joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14045c6df
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
not ch
lea rcx, [rsp + 0x30]
jmp 0x14045c6ef
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmp dl, r8b
test rdx, rbp
add rsp, 0x28
ret

Function at 0x14045c7d9
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
and ax, 0x5f80
movzx ebx, sp
xchg bl, bh
push rbp
or bp, 0x5a85
mov rbp, rsp
cdqe
xchg bh, bh
inc ah
sub rsp, 0x20
xor bx, r12w
mov rax, qword [0x1400b7288]
movabs rbx, 0x2b992ddfa232
cmc
cmp ah, 0xc
cmp rax, rbx
jmp 0x14045c81b
jne 0x14045c8f1
and qword [rbp + 0x18], 0
lea rcx, [rbp + 0x18]
jmp 0x14045c82f
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
jmp 0x14045c842
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
clc
test rsp, 0x5bf80501
stc
xor qword [rbp + 0x10], rax
jmp 0x14045c85c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x14045c871
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
and cx, r12w
movsx rcx, r11w
shl ch, 0x1c
lea rcx, [rbp + 0x10]
test r8d, 0x5ee40d1b
stc
shl rax, 0x20
cmc
test sil, bl
jmp 0x14045c89e
xor rax, qword [rbp + 0x20]
test r10b, 0x1b
stc
cmp r9w, r14w
xor rax, qword [rbp + 0x10]
xor rax, rcx
sar ch, cl
cmp dl, r15b
movabs rcx, 0xffffffffffff
movzx ebp, di
and rax, rcx
sub cl, 0xa7
cmovge cx, sp
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
cmove rax, rcx
add bpl, r12b
xchg bpl, bpl
mov qword [0x1400b7288], rax
jmp 0x14045c8f1
mov rbx, qword [rsp + 0x48]
rcl rbp, cl
not rax
cmp ax, cx
adc ebp, 0x5a242331
movsxd rbp, esp
mov qword [0x1400b7280], rax
test bpl, r8b
sub bpl, 0x53
xadd bpl, bpl
add rsp, 0x20
movsxd rbp, ecx
jmp 0x14045c92a
pop rbp
jmp 0x14045c930
ret

Function at 0x14045c9b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
clc
test rdx, 0x73c43b66
sub ecx, ecx
jmp 0x14045c9c3
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x14045c9d1
je 0x14045ca38
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x14045c9e4
jne 0x14045ca38
movsxd rcx, dword [rax + 0x3c]
test r13w, r12w
add rcx, rax
cmp bpl, sil
cmc
cmp dword [rcx], 0x4550
jne 0x14045ca38
mov eax, 0x20b
clc
cmp word [rcx + 0x18], ax
jne 0x14045ca38
cmp dword [rcx + 0x84], 0xe
jbe 0x14045ca38
cmp dword [rcx + 0xf8], 0
not al
setne al
jmp 0x14045ca33
jmp 0x14045ca43
sub al, al
jmp 0x14045ca43
add rsp, 0x28
jmp 0x14045ca4c
ret
Function at 0x14046e391
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp si, di
cmp r14b, 0x4f
mov qword [rax + 8], rbx
test r10w, r13w
mov qword [rax + 0x10], rbp
shl bpl, cl
mov qword [rax + 0x18], rsi
setle bpl
or bpl, bpl
mov qword [rax + 0x20], rdi
test sil, al
sar esi, 0x4c
bswap si
push r14
shr bpl, cl
sub rsp, 0x20
and dil, 0xd3
mov rsi, qword [rsp + 0x50]
shr r14w, cl
bts rdi, r15
movzx r14d, r9w
mov rdi, r8
mov rbp, rdx
test rsi, rsi
jmp 0x14046e3ee
je 0x14046e4cd
mov rbx, qword [r8 + 8]
test rbx, rbx
jmp 0x14046e400
je 0x14046e4ac
mov rax, qword [rbx + 0x40]
cmp bpl, spl
clc
cmp qword [rax], 0
jmp 0x14046e417
je 0x14046e476
mov rax, qword [rbx + 0x58]
cmp r13d, 0x536c2b53
cmp dword [rax], 0
jmp 0x14046e430
jle 0x14046e476
dec dword [rax]
movsx ecx, dx
mov rcx, qword [rbx + 0x40]
cbw
mov rdx, qword [rcx]
xchg ah, ah
mov eax, 0x539a77d4
lea rax, [rdx + 2]
jmp 0x14046e454
mov qword [rcx], rax
sete ah
movsx rax, di
nop
movzx eax, r14w
jmp 0x14046e468
mov word [rdx], r14w
jmp 0x14046e471
jmp 0x14046e497
mov rax, qword [rbx]
mov cl, 0xfa
movzx edx, r14w
mov cl, 0xf6
movzx ecx, r8w
mov rcx, rbx
jmp 0x14046e48d
mov rax, qword [rax + 0x18]
call qword [0x1400b8d90]
mov ecx, 0xffff
stc
clc
cmp cx, ax
jmp 0x14046e4a6
jne 0x14046e4be
mov byte [rdi], 1
cmp r8w, 0xaf5
test ax, r8w
jmp 0x14046e4be
sub rsi, 1
jmp 0x14046e4c7
jne 0x14046e3f8
movups xmm0, xmmword [rdi]
sal bx, 0xdd
mov rbx, qword [rsp + 0x30]
cmp bpl, dil
cmc
sal eax, 0xa
mov rax, rbp
shrd si, ax, 0
cmovs r14w, r9w
bts r14w, r12w
mov rsi, qword [rsp + 0x40]
add dil, 0x43
shr di, 0xa0
mov rdi, qword [rsp + 0x48]
not r14b
xor r14w, 0x37e2
movdqu xmmword [rbp], xmm0
clc
sub r14b, dl
shrd r14d, edx, 0x15
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
jmp 0x14046e534
pop r14
jmp 0x14046e53b
ret
Function at 0x1404a295c
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
jmp 0x1404a296a
call fcn.1404acbd8
mov r9d, 2
setne ch
lea r8, [rsp + 0x30]
setle ch
not edx
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x1404a298f
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
jmp 0x1404a29a2
je 0x1404a29e9
sub ecx, 1
je 0x1404a29da
cmp ecx, 1
jmp 0x1404a29b9
je 0x1404a29cb
sub eax, eax
jmp 0x1404a29c6
jmp 0x1404a29fa
mov eax, 3
jmp 0x1404a29d5
jmp 0x1404a29fa
mov eax, 1
jmp 0x1404a29e4
jmp 0x1404a29fa
mov eax, 2
jmp 0x1404a29fa
add rsp, 0x28
jmp 0x1404a2a03
ret

Function at 0x1404a368d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
adc bl, al
push rsi
push rdi
setb bh
sub rsp, 0x40
movsx bx, r10b
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rsi, qword [rbx + 0xf8]
xor edi, edi
xor r8d, r8d
cwd
jmp 0x1404a36bb
lea rdx, [rsp + 0x60]
bswap rcx
movzx ecx, r14w
movzx cx, r8b
mov rcx, rsi
jmp 0x1404a36d4
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
jmp 0x1404a36e2
je 0x1404a3758
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x68]
sar edx, cl
adc dx, 0x3bd7
mov rdx, qword [rsp + 0x60]
clc
rcr r9w, cl
movzx r8d, dx
mov r9, rax
rcl r8b, cl
movsx r8w, r10b
mov qword [rsp + 0x30], rcx
xor cl, r11b
mov r8, rsi
bts cx, r9w
lea rcx, [rsp + 0x70]
test r9w, 0x6c3c
mov qword [rsp + 0x28], rcx
test r15b, cl
clc
xor ecx, ecx
jmp 0x1404a373e
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
inc edi
cmc
test r9b, sil
cmp edi, 2
jl 0x1404a36b1
add rsp, 0x40
movsx rbx, r8w
movsx di, spl
pop rdi
pop rsi
movzx bx, r8b
pop rbx
ret
Function at 0x1404a4599
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
add bl, r12b
shrd bx, dx, 0xd
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
test r12b, 0x85
sbb ebx, 0x6cc92bad
push rdi
sbb bpl, r8b
inc bh
and rbp, r11
push r12
push r13
bsr di, ax
bt bp, 0x95
push r14
inc bx
push r15
test r8w, r8w
sub rsp, 0x40
mov rbx, qword [rsp + 0x90]
mov r15b, r13b
mov r12, rdx
mov rbp, rcx
cqo
mov r15, r10
mov rdx, r9
cmovae r15, rcx
bswap r14
movsx r15w, bl
mov rcx, rbx
movzx di, spl
mov rdi, r9
mov r15, 0x56273706
mov r15d, r8d
movsx r14d, di
mov r14d, dword [rbx + 0xc]
jmp 0x1404a4626
call fcn.140124c7c
xor r10d, r10d
shr sil, 0x3b
sar si, 0x56
mov esi, eax
test eax, 0x6d225dbf
stc
test r14d, r14d
je 0x1404a487d
mov r11, qword [rdi + 8]
xor r9b, spl
cmp rbp, r13
or eax, 0xffffffff
movsxd rbx, dword [rbx + 0x10]
mov r9d, eax
rcr r8d, 0x4f
test spl, dil
rcr r13w, cl
mov r13d, eax
mov edx, r14d
lea r8d, [rdx - 1]
shl cl, 0x94
movzx rax, r11w
lea rcx, [r8 + r8*4]
bt rax, rsp
movsx ax, bpl
test r8d, 0x504b4cfb
lea rax, [r11 + rcx*4]
cmp r11b, 0x4b
cmp esi, dword [rax + rbx + 4]
jmp 0x1404a469c
jle 0x1404a46b1
cmp esi, dword [rax + rbx + 8]
jmp 0x1404a46ab
jle 0x1404a46ca
mov edx, r8d
cmp dx, dx
jmp 0x1404a46bc
test r8d, r8d
jmp 0x1404a46c4
jne 0x1404a466c
mov r8d, r10d
cmp r15b, cl
test edx, edx
jmp 0x1404a46d7
je 0x1404a46fe
lea eax, [rdx - 1]
bts dx, ax
mov dl, r12b
bsr edx, eax
lea rax, [rax + rax*4]
lea rdx, [rbx + rax*4]
clc
test bl, dil
add rdx, r11
jmp 0x1404a4709
mov rdx, r10
rcr cx, cl
btc rcx, 0xb
lea rcx, [r11 + rbx]
or r11d, 0xffffffff
stc
jmp 0x1404a4717
test rdx, rdx
jmp 0x1404a471f
je 0x1404a4752
mov eax, dword [rdx + 4]
cmp r11w, dx
test r9b, r15b
jmp 0x1404a4734
cmp dword [rcx], eax
jmp 0x1404a473b
jle 0x1404a478d
mov eax, dword [rdx + 8]
cmp dword [rcx + 4], eax
jmp 0x1404a474c
jg 0x1404a478d
cmp r15d, dword [rcx]
jmp 0x1404a475a
jl 0x1404a478d
cmp r15d, dword [rcx + 4]
jmp 0x1404a4769
jg 0x1404a478d
cmp r9d, r11d
movzx r13, r15w
mov eax, r8d
jmp 0x1404a4783
mov r13d, r8d
cmovne eax, r9d
mov r9d, eax
inc r8d
cmc
add rcx, 0x14
cmp r8d, r14d
jmp 0x1404a479d
jb 0x1404a4717
cmp r9d, r11d
sete bl
mov qword [rsp + 0x20], r12
movsxd r14, r13d
xchg r14w, ax
sete r14b
mov eax, r10d
mov qword [rsp + 0x30], r12
cmovne eax, r9d
movsx rsi, r14w
xchg bh, bl
lea r11, [rsp + 0x40]
xchg si, r14w
movsx r12w, dl
mov rbx, qword [r11 + 0x30]
mov sil, 0x5f
mov rsi, qword [r11 + 0x40]
movsxd rdi, edi
sets r14b
movsx r12, r12w
mov dword [rsp + 0x28], eax
lea eax, [r13 + 1]
cmovb r15, rdi
movzx r14, dx
movups xmm0, xmmword [rsp + 0x20]
cmovne r10d, eax
movzx r12d, si
bswap r13
cmovnp edi, esp
mov rax, rbp
mov dword [rsp + 0x38], r10d
movsx r13, ax
bswap r12d
movups xmm1, xmmword [rsp + 0x30]
not r13w
movzx r12d, r11w
movdqu xmmword [rbp], xmm0
mov r13, rbx
bswap r15w
not dil
movdqu xmmword [rbp + 0x10], xmm1
jmp 0x1404a484e
mov rbp, qword [r11 + 0x38]
movsx r13w, spl
mov rsp, r11
movsx r12, r12w
movsx r13w, r12b
pop r15
pop r14
xchg r12w, r13w
mov dil, dl
pop r13
movzx rdi, bx
pop r12
pop rdi
jmp 0x1404a487c
ret
call fcn.1404b9703
int3
Function at 0x1404af649
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
btr bx, sp
cmp r8d, 0x373f3434
cmc
mov qword [rsp + 0x18], rsi
push rdi
sar ax, 0xf5
sub rsp, 0x50
xor bl, 0x65
mov rax, qword [0x1400b7288]
sub bl, r13b
xor rax, rsp
and ebx, 0x23fc2f2b
rcr bh, cl
cmp rdx, r12
mov qword [rsp + 0x40], rax
cmp byte [rcx + 0x54], 0
mov rbx, rcx
je 0x1404af76a
cmp dword [rcx + 0x50], 0
jmp 0x1404af69e
jle 0x1404af76a
mov rsi, qword [rcx + 0x48]
test esi, 0x60dc130e
xor edi, edi
cqo
inc r9b
mov rax, qword [rbx + 8]
movsx edx, di
rcl r8b, cl
lea rdx, [rsp + 0x34]
movzx r9d, word [rsi]
movzx r8, r13w
movzx r8w, bpl
lea rcx, [rsp + 0x30]
sal r8w, cl
rol r8b, 0xf9
and dword [rsp + 0x30], 0
mov r8d, ebx
movsx r8w, r8b
lea rsi, [rsi + 2]
mov r8d, 6
jmp 0x1404af6fa
mov qword [rsp + 0x20], rax
jmp 0x1404af704
call fcn.1404d2cd0
test eax, eax
jmp 0x1404af710
jne 0x1404af75c
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x1404af75c
lea rax, [rbx + 0x10]
lea r9, [rbx + 0x28]
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
lea rdx, [rsp + 0x34]
jmp 0x1404af742
call fcn.1404ada9a
inc edi
cmp edi, dword [rbx + 0x50]
jmp 0x1404af751
jne 0x1404af6b5
jmp 0x1404af7af
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404af765
jmp 0x1404af7af
mov r8d, dword [rbx + 0x50]
cmp r12, 0x2f543895
not dh
xchg r9d, eax
lea rax, [rcx + 0x10]
rcr dh, 0xb1
btr r9w, 0xbd
mov rdx, qword [rbx + 0x48]
and r9b, r15b
test dh, 0xe2
lea r9, [rcx + 0x28]
cmc
test r11b, 0x13
add rcx, 0x468
jmp 0x1404af7a5
mov qword [rsp + 0x20], rax
call fcn.1404ada9a
mov al, 1
mov rcx, qword [rsp + 0x40]
test r11w, 0x5b08
test al, bpl
cmc
xor rcx, rsp
jmp 0x1404af7c8
call fcn.1404a2014
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
shl dil, 0x43
add rsp, 0x50
movzx rdi, bp
pop rdi
jmp 0x1404af7e9
ret
Function at 0x1404b1336
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
shr bl, cl
mov qword [rsp + 0x18], rbp
bt bx, r8w
mov qword [rsp + 0x20], rsi
sbb bx, 0x5d26
shr rbx, 0xf7
push rdi
xadd rbx, rbx
rcr rbx, 0x1a
sub rsp, 0x30
xor ebx, r11d
xor ebp, ebp
setae bl
shr rbx, 0x61
xor bh, 0x2f
mov rbx, rcx
jmp 0x1404b1379
cmp byte [rcx + 0x54], bpl
jmp 0x1404b1382
jne 0x1404b1489
cmp dword [rcx + 0x50], ebp
jmp 0x1404b1390
jle 0x1404b1489
mov rsi, qword [rcx + 0x48]
cwd
cdq
movsxd r8, ebx
mov edi, ebp
mov r9, qword [rbx + 8]
not r8b
setae cl
movsx eax, si
lea rcx, [rsp + 0x40]
cbw
mov eax, r8d
mov word [rsp + 0x40], bp
movzx r8d, r15w
cwde
mov rdx, rsi
movzx eax, bx
mov rax, qword [r9]
movsxd r8, dword [rax + 8]
jmp 0x1404b13d5
call fcn.1404d29e9
movsxd r8, eax
stc
test eax, eax
jmp 0x1404b13e5
jle 0x1404b147b
mov rcx, qword [rbx + 0x468]
movzx edx, word [rsp + 0x40]
not ax
mov rax, qword [rcx + 8]
cmp qword [rcx + 0x10], rax
jne 0x1404b142d
cmp byte [rcx + 0x18], bpl
jmp 0x1404b1411
je 0x1404b1424
inc dword [rbx + 0x28]
jmp 0x1404b141f
jmp 0x1404b1460
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b1460
inc dword [rbx + 0x28]
inc qword [rcx + 0x10]
sar eax, 0xf0
mov al, r10b
mov rax, qword [rbx + 0x468]
btr cx, dx
sbb cl, r11b
add cl, 0x80
mov rcx, qword [rax]
rol ah, cl
mov word [rcx], dx
mov rax, qword [rbx + 0x468]
stc
clc
add qword [rax], 2
add rsi, r8
inc edi
test sil, al
cmp edi, dword [rbx + 0x50]
jmp 0x1404b1470
jne 0x1404b13a2
jmp 0x1404b14c7
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b1484
jmp 0x1404b14c7
mov r8d, dword [rbx + 0x50]
lea rax, [rcx + 0x10]
shrd rdx, rsp, 0xbb
movzx edx, r10w
test ebx, r8d
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
test r13w, 0x962
clc
add rcx, 0x468
jmp 0x1404b14b8
mov qword [rsp + 0x20], rax
jmp 0x1404b14c2
call fcn.1404af7ea
mov rbx, qword [rsp + 0x48]
or bp, di
shld bp, sp, 0xb
test r15b, r9b
mov al, 1
sal bpl, cl
xchg si, si
and sil, 0x27
mov rbp, qword [rsp + 0x50]
test rbp, rdx
rcr esi, cl
shl sil, cl
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
mov edi, 0x181101b7
pop rdi
ret
Function at 0x1404b1da8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x1404b1ed8
mov qword [rsp + 8], rbx
cwde
mov qword [rsp + 0x10], rdi
cmp rdx, rax
and bl, 0x75
mov r10d, dword [r9]
lahf
rol rax, 0x68
bt ebx, 0x49
mov dil, dl
rol rdx, 0x48
mov rbx, rcx
xor al, bl
or dl, r15b
adc ax, 0x352c
sub r11d, r11d
shr dl, cl
test r10d, esi
bsf ax, bp
mov rdx, qword [rbx]
shrd rax, rbp, 0xd2
mov rax, qword [rdx + 8]
cmp qword [rdx + 0x10], rax
jne 0x1404b1e30
cmp byte [rdx + 0x18], 0
jmp 0x1404b1e0c
je 0x1404b1e1f
inc r10d
jmp 0x1404b1e1a
jmp 0x1404b1e23
or r10d, 0xffffffff
mov dword [r9], r10d
jmp 0x1404b1e2b
jmp 0x1404b1e97
lea eax, [r10 + 1]
movzx r10, r8w
movsxd r10, r8d
mov dword [r9], eax
not r10d
cbw
mov rax, qword [rbx]
jmp 0x1404b1e50
inc qword [rax + 0x10]
mov rax, qword [rbx]
mov r10b, cl
movsx r10w, bl
movzx r10d, r10w
mov rcx, qword [rax]
bswap r10
movzx eax, cx
not r10d
mov byte [rcx], dil
mov r10b, al
cdqe
mov rax, qword [rbx]
movsx r10w, r10b
inc qword [rax]
clc
movzx r10d, r14w
cmp r14w, 0x1cc5
mov r10d, dword [r9]
test r9d, 0x3de1112f
cmp r10d, 0xffffffff
jmp 0x1404b1ea0
je 0x1404b1ebd
inc r11d
stc
cmp spl, 0x53
cmc
cmp r11d, r8d
jmp 0x1404b1eb7
jl 0x1404b1ded
mov rbx, qword [rsp + 8]
movsx edi, dx
setns dil
cmovb di, r11w
mov rdi, qword [rsp + 0x10]
jmp 0x1404b1ed8
ret

Function at 0x1404b2ecd
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
and sil, 1
push rdi
ror rsi, cl
ror rsi, 0xe0
sub rsp, 0x30
mov si, r14w
mov edi, edx
ror sil, cl
mov rsi, rcx
cmc
jmp 0x1404b2ef9
test r8, r8
jne 0x1404b2f23
call fcn.1404b77d4
mov dword [rax], 0x16
jmp 0x1404b2f12
call fcn.1404b8499
sub eax, eax
jmp 0x1404b2f1e
jmp 0x1404b2ffe
mov rdx, r9
mov rcx, r8
call fcn.1404b3056
mov rbx, rax
stc
test rax, rax
je 0x1404b2fb1
lea rax, [rsp + 0x50]
movsx edx, r9w
jmp 0x1404b2f49
mov rdx, rdi
movsx rcx, sp
mov qword [rsp + 0x28], rax
lahf
mov al, r15b
not cx
lea r8, [0x140094b24]
cdqe
movzx ax, spl
mov eax, dword [rsp + 0x60]
movsxd r9, r11d
mov r9, rbx
mov rcx, rsi
jmp 0x1404b2f7c
mov dword [rsp + 0x20], eax
jmp 0x1404b2f85
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp rbx, rsi
test rax, rax
jmp 0x1404b2f99
jne 0x1404b301b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b2fac
call fcn.1404b7844
sub edi, edi
test rbx, rbx
jmp 0x1404b2fbb
je 0x1404b2ff4
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1404b2fd4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1404b2fe7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b2fef
call fcn.1404cb744
mov rax, rdi
cmp r8b, dl
shr si, 0xc9
mov rbx, qword [rsp + 0x40]
rol dil, 0x8f
mov rsi, qword [rsp + 0x48]
sal di, 0xf4
add rsp, 0x30
pop rdi
jmp 0x1404b301a
ret
mov rcx, qword [rsp + 0x68]
stc
cmc
test rcx, rcx
je 0x1404b303b
mov eax, dword [rsp + 0x50]
cmp esp, ebx
mov dword [rcx], eax
jmp 0x1404b303b
sub ebx, ebx
jmp 0x1404b2fb3
Function at 0x1404b32f8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, bp
cmovs bx, r13w
bswap rbx
mov ebx, ecx
jmp 0x1404b3310
call fcn.1404d4c84
cmp eax, 1
jmp 0x1404b331d
je 0x1404b336c
mov rax, qword gs:[0x60]
cmp cx, cx
shl edx, cl
and rdx, 0x661d11eb
mov edx, dword [rax + 0xbc]
shr edx, 8
stc
cmc
test dl, 1
jmp 0x1404b334b
jne 0x1404b336c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsx dx, spl
mov edx, ebx
jmp 0x1404b3366
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b3373
call fcn.1404b324c
mov ecx, ebx
jmp 0x1404b337f
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1404b43e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jmp 0x1404b43fb
jle 0x1404b44be
mov dword [rsp + 0x18], r8d
adc r8, r12
mov qword [rsp + 0x20], r9
rcr r8b, cl
clc
movzx r8, bx
push rbx
push rbp
bts r8, rsi
ror r8d, cl
push rsi
push rdi
movzx r8, bp
sub rsp, 0x38
shr esi, 0x40
adc r8b, al
movsx di, spl
lea rdi, [rsp + 0x78]
and sil, dl
dec rbp
xor ebx, ebx
xor si, r15w
cmp r9w, bx
add rdi, 0xfffffffffffffff8
movzx bp, r8b
jmp 0x1404b445b
mov rsi, rdx
mov rbp, rcx
movzx r8, r14w
not cl
movzx r8d, r13w
lea rdi, [rdi + 8]
mov rdx, rsi
cmovne r8, rsi
mov r8, qword [rdi]
movzx ecx, r15w
movsx cx, dil
mov rcx, rbp
call fcn.1404d6afa
test eax, eax
jne 0x1404b44bf
inc ebx
test bp, r8w
clc
cmp ebx, dword [rsp + 0x70]
jmp 0x1404b44a2
jl 0x1404b446b
add rsp, 0x38
xchg bx, bp
movsx esi, bx
pop rdi
bswap ebx
pop rsi
movsxd rbp, r8d
movsx ebx, cx
pop rbp
pop rbx
ret
and qword [rsp + 0x20], 0
test r11b, 0x9c
sub r9d, r9d
cmc
test ebx, 0x61fd579c
sub r8d, r8d
jmp 0x1404b44dc
xor edx, edx
cmp r11b, cl
test r10, rsi
sub ecx, ecx
jmp 0x1404b44eb
call fcn.1404b8533
int3
Function at 0x1404b8533
Capabilities:
Terminate process

Disassembly:
jmp [rsi]
push rbx
imul esp, dword [rdi + 0x23b7af03], 0x9aac8cb5
loopne 0x140177721
invalid
invalid
insb byte [rdi], dx
add byte [rax], al
add byte [rax], al
add byte [0x10b536549], ah
add byte [rax], al
add byte [0x10b536549], ah
add byte [rax - 0x14], al
in al, dx
sbb esi, dword [rcx + rax*8 - 0x4db2c6fd]
mov ch, 0x4e
repne movsb byte [rdi], byte [rsi]
sub edi, dword [rdx + 0x59]
pop rcx
pop rcx
movsd dword [rdi], dword [rsi]
jrcxz 0x140177702
jae 0x1401776ce
lodsb al, byte [rsi]
cld
invalid
int3
mov ch, 0xf9
out dx, al
in eax, 0x3b
mov bh, 0x68
lea esp, [rbx + 0x29adc4b6]
sbb al, 0x84
in al, dx
invalid
cmc
invalid
jmp 0x140177761
int1
adc ah, ah
jno 0x1401777b6
mov byte [rbx], dl
invalid
ret
fcomp qword [rdi + 0x19ffa88]
invalid
std
push rax
jg 0x1401777bf
add al, 0xa6
jmp 0x15e60725d
invalid
sub rsp, 0x28
movsx rcx, r9w
movzx cx, r11b
mov cl, 0x87
mov ecx, 0x17
jmp 0x1404b854c
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x1404b8559
je 0x1404b8570
mov ecx, 5
jmp 0x1404b8569
int 0x29
jmp 0x1404b8570
mov r8d, 1
mov ecx, r15d
xchg ch, cl
mov edx, 0xc0000417
movsx cx, sil
movzx cx, r10b
jmp 0x1404b858f
lea ecx, [r8 + 1]
jmp 0x1404b8598
call fcn.1404b85c3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
bsf rdx, rdx
mov edx, 0xc0000417
cmp r14d, esi
cmc
add rsp, 0x28
jmp switch.0x1404b85bc
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1404b995c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbx
or bl, r14b
movsx rbx, r14w
not bh
sub rsp, 0x20
sar bx, cl
btc bx, di
mov rbx, rcx
stc
test rcx, rcx
jmp 0x1404b997e
jne 0x1404b9998
add rsp, 0x20
bswap ebx
movzx ebx, si
pop rbx
jmp 0x1404b9993
jmp 0x1404b9b25
call fcn.1404b9a0b
test eax, eax
jmp 0x1404b99a4
jne 0x1404b99f3
mov eax, dword [rbx + 0x14]
cmp r8b, 0xb7
shr eax, 0xb
cmc
clc
cmp r11b, sil
test al, 1
jmp 0x1404b99c0
je 0x1404b99e7
mov rcx, rbx
jmp 0x1404b99ce
call fcn.1404d4c49
mov ecx, eax
call fcn.1404dd183
test eax, eax
jmp 0x1404b99e1
jne 0x1404b99f3
sub eax, eax
jmp 0x1404b99ee
jmp 0x1404b99f9
or eax, 0xffffffff
dec bx
add rsp, 0x20
bswap rbx
movzx rbx, si
pop rbx
jmp 0x1404b9a0a
ret
Function at 0x1404b9d89
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rsi
cmp r9w, 0x1da9
push rdi
adc si, si
xchg si, si
sal dil, cl
push r14
mov di, dx
add dil, 0x78
sub rsp, 0x60
movsx di, r13b
movsx rdi, bp
movsxd rsi, r12d
mov rsi, r9
cmovs edi, ecx
movzx edi, si
jmp 0x1404b9dcb
mov rdi, r8
mov ecx, dword [rdx]
call fcn.14025f224
nop
rol r14b, 0x83
xadd bl, al
mov rbx, qword [0x1400ba160]
shrd rax, rsi, 0xe
movsx eax, si
movsxd rax, dword [0x1400ba158]
xor r14, 0x347862bf
cmp spl, 0xd2
ror r14d, cl
lea r14, [rbx + rax*8]
stc
mov qword [rsp + 0x38], rbx
test r11b, 0xe6
jmp 0x1404b9e14
cmp rbx, r14
je 0x1404b9f32
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
neg edx
movzx rdx, cx
mov rdx, qword [rdi]
cmc
test rax, rax
jmp 0x1404b9e37
je 0x1404b9e97
mov ecx, dword [rax + 0x14]
shl ah, cl
mov eax, ecx
shr eax, 0xd
jmp 0x1404b9e55
test al, 1
jmp 0x1404b9e5c
je 0x1404b9e97
mov eax, ecx
clc
cmc
test r11, 0x635a4975
and al, 3
cmp al, 2
jmp 0x1404b9e76
jne 0x1404b9e85
test cl, 0xc0
jne 0x1404b9ea5
bt ecx, 0xb
jmp 0x1404b9e8e
jb 0x1404b9ea5
inc dword [rdx]
stc
add rbx, 8
jmp 0x1404b9ea0
jmp 0x1404b9e06
mov rdx, qword [rdi + 0x10]
movzx r8d, cx
cbw
mov rcx, qword [rdi + 8]
movsx ax, bpl
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
movsx r9, r14w
mov qword [rsp + 0x40], r8
bswap r8d
mov qword [rsp + 0x48], rax
movzx r8w, r11b
lahf
movsxd r9, ecx
mov qword [rsp + 0x50], rcx
movsx rax, dx
movsx r8w, r14b
cmovb rax, r12
mov qword [rsp + 0x58], rdx
rdtsc
movzx edx, si
lahf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x28]
setnp ch
mov r8, rbp
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x88]
jmp 0x1404b9f28
call fcn.1404b9c1f
jmp 0x1404b9e97
mov ecx, dword [rsi]
jmp 0x1404b9f39
call fcn.140230dcc
mov rbx, qword [rsp + 0x80]
add edi, 0x10584d23
movsxd r14, ecx
add rsp, 0x60
setns sil
jmp 0x1404b9f5f
pop r14
movsx esi, bx
not sil
movsxd rsi, r8d
pop rdi
movzx esi, ax
pop rsi
jmp 0x1404b9f74
ret
Function at 0x1404bb922
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
cmp r11b, 0xa8
neg rcx
stc
test rax, 7
je 0x1404bb962
nop
mov dl, byte [rax]
jmp 0x1404bb942
inc rax
test dl, 0x70
test dl, dl
jmp 0x1404bb94f
je 0x1404bba25
test al, 7
jmp 0x1404bb95c
jne 0x1404bb93b
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
stc
movsx dx, ch
mov rdx, qword [rax]
bswap r9w
add r9b, 0xbc
mov r9, r8
test rax, rsp
stc
add rax, 8
cmc
cmp r10w, ax
test bl, dil
add r9, rdx
stc
test r13b, 0xcd
not rdx
clc
cmp r10w, 0x52ed
xor rdx, r9
and rdx, r11
je 0x1404bb97b
mov rdx, qword [rax - 8]
cmc
test dl, dl
jmp 0x1404bb9c3
je 0x1404bba72
test dh, dh
jmp 0x1404bb9d0
je 0x1404bba67
shr rdx, 0x10
test dl, dl
jmp 0x1404bb9e1
je 0x1404bba5c
test dh, dh
jmp 0x1404bb9ee
je 0x1404bba51
shr rdx, 0x10
test dl, dl
je 0x1404bba46
test dh, dh
je 0x1404bba3b
shr edx, 0x10
jmp 0x1404bba10
test dl, dl
je 0x1404bba30
test dh, dh
jmp 0x1404bba1f
jne 0x1404bb97b
lea rax, [rax + rcx - 1]
jmp 0x1404bba2f
ret
lea rax, [rax + rcx - 2]
jmp 0x1404bba3a
ret
lea rax, [rax + rcx - 3]
jmp 0x1404bba45
ret
lea rax, [rax + rcx - 4]
jmp 0x1404bba50
ret
lea rax, [rax + rcx - 5]
jmp 0x1404bba5b
ret
lea rax, [rax + rcx - 6]
jmp 0x1404bba66
ret
lea rax, [rax + rcx - 7]
jmp 0x1404bba71
ret
lea rax, [rax + rcx - 8]
ret