joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403d8992
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
ror r9b, 0xff
rcr sil, cl
xor r9b, bpl
mov r10, qword [rcx]
movzx r9d, si
adc r9b, spl
mov rsi, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
cmp r8d, 2
jmp 0x1403d89bc
jne 0x1403d8b27
test r9d, r9d
jmp 0x1403d89ca
je 0x1403d8bb0
lea ecx, [r9 - 1]
cmp ecx, 3
jmp 0x1403d89dc
jb 0x1403d8aba
mov r11d, r9d
and r11d, 0xfffffffc
sar r10w, 0x6a
sbb r8b, al
nop word cs:[rax + rax]
rcr r8b, cl
sar r8b, 0x31
not r8w
nop dword [rax]
movsx r10, r10w
movsxd r8, r15d
movzx r8d, word [rsi]
movzx r10d, word [rsi + 4]
sub ecx, ecx
rcl cl, 0xf2
cmp r8w, word [rdx]
setne cl
rcl r8, cl
neg ecx
mov r8, 0x51c60216
inc r8b
mov word [rsi + 2], cx
xchg r8b, r8b
neg r8w
xor ecx, ecx
movzx r8, r8w
cmp r10w, word [rdx]
setne cl
neg ecx
mov word [rsi + 6], cx
sub r8b, 0xd4
movzx r8d, word [rsi + 8]
sub ecx, ecx
sub cl, r14b
add cl, 0x43
shl cl, 0xb2
cmp r8w, word [rdx]
jmp 0x1403d8a71
setne cl
neg ecx
mov word [rsi + 0xa], cx
cmp sp, r14w
bsr r8d, edx
movzx r8d, word [rsi + 0xc]
clc
xor ecx, ecx
ror cl, 0xf9
cmp r8w, word [rdx]
not cl
xchg cl, cl
setne cl
test rax, 0x5c4a021f
neg ecx
mov word [rsi + 0xe], cx
clc
stc
add rsi, 0x10
clc
add r11d, 0xfffffffc
jmp 0x1403d8ab4
jne 0x1403d8a10
test r9b, 3
jmp 0x1403d8ac3
je 0x1403d8bb0
and r9d, 3
xor ecx, ecx
nop word cs:[rax + rax]
cmp r8b, r10b
movzx r8d, ax
btr r8w, dx
nop
cmp spl, 0xd
movzx r8d, word [rsi + rcx*4]
cmc
xor eax, eax
mov al, dl
rol al, 0x90
inc al
cmp r8w, word [rdx]
setne al
cmp di, 0x58c7
neg eax
mov word [rsi + rcx*4 + 2], ax
add rcx, 1
cmp r13b, 0x3e
cmp r9d, ecx
jmp 0x1403d8b1c
jne 0x1403d8aea
jmp 0x1403d8bb0
test r9d, r9d
jmp 0x1403d8b2f
je 0x1403d8bb0
movzx r10d, word [rdx]
btc r8, r11
and r8w, 0x15aa
mov r8d, r9d
cmp r9w, 0x1c35
test r10b, r10b
xor ecx, ecx
jmp 0x1403d8b56
jmp 0x1403d8b68
add rcx, 1
cmp r8d, ecx
je 0x1403d8bb0
cmp word [rsi + rcx*8], r10w
jmp 0x1403d8b72
jne 0x1403d8b5b
movzx eax, word [rsi + rcx*8 + 2]
cmp ax, word [rdx + 2]
jne 0x1403d8b5b
movzx eax, word [rsi + rcx*8 + 4]
cmp r8b, 0xb2
stc
cmp ax, word [rdx + 4]
jne 0x1403d8b5b
mov word [rsi + rcx*8 + 6], 0
movzx r10d, word [rdx]
jmp 0x1403d8bab
jmp 0x1403d8b5b
pop rsi
jmp 0x1403d8bb6
ret
Function at 0x1403f5d00
Capabilities:
Check for software breakpoints

Disassembly:
push r15
dec ah
xor eax, edi
push r14
and al, 0x1d
btr rax, 0xa8
push rsi
cbw
push rdi
neg esi
xadd sil, sil
push rbp
bts ax, bp
push rbx
bswap esi
sub sil, 0xa3
cmp r15w, di
sub rsp, 0x78
sub si, 0x4bed
btc eax, edx
sar rax, cl
movaps xmmword [rsp + 0x60], xmm8
or si, r12w
shld si, r15w, 0x48
movzx rax, cx
movaps xmmword [rsp + 0x50], xmm7
movzx esi, sp
movzx rax, bp
xor al, 0x97
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [rcx]
sar esi, 0x52
xor sil, 0x15
mov esi, dword [rax + 0x10]
cmc
clc
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x34], 0
test r14b, r8b
mov dword [rsp + 0x3c], 0
test r9w, 0x1e28
cmp sp, r11w
cmp bh, 0xd4
test esi, esi
jmp 0x1403f5d9f
jle 0x1403f5f71
movaps xmm7, xmm2
mov r15b, 0x73
movaps xmm8, xmm1
xchg r15b, r15b
movzx r15, r12w
mov r15, rcx
jmp 0x1403f5dbe
xorps xmm6, xmm6
xor edi, edi
cmovbe rdx, rbx
cdq
movzx dx, sil
lea r14, [rsp + 0x28]
cdq
nop dword [rax + rax]
cdq
mov rcx, r14
mov rdx, r15
seta r8b
mov r8b, 0xfd
mov r8d, edi
jmp 0x1403f5df1
call fcn.1403f5a14
mov ebx, dword [rsp + 0x3c]
test r15w, cx
test ebx, ebx
jle 0x1403f5f71
test edi, edi
jmp 0x1403f5e0d
jne 0x1403f5e2b
movss xmm0, dword [rsp + 0x34]
jmp 0x1403f5e1e
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x1403f5f6a
movss xmm0, dword [rsp + 0x38]
jmp 0x1403f5e36
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x1403f5e62
add edi, ebx
jmp 0x1403f5e4a
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x1403f5e57
jl 0x1403f5ddc
jmp 0x1403f5f71
movss xmm6, dword [rsp + 0x28]
jmp 0x1403f5e6d
ucomiss xmm6, xmm8
jbe 0x1403f5e83
mov esi, edi
jmp 0x1403f5e7e
jmp 0x1403f5f71
movss xmm0, dword [rsp + 0x2c]
jmp 0x1403f5e8e
ucomiss xmm0, xmm8
jbe 0x1403f5f19
xor ebp, ebp
movsx dx, dil
movsxd rdx, r14d
cdq
mov esi, edi
cwd
mov r8w, cx
movsx rdx, cx
movaps xmm7, xmm6
movsx edx, bp
movzx edx, sp
cwd
nop word cs:[rax + rax]
nop
movsx rcx, di
mov rcx, r15
movzx edx, bx
mov edx, edi
movsx r8d, bx
mov r8d, ebp
jmp 0x1403f5ede
call fcn.1403f6255
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x1403f5fcb
add ebp, 1
add esi, 1
jmp 0x1403f5f02
movaps xmm6, xmm7
cmp sil, spl
test bp, cx
clc
cmp ebx, ebp
jmp 0x1403f5f13
jne 0x1403f5eca
test byte [r15 + 0x1c], 4
jmp 0x1403f5f23
jne 0x1403f5f5c
lea esi, [rbx + rdi]
add esi, 0xffffffff
mov rax, qword [r15]
movsxd rcx, esi
cmp spl, 0xcc
cmp qword [rax + 0x10], rcx
jbe 0x1403f5fee
cmp qword [rax + 0x18], 8
jb 0x1403f5f51
mov rax, qword [rax]
cmp word [rax + rcx*2], 0xa
je 0x1403f5f71
add ebx, edi
mov esi, ebx
jmp 0x1403f5f65
jmp 0x1403f5f71
xor esi, esi
neg r15b
rcl ebp, cl
mov eax, esi
cmp rcx, 0x3c1b3052
ror bp, cl
movaps xmm6, xmmword [rsp + 0x40]
btc r15, 0x5b
or sil, 0xf3
movaps xmm7, xmmword [rsp + 0x50]
add bpl, 0x98
not di
sar edi, cl
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x78
mov bp, 0x5934
not edi
movsx bx, spl
pop rbx
pop rbp
pop rdi
movzx r14, r8w
pop rsi
bswap r15d
movsx r14d, r9w
pop r14
setbe r15b
pop r15
jmp 0x1403f5fca
ret
mulss xmm0, dword [0x1400ba5b0]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x1403f5f71
add esi, 1
jmp 0x1403f5fe9
jmp 0x1403f5f71
call fcn.1403f63fc
int3
Function at 0x1403f864e
Capabilities:
Accept command line arguments

Disassembly:
push rsi
cmp r15b, 0x1b
cmc
sub rsp, 0x80
jmp 0x1403f8661
movaps xmmword [rsp + 0x70], xmm6
jmp 0x1403f866b
mov dword [rsp + 0x3c], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x3c]
mov ch, ah
movzx ecx, cx
movzx cx, dil
mov rcx, rax
jmp 0x1403f8690
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
movsxd r8, dword [rsp + 0x3c]
jmp 0x1403f86a4
lea rcx, [rsp + 0x40]
movzx edx, r8w
mov rdx, rax
jmp 0x1403f86b5
call fcn.1403f894e
mov rcx, qword [0x1400b5f10]
jmp 0x1403f86c6
test rcx, rcx
jmp 0x1403f86ce
je 0x1403f8728
mov rdx, qword [0x1400b5f20]
sub rdx, rcx
test r14b, 4
stc
cmp rdx, 0x1000
jmp 0x1403f86ef
jb 0x1403f8723
mov rax, qword [rcx - 8]
test bpl, bpl
add rcx, 0xfffffffffffffff8
test r14b, 0xc5
clc
sub rcx, rax
jmp 0x1403f870d
cmp rcx, 0x20
jmp 0x1403f8716
jae 0x1403f8943
add rdx, 0x27
mov rcx, rax
call fcn.140239321
movaps xmm0, xmmword [rsp + 0x40]
cwde
not ah
movups xmmword [0x1400b5f10], xmm0
xchg ah, ah
mov rax, qword [rsp + 0x50]
jmp 0x1403f8743
mov qword [0x1400b5f20], rax
jmp 0x1403f874f
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
jmp 0x1403f876b
mov rcx, qword [0x1400b5f28]
jmp 0x1403f8777
test rcx, rcx
jmp 0x1403f877f
je 0x1403f87e7
mov rdx, qword [0x1400b5f38]
cmp r11w, 0x530f
test al, 0x3b
sub rdx, rcx
test r10b, spl
cmp rdx, 0x1000
jmp 0x1403f87a6
jb 0x1403f87d8
mov rax, qword [rcx - 8]
test cx, cx
jmp 0x1403f87b8
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403f87c8
jae 0x1403f8943
add rdx, 0x27
mov cl, spl
mov rcx, rax
call fcn.140239321
mov rcx, qword [rsp + 0x40]
jmp 0x1403f87f0
sub ecx, ecx
movzx dx, r10b
rcr ah, cl
lea rax, [rsp + 0x58]
movups xmm0, xmmword [rsp + 0x58]
or rdx, rdx
movups xmmword [0x1400b5f28], xmm0
shr dx, cl
mov rdx, qword [rsp + 0x68]
cmp spl, 0xcb
mov qword [0x1400b5f38], rdx
cmp cl, r15b
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
cmc
cmp r13w, 0x6fdd
test rcx, rcx
je 0x1403f8886
mov rdx, qword [rsp + 0x50]
cmp cl, r14b
sub rdx, rcx
stc
cmp rdx, 0x1000
jmp 0x1403f884d
jb 0x1403f8881
mov rax, qword [rcx - 8]
test r12b, dl
clc
add rcx, 0xfffffffffffffff8
stc
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403f886c
jae 0x1403f8943
add rdx, 0x27
bswap cx
mov rcx, rax
jmp 0x1403f8881
call fcn.140239321
call fcn.140056130
mov ecx, 0x58
jmp 0x1403f8895
call fcn.1403fc89f
mov rsi, rax
movzx rcx, r14w
mov rcx, rax
jmp 0x1403f88a9
call fcn.14036ea70
mov qword [0x1400b5f08], rsi
movzx ecx, r11w
mov rcx, rsi
jmp 0x1403f88c1
call fcn.14036f036
mov qword [rsp + 0x28], 0
adc r8d, 0x52992149
neg r8w
bswap r8w
mov dword [rsp + 0x20], 0
test r9d, r12d
rcl r8b, cl
lea r8, [0x14005c990]
jmp 0x1403f88f9
xor ecx, ecx
cmp r8, r8
sub edx, edx
clc
test bl, 0x6b
xor r9d, r9d
jmp 0x1403f890c
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x1400b5f08]
jmp 0x1403f891e
call fcn.140172b1b
call fcn.1403ee1fc
sub eax, eax
movaps xmm6, xmmword [rsp + 0x70]
mov sil, 0x2e
test r13d, ecx
add rsp, 0x80
movzx si, r9b
pop rsi
ret
call fcn.14046a291
int3
Function at 0x1403f8d5f
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x1403f8d68
movzx ecx, cx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
mov al, 0x16
setae al
add rsp, 0x28
jmp 0x1403f8d87
ret

Function at 0x1403fa211
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get ntdll base address

Disassembly:
sub rsp, 0x28
movzx ax, sil
mov rcx, qword [rcx]
cwde
not ah
mov rax, qword [rcx]
jmp 0x1403fa228
call qword [rax + 0x28]
test eax, eax
jmp 0x1403fa232
je 0x1403fa26a
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
dec dl
inc dl
mov dl, 3
movsx r9d, r9w
adc r9b, al
mov r9d, 0x2a
clc
test r9b, 0x41
add rsp, 0x28
jmp 0x1403fa265
jmp fcn.140369490
nop
add rsp, 0x28
jmp 0x1403fa274
ret

Function at 0x1403fb373
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
push rsi
shr al, cl
rol ah, 0x76
test cx, 0x56e2
push rdi
push rbp
or r14, rsi
cdqe
and r14, 0x294b1b8c
push rbx
cwde
or r14, rsp
clc
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
movsx esi, di
mov r14, r9
setnp bpl
bswap di
mov rbx, r8
movzx rdi, si
mov rdi, rdx
movsx eax, r13w
mov rsi, rcx
cdqe
movss xmm6, dword [rsp + 0xb0]
not dl
mov bpl, byte [rsp + 0xb8]
cdq
mov qword [rsp + 0x38], 0
rdtsc
movzx edx, bx
cqo
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
jmp 0x1403fb3f2
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
not cx
jmp 0x1403fb40b
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
cdq
lea rdx, [rsp + 0x30]
jmp 0x1403fb41e
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
lahf
mov rdx, qword [rdi]
seto r8b
cmovge eax, esi
movsx rax, si
mov rax, qword [rcx]
mov r8d, 1
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
cbw
movsx eax, r10w
mov rax, qword [rcx]
mov rdx, rdi
movsxd r8, ecx
mov r8d, ebx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
cwd
movzx rdx, bp
movzx edx, bpl
cdqe
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
mov ah, 0x6a
movsxd rax, r10d
cdqe
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
cwd
rdtsc
bswap edx
movups xmm0, xmmword [r14]
movzx edx, r10w
movaps xmmword [rsp + 0x40], xmm0
xchg ah, dl
mov rax, qword [rcx]
movzx edx, dx
setbe dh
lea rdx, [rsp + 0x40]
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
xchg al, al
cqo
movsx eax, si
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsp + 0x38]
sets al
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
jmp 0x1403fb4da
movaps xmm3, xmm6
jmp 0x1403fb4e2
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
jmp 0x1403fb4f5
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
movsx eax, di
mov ah, 0x66
movsx rax, di
mov rax, qword [rcx]
jmp 0x1403fb50f
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
movsxd rbx, r14d
movzx r14w, cl
sar bp, cl
add rsp, 0x60
movsx bx, sil
pop rbx
movsx r14w, r10b
pop rbp
sete r14b
not rdi
pop rdi
movsx rsi, si
pop rsi
setb r14b
cmovno r14d, r11d
jmp 0x1403fb54c
pop r14
jmp 0x1403fb553
ret
Function at 0x1403fceb4
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
movsx eax, sp
lahf
cmc
mov eax, 0x5a4d
cmp word [0x140002000], ax
jmp 0x1403fced1
jne 0x1403fcfcc
movsxd rcx, dword [0x14000203c]
lea rdx, [0x140002000]
stc
clc
lea rcx, [rcx + rdx]
cmp dword [rcx], 0x4550
jne 0x1403fcfcc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1403fcf05
jne 0x1403fcfcc
sub r8, rdx
test di, 0x5907
cdqe
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
movsx rcx, r9w
dec r9b
lea rcx, [rax + rax*4]
add r9w, 0x407f
sal r9w, 0xef
rcl r9, cl
lea r9, [rdx + rcx*8]
stc
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x1403fcf4e
je 0x1403fcf8e
mov ecx, dword [rdx + 0xc]
cmp r15b, 0xe9
test rax, r11
cmp r8, rcx
jmp 0x1403fcf66
jb 0x1403fcf80
mov eax, dword [rdx + 8]
add eax, ecx
stc
cmp r8, rax
jmp 0x1403fcf7a
jb 0x1403fcf90
add rdx, 0x28
jmp 0x1403fcf89
jmp 0x1403fcf42
sub edx, edx
test rdx, rdx
jmp 0x1403fcf98
jne 0x1403fcfaa
xor al, al
jmp 0x1403fcfa5
jmp 0x1403fcfda
cmp dword [rdx + 0x24], 0
jmp 0x1403fcfb3
jge 0x1403fcfc5
sub al, al
jmp 0x1403fcfc0
jmp 0x1403fcfda
mov al, 1
jmp 0x1403fcfda
xor al, al
jmp 0x1403fcfd3
jmp 0x1403fcfda
add rsp, 0x18
ret
Function at 0x14040eedb
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
not cl
bswap cx
lea rcx, [rsp + 0x30]
jmp 0x14040eeee
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
add rsp, 0x28
jmp 0x14040ef02
ret
Function at 0x140420ca2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
clc
shrd rbp, r15, 0xba
mov qword [rax + 0x18], rsi
btr ebp, ecx
btc bp, 0x3c
shld rsi, rbx, 0x30
mov qword [rax + 0x20], rdi
push r14
neg rsi
sal bpl, 0x30
sub rsp, 0x20
and di, 0x6462
mov r14b, spl
shr sil, 0xd
mov rdi, qword [rsp + 0x50]
mov r14, r9
add bpl, r13b
movzx bp, r15b
mov rsi, r8
or bpl, 0xe2
add bpl, 0x5c
mov rbp, rdx
stc
test rdi, rdi
jmp 0x140420d09
je 0x140420dd4
mov rbx, qword [r8 + 8]
cmp r12b, dil
test rbx, rbx
jmp 0x140420d1e
je 0x140420db6
mov rax, qword [rbx + 0x40]
movzx r8d, word [r14]
stc
cmc
cmp qword [rax], 0
je 0x140420d7d
mov rax, qword [rbx + 0x58]
stc
cmp bpl, 0xae
cmp dword [rax], 0
jle 0x140420d7d
dec dword [rax]
mov dh, bl
movsxd rax, r14d
jmp 0x140420d56
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
xchg al, ah
movsx rax, r8w
movsx ax, r13b
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x140420d74
mov word [rdx], r8w
jmp 0x140420d9f
mov rax, qword [rbx]
movzx edx, r8w
mov rcx, rbx
jmp 0x140420d8c
mov rax, qword [rax + 0x18]
jmp 0x140420d95
call qword [case.0x1403fcc95.0]
movzx r8d, ax
mov eax, 0xffff
cmp rcx, 0x21e36f9b
clc
cmp ax, r8w
jne 0x140420dbd
mov byte [rsi], 1
cmp r8b, r15b
clc
add r14, 2
cmp r12w, 0x202b
cmp edi, r9d
sub rdi, 1
jne 0x140420d16
movups xmm0, xmmword [rsi]
add r14b, dl
mov rbx, qword [rsp + 0x30]
movsx si, bpl
shr ax, 0x47
mov rax, rbp
dec rdi
sar r14b, cl
mov rsi, qword [rsp + 0x40]
adc dil, r8b
mov rdi, qword [rsp + 0x48]
xor r14b, 2
not r14b
test r13b, 0xce
movdqu xmmword [rbp], xmm0
sar r14d, 0x1c
mov rbp, qword [rsp + 0x38]
sub r14b, dl
ror r14b, cl
add rsp, 0x20
movzx r14w, al
pop r14
jmp 0x140420e2d
ret
Function at 0x1404533d2
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp bpl, al
cmc
and dword [rsp + 0x30], 0
call fcn.14045e772
mov r9d, 2
xchg dx, cx
movsx rcx, si
sets dh
lea r8, [rsp + 0x30]
mov dl, sil
movsxd rcx, edi
movsx edx, cx
mov rcx, qword [rax + 0x28]
mov dl, r8b
movsx edx, r9w
lea edx, [r9 + 0x20]
jmp 0x140453416
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
test r15d, ebx
sub ecx, 0x30
je 0x14045346e
sub ecx, 1
je 0x14045345f
cmp ecx, 1
jmp 0x14045343e
je 0x140453450
sub eax, eax
jmp 0x14045344b
jmp 0x14045347b
mov eax, 3
jmp 0x14045345a
jmp 0x14045347b
mov eax, 1
jmp 0x140453469
jmp 0x14045347b
mov eax, 2
test rbp, 0x2dd37a68
clc
add rsp, 0x28
jmp 0x140453484
ret

Function at 0x14045429a
Capabilities:
Terminate process

Disassembly:
popfq
js 0x14016f9e7
invalid
xchg ebp, eax
out dx, al
retf 0xdf2b
sub edi, dword [rdx - 0x6ec726fb]
clc
push 0xffffffffffffffec
outsd dx, dword [rsi]
shr dword [rbx], 0x76
fist word [rdx + rdi*8 - 0x2b]
wait
fcmove st(0), st(4)
invalid
mov edi, 0x55ace816
mov cl, ch
in eax, 3
stosb byte [rdi], al
mov bh, byte [rsi + 0x3701af46]
scasd eax, dword [rdi]
add dword [rdi], esi
scasd eax, dword [rdi]
add dword [rdi], esi
sub ch, byte [rdx + 0x72]
fdivr qword [rdx - 0x6fc1df2d]
xchg esi, eax
adc eax, dword [rbx]
js 0x14016f9a1
retf 0x26fd
invalid
or r14b, bl
lahf
add eax, 0x9e601650
invalid
lahf
jrcxz 0x14016f977
ror edx, 1
lahf
fdisi8087_nop
or eax, 0x11ba6026
in eax, 0xca
lahf
lodsd eax, dword [rsi]
invalid
xlatb
lahf
and al, 0xce
stc
adc ah, byte [rax + 0x31]
mov ebp, 0x659ff2ee
int1
pop rbx
rcr dword [rdi + 0x214c632e], 0x60
cwde
scasd eax, dword [rdi]
adc al, 0xe9
lahf
push 0xffffffffdec30777
lahf
in eax, 0xac
sbb eax, 0x8cb6534a
mov dh, 0x8c
mov dh, 0x8c
xchg edx, eax
invalid
push rbx
cmp bl, bpl
sub rsp, 0x20
stc
cmc
mov rbx, rcx
cmc
sub ecx, ecx
jmp 0x1404542b0
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404542be
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movzx edx, di
cmp bpl, bl
mov edx, 0xc0000409
bswap ebx
movzx rbx, r14w
clc
add rsp, 0x20
movsxd rbx, r11d
pop rbx
jmp switch.0x1404542ec
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140455075
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
shrd ax, r11w, 0x3d
push rbp
sar bp, 0x43
btc ebp, r9d
mov rbp, rsp
sub rsp, 0x20
dec bl
rcl al, cl
mov rax, qword [0x1400b4278]
shr bl, cl
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x1404550af
jne 0x140455195
and qword [rbp + 0x18], 0
movzx rcx, si
cmovne cx, r9w
movsx cx, sil
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x1404550db
mov qword [rbp + 0x10], rax
jmp 0x1404550e4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
test r13b, 0x18
cmp bl, spl
cmp sil, 0x87
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
rol cl, 0x98
btr cx, di
lea rcx, [rbp + 0x20]
jmp 0x140455114
xor qword [rbp + 0x10], rax
jmp 0x14045511d
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
rol ecx, cl
rcr cx, 0x4b
movsxd rcx, ebx
lea rcx, [rbp + 0x10]
cmc
shl rax, 0x20
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
not rbp
stc
movsx bp, r9b
xor rax, rcx
btc bp, dx
xor cl, 0x1d
movabs rcx, 0xffffffffffff
and rax, rcx
sar bpl, cl
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
movsx bx, sil
bswap ebp
movzx bx, bpl
cmove rax, rcx
xchg bpl, bl
mov qword [0x1400b4278], rax
test rdi, r10
movzx ebp, r8w
bsf rbp, rax
mov rbx, qword [rsp + 0x48]
btr bp, r11w
rol rbp, 0x44
cmc
not rax
adc rbp, 0x58f516e4
sbb ebp, r14d
dec rbp
mov qword [0x1400b4270], rax
sal bpl, cl
bts rbp, r12
bt bp, dx
add rsp, 0x20
movsx bp, dl
mov bpl, r9b
movsx ebp, r8w
pop rbp
jmp 0x1404551db
ret
Function at 0x14046274c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
or ax, 0x59cc
push rdi
sub rsp, 0x20
ror dil, cl
rcr ah, 0xc6
and dh, 0xa3
add qword [rcx + 0x20], 8
dec dil
adc dil, dl
sar r8b, 0x3c
mov rdi, rcx
or ebx, 0x72f42f9c
ror bx, 0x94
mov rax, qword [rcx + 0x20]
add bl, dil
and dh, ah
dec bx
mov esi, dword [rcx + 0x38]
cmp esi, 0xffffffff
bswap r8w
mov bx, bx
movzx r8, cx
mov r8d, dword [rcx + 0x3c]
movzx edx, word [rcx + 0x42]
mov bx, r14w
mov rbx, qword [rax - 8]
bswap rax
movsx eax, r13w
mov eax, 0x7fffffff
mov qword [rcx + 0x48], rbx
jmp 0x1404627c6
cmove esi, eax
mov rcx, qword [rcx]
call fcn.140162397
test al, al
jmp 0x1404627d8
je 0x140462814
test rbx, rbx
jne 0x1404627fb
lea rbx, [0x1400cf7e0]
movsx dx, cl
mov qword [rdi + 0x48], rbx
cmovo dx, cx
cdq
movsxd rdx, esi
mov rcx, rbx
mov byte [rdi + 0x54], 1
jmp 0x14046280a
call fcn.14023d674
jmp 0x1404628c5
test rbx, rbx
jmp 0x14046281c
jne 0x140462830
lea rbx, [0x1400cbcc0]
mov qword [rdi + 0x48], rbx
test r10b, spl
sub r9d, r9d
jmp 0x140462838
test esi, esi
jmp 0x14046283f
jle 0x1404628b8
cmp byte [rbx], 0
je 0x1404628b8
mov rax, qword [rdi + 8]
btc ecx, eax
setne r8b
ror r8b, 0xdf
movzx edx, byte [rbx]
movsxd r8, r11d
sar cx, 0x5a
mov rcx, qword [rax]
mov r8b, r13b
cmp dil, 0xcf
mov rax, qword [rcx]
movzx r8, r15w
shrd ecx, edx, 0xd
lea rcx, [rbx + 1]
or r8d, r13d
movsx r8, r15w
movsx r8d, r9w
movzx r8d, word [rax + rdx*2]
test ch, 0x1d
cmc
and r8d, 0x8000
cmove rcx, rbx
movsx rbx, bx
inc r9d
lea rbx, [rcx + 1]
cmp r9d, esi
jmp 0x1404628b2
jl 0x140462845
mov eax, r9d
movsx esi, si
add sil, 0x5a
mov bx, bp
mov dword [rdi + 0x50], eax
btc di, di
add al, 0xb8
mov si, 0x1b19
mov al, 1
movzx rbx, r15w
movsx rdi, r10w
btr si, 6
mov rbx, qword [rsp + 0x30]
dec rdi
movzx esi, r15w
mov rsi, qword [rsp + 0x38]
xor dil, r9b
add rsp, 0x20
mov dil, r15b
movzx di, dl
movsx di, al
pop rdi
jmp 0x14046290a
ret
Function at 0x1404639a2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jmp 0x1404639b1
jle 0x140463aec
mov qword [rsp + 8], rbx
movzx ax, bh
mov bl, r12b
mov qword [rsp + 0x10], rdi
or ah, 0xa
mov r10d, dword [r9]
and ebx, 0xf5d57ad
mov rbx, rcx
movsx edi, bx
movsx edi, dl
add dl, 0x75
rcr eax, 0xc5
stc
sub r11d, r11d
bts edx, esp
xor dx, r10w
mov rdx, qword [rbx]
test r12, rdx
mov rax, qword [rdx + 8]
test dl, r12b
cmp dx, 0x6c1
cmp qword [rdx + 0x10], rax
jmp 0x140463a09
jne 0x140463a41
cmp byte [rdx + 0x18], 0
jmp 0x140463a18
je 0x140463a2b
inc r10d
jmp 0x140463a26
jmp 0x140463a34
or r10d, 0xffffffff
jmp 0x140463a34
mov dword [r9], r10d
jmp 0x140463a3c
jmp 0x140463ab8
lea eax, [r10 + 1]
mov r10d, r13d
movzx rcx, sp
inc r10
mov dword [r9], eax
mov rax, qword [rbx]
jmp 0x140463a64
inc qword [rax + 0x10]
movzx rax, r8w
clc
test rsi, 0x4e021851
mov rax, qword [rbx]
btc r10w, 0x2f
btr r10w, 0xc9
mov rcx, qword [rax]
btc r10w, 0xb1
jmp 0x140463a94
mov word [rcx], di
mov rax, qword [rbx]
movzx r10, r9w
shld r10d, ebx, 0xd6
sub r10b, r12b
add qword [rax], 2
adc r10b, dl
shr r10w, 0xb7
mov r10d, dword [r9]
test spl, r9b
cmp r10d, 0xffffffff
je 0x140463add
inc r11d
cmp cx, 0x4e45
jmp 0x140463acf
cmp r11d, r8d
jmp 0x140463ad7
jl 0x1404639ee
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
jmp 0x140463aec
ret

Function at 0x14046400a
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, 0x55320791
mov rax, qword [rcx + 0x460]
mov r10, rcx
movzx ebx, r14w
clc
shr r11b, 5
add rcx, 0x58
sub r11w, cx
mov ebx, r8d
movzx r11, r12w
mov r11d, edx
stc
cmp r10w, 0x38cc
jmp 0x140464047
test rax, rax
jmp 0x14046404f
jne 0x140464064
mov eax, 0x100
jmp 0x14046405f
jmp 0x14046408b
mov rcx, rax
shrd r8, r8, 0xac
sub ah, 0x70
neg eax
mov rax, qword [r10 + 0x458]
movsx r8, bx
test al, r11b
shr rax, 2
btr r8w, ax
xchg r8d, r8d
lea rax, [rax - 1]
bsf r8w, r8w
rol r8b, cl
bt r8w, bp
lea r8, [rcx + rax*2]
movsx rcx, r14w
rcl ch, cl
rcr ax, 0xaf
mov qword [r10 + 0x48], r8
btc cx, r13w
cmp r10b, 0xcc
mov rax, r8
bt cx, r11w
movsx rcx, r15w
mov ecx, dword [r10 + 0x38]
test ecx, ecx
jg 0x1404640dd
test r11d, r11d
jmp 0x1404640d7
je 0x14046417f
sub edx, edx
btc eax, 0x37
bsf eax, r12d
lea eax, [rcx - 1]
cmp r9b, 1
mov dword [r10 + 0x38], eax
rol al, cl
bts rax, rbx
mov eax, r11d
adc r11, rsi
div ebx
add dx, 0x30
sal r11w, 0xe6
sar r11b, cl
mov r11d, eax
cmp dx, 0x39
jbe 0x140464150
mov al, r9b
xor al, 1
btc cx, r15w
dec cx
shl al, 5
shr cl, cl
add al, 7
mov rcx, 0x279450cf
xadd cl, cl
btr cx, r14w
add al, dl
rcr cl, 0x87
movsx edx, al
btr rcx, rsp
movzx cx, dh
bts rcx, rdi
mov rax, qword [r10 + 0x48]
rcl rcx, cl
movsx ecx, dl
test bl, dil
cmp r15b, 0xdf
mov word [rax], cx
xadd rax, rax
add qword [r10 + 0x48], 0xfffffffffffffffe
mov ax, r15w
mov rax, qword [r10 + 0x48]
jmp 0x14046417a
jmp 0x1404640c3
mov rbx, qword [rsp + 8]
sub r8, rax
sar r8, 1
clc
test cl, 0xd4
stc
mov dword [r10 + 0x50], r8d
stc
add qword [r10 + 0x48], 2
ret