joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d3fe8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400d3e88
call fcn.1400b7a94
mov dword [rax], 0x16
call fcn.1400b7944
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400d3e70
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400d3e70
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400d3eba
lock or dword [rax + 0x14], 0x10
jmp 0x1400d3e70
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400d3ed7
mov rcx, qword [rbp + 0x10]
call fcn.1400d54ec
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400cf334
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400d4dd0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400d3f2e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400d3e70
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400d3f9a
mov rcx, qword [rbp + 0x10]
call fcn.1400cf334
cmp eax, 0xffffffff
je 0x1400d3f81
mov rcx, qword [rbp + 0x10]
call fcn.1400cf334
cmp eax, 0xfffffffe
je 0x1400d3f81
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400cf334
movsxd rdi, eax
lea rsi, [0x14015dad0]
mov rcx, rbx
sar rdi, 6
call fcn.1400cf334
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400d3f88
lea rax, [0x14014c5d0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400d3f9a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400d3fd0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400d3fcc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400d3fcc
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400d3e73
jmp 0x1400d3e40
Function at 0x1400e02d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x14014c228]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x40]
call fcn.1400aeef0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1400e034e
call fcn.14000ce10
test rax, rax
je 0x1400e03d5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx], rax
jmp 0x1400e03ae
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x1400e03ca
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rax, [rsp + 0x40]
cmp rax, 0x10000
jae 0x1400e0387
lea rax, [rsp + 0x40]
movzx edx, ax
mov rcx, rbx
call fcn.14000d4c0
jmp 0x1400e03ae
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400e0393
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000fd40
nop
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400a79f0
add rsp, 0x260
pop rbx
ret
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
int3

Function at 0x1400e03e0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
lea r14, [rcx + 0x10]
mov r15d, r8d
lea rsi, [rcx + 0x18]
mov rbp, rdx
lea rax, vtable.Cxx::Security::CCrypt.0
mov rbx, rcx
mov qword [rcx], rax
xor r8d, r8d
xor eax, eax
xor edx, edx
mov qword [rcx + 8], rax
add rcx, 8
mov qword [r14], rax
mov qword [rsi], rax
lea r9d, [rax + 0x18]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400e0468
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x1400e0468
mov r9d, 0x18
mov dword [rsp + 0x20], 8
xor r8d, r8d
lea rcx, [rbx + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400e04bb
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400e04bb
test rbp, rbp
je 0x1400e04bb
mov rcx, qword [rsi]
xor r9d, r9d
mov r8d, r15d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400e04bb
mov r8, qword [rsi]
xor r9d, r9d
mov rcx, qword [rbx + 8]
mov edx, 0x660e
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400e05d0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rbx, r9
mov esi, r8d
mov rdi, rcx
je 0x1400e0689
cmp qword [rcx + 0x18], 0
je 0x1400e0689
cmp qword [rcx + 0x10], 0
je 0x1400e0689
test rdx, rdx
je 0x1400e0689
cmp qword [r9 + 0x18], 0x10
mov rax, rbx
mov qword [r9 + 0x10], 0
jb 0x1400e0623
mov rax, qword [r9]
mov r8, rsi
mov byte [rax], 0
mov rcx, rbx
call fcn.140015b50
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
mov dword [rsp + 0x40], esi
jb 0x1400e0642
mov rax, qword [rbx]
xor r9d, r9d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
xor edx, edx
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400e0689
mov edx, dword [rsp + 0x40]
xor r8d, r8d
mov rcx, rbx
call fcn.1400184c0
mov al, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400e3a50
Capabilities:
Connect to http server
Create http request

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x14014c228]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r15, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
lea rax, vtable.Cxx::Network::Http::HttpClient::WinConnection::CWinInetConnection.0
mov qword [rcx], rax
mov qword [rcx + 0x18], rbx
movzx eax, word [r9]
mov word [rcx + 0x28], ax
mov eax, dword [rsp + 0xf0]
mov dword [rcx + 0x2c], eax
add rcx, 0x30
call fcn.1400e49d0
nop
cmp dword [rdi + 0x2c], 3
jne 0x1400e3ad0
call fcn.14001f540
test al, al
je 0x1400e3ad0
lea rcx, [rdi + 0x30]
call fcn.1400e4b20
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi + 8], rax
test rax, rax
je 0x1400e3bac
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
xor r9d, r9d
movzx r8d, word [rdi + 0x28]
mov rdx, qword [r15]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400e3b47
mov rax, rdi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400a79f0
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x20
call fcn.1400a72cc
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400e3b8d
lea rdx, str.Cant_connect_to_the_server.
lea rcx, [rsp + 0x70]
call fcn.14006d2a0
nop
mov dword [rsp + 0x40], 2
lea r8, [rsp + 0x70]
mov edx, 2
mov rcx, rdi
call fcn.1400e2ee0
mov rbx, rax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400e2cb0
lea rdx, [0x140147458]
lea rcx, [rsp + 0x50]
call fcn.1400ae2cc
nop
mov ecx, 0x20
call fcn.1400a72cc
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400e3bf2
lea rdx, str.Cant_open_http_connection_to_the_server.
lea rcx, [rsp + 0x70]
call fcn.14006d2a0
nop
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x70]
mov edx, 2
mov rcx, rdi
call fcn.1400e2ee0
mov rbx, rax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400e2cb0
lea rdx, [0x140147458]
lea rcx, [rsp + 0x50]
call fcn.1400ae2cc
int3
Function at 0x1400e4b20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x68
xor esi, esi
mov rbx, rcx
mov dword [rcx + 0x14], esi
mov rdx, 0xffffffff80000001
mov r9d, dword [rcx + 0x10]
mov r8, qword [rcx]
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
call fcn.14000da90
test eax, eax
je 0x1400e4b78
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400e4c41
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add rsp, 0x68
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdi, qword [rbp - 0x20]
lea rax, [rbp - 0x38]
mov rdx, qword [rbx + 8]
lea r9, [rbp - 0x24]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x30]
mov dword [rbp + 0x30], esi
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x1400e4bff
mov rdx, qword [rbx + 8]
lea rax, [rbp - 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov dword [rbp + 0x30], esi
mov dword [rbp - 0x30], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400e4bfb
test rdi, rdi
je 0x1400e4c41
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add rsp, 0x68
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov byte [rbx + 0x1c], 1
mov eax, dword [rbp + 0x30]
mov dword [rbx + 0x14], eax
test rdi, rdi
je 0x1400e4c13
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbx + 0x14]
lea r9, [rbp + 0x28]
lea r8, [rbp - 0x28]
mov dword [rbx + 0x18], eax
lea rdx, [rbp + 0x38]
mov dword [rbp + 0x40], esi
lea rcx, [rbp + 0x40]
mov dword [rbp + 0x38], esi
mov dword [rbp - 0x28], esi
mov edi, esi
mov word [rbp + 0x28], si
call fcn.14001f330
test al, al
jne 0x1400e4c4c
xor al, al
add rsp, 0x68
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, dword [rbp + 0x40]
mov ecx, dword [rbp + 0x38]
cmp eax, 6
jb 0x1400e4c74
cmp ecx, 1
jae 0x1400e4c61
cmp eax, 6
jbe 0x1400e4c69
mov edi, 0xa00
cmp eax, 6
jne 0x1400e4c72
cmp ecx, 1
jbe 0x1400e4c74
jmp 0x1400e4c78
jae 0x1400e4c78
bts edi, 7
mov eax, edi
and eax, dword [rbx + 0x14]
cmp edi, eax
jne 0x1400e4c8c
mov al, 1
add rsp, 0x68
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9d, dword [rbx + 0x10]
lea rcx, [rbp - 0x20]
mov r8, qword [rbx]
mov rdx, 0xffffffff80000001
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
call fcn.14000da90
mov rsi, qword [rbp - 0x20]
test eax, eax
jne 0x1400e4cee
or edi, dword [rbx + 0x14]
lea rax, [rbp + 0x30]
mov rdx, qword [rbx + 8]
mov r9d, 4
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400e4cee
mov dword [rbx + 0x18], edi
mov bl, 1
jmp 0x1400e4cf0
xor bl, bl
test rsi, rsi
je 0x1400e4cfe
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x68
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Authenticate hmac
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403aafe1

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403acbb5

Function at 0x1400f5f80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x1400f65d1
jne 0x14028ee04
movsxd rdx, dword [rcx + 0x3c]
stc
lea rdx, [rdx + rcx]
test r13b, 0x9c
cmp r8d, 0x11de3fb6
cmp dword [rdx], 0x4550
jmp 0x1401d03e2
jne 0x14028ee04
xor eax, eax
rcr cx, cl
and al, sil
mov ecx, 0x20b
sbb al, bl
cmp word [rdx + 0x18], cx
sete al
jmp 0x1401d7480
ret
sub eax, eax
jmp 0x14029529c
ret
Function at 0x140129561
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14019ca68
jmp 0x140443946
push rsi
rcr sil, cl
movsx rsi, di
sub sil, 0x92
push rdi
shrd ax, r11w, 0x53
sub rsp, 0x28
mov rsi, rcx
movsx eax, r9w
test r12b, 0x25
or eax, r10d
mov rcx, qword [rcx + 0x18]
adc ax, r9w
cmp sp, 0x7a74
mov rax, qword [rcx]
stc
xor edx, edx
xor r8d, r8d
call qword [rax + 0x188]
mov edi, eax
jmp 0x14044398e
lea rcx, [rsi + 0x30]
call fcn.140457544
test edi, edi
jmp 0x14044399e
je 0x1404439d4
cmp edi, 0x8899000c
jmp 0x1404439af
jne 0x1404439f7
mov rcx, rsi
jmp 0x1404439bd
add rsp, 0x28
movsxd rdi, r8d
movzx si, sil
mov si, 0x5899
pop rdi
pop rsi
jmp fcn.140443611
nop
shrd edi, r14d, 0xdc
dec di
add rsp, 0x28
movzx si, r14b
movzx rsi, di
movsx edi, bx
pop rdi
xchg esi, esi
pop rsi
jmp 0x1404439f6
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
test r12w, 0x65cb
mov dl, 3
sal sil, 0xa7
xor di, 0x7782
shl edi, cl
mov r9d, 0x54
ror rdi, cl
sub si, 0x3bb2
add rsp, 0x28
not dil
pop rdi
jmp 0x140443a38
pop rsi
jmp 0x140443a3e
jmp fcn.1403ad169

Function at 0x140129d95
Capabilities:
Enumerate pe sections

Disassembly:
ret
jb 0x140287986
mov ecx, dword [rax + 8]
add ecx, edx
test r14b, r8b
cmp cx, 0x3a91
cmp r10, rcx
jmp 0x140287980
add rax, 0x28
clc
cmp r9d, r11d
jmp 0x14022f98d
movsxd r8, dword [rcx + 0x3c]
bsf ax, r14w
sub r9d, r9d
add r8, rcx
movsx r11w, bpl
bsf r10, r11
bts ax, sp
mov r10, rdx
cbw
cmp rdx, rdi
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
cmc
add rax, 0x18
stc
add rax, r8
test r11d, r11d
jmp 0x140203edc
je 0x14022f993
mov edx, dword [rax + 0xc]
cmp r10, rdx
jmp 0x1401157f5
jb 0x140203ee2
sub eax, eax
jmp 0x14010c699
jb 0x14010c699
inc r9d
test r10d, esi
cmp r11w, bx
jmp 0x140122dd2

Function at 0x1401320e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x140248067
jmp fcn.1404c0ff5

Function at 0x1401af110
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
test r11w, r11w
stc
cmp cl, 0x13
xor edx, edx
jmp 0x1401b5654
jmp 0x1404ae6c6
Function at 0x1401c0393
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x1401c03c6
inc rcx
cmp r15b, 0xc7
cmp r11d, r10d
test al, al
je 0x140129c6f
movzx eax, byte [rcx]
test al, al
jmp 0x1402620f3
inc rcx
test r10, 0x4c1927a8
test al, al
jne 0x1402620f9
movzx eax, byte [rcx - 1]
mov r8d, 0x4bd55b94
mov r8, rcx
jmp 0x14020b7d0
je 0x140294c4a
cmp al, r9b
cwd
lea rdx, [rcx - 1]
setns ah
nop
movsxd rax, esi
cmovne rdx, rcx
inc ax
xor al, cl
nop dword [rax]
mov ax, r14w
movzx eax, byte [r8]
cmp ch, 0xb5
cmp r14w, si
lea rdx, [rdx + 1]
cmc
test r13b, r8b
mov byte [rdx], al
lea r8, [r8 + 1]
stc
test al, al
jne 0x140129c4d
ret
mov rax, qword [rdx]
bts r9d, r14d
mov rdx, qword [rax + 0xf8]
rcr al, 0xcb
mov rax, qword [rdx]
add r9b, 0x7d
movzx r9d, byte [rax]
movzx eax, byte [rcx]
test al, al
je 0x1400fc11e
movzx edx, al
nop dword [rax + rax]
lahf
test rdx, rdx
movzx eax, dl
cmc
cmp r13b, 0x45
cmp dl, r9b
je 0x1400fc11e
movzx eax, byte [rcx + 1]
movsx rdx, r13w
inc rcx
btr rdx, 0xbd
movsx rdx, r11w
movzx edx, al
clc
test al, al
jmp 0x1400fc118
dec rcx
stc
cmp al, 0x30
jmp 0x140129c22
je 0x14012749f
movzx eax, byte [rcx + 1]
jmp 0x14012748d
dec rcx
clc
cmp r15d, 0x5d870370
test r13b, 0x62
cmp al, 0x30
jmp 0x140294c44
je 0x14012749f
sub al, 0x45
test r15w, 0x2695
stc
jmp 0x14028f7f9
test al, 0xdf
jmp 0x1401f0384
jne 0x140129c28
movzx eax, byte [rcx - 1]
jmp 0x1401c87cd
Function at 0x1401c5c5d
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x1404de3e7
mov rax, rsp
cmp r13b, 0xfc
mov qword [rax + 8], rbx
cmc
cmp ch, 0x35
mov qword [rax + 0x10], rsi
sub si, bp
mov qword [rax + 0x18], rdi
bt rdi, rsi
btr di, 0xca
xchg sil, sil
mov qword [rax + 0x20], r14
stc
sal si, cl
push r15
sub rsp, 0x30
bswap edi
mov si, 0x87a
jmp 0x1404de426
mov r15, r9
cmovl si, r12w
movzx r14d, ax
bswap r14w
mov rsi, r8
movzx rdi, r9w
mov rdi, rdx
movsx r14, r11w
jmp 0x1404de44e
mov r14, rcx
movsx rcx, sp
mov ecx, 0xb
jmp 0x1404de45f
call fcn.140213cb7
nop
xor ebx, ebx
test r9b, 0xc2
cmc
clc
test r14, r14
jne 0x1404de496
call fcn.1404b2a34
mov ebx, 0x16
jmp 0x1404de485
mov dword [rax], ebx
jmp 0x1404de48c
call fcn.1404b36f7
jmp 0x1404de58e
mov qword [r14], rbx
test rdi, rdi
je 0x1404de4be
test rsi, rsi
jmp 0x1404de4aa
jne 0x1404de4cc
test rdi, rdi
jmp 0x1404de4b8
jne 0x1404de4db
test rsi, rsi
jmp 0x1404de4c6
jne 0x1404de4db
mov eax, 1
jmp 0x1404de4d6
jmp 0x1404de4e1
mov eax, ebx
cmp r9b, 0xcc
test eax, eax
jmp 0x1404de4e8
je 0x1404de476
test rdi, rdi
je 0x1404de4fd
mov word [rdi], bx
movzx ecx, bx
mov rcx, r15
call fcn.1404de5fe
mov r8, rax
test rax, rax
jmp 0x1404de510
je 0x1404de58e
or rax, 0xffffffffffffffff
jmp 0x1404de51f
inc rax
cmp sil, 0x3c
test sil, r11b
cmp word [r8 + rax*2], bx
jmp 0x1404de533
jne 0x1404de51f
inc rax
cmp bh, 0xe5
mov qword [r14], rax
test r12b, 0x51
test rsi, rsi
jmp 0x1404de54e
je 0x1404de58e
cmp rax, rsi
jmp 0x1404de55c
jbe 0x1404de571
mov ebx, 0x22
jmp 0x1404de56c
jmp 0x1404de58e
mov rdx, rsi
mov cl, pe_nt_image_headers64
movsxd rcx, esp
mov rcx, rdi
jmp 0x1404de581
call fcn.1404c77b6
test eax, eax
jne 0x1404de5d8
mov ecx, 0xb
jmp 0x1404de598
call fcn.14025421e
mov eax, ebx
cmp r14w, 0x55de
or bx, 0x7fc7
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
sub di, r15w
rcl r14b, cl
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
sbb r15d, 0x447c40bd
add rsp, 0x30
pop r15
jmp 0x1404de5d7
ret
mov qword [rsp + 0x20], rbx
cmp dl, r15b
xor r9d, r9d
cmc
sub r8d, r8d
clc
sub edx, edx
cmc
sub ecx, ecx
call fcn.1404b37a8
nop
jmp 0x1404de5f8
int3

Function at 0x1401e7920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ax, ax
jmp 0x1401b71c9
je 0x1400e8f9c
mov eax, r8d
shr r8d, 0x1f
clc
cmc
neg eax
cmp r10w, 0x7333
shr eax, 0x1f
sub eax, r8d
ret
jne 0x1400e9bf8
sub rcx, rdx
test dil, dil
jmp 0x1400e8f9c
je 0x1400e9bf8
add rdx, 2
xor r8, r13
dec al
movzx eax, word [rdx]
sub r8d, 0x67764f1f
movzx r8d, word [rcx + rdx]
sub r8d, eax
jmp 0x1400e9bf2
movzx eax, word [rdx]
movzx r8d, word [rcx]
sub r8d, eax
jmp 0x140103279
Function at 0x1402269d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ja 0x1402832a0
mov eax, 0xffd9
jmp 0x14026a18b
lea eax, [rdx - 0x61]
lea r9, [r9 + 2]
cmp ax, 5
jmp 0x140104a0f
movzx edx, word [rcx]
sub r10d, r10d
cmovo r8d, r12d
movsx r9, r9w
mov r8d, r10d
not r9w
movsx r9, bp
mov r9, rcx
jmp 0x14028da25
jne 0x140128b26
mov eax, r8d
jmp 0x140260d5c
ret
jmp 0x14028d9f3
lea eax, [rdx - 0x41]
jmp 0x14028f04c
ja 0x14028d9f6
mov eax, 0xfff9
bts ecx, r14d
movzx rcx, si
add dx, ax
shl r8d, 4
xor cl, r12b
rol cx, 0xe1
movzx cx, dil
movzx ecx, dx
movzx rdx, r8w
sub dx, r12w
ror rdx, cl
add r8d, 0xffffffd0
sal dh, 0x5d
movsxd rdx, ecx
movzx edx, word [r9]
add r8d, ecx
test dx, dx
jmp 0x14023eb50
cmp ax, 5
jmp 0x14028d9e0
Function at 0x1402512cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x1401e1db3
movzx r10d, byte [rdx]
adc r8w, sp
mov r8d, r9d
cmp r12b, 0x2d
clc
stc
sub ecx, ecx
jmp 0x140267ec9
inc rcx
cmp r8d, ecx
jmp 0x1401f7bd4
neg cl
cmp bx, 0x8d1
stc
mov byte [r11 + 7], cl
add r11, 8
add r8d, 0xfffffffc
jmp 0x140127708
jne 0x1400fd67f
movzx eax, byte [r11 + rcx*4 + 2]
cmp al, byte [rdx + 2]
jne 0x1400fd67f
mov byte [r11 + rcx*4 + 3], 0
xchg r10w, r10w
movzx r10d, byte [rdx]
jmp 0x140292766
je 0x1401e1db3
lea ecx, [r9 - 1]
stc
cmp ecx, 3
jb 0x14012770e
mov r8d, r9d
movzx r10w, r13b
sal r10b, cl
and r8d, 0xfffffffc
nop word cs:[rax + rax]
bsr cx, r15w
xor ecx, edx
bsf cx, r13w
movzx ecx, byte [r11]
clc
cmp cl, byte [rdx]
movzx r10d, byte [r11 + 2]
mov cl, 0xde
setne cl
test r11w, 0x39d5
neg cl
cmp r14w, si
clc
mov byte [r11 + 1], cl
cmp r10b, byte [rdx]
xchg cl, cl
setne cl
stc
test rdx, 0x6a0e0686
neg cl
cmc
mov byte [r11 + 3], cl
movzx ecx, byte [r11 + 4]
test ax, r8w
cmc
cmp dl, r13b
cmp cl, byte [rdx]
setne cl
neg cl
mov byte [r11 + 5], cl
btc rcx, 0x99
sbb cl, 0xb6
movzx ecx, byte [r11 + 6]
stc
cmp cl, byte [rdx]
setne cl
jmp 0x140109e04
jne 0x140113035
test r9b, 3
jmp 0x1402046e0
ret
je 0x1401e1db3
cmp byte [r11 + rcx*4], r10b
jmp 0x14020d355
je 0x1401e1db3
and r9d, 3
movzx ax, r8b
lahf
xor ecx, ecx
adc ah, 0x18
movsxd rax, ebx
and al, r15b
nop word cs:[rax + rax]
setg ah
movzx eax, byte [r11 + rcx*2]
test r11d, r11d
cmp al, byte [rdx]
setne al
cmp spl, bpl
cmc
neg al
mov byte [r11 + rcx*2 + 1], al
jmp 0x140226d7c
jne 0x1400fd67f
movzx eax, byte [r11 + rcx*4 + 1]
cmp al, byte [rdx + 1]
jmp 0x14011258c
inc rcx
cmp r9d, ecx
jne 0x140204708
jmp 0x1401e1db3
mov r10, qword [rcx]
cmp r15w, 0xc37
movsxd r11, r12d
mov r11, qword [rcx + 0x18]
rcr r9b, cl
not r9w
mov r9d, dword [r10 + 4]
cmc
imul r9d, dword [r10]
clc
test bpl, 0
cmp r8d, 2
jne 0x14026caba
test r9d, r9d
jmp 0x140112ff8
jmp 0x1401f7bda
test r9d, r9d
jmp 0x1400e0e28
jmp 0x1400fd67f
Function at 0x14025c1fc
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404ae6c6
xor r8d, r8d
mov dx, 0x26d1
movzx dx, ch
lea edx, [r8 + 2]
jmp 0x14025b4a4
mov qword [rsp + 8], rbx
cmc
shl bx, cl
mov dword [rsp + 0x18], r8d
and ebx, 0x4eab7e37
rol bl, cl
movsxd rbx, r11d
mov dword [rsp + 0x10], edx
push rbp
ror bpl, cl
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
cmp r9, rcx
jmp 0x1404ae6f8
test r8d, r8d
jmp 0x1404ae700
jne 0x1404ae786
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404ae716
je 0x1404ae786
mov ecx, 0x5a4d
stc
test dl, r12b
cmp word [rax], cx
jmp 0x1404ae72d
jne 0x1404ae786
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
stc
cmp dword [rcx], 0x4550
jmp 0x1404ae746
jne 0x1404ae786
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1404ae75a
jne 0x1404ae786
cmp dword [rcx + 0x84], 0xe
jmp 0x1404ae76c
jbe 0x1404ae786
cmp dword [rcx + 0xf8], 0
je 0x1404ae786
mov ecx, ebx
call fcn.1404ae596
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lahf
cwd
mov ax, dx
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
movsx r8, di
cdq
mov cl, 0x43
mov qword [rbp - 0x18], rax
movzx rax, si
jmp 0x1404ae7b9
lea r8, [rbp - 0x20]
mov al, r14b
lea rax, [rbp + 0x28]
not dx
jmp 0x1404ae7d0
mov qword [rbp - 0x10], rax
cdqe
lea rdx, [rbp - 0x28]
cdqe
mov eax, 2
movsxd rcx, edi
movzx rcx, ax
setle ch
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1404ae997
cmp dword [rbp + 0x20], 0
jmp 0x1404ae803
je 0x1404ae822
mov rbx, qword [rsp + 0x60]
shr bp, cl
test r14, rdi
xor bp, bx
add rsp, 0x50
pop rbp
jmp 0x1404ae821
ret
mov ecx, ebx
jmp 0x1404ae829
call fcn.1404ae644
int3