joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403bf165
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
jmp 0x1403bf176
sub rsp, 0x50
xchg sil, sil
movaps xmmword [rsp + 0x40], xmm6
movsxd rsi, ecx
mov rsi, rcx
jmp 0x1403bf18e
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
jmp 0x1403bf19b
mov qword [rsp + 0x30], 0
jmp 0x1403bf1a9
mov qword [rsp + 0x38], 7
jmp 0x1403bf1b7
call fcn.1401dd499
movups xmmword [rsi + 0x40], xmm6
rdtsc
mov qword [rsi + 0x50], 0
not ch
rdtsc
xchg cl, ch
lea rax, [0x1400be020]
movsx edx, r13w
mov qword [rsi], rax
xchg cl, dh
cqo
not edx
movups xmmword [rsi + 0x58], xmm6
mov dl, 0x63
cmove cx, r11w
mov qword [rsi + 0x68], 0
movsxd rcx, r8d
movsx edx, dx
cqo
mov qword [rsi + 0x70], 7
mov qword [rsi + 0x78], 0
bswap ecx
movzx edx, r11w
movzx dx, r8b
lea rdx, [rsp + 0x20]
mov rcx, rsi
jmp 0x1403bf227
call fcn.1403c021f
mov rax, qword [rsp + 0x38]
cmc
cmp rax, 8
jmp 0x1403bf23b
jb 0x1403bf2b3
mov rcx, qword [rsp + 0x20]
rcr dl, 0x43
cmp r9b, 0x91
lea rdx, [rax + rax]
add rdx, 2
test bpl, r8b
cmp rdx, 0x1000
jb 0x1403bf2ae
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
test bx, 0x25e7
cmc
cmp rcx, 0x20
jmp 0x1403bf27f
jae 0x1403bf2f8
lea rax, [rax + rax]
dec cl
movsx edx, bx
adc cx, 0x7816
add rax, 0x29
mov rdx, rax
mov ecx, 0x9265031
movzx rcx, r15w
seto ch
mov rcx, r8
jmp 0x1403bf2ae
call fcn.140266bc7
lea rax, [0x1400be020]
mov qword [rsi], rax
bt ax, bx
bts ax, ax
adc rax, r10
mov rax, rsi
rol rsi, 0xb8
test r13b, 0x77
movaps xmm6, xmmword [rsp + 0x40]
add si, 0x34de
btc si, r11w
add rsp, 0x50
jmp 0x1403bf2f1
pop rsi
jmp 0x1403bf2f7
ret
call fcn.1404b040b
int3
Function at 0x1403e1386
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
and r15d, 0x254c2ece
or r15w, si
push r14
clc
push r13
add r15, 0x8a40fed
neg r13d
bsf r14, r13
push r12
cmova r12, rbp
ror r15, cl
and r13d, r14d
push rsi
movsx r12d, r14w
or r15b, al
sal r12b, 0xc
push rdi
dec r13w
push rbp
movzx r13, r11w
adc r14w, r10w
neg r13b
push rbx
cmovne r15w, sp
shr r15w, 0xb1
sub rsp, 0x38
sub r14b, 0x71
movaps xmmword [rsp + 0x20], xmm6
add r12w, r8w
test dx, 0x4c65
mov r14, r9
xor bx, sp
mov r15, r8
bt r13w, 0x79
movsx rbx, si
mov r12, rdx
and r13d, ebp
inc ebx
mov r13, rbx
mov r13, rcx
and bh, 0x50
or bh, 0x97
mov rbx, qword [rcx]
test rbx, rbx
je 0x1403e156b
mov rdi, qword [r13 + 8]
cmc
cmp rbx, rdi
jmp 0x1403e1430
je 0x1403e1517
lea rbp, [0x1400bed10]
jmp 0x1403e1442
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e144e
jmp 0x1403e147a
call fcn.140266bc7
movups xmmword [rbx + 0x20], xmm6
jmp 0x1403e1461
mov byte [rbx + 0x10], 0
cmp ecx, ebx
add rbx, 0x50
clc
cmp rbx, rdi
jmp 0x1403e1474
je 0x1403e150a
mov qword [rbx], rbp
cmove rcx, rbp
movsx cx, bl
lea rcx, [rbx + 0x38]
jmp 0x1403e148e
call fcn.1403de86c
mov rax, qword [rbx + 0x28]
test r8w, 0x249d
cmp rax, 0x10
jmp 0x1403e14a6
jb 0x1403e1458
mov rcx, qword [rbx + 0x10]
sar rdx, 0xe6
mov dx, 0x17e6
lea rdx, [rax + 1]
clc
cmp r12b, 0x1b
cmp rdx, 0x1000
jmp 0x1403e14cd
jb 0x1403e1453
mov rsi, qword [rcx - 8]
cmc
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x1403e162e
add rax, 0x28
cdq
movsx rdx, r8w
mov rdx, rax
not rcx
jmp 0x1403e14fd
mov rcx, rsi
jmp 0x1403e1505
jmp 0x1403e1453
mov rbx, qword [r13]
add dx, di
btc rdx, r10
ror dl, cl
mov rdx, qword [r13 + 0x10]
stc
cmp r10b, 0x2f
sub rdx, rbx
cmp r14, 0x538c2edf
cmp r12b, al
cmp rdx, 0x1000
jb 0x1403e1563
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403e154e
jae 0x1403e162e
add rdx, 0x27
mov rbx, rax
movzx ecx, r10w
mov cx, r12w
mov rcx, rbx
call fcn.140266bc7
mov qword [r13], r12
cmc
bts si, si
rcr al, 0xfb
lea rax, [r15 + r15*4]
movzx esi, di
shl rax, 4
shr bl, cl
sub si, r11w
add rax, r12
rcr bpl, 0xae
not dil
mov qword [r13 + 8], rax
ror sil, cl
movsx r15d, cx
rol bx, cl
lea rax, [r14 + r14*4]
not r15b
rcl esi, cl
shl rax, 4
add rax, r12
test r15, 0x4cb87aa9
shrd r15, r10, 0x49
sar r12b, cl
mov qword [r13 + 0x10], rax
sub r15b, r11b
rcr sil, 0xb
sbb sil, r11b
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
xchg edi, r15d
movzx rbp, r15w
bswap r12w
pop rbx
not sil
cmovl r14w, ax
mov r14w, r15w
pop rbp
mov r15, 0x56243f1f
not r13b
movzx r15d, di
pop rdi
cmovp r15w, cx
pop rsi
mov r15d, 0x257ba0
pop r12
not r13b
pop r13
movsx r15d, dx
bswap r15
cmovb r15, r14
pop r14
setne r15b
movzx r15, r9w
pop r15
jmp 0x1403e162d
ret
call fcn.1404b040b
int3
Function at 0x140426153
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bsf rsi, rsi
sub esi, esi
setl sil
push rdi
xchg sil, sil
and dil, 0xa
sub rsp, 0x28
adc sil, 0x1b
movzx rsi, si
mov rsi, rcx
cmovns edi, eax
movzx edi, dx
rcr rdx, cl
movsx rdx, si
movzx edx, word [rcx + rdi*4 + 0x834]
cmp r15b, 0xb9
test r9b, 0xd4
test dx, dx
js 0x1404261a8
mov rcx, rsi
jmp 0x1404261a3
call fcn.140426153
movsxd rcx, dword [rsi + 0x8860]
jmp 0x1404261b4
cmp ecx, dword [rsi + 0x8858]
jmp 0x1404261bf
jge 0x140426363
movsxd rax, dword [rsi + 0x885c]
lea rax, [rax + rcx]
bt r8w, bx
mov r8, qword [rsi + 8]
movzx dx, cl
rcr cl, 0x6a
bts dx, r15w
lea edx, [rax + 3]
neg cl
bswap cx
test eax, eax
cmovns edx, eax
sbb cl, r12b
mov ch, 0xfb
mov rcx, qword [rsi + 0x18]
cmp r12w, r9w
sar edx, 2
cmp r15b, cl
clc
movsxd rdx, edx
mov byte [rcx + rdx], 1
btc dx, cx
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
cmc
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x14042622c
jb 0x14042627d
movzx ecx, byte [rdx + rdi*4 + 2]
test r14, rbp
stc
mov byte [r8 + rax], cl
neg cx
movsx cx, al
rol cl, 0x1e
movzx ecx, byte [rdx + rdi*4 + 1]
cmc
mov byte [r8 + rax + 1], cl
shl cx, cl
movzx ecx, r9w
movzx ecx, byte [rdx + rdi*4]
mov byte [r8 + rax + 2], cl
adc cl, bpl
add cx, 0x7853
movzx ecx, byte [rdx + rdi*4 + 3]
clc
cmc
mov byte [r8 + rax + 3], cl
setno ah
test ch, bh
mov eax, dword [rsi + 0x885c]
test r9b, 0x99
test al, spl
add eax, 4
clc
mov dword [rsi + 0x885c], eax
cmp eax, dword [rsi + 0x8854]
jmp 0x14042629f
jl 0x140426363
mov ecx, dword [rsi + 0x884c]
cwde
sar rax, cl
shrd ax, bx, 0x73
mov eax, dword [rsi + 0x8858]
jmp 0x1404262c7
mov dword [rsi + 0x885c], ecx
xor rcx, rdi
mov ecx, dword [rsi + 0x8860]
cmp r9b, 0x63
stc
add ecx, dword [rsi + 0x8844]
stc
test r12b, 0xcb
mov dword [rsi + 0x8860], ecx
cmp ecx, eax
jmp 0x1404262f3
jl 0x140426363
mov ecx, dword [rsi + 0x8840]
cmp r14b, bpl
clc
cmc
nop dword [rax]
stc
test ecx, ecx
jle 0x140426363
mov edx, dword [rsi + 0x8864]
shl edx, cl
clc
cmc
mov dword [rsi + 0x8844], edx
clc
test dl, r15b
cmp r15, 0x6ca71ef
sar edx, 1
jmp 0x140426339
add edx, dword [rsi + 0x8850]
mov dword [rsi + 0x8860], edx
jmp 0x14042634a
dec ecx
test cl, 0x88
mov dword [rsi + 0x8840], ecx
clc
cmp edx, eax
jmp 0x14042635d
jge 0x14042630c
add rsp, 0x28
not sil
pop rdi
movsx si, dil
pop rsi
ret
Function at 0x140439b43
Capabilities:
Check for software breakpoints

Disassembly:
push r15
sar rax, cl
clc
sal ax, cl
push r14
sal ah, 0xa5
push rsi
push rdi
lahf
movsx eax, di
not eax
push rbx
sub ebx, 0x136f5464
xor bx, 0x76a5
xadd bx, bx
sub rsp, 0x30
shr bh, 0x47
lea eax, [r9 + rdx]
btr edi, r15d
sar bl, cl
mov edi, dword [rcx + 0x20]
sar bx, cl
rol ebx, 0x45
movsx ebx, r15w
mov ebx, edi
sub ebx, edx
test dl, r12b
cmc
cmp eax, edi
cmovle ebx, r9d
dec r9d
movsx r9w, r15b
xor rax, 0x17f44803
mov rcx, qword [rcx]
movsxd r9, edx
rcr al, cl
rol dh, 0x99
mov rdx, qword [rcx + 0x10]
mov rax, rdx
cmp r9b, 0x83
sub rax, r9
jmp 0x140439bc2
jb 0x140439d77
mov r15, r8
movsxd rdi, ebx
bts bx, bx
cmp r14w, r9w
cmc
mov rsi, qword [rcx + 0x18]
bswap ebx
and ebx, ecx
movsx rbx, r12w
mov rbx, rsi
sub rbx, rdx
cmc
cmp rbx, rdi
jmp 0x140439bf2
jae 0x140439c50
mov qword [rsp + 0x28], rdi
movzx rdx, r10w
movsx rdx, cx
setae dl
mov qword [rsp + 0x20], r15
movsx rdx, r10w
cwd
mov rdx, rdi
jmp 0x140439c1b
call fcn.14042e40f
nop
jmp 0x140439c2a
add rsp, 0x30
bswap di
pop rbx
setns sil
movsx si, r15b
pop rdi
movsx rsi, bx
pop rsi
mov r14d, 0x6be01f07
pop r14
movzx r15d, r14w
pop r15
ret
lea rbx, [rdx + rdi]
cmc
mov qword [rcx + 0x10], rbx
cmp bl, 0x27
cmp rsi, 8
jmp 0x140439c65
jb 0x140439c7b
mov rcx, qword [rcx]
movsx ebx, bx
bt r14w, 0x38
btr esi, r13d
lea rsi, [rcx + r9*2]
movsx rbx, ax
or bh, dh
lea r14, [r15 + rdi*2]
mov rbx, rdi
cmp r9d, r14d
cmp r14, rsi
jbe 0x140439cdf
lea rcx, [rcx + rdx*2]
mov rbx, rdi
cmp r9d, 0x2b456362
cmp rcx, r15
jmp 0x140439cae
jb 0x140439cdf
mov rbx, rsi
test ah, 0xd9
sub rbx, r15
jmp 0x140439cc2
jbe 0x140439cd5
sar rbx, 1
jmp 0x140439cd0
jmp 0x140439cdf
xor ebx, ebx
cwd
rcr ecx, 0x15
sbb cl, 0x81
lea rcx, [rsi + rdi*2]
sbb dl, dil
lea r8, [rax + rax]
shld edx, esi, 0x75
add r8, 2
movzx dx, r14b
not edx
mov rdx, rsi
call fcn.14049d8a6
lea r8, [rbx + rbx]
cqo
mov rcx, rsi
seto dl
cdq
movzx edx, r12w
mov rdx, r15
jmp 0x140439d1a
call fcn.14049d8a6
sub rdi, rbx
rcl r8w, cl
lea rdx, [r14 + rbx*2]
movsx r8, bp
lea rcx, [rsi + rbx*2]
sal sil, 7
xor r14b, cl
lea rdi, [rdi + rdi]
shr r8b, cl
btc r14w, di
mov r8, rdi
movzx r15, bx
mov sil, 0xce
add rsp, 0x30
mov sil, r12b
pop rbx
pop rdi
setp sil
pop rsi
movsxd r14, esp
movzx r15w, r9b
movsx r15d, cx
pop r14
pop r15
jmp 0x140439d72
jmp fcn.14049d8a6
call fcn.14043993b
int3
Function at 0x14043e2bd
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14043e2c6
movzx ecx, cx
jmp 0x14043e2ce
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
mov al, cl
setae al
cmp sil, 0x51
add rsp, 0x28
jmp 0x14043e2ee
ret

Function at 0x14043fa3d
Capabilities:
Access peb ldr_data
Encrypt data using speck
Execute syscall

Disassembly:
sub rsp, 0x28
setg ah
movsx rax, r11w
mov rcx, qword [rcx]
xchg ah, ah
mov rax, qword [rcx]
jmp 0x14043fa55
call qword [rax + 0x28]
test eax, eax
je 0x14043fa93
mov ecx, eax
ror r8w, 9
adc r8w, dx
movabs r8, 0xcafa59766d7f94e
clc
sub dl, r12b
mov dl, 3
mov r9d, 0x2a
cmp r10b, 0xdb
add rsp, 0x28
jmp 0x14043fa8e
jmp fcn.1403aa1a5
nop
test ebp, 0x50da7b23
add rsp, 0x28
ret

Function at 0x14043fb3f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
or sil, r14b
test ecx, eax
push rdi
cmp r14b, 0x65
adc sil, 0x22
sbb si, 0x3414
push rbp
push rbx
adc esi, 0x67c03582
rol sil, 0x6d
sub rsp, 0x48
mov rax, r9
movsx r9d, r11w
xor esi, 0x55a70e96
bsr r9w, r9w
mov rsi, rdx
sbb r9w, r15w
mov rdx, rcx
mov ebx, dword [rsp + 0xa0]
rol cl, cl
mov qword [rsp + 0x40], 0
bt cx, sp
mov rcx, qword [0x1400b9300]
test cx, r12w
movss xmm0, dword [r8]
bsr r9d, r13d
movss xmm1, dword [r8 + 4]
clc
mov r9, qword [rdx]
test bl, 0x92
cmp ebx, 0xffffffff
jmp 0x14043fbbe
je 0x14043fbcc
mov r8d, ebx
jmp 0x14043fc08
mov rdx, 0xffffffffffffffff
dec r8
mov r8b, cl
xor r8w, si
nop word [rax + rax]
bsf r8d, r10d
lea r8, [rdx + 1]
stc
jmp 0x14043fbf8
cmp word [rax + rdx*2 + 2], 0
cdq
mov rdx, r8
jne 0x14043fbea
mov ebp, dword [rsp + 0x98]
mov ebx, dword [rsp + 0x90]
movzx edi, cx
movsxd rdx, r13d
mov rdi, qword [rcx]
lea rdx, [rsp + 0x40]
jmp 0x14043fc29
mov qword [rsp + 0x30], rdx
movsx dx, r12b
movsxd rdx, r15d
movss dword [rsp + 0x28], xmm1
movsx edx, ax
movsx rdx, dx
movss dword [rsp + 0x20], xmm0
mov dl, r8b
cdq
mov rdx, rax
call qword [rdi + 0x90]
test eax, eax
jmp 0x14043fc5d
je 0x14043fc97
mov ecx, eax
jmp 0x14043fc6e
movabs r8, 0xcafa59766d7f94e
mov dl, 3
jmp 0x14043fc87
mov r9d, 0x41
jmp 0x14043fc92
call fcn.1403aa1a5
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
cwd
cdq
mov edx, ebx
jmp 0x14043fca9
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x40]
sets al
movsxd rax, r9d
movzx ax, r11b
mov rax, qword [rcx]
movzx edx, r12w
cdq
mov edx, ebp
jmp 0x14043fccb
call qword [rax + 0x20]
mov rax, qword [rsp + 0x40]
bts bp, bx
movsxd rbx, r9d
shl bl, cl
mov qword [rsi], rax
jmp 0x14043fce5
mov rax, rsi
shld bp, r11w, 0x59
sub bpl, 0x5d
add rsp, 0x48
pop rbx
pop rbp
movzx rsi, r8w
pop rdi
movzx si, dl
movsx si, r10b
mov sil, 0x80
pop rsi
jmp 0x14043fd0f
ret
Function at 0x1404404c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
or r14b, 0x28
shr r14, cl
push rsi
sar r14, 0x29
sbb rax, 0x73d259c4
ror eax, cl
push rdi
push rbx
sub rsp, 0x58
cwde
bswap eax
jmp 0x1404404e5
mov rax, r9
mov r14b, 0xaf
setbe r9b
mov r14, rdx
movsx r9w, bpl
bswap r9d
mov r9d, dword [rsp + 0xa0]
jmp 0x140440507
movd xmm0, r8d
shr r8, 0x20
movd xmm1, r8d
mov qword [rdx], 0
cvttss2si r8d, xmm1
test r8d, r8d
jmp 0x140440529
jle 0x14044066c
cvttss2si r10d, xmm0
xor r11d, r11d
clc
test r15, rsp
movss xmm2, dword [0x1400bf4c0]
jmp 0x14044054f
xor ebx, ebx
jmp 0x140440556
jmp 0x140440581
inc ebx
cmp rax, 0x31f34ed8
test r12w, 0x61a2
add r11d, r9d
cmp dx, 0x4c9f
stc
cmp ebx, r8d
jmp 0x14044057b
je 0x14044066c
mov rsi, r10
and dl, dil
xor dx, r8w
clc
mov edx, r11d
cmp rbx, 0x602433b1
test r10d, r10d
jmp 0x14044059e
jg 0x14044061f
jmp 0x14044055b
movzx edi, dil
jmp 0x1404405b2
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
movzx edi, byte [rax + rdx + 1]
jmp 0x1404405de
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
mov dil, spl
movzx edi, byte [rax + rdx + 2]
jmp 0x1404405ff
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
add edx, 4
dec rsi
je 0x14044055b
mov edx, edx
and dil, r12b
add dil, sil
xchg di, di
movzx edi, byte [rax + rdx + 3]
cmp sil, 0xb9
stc
cmp edi, 0xff
jmp 0x14044063f
je 0x140440613
test edi, edi
jmp 0x14044064c
jne 0x1404405a9
mov byte [rax + rdx + 2], 0
jmp 0x14044065c
mov word [rax + rdx], 0
jmp 0x140440667
jmp 0x140440613
mov rcx, qword [rcx + 0x18]
jmp 0x14044067b
movabs rdx, 0x10000001c
mov qword [rsp + 0x38], rdx
jmp 0x14044068f
movsd xmm2, qword [0x1400bfee0]
jmp 0x14044069c
movsd qword [rsp + 0x40], xmm2
jmp 0x1404406a7
mov dword [rsp + 0x48], 0
jmp 0x1404406b4
mov qword [rsp + 0x50], 0
jmp 0x1404406c2
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
inc di
shl di, 0x1e
neg r8w
mov edx, edx
bts di, r12w
xadd r8, r8
or rdx, rbx
mov rbx, qword [rcx]
jmp 0x1404406f4
mov qword [rsp + 0x28], r14
cmovno di, r10w
movsx r8w, bpl
lea rdi, [rsp + 0x38]
jmp 0x14044070d
mov qword [rsp + 0x20], rdi
movsx r8, cx
mov r8, rax
jmp 0x14044071e
call qword [rbx + 0x1c8]
test eax, eax
je 0x14044075f
mov ecx, eax
movabs r8, 0xad4a5352d2edebd0
movzx r9d, ax
movsx r9, si
mov dl, 3
cmovl r9w, bp
movzx r9w, r9b
xchg r9b, r9b
mov r9d, 0xd4
jmp 0x14044075a
call fcn.1403aa1a5
mov rax, r14
movsx r14, r14w
bswap di
add rsp, 0x58
movsxd r14, r10d
setp r14b
movsx edi, r8w
pop rbx
pop rdi
movzx r14w, r14b
movsxd r14, esp
pop rsi
pop r14
jmp 0x14044078a
ret
Function at 0x1404416e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
or eax, edi
bsr r15w, bp
push rdi
movzx r15d, bx
cwde
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm8
bswap r14d
lahf
movzx ebx, bp
movaps xmmword [rsp + 0x60], xmm7
movsx r15d, ax
movaps xmmword [rsp + 0x50], xmm6
mov dil, 0xd6
mov r14, r8
xchg bx, r15w
cmovle rax, rax
lahf
mov rbx, rdx
movzx ax, r9b
mov r15, rcx
movsx edx, bx
cbw
mov rsi, qword [rsp + 0xe0]
cwd
cdq
mov ebp, dword [rsp + 0xf0]
cqo
mov edx, dword [rsp + 0xe8]
cmovs edi, r14d
mov rdi, qword [r9]
cbw
mov rax, qword [rdi]
mov rcx, rcx
jmp 0x14044176c
mov rcx, rdi
jmp 0x140441774
call qword [rax + 0x18]
mov rax, qword [rdi]
jmp 0x140441782
mov rcx, rdi
mov edx, ebp
jmp 0x14044178c
call qword [rax + 0x20]
mov rcx, qword [r15 + 0x20]
movups xmm0, xmmword [r14]
cdq
mov r14w, 0xd54
bswap r14
movaps xmmword [rsp + 0x40], xmm0
movsx r14, r12w
mov rax, qword [rcx]
movzx r14d, bx
cmovbe edx, r10d
lea r14, [rsp + 0x40]
cqo
xchg dx, dx
mov rdx, r14
call qword [rax + 0x40]
movsd xmm7, qword [rbx]
jmp 0x1404417cd
movaps xmm0, xmm7
jmp 0x1404417d5
call fcn.1404b288a
movaps xmm8, xmm0
jmp 0x1404417e3
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404b288a
unpcklps xmm8, xmm0
addps xmm8, xmmword [0x1400bd4e0]
movlps qword [rbx], xmm8
movlps qword [rsp + 0x40], xmm8
movsd xmm7, qword [rbx + 8]
movaps xmm0, xmm7
call fcn.1404b288a
movaps xmm6, xmm0
jmp 0x14044181a
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140441826
call fcn.1404b288a
movss dword [rbx + 8], xmm6
jmp 0x140441835
unpcklps xmm6, xmm0
movss dword [rbx + 0xc], xmm0
lahf
jmp 0x140441843
mov rcx, qword [r15 + 0x18]
movsx eax, r14w
mov rax, qword [r15 + 0x20]
jmp 0x140441854
addps xmm6, xmm8
movlps qword [rsp + 0x48], xmm6
xor r8d, r8d
stc
nop
cmp r9d, 0x52aa643a
clc
cmp word [rsi + r8*2], 0
lea r8, [r8 + 1]
jmp 0x140441879
jne 0x14044186a
dec r8d
mov rbp, qword [rcx]
movsx edx, bp
cwd
cmovl dx, r9w
mov qword [rsp + 0x28], rax
bswap dx
mov qword [rsp + 0x20], r14
not edx
mov edx, ebp
movzx rdx, r13w
mov dword [rsp + 0x38], 0
movsx rdx, sp
movsxd rdx, ecx
mov dword [rsp + 0x30], 2
mov rdx, rsi
mov r9, rdi
call qword [rbp + 0xd8]
movaps xmm6, xmmword [rsp + 0x50]
sal ebx, cl
test r12w, r15w
xor r14b, 0xdf
movaps xmm7, xmmword [rsp + 0x60]
sub bp, r15w
movsxd rdi, edi
add r15b, 4
movaps xmm8, xmmword [rsp + 0x70]
bswap r14
add rsp, 0x88
movsx bx, r12b
movsx ebp, cx
movzx ebx, r15w
pop rbx
pop rbp
bswap si
cmovbe r14, rsp
pop rdi
bswap r15
pop rsi
movzx r15w, r15b
pop r14
mov r15d, 0x7fd80347
movsxd r15, ebp
pop r15
jmp 0x140441927
ret
Function at 0x140442974
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
movzx ax, r8b
and r8b, 0xb6
mov r8, rcx
nop
mov eax, 0x5a4d
cmc
jmp 0x140442990
cmp word [0x140000000], ax
jmp 0x14044299c
jne 0x140442a9e
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
cmp dil, 0x77
lea rcx, [rcx + rdx]
cmp dword [rcx], 0x4550
jne 0x140442a9e
mov eax, 0x20b
cmc
stc
cmp word [rcx + 0x18], ax
jmp 0x1404429d4
jne 0x140442a9e
sub r8, rdx
movzx edx, word [rcx + 0x14]
sar rax, cl
xor al, r8b
movzx rax, sp
add rdx, 0x18
xor rax, 0x1571384f
add rdx, rcx
xadd r9b, al
bts r9w, ax
sar ah, 0x35
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
shl r9w, 0x30
sar r9b, 0xe6
sal r9d, 0xad
lea r9, [rdx + rcx*8]
cmc
stc
mov qword [rsp], rdx
cmp rdx, r9
je 0x140442a60
mov ecx, dword [rdx + 0xc]
cmp dl, r12b
cmp r8, rcx
jb 0x140442a52
mov eax, dword [rdx + 8]
add eax, ecx
test r15b, r13b
cmp r8, rax
jmp 0x140442a4c
jb 0x140442a62
add rdx, 0x28
jmp 0x140442a5b
jmp 0x140442a20
sub edx, edx
test rdx, rdx
jmp 0x140442a6a
jne 0x140442a7c
sub al, al
jmp 0x140442a77
jmp 0x140442ab1
cmp dword [rdx + 0x24], 0
jge 0x140442a92
sub al, al
jmp 0x140442a8d
jmp 0x140442ab1
mov al, 1
jmp 0x140442a99
jmp 0x140442ab1
xor al, al
jmp 0x140442aa5
jmp 0x140442ab1
add rsp, 0x18
jmp 0x140442aba
ret

Function at 0x140443411
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov al, bpl
sar bx, cl
bts bx, dx
mov qword [rsp + 0x10], rbp
push rdi
bt ebx, edx
rcl ah, 0x81
sub rsp, 0x20
bt eax, 0x36
btc edi, 0xa2
adc al, 0x9b
and qword [rcx + 0x10], 0
and di, bp
bt bx, r9w
ror ax, 0x3c
lea rax, [0x1400bff98]
and qword [rcx + 0x18], 0
sbb dil, bpl
bt di, 0xbe
lea rbp, [0x1400ced94]
sbb edi, r8d
and dword [rcx + 0x20], 0
movzx bx, al
movzx edi, r14w
xor ebx, 0xb6372b0
mov rbx, rcx
ror dil, 0x6e
add dil, cl
mov qword [rcx], rax
ror di, 0xe
mov rdi, rbp
cmc
mov dword [rcx + 8], 1
mov byte [rcx + 0x24], dl
test eax, edi
and qword [rcx + 0x28], 0
jmp 0x1404434a6
mov byte [rcx + 0x30], 0
jmp 0x1404434af
inc rdi
cmp r14w, r13w
clc
cmp byte [rdi], 0
jmp 0x1404434bf
jne 0x1404434af
sub rdi, rbp
mov ch, 0x30
jmp 0x1404434d0
lea rcx, [rdi + 1]
jmp 0x1404434d9
call fcn.1400e071d
mov qword [rbx + 0x28], rax
test rax, rax
je 0x1404434ff
lea r8, [rdi + 1]
mov rdx, rbp
mov rcx, rax
jmp 0x1404434fa
call fcn.14049d8a6
mov rbp, qword [rsp + 0x38]
bt eax, 0xc6
xadd dil, dil
btc rdi, r11
mov rax, rbx
mov rbx, qword [rsp + 0x30]
movzx rdi, r11w
bt edi, r9d
movsx rdi, r11w
add rsp, 0x20
movzx di, r8b
movzx rdi, cx
movsx edi, r15w
pop rdi
jmp 0x14044353b
ret

Function at 0x140454593
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
mov ch, 0x52
lea rcx, [rsp + 0x30]
jmp 0x1404545a4
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
test r15, rbp
add rsp, 0x28
jmp 0x1404545bb
ret
Function at 0x140454665
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
movsxd rax, r15d
push rbp
sbb rax, 0x638b150f
btr rax, rcx
rcr bpl, 0x6d
mov rbp, rsp
movsx eax, cx
cmp rax, 0x62026a56
sub rsp, 0x20
stc
sete bh
mov rax, qword [0x1400b7288]
clc
and bl, r11b
sbb bl, ch
movabs rbx, 0x2b992ddfa232
test r12b, 0xfb
test bl, dil
jmp 0x1404546b5
cmp rax, rbx
jmp 0x1404546bd
jne 0x140454781
and qword [rbp + 0x18], 0
lea rcx, [rbp + 0x18]
jmp 0x1404546d1
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x1404546e0
mov qword [rbp + 0x10], rax
jmp 0x1404546e9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
cmp sp, r14w
xor qword [rbp + 0x10], rax
jmp 0x1404546fe
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
xor qword [rbp + 0x10], rax
jmp 0x140454713
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
xadd cx, cx
lea rcx, [rbp + 0x10]
clc
shl rax, 0x20
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
xor rax, rcx
sbb rbp, 0x45be3360
movabs rcx, 0xffffffffffff
sbb bp, r9w
adc rbp, 0x42245a83
xor rbp, r12
and rax, rcx
movabs rcx, 0x2b992ddfa233
rcl bp, 0xbd
cmp rax, rbx
movsx rbx, bx
cmove rax, rcx
movsxd rbx, r9d
shr bx, cl
jmp 0x14045477a
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
movsx ebp, r10w
not rax
mov qword [0x1400b7280], rax
mov bp, si
cmc
btr bp, r11w
add rsp, 0x20
mov bpl, bpl
pop rbp
ret
Function at 0x14045925d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
xor rbp, r10
push rsi
sar ebp, 0x9c
movsx rbp, r9w
push rdi
and bpl, 0x80
push r12
btc bp, bx
btr ebp, 0x89
xadd bp, bp
push r14
push r15
shr r15b, cl
sub rsp, 0x40
adc r15b, r10b
bts bp, di
shr ebp, 0x92
sub r12d, r12d
shr r15d, cl
mov r15, r8
mov qword [rax + 0x20], r12
or rdi, 0xffffffffffffffff
mov bp, 0x594f
mov bpl, dl
movsx rbp, si
mov rbp, rcx
jmp 0x1404592bf
inc rdi
cmp byte [rdi + rcx], r12b
jmp 0x1404592cb
jne 0x1404592bf
add rdi, 1
movsxd rsi, ebp
movzx r14w, r11b
mov rbx, r12
mov rsi, rdi
mov r14, rcx
jmp 0x1404592eb
je 0x14045934c
lea r9, [rsp + 0x88]
movzx edx, bx
mov qword [rsp + 0x20], r15
not r8b
mov r8b, 0xb3
mov r8, rsi
mov dx, r14w
bswap rcx
lea rcx, [rsp + 0x70]
mov rdx, r14
jmp 0x14045931e
call fcn.140453b27
test eax, eax
jle 0x14045934c
cdqe
jmp 0x140459332
inc rbx
test edx, edx
lea r14, [r14 + rax]
test r9b, r11b
cmp spl, 0x93
cmc
sub rsi, rax
jne 0x1404592f1
inc rbx
mov edx, 2
mov rcx, 0x1e626436
xchg ch, cl
mov rcx, rbx
jmp 0x140459365
call fcn.14012a91d
mov r14, rax
test r13b, r12b
test rax, rax
jmp 0x140459378
je 0x140459450
mov qword [rsp + 0x30], r12
adc sil, 0xc4
bts rsi, r14
mov rsi, rax
cmp r12b, 0x45
test rbx, rbx
jmp 0x14045939a
je 0x1404593fe
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
not dx
movsx ecx, sp
movsx rdx, r9w
mov r8, rdi
cmovns rcx, rbx
mov rdx, rbp
mov cl, r12b
cmovbe ecx, r11d
movzx cx, bpl
mov rcx, rsi
jmp 0x1404593d2
call fcn.140453b27
test eax, eax
jle 0x1404593fe
cdqe
clc
add rsi, 2
add rbp, rax
cmc
jmp 0x1404593ef
sub rbx, 1
jmp 0x1404593f8
jne 0x1404593a0
lea r11, [rsp + 0x40]
xchg ebx, ebx
movzx eax, r12w
mov word [rsi], r12w
xchg r15w, ax
mov si, r12w
movsxd r15, esi
mov rbx, qword [r11 + 0x38]
mov rax, r14
mov rbp, qword [r11 + 0x40]
movsx r15d, r12w
mov rsp, r11
pop r15
not di
bswap r14
pop r14
pop r12
xchg si, di
seta dil
pop rdi
bswap esi
movzx si, r14b
movsx si, r9b
pop rsi
jmp 0x14045944f
ret
call fcn.1404532ce
int3