joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400112fc
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea ebp, [rdx - 0x113]
mov r13, r8
mov edx, dword [rsp + 0xa0]
lea edi, [r9 + 0x4e]
mov r15d, edx
mov dword [rsp + 0x88], ebp
xor r15d, 7
lea ebx, [r9 - 0xa7]
lea eax, [rdi - 0x35]
lea esi, [r9 + 0x19]
cmp ebx, eax
jge 0x140011559
lea eax, [rbx + 0xa8]
cmp edx, eax
jl 0x140011559
lea eax, [rsi + 6]
cmp edx, eax
je 0x14001145a
mov r8d, edi
mov dword [r11 - 0x58], r9d
mov r9, qword [section..data]
lea ebx, [rdx + 0x15]
mov ecx, r15d
lea edx, [rsi + 0x1c]
xor r8d, 0x4c
xor ecx, 0x1c4
call fcn.140014de0
mov rcx, qword [section..data]
lea r8d, [r15 + 0x1e]
mov edx, eax
xor ebp, 0xa7
mov eax, ebx
xor edx, 0x68
xor eax, 0x39
mov dword [rsp + 0x20], eax
lea r9d, [rbp + 0x2e]
call fcn.14000d1c0
mov r11, qword [section..data]
lea edx, [r15 + 0x3c]
mov r14d, eax
lea ecx, [r15 - 0x11]
mov r10d, eax
lea eax, [rbx - 0x49]
xor r10d, 0x72
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], eax
lea r9d, [r14 - 0x2e]
lea r8d, [r14 - 0x1c]
mov qword [rsp + 0x20], r11
call fcn.14000ce20
mov rcx, qword [section..data]
mov ebp, eax
cmp dword [rcx + 0x6c], 0x2e82
jae 0x140011416
mov ecx, dword [rcx + 0x64]
add ecx, 0xa33f1255
add ecx, dword [r13 + 0x100]
mov dword [r13 + 0x5c], ecx
jmp 0x140011422
mov eax, dword [0x140068068]
mov dword [rcx + 0xfc], eax
lea eax, [rdi - 0x25]
xor r14d, 0x15
mov dword [rsp + 0x30], eax
lea edx, [rsi + 0x1c]
lea rax, [0x140068010]
lea r9d, [rdi - 0x35]
mov qword [rsp + 0x28], rax
xor edi, 0x20
mov dword [rsp + 0x20], edx
mov edx, r14d
lea r8d, [rsi + 0x10]
mov ecx, edi
call fcn.140015a00
jmp 0x140011559
mov ecx, dword [0x1400680bc]
add ecx, dword [0x140068040]
cmp esi, ecx
jb 0x140011559
lea eax, [rdx + 0xb9]
or edx, 0xc6
movsxd r12, eax
lea eax, [rdx + 0xa8]
cdqe
mov rbp, rax
mov r9d, dword [0x1400680e0]
lea r8d, [rdi + 0x1c]
mov edx, dword [r13 + 0xac]
add r9d, 0x9c
mov ecx, dword [r13 + 0x24]
sub ecx, dword [r13 + 4]
mov eax, r15d
xor rdx, rax
mov eax, dword [r13 + 0xa8]
or rdx, 0xa7
xor r9, rax
mov qword [rsp + 0x20], rdx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [0x140068054]
mov rcx, rbp
mov edx, dword [r13 + 0x4c]
and r8d, ebx
sub r8d, dword [r13 + 0xec]
and edx, ebx
xor edx, dword [0x140068054]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov eax, dword [0x140068068]
mov r8, r13
sub eax, dword [r13 + 0xec]
mov r9d, dword [0x1400680dc]
imul r9d, dword [0x140068040]
mov ecx, dword [r13 + 0x64]
sub ecx, dword [0x140068038]
imul edx, eax, 0xa7
mov eax, dword [r13 + 0x24]
xor eax, edi
or r9d, 0x9c
mov dword [rsp + 0x20], eax
call fcn.14000bbc4
mov edx, dword [0x1400680bc]
add esi, 3
add edx, dword [0x140068040]
mov ebx, eax
cmp esi, edx
jae 0x140011488
mov ebp, dword [rsp + 0x88]
lea r11, [rsp + 0x50]
xor ebp, 0x1f
mov rbx, qword [r11 + 0x30]
mov eax, ebp
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140011874
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x78]
lea edi, [rdx - 0xb7]
mov ebp, r8d
lea eax, [rdi + 0xb9]
xor ebp, 0x4d
lea r10d, [rdx + 0x2e]
add r9d, 0xffffff40
lea esi, [r8 - 0x35]
lea r15d, [rcx - 0x113]
mov r14d, edx
mov rdx, qword [section..data]
cmp r9d, eax
jge 0x140011921
cmp dword [rdx + 0x6c], 0x1854d
ja 0x1400118f2
mov ecx, dword [rdx + 0x58]
xor ecx, dword [rbx]
mov eax, dword [rbx + 0xa0]
xor ecx, 0xfff02103
imul eax, ecx
mov dword [rbx + 0xa0], eax
mov rdx, qword [section..data]
mov eax, dword [0x1400680bc]
cmp dword [rbx + 0xe8], eax
ja 0x14001195a
mov ecx, dword [0x14006807c]
add ecx, 0xc5cc4
add ecx, dword [0x140068024]
xor dword [rbx + 0x98], ecx
mov rdx, qword [section..data]
jmp 0x14001195a
mov ecx, dword [rdx + 0x9c]
mov eax, esi
sub eax, dword [rbx + 0x24]
cmp ecx, eax
jbe 0x14001195a
mov r8d, dword [0x14006807c]
imul eax, dword [rbx + 0x2c], 0xdc
add ecx, 2
xor eax, dword [0x1400680b8]
or r8d, eax
mov eax, esi
mov dword [0x14006807c], r8d
sub eax, dword [rbx + 0x24]
cmp ecx, eax
ja 0x140011937
lea r11d, [r10 - 0x25]
cmp esi, r11d
jg 0x1400119ff
lea eax, [r10 - 0x15]
cmp ebp, eax
je 0x1400119b9
mov qword [rsp + 0x28], rdx
lea r8d, [r10 - 0x2c]
xor edi, 0xc0
mov dword [rsp + 0x20], r11d
mov edx, edi
lea ecx, [r15 + 0xa7]
add r9d, 0xe5
call fcn.140011d6c
mov eax, dword [0x140068038]
cmp dword [0x1400680b0], eax
jb 0x1400119ff
mov eax, dword [0x140068068]
add eax, 0x703c842
mov dword [0x14006802c], eax
jmp 0x1400119ff
mov eax, dword [rbx + 0xec]
and eax, r10d
cmp dword [rbx + 0x64], eax
je 0x1400119ff
mov edi, dword [0x140068110]
jmp 0x1400119f1
mov edx, dword [rdx + 0xa0]
mov ecx, ebp
sub ecx, dword [0x140068010]
and edx, esi
sub edx, r15d
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov rdx, qword [section..data]
inc edi
mov eax, dword [rdx + 0x9c]
imul eax, dword [rbx + 0x6c]
cmp edi, eax
je 0x1400119cf
mov rbx, qword [rsp + 0x50]
mov eax, r14d
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140011fac
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r10d, dword [rsp + 0xa0]
lea r12d, [rcx - 0x20]
mov ebx, dword [rsp + 0x98]
lea r13d, [r9 - 9]
mov edi, dword [rsp + 0x90]
add ebx, 0xfffffff8
mov eax, ebx
mov ebp, r8d
mov esi, r10d
lea r15d, [r10 - 0x27]
xor eax, 0xf
xor esi, 0x60
xor ebp, 0xd7
xor edi, 0x45
mov r14, rdx
cmp r12d, eax
je 0x140012193
lea r8d, [r15 + 0x36]
cmp ebx, r8d
jg 0x14001210c
mov rcx, qword [section..data]
lea r10d, [rbp + 0xc8]
lea r11d, [rbx + 0x4d]
lea r9d, [rsi + 0xf]
mov eax, dword [rcx + 0x24]
add eax, 0xa7aab
mov dword [rcx + 0x98], eax
mov eax, dword [0x1400680d4]
add eax, eax
sub eax, dword [rdx + 0xfc]
add eax, 0x16619b
mov dword [0x1400680d4], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0xa0]
mov eax, dword [rdx + 0x58]
xor ecx, 0x199101
imul eax, ecx
lea ecx, [rbx + 0x18]
mov dword [rdx + 0x58], eax
lea edx, [rdi - 0x35]
mov rax, qword [section..data]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.14000ca60
xor ebx, 0x7f
lea r10d, [r13 + 0x10]
mov r11d, eax
lea ecx, [r13 - 9]
xor r11d, 0x74
mov edi, eax
lea r9d, [rax + 0x3b]
lea edx, [rbx + 0x1e]
mov dword [rsp + 0x30], edx
lea r8d, [rbx + 0x3c]
mov dword [rsp + 0x28], r10d
mov rdx, r14
mov dword [rsp + 0x20], r11d
call fcn.14000f0a8
mov rcx, qword [section..data]
add dword [rcx + 0xc4], 0x12439f
mov eax, dword [r14 + 0xfc]
cmp dword [0x1400680d4], eax
jbe 0x140012193
xor eax, dword [0x140068054]
xor eax, dword [0x140068110]
xor eax, 0x11add4
mov dword [0x140068054], eax
jmp 0x140012193
mov ecx, ebp
sub ecx, ebx
and ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [r14]
mov r8d, dword [0x140068068]
mov ecx, dword [r14 + 0xa4]
or r8d, r12d
lea r10d, [rax + rax*2]
mov rax, qword [section..data]
shl r10d, 6
mov qword [rsp + 0x20], r10
sub ebx, dword [rax + 0x4c]
add r8d, dword [rax + 8]
sub ebx, r15d
mov eax, esi
mov r9d, ebx
and eax, 0xb9
sub eax, ebp
movsxd rdx, eax
mov eax, esi
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [section..data]
mov ecx, dword [rax + 0x4c]
mov eax, dword [r14 + 0xb0]
or ecx, esi
xor eax, dword [0x1400680bc]
imul ecx, r13d
imul edx, ecx, 0xb0
add edx, eax
mov dword [0x140068074], edx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
lea eax, [rdi + 0x3b]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rsi
push rdi
sub rsp, 0x58
mov byte [rsp + 0x20], 0x57
mov byte [rsp + 0x21], 0x45
mov byte [rsp + 0x22], 0x4c
mov byte [rsp + 0x23], 0x43
mov byte [rsp + 0x24], 0x4f
mov byte [rsp + 0x25], 0x4d
mov byte [rsp + 0x26], 0x45
mov byte [rsp + 0x27], 0x20
mov byte [rsp + 0x28], 0x41
mov byte [rsp + 0x29], 0x44
mov byte [rsp + 0x2a], 0x4d
mov byte [rsp + 0x2b], 0x49
mov byte [rsp + 0x2c], 0x4e
mov byte [rsp + 0x2d], 0x21
mov byte [rsp + 0x2e], 0
lea rax, [rsp + 0x30]
lea rcx, str.Heres_The_Acess_Code_:
mov rdi, rax
mov rsi, rcx
mov ecx, 0x19
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x20]
lea rcx, str._s_n_n
call fcn.140001630
lea rdx, [rsp + 0x30]
lea rcx, [0x140005064]
call fcn.140001630
lea rcx, str.flag
call fcn.140001630
mov r9, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
lea rcx, str._s__s__s
call fcn.140001630
lea rcx, str._UwU
call fcn.140001630
lea rcx, [0x140005084]
call fcn.140001630
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1400014d0
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
sub rsp, 0xc8
mov byte [rsp + 0x28], 0x42
mov byte [rsp + 0x29], 0x30
mov byte [rsp + 0x2a], 0x30
mov byte [rsp + 0x2b], 0x4c
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x24], 0x49
mov byte [rsp + 0x25], 0x35
mov byte [rsp + 0x26], 0
mov byte [rsp + 0x30], 0x35
mov byte [rsp + 0x31], 0x37
mov byte [rsp + 0x32], 0x72
mov byte [rsp + 0x33], 0x30
mov byte [rsp + 0x34], 0x4e
mov byte [rsp + 0x35], 0x36
mov byte [rsp + 0x36], 0
mov byte [rsp + 0x20], 0
lea rcx, str.Welcome_to_The_CyberSecurity_Password_Manager__n_n
call fcn.140001630
lea r8, [0x1400050bc]
lea rdx, str.License.dat
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140001574
lea rcx, str.Failed_To_Find_License.dat_n
call fcn.140001630
lea rcx, str.Please_Ensure_The_License_File_Exists__n
call fcn.140001630
jmp 0x14000161a
cmp dword [rsp + 0x38], 0
jne 0x14000161a
mov r8, qword [rsp + 0x40]
mov edx, 0x64
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
lea rdx, [rsp + 0x50]
lea rcx, str.Provided_Key:__s_n_n
call fcn.140001630
lea rcx, [rsp + 0x50]
call fcn.1400010f0
test rax, rax
jne 0x1400015be
mov dword [rsp + 0x3c], 0
jmp 0x1400015c6
mov dword [rsp + 0x3c], 1
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400015f3
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x28]
movzx ecx, byte [rsp + 0x20]
call entry0
jmp 0x14000160b
lea rcx, str.Unauthorized_Computer__n
call fcn.140001630
lea rcx, str.This_Error_Will_be_Reported__n
call fcn.140001630
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [rsp + 0x38], eax
lea rcx, str.pause
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
xor eax, eax
add rsp, 0xc8
ret
Function at 0x140001dc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e0c
xor al, al
add rsp, 0x28
ret

Function at 0x14000f540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14000f56d
xor al, al
jmp 0x14000f6cf
mov rax, qword [0x14002f6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14002f6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14002f6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14002f6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14002f6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14002f6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14002f6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14002f6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14002f700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14000f6c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14000f619
mov r11d, 2
jmp 0x14000f63d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14000f633
mov r11d, 1
jmp 0x14000f63d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14000f6e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14000f682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14000f69a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14000f6aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14000f6b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14000f600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14000f6ca
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403b3583

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b5077
Function at 0x1400ed4e6
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
movzx eax, word [0x1400b8f10]
stc
test ax, ax
jmp 0x1401dd0a3
jne 0x140113190
sub r8, rax
stc
clc
test r8, r8
jmp 0x1401be988
nop word [rax + rax]
cmp r8, rax
jmp 0x14018e142
je 0x14014fef7
mov word [rcx], ax
sbb eax, edi
add rcx, 2
cmovae eax, r12d
movsx ax, r12b
movzx rax, r10w
movzx eax, word [r9 + rdx*2 + 2]
inc rdx
test ax, ax
jmp 0x140185424
je 0x1401bd919
mov word [rcx], 0
jmp 0x1401bd919
je 0x14010c663
sub eax, eax
jmp 0x14011318a
jne 0x14022fc67
sub r8, rdx
test dx, r10w
cmc
test r8, r8
jmp 0x14014fef1
je 0x1401be98e
mov word [r10], r11w
movzx r11, sp
sbb r11, r10
shrd r11d, esi, 0x22
add r10, 2
movsx r11w, r13b
movzx r11w, r14b
bswap r11w
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14027c792
ret
je 0x1401be994
mov word [r10], 0
movzx eax, word [0x1400b8f10]
bswap r8
cmp rdx, 0x104
movsx r8, r10w
mov r8b, sil
movzx r8d, r11w
mov r8d, 0x104
jmp 0x140232a28
je 0x14020b8b2
cmp rdx, 0x104
movsxd r8, esi
movzx r8, dx
mov r8d, 0x104
jmp 0x14020721b
cmovb r8, rdx
jmp 0x1402443f7
mov rax, qword gs:[0x30]
inc r10b
shr r10d, 0x31
mov rax, qword [rax + 0x60]
rcl r10, cl
mov rax, qword [rax + 0x18]
sar r8w, cl
sal r9, cl
xor r8w, sp
mov rax, qword [rax + 0x10]
clc
bts r8w, si
movzx r8d, word [rax + 0x58]
cmp r8, rdx
cmovae r8, rdx
movsx r11d, r15w
mov r9, qword [rax + 0x60]
shr r10b, cl
movzx r11d, word [r9]
sbb r10b, sil
sal r10b, cl
lea r10, [0x1400b8f10]
cmp sil, r12b
test r11w, r11w
jmp 0x14015be74
je 0x140185432
xor edx, edx
movzx r9d, r14w
lea r9, [0x1400b8f10]
cmp r8, rdx
jmp 0x1401397e9
cmovb r8, rdx
test ax, ax
jmp 0x14022fc54
jmp 0x14022fc5a
inc rax
stc
test cl, dil
test r11w, r11w
jmp 0x14010c658

Function at 0x1400ffbd4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x14025b072
jmp fcn.1404c9781
Function at 0x1401237a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x1401e21e4
and r9d, 3
btr rax, r12
mov ax, r9w
xor ecx, ecx
cmc
nop word cs:[rax + rax]
btc rax, r15
test r12b, 0x73
movzx eax, byte [r11 + rcx*2]
test r11d, ebx
jmp 0x14012ab44
sub ecx, ecx
jmp 0x140236511
mov r10, qword [rcx]
rol r9, 0x41
mov r11, qword [rcx + 0x18]
ror r9b, cl
shl r9b, cl
cmp bh, 0x31
mov r9d, dword [r10 + 4]
cmc
jmp 0x1401fd687
jne 0x14027042f
test r9b, 3
jmp 0x1400e6564
mov byte [r11 + 3], cl
ror ch, 0x4f
movzx ecx, byte [r11 + 4]
cmp cl, byte [rdx]
mov cl, 0xc7
setne cl
cmc
test cl, dil
neg cl
mov byte [r11 + 5], cl
mov cx, 0x5989
movzx ecx, byte [r11 + 6]
test r14b, r15b
cmp cl, byte [rdx]
setne cl
cmc
test r11d, 0x10691417
neg cl
cmc
jmp 0x14028ca00
cmp al, byte [rdx]
setne al
cmp bpl, bl
jmp 0x140292e77
ret
jne 0x14023c39d
movzx eax, byte [r11 + rcx*4 + 1]
clc
cmp ah, 0x18
cmp al, byte [rdx + 1]
jmp 0x14022422c
neg cl
jmp 0x140127380
imul r9d, dword [r10]
cmp sil, bpl
cmp r8d, 2
jne 0x140251a80
test r9d, r9d
jmp 0x14026ed4b
jmp 0x14023c39d
jne 0x14023c39d
movzx eax, byte [r11 + rcx*4 + 2]
cmp dil, 0xa6
stc
cmp al, byte [rdx + 2]
jne 0x14023c39d
mov byte [r11 + rcx*4 + 3], 0
jmp 0x14027ad00
je 0x1401e21e4
cmp byte [r11 + rcx*4], r10b
jmp 0x1401e931c
inc rcx
cmp r8d, ecx
jmp 0x14023650b
test r9d, r9d
je 0x1401e21e4
movzx r10d, byte [rdx]
xor r8, rsp
sub r8b, 0x88
rcr r8b, cl
mov r8d, r9d
jmp 0x1400f6ec0
mov byte [r11 + rcx*2 + 1], al
inc rcx
clc
cmp r9d, ecx
jne 0x1400e658b
jmp 0x1401e21e4
je 0x1401e21e4
lea ecx, [r9 - 1]
cmp ecx, 3
jmp 0x140270400
jb 0x140124380
mov r8d, r9d
rol r10b, cl
and ch, dh
bswap r10d
and r8d, 0xfffffffc
adc r10b, r15b
nop word cs:[rax + rax]
btc r10, 0xb8
test r9b, 0x23
movzx ecx, byte [r11]
movzx r10w, bl
cmp cl, byte [rdx]
sete r10b
movzx r10d, byte [r11 + 2]
jmp 0x140282322
movzx r10d, byte [rdx]
jmp 0x140202a62
neg cl
cmp r13d, 0x680040cc
cmp r13b, dil
mov byte [r11 + 1], cl
xor cl, cl
cmp r10b, byte [rdx]
setne cl
jmp 0x1401f016e
setne cl
jmp 0x14027fd1a
mov byte [r11 + 7], cl
cmc
add r11, 8
add r8d, 0xfffffffc
jmp 0x14012437a
neg al
jmp 0x14026aeb7

Function at 0x140124155
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
mov r10w, 0x5690
clc
sub r9d, r9d
add r8, rcx
mov r10, rdx
bt ax, cx
sbb ah, al
movzx eax, word [r8 + 0x14]
sbb r11b, r13b
movsx r11d, di
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test cx, sp
cmp r12d, ebx
test r11d, r11d
jmp 0x14020eede
jb 0x14019c0e2
inc r9d
test dl, 0xac
add rax, 0x28
test bh, 0xc3
test r10w, r12w
cmp r9d, r11d
jb 0x14020eee4
sub eax, eax
jmp 0x14019c0e2
ret
jb 0x14012d096
mov ecx, dword [rax + 8]
add ecx, edx
cmc
test sil, r9b
cmp r10, rcx
jmp 0x14012d090
je 0x14012d0b0
mov edx, dword [rax + 0xc]
cmp r10, r12
test ax, 0x17c
cmp r10, rdx
jmp 0x1401a59f4
Function at 0x1401a9968
Capabilities:
Parse pe header

Disassembly:
jne 0x14020ffc7
movsxd rdx, dword [rcx + 0x3c]
test sil, 4
add rdx, rcx
cmc
cmp bpl, bl
cmp dword [rdx], 0x4550
jmp 0x140236bd1
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x1401a7280
xor eax, eax
jmp 0x140241a64
jne 0x14020ffc7
sub eax, eax
not ch
or rcx, 0x58a431d3
rcl cl, cl
mov ecx, 0x20b
xor al, 0xf
or al, 0x53
cmp word [rdx + 0x18], cx
sete al
jmp 0x14029a188
ret
ret

Function at 0x1401ae840
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x1401d477a
jmp 0x14044bd91
push rsi
rol ax, 5
and ah, 0xb7
bt ax, r10w
push rdi
sub rsp, 0x28
cmc
rcl ah, cl
neg al
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
adc rax, 0x49b829c0
seto al
mov rax, qword [rcx]
sub edx, edx
stc
test al, r10b
xor r8d, r8d
jmp 0x14044bdca
call qword [rax + 0x188]
mov edi, eax
bswap rcx
lea rcx, [rsi + 0x30]
jmp 0x14044bdde
call fcn.14045f78a
test edi, edi
je 0x14044be1a
cmp edi, 0x8899000c
jmp 0x14044bdf6
jne 0x14044be3a
mov rcx, rsi
add rsp, 0x28
seto dil
not di
pop rdi
setle sil
pop rsi
jmp 0x14044be15
jmp fcn.14044ba6d
nop
shld rdi, rsi, 0x56
rcr sil, cl
sal di, cl
add rsp, 0x28
pop rdi
movzx si, r8b
movsxd rsi, r11d
pop rsi
jmp 0x14044be39
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
xadd rsi, rdi
movsx r9w, r10b
ror rdi, 5
mov r9d, 0x54
or sil, 0x84
add rsp, 0x28
movzx esi, r11w
movsx rdi, r11w
pop rdi
pop rsi
jmp 0x14044be72
jmp fcn.1403b5675
Function at 0x140236108
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
test r14b, 0x38
sub edx, edx
jmp 0x14023764e
jmp 0x1404b6c66
Function at 0x1403d0da2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
inc rax
push rsi
or ah, 0xbb
btc rax, r8
bt rax, 0x24
push rdi
mov si, cx
adc rsi, rsi
rol si, 0x18
push rbx
not ah
shr ax, 0xa0
rcl al, 0x71
sub rsp, 0x28
mov rsi, rcx
adc eax, 0x5da606e8
lea rax, [0x1400be400]
jmp 0x1403d0de1
mov qword [rcx], rax
mov rcx, qword [rcx + 0xa8]
test r13b, 0x57
test rcx, rcx
je 0x1403d0e2f
lea rax, [rsi + 0x70]
sub dl, 0x3e
sal dl, cl
cmp rcx, rax
setne dl
mov eax, 0x2e362f09
movzx ax, r10b
not ah
mov rax, qword [rcx]
call qword [rax + 0x20]
mov qword [rsi + 0xa8], 0
rol di, 0x14
not dil
rcr di, 0xb2
mov rdi, qword [rsi + 0x58]
cmc
jmp 0x1403d0e3a
test rdi, rdi
jmp 0x1403d0e42
je 0x1403d0f17
lea r14, [rsi + 0x58]
mov rbx, qword [rsi + 0x60]
stc
cmp bh, 0xd2
cmp rdi, rbx
jmp 0x1403d0e5c
je 0x1403d0e9f
nop word cs:[rax + rax]
movzx ecx, cx
mov rcx, rdi
jmp 0x1403d0e7a
call fcn.1403d1068
add rdi, 0x60
test r10d, esp
test bh, 0xdc
cmp rdi, rbx
jmp 0x1403d0e91
jne 0x1403d0e72
mov rdi, qword [r14]
btr rdx, 0x2e
mov rdx, qword [rsi + 0x68]
clc
sub rdx, rdi
cmp r11b, spl
test dil, 0x2e
cmp rdx, 0x1000
jmp 0x1403d0eba
jb 0x1403d0ef0
mov rax, qword [rdi - 8]
stc
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmc
cmp rdi, 0x20
jmp 0x1403d0ed6
jae 0x1403d105d
add rdx, 0x27
movzx edi, r10w
jmp 0x1403d0ee9
mov rdi, rax
movsx ecx, r13w
mov rcx, rdi
jmp 0x1403d0ef8
call fcn.140296cf3
xorps xmm0, xmm0
movups xmmword [r14], xmm0
sar di, 0xdd
clc
mov qword [r14 + 0x10], 0
stc
and bx, 0x769
lea rax, [0x1400bdb70]
add bl, 0xb1
rol bl, 0xf3
movzx rdi, ax
mov qword [rsi], rax
shr di, 0xf6
and di, r15w
mov rdi, qword [rsi + 0x40]
bts bx, r10w
test dil, 0x8e
mov rbx, qword [rsi + 0x48]
clc
cmp rdi, rbx
jmp 0x1403d0f4d
jne 0x1403d0f6a
jmp 0x1403d0fc2
add rdi, 8
cmp rdi, rbx
jmp 0x1403d0f64
je 0x1403d0fa0
mov rcx, qword [rdi]
cmc
test rcx, rcx
jmp 0x1403d0f76
je 0x1403d0f58
mov rax, qword [rcx]
movzx rdx, r9w
xchg rdx, rdx
movsx dx, r14b
mov edx, 1
jmp 0x1403d0f95
call qword [rax + 0xb8]
jmp 0x1403d0f58
mov rdi, qword [rsi + 0x40]
cmp di, 0x6eb8
cmc
clc
cmp rdi, qword [rsi + 0x48]
jmp 0x1403d0fb4
je 0x1403d0fc2
mov qword [rsi + 0x48], rdi
clc
cmp r14d, edi
test rdi, rdi
jmp 0x1403d0fca
je 0x1403d1035
mov rdx, qword [rsi + 0x50]
clc
sub rdx, rdi
cmc
cmp rdx, 0x1000
jmp 0x1403d0fe5
jb 0x1403d1010
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x1403d105d
add rdx, 0x27
xor cx, r9w
sub edi, r11d
rcr cl, cl
mov rdi, rax
add rsi, 0x40
bswap cx
movsxd rcx, edx
mov rcx, rdi
jmp 0x1403d1022
call fcn.140296cf3
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
add rsp, 0x28
movzx r14d, ax
movsxd rsi, ebp
pop rbx
movzx r14w, r14b
bswap esi
pop rdi
mov sil, r13b
pop rsi
movzx r14, r13w
not r14w
pop r14
jmp 0x1403d105c
ret
call fcn.1404bbe0d
int3