joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f12d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0xb0
call fcn.140253840
sub rsp, rax
mov rax, qword [0x14031a320]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xf0]
mov rbp, r8
mov dword [rsp + 0x60], 0x61707865
mov rsi, rdx
mov dword [rsp + 0x64], 0x3320646e
mov rdi, rcx
mov dword [rsp + 0x68], 0x79622d32
mov dword [rsp + 0x6c], 0x6b206574
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x80], xmm1
movups xmmword [rsp + 0x90], xmm0
test r8, r8
je 0x1401f14b1
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], r14
nop
mov ebx, 0x40
lea rdx, [rsp + 0x60]
cmp rbp, rbx
lea rcx, [rsp + 0x20]
cmovb rbx, rbp
call fcn.1401f14d0
xor eax, eax
test rbx, rbx
je 0x1401f148b
cmp rbx, 0x40
jb 0x1401f1459
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rsp + rbx + 0x1f]
cmp rdi, rcx
ja 0x1401f13af
lea rcx, [rsp + 0x20]
cmp rdx, rcx
jae 0x1401f1459
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x1401f13c4
cmp rdx, rsi
jae 0x1401f1459
mov r10, rbx
and r10, 0xffffffffffffffc0
mov rdx, rsi
lea r8, [rsp + 0x20]
lea r11, [rsp + 0x30]
sub rdx, rdi
sub r8, rdi
lea r14, [rsp + 0x40]
sub r11, rdi
lea rcx, [rdi + 0x10]
sub r14, rdi
nop dword [rax]
movdqu xmm0, xmmword [r8 + rcx - 0x10]
add rax, 0x40
movdqu xmm1, xmmword [rdx + rcx - 0x10]
movdqu xmm2, xmmword [rcx + r8]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x40]
movdqu xmmword [rcx - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x30]
movdqu xmm1, xmmword [rcx + r11 - 0x40]
movdqu xmmword [rcx - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x20]
movdqu xmm2, xmmword [rcx + r14 - 0x40]
movdqu xmmword [rcx - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x20], xmm2
cmp rax, r10
jb 0x1401f13f0
cmp rax, rbx
jae 0x1401f148b
lea rcx, [rsp + 0x20]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rsp + 0x20]
sub r9, rcx
nop
lea rdx, [rsp + 0x20]
add rdx, rax
inc rax
movzx ecx, byte [rdx + r8]
xor cl, byte [rdx]
mov byte [rdx + r9], cl
cmp rax, rbx
jb 0x1401f1470
inc dword [rsp + 0x90]
add rdi, rbx
add rsi, rbx
sub rbp, rbx
jne 0x1401f1360
mov r14, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140252d20
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401f3fe0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.140253840
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1401f4009
lea rax, [0x1401f2650]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1401eac00
lea rax, [0x1401f1810]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1401ea950
Function at 0x1401fa840
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x20
call fcn.140253840
sub rsp, rax
mov rsi, r9
mov rbp, r9
shr rsi, 3
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp r8, r9
jb 0x1401fa900
nop
xor edx, edx
test rsi, rsi
je 0x1401fa8f0
nop word [rax + rax]
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx]
shl rcx, 8
add rbx, 8
or rcx, rax
xor qword [r14 + rdx*8], rcx
inc rdx
cmp rdx, rsi
jb 0x1401fa890
mov rcx, r14
call fcn.1401fa010
sub rdi, rbp
cmp rdi, rbp
jae 0x1401fa880
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1401faba9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401fad9a
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_208
call fcn.140253840
sub rsp, rax
mov rax, qword [0x14031a320]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1401411d0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140140b70
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.14017be40
mov rcx, r15
call fcn.1401411d0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140140b70
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14017be40
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r14], dil
shr edi, 0x18
mov byte [r14 + 4], dl
shr edx, 0x18
mov byte [r15], r8b
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r14 + 3], dil
mov byte [r14 + 7], dl
mov byte [r15 + 2], al
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1401fac10
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140252d20
add rsp, 0xd0
pop rbx
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403af8f9

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b13a1

Function at 0x14010a487
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [r8 + rdx], 0x65
jmp 0x1401be2c2
mov r9, qword [rdx]
rcl rdx, 6
movzx r8d, byte [rcx]
bts edx, r13d
cmp dx, 0x521
jmp 0x1401c946c
cmovne rdx, rcx
rcr ch, cl
bsf ecx, eax
rcl ch, 7
mov rcx, qword [rax]
shl ax, cl
add ax, 0x2759
movzx eax, byte [rcx]
sar cl, cl
mov byte [rdx], al
test bpl, 0x75
cmovnp ax, r14w
lea rax, [rdx + 1]
mov cx, 0x4fd9
sal cl, cl
nop dword [rax]
btc ecx, 0x97
movzx ecx, byte [rax]
movzx edx, r8b
mov byte [rax], r8b
xor r8b, 0x9c
and r8b, 0xbe
jmp 0x1401ad1fc
lea rax, [rax + 1]
sal r8b, 0xbc
and r8d, 0x728974bc
test r8w, r11w
movzx r8d, cl
cmp rsp, 0x4a114fa5
test dl, dl
jmp 0x140222438
je 0x140268740
mov rax, qword [r9]
movsxd r8, r14d
bswap r8w
not r8b
nop dword [rax + rax]
movzx r8w, cl
movsx r8w, r12b
movzx r8, cx
movzx r8d, byte [rcx + 1]
inc rcx
test bl, dil
jmp 0x14027022e
mov rdx, qword [r9 + 0x110]
jmp 0x1400f7876
jne 0x1401e8992
movzx r8d, byte [rcx + 2]
mov rax, qword [r9 + 0xf8]
jmp 0x14020c5bd
lea rdx, [rcx + 2]
jmp 0x140115b69
jne 0x140115ba4
ret
jne 0x1401be2eb
movzx eax, r8b
test r15b, cl
cmp byte [rax + rdx], 0x78
jmp 0x1401e8987
test byte [rax + r8*2], 4
jmp 0x14026873a
Function at 0x140110cba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
imul r9d, dword [r10]
jmp 0x1401ddce4
mov r10, qword [rcx]
shl r11b, cl
mov r11, qword [rcx + 0x18]
cmp bpl, r15b
cmp r14w, 0x276e
add r9, 0x9054dbf
mov r9d, dword [r10 + 4]
jmp 0x1400edd46
test r9d, r9d
je 0x1401e8cf0
movzx r10d, byte [rdx]
stc
sar r8w, 0xe0
movsx r8, r14w
mov r8d, r9d
stc
clc
sub ecx, ecx
jmp 0x1401ea308
jne 0x14024a164
mov byte [r11 + rcx*4 + 3], 0
movzx r10d, byte [rdx]
jmp 0x1402580b0
cmp r8d, 2
jmp 0x14028ce80
ret
jmp 0x140249b9a
jne 0x14024a13a
jmp 0x1401e8cf0
setne al
neg al
mov byte [r11 + rcx*2 + 1], al
jmp 0x1402861bb
je 0x1401e8cf0
cmp byte [r11 + rcx*4], r10b
jne 0x14024a164
movzx eax, byte [r11 + rcx*4 + 1]
jmp 0x140286077
add r11, 8
cmp di, si
add r8d, 0xfffffffc
jne 0x14028cec2
test r9b, 3
je 0x1401e8cf0
and r9d, 3
movzx eax, r12w
shl ax, 0xfe
cmp ah, 0xc4
xor ecx, ecx
sar ah, cl
movzx eax, cx
nop word cs:[rax + rax]
sal ah, 0x39
xor rax, 0x58bb7a2c
sal al, cl
movzx eax, byte [r11 + rcx*2]
test r15b, 0x3f
cmp al, byte [rdx]
jmp 0x1402056c8
inc rcx
cmp r8d, ecx
jmp 0x140249b94
jmp 0x14024a164
cmp al, byte [rdx + 1]
jmp 0x14028ea12
inc rcx
test r15, r14
cmp r9d, ecx
jmp 0x1401fa2e0
jne 0x14012cd59
test r9d, r9d
je 0x1401e8cf0
lea ecx, [r9 - 1]
test spl, r15b
cmp ecx, 3
jb 0x14024a104
mov r8d, r9d
sbb cx, r14w
bt cx, r9w
and r8d, 0xfffffffc
not r10b
nop word cs:[rax + rax]
bswap ecx
movzx ecx, byte [r11]
sal r10b, cl
and r10d, r15d
bswap r10w
cmp cl, byte [rdx]
mov cl, r11b
movzx r10d, byte [r11 + 2]
xchg cl, cl
setne cl
neg cl
mov byte [r11 + 1], cl
rol cl, 0xf4
sal cl, 0xa1
cmp r10b, byte [rdx]
mov cl, 0x9a
setne cl
neg cl
clc
mov byte [r11 + 3], cl
movzx ecx, byte [r11 + 4]
test r12, 0x5165668e
cmp cl, byte [rdx]
xchg cl, cl
setne cl
cmp r10b, 0x6e
cmc
neg cl
cmc
mov byte [r11 + 5], cl
movzx ecx, byte [r11 + 6]
stc
cmp cl, byte [rdx]
setne cl
test al, 0xc2
neg cl
cmc
mov byte [r11 + 7], cl
jmp 0x14024a0f3
jne 0x14024a164
movzx eax, byte [r11 + rcx*4 + 2]
cmp al, byte [rdx + 2]
jmp 0x140132b9c
Function at 0x1401623cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp al, 0x30
jmp 0x14011b87e
dec rcx
cmp r15, r13
jmp 0x1400f9104
jne 0x1401b7207
movzx eax, byte [rcx - 1]
jmp 0x14019d5a2
mov rax, qword [rdx]
mov rdx, qword [rax + 0xf8]
cmp bl, sil
ror r9b, 0x95
xor r9d, edx
mov rax, qword [rdx]
rol r9w, 0xef
adc r9b, 0xc3
xchg r9, r9
movzx r9d, byte [rax]
lahf
shl ah, cl
movzx eax, byte [rcx]
test al, al
je 0x1401af21e
movzx edx, al
movzx eax, sp
nop dword [rax + rax]
sal al, 0xe3
movzx eax, dl
clc
cmp dl, r9b
je 0x1401af21e
movzx eax, byte [rcx + 1]
mov dx, 0x10fc
inc rcx
shrd dx, r13w, 0x8c
adc edx, eax
sar dx, 0xc5
movzx edx, al
test al, al
jmp 0x1401af218
test al, al
jmp 0x1401cd094
je 0x1402173cf
movzx eax, byte [rcx]
jmp 0x140167aa8
dec rcx
cmp bp, 0x22bd
stc
cmp al, 0x30
jmp 0x1401b7201
jne 0x140162410
inc rcx
test bx, 0x433d
cmp bx, 0x687d
test al, al
jmp 0x140198b15
je 0x14011b884
cmp al, r9b
lahf
lea rdx, [rcx - 1]
cmovne rdx, rcx
nop dword [rax]
rol ah, cl
movzx eax, byte [r8]
lea rdx, [rdx + 1]
mov byte [rdx], al
clc
stc
lea r8, [r8 + 1]
cmc
cmp r8b, r8b
test al, al
jmp 0x1402173c9
je 0x14024a0db
sub al, 0x45
test ebp, 0x4cab0c4d
test al, 0xdf
je 0x14024a0db
movzx eax, byte [rcx + 1]
inc rcx
stc
test al, al
jmp 0x14024a0d5
jne 0x1401b721c
ret
jne 0x1401cd09a
movzx eax, byte [rcx - 1]
movzx r8w, r9b
mov r8, rcx
jmp 0x140107f14

Function at 0x14017121d
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
cmp rsp, 0x55d28a8
xor edx, edx
jmp 0x14020dd80
jmp 0x1404b338a

Function at 0x1401b8baa
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
btr ax, 0x86
shr r10b, 0xfc
rol ah, 0x45
xor r9d, r9d
mov r10b, 0x45
movsxd rax, r10d
lea r8, [r8 + rcx]
cmp ebp, 0x42897a36
sub r10w, r14w
sar r11d, 0xf
mov r10, rdx
bts r11, rcx
and r11w, di
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
lea rax, [rax + r8]
cmp ecx, 0x4ec2583a
test r11d, r11d
jmp 0x14023df2b
jb 0x1401f5484
inc r9d
cmp rdi, rsi
test r10w, 0x4967
add rax, 0x28
cmc
cmp r9d, r11d
jb 0x14023df31
xor eax, eax
jmp 0x1401f5484
ret
jb 0x1401be30c
mov ecx, dword [rax + 8]
clc
test cl, r13b
cmp cl, 0xc1
add ecx, edx
cmc
cmp r10, rcx
jmp 0x1401be306
je 0x1401be326
mov edx, dword [rax + 0xc]
cmp r10, rdx
jmp 0x14021b898
Function at 0x1401e9783
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx + 0x18]
jmp 0x14028b8bf
jmp 0x140446c6b
push r14
cmp r13d, r9d
bts ecx, ebp
or cl, 0xc2
push rsi
shld ecx, r10d, 0x18
xor ecx, 0x22271e7
push rdi
btc rcx, r11
mov cx, 0x500e
push rbx
movsxd rcx, esi
shr cl, cl
sal ecx, cl
sub rsp, 0x58
xadd ecx, ecx
jmp 0x140446c9f
lea rcx, [rsp + 0x28]
cmp sil, 9
test bh, ch
sub edx, edx
cmp r14, r14
sub r8d, r8d
sub r9d, r9d
jmp 0x140446cba
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140446d30
lea rsi, [rsp + 0x28]
mov r14, qword [sym.imp.USER32.dll_TranslateMessage]
setp cl
mov rbx, qword [sym.imp.USER32.dll_DispatchMessageW]
not cl
movzx rcx, r9w
mov rdi, qword [sym.imp.USER32.dll_GetMessageW]
mov ecx, esp
nop word [rax + rax]
setp ch
mov rcx, rsi
jmp 0x140446cfe
call r14
mov rcx, rsi
jmp 0x140446d09
call rbx
mov rcx, rsi
cmc
jmp 0x140446d14
xor edx, edx
xor r8d, r8d
stc
cmp r12w, r11w
xor r9d, r9d
jmp 0x140446d26
call rdi
test eax, eax
jne 0x140446cf6
add rsp, 0x58
mov r14w, dx
xchg si, bx
mov rbx, 0x10f35c72
pop rbx
movsx rdi, r11w
movzx rdi, di
pop rdi
setns sil
cmovle r14, r11
movzx r14, dx
pop rsi
movzx r14, di
jmp 0x140446d62
pop r14
jmp 0x140446d69
ret

Function at 0x140205016
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
not dx
lea edx, [r8 + 2]
jmp 0x1402759b8
jmp 0x1404b338a
mov qword [rsp + 8], rbx
ror rbx, cl
mov dword [rsp + 0x18], r8d
bts rbx, rsp
mov dword [rsp + 0x10], edx
not bl
push rbp
mov rbp, rsp
movsx rbx, si
sub rsp, 0x50
movsx ebx, r11w
rcr bh, cl
bswap bx
mov ebx, ecx
jmp 0x1404b33c0
test r8d, r8d
jmp 0x1404b33c8
jne 0x1404b3470
sub ecx, ecx
jmp 0x1404b33d5
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b33e3
je 0x1404b3470
mov ecx, 0x5a4d
stc
clc
jmp 0x1404b33f5
cmp word [rax], cx
jmp 0x1404b33fd
jne 0x1404b3470
movsxd rcx, dword [rax + 0x3c]
jmp 0x1404b3413
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jmp 0x1404b3422
jne 0x1404b3470
mov eax, 0x20b
cmp dil, r15b
cmc
jmp 0x1404b3436
cmp word [rcx + 0x18], ax
jmp 0x1404b343f
jne 0x1404b3470
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b3451
jbe 0x1404b3470
cmp dword [rcx + 0xf8], 0
je 0x1404b3470
mov ecx, ebx
jmp 0x1404b346b
call fcn.1404b324c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
setbe cl
movsxd r8, esp
lea r9, [rbp - 0x2c]
movzx rcx, cx
movzx r8d, si
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
mov cx, cx
lea r8, [rbp - 0x20]
rdtsc
setg ch
not ch
lea rax, [rbp + 0x28]
movsx cx, r9b
mov qword [rbp - 0x10], rax
movsx rax, r10w
mov dh, 0xd2
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
jmp 0x1404b34ca
mov dword [rbp - 0x2c], eax
jmp 0x1404b34d2
mov dword [rbp - 0x28], eax
jmp 0x1404b34da
call fcn.1404b369f
cmp dword [rbp + 0x20], 0
jmp 0x1404b34e8
je 0x1404b3505
mov rbx, qword [rsp + 0x60]
shrd ebp, esi, 0xf3
dec bp
add rsp, 0x50
pop rbp
jmp 0x1404b3504
ret
mov ecx, ebx
jmp 0x1404b350c
call fcn.1404b32f8
int3
Function at 0x1402195bc
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
jmp 0x14019b016
add rdx, rcx
jmp 0x1402086ec
ret
cmp dword [rdx], 0x4550
jmp 0x14020f493
jne 0x1400e00ec
xor eax, eax
movsx ecx, dx
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
mov al, r13b
jmp 0x140288b00
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x1402902f5
ret
sete al
jmp 0x1402528ab
jne 0x1400e00ec
movsxd rdx, dword [rcx + 0x3c]
jmp 0x1400f7fe1

Function at 0x140233c3e
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
je 0x1400fb444
mov word [r10], 0
cmc
movzx eax, word [0x1400b8f10]
sub r8b, sil
sbb r8b, 0x88
cmp ah, 0xd2
cmp rdx, 0x104
xchg r8w, r8w
mov r8d, 0x104
cmovb r8, rdx
cmp bp, 0x6cd4
test ax, ax
jmp 0x140159e18
je 0x140242144
xor eax, eax
stc
cmp r15, 0x2da276fe
nop word [rax + rax]
cmp r15w, 0x68a6
cmp r8, rax
jmp 0x14017da4e
je 0x140182fa5
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x14024b100
je 0x14026d4f8
sub edx, edx
lea r9, [0x1400b8f10]
cmp r8, rdx
jmp 0x14015b62b
je 0x1401af03a
mov word [rcx], ax
btc ax, 0xb5
nop
add rcx, 2
bswap eax
cmovb eax, r15d
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x14028ada9
je 0x1400fb43d
mov word [r10], r11w
inc r11w
shl r11b, cl
add r10, 2
movzx r11, r11w
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14021f774
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
shl r8d, 0x35
bts r9w, dx
mov rax, qword [rax + 0x18]
xor r8d, 0x58480723
mov rax, qword [rax + 0x10]
clc
shld r11w, sp, 0x6a
sbb r10w, r11w
movzx r8d, word [rax + 0x58]
cmovs r9, rdx
cmp r8, rdx
movsx r10d, r15w
mov r9w, 0x7c5a
movzx r9, r15w
cmovae r8, rdx
mov r9, qword [rax + 0x60]
movzx r11d, word [r9]
rol r10d, 0xae
movzx r10, si
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x1401046d0
je 0x140276173
mov word [rcx], 0
jmp 0x140276173
inc rax
cmp sp, 0x4350
test r11w, r11w
jmp 0x14024213b
movzx eax, word [0x1400b8f10]
cmp r15d, 0x24d0101d
test edx, eax
test ax, ax
jmp 0x140117e3b
jne 0x1401046ec
sub r8, rax
test r8, r8
jmp 0x1400fb437
cmovb r8, rdx
jmp 0x140279ede
jne 0x140159e27
sub r8, rdx
cmp cl, r12b
cmp dh, 0x7d
test r11b, spl
test r8, r8
jmp 0x1401af034
ret
jmp 0x140159e1e
inc rdx
clc
test ax, ax
jmp 0x14026d4e6
Function at 0x14023ec13
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x1404481fe
mov rcx, qword [rcx]
jmp 0x1401e58a0
push rsi
xadd al, sil
stc
shrd rax, rcx, 0x8e
push rdi
cbw
not si
sub rsp, 0x28
bt si, 0x71
adc sil, r10b
mov rsi, rcx
rcr al, cl
xadd al, al
shl al, 0x39
mov rcx, qword [rcx + 0x18]
ror ax, 0xf7
and eax, 0x432c5b7e
cmc
mov rax, qword [rcx]
cmp bp, 0x699d
xor edx, edx
cmp r15b, 0xeb
xor r8d, r8d
jmp 0x14044824a
call qword [rax + 0x188]
mov edi, eax
setns ch
lea rcx, [rsi + 0x30]
call fcn.14045c03e
test edi, edi
jmp 0x140448265
je 0x1404482a4
cmp edi, 0x8899000c
jmp 0x140448276
jne 0x1404482c6
mov rcx, rsi
and sil, r12b
xadd rsi, rsi
add rsp, 0x28
mov di, 0x7f8
pop rdi
movzx rsi, r13w
not sil
movsxd rsi, eax
pop rsi
jmp 0x14044829f
jmp fcn.140447ed0
nop
sub sil, 0x96
movzx rdi, ax
add rsp, 0x28
setle sil
mov sil, r11b
pop rdi
mov sil, 0x55
not sil
pop rsi
jmp 0x1404482c5
ret
mov ecx, edi
btr r9d, 0xc9
shl sil, cl
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
and dil, 0x92
movzx r9d, si
test rsp, r8
mov r9d, 0x54
add rsp, 0x28
pop rdi
not esi
bswap si
cmovl si, r10w
pop rsi
jmp 0x140448302
jmp fcn.1403b19c1
Function at 0x14027f97b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1404b9b25
mov cl, 1
jmp 0x1400e6be8
mov byte [rsp + 8], cl
cdqe
movsx ecx, r10w
push rbp
rcr r9b, 0xdd
test bx, cx
sbb r9b, r12b
mov rbp, rsp
shl r9w, 0x42
sub rsp, 0x40
xadd ecx, ecx
sal r9w, 0x53
and dword [rbp + 0x28], 0
lea rax, [rbp + 0x28]
btc r8w, 0xc1
and dword [rbp + 0x20], 0
bswap rdx
movzx ecx, r14w
movsx rcx, cx
lea r9, [rbp - 0x20]
bswap edx
movsx edx, r15w
movzx cx, r11b
mov qword [rbp - 0x18], rax
cbw
rdtsc
lea r8, [rbp - 0x18]
movsx cx, bpl
movsx eax, r13w
lea rax, [rbp + 0x10]
cqo
mov cl, 0x22
mov qword [rbp - 0x10], rax
rdtsc
cwd
seta dh
lea rdx, [rbp - 0x1c]
mov ah, 0x21
movsx cx, r8b
lea rax, [rbp + 0x20]
setbe cl
bswap cx
mov qword [rbp - 8], rax
jmp 0x1404b9bc5
lea rcx, [rbp + 0x18]
not rax
bswap eax
mov eax, 8
jmp 0x1404b9bd8
mov dword [rbp - 0x20], eax
jmp 0x1404b9be0
mov dword [rbp - 0x1c], eax
jmp 0x1404b9be8
call fcn.1404b9d89
cmp byte [rbp + 0x10], 0
mov al, r11b
movzx eax, di
lahf
mov eax, dword [rbp + 0x20]
jmp 0x1404b9c00
cmovne eax, dword [rbp + 0x28]
cmp bl, r11b
rcl ebp, cl
add rsp, 0x40
not bpl
movzx rbp, dx
movsx rbp, ax
pop rbp
jmp 0x1404b9c1e
ret
Function at 0x1403bdd34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sar ah, cl
btc ax, 0x4e
bswap rax
push r14
push r13
adc al, 0x23
push r12
bts eax, edi
rol al, cl
movzx ax, dl
push rsi
bts si, di
push rdi
push rbx
bts ax, sp
cmovne rax, rcx
sub rsp, 0x20
cmp sil, 0xac
mov rsi, r8
neg rbx
mov rdi, rdx
jmp 0x1403bdd79
mov r14, rcx
mov rbx, qword [rcx]
and al, dil
mov rcx, qword [rcx + 0x10]
sub rcx, rbx
btr rax, 0x42
movsx rax, r13w
movsx ax, spl
sar rcx, 4
shld ax, si, 0xa6
xor eax, r11d
bswap ax
movabs rax, 0xf0f0f0f0f0f0f0f1
cmc
jmp 0x1403bddb6
imul rcx, rax
cmp rcx, r8
jmp 0x1403bddc2
jae 0x1403bde1b
mov rcx, r14
mov rdx, rsi
call fcn.1403bdff3
mov rbx, qword [r14]
nop word [rax + rax]
mov dl, 0x43
mov rcx, rbx
movsx edx, r11w
cdq
mov rdx, rdi
jmp 0x1403bddf1
call fcn.1403be827
add rbx, 0x110
test r13b, 0x2b
add rdi, 0x110
dec rsi
jmp 0x1403bde10
jne 0x1403bdde1
jmp 0x1403bdfbc
mov r13, qword [r14 + 8]
mov r12, r13
sub r12, rbx
sar r12, 4
imul r12, rax
test dil, 0x50
movsx r15d, r15w
bt r15, 0xa6
mov r15, r12
cmc
sub r15, rsi
jmp 0x1403bde46
jae 0x1403bdf05
cmp rbx, r13
jmp 0x1403bde54
je 0x1403bdeb0
nop word cs:[rax + rax]
movsx rdx, r12w
cwd
movsxd rcx, r9d
mov rcx, rbx
movsx dx, r9b
movzx rdx, r8w
mov rdx, rdi
jmp 0x1403bde85
call fcn.1403be29e
add rbx, 0x110
cmp ah, 0x93
test r12b, r12b
cmp r15b, r12b
add rdi, 0x110
cmp rbx, qword [r14 + 8]
jmp 0x1403bdeaa
jne 0x1403bde71
cmp rsi, r12
jmp 0x1403bdeb8
je 0x1403bdfbc
nop dword [rax + rax]
not dh
movsx ecx, r14w
mov rcx, rbx
movzx dx, r15b
mov rdx, rdi
call fcn.1403be827
add rbx, 0x110
test bl, bpl
add rdi, 0x110
jmp 0x1403bdef2
inc r15
jmp 0x1403bdefa
jne 0x1403bdecc
jmp 0x1403bdfbc
imul r15, rsi, 0x110
stc
cmp rbp, r15
add r15, rbx
cmp bx, dx
clc
test r14b, 0x5b
test rsi, rsi
je 0x1403bdf75
nop
movzx rdx, r15w
not ch
movsxd rdx, r9d
mov rcx, rbx
not dl
movzx rdx, sp
cdq
mov rdx, rdi
call fcn.1403be29e
add rbx, 0x110
cmp al, r11b
cmp r11b, 0xfc
add rdi, 0x110
jmp 0x1403bdf5a
dec rsi
jmp 0x1403bdf62
jne 0x1403bdf2e
mov r13, qword [r14 + 8]
cmc
test r8, rdi
jmp 0x1403bdf75
cmp r15, r13
je 0x1403bdfb2
mov rsi, r15
movsx ecx, dx
nop word [rax + rax]
mov rcx, rsi
jmp 0x1403bdf92
call fcn.1403b869b
add rsi, 0x110
cmc
cmp r8d, r11d
cmp rdx, 0x32d972ce
cmp rsi, r13
jne 0x1403bdf8a
mov rbx, r15
bswap r15w
or r13b, spl
mov qword [r14 + 8], rbx
xchg si, si
add rsp, 0x20
movsxd r13, esi
bswap ebx
pop rbx
jmp 0x1403bdfd2
pop rdi
not r13
movzx r12w, bpl
movsx r12, si
pop rsi
movzx r12w, r12b
pop r12
pop r13
pop r14
pop r15
jmp 0x1403bdff2
ret