joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403ec494
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmp r14w, 0x4675
cmp bpl, al
push r14
rcl r14d, 0x16
push rsi
movzx r14, di
push rdi
push rbx
bt di, 0xa
clc
sub rsp, 0x90
ror ebx, 0x81
add bh, 0xb5
bswap r14w
movaps xmmword [rsp + 0x80], xmm6
rol rdi, 0xd1
clc
rol r14d, cl
mov r14, rcx
movsx di, r15b
mov dword [rcx + 8], 0
mov qword [rcx + 0x10], 0
movzx bx, r10b
bts di, si
not bl
mov rdi, qword [rcx + 0x18]
btr bx, dx
sal bx, cl
mov rbx, qword [rcx + 0x20]
cmp esp, esp
jmp 0x1403ec50d
cmp rdi, rbx
je 0x1403ec5f2
lea r15, [0x1400beb30]
jmp 0x1403ec522
xorps xmm6, xmm6
jmp 0x1403ec557
lea rsi, [rdi + 0x18]
call fcn.14012e38b
movups xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
add rdi, 0x30
test r15b, sil
clc
test ah, 0x82
cmp rdi, rbx
jmp 0x1403ec551
je 0x1403ec5dc
mov qword [rdi], r15
or cl, r10b
add cl, bpl
mov rcx, qword [rdi + 0x18]
cmp bx, si
cmc
test rcx, rcx
jmp 0x1403ec570
je 0x1403ec53e
mov rdx, qword [rdi + 0x28]
cmp r12b, 0x47
test r14b, dil
sub rdx, rcx
test al, sil
test r15b, 0x9b
cmp rdx, 0x1000
jmp 0x1403ec597
jb 0x1403ec52a
mov rax, qword [rcx - 8]
test r10b, 0x99
jmp 0x1403ec5aa
add rcx, 0xfffffffffffffff8
test ch, 0xd9
sub rcx, rax
jmp 0x1403ec5b9
cmp rcx, 0x20
jmp 0x1403ec5c2
jae 0x1403ec746
add rdx, 0x27
movsx ecx, bp
mov rcx, rax
jmp 0x1403ec5d7
jmp 0x1403ec52a
mov rax, qword [r14 + 0x18]
jmp 0x1403ec5e5
mov qword [r14 + 0x20], rax
not eax
movsxd rax, ebp
cmovp ax, bx
mov qword [r14 + 0x30], 0
movsx rax, si
cwde
lea rax, [0x1400bed70]
mov qword [rsp + 0x28], rax
jmp 0x1403ec610
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
neg ch
xor cx, r9w
shr al, 0x48
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
add cl, bh
mov qword [rsp + 0x78], 0
shl eax, cl
mov rcx, rsp
mov dword [rsp + 0x30], 0
lea rax, [r14 + 0x38]
bts rcx, r12
neg cx
not rcx
mov dword [r14 + 0x40], 0
sub ch, 0xfe
cmc
lea rcx, [rsp + 0x28]
cmp si, 0x2698
cmp rax, rcx
jmp 0x1403ec674
je 0x1403ec6fc
lea rcx, [r14 + 0x48]
test bp, r13w
xor edx, edx
sub r8d, r8d
jmp 0x1403ec68c
call fcn.1403ee3ef
lea rcx, [r14 + 0x60]
mov rdx, qword [rsp + 0x50]
sbb r8b, spl
bswap r8d
adc r8d, edx
mov r8, qword [rsp + 0x58]
cmc
sub r8, rdx
stc
cmp r11b, 0xb
sar r8, 5
jmp 0x1403ec6ba
call fcn.1403ee3ef
add r14, 0x78
mov rdx, qword [rsp + 0x68]
sbb cl, 0x93
rol rcx, 0x15
mov r8, qword [rsp + 0x70]
rcr rcx, 0xda
stc
sub r8, rdx
bts cx, r9w
movzx ecx, di
sar r8, 5
movsx rcx, r8w
movsxd rcx, r11d
mov rcx, r14
jmp 0x1403ec6f7
call fcn.1403ee3ef
lea rcx, [rsp + 0x28]
jmp 0x1403ec706
call fcn.1403ee1ef
movaps xmm6, xmmword [rsp + 0x80]
sal r15b, 0xe6
rcl r15b, cl
add rsp, 0x90
pop rbx
pop rdi
movsxd r14, esp
jmp 0x1403ec72f
pop rsi
xchg r15b, r14b
movzx r15, di
jmp 0x1403ec73c
pop r14
pop r15
jmp 0x1403ec745
ret
call fcn.1404ba2d1
int3
Function at 0x1403fa332
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
jmp 0x1403fa33f
push r14
and r14b, bpl
bt r14d, edi
push r12
btr r14w, ax
push rsi
and r14w, r9w
push rdi
test dx, 0x108a
movsx r14w, sil
push rbx
shl r14d, 0x6f
sub rsp, 0x28
mov r14, r8
test edx, 0x2dee0137
test rdx, rdx
je 0x1403fa542
mov rdi, rdx
xchg r12b, r12b
cmc
mov r12, rcx
xor ebx, ebx
jmp 0x1403fa38b
jmp 0x1403fa3b7
mov rcx, r15
mov rdx, rsi
jmp 0x1403fa39b
call fcn.1403bf42a
add rbx, 0x50
jmp 0x1403fa3a9
dec rdi
jmp 0x1403fa3b1
je 0x1403fa539
mov eax, dword [r12 + rbx + 8]
cmp bl, 0xde
test r13w, r15w
mov dword [r14 + rbx + 8], eax
stc
cmp cx, sp
cmp r14, r12
jmp 0x1403fa3d4
je 0x1403fa3a0
cmp qword [r12 + rbx + 0x28], 0x10
jmp 0x1403fa3e5
jb 0x1403fa3fa
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403fa3f5
jmp 0x1403fa40a
lea r9, [r12 + rbx]
shr r15d, 0x9c
cmp bx, r12w
add r9, 0x10
lea r15, [r14 + rbx]
bswap eax
cdqe
add r15, 0x10
mov rsi, qword [r12 + rbx + 0x20]
adc ax, 0x1127
and ax, r12w
mov rax, qword [r14 + rbx + 0x28]
cmp rax, rsi
jmp 0x1403fa430
jae 0x1403fa44b
mov rcx, r15
mov rdx, rsi
jmp 0x1403fa441
call fcn.1403bf42a
jmp 0x1403fa47e
cmp rax, 0x10
jmp 0x1403fa454
jb 0x1403fa461
mov r15, qword [r14 + rbx + 0x10]
cqo
mov qword [r14 + rbx + 0x20], rsi
mov rcx, r15
mov rdx, r9
mov r8, rsi
jmp 0x1403fa474
call fcn.1404a79a8
mov byte [r15 + rsi], 0
mov rsi, qword [r12 + rbx + 0x40]
cmp spl, bl
stc
test r8b, 0x99
cmp qword [r12 + rbx + 0x48], 0x10
jmp 0x1403fa496
jb 0x1403fa4ab
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403fa4a6
jmp 0x1403fa4bd
lea r9, [r12 + rbx]
add al, dl
bswap r15w
bts r15d, r14d
add r9, 0x30
lea r15, [r14 + rbx]
cdqe
btr eax, 0xb1
rcr ah, cl
add r15, 0x30
mov ax, r12w
mov rax, qword [r14 + rbx + 0x48]
cmp r10b, 0x5d
cmp rax, rsi
jb 0x1403fa390
cmp rax, 0x10
jb 0x1403fa4f8
mov r15, qword [r14 + rbx + 0x30]
cwd
cdq
bswap cx
mov qword [r14 + rbx + 0x40], rsi
movsx r8d, bp
xchg cl, ch
movsxd rdx, r13d
mov rcx, r15
movsx rdx, sp
movsx r8d, r15w
movzx dx, sil
mov rdx, r9
movzx r8d, bp
mov r8, rsi
jmp 0x1403fa525
call fcn.1404a79a8
mov byte [r15 + rsi], 0
jmp 0x1403fa534
jmp 0x1403fa3a0
lea r14, [r14 + rbx]
add ebx, edi
xor bl, 0x96
mov rax, r14
btc si, 0x1f
inc bx
shl r15b, cl
add rsp, 0x28
xchg esi, r14d
movzx rbx, cx
mov r14w, bp
pop rbx
movsx si, bpl
pop rdi
pop rsi
pop r12
xchg r14b, r14b
jmp 0x1403fa571
pop r14
movzx r15d, sp
movsxd r15, ecx
pop r15
ret
Function at 0x1404300f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sal sil, cl
push rdi
bswap edi
or sil, r10b
adc sil, r8b
sub rsp, 0x28
cmc
mov rsi, rcx
xor edi, eax
movzx edi, dx
shld dx, r11w, 0x31
movzx edx, word [rcx + rdi*4 + 0x834]
clc
test dx, dx
jmp 0x14043012a
js 0x14043013d
mov rcx, rsi
jmp 0x140430138
call fcn.1404300f9
movsxd rcx, dword [rsi + 0x8860]
stc
test r8b, 0x17
jmp 0x14043014e
cmp ecx, dword [rsi + 0x8858]
jmp 0x140430159
jge 0x1404302fe
movsxd rax, dword [rsi + 0x885c]
add rax, rcx
sub r8b, 0xc9
shr r8b, 0xc4
mov ecx, esi
mov r8, qword [rsi + 8]
bsr cx, sp
and dl, 0xc5
lea edx, [rax + 3]
rcr ch, 0xec
bt rcx, 0xd4
ror ch, cl
test eax, eax
cmovns edx, eax
rcl cx, cl
shld cx, di, 0xce
btc cx, 0x22
mov rcx, qword [rsi + 0x18]
clc
cmp ch, 0xd3
sar edx, 2
cmp r12, rdx
movsxd rdx, edx
mov byte [rcx + rdx], 1
and dh, 0x73
or dl, 0xff
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
stc
cmc
cmp byte [rdx + rdi*4 + 3], 0x81
jb 0x140430227
movzx ecx, byte [rdx + rdi*4 + 2]
cmp r10w, 0x390e
cmp r10w, dx
test r13b, 0xe9
mov byte [r8 + rax], cl
cmovns cx, r10w
or cl, r15b
sbb cl, 0x65
movzx ecx, byte [rdx + rdi*4 + 1]
mov byte [r8 + rax + 1], cl
movzx ecx, byte [rdx + rdi*4]
cmp r9d, ebx
clc
cmc
mov byte [r8 + rax + 2], cl
btr cx, di
movzx ecx, byte [rdx + rdi*4 + 3]
mov byte [r8 + rax + 3], cl
inc ax
movsx ax, r10b
and al, bpl
mov eax, dword [rsi + 0x885c]
cmp rbx, 0x6fe01d82
jmp 0x14043023a
add eax, 4
cmp r15, 0x4d142cfb
cmc
mov dword [rsi + 0x885c], eax
cmp eax, dword [rsi + 0x8854]
jmp 0x140430256
jl 0x1404302fe
mov ecx, dword [rsi + 0x884c]
test r9w, ax
rol ah, cl
adc ax, r11w
mov eax, dword [rsi + 0x8858]
mov dword [rsi + 0x885c], ecx
test spl, bl
mov ecx, dword [rsi + 0x8860]
add ecx, dword [rsi + 0x8844]
mov dword [rsi + 0x8860], ecx
cmp ecx, eax
jl 0x1404302fe
mov ecx, dword [rsi + 0x8840]
cmp r9b, r10b
nop dword [rax]
cmc
test ecx, ecx
jmp 0x1404302ad
jle 0x1404302fe
mov edx, dword [rsi + 0x8864]
cmc
shl edx, cl
mov dword [rsi + 0x8844], edx
sar edx, 1
jmp 0x1404302cc
add edx, dword [rsi + 0x8850]
mov dword [rsi + 0x8860], edx
jmp 0x1404302dd
dec ecx
jmp 0x1404302e5
mov dword [rsi + 0x8840], ecx
cmp r9w, 0x17bc
cmp edx, eax
jmp 0x1404302f8
jge 0x1404302a6
add rsp, 0x28
movsx rsi, bp
pop rdi
mov si, 0x7ffa
jmp 0x140430310
pop rsi
jmp 0x140430316
ret
Function at 0x14043270d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
btc rax, 0x79
shl al, cl
cmp r10, 0x208a529a
sub rsp, 0x20
sbb ax, 0x35d
mov rsi, rcx
setnp ah
movzx eax, byte [rcx + 0x4828]
cmc
cmp al, 0xff
jmp 0x14043273b
je 0x14043274d
mov byte [rsi + 0x4828], 0xff
jmp 0x14043284a
mov rbx, qword [rsi]
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jmp 0x140432763
jae 0x140432790
lea rcx, [rax + 1]
jmp 0x140432772
mov qword [rbx + 0xc0], rcx
xchg rcx, rcx
movzx rcx, sp
movsxd rcx, r10d
movzx ecx, byte [rax]
jmp 0x14043278b
jmp 0x140432832
cmp dword [rbx + 0x30], 0
jmp 0x140432799
je 0x1404327f7
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
movzx dx, spl
mov rcx, qword [rbx + 0x28]
movsx edx, dx
mov rdx, rdi
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
cmp r10b, 0xab
sub ecx, dword [rbx + 0xd0]
test dl, 0xfd
add dword [rbx + 0xb8], ecx
clc
test eax, eax
jmp 0x1404327da
je 0x1404327fe
cdqe
sub cl, spl
add rax, rdi
bswap cx
xchg ch, cl
not cl
movzx ecx, byte [rdi]
jmp 0x14043281b
mov al, 0xff
jmp 0x14043284a
mov dword [rbx + 0x30], 0
xor al, r14b
btc eax, esi
lea rax, [rbx + 0x39]
cmp r9w, 0x157d
mov byte [rbx + 0x38], 0
xor ecx, ecx
mov qword [rbx + 0xc8], rax
bsr ax, r13w
lea rax, [rbx + 0x39]
mov qword [rbx + 0xc0], rax
mov al, 0xff
cmc
cmp rdx, 0x2e9c670a
cmp cl, 0xff
jmp 0x140432844
je 0x140432893
add rsp, 0x20
setnp sil
pop rbx
movsx rsi, r8w
bswap si
pop rdi
mov rsi, 0x2166401e
movsx esi, si
pop rsi
jmp 0x14043286b
ret
lea rcx, [rax + 1]
mov qword [rbx + 0xc0], rcx
test r10, 0x743c6782
movzx eax, byte [rax]
jmp 0x14043288b
cmp al, 0xff
jne 0x14043284a
mov rbx, qword [rsi]
bt eax, 0x4e
btc rax, r10
shld rax, r12, 0xeb
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jmp 0x1404328b6
jb 0x14043286c
cmp dword [rbx + 0x30], 0
je 0x140432976
mov r8d, dword [rbx + 0x34]
movsx edx, cx
movzx rcx, cx
lea rdi, [rbx + 0x38]
movzx rcx, sp
xchg rdx, rdx
mov rcx, qword [rbx + 0x28]
jmp 0x1404328e5
mov rdx, rdi
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
test r12b, 0x6e
cmp dl, 0x86
jmp 0x1404328fd
sub ecx, dword [rbx + 0xd0]
cmc
add dword [rbx + 0xb8], ecx
cmp r15b, bl
test eax, eax
je 0x140432923
movsxd rcx, eax
add rcx, rdi
movzx eax, byte [rdi]
jmp 0x140432943
mov dword [rbx + 0x30], 0
adc cl, r12b
rcl rcx, cl
lea rcx, [rbx + 0x39]
test al, spl
mov byte [rbx + 0x38], 0
jmp 0x140432941
sub eax, eax
mov qword [rbx + 0xc8], rcx
sbb cl, 0xf8
or cx, r10w
lea rcx, [rbx + 0x39]
cmp r10b, bpl
jmp 0x14043295d
mov qword [rbx + 0xc0], rcx
jmp 0x140432969
cmp al, 0xff
je 0x140432893
jmp 0x14043284a
sub eax, eax
jmp 0x14043284a
Function at 0x140443310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sbb al, bpl
push rdi
rcl dil, cl
push rbx
test r9b, dil
shld si, r9w, 0xc4
sub rsp, 0x90
rcr si, cl
neg ax
movaps xmmword [rsp + 0x80], xmm7
setp al
test r10d, 0x6ac54513
movaps xmmword [rsp + 0x70], xmm6
or dil, cl
shr rsi, 0x34
mov rdi, rdx
neg sil
bsr si, sp
rcr esi, 0x4c
mov rsi, rcx
btr rax, 0x43
mov rax, qword [rdx]
cmp qword [rax + 0x18], 8
jmp 0x140443371
jb 0x140443381
mov rax, qword [rax]
rcl cx, 0x86
adc r9b, r8b
movsxd rcx, r8d
sal r9w, cl
shrd r9, rdi, 2
lea r9, [rax + rcx*2]
sub ebx, ebx
nop word cs:[rax + rax]
movzx eax, word [r9 + rbx*2]
cmp r12b, 3
cmp eax, 0xa
je 0x1404433cc
test eax, eax
jmp 0x1404433b9
je 0x1404433cc
inc rbx
jmp 0x1404433c7
jmp 0x1404433a0
test byte [rdi + 0x1c], 4
jmp 0x1404433d5
jne 0x14044355c
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi + 8]
movsd xmm0, qword [rax + 8]
setl r8b
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], ebx
jmp 0x1404433ff
mov dword [rsp + 0x28], 2
cdq
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x38]
mov r8, r14
bswap r8w
lea r8, [rsp + 0x40]
jmp 0x140443426
call fcn.14044a093
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov cx, 0x659a
movaps xmmword [rsp + 0x40], xmm0
seto cl
movsx rdx, bp
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x38]
movsx edx, ax
mov rax, qword [rcx]
movzx edx, sp
mov dx, r9w
lea rdx, [rsp + 0x40]
call qword [rax + 0x1e0]
test eax, eax
jmp 0x14044346f
je 0x1404434aa
mov ecx, eax
movzx r8d, si
jmp 0x140443480
movabs r8, 0xe31b45c42a775183
cmovg r9d, r10d
mov dl, 3
movzx r9w, r13b
jmp 0x14044349a
mov r9d, 0x4f
jmp 0x1404434a5
call fcn.1403b396a
movss xmm6, dword [rsp + 0x4c]
dec dx
not dh
movss xmm7, dword [rsp + 0x50]
btc rdx, 0x6a
lea rcx, [rsp + 0x38]
movzx dx, dil
lea rdx, [rsp + 0x40]
test r13w, r11w
sub r8d, r8d
jmp 0x1404434db
call fcn.1404438eb
movss xmm0, dword [rdi + 0x18]
jmp 0x1404434ea
movss dword [rsi], xmm0
jmp 0x1404434f3
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
shrd cx, r11w, 0xf1
xor cl, ch
movss xmm0, dword [rsp + 0x50]
movss dword [rsi + 8], xmm0
mov dword [rsi + 0xc], 0
add ch, 0x13
mov cl, r9b
btr rcx, rbx
movss dword [rsi + 0x10], xmm7
mov dword [rsi + 0x14], ebx
movzx cx, r12b
sub ch, 0xf6
setbe cl
mov rcx, qword [rsp + 0x38]
stc
cmp bp, 0x2587
test rcx, rcx
jmp 0x140443546
je 0x1404435bf
mov rax, qword [rcx]
jmp 0x140443554
call qword [rax + 0x10]
jmp 0x1404435bf
movss xmm0, dword [rdi + 0x18]
jmp 0x140443566
movss dword [rsi], xmm0
cvtsi2ss xmm1, ebx
mulss xmm1, dword [0x1400bfc14]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
jmp 0x140443584
movss xmm0, dword [0x1400bfc94]
jmp 0x140443591
movlps qword [rsi + 8], xmm0
mov rax, qword [rdi + 8]
movss xmm0, dword [rax + 0xc]
jmp 0x1404435a3
addss xmm0, dword [0x1400bfbd0]
movss dword [rsi + 0x10], xmm0
sar dil, 0x54
adc di, dx
mov dword [rsi + 0x14], ebx
jmp 0x1404435bf
movaps xmm6, xmmword [rsp + 0x70]
test r10b, 0xf7
movzx rbx, si
add sil, r15b
movaps xmm7, xmmword [rsp + 0x80]
movsx ebx, r9w
bt bx, 0xd7
ror di, cl
add rsp, 0x90
mov si, 0x34e6
jmp 0x1404435f3
pop rbx
mov sil, 0x49
movsx rsi, r11w
pop rdi
movzx si, bpl
pop rsi
jmp 0x140443607
ret
Function at 0x140448844
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044884d
movzx ecx, cx
jmp 0x140448855
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
add rsp, 0x28
jmp 0x14044886f
ret
Function at 0x140449f99
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
mov ax, cx
mov rax, qword [rcx]
jmp 0x140449fab
call qword [rax + 0x28]
test eax, eax
jmp 0x140449fb5
je 0x140449feb
mov ecx, eax
cmc
xor r8w, bp
clc
movabs r8, 0xcafa59766d7f94e
or r9d, 0x44267475
mov dl, 3
mov r9d, 0x2a
jmp 0x140449fe2
add rsp, 0x28
jmp fcn.1403b396a
nop
add rsp, 0x28
jmp 0x140449ff5
ret

Function at 0x14044a093
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
adc sil, 0x33
push rdi
push rbp
shl sil, 0x50
push rbx
sal ebx, cl
cwde
btr bx, bp
sub rsp, 0x48
xadd bh, bh
movsxd rsi, esp
mov rax, r9
btc esi, r8d
stc
mov rsi, rdx
or bx, 0x4bbf
mov rdx, rcx
rcl r9b, 0xc8
bsf r9w, cx
and cx, di
mov ebx, dword [rsp + 0xa0]
test r9d, 0x565d7ac5
xor r9w, 0x684f
movzx r9, si
mov qword [rsp + 0x40], 0
bts rcx, rax
add r9b, 1
rol r9d, 0x3a
mov rcx, qword [0x1400b9300]
shrd r9d, ecx, 0x43
movzx r9w, r12b
movss xmm0, dword [r8]
or r9b, dl
movsx r9w, r8b
movss xmm1, dword [r8 + 4]
add r9b, bpl
mov r9, qword [rdx]
stc
cmp ebx, 0xffffffff
jmp 0x14044a12f
je 0x14044a142
mov r8d, ebx
jmp 0x14044a13d
jmp 0x14044a17f
mov rdx, 0xffffffffffffffff
inc r8b
btc r8d, 7
setb r8b
nop word [rax + rax]
btc r8w, r10w
lea r8, [rdx + 1]
test dil, sil
clc
cmp word [rax + rdx*2 + 2], 0
movzx dx, r13b
mov rdx, r8
jne 0x14044a163
mov ebp, dword [rsp + 0x98]
setbe dh
mov ebx, dword [rsp + 0x90]
movsxd rdx, esi
mov rdi, qword [rcx]
movsx rdx, dx
movzx dx, dh
movsx dx, al
lea rdx, [rsp + 0x40]
jmp 0x14044a1ac
mov qword [rsp + 0x30], rdx
movzx dx, bl
cqo
movss dword [rsp + 0x28], xmm1
movsx dx, r8b
movss dword [rsp + 0x20], xmm0
movzx dx, bh
bswap dx
xchg dx, dx
mov rdx, rax
jmp 0x14044a1da
call qword [rdi + 0x90]
test eax, eax
jmp 0x14044a1e7
je 0x14044a218
mov ecx, eax
setg r9b
movabs r8, 0xcafa59766d7f94e
mov dl, 3
movzx r9w, r13b
movzx r9d, r14w
jmp 0x14044a20d
mov r9d, 0x41
call fcn.1403b396a
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movsx edx, si
setp dl
mov edx, ebx
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
jmp 0x14044a235
mov rax, qword [rcx]
mov edx, ebp
jmp 0x14044a23f
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
adc dil, 0xd
rol bp, cl
mov qword [rsi], rax
mov rax, rsi
or rbp, 0x46ce5724
xadd bpl, sil
add rsp, 0x48
setbe sil
pop rbx
movzx si, cl
xchg di, si
pop rbp
bswap di
pop rdi
setns sil
mov sil, 0x93
movsx esi, si
pop rsi
jmp 0x14044a284
ret
Function at 0x14044aa41
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
bsr r14w, dx
push rdi
movsx ax, r15b
push rbx
sub rsp, 0x58
mov rax, r9
mov r14d, 0x2cdd56cc
mov r14, rdx
mov r9d, dword [rsp + 0xa0]
jmp 0x14044aa6d
movd xmm0, r8d
shr r8, 0x20
jmp 0x14044aa7b
movd xmm1, r8d
mov qword [rdx], 0
jmp 0x14044aa8c
cvttss2si r8d, xmm1
test r8d, r8d
jmp 0x14044aa99
jle 0x14044abc7
cvttss2si r10d, xmm0
xor r11d, r11d
movss xmm2, dword [0x1400bf4c0]
jmp 0x14044aabb
xor ebx, ebx
jmp 0x14044aac2
jmp 0x14044aadc
inc ebx
add r11d, r9d
cmc
clc
cmp ebx, r8d
jmp 0x14044aad6
je 0x14044abc7
mov rsi, r10
bt edx, 2
btc rdx, rsi
xor edx, 0x38c65eb6
mov edx, r11d
test r10d, r10d
jmp 0x14044aaf8
jg 0x14044ab87
jmp 0x14044aac7
movzx edi, dil
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
jmp 0x14044ab1b
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
movzx edi, byte [rax + rdx + 1]
jmp 0x14044ab38
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
movsx rdi, r12w
movzx edi, di
movzx edi, byte [rax + rdx + 2]
jmp 0x14044ab5d
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
jmp 0x14044ab76
add edx, 4
dec rsi
jmp 0x14044ab81
je 0x14044aac7
mov edx, edx
movzx edi, byte [rax + rdx + 3]
clc
cmp edi, 0xff
jmp 0x14044ab9a
je 0x14044ab76
test edi, edi
jmp 0x14044aba7
jne 0x14044ab03
mov byte [rax + rdx + 2], 0
jmp 0x14044abb7
mov word [rax + rdx], 0
jmp 0x14044abc2
jmp 0x14044ab76
mov rcx, qword [rcx + 0x18]
movzx dx, r14b
movabs rdx, 0x10000001c
jmp 0x14044abdf
mov qword [rsp + 0x38], rdx
jmp 0x14044abe9
movsd xmm2, qword [0x1400bfee0]
jmp 0x14044abf6
movsd qword [rsp + 0x40], xmm2
mov dword [rsp + 0x48], 0
jmp 0x14044ac09
mov qword [rsp + 0x50], 0
jmp 0x14044ac17
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
mov edx, edx
clc
sbb r8, rcx
inc edi
or rdx, rbx
movsx rbx, cx
jmp 0x14044ac39
mov rbx, qword [rcx]
movzx di, dl
mov qword [rsp + 0x28], r14
mov di, 0x4acb
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x20], rdi
movsx r8w, r8b
movzx r8w, r9b
mov r8, rax
call qword [rbx + 0x1c8]
test eax, eax
jmp 0x14044ac6d
je 0x14044ac96
mov ecx, eax
movabs r8, 0xad4a5352d2edebd0
bswap r9d
mov r9b, r15b
movzx r9, si
mov dl, 3
mov r9d, 0xd4
call fcn.1403b396a
mov rax, r14
add rsp, 0x58
bswap r14w
pop rbx
movzx edi, r9w
movsx si, sil
seto r14b
pop rdi
xchg sil, sil
setp sil
pop rsi
pop r14
jmp 0x14044acbf
ret
Function at 0x14044b3ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
test dl, 0xca
push rdi
rcl sil, cl
cmp ax, bx
sub rsp, 0xa8
xchg sil, dil
jmp 0x14044b3e9
movaps xmmword [rsp + 0x90], xmm10
movaps xmmword [rsp + 0x80], xmm9
cwde
movzx di, al
movaps xmmword [rsp + 0x70], xmm8
not al
lahf
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm6
bswap rdi
movsx rax, r11w
movaps xmm9, xmm3
cmovl edi, eax
mov rdi, rdx
mov rsi, rcx
cdq
cdqe
movss xmm8, dword [rsp + 0xe0]
mov rcx, qword [rcx + 0x20]
movups xmm0, xmmword [r8]
movaps xmmword [rsp + 0x30], xmm0
movsx rax, cx
rdtsc
cqo
mov rax, qword [rcx]
movsx dx, r9b
lea rdx, [rsp + 0x30]
jmp 0x14044b45b
call qword [rax + 0x40]
movsd xmm7, qword [rdi]
movaps xmm0, xmm7
jmp 0x14044b46a
call fcn.1404bc6fc
movaps xmm10, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x14044b47f
call fcn.1404bc6fc
unpcklps xmm10, xmm0
addps xmm10, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm10
movlps qword [rsp + 0x30], xmm10
movsd xmm7, qword [rdi + 8]
jmp 0x14044b4a4
movaps xmm0, xmm7
call fcn.1404bc6fc
movaps xmm6, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404bc6fc
movss dword [rdi + 8], xmm6
jmp 0x14044b4c5
unpcklps xmm6, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x14044b4d2
addps xmm6, xmm10
movlps qword [rsp + 0x38], xmm6
movss dword [rsp + 0x40], xmm9
jmp 0x14044b4ec
movss dword [rsp + 0x44], xmm9
mov rcx, qword [rsi + 0x18]
rdtsc
mov ax, bp
movzx edx, bp
mov r8, qword [rsi + 0x20]
bswap rax
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
mov dh, 0x15
cdq
lea rdx, [rsp + 0x30]
movaps xmm3, xmm8
jmp 0x14044b524
call qword [rax + 0x90]
movaps xmm6, xmmword [rsp + 0x50]
adc di, di
xor di, 0x61e
xor si, sp
movaps xmm7, xmmword [rsp + 0x60]
or sil, r10b
sal di, cl
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm9, xmmword [rsp + 0x80]
adc sil, r9b
movaps xmm10, xmmword [rsp + 0x90]
btc esi, 0x9b
add rsp, 0xa8
mov edi, 0x38170c28
jmp 0x14044b575
pop rdi
movzx rsi, r10w
pop rsi
jmp 0x14044b580
ret
Function at 0x14044cec5
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
cdqe
btc r8, 0x72
mov r8, rcx
shl ah, 0x19
cmp r15b, al
mov eax, 0x5a4d
cmp word [0x140000000], ax
jmp 0x14044ceea
jne 0x14044d00c
movsxd rcx, dword [0x14000003c]
sub edx, r10d
lea rdx, [0x140000000]
test r10w, di
lea rcx, [rcx + rdx]
cmp dword [rcx], 0x4550
jmp 0x14044cf14
jne 0x14044d00c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14044d00c
sub r8, rdx
setp al
bt rax, r9
movzx edx, word [rcx + 0x14]
shl eax, cl
add rdx, 0x18
and r9b, 0x62
adc r9, 0x75545b5b
lea rdx, [rdx + rcx]
movzx r9d, bx
movzx eax, word [rcx + 6]
xor r9b, r13b
rcl r9b, 0xa0
lea rcx, [rax + rax*4]
movsxd r9, esp
sar r9b, 0x68
lea r9, [rdx + rcx*8]
stc
cmp dx, 0x3317
cmp r10b, dl
mov qword [rsp], rdx
cmp r10b, sil
cmp rdx, r9
jmp 0x14044cf82
je 0x14044cfc8
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x14044cf93
jb 0x14044cfba
mov eax, dword [rdx + 8]
cmp spl, 0xd1
stc
add eax, ecx
test r8w, 0x60e3
test sp, bp
cmp r8, rax
jmp 0x14044cfb4
jb 0x14044cfcb
add rdx, 0x28
jmp 0x14044cfc3
jmp 0x14044cf73
xor edx, edx
stc
test rdx, rdx
jmp 0x14044cfd3
jne 0x14044cfe5
sub al, al
jmp 0x14044cfe0
jmp 0x14044d01f
cmp dword [rdx + 0x24], 0
jmp 0x14044cfee
jge 0x14044d000
sub al, al
jmp 0x14044cffb
jmp 0x14044d01f
mov al, 1
jmp 0x14044d007
jmp 0x14044d01f
xor al, al
jmp 0x14044d013
jmp 0x14044d01f
add rsp, 0x18
jmp 0x14044d028
ret
Function at 0x14045e88a
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
not ch
movsxd rcx, r14d
lea rcx, [rsp + 0x30]
jmp 0x14045e89d
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmp dil, 0x66
add rsp, 0x28
jmp 0x14045e8b5
ret

Function at 0x14045e984
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
stc
test di, 0x2b31
cmp esp, esi
push rbp
mov rbp, rsp
setp al
sub rsp, 0x20
mov rax, qword [0x1400b7288]
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x14045e9b5
jne 0x14045ea7f
and qword [rbp + 0x18], 0
movsxd rcx, eax
xchg cx, cx
lea rcx, [rbp + 0x18]
jmp 0x14045e9cf
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045e9de
mov qword [rbp + 0x10], rax
jmp 0x14045e9e7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x14045e9f8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
cmp r14w, r15w
clc
stc
xor qword [rbp + 0x10], rax
jmp 0x14045ea13
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
cmc
lea rcx, [rbp + 0x10]
test bpl, r14b
shl rax, 0x20
xor rax, qword [rbp + 0x20]
test ah, 0xeb
stc
test r9d, ebx
xor rax, qword [rbp + 0x10]
and bpl, r12b
xor rax, rcx
sbb cx, ax
bsf ecx, esp
bsr ebp, edi
movabs rcx, 0xffffffffffff
and rax, rcx
sal ecx, 0xce
rcl cx, 0x10
movabs rcx, 0x2b992ddfa233
movsxd rbp, r13d
cmp rax, rbx
movzx ebp, si
cmove rax, rcx
add bpl, 0xa0
ror bx, cl
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
cmp r14w, bx
and bpl, r12b
movzx rbp, r8w
not rax
jmp 0x14045ea9d
mov qword [0x1400b7280], rax
not bp
sal rbp, 0xb7
add rsp, 0x20
pop rbp
ret