joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14043d21a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
dec eax
stc
bt ax, r10w
push r14
bts ax, r14w
jmp 0x14043d239
push rsi
push rdi
bts si, bx
add al, dil
sub al, 0xdd
push rbp
cmc
push rbx
neg ah
btc esi, eax
sub rsp, 0x78
movsx eax, r9w
movaps xmmword [rsp + 0x60], xmm8
mov si, r9w
movaps xmmword [rsp + 0x50], xmm7
movzx ax, r15b
xchg rsi, rax
cbw
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [rcx]
bswap si
mov sil, r12b
movzx esi, r15w
mov esi, dword [rax + 0x10]
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
jmp 0x14043d2a0
test esi, esi
jle 0x14043d475
movaps xmm7, xmm2
movaps xmm8, xmm1
mov r15, rcx
xorps xmm6, xmm6
xor edi, edi
cqo
movsxd rdx, r10d
movsx r8, sp
lea r14, [rsp + 0x28]
not dx
movsxd r8, r12d
nop word cs:[rax + rax]
movzx edx, r13w
movzx dx, r12b
xchg r8, rdx
mov rcx, r14
jmp 0x14043d2ec
mov rdx, r15
bswap r8w
not r8w
movzx r8d, di
mov r8d, edi
jmp 0x14043d303
call fcn.14043cf3c
mov ebx, dword [rsp + 0x3c]
cmc
test r11b, r14b
jmp 0x14043d315
test ebx, ebx
jmp 0x14043d31c
jle 0x14043d475
test edi, edi
jne 0x14043d33d
movss xmm0, dword [rsp + 0x34]
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043d468
movss xmm0, dword [rsp + 0x38]
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043d36f
add edi, ebx
jmp 0x14043d357
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x14043d364
jl 0x14043d2e4
jmp 0x14043d475
movss xmm6, dword [rsp + 0x28]
jmp 0x14043d37a
ucomiss xmm6, xmm8
jbe 0x14043d390
mov esi, edi
jmp 0x14043d38b
jmp 0x14043d475
movss xmm0, dword [rsp + 0x2c]
jmp 0x14043d39b
ucomiss xmm0, xmm8
jbe 0x14043d403
xor ebp, ebp
sete cl
mov esi, edi
movaps xmm7, xmm6
nop word cs:[rax + rax]
cqo
mov rcx, r15
movsxd r8, r14d
cdq
mov edx, edi
mov r8w, 0x1264
mov r8d, ebp
call fcn.14043d71d
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x14043d4d4
inc ebp
jmp 0x14043d3e8
inc esi
test r15b, 0xf4
movaps xmm6, xmm7
jmp 0x14043d3f6
cmp ebx, ebp
jmp 0x14043d3fd
jne 0x14043d3bd
test byte [r15 + 0x1c], 4
jne 0x14043d45f
lea esi, [rbx + rdi]
movsx cx, ah
bswap cx
cdqe
dec esi
mov rax, qword [r15]
sar ch, 0x67
movzx cx, dil
movsxd rcx, esi
cmp qword [rax + 0x10], rcx
jmp 0x14043d433
jbe 0x14043d4f1
cmp qword [rax + 0x18], 8
jmp 0x14043d443
jb 0x14043d44f
mov rax, qword [rax]
cmc
cmp ecx, esp
cmp word [rax + rcx*2], 0xa
jmp 0x14043d459
je 0x14043d475
add ebx, edi
mov esi, ebx
jmp 0x14043d475
sub esi, esi
movzx rbx, cx
xor r14b, r10b
movsx bp, dl
mov eax, esi
rcr bpl, cl
stc
movaps xmm6, xmmword [rsp + 0x40]
rol r14b, cl
movaps xmm7, xmmword [rsp + 0x50]
clc
and r15w, 0x66e0
sar dil, cl
movaps xmm8, xmmword [rsp + 0x60]
movzx r14, dx
jmp 0x14043d4a1
add rsp, 0x78
xchg sil, sil
movzx bx, r8b
movsx esi, sp
pop rbx
pop rbp
sete r14b
pop rdi
not r14b
mov sil, bl
pop rsi
pop r14
xchg r15w, r15w
movsx r15, bp
movzx r15d, si
pop r15
jmp 0x14043d4d3
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x14043d475
inc esi
jmp 0x14043d475
call fcn.14043d8c6
int3
Function at 0x14044245a
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140442463
movzx ecx, cx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
add rsp, 0x28
ret

Function at 0x140443bbd
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
cbw
mov rcx, qword [rcx]
cdqe
movsx ax, r12b
lahf
mov rax, qword [rcx]
jmp 0x140443bd6
call qword [rax + 0x28]
test eax, eax
je 0x140443c13
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
ror dl, cl
shl r9b, cl
mov dl, 3
movsx r9w, dil
cmovle r9w, bx
mov r9d, 0x2a
cmc
add rsp, 0x28
jmp 0x140443c0e
jmp fcn.1403ad972
nop
jmp 0x140443c19
add rsp, 0x28
jmp 0x140443c22
ret

Function at 0x140444d54
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
mov r14, rbp
bts rax, r11
push rsi
push rdi
push rbp
cmp sil, dl
neg r14b
push rbx
inc rsi
sub rsp, 0x60
movsx rdi, sp
movaps xmmword [rsp + 0x50], xmm6
lahf
movsx ebx, bp
movsxd rdi, ebp
mov r14, r9
cwde
movzx ebx, r15w
mov rbx, r8
movsx rdi, r13w
xchg sil, dil
movzx rax, cx
mov rdi, rdx
movzx rsi, ax
lahf
mov rsi, rcx
movss xmm6, dword [rsp + 0xb0]
movzx ebp, byte [rsp + 0xb8]
cdq
cmovno edx, edx
mov qword [rsp + 0x38], 0
mov rcx, qword [rcx + 8]
cwd
xchg dh, ah
mov rax, qword [rcx]
cdq
lea rdx, [rsp + 0x38]
jmp 0x140444dd3
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
cqo
bswap edx
mov rcx, qword [rsp + 0x38]
jmp 0x140444df1
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
jmp 0x140444dfe
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
movzx rdx, cx
bswap r8d
cqo
mov rdx, qword [rdi]
movsxd r8, esp
movzx r8w, dil
mov rax, qword [rcx]
mov r8d, 1
jmp 0x140444e2b
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
jmp 0x140444e3b
mov rdx, rdi
setae r8b
mov r8d, ebx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov dl, spl
cmovbe dx, di
movzx edx, bpl
movzx ax, r15b
mov rax, qword [rcx]
jmp 0x140444e65
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
movzx eax, ax
mov rax, qword [rcx]
jmp 0x140444e78
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
cmovge eax, r14d
mov al, 0x7f
movups xmm0, xmmword [r14]
cwd
movzx rdx, r11w
rdtsc
movaps xmmword [rsp + 0x40], xmm0
rdtsc
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
jmp 0x140444ea5
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
jmp 0x140444eb5
mov r8, qword [rsi + 0x20]
mov ax, 0x5f98
movsx dx, sil
cdq
mov rdx, qword [rsp + 0x38]
mov ax, bp
mov rax, qword [rcx]
jmp 0x140444ed3
mov qword [rsp + 0x20], 0
jmp 0x140444ee1
movaps xmm3, xmm6
jmp 0x140444ee9
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
jmp 0x140444efc
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
movzx eax, r12w
mov rax, qword [rcx]
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
cmc
shl r14w, cl
xadd si, bx
add rsp, 0x60
movsx bp, dil
pop rbx
movsx edi, r9w
pop rbp
pop rdi
mov r14, rbp
bswap si
not sil
pop rsi
movsx r14d, r12w
movsxd r14, edx
pop r14
jmp 0x140444f44
ret
Function at 0x1404469d4
Capabilities:
Encrypt data using rc4 prga
Parse pe header

Disassembly:
sub rsp, 0x18
rcl al, 0x6e
setle r8b
mov r8, rcx
movzx ax, bl
adc eax, 0x6cb93ae6
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140446b0b
movsxd rcx, dword [0x14000003c]
ror dl, cl
jmp 0x140446a0c
lea rdx, [0x140000000]
cmc
lea rcx, [rcx + rdx]
cmc
cmp sil, 0xf3
cmp dword [rcx], 0x4550
jmp 0x140446a28
jne 0x140446b0b
mov eax, 0x20b
stc
jmp 0x140446a39
cmp word [rcx + 0x18], ax
jmp 0x140446a42
jne 0x140446b0b
sub r8, rdx
not r9b
movzx dx, r13b
movzx edx, word [rcx + 0x14]
add rdx, 0x18
xor ah, 0x59
lea rdx, [rdx + rcx]
movzx eax, word [rcx + 6]
dec cx
bt cx, 0xfb
and r9w, 0x7b05
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
clc
cmc
mov qword [rsp], rdx
cmp dh, cl
cmp rdx, r9
je 0x140446ac4
mov ecx, dword [rdx + 0xc]
clc
cmp r8, rcx
jmp 0x140446a99
jb 0x140446ab6
mov eax, dword [rdx + 8]
stc
cmp r10b, r15b
add eax, ecx
cmp r8, rax
jmp 0x140446ab0
jb 0x140446aca
add rdx, 0x28
jmp 0x140446abf
jmp 0x140446a7e
xor edx, edx
clc
cmp si, cx
test rdx, rdx
jmp 0x140446ad2
jne 0x140446ae4
xor al, al
jmp 0x140446adf
jmp 0x140446b16
cmp dword [rdx + 0x24], 0
jmp 0x140446aed
jge 0x140446aff
xor al, al
jmp 0x140446afa
jmp 0x140446b16
mov al, 1
jmp 0x140446b06
jmp 0x140446b16
sub al, al
jmp 0x140446b16
add rsp, 0x18
jmp 0x140446b1f
ret

Function at 0x1404584ea
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movzx ecx, r15w
cmove cx, r8w
jmp 0x1404584fc
lea rcx, [rsp + 0x30]
jmp 0x140458506
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
clc
test rsp, 0x673041f5
add rsp, 0x28
jmp 0x140458522
ret

Function at 0x1404585da
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
movsx ebx, r14w
mov rbp, rsp
and rax, 0x21030c76
shr ah, cl
sub rsp, 0x20
sar eax, 0xf5
neg ax
mov rax, qword [0x1400b7288]
dec bl
inc bx
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x140458618
jne 0x1404586c8
and qword [rbp + 0x18], 0
jmp 0x140458628
lea rcx, [rbp + 0x18]
jmp 0x140458631
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140458640
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x140458655
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
cmc
xor qword [rbp + 0x10], rax
jmp 0x14045866b
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
btc cx, 0xb6
cmc
lea rcx, [rbp + 0x10]
stc
test r10d, 0x9244c43
shl rax, 0x20
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
xor rax, rcx
movabs rcx, 0xffffffffffff
and rax, rcx
shr bp, 0x96
movabs rcx, 0x2b992ddfa233
or bp, bp
cmp rax, rbx
movsx bp, r14b
cmove rax, rcx
shl ebp, cl
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
test dil, dl
not rax
bsr rbp, r14
mov qword [0x1400b7280], rax
add rsp, 0x20
movzx ebp, ax
setns bpl
cmovg ebp, r9d
pop rbp
ret
Function at 0x14045d1c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp rcx, rdi
jmp 0x14045d1dc
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
movsx rbp, sp
btr rbp, rdx
push rsi
rcr ebp, cl
movsx bp, bpl
push rdi
movsx bp, cl
sub rbp, 0x12755d25
ror ebp, 0xa3
push r12
push r14
shl bpl, 5
xor bp, r13w
movsx rbp, r12w
push r15
btr r15w, 0xe3
btc ebp, r12d
jmp 0x14045d224
sub rsp, 0x40
adc bpl, 0xdd
xor r12d, r12d
mov r15, r8
test bpl, r12b
mov qword [rax + 0x20], r12
btc rbp, r14
btr bp, 0xd5
or bpl, bpl
or rdi, 0xffffffffffffffff
sete bpl
mov rbp, rcx
jmp 0x14045d255
inc rdi
stc
cmp spl, bl
cmp ah, 4
cmp byte [rdi + rcx], r12b
jmp 0x14045d268
jne 0x14045d255
add rdi, 1
mov bx, 0x7a8b
movsx esi, si
not ebx
mov rbx, r12
cmovbe si, r14w
xchg r14b, r14b
movzx r14d, bx
mov rsi, rdi
movzx r14w, cl
mov r14, rcx
je 0x14045d2f9
lea r9, [rsp + 0x88]
movsx rcx, r15w
mov qword [rsp + 0x20], r15
cdq
cmovl r8w, r12w
mov r8, rsi
movsx edx, di
lea rcx, [rsp + 0x70]
setae dl
mov rdx, r14
call fcn.140457a3e
test eax, eax
jmp 0x14045d2cf
jle 0x14045d2f9
cdqe
jmp 0x14045d2dc
inc rbx
clc
cmp bx, 0x79b0
test bpl, bpl
add r14, rax
sub rsi, rax
jmp 0x14045d2f3
jne 0x14045d29b
inc rbx
movsx rcx, r11w
cdq
not cl
mov edx, 2
mov cl, 0xfe
movzx cx, r13b
movzx rcx, cx
mov rcx, rbx
call fcn.1401d39fe
mov r14, rax
test dh, dl
test rax, rax
jmp 0x14045d328
je 0x14045d422
mov qword [rsp + 0x30], r12
clc
mov rsi, rax
cmp ah, 0xc7
test rbx, rbx
jmp 0x14045d342
je 0x14045d3b6
lea r9, [rsp + 0x30]
movsxd r8, r9d
jmp 0x14045d358
mov qword [rsp + 0x20], r15
mov r8, rdi
movzx ecx, r13w
not dh
mov cx, r15w
mov rdx, rbp
jmp 0x14045d37b
mov rcx, rsi
call fcn.140457a3e
test eax, eax
jmp 0x14045d38a
jle 0x14045d3b6
cdqe
test r14w, 0x29fb
jmp 0x14045d39d
add rsi, 2
stc
lea rbp, [rbp + rax]
sub rbx, 1
jmp 0x14045d3b0
jne 0x14045d348
lea r11, [rsp + 0x40]
movzx edi, r9w
mov word [rsi], r12w
movzx edi, r8w
mov rbx, qword [r11 + 0x38]
mov rax, r14
bswap si
mov r15, 0x35a06f04
mov rbp, qword [r11 + 0x40]
movsx esi, r11w
jmp 0x14045d3e5
mov rsp, r11
not r15b
mov esi, ebx
movsx r15, si
pop r15
movsx si, r13b
movsxd r14, r13d
mov r12b, r8b
pop r14
xchg r12b, sil
movsxd rsi, r8d
pop r12
mov sil, bpl
movzx di, r9b
pop rdi
mov sil, 0x93
movsx esi, ax
movzx rsi, r12w
pop rsi
jmp 0x14045d421
ret
call fcn.1404571be
int3
Function at 0x14046a19e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test si, 0xfb0
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
shl bp, cl
rcr ebp, 0x2d
sar bp, cl
mov qword [rax + 0x18], rsi
sub bpl, r15b
test r15w, 0x716
mov qword [rax + 0x20], rdi
push r14
btr rdi, 0x3d
test ax, 0x3232
sub rsp, 0x20
neg r14b
ror r14b, cl
mov rdi, qword [rsp + 0x50]
mov r14, r9
and sil, 0x24
shr rsi, 0xa7
ror sil, 0xb
mov rsi, r8
test r12w, r14w
btc rbp, rdx
rol rbp, 0xd0
mov rbp, rdx
jmp 0x14046a208
test rdi, rdi
jmp 0x14046a210
je 0x14046a2fa
mov rbx, qword [r8 + 8]
jmp 0x14046a21f
test rbx, rbx
jmp 0x14046a227
je 0x14046a2d8
mov rax, qword [rbx + 0x40]
movzx r8d, word [r14]
cmp qword [rax], 0
jmp 0x14046a23e
je 0x14046a298
mov rax, qword [rbx + 0x58]
jmp 0x14046a24e
cmp dword [rax], 0
jmp 0x14046a256
jle 0x14046a298
dec dword [rax]
bswap dx
cwd
movzx ecx, r10w
mov rcx, qword [rbx + 0x40]
movsx dx, bh
mov rdx, qword [rcx]
mov eax, 0x4c252380
not al
lea rax, [rdx + 2]
jmp 0x14046a282
mov qword [rcx], rax
jmp 0x14046a28a
mov word [rdx], r8w
jmp 0x14046a293
jmp 0x14046a2c2
mov rax, qword [rbx]
movzx edx, r8w
bswap ecx
movsx rcx, r11w
mov cx, bx
mov rcx, rbx
jmp 0x14046a2b0
mov rax, qword [rax + 0x18]
call qword [0x1400b8d90]
movzx r8d, ax
xor ax, 0x5f05
mov eax, 0xffff
stc
test bp, bx
cmp dl, bpl
cmp ax, r8w
jne 0x14046a2df
mov byte [rsi], 1
cmp rsp, r14
stc
add r14, 2
test spl, spl
jmp 0x14046a2eb
sub rdi, 1
jmp 0x14046a2f4
jne 0x14046a21f
movups xmm0, xmmword [rsi]
rcr edi, cl
btr eax, 0x5f
shl bx, 6
mov rbx, qword [rsp + 0x30]
rol edi, 0x79
shr sil, cl
mov rax, rbp
and r14b, 0x16
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
rcl r14w, cl
or r14b, 0xe3
add r14b, r15b
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
shld r14w, r9w, 0x52
rcl r14w, 0xe5
add rsp, 0x20
mov r14, rsp
movsx r14w, r9b
pop r14
jmp 0x14046a356
ret
Function at 0x14049e967
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x14049e975
call fcn.1404a8c9a
mov r9d, 2
movsx r8d, cx
lea r8, [rsp + 0x30]
movsxd rdx, r8d
jmp 0x14049e991
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x14049e99e
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x14049e9f8
sub ecx, 1
jmp 0x14049e9ba
je 0x14049e9e9
cmp ecx, 1
jmp 0x14049e9c8
je 0x14049e9da
xor eax, eax
jmp 0x14049e9d5
jmp 0x14049e9fd
mov eax, 3
jmp 0x14049e9e4
jmp 0x14049e9fd
mov eax, 1
jmp 0x14049e9f3
jmp 0x14049e9fd
mov eax, 2
add rsp, 0x28
ret

Function at 0x14049ea02
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14049ea1e
mov qword [rax + 8], rbx
cmp r9d, 0x61b30be6
clc
jmp 0x14049ea2f
mov qword [rax + 0x10], rsi
ror sil, cl
mov qword [rax + 0x18], rdi
cmp r12w, bx
mov qword [rax + 0x20], r14
test r15d, 0x72d9405f
neg esi
push r15
sub rsp, 0x30
mov rdi, r9
add r14d, r13d
mov rsi, rdx
rcl r15, cl
sub rsi, rcx
sub rdi, r8
not r15
cmp r13w, 0x7762
mov r15, rcx
mov ch, 0xc5
shl ch, 0xa0
sar rsi, 1
or r14b, 0x61
sal r14b, 0x60
shr ch, cl
mov rcx, qword [rsp + 0x60]
sub r14w, 0x40c3
xor r14d, r15d
xor ebx, ebx
sar rdi, 1
adc r14b, r10b
movsx r14w, bpl
sal r14b, cl
mov r14, r8
clc
test rcx, rcx
jmp 0x14049eaac
jne 0x14049eac5
call fcn.1404a8c9a
mov rcx, qword [rax + 8]
jmp 0x14049eac0
jmp 0x14049eace
mov rcx, qword [rcx + 8]
jmp 0x14049eace
test rcx, rcx
jmp 0x14049ead6
jne 0x14049eb62
cmp esi, edi
cbw
setp ah
mov eax, edi
cmovl eax, esi
movsxd rcx, eax
bts ax, di
mov eax, 1
cmp rax, r11
test rcx, rcx
jmp 0x14049eaff
je 0x14049eb32
sub r15, r14
movzx rdx, r13w
movzx edx, word [r15 + r14]
cmp dx, word [r14]
jmp 0x14049eb1a
jne 0x14049eb4c
add r14, 2
sub rcx, rax
jmp 0x14049eb2c
jne 0x14049eb0c
cmp esi, edi
jmp 0x14049eb39
je 0x14049eb5b
or ecx, 0xffffffff
cmp esi, edi
cmovl eax, ecx
jmp 0x14049ebc7
sbb ebx, ebx
and ebx, 0xfffffffe
cmc
test r14b, r11b
add ebx, eax
movsx rax, r13w
mov eax, ebx
jmp 0x14049ebc7
mov dword [rsp + 0x28], edi
movzx r9w, bl
cmovl r8d, edx
not r8b
mov r9d, esi
xchg r8w, r8w
cmovae dx, r14w
mov r8, r15
mov qword [rsp + 0x20], r14
cmove rdx, rsi
mov edx, 0x1000
jmp 0x14049eb94
call fcn.1404c1612
test eax, eax
jmp 0x14049eba0
jne 0x14049ebc0
call fcn.1404b3a01
mov dword [rax], 0x16
mov eax, 0x7fffffff
jmp 0x14049ebbb
jmp 0x14049ebc7
sub eax, 2
bt rbx, r8
mov rbx, qword [rsp + 0x40]
and r14b, bpl
bt r15, 0x29
mov rsi, qword [rsp + 0x48]
test r15w, sp
sal r15w, cl
shrd r15, r10, 0x81
mov rdi, qword [rsp + 0x50]
neg r15b
mov r14, qword [rsp + 0x58]
movzx r15, r11w
add rsp, 0x30
movsxd r15, r10d
mov r15, rsp
pop r15
ret
Function at 0x14049f7e1
Capabilities:
Terminate process

Disassembly:
push rbx
mov bl, ch
sub rsp, 0x20
ror bh, cl
mov rbx, rcx
test ebp, r8d
stc
sub ecx, ecx
jmp 0x14049f7f9
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x14049f807
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx edx, dx
clc
mov edx, 0xc0000409
add rsp, 0x20
mov bx, r8w
not bx
cmove rbx, rcx
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1404a02b0
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 0x10], rbx
cmp dil, 0xb7
mov qword [rsp + 0x18], rbp
stc
push rsi
shl sil, cl
rcr si, 0x88
and sil, 0xf
push rdi
clc
movsx si, bl
push r12
stc
push r14
shr di, cl
movsx r12w, cl
xor r14d, 0x1125849
push r15
mov r12b, spl
sub rsp, 0x20
seta r12b
mov esi, dword [r8 + 0xc]
mov r12, rcx
not r14d
mov rcx, r8
mov r15b, spl
mov rdi, r9
movsxd r14, r14d
movzx r15, bp
mov r14, r8
xchg r15, r15
mov r15, rdx
jmp 0x1404a031a
call fcn.140241c24
mov r10, qword [r12]
sbb ebp, edx
test ax, 0x66e8
mov ebp, eax
mov qword [rdi], r10
cmp bl, 0xba
cmc
test esi, esi
je 0x1404a0434
movsxd rax, dword [r14 + 0x10]
inc ecx
or ch, 0xe1
lea ecx, [rsi - 1]
mov esi, ecx
clc
or bh, bh
lea rcx, [rcx + rcx*4]
movsx ebx, bp
lea rbx, [rax + rcx*4]
add rbx, qword [r15 + 8]
jmp 0x1404a035f
cmp ebp, dword [rbx + 4]
jle 0x1404a0332
cmp ebp, dword [rbx + 8]
jg 0x1404a0332
mov rcx, qword [r15]
cmp r13b, spl
lea rdx, [rsp + 0x50]
sub r8d, r8d
jmp 0x1404a0384
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
cmp sil, r10b
shrd r10w, r10w, 0x7c
sub ecx, ecx
add r8, qword [rsp + 0x50]
movsx r9w, al
shl r10b, 0x36
mov r9d, dword [rbx + 0xc]
adc r10b, 0x3b
shrd r10w, r12w, 0x17
mov r10w, 0x1181
mov r10d, dword [rax]
cmp al, bpl
test r9d, r9d
je 0x1404a03fc
lea rdx, [r8 + 0xc]
bts eax, ebp
movsxd rax, dword [rdx]
test r12w, ax
cmc
cmp rax, r10
je 0x1404a03fc
inc ecx
test r12b, 0xab
cmp cl, 0xfd
add rdx, 0x14
cmp ecx, r9d
jmp 0x1404a03f6
jb 0x1404a03d0
cmp ecx, r9d
jae 0x1404a0332
mov rax, qword [r12]
bt ebx, 0x5c
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
xor r14d, esp
btc bx, r13w
setl sil
mov rcx, qword [rcx + rax]
sub bx, ax
rol r14b, 0x90
mov qword [rdi], rcx
bts rsi, r15
mov rbx, qword [rsp + 0x58]
sbb r12b, r11b
xchg rbp, r14
mov rax, rdi
not r12w
ror dil, 0xc9
mov rbp, qword [rsp + 0x60]
xor r14w, di
shr dil, cl
add rsp, 0x20
not rsi
pop r15
not r12b
mov rdi, 0x54a9289a
movsx r14w, r8b
pop r14
not r12b
movsx rdi, ax
jmp 0x1404a047c
pop r12
movsx esi, cx
movsx rdi, r13w
cmovne rsi, r10
pop rdi
pop rsi
jmp 0x1404a0490
ret
Function at 0x1404a5410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
movzx r10d, bp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
stc
mov r10b, 0xae
btc r10d, r12d
mov qword [rax + 0x18], rsi
movsx r10w, r9b
mov qword [rax + 0x20], rdi
dec bh
or r10b, r14b
push r14
jmp 0x1404a5443
push r15
movzx esi, word [rsp + 0x38]
adc bl, 8
btc ebx, r14d
movsx rbx, di
mov r10, r8
movsxd r8, ebp
xchg r8w, bx
shr r8w, cl
sub r15d, r15d
sub r8b, 0xf8
movsxd r8, edx
mov ebx, ecx
mov ecx, r8d
stc
clc
test si, si
jne 0x1404a5615
mov rax, qword [r9]
and r11w, r10w
rcr r11d, cl
movsx r11w, r8b
mov r11, qword [r10]
jmp 0x1404a5495
cmp rax, 1
jmp 0x1404a549e
jbe 0x1404a55b4
mov eax, 0x66666667
cmovo edx, eax
mov r8, r11
dec cx
sbb dx, 0x3be2
imul ebx
sub cx, dx
sar edx, 2
sar cx, 0xa6
cwde
ror cl, 0x95
mov eax, edx
shr eax, 0x1f
shl cx, 0xd8
add edx, eax
movzx eax, dx
cmovnp rcx, r10
movzx cx, al
shl ax, 2
lea ecx, [rax + rdx]
stc
btc ax, r14w
btc eax, 0x61
add cx, cx
movzx ax, dh
sub bx, cx
shr ax, cl
sbb eax, r15d
bsr ax, r8w
add bx, 0x30
movzx eax, sp
ror rax, 0xf4
xor ah, 0xcf
mov word [r11], bx
cdqe
add r11, 2
setne bh
cmovge bx, r9w
cdqe
mov rax, qword [r9]
bswap bx
mov ebx, edx
jmp 0x1404a5532
dec rax
cmc
test r11b, r10b
test sp, 0x6389
mov qword [r9], rax
stc
cmp rdi, 0x4e875164
test edx, edx
jle 0x1404a5560
cmp rax, 1
jmp 0x1404a555a
ja 0x1404a54a4
mov rdx, qword [r10]
mov qword [r10], r11
jmp 0x1404a556b
jmp 0x1404a55a1
movzx eax, word [rdx]
shld ecx, ecx, 0xae
shl cx, 0xba
test sil, 0x8b
movzx ecx, word [r8]
stc
cmc
mov word [r8], ax
cmp sil, r14b
cmp rsi, 0x13424cdf
sub r8, 2
test r10d, ebx
mov word [rdx], cx
add rdx, 2
cmp rdx, r8
jmp 0x1404a55a9
jb 0x1404a5570
jmp 0x1404a55cb
lea rax, [rax + rax]
sub r11, rax
not bpl
mov qword [r10], r11
not dil
mov qword [r9], r15
movsx esi, r11w
mov rbx, qword [rsp + 0x18]
not r15d
mov rbp, qword [rsp + 0x20]
cmova r15d, r9d
movsxd r15, r8d
movsx r15w, r10b
mov rsi, qword [rsp + 0x28]
bswap edi
setb dil
movsx r14d, r13w
mov rdi, qword [rsp + 0x30]
mov r14w, r13w
movsx r14d, si
movsx r15, r10w
pop r15
movzx r14w, bpl
mov r14w, r10w
movsxd r14, r8d
pop r14
ret
cmp r8, qword [r9]
jmp 0x1404a561d
jae 0x1404a55c4
dec r8d
mov r11d, r15d
jmp 0x1404a562f
test ecx, ecx
jmp 0x1404a5636
je 0x1404a56f5
movsxd rax, r8d
bts rbp, rbp
lea rdi, [rax + rax]
bts ax, sp
shr al, 0xe0
rol r14w, 0xf
mov r14, qword [r10]
shr dh, 0x33
add dx, 0x6c09
mov eax, 0x66666667
imul ebx
mov bp, di
mov ebp, r8d
sar edx, 2
shr rax, cl
movzx eax, r10w
mov eax, edx
shr eax, 0x1f
stc
add edx, eax
cmc
cmp r15b, al
test ebx, ebx
jmp 0x1404a5688
je 0x1404a56c5
movzx eax, dx
sub cx, ax
bsr rcx, r8
sar cx, cl
shl ax, 2
or ch, ch
lea ecx, [rax + rdx]
sbb ax, 0x492a
add cx, cx
sub bx, cx
movsx ax, r10b
movsxd rax, r8d
not al
lea eax, [rbx + 0x30]
jmp 0x1404a56c0
jmp 0x1404a56cc
movzx eax, si
dec ebx
inc bh
mov word [rdi + r14], ax
not ebx
xchg bh, bl
inc r11d
rol bh, cl
sub rdi, 2
not bx
mov bl, dil
movsx ebx, r11w
dec r8d
mov ebx, edx
test ebp, ebp
jne 0x1404a5653
movsxd rcx, r11d
bswap rax
lea rax, [rcx + rcx]
add qword [r10], rax
sub qword [r9], rcx
jmp 0x1404a570a
jmp 0x1404a55cb
Function at 0x1404ab787
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
sal ebx, cl
ror bx, cl
mov qword [rsp + 0x18], rsi
sub ebx, edi
add ah, 0xf8
push rdi
rcr bx, cl
sub rsp, 0x50
test r11w, r9w
nop
cmc
mov rax, qword [0x1400b7288]
add bl, 0xab
xor rax, rsp
mov qword [rsp + 0x40], rax
rcl bh, 0x47
inc bh
cmp byte [rcx + 0x54], 0
bswap ebx
movzx bx, r15b
movzx ebx, bx
mov rbx, rcx
jmp 0x1404ab7d7
je 0x1404ab8ea
cmp dword [rcx + 0x50], 0
jle 0x1404ab8ea
mov rsi, qword [rcx + 0x48]
xor edi, edi
lahf
shrd ax, sp, 0xde
mov rax, qword [rbx + 8]
shrd r8, rbx, 0x8d
and r8, 0x637f3c8f
bsr r8w, r13w
lea rdx, [rsp + 0x34]
bt r8, rsi
btc r9, 0xb4
movzx r9d, word [rsi]
btc r8d, 0x2b
bswap ecx
btc r8w, r15w
lea rcx, [rsp + 0x30]
and dword [rsp + 0x30], 0
movzx r8, si
lea rsi, [rsi + 2]
bswap r8w
movzx r8d, r12w
mov r8d, 6
jmp 0x1404ab84b
mov qword [rsp + 0x20], rax
jmp 0x1404ab855
call fcn.1404cec96
test eax, eax
jmp 0x1404ab861
jne 0x1404ab8e1
mov r8d, dword [rsp + 0x30]
test spl, 0x6e
test r9w, r15w
cmp rbp, r10
test r8d, r8d
jmp 0x1404ab87f
je 0x1404ab8e1
lea rax, [rbx + 0x10]
mov r9b, 0x6c
cwd
setbe r9b
lea r9, [rbx + 0x28]
movsx rdx, sp
mov dl, sil
mov qword [rsp + 0x20], rax
movzx rdx, di
mov cl, 0xf8
movsxd rdx, ecx
lea rcx, [rbx + 0x468]
movzx edx, r13w
mov dx, 0x3e04
lea rdx, [rsp + 0x34]
jmp 0x1404ab8c4
call fcn.1404a9bdb
inc edi
cmp dl, r14b
cmp edi, dword [rbx + 0x50]
jmp 0x1404ab8d6
jne 0x1404ab7f3
jmp 0x1404ab936
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ab936
mov r8d, dword [rbx + 0x50]
rol ah, 0x29
sar r9d, cl
btr dx, r15w
lea rax, [rcx + 0x10]
movzx dx, r9b
bswap r9
mov rdx, qword [rbx + 0x48]
movzx r9d, ax
rcr r9w, cl
xadd r9b, r9b
lea r9, [rcx + 0x28]
test esp, r11d
cmp r13b, 0x96
add rcx, 0x468
jmp 0x1404ab92c
mov qword [rsp + 0x20], rax
call fcn.1404a9bdb
mov al, 1
test sp, 0x18cb
rol ch, cl
xchg cl, cl
mov rcx, qword [rsp + 0x40]
stc
xor rcx, rsp
jmp 0x1404ab94f
call fcn.14049e054
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
adc di, r15w
rcl rdi, cl
rol dil, 0xc4
add rsp, 0x50
cmova rdi, r11
not edi
pop rdi
jmp 0x1404ab979
ret