joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f72e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, qword [rsp + 8]
shl ch, cl
mov ecx, 0x7ff0
sar r8b, cl
movzx r8w, r11b
cmp r15w, r14w
mov r8, rax
cmp r14b, 0x83
stc
shr r8, 0x30
test cx, r8w
jmp 0x140252f1a
dec ecx
jmp 0x1401b4798
jmp 0x140219ec5
shr rax, 0x30
clc
cmc
and ax, dx
movsd qword [rsp + 8], xmm0
mov edx, 0x3fe0
or ax, dx
jmp 0x1401c7dc5
add eax, eax
jmp 0x1401c5a2b
je 0x14025fdae
xor r9d, r9d
bswap ecx
xchg ch, cl
cmovle cx, cx
mov ecx, 0xfffffc03
jmp 0x1401e744d
test byte [rsp + 0xe], 0x10
je 0x1401a187d
mov dword [rsp + 8], edx
shr rdx, cl
xchg edx, eax
ror edx, cl
movzx eax, word [rsp + 0xe]
shl edx, 0x7d
shl dh, cl
sbb dx, 0x4885
mov edx, 0xffef
and ax, dx
test rdi, rax
jmp 0x140209b1d
jmp 0x140219ec5
test edx, edx
jns 0x1401b9b85
or eax, 1
clc
test si, 0x4156
mov dword [rsp + 0xc], eax
add edx, edx
jmp 0x1400f88f8
movsd xmm0, qword [rsp + 0x10]
jmp 0x140219ec5
mov dword [rsp + 0xc], eax
jmp 0x1401b9b70
mov word [rsp + 0xe], ax
movsd xmm0, qword [rsp + 8]
jmp 0x1401b6b00
xorps xmm0, xmm0
mov r10, rdx
jmp 0x14028441b
comisd xmm0, xmm1
seta r9b
cmp r15w, 0x411e
cmp r13b, bpl
clc
test r8b, 0x10
jmp 0x14028fb3f
movaps xmm1, xmm0
jmp 0x140288cfa
mov word [rsp + 0xe], ax
cmp edi, 0x5f4468ed
test r9d, r9d
je 0x140209b53
mov edx, 0x8000
cmp al, 0xe9
stc
or ax, dx
movzx dx, r11b
or dl, spl
mov word [rsp + 0xe], ax
xadd ah, ah
btr ax, ax
rcr dx, cl
movsd xmm0, qword [rsp + 8]
adc dl, 0xe8
bt rdx, 0x3a
mov edx, 0xbfef
movsd qword [rsp + 0x10], xmm0
cwde
mov rax, qword [rsp + 0x10]
jmp 0x140124657
mov word [rsp + 0x16], ax
test dil, 0x16
cmp spl, al
cmp r11b, 0xe
sub ecx, 0x3fe
jmp 0x1401c05b6
ret
mov dword [r10], ecx
jmp 0x14020f2f3
jne 0x14025fdae
mov edx, dword [rsp + 8]
test cl, r14b
shr rax, 0x20
stc
clc
test eax, 0xfffff
jne 0x1401b1085
test edx, edx
jmp 0x1401b107f
movzx ecx, word [rsp + 0xe]
cdq
cwde
mov edx, 0xbfef
sar al, cl
neg ah
movzx ax, r13b
shr ecx, 4
sar ax, 0x96
btc rax, 0x81
bsf eax, ebx
movsd qword [rsp + 0x10], xmm1
cmp r11w, 0x7195
movsx eax, ax
xor ax, 0x6acf
and ecx, 0x7ff
shr eax, 0xbb
sar eax, cl
sal al, cl
movsd qword [rsp + 0x18], xmm1
mov rax, qword [rsp + 0x18]
test dx, r13w
cmc
cmp r8, 0x72ee6b94
shr rax, 0x30
and ax, dx
mov edx, 0x3fe0
cmc
or ax, dx
cmc
jmp 0x14020a757
ucomisd xmm1, xmm0
jp 0x1400e66eb
jne 0x1400e66eb
sub ecx, ecx
jmp 0x1400ffb30
movsd qword [rsp + 8], xmm0
jmp 0x1401e00a6
jne 0x1401b47ad
mov eax, dword [rsp + 0xc]
jmp 0x1401a187d

Function at 0x140227285
Capabilities:
Parse pe header

Disassembly:
jmp fcn.1404a9cfa
lea edx, [r8 + 2]
jmp 0x1400f703c
xor r8d, r8d
movsx dx, ch
jmp 0x1401c43a5

Function at 0x14023eab1
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
jmp 0x14010fdc3
ret
ret
jne 0x1400f69d5
sub eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
mov al, spl
sete al
jmp 0x1401b6832
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400f69d5
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
test r10, r14
stc
cmp bl, r11b
cmp dword [rdx], 0x4550
jmp 0x140237bb6

Function at 0x14025039f
Capabilities:
Parse pe header

Disassembly:
jmp fcn.1404a9cfa
xor edx, edx
xor ecx, ecx
movsxd r8, eax
setle r8b
lea r8d, [rdx + 1]
jmp 0x1400f6380
Function at 0x1403b4a6d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test dil, bpl
movsxd rax, r15d
push r14
sbb al, r13b
shl r14, cl
push r13
sal r14w, 0x7d
push r12
cmp r15d, r12d
push rsi
sar si, 0x5f
push rdi
clc
shl dil, cl
ror dil, cl
push rbx
mov dil, dl
btc ax, 0xae
sub rsp, 0x20
test ch, 0x5d
mov rsi, r8
adc bx, 0x36a8
xadd r14d, ebx
movsx edi, r8w
mov rdi, rdx
mov r14, rcx
rcl eax, 0xe9
mov rbx, qword [rcx]
shl ah, cl
mov rcx, qword [rcx + 0x10]
lahf
sub rcx, rbx
stc
sar rcx, 4
add ax, dx
sbb al, r13b
movabs rax, 0xf0f0f0f0f0f0f0f1
cmp r8b, 0x72
imul rcx, rax
cmp rcx, r8
jmp 0x1403b4af1
jae 0x1403b4b5e
mov rcx, r14
movsxd rdx, ecx
xchg dl, dl
mov rdx, rsi
jmp 0x1403b4b07
call fcn.1403b4d3c
mov rbx, qword [r14]
movsx rdx, dx
mov cl, 0xb5
movzx rcx, sp
nop word [rax + rax]
cwd
movzx edx, r11w
mov rcx, rbx
mov rdx, rdi
jmp 0x1403b4b33
call fcn.1403b5536
add rbx, 0x110
add rdi, 0x110
jmp 0x1403b4b4b
dec rsi
jmp 0x1403b4b53
jne 0x1403b4b28
jmp 0x1403b4cf5
mov r13, qword [r14 + 8]
test r9b, 0x20
mov r12, r13
movzx r15, r10w
xor r15b, r12b
cmp r15b, 0x2a
sub r12, rbx
sar r12, 4
movsx r15d, r12w
ror r15b, cl
movsx r15, dx
imul r12, rax
bsf r15, rbx
bt r15d, 0x11
mov r15, r12
cmp ah, ch
sub r15, rsi
jmp 0x1403b4ba0
jae 0x1403b4c51
cmp rbx, r13
jmp 0x1403b4bae
je 0x1403b4bf5
nop word cs:[rax + rax]
cdq
cqo
mov rcx, rbx
bswap dx
movsx dx, r15b
mov rdx, rdi
call fcn.1403b4fca
add rbx, 0x110
test bpl, 0xe0
add rdi, 0x110
cmc
cmp rbx, qword [r14 + 8]
jne 0x1403b4bc5
cmp rsi, r12
jmp 0x1403b4bfd
je 0x1403b4cf5
nop dword [rax + rax]
mov rcx, rbx
movsx edx, r13w
movsx rdx, di
setge dl
mov rdx, rdi
jmp 0x1403b4c21
call fcn.1403b5536
add rbx, 0x110
jmp 0x1403b4c32
add rdi, 0x110
jmp 0x1403b4c3e
inc r15
jmp 0x1403b4c46
jne 0x1403b4c0b
jmp 0x1403b4cf5
imul r15, rsi, 0x110
clc
test rbx, 0x4d592674
cmc
lea r15, [r15 + rbx]
test rsi, rsi
jmp 0x1403b4c6d
je 0x1403b4ca6
nop
mov rcx, rbx
movsx edx, ax
cqo
mov rdx, rdi
jmp 0x1403b4c84
call fcn.1403b4fca
add rbx, 0x110
add rdi, 0x110
dec rsi
jne 0x1403b4c74
mov r13, qword [r14 + 8]
clc
cmc
cmp r15, r13
jmp 0x1403b4cae
je 0x1403b4cef
mov rsi, r15
not ch
jmp 0x1403b4cbe
nop word [rax + rax]
mov cx, 0x161
movsx cx, r9b
mov rcx, rsi
jmp 0x1403b4cd5
call fcn.1403af42f
add rsi, 0x110
cmp rsi, r13
jmp 0x1403b4ce9
jne 0x1403b4ccd
mov rbx, r15
rcr dil, cl
mov qword [r14 + 8], rbx
ror r12w, 8
add rsp, 0x20
pop rbx
xchg dil, r13b
pop rdi
pop rsi
movsxd r14, r9d
cmovp r14, rdx
mov r13, 0x294673d9
pop r12
movsx r13d, r12w
pop r13
movzx r15, r11w
movsx r14, dx
pop r14
movsx r15, dx
movsx r15d, r9w
setnp r15b
pop r15
jmp 0x1403b4d3b
ret
Function at 0x1403b635b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r10b, r12b
stc
push r14
push r12
movsxd r12, r11d
push rsi
push rdi
mov r12w, r9w
ror r12w, cl
sbb r12d, esi
push rbx
sub rsp, 0x28
mov r12, r8
jmp 0x1403b6383
test rdx, rdx
jmp 0x1403b638b
je 0x1403b6591
mov r15, rdx
mov rbx, rcx
cmc
clc
xor esi, esi
jmp 0x1403b63a0
jmp 0x1403b6405
mov rcx, rdi
cdq
movzx edx, r13w
not dh
mov rdx, r14
call fcn.1403b4138
mov eax, dword [rbx + rsi + 0x58]
stc
jmp 0x1403b63c4
mov dword [r12 + rsi + 0x58], eax
sar ah, 0xc0
xor rax, 0x7d091601
sub ax, r15w
mov rax, qword [rbx + rsi + 0x50]
jmp 0x1403b63e5
mov qword [r12 + rsi + 0x50], rax
cmp eax, 0x579f5d84
cmc
test spl, r13b
add rsi, 0x60
jmp 0x1403b63fc
dec r15
je 0x1403b658c
mov eax, dword [rbx + rsi + 8]
test r15w, cx
clc
mov dword [r12 + rsi + 8], eax
cmp r12, rbx
jmp 0x1403b641b
je 0x1403b63b7
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403b642c
jb 0x1403b6441
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403b643c
jmp 0x1403b6449
lea r9, [rbx + rsi]
add r9, 0x10
lea r14, [r12 + rsi]
cbw
clc
shld di, ax, 0x2b
add r14, 0x10
mov rdi, qword [rbx + rsi + 0x20]
mov rax, qword [r12 + rsi + 0x28]
stc
clc
cmp rax, rdi
jmp 0x1403b646d
jae 0x1403b648c
mov rcx, r14
movsx edx, r12w
mov rdx, rdi
jmp 0x1403b6482
call fcn.1403b4138
jmp 0x1403b64dd
cmp rax, 0x10
jmp 0x1403b6495
jb 0x1403b64a8
mov r14, qword [r12 + rsi + 0x10]
movzx cx, cl
movsx rdx, bx
mov qword [r12 + rsi + 0x20], rdi
movzx cx, r10b
mov rcx, r14
jmp 0x1403b64ba
mov rdx, r9
xchg r8w, r8w
bswap r8
sete r8b
mov r8, rdi
jmp 0x1403b64d0
call fcn.14049c447
mov byte [r14 + rdi], 0
and r14b, r12b
mov r14, qword [rbx + rsi + 0x40]
test dil, 0x22
cmp qword [rbx + rsi + 0x48], 0x10
jb 0x1403b6501
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403b64fc
jmp 0x1403b650d
lea r9, [rbx + rsi]
add r9, 0x30
cbw
sub ah, bl
lea rdi, [r12 + rsi]
btc rax, 0x47
ror al, 0x35
add rdi, 0x30
sbb rax, 0x31db306a
bt ax, r15w
btr ax, 0xa7
mov rax, qword [r12 + rsi + 0x48]
cmp r11b, r8b
test dl, 0xb2
cmp rax, r14
jmp 0x1403b6541
jb 0x1403b63a5
cmp rax, 0x10
jmp 0x1403b6550
jb 0x1403b655b
mov rdi, qword [r12 + rsi + 0x30]
mov qword [r12 + rsi + 0x40], r14
bswap rcx
mov rcx, rdi
movsxd r8, r12d
mov rdx, r9
mov r8w, cx
mov r8, r14
jmp 0x1403b6578
call fcn.14049c447
mov byte [rdi + r14], 0
jmp 0x1403b6587
jmp 0x1403b63b7
lea r12, [r12 + rsi]
clc
mov rax, r12
add rsp, 0x28
pop rbx
pop rdi
setl r15b
movsx esi, r14w
pop rsi
pop r12
mov r15w, 0x1973
bswap r15w
pop r14
movzx r15, r8w
movsx r15w, bl
pop r15
ret
Function at 0x1403ba36c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bt esi, 0x3b
movzx rsi, r10w
push rdi
push rbx
rol sil, cl
sub rsp, 0x20
shl rax, 0x36
adc rsi, rax
mov rsi, rcx
test bl, 0x38
lea rax, [0x1400bdab0]
test r15w, 0x1d30
cmp rcx, r11
clc
mov qword [rcx], rax
adc rax, rbx
jmp 0x1403ba3a7
mov rax, qword [rcx + 0x88]
cmp rax, 8
jmp 0x1403ba3b7
jb 0x1403ba42e
mov rcx, qword [rsi + 0x70]
bts rdx, rcx
lea rdx, [rax + rax]
add rdx, 2
stc
test r9w, 0x340e
cmp rdx, 0x1000
jb 0x1403ba429
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp bl, r10b
cmp rcx, 0x20
jmp 0x1403ba3f8
jae 0x1403ba5ae
add rax, rax
cqo
sar dx, cl
cmovno cx, ax
add rax, 0x29
movzx rdx, r11w
movsx dx, spl
mov rdx, rax
xchg cl, ch
movzx cx, dil
mov rcx, rbx
jmp 0x1403ba429
call fcn.1401e23eb
movaps xmm0, xmmword [0x1400bd3f0]
bt rax, r15
dec ah
movups xmmword [rsi + 0x80], xmm0
not dil
sub bl, spl
xor al, r10b
mov word [rsi + 0x70], 0
test ebp, r15d
add bl, cl
or edi, ebp
lea rax, [0x1400bdb70]
mov bh, 0x6a
mov qword [rsi], rax
mov bl, spl
btc bx, r12w
mov rdi, qword [rsi + 0x40]
xchg bl, bh
mov rbx, qword [rsi + 0x48]
stc
cmp rdi, rbx
jne 0x1403ba493
jmp 0x1403ba4ec
add rdi, 8
cmp rdi, rbx
je 0x1403ba4c7
mov rcx, qword [rdi]
cmp rsi, 0x74f33ec3
test rcx, rcx
jmp 0x1403ba4a5
je 0x1403ba486
mov rax, qword [rcx]
mov dx, r10w
mov edx, 1
jmp 0x1403ba4bc
call qword [rax + 0xb8]
jmp 0x1403ba486
mov rdi, qword [rsi + 0x40]
cmp rdi, qword [rsi + 0x48]
jmp 0x1403ba4d4
je 0x1403ba4ec
mov qword [rsi + 0x48], rdi
cmp bx, 0x4b9f
test r13w, 0x3bf0
cmp rbp, r12
test rdi, rdi
jmp 0x1403ba4f4
je 0x1403ba585
mov rdx, qword [rsi + 0x50]
clc
test r12b, al
sub rdx, rdi
test cx, 0x58bd
cmp rdx, 0x1000
jmp 0x1403ba516
jb 0x1403ba556
mov rax, qword [rdi - 8]
jmp 0x1403ba525
add rdi, 0xfffffffffffffff8
cmp bp, 0x4183
test r12w, cx
sub rdi, rax
test bh, 9
clc
cmp rdi, 0x20
jmp 0x1403ba542
jae 0x1403ba5ae
add rdx, 0x27
ror dil, 0xdc
mov dil, 0x4b
mov rdi, rax
add rsi, 0x40
bswap ecx
mov rcx, 0x6f0279d6
mov rcx, rdi
jmp 0x1403ba56b
call fcn.1401e23eb
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
sar di, cl
setae dil
add rsp, 0x20
movzx bx, r8b
not si
movsx di, r13b
pop rbx
movsx si, al
mov dil, r9b
pop rdi
movsx si, spl
bswap si
pop rsi
jmp 0x1403ba5ad
ret
call fcn.1404aedbf
int3
Function at 0x1403cf55a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
or al, 0x99
test al, r10b
push rsi
bts rax, rdi
or eax, 0x4e25176c
push rdi
push rbx
or sil, 0x7a
inc eax
sub rsp, 0x28
movzx si, r13b
movsx esi, r9w
mov rsi, rcx
lea rax, fcn.140010f00
mov qword [rcx], rax
movsx eax, r15w
lea rax, fcn.140010f00
cmp bp, di
cmc
mov qword [rcx + 0x50], rax
cmp bpl, 0x31
cmc
mov rcx, qword [rcx + 0xa0]
test spl, 0xa9
stc
cmp r12w, bp
test rcx, rcx
jmp 0x1403cf5bd
je 0x1403cf647
mov rdx, qword [rsi + 0xb0]
cmp r8b, r10b
sub rdx, rcx
cmp sil, r11b
cmp rdx, 0x1000
jb 0x1403cf61c
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403cf5f4
jae 0x1403cf76c
add rdx, 0x27
movsx rcx, r15w
mov rcx, 0x14b0640b
movzx di, al
mov rcx, rax
movsx rdi, r12w
jmp 0x1403cf61c
lea rdi, [rsi + 0xa0]
call fcn.1401e23eb
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
jmp 0x1403cf633
mov qword [rdi + 0x10], 0
adc di, 0x401f
movzx edi, cx
rcr di, 0x34
mov rdi, qword [rsi + 0x60]
jmp 0x1403cf650
test rdi, rdi
jmp 0x1403cf658
je 0x1403cf73c
lea r14, [rsi + 0x60]
movsx rbx, di
mov rbx, qword [rsi + 0x68]
cmp r14b, 0x71
cmp al, r11b
cmc
cmp rdi, rbx
jmp 0x1403cf67a
je 0x1403cf6ba
nop dword [rax]
movsx rcx, r11w
movzx cx, r10b
mov rcx, rdi
jmp 0x1403cf695
call fcn.1403af42f
add rdi, 0x110
cmc
cmp r9b, 0x57
cmp rdi, rbx
jne 0x1403cf68d
mov rdi, qword [r14]
movzx rdx, ax
sar rdx, 0x2c
mov rdx, qword [rsi + 0x70]
cmc
cmp r10w, r14w
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403cf6d2
jb 0x1403cf70f
mov rax, qword [rdi - 8]
test r9b, dl
test bh, 0x6f
add rdi, 0xfffffffffffffff8
test r12b, 0x20
cmp sp, r14w
test r10, r11
sub rdi, rax
cmc
test r10w, r10w
cmp rdi, 0x20
jmp 0x1403cf702
jae 0x1403cf76c
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
jmp 0x1403cf717
call fcn.1401e23eb
xorps xmm0, xmm0
movups xmmword [r14], xmm0
rol rcx, cl
cmp spl, spl
mov qword [r14 + 0x10], 0
sub r14b, 0xb
xor bl, 0x2f
test ax, r11w
mov rcx, rsi
add rsp, 0x28
movsx esi, r11w
movzx si, r8b
mov r14w, di
pop rbx
setno dil
pop rdi
pop rsi
movsx r14w, r13b
movsx r14d, bx
pop r14
jmp 0x1403cf767
jmp fcn.140439d39
call fcn.1404aedbf
int3
Function at 0x1403eae4b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
shr ah, cl
ror ah, cl
ror rax, 0x8d
push rsi
xor esi, r8d
shl r14b, cl
add r14b, r13b
push rdi
test al, r11b
push rbx
sub rsp, 0x28
shrd r14, r11, 0xf4
mov rbx, rdx
lahf
mov r14b, spl
stc
mov r14, rcx
movzx esi, r14w
lea rsi, [rdx + r8]
movzx rax, sp
bt eax, eax
mov eax, dword [rcx + 8]
test al, 2
jmp 0x1403eae91
jne 0x1403eaf4e
mov dil, 1
cmc
cmp r14w, 0x68f8
test al, 4
jmp 0x1403eaea8
je 0x1403eb086
lea rax, [rbx + 1]
cmp rax, rsi
ja 0x1403eb084
mov byte [rbx], 0x12
mov rcx, 0x23d2101d
ror ecx, 0xb2
rcl cx, cl
mov rcx, qword [r14 + 0x40]
cmp rcx, 0x80
jmp 0x1403eaedb
jb 0x1403eb052
nop word cs:[rax + rax]
btc edx, ebx
lea rdx, [rax + 1]
cmp rdx, rsi
ja 0x1403eb084
mov ebx, ecx
cmp dx, si
stc
test r14d, edx
or bl, 0x80
cmp r14b, 0x99
test r12w, 0x3a19
mov byte [rax], bl
sal rbx, 0x9b
rcl ax, 0x42
movsx eax, r12w
mov rbx, rcx
movzx rax, bx
rcr ah, cl
shr ax, cl
shr rbx, 7
not al
mov rax, rdx
cmp rcx, 0x3fff
mov rcx, rbx
jmp 0x1403eaf43
ja 0x1403eaeee
jmp 0x1403eb05b
test r8, r8
jmp 0x1403eaf56
jle 0x1403eb084
mov byte [rbx], 0xa
movsx rcx, r9w
not cx
inc rbx
mov rcx, qword [r14 + 0x20]
clc
test cx, 0x2096
cmp rcx, 0x80
jmp 0x1403eaf7f
jb 0x1403eafee
nop dword [rax + rax]
btr ax, 0x59
lea rax, [rbx + 1]
clc
cmp rax, rsi
ja 0x1403eb084
mov edx, ecx
test sil, 0x36
or dl, 0x80
test rsi, 0x5e041e34
mov byte [rbx], dl
stc
shr bx, 0xd3
mov rdx, rcx
xchg rbx, rbx
mov bx, r10w
shr rdx, 7
mov rbx, rax
clc
test bx, cx
cmp rcx, 0x3fff
sete ch
not cl
movsxd rcx, ecx
mov rcx, rdx
jmp 0x1403eafe3
ja 0x1403eaf92
jmp 0x1403eb000
mov rax, rbx
sub dl, 0x81
shl dx, cl
mov rdx, rcx
adc cl, 0x97
movsx ecx, si
lea rcx, [rax + 1]
cmc
cmp rcx, rsi
jmp 0x1403eb00d
ja 0x1403eb084
mov byte [rax], dl
mov r8b, bpl
mov r8, qword [r14 + 0x20]
bt rbx, r13
test cl, r10b
movzx rbx, ax
lea rbx, [rcx + r8]
jmp 0x1403eb030
cmp rbx, rsi
ja 0x1403eb084
cmp qword [r14 + 0x28], 0x10
jmp 0x1403eb043
jb 0x1403eb0b6
mov rdx, qword [r14 + 0x10]
jmp 0x1403eb0bf
mov rdx, rax
movsxd rbx, edx
mov rbx, rcx
lea rcx, [rdx + 1]
cmc
cmp rcx, rsi
ja 0x1403eb084
mov byte [rdx], bl
sal ax, 0xcb
mov r8, qword [r14 + 0x40]
stc
lea rax, [rcx + r8]
cmp r14, r11
cmp rax, rsi
jbe 0x1403eb0d2
xor edi, edi
mov eax, edi
stc
xor di, di
add rsp, 0x28
mov sil, r15b
movsx di, r14b
xchg rdi, rsi
pop rbx
movsx edi, r15w
pop rdi
jmp 0x1403eb0ad
pop rsi
pop r14
jmp 0x1403eb0b5
ret
lea rdx, [r14 + 0x10]
jmp 0x1403eb0bf
call fcn.14049c447
mov eax, dword [r14 + 8]
jmp 0x1403eb0cd
jmp 0x1403eae97
cmp qword [r14 + 0x48], 0x10
jmp 0x1403eb0dc
jb 0x1403eb0f0
mov r14, qword [r14 + 0x30]
jmp 0x1403eb0eb
jmp 0x1403eb0fe
add r14, 0x30
setge dl
jmp 0x1403eb0fe
mov rdx, r14
jmp 0x1403eb106
call fcn.14049c447
jmp 0x1403eb086
Function at 0x140424ad3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
cmp r9w, 0x7a1f
bts esi, r10d
push rdi
sub rsp, 0x28
btr rsi, 0x96
mov rsi, rcx
btr rdi, rcx
inc dil
movzx edi, dx
inc dx
movzx edx, word [rcx + rdi*4 + 0x834]
test dx, dx
jmp 0x140424b08
js 0x140424b16
mov rcx, rsi
call fcn.140424ad3
movsxd rcx, dword [rsi + 0x8860]
test r14b, bl
clc
cmp ch, 0x39
cmp ecx, dword [rsi + 0x8858]
jmp 0x140424b2f
jge 0x140424cc3
movsxd rax, dword [rsi + 0x885c]
add r8b, 0xec
add rax, rcx
shl dx, cl
cwd
mov r8, qword [rsi + 8]
lea edx, [rax + 3]
bswap rcx
movzx ecx, r11w
test eax, eax
movzx cx, r13b
cmovns edx, eax
inc cx
or ecx, 0x79971e49
sal cl, cl
mov rcx, qword [rsi + 0x18]
cmp r13b, spl
stc
sar edx, 2
movsxd rdx, edx
mov byte [rcx + rdx], 1
sal dh, cl
sbb edx, edi
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x140424b9a
jb 0x140424be6
movzx ecx, byte [rdx + rdi*4 + 2]
clc
cmc
mov byte [r8 + rax], cl
shl cl, 0xdc
rcl ch, cl
movsxd rcx, esi
movzx ecx, byte [rdx + rdi*4 + 1]
cmc
cmp r15b, r9b
test sil, 0x1f
mov byte [r8 + rax + 1], cl
rcr ch, cl
movzx ecx, byte [rdx + rdi*4]
stc
cmc
mov byte [r8 + rax + 2], cl
or cl, r8b
not ch
btc cx, ax
movzx ecx, byte [rdx + rdi*4 + 3]
cmc
mov byte [r8 + rax + 3], cl
mov eax, dword [rsi + 0x885c]
cmp si, r9w
jmp 0x140424bf6
add eax, 4
mov dword [rsi + 0x885c], eax
jmp 0x140424c08
cmp eax, dword [rsi + 0x8854]
jmp 0x140424c13
jl 0x140424cc3
mov ecx, dword [rsi + 0x884c]
adc ax, r13w
xor rax, rsi
shl ax, 0xb0
mov eax, dword [rsi + 0x8858]
stc
test r13b, cl
mov dword [rsi + 0x885c], ecx
bswap rcx
dec rcx
shr cx, 0x4b
mov ecx, dword [rsi + 0x8860]
stc
add ecx, dword [rsi + 0x8844]
clc
cmp r15b, r9b
mov dword [rsi + 0x8860], ecx
cmp ecx, eax
jmp 0x140424c62
jl 0x140424cc3
mov ecx, dword [rsi + 0x8840]
nop dword [rax]
test ecx, ecx
jle 0x140424cc3
mov edx, dword [rsi + 0x8864]
cmp r9, 0x27824363
stc
jmp 0x140424c90
shl edx, cl
mov dword [rsi + 0x8844], edx
sar edx, 1
add edx, dword [rsi + 0x8850]
mov dword [rsi + 0x8860], edx
jmp 0x140424cab
dec ecx
test al, r15b
mov dword [rsi + 0x8840], ecx
cmp edx, eax
jmp 0x140424cbd
jge 0x140424c75
add rsp, 0x28
movzx edi, si
mov di, 0x5e0b
pop rdi
pop rsi
jmp 0x140424cd5
ret
Function at 0x140427179
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov sil, cl
bts si, r10w
shl al, cl
push rdi
push rbx
sub rsp, 0x20
cmp r11b, 0xbd
mov rsi, rcx
mov eax, r11d
movsx rax, ax
movsx ax, r11b
movzx eax, byte [rcx + 0x4828]
cmp r12b, 0x69
cmp al, 0xff
jmp 0x1404271af
je 0x1404271c1
mov byte [rsi + 0x4828], 0xff
jmp 0x1404272e9
mov rbx, qword [rsi]
adc ax, 0x512e
btr ax, 0x94
mov rax, qword [rbx + 0xc0]
cmc
test cl, sil
cmp rax, qword [rbx + 0xc8]
jmp 0x1404271e4
jae 0x140427207
lea rcx, [rax + 1]
jmp 0x1404271f3
mov qword [rbx + 0xc0], rcx
movzx ecx, byte [rax]
jmp 0x140427202
jmp 0x1404272d9
cmp dword [rbx + 0x30], 0
jmp 0x140427210
je 0x140427288
mov r8d, dword [rbx + 0x34]
movsx rdx, r8w
movzx dx, r13b
cmovb edx, r14d
lea rdi, [rbx + 0x38]
movzx rcx, r9w
cqo
mov rcx, qword [rbx + 0x28]
mov edx, 0x22190eec
mov rdx, rsp
cdq
mov rdx, rdi
jmp 0x140427246
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
test eax, eax
jmp 0x140427262
je 0x14042728f
cdqe
bsf rcx, rsp
movsx cx, r15b
add rax, rdi
bswap rcx
seto ch
movsx rcx, r8w
movzx ecx, byte [rdi]
jmp 0x1404272c0
mov al, 0xff
jmp 0x1404272e9
mov dword [rbx + 0x30], 0
bts ax, r11w
sbb al, r15b
btc eax, eax
lea rax, [rbx + 0x39]
stc
clc
test sil, 0xa5
mov byte [rbx + 0x38], 0
cmp r14w, 0x6ae7
test r13w, r9w
cmc
xor ecx, ecx
test al, r8b
clc
mov qword [rbx + 0xc8], rax
lea rax, [rbx + 0x39]
cmp bl, r11b
test cl, r12b
stc
mov qword [rbx + 0xc0], rax
mov al, 0xff
cmp cl, 0xff
jmp 0x1404272e3
je 0x140427324
add rsp, 0x20
bswap si
mov bl, r11b
pop rbx
pop rdi
movsx rsi, r15w
movzx rsi, bx
movsx esi, r15w
pop rsi
ret
lea rcx, [rax + 1]
test r8w, 0x78f3
mov qword [rbx + 0xc0], rcx
movzx eax, byte [rax]
cmp al, 0xff
jmp 0x14042731e
jne 0x1404272e9
mov rbx, qword [rsi]
movsxd rax, r11d
rcr ax, cl
and al, 0xd0
mov rax, qword [rbx + 0xc0]
clc
cmp rax, qword [rbx + 0xc8]
jb 0x140427303
cmp dword [rbx + 0x30], 0
jmp 0x14042734d
je 0x140427408
mov r8d, dword [rbx + 0x34]
jmp 0x140427360
lea rdi, [rbx + 0x38]
setle ch
cmovbe edx, r13d
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
jmp 0x140427377
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
cmp r15d, 0x3350ff9
sub ecx, dword [rbx + 0xd0]
clc
test r15d, 0x37ef3e92
add dword [rbx + 0xb8], ecx
stc
test ebx, 0x6a0b4b89
test eax, eax
je 0x1404273c7
movsxd rcx, eax
cmp r13d, r10d
xor rax, rsp
movsx eax, r8w
add rcx, rdi
movzx eax, byte [rdi]
jmp 0x1404273c2
jmp 0x1404273de
mov dword [rbx + 0x30], 0
lea rcx, [rbx + 0x39]
mov byte [rbx + 0x38], 0
test r10w, 0x49e7
sub eax, eax
mov qword [rbx + 0xc8], rcx
cmp r15w, 0x1492
lea rcx, [rbx + 0x39]
mov qword [rbx + 0xc0], rcx
cmp al, 0xff
jmp 0x1404273fd
je 0x140427324
jmp 0x1404272e9
xor eax, eax
jmp 0x1404272e9
Function at 0x140438fe9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sar r15b, cl
adc r15b, r11b
push r14
sar r14w, cl
cmc
push rsi
not r14b
movzx r15w, bpl
push rdi
push rbp
movsx ebp, r11w
clc
push rbx
shr r14b, 0x80
not bx
movsx r14d, r11w
sub rsp, 0x28
mov r15d, r9d
and bl, 0xb8
not bx
bt r14w, si
mov ebp, r8d
sal bl, cl
mov r14, rdx
xor bl, 0x6a
shl bh, 0x31
sub bx, si
mov rbx, rcx
bts cx, r8w
sar cl, cl
rol cx, 0xbc
lea rcx, [rdx + 0x20]
bsf dx, r10w
mov edx, r8d
mov r8d, r9d
clc
sub r9d, r9d
jmp 0x14043905d
call fcn.1404391f7
test r15d, r15d
jmp 0x14043906a
jle 0x140439111
test rax, rax
je 0x140439111
movsxd rsi, ebp
sub cx, sp
and cx, cx
sar dh, cl
mov ecx, r15d
xor ebp, ebp
not edx
cmovl edx, ebx
mov dx, ax
mov rdx, rsi
jmp 0x1404390c5
movzx edi, word [rdi + rdx*2]
jmp 0x1404390a2
mov word [rax + rbp*2], di
jmp 0x1404390ab
inc rbp
jmp 0x1404390b3
inc rdx
cmc
cmp rcx, rbp
jmp 0x1404390bf
je 0x140439120
mov di, 0x2a
test al, r13b
clc
test byte [rbx + 0x1c], 4
jmp 0x1404390d6
jne 0x1404390a2
mov rdi, qword [rbx]
test esp, 0x10b25d11
cmp qword [rdi + 0x10], rdx
jmp 0x1404390ee
jbe 0x1404391ec
cmp qword [rdi + 0x18], 8
jmp 0x1404390fe
jb 0x140439099
mov rdi, qword [rdi]
jmp 0x14043910c
jmp 0x140439099
movsxd rsi, ebp
bsr ecx, r13d
movsxd rdi, esp
shld rcx, r14, 0x2e
mov rbx, qword [rbx]
bsr di, r11w
mov rdi, qword [rbx + 0x10]
mov rcx, rdi
clc
stc
jmp 0x140439136
sub rcx, rsi
jmp 0x14043913e
jb 0x1404391ec
movsxd rax, r15d
cmp rbx, r9
cmp rcx, rax
jmp 0x140439152
cmovb rax, rcx
rcr ecx, cl
or cl, 0x34
rcr cx, 0x64
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140439173
mov rcx, qword [rbx]
mov r8b, 0x45
lea rcx, [rcx + rsi*2]
movzx r8d, cx
sub rdi, rax
sbb r8b, 0xe7
sub bpl, 0x56
shr dx, cl
mov rbp, rdi
bt rdx, rcx
sub rbp, rsi
dec r8w
clc
shl r8b, cl
lea rdx, [rcx + rax*2]
lea r8, [rbp + 2]
clc
add r8, rbp
jmp 0x1404391b0
call fcn.14049c447
mov qword [rbx + 0x10], rdi
mov byte [r14 + 0x16], 0
btr si, bx
add rsp, 0x28
cmovnp edi, esi
pop rbx
pop rbp
pop rdi
mov sil, 0xe9
movzx r14d, r11w
pop rsi
mov r14b, r15b
movsx r14d, r15w
movsxd r15, r9d
pop r14
cmova r15d, ebx
jmp 0x1404391e9
pop r15
ret
call fcn.14043867b
int3
Function at 0x14043d1d6
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx ecx, cx
jmp 0x14043d1e2
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp r14b, cl
cmp eax, 0x100
setae al
add rsp, 0x28
jmp 0x14043d1ff
ret
Function at 0x14043e95d
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movzx ax, r10b
mov rcx, qword [rcx]
mov rax, qword [rcx]
jmp 0x14043e971
call qword [rax + 0x28]
test eax, eax
jmp 0x14043e97b
je 0x14043e9b6
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
ror dl, 0x40
or dl, bl
inc dl
mov dl, 3
rcl r9b, cl
rcr r9, 0xbe
mov r9d, 0x2a
cmp dh, 0xfa
stc
cmc
add rsp, 0x28
jmp 0x14043e9b1
jmp fcn.1403a8612
nop
cmp r15b, 0xde
jmp 0x14043e9c0
add rsp, 0x28
jmp 0x14043e9c9
ret