joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140075570
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbp, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
movabs rdi, 0x8000000000
mov byte [rax - 0x30], 0
xor r15d, r15d
mov qword [rax - 0x28], r15
cmp byte [rax - 0x30], r15b
jne 0x1400756e3
xor r8d, r8d
lea rcx, [rax - 0x28]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
setne cl
mov byte [rsp + 0x68], cl
test cl, cl
je 0x1400756e3
cmp qword [rbx + 0x18], 8
jb 0x1400755e6
mov rbx, qword [rbx]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
movabs rsi, 0x142100000000
test eax, eax
jne 0x140075676
lea edx, [rax + 0x5c]
lea rcx, str.D:_agent_work6_sprivate_softgridclientintegration_notifier_process.hpp
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x14007564b
inc rax
jmp 0x140075652
lea rax, str.D:_agent_work6_sprivate_softgridclientintegration_notifier_process.hpp
mov rdx, rax
lea rcx, [0x14020c428]
call fcn.140005ff0
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or rdi, rbx
or rdi, rsi
cmp byte [rsp + 0x68], 0
je 0x140075734
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test eax, eax
je 0x14007569a
mov byte [rsp + 0x68], 0
jmp 0x140075734
mov edx, MsiPreviewDialogW
lea rcx, str.D:_agent_work6_sprivate_softgridclientintegration_notifier_process.hpp
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x1400756b6
inc rax
jmp 0x1400756bd
lea rax, str.D:_agent_work6_sprivate_softgridclientintegration_notifier_process.hpp
mov rdx, rax
lea rcx, [0x14020c428]
call fcn.140005ff0
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or rdi, rbx
or rdi, rsi
jmp 0x140075734
mov edx, MsiPreviewDialogW
lea rcx, str.D:_agent_work6_sprivate_softgridclientintegration_notifier_process.hpp
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x1400756ff
inc rax
jmp 0x140075706
lea rax, str.D:_agent_work6_sprivate_softgridclientintegration_notifier_process.hpp
mov rdx, rax
lea rcx, [0x14020c428]
call fcn.140005ff0
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
or rdi, rbx
movabs rax, 0x132100000000
or rdi, rax
cmp byte [rsp + 0x68], 0
je 0x140075755
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
movzx ecx, byte [rsp + 0x68]
test eax, eax
cmovne ecx, r15d
mov byte [rsp + 0x68], cl
mov rax, rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140094d10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x58], 8
mov ebx, edx
lea rdx, [rcx + 0x40]
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x58], 0
jb 0x140094d37
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x140094daf
lea rcx, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
mov edx, MsiPreviewDialogW
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x140094d7a
inc rax
jmp 0x140094d81
lea rax, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
lea rcx, [0x14020c428]
mov rdx, rax
call fcn.140005ff0
movabs rcx, 0x342500000000
shl rax, 0x34
or rax, rdi
or rax, rcx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp ebx, dword [rsp + 0x58]
je 0x140094e03
lea rcx, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
mov edx, MsiPreviewDialogW
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x140094dd1
inc rax
jmp 0x140094dd8
lea rax, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
lea rcx, [0x14020c428]
mov rdx, rax
call fcn.140005ff0
movabs rcx, 0x350500040002
shl rax, 0x34
or rax, rcx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140095050
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x30
lea rdx, [rcx + 0x40]
mov rdi, r8
xor r8d, r8d
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x48], r8d
jb 0x14009507c
mov rdx, qword [rdx]
mov rcx, qword [rcx + 0x60]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
je 0x1400950f8
test eax, eax
je 0x1400950f8
lea rcx, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
mov edx, MsiPreviewDialogW
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x1400950c3
inc rax
jmp 0x1400950ca
lea rax, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
lea rcx, [0x14020c428]
mov rdx, rax
call fcn.140005ff0
movabs rcx, 0x312500000000
shl rax, 0x34
or rax, rbx
or rax, rcx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp dword [rsp + 0x48], 1
je 0x14009514d
lea rcx, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
mov edx, MsiPreviewDialogW
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x14009511b
inc rax
jmp 0x140095122
lea rax, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
lea rcx, [0x14020c428]
mov rdx, rax
call fcn.140005ff0
movabs rcx, 0x320500040002
shl rax, 0x34
or rax, rcx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
cmp eax, 0x4000
jb 0x1400951a6
lea rcx, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
mov edx, MsiPreviewDialogW
call qword [sym.imp.MSVCR120.dll_strrchr]
test rax, rax
je 0x140095174
inc rax
jmp 0x14009517b
lea rax, str.d:_agent_work6_sprivate_softgrid_sharedclientconfigurationRegistryValue.h
lea rcx, [0x14020c428]
mov rdx, rax
call fcn.140005ff0
movabs rcx, 0x330500040003
shl rax, 0x34
or rax, rcx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov dword [rdi], eax
movabs rax, 0x8000000000
add rsp, 0x30
pop rdi
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Check for software breakpoints
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403ab898

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403ad39a

Function at 0x1400f4f6b
Capabilities:
Enumerate pe sections

Disassembly:
je 0x1401900fb
mov edx, dword [rax + 0xc]
test r13w, r12w
cmp r10, rdx
jmp 0x1401923c9
movsxd r8, dword [rcx + 0x3c]
sub r9d, r9d
cdqe
lea r8, [r8 + rcx]
dec r11b
bsf r11, rax
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
cmp esp, 0x42e37b08
stc
add rax, r8
jmp 0x1401eff22
jb 0x140210329
inc r9d
cmc
add rax, 0x28
jmp 0x1401a6bbd
jb 0x1400eb377
xor eax, eax
jmp 0x140210329
jb 0x14018dfc1
mov ecx, dword [rax + 8]
cmp al, bpl
add ecx, edx
cmp dil, 0xae
cmp r10, rcx
jmp 0x14018dfbb
cmp r9d, r11d
jmp 0x1401900f5
test r11d, r11d
jmp 0x1400eb371
ret

Function at 0x140122350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x1402283f8
ret
mov rax, qword [rdx]
ror dh, cl
and rdx, 0x5b8e671d
mov rdx, qword [rax + 0xf8]
bsf r9w, si
ror al, 0x8f
cmova ax, si
mov rax, qword [rdx]
cmp sil, spl
movzx r9d, byte [rax]
btc ax, 0x66
movzx eax, byte [rcx]
test al, al
jmp 0x1401aab54
je 0x1402494fb
sub al, 0x45
test r12b, r9b
test al, 0xdf
je 0x1402494fb
movzx eax, byte [rcx + 1]
jmp 0x1401a20f7
inc rcx
stc
test al, al
jmp 0x1402494f5
je 0x140235502
movzx edx, al
rcl ax, 0x2c
nop dword [rax + rax]
xor al, 0x3c
movzx eax, dl
test bl, r9b
cmp dl, r9b
jmp 0x14027866d
lea rdx, [rdx + 1]
cmp r11b, r10b
mov byte [rdx], al
lea r8, [r8 + 1]
cmc
jmp 0x1401cd2c4
test al, al
jmp 0x1401127b1
cmovne rdx, rcx
nop dword [rax]
or al, 0x62
bsr ax, bx
or ax, r10w
movzx eax, byte [r8]
stc
test dil, 0x71
jmp 0x1401ade4d
dec rcx
test di, 0x4e54
cmp al, 0x30
jmp 0x14022b0a6
je 0x140295fde
cmp al, r9b
not ah
movzx edx, ax
movsx rax, r8w
lea rdx, [rcx - 1]
movzx ax, r8b
jmp 0x1402283e3
jne 0x1401aab68
inc rcx
cmp r10w, 0x452b
test al, al
je 0x1401127b7
movzx eax, byte [rcx]
test al, al
jmp 0x14012ec38
jne 0x14012ec3e
movzx eax, byte [rcx - 1]
movsx r8d, sp
setb r8b
mov r8, rcx
dec rcx
stc
cmp al, 0x30
jmp 0x140295fd8
je 0x140235502
movzx eax, byte [rcx + 1]
movsxd rdx, r9d
inc rcx
adc edx, 0x23ba7ec1
add dl, r12b
movzx edx, al
stc
cmp dl, r9b
test al, al
jmp 0x1402354fc
jne 0x14022b0ac
movzx eax, byte [rcx - 1]
jmp 0x140228709
Function at 0x14014ff47
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x140444218
push rsi
push rdi
btc si, 0xfd
movsx si, sil
sub rsp, 0x28
bts ax, di
ror sil, 0xed
cbw
mov rsi, rcx
and ah, 0x4d
xor ah, dl
mov rcx, qword [rcx + 0x18]
add al, r13b
rol ax, 0xd9
mov rax, qword [rcx]
sub edx, edx
sub r8d, r8d
jmp 0x140444252
call qword [rax + 0x188]
mov edi, eax
movzx ecx, r8w
movzx rcx, dx
lea rcx, [rsi + 0x30]
jmp 0x14044426b
call fcn.140457dfd
test edi, edi
jmp 0x140444277
je 0x1404442b9
cmp edi, 0x8899000c
jmp 0x140444288
jne 0x1404442d4
mov rcx, rsi
and edi, r14d
add rsp, 0x28
movsxd rsi, r13d
not si
movzx rdi, r12w
pop rdi
setp sil
cmovno rsi, r9
not sil
pop rsi
jmp 0x1404442b4
jmp fcn.140443ea6
nop
bts esi, ecx
or sil, spl
add rsp, 0x28
pop rdi
movsxd rsi, ebx
jmp 0x1404442cd
pop rsi
jmp 0x1404442d3
ret
mov ecx, edi
cmovl rsi, rbp
movabs r8, 0xad4a5352d2edebd0
bsr r9w, ax
bsf edi, r13d
mov dl, 3
test bh, 0x85
bt si, r10w
add di, r13w
mov r9d, 0x54
movzx esi, bp
bsr rsi, r15
rol si, 0xf1
add rsp, 0x28
jmp 0x140444318
pop rdi
pop rsi
jmp 0x14044431f
jmp fcn.1403ad972

Function at 0x1401cc1ac
Capabilities:
Parse pe header

Disassembly:
jne 0x14023c0d7
movsxd rdx, dword [rcx + 0x3c]
clc
lea rdx, [rdx + rcx]
stc
cmp dword [rdx], 0x4550
jne 0x14023c0d7
xor eax, eax
sar al, cl
mov ecx, 0x20b
mov al, sil
cmp word [rdx + 0x18], cx
xchg al, al
setbe al
sete al
jmp 0x140241be9
ret
mov eax, 0x5a4d
clc
cmp rax, rbx
cmp word [rcx], ax
jmp 0x1401978ea
xor eax, eax
jmp 0x1401a6ba8
ret

Function at 0x1401ced3d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x140245717
mov eax, r8d
shr r8d, 0x1f
test r15d, esp
neg eax
shr eax, 0x1f
jmp 0x1401ef4a5
movzx eax, word [rdx]
cmc
xor r8, rdi
movzx r8d, word [rcx]
sub r8d, eax
jmp 0x140245707
je 0x1400faab6
add rdx, 2
btc rax, 0xfa
movzx r8w, dl
btr r8w, r11w
movzx eax, word [rdx]
adc r8, r15
movsx r8w, bl
movzx r8d, word [rcx + rdx]
cmc
sub r8d, eax
jmp 0x1400faab0
sub eax, r8d
ret
jne 0x1400faab6
sub rcx, rdx
test dil, r9b
test ah, 0x92
clc
test ax, ax
jmp 0x1401d8872
Function at 0x140206e95
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404af68f
sub r8d, r8d
cmp dil, bpl
xor edx, edx
jmp 0x140175e94

Function at 0x14027ebb0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
test ax, ax
jmp 0x1401ad892
jne 0x1401470a2
sub r8, rax
stc
test r8, r8
jmp 0x14019d372
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401c2a15
je 0x1401147c6
xor eax, eax
cmc
nop word [rax + rax]
cmp r10b, 0x37
clc
test dx, 0x4ff5
cmp r8, rax
jmp 0x140198955
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
ror r9b, cl
neg r11b
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
neg r9b
movzx r8d, word [rax + 0x58]
cmp r8, rdx
movsxd r11, esp
mov r9w, 0x5ca0
cmovae r8, rdx
movsx r9d, di
rol r10d, cl
btr r11w, bp
mov r9, qword [rax + 0x60]
movsx r10, r9w
jmp 0x140175e99
test ax, ax
jmp 0x140230672
movzx r11d, word [r9]
adc r10w, r14w
xor r10w, 0xb32
lea r10, [0x1400b8f10]
cmp ebp, 0x1790093c
test r12b, 0x2f
test r11w, r14w
test r11w, r11w
jmp 0x140147089
je 0x14019d378
mov word [r10], r11w
add r11b, dil
rcr r11w, cl
add r10, 2
dec r11b
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1402396cc
jmp 0x14022e2df
je 0x14019d385
mov word [r10], 0
sar ax, cl
sal rax, 0x8e
movzx eax, word [0x1400b8f10]
sar r8b, cl
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x14022e2cf
jne 0x14022e2ec
sub r8, rdx
test dil, 0xbb
test r8, r8
jmp 0x140213b60
inc rdx
jmp 0x1400fdf37
je 0x140213b6b
mov word [rcx], 0
ret
cmovb r8, rdx
cmp r11b, r13b
test ax, ax
je 0x1401ad89f
xor edx, edx
sub r9d, r8d
clc
lea r9, [0x1400b8f10]
cmp r8, rdx
je 0x140213b66
mov word [rcx], ax
movsx rax, r9w
add rcx, 2
jmp 0x140144816
je 0x14014f8b2
cmp rdx, 0x104
movsx r8, r10w
not r8b
mov r8d, 0x104
cmovb r8, rdx
jmp 0x14019a4a9
inc rax
stc
cmp r15w, 0x387a
test r8b, r10b
test r11w, r11w
jmp 0x1401147bc
movzx eax, word [0x1400b8f10]
jmp 0x140169c4e
Function at 0x1403de350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sbb r10, r8
bsf r9w, sp
push rbx
sbb r10, r9
sar r9b, 0xc9
bts r10w, r10w
mov r9, rcx
movsx r10w, cl
lea r8, [r8 + rdx]
ror r10w, 0x7c
shrd r10, r9, 0xc
mov dword [rcx + 8], 0
xor eax, eax
and r10d, r12d
xor ecx, ecx
bt r10, r9
bt r10w, 0x71
nop word cs:[rax + rax]
lea r10, [rdx + 1]
stc
cmp r10, r8
ja 0x1403de5ee
movzx edi, byte [rdx]
mov edx, edi
cmp r15b, 0xad
cmp bl, r8b
and edx, 0x7f
jmp 0x1403de3c3
shl rdx, cl
add rax, rdx
movsx edx, r14w
xchg dl, dh
add rcx, 7
sbb rdx, 0x2f6d2bcd
add dx, 0x1eb6
sal edx, 0xad
mov rdx, r10
cmp r8b, dil
test dil, dil
jmp 0x1403de3f0
js 0x1403de3a1
mov rcx, rax
jmp 0x1403de401
and rcx, 0xfffffffffffffff8
and eax, 7
cmp bpl, 0x59
cmc
cmp rcx, 8
jmp 0x1403de416
je 0x1403de564
cmp rax, 1
jg 0x1403de450
test rax, rax
jmp 0x1403de42e
je 0x1403de504
cmp eax, 1
jmp 0x1403de43c
jne 0x1403de5ee
lea rdx, [r10 + 8]
jmp 0x1403de44b
jmp 0x1403de54e
cmp eax, 5
je 0x1403de546
cmp eax, 2
jmp 0x1403de461
jne 0x1403de5ee
mov rsi, r10
setne al
shr ah, 0x84
sub edi, edi
xor al, sil
shl ah, cl
xor ecx, ecx
nop word cs:[rax + rax]
not ah
shl ax, cl
rcl ax, 6
lea rax, [rsi + 1]
cmp rax, r8
jmp 0x1403de499
ja 0x1403de5ee
mov r11, rdi
btc rdx, 0xf1
movzx ebx, byte [rsi]
btc si, 0x78
sar rsi, 0xb
cmp dx, r9w
mov edx, ebx
test bx, 0x7410
and edx, 0x7f
adc sil, 0xff
cmovns rsi, r12
shl rdx, cl
add rdi, rdx
add rcx, 7
movsx esi, dx
mov rsi, rax
cmc
stc
test bl, bl
jmp 0x1403de4e2
js 0x1403de48d
add rdx, r11
add rdx, rax
cmp rdx, r8
jmp 0x1403de4f6
cmova rdx, rax
jmp 0x1403de4ff
jmp 0x1403de384
mov rax, r10
rcl dh, cl
sal dl, 0x3a
nop
movsx dx, spl
lea rdx, [rax + 1]
test dl, bpl
cmp rdx, r8
jmp 0x1403de522
ja 0x1403de5ee
cmp byte [rax], 0
jmp 0x1403de533
mov rax, rdx
jmp 0x1403de53b
js 0x1403de513
jmp 0x1403de384
lea rdx, [r10 + 4]
cmp si, r8w
cmp rdx, r8
jmp 0x1403de556
cmova rdx, r10
jmp 0x1403de55f
jmp 0x1403de384
cmp eax, 2
jmp 0x1403de56c
jne 0x1403de5ee
mov dword [r9 + 8], 2
test al, 0xf3
bsr esi, r12d
mov rsi, r10
sub eax, eax
movzx dx, spl
xor ecx, ecx
nop word [rax + rax]
lea rdx, [rsi + 1]
cmp rdx, r8
jmp 0x1403de59e
ja 0x1403de5ee
movzx r11d, byte [rsi]
mov edi, r11d
bts si, r14w
and edi, 0x7f
shl rdi, cl
add rax, rdi
add rcx, 7
mov rsi, rdx
test r11b, r11b
jmp 0x1403de5c8
js 0x1403de592
mov qword [r9 + 0x10], rdx
cmc
cmp r10d, 0x74817b7d
mov qword [r9 + 0x18], rax
cmp r14b, bpl
add rdx, rax
stc
cmp rdx, r8
jbe 0x1403de384
cmp r10, r8
mov al, dil
seta al
movsx rsi, sp
pop rbx
movzx di, bl
cmovle si, r15w
pop rdi
jmp 0x1403de60f
pop rsi
jmp 0x1403de615
ret
Function at 0x1403fc443
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
sub rsp, 0x28
cmp r11, 0x2b911777
test r8, r8
jmp 0x1403fc456
je 0x1403fc4ba
movzx r9d, word [r8]
cmc
test r9w, r9w
jmp 0x1403fc46a
je 0x1403fc4f5
sub eax, eax
mov r10, rcx
nop dword [rax + rax]
cmp rdx, rax
je 0x1403fc6b3
mov word [r10], r9w
cmovbe r9d, edx
add r10, 2
movzx r9d, word [r8 + rax*2 + 2]
inc rax
test spl, 0xb8
cmp r13w, si
test r9w, r9w
jne 0x1403fc47d
sub rdx, rax
jmp 0x1403fc4b5
jmp 0x1403fc4fc
movzx r9d, word [0x1400b8f10]
test r9w, r9w
jmp 0x1403fc4cb
je 0x1403fc50f
cmp rdx, 0x104
movsx r8d, r9w
movzx r8w, spl
mov r8d, 0x104
jmp 0x1403fc4ec
cmovb r8, rdx
jmp 0x1403fc645
mov r10, rcx
cmp r10, r14
cmc
test rdx, rdx
jmp 0x1403fc504
jne 0x1403fc6b3
jmp 0x1403fc6c1
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
adc r9b, r10b
cmovns r11, rcx
ror r8b, cl
mov rax, qword [rax + 0x18]
or r9, r10
mov rax, qword [rax + 0x10]
xor r8d, 0x4324345b
inc r9w
movzx r8d, word [rax + 0x58]
sar r11w, 0x56
shl r9b, cl
xor r11d, 0x5f0213e1
cmp r8, rdx
movzx r10w, r12b
cmovae r8, rdx
mov r9, qword [rax + 0x60]
movzx r11d, word [r9]
add r10b, 0xdc
bts r10, r10
xor r10, 0x36072d3b
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x1403fc583
je 0x1403fc5da
sub eax, eax
nop word cs:[rax + rax]
cmp r8, rax
jmp 0x1403fc5a1
je 0x1403fc5e8
mov word [r10], r11w
add r10, 2
mov r11d, 0x64e40817
bswap r11w
cmovb r11, r14
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1403fc5c8
inc rax
test r11w, r11w
jne 0x1403fc599
sub r8, rax
clc
cmc
test r8, r8
jmp 0x1403fc5e2
je 0x1403fc5f4
mov word [r10], 0
dec r8b
inc r8d
movzx r9d, word [0x1400b8f10]
xadd r10, r8
cmp rdx, 0x104
mov r8d, 0x104
not r10b
jmp 0x1403fc615
cmovb r8, rdx
sbb r10d, 0x22a406c2
shrd r10d, ebp, 0x7b
mov r10, rcx
cmp dh, dh
test di, 0x1182
cmp rsp, 0x6dee0392
test r9w, r9w
jmp 0x1403fc63f
je 0x1403fc6a5
xor edx, edx
cbw
lea rax, [0x1400b8f10]
mov r10, rcx
cmp r11b, 0xed
nop dword [rax + rax]
stc
cmp r8, rdx
je 0x1403fc6b3
mov word [r10], r9w
movsxd r9, r12d
adc r9w, 0x3937
clc
add r10, 2
movsx r9d, si
movzx r9, r9w
movzx r9d, word [rax + rdx*2 + 2]
inc rdx
cmc
test r9w, r9w
jmp 0x1403fc696
jne 0x1403fc660
sub r8, rdx
cmp ebx, 0x3ce32feb
test r8, r8
jmp 0x1403fc6ad
je 0x1403fc6c1
mov word [r10], 0
movsx edx, di
movsx rdx, r12w
cwde
movabs rax, 0xe039ec0d24fefd13
mov qword [rsp], rax
movabs rax, 0x2247bce40ef3a5e6
movsxd rdx, esp
jmp 0x1403fc6e2
mov qword [rsp + 8], rax
movsxd rdx, r11d
movzx rdx, di
movabs rdx, 0xe05dec612491fd3d
jmp 0x1403fc6fd
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rax
xchg al, ah
movzx eax, r13w
movzx rax, r10w
lea rax, [rsp + 0x10]
jmp 0x1403fc71b
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
nop word cs:[rax + rax]
stc
cmp word [rcx + 2], 0
jmp 0x1403fc746
lea rcx, [rcx + 2]
jmp 0x1403fc74f
jne 0x1403fc73c
test ax, ax
jmp 0x1403fc75d
je 0x1403fc79d
lea rdx, [rsp + 2]
nop word cs:[rax + rax]
mov word [rcx], ax
movzx eax, bx
cmp dl, 0x2b
add eax, esi
add rcx, 2
movzx eax, word [rdx]
add rdx, 2
jmp 0x1403fc78f
test ax, ax
jmp 0x1403fc797
jne 0x1403fc773
mov word [rcx], 0
test r12b, r13b
add rsp, 0x28
ret
Function at 0x140420791
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
and r9d, 0x3b5d118a
bsf si, r11w
mov r10, qword [rcx]
rcl sil, 0xd
movsx r9d, cx
test r12b, 0x37
mov rsi, qword [rcx + 0x18]
sar r9w, cl
shr r9b, cl
mov r9d, dword [r10 + 4]
clc
imul r9d, dword [r10]
jmp 0x1404207c6
cmp r8d, 2
jmp 0x1404207cf
jne 0x140420978
test r9d, r9d
jmp 0x1404207dd
je 0x1404209fa
lea ecx, [r9 - 1]
clc
test r13b, al
cmp ecx, 3
jmp 0x1404207f3
jb 0x140420903
mov r11d, r9d
adc r10b, bl
rol r8w, 0x36
and r11d, 0xfffffffc
sal r8, cl
and r10b, 0xc6
nop word cs:[rax + rax]
dec r10b
shr r10w, 0xd5
adc r10, 0x2041260
movzx r8d, word [rsi]
jmp 0x140420839
movzx r10d, word [rsi + 4]
sub ecx, ecx
or cl, r10b
cmp r8w, word [rdx]
movsx r8w, r8b
mov r8, r9
setne cl
sar r8w, cl
neg ecx
sbb r8, 0x732b79c6
add r8b, r11b
movzx r8, r15w
mov word [rsi + 2], cx
shr r8b, cl
sub ecx, ecx
cmp r10w, word [rdx]
setne cl
shld r8d, ebp, 0xe0
neg ecx
xor r8b, 0xd6
xadd r8b, r8b
mov word [rsi + 6], cx
rol r8w, 0x55
test r12b, 0x53
movzx r8d, word [rsi + 8]
xor ecx, ecx
and cl, dil
cmp r8w, word [rdx]
setnp r8b
setne cl
sbb r8b, al
neg ecx
bswap r8w
rcr r8, cl
test spl, r8b
mov word [rsi + 0xa], cx
test ah, 0xb2
shr r8b, 0x3d
movzx r8d, word [rsi + 0xc]
test rdx, 0x53f76414
jmp 0x1404208d2
sub ecx, ecx
cmp r8w, word [rdx]
setg cl
setne cl
cmp sil, 0xf4
neg ecx
stc
test r12b, dl
jmp 0x1404208ed
mov word [rsi + 0xe], cx
add rsi, 0x10
cmp r13b, 0x12
add r11d, 0xfffffffc
jne 0x14042082b
test r9b, 3
jmp 0x14042090c
je 0x1404209fa
and r9d, 3
mov r8w, 0x7495
bt r8w, 0x7d
dec r8w
sub ecx, ecx
sal r8b, 0xcb
inc r8b
sbb r8d, 0x16de5b7c
nop word cs:[rax + rax]
movzx r8d, word [rsi + rcx*4]
sub eax, eax
or al, dl
cmp r8w, word [rdx]
setne al
stc
neg eax
jmp 0x140420958
mov word [rsi + rcx*4 + 2], ax
jmp 0x140420962
inc rcx
cmp r9d, ecx
jmp 0x14042096d
jne 0x140420940
jmp 0x1404209fa
test r9d, r9d
je 0x1404209fa
movzx r10d, word [rdx]
mov r8d, r9d
jmp 0x14042098d
sub ecx, ecx
jmp 0x1404209a8
inc rcx
clc
stc
cmc
cmp r8d, ecx
jmp 0x1404209a2
je 0x1404209fa
cmp word [rsi + rcx*8], r10w
jne 0x140420994
movzx eax, word [rsi + rcx*8 + 2]
cmp ax, word [rdx + 2]
jmp 0x1404209c1
jne 0x140420994
movzx eax, word [rsi + rcx*8 + 4]
jmp 0x1404209d2
cmp ax, word [rdx + 4]
jmp 0x1404209db
jne 0x140420994
mov word [rsi + rcx*8 + 6], 0
sets r10b
movzx r10d, word [rdx]
jmp 0x1404209f5
jmp 0x140420994
pop rsi
jmp 0x140420a00
ret
Function at 0x140429d6b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub si, 0x75c8
and si, r8w
push rdi
stc
ror si, 0x56
sub rsp, 0x28
mov rsi, rcx
movzx edi, dx
movzx edx, word [rcx + rdi*4 + 0x834]
test dx, dx
jmp 0x140429d95
js 0x140429da8
mov rcx, rsi
jmp 0x140429da3
call fcn.140429d6b
movsxd rcx, dword [rsi + 0x8860]
cmp r14b, r8b
cmp ecx, dword [rsi + 0x8858]
jmp 0x140429dbd
jge 0x140429f6f
movsxd rax, dword [rsi + 0x885c]
mov dx, 0x19fd
cmp r15d, esi
add rax, rcx
rol cl, cl
mov r8, qword [rsi + 8]
lea edx, [rax + 3]
bt cx, 0xf5
test eax, eax
mov cl, 0x21
movsx rcx, r10w
cmovns edx, eax
movzx ecx, r14w
mov rcx, qword [rsi + 0x18]
stc
cmp r14b, 0x81
sar edx, 2
movsxd rdx, edx
jmp 0x140429e07
mov byte [rcx + rdx], 1
mov rdx, qword [rsi + 0x8838]
test dx, r11w
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp bp, ax
stc
jmp 0x140429e27
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x140429e31
jb 0x140429e89
movzx ecx, byte [rdx + rdi*4 + 2]
stc
cmp dh, 0x7b
mov byte [r8 + rax], cl
rcl cx, 0xd0
shr cl, 0xf7
movzx ecx, byte [rdx + rdi*4 + 1]
stc
mov byte [r8 + rax + 1], cl
jmp 0x140429e5e
movzx ecx, byte [rdx + rdi*4]
test r14w, 0x46b8
test r12b, r12b
mov byte [r8 + rax + 2], cl
test r13b, bpl
movzx ecx, byte [rdx + rdi*4 + 3]
test r8b, 0x9d
clc
mov byte [r8 + rax + 3], cl
cmp r11d, 0x40ad6f9e
mov eax, dword [rsi + 0x885c]
test ax, 0x25ca
cmc
add eax, 4
stc
jmp 0x140429e9d
mov dword [rsi + 0x885c], eax
cmc
jmp 0x140429ea9
cmp eax, dword [rsi + 0x8854]
jmp 0x140429eb4
jl 0x140429f6f
mov ecx, dword [rsi + 0x884c]
xor rax, 0x42c45d1e
jmp 0x140429ecc
mov eax, dword [rsi + 0x8858]
cmc
mov dword [rsi + 0x885c], ecx
bsf ecx, ebx
mov ecx, dword [rsi + 0x8860]
add ecx, dword [rsi + 0x8844]
clc
cmp sp, 0x2283
mov dword [rsi + 0x8860], ecx
stc
jmp 0x140429efa
cmp ecx, eax
jl 0x140429f6f
mov ecx, dword [rsi + 0x8840]
test ch, 0x52
nop dword [rax]
cmp rdx, rbx
test ecx, ecx
jmp 0x140429f1c
jle 0x140429f6f
mov edx, dword [rsi + 0x8864]
jmp 0x140429f2e
shl edx, cl
stc
mov dword [rsi + 0x8844], edx
test dil, 0xb6
cmp r8b, 0xaa
sar edx, 1
cmp r15b, dil
add edx, dword [rsi + 0x8850]
jmp 0x140429f4f
mov dword [rsi + 0x8860], edx
jmp 0x140429f5a
dec ecx
mov dword [rsi + 0x8840], ecx
cmp edx, eax
jmp 0x140429f69
jge 0x140429f15
add rsp, 0x28
not sil
movzx edi, r11w
pop rdi
cmovae esi, r11d
movzx rsi, r15w
movsx rsi, di
pop rsi
jmp 0x140429f8d
ret