joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403f4967
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
sub r14w, si
test sp, 0x2f30
rol r15b, cl
push r13
mov r15b, dil
stc
cmc
push r12
push rsi
push rdi
sbb r15b, spl
sar r14, cl
push rbx
mov rsi, 0x59604d2
cmp sil, r12b
sub rsp, 0x30
shr rsi, 0x2d
movaps xmmword [rsp + 0x20], xmm6
cmp r12, 0x7902aea
btc r12w, 0xdf
xadd r15w, r12w
mov r15, r9
sar r14b, 0xe1
rcl r13b, 0xa0
mov r12, r8
or r13b, 0x70
dec si
bswap r13d
mov r14, rdx
inc r13b
rcl r13b, 0x89
mov r13, rcx
setnp sil
sbb esi, 0x4d10009b
mov rsi, qword [rcx]
cmp r11d, r11d
test rsi, rsi
jmp 0x1403f49ef
je 0x1403f4b14
mov rbx, qword [r13 + 8]
test di, 0x409b
cmp rsi, rbx
je 0x1403f4abd
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f4a13
jmp 0x1403f4a41
call fcn.140267d8d
movups xmmword [rsi + 0x10], xmm6
cmc
mov byte [rsi], 0
test rcx, rbp
cmp r13d, 0xdf24311
stc
add rsi, 0x20
clc
test bpl, r9b
cmp rsi, rbx
je 0x1403f4ab7
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jmp 0x1403f4a4e
jb 0x1403f4a1d
mov rcx, qword [rsi]
shr rdx, cl
lea rdx, [rax + 1]
jmp 0x1403f4a64
cmp rdx, 0x1000
jb 0x1403f4a18
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp bp, 0x5143
cmp r13d, r9d
sub rcx, rdi
test r14, 0x4ad45844
cmp rcx, 0x20
jmp 0x1403f4a94
jae 0x1403f4ba6
add rax, 0x28
movsx edx, r13w
movzx ecx, cx
movsx rdx, dx
mov rdx, rax
xchg rcx, rcx
mov rcx, rdi
jmp 0x1403f4a18
mov rsi, qword [r13]
rol dl, cl
mov rdx, qword [r13 + 0x10]
stc
sub rdx, rsi
clc
cmp rdx, 0x1000
jb 0x1403f4b07
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
cmp bpl, 0x3e
stc
jmp 0x1403f4ae5
sub rsi, rax
cmp rsi, 0x20
jae 0x1403f4ba6
add rdx, 0x27
not cl
mov rsi, rax
setl cl
movzx ecx, r13w
movzx cx, sil
mov rcx, rsi
jmp 0x1403f4b0f
call fcn.140267d8d
mov qword [r13], r14
shr bx, 3
sar bx, 0xbc
shl r12, 5
btc rbx, 0x15
btr ebx, 0xb6
btr rdi, r10
add r12, r14
xor ebx, 0x3eb243b3
sbb bl, 0x64
mov qword [r13 + 8], r12
bsr rbx, r10
rol r12w, 0x94
shl r15, 5
stc
adc r12w, 0x1eb2
add r15, r14
mov qword [r13 + 0x10], r15
bsf r15w, sp
movaps xmm6, xmmword [rsp + 0x20]
btr r12, r15
bsf r15w, bp
movsx si, cl
add rsp, 0x30
pop rbx
cmovo r14w, r14w
movsx r15, cx
pop rdi
pop rsi
movzx r14, bx
movzx r14w, r13b
not r14b
pop r12
pop r13
movzx r14w, bl
movsx r15d, r15w
pop r14
pop r15
jmp 0x1403f4ba5
ret
call fcn.1404b6b98
int3
Function at 0x1403fe878
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
test r8, r8
jmp 0x1403fe884
je 0x1403fe902
movzx r9d, word [r8]
stc
test r9w, r9w
jmp 0x1403fe898
je 0x1403fe948
sub eax, eax
mov r10, rcx
jmp 0x1403fe8a8
nop dword [rax + rax]
cmp r9b, sil
cmp rdx, rax
jmp 0x1403fe8bb
je 0x1403feaf5
mov word [r10], r9w
movsx r9, ax
add r10, 2
movsx r9w, r8b
movsx r9, dx
movzx r9d, word [r8 + rax*2 + 2]
jmp 0x1403fe8e1
inc rax
test r12w, ax
cmp ah, 0xf4
test r9w, r9w
jmp 0x1403fe8f4
jne 0x1403fe8b3
sub rdx, rax
jmp 0x1403fe953
movzx r9d, word [0x1400b8f10]
test dl, r13b
cmp r8b, sil
clc
test r9w, r9w
jmp 0x1403fe91a
je 0x1403fe961
cmp rdx, 0x104
movzx r8w, al
not r8b
mov r8d, 0x104
jmp 0x1403fe93a
cmovb r8, rdx
jmp 0x1403fe943
jmp 0x1403fea81
mov r10, rcx
test sil, r14b
test bp, 0x4393
test rdx, rdx
jne 0x1403feaf5
jmp 0x1403feaff
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
sbb r10d, 0x28193c8a
xchg r9b, r10b
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
sal r10w, 0x21
shr r9, 0x26
movzx r8d, word [rax + 0x58]
or r11w, 0x3589
shld r9d, r10d, 0xb7
cmp r8, rdx
bswap r9w
cmovl r10w, di
cmovae r8, rdx
mov r9, qword [rax + 0x60]
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
test bx, 0x28c5
cmc
test r11w, r11w
jmp 0x1403fe9c7
je 0x1403fea20
xor eax, eax
nop word cs:[rax + rax]
test ch, 0x60
cmp r8, rax
je 0x1403fea2e
mov word [r10], r11w
add r10, 2
bswap r11d
jmp 0x1403fe9fd
movzx r11d, word [r9 + rax*2 + 2]
inc rax
jmp 0x1403fea0f
test r11w, r11w
jne 0x1403fe9e0
sub r8, rax
stc
test bl, 0x34
test r8, r8
jmp 0x1403fea28
je 0x1403fea3e
mov word [r10], 0
rol r9w, 0x70
mov r8w, 0x1376
movzx r9d, word [0x1400b8f10]
cmp rdx, 0x104
movzx r8, di
mov r8d, 0x104
movsx r10d, dx
cmovb r8, rdx
sbb r10b, r13b
cmp r11w, 0x2c93
shr r10b, 0xa
mov r10, rcx
cmp r10b, 0xbe
test sil, 0x24
test r9w, r9w
je 0x1403feae7
sub edx, edx
bsr r10w, r15w
lea rax, [0x1400b8f10]
mov r10, rcx
nop dword [rax + rax]
test edx, 0x1a630b91
cmp r8, rdx
jmp 0x1403feaa8
je 0x1403feaf5
mov word [r10], r9w
shl r9b, 0x72
add r10, 2
mov r9b, bpl
movzx r9d, word [rax + rdx*2 + 2]
jmp 0x1403feac8
inc rdx
stc
cmc
clc
test r9w, r9w
jmp 0x1403fead7
jne 0x1403feaa0
sub r8, rdx
stc
jmp 0x1403feae7
test r8, r8
jmp 0x1403feaef
je 0x1403feaff
mov word [r10], 0
movzx rdx, r14w
movabs rax, 0xe039ec0d24fefd13
mov qword [rsp], rax
movabs rax, 0x2247bce40ef3a5e6
movsx rdx, di
mov dx, 0x7d51
mov qword [rsp + 8], rax
movzx dx, ah
movabs rdx, 0xe05dec612491fd3d
jmp 0x1403feb37
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rax
bswap eax
cmove ax, r11w
lea rax, [rsp + 0x10]
jmp 0x1403feb52
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
test sp, dx
cmp r14b, 0xd6
nop word cs:[rax + rax]
test r15d, 0x6b28670c
cmp word [rcx + 2], 0
jmp 0x1403feb8a
lea rcx, [rcx + 2]
jne 0x1403feb80
test ax, ax
jmp 0x1403feb9c
je 0x1403febdb
lea rdx, [rsp + 2]
nop word cs:[rax + rax]
mov word [rcx], ax
add rcx, 2
movzx eax, word [rdx]
stc
cmp al, 0xc2
cmc
add rdx, 2
cmp r14, 0x6a4c214d
cmc
stc
test ax, ax
jmp 0x1403febd5
jne 0x1403febb2
mov word [rcx], 0
add rsp, 0x28
jmp 0x1403febe9
ret
Function at 0x14042c359
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
and r15w, 0x75d0
clc
push r14
btr r14w, 0xdb
sar r15b, cl
push r12
bsr r15d, esi
ror r12, 0x1f
push rsi
or r12, 0x65406d7b
or r12d, ebx
inc r14d
push rdi
push rbp
sub r14b, r15b
sal r12w, cl
rcl edi, cl
push rbx
sub rsp, 0x20
btr r15w, 0x62
adc bp, 0x7c25
mov r12, r8
mov edi, edx
jmp 0x14042c3ad
mov rbx, rcx
shld r14w, r9w, 0xe7
test r14b, bpl
lea r14, [rcx + 0x38]
btc r15w, 0xa6
btr r15d, 0xef
not ebp
lea r15, [rcx + 0x39]
mov ebp, 0x80
xor esi, esi
jmp 0x14042c3da
jmp 0x14042c421
lea rcx, [rax + 1]
jmp 0x14042c3e8
mov qword [rbx + 0xc0], rcx
jmp 0x14042c3f4
movzx eax, byte [rax]
jmp 0x14042c3fc
mov byte [r12 + rsi], al
jmp 0x14042c405
inc rsi
clc
cmp r14w, 0x78e4
shr ebp, 1
stc
cmp rsi, 4
jmp 0x14042c41b
je 0x14042c574
test ebp, edi
je 0x14042c405
cmp qword [rbx + 0x10], 0
jmp 0x14042c433
je 0x14042c45c
mov rcx, qword [rbx + 0x28]
jmp 0x14042c442
call qword [rbx + 0x20]
test eax, eax
je 0x14042c50a
cmp dword [rbx + 0x30], 0
jmp 0x14042c456
je 0x14042c571
mov rax, qword [rbx + 0xc0]
movsx ecx, r9w
sbb rcx, 0x18d00985
xor cl, r8b
mov rcx, qword [rbx + 0xc8]
cmp di, r8w
cmp rax, rcx
jmp 0x14042c484
jae 0x14042c571
cmp rax, rcx
jmp 0x14042c492
jb 0x14042c3df
cmp dword [rbx + 0x30], 0
jmp 0x14042c4a1
je 0x14042c52a
mov r8d, dword [rbx + 0x34]
mov rcx, qword [rbx + 0x28]
cwd
mov rdx, r14
jmp 0x14042c4b9
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xd0]
cmp r15b, 0xc8
jmp 0x14042c4d1
add dword [rbx + 0xb8], ecx
test esp, edx
jmp 0x14042c4de
test eax, eax
jmp 0x14042c4e5
je 0x14042c536
movsxd rcx, eax
movsx eax, cx
xchg al, al
add rcx, r14
movsxd rax, r15d
movzx eax, di
movzx eax, byte [r14]
jmp 0x14042c505
jmp 0x14042c554
mov rax, qword [rbx + 0xc0]
cmp r9b, r14b
mov rcx, qword [rbx + 0xc8]
cmc
cmp rax, rcx
jae 0x14042c498
jmp 0x14042c3df
xor eax, eax
jmp 0x14042c531
jmp 0x14042c3fc
mov dword [rbx + 0x30], 0
test sp, r9w
sar ecx, cl
mov byte [rbx + 0x38], 0
xor eax, eax
movsxd rcx, ebx
mov rcx, r15
jmp 0x14042c554
mov qword [rbx + 0xc8], rcx
jmp 0x14042c560
mov qword [rbx + 0xc0], r15
jmp 0x14042c56c
jmp 0x14042c3fc
sub r12d, r12d
mov rax, r12
rcl bp, 0x78
shr r12, 0xbb
sub esi, edi
add rsp, 0x20
movzx r15d, bx
movsxd rdi, r15d
movsx edi, r11w
pop rbx
pop rbp
mov r14, 0x353408ae
seto dil
mov r14w, r8w
pop rdi
jmp 0x14042c5b0
pop rsi
setnp r15b
pop r12
not r14b
bswap r14
pop r14
pop r15
jmp 0x14042c5c6
ret
Function at 0x140440263
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
clc
movzx eax, r11w
push r14
shld r14w, r15w, 0x46
btc rax, 0x5e
push rsi
push rdi
push rbp
or sil, 0x7e
push rbx
sub rsp, 0x38
shld rdi, rdi, 0xbc
mov edi, r8d
btr esi, 0xac
or rax, r9
mov r14, rdx
sub al, r9b
mov ah, 0x53
mov rsi, rcx
mov rax, qword [rdx]
cmp dword [rax + 0x10], r8d
jmp 0x1404402aa
jne 0x14044032d
test r9d, r9d
jmp 0x1404402b8
je 0x140440473
lea rcx, [rsp + 0x20]
rol dx, 0x50
shl dx, 7
xor dl, r13b
mov rdx, r14
xor r8d, r8d
call fcn.14043f2f8
mov dword [rsi + 4], 0
jmp 0x1404402e5
mov dword [rsi + 0xc], 0
jmp 0x1404402f1
mov dword [rsi + 0x10], edi
jmp 0x1404402f9
movss xmm0, dword [rsp + 0x30]
jmp 0x140440304
subss xmm0, dword [rsp + 0x2c]
movss dword [rsi + 8], xmm0
jmp 0x140440314
movss xmm0, dword [rsp + 0x24]
jmp 0x14044031f
movss dword [rsi], xmm0
jmp 0x140440328
jmp 0x140440515
mov dword [rsi + 4], 0
seta cl
rcr dx, 0x39
lea rcx, [rsp + 0x20]
sub ebx, ebx
mov rdx, r14
clc
cmp dx, r12w
xor r8d, r8d
jmp 0x140440352
call fcn.14043f2f8
mov eax, dword [rsp + 0x34]
cmc
cmp eax, edi
jmp 0x140440363
jle 0x140440375
sub ebp, ebp
mov cl, r8b
mov ecx, eax
jmp 0x1404403e1
xor ebx, ebx
movzx r15d, r15w
lea r15, [rsp + 0x20]
xchg bpl, bpl
nop word cs:[rax + rax]
mov ebp, ebx
movsxd rbx, r10d
mov ebx, eax
jmp 0x140440399
movss xmm0, dword [rsp + 0x28]
jmp 0x1404403a4
addss xmm0, dword [rsi + 4]
movss dword [rsi + 4], xmm0
mov rcx, r15
not dh
movsx dx, sil
mov rdx, r14
xchg r8w, r8w
mov r8d, eax
jmp 0x1404403c7
call fcn.14043f2f8
mov ecx, dword [rsp + 0x34]
sub eax, r14d
lea eax, [rcx + rbx]
cmp sil, al
cmp eax, edi
jle 0x14044038d
mov dword [rsi + 0xc], ebx
mov dword [rsi + 0x10], ecx
jmp 0x1404403ec
movss xmm0, dword [rsp + 0x30]
jmp 0x1404403f7
subss xmm0, dword [rsp + 0x2c]
movss dword [rsi + 8], xmm0
stc
mov dword [rsi + 0x14], ebp
cmc
cmp r9d, eax
movss xmm0, dword [rsp + 0x20]
movss dword [rsi], xmm0
jmp 0x140440419
cmp ebx, edi
jge 0x140440515
sub edi, ebx
bswap rdx
bt cx, 0x52
sub ebp, ebp
movzx r8, r11w
mov cl, dil
nop dword [rax]
mov rcx, r14
cqo
mov edx, ebx
cmovae r8, rdx
movzx r8, ax
mov r8d, ebp
jmp 0x140440452
call fcn.14043fa74
addss xmm0, dword [rsi]
movss dword [rsi], xmm0
jmp 0x140440464
inc ebp
cmp edi, ebp
jne 0x14044043b
jmp 0x140440515
xorps xmm0, xmm0
movlps qword [rsi], xmm0
mov dword [rsi + 8], 0x3f800000
cmp sil, 0xac
test al, sil
xor eax, eax
test r12, 0x28343ee3
test edi, edi
jle 0x1404404ed
lea rbp, [rsp + 0x20]
movsx dx, spl
movsx r8, si
movzx bx, bh
nop word cs:[rax + rax]
not ecx
mov ebx, eax
cqo
movsx ecx, r10w
cdq
mov rcx, rbp
cmovge r8d, r12d
not r8b
mov rdx, r14
mov r8d, eax
jmp 0x1404404d5
call fcn.14043f2f8
mov eax, dword [rsp + 0x34]
add eax, ebx
cmp eax, edi
jl 0x1404404b7
jmp 0x1404404f8
xor ebx, ebx
rol dil, cl
xchg dil, dil
shr di, cl
mov dword [rsi + 0xc], eax
movsx r14, si
rcr rdi, 0xd4
mov dword [rsi + 0x10], 0
mov dword [rsi + 0x14], ebx
bt di, si
sal rdi, 0x28
add rsp, 0x38
cmovo di, bp
movzx rsi, bp
pop rbx
movsx r14w, sil
mov bp, r11w
xchg rdi, rdi
pop rbp
mov r14, rcx
xchg dil, dil
pop rdi
movsx r15w, r9b
jmp 0x140440540
pop rsi
pop r14
pop r15
jmp 0x14044054a
ret
Function at 0x14044465a
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140444663
movzx ecx, cx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp rsp, 0x20f06384
cmp eax, 0x100
setae al
cmp r9b, 0x62
jmp 0x140444687
add rsp, 0x28
ret

Function at 0x140445e3f
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movsx eax, si
setne ah
mov rax, qword [rcx]
jmp 0x140445e54
call qword [rax + 0x28]
test eax, eax
jmp 0x140445e5e
je 0x140445e8e
mov ecx, eax
adc r9w, sp
neg dl
movabs r8, 0xcafa59766d7f94e
inc dl
mov dl, 3
mov r9d, 0x2a
add rsp, 0x28
jmp 0x140445e89
jmp fcn.1403afd79
nop
add rsp, 0x28
ret
Function at 0x140448d9d
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
bts ax, r11w
neg r8w
mov r8, rcx
shr al, cl
mov eax, 0xd20053a
add ax, r8w
mov eax, 0x5a4d
cmc
test rbx, r9
cmp word [0x140000000], ax
jne 0x140448eed
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp r8b, 0x39
test r12w, 0x10c2
cmp dword [rcx], 0x4550
jmp 0x140448df4
jne 0x140448eed
mov eax, 0x20b
stc
cmp word [rcx + 0x18], ax
jmp 0x140448e09
jne 0x140448eed
sub r8, rdx
stc
btr ax, si
movzx edx, word [rcx + 0x14]
test r10d, r14d
movzx r9d, cx
sal ax, cl
add rdx, 0x18
sub ah, 0xce
add al, r10b
add rdx, rcx
movsx r9w, r15b
bsf ax, cx
movzx eax, word [rcx + 6]
dec r9b
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp bl, r14b
cmp rbp, 0x20126dd1
mov qword [rsp], rdx
clc
test eax, eax
jmp 0x140448e60
cmp rdx, r9
jmp 0x140448e68
je 0x140448eb1
mov ecx, dword [rdx + 0xc]
clc
cmc
cmp rdi, 0x54b9691d
cmp r8, rcx
jmp 0x140448e82
jb 0x140448ea3
mov eax, dword [rdx + 8]
cmc
add eax, ecx
clc
cmp r14w, 0xf9a
cmp r8, rax
jmp 0x140448e9d
jb 0x140448eb6
add rdx, 0x28
jmp 0x140448eac
jmp 0x140448e54
xor edx, edx
cmp spl, r13b
test rdx, rdx
jne 0x140448ecb
sub al, al
jmp 0x140448ec6
jmp 0x140448efc
cmp dword [rdx + 0x24], 0
jge 0x140448ee1
sub al, al
jmp 0x140448edc
jmp 0x140448efc
mov al, 1
jmp 0x140448ee8
jmp 0x140448efc
sub al, al
jmp 0x140448ef4
jmp 0x140448efc
add rsp, 0x18
jmp 0x140448f05
ret
Function at 0x14045a91f
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
jmp 0x14045a92d
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
clc
cmp r11w, 0x1ebd
add rsp, 0x28
ret

Function at 0x14045f6fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r15b, dl
cmc
mov qword [rax + 0x10], rbx
test bpl, 0x70
cmc
mov qword [rax + 0x18], rbp
rol bp, 0xe7
push rsi
push rdi
push r12
xor bp, r15w
push r14
movsx bp, r14b
cmc
bswap bp
push r15
cmovne ebp, r9d
adc r15b, 0xe1
movsx ebp, r11w
sub rsp, 0x40
adc bp, 0x71bf
and bpl, cl
ror bpl, 0x4c
sub r12d, r12d
bt bp, 0x2f
mov r15, r8
mov qword [rax + 0x20], r12
adc ebp, edx
or rdi, 0xffffffffffffffff
mov rbp, rcx
inc rdi
stc
jmp 0x14045f767
cmp byte [rdi + rcx], r12b
jmp 0x14045f770
jne 0x14045f75b
add rdi, 1
movzx r14d, si
not sil
mov rbx, r12
not r14
movzx si, r14b
movsx esi, r8w
mov rsi, rdi
movzx r14, bp
mov r14, rcx
je 0x14045f7fa
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], r15
jmp 0x14045f7b5
mov r8, rsi
bswap cx
movsx ecx, r8w
lea rcx, [rsp + 0x70]
mov rdx, r14
jmp 0x14045f7cc
call fcn.140459e50
test eax, eax
jmp 0x14045f7d8
jle 0x14045f7fa
cdqe
inc rbx
add r14, rax
jmp 0x14045f7ec
sub rsi, rax
jmp 0x14045f7f4
jne 0x14045f7a0
inc rbx
movsxd rcx, r9d
cdq
mov edx, 2
mov ecx, r15d
mov rcx, rbx
call fcn.14018b8e0
mov r14, rax
cmp ax, r10w
stc
test rax, rax
je 0x14045f8fb
mov qword [rsp + 0x30], r12
sbb rsi, 0x7b8c12de
mov esi, 0x569144e9
mov rsi, rax
test rbx, rbx
jmp 0x14045f83e
je 0x14045f892
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
mov r8d, ebp
mov r8, rdi
cwd
movsx rcx, dx
movzx rcx, ax
mov rdx, rbp
movsx cx, cl
mov rcx, rsi
jmp 0x14045f86d
call fcn.140459e50
test eax, eax
jle 0x14045f892
cdqe
stc
add rsi, 2
add rbp, rax
cmc
cmp bl, 2
sub rbx, 1
jne 0x14045f844
lea r11, [rsp + 0x40]
mov word [rsi], r12w
cmovp ax, r12w
movsx di, r11b
mov rbx, qword [r11 + 0x38]
movsx si, dil
movsxd r12, r15d
cwde
mov rax, r14
mov rbp, qword [r11 + 0x40]
movzx r15d, r13w
movsx di, bpl
mov rsp, r11
movzx di, cl
mov r14, r12
pop r15
movsx r12w, r15b
cmovo r12, rbp
movsx r12d, r8w
pop r14
xchg di, r12w
cmovnp rsi, r14
pop r12
pop rdi
setb sil
movsxd rsi, r9d
cmovp si, r13w
pop rsi
jmp 0x14045f8fa
ret
call fcn.1404595e3
int3
Function at 0x14049fa28
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
shr rsi, 0x45
push rdi
push r12
push r14
push r15
ror r15w, 0xf7
sub rsp, 0x20
test rdx, rdx
movsx rsi, ax
xchg rdi, rbp
lea r14, [rsp + 0x50]
movsx si, sil
setbe bpl
mov rsi, rcx
mov dil, 0x6d
movzx r15w, r10b
cmovb rdi, r10
mov rdi, rcx
movzx r15d, cx
movzx bp, r10b
movzx ecx, byte [rcx]
cmovne r14, rdx
setnp bpl
movsx ebp, bp
mov bpl, al
mov r15, r9
xchg bpl, bpl
bswap bp
mov ebp, r8d
jmp 0x14049fa9c
jmp 0x14049faac
inc rdi
movzx ecx, byte [rdi]
jmp 0x14049faac
call fcn.1404b8af4
test eax, eax
jne 0x14049faa1
mov bl, byte [rdi]
xor ax, 0x77f4
lea eax, [rbx - 0x2b]
test al, 0xfd
jmp 0x14049fac9
je 0x14049fad6
mov bl, 0x2b
jmp 0x14049fadd
inc rdi
movsx r9, dx
mov r9, r15
movsx dx, dil
movsxd rcx, ebp
mov r8d, ebp
movsx ecx, bp
cmovs rdx, r9
movsxd rdx, r13d
mov rdx, r14
mov ch, 0xd3
mov rcx, rdi
jmp 0x14049fb03
call fcn.14049fc43
mov rcx, rax
mov bpl, 0x2d
mov r12w, bx
bt r12d, 0x11
movabs r12, 0x8000000000000000
jmp 0x14049fb26
cmp rdi, qword [r14]
jmp 0x14049fb2e
jne 0x14049fb41
mov qword [r14], rsi
jmp 0x14049fb3c
jmp 0x14049fb4f
cmp rsi, qword [r14]
jmp 0x14049fb49
jne 0x14049fb58
test rcx, rcx
jne 0x14049fb9a
cmp bl, 0x2b
jmp 0x14049fb60
jne 0x14049fb7e
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
jmp 0x14049fb78
ja 0x14049fb9a
cmp bl, bpl
jmp 0x14049fb86
jne 0x14049fbde
cmp rcx, r12
jmp 0x14049fb94
jbe 0x14049fbde
call fcn.1404b5eee
mov dword [rax], 0x22
test r15, r15
jmp 0x14049fbad
je 0x14049fbbe
mov dword [r15], 1
cmp r14b, 0xf5
sub bl, bpl
stc
cmp bpl, 0xd7
jmp 0x14049fbcb
neg bl
jmp 0x14049fbd2
sbb rax, rax
cmc
add rax, r12
jmp 0x14049fbfd
mov rax, rcx
rcl r15w, cl
neg rax
shrd r12, rsp, 0xca
cmc
cmp bl, bpl
xchg rbx, r12
cmove rcx, rax
mov rax, rcx
ror ebx, cl
mov rbx, qword [rsp + 0x58]
ror dil, 0x87
movsx si, sil
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
movsx r12, dx
cmovp r12w, bp
movzx di, r8b
pop r15
movsx r12w, r13b
pop r14
pop r12
bswap di
movzx edi, r8w
pop rdi
mov sil, r10b
movzx rsi, di
pop rsi
jmp 0x14049fc42
ret

Function at 0x1404a0c88
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test bx, r14w
and dword [rsp + 0x30], 0
jmp 0x1404a0c9a
call fcn.1404ab0e9
mov r9d, 2
lea r8, [rsp + 0x30]
movzx cx, r11b
movzx rcx, r12w
mov rcx, qword [rax + 0x28]
movzx dx, r8b
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmc
sub ecx, 0x30
jmp 0x1404a0cd4
je 0x1404a0d20
sub ecx, 1
jmp 0x1404a0ce2
je 0x1404a0d11
cmp ecx, 1
jmp 0x1404a0cf0
je 0x1404a0d02
sub eax, eax
jmp 0x1404a0cfd
jmp 0x1404a0d2f
mov eax, 3
jmp 0x1404a0d0c
jmp 0x1404a0d2f
mov eax, 1
jmp 0x1404a0d1b
jmp 0x1404a0d2f
mov eax, 2
jmp 0x1404a0d2f
add rsp, 0x28
jmp 0x1404a0d38
ret
Function at 0x1404a1a11
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
bt ebx, ebx
push rdi
sub rsp, 0x40
mov bh, bh
movsx ebx, r15w
mov rbx, rcx
jmp 0x1404a1a2a
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rsi, qword [rbx + 0xf8]
not rdx
btc dx, bp
sub edi, edi
xor dh, 0x7b
shr cx, 0x15
sub r8d, r8d
cqo
movzx dx, ah
movzx ecx, cx
lea rdx, [rsp + 0x60]
movsx cx, r12b
mov rcx, rsi
jmp 0x1404a1a65
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
jmp 0x1404a1a73
je 0x1404a1af9
and qword [rsp + 0x38], 0
rcr rcx, 0x6b
movzx dx, r12b
cmp r13w, r14w
lea rcx, [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
movzx r8d, cx
sub r9b, 0x23
mov r9, rax
sar r8d, cl
btr r8, r11
test r9w, r9w
mov qword [rsp + 0x30], rcx
test dx, r14w
movzx ecx, di
mov r8, rsi
lea rcx, [rsp + 0x70]
test edx, 0x10003c64
clc
mov qword [rsp + 0x28], rcx
sub ecx, ecx
jmp 0x1404a1ad3
mov qword [rsp + 0x20], rbx
jmp 0x1404a1add
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
inc edi
cmc
jmp 0x1404a1aeb
cmp edi, 2
jmp 0x1404a1af3
jl 0x1404a1a47
add rsp, 0x40
xchg si, si
movzx ebx, r14w
pop rdi
pop rsi
bswap bx
pop rbx
jmp 0x1404a1b0f
ret
Function at 0x1404af051
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
sar eax, 0x45
shrd ebx, ebp, 0x83
mov qword [rsp + 0x10], rsi
shr bx, 0x69
rcr dh, 0xf0
push rdi
cqo
xadd r8b, bl
or bl, r9b
sub rsp, 0x20
add qword [rcx + 0x20], 8
lahf
mov rdi, rcx
and r8, r13
adc r8b, r11b
mov rax, qword [rcx + 0x20]
shr rbx, 4
mov esi, dword [rcx + 0x38]
xor dh, bl
movsx bx, al
dec ebx
cmp esi, 0xffffffff
mov r8b, 7
movzx rbx, dx
mov r8d, dword [rcx + 0x3c]
cdq
not dh
mov bx, sp
movzx edx, word [rcx + 0x42]
movzx ebx, r9w
mov rbx, qword [rax - 8]
cbw
movsx ax, sil
lahf
mov eax, 0x7fffffff
jmp 0x1404af0cb
mov qword [rcx + 0x48], rbx
cmove esi, eax
jmp 0x1404af0d7
mov rcx, qword [rcx]
jmp 0x1404af0df
call fcn.14011133e
test al, al
je 0x1404af12b
test rbx, rbx
jmp 0x1404af0f4
jne 0x1404af10d
lea rbx, [0x1400d25f0]
movsxd rcx, r15d
xchg dl, ch
mov qword [rdi + 0x48], rbx
movsx ecx, si
movsxd rdx, esi
mov rcx, rbx
jmp 0x1404af118
mov byte [rdi + 0x54], 1
jmp 0x1404af121
call fcn.140239c16
jmp 0x1404af1ae
test rbx, rbx
jne 0x1404af144
lea rbx, [0x1400ced98]
cmc
mov qword [rdi + 0x48], rbx
cmp r13b, 0x99
sub r9d, r9d
test esi, esi
jmp 0x1404af14e
jle 0x1404af1a7
cmp byte [rbx], 0
je 0x1404af1a7
mov rax, qword [rdi + 8]
movzx edx, byte [rbx]
sal cl, 0x51
mov rcx, qword [rax]
mov rax, qword [rcx]
lea rcx, [rbx + 1]
sar r8w, 0xeb
movzx r8d, word [rax + rdx*2]
and r8d, 0x8000
cmove rcx, rbx
not bx
inc r9d
test cx, 0x7318
shr bx, 3
lea rbx, [rcx + 1]
cmp spl, 0xdf
cmc
cmp r9d, esi
jl 0x1404af154
mov eax, r9d
btr esi, 0xe6
mov dword [rdi + 0x50], eax
sub sil, 4
mov sil, 0xa0
mov al, 1
btc di, 0x93
sal bh, 0x23
mov rbx, qword [rsp + 0x30]
movzx edi, cx
movsx rsi, si
shl dil, 0xa4
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
movsxd rdi, ebp
pop rdi
ret
Function at 0x1404af94a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
sub bx, 0x602e
rol bh, 0xc4
rol ebx, cl
push rdi
xchg bx, bx
sub rsp, 0x30
mov rbx, r15
xor ebp, ebp
mov rbx, rcx
cmc
cmp dil, r15b
cmp byte [rcx + 0x54], bpl
jmp 0x1404af980
jne 0x1404afaab
cmp dword [rcx + 0x50], ebp
jmp 0x1404af98e
jle 0x1404afaab
mov rsi, qword [rcx + 0x48]
movzx rax, cx
cqo
movsx eax, ax
mov edi, ebp
mov r9, qword [rbx + 8]
lea rcx, [rsp + 0x40]
setnp ah
movzx dx, dh
xchg dl, r8b
mov word [rsp + 0x40], bp
movsx r8d, r15w
movzx rdx, r9w
mov rdx, rsi
mov rax, qword [r9]
mov r8w, r14w
mov r8w, 0x3977
movsxd r8, dword [rax + 8]
call fcn.1404d0d89
movsxd r8, eax
test eax, eax
jle 0x1404afa9d
mov rcx, qword [rbx + 0x468]
rcl ax, cl
setb dh
movzx edx, word [rsp + 0x40]
cbw
bts ax, r9w
btr ax, 0x5a
mov rax, qword [rcx + 8]
cmp r8b, 0x10
cmc
cmp qword [rcx + 0x10], rax
jmp 0x1404afa16
jne 0x1404afa46
cmp byte [rcx + 0x18], bpl
jmp 0x1404afa25
je 0x1404afa38
inc dword [rbx + 0x28]
jmp 0x1404afa33
jmp 0x1404afa85
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404afa41
jmp 0x1404afa85
inc dword [rbx + 0x28]
cdqe
dec ax
movsxd rax, r10d
inc qword [rcx + 0x10]
mov al, 0x86
movsx rax, bp
mov rax, qword [rbx + 0x468]
add cx, 0x36ba
mov rcx, qword [rax]
cmp r13w, r11w
xor eax, 0x550a44a8
mov word [rcx], dx
mov rax, qword [rbx + 0x468]
cmc
add qword [rax], 2
test ecx, eax
clc
add rsi, r8
inc edi
test al, ch
test dl, 0x42
cmp edi, dword [rbx + 0x50]
jne 0x1404af9a3
jmp 0x1404afaef
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404afaa6
jmp 0x1404afaef
mov r8d, dword [rbx + 0x50]
cmc
movsx r9w, r15b
lea rax, [rcx + 0x10]
add rdx, 0x47101052
mov rdx, qword [rbx + 0x48]
xchg r9w, r9w
movsx r9, r10w
neg r9w
lea r9, [rcx + 0x28]
add rcx, 0x468
jmp 0x1404afae0
mov qword [rsp + 0x20], rax
jmp 0x1404afaea
call fcn.1404addc6
mov rbx, qword [rsp + 0x48]
mov al, 1
adc di, 0xc69
sal di, cl
cmovge ebp, ebp
mov rbp, qword [rsp + 0x50]
shl sil, 0xdf
ror si, cl
sub sil, dl
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
mov rdi, r9
not di
bswap edi
pop rdi
jmp 0x1404afb27
ret