joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403faf45
Capabilities:
Accept command line arguments

Disassembly:
push rsi
cmp r14, r8
test r13, rbp
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov dword [rsp + 0x3c], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x3c]
movsxd rcx, r10d
mov cx, r9w
jmp 0x1403faf78
mov rcx, rax
jmp 0x1403faf80
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
movsxd r8, dword [rsp + 0x3c]
lea rcx, [rsp + 0x40]
movsx edx, r11w
mov rdx, rax
jmp 0x1403faf9c
call fcn.1403fb247
mov rcx, qword [0x1400b7f10]
cmp r10b, bpl
cmc
test rcx, rcx
je 0x1403fb007
mov rdx, qword [0x1400b7f20]
test cx, r8w
clc
cmc
sub rdx, rcx
cmc
cmp rdx, 0x1000
jb 0x1403fb002
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp bpl, bl
test r8b, 0xa3
sub rcx, rax
clc
stc
cmp rcx, 0x20
jmp 0x1403faff0
jae 0x1403fb23c
add rdx, 0x27
mov rcx, rax
jmp 0x1403fb002
call fcn.140199a77
movaps xmm0, xmmword [rsp + 0x40]
cbw
xchg ah, ah
not al
movups xmmword [0x1400b7f10], xmm0
not rax
mov rax, qword [rsp + 0x50]
jmp 0x1403fb026
mov qword [0x1400b7f20], rax
jmp 0x1403fb032
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
xadd cl, cl
mov qword [rsp + 0x50], 0
xadd cx, cx
sar ecx, cl
mov rcx, qword [0x1400b7f28]
stc
cmc
test rcx, rcx
jmp 0x1403fb05d
je 0x1403fb0d2
mov rdx, qword [0x1400b7f38]
cmc
stc
sub rdx, rcx
test r10, 0xae0004d
cmp dil, 0xc
cmp rdx, 0x1000
jmp 0x1403fb086
jb 0x1403fb0be
mov rax, qword [rcx - 8]
cmp r13b, dil
add rcx, 0xfffffffffffffff8
sub rcx, rax
clc
cmp rcx, 0x20
jmp 0x1403fb0a4
jae 0x1403fb23c
add rdx, 0x27
movzx cx, r10b
movsx ecx, cx
mov rcx, rax
jmp 0x1403fb0be
call fcn.140199a77
mov rcx, qword [rsp + 0x40]
jmp 0x1403fb0cd
jmp 0x1403fb0d5
sub ecx, ecx
xchg edx, eax
lea rax, [rsp + 0x58]
bsf dx, r11w
btc rdx, r14
sbb dl, 0xf9
movups xmm0, xmmword [rsp + 0x58]
shr dh, cl
movups xmmword [0x1400b7f28], xmm0
rcl dl, 0x76
adc dh, 0xcd
sbb dl, 0xf
mov rdx, qword [rsp + 0x68]
mov qword [0x1400b7f38], rdx
stc
jmp 0x1403fb112
movups xmmword [rax], xmm6
test bl, r13b
jmp 0x1403fb120
mov qword [rax + 0x10], 0
test rcx, rcx
jmp 0x1403fb130
je 0x1403fb192
mov rdx, qword [rsp + 0x50]
stc
sub rdx, rcx
cmp rdx, 0x1000
jmp 0x1403fb14b
jb 0x1403fb18d
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
jmp 0x1403fb160
sub rcx, rax
clc
cmp bx, 0x7f9
jmp 0x1403fb16e
cmp rcx, 0x20
jmp 0x1403fb177
jae 0x1403fb23c
add rdx, 0x27
movzx rcx, r11w
mov rcx, rax
jmp 0x1403fb18d
call fcn.140199a77
call fcn.140058130
mov ecx, 0x58
jmp 0x1403fb1a1
call fcn.1403ff177
mov rsi, rax
movzx rcx, r9w
mov cx, si
mov rcx, rax
jmp 0x1403fb1b8
call fcn.140371236
mov qword [0x1400b7f08], rsi
movsx rcx, bx
mov ch, 0xd7
mov rcx, rsi
call fcn.14037182e
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14005e990]
sub ecx, ecx
stc
test ebx, 0x4c7843d2
cmp r14w, 0x3965
sub edx, edx
stc
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x1400b7f08]
jmp 0x1403fb212
call fcn.140149f09
call fcn.1403f0b9c
xor eax, eax
movaps xmm6, xmmword [rsp + 0x70]
add si, 0x67df
add rsp, 0x80
movsxd rsi, r9d
mov sil, bpl
pop rsi
jmp 0x1403fb23b
ret
call fcn.14046c35b
int3
Function at 0x1403fb66c
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx ecx, cx
jmp 0x1403fb678
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp ch, 0xd0
cmp eax, 0x100
jmp 0x1403fb690
setae al
jmp 0x1403fb69c
add rsp, 0x28
ret

Function at 0x1403fcae5
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get ntdll base address

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movsx ax, r11b
not ax
jmp 0x1403fcaf9
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jmp 0x1403fcb06
je 0x1403fcb34
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
xor dl, 0xca
mov dl, 3
bswap r9w
mov r9d, 0x2a
test r15w, r10w
add rsp, 0x28
jmp fcn.14036bb4e
nop
add rsp, 0x28
jmp 0x1403fcb3e
ret
Function at 0x1403ff3d1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub bh, 0xac
rcl rbx, 0xcd
sub rsp, 0x20
bswap rbx
movsx rbx, sp
movzx rbx, cx
mov rbx, rcx
movsx cx, ch
not ch
lea rcx, [0x1400b8358]
jmp 0x1403ff3fe
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx], 0
jmp 0x1403ff40c
jne 0x1403ff42e
or dword [rbx], 0xffffffff
jmp 0x1403ff493
mov ecx, 0x64
jmp 0x1403ff424
call fcn.1403ff55e
jmp 0x1403ff404
cmp dword [rbx], 0xffffffff
jmp 0x1403ff436
je 0x1403ff41a
mov rax, qword gs:[0x58]
shrd edx, r14d, 0xb8
sar ecx, cl
xor cx, 0x77de
mov ecx, dword [0x1400b8390]
movsx rbx, r9w
btc dx, 1
mov r8d, 0x28
movsxd rdx, esp
shrd dx, sp, 0x81
movzx ebx, di
mov rdx, qword [rax + rcx*8]
xchg ecx, ecx
cwde
sbb ax, 0x1085
mov eax, dword [0x1400b6218]
movzx ebx, bp
mov dword [r8 + rdx], eax
neg bx
bts rcx, r12
sal cx, cl
lea rcx, [0x1400b8358]
movsx rbx, r9w
cmova ebx, ebx
test bpl, 6
add rsp, 0x20
movzx ebx, si
movzx rbx, r13w
setno bh
pop rbx
jmp 0x1403ff4b9
push qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ret

Function at 0x1403ff7db
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
test sil, 0x72
cmp word [0x140004000], ax
jne 0x1403ff8f5
movsxd rcx, dword [0x14000403c]
movsx rdx, r10w
not dl
lea rdx, [0x140004000]
stc
lea rcx, [rcx + rdx]
clc
test dx, r10w
cmp dword [rcx], 0x4550
jne 0x1403ff8f5
mov eax, 0x20b
cmp ebp, r8d
cmp word [rcx + 0x18], ax
jmp 0x1403ff833
jne 0x1403ff8f5
sub r8, rdx
cbw
sar ah, cl
adc r9w, 0x6b6e
movzx edx, word [rcx + 0x14]
sub r9b, cl
add rdx, 0x18
adc al, 0xd8
lea rdx, [rdx + rcx]
cmp edi, ebp
movzx eax, word [rcx + 6]
stc
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp r8d, ebp
mov qword [rsp], rdx
cmp bp, r14w
cmp r15, 0x694935d3
test r9w, 0x772e
cmp rdx, r9
jmp 0x1403ff886
je 0x1403ff8ba
mov ecx, dword [rdx + 0xc]
clc
cmp r8, rcx
jb 0x1403ff8ac
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jmp 0x1403ff8a6
jb 0x1403ff8c3
add rdx, 0x28
jmp 0x1403ff8b5
jmp 0x1403ff869
xor edx, edx
cmp r11b, r15b
test ch, 0x1f
cmc
test rdx, rdx
jne 0x1403ff8d3
xor al, al
jmp 0x1403ff8fe
cmp dword [rdx + 0x24], 0
jge 0x1403ff8e9
xor al, al
jmp 0x1403ff8e4
jmp 0x1403ff8fe
mov al, 1
jmp 0x1403ff8f0
jmp 0x1403ff8fe
xor al, al
jmp 0x1403ff8fe
add rsp, 0x18
jmp 0x1403ff907
ret
Function at 0x140400287
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
cdqe
bsf rdi, r14
and qword [rcx + 0x10], 0
lea rax, [0x1400bee38]
shld bx, r11w, 0xb3
movsxd rbx, r13d
xchg rbx, rbx
and qword [rcx + 0x18], 0
cmove edi, ebx
add dil, bpl
neg bl
lea rbp, [0x1400cdcbc]
sub dil, 0x89
bsr rdi, r12
and dword [rcx + 0x20], 0
sar bx, cl
mov rbx, rcx
movzx rdi, bx
shld edi, edx, 0x99
mov qword [rcx], rax
jmp 0x1404002f2
mov rdi, rbp
cmp ecx, r14d
cmc
mov dword [rcx + 8], 1
mov byte [rcx + 0x24], dl
test dil, 0x43
and qword [rcx + 0x28], 0
jmp 0x140400311
mov byte [rcx + 0x30], 0
jmp 0x14040031a
inc rdi
stc
test dx, dx
cmp byte [rdi], 0
jmp 0x140400329
jne 0x14040031a
sub rdi, rbp
jmp 0x140400337
lea rcx, [rdi + 1]
jmp 0x140400340
call fcn.1401c2175
mov qword [rbx + 0x28], rax
cmp dil, 0xc6
test rax, rax
jmp 0x140400355
je 0x140400382
lea r8, [rdi + 1]
xchg cl, dh
mov dh, 0x13
mov cl, r11b
mov rdx, rbp
movzx rcx, r14w
movsx rcx, di
movzx ecx, ax
mov rcx, rax
jmp 0x14040037d
call fcn.140459a26
mov rbp, qword [rsp + 0x38]
add dil, 0xe5
xor ah, 0x26
btc ax, 0x65
mov rax, rbx
sbb dil, dl
btr rdi, 0xd6
mov rbx, qword [rsp + 0x30]
movzx rdi, r12w
adc edi, r11d
add rsp, 0x20
movsx rdi, bx
xchg dil, dil
pop rdi
jmp 0x1404003bb
ret
Function at 0x14040ffd7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
movzx rax, r15w
not rax
mov qword [rsp + 0x18], rsi
push rdi
cmc
ror bh, 0xe4
sub rsp, 0x60
btr eax, 0xf4
mov rax, qword [0x1400b6278]
shl sil, 0x26
bts rsi, r14
movzx di, al
xor rax, rsp
shld bx, dx, 0xab
ror sil, cl
shl dil, 0x74
mov qword [rsp + 0x50], rax
mov rdi, r8
shr bl, cl
movsx bx, r15b
add rsi, r10
mov esi, edx
rcr bx, cl
test r9b, 0x82
mov rbx, rcx
mov qword [rsp + 0x20], rcx
test cx, r13w
cmp cl, r10b
stc
and qword [rsp + 0x30], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
jmp 0x140410056
or r8, 0xffffffffffffffff
jmp 0x14041005f
inc r8
cmp byte [r9 + r8], 0
jmp 0x14041006c
jne 0x14041005f
mov rdx, r9
lea rcx, [rsp + 0x30]
jmp 0x14041007f
call fcn.14040e505
nop
jmp 0x14041008a
mov dword [rsp + 0x20], esi
jmp 0x140410093
mov qword [rsp + 0x28], rdi
jmp 0x14041009d
movaps xmm0, xmmword [rsp + 0x20]
jmp 0x1404100a7
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x30]
bswap dx
setnp dh
lea rdx, [rsp + 0x20]
mov cl, r8b
movsx ecx, ax
mov ch, 0xf0
mov rcx, rbx
jmp 0x1404100ce
call fcn.14040fd0a
nop
movzx cx, ah
lea rcx, [rsp + 0x30]
jmp 0x1404100e2
call fcn.1404013a3
lea rax, [0x1400bf190]
movsxd rcx, r11d
mov qword [rbx], rax
test r8w, 0x7adb
sar ah, 0xd3
test r12b, spl
mov rax, rbx
cmp r11w, di
xor cl, r15b
mov rcx, qword [rsp + 0x50]
test si, 0xdd3
xor rcx, rsp
call fcn.140454a7f
lea r11, [rsp + 0x60]
not bx
mov rbx, qword [r11 + 0x18]
movsxd rdi, eax
mov rsi, qword [r11 + 0x20]
movzx edi, r15w
movsxd rdi, r12d
movsx di, r8b
mov rsp, r11
movsx di, r8b
movsx rdi, si
mov dil, bl
pop rdi
ret

Function at 0x14041197b
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
lea rcx, [rsp + 0x30]
jmp 0x140411989
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
clc
cmc
add rsp, 0x28
jmp 0x14041199f
ret
Function at 0x14041338f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x60
rol dil, cl
setge al
mov rax, qword [0x1400b6278]
xor rax, rsp
bt di, bp
sbb bl, r14b
mov qword [rsp + 0x50], rax
bts bx, r14w
bsf bx, r14w
lahf
mov rax, r8
btc bx, 0x1a
cmp r8, r11
or bx, r15w
mov rdi, rdx
mov rbx, rcx
jmp 0x1404133dd
mov qword [rsp + 0x20], rcx
test di, 0x69c4
clc
stc
and qword [rsp + 0x30], 0
jmp 0x1404133f4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
test rbx, rbp
or r8, 0xffffffffffffffff
inc r8
test cl, bpl
cmp byte [rax + r8], 0
jmp 0x140413414
jne 0x140413404
mov rdx, rax
cmovle cx, si
movzx rcx, r10w
movsx ecx, dx
lea rcx, [rsp + 0x30]
jmp 0x140413432
call fcn.14040e505
nop
movsx rcx, r11w
cmovs r8w, r14w
movups xmm0, xmmword [rdi]
movzx dx, r12b
movsx ecx, r14w
movdqu xmmword [rsp + 0x20], xmm0
mov r8d, esi
lea r8, [rsp + 0x30]
movsx cx, r13b
lea rdx, [rsp + 0x20]
movzx rcx, di
jmp 0x140413473
mov rcx, rbx
jmp 0x14041347b
call fcn.14040fd0a
nop
movsx cx, r15b
lea rcx, [rsp + 0x30]
jmp 0x140413490
call fcn.1404013a3
lea rax, [0x1400bf190]
bt cx, ax
sar ch, 0xd9
mov qword [rbx], rax
bswap rax
mov rax, rbx
shl cx, 0xf5
shrd ecx, esp, 0x73
bts cx, r13w
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
jmp 0x1404134c6
call fcn.140454a7f
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
movzx di, r15b
mov dil, r11b
not dil
pop rdi
jmp 0x1404134e8
ret
Function at 0x1404234cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
clc
stc
mov qword [rax + 0x10], rbp
mov ebp, 0xc7a3d67
bt bp, ax
movzx ebp, cx
mov qword [rax + 0x18], rsi
stc
movzx rbp, sp
mov qword [rax + 0x20], rdi
push r14
movsx ebp, r15w
cmc
sub rsp, 0x20
shl r14b, 0xd4
adc r14, r14
shr r14b, 0x8d
mov rdi, qword [rsp + 0x50]
shr r14b, cl
movzx bp, r14b
mov r14, r9
adc rsi, rdx
mov rsi, r8
bsf rbp, r13
rol bpl, cl
ror bpl, 0xac
mov rbp, rdx
stc
test rdi, rdi
jmp 0x140423536
je 0x140423607
mov rbx, qword [r8 + 8]
test rbx, rbx
je 0x1404235e9
mov rax, qword [rbx + 0x40]
and r8b, r15b
movzx r8d, word [r14]
stc
cmp qword [rax], 0
je 0x1404235a6
mov rax, qword [rbx + 0x58]
clc
jmp 0x14042356d
cmp dword [rax], 0
jmp 0x140423575
jle 0x1404235a6
dec dword [rax]
mov rcx, qword [rbx + 0x40]
movsx eax, dx
not al
mov rdx, qword [rcx]
cwde
nop
lahf
lea rax, [rdx + 2]
jmp 0x140423595
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x1404235a1
jmp 0x1404235d5
mov rax, qword [rbx]
bswap ecx
movsx rcx, r11w
movsx edx, dx
movzx edx, r8w
mov cl, 0xce
mov rcx, rbx
mov rax, qword [rax + 0x18]
jmp 0x1404235c4
call qword [case.0x140480642.0]
movzx r8d, ax
sal eax, 0x79
movsx eax, r8w
mov eax, 0xffff
cmp ax, r8w
jmp 0x1404235e3
jne 0x1404235ec
mov byte [rsi], 1
add r14, 2
test r15, 0x6bff6c90
cmp al, r14b
test cx, di
sub rdi, 1
jne 0x140423540
movups xmm0, xmmword [rsi]
shr rdi, cl
mov rbx, qword [rsp + 0x30]
cmp r8b, 0xca
adc si, dx
btr eax, r11d
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
or r14d, 0x706001ae
shl r14w, cl
movdqu xmmword [rbp], xmm0
jmp 0x140423643
mov rbp, qword [rsp + 0x38]
xor r14b, 0x63
xchg r14b, r14b
sbb r14b, 0xce
add rsp, 0x20
movzx r14d, dx
not r14b
xchg r14d, r14d
pop r14
jmp 0x140423668
ret
Function at 0x140429be1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test spl, 0xd5
mov qword [rax + 8], rbx
sar bx, 0x5d
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movsxd rbp, eax
bsr ebp, r14d
movsx ebx, r15w
mov qword [rax + 0x20], rdi
mov rsi, 0x13e65183
push r14
xor esi, eax
shr r14w, cl
sub rsp, 0x20
mov rsi, r9
test r15b, r15b
mov rbx, r8
mov r14, rdx
dec bp
adc bpl, bl
rcr bp, 0x7a
mov rbp, rcx
stc
test r9, r9
jmp 0x140429c3c
je 0x140429d2f
mov rdi, qword [rdx + 8]
jmp 0x140429c53
test rdi, rdi
jmp 0x140429c5b
je 0x140429d12
mov rax, qword [rdi + 0x40]
bt r8w, 0xf8
ror r8b, 0xf4
movzx r8d, word [rbx]
stc
cmc
cmp r14b, r10b
cmp qword [rax], 0
jmp 0x140429c81
je 0x140429cc8
mov rax, qword [rdi + 0x58]
cmp r10b, 0xdf
cmp dword [rax], 0
jle 0x140429cc8
dec dword [rax]
bswap rdx
mov rcx, qword [rdi + 0x40]
cdqe
cmove ax, dx
mov rdx, qword [rcx]
movsxd rax, r8d
cwde
lea rax, [rdx + 2]
mov qword [rcx], rax
jmp 0x140429cba
mov word [rdx], r8w
jmp 0x140429cc3
jmp 0x140429cfe
mov rax, qword [rdi]
movzx edx, dx
movzx rcx, dx
not dx
movzx edx, r8w
movsx ecx, r8w
bswap cx
mov rcx, rdi
jmp 0x140429ce8
mov rax, qword [rax + 0x18]
jmp 0x140429cf1
call qword [case.0x140480642.0]
movzx r8d, ax
xadd ah, al
mov eax, 0xffff
cmp ax, r8w
jmp 0x140429d0c
jne 0x140429d16
mov byte [r14], 1
add rbx, 2
cmc
jmp 0x140429d20
sub rsi, 1
jmp 0x140429d29
jne 0x140429c53
movups xmm0, xmmword [r14]
btr ebx, r11d
sub ebx, 0x22cc2320
mov rbx, qword [rsp + 0x30]
bts rax, r13
mov rax, rbp
cmovnp rdi, r15
btr di, 0xa9
mov rsi, qword [rsp + 0x40]
shrd rdi, rsp, 0xa
not dil
or r14b, r9b
mov rdi, qword [rsp + 0x48]
bts r14w, r12w
shr r14d, cl
and r14b, 0x89
movdqu xmmword [rbp], xmm0
btc ebp, 0x87
mov rbp, qword [rsp + 0x38]
bswap r14w
btr r14w, di
add rsp, 0x20
movsxd r14, edi
pop r14
jmp 0x140429d98
ret
Function at 0x1404558c0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
cmp sp, 0x1be6
and dword [rsp + 0x30], 0
jmp 0x1404558d3
call fcn.140460a0c
mov r9d, 2
movzx r8, sp
movsx r8d, r13w
movsx rdx, r15w
lea r8, [rsp + 0x30]
movzx cx, r14b
mov rcx, qword [rax + 0x28]
lea edx, [r9 + 0x20]
jmp 0x140455901
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
cmp cl, r15b
cmp r10w, 0xd08
clc
sub ecx, 0x30
je 0x140455960
sub ecx, 1
jmp 0x140455927
je 0x140455951
cmp ecx, 1
je 0x140455942
sub eax, eax
jmp 0x14045593d
jmp 0x140455967
mov eax, 3
jmp 0x14045594c
jmp 0x140455967
mov eax, 1
jmp 0x14045595b
jmp 0x140455967
mov eax, 2
stc
clc
add rsp, 0x28
jmp 0x140455970
ret

Function at 0x140455971
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
cmp bp, sp
test r15, 0x6c71174
jmp 0x14045598a
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
neg sil
cmovl esi, r8d
mov qword [rax + 0x18], rdi
movzx esi, r9w
sub dil, cl
jmp 0x1404559a9
mov qword [rax + 0x20], r14
cmp r11b, 0x60
push r15
ror r15w, cl
sub rsp, 0x30
movsx si, r13b
mov rdi, r9
shl rsi, cl
mov rsi, rdx
inc r14w
sub rsi, rcx
sub rdi, r8
cmove r15d, edi
shl r15w, 0x9b
mov r15, rcx
xor r14b, sil
sar rsi, 1
mov rcx, qword [rsp + 0x60]
or r14b, 0xea
xor ebx, ebx
bsr r14d, ebp
sar rdi, 1
shld r14w, cx, 0x47
mov r14, r8
clc
cmp r13w, bp
cmp rdi, 0x30420e6f
test rcx, rcx
jmp 0x140455a14
jne 0x140455a2d
call fcn.140460a0c
mov rcx, qword [rax + 8]
jmp 0x140455a28
jmp 0x140455a32
mov rcx, qword [rcx + 8]
clc
test rcx, rcx
jne 0x140455aec
cmp esi, edi
mov eax, 0xc835927
movsxd rax, esi
mov eax, edi
mov rcx, rsp
cmovl eax, esi
rcr cl, 0xdc
movsxd rcx, eax
btr eax, edx
bswap ax
inc rax
mov eax, 1
cmc
stc
test rcx, rcx
jmp 0x140455a6b
je 0x140455aa8
sub r15, r14
cmove dx, bx
bts dx, r11w
movzx edx, word [r15 + r14]
cmp dx, word [r14]
jmp 0x140455a8b
jne 0x140455aca
add r14, 2
jmp 0x140455a9a
sub rcx, rax
jmp 0x140455aa2
jne 0x140455a7d
cmp esi, edi
jmp 0x140455aaf
je 0x140455ae0
or ecx, 0xffffffff
test r11b, cl
cmp esi, edi
cmovl eax, ecx
jmp 0x140455ac5
jmp 0x140455b47
sbb ebx, ebx
test esi, r14d
and ebx, 0xfffffffe
add ebx, eax
movzx rax, r11w
movsx rax, bx
movzx eax, r9w
mov eax, ebx
jmp 0x140455ae7
jmp 0x140455b47
mov dword [rsp + 0x28], edi
mov r9d, esi
cwd
movsx dx, dl
mov r8, r15
mov dh, 0x71
mov qword [rsp + 0x20], r14
setnp dh
movzx edx, ax
mov edx, 0x1000
jmp 0x140455b14
call fcn.140456e17
test eax, eax
jmp 0x140455b20
jne 0x140455b3f
call fcn.14046b6b3
mov dword [rax], 0x16
lahf
setg ah
mov eax, 0x7fffffff
jmp 0x140455b47
sub eax, 2
mov r15b, 0x36
dec bh
mov rbx, qword [rsp + 0x40]
sar edi, cl
mov edi, edx
mov rsi, qword [rsp + 0x48]
movzx r14w, al
movsx r14, bp
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
mov r15d, ebp
pop r15
jmp 0x140455b76
ret
Function at 0x1404574c8
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x20
movsx ax, r12b
btc eax, 0x56
ror ebx, cl
mov rax, qword [0x1400b6278]
or ebx, 0x2f43136d
sal bl, 0xf
test r14w, 0xa8d
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x140457508
jne 0x1404575dd
and qword [rbp + 0x18], 0
movzx ecx, di
movzx rcx, r9w
movsxd rcx, edx
lea rcx, [rbp + 0x18]
jmp 0x140457526
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x140457535
mov qword [rbp + 0x10], rax
jmp 0x14045753e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
clc
xor qword [rbp + 0x10], rax
jmp 0x140457550
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
sbb ecx, 0x17c40bbf
btc cx, 0x88
sal cl, 1
lea rcx, [rbp + 0x20]
test r15b, sil
xor qword [rbp + 0x10], rax
jmp 0x140457575
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
jmp 0x140457583
lea rcx, [rbp + 0x10]
jmp 0x14045758c
shl rax, 0x20
test r15d, 0x24ec6a5e
xor rax, qword [rbp + 0x20]
clc
xor rax, qword [rbp + 0x10]
cmc
xor rax, rcx
movabs rcx, 0xffffffffffff
rcl bpl, 0x79
cmc
mov bpl, r11b
and rax, rcx
cmp r14b, dl
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
cmove rax, rcx
bswap ebx
sal rbp, cl
bt ebp, 0xf6
mov qword [0x1400b6278], rax
mov rbx, qword [rsp + 0x48]
movzx bp, r12b
xchg bp, bp
not rax
ror bpl, cl
mov qword [0x1400b6270], rax
jmp 0x1404575fc
add rsp, 0x20
movzx ebp, r10w
mov bp, bp
pop rbp
ret
Function at 0x14046347d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
movsx ebx, r13w
mov qword [rsp + 0x18], rsi
sar bx, cl
rcr ah, cl
push rdi
inc ah
sub rsp, 0x50
mov rax, qword [0x1400b6278]
xor rax, rsp
sub rbx, r8
mov qword [rsp + 0x40], rax
rcl ebx, 0xe0
cmp byte [rcx + 0x54], 0
movsx rbx, r14w
mov rbx, rcx
jmp 0x1404634bc
je 0x1404635a9
cmp dword [rcx + 0x50], 0
jle 0x1404635a9
mov rsi, qword [rcx + 0x48]
add cl, 0xe4
add rax, rbp
xor edi, edi
mov rax, qword [rbx + 8]
and cl, 0xae
lea rdx, [rsp + 0x34]
sbb cl, r10b
add r9b, 0x30
movzx r9d, word [rsi]
test r12w, 0x1779
movsx ecx, cx
cmp cl, bl
lea rcx, [rsp + 0x30]
adc r8w, r8w
movzx r8w, r14b
and dword [rsp + 0x30], 0
movzx r8, r9w
mov r8b, r9b
lea rsi, [rsi + 2]
movsx r8w, bpl
mov r8d, 6
jmp 0x140463528
mov qword [rsp + 0x20], rax
jmp 0x140463532
call fcn.140485b24
test eax, eax
jne 0x1404635a0
mov r8d, dword [rsp + 0x30]
cmp r15, rsp
cmp r14w, 0x7b6a
test r9d, 0x48c52498
test r8d, r8d
je 0x1404635a0
lea rax, [rbx + 0x10]
movzx edx, r8w
not rdx
lea r9, [rbx + 0x28]
xchg dl, cl
bswap ecx
cdq
mov qword [rsp + 0x20], rax
lea rcx, [rbx + 0x468]
lea rdx, [rsp + 0x34]
jmp 0x140463587
call fcn.140461907
inc edi
test r15b, r14b
cmc
cmp edi, dword [rbx + 0x50]
jne 0x1404634d8
jmp 0x1404635e1
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404635e1
mov r8d, dword [rbx + 0x50]
test r10b, spl
sub r9b, dl
lea rax, [rcx + 0x10]
bsf r9d, ebp
inc rdx
mov rdx, qword [rbx + 0x48]
lea r9, [rcx + 0x28]
add rcx, 0x468
jmp 0x1404635d2
mov qword [rsp + 0x20], rax
jmp 0x1404635dc
call fcn.140461907
mov al, 1
shld rcx, r9, 0x28
mov rcx, qword [rsp + 0x40]
test bp, 0x489a
clc
xor rcx, rsp
jmp 0x1404635fb
call fcn.140454a7f
mov rbx, qword [rsp + 0x68]
bsr edi, r12d
cmova di, r8w
sub rsi, rsi
mov rsi, qword [rsp + 0x70]
sal di, 0xca
btc edi, 0x7a
add rsp, 0x50
mov dil, cl
pop rdi
jmp 0x14046362b
ret
Function at 0x140466d9b
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x140466daa
mov qword [rsp + 0x10], rsi
rcr si, 0x4b
push rdi
rcl dil, cl
sub rsp, 0x30
rcr dil, 0x1e
xchg esi, esi
mov edi, edx
mov rsi, rcx
test r8, r8
jmp 0x140466dce
jne 0x140466df5
call fcn.14046b6b3
mov dword [rax], 0x16
jmp 0x140466de4
call fcn.14046c324
sub eax, eax
jmp 0x140466df0
jmp 0x140466edb
mov rdx, r9
not cx
movzx rcx, ax
mov cl, r10b
mov rcx, r8
jmp 0x140466e0a
call fcn.140466f39
mov rbx, rax
test rax, rax
jmp 0x140466e1a
je 0x140466e8e
lea rax, [rsp + 0x50]
movzx edx, bx
bswap r9w
mov rdx, rdi
cmovg r9d, r15d
not cl
mov qword [rsp + 0x28], rax
not r9b
lea r8, [0x14009454c]
cmovge ecx, esi
cbw
mov eax, dword [rsp + 0x60]
movsx ecx, r15w
bswap r9w
mov r9b, 0x6c
mov r9, rbx
movzx cx, dh
movzx rcx, r12w
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x140466e7b
jne 0x140466ef7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14046b725
sub edi, edi
test rbx, rbx
je 0x140466ed1
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140466eac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jmp 0x140466eb8
je 0x140466ec4
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x140466ecc
call fcn.14047e5e7
mov rax, rdi
add rdi, 0x4a7e1a6a
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
stc
add rsp, 0x30
not dil
xchg di, di
pop rdi
jmp 0x140466ef6
ret
mov rcx, qword [rsp + 0x68]
clc
test rcx, rcx
jmp 0x140466f05
je 0x140466f19
mov eax, dword [rsp + 0x50]
cmp r13b, 0x4c
test rdi, r13
mov dword [rcx], eax
stc
xor ebx, ebx
jmp 0x140466f20
jmp 0x140466e90

Function at 0x1404671f0
Capabilities:
Terminate process

Disassembly:
push rbx
movzx rbx, si
movzx bx, r8b
sub rsp, 0x20
movsx ebx, di
jmp 0x14046720b
mov ebx, ecx
call fcn.140487ae1
cmp eax, 1
jmp 0x14046721a
je 0x140467265
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
test r8, 0x2eea5b7b
shr edx, 8
cmc
test dl, 1
jmp 0x140467242
jne 0x140467265
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
cwd
jmp 0x140467258
mov edx, ebx
jmp 0x14046725f
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x14046726c
call fcn.14046713d
mov ecx, ebx
jmp 0x140467278
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404682c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jmp 0x1404682df
jle 0x1404683c0
mov dword [rsp + 0x18], r8d
mov r8d, r10d
cmp r8d, ebx
rol r8b, cl
mov qword [rsp + 0x20], r9
rol r8d, 0xf9
ror r8b, cl
push rbx
rcr r8b, cl
bsr r8d, r12d
push rbp
adc bpl, bl
push rsi
sub si, 0x381b
xor r8, r12
push rdi
sub rsp, 0x38
add di, ax
lea rdi, [rsp + 0x78]
sbb bpl, 0x56
and r8b, 0xd5
movzx rsi, bp
xor ebx, ebx
bsf bp, sp
add rdi, 0xfffffffffffffff8
movzx rsi, si
mov rsi, rdx
sets bpl
movsx edx, sp
jmp 0x14046834a
mov rbp, rcx
cqo
xchg ch, ch
seta cl
lea rdi, [rdi + 8]
mov rdx, rsi
movsx cx, bpl
bswap r8w
movzx cx, r8b
mov r8, qword [rdi]
movzx ecx, dx
xchg cx, cx
mov ecx, 0x48fe65ab
mov rcx, rbp
call fcn.14048993c
test eax, eax
jmp 0x140468386
jne 0x1404683c1
inc ebx
cmp ebx, dword [rsp + 0x70]
jmp 0x140468397
jl 0x140468354
add rsp, 0x38
movsx rbp, si
mov rsi, 0x2ff62c0
pop rdi
xchg rbx, rsi
pop rsi
pop rbp
mov bh, 0x3e
xchg bh, bh
mov bl, r12b
pop rbx
jmp 0x1404683c0
ret
and qword [rsp + 0x20], 0
test r10w, r13w
cmp bx, r15w
xor r9d, r9d
sub r8d, r8d
sub edx, edx
cmp ah, 0x55
xor ecx, ecx
jmp 0x1404683e1
call fcn.14046c3bb
int3