joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403f3058
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
shr eax, 0xc6
shld si, r14w, 0xc8
push rbx
movsx bx, r13b
ror bh, 0x6c
sub rsp, 0x28
btc eax, 0x53
not r14b
mov rbx, rdx
mov r14, rcx
lea rsi, [rdx + r8]
rcr eax, 0x19
not eax
movsx ax, r12b
mov eax, dword [rcx + 8]
test r9, 0x69e05275
cmp rsp, r11
test al, 2
jmp 0x1403f30a1
jne 0x1403f3145
mov dil, 1
test al, 4
je 0x1403f32b9
lea rax, [rbx + 1]
cmc
cmp rax, rsi
jmp 0x1403f30bf
ja 0x1403f32ae
mov byte [rbx], 0x12
rol ch, cl
movsx ecx, di
movsx rcx, r14w
mov rcx, qword [r14 + 0x40]
stc
cmp edi, r13d
cmp rcx, 0x80
jmp 0x1403f30e5
jb 0x1403f326e
nop word cs:[rax + rax]
lea rdx, [rax + 1]
cmp rdx, rsi
ja 0x1403f32ae
mov ebx, ecx
test r15b, 0x9d
test dl, r9b
or bl, 0x80
cmp bx, r9w
mov byte [rax], bl
xor al, 0x4d
cdqe
mov rbx, rcx
inc eax
cmp r12w, bx
shr rbx, 7
mov rax, rdx
cmp rcx, 0x3fff
setbe ch
mov rcx, rbx
jmp 0x1403f313a
ja 0x1403f30f5
jmp 0x1403f327a
test r8, r8
jmp 0x1403f314d
jle 0x1403f32ae
mov byte [rbx], 0xa
movzx ecx, r15w
movzx cx, r9b
inc rbx
bsr cx, r10w
mov rcx, qword [r14 + 0x20]
clc
stc
cmp rcx, 0x80
jb 0x1403f31fe
nop dword [rax + rax]
sar al, 0x36
lea rax, [rbx + 1]
cmc
cmp rax, rsi
jmp 0x1403f3192
ja 0x1403f32ae
mov edx, ecx
jmp 0x1403f319f
or dl, 0x80
clc
cmp bx, r15w
test bpl, 0x96
mov byte [rbx], dl
add dl, dh
test dil, 0xdb
jmp 0x1403f31b8
mov rdx, rcx
mov ebx, 0x6f132621
btc bx, 0x22
rol rbx, cl
shr rdx, 7
movzx bx, r8b
rcl bx, 0x1b
mov rbx, rax
cmp r15w, 0x742b
cmp rcx, 0x3fff
not cx
setns ch
mov rcx, rdx
jmp 0x1403f31f3
ja 0x1403f3185
jmp 0x1403f3210
mov rax, rbx
bsf dx, di
mov rdx, rcx
cmp sil, 0x62
rcr cx, 0xfb
lea rcx, [rax + 1]
cmp r10d, 0x2ff378c4
stc
cmp rcx, rsi
ja 0x1403f32ae
mov byte [rax], dl
rcl r8b, cl
mov bx, r15w
mov r8, qword [r14 + 0x20]
btr bx, r11w
or rbx, 0x31063a71
lea rbx, [rcx + r8]
test r9b, bpl
test r9d, 0x5e962e00
cmp rbx, rsi
ja 0x1403f32ae
cmp qword [r14 + 0x28], 0x10
jb 0x1403f32e6
mov rdx, qword [r14 + 0x10]
jmp 0x1403f3269
jmp 0x1403f32ea
mov rdx, rax
mov bx, 0x103a
mov rbx, rcx
mov cl, 0x68
lea rcx, [rdx + 1]
cmp rcx, rsi
jmp 0x1403f3286
ja 0x1403f32ae
mov byte [rdx], bl
mov r8, qword [r14 + 0x40]
shr ah, 0xd3
sbb ax, 0x7253
or ah, 0x9e
lea rax, [rcx + r8]
cmp rax, rsi
jmp 0x1403f32a8
jbe 0x1403f32fd
xor edi, edi
dec bl
sub bx, cx
cmovge rsi, rsp
mov eax, edi
add rsp, 0x28
movzx di, dil
pop rbx
bswap edi
mov di, 0x29b8
jmp 0x1403f32d0
pop rdi
pop rsi
movsx r14d, r13w
jmp 0x1403f32de
pop r14
jmp 0x1403f32e5
ret
lea rdx, [r14 + 0x10]
call fcn.1404a4fce
mov eax, dword [r14 + 8]
jmp 0x1403f32f8
jmp 0x1403f30a7
cmp qword [r14 + 0x48], 0x10
jb 0x1403f3316
mov r14, qword [r14 + 0x30]
jmp 0x1403f3311
jmp 0x1403f331f
add r14, 0x30
jmp 0x1403f331f
mov rdx, r14
jmp 0x1403f3327
call fcn.1404a4fce
jmp 0x1403f32b9
Function at 0x1403f56c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
cmovge r14w, r13w
inc r15b
test bpl, cl
push r12
push rsi
bswap r14d
push rdi
movzx r12w, r15b
setp r12b
push rbx
ror esi, 0x90
neg sil
sub rsp, 0x30
bts r12, rcx
movsx r12w, bl
movaps xmmword [rsp + 0x20], xmm6
jmp 0x1403f5704
mov r15, r9
btr r12, rdx
adc r12b, 0x7c
mov r12, r8
xor sil, r12b
mov r14, rdx
rol sil, 0x9f
mov r13, rcx
mov rsi, qword [rcx]
cmc
cmp r11w, 0x1449
clc
test rsi, rsi
jmp 0x1403f5732
je 0x1403f5863
mov rbx, qword [r13 + 8]
cmp rsi, rbx
jmp 0x1403f5744
je 0x1403f57f9
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f5756
jmp 0x1403f5785
call fcn.14011c953
movups xmmword [rsi + 0x10], xmm6
test r15, 0x2ad460bd
mov byte [rsi], 0
jmp 0x1403f5773
add rsi, 0x20
cmp rsi, rbx
jmp 0x1403f577f
je 0x1403f57f5
mov rax, qword [rsi + 0x18]
cmp sp, r15w
cmp rax, 0x10
jb 0x1403f5760
mov rcx, qword [rsi]
ror dl, 0xab
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403f57ad
jb 0x1403f575b
mov rdi, qword [rcx - 8]
stc
cmp rbp, rcx
add rcx, 0xfffffffffffffff8
stc
test bh, 0xd6
cmp r13b, 0xd5
sub rcx, rdi
test rsi, 0x64ea280b
cmp rcx, 0x20
jmp 0x1403f57da
jae 0x1403f58d9
add rax, 0x28
xchg dh, dl
movsx ecx, r9w
mov rdx, rax
mov rcx, rdi
jmp 0x1403f575b
mov rsi, qword [r13]
mov rdx, qword [r13 + 0x10]
jmp 0x1403f5805
sub rdx, rsi
clc
cmp rdx, 0x1000
jmp 0x1403f5815
jb 0x1403f585b
mov rax, qword [rsi - 8]
cmc
stc
add rsi, 0xfffffffffffffff8
cmc
test r8w, 0x4d8f
sub rsi, rax
jmp 0x1403f5835
cmp rsi, 0x20
jmp 0x1403f583e
jae 0x1403f58d9
add rdx, 0x27
movsx si, bl
mov rsi, rax
movzx rcx, r8w
setg cl
jmp 0x1403f585b
mov rcx, rsi
call fcn.14011c953
mov qword [r13], r14
shl r12, 5
jmp 0x1403f5873
lea r12, [r12 + r14]
shrd di, ax, 0x7f
mov qword [r13 + 8], r12
shl r15, 5
rcl si, 0xa6
lea r15, [r15 + r14]
add sil, 0x88
mov qword [r13 + 0x10], r15
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
jmp 0x1403f58a7
pop rbx
xchg r12w, r12w
mov dil, 0x64
pop rdi
movzx rsi, r9w
setae r15b
pop rsi
seto r13b
movzx r13d, cx
pop r12
movzx r15w, r12b
xchg r15b, r14b
movzx r13d, di
pop r13
mov r15, rcx
pop r14
pop r15
ret
call fcn.1404b79e9
int3
Function at 0x14042388a
Capabilities:
Check for software breakpoints

Disassembly:
push rsi
sal sil, 0xd9
adc si, r13w
mov r10, qword [rcx]
sbb rsi, 0x3eb80d47
mov rsi, qword [rcx + 0x18]
xadd r9b, r9b
jmp 0x1404238af
mov r9d, dword [r10 + 4]
stc
imul r9d, dword [r10]
stc
cmp r8d, 2
jmp 0x1404238c2
jne 0x140423a4d
test r9d, r9d
jmp 0x1404238d0
je 0x140423ae6
lea ecx, [r9 - 1]
test eax, r11d
stc
cmp spl, 0xcc
cmp ecx, 3
jmp 0x1404238ea
jb 0x1404239ea
mov r11d, r9d
bsr r10w, dx
and r11d, 0xfffffffc
nop word cs:[rax + rax]
movzx r8d, word [rsi]
and r10b, sil
btc r10w, r14w
shr r10, cl
movzx r10d, word [rsi + 4]
test cl, r12b
cmp r8b, 0xc6
sub ecx, ecx
sub cl, r13b
test ebp, 0x6a1d6449
cmp r8w, word [rdx]
jmp 0x140423938
setne cl
clc
rcr r8d, 0xa7
neg ecx
mov word [rsi + 2], cx
movzx r8, r14w
rcl r8b, cl
sal r8w, 0x33
xor ecx, ecx
shl cl, cl
inc r8b
and r8, r8
cmp r10w, word [rdx]
setne cl
neg ecx
not r8w
dec r8b
mov word [rsi + 6], cx
movzx r8d, word [rsi + 8]
cmc
test r10b, r13b
sub ecx, ecx
stc
cmp r8w, word [rdx]
mov r8, r15
setne cl
rcl r8b, cl
rcl r8w, 0xf4
dec r8w
neg ecx
btr r8w, 0x3a
sal r8b, 0xe5
mov word [rsi + 0xa], cx
sbb r8b, 0x33
ror r8b, cl
clc
movzx r8d, word [rsi + 0xc]
stc
test r8b, r15b
cmc
xor ecx, ecx
sal cl, 0xaf
sal cl, cl
shr cl, cl
cmp r8w, word [rdx]
setne cl
neg ecx
cmp rax, rsi
clc
mov word [rsi + 0xe], cx
cmp spl, 1
add rsi, 0x10
jmp 0x1404239db
add r11d, 0xfffffffc
jmp 0x1404239e4
jne 0x140423909
test r9b, 3
jmp 0x1404239f3
je 0x140423ae6
and r9d, 3
sar r8w, 0x73
shl r8b, cl
sub ecx, ecx
xor r8b, r12b
nop word cs:[rax + rax]
movzx r8d, word [rsi + rcx*4]
xor eax, eax
xor al, 0xe1
cmp r8w, word [rdx]
setne al
neg eax
jmp 0x140423a2c
mov word [rsi + rcx*4 + 2], ax
jmp 0x140423a36
inc rcx
clc
cmp r9d, ecx
jmp 0x140423a42
jne 0x140423a15
jmp 0x140423ae6
test r9d, r9d
jmp 0x140423a55
je 0x140423ae6
movzx r10d, word [rdx]
mov r8d, r9d
test dil, 0x4a
test r8b, dl
sub ecx, ecx
jmp 0x140423a70
jmp 0x140423a85
inc rcx
test ax, 0x72ca
cmp r8d, ecx
je 0x140423ae6
cmp word [rsi + rcx*8], r10w
jmp 0x140423a8f
jne 0x140423a75
movzx eax, word [rsi + rcx*8 + 2]
jmp 0x140423aa5
cmp ax, word [rdx + 2]
jmp 0x140423aae
jne 0x140423a75
movzx eax, word [rsi + rcx*8 + 4]
cmp ax, word [rdx + 4]
jmp 0x140423ac2
jne 0x140423a75
mov word [rsi + rcx*8 + 6], 0
movzx r10w, r10b
movsx r10, r14w
movzx r10d, word [rdx]
jmp 0x140423ae1
jmp 0x140423a75
pop rsi
ret
Function at 0x1404415c1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
add r15b, r11b
sar r15b, 0x30
rcr r15d, cl
push r14
test bh, 0xf1
push rsi
movsx r15d, r15w
push rdi
bsr r14w, di
rol r14b, 0x39
dec r15b
push rbp
push rbx
sub rsp, 0x28
movsx bx, dil
mov r15, 0x40a410fc
mov r15d, r9d
rol bpl, 0xa4
mov ebp, r8d
mov r14, rdx
shr bh, 0xdb
movzx rbx, bp
sbb bh, 0x50
mov rbx, rcx
not ch
lea rcx, [rdx + 0x20]
mov edx, r8d
sbb r8w, 0x215c
bsr r8, r14
mov r8d, r9d
sub r9d, r9d
jmp 0x14044162e
call fcn.1404417e3
test r15d, r15d
jmp 0x14044163b
jle 0x1404416d9
test rax, rax
je 0x1404416d9
movsxd rsi, ebp
bts ecx, ecx
bswap cx
mov ecx, r15d
sub ebp, ebp
mov rdx, rsi
jmp 0x140441660
jmp 0x140441697
movzx edi, word [rdi + rdx*2]
jmp 0x14044166e
mov word [rax + rbp*2], di
jmp 0x140441677
inc rbp
jmp 0x14044167f
inc rdx
cmp r11b, r10b
test r14b, 0xc0
cmp rcx, rbp
jmp 0x140441691
je 0x1404416dd
mov di, 0x2a
test byte [rbx + 0x1c], 4
jmp 0x1404416a4
jne 0x14044166e
mov rdi, qword [rbx]
test r11b, 0x6c
cmc
cmp qword [rdi + 0x10], rdx
jbe 0x1404417d8
cmp qword [rdi + 0x18], 8
jmp 0x1404416c6
jb 0x140441665
mov rdi, qword [rdi]
jmp 0x1404416d4
jmp 0x140441665
movsxd rsi, ebp
clc
mov rbx, qword [rbx]
mov rdi, qword [rbx + 0x10]
sub cl, dil
clc
mov rcx, rdi
test r11b, r13b
stc
jmp 0x1404416f4
sub rcx, rsi
jmp 0x1404416fc
jb 0x1404417d8
movsxd rax, r15d
cmp r8w, cx
stc
cmp rcx, rax
cmovb rax, rcx
xor cx, di
cmp qword [rbx + 0x18], 8
cmovae cx, r15w
mov rcx, rbx
jmp 0x140441726
jb 0x14044173a
mov rcx, qword [rbx]
btc bp, bp
cwd
bsr dx, r11w
lea rcx, [rcx + rsi*2]
xchg ebp, ebp
mov r8w, ax
movzx r8d, si
sub rdi, rax
shr r8b, 0x82
adc ebp, esi
mov rbp, rdi
test cl, r14b
sub rbp, rsi
rol r8w, 0x9d
btr edx, r15d
cmp di, r15w
lea rdx, [rcx + rax*2]
movsx r8, bx
adc r8, r8
sbb r8b, r10b
lea r8, [rbp + 2]
jmp 0x140441786
add r8, rbp
jmp 0x14044178e
call fcn.1404a4fce
mov qword [rbx + 0x10], rdi
mov byte [r14 + 0x16], 0
movsx bp, r10b
add rsp, 0x28
pop rbx
mov r15w, si
movsx r14d, r8w
movzx rdi, r15w
pop rbp
pop rdi
movsxd r14, r12d
movsx r14w, r11b
movsx r14d, r14w
pop rsi
movsx r14w, r10b
mov r14b, r14b
cmovg r14w, bp
pop r14
pop r15
jmp 0x1404417d7
ret
call fcn.140440c9c
int3
Function at 0x1404457ea
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x1404457f3
movzx ecx, cx
jmp 0x1404457fb
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
jmp 0x140445818
add rsp, 0x28
jmp 0x140445821
ret
Function at 0x140446fff
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx eax, r12w
movzx ax, cl
lahf
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jmp 0x14044701c
je 0x14044705e
mov ecx, eax
or r9b, 0x18
rcr dl, 0xe5
btr r8, rcx
movabs r8, 0xcafa59766d7f94e
rcr r9d, 0xb0
adc r9, 0x33d46975
mov dl, 3
mov r9d, 0x2a
test r13, r12
clc
add rsp, 0x28
jmp 0x140447059
jmp fcn.1403b0d5a
nop
jmp 0x14044706b
add rsp, 0x28
jmp 0x140447074
ret

Function at 0x1404481e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
movsx r14d, ax
push rsi
push rdi
push rbp
cwde
sbb rdi, 0x4bec0af8
push rbx
neg sil
sal sil, 0x35
sub rsp, 0x60
jmp 0x140448209
movaps xmmword [rsp + 0x50], xmm6
mov r14, r9
jmp 0x14044821a
mov rbx, r8
mov rdi, rdx
rdtsc
movzx dx, dh
mov rsi, rcx
movzx eax, si
movss xmm6, dword [rsp + 0xb0]
movsx bp, dl
movzx ebp, byte [rsp + 0xb8]
bswap dx
rdtsc
mov qword [rsp + 0x38], 0
cmovbe rdx, r9
mov rcx, qword [rcx + 8]
cqo
mov dh, bh
mov rax, qword [rcx]
movsxd rdx, eax
lea rdx, [rsp + 0x38]
jmp 0x14044826b
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
bswap dx
mov rcx, qword [rsp + 0x38]
cwde
mov rax, qword [rcx]
movsx edx, r12w
lea rdx, [rsp + 0x30]
jmp 0x140448291
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rdi]
lahf
mov rax, qword [rcx]
movsxd r8, r12d
mov r8b, 0xf1
mov r8d, 1
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
cmova r8w, cx
mov dx, 0x4f1a
mov rax, qword [rcx]
mov dl, r10b
mov rdx, rdi
mov r8d, ebx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
lahf
movsx dx, dil
movzx edx, bpl
jmp 0x1404482e3
mov rax, qword [rcx]
jmp 0x1404482eb
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
cmovp ax, r11w
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
movzx rax, bp
cqo
rdtsc
movups xmm0, xmmword [r14]
movsxd rdx, esp
cwd
cbw
movaps xmmword [rsp + 0x40], xmm0
movsx dx, r14b
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
jmp 0x14044832c
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
movsx eax, bp
cwd
mov rdx, qword [rsp + 0x38]
setle al
movsx ax, dh
movzx ax, r15b
mov rax, qword [rcx]
jmp 0x140448355
mov qword [rsp + 0x20], 0
jmp 0x140448363
movaps xmm3, xmm6
jmp 0x14044836b
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
jmp 0x14044837e
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
movsx eax, r10w
mov al, r14b
cbw
mov rax, qword [rcx]
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
cmp r12w, r8w
add rsp, 0x60
movsxd rbx, edx
pop rbx
pop rbp
setg sil
not sil
xchg dil, sil
pop rdi
mov sil, 0x86
not r14
movsx r14, dx
pop rsi
movsx r14, r8w
movsxd r14, esi
pop r14
jmp 0x1404483cb
ret
Function at 0x14044a04f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
cmp r11b, bl
nop
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jmp 0x14044a06b
jne 0x14044a16f
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp r10d, 0xce43ea7
cmp dword [rcx], 0x4550
jne 0x14044a16f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x14044a0a3
jne 0x14044a16f
sub r8, rdx
movzx r9w, dl
jmp 0x14044a0ba
movzx edx, word [rcx + 0x14]
shrd ax, bx, 0x91
add rdx, 0x18
rol r9b, cl
add rdx, rcx
btc ax, r14w
movzx eax, word [rcx + 6]
add r9b, 0xad
or r9w, r15w
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
clc
mov qword [rsp], rdx
jmp 0x14044a0f0
cmp rdx, r9
jmp 0x14044a0f8
je 0x14044a140
mov ecx, dword [rdx + 0xc]
test ax, 0x2744
jmp 0x14044a10a
cmp r8, rcx
jmp 0x14044a112
jb 0x14044a132
mov eax, dword [rdx + 8]
cmp spl, 0x25
test dh, 5
cmp r8w, r10w
add eax, ecx
clc
cmp r8, rax
jb 0x14044a142
add rdx, 0x28
jmp 0x14044a13b
jmp 0x14044a0e7
sub edx, edx
test rdx, rdx
jne 0x14044a157
sub al, al
jmp 0x14044a152
jmp 0x14044a180
cmp dword [rdx + 0x24], 0
jge 0x14044a168
xor al, al
jmp 0x14044a180
mov al, 1
jmp 0x14044a180
sub al, al
jmp 0x14044a176
jmp 0x14044a180
add rsp, 0x18
ret
Function at 0x14045ac5a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rcx, [0x1400b9450]
jmp 0x14026753d
jmp fcn.140118474
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
movzx rbx, sp
movsx rbx, di
mov qword [rsp + 0x18], rsi
shld ebx, r12d, 0x56
push rdi
movsx rbx, si
xor bx, 0x3dd2
cmovno ebx, edi
sub rsp, 0x20
movsx ebx, r11w
lea rbx, [0x1400b95a0]
jmp 0x14045ac97
call fcn.1400fd251
mov ebp, eax
call fcn.1400f398a
mov ecx, dword [rbx + 0x320]
jmp 0x14045acae
xor esi, esi
cmp spl, bl
test ecx, ecx
je 0x14045ad69
lea rdi, [rbx + 0x10]
test ch, 0x68
cmp rsi, 0x14
jmp 0x14045accb
jge 0x14045ad69
cmp qword [rdi], 0
movsx eax, sp
movzx rax, sp
movsx rax, r11w
mov eax, ecx
jmp 0x14045ace7
je 0x14045ad51
cmp dword [rdi - 8], ebp
jmp 0x14045acf5
jne 0x14045ad51
mov rax, qword [rdi + 0x10]
cmp r13b, cl
test di, r10w
test rax, rax
jmp 0x14045ad0e
je 0x14045ad1a
mov dword [rax], 1
mov rcx, qword [rdi]
jmp 0x14045ad22
call fcn.14045b37b
mov rcx, qword [rdi + 8]
call fcn.1404a1448
and qword [rdi], 0
jmp 0x14045ad3c
dec dword [rbx + 0x320]
cmovp eax, r11d
cwde
movzx rax, r12w
mov eax, dword [rbx + 0x320]
inc rsi
or cl, r11b
add rdi, 0x28
bt rcx, rdi
mov ecx, eax
test eax, eax
jne 0x14045acc2
mov rbx, qword [rbx + 0x328]
clc
test rbx, rbx
jmp 0x14045ad79
jne 0x14045aca3
mov rbx, qword [rsp + 0x30]
sar si, cl
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sbb dil, dl
add rsp, 0x20
movzx rdi, r11w
pop rdi
jmp 0x14045ada2
jmp 0x140243bf4

Function at 0x14045bae6
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
adc ah, bh
mov rbp, rsp
add ax, r12w
test sil, cl
sub rsp, 0x20
movsx rbx, ax
bts ax, r13w
btr ebx, 0x52
mov rax, qword [0x1400b7288]
ror bl, 0xc5
sal ebx, cl
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x14045bb27
jne 0x14045bc05
and qword [rbp + 0x18], 0
movsx ecx, r12w
jmp 0x14045bb3b
lea rcx, [rbp + 0x18]
jmp 0x14045bb44
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
cmp esp, eax
xor qword [rbp + 0x10], rax
jmp 0x14045bb65
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
clc
test bpl, r11b
xor qword [rbp + 0x10], rax
jmp 0x14045bb7e
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
movsx ecx, dx
stc
bt rcx, r11
lea rcx, [rbp + 0x10]
test r10w, 0x54de
jmp 0x14045bba1
shl rax, 0x20
cmc
xor rax, qword [rbp + 0x20]
jmp 0x14045bbaf
xor rax, qword [rbp + 0x10]
ror rbp, 0x40
xor rax, rcx
rcr bpl, 0xd6
bt bp, r12w
rol rcx, cl
movabs rcx, 0xffffffffffff
mov rbp, r8
and rax, rcx
btc rbp, r13
movabs rcx, 0x2b992ddfa233
ror bpl, cl
cmp rax, rbx
cmove rax, rcx
sal bpl, cl
xor rbx, r8
mov qword [0x1400b7288], rax
movsxd rbx, r13d
shl bp, 0xff
adc bl, dil
mov rbx, qword [rsp + 0x48]
not rax
xchg rbp, rbp
mov qword [0x1400b7280], rax
add rsp, 0x20
mov rbp, 0x24a87f8b
pop rbp
jmp 0x14045bc28
ret
Function at 0x14046d773
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
cmc
cmp bpl, 0xd9
mov qword [rax + 0x10], rbp
mov bpl, r11b
mov qword [rax + 0x18], rsi
clc
mov qword [rax + 0x20], rdi
sub sil, spl
test dil, r14b
neg si
push r14
sal edi, cl
sub rsp, 0x20
inc r14d
sbb bp, 0x499d
cmp sp, dx
mov rdi, qword [rsp + 0x50]
shld r14w, r13w, 0x8b
mov r14, r9
xchg bpl, sil
mov rsi, r8
ror bpl, cl
mov rbp, rdx
stc
jmp 0x14046d7cb
test rdi, rdi
jmp 0x14046d7d3
je 0x14046d8c0
mov rbx, qword [r8 + 8]
test r11d, 0x799d76c5
stc
jmp 0x14046d7ea
test rbx, rbx
je 0x14046d8a7
mov rax, qword [rbx + 0x40]
bswap r8w
movzx r8, r14w
movzx r8d, word [r14]
stc
cmp qword [rax], 0
jmp 0x14046d80d
je 0x14046d84d
mov rax, qword [rbx + 0x58]
cmc
cmp dword [rax], 0
jle 0x14046d84d
dec dword [rax]
setbe ch
cdqe
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
movzx ax, sil
nop
cdqe
lea rax, [rdx + 2]
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x14046d848
jmp 0x14046d88a
mov rax, qword [rbx]
mov dl, 0xba
cmovnp rcx, r11
movzx edx, r8w
movsx rcx, r11w
setp cl
movsx cx, r13b
mov rcx, rbx
jmp 0x14046d86e
mov rax, qword [rax + 0x18]
jmp 0x14046d877
call qword [0x1400b8d90]
movzx r8d, ax
movzx eax, di
adc ax, 0x9bf
mov ah, al
mov eax, 0xffff
clc
cmp si, r11w
cmp r13b, 0x13
cmp ax, r8w
jmp 0x14046d8a1
jne 0x14046d8b0
mov byte [rsi], 1
stc
jmp 0x14046d8b0
add r14, 2
cmc
clc
sub rdi, 1
jne 0x14046d7ea
movups xmm0, xmmword [rsi]
sar sil, 0xcd
xor ax, 0x7c5a
btc rbx, 0xbf
mov rbx, qword [rsp + 0x30]
cmp bpl, 0x2f
and al, r14b
mov rax, rbp
and si, 0x601a
mov rsi, qword [rsp + 0x40]
cmc
sal r14d, 0x4d
shr di, cl
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
add bpl, 0xa3
test cl, r8b
xor bpl, 0x72
mov rbp, qword [rsp + 0x38]
rcr r14, 0x58
sub r14, rax
movsx r14w, r15b
add rsp, 0x20
pop r14
ret
Function at 0x14046d91e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
shld bp, r9w, 0x4e
or sil, dl
shl esi, 0xc9
mov qword [rax + 0x20], rdi
movzx di, spl
push r14
cmp cx, 0xdd3
xor r14d, 0x67a64ff7
bsf rdi, rcx
sub rsp, 0x20
ror ebp, cl
shl rbp, 0x12
shld esi, r15d, 0x6b
mov rsi, qword [rsp + 0x50]
sub edi, 0x441f62e2
movzx rbp, bx
movzx r14d, r9w
rcr ebp, 0xcd
xor dil, 0xae
rcl dil, 0x82
mov rdi, r8
mov rbp, rdx
test rsi, rsi
jmp 0x14046d98f
je 0x14046da5b
mov rbx, qword [r8 + 8]
cmp r12w, 0xb67
test rbx, rbx
je 0x14046da41
mov rax, qword [rbx + 0x40]
cmp r14w, si
cmc
clc
cmp qword [rax], 0
jmp 0x14046d9bb
je 0x14046da07
mov rax, qword [rbx + 0x58]
cmp rax, r8
stc
cmp dword [rax], 0
jmp 0x14046d9d1
jle 0x14046da07
dec dword [rax]
rdtsc
cqo
movsxd rdx, esp
mov rcx, qword [rbx + 0x40]
mov al, 0x55
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
lahf
cmovnp eax, r13d
movzx eax, r14w
mov word [rdx], r14w
jmp 0x14046da02
jmp 0x14046da2a
mov rax, qword [rbx]
movzx cx, r13b
sete dl
not dl
movzx edx, r14w
mov rcx, rbx
mov rax, qword [rax + 0x18]
jmp 0x14046da24
call qword [0x1400b8d90]
mov ecx, 0xffff
test r8w, dx
cmp cx, ax
jmp 0x14046da3b
jne 0x14046da4c
mov byte [rdi], 1
test bl, dil
test cx, 0x690a
sub rsi, 1
jmp 0x14046da55
jne 0x14046d99f
movups xmm0, xmmword [rdi]
xor bh, 0x1b
mov rbx, qword [rsp + 0x30]
stc
cbw
mov rax, rbp
mov rsi, qword [rsp + 0x40]
btc edi, 0xe6
shrd di, dx, 0x36
sbb rdi, 0x6cd2438d
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1404747f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
jmp 0x14047480a
mov qword [rax + 0x20], rdi
push r14
btc rbx, 0xc6
adc rbx, 0x6b781dd2
sub rsp, 0x20
movsx ebx, r14w
mov rsi, r9
mov rbx, r8
sar r14w, 0x9f
xor bpl, 0xf5
mov r14, rdx
mov rbp, rcx
test r9, r9
je 0x140474923
mov rdi, qword [rdx + 8]
jmp 0x14047484c
test rdi, rdi
jmp 0x140474854
je 0x140474906
mov rax, qword [rdi + 0x40]
add r8b, al
movzx r8d, word [rbx]
cmp cx, 0x34ca
jmp 0x14047486f
cmp qword [rax], 0
jmp 0x140474878
je 0x1404748bc
mov rax, qword [rdi + 0x58]
cmp dword [rax], 0
jle 0x1404748bc
dec dword [rax]
mov rcx, qword [rdi + 0x40]
movsx ax, bh
mov rdx, qword [rcx]
jmp 0x1404748a2
lea rax, [rdx + 2]
jmp 0x1404748ab
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x1404748b7
jmp 0x1404748f2
mov rax, qword [rdi]
movsx dx, r13b
bswap cx
movsx edx, r12w
movzx edx, r8w
movsx ecx, r10w
mov rcx, rdi
jmp 0x1404748db
mov rax, qword [rax + 0x18]
jmp 0x1404748e4
call qword [0x1400b8d90]
movzx r8d, ax
sar rax, 0x94
mov eax, 0xffff
cmp ax, r8w
jmp 0x140474900
jne 0x14047490a
mov byte [r14], 1
add rbx, 2
jmp 0x140474919
sub rsi, 1
jne 0x14047484c
movups xmm0, xmmword [r14]
clc
bsr r14w, r8w
mov rbx, qword [rsp + 0x30]
mov rax, rbp
shr r14b, cl
ror edi, cl
inc r14b
mov rsi, qword [rsp + 0x40]
bswap rdi
mov rdi, qword [rsp + 0x48]
shl r14b, cl
movdqu xmmword [rbp], xmm0
dec bpl
movzx r14, r14w
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
movsx r14w, r15b
movzx r14, cx
mov r14d, 0x528f7c89
pop r14
jmp 0x140474978
ret
Function at 0x1404a1cf5
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test al, r11b
jmp 0x1404a1d01
and dword [rsp + 0x30], 0
jmp 0x1404a1d0b
call fcn.1404ac06f
mov r9d, 2
bswap edx
lea r8, [rsp + 0x30]
cdq
cmove dx, si
mov rcx, qword [rax + 0x28]
movzx edx, r14w
lea edx, [r9 + 0x20]
jmp 0x1404a1d33
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
test r8, 0x3a05959
sub ecx, 0x30
jmp 0x1404a1d4d
je 0x1404a1d99
sub ecx, 1
jmp 0x1404a1d5b
je 0x1404a1d8a
cmp ecx, 1
jmp 0x1404a1d69
je 0x1404a1d7b
sub eax, eax
jmp 0x1404a1d76
jmp 0x1404a1da1
mov eax, 3
jmp 0x1404a1d85
jmp 0x1404a1da1
mov eax, 1
jmp 0x1404a1d94
jmp 0x1404a1da1
mov eax, 2
clc
test ah, cl
add rsp, 0x28
ret

Function at 0x1404a2bec
Capabilities:
Terminate process

Disassembly:
push rbx
sub rbx, r15
rcl ebx, cl
sub rsp, 0x20
ror bl, cl
movsx bx, r11b
cmovl bx, si
mov rbx, rcx
test esi, 0x7fba5b22
xor ecx, ecx
jmp 0x1404a2c12
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
movzx ebx, ax
add rsp, 0x20
xchg bh, bh
mov bx, 0x341d
pop rbx
jmp 0x1404a2c42
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]