joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140445c87
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
push rsi
cmc
push rdi
setg r14b
bt esi, esi
rcr al, cl
push rbp
movzx ax, bh
lahf
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
setl dil
cwde
mov r14, r9
xchg rsi, rsi
movsx ebp, di
mov rbx, r8
cdqe
cmove ax, r12w
mov rdi, rdx
mov rsi, rcx
cwde
rdtsc
mov bp, 0x1dc6
movss xmm6, dword [rsp + 0xb0]
cwde
xchg dx, dx
movzx ebp, byte [rsp + 0xb8]
mov edx, 0x492d4c3b
movzx rax, sp
cwd
mov qword [rsp + 0x38], 0
movsx rax, r12w
cwde
movzx edx, r9w
mov rcx, qword [rcx + 8]
setle dl
mov rax, qword [rcx]
movzx dx, ah
cdq
movsx edx, dx
lea rdx, [rsp + 0x38]
jmp 0x140445d18
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
mov ah, dl
cdqe
mov rcx, qword [rsp + 0x38]
cwd
movsxd rdx, r14d
mov rdx, 0x3eda1300
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
movzx edx, r9w
mov rdx, qword [rdi]
movzx r8d, r14w
bswap rax
xchg r8w, r8w
mov rax, qword [rcx]
mov r8b, sil
movsx r8w, al
cmove r8, r14
mov r8d, 1
jmp 0x140445d78
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
mov dl, 0xb2
movzx ax, dil
xchg r8w, ax
mov rax, qword [rcx]
mov rdx, rdi
mov r8d, ebx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
cdq
movzx edx, bpl
movsxd rax, r8d
mov al, bl
movsx eax, r9w
mov rax, qword [rcx]
jmp 0x140445db1
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
mov al, 0x2f
mov rax, qword [rcx]
jmp 0x140445dc3
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
movups xmm0, xmmword [r14]
cwde
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
xchg dl, dl
cmove dx, r12w
movzx edx, r11w
lea rdx, [rsp + 0x40]
jmp 0x140445dec
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
bswap r8
cqo
rdtsc
mov r8, qword [rsi + 0x20]
rdtsc
mov rdx, qword [rsp + 0x38]
jmp 0x140445e11
mov rax, qword [rcx]
jmp 0x140445e19
mov qword [rsp + 0x20], 0
jmp 0x140445e27
movaps xmm3, xmm6
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
setne al
movsx rax, dx
movzx eax, di
mov rax, qword [rcx]
jmp 0x140445e47
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
jmp 0x140445e5a
mov rax, qword [rcx]
jmp 0x140445e62
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
test bp, 0x1288
xchg dil, dil
sub sil, 0xc2
add rsp, 0x60
pop rbx
movzx rbp, si
movsxd rbp, ebx
not r14b
pop rbp
movsxd r14, ebx
movsx esi, r14w
pop rdi
movsx r14, r13w
pop rsi
mov r14d, edx
pop r14
ret
Function at 0x140445e99
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
shr ax, cl
push rdi
cbw
xor ah, 0xa0
sub rsp, 0xa8
movzx rdi, r13w
movaps xmmword [rsp + 0x90], xmm10
xchg si, si
cbw
movaps xmmword [rsp + 0x80], xmm9
setle al
movaps xmmword [rsp + 0x70], xmm8
movaps xmmword [rsp + 0x60], xmm7
cwde
not ah
movaps xmmword [rsp + 0x50], xmm6
movsx rax, sp
movaps xmm9, xmm3
mov rdi, rdx
movsx ax, dl
cbw
rdtsc
mov rsi, rcx
movzx ax, dl
cmovno dx, bp
movss xmm8, dword [rsp + 0xe0]
mov rcx, qword [rcx + 0x20]
movups xmm0, xmmword [r8]
movaps xmmword [rsp + 0x30], xmm0
cmovp eax, edx
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
jmp 0x140445f24
call qword [rax + 0x40]
movsd xmm7, qword [rdi]
jmp 0x140445f30
movaps xmm0, xmm7
call fcn.1404b757a
movaps xmm10, xmm0
jmp 0x140445f41
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140445f4d
call fcn.1404b757a
unpcklps xmm10, xmm0
addps xmm10, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm10
movlps qword [rsp + 0x30], xmm10
movsd xmm7, qword [rdi + 8]
jmp 0x140445f72
movaps xmm0, xmm7
jmp 0x140445f7a
call fcn.1404b757a
movaps xmm6, xmm0
jmp 0x140445f87
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140445f93
call fcn.1404b757a
movss dword [rdi + 8], xmm6
jmp 0x140445fa2
unpcklps xmm6, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x140445faf
addps xmm6, xmm10
movlps qword [rsp + 0x38], xmm6
movss dword [rsp + 0x40], xmm9
not al
rdtsc
mov rcx, r10
movss dword [rsp + 0x44], xmm9
movzx dx, cl
cwd
mov rcx, qword [rsi + 0x18]
xchg edx, eax
jmp 0x140445fdd
mov r8, qword [rsi + 0x20]
cdq
cmovle eax, r8d
movzx dx, r10b
mov rax, qword [rcx]
setne dl
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
movaps xmm3, xmm8
jmp 0x140446008
call qword [rax + 0x90]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
adc di, 0x680f
rol si, cl
movaps xmm8, xmmword [rsp + 0x70]
movzx edi, sp
movaps xmm9, xmmword [rsp + 0x80]
movaps xmm10, xmmword [rsp + 0x90]
cmc
btr rdi, 0xdc
add rsp, 0xa8
pop rdi
movzx esi, r15w
pop rsi
jmp 0x140446053
ret
Function at 0x14044797d
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
bsr r8, rsi
setle r8b
rol r8, cl
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140447ab1
movsxd rcx, dword [0x14000003c]
shrd rdx, r10, 0x5b
cmovns rdx, r9
lea rdx, [0x140000000]
test r12b, r14b
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140447ab1
mov eax, 0x20b
cmp r15b, 0xa0
cmp word [rcx + 0x18], ax
jmp 0x1404479dc
jne 0x140447ab1
sub r8, rdx
cqo
or dx, 0x75fa
inc r9d
movzx edx, word [rcx + 0x14]
add rdx, 0x18
shr r9, 0xd4
mov r9w, 0xc95
cdqe
lea rdx, [rdx + rcx]
movzx eax, r14w
or eax, 0x6bc517b3
movzx eax, word [rcx + 6]
and cl, r10b
not rcx
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
jmp 0x140447a30
mov qword [rsp], rdx
test r13d, edx
stc
cmp rdx, r9
je 0x140447a79
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140447a6b
mov eax, dword [rdx + 8]
stc
test r10w, 0x29fe
clc
add eax, ecx
test r8, rdi
cmp r8, rax
jmp 0x140447a65
jb 0x140447a7f
add rdx, 0x28
jmp 0x140447a74
jmp 0x140447a30
sub edx, edx
test spl, 0x66
test rdx, rdx
jne 0x140447a8f
sub al, al
jmp 0x140447ac0
cmp dword [rdx + 0x24], 0
jge 0x140447aa5
xor al, al
jmp 0x140447aa0
jmp 0x140447ac0
mov al, 1
jmp 0x140447aac
jmp 0x140447ac0
xor al, al
jmp 0x140447ab8
jmp 0x140447ac0
add rsp, 0x18
jmp 0x140447ac9
ret
Function at 0x1404594a5
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
sal bh, cl
bt bx, 0x30
sar ah, cl
push rbp
shr bl, cl
not ebx
mov rbp, rsp
bsf rbx, rsp
cmp r8d, r14d
sub rsp, 0x20
mov rax, qword [0x1400b7288]
movsx rbx, bp
cmp r15w, ax
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x1404594e7
jne 0x1404595c4
and qword [rbp + 0x18], 0
not ecx
lea rcx, [rbp + 0x18]
jmp 0x1404594fd
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045950c
mov qword [rbp + 0x10], rax
jmp 0x140459515
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
cmp rsi, 0x17d0482c
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
neg rcx
shr cx, cl
bts cx, r14w
lea rcx, [rbp + 0x20]
test r14, 0x30587a95
xor qword [rbp + 0x10], rax
jmp 0x14045954f
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
lea rcx, [rbp + 0x10]
jmp 0x140459562
shl rax, 0x20
cmp r14w, 0xa59
test r12w, 0xa95
xor rax, qword [rbp + 0x20]
cmc
jmp 0x14045957c
xor rax, qword [rbp + 0x10]
dec bpl
xor rax, rcx
clc
movabs rcx, 0xffffffffffff
cmp r9b, r9b
sar bp, 0xca
and rax, rcx
jmp 0x1404595a0
movabs rcx, 0x2b992ddfa233
movsx bp, r10b
rcl bpl, 0x9e
cmp rax, rbx
mov bl, bpl
cmove rax, rcx
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
not rax
mov qword [0x1400b7280], rax
sub bp, ax
movzx bp, r15b
movzx rbp, r9w
add rsp, 0x20
pop rbp
jmp 0x1404595e9
ret
Function at 0x14045e0d1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
cmc
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
sbb bp, 0x461c
push rsi
btc bp, r14w
not bpl
push rdi
push r12
push r14
cmp r15d, 0xa78123f
btr bp, 5
push r15
bsr r15d, ecx
xor bp, 0x9bf
sub rsp, 0x40
xor r12d, r12d
sar r15b, 0xfd
movsx r15w, r11b
movsxd rbp, ecx
mov r15, r8
rcr bpl, cl
mov qword [rax + 0x20], r12
sbb bp, 0x2e92
ror rbp, cl
or rdi, 0xffffffffffffffff
movsx bp, dl
mov bpl, 0xda
inc ebp
mov rbp, rcx
jmp 0x14045e142
inc rdi
cmp cl, r11b
cmp spl, 0x24
cmp byte [rdi + rcx], r12b
jne 0x14045e142
add rdi, 1
movzx r14w, spl
movsx r14d, di
not bl
mov rbx, r12
movsx esi, cx
xchg si, si
mov rsi, rdi
cmove r14, rbp
movzx r14w, bpl
mov r14, rcx
jmp 0x14045e182
je 0x14045e1ef
lea r9, [rsp + 0x88]
mov cl, r9b
cwd
xchg r8d, ecx
mov qword [rsp + 0x20], r15
jmp 0x14045e1a2
mov r8, rsi
cwd
xchg dh, cl
lea rcx, [rsp + 0x70]
bswap dx
seta dh
mov rdx, r14
jmp 0x14045e1bc
call fcn.14045892d
test eax, eax
jmp 0x14045e1c8
jle 0x14045e1ef
cdqe
jmp 0x14045e1d5
inc rbx
cmc
test r13w, r8w
lea r14, [r14 + rax]
sub rsi, rax
jmp 0x14045e1e9
jne 0x14045e188
inc rbx
movsxd rcx, r14d
setp dl
mov edx, 2
movsxd rcx, r8d
jmp 0x14045e20a
mov rcx, rbx
call fcn.1400e01b1
mov r14, rax
test rax, rax
jmp 0x14045e21d
je 0x14045e300
mov qword [rsp + 0x30], r12
xor si, r9w
shrd si, ax, 0xcc
mov rsi, rax
test di, 0x4a85
test r14w, r12w
test rbx, rbx
jmp 0x14045e245
je 0x14045e2ad
lea r9, [rsp + 0x30]
mov r8b, dl
mov qword [rsp + 0x20], r15
jmp 0x14045e263
mov r8, rdi
not cx
cwd
mov rdx, rbp
mov ecx, edx
mov rcx, rsi
call fcn.14045892d
test eax, eax
jmp 0x14045e27f
jle 0x14045e2ad
cdqe
test r15w, di
cmc
cmp ecx, 0xc844d43
add rsi, 2
clc
stc
add rbp, rax
cmp edx, r14d
sub rbx, 1
jmp 0x14045e2a7
jne 0x14045e24b
lea r11, [rsp + 0x40]
xchg ebx, ebx
mov word [rsi], r12w
cwde
cdqe
mov rbx, qword [r11 + 0x38]
mov dil, 0x62
movzx ax, dil
mov rax, r14
bswap r14w
not rsi
movzx r15w, dl
mov rbp, qword [r11 + 0x40]
movzx r12d, r12w
mov rsp, r11
pop r15
movsx edi, r10w
pop r14
cmovg r12d, r13d
xchg di, r12w
pop r12
movsx si, r15b
pop rdi
pop rsi
jmp 0x14045e2ff
ret
call fcn.1404580af
int3
Function at 0x14046b166
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r9b, 0x74
stc
mov qword [rax + 8], rbx
test rbp, rcx
clc
test r13b, 0x5e
mov qword [rax + 0x10], rbp
sub rbp, 0x3cc22a1f
bts bp, r11w
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
btr di, 0xb1
neg sil
dec sil
push r14
or dil, 0x3b
xor bpl, 0xca
sar rbp, 0x78
sub rsp, 0x20
bts rbp, rax
sar bpl, cl
test r13b, 0x67
mov rsi, qword [rsp + 0x50]
test dil, sil
movzx r14d, r9w
test dx, si
mov rdi, r8
cmc
bts bp, r9w
mov rbp, rdx
test rsi, rsi
jmp 0x14046b1dd
je 0x14046b2b9
mov rbx, qword [r8 + 8]
test rbx, rbx
jmp 0x14046b1ef
je 0x14046b2a2
mov rax, qword [rbx + 0x40]
clc
cmp spl, 0xff
cmp qword [rax], 0
jmp 0x14046b207
je 0x14046b25f
mov rax, qword [rbx + 0x58]
jmp 0x14046b21b
cmp dword [rax], 0
jmp 0x14046b223
jle 0x14046b25f
dec dword [rax]
movzx rdx, r12w
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
nop
lea rax, [rdx + 2]
mov qword [rcx], rax
movzx rax, bp
movzx ax, r14b
movzx eax, r14w
jmp 0x14046b251
mov word [rdx], r14w
jmp 0x14046b25a
jmp 0x14046b28c
mov rax, qword [rbx]
xchg dx, dx
mov dl, 2
movsx ecx, r9w
movzx edx, r14w
xchg cx, cx
mov ch, 0xa2
mov rcx, rbx
jmp 0x14046b27d
mov rax, qword [rax + 0x18]
jmp 0x14046b286
call qword [0x1400b8d90]
mov ecx, 0xffff
stc
cmp esi, eax
cmp cx, ax
jmp 0x14046b29c
jne 0x14046b2aa
mov byte [rdi], 1
cmp r9b, 0x20
clc
sub rsi, 1
jmp 0x14046b2b3
jne 0x14046b1e7
movups xmm0, xmmword [rdi]
mov rbx, qword [rsp + 0x30]
movsx si, spl
shr dil, cl
sub rdi, rbx
mov rax, rbp
xor rsi, 0x741d6e51
shr di, cl
mov rsi, qword [rsp + 0x40]
bt edi, r10d
shrd edi, r15d, 8
or r14b, 0xf6
mov rdi, qword [rsp + 0x48]
cmp r11, r9
rcl r14w, 4
bswap r14
movdqu xmmword [rbp], xmm0
mov rbp, rdi
mov rbp, qword [rsp + 0x38]
bt r14w, r8w
btc r14d, r11d
add rsp, 0x20
cmovge r14w, bx
pop r14
jmp 0x14046b321
ret
Function at 0x140471fc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmc
cmp r15d, r8d
test ah, 0x49
mov qword [rax + 8], rbx
rol bl, cl
bsf rbx, r14
bswap ebx
mov qword [rax + 0x10], rbp
test bpl, 0xa4
ror ebp, 0xa3
mov qword [rax + 0x18], rsi
adc bl, r14b
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
bts ebx, r13d
rcl bh, cl
mov rsi, r9
xor r14w, r8w
mov rbx, r8
rol r14w, 0x68
bts r14, r9
stc
mov r14, rdx
bswap bp
and bpl, 0xd4
mov rbp, rcx
test r9, r9
jmp 0x140472025
je 0x14047210f
mov rdi, qword [rdx + 8]
test r15d, 0x3c0735ba
stc
cmp r12b, 0xdb
test rdi, rdi
jmp 0x140472043
je 0x1404720f4
mov rax, qword [rdi + 0x40]
shl r8b, 0x47
movzx r8d, word [rbx]
test r14b, r14b
clc
cmp qword [rax], 0
jmp 0x140472062
je 0x1404720b1
mov rax, qword [rdi + 0x58]
test r15d, r15d
stc
jmp 0x140472075
cmp dword [rax], 0
jmp 0x14047207d
jle 0x1404720b1
dec dword [rax]
rdtsc
movsx edx, r10w
mov rcx, qword [rdi + 0x40]
cwd
mov rdx, qword [rcx]
movzx eax, cx
lea rax, [rdx + 2]
jmp 0x1404720a0
mov qword [rcx], rax
jmp 0x1404720a8
mov word [rdx], r8w
jmp 0x1404720e0
mov rax, qword [rdi]
xchg dh, dh
mov rdx, r11
movzx edx, r8w
movsx rcx, ax
mov rcx, rdi
jmp 0x1404720c9
mov rax, qword [rax + 0x18]
jmp 0x1404720d2
call qword [0x1400b8d90]
movzx r8d, ax
shl ax, 0xe8
mov eax, 0xffff
cmp ax, r8w
jmp 0x1404720ee
jne 0x1404720f8
mov byte [r14], 1
add rbx, 2
test r13b, r10b
clc
sub rsi, 1
jmp 0x140472109
jne 0x14047203b
movups xmm0, xmmword [r14]
jmp 0x14047211e
mov rbx, qword [rsp + 0x30]
movsx di, al
mov rax, rbp
bt r14w, 0x67
mov dil, 0xcd
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r14b, 0x19
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
setp r14b
adc r14, rcx
add rsp, 0x20
pop r14
ret
Function at 0x140490f08
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp ecx, 0x651b3612
clc
test rax, r9
mov qword [rax + 8], rbx
movsxd rbx, eax
mov qword [rax + 0x10], rbp
movsx bp, sil
mov qword [rax + 0x18], rsi
cmovb bx, ax
sbb bl, r15b
mov qword [rax + 0x20], rdi
rcr rbp, 0x53
push r14
shl bpl, 0xe8
bt r14w, 0x19
sub rsp, 0x20
neg bx
btr bp, r11w
mov rsi, r9
mov r14, r8
mov rbx, rdx
movsx bp, r10b
movsxd rbp, r14d
and bpl, 0xc3
mov rbp, rcx
stc
cmc
cmp rdx, r8
jmp 0x140490f72
je 0x140491046
mov rdi, qword [r9 + 8]
test rdi, rdi
jmp 0x140490f84
je 0x14049102f
mov rax, qword [rdi + 0x40]
or r8w, r13w
inc r8b
btr r8w, 0xad
movzx r8d, word [rbx]
jmp 0x140490fa9
cmp qword [rax], 0
jmp 0x140490fb2
je 0x140490ffb
mov rax, qword [rdi + 0x58]
clc
test r14b, spl
cmp dword [rax], 0
jmp 0x140490fc8
jle 0x140490ffb
dec dword [rax]
xchg ch, dl
mov rcx, qword [rdi + 0x40]
movzx eax, di
bswap edx
mov rdx, qword [rcx]
not ax
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x140490fed
mov word [rdx], r8w
jmp 0x140490ff6
jmp 0x14049101f
mov rax, qword [rdi]
xchg cx, cx
cqo
movzx edx, r8w
not ecx
movzx cx, sil
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [0x1400b8d90]
movzx r8d, ax
mov eax, 0xffff
clc
cmp ax, r8w
jne 0x140491032
mov byte [rsi], 1
add rbx, 2
cmp esp, r15d
cmp r11b, 0x8b
cmp rbx, r14
jne 0x140490f7c
movups xmm0, xmmword [rsi]
mov rbx, qword [rsp + 0x30]
movsxd rax, r8d
bt r14w, 0x48
mov rax, rbp
mov rsi, qword [rsp + 0x40]
add r14d, r14d
sal r14b, 0xde
mov rdi, qword [rsp + 0x48]
shl r14d, cl
movdqu xmmword [rbp], xmm0
cmp r10b, 0x18
mov rbp, qword [rsp + 0x38]
shl r14b, cl
xor r14b, r11b
xchg r14w, r14w
add rsp, 0x20
movsx r14d, sp
movsx r14, r8w
pop r14
jmp 0x140491099
ret
Function at 0x14049da34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
ror bpl, 0xb9
dec rsi
push rdi
bsr bp, r15w
mov si, ax
push r14
sal dil, cl
push r15
bt bp, 0x70
cmovs di, bp
sub rsp, 0x20
clc
xor dil, r13b
test rdx, rdx
movzx r14, r14w
movzx si, al
lea r14, [rax + 8]
movsx rsi, r14w
seto dil
mov rbp, rcx
mov rdi, rcx
movsxd r15, r12d
movsx r15, r15w
movsx si, dl
movzx ecx, byte [rcx]
movzx si, al
cmovne r14, rdx
mov r15, r9
mov esi, r8d
jmp 0x14049dabe
inc rdi
mov cx, 0x5e92
xchg ch, ch
mov cx, r14w
movzx ecx, byte [rdi]
jmp 0x14049dabe
call fcn.1404b7042
test eax, eax
jmp 0x14049daca
jne 0x14049daa9
mov bl, byte [rdi]
rol al, 0xec
lea eax, [rbx - 0x2b]
cmp r8w, dx
test al, 0xfd
jmp 0x14049dae3
je 0x14049daf5
mov bl, 0x2b
jmp 0x14049daf0
jmp 0x14049daf8
inc rdi
mov r9, r15
not ch
cmovnp dx, r11w
mov r8d, esi
cdq
cqo
mov rdx, r14
movsx ecx, r13w
mov cx, r8w
mov rcx, rdi
jmp 0x14049db1b
call fcn.14049dc38
mov ecx, eax
neg si
sar sil, 0x17
mov esi, 0x7fffffff
cmp r9w, r13w
cmp rdi, qword [r14]
jne 0x14049db48
mov qword [r14], rbp
jmp 0x14049db43
jmp 0x14049db51
cmp rbp, qword [r14]
jne 0x14049db5e
test ecx, ecx
jmp 0x14049db58
jne 0x14049db8e
cmp bl, 0x2b
jmp 0x14049db66
jne 0x14049db74
cmp ecx, esi
ja 0x14049db8e
cmp bl, 0x2d
jmp 0x14049db7c
jne 0x14049dbdb
cmp ecx, 0x80000000
jbe 0x14049dbdb
call fcn.1404b449b
mov dword [rax], 0x22
test r13, 0x18e430c3
cmp r14w, sp
test r15, r15
je 0x14049dbb4
mov dword [r15], 1
mov eax, 0x80000000
cmc
test r11b, 0xa4
cmp bl, 0x2d
jmp 0x14049dbc6
cmove esi, eax
movsx rax, r14w
mov al, 0x62
mov eax, esi
jmp 0x14049dbd6
jmp 0x14049dbfc
neg eax
jmp 0x14049dbe7
cmp bl, 0x2d
movzx rbp, ax
cmove ecx, eax
test bp, 0x1b58
movsx rsi, r12w
mov eax, ecx
mov rbx, qword [rsp + 0x48]
bt r15w, 0xe2
shl sil, cl
neg r14
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
movsx rdi, si
movsx di, r12b
pop r15
bswap r14
movzx r14, bp
pop r14
bswap edi
pop rdi
jmp 0x14049dc37
ret

Function at 0x14049f27d
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
jmp 0x14049f28a
and dword [rsp + 0x30], 0
jmp 0x14049f294
call fcn.1404a96c0
mov r9d, 2
cwd
lea r8, [rsp + 0x30]
mov cl, 0x27
jmp 0x14049f2ad
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x14049f2ba
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
jmp 0x14049f2cb
sub ecx, 0x30
jmp 0x14049f2d3
je 0x14049f310
sub ecx, 1
je 0x14049f306
cmp ecx, 1
je 0x14049f2f7
xor eax, eax
jmp 0x14049f2f2
jmp 0x14049f31b
mov eax, 3
jmp 0x14049f301
jmp 0x14049f31b
mov eax, 1
jmp 0x14049f31b
mov eax, 2
cmp r11w, 0x3e84
add rsp, 0x28
ret
Function at 0x1404a011a
Capabilities:
Terminate process

Disassembly:
push rbx
shl bl, 0x54
sub rsp, 0x20
shld ebx, ebp, 0x7f
shrd ebx, r13d, 0x69
rcl bh, 0x5e
mov rbx, rcx
cmp r12b, r9b
cmc
sub ecx, ecx
jmp 0x1404a013d
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a014b
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx rbx, ax
mov edx, 0xc0000409
add rsp, 0x20
setnp bl
movsx ebx, cx
pop rbx
jmp 0x1404a0173
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1404a0966
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmc
mov qword [rsp + 0x10], rbp
bts bp, ax
sar bpl, 0xed
mov qword [rsp + 0x18], rsi
movzx esi, di
sar bpl, 0xb3
shrd bp, sp, 0xcd
push rdi
btc esi, edi
inc sil
sub rsp, 0x20
btc rbp, r11
mov edi, dword [rcx + 0xc]
shld bp, ax, 0x36
neg bp
movzx esi, ax
mov esi, edx
test edi, edi
mov rbp, rcx
jmp 0x1404a09b3
je 0x1404a0a1e
lea ebx, [rdi - 1]
mov di, 0x6fff
movsx rdi, r12w
mov edi, ebx
jmp 0x1404a09cb
call fcn.1404c23d1
lea rdx, [rbx + rbx*4]
bts cx, r12w
bts cx, r15w
mov rax, qword [rax + 0x60]
shrd cx, cx, 0x8f
ror ch, 0x8f
lea rcx, [rax + rdx*4]
cbw
sub ah, 0x99
movsxd rax, dword [rbp + 0x10]
add rax, rcx
clc
cmp esi, dword [rax + 4]
jle 0x1404a0a12
cmp esi, dword [rax + 8]
jmp 0x1404a0a0c
jle 0x1404a0a2e
test ebx, ebx
jmp 0x1404a0a19
jmp 0x1404a09b3
xor eax, eax
dec bpl
xor rsi, 0x4c56093c
movzx rbx, cx
mov rbx, qword [rsp + 0x30]
not bpl
cmc
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
btc di, 0xc0
or rdi, rcx
add rsp, 0x20
movzx di, r15b
pop rdi
jmp 0x1404a0a58
ret
Function at 0x1404a5de3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
inc r10d
sal ebx, cl
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
or si, r15w
mov qword [rax + 0x20], rdi
sar sil, 0xb7
push r14
movsx rsi, si
add bh, 0x70
sar sil, 0xc4
push r15
movzx esi, word [rsp + 0x38]
btr bx, 0x53
mov r10, r8
xor r15d, r15d
movsx r8w, r12b
bsr r8d, ecx
add r8b, 0xd1
movsxd r8, edx
xor bx, 0x71ca
movsxd rbx, r11d
movzx bx, spl
mov ebx, ecx
mov ecx, r8d
test si, si
jmp 0x1404a5e4c
jne 0x1404a5fb4
mov rax, qword [r9]
and r11b, bl
mov r11w, cx
jmp 0x1404a5e61
mov r11, qword [r10]
cmc
cmp rax, 1
jmp 0x1404a5e6e
jbe 0x1404a5f6c
mov eax, 0x66666667
rcl ch, cl
sub cl, 0x1c
movzx rdx, r11w
mov r8, r11
imul ebx
movsx eax, cx
sar edx, 2
cdqe
mov eax, edx
movsx rcx, r12w
shr eax, 0x1f
cmc
add edx, eax
dec rax
test bpl, bl
cmp sil, dil
movzx eax, dx
bswap cx
neg ecx
shl ax, 2
neg cl
cmp sil, r8b
lea ecx, [rax + rdx]
add cx, cx
xadd ax, ax
and al, r10b
or ax, 0x7195
sub bx, cx
add bx, 0x30
mov word [r11], bx
add r11, 2
mov rax, qword [r9]
movzx ebx, r15w
setp bl
movsxd rbx, ebp
mov ebx, edx
jmp 0x1404a5ee9
dec rax
mov qword [r9], rax
cmp r15b, 2
stc
test edx, edx
jmp 0x1404a5efb
jle 0x1404a5f10
cmp rax, 1
jmp 0x1404a5f0a
ja 0x1404a5e74
mov rdx, qword [r10]
jmp 0x1404a5f18
mov qword [r10], r11
jmp 0x1404a5f20
jmp 0x1404a5f59
movzx eax, word [rdx]
bsf cx, r12w
movsxd rcx, eax
inc cl
movzx ecx, word [r8]
cmc
jmp 0x1404a5f3c
mov word [r8], ax
cmc
sub r8, 2
clc
mov word [rdx], cx
test r12w, 0x4a19
clc
stc
add rdx, 2
test r13b, r13b
stc
cmp rdx, r8
jmp 0x1404a5f61
jb 0x1404a5f25
jmp 0x1404a5f82
add rax, rax
movzx ebp, dx
sub r11, rax
movsx rbx, r10w
mov qword [r10], r11
xchg r14b, bl
mov qword [r9], r15
mov rbx, qword [rsp + 0x18]
movsx bp, dl
bswap ebp
mov rbp, qword [rsp + 0x20]
xchg dil, r14b
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
movsx r15d, sp
movsxd r14, r11d
pop r15
movsx r14d, sp
pop r14
jmp 0x1404a5fb3
ret
cmp r8, qword [r9]
jmp 0x1404a5fbc
jae 0x1404a5f7f
dec r8d
movsx r11, ax
btr r11d, r13d
btr r11, 0x59
mov r11d, r15d
cmp r13w, r9w
test ecx, ecx
jmp 0x1404a5fe0
je 0x1404a60b3
movsxd rax, r8d
lea rdi, [rax + rax]
bts rbp, r11
mov r14, qword [r10]
adc edx, edi
cmc
cmp ebp, r14d
mov eax, 0x66666667
bt edx, 0xef
imul ebx
ror al, cl
mov ebp, r8d
sar edx, 2
test dil, 0x6a
movsx ax, r9b
and ax, bx
mov eax, edx
shr eax, 0x1f
stc
cmp r11w, r14w
add edx, eax
cmp sp, 0x39ce
stc
test ebx, ebx
jmp 0x1404a6032
je 0x1404a6070
movzx eax, dx
cmc
dec ecx
ror rcx, 0x6c
shl ax, 2
bts cx, sp
lea ecx, [rax + rdx]
add cx, cx
movsx ax, r12b
shld ax, r9w, 0xe5
btc rax, 0x4d
sub bx, cx
lea eax, [rbx + 0x30]
jmp 0x1404a606b
jmp 0x1404a6076
movzx eax, si
movsx ebx, si
mov word [rdi + r14], ax
inc r11d
movsx rbx, di
shrd rbx, r8, 0xfe
movsx ebx, r8w
sub rdi, 2
bswap rbx
mov ebx, 0x1c537256
dec r8d
adc bx, bp
btr rbx, rdi
mov ebx, edx
test dl, cl
cmc
test ebp, ebp
jmp 0x1404a60ad
jne 0x1404a5ff1
movsxd rcx, r11d
lea rax, [rcx + rcx]
test r11w, 0x7879
clc
cmp bl, 0x38
add qword [r10], rax
cmp r11d, 0x689c23a3
test r11b, r15b
sub qword [r9], rcx
jmp 0x1404a5f82
Function at 0x1404adf8e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
movzx rbx, r15w
mov qword [rsp + 0x18], rbp
sub bh, bh
mov qword [rsp + 0x20], rsi
btr ebx, 0x15
stc
shl bl, cl
push rdi
sub rsp, 0x30
shr bl, cl
sub ebx, 0x24f1675a
sub ebp, ebp
neg bh
dec rbx
mov rbx, rcx
cmp byte [rcx + 0x54], bpl
jmp 0x1404adfca
jne 0x1404ae0d3
cmp dword [rcx + 0x50], ebp
jle 0x1404ae0d3
mov rsi, qword [rcx + 0x48]
movsx di, sil
setnp dl
mov edi, ebp
mov r8b, 1
movzx ax, dil
mov r9, qword [rbx + 8]
mov r8b, cl
lea rcx, [rsp + 0x40]
cdqe
movzx r8w, al
mov word [rsp + 0x40], bp
cbw
sets r8b
movsx r8d, cx
mov rdx, rsi
mov rax, qword [r9]
movsxd r8, dword [rax + 8]
jmp 0x1404ae020
call fcn.1404cf496
movsxd r8, eax
jmp 0x1404ae031
test eax, eax
jmp 0x1404ae038
jle 0x1404ae0ca
mov rcx, qword [rbx + 0x468]
cwde
movzx eax, cx
movzx edx, word [rsp + 0x40]
mov rax, qword [rcx + 8]
cmc
stc
cmp qword [rcx + 0x10], rax
jne 0x1404ae083
cmp byte [rcx + 0x18], bpl
jmp 0x1404ae067
je 0x1404ae075
inc dword [rbx + 0x28]
jmp 0x1404ae0b2
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ae07e
jmp 0x1404ae0b2
inc dword [rbx + 0x28]
inc qword [rcx + 0x10]
mov rax, qword [rbx + 0x468]
shl cx, 0xe6
mov rcx, qword [rax]
xor eax, r11d
bts ax, si
mov word [rcx], dx
xadd al, ah
cbw
mov rax, qword [rbx + 0x468]
add qword [rax], 2
add rsi, r8
jmp 0x1404ae0ba
inc edi
cmp edi, dword [rbx + 0x50]
jne 0x1404adfef
jmp 0x1404ae113
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404ae113
mov r8d, dword [rbx + 0x50]
rcl r9b, cl
or ax, r11w
sar r9w, 0xa1
lea rax, [rcx + 0x10]
btr r9w, 0x86
ror dh, 0x2a
ror edx, cl
mov rdx, qword [rbx + 0x48]
cmp di, 0x390d
inc r9b
lea r9, [rcx + 0x28]
add rcx, 0x468
mov qword [rsp + 0x20], rax
call fcn.1404ac3df
mov rbx, qword [rsp + 0x48]
sar dil, cl
ror al, cl
mov al, 1
movsxd rsi, esi
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
bsf edi, r8d
bt di, r14w
add rsp, 0x30
movsx edi, di
setne dil
pop rdi
jmp 0x1404ae146
ret