joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403e1e5b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
btc r15d, 0x1a
shrd r15w, r12w, 0xbb
push r14
btr r15, 0xd0
and r15b, bpl
bts r14w, bp
push r13
rcr r15b, 0xd0
movzx r13d, r10w
push r12
cmp r13b, 0x6b
push rsi
cmovbe r14w, sp
xor r15b, 0xd2
cmc
push rdi
push rbp
push rbx
sal r14d, 0xee
sub rsp, 0x38
add r14b, sil
cmovns r14w, r9w
neg r13b
movaps xmmword [rsp + 0x20], xmm6
sbb r13d, 0x7a02770
mov r14, r9
rcr r12w, cl
mov r15, r8
not r13
sal r12b, 0x47
ror bh, cl
mov r12, rdx
bts ebx, r13d
bts rbx, rbp
mov r13, rcx
sub bl, 0x6b
bt rbx, rsi
mov rbx, qword [rcx]
test rbx, rbx
jmp 0x1403e1ee7
je 0x1403e203b
mov rdi, qword [r13 + 8]
test rbx, rsi
jmp 0x1403e1ef9
cmp rbx, rdi
je 0x1403e1fda
lea rbp, [0x1400bed30]
jmp 0x1403e1f0e
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e1f1a
jmp 0x1403e1f4c
call fcn.14022f308
movups xmmword [rbx + 0x20], xmm6
jmp 0x1403e1f2d
mov byte [rbx + 0x10], 0
test spl, dl
jmp 0x1403e1f39
add rbx, 0x38
cmc
cmp rbx, rdi
jmp 0x1403e1f46
je 0x1403e1fd2
mov qword [rbx], rbp
rol ax, 0x50
movzx eax, bx
or ax, si
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jmp 0x1403e1f66
jb 0x1403e1f24
mov rcx, qword [rbx + 0x10]
clc
shl dx, 0x80
shl dl, cl
lea rdx, [rax + 1]
cmp dil, 0x87
test r10w, 0x6374
cmp rdx, 0x1000
jmp 0x1403e1f91
jb 0x1403e1f1f
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jmp 0x1403e1fab
jae 0x1403e20b0
add rax, 0x28
movsx dx, r12b
mov rdx, rdi
mov rdx, rax
movzx cx, r10b
mov rcx, rsi
jmp 0x1403e1fcd
jmp 0x1403e1f1f
mov rbx, qword [r13]
xor dx, r12w
mov rdx, qword [r13 + 0x10]
stc
sub rdx, rbx
cmp r9b, 0x7f
test r13, 0x41924e2e
cmp rdx, 0x1000
jmp 0x1403e1ff9
jb 0x1403e2033
mov rax, qword [rbx - 8]
cmp r15, rdi
add rbx, 0xfffffffffffffff8
sub rbx, rax
test ah, 0xa3
cmp rbx, 0x20
jmp 0x1403e2019
jae 0x1403e20b0
add rdx, 0x27
cmovl bx, r15w
bswap cx
jmp 0x1403e2030
mov rbx, rax
mov rcx, rbx
call fcn.14022f308
mov qword [r13], r12
test r13d, r14d
xadd rax, rsi
rcl ebp, cl
imul rax, r15, 0x38
lea rax, [rax + r12]
mov qword [r13 + 8], rax
imul rax, r14, 0x38
add rax, r12
mov qword [r13 + 0x10], rax
cmovo si, r13w
movaps xmm6, xmmword [rsp + 0x20]
rcr r15d, 0x65
ror r12b, 0x6f
bt r12, rsp
add rsp, 0x38
pop rbx
pop rbp
not r14d
pop rdi
setae r13b
pop rsi
movzx r15d, ax
movsx r12, r13w
movsxd r12, ebx
pop r12
movsxd r14, r10d
jmp 0x1403e2099
pop r13
seta r14b
mov r15b, r11b
pop r14
bswap r15w
pop r15
jmp 0x1403e20af
ret
call fcn.1404b2945
int3
Function at 0x1403e3635
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rcl r15w, cl
bswap r15w
not r15b
push r14
rol r15w, cl
push r13
xor r15b, 0x89
push r12
sal r14b, 0xd6
shr r12, cl
mov r15w, 0x7b6c
push rsi
sbb r15w, 0x1640
shrd r15d, edi, 0xc7
movzx r13d, r8w
push rdi
movsx r15, bp
sbb r13b, 0x26
push rbp
push rbx
sub rsp, 0x38
shr r13w, 0x44
movaps xmmword [rsp + 0x20], xmm6
or bx, 0x4ff1
and r13w, 0x1e63
bsf r15w, bx
mov r14, r9
mov r15, r8
rcr bl, 0xff
mov r12, rdx
shld rbx, rax, 0xe6
not r13b
shrd r13w, r12w, 0x45
mov r13, rcx
mov rbx, qword [rcx]
test rbx, rbx
jmp 0x1403e36bd
je 0x1403e3826
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403e36cf
je 0x1403e37be
lea rbp, [0x1400bed10]
jmp 0x1403e36e1
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e36ed
jmp 0x1403e3725
call fcn.14022f308
movups xmmword [rbx + 0x20], xmm6
mov byte [rbx + 0x10], 0
jmp 0x1403e3708
add rbx, 0x50
test r8w, 0x3a51
cmp r15b, 0x12
clc
cmp rbx, rdi
jmp 0x1403e371f
je 0x1403e37ba
mov qword [rbx], rbp
movzx ecx, r11w
movsxd rcx, r15d
movzx cx, r11b
lea rcx, [rbx + 0x38]
jmp 0x1403e373d
call fcn.1403e0afb
mov rax, qword [rbx + 0x28]
test r12b, 0x34
cmp bx, 0x5d38
cmp rax, 0x10
jb 0x1403e36f7
mov rcx, qword [rbx + 0x10]
xor rdx, 0x206c5bfa
seta dl
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1403e36f2
mov rsi, qword [rcx - 8]
stc
add rcx, 0xfffffffffffffff8
test r9w, cx
sub rcx, rsi
test r14b, al
clc
cmp rcx, 0x20
jmp 0x1403e3795
jae 0x1403e38ba
add rax, 0x28
movsx edx, r15w
mov rdx, rax
movzx rcx, ax
movsxd rcx, edi
mov rcx, rsi
jmp 0x1403e37b5
jmp 0x1403e36f2
mov rbx, qword [r13]
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmp r12d, eax
cmp rdx, 0x1000
jb 0x1403e381e
mov rax, qword [rbx - 8]
cmp r15d, 0x58f12fa6
test sil, 0xac
cmp r10b, r15b
add rbx, 0xfffffffffffffff8
cmp r10d, eax
jmp 0x1403e37f6
sub rbx, rax
jmp 0x1403e3802
cmp rbx, 0x20
jmp 0x1403e380b
jae 0x1403e38ba
add rdx, 0x27
not bx
mov rbx, rax
movsxd rcx, esp
mov rcx, rbx
call fcn.14022f308
mov qword [r13], r12
lea rax, [r15 + r15*4]
sub rbx, rax
not bpl
shl rax, 4
rcl sil, cl
movsx ebp, r13w
test al, 0xdc
lea rax, [rax + r12]
rcl bl, 0x7e
add r15, 0x4e6a4f63
mov qword [r13 + 8], rax
clc
lea rax, [r14 + r14*4]
shld r14d, r12d, 0xda
shl rax, 4
sbb rdi, r14
add rax, r12
sar r15, cl
inc sil
mov qword [r13 + 0x10], rax
mov r12, r11
btr si, bx
rcr r13w, 0xc5
movaps xmm6, xmmword [rsp + 0x20]
bts rsi, rdx
movsx di, bl
or si, si
add rsp, 0x38
pop rbx
movzx r14d, r14w
xchg r12b, r15b
movsx r12d, cx
pop rbp
pop rdi
movsx r13w, r15b
pop rsi
movsx r13w, cl
pop r12
xchg r14, r14
cmovp r13d, edi
pop r13
pop r14
pop r15
ret
call fcn.1404b2945
int3
Function at 0x1403e708f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r12b, r13b
stc
push r14
test si, 0x20eb
test r12d, r10d
stc
push rsi
push rdi
push rbx
sal dil, cl
add dil, 7
bts edi, ebp
sub rsp, 0x30
shrd edi, r15d, 0x12
movaps xmmword [rsp + 0x20], xmm6
movsx rdi, r8w
rcr rdi, 0xfc
movzx rdi, ax
mov rdi, qword [rcx]
test r8b, r14b
cmp dil, 0x60
test rdi, rdi
jmp 0x1403e70d9
je 0x1403e725f
mov r14, rcx
mov rbx, qword [rcx + 8]
clc
cmp bl, r14b
cmp rdi, rbx
jmp 0x1403e70f2
je 0x1403e71dd
lea r15, [0x1400bed10]
jmp 0x1403e7104
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e7110
jmp 0x1403e713e
call fcn.14022f308
movups xmmword [rdi + 0x20], xmm6
mov byte [rdi + 0x10], 0
cmp r13w, 0xf77
stc
add rdi, 0x50
cmp bl, 0x21
cmp rdi, rbx
jmp 0x1403e7138
je 0x1403e71d6
mov qword [rdi], r15
movsxd rcx, r10d
lea rcx, [rdi + 0x38]
jmp 0x1403e714d
call fcn.1403e0afb
mov rax, qword [rdi + 0x28]
cmc
jmp 0x1403e715c
cmp rax, 0x10
jmp 0x1403e7165
jb 0x1403e711a
mov rcx, qword [rdi + 0x10]
xadd dh, dh
sub dx, ax
lea rdx, [rax + 1]
clc
cmp rdx, 0x1000
jmp 0x1403e7186
jb 0x1403e7115
mov rsi, qword [rcx - 8]
cmp cl, 0xcb
cmc
stc
add rcx, 0xfffffffffffffff8
sub rcx, rsi
test bp, 0x5b07
jmp 0x1403e71a6
cmp rcx, 0x20
jmp 0x1403e71af
jae 0x1403e729d
add rax, 0x28
cmovle edx, r10d
xchg dh, ch
cdq
mov rdx, rax
bswap cx
movzx ecx, cx
mov rcx, rsi
jmp 0x1403e71d1
jmp 0x1403e7115
mov rdi, qword [r14]
shl rdx, 0x2f
mov rdx, qword [r14 + 0x10]
cmp r13b, 0xe3
sub rdx, rdi
cmp r8b, bpl
cmp rdx, 0x1000
jmp 0x1403e71f7
jb 0x1403e7230
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
jmp 0x1403e720b
sub rdi, rax
cmp rdi, 0x20
jmp 0x1403e7217
jae 0x1403e729d
add rdx, 0x27
mov rdi, rax
cmove rcx, rsi
xchg cx, cx
movzx cx, r8b
mov rcx, rdi
jmp 0x1403e7238
call fcn.14022f308
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
sub r14d, 0x6ad777bf
xor rbx, 0x31fb3107
movsx si, sil
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
movsx r14, r13w
cmovp r14, rbx
pop rbx
bswap si
pop rdi
jmp 0x1403e7282
pop rsi
not r14b
jmp 0x1403e728b
pop r14
movsx r15d, si
movzx r15d, r10w
pop r15
jmp 0x1403e729c
ret
call fcn.1404b2945
int3
Function at 0x1403fa8b0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
cmp dl, sil
jmp 0x1403fa8bc
test r8, r8
jmp 0x1403fa8c4
je 0x1403fa930
movzx r9d, word [r8]
cmc
test dil, dil
test r9w, r9w
je 0x1403fa96b
sub eax, eax
mov r10, rcx
nop dword [rax + rax]
cmc
stc
clc
cmp rdx, rax
jmp 0x1403fa8f4
je 0x1403fab15
mov word [r10], r9w
neg r9b
add r10, 2
mov r9b, 0
movsx r9d, bx
movzx r9d, word [r8 + rax*2 + 2]
inc rax
test r9b, 0x32
test r9w, r9w
jne 0x1403fa8ec
sub rdx, rax
jmp 0x1403fa92b
jmp 0x1403fa96e
movzx r9d, word [0x1400b8f10]
test r9w, r9w
jmp 0x1403fa941
je 0x1403fa97c
cmp rdx, 0x104
movsx r8d, ax
mov r8d, 0x104
jmp 0x1403fa95d
cmovb r8, rdx
jmp 0x1403fa966
jmp 0x1403faa9b
mov r10, rcx
test rdx, rdx
jne 0x1403fab15
jmp 0x1403fab23
mov rax, qword gs:[0x30]
bt r11w, 0xbc
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
xadd r8w, r10w
and r9b, r9b
mov rax, qword [rax + 0x10]
clc
or r10b, dl
btr r8d, ebp
movzx r8d, word [rax + 0x58]
cmp r8, rdx
movsx r9, r13w
movsx r9d, r11w
cmovae r8, rdx
inc r11b
mov r9, qword [rax + 0x60]
sar r10w, 4
movzx r10w, bl
cmova r11d, edi
movzx r11d, word [r9]
setae r10b
lea r10, [0x1400b8f10]
stc
test r11w, r11w
jmp 0x1403fa9e9
je 0x1403faa4b
xor eax, eax
cmp r12w, r15w
cmc
nop word cs:[rax + rax]
test r13w, 0x3b81
cmp r8, rax
jmp 0x1403faa12
je 0x1403faa59
mov word [r10], r11w
ror r11b, 0x96
btr r11d, ecx
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1403faa33
inc rax
test r11w, r11w
jmp 0x1403faa3f
jne 0x1403faa0a
sub r8, rax
test dx, bp
test r8, r8
jmp 0x1403faa53
je 0x1403faa5f
mov word [r10], 0
movzx r9d, word [0x1400b8f10]
cmp rdx, 0x104
mov r10b, cl
bswap r10d
mov r8b, 0x93
mov r8d, 0x104
movsx r10, dx
cmovb r8, rdx
mov r10, rcx
cmp r9w, r8w
test r9w, r9w
jmp 0x1403faa95
je 0x1403fab0c
sub edx, edx
lea rax, [0x1400b8f10]
rcl r10b, cl
mov r10, rcx
clc
nop dword [rax + rax]
cmp ch, 0x31
stc
cmp r8, rdx
jmp 0x1403faabf
je 0x1403fab15
mov word [r10], r9w
adc r9b, 0x39
btr r9w, 0x3f
add r10, 2
cmovbe r9w, r9w
movzx r9d, word [rax + rdx*2 + 2]
jmp 0x1403faae7
inc rdx
test r8b, spl
stc
test r11b, 0xf7
test r9w, r9w
jmp 0x1403faafb
jne 0x1403faab7
sub r8, rdx
test dl, sil
jmp 0x1403fab0c
test r8, r8
je 0x1403fab23
mov word [r10], 0
xchg rdx, rax
movzx eax, si
movsxd rax, r10d
movabs rax, 0xe039ec0d24fefd13
xchg dl, dh
movzx edx, dx
mov qword [rsp], rax
movabs rax, 0x2247bce40ef3a5e6
jmp 0x1403fab4a
mov qword [rsp + 8], rax
movabs rdx, 0xe05dec612491fd3d
jmp 0x1403fab5e
mov qword [rsp + 0x10], rdx
jmp 0x1403fab68
mov qword [rsp + 0x18], rax
movzx rax, ax
lea rax, [rsp + 0x10]
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
cmp spl, 0xbd
clc
jmp 0x1403fab96
nop word cs:[rax + rax]
cmp word [rcx + 2], 0
jmp 0x1403fabaa
lea rcx, [rcx + 2]
jne 0x1403faba0
test ax, ax
jmp 0x1403fabbc
je 0x1403fac03
lea rdx, [rsp + 2]
test r9b, sil
nop word cs:[rax + rax]
stc
clc
mov word [rcx], ax
add ax, 0x4390
dec ah
movsx ax, r10b
add rcx, 2
rcr eax, 0x61
movzx eax, word [rdx]
cmc
stc
add rdx, 2
test ax, ax
jmp 0x1403fabfd
jne 0x1403fabd7
mov word [rcx], 0
test r12b, dl
add rsp, 0x28
jmp 0x1403fac14
ret
Function at 0x140428362
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
movsx si, dil
xor esi, r10d
push rdi
rcr di, cl
sub rsp, 0x28
mov rsi, rcx
btc di, 0xd3
movzx edi, dx
shld dx, sp, 0x41
movzx edx, word [rcx + rdi*4 + 0x834]
test dx, dx
jmp 0x140428393
js 0x1404283a6
mov rcx, rsi
jmp 0x1404283a1
call fcn.140428362
movsxd rcx, dword [rsi + 0x8860]
jmp 0x1404283b8
cmp ecx, dword [rsi + 0x8858]
jmp 0x1404283c3
jge 0x14042855e
movsxd rax, dword [rsi + 0x885c]
add rax, rcx
add ecx, 0x1222317f
and r8w, bp
bswap cx
mov r8, qword [rsi + 8]
shrd rcx, rax, 0xe0
adc cx, r12w
mov ecx, 0x2e290dca
lea edx, [rax + 3]
test eax, eax
movzx cx, r11b
xchg cx, cx
movzx rcx, dx
cmovns edx, eax
rcl rcx, cl
mov rcx, qword [rsi + 0x18]
sar edx, 2
test bx, 0x3a1a
movsxd rdx, edx
mov byte [rcx + rdx], 1
inc dx
cdq
mov rdx, qword [rsi + 0x8838]
cmp sp, 0x26c3
cmc
clc
movzx edi, byte [rsi + rdi*4 + 0x837]
cmc
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x140428441
jb 0x140428489
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
sal ch, 0xfc
bts ecx, r8d
movzx ecx, byte [rdx + rdi*4 + 1]
stc
cmp r11b, al
mov byte [r8 + rax + 1], cl
sar cx, cl
movzx ecx, byte [rdx + rdi*4]
cmc
cmp cl, ch
stc
mov byte [r8 + rax + 2], cl
sub cl, r15b
movzx ecx, byte [rdx + rdi*4 + 3]
cmp si, r14w
mov byte [r8 + rax + 3], cl
shr rax, cl
mov eax, dword [rsi + 0x885c]
add eax, 4
cmp rax, 0x49f00bb
mov dword [rsi + 0x885c], eax
test r9w, r10w
test si, 0x74d3
cmp eax, dword [rsi + 0x8854]
jmp 0x1404284b3
jl 0x14042855e
mov ecx, dword [rsi + 0x884c]
mov eax, dword [rsi + 0x8858]
mov dword [rsi + 0x885c], ecx
movsx rcx, r9w
ror ecx, 0xe7
mov ecx, dword [rsi + 0x8860]
add ecx, dword [rsi + 0x8844]
cmc
clc
cmp dx, 0x5055
mov dword [rsi + 0x8860], ecx
cmp ecx, eax
jmp 0x1404284f2
jl 0x14042855e
mov ecx, dword [rsi + 0x8840]
nop dword [rax]
test dil, 0x70
test ecx, ecx
jle 0x14042855e
mov edx, dword [rsi + 0x8864]
cmp r10b, r13b
test r15b, 0x51
shl edx, cl
mov dword [rsi + 0x8844], edx
sar edx, 1
cmp ah, 0xd7
add edx, dword [rsi + 0x8850]
jmp 0x140428536
mov dword [rsi + 0x8860], edx
jmp 0x140428541
dec ecx
stc
cmp r9d, r11d
mov dword [rsi + 0x8840], ecx
jmp 0x140428556
cmp edx, eax
jge 0x140428509
add rsp, 0x28
cmovnp edi, r8d
not sil
mov dil, 0xf
pop rdi
pop rsi
jmp 0x140428573
ret
Function at 0x1404316ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
btc r15w, di
sal r15d, cl
push r14
movzx r15d, ax
jmp 0x140431707
push rsi
push rdi
stc
btc r15, r9
btr r15d, esp
push rbx
rcr r15w, 0xbf
bts r15w, si
sub rsp, 0x20
xchg r15w, r15w
cmovs r15d, edx
mov r15, rcx
jmp 0x140431731
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
btc ebx, 0x51
mov qword [rcx + 0x10], 0
sal cl, 0xba
xadd ax, ax
cbw
mov rcx, qword [rdx + 8]
movzx bx, r12b
mov rax, qword [rdx]
btr rbx, rcx
sal bh, cl
sbb bh, 0x19
mov rbx, rcx
sub rbx, rax
cmp bl, 0x73
cmc
test ebp, 0x59174133
sub rcx, rax
jmp 0x140431779
je 0x140431883
js 0x1404318b6
mov r14, rdx
cmc
sar rbx, 6
clc
test bh, 0x80
jmp 0x140431796
cmp rcx, 0xfc1
jmp 0x1404317a2
jb 0x1404317d3
or rcx, 0x27
jmp 0x1404317b1
call fcn.14044457e
lea rdi, [rax + 0x27]
cmc
stc
and rdi, 0xffffffffffffffe0
jmp 0x1404317c5
mov qword [rdi - 8], rax
jmp 0x1404317ce
jmp 0x1404317db
call fcn.14044457e
mov rdi, rax
mov qword [r15], rdi
btc esi, esp
mov qword [r15 + 8], rdi
xor sil, spl
neg si
shl esi, cl
shl rbx, 6
cmc
cmovne esi, r14d
add rbx, rdi
mov qword [r15 + 0x10], rbx
movsxd rbx, r15d
bswap esi
xchg bl, sil
mov rbx, qword [r14]
mov rsi, qword [r14 + 8]
jmp 0x140431811
jmp 0x140431822
add rdi, 0x40
add rbx, 0x40
cmp r10, rcx
stc
cmp rbx, rsi
jmp 0x14043182a
je 0x14043187f
mov qword [rdi + 0x38], 0
shld cx, si, 0xd5
mov rcx, qword [rbx + 0x38]
test r12b, 3
cmp rbx, 0x319504f6
cmp r13w, r9w
test rcx, rcx
je 0x140431816
mov rax, qword [rcx]
bswap rdx
movzx rdx, r14w
movsx rdx, dx
mov rdx, rdi
jmp 0x14043186f
call qword [rax]
mov qword [rdi + 0x38], rax
jmp 0x14043187a
jmp 0x140431816
mov qword [r15 + 8], rdi
mov rax, r15
add rsp, 0x20
bswap r15w
jmp 0x140431896
pop rbx
movsx edi, r9w
movzx rsi, cx
pop rdi
jmp 0x1404318a5
pop rsi
pop r14
mov r15d, 0x19f66ced
pop r15
jmp 0x1404318b5
ret
call fcn.1403b85f7
int3
Function at 0x14043b4a2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
movzx esi, r12w
rcl dil, 0xd5
add di, bx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm7
adc edi, r11d
movaps xmmword [rsp + 0x70], xmm6
mov rdi, rdx
mov rsi, rcx
cwde
test r14, 0x62832acd
sal eax, 0xe4
mov rax, qword [rdx]
cmp qword [rax + 0x18], 8
jmp 0x14043b4e7
jb 0x14043b4f7
mov rax, qword [rax]
setl r9b
sal rcx, cl
movsxd rcx, r8d
lea r9, [rax + rcx*2]
cdqe
jmp 0x14043b508
sub ebx, ebx
rol al, 0x32
cmp rsi, 0x18853d1b
nop word cs:[rax + rax]
xor rax, 0x188d4e75
movzx eax, word [r9 + rbx*2]
clc
cmp rbp, r13
cmp eax, 0xa
jmp 0x14043b539
je 0x14043b54f
test eax, eax
je 0x14043b54f
inc rbx
jmp 0x14043b528
test byte [rdi + 0x1c], 4
jmp 0x14043b558
jne 0x14043b6df
mov rcx, qword [rdi + 0x10]
movzx eax, r8w
cdqe
mov r8b, r14b
mov rax, qword [rdi + 8]
movzx r8w, bl
movsd xmm0, qword [rax + 8]
jmp 0x14043b57e
movsd qword [rsp + 0x40], xmm0
movzx dx, r10b
bswap r8d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 2
movzx dx, dl
setne dl
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x38]
bswap r8w
movsxd r8, eax
lea r8, [rsp + 0x40]
jmp 0x14043b5bd
call fcn.140442193
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
not al
movaps xmmword [rsp + 0x40], xmm0
lahf
movsx edx, bp
mov dword [rsp + 0x60], 0
movzx dx, r15b
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
movsx edx, r10w
movsx rdx, dx
lea rdx, [rsp + 0x40]
jmp 0x14043b5fc
call qword [rax + 0x1e0]
test eax, eax
jmp 0x14043b609
je 0x14043b63d
mov ecx, eax
movabs r8, 0xe31b45c42a775183
jmp 0x14043b625
mov dl, 3
xchg r9d, r9d
not r9
mov r9d, 0x4f
jmp 0x14043b638
call fcn.1403ac24d
movss xmm6, dword [rsp + 0x4c]
movss xmm7, dword [rsp + 0x50]
movsxd rdx, edx
lea rcx, [rsp + 0x38]
rol rdx, 0x8f
lea rdx, [rsp + 0x40]
xor r8d, r8d
jmp 0x14043b662
call fcn.14043ba9a
movss xmm0, dword [rdi + 0x18]
jmp 0x14043b671
movss dword [rsi], xmm0
jmp 0x14043b67a
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
movss xmm0, dword [rsp + 0x50]
bts cx, r11w
movss dword [rsi + 8], xmm0
shl cl, 0x4e
or cx, 0x1fc2
sub ecx, 0xd744960
mov dword [rsi + 0xc], 0
setp ch
movss dword [rsi + 0x10], xmm7
movsx rcx, r15w
shr cx, 0xf4
mov ch, 9
mov dword [rsi + 0x14], ebx
mov rcx, qword [rsp + 0x38]
test cl, r15b
test rcx, rcx
jmp 0x14043b6ce
je 0x14043b747
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14043b747
movss xmm0, dword [rdi + 0x18]
movss dword [rsi], xmm0
cvtsi2ss xmm1, ebx
mulss xmm1, dword [0x1400bfc14]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
jmp 0x14043b702
movss xmm0, dword [0x1400bfc94]
jmp 0x14043b70f
movlps qword [rsi + 8], xmm0
mov rax, qword [rdi + 8]
jmp 0x14043b71c
movss xmm0, dword [rax + 0xc]
jmp 0x14043b726
addss xmm0, dword [0x1400bfbd0]
movss dword [rsi + 0x10], xmm0
setge dil
sub dil, cl
xchg di, di
mov dword [rsi + 0x14], ebx
sub bl, 0xac
btc esi, r11d
movaps xmm6, xmmword [rsp + 0x70]
and dil, r12b
movzx di, r8b
movsx di, cl
movaps xmm7, xmmword [rsp + 0x80]
shrd di, bx, 0xdb
sal di, cl
add dil, 0xf
add rsp, 0x90
movsx edi, di
setbe dil
pop rbx
mov sil, dil
setp sil
movzx rsi, sp
pop rdi
not si
pop rsi
jmp 0x14043b790
ret
Function at 0x140440933
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx ecx, cx
jmp 0x14044093f
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
stc
cmp eax, 0x100
setae al
jmp 0x140440956
add rsp, 0x28
jmp 0x14044095f
ret

Function at 0x14044209e
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
not ah
mov al, 0x55
lahf
mov rcx, qword [rcx]
nop
mov rax, qword [rcx]
jmp 0x1404420b4
call qword [rax + 0x28]
test eax, eax
jmp 0x1404420be
je 0x1404420fd
mov ecx, eax
jmp 0x1404420cb
movabs r8, 0xcafa59766d7f94e
mov dl, 3
sar r9d, 0x7b
bswap r9w
mov r9d, 0x2a
jmp 0x1404420ef
add rsp, 0x28
jmp 0x1404420f8
jmp fcn.1403ac24d
nop
test edi, r15d
add rsp, 0x28
jmp 0x14044210a
ret

Function at 0x14044327b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
movzx eax, ax
sar r14b, 0x3d
cmc
push rsi
push rdi
bsf si, r8w
and ah, ch
push rbp
rol al, 0x9a
rcr sil, 0xd8
push rbx
movsx di, r9b
ror si, cl
sub rsp, 0x60
cbw
setne dil
mov r14w, 0x1a9f
movaps xmmword [rsp + 0x50], xmm6
movzx r14w, r13b
mov r14b, 0x38
mov r14, r9
mov rbx, r8
bswap bp
cdqe
mov rdi, rdx
mov rsi, rcx
movss xmm6, dword [rsp + 0xb0]
xchg dx, bp
movzx ebp, byte [rsp + 0xb8]
mov qword [rsp + 0x38], 0
mov rcx, qword [rcx + 8]
movzx ax, r15b
not rax
mov rax, qword [rcx]
movzx rdx, ax
lea rdx, [rsp + 0x38]
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
rdtsc
cdq
mov rcx, qword [rsp + 0x38]
cqo
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
jmp 0x140443324
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
mov dl, dil
xchg al, r8b
mov rdx, qword [rdi]
mov rax, qword [rcx]
mov r8d, 1
jmp 0x140443346
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
cbw
rdtsc
jmp 0x140443357
mov rax, qword [rcx]
movsx r8w, al
movsx edx, r15w
bswap dx
mov rdx, rdi
xchg r8b, r8b
mov r8d, ebx
jmp 0x140443374
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
movzx edx, bpl
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
movzx eax, r11w
cwde
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
lahf
bswap ax
xchg rdx, rax
movups xmm0, xmmword [r14]
lahf
movaps xmmword [rsp + 0x40], xmm0
cdqe
mov rax, qword [rcx]
cqo
lea rdx, [rsp + 0x40]
jmp 0x1404433bb
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
movzx ax, r12b
jmp 0x1404433d0
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
jmp 0x1404433e6
movaps xmm3, xmm6
jmp 0x1404433ee
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
movzx ax, spl
mov rax, qword [rcx]
jmp 0x140443406
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
movzx ax, bl
mov rax, qword [rcx]
jmp 0x14044341a
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
movzx bx, sil
btr di, r10w
movzx esi, bx
add rsp, 0x60
not sil
pop rbx
movsx r14, r14w
movzx di, bpl
xchg sil, sil
pop rbp
pop rdi
bswap rsi
movsx r14w, bl
pop rsi
cmova r14, rsi
pop r14
jmp 0x140443459
ret
Function at 0x14044345a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
movzx rsi, cx
cwde
movaps xmmword [rsp + 0x90], xmm10
movsxd rax, edi
movaps xmmword [rsp + 0x80], xmm9
movzx ax, r10b
movaps xmmword [rsp + 0x70], xmm8
movsx ax, dh
xchg dil, al
movaps xmmword [rsp + 0x60], xmm7
mov edi, 0x4d9b42ab
xchg di, si
movsx edi, r9w
movaps xmmword [rsp + 0x50], xmm6
not sil
movzx eax, r14w
movzx rdi, r15w
movaps xmm9, xmm3
cdqe
cwde
movsxd rdi, eax
mov rdi, rdx
cmovg rdx, rbx
lahf
mov rsi, rcx
cwd
movzx dx, r11b
movss xmm8, dword [rsp + 0xe0]
xchg ah, ah
mov rcx, qword [rcx + 0x20]
rdtsc
movzx rax, r11w
movsx dx, dl
movups xmm0, xmmword [r8]
mov al, bl
mov dl, 0x1b
not dh
movaps xmmword [rsp + 0x30], xmm0
not edx
movzx ax, al
movsxd rdx, r13d
mov rax, qword [rcx]
movzx rdx, r15w
bswap dx
lea rdx, [rsp + 0x30]
jmp 0x140443516
call qword [rax + 0x40]
movsd xmm7, qword [rdi]
jmp 0x140443522
movaps xmm0, xmm7
jmp 0x14044352a
call fcn.1404b4da9
movaps xmm10, xmm0
jmp 0x140443538
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
jmp 0x140443544
call fcn.1404b4da9
unpcklps xmm10, xmm0
addps xmm10, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm10
movlps qword [rsp + 0x30], xmm10
movsd xmm7, qword [rdi + 8]
jmp 0x140443569
movaps xmm0, xmm7
jmp 0x140443571
call fcn.1404b4da9
movaps xmm6, xmm0
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404b4da9
movss dword [rdi + 8], xmm6
jmp 0x14044358f
unpcklps xmm6, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x14044359c
addps xmm6, xmm10
movlps qword [rsp + 0x38], xmm6
movss dword [rsp + 0x40], xmm9
bswap dx
rdtsc
lahf
movss dword [rsp + 0x44], xmm9
movzx rcx, r9w
cwde
mov rcx, qword [rsi + 0x18]
movzx rdx, bx
mov r8, qword [rsi + 0x20]
jmp 0x1404435d1
mov rax, qword [rcx]
mov dl, bpl
movzx rdx, r10w
cqo
mov qword [rsp + 0x20], 0
cwd
lea rdx, [rsp + 0x30]
jmp 0x1404435f2
movaps xmm3, xmm8
jmp 0x1404435fb
call qword [rax + 0x90]
movaps xmm6, xmmword [rsp + 0x50]
rcl sil, cl
inc sil
movaps xmm7, xmmword [rsp + 0x60]
xor di, r12w
movaps xmm8, xmmword [rsp + 0x70]
rcr esi, 0xa0
rcl si, 0xea
add si, ax
movaps xmm9, xmmword [rsp + 0x80]
bts esi, esp
and sil, dl
movaps xmm10, xmmword [rsp + 0x90]
shld esi, r12d, 0xb8
movsx esi, r14w
add rsp, 0xa8
mov sil, r8b
movsx rdi, r12w
pop rdi
pop rsi
jmp 0x14044365b
ret
Function at 0x140444fd5
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
and ah, 0xc
bt ax, 4
bsf r8w, r11w
mov r8, rcx
not ah
shl ah, cl
mov eax, 0x5a4d
clc
cmp word [0x140000000], ax
jmp 0x140444fff
jne 0x1404450ff
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
jmp 0x140445021
cmp dword [rcx], 0x4550
jmp 0x14044502c
jne 0x1404450ff
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1404450ff
sub r8, rdx
stc
setge ah
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
cwde
shld r9w, bp, 0xbf
not ax
movzx eax, word [rcx + 6]
bsf r9d, esp
rcl r9b, cl
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
stc
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x14044507d
je 0x1404450c5
mov ecx, dword [rdx + 0xc]
test r15d, eax
cmp r13w, 0x4e9e
test r8b, 0x73
cmp r8, rcx
jmp 0x14044509b
jb 0x1404450b7
mov eax, dword [rdx + 8]
add eax, ecx
stc
cmp edx, edi
cmp r8, rax
jmp 0x1404450b1
jb 0x1404450c8
add rdx, 0x28
jmp 0x1404450c0
jmp 0x140445071
sub edx, edx
clc
test rdx, rdx
jmp 0x1404450d0
jne 0x1404450dd
xor al, al
jmp 0x140445112
cmp dword [rdx + 0x24], 0
jmp 0x1404450e6
jge 0x1404450f3
xor al, al
jmp 0x140445112
mov al, 1
jmp 0x1404450fa
jmp 0x140445112
sub al, al
jmp 0x140445106
jmp 0x140445112
add rsp, 0x18
jmp 0x14044511b
ret