joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406d0298
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
ror r8b, 0x26
inc r8w
dec r8b
mov dword [rsp + 0x10], edx
movzx dx, r15b
xor r8b, sil
mov qword [rsp + 8], rcx
sub rsp, 0x98
cdq
jmp 0x1406d02c6
mov dword [rsp + 0x58], 1
cwd
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
cdq
setno r8b
movss dword [rsp + 0x60], xmm0
movzx cx, bpl
movsx dx, spl
xorps xmm0, xmm0
mov r8w, 0xa918
cmovg r8w, bp
jmp 0x1406d0302
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
bswap dx
movss dword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x6c], xmm0
movzx r8, r12w
setbe dl
xchg r8w, cx
mov dword [rsp + 0x70], 0
setl cl
mov rcx, r15
movsxd r8, r15d
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x78], 0
movzx r8d, bp
mov dword [rsp + 0x7c], 0
movzx ecx, ax
cdq
movzx r8, r11w
mov qword [rsp + 0x80], 0
bswap r8
mov cx, 0x1693
movzx rcx, r15w
mov dword [rsp + 0x88], 0
jmp 0x1406d0384
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
xchg rdx, r8
xorps xmm0, xmm0
movzx rcx, dx
movsx edx, r12w
bswap rcx
movss dword [rsp + 0x28], xmm0
xorps xmm0, xmm0
movsxd rcx, eax
movss dword [rsp + 0x2c], xmm0
movsx rdx, sp
cqo
xorps xmm0, xmm0
cqo
movsxd r8, ebx
movss dword [rsp + 0x30], xmm0
jmp 0x1406d03d3
xorps xmm0, xmm0
not ch
jmp 0x1406d03e1
movss dword [rsp + 0x34], xmm0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
mov dl, bpl
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
not cl
mov edx, r12d
mov qword [rsp + 0x48], 0
seta cl
not dx
movzx edx, r8w
mov dword [rsp + 0x50], 0
jmp 0x1406d0436
lea r8, [rsp + 0x58]
movsxd rcx, esi
mov edx, dword [rsp + 0xa8]
movzx cx, r11b
movsx ecx, ax
movzx rcx, dx
mov rcx, qword [rsp + 0xa0]
jmp 0x1406d045e
call fcn.1406cdf4a
test eax, eax
jmp 0x1406d046a
je 0x1406d050f
movsxd rax, dword [rsp + 0x88]
movzx rcx, cx
add cl, sil
or ch, 0x8b
imul rax, rax, 0xe
setle ch
not cl
mov rcx, rax
jmp 0x1406d0493
call fcn.14069906f
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], rax
cdq
movsx cx, spl
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
cmovs rdx, rcx
cdq
lea r8, [rsp + 0x20]
movsxd rdx, r13d
cdq
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
jmp 0x1406d04db
call fcn.1406cdf4a
test eax, eax
jmp 0x1406d04e7
je 0x1406d050f
xor eax, eax
clc
cmp r13w, ax
test eax, eax
jmp 0x1406d04fb
jne 0x1406d04ed
mov eax, dword [rsp + 0x50]
jmp 0x1406d050a
jmp 0x1406d0525
mov rax, qword [rsp + 0xb0]
cmp r11, rbx
cmc
clc
mov qword [rax], 0
xor eax, eax
add rsp, 0x98
jmp 0x1406d0531
ret
Function at 0x1406d0532
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
or r8b, al
sar r8b, cl
mov dword [rsp + 0x10], edx
cmp r11b, 0x1d
sbb r8b, 0x2a
btc edx, ecx
mov qword [rsp + 8], rcx
cmp spl, 0x1f
sub rsp, 0x78
cdq
not r8b
movsx rcx, cx
mov dword [rsp + 0x38], 1
movzx dx, r12b
mov dword [rsp + 0x3c], 0
movsx dx, r12b
xorps xmm0, xmm0
mov r8, rax
jmp 0x1406d058f
movss dword [rsp + 0x40], xmm0
movsx r8d, r13w
movsx cx, spl
movzx edx, r13w
xorps xmm0, xmm0
movzx cx, dil
mov r8b, 0xae
xchg r8b, dl
movss dword [rsp + 0x44], xmm0
jmp 0x1406d05c3
xorps xmm0, xmm0
movsxd rdx, edx
xchg r8b, dl
movss dword [rsp + 0x48], xmm0
xorps xmm0, xmm0
movsx dx, r14b
mov ecx, 0x34110b0b
mov cl, bpl
movss dword [rsp + 0x4c], xmm0
cqo
setno dl
movzx ecx, bp
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 0
mov ch, 0x20
xchg r8, rcx
mov dword [rsp + 0x58], 0
movsx dx, dil
jmp 0x1406d061a
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x60], 0
movzx rdx, r13w
mov dword [rsp + 0x68], 0
not r8w
mov r8d, ebx
movzx rcx, r11w
lea r8, [rsp + 0x38]
sete dh
mov edx, dword [rsp + 0x88]
jmp 0x1406d065f
mov rcx, qword [rsp + 0x80]
jmp 0x1406d066c
call fcn.1406cdf4a
mov dword [rsp + 0x20], eax
stc
test r9d, esp
test r14, 0x108d641e
cmp qword [rsp + 0x90], 0
jmp 0x1406d068e
je 0x1406d06e9
cmp dword [rsp + 0x20], 0
jmp 0x1406d069e
je 0x1406d06bb
mov eax, dword [rsp + 0x50]
jmp 0x1406d06ad
mov dword [rsp + 0x24], eax
jmp 0x1406d06b6
jmp 0x1406d06c7
mov dword [rsp + 0x24], 0
sal ax, 0xba
mov rax, qword [rsp + 0x90]
btr cx, 0x9a
mov ecx, dword [rsp + 0x24]
cmp r13b, 0x81
jmp 0x1406d06e1
mov dword [rax], ecx
jmp 0x1406d06e9
cmp qword [rsp + 0x98], 0
jmp 0x1406d06f7
je 0x1406d0749
cmp dword [rsp + 0x20], 0
je 0x1406d071f
mov eax, dword [rsp + 0x58]
jmp 0x1406d0711
mov dword [rsp + 0x28], eax
jmp 0x1406d071a
jmp 0x1406d072e
mov dword [rsp + 0x28], 0
rcr ah, cl
bsf cx, r15w
mov rax, qword [rsp + 0x98]
cmp esi, ebp
xor cx, bp
add rcx, rsp
mov ecx, dword [rsp + 0x28]
cmp bx, 0x69ba
mov dword [rax], ecx
cmp qword [rsp + 0xa0], 0
je 0x1406d0797
cmp dword [rsp + 0x20], 0
je 0x1406d0775
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x2c], eax
jmp 0x1406d0770
jmp 0x1406d0783
mov dword [rsp + 0x2c], 0
rol ah, 0x14
xor ch, 6
mov rax, qword [rsp + 0xa0]
neg cl
mov ecx, dword [rsp + 0x2c]
mov dword [rax], ecx
stc
cmp r13b, spl
cmp qword [rsp + 0xa8], 0
je 0x1406d07ea
cmp dword [rsp + 0x20], 0
jmp 0x1406d07b0
je 0x1406d07cd
mov eax, dword [rsp + 0x5c]
jmp 0x1406d07bf
mov dword [rsp + 0x30], eax
jmp 0x1406d07c8
jmp 0x1406d07d5
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0xa8]
setne ch
ror cl, cl
mov ecx, dword [rsp + 0x30]
stc
cmc
mov dword [rax], ecx
cmp dword [rsp + 0x20], 0
jmp 0x1406d07f4
je 0x1406d080c
mov eax, dword [rsp + 0x68]
jmp 0x1406d0803
mov dword [rsp + 0x34], eax
jmp 0x1406d0814
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
cmp bx, r14w
clc
add rsp, 0x78
jmp 0x1406d0826
ret
Function at 0x1406e2648
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 0x20], r9d
dec rax
and ax, r11w
btc rax, r11
mov qword [rsp + 0x18], r8
cwde
mov qword [rsp + 0x10], rdx
sal rax, cl
mov qword [rsp + 8], rcx
btc eax, r8d
setnp ah
sar ax, cl
sub rsp, 0x88
mov eax, dword [rsp + 0xa8]
cmp r14, r11
and eax, 0xff000000
clc
cmp r12d, r8d
test eax, eax
jmp 0x1406e2696
jne 0x1406e26a1
jmp 0x1406e28d9
movss xmm0, dword [0x1400c0960]
sub cx, 0xe0a5
add ax, dx
movss dword [rsp + 0x50], xmm0
bts rcx, r8
inc ah
movsxd rdx, edx
movss xmm0, dword [0x1400c0960]
neg edx
movzx ax, r15b
movss dword [rsp + 0x54], xmm0
mov rax, qword [rsp + 0x98]
sbb dh, 0x2e
sar ecx, 0
sub dx, r11w
movss xmm0, dword [rax + 4]
rol ah, 3
addss xmm0, dword [rsp + 0x54]
adc eax, 0x8130d939
movss dword [rsp + 0x38], xmm0
mov rax, qword [rsp + 0x98]
shr cl, 0x15
neg cl
movss xmm0, dword [rax]
addss xmm0, dword [rsp + 0x50]
sbb dx, 0xf03
movss dword [rsp + 0x30], xmm0
cwd
btc dx, 0x31
or ah, 0x16
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x60], xmm0
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x64], xmm0
mov rax, qword [rsp + 0x90]
cqo
add rax, 0x80
cqo
mov cl, sil
mov qword [rsp + 0x70], rax
movzx cx, sil
cwd
cqo
lea rdx, [rsp + 0x60]
movsx ecx, bp
mov rcx, qword [rsp + 0x70]
jmp 0x1406e2779
call fcn.1406c4414
movss xmm0, dword [0x1400c0960]
movss dword [rsp + 0x58], xmm0
bswap dx
bts ecx, r13d
test bx, 0xdeb5
movss xmm0, dword [0x1400c0960]
cmp r8w, r8w
movss dword [rsp + 0x5c], xmm0
mov dh, dh
shr edx, 0xc
mov rax, qword [rsp + 0xa0]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x5c]
btc cx, 0x14
rdtsc
movss dword [rsp + 0x48], xmm0
mov rax, qword [rsp + 0xa0]
sal ch, 0x3e
rcr cl, cl
movss xmm0, dword [rax]
addss xmm0, dword [rsp + 0x58]
cdqe
movss dword [rsp + 0x40], xmm0
cbw
setne ch
movss xmm0, dword [rsp + 0x40]
ror al, 0x29
movss dword [rsp + 0x68], xmm0
sar rcx, 0x25
shld rax, r14, 0xb5
shl al, 0x28
movss xmm0, dword [rsp + 0x48]
cmovp ax, r9w
movss dword [rsp + 0x6c], xmm0
test r13b, 0x3a
mov rax, qword [rsp + 0x90]
bts rcx, r10
add rax, 0x80
movzx dx, r12b
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x68]
not rcx
jmp 0x1406e284c
mov rcx, qword [rsp + 0x78]
jmp 0x1406e2856
call fcn.1406c4414
movss xmm0, dword [rsp + 0xb0]
movss dword [rsp + 0x28], xmm0
movzx rdx, r9w
cqo
rdtsc
mov byte [rsp + 0x20], 0
mov r9d, dword [rsp + 0xa8]
mov rax, qword [rsp + 0x90]
cmovge dx, r11w
mov dx, 0x76b9
not r8d
mov r8d, dword [rax + 0x80]
movzx cx, dl
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax + 0x88]
mov rcx, qword [rsp + 0x90]
jmp 0x1406e28ba
call fcn.1406dcbdc
mov rax, qword [rsp + 0x90]
mov dword [rax + 0x80], 0
test rsi, 0x54a73cbf
stc
add rsp, 0x88
jmp 0x1406e28e5
ret
Function at 0x1406e551a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
ror eax, 0xa7
mov qword [rsp + 0x18], r8
btr eax, 0xa4
movsx eax, si
rol al, 0x14
mov qword [rsp + 0x10], rdx
movsx eax, r11w
cmovae rax, rsi
cwde
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov ax, dx
mov rax, qword [rsp + 0x60]
clc
stc
cmp qword [rax + 0x20], 0
jmp 0x1406e555c
jne 0x1406e5741
mov qword [rsp + 0x38], 0
test r9b, 0x19
mov qword [rsp + 0x20], 0
xor r9d, r9d
movsx edx, di
sub r8d, r8d
lea rdx, [rsp + 0x38]
cmovbe rcx, rcx
xchg ch, ch
movzx ecx, bx
mov rcx, qword [rsp + 0x60]
jmp 0x1406e5599
call fcn.1406e53cd
cmp qword [rsp + 0x38], 0
je 0x1406e5741
mov rax, qword [rsp + 0x60]
rol ecx, 0xbc
btc rcx, 9
movzx rcx, dx
movsxd rax, dword [rax + 0x28]
bts cx, r14w
btc rcx, rdx
btr rcx, r12
mov rcx, qword [rsp + 0x60]
cmp r12d, 0xbc30b638
cmp cl, cl
movsxd rcx, dword [rcx + 0x2c]
imul rax, rcx
cmp ah, 0x99
shl rax, 2
movzx cx, r10b
mov rcx, rax
jmp 0x1406e55f6
call fcn.14069906f
mov rcx, qword [rsp + 0x60]
clc
mov qword [rcx + 0x20], rax
bt rcx, 2
movsxd rax, r9d
rcl al, 0
mov rax, qword [rsp + 0x38]
sar ecx, 0x88
movsxd rcx, r12d
bswap cx
mov qword [rsp + 0x40], rax
and al, 0
movzx cx, sil
shrd rax, r15, 0x9d
mov rax, qword [rsp + 0x60]
adc rcx, 0xffffffffab885605
sub ch, 0xb9
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x48], rax
btr ax, 0x1e
bswap rax
mov rax, qword [rsp + 0x60]
sar ecx, cl
sal cx, 0x11
mov rcx, qword [rsp + 0x60]
mov eax, dword [rax + 0x28]
cmp r13w, 0xc82f
cmc
imul eax, dword [rcx + 0x2c]
jmp 0x1406e5672
mov dword [rsp + 0x30], eax
jmp 0x1406e567b
jmp 0x1406e5696
mov eax, dword [rsp + 0x30]
jmp 0x1406e5689
dec eax
cmc
mov dword [rsp + 0x30], eax
jmp 0x1406e5696
cmp dword [rsp + 0x30], 0
jmp 0x1406e56a0
jle 0x1406e5741
mov rax, qword [rsp + 0x40]
movsx ecx, r10w
movzx eax, byte [rax]
jmp 0x1406e56bb
mov dword [rsp + 0x34], eax
setno al
movzx cx, sil
mov rax, qword [rsp + 0x40]
bswap cx
inc ecx
seta cl
inc rax
movsxd rcx, ebx
mov qword [rsp + 0x40], rax
xadd ax, cx
btc ax, 0x16
mov eax, dword [rsp + 0x34]
btc cx, r10w
rcr cl, cl
shl eax, 0x18
movzx ecx, bp
add ch, 0x8d
movzx cx, r10b
or eax, 0xff0000
clc
bswap ecx
or eax, 0xff00
or eax, 0xff
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
btc eax, r10d
cbw
bt rax, r8
mov rax, qword [rsp + 0x48]
add rax, 4
jmp 0x1406e5732
mov qword [rsp + 0x48], rax
jmp 0x1406e573c
jmp 0x1406e5680
mov rax, qword [rsp + 0x68]
cmovge cx, ax
setp ch
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x20]
clc
mov qword [rax], rcx
cmp qword [rsp + 0x70], 0
je 0x1406e577d
mov rax, qword [rsp + 0x70]
mov cx, 0xed80
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x28]
stc
cmc
mov dword [rax], ecx
stc
clc
cmp qword [rsp + 0x78], 0
jmp 0x1406e5788
je 0x1406e57b7
mov rax, qword [rsp + 0x78]
xor cx, 0xda92
mov rcx, qword [rsp + 0x60]
jmp 0x1406e57a5
mov ecx, dword [rcx + 0x2c]
stc
jmp 0x1406e57b1
mov dword [rax], ecx
cmp r11b, sil
clc
cmp qword [rsp + 0x80], 0
jmp 0x1406e57c5
je 0x1406e57db
mov rax, qword [rsp + 0x80]
cmc
clc
mov dword [rax], 4
add rsp, 0x58
jmp 0x1406e57e4
ret
Function at 0x1406f2a2b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
sar eax, 0x32
rol ax, cl
mov dword [rsp + 0x10], edx
neg ax
mov eax, 0x1fac9515
mov qword [rsp + 8], rcx
sub al, 0xb7
sal eax, 0x39
sub rsp, 0x38
adc al, r13b
bts ax, bx
mov rax, qword [rsp + 0x40]
cmp bl, dil
mov eax, dword [rax + 4]
cmp dword [rsp + 0x48], eax
jmp 0x1406f2a6b
jle 0x1406f2b3b
mov rax, qword [rsp + 0x40]
cmp edx, r9d
cmp dword [rax + 4], 0
jmp 0x1406f2a82
je 0x1406f2ad0
mov rax, qword [rsp + 0x40]
movsxd rdx, r8d
mov eax, dword [rax + 4]
neg dx
test r8w, si
rol cl, cl
cdq
cmc
ror cl, cl
mov cx, 0x241c
sub eax, edx
xor ch, 0xa8
sar eax, 1
not cl
mov rcx, qword [rsp + 0x40]
test r12b, r12b
stc
test r13b, 0xbf
add eax, dword [rcx + 4]
jmp 0x1406f2ac2
mov dword [rsp + 0x24], eax
jmp 0x1406f2acb
jmp 0x1406f2ae0
mov dword [rsp + 0x24], 8
sar ax, 0x8e
movzx ax, dh
mov eax, dword [rsp + 0x24]
cmp r8b, 0x17
mov dword [rsp + 0x28], eax
shl rax, 0xba
mov eax, dword [rsp + 0x48]
cmc
cmp dword [rsp + 0x28], eax
jmp 0x1406f2afe
jle 0x1406f2b11
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x2c], eax
jmp 0x1406f2b27
mov eax, dword [rsp + 0x48]
setl dh
movsx ecx, r10w
mov dword [rsp + 0x2c], eax
movzx edx, r11w
setp dl
mov edx, dword [rsp + 0x2c]
bswap ecx
movzx rcx, r10w
mov rcx, qword [rsp + 0x40]
call fcn.1406c54fb
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
cmp bpl, 0xc
cmp dword [rsp + 0x48], eax
jmp 0x1406f2b4f
jle 0x1406f2bd2
mov rax, qword [rsp + 0x40]
jmp 0x1406f2b5f
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
jmp 0x1406f2b6a
jmp 0x1406f2b84
mov eax, dword [rsp + 0x20]
jmp 0x1406f2b78
inc eax
mov dword [rsp + 0x20], eax
movzx eax, si
rol eax, 0x28
mov eax, dword [rsp + 0x48]
test r14b, r15b
cmc
cmp dword [rsp + 0x20], eax
jmp 0x1406f2b95
jge 0x1406f2bd2
movsxd rax, dword [rsp + 0x20]
jmp 0x1406f2bac
mov rcx, qword [rsp + 0x40]
cqo
mov rcx, qword [rcx + 8]
mov dh, al
mov rdx, qword [rsp + 0x50]
jmp 0x1406f2bc3
mov edx, dword [rdx]
jmp 0x1406f2bca
mov dword [rcx + rax*4], edx
jmp 0x1406f2b6f
mov rax, qword [rsp + 0x40]
and ecx, r11d
mov ecx, dword [rsp + 0x48]
cmc
clc
test al, r11b
mov dword [rax], ecx
clc
cmp dil, r10b
add rsp, 0x38
jmp 0x1406f2bf2
ret
Function at 0x1407032d6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x20], r9b
btc ax, r14w
bts rax, rdi
movzx eax, sp
movss dword [rsp + 0x18], xmm2
shr al, cl
bts ax, di
adc ax, 0x8030
mov dword [rsp + 0x10], edx
sub rax, 0x78349f9e
movzx eax, r9w
mov qword [rsp + 8], rcx
not ah
rol ah, cl
push rdi
sub rsp, 0x10
movsx ax, r10b
mov rax, qword [rsp + 0x20]
xorps xmm0, xmm0
jmp 0x140703326
movss dword [rax + 8], xmm0
mov ax, 0x77ab
xor al, 8
mov rax, qword [rsp + 0x20]
stc
cmp bl, r14b
xorps xmm0, xmm0
movss dword [rax + 4], xmm0
bt eax, 0xb0
movsx rax, si
btc ax, 0xb4
mov rax, qword [rsp + 0x20]
clc
test r15d, r13d
movss xmm0, dword [rsp + 0x30]
movss dword [rax], xmm0
and ax, 0x6194
not rax
xadd al, al
movzx eax, byte [rsp + 0x38]
cmc
test eax, eax
je 0x1407033ab
mov rax, qword [rsp + 0x20]
rol cx, cl
xadd cx, cx
add rax, 0x18
mov rdi, rax
movsx ecx, dx
rcl ch, 0x3e
xor eax, eax
movsx cx, r9b
mov ecx, 0xc
jmp 0x1407033a4
rep stosb byte [rdi], al
jmp 0x1407033ab
mov dword [rsp], 0
jmp 0x1407033b7
jmp 0x1407033ce
mov eax, dword [rsp]
jmp 0x1407033c4
inc eax
test r8b, 0xa2
stc
mov dword [rsp], eax
cmp dword [rsp], 3
jmp 0x1407033d7
jge 0x1407034f2
cmp dword [rsp], 0
jmp 0x1407033e6
jle 0x140703448
movsxd rax, dword [rsp]
movsx ecx, r12w
mov rcx, qword [rsp + 0x20]
jmp 0x1407033fe
xorps xmm0, xmm0
jmp 0x140703406
comiss xmm0, dword [rcx + rax*4 + 0x18]
jae 0x140703448
mov rax, qword [rsp + 0x20]
mov rcx, 0xffffffffffa20c20
mov ecx, r14d
mov rcx, qword [rsp + 0x20]
movss xmm0, dword [rax + 4]
cmovl ax, r9w
lahf
addss xmm0, dword [rcx]
movzx eax, r8w
cmovae eax, r14d
mov rax, qword [rsp + 0x20]
movss dword [rax + 4], xmm0
cdqe
mov rax, qword [rsp + 0x20]
jmp 0x140703452
cvttss2si eax, dword [rax + 4]
cvtsi2ss xmm0, eax
movsxd rax, dword [rsp]
movsx rcx, bx
setl ch
jmp 0x14070346b
mov rcx, qword [rsp + 0x20]
cwd
movss dword [rcx + rax*4 + 0xc], xmm0
movsxd rax, dword [rsp]
movzx rcx, r9w
movsx rdx, r8w
mov rcx, qword [rsp + 0x20]
movsx edx, bp
not dl
cmovp edx, r15d
mov rdx, qword [rsp + 0x20]
jmp 0x14070349c
movss xmm0, dword [rcx + 4]
setp cl
movzx cx, dh
addss xmm0, dword [rdx + rax*4 + 0x18]
movsxd rcx, eax
cwde
mov rax, qword [rsp + 0x20]
bswap cx
seto ch
movss dword [rax + 4], xmm0
movsx eax, r11w
cbw
lahf
movsxd rax, dword [rsp]
movsxd rcx, edi
mov rcx, qword [rsp + 0x20]
jmp 0x1407034da
xorps xmm0, xmm0
jmp 0x1407034e2
movss dword [rcx + rax*4 + 0x18], xmm0
jmp 0x1407034ed
jmp 0x1407033bc
add rsp, 0x10
movzx di, r8b
movzx rdi, r9w
pop rdi
jmp 0x140703505
ret
Function at 0x14070529c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [rsp + 0x10], edx
test r14w, di
movzx r8d, bx
mov qword [rsp + 8], rcx
sub rsp, 0x88
cwd
mov eax, dword [rsp + 0x98]
movzx r8, r15w
xchg dx, cx
mov dword [rsp + 0x60], eax
bswap ax
rdtsc
cmovle r8w, r12w
mov dword [rsp + 0x64], 0
movzx r9, bx
mov qword [rsp + 0x50], 0
bswap edx
mov qword [rsp + 0x48], 0
rdtsc
movzx ax, r13b
mov qword [rsp + 0x40], 0
cbw
mov qword [rsp + 0x38], 0
xchg edx, r9d
cwde
cbw
mov qword [rsp + 0x30], 0
movsx edx, dx
setne ch
cwde
mov qword [rsp + 0x28], 0
xchg cl, r9b
cbw
mov qword [rsp + 0x20], 0
bswap dx
mov r9, qword [rsp + 0x60]
xchg cx, ax
mov dl, 8
rdtsc
mov r8d, 0x18
bswap rdx
cdqe
cdq
mov rax, qword [rsp + 0x90]
movzx rcx, r10w
mov dx, 0xa13f
mov edx, dword [rax + 8]
cwde
xchg al, al
mov rax, qword [rsp + 0x90]
movsx rcx, di
mov cl, dil
mov cx, 0x68b7
mov rcx, qword [rax]
jmp 0x140705385
call fcn.140683a16
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
neg ah
movsx eax, bp
mov rax, qword [rsp + 0x70]
add rsp, 0x88
jmp 0x1407053af
ret

Function at 0x1407056ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x20], r9
movsx eax, r15w
jmp 0x140705706
mov qword [rsp + 0x18], r8
shld r9w, cx, 0xbc
movzx r9d, r11w
mov dword [rsp + 0x10], edx
add r9w, 0xa881
clc
or dl, r9b
mov qword [rsp + 8], rcx
btr r9w, 0x82
bswap ax
rdtsc
sub rsp, 0x88
bswap r8w
cwd
mov eax, dword [rsp + 0x98]
movsx r8, si
movsxd rcx, r13d
movsx dx, ah
mov dword [rsp + 0x60], eax
cwd
movzx r8, r12w
mov dword [rsp + 0x64], 0
cdq
mov qword [rsp + 0x50], 0
movzx cx, bl
cqo
lahf
mov qword [rsp + 0x48], 0
setg dl
cwde
lahf
mov qword [rsp + 0x40], 0
rdtsc
mov qword [rsp + 0x38], 0
rdtsc
mov rcx, 0x1bb5b40e
movsx ax, al
mov qword [rsp + 0x30], 0
rdtsc
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
movzx rcx, si
movzx eax, r9w
movsxd r8, r14d
mov rax, qword [rsp + 0xa0]
movsx rdx, ax
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8d, 0x22
movsx rdx, r15w
cwde
movzx cx, r15b
mov rax, qword [rsp + 0x90]
not ecx
cqo
mov edx, dword [rax + 8]
mov rax, qword [rsp + 0x90]
movsx cx, ch
bswap ecx
mov rcx, qword [rax]
jmp 0x140705812
call fcn.140683a16
mov qword [rsp + 0x68], rax
btr eax, 0xa8
sbb al, 3
bts rax, r8
mov rax, qword [rsp + 0x68]
clc
jmp 0x140705832
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x70]
jmp 0x140705846
add rsp, 0x88
ret
Function at 0x140707777
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
rcr al, cl
cwde
adc r8, 0x1f2bc688
mov r8, rcx
not ax
movzx ax, spl
mov eax, 0x5a4d
jmp 0x1407077a1
cmp word [0x140000000], ax
jmp 0x1407077ad
jne 0x1407078af
movsxd rcx, dword [0x14000003c]
bsr dx, r9w
adc rdx, r10
lea rdx, [0x140000000]
lea rcx, [rcx + rdx]
test r14b, 0x8f
stc
test r8b, dl
cmp dword [rcx], 0x4550
jmp 0x1407077e0
jne 0x1407078af
mov eax, 0x20b
cmc
cmp word [rcx + 0x18], ax
jmp 0x1407077f5
jne 0x1407078af
sub r8, rdx
or ah, 0x29
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
lea rdx, [rdx + rax]
xor al, 0x26
movzx eax, word [rcx + 6]
sal r9, 0xa1
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
jmp 0x140707828
mov qword [rsp], rdx
stc
cmp rdx, r9
je 0x140707871
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x140707841
jb 0x140707863
mov eax, dword [rdx + 8]
cmp r8d, r10d
cmc
add eax, ecx
jmp 0x140707855
cmp r8, rax
jmp 0x14070785d
jb 0x140707878
add rdx, 0x28
jmp 0x14070786c
jmp 0x140707828
xor edx, edx
jmp 0x140707878
test rdx, rdx
jne 0x14070788d
sub al, al
jmp 0x140707888
jmp 0x1407078c2
cmp dword [rdx + 0x24], 0
jmp 0x140707896
jge 0x1407078a8
sub al, al
jmp 0x1407078a3
jmp 0x1407078c2
mov al, 1
jmp 0x1407078c2
xor al, al
jmp 0x1407078b6
jmp 0x1407078c2
add rsp, 0x18
jmp 0x1407078cb
ret
Function at 0x14070b6b5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
movsx eax, bx
movsx di, spl
mov eax, edx
mov dil, 0x31
mov rdi, rcx
movzx cx, al
movsx rcx, bp
mov rcx, r8
jmp 0x14070b6a0
rep stosb byte [rdi], al
lahf
mov rax, r11
movzx di, al
setbe dil
pop rdi
jmp 0x14070b6b4
ret
mov r11, rcx
sar r9b, 0x8e
stc
cmp cl, r9b
movzx edx, dl
stc
bswap r9
movabs r9, 0x101010101010101
stc
cmc
imul r9, rdx
cmp r8, 0x10
jmp 0x14070b6e0
jbe 0x14070b86d
movq xmm0, r9
punpcklbw xmm0, xmm0
cmp r8, 0x80
jmp 0x14070b6fb
ja 0x14070b706
jmp 0x14070b7ce
test byte [0x1400ca5a8], 2
jmp 0x14070b712
jne 0x14070b67f
movups xmmword [rcx], xmm0
add r8, rcx
xor r9d, ebx
add rcx, 0x10
bts r9, rdx
test dil, 0x18
adc r9b, r15b
and rcx, 0xfffffffffffffff0
movzx r9w, r15b
btc r9w, r9w
sub r8, rcx
rol r9b, cl
clc
mov r9, r8
jmp 0x14070b754
shr r9, 7
je 0x14070b7ce
cmp r9, qword [0x1400c9040]
ja 0x14070b823
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x10], xmm0
cmp rbx, rcx
stc
add rcx, 0x80
jmp 0x14070b782
movaps xmmword [rcx - 0x60], xmm0
jmp 0x14070b78b
movaps xmmword [rcx - 0x50], xmm0
dec r9
jmp 0x14070b797
movaps xmmword [rcx - 0x40], xmm0
jmp 0x14070b7a0
movaps xmmword [rcx - 0x30], xmm0
jmp 0x14070b7a9
movaps xmmword [rcx - 0x20], xmm0
jmp 0x14070b7b2
movapd xmmword [rcx - 0x10], xmm0
jne 0x14070b76b
and r8, 0x7f
btc r9w, 0x36
mov r9, 0xffffffffc51b56a8
mov r9, r8
test sil, bpl
shr r9, 4
je 0x14070b809
nop dword [rax]
test r13b, bpl
cmp r12b, r14b
movups xmmword [rcx], xmm0
stc
cmp r8b, r14b
add rcx, 0x10
jmp 0x14070b7fb
dec r9
jmp 0x14070b803
jne 0x14070b7eb
and r8, 0xf
jmp 0x14070b812
je 0x14070b81f
movups xmmword [rcx + r8 - 0x10], xmm0
lahf
mov rax, r11
ret
movntps xmmword [rcx], xmm0
movntps xmmword [rcx + 0x10], xmm0
add rcx, 0x80
jmp 0x14070b836
movntps xmmword [rcx - 0x60], xmm0
movntps xmmword [rcx - 0x50], xmm0
dec r9
jmp 0x14070b846
movntps xmmword [rcx - 0x40], xmm0
movntps xmmword [rcx - 0x30], xmm0
movntps xmmword [rcx - 0x20], xmm0
movntps xmmword [rcx - 0x10], xmm0
jne 0x14070b823
sfence
and r8, 0x7f
jmp 0x14070b868
jmp 0x14070b7ce
mov rdx, r9
rcr r9, cl
sar ah, 0x27
lea r9, [0x140000000]
mov eax, dword [r9 + r8*4 + 0xd10b0]
lea r9, [r9 + rax]
ror al, cl
add rcx, r8
mov rax, r11
jmp 0x14070b896
jmp r9
Function at 0x14071e52d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rax, rsp
test bpl, 0x93
test r14b, r11b
clc
mov qword [rax + 0x10], rbx
btr ebx, 0x3a
mov qword [rax + 0x18], rsi
sbb sil, r11b
stc
rcl sil, cl
push rdi
btr si, r8w
ror di, cl
sub rsp, 0x20
not bl
movsx edi, byte [rsp + 0x58]
movzx ebx, di
mov rsi, r9
movzx rbx, sp
mov byte [rax + 0x30], dil
not bh
mov rbx, rcx
jmp 0x14071e577
mov byte [rax + 0x31], 0
jmp 0x14071e580
call fcn.14072963d
movzx edx, dil
clc
stc
cmp word [rax + rdx*2], 0
jmp 0x14071e595
jge 0x14071e5e2
mov rax, qword [rbx + 0x18]
cmp rax, qword [rbx + 0x10]
jmp 0x14071e5a8
jne 0x14071e5ba
mov cl, 0xff
jmp 0x14071e5b5
jmp 0x14071e5d7
mov cl, byte [rax]
inc rax
xchg r9w, r9w
cmovl r9d, eax
cwd
mov qword [rbx + 0x18], rax
bswap rax
rdtsc
jmp 0x14071e5d7
mov byte [rsp + 0x59], cl
setg dh
rdtsc
cdqe
mov r9, qword [rbx + 0x78]
lea rdx, [rsp + 0x58]
jmp 0x14071e5f3
mov eax, 0x3f
lea rcx, [rsp + 0x30]
not r8b
movsx r8, r12w
mov word [rsp + 0x30], ax
xchg ah, al
lahf
movsx rax, r10w
mov rax, qword [r9]
movsx r8w, r11b
movsxd r8, dword [rax + 8]
call fcn.140724436
mov rax, qword [rsi]
xor bx, bp
mov bh, 0xa5
mov rbx, qword [rsp + 0x38]
jmp 0x14071e63a
mov word [rax], di
mov rax, qword [rsp + 0x50]
add qword [rsi], 2
jmp 0x14071e652
mov rsi, qword [rsp + 0x40]
not edi
movsx edi, r10w
jmp 0x14071e662
dec qword [rax]
mov al, 1
test bpl, 0xac
xadd dil, dil
sub rdi, r13
add rsp, 0x20
movzx rdi, bp
pop rdi
ret