joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001ed0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140108100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401080e0]
test rbx, rbx
je 0x140001f2c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140001f23
test eax, eax
jne 0x140001f23
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001f08
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002260
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401053a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002280
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002288
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002280
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400022dd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400022d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002280
add rax, 0x28
cmp rax, r9
jne 0x1400022c0
xor eax, eax
ret

Function at 0x1400022e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401053a0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400022ff
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002308
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400022ff
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400023a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401053a0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400023bf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400023c8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140117440]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140117450]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x14011a008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1401173b0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.140001930
mov rcx, qword [0x1401174d0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140117430]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140001740
mov ebx, dword [0x14011a028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r12, qword [0x14011a020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [r12 + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [r12 + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, rbp
mov qword [rdi], 0
mov qword [0x14011a020], rbp
call fcn.140001540
mov rax, qword [0x1401173c0]
mov r8, qword [0x14011a018]
mov ecx, dword [0x14011a028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x14011a020]
call fcn.140002a20
mov ecx, dword [0x14011a00c]
mov dword [0x14011a010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x14011a008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140117450]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call fcn.1400026e0
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x140117470]
mov rcx, qword [0x140117460]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x14011a010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140117490]
mov rcx, qword [0x140117480]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b5
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
sub rsp, 0x28
mov rax, qword [0x1401173e0]
mov dword [rax], 1
call fcn.140001180
nop
nop
add rsp, 0x28
ret
Function at 0x140001750
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.140002550
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]

Function at 0x1400017c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14011a094]
mov rbx, rcx
test esi, esi
jle 0x1400018f0
mov rax, qword [0x14011a098]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000180b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001895
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400017f0
mov rcx, rbx
call fcn.140002230
mov rdi, rax
test rax, rax
je 0x140001912
mov rax, qword [0x14011a098]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002370
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14011a098]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400018f7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000188e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400018a0
add dword [0x14011a094], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14011a098]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000188e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001750
nop dword [rax]
xor esi, esi
jmp 0x140001818
mov rax, qword [0x14011a098]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001750
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001750
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140001ea0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14011a100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14011a0e0]
test rbx, rbx
je 0x140001efc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x140001ef3
test eax, eax
jne 0x140001ef3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001ed8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140002230
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140117380]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002250
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002258
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002250
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400022ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400022a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002250
add rax, 0x28
cmp rax, r9
jne 0x140002290
xor eax, eax
ret

Function at 0x1400022b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140117380]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400022cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400022d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400022cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002370
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140117380]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000238f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002398
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403ad9a4

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403af518
Function at 0x1400ea127
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
test r10b, dil
xor r9d, r9d
sal r10, 0x13
lea r8, [r8 + rcx]
rcl r11, 0x53
nop
mov r10, rdx
sal ax, cl
movzx eax, word [r8 + 0x14]
cmc
movzx r11d, word [r8 + 6]
add rax, 0x18
cmc
lea rax, [rax + r8]
cmp ebx, 0x694b6028
clc
test r11d, r11d
jmp 0x1401037b4
je 0x140117652
mov edx, dword [rax + 0xc]
cmp bp, 0x5d53
cmc
cmp r10, rdx
jb 0x1401d2dbb
mov ecx, dword [rax + 8]
clc
add ecx, edx
clc
cmp r10, rcx
jmp 0x1401d2db5
jb 0x1401037ba
xor eax, eax
ret
jb 0x140117654
inc r9d
test r8w, bp
add rax, 0x28
cmp r9d, r11d
jmp 0x14011764c

Function at 0x1400ed955
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rcx, qword [rcx]
jmp 0x1401ffac0
jmp 0x1404465f8
push rsi
sub rsp, 0x40
mov rsi, rcx
add rcx, 0x30
jmp 0x140446609
call fcn.14015bf22
test eax, eax
jmp 0x140446615
jne 0x1404466a6
mov rcx, qword [rsi + 0x18]
jmp 0x140446624
mov rax, qword [rcx]
jmp 0x14044662c
call qword [rax + 0x180]
mov rcx, qword [rsi + 0x18]
jmp 0x14044663b
movaps xmm0, xmmword [0x1400bd5f0]
movaps xmmword [rsp + 0x20], xmm0
xorps xmm0, xmm0
movlps qword [rsp + 0x30], xmm0
mov rax, qword [rcx]
cmovae dx, si
lea rdx, [rsp + 0x20]
jmp 0x140446660
call qword [rax + 0xf0]
mov rcx, qword [rsi + 0x18]
movzx eax, dx
not dh
movaps xmm0, xmmword [0x1400bd490]
rdtsc
movaps xmmword [rsp + 0x20], xmm0
rdtsc
cwde
mov rax, qword [rcx]
movzx dx, r15b
lea rdx, [rsp + 0x20]
call qword [rax + 0x178]
nop
movzx rsi, r12w
add rsp, 0x40
mov sil, 4
pop rsi
jmp 0x1404466a5
ret
mov ecx, eax
jmp 0x1404466ad
call fcn.140458c83
int3

Function at 0x140124512
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
xor edx, edx
jmp 0x140248c54
jmp 0x1404b1cef
Function at 0x14016f593
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
lea edx, [r8 + 2]
jmp 0x1401c5f23
jmp 0x1404b1cef
mov qword [rsp + 8], rbx
shrd rbx, rbp, 0x72
mov dword [rsp + 0x18], r8d
xor rbx, r14
mov dword [rsp + 0x10], edx
rcr bx, 0xce
stc
push rbp
mov rbp, rsp
btr bx, 0xba
sub rsp, 0x50
movsx bx, bpl
movsx rbx, r13w
mov ebx, ecx
clc
jmp 0x1404b1d28
test r8d, r8d
jmp 0x1404b1d30
jne 0x1404b1dbd
sub ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b1d46
je 0x1404b1dbd
mov ecx, 0x5a4d
stc
jmp 0x1404b1d57
cmp word [rax], cx
jmp 0x1404b1d5f
jne 0x1404b1dbd
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
stc
cmp dword [rcx], 0x4550
jne 0x1404b1dbd
mov eax, 0x20b
cmp sp, r13w
cmp word [rcx + 0x18], ax
jmp 0x1404b1d8c
jne 0x1404b1dbd
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b1d9e
jbe 0x1404b1dbd
cmp dword [rcx + 0xf8], 0
je 0x1404b1dbd
mov ecx, ebx
jmp 0x1404b1db8
call fcn.1404b1bdf
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
cwde
cmovae ax, ax
lea r9, [rbp - 0x2c]
cdqe
cbw
lea rax, [rbp + 0x20]
mov r8b, bl
cqo
jmp 0x1404b1de4
mov qword [rbp - 0x18], rax
cwde
rdtsc
lea r8, [rbp - 0x20]
cdqe
mov ch, 0xfa
movzx edx, ax
lea rax, [rbp + 0x28]
bswap cx
xchg cl, dh
movzx rdx, bp
mov qword [rbp - 0x10], rax
movzx dx, spl
lea rdx, [rbp - 0x28]
movzx rax, dx
mov eax, 2
lea rcx, [rbp - 0x30]
jmp 0x1404b1e23
mov dword [rbp - 0x2c], eax
jmp 0x1404b1e2b
mov dword [rbp - 0x28], eax
jmp 0x1404b1e33
call fcn.1404b1fe4
cmp dword [rbp + 0x20], 0
jmp 0x1404b1e41
je 0x1404b1e61
mov rbx, qword [rsp + 0x60]
bts bp, r8w
stc
add rsp, 0x50
movsx rbp, di
movzx bp, sil
pop rbp
ret
mov ecx, ebx
call fcn.1404b1c77
int3

Function at 0x1401b26f8
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14026c07a
jmp 0x1404466b8
push rsi
bts ax, r10w
rcr esi, cl
rol ah, cl
push rdi
shl ax, cl
sub rsp, 0x28
rol ax, 0xfa
ror ah, cl
rcr al, 3
mov rsi, rcx
movzx eax, si
mov rcx, qword [rcx + 0x18]
clc
sub ax, 0x4f18
adc ax, ax
mov rax, qword [rcx]
test rcx, 0x55c63062
cmp r14b, 0x36
xor edx, edx
sub r8d, r8d
call qword [rax + 0x188]
mov edi, eax
lea rcx, [rsi + 0x30]
jmp 0x140446709
call fcn.14045a4d2
test edi, edi
jmp 0x140446715
je 0x140446750
cmp edi, 0x8899000c
jmp 0x140446726
jne 0x140446775
mov rcx, rsi
bswap si
add rsp, 0x28
xchg dil, sil
mov sil, 0x42
movsx edi, sp
pop rdi
movzx si, r13b
pop rsi
jmp 0x14044674b
jmp fcn.1404463b7
nop
add edi, 0x34536cd
or rsi, r8
cmovp rsi, r13
add rsp, 0x28
pop rdi
movzx si, bl
mov sil, r13b
movsx rsi, r10w
pop rsi
jmp 0x140446774
ret
mov ecx, edi
movzx r9, r10w
movabs r8, 0xad4a5352d2edebd0
cmp ebp, 0x476730bd
ror dl, 7
mov dl, 3
bt si, sp
mov r9d, 0x54
add rsp, 0x28
jmp 0x1404467a3
pop rdi
movzx esi, si
movsxd rsi, r12d
pop rsi
jmp 0x1404467b0
jmp fcn.1403afaf6

Function at 0x1401d7fb7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x14021dbc3
jmp fcn.1404c4729
Function at 0x14020bb4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test al, al
jmp 0x1400e7b85
dec rcx
cmp dl, r15b
cmp al, 0x30
jmp 0x14019be90
jne 0x14019beb0
ret
je 0x14025649e
sub al, 0x45
test si, 0x5a7c
test al, 0xdf
jmp 0x14018cea4
jne 0x14019be96
movzx eax, byte [rcx - 1]
jmp 0x1400e7834
je 0x14025649e
movzx eax, byte [rcx + 1]
jmp 0x1401a0ba9
je 0x140128f5a
cmp al, r9b
setnp dh
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop dword [rax]
inc eax
sal ax, cl
movzx eax, byte [r8]
cmp bp, 0x54d3
lea rdx, [rdx + 1]
test ax, 0x27ff
mov byte [rdx], al
cmp r15w, 0x162e
lea r8, [r8 + 1]
test r12, r9
jmp 0x1400e34db
inc rcx
test al, al
jmp 0x140256498
mov rax, qword [rdx]
rcr r9d, cl
cmc
mov rdx, qword [rax + 0xf8]
or r9d, 0x6e8443d2
xor al, r13b
mov rax, qword [rdx]
rcr r9w, 0xf6
rcr r9b, cl
movzx r9d, byte [rax]
dec ax
movzx eax, byte [rcx]
test al, al
je 0x1402843de
movzx edx, al
neg ah
nop dword [rax + rax]
movzx eax, dl
cmc
cmp dl, r9b
jmp 0x140219e03
je 0x1402843de
movzx eax, byte [rcx + 1]
not edx
inc rcx
movsx rdx, ax
shld rdx, rax, 0x84
movzx edx, al
test bp, r8w
jmp 0x14025876b
jne 0x14011023a
movzx eax, byte [rcx - 1]
inc r8w
dec r8d
mov r8, rcx
dec rcx
cmp al, 0x30
jmp 0x140128f54
test al, al
jmp 0x1402843d8
jne 0x14020bb8b
inc rcx
test ch, 0x25
stc
cmc
test al, al
je 0x1400e7b8b
movzx eax, byte [rcx]
cmp r9w, r11w
test bx, 0x25fa
test r12w, r11w
test al, al
jmp 0x140110234

Function at 0x140228e20
Capabilities:
Parse pe header

Disassembly:
ret
jne 0x140222d3c
movsxd rdx, dword [rcx + 0x3c]
clc
cmp dx, 0xcaa
add rdx, rcx
test r15b, 0x32
cmp dword [rdx], 0x4550
jne 0x140222d3c
xor eax, eax
movzx rcx, r11w
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
sub eax, eax
jmp 0x1400eaf29
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x1401c6620
Function at 0x14025e35f
Capabilities:
Access peb ldr_data

Disassembly:
inc rdx
clc
test ax, ax
jmp 0x1400f2399
je 0x1400e1aa9
mov word [r10], 0
movzx eax, word [0x1400b8f10]
stc
test dil, 0x2e
sub r8w, r9w
cmp rdx, 0x104
movsx r8d, ax
movsx r8, ax
movzx r8w, al
mov r8d, 0x104
jmp 0x1401dfa08
jne 0x1401787bc
sub r8, rdx
clc
cmc
test r8, r8
je 0x14013958c
mov word [rcx], 0
jmp 0x14013958c
mov rax, qword gs:[0x30]
btr r9, 0x22
rcr r11, cl
neg r11d
mov rax, qword [rax + 0x60]
adc r11w, 0x6a1e
mov rax, qword [rax + 0x18]
movsxd r10, r8d
sar r9b, 0xf8
mov rax, qword [rax + 0x10]
btr r8w, 0x57
movzx r8d, word [rax + 0x58]
clc
cmp r8, rdx
movsx r11d, r12w
movzx r9w, r14b
not r11d
cmovae r8, rdx
add r10b, r14b
and r10w, 0x1219
sub r9, 0x293c19ed
mov r9, qword [rax + 0x60]
add r10, 0x1e9e1c4b
shr r11, 0xfb
movzx r11d, word [r9]
add r10w, dx
movsx r10w, cl
xchg r10b, r10b
lea r10, [0x1400b8f10]
test r13b, r11b
test r11w, r11w
je 0x1401fef4d
xor eax, eax
nop word [rax + rax]
cmp r8, rax
je 0x1400e1aa3
mov word [r10], r11w
adc r11d, 0x871558f
test dil, 0xa9
add r10, 2
movzx r11, di
inc r11w
mov r11b, 0x50
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x140134ac8
inc rax
test cl, 0xa1
cmp dx, r12w
cmp rsi, 0x6ab73b26
test r11w, r11w
jmp 0x1401fef42
ret
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1400e034c
cmovb r8, rdx
jmp 0x1401a703d
je 0x140124287
cmp rdx, 0x104
setge r8b
movzx r8w, r10b
mov r8d, 0x104
jmp 0x14015c924
je 0x1400f23a4
sub edx, edx
cmc
xadd r9b, r9b
lea r9, [0x1400b8f10]
test sp, r8w
cmp r8, rdx
jmp 0x1401d178f
jmp 0x1401787aa
je 0x1400f23ad
mov word [rcx], ax
shrd ax, dx, 0x15
bts eax, r9d
sbb ah, 0xe1
add rcx, 2
jmp 0x14015bf87
cmovb r8, rdx
stc
test ax, r11w
test ax, ax
jmp 0x1401787a4
jne 0x14012431e
sub r8, rax
stc
cmc
test r8, r8
jmp 0x1400e1a9d
movzx eax, word [0x1400b8f10]
test r11d, edx
test ax, ax
jmp 0x140166826
Function at 0x1402e7d0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor edx, r9d
sub edx, 0x15b6387f
jmp 0x1402dca1f
bswap edx
xor edx, 0x17977ac
cmp si, 0x4bc9
test rbp, rsi
cmp dl, r11b
not edx
cmc
clc
push r9
xor dword [rsp], edx
shr r9b, cl
clc
sbb r9w, 0x1004
pop r9
test r9b, 0x78
movsxd rdx, edx
cmp cl, ch
add rdi, rdx
jmp 0x1402eeff0
push rax
cmovs ax, r8w
push rdx
movsx eax, si
bswap rdx
movzx dx, spl
push rbx
cdqe
push rsi
cdqe
push r13
rdtsc
movsx rax, si
pushfq
push r11
push r8
bts r8w, si
push rdi
push r12
push rbp
movzx r8, dx
cqo
bt edi, r14d
push r10
clc
cdq
cwde
push r9
cdqe
clc
rcl r8b, 0x62
push rcx
mov r11w, bx
bswap rax
push r15
push r14
movabs r11, 0
push r11
btr r8, 0xa1
jmp 0x14031b176
push rdi
ret
mov rbp, qword [rsp + 0x90]
rol ebp, 1
xadd dil, dil
mov edx, r8d
shl r9b, cl
add ebp, 0x1084802
bswap ebp
neg ebp
stc
jmp 0x14036a023
sub rsp, 0x180
and r9b, cl
movsx rax, bp
rcl edx, 0xfe
and rsp, 0xfffffffffffffff0
cwde
btr di, r12w
setne dh
mov r9, rbp
bsf ax, r10w
rdtsc
movabs rax, 0
sub r9, rax
neg dx
cmovl di, r13w
lea rdi, [0x1403615a7]
sbb dh, 0xba
clc
sub edx, 0x2b3275b0
sub rbp, 4
movzx rdx, cx
xor dx, sp
mov edx, dword [rbp + riz]
jmp 0x14029aaba
add rbp, r11
bswap dx
movabs rax, 0x100000000
movsx edi, di
btc r8w, 0xbb
ror dil, cl
lea rbp, [rbp + rax]
shl r9b, 0x10
movzx rdx, r13w
sal r9b, cl
mov r8, rsp
sub di, 0x6b1d
jmp 0x140361567
Function at 0x1403bd7ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmc
push r14
push r12
push rsi
rcr r12w, 0x23
xor r12b, 0xc6
push rdi
not r12w
sub r12, r12
push rbx
rcr r12b, 0x91
sal r12b, 0x61
xor r12b, r11b
sub rsp, 0x28
sbb r12w, 0x5e1c
shr r12b, cl
mov r12, r8
test rdx, rdx
jmp 0x1403bd807
je 0x1403bda22
mov r15, rdx
mov rbx, rcx
sub esi, esi
jmp 0x1403bd81a
jmp 0x1403bd86a
mov rcx, rdi
movzx rdx, ax
mov dx, r12w
mov rdx, r14
jmp 0x1403bd832
call fcn.1403bb5c7
mov eax, dword [rbx + rsi + 0x58]
clc
jmp 0x1403bd841
mov dword [r12 + rsi + 0x58], eax
mov rax, qword [rbx + rsi + 0x50]
clc
mov qword [r12 + rsi + 0x50], rax
test esi, esi
add rsi, 0x60
jmp 0x1403bd85c
dec r15
jmp 0x1403bd864
je 0x1403bda1f
mov eax, dword [rbx + rsi + 8]
mov dword [r12 + rsi + 8], eax
cmp r8b, cl
stc
jmp 0x1403bd87c
cmp r12, rbx
jmp 0x1403bd884
je 0x1403bd837
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403bd895
jb 0x1403bd8aa
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403bd8a5
jmp 0x1403bd8bf
lea r9, [rbx + rsi]
sbb di, r13w
shrd r14w, di, 0x13
sar dil, cl
add r9, 0x10
lea r14, [r12 + rsi]
or ah, 0xe
rcr dil, cl
shl eax, 0xa
add r14, 0x10
sal dil, cl
lahf
mov rdi, qword [rbx + rsi + 0x20]
mov rax, qword [r12 + rsi + 0x28]
cmp spl, bl
cmp rax, rdi
jmp 0x1403bd8e9
jae 0x1403bd908
mov rcx, r14
movzx edx, r13w
mov rdx, rdi
jmp 0x1403bd8fe
call fcn.1403bb5c7
jmp 0x1403bd95f
cmp rax, 0x10
jmp 0x1403bd911
jb 0x1403bd925
mov r14, qword [r12 + rsi + 0x10]
movsx cx, ch
cdq
movzx r8, r9w
mov qword [r12 + rsi + 0x20], rdi
mov rcx, r14
jmp 0x1403bd935
mov rdx, r9
movsx r8d, bx
movsx r8w, r11b
mov r8w, 0x7a6c
mov r8, rdi
jmp 0x1403bd94e
call fcn.1404a4302
mov byte [r14 + rdi], 0
xchg r14b, r14b
sar r14b, 0xfa
mov r14, qword [rbx + rsi + 0x40]
jmp 0x1403bd969
cmp qword [rbx + rsi + 0x48], 0x10
jmp 0x1403bd974
jb 0x1403bd989
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403bd984
jmp 0x1403bd998
lea r9, [rbx + rsi]
movsx eax, si
rcr ax, 0x72
add r9, 0x30
lea rdi, [r12 + rsi]
or ax, 0x486b
add al, 0xb3
test esp, ebx
add rdi, 0x30
cwde
test rsp, 0x6b7a082f
mov rax, qword [r12 + rsi + 0x48]
jmp 0x1403bd9bf
cmp rax, r14
jmp 0x1403bd9c7
jb 0x1403bd81f
cmp rax, 0x10
jmp 0x1403bd9d6
jb 0x1403bd9eb
mov rdi, qword [r12 + rsi + 0x30]
movsx rcx, bp
cmovns ecx, edi
bswap dx
mov qword [r12 + rsi + 0x40], r14
movsx cx, bl
cdq
mov rcx, rdi
mov r8d, 0x387e6620
setbe dh
mov rdx, r9
movsx r8d, r9w
mov r8, r14
call fcn.1404a4302
mov byte [rdi + r14], 0
jmp 0x1403bda1a
jmp 0x1403bd837
add r12, rsi
mov rax, r12
cmp dil, al
add rsp, 0x28
pop rbx
seto dil
mov r15b, 0xc9
movsxd r14, r9d
pop rdi
xchg r15, r12
mov rsi, 0x2493654a
pop rsi
movzx r14w, r14b
pop r12
seta r14b
pop r14
pop r15
ret