joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404418cc
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
movsxd rax, r12d
mov eax, 0x5a4d
cmp r15w, cx
clc
cmp r9b, 0x35
cmp word [0x140000000], ax
jne 0x1404419f2
movsxd rcx, dword [0x14000003c]
bts dx, r13w
sbb dx, sp
dec dx
lea rdx, [0x140000000]
add rcx, rdx
test r9b, 0x71
cmp dword [rcx], 0x4550
jmp 0x14044191c
jne 0x1404419f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x140441930
jne 0x1404419f2
sub r8, rdx
lahf
movzx edx, word [rcx + 0x14]
mov ax, bx
add rdx, 0x18
sar ax, cl
btc r9, r15
test sp, 0x2f07
add rdx, rcx
movzx eax, word [rcx + 6]
movzx cx, spl
lea rcx, [rax + rax*4]
sbb r9b, 0x7e
lea r9, [rdx + rcx*8]
stc
mov qword [rsp], rdx
cmp rdx, r9
je 0x1404419ab
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x140441982
jb 0x14044199d
mov eax, dword [rdx + 8]
add eax, ecx
stc
cmc
cmp r8, rax
jmp 0x140441997
jb 0x1404419b1
add rdx, 0x28
jmp 0x1404419a6
jmp 0x14044196a
sub edx, edx
clc
test edx, r14d
test rdx, rdx
jmp 0x1404419b9
jne 0x1404419cb
xor al, al
jmp 0x1404419c6
jmp 0x140441a00
cmp dword [rdx + 0x24], 0
jmp 0x1404419d4
jge 0x1404419e6
xor al, al
jmp 0x1404419e1
jmp 0x140441a00
mov al, 1
jmp 0x1404419ed
jmp 0x140441a00
xor al, al
jmp 0x1404419f9
jmp 0x140441a00
add rsp, 0x18
ret
Function at 0x140453330
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
cmp bpl, cl
shl rax, 0x9c
push rbp
add ah, 0x40
mov rbp, rsp
movsx ax, r12b
sub rsp, 0x20
and bx, sp
cwde
cdqe
mov rax, qword [0x1400b7288]
cmp r15b, dl
movabs rbx, 0x2b992ddfa232
jmp 0x14045336c
cmp rax, rbx
jmp 0x140453374
jne 0x140453465
and qword [rbp + 0x18], 0
mov ecx, 0x7a756f20
lea rcx, [rbp + 0x18]
jmp 0x14045338d
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045339c
mov qword [rbp + 0x10], rax
jmp 0x1404533a5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
jmp 0x1404533b2
xor qword [rbp + 0x10], rax
jmp 0x1404533bb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
movzx ecx, r10w
lea rcx, [rbp + 0x20]
cmc
cmp dl, 0xfb
xor qword [rbp + 0x10], rax
jmp 0x1404533d8
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
cmovno rcx, rdx
xchg ch, cl
lea rcx, [rbp + 0x10]
stc
cmp bx, r15w
jmp 0x1404533f5
shl rax, 0x20
test r8b, 0x49
test r15b, r11b
xor rax, qword [rbp + 0x20]
test r14, rax
cmp edx, 0x402001f1
xor rax, qword [rbp + 0x10]
xor rax, rcx
shld ecx, esp, 0x12
shr bpl, 0x49
movabs rcx, 0xffffffffffff
movsx bp, r11b
rcr bpl, cl
shld ebp, edx, 0xc9
and rax, rcx
bts bp, di
movabs rcx, 0x2b992ddfa233
rol bpl, cl
cmp rax, rbx
movzx bx, r10b
cmove rax, rcx
neg bp
dec bh
rcr bpl, cl
mov qword [0x1400b7288], rax
shr rbx, 0x15
mov rbx, qword [rsp + 0x48]
movsx ebp, r11w
xadd bp, bp
not rax
cmp si, 0x347a
sal rbp, 0x4f
mov qword [0x1400b7280], rax
movzx rbp, r10w
xadd bpl, bpl
rcr bp, cl
add rsp, 0x20
mov rbp, rbp
movzx rbp, di
pop rbp
jmp 0x1404534a1
ret

Function at 0x14045353b
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
clc
cmc
test dh, ah
sub ecx, ecx
jmp 0x14045354a
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x140453558
je 0x1404535d1
mov ecx, 0x5a4d
test dl, 0x8e
cmp word [rax], cx
jmp 0x14045356e
jne 0x1404535d1
movsxd rcx, dword [rax + 0x3c]
cmp r13w, bp
jmp 0x140453581
add rcx, rax
cmp dword [rcx], 0x4550
jmp 0x14045358f
jne 0x1404535d1
mov eax, 0x20b
test r12, 0x1d8002a7
cmp word [rcx + 0x18], ax
jmp 0x1404535aa
jne 0x1404535d1
cmp dword [rcx + 0x84], 0xe
jmp 0x1404535bc
jbe 0x1404535d1
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1404535d4
sub al, al
stc
add rsp, 0x28
jmp 0x1404535dd
ret
Function at 0x14046c0ba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
jmp 0x14046c0d7
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
rol bp, 0x4d
btr bp, bx
mov qword [rax + 0x20], rdi
xor sil, dl
push r14
sub rsp, 0x20
add di, 0x514
shl rsi, cl
mov rsi, r9
bt r14w, 0x7f
movzx di, dl
movzx r14d, r8w
mov rdi, rdx
mov rbp, rcx
test sil, 0xeb
clc
test r8b, bpl
test r9, r9
jmp 0x14046c123
je 0x14046c1e1
mov rbx, qword [rdx + 8]
clc
test rbx, rbx
jmp 0x14046c136
je 0x14046c1cf
mov rax, qword [rbx + 0x40]
cmc
cmp qword [rax], 0
jmp 0x14046c14a
je 0x14046c19b
mov rax, qword [rbx + 0x58]
stc
clc
cmp dword [rax], 0
jmp 0x14046c15e
jle 0x14046c19b
dec dword [rax]
cbw
mov rcx, qword [rbx + 0x40]
not edx
mov rdx, qword [rcx]
cmovle eax, r14d
movsx rax, sp
lea rax, [rdx + 2]
jmp 0x14046c182
mov qword [rcx], rax
movsx rax, di
movzx eax, r14w
jmp 0x14046c192
mov word [rdx], r14w
jmp 0x14046c1b9
mov rax, qword [rbx]
movzx edx, r14w
movsx rcx, r14w
cmovns cx, dx
not ch
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x140441677.0]
mov ecx, 0xffff
cmp bpl, r9b
cmp cx, ax
jmp 0x14046c1c9
jne 0x14046c1d2
mov byte [rdi], 1
sub rsi, 1
jmp 0x14046c1db
jne 0x14046c12e
movups xmm0, xmmword [rdi]
rol r14w, cl
mov rbx, qword [rsp + 0x30]
movzx r14, r12w
cmc
stc
mov rax, rbp
rcl sil, 0x19
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
shrd r14w, r9w, 0xff
movdqu xmmword [rbp], xmm0
btc bp, 0x3c
btc bp, dx
btr rbp, rcx
mov rbp, qword [rsp + 0x38]
movsx r14, cx
sub r14b, bl
add rsp, 0x20
pop r14
ret
Function at 0x14047b486
Capabilities:
Check http status code

Disassembly:
int3
push rbx
stc
cmp spl, cl
push rbp
push rsi
test r11b, 0x10
push rdi
movsx bp, r13b
or bpl, r9b
push r14
sub rsp, 0x20
bsr ebp, r10d
mov rbp, rcx
sub cx, 0x65a8
sub edx, edx
lea rcx, [rsp + 0x58]
jmp 0x14047b4b9
call fcn.140441cb9
nop
mov rsi, qword [0x1400b9ae8]
mov qword [rsp + 0x60], rsi
adc di, cx
sub dil, 0x35
mov rdi, qword [0x1400b9a20]
cmp rdi, r11
test rdi, rdi
jmp 0x14047b4e4
jne 0x14047b560
xor edx, edx
movsx cx, spl
movsx ecx, r14w
lea rcx, [rsp + 0x50]
call fcn.140441cb9
cmp qword [0x1400b9a20], rdi
jmp 0x14047b50b
jne 0x14047b540
mov eax, dword [0x1400b94f0]
jmp 0x14047b51f
inc eax
movsxd rcx, esi
not ecx
mov dword [0x1400b94f0], eax
movzx cx, r10b
cdqe
xchg cx, cx
setne ch
mov qword [0x1400b9a20], rax
lea rcx, [rsp + 0x50]
jmp 0x14047b54a
call fcn.140441d41
mov rdi, qword [0x1400b9a20]
inc r14w
shrd cx, r8w, 0xa7
mov rcx, qword [rbp + 8]
shl r14, 0x34
xchg r14b, r14b
sub r14b, r11b
lea r14, [rdi*8]
cmp rdi, qword [rcx + 0x18]
jmp 0x14047b57f
jae 0x14047b5aa
mov rax, qword [rcx + 0x10]
bt bx, bp
ror bx, cl
mov rbx, qword [r14 + rax]
cmp r9b, al
test rbx, rbx
jmp 0x14047b59f
jne 0x14047b679
jmp 0x14047b5ad
sub ebx, ebx
clc
cmp byte [rcx + 0x24], 0
jmp 0x14047b5b6
je 0x14047b5de
call fcn.14019bae4
cmp rdi, qword [rax + 0x18]
jae 0x14047b5ec
mov rax, qword [rax + 0x10]
movzx rbx, r12w
cmp sil, 0x13
mov rbx, qword [r14 + rax]
cmp bh, 0xc8
test rbx, rbx
jmp 0x14047b5e6
jne 0x14047b679
test rsi, rsi
jmp 0x14047b5f4
je 0x14047b607
mov rbx, rsi
jmp 0x14047b602
jmp 0x14047b679
mov rdx, rbp
cmovbe rcx, rdx
movsx rcx, r15w
lea rcx, [rsp + 0x60]
call fcn.1404789ea
cmp rax, 0xffffffffffffffff
je 0x14047b6b3
mov rbx, qword [rsp + 0x60]
movzx ecx, r10w
movzx cx, r9b
mov qword [rsp + 0x50], rbx
movsx ecx, r14w
mov rcx, rbx
jmp 0x14047b645
call fcn.140441ed2
mov rcx, qword [rbx]
movsx rax, sp
movzx rax, sp
cmovns rax, rsi
mov rax, qword [rcx + 8]
mov rcx, rbx
call qword [case.0x140441677.0]
mov qword [0x1400b9ae8], rbx
movsx cx, r14b
movsxd rcx, esp
movsx ecx, r8w
lea rcx, [rsp + 0x58]
jmp 0x14047b683
call fcn.140441d41
mov rax, rbx
sar sil, cl
add rsp, 0x20
pop r14
pop rdi
jmp 0x14047b6a2
pop rsi
bswap bx
jmp 0x14047b6ab
pop rbp
pop rbx
jmp 0x14047b6b2
ret
call fcn.140442f59
nop
jmp 0x1400e01c2
Function at 0x14048acd7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r14w, r12w
cmc
mov qword [rax + 8], rbx
shl bl, cl
xor bl, 0x54
or bx, r15w
mov qword [rax + 0x10], rbp
sbb bpl, 0xa9
mov qword [rax + 0x18], rsi
sar bl, 0x35
movzx bx, bl
and ebx, 0xede4cc7
mov qword [rax + 0x20], rdi
push r14
bt bx, 0xa9
sub rsp, 0x20
cmp bh, 0xab
ror rbx, cl
mov rsi, r9
sbb r14, 0x137e768e
mov r14, r8
sbb bl, sil
mov rbx, rdx
xchg bp, bp
mov rbp, rcx
jmp 0x14048ad39
cmp rdx, r8
jmp 0x14048ad41
je 0x14048ae1b
mov rdi, qword [r9 + 8]
test r8w, si
cmp bp, 0x7d1c
test rdi, rdi
jmp 0x14048ad5c
je 0x14048ae05
mov rax, qword [rdi + 0x40]
rcr r8b, cl
rol r8b, cl
movzx r8d, word [rbx]
cmp r13w, 0x240
test r14d, 0x2ab61603
cmp qword [rax], 0
jmp 0x14048ad86
je 0x14048adcd
mov rax, qword [rdi + 0x58]
test r13b, al
clc
cmp dword [rax], 0
jmp 0x14048ad9c
jle 0x14048adcd
dec dword [rax]
mov rcx, r13
mov rcx, qword [rdi + 0x40]
mov rdx, qword [rcx]
setno ah
nop
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x14048adbf
mov word [rdx], r8w
jmp 0x14048adc8
jmp 0x14048adf3
mov rax, qword [rdi]
cqo
movzx rdx, bx
movzx edx, r8w
mov rcx, rdi
jmp 0x14048ade2
mov rax, qword [rax + 0x18]
call qword [case.0x140441677.0]
movzx r8d, ax
rol ax, cl
mov eax, 0xffff
cmp sil, cl
cmp ax, r8w
jne 0x14048ae09
mov byte [rsi], 1
stc
add rbx, 2
cmp rbx, r14
jmp 0x14048ae15
jne 0x14048ad54
movups xmm0, xmmword [rsi]
movsx rbx, r14w
ror r14b, 0x99
mov rbx, qword [rsp + 0x30]
adc sil, spl
xor r14b, dil
shld r14w, r12w, 0x86
mov rax, rbp
rcr esi, cl
adc r14b, 0xa
rcl dil, cl
mov rsi, qword [rsp + 0x40]
shld r14w, di, 0xa6
mov rdi, qword [rsp + 0x48]
cmp sp, r15w
bts r14w, r15w
inc r14w
movdqu xmmword [rbp], xmm0
sal bp, cl
test bl, 0x82
ror bpl, 0x39
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
xchg r14b, r14b
sete r14b
movzx r14w, dl
pop r14
jmp 0x14048ae8b
ret
Function at 0x140498026
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
cmp r12b, bl
mov qword [rsp + 0x18], rbp
bt bp, 0xc2
sub ebp, 0x2a002ce5
push rsi
shld esi, ebx, 0x47
shl sil, cl
push rdi
not esi
xchg bpl, bpl
push r12
xor bpl, 8
push r14
push r15
mov bpl, r8b
sub rsp, 0x20
test rdx, rdx
seta r14b
cmovl edi, r10d
movzx si, cl
lea r14, [rsp + 0x50]
mov rsi, rcx
movsx r15w, bpl
mov rdi, 0x3c5d4c0f
cmovp di, di
mov rdi, rcx
movzx rbp, r11w
jmp 0x140498093
movzx ecx, byte [rcx]
bswap bp
setnp bpl
movzx r15, cx
cmovne r14, rdx
mov r15, r9
mov ebp, r8d
jmp 0x1404980b0
jmp 0x1404980c0
inc rdi
movzx ecx, byte [rdi]
jmp 0x1404980c0
call fcn.1404b0df3
test eax, eax
jne 0x1404980b5
mov bl, byte [rdi]
lea eax, [rbx - 0x2b]
stc
test ecx, 0xe2d12bf
test al, 0xfd
jmp 0x1404980e0
je 0x1404980f2
mov bl, 0x2b
jmp 0x1404980ed
jmp 0x1404980f8
inc rdi
movsx edx, bp
mov r9, r15
movsxd r8, r10d
mov cx, 0x1e52
mov r8d, ebp
mov cl, r14b
mov rdx, r14
mov rcx, rdi
jmp 0x140498113
call fcn.14049826d
mov rcx, rax
xor bpl, r8b
mov bpl, 0x2d
shl r12, cl
shr r12b, 0x74
xchg r12b, r12b
movabs r12, 0x8000000000000000
cmp rdi, qword [r14]
jne 0x14049814b
mov qword [r14], rsi
jmp 0x140498146
jmp 0x140498159
cmp rsi, qword [r14]
jmp 0x140498153
jne 0x140498167
test rcx, rcx
jmp 0x140498161
jne 0x1404981a9
cmp bl, 0x2b
jmp 0x14049816f
jne 0x140498197
movabs rax, 0x7fffffffffffffff
test dx, ax
test r14d, 0x7ff3457f
cmp rcx, rax
jmp 0x140498191
ja 0x1404981a9
cmp bl, bpl
jne 0x1404981ef
cmp rcx, r12
jbe 0x1404981ef
call fcn.1404ae0f9
mov dword [rax], 0x22
clc
test r15, r15
jmp 0x1404981bd
je 0x1404981d1
mov dword [r15], 1
test r12b, 0x6e
test bl, dil
sub bl, bpl
neg bl
jmp 0x1404981db
sbb rax, rax
stc
cmp dl, sil
add rax, r12
jmp 0x1404981ea
jmp 0x140498220
mov rax, rcx
not r15b
dec dil
or dil, 0xa7
neg rax
shr dil, cl
cmp bl, bpl
movsx r15d, r14w
cmove rcx, rax
add ax, 0x5dce
mov rax, rcx
movsx bp, r12b
movzx rbp, sp
rcl dil, cl
mov rbx, qword [rsp + 0x58]
movsx si, bpl
mov rbp, qword [rsp + 0x60]
shl dil, 0x14
movzx r15w, r11b
add rsp, 0x20
pop r15
mov r12b, 0x51
movzx rdi, r8w
setbe r14b
pop r14
mov si, bx
movsx r12w, bpl
bswap rsi
pop r12
movzx rsi, r13w
movsx si, r9b
bswap si
pop rdi
not rsi
bswap si
pop rsi
ret

Function at 0x1404991d9
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
clc
and dword [rsp + 0x30], 0
jmp 0x1404991e8
call fcn.1404a3380
mov r9d, 2
mov cx, di
lea r8, [rsp + 0x30]
not ch
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x14049920a
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp ch, 0x42
cmp spl, sil
sub ecx, 0x30
jmp 0x140499223
je 0x14049926a
sub ecx, 1
jmp 0x140499231
je 0x14049925b
cmp ecx, 1
jmp 0x14049923f
je 0x140499251
xor eax, eax
jmp 0x14049924c
jmp 0x14049926f
mov eax, 3
jmp 0x14049926f
mov eax, 1
jmp 0x140499265
jmp 0x14049926f
mov eax, 2
add rsp, 0x28
ret
Function at 0x14049a054
Capabilities:
Terminate process

Disassembly:
push rbx
movsx rbx, r15w
test bp, di
movzx rbx, r9w
sub rsp, 0x20
sal bh, cl
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x14049a07a
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
rol dh, cl
btc edx, 0x91
mov edx, 0xc0000409
movzx ebx, r11w
add rsp, 0x20
not bx
pop rbx
jmp switch.0x14049a0a5
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14049aad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
cmc
stc
push rsi
sar sil, 0xd1
sbb sil, 0x28
bts si, bx
push rdi
rol rsi, cl
sbb esi, ecx
push r12
movsxd rsi, r8d
stc
push r14
or esi, 0x478714d5
push r15
shl r14b, cl
sub rsp, 0x20
mov esi, dword [r8 + 0xc]
xchg r14, r15
movsx r12, cx
mov r12, rcx
mov rcx, r8
bswap r14
movzx r15w, r10b
mov rdi, r9
sets r15b
movsx r15w, sil
bswap r14
mov r14, r8
jmp 0x14049ab3e
mov r15, rdx
jmp 0x14049ab46
call fcn.1401b0e34
mov r10, qword [r12]
mov ebp, eax
test spl, al
clc
jmp 0x14049ab5a
mov qword [rdi], r10
test esi, esi
jmp 0x14049ab64
je 0x14049ac72
movsxd rax, dword [r14 + 0x10]
btc cx, bx
cmc
lea ecx, [rsi - 1]
shrd esi, r10d, 0xed
add rsi, 0xacc3ddd
mov esi, ecx
lea rcx, [rcx + rcx*4]
xor rbx, 0x7ff079cb
movzx ebx, bp
add bh, 0xef
lea rbx, [rax + rcx*4]
stc
add rbx, qword [r15 + 8]
cmp ebp, dword [rbx + 4]
jle 0x14049ab5d
cmp ebp, dword [rbx + 8]
jmp 0x14049abaf
jg 0x14049ab5d
mov rcx, qword [r15]
ror edx, 0xf8
lea rdx, [rsp + 0x50]
sub r8d, r8d
jmp 0x14049abc8
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
add r9b, 0x32
neg r9b
btr r9d, 0x80
sub ecx, ecx
sal r9b, cl
clc
add r8, qword [rsp + 0x50]
bsf r10d, eax
mov r9d, dword [rbx + 0xc]
mov r10d, dword [rax]
test esp, esp
jmp 0x14049abfb
test r9d, r9d
je 0x14049ac3d
lea rdx, [r8 + 0xc]
movsx rax, r14w
ror ax, cl
rcr eax, cl
movsxd rax, dword [rdx]
jmp 0x14049ac1e
cmp rax, r10
je 0x14049ac3d
inc ecx
add rdx, 0x14
test ah, 0xaf
cmp sil, bpl
stc
cmp ecx, r9d
jb 0x14049ac11
cmp ecx, r9d
jae 0x14049ab5d
mov rax, qword [r12]
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
bswap r15w
adc ebp, 0x222049ef
cmp r14b, r9b
mov rcx, qword [rcx + rax]
mov qword [rdi], rcx
bt ebp, ebp
sub r15b, r10b
shl r14w, 0xee
mov rbx, qword [rsp + 0x58]
sub ebp, r15d
rcl r15b, cl
mov rax, rdi
shld bp, ax, 0xa5
movsxd rsi, ebx
sbb r15b, 0x6f
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
movzx rdi, r10w
movzx r12w, r11b
pop r15
setne sil
pop r14
movzx r12d, r14w
movsx esi, di
pop r12
movzx esi, cx
pop rdi
movzx rsi, dx
xchg rsi, rsi
mov sil, 0xd9
pop rsi
jmp 0x14049acc3
ret
Function at 0x14049fba8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
or ebx, 0x2c720b7
mov qword [rax + 0x18], rsi
sub sil, r12b
mov qword [rax + 0x20], rdi
neg r10w
bts r10w, r13w
clc
push r14
push r15
movsxd r10, edi
movzx esi, word [rsp + 0x38]
ror r10b, 0x4a
movzx ebx, dx
btr rbx, r8
mov r10, r8
movsx r8w, r10b
movzx r8, bp
adc r8b, 0xa3
sub r15d, r15d
movsxd r8, edx
mov ebx, ecx
movsx cx, al
mov ecx, r8d
test si, si
jne 0x14049fd81
mov rax, qword [r9]
xor r11b, 0xa6
movzx r11d, r15w
movsx r11d, r9w
mov r11, qword [r10]
cmp rax, 1
jmp 0x14049fc28
jbe 0x14049fd30
mov eax, 0x66666667
shr cl, cl
mov r8, r11
imul ebx
sar edx, 2
cdqe
mov eax, edx
shr eax, 0x1f
adc rcx, 0x7da24bd7
add edx, eax
add al, r9b
clc
movzx eax, dx
sbb cl, r9b
sal rcx, cl
shl ax, 2
bt cx, 0x79
shr cx, cl
lea ecx, [rax + rdx]
nop
add cx, cx
movzx ax, r8b
cbw
sub bx, cx
dec ax
sbb rax, r12
add bx, 0x30
xchg al, ah
shld ax, bx, 0xe5
add al, r9b
mov word [r11], bx
add r11, 2
cdqe
cbw
mov rax, qword [r9]
movsx rbx, sp
movzx rbx, dx
mov ebx, edx
jmp 0x14049fcaa
dec rax
cmp al, r9b
cmc
mov qword [r9], rax
clc
stc
test edx, edx
jmp 0x14049fcbd
jle 0x14049fcd2
cmp rax, 1
jmp 0x14049fccc
ja 0x14049fc2e
mov rdx, qword [r10]
jmp 0x14049fcda
mov qword [r10], r11
jmp 0x14049fce2
jmp 0x14049fd1d
movzx eax, word [rdx]
add cx, 0x3999
sbb cl, 0x1d
movzx ecx, word [r8]
test r14, 0x33253649
cmc
mov word [r8], ax
test bpl, dl
cmp eax, r10d
test ah, 0x75
sub r8, 2
clc
cmp r14b, 0x45
mov word [rdx], cx
add rdx, 2
clc
stc
cmp rdx, r8
jmp 0x14049fd25
jb 0x14049fce7
jmp 0x14049fd5c
add rax, rax
btr bp, r13w
shld bx, bx, 0xf0
sub r11, rax
movzx si, sil
movsx rbx, r10w
mov qword [r10], r11
not r14
mov qword [r9], r15
cmovne esi, r13d
bswap rbp
movsxd rsi, r9d
mov rbx, qword [rsp + 0x18]
setg r15b
movzx r15, bp
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
setne r15b
pop r15
pop r14
ret
cmp r8, qword [r9]
jmp 0x14049fd89
jae 0x14049fd4f
dec r8d
test bh, 0x63
and r11w, dx
mov r11d, r15d
test ecx, ecx
jmp 0x14049fda3
je 0x14049fe59
movsxd rax, r8d
stc
cmp dil, r8b
lea rdi, [rax + rax]
mov r14, qword [r10]
mov eax, 0x66666667
stc
cdq
and bp, di
imul ebx
mov ebp, r8d
bt ax, si
shl ah, 0x7f
nop
sar edx, 2
add al, r14b
bsf ax, ax
shr ax, cl
mov eax, edx
stc
cmc
cmp ebp, r14d
shr eax, 0x1f
add edx, eax
test ebx, ebx
jmp 0x14049fdef
je 0x14049fe26
movzx eax, dx
inc ch
shl ax, 2
bsr rcx, r10
setae cl
lea ecx, [rax + rdx]
btr rax, rax
and al, r9b
add cx, cx
sub bx, cx
movsx rax, si
lea eax, [rbx + 0x30]
jmp 0x14049fe21
jmp 0x14049fe2b
movzx eax, si
xchg ebx, ebx
mov word [rdi + r14], ax
inc r11d
rcr bx, 0xee
sal bh, 0xea
shl bh, 0x5a
sub rdi, 2
not bx
jmp 0x14049fe49
dec r8d
rcl rbx, cl
mov ebx, edx
test ebp, ebp
jne 0x14049fdb4
movsxd rcx, r11d
lea rax, [rcx + rcx]
cmp si, 0x5608
add qword [r10], rax
sub qword [r9], rcx
jmp 0x14049fe70
jmp 0x14049fd5c
Function at 0x1404a72e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
shr r8b, cl
cwde
movzx bx, r8b
mov qword [rsp + 0x10], rsi
push rdi
cdqe
sub rsp, 0x20
and si, 0x1037
and rdx, rbp
add qword [rcx + 0x20], 8
sar rdx, 0xae
test r8d, ecx
setp sil
mov rdi, rcx
xchg r8w, ax
inc sil
mov rax, qword [rcx + 0x20]
adc rsi, 0x592d2477
mov esi, dword [rcx + 0x38]
movsxd rbx, r14d
xor dl, r12b
cmp esi, 0xffffffff
mov r8d, dword [rcx + 0x3c]
bswap dx
movzx edx, word [rcx + 0x42]
setns bl
bswap bx
jmp 0x1404a734c
mov rbx, qword [rax - 8]
mov al, 0x6a
not ah
mov eax, 0x7fffffff
jmp 0x1404a735e
mov qword [rcx + 0x48], rbx
jmp 0x1404a7367
cmove esi, eax
jmp 0x1404a736f
mov rcx, qword [rcx]
jmp 0x1404a7377
call fcn.1402287a8
test al, al
jmp 0x1404a7383
je 0x1404a73c3
test rbx, rbx
jne 0x1404a73a3
lea rbx, [0x1400d25f0]
cqo
movsx dx, ch
mov qword [rdi + 0x48], rbx
movsxd rdx, esi
mov ecx, esi
mov cl, 0x8b
movsxd rcx, edx
mov rcx, rbx
mov byte [rdi + 0x54], 1
jmp 0x1404a73b9
call fcn.1401d9e56
jmp 0x1404a7475
test rbx, rbx
jmp 0x1404a73cb
jne 0x1404a73e1
lea rbx, [0x1400ced98]
jmp 0x1404a73dd
mov qword [rdi + 0x48], rbx
sub r9d, r9d
test r12b, 0x89
jmp 0x1404a73f0
test esi, esi
jmp 0x1404a73f7
jle 0x1404a746a
cmp byte [rbx], 0
je 0x1404a746a
mov rax, qword [rdi + 8]
sar r8w, 0x12
movzx edx, byte [rbx]
movsx r8d, r11w
xadd r8b, cl
mov rcx, qword [rax]
add r8w, di
shld ax, r9w, 0xdf
rcl r8w, cl
mov rax, qword [rcx]
sub ecx, r14d
bt r8w, r13w
lea rcx, [rbx + 1]
sub r8b, 0xcd
dec r8b
movzx r8d, word [rax + rdx*2]
stc
cmc
and r8d, 0x8000
jmp 0x1404a7454
cmove rcx, rbx
inc r9d
shr bh, cl
lea rbx, [rcx + 1]
cmp r9d, esi
jl 0x1404a73fd
mov eax, r9d
bt si, 0x6d
movsx ebx, bp
mov dword [rdi + 0x50], eax
ror rsi, 0x12
mov al, 1
btc di, r9w
mov rbx, qword [rsp + 0x30]
bts esi, r10d
and rdi, 0x2d0e2be3
bts si, r9w
mov rsi, qword [rsp + 0x38]
adc dil, 0x35
add rsp, 0x20
pop rdi
jmp 0x1404a74ab
ret
Function at 0x1404a97ff
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
cmp sil, 5
stc
mov qword [rsp + 0x10], rsi
rcl rsi, 0xe5
push rdi
sub rsp, 0x30
sbb sil, dl
mov edi, edx
rcl sil, cl
mov rsi, rcx
stc
jmp 0x1404a982b
test r8, r8
jmp 0x1404a9833
jne 0x1404a985a
call fcn.1404ae0f9
mov dword [rax], 0x16
jmp 0x1404a9849
call fcn.1404aed82
sub eax, eax
jmp 0x1404a9855
jmp 0x1404a995d
mov rdx, r9
movzx ecx, r8w
movsx cx, r10b
mov rcx, r8
jmp 0x1404a986e
call fcn.1404a99aa
mov rbx, rax
cmp r10b, r15b
test rax, rax
jmp 0x1404a9881
je 0x1404a98fc
lea rax, [rsp + 0x50]
mov rdx, rdi
movzx r9d, r12w
cmovno r8, rsi
mov qword [rsp + 0x28], rax
cwde
lea r8, [0x140094b24]
movzx ax, bpl
movsx cx, bpl
xchg r9b, al
mov eax, dword [rsp + 0x60]
mov r9, rbx
movzx rcx, r11w
bswap cx
mov rcx, rsi
jmp 0x1404a98c7
mov dword [rsp + 0x20], eax
jmp 0x1404a98d0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
clc
test r14d, 0x17264536
test rax, rax
jne 0x1404a996d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404a98f7
call fcn.1404ae16b
sub edi, edi
jmp 0x1404a9903
test rbx, rbx
jmp 0x1404a990b
je 0x1404a9955
mov rcx, qword [rbx + 0x10]
test r8w, r14w
stc
test rcx, rcx
jmp 0x1404a9922
je 0x1404a992e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
clc
cmp dil, r15b
test r12b, r9b
test rcx, rcx
je 0x1404a9948
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404a9950
call fcn.1404c2337
mov rax, rdi
shrd rsi, rbp, 0x27
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jmp 0x1404a997a
je 0x1404a998a
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
test r15d, edx
stc
sub ebx, ebx
jmp 0x1404a9991
jmp 0x1404a9903

Function at 0x1404a9c74
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
movsx rbx, r15w
jmp 0x1404a9c83
mov ebx, ecx
jmp 0x1404a9c8a
call fcn.1404cb913
cmp eax, 1
jmp 0x1404a9c97
je 0x1404a9cdc
mov rax, qword gs:[0x60]
sub rdx, r8
mov edx, dword [rax + 0xbc]
clc
shr edx, 8
test r14b, r12b
cmc
test dl, 1
jne 0x1404a9cdc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx rdx, bx
not dh
mov edx, ebx
jmp 0x1404a9cd6
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404a9ce3
call fcn.1404a9bb9
mov ecx, ebx
jmp 0x1404a9cef
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404ad938
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rdx
cbw
mov qword [rsp + 8], rcx
movsx cx, r12b
rdtsc
lahf
push rbp
mov rbp, rsp
rol r9b, 0xd
sub rsp, 0x40
movsx rcx, di
lea rax, [rbp + 0x10]
cdq
cqo
mov qword [rbp - 0x18], rax
cbw
movzx cx, sil
not al
lea r9, [rbp + 0x28]
cwd
movzx ax, r13b
lea rax, [rbp + 0x18]
mov r8b, 0x18
mov qword [rbp - 0x10], rax
rdtsc
cbw
movsx ecx, ax
lea r8, [rbp - 0x18]
mov dl, sil
mov eax, 2
movsx rdx, r12w
movzx rdx, r14w
lea rdx, [rbp - 0x20]
cmovae cx, bp
movzx rcx, r8w
movsxd rcx, r12d
lea rcx, [rbp + 0x20]
jmp 0x1404ad9b9
mov dword [rbp + 0x28], eax
jmp 0x1404ad9c1
mov dword [rbp - 0x20], eax
jmp 0x1404ad9c9
call fcn.140096f80
add rsp, 0x40
movzx ebp, r9w
pop rbp
jmp 0x1404ad9dc
ret
Function at 0x1404aee0e
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404aee24
je 0x1404aee3b
mov ecx, 5
jmp 0x1404aee34
int 0x29
jmp 0x1404aee3b
mov r8d, 1
bswap rdx
movzx ecx, r10w
mov edx, 0xc0000417
lea ecx, [r8 + 1]
jmp 0x1404aee56
call fcn.1404aee89
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
btr edx, 0xbf
xor rdx, 0x756a45a7
sar dh, cl
mov edx, 0xc0000417
cmp r15b, r14b
add rsp, 0x28
jmp switch.0x1404aee82
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]