joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403e6cf4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
cmp r15, 0x3095531a
mov qword [rsp + 8], rcx
sub rsp, 0x38
lahf
not cl
cmovp ax, r10w
mov eax, dword [rsp + 0x48]
jmp 0x1403e6d1e
mov rcx, qword [rsp + 0x40]
jmp 0x1403e6d28
lea rax, [rcx + rax + 4]
movsx rcx, r15w
movsx cx, r11b
bswap cx
mov rcx, rax
call fcn.140057416
movzx eax, ax
clc
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x48]
clc
add eax, 0xc
jmp 0x1403e6d56
mov dword [rsp + 0x2c], eax
jmp 0x1403e6d5f
mov dword [rsp + 0x24], 0
jmp 0x1403e6d6c
jmp 0x1403e6d85
mov eax, dword [rsp + 0x24]
jmp 0x1403e6d7a
inc eax
cmp r10, r13
mov dword [rsp + 0x24], eax
and al, bh
mov eax, dword [rsp + 0x28]
cmc
cmp dword [rsp + 0x24], eax
jmp 0x1403e6d93
jge 0x1403e6faf
imul eax, dword [rsp + 0x24], 0x10
sal ch, 0x2c
mov ecx, dword [rsp + 0x2c]
sar edx, 0xb0
sbb dl, 0xe
add ecx, eax
cmc
btr ax, di
mov eax, ecx
shrd cx, sp, 0x84
sub cl, ah
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov rcx, 0xffffffffe718382a
cmc
mov rcx, qword [rsp + 0x40]
xadd dh, dh
sbb dl, 0xa9
rcr dl, cl
lea rcx, [rcx + rax]
btr dx, ax
sar dx, cl
mov rax, rcx
shl dl, cl
sbb dl, bpl
mov ecx, 1
btc dx, si
clc
sar edx, cl
imul rcx, rcx, 0
sbb dh, bl
xchg edx, edx
sbb rdx, 0xffffffffd11a1b82
movzx eax, byte [rax + rcx]
bt cx, 0xe
mov ecx, 1
xor rdx, 0xffffffffca36db2c
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
cmp r14b, 2
jmp 0x1403e6e2d
movsx ecx, byte [rdx + rcx]
test ax, r13w
cmp eax, ecx
jmp 0x1403e6e3c
jne 0x1403e6faa
mov eax, dword [rsp + 0x20]
bsr ecx, r10d
sar cx, 0xab
mov rcx, qword [rsp + 0x40]
sbb dx, 0x9d02
add rcx, rax
mov rax, rcx
and cl, dil
add dx, 0x6b18
mov ecx, 1
mov rdx, 0x26289711
xchg dl, dh
imul rcx, rcx, 1
sbb dl, dh
movzx eax, byte [rax + rcx]
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x50]
test r11w, 0x4e21
stc
movsx ecx, byte [rdx + rcx]
cmp eax, ecx
jmp 0x1403e6e9e
jne 0x1403e6faa
mov eax, dword [rsp + 0x20]
sal cx, 0xb9
mov rcx, qword [rsp + 0x40]
test ah, 0x8f
ror dh, cl
add rcx, rax
shl ah, 0x1d
mov rax, rcx
mov ecx, 1
movsx edx, r15w
sar dl, 0x3a
mov dl, r13b
imul rcx, rcx, 2
shr dl, 0x82
rcl dl, 0xbe
bsf dx, r14w
movzx eax, byte [rax + rcx]
bsf dx, dx
sar cx, 0x2e
test bp, 0x2e8c
mov ecx, 1
sub dl, 0x33
cmp r9b, cl
bsr edx, r14d
imul rcx, rcx, 2
add edx, r13d
cwd
xchg edx, edx
mov rdx, qword [rsp + 0x50]
movsx ecx, byte [rdx + rcx]
clc
test r11, rcx
cmp eax, ecx
jmp 0x1403e6f1c
jne 0x1403e6faa
mov eax, dword [rsp + 0x20]
not dh
mov rcx, qword [rsp + 0x40]
shr dx, 0xb2
shl edx, 0xa8
lea rcx, [rcx + rax]
sal dh, cl
shr dx, cl
mov rax, rcx
shl ch, 0xb
cwd
mov ecx, 1
bt rdx, r13
sal edx, 0xae
imul rcx, rcx, 3
bswap edx
sub rdx, rbx
movzx eax, byte [rax + rcx]
mov ecx, 1
xchg dl, dh
imul rcx, rcx, 3
rcr edx, cl
mov rdx, qword [rsp + 0x50]
clc
movsx ecx, byte [rdx + rcx]
cmp eax, ecx
jmp 0x1403e6f7c
jne 0x1403e6faa
mov eax, dword [rsp + 0x20]
movsx cx, sil
mov rcx, qword [rsp + 0x40]
jmp 0x1403e6f95
lea rax, [rcx + rax + 8]
mov cl, r9b
mov rcx, rax
call fcn.1400504d1
jmp 0x1403e6fb5
jmp 0x1403e6d71
xor eax, eax
stc
cmp rdx, r9
add rsp, 0x38
jmp 0x1403e6fbe
ret
Function at 0x1403ee685
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
movsx r8w, sil
mov dword [rsp + 0x10], edx
bsr r8d, r15d
add r8b, 0xaa
cmc
mov qword [rsp + 8], rcx
cqo
sub rsp, 0x98
bswap r8w
mov dword [rsp + 0x58], 1
cmovnp r8w, r13w
mov rdx, r10
mov dword [rsp + 0x5c], 0
xchg r8w, dx
xorps xmm0, xmm0
cdq
jmp 0x1403ee6d3
movss dword [rsp + 0x60], xmm0
jmp 0x1403ee6e0
xorps xmm0, xmm0
movsxd r8, ecx
movzx edx, ax
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
cmovge ecx, esi
mov r8b, dl
movss dword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movzx ecx, r13w
movss dword [rsp + 0x6c], xmm0
movsx rdx, si
movzx ecx, dx
mov dword [rsp + 0x70], 0
jmp 0x1403ee723
mov dword [rsp + 0x74], 0
movzx edx, r9w
setb dl
movzx cx, r11b
mov dword [rsp + 0x78], 0
movzx r8d, r13w
movzx cx, bl
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x80], 0
movsx r8, ax
movsxd r8, r11d
mov dword [rsp + 0x88], 0
movsx cx, r12b
xchg cl, r8b
mov dword [rsp + 0x20], 0
mov cx, 0x8012
movzx cx, ch
mov dword [rsp + 0x24], 0
movsxd rcx, r14d
not ch
xorps xmm0, xmm0
xchg r8b, dl
movss dword [rsp + 0x28], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
movzx dx, sil
jmp 0x1403ee7b6
xorps xmm0, xmm0
movzx r8w, r12b
movss dword [rsp + 0x30], xmm0
xorps xmm0, xmm0
setne dh
movss dword [rsp + 0x34], xmm0
mov dword [rsp + 0x38], 0
cwd
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
movsxd r8, r8d
movsx cx, r8b
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov r8b, 3
cmovns r8, r10
mov dword [rsp + 0x50], 0
movsx dx, cl
lea r8, [rsp + 0x58]
movsx dx, al
mov edx, dword [rsp + 0xa8]
movsx ecx, r13w
mov cl, r12b
mov rcx, qword [rsp + 0xa0]
jmp 0x1403ee83a
call fcn.1403ec353
test eax, eax
jmp 0x1403ee846
je 0x1403ee8fc
movsxd rax, dword [rsp + 0x88]
bswap rcx
movsx cx, r8b
imul rax, rax, 0xe
mov cl, r9b
mov rcx, rax
jmp 0x1403ee86b
call fcn.1403b3b23
mov rcx, qword [rsp + 0xb0]
movsx edx, r11w
movsx r8w, cl
cmovbe r8w, r12w
mov qword [rcx], rax
mov rax, qword [rsp + 0xb0]
jmp 0x1403ee89b
mov rax, qword [rax]
jmp 0x1403ee8a3
mov qword [rsp + 0x48], rax
movzx edx, r14w
cdq
jmp 0x1403ee8b2
lea r8, [rsp + 0x20]
movsx ecx, r10w
movzx cx, dl
mov edx, dword [rsp + 0xa8]
movsx ecx, r12w
mov rcx, qword [rsp + 0xa0]
call fcn.1403ec353
test eax, eax
jmp 0x1403ee8de
je 0x1403ee8fc
sub eax, eax
test eax, eax
jmp 0x1403ee8ed
jne 0x1403ee8e4
mov eax, dword [rsp + 0x50]
jmp 0x1403ee91a
mov rax, qword [rsp + 0xb0]
test r8, r10
jmp 0x1403ee90c
mov qword [rax], 0
stc
cmp r15, r9
cmc
sub eax, eax
add rsp, 0x98
jmp 0x1403ee926
ret
Function at 0x1403ee927
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
cmp r14b, al
stc
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
adc dl, r10b
xadd r8d, r8d
mov qword [rsp + 8], rcx
btc cx, r13w
sub rsp, 0x78
setae r8b
bswap r8w
mov ecx, esi
mov dword [rsp + 0x38], 1
cdq
cqo
cmovns edx, r10d
mov dword [rsp + 0x3c], 0
jmp 0x1403ee979
xorps xmm0, xmm0
movss dword [rsp + 0x40], xmm0
cdq
movzx edx, dx
xorps xmm0, xmm0
movss dword [rsp + 0x44], xmm0
bswap cx
cdq
mov r8w, si
xorps xmm0, xmm0
bswap r8w
cdq
movzx r8w, bl
movss dword [rsp + 0x48], xmm0
xorps xmm0, xmm0
xchg rdx, rcx
movsx r8w, r13b
mov dl, r10b
movss dword [rsp + 0x4c], xmm0
bswap r8d
mov dword [rsp + 0x50], 0
jmp 0x1403ee9d1
mov dword [rsp + 0x54], 0
jmp 0x1403ee9e1
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0
mov r8d, eax
mov qword [rsp + 0x60], 0
cqo
mov dword [rsp + 0x68], 0
cwd
bswap rdx
lea r8, [rsp + 0x38]
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
jmp 0x1403eea25
call fcn.1403ec353
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x90], 0
jmp 0x1403eea3c
je 0x1403eea92
cmp dword [rsp + 0x20], 0
jmp 0x1403eea4c
je 0x1403eea69
mov eax, dword [rsp + 0x50]
jmp 0x1403eea5b
mov dword [rsp + 0x24], eax
jmp 0x1403eea64
jmp 0x1403eea76
mov dword [rsp + 0x24], 0
lahf
bt rax, r8
mov rax, qword [rsp + 0x90]
shl ch, 0xb
xor cx, r11w
mov ecx, dword [rsp + 0x24]
cmc
jmp 0x1403eea8f
mov dword [rax], ecx
stc
cmp qword [rsp + 0x98], 0
jmp 0x1403eeaa0
je 0x1403eeaed
cmp dword [rsp + 0x20], 0
jmp 0x1403eeab0
je 0x1403eeacd
mov eax, dword [rsp + 0x58]
jmp 0x1403eeabf
mov dword [rsp + 0x28], eax
jmp 0x1403eeac8
jmp 0x1403eead5
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x98]
xor cx, 0xdf07
mov ecx, dword [rsp + 0x28]
mov dword [rax], ecx
test spl, 7
stc
cmp qword [rsp + 0xa0], 0
jmp 0x1403eeafb
je 0x1403eeb37
cmp dword [rsp + 0x20], 0
je 0x1403eeb19
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x2c], eax
jmp 0x1403eeb21
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0xa0]
bt ecx, ebp
movsx ecx, r9w
mov ecx, dword [rsp + 0x2c]
clc
mov dword [rax], ecx
cmp qword [rsp + 0xa8], 0
jmp 0x1403eeb45
je 0x1403eeba5
cmp dword [rsp + 0x20], 0
jmp 0x1403eeb55
je 0x1403eeb72
mov eax, dword [rsp + 0x5c]
jmp 0x1403eeb64
mov dword [rsp + 0x30], eax
jmp 0x1403eeb6d
jmp 0x1403eeb82
mov dword [rsp + 0x30], 0
or cx, 0x9622
movzx eax, cx
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x30]
test r13w, 0xf085
jmp 0x1403eeb9f
mov dword [rax], ecx
clc
test rdi, rsp
cmp dword [rsp + 0x20], 0
jmp 0x1403eebaf
je 0x1403eebc7
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x34], eax
jmp 0x1403eebc2
jmp 0x1403eebd5
mov dword [rsp + 0x34], 0
lahf
cmp dx, 0x4529
mov eax, dword [rsp + 0x34]
add rsp, 0x78
ret
Function at 0x1403ffd4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
test r15w, r10w
cmc
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
cmc
test r9b, 0x8a
clc
mov qword [rsp + 8], rcx
sub rsp, 0x68
jmp 0x1403ffd78
movss xmm0, dword [rsp + 0x80]
jmp 0x1403ffd86
ucomiss xmm0, dword [0x1400ce90c]
jne 0x1403ffdd1
mov rax, qword [rsp + 0x70]
cmc
rcl dh, cl
add rax, 0x80
xchg dh, ch
mov qword [rsp + 0x40], rax
cqo
mov rdx, qword [rsp + 0x78]
movzx ecx, r15w
mov rcx, rbx
mov rcx, 0x73128da1
mov rcx, qword [rsp + 0x40]
jmp 0x1403ffdc7
call fcn.1403e2b77
jmp 0x1403fff9a
mov rax, qword [rsp + 0x70]
sbb rdx, 0x290c2b82
add rax, 0x80
movsxd rdx, ebx
mov qword [rsp + 0x48], rax
xchg dx, ax
mov ch, ch
movzx rdx, dx
mov rax, qword [rsp + 0x70]
cmovne edx, ebx
mov dx, 0xa39b
cqo
mov eax, dword [rax + 0x80]
mov ecx, dword [rsp + 0x98]
setp dh
movzx edx, ax
lea eax, [rcx + rax + 1]
mov edx, eax
sete ch
mov cx, bx
mov rcx, qword [rsp + 0x48]
call fcn.1403e2d30
mov dword [rsp + 0x20], 0
jmp 0x1403ffe46
mov eax, dword [rsp + 0x20]
jmp 0x1403ffe40
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x98]
test r13w, dx
clc
cmp dword [rsp + 0x20], eax
jmp 0x1403ffe5b
jg 0x1403fff9a
cvtsi2ss xmm0, dword [rsp + 0x20]
cvtsi2ss xmm1, dword [rsp + 0x98]
divss xmm0, xmm1
movss xmm1, dword [rsp + 0x90]
jmp 0x1403ffe82
subss xmm1, dword [rsp + 0x88]
mulss xmm0, xmm1
movss xmm1, dword [rsp + 0x88]
shr al, cl
adc al, r14b
addss xmm1, xmm0
cbw
mov al, 0x94
movaps xmm0, xmm1
rol al, cl
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x70]
cmc
add rax, 0x80
mov qword [rsp + 0x50], rax
jmp 0x1403ffec6
movss xmm0, dword [rsp + 0x24]
jmp 0x1403ffed1
call fcn.1400bbc80
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
jmp 0x1403ffee9
movss xmm1, dword [rax + 4]
jmp 0x1403ffef3
addss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1403ffeff
movss dword [rsp + 0x30], xmm0
jmp 0x1403fff0a
movss xmm0, dword [rsp + 0x24]
jmp 0x1403fff15
call fcn.1400b89d0
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
movsx edx, cx
movss xmm1, dword [rax]
movzx edx, r9w
addss xmm1, xmm0
setno dh
bswap dx
movaps xmm0, xmm1
cwd
movsx dx, dl
movss dword [rsp + 0x28], xmm0
bswap rcx
cqo
movzx edx, sp
movss xmm0, dword [rsp + 0x28]
movzx rcx, r11w
xchg dh, cl
bswap dx
movss dword [rsp + 0x38], xmm0
sets dh
mov cl, sil
movss xmm0, dword [rsp + 0x30]
xchg dh, dl
movss dword [rsp + 0x3c], xmm0
cdq
bswap dx
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
jmp 0x1403fff90
call fcn.1403e2b77
jmp 0x1403ffe37
add rsp, 0x68
jmp 0x1403fffa3
ret
Function at 0x140406dd3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
bsf ax, dx
mov qword [rsp + 8], rcx
dec al
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
movzx ecx, si
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
not ch
mov qword [rsp + 0x38], rax
movzx rax, bp
movzx eax, di
movsx ax, r11b
mov rax, qword [rsp + 0x38]
movzx ecx, r12w
not cx
movsxd rax, dword [rax]
mov cl, r10b
bswap rcx
movzx rcx, r8w
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
jmp 0x140406e37
lea rax, [rcx + rax*4]
jmp 0x140406e40
mov qword [rsp + 0x48], rax
movsxd rax, r8d
mov rax, qword [rsp + 0x40]
jmp 0x140406e52
mov qword [rsp + 0x30], rax
jmp 0x140406e5c
jmp 0x140406e78
mov rax, qword [rsp + 0x30]
clc
add rax, 4
clc
test r9b, sil
mov qword [rsp + 0x30], rax
rcr rax, 0x9c
mov rax, qword [rsp + 0x48]
test rsi, rax
clc
cmp qword [rsp + 0x30], rax
jae 0x140406f93
mov rax, qword [rsp + 0x30]
test di, r10w
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
cmp dil, 0x14
cmp dword [rsp + 0x24], 0
je 0x140406f8e
mov dword [rsp + 0x20], 0
jmp 0x140406eb7
jmp 0x140406eda
mov eax, dword [rsp + 0x20]
inc eax
jmp 0x140406ec7
mov dword [rsp + 0x20], eax
cmp r12d, 0x10208537
jmp 0x140406eda
cmp dword [rsp + 0x20], 0x20
jmp 0x140406ee4
jae 0x140406f8e
mov eax, dword [rsp + 0x20]
sub rcx, 0xffffffff9a888295
mov ecx, 1
mov dword [rsp + 0x28], ecx
mov cl, al
neg ax
shl al, 0x1c
mov eax, dword [rsp + 0x28]
shl eax, cl
rol ch, 0x84
xor cx, 0x7490
mov ecx, 0xe412c303
mov ecx, dword [rsp + 0x24]
and ecx, eax
add eax, edi
mov eax, ecx
test eax, eax
je 0x140406f89
mov rax, qword [rsp + 0x40]
btc cx, r14w
xadd ch, dh
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
sar rax, 2
add cx, dx
sar dh, 0xaa
shl rax, 5
not dl
btr rdx, 0x1f
mov ecx, dword [rsp + 0x20]
btc dx, r10w
add rax, rcx
setns cl
mov dh, bl
mov dword [rsp + 0x2c], eax
cwd
lea rdx, [rsp + 0x2c]
movsx ecx, cx
movsx cx, r13b
bswap cx
mov rcx, qword [rsp + 0x68]
call fcn.1403e19dc
jmp 0x140406ebc
jmp 0x140406e61
add rsp, 0x58
ret
Function at 0x140418769
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x78
jmp 0x140418772
call fcn.1400556a4
mov qword [rsp + 0x20], rax
setg dl
cqo
movzx rdx, dx
lea rdx, [rsp + 0x60]
mov rcx, qword [0x1400dbda0]
jmp 0x140418796
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x64]
jmp 0x1404187a9
mov ecx, dword [rsp + 0x6c]
jmp 0x1404187b2
sub ecx, eax
cbw
mov rax, 0x17069501
mov eax, ecx
jmp 0x1404187c4
cvtsi2ss xmm0, eax
movss dword [rsp + 0x48], xmm0
btc ecx, ecx
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
jmp 0x1404187e2
cvtsi2ss xmm0, eax
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x40]
lahf
not cx
movss dword [rsp + 0x50], xmm0
mov rcx, 0x40230da3
movss xmm0, dword [rsp + 0x48]
cbw
movsx ecx, r15w
movss dword [rsp + 0x54], xmm0
mov cx, 0x89e
movsx eax, bp
jmp 0x140418821
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
jmp 0x140418830
mov qword [rcx + 8], rax
movsxd rcx, r15d
not ch
movzx ecx, cx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1400dbda8]
rol cl, cl
neg cx
mov rcx, qword [rsp + 0x58]
sub rcx, rax
bswap ax
mov rax, rcx
jmp 0x140418866
cvtsi2ss xmm0, rax
cvtsi2ss xmm1, qword [0x1400dbdb0]
divss xmm0, xmm1
mov rax, qword [rsp + 0x20]
bswap ecx
movss dword [rax + 0x10], xmm0
movsx rax, r14w
lahf
mov rax, qword [rsp + 0x58]
cmovbe cx, si
movsx ecx, r12w
setg cl
mov qword [0x1400dbda8], rax
movsx ecx, si
mov ecx, 0x11
jmp 0x1404188ad
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
cmp dx, 0xf18
and eax, 0x8000
cmc
test eax, eax
je 0x1404188d4
mov dword [rsp + 0x28], 1
jmp 0x1404188dc
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x20]
mov cl, byte [rsp + 0x28]
jmp 0x1404188ea
mov byte [rax + 0x140], cl
movsx cx, dil
mov ecx, 0x10
jmp 0x1404188ff
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
cmp dil, r11b
cmp r8b, 9
test r11b, r11b
and eax, 0x8000
cmp bh, ch
stc
test eax, eax
je 0x140418932
mov dword [rsp + 0x2c], 1
jmp 0x14041892d
jmp 0x14041893a
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x20]
not cl
mov cl, byte [rsp + 0x2c]
jmp 0x14041894a
mov byte [rax + 0x141], cl
not ecx
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
clc
and eax, 0x8000
stc
test eax, eax
jmp 0x14041896c
je 0x140418984
mov dword [rsp + 0x30], 1
jmp 0x14041897f
jmp 0x14041898e
mov dword [rsp + 0x30], 0
xchg cl, cl
mov rax, qword [rsp + 0x20]
not cl
mov cl, byte [rsp + 0x30]
jmp 0x14041899e
mov byte [rax + 0x142], cl
movsxd rax, esi
mov rax, qword [rsp + 0x20]
mov byte [rax + 0x143], 0
jmp 0x1404189b8
call fcn.140418751
mov rax, qword [rsp + 0x20]
cmp di, 0x6838
movzx eax, byte [rax + 0xc0]
cmp bp, r9w
test eax, eax
je 0x1404189e7
mov dword [rsp + 0x34], 0xffffffff
jmp 0x1404189f7
call fcn.140069d88
mov dword [rsp + 0x34], eax
sar ah, cl
sbb eax, 0x1ea9b215
mov eax, dword [rsp + 0x34]
stc
test r13b, cl
mov dword [rsp + 0x38], eax
stc
mov eax, esp
mov eax, dword [rsp + 0x38]
cmp dword [0x1400da084], eax
je 0x140418a2f
mov eax, dword [rsp + 0x38]
jmp 0x140418a1f
mov dword [0x1400da084], eax
jmp 0x140418a2a
call fcn.140418735
call fcn.14004cda8
add rsp, 0x78
jmp 0x140418a3d
ret
Function at 0x1404298d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
movss dword [rsp + 0x20], xmm3
movss dword [rsp + 0x18], xmm2
cdqe
shr r8, 0x3f
mov qword [rsp + 0x10], rdx
shr r8d, cl
mov qword [rsp + 8], rcx
lahf
add al, ah
sub rsp, 0x48
movzx eax, r10w
cmovbe rdx, rax
rdtsc
movss xmm0, dword [rsp + 0x78]
cmovbe cx, r9w
movsx r9d, r15w
rdtsc
movss dword [rsp + 0x30], xmm0
movsx cx, r15b
bswap dx
xchg r9, rax
mov rax, qword [rsp + 0x70]
movsx rcx, r12w
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
not dx
movsxd r8, r15d
lea r9, [rsp + 0x60]
mov r8, qword [rsp + 0x58]
bswap dx
mov edx, 8
mov cl, ch
mov rcx, qword [rsp + 0x50]
call fcn.140428aeb
add rsp, 0x48
jmp 0x14042996d
ret

Function at 0x14042b454
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
cmp dil, r11b
sub rsp, 0x48
mov cx, cx
lahf
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
xchg dx, dx
movzx dx, dil
movsxd rdx, ecx
lea rax, [rcx + rax*2]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax*2]
mov rdx, rax
mov cl, 0x88
cmovne rcx, r8
xchg ch, ch
mov rcx, qword [rsp + 0x30]
call fcn.1403ac569
mov dword [rsp + 0x28], eax
btr ecx, r13d
xor ah, 0x2a
mov rax, qword [rsp + 0x50]
setge ch
mov eax, dword [rax + 8]
cmp r13w, ax
mov dword [rsp + 0x2c], eax
clc
movsx rcx, r8w
mov eax, dword [rsp + 0x28]
btc rcx, rsp
mov ecx, dword [rsp + 0x2c]
test bh, 0x92
sub ecx, eax
rol al, 0x22
btc rax, r8
mov eax, ecx
bswap cx
mov rcx, qword [rsp + 0x50]
cmc
test rdx, 0xffffffffa3860d09
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x60]
cmc
mov eax, dword [rax + 4]
test r12b, 0xb9
cmc
stc
sub eax, ecx
mov rcx, qword [rsp + 0x50]
test r9b, bpl
test r9b, 0xa4
mov dword [rcx + 4], eax
inc ah
shl ax, 0x38
movsxd rax, dword [rsp + 0x58]
and cl, 0xb
xadd rcx, rcx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
clc
lea rax, [rcx + rax*2]
shl ch, 0xb
neg cx
movsxd rcx, dword [rsp + 0x60]
lea rax, [rax + rcx*2]
test dl, r11b
cmp di, di
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
jmp 0x14042b56e
movzx eax, word [rax]
mov word [rsp + 0x24], ax
mov rax, qword [rsp + 0x38]
add rax, 2
clc
jmp 0x14042b586
mov qword [rsp + 0x38], rax
movzx eax, word [rsp + 0x24]
cmp r8b, bpl
clc
mov word [rsp + 0x20], ax
rcr al, 0xf
movzx eax, word [rsp + 0x20]
test r10b, al
cmp r12b, spl
jmp 0x14042b5ac
test eax, eax
jmp 0x14042b5b3
je 0x14042b5fe
mov rax, qword [rsp + 0x30]
bts cx, ax
cmp r11b, 0xb1
movzx ecx, word [rsp + 0x20]
test r12w, r9w
clc
mov word [rax], cx
movsx rax, r14w
setl ah
bt ax, si
mov rax, qword [rsp + 0x30]
cmp r14b, r14b
add rax, 2
jmp 0x14042b5ef
mov qword [rsp + 0x30], rax
jmp 0x14042b5f9
jmp 0x14042b560
sub eax, eax
sar ch, 0xbe
mov rcx, qword [rsp + 0x30]
cmp spl, r13b
cmp dil, 0x14
test cx, r14w
mov word [rcx], ax
add rsp, 0x48
jmp 0x14042b61f
ret
Function at 0x140444b97
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
stc
mov qword [rsp + 8], rcx
cmp rbx, r14
clc
sub rsp, 0x68
cmp dword [rsp + 0x78], 0
jmp 0x140444bb8
jge 0x140444bcf
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
cmc
test r11b, spl
clc
mov dword [rsp + 0x78], eax
movzx eax, byte [rsp + 0x80]
cmp r11b, dil
test eax, eax
je 0x140444ca5
mov rax, qword [rsp + 0x70]
add rax, 0x60
cmp bx, 0x5f9d
sub ch, ah
mov qword [rsp + 0x30], rax
movzx dx, r14b
movsxd rdx, ebx
bsr eax, r14d
mov rax, qword [rsp + 0x70]
cmp bpl, al
add rax, 0x60
rol dx, 0x8d
mov qword [rsp + 0x28], rax
movzx ax, spl
movsxd rax, dword [rsp + 0x78]
imul rax, rax, 0x1c
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx + 8]
movsxd rcx, esi
cwd
mov qword [rsp + 0x38], rax
movsx ecx, r15w
rdtsc
mov eax, dword [rsp + 0x78]
inc eax
cmovb dx, r13w
movsxd rcx, eax
movzx ecx, r8w
cdqe
imul rax, rax, 0x1c
cmovo edx, r11d
cdq
movsx dx, ah
mov rcx, qword [rsp + 0x30]
movsxd rdx, esp
mov rcx, qword [rcx + 8]
mov dl, bpl
not dx
cmova dx, ax
mov rdx, qword [rsp + 0x38]
jmp 0x140444c80
movss xmm0, dword [rcx + rax + 4]
jmp 0x140444c8b
subss xmm0, dword [rdx + 4]
jmp 0x140444c95
movss dword [rsp + 0x20], xmm0
jmp 0x140444ca0
jmp 0x140444d80
mov rax, qword [rsp + 0x70]
rcr ch, cl
add rax, 0x60
sar rcx, cl
mov qword [rsp + 0x48], rax
rdtsc
sub cx, r10w
bt ecx, ebx
mov rax, qword [rsp + 0x70]
sub cl, sil
add rax, 0x60
bsf rdx, rsp
mov qword [rsp + 0x40], rax
not rcx
and rcx, 0x2d0fac1c
movsxd rax, dword [rsp + 0x78]
btr rdx, r9
imul rax, rax, 0x1c
add cl, 0xa0
mov rcx, qword [rsp + 0x40]
sbb dl, 0x98
and dl, r9b
add rax, qword [rcx + 8]
movsx edx, cx
mov qword [rsp + 0x50], rax
cdq
mov eax, dword [rsp + 0x78]
movzx ecx, di
bswap dx
movsx ecx, bp
inc eax
ror cl, 0x3b
cmp cl, bl
movsx rcx, cx
cdqe
imul rax, rax, 0x1c
cdq
movsx edx, r15w
movsxd rcx, edi
mov rcx, qword [rsp + 0x48]
jmp 0x140444d3a
mov rcx, qword [rcx + 8]
setb dh
jmp 0x140444d46
mov rdx, qword [rsp + 0x50]
jmp 0x140444d50
movss xmm0, dword [rcx + rax]
mov rcx, 0x27bbee9c
bswap cx
subss xmm0, dword [rdx]
bswap cx
movsx cx, r11b
movss dword [rsp + 0x20], xmm0
not rcx
movsx cx, r13b
mov rcx, 0xffffffffff87cdbb
movss xmm1, dword [rsp + 0x20]
movzx ecx, r9w
movsx ecx, r12w
mov rcx, qword [rsp + 0x70]
jmp 0x140444d98
call fcn.140060abf
add rsp, 0x68
ret
Function at 0x14045cbbd
Capabilities:
Set thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
movsx eax, cx
mov qword [rsp + 8], rcx
movsx eax, r14w
movzx ax, ch
add ax, r13w
sub rsp, 0x38
shl ax, cl
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x14045cbf2
xor eax, eax
jmp 0x14045cc61
mov rax, qword [rsp + 0x40]
cmc
clc
test di, si
mov rax, qword [rax]
cmp cx, di
mov eax, dword [rax + 0x24]
jmp 0x14045cc0b
cmp dword [rsp + 0x48], eax
jbe 0x14045cc21
xor eax, eax
jmp 0x14045cc1c
jmp 0x14045cc61
mov eax, dword [rsp + 0x48]
setl ch
cmovns cx, r14w
mov dword [rsp + 0x20], eax
cmovnp ax, r13w
not ax
cwde
mov rdx, qword [rsp + 0x20]
not ch
movzx rcx, si
mov rax, qword [rsp + 0x40]
movzx rcx, bp
cmovle cx, r9w
mov ecx, dword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, 1
add rsp, 0x38
jmp 0x14045cc6a
ret

Function at 0x14045d909
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
and al, r13b
movsx eax, si
mov dword [rsp + 0x10], edx
cmp r13w, 0x9324
sub rax, r9
mov qword [rsp + 8], rcx
movzx rcx, r14w
shld ax, bp, 0xd
sub rsp, 0x98
mov rax, qword [rsp + 0xa0]
cmovs cx, si
movsx rcx, di
mov ecx, dword [rax + 0x28]
jmp 0x14045d953
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x70], rax
ror ah, cl
setb al
btr ax, 0x35
mov eax, dword [rsp + 0xa8]
stc
cmc
mov dword [rsp + 0x60], eax
sete al
bt rax, 0xbf
movzx eax, ax
mov dword [rsp + 0x64], 0
sal al, 0x1e
mov qword [rsp + 0x68], 0x1a
or ax, 0x99bc
mov rax, qword [rsp + 0xa0]
cmp al, 0xb8
cmp dword [rax + 0x30], 1
jmp 0x14045d9ab
jne 0x14045d9c4
mov qword [rsp + 0x68], 0x1c
mov r8b, r9b
cqo
cmovs dx, r8w
mov qword [rsp + 0x50], 0
jmp 0x14045d9d2
mov qword [rsp + 0x48], 0
movsxd rax, esp
lahf
mov qword [rsp + 0x40], 0
xchg r8d, eax
mov qword [rsp + 0x38], 0
movsx edx, ax
movsx ax, al
cwd
mov rax, qword [rsp + 0xb8]
mov cx, 0x1b37
mov qword [rsp + 0x30], rax
rdtsc
movzx ax, cl
not r8b
mov rax, qword [rsp + 0xc0]
movsx r9d, di
mov qword [rsp + 0x28], rax
cwd
movzx r8d, si
cmovle edx, esi
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
movzx r9w, spl
mov r9, qword [rsp + 0x60]
movzx cx, r15b
cbw
movzx rdx, r13w
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x70]
cdqe
movsx rax, cx
cmovo eax, r15d
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
jmp 0x14045da75
call fcn.14001ff48
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
cmp r14b, r8b
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x80]
jmp 0x14045da9b
add rsp, 0x98
jmp 0x14045daa7
ret