joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403add18

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403af888

Function at 0x1400eadd0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
adc r11b, 0xd3
bsr r10, rax
shr r10d, cl
xor r9d, r9d
shrd r10w, r11w, 0xe0
cdqe
cmc
add r8, rcx
mov r10, rdx
test sil, r8b
mov r11b, 0x76
movzx eax, word [r8 + 0x14]
add r11b, 0xee
movzx r11d, word [r8 + 6]
test spl, 0x83
stc
cmc
add rax, 0x18
test dl, dl
add rax, r8
cmc
test bl, 9
jmp 0x140202cf0
je 0x140106bdf
mov edx, dword [rax + 0xc]
cmp r10, rdx
jmp 0x1400f5e1c
jb 0x1400f5e31
mov ecx, dword [rax + 8]
stc
add ecx, edx
cmp r10, rcx
jb 0x140115a0d
inc r9d
jmp 0x140106bd2
add rax, 0x28
cmp r9d, r11d
jb 0x1400edeaa
xor eax, eax
jmp 0x140115a0d
ret
test r11d, r11d
jmp 0x1400edea4

Function at 0x14016c580
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
cqo
not dl
mov dx, 0x2f2e
lea edx, [r8 + 2]
jmp 0x1404b1acd
mov qword [rsp + 8], rbx
and bl, 0x9a
mov dword [rsp + 0x18], r8d
sar bh, 0x54
btr bx, 0x5e
cmc
mov dword [rsp + 0x10], edx
bsr bx, ax
dec bl
adc bl, dil
push rbp
xchg bl, bpl
mov rbp, rsp
adc bx, r14w
sub rsp, 0x50
sbb bh, 0x9d
mov ebx, ecx
cmc
test r8d, r8d
jmp 0x1404b1b0d
jne 0x1404b1b9c
sub ecx, ecx
jmp 0x1404b1b1a
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b1b28
je 0x1404b1b9c
mov ecx, 0x5a4d
clc
cmp word [rax], cx
jne 0x1404b1b9c
movsxd rcx, dword [rax + 0x3c]
jmp 0x1404b1b4a
add rcx, rax
test r14b, 0xf1
cmp dword [rcx], 0x4550
jmp 0x1404b1b5c
jne 0x1404b1b9c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1404b1b9c
cmp dword [rcx + 0x84], 0xe
jbe 0x1404b1b9c
cmp dword [rcx + 0xf8], 0
jmp 0x1404b1b8a
je 0x1404b1b9c
mov ecx, ebx
jmp 0x1404b1b97
call fcn.1404b199c
lea rax, [rbp + 0x18]
jmp 0x1404b1ba5
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lahf
setb ah
lea r9, [rbp - 0x2c]
cbw
lea rax, [rbp + 0x20]
cdq
mov dx, 0x3032
cwd
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
cmova dx, r9w
movsx cx, spl
not cl
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
mov ch, 0xff
jmp 0x1404b1bef
lea rcx, [rbp - 0x30]
jmp 0x1404b1bf8
mov dword [rbp - 0x2c], eax
jmp 0x1404b1c00
mov dword [rbp - 0x28], eax
jmp 0x1404b1c08
call fcn.1404b1ddc
cmp dword [rbp + 0x20], 0
je 0x1404b1c31
mov rbx, qword [rsp + 0x60]
or bpl, cl
movzx ebp, sp
btr bp, bx
add rsp, 0x50
pop rbp
jmp 0x1404b1c30
ret
mov ecx, ebx
jmp 0x1404b1c38
call fcn.1404b1a37
int3
Function at 0x1401b02c1
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b1acd
sub r8d, r8d
test si, r9w
cmp edx, r13d
stc
sub edx, edx
jmp 0x1401291b7
Function at 0x1401ee9a8
Capabilities:
Parse pe header

Disassembly:
jne 0x14021f984
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
mov eax, 0x5a4d
cmc
jmp 0x14023085e
ret
xor eax, eax
jmp 0x140218274
cmp word [rcx], ax
jne 0x14021f984
movsxd rdx, dword [rcx + 0x3c]
clc
add rdx, rcx
stc
test r15b, 0x68
cmp dword [rdx], 0x4550
jmp 0x1401b320c

Function at 0x140206b64
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
sub ecx, ecx
movsx r8w, r8b
xchg r8w, r8w
lea r8d, [rdx + 1]
jmp 0x140284c44
jmp 0x1404b1acd

Function at 0x140233008
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x14044695b
mov rcx, qword [rcx]
jmp 0x14021a4b4
push rsi
sbb esi, 0x65f5220a
or sil, r10b
push rdi
or ax, si
sub rsp, 0x28
sub eax, 0x5bce3ad1
shr si, 0xf8
btc rax, 0xf7
mov rsi, rcx
ror ax, 0xcb
sar al, 0x92
mov rcx, qword [rcx + 0x18]
shld ax, r12w, 0x93
clc
mov rax, qword [rcx]
cmp r8w, 0x3b0c
test r15b, 0x4b
xor edx, edx
stc
test r9b, r15b
xor r8d, r8d
jmp 0x1404469ab
call qword [rax + 0x188]
mov edi, eax
movsx cx, bh
movzx cx, r10b
cmovle ecx, ebx
lea rcx, [rsi + 0x30]
jmp 0x1404469c8
call fcn.14045a757
test edi, edi
jmp 0x1404469d4
je 0x140446a15
cmp edi, 0x8899000c
jmp 0x1404469e5
jne 0x140446a25
mov rcx, rsi
sbb sil, r13b
bts si, r14w
add rsp, 0x28
movzx di, r10b
movsxd rsi, r11d
pop rdi
mov sil, 0xb7
setne sil
pop rsi
jmp 0x140446a10
jmp fcn.140446611
nop
add rsp, 0x28
pop rdi
xchg sil, sil
pop rsi
jmp 0x140446a24
ret
mov ecx, edi
xor r8d, 0x7bd13739
movabs r8, 0xad4a5352d2edebd0
mov dl, sil
sbb dl, r14b
mov dl, 3
and r9w, r14w
xor dil, 1
mov r9d, 0x54
shl sil, cl
shl si, 0x72
add rsp, 0x28
cmovs edi, ecx
pop rdi
movsx si, r13b
mov sil, r10b
pop rsi
jmp 0x140446a6b
jmp fcn.1403afe6c
Function at 0x1402921df
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
je 0x1400e965e
xor edx, edx
rol r9b, cl
lea r9, [0x1400b8f10]
test r8d, 0x77c95c81
cmp r8, rdx
je 0x1400e9667
mov word [rcx], ax
add rcx, 2
movsx rax, dx
movsx ax, r15b
movzx rax, r9w
movzx eax, word [r9 + rdx*2 + 2]
inc rdx
test ax, ax
jne 0x1400e962c
sub r8, rdx
test r8, r8
je 0x14021a7aa
mov word [rcx], 0
jmp 0x14021a7aa
jmp 0x1400e9619
inc rax
test r11w, r11w
jne 0x1401e430d
sub r8, rax
test spl, bl
cmp dil, cl
test r8, r8
jmp 0x14016d3e5
je 0x14016d3fe
mov word [r10], 0
test dx, 0x17a1
rcr r8w, 0x16
add r8, rbp
movzx eax, word [0x1400b8f10]
bt r8w, r14w
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x1402419b0
je 0x14016d3eb
mov word [r10], r11w
sub r11d, r14d
add r10, 2
mov r11d, 0x7eaf2f07
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x140108c28
je 0x140108c3e
xor eax, eax
cmp dil, r10b
nop word [rax + rax]
cmp r9b, 0xef
cmp r8, rax
jmp 0x1401dcacb
mov rax, qword gs:[0x30]
test eax, 0x3f8a6d72
sal r8b, cl
mov rax, qword [rax + 0x60]
shr r10w, 0xa9
sbb r9d, 0x3ab44545
mov r8b, r13b
mov rax, qword [rax + 0x18]
bts r11d, r13d
test spl, dl
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
cmp r8, rdx
cmovae r8, rdx
clc
btc r10d, 0xbc
xor r9b, dil
mov r9, qword [rax + 0x60]
btr r11w, 0x88
movsx r10d, r14w
movzx r11d, word [r9]
shr r10d, 0xea
sub r10, 0x50c0185b
bt r10w, r13w
lea r10, [0x1400b8f10]
cmp r8w, di
stc
test r11w, r11w
jmp 0x1401e42f8
ret
cmovb r8, rdx
jmp 0x14010124a
cmovb r8, rdx
test ax, ax
jmp 0x1400e9613
je 0x1401fd528
cmp rdx, 0x104
movsx r8w, bl
mov r8d, 0x104
jmp 0x140225d42
movzx eax, word [0x1400b8f10]
cmp r11b, bpl
test ax, ax
jmp 0x14025eb9a
Function at 0x1403bc1bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bts rax, r14
btr ax, r13w
push r14
bts ax, bp
setne r14b
push r13
push r12
movzx r14w, r11b
setb r14b
xor ah, 0xe5
push rsi
btc rsi, rsp
rol sil, cl
push rdi
rcl al, cl
dec si
ror rsi, cl
push rbx
sub rsp, 0x20
sal edi, cl
cwde
mov rsi, r8
movsx r14w, cl
bsf bx, r14w
mov rdi, rdx
test r11b, 0xfb
mov r14, rcx
xor al, 0x34
movzx ax, r13b
and rbx, rsp
mov rbx, qword [rcx]
mov rcx, qword [rcx + 0x10]
movsx ax, bl
movzx rax, r14w
sub rcx, rbx
sar rcx, 4
shr ax, cl
cmc
sbb al, r8b
movabs rax, 0xf0f0f0f0f0f0f0f1
clc
imul rcx, rax
test r8w, 0x393c
cmp rcx, r8
jmp 0x1403bc254
jae 0x1403bc2bb
mov rcx, r14
mov dx, r14w
not dl
setbe dh
mov rdx, rsi
jmp 0x1403bc26e
call fcn.1403bc4a9
mov rbx, qword [r14]
movsxd rdx, r12d
cqo
nop word [rax + rax]
mov rcx, rbx
mov rdx, rdi
jmp 0x1403bc28f
call fcn.1403bcca5
add rbx, 0x110
stc
add rdi, 0x110
jmp 0x1403bc2a8
dec rsi
jmp 0x1403bc2b0
jne 0x1403bc284
jmp 0x1403bc45a
mov r13, qword [r14 + 8]
mov r12, r13
cmovle r15, rbx
add r15b, r15b
shr r15b, cl
sub r12, rbx
rol r15w, 0xf5
sar r12, 4
movzx r15, r11w
movzx r15d, ax
imul r12, rax
mov r15, r12
test r14, 0x16570650
cmp r10, 0x1a714254
sub r15, rsi
jae 0x1403bc3c5
cmp rbx, r13
jmp 0x1403bc306
je 0x1403bc360
nop word cs:[rax + rax]
movsxd rdx, edi
cwd
mov rcx, rbx
movsxd rdx, edi
movzx rdx, dx
sets dh
mov rdx, rdi
jmp 0x1403bc334
call fcn.1403bc705
add rbx, 0x110
test r13, r15
test r10b, 0x54
add rdi, 0x110
cmp r10b, r10b
cmp rbx, qword [r14 + 8]
jmp 0x1403bc35a
jne 0x1403bc31f
cmp rsi, r12
jmp 0x1403bc368
je 0x1403bc45a
nop dword [rax + rax]
mov dl, 0xeb
movzx rcx, bp
bswap ecx
mov rcx, rbx
movsx rdx, bx
mov dh, 0x49
movsx dx, bpl
mov rdx, rdi
jmp 0x1403bc395
call fcn.1403bcca5
add rbx, 0x110
jmp 0x1403bc3a6
add rdi, 0x110
jmp 0x1403bc3b2
inc r15
jmp 0x1403bc3ba
jne 0x1403bc37e
jmp 0x1403bc45a
imul r15, rsi, 0x110
cmc
lea r15, [r15 + rbx]
clc
test rsi, rsi
jmp 0x1403bc3da
je 0x1403bc416
nop
mov rcx, rbx
mov rdx, rdi
jmp 0x1403bc3ec
call fcn.1403bc705
add rbx, 0x110
add rdi, 0x110
dec rsi
jmp 0x1403bc407
jne 0x1403bc3e1
mov r13, qword [r14 + 8]
jmp 0x1403bc416
cmp r15, r13
je 0x1403bc457
mov rsi, r15
xchg ch, cl
jmp 0x1403bc42c
nop word [rax + rax]
movsxd rcx, esp
movzx cx, dl
mov rcx, rsi
call fcn.1403b6ba2
add rsi, 0x110
cmc
cmp rsi, r13
jmp 0x1403bc451
jne 0x1403bc439
mov rbx, r15
mov qword [r14 + 8], rbx
sar bl, 0x43
bt si, r11w
add rsp, 0x20
cmovl rbx, rdi
movsx r14d, bp
pop rbx
movsx r15, r11w
movzx r14d, di
movzx r14, r14w
pop rdi
movzx r13w, r8b
pop rsi
movsxd r15, esp
movsx r13, r9w
pop r12
pop r13
cmovo r14w, r8w
pop r14
cmovge r15w, r12w
movsx r15d, bx
pop r15
jmp 0x1403bc4a8
ret
Function at 0x1403cda06
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
setle r15b
and r15w, 0x5c23
bt r15w, ax
push r14
shl r15w, cl
push r13
adc r13d, ecx
push r12
bts r12, r13
cmp r12, 0x13d84a09
rol r13b, cl
push rsi
sar r13d, cl
push rdi
push rbx
btc r13w, 0x9d
shr r12w, 0x22
sub rsp, 0x30
dec sil
sar rsi, 0xeb
movaps xmmword [rsp + 0x20], xmm6
ror r14, 0x72
mov r15, r9
cmp cl, r10b
btc r14d, 0xd6
mov r12, r8
not r13d
shrd rsi, rax, 0xca
mov r14, rdx
or sil, 0xed
mov r13, rcx
cmc
xor sil, 0x27
mov rsi, qword [rcx]
clc
cmp sil, 0x94
test rsi, rsi
jmp 0x1403cda8c
je 0x1403cdbb9
mov rbx, qword [r13 + 8]
test r9w, sp
jmp 0x1403cda9f
cmp rsi, rbx
jmp 0x1403cdaa7
je 0x1403cdb52
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403cdad9
call fcn.1402921ff
movups xmmword [rsi + 0x10], xmm6
mov word [rsi], 0
jmp 0x1403cdacc
add rsi, 0x20
cmp rsi, rbx
je 0x1403cdb4e
mov rax, qword [rsi + 0x18]
cmp rax, 8
jb 0x1403cdabe
mov rcx, qword [rsi]
rol dl, 0xf2
cqo
lea rdx, [rax + rax]
jmp 0x1403cdaf9
add rdx, 2
cmp rdx, 0x1000
jmp 0x1403cdb09
jb 0x1403cdab9
mov rdi, qword [rcx - 8]
cmc
test bl, dl
cmp rcx, r14
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jmp 0x1403cdb29
jae 0x1403cdc3d
add rax, rax
ror cx, 0x50
add cl, r15b
add rax, 0x29
cdq
mov rdx, rax
mov rcx, rdi
jmp 0x1403cdb49
jmp 0x1403cdab9
mov rsi, qword [r13]
mov rdx, qword [r13 + 0x10]
test bp, r12w
sub rdx, rsi
stc
cmp rbp, 0x365b3649
clc
cmp rdx, 0x1000
jmp 0x1403cdb72
jb 0x1403cdbac
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, rax
cmp r10b, 0xc6
jmp 0x1403cdb8c
cmp rsi, 0x20
jae 0x1403cdc3d
add rdx, 0x27
movzx rsi, dx
mov rsi, rax
sets ch
movsx cx, bpl
bswap cx
mov rcx, rsi
jmp 0x1403cdbb4
call fcn.1402921ff
mov qword [r13], r14
shl r12, 5
add r12, r14
rcl rsi, cl
mov qword [r13 + 8], r12
mov r12b, r13b
shl r15, 5
cmc
cmp r13b, spl
adc bl, bpl
add r15, r14
setnp bl
movzx di, r10b
mov qword [r13 + 0x10], r15
movaps xmm6, xmmword [rsp + 0x20]
rcr di, cl
add rsp, 0x30
not r14b
mov rbx, 0x6680580a
pop rbx
movzx r12, r10w
movsx r15w, spl
pop rdi
movzx r15w, r10b
movsx r14, ax
pop rsi
movsx r14d, dx
pop r12
jmp 0x1403cdc1e
pop r13
movzx r14, r13w
movzx r14d, bp
pop r14
not r15b
movsxd r15, r9d
jmp 0x1403cdc35
pop r15
jmp 0x1403cdc3c
ret
call fcn.1404b6a63
int3
Function at 0x1403eacc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
jmp 0x1403eacd8
push rsi
cmc
stc
push rdi
or dil, 0x74
add di, 0x681a
push rbx
xor dil, 0x96
movsx rdi, r12w
sub rsp, 0x30
btc edi, 0xd0
movaps xmmword [rsp + 0x20], xmm6
neg edi
movzx di, al
shr dil, 0xb8
mov rdi, qword [rcx]
jmp 0x1403ead10
test rdi, rdi
je 0x1403eae6e
mov r14, rcx
sar bx, cl
mov rbx, qword [rcx + 8]
cmp r13, r10
test spl, 0xf2
cmp rdi, rbx
jmp 0x1403ead32
je 0x1403eadfb
lea r15, [0x1400beb30]
jmp 0x1403ead44
xorps xmm6, xmm6
jmp 0x1403ead7f
lea rsi, [rdi + 0x18]
jmp 0x1403ead55
call fcn.1402921ff
movups xmmword [rsi], xmm6
stc
mov qword [rsi + 0x10], 0
test al, dil
clc
cmp bp, dx
add rdi, 0x30
cmp rdi, rbx
jmp 0x1403ead79
je 0x1403eadf8
mov qword [rdi], r15
movsxd rcx, esp
bts ecx, ebx
cmp rsi, rax
mov rcx, qword [rdi + 0x18]
cmc
clc
cmp ebx, 0xb75229b
test rcx, rcx
jmp 0x1403ead9f
je 0x1403ead6d
mov rdx, qword [rdi + 0x28]
clc
cmc
sub rdx, rcx
cmp dh, 0x87
cmp rdx, 0x1000
jmp 0x1403eadbd
jb 0x1403ead4c
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403eadd7
jae 0x1403eaea7
add rdx, 0x27
cmovle ecx, esp
bswap ecx
movsx cx, r9b
mov rcx, rax
jmp 0x1403eadf3
jmp 0x1403ead4c
mov rdi, qword [r14]
mov rdx, qword [r14 + 0x10]
sub rdx, rdi
cmc
test r9, 0x3be94dfe
stc
cmp rdx, 0x1000
jmp 0x1403eae17
jb 0x1403eae4e
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
stc
cmp r9w, dx
sub rdi, rax
cmp rdi, 0x20
jmp 0x1403eae36
jae 0x1403eaea7
add rdx, 0x27
bswap di
movzx cx, ch
movsx rcx, r8w
mov rdi, rax
mov rcx, rdi
jmp 0x1403eae56
call fcn.1402921ff
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
rcl r14, 0x85
movaps xmm6, xmmword [rsp + 0x20]
bswap rdi
rcl r14b, 0x9c
add rsp, 0x30
xchg esi, r15d
movzx rsi, ax
pop rbx
mov dil, 0xc5
movzx edi, r11w
movsx r15, r15w
pop rdi
pop rsi
mov r15, 0x401b43f0
pop r14
xchg r15b, r15b
pop r15
jmp 0x1403eaea6
ret
call fcn.1404b6a63
int3
Function at 0x14042eb84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
movzx esi, r13w
shr rax, cl
seta sil
push rbx
bsf si, r9w
sub rsp, 0x20
rol si, cl
mov rsi, rcx
sub al, r11b
movzx ax, dl
dec ax
movzx eax, byte [rcx + 0x4828]
cmc
cmp al, 0xff
jmp 0x14042ebba
je 0x14042ebd1
mov byte [rsi + 0x4828], 0xff
jmp 0x14042ebcc
jmp 0x14042ece6
mov rbx, qword [rsi]
bt eax, 0xca
rcl al, 0x6f
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jmp 0x14042ebee
jae 0x14042ec1d
lea rcx, [rax + 1]
jmp 0x14042ebfd
mov qword [rbx + 0xc0], rcx
cmovg cx, sp
jmp 0x14042ec10
movzx ecx, byte [rax]
jmp 0x14042ec18
jmp 0x14042ecd8
cmp dword [rbx + 0x30], 0
jmp 0x14042ec26
je 0x14042ec87
mov r8d, dword [rbx + 0x34]
cdq
movzx di, r12b
movzx edx, cx
lea rdi, [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov dl, r11b
cdq
mov rdx, rdi
jmp 0x14042ec4d
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
clc
test eax, eax
jmp 0x14042ec6a
je 0x14042ec93
cdqe
bts ecx, ecx
add rax, rdi
movzx cx, r13b
not ecx
movzx ecx, byte [rdi]
jmp 0x14042ecb3
mov al, 0xff
jmp 0x14042ec8e
jmp 0x14042ece6
mov dword [rbx + 0x30], 0
test rbx, 0x37ef3d33
lea rax, [rbx + 0x39]
clc
stc
mov byte [rbx + 0x38], 0
cmc
sub ecx, ecx
cmp bx, 0x3e1d
mov qword [rbx + 0xc8], rax
bts ax, si
xor ax, 0x5d29
rcl ax, cl
lea rax, [rbx + 0x39]
mov qword [rbx + 0xc0], rax
sar al, 0x1b
rcr al, 0xd4
sub al, dl
mov al, 0xff
cmp r13b, r12b
cmp cl, 0xff
je 0x14042ed1b
add rsp, 0x20
pop rbx
bswap di
pop rdi
bswap esi
setl sil
mov sil, cl
pop rsi
ret
lea rcx, [rax + 1]
mov qword [rbx + 0xc0], rcx
cmp spl, r8b
cmc
movzx eax, byte [rax]
stc
clc
cmp al, 0xff
jmp 0x14042ed15
jne 0x14042ece6
mov rbx, qword [rsi]
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jmp 0x14042ed31
jb 0x14042ecfa
cmp dword [rbx + 0x30], 0
jmp 0x14042ed40
je 0x14042edff
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
movsx rcx, di
not dx
xchg dh, ch
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
jmp 0x14042ed63
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
test rdx, 0x3f9561db
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
stc
cmc
test eax, eax
je 0x14042eda0
movsxd rcx, eax
bsf eax, r14d
add rcx, rdi
movzx eax, byte [rdi]
jmp 0x14042ed9b
jmp 0x14042edca
mov dword [rbx + 0x30], 0
movsx rcx, cx
lea rcx, [rbx + 0x39]
test r10d, 0x3142789d
jmp 0x14042edbb
mov byte [rbx + 0x38], 0
clc
xor eax, eax
test r14w, r14w
test dil, 0xcc
mov qword [rbx + 0xc8], rcx
bswap cx
rcr cx, cl
rcr cl, 0x68
lea rcx, [rbx + 0x39]
cmp dil, cl
test cx, 0x124
mov qword [rbx + 0xc0], rcx
cmp al, 0xff
jmp 0x14042edf4
je 0x14042ed1b
jmp 0x14042ece6
sub eax, eax
jmp 0x14042ee06
jmp 0x14042ece6
Function at 0x140435940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bswap r15d
btr r15d, r14d
or r15d, 0x1f3b6274
push r14
rcl r15d, cl
push rsi
test r13b, 0x99
push rdi
mov r15d, 0x742a5bf1
btc r15, r10
xor r15b, 0xe2
push rbx
bts r15, r9
sub r15, 0x3e652d2f
sub rsp, 0x20
movsxd r15, edx
movsx r15d, ax
mov r15, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
bsf bx, r14w
mov rcx, qword [rdx + 8]
add bh, ch
btr rbx, r15
mov rax, qword [rdx]
rcr bl, 0xd4
and bl, r13b
mov rbx, rcx
cmp r9, r10
sub rbx, rax
test dx, r11w
cmp r12b, 0xc
sub rcx, rax
jmp 0x1404359c2
je 0x140435adb
js 0x140435b02
mov r14, rdx
jmp 0x1404359d9
sar rbx, 6
cmp r11b, 0x80
cmp esi, ebp
cmp rcx, 0xfc1
jb 0x140435a1f
or rcx, 0x27
jmp 0x1404359f9
call fcn.14044878a
lea rdi, [rax + 0x27]
cmp r9w, 0x190
and rdi, 0xffffffffffffffe0
jmp 0x140435a11
mov qword [rdi - 8], rax
jmp 0x140435a1a
jmp 0x140435a2f
call fcn.14044878a
mov rdi, rax
bts rsi, rcx
add sil, 0xc0
mov qword [r15], rdi
xor sil, spl
mov qword [r15 + 8], rdi
sal si, 0xe4
movzx si, r10b
not rsi
shl rbx, 6
bts rsi, r9
mov sil, 0xc9
sar sil, 0xb6
add rbx, rdi
mov sil, dil
movzx rsi, cx
mov qword [r15 + 0x10], rbx
cmova bx, r14w
mov bx, r12w
mov rbx, qword [r14]
not si
mov rsi, qword [r14 + 8]
jmp 0x140435a7a
jmp 0x140435a87
add rdi, 0x40
add rbx, 0x40
cmp rbx, rsi
jmp 0x140435a8f
je 0x140435ad7
mov qword [rdi + 0x38], 0
ror ch, 0xa4
mov rcx, qword [rbx + 0x38]
test r12d, 0x49d81611
clc
test rcx, rcx
jmp 0x140435ab4
je 0x140435a7f
mov rax, qword [rcx]
movzx rdx, r9w
not dx
mov rdx, rdi
call qword [rax]
mov qword [rdi + 0x38], rax
jmp 0x140435ad2
jmp 0x140435a7f
mov qword [r15 + 8], rdi
mov rax, r15
add rsp, 0x20
movzx r15, dx
pop rbx
movsx edi, r15w
pop rdi
movzx r14, cx
movsx r15, sp
pop rsi
pop r14
not r15
pop r15
jmp 0x140435b01
ret
call fcn.1403bc1a0
int3
Function at 0x14043f7f2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
or sil, 0x6c
bt edi, edi
push rbx
shrd di, r14w, 0xe9
bts edi, esi
sub rsp, 0x90
bsf rdi, r12
btc ax, 0x29
shrd rsi, rdi, 0xa4
movaps xmmword [rsp + 0x80], xmm7
sbb si, bx
rcr eax, cl
xchg di, ax
movaps xmmword [rsp + 0x70], xmm6
shld di, r12w, 0xee
movzx rsi, bp
mov rdi, rdx
sub rax, r15
shl ax, 0x18
mov rsi, rcx
rcr rax, cl
adc rax, 0x3ee31e02
cmc
mov rax, qword [rdx]
jmp 0x14043f85a
cmp qword [rax + 0x18], 8
jmp 0x14043f864
jb 0x14043f86d
mov rax, qword [rax]
movsxd rcx, r8d
lea r9, [rax + rcx*2]
sub ebx, ebx
shr rax, 0x1a
xor ax, 0x22a1
sar al, 0xa
nop word cs:[rax + rax]
rcl al, cl
movzx eax, word [r9 + rbx*2]
cmp bh, 0x74
cmp eax, 0xa
jmp 0x14043f8a0
je 0x14043f8b6
test eax, eax
je 0x14043f8b6
inc rbx
jmp 0x14043f890
test byte [rdi + 0x1c], 4
jmp 0x14043f8bf
jne 0x14043fa1d
mov rcx, qword [rdi + 0x10]
rdtsc
cdqe
mov rax, qword [rdi + 8]
movsd xmm0, qword [rax + 8]
not dh
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
movsx edx, r11w
lea rdx, [rsp + 0x38]
bswap r8w
movzx r8, r14w
jmp 0x14043f908
lea r8, [rsp + 0x40]
jmp 0x14043f912
call fcn.140446407
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
cbw
cmovp ecx, r13d
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0
xchg rdx, rax
mov rcx, qword [rsp + 0x38]
movsx ax, r15b
cdq
bswap eax
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x1e0]
test eax, eax
jmp 0x14043f956
je 0x14043f977
mov ecx, eax
mov dl, dl
movabs r8, 0xe31b45c42a775183
mov dl, 3
mov r9d, 0x4f
call fcn.1403afe6c
movss xmm6, dword [rsp + 0x4c]
movzx dx, r9b
sbb cl, r13b
bts ecx, ecx
movss xmm7, dword [rsp + 0x50]
bt dx, 0xf7
lea rcx, [rsp + 0x38]
bt dx, si
rcl edx, cl
lea rdx, [rsp + 0x40]
xor r8d, r8d
jmp 0x14043f9ab
call fcn.14043fd6d
movss xmm0, dword [rdi + 0x18]
movss dword [rsi], xmm0
jmp 0x14043f9be
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
movss xmm0, dword [rsp + 0x50]
movss dword [rsi + 8], xmm0
shrd ecx, r13d, 0xa9
sar cl, cl
sub cl, 0xb7
mov dword [rsi + 0xc], 0
shr cl, cl
or rcx, rbx
movss dword [rsi + 0x10], xmm7
bts rcx, r14
mov dword [rsi + 0x14], ebx
rol ch, 0x4e
btr ecx, 0x3a
mov rcx, qword [rsp + 0x38]
test al, r10b
clc
test rcx, rcx
je 0x14043fa81
mov rax, qword [rcx]
jmp 0x14043fa15
call qword [rax + 0x10]
jmp 0x14043fa81
movss xmm0, dword [rdi + 0x18]
jmp 0x14043fa27
movss dword [rsi], xmm0
cvtsi2ss xmm1, ebx
mulss xmm1, dword [0x1400bfc14]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
jmp 0x14043fa45
movss xmm0, dword [0x1400bfc94]
jmp 0x14043fa52
movlps qword [rsi + 8], xmm0
mov rax, qword [rdi + 8]
jmp 0x14043fa5f
movss xmm0, dword [rax + 0xc]
jmp 0x14043fa69
addss xmm0, dword [0x1400bfbd0]
movss dword [rsi + 0x10], xmm0
bsf rdi, r9
mov dword [rsi + 0x14], ebx
cmovb rdi, rbx
movaps xmm6, xmmword [rsp + 0x70]
sar dil, 0x3a
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
cmovo edi, r13d
movzx rdi, r9w
movsxd rdi, edx
pop rdi
pop rsi
jmp 0x14043faac
ret
Function at 0x140444b62
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx ecx, cx
jmp 0x140444b6e
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
test r13w, 0x22ae
cmp bpl, 0xee
cmp r12w, di
cmp eax, 0x100
mov al, 0x9a
not al
setae al
cmp r15b, 0xb2
add rsp, 0x28
jmp 0x140444b9e
ret

Function at 0x1404462fe
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movzx ax, cl
movsx rax, cx
not ah
mov rcx, qword [rcx]
mov rax, qword [rcx]
jmp 0x140446317
call qword [rax + 0x28]
test eax, eax
jmp 0x140446321
je 0x140446362
mov ecx, eax
btc r9w, 0xa0
shr r9d, cl
stc
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9d, 0x12300333
bswap r9w
cmovs r9d, edi
mov r9d, 0x2a
stc
add rsp, 0x28
jmp 0x14044635d
jmp fcn.1403afe6c
nop
add rsp, 0x28
jmp 0x14044636c
ret
Function at 0x140449228
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
jmp 0x14044923b
cmp word [0x140000000], ax
jmp 0x140449247
jne 0x140449339
movsxd rcx, dword [0x14000003c]
shl dh, cl
lea rdx, [0x140000000]
test r11b, 0xdb
cmp r11b, bpl
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140449339
mov eax, 0x20b
stc
cmc
cmp word [rcx + 0x18], ax
jmp 0x140449283
jne 0x140449339
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
add r9b, 0x6a
bsr r9d, ecx
mov r9b, 0x1a
lea rcx, [rax + rax*4]
inc r9d
lea r9, [rdx + rcx*8]
test r13b, 0xfc
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x1404492c1
je 0x1404492fa
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x1404492d2
jb 0x1404492ec
mov eax, dword [rdx + 8]
test r14w, r9w
clc
add eax, ecx
clc
cmp r8, rax
jb 0x1404492fd
add rdx, 0x28
jmp 0x1404492f5
jmp 0x1404492b5
xor edx, edx
clc
test rdx, rdx
jmp 0x140449305
jne 0x140449317
sub al, al
jmp 0x140449312
jmp 0x140449347
cmp dword [rdx + 0x24], 0
jmp 0x140449320
jge 0x14044932d
xor al, al
jmp 0x140449347
mov al, 1
jmp 0x140449334
jmp 0x140449347
sub al, al
jmp 0x140449340
jmp 0x140449347
add rsp, 0x18
jmp 0x140449350
ret
Function at 0x14045ae20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsx rcx, bp
lea rcx, [rsp + 0x30]
jmp 0x14045ae32
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
test r12b, 0x8a
cmp r11b, r15b
add rsp, 0x28
jmp 0x14045ae4d
ret

Function at 0x14045b0dd
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
test r10b, 0x59
sub ecx, ecx
jmp 0x14045b0ec
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14045b177
mov ecx, 0x5a4d
cmp r14d, 0x66916639
cmp rdx, rsi
cmp word [rax], cx
jmp 0x14045b112
jne 0x14045b177
movsxd rcx, dword [rax + 0x3c]
jmp 0x14045b124
lea rcx, [rcx + rax]
stc
cmp dword [rcx], 0x4550
jmp 0x14045b134
jne 0x14045b177
mov eax, 0x20b
cmc
cmp r8w, r11w
cmp word [rcx + 0x18], ax
jmp 0x14045b14d
jne 0x14045b177
cmp dword [rcx + 0x84], 0xe
jbe 0x14045b177
cmp dword [rcx + 0xf8], 0
setno al
jmp 0x14045b16f
setne al
jmp 0x14045b17d
sub al, al
stc
test al, r11b
add rsp, 0x28
jmp 0x14045b186
ret