joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403dad9a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sal r15b, cl
push r14
shld r15, rdx, 0x36
bt r14, 0xdb
push r13
rcl r13b, cl
push r12
push rsi
movsx r13w, r9b
xor r15b, 0x6f
push rdi
setns r12b
push rbp
test rbx, r13
add r12b, 0xdc
push rbx
sub rsp, 0x38
bts r15w, bp
movaps xmmword [rsp + 0x20], xmm6
test r15b, r10b
or r12d, 0x1d260635
mov r14, r9
bsf r12w, ax
mov r15, r8
btc bx, 0x81
mov r13b, r10b
mov r12, rdx
movzx r13d, dx
movzx bx, r8b
mov r13, rcx
movzx rbx, r11w
mov rbx, qword [rcx]
test al, 6
test rbx, rbx
jmp 0x1403dae15
je 0x1403daf2e
mov rdi, qword [r13 + 8]
cmp rbx, rdi
je 0x1403daece
lea rsi, [0x1400beb30]
xorps xmm6, xmm6
jmp 0x1403dae66
lea rbp, [rbx + 0x18]
jmp 0x1403dae40
call fcn.140228090
movups xmmword [rbp], xmm6
clc
mov qword [rbp + 0x10], 0
cmc
stc
add rbx, 0x30
cmp rbx, rdi
jmp 0x1403dae60
je 0x1403daeca
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x18]
stc
test rcx, rcx
jmp 0x1403dae76
je 0x1403dae54
mov rdx, qword [rbx + 0x28]
clc
sub rdx, rcx
cmp rdx, 0x1000
jmp 0x1403dae90
jb 0x1403dae37
mov rax, qword [rcx - 8]
cmp dx, 0x6481
cmc
stc
add rcx, 0xfffffffffffffff8
clc
sub rcx, rax
stc
cmp rcx, 0x20
jmp 0x1403daeb3
jae 0x1403dafd5
add rdx, 0x27
mov rcx, rax
jmp 0x1403daec5
jmp 0x1403dae37
mov rbx, qword [r13]
mov rdx, qword [r13 + 0x10]
test r15w, 0x77e1
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403daee7
jb 0x1403daf21
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
cmc
sub rbx, rax
cmc
cmp r8b, 0xec
cmp rbx, 0x20
jmp 0x1403daf07
jae 0x1403dafd5
add rdx, 0x27
movzx ecx, r10w
mov rbx, rax
xchg ch, ch
movsx rcx, si
mov ch, 0xf4
mov rcx, rbx
jmp 0x1403daf29
call fcn.140228090
mov qword [r13], r12
rcl di, 0xe2
lea rax, [r15 + r15*2]
shrd rbx, rdi, 0x7f
neg r15b
shl rax, 4
and bh, 0x41
add rax, r12
sub dil, 0xa5
xor sil, r9b
mov qword [r13 + 8], rax
movsx r15, bp
cmc
lea rax, [r14 + r14*2]
bsf bx, dx
bt r15w, bx
shr bpl, cl
shl rax, 4
lea rax, [rax + r12]
mov qword [r13 + 0x10], rax
not rbp
bts r13d, r9d
inc sil
movaps xmm6, xmmword [rsp + 0x20]
btc di, 0x74
clc
sar rbx, cl
add rsp, 0x38
mov sil, r9b
movzx bx, r12b
pop rbx
pop rbp
pop rdi
movsx r14, r9w
pop rsi
bswap r12w
movzx r15, sp
movsx r15d, r13w
pop r12
movzx r13d, ax
movzx r15w, r9b
pop r13
cmovae r15, rsp
mov r15b, 0xa6
pop r14
movsx r15d, r13w
bswap r15
pop r15
jmp 0x1403dafd4
ret
call fcn.1404b5029
int3
Function at 0x1403df297
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
cmp bx, 0x2537
shr r10b, cl
push rdi
push rbx
adc r9d, r10d
mov r9, rcx
lea r8, [r8 + rdx]
shr r10b, 0xc9
mov dword [rcx + 8], 0
rol r10, 0x4a
test r12b, 0x51
sub eax, eax
xor ecx, ecx
nop word cs:[rax + rax]
rcl r10b, cl
lea r10, [rdx + 1]
cmp r10, r8
jmp 0x1403df2de
ja 0x1403df543
movzx edi, byte [rdx]
mov edx, edi
cmp r8b, 0x8c
stc
and edx, 0x7f
test ebx, 0x31480977
shl rdx, cl
lea rax, [rax + rdx]
cwd
add rcx, 7
mov rdx, r10
cmp r13b, spl
test r12, 0x5420657f
test dil, dil
jmp 0x1403df319
js 0x1403df2d2
mov rcx, rax
and rcx, 0xfffffffffffffff8
jmp 0x1403df32b
and eax, 7
cmp sp, 0x6002
stc
clc
cmp rcx, 8
jmp 0x1403df33e
je 0x1403df4b1
cmp rax, 1
jg 0x1403df378
test rax, rax
jmp 0x1403df356
je 0x1403df44f
cmp eax, 1
jmp 0x1403df364
jne 0x1403df543
lea rdx, [r10 + 8]
jmp 0x1403df373
jmp 0x1403df49b
cmp eax, 5
jmp 0x1403df380
je 0x1403df492
cmp eax, 2
jmp 0x1403df38e
jne 0x1403df543
mov rsi, r10
xadd al, ah
neg eax
cmc
xor edi, edi
btr eax, 0xe5
sal al, 0x7d
rcr rax, cl
xor ecx, ecx
nop
nop word cs:[rax + rax]
btr eax, 0x58
add al, dl
lea rax, [rsi + 1]
test rcx, r10
cmp r13b, 0x6c
cmp rax, r8
ja 0x1403df543
mov r11, rdi
rol rdx, 9
movzx ebx, byte [rsi]
mov edx, ebx
btr si, 0
sbb sil, 0x7e
and edx, 0x7f
cmp r12b, r11b
bsf esi, ecx
bswap si
shl rdx, cl
bswap esi
lea rdi, [rdi + rdx]
test r8, rax
shld esi, r9d, 8
mov si, 0xdba
add rcx, 7
movzx si, r15b
or sil, 0x55
mov rsi, rax
cmp r12, rdx
cmc
test bl, bl
jmp 0x1403df422
js 0x1403df3bd
lea rdx, [rdx + r11]
lea rdx, [rdx + rax]
jmp 0x1403df439
cmp rdx, r8
jmp 0x1403df441
cmova rdx, rax
jmp 0x1403df44a
jmp 0x1403df2bf
mov rax, r10
ror dx, cl
sbb dl, dl
cmovae dx, ax
nop
or dx, 0x2198
lea rdx, [rax + 1]
cmp rdx, r8
jmp 0x1403df46e
ja 0x1403df543
cmp byte [rax], 0
movsxd rax, ebx
movzx ax, r8b
mov rax, rdx
jmp 0x1403df487
js 0x1403df462
jmp 0x1403df2bf
lea rdx, [r10 + 4]
test r13w, bx
clc
cmp rdx, r8
jmp 0x1403df4a3
cmova rdx, r10
jmp 0x1403df4ac
jmp 0x1403df2bf
cmp eax, 2
jmp 0x1403df4b9
jne 0x1403df543
mov dword [r9 + 8], 2
dec sil
mov rsi, r10
xor eax, eax
xor ecx, ecx
xor dh, ah
nop word [rax + rax]
lea rdx, [rsi + 1]
cmp rdx, r8
ja 0x1403df543
movzx r11d, byte [rsi]
mov rdi, r12
neg sil
movsx rsi, di
mov edi, r11d
and edi, 0x7f
ror esi, cl
shld si, r10w, 0x41
shl rdi, cl
and si, 0x3123
cmova esi, edx
test r11d, 0x7b22272b
add rax, rdi
add rcx, 7
mov rsi, rdx
test r11b, r11b
jmp 0x1403df526
js 0x1403df4d9
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], rax
cmc
clc
lea rdx, [rdx + rax]
cmp rdx, r8
jbe 0x1403df2bf
cmp r10, r8
seta al
bswap si
xchg di, di
pop rbx
movsx esi, bx
cmovbe si, r13w
not si
pop rdi
movzx esi, r14w
pop rsi
jmp 0x1403df566
ret
Function at 0x1403f4f76
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
jmp 0x1403f4f83
push r14
shl r14w, 0x3f
rcr r14b, cl
push r12
and r14b, 0xcb
bt r14, rdi
xor r14w, 0x605
push rsi
btc r14d, r10d
neg r14b
push rdi
sbb r14b, 0xaf
push rbx
bswap r14
and r14w, 0x3ba2
sub rsp, 0x28
mov r14, r8
test dil, 0xcc
cmc
test rdx, rdx
jmp 0x1403f4fc8
je 0x1403f51a3
mov rdi, rdx
btc r12, r8
mov r12, rcx
sub ebx, ebx
jmp 0x1403f4fdf
jmp 0x1403f5010
mov rcx, r15
cmove edx, r14d
mov dx, 0x520f
bswap edx
mov rdx, rsi
jmp 0x1403f4ff9
call fcn.1403ba342
add rbx, 0x50
dec rdi
jmp 0x1403f500a
je 0x1403f519b
mov eax, dword [r12 + rbx + 8]
mov dword [r14 + rbx + 8], eax
cmp ah, 0xb6
cmp ebx, esp
cmp r14, r12
jmp 0x1403f5027
je 0x1403f4ffe
cmp qword [r12 + rbx + 0x28], 0x10
jmp 0x1403f5038
jb 0x1403f5048
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403f5059
lea r9, [r12 + rbx]
stc
jmp 0x1403f5055
add r9, 0x10
lea r15, [r14 + rbx]
mov eax, r10d
add r15, 0x10
cmp r15d, r13d
mov rsi, qword [r12 + rbx + 0x20]
mov rax, qword [r14 + rbx + 0x28]
clc
jmp 0x1403f5078
cmp rax, rsi
jmp 0x1403f5080
jae 0x1403f50a2
mov rcx, r15
movzx rdx, r8w
xchg dx, dx
mov rdx, rsi
jmp 0x1403f5098
call fcn.1403ba342
jmp 0x1403f50e8
cmp rax, 0x10
jmp 0x1403f50ab
jb 0x1403f50bb
mov r15, qword [r14 + rbx + 0x10]
cdq
movsx rcx, bp
mov qword [r14 + rbx + 0x20], rsi
movsx rcx, r15w
xchg edx, ecx
jmp 0x1403f50cb
mov rcx, r15
mov rdx, r9
movzx r8w, bl
mov r8, rsi
jmp 0x1403f50de
call fcn.1404a26e1
mov byte [r15 + rsi], 0
mov rsi, qword [r12 + rbx + 0x40]
cmp qword [r12 + rbx + 0x48], 0x10
jmp 0x1403f50f8
jb 0x1403f510d
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403f5108
jmp 0x1403f511e
lea r9, [r12 + rbx]
btr r15w, 0x7d
dec r15b
add r9, 0x30
lea r15, [r14 + rbx]
cmc
shr eax, 0x4b
bt rax, 0x2c
add r15, 0x30
inc al
mov rax, qword [r14 + rbx + 0x48]
jmp 0x1403f513c
cmp rax, rsi
jb 0x1403f4fe4
cmp rax, 0x10
jmp 0x1403f514e
jb 0x1403f5160
mov r15, qword [r14 + rbx + 0x30]
cdq
cqo
movsx r8, r14w
mov qword [r14 + rbx + 0x40], rsi
movsx r8, cx
movsxd rdx, r15d
mov dx, 0x5833
mov rcx, r15
mov rdx, r9
movzx r8, bx
movzx r8w, bpl
mov r8, rsi
jmp 0x1403f5187
call fcn.1404a26e1
mov byte [r15 + rsi], 0
jmp 0x1403f5196
jmp 0x1403f4ffe
lea r14, [r14 + rbx]
and r15b, 0xa1
mov rax, r14
ror di, 0x67
add bh, 0xbb
add rsp, 0x28
movsxd r12, r13d
pop rbx
movzx r14w, r13b
setno r14b
pop rdi
movzx r15d, r14w
pop rsi
movzx r14w, dl
movsx r12, sp
pop r12
xchg r15b, r15b
movsx r15, si
pop r14
jmp 0x1403f51dd
pop r15
jmp 0x1403f51e4
ret
Function at 0x1403fd320
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
test r10w, 0x116e
test r8, r8
jmp 0x1403fd332
je 0x1403fd3a5
movzx r9d, word [r8]
test r9w, r9w
je 0x1403fd3ef
sub eax, eax
clc
rol r10b, 0xb9
mov r10, rcx
test r10d, edx
nop dword [rax + rax]
cmp rdx, rax
jmp 0x1403fd363
je 0x1403fd580
mov word [r10], r9w
not r9d
ror r9b, 0x39
add r10, 2
movzx r9d, word [r8 + rax*2 + 2]
jmp 0x1403fd383
inc rax
test bpl, sil
test r9w, r9w
jmp 0x1403fd392
jne 0x1403fd35b
sub rdx, rax
jmp 0x1403fd3a0
jmp 0x1403fd3f8
movzx r9d, word [0x1400b8f10]
cmp r11, r15
test ch, 0xc4
test r9w, r9w
jmp 0x1403fd3bc
je 0x1403fd40b
cmp rdx, 0x104
movsx r8, r14w
jmp 0x1403fd3d6
mov r8d, 0x104
jmp 0x1403fd3e1
cmovb r8, rdx
jmp 0x1403fd3ea
jmp 0x1403fd516
mov r10, rcx
cmp r13b, bl
test r9b, dl
test rdx, rdx
jmp 0x1403fd400
jne 0x1403fd580
jmp 0x1403fd58d
mov rax, qword gs:[0x30]
shrd r11, rdi, 6
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
ror r9b, cl
and r10b, cl
inc r11b
cmp r8, rdx
movsxd r11, r15d
cmovae r8, rdx
and r9b, bpl
clc
mov r9, qword [rax + 0x60]
ror r11b, 0xba
bsr r11w, si
movzx r11d, word [r9]
xchg r10d, r10d
lea r10, [0x1400b8f10]
cmp dh, 0x6d
cmp r12b, dl
test r11w, r11w
je 0x1403fd4c6
sub eax, eax
stc
nop word cs:[rax + rax]
test r13w, 0x78ae
clc
cmp r8, rax
je 0x1403fd4d4
mov word [r10], r11w
sub r11b, 0x32
cmc
movsx r11d, di
add r10, 2
not r11b
movsx r11, r14w
movsx r11w, spl
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1403fd4b5
inc rax
test r11w, r11w
jne 0x1403fd484
sub r8, rax
cmc
test r8, r8
jmp 0x1403fd4ce
je 0x1403fd4da
mov word [r10], 0
movzx r9d, word [0x1400b8f10]
bsr r10, r9
cmp rdx, 0x104
mov r8d, 0x104
xchg r10w, r10w
cmovb r8, rdx
mov r10, rcx
jmp 0x1403fd507
test r9w, r9w
jmp 0x1403fd510
je 0x1403fd572
xor edx, edx
lea rax, [0x1400b8f10]
shl r10b, 0x79
or r10b, 0x5c
mov r10, rcx
cmc
nop dword [rax + rax]
cmp r8, rdx
je 0x1403fd580
mov word [r10], r9w
add r10, 2
movzx r9, sp
mov r9b, dl
movzx r9d, word [rax + rdx*2 + 2]
jmp 0x1403fd556
inc rdx
clc
test r9w, r9w
jmp 0x1403fd563
jne 0x1403fd533
sub r8, rdx
jmp 0x1403fd572
test r8, r8
jmp 0x1403fd57a
je 0x1403fd58d
mov word [r10], 0
cbw
cwde
movzx dx, cl
movabs rax, 0xe039ec0d24fefd13
movzx dx, dil
jmp 0x1403fd5a4
mov qword [rsp], rax
mov dl, r11b
movsxd rdx, ebp
movabs rax, 0x2247bce40ef3a5e6
mov qword [rsp + 8], rax
cdq
movabs rdx, 0xe05dec612491fd3d
jmp 0x1403fd5cd
mov qword [rsp + 0x10], rdx
jmp 0x1403fd5d7
mov qword [rsp + 0x18], rax
cmovle eax, esp
lea rax, [rsp + 0x10]
jmp 0x1403fd5e9
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
cmc
nop word cs:[rax + rax]
clc
cmp word [rcx + 2], 0
jmp 0x1403fd615
lea rcx, [rcx + 2]
jmp 0x1403fd61e
jne 0x1403fd60b
test ax, ax
jmp 0x1403fd62c
je 0x1403fd67f
lea rdx, [rsp + 2]
clc
cmp ah, 0xc5
nop word cs:[rax + rax]
test r11b, r10b
cmp r13, r15
mov word [rcx], ax
ror ax, cl
test r14, rsi
add rcx, 2
shr ax, cl
bsr ax, sp
movzx eax, word [rdx]
jmp 0x1403fd66c
add rdx, 2
clc
test ax, ax
jmp 0x1403fd679
jne 0x1403fd64c
mov word [rcx], 0
jmp 0x1403fd68c
add rsp, 0x28
jmp 0x1403fd695
ret
Function at 0x14042af85
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
dec r15b
bswap r15w
sub r15b, r10b
push r14
rol r14w, 0xae
push r12
push rsi
push rdi
test ch, 0xba
push rbp
rcr r14, 1
ror r15, 0x7d
xadd r15, r15
push rbx
sub rsp, 0x20
sal bh, cl
adc r15b, 0x59
xor bp, 0x2883
mov r12, r8
movsxd rbx, r10d
xor bl, 0x1e
mov edi, edx
movsx r15w, sil
bts ebp, edi
mov rbx, rcx
adc bp, 0x4496
bts r14w, r14w
btc bp, 0x8e
lea r14, [rcx + 0x38]
stc
shr bpl, 0x6a
lea r15, [rcx + 0x39]
add bpl, sil
movsx bp, r9b
btr bp, di
mov ebp, 0x80
jmp 0x14042b004
xor esi, esi
jmp 0x14042b00b
jmp 0x14042b053
lea rcx, [rax + 1]
jmp 0x14042b019
mov qword [rbx + 0xc0], rcx
jmp 0x14042b025
movzx eax, byte [rax]
jmp 0x14042b02d
mov byte [r12 + rsi], al
jmp 0x14042b036
inc rsi
stc
shr ebp, 1
jmp 0x14042b049
cmp rsi, 4
je 0x14042b1b7
test ebp, edi
je 0x14042b036
cmp qword [rbx + 0x10], 0
jmp 0x14042b065
je 0x14042b093
mov rcx, qword [rbx + 0x28]
jmp 0x14042b074
call qword [rbx + 0x20]
test eax, eax
jmp 0x14042b07e
je 0x14042b125
cmp dword [rbx + 0x30], 0
jmp 0x14042b08d
je 0x14042b1ae
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
cmp r10b, 0xdc
test r13, r11
cmp rax, rcx
jae 0x14042b1ae
cmp rax, rcx
jb 0x14042b010
cmp dword [rbx + 0x30], 0
je 0x14042b155
mov r8d, dword [rbx + 0x34]
mov dx, r11w
setl cl
cwd
mov rcx, qword [rbx + 0x28]
mov rdx, r14
jmp 0x14042b0dd
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
jmp 0x14042b0eb
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
cmc
clc
test eax, eax
jmp 0x14042b100
je 0x14042b161
movsxd rcx, eax
add al, dil
shl al, cl
add rcx, r14
cwde
bswap ax
not eax
movzx eax, byte [r14]
jmp 0x14042b120
jmp 0x14042b191
mov rax, qword [rbx + 0xc0]
movsxd rcx, r8d
btr rcx, r9
mov rcx, qword [rbx + 0xc8]
clc
cmp spl, 0xd8
test eax, r11d
cmp rax, rcx
jmp 0x14042b14a
jae 0x14042b0ba
jmp 0x14042b010
sub eax, eax
jmp 0x14042b15c
jmp 0x14042b02d
mov dword [rbx + 0x30], 0
shr rcx, cl
or cl, spl
mov byte [rbx + 0x38], 0
or cx, 0x1b62
xadd cx, cx
cmp r10w, 0x68b3
xor eax, eax
seto cl
cmovno rcx, rsp
movzx ecx, r12w
mov rcx, r15
mov qword [rbx + 0xc8], rcx
jmp 0x14042b19d
mov qword [rbx + 0xc0], r15
jmp 0x14042b1a9
jmp 0x14042b02d
xor r12d, r12d
rcl rdi, cl
xor r14, r13
mov rax, r12
bt bp, r14w
add rsp, 0x20
movsx edi, bx
pop rbx
bswap r12w
setg dil
movsx ebp, bx
pop rbp
jmp 0x14042b1d8
pop rdi
jmp 0x14042b1e2
pop rsi
xchg r14b, r14b
movsxd r14, r13d
not r12b
pop r12
mov r15w, 0x263d
movsx r14, ax
pop r14
movzx r15w, bl
setae r15b
pop r15
jmp 0x14042b209
ret
Function at 0x14043e16a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rcl ax, cl
movsx ax, sil
push r14
xor ah, 0x92
add ax, 0x69a2
cmp r15b, 0x4e
push rsi
push rdi
cdqe
sal ah, 0x58
bsf esi, eax
push rbp
sbb rax, rsi
push rbx
sub rsp, 0x78
movsx ax, dh
movaps xmmword [rsp + 0x60], xmm8
cwde
cbw
mov rax, 0x6c060b28
movaps xmmword [rsp + 0x50], xmm7
setl al
xchg al, sil
cmovp ax, sp
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [rcx]
mov esi, dword [rax + 0x10]
jmp 0x14043e1c7
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
stc
test esi, esi
jmp 0x14043e1e4
jle 0x14043e3e3
movaps xmm7, xmm2
setae r15b
movaps xmm8, xmm1
cmovg r15w, cx
mov r15d, 0x1dc3597c
mov r15, rcx
jmp 0x14043e208
xorps xmm6, xmm6
xor edi, edi
movsxd r8, r11d
mov r14b, 0x84
cqo
lea r14, [rsp + 0x28]
cqo
movzx r8w, sil
mov cl, 0xe1
nop word cs:[rax + rax]
bswap cx
cwd
mov rcx, r14
cqo
mov rdx, r15
bswap r8w
movsxd r8, ebp
mov r8d, edi
jmp 0x14043e24c
call fcn.14043de68
mov ebx, dword [rsp + 0x3c]
cmc
cmp r11, rcx
test ebx, ebx
jmp 0x14043e260
jle 0x14043e3e3
test edi, edi
jne 0x14043e286
movss xmm0, dword [rsp + 0x34]
jmp 0x14043e279
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043e3d7
movss xmm0, dword [rsp + 0x38]
jmp 0x14043e291
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14043e2b8
add edi, ebx
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x14043e2ad
jl 0x14043e235
jmp 0x14043e3e3
movss xmm6, dword [rsp + 0x28]
jmp 0x14043e2c3
ucomiss xmm6, xmm8
jbe 0x14043e2d4
mov esi, edi
jmp 0x14043e3e3
movss xmm0, dword [rsp + 0x2c]
jmp 0x14043e2df
ucomiss xmm0, xmm8
jbe 0x14043e35d
xor ebp, ebp
movsx r8d, r10w
mov esi, edi
movzx rdx, cx
movaps xmm7, xmm6
cmovo ecx, r15d
movsx r8d, ax
nop word cs:[rax + rax]
mov rcx, r15
movzx edx, r8w
cdq
mov edx, edi
seta r8b
movsx r8d, r10w
mov r8d, ebp
jmp 0x14043e326
call fcn.14043e67c
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x14043e43c
inc ebp
jmp 0x14043e340
inc esi
stc
cmp ax, 0x4217
jmp 0x14043e34c
movaps xmm6, xmm7
clc
cmp ebx, ebp
jmp 0x14043e357
jne 0x14043e30c
test byte [r15 + 0x1c], 4
jmp 0x14043e367
jne 0x14043e3c2
lea esi, [rbx + rdi]
not al
movzx ax, r11b
dec esi
movzx ax, r9b
rcr rcx, 0x69
mov rax, qword [r15]
xor cl, r11b
rol ch, cl
movsxd rcx, esi
test dl, 0x7a
cmp qword [rax + 0x10], rcx
jmp 0x14043e399
jbe 0x14043e45e
cmp qword [rax + 0x18], 8
jmp 0x14043e3a9
jb 0x14043e3b2
mov rax, qword [rax]
cmp word [rax + rcx*2], 0xa
jmp 0x14043e3bc
je 0x14043e3e3
add ebx, edi
movzx esi, cx
cmovo esi, r14d
mov esi, ebx
jmp 0x14043e3d2
jmp 0x14043e3e3
sub esi, esi
bts r14d, edx
rcr dil, cl
cmp r12d, ebx
mov eax, esi
sal sil, 0x56
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
add r14, 0x605347f8
or r15w, r11w
rol r15w, 0x77
add rsp, 0x78
not sil
bswap esi
jmp 0x14043e417
pop rbx
pop rbp
pop rdi
movzx r14w, r15b
xchg r14b, r15b
pop rsi
mov r14d, 0x2b527121
xchg r15w, r14w
movsx r14w, r13b
pop r14
pop r15
jmp 0x14043e43b
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x14043e3e3
inc esi
jmp 0x14043e459
jmp 0x14043e3e3
call fcn.14043e824
int3
Function at 0x140443365
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044336e
movzx ecx, cx
jmp 0x140443376
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp r14d, 0x17d4088a
cmp eax, 0x100
setae al
cmp rax, 0x2f140da5
add rsp, 0x28
jmp 0x14044339e
ret

Function at 0x140444af9
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movsxd rax, r9d
lahf
mov rcx, qword [rcx]
movzx eax, cx
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jmp 0x140444b14
je 0x140444b3e
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9d, 0x2a
stc
clc
add rsp, 0x28
jmp 0x140444b39
jmp fcn.1403ae879
nop
add rsp, 0x28
jmp 0x140444b48
ret
Function at 0x1404454f2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
movsx r14w, r12b
push rsi
push rdi
rol r14b, cl
adc r14w, 0x2ff8
not r14w
push rbx
sub rsp, 0x58
mov ax, 0x2efb
xchg r14b, al
movsx ax, r10b
mov rax, r9
movzx r9d, r14w
mov r14, rdx
movzx r9, sp
movzx r9d, r15w
mov r9d, dword [rsp + 0xa0]
jmp 0x140445538
movd xmm0, r8d
shr r8, 0x20
movd xmm1, r8d
mov qword [rdx], 0
cvttss2si r8d, xmm1
test r8d, r8d
jmp 0x14044555a
jle 0x140445685
cvttss2si r10d, xmm0
xor r11d, r11d
test r14b, 0xe8
stc
movss xmm2, dword [0x1400bf4c0]
sub ebx, ebx
jmp 0x14044557c
jmp 0x140445599
inc ebx
cmc
add r11d, r9d
cmp sil, dl
stc
cmp ebx, r8d
jmp 0x140445593
je 0x140445685
mov rsi, r10
mov edx, r11d
test r10d, r10d
jmp 0x1404455a7
jg 0x140445644
jmp 0x140445581
movzx edi, dil
jmp 0x1404455bb
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
jmp 0x1404455cf
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
jmp 0x1404455ed
movzx edi, byte [rax + rdx + 1]
jmp 0x1404455f7
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
mov di, 0x2068
bswap edi
movsx edi, r9w
movzx edi, byte [rax + rdx + 2]
jmp 0x14044561f
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
add edx, 4
jmp 0x14044563b
dec rsi
je 0x140445581
mov edx, edx
bsr edi, ebx
shld rdi, rbx, 0x21
rcl di, 0xa0
movzx edi, byte [rax + rdx + 3]
cmp edi, 0xff
je 0x140445633
test edi, edi
jmp 0x14044566a
jne 0x1404455b2
mov byte [rax + rdx + 2], 0
jmp 0x14044567a
mov word [rax + rdx], 0
jmp 0x140445633
mov rcx, qword [rcx + 0x18]
setl dh
movzx edx, bp
movzx rdx, r13w
movabs rdx, 0x10000001c
jmp 0x1404456a2
mov qword [rsp + 0x38], rdx
movsd xmm2, qword [0x1400bfee0]
movsd qword [rsp + 0x40], xmm2
jmp 0x1404456ba
mov dword [rsp + 0x48], 0
jmp 0x1404456c7
mov qword [rsp + 0x50], 0
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
xor r8w, r11w
adc rdi, 0x3dbb3f63
mov edx, edx
or rdx, rbx
cmovnp edi, edx
sets bh
mov rbx, qword [rcx]
movzx r8, r9w
movsx r8, r8w
bswap di
mov qword [rsp + 0x28], r14
movzx di, dl
lea rdi, [rsp + 0x38]
jmp 0x14044571a
mov qword [rsp + 0x20], rdi
mov r8, rax
jmp 0x140445727
call qword [rbx + 0x1c8]
test eax, eax
je 0x14044575f
mov ecx, eax
xchg dl, dl
movabs r8, 0xad4a5352d2edebd0
bswap r9w
mov dl, 3
movsxd r9, r9d
mov r9b, 0xa5
mov r9d, 0xd4
jmp 0x14044575a
call fcn.1403ae879
mov rax, r14
add rsp, 0x58
pop rbx
movsxd r14, edx
not r14b
xchg dil, r14b
pop rdi
xchg rsi, rsi
jmp 0x14044577d
pop rsi
cmovno r14d, ecx
pop r14
jmp 0x140445789
ret
Function at 0x140445c5e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
not r14
bt r14, 0x2c
cmove r14w, cx
push rsi
ror r14, cl
movzx r14w, r14b
push rdi
inc ah
sub sil, 0x9f
push rbp
movsx rsi, r12w
sbb bpl, 0xb4
shr ebp, cl
push rbx
sar bh, cl
stc
sar bp, 0x9e
sub rsp, 0x60
cdqe
movaps xmmword [rsp + 0x50], xmm6
not sil
cbw
mov r14, r9
cwde
mov rbx, r8
cbw
mov rdi, rdx
movzx rax, bx
setno bpl
mov rsi, rcx
not bpl
cdq
mov rdx, r9
movss xmm6, dword [rsp + 0xb0]
movzx ebp, byte [rsp + 0xb8]
cmovb rax, rcx
mov qword [rsp + 0x38], 0
cwd
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
jmp 0x140445cea
lea rdx, [rsp + 0x38]
jmp 0x140445cf4
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
movzx rax, r12w
mov rcx, qword [rsp + 0x38]
movsxd rax, r12d
mov rax, qword [rcx]
cdq
bswap dx
movzx rdx, bx
lea rdx, [rsp + 0x30]
jmp 0x140445d21
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
cdq
movzx edx, r13w
mov rdx, qword [rdi]
mov r8b, r15b
setg ah
mov rax, qword [rcx]
setg r8b
movsx r8, r14w
bswap r8d
mov r8d, 1
jmp 0x140445d53
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
cdq
movsx edx, bp
rdtsc
mov rax, qword [rcx]
mov r8w, 0x1cf1
cwd
cmove edx, ebx
mov rdx, rdi
bswap r8d
cmovg r8w, r9w
movsx r8d, cx
mov r8d, ebx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
rdtsc
bswap dx
cdq
movzx edx, bpl
bswap ax
movsx eax, r14w
mov rax, qword [rcx]
jmp 0x140445da1
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
movzx ax, r13b
cwde
cdqe
mov rax, qword [rcx]
jmp 0x140445db9
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
mov dl, 0x3f
movups xmm0, xmmword [r14]
cwde
cwd
cmovs eax, edi
movaps xmmword [rsp + 0x40], xmm0
cdqe
mov rax, qword [rcx]
movzx edx, r13w
movzx rdx, ax
lea rdx, [rsp + 0x40]
jmp 0x140445de8
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
movsxd r8, ebp
xchg dx, dx
mov r8, qword [rsi + 0x20]
cwd
lahf
mov rdx, qword [rsp + 0x38]
cwde
movsx rax, r8w
mov al, r15b
mov rax, qword [rcx]
jmp 0x140445e11
mov qword [rsp + 0x20], 0
jmp 0x140445e1f
movaps xmm3, xmm6
jmp 0x140445e27
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
movsx ax, r15b
mov rax, qword [rcx]
jmp 0x140445e3f
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
cmovbe eax, ebp
movzx ax, r9b
cbw
mov rax, qword [rcx]
jmp 0x140445e59
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
or bpl, 0x78
jmp 0x140445e6a
add rsp, 0x60
movzx bp, r8b
pop rbx
jmp 0x140445e80
pop rbp
movsx rsi, ax
movzx r14w, r12b
pop rdi
mov sil, 0x44
movzx rsi, r9w
pop rsi
pop r14
jmp 0x140445e9a
ret
Function at 0x1404479fe
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
btc eax, r13d
add ax, 0x2e1e
mov eax, 0x5a4d
cmp word [0x140000000], ax
jmp 0x140447a1e
jne 0x140447b2c
movsxd rcx, dword [0x14000003c]
neg dh
movzx rdx, r15w
lea rdx, [0x140000000]
test r14d, eax
lea rcx, [rcx + rdx]
test r11, rdx
jmp 0x140447a47
cmp dword [rcx], 0x4550
jne 0x140447b2c
mov eax, 0x20b
test bpl, r8b
cmp word [rcx + 0x18], ax
jmp 0x140447a64
jne 0x140447b2c
sub r8, rdx
btr rax, 0xe2
mov rdx, 0x4a155f4d
rcr dh, 0xc9
movzx edx, word [rcx + 0x14]
add rdx, 0x18
jmp 0x140447a89
lea rdx, [rdx + rcx]
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp spl, r11b
cmp bpl, 0xa4
test r13w, 0x2808
mov qword [rsp], rdx
cmp r12w, r11w
cmp rdx, r9
jmp 0x140447ab6
je 0x140447aed
mov ecx, dword [rdx + 0xc]
test r12b, r8b
cmp r8, rcx
jb 0x140447adf
mov eax, dword [rdx + 8]
clc
add eax, ecx
cmp r8, rax
jmp 0x140447ad9
jb 0x140447af0
add rdx, 0x28
jmp 0x140447ae8
jmp 0x140447aa6
xor edx, edx
clc
test rdx, rdx
jmp 0x140447af8
jne 0x140447b05
xor al, al
jmp 0x140447b42
cmp dword [rdx + 0x24], 0
jmp 0x140447b0e
jge 0x140447b20
sub al, al
jmp 0x140447b1b
jmp 0x140447b42
mov al, 1
jmp 0x140447b27
jmp 0x140447b42
sub al, al
jmp 0x140447b33
jmp 0x140447b42
add rsp, 0x18
jmp 0x140447b4b
ret