joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14042ef2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
test ax, di
xor sil, 0x93
push rdi
sub rsp, 0x28
sal sil, cl
mov rsi, rcx
cmp dx, r11w
or di, r10w
rcr edi, 0x38
movzx edi, dx
rol rdx, cl
sub edx, 0x56217fd0
cqo
movzx edx, word [rcx + rdi*4 + 0x834]
test dx, dx
jmp 0x14042ef6a
js 0x14042ef7d
mov rcx, rsi
jmp 0x14042ef78
call fcn.14042ef2e
movsxd rcx, dword [rsi + 0x8860]
cmp ecx, dword [rsi + 0x8858]
jmp 0x14042ef8f
jge 0x14042f119
movsxd rax, dword [rsi + 0x885c]
add rax, rcx
bt dx, 0x41
mov r8, qword [rsi + 8]
btc rdx, r12
lea edx, [rax + 3]
ror cx, 0xd1
test eax, eax
cmovns edx, eax
ror cx, 0x98
mov rcx, qword [rsi + 0x18]
test bh, al
cmp r13b, 0x5c
sar edx, 2
test spl, 0xa9
movsxd rdx, edx
test dil, 0x2c
mov byte [rcx + rdx], 1
btc dx, cx
movsx edx, r13w
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x14042eff9
jb 0x14042f045
movzx ecx, byte [rdx + rdi*4 + 2]
cmc
cmp r10w, 0x564e
mov byte [r8 + rax], cl
setnp ch
ror ecx, 0xbe
xadd ecx, ecx
movzx ecx, byte [rdx + rdi*4 + 1]
cmp r14b, r13b
mov byte [r8 + rax + 1], cl
and rcx, rdi
bsf cx, cx
movzx ecx, byte [rdx + rdi*4]
clc
mov byte [r8 + rax + 2], cl
ror cl, 0x6b
movzx ecx, byte [rdx + rdi*4 + 3]
mov byte [r8 + rax + 3], cl
xchg al, al
mov eax, dword [rsi + 0x885c]
cmp r11b, r14b
jmp 0x14042f053
add eax, 4
cmp r10w, 0x4471
mov dword [rsi + 0x885c], eax
cmp eax, dword [rsi + 0x8854]
jmp 0x14042f06d
jl 0x14042f119
mov ecx, dword [rsi + 0x884c]
mov eax, dword [rsi + 0x8858]
mov dword [rsi + 0x885c], ecx
cmovno rcx, r14
bt cx, 0x5b
xor rcx, 0x9931931
mov ecx, dword [rsi + 0x8860]
add ecx, dword [rsi + 0x8844]
cmc
mov dword [rsi + 0x8860], ecx
cmp ecx, eax
jl 0x14042f119
mov ecx, dword [rsi + 0x8840]
stc
nop dword [rax]
test ecx, ecx
jmp 0x14042f0c5
jle 0x14042f119
mov edx, dword [rsi + 0x8864]
stc
jmp 0x14042f0da
shl edx, cl
mov dword [rsi + 0x8844], edx
sar edx, 1
test sil, 0xd0
clc
add edx, dword [rsi + 0x8850]
mov dword [rsi + 0x8860], edx
jmp 0x14042f0fa
dec ecx
cmp r10, 0x97065f9
test sil, cl
mov dword [rsi + 0x8840], ecx
cmp edx, eax
jmp 0x14042f113
jge 0x14042f0be
add rsp, 0x28
movsx rsi, r11w
setl sil
movzx si, r15b
pop rdi
pop rsi
ret
Function at 0x140442d43
Capabilities:
Encrypt data using speck

Disassembly:
push r15
bt rax, rbp
and rax, rax
lahf
push r14
rcl ah, 0x1c
cmp esi, 0x246b100b
neg ax
push rsi
push rdi
sar eax, cl
cwde
push rbx
sub rsp, 0x30
and bx, sp
sal di, cl
or bx, 0x6ce
lea eax, [r9 + rdx]
xor dil, dl
mov edi, dword [rcx + 0x20]
bsr rbx, rsi
mov ebx, edi
jmp 0x140442d85
sub ebx, edx
cmc
test r11b, cl
test si, 0x247f
cmp eax, edi
cmovle ebx, r9d
btc r9, 0x24
shr eax, 0x4a
mov rcx, qword [rcx]
test r15d, 0x1f112ab0
movsxd r9, edx
inc rax
shrd ax, r10w, 0xeb
lahf
mov rdx, qword [rcx + 0x10]
cdqe
mov rax, rdx
cmc
sub rax, r9
jmp 0x140442dc7
jb 0x140442f93
mov r15, r8
shr sil, cl
test rax, rsp
movsxd rdi, ebx
movsx rsi, r12w
mov rsi, qword [rcx + 0x18]
movsx rbx, r8w
shr bh, cl
mov rbx, rsi
sub rbx, rdx
stc
cmp r11w, 0x2f18
cmp rbx, rdi
jmp 0x140442dfc
jae 0x140442e5a
mov qword [rsp + 0x28], rdi
cqo
movsxd rdx, edi
not dh
mov qword [rsp + 0x20], r15
movsxd rdx, edi
mov rdx, rdi
jmp 0x140442e1e
call fcn.140437284
nop
btr ebx, esp
add rsp, 0x30
bswap r15w
mov rbx, rbx
cmovae r15d, r9d
pop rbx
xchg rdi, rdi
pop rdi
pop rsi
movsxd r15, r15d
movzx r15, bx
mov r14w, r13w
pop r14
movsx r15d, r9w
movsx r15w, r10b
pop r15
jmp 0x140442e59
ret
lea rbx, [rdx + rdi]
mov qword [rcx + 0x10], rbx
test r10b, r15b
cmp r12b, 0x15
cmp rsi, 8
jb 0x140442e81
mov rcx, qword [rcx]
movzx r14, di
setne bh
sar r14w, cl
lea rsi, [rcx + r9*2]
lea r14, [r15 + rdi*2]
rol bx, 0x20
add bx, r12w
xor bl, bpl
mov rbx, rdi
test spl, 0x4b
cmp r14, rsi
jmp 0x140442ea3
jbe 0x140442efa
lea rcx, [rcx + rdx*2]
stc
sbb bh, 0x83
mov rbx, rdi
cmp dx, 0x3439
cmp rcx, r15
jb 0x140442efa
mov rbx, rsi
cmp r9b, 0xba
jmp 0x140442ed2
sub rbx, r15
jmp 0x140442eda
jbe 0x140442eed
sar rbx, 1
jmp 0x140442ee8
jmp 0x140442efa
xor ebx, ebx
add dx, 0x37a0
rol ch, cl
rcl r8b, 0x92
lea rcx, [rsi + rdi*2]
bt rdx, rbx
shrd dx, di, 0x6b
rol r8w, 0xd7
lea r8, [rax + rax]
sbb edx, r15d
test r14b, 0x6f
sub dx, si
add r8, 2
mov rdx, rsi
jmp 0x140442f26
call fcn.1404a6cac
lea r8, [rbx + rbx]
movzx rcx, r9w
mov rcx, rsi
mov rdx, r15
call fcn.1404a6cac
sub rdi, rbx
shld r8w, bx, 0xce
bt rcx, 0xc8
movsx rcx, bp
lea rdx, [r14 + rbx*2]
btr r14, 0xb3
sal ch, cl
lea rcx, [rsi + rbx*2]
add rdi, rdi
mov r8, rdi
add rsp, 0x30
sets r15b
movsx esi, di
pop rbx
pop rdi
movzx r15w, r10b
pop rsi
jmp 0x140442f85
pop r14
pop r15
jmp 0x140442f8e
jmp fcn.1404a6cac
call fcn.140442b38
int3
Function at 0x140447643
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044764c
movzx ecx, cx
jmp 0x140447654
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
not al
setae al
add rsp, 0x28
jmp 0x140447670
ret

Function at 0x140448d80
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
cwde
lahf
mov rcx, qword [rcx]
movsx ax, al
movzx rax, bx
cmovp ax, sp
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jmp 0x140448da2
je 0x140448dd0
mov ecx, eax
test r8b, bl
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9d, 0x2a
cmp bh, 0xa2
add rsp, 0x28
jmp 0x140448dcb
jmp fcn.1403b2acb
nop
clc
add rsp, 0x28
jmp 0x140448ddb
ret

Function at 0x140449f92
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
cmovnp eax, edi
test r8w, r11w
bsf r14w, bp
push rsi
rcr ah, 0xe6
push rdi
movsx r14w, spl
setp r14b
neg r14b
push rbp
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rdi, 0x2bc3753
movzx ebx, r12w
movzx rax, bp
mov r14, r9
movzx bp, r8b
cbw
cdqe
mov rbx, r8
movzx rdi, bp
mov rdi, rdx
cbw
xchg dx, ax
mov rsi, rcx
xchg ah, dh
movsx dx, bh
cdq
movss xmm6, dword [rsp + 0xb0]
movzx ebp, byte [rsp + 0xb8]
mov qword [rsp + 0x38], 0
movzx rdx, r9w
cdq
mov rcx, qword [rcx + 8]
cbw
movsx rdx, si
not dh
mov rax, qword [rcx]
movsxd rdx, ebp
movsx dx, spl
lea rdx, [rsp + 0x38]
jmp 0x14044a02f
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
movsx ecx, r8w
jmp 0x14044a046
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
jmp 0x14044a058
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
movzx edx, r9w
rdtsc
movsx eax, r9w
mov rdx, qword [rdi]
movsx rax, sp
movsx r8d, dx
jmp 0x14044a07d
mov rax, qword [rcx]
mov r8d, 1
jmp 0x14044a08b
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
cdqe
rdtsc
mov rax, qword [rcx]
movzx r8, r9w
cdq
mov rdx, rdi
jmp 0x14044a0ad
mov r8d, ebx
jmp 0x14044a0b5
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
xchg ah, dl
movzx edx, bpl
movsx rax, bx
movsx ax, r9b
setge ah
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
mov al, bpl
mov rax, qword [rcx]
jmp 0x14044a0e5
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
xchg dh, dl
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x40], xmm0
movsx rdx, si
cbw
movzx rdx, cx
mov rax, qword [rcx]
movsx rdx, dx
mov dl, r14b
lea rdx, [rsp + 0x40]
jmp 0x14044a115
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
cdq
cbw
mov dl, r11b
mov r8, qword [rsi + 0x20]
jmp 0x14044a131
mov rdx, qword [rsp + 0x38]
mov ax, ax
movzx rax, bp
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
jmp 0x14044a14e
movaps xmm3, xmm6
jmp 0x14044a156
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
jmp 0x14044a169
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
movzx eax, bp
mov rax, qword [rcx]
jmp 0x14044a17c
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
rol dil, cl
sub r14d, esi
add rsp, 0x60
jmp 0x14044a199
pop rbx
movsx di, r11b
setne dil
movzx ebp, cx
pop rbp
not r14d
movsxd r14, r12d
pop rdi
pop rsi
movzx r14, ax
movzx r14w, bl
setne r14b
pop r14
jmp 0x14044a1c3
ret
Function at 0x14044bd48
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
stc
mov r8, rcx
xchg al, al
stc
mov al, r11b
mov eax, 0x5a4d
test r15b, r8b
cmc
cmp word [0x140000000], ax
jmp 0x14044bd6b
jne 0x14044be7f
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
clc
stc
add rcx, rdx
cmp dword [rcx], 0x4550
jmp 0x14044bd8f
jne 0x14044be7f
mov eax, 0x20b
test esp, 0x30d755cb
jmp 0x14044bda5
cmp word [rcx + 0x18], ax
jmp 0x14044bdae
jne 0x14044be7f
sub r8, rdx
sal dx, cl
sar al, 0x8c
cmp r13b, sil
movzx edx, word [rcx + 0x14]
sbb al, r8b
test r8b, 0x11
shl r9b, 0x45
add rdx, 0x18
btr ax, r8w
lea rdx, [rdx + rcx]
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
jmp 0x14044bded
mov qword [rsp], rdx
cmp r11, r10
test sil, r14b
cmp rdx, r9
jmp 0x14044bdff
je 0x14044be3d
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14044be2f
mov eax, dword [rdx + 8]
test bpl, r10b
test dil, 0x87
add eax, ecx
cmc
test r11, rdi
cmp r8, rax
jmp 0x14044be29
jb 0x14044be43
add rdx, 0x28
jmp 0x14044be38
jmp 0x14044bded
sub edx, edx
test r12w, r9w
test rdx, rdx
jmp 0x14044be4b
jne 0x14044be5d
sub al, al
jmp 0x14044be58
jmp 0x14044be90
cmp dword [rdx + 0x24], 0
jmp 0x14044be66
jge 0x14044be78
sub al, al
jmp 0x14044be73
jmp 0x14044be90
mov al, 1
jmp 0x14044be90
sub al, al
jmp 0x14044be86
jmp 0x14044be90
add rsp, 0x18
jmp 0x14044be99
ret
Function at 0x14045d965
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
add al, ah
push rbp
or rax, 0x398275fe
bt rax, 0x9e
movzx rbp, r10w
mov rbp, rsp
dec ah
btr bx, 0xd1
sal al, 0x10
sub rsp, 0x20
rcr ah, 0x2c
sbb al, bpl
mov rax, qword [0x1400b7288]
shr ebx, 0x30
movabs rbx, 0x2b992ddfa232
clc
cmp rax, rbx
jmp 0x14045d9b1
jne 0x14045da86
and qword [rbp + 0x18], 0
movsx rcx, bx
mov cx, 0x4048
bswap rcx
lea rcx, [rbp + 0x18]
jmp 0x14045d9d0
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
jmp 0x14045d9e3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
bts rcx, r12
sar ch, 0x33
xchg ch, ch
lea rcx, [rbp + 0x20]
clc
cmc
xor qword [rbp + 0x10], rax
jmp 0x14045da0f
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
dec ch
lea rcx, [rbp + 0x10]
shl rax, 0x20
jmp 0x14045da2a
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
sbb rbp, 0x5e122ac9
add bp, r11w
xor rax, rcx
rol ch, 0xf0
movabs rcx, 0xffffffffffff
stc
shl bp, cl
or bpl, r12b
and rax, rcx
sbb rcx, 0x509a08d3
inc bpl
movabs rcx, 0x2b992ddfa233
movzx ebp, r10w
dec bp
cmp rax, rbx
cmove rax, rcx
clc
bt rbx, r15
mov qword [0x1400b7288], rax
stc
mov rbx, qword [rsp + 0x48]
xor bpl, 0x24
not rax
xor ebp, 0x179334b3
rcl bpl, cl
cmp cx, 0x5f04
mov qword [0x1400b7280], rax
shld bp, si, 0x22
xadd bp, bp
bsr ebp, r15d
add rsp, 0x20
mov bpl, 0x22
movsx bp, spl
pop rbp
jmp 0x14045dac6
ret
Function at 0x140462647
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test dl, dil
cmp r14, r9
cmp r14b, 0x77
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
xadd ebp, ebp
cmp ecx, ebp
push rsi
rcl ebp, 0x72
ror bpl, cl
sbb bpl, dil
push rdi
push r12
bts rbp, r9
push r14
inc bpl
push r15
movzx r15w, al
btc r15w, di
xchg r15w, bp
sub rsp, 0x40
bts bp, di
sub r12d, r12d
mov r15, r8
sar rbp, cl
xadd bpl, bpl
bt rbp, r15
mov qword [rax + 0x20], r12
movzx rbp, r9w
bsr rbp, rdi
xor bpl, 0x3e
or rdi, 0xffffffffffffffff
inc bpl
movzx bp, r10b
mov rbp, rcx
jmp 0x1404626c4
inc rdi
test r15w, r15w
cmp byte [rdi + rcx], r12b
jne 0x1404626c4
add rdi, 1
movzx r14w, dl
mov rbx, r12
mov rsi, rdi
setnp r14b
mov r14, rcx
jmp 0x1404626f0
je 0x140462755
lea r9, [rsp + 0x88]
movsx r8d, r12w
movzx cx, r15b
mov dx, 0xcf
mov qword [rsp + 0x20], r15
movsx edx, si
mov r8, rsi
movsx edx, r8w
lea rcx, [rsp + 0x70]
movzx rdx, dx
cdq
mov rdx, r14
jmp 0x14046272c
call fcn.14045ce21
test eax, eax
jmp 0x140462738
jle 0x140462755
cdqe
inc rbx
lea r14, [r14 + rax]
sub rsi, rax
jmp 0x14046274f
jne 0x1404626f6
inc rbx
movsx ecx, bp
jmp 0x140462764
mov edx, 2
movsxd rcx, r15d
mov rcx, rbx
jmp 0x140462774
call fcn.1401b4f23
mov r14, rax
test rax, rax
jmp 0x140462784
je 0x140462868
mov qword [rsp + 0x30], r12
mov rsi, rax
test rbx, rbx
jmp 0x14046279a
je 0x1404627fb
lea r9, [rsp + 0x30]
movsx ecx, di
bswap dx
mov qword [rsp + 0x20], r15
movsx ecx, r8w
xchg cl, dl
mov r8, rdi
mov dx, 0x5fb2
mov rdx, rbp
cmovs ecx, edi
mov ch, 0xa4
movsx cx, r11b
mov rcx, rsi
jmp 0x1404627d3
call fcn.14045ce21
test eax, eax
jle 0x1404627fb
cdqe
add rsi, 2
add rbp, rax
test dil, bpl
sub rbx, 1
jmp 0x1404627f5
jne 0x1404627a0
lea r11, [rsp + 0x40]
lahf
mov word [rsi], r12w
mov r15, 0x59325745
mov rbx, qword [r11 + 0x38]
movsx rsi, r9w
setns sil
lahf
mov rax, r14
movsx rbp, dx
mov rbp, qword [r11 + 0x40]
movsx si, r10b
mov rsp, r11
movsx r12, si
movzx r14w, sil
pop r15
pop r14
bswap r12d
cmovbe r12w, ax
movzx r12, r12w
pop r12
movsx edi, r11w
setae dil
movsx rsi, r8w
pop rdi
jmp 0x140462861
pop rsi
jmp 0x140462867
ret
call fcn.14045c5c2
int3
Function at 0x1404954a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
movzx bx, al
mov qword [rax + 0x10], rbp
movsx rbx, r15w
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, edi
mov rsi, r9
mov r14, r8
mov rbx, rdx
mov bpl, cl
mov rbp, rcx
test r8b, r11b
cmp ah, 0x9a
stc
cmp rdx, r8
jmp 0x1404954e2
je 0x1404955cf
mov rdi, qword [r9 + 8]
test dil, 0x61
cmp ecx, r14d
test rdi, rdi
jmp 0x1404954fb
je 0x1404955b0
mov rax, qword [rdi + 0x40]
shr r8d, cl
movzx r8d, word [rbx]
test r8b, 0x24
cmp r14d, edi
cmp qword [rax], 0
jmp 0x14049551c
je 0x14049556b
mov rax, qword [rdi + 0x58]
test r14b, 0xb5
stc
cmp dword [rax], 0
jmp 0x140495533
jle 0x14049556b
dec dword [rax]
cdq
rdtsc
mov rcx, qword [rdi + 0x40]
movsxd rax, r15d
mov rdx, qword [rcx]
cmovbe ax, r9w
movsx eax, cx
lahf
lea rax, [rdx + 2]
jmp 0x14049555a
mov qword [rcx], rax
jmp 0x140495562
mov word [rdx], r8w
jmp 0x14049559c
mov rax, qword [rdi]
cwd
movsx edx, r12w
movzx edx, r8w
mov rcx, rdi
jmp 0x140495580
mov rax, qword [rax + 0x18]
jmp 0x140495589
call qword [case.0x14044bb9c.0]
movzx r8d, ax
cbw
adc rax, 0x6d7b25b8
mov eax, 0xffff
cmp ax, r8w
jmp 0x1404955aa
jne 0x1404955bd
mov byte [rsi], 1
cmp bpl, 0xbc
test bl, r8b
cmp cl, sil
add rbx, 2
cmp rbx, r14
jmp 0x1404955c9
jne 0x1404954f3
movups xmm0, xmmword [rsi]
mov rbx, qword [rsp + 0x30]
rcr rdi, cl
cmova si, r11w
mov rax, rbp
and sil, cl
mov rsi, qword [rsp + 0x40]
shr r14d, 0x1d
mov rdi, qword [rsp + 0x48]
bt r14d, 0xe7
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
shr r14b, cl
btc r14w, r9w
add rsp, 0x20
pop r14
ret
Function at 0x1404a27fd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test edx, 0x22bf6dfa
stc
jmp 0x1404a2813
mov qword [rsp + 0x18], rbp
and bpl, r11b
push rsi
movzx rsi, r11w
bsr rbp, r12
push rdi
movsx si, bpl
push r12
sal si, cl
push r14
ror r14b, 0x27
add r14w, 0x6e56
push r15
add rdi, 0x49b551e
sub rsp, 0x20
sar dil, 0xab
test rdx, rdx
movzx di, cl
movsx di, r11b
lea r14, [rsp + 0x50]
movsxd r15, ebx
not si
setne sil
mov rsi, rcx
mov rdi, rcx
bswap ebp
movzx ecx, byte [rcx]
movzx r15, bx
movsx r15, r11w
movsx bp, dl
cmovne r14, rdx
mov bp, r13w
mov r15, r9
mov ebp, 0x5383507
mov ebp, r8d
jmp 0x1404a2896
jmp 0x1404a28b0
inc rdi
setns cl
movsxd rcx, r15d
movzx rcx, di
movzx ecx, byte [rdi]
jmp 0x1404a28b0
call fcn.1404bb757
test eax, eax
jmp 0x1404a28bc
jne 0x1404a289b
mov bl, byte [rdi]
jmp 0x1404a28c9
lea eax, [rbx - 0x2b]
stc
clc
test al, 0xfd
jmp 0x1404a28d5
je 0x1404a28e7
mov bl, 0x2b
jmp 0x1404a28e2
jmp 0x1404a28f6
inc rdi
cqo
movsx r8w, r12b
movzx r8w, bpl
mov r9, r15
movzx cx, spl
movsx dx, r8b
movsx r8d, r14w
mov r8d, ebp
movsx ecx, sp
mov cl, 0xa5
mov rdx, r14
movzx rcx, ax
mov rcx, rdi
jmp 0x1404a291e
call fcn.1404a2a5b
mov rcx, rax
test bp, bp
mov bpl, 0x2d
movabs r12, 0x8000000000000000
cmc
jmp 0x1404a293c
cmp rdi, qword [r14]
jne 0x1404a2952
mov qword [r14], rsi
jmp 0x1404a294d
jmp 0x1404a2960
cmp rsi, qword [r14]
jmp 0x1404a295a
jne 0x1404a296e
test rcx, rcx
jmp 0x1404a2968
jne 0x1404a29b4
cmp bl, 0x2b
jmp 0x1404a2976
jne 0x1404a299d
movabs rax, 0x7fffffffffffffff
test r11b, r10b
clc
jmp 0x1404a298f
cmp rcx, rax
jmp 0x1404a2997
ja 0x1404a29b4
cmp bl, bpl
jmp 0x1404a29a5
jne 0x1404a29f9
cmp rcx, r12
jbe 0x1404a29f9
call fcn.1404b8b59
mov dword [rax], 0x22
cmp dil, dl
test r15, r15
jmp 0x1404a29ca
je 0x1404a29de
mov dword [r15], 1
stc
test r12w, 0x5080
sub bl, bpl
neg bl
jmp 0x1404a29e8
sbb rax, rax
cmc
add rax, r12
jmp 0x1404a29f4
jmp 0x1404a2a16
mov rax, rcx
neg rax
cmp bl, bpl
bswap ebx
movsx r14w, r8b
cmovle r15, r9
cmove rcx, rax
xor bh, cl
mov rax, rcx
mov rbx, qword [rsp + 0x58]
sbb r14d, 0x543128df
bt r12w, di
rol r12b, 0x3e
mov rbp, qword [rsp + 0x60]
test r12w, 0x3e0e
rcl r14d, 0xb8
add rsp, 0x20
pop r15
mov r14w, 0x1c4d
pop r14
movzx r12d, di
pop r12
bswap edi
movzx si, r13b
pop rdi
movzx esi, r10w
pop rsi
ret

Function at 0x1404a3a1b
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
clc
jmp 0x1404a3a25
and dword [rsp + 0x30], 0
jmp 0x1404a3a2f
call fcn.1404adda2
mov r9d, 2
movsx ecx, r12w
lea r8, [rsp + 0x30]
not dl
cwd
mov dx, bp
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x1404a3a57
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp ah, 0x74
cmp ecx, ecx
sub ecx, 0x30
je 0x1404a3ab6
sub ecx, 1
jmp 0x1404a3a78
je 0x1404a3aa7
cmp ecx, 1
jmp 0x1404a3a86
je 0x1404a3a98
sub eax, eax
jmp 0x1404a3a93
jmp 0x1404a3abe
mov eax, 3
jmp 0x1404a3aa2
jmp 0x1404a3abe
mov eax, 1
jmp 0x1404a3ab1
jmp 0x1404a3abe
mov eax, 2
test ebx, r14d
add rsp, 0x28
jmp 0x1404a3ac7
ret
Function at 0x1404b2626
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
rcl bh, cl
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
btr bx, 0x11
push rdi
adc ebx, 0x6bc457bf
and bl, r15b
sub rsp, 0x30
xor ebp, ebp
mov rbx, rcx
cmp byte [rcx + 0x54], bpl
jmp 0x1404b2658
jne 0x1404b276e
cmp dword [rcx + 0x50], ebp
jmp 0x1404b2666
jle 0x1404b276e
mov rsi, qword [rcx + 0x48]
mov edi, ebp
mov r9w, 0x1857
mov r9, qword [rbx + 8]
lea rcx, [rsp + 0x40]
movzx r8, cx
mov word [rsp + 0x40], bp
movzx eax, r11w
movsx eax, r10w
mov rdx, rsi
mov ah, dl
not ax
bswap ax
mov rax, qword [r9]
movsxd r8, dword [rax + 8]
jmp 0x1404b26a8
call fcn.1404d3d75
movsxd r8, eax
test dl, dh
test eax, eax
jmp 0x1404b26b9
jle 0x1404b2760
mov rcx, qword [rbx + 0x468]
clc
movzx edx, word [rsp + 0x40]
xchg al, ah
rcl rax, 0x6e
mov rax, qword [rcx + 8]
cmp bpl, 0x50
cmp qword [rcx + 0x10], rax
jmp 0x1404b26e3
jne 0x1404b2709
cmp byte [rcx + 0x18], bpl
je 0x1404b26fb
inc dword [rbx + 0x28]
jmp 0x1404b2742
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b2704
jmp 0x1404b2742
inc dword [rbx + 0x28]
movsx eax, di
inc qword [rcx + 0x10]
xchg al, ah
mov rax, qword [rbx + 0x468]
neg cl
cmc
movsx ecx, r10w
mov rcx, qword [rax]
bts rax, r10
movsxd rax, edi
mov word [rcx], dx
xor al, spl
rol ah, 0x24
mov rax, qword [rbx + 0x468]
add qword [rax], 2
clc
add rsi, r8
jmp 0x1404b274a
inc edi
stc
cmp edi, dword [rbx + 0x50]
jmp 0x1404b2755
jne 0x1404b2677
jmp 0x1404b27a9
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b2769
jmp 0x1404b27a9
mov r8d, dword [rbx + 0x50]
setne r9b
cwd
not r9b
lea rax, [rcx + 0x10]
neg r9w
or edx, esp
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
clc
add rcx, 0x468
jmp 0x1404b279a
mov qword [rsp + 0x20], rax
jmp 0x1404b27a4
call fcn.1404b0a88
mov rbx, qword [rsp + 0x48]
not dil
jmp 0x1404b27b6
mov al, 1
stc
xchg rbp, rsi
movzx edi, r9w
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
movzx rdi, dx
seta dil
pop rdi
ret
Function at 0x1404b4267
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404b4277
mov qword [rsp + 0x10], rsi
movsx esi, si
rcr si, 0x62
sub sil, 0x65
push rdi
not di
sub dil, 0x2f
sub rsp, 0x30
mov edi, edx
mov rsi, rcx
jmp 0x1404b42a0
test r8, r8
jne 0x1404b42ca
call fcn.1404b8b59
mov dword [rax], 0x16
jmp 0x1404b42b9
call fcn.1404b9845
xor eax, eax
jmp 0x1404b42c5
jmp 0x1404b43b9
mov rdx, r9
movsx rcx, r14w
mov rcx, r8
jmp 0x1404b42d9
call fcn.1404b441d
mov rbx, rax
test rax, rax
jmp 0x1404b42e9
je 0x1404b4364
lea rax, [rsp + 0x50]
bswap r8w
movsxd rdx, ecx
mov rdx, rdi
movsx r9d, cx
mov qword [rsp + 0x28], rax
movsx r8d, r12w
mov ch, 0x46
lea r8, [0x140094b24]
lahf
movsx r9d, r10w
cbw
mov eax, dword [rsp + 0x60]
mov r9, rbx
setbe ch
cmove rcx, rsp
mov rcx, rsi
jmp 0x1404b4332
mov dword [rsp + 0x20], eax
jmp 0x1404b433b
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b434c
jne 0x1404b43dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b435f
call fcn.1404b8bcb
sub edi, edi
cmc
test r15b, r13b
test rbx, rbx
jmp 0x1404b4372
je 0x1404b43af
mov rcx, qword [rbx + 0x10]
test r8b, 0x6d
test rcx, rcx
je 0x1404b438f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
jmp 0x1404b4398
test rcx, rcx
je 0x1404b43a7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1404cc9fa
mov rax, rdi
adc si, 0x1ac4
sal bh, cl
mov rbx, qword [rsp + 0x40]
clc
mov rsi, qword [rsp + 0x48]
bswap di
shl dil, 0x71
add rsp, 0x30
movsx edi, bp
xchg dil, dil
pop rdi
jmp 0x1404b43db
ret
mov rcx, qword [rsp + 0x68]
clc
test r11b, r10b
cmp bl, r15b
test rcx, rcx
jmp 0x1404b43f0
je 0x1404b43fd
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
clc
sub ebx, ebx
jmp 0x1404b4404
jmp 0x1404b436a

Function at 0x1404b4687
Capabilities:
Terminate process

Disassembly:
push rbx
sbb bh, 0x57
ror ebx, 0x97
sub rsp, 0x20
movsx ebx, ax
mov ebx, ecx
jmp 0x1404b469d
call fcn.1404d5ff3
cmp eax, 1
jmp 0x1404b46aa
je 0x1404b46ee
mov rax, qword gs:[0x60]
sar dl, cl
cmc
mov edx, dword [rax + 0xbc]
cmc
shr edx, 8
cmp r12b, 0xa4
test dl, 1
jmp 0x1404b46d2
jne 0x1404b46ee
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1404b46e8
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1404b45ed
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b98b7
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 0x17
jmp 0x1404b98c5
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404b98e4
mov ecx, 5
jmp 0x1404b98dd
int 0x29
jmp 0x1404b98e4
mov r8d, 1
cqo
mov edx, 0xc0000417
movsxd rcx, r14d
setbe cl
lea ecx, [r8 + 1]
call fcn.1404b992b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx edx, bx
rcl dl, cl
dec rdx
mov edx, 0xc0000417
stc
test bpl, 0xc1
add rsp, 0x28
jmp 0x1404b9924
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]