joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403fab70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
jmp 0x1403fab7d
push r14
push r12
bsf r14w, di
ror r14b, cl
push rsi
push rdi
shr r14d, 0xdc
push rbx
and r14w, 0x4c61
ror r14, 3
xor r14d, 0x495e72e5
sub rsp, 0x28
mov r14, r8
test rdx, rdx
jmp 0x1403fabb0
je 0x1403fad87
mov rdi, rdx
xchg r12, r12
mov r12, rcx
xor ebx, ebx
jmp 0x1403fabc6
jmp 0x1403fabfa
mov rcx, r15
cdq
bswap rdx
cmovo rdx, rsp
mov rdx, rsi
jmp 0x1403fabde
call fcn.1403c02d4
add rbx, 0x50
jmp 0x1403fabec
dec rdi
jmp 0x1403fabf4
je 0x1403fad7a
mov eax, dword [r12 + rbx + 8]
cmc
mov dword [r14 + rbx + 8], eax
cmp r14, r12
jmp 0x1403fac0d
je 0x1403fabe3
cmp qword [r12 + rbx + 0x28], 0x10
jmp 0x1403fac1e
jb 0x1403fac33
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403fac2e
jmp 0x1403fac47
lea r9, [r12 + rbx]
movzx ax, cl
add r9, 0x10
sbb si, 0x3f44
rcr sil, cl
lea r15, [r14 + rbx]
add r15, 0x10
btr si, 0xa3
mov rsi, qword [r12 + rbx + 0x20]
stc
movzx ax, dil
sar al, 2
mov rax, qword [r14 + rbx + 0x28]
jmp 0x1403fac6c
cmp rax, rsi
jae 0x1403fac88
mov rcx, r15
movsxd rdx, edx
mov rdx, rsi
call fcn.1403c02d4
jmp 0x1403facca
cmp rax, 0x10
jb 0x1403faca0
mov r15, qword [r14 + rbx + 0x10]
mov rdx, r11
cdq
movzx r8w, dil
mov qword [r14 + rbx + 0x20], rsi
mov rcx, r15
cdq
mov dh, al
mov rdx, r9
movsx r8w, sil
mov r8, rsi
jmp 0x1403facbb
call fcn.1404a8457
mov byte [r15 + rsi], 0
bsr si, r10w
mov rsi, qword [r12 + rbx + 0x40]
cmp qword [r12 + rbx + 0x48], 0x10
jb 0x1403facea
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403face5
jmp 0x1403facf8
lea r9, [r12 + rbx]
shl eax, cl
add r9, 0x30
cmc
mov r15b, 0x79
lea r15, [r14 + rbx]
neg al
shrd eax, r14d, 0
add r15, 0x30
setae al
mov rax, qword [r14 + rbx + 0x48]
jmp 0x1403fad14
cmp rax, rsi
jmp 0x1403fad1c
jb 0x1403fabcb
cmp rax, 0x10
jmp 0x1403fad2b
jb 0x1403fad3e
mov r15, qword [r14 + rbx + 0x30]
jmp 0x1403fad3e
mov qword [r14 + rbx + 0x40], rsi
xchg dl, r8b
mov rcx, r15
movsxd r8, r13d
movzx edx, r12w
mov rdx, r9
movsxd r8, esp
cmovbe r8w, r12w
bswap r8d
mov r8, rsi
jmp 0x1403fad66
call fcn.1404a8457
mov byte [r15 + rsi], 0
jmp 0x1403fad75
jmp 0x1403fabe3
add r14, rbx
setno ah
mov bl, 0x80
btr ax, 0x6c
mov rax, r14
sub r15b, 0x63
add rsp, 0x28
movsx r14d, dx
pop rbx
pop rdi
setb r14b
movsxd rsi, r13d
movsx r14, r13w
pop rsi
pop r12
xchg r15b, r14b
pop r14
mov r15b, 0x52
movzx r15, ax
setne r15b
pop r15
jmp 0x1403fadbd
ret
Function at 0x1403fb9ab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
cmc
test ax, dx
push rsi
push rdi
sub dil, 0xf6
cmp r15b, bl
push rbx
xor dil, dl
movzx di, r9b
sub rsp, 0x38
rcr dil, 0xf0
or edi, esi
rcr dil, cl
movaps xmmword [rsp + 0x20], xmm6
jmp 0x1403fb9da
mov rdi, qword [rcx]
clc
test rdi, rdi
jmp 0x1403fb9e6
je 0x1403fbb3c
mov r14, rcx
mov rbx, qword [rcx + 8]
cmp rdi, rbx
jmp 0x1403fb9fb
je 0x1403fbab5
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403fba3f
call fcn.1401a86e2
movups xmmword [rdi + 0x10], xmm6
mov byte [rdi], 0
cmp r11w, 0x2ffa
test r9w, dx
test r15, 0x6b4a52dc
add rdi, 0x20
test r11b, r10b
cmp rdi, rbx
jmp 0x1403fba39
je 0x1403fbaab
mov rax, qword [rdi + 0x18]
cmc
cmp r15b, r15b
cmp rax, 0x10
jmp 0x1403fba50
jb 0x1403fba12
mov rcx, qword [rdi]
lea rdx, [rax + 1]
stc
clc
cmp rdx, 0x1000
jb 0x1403fba0d
mov rsi, qword [rcx - 8]
stc
add rcx, 0xfffffffffffffff8
jmp 0x1403fba7a
sub rcx, rsi
test r14w, 0x33ea
cmc
cmp rcx, 0x20
jae 0x1403fbb82
add rax, 0x28
mov rdx, rax
jmp 0x1403fba9e
mov rcx, rsi
jmp 0x1403fbaa6
jmp 0x1403fba0d
mov rdi, qword [r14]
bswap dx
stc
movsxd rdx, ecx
mov rdx, qword [r14 + 0x10]
test ebp, r14d
sub rdx, rdi
clc
cmp rdx, 0x1000
jmp 0x1403fbacc
jb 0x1403fbb10
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
test r12d, r12d
clc
sub rdi, rax
test r14b, r12b
cmc
cmp rdi, 0x20
jmp 0x1403fbaee
jae 0x1403fbb82
add rdx, 0x27
movzx cx, al
bswap edi
movzx rdi, r11w
mov rdi, rax
bswap rcx
movzx cx, r13b
xchg rcx, rcx
mov rcx, rdi
call fcn.1401a86e2
xorps xmm0, xmm0
movups xmmword [r14], xmm0
movsx si, r8b
bt si, 0x5f
mov qword [r14 + 0x10], 0
shl sil, cl
adc r14w, di
rol bx, 0xee
movaps xmm6, xmmword [rsp + 0x20]
bswap r14d
mov r14b, 5
sal rbx, cl
add rsp, 0x38
movsx ebx, si
movzx di, r14b
movzx ebx, di
pop rbx
jmp 0x1403fbb66
pop rdi
movzx r14w, r8b
setb sil
pop rsi
movsx r14w, cl
movzx r14d, r13w
pop r14
jmp 0x1403fbb81
ret
call fcn.1404bae88
int3
Function at 0x140402f09
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
clc
cmp dx, bp
test r8, r8
jmp 0x140402f19
je 0x140402f8e
movzx r9d, word [r8]
test r9w, r9w
jmp 0x140402f2c
je 0x140402fc8
xor eax, eax
cmp dh, 0xaa
mov r10, rcx
cmc
nop dword [rax + rax]
cmp r12b, 0x22
cmp rdi, rsp
cmp rdx, rax
je 0x14040317b
mov word [r10], r9w
sbb r9b, spl
bsr r9, rcx
sal r9b, cl
add r10, 2
bswap r9w
movzx r9w, bl
movzx r9d, word [r8 + rax*2 + 2]
inc rax
test r9w, r9w
jmp 0x140402f80
jne 0x140402f4a
sub rdx, rax
jmp 0x140402fcb
movzx r9d, word [0x1400b8f10]
test r9w, r9w
jmp 0x140402f9f
je 0x140402fde
cmp rdx, 0x104
cmovg r8w, r11w
xchg r8b, r8b
mov r8d, 0x104
jmp 0x140402fbf
cmovb r8, rdx
jmp 0x140403109
mov r10, rcx
test rdx, rdx
jmp 0x140402fd3
jne 0x14040317b
jmp 0x140403185
mov rax, qword gs:[0x30]
dec r10b
bsf r9d, eax
movsx r9w, r8b
mov rax, qword [rax + 0x60]
cmp r8b, cl
test spl, 0xe8
mov rax, qword [rax + 0x18]
rcr r9b, cl
sbb r8b, r12b
mov rax, qword [rax + 0x10]
sbb r8b, 0x80
movzx r8d, word [rax + 0x58]
shr r10, cl
cmp dl, r11b
rcr r10b, cl
cmp r8, rdx
setnp r9b
cmovae r8, rdx
movsx r11d, di
mov r9, qword [rax + 0x60]
movzx r11d, word [r9]
and r10b, r14b
lea r10, [0x1400b8f10]
test r11w, 0x4df2
test r11w, r11w
je 0x1404030a9
xor eax, eax
nop word cs:[rax + rax]
cmp r8, rax
jmp 0x140403067
je 0x1404030b7
mov word [r10], r11w
jmp 0x140403076
add r10, 2
dec r11w
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x140403089
inc rax
test r11, 0x2e3c18ca
test r11w, r11w
jmp 0x14040309c
jne 0x14040305f
sub r8, rax
test bp, dx
clc
test r8, r8
jmp 0x1404030b1
je 0x1404030bd
mov word [r10], 0
movzx r9d, word [0x1400b8f10]
cmovp r10w, bx
sub r8b, r15b
cmp dx, 0x79ca
cmp rdx, 0x104
mov r8d, 0x104
movsx r10, r11w
cmovb r8, rdx
xor r10w, 0x5a6d
bsr r10w, di
bswap r10w
mov r10, rcx
cmp cl, r9b
test ah, 0x37
test r9w, r9w
je 0x14040316d
xor edx, edx
lea rax, [0x1400b8f10]
mov r10w, 0x13d9
shrd r10d, edi, 0x97
mov r10, rcx
clc
nop dword [rax + rax]
cmp r10, 0x61b02414
clc
cmp r8, rdx
je 0x14040317b
mov word [r10], r9w
or r9, 0x3bb55ebf
add r10, 2
jmp 0x14040314d
movzx r9d, word [rax + rdx*2 + 2]
jmp 0x140403158
inc rdx
test r9w, r9w
jmp 0x140403164
jne 0x140403130
sub r8, rdx
test r8, r8
jmp 0x140403175
je 0x140403185
mov word [r10], 0
movzx eax, r13w
movabs rax, 0xe039ec0d24fefd13
mov dx, 0x51f1
bswap dx
mov qword [rsp], rax
cwd
movsx ax, ah
setbe dl
movabs rax, 0x2247bce40ef3a5e6
movzx edx, r12w
mov qword [rsp + 8], rax
movabs rdx, 0xe05dec612491fd3d
jmp 0x1404031c5
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rax
lea rax, [rsp + 0x10]
jmp 0x1404031d9
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
cmp r12, rbp
jmp 0x1404031f8
nop word cs:[rax + rax]
cmc
cmp bx, dx
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jmp 0x140403214
jne 0x140403206
test ax, ax
jmp 0x140403222
je 0x140403266
lea rdx, [rsp + 2]
nop word cs:[rax + rax]
clc
stc
jmp 0x14040323f
mov word [rcx], ax
btr ax, dx
bsr eax, eax
bt eax, 0xb6
add rcx, 2
movzx eax, word [rdx]
jmp 0x140403259
add rdx, 2
test ax, ax
jne 0x14040323f
mov word [rcx], 0
add rsp, 0x28
jmp 0x140403274
ret
Function at 0x14042736f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov sil, sil
bts esi, ebx
mov r10, qword [rcx]
mov rsi, qword [rcx + 0x18]
shr r9, 0x47
not r9b
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
cmp dl, r13b
cmp r8d, 2
jne 0x14042754f
test r9d, r9d
je 0x1404275dd
lea ecx, [r9 - 1]
test rsi, 0x12834811
cmp ecx, 3
jmp 0x1404273b5
jb 0x1404274cc
mov r11d, r9d
not r8b
and r11d, 0xfffffffc
movsx r10w, r12b
nop word cs:[rax + rax]
xadd r10b, r8b
rcl r10b, cl
movzx r8d, word [rsi]
movsx r10w, r14b
movzx r10d, word [rsi + 4]
jmp 0x1404273f1
sub ecx, ecx
sar cl, 0xb4
stc
cmp r8w, word [rdx]
mov r8b, r8b
movzx r8, sp
setne cl
sal r8b, cl
neg ecx
cmp rbx, rbp
shld r8w, r14w, 0xb5
mov word [rsi + 2], cx
mov r8w, 0x193d
xor ecx, ecx
test r15d, 0x5efe0002
test r15b, spl
rcl r8b, cl
cmp r10w, word [rdx]
jmp 0x140427434
setne cl
xadd r8b, r8b
bsr r8w, r8w
neg ecx
rcl r8b, cl
test r10w, r9w
and r8b, spl
mov word [rsi + 6], cx
btr r8w, r15w
movzx r8d, word [rsi + 8]
cmp al, r12b
xor ecx, ecx
test cl, 0x31
clc
cmp r8w, word [rdx]
setne cl
movsxd r8, r15d
bt r8, rsp
neg ecx
mov r8w, 0x33cc
inc r8b
mov word [rsi + 0xa], cx
and r8b, 0x8e
sar r8, 0xdf
movzx r8d, word [rsi + 0xc]
stc
cmp r12w, r12w
test dx, 0x36f4
xor ecx, ecx
shl cl, 0x64
rcl cl, cl
cmp r8w, word [rdx]
setne cl
jmp 0x1404274aa
neg ecx
stc
mov word [rsi + 0xe], cx
cmp sil, 0xc5
add rsi, 0x10
clc
test bl, 0xd1
add r11d, 0xfffffffc
jmp 0x1404274c6
jne 0x1404273de
test r9b, 3
jmp 0x1404274d5
je 0x1404275dd
and r9d, 3
bts r8d, r14d
cmp r15b, dil
sub ecx, ecx
mov r8b, al
bts r8w, r14w
nop word cs:[rax + rax]
test bp, cx
bt r8, rcx
rcr r8b, 0x2c
movzx r8d, word [rsi + rcx*4]
stc
cmp dl, r14b
test r12b, 0xd1
sub eax, eax
ror al, 0xb2
xor al, r15b
cmp r8w, word [rdx]
not al
setne al
test r11b, r13b
neg eax
jmp 0x14042752e
mov word [rsi + rcx*4 + 2], ax
jmp 0x140427538
inc rcx
cmc
cmp r9d, ecx
jmp 0x140427544
jne 0x140427506
jmp 0x1404275dd
test r9d, r9d
jmp 0x140427557
je 0x1404275dd
movzx r10d, word [rdx]
clc
btr r8w, r15w
mov r8d, r9d
sub ecx, ecx
jmp 0x140427571
jmp 0x14042758f
inc rcx
cmc
cmp r15b, r15b
test r13w, bx
cmp r8d, ecx
jmp 0x140427589
je 0x1404275dd
cmp word [rsi + rcx*8], r10w
jmp 0x140427599
jne 0x140427576
movzx eax, word [rsi + rcx*8 + 2]
cmp ax, word [rdx + 2]
jne 0x140427576
movzx eax, word [rsi + rcx*8 + 4]
jmp 0x1404275ba
cmp ax, word [rdx + 4]
jne 0x140427576
mov word [rsi + rcx*8 + 6], 0
movzx r10, r11w
movzx r10d, word [rdx]
jmp 0x1404275d8
jmp 0x140427576
pop rsi
ret
Function at 0x140444d76
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
btr r15w, 0x93
bswap r14w
push rsi
sal r15b, 0x50
sub r14w, 0x6e59
btr r15d, 0xd9
push rdi
rcr r14b, cl
neg r15d
and r15w, 0x59e
push rbp
push rbx
sbb r14b, 0x93
rol rbx, cl
or rbp, r10
sub rsp, 0x28
mov r15d, r9d
and r14w, 0x14a5
cmp bl, sil
ror ebp, 0x26
mov ebp, r8d
bts rbx, r8
mov r14, rdx
mov rbx, rcx
or cl, ah
ror cx, cl
lea rcx, [rdx + 0x20]
test r10b, dl
and dl, dil
xor dl, 0xfc
mov edx, r8d
xadd r8, r8
mov r8d, r9d
test r8w, si
stc
sub r9d, r9d
jmp 0x140444df6
call fcn.140444fa7
test r15d, r15d
jmp 0x140444e03
jle 0x140444ea8
test rax, rax
jmp 0x140444e11
je 0x140444ea8
movsxd rsi, ebp
rol dx, cl
mov ecx, r15d
sub ebp, ebp
cmovb dx, r13w
not dl
xchg dh, dh
mov rdx, rsi
jmp 0x140444e33
jmp 0x140444e61
movzx edi, word [rdi + rdx*2]
mov word [rax + rbp*2], di
jmp 0x140444e45
inc rbp
inc rdx
cmp r8, 0x401f490c
stc
cmp rcx, rbp
jmp 0x140444e5b
je 0x140444eaf
mov di, 0x2a
stc
cmp r8b, r8b
test byte [rbx + 0x1c], 4
jmp 0x140444e72
jne 0x140444e3c
mov rdi, qword [rbx]
stc
cmp qword [rdi + 0x10], rdx
jmp 0x140444e85
jbe 0x140444f9c
cmp qword [rdi + 0x18], 8
jmp 0x140444e95
jb 0x140444e38
mov rdi, qword [rdi]
jmp 0x140444ea3
jmp 0x140444e38
movsxd rsi, ebp
bsr rcx, r10
mov rbx, qword [rbx]
jmp 0x140444ebf
mov rdi, qword [rbx + 0x10]
mov rcx, rdi
sub rcx, rsi
jmp 0x140444ece
jb 0x140444f9c
movsxd rax, r15d
cmp rcx, rax
jmp 0x140444edf
cmovb rax, rcx
btr cx, 0xf5
bt rcx, r8
movsxd rcx, r11d
cmp qword [rbx + 0x18], 8
movsx ecx, r8w
mov rcx, rbx
jmp 0x140444f00
jb 0x140444f09
mov rcx, qword [rbx]
lea rcx, [rcx + rsi*2]
sbb bpl, 0xc4
rcr r8w, cl
btc rdx, 0xa1
sub rdi, rax
mov rbp, rdi
cqo
sub rbp, rsi
bsr dx, bx
movzx edx, bp
cmp cl, r11b
lea rdx, [rcx + rax*2]
lea r8, [rbp + 2]
test bpl, spl
clc
add r8, rbp
jmp 0x140444f47
call fcn.1404a8457
mov qword [rbx + 0x10], rdi
not rdi
btr di, r10w
mov byte [r14 + 0x16], 0
add rsp, 0x28
jmp 0x140444f6d
pop rbx
movzx r15w, dil
pop rbp
movsx rdi, ax
not sil
movsxd r14, r11d
pop rdi
setle r15b
pop rsi
cmovl r14d, esp
pop r14
movsx r15w, cl
movzx r15w, r13b
pop r15
jmp 0x140444f9b
ret
call fcn.1404443c6
int3
Function at 0x140448e7e
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140448e87
movzx ecx, cx
jmp 0x140448e8f
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmc
cmp eax, 0x100
jmp 0x140448ea3
setae al
cmc
add rsp, 0x28
jmp 0x140448eb0
ret

Function at 0x14044a604
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
lahf
mov rcx, qword [rcx]
mov rax, qword [rcx]
jmp 0x14044a614
call qword [rax + 0x28]
test eax, eax
jmp 0x14044a61e
je 0x14044a65d
mov ecx, eax
rcl r9w, cl
movabs r8, 0xcafa59766d7f94e
adc dl, bpl
sal dl, 0x6b
inc dl
mov dl, 3
or r9d, esi
bt r9d, r10d
sbb r9b, spl
mov r9d, 0x2a
clc
add rsp, 0x28
jmp 0x14044a658
jmp fcn.1403b48bb
nop
clc
add rsp, 0x28
jmp 0x14044a668
ret

Function at 0x14044b9df
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
btc ax, 0xea
sub rsp, 0xa8
movsxd rdi, r8d
movaps xmmword [rsp + 0x90], xmm10
movaps xmmword [rsp + 0x80], xmm9
not rdi
mov si, 0x7f5d
movaps xmmword [rsp + 0x70], xmm8
mov sil, r15b
movsx rdi, r12w
movzx rdi, r15w
movaps xmmword [rsp + 0x60], xmm7
jmp 0x14044ba2b
movaps xmmword [rsp + 0x50], xmm6
cmove rdi, rsi
not al
movaps xmm9, xmm3
movsxd rsi, r12d
movzx di, bpl
movzx eax, r8w
mov rdi, rdx
mov rsi, rcx
movzx edx, sp
movss xmm8, dword [rsp + 0xe0]
mov rcx, qword [rcx + 0x20]
movsx dx, r11b
movups xmm0, xmmword [r8]
bswap dx
cmovb edx, ecx
rdtsc
movaps xmmword [rsp + 0x30], xmm0
mov dl, bpl
rdtsc
movsxd rdx, r12d
mov rax, qword [rcx]
movsx edx, ax
lea rdx, [rsp + 0x30]
jmp 0x14044ba8b
call qword [rax + 0x40]
movsd xmm7, qword [rdi]
jmp 0x14044ba97
movaps xmm0, xmm7
call fcn.1404bd2f1
movaps xmm10, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x14044baaf
call fcn.1404bd2f1
unpcklps xmm10, xmm0
addps xmm10, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm10
movlps qword [rsp + 0x30], xmm10
movsd xmm7, qword [rdi + 8]
movaps xmm0, xmm7
jmp 0x14044bad7
call fcn.1404bd2f1
movaps xmm6, xmm0
jmp 0x14044bae4
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x14044baf0
call fcn.1404bd2f1
movss dword [rdi + 8], xmm6
jmp 0x14044baff
unpcklps xmm6, xmm0
movss dword [rdi + 0xc], xmm0
addps xmm6, xmm10
movlps qword [rsp + 0x38], xmm6
movss dword [rsp + 0x40], xmm9
cqo
rdtsc
cdq
movss dword [rsp + 0x44], xmm9
lahf
cwde
movsx dx, r12b
mov rcx, qword [rsi + 0x18]
cwde
movzx r8, di
mov r8, qword [rsi + 0x20]
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
jmp 0x14044bb4d
movaps xmm3, xmm8
call qword [rax + 0x90]
movaps xmm6, xmmword [rsp + 0x50]
shl sil, cl
and rsi, r10
movaps xmm7, xmmword [rsp + 0x60]
inc rsi
and edi, ecx
movaps xmm8, xmmword [rsp + 0x70]
adc sil, 0xad
sal dil, 0xb7
cmp r10b, spl
movaps xmm9, xmmword [rsp + 0x80]
movaps xmm10, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rdi
setl sil
not sil
pop rsi
jmp 0x14044bba4
ret
Function at 0x14044d550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor r8w, 0x2f9e
cdqe
mov r8, rcx
bts eax, r8d
inc ax
mov eax, 0x5a4d
cmp word [0x140000000], ax
jmp 0x14044d577
jne 0x14044d6a6
movsxd rcx, dword [0x14000003c]
shrd edx, esi, 0xa1
sal edx, cl
btr rdx, rbx
lea rdx, [0x140000000]
lea rcx, [rcx + rdx]
test bpl, 0x51
cmp dword [rcx], 0x4550
jmp 0x14044d5a8
jne 0x14044d6a6
mov eax, 0x20b
stc
test sp, 0x4e53
cmp cx, r12w
cmp word [rcx + 0x18], ax
jmp 0x14044d5c6
jne 0x14044d6a6
sub r8, rdx
movsx ax, dl
rcl r9b, 0xb3
movzx edx, word [rcx + 0x14]
mov ax, r11w
sar r9b, 0x83
xor eax, 0x5e7a4e23
add rdx, 0x18
btr r9d, 0x74
btc rax, rcx
lahf
add rdx, rcx
movzx rax, r12w
bts ax, r14w
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp r14b, 0x52
test spl, 0x62
mov qword [rsp], rdx
cmp r14b, dil
cmp spl, 0x33
jmp 0x14044d626
cmp rdx, r9
jmp 0x14044d62e
je 0x14044d66c
mov ecx, dword [rdx + 0xc]
jmp 0x14044d63d
cmp r8, rcx
jmp 0x14044d645
jb 0x14044d65e
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jmp 0x14044d658
jb 0x14044d66f
add rdx, 0x28
jmp 0x14044d667
jmp 0x14044d616
sub edx, edx
clc
test rdx, rdx
jmp 0x14044d677
jne 0x14044d689
xor al, al
jmp 0x14044d684
jmp 0x14044d6b0
cmp dword [rdx + 0x24], 0
jge 0x14044d69a
xor al, al
jmp 0x14044d6b0
mov al, 1
jmp 0x14044d6a1
jmp 0x14044d6b0
xor al, al
jmp 0x14044d6b0
add rsp, 0x18
jmp 0x14044d6b9
ret

Function at 0x14044e040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
rcl bx, cl
movzx rax, r10w
mov qword [rsp + 0x10], rbp
shl ah, 0x48
movzx ebp, r8w
push rdi
sub rsp, 0x20
cmovae di, di
sal edi, cl
and qword [rcx + 0x10], 0
lea rax, [0x1400bff98]
and qword [rcx + 0x18], 0
bt bp, r13w
lea rbp, [0x1400ced94]
and dword [rcx + 0x20], 0
btr bx, ax
movsx rdi, si
btc di, 0x6d
mov rbx, rcx
mov qword [rcx], rax
xor edi, r8d
and dil, 0xce
xadd dil, dil
mov rdi, rbp
mov dword [rcx + 8], 1
cmc
mov byte [rcx + 0x24], dl
cmc
stc
cmp sil, 0xf0
and qword [rcx + 0x28], 0
mov byte [rcx + 0x30], 0
jmp 0x14044e0c4
inc rdi
jmp 0x14044e0cc
cmp byte [rdi], 0
jmp 0x14044e0d4
jne 0x14044e0c4
sub rdi, rbp
movsxd rcx, ebp
mov ch, 0x56
lea rcx, [rdi + 1]
jmp 0x14044e0ec
call fcn.140109134
mov qword [rbx + 0x28], rax
test rax, rax
jmp 0x14044e0fd
je 0x14044e11f
lea r8, [rdi + 1]
cmovns rcx, r9
movzx ecx, r14w
mov rdx, rbp
mov rcx, rax
jmp 0x14044e11a
call fcn.1404a8457
mov rbp, qword [rsp + 0x38]
movsx rax, dx
rol ax, 0xd
mov rax, rbx
add dil, 0x84
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
movzx di, al
movsx rdi, r10w
movzx edi, sp
pop rdi
ret
Function at 0x14045e517
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmp r9w, bp
push rdi
cmp r12d, ebp
sub rsp, 0x20
jmp 0x14045e52d
xorps xmm0, xmm0
sub eax, eax
setae bl
cmovs bx, si
movups xmmword [rcx], xmm0
jmp 0x14045e547
mov rbx, rcx
movups xmmword [rcx + 0x10], xmm0
mov qword [rcx + 0x20], rax
jmp 0x14045e557
mov dword [rcx + 0x28], eax
call fcn.1404af54b
mov dword [rbx], eax
call fcn.1404ae883
mov dword [rbx + 4], eax
jmp 0x14045e56e
call fcn.1404af4f3
xor edi, edi
mov rcx, qword [rax + 0x10]
movzx rax, r11w
mov eax, edi
xor al, 0x78
test rcx, rcx
mov al, 0xc3
sete al
mov dword [rbx + 8], eax
test rcx, rcx
jmp 0x14045e594
je 0x14045e63d
call fcn.1404afad8
mov r9, rax
mov r8d, edi
stc
bt r10w, r8w
ror r10w, 0x3a
mov r10d, edi
clc
cmp r14w, r15w
cmp word [r9], di
jmp 0x14045e5c1
jge 0x14045e60e
mov rdx, r10
movsx eax, r14w
jmp 0x14045e5d3
mov eax, r8d
test r15, 0x35633dc
shr rdx, 3
movzx cx, cl
sub cl, bl
and rcx, rdx
and eax, 7
not cx
movzx cx, r14b
btr ecx, ebp
movzx ecx, byte [rdx + rbx + 0xc]
jmp 0x14045e602
bts ecx, eax
mov byte [rdx + rbx + 0xc], cl
jmp 0x14045e60e
inc r8d
jmp 0x14045e616
inc r10
jmp 0x14045e61e
add r9, 2
test spl, sil
clc
jmp 0x14045e62b
cmp r8d, 0x100
jmp 0x14045e637
jl 0x14045e5b8
mov rax, rbx
shrd bx, dx, 0xbb
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
not edi
mov dil, cl
pop rdi
jmp 0x14045e659
ret

Function at 0x14045f1c9
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsxd rcx, edi
movsx ecx, r13w
lea rcx, [rsp + 0x30]
jmp 0x14045f1de
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
add rsp, 0x28
jmp 0x14045f1f2
ret
Function at 0x14045f28f
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
adc al, dil
push rbp
inc bp
lahf
mov rbp, rsp
jmp 0x14045f2a4
sub rsp, 0x20
movsx ax, r9b
jmp 0x14045f2b4
mov rax, qword [0x1400b7288]
shl rbx, 0x68
xchg bh, bh
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x14045f2d3
jne 0x14045f3b6
and qword [rbp + 0x18], 0
mov rcx, 0x336a5e6b
movzx cx, r10b
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045f2fd
mov qword [rbp + 0x10], rax
jmp 0x14045f306
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
test r12b, 0x67
xor qword [rbp + 0x10], rax
jmp 0x14045f31b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
inc rcx
lea rcx, [rbp + 0x20]
cmc
test r10w, sp
stc
xor qword [rbp + 0x10], rax
jmp 0x14045f339
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
add rcx, 0x44310adb
and cl, 0x38
lea rcx, [rbp + 0x10]
shl rax, 0x20
jmp 0x14045f359
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
sbb bpl, 0xf2
or bp, r10w
xor rax, rcx
and cl, 0xbe
movabs rcx, 0xffffffffffff
btr bp, 0x9b
and rax, rcx
rcr rcx, 0x62
inc rbp
xchg ebp, ebp
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
bswap ebp
movzx bp, spl
mov ebp, eax
cmove rax, rcx
inc bx
mov qword [0x1400b7288], rax
rol rbx, cl
movzx bp, spl
mov rbx, qword [rsp + 0x48]
movzx rbp, r12w
sub bpl, 0xe4
not rax
xchg bpl, bpl
mov qword [0x1400b7280], rax
btc bp, 0x7b
shrd rbp, r12, 0xb2
mov rbp, 0x13f048d0
add rsp, 0x20
movzx ebp, r14w
cmovl ebp, ebx
pop rbp
jmp 0x14045f3f2
ret
Function at 0x140470e4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
clc
stc
mov qword [rax + 0x10], rbp
bt rbp, 0x80
rcr bpl, cl
movsx rbp, cx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
neg esi
xor sil, al
push r14
rcl bp, 0x30
sub rsp, 0x20
mov rdi, qword [rsp + 0x50]
rol r14b, cl
stc
mov r14, r9
mov rsi, r8
adc bpl, 0xda
mov rbp, rdx
test rdi, rdi
jmp 0x140470e9a
je 0x140470f60
mov rbx, qword [r8 + 8]
test rbx, rbx
jmp 0x140470eac
je 0x140470f47
mov rax, qword [rbx + 0x40]
movzx r8d, word [r14]
cmc
test r14b, 0x56
cmp qword [rax], 0
jmp 0x140470ec8
je 0x140470f05
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0
jle 0x140470f05
dec dword [rax]
mov rcx, qword [rbx + 0x40]
movsx dx, ah
movsx rax, si
mov ax, 0x5956
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x140470efc
mov word [rdx], r8w
jmp 0x140470f38
mov rax, qword [rbx]
cwd
movzx edx, r8w
movsx rcx, r11w
movsx cx, bpl
movzx cx, r15b
mov rcx, rbx
jmp 0x140470f24
mov rax, qword [rax + 0x18]
call qword [0x1400b8d90]
movzx r8d, ax
shr al, cl
sub ax, r10w
mov eax, 0xffff
cmp ax, r8w
jne 0x140470f4d
mov byte [rsi], 1
test r9b, r15b
add r14, 2
sub rdi, 1
jmp 0x140470f5a
jne 0x140470ea4
movups xmm0, xmmword [rsi]
sbb r14b, spl
movsx eax, cx
mov rbx, qword [rsp + 0x30]
test di, bp
mov rax, rbp
btr edi, r10d
mov rsi, qword [rsp + 0x40]
shr dil, 0xd7
movzx rdi, r14w
mov rdi, qword [rsp + 0x48]
movdqu xmmword [rbp], xmm0
cmp r15, 0x58ad68b7
mov rbp, qword [rsp + 0x38]
shrd r14w, r12w, 0x46
add rsp, 0x20
seta r14b
pop r14
jmp 0x140470fb0
ret
Function at 0x140496db9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
stc
shl bh, cl
mov qword [rax + 0x10], rbp
adc bpl, dil
cmovg bp, cx
mov qword [rax + 0x18], rsi
movsx rsi, r12w
mov qword [rax + 0x20], rdi
neg sil
push r14
rcl si, 0x9e
add bl, 3
shl bl, cl
sub rsp, 0x20
movzx r14, r14w
sbb ebx, ecx
shl r14b, 0xea
mov rsi, r9
rcl r14b, 0xdb
and r14d, esi
mov r14, r8
shl bpl, 0x4d
not bpl
movsx rbp, r8w
mov rbx, rdx
inc bpl
shld bp, si, 0x7c
mov rbp, rcx
test r13b, spl
test r8d, 0x525b6140
cmp rdx, r8
jmp 0x140496e2e
je 0x140496f11
mov rdi, qword [r9 + 8]
test rdi, rdi
jmp 0x140496e40
je 0x140496ef9
mov rax, qword [rdi + 0x40]
movzx r8d, word [rbx]
cmp sp, r12w
test dl, 0x9d
cmp qword [rax], 0
jmp 0x140496e5e
je 0x140496eb0
mov rax, qword [rdi + 0x58]
test bpl, 0xfa
cmp cl, 0xaf
cmp dword [rax], 0
jmp 0x140496e77
jle 0x140496eb0
dec dword [rax]
cdq
movzx dx, bl
mov rcx, qword [rdi + 0x40]
mov al, bl
movsx edx, r14w
bswap ax
mov rdx, qword [rcx]
mov al, r8b
movsx rax, bp
lea rax, [rdx + 2]
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x140496eab
jmp 0x140496ee4
mov rax, qword [rdi]
movzx edx, bp
mov cl, dil
movzx edx, r8w
cmovs ecx, edi
movzx ecx, cx
mov ecx, r9d
mov rcx, rdi
jmp 0x140496ece
mov rax, qword [rax + 0x18]
jmp 0x140496ed7
call qword [0x1400b8d90]
movzx r8d, ax
cmp di, di
mov eax, 0xffff
stc
cmp ax, r8w
jmp 0x140496ef3
jne 0x140496efc
mov byte [rsi], 1
add rbx, 2
test bh, 0x48
cmp rbx, r14
jmp 0x140496f0b
jne 0x140496e38
movups xmm0, xmmword [rsi]
xor sil, 0x9d
movsxd rsi, r8d
rol sil, cl
mov rbx, qword [rsp + 0x30]
btc si, 0xe5
shrd eax, ebx, 0xb4
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
and r14d, edx
bts r14, rdi
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
sete r14b
add rsp, 0x20
pop r14
jmp 0x140496f59
ret