joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403ac387

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403adeb2

Function at 0x1401080b1
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14013de33
jmp 0x140445156
push rsi
sub rax, 0xba461e1
cmp r10b, 0xb9
setnp sil
push rdi
neg sil
setno sil
cdqe
sub rsp, 0x28
cmp dl, 0xe2
movzx rsi, r13w
mov rsi, rcx
rcr ax, 0x91
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
clc
jmp 0x14044518f
xor edx, edx
cmp spl, 0x4e
sub r8d, r8d
jmp 0x14044519d
call qword [rax + 0x188]
mov edi, eax
jmp 0x1404451ad
lea rcx, [rsi + 0x30]
call fcn.140458cfa
test edi, edi
jmp 0x1404451bd
je 0x1404451ee
cmp edi, 0x8899000c
jmp 0x1404451ce
jne 0x140445207
mov rcx, rsi
add rsp, 0x28
setp sil
pop rdi
bswap si
pop rsi
jmp 0x1404451e9
jmp fcn.140444e32
nop
ror esi, 0xe9
add rsp, 0x28
movsx di, r14b
pop rdi
setg sil
pop rsi
jmp 0x140445206
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
btr rsi, rsi
mov dl, 3
sub edi, 0x12ac4ffc
movsxd rdi, r8d
mov r9d, 0x54
add rsp, 0x28
jmp 0x140445239
pop rdi
bswap si
mov esi, r8d
movsx rsi, bx
pop rsi
jmp fcn.1403ae47e

Function at 0x14011cb48
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
jmp 0x140203c44
xor edx, edx
jmp 0x1404b0024
Function at 0x1401c8239
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], ax
jne 0x1400ea864
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmc
test r13b, r15b
cmp dword [rdx], 0x4550
jmp 0x140218b32
sub eax, eax
ret
mov eax, 0x5a4d
cmc
jmp 0x1400e040c
jne 0x1400ea864
sub eax, eax
clc
mov ecx, 0x20b
test eax, 0x1a095210
cmp word [rdx + 0x18], cx
sete al
ret

Function at 0x1401d2efc
Capabilities:
Enumerate pe sections

Disassembly:
ret
jb 0x14023ffce
xor eax, eax
jmp 0x1400fe739
jb 0x1401ffd94
mov ecx, dword [rax + 8]
test r12, r12
jmp 0x1401ab404
add ecx, edx
cmp r10, rcx
jmp 0x1401ffd8e
movsxd r8, dword [rcx + 0x3c]
and al, bh
sub r9d, r9d
movsx rax, r8w
lea r8, [r8 + rcx]
lahf
adc al, 0xdf
btc ax, cx
mov r10, rdx
movzx eax, word [r8 + 0x14]
btr r11, rsi
shr r11b, 2
movzx r11d, word [r8 + 6]
clc
add rax, 0x18
lea rax, [rax + r8]
test r11d, r11d
jmp 0x14023ffc8
jb 0x1400fe739
inc r9d
stc
test bp, cx
cmp rsi, 0x48434b5a
add rax, 0x28
cmp r9d, r11d
jmp 0x14011219c
je 0x1401121a2
mov edx, dword [rax + 0xc]
cmp r10, rdx
jmp 0x1401a5190

Function at 0x1402294a0
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b0024
lea edx, [r8 + 2]
jmp 0x1400e5e40
xor r8d, r8d
jmp 0x140116cd7
mov qword [rsp + 8], rbx
btr bx, 0xa3
mov dword [rsp + 0x18], r8d
sbb bx, 0x3d65
bsr ebx, eax
mov dword [rsp + 0x10], edx
bsr bx, cx
movsx rbx, r13w
rcr bl, cl
push rbp
mov rbp, rsp
sub rsp, 0x50
and bx, 0xd00
mov ebx, ecx
test r12d, r13d
test r8d, r8d
jmp 0x1404b0063
jne 0x1404b0102
xor ecx, ecx
jmp 0x1404b0070
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b007e
je 0x1404b0102
mov ecx, 0x5a4d
stc
test r12b, 0x1e
cmp word [rax], cx
jmp 0x1404b0096
jne 0x1404b0102
movsxd rcx, dword [rax + 0x3c]
cmc
lea rcx, [rcx + rax]
cmp r11b, al
cmc
test r12w, di
cmp dword [rcx], 0x4550
jmp 0x1404b00b8
jne 0x1404b0102
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1404b00cc
jne 0x1404b0102
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b00de
jbe 0x1404b0102
cmp dword [rcx + 0xf8], 0
jmp 0x1404b00f0
je 0x1404b0102
mov ecx, ebx
jmp 0x1404b00fd
call fcn.1404afef8
lea rax, [rbp + 0x18]
cdq
mov byte [rbp + 0x28], 0
setne r9b
not dl
mov qword [rbp - 0x20], rax
movsxd rdx, ecx
xchg rcx, rcx
lea r9, [rbp - 0x2c]
cdq
movzx r8d, sp
lea rax, [rbp + 0x20]
cdq
movsxd rcx, r10d
mov qword [rbp - 0x18], rax
rdtsc
cdq
mov al, r12b
lea r8, [rbp - 0x20]
jmp 0x1404b013f
lea rax, [rbp + 0x28]
movsxd rcx, edi
mov qword [rbp - 0x10], rax
cwde
cmovo cx, r13w
lea rdx, [rbp - 0x28]
cbw
cwde
setb al
mov eax, 2
movzx rcx, r14w
movzx ecx, si
lea rcx, [rbp - 0x30]
jmp 0x1404b016f
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
jmp 0x1404b017a
call fcn.1404b031e
cmp dword [rbp + 0x20], 0
je 0x1404b019d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
movsx bp, r12b
setge bpl
pop rbp
ret
mov ecx, ebx
jmp 0x1404b01a4
call fcn.1404aff9f
int3
Function at 0x140237ce5
Capabilities:
Access peb ldr_data

Disassembly:
cmovb r8, rdx
jmp 0x1401a71fc
je 0x1401b06e2
mov word [rcx], ax
add rcx, 2
cbw
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x140218680
test ax, ax
jne 0x1402365ff
sub r8, rdx
clc
test r8, r8
jmp 0x1401b06dc
je 0x1401928a5
sub eax, eax
cmp r8w, r12w
nop word [rax + rax]
cmp r8, rax
je 0x1401928ae
mov word [r10], r11w
add r11, 0x17330a71
neg r11b
add r10, 2
movsx r11, r12w
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14024c98f
mov r8d, 0x104
jmp 0x1401db41b
jne 0x14016afdd
sub r8, rax
cmp r15w, 0x6a49
clc
test r8, r8
je 0x1401928b4
mov word [r10], 0
movzx eax, word [0x1400b8f10]
movsx r8, r12w
cmp rdx, 0x104
movsx r8d, si
setp r8b
jmp 0x140173c80
jmp 0x14026bf86
je 0x1401b06e7
mov word [rcx], 0
ret
mov rax, qword gs:[0x30]
rcr r9b, 0xf9
movsx r11w, r10b
mov rax, qword [rax + 0x60]
shrd r11w, r10w, 0x31
mov rax, qword [rax + 0x18]
bt r8d, r9d
mov rax, qword [rax + 0x10]
cmp r12b, r9b
btc r8w, 6
movzx r8d, word [rax + 0x58]
cmp r8, rdx
movsx r9d, si
mov r10, 0x7e640108
movzx r10d, r13w
cmovae r8, rdx
xor r9b, r15b
adc r10b, cl
sal r10b, 0x71
mov r9, qword [rax + 0x60]
stc
movzx r11d, word [r9]
xor r10d, r15d
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x14016afcb
cmovb r8, rdx
cmp bl, spl
test ax, ax
jmp 0x14026bf80
je 0x1401d77e4
cmp rdx, 0x104
mov r8b, 0x3a
setb r8b
bswap r8w
mov r8d, 0x104
jmp 0x1400f2c90
inc rdx
jmp 0x1401401d3
cmp r8, rdx
jmp 0x1401176d4
movzx eax, word [0x1400b8f10]
test ax, ax
jmp 0x1401ddc50
inc rax
stc
cmc
cmp r12b, r8b
test r11w, r11w
jmp 0x140192895
je 0x1401401e0
xor edx, edx
shr r9w, 0xdd
inc r9b
movsx r9w, r11b
lea r9, [0x1400b8f10]
cmp bp, r14w
jmp 0x1402365ff
Function at 0x1403ba818
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bt eax, ebx
push r14
push r13
lahf
and r14b, 0x3c
push r12
bt r14, 0xc1
ror r14b, 0x63
cwde
push rsi
push rdi
push rbx
adc sil, 0x4a
rcr eax, cl
sub rsp, 0x20
sbb sil, r14b
cmp sil, sil
mov rsi, r8
shrd edi, r13d, 0x12
adc r14d, ecx
rcl ebx, 0xaa
mov rdi, rdx
inc rax
sar bh, cl
mov r14, rcx
mov rbx, qword [rcx]
mov rcx, qword [rcx + 0x10]
rcl eax, cl
sub rcx, rbx
sar rcx, 4
cmp r8b, 0x51
shl al, 0xd8
movabs rax, 0xf0f0f0f0f0f0f0f1
stc
cmp r13w, bp
imul rcx, rax
cmp rcx, r8
jmp 0x1403ba890
jae 0x1403ba8fb
mov rcx, r14
cdq
mov rdx, r13
setns dl
mov rdx, rsi
jmp 0x1403ba8a8
call fcn.1403baad8
mov rbx, qword [r14]
nop word [rax + rax]
mov rcx, rbx
movsx dx, r13b
setno dh
cqo
mov rdx, rdi
jmp 0x1403ba8ce
call fcn.1403bb2a7
add rbx, 0x110
test r8, 0x7751289e
add rdi, 0x110
jmp 0x1403ba8ed
dec rsi
jne 0x1403ba8b9
jmp 0x1403baa8b
mov r13, qword [r14 + 8]
cmp rsp, r14
movzx r12, di
adc r15, rsi
mov r12, r13
or r15b, dl
and r15b, spl
xor r15w, 0x2b0e
sub r12, rbx
cmc
sar r12, 4
ror r15w, 0x73
imul r12, rax
mov r15, r12
sub r15, rsi
jae 0x1403ba9df
cmp rbx, r13
jmp 0x1403ba93d
je 0x1403ba98b
nop word cs:[rax + rax]
jmp 0x1403ba958
mov rcx, rbx
mov dl, r12b
movzx dx, cl
mov rdx, rdi
call fcn.1403bad43
add rbx, 0x110
test r15b, 0xf4
add rdi, 0x110
cmp rbx, qword [r14 + 8]
jmp 0x1403ba985
jne 0x1403ba958
cmp rsi, r12
jmp 0x1403ba993
je 0x1403baa8b
nop dword [rax + rax]
bswap dx
mov rcx, rbx
mov edx, 0x173370a9
mov rdx, rdi
jmp 0x1403ba9b4
call fcn.1403bb2a7
add rbx, 0x110
add rdi, 0x110
jmp 0x1403ba9cc
inc r15
jmp 0x1403ba9d4
jne 0x1403ba9a4
jmp 0x1403baa8b
imul r15, rsi, 0x110
jmp 0x1403ba9ec
lea r15, [r15 + rbx]
cmp r10w, di
cmc
test r15b, r15b
test rsi, rsi
jmp 0x1403baa00
je 0x1403baa46
nop
mov rcx, rbx
movsx edx, di
mov rdx, rdi
jmp 0x1403baa15
call fcn.1403bad43
add rbx, 0x110
cmp r9w, 0x2b2c
jmp 0x1403baa2c
add rdi, 0x110
dec rsi
jmp 0x1403baa3b
jne 0x1403baa07
mov r13, qword [r14 + 8]
stc
cmp r15, r13
je 0x1403baa85
mov rsi, r15
not cl
cmovge rcx, rsi
nop word [rax + rax]
mov rcx, rsi
jmp 0x1403baa66
call fcn.1403b52c5
add rsi, 0x110
stc
cmp r8w, di
cmp rsi, r13
jmp 0x1403baa7f
jne 0x1403baa5e
mov rbx, r15
rcl r12b, cl
mov qword [r14 + 8], rbx
btr di, 0xa6
add rsp, 0x20
movzx r15d, si
pop rbx
mov r12b, r14b
pop rdi
movzx r14d, r10w
bswap r12
pop rsi
cmovb r15w, r11w
pop r12
xchg r13, r13
movzx r15d, r14w
pop r13
cmovle r15d, r14d
movzx r15w, r10b
pop r14
jmp 0x1403baad0
pop r15
jmp 0x1403baad7
ret
Function at 0x1403e5c07
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
movsxd r14, r15d
mov r15b, 0xc0
push r13
xadd r15d, r14d
push r12
push rsi
ror r15b, 0x64
push rdi
movsx r14d, r8w
push rbp
ror r13, cl
push rbx
ror r15b, cl
sub rsp, 0x38
jmp 0x1403e5c34
movaps xmmword [rsp + 0x20], xmm6
cmp r12w, 0x256e
movzx r13, r14w
mov r14, r9
bts r12d, esp
bsf r13w, r10w
mov r15, r8
add bx, bx
inc ebx
xor r12w, 0x5e89
mov r12, rdx
btc bx, 0x9a
sete bl
movsx r13w, dl
mov r13, rcx
mov rbx, qword [rcx]
jmp 0x1403e5c78
test rbx, rbx
jmp 0x1403e5c80
je 0x1403e5dcc
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403e5c92
je 0x1403e5d76
lea rbp, [0x1400bed10]
jmp 0x1403e5ca4
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e5cda
call fcn.1401c5da5
movups xmmword [rbx + 0x20], xmm6
cmp r11b, 0xa7
mov byte [rbx + 0x10], 0
clc
jmp 0x1403e5cc7
add rbx, 0x50
stc
cmp rbx, rdi
jmp 0x1403e5cd4
je 0x1403e5d6c
mov qword [rbx], rbp
bswap ecx
movsx cx, ah
lea rcx, [rbx + 0x38]
jmp 0x1403e5cec
call fcn.1403e306f
mov rax, qword [rbx + 0x28]
stc
jmp 0x1403e5cfb
cmp rax, 0x10
jmp 0x1403e5d04
jb 0x1403e5cb5
mov rcx, qword [rbx + 0x10]
shrd edx, r10d, 0x48
lea rdx, [rax + 1]
clc
cmp rdx, 0x1000
jb 0x1403e5cb0
mov rsi, qword [rcx - 8]
clc
test r12w, 0x6ca9
add rcx, 0xfffffffffffffff8
cmp eax, 0xe5805ee
stc
sub rcx, rsi
clc
jmp 0x1403e5d43
cmp rcx, 0x20
jmp 0x1403e5d4c
jae 0x1403e5e35
add rax, 0x28
mov cx, bx
xchg dx, dx
movzx dx, r8b
mov rdx, rax
mov rcx, rsi
jmp 0x1403e5cb0
mov rbx, qword [r13]
bswap dx
adc dl, 0xa2
mov rdx, qword [r13 + 0x10]
test r12b, 0x52
jmp 0x1403e5d83
sub rdx, rbx
test r8b, r14b
cmp rdx, 0x1000
jb 0x1403e5dbf
mov rax, qword [rbx - 8]
clc
cmc
add rbx, 0xfffffffffffffff8
cmp r12b, r15b
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403e5daf
jae 0x1403e5e35
add rdx, 0x27
mov rbx, rax
movsxd rcx, esp
mov rcx, rbx
jmp 0x1403e5dc7
call fcn.1401c5da5
mov qword [r13], r12
lea rax, [r15 + r15*4]
test dl, r12b
or dil, r8b
shl rax, 4
movzx rsi, di
add rax, r12
bts ebx, r14d
movsx bp, spl
mov qword [r13 + 8], rax
lea rax, [r14 + r14*4]
or r14w, dx
or sil, 0xc9
shl rax, 4
add rax, r12
ror edi, cl
rol r12w, 0x45
rcr rbx, 0xb4
mov qword [r13 + 0x10], rax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
movzx r12w, sil
pop rbp
pop rdi
pop rsi
pop r12
not r14b
pop r13
pop r14
xchg r15, r15
pop r15
ret
call fcn.1404b515b
int3
Function at 0x1403e6eaa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r9, r13
cmp bpl, cl
push r14
and r14w, sp
push rsi
push rdi
shr di, 0xdf
mov r14b, r14b
push rbx
sub rsp, 0x90
sal bh, cl
test r10w, r8w
test dx, 0x26ec
movaps xmmword [rsp + 0x80], xmm6
cmp r9b, spl
xadd r14b, r14b
mov r14, rcx
movzx rdi, r13w
btc rdi, rdx
mov dword [rcx + 8], 0
bt edi, r10d
sbb bl, spl
mov qword [rcx + 0x10], 0
mov rdi, qword [rcx + 0x18]
mov bx, r8w
cmp r12b, 0x25
inc rbx
mov rbx, qword [rcx + 0x20]
clc
cmp rdi, rbx
je 0x1403e6fec
lea r15, [0x1400beb30]
jmp 0x1403e6f2e
xorps xmm6, xmm6
jmp 0x1403e6f67
lea rsi, [rdi + 0x18]
call fcn.1401c5da5
movups xmmword [rsi], xmm6
clc
mov qword [rsi + 0x10], 0
test r14w, 0x4d39
add rdi, 0x30
stc
test rdi, r8
cmp rdi, rbx
jmp 0x1403e6f61
je 0x1403e6fd9
mov qword [rdi], r15
mov rcx, qword [rdi + 0x18]
test di, 0x237d
test rcx, rcx
jmp 0x1403e6f7b
je 0x1403e6f51
mov rdx, qword [rdi + 0x28]
test r8w, r13w
cmp r9w, 0x3179
stc
sub rdx, rcx
cmp bpl, 0x9e
test rax, r9
cmp rdx, 0x1000
jmp 0x1403e6fa6
jb 0x1403e6f36
mov rax, qword [rcx - 8]
stc
clc
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403e6fc2
jae 0x1403e713a
add rdx, 0x27
mov rcx, rax
jmp 0x1403e6fd4
jmp 0x1403e6f36
mov rax, qword [r14 + 0x18]
jmp 0x1403e6fe2
mov qword [r14 + 0x20], rax
cbw
movzx rax, r8w
mov qword [r14 + 0x30], 0
lea rax, [0x1400bed70]
jmp 0x1403e7000
mov qword [rsp + 0x28], rax
jmp 0x1403e700a
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
rcr cl, 0xa4
rcl ch, cl
movzx rcx, r15w
movups xmmword [rsp + 0x48], xmm0
shr al, cl
or al, dil
cmc
movups xmmword [rsp + 0x58], xmm0
sar ah, 0x54
movups xmmword [rsp + 0x68], xmm0
or al, 0xca
bts cx, r8w
sbb al, r10b
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x30], 0
inc al
lea rax, [r14 + 0x38]
bt cx, bx
rcl ecx, cl
mov dword [r14 + 0x40], 0
sbb cl, r14b
sar cl, cl
movsxd rcx, edi
lea rcx, [rsp + 0x28]
cmp rax, rcx
jmp 0x1403e7077
je 0x1403e70fd
lea rcx, [r14 + 0x48]
cmp r10w, 0x1fbb
xor edx, edx
test sil, r12b
cmp dx, di
sub r8d, r8d
call fcn.1403e8dd9
lea rcx, [r14 + 0x60]
clc
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
stc
cmp r9b, 0x35
sub r8, rdx
sar r8, 5
jmp 0x1403e70b7
call fcn.1403e8dd9
add r14, 0x78
adc ch, 0xa8
rol r8, 0x33
sar cx, cl
mov rdx, qword [rsp + 0x68]
xor ch, cl
mov r8, qword [rsp + 0x70]
or ecx, 0x4b7a0b9d
sal rcx, 0xe7
sub r8, rdx
movsx rcx, r9w
jmp 0x1403e70ef
sar r8, 5
bswap ecx
mov rcx, r14
call fcn.1403e8dd9
lea rcx, [rsp + 0x28]
jmp 0x1403e7107
call fcn.1403e8bd2
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
movzx r14w, bpl
movsx r15d, bp
bswap r15d
pop rdi
xchg r14b, r14b
pop rsi
pop r14
xchg r15b, r15b
pop r15
jmp 0x1403e7139
ret
call fcn.1404b515b
int3
Function at 0x1403f320f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
movsx r14w, r13b
jmp 0x1403f3223
push r13
bts r14w, r12w
rcl r15w, cl
push r12
test sil, 0x21
rcr r15b, 0xc0
push rsi
rcl r15b, cl
push rdi
rol r15d, cl
sbb r13b, 0x31
push rbx
movzx r13d, r11w
sub rsp, 0x30
mov r12d, 0x48f312d1
btc r14w, cx
movaps xmmword [rsp + 0x20], xmm6
neg r14w
bt r12w, 0x19
rol r13d, cl
mov r15, r9
or r14d, 0x757d7501
and r12d, r14d
shrd rsi, rbp, 0x4c
mov r12, r8
movsx r13w, spl
ror r14b, 0x1b
btr si, r15w
mov r14, rdx
mov r13, rcx
neg esi
shl sil, 0xb0
setge sil
mov rsi, qword [rcx]
stc
test di, r11w
test ebp, 0x6f963c8
test rsi, rsi
jmp 0x1403f32b3
je 0x1403f33df
mov rbx, qword [r13 + 8]
cmp ch, 0xfd
cmp rsi, rbx
jmp 0x1403f32c8
je 0x1403f337c
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f32f8
call fcn.1401c5da5
movups xmmword [rsi + 0x10], xmm6
mov byte [rsi], 0
add rsi, 0x20
cmp rsi, rbx
jmp 0x1403f32f2
je 0x1403f3375
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jmp 0x1403f3305
jb 0x1403f32df
mov rcx, qword [rsi]
shl rdx, 0x6b
or dl, bh
lea rdx, [rax + 1]
cmp r9, r14
cmp rdx, 0x1000
jmp 0x1403f3327
jb 0x1403f32da
mov rdi, qword [rcx - 8]
test dl, ch
cmp bpl, bpl
add rcx, 0xfffffffffffffff8
stc
clc
sub rcx, rdi
jmp 0x1403f3347
cmp rcx, 0x20
jmp 0x1403f3350
jae 0x1403f3470
add rax, 0x28
cwd
movzx edx, bx
mov rdx, rax
mov cx, si
jmp 0x1403f336d
mov rcx, rdi
jmp 0x1403f32da
mov rsi, qword [r13]
shr dx, cl
mov rdx, qword [r13 + 0x10]
cmp sil, 0x65
test dh, 0x77
sub rdx, rsi
test si, bp
cmc
cmp rdx, 0x1000
jmp 0x1403f339a
jb 0x1403f33d2
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
cmp edi, r14d
sub rsi, rax
jmp 0x1403f33b4
cmp rsi, 0x20
jae 0x1403f3470
add rdx, 0x27
movzx esi, bx
jmp 0x1403f33ca
mov rsi, rax
bswap ecx
movzx ecx, di
mov rcx, rsi
jmp 0x1403f33da
call fcn.1401c5da5
mov qword [r13], r14
xor bx, ax
shl r12, 5
test dil, 0xfd
bt rdi, r9
add r12, r14
shl bx, 0x70
mov dil, 0x3f
mov qword [r13 + 8], r12
shl r12w, cl
btc r12d, 0x1c
shl r15, 5
and r12w, 0x2f7d
lea r15, [r15 + r14]
mov qword [r13 + 0x10], r15
movaps xmm6, xmmword [rsp + 0x20]
mov bx, 0x3de3
add rsp, 0x30
cmovl r15, rbp
pop rbx
pop rdi
not r13b
setp r14b
bswap r12w
pop rsi
movsx r13, bp
mov r13b, 0x98
pop r12
mov r14b, 0x42
movsxd r15, edx
movsx r13d, bp
pop r13
cmovg r15w, r13w
setbe r15b
jmp 0x1403f345d
pop r14
movzx r15, r15w
cmovs r15w, r9w
pop r15
jmp 0x1403f346f
ret
call fcn.1404b515b
int3
Function at 0x1403f5cbd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
test r14, 0xf8a1d21
jmp 0x1403f5ccb
push rsi
cmp r13b, 0x51
clc
cmc
push rdi
bsf di, r13w
push rbx
bt rdi, 0x2f
xor di, 0x7ebd
sub rsp, 0x38
and di, r8w
shrd edi, esp, 0x34
movzx edi, si
movaps xmmword [rsp + 0x20], xmm6
rol rdi, 0x2c
btc di, bp
shl dil, cl
mov rdi, qword [rcx]
test r10w, 0x5720
test rdi, rdi
je 0x1403f5e6c
mov r14, rcx
rcl bx, 0x7f
rcr bh, 0x92
mov rbx, qword [rcx + 8]
jmp 0x1403f5d28
cmp rdi, rbx
jmp 0x1403f5d30
je 0x1403f5df3
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f5d42
jmp 0x1403f5d70
call fcn.1401c5da5
movups xmmword [rdi + 0x10], xmm6
test r11d, r15d
clc
mov byte [rdi], 0
test rbp, r9
add rdi, 0x20
test bpl, 0xb7
cmp rdi, rbx
jmp 0x1403f5d6a
je 0x1403f5df0
mov rax, qword [rdi + 0x18]
stc
test r8b, al
cmp rax, 0x10
jmp 0x1403f5d81
jb 0x1403f5d4c
mov rcx, qword [rdi]
lea rdx, [rax + 1]
test r15, 0x693f74d0
cmp al, r14b
test cx, di
cmp rdx, 0x1000
jb 0x1403f5d47
mov rsi, qword [rcx - 8]
jmp 0x1403f5db1
add rcx, 0xfffffffffffffff8
clc
cmc
sub rcx, rsi
cmp ebp, 0x66ff2b80
cmp rcx, 0x20
jmp 0x1403f5dc9
jae 0x1403f5e96
add rax, 0x28
movzx cx, al
movzx edx, bp
mov rdx, rax
xchg ch, ch
cmovbe cx, bx
mov rcx, rsi
jmp 0x1403f5deb
jmp 0x1403f5d47
mov rdi, qword [r14]
mov rdx, qword [r14 + 0x10]
jmp 0x1403f5e00
sub rdx, rdi
stc
test r11d, r15d
cmp rdx, 0x1000
jmp 0x1403f5e13
jb 0x1403f5e49
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
jmp 0x1403f5e2c
sub rdi, rax
stc
cmp al, dil
cmp rdi, 0x20
jmp 0x1403f5e3c
jae 0x1403f5e96
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
jmp 0x1403f5e51
call fcn.1401c5da5
xorps xmm0, xmm0
movups xmmword [r14], xmm0
shl bx, 0xb9
mov qword [r14 + 0x10], 0
sar ebx, 0x7c
movaps xmm6, xmmword [rsp + 0x20]
jmp 0x1403f5e7a
add rsp, 0x38
setle bl
movzx ebx, r12w
pop rbx
pop rdi
sets r14b
pop rsi
mov r14b, 0x36
movsx r14, bx
pop r14
ret
call fcn.1404b515b
int3
Function at 0x14042ae12
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
and dil, r8b
sub rsp, 0x28
adc esi, r10d
shl sil, 0x58
mov rsi, rcx
movzx edi, dx
sal edx, cl
sal dx, 1
movzx edx, word [rcx + rdi*4 + 0x834]
test dx, dx
js 0x14042ae46
mov rcx, rsi
call fcn.14042ae12
movsxd rcx, dword [rsi + 0x8860]
cmc
clc
cmp ecx, dword [rsi + 0x8858]
jmp 0x14042ae5a
jge 0x14042afc6
movsxd rax, dword [rsi + 0x885c]
lea rax, [rax + rcx]
bswap dx
mov r8, qword [rsi + 8]
or rdx, rsp
btc rdx, rax
lea edx, [rax + 3]
sar cx, cl
movsxd rcx, esp
test eax, eax
movsx ecx, r15w
movzx cx, r8b
movsx rcx, r8w
cmovns edx, eax
or cl, 0x4a
mov rcx, qword [rsi + 0x18]
clc
sar edx, 2
clc
movsxd rdx, edx
mov byte [rcx + rdx], 1
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
stc
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x14042aec1
jb 0x14042aef9
movzx ecx, byte [rdx + rdi*4 + 2]
stc
clc
mov byte [r8 + rax], cl
movzx ecx, byte [rdx + rdi*4 + 1]
mov byte [r8 + rax + 1], cl
movzx ecx, byte [rdx + rdi*4]
mov byte [r8 + rax + 2], cl
add ecx, ebx
rol ch, cl
movzx ecx, byte [rdx + rdi*4 + 3]
stc
mov byte [r8 + rax + 3], cl
xor al, r9b
mov al, 0xdb
mov eax, dword [rsi + 0x885c]
jmp 0x14042af04
add eax, 4
test dil, cl
mov dword [rsi + 0x885c], eax
cmp eax, dword [rsi + 0x8854]
jmp 0x14042af1b
jl 0x14042afc6
mov ecx, dword [rsi + 0x884c]
adc ah, dh
cmp r12b, 0xab
mov eax, dword [rsi + 0x8858]
mov dword [rsi + 0x885c], ecx
mov ecx, dword [rsi + 0x8860]
cmp bx, 0x7137
add ecx, dword [rsi + 0x8844]
jmp 0x14042af52
mov dword [rsi + 0x8860], ecx
test r15d, 0xe3815fe
cmp ecx, eax
jmp 0x14042af66
jl 0x14042afc6
mov ecx, dword [rsi + 0x8840]
jmp 0x14042af77
nop dword [rax]
test ecx, ecx
jle 0x14042afc6
mov edx, dword [rsi + 0x8864]
shl edx, cl
stc
mov dword [rsi + 0x8844], edx
clc
sar edx, 1
clc
add edx, dword [rsi + 0x8850]
jmp 0x14042afa4
mov dword [rsi + 0x8860], edx
dec ecx
test r9b, bpl
cmc
mov dword [rsi + 0x8840], ecx
cmp bp, di
jmp 0x14042afbe
cmp edx, eax
jge 0x14042af7e
add rsp, 0x28
not si
mov si, r9w
movsx rsi, r15w
pop rdi
movsxd rsi, eax
movsx si, r12b
pop rsi
jmp 0x14042afe4
ret
Function at 0x14043e1f6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
rcl rax, 0xeb
sbb al, 0x6c
push rdi
push rbp
xor al, ah
push rbx
test r8b, 0x2a
cmp spl, 1
sub rsp, 0x78
cwde
bswap si
movaps xmmword [rsp + 0x60], xmm8
movsxd rsi, r8d
mov rax, r11
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm6
cdqe
mov rax, qword [rcx]
cmovp si, sp
not sil
movzx rsi, ax
mov esi, dword [rax + 0x10]
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
jmp 0x14043e25a
test esi, esi
jmp 0x14043e261
jle 0x14043e420
movaps xmm7, xmm2
mov r15b, r9b
cmovo r15w, r14w
movsx r15, di
movaps xmm8, xmm1
mov r15, rcx
xorps xmm6, xmm6
sub edi, edi
xchg cl, r14b
lea r14, [rsp + 0x28]
nop word cs:[rax + rax]
mov rcx, r14
mov rdx, r15
movzx r8, sp
cmovge r8w, di
mov r8d, edi
call fcn.14043df02
mov ebx, dword [rsp + 0x3c]
test ebx, ebx
jmp 0x14043e2b9
jle 0x14043e420
test edi, edi
jmp 0x14043e2c6
jne 0x14043e2e4
movss xmm0, dword [rsp + 0x34]
jmp 0x14043e2d7
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043e41a
movss xmm0, dword [rsp + 0x38]
jmp 0x14043e2ef
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043e316
add edi, ebx
jmp 0x14043e303
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jl 0x14043e297
jmp 0x14043e420
movss xmm6, dword [rsp + 0x28]
jmp 0x14043e321
ucomiss xmm6, xmm8
jbe 0x14043e337
mov esi, edi
jmp 0x14043e332
jmp 0x14043e420
movss xmm0, dword [rsp + 0x2c]
jmp 0x14043e342
ucomiss xmm0, xmm8
jbe 0x14043e3b1
sub ebp, ebp
cqo
mov esi, edi
mov rdx, 0x5e2c650e
movaps xmm7, xmm6
bswap r8w
nop word cs:[rax + rax]
cdq
mov rcx, r15
not r8w
movsx edx, si
mov edx, edi
mov r8d, ebp
jmp 0x14043e381
call fcn.14043e6d3
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x14043e47f
inc ebp
jmp 0x14043e39b
inc esi
cmc
test r10b, r11b
movaps xmm6, xmm7
cmp ebx, ebp
jmp 0x14043e3ab
jne 0x14043e36d
test byte [r15 + 0x1c], 4
jne 0x14043e405
lea esi, [rbx + rdi]
movzx ax, bpl
dec esi
sar al, cl
mov rax, qword [r15]
movsxd rcx, ebp
movsxd rcx, esi
cmp qword [rax + 0x10], rcx
jmp 0x14043e3da
jbe 0x14043e4a1
cmp qword [rax + 0x18], 8
jmp 0x14043e3ea
jb 0x14043e3f5
mov rax, qword [rax]
stc
cmc
cmp word [rax + rcx*2], 0xa
jmp 0x14043e3ff
je 0x14043e420
add ebx, edi
movsx esi, r9w
movsxd rsi, r8d
mov esi, ebx
jmp 0x14043e415
jmp 0x14043e420
sub esi, esi
rcl rbp, 0x19
mov eax, esi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
sal edi, 0xd8
stc
movsxd rbx, r10d
movaps xmm8, xmmword [rsp + 0x60]
adc r14b, r9b
or r15b, r13b
add rsp, 0x78
not sil
mov ebp, edi
movsx r14w, r8b
pop rbx
movsxd r15, r11d
pop rbp
cmovg r15w, di
not r14b
setbe r15b
pop rdi
xchg r15b, r14b
movzx r14, ax
movsx si, r8b
pop rsi
movzx r15d, r14w
movzx r15w, r15b
pop r14
pop r15
jmp 0x14043e47e
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x14043e420
inc esi
jmp 0x14043e49c
jmp 0x14043e420
call fcn.14043e891
int3
Function at 0x140443348
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140443351
movzx ecx, cx
jmp 0x140443359
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
test dx, 0x70db
cmp eax, 0x100
jmp 0x140443371
setae al
test sp, r9w
add rsp, 0x28
jmp 0x140443381
ret

Function at 0x140444ab5
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov al, ah
mov rcx, qword [rcx]
movzx eax, di
mov rax, qword [rcx]
jmp 0x140444ac9
call qword [rax + 0x28]
test eax, eax
jmp 0x140444ad3
je 0x140444b17
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
add dl, 0x27
mov dl, 3
shld r9w, r13w, 0xec
movsx r9w, spl
sar r9b, 0xb6
mov r9d, 0x2a
clc
test ebp, 0x64f02998
test bpl, spl
add rsp, 0x28
jmp 0x140444b12
jmp fcn.1403ae47e
nop
add rsp, 0x28
jmp 0x140444b21
ret