joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403e078c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
movzx r9, r9w
push rdi
shr r10w, cl
push rbx
ror r10b, 0x6a
mov r9, rcx
lea r8, [r8 + rdx]
mov r10b, 0x8a
cmp r14b, r9b
mov dword [rcx + 8], 0
sub eax, eax
xor ecx, ecx
xor r10d, ebx
shr r10b, 0xa4
mov r10b, 0xac
nop word cs:[rax + rax]
sbb r10b, r15b
cmp bp, r15w
rcl r10w, 0xef
lea r10, [rdx + 1]
jmp 0x1403e07e1
cmp r10, r8
ja 0x1403e0a3a
movzx edi, byte [rdx]
shr rdx, cl
mov edx, edi
and edx, 0x7f
test ax, 0x2760
shl rdx, cl
lea rax, [rax + rdx]
adc dl, 0x3e
rcl dx, 0x9b
shr rdx, 0x4c
add rcx, 7
mov rdx, r10
test dil, dil
jmp 0x1403e081a
js 0x1403e07d5
mov rcx, rax
and rcx, 0xfffffffffffffff8
test edx, 0x6c68300c
and eax, 7
cmp cx, r11w
test cl, r15b
cmp rcx, 8
je 0x1403e0986
cmp rax, 1
jmp 0x1403e084a
jg 0x1403e0875
test rax, rax
je 0x1403e0928
cmp eax, 1
jmp 0x1403e0861
jne 0x1403e0a3a
lea rdx, [r10 + 8]
jmp 0x1403e0870
jmp 0x1403e0970
cmp eax, 5
jmp 0x1403e087d
je 0x1403e096c
cmp eax, 2
jmp 0x1403e088b
jne 0x1403e0a3a
mov rsi, r10
sub edi, edi
sub ecx, ecx
bts ax, r13w
cmp r12, rdi
nop word cs:[rax + rax]
sal al, 4
lea rax, [rsi + 1]
stc
cmc
test bp, r13w
cmp rax, r8
jmp 0x1403e08c0
ja 0x1403e0a3a
mov r11, rdi
movzx ebx, byte [rsi]
shrd esi, ebx, 0x8b
shld si, r14w, 5
mov edx, ebx
and edx, 0x7f
movzx si, sil
shl rdx, cl
cmp r10, 0x40b176c1
lea rdi, [rdi + rdx]
sal sil, 0xa9
rcl sil, 0xc6
add rcx, 7
mov rsi, rax
test bl, bl
jmp 0x1403e0904
js 0x1403e08ae
lea rdx, [rdx + r11]
lea rdx, [rdx + rax]
cmp rdx, r8
jmp 0x1403e091a
cmova rdx, rax
jmp 0x1403e0923
jmp 0x1403e07af
mov rax, r10
bts rdx, r11
sbb dl, 0xc4
nop
not dx
rcr dx, 0x7a
lea rdx, [rax + 1]
cmp r14d, 0x43c73f7d
cmp rdx, r8
ja 0x1403e0a3a
cmp byte [rax], 0
bswap ax
cwde
sete ah
mov rax, rdx
jmp 0x1403e0961
js 0x1403e093b
jmp 0x1403e07af
lea rdx, [r10 + 4]
cmp rdx, r8
jmp 0x1403e0978
cmova rdx, r10
jmp 0x1403e0981
jmp 0x1403e07af
cmp eax, 2
jne 0x1403e0a3a
mov dword [r9 + 8], 2
inc dl
not rsi
mov rsi, r10
sub eax, eax
sar edx, 0x14
sub ecx, ecx
nop word [rax + rax]
lea rdx, [rsi + 1]
cmp rdx, r8
jmp 0x1403e09b8
ja 0x1403e0a3a
movzx r11d, byte [rsi]
sub sil, bl
mov rdi, 0x608b32df
mov edi, r11d
rcl rsi, cl
ror si, cl
and edi, 0x7f
xchg sil, sil
shl rdi, cl
movzx esi, bp
rcl sil, cl
lea rax, [rax + rdi]
add si, bx
mov rsi, r15
rol si, 0x94
add rcx, 7
and sil, 0xde
mov rsi, rdx
cmc
test al, spl
test r11b, r11b
js 0x1403e09ac
mov qword [r9 + 0x10], rdx
jmp 0x1403e0a14
mov qword [r9 + 0x18], rax
test sp, r13w
cmp r14w, r9w
add rdx, rax
jmp 0x1403e0a2c
cmp rdx, r8
jmp 0x1403e0a34
jbe 0x1403e07af
cmp r10, r8
movsx di, r12b
mov bl, sil
seta al
not esi
seta sil
pop rbx
movsx rsi, bx
movsx edi, r11w
pop rdi
pop rsi
ret
Function at 0x1403e590b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmovs r15, rsi
shl r15b, 0xaf
inc r15d
push r14
push r13
push r12
push rsi
cmp dil, 0x48
push rdi
push rbp
and r13d, r14d
xchg r15b, r13b
push rbx
test r12d, r13d
bts r15w, r10w
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov r14, r9
adc r13b, r11b
movsxd rbx, ecx
bsf r12w, r12w
mov r15, r8
movzx rbx, sp
adc r13, 0x23fa0d95
mov r12, rdx
stc
bt r13, r10
mov r13, rcx
shld bx, sp, 0xb8
movsx bx, spl
mov rbx, qword [rcx]
cmc
stc
test rbx, rbx
jmp 0x1403e597b
je 0x1403e5ac7
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403e598d
je 0x1403e5a6a
lea rbp, [0x1400bed30]
jmp 0x1403e599f
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e59ab
jmp 0x1403e59e1
call fcn.14018e3c0
movups xmmword [rbx + 0x20], xmm6
cmc
cmp r14b, r8b
mov byte [rbx + 0x10], 0
cmp rsp, 0x4a20416f
add rbx, 0x38
cmp r11d, 0x45991ecb
cmp rbx, rdi
jmp 0x1403e59db
je 0x1403e5a60
mov qword [rbx], rbp
xadd ax, ax
adc al, 0x4b
shr rax, 0xa1
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jb 0x1403e59b5
mov rcx, qword [rbx + 0x10]
add dl, 0xa3
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403e5a13
jb 0x1403e59b0
mov rsi, qword [rcx - 8]
clc
add rcx, 0xfffffffffffffff8
jmp 0x1403e5a28
sub rcx, rsi
test edi, 0x2cb84445
cmp bx, r11w
cmc
cmp rcx, 0x20
jmp 0x1403e5a3f
jae 0x1403e5b6e
add rax, 0x28
movsx rcx, r9w
mov rdx, rax
movsx ecx, sp
mov rcx, rsi
jmp 0x1403e5a5b
jmp 0x1403e59b0
mov rbx, qword [r13]
and dl, ch
bsf rdx, rcx
mov rdx, qword [r13 + 0x10]
test r9b, sil
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403e5a80
jb 0x1403e5aba
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
clc
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403e5a9b
jae 0x1403e5b6e
add rdx, 0x27
xchg bl, ch
movsx rbx, r10w
bswap ecx
mov rbx, rax
movsx ecx, bp
movsxd rcx, r8d
cmovo rcx, r15
mov rcx, rbx
jmp 0x1403e5ac2
call fcn.14018e3c0
mov qword [r13], r12
clc
jmp 0x1403e5ad1
imul rax, r15, 0x38
sub bh, al
add rax, r12
btc rsi, 0x81
sub ebx, esp
inc ebx
mov qword [r13 + 8], rax
ror r15d, cl
sal rax, 0x65
movzx r15, si
imul rax, r14, 0x38
xor si, r15w
shr bp, cl
bt r14d, 0xc5
lea rax, [rax + r12]
shl r15w, 0x79
cmp dl, dil
sub ebp, 0x3610280a
mov qword [r13 + 0x10], rax
sbb r12w, 0x2afe
inc r12d
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
movzx r14w, bl
movzx rbp, r8w
jmp 0x1403e5b38
pop rbx
bswap r15
pop rbp
movsxd rdi, r15d
movsx esi, r8w
pop rdi
pop rsi
movzx r12, si
not r12b
pop r12
bswap r15w
jmp 0x1403e5b5b
pop r13
pop r14
xchg r15d, r15d
bswap r15w
pop r15
jmp 0x1403e5b6d
ret
call fcn.1404b6dca
int3
Function at 0x1403e8494
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test eax, edi
test r15b, 0xd7
push r14
bt r14w, 0xaf
btc r14w, 0xc0
push rsi
push rdi
rol edi, cl
push rbx
xchg rbx, rbx
add r14b, r12b
sub rsp, 0x90
stc
movaps xmmword [rsp + 0x80], xmm6
cmovle bx, bp
rol dil, cl
mov r14, rcx
inc bl
mov dword [rcx + 8], 0
add bl, spl
xadd bx, di
cmp r14d, 0x37b42b3f
mov qword [rcx + 0x10], 0
rcl rbx, 0x55
movzx bx, bh
shld di, r12w, 0xec
mov rdi, qword [rcx + 0x18]
bt bx, r9w
bswap bx
mov rbx, qword [rcx + 0x20]
cmp rdi, rbx
jmp 0x1403e8515
je 0x1403e85e5
lea r15, [0x1400beb30]
jmp 0x1403e8527
xorps xmm6, xmm6
jmp 0x1403e855c
lea rsi, [rdi + 0x18]
jmp 0x1403e8538
call fcn.14018e3c0
movups xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
add rdi, 0x30
test r9d, 0x42e90343
cmp rdi, rbx
je 0x1403e85dd
mov qword [rdi], r15
movzx rcx, r15w
mov rcx, qword [rdi + 0x18]
cmp spl, 0xa4
clc
stc
test rcx, rcx
jmp 0x1403e8575
je 0x1403e8548
mov rdx, qword [rdi + 0x28]
test r12b, 0x6a
cmp rcx, r13
sub rdx, rcx
cmp cl, 0xb9
clc
cmp rdx, 0x1000
jb 0x1403e852f
mov rax, qword [rcx - 8]
cmc
jmp 0x1403e85a7
add rcx, 0xfffffffffffffff8
stc
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403e85b8
jae 0x1403e876f
add rdx, 0x27
mov rcx, 0x50182b03
movzx rcx, si
mov cl, sil
mov rcx, rax
jmp 0x1403e85d8
jmp 0x1403e852f
mov rax, qword [r14 + 0x18]
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x30], 0
movzx rax, bx
cbw
lea rax, [0x1400bed70]
jmp 0x1403e85ff
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
stc
bts cx, r14w
bsr cx, r8w
movups xmmword [rsp + 0x48], xmm0
bts rcx, r12
or cx, 0x13bf
xor cx, 0x70bd
movups xmmword [rsp + 0x58], xmm0
sar rcx, cl
cdqe
test r15b, 0x93
movups xmmword [rsp + 0x68], xmm0
sbb ch, 0x2d
cmp r14d, r14d
bt eax, 0x8f
mov qword [rsp + 0x78], 0
or rax, rdi
xchg ch, ah
ror al, 0xf0
mov dword [rsp + 0x30], 0
jmp 0x1403e8668
lea rax, [r14 + 0x38]
mov dword [r14 + 0x40], 0
sub cx, 0x1b91
btr ecx, r15d
lea rcx, [rsp + 0x28]
cmp rax, rcx
jmp 0x1403e868a
je 0x1403e870e
lea rcx, [r14 + 0x48]
xor edx, edx
test r14, 0x1d7a52fb
cmp r10b, r9b
xor r8d, r8d
jmp 0x1403e86a8
call fcn.1403ea458
lea rcx, [r14 + 0x60]
mov rdx, qword [rsp + 0x50]
xchg r8w, r8w
shl r8d, 0x9d
mov r8, qword [rsp + 0x58]
clc
test r15b, 0x32
sub r8, rdx
stc
test r9b, r15b
sar r8, 5
jmp 0x1403e86d8
call fcn.1403ea458
add r14, 0x78
sar dx, 0xd2
btr edx, 0xdd
or r8, rdx
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
sub r8, rdx
rol ch, cl
rcr ecx, cl
sar r8, 5
mov rcx, r14
jmp 0x1403e8709
call fcn.1403ea458
lea rcx, [rsp + 0x28]
jmp 0x1403e8718
call fcn.1403ea25e
movaps xmm6, xmmword [rsp + 0x80]
or rbx, 0x4e3f3e4c
bswap r15w
add rsp, 0x90
mov esi, r14d
mov r14b, 0x8c
movzx r14w, r11b
pop rbx
movzx di, r13b
mov r14, 0x23106d8a
pop rdi
pop rsi
movsx r15w, r10b
movzx r15w, r8b
bswap r14
pop r14
movsxd r15, r9d
xchg r15w, r15w
pop r15
jmp 0x1403e876e
ret
call fcn.1404b6dca
int3
Function at 0x140422b86
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
neg r9
xor si, 0x11a4
not r10w
mov r10, qword [rcx]
mov rsi, qword [rcx + 0x18]
btc r9, 0xf1
test cl, bpl
mov r9d, dword [r10 + 4]
cmp rcx, rsi
cmp r11b, 0x54
imul r9d, dword [r10]
cmp r15w, si
jmp 0x140422bba
cmp r8d, 2
jmp 0x140422bc3
jne 0x140422d56
test r9d, r9d
je 0x140422de7
lea ecx, [r9 - 1]
test r10d, edi
test sp, 0x440a
cmp ecx, 3
jmp 0x140422be6
jb 0x140422cdf
mov r11d, r9d
btc r8d, 0x5a
ror r10b, 0x5b
adc r10b, 0xa6
and r11d, 0xfffffffc
sbb r8d, 0x78e53726
dec r10
or r8d, r10d
nop word cs:[rax + rax]
btr r10, r11
movzx r8d, word [rsi]
movzx r10d, word [rsi + 4]
stc
sub ecx, ecx
mov cl, 0x5d
cmp r8w, word [rdx]
setne cl
neg ecx
and r8w, r13w
mov word [rsi + 2], cx
bsr r8d, r10d
not r8
rol r8, 0xfd
sub ecx, ecx
or cl, r10b
shr r8b, cl
rcr r8w, 0xe7
cmp r10w, word [rdx]
setne cl
add r8, 0x71b20683
adc r8w, r10w
neg ecx
mov word [rsi + 6], cx
rcl r8, cl
movzx r8d, word [rsi + 8]
jmp 0x140422c7a
xor ecx, ecx
cmp r8w, word [rdx]
movsxd r8, r12d
setne cl
xchg r8b, r8b
neg ecx
xor r8b, r9b
bsr r8w, bx
movzx r8w, dl
mov word [rsi + 0xa], cx
add r8d, 0xb963c23
btc r8, 0xeb
movzx r8d, word [rsi + 0xc]
xor ecx, ecx
clc
cmp r8w, word [rdx]
mov cl, r11b
setne cl
clc
test rbx, rdi
neg ecx
cmp r12b, 0xbe
mov word [rsi + 0xe], cx
stc
test r8, rbp
add rsi, 0x10
add r11d, 0xfffffffc
jmp 0x140422cd9
jne 0x140422c1e
test r9b, 3
jmp 0x140422ce8
je 0x140422de7
and r9d, 3
cmc
xor ecx, ecx
btc r8d, r14d
shld r8w, r15w, 0xaa
adc r8, 0x1d69074b
nop word cs:[rax + rax]
movzx r8d, word [rsi + rcx*4]
clc
xor eax, eax
or al, r11b
test rdi, rdi
rol al, cl
cmp r8w, word [rdx]
setne al
neg eax
jmp 0x140422d2f
mov word [rsi + rcx*4 + 2], ax
jmp 0x140422d39
inc rcx
test esp, 0x1add199a
cmc
cmp r9d, ecx
jmp 0x140422d4b
jne 0x140422d11
jmp 0x140422de7
test r9d, r9d
jmp 0x140422d5e
je 0x140422de7
movzx r10d, word [rdx]
shld r8, r12, 0x19
mov r8d, r9d
clc
stc
test dh, 0x9d
xor ecx, ecx
jmp 0x140422d8e
inc rcx
stc
cmp r8d, ecx
jmp 0x140422d88
je 0x140422de7
cmp word [rsi + rcx*8], r10w
jmp 0x140422d98
jne 0x140422d7c
movzx eax, word [rsi + rcx*8 + 2]
cmp ax, word [rdx + 2]
jmp 0x140422dac
jne 0x140422d7c
movzx eax, word [rsi + rcx*8 + 4]
cmc
cmp r13b, r9b
cmp ax, word [rdx + 4]
jmp 0x140422dc4
jne 0x140422d7c
mov word [rsi + rcx*8 + 6], 0
movzx r10d, r10w
setge r10b
movzx r10d, word [rdx]
jmp 0x140422de2
jmp 0x140422d7c
pop rsi
jmp 0x140422ded
ret
Function at 0x140444951
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044495a
movzx ecx, cx
jmp 0x140444962
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
clc
test ebx, ecx
cmp eax, 0x100
setae al
clc
cmp di, di
test rdx, 0x254b0ab0
add rsp, 0x28
jmp 0x14044498a
ret

Function at 0x140446096
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movsx eax, r9w
movsxd rax, r11d
movsx ax, al
mov rcx, qword [rcx]
movsx eax, r14w
cbw
mov rax, qword [rcx]
jmp 0x1404460b6
call qword [rax + 0x28]
test eax, eax
je 0x1404460ec
mov ecx, eax
not r9b
movabs r8, 0xcafa59766d7f94e
neg dl
ror r9d, cl
mov dl, 3
mov r9d, 0x2a
cmc
add rsp, 0x28
jmp 0x1404460e7
jmp fcn.1403afaf6
nop
cmp dil, 0x91
add rsp, 0x28
ret

Function at 0x140446175
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
bts ax, r9w
sbb al, r15b
push rbp
add al, r15b
cmc
push rbx
or ebx, 0x68005e9e
movzx eax, r15w
or bl, bpl
sub rsp, 0x48
test rbx, rbx
or bx, r13w
bsr esi, edx
mov rax, r9
cmovns rsi, r14
rcl bh, 0x80
mov rsi, rdx
mov rdx, rcx
shl r9w, cl
xadd bx, r9w
mov ebx, dword [rsp + 0xa0]
clc
shld r9w, si, 0x55
mov qword [rsp + 0x40], 0
rcl rcx, cl
bt ecx, 0x43
mov rcx, qword [0x1400b9300]
movsxd r9, ecx
xor r9w, 0x1a08
movss xmm0, dword [r8]
shrd r9w, r15w, 0xc3
cmp r15w, 0x638c
movss xmm1, dword [r8 + 4]
xadd r9, r9
or r9, 0x13ec7bb5
mov r9, qword [rdx]
cmp ebx, 0xffffffff
je 0x140446222
mov r8d, ebx
jmp 0x14044621d
jmp 0x14044625f
mov rdx, 0xffffffffffffffff
sub r8w, r12w
rcr r8b, cl
sal r8b, cl
nop word [rax + rax]
sub r8d, edx
lea r8, [rdx + 1]
cmc
cmp word [rax + rdx*2 + 2], 0
cdq
xchg edx, edx
movzx rdx, r12w
mov rdx, r8
jmp 0x140446259
jne 0x14044623f
mov ebp, dword [rsp + 0x98]
jmp 0x14044626e
mov ebx, dword [rsp + 0x90]
mov rdi, qword [rcx]
bswap edx
cmovg rdx, r14
lea rdx, [rsp + 0x40]
jmp 0x140446288
mov qword [rsp + 0x30], rdx
bswap dx
movss dword [rsp + 0x28], xmm1
xchg dl, dl
jmp 0x14044629d
movss dword [rsp + 0x20], xmm0
not dl
mov rdx, rax
jmp 0x1404462ad
call qword [rdi + 0x90]
test eax, eax
je 0x1404462e4
mov ecx, eax
movsx r9d, r15w
not dl
movzx r9w, r15b
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9d, 0x41
jmp 0x1404462df
call fcn.1403afaf6
mov rcx, qword [rsp + 0x40]
cdq
mov rax, qword [rcx]
mov edx, ebx
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
cmovns eax, ebp
xchg al, ah
mov al, ah
mov rax, qword [rcx]
movsx edx, r8w
cqo
cwd
mov edx, ebp
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
clc
rcr bp, cl
shr bl, 0x7e
mov qword [rsi], rax
setne bl
btc bp, 0x90
sbb edi, esi
mov rax, rsi
add rsp, 0x48
movzx esi, r9w
movzx di, r9b
pop rbx
pop rbp
movzx rdi, si
movsxd rsi, r11d
pop rdi
movzx esi, si
pop rsi
ret
Function at 0x1404471f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
dec r14b
movsx rax, ax
push rsi
shl al, cl
shr si, cl
push rdi
push rbp
movsxd rdi, r10d
rcr rdi, 0xd3
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov r14, r9
movzx ebx, r14w
movsx edi, di
cwde
mov rbx, r8
bswap si
movzx ax, r9b
mov rdi, rdx
cmovbe ebp, esp
rdtsc
mov rsi, rcx
not rax
cmovo dx, bp
jmp 0x140447248
movss xmm6, dword [rsp + 0xb0]
movzx rax, bp
cwde
movzx ebp, byte [rsp + 0xb8]
movzx edx, bp
rdtsc
mov qword [rsp + 0x38], 0
mov dh, 0x18
movzx edx, di
cdqe
mov rcx, qword [rcx + 8]
rdtsc
mov rax, qword [rcx]
xchg dl, dl
bswap rdx
lea rdx, [rsp + 0x38]
jmp 0x14044728c
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
movzx dx, r15b
mov rcx, qword [rsp + 0x38]
cwde
movsxd rax, eax
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
jmp 0x1404472b3
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
cdq
not r8d
movsx r8d, r11w
mov rdx, qword [rdi]
cdqe
mov rax, qword [rcx]
movsx r8w, r15b
mov r8d, 1
jmp 0x1404472de
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
movzx r8w, spl
mov rax, qword [rcx]
mov rdx, rdi
cmovo r8w, si
movsx r8, cx
movsxd r8, edx
mov r8d, ebx
jmp 0x140447305
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
rdtsc
mov edx, 0x11152c4d
mov dl, r9b
movzx edx, bpl
movzx rax, cx
setnp al
cwde
mov rax, qword [rcx]
jmp 0x14044732b
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
xchg ah, al
movsx rax, r8w
bswap eax
mov rax, qword [rcx]
jmp 0x140447343
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
movzx edx, dx
xchg rdx, rax
setne dh
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x40], xmm0
xchg rdx, rdx
mov rax, qword [rcx]
movzx edx, bx
lea rdx, [rsp + 0x40]
jmp 0x14044736e
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
not al
movsx rdx, dx
movsx edx, si
mov r8, qword [rsi + 0x20]
lahf
mov rdx, qword [rsp + 0x38]
nop
movzx rax, bx
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
movaps xmm3, xmm6
jmp 0x1404473a2
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
jmp 0x1404473b5
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
movzx ax, al
mov ah, bl
cbw
mov rax, qword [rcx]
jmp 0x1404473cd
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
bts di, bp
rcl rbp, 0x9a
bts bp, r11w
add rsp, 0x60
pop rbx
movsx r14w, al
setno r14b
cmovae si, dx
pop rbp
pop rdi
jmp 0x1404473ff
pop rsi
movsxd r14, r13d
pop r14
jmp 0x14044740a
ret
Function at 0x14044740b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
test spl, 6
shr sil, cl
btc si, 0xee
push rdi
movzx di, r8b
and sil, 0x1d
sub rsp, 0xa8
cmovbe rsi, rbx
seto dil
movaps xmmword [rsp + 0x90], xmm10
bswap rax
movaps xmmword [rsp + 0x80], xmm9
cdqe
movsxd rsi, r12d
movaps xmmword [rsp + 0x70], xmm8
cbw
movaps xmmword [rsp + 0x60], xmm7
mov eax, ecx
movaps xmmword [rsp + 0x50], xmm6
movzx ax, spl
movaps xmm9, xmm3
movsx rdi, r13w
bswap si
mov al, bpl
mov rdi, rdx
mov rsi, rcx
movss xmm8, dword [rsp + 0xe0]
mov rcx, qword [rcx + 0x20]
movups xmm0, xmmword [r8]
lahf
not dh
movsxd rax, edi
movaps xmmword [rsp + 0x30], xmm0
rdtsc
cbw
mov rax, qword [rcx]
movsx rdx, r9w
lea rdx, [rsp + 0x30]
call qword [rax + 0x40]
movsd xmm7, qword [rdi]
jmp 0x1404474b5
movaps xmm0, xmm7
call fcn.1404b91cd
movaps xmm10, xmm0
jmp 0x1404474c6
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x1404474d2
call fcn.1404b91cd
unpcklps xmm10, xmm0
addps xmm10, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm10
movlps qword [rsp + 0x30], xmm10
movsd xmm7, qword [rdi + 8]
jmp 0x1404474f7
movaps xmm0, xmm7
jmp 0x1404474ff
call fcn.1404b91cd
movaps xmm6, xmm0
jmp 0x14044750c
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404b91cd
movss dword [rdi + 8], xmm6
jmp 0x140447522
unpcklps xmm6, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x14044752f
addps xmm6, xmm10
movlps qword [rsp + 0x38], xmm6
movss dword [rsp + 0x40], xmm9
cwde
movzx r8w, r9b
movss dword [rsp + 0x44], xmm9
mov rcx, qword [rsi + 0x18]
rdtsc
bswap r8d
cwde
mov r8, qword [rsi + 0x20]
bswap dx
mov rax, qword [rcx]
jmp 0x140447566
mov qword [rsp + 0x20], 0
jmp 0x14044757d
lea rdx, [rsp + 0x30]
jmp 0x140447587
movaps xmm3, xmm8
call qword [rax + 0x90]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
setl sil
bt esi, edx
movaps xmm8, xmmword [rsp + 0x70]
or dil, r13b
ror esi, cl
movaps xmm9, xmmword [rsp + 0x80]
movaps xmm10, xmmword [rsp + 0x90]
bswap esi
bts rdi, rsi
add rsp, 0xa8
pop rdi
movsx rsi, bp
mov esi, r9d
mov si, 0x413c
pop rsi
jmp 0x1404475de
ret
Function at 0x140447cd7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sal r15w, 0x75
cmp r12b, cl
push r14
xor eax, ecx
rol al, 0xdc
movsx r14w, bpl
push rsi
sar r15b, cl
bsf r15d, edi
push rdi
xadd r14w, ax
inc rsi
push rbp
shr r15, cl
sub r14b, r13b
push rbx
rol r15d, cl
bt r15w, 0xc5
shl r14w, cl
sub rsp, 0x88
mov bpl, sil
lahf
movaps xmmword [rsp + 0x70], xmm8
movaps xmmword [rsp + 0x60], xmm7
mov bp, r11w
seta ah
movaps xmmword [rsp + 0x50], xmm6
mov r14, r8
setne sil
movsxd rdi, edx
mov rbx, rdx
mov r15, rcx
movzx rdx, r10w
movsxd rdx, r9d
mov ch, 0xac
mov rsi, qword [rsp + 0xe0]
movsx rax, bx
mov ebp, dword [rsp + 0xf0]
not ch
mov edx, dword [rsp + 0xe8]
jmp 0x140447d75
mov rdi, qword [r9]
cdqe
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x140447d85
call qword [rax + 0x18]
mov rax, qword [rdi]
mov rcx, rdi
bswap edx
mov dx, r11w
mov edx, ebp
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
cwde
bswap rax
mov al, r15b
movups xmm0, xmmword [r14]
cwd
cwde
cqo
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
mov r14d, 0x1128722f
lea r14, [rsp + 0x40]
xchg dl, dl
movsxd rdx, eax
mov rdx, r14
jmp 0x140447dcd
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
movaps xmm0, xmm7
call fcn.1404b91cd
movaps xmm8, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140447dec
call fcn.1404b91cd
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
jmp 0x140447e11
movaps xmm0, xmm7
jmp 0x140447e19
call fcn.1404b91cd
movaps xmm6, xmm0
jmp 0x140447e26
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140447e32
call fcn.1404b91cd
movss dword [rbx + 8], xmm6
jmp 0x140447e41
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
mov rcx, qword [r15 + 0x18]
lahf
mov rax, qword [r15 + 0x20]
jmp 0x140447e57
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
sub r8d, r8d
cmc
stc
nop
clc
cmp word [rsi + r8*2], 0
jmp 0x140447e72
lea r8, [r8 + 1]
jmp 0x140447e7b
jne 0x140447e67
dec r8d
cqo
mov rbp, qword [rcx]
mov qword [rsp + 0x28], rax
movzx r9d, r13w
cmovb edx, r15d
mov r9d, 0x79b116e2
mov qword [rsp + 0x20], r14
jmp 0x140447ea6
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 2
mov rdx, rsi
jmp 0x140447ec1
mov r9, rdi
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
mov rsi, 0x1c3710e6
movzx rbx, r9w
movaps xmm7, xmmword [rsp + 0x60]
setbe bl
shr r14b, cl
shrd r14w, sp, 3
movaps xmm8, xmmword [rsp + 0x70]
sub rsi, r15
add rsp, 0x88
movzx r14, r15w
pop rbx
pop rbp
not r15b
movsx esi, r11w
pop rdi
movzx r14, di
pop rsi
not r14b
pop r14
movzx r15, di
movzx r15w, cl
mov r15b, r14b
pop r15
jmp 0x140447f26
ret
Function at 0x140448ff3
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
not r8w
shl r8w, 0x43
mov r8, rcx
movzx rax, bp
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140449112
movsxd rcx, dword [0x14000003c]
movzx dx, dil
lea rdx, [0x140000000]
lea rcx, [rcx + rdx]
cmp dword [rcx], 0x4550
jmp 0x14044903b
jne 0x140449112
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x14044904f
jne 0x140449112
sub r8, rdx
add edx, edx
movzx edx, word [rcx + 0x14]
movsx r9w, r15b
lahf
bts r9d, r10d
add rdx, 0x18
bswap r9w
add rdx, rcx
sbb r9b, 0x57
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
btr r9, rbx
sar r9w, cl
movzx r9, r12w
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
jmp 0x140449098
cmp rdx, r9
jmp 0x1404490a0
je 0x1404490cf
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1404490c6
mov eax, dword [rdx + 8]
jmp 0x1404490bb
add eax, ecx
cmp r8, rax
jb 0x1404490d6
add rdx, 0x28
jmp 0x14044908f
sub edx, edx
stc
cmc
test ah, 0x28
test rdx, rdx
jmp 0x1404490de
jne 0x1404490f0
sub al, al
jmp 0x1404490eb
jmp 0x140449129
cmp dword [rdx + 0x24], 0
jge 0x140449106
xor al, al
jmp 0x140449101
jmp 0x140449129
mov al, 1
jmp 0x14044910d
jmp 0x140449129
sub al, al
jmp 0x140449119
jmp 0x140449129
add rsp, 0x18
jmp 0x140449132
ret
Function at 0x14045ab8e
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsx ecx, r10w
lea rcx, [rsp + 0x30]
jmp 0x14045aba0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmp r14w, 0x15ea
stc
add rsp, 0x28
jmp 0x14045abbb
ret

Function at 0x14045ac6c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
sbb ax, 0x6cde
sal ebx, 0xa4
btc rax, r12
push rbp
sal al, 0x37
movsx rbx, r14w
setp bpl
mov rbp, rsp
movzx ebx, dx
sub rsp, 0x20
cwde
lahf
btr bx, bp
mov rax, qword [0x1400b7288]
movabs rbx, 0x2b992ddfa232
test ah, 0xb6
stc
cmp rax, rbx
jmp 0x14045acb5
jne 0x14045ad91
and qword [rbp + 0x18], 0
movsxd rcx, edi
setne cl
movsx rcx, r13w
lea rcx, [rbp + 0x18]
jmp 0x14045acd3
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045ace2
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
test r9b, 0x77
clc
cmp rax, 0x5a476ca2
xor qword [rbp + 0x10], rax
jmp 0x14045ad03
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
cmp dh, 0x96
test dil, r15b
jmp 0x14045ad1a
xor qword [rbp + 0x10], rax
jmp 0x14045ad23
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
lea rcx, [rbp + 0x10]
shl rax, 0x20
test r15b, 0x47
cmp r8b, 0xfe
xor rax, qword [rbp + 0x20]
clc
jmp 0x14045ad46
xor rax, qword [rbp + 0x10]
xor rax, rcx
sar ch, 0x93
dec ebp
movabs rcx, 0xffffffffffff
and rax, rcx
rcr bpl, 0x94
movabs rcx, 0x2b992ddfa233
movzx rbp, di
dec bpl
ror bpl, 0x77
cmp rax, rbx
xchg bh, bh
cmove rax, rcx
shl bpl, 0xde
shld rbx, r15, 0x89
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
not rax
shr bpl, 0xdb
mov qword [0x1400b7280], rax
cmovae bp, bp
add rsp, 0x20
mov bp, 0x767
pop rbp
jmp 0x14045adb6
ret