joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14044b8fd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
cmc
test r10w, r14w
push rsi
setnp r14b
btr r14w, 0xca
push rdi
cmove di, r12w
xor r15d, edx
bts esi, edi
push rbp
xchg r15w, r14w
clc
bswap ebp
push rbx
lahf
adc rdi, r15
xor al, 9
sub rsp, 0x88
movzx rbp, ax
cwde
movaps xmmword [rsp + 0x70], xmm8
movsxd rax, r10d
movaps xmmword [rsp + 0x60], xmm7
movzx ax, ch
movsxd rax, r11d
movaps xmmword [rsp + 0x50], xmm6
mov r14, r8
mov rbx, rdx
mov r15, rcx
mov rsi, qword [rsp + 0xe0]
movsx ebp, dx
mov ebp, dword [rsp + 0xf0]
not dx
rdtsc
mov edx, dword [rsp + 0xe8]
cwde
mov rdi, qword [r9]
mov rax, qword [rdi]
movsx ecx, r13w
setg ch
jmp 0x14044b98c
mov rcx, rdi
call qword [rax + 0x18]
mov rax, qword [rdi]
cqo
not ch
mov rcx, rdi
movsx edx, cx
movzx dx, r9b
movsxd rdx, esi
mov edx, ebp
jmp 0x14044b9ae
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
movzx eax, r10w
mov dx, dx
lahf
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x40], xmm0
movzx eax, r10w
movsxd rax, r14d
mov rax, qword [rcx]
movzx r14w, r10b
xchg rdx, r14
lea r14, [rsp + 0x40]
mov dx, dx
movzx edx, sp
mov rdx, r14
jmp 0x14044b9eb
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x14044b9f7
movaps xmm0, xmm7
jmp 0x14044b9ff
call fcn.1404bc93a
movaps xmm8, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404bc93a
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
movaps xmm0, xmm7
jmp 0x14044ba37
call fcn.1404bc93a
movaps xmm6, xmm0
jmp 0x14044ba44
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x14044ba50
call fcn.1404bc93a
movss dword [rbx + 8], xmm6
jmp 0x14044ba5f
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
not rcx
mov rcx, qword [r15 + 0x18]
mov rax, qword [r15 + 0x20]
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
sub r8d, r8d
stc
jmp 0x14044ba84
nop
clc
cmp word [rsi + r8*2], 0
jmp 0x14044ba91
lea r8, [r8 + 1]
jmp 0x14044ba9a
jne 0x14044ba86
dec r8d
jmp 0x14044baaf
mov rbp, qword [rcx]
jmp 0x14044baba
mov qword [rsp + 0x28], rax
mov r9b, 0x9d
mov qword [rsp + 0x20], r14
xchg r9b, r9b
movsx dx, r10b
bswap r9w
mov dword [rsp + 0x38], 0
movsx r9, r14w
mov dword [rsp + 0x30], 2
cqo
mov dx, ax
mov rdx, rsi
movzx r9w, r8b
movsx r9d, r11w
setne r9b
mov r9, rdi
jmp 0x14044bb04
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x70]
rcl rbp, cl
bt si, r14w
add rsp, 0x88
mov r15b, 0xe1
pop rbx
movzx rsi, r10w
movzx r15d, r10w
pop rbp
pop rdi
movsx r15w, spl
pop rsi
setb r15b
movsxd r14, eax
movsx r14d, di
pop r14
xchg r15, r15
setl r15b
movzx r15d, r9w
pop r15
jmp 0x14044bb5c
ret
Function at 0x14044cc58
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
bt rax, r15
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14044cd69
movsxd rcx, dword [0x14000003c]
shld edx, r11d, 0xf3
btc dx, 0xb7
lea rdx, [0x140000000]
add rcx, rdx
cmc
cmp dword [rcx], 0x4550
jmp 0x14044cc9c
jne 0x14044cd69
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14044cd69
sub r8, rdx
movzx edx, word [rcx + 0x14]
adc r9b, al
bt ax, cx
add rdx, 0x18
add rdx, rcx
shrd r9d, edi, 0xab
ror ah, 0x5d
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
shl r9b, cl
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x14044cce9
je 0x14044cd29
mov ecx, dword [rdx + 0xc]
cmc
cmp r8, rcx
jmp 0x14044ccfb
jb 0x14044cd1b
mov eax, dword [rdx + 8]
cmp sp, dx
add eax, ecx
cmp r8w, r9w
cmp r8, rax
jmp 0x14044cd15
jb 0x14044cd2d
add rdx, 0x28
jmp 0x14044cd24
jmp 0x14044ccdd
xor edx, edx
clc
stc
test rdx, rdx
jmp 0x14044cd35
jne 0x14044cd47
xor al, al
jmp 0x14044cd42
jmp 0x14044cd73
cmp dword [rdx + 0x24], 0
jmp 0x14044cd50
jge 0x14044cd5d
xor al, al
jmp 0x14044cd73
mov al, 1
jmp 0x14044cd64
jmp 0x14044cd73
xor al, al
jmp 0x14044cd73
add rsp, 0x18
jmp 0x14044cd7c
ret
Function at 0x14045e65f
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
setp cl
mov cl, 0xfd
lea rcx, [rsp + 0x30]
jmp 0x14045e672
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
stc
add rsp, 0x28
ret

Function at 0x14045e732
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
bt bx, 0x7b
sub rsp, 0x20
mov rax, qword [0x1400b7288]
btc ebx, 0xdc
shrd rbx, rdx, 0x30
movabs rbx, 0x2b992ddfa232
clc
cmp rax, rbx
jmp 0x14045e767
jne 0x14045e813
and qword [rbp + 0x18], 0
mov ecx, r9d
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
test r14, 0x3be6170d
cmc
xor qword [rbp + 0x10], rax
jmp 0x14045e7b0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
rcr cl, cl
btr cx, r9w
dec cl
lea rcx, [rbp + 0x10]
shl rax, 0x20
stc
cmc
xor rax, qword [rbp + 0x20]
cmp r13b, sil
cmp dil, 3
xor rax, qword [rbp + 0x10]
bswap bp
xadd bpl, bpl
xor rax, rcx
sal bp, 0x70
movabs rcx, 0xffffffffffff
and rax, rcx
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
mov bp, di
cmove rax, rcx
rcr ebx, cl
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
not rax
rol bpl, cl
mov qword [0x1400b7280], rax
mov bpl, bl
add rsp, 0x20
pop rbp
ret

Function at 0x14045e8ad
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
clc
stc
sub ecx, ecx
jmp 0x14045e8ba
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x14045e8c8
je 0x14045e935
mov ecx, 0x5a4d
stc
jmp 0x14045e8da
cmp word [rax], cx
jmp 0x14045e8e2
jne 0x14045e935
movsxd rcx, dword [rax + 0x3c]
cmc
clc
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jne 0x14045e935
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14045e935
cmp dword [rcx + 0x84], 0xe
jmp 0x14045e919
jbe 0x14045e935
cmp dword [rcx + 0xf8], 0
not al
setne al
jmp 0x14045e930
jmp 0x14045e937
sub al, al
add rsp, 0x28
jmp 0x14045e940
ret
Function at 0x140477490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test rdi, r10
cmp r15, rax
jmp 0x1404774a9
mov qword [rax + 8], rbx
cmp r11d, 0x6d6d40a2
mov qword [rax + 0x10], rbp
shr bp, 0xc7
mov qword [rax + 0x18], rsi
sal rbp, 0xd4
bts si, r15w
movsx ebp, r11w
mov qword [rax + 0x20], rdi
push r14
cmovne r14w, r8w
dec r14b
sub rsp, 0x20
sal dil, cl
mov rsi, r9
movzx r14d, r8w
cmovnp rbp, rsp
mov rdi, rdx
bts bp, cx
mov rbp, rcx
test r9, r9
jmp 0x1404774ff
je 0x1404775cb
mov rbx, qword [rdx + 8]
test rbx, rbx
jmp 0x140477511
je 0x1404775b3
mov rax, qword [rbx + 0x40]
test bh, 0x8d
cmc
cmp r10b, r15b
cmp qword [rax], 0
je 0x14047757f
mov rax, qword [rbx + 0x58]
stc
cmc
cmp dword [rax], 0
jmp 0x14047753a
jle 0x14047757f
dec dword [rax]
movsx edx, dx
not ax
mov rcx, qword [rbx + 0x40]
lahf
cdqe
not ah
mov rdx, qword [rcx]
movzx ax, r14b
lea rax, [rdx + 2]
jmp 0x140477562
mov qword [rcx], rax
mov ax, r15w
movzx rax, sp
movzx eax, r14w
jmp 0x140477576
mov word [rdx], r14w
jmp 0x1404775a5
mov rax, qword [rbx]
movzx edx, r14w
movzx rcx, r11w
movsx rcx, sp
mov rcx, rbx
jmp 0x140477596
mov rax, qword [rax + 0x18]
jmp 0x14047759f
call qword [0x1400b8d90]
mov ecx, 0xffff
cmp cx, ax
jne 0x1404775bc
mov byte [rdi], 1
cmc
jmp 0x1404775bc
sub rsi, 1
jmp 0x1404775c5
jne 0x140477509
movups xmm0, xmmword [rdi]
btr si, cx
shld ebx, r15d, 0x7e
mov rbx, qword [rsp + 0x30]
inc sil
mov rax, rbp
sar r14, cl
mov rsi, qword [rsp + 0x40]
mov r14, 0x30de1247
movsx r14, bx
mov rdi, qword [rsp + 0x48]
movsxd r14, r14d
movdqu xmmword [rbp], xmm0
btc r14d, 0xc7
sbb rbp, 0xb2133fe
mov rbp, qword [rsp + 0x38]
inc r14w
xor r14d, esi
cmc
add rsp, 0x20
xchg r14b, r14b
seto r14b
pop r14
ret
Function at 0x1404a34b1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test r12b, 0x90
jmp 0x1404a34c7
mov qword [rsp + 0x18], rbp
movzx rbp, r12w
sbb bpl, 0xad
push rsi
movzx bp, dil
push rdi
bt rsi, r9
xadd rdi, rdi
push r12
push r14
shl di, 0xe5
push r15
xor sil, 0xed
sub rsp, 0x20
test rdx, rdx
lea r14, [rsp + 0x50]
movsxd rdi, r11d
mov rsi, rcx
movsx r15w, bl
mov rdi, rcx
movsx ebp, r9w
movzx r15d, cx
bswap ebp
movzx ecx, byte [rcx]
bswap r15
setl r15b
cmovne r14, rdx
mov r15, r9
bswap bp
movsxd rbp, ecx
xchg bpl, bpl
mov ebp, r8d
jmp 0x1404a3537
jmp 0x1404a3547
inc rdi
movzx ecx, byte [rdi]
jmp 0x1404a3547
call fcn.1404bc463
test eax, eax
jmp 0x1404a3553
jne 0x1404a353c
mov bl, byte [rdi]
adc al, r12b
lea eax, [rbx - 0x2b]
test al, 0xfd
jmp 0x1404a3568
je 0x1404a357a
mov bl, 0x2b
jmp 0x1404a3575
jmp 0x1404a3587
inc rdi
mov r9b, r13b
movzx r8, ax
bswap r8
mov r9, r15
setne ch
mov r8d, ebp
movsxd rcx, edi
not cx
mov rdx, r14
mov rcx, rdi
jmp 0x1404a35a1
call fcn.1404a3703
mov rcx, rax
xchg r12b, bpl
mov bpl, 0x2d
movzx r12d, ax
adc r12b, 0xb3
movabs r12, 0x8000000000000000
cmp rdi, qword [r14]
jmp 0x1404a35c9
jne 0x1404a35dc
mov qword [r14], rsi
jmp 0x1404a35d7
jmp 0x1404a35ea
cmp rsi, qword [r14]
jmp 0x1404a35e4
jne 0x1404a35f8
test rcx, rcx
jmp 0x1404a35f2
jne 0x1404a363f
cmp bl, 0x2b
jmp 0x1404a3600
jne 0x1404a3623
movabs rax, 0x7fffffffffffffff
stc
cmp ebp, r9d
clc
cmp rcx, rax
jmp 0x1404a361d
ja 0x1404a363f
cmp bl, bpl
jmp 0x1404a362b
jne 0x1404a368b
cmp rcx, r12
jmp 0x1404a3639
jbe 0x1404a368b
call fcn.1404b98a4
mov dword [rax], 0x22
cmp spl, r13b
clc
test r15, r15
je 0x1404a3666
mov dword [r15], 1
jmp 0x1404a3666
sub bl, bpl
cmp cl, 0x98
neg bl
jmp 0x1404a3673
sbb rax, rax
jmp 0x1404a367e
add rax, r12
jmp 0x1404a3686
jmp 0x1404a36b4
mov rax, rcx
neg rax
rcr r14b, cl
cmp bl, bpl
cmove rcx, rax
bts di, bp
inc r12b
mov rax, rcx
rol bpl, cl
or bp, 0x5b91
test r10d, 0x11722ae0
mov rbx, qword [rsp + 0x58]
xchg r15b, r12b
neg r14
rol rsi, 0x7a
mov rbp, qword [rsp + 0x60]
clc
jmp 0x1404a36ce
add rsp, 0x20
movsx si, r11b
movzx rdi, sp
pop r15
pop r14
movzx r12d, r10w
movsx esi, di
mov sil, 0x64
pop r12
movsxd rdi, eax
movzx rsi, r15w
movsx di, r15b
pop rdi
movzx si, dl
pop rsi
jmp 0x1404a3702
ret

Function at 0x1404a4749
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x1404a4757
call fcn.1404aeb8e
mov r9d, 2
movsx dx, spl
lea r8, [rsp + 0x30]
jmp 0x1404a4774
mov rcx, qword [rax + 0x28]
movsxd rdx, r14d
movzx rdx, dx
lea edx, [r9 + 0x20]
jmp 0x1404a4788
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x1404a47d8
sub ecx, 1
jmp 0x1404a47a4
je 0x1404a47c9
cmp ecx, 1
jmp 0x1404a47b2
je 0x1404a47bf
sub eax, eax
jmp 0x1404a47e0
mov eax, 3
jmp 0x1404a47e0
mov eax, 1
jmp 0x1404a47d3
jmp 0x1404a47e0
mov eax, 2
cmp r13, r8
add rsp, 0x28
jmp 0x1404a47e9
ret
Function at 0x1404a54ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sbb rbx, rbp
test bx, r8w
push rdi
movzx rbx, bp
cmc
test rax, r11
sub rsp, 0x40
mov bh, 0xdf
mov rbx, rcx
jmp 0x1404a54cf
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rsi, qword [rbx + 0xf8]
movzx cx, bpl
inc dh
xor edi, edi
mov dl, bh
or cl, r11b
add cx, 0x5302
xor r8d, r8d
bswap rcx
movzx rcx, ax
cdq
lea rdx, [rsp + 0x60]
movsx ecx, bx
mov rcx, rsi
jmp 0x1404a550a
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
jmp 0x1404a5518
je 0x1404a558a
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov r8w, 0x4886
movsx r9d, r15w
movzx r8w, r13b
mov r9, rax
ror r8b, 0xc5
and r8b, 0xda
mov qword [rsp + 0x30], rcx
xor r8b, 0xa1
mov r8, rsi
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
cmc
clc
sub ecx, ecx
jmp 0x1404a5566
mov qword [rsp + 0x20], rbx
jmp 0x1404a5570
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
inc edi
cmp ax, 0x4986
cmp edi, 2
jmp 0x1404a5584
jl 0x1404a54ef
add rsp, 0x40
pop rdi
mov bh, 0x47
movsxd rsi, eax
pop rsi
setb bl
movzx rbx, r15w
pop rbx
ret

Function at 0x1404a559f
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
stc
adc bl, r12b
mov rbx, rcx
test dl, sil
test si, 0x67b0
clc
xor ecx, ecx
jmp 0x1404a55bc
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x1404a55ca
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
shl bl, cl
xor dl, r8b
mov edx, 0xc0000409
btc bx, 0xf2
add rsp, 0x20
movsx bx, dl
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404a63cc
Capabilities:
Check for software breakpoints
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmp r8b, 0xc1
mov qword [rsp + 0x10], rbp
not bh
neg bp
mov qword [rsp + 0x18], rsi
inc bpl
btr rbp, 0x91
sal bpl, 0xb4
push rdi
push r12
cmp r11b, 0x76
setge bl
push r13
sal dil, 0xaa
sal bp, cl
shr bh, 0x50
push r14
push r15
sub bl, spl
sub rsp, 0x40
movsx ebp, r13w
not r12w
movzx bp, bpl
mov rbx, qword [rsp + 0x90]
mov r12, rdx
mov rbp, rcx
mov dh, 0x3a
mov rdx, r9
mov r14, r15
mov rcx, rbx
movsx r14, cx
mov rdi, r9
movzx r15d, r9w
bswap r14w
mov r15d, r8d
mov r14d, dword [rbx + 0xc]
call fcn.140227a10
xor r10d, r10d
movsx si, dil
mov esi, eax
cmp rsi, rbx
test r14d, r14d
jmp 0x1404a6468
je 0x1404a66af
mov r11, qword [rdi + 8]
shr dl, cl
movzx r8, di
cmp r8w, bp
or eax, 0xffffffff
movsxd rbx, dword [rbx + 0x10]
bts r8w, di
ror r13b, 0x72
mov r9d, eax
mov r13d, eax
mov edx, r14d
bsf ecx, edi
and cl, r14b
lea r8d, [rdx - 1]
lea rcx, [r8 + r8*4]
bsf rax, r10
or al, r12b
lea rax, [r11 + rcx*4]
test eax, 0x518c6b4e
jmp 0x1404a64b8
cmp esi, dword [rax + rbx + 4]
jle 0x1404a64d1
cmp esi, dword [rax + rbx + 8]
jmp 0x1404a64cb
jle 0x1404a64e2
mov edx, r8d
test r8d, r8d
jmp 0x1404a64dc
jne 0x1404a649b
mov r8d, r10d
test spl, 0x6b
jmp 0x1404a64f1
test edx, edx
jmp 0x1404a64f8
je 0x1404a6526
lea eax, [rdx - 1]
sub dx, ax
lea rax, [rax + rax*4]
not dx
adc dl, r11b
xor dh, 0x33
lea rdx, [rbx + rax*4]
cmp r14w, r9w
add rdx, r11
jmp 0x1404a6521
jmp 0x1404a6529
mov rdx, r10
lea rcx, [r11 + rbx]
test r11b, 0x8d
cmc
or r11d, 0xffffffff
clc
test rdx, rdx
jmp 0x1404a653f
je 0x1404a6573
mov eax, dword [rdx + 4]
test edi, 0x439e6846
clc
cmp dword [rcx], eax
jmp 0x1404a6556
jle 0x1404a65b6
mov eax, dword [rdx + 8]
stc
test sp, 0x49
cmp dword [rcx + 4], eax
jmp 0x1404a656d
jg 0x1404a65b6
cmp r15d, dword [rcx]
jl 0x1404a65b6
cmp r15d, dword [rcx + 4]
jmp 0x1404a6585
jg 0x1404a65b6
cmp r9d, r11d
movzx r13d, r8w
mov eax, r8d
jmp 0x1404a65a1
mov r13d, r8d
cmovne eax, r9d
dec r9
xchg r9b, r9b
mov r9d, eax
jmp 0x1404a65b6
inc r8d
cmc
cmp bh, 0xcc
add rcx, 0x14
jmp 0x1404a65c9
cmp r8d, r14d
jmp 0x1404a65d1
jb 0x1404a6537
cmp r9d, r11d
mov qword [rsp + 0x20], r12
cdqe
mov eax, r10d
movsx di, sil
mov r14b, 0x19
movsx ebx, r9w
mov qword [rsp + 0x30], r12
cmovne eax, r9d
movsx r14, dx
lea r11, [rsp + 0x40]
movsx r15, r14w
movsxd rbx, edx
xchg dil, r12b
mov rbx, qword [r11 + 0x30]
movzx r14, bp
movsx r12, si
mov rsi, qword [r11 + 0x40]
not dil
mov dword [rsp + 0x28], eax
lea eax, [r13 + 1]
xchg di, r13w
movups xmm0, xmmword [rsp + 0x20]
sete r12b
cmovne r10d, eax
mov rax, rbp
xchg edi, r15d
jmp 0x1404a6643
mov dword [rsp + 0x38], r10d
jmp 0x1404a6651
movups xmm1, xmmword [rsp + 0x30]
movzx r14w, dl
movsx r14, si
movsx r15w, bpl
movdqu xmmword [rbp], xmm0
movdqu xmmword [rbp + 0x10], xmm1
not r13w
mov rbp, qword [r11 + 0x38]
movsx r13w, r10b
jmp 0x1404a6684
mov rsp, r11
bswap r12w
movsx r13w, dil
mov r15b, 0xd2
pop r15
jmp 0x1404a669a
pop r14
movsx r12d, r10w
movzx rdi, ax
pop r13
pop r12
pop rdi
jmp 0x1404a66ae
ret
call fcn.1404bb781
int3
Function at 0x1404b2ab2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsx r8, cx
movzx r8d, r14w
mov qword [rsp + 0x10], rsi
xor bl, r8b
movzx r8w, bl
test rdx, rbp
push rdi
inc sil
movsxd r8, ebp
sub rsp, 0x20
cbw
add qword [rcx + 0x20], 8
cdqe
cbw
ror al, 0xb1
mov rdi, rcx
sbb si, dx
mov rax, qword [rcx + 0x20]
neg bl
bt dx, 0x8b
mov esi, dword [rcx + 0x38]
cmp esi, 0xffffffff
cdq
mov r8d, dword [rcx + 0x3c]
bswap rdx
movzx ebx, cx
movzx edx, word [rcx + 0x42]
mov rbx, qword [rax - 8]
mov eax, 0x7fffffff
jmp 0x1404b2b1c
mov qword [rcx + 0x48], rbx
jmp 0x1404b2b25
cmove esi, eax
mov rcx, qword [rcx]
jmp 0x1404b2b30
call fcn.1401cfaad
test al, al
jmp 0x1404b2b3c
je 0x1404b2b82
test rbx, rbx
jmp 0x1404b2b4a
jne 0x1404b2b64
lea rbx, [0x1400d25f0]
mov cl, 0xc
mov qword [rdi + 0x48], rbx
movsxd rcx, r9d
movzx rdx, r15w
movsxd rdx, esi
movzx cx, spl
mov rcx, rbx
mov byte [rdi + 0x54], 1
jmp 0x1404b2b78
call fcn.14019e9c3
jmp 0x1404b2c36
test rbx, rbx
jmp 0x1404b2b8a
jne 0x1404b2ba8
lea rbx, [0x1400ced98]
cmc
mov qword [rdi + 0x48], rbx
test bp, 0x5c14
cmp r14b, 0x1f
cmp eax, r10d
sub r9d, r9d
test esi, esi
jmp 0x1404b2bb2
jle 0x1404b2c2d
cmp byte [rbx], 0
jmp 0x1404b2bc0
je 0x1404b2c2d
mov rax, qword [rdi + 8]
movzx edx, byte [rbx]
test al, 0xb3
mov r8b, 0xe0
btc r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx]
lea rcx, [rbx + 1]
test r13, 0x8807db5
cmp sil, 0x11
shr r8b, 0x49
movzx r8d, word [rax + rdx*2]
stc
and r8d, 0x8000
jmp 0x1404b2c01
cmove rcx, rbx
movsx bx, spl
inc r9d
rol rbx, 0xb7
movsxd rbx, ebp
shld bx, cx, 0xbe
lea rbx, [rcx + 1]
test r9b, 0x64
test r12b, sil
cmp r9d, esi
jl 0x1404b2bb8
mov eax, r9d
neg si
not si
mov dword [rdi + 0x50], eax
mov al, 1
sal si, 0xc8
mov rbx, qword [rsp + 0x30]
bts di, r9w
xchg esi, edi
mov rsi, qword [rsp + 0x38]
bts di, bx
add rsp, 0x20
bswap rdi
pop rdi
jmp 0x1404b2c61
ret
Function at 0x1404b5007
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, edx
mov rsi, rcx
cmp cx, 0x28f5
test r8, r8
jne 0x1404b504a
call fcn.1404b98a4
mov dword [rax], 0x16
jmp 0x1404b5039
call fcn.1404ba568
xor eax, eax
jmp 0x1404b5045
jmp 0x1404b5154
mov rdx, r9
jmp 0x1404b5056
mov rcx, r8
jmp 0x1404b505e
call fcn.1404b51c4
mov rbx, rax
cmc
cmp r11w, ax
test rax, rax
jmp 0x1404b5073
je 0x1404b50fd
lea rax, [rsp + 0x50]
movsx r8d, r14w
mov cl, r8b
movzx r9, r12w
mov rdx, rdi
bswap cx
movsx r8d, ax
mov qword [rsp + 0x28], rax
cdqe
cmova eax, r11d
mov ax, sp
lea r8, [0x140094b24]
jmp 0x1404b50b0
mov eax, dword [rsp + 0x60]
movsxd rcx, eax
movzx r9, r12w
mov r9, rbx
mov rcx, 0x5fee2840
sete ch
mov rcx, rsi
jmp 0x1404b50d0
mov dword [rsp + 0x20], eax
jmp 0x1404b50d9
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b50ea
jne 0x1404b5181
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1404b9917
sub edi, edi
test rbx, rbx
jmp 0x1404b5107
je 0x1404b514e
mov rcx, qword [rbx + 0x10]
test rcx, rcx
jmp 0x1404b5119
je 0x1404b5125
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rsi
cmc
test rcx, rcx
jmp 0x1404b5135
je 0x1404b5141
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b5149
call fcn.1404cd7c2
mov rax, rdi
sar bl, 0x50
mov rbx, qword [rsp + 0x40]
shrd edi, edi, 0xf8
cmovg si, cx
mov rsi, qword [rsp + 0x48]
or rdi, rax
add di, 0x5f16
add rsp, 0x30
movsx edi, r9w
movzx edi, r13w
pop rdi
jmp 0x1404b5180
ret
mov rcx, qword [rsp + 0x68]
test r13b, 0x7e
test rcx, rcx
jmp 0x1404b5192
je 0x1404b51a9
mov eax, dword [rsp + 0x50]
test r15, 0x39e87c7a
mov dword [rcx], eax
test dil, 0x56
xor ebx, ebx
jmp 0x1404b50ff

Function at 0x1404b543a
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x1404b5447
call fcn.1404d6d9b
cmp eax, 1
jmp 0x1404b5454
je 0x1404b549e
mov rax, qword gs:[0x60]
clc
bsf edx, eax
mov edx, dword [rax + 0xbc]
cmp spl, dil
jmp 0x1404b5475
shr edx, 8
jmp 0x1404b547d
test dl, 1
jmp 0x1404b5485
jne 0x1404b549e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
cwd
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b54a5
call fcn.1404b539b
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404bbdb2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
rol ch, cl
bts rcx, rsi
mov qword [rsp + 0x20], r9
push rsi
bt rsi, 0x41
cmova cx, sp
push rdi
bswap cx
cmova di, r13w
sbb ch, 0xfa
push r14
sal dil, cl
sub rsp, 0x60
jmp 0x1404bbde6
mov rsi, r9
xchg dil, cl
movzx di, r13b
mov di, 0x7c7d
mov rdi, r8
movzx ecx, ax
xchg ch, cl
not cx
mov ecx, dword [rdx]
jmp 0x1404bbe07
call fcn.14024e348
nop
mov rbx, qword [0x1400ba160]
sbb al, spl
btc r14w, 0x9a
movsxd rax, dword [0x1400ba158]
bsr r14w, sp
lea r14, [rbx + rax*8]
test bx, 0x1210
mov qword [rsp + 0x38], rbx
cmp rbx, r14
jmp 0x1404bbe3f
je 0x1404bbf76
mov rax, qword [rbx]
btr edx, r8d
xadd rdx, rdx
rol dx, cl
mov qword [rsp + 0x20], rax
cmovns edx, r12d
shrd rdx, r12, 0x7c
mov rdx, qword [rdi]
cmp r13w, 0x5177
test r9d, ebp
cmp dil, r9b
test rax, rax
jmp 0x1404bbe78
je 0x1404bbede
mov ecx, dword [rax + 0x14]
xor al, dil
cmp r9d, 0x75e04ea8
btr ax, 0x5a
mov eax, ecx
jmp 0x1404bbe98
shr eax, 0xd
test al, 1
jmp 0x1404bbea2
je 0x1404bbede
mov eax, ecx
cmp dh, 0x9c
and al, 3
test r9b, r10b
cmp al, 2
jne 0x1404bbec8
test cl, 0xc0
jmp 0x1404bbec2
jne 0x1404bbeec
bt ecx, 0xb
jmp 0x1404bbed1
jb 0x1404bbeec
inc dword [rdx]
jmp 0x1404bbede
add rbx, 8
jmp 0x1404bbee7
jmp 0x1404bbe32
mov rdx, qword [rdi + 0x10]
cdqe
mov rcx, qword [rdi + 8]
movsx r9w, r9b
cmovs eax, ebx
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
movsx r9w, bl
mov qword [rsp + 0x40], r8
movsx r8d, r13w
movzx r9d, r9w
bswap r8d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
movsx rcx, r10w
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0x20]
movzx r9, di
not r9b
mov r8b, 0xf9
mov qword [rsp + 0x28], rax
movzx edx, sp
movsxd r8, r8d
mov qword [rsp + 0x30], rax
xchg dx, dx
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x88]
jmp 0x1404bbf6c
call fcn.1404bbc2c
jmp 0x1404bbede
mov ecx, dword [rsi]
call fcn.1402239b1
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
movsx r14d, r10w
movzx r14w, bpl
cmovno r14, rsi
pop r14
mov dil, 0xc3
setno sil
pop rdi
pop rsi
jmp 0x1404bbfa6
ret

Function at 0x1404bca03
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 0x10], rdx
test r15d, r12d
cmc
mov dword [rsp + 8], ecx
stc
push rbp
not rbp
rcr rbp, 0xa2
sar bpl, cl
mov rbp, rsp
cmp cl, sil
sub rsp, 0x40
call fcn.1404cfa66
lea rax, [rbp + 0x10]
mov qword [rbp - 0x18], rax
jmp 0x1404bca38
lea r9, [rbp + 0x28]
rdtsc
movzx r8, r8w
mov ah, 0xea
lea rax, [rbp + 0x18]
movzx r8d, sp
cwd
mov edx, 0x72930172
mov qword [rbp - 0x10], rax
movzx dx, r14b
movsx r8w, r14b
lea r8, [rbp - 0x18]
rdtsc
movzx rax, r12w
lahf
mov eax, 4
cwd
jmp 0x1404bca7c
lea rdx, [rbp - 0x20]
movsx ecx, r9w
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x28], eax
jmp 0x1404bca90
mov dword [rbp - 0x20], eax
jmp 0x1404bca98
call fcn.14009b720
add rsp, 0x40
movzx bp, r13b
pop rbp
jmp 0x1404bcaac
ret
Function at 0x1404c2ed6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
sub r9b, 0xf7
or r11d, esp
push rdi
adc di, 0x570
sub rsp, 0x30
mov r9b, byte [rdx + 8]
or edi, 0x7a1f558d
sar di, 0x90
movzx di, r14b
mov rbx, rcx
mov al, r9b
and r8b, 0xcc
sar dil, 0x36
or r8b, 0x64
sub ecx, ecx
and r11d, r13d
movsxd rdi, eax
xor r11d, 0x70782b8f
neg al
mov rdi, rdx
mov eax, dword [rbx + 4]
movzx r11w, r9b
lea r11, [rbx + 8]
movzx r8d, r10w
sbb r10d, r10d
sar r8w, cl
bts r8w, r12w
shld r8w, ax, 0xfe
lea r8, [rbx + 8]
clc
cmp bpl, 0xee
and r10d, 0x1d
add r11, rax
cmc
add r10d, 0x17
cmc
add r10d, dword [rbx]
test cx, 0x7dd5
cmp r8, r11
jmp 0x1404c2f6d
je 0x1404c2fea
neg r9b
movsx rax, r15w
movabs rax, 0x1fffffff000000
jmp 0x1404c2f89
sbb rdx, rdx
cmp bpl, r14b
clc
and rdx, rax
add rdx, 0xffffff
jmp 0x1404c2fa0
cmp rcx, rdx
jmp 0x1404c2fa8
ja 0x1404c2fea
movzx eax, byte [r8]
cmp cl, r9b
test al, r15b
sub r10d, 4
cmp edx, esp
cmc
shl rcx, 4
inc r8
test r12b, r9b
cmp spl, 0xe1
clc
add rcx, rax
test r12b, r13b
cmc
test rsp, 0x3fcc364e
cmp r8, r11
jmp 0x1404c2fe4
jne 0x1404c2fa0
mov r9b, 1
jmp 0x1404c3019
test r9b, r9b
jmp 0x1404c2ffa
je 0x1404c3022
mov al, byte [r8]
jmp 0x1404c3008
inc r8
shl r9b, 0xb8
test al, al
not r9b
sete r9b
clc
cmp r8, r11
jne 0x1404c2ff2
mov r8b, byte [rbx + 0x308]
movzx rdx, dx
mov edx, r10d
jmp 0x1404c3035
mov qword [rsp + 0x20], rdi
jmp 0x1404c303f
call fcn.1404be838
mov rbx, qword [rsp + 0x40]
rcl dil, 0xbe
btr edi, edi
add rsp, 0x30
movsxd rdi, r8d
movzx rdi, r9w
pop rdi
jmp 0x1404c3061
ret