joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14043c3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
and ah, 0x48
sbb ah, 0xa
push rsi
btr r14d, r10d
or r14d, 0x29fc7dca
xadd r14b, al
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, r8d
and r14b, r15b
and al, 0x53
bsf rsi, r10
mov r14, rdx
movzx eax, ax
mov rsi, rcx
nop
mov rax, qword [rdx]
cmp dword [rax + 0x10], r8d
jmp 0x14043c433
jne 0x14043c4b0
test r9d, r9d
jmp 0x14043c441
je 0x14043c611
lea rcx, [rsp + 0x20]
btc dx, 0x9c
test rdi, 0x6eb37a2a
shr dh, 0xe0
mov rdx, r14
sub r8d, r8d
jmp 0x14043c466
call fcn.14043b395
mov dword [rsi + 4], 0
jmp 0x14043c477
mov dword [rsi + 0xc], 0
mov dword [rsi + 0x10], edi
jmp 0x14043c486
movss xmm0, dword [rsp + 0x30]
subss xmm0, dword [rsp + 0x2c]
movss dword [rsi + 8], xmm0
movss xmm0, dword [rsp + 0x24]
jmp 0x14043c4a2
movss dword [rsi], xmm0
jmp 0x14043c4ab
jmp 0x14043c6ad
mov dword [rsi + 4], 0
lea rcx, [rsp + 0x20]
shr rdx, cl
mov dx, 0x3f31
sub ebx, ebx
not rdx
mov rdx, r14
sub r8d, r8d
jmp 0x14043c4d3
call fcn.14043b395
mov eax, dword [rsp + 0x34]
stc
cmp eax, edi
jmp 0x14043c4e4
jle 0x14043c4ff
sub ebp, ebp
movsx ecx, r10w
bswap cx
mov ecx, eax
jmp 0x14043c4fa
jmp 0x14043c566
sub ebx, ebx
lea r15, [rsp + 0x20]
jmp 0x14043c50b
nop word cs:[rax + rax]
mov ebp, ebx
mov ebx, eax
movss xmm0, dword [rsp + 0x28]
jmp 0x14043c524
addss xmm0, dword [rsi + 4]
movss dword [rsi + 4], xmm0
xchg cl, ch
jmp 0x14043c539
mov rcx, r15
mov r8w, bx
xchg dl, dl
mov rdx, r14
mov r8d, eax
jmp 0x14043c54d
call fcn.14043b395
mov ecx, dword [rsp + 0x34]
lea eax, [rcx + rbx]
cmp eax, edi
jmp 0x14043c560
jle 0x14043c515
mov dword [rsi + 0xc], ebx
jmp 0x14043c56e
mov dword [rsi + 0x10], ecx
jmp 0x14043c576
movss xmm0, dword [rsp + 0x30]
subss xmm0, dword [rsp + 0x2c]
movss dword [rsi + 8], xmm0
test spl, 0x58
stc
mov dword [rsi + 0x14], ebp
clc
test ax, si
movss xmm0, dword [rsp + 0x20]
jmp 0x14043c59e
movss dword [rsi], xmm0
cmp bpl, r13b
jmp 0x14043c5aa
cmp ebx, edi
jmp 0x14043c5b1
jge 0x14043c6ad
sub edi, ebx
sar dx, 0xd3
xor ebp, ebp
movzx r8w, r15b
setb dh
nop dword [rax]
jmp 0x14043c5db
mov rcx, r14
cwd
xchg r8d, r8d
mov edx, ebx
mov r8d, ebp
jmp 0x14043c5ed
call fcn.14043bbe0
addss xmm0, dword [rsi]
movss dword [rsi], xmm0
inc ebp
cmp r13d, edi
cmp edi, ebp
jmp 0x14043c606
jne 0x14043c5db
jmp 0x14043c6ad
xorps xmm0, xmm0
movlps qword [rsi], xmm0
mov dword [rsi + 8], 0x3f800000
sub eax, eax
cmp cx, 0x660b
test bh, ah
test edi, edi
jle 0x14043c67d
lea rbp, [rsp + 0x20]
cdq
cmovnp cx, r11w
nop word cs:[rax + rax]
bswap r8w
mov ebx, eax
mov rcx, rbp
mov rdx, r14
mov r8d, eax
jmp 0x14043c659
call fcn.14043b395
mov eax, dword [rsp + 0x34]
cmc
cmp r9b, 0x88
add eax, ebx
stc
cmc
cmp eax, edi
jmp 0x14043c672
jl 0x14043c649
jmp 0x14043c68a
xor ebx, ebx
inc di
bswap rbp
bts r15w, ax
mov dword [rsi + 0xc], eax
movzx rbp, bx
mov dword [rsi + 0x10], 0
bsf edi, eax
xor r15b, 0xcd
clc
mov dword [rsi + 0x14], ebx
rcr sil, cl
movsx ebp, r8w
shl r15b, cl
add rsp, 0x38
setae bpl
cmovne rbx, rax
movsx ebx, ax
pop rbx
movzx r15d, r13w
movzx r15, bx
setg r15b
pop rbp
movsxd r15, r13d
movsx r15d, r10w
pop rdi
pop rsi
setnp r14b
bswap r15d
pop r14
movzx r15d, r15w
pop r15
jmp 0x14043c6e7
ret
Function at 0x140440844
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044084d
movzx ecx, cx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
clc
add rsp, 0x28
ret

Function at 0x140441fd2
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
jmp 0x140441fe5
mov rax, qword [rcx]
jmp 0x140441fed
call qword [rax + 0x28]
test eax, eax
jmp 0x140441ff7
je 0x140442033
mov ecx, eax
movsxd r8, r8d
movabs r8, 0xcafa59766d7f94e
rcr r9w, 0xb9
mov dl, 3
add r9b, 0x12
mov r9d, 0x2a
cmp si, dx
test di, 0x1ab0
add rsp, 0x28
jmp 0x14044202e
jmp fcn.1403abf97
nop
test r15b, 0x39
clc
add rsp, 0x28
jmp 0x140442042
ret

Function at 0x1404420cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
rol ah, 0xcc
jmp 0x1404420db
push rdi
push rbp
or ax, r14w
push rbx
xor sil, r14b
sub rsp, 0x48
cbw
bts rax, rax
mov rax, r9
mov rsi, rdx
mov rdx, rcx
shrd rbx, rbp, 0xad
rol r9d, 0x51
mov ebx, dword [rsp + 0xa0]
adc cl, bpl
movzx cx, ch
mov qword [rsp + 0x40], 0
movsx cx, cl
ror r9d, cl
mov rcx, qword [0x1400b9300]
movss xmm0, dword [r8]
mov r9, 0x72080f45
movss xmm1, dword [r8 + 4]
ror r9b, 0x55
sub r9b, dl
mov r9, qword [rdx]
test r12, 0x12e75500
cmp ebx, 0xffffffff
jmp 0x140442151
je 0x14044215f
mov r8d, ebx
jmp 0x140442190
mov rdx, 0xffffffffffffffff
setnp r8b
nop word [rax + rax]
btr r8, r11
lea r8, [rdx + 1]
cmp word [rax + rdx*2 + 2], 0
jmp 0x140442187
mov rdx, r8
jne 0x140442177
mov ebp, dword [rsp + 0x98]
mov ebx, dword [rsp + 0x90]
movzx dx, r8b
mov dil, 0x6d
xchg edx, edi
mov rdi, qword [rcx]
bswap edx
movsx edx, r15w
movzx rdx, dx
lea rdx, [rsp + 0x40]
jmp 0x1404421bf
mov qword [rsp + 0x30], rdx
movsxd rdx, r11d
mov dl, bpl
movss dword [rsp + 0x28], xmm1
cwd
movss dword [rsp + 0x20], xmm0
cwd
mov rdx, rax
jmp 0x1404421e2
call qword [rdi + 0x90]
test eax, eax
jmp 0x1404421ef
je 0x140442224
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
movsx r9w, dl
mov dl, bpl
mov dl, 3
movzx r9d, r14w
jmp 0x140442214
mov r9d, 0x41
jmp 0x14044221f
call fcn.1403abf97
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movsx rdx, dx
movzx rdx, r10w
bswap rdx
mov edx, ebx
jmp 0x14044223e
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
mov dl, 0xfd
mov rax, qword [rcx]
cqo
movsxd rdx, r9d
movzx rdx, di
mov edx, ebp
jmp 0x14044225b
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
movzx bx, dil
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x48
movsx di, cl
cmovne rsi, r11
movzx si, r11b
pop rbx
pop rbp
setnp dil
movzx rsi, r12w
pop rdi
movzx si, sil
pop rsi
jmp 0x140442295
ret
Function at 0x14044317c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
cwde
push rsi
rol al, cl
push rdi
push rbp
movzx ebp, si
movsx rbp, di
push rbx
bt r14w, 0xaf
sal ax, 0x2a
or ebp, 0x39e32be6
sub rsp, 0x60
cmovae di, cx
movaps xmmword [rsp + 0x50], xmm6
mov r14, r9
mov rbx, r8
movsxd rdi, r10d
xchg bp, bp
mov rdi, rdx
cbw
cqo
mov rsi, rcx
movsx rdx, bp
not al
movss xmm6, dword [rsp + 0xb0]
movsx rbp, cx
movzx ebp, byte [rsp + 0xb8]
rdtsc
mov qword [rsp + 0x38], 0
movzx edx, cx
mov rcx, qword [rcx + 8]
bswap dx
cbw
mov rax, qword [rcx]
mov rdx, 0x29152d97
movsx dx, r11b
mov dh, bh
lea rdx, [rsp + 0x38]
jmp 0x14044320c
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
movsx dx, bl
cqo
movzx ecx, r10w
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov dx, 0x3089
movzx rdx, r14w
cqo
lea rdx, [rsp + 0x30]
jmp 0x14044323e
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rdi]
bswap ax
mov rax, qword [rcx]
mov r8d, 1
jmp 0x14044325d
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
cdq
not dx
mov rax, qword [rcx]
xchg dx, dx
mov rdx, rdi
movzx r8d, ax
mov r8d, ebx
jmp 0x14044327e
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
movzx edx, r8w
xchg rdx, rax
movzx dx, r12b
movzx edx, bpl
mov rax, qword [rcx]
jmp 0x14044329d
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
jmp 0x1404432ad
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
movups xmm0, xmmword [r14]
cwd
rdtsc
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
jmp 0x1404432ce
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
cqo
movsx r8, ax
mov r8, qword [rsi + 0x20]
xchg rdx, rax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
movaps xmm3, xmm6
jmp 0x1404432fa
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
movsx eax, ax
movzx eax, r12w
cwde
mov rax, qword [rcx]
jmp 0x140443315
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
jmp 0x140443325
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
clc
add rsp, 0x60
movsx rsi, sp
pop rbx
mov sil, 0xc1
pop rbp
cmovb di, r13w
pop rdi
mov sil, 7
xchg r14b, r14b
bswap rsi
pop rsi
mov r14b, dil
cmovg r14w, dx
pop r14
jmp 0x14044335a
ret
Function at 0x140443c02
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
neg al
shl ax, 0x4a
not r15b
push r14
push rsi
bt rsi, 0xa7
jmp 0x140443c26
push rdi
push rbp
xchg al, dil
stc
push rbx
rcr r15d, 0x4d
test r15b, sil
bt r15d, r8d
sub rsp, 0x88
movzx esi, r12w
setb r15b
mov r15b, r12b
movaps xmmword [rsp + 0x70], xmm8
movsxd r15, esp
xchg al, r14b
movaps xmmword [rsp + 0x60], xmm7
movsxd r15, r14d
cdqe
lahf
movaps xmmword [rsp + 0x50], xmm6
cwde
mov r14, r8
movzx di, r12b
mov rbx, rdx
xchg bpl, r15b
cqo
movzx di, cl
mov r15, rcx
cwde
cmovp si, si
cdq
mov rsi, qword [rsp + 0xe0]
cbw
cmovnp rbp, rax
rdtsc
mov ebp, dword [rsp + 0xf0]
mov edx, dword [rsp + 0xe8]
mov rcx, rsp
mov rdi, qword [r9]
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x140443cb3
call qword [rax + 0x18]
mov rax, qword [rdi]
mov dx, 0x3f4b
movsx dx, r9b
mov rcx, rdi
xchg edx, edx
mov edx, ebp
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
movups xmm0, xmmword [r14]
bswap edx
jmp 0x140443cdb
movaps xmmword [rsp + 0x40], xmm0
movsxd rax, r10d
lahf
mov rax, qword [rcx]
mov r14d, 0x3cc75441
lea r14, [rsp + 0x40]
mov dx, di
mov rdx, r14
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x140443d04
movaps xmm0, xmm7
jmp 0x140443d0c
call fcn.1404b495b
movaps xmm8, xmm0
jmp 0x140443d1a
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140443d26
call fcn.1404b495b
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
movaps xmm0, xmm7
jmp 0x140443d4e
call fcn.1404b495b
movaps xmm6, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404b495b
movss dword [rbx + 8], xmm6
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
cdqe
lahf
cmovns ax, r12w
mov rcx, qword [r15 + 0x18]
mov rax, qword [r15 + 0x20]
jmp 0x140443d84
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
xor r8d, r8d
cmc
cmp r10d, r12d
test r10b, 0xca
nop
clc
jmp 0x140443d9f
cmp word [rsi + r8*2], 0
jmp 0x140443daa
lea r8, [r8 + 1]
jmp 0x140443db3
jne 0x140443d9f
dec r8d
xchg dh, dh
cqo
cmovl dx, r10w
mov rbp, qword [rcx]
bswap r9w
movsx r9, ax
jmp 0x140443dd5
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
cdq
mov dword [rsp + 0x38], 0
movsxd r9, r9d
mov r9d, r8d
setae r9b
mov dword [rsp + 0x30], 2
cdq
mov rdx, rsi
mov r9b, 0x65
mov r9, rdi
jmp 0x140443e09
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
sub r15d, 0x52470164
movaps xmm7, xmmword [rsp + 0x60]
shr r15d, 0x2a
sub esi, 0x80b4d8e
movaps xmm8, xmmword [rsp + 0x70]
xor r14b, al
add rsp, 0x88
bswap si
movzx r14, dx
jmp 0x140443e46
pop rbx
pop rbp
movzx r15w, cl
movsxd rsi, ecx
pop rdi
movsx r14, r11w
movsx r14w, bl
xchg r14d, esi
pop rsi
not r14b
movsxd r14, r15d
pop r14
pop r15
jmp 0x140443e6d
ret
Function at 0x140444efa
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
rol r8b, cl
cmovs r8w, dx
mov r8, rcx
adc ax, r11w
mov eax, 0x5a4d
test r9w, di
clc
cmp word [0x140000000], ax
jne 0x140445024
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rcx + rdx]
cmp dword [rcx], 0x4550
jne 0x140445024
mov eax, 0x20b
test r9b, al
cmp word [rcx + 0x18], ax
jmp 0x140444f53
jne 0x140445024
sub r8, rdx
rcr ah, cl
movzx edx, word [rcx + 0x14]
add rdx, 0x18
lea rdx, [rdx + rcx]
dec ax
movzx eax, word [rcx + 6]
shrd rcx, r14, 0x6c
movsx cx, r12b
lea rcx, [rax + rax*4]
ror r9b, cl
lea r9, [rdx + rcx*8]
jmp 0x140444f8b
mov qword [rsp], rdx
cmp al, 0x50
cmp r10w, r8w
cmp rdx, r9
jmp 0x140444f9d
je 0x140444fe0
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x140444fae
jb 0x140444fd2
mov eax, dword [rdx + 8]
jmp 0x140444fbf
add eax, ecx
test ebx, r13d
jmp 0x140444fc9
cmp r8, rax
jb 0x140444fe3
add rdx, 0x28
jmp 0x140444fdb
jmp 0x140444f8b
sub edx, edx
cmc
test rdx, rdx
jmp 0x140444feb
jne 0x140444ffd
sub al, al
jmp 0x140444ff8
jmp 0x140445033
cmp dword [rdx + 0x24], 0
jmp 0x140445006
jge 0x140445018
xor al, al
jmp 0x140445013
jmp 0x140445033
mov al, 1
jmp 0x14044501f
jmp 0x140445033
sub al, al
jmp 0x14044502b
jmp 0x140445033
add rsp, 0x18
ret

Function at 0x1404456a4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmp r14b, 0x33
cmp bp, ax
mov qword [rsp + 0x10], rsi
xor esi, esp
push rdi
ror sil, 0x3a
sub rsp, 0x20
sbb sil, 6
bswap si
setge dil
mov rsi, rcx
ror edi, 0xb0
mov rdi, rdx
test r11d, r10d
mov rcx, qword [rcx]
jmp 0x1404456e3
cmp rcx, rdx
jmp 0x1404456eb
je 0x140445783
test rcx, rcx
jmp 0x1404456f9
je 0x140445704
call fcn.140234d6a
and qword [rsi], 0
clc
test r11b, dil
test rdi, rdi
je 0x140445783
cmp byte [rdi], 0
movzx rbx, r11w
movzx bx, dil
sete bh
mov rbx, rdi
jmp 0x14044572c
je 0x14044573f
inc rbx
cmc
cmp byte [rbx], 0
jne 0x140445732
sub rbx, rdi
lea rcx, [rbx + 1]
jmp 0x14044574b
call fcn.140179b4c
mov qword [rsi], rax
test r12w, dx
stc
test rax, rax
jmp 0x140445760
je 0x140445783
lea r8, [rbx + 1]
movzx dx, r8b
xchg dl, ch
mov rdx, rdi
mov cx, bx
movzx cx, dl
mov rcx, rax
call fcn.14049fa7b
mov rbx, qword [rsp + 0x30]
sbb ax, 0x34ad
movsx rax, bx
sar eax, 0xea
mov rax, rsi
bt si, r10w
mov rsi, qword [rsp + 0x38]
stc
add rsp, 0x20
pop rdi
jmp 0x1404457ab
ret
Function at 0x140456a91
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
stc
adc rbx, 0x3f827315
push rbp
shr al, 0x9c
mov rbp, rsp
neg rbx
sub rsp, 0x20
shr ah, 0xbf
sub rbx, 0x69f21719
movzx rbx, r10w
mov rax, qword [0x1400b7288]
sar bl, cl
sal bl, 0x9d
movabs rbx, 0x2b992ddfa232
stc
cmp rax, rbx
jne 0x140456b98
and qword [rbp + 0x18], 0
movsx cx, ch
movzx rcx, bp
setg ch
lea rcx, [rbp + 0x18]
jmp 0x140456af3
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140456b02
mov qword [rbp + 0x10], rax
jmp 0x140456b0b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
stc
test si, ax
xor qword [rbp + 0x10], rax
jmp 0x140456b20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
test r14b, 0x9e
xor qword [rbp + 0x10], rax
jmp 0x140456b39
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
rol ecx, 0x64
rcr cx, cl
lea rcx, [rbp + 0x10]
shl rax, 0x20
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
bsf ebp, r11d
movsx ebp, dx
xor rax, rcx
movsx ebp, bp
dec cl
movabs rcx, 0xffffffffffff
and rax, rcx
movabs rcx, 0x2b992ddfa233
sub bp, 0x5c91
cmp rax, rbx
mov bpl, bpl
movzx rbp, di
cmove rax, rcx
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
not rax
shld bp, sp, 0x5e
mov qword [0x1400b7280], rax
test ax, 0x4eac
shrd rbp, r9, 0x89
add rsp, 0x20
cmovg bp, r10w
pop rbp
ret

Function at 0x140456c4b
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
test r8b, 0xf3
cmp r9b, 0x57
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x140456c67
je 0x140456ce9
mov ecx, 0x5a4d
test r9b, 0x99
test r13w, bp
cmp word [rax], cx
jmp 0x140456c82
jne 0x140456ce9
movsxd rcx, dword [rax + 0x3c]
cmc
clc
lea rcx, [rcx + rax]
cmp r8w, 0x63c9
cmp dword [rcx], 0x4550
jmp 0x140456ca3
jne 0x140456ce9
mov eax, 0x20b
clc
jmp 0x140456cb4
cmp word [rcx + 0x18], ax
jmp 0x140456cbd
jne 0x140456ce9
cmp dword [rcx + 0x84], 0xe
jmp 0x140456ccf
jbe 0x140456ce9
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140456ce4
jmp 0x140456cef
xor al, al
test r8b, 0x94
add rsp, 0x28
ret
Function at 0x140468550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test cx, 0x495d
stc
test bp, r15w
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
rcl bpl, 0x56
mov qword [rax + 0x18], rsi
sub bp, 0xc77
mov qword [rax + 0x20], rdi
dec rdi
push r14
setno bpl
movsx r14, bp
shl r14d, cl
sub rsp, 0x20
mov rdi, qword [rsp + 0x50]
btr r14, 0x4a
mov r14, r9
test r12b, 0xf4
sal bpl, cl
shl bpl, 0xb
mov rsi, r8
movzx rbp, r11w
bsf ebp, ecx
mov rbp, rdx
test rdi, rdi
jmp 0x1404685b7
je 0x140468677
mov rbx, qword [r8 + 8]
test r11b, 0x87
test rbx, rbx
je 0x14046865c
mov rax, qword [rbx + 0x40]
shr r8b, cl
movzx r8d, word [r14]
cmp qword [rax], 0
je 0x14046861d
mov rax, qword [rbx + 0x58]
test r15b, cl
cmp dword [rax], 0
jle 0x14046861d
dec dword [rax]
setp dl
not rdx
mov rcx, qword [rbx + 0x40]
cwd
movzx eax, r13w
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x140468614
mov word [rdx], r8w
jmp 0x14046864d
mov rax, qword [rbx]
movsxd rcx, r15d
movzx edx, r8w
not cx
movsxd rcx, eax
movzx cx, r11b
mov rcx, rbx
jmp 0x14046863a
mov rax, qword [rax + 0x18]
jmp 0x140468643
call qword [case.0x1404c7a96.0]
movzx r8d, ax
mov eax, 0xffff
cmp ax, r8w
jne 0x14046865f
mov byte [rsi], 1
add r14, 2
jmp 0x140468668
sub rdi, 1
jmp 0x140468671
jne 0x1404685c5
movups xmm0, xmmword [rsi]
sub r14b, spl
shl r14w, cl
rcl esi, 0x27
mov rbx, qword [rsp + 0x30]
xor si, cx
mov rax, rbp
mov rsi, qword [rsp + 0x40]
or r14w, 0x5bae
add rdi, 0x387b70f8
mov rdi, qword [rsp + 0x48]
rcr r14b, 0x3c
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
movzx r14w, bpl
movsx r14d, ax
pop r14
ret
Function at 0x14046f627
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test esi, 0x18c77c8c
cmp r11d, 0x36b62867
test rbp, rax
mov qword [rax + 8], rbx
ror rbx, 0x58
sbb ebx, eax
mov qword [rax + 0x10], rbp
btr rbx, rsi
mov qword [rax + 0x18], rsi
sub rbp, r15
rcr bl, 0xf3
cmp cl, 0x1c
mov qword [rax + 0x20], rdi
xor sil, 0xa6
adc bh, 0x97
sal sil, cl
push r14
shr ebp, cl
shrd rbx, r13, 0xeb
sub rsp, 0x20
xor sil, 0xcd
test r12w, 0x65f
mov rsi, r9
mov rbx, r8
btr r14, 0x74
sets r14b
mov r14, rdx
mov rbp, rcx
clc
cmc
cmp cx, 0xcf9
test r9, r9
jmp 0x14046f6a2
je 0x14046f796
mov rdi, qword [rdx + 8]
test rdi, rdi
jmp 0x14046f6b4
je 0x14046f778
mov rax, qword [rdi + 0x40]
movsx r8d, r12w
movzx r8d, word [rbx]
test r11b, r9b
cmp qword [rax], 0
jmp 0x14046f6d2
je 0x14046f72a
mov rax, qword [rdi + 0x58]
cmc
cmp bh, 0x70
test ax, sp
cmp dword [rax], 0
jmp 0x14046f6eb
jle 0x14046f72a
dec dword [rax]
movzx rax, di
cqo
not cx
mov rcx, qword [rdi + 0x40]
cdqe
bswap eax
cqo
mov rdx, qword [rcx]
movsx rax, r11w
setbe al
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x14046f71c
mov word [rdx], r8w
jmp 0x14046f725
jmp 0x14046f762
mov rax, qword [rdi]
movzx rcx, r13w
movzx edx, r8w
movzx rcx, dx
mov ch, 0x95
mov rcx, rdi
jmp 0x14046f744
mov rax, qword [rax + 0x18]
jmp 0x14046f74d
call qword [case.0x1404c7a96.0]
movzx r8d, ax
cmp r8w, bp
movzx rax, bx
movsxd rax, r15d
mov eax, 0xffff
test r9, 0x54bc4edd
cmp ax, r8w
jne 0x14046f783
mov byte [r14], 1
cmp r15d, 0x2291ebc
add rbx, 2
sub rsi, 1
jmp 0x14046f790
jne 0x14046f6ac
movups xmm0, xmmword [r14]
movsx rbx, r14w
mov rbx, qword [rsp + 0x30]
mov rax, rbp
movzx r14d, sp
sal r14b, cl
mov rsi, qword [rsp + 0x40]
add r14b, 0x5c
and r14d, r12d
mov rdi, qword [rsp + 0x48]
not r14b
bswap r14w
and r14b, cl
movdqu xmmword [rbp], xmm0
rol bpl, 0x18
rol bpl, cl
mov rbp, qword [rsp + 0x38]
bt r14w, 1
add rsp, 0x20
pop r14
ret
Function at 0x14049c7a5
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp r9w, 0x32d1
and dword [rsp + 0x30], 0
jmp 0x14049c7b9
call fcn.1404a6b12
mov r9d, 2
lea r8, [rsp + 0x30]
mov dl, 0x2d
cwd
mov rcx, qword [rax + 0x28]
xchg dl, dh
cqo
movsx edx, ax
lea edx, [r9 + 0x20]
jmp 0x14049c7e1
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
clc
sub ecx, 0x30
jmp 0x14049c7f5
je 0x14049c841
sub ecx, 1
jmp 0x14049c803
je 0x14049c832
cmp ecx, 1
jmp 0x14049c811
je 0x14049c823
sub eax, eax
jmp 0x14049c81e
jmp 0x14049c84c
mov eax, 3
jmp 0x14049c82d
jmp 0x14049c84c
mov eax, 1
jmp 0x14049c83c
jmp 0x14049c84c
mov eax, 2
test r8w, 0x1d0
add rsp, 0x28
jmp 0x14049c855
ret

Function at 0x14049d5ee
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
stc
sub ecx, ecx
jmp 0x14049d5ff
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x14049d60d
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
adc bl, r12b
not rbx
add rsp, 0x20
movsx bx, r10b
jmp 0x14049d638
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x14049e07b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
stc
test rbp, 0x23a01b85
cmp esp, 0x40585980
mov qword [rsp + 0x18], rbp
cmc
push rsi
push rdi
sal sil, 0xeb
push r12
btc di, dx
cmovle rdi, r14
push r14
sub r14b, 0xff
test rbp, 0x4e590814
push r15
sub rsp, 0x20
mov esi, dword [r8 + 0xc]
bswap r14d
mov r12, rcx
cmovbe r15w, dx
movsx rdi, r14w
mov rcx, r8
mov r14d, 0x343c3012
movzx r15w, r10b
mov rdi, r9
movzx r15d, bx
xchg r14b, r14b
mov r14, r8
xchg r15w, r15w
movsx r15, r10w
mov r15, rdx
jmp 0x14049e0f5
call fcn.1401f7a9a
mov r10, qword [r12]
xor bpl, 0
jmp 0x14049e10c
mov ebp, eax
mov qword [rdi], r10
cmp r15b, 0xa8
test esi, esi
jmp 0x14049e11c
je 0x14049e246
movsxd rax, dword [r14 + 0x10]
sal ecx, cl
setg cl
ror ecx, cl
lea ecx, [rsi - 1]
add si, 0x51b4
mov esi, ecx
bt rbx, r12
movzx ebx, r8w
lea rcx, [rcx + rcx*4]
sub bh, 0x5e
add bh, 0x39
lea rbx, [rax + rcx*4]
clc
add rbx, qword [r15 + 8]
test bl, 0xcd
test bl, r8b
cmp ebp, dword [rbx + 4]
jmp 0x14049e160
jle 0x14049e115
cmp ebp, dword [rbx + 8]
jg 0x14049e115
mov rcx, qword [r15]
bswap rdx
bt rdx, 0xa3
lea rdx, [rsp + 0x50]
stc
cmp r8b, 0xaf
xor r8d, r8d
jmp 0x14049e18c
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
bts r9w, ax
xor ecx, ecx
btc r10, r14
test ax, ax
add r8, qword [rsp + 0x50]
mov r9d, dword [rbx + 0xc]
shr r10w, cl
sbb r10b, r14b
stc
mov r10d, dword [rax]
test r12b, bl
test rsi, 0x3d2070ee
test r9d, r9d
jmp 0x14049e1ca
je 0x14049e202
lea rdx, [r8 + 0xc]
movsxd rax, dword [rdx]
cmp rax, r10
jmp 0x14049e1df
je 0x14049e202
inc ecx
add rdx, 0x14
cmp r9b, 0x9a
cmc
test r12b, 0x4f
cmp ecx, r9d
jmp 0x14049e1fc
jb 0x14049e1d4
cmp ecx, r9d
jmp 0x14049e20a
jae 0x14049e115
mov rax, qword [r12]
clc
sal r12d, cl
sub ebp, 0x3aae0764
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
or r15b, dl
bsr bx, si
dec r15d
mov rcx, qword [rcx + rax]
mov si, r13w
adc sil, r11b
mov qword [rdi], rcx
lahf
add r12w, 0x1c41
mov rbx, qword [rsp + 0x58]
ror r15b, 0x72
shld r15d, r10d, 0xd7
mov rax, rdi
cmp dil, r8b
shr rdi, 0x71
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
cmovbe r15, r13
movzx esi, sp
pop r15
jmp 0x14049e27c
pop r14
cmovns r12d, r12d
pop r12
pop rdi
mov sil, r15b
movsxd rsi, r9d
pop rsi
jmp 0x14049e291
ret