joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14042c4fb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
stc
shrd esi, r12d, 0x5c
sbb sil, bpl
push rdi
bt rdi, rcx
shrd si, di, 0xbb
xchg dil, sil
sub rsp, 0x28
movsx di, cl
movzx esi, bx
mov rsi, rcx
cmp r13w, bx
movzx edi, dx
clc
xor dl, r15b
sar dl, 0xca
movzx edx, word [rcx + rdi*4 + 0x834]
test dx, dx
jmp 0x14042c53e
js 0x14042c54c
mov rcx, rsi
call fcn.14042c4fb
movsxd rcx, dword [rsi + 0x8860]
cmp ecx, dword [rsi + 0x8858]
jmp 0x14042c55e
jge 0x14042c6ec
movsxd rax, dword [rsi + 0x885c]
sbb r8w, si
lea rax, [rax + rcx]
btc r8w, 0xd5
rcr dl, cl
shl r8b, 0xcc
mov r8, qword [rsi + 8]
rcl ecx, cl
lea edx, [rax + 3]
sets cl
test eax, eax
xchg ch, cl
cmovns edx, eax
rcl ch, cl
btr ecx, 0x87
mov rcx, qword [rsi + 0x18]
sar edx, 2
movsxd rdx, edx
cmp r9b, r10b
mov byte [rcx + rdx], 1
mov rdx, qword [rsi + 0x8838]
cmp dh, 0x57
test rbp, 0x7ea114fd
movzx edi, byte [rsi + rdi*4 + 0x837]
clc
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x14042c5cd
jb 0x14042c617
movzx ecx, byte [rdx + rdi*4 + 2]
jmp 0x14042c5de
mov byte [r8 + rax], cl
cmc
movzx ecx, r12w
movzx ecx, byte [rdx + rdi*4 + 1]
stc
test ecx, 0x7d4f5cb5
mov byte [r8 + rax + 1], cl
movzx ecx, byte [rdx + rdi*4]
mov byte [r8 + rax + 2], cl
movzx rcx, di
rcr ch, cl
movzx ecx, byte [rdx + rdi*4 + 3]
clc
mov byte [r8 + rax + 3], cl
bt ax, 0xce
mov eax, dword [rsi + 0x885c]
add eax, 4
mov dword [rsi + 0x885c], eax
cmp r10b, 0xe
test spl, 0x58
cmp eax, dword [rsi + 0x8854]
jmp 0x14042c639
jl 0x14042c6ec
mov ecx, dword [rsi + 0x884c]
btc ax, 0x7a
btc rax, rcx
mov eax, dword [rsi + 0x8858]
clc
mov dword [rsi + 0x885c], ecx
mov ecx, dword [rsi + 0x8860]
add ecx, dword [rsi + 0x8844]
jmp 0x14042c670
mov dword [rsi + 0x8860], ecx
clc
test esi, 0xfbb3647
test r14b, r8b
cmp ecx, eax
jmp 0x14042c687
jl 0x14042c6ec
mov ecx, dword [rsi + 0x8840]
cmp dil, 0x53
cmc
stc
nop dword [rax]
stc
test ecx, ecx
jmp 0x14042c6a8
jle 0x14042c6ec
mov edx, dword [rsi + 0x8864]
shl edx, cl
cmp r9b, al
mov dword [rsi + 0x8844], edx
stc
cmp di, r15w
sar edx, 1
add edx, dword [rsi + 0x8850]
jmp 0x14042c6d1
mov dword [rsi + 0x8860], edx
jmp 0x14042c6dc
dec ecx
mov dword [rsi + 0x8840], ecx
cmp edx, eax
jge 0x14042c6a1
add rsp, 0x28
movsx edi, r10w
mov dil, 0xc0
movzx si, al
pop rdi
cmovnp esi, r11d
movsx si, bpl
movzx rsi, si
pop rsi
jmp 0x14042c70f
ret
Function at 0x14043faab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
inc ah
test esp, ebx
push r14
movzx eax, r10w
bsr ax, bx
push rsi
ror ax, 0x38
btr esi, 0x32
push rdi
xchg sil, al
shr rax, 0x30
bsr rax, r9
push rbp
cmc
push rbx
test r9w, r14w
sub rsp, 0x78
bswap esi
movsx si, sil
movaps xmmword [rsp + 0x60], xmm8
lahf
movsx si, dl
movaps xmmword [rsp + 0x50], xmm7
movsx si, r11b
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [rcx]
movzx esi, dx
mov esi, dword [rax + 0x10]
jmp 0x14043fb0a
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
test esi, esi
jmp 0x14043fb26
jle 0x14043fd2d
movaps xmm7, xmm2
mov r15w, 0x63af
movzx r15w, al
movaps xmm8, xmm1
xchg r15b, r15b
movzx r15, si
mov r15, rcx
xorps xmm6, xmm6
sub edi, edi
lea r14, [rsp + 0x28]
movzx rdx, sp
movzx ecx, bp
movzx cx, r15b
nop word cs:[rax + rax]
not r8b
mov r8b, cl
movsx edx, ax
mov rcx, r14
movsxd r8, edi
cqo
cdq
mov rdx, r15
bswap r8d
mov r8b, bpl
mov r8d, edi
jmp 0x14043fb8d
call fcn.14043f7c5
mov ebx, dword [rsp + 0x3c]
test rsp, 0x9e67d20
cmp dh, dl
test ebx, ebx
jmp 0x14043fba6
jle 0x14043fd2d
test edi, edi
jmp 0x14043fbb3
jne 0x14043fbd1
movss xmm0, dword [rsp + 0x34]
jmp 0x14043fbc4
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043fd26
movss xmm0, dword [rsp + 0x38]
jmp 0x14043fbdc
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043fc03
add edi, ebx
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x14043fbf8
jl 0x14043fb73
jmp 0x14043fd2d
movss xmm6, dword [rsp + 0x28]
jmp 0x14043fc0e
ucomiss xmm6, xmm8
jbe 0x14043fc24
mov esi, edi
jmp 0x14043fc1f
jmp 0x14043fd2d
movss xmm0, dword [rsp + 0x2c]
jmp 0x14043fc2f
ucomiss xmm0, xmm8
jbe 0x14043fcb0
xor ebp, ebp
cwd
movsx r8d, r14w
movzx dx, cl
mov esi, edi
movaps xmm7, xmm6
nop word cs:[rax + rax]
cwd
movsx r8w, r12b
xchg dh, dl
mov rcx, r15
movsx rdx, r13w
mov dl, r13b
mov r8, 0xb5e5fb4
mov edx, edi
mov r8d, ebp
jmp 0x14043fc7a
call fcn.14043ffd3
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x14043fd7a
inc ebp
jmp 0x14043fc94
inc esi
cmp r14b, 0xc8
cmp rdx, rcx
cmc
movaps xmm6, xmm7
stc
clc
cmp ebx, ebp
jmp 0x14043fcaa
jne 0x14043fc5f
test byte [r15 + 0x1c], 4
jmp 0x14043fcba
jne 0x14043fd0b
lea esi, [rbx + rdi]
dec esi
add ch, ah
cdqe
mov rax, qword [r15]
bsr cx, bp
neg cx
btr cx, 0xd7
movsxd rcx, esi
cmp qword [rax + 0x10], rcx
jbe 0x14043fd9c
cmp qword [rax + 0x18], 8
jmp 0x14043fcef
jb 0x14043fcfb
mov rax, qword [rax]
test ax, bp
cmp word [rax + rcx*2], 0xa
jmp 0x14043fd05
je 0x14043fd2d
add ebx, edi
movzx esi, r15w
jmp 0x14043fd1a
mov esi, ebx
jmp 0x14043fd21
jmp 0x14043fd2d
sub esi, esi
shld eax, eax, 0x43
clc
mov eax, esi
bswap bp
movaps xmm6, xmmword [rsp + 0x40]
sar r14b, cl
ror ebx, cl
btr r15d, edi
movaps xmm7, xmmword [rsp + 0x50]
seta bh
movaps xmm8, xmmword [rsp + 0x60]
xor si, 0x4ff9
add rsp, 0x78
jmp 0x14043fd5c
pop rbx
movsx di, sil
pop rbp
pop rdi
bswap r14d
pop rsi
movzx r15d, cx
not r14w
pop r14
pop r15
jmp 0x14043fd79
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x14043fd2d
inc esi
jmp 0x14043fd97
jmp 0x14043fd2d
call fcn.140440169
int3
Function at 0x140444c1d
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140444c26
movzx ecx, cx
jmp 0x140444c2e
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
clc
cmp eax, 0x100
setae al
test r9d, 0x198115a3
add rsp, 0x28
jmp 0x140444c50
ret
Function at 0x140444f85
Capabilities:
Inspect load icon resource

Disassembly:
push r15
push r14
and ax, 0x5db4
push rsi
xadd ax, r14w
btr ax, 0xb6
push rdi
rol ax, 0xdd
mov esi, r15d
push rbp
test rdi, rdx
rcr si, cl
sar ah, 0x57
push rbx
bsr r14w, r14w
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
xchg sil, bpl
movsxd rax, edi
lahf
mov ebp, r9d
movsx ax, dl
movzx rsi, ax
not sil
mov ebx, r8d
cbw
bswap ax
cmovg r14, r11
mov r14d, edx
cmovb ax, di
mov rsi, rcx
cwde
mov rax, qword [rsp + 0x128]
jmp 0x140444ff9
xorps xmm6, xmm6
movaps xmmword [rsp + 0x60], xmm6
jmp 0x140445006
mov qword [rsp + 0x70], 0
jmp 0x140445014
movss xmm0, dword [0x1400bf4c0]
jmp 0x140445021
movss xmm1, dword [rax]
mulss xmm1, xmm0
cvttss2si ecx, xmm1
mov r15d, dword [rsp + 0x120]
jmp 0x14044503a
movzx ecx, cl
jmp 0x140445042
movss xmm1, dword [rax + 4]
jmp 0x14044504c
mulss xmm1, xmm0
cvttss2si edx, xmm1
movzx edx, dl
stc
shl edx, 8
mulss xmm0, dword [rax + 8]
cvttss2si eax, xmm0
or edx, ecx
movzx ecx, al
cmc
shl ecx, 0x10
jmp 0x140445073
or ecx, edx
jmp 0x14044507a
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rsp + 0x90], rax
mov edx, 0x7f00
clc
xor ecx, ecx
jmp 0x140445095
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rsp + 0x88], rax
mov dl, r8b
mov edx, 0x7f00
xor ecx, ecx
jmp 0x1404450b2
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0x80], rax
cwde
mov qword [rsp + 0x78], 0
movsx cx, r12b
mov qword [rsp + 0x98], 0
movzx eax, bx
lea rdi, [rsi + 0x40]
setg ch
movsx cx, dl
mov qword [rsp + 0xa0], rdi
cmove ax, di
mov ax, 0x3788
mov dword [rsp + 0x60], 0x20800
movsx rcx, r12w
mov ah, 0xf2
lea rax, [0x14005eda0]
mov cl, 0x6d
setae ch
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_RegisterClassW]
movups xmmword [rsp + 0x50], xmm6
movzx r9, di
test esi, r10d
shrd r9, rcx, 0x48
movups xmmword [rsp + 0x40], xmm6
movzx r9, si
test ah, 0x8b
mov dword [rsp + 0x38], r15d
movsx r8w, al
movzx r8, r12w
shl r8d, cl
mov dword [rsp + 0x30], ebp
cdq
btc r9d, esi
mov dword [rsp + 0x28], ebx
xadd dl, dh
xor r8d, 0x2ad75dd4
btr r8w, r12w
mov dword [rsp + 0x20], r14d
cqo
mov dx, bp
test bpl, 3
xor ecx, ecx
cwd
bswap r9
mov rdx, rdi
movsx r8d, sp
mov r8d, ebp
movzx r8d, ax
mov r8, rsi
mov r9d, 0x870000
jmp 0x14044519f
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rsi + 0x90], rax
test rax, rax
jmp 0x1404451b4
jne 0x140445205
mov rax, qword gs:[0x30]
movsx r9, bp
setne dl
mov ecx, dword [rax + 0x68]
movzx r9d, cx
jmp 0x1404451d6
movabs r8, 0x105f77f761f1390b
xchg r9b, dl
movsx r9d, r8w
mov dl, 1
mov r9d, 0x34
call fcn.1403aff88
mov rax, qword [rsi + 0x90]
cqo
movzx edx, r12w
movsx r8, dx
mov rcx, rax
bswap r8w
cmovb r8d, r15d
mov edx, 0xffffffeb
bswap r8d
xchg r8d, r8d
mov r8, rsi
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
movaps xmm6, xmmword [rsp + 0xb0]
cmp r13d, esp
mov bpl, r15b
add rsp, 0xc8
pop rbx
mov esi, ecx
cmovp si, sp
pop rbp
movzx di, r12b
movzx r14d, di
pop rdi
pop rsi
bswap r14
pop r14
pop r15
jmp 0x140445258
ret
Function at 0x140446347
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movzx rax, bx
movsx eax, cx
mov rcx, qword [rcx]
movzx rax, bx
mov rax, qword [rcx]
jmp 0x140446361
call qword [rax + 0x28]
test eax, eax
jmp 0x14044636b
je 0x140446394
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9d, 0x2a
stc
add rsp, 0x28
jmp 0x14044638f
jmp fcn.1403aff88
nop
stc
cmc
test r10w, 0xc8d
add rsp, 0x28
jmp 0x1404463a6
ret
Function at 0x140449235
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
add r8b, 0x98
mov ax, cx
movsxd r8, esi
mov r8, rcx
and ax, 0x36c5
cdqe
sal rax, cl
mov eax, 0x5a4d
cmc
cmp word [0x140000000], ax
jmp 0x140449261
jne 0x14044937a
movsxd rcx, dword [0x14000003c]
mov dl, sil
lea rdx, [0x140000000]
cmp r12w, 0x72d7
lea rcx, [rcx + rdx]
cmc
cmp dword [rcx], 0x4550
jmp 0x14044928e
jne 0x14044937a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1404492a2
jne 0x14044937a
sub r8, rdx
cwd
movzx edx, word [rcx + 0x14]
movzx ax, r8b
movsx r9w, r14b
add rdx, 0x18
btr rax, r9
lea rdx, [rdx + rcx]
jmp 0x1404492d2
movzx eax, word [rcx + 6]
rol rcx, 0x91
cmovne cx, r12w
bswap r9w
lea rcx, [rax + rax*4]
rcl r9, 0xb1
shr r9b, 8
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x1404492ff
je 0x140449337
mov ecx, dword [rdx + 0xc]
stc
cmp ah, 0x6f
cmp r8, rcx
jmp 0x140449314
jb 0x140449329
mov eax, dword [rdx + 8]
stc
add eax, ecx
cmp r8, rax
jb 0x14044933e
add rdx, 0x28
jmp 0x140449332
jmp 0x1404492f3
xor edx, edx
stc
cmp rsi, r14
cmc
test rdx, rdx
jmp 0x140449346
jne 0x140449353
sub al, al
jmp 0x140449388
cmp dword [rdx + 0x24], 0
jmp 0x14044935c
jge 0x14044936e
sub al, al
jmp 0x140449369
jmp 0x140449388
mov al, 1
jmp 0x140449375
jmp 0x140449388
sub al, al
jmp 0x140449381
jmp 0x140449388
add rsp, 0x18
ret

Function at 0x14044ab53
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
test di, 0xf8e
stc
mov qword [rsp + 0x18], rsi
cmc
shl sil, cl
push rdi
xadd si, di
bswap di
inc si
sub rsp, 0x90
mov rsi, rdx
mov di, r8w
bsr rdi, rsp
mov rdi, rcx
clc
test dh, 0x1a
cmp rdx, qword [0x1400b94f8]
jmp 0x14044ab97
jne 0x14044ac03
lea rdx, [0x1400ced04]
movzx rcx, r10w
movsx rcx, dx
lea rcx, [rsp + 0x20]
jmp 0x14044abb6
call fcn.14044a886
nop
xor r9d, r9d
cmovo r8, rdi
mov r8, rdi
movzx edx, bx
movzx dx, r11b
movsxd rcx, ebx
lea edx, [r9 + 0x3f]
jmp 0x14044abe1
lea rcx, [rsp + 0x20]
jmp 0x14044abeb
call fcn.14044ad11
nop
bswap cx
lea rcx, [rsp + 0x20]
call fcn.1403b208f
jmp 0x14044acc7
xor edx, edx
lea rcx, [rsp + 0xa8]
jmp 0x14044ac12
call fcn.140449608
nop
shr ch, 0x46
mov rcx, qword [rdi + 0x18]
stc
cmc
test r10w, sp
test rcx, rcx
jmp 0x14044ac2d
je 0x14044acb5
shl rcx, 3
jmp 0x14044ac3c
call fcn.1401f539d
mov qword [rdi + 0x10], rax
clc
stc
test rax, rax
jmp 0x14044ac4f
je 0x14044ad05
mov rbx, qword [rdi + 0x18]
jmp 0x14044ac5e
jmp 0x14044acac
dec rbx
test dl, bpl
ror rcx, 0x11
mov rax, qword [rsi + 0x10]
mov cl, 0x3d
rol rcx, 0x7f
mov rcx, qword [rax + rbx*8]
btr eax, 0x61
mov rax, qword [rdi + 0x10]
mov qword [rax + rbx*8], rcx
test rcx, rcx
jmp 0x14044ac8f
je 0x14044acac
mov rax, qword [rcx]
jmp 0x14044ac9d
mov rax, qword [rax + 8]
jmp 0x14044aca6
call qword [0x1400b8d90]
test rbx, rbx
jne 0x14044ac63
lea rcx, [rsp + 0xa8]
jmp 0x14044acc2
call fcn.14044968f
lea r11, [rsp + 0x90]
xchg bx, di
movsx si, bl
mov si, 0x2351
mov rbx, qword [r11 + 0x10]
xchg dil, dil
setne sil
mov rsi, qword [r11 + 0x20]
movsx di, r9b
mov rdi, r11
movzx edi, si
mov rsp, r11
mov dil, r12b
setb dil
pop rdi
jmp 0x14044ad04
ret
call fcn.140459a83
nop
int3
Function at 0x140459f5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rcx, [0x1400b9450]
jmp fcn.140230229
mov qword [rsp + 8], rbx
movsx rbx, sp
shrd ebx, r14d, 0x32
shl rbx, cl
mov qword [rsp + 0x10], rbp
rcl bh, cl
rcl bh, 0x1b
xor bl, dil
mov qword [rsp + 0x18], rsi
bt bx, 0x37
push rdi
or bl, spl
neg ebx
sub rsp, 0x20
setbe bh
movzx bx, sil
movsx rbx, ax
lea rbx, [0x1400b95a0]
jmp 0x140459fa6
call fcn.14025723f
mov ebp, eax
jmp 0x140459fb2
call fcn.1400e4485
mov ecx, dword [rbx + 0x320]
cmc
clc
cmp ax, 0x14fc
xor esi, esi
test ecx, ecx
jmp 0x140459fcc
je 0x14045a07c
lea rdi, [rbx + 0x10]
cmp rsi, 0x14
jge 0x14045a07c
cmp qword [rdi], 0
movzx ax, r14b
not ax
mov eax, ecx
jmp 0x140459ff3
je 0x14045a058
cmp dword [rdi - 8], ebp
jmp 0x14045a001
jne 0x14045a058
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14045a01c
mov dword [rax], 1
mov cl, 6
mov rcx, qword [rdi]
jmp 0x14045a024
call fcn.14045a67a
mov rcx, qword [rdi + 8]
jmp 0x14045a032
call fcn.1404a06c2
and qword [rdi], 0
movzx rcx, si
setae cl
movzx eax, r12w
dec dword [rbx + 0x320]
movsx cx, r10b
cwde
mov eax, dword [rbx + 0x320]
inc rsi
movsx ecx, r9w
sets ch
add rdi, 0x28
bt rcx, rdx
shl rcx, cl
mov ecx, eax
test eax, eax
jmp 0x14045a076
jne 0x140459fd6
mov rbx, qword [rbx + 0x328]
test rbx, rbx
jmp 0x14045a08b
jne 0x140459fb7
mov rbx, qword [rsp + 0x30]
bts bp, sp
mov rbp, qword [rsp + 0x38]
btc di, 0x15
and sil, bpl
rcr si, 0xdb
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x14045a0ba
jmp 0x1400e615c
Function at 0x140473f55
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r11w, 0x3d96
cmc
mov qword [rax + 8], rbx
stc
mov qword [rax + 0x10], rbp
sub bpl, 0x22
setns bpl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmc
push r14
sar rdi, cl
sub rsp, 0x20
xadd si, si
mov rsi, r9
add r14d, 0x628a7b21
bts r14w, r8w
movzx r14d, r8w
movzx rdi, bp
mov rdi, rdx
btc ebp, r14d
btc bp, 0x7c
sar bp, 0x6a
mov rbp, rcx
test r9, r9
je 0x140474077
mov rbx, qword [rdx + 8]
test rbx, rbx
jmp 0x140473fc5
je 0x14047405f
mov rax, qword [rbx + 0x40]
jmp 0x140473fd5
cmp qword [rax], 0
je 0x140474030
mov rax, qword [rbx + 0x58]
cmp r8d, r9d
jmp 0x140473feb
cmp dword [rax], 0
jle 0x140474030
dec dword [rax]
lahf
movsxd rax, r8d
mov rcx, qword [rbx + 0x40]
xchg dh, ah
mov rdx, qword [rcx]
bswap ax
cbw
nop
lea rax, [rdx + 2]
jmp 0x140474013
mov qword [rcx], rax
movzx eax, dx
movsx eax, dx
cbw
movzx eax, r14w
mov word [rdx], r14w
jmp 0x14047402b
jmp 0x14047404c
mov rax, qword [rbx]
movsxd rdx, esi
movzx edx, r14w
mov rcx, rbx
mov rax, qword [rax + 0x18]
jmp 0x140474046
call qword [0x1400b8d90]
mov ecx, 0xffff
cmp cx, ax
jmp 0x140474059
jne 0x140474068
mov byte [rdi], 1
cmp sp, 0x6edb
stc
sub rsi, 1
jmp 0x140474071
jne 0x140473fbd
movups xmm0, xmmword [rdi]
lahf
seta bl
mov rbx, qword [rsp + 0x30]
ror al, cl
xor r14b, 0xd8
mov rax, rbp
bswap r14w
mov rsi, qword [rsp + 0x40]
rol r14w, cl
and edi, 0x387f4cab
mov rdi, qword [rsp + 0x48]
movsx r14, si
bsf r14w, ax
movdqu xmmword [rbp], xmm0
shrd rbp, r10, 0xe9
adc r14d, esi
mov rbp, qword [rsp + 0x38]
rol r14b, cl
sub r14w, r15w
shld r14w, r8w, 0xc4
add rsp, 0x20
xchg r14b, r14b
movsx r14w, al
bswap r14
pop r14
ret
Function at 0x140492c0b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
movzx rbx, r13w
mov qword [rax + 0x10], rbp
test r9b, r14b
movsxd rbp, edi
mov qword [rax + 0x18], rsi
sub sil, 0xf7
rcr bpl, 0x1c
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
test cx, bp
mov rsi, r9
sub r14b, cl
sete r14b
btr r14w, sp
mov r14, r8
xor ebx, 0x145343f2
mov rbx, rdx
mov rbp, rcx
cmp rdx, r8
jmp 0x140492c5f
je 0x140492d44
mov rdi, qword [r9 + 8]
test rdi, rdi
jmp 0x140492c71
je 0x140492d33
mov rax, qword [rdi + 0x40]
sal r8d, 0x1a
movzx r8d, word [rbx]
cmp qword [rax], 0
jmp 0x140492c8c
je 0x140492cd9
mov rax, qword [rdi + 0x58]
clc
test r15w, 0x1382
cmp dword [rax], 0
jle 0x140492cd9
dec dword [rax]
cbw
mov rcx, qword [rdi + 0x40]
mov ax, r9w
mov rdx, qword [rcx]
setle al
xchg ah, ah
lea rax, [rdx + 2]
jmp 0x140492cc3
mov qword [rcx], rax
jmp 0x140492ccb
mov word [rdx], r8w
jmp 0x140492cd4
jmp 0x140492d17
mov rax, qword [rdi]
movsx rcx, r11w
movsxd rcx, r8d
movzx edx, r8w
movzx cx, r10b
xchg ch, cl
movsx ecx, sp
mov rcx, rdi
jmp 0x140492cf9
mov rax, qword [rax + 0x18]
jmp 0x140492d02
call qword [0x1400b8d90]
movzx r8d, ax
dec rax
add ax, 0x50c4
and ax, r13w
mov eax, 0xffff
cmp r15d, 0x4a60595f
clc
cmp ax, r8w
jmp 0x140492d2d
jne 0x140492d37
mov byte [rsi], 1
clc
add rbx, 2
cmp rbx, r14
jne 0x140492c69
movups xmm0, xmmword [rsi]
rcl bx, 0xd4
movzx rax, cx
adc edi, r11d
mov rbx, qword [rsp + 0x30]
mov rax, rbp
bt esi, 0x85
mov rsi, qword [rsp + 0x40]
rol r14w, cl
bswap r14d
mov rdi, qword [rsp + 0x48]
cmp bl, r9b
movdqu xmmword [rbp], xmm0
bsf bp, cx
mov rbp, qword [rsp + 0x38]
movsxd r14, ebx
add rsp, 0x20
pop r14
jmp 0x140492d8e
ret
Function at 0x14049f749
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp r14w, 0x2b04
mov qword [rax + 0x10], rbx
cmp rcx, 0xb677541
mov qword [rax + 0x18], rbp
sal bp, 0x70
not bp
movzx ebp, di
mov qword [rax + 0x20], rsi
movsx rbp, r13w
push rdi
xor rbp, r14
sbb sil, cl
push r14
push r15
rcr r15w, 0x9b
cmc
sub rsp, 0x20
xor sil, 0x75
test rdx, rdx
lea r14, [rax + 8]
mov rbp, rcx
movsxd r15, ecx
movsx edi, r14w
mov rdi, rcx
jmp 0x14049f7ae
movzx ecx, byte [rcx]
mov esi, r12d
cmovle r15d, ebx
cmovne r14, rdx
movzx esi, r15w
mov r15, r9
mov esi, r8d
jmp 0x14049f7cb
jmp 0x14049f7e3
inc rdi
mov cx, 0x5b10
mov cx, r14w
movzx ecx, byte [rdi]
jmp 0x14049f7e3
call fcn.1404b8e40
test eax, eax
jmp 0x14049f7ef
jne 0x14049f7d0
mov bl, byte [rdi]
and ah, 0xf9
movsx ax, r12b
lea eax, [rbx - 0x2b]
test r14w, 0xc45
cmp al, sil
test cl, bpl
test al, 0xfd
jmp 0x14049f815
je 0x14049f827
mov bl, 0x2b
jmp 0x14049f822
jmp 0x14049f82d
inc rdi
cdq
cwd
mov r9, r15
movzx cx, cl
mov r8b, r13b
not r8w
mov r8d, esi
movzx edx, r10w
movsx cx, bl
mov rdx, r14
movsx cx, cl
mov rcx, rdi
call fcn.14049f98a
mov ecx, eax
btc si, 0xff
mov esi, 0x7fffffff
cmp rdi, qword [r14]
jmp 0x14049f869
jne 0x14049f87c
mov qword [r14], rbp
jmp 0x14049f877
jmp 0x14049f88a
cmp rbp, qword [r14]
jmp 0x14049f884
jne 0x14049f897
test ecx, ecx
jmp 0x14049f891
jne 0x14049f8d1
cmp bl, 0x2b
jmp 0x14049f89f
jne 0x14049f8b2
cmp ecx, esi
jmp 0x14049f8ac
ja 0x14049f8d1
cmp bl, 0x2d
jmp 0x14049f8ba
jne 0x14049f925
cmp ecx, 0x80000000
jmp 0x14049f8cb
jbe 0x14049f925
call fcn.1404b6235
mov dword [rax], 0x22
test spl, 0xa8
cmc
test r15, r15
jmp 0x14049f8e9
je 0x14049f8ff
mov dword [r15], 1
btc eax, r11d
rcr ah, 0x70
rol eax, cl
mov eax, 0x80000000
cmp bl, 0x2d
jmp 0x14049f90c
cmove esi, eax
movzx ax, spl
movsx ax, spl
mov eax, esi
jmp 0x14049f920
jmp 0x14049f946
neg eax
cmp rdx, 0xe577874
cmp bl, 0x2d
movsx ebx, bx
cmove ecx, eax
mov ah, cl
mov eax, ecx
movsxd rsi, ecx
xadd bl, r15b
rol rbp, 0xac
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
movsx r15d, r9w
mov rsi, qword [rsp + 0x58]
sub r15d, 0x263e409d
adc r14w, si
add rsp, 0x20
movzx r14d, sp
setnp r15b
jmp 0x14049f975
pop r15
jmp 0x14049f97c
pop r14
movsx di, r13b
pop rdi
jmp 0x14049f989
ret

Function at 0x1404a0f98
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x1404a0fa6
call fcn.1404ab465
mov r9d, 2
cdq
not cl
lea r8, [rsp + 0x30]
cwd
xchg rcx, rcx
mov rcx, qword [rax + 0x28]
movsx edx, sp
movsx rdx, dx
mov rdx, r11
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp al, spl
cmp rdx, 0x65326e73
sub ecx, 0x30
jmp 0x1404a0fed
je 0x1404a1034
sub ecx, 1
je 0x1404a1025
cmp ecx, 1
jmp 0x1404a1004
je 0x1404a1016
sub eax, eax
jmp 0x1404a1011
jmp 0x1404a103d
mov eax, 3
jmp 0x1404a1020
jmp 0x1404a103d
mov eax, 1
jmp 0x1404a102f
jmp 0x1404a103d
mov eax, 2
test spl, 0x78
add rsp, 0x28
ret
Function at 0x1404a2412
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
rol r11w, cl
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
rcr sil, 0x69
push r14
add bl, dil
mov bl, byte [rcx]
or r14b, bl
bts si, r15w
adc bpl, 0xb
lea r10, [rcx + 1]
bsf r11w, r12w
add bp, r13w
mov byte [rdx], bl
mov esi, r9d
xchg r14w, bp
lea r14, [0x140000000]
and r11b, bpl
test esp, 0x3b477688
mov rbp, r8
mov r11, rdx
rcr edi, 0x13
sub rdi, r14
mov rdi, rcx
stc
test rcx, r8
test bl, 4
jmp 0x1404a2481
je 0x1404a24d5
movzx ecx, byte [r10]
mov rax, 0x51875377
and ecx, 0xf
sal ax, cl
seto ah
rcr eax, cl
movsx rax, byte [rcx + r14 + 0xc1a30]
test di, 0x24ae
cmc
mov cl, byte [rcx + r14 + 0xc1a40]
sub r10, rax
setnp ah
shld ax, si, 0xab
or eax, 0x21956025
mov eax, dword [r10 - 4]
clc
shr eax, cl
clc
mov dword [rdx + 4], eax
stc
cmp di, 0x101c
test bl, 8
jmp 0x1404a24dd
je 0x1404a2503
mov eax, dword [r10]
add r10, 4
test r15, 0x291024f8
jmp 0x1404a24f6
mov dword [rdx + 8], eax
stc
jmp 0x1404a2503
test bl, 0x10
jmp 0x1404a250b
je 0x1404a2532
mov eax, dword [r10]
shrd r8d, r12d, 0xb4
add r10, 4
or r8b, r11b
xchg r8b, r8b
rcr r8w, 0xd4
mov dword [rdx + 0xc], eax
rcl eax, 0xbc
cmc
xchg r8d, r8d
movsxd rax, dword [r10]
stc
shl r8b, cl
lea r8, [r10 + 4]
sub r9d, r9d
cmp si, 0x2901
jmp 0x1404a254a
cmp byte [rsp + 0x30], r9b
jmp 0x1404a2554
jne 0x1404a261e
test bl, 2
jmp 0x1404a2562
je 0x1404a261e
lea rdx, [rax + rbp]
ror r10b, cl
movsx r10d, r11w
movzx ecx, byte [rdx]
or r10d, r12d
test r9w, 0x78dc
bswap eax
and ecx, 0xf
mov r10b, 0x5a
bt r10, rax
movsx rax, byte [rcx + r14 + 0xc1a30]
ror r10b, cl
setnp r10b
not r10b
mov cl, byte [rcx + r14 + 0xc1a40]
adc r10w, 0x2539
sub rdx, rax
sbb r10b, sil
mov r10d, dword [rdx - 4]
shr r10d, cl
jmp 0x1404a25c2
mov dword [r11 + 0x10], r9d
cmc
test r10d, r10d
jmp 0x1404a25cf
je 0x1404a2629
mov eax, dword [rdx]
btc cx, 0x3e
bts cx, dx
mov ecx, dword [rdx + 4]
lea rdx, [rdx + 8]
stc
jmp 0x1404a25ed
cmp eax, esi
jmp 0x1404a25f4
je 0x1404a2610
inc r9d
cmp r9d, r10d
jmp 0x1404a2605
jb 0x1404a25d5
jmp 0x1404a2629
mov dword [r11 + 0x10], ecx
jmp 0x1404a2619
jmp 0x1404a2629
mov dword [rdx + 0x10], eax
test spl, bpl
cmp cx, 0x92e
test bl, 1
jmp 0x1404a2631
je 0x1404a2683
movzx ecx, byte [r8]
neg dh
mov rax, r8
and ecx, 0xf
movzx esi, bp
movsx rdx, byte [rcx + r14 + 0xc1a30]
or ebx, 0x69ab42e2
rcl sil, cl
btc ebp, r9d
mov cl, byte [rcx + r14 + 0xc1a40]
dec ebp
rol r14b, 0x89
xor rax, 0x386c6514
sub r8, rdx
mov edx, dword [r8 - 4]
clc
shr edx, cl
mov dword [r11 + 0x14], edx
or sil, r13b
stc
mov rbx, qword [rsp + 0x10]
rcl al, cl
dec ah
sub r8, rdi
movzx rsi, ax
mov al, r12b
xchg ebp, edi
mov rbp, qword [rsp + 0x18]
setp r14b
jmp 0x1404a26aa
mov rax, r8
movsx rdi, r8w
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
jmp 0x1404a26c2
ret