joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403ec3c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmp bpl, 0xf2
push r14
sub r14w, r8w
rcr r15d, 0x7f
rol r15d, cl
push r13
sbb r14b, r13b
push r12
bts r12, r9
push rsi
clc
adc r15w, r10w
bts r15, r8
push rdi
push rbp
neg r15w
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
sub r12, rax
bt r13w, r15w
btc r13w, 0x2c
mov r14, r9
sub r12b, r10b
shl rbx, 0x1e
movsx ebx, r15w
mov r15, r8
rcl bh, 0xc4
mov r12, rdx
rol r13d, 0xfe
mov r13, rcx
sub bl, 0xbd
rcr bh, cl
sbb bl, r8b
mov rbx, qword [rcx]
test rbx, rbx
jmp 0x1403ec43f
je 0x1403ec589
mov rdi, qword [r13 + 8]
cmc
cmp rbx, rdi
jmp 0x1403ec452
je 0x1403ec528
lea rbp, [0x1400bed10]
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403ec46b
jmp 0x1403ec498
call fcn.1401f8216
movups xmmword [rbx + 0x20], xmm6
jmp 0x1403ec47f
mov byte [rbx + 0x10], 0
test r13b, 0xc7
stc
add rbx, 0x50
clc
stc
cmc
cmp rbx, rdi
je 0x1403ec524
mov qword [rbx], rbp
movsx ecx, r15w
lea rcx, [rbx + 0x38]
jmp 0x1403ec4a8
call fcn.1403e9909
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jmp 0x1403ec4ba
jb 0x1403ec475
mov rcx, qword [rbx + 0x10]
test r11b, spl
sbb dl, r14b
stc
lea rdx, [rax + 1]
jmp 0x1403ec4d8
cmp rdx, 0x1000
jmp 0x1403ec4e4
jb 0x1403ec470
mov rsi, qword [rcx - 8]
cmc
clc
add rcx, 0xfffffffffffffff8
test ax, 0x1e6a
sub rcx, rsi
test r15w, 0x2e54
cmp rcx, 0x20
jmp 0x1403ec50a
jae 0x1403ec649
add rax, 0x28
mov rdx, rax
mov rcx, rsi
jmp 0x1403ec51f
jmp 0x1403ec470
mov rbx, qword [r13]
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmc
cmp rdx, 0x1000
jmp 0x1403ec53c
jb 0x1403ec57c
mov rax, qword [rbx - 8]
cmp dx, 0x6e71
jmp 0x1403ec551
add rbx, 0xfffffffffffffff8
stc
sub rbx, rax
cmc
cmp rbx, 0x20
jae 0x1403ec649
add rdx, 0x27
mov bl, bpl
movzx rbx, di
mov rbx, rax
not ch
movzx rcx, r12w
movzx ecx, r15w
mov rcx, rbx
jmp 0x1403ec584
call fcn.1401f8216
mov qword [r13], r12
rcl si, 0x73
sub al, 0x5a
bt bp, dx
lea rax, [r15 + r15*4]
test sil, 0xfd
shl dil, 0xbd
shl rax, 4
rol si, cl
shl sil, cl
lea rax, [rax + r12]
ror r15b, 0xe0
stc
mov qword [r13 + 8], rax
mov sil, 0x57
rcr eax, cl
lea rax, [r14 + r14*4]
xadd r14b, sil
and sil, 0x88
shl rax, 4
add r14b, bpl
neg rdi
lea rax, [rax + r12]
dec r15
cmp ah, al
not r12b
mov qword [r13 + 0x10], rax
xchg r12w, bp
xor r14b, dl
movaps xmm6, xmmword [rsp + 0x20]
or r14d, esp
mov r15w, 0x5de3
add rsp, 0x38
not esi
movzx ebx, r11w
movsx r14, di
pop rbx
pop rbp
mov r12b, r10b
movzx r12w, spl
xchg r12d, esi
pop rdi
movzx r15, r13w
movzx r13d, r8w
pop rsi
mov r14w, 0x4f67
jmp 0x1403ec62c
pop r12
movzx r13w, spl
mov r13b, al
pop r13
pop r14
movzx r15d, r12w
mov r15b, spl
pop r15
jmp 0x1403ec648
ret
call fcn.1404bb982
int3
Function at 0x1403ed6ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
clc
cmp edi, 0x58696282
push r14
adc r14b, 0xf0
push rsi
shl r14b, 0x60
bt r14w, di
push rdi
push rbx
stc
bt r14w, di
cmp r12b, r13b
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
bt bx, 0xec
bts ebx, esp
movsx r14, r10w
mov r14, rcx
bt rbx, r12
bswap ebx
movsxd rbx, ebx
mov dword [rcx + 8], 0
shr bh, cl
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 0x18]
bsf ebx, r14d
sal bx, cl
mov rbx, qword [rcx + 0x20]
test r9b, r15b
cmp rdi, rbx
jmp 0x1403ed724
je 0x1403ed7ed
lea r15, [0x1400beb30]
jmp 0x1403ed736
xorps xmm6, xmm6
jmp 0x1403ed771
lea rsi, [rdi + 0x18]
jmp 0x1403ed747
call fcn.1401f8216
movups xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
jmp 0x1403ed75c
add rdi, 0x30
cmp r8b, bpl
cmp rdi, rbx
jmp 0x1403ed76b
je 0x1403ed7de
mov qword [rdi], r15
sar rcx, cl
mov rcx, qword [rdi + 0x18]
test rcx, rcx
jmp 0x1403ed783
je 0x1403ed75c
mov rdx, qword [rdi + 0x28]
test rbp, rbx
sub rdx, rcx
stc
jmp 0x1403ed799
cmp rdx, 0x1000
jb 0x1403ed73e
mov rax, qword [rcx - 8]
test dh, 0xda
jmp 0x1403ed7b3
add rcx, 0xfffffffffffffff8
sub rcx, rax
test eax, r15d
clc
cmp rcx, 0x20
jmp 0x1403ed7c7
jae 0x1403ed965
add rdx, 0x27
mov rcx, rax
jmp 0x1403ed7d9
jmp 0x1403ed73e
mov rax, qword [r14 + 0x18]
jmp 0x1403ed7e7
mov qword [r14 + 0x20], rax
cbw
mov qword [r14 + 0x30], 0
lea rax, [0x1400bed70]
jmp 0x1403ed801
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
btc rcx, rsp
jmp 0x1403ed817
movups xmmword [rsp + 0x48], xmm0
setae ch
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
test r15d, esi
mov qword [rsp + 0x78], 0
and rax, r8
lahf
mov dword [rsp + 0x30], 0
mov eax, 0x4dd4631a
lea rax, [r14 + 0x38]
bt rcx, 0xc
mov dword [r14 + 0x40], 0
lea rcx, [rsp + 0x28]
clc
cmp rax, rcx
jmp 0x1403ed865
je 0x1403ed915
lea rcx, [r14 + 0x48]
cmc
cmp r9, r13
cmp r8, 0x30fa1878
sub edx, edx
cmc
xor r8d, r8d
jmp 0x1403ed885
call fcn.1403ef68d
lea rcx, [r14 + 0x60]
shl dx, cl
clc
mov rdx, qword [rsp + 0x50]
movsx r8, r11w
mov r8b, 0x34
bswap r8d
mov r8, qword [rsp + 0x58]
jmp 0x1403ed8b3
sub r8, rdx
test cl, r12b
jmp 0x1403ed8be
sar r8, 5
jmp 0x1403ed8c7
call fcn.1403ef68d
add r14, 0x78
sar dl, cl
and r8w, bx
neg dh
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
xor cx, 0x132d
cmp r15, 0x6c531934
or cx, 0x6ac3
sub r8, rdx
and rcx, 0x64683bd9
movzx rcx, r11w
add ch, 0xb
sar r8, 5
mov rcx, r14
jmp 0x1403ed910
call fcn.1403ef68d
lea rcx, [rsp + 0x28]
jmp 0x1403ed91f
call fcn.1403ef47e
movaps xmm6, xmmword [rsp + 0x80]
movzx r15d, r11w
bts r14w, r10w
bswap rsi
add rsp, 0x90
movsx r14d, r12w
pop rbx
movsx r15w, sil
mov r15w, 0x444a
pop rdi
setae r15b
pop rsi
pop r14
movzx r15w, r10b
xchg r15b, r15b
movzx r15, cx
pop r15
ret
call fcn.1404bb982
int3
Function at 0x1403efc7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
stc
cmc
push r14
cmp r9d, 0x39b2a4a
push rsi
push rdi
bts di, bp
push rbx
xadd dil, dil
rol dil, 0x49
xor dil, r8b
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rdi, qword [rcx]
cmp ax, bp
test rdi, rdi
jmp 0x1403efcb2
je 0x1403efe08
mov r14, rcx
mov rbx, qword [rcx + 8]
test r11, r15
clc
cmp rdi, rbx
jmp 0x1403efccb
je 0x1403efd83
lea r15, [0x1400beb30]
xorps xmm6, xmm6
jmp 0x1403efd13
lea rsi, [rdi + 0x18]
call fcn.1401f8216
movups xmmword [rsi], xmm6
stc
clc
jmp 0x1403efcf3
mov qword [rsi + 0x10], 0
add rdi, 0x30
stc
jmp 0x1403efd05
cmp rdi, rbx
jmp 0x1403efd0d
je 0x1403efd80
mov qword [rdi], r15
btr cx, r13w
clc
mov rcx, qword [rdi + 0x18]
clc
jmp 0x1403efd26
test rcx, rcx
je 0x1403efcfb
mov rdx, qword [rdi + 0x28]
sub rdx, rcx
test cl, 0x55
cmp rdx, 0x1000
jmp 0x1403efd45
jb 0x1403efce0
mov rax, qword [rcx - 8]
test r13b, r15b
cmp r12b, 0x3d
add rcx, 0xfffffffffffffff8
jmp 0x1403efd5f
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403efd6b
jae 0x1403efe40
add rdx, 0x27
mov ch, 0xf9
mov rcx, rax
jmp 0x1403efce0
mov rdi, qword [r14]
mov rdx, qword [r14 + 0x10]
jmp 0x1403efd8c
sub rdx, rdi
cmp rdx, 0x1000
jb 0x1403efdda
mov rax, qword [rdi - 8]
cmp r8b, 0x5b
add rdi, 0xfffffffffffffff8
jmp 0x1403efdad
sub rdi, rax
cmp rdi, 0x20
jmp 0x1403efdb9
jae 0x1403efe40
add rdx, 0x27
movsx cx, r8b
movzx edi, r14w
mov rdi, rax
mov rcx, rdi
movzx rcx, r9w
movsx ecx, r9w
mov rcx, rdi
call fcn.1401f8216
xorps xmm0, xmm0
movups xmmword [r14], xmm0
cmp r10w, 0x58e7
bt rdi, r11
mov qword [r14 + 0x10], 0
rol r14, 0xc6
sbb r14w, 0x6a6a
test bh, 0x20
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
movsxd rbx, r13d
not si
pop rbx
setge r15b
bswap r14d
pop rdi
movsxd r15, esi
pop rsi
movzx r14d, ax
xchg r15w, r15w
setle r15b
pop r14
bswap r15d
movzx r15, r13w
movsx r15, r9w
pop r15
ret
call fcn.1404bb982
int3
Function at 0x1403fb5a3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
clc
push r14
sar r14, 0xbe
sub r14w, 0x6940
push r12
not r14b
push rsi
push rdi
rcl r14b, 0xd4
bts r14w, sp
push rbx
sub rsp, 0x28
movsx r14w, r13b
rcr r14w, 0xb3
ror r14b, 0x82
mov r14, r8
cmp bl, 0x9b
test rdx, rdx
jmp 0x1403fb5e3
je 0x1403fb7fb
mov rdi, rdx
sar r12, 9
bswap r12d
mov r12, rcx
sub ebx, ebx
jmp 0x1403fb5fd
jmp 0x1403fb61f
mov rcx, r15
mov rdx, rsi
jmp 0x1403fb60d
call fcn.1403c0abe
add rbx, 0x50
dec rdi
je 0x1403fb7ee
mov eax, dword [r12 + rbx + 8]
mov dword [r14 + rbx + 8], eax
cmp r14, r12
jmp 0x1403fb631
je 0x1403fb612
cmp qword [r12 + rbx + 0x28], 0x10
jmp 0x1403fb642
jb 0x1403fb657
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403fb652
jmp 0x1403fb670
lea r9, [r12 + rbx]
shld r15w, r15w, 0xed
add r9, 0x10
ror r15w, cl
bts eax, r15d
sar r15d, cl
lea r15, [r14 + rbx]
or al, spl
test r8b, 8
bt ax, 0xa0
add r15, 0x10
test r12, 0xc0577ab
cmp spl, al
mov rsi, qword [r12 + rbx + 0x20]
bswap eax
test r14b, r8b
mov rax, qword [r14 + rbx + 0x28]
test ah, 0xc1
stc
jmp 0x1403fb6a6
cmp rax, rsi
jmp 0x1403fb6ae
jae 0x1403fb6cb
mov rcx, r15
cqo
mov rdx, rsi
jmp 0x1403fb6c1
call fcn.1403c0abe
jmp 0x1403fb720
cmp rax, 0x10
jmp 0x1403fb6d4
jb 0x1403fb6df
mov r15, qword [r14 + rbx + 0x10]
mov qword [r14 + rbx + 0x20], rsi
jmp 0x1403fb6e9
mov rcx, r15
bswap dx
movzx r8w, r13b
not r8b
mov rdx, r9
movsxd r8, r14d
movzx r8, si
movsx r8, r14w
mov r8, rsi
jmp 0x1403fb70d
call fcn.1404a8f08
mov byte [r15 + rsi], 0
stc
cmp r10d, 0x42c87b99
cmc
mov rsi, qword [r12 + rbx + 0x40]
jmp 0x1403fb733
cmp qword [r12 + rbx + 0x48], 0x10
jb 0x1403fb74e
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403fb749
jmp 0x1403fb76c
lea r9, [r12 + rbx]
sar al, 0x20
bsf r15d, ecx
rcr r15d, 0x5b
add r9, 0x30
sub eax, r15d
btr r15d, esi
rol r15, 0xaf
lea r15, [r14 + rbx]
xor al, r14b
inc al
add r15, 0x30
movzx ax, r14b
and ax, di
mov rax, qword [r14 + rbx + 0x48]
cmc
cmp rax, rsi
jmp 0x1403fb78f
jb 0x1403fb602
cmp rax, 0x10
jb 0x1403fb7ad
mov r15, qword [r14 + rbx + 0x30]
movzx edx, bp
jmp 0x1403fb7ad
mov qword [r14 + rbx + 0x40], rsi
bswap rdx
movzx r8w, r9b
xchg dl, r8b
mov rcx, r15
movsx r8d, dx
cdq
setnp dh
mov rdx, r9
mov r8w, r13w
movsxd r8, esi
mov r8w, 0x24cf
mov r8, rsi
call fcn.1404a8f08
mov byte [r15 + rsi], 0
jmp 0x1403fb7e9
jmp 0x1403fb612
lea r14, [r14 + rbx]
jmp 0x1403fb7fb
mov rax, r14
add rsp, 0x28
mov di, 0x4a6a
movsx di, bl
cmova bx, r10w
pop rbx
movzx si, r13b
pop rdi
pop rsi
xchg r15b, r14b
pop r12
mov r15b, al
movsx r14d, di
xchg r14w, r15w
pop r14
mov r15b, bl
pop r15
ret
Function at 0x14043a736
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
clc
push r14
push rsi
movzx r15w, r13b
or r15b, 0xba
push rdi
push rbx
sub rsp, 0x20
xchg r15d, r15d
mov r15, rcx
jmp 0x14043a756
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movzx ax, r8b
mov qword [rcx + 0x10], 0
mov rcx, qword [rdx + 8]
cmp bpl, r11b
mov rax, qword [rdx]
mov rbx, rcx
cmp rax, 0x303b0532
jmp 0x14043a782
sub rbx, rax
test r13, 0x35ed3383
cmc
sub rcx, rax
je 0x14043a8a1
js 0x14043a8d8
mov r14, rdx
sar rbx, 6
test r11b, 0x19
cmp rcx, 0xfc1
jmp 0x14043a7b3
jb 0x14043a7e6
or rcx, 0x27
jmp 0x14043a7c2
call fcn.14044d63e
lea rdi, [rax + 0x27]
cmc
cmp r13d, ebx
and rdi, 0xffffffffffffffe0
jmp 0x14043a7d8
mov qword [rdi - 8], rax
jmp 0x14043a7e1
jmp 0x14043a7ee
call fcn.14044d63e
mov rdi, rax
mov qword [r15], rdi
rcr si, 0x8b
movsx esi, bp
jmp 0x14043a7fd
mov qword [r15 + 8], rdi
bswap rsi
xadd si, si
and sil, bpl
shl rbx, 6
test dx, 0x86b
rcl sil, cl
xor si, 0x5107
add rbx, rdi
bswap esi
jmp 0x14043a826
mov qword [r15 + 0x10], rbx
bswap bx
mov rbx, qword [r14]
mov rsi, qword [r14 + 8]
jmp 0x14043a839
jmp 0x14043a84a
add rdi, 0x40
test r13d, ecx
clc
add rbx, 0x40
cmp rbx, rsi
jmp 0x14043a852
je 0x14043a896
mov qword [rdi + 0x38], 0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
jmp 0x14043a86c
je 0x14043a83e
mov rax, qword [rcx]
movsx rdx, cx
movzx edx, cx
cqo
mov rdx, rdi
jmp 0x14043a886
call qword [rax]
mov qword [rdi + 0x38], rax
jmp 0x14043a891
jmp 0x14043a83e
mov qword [r15 + 8], rdi
add sil, 0x9d
ror eax, 0x98
mov rax, r15
sub si, ax
inc r14
shrd bx, cx, 0x6f
add rsp, 0x20
movsx r14d, r13w
pop rbx
pop rdi
mov sil, 0x18
movzx r15d, r12w
pop rsi
pop r14
setp r15b
cmovge r15w, r12w
movzx r15d, r12w
pop r15
jmp 0x14043a8d7
ret
call fcn.1403c13e0
int3
Function at 0x14044498a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
btc ax, 0x26
cwde
bt rax, 0xe5
push r14
btc ax, 0xf0
cmp sil, cl
seto al
push rsi
push rdi
push rbp
xor al, cl
cdqe
push rbx
sal ah, 0x95
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm8
xchg esi, esi
cbw
movaps xmmword [rsp + 0x50], xmm7
movsx rsi, r15w
jmp 0x1404449cb
movaps xmmword [rsp + 0x40], xmm6
movzx si, spl
mov ah, 0x2d
mov rax, qword [rcx]
mov esi, dword [rax + 0x10]
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
test rbx, 0x57661ad7
test esi, esi
jmp 0x140444a01
jle 0x140444be3
movaps xmm7, xmm2
movaps xmm8, xmm1
xchg r15b, r15b
mov r15b, spl
bswap r15w
mov r15, rcx
jmp 0x140444a20
xorps xmm6, xmm6
sub edi, edi
bswap r14w
cmovns r8d, esi
cqo
lea r14, [rsp + 0x28]
movsx ecx, dx
movzx rdx, r12w
nop word cs:[rax + rax]
mov rcx, r14
movsx rdx, r11w
xchg dh, dl
not dx
mov rdx, r15
not r8b
mov r8d, edi
jmp 0x140444a62
call fcn.140444672
mov ebx, dword [rsp + 0x3c]
clc
cmc
test ebx, ebx
jle 0x140444be3
test edi, edi
jmp 0x140444a7c
jne 0x140444a95
movss xmm0, dword [rsp + 0x34]
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x140444bd7
movss xmm0, dword [rsp + 0x38]
jmp 0x140444aa0
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x140444acc
add edi, ebx
jmp 0x140444ab4
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x140444ac1
jl 0x140444a48
jmp 0x140444be3
movss xmm6, dword [rsp + 0x28]
jmp 0x140444ad7
ucomiss xmm6, xmm8
jbe 0x140444aed
mov esi, edi
jmp 0x140444ae8
jmp 0x140444be3
movss xmm0, dword [rsp + 0x2c]
jmp 0x140444af8
ucomiss xmm0, xmm8
jbe 0x140444b75
sub ebp, ebp
movsx rdx, r8w
jmp 0x140444b0d
mov esi, edi
bswap r8d
movaps xmm7, xmm6
cmovae r8, rbx
nop word cs:[rax + rax]
movsx dx, r9b
mov rcx, r15
mov r8d, 0x7826a98
mov edx, edi
movzx r8, si
mov r8b, 0xfe
mov r8b, r14b
mov r8d, ebp
call fcn.140444e9e
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x140444c40
inc ebp
jmp 0x140444b5c
inc esi
cmp r11b, bpl
cmp r14d, 0x671e7bfa
movaps xmm6, xmm7
stc
cmc
cmp ebx, ebp
jne 0x140444b2a
test byte [r15 + 0x1c], 4
jmp 0x140444b7f
jne 0x140444bce
lea esi, [rbx + rdi]
dec esi
mov rax, qword [r15]
movsxd rcx, esi
test bh, 0xbf
stc
cmp qword [rax + 0x10], rcx
jmp 0x140444b9d
jbe 0x140444c5d
cmp qword [rax + 0x18], 8
jmp 0x140444bad
jb 0x140444bbe
mov rax, qword [rax]
test dl, r14b
jmp 0x140444bbe
cmp word [rax + rcx*2], 0xa
jmp 0x140444bc8
je 0x140444be3
add ebx, edi
mov esi, ebx
jmp 0x140444be3
sub esi, esi
sub di, 0x1e40
bt r15d, 0x7a
mov eax, esi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
shr sil, 0x1c
shrd rbp, rdi, 0x50
movaps xmm8, xmmword [rsp + 0x60]
bsf bp, r8w
jmp 0x140444c08
add rsp, 0x78
movsx r14w, spl
pop rbx
bswap r14w
movsx rbp, r15w
movsxd rdi, r14d
pop rbp
movzx r15w, r10b
pop rdi
movsx r15, bp
pop rsi
setne r15b
pop r14
mov r15w, dx
cmova r15w, r14w
pop r15
jmp 0x140444c3f
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x140444be3
inc esi
jmp 0x140444be3
call fcn.14044504d
int3
Function at 0x1404499f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x1404499f9
movzx ecx, cx
jmp 0x140449a01
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
stc
cmp r14w, r10w
cmp eax, 0x100
setae al
test dl, spl
add rsp, 0x28
jmp 0x140449a23
ret

Function at 0x14044b17a
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
lahf
mov rcx, qword [rcx]
cdqe
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
je 0x14044b1c5
mov ecx, eax
xor r9b, 0x56
movabs r8, 0xcafa59766d7f94e
adc r9w, 0x5802
add dl, 0x2e
mov dl, 3
bt r9d, r10d
mov r9d, 0x2a
add rsp, 0x28
jmp 0x14044b1c0
jmp fcn.1403b4efd
nop
add rsp, 0x28
jmp 0x14044b1cf
ret
Function at 0x14044e0a5
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
rol al, cl
test dx, ax
shld ax, r12w, 0xad
mov r8, rcx
mov eax, 0x5a4d
jmp 0x14044e0c4
cmp word [0x140000000], ax
jmp 0x14044e0d0
jne 0x14044e1d6
movsxd rcx, dword [0x14000003c]
ror dh, 0xd7
bts rdx, rbp
lea rdx, [0x140000000]
test cx, 0x27e4
lea rcx, [rcx + rdx]
cmp dword [rcx], 0x4550
jmp 0x14044e0ff
jne 0x14044e1d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14044e1d6
sub r8, rdx
rol r9d, cl
movzx rax, r8w
movzx edx, word [rcx + 0x14]
adc r9, 0x5f913567
mov rax, rdx
not r9d
add rdx, 0x18
shrd r9, r9, 5
add rdx, rcx
ror ax, 0x76
movsx ax, r12b
movzx eax, word [rcx + 6]
bsf cx, si
shr r9b, 0xc0
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
clc
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x14044e165
je 0x14044e1a0
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x14044e176
jb 0x14044e192
mov eax, dword [rdx + 8]
cmp ebp, esi
clc
add eax, ecx
cmp r8, rax
jmp 0x14044e18c
jb 0x14044e1a4
add rdx, 0x28
jmp 0x14044e19b
jmp 0x14044e159
sub edx, edx
cmc
clc
test rdx, rdx
jne 0x14044e1b4
xor al, al
jmp 0x14044e1e7
cmp dword [rdx + 0x24], 0
jge 0x14044e1ca
sub al, al
jmp 0x14044e1c5
jmp 0x14044e1e7
mov al, 1
jmp 0x14044e1d1
jmp 0x14044e1e7
sub al, al
jmp 0x14044e1dd
jmp 0x14044e1e7
add rsp, 0x18
jmp 0x14044e1f0
ret
Function at 0x14045fb04
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsx cx, r10b
cmovs rcx, r8
jmp 0x14045fb16
lea rcx, [rsp + 0x30]
jmp 0x14045fb20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
clc
test r10d, r10d
stc
add rsp, 0x28
jmp 0x14045fb39
ret

Function at 0x14045fbf0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
btc ebp, 0xa
jmp 0x14045fbff
mov rbp, rsp
shl al, cl
sub rsp, 0x20
mov rax, qword [0x1400b7288]
adc ebx, r8d
rol ebx, cl
movabs rbx, 0x2b992ddfa232
jmp 0x14045fc2b
cmp rax, rbx
jmp 0x14045fc33
jne 0x14045fd1b
and qword [rbp + 0x18], 0
movsx ecx, ax
movsxd rcx, r10d
lea rcx, [rbp + 0x18]
jmp 0x14045fc4d
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045fc5c
mov qword [rbp + 0x10], rax
jmp 0x14045fc65
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
stc
test r14b, 0x97
clc
xor qword [rbp + 0x10], rax
jmp 0x14045fc7c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
bt cx, r9w
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x14045fc96
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
sal cl, 0xe9
or rcx, 0x58676c88
lea rcx, [rbp + 0x10]
cmc
clc
test ch, ah
shl rax, 0x20
xor rax, qword [rbp + 0x20]
jmp 0x14045fcbf
xor rax, qword [rbp + 0x10]
rol bp, cl
test r11b, r11b
xor rax, rcx
bts ebp, r9d
add cx, 0x3c7b
movabs rcx, 0xffffffffffff
bts ebp, ecx
and bp, sp
sal rbp, 0x58
and rax, rcx
movabs rcx, 0x2b992ddfa233
sbb ebp, r13d
cmp rax, rbx
movzx ebx, bx
jmp 0x14045fd04
cmove rax, rcx
mov qword [0x1400b7288], rax
add bpl, sil
rcl bpl, 0x93
shrd ebx, r14d, 0x52
mov rbx, qword [rsp + 0x48]
mov bpl, 0xf9
btr ebp, 0xc0
not rax
sub bp, 0x209e
movsx rbp, si
mov qword [0x1400b7280], rax
btr bp, r13w
add rsp, 0x20
sete bpl
movsx ebp, r10w
movzx rbp, bp
pop rbp
jmp 0x14045fd55
ret
Function at 0x14047177d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test bx, 0x3e95
stc
mov qword [rax + 8], rbx
cmp rdx, 0x2c3775a1
cmc
mov qword [rax + 0x10], rbp
sal bpl, 0xaf
movsxd rbp, esp
mov qword [rax + 0x18], rsi
ror bpl, 0xc9
rol rsi, 0xa
sub esi, ebx
mov qword [rax + 0x20], rdi
push r14
add edi, eax
sbb r14b, 0x63
sub rsp, 0x20
mov rdi, qword [rsp + 0x50]
and bp, ax
mov r14, r9
mov rsi, r8
add bpl, 0x1e
bt bp, 0x9c
mov rbp, rdx
test rdi, rdi
jmp 0x1404717dd
je 0x1404718a7
mov rbx, qword [r8 + 8]
clc
test rbx, rbx
jmp 0x1404717f0
je 0x140471889
mov rax, qword [rbx + 0x40]
bswap r8
movzx r8d, word [r14]
cmp qword [rax], 0
je 0x140471858
mov rax, qword [rbx + 0x58]
cmp r9b, 0xe8
jmp 0x140471818
cmp dword [rax], 0
jmp 0x140471820
jle 0x140471858
dec dword [rax]
cbw
cwd
movsxd rax, r13d
mov rcx, qword [rbx + 0x40]
setne ah
mov rdx, qword [rcx]
lea rax, [rdx + 2]
jmp 0x140471842
mov qword [rcx], rax
jmp 0x14047184a
mov word [rdx], r8w
jmp 0x140471853
jmp 0x140471875
mov rax, qword [rbx]
movzx edx, r8w
mov rcx, rbx
mov rax, qword [rax + 0x18]
jmp 0x14047186b
call qword [case.0x1404e588a.0]
movzx r8d, ax
mov eax, 0xffff
cmp ax, r8w
jmp 0x140471883
jne 0x14047188e
mov byte [rsi], 1
cmp bh, bl
add r14, 2
jmp 0x140471898
sub rdi, 1
jmp 0x1404718a1
jne 0x1404717e8
movups xmm0, xmmword [rsi]
mov rbx, qword [rsp + 0x30]
mov rax, rbp
xor r14b, r13b
btr si, 5
mov rsi, qword [rsp + 0x40]
bsf edi, r9d
rcr dil, cl
shl rdi, cl
mov rdi, qword [rsp + 0x48]
jmp 0x1404718d8
movdqu xmmword [rbp], xmm0
movzx r14d, r11w
not r14b
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r14
jmp 0x1404718f4
ret
Function at 0x1404718f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test dil, 0x1b
cmp al, 0x46
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
sbb bpl, 0x9c
shl ebp, 0x17
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
btr si, di
sub r14b, r9b
movzx ebp, sp
sub rsp, 0x20
cmp r10, r12
adc dil, 0x41
shr si, cl
mov rsi, qword [rsp + 0x50]
add bp, bp
and ebp, r13d
movzx r14d, r9w
xchg ebp, edi
cmp r9, rbp
mov rdi, r8
mov rbp, rdx
test rsi, rsi
jmp 0x140471951
je 0x140471a28
mov rbx, qword [r8 + 8]
cmc
test spl, 3
test rbx, rbx
jmp 0x140471968
je 0x140471a0e
mov rax, qword [rbx + 0x40]
cmp qword [rax], 0
jmp 0x14047197b
je 0x1404719d2
mov rax, qword [rbx + 0x58]
cmp r12w, 0x508a
clc
test r14d, 0x4a933136
cmp dword [rax], 0
jle 0x1404719d2
dec dword [rax]
mov rcx, qword [rbx + 0x40]
cbw
movzx eax, bx
cmovne ax, bx
mov rdx, qword [rcx]
jmp 0x1404719b6
lea rax, [rdx + 2]
mov qword [rcx], rax
bswap ax
movzx eax, r14w
mov word [rdx], r14w
jmp 0x1404719cd
jmp 0x1404719fa
mov rax, qword [rbx]
mov cl, r9b
movzx edx, r14w
movsx ecx, si
movzx rcx, dx
mov rcx, rbx
jmp 0x1404719eb
mov rax, qword [rax + 0x18]
jmp 0x1404719f4
call qword [case.0x1404e588a.0]
mov ecx, 0xffff
stc
cmp cx, ax
jmp 0x140471a08
jne 0x140471a19
mov byte [rdi], 1
clc
stc
cmp r8w, 0x1112
sub rsi, 1
jmp 0x140471a22
jne 0x140471960
movups xmm0, xmmword [rdi]
dec si
movsx rbx, r9w
test r8, 0x76205198
mov rbx, qword [rsp + 0x30]
rcl di, 0x7b
or r14, 0x352229f3
bsf r14, rsp
mov rax, rbp
rcr di, cl
xor r14d, edi
mov rsi, qword [rsp + 0x40]
add r14b, sil
ror r14b, 0x6c
mov rdi, qword [rsp + 0x48]
rcl r14b, cl
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
movsxd r14, eax
xchg r14d, r14d
bswap r14d
pop r14
jmp 0x140471a88
ret
Function at 0x140478747
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp r13, 0x52e31161
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
movsx rbp, bp
mov qword [rax + 0x18], rsi
bts rbp, rsi
mov qword [rax + 0x20], rdi
ror bx, cl
push r14
sub rsp, 0x20
mov rsi, r9
mov rbx, r8
movsxd rbp, esi
mov r14, rdx
movsx bp, r15b
bsf bp, r15w
adc rbp, 0x34ce487f
mov rbp, rcx
cmc
test sil, 0x4c
test r9, r9
jmp 0x14047879f
je 0x14047889c
mov rdi, qword [rdx + 8]
cmc
stc
test r8d, r15d
test rdi, rdi
jmp 0x1404787b6
je 0x140478880
mov rax, qword [rdi + 0x40]
inc r8b
movzx r8d, word [rbx]
cmp r13, 0x16f5199c
test r12b, r9b
cmp qword [rax], 0
je 0x14047882e
mov rax, qword [rdi + 0x58]
cmc
cmp ah, dl
cmp dword [rax], 0
jmp 0x1404787ea
jle 0x14047882e
dec dword [rax]
rdtsc
mov dl, 0xfb
movsx dx, r15b
mov rcx, qword [rdi + 0x40]
cdqe
movzx edx, r9w
mov rdx, qword [rcx]
movzx ax, bh
bswap ax
lea rax, [rdx + 2]
jmp 0x140478818
mov qword [rcx], rax
jmp 0x140478820
mov word [rdx], r8w
jmp 0x140478829
jmp 0x140478871
mov rax, qword [rdi]
movsx rdx, cx
movzx rcx, r12w
movzx cx, spl
movzx edx, r8w
bswap cx
setg cl
jmp 0x14047884d
mov rcx, rdi
jmp 0x140478855
mov rax, qword [rax + 0x18]
jmp 0x14047885e
call qword [case.0x1404e588a.0]
movzx r8d, ax
rcl al, cl
sbb al, dil
and ax, 0x5d11
mov eax, 0xffff
cmp ax, r8w
jne 0x140478889
mov byte [r14], 1
jmp 0x140478889
add rbx, 2
sub rsi, 1
jmp 0x140478896
jne 0x1404787ae
movups xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x30]
rcl rsi, 0x77
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
xor bp, dx
add bpl, spl
bts bp, r8w
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
mov r14, 0xae51e69
pop r14
jmp 0x1404788dd
ret