joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403b76b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
jmp 0x1403b76c6
push r14
cmp r14b, bl
push r12
bts r12d, edx
xadd r12b, r12b
push rsi
sal r12d, 0x99
and r12b, 0xb8
shl r12w, cl
push rdi
sub r12b, 0x45
bsr r12w, r9w
push rbx
cmc
sub rsp, 0x28
mov r12, r8
cmp sp, 0x63b
test rdx, rdx
je 0x1403b78f9
mov r15, rdx
mov rbx, rcx
cmc
clc
jmp 0x1403b7710
sub esi, esi
jmp 0x1403b7717
jmp 0x1403b775f
mov rcx, rdi
movzx edx, r13w
mov rdx, r14
call fcn.1403b54bc
mov eax, dword [rbx + rsi + 0x58]
mov dword [r12 + rsi + 0x58], eax
bts ax, r9w
rcr ah, 0xc
dec eax
mov rax, qword [rbx + rsi + 0x50]
cmp r15b, 0x75
clc
mov qword [r12 + rsi + 0x50], rax
add rsi, 0x60
dec r15
jmp 0x1403b7759
je 0x1403b78ea
mov eax, dword [rbx + rsi + 8]
mov dword [r12 + rsi + 8], eax
cmp r12, rbx
jmp 0x1403b7770
je 0x1403b772b
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403b7781
jb 0x1403b7791
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403b77aa
lea r9, [rbx + rsi]
bswap ax
cbw
movsx ax, r11b
add r9, 0x10
test r10, 0x86b688f
lea r14, [r12 + rsi]
rcl al, 0x34
add r14, 0x10
test r15b, 0xb9
mov rdi, qword [rbx + rsi + 0x20]
movzx eax, bp
mov rax, qword [r12 + rsi + 0x28]
cmp dx, cx
cmc
cmp rax, rdi
jae 0x1403b77e8
mov rcx, r14
mov rdx, rdi
jmp 0x1403b77de
call fcn.1403b54bc
jmp 0x1403b7833
cmp rax, 0x10
jmp 0x1403b77f1
jb 0x1403b7802
mov r14, qword [r12 + rsi + 0x10]
cdq
movsx dx, r11b
mov qword [r12 + rsi + 0x20], rdi
jmp 0x1403b7810
mov rcx, r14
mov rdx, r9
movzx r8d, r8w
seto r8b
mov r8b, r14b
mov r8, rdi
jmp 0x1403b7829
call fcn.14049d2da
mov byte [r14 + rdi], 0
mov r14, qword [rbx + rsi + 0x40]
stc
cmp qword [rbx + rsi + 0x48], 0x10
jmp 0x1403b7844
jb 0x1403b7859
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403b7854
jmp 0x1403b786d
lea r9, [rbx + rsi]
adc di, bx
shrd ax, r14w, 0x8a
rcl dil, cl
add r9, 0x30
lea rdi, [r12 + rsi]
xor al, 0xe1
sar eax, 0x4a
mov al, r9b
add rdi, 0x30
btr ax, 0xa9
rol al, cl
mov rax, qword [r12 + rsi + 0x48]
cmc
cmp rax, r14
jb 0x1403b771c
cmp rax, 0x10
jmp 0x1403b789c
jb 0x1403b78ac
mov rdi, qword [r12 + rsi + 0x30]
movsx dx, r14b
mov qword [r12 + rsi + 0x40], r14
cmovs cx, r14w
not edx
movzx r8, di
mov rcx, rdi
jmp 0x1403b78cd
mov rdx, r9
xchg r8d, r8d
mov r8, r14
call fcn.14049d2da
mov byte [rdi + r14], 0
jmp 0x1403b78e5
jmp 0x1403b772b
add r12, rsi
sal si, 0x3e
jmp 0x1403b78f9
mov rax, r12
add rsp, 0x28
pop rbx
movzx r15d, si
pop rdi
movzx r14d, bp
movzx r14, r14w
pop rsi
setne r15b
bswap r12w
jmp 0x1403b791c
pop r12
movsxd r14, edi
pop r14
sets r15b
bswap r15d
jmp 0x1403b792f
pop r15
jmp 0x1403b7936
ret
Function at 0x1403bb626
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
shl eax, 0x75
test r15, r11
push rbx
test r14b, r12b
shl sil, cl
rcr si, 0x67
sub rsp, 0x20
rol ax, 0x9a
btc rax, rax
bswap rsi
mov rsi, rcx
sal al, cl
cmp r10, 0x4e4c6fce
shld eax, ebx, 0xf4
lea rax, [0x1400bdab0]
stc
mov qword [rcx], rax
mov rax, qword [rcx + 0x88]
cmp r15d, ebx
cmp rax, 8
jmp 0x1403bb676
jb 0x1403bb6eb
mov rcx, qword [rsi + 0x70]
not dl
movzx edx, dx
bsr dx, bx
lea rdx, [rax + rax]
test r15d, r10d
clc
add rdx, 2
cmp rdx, 0x1000
jmp 0x1403bb6a1
jb 0x1403bb6e6
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
clc
test r13b, dl
jmp 0x1403bb6bb
cmp rcx, 0x20
jae 0x1403bb83a
lea rax, [rax + rax]
add rax, 0x29
not cl
mov rdx, rax
movzx cx, dil
movzx ecx, r12w
movsxd rcx, r11d
mov rcx, rbx
jmp 0x1403bb6e6
call fcn.140117612
movaps xmm0, xmmword [0x1400bd3f0]
xor dil, r12b
movups xmmword [rsi + 0x80], xmm0
shr bx, cl
mov word [rsi + 0x70], 0
sal bx, 0x38
lea rax, [0x1400bdb70]
mov qword [rsi], rax
mov rdi, qword [rsi + 0x40]
mov rbx, qword [rsi + 0x48]
cmp rdi, rbx
jmp 0x1403bb723
jne 0x1403bb73b
jmp 0x1403bb78a
add rdi, 8
cmp rdi, rbx
je 0x1403bb76d
mov rcx, qword [rdi]
test dil, 0x19
clc
test rcx, rcx
jmp 0x1403bb74b
je 0x1403bb72e
mov rax, qword [rcx]
cqo
cwd
mov edx, 1
jmp 0x1403bb762
call qword [rax + 0xb8]
jmp 0x1403bb72e
mov rdi, qword [rsi + 0x40]
cmp r14b, 0x6a
cmc
stc
cmp rdi, qword [rsi + 0x48]
jmp 0x1403bb780
je 0x1403bb78a
mov qword [rsi + 0x48], rdi
test rdi, rdi
je 0x1403bb812
mov rdx, qword [rsi + 0x50]
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403bb7a6
jb 0x1403bb7e1
mov rax, qword [rdi - 8]
jmp 0x1403bb7b9
add rdi, 0xfffffffffffffff8
stc
sub rdi, rax
stc
cmp rdi, 0x20
jmp 0x1403bb7cb
jae 0x1403bb83a
add rdx, 0x27
mov rdi, rax
bts ecx, esp
adc cl, r9b
xadd ecx, ecx
add rsi, 0x40
movsx rcx, di
movsx cx, ah
mov rcx, rdi
jmp 0x1403bb7f5
call fcn.140117612
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
sal rdi, cl
mov qword [rsi + 0x10], 0
bts si, di
dec dil
add rsp, 0x20
mov rsi, rsp
setne dil
jmp 0x1403bb822
pop rbx
xchg si, si
jmp 0x1403bb82b
pop rdi
movzx si, r9b
mov esi, edi
pop rsi
jmp 0x1403bb839
ret
call fcn.1404afd2c
int3
Function at 0x1403d0706
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
bswap eax
push rsi
cbw
push rdi
cmp r13d, 0x3d321774
rcl si, cl
push rbx
shl ah, cl
sub rsp, 0x28
movzx rax, bx
setg al
mov rsi, rcx
lea rax, fcn.140010f00
stc
cmp r15w, di
mov qword [rcx], rax
lea rax, fcn.140010f00
test r14, r9
mov qword [rcx + 0x50], rax
test r10w, si
clc
mov rcx, qword [rcx + 0xa0]
test rcx, rcx
je 0x1403d07df
mov rdx, qword [rsi + 0xb0]
sub rdx, rcx
cmp r13d, esp
stc
cmp rdx, 0x1000
jmp 0x1403d0775
jb 0x1403d07b9
mov rax, qword [rcx - 8]
test r8w, 0x5a61
add rcx, 0xfffffffffffffff8
cmc
clc
sub rcx, rax
cmc
cmp r15b, 0x3c
cmp rcx, 0x20
jmp 0x1403d079c
jae 0x1403d08e8
add rdx, 0x27
jmp 0x1403d07af
mov rcx, rax
movsx rdi, r15w
movsx edi, ax
lea rdi, [rsi + 0xa0]
call fcn.140117612
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
clc
mov qword [rdi + 0x10], 0
test bpl, bpl
sar dil, 0x47
rol di, 0xaa
mov rdi, qword [rsi + 0x60]
cmp r13b, 0x77
test rdi, rdi
jmp 0x1403d07ef
je 0x1403d08b7
lea r14, [rsi + 0x60]
sar ebx, cl
shr ebx, 0x1d
movzx ebx, r11w
mov rbx, qword [rsi + 0x68]
cmp rdi, rbx
jmp 0x1403d080e
je 0x1403d084a
nop dword [rax]
movzx cx, r14b
mov rcx, rdi
jmp 0x1403d0825
call fcn.1403b0811
add rdi, 0x110
cmp r13w, r11w
cmp rdi, rbx
jne 0x1403d081d
mov rdi, qword [r14]
cmp r12b, r12b
cmp r14w, 0x58f9
mov rdx, qword [rsi + 0x70]
stc
cmc
cmp rbp, rdi
sub rdx, rdi
test r11b, bl
cmp rdx, 0x1000
jmp 0x1403d0865
jb 0x1403d089b
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
test r14w, cx
sub rdi, rax
stc
cmp rdi, 0x20
jmp 0x1403d0884
jae 0x1403d08e8
add rdx, 0x27
bswap di
movzx rdi, r11w
movsxd rdi, ecx
mov rdi, rax
mov rcx, rdi
call fcn.140117612
xorps xmm0, xmm0
movups xmmword [r14], xmm0
movzx ebx, r15w
mov qword [r14 + 0x10], 0
cmc
mov rcx, rsi
xor dil, r9b
shr r14b, 0x9e
cmp esp, edx
add rsp, 0x28
xchg edi, ebx
setae sil
pop rbx
pop rdi
movsx r14, ax
movsxd r14, ebx
movzx r14w, r14b
pop rsi
pop r14
jmp 0x1403d08e3
jmp fcn.14043ab88
call fcn.1404afd2c
int3
Function at 0x1403da261
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov r10b, 0x97
sar r9b, cl
push rdi
push rbx
rcr r9w, 0x3c
test al, 0xf6
sub r10w, 0x3dbf
mov r9, rcx
btc r10w, 0xbc
xor r10w, 0x7e62
add r8, rdx
sbb r10d, 0x4c383f23
and r10, rax
mov dword [rcx + 8], 0
and r10w, r8w
inc r10w
xor eax, eax
movsx r10, r12w
neg r10b
xadd r10b, r10b
sub ecx, ecx
btc r10w, 0x2a
bsr r10w, r10w
btr r10d, 0x79
nop word cs:[rax + rax]
xor r10b, 0x63
rcl r10b, 0x61
rol r10b, 0x82
lea r10, [rdx + 1]
stc
cmp r9d, r10d
cmp r10, r8
jmp 0x1403da2e9
ja 0x1403da54a
movzx edi, byte [rdx]
and dx, 0x579e
shr dx, 0x7c
mov edx, edi
cmp r15, 0x68f2027a
jmp 0x1403da309
and edx, 0x7f
cmp r11b, 0x5f
cmc
shl rdx, cl
cmp r12b, r14b
add rax, rdx
cmc
add rcx, 7
sub rdx, 0x4bb14ccd
mov rdx, r10
cmp bl, r15b
cmp rbp, 0x784d2b15
test dil, dil
jmp 0x1403da33b
js 0x1403da2d9
mov rcx, rax
and rcx, 0xfffffffffffffff8
and eax, 7
cmp rcx, 8
jmp 0x1403da354
je 0x1403da490
cmp rax, 1
jmp 0x1403da363
jg 0x1403da389
test rax, rax
jmp 0x1403da371
je 0x1403da433
cmp eax, 1
jne 0x1403da54a
lea rdx, [r10 + 8]
jmp 0x1403da47a
cmp eax, 5
jmp 0x1403da391
je 0x1403da471
cmp eax, 2
jmp 0x1403da39f
jne 0x1403da54a
mov rsi, r10
xor edi, edi
shl al, cl
xchg ah, ah
xor ecx, ecx
mov eax, 0xe0a7c0c
nop word cs:[rax + rax]
bswap ax
lea rax, [rsi + 1]
clc
cmp rdi, r11
cmp rax, r8
ja 0x1403da54a
mov r11, rdi
movzx ebx, byte [rsi]
bsr edx, ebp
ror dl, 0x74
mov edx, ebx
btr si, dx
and edx, 0x7f
shl rdx, cl
sar esi, cl
stc
lea rdi, [rdi + rdx]
adc sil, 0x93
add sil, bpl
add rcx, 7
inc sil
rcl sil, 0xb5
mov rsi, rax
stc
test bl, bl
js 0x1403da3c3
lea rdx, [rdx + r11]
lea rdx, [rdx + rax]
cmp r11b, 0x95
test r8b, 0xfe
stc
cmp rdx, r8
cmova rdx, rax
jmp 0x1403da42e
jmp 0x1403da2a2
mov rax, r10
test sil, r15b
rcl dh, cl
nop
rcr dx, 0x9e
lea rdx, [rax + 1]
jmp 0x1403da44d
cmp rdx, r8
jmp 0x1403da455
ja 0x1403da54a
cmp byte [rax], 0
jmp 0x1403da463
mov rax, rdx
js 0x1403da441
jmp 0x1403da2a2
lea rdx, [r10 + 4]
test dx, 0x5b44
cmp rdx, r8
jmp 0x1403da482
cmova rdx, r10
jmp 0x1403da48b
jmp 0x1403da2a2
cmp eax, 2
jmp 0x1403da498
jne 0x1403da54a
mov dword [r9 + 8], 2
mov rsi, r10
jmp 0x1403da4ae
sub eax, eax
rcl dx, cl
cmp r12w, si
xor ecx, ecx
xchg dh, dl
cmp ch, 0xb3
nop word [rax + rax]
btr rdx, r12
cqo
lea rdx, [rsi + 1]
cmp rdx, r8
jmp 0x1403da4d6
ja 0x1403da54a
movzx r11d, byte [rsi]
rcr esi, cl
cmp r14w, r13w
mov edi, r11d
bt si, 0xb1
shr si, 0x70
and edi, 0x7f
bsf rsi, r10
movzx rsi, r11w
shl rdi, cl
xchg si, si
sal si, cl
lea rax, [rax + rdi]
rcr sil, 0x7d
btc rsi, 0xae
add rcx, 7
xchg sil, sil
mov rsi, rdx
test r11b, r11b
jmp 0x1403da525
js 0x1403da4ca
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], rax
clc
lea rdx, [rdx + rax]
cmc
cmp bl, 0x31
cmp rdx, r8
jmp 0x1403da544
jbe 0x1403da2a2
cmp r10, r8
seta al
mov di, bp
bswap di
pop rbx
mov sil, r14b
movsx di, spl
setl sil
pop rdi
movsxd rsi, esp
movzx si, spl
movsx rsi, r15w
pop rsi
jmp 0x1403da576
ret
Function at 0x14042598e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
shr sil, 0xeb
movzx esi, dx
bsr esi, edx
push rdi
test dl, spl
cmc
test r13, 0xe14574
sub rsp, 0x28
cmovp si, di
movzx esi, r11w
mov rsi, rcx
movzx edi, dx
movzx edx, word [rcx + rdi*4 + 0x834]
test dx, dx
jmp 0x1404259c7
js 0x1404259da
mov rcx, rsi
jmp 0x1404259d5
call fcn.14042598e
movsxd rcx, dword [rsi + 0x8860]
test dh, 1
cmp ecx, dword [rsi + 0x8858]
jmp 0x1404259ef
jge 0x140425b96
movsxd rax, dword [rsi + 0x885c]
stc
lea rax, [rax + rcx]
adc ch, cl
jmp 0x140425a08
mov r8, qword [rsi + 8]
xor edx, 0x35a3cca
lea edx, [rax + 3]
btr ecx, r11d
test eax, eax
bswap ecx
not cx
cmovns edx, eax
xchg ch, ch
mov rcx, qword [rsi + 0x18]
stc
sar edx, 2
jmp 0x140425a38
movsxd rdx, edx
test di, 0x304
mov byte [rcx + rdx], 1
add dh, 0x2c
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
test r10w, r8w
cmp r13b, 0x3b
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x140425a68
jb 0x140425abc
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
bswap rcx
cmovl cx, cx
movzx ecx, byte [rdx + rdi*4 + 1]
clc
cmc
mov byte [r8 + rax + 1], cl
cmp al, 0xdb
movzx ecx, byte [rdx + rdi*4]
cmp rcx, r8
jmp 0x140425a98
mov byte [r8 + rax + 2], cl
or cl, spl
movsx rcx, r9w
or ecx, 0x336c1aaf
movzx ecx, byte [rdx + rdi*4 + 3]
mov byte [r8 + rax + 3], cl
sar al, 0xd5
not eax
xadd ah, al
mov eax, dword [rsi + 0x885c]
cmp r13d, r14d
add eax, 4
cmp dil, 9
clc
mov dword [rsi + 0x885c], eax
cmp eax, dword [rsi + 0x8854]
jmp 0x140425ade
jl 0x140425b96
mov ecx, dword [rsi + 0x884c]
and al, dil
movsx rax, bp
rcl ah, 0xce
mov eax, dword [rsi + 0x8858]
test si, r11w
mov dword [rsi + 0x885c], ecx
or cx, dx
sub cl, 0x89
shl ch, cl
mov ecx, dword [rsi + 0x8860]
test r11w, 0x6181
add ecx, dword [rsi + 0x8844]
mov dword [rsi + 0x8860], ecx
test r9b, 0xa3
clc
cmp ecx, eax
jmp 0x140425b30
jl 0x140425b96
mov ecx, dword [rsi + 0x8840]
clc
cmc
nop dword [rax]
cmc
clc
test ecx, ecx
jmp 0x140425b4e
jle 0x140425b96
mov edx, dword [rsi + 0x8864]
cmp r8w, 0x4a9
shl edx, cl
jmp 0x140425b6d
mov dword [rsi + 0x8844], edx
test r13w, bx
cmc
sar edx, 1
add edx, dword [rsi + 0x8850]
mov dword [rsi + 0x8860], edx
dec ecx
mov dword [rsi + 0x8840], ecx
cmp edx, eax
jge 0x140425b47
add rsp, 0x28
movsx si, spl
setbe dil
cmovae rdi, r11
pop rdi
cmovle si, r10w
movzx rsi, r10w
jmp 0x140425bb6
pop rsi
ret
Function at 0x140439b76
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sal ax, 0xf0
push r14
and al, r13b
shr ah, cl
movzx ax, bl
push rsi
bsf ax, r15w
push rdi
sar r14b, cl
cmp bh, 0x86
btc r14w, 0xa4
push rbp
push rbx
cmc
sbb dil, dil
sub rsp, 0x38
jmp 0x140439bad
mov edi, r8d
test dx, 0x2e82
btr ax, 0x17
mov r14, rdx
inc si
movzx rax, di
jmp 0x140439bc9
mov rsi, rcx
add ax, 0x2a3d
mov rax, qword [rdx]
cmp dword [rax + 0x10], r8d
jne 0x140439c41
mov dword [rsi + 4], 0
lea rcx, [rsp + 0x20]
cmp r10b, 0x4c
sub ebx, ebx
mov rdx, r14
sub r8d, r8d
jmp 0x140439c5e
call fcn.140438b8c
mov eax, dword [rsp + 0x34]
cmp eax, edi
jmp 0x140439c6e
jle 0x140439c8c
xor ebp, ebp
not ch
movsx ecx, bp
movsx cx, r13b
mov ecx, eax
jmp 0x140439c87
jmp 0x140439d0a
xor ebx, ebx
movsx ebp, sp
xchg r15b, bpl
jmp 0x140439c99
lea r15, [rsp + 0x20]
xchg bpl, bpl
jmp 0x140439cab
nop word cs:[rax + rax]
mov ebp, ebx
movsx ebx, r8w
mov ebx, eax
jmp 0x140439cc2
movss xmm0, dword [rsp + 0x28]
jmp 0x140439ccd
addss xmm0, dword [rsi + 4]
movss dword [rsi + 4], xmm0
mov rcx, r15
xchg r8b, dl
movzx dx, r13b
mov rdx, r14
mov r8d, eax
call fcn.140438b8c
mov ecx, dword [rsp + 0x34]
add ax, 0x1a71
lea eax, [rcx + rbx]
jmp 0x140439cfd
cmp eax, edi
jmp 0x140439d04
jle 0x140439cb5
mov dword [rsi + 0xc], ebx
mov dword [rsi + 0x10], ecx
movss xmm0, dword [rsp + 0x30]
jmp 0x140439d1b
subss xmm0, dword [rsp + 0x2c]
movss dword [rsi + 8], xmm0
test r15d, r8d
cmp r14b, 0xc2
mov dword [rsi + 0x14], ebp
jmp 0x140439d35
movss xmm0, dword [rsp + 0x20]
cmc
stc
movss dword [rsi], xmm0
cmp ebx, edi
jmp 0x140439d48
jge 0x140439e5c
sub edi, ebx
and r8, rcx
cmp spl, 0x4c
shr r8b, cl
sub ebp, ebp
nop dword [rax]
not r8d
cwd
xchg r8b, dl
mov rcx, r14
mov dh, 0xf2
movsxd rdx, r12d
not dh
mov edx, ebx
movzx r8w, cl
mov r8d, 0x1ebf7e06
mov r8d, ebp
jmp 0x140439d8b
call fcn.140439390
addss xmm0, dword [rsi]
movss dword [rsi], xmm0
inc ebp
cmp di, 0xfd1
cmc
clc
cmp edi, ebp
jmp 0x140439da8
jne 0x140439d6b
jmp 0x140439e5c
Function at 0x140439ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
btc r15, 0x6e
adc r15b, 5
shr r15w, cl
push r14
jmp 0x140439eba
push rsi
rcr r15b, cl
push rdi
and r15b, al
inc r14b
btc r15, r14
push rbp
cmc
push rbx
sub rsp, 0x28
sbb bpl, bpl
jmp 0x140439edc
mov r15d, r9d
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
movsx rcx, sp
lea rcx, [rdx + 0x20]
mov edx, r8d
movzx r8, dx
mov r8d, r9d
cmp r15b, dil
test si, 0x17b4
xor r9d, r9d
call fcn.14043a0d9
test r15d, r15d
jmp 0x140439f12
jle 0x140439fbf
test rax, rax
jmp 0x140439f20
je 0x140439fbf
movsxd rsi, ebp
and ch, 0x5c
mov ecx, r15d
shl dl, 0xf9
xadd dx, dx
xor ebp, ebp
bswap dx
movzx dx, bpl
mov rdx, rsi
jmp 0x140439f48
jmp 0x140439f79
movzx edi, word [rdi + rdx*2]
jmp 0x140439f56
mov word [rax + rbp*2], di
jmp 0x140439f5f
inc rbp
jmp 0x140439f67
inc rdx
cmp r15w, 0x3664
cmp rcx, rbp
je 0x140439fc6
mov di, 0x2a
cmc
cmp r15b, 0xd9
cmp bx, r15w
test byte [rbx + 0x1c], 4
jmp 0x140439f8f
jne 0x140439f56
mov rdi, qword [rbx]
cmp qword [rdi + 0x10], rdx
jbe 0x14043a0ce
cmp qword [rdi + 0x18], 8
jmp 0x140439fac
jb 0x140439f4d
mov rdi, qword [rdi]
jmp 0x140439fba
jmp 0x140439f4d
movsxd rsi, ebp
stc
not dil
mov rbx, qword [rbx]
movsx cx, bpl
bts di, r14w
bt di, 0x27
mov rdi, qword [rbx + 0x10]
sub ch, cl
movsx cx, ch
bts rcx, rbp
mov rcx, rdi
sub rcx, rsi
jmp 0x140439ff1
jb 0x14043a0ce
movsxd rax, r15d
cmp sil, 0x7b
cmp rcx, rax
cmovb rax, rcx
test di, 0x4b73
sal ch, 0x65
cmp qword [rbx + 0x18], 8
movzx ecx, bx
mov rcx, rbx
jb 0x14043a021
mov rcx, qword [rbx]
lea rcx, [rcx + rsi*2]
neg r8
sbb rbp, rdx
xchg r8b, r8b
sub rdi, rax
sbb r8b, 0xf7
mov rbp, rdi
sub rbp, rsi
adc dx, r10w
and r8d, 0x14ff5c89
movsx r8, dx
lea rdx, [rcx + rax*2]
xor r8b, 0xb8
or r8d, 0x52e1060e
lea r8, [rbp + 2]
cmp r9, r13
jmp 0x14043a069
add r8, rbp
jmp 0x14043a071
call fcn.14049d2da
mov qword [rbx + 0x10], rdi
cmc
cmp r11b, cl
mov byte [r14 + 0x16], 0
movsx rbp, r12w
add rsp, 0x28
movzx r14w, spl
cmovo r14w, dx
pop rbx
xchg r14b, sil
bswap di
pop rbp
movsx rsi, cx
mov r15b, dil
pop rdi
mov r15b, 0xff
movsx rsi, cx
pop rsi
jmp 0x14043a0ba
pop r14
movsx r15d, r10w
not r15d
mov r15b, 0x7a
pop r15
jmp 0x14043a0cd
ret
call fcn.14043956a
int3
Function at 0x14043df35
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14043df3e
movzx ecx, cx
jmp 0x14043df46
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
add rsp, 0x28
jmp 0x14043df60
ret

Function at 0x14043f663
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
cdqe
cmovp ax, sp
movsx eax, r13w
mov rcx, qword [rcx]
movzx rax, r14w
lahf
cwde
mov rax, qword [rcx]
jmp 0x14043f682
call qword [rax + 0x28]
test eax, eax
jmp 0x14043f68c
je 0x14043f6b8
mov ecx, eax
shrd r8, rbp, 0x4c
movabs r8, 0xcafa59766d7f94e
mov dl, 3
and r9w, r13w
mov r9d, 0x2a
add rsp, 0x28
jmp fcn.1403a994e
nop
stc
add rsp, 0x28
ret
Function at 0x140440044
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
sar r14d, 0xf6
mov ax, 0x76f7
push rsi
sal rax, 0xf3
mov al, 0x2b
or r14d, 0x5ee83bf3
push rdi
sub r14w, r9w
add r14, 0x6e2f7234
bts ax, r10w
push rbx
rol r14b, 0x35
clc
sub rsp, 0x58
movsx r14, dx
mov rax, r9
bswap r9w
setae r14b
mov r14, rdx
jmp 0x140440092
mov r9d, dword [rsp + 0xa0]
jmp 0x14044009f
movd xmm0, r8d
shr r8, 0x20
movd xmm1, r8d
mov qword [rdx], 0
jmp 0x1404400b9
cvttss2si r8d, xmm1
test r8d, r8d
jmp 0x1404400c6
jle 0x140440210
cvttss2si r10d, xmm0
xor r11d, r11d
stc
cmp r13b, 0x7d
movss xmm2, dword [0x1400bf4c0]
cmp sil, 0xe9
clc
sub ebx, ebx
jmp 0x1404400ed
jmp 0x14044010b
inc ebx
cmc
jmp 0x1404400fa
add r11d, r9d
cmp ebx, r8d
jmp 0x140440105
je 0x140440210
mov rsi, r10
mov edx, r11d
cmc
clc
test r10d, r10d
jmp 0x14044011b
jg 0x1404401b5
jmp 0x1404400f2
movzx edi, dil
jmp 0x14044012f
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
jmp 0x140440143
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
movsx edi, r15w
movzx edi, byte [rax + rdx + 1]
jmp 0x140440164
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
movzx edi, byte [rax + rdx + 2]
jmp 0x140440182
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
cmp r12b, r15b
clc
jmp 0x14044019f
add edx, 4
jmp 0x1404401a7
dec rsi
jmp 0x1404401af
je 0x1404400f2
mov edx, edx
or dil, 0xa2
sbb edi, 0x5eb741d7
bt di, 0x64
movzx edi, byte [rax + rdx + 3]
test r14b, 0x7d
test r8w, r12w
jmp 0x1404401d8
cmp edi, 0xff
jmp 0x1404401e3
je 0x14044019f
test edi, edi
jmp 0x1404401f0
jne 0x140440126
mov byte [rax + rdx + 2], 0
jmp 0x140440200
mov word [rax + rdx], 0
jmp 0x14044020b
jmp 0x14044019f
mov rcx, qword [rcx + 0x18]
movabs rdx, 0x10000001c
jmp 0x140440223
mov qword [rsp + 0x38], rdx
jmp 0x14044022d
movsd xmm2, qword [0x1400bfee0]
jmp 0x14044023a
movsd qword [rsp + 0x40], xmm2
jmp 0x140440245
mov dword [rsp + 0x48], 0
jmp 0x140440252
mov qword [rsp + 0x50], 0
jmp 0x140440260
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
xor di, r8w
sbb edi, ecx
or r8d, esp
mov edx, edx
jmp 0x14044027e
or rdx, rbx
mov rbx, qword [rcx]
movzx rdi, bp
mov qword [rsp + 0x28], r14
lea rdi, [rsp + 0x38]
movzx r8w, r13b
jmp 0x14044029f
mov qword [rsp + 0x20], rdi
movsx r8w, r15b
jmp 0x1404402b2
mov r8, rax
jmp 0x1404402ba
call qword [rbx + 0x1c8]
test eax, eax
jmp 0x1404402c7
je 0x1404402ee
mov ecx, eax
movzx r8d, r14w
movsx r8d, r8w
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
mov r9d, 0xd4
call fcn.1403a994e
mov rax, r14
shr sil, 0x78
rol dil, 0x12
sub edi, 0x2228480f
add rsp, 0x58
bswap r14d
pop rbx
movsx r14w, al
pop rdi
not si
movzx r14w, r13b
cmovnp r14, rdi
pop rsi
xchg r14b, r14b
movsx r14, ax
movsx r14w, r14b
pop r14
jmp 0x14044032d
ret
Function at 0x140441274
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
ror r15d, cl
dec al
ror r15b, 0x4f
push r14
rol r15b, 0x18
bswap r14d
test di, r13w
push rsi
btr ax, 0xed
rcr r14b, 0x5b
jmp 0x14044129b
push rdi
jmp 0x1404412a6
push rbp
shl sil, 0xa9
xor bpl, spl
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm8
lahf
movaps xmmword [rsp + 0x60], xmm7
cbw
movzx r14d, r8w
movaps xmmword [rsp + 0x50], xmm6
movzx ax, dh
mov r14, r8
cmovbe rsi, r14
not si
setle dil
mov rbx, rdx
cbw
mov rsi, 0x311c7b42
xchg al, dl
mov r15, rcx
cmovo edi, r13d
sets bpl
movsx dx, r14b
mov rsi, qword [rsp + 0xe0]
xchg bpl, cl
movzx rbp, r14w
mov cl, cl
mov ebp, dword [rsp + 0xf0]
cdq
movsx ecx, r8w
mov edx, dword [rsp + 0xe8]
movzx rdi, r15w
mov rdi, qword [r9]
cwde
mov rax, qword [rdi]
movsx ecx, r12w
movsxd rcx, r13d
movzx ecx, r13w
mov rcx, rdi
jmp 0x14044133f
call qword [rax + 0x18]
mov rax, qword [rdi]
mov ecx, 0x31c35f8b
movsxd rcx, r11d
mov rcx, rdi
movzx edx, bx
jmp 0x140441358
mov edx, ebp
jmp 0x14044135f
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
mov dl, 0xa9
movups xmm0, xmmword [r14]
cdqe
cwd
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
cmovne r14, r8
not r14b
lea r14, [rsp + 0x40]
cdq
mov dx, 0x4c62
mov rdx, r14
jmp 0x140441391
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x14044139d
movaps xmm0, xmm7
jmp 0x1404413a5
call fcn.1404b2162
movaps xmm8, xmm0
jmp 0x1404413b3
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x1404413bf
call fcn.1404b2162
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
movaps xmm0, xmm7
jmp 0x1404413e7
call fcn.1404b2162
movaps xmm6, xmm0
jmp 0x1404413f4
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140441400
call fcn.1404b2162
movss dword [rbx + 8], xmm6
jmp 0x14044140f
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
movzx ecx, sp
mov rcx, qword [r15 + 0x18]
mov rax, qword [r15 + 0x20]
jmp 0x140441427
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
xor r8d, r8d
stc
jmp 0x14044143d
nop
stc
cmp eax, r11d
cmp word [rsi + r8*2], 0
jmp 0x14044144d
lea r8, [r8 + 1]
jmp 0x140441456
jne 0x140441442
dec r8d
mov edx, 0x7474438f
mov rbp, qword [rcx]
movzx r9d, r10w
movsxd rdx, r8d
mov qword [rsp + 0x28], rax
cqo
movsx rdx, r11w
mov r9b, r14b
mov qword [rsp + 0x20], r14
not r9b
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 2
movzx r9d, r11w
movzx rdx, bp
bswap r9w
mov rdx, rsi
mov r9b, cl
setp r9b
mov r9b, 0xa8
mov r9, rdi
jmp 0x1404414b5
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
movsx esi, sp
movaps xmm7, xmmword [rsp + 0x60]
and bx, 0x6290
sar r15d, cl
cmovp bp, r12w
movaps xmm8, xmmword [rsp + 0x70]
neg dil
movsx bx, r10b
shld rbp, r11, 0x2b
add rsp, 0x88
mov r14b, 0xc9
cmovle rsi, rbx
pop rbx
cmovno rbp, r14
movzx si, cl
pop rbp
setb dil
pop rdi
movzx r14w, bpl
movsx r15, r8w
pop rsi
mov r15b, 0x1d
not r15d
pop r14
movsx r15w, r12b
pop r15
jmp 0x140441523
ret
Function at 0x14044259b
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
stc
mov al, al
mov r8, rcx
movsxd rax, r15d
xor ax, 0x748d
rcl rax, 0x71
mov eax, 0x5a4d
cmp r8b, spl
test di, r14w
cmp word [0x140000000], ax
jmp 0x1404425c8
jne 0x1404426eb
movsxd rcx, dword [0x14000003c]
movzx rdx, r9w
bsf dx, dx
inc rdx
lea rdx, [0x140000000]
cmp bp, 0x2fb
jmp 0x1404425f1
add rcx, rdx
cmp bpl, r11b
clc
cmp dword [rcx], 0x4550
jmp 0x140442603
jne 0x1404426eb
mov eax, 0x20b
jmp 0x140442614
cmp word [rcx + 0x18], ax
jmp 0x14044261d
jne 0x1404426eb
sub r8, rdx
movzx edx, word [rcx + 0x14]
inc rax
adc r9b, r8b
add rdx, 0x18
bts r9, r12
shr r9w, cl
lahf
lea rdx, [rdx + rcx]
bswap r9d
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
and r9b, spl
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
jmp 0x140442662
cmp rdx, r9
jmp 0x14044266a
je 0x1404426a1
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140442698
mov eax, dword [rdx + 8]
add eax, ecx
cmp bp, r9w
jmp 0x14044268a
cmp r8, rax
jmp 0x140442692
jb 0x1404426aa
add rdx, 0x28
jmp 0x140442653
sub edx, edx
cmp cx, sp
cmp r12b, 0x3f
test rdx, rdx
jmp 0x1404426b2
jne 0x1404426c4
sub al, al
jmp 0x1404426bf
jmp 0x1404426f5
cmp dword [rdx + 0x24], 0
jmp 0x1404426cd
jge 0x1404426df
sub al, al
jmp 0x1404426da
jmp 0x1404426f5
mov al, 1
jmp 0x1404426e6
jmp 0x1404426f5
sub al, al
jmp 0x1404426f5
add rsp, 0x18
ret