0x14049c5d4
cmp esi, edi
xchg cx, cx
mov eax, edi
movsx ecx, si
movzx rcx, r10w
cmovl eax, esi
setle cl
sbb ecx, r14d
movsxd rcx, eax
stc
cbw
mov eax, 1
test r9b, 0x2f
test rcx, rcx
je 0x14049c5a1
sub r15, r14
or dl, bpl
movzx edx, word [r15 + r14]
clc
cmp dx, word [r14]
jmp 0x14049c585
jne 0x14049c5c1
add r14, 2
cmc
test dil, r10b
sub rcx, rax
jmp 0x14049c59b
jne 0x14049c576
cmp esi, edi
jmp 0x14049c5a8
je 0x14049c5c8
or ecx, 0xffffffff
clc
cmp esi, edi
cmovl eax, ecx
jmp 0x14049c5bc
jmp 0x14049c639
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, eax
mov eax, ebx
jmp 0x14049c5cf
jmp 0x14049c639
mov dword [rsp + 0x28], edi
movzx r9, dx
movsxd r8, ebx
xchg r9w, dx
mov r9d, esi
mov r8, r15
movsx rdx, r14w
mov qword [rsp + 0x20], r14
movzx rdx, bp
sets dh
cdq
mov edx, 0x1000
jmp 0x14049c604
call fcn.1404bf2e9
test eax, eax
jne 0x14049c62b
call fcn.1404b152a
mov dword [rax], 0x16
mov eax, 0x7fffffff
jmp 0x14049c626
jmp 0x14049c639
sub eax, 2
cmovae di, r13w
bswap r15d
bsr esi, ecx
mov rbx, qword [rsp + 0x40]
jmp 0x14049c649
mov rsi, qword [rsp + 0x48]
or r15w, 0x380a
btc r14, 0xc6
shr r14w, 0x70
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
cmovge r15w, r15w
rol r15w, cl
add rsp, 0x30
mov r15d, ebp
movsx r15, r11w
movsx r15w, sil
pop r15
jmp 0x14049c688
ret
Function at 0x14049d201
Capabilities:
Terminate process

Disassembly:
push rbx
shl rbx, cl
sar bx, cl
sub rsp, 0x20
rol bh, 0x6f
bts bx, ax
sub bl, bh
mov rbx, rcx
xor ecx, ecx
jmp 0x14049d220
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
bsf rdx, r10
mov edx, 0xc0000409
rol bh, cl
add rsp, 0x20
movsx ebx, r14w
pop rbx
jmp 0x14049d251
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]