joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f792
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x140018080], 0
je 0x14000f7b1
mov edx, 1
jmp 0x14000f8f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
xor ebx, ebx
mov r8, qword [rax + 0x10]
xor eax, eax
mov rdx, qword [r8 + 0x30]
test rdx, rdx
je 0x14000f814
movsxd rcx, dword [rdx + 0x3c]
mov ecx, dword [rdx + rcx + 0x88]
test ecx, ecx
je 0x14000f80c
lea rax, [rcx + rdx]
mov ecx, dword [rax + 0xc]
add rcx, rdx
mov r9d, dword [rcx]
or r9d, 0x20202020
cmp r9d, 0x6c64746e
jne 0x14000f80c
mov ecx, dword [rcx + 4]
or ecx, 0x20202020
cmp ecx, 0x6c642e6c
je 0x14000f81e
mov r8, qword [r8]
mov rbx, rdx
jmp 0x14000f7c6
test rax, rax
jne 0x14000f821
jmp 0x14000f8f0
mov rbx, rdx
mov ebp, dword [rax + 0x1c]
mov esi, dword [rax + 0x24]
xor r10d, r10d
lea r13, [0x140018084]
mov edx, dword [rax + 0x18]
mov eax, dword [rax + 0x20]
add rsi, rbx
add rbp, rbx
lea r11d, [rdx - 1]
add rax, rbx
lea rdi, [rax + r11*4]
add r11, r11
add r11, rsi
mov ecx, dword [rdi]
add rcx, rbx
cmp word [rcx], 0x775a
jne 0x14000f884
mov eax, r10d
inc r10d
lea r12, [r13 + rax*8]
call fcn.14000f76a
mov dword [r12], eax
movzx eax, word [r11]
mov eax, dword [rbp + rax*4]
mov dword [r12 + 4], eax
cmp r10d, 0x1f4
je 0x14000f896
sub rdi, 4
lea rax, [r11 - 2]
cmp rsi, r11
je 0x14000f896
mov r11, rax
jmp 0x14000f84e
mov dword [0x140018080], r10d
lea r11, [0x140018084]
dec r10d
test r10d, r10d
je 0x14000f7a7
lea rax, [0x140018080]
xor edx, edx
lea ecx, [rdx + 1]
mov r8d, dword [rax + 8]
mov rdx, rcx
lea rcx, [r11 + rcx*8]
mov r9d, dword [rcx + 4]
cmp r9d, r8d
jae 0x14000f8e2
mov ebx, dword [rax + 4]
mov esi, dword [rcx]
mov dword [rax + 8], r9d
mov dword [rax + 4], esi
mov dword [rcx], ebx
mov dword [rcx + 4], r8d
add rax, 8
cmp edx, r10d
jb 0x14000f8b9
dec r10d
jmp 0x14000f8a7
mov eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x14000fa69
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3950907
call fcn.14000f8ff
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x14000faac
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x8b19978d
call fcn.14000f8ff
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x14000fcbd
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x88a6285
call fcn.14000f8ff
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret
Function at 0x14000fd00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x14000fd29
cmp word [rcx], 0x5a4d
jne 0x14000fd29
movsxd rdx, dword [rcx + 0x3c]
cmp edx, 0x400
jg 0x14000fd29
call fcn.140007eb0
cmp dword [rax], 0x4550
je 0x14000fd2b
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000fd64
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x19991f17
call fcn.14000f8ff
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x14001026d
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xc85e88a6
call fcn.14000f8ff
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x1400102b0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x8a92015
call fcn.14000f8ff
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
nop
syscall
ret

Function at 0x1400110f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140016e90
mov r8d, 0x1b
mov edx, 1
lea rcx, [0x1410d98e0]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140016e90
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140011160
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1410f19b4]
mov rbx, rcx
test esi, esi
jle 0x140011290
mov rax, qword [0x1410f19b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400111ab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140011235
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140011190
mov rcx, rbx
call fcn.140011bb0
mov rdi, rax
test rax, rax
je 0x1400112b2
mov rax, qword [0x1410f19b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140011cf0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1410f19b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140011297
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14001122e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140011240
add dword [0x1410f19b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1410f19b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001122e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1410d9958]
mov edx, eax
call fcn.1400110f0
nop dword [rax]
xor esi, esi
jmp 0x1400111b8
mov rax, qword [0x1410f19b8]
mov edx, dword [rdi + 8]
lea rcx, [0x1410d9920]
mov r8, qword [rax + rbx + 0x18]
call fcn.1400110f0
mov rdx, rbx
lea rcx, [0x1410d9900]
call fcn.1400110f0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140011820
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1410f1a20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1410f1a00]
test rbx, rbx
je 0x14001187c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140011873
test rsi, rsi
je 0x140011873
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140011858
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140011bb0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1410d9fb0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140011bd0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140011bd8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140011bd0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140011c2d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140011c24
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140011bd0
add rax, 0x28
cmp rax, r9
jne 0x140011c10
xor eax, eax
ret

Function at 0x140011c30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1410d9fb0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140011c4f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140011c58
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140011c4f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140011cf0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1410d9fb0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140011d0f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140011d18
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x14057e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14057e237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14057e0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14057e0c7
add dl, dl
jne 0x14057e0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14057e14e
xor eax, eax
add dl, dl
jne 0x14057e0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14057e205
add dl, dl
jne 0x14057e10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14057e11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14057e128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14057e135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14057e142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14057e0d6
mov eax, 1
add dl, dl
jne 0x14057e15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14057e16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14057e153
sub eax, ebx
mov ebx, 1
jne 0x14057e1a4
mov ecx, 1
add dl, dl
jne 0x14057e186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14057e193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14057e17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14057e0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14057e1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14057e1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14057e1b5
cmp eax, 0x7d00
jae 0x14057e1f3
cmp eax, 0x500
jb 0x14057e1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14057e0d6
cmp eax, 0x7f
ja 0x14057e1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14057e0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14057e22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14057e0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140030240
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rsi, rcx
mov r14, rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140030270
xor eax, eax
add rsp, 0x260
pop r14
pop rsi
pop rbp
ret
mov qword [rsp + 0x288], rbx
lea rax, [rbp + 0x190]
mov qword [rsp + 0x258], rdi
xor r8d, r8d
mov edi, dword [rsi + 8]
or edi, 0x2001f
mov qword [rsp + 0x250], r15
xor r15d, r15d
mov qword [rsp + 0x20], rax
mov r9d, edi
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
mov qword [rbp + 0x190], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x1400302ee
mov ebx, r15d
test rcx, rcx
je 0x1400302d8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rbp + 0x190]
and edi, 0x300
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edi
mov rdi, qword [rsp + 0x258]
test ebx, ebx
jne 0x1400303d4
lea rax, [rbp + 0x198]
mov dword [rbp + 0x180], pe_nt_image_headers64
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x180]
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140030397
nop dword [rax + rax]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140030240
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x1400303d4
lea rax, [rbp + 0x198]
mov dword [rbp + 0x180], pe_nt_image_headers64
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x180]
mov qword [rsp + 0x30], r15
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140030340
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400303af
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
mov qword [rsp + 0x40], rcx
mov rax, qword [rsi]
mov ebx, 0xd
mov dword [rsp + 0x48], r15d
test rax, rax
je 0x1400303d4
mov rdx, r14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
mov r15, qword [rsp + 0x250]
test rcx, rcx
je 0x1400303e7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop r14
pop rsi
pop rbp
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using base64
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403ac799

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403ae29c

Function at 0x1400f70f8
Capabilities:
Access peb ldr_data

Disassembly:
movzx eax, word [0x1400b8f10]
cmc
test ax, ax
jmp 0x14023bea8
je 0x140101a2e
mov word [rcx], ax
add al, r15b
add rcx, 2
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401de395
je 0x1401c6b3a
mov word [rcx], 0
jmp 0x1401c6b3a
movzx r11d, word [r9]
cmp r13, 0x73cc40be
movzx r10d, ax
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x1401acac4
mov r8d, 0x104
jmp 0x1401de287
je 0x140261e74
xor eax, eax
stc
nop word [rax + rax]
jmp 0x140248d91
ret
cmovb r8, rdx
jmp 0x140243761
inc rdx
cmp r14b, cl
test r9b, r9b
test ax, ax
jmp 0x14024ce73
je 0x14024ce83
xor edx, edx
cmova r9, r10
or r9b, 0xfe
lea r9, [0x1400b8f10]
cmp r8, rdx
jmp 0x1400f7d7c
je 0x14027bff3
cmp rdx, 0x104
jmp 0x1401620fe
jmp 0x1401e1379
cmp r8, rax
jmp 0x140261e42
jne 0x1401e138a
sub r8, rdx
test rdi, 0x32607763
test r8, r8
jmp 0x140101a28
je 0x140261e7d
mov word [r10], r11w
movzx r11d, ax
adc r11b, r12b
add r10, 2
inc r11d
movzx r11d, word [r9 + rax*2 + 2]
inc rax
test r11w, r11w
jne 0x140248d91
sub r8, rax
test sil, dl
stc
test r8, r8
je 0x140261e87
mov word [r10], 0
xadd al, r8b
movzx eax, word [0x1400b8f10]
ror r8b, cl
test al, 0x20
xchg r8b, r8b
cmp rdx, 0x104
setns r8b
cmovl r8w, r11w
movzx r8, r13w
mov r8d, 0x104
jmp 0x14028cebe
mov rax, qword gs:[0x30]
shrd r8w, r13w, 0x41
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
bts r9d, esi
movzx r10w, sil
cmp r8, rdx
not r11w
cmovbe r11d, r13d
movzx r11d, r8w
cmovae r8, rdx
mov r9, qword [rax + 0x60]
jmp 0x140110524
cmovb r8, rdx
stc
cmp si, 0x1bb9
test ax, ax
jmp 0x1401e1373
Function at 0x140100afc
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
movsx dx, r9b
movzx edx, r10w
lea edx, [r8 + 2]
jmp 0x1402277c2
jmp 0x1404aff8d
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
movsx ebx, di
push rbp
mov rbp, rsp
clc
rcr bh, cl
sub rsp, 0x50
ror bh, cl
mov ebx, ecx
jmp 0x1404affbb
test r8d, r8d
jmp 0x1404affc3
jne 0x1404b0057
sub ecx, ecx
jmp 0x1404affd0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404affde
je 0x1404b0057
mov ecx, 0x5a4d
test sil, r10b
cmc
cmp word [rax], cx
jmp 0x1404afff5
jne 0x1404b0057
movsxd rcx, dword [rax + 0x3c]
cmc
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jmp 0x1404b000f
jne 0x1404b0057
mov eax, 0x20b
cmp r14, rsi
cmp word [rcx + 0x18], ax
jne 0x1404b0057
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b0033
jbe 0x1404b0057
cmp dword [rcx + 0xf8], 0
jmp 0x1404b0045
je 0x1404b0057
mov ecx, ebx
jmp 0x1404b0052
call fcn.1404afe41
lea rax, [rbp + 0x18]
movsx edx, r11w
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
cqo
movsx r8w, bl
movzx r8d, r13w
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
movsx r8, r10w
jmp 0x1404b0086
mov qword [rbp - 0x18], rax
movsx eax, r13w
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
setg dl
jmp 0x1404b00a2
lea rdx, [rbp - 0x28]
lahf
movsx rcx, dx
xchg al, ch
mov eax, 2
movsx ecx, cx
lea rcx, [rbp - 0x30]
jmp 0x1404b00be
mov dword [rbp - 0x2c], eax
jmp 0x1404b00c6
mov dword [rbp - 0x28], eax
call fcn.1404b026e
cmp dword [rbp + 0x20], 0
jmp 0x1404b00d7
je 0x1404b00fb
mov rbx, qword [rsp + 0x60]
shr bpl, 0x44
add rsp, 0x50
movzx rbp, r11w
movzx ebp, cx
mov bpl, 0x27
pop rbp
jmp 0x1404b00fa
ret
mov ecx, ebx
jmp 0x1404b0102
call fcn.1404afeff
int3

Function at 0x140109140
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x140160b78
jmp 0x14044511f
push rsi
push rdi
sub rsp, 0x28
movsx ax, r13b
cdqe
bt si, 0x8f
mov rsi, rcx
test r14b, 0x67
xor rax, r15
bt eax, 0xb
mov rcx, qword [rcx + 0x18]
adc al, 0xdc
mov rax, qword [rcx]
test ecx, esp
sub edx, edx
test rdx, 0x74783648
xor r8d, r8d
jmp 0x14044515b
call qword [rax + 0x188]
mov edi, eax
setge ch
movzx ecx, r12w
xchg cx, cx
lea rcx, [rsi + 0x30]
jmp 0x140445176
call fcn.140458fae
test edi, edi
jmp 0x140445182
je 0x1404451ba
cmp edi, 0x8899000c
jmp 0x140445193
jne 0x1404451d4
mov rcx, rsi
dec sil
not dil
add rsp, 0x28
bswap di
movzx si, r11b
pop rdi
pop rsi
jmp 0x1404451b5
jmp fcn.140444e04
nop
add rsp, 0x28
pop rdi
movzx si, r11b
movsx esi, di
movsx si, r13b
pop rsi
jmp 0x1404451d3
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
sar dl, 0x6d
mov dl, 3
mov r9d, 0x54
add rsp, 0x28
movzx esi, di
xchg di, si
pop rdi
pop rsi
jmp 0x1404451fc
jmp fcn.1403ae879

Function at 0x1401195be
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
test r11b, 0x9f
cmp bpl, r15b
xor edx, edx
jmp 0x140258bf1
jmp 0x1404aff8d
Function at 0x140192ef6
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
jmp 0x14010c19c
ret
jne 0x1400e9b44
movsxd rdx, dword [rcx + 0x3c]
jmp 0x1401b7b8b
mov eax, 0x5a4d
test r15b, 0x95
test si, r14w
cmp word [rcx], ax
jmp 0x140121429
add rdx, rcx
cmp dword [rdx], 0x4550
jmp 0x140218eb5
ret
jne 0x1400e9b44
xor eax, eax
not al
mov ch, 0x46
mov ecx, 0x20b
rcl al, 0x14
sar al, 0xed
cmp word [rdx + 0x18], cx
sete al
jmp 0x14020b1cd
Function at 0x1401dbe94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x14011513f
movzx r8d, byte [rcx + 2]
mov rax, qword [r9 + 0xf8]
bswap dx
movzx rdx, cx
cqo
lea rdx, [rcx + 2]
jmp 0x140265e89
je 0x1401794ad
mov rax, qword [r9]
movzx r8d, r8w
movsx r8, r10w
mov r8b, 0xb9
nop dword [rax + rax]
mov r8w, r15w
movzx r8d, byte [rcx + 1]
inc rcx
test r14b, 8
test byte [rax + r8*2], 4
jmp 0x1401794a7
jne 0x140137478
movzx eax, r8b
cmp byte [rax + rdx], 0x78
jmp 0x140115134
jne 0x140265ec4
ret
mov byte [rax], r8b
stc
lea rax, [rax + 1]
adc r8w, ax
movzx r8d, cl
cmp r8b, 0x7f
cmp r12b, sil
cmc
test dl, dl
jmp 0x1401b2ad0
mov r9, qword [rdx]
or r8w, si
bswap r8d
bt dx, 0x9e
movzx r8d, byte [rcx]
movzx dx, r8b
mov rdx, qword [r9 + 0x110]
cmp bh, 0x69
test r14b, 0x88
cmc
cmp byte [r8 + rdx], 0x65
jmp 0x140137458
cmovne rdx, rcx
ror ecx, cl
movsx cx, r14b
mov rcx, qword [rax]
not ah
and rax, r15
btr rax, 0xb3
movzx eax, byte [rcx]
movzx rcx, di
mov byte [rdx], al
movzx ax, r13b
lea rax, [rdx + 1]
rcr dl, 0xa
stc
add dl, dil
nop dword [rax]
cmovs ecx, ebx
movzx ecx, byte [rax]
xor dh, bl
movzx dx, r11b
movzx edx, r8b
jmp 0x1401caab1

Function at 0x140205204
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x14010c162
mov ecx, dword [rax + 8]
cmp r15b, dl
add ecx, edx
test sil, 0xc0
cmp r10, rcx
jmp 0x14010c15c
jb 0x1401d3eec
inc r9d
cmp r12, r8
add rax, 0x28
test r13, 0x5d5660da
jmp 0x140250e15
ret
movsxd r8, dword [rcx + 0x3c]
bt rax, rsi
sub r9d, r9d
rcr r10b, 0x47
cbw
add r8, rcx
sal rax, cl
rcl ah, 0x68
or ax, 0x6b05
mov r10, rdx
neg al
movzx eax, sp
movzx eax, word [r8 + 0x14]
movzx r11w, r13b
stc
movzx r11d, word [r8 + 6]
clc
cmp r15w, si
add rax, 0x18
cmp r9, 0x11b92cea
stc
add rax, r8
cmp al, 0x76
stc
test r11d, r11d
jmp 0x1402244ac
je 0x140250e1e
mov edx, dword [rax + 0xc]
jmp 0x14028faa8
cmp r9d, r11d
jb 0x1402244b2
sub eax, eax
jmp 0x1401d3eec
cmp r10, rdx
jmp 0x1400e415e
Function at 0x1403cc32e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
movzx r15w, r10b
bsf r15, r15
push r14
cmp ah, ch
push r13
btc r14w, r12w
cmc
mov r14b, 0xea
push r12
push rsi
btc r15d, 0x8f
push rdi
rcl r12b, 0xde
push rbx
sub rsp, 0x30
cmc
and sil, 0x17
movzx si, r12b
movaps xmmword [rsp + 0x20], xmm6
dec sil
sal rsi, cl
mov r15, r9
rol r12b, cl
shr esi, 0x5d
neg r14w
mov r12, r8
mov r14, rdx
bswap si
cmovb r13, r14
mov r13, rcx
or si, 0x7054
shl rsi, 0x1e
btr esi, r11d
mov rsi, qword [rcx]
cmc
test rsi, rsi
jmp 0x1403cc3a5
je 0x1403cc505
mov rbx, qword [r13 + 8]
jmp 0x1403cc3b8
cmp rsi, rbx
jmp 0x1403cc3c0
je 0x1403cc493
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403cc3d2
jmp 0x1403cc3fd
call fcn.140228090
movups xmmword [rsi + 0x10], xmm6
cmp sp, 0x7955
mov word [rsi], 0
add rsi, 0x20
clc
stc
cmp r15b, 0xe8
cmp rsi, rbx
je 0x1403cc48a
mov rax, qword [rsi + 0x18]
test spl, cl
clc
cmp rax, 8
jb 0x1403cc3dc
mov rcx, qword [rsi]
lea rdx, [rax + rax]
jmp 0x1403cc41b
add rdx, 2
cmp dh, 0x59
cmp rdx, 0x1000
jmp 0x1403cc42e
jb 0x1403cc3d7
mov rdi, qword [rcx - 8]
cmc
test bp, 0x122c
clc
add rcx, 0xfffffffffffffff8
jmp 0x1403cc44d
sub rcx, rdi
clc
test r12b, r13b
cmp rcx, 0x20
jae 0x1403cc57f
lea rax, [rax + rax]
ror ch, 0x1e
add rax, 0x29
bswap dx
movzx rcx, di
mov rdx, rax
jmp 0x1403cc47d
mov rcx, rdi
jmp 0x1403cc485
jmp 0x1403cc3d7
mov rsi, qword [r13]
btc rdx, 0xc1
mov rdx, qword [r13 + 0x10]
cmp r12w, r10w
test bpl, 0x41
sub rdx, rsi
cmp rdx, 0x1000
jmp 0x1403cc4ae
jb 0x1403cc4f8
mov rax, qword [rsi - 8]
clc
add rsi, 0xfffffffffffffff8
test r13b, bpl
test bx, 0x4da6
cmp r14b, r10b
sub rsi, rax
clc
test ebp, eax
jmp 0x1403cc4d3
cmp rsi, 0x20
jae 0x1403cc57f
add rdx, 0x27
movsx rcx, r8w
movsxd rcx, edi
mov rsi, rax
mov ecx, 0x7c8672e8
bswap rcx
jmp 0x1403cc4f8
mov rcx, rsi
jmp 0x1403cc500
call fcn.140228090
mov qword [r13], r14
shl r12, 5
rol si, 0x7b
and esi, r8d
add r12, r14
xchg edi, edi
mov qword [r13 + 8], r12
shl r15, 5
sal r12b, cl
movsx di, cl
cmc
add r15, r14
rcl si, 0x6c
ror di, 0x12
btc si, 0xf8
mov qword [r13 + 0x10], r15
xor r13b, 0x80
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
bswap r13d
pop rbx
pop rdi
cmovp r15w, r10w
movsxd rsi, ebx
pop rsi
cmovno r15w, r9w
movzx r14d, r10w
movzx r13, ax
pop r12
movsxd r13, r14d
pop r13
pop r14
xchg r15d, r15d
mov r15w, r12w
mov r15, 0x563e4cfc
pop r15
ret
call fcn.1404b5029
int3