joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14042c0a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test dil, cl
btc r15d, 9
bswap r15w
push r14
ror r14w, cl
push r12
setbe r12b
push rsi
push rdi
cmc
push rbp
push rbx
movsx r14d, sp
sub rsp, 0x20
mov r12, r8
rcl bpl, cl
mov edi, edx
sbb r15b, 0x8f
mov rbx, rcx
inc bp
ror ebp, 0x28
sar r14b, cl
lea r14, [rcx + 0x38]
lea r15, [rcx + 0x39]
mov ebp, 0x80
stc
cmc
sub esi, esi
jmp 0x14042c0fc
jmp 0x14042c139
lea rcx, [rax + 1]
jmp 0x14042c10a
mov qword [rbx + 0xc0], rcx
movzx eax, byte [rax]
mov byte [r12 + rsi], al
jmp 0x14042c11d
inc rsi
shr ebp, 1
clc
test r15b, dl
cmp r12b, 0x52
cmp rsi, 4
jmp 0x14042c133
je 0x14042c29e
test ebp, edi
je 0x14042c11d
cmp qword [rbx + 0x10], 0
jmp 0x14042c14b
je 0x14042c174
mov rcx, qword [rbx + 0x28]
jmp 0x14042c15a
call qword [rbx + 0x20]
test eax, eax
je 0x14042c22b
cmp dword [rbx + 0x30], 0
jmp 0x14042c16e
je 0x14042c297
mov rax, qword [rbx + 0xc0]
sal cx, cl
movsx ecx, bx
mov rcx, qword [rbx + 0xc8]
jmp 0x14042c18d
cmp rax, rcx
jmp 0x14042c195
jae 0x14042c297
cmp rax, rcx
jmp 0x14042c1a3
jb 0x14042c101
cmp dword [rbx + 0x30], 0
jmp 0x14042c1b2
je 0x14042c250
mov r8d, dword [rbx + 0x34]
movzx dx, dl
mov rcx, qword [rbx + 0x28]
not dh
movsxd rdx, edx
mov rdx, r14
jmp 0x14042c1d1
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
test r12, 0x60065996
stc
sub ecx, dword [rbx + 0xd0]
test r14b, 0x55
test r9d, ecx
stc
add dword [rbx + 0xb8], ecx
test edi, r11d
jmp 0x14042c1ff
test eax, eax
jmp 0x14042c206
je 0x14042c257
movsxd rcx, eax
movsx eax, r10w
sal al, 8
add rcx, r14
cwde
movsxd rax, esp
movzx eax, byte [r14]
jmp 0x14042c226
jmp 0x14042c27a
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
cmp r14b, 0xeb
cmp rax, rcx
jmp 0x14042c245
jae 0x14042c1a9
jmp 0x14042c101
xor eax, eax
jmp 0x14042c114
mov dword [rbx + 0x30], 0
mov byte [rbx + 0x38], 0
rcl cx, cl
dec cx
sub eax, eax
movsx cx, r10b
movsxd rcx, ecx
mov rcx, r15
jmp 0x14042c27a
mov qword [rbx + 0xc8], rcx
jmp 0x14042c286
mov qword [rbx + 0xc0], r15
jmp 0x14042c292
jmp 0x14042c114
xor r12d, r12d
ror dil, 0x95
mov rax, r12
xor di, r15w
btr r12w, r8w
jmp 0x14042c2af
add rsp, 0x20
mov r15b, 0xdb
movzx bp, cl
movzx esi, r15w
pop rbx
bswap esi
movsx r15, dx
movzx r14w, bl
pop rbp
setp r15b
movsx r15d, r12w
pop rdi
pop rsi
mov r14b, r15b
bswap r14
jmp 0x14042c2e0
pop r12
pop r14
movsx r15d, bx
setno r15b
movzx r15, r14w
pop r15
jmp 0x14042c2f7
ret
Function at 0x14043f09b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
cbw
mov ah, 0xde
push rdi
push rbx
and si, 0x29df
movsx esi, bp
sar ax, cl
sub rsp, 0x90
mov di, 0x4652
bsr di, bp
movaps xmmword [rsp + 0x80], xmm7
test spl, 0x92
shr ah, 0x12
movaps xmmword [rsp + 0x70], xmm6
movsx si, r11b
mov rdi, rdx
mov rsi, rcx
ror ah, 0x83
or ax, 0xffa
mov rax, qword [rdx]
cmp qword [rax + 0x18], 8
jmp 0x14043f0f2
jb 0x14043f109
mov rax, qword [rax]
adc r9w, 0x5a77
rol cx, 0xec
bsr rcx, rdx
movsxd rcx, r8d
lea r9, [rax + rcx*2]
bswap eax
shld eax, esi, 0x92
xor ebx, ebx
not ah
movzx rax, r9w
nop word cs:[rax + rax]
bswap ax
rol ax, 0xe3
movzx eax, word [r9 + rbx*2]
cmp eax, 0xa
je 0x14043f15a
test eax, eax
jmp 0x14043f147
je 0x14043f15a
inc rbx
jmp 0x14043f155
jmp 0x14043f132
test byte [rdi + 0x1c], 4
jne 0x14043f2c3
mov rcx, qword [rdi + 0x10]
rdtsc
mov rax, qword [rdi + 8]
movsd xmm0, qword [rax + 8]
movsx rdx, bx
movsx r8w, sil
movsd qword [rsp + 0x40], xmm0
movsx dx, al
cdq
movsxd r8, r8d
mov dword [rsp + 0x30], ebx
movzx r8d, bp
jmp 0x14043f197
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
movsxd r8, ebp
xchg dx, r8w
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x40]
jmp 0x14043f1bd
call fcn.140445cd8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov ah, 0xe8
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x38]
cdqe
cmovl ax, di
mov rax, qword [rcx]
mov rdx, 0x4f9513a1
not dx
cdq
lea rdx, [rsp + 0x40]
call qword [rax + 0x1e0]
test eax, eax
je 0x14043f227
mov ecx, eax
movsxd r9, r9d
movabs r8, 0xe31b45c42a775183
mov dl, 3
mov r9d, 0x4f
jmp 0x14043f222
call fcn.1403afa94
movss xmm6, dword [rsp + 0x4c]
adc cx, 0x198f
xadd rdx, rdx
movss xmm7, dword [rsp + 0x50]
adc dx, 0x3f1a
cmc
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x40]
sub r8d, r8d
call fcn.14043f618
movss xmm0, dword [rdi + 0x18]
jmp 0x14043f25e
movss dword [rsi], xmm0
jmp 0x14043f267
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
movss xmm0, dword [rsp + 0x50]
movss dword [rsi + 8], xmm0
movzx rcx, si
sar cl, cl
mov dword [rsi + 0xc], 0
bsf ecx, r12d
xor cl, bh
movss dword [rsi + 0x10], xmm7
mov dword [rsi + 0x14], ebx
or ecx, ebp
mov rcx, qword [rsp + 0x38]
jmp 0x14043f2a5
test rcx, rcx
jmp 0x14043f2ad
je 0x14043f32b
mov rax, qword [rcx]
jmp 0x14043f2bb
call qword [rax + 0x10]
jmp 0x14043f32b
movss xmm0, dword [rdi + 0x18]
jmp 0x14043f2cd
movss dword [rsi], xmm0
jmp 0x14043f2d6
cvtsi2ss xmm1, ebx
mulss xmm1, dword [0x1400bfc14]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
jmp 0x14043f2f0
movss xmm0, dword [0x1400bfc94]
jmp 0x14043f2fd
movlps qword [rsi + 8], xmm0
mov rax, qword [rdi + 8]
jmp 0x14043f30a
movss xmm0, dword [rax + 0xc]
addss xmm0, dword [0x1400bfbd0]
movss dword [rsi + 0x10], xmm0
mov dword [rsi + 0x14], ebx
add dil, 0x7a
btc bx, cx
cmp r13w, bp
movaps xmm6, xmmword [rsp + 0x70]
mov sil, bpl
cmovns ebx, ebp
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0x90
mov bl, bh
movsx esi, r8w
mov sil, 0x45
pop rbx
movzx edi, ax
pop rdi
not si
bswap si
pop rsi
jmp 0x14043f35f
ret
Function at 0x1404444f8
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140444501
movzx ecx, cx
jmp 0x140444509
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
test r8b, 0x49
cmp ebx, r11d
cmp eax, 0x100
setae al
test r12w, 0x6708
cmp bl, r14b
add rsp, 0x28
jmp 0x140444533
ret

Function at 0x140445bef
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
bswap eax
mov rcx, qword [rcx]
cmovp ax, bp
movzx ax, r11b
movsx ax, spl
mov rax, qword [rcx]
jmp 0x140445c0e
call qword [rax + 0x28]
test eax, eax
je 0x140445c4b
mov ecx, eax
test si, 0x3111
movabs r8, 0xcafa59766d7f94e
rcr dl, cl
or dl, 0xe5
mov dl, 3
or r9b, al
movzx r9, di
movzx r9d, bp
mov r9d, 0x2a
add rsp, 0x28
jmp fcn.1403afa94
nop
clc
add rsp, 0x28
ret
Function at 0x1404478c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
shl ax, 0xa8
add r15w, 0x178c
push r14
xor r15b, r11b
push rsi
movsx r15w, dl
push rdi
push rbp
mov rax, rcx
push rbx
movzx rbx, r12w
bswap eax
rol bpl, cl
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm8
mov sil, r10b
bswap bx
movzx rbx, r12w
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm6
cbw
movzx rax, r10w
movsx di, dl
mov r14, r8
mov rbx, rdx
xchg di, ax
mov r15, rcx
rdtsc
movsx rcx, r10w
mov rsi, qword [rsp + 0xe0]
movsx rcx, di
mov ebp, dword [rsp + 0xf0]
cwd
mov cl, r12b
not cl
mov edx, dword [rsp + 0xe8]
xchg dil, dil
movsx rdi, si
mov rdi, qword [r9]
movzx ax, spl
bswap rax
xchg al, ah
mov rax, qword [rdi]
movsx rcx, sp
mov rcx, rdi
jmp 0x14044796b
call qword [rax + 0x18]
mov rax, qword [rdi]
cwd
mov rcx, rdi
mov edx, 0x5e0373c
mov edx, ebp
jmp 0x140447982
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
cwde
movups xmm0, xmmword [r14]
mov r14, rbx
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
cwd
setns dh
lea r14, [rsp + 0x40]
movzx rdx, bp
mov rdx, r14
jmp 0x1404479af
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x1404479bb
movaps xmm0, xmm7
jmp 0x1404479c3
call fcn.1404b886f
movaps xmm8, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404b886f
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
jmp 0x1404479f8
movaps xmm0, xmm7
jmp 0x140447a00
call fcn.1404b886f
movaps xmm6, xmm0
jmp 0x140447a0d
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404b886f
movss dword [rbx + 8], xmm6
jmp 0x140447a23
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
movsx rax, bx
jmp 0x140447a37
mov rcx, qword [r15 + 0x18]
mov rax, r8
mov rax, qword [r15 + 0x20]
jmp 0x140447a47
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
xor r8d, r8d
nop
test rbp, 0x63b3881
stc
test r14b, dl
cmp word [rsi + r8*2], 0
jmp 0x140447a6a
lea r8, [r8 + 1]
jmp 0x140447a73
jne 0x140447a5f
dec r8d
movzx r9w, dl
mov dx, 0x4ead
mov rbp, qword [rcx]
mov dh, 0x41
mov qword [rsp + 0x28], rax
cdq
movsx r9d, si
mov qword [rsp + 0x20], r14
movsx r9w, r13b
mov dword [rsp + 0x38], 0
movzx r9, dx
cdq
cqo
mov dword [rsp + 0x30], 2
bswap r9
mov rdx, rsi
mov r9, rdi
jmp 0x140447ac4
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
test sil, 0xbe
bt ebp, 0x73
mov rbx, r9
movaps xmm8, xmmword [rsp + 0x70]
shld r15w, r10w, 0xb9
movzx bp, dil
add rsp, 0x88
pop rbx
pop rbp
xchg r15b, dil
pop rdi
cmovns si, si
pop rsi
jmp 0x140447b0b
pop r14
cmova r15, rdx
pop r15
ret
Function at 0x140448bdc
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
sub eax, eax
shld r8, r12, 0xa0
mov r8, rcx
ror ah, 0xee
mov eax, 0x5a4d
test sil, bpl
cmc
cmp word [0x140000000], ax
jmp 0x140448c02
jne 0x140448d0f
movsxd rcx, dword [0x14000003c]
bt edx, r10d
cqo
lea rdx, [0x140000000]
add rcx, rdx
cmp rcx, 0x26fd7a74
cmp dword [rcx], 0x4550
jmp 0x140448c31
jne 0x140448d0f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x140448c45
jne 0x140448d0f
sub r8, rdx
bts r9w, r9w
movzx edx, word [rcx + 0x14]
movsx eax, r12w
btr rax, r14
add rdx, 0x18
lea rdx, [rdx + rcx]
movzx eax, word [rcx + 6]
or ecx, 0x28d63b5b
bts cx, bx
jmp 0x140448c7a
lea rcx, [rax + rax*4]
bsf r9d, r14d
lea r9, [rdx + rcx*8]
test edx, 0x361229ec
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x140448c98
je 0x140448cd5
mov ecx, dword [rdx + 0xc]
jmp 0x140448ca6
cmp r8, rcx
jmp 0x140448cae
jb 0x140448cc7
mov eax, dword [rdx + 8]
add eax, ecx
cmp r13w, dx
clc
cmp r8, rax
jb 0x140448cd8
add rdx, 0x28
jmp 0x140448cd0
jmp 0x140448c8c
sub edx, edx
clc
test rdx, rdx
jmp 0x140448ce0
jne 0x140448cf2
xor al, al
jmp 0x140448ced
jmp 0x140448d22
cmp dword [rdx + 0x24], 0
jge 0x140448d03
xor al, al
jmp 0x140448d22
mov al, 1
jmp 0x140448d0a
jmp 0x140448d22
sub al, al
jmp 0x140448d22
add rsp, 0x18
jmp 0x140448d2b
ret
Function at 0x14045a51a
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
bswap cx
lea rcx, [rsp + 0x30]
jmp 0x14045a52b
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
test r11d, 0x70d4208
cmp spl, 0x6a
add rsp, 0x28
jmp 0x14045a54a
ret

Function at 0x14045a5ef
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
rcr ah, cl
shr ax, cl
sub rsp, 0x20
movsx rbx, cx
sbb rax, 0x58cf2ffc
mov rax, qword [0x1400b7288]
test r9, r11
shrd ebx, ebx, 0x3a
test eax, 0x27b559e5
movabs rbx, 0x2b992ddfa232
test r13, r9
cmp rax, rbx
jmp 0x14045a634
jne 0x14045a716
and qword [rbp + 0x18], 0
mov cl, r12b
bswap ecx
sete cl
lea rcx, [rbp + 0x18]
jmp 0x14045a650
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045a65f
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x14045a674
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
stc
clc
test r13, rax
xor qword [rbp + 0x10], rax
jmp 0x14045a68e
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
lea rcx, [rbp + 0x10]
cmp ebx, 0x178c7eed
shl rax, 0x20
jmp 0x14045a6ad
xor rax, qword [rbp + 0x20]
clc
xor rax, qword [rbp + 0x10]
xor rax, rcx
clc
bsf rbp, rdx
movabs rcx, 0xffffffffffff
sbb bpl, spl
rol bpl, cl
sub bp, si
and rax, rcx
btc ebp, 0xf4
xadd bpl, bpl
movabs rcx, 0x2b992ddfa233
test sil, dil
adc bpl, sil
movzx rbp, r12w
cmp rax, rbx
movsx ebx, r15w
cmove rax, rcx
adc bx, 0x6f18
or rbp, r13
rcr bx, 0xd3
mov qword [0x1400b7288], rax
movzx rbp, bx
rcr bpl, 0xab
mov rbx, qword [rsp + 0x48]
movzx ebp, dx
not rax
xadd bpl, bpl
mov qword [0x1400b7280], rax
clc
rcr bp, cl
xor bpl, 0x91
add rsp, 0x20
cmovs ebp, esp
movsx bp, spl
movzx rbp, r8w
pop rbp
jmp 0x14045a74a
ret
Function at 0x14045f2af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14045f2c7
mov qword [rax + 0x10], rbx
jmp 0x14045f2d1
mov qword [rax + 0x18], rbp
xor bp, si
shrd bp, r13w, 0xc8
movsx ebp, dx
push rsi
push rdi
adc rbp, 0x404f21a4
bsr bp, r11w
stc
push r12
sbb ebp, r9d
push r14
bts ebp, r13d
cmp r11w, dx
adc rbp, 0x4a7f73ec
push r15
neg r15b
sub rsp, 0x40
shrd ebp, r11d, 0x6d
mov r15b, 3
sub r12d, r12d
btr bp, dx
mov r15, r8
mov qword [rax + 0x20], r12
dec bpl
rcr bp, cl
btr ebp, 0xcb
or rdi, 0xffffffffffffffff
inc bpl
bswap bp
mov rbp, rcx
jmp 0x14045f341
inc rdi
cmp r14b, 0xa4
cmp byte [rdi + rcx], r12b
jmp 0x14045f351
jne 0x14045f341
add rdi, 1
cmove rsi, rcx
not r14b
jmp 0x14045f367
mov rbx, r12
mov sil, 0x6c
jmp 0x14045f372
mov rsi, rdi
cmovne r14d, esi
movzx r14w, dil
bswap r14w
mov r14, rcx
jmp 0x14045f38a
je 0x14045f3f4
lea r9, [rsp + 0x88]
movsx cx, r10b
movsx ecx, r9w
cqo
mov qword [rsp + 0x20], r15
mov r8, rsi
lea rcx, [rsp + 0x70]
cqo
mov edx, 0x6c9736bc
jmp 0x14045f3bc
mov rdx, r14
jmp 0x14045f3c4
call fcn.140459a8f
test eax, eax
jmp 0x14045f3d0
jle 0x14045f3f4
cdqe
jmp 0x14045f3dd
inc rbx
stc
lea r14, [r14 + rax]
cmc
sub rsi, rax
jmp 0x14045f3ee
jne 0x14045f390
inc rbx
movzx dx, r13b
mov edx, 2
movzx cx, r9b
movzx ecx, di
mov rcx, rbx
jmp 0x14045f411
call fcn.1400f9e7c
mov r14, rax
jmp 0x14045f41e
test rax, rax
jmp 0x14045f426
je 0x14045f4eb
mov qword [rsp + 0x30], r12
mov rsi, rax
test rbx, rbx
jmp 0x14045f43c
je 0x14045f4ac
lea r9, [rsp + 0x30]
movzx r8, r15w
jmp 0x14045f454
mov qword [rsp + 0x20], r15
setl r8b
movzx r8, bp
mov r8, rdi
xchg dx, cx
not cx
mov rdx, rbp
movzx cx, bpl
mov rcx, rsi
jmp 0x14045f47a
call fcn.140459a8f
test eax, eax
jmp 0x14045f486
jle 0x14045f4ac
cdqe
test r15b, r13b
cmp bl, r8b
add rsi, 2
lea rbp, [rbp + rax]
test di, 0x52f4
sub rbx, 1
jne 0x14045f442
lea r11, [rsp + 0x40]
movzx ebp, r8w
mov word [rsi], r12w
xchg al, r12b
movsx r15d, dx
mov rbx, qword [r11 + 0x38]
mov rax, r14
bswap r12w
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
mov r14b, 7
pop r14
movzx si, r14b
pop r12
movzx di, r14b
pop rdi
bswap rsi
pop rsi
ret
call fcn.1404591f4
int3
Function at 0x14046c0fb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14046c114
mov qword [rax + 8], rbx
cmp ax, r10w
test r12d, 0x4b9654e1
stc
mov qword [rax + 0x10], rbp
cmovle ebp, ebx
mov qword [rax + 0x18], rsi
movsx rbp, r14w
sub bpl, 0xde
mov qword [rax + 0x20], rdi
bt ebp, esp
ror edi, cl
push r14
not r14w
sub rsp, 0x20
xor di, 0x6a7
mov rdi, qword [rsp + 0x50]
mov r14, 0x34324640
mov r14, r9
bt ebp, r10d
or bp, 0x2560
sbb bpl, 0x8f
mov rsi, r8
test r14b, 0x8d
movsx ebp, bp
add ebp, esp
mov rbp, rdx
stc
test r12b, 0x85
test rdi, rdi
je 0x14046c267
mov rbx, qword [r8 + 8]
test rbx, rbx
jmp 0x14046c194
je 0x14046c24c
mov rax, qword [rbx + 0x40]
xadd r8, r8
movzx r8d, word [r14]
jmp 0x14046c1ac
cmp qword [rax], 0
jmp 0x14046c1b5
je 0x14046c209
mov rax, qword [rbx + 0x58]
cmc
cmp r13w, r12w
cmp dword [rax], 0
jmp 0x14046c1cc
jle 0x14046c209
dec dword [rax]
cwde
bswap eax
mov rcx, qword [rbx + 0x40]
movsx eax, bx
lahf
movzx eax, sp
mov rdx, qword [rcx]
movzx ax, dil
lea rax, [rdx + 2]
jmp 0x14046c1f3
mov qword [rcx], rax
jmp 0x14046c1fb
mov word [rdx], r8w
jmp 0x14046c204
jmp 0x14046c23d
mov rax, qword [rbx]
mov dl, ah
movsx edx, ax
movsxd rdx, ebp
movzx edx, r8w
cmovae cx, dx
seto cl
not rcx
mov rcx, rbx
jmp 0x14046c22a
mov rax, qword [rax + 0x18]
jmp 0x14046c233
call qword [0x1400b8d90]
movzx r8d, ax
mov eax, 0xffff
cmp ax, r8w
jne 0x14046c254
mov byte [rsi], 1
jmp 0x14046c254
add r14, 2
sub rdi, 1
jmp 0x14046c261
jne 0x14046c18c
movups xmm0, xmmword [rsi]
rol r14, cl
mov rbx, qword [rsp + 0x30]
movsxd rax, r10d
sal esi, cl
stc
mov rax, rbp
movsx rsi, dx
xchg di, di
mov rsi, qword [rsp + 0x40]
shr di, 0x3a
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
ror r14, cl
bswap bp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
mov r14b, spl
movsx r14w, r8b
bswap r14
pop r14
ret
Function at 0x140473177
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
stc
cmp rdi, r14
mov qword [rax + 8], rbx
sar bl, cl
rcr bh, cl
mov qword [rax + 0x10], rbp
movsx bp, r14b
cmp r14b, 0x4b
rcl rbx, cl
mov qword [rax + 0x18], rsi
movzx rsi, cx
xor ebx, r10d
mov qword [rax + 0x20], rdi
push r14
cmovno bx, r15w
movzx bp, r12b
rol rbp, 0x90
sub rsp, 0x20
mov rsi, r9
movzx bp, dl
bt bp, 0x35
sal r14b, 0xdb
mov rbx, r8
stc
bt r14d, 0x86
btc r14w, dx
mov r14, rdx
xchg rbp, rbp
sub rbp, rsi
mov rbp, rcx
test r15d, eax
jmp 0x1404731eb
test r9, r9
jmp 0x1404731f3
je 0x1404732db
mov rdi, qword [rdx + 8]
test rdi, rdi
je 0x1404732b4
mov rax, qword [rdi + 0x40]
bsr r8w, r14w
bswap r8d
movzx r8d, word [rbx]
cmp qword [rax], 0
je 0x14047326d
mov rax, qword [rdi + 0x58]
test bp, r10w
cmc
cmp dword [rax], 0
jmp 0x140473231
jle 0x14047326d
dec dword [rax]
mov rcx, qword [rdi + 0x40]
movzx rdx, di
movzx ax, r13b
cdqe
mov rdx, qword [rcx]
movzx eax, cx
lea rax, [rdx + 2]
jmp 0x140473257
mov qword [rcx], rax
jmp 0x14047325f
mov word [rdx], r8w
jmp 0x140473268
jmp 0x140473298
mov rax, qword [rdi]
cwd
movzx edx, r8w
mov rcx, rdi
jmp 0x14047327e
mov rax, qword [rax + 0x18]
jmp 0x140473287
call qword [0x1400b8d90]
movzx r8d, ax
movsx rax, si
bswap ax
mov eax, 0xffff
cmc
clc
cmp r9w, 0x5304
cmp ax, r8w
jmp 0x1404732ae
jne 0x1404732bf
mov byte [r14], 1
test r9d, 0x3c9121b9
add rbx, 2
test r11w, bx
jmp 0x1404732cc
sub rsi, 1
jmp 0x1404732d5
jne 0x1404731fd
movups xmm0, xmmword [r14]
shld bx, di, 0xe
mov rbx, qword [rsp + 0x30]
btr di, r15w
cmp r10d, ecx
bts r14, r8
mov rax, rbp
btc rdi, r12
rcl di, cl
mov rsi, qword [rsp + 0x40]
stc
movsxd r14, ebp
rcr r14w, 0xa8
mov rdi, qword [rsp + 0x48]
rcr r14b, 0x47
sbb r14w, 0x684e
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
mov r14d, ebx
movsx r14, r11w
pop r14
jmp 0x140473338
ret
Function at 0x14049ec93
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
rcr ebp, 0x66
shld bp, di, 0xe5
xor bpl, r8b
mov qword [rax + 0x20], rsi
add ebp, 0x14ef132e
push rdi
inc bpl
btr di, 0
push r14
seto dil
push r15
rcl sil, 0x7b
shld di, r10w, 0xa0
sub rsp, 0x20
movsx si, al
rcl bpl, cl
test dil, 0xb9
test rdx, rdx
not si
movzx ebp, r11w
sete bpl
lea r14, [rax + 8]
mov bpl, 0xa6
mov rbp, rcx
movsx r15w, r8b
mov rdi, rcx
movzx ecx, byte [rcx]
movsx r15d, sp
cmovne r14, rdx
mov r15, r9
movsx esi, dx
mov esi, r8d
jmp 0x14049ed21
inc rdi
movzx ecx, byte [rdi]
jmp 0x14049ed21
call fcn.1404b8351
test eax, eax
jmp 0x14049ed2d
jne 0x14049ed16
mov bl, byte [rdi]
lea eax, [rbx - 0x2b]
test r15b, 0x1e
test al, 0xfd
je 0x14049ed50
mov bl, 0x2b
jmp 0x14049ed4b
jmp 0x14049ed58
inc rdi
mov edx, 0x3463509d
mov r9, r15
movsx ecx, ax
mov r8d, esi
mov rdx, r14
jmp 0x14049ed69
mov rcx, rdi
jmp 0x14049ed71
call fcn.14049eea0
mov ecx, eax
shl si, 0x28
mov esi, 0x7fffffff
cmp rdi, qword [r14]
jmp 0x14049ed89
jne 0x14049ed9c
mov qword [r14], rbp
jmp 0x14049ed97
jmp 0x14049eda5
cmp rbp, qword [r14]
jne 0x14049edb2
test ecx, ecx
jmp 0x14049edac
jne 0x14049ede7
cmp bl, 0x2b
jmp 0x14049edba
jne 0x14049edcd
cmp ecx, esi
jmp 0x14049edc7
ja 0x14049ede7
cmp bl, 0x2d
jne 0x14049ee2e
cmp ecx, 0x80000000
jmp 0x14049ede1
jbe 0x14049ee2e
call fcn.1404b575b
mov dword [rax], 0x22
cmp r13b, dil
jmp 0x14049edfd
test r15, r15
jmp 0x14049ee05
je 0x14049ee12
mov dword [r15], 1
mov eax, 0x80000000
cmp bl, 0x2d
jmp 0x14049ee1f
cmove esi, eax
mov eax, esi
jmp 0x14049ee29
jmp 0x14049ee4f
neg eax
cmp bl, 0x2d
xchg r15b, bpl
movzx rsi, r8w
cmove ecx, eax
adc di, 0x6ed0
btr si, r13w
sar ah, cl
mov eax, ecx
bsr rsi, r8
mov rbx, qword [rsp + 0x48]
adc r15d, 0x493611ae
mov rbp, qword [rsp + 0x50]
stc
rcr si, cl
mov dil, dl
mov rsi, qword [rsp + 0x58]
sal edi, cl
neg dil
adc r14w, 0x4ee3
add rsp, 0x20
not r15w
movzx r15d, sp
mov r14b, r12b
pop r15
movzx r14w, r12b
not di
pop r14
cmovnp di, bp
movzx edi, cx
pop rdi
jmp 0x14049ee9f
ret
Function at 0x14049f319
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test rsi, rdx
mov qword [rsp + 0x18], rbp
cmc
push rsi
push rdi
shl sil, 0x6a
bsr edi, r12d
push r12
push r14
push r15
sub rsp, 0x20
test rdx, rdx
movzx edi, r8w
bswap r15d
movzx r15, r14w
lea r14, [rsp + 0x50]
jmp 0x14049f357
mov rsi, rcx
movzx rdi, r12w
mov rdi, rcx
movsx r15w, r10b
movzx ecx, byte [rcx]
movsx r15d, r8w
movzx r15w, r13b
cmovne r14, rdx
jmp 0x14049f37e
mov r15, r9
cmovnp bp, bp
movsx ebp, r9w
bswap rbp
mov ebp, r8d
jmp 0x14049f394
jmp 0x14049f3a4
inc rdi
movzx ecx, byte [rdi]
jmp 0x14049f3a4
call fcn.1404b8351
test eax, eax
jne 0x14049f399
mov bl, byte [rdi]
lea eax, [rbx - 0x2b]
clc
test al, 0xfd
jmp 0x14049f3be
je 0x14049f3cb
mov bl, 0x2b
jmp 0x14049f3d5
inc rdi
movsx cx, spl
cwd
mov r9, r15
xchg dx, r8w
mov r8d, ebp
movsx rdx, r8w
mov rdx, r14
mov rcx, rdi
call fcn.14049f542
mov rcx, rax
bt r12d, eax
mov bpl, 0x2d
movabs r12, 0x8000000000000000
test al, al
cmp rdi, qword [r14]
jne 0x14049f415
mov qword [r14], rsi
jmp 0x14049f423
cmp rsi, qword [r14]
jmp 0x14049f41d
jne 0x14049f431
test rcx, rcx
jmp 0x14049f42b
jne 0x14049f477
cmp bl, 0x2b
jne 0x14049f45b
movabs rax, 0x7fffffffffffffff
cmp spl, r14b
test r15w, 0x574c
cmp rcx, rax
jmp 0x14049f455
ja 0x14049f477
cmp bl, bpl
jmp 0x14049f463
jne 0x14049f4c2
cmp rcx, r12
jmp 0x14049f471
jbe 0x14049f4c2
call fcn.1404b575b
mov dword [rax], 0x22
stc
test al, r13b
test r15, r15
jmp 0x14049f48e
je 0x14049f4a3
mov dword [r15], 1
test r10b, 0x65
clc
test rcx, rcx
sub bl, bpl
jmp 0x14049f4ab
neg bl
jmp 0x14049f4b2
sbb rax, rax
add rax, r12
jmp 0x14049f4bd
jmp 0x14049f4e9
mov rax, rcx
add r14d, esp
rol sil, 0x99
test r10b, al
neg rax
add sil, 6
cmp bl, bpl
cmove rcx, rax
mov rax, rcx
bt esi, edx
bsf r14d, r9d
shr bl, cl
mov rbx, qword [rsp + 0x58]
movzx r12w, r8b
mov rbp, qword [rsp + 0x60]
and r12b, r12b
xor r14b, r10b
movzx edi, ax
add rsp, 0x20
movzx r14w, r13b
movsx r15d, ax
cmovnp r12d, r12d
pop r15
not si
pop r14
jmp 0x14049f529
pop r12
movsxd rsi, esi
movsx esi, r14w
movsx rsi, bp
pop rdi
movsx si, cl
pop rsi
jmp 0x14049f541
ret

Function at 0x1404a0554
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
stc
test r11b, 0x97
and dword [rsp + 0x30], 0
jmp 0x1404a0567
call fcn.1404aa951
mov r9d, 2
movsx rdx, cx
bswap ecx
lea r8, [rsp + 0x30]
movsx rcx, r10w
cqo
movzx cx, dl
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x1404a0594
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
clc
sub ecx, 0x30
je 0x1404a05ea
sub ecx, 1
jmp 0x1404a05b1
je 0x1404a05e0
cmp ecx, 1
jmp 0x1404a05bf
je 0x1404a05d1
xor eax, eax
jmp 0x1404a05cc
jmp 0x1404a05f2
mov eax, 3
jmp 0x1404a05db
jmp 0x1404a05f2
mov eax, 1
jmp 0x1404a05f2
mov eax, 2
test ch, 0x25
add rsp, 0x28
jmp 0x1404a05fb
ret