joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140427dd5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
ror esi, cl
xor sil, r9b
push rdi
inc si
movsx esi, dx
sub rsp, 0x28
sar esi, cl
adc rsi, 0x44a71753
mov rsi, rcx
movzx edi, dx
bswap dx
or dx, 0x2e0d
movsxd rdx, esp
movzx edx, word [rcx + rdi*4 + 0x834]
cmp spl, 0xd4
test r12b, cl
test dx, dx
jmp 0x140427e17
js 0x140427e25
mov rcx, rsi
call fcn.140427dd5
movsxd rcx, dword [rsi + 0x8860]
test di, 0x1461
clc
cmp ecx, dword [rsi + 0x8858]
jmp 0x140427e3d
jge 0x140427fd5
movsxd rax, dword [rsi + 0x885c]
cmove edx, r11d
shr rdx, 0x96
neg r8b
add rax, rcx
xchg ch, ch
mov r8, qword [rsi + 8]
lea edx, [rax + 3]
sal cl, cl
xadd ch, cl
or cl, al
test eax, eax
movzx ecx, r8w
jmp 0x140427e77
cmovns edx, eax
btc cx, 0x88
setae ch
mov rcx, qword [rsi + 0x18]
test dil, dil
sar edx, 2
cmp r9b, 5
movsxd rdx, edx
mov byte [rcx + rdx], 1
rcr dh, 0x78
or edx, r13d
ror dl, cl
mov rdx, qword [rsi + 0x8838]
test r15b, r15b
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x140427ebb
jb 0x140427f0a
movzx ecx, byte [rdx + rdi*4 + 2]
cmc
cmp r9, 0x19a2595e
mov byte [r8 + rax], cl
movzx rcx, r10w
sar cl, cl
add rcx, r11
movzx ecx, byte [rdx + rdi*4 + 1]
clc
cmp dx, 0x76a1
mov byte [r8 + rax + 1], cl
sal cl, 0xfb
rcl cl, cl
movzx ecx, byte [rdx + rdi*4]
cmp r15w, 0x332e
mov byte [r8 + rax + 2], cl
movzx ecx, byte [rdx + rdi*4 + 3]
clc
mov byte [r8 + rax + 3], cl
mov eax, dword [rsi + 0x885c]
add eax, 4
jmp 0x140427f19
mov dword [rsi + 0x885c], eax
jmp 0x140427f28
cmp eax, dword [rsi + 0x8854]
jmp 0x140427f33
jl 0x140427fd5
mov ecx, dword [rsi + 0x884c]
rcr ah, cl
bswap rax
mov eax, dword [rsi + 0x8858]
mov dword [rsi + 0x885c], ecx
sal ch, cl
cmovae ecx, eax
mov ecx, dword [rsi + 0x8860]
stc
test rbp, rbp
add ecx, dword [rsi + 0x8844]
mov dword [rsi + 0x8860], ecx
cmp r9b, 0xbb
cmp ecx, eax
jmp 0x140427f76
jl 0x140427fd5
mov ecx, dword [rsi + 0x8840]
stc
nop dword [rax]
test ecx, ecx
jle 0x140427fd5
mov edx, dword [rsi + 0x8864]
shl edx, cl
mov dword [rsi + 0x8844], edx
test r14b, r9b
jmp 0x140427fa8
sar edx, 1
cmp r13b, 0xcb
add edx, dword [rsi + 0x8850]
jmp 0x140427fb9
mov dword [rsi + 0x8860], edx
dec ecx
mov dword [rsi + 0x8840], ecx
cmc
cmp di, 0x56dd
cmp edx, eax
jge 0x140427f8a
add rsp, 0x28
movzx di, sil
pop rdi
movzx rsi, bx
cmovp rsi, rsi
bswap si
pop rsi
jmp 0x140427ff0
ret
Function at 0x140427ff1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
btr r15w, r10w
push r14
btc r14, 0xe5
shld r14d, r8d, 2
push r12
dec r12
or r15w, r9w
sub r14b, 0xb4
push rsi
adc r12b, al
setb r12b
push rdi
sar di, 0x25
xor dil, spl
push rbp
push rbx
bts r14, rdi
sub rsp, 0x20
adc r14b, r14b
shrd r12w, sp, 0xc0
sal bpl, cl
mov r12, r8
mov r15, 0x591b00d4
mov edi, edx
mov rbx, rcx
btc rbp, 0xf
lea r14, [rcx + 0x38]
lea r15, [rcx + 0x39]
and bpl, r14b
btr rbp, 0x21
add rbp, 0x37511eae
mov ebp, 0x80
jmp 0x14042806c
sub esi, esi
jmp 0x1404280b9
lea rcx, [rax + 1]
jmp 0x14042807c
mov qword [rbx + 0xc0], rcx
jmp 0x140428088
movzx eax, byte [rax]
jmp 0x140428090
mov byte [r12 + rsi], al
jmp 0x140428099
inc rsi
shr ebp, 1
test bpl, 0x96
cmp bl, r15b
jmp 0x1404280aa
cmp rsi, 4
jmp 0x1404280b3
je 0x140428203
test ebp, edi
je 0x140428099
cmp qword [rbx + 0x10], 0
jmp 0x1404280cb
je 0x1404280f4
mov rcx, qword [rbx + 0x28]
call qword [rbx + 0x20]
test eax, eax
jmp 0x1404280df
je 0x140428191
cmp dword [rbx + 0x30], 0
jmp 0x1404280ee
je 0x140428200
mov rax, qword [rbx + 0xc0]
rcr ch, cl
mov rcx, qword [rbx + 0xc8]
clc
cmp rax, rcx
jmp 0x14042810d
jae 0x140428200
cmp rax, rcx
jb 0x140428073
cmp dword [rbx + 0x30], 0
jmp 0x140428125
je 0x1404281b9
mov r8d, dword [rbx + 0x34]
mov rcx, qword [rbx + 0x28]
movsxd rdx, r14d
xchg dx, dx
mov rdx, r14
jmp 0x140428141
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xd0]
test bpl, r15b
jmp 0x140428158
add dword [rbx + 0xb8], ecx
cmp rsi, rax
test eax, eax
je 0x1404281c5
movsxd rcx, eax
btc eax, ebx
btc ax, 0xea
movzx eax, bx
add rcx, r14
movsx rax, sp
setne ah
mov al, 0xbb
movzx eax, byte [r14]
jmp 0x14042818c
jmp 0x1404281e8
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
clc
jmp 0x1404281a6
cmp rax, rcx
jmp 0x1404281ae
jae 0x14042811c
jmp 0x140428073
sub eax, eax
jmp 0x1404281c0
jmp 0x140428090
mov dword [rbx + 0x30], 0
not rcx
mov byte [rbx + 0x38], 0
movsx ecx, dx
sub eax, eax
movsx ecx, cx
movzx cx, r13b
mov rcx, r15
jmp 0x1404281e8
mov qword [rbx + 0xc8], rcx
jmp 0x1404281f4
mov qword [rbx + 0xc0], r15
jmp 0x140428090
xor r12d, r12d
mov rax, r12
or bp, 0x24fa
sub bpl, 0xa2
add rsp, 0x20
movzx r14d, cx
pop rbx
pop rbp
not r14b
movsx r12, r10w
pop rdi
movsx r12d, cx
setnp r12b
pop rsi
bswap r14d
pop r12
not r14b
mov r14b, 0x9f
movsxd r15, r11d
pop r14
pop r15
ret
Function at 0x14042a439
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
inc si
movzx eax, r13w
xor sil, dil
push rdi
movzx ax, dl
cmc
push rbx
sub rsp, 0x20
mov rsi, rcx
shrd eax, r13d, 0xc9
movzx eax, byte [rcx + 0x4828]
stc
clc
cmp al, 0xff
je 0x14042a479
mov byte [rsi + 0x4828], 0xff
jmp 0x14042a474
jmp 0x14042a5a0
mov rbx, qword [rsi]
stc
mov rax, qword [rbx + 0xc0]
stc
cmp r13d, 0x53a82ac4
test ax, r9w
cmp rax, qword [rbx + 0xc8]
jmp 0x14042a49c
jae 0x14042a4bf
lea rcx, [rax + 1]
jmp 0x14042a4ab
mov qword [rbx + 0xc0], rcx
movzx ecx, byte [rax]
jmp 0x14042a4ba
jmp 0x14042a58c
cmp dword [rbx + 0x30], 0
jmp 0x14042a4c8
je 0x14042a540
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
movzx cx, ch
mov rcx, qword [rbx + 0x28]
cdq
mov rdx, rdi
jmp 0x14042a4e7
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
clc
test r8, 0x71695d6a
cmp r12b, 0x3a
sub ecx, dword [rbx + 0xd0]
stc
test rcx, r13
add dword [rbx + 0xb8], ecx
test eax, eax
jmp 0x14042a513
je 0x14042a54c
cdqe
bts ecx, r15d
and cx, dx
movsx ecx, r14w
add rax, rdi
cmovns cx, r9w
xchg ecx, ecx
not rcx
movzx ecx, byte [rdi]
jmp 0x14042a53b
jmp 0x14042a56c
mov al, 0xff
jmp 0x14042a547
jmp 0x14042a5a0
mov dword [rbx + 0x30], 0
sbb al, r13b
btc eax, esp
lea rax, [rbx + 0x39]
mov byte [rbx + 0x38], 0
xor ecx, ecx
jmp 0x14042a56c
mov qword [rbx + 0xc8], rax
bsr eax, r14d
adc al, sil
or al, 0xab
lea rax, [rbx + 0x39]
test r15b, r13b
clc
cmc
mov qword [rbx + 0xc0], rax
mov al, 0xff
cmp r11b, 0x3f
cmp cl, 0xff
jmp 0x14042a59a
je 0x14042a5ef
add rsp, 0x20
mov di, r9w
not sil
movsx bx, spl
pop rbx
pop rdi
cmovs si, bp
movzx rsi, bx
movsx rsi, bp
pop rsi
jmp 0x14042a5c4
ret
lea rcx, [rax + 1]
test dil, 0xd3
cmp r10b, 0x25
cmp r9b, r11b
mov qword [rbx + 0xc0], rcx
cmp dil, 0x54
movzx eax, byte [rax]
cmp al, 0xff
jmp 0x14042a5e9
jne 0x14042a5a0
mov rbx, qword [rsi]
mov rax, qword [rbx + 0xc0]
cmp r9b, dl
cmp rax, qword [rbx + 0xc8]
jmp 0x14042a608
jb 0x14042a5c5
cmp dword [rbx + 0x30], 0
jmp 0x14042a617
je 0x14042a6c8
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
not dx
mov rdx, rdi
jmp 0x14042a634
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
jmp 0x14042a643
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
test eax, eax
jmp 0x14042a656
je 0x14042a67a
movsxd rcx, eax
rcl ah, cl
cmp ebx, 0x57b67a39
sar al, 0
add rcx, rdi
movzx eax, byte [rdi]
jmp 0x14042a675
jmp 0x14042a698
mov dword [rbx + 0x30], 0
neg ch
lea rcx, [rbx + 0x39]
cmp spl, 0xca
mov byte [rbx + 0x38], 0
test r10b, sil
cmp sil, 0xc5
xor eax, eax
mov qword [rbx + 0xc8], rcx
test spl, 0xd4
cmp spl, cl
lea rcx, [rbx + 0x39]
mov qword [rbx + 0xc0], rcx
cmp r10b, 0x8b
stc
cmp al, 0xff
jmp 0x14042a6bd
je 0x14042a5ef
jmp 0x14042a5a0
sub eax, eax
jmp 0x14042a6cf
jmp 0x14042a5a0
Function at 0x140440341
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx ecx, cx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
clc
cmp eax, 0x100
setae al
add rsp, 0x28
jmp 0x140440363
ret

Function at 0x140441ad8
Capabilities:
Encrypt data using speck

Disassembly:
sub rsp, 0x28
bswap rax
mov rcx, qword [rcx]
mov rax, qword [rcx]
jmp 0x140441aea
call qword [rax + 0x28]
test eax, eax
jmp 0x140441af4
je 0x140441b33
mov ecx, eax
and r8b, 0x89
movabs r8, 0xcafa59766d7f94e
adc r9w, 0x607e
mov dl, 3
setg r9b
mov r9d, 0x2a
jmp 0x140441b25
add rsp, 0x28
jmp 0x140441b2e
jmp fcn.1403ab945
nop
add rsp, 0x28
jmp 0x140441b3d
ret

Function at 0x140441bc7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
clc
push rdi
push rbp
stc
xor sil, dil
push rbx
btc bx, 0x87
shr rax, 0x4f
adc sil, 0x52
sub rsp, 0x48
movzx bx, r13b
mov rax, r9
shld esi, edi, 0x8c
sar r9b, 0x15
add rsi, rax
mov rsi, rdx
sal edx, 0x9d
mov rdx, rcx
mov ebx, dword [rsp + 0xa0]
mov qword [rsp + 0x40], 0
not r9
inc r9b
mov rcx, qword [0x1400b9300]
movss xmm0, dword [r8]
movss xmm1, dword [r8 + 4]
xadd r9b, r9b
mov r9, qword [rdx]
cmp ebx, 0xffffffff
je 0x140441c42
mov r8d, ebx
jmp 0x140441c3d
jmp 0x140441c7e
mov rdx, 0xffffffffffffffff
rcr r8, 0x3b
nop word [rax + rax]
shl r8b, cl
shr r8w, cl
lea r8, [rdx + 1]
cmp word [rax + rdx*2 + 2], 0
movzx rdx, di
bswap edx
setbe dh
mov rdx, r8
jmp 0x140441c78
jne 0x140441c5d
mov ebp, dword [rsp + 0x98]
bswap rdi
movsx ebx, r11w
cqo
mov ebx, dword [rsp + 0x90]
cmovle rdx, rdx
seta dh
mov rdi, qword [rcx]
cmovae rdx, r14
cwd
mov dx, cx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdx
mov dx, r10w
movsx dx, r14b
movss dword [rsp + 0x28], xmm1
mov rdx, 0x503f54ca
movss dword [rsp + 0x20], xmm0
cqo
xchg dl, dl
mov rdx, rax
jmp 0x140441cda
call qword [rdi + 0x90]
test eax, eax
je 0x140441d11
mov ecx, eax
movzx r9w, r14b
bswap r9w
not dl
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9d, 0x41
jmp 0x140441d0c
call fcn.1403ab945
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
jmp 0x140441d1e
mov edx, ebx
jmp 0x140441d25
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
movsxd rdx, ebp
movzx ax, bl
movsx rdx, r14w
mov rax, qword [rcx]
bswap dx
cwd
xchg dx, dx
mov edx, ebp
jmp 0x140441d4a
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov bl, cl
dec dil
mov qword [rsi], rax
sub di, 0x73b
bts rax, r12
jmp 0x140441d68
mov rax, rsi
sbb bpl, spl
add rsp, 0x48
mov sil, 0x44
not bh
pop rbx
cmovge bp, r10w
movzx di, r8b
pop rbp
jmp 0x140441d90
pop rdi
cmovae esi, edx
pop rsi
jmp 0x140441d9a
ret
Function at 0x140443073
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
sub rsp, 0x88
lahf
movaps xmmword [rsp + 0x70], xmm9
setae dil
cmovge di, r13w
movaps xmmword [rsp + 0x60], xmm8
movzx esi, r14w
cdqe
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm6
movzx rsi, cx
movaps xmm8, xmm3
cbw
mov rdi, rdx
mov rsi, rcx
rdtsc
mov rcx, qword [rcx + 0x20]
cqo
movzx rax, r14w
movups xmm0, xmmword [r8]
bswap rdx
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
jmp 0x1404430db
call qword [rax + 0x40]
movsd xmm6, qword [rdi]
jmp 0x1404430e7
movaps xmm0, xmm6
jmp 0x1404430ef
call fcn.1404b48e7
movaps xmm9, xmm0
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
call fcn.1404b48e7
unpcklps xmm9, xmm0
addps xmm9, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm9
movlps qword [rsp + 0x20], xmm9
movsd xmm6, qword [rdi + 8]
movaps xmm0, xmm6
jmp 0x140443127
call fcn.1404b48e7
movaps xmm7, xmm0
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
call fcn.1404b48e7
movss dword [rdi + 8], xmm7
jmp 0x140443145
unpcklps xmm7, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x140443152
addps xmm7, xmm9
movlps qword [rsp + 0x28], xmm7
movss dword [rsp + 0x30], xmm8
movsx eax, sp
movss dword [rsp + 0x34], xmm8
cwd
mov rcx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
not dl
xchg dx, ax
rdtsc
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
jmp 0x140443189
call qword [rax + 0x98]
movaps xmm6, xmmword [rsp + 0x40]
xchg dil, dil
btc rsi, 0x9b
movaps xmm7, xmmword [rsp + 0x50]
sub dil, 0x8f
stc
movsxd rsi, ecx
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm9, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
movsxd rsi, r8d
pop rsi
ret
Function at 0x1404436ed
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
push r15
bsf r15w, dx
bswap r15
rol r15b, cl
push r14
push rsi
clc
btr ax, 0x37
push rdi
btc esi, 0xfc
xor r14b, r12b
push rbp
push rbx
sub rsp, 0x88
movzx ebp, r9w
cmovge r15w, cx
jmp 0x140443722
movaps xmmword [rsp + 0x70], xmm8
movaps xmmword [rsp + 0x60], xmm7
cwde
movaps xmmword [rsp + 0x50], xmm6
movsx bx, r12b
jmp 0x140443742
mov r14, r8
movzx di, bl
movsx bp, r12b
mov rbx, rdx
mov dil, spl
mov r15, rcx
jmp 0x140443764
mov rsi, qword [rsp + 0xe0]
movsx rbp, r11w
mov rdx, rbp
rdtsc
mov ebp, dword [rsp + 0xf0]
cdq
lahf
movzx rcx, r10w
mov edx, dword [rsp + 0xe8]
mov dil, 0x2f
mov rdi, qword [r9]
movzx rcx, cx
mov rax, qword [rdi]
jmp 0x14044379b
mov rcx, rdi
call qword [rax + 0x18]
mov rax, qword [rdi]
setns cl
mov rcx, rdi
movzx dx, r8b
movzx rdx, sp
mov edx, ebp
jmp 0x1404437ba
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
cqo
movzx ax, dil
xchg dx, ax
movups xmm0, xmmword [r14]
movzx edx, dx
not ax
movaps xmmword [rsp + 0x40], xmm0
rdtsc
mov rax, qword [rcx]
movzx rdx, r13w
lea r14, [rsp + 0x40]
mov rdx, r14
jmp 0x1404437ef
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x1404437fb
movaps xmm0, xmm7
jmp 0x140443803
call fcn.1404b48e7
movaps xmm8, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140443818
call fcn.1404b48e7
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
jmp 0x14044383d
movaps xmm0, xmm7
jmp 0x140443845
call fcn.1404b48e7
movaps xmm6, xmm0
jmp 0x140443852
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x14044385e
call fcn.1404b48e7
movss dword [rbx + 8], xmm6
jmp 0x14044386d
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
movzx ax, r10b
jmp 0x14044387f
mov rcx, qword [r15 + 0x18]
bswap ax
movzx ax, dil
mov rax, qword [r15 + 0x20]
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
sub r8d, r8d
nop
cmp word [rsi + r8*2], 0
jmp 0x1404438a7
lea r8, [r8 + 1]
jmp 0x1404438b0
jne 0x14044389c
dec r8d
cdq
setle bpl
movsx ebp, r8w
mov rbp, qword [rcx]
cmovne dx, r11w
mov qword [rsp + 0x28], rax
movsx dx, r11b
mov qword [rsp + 0x20], r14
cwd
not dl
setae dh
mov dword [rsp + 0x38], 0
movsx rdx, ax
mov dword [rsp + 0x30], 2
mov rdx, rsi
mov r9, rdi
jmp 0x1404438ff
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
rcr sil, cl
movaps xmm7, xmmword [rsp + 0x60]
cmp ax, 0x2c50
clc
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
movsx esi, bx
movzx di, al
bswap di
pop rbp
mov r15w, di
movsx esi, bx
pop rdi
pop rsi
movsxd r14, ebp
cmovo r14w, bx
movsx r14, di
pop r14
pop r15
jmp 0x14044394e
ret
Function at 0x140444a42
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
cwde
mov r8, rcx
mov eax, 0x5a4d
cmp r12b, dl
test ch, 0x60
cmp bx, 0x1a7
cmp word [0x140000000], ax
jmp 0x140444a66
jne 0x140444b76
movsxd rcx, dword [0x14000003c]
sbb dl, bpl
stc
inc dx
lea rdx, [0x140000000]
add rcx, rdx
test r8b, r9b
cmp r8b, r13b
cmp dword [rcx], 0x4550
jmp 0x140444a95
jne 0x140444b76
mov eax, 0x20b
test dl, dh
cmp word [rcx + 0x18], ax
jmp 0x140444aab
jne 0x140444b76
sub r8, rdx
movzx edx, word [rcx + 0x14]
bsr eax, esi
movzx ax, ah
cmp bx, r11w
add rdx, 0x18
movzx eax, si
add rdx, rcx
movzx eax, word [rcx + 6]
bt r9w, r9w
movsx ecx, si
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
stc
test r14d, r12d
mov qword [rsp], rdx
cmc
clc
cmp bl, spl
cmp rdx, r9
jmp 0x140444af6
je 0x140444b2f
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x140444b07
jb 0x140444b26
mov eax, dword [rdx + 8]
cmc
test dx, r10w
add eax, ecx
stc
cmp r8, rax
jmp 0x140444b20
jb 0x140444b35
add rdx, 0x28
jmp 0x140444ae5
xor edx, edx
test sil, dl
stc
test rdx, rdx
jmp 0x140444b3d
jne 0x140444b4f
sub al, al
jmp 0x140444b4a
jmp 0x140444b8b
cmp dword [rdx + 0x24], 0
jmp 0x140444b58
jge 0x140444b6a
xor al, al
jmp 0x140444b65
jmp 0x140444b8b
mov al, 1
jmp 0x140444b71
jmp 0x140444b8b
xor al, al
jmp 0x140444b7d
jmp 0x140444b8b
add rsp, 0x18
ret
Function at 0x140456434
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
mov ch, 0x7b
setge ch
movsx ecx, r12w
lea rcx, [rsp + 0x30]
jmp 0x14045644c
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmc
jmp 0x140456460
add rsp, 0x28
ret

Function at 0x1404566f6
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
sub ecx, ecx
jmp 0x140456701
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14045677e
mov ecx, 0x5a4d
jmp 0x14045671a
cmp word [rax], cx
jne 0x14045677e
movsxd rcx, dword [rax + 0x3c]
jmp 0x140456730
lea rcx, [rcx + rax]
cmc
cmp r10b, r10b
jmp 0x14045673d
cmp dword [rcx], 0x4550
jmp 0x140456748
jne 0x14045677e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x14045675c
jne 0x14045677e
cmp dword [rcx + 0x84], 0xe
jbe 0x14045677e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140456785
xor al, al
jmp 0x140456785
add rsp, 0x28
ret
Function at 0x14045b1f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14045b209
mov qword [rax + 0x10], rbx
jmp 0x14045b216
mov qword [rax + 0x18], rbp
push rsi
sal bpl, 0xd2
push rdi
btr bp, r11w
bsr ebp, r11d
push r12
cmp r9w, cx
sbb rbp, 0x496e06aa
push r14
xor rbp, 0x6dda106f
bt ebp, 0x8b
bts bp, r14w
push r15
seto r15b
rcl bpl, cl
sar r15b, 0xdd
sub rsp, 0x40
sal bp, 0x39
rcr r15d, 0x3d
xor r12d, r12d
shld bp, sp, 0x7d
xadd r15b, r15b
bsf r15w, r9w
mov r15, r8
cmp rax, r13
btc ebp, 0xd5
mov qword [rax + 0x20], r12
rcl ebp, cl
xchg bpl, bpl
or rdi, 0xffffffffffffffff
mov bpl, r8b
dec rbp
jmp 0x14045b294
mov rbp, rcx
jmp 0x14045b29c
inc rdi
cmp r10b, dil
cmp byte [rdi + rcx], r12b
jmp 0x14045b2ab
jne 0x14045b29c
add rdi, 1
cmove si, dx
movsxd r14, r10d
mov rbx, r12
movsx r14w, r11b
movsx r14, r11w
mov rsi, rdi
movsx r14d, r9w
mov r14b, 0xeb
mov r14, rcx
je 0x14045b34a
lea r9, [rsp + 0x88]
cmovnp ecx, ebx
mov cl, 0x4c
mov qword [rsp + 0x20], r15
seta r8b
xchg dl, ch
cqo
mov r8, rsi
cwd
not cx
movsxd rcx, esp
lea rcx, [rsp + 0x70]
movsx rdx, r12w
cdq
movsx edx, r15w
mov rdx, r14
jmp 0x14045b316
call fcn.1404559af
test eax, eax
jmp 0x14045b322
jle 0x14045b34a
cdqe
jmp 0x14045b32f
inc rbx
test r11b, 0xa3
stc
add r14, rax
stc
clc
sub rsi, rax
jmp 0x14045b344
jne 0x14045b2db
inc rbx
setne dl
mov edx, 2
mov ch, 0x6a
movsx ecx, dx
cmovb ecx, r13d
mov rcx, rbx
jmp 0x14045b367
call fcn.1401f7538
mov r14, rax
clc
test rax, rax
jmp 0x14045b378
je 0x14045b455
mov qword [rsp + 0x30], r12
adc esi, 0x7117694d
cmovno esi, ebp
mov rsi, rax
test rbx, rbx
jmp 0x14045b397
je 0x14045b3f2
lea r9, [rsp + 0x30]
setne dh
movzx cx, r15b
mov qword [rsp + 0x20], r15
not dl
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
jmp 0x14045b3bf
call fcn.1404559af
test eax, eax
jmp 0x14045b3cb
jle 0x14045b3f2
cdqe
stc
cmp spl, bl
add rsi, 2
add rbp, rax
jmp 0x14045b3e3
sub rbx, 1
jmp 0x14045b3ec
jne 0x14045b39d
lea r11, [rsp + 0x40]
movzx rbx, si
cmovs bx, r14w
mov word [rsi], r12w
cbw
cmovge si, bx
mov rbx, qword [r11 + 0x38]
lahf
mov rax, r14
mov rbp, qword [r11 + 0x40]
xchg esi, r12d
bswap di
movsx r14d, r9w
mov rsp, r11
cmovb r12d, r11d
movzx rsi, si
movsx si, bpl
pop r15
not r14w
movzx rsi, di
pop r14
pop r12
movsx edi, bx
cmovae rsi, r15
movsx rsi, bp
pop rdi
mov si, 0x3556
pop rsi
jmp 0x14045b454
ret
call fcn.1404551a4
int3
Function at 0x14046f09c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
test cx, 0x62e8
mov qword [rax + 8], rbx
cmovae bx, r14w
mov qword [rax + 0x10], rbp
sal bpl, cl
or bl, r13b
rcr bpl, 0x19
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
inc bpl
bswap bp
push r14
not ebx
test r15d, eax
sub rsp, 0x20
stc
rcl ebp, 0x39
rol bh, 0x65
mov rsi, r9
add bp, r12w
mov rbx, r8
bt bp, r12w
mov r14, rdx
inc bpl
bt bp, r10w
bsf bp, bp
mov rbp, rcx
test r9, r9
jmp 0x14046f105
je 0x14046f1d5
mov rdi, qword [rdx + 8]
test rdi, rdi
je 0x14046f1b9
mov rax, qword [rdi + 0x40]
not r8
movzx r8d, r14w
movzx r8d, word [rbx]
cmp qword [rax], 0
jmp 0x14046f130
je 0x14046f17a
mov rax, qword [rdi + 0x58]
cmp dword [rax], 0
jmp 0x14046f142
jle 0x14046f17a
dec dword [rax]
cwd
movsxd rdx, edi
mov rcx, qword [rdi + 0x40]
movsx ax, spl
mov rdx, qword [rcx]
lea rax, [rdx + 2]
jmp 0x14046f164
mov qword [rcx], rax
jmp 0x14046f16c
mov word [rdx], r8w
jmp 0x14046f175
jmp 0x14046f19f
mov rax, qword [rdi]
mov dl, 0x4a
movzx edx, r8w
mov rcx, rdi
jmp 0x14046f18b
mov rax, qword [rax + 0x18]
call qword [case.0x140444828.0]
movzx r8d, ax
mov al, dh
shl al, 0xb
clc
mov eax, 0xffff
clc
stc
test r13b, 0x4e
cmp ax, r8w
jmp 0x14046f1b3
jne 0x14046f1bd
mov byte [r14], 1
add rbx, 2
test si, 0x5985
sub rsi, 1
jmp 0x14046f1cf
jne 0x14046f10f
movups xmm0, xmmword [r14]
rcl bl, cl
mov rbx, qword [rsp + 0x30]
shld esi, r9d, 0xde
lahf
xor rsi, 0x542d29d5
mov rax, rbp
inc r14b
rol r14b, cl
shrd si, si, 0x9b
mov rsi, qword [rsp + 0x40]
btr edi, 8
mov rdi, qword [rsp + 0x48]
shr r14b, 0x7f
sub r14w, 0x47b4
movdqu xmmword [rbp], xmm0
dec r14b
xadd r14d, r14d
ror ebp, 0xa2
mov rbp, qword [rsp + 0x38]
xchg r14b, r14b
mov r14b, cl
add rsp, 0x20
movsxd r14, ebp
cmovo r14, r11
movzx r14w, r12b
pop r14
ret
Function at 0x14049ac43
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp r10b, r10b
mov qword [rax + 0x10], rbx
cmp r13b, 0x9b
test dil, cl
stc
mov qword [rax + 0x18], rbp
inc bp
adc bpl, r10b
mov qword [rax + 0x20], rsi
dec bpl
push rdi
push r14
movsx bp, dl
cmovne r14w, r14w
push r15
rcr bpl, 0x4f
bts r15w, sp
sbb bpl, r14b
sub rsp, 0x20
cmc
bt si, 0xa8
mov bpl, r14b
test rdx, rdx
lea r14, [rax + 8]
movsx r15w, r9b
mov rbp, rcx
mov rdi, rcx
not r15b
movsx esi, r10w
movzx ecx, byte [rcx]
setno r15b
jmp 0x14049acb2
cmovne r14, rdx
movzx r15d, r11w
movsx si, r14b
bswap esi
mov r15, r9
mov esi, r8d
jmp 0x14049acd8
inc rdi
xchg cl, cl
movsx rcx, bp
movzx ecx, byte [rdi]
call fcn.1404b43ee
test eax, eax
jmp 0x14049ace4
jne 0x14049accc
mov bl, byte [rdi]
or ah, ch
xor ax, 0x438
or al, 0x93
lea eax, [rbx - 0x2b]
test al, 0xfd
jmp 0x14049acfe
je 0x14049ad0b
mov bl, 0x2b
jmp 0x14049ad13
inc rdi
bswap rcx
xchg edx, ecx
mov r9, r15
movzx dx, r8b
setle ch
not r8b
mov r8d, esi
not rcx
mov rdx, r14
movsx ecx, dx
mov rcx, rdi
jmp 0x14049ad35
call fcn.14049ae60
mov ecx, eax
mov esi, 0x7fffffff
cmp dil, 0x6d
cmp rdi, qword [r14]
jne 0x14049ad5b
mov qword [r14], rbp
jmp 0x14049ad56
jmp 0x14049ad69
cmp rbp, qword [r14]
jmp 0x14049ad63
jne 0x14049ad76
test ecx, ecx
jmp 0x14049ad70
jne 0x14049adab
cmp bl, 0x2b
jne 0x14049ad8c
cmp ecx, esi
jmp 0x14049ad86
ja 0x14049adab
cmp bl, 0x2d
jmp 0x14049ad94
jne 0x14049adee
cmp ecx, 0x80000000
jmp 0x14049ada5
jbe 0x14049adee
call fcn.1404b1712
mov dword [rax], 0x22
cmp dl, r9b
test r15, r15
jmp 0x14049adc1
je 0x14049add1
mov dword [r15], 1
or ah, 0xa0
mov eax, 0x80000000
clc
cmp bl, 0x2d
jmp 0x14049addf
cmove esi, eax
mov eax, esi
jmp 0x14049ade9
jmp 0x14049ae0f
neg eax
bts r14d, ebp
or rdi, rbp
movzx r14w, r15b
cmp bl, 0x2d
movsx r14w, spl
cmove ecx, eax
mov eax, ecx
test r10w, 0x3280
mov rbx, qword [rsp + 0x48]
inc rdi
and bp, r14w
cmc
mov rbp, qword [rsp + 0x50]
sal r15b, cl
mov rsi, qword [rsp + 0x58]
movsx r14, r15w
btr r14w, bp
test ah, 0xf4
add rsp, 0x20
movsx r15w, al
mov r14b, 0xcb
jmp 0x14049ae46
pop r15
movsx r14, r12w
mov edi, r8d
pop r14
movzx rdi, r8w
sets dil
pop rdi
jmp 0x14049ae5f
ret

Function at 0x14049c4de
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp edx, r15d
jmp 0x14049c4ea
and dword [rsp + 0x30], 0
jmp 0x14049c4f4
call fcn.1404a684d
mov r9d, 2
movzx r8, r8w
lea r8, [rsp + 0x30]
mov rcx, qword [rax + 0x28]
movzx rdx, r13w
movzx edx, dx
cwd
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
test r8w, 0x17c8
clc
sub ecx, 0x30
jmp 0x14049c533
je 0x14049c57f
sub ecx, 1
jmp 0x14049c541
je 0x14049c570
cmp ecx, 1
jmp 0x14049c54f
je 0x14049c561
sub eax, eax
jmp 0x14049c55c
jmp 0x14049c585
mov eax, 3
jmp 0x14049c56b
jmp 0x14049c585
mov eax, 1
jmp 0x14049c57a
jmp 0x14049c585
mov eax, 2
stc
add rsp, 0x28
jmp 0x14049c58e
ret