joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403e30fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
jmp 0x1403e310e
push r14
push rsi
test r10w, r8w
jmp 0x1403e311a
push rdi
test r13d, r14d
movsx rdi, r15w
push rbx
test eax, ecx
bts edi, r8d
sar dil, 0x90
sub rsp, 0x30
add di, r14w
movaps xmmword [rsp + 0x20], xmm6
adc dil, r11b
xor di, si
neg dil
mov rdi, qword [rcx]
test rdi, rdi
jmp 0x1403e314e
je 0x1403e3298
mov r14, rcx
mov rbx, qword [rcx + 8]
clc
test r15w, bx
cmp rdi, rbx
jmp 0x1403e3168
je 0x1403e3216
lea r15, [0x1400beb30]
xorps xmm6, xmm6
jmp 0x1403e31b6
lea rsi, [rdi + 0x18]
call fcn.140217864
movups xmmword [rsi], xmm6
test r11, rsp
jmp 0x1403e3191
mov qword [rsi + 0x10], 0
cmp dl, dil
add rdi, 0x30
test r13d, 0x70153da8
clc
cmp rdi, rbx
jmp 0x1403e31b0
je 0x1403e3213
mov qword [rdi], r15
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1403e319c
mov rdx, qword [rdi + 0x28]
stc
test al, r11b
sub rdx, rcx
cmc
cmp rdx, 0x1000
jb 0x1403e317d
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp dx, r11w
test r14b, 0xfa
jmp 0x1403e31f4
sub rcx, rax
stc
cmp rcx, 0x20
jae 0x1403e32e5
add rdx, 0x27
mov rcx, rax
jmp 0x1403e320e
jmp 0x1403e317d
mov rdi, qword [r14]
mov rdx, qword [r14 + 0x10]
jmp 0x1403e3222
sub rdx, rdi
cmp cl, r15b
test rcx, 0x76776731
cmp rdx, 0x1000
jmp 0x1403e323b
jb 0x1403e3274
mov rax, qword [rdi - 8]
cmc
add rdi, 0xfffffffffffffff8
stc
sub rdi, rax
stc
cmp rdi, 0x20
jmp 0x1403e3258
jae 0x1403e32e5
add rdx, 0x27
xchg cl, dil
movsx cx, sil
mov rdi, rax
mov cx, ax
movzx rcx, di
mov rcx, rdi
call fcn.140217864
xorps xmm0, xmm0
movups xmmword [r14], xmm0
cmp r15b, 0xea
mov qword [r14 + 0x10], 0
bt r15, 0xdb
movzx ebx, r12w
movaps xmm6, xmmword [rsp + 0x20]
rol di, cl
movsx rsi, r15w
movsx r14w, sil
add rsp, 0x30
not r15d
xchg r15d, esi
pop rbx
not dil
setne r14b
movzx r14, bp
pop rdi
cmova r15d, esi
movsxd r15, edx
xchg r15b, sil
pop rsi
movsx r15, r11w
movzx r14, di
pop r14
cmovs r15, r12
bswap r15w
pop r15
jmp 0x1403e32e4
ret
call fcn.1404aef74
int3
Function at 0x1403ea72d
Capabilities:
Check for software breakpoints

Disassembly:
push r14
shld r14, r8, 0x6b
push rsi
movzx r14, r13w
push rdi
bts rsi, r14
sub r14b, r14b
push rbx
setl al
stc
rcr sil, cl
sub rsp, 0x28
mov sil, 0x45
bsr si, r11w
movzx ebx, si
mov rbx, rdx
xor r14b, 0xec
xadd ah, ah
lahf
mov r14, rcx
lea rsi, [rdx + r8]
shrd ax, r8w, 0x61
rol eax, 0x8c
mov eax, dword [rcx + 8]
cmp r12b, sil
clc
test al, 2
jmp 0x1403ea781
jne 0x1403ea81f
mov dil, 1
test al, 4
je 0x1403ea949
lea rax, [rbx + 1]
clc
cmp rax, rsi
jmp 0x1403ea79f
ja 0x1403ea947
mov byte [rbx], 0x12
movsx rcx, dx
shl cx, cl
mov rcx, qword [r14 + 0x40]
test r8b, 1
test r11d, esi
cmp rcx, 0x80
jb 0x1403ea90a
nop word cs:[rax + rax]
lea rdx, [rax + 1]
cmp rdx, rsi
jmp 0x1403ea7dd
ja 0x1403ea947
mov ebx, ecx
clc
test bh, 0x5b
or bl, 0x80
mov byte [rax], bl
and rax, rdx
rol al, cl
mov rbx, rcx
shld ax, bx, 0x94
shr rbx, 7
mov rax, rdx
jmp 0x1403ea807
cmp rcx, 0x3fff
mov cl, r8b
mov rcx, rbx
ja 0x1403ea7d1
jmp 0x1403ea916
test r8, r8
jle 0x1403ea947
mov byte [rbx], 0xa
inc rbx
rcl cx, cl
clc
mov rcx, qword [r14 + 0x20]
cmp ah, ch
test cx, 0x3ba0
cmc
cmp rcx, 0x80
jmp 0x1403ea84a
jb 0x1403ea8a9
nop dword [rax + rax]
lea rax, [rbx + 1]
clc
cmp rax, rsi
jmp 0x1403ea865
ja 0x1403ea947
mov edx, ecx
cmp cl, dl
or dl, 0x80
mov byte [rbx], dl
movzx rbx, r15w
mov rdx, rcx
rcl bl, 0x66
shr rdx, 7
mov rbx, rax
cmp r11b, 0xcc
cmc
cmp rcx, 0x3fff
setl cl
xchg ch, ch
mov rcx, rdx
jmp 0x1403ea89e
ja 0x1403ea858
jmp 0x1403ea8b5
mov rax, rbx
stc
mov rdx, rcx
not ch
rol rcx, cl
lea rcx, [rax + 1]
cmp rcx, rsi
jmp 0x1403ea8c1
ja 0x1403ea947
mov byte [rax], dl
movzx rbx, r14w
mov r8, qword [r14 + 0x20]
bsr ebx, eax
lea rbx, [rcx + r8]
cmp dil, 0x6d
cmc
stc
cmp rbx, rsi
jmp 0x1403ea8e6
ja 0x1403ea947
cmp qword [r14 + 0x28], 0x10
jmp 0x1403ea8f6
jb 0x1403ea970
mov rdx, qword [r14 + 0x10]
jmp 0x1403ea905
jmp 0x1403ea979
mov rdx, rax
bts bx, sp
mov rbx, rcx
cmp edi, ebx
lea rcx, [rdx + 1]
jmp 0x1403ea920
cmp rcx, rsi
ja 0x1403ea947
mov byte [rdx], bl
cmc
mov r8, qword [r14 + 0x40]
shld eax, r8d, 0x3b
lea rax, [rcx + r8]
cmp rax, rsi
jmp 0x1403ea941
jbe 0x1403ea98c
xor edi, edi
mov eax, edi
add rsp, 0x28
pop rbx
not di
mov edi, r9d
movzx r14, di
pop rdi
pop rsi
movsx r14w, r15b
xchg r14, r14
cmovge r14d, r8d
pop r14
jmp 0x1403ea96f
ret
lea rdx, [r14 + 0x10]
jmp 0x1403ea979
call fcn.14049c53b
mov eax, dword [r14 + 8]
jmp 0x1403ea987
jmp 0x1403ea787
cmp qword [r14 + 0x48], 0x10
jmp 0x1403ea996
jb 0x1403ea9aa
mov r14, qword [r14 + 0x30]
jmp 0x1403ea9a5
jmp 0x1403ea9bb
add r14, 0x30
cmova dx, r15w
sets dh
movzx dx, sil
mov rdx, r14
jmp 0x1403ea9c3
call fcn.14049c53b
jmp 0x1403ea949
Function at 0x1403ee9a3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
movzx r14, si
push r12
rcl r14b, 0xe0
adc r14, r10
push rsi
push rdi
shl r14b, 0x92
sal r14b, 0x49
ror r14d, cl
push rbx
btc r14w, 0xc4
add r14d, 0x6e7c303a
sub rsp, 0x28
mov r14, r8
test rdx, rdx
jmp 0x1403ee9de
je 0x1403eebc5
mov rdi, rdx
sar r12b, cl
bts r12, rbp
mov r12, rcx
cmp dil, r13b
clc
sub ebx, ebx
jmp 0x1403eea26
mov rcx, r15
bswap dx
jmp 0x1403eea07
mov rdx, rsi
jmp 0x1403eea0f
call fcn.1403b3ea5
add rbx, 0x50
jmp 0x1403eea1d
dec rdi
je 0x1403eebbc
mov eax, dword [r12 + rbx + 8]
mov dword [r14 + rbx + 8], eax
stc
cmp r14, r12
jmp 0x1403eea39
je 0x1403eea14
cmp qword [r12 + rbx + 0x28], 0x10
jmp 0x1403eea4a
jb 0x1403eea5f
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403eea5a
jmp 0x1403eea71
lea r9, [r12 + rbx]
rcr ah, 0xee
movsx rax, r13w
add r9, 0x10
rcr r15b, cl
lea r15, [r14 + rbx]
movzx rsi, r10w
bsr eax, esp
add r15, 0x10
cwde
shl al, cl
mov rsi, qword [r12 + rbx + 0x20]
mov rax, qword [r14 + rbx + 0x28]
cmp rax, rsi
jmp 0x1403eea95
jae 0x1403eeab5
mov rcx, r15
movzx dx, r12b
mov rdx, rsi
jmp 0x1403eeaab
call fcn.1403b3ea5
jmp 0x1403eeaff
cmp rax, 0x10
jb 0x1403eead0
mov r15, qword [r14 + rbx + 0x10]
movzx edx, r9w
movzx rdx, r14w
mov dx, 0x3dc4
mov qword [r14 + rbx + 0x20], rsi
movzx rcx, cx
mov dh, 0x6c
cqo
mov rcx, r15
mov rdx, r9
mov r8w, 0x23a8
mov r8, rsi
jmp 0x1403eeaf1
call fcn.14049c53b
mov byte [r15 + rsi], 0
setne sil
mov rsi, qword [r12 + rbx + 0x40]
cmp qword [r12 + rbx + 0x48], 0x10
jmp 0x1403eeb0f
jb 0x1403eeb1f
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403eeb37
lea r9, [r12 + rbx]
rcl ax, 0xd9
rcr r15b, cl
dec ax
add r9, 0x30
not ax
sub r15b, r13b
lea r15, [r14 + rbx]
and ax, r10w
or al, bl
add r15, 0x30
xor eax, 0x1daf7a73
cmp r15w, 0x1236
add eax, 0x4f4d1674
mov rax, qword [r14 + rbx + 0x48]
test bx, 0xda0
cmp dil, r15b
cmp rax, rsi
jmp 0x1403eeb6a
jb 0x1403ee9fc
cmp rax, 0x10
jmp 0x1403eeb79
jb 0x1403eeb84
mov r15, qword [r14 + rbx + 0x30]
mov qword [r14 + rbx + 0x40], rsi
movzx r8, ax
mov cl, dh
mov rcx, r15
xchg r8b, dl
seta dl
movsx dx, r8b
mov rdx, r9
mov r8, rsi
jmp 0x1403eeba8
call fcn.14049c53b
mov byte [r15 + rsi], 0
jmp 0x1403eebb7
jmp 0x1403eea14
lea r14, [r14 + rbx]
sub bx, 0x1bf9
mov rax, r14
sbb r14w, 0x220
movsx r12w, spl
shrd esi, edi, 0x10
add rsp, 0x28
mov r15, rsi
pop rbx
jmp 0x1403eebed
pop rdi
movzx esi, bp
movzx r12w, r15b
setp sil
pop rsi
pop r12
pop r14
movsx r15, r14w
jmp 0x1403eec08
pop r15
jmp 0x1403eec0f
ret
Function at 0x14042716f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
xor sil, cl
sal ax, cl
push rdi
push rbx
sub rsp, 0x20
rcl rsi, cl
xadd eax, eax
shld rax, rbx, 0xb4
mov rsi, rcx
add al, 0x6c
or ax, cx
movzx eax, byte [rcx + 0x4828]
cmp si, 0x6982
cmp al, 0xff
jmp 0x1404271a2
je 0x1404271b4
mov byte [rsi + 0x4828], 0xff
jmp 0x1404272db
mov rbx, qword [rsi]
shl rax, 0x46
mov rax, qword [rbx + 0xc0]
cmc
cmp rax, qword [rbx + 0xc8]
jmp 0x1404271cf
jae 0x1404271f5
lea rcx, [rax + 1]
jmp 0x1404271de
mov qword [rbx + 0xc0], rcx
mov cx, dx
jmp 0x1404271ed
movzx ecx, byte [rax]
jmp 0x1404272c3
cmp dword [rbx + 0x30], 0
jmp 0x1404271fe
je 0x14042727b
mov r8d, dword [rbx + 0x34]
movsx edi, r15w
cmovns edx, r14d
lea rdi, [rbx + 0x38]
cqo
not cl
movzx edx, si
mov rcx, qword [rbx + 0x28]
xchg dh, dl
movzx edx, si
movzx rdx, r11w
mov rdx, rdi
jmp 0x140427230
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
clc
jmp 0x140427240
sub ecx, dword [rbx + 0xd0]
test esp, ebp
cmc
add dword [rbx + 0xb8], ecx
jmp 0x140427259
test eax, eax
je 0x140427282
cdqe
shl rcx, 0x9e
add rax, rdi
movzx rcx, r12w
movzx ecx, byte [rdi]
jmp 0x140427276
jmp 0x1404272a2
mov al, 0xff
jmp 0x1404272db
mov dword [rbx + 0x30], 0
btc ax, 0x18
sbb rax, r15
stc
lea rax, [rbx + 0x39]
mov byte [rbx + 0x38], 0
jmp 0x1404272a0
sub ecx, ecx
mov qword [rbx + 0xc8], rax
rol al, 0x27
bswap ax
bt eax, ecx
lea rax, [rbx + 0x39]
cmp sil, 0x93
mov qword [rbx + 0xc0], rax
rcl al, cl
mov al, 0xff
cmp r9d, 0xfed715a
clc
cmp cl, 0xff
jmp 0x1404272d5
je 0x14042731b
add rsp, 0x20
pop rbx
mov dil, 0xb3
jmp 0x1404272eb
pop rdi
xchg si, si
movsx esi, r8w
mov sil, r9b
pop rsi
ret
lea rcx, [rax + 1]
test r14b, 0xfb
jmp 0x140427305
mov qword [rbx + 0xc0], rcx
movzx eax, byte [rax]
test r10b, 4
cmp al, 0xff
jne 0x1404272db
mov rbx, qword [rsi]
mov rax, qword [rbx + 0xc0]
clc
test r11b, 0xfe
cmp rax, qword [rbx + 0xc8]
jb 0x1404272f8
cmp dword [rbx + 0x30], 0
je 0x14042740b
mov r8d, dword [rbx + 0x34]
not dx
lea rdi, [rbx + 0x38]
cqo
bswap dx
movsx cx, r11b
mov rcx, qword [rbx + 0x28]
setae dh
movzx rdx, cx
cdq
mov rdx, rdi
jmp 0x14042736a
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
cmp al, 0x31
cmp r15b, r14b
sub ecx, dword [rbx + 0xd0]
test r12d, eax
cmp r9d, 0x712423f2
add dword [rbx + 0xb8], ecx
test r15d, 0x6f2d5b36
cmc
jmp 0x14042739b
test eax, eax
jmp 0x1404273a2
je 0x1404273bd
movsxd rcx, eax
add rcx, rdi
xchg ah, ah
movzx eax, byte [rdi]
jmp 0x1404273b8
jmp 0x1404273d7
mov dword [rbx + 0x30], 0
lea rcx, [rbx + 0x39]
stc
test r12d, 0x40636636
mov byte [rbx + 0x38], 0
clc
sub eax, eax
mov qword [rbx + 0xc8], rcx
bswap ecx
lea rcx, [rbx + 0x39]
test dil, r13b
mov qword [rbx + 0xc0], rcx
cmp dil, dil
test bp, 0x1645
test r13b, dil
cmp al, 0xff
jmp 0x140427400
je 0x14042731b
jmp 0x1404272db
sub eax, eax
jmp 0x140427412
jmp 0x1404272db
Function at 0x140438573
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub rsp, 0x88
jmp 0x140438585
movaps xmmword [rsp + 0x70], xmm6
movsx ax, bpl
cmc
mov rax, qword [rcx]
stc
cmp di, bp
cmp qword [rax + 0x18], 8
jmp 0x1404385a1
jb 0x1404385aa
mov rax, qword [rax]
movsxd rdx, edx
jmp 0x1404385b2
lea rax, [rax + rdx*2]
cdq
sbb dl, 0xf0
bts dx, ax
movsxd rdx, r8d
cmc
stc
cmp word [rax + rdx*2], 0xa
jne 0x1404385e0
movss xmm6, dword [0x1400bd560]
jmp 0x1404385db
jmp 0x1404386fe
test byte [rcx + 0x1c], 4
jmp 0x1404385e9
jne 0x1404386f0
lea r9, [rax + rdx*2]
mov rcx, qword [rcx + 0x10]
movsd xmm0, qword [0x1400bfca0]
movsx r8d, r13w
movsxd r8, r12d
movzx rdx, r11w
movsd qword [rsp + 0x40], xmm0
mov r8b, 0x54
mov dword [rsp + 0x30], 1
cwd
movsx dx, bpl
movzx rdx, r11w
mov dword [rsp + 0x28], 0
movzx rdx, r10w
movsx r8, r8w
setp r8b
mov dword [rsp + 0x20], 0
not dl
lea rdx, [rsp + 0x38]
movzx r8w, r8b
setbe r8b
not r8b
lea r8, [rsp + 0x40]
call fcn.14043eab9
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
cwd
rdtsc
movzx edx, r15w
mov dword [rsp + 0x60], 0
rdtsc
not ax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
cdq
lea rdx, [rsp + 0x40]
call qword [rax + 0x1e0]
test eax, eax
jmp 0x14043869c
je 0x1404386c8
mov ecx, eax
movabs r8, 0xe31b45c42a775183
mov dl, 3
not r9b
movsx r9w, spl
mov r9d, 0x4f
jmp 0x1404386c3
call fcn.1403a847c
movss xmm6, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x38]
test cx, r12w
test rcx, rcx
je 0x1404386fe
mov rax, qword [rcx]
jmp 0x1404386e8
call qword [rax + 0x10]
jmp 0x1404386fe
movss xmm6, dword [0x1400bfc14]
jmp 0x1404386fe
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x70]
stc
add rsp, 0x88
jmp 0x140438713
ret
Function at 0x14043905d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rol r15w, 0x23
rcl r15b, cl
rcr r15d, cl
push r14
sbb r14d, 0x20940416
push rsi
rcr r14b, 0xc7
adc r15b, 0x6c
push rdi
push rbp
shr bpl, cl
push rbx
sub rsp, 0x28
ror ebx, 0xe4
mov r15d, r9d
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
lea rcx, [rdx + 0x20]
btr rdx, 0x12
test r10w, si
movzx rdx, r10w
mov edx, r8d
shl r8, 0x34
rcl r8w, cl
shr r8b, 0x52
mov r8d, r9d
xor r9d, r9d
call fcn.140439294
test r15d, r15d
jmp 0x1404390c8
jle 0x14043916e
test rax, rax
jmp 0x1404390d6
je 0x14043916e
movsxd rsi, ebp
mov ecx, r15d
cmp bp, r9w
btc rdx, rbp
movzx rdx, r12w
sub ebp, ebp
mov rdx, rsi
jmp 0x1404390f8
jmp 0x140439123
movzx edi, word [rdi + rdx*2]
jmp 0x140439106
mov word [rax + rbp*2], di
inc rbp
jmp 0x140439112
inc rdx
cmp rcx, rbp
jmp 0x14043911d
je 0x140439175
mov di, 0x2a
test byte [rbx + 0x1c], 4
jmp 0x140439130
jne 0x140439106
mov rdi, qword [rbx]
jmp 0x140439142
cmp qword [rdi + 0x10], rdx
jmp 0x14043914b
jbe 0x140439289
cmp qword [rdi + 0x18], 8
jmp 0x14043915b
jb 0x1404390fd
mov rdi, qword [rdi]
jmp 0x140439169
jmp 0x1404390fd
movsxd rsi, ebp
bsf rcx, r11
mov rbx, qword [rbx]
stc
sbb ecx, esp
shr rdi, 0xe3
mov rdi, qword [rbx + 0x10]
ror cl, cl
or cl, sil
mov rcx, rdi
sub rcx, rsi
jb 0x140439289
movsxd rax, r15d
cmp rcx, rax
jmp 0x14043919f
cmovb rax, rcx
movsx ecx, bp
sbb cl, bl
cmove ecx, r15d
cmp qword [rbx + 0x18], 8
xchg ch, ch
movsx ecx, sp
movsx rcx, sp
mov rcx, rbx
jmp 0x1404391c2
jb 0x1404391d4
mov rcx, qword [rbx]
shr dl, cl
cwd
bt r8, 0xbf
lea rcx, [rcx + rsi*2]
shl bpl, cl
bsr r8w, r12w
movzx r8d, r13w
sub rdi, rax
sar bpl, 0x6c
movsxd rbp, edx
mov rbp, rdi
cmp bpl, dil
xor r8b, spl
sub rbp, rsi
setb r8b
rcr r8b, 0x80
rol r8, cl
lea rdx, [rcx + rax*2]
lea r8, [rbp + 2]
stc
test r13b, bpl
add r8, rbp
jmp 0x14043921d
call fcn.14049c53b
mov qword [rbx + 0x10], rdi
jmp 0x14043922f
mov byte [r14 + 0x16], 0
btc di, r9w
cmovbe ebx, esi
sar r14b, 4
add rsp, 0x28
movsxd r14, r13d
movzx si, cl
pop rbx
pop rbp
xchg r14w, r14w
movzx rsi, r12w
jmp 0x14043925a
pop rdi
mov esi, 0x4f431c2e
movzx si, dil
bswap rsi
pop rsi
movsx r14, dx
mov r15b, cl
movzx r14w, al
pop r14
movzx r15d, si
xchg r15, r15
not r15b
pop r15
jmp 0x140439288
ret
call fcn.140438714
int3
Function at 0x14043d25b
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx ecx, cx
jmp 0x14043d267
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
cmc
cmp esp, 0x10076e9b
add rsp, 0x28
jmp 0x14043d288
ret

Function at 0x14043e9c5
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
bswap ax
mov rax, qword [rcx]
jmp 0x14043e9d7
call qword [rax + 0x28]
test eax, eax
jmp 0x14043e9e1
je 0x14043ea1b
mov ecx, eax
xor r9b, r12b
movabs r8, 0xcafa59766d7f94e
mov r9b, 0x6b
mov dl, 3
bsr r9d, r15d
neg r9b
test r14b, 0xd4
mov r9d, 0x2a
clc
cmp dx, 0x1ae1
add rsp, 0x28
jmp fcn.1403a847c
nop
jmp 0x14043ea21
add rsp, 0x28
jmp 0x14043ea2a
ret
Function at 0x14043f456
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
shld r14, rbx, 0xd
bsf eax, ecx
push rsi
sub al, r13b
push rdi
xor r14b, 0xcc
push rbx
ror r14b, cl
mov al, 0xde
sub rsp, 0x58
movzx r14, cx
mov r14b, 0xe3
mov rax, r9
setp r14b
mov r9, 0x519e4ee2
mov r14, rdx
cmovl r9w, sp
mov r9d, dword [rsp + 0xa0]
jmp 0x14043f49d
movd xmm0, r8d
shr r8, 0x20
jmp 0x14043f4ab
movd xmm1, r8d
mov qword [rdx], 0
jmp 0x14043f4bc
cvttss2si r8d, xmm1
test r8d, r8d
jmp 0x14043f4c9
jle 0x14043f5ee
cvttss2si r10d, xmm0
sub r11d, r11d
test r8b, r9b
movss xmm2, dword [0x1400bf4c0]
stc
sub ebx, ebx
jmp 0x14043f4ea
jmp 0x14043f508
inc ebx
cmc
jmp 0x14043f4f7
add r11d, r9d
cmp ebx, r8d
jmp 0x14043f502
je 0x14043f5ee
mov rsi, r10
mov edx, r11d
test r10d, r10d
jmp 0x14043f516
jg 0x14043f5a8
jmp 0x14043f4ef
movzx edi, dil
jmp 0x14043f52a
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
jmp 0x14043f53e
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
mov rdi, rdx
movzx rdi, r9w
not di
movzx edi, byte [rax + rdx + 1]
jmp 0x14043f565
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
movzx edi, byte [rax + rdx + 2]
jmp 0x14043f583
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
add edx, 4
jmp 0x14043f59f
dec rsi
je 0x14043f4ef
mov edx, edx
inc dil
movzx edi, byte [rax + rdx + 3]
cmp r8, r9
cmp edi, 0x181c79cb
cmp edi, 0xff
jmp 0x14043f5c6
je 0x14043f597
test edi, edi
jmp 0x14043f5d3
jne 0x14043f521
mov byte [rax + rdx + 2], 0
mov word [rax + rdx], 0
jmp 0x14043f5e9
jmp 0x14043f597
mov rcx, qword [rcx + 0x18]
cmovno edx, eax
movabs rdx, 0x10000001c
jmp 0x14043f604
mov qword [rsp + 0x38], rdx
movsd xmm2, qword [0x1400bfee0]
jmp 0x14043f616
movsd qword [rsp + 0x40], xmm2
jmp 0x14043f621
mov dword [rsp + 0x48], 0
jmp 0x14043f62e
mov qword [rsp + 0x50], 0
jmp 0x14043f63c
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
rol r8w, cl
bt rdi, rcx
mov edx, edx
or rdx, rbx
mov rbx, qword [rcx]
mov qword [rsp + 0x28], r14
movsxd rdi, r15d
xchg r8, r8
lea rdi, [rsp + 0x38]
xchg r8b, r8b
seta r8b
mov qword [rsp + 0x20], rdi
setge r8b
mov r8b, r13b
mov r8, rax
jmp 0x14043f685
call qword [rbx + 0x1c8]
test eax, eax
jmp 0x14043f692
je 0x14043f6cc
mov ecx, eax
movzx r9d, bx
movabs r8, 0xad4a5352d2edebd0
jmp 0x14043f6ad
mov dl, 3
movsx r9, r11w
jmp 0x14043f6bc
mov r9d, 0xd4
jmp 0x14043f6c7
call fcn.1403a847c
mov rax, r14
or r14b, 0x94
xor r14b, 0xc6
add rsp, 0x58
movsx bx, bl
not di
pop rbx
pop rdi
xchg r14b, r14b
pop rsi
pop r14
jmp 0x14043f6ef
ret
Function at 0x140441945
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
ror r8b, cl
not r8w
xor r8b, dil
mov r8, rcx
xor al, 5
mov eax, 0x5a4d
cmc
cmp word [0x140000000], ax
jmp 0x14044196a
jne 0x140441a7d
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp r13w, ax
cmp dword [rcx], 0x4550
jmp 0x140441990
jne 0x140441a7d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1404419a4
jne 0x140441a7d
sub r8, rdx
rcl eax, cl
sal ax, 0xda
setae ah
movzx edx, word [rcx + 0x14]
sub al, r9b
clc
add rdx, 0x18
xadd ax, ax
shr r9b, 0xda
cmp r15b, r14b
lea rdx, [rdx + rcx]
stc
movzx eax, word [rcx + 6]
xchg ecx, ecx
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
clc
cmc
cmp cx, r15w
mov qword [rsp], rdx
clc
stc
jmp 0x1404419f1
cmp rdx, r9
jmp 0x1404419f9
je 0x140441a43
mov ecx, dword [rdx + 0xc]
clc
cmp si, r14w
test ebp, 0x69074bfe
cmp r8, rcx
jmp 0x140441a15
jb 0x140441a35
mov eax, dword [rdx + 8]
stc
add eax, ecx
stc
test cl, spl
cmp r12d, 0x1de22763
cmp r8, rax
jb 0x140441a46
add rdx, 0x28
jmp 0x140441a3e
jmp 0x1404419e6
xor edx, edx
cmc
test rdx, rdx
jmp 0x140441a4e
jne 0x140441a5b
sub al, al
jmp 0x140441a93
cmp dword [rdx + 0x24], 0
jmp 0x140441a64
jge 0x140441a71
xor al, al
jmp 0x140441a93
mov al, 1
jmp 0x140441a78
jmp 0x140441a93
sub al, al
jmp 0x140441a84
jmp 0x140441a93
add rsp, 0x18
jmp 0x140441a9c
ret
Function at 0x14044271e
Capabilities:
Check for software breakpoints

Disassembly:
mov rax, rsp
clc
jmp 0x140442732
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
test r14d, 0x2bc54e23
cmp r12b, 0xcc
mov qword [rax + 0x20], rsi
sub sil, r12b
clc
jmp 0x140442752
push rdi
jmp 0x140442759
sub rsp, 0x20
rcl sil, cl
mov sil, cl
sub cx, 0x975
xchg ecx, ecx
xor edx, edx
jmp 0x140442778
lea rcx, [rax + 8]
jmp 0x140442781
call fcn.140441d34
nop
shl bh, cl
cmp dl, r13b
mov rbx, qword [0x1400b9548]
test r12b, 0xb7
test rbx, rbx
jmp 0x14044279f
jne 0x1404428b6
sub ecx, ecx
jmp 0x1404427ac
call fcn.14044222f
mov rbx, rax
movsxd rcx, ecx
movzx rcx, r8w
mov cx, 0x2621
mov rcx, rax
call fcn.140442913
mov dword [rbx + 0x20], 0x3f
bswap ecx
bt cx, 0x5c
mov rcx, qword [rbx + 0x28]
bts rbp, rbp
xor bpl, r12b
btr ebp, eax
lea rbp, [0x1400ced04]
cmp rcx, rbp
je 0x140442878
test rcx, rcx
jmp 0x1404427fb
je 0x140442806
call fcn.14029196c
and qword [rbx + 0x28], 0
mov rdi, rbp
jmp 0x140442813
inc rdi
clc
cmp di, di
cmp byte [rdi], 0
jmp 0x140442822
jne 0x140442813
inc rdi
adc ecx, r11d
rol ch, 0x7b
bts rcx, rcx
sub rdi, rbp
setne ch
movsx ecx, di
mov rcx, rdi
call fcn.140118f4a
mov qword [rbx + 0x28], rax
test rax, rax
jmp 0x140442852
je 0x140442878
mov r8, rdi
cdq
xchg cl, dh
mov cl, r14b
mov rdx, rbp
movsx rcx, r9w
bswap cx
movzx cx, r15b
mov rcx, rax
call fcn.14049c53b
mov qword [0x1400b94f8], rbx
mov rax, qword [rbx]
xchg cx, cx
movsx cx, r15b
cmova cx, r15w
mov rcx, rbx
mov rax, qword [rax + 8]
jmp 0x14044289b
call qword [case.0x140441720.0]
mov rax, qword [0x1400b94f8]
stc
test r11b, 0x12
mov qword [0x1400b9528], rax
stc
cmc
test sil, sil
jmp 0x1404428be
je 0x1404428e2
mov rax, qword [rbx]
movsx ecx, dx
mov rcx, rbx
jmp 0x1404428d2
mov rax, qword [rax + 8]
jmp 0x1404428db
call qword [case.0x140441720.0]
nop
lea rcx, [rsp + 0x30]
call fcn.140441db2
mov rax, rbx
cmp r14, rdx
test r11b, 0x32
mov rbx, qword [rsp + 0x38]
ror dil, 0xb7
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
cmovnp rdi, r9
pop rdi
ret
Function at 0x140452637
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test r8b, r14b
push rdi
sub rsp, 0x20
jmp 0x140452649
xorps xmm0, xmm0
sub eax, eax
movsx bx, r8b
movsx rbx, sp
movups xmmword [rcx], xmm0
movsx ebx, cx
mov rbx, rcx
jmp 0x140452665
movups xmmword [rcx + 0x10], xmm0
jmp 0x14045266e
mov qword [rcx + 0x20], rax
jmp 0x140452677
mov dword [rcx + 0x28], eax
call fcn.1404a36ce
mov dword [rbx], eax
jmp 0x140452686
call fcn.1404a29ef
mov dword [rbx + 4], eax
jmp 0x140452693
call fcn.1404a367c
xor edi, edi
and ecx, 0x7fc4cc6
neg ecx
rcl ecx, 0x42
mov rcx, qword [rax + 0x10]
mov eax, edi
add al, al
add al, 0xb5
test rcx, rcx
sete al
mov dword [rbx + 8], eax
test rcx, rcx
je 0x140452740
call fcn.1404a3c79
mov r9, rax
xor r10d, edi
mov r8d, edi
mov r10d, edi
cmp word [r9], di
jge 0x14045271d
mov rdx, r10
btc cx, r10w
sar rcx, cl
mov eax, r8d
shrd ecx, r9d, 0x2a
shr rdx, 3
btr cx, r13w
rcr rcx, 0xc0
and eax, 7
movzx ecx, r10w
movzx rcx, bx
bt cx, si
movzx ecx, byte [rdx + rbx + 0xc]
stc
bts ecx, eax
mov byte [rdx + rbx + 0xc], cl
jmp 0x14045271d
inc r8d
jmp 0x140452725
inc r10
cmp cx, ax
add r9, 2
test sp, r11w
cmp r8d, 0x100
jl 0x1404526d2
mov rax, rbx
add rdi, 0x21ed3aea
mov rbx, qword [rsp + 0x30]
rol dil, cl
movzx di, sil
add rsp, 0x20
mov di, di
movsx edi, dx
bswap di
pop rdi
jmp 0x14045276a
ret

Function at 0x1404533b2
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
cdqe
bsr bx, di
push rbp
movsxd rbx, eax
mov rbp, rsp
bswap ebx
sub rax, r9
xadd bx, ax
sub rsp, 0x20
neg al
and bl, r10b
mov rax, qword [0x1400b7288]
cmc
stc
movabs rbx, 0x2b992ddfa232
clc
test r15b, sil
cmp rax, rbx
jmp 0x1404533f5
jne 0x1404534cc
and qword [rbp + 0x18], 0
xchg ecx, ecx
bswap cx
movzx ecx, r12w
lea rcx, [rbp + 0x18]
jmp 0x140453412
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140453421
mov qword [rbp + 0x10], rax
jmp 0x14045342a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
clc
cmp r11w, 0x3c59
xor qword [rbp + 0x10], rax
jmp 0x140453442
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
sub cx, 0x5402
lea rcx, [rbp + 0x20]
jmp 0x14045345a
xor qword [rbp + 0x10], rax
jmp 0x140453463
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
dec ch
sbb cl, 0x3a
lea rcx, [rbp + 0x10]
jmp 0x14045347a
shl rax, 0x20
xor rax, qword [rbp + 0x20]
cmc
jmp 0x140453488
xor rax, qword [rbp + 0x10]
xor rax, rcx
movabs rcx, 0xffffffffffff
and rax, rcx
sbb ebp, 0x6b1023e9
inc rbp
movabs rcx, 0x2b992ddfa233
shl bpl, 0xdf
movsx bp, r10b
cmp rax, rbx
cmove rax, rcx
mov qword [0x1400b7288], rax
sar bpl, 0x14
bswap ebx
mov rbx, qword [rsp + 0x48]
neg bp
not rax
ror bpl, 0xac
mov bp, 0xe3b
shl bpl, cl
mov qword [0x1400b7280], rax
bts rbp, rdi
cmc
add rsp, 0x20
movzx ebp, r15w
setg bpl
pop rbp
jmp 0x140453500
ret