joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403f487f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
jmp 0x1403f488d
push r14
movsxd r14, esp
push r12
btr r14w, 0x19
or r14b, 0xb9
push rsi
push rdi
sbb r14b, dil
or r14b, dil
push rbx
sub rsp, 0x28
mov r14d, r11d
xor r14b, 0xcb
bsr r14w, r12w
mov r14, r8
cmp r13b, r12b
test rdx, rdx
je 0x1403f4a94
mov rdi, rdx
btr r12d, 0x99
mov r12, rcx
cmc
sub ebx, ebx
jmp 0x1403f4908
mov rcx, r15
not rdx
sets dh
mov rdx, 0x2fbe47b7
mov rdx, rsi
jmp 0x1403f48f1
call fcn.1403b9dc5
add rbx, 0x50
dec rdi
jmp 0x1403f4902
je 0x1403f4a90
mov eax, dword [r12 + rbx + 8]
cmc
mov dword [r14 + rbx + 8], eax
cmp rax, rdx
jmp 0x1403f491b
cmp r14, r12
je 0x1403f48f6
cmp qword [r12 + rbx + 0x28], 0x10
jmp 0x1403f492f
jb 0x1403f4944
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403f493f
jmp 0x1403f495c
lea r9, [r12 + rbx]
sub r15, 0x6c674a48
add r9, 0x10
sar ax, cl
movsxd r15, r13d
rol sil, cl
lea r15, [r14 + rbx]
adc ah, 0xc9
add sil, 0x31
add r15, 0x10
jmp 0x1403f4974
mov rsi, qword [r12 + rbx + 0x20]
bsr eax, r11d
mov rax, qword [r14 + rbx + 0x28]
cmc
cmp rax, rsi
jmp 0x1403f498b
jae 0x1403f49aa
mov rcx, r15
movzx edx, r12w
mov rdx, rsi
jmp 0x1403f49a0
call fcn.1403b9dc5
jmp 0x1403f49ea
cmp rax, 0x10
jb 0x1403f49bc
mov r15, qword [r14 + rbx + 0x10]
movsxd r8, r8d
mov qword [r14 + rbx + 0x20], rsi
mov rcx, r15
mov rdx, r9
bswap r8w
mov r8, rsi
jmp 0x1403f49d3
call fcn.1404a222e
mov byte [r15 + rsi], 0
sub si, 0x2f7b
dec sil
btr rsi, 0x4b
mov rsi, qword [r12 + rbx + 0x40]
cmp qword [r12 + rbx + 0x48], 0x10
jb 0x1403f4a0a
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403f4a05
jmp 0x1403f4a1b
lea r9, [r12 + rbx]
cbw
add r9, 0x30
and r15, rax
or r15b, spl
lahf
lea r15, [r14 + rbx]
add ax, r8w
cdqe
add r15, 0x30
btc rax, r12
shl al, cl
or al, r10b
mov rax, qword [r14 + rbx + 0x48]
cmp rax, rsi
jmp 0x1403f4a3f
jb 0x1403f48d9
cmp rax, 0x10
jmp 0x1403f4a4e
jb 0x1403f4a5e
mov r15, qword [r14 + rbx + 0x30]
movzx dx, r8b
mov qword [r14 + rbx + 0x40], rsi
xchg ch, cl
cwd
mov rcx, r15
mov rdx, r9
setp r8b
mov r8d, r14d
movsx r8w, dl
mov r8, rsi
call fcn.1404a222e
mov byte [r15 + rsi], 0
jmp 0x1403f4a8b
jmp 0x1403f48f6
lea r14, [r14 + rbx]
mov rax, r14
sub r14b, 0x63
bsr rdi, rbp
add rsp, 0x28
setb r15b
pop rbx
pop rdi
cmovl r15, r11
movsx r12w, cl
mov r12b, r10b
pop rsi
pop r12
pop r14
movzx r15d, r11w
movzx r15w, al
jmp 0x1403f4ac8
pop r15
jmp 0x1403f4acf
ret
Function at 0x14042a950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
xor r14w, dx
sal r15b, 0xe3
bts r14d, r11d
push r12
push rsi
push rdi
rcr r15d, cl
bsf r14w, bx
jmp 0x14042a971
push rbp
btr r15w, r9w
movsx r12, sp
push rbx
stc
and bx, bp
sub rsp, 0x20
mov r12, r8
mov edi, edx
stc
mov rbx, rcx
lea r14, [rcx + 0x38]
lea r15, [rcx + 0x39]
rcl bpl, 0xc4
adc bpl, 0x28
rcr bpl, 0xd8
mov ebp, 0x80
jmp 0x14042a9ac
sub esi, esi
jmp 0x14042a9b3
jmp 0x14042a9f0
lea rcx, [rax + 1]
jmp 0x14042a9c1
mov qword [rbx + 0xc0], rcx
movzx eax, byte [rax]
jmp 0x14042a9d0
mov byte [r12 + rsi], al
jmp 0x14042a9d9
inc rsi
cmp r12d, r13d
shr ebp, 1
cmp rsi, 4
jmp 0x14042a9ea
je 0x14042ab38
test ebp, edi
jmp 0x14042a9f7
je 0x14042a9d9
cmp qword [rbx + 0x10], 0
je 0x14042aa30
mov rcx, qword [rbx + 0x28]
jmp 0x14042aa11
call qword [rbx + 0x20]
test eax, eax
jmp 0x14042aa1b
je 0x14042aac0
cmp dword [rbx + 0x30], 0
jmp 0x14042aa2a
je 0x14042ab2f
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
cmp rax, rcx
jmp 0x14042aa46
jae 0x14042ab2f
cmp rax, rcx
jmp 0x14042aa54
jb 0x14042a9b8
cmp dword [rbx + 0x30], 0
jmp 0x14042aa63
je 0x14042aae7
mov r8d, dword [rbx + 0x34]
not dh
cmovg ecx, r11d
cwd
mov rcx, qword [rbx + 0x28]
movzx rdx, dx
mov rdx, r8
cdq
mov rdx, r14
jmp 0x14042aa89
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
test eax, eax
jmp 0x14042aaa5
je 0x14042aaf3
movsxd rcx, eax
cwde
add rcx, r14
movzx eax, byte [r14]
jmp 0x14042aabb
jmp 0x14042ab1c
mov rax, qword [rbx + 0xc0]
not cl
neg ch
rcr cl, cl
mov rcx, qword [rbx + 0xc8]
cmp rax, rcx
jmp 0x14042aadc
jae 0x14042aa5a
jmp 0x14042a9b8
sub eax, eax
jmp 0x14042aaee
jmp 0x14042a9d0
mov dword [rbx + 0x30], 0
ror cl, cl
mov byte [rbx + 0x38], 0
xadd ch, ch
bsr rcx, rax
sub eax, eax
movsx rcx, r11w
movzx rcx, cx
setne ch
mov rcx, r15
jmp 0x14042ab1c
mov qword [rbx + 0xc8], rcx
mov qword [rbx + 0xc0], r15
jmp 0x14042a9d0
sub r12d, r12d
movsxd rbx, ecx
shr di, cl
mov rax, r12
shl r15w, 0x78
test rdi, r10
add rsp, 0x20
cmovno r12d, ebx
pop rbx
seto r14b
mov sil, spl
movzx r12, ax
pop rbp
pop rdi
sete r14b
movzx r12w, r10b
mov r14w, cx
pop rsi
movsx r14, r12w
pop r12
pop r14
mov r15b, r10b
not r15w
pop r15
jmp 0x14042ab7d
ret
Function at 0x14042cc5a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bsr rax, rbx
cbw
push rdi
shl sil, cl
shl eax, 0xb7
push rbx
movzx rax, r10w
cwde
bsr esi, esi
sub rsp, 0x20
sbb al, r8b
mov rsi, rcx
btr ax, ax
inc ah
movzx eax, byte [rcx + 0x4828]
jmp 0x14042cc8d
cmp al, 0xff
jmp 0x14042cc94
je 0x14042ccab
mov byte [rsi + 0x4828], 0xff
jmp 0x14042cca6
jmp 0x14042cdac
mov rbx, qword [rsi]
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jmp 0x14042ccc1
jae 0x14042cce8
lea rcx, [rax + 1]
jmp 0x14042ccd0
mov qword [rbx + 0xc0], rcx
movzx cx, al
movzx ecx, byte [rax]
jmp 0x14042cce3
jmp 0x14042cda0
cmp dword [rbx + 0x30], 0
jmp 0x14042ccf1
je 0x14042cd5f
mov r8d, dword [rbx + 0x34]
movzx rcx, r15w
not ecx
mov rdi, r12
lea rdi, [rbx + 0x38]
cqo
movzx edx, r13w
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
jmp 0x14042cd1a
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
stc
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
jmp 0x14042cd39
test eax, eax
jmp 0x14042cd40
je 0x14042cd6b
cdqe
ror rcx, 0xb0
add ch, 0xc
add rax, rdi
movzx ecx, byte [rdi]
jmp 0x14042cd5a
jmp 0x14042cd83
mov al, 0xff
jmp 0x14042cd66
jmp 0x14042cdac
mov dword [rbx + 0x30], 0
sub al, sil
lea rax, [rbx + 0x39]
cmp r15b, 0x71
mov byte [rbx + 0x38], 0
sub ecx, ecx
mov qword [rbx + 0xc8], rax
movzx ax, r14b
setle al
lea rax, [rbx + 0x39]
mov qword [rbx + 0xc0], rax
sub al, r9b
mov al, 0xff
stc
cmp cl, 0xff
je 0x14042cdee
add rsp, 0x20
pop rbx
not dil
movzx rsi, r13w
mov sil, 9
pop rdi
movsxd rsi, r13d
mov rsi, rsp
pop rsi
jmp 0x14042cdc8
ret
lea rcx, [rax + 1]
mov qword [rbx + 0xc0], rcx
movzx eax, byte [rax]
test sp, 0x4cc6
jmp 0x14042cde1
cmp al, 0xff
jmp 0x14042cde8
jne 0x14042cdac
mov rbx, qword [rsi]
shr ah, 0xda
xor al, r14b
btr ax, r13w
mov rax, qword [rbx + 0xc0]
test dil, 0xa7
cmp rax, qword [rbx + 0xc8]
jmp 0x14042ce13
jb 0x14042cdc9
cmp dword [rbx + 0x30], 0
jmp 0x14042ce22
je 0x14042cef2
mov r8d, dword [rbx + 0x34]
movzx rdx, r14w
lea rdi, [rbx + 0x38]
movsxd rcx, r15d
mov dl, r15b
mov rcx, qword [rbx + 0x28]
mov edx, ebx
movsxd rdx, r12d
setno dl
mov rdx, rdi
jmp 0x14042ce4e
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
test cl, 0x88
jmp 0x14042ce5f
sub ecx, dword [rbx + 0xd0]
jmp 0x14042ce71
add dword [rbx + 0xb8], ecx
test r8b, 0x9b
jmp 0x14042ce80
test eax, eax
jmp 0x14042ce87
je 0x14042cea6
movsxd rcx, eax
rcr ax, 5
add rcx, rdi
cdqe
movzx eax, byte [rdi]
jmp 0x14042cea1
jmp 0x14042cec8
mov dword [rbx + 0x30], 0
inc rcx
sub rcx, rbx
or cl, sil
lea rcx, [rbx + 0x39]
clc
mov byte [rbx + 0x38], 0
test bpl, spl
sub eax, eax
clc
cmp dil, r12b
mov qword [rbx + 0xc8], rcx
setg ch
rcl cl, 0x6b
lea rcx, [rbx + 0x39]
mov qword [rbx + 0xc0], rcx
cmp al, 0xff
jmp 0x14042cee7
je 0x14042cdee
jmp 0x14042cdac
sub eax, eax
jmp 0x14042cdac
Function at 0x14043eb3f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
shr r15b, cl
sal r15w, 0x99
xadd r15b, r15b
push r14
movsx r14, dx
cmp r13d, edi
push rsi
rcr r14b, cl
push rdi
push rbp
movsx r14w, r12b
dec bp
push rbx
movzx rbx, ax
btr r15d, 0x82
sub rsp, 0x28
mov r15d, r9d
mov ebp, r8d
sbb bx, 0x5f1e
movsx bx, bh
and rbx, rdx
mov r14, rdx
sub bl, 0x68
xor ebx, ecx
mov rbx, rcx
clc
lea rcx, [rdx + 0x20]
movsx rdx, dx
sub edx, 0x15d87ac6
mov edx, r8d
bsr r8w, r14w
test sp, 0x1e12
movsx r8, dx
mov r8d, r9d
jmp 0x14043ebb7
xor r9d, r9d
jmp 0x14043ebbf
call fcn.14043ed7f
test r15d, r15d
jle 0x14043ec78
test rax, rax
je 0x14043ec78
movsxd rsi, ebp
rcr edx, 0x47
movsx dx, r10b
movzx cx, bh
mov ecx, r15d
sar dl, 0x8b
sbb dx, 0x267d
movsxd rdx, edi
sub ebp, ebp
mov dl, r10b
movsxd rdx, esi
mov rdx, rsi
jmp 0x14043ec03
jmp 0x14043ec33
movzx edi, word [rdi + rdx*2]
jmp 0x14043ec11
mov word [rax + rbp*2], di
jmp 0x14043ec1a
inc rbp
jmp 0x14043ec22
inc rdx
cmp rcx, rbp
jmp 0x14043ec2d
je 0x14043ec82
mov di, 0x2a
jmp 0x14043ec3f
test byte [rbx + 0x1c], 4
jne 0x14043ec11
mov rdi, qword [rbx]
cmp qword [rdi + 0x10], rdx
jmp 0x14043ec55
jbe 0x14043ed74
cmp qword [rdi + 0x18], 8
jmp 0x14043ec65
jb 0x14043ec08
mov rdi, qword [rdi]
jmp 0x14043ec73
jmp 0x14043ec08
movsxd rsi, ebp
rcl di, cl
btc ecx, 0x1f
mov rbx, qword [rbx]
adc ch, 0x33
sar ch, 0xe6
rol di, cl
mov rdi, qword [rbx + 0x10]
sets ch
sbb ecx, r12d
mov rcx, rdi
cmc
jmp 0x14043eca1
sub rcx, rsi
jmp 0x14043eca9
jb 0x14043ed74
movsxd rax, r15d
cmp al, r13b
cmp rcx, rax
jmp 0x14043ecbd
cmovb rax, rcx
cmp qword [rbx + 0x18], 8
xchg ecx, ecx
movsx cx, r14b
mov rcx, rbx
jb 0x14043ecda
mov rcx, qword [rbx]
stc
lea rcx, [rcx + rsi*2]
movsx edx, r14w
test sil, cl
sub rdi, rax
xadd rbp, rdx
bswap r8w
rcr r8w, 0x44
mov rbp, rdi
shl r8w, 0x1a
ror r8b, cl
xadd r8, rdx
sub rbp, rsi
lea rdx, [rcx + rax*2]
add r8b, 0xbc
bsf r8d, esi
lea r8, [rbp + 2]
add r8, rbp
call fcn.1404a222e
mov qword [rbx + 0x10], rdi
btr bp, 0x93
sar bp, 0x3d
mov byte [r14 + 0x16], 0
or bl, r12b
btr rbp, rdx
add rsp, 0x28
pop rbx
xchg r14b, sil
movsx rdi, r14w
movzx bp, r14b
pop rbp
cmovg rdi, rbp
mov r15b, sil
pop rdi
movzx r14, di
pop rsi
movsx r14d, dx
bswap r15w
pop r14
xchg r15b, r15b
movsx r15d, di
pop r15
jmp 0x14043ed73
ret
call fcn.14043e182
int3
Function at 0x140442c46
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140442c4f
movzx ecx, cx
jmp 0x140442c57
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
clc
jmp 0x140442c66
cmp eax, 0x100
setae al
jmp 0x140442c74
add rsp, 0x28
ret

Function at 0x14044440f
Capabilities:
Access peb ldr_data
Encrypt data using speck
Execute syscall

Disassembly:
sub rsp, 0x28
jmp 0x140444420
mov rcx, qword [rcx]
cwde
setle al
mov rax, qword [rcx]
jmp 0x14044442f
call qword [rax + 0x28]
test eax, eax
je 0x140444465
mov ecx, eax
cmc
movabs r8, 0xcafa59766d7f94e
movzx r9w, r15b
shr r9d, cl
mov dl, 3
clc
rcl r9d, 0x55
mov r9d, 0x2a
add rsp, 0x28
jmp fcn.1403ae3a8
nop
cmp dil, cl
add rsp, 0x28
ret

Function at 0x1404444f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
xor sil, dil
cdqe
sub ah, 0xe1
push rdi
adc ax, di
push rbp
push rbx
xchg sil, sil
sub rsp, 0x48
mov rax, r9
add r9w, 0x4997
mov rsi, rdx
adc r9w, cx
cmp rax, rbp
mov rdx, rcx
btc r9, 0xf3
movzx r9w, r8b
mov ebx, dword [rsp + 0xa0]
test bp, dx
shr r9, cl
mov qword [rsp + 0x40], 0
btc r9w, 0xf7
mov rcx, qword [0x1400b9300]
btc r9w, sp
movss xmm0, dword [r8]
movss xmm1, dword [r8 + 4]
inc r9b
add r9b, 0xa8
mov r9, qword [rdx]
cmp spl, 0x4e
cmp ebx, 0xffffffff
jmp 0x140444575
je 0x140444588
mov r8d, ebx
jmp 0x140444583
jmp 0x1404445d0
mov rdx, 0xffffffffffffffff
neg r8
nop word [rax + rax]
shr r8d, cl
sets r8b
bsf r8d, r8d
lea r8, [rdx + 1]
test r12b, 0x12
test r10w, si
cmp word [rax + rdx*2 + 2], 0
movzx edx, di
movsxd rdx, r10d
movzx rdx, ax
mov rdx, r8
jmp 0x1404445ca
jne 0x1404445a6
mov ebp, dword [rsp + 0x98]
mov bx, 0x862
mov ebx, dword [rsp + 0x90]
movzx rdx, si
cdq
bswap edi
mov rdi, qword [rcx]
movzx dx, dh
movsx edx, sp
lea rdx, [rsp + 0x40]
jmp 0x1404445fd
mov qword [rsp + 0x30], rdx
xchg rdx, rdx
movzx edx, r12w
movss dword [rsp + 0x28], xmm1
mov rdx, 0x29e0117
not dx
movss dword [rsp + 0x20], xmm0
jmp 0x14044462a
mov rdx, rax
call qword [rdi + 0x90]
test eax, eax
je 0x14044465b
mov ecx, eax
not dl
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9d, 0x41
jmp 0x140444656
call fcn.1403ae3a8
mov rcx, qword [rsp + 0x40]
cwd
mov rax, qword [rcx]
xchg dh, dh
movsx dx, spl
mov edx, ebx
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
lahf
rdtsc
xchg dl, al
mov rax, qword [rcx]
movsxd rdx, r13d
mov edx, ebp
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
not ax
mov rax, rsi
add rsp, 0x48
movzx ebx, dx
movsx ebx, r8w
pop rbx
jmp 0x1404446a5
pop rbp
movsxd rdi, edx
sets dil
pop rdi
pop rsi
jmp 0x1404446b4
ret
Function at 0x140445557
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
shrd r14w, r15w, 0x56
xchg r14b, al
push rsi
rcl al, 0xb9
xchg al, sil
push rdi
cmc
movsx r14d, sp
xadd ax, ax
push rbp
bt ax, r12w
movzx r14w, r11b
push rbx
movsxd rbp, eax
cmovns r14, r15
xor dil, 0xa4
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
bswap rax
mov r14, r9
cmovae di, si
cdqe
mov rbx, r8
not bp
mov rdi, rdx
rdtsc
lahf
cmovne bp, r13w
mov rsi, rcx
cbw
cdqe
movsxd rax, r9d
movss xmm6, dword [rsp + 0xb0]
cbw
movzx ebp, byte [rsp + 0xb8]
mov qword [rsp + 0x38], 0
cqo
movsx edx, r13w
mov rcx, qword [rcx + 8]
cqo
mov rax, qword [rcx]
mov dl, r9b
mov dx, 0x2ffa
cdq
lea rdx, [rsp + 0x38]
jmp 0x1404455f7
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
movsxd rcx, r14d
movzx dx, al
mov dl, r9b
mov rcx, qword [rsp + 0x38]
xchg rdx, rdx
cmovs rdx, rsp
mov rax, qword [rcx]
not rdx
movsx dx, r10b
lea rdx, [rsp + 0x30]
jmp 0x14044562e
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
lahf
mov rdx, qword [rdi]
cdqe
movzx rax, r9w
movzx ax, r9b
mov rax, qword [rcx]
not r8w
movsx r8w, dl
movsxd r8, edx
mov r8d, 1
jmp 0x140445662
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
rdtsc
mov rax, qword [rcx]
jmp 0x140445676
mov rdx, rdi
bswap r8d
mov r8d, ebx
jmp 0x140445684
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
cdqe
not dl
movzx edx, bpl
mov rax, qword [rcx]
jmp 0x14044569c
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
not ax
movsxd rax, ebp
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x40], xmm0
mov rdx, r15
cmovg eax, r12d
movzx eax, sp
mov rax, qword [rcx]
cmovge dx, r11w
bswap edx
lea rdx, [rsp + 0x40]
jmp 0x1404456db
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
cbw
mov r8, qword [rsi + 0x20]
cdq
jmp 0x1404456ee
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
jmp 0x1404456fb
mov qword [rsp + 0x20], 0
jmp 0x140445709
movaps xmm3, xmm6
jmp 0x140445711
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
movsx rax, r10w
movzx eax, r11w
nop
mov rax, qword [rcx]
jmp 0x14044572d
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
cdqe
movsx eax, dx
movzx ax, r9b
mov rax, qword [rcx]
jmp 0x140445747
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
sal r14b, 0xd4
bts ebp, esi
shld rbp, r10, 0x15
add rsp, 0x60
movzx ebp, r9w
pop rbx
mov si, sp
cmovge si, di
pop rbp
xchg r14d, r14d
bswap r14d
pop rdi
movzx rsi, cx
movsxd rsi, r11d
bswap r14w
pop rsi
movsx r14d, di
bswap r14w
not r14w
pop r14
jmp 0x140445792
ret
Function at 0x14044734f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
inc ax
btr ax, r13w
mov eax, 0x5a4d
cmp word [0x140000000], ax
jmp 0x14044736f
jne 0x140447476
movsxd rcx, dword [0x14000003c]
rcl edx, cl
and edx, esi
lea rdx, [0x140000000]
test r13b, 0xc9
cmp r9b, bl
test rax, rdx
add rcx, rdx
cmp si, ax
cmp r13b, 0x3c
cmp dword [rcx], 0x4550
jmp 0x1404473a6
jne 0x140447476
mov eax, 0x20b
cmp r15b, dil
test cx, sp
cmp word [rcx + 0x18], ax
jmp 0x1404473c0
jne 0x140447476
sub r8, rdx
movzx edx, word [rcx + 0x14]
sar ax, 0xb8
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
rol r9b, cl
sub r9, rdi
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp bp, 0x13ce
cmc
cmp rdx, r9
jmp 0x1404473fc
je 0x140447433
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140447425
mov eax, dword [rdx + 8]
cmp bx, ax
clc
add eax, ecx
cmp r8, rax
jmp 0x14044741f
jb 0x14044743f
add rdx, 0x28
jmp 0x14044742e
jmp 0x1404473ea
xor edx, edx
test r9d, r12d
test r12b, 0xc2
cmp dh, 0x59
test rdx, rdx
jmp 0x140447447
jne 0x140447454
xor al, al
jmp 0x140447483
cmp dword [rdx + 0x24], 0
jge 0x14044746a
xor al, al
jmp 0x140447465
jmp 0x140447483
mov al, 1
jmp 0x140447471
jmp 0x140447483
sub al, al
jmp 0x140447483
add rsp, 0x18
jmp 0x14044748c
ret
Function at 0x140459037
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
jmp 0x140459045
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
add rsp, 0x28
jmp 0x140459059
ret

Function at 0x1404592e6
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
sub ecx, ecx
jmp 0x1404592f1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140459367
mov ecx, 0x5a4d
cmp r10, 0x78ba4036
cmp word [rax], cx
jne 0x140459367
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jmp 0x140459328
jne 0x140459367
mov eax, 0x20b
cmp r8w, 0x1771
cmp word [rcx + 0x18], ax
jne 0x140459367
cmp dword [rcx + 0x84], 0xe
jbe 0x140459367
cmp dword [rcx + 0xf8], 0
setno al
setne al
jmp 0x140459362
jmp 0x14045936a
sub al, al
stc
add rsp, 0x28
ret
Function at 0x14046ac9b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp dl, r13b
stc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
cmove bp, r11w
mov qword [rax + 0x20], rdi
xor rdi, rsi
shr edi, 0xa6
push r14
sbb si, 0x4a73
stc
sub rsp, 0x20
dec di
sbb ebp, edi
mov rdi, qword [rsp + 0x50]
movzx rsi, r12w
mov r14, r9
mov rsi, r8
sar bpl, 0xa
mov rbp, rdx
stc
test rdi, rdi
jmp 0x14046aced
je 0x14046adaf
mov rbx, qword [r8 + 8]
jmp 0x14046acfc
test rbx, rbx
je 0x14046ad96
mov rax, qword [rbx + 0x40]
movzx r8d, word [r14]
cmp qword [rax], 0
je 0x14046ad53
mov rax, qword [rbx + 0x58]
test al, 0xb8
cmp dword [rax], 0
jmp 0x14046ad25
jle 0x14046ad53
dec dword [rax]
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 2]
jmp 0x14046ad3d
mov qword [rcx], rax
jmp 0x14046ad45
mov word [rdx], r8w
jmp 0x14046ad4e
jmp 0x14046ad82
mov rax, qword [rbx]
movzx edx, r13w
mov dx, si
movsx edx, bx
movzx edx, r8w
mov rcx, rbx
jmp 0x14046ad6c
mov rax, qword [rax + 0x18]
jmp 0x14046ad75
call qword [0x1400b8d90]
movzx r8d, ax
ror al, 0xd6
mov eax, 0xffff
cmp ax, r8w
jmp 0x14046ad90
jne 0x14046ad99
mov byte [rsi], 1
add r14, 2
test r13b, r10b
sub rdi, 1
jmp 0x14046ada9
jne 0x14046acfc
movups xmm0, xmmword [rsi]
rcr ah, cl
rol ax, cl
neg edi
mov rbx, qword [rsp + 0x30]
mov rax, rbp
ror si, cl
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
shl r14d, cl
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r14
jmp 0x14046ade6
ret
Function at 0x14046ade7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp dx, 0x1a85
test r12, 0x182628a3
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
test cx, bx
mov qword [rax + 0x18], rsi
btc rsi, rax
rcr bp, cl
mov qword [rax + 0x20], rdi
bts bp, r12w
push r14
movsx r14d, bx
inc bpl
add r14b, r8b
sub rsp, 0x20
mov rsi, qword [rsp + 0x50]
movzx r14d, r9w
mov rdi, r8
sbb bpl, spl
xor bp, 0x2bc9
sar bpl, 0x57
mov rbp, rdx
test r12b, spl
jmp 0x14046ae48
test rsi, rsi
jmp 0x14046ae50
je 0x14046af30
mov rbx, qword [r8 + 8]
test r14, rdi
clc
test rbx, rbx
jmp 0x14046ae66
je 0x14046af1e
mov rax, qword [rbx + 0x40]
clc
jmp 0x14046ae76
cmp qword [rax], 0
jmp 0x14046ae7f
je 0x14046aed1
mov rax, qword [rbx + 0x58]
cmp dx, 0x7be7
stc
cmp dword [rax], 0
jmp 0x14046ae97
jle 0x14046aed1
dec dword [rax]
cdq
mov rcx, qword [rbx + 0x40]
movzx dx, ch
cbw
mov rdx, qword [rcx]
lea rax, [rdx + 2]
jmp 0x14046aeb6
mov qword [rcx], rax
lahf
movzx eax, r14w
jmp 0x14046aec3
mov word [rdx], r14w
jmp 0x14046aecc
jmp 0x14046af06
mov rax, qword [rbx]
movsx rcx, bp
movsxd rcx, r8d
movzx ecx, ax
movzx edx, r14w
movsx ecx, si
movsx cx, r9b
cmovne cx, r10w
mov rcx, rbx
jmp 0x14046aef7
mov rax, qword [rax + 0x18]
jmp 0x14046af00
call qword [0x1400b8d90]
mov ecx, 0xffff
cmp r13w, r8w
test r8w, 0x1a07
cmp cx, ax
jne 0x14046af21
mov byte [rdi], 1
sub rsi, 1
jmp 0x14046af2a
jne 0x14046ae5e
movups xmm0, xmmword [rdi]
adc r14w, 0x1254
add di, 0x54df
mov rbx, qword [rsp + 0x30]
lahf
cmovno r14d, r11d
bts si, si
mov rax, rbp
mov rsi, qword [rsp + 0x40]
xadd dil, dil
not dil
mov rdi, qword [rsp + 0x48]
mov r14, 0x470f1928
sar r14w, cl
movdqu xmmword [rbp], xmm0
or r14b, 0x9b
mov rbp, qword [rsp + 0x38]
add r14, 0x421273bf
add rsp, 0x20
pop r14
jmp 0x14046af8b
ret
Function at 0x14049d79e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test ch, 0x56
mov qword [rax + 0x10], rbx
jmp 0x14049d7b6
mov qword [rax + 0x18], rbp
cmovno bp, cx
mov qword [rax + 0x20], rsi
test r14b, 0x12
inc sil
adc rbp, r15
push rdi
and bpl, r11b
movzx rsi, dx
bswap edi
push r14
movsx ebp, r8w
push r15
ror si, cl
mov rdi, r14
sub rsp, 0x20
sbb sil, sil
test rdx, rdx
movzx r14w, r9b
movsx r15, r10w
lea r14, [rax + 8]
not bp
mov rbp, rcx
bswap r15w
mov rdi, rcx
movzx ecx, byte [rcx]
cmovne r14, rdx
setbe sil
movzx rsi, r11w
not r15b
mov r15, r9
mov esi, r8d
jmp 0x14049d830
inc rdi
movzx ecx, byte [rdi]
jmp 0x14049d830
call fcn.1404b6f1a
test eax, eax
jne 0x14049d825
mov bl, byte [rdi]
lea eax, [rbx - 0x2b]
clc
test r11d, 0xc9f5aa0
test al, 0xfd
je 0x14049d85e
mov bl, 0x2b
jmp 0x14049d859
jmp 0x14049d863
inc rdi
cqo
mov r9, r15
cqo
movzx rdx, r13w
mov r8d, esi
setp ch
cdq
cqo
mov rdx, r14
movzx rcx, bp
xchg cx, cx
cmovge cx, r8w
mov rcx, rdi
call fcn.14049d9a4
mov ecx, eax
movsx si, dl
mov esi, 0x7fffffff
cmp dil, 0x1a
stc
cmp rdi, qword [r14]
jmp 0x14049d8a4
jne 0x14049d8b7
mov qword [r14], rbp
jmp 0x14049d8b2
jmp 0x14049d8c5
cmp rbp, qword [r14]
jmp 0x14049d8bf
jne 0x14049d8d2
test ecx, ecx
jmp 0x14049d8cc
jne 0x14049d907
cmp bl, 0x2b
jmp 0x14049d8da
jne 0x14049d8e8
cmp ecx, esi
ja 0x14049d907
cmp bl, 0x2d
jmp 0x14049d8f0
jne 0x14049d949
cmp ecx, 0x80000000
jmp 0x14049d901
jbe 0x14049d949
call fcn.1404b4263
mov dword [rax], 0x22
cmp bpl, r12b
jmp 0x14049d91a
test r15, r15
jmp 0x14049d922
je 0x14049d92f
mov dword [r15], 1
mov eax, 0x80000000
test bpl, r9b
cmp bl, 0x2d
jmp 0x14049d93f
cmove esi, eax
mov eax, esi
jmp 0x14049d96c
neg eax
rcl r15w, 0x37
cmc
cmp bl, 0x2d
cmovle di, bp
not r15b
mov bp, r11w
cmove ecx, eax
xor bx, 0x7c8f
mov eax, ecx
rcr r14b, cl
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
rcr dil, cl
mov rsi, qword [rsp + 0x58]
shl rdi, 0x90
add rsp, 0x20
mov di, r12w
xchg dil, r15b
movzx r15, r12w
pop r15
sete dil
movzx r14, di
pop r14
pop rdi
jmp 0x14049d9a3
ret