joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002e50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002e7d
xor eax, eax
jmp 0x140002fe9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002eb7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002eb7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002fe9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002fdc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002efa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002f25
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002fe1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002f94
sub eax, 1
je 0x140002f94
cmp eax, 2
jne 0x140002fdc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002fe1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002fc2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002fdc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002fe1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003c80
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003180
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003253
cmp byte [rcx + 0x71], 0
je 0x140003253
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000324f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003214
sub eax, 1
je 0x140003218
cmp eax, 2
jne 0x14000324f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003c80
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003246
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000324f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400031fc
xor al, al
jmp 0x1400031fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003c80
add rsp, 0x60
pop rbx
ret

Function at 0x140004600
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000464a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000464a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000464a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000464a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000464a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000464c
xor al, al
add rsp, 0x28
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Authenticate hmac
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403b178a

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Get number of processors
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b3345

Function at 0x1400e0114
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec rcx
cmp al, 0x30
jne 0x14022695c
movzx eax, byte [rcx - 1]
jmp 0x1401ffed5
mov rax, qword [rdx]
bt edx, edx
clc
shrd dx, dx, 0x5a
mov rdx, qword [rax + 0xf8]
or r9b, r8b
mov rax, qword [rdx]
movzx r9d, byte [rax]
movzx ax, r15b
movzx eax, byte [rcx]
cmp r11b, r11b
test al, al
je 0x14012b57e
movzx edx, al
sbb al, r15b
movsxd rax, ecx
nop dword [rax + rax]
xor ax, dx
sal al, 0x99
btc rax, 0
movzx eax, dl
cmp dl, r9b
jmp 0x1402269b0
je 0x1401b04b1
movzx eax, byte [rcx]
clc
test al, al
jmp 0x140194c10
jne 0x1400e015d
inc rcx
cmp r10d, 0x46757057
test al, al
jmp 0x140122ec5
jne 0x140194c16
movzx eax, byte [rcx - 1]
movzx r8, r11w
movsx r8d, r11w
cmovns r8w, r8w
mov r8, rcx
jmp 0x1400e008d
je 0x14018f82b
sub al, 0x45
stc
cmp al, 0xd4
test al, 0xdf
jmp 0x14025e21c
jne 0x14022697c
ret
inc rcx
clc
cmc
test al, al
jmp 0x14018f825
dec rcx
test r11w, 0x6313
stc
clc
cmp al, 0x30
jmp 0x140226956
je 0x1400e0098
cmp al, r9b
lea rdx, [rcx - 1]
cdqe
cmovne rdx, rcx
shrd rax, r8, 0x75
nop dword [rax]
movzx rax, r10w
setns al
movzx eax, byte [r8]
lea rdx, [rdx + 1]
test rbx, 0x60a213db
test ecx, r13d
cmp bl, r8b
mov byte [rdx], al
lea r8, [r8 + 1]
cmp rax, 0x49463cd8
stc
test al, al
jmp 0x1401b04ab
je 0x14012b57e
movzx eax, byte [rcx + 1]
inc rcx
ror dh, 0xa4
stc
movzx edx, al
test al, al
jmp 0x14012b578
je 0x14018f82b
movzx eax, byte [rcx + 1]
jmp 0x1401b94da

Function at 0x1401083b8
Capabilities:
Encrypt data using speck
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14044a657
push rsi
lahf
push rdi
add al, 0xe6
btc rax, rax
sub rsp, 0x28
btr rsi, rbp
rcr ah, cl
movsx rax, r11w
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
xor edx, edx
jmp 0x14044a67f
xor r8d, r8d
jmp 0x14044a687
call qword [rax + 0x188]
mov edi, eax
not ch
bswap cx
lea rcx, [rsi + 0x30]
jmp 0x14044a69d
call fcn.14045e21d
test edi, edi
jmp 0x14044a6a9
je 0x14044a6dc
cmp edi, 0x8899000c
jmp 0x14044a6ba
jne 0x14044a6f8
mov rcx, rsi
add rsp, 0x28
pop rdi
movzx rsi, si
jmp 0x14044a6d1
pop rsi
jmp 0x14044a6d7
jmp fcn.14044a2f2
nop
sar di, 0x7b
cmovbe di, si
shr sil, cl
add rsp, 0x28
pop rdi
movzx rsi, r10w
pop rsi
jmp 0x14044a6f7
ret
mov ecx, edi
btr r8d, r12d
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
mov r9d, 0x54
adc di, 0x47de
add rsp, 0x28
movzx edi, sp
mov si, 0x503d
pop rdi
pop rsi
jmp 0x14044a727
jmp fcn.1403b396a
Function at 0x14019798f
Capabilities:
Encode data using xor

Disassembly:
jne 0x14024efa9
movzx eax, r8b
jmp 0x140193fea
inc rcx
test byte [rax + r8*2], 4
jmp 0x1401073e0
cmovne rdx, rcx
mov rcx, rdi
bsr ecx, r11d
mov rcx, qword [rax]
movsx ax, r14b
ror ax, 0x91
movzx eax, byte [rcx]
mov byte [rdx], al
xadd eax, ecx
mov al, r8b
btr cx, 0x20
lea rax, [rdx + 1]
test ebp, ecx
rcr dx, 0x32
nop dword [rax]
shl cx, 4
dec dx
xor dl, 0x4f
movzx ecx, byte [rax]
xor dh, 0x2f
dec dh
rol dh, cl
movzx edx, r8b
mov byte [rax], r8b
bts r8w, r15w
add r8b, 0x7a
lea rax, [rax + 1]
bts r8w, cx
rcr r8b, 0xa4
shld r8, r8, 0x54
movzx r8d, cl
test dl, dl
jne 0x14011ccd4
ret
cmp byte [rax + rdx], 0x78
jne 0x140194002
movzx r8d, byte [rcx + 2]
movzx ax, bl
movsx dx, sil
mov rax, qword [r9 + 0xf8]
movzx dx, dh
movsx rdx, r12w
lea rdx, [rcx + 2]
jmp 0x14011cc92
mov r9, qword [rdx]
xchg dh, dl
movzx r8d, byte [rcx]
shl dx, 0xae
rcr dh, 0xe6
sbb dl, r11b
mov rdx, qword [r9 + 0x110]
cmp byte [r8 + rdx], 0x65
jmp 0x14024ef98
je 0x1401073e6
mov rax, qword [r9]
nop dword [rax + rax]
movzx r8d, byte [rcx + 1]
jmp 0x1401134ae

Function at 0x1401bbef0
Capabilities:
Access peb ldr_data

Disassembly:
test ax, ax
jmp 0x14026a2ca
je 0x1401f47e6
sub edx, edx
lea r9, [0x1400b8f10]
cmp r14w, bx
cmp r8, rdx
jmp 0x1401bc85c
je 0x14014e327
mov word [r10], 0
cbw
mov r8b, r15b
adc al, 0xc7
movzx eax, word [0x1400b8f10]
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x14016980c
cmovb r8, rdx
cmc
cmp r8w, 0x2866
test ax, ax
jmp 0x140148728
je 0x14021c7a3
xor eax, eax
clc
cmp r9w, r11w
cmp r8w, 0x3c3e
nop word [rax + rax]
clc
cmp r8, rax
je 0x14014e31a
mov word [r10], r11w
xadd r11b, r11b
btc r11w, r15w
add r10, 2
movzx r11d, r9w
movzx r11d, word [r9 + rax*2 + 2]
inc rax
test bpl, r9b
test r11w, r11w
jmp 0x14021c79a
cmovb r8, rdx
jmp 0x14023a3a8
inc rdx
test ax, ax
jmp 0x1401f47dd
movzx eax, word [0x1400b8f10]
cmc
jmp 0x14010559b
je 0x1401c8742
mov word [rcx], ax
test sil, 0x12
sar al, cl
add rcx, 2
dec ax
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401bb21d
je 0x14025fddf
mov word [rcx], 0
jmp 0x14025fddf
jne 0x14014873b
sub r8, rdx
test r8, r8
jmp 0x1401c873c
jne 0x14018bd18
sub r8, rax
test r8, r8
jmp 0x14014e314
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movzx r11d, r9w
xchg r11, r9
shl r9d, 0xa
movzx r8d, word [rax + 0x58]
cmc
sub r11d, ebx
setne r10b
cmp r8, rdx
cmovae r8, rdx
mov r9, qword [rax + 0x60]
movzx r11d, word [r9]
sbb r10w, dx
rol r10b, 0x6e
lea r10, [0x1400b8f10]
cmc
test r11w, r11w
jmp 0x14018bcfe
jmp 0x14014872e
ret
je 0x140221372
cmp rdx, 0x104
bswap r8
mov r8d, 0x104
jmp 0x140192dac
Function at 0x1401c6558
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
movzx rdx, r10w
movsxd rdx, r10d
cdq
lea edx, [r8 + 2]
jmp 0x14028a6fe
jmp 0x1404b5232
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
ror bh, cl
mov dword [rsp + 0x10], edx
sal bx, cl
push rbp
mov rbp, rsp
rol bl, 0x45
sub rsp, 0x50
cmc
and bh, 0xba
or bx, r12w
mov ebx, ecx
test r11b, 0x29
cmp dil, dl
cmc
test r8d, r8d
jmp 0x1404b526a
jne 0x1404b5303
xor ecx, ecx
jmp 0x1404b5277
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b5285
je 0x1404b5303
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x1404b5298
jne 0x1404b5303
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
stc
cmc
cmp dl, r14b
cmp dword [rcx], 0x4550
jmp 0x1404b52b6
jne 0x1404b5303
mov eax, 0x20b
cmp sil, 0xdf
test r13b, 0x54
cmp word [rcx + 0x18], ax
jmp 0x1404b52d2
jne 0x1404b5303
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b52e4
jbe 0x1404b5303
cmp dword [rcx + 0xf8], 0
jmp 0x1404b52f6
je 0x1404b5303
mov ecx, ebx
call fcn.1404b510d
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
bswap rcx
mov qword [rbp - 0x20], rax
cmovle cx, bx
mov cl, 0x20
xchg r9d, edx
lea r9, [rbp - 0x2c]
movzx ax, spl
lea rax, [rbp + 0x20]
movsx r8w, dil
bswap cx
mov qword [rbp - 0x18], rax
movzx r8, r10w
mov r8b, spl
cwd
lea r8, [rbp - 0x20]
movzx ax, r9b
lea rax, [rbp + 0x28]
movsxd rdx, esi
cmovs edx, r13d
mov qword [rbp - 0x10], rax
cdqe
cdq
lea rdx, [rbp - 0x28]
xchg cl, ah
mov eax, 2
bswap cx
lea rcx, [rbp - 0x30]
jmp 0x1404b536f
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
jmp 0x1404b537a
call fcn.1404b551b
cmp dword [rbp + 0x20], 0
jmp 0x1404b5388
je 0x1404b539e
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp 0x1404b539d
ret
mov ecx, ebx
jmp 0x1404b53a5
call fcn.1404b51ae
int3
Function at 0x140205c52
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x1400fdde9
sub r9d, r9d
not cx
mov ch, 0x1f
mov cx, r12w
mov ecx, 0xfffffc03
jmp 0x140221a78
ret
je 0x1402420a2
mov dword [rsp + 8], edx
ror dx, 0x70
sal edx, 0x7c
btc ax, r11w
movzx eax, word [rsp + 0xe]
bts dx, dx
or dl, 0x42
mov edx, 0xffef
cmp esi, 0x44145ece
clc
and ax, dx
cmp r12b, bl
cmc
mov word [rsp + 0xe], ax
cmp r8b, 0xbf
jmp 0x14024c3ce
movzx ecx, word [rsp + 0xe]
bsf rax, rax
or dx, bp
cwde
mov edx, 0xbfef
cdqe
shr ecx, 4
clc
movzx eax, r15w
movsd qword [rsp + 0x10], xmm1
adc ax, 0x7ea9
and ecx, 0x7ff
dec al
movsd qword [rsp + 0x18], xmm1
and ax, r10w
sal ah, 0x4b
not al
mov rax, qword [rsp + 0x18]
shr rax, 0x30
and ax, dx
mov edx, 0x3fe0
cmp r14d, 0x7e2e1d31
clc
or ax, dx
mov word [rsp + 0x16], ax
test rbp, r14
cmc
clc
sub ecx, 0x3fe
jmp 0x140277004
mov dword [r10], ecx
jmp 0x1400ece8c
mov rax, qword [rsp + 8]
shld cx, ax, 0xa4
mov ecx, 0x7ff0
ror r8b, cl
mov r8, rax
test r15b, 0xdf
cmp r8b, r8b
clc
shr r8, 0x30
cmp r8b, 0xc2
test cx, r8w
jmp 0x1402466f2
jmp 0x1401af647
xorps xmm0, xmm0
mov r10, rdx
jmp 0x14025ff3b
movaps xmm1, xmm0
jmp 0x14028d33f
or ax, dx
mov word [rsp + 0xe], ax
jmp 0x140245003
comisd xmm0, xmm1
seta r9b
cmp sil, 0x7a
test r8b, 0x10
jmp 0x140242098
jne 0x1400f2102
mov eax, dword [rsp + 0xc]
add eax, eax
mov dword [rsp + 0xc], eax
test dh, 0x7e
test edx, edx
jmp 0x14028a821
movsd xmm0, qword [rsp + 8]
jmp 0x1401e918c
jne 0x1400fdde9
mov edx, dword [rsp + 8]
test si, r11w
cmp r15, r9
shr rax, 0x20
cmp r14d, r9d
test eax, 0xfffff
jne 0x1400e5e85
test edx, edx
jmp 0x1400e5e7f
test r9d, r9d
jmp 0x14029a51d
jmp 0x1401af647
ucomisd xmm1, xmm0
jp 0x1401e3f3d
jne 0x1401e3f3d
xor ecx, ecx
jmp 0x140253ca0
movsd xmm0, qword [rsp + 0x10]
jmp 0x1401af647
dec ecx
stc
cmc
test byte [rsp + 0xe], 0x10
jmp 0x1400f20ec
jns 0x14028a835
or eax, 1
cmp r9, 0x10c362d1
mov dword [rsp + 0xc], eax
add edx, edx
jmp 0x14028a6f0
movsd qword [rsp + 8], xmm0
jmp 0x1401f9c08
je 0x14029a547
mov edx, 0x8000
cmp r9b, 0x6f
cmc
stc
or ax, dx
and rdx, rbx
xadd dh, dh
mov word [rsp + 0xe], ax
bt ax, 0x7b
bts ax, bx
rdtsc
movsd xmm0, qword [rsp + 8]
bsr eax, r9d
ror ax, 0xc8
mov ax, 0xa7a
mov edx, 0xbfef
test dl, dil
movzx ax, cl
or al, 0xff
movsd qword [rsp + 0x10], xmm0
mov rax, qword [rsp + 0x10]
cmp ecx, r10d
shr rax, 0x30
and ax, dx
bts dx, r10w
movsd qword [rsp + 8], xmm0
shl dh, cl
shrd rdx, rsp, 0x6f
xor dl, dil
mov edx, 0x3fe0
jmp 0x14020dd73

Function at 0x1402253f4
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b5232
xor r8d, r8d
cmp r13d, r8d
cmp rcx, 0x68a73ddf
xor edx, edx
jmp 0x1401f259f
Function at 0x140249eaa
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x1401f7983
xor eax, eax
jmp 0x14026ffaa
cmp r10, rcx
jmp 0x1401cefe9
jb 0x14026ffaa
inc r9d
clc
cmp r9b, 0x46
test dil, 0x7a
add rax, 0x28
test r8, 0x3bf23093
cmp r9d, r11d
jmp 0x140194c2c
je 0x140194c32
mov edx, dword [rax + 0xc]
cmp r10, rdx
jmp 0x140270807
movsxd r8, dword [rcx + 0x3c]
lahf
neg r10b
add r11d, 0x18b12f44
sub r9d, r9d
add r8, rcx
and r10b, r8b
mov r10, rdx
movzx eax, word [r8 + 0x14]
stc
movzx r11d, word [r8 + 6]
cmp di, bx
add rax, 0x18
add rax, r8
cmp sil, r10b
test r11d, r11d
jmp 0x1401f797d
ret
jb 0x1401cefef
mov ecx, dword [rax + 8]
clc
cmp r13b, 0xdb
add ecx, edx
jmp 0x1401a5876
Function at 0x1402681c4
Capabilities:
Parse pe header

Disassembly:
jne 0x1401df3dc
movsxd rdx, dword [rcx + 0x3c]
cmp r12b, spl
jmp 0x140249b18
ret
sub eax, eax
ret
jne 0x1401df3dc
xor eax, eax
dec cl
mov ecx, 0x20b
rcr al, 0xd5
inc al
cmp word [rdx + 0x18], cx
mov al, spl
jmp 0x14029764c
lea rdx, [rdx + rcx]
cmp dword [rdx], 0x4550
jmp 0x140230572
mov eax, 0x5a4d
stc
cmp ebx, esp
cmp word [rcx], ax
jmp 0x140107ee0
sete al
jmp 0x1401ad2cb
Function at 0x1403c9d57
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
ror rsi, cl
shr ax, cl
btc ax, bx
push rdi
push rbx
sub rsp, 0x20
bts esi, eax
xor dil, r8b
mov rsi, rcx
movzx rax, r10w
lea rax, [0x1400be020]
cmovs edi, r10d
btc rdi, rcx
mov qword [rcx], rax
rcr dil, cl
mov di, dx
mov rdi, qword [rcx + 0x78]
cmp r11b, r13b
test rdi, rdi
jmp 0x1403c9d9c
je 0x1403c9dbf
mov rcx, rdi
call fcn.1401ee7d4
mov rcx, rdi
jmp 0x1403c9db2
call fcn.1401ea1c8
mov qword [rsi + 0x78], 0
mov rax, qword [rsi + 0x70]
cmp rax, 8
jb 0x1403c9e47
mov rcx, qword [rsi + 0x58]
movsx edx, si
xchg rdx, rdx
lea rdx, [rax + rax]
test r12b, dil
add rdx, 2
test r12w, 0x32a6
stc
cmp rdx, 0x1000
jmp 0x1403c9df5
jb 0x1403c9e42
mov rbx, qword [rcx - 8]
test spl, sil
add rcx, 0xfffffffffffffff8
test bx, 0x4797
stc
sub rcx, rbx
cmp ah, cl
test cl, r8b
cmp rcx, 0x20
jmp 0x1403c9e1d
jae 0x1403c9f94
add rax, rax
add rax, 0x29
jmp 0x1403c9e37
mov rdx, rax
mov rcx, rbx
jmp 0x1403c9e42
call fcn.14012e38b
movaps xmm0, xmmword [0x1400bd3f0]
xchg bx, di
jmp 0x1403c9e59
movups xmmword [rsi + 0x68], xmm0
cmc
mov word [rsi + 0x58], 0
sete al
lea rax, [0x1400bdb70]
shld di, ax, 0x72
mov qword [rsi], rax
xchg bx, bx
mov rdi, qword [rsi + 0x40]
mov rbx, qword [rsi + 0x48]
jmp 0x1403c9e86
cmp rdi, rbx
jmp 0x1403c9e8e
jne 0x1403c9eab
jmp 0x1403c9eeb
add rdi, 8
cmp rdi, rbx
jmp 0x1403c9ea5
je 0x1403c9ed3
mov rcx, qword [rdi]
stc
clc
test rcx, rcx
je 0x1403c9e99
mov rax, qword [rcx]
not dl
mov rdx, rbp
cqo
mov edx, 1
call qword [rax + 0xb8]
jmp 0x1403c9e99
mov rdi, qword [rsi + 0x40]
test r15w, 0x50b7
cmp rdi, qword [rsi + 0x48]
je 0x1403c9eeb
mov qword [rsi + 0x48], rdi
test rdi, rdi
je 0x1403c9f77
mov rdx, qword [rsi + 0x50]
cmp rbx, 0x26e8496e
stc
sub rdx, rdi
jmp 0x1403c9f08
cmp rdx, 0x1000
jmp 0x1403c9f14
jb 0x1403c9f51
mov rax, qword [rdi - 8]
stc
cmc
add rdi, 0xfffffffffffffff8
stc
sub rdi, rax
clc
stc
test cl, dil
cmp rdi, 0x20
jmp 0x1403c9f36
jae 0x1403c9f94
add rdx, 0x27
bswap di
dec cx
mov rdi, rax
rcr cl, cl
movzx ecx, r10w
sar cl, cl
add rsi, 0x40
cmovge ecx, r8d
xchg rcx, rcx
jmp 0x1403c9f61
mov rcx, rdi
call fcn.14012e38b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
add rsp, 0x20
jmp 0x1403c9f80
pop rbx
movzx rdi, si
pop rdi
cmovp rsi, rcx
movsx esi, r12w
movzx esi, r11w
pop rsi
ret
call fcn.1404ba2d1
int3
Function at 0x1403e479d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov r9d, ebx
movsx r10d, bx
push rdi
rcr r9d, 0x49
push rbx
rcr r10b, 0xb0
sbb r10d, 0x29fa65b5
mov r9, rcx
test bpl, 0x23
lea r8, [r8 + rdx]
movsxd r10, r10d
rcr r10b, 0xae
sbb r10b, 0x1c
mov dword [rcx + 8], 0
bts r10w, r15w
sub eax, eax
sub ecx, ecx
cmc
nop word cs:[rax + rax]
rcr r10d, cl
movzx r10w, cl
lea r10, [rdx + 1]
cmp r10, r8
jmp 0x1403e47fd
ja 0x1403e4a87
movzx edi, byte [rdx]
movzx edx, si
sal dh, 0xdb
mov edx, edi
cmc
and edx, 0x7f
cmp r10w, 0x33e9
shl rdx, cl
jmp 0x1403e4824
lea rax, [rax + rdx]
or dh, 0xb1
add rcx, 7
btc rdx, r11
neg edx
or dh, 0xa4
mov rdx, r10
cmp r10w, 0x15a6
cmc
test dil, dil
jmp 0x1403e484a
js 0x1403e47f1
mov rcx, rax
test dil, r9b
test r9b, 0x40
and rcx, 0xfffffffffffffff8
cmp r10, r10
and eax, 7
cmp rcx, 8
je 0x1403e49bf
cmp rax, 1
jmp 0x1403e4877
jg 0x1403e48a2
test rax, rax
jmp 0x1403e4885
je 0x1403e4961
cmp eax, 1
jne 0x1403e4a87
lea rdx, [r10 + 8]
jmp 0x1403e489d
jmp 0x1403e49a9
cmp eax, 5
je 0x1403e499e
cmp eax, 2
jne 0x1403e4a87
mov rsi, r10
shl ax, 0x50
bswap rax
sub edi, edi
rcl al, 0xc3
xor ecx, ecx
and ax, di
xor eax, r12d
nop word cs:[rax + rax]
bsf ax, r14w
cbw
lea rax, [rsi + 1]
cmc
clc
cmp rax, r8
jmp 0x1403e48eb
ja 0x1403e4a87
mov r11, rdi
rcl dl, 0x90
add ebx, 0x1dc703fc
stc
movzx ebx, byte [rsi]
bswap si
bts rdx, r13
ror rsi, cl
mov edx, ebx
btr rsi, rsp
and edx, 0x7f
shl rdx, cl
btc esi, r15d
shr sil, 0x65
rcr si, 0x56
add rdi, rdx
movsx esi, bx
add rcx, 7
sub sil, 0x38
mov rsi, rax
test r13b, 0x51
test bl, bl
jmp 0x1403e493f
js 0x1403e48dd
add rdx, r11
add rdx, rax
cmp rdx, r8
jmp 0x1403e4953
cmova rdx, rax
jmp 0x1403e495c
jmp 0x1403e47d8
mov rax, r10
test rsp, r15
ror dx, cl
nop
or dh, 0x91
neg edx
lea rdx, [rax + 1]
test si, 0x76bb
cmp rdx, r8
jmp 0x1403e4982
ja 0x1403e4a87
cmp byte [rax], 0
mov rax, rdx
jmp 0x1403e4993
js 0x1403e4971
jmp 0x1403e47d8
lea rdx, [r10 + 4]
clc
test edx, 0x65ee089c
cmp rdx, r8
jmp 0x1403e49b1
cmova rdx, r10
jmp 0x1403e49ba
jmp 0x1403e47d8
cmp eax, 2
jmp 0x1403e49c7
jne 0x1403e4a87
mov dword [r9 + 8], 2
movsx esi, cx
movsxd rdx, ebx
mov rsi, r10
bt edx, 0x46
sub eax, eax
sub ecx, ecx
bt dx, bx
sub dl, r14b
nop word [rax + rax]
adc dl, r12b
xadd rdx, rdx
btr rdx, rsi
lea rdx, [rsi + 1]
cmp rdx, r8
jmp 0x1403e4a0a
ja 0x1403e4a87
movzx r11d, byte [rsi]
add esi, eax
mov edi, r11d
bts rsi, r9
bsf rsi, r10
and edi, 0x7f
shl sil, 0xa3
shl rdi, cl
sub sil, 0xed
lea rax, [rax + rdi]
sar rsi, cl
shr sil, 0xed
clc
add rcx, 7
mov rsi, rdx
jmp 0x1403e4a4b
test r11b, r11b
jmp 0x1403e4a53
js 0x1403e49fe
mov qword [r9 + 0x10], rdx
jmp 0x1403e4a62
mov qword [r9 + 0x18], rax
test r13, r9
stc
cmp bh, 0xce
lea rdx, [rdx + rax]
cmp r10d, 0x53aa12eb
cmc
cmp rdx, r8
jmp 0x1403e4a81
jbe 0x1403e47d8
cmp r10, r8
jmp 0x1403e4a98
seta al
xchg ebx, edi
pop rbx
movzx esi, di
movzx si, spl
pop rdi
movzx rsi, bp
movzx si, dil
mov sil, r9b
pop rsi
jmp 0x1403e4ab9
ret
Function at 0x1403e9986
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rcr r15b, cl
bts r15w, dx
push r14
cmp ax, r14w
push r13
movsxd r15, r11d
xor r13, r9
cmp spl, r13b
push r12
jmp 0x1403e99a8
push rsi
bts r15, r15
mov r12w, 0x19b7
movsxd r15, eax
push rdi
push rbp
rcr r14, cl
btr r12, r11
push rbx
sal r15b, 0x69
sub rsp, 0x38
rcl r13, cl
movsx r15d, r10w
movaps xmmword [rsp + 0x20], xmm6
adc rbx, 0x654639e4
mov r14, r9
sbb r15b, bl
mov r15, r8
movzx rbx, r14w
or r13b, 0x44
add bl, bpl
mov r12, rdx
xchg r13w, r13w
bt r13w, r15w
cmp r11b, r11b
mov r13, rcx
shr bx, cl
neg bh
mov rbx, qword [rcx]
jmp 0x1403e9a0d
test rbx, rbx
jmp 0x1403e9a15
je 0x1403e9b58
mov rdi, qword [r13 + 8]
test r9b, spl
cmp rbx, rdi
jmp 0x1403e9a2a
je 0x1403e9af3
lea rbp, [0x1400bed30]
jmp 0x1403e9a3c
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e9a48
jmp 0x1403e9a76
call fcn.14012e38b
movups xmmword [rbx + 0x20], xmm6
test ebx, 0x4dc32303
mov byte [rbx + 0x10], 0
cmp esi, eax
stc
clc
add rbx, 0x38
cmc
clc
cmp bh, 0xc5
cmp rbx, rdi
je 0x1403e9aef
mov qword [rbx], rbp
mov rax, qword [rbx + 0x28]
cmc
test r14b, 0x53
cmp rax, 0x10
jmp 0x1403e9a8b
jb 0x1403e9a52
mov rcx, qword [rbx + 0x10]
movzx rdx, cx
cdq
sar dh, cl
lea rdx, [rax + 1]
stc
clc
cmp r9b, bpl
cmp rdx, 0x1000
jmp 0x1403e9ab1
jb 0x1403e9a4d
mov rsi, qword [rcx - 8]
cmp r11d, esp
test bl, 0x42
add rcx, 0xfffffffffffffff8
sub rcx, rsi
clc
cmp rcx, 0x20
jmp 0x1403e9ad2
jae 0x1403e9bdc
add rax, 0x28
mov rdx, rax
movsxd rcx, esp
mov rcx, rsi
jmp 0x1403e9aea
jmp 0x1403e9a4d
mov rbx, qword [r13]
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmc
cmp rdx, 0x1000
jmp 0x1403e9b07
jb 0x1403e9b4b
mov rax, qword [rbx - 8]
cmp cl, 0xa4
test bpl, 0x11
add rbx, 0xfffffffffffffff8
cmp bpl, 0x73
jmp 0x1403e9b25
sub rbx, rax
cmc
cmp rbx, 0x20
jae 0x1403e9bdc
add rdx, 0x27
movzx ecx, bx
not cx
xchg cl, cl
mov rbx, rax
mov cl, sil
not cl
cmovae rcx, r12
mov rcx, rbx
jmp 0x1403e9b53
call fcn.14012e38b
mov qword [r13], r12
cmp r11d, ebp
sub ax, 0x726d
imul rax, r15, 0x38
and sil, 0x88
rcr di, cl
add rax, r12
cmp r11b, r8b
mov qword [r13 + 8], rax
imul rax, r14, 0x38
add rax, r12
rcr bl, 0xa7
shl bpl, cl
cmc
mov qword [r13 + 0x10], rax
bts si, bp
clc
movaps xmm6, xmmword [rsp + 0x20]
movsxd r13, r15d
and r15b, 0xd3
add rsp, 0x38
pop rbx
pop rbp
xchg r14w, r12w
movzx di, spl
pop rdi
movsx r12w, bl
mov r12b, dil
pop rsi
cmovge r15, rsp
pop r12
pop r13
movzx r15w, r10b
movsx r15d, r10w
movsx r14w, r14b
pop r14
movsxd r15, r10d
movzx r15w, r15b
pop r15
jmp 0x1403e9bdb
ret
call fcn.1404ba2d1
int3