joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403dfe24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub r10w, 0x1102
shld r9d, r15d, 0xa6
push rdi
sbb r9b, r14b
bts r10w, r14w
mov r10b, spl
push rbx
bswap r9d
mov r9b, dl
mov r9, rcx
add r8, rdx
btc r10w, r14w
mov dword [rcx + 8], 0
xor eax, eax
movzx r10, r12w
movsx r10d, r9w
setns r10b
xor ecx, ecx
shl r10b, cl
nop word cs:[rax + rax]
movsx r10, dx
lea r10, [rdx + 1]
jmp 0x1403dfe81
cmp r10, r8
jmp 0x1403dfe89
ja 0x1403e010e
movzx edi, byte [rdx]
or dl, r12b
mov edx, edi
clc
and edx, 0x7f
jmp 0x1403dfea2
shl rdx, cl
cmp spl, 0x76
cmp r8w, r8w
add rax, rdx
dec dx
cwd
shld dx, sp, 0xe1
add rcx, 7
sal edx, 0xd2
btr dx, sp
xadd dx, dx
mov rdx, r10
cmc
test dil, dil
js 0x1403dfe78
mov rcx, rax
cmp sp, r15w
jmp 0x1403dfee2
and rcx, 0xfffffffffffffff8
stc
clc
test r10b, 0
and eax, 7
clc
cmp sp, 0x2dcc
cmp rcx, 8
jmp 0x1403dfefe
je 0x1403e006c
cmp rax, 1
jg 0x1403dff33
test rax, rax
jmp 0x1403dff16
je 0x1403e0013
cmp eax, 1
jne 0x1403e010e
lea rdx, [r10 + 8]
jmp 0x1403dff2e
jmp 0x1403e0056
cmp eax, 5
jmp 0x1403dff3b
je 0x1403e0051
cmp eax, 2
jmp 0x1403dff49
jne 0x1403e010e
mov rsi, r10
cmovne rax, r14
sub edi, edi
bsr eax, r12d
xor ecx, ecx
and rax, r15
nop word cs:[rax + rax]
movsxd rax, r10d
mov eax, 0x741a785d
movzx rax, sp
lea rax, [rsi + 1]
cmp rax, r8
jmp 0x1403dff84
ja 0x1403e010e
mov r11, rdi
or bx, cx
movzx ebx, byte [rsi]
shrd si, bp, 0x7c
movzx dx, r11b
and sil, cl
mov edx, ebx
sub sil, 0xc8
movsx esi, r8w
clc
and edx, 0x7f
rol si, cl
mov sil, r14b
clc
shl rdx, cl
add rdi, rdx
btr si, dx
sub sil, 0x60
bswap si
add rcx, 7
shld si, r11w, 0xa4
bswap si
xchg rsi, rsi
mov rsi, rax
stc
cmc
test bl, bl
jmp 0x1403dffe2
js 0x1403dff78
lea rdx, [rdx + r11]
clc
test r11b, 0x71
add rdx, rax
jmp 0x1403dfffd
cmp rdx, r8
jmp 0x1403e0005
cmova rdx, rax
jmp 0x1403e000e
jmp 0x1403dfe55
mov rax, r10
or dh, 0xb4
nop
movzx dx, r14b
bsr edx, ebp
lea rdx, [rax + 1]
cmp r9b, al
cmc
test dil, dil
cmp rdx, r8
ja 0x1403e010e
cmp byte [rax], 0
movsx eax, r9w
mov rax, rdx
jmp 0x1403e0046
js 0x1403e0023
jmp 0x1403dfe55
lea rdx, [r10 + 4]
cmc
cmp rdx, r8
jmp 0x1403e005e
cmova rdx, r10
jmp 0x1403e0067
jmp 0x1403dfe55
cmp eax, 2
jmp 0x1403e0074
jne 0x1403e010e
mov dword [r9 + 8], 2
mov rsi, r10
sar dx, cl
sub dl, 0
sub eax, eax
clc
rcl rdx, cl
xor ecx, ecx
cqo
cmp r15d, 0x6b8561d7
nop word [rax + rax]
xor dh, bl
lea rdx, [rsi + 1]
test r10b, bl
cmp rdx, r8
ja 0x1403e010e
movzx r11d, byte [rsi]
add sil, 0xf
rol rsi, cl
movzx rdi, cx
mov edi, r11d
and edi, 0x7f
shl rdi, cl
bts si, r9w
rcr sil, cl
sbb sil, r12b
lea rax, [rax + rdi]
cmovb rsi, r8
add rcx, 7
mov rsi, rdx
test r11b, r11b
jmp 0x1403e00ee
js 0x1403e00a4
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], rax
lea rdx, [rdx + rax]
jmp 0x1403e0105
cmp rdx, r8
jbe 0x1403dfe55
cmp r10, r8
movsx rdi, r8w
movzx ebx, di
seta al
pop rbx
movzx si, r8b
movsx rsi, r10w
pop rdi
movsx si, r12b
not si
pop rsi
jmp 0x1403e0134
ret
Function at 0x1403f3ec1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r11b, cl
push r14
shl r15, 0x39
btc r14, rbp
push r13
bsf r14, rsi
push r12
shr r13b, 0xba
mov r14w, 0x3b7e
push rsi
push rdi
push rbx
bsr r12w, r8w
sub rsp, 0x30
shr sil, 0x46
movaps xmmword [rsp + 0x20], xmm6
mov r15, r9
mov r12, r8
movsx esi, r13w
clc
bts r14, rdx
mov r14, rdx
bswap si
rcl sil, 0x48
mov r13, rcx
or sil, cl
sub sil, 0x5e
shld rsi, r10, 0xc9
mov rsi, qword [rcx]
test rsi, rsi
jmp 0x1403f3f29
je 0x1403f4048
mov rbx, qword [r13 + 8]
test r12w, 0x43b7
cmp rsi, rbx
jmp 0x1403f3f41
je 0x1403f3ff6
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f3f53
jmp 0x1403f3f7d
call fcn.14026e02c
movups xmmword [rsi + 0x10], xmm6
cmp r9, r15
mov byte [rsi], 0
clc
test r15b, al
add rsi, 0x20
cmp rsi, rbx
jmp 0x1403f3f77
je 0x1403f3fec
mov rax, qword [rsi + 0x18]
jmp 0x1403f3f89
cmp rax, 0x10
jmp 0x1403f3f92
jb 0x1403f3f5d
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1403f3f58
mov rdi, qword [rcx - 8]
cmp dl, r15b
test r10, 0x5619128f
add rcx, 0xfffffffffffffff8
jmp 0x1403f3fc7
sub rcx, rdi
cmp r11b, 0xf9
cmp rcx, 0x20
jae 0x1403f40f1
add rax, 0x28
mov rdx, rax
mov rcx, rdi
jmp 0x1403f3fe7
jmp 0x1403f3f58
mov rsi, qword [r13]
test rbx, r15
rcl rdx, cl
mov rdx, qword [r13 + 0x10]
jmp 0x1403f3fff
sub rdx, rsi
clc
stc
cmp rdx, 0x1000
jb 0x1403f4040
mov rax, qword [rsi - 8]
cmp r9b, sil
clc
add rsi, 0xfffffffffffffff8
clc
cmp bp, 0x225
sub rsi, rax
cmp rsi, 0x20
jmp 0x1403f402f
jae 0x1403f40f1
add rdx, 0x27
movzx rsi, cx
mov rsi, rax
mov rcx, rsi
call fcn.14026e02c
mov qword [r13], r14
bsr edi, edi
shrd rdi, rcx, 0xc4
cmovs rsi, r13
shl r12, 5
xadd bl, bh
mov bl, dil
lea r12, [r12 + r14]
bt bx, 2
rcl bh, 0x58
test r15d, esi
mov qword [r13 + 8], r12
xor r12b, 0xec
shl r15, 5
add r15, r14
stc
cmp bp, 0x6948
mov qword [r13 + 0x10], r15
bt si, 0xaa
btr r15w, 0x2c
movaps xmm6, xmmword [rsp + 0x20]
test rbp, 0x1b4b5616
shr dil, cl
add rsp, 0x30
movzx r14, r9w
cmovge esi, r10d
movzx r14w, al
pop rbx
bswap esi
movsxd r14, r12d
pop rdi
pop rsi
xchg r15, r14
movzx r15d, r14w
pop r12
movsx r13, bx
movsx r14w, spl
movsxd r15, r9d
pop r13
movzx r15d, bx
bswap r15
pop r14
movsx r15d, bp
xchg r15b, r15b
jmp 0x1403f40e9
pop r15
jmp 0x1403f40f0
ret
call fcn.1404b5e2e
int3
Function at 0x1403fddd7
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
jmp 0x1403fdde7
test r8, r8
jmp 0x1403fddef
je 0x1403fde6f
movzx r9d, word [r8]
clc
test r9w, r9w
jmp 0x1403fde03
je 0x1403fdeaf
xor eax, eax
mov r10, rcx
clc
nop dword [rax + rax]
clc
cmc
cmp rdx, rax
jmp 0x1403fde21
je 0x1403fe05a
mov word [r10], r9w
bt r9w, dx
sar r9b, cl
add r10, 2
not r9
movzx r9, si
bswap r9w
movzx r9d, word [r8 + rax*2 + 2]
inc rax
cmp r10w, r9w
cmp r10b, 0xb0
test r9w, r9w
jmp 0x1403fde5c
jne 0x1403fde19
sub rdx, rax
jmp 0x1403fde6a
jmp 0x1403fdeb2
movzx r9d, word [0x1400b8f10]
cmc
test r9w, r9w
jmp 0x1403fde81
je 0x1403fdec0
cmp rdx, 0x104
jmp 0x1403fde9b
mov r8d, 0x104
jmp 0x1403fdea6
cmovb r8, rdx
jmp 0x1403fdfea
mov r10, rcx
test rdx, rdx
jne 0x1403fe05a
jmp 0x1403fe068
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
movsxd r11, r14d
mov rax, qword [rax + 0x18]
shld r8, rbx, 0x9e
shl r8b, cl
mov rax, qword [rax + 0x10]
sar r9b, cl
add r11b, 0xe9
not r8b
movzx r8d, word [rax + 0x58]
dec r10
rol r9w, 0xe
cmp r8, rdx
cmovae r8, rdx
bts r9w, r15w
bts r9w, cx
mov r9, qword [rax + 0x60]
xadd r11b, r11b
dec r11
rol r10d, cl
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x1403fdf2a
je 0x1403fdf89
xor eax, eax
nop word cs:[rax + rax]
clc
cmp r8, rax
je 0x1403fdf97
mov word [r10], r11w
btr r11, 0x80
btc r11w, 0xc1
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1403fdf68
inc rax
test r12b, 0xd8
clc
cmp r15w, r15w
test r11w, r11w
jne 0x1403fdf41
sub r8, rax
test r11w, r15w
cmp bl, 0x51
clc
test r8, r8
jmp 0x1403fdf91
je 0x1403fdfaa
mov word [r10], 0
clc
sub r10d, 0x609754dc
movsx r8w, bpl
movzx r9d, word [0x1400b8f10]
movzx r8w, bl
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x1403fdfcd
cmovb r8, rdx
sal r10d, cl
mov r10b, 0x9c
mov r10, rcx
cmp di, 0x7061
cmc
test r9w, r9w
je 0x1403fe04c
xor edx, edx
dec ax
lea rax, [0x1400b8f10]
mov r10, rcx
cmp r13w, di
nop dword [rax + rax]
clc
cmp rdx, 0x398a0793
cmc
cmp r8, rdx
je 0x1403fe05a
mov word [r10], r9w
setns r9b
add r10, 2
movzx r9w, bpl
inc r9b
movzx r9d, word [rax + rdx*2 + 2]
inc rdx
clc
jmp 0x1403fe03a
test r9w, r9w
jmp 0x1403fe043
jne 0x1403fe00e
sub r8, rdx
test r8, r8
jmp 0x1403fe054
je 0x1403fe068
mov word [r10], 0
bswap dx
rdtsc
not rdx
movabs rax, 0xe039ec0d24fefd13
mov dx, dx
mov qword [rsp], rax
bswap dx
movabs rax, 0x2247bce40ef3a5e6
not dx
mov qword [rsp + 8], rax
cdq
movabs rdx, 0xe05dec612491fd3d
mov qword [rsp + 0x10], rdx
jmp 0x1403fe0a3
mov qword [rsp + 0x18], rax
lahf
lea rax, [rsp + 0x10]
jmp 0x1403fe0b3
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
cmp al, 0xa7
jmp 0x1403fe0d3
nop word cs:[rax + rax]
cmp word [rcx + 2], 0
jmp 0x1403fe0e7
lea rcx, [rcx + 2]
jmp 0x1403fe0f0
jne 0x1403fe0dd
test ax, ax
jmp 0x1403fe0fe
je 0x1403fe142
lea rdx, [rsp + 2]
nop word cs:[rax + rax]
stc
test r9, r11
mov word [rcx], ax
rcl ah, 0x53
shld eax, r11d, 0x90
add rcx, 2
btc ax, 0xd5
shrd ax, dx, 0xb
stc
movzx eax, word [rdx]
add rdx, 2
test ax, ax
jne 0x1403fe118
mov word [rcx], 0
test r12w, r10w
add rsp, 0x28
ret
Function at 0x14042b7f2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
or sil, 0x9e
dec sil
push rdi
sub rsp, 0x28
mov rsi, rcx
dec edi
movsx edi, r13w
rol dil, 5
movzx edi, dx
sbb dl, sil
rol dx, cl
bt dx, 0x9d
movzx edx, word [rcx + rdi*4 + 0x834]
clc
cmp eax, r10d
cmp rsi, 0x6c925d0b
test dx, dx
jmp 0x14042b835
js 0x14042b848
mov rcx, rsi
jmp 0x14042b843
call fcn.14042b7f2
movsxd rcx, dword [rsi + 0x8860]
stc
cmp r12w, sp
cmp ecx, dword [rsi + 0x8858]
jmp 0x14042b85f
jge 0x14042b9f6
movsxd rax, dword [rsi + 0x885c]
lea rax, [rax + rcx]
movsx edx, bp
rcl dl, 0x8c
mov r8b, 0xd8
mov r8, qword [rsi + 8]
bts edx, eax
add dl, 0xc9
xor dx, 0x3e0
lea edx, [rax + 3]
test dl, sil
or ch, 0xf2
sal ch, 0xbc
test eax, eax
cmovns edx, eax
sbb rcx, 0x3f34f14
mov rcx, qword [rsi + 0x18]
test cl, bh
cmp r13d, ebp
sar edx, 2
cmc
movsxd rdx, edx
mov byte [rcx + rdx], 1
adc rdx, 0x753a14bf
mov rdx, qword [rsi + 0x8838]
stc
clc
test rdi, rbx
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp bx, 0x549a
cmp byte [rdx + rdi*4 + 3], 0x81
jb 0x14042b926
movzx ecx, byte [rdx + rdi*4 + 2]
stc
clc
test r9b, sil
mov byte [r8 + rax], cl
movsx rcx, r15w
movzx ecx, byte [rdx + rdi*4 + 1]
mov byte [r8 + rax + 1], cl
cmp r15, r10
bt cx, 0x44
test sil, bpl
movzx ecx, byte [rdx + rdi*4]
test dil, bpl
mov byte [r8 + rax + 2], cl
movzx ecx, byte [rdx + rdi*4 + 3]
cmp r13b, 0x90
mov byte [r8 + rax + 3], cl
bswap ax
sbb al, r10b
mov eax, dword [rsi + 0x885c]
add eax, 4
mov dword [rsi + 0x885c], eax
cmp eax, dword [rsi + 0x8854]
jmp 0x14042b940
jl 0x14042b9f6
mov ecx, dword [rsi + 0x884c]
mov eax, dword [rsi + 0x8858]
clc
test rax, 0x6546581c
cmp r12, r10
mov dword [rsi + 0x885c], ecx
mov ecx, dword [rsi + 0x8860]
add ecx, dword [rsi + 0x8844]
stc
test bl, r14b
test r13b, 0x9e
mov dword [rsi + 0x8860], ecx
cmp dh, 0xae
stc
test ch, 0x35
cmp ecx, eax
jmp 0x14042b98a
jl 0x14042b9f6
mov ecx, dword [rsi + 0x8840]
nop dword [rax]
stc
test ecx, ecx
jmp 0x14042b9a5
jle 0x14042b9f6
mov edx, dword [rsi + 0x8864]
test r11d, 0x4ae1594d
cmp r10b, 0x2d
shl edx, cl
cmc
clc
mov dword [rsi + 0x8844], edx
test r8b, r10b
sar edx, 1
stc
test ch, 0xc6
add edx, dword [rsi + 0x8850]
jmp 0x14042b9da
mov dword [rsi + 0x8860], edx
dec ecx
cmc
mov dword [rsi + 0x8840], ecx
cmp edx, eax
jmp 0x14042b9f0
jge 0x14042b99e
add rsp, 0x28
pop rdi
movsxd rsi, r10d
xchg si, si
pop rsi
jmp 0x14042ba07
ret
Function at 0x140434c28
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
adc r15b, r9b
btr r15w, 0x6c
rcl r15, cl
push rsi
push rdi
neg r15
sub r15b, al
push rbx
sbb r15w, sp
cmc
xchg r15d, r15d
sub rsp, 0x20
movzx r15, bx
mov r15, rcx
jmp 0x140434c59
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
cbw
rcr ebx, cl
mov rcx, qword [rdx + 8]
rcl bl, cl
mov rax, qword [rdx]
movsx ebx, bx
bswap bx
rol bl, 0xe4
mov rbx, rcx
stc
sub rbx, rax
cmp eax, r14d
sub rcx, rax
jmp 0x140434c8f
je 0x140434db5
js 0x140434dfa
mov r14, rdx
sar rbx, 6
cmp rcx, 0xfc1
jmp 0x140434cae
jb 0x140434ce2
or rcx, 0x27
jmp 0x140434cbd
call fcn.140447a6f
lea rdi, [rax + 0x27]
jmp 0x140434ccb
and rdi, 0xffffffffffffffe0
jmp 0x140434cd4
mov qword [rdi - 8], rax
jmp 0x140434cdd
jmp 0x140434cf0
call fcn.140447a6f
mov rdi, rax
xor sil, al
add sil, spl
mov qword [r15], rdi
sal sil, 0xaa
cmp cx, 0x4b3e
adc sil, 0x60
mov qword [r15 + 8], rdi
adc si, 0x6392
ror rsi, 0x5f
mov sil, 0xa1
shl rbx, 6
movzx esi, ax
inc esi
add rbx, rdi
movsx rsi, dx
mov qword [r15 + 0x10], rbx
xchg bx, bx
mov rbx, qword [r14]
setl sil
movsxd rsi, r10d
movzx si, r10b
mov rsi, qword [r14 + 8]
jmp 0x140434d3f
jmp 0x140434d56
add rdi, 0x40
test r8b, dil
add rbx, 0x40
cmp sil, 0xb2
test esp, r12d
cmp rbx, rsi
je 0x140434da6
mov qword [rdi + 0x38], 0
btr cx, 0x4c
shld rcx, r11, 0xfc
adc ch, 0xe3
mov rcx, qword [rbx + 0x38]
jmp 0x140434d82
test rcx, rcx
je 0x140434d44
mov rax, qword [rcx]
jmp 0x140434d93
mov rdx, rdi
jmp 0x140434d9b
call qword [rax]
mov qword [rdi + 0x38], rax
jmp 0x140434d44
mov qword [r15 + 8], rdi
add r14b, 3
bts r14, r11
dec r14b
mov rax, r15
add rsp, 0x20
xchg rbx, r14
movsx r15w, r12b
mov rbx, 0x3ab858d5
pop rbx
movsx si, r10b
movzx r15, r11w
pop rdi
xchg r15b, sil
movzx r14d, r11w
mov r14b, r9b
pop rsi
movsx r15w, r13b
mov r15b, 0x29
pop r14
mov r15b, 0x46
mov r15w, r10w
pop r15
jmp 0x140434df9
ret
call fcn.1403bb432
int3
Function at 0x14043f94b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
sub r14w, 0x2dbc
jmp 0x14043f959
push rdi
push rbx
rcr r14w, cl
cdqe
sub rsp, 0x28
bts si, r15w
mov esi, edx
neg bl
mov r14, rcx
btc rax, r14
btr di, si
mov rax, qword [rcx]
ror dil, cl
ror dil, 8
mov ebx, dword [rax + 0x10]
stc
nop word cs:[rax + rax]
btc rdi, r12
rol dil, 0xc2
movsx edi, r13w
mov edi, esi
xor sil, al
cmp r10b, r10b
clc
lea esi, [rdi + 1]
test bpl, 0x6b
test r12d, r14d
cmp bh, 0x5b
cmp esi, ebx
jmp 0x14043f9bc
jge 0x14043f9e5
mov rcx, r14
cdq
movzx edx, di
movsx edx, bx
mov edx, esi
jmp 0x14043f9d3
call fcn.1404403cf
test eax, eax
jmp 0x14043f9df
je 0x14043f99f
cmp edi, ebx
movzx eax, bp
cmovge esi, ebx
not r14b
movsx di, bl
mov eax, esi
or sil, r11b
xchg bx, di
add rsp, 0x28
movzx esi, r11w
xchg rbx, rbx
pop rbx
movsx esi, r15w
movsxd r14, r10d
pop rdi
mov r14b, 0x81
pop rsi
cmovg r14w, bx
movzx r14, r8w
pop r14
jmp 0x14043fa24
ret
Function at 0x140443df3
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140443dfc
movzx ecx, cx
jmp 0x140443e04
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
clc
cmp eax, 0x100
mov al, sil
setae al
cmc
jmp 0x140443e1f
add rsp, 0x28
ret

Function at 0x14044559c
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get number of processors

Disassembly:
sub rsp, 0x28
cdqe
setl ah
movzx rax, r15w
mov rcx, qword [rcx]
movsx ax, r14b
movzx rax, r13w
mov rax, qword [rcx]
jmp 0x1404455bd
call qword [rax + 0x28]
test eax, eax
jmp 0x1404455c7
je 0x14044560b
mov ecx, eax
sar dl, 0xe6
movsxd r9, edx
movabs r8, 0xcafa59766d7f94e
bt r9, rax
mov dl, 3
and r9w, si
cmp r9w, di
rol r9w, 4
mov r9d, 0x2a
jmp 0x1404455fd
add rsp, 0x28
jmp 0x140445606
jmp fcn.1403af0d7
nop
test r11w, dx
cmp sil, r8b
cmc
add rsp, 0x28
jmp 0x14044561d
ret

Function at 0x140446b1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
movzx si, bl
push rdi
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm9
movzx edi, r15w
cdqe
movaps xmmword [rsp + 0x60], xmm8
movzx rsi, r13w
cmovb si, di
movsx rax, sp
movaps xmmword [rsp + 0x50], xmm7
mov al, r10b
movaps xmmword [rsp + 0x40], xmm6
setle sil
cwde
bswap rsi
movaps xmm8, xmm3
cdqe
not al
movsx rdi, r13w
mov rdi, rdx
mov dl, dil
movsx esi, di
xchg al, sil
mov rsi, rcx
setbe ah
movsx eax, bx
mov rcx, qword [rcx + 0x20]
movzx ax, r12b
cbw
rdtsc
movups xmm0, xmmword [r8]
jmp 0x140446b9a
movaps xmmword [rsp + 0x20], xmm0
bswap dx
lahf
cmovns rax, r13
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
jmp 0x140446bb4
call qword [rax + 0x40]
movsd xmm6, qword [rdi]
movaps xmm0, xmm6
jmp 0x140446bc3
call fcn.1404b8243
movaps xmm9, xmm0
jmp 0x140446bd1
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x140446bdd
call fcn.1404b8243
unpcklps xmm9, xmm0
addps xmm9, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm9
movlps qword [rsp + 0x20], xmm9
movsd xmm6, qword [rdi + 8]
jmp 0x140446c02
movaps xmm0, xmm6
jmp 0x140446c0a
call fcn.1404b8243
movaps xmm7, xmm0
jmp 0x140446c17
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
call fcn.1404b8243
movss dword [rdi + 8], xmm7
unpcklps xmm7, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x140446c35
addps xmm7, xmm9
movlps qword [rsp + 0x28], xmm7
movss dword [rsp + 0x30], xmm8
cdq
setne ch
movss dword [rsp + 0x34], xmm8
mov ax, bx
mov rcx, qword [rsi + 0x18]
movsx dx, r13b
bswap dx
movsx rax, r14w
mov r8, qword [rsi + 0x20]
not ah
rdtsc
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x98]
movaps xmm6, xmmword [rsp + 0x40]
movzx di, r8b
cmp r12b, 0x24
movaps xmm7, xmmword [rsp + 0x50]
movzx rdi, r15w
neg dil
movaps xmm8, xmmword [rsp + 0x60]
stc
cmp cx, r8w
btr esi, ebp
movaps xmm9, xmmword [rsp + 0x70]
add rsp, 0x88
mov sil, 0x60
movsx edi, cx
pop rdi
jmp 0x140446cc1
pop rsi
ret
Function at 0x140448519
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
adc r8b, sil
movsxd rax, r9d
mov r8, rcx
mov eax, 0x5a4d
cmp r8b, 0x3d
cmp word [0x140000000], ax
jmp 0x14044853b
jne 0x140448648
movsxd rcx, dword [0x14000003c]
movzx edx, r9w
xadd rdx, rdx
lea rdx, [0x140000000]
lea rcx, [rcx + rdx]
test r8w, 0x868
cmp dword [rcx], 0x4550
jmp 0x14044856c
jne 0x140448648
mov eax, 0x20b
stc
test r13b, 0x22
cmp word [rcx + 0x18], ax
jmp 0x140448585
jne 0x140448648
sub r8, rdx
xadd dl, r9b
movzx edx, word [rcx + 0x14]
and r9d, 0x743e36ea
cwde
inc eax
add rdx, 0x18
cmovae r9w, dx
add rdx, rcx
movzx eax, word [rcx + 6]
neg r9
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp ax, si
jmp 0x1404485c8
cmp rdx, r9
jmp 0x1404485d0
je 0x140448605
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x1404485e1
jb 0x1404485fc
mov eax, dword [rdx + 8]
stc
jmp 0x1404485f0
add eax, ecx
stc
cmp r8, rax
jb 0x140448607
add rdx, 0x28
jmp 0x1404485bb
sub edx, edx
test rdx, rdx
jmp 0x14044860f
jne 0x140448621
sub al, al
jmp 0x14044861c
jmp 0x140448656
cmp dword [rdx + 0x24], 0
jmp 0x14044862a
jge 0x14044863c
xor al, al
jmp 0x140448637
jmp 0x140448656
mov al, 1
jmp 0x140448643
jmp 0x140448656
sub al, al
jmp 0x14044864f
jmp 0x140448656
add rsp, 0x18
ret
Function at 0x140459e61
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsx rcx, dx
lea rcx, [rsp + 0x30]
jmp 0x140459e73
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmc
clc
add rsp, 0x28
jmp 0x140459e89
ret

Function at 0x14045b6fe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmp r13w, 0x6b2a
test rsp, r12
mov qword [rsp + 0x10], rbp
jmp 0x14045b717
mov qword [rsp + 0x18], rsi
push rdi
and dil, r14b
or dil, r11b
sub rsp, 0x20
neg di
movzx edi, ax
mov rsi, rcx
mov rdi, rdx
mov rcx, qword [rcx]
cmp rcx, rdx
jmp 0x14045b73e
je 0x14045b7e6
sub ebp, ebp
cmp bh, 0xe7
test rcx, rcx
jmp 0x14045b751
je 0x14045b75c
call fcn.1401d7628
mov qword [rsi], rbp
clc
test r13d, esi
cmc
test rdi, rdi
je 0x14045b7e6
mov rbx, rdi
cmp word [rdi], bp
jmp 0x14045b778
je 0x14045b790
add rbx, 2
cmp word [rbx], bp
jmp 0x14045b78a
jne 0x14045b77e
sub rbx, rdi
setae ch
xor ch, 0x7e
add rbx, 2
sar rbx, 1
cmc
add rbx, rbx
mov rcx, rbx
call fcn.14018a770
mov qword [rsi], rax
cmp rdx, rdi
test r14d, 0x1be20948
test rax, rax
jmp 0x14045b7c1
je 0x14045b7e6
mov r8, rbx
cqo
mov rdx, rdi
movzx ecx, ax
movzx rcx, dx
xchg cx, cx
mov rcx, rax
jmp 0x14045b7e1
call fcn.1404a3400
mov rbx, qword [rsp + 0x30]
bsr ebp, r14d
bsf rax, rdi
btc eax, ebx
mov rax, rsi
mov rsi, qword [rsp + 0x40]
movsx bp, r13b
sal bp, 0x7c
mov rbp, qword [rsp + 0x38]
bts edi, esp
mov edi, ebp
bt di, 0xd5
add rsp, 0x20
movzx rdi, r8w
mov dil, r8b
pop rdi
ret
Function at 0x14045ec84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
test r12w, 0x7593
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
inc bpl
neg ebp
btc rbp, r9
push rsi
push rdi
push r12
stc
mov bpl, spl
rol bpl, cl
push r14
shr bpl, 6
mov bpl, 0x5c
not bpl
push r15
mov r15b, r15b
movsxd rbp, esp
sub rsp, 0x40
adc r15b, 0x84
bsr r15w, di
btc rbp, 0x91
xor r12d, r12d
mov r15, r8
and bp, cx
mov qword [rax + 0x20], r12
jmp 0x14045ecea
or rdi, 0xffffffffffffffff
mov rbp, rcx
jmp 0x14045ecf6
inc rdi
test bl, 0xae
cmp byte [rdi + rcx], r12b
jne 0x14045ecf6
add rdi, 1
movzx esi, r12w
movsx r14d, bx
jmp 0x14045ed17
mov rbx, r12
mov rsi, rdi
movzx r14, r15w
setb r14b
cmovp r14w, bp
mov r14, rcx
jmp 0x14045ed32
je 0x14045ed96
lea r9, [rsp + 0x88]
not rdx
cdq
mov qword [rsp + 0x20], r15
jmp 0x14045ed4f
mov r8, rsi
cmova cx, cx
jmp 0x14045ed5e
lea rcx, [rsp + 0x70]
bswap dx
mov rdx, r14
call fcn.1404593e2
test eax, eax
jle 0x14045ed96
cdqe
jmp 0x14045ed7d
inc rbx
test r10w, r15w
lea r14, [r14 + rax]
sub rsi, rax
jmp 0x14045ed90
jne 0x14045ed38
inc rbx
movsx rcx, r13w
mov edx, 2
xchg cl, cl
mov rcx, rbx
jmp 0x14045edac
call fcn.1401d82da
mov r14, rax
test rax, rax
jmp 0x14045edbc
je 0x14045eea7
mov qword [rsp + 0x30], r12
xor esi, 0x67713c21
movzx rsi, r8w
mov rsi, rax
cmp r12b, r8b
cmc
clc
test rbx, rbx
jmp 0x14045ede1
je 0x14045ee4e
lea r9, [rsp + 0x30]
bswap dx
xchg dx, cx
mov qword [rsp + 0x20], r15
bswap r8w
movsx dx, al
cdq
mov r8, rdi
mov rdx, rbp
movsx cx, r8b
movsx ecx, ax
mov rcx, rsi
jmp 0x14045ee16
call fcn.1404593e2
test eax, eax
jle 0x14045ee4e
cdqe
cmp r8b, 0x57
jmp 0x14045ee2e
add rsi, 2
cmp r9b, dil
test dl, dh
lea rbp, [rbp + rax]
cmp bh, 0xd1
sub rbx, 1
jmp 0x14045ee48
jne 0x14045ede7
lea r11, [rsp + 0x40]
movsx edi, ax
mov ax, di
cbw
mov word [rsi], r12w
lahf
cbw
mov rbx, qword [r11 + 0x38]
mov rax, r14
mov rbp, qword [r11 + 0x40]
mov r12w, r10w
movzx r14w, bpl
movsx r14d, bp
mov rsp, r11
setbe r14b
pop r15
not si
movzx r12d, di
mov esi, 0x487026cb
pop r14
movzx r12, bp
movsx edi, bp
pop r12
pop rdi
jmp 0x14045eea0
pop rsi
jmp 0x14045eea6
ret
call fcn.140458b7e
int3
Function at 0x14046bb98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
jmp 0x14046bbb6
mov qword [rax + 0x10], rbp
bt bp, 0x5c
sar bp, cl
mov qword [rax + 0x18], rsi
not bpl
rol sil, cl
sbb rsi, 0x29084a79
mov qword [rax + 0x20], rdi
push r14
sets r14b
btc rbp, 0x43
cmc
sub rsp, 0x20
bt si, 0x12
mov rdi, qword [rsp + 0x50]
movsx rsi, r15w
sub rbp, 0x12db50d5
mov r14, r9
sub si, sp
bsr si, r10w
mov rsi, r8
sub bpl, 0x28
mov rbp, rdx
cmp si, 0xac0
test rdi, rdi
je 0x14046bceb
mov rbx, qword [r8 + 8]
clc
test rbx, rbx
je 0x14046bcd1
mov rax, qword [rbx + 0x40]
bswap r8w
shrd r8w, si, 0x15
movzx r8d, word [r14]
test r8w, r13w
cmp qword [rax], 0
jmp 0x14046bc4c
je 0x14046bc8e
mov rax, qword [rbx + 0x58]
test sil, 4
cmp dword [rax], 0
jle 0x14046bc8e
dec dword [rax]
cdq
mov rcx, qword [rbx + 0x40]
mov edx, 0x52ac6e79
cbw
mov rdx, qword [rcx]
lea rax, [rdx + 2]
jmp 0x14046bc7d
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x14046bc89
jmp 0x14046bcb7
mov rax, qword [rbx]
movzx edx, r8w
mov rcx, rbx
jmp 0x14046bc9d
mov rax, qword [rax + 0x18]
call qword [0x1400b8d90]
movzx r8d, ax
movzx rax, r12w
movzx ax, dl
movsx rax, di
mov eax, 0xffff
jmp 0x14046bcc2
cmp ax, r8w
jmp 0x14046bccb
jne 0x14046bcd8
mov byte [rsi], 1
cmp bl, sil
stc
add r14, 2
sub rdi, 1
jmp 0x14046bce5
jne 0x14046bc24
movups xmm0, xmmword [rsi]
mov rbx, qword [rsp + 0x30]
movzx rdi, r12w
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
or r14b, 0x84
sal r14b, cl
sub r14w, r11w
movdqu xmmword [rbp], xmm0
xor r14b, r9b
mov rbp, qword [rsp + 0x38]
cmc
mov r14d, ebp
add rsp, 0x20
movsx r14w, r14b
pop r14
jmp 0x14046bd30
ret