joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403d1eea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
setg sil
push rdi
push rbx
movzx eax, bx
movsx ax, ch
sub rsp, 0x20
bsf esi, ecx
test bpl, 5
neg esi
mov rsi, rcx
xchg al, al
lea rax, [0x1400be340]
cmc
test r11d, r14d
cmp dil, dil
mov qword [rcx], rax
cmp spl, 0xda
mov rcx, qword [rcx + 0x90]
test bh, 0xe
test r13d, r13d
test rcx, rcx
je 0x1403d1f4d
mov rax, qword [rcx]
jmp 0x1403d1f3d
call qword [rax + 0x10]
mov qword [rsi + 0x90], 0
add ch, dh
mov rcx, qword [rsi + 0x88]
test si, r14w
test rcx, rcx
je 0x1403d1f77
mov rax, qword [rcx]
jmp 0x1403d1f69
call qword [rax + 0x10]
mov qword [rsi + 0x88], 0
mov rcx, qword [rsi + 0x80]
stc
cmp r13b, dl
test rcx, rcx
jmp 0x1403d1f8a
je 0x1403d1fa6
mov rax, qword [rcx]
jmp 0x1403d1f98
call qword [rax + 0x10]
mov qword [rsi + 0x80], 0
lea rax, [0x1400bdb70]
bts bx, bp
xor di, r8w
mov qword [rsi], rax
btr bx, si
movzx edi, ax
mov rdi, qword [rsi + 0x40]
btc ebx, ebp
rcl bl, 0xb8
mov rbx, rbx
mov rbx, qword [rsi + 0x48]
cmp rdi, rbx
jmp 0x1403d1fd8
jne 0x1403d1ffb
jmp 0x1403d203f
add rdi, 8
jmp 0x1403d1fed
cmp rdi, rbx
jmp 0x1403d1ff5
je 0x1403d2029
mov rcx, qword [rdi]
jmp 0x1403d2003
test rcx, rcx
je 0x1403d1fe3
mov rax, qword [rcx]
cdq
movsx dx, bh
mov edx, 1
jmp 0x1403d201e
call qword [rax + 0xb8]
jmp 0x1403d1fe3
mov rdi, qword [rsi + 0x40]
clc
test esp, r11d
cmp rdi, qword [rsi + 0x48]
je 0x1403d203f
mov qword [rsi + 0x48], rdi
test rdi, rdi
jmp 0x1403d2047
je 0x1403d20e0
mov rdx, qword [rsi + 0x50]
cmc
cmp edx, 0x3fb562f4
sub rdx, rdi
clc
jmp 0x1403d2064
cmp rdx, 0x1000
jmp 0x1403d2070
jb 0x1403d20aa
mov rax, qword [rdi - 8]
cmp r11b, r13b
test r15, r11
add rdi, 0xfffffffffffffff8
cmp r12w, 0x133e
cmc
cmp dh, bh
sub rdi, rax
cmp rdi, 0x20
jmp 0x1403d2099
jae 0x1403d2100
add rdx, 0x27
movsx edi, r8w
mov rdi, rax
add rsi, 0x40
movzx rcx, ax
movsxd rcx, r9d
mov rcx, rdi
jmp 0x1403d20bd
call fcn.140232287
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
sar edi, 0x9d
add di, 0x1264
bsr di, r9w
mov qword [rsi + 0x10], 0
bswap di
add rsp, 0x20
jmp 0x1403d20ef
pop rbx
cmovp rdi, r15
movzx rsi, sp
pop rdi
pop rsi
jmp 0x1403d20ff
ret
call fcn.1404b549a
int3
Function at 0x1403db7ed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
mov r15b, 0x66
movsxd r15, esi
push r14
cmc
push r13
clc
push r12
push rsi
movsxd r15, ecx
rcl r13w, cl
push rdi
sal r12w, cl
push rbp
push rbx
sub rsp, 0x38
rcl ebx, cl
movzx r12, di
movaps xmmword [rsp + 0x20], xmm6
mov r14, r9
sub rbx, rsi
dec r13b
mov r15, r8
mov r12, rdx
ror bh, cl
test bpl, 0xf9
mov r13, rcx
btc ebx, edx
bswap bx
movzx ebx, r10w
mov rbx, qword [rcx]
cmp r13b, 0x2e
stc
test rbx, rbx
jmp 0x1403db84d
je 0x1403db99f
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403db85f
je 0x1403db946
lea rsi, [0x1400beb30]
jmp 0x1403db871
xorps xmm6, xmm6
jmp 0x1403db8b0
lea rbp, [rbx + 0x18]
jmp 0x1403db882
call fcn.140232287
movups xmmword [rbp], xmm6
test r11b, r12b
test r14w, 0x4f0c
mov qword [rbp + 0x10], 0
stc
cmc
add rbx, 0x30
cmp rbx, rdi
jmp 0x1403db8aa
je 0x1403db937
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x18]
cmp r11, 0x37e62017
test rcx, rcx
jmp 0x1403db8c6
je 0x1403db89e
mov rdx, qword [rbx + 0x28]
cmp dl, r8b
sub rdx, rcx
test dil, cl
stc
cmp rdx, 0x1000
jmp 0x1403db8e6
jb 0x1403db879
mov rax, qword [rcx - 8]
test esp, 0x50955d01
add rcx, 0xfffffffffffffff8
test r9b, 0xae
stc
test r8, r13
sub rcx, rax
cmp dl, r12b
cmp rcx, 0x20
jmp 0x1403db911
jae 0x1403dba37
add rdx, 0x27
bswap cx
mov rcx, 0x17a60a1e
movsx cx, r15b
mov rcx, rax
jmp 0x1403db932
jmp 0x1403db879
mov rbx, qword [r13]
xor dx, r10w
movzx edx, cx
and dx, r9w
mov rdx, qword [r13 + 0x10]
stc
sub rdx, rbx
cmp r12b, 0x6c
cmc
cmp spl, r12b
cmp rdx, 0x1000
jmp 0x1403db962
jb 0x1403db992
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403db97c
jae 0x1403dba37
add rdx, 0x27
mov ebx, r8d
cmovle cx, dx
not cl
mov rbx, rax
mov rcx, rbx
jmp 0x1403db99a
call fcn.140232287
mov qword [r13], r12
dec ax
mov bl, r11b
rcr ebp, cl
lea rax, [r15 + r15*2]
xchg ebp, ebx
shl rax, 4
add rax, r12
or r15d, 0x34553bb3
ror bpl, 0xbd
mov qword [r13 + 8], rax
lea rax, [r14 + r14*2]
ror edi, cl
add di, dx
bt r15w, 0xbf
shl rax, 4
add rax, r12
mov qword [r13 + 0x10], rax
btr r14d, r11d
movzx esi, r9w
rcl bp, cl
movaps xmm6, xmmword [rsp + 0x20]
and r12w, r8w
movsx r13d, r13w
add rsp, 0x38
pop rbx
pop rbp
jmp 0x1403dba04
pop rdi
movsxd rsi, r14d
mov r12b, 0x86
movzx r12d, di
pop rsi
mov r13b, 0xed
movzx r14d, bp
pop r12
mov r13, 0x19f2342d
pop r13
mov r14b, r10b
movzx r15, r13w
pop r14
movzx r15d, r10w
pop r15
jmp 0x1403dba36
ret
call fcn.1404b549a
int3
Function at 0x1403dfbdc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bts r10w, sp
sar r10w, 0x54
push rdi
push rbx
mov r9, rcx
adc r10, r11
sar r10w, cl
clc
add r8, rdx
mov dword [rcx + 8], 0
test r11b, r8b
shld r10, rcx, 0x12
sub r10w, r11w
xor eax, eax
ror r10b, cl
btc r10w, 0xe6
sub ecx, ecx
sar r10b, cl
nop word cs:[rax + rax]
lea r10, [rdx + 1]
cmp r10, r8
jmp 0x1403dfc32
ja 0x1403dfeb9
movzx edi, byte [rdx]
dec rdx
clc
mov edx, edi
cmp dil, spl
and edx, 0x7f
cmc
test r14b, cl
shl rdx, cl
cmp r13w, 0x6122
stc
lea rax, [rax + rdx]
sbb dh, ah
add rcx, 7
mov rdx, r10
cmp r15, 0x66620260
test dil, dil
jmp 0x1403dfc71
js 0x1403dfc26
mov rcx, rax
jmp 0x1403dfc87
and rcx, 0xfffffffffffffff8
cmc
cmp al, dil
and eax, 7
test r14d, ebp
cmp rcx, 8
jmp 0x1403dfc9e
je 0x1403dfdef
cmp rax, 1
jmp 0x1403dfcad
jg 0x1403dfcd3
test rax, rax
jmp 0x1403dfcbb
je 0x1403dfd94
cmp eax, 1
jne 0x1403dfeb9
lea rdx, [r10 + 8]
jmp 0x1403dfde3
cmp eax, 5
jmp 0x1403dfcdb
je 0x1403dfdda
cmp eax, 2
jmp 0x1403dfce9
jne 0x1403dfeb9
mov rsi, r10
bts rax, r13
sub edi, edi
movzx ax, ch
movsx eax, r14w
cbw
sub ecx, ecx
neg eax
nop word cs:[rax + rax]
lea rax, [rsi + 1]
jmp 0x1403dfd21
cmp rax, r8
ja 0x1403dfeb9
mov r11, rdi
movzx ebx, byte [rsi]
mov rdx, 0x6b205117
mov edx, ebx
sbb sil, 0x76
mov sil, r13b
and edx, 0x7f
shl rdx, cl
and esi, 0x788529bf
add rdi, rdx
add rcx, 7
mov rsi, rax
stc
test di, 0x163d
test bl, bl
jmp 0x1403dfd63
js 0x1403dfd11
lea rdx, [rdx + r11]
stc
test di, r14w
jmp 0x1403dfd77
add rdx, rax
test sil, 0xea
cmp rdx, r8
jmp 0x1403dfd86
cmova rdx, rax
jmp 0x1403dfd8f
jmp 0x1403dfc0a
mov rax, r10
bsr dx, si
neg edx
stc
nop
sub dl, 0x74
movsx edx, r15w
sub rdx, r8
lea rdx, [rax + 1]
cmc
cmp r11d, r11d
stc
cmp rdx, r8
jmp 0x1403dfdbb
ja 0x1403dfeb9
cmp byte [rax], 0
setae al
mov rax, rdx
jmp 0x1403dfdcf
js 0x1403dfdaa
jmp 0x1403dfc0a
lea rdx, [r10 + 4]
clc
test spl, 0xab
cmp rdx, r8
cmova rdx, r10
jmp 0x1403dfc0a
cmp eax, 2
jne 0x1403dfeb9
mov dword [r9 + 8], 2
sar esi, 0xc4
bsr edx, ecx
mov rsi, r10
shrd edx, edi, 0x5d
sal dx, cl
jmp 0x1403dfe15
xor eax, eax
rcl dh, cl
sub ecx, ecx
nop word [rax + rax]
shrd dx, di, 0x32
lea rdx, [rsi + 1]
cmp bpl, 0xfc
cmp di, r12w
test di, r9w
cmp rdx, r8
jmp 0x1403dfe3e
ja 0x1403dfeb9
movzx r11d, byte [rsi]
and sil, 0xa6
rcl sil, 0x6d
clc
mov edi, r11d
movzx si, r12b
test bpl, 0x61
not si
and edi, 0x7f
shl rdi, cl
movsx si, spl
bts si, ax
add rax, rdi
xor sil, 0x5e
bswap esi
rol si, 0x85
add rcx, 7
mov rsi, rdx
stc
cmp ax, 0x517c
test r11b, r11b
jmp 0x1403dfe90
js 0x1403dfe26
mov qword [r9 + 0x10], rdx
stc
clc
mov qword [r9 + 0x18], rax
cmp r11d, edi
cmc
lea rdx, [rdx + rax]
test rax, r12
cmp rdx, r8
jmp 0x1403dfeb3
jbe 0x1403dfc0a
cmp r10, r8
mov bx, 0x1532
seta al
movzx bx, al
movzx esi, bp
pop rbx
movsx rsi, r15w
pop rdi
pop rsi
jmp 0x1403dfed6
ret
Function at 0x1403f1377
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
btc r14w, 0xf2
push rdi
push rbx
movsx rax, r8w
sub rsp, 0x28
btr r14, 0xad
stc
mov rbx, rdx
stc
shl si, 0x1a
sub sil, r12b
mov r14, rcx
lea rsi, [rdx + r8]
sar ax, 0xb6
mov eax, dword [rcx + 8]
test bp, bx
clc
cmp bl, r9b
test al, 2
jne 0x1403f1479
mov dil, 1
test al, 4
je 0x1403f15c7
lea rax, [rbx + 1]
test esi, ecx
test sil, 0x25
cmp rax, rsi
jmp 0x1403f13d5
ja 0x1403f15c5
mov byte [rbx], 0x12
shr ecx, 0x9b
shrd cx, ax, 0x49
mov rcx, qword [r14 + 0x40]
test cx, si
cmp di, 0x42fa
clc
cmp rcx, 0x80
jmp 0x1403f13ff
jb 0x1403f157c
nop word cs:[rax + rax]
sal dl, cl
ror dh, cl
rcr dh, cl
lea rdx, [rax + 1]
test r14w, r11w
cmp rdx, rsi
jmp 0x1403f1425
ja 0x1403f15c5
mov ebx, ecx
or bl, 0x80
test di, 0x69c9
cmc
mov byte [rax], bl
rcl ah, cl
mov rbx, rcx
rcr eax, cl
add ah, 0x12
shr rbx, 7
sub al, r13b
movzx ax, ch
shrd rax, r9, 0x1c
mov rax, rdx
cmp r10b, 0x1e
clc
cmp rcx, 0x3fff
movsxd rcx, esp
xchg cl, cl
mov rcx, rbx
jmp 0x1403f146e
ja 0x1403f1415
jmp 0x1403f158e
test r8, r8
jmp 0x1403f1481
jle 0x1403f15c5
mov byte [rbx], 0xa
movzx cx, ah
inc rbx
mov rcx, qword [r14 + 0x20]
cmp rcx, 0x80
jmp 0x1403f14a1
jb 0x1403f1506
nop dword [rax + rax]
and al, r10b
sar ah, cl
lea rax, [rbx + 1]
cmc
cmp rax, rsi
ja 0x1403f15c5
mov edx, ecx
cmp cl, r8b
or dl, 0x80
mov byte [rbx], dl
mov rdx, rcx
sal bh, cl
shl bx, cl
shr rdx, 7
shrd ebx, r15d, 0x40
mov rbx, rax
clc
test ch, bh
cmp dil, 0x63
cmp rcx, 0x3fff
movsx rcx, cx
movzx ecx, bx
setge cl
mov rcx, rdx
ja 0x1403f14b4
jmp 0x1403f1520
mov rax, rbx
movsx dx, bpl
ror dl, 0xe7
mov rdx, rcx
movsxd rcx, ebx
xadd cx, cx
bts cx, r11w
lea rcx, [rax + 1]
cmc
jmp 0x1403f152a
cmp rcx, rsi
jmp 0x1403f1532
ja 0x1403f15c5
mov byte [rax], dl
stc
bt rbx, 0x5f
sal r8b, 0x63
mov r8, qword [r14 + 0x20]
clc
sar ebx, 0xe1
lea rbx, [rcx + r8]
cmp rbx, rsi
jmp 0x1403f1558
ja 0x1403f15c5
cmp qword [r14 + 0x28], 0x10
jmp 0x1403f1568
jb 0x1403f15f8
mov rdx, qword [r14 + 0x10]
jmp 0x1403f1577
jmp 0x1403f15fc
mov rdx, rax
dec bh
xor bl, r11b
rol ebx, cl
mov rbx, rcx
test di, 0x3e1e
lea rcx, [rdx + 1]
test sil, 0xe9
cmp r11d, r9d
stc
cmp rcx, rsi
jmp 0x1403f15a2
ja 0x1403f15c5
mov byte [rdx], bl
shr r8w, 0xbb
mov r8, qword [r14 + 0x40]
lea rax, [rcx + r8]
cmp rax, rsi
jmp 0x1403f15bf
jbe 0x1403f160f
sub edi, edi
mov eax, edi
bswap r14d
movzx edi, r14w
test r13w, 0x7d58
add rsp, 0x28
pop rbx
movsxd rsi, esi
movzx rdi, cx
movzx si, r12b
pop rdi
pop rsi
movsx r14w, r15b
movzx r14d, r15w
movsxd r14, ecx
pop r14
ret
lea rdx, [r14 + 0x10]
call fcn.1404a29dd
mov eax, dword [r14 + 8]
jmp 0x1403f160a
jmp 0x1403f13b8
cmp qword [r14 + 0x48], 0x10
jmp 0x1403f1619
jb 0x1403f162d
mov r14, qword [r14 + 0x30]
jmp 0x1403f1628
jmp 0x1403f1638
add r14, 0x30
sets dl
movsx edx, r14w
mov rdx, r14
jmp 0x1403f1640
call fcn.1404a29dd
jmp 0x1403f15c7
Function at 0x14042af5a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bt esi, r13d
push rdi
btc si, 0xe4
sbb dil, 0x7a
xchg rdi, rsi
sub rsp, 0x28
rcl dil, cl
not dil
mov rsi, rcx
cmc
or dil, cl
btr di, r15w
movzx edi, dx
bt dx, 0x25
cmp r13w, r10w
movzx edx, word [rcx + rdi*4 + 0x834]
cmp r8b, 0x5a
cmc
clc
test dx, dx
jmp 0x14042afa4
js 0x14042afb7
mov rcx, rsi
jmp 0x14042afb2
call fcn.14042af5a
movsxd rcx, dword [rsi + 0x8860]
cmp ecx, dword [rsi + 0x8858]
jmp 0x14042afc9
jge 0x14042b16c
movsxd rax, dword [rsi + 0x885c]
xor r8b, 0x60
add rax, rcx
bswap r8d
or dl, r11b
shr dh, 0x80
mov r8, qword [rsi + 8]
sal dl, cl
lea edx, [rax + 3]
btr ecx, 0x6e
bsr rcx, r9
adc cx, 0x2f4f
test eax, eax
not cl
cmovns edx, eax
xchg ecx, ecx
mov rcx, qword [rsi + 0x18]
test r13b, r8b
stc
jmp 0x14042b012
sar edx, 2
jmp 0x14042b01a
movsxd rdx, edx
cmp dil, 0x24
jmp 0x14042b026
mov byte [rcx + rdx], 1
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp byte [rdx + rdi*4 + 3], 0x81
jb 0x14042b091
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
rol cx, cl
movzx ecx, byte [rdx + rdi*4 + 1]
cmp esp, r13d
stc
mov byte [r8 + rax + 1], cl
movzx ecx, byte [rdx + rdi*4]
test r13w, r15w
jmp 0x14042b06f
mov byte [r8 + rax + 2], cl
sub ecx, r11d
btr rcx, rcx
jmp 0x14042b080
movzx ecx, byte [rdx + rdi*4 + 3]
mov byte [r8 + rax + 3], cl
xchg al, al
shr al, cl
sar ah, 0xee
mov eax, dword [rsi + 0x885c]
cmc
add eax, 4
mov dword [rsi + 0x885c], eax
test bx, r11w
jmp 0x14042b0aa
cmp eax, dword [rsi + 0x8854]
jmp 0x14042b0b5
jl 0x14042b16c
mov ecx, dword [rsi + 0x884c]
cmp r13d, 0x7007e51
or ax, di
cbw
mov eax, dword [rsi + 0x8858]
test spl, 0x8d
cmp bx, bx
cmp r10b, 0xe2
mov dword [rsi + 0x885c], ecx
adc ch, 0x58
mov ecx, dword [rsi + 0x8860]
test sp, r14w
stc
clc
add ecx, dword [rsi + 0x8844]
stc
mov dword [rsi + 0x8860], ecx
stc
clc
cmp ecx, eax
jl 0x14042b16c
mov ecx, dword [rsi + 0x8840]
cmc
clc
nop dword [rax]
test ecx, ecx
jle 0x14042b16c
mov edx, dword [rsi + 0x8864]
jmp 0x14042b12d
shl edx, cl
clc
mov dword [rsi + 0x8844], edx
sar edx, 1
cmp r9, 0x64164cdc
add edx, dword [rsi + 0x8850]
jmp 0x14042b14a
mov dword [rsi + 0x8860], edx
jmp 0x14042b155
dec ecx
stc
mov dword [rsi + 0x8840], ecx
cmc
cmp edx, eax
jmp 0x14042b166
jge 0x14042b119
add rsp, 0x28
movzx esi, bp
xchg di, si
mov si, r12w
pop rdi
movsx esi, cx
pop rsi
ret
Function at 0x140443550
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140443559
movzx ecx, cx
jmp 0x140443561
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
mov al, r11b
setae al
cmp r10w, 0x35f2
add rsp, 0x28
jmp 0x140443584
ret

Function at 0x140444cce
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
bswap ax
cdqe
mov rcx, qword [rcx]
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jmp 0x140444ce7
je 0x140444d20
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
movsxd r9, r9d
xor r9, r15
mov dl, 3
movzx r9w, r12b
mov r9d, 0x2a
stc
jmp 0x140444d12
add rsp, 0x28
jmp 0x140444d1b
jmp fcn.1403af394
nop
jmp 0x140444d26
add rsp, 0x28
jmp 0x140444d2f
ret

Function at 0x140444de1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sar si, cl
push rdi
mov al, r13b
push rbp
and si, bx
cdqe
test r12w, 0x4067
push rbx
rcl al, cl
sbb ah, 0x79
rcr bh, cl
sub rsp, 0x48
sar sil, 0xfc
clc
mov rax, r9
movsx bx, r13b
xchg r9d, esi
mov rsi, rdx
shr r9w, cl
mov rdx, rcx
shr ecx, cl
mov ebx, dword [rsp + 0xa0]
btc cx, 0x4d
mov qword [rsp + 0x40], 0
sub cl, dl
bt r9w, sp
mov rcx, qword [0x1400b9300]
bt r9w, r9w
and r9b, r13b
bsr r9w, r12w
movss xmm0, dword [r8]
movzx r9w, r8b
rcr r9, 0x1d
movss xmm1, dword [r8 + 4]
btc r9, 0x14
or r9b, r11b
mov r9, qword [rdx]
cmp r15b, r10b
jmp 0x140444e74
cmp ebx, 0xffffffff
jmp 0x140444e7c
je 0x140444e8a
mov r8d, ebx
jmp 0x140444ec0
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
bswap r8w
lea r8, [rdx + 1]
test dil, 0x60
cmp word [rax + rdx*2 + 2], 0
movzx edx, r11w
cqo
mov rdx, r8
jmp 0x140444eba
jne 0x140444e9e
mov ebp, dword [rsp + 0x98]
xchg bh, bh
cdq
movzx rdx, r15w
mov ebx, dword [rsp + 0x90]
movsx dx, al
mov rdi, qword [rcx]
movsx dx, r12b
lea rdx, [rsp + 0x40]
jmp 0x140444eeb
mov qword [rsp + 0x30], rdx
bswap dx
movzx edx, r11w
cwd
movss dword [rsp + 0x28], xmm1
mov dl, sil
movss dword [rsp + 0x20], xmm0
mov rdx, rax
jmp 0x140444f10
call qword [rdi + 0x90]
test eax, eax
je 0x140444f48
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
movzx r9w, bpl
mov dl, 3
jmp 0x140444f3d
mov r9d, 0x41
call fcn.1403af394
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
cmovnp rdx, r11
cqo
mov edx, ebx
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
cdqe
mov rax, qword [rcx]
mov edx, ebp
jmp 0x140444f6c
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
or rbp, rcx
shr bp, cl
xor rbp, 0x3168225b
mov qword [rsi], rax
movsxd rax, r14d
cdqe
btc rbx, 0xfb
mov rax, rsi
movzx si, r13b
add rsp, 0x48
not dil
movsx rbx, ax
xchg rsi, rbx
pop rbx
not dil
bswap si
pop rbp
not sil
bswap rsi
pop rdi
mov esi, 0x306f2ca9
movsx esi, ax
pop rsi
jmp 0x140444fc1
ret
Function at 0x140445782
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
test spl, 0xdd
xchg al, ah
push rsi
adc eax, esp
adc r14b, 6
push rdi
test dil, 0x30
push rbx
bsr eax, ecx
sub rsp, 0x58
movsx r14, bx
cmovs r14w, r8w
cwde
mov rax, r9
mov r14, rdx
not r9b
movsx r9, sp
mov r9d, dword [rsp + 0xa0]
movd xmm0, r8d
shr r8, 0x20
jmp 0x1404457cb
movd xmm1, r8d
mov qword [rdx], 0
cvttss2si r8d, xmm1
test r8d, r8d
jmp 0x1404457e4
jle 0x140445925
cvttss2si r10d, xmm0
sub r11d, r11d
cmp r13w, 0x18cb
movss xmm2, dword [0x1400bf4c0]
test r14b, 0xfb
xor ebx, ebx
jmp 0x14044580b
jmp 0x14044582f
inc ebx
test rdx, 0x754f042b
add r11d, r9d
stc
cmp r13b, 0x2b
jmp 0x140445826
cmp ebx, r8d
je 0x140445925
mov rsi, r10
mov edx, r11d
cmp spl, 0xd6
test r10d, r10d
jmp 0x140445841
jg 0x1404458d6
jmp 0x140445810
movzx edi, dil
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
jmp 0x140445864
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
movsx edi, cx
movzx edi, byte [rax + rdx + 1]
jmp 0x140445884
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
movsx rdi, ax
jmp 0x1404458a1
movzx edi, byte [rax + rdx + 2]
jmp 0x1404458ab
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
clc
jmp 0x1404458c5
add edx, 4
jmp 0x1404458cd
dec rsi
je 0x140445810
mov edx, edx
sbb dil, 0x37
bts di, r12w
xchg edi, edi
movzx edi, byte [rax + rdx + 3]
cmc
jmp 0x1404458f2
cmp edi, 0xff
jmp 0x1404458fd
je 0x1404458c5
test edi, edi
jmp 0x14044590a
jne 0x14044584c
mov byte [rax + rdx + 2], 0
jmp 0x14044591a
mov word [rax + rdx], 0
jmp 0x1404458c5
mov rcx, qword [rcx + 0x18]
setl dl
not dl
movsx dx, cl
movabs rdx, 0x10000001c
mov qword [rsp + 0x38], rdx
movsd xmm2, qword [0x1400bfee0]
jmp 0x14044594e
movsd qword [rsp + 0x40], xmm2
jmp 0x140445959
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
rcr r8d, cl
stc
mov edx, edx
cmp r15b, 0x7b
mov r8, 0x7dcb7a80
or rdx, rbx
mov rbx, qword [rcx]
mov dil, sil
mov qword [rsp + 0x28], r14
lea rdi, [rsp + 0x38]
jmp 0x1404459a1
mov qword [rsp + 0x20], rdi
bswap r8w
mov r8, rax
jmp 0x1404459b2
call qword [rbx + 0x1c8]
test eax, eax
jmp 0x1404459bf
je 0x1404459f4
mov ecx, eax
xchg r8w, r9w
jmp 0x1404459d0
movabs r8, 0xad4a5352d2edebd0
movsx r9w, sil
mov dl, 3
xchg r9, r9
movsx r9w, spl
mov r9d, 0xd4
call fcn.1403af394
mov rax, r14
sar dil, 0x54
mov dil, dil
xor esi, ebx
add rsp, 0x58
bswap di
sets sil
mov dil, 0xe9
pop rbx
bswap di
setl dil
pop rdi
mov r14d, r13d
not r14w
pop rsi
xchg r14b, r14b
bswap r14w
pop r14
ret
Function at 0x140447c57
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
xor ax, 0x670b
mov r8, rcx
mov eax, 0x5a4d
jmp 0x140447c6c
cmp word [0x140000000], ax
jne 0x140447d99
movsxd rcx, dword [0x14000003c]
shr dx, 0x80
lea rdx, [0x140000000]
cmp eax, 0x912299c
cmp r13b, dil
add rcx, rdx
clc
cmp dword [rcx], 0x4550
jmp 0x140447ca2
jne 0x140447d99
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x140447cb6
jne 0x140447d99
sub r8, rdx
movzx edx, word [rcx + 0x14]
cmp r8d, 0x11870496
add rdx, 0x18
sal ax, 0x48
cmc
add ax, 0x660c
add rdx, rcx
btr ax, 0x7c
bt r9, rbx
cmc
movzx eax, word [rcx + 6]
sar cx, cl
sal r9b, 0x92
mov ch, bl
lea rcx, [rax + rax*4]
shr r9b, cl
bts r9d, r15d
lea r9, [rdx + rcx*8]
cmc
test dl, sil
cmp r11b, 0xee
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x140447d14
je 0x140447d51
mov ecx, dword [rdx + 0xc]
stc
cmp r8, rcx
jmp 0x140447d26
jb 0x140447d43
mov eax, dword [rdx + 8]
test rbp, rbx
jmp 0x140447d38
add eax, ecx
cmp r8, rax
jb 0x140447d58
add rdx, 0x28
jmp 0x140447d4c
jmp 0x140447d08
xor edx, edx
test spl, 9
cmc
test rdx, rdx
jmp 0x140447d60
jne 0x140447d72
xor al, al
jmp 0x140447d6d
jmp 0x140447da7
cmp dword [rdx + 0x24], 0
jmp 0x140447d7b
jge 0x140447d8d
xor al, al
jmp 0x140447d88
jmp 0x140447da7
mov al, 1
jmp 0x140447d94
jmp 0x140447da7
xor al, al
jmp 0x140447da0
jmp 0x140447da7
add rsp, 0x18
jmp 0x140447db0
ret
Function at 0x1404595a4
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
mov cl, r14b
lea rcx, [rsp + 0x30]
jmp 0x1404595b5
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
stc
add rsp, 0x28
jmp 0x1404595ca
ret

Function at 0x140459686
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
movsx bx, sil
clc
dec ah
push rbp
sar ax, cl
and bx, dx
lahf
mov rbp, rsp
cmp ax, 0x59f9
sub rsp, 0x20
movsx ebx, di
cmovle bx, bx
shl al, 0x83
mov rax, qword [0x1400b7288]
movsxd rbx, r13d
movabs rbx, 0x2b992ddfa232
stc
cmp rax, rbx
jne 0x140459798
and qword [rbp + 0x18], 0
lea rcx, [rbp + 0x18]
jmp 0x1404596dc
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x1404596eb
mov qword [rbp + 0x10], rax
jmp 0x1404596f4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
cmc
xor qword [rbp + 0x10], rax
jmp 0x140459706
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
bts rcx, rbx
lea rcx, [rbp + 0x20]
stc
xor qword [rbp + 0x10], rax
jmp 0x140459720
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
bswap rcx
lea rcx, [rbp + 0x10]
cmc
clc
shl rax, 0x20
cmp r12b, dl
test di, 0x51f1
xor rax, qword [rbp + 0x20]
clc
jmp 0x140459748
xor rax, qword [rbp + 0x10]
xor rax, rcx
rcr ch, 0x56
cmp r10b, bpl
bt ebp, 0x4d
movabs rcx, 0xffffffffffff
and rax, rcx
movabs rcx, 0x2b992ddfa233
bsr ebp, r10d
cmp spl, dl
cmp rax, rbx
mov bpl, r11b
jmp 0x140459782
cmove rax, rcx
mov qword [0x1400b7288], rax
rcr bh, 0x51
bts ebp, r14d
shr bx, 0xc9
mov rbx, qword [rsp + 0x48]
ror bpl, 0x8a
not rax
or bpl, r14b
mov qword [0x1400b7280], rax
sub bpl, 0x16
bt bp, 0x37
add rsp, 0x20
cmovo rbp, r11
mov bp, sp
movzx ebp, ax
pop rbp
jmp 0x1404597cb
ret

Function at 0x14045984f
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
test r15w, r10w
sub ecx, ecx
jmp 0x14045985e
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x14045986c
je 0x1404598dd
mov ecx, 0x5a4d
cmp r12b, 0x78
cmp word [rax], cx
jne 0x1404598dd
movsxd rcx, dword [rax + 0x3c]
cmp si, si
lea rcx, [rcx + rax]
test bl, r15b
stc
cmp dword [rcx], 0x4550
jne 0x1404598dd
mov eax, 0x20b
test spl, 0xe4
jmp 0x1404598ad
cmp word [rcx + 0x18], ax
jne 0x1404598dd
cmp dword [rcx + 0x84], 0xe
jmp 0x1404598c3
jbe 0x1404598dd
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1404598d8
jmp 0x1404598e6
xor al, al
test esp, r14d
clc
cmp sil, r8b
add rsp, 0x28
ret