joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013259f
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b0b76
xor r8d, r8d
movzx dx, r15b
lea edx, [r8 + 2]
jmp 0x1400e4816
mov qword [rsp + 8], rbx
shrd ebx, r10d, 0xf0
adc bl, r8b
mov dword [rsp + 0x18], r8d
add bx, bx
shld bx, di, 0xd4
sal bh, cl
mov dword [rsp + 0x10], edx
sar bx, 5
push rbp
sar bx, 0x26
rol ebx, cl
mov rbp, rsp
neg rbx
shl bx, 0x95
rcl bh, 0x9b
sub rsp, 0x50
mov ebx, ecx
clc
test r8d, r8d
jmp 0x1404b0bbd
jne 0x1404b0c59
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b0bd3
je 0x1404b0c59
mov ecx, 0x5a4d
cmp r8b, 0x75
cmp word [rax], cx
jmp 0x1404b0bea
jne 0x1404b0c59
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
cmc
cmp bl, 0x7e
clc
cmp dword [rcx], 0x4550
jmp 0x1404b0c08
jne 0x1404b0c59
mov eax, 0x20b
test bx, 0x6401
cmp r12d, 0x1a0a456a
cmp word [rcx + 0x18], ax
jmp 0x1404b0c28
jne 0x1404b0c59
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b0c3a
jbe 0x1404b0c59
cmp dword [rcx + 0xf8], 0
je 0x1404b0c59
mov ecx, ebx
jmp 0x1404b0c54
call fcn.1404b0a46
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
movsx eax, si
xchg r9d, ecx
movzx r8, sp
lea r9, [rbp - 0x2c]
cdqe
mov dl, 0xef
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
cqo
lea r8, [rbp - 0x20]
lahf
cwd
cmovl dx, bp
lea rax, [rbp + 0x28]
movsx ecx, si
movzx rcx, r12w
mov qword [rbp - 0x10], rax
movzx rdx, r9w
movsxd rcx, r8d
movzx dx, dh
lea rdx, [rbp - 0x28]
sets ah
mov eax, 2
movsx ecx, bx
movsx cx, r14b
lea rcx, [rbp - 0x30]
jmp 0x1404b0cc3
mov dword [rbp - 0x2c], eax
jmp 0x1404b0ccb
mov dword [rbp - 0x28], eax
jmp 0x1404b0cd3
call fcn.1404b0e7f
cmp dword [rbp + 0x20], 0
je 0x1404b0cfc
mov rbx, qword [rsp + 0x60]
shld ebp, ebx, 0xc5
add rsp, 0x50
movsx bp, r15b
mov bpl, r13b
xchg bpl, bpl
pop rbp
ret
mov ecx, ebx
call fcn.1404b0af9
int3

Function at 0x14016b05d
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x1402080d9
jmp 0x140445a72
push rsi
test r9w, 0x4d7a
movsx si, r14b
push rdi
or sil, bl
sub rsp, 0x28
shr rsi, cl
bt si, 0x81
mov rsi, rcx
jmp 0x140445a9b
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
jmp 0x140445aa7
xor edx, edx
xor r8d, r8d
jmp 0x140445ab1
call qword [rax + 0x188]
mov edi, eax
movsx rcx, cx
lea rcx, [rsi + 0x30]
call fcn.140459765
test edi, edi
jmp 0x140445acd
je 0x140445b0d
cmp edi, 0x8899000c
jmp 0x140445ade
jne 0x140445b1f
mov rcx, rsi
cmc
bt si, 0x28
add rsp, 0x28
movzx rdi, bp
movsx esi, r15w
xchg rdi, rdi
pop rdi
xchg si, si
movzx rsi, r9w
mov sil, r9b
pop rsi
jmp fcn.140445728
nop
add rsp, 0x28
cmovg si, r14w
movsx di, spl
pop rdi
pop rsi
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
cmc
mov r9d, 0x54
add si, ax
btc esi, esp
add rsp, 0x28
bswap di
movsx di, bl
pop rdi
pop rsi
jmp 0x140445b4c
jmp fcn.1403af4b6

Function at 0x1401b63c3
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
sub edx, edx
jmp 0x1401ff314
jmp 0x1404b0b76
Function at 0x1401eee96
Capabilities:
Enumerate pe sections

Disassembly:
cmp r10, rcx
jmp 0x140210e4f
movsxd r8, dword [rcx + 0x3c]
cmp r12b, 0x75
sub r9d, r9d
bt r11d, ebx
bts r11d, r15d
sal r11, 0xfb
lea r8, [r8 + rcx]
lahf
sar ah, cl
mov r10, rdx
movzx eax, word [r8 + 0x14]
neg r11w
bsr r11d, esi
movzx r11d, word [r8 + 6]
add rax, 0x18
clc
cmp r9w, r15w
lea rax, [rax + r8]
cmc
cmp dl, 0xf8
test r11d, r11d
jmp 0x1401f5789
je 0x1402267be
mov edx, dword [rax + 0xc]
cmp r10w, r14w
cmp r10, rdx
jmp 0x14021bed9
jb 0x140260923
inc r9d
test bpl, r10b
add rax, 0x28
test r15b, bpl
cmp r9d, r11d
jmp 0x1402267b8
jb 0x140210e55
mov ecx, dword [rax + 8]
add ecx, edx
jmp 0x1400f1c04
jb 0x1401f578f
xor eax, eax
jmp 0x140260923
ret
Function at 0x14025c4c9
Capabilities:
Parse pe header

Disassembly:
jne 0x1401939f5
movsxd rdx, dword [rcx + 0x3c]
test r9b, 0x42
cmc
add rdx, rcx
clc
stc
cmp dword [rdx], 0x4550
jmp 0x140136d74
jne 0x1401939f5
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
setae al
sete al
ret
xor eax, eax
jmp 0x14025088f
cmp word [rcx], ax
jmp 0x1400eb584
ret
mov eax, 0x5a4d
stc
jmp 0x1401e4fe0

Function at 0x14027ceaf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp fcn.1404b489c
mov rdx, rcx
mov cl, r13b
bswap ecx
movzx ecx, r10w
lea rcx, [0x1400ba2a8]
jmp 0x140255f5c
Function at 0x1403dbaff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
or r15b, al
push r14
bt r15w, 0x42
push r13
push r12
btc r12d, r12d
push rsi
adc r14b, 0x75
btc r14d, 0xb5
push rdi
bsr r12w, r8w
add r12b, 0xa
shl r14b, cl
push rbp
push rbx
rcr r15b, cl
btr rbx, rcx
sub rsp, 0x38
bt r14w, 0x3a
movaps xmmword [rsp + 0x20], xmm6
mov r14, r9
mov r15b, 0x51
mov r15, r8
shr bx, 0xc9
shl r12b, 0x40
movsxd r13, eax
mov r12, rdx
stc
sar r13d, 0xe
sbb r13d, ecx
mov r13, rcx
mov rbx, qword [rcx]
clc
jmp 0x1403dbb6e
test rbx, rbx
jmp 0x1403dbb76
je 0x1403dbcd1
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403dbb88
je 0x1403dbc68
lea rsi, [0x1400beb30]
jmp 0x1403dbb9a
xorps xmm6, xmm6
jmp 0x1403dbbcf
lea rbp, [rbx + 0x18]
call fcn.140158ff6
movups xmmword [rbp], xmm6
clc
cmc
mov qword [rbp + 0x10], 0
cmp dl, spl
cmc
add rbx, 0x30
cmp rbx, rdi
jmp 0x1403dbbc9
je 0x1403dbc5c
mov qword [rbx], rsi
sub cx, bx
not cl
rcr cl, 0x16
mov rcx, qword [rbx + 0x18]
stc
cmp r10d, 0x296d1a5d
jmp 0x1403dbbeb
test rcx, rcx
jmp 0x1403dbbf3
je 0x1403dbbbd
mov rdx, qword [rbx + 0x28]
stc
cmp r9, r15
jmp 0x1403dbc06
sub rdx, rcx
test r8b, 0x1c
jmp 0x1403dbc12
cmp rdx, 0x1000
jmp 0x1403dbc1e
jb 0x1403dbba2
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmc
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403dbc39
jae 0x1403dbd91
add rdx, 0x27
movzx cx, sil
movsx rcx, r14w
xchg rcx, rcx
mov rcx, rax
jmp 0x1403dbc57
jmp 0x1403dbba2
mov rbx, qword [r13]
btc dx, di
movzx rdx, sp
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmp r12b, 0xbe
test di, r13w
cmp rdx, 0x1000
jmp 0x1403dbc83
jb 0x1403dbcc4
mov rax, qword [rbx - 8]
cmp r8b, sil
add rbx, 0xfffffffffffffff8
test dl, 0xfb
clc
test r8d, eax
sub rbx, rax
cmp sil, r13b
stc
cmp rbx, 0x20
jmp 0x1403dbcab
jae 0x1403dbd91
add rdx, 0x27
mov ch, 0xba
movsx rcx, si
mov rbx, rax
not ch
mov cl, r15b
mov rcx, rbx
jmp 0x1403dbccc
call fcn.140158ff6
mov qword [r13], r12
bswap ebp
xor rdi, r13
lea rax, [r15 + r15*2]
movsxd rsi, ebx
test r9b, bpl
shl rax, 4
test dl, sil
lea rax, [rax + r12]
xchg bl, dil
mov r15b, 0x77
sbb bp, r11w
mov qword [r13 + 8], rax
lea rax, [r14 + r14*2]
movzx rdi, r15w
shl rax, 4
mov di, 0x1917
xadd bp, si
sbb r15, rbp
add rax, r12
test r13w, r12w
rcr r14b, cl
mov qword [r13 + 0x10], rax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
cmove r12w, di
not r12b
pop rbx
jmp 0x1403dbd43
pop rbp
cmovo di, r12w
movsxd rsi, edi
pop rdi
jmp 0x1403dbd55
pop rsi
seta r13b
jmp 0x1403dbd5f
pop r12
mov r13b, r15b
bswap r14
movsxd r15, eax
pop r13
mov r15w, 0x4733
movsx r14w, sil
movzx r14d, r13w
pop r14
not r15b
movsx r15w, bl
movzx r15w, r8b
pop r15
jmp 0x1403dbd90
ret
call fcn.1404b5d90
int3
Function at 0x1403dfe97
Capabilities:
Check for software breakpoints

Disassembly:
push rsi
bts r9w, ax
push rdi
bsf r10w, di
push rbx
btc r9w, 0x7b
mov r9, rcx
rcr r10b, cl
btr r10, rdx
lea r8, [r8 + rdx]
mov dword [rcx + 8], 0
adc r10w, 0x5b26
bts r10d, eax
xor eax, eax
xor r10w, r13w
sar r10w, cl
xor ecx, ecx
bts r10d, eax
nop word cs:[rax + rax]
movzx r10w, cl
xchg r10b, r10b
lea r10, [rdx + 1]
cmp r10, r8
jmp 0x1403dfef9
ja 0x1403e0176
movzx edi, byte [rdx]
ror dl, cl
mov edx, edi
cmp r10b, 0xcc
cmp di, bx
clc
and edx, 0x7f
test al, r15b
shl rdx, cl
cmp esp, r11d
jmp 0x1403dff1f
lea rax, [rax + rdx]
add rcx, 7
or dl, sil
stc
bt dx, 0x87
mov rdx, r10
clc
cmc
test sp, r10w
test dil, dil
jmp 0x1403dff41
js 0x1403dfeed
mov rcx, rax
cmp r14b, 0x32
and rcx, 0xfffffffffffffff8
test ch, 0x3c
cmp r14w, r10w
and eax, 7
stc
cmp rcx, 8
jmp 0x1403dff66
je 0x1403e00b9
cmp rax, 1
jmp 0x1403dff75
jg 0x1403dffa0
test rax, rax
je 0x1403e0068
cmp eax, 1
jmp 0x1403dff8c
jne 0x1403e0176
lea rdx, [r10 + 8]
jmp 0x1403dff9b
jmp 0x1403e00a3
cmp eax, 5
jmp 0x1403dffa8
je 0x1403e009f
cmp eax, 2
jmp 0x1403dffb6
jne 0x1403e0176
mov rsi, r10
rcr eax, 0xea
sub edi, edi
sub ecx, ecx
xor al, 0x5c
not rax
jmp 0x1403dffd0
nop word cs:[rax + rax]
lea rax, [rsi + 1]
cmc
stc
cmp rax, r8
jmp 0x1403dffe9
ja 0x1403e0176
mov r11, rdi
movzx ebx, byte [rsi]
sub sil, bpl
btc si, 0xa3
btc dx, dx
mov edx, ebx
sal sil, 0x7d
test di, 0x2f25
and edx, 0x7f
movsx si, r11b
rol si, 0x3f
shl rdx, cl
mov sil, dil
cmovg si, di
sbb sil, 0xb1
add rdi, rdx
sub sil, sil
mov sil, r13b
btc rsi, 0xf
add rcx, 7
bts si, sp
rcr sil, 0x6a
mov rsi, rax
stc
cmp al, 0xf2
test bl, bl
js 0x1403dffdb
add rdx, r11
cmc
add rdx, rax
clc
test dl, r13b
cmp cl, 0x3c
cmp rdx, r8
cmova rdx, rax
jmp 0x1403dfec9
mov rax, r10
rcr dh, 0xb9
sar dx, 0x95
clc
nop
lea rdx, [rax + 1]
cmp rdx, r8
ja 0x1403e0176
cmp byte [rax], 0
cbw
setp ah
xchg al, al
mov rax, rdx
jmp 0x1403e0094
js 0x1403e0075
jmp 0x1403dfec9
lea rdx, [r10 + 4]
cmp rdx, r8
jmp 0x1403e00ab
cmova rdx, r10
jmp 0x1403e00b4
jmp 0x1403dfec9
cmp eax, 2
jmp 0x1403e00c1
jne 0x1403e0176
mov dword [r9 + 8], 2
add sil, 0x81
rol si, 0x33
mov rsi, r10
neg dx
sub eax, eax
bt dx, r13w
cwd
xor ecx, ecx
movsxd rdx, esp
btc dx, r10w
nop word [rax + rax]
dec edx
lea rdx, [rsi + 1]
cmp esp, r8d
cmp rdx, r8
jmp 0x1403e0107
ja 0x1403e0176
movzx r11d, byte [rsi]
mov edi, r11d
bts si, bp
and edi, 0x7f
shl rdi, cl
ror si, 0x98
movsxd rsi, r9d
add rax, rdi
shld esi, r9d, 0x93
movsx si, dl
rcl si, cl
add rcx, 7
rol sil, 0x85
sar si, 0xd7
bsf si, bx
mov rsi, rdx
stc
test r11b, r11b
js 0x1403e00f8
mov qword [r9 + 0x10], rdx
cmp r13w, 0x20d7
mov qword [r9 + 0x18], rax
lea rdx, [rdx + rax]
jmp 0x1403e0168
cmp rdx, r8
jmp 0x1403e0170
jbe 0x1403dfec9
cmp r10, r8
movzx bx, r9b
movsx rbx, r10w
seta al
jmp 0x1403e018e
pop rbx
jmp 0x1403e019c
pop rdi
jmp 0x1403e01a2
pop rsi
ret
Function at 0x1403e8c48
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
adc al, r8b
movzx eax, si
push r14
mov r14d, ecx
push rsi
movzx r14w, spl
movzx rax, di
bts eax, r10d
push rdi
sal eax, cl
cmova rax, r12
shl r14b, 0xbe
push rbx
rcl ax, 0x15
btr ax, r11w
sub rsp, 0x20
mov r14, rcx
inc ax
rcr ah, cl
rol al, 0xb9
mov eax, dword [rcx + 8]
test al, 2
jmp 0x1403e8c91
jne 0x1403e8ca3
sub esi, esi
jmp 0x1403e8c9e
jmp 0x1403e8d4c
mov rdi, qword [r14 + 0x10]
shrd r15w, r14w, 0x68
test dl, r9b
rol r15w, cl
mov r15, qword [r14 + 0x18]
sal si, cl
rcl sil, cl
btr esi, 0x72
mov rsi, r15
clc
sub rsi, rdi
test sp, 0x609
sar rsi, 5
cmp dl, dh
clc
cmp r15, rdi
jmp 0x1403e8cdd
je 0x1403e8d4c
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
or rax, 1
movsx ecx, bx
xor cl, r9b
cmc
bsr rax, rax
or cx, 0x2c60
lea rbx, [rax + rax*8]
adc al, r12b
add rbx, 0x49
shr rbx, 6
movsx eax, r12w
movzx ax, spl
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x1403e8d23
call qword [rax + 0x10]
lea rsi, [rsi + rax]
cmc
stc
lea rsi, [rsi + rbx]
cmp dx, r11w
test al, 0xfc
add rdi, 0x20
cmp rdi, r15
jmp 0x1403e8d42
jne 0x1403e8ce3
mov eax, dword [r14 + 8]
test al, 4
jne 0x1403e8d61
mov rdi, rsi
jmp 0x1403e8d5c
jmp 0x1403e8e0b
mov rbx, qword [r14 + 0x28]
ror di, 0x25
btr r15d, ecx
mov r15, qword [r14 + 0x30]
shld edi, eax, 0x2f
rcr di, cl
mov rdi, r15
clc
sub rdi, rbx
sar rdi, 5
cmp r8d, 0x54d022f
add rdi, rsi
cmp dh, 0x49
cmp r15, rbx
jmp 0x1403e8d98
je 0x1403e8e0b
nop dword [rax]
movsx ecx, dx
cbw
not cl
mov rax, qword [rbx]
mov rcx, rbx
jmp 0x1403e8db4
call qword [rax + 0x10]
or rax, 1
bsr esi, r14d
bsr rax, rax
lea rsi, [rax + rax*8]
add rsi, 0x49
shr ecx, cl
not cl
shr rsi, 6
cdqe
movsxd rax, r8d
mov rax, qword [rbx]
mov rcx, rbx
jmp 0x1403e8de3
call qword [rax + 0x10]
add rdi, rax
cmc
cmp al, al
jmp 0x1403e8df1
lea rdi, [rdi + rsi]
add rbx, 0x20
cmp rbx, r15
jmp 0x1403e8e01
jne 0x1403e8da9
mov eax, dword [r14 + 8]
test al, 8
jmp 0x1403e8e12
je 0x1403e8f17
mov rbx, qword [r14 + 0x40]
mov r15w, r8w
mov r14, qword [r14 + 0x48]
jmp 0x1403e8e2f
mov r15, r14
cmp r9b, 0x2f
sub r15, rbx
clc
stc
sar r15, 5
jmp 0x1403e8e44
lea r15, [r15 + rdi]
cmp r14, rbx
je 0x1403e8f06
nop word [rax + rax]
mov rax, qword [rbx]
cmovle cx, dx
movsx cx, r15b
mov rcx, rbx
jmp 0x1403e8e6e
call qword [rax + 0x10]
or rax, 1
rol sil, cl
bsr rax, rax
btc cx, r11w
adc cx, 0x489f
btc rcx, 0xef
lea rsi, [rax + rax*8]
bts ecx, r13d
test r9d, 0x55e047c9
add rsi, 0x49
cdqe
shr rsi, 6
lahf
cmovne cx, r10w
mov rax, qword [rbx]
movsx cx, r10b
mov cl, 0x20
movzx rcx, ax
mov rcx, rbx
jmp 0x1403e8ec0
call qword [rax + 0x10]
mov rdi, rax
stc
cmc
cmp r10, 0x3c5a7ea7
add rdi, r15
not r15
lea rdi, [rdi + rsi]
adc r15b, r14b
rol r15b, cl
add rbx, 0x20
bt r15, rsi
shr r15w, 0x19
mov r15, rdi
stc
clc
cmp bh, dh
cmp rbx, r14
jmp 0x1403e8efb
jne 0x1403e8e5a
jmp 0x1403e8f17
mov rdi, r15
bts esi, r9d
cmove ax, r12w
sbb bx, 0x27b3
mov rax, rdi
cmc
shr ebx, cl
btc ebx, edx
add rsp, 0x20
mov bl, sil
pop rbx
not r14
movzx edi, r8w
movzx r14, r13w
pop rdi
cmovs r15w, r12w
mov esi, 0x431d1341
pop rsi
movzx r14w, bl
movsxd r15, ecx
pop r14
mov r15b, r15b
pop r15
jmp 0x1403e8f53
ret
Function at 0x1404221cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
xadd sil, r9b
btc esi, edx
movzx r9d, r12w
mov r10, qword [rcx]
rol sil, cl
adc sil, 0xec
movzx si, r15b
mov rsi, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
cmp r10b, 0x1c
cmc
test al, 0xea
imul r9d, dword [r10]
cmc
cmp r8d, 2
jmp 0x140422205
jne 0x14042238d
test r9d, r9d
jmp 0x140422213
je 0x14042242e
lea ecx, [r9 - 1]
cmc
cmp ecx, 3
jmp 0x140422226
jb 0x140422325
mov r11d, r9d
and r11d, 0xfffffffc
nop word cs:[rax + rax]
bswap r8d
bts r10, r13
movzx r8d, word [rsi]
sal r10w, 0xcd
cmp ah, 0xb2
movzx r10d, word [rsi + 4]
test r15b, 0xda
sub ecx, ecx
cmp r8w, word [rdx]
xchg cl, cl
setne cl
sar r8b, cl
add r8b, al
neg ecx
add r8b, al
mov word [rsi + 2], cx
sete r8b
xor ecx, ecx
cmp r10w, word [rdx]
setne cl
sal r8w, 0xec
btc r8w, 0x95
neg ecx
xor r8w, r9w
sub r8b, r10b
mov word [rsi + 6], cx
movzx r8d, word [rsi + 8]
jmp 0x1404222ad
xor ecx, ecx
cmp r8w, word [rdx]
setne cl
movsx r8, sp
btr r8w, 0x54
jmp 0x1404222c5
neg ecx
shrd r8, r14, 0x17
movsx r8d, r10w
btc r8w, bx
mov word [rsi + 0xa], cx
cmovp r8, r9
rcl r8b, cl
movzx r8d, word [rsi + 0xc]
clc
cmp rax, 0x6c4b5c94
xor ecx, ecx
jmp 0x1404222f9
cmp r8w, word [rdx]
setne cl
neg ecx
cmp r14d, r9d
cmp r14, 0x15261065
mov word [rsi + 0xe], cx
cmc
add rsi, 0x10
stc
add r11d, 0xfffffffc
jmp 0x14042231f
jne 0x140422247
test r9b, 3
jmp 0x14042232e
je 0x14042242e
and r9d, 3
clc
mov r8b, 0x76
xor ecx, ecx
movsx r8d, r12w
nop word cs:[rax + rax]
cmc
test r9b, 0xa1
movzx r8d, word [rsi + rcx*4]
sub eax, eax
sar al, 0x77
shr al, cl
cmp r8w, word [rdx]
xchg al, al
mov al, 0xc2
setne al
cmc
neg eax
jmp 0x140422371
mov word [rsi + rcx*4 + 2], ax
inc rcx
clc
cmp r9d, ecx
jmp 0x140422382
jne 0x140422352
jmp 0x14042242e
test r9d, r9d
jmp 0x140422395
je 0x14042242e
movzx r10d, word [rdx]
movzx r8w, r8b
bt r8d, 0xd7
sal r8b, 0xb8
mov r8d, r9d
jmp 0x1404223b5
sub ecx, ecx
jmp 0x1404223bc
jmp 0x1404223d5
inc rcx
cmp bpl, sil
cmp r8d, ecx
jmp 0x1404223cf
je 0x14042242e
cmp word [rsi + rcx*8], r10w
jmp 0x1404223df
jne 0x1404223c1
movzx eax, word [rsi + rcx*8 + 2]
cmp r8b, r14b
cmp ax, word [rdx + 2]
jmp 0x1404223f6
jne 0x1404223c1
movzx eax, word [rsi + rcx*8 + 4]
cmp ax, word [rdx + 4]
jne 0x1404223c1
mov word [rsi + rcx*8 + 6], 0
movsx r10w, r9b
movsx r10d, sp
movzx r10w, sil
movzx r10d, word [rdx]
jmp 0x140422429
jmp 0x1404223c1
pop rsi
ret
Function at 0x14043eb5a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
bsf si, ax
shld si, sp, 0x97
push rdi
btr eax, 0x41
cdqe
push rbp
movsx rsi, di
movzx esi, ax
push rbx
test r12, rbp
or esi, 0x70ac0017
mov sil, r9b
sub rsp, 0x78
nop
not ah
movsxd rsi, r14d
movaps xmmword [rsp + 0x60], xmm8
not rax
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm6
not sil
cdqe
mov rax, qword [rcx]
movsxd rsi, esi
setne sil
movzx esi, bp
mov esi, dword [rax + 0x10]
jmp 0x14043ebbb
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
cmp dx, r10w
test esi, esi
jmp 0x14043ebdb
jle 0x14043eda9
movaps xmm7, xmm2
movaps xmm8, xmm1
cmove r15, r14
mov r15, rcx
xorps xmm6, xmm6
sub edi, edi
movsx rcx, r14w
cmovns ecx, r10d
cqo
lea r14, [rsp + 0x28]
nop word cs:[rax + rax]
mov rcx, r14
bswap r8w
movzx r8d, ax
mov rdx, r15
cmovno r8w, r14w
mov r8d, edi
jmp 0x14043ec2b
call fcn.14043e872
mov ebx, dword [rsp + 0x3c]
test ebx, ebx
jmp 0x14043ec3b
jle 0x14043eda9
test edi, edi
jmp 0x14043ec48
jne 0x14043ec66
movss xmm0, dword [rsp + 0x34]
jmp 0x14043ec59
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043ed9d
movss xmm0, dword [rsp + 0x38]
jmp 0x14043ec71
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043ec98
add edi, ebx
jmp 0x14043ec85
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jl 0x14043ec10
jmp 0x14043eda9
movss xmm6, dword [rsp + 0x28]
ucomiss xmm6, xmm8
jbe 0x14043ecaf
mov esi, edi
jmp 0x14043eda9
movss xmm0, dword [rsp + 0x2c]
jmp 0x14043ecba
ucomiss xmm0, xmm8
jbe 0x14043ed28
sub ebp, ebp
mov esi, edi
movaps xmm7, xmm6
cqo
movzx dx, ah
nop word cs:[rax + rax]
mov cl, 0xee
bswap r8w
mov rcx, r15
mov edx, edi
mov r8d, ebp
jmp 0x14043ecf0
call fcn.14043f051
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x14043edec
inc ebp
jmp 0x14043ed0a
inc esi
cmp r8w, r10w
movaps xmm6, xmm7
cmp dil, r12b
test r9b, 0x15
clc
cmp ebx, ebp
jmp 0x14043ed22
jne 0x14043ece3
test byte [r15 + 0x1c], 4
jmp 0x14043ed32
jne 0x14043ed85
lea esi, [rbx + rdi]
movsx eax, si
lahf
dec al
dec esi
mov rax, qword [r15]
rcr ch, 0x6d
movsxd rcx, esi
test r12w, si
cmp dil, r14b
jmp 0x14043ed58
cmp qword [rax + 0x10], rcx
jmp 0x14043ed61
jbe 0x14043ee0e
cmp qword [rax + 0x18], 8
jmp 0x14043ed71
jb 0x14043ed7a
mov rax, qword [rax]
cmp word [rax + rcx*2], 0xa
je 0x14043eda9
add ebx, edi
movzx si, bl
xchg sil, sil
bswap si
mov esi, ebx
jmp 0x14043ed98
jmp 0x14043eda9
sub esi, esi
shl r15w, cl
dec dil
shl ah, 0xc1
mov eax, esi
and r15b, 0x29
shl r14b, cl
xor r15b, sil
movaps xmm6, xmmword [rsp + 0x40]
sub rdi, r11
btc rbx, rsp
movaps xmm7, xmmword [rsp + 0x50]
and r14b, 0xde
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
movzx r14d, r14w
movsxd r14, edi
pop rbp
movsxd rsi, r14d
pop rdi
pop rsi
pop r14
pop r15
jmp 0x14043edeb
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x14043eda9
inc esi
jmp 0x14043ee09
jmp 0x14043eda9
call fcn.14043f1fc
int3
Function at 0x140443ce9
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx ecx, cx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp r8d, r10d
cmc
cmp r15w, 0x5230
cmp eax, 0x100
setae al
test r9b, 0xc9
add rsp, 0x28
jmp 0x140443d18
ret

Function at 0x1404453dd
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movsx rax, di
movsx ax, r15b
mov rcx, qword [rcx]
jmp 0x1404453f6
mov rax, qword [rcx]
jmp 0x1404453fe
call qword [rax + 0x28]
test eax, eax
jmp 0x140445408
je 0x140445430
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9d, 0x2a
add rsp, 0x28
jmp 0x14044542b
jmp fcn.1403af4b6
nop
stc
add rsp, 0x28
jmp 0x14044543b
ret
Function at 0x140446f77
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
ror rsi, cl
cmp r13b, bl
test r14b, r14b
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm9
mov sil, 0x8a
movsxd rsi, r12d
movaps xmmword [rsp + 0x50], xmm8
movaps xmmword [rsp + 0x40], xmm7
movzx esi, cx
movaps xmmword [rsp + 0x30], xmm6
movzx si, r8b
movaps xmm8, xmm2
bswap si
cmovle si, cx
movzx esi, r13w
mov rsi, rcx
jmp 0x140446fc3
movd xmm7, edx
shr rdx, 0x20
movd xmm6, edx
mov rcx, qword [rcx + 0x20]
rdtsc
movups xmm0, xmmword [r9]
rdtsc
lahf
movzx rdx, r14w
movaps xmmword [rsp + 0x20], xmm0
movsx rax, bp
movzx rax, cx
mov rax, qword [rcx]
jmp 0x140446ff8
lea rdx, [rsp + 0x20]
jmp 0x140447002
call qword [rax + 0x40]
movdqa xmm0, xmm7
call fcn.1404b81a4
movdqa xmm7, xmm0
movss xmm9, dword [0x1400bd480]
jmp 0x140447020
addss xmm7, xmm9
movdqa xmm0, xmm6
call fcn.1404b81a4
addss xmm0, xmm9
mov rcx, qword [rsi + 0x18]
movzx r8d, r12w
xchg r8b, r8b
movsxd r8, r10d
mov r8, qword [rsi + 0x20]
jmp 0x14044704a
movd eax, xmm7
movd edx, xmm0
shl rdx, 0x20
or rax, rdx
cwd
bswap edx
jmp 0x140447062
mov qword [rsp + 0x20], rax
bswap dx
movss dword [rsp + 0x28], xmm8
xchg dl, al
movss dword [rsp + 0x2c], xmm8
mov rax, qword [rcx]
movzx dx, r15b
mov dx, 0x738f
lea rdx, [rsp + 0x20]
jmp 0x140447090
call qword [rax + 0xa8]
movaps xmm6, xmmword [rsp + 0x30]
and si, 0x608e
inc sil
movaps xmm7, xmmword [rsp + 0x40]
shld si, r9w, 0x90
movaps xmm8, xmmword [rsp + 0x50]
sub sil, 0x6e
clc
movaps xmm9, xmmword [rsp + 0x60]
add rsp, 0x70
movzx si, r12b
movsxd rsi, ebp
pop rsi
jmp 0x1404470d1
ret

Function at 0x14044837f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
btr r8, rbx
mov r8, rcx
or rax, r8
mov eax, 0x5a4d
jmp 0x140448398
cmp word [0x140000000], ax
jmp 0x1404483a4
jne 0x1404484bd
movsxd rcx, dword [0x14000003c]
movsx rdx, bp
shr dh, 0x9d
lea rdx, [0x140000000]
cmc
clc
cmp ebp, eax
add rcx, rdx
cmp dword [rcx], 0x4550
jmp 0x1404483d1
jne 0x1404484bd
mov eax, 0x20b
jmp 0x1404483e1
cmp word [rcx + 0x18], ax
jne 0x1404484bd
sub r8, rdx
movzx edx, word [rcx + 0x14]
rol r9d, 8
btc ax, r9w
bt rax, rsp
add rdx, 0x18
cmp r10, 0x5cfb3ee8
lea rdx, [rdx + rcx]
shrd eax, r8d, 0x56
movzx eax, word [rcx + 6]
neg cx
bswap r9d
movsx r9w, r8b
lea rcx, [rax + rax*4]
bt r9w, r15w
bsr r9w, r9w
shr r9w, 0xc0
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x140448445
je 0x14044847a
mov ecx, dword [rdx + 0xc]
cmc
stc
cmp r8, rcx
jb 0x14044846c
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jmp 0x140448466
jb 0x14044847c
add rdx, 0x28
jmp 0x140448475
jmp 0x140448439
xor edx, edx
test rdx, rdx
jmp 0x140448484
jne 0x140448496
xor al, al
jmp 0x140448491
jmp 0x1404484cb
cmp dword [rdx + 0x24], 0
jmp 0x14044849f
jge 0x1404484b1
sub al, al
jmp 0x1404484ac
jmp 0x1404484cb
mov al, 1
jmp 0x1404484b8
jmp 0x1404484cb
sub al, al
jmp 0x1404484c4
jmp 0x1404484cb
add rsp, 0x18
jmp 0x1404484d4
ret
Function at 0x140459ed7
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
shrd bx, r15w, 0x68
movzx eax, r13w
bsf ax, r13w
push rbp
movzx ebx, r15w
mov rbp, rsp
movzx ax, dil
movsxd rbx, eax
not bl
sub rsp, 0x20
sub ah, 0x71
mov rax, qword [0x1400b7288]
btc bx, r9w
movabs rbx, 0x2b992ddfa232
clc
jmp 0x140459f20
cmp rax, rbx
jmp 0x140459f28
jne 0x14045a000
and qword [rbp + 0x18], 0
lea rcx, [rbp + 0x18]
jmp 0x140459f3c
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140459f4b
mov qword [rbp + 0x10], rax
jmp 0x140459f54
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x140459f65
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
cmc
clc
xor qword [rbp + 0x10], rax
jmp 0x140459f7c
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
bt cx, 0xb
lea rcx, [rbp + 0x10]
stc
cmp bp, bx
shl rax, 0x20
cmp r11w, di
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
xor rax, rcx
not ebp
rol bpl, 0xc9
movabs rcx, 0xffffffffffff
bts rbp, rsi
ror bpl, 0x2f
sbb bpl, 0xc7
and rax, rcx
xadd cl, ch
movsx rbp, r9w
movabs rcx, 0x2b992ddfa233
shld ebp, edx, 0x7a
btr ebp, 0x51
cmp rax, rbx
sets bl
movsx bx, dl
movzx bx, sil
cmove rax, rcx
seto bpl
and bl, r11b
mov qword [0x1400b7288], rax
add ebp, ebx
mov rbx, qword [rsp + 0x48]
not rax
cmovg bp, bp
mov qword [0x1400b7280], rax
sub rbp, 0x7c470ecb
rcl bp, 0xa9
add rsp, 0x20
pop rbp
jmp 0x14045a028
ret