joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403e900f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
neg r15d
push r14
sar r15b, 2
adc r14b, 0xbd
rcr r14d, cl
push r13
push r12
inc r13w
push rsi
shr r12b, 0x5c
sar r15b, 0xee
push rdi
sub r12b, 0xcd
push rbp
push rbx
or r15b, 0x17
shrd r14w, bp, 0x92
rcr r12b, cl
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
or r14b, 0x73
mov r14, r9
shl bl, 0x1c
sal bx, cl
mov r15, r8
shl r13b, 0x76
bts r12w, r15w
bsr r13w, bp
mov r12, rdx
xchg r13d, r13d
ror r13b, cl
mov r13, rcx
or bx, r10w
cmp r11d, 0x34fe59a5
add bl, 0x3c
mov rbx, qword [rcx]
stc
test eax, 0x4df95f1f
test rbx, rbx
jmp 0x1403e9098
je 0x1403e91b6
mov rdi, qword [r13 + 8]
stc
cmp rbx, rdi
je 0x1403e9166
lea rbp, [0x1400bed10]
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e90bf
jmp 0x1403e90e4
call fcn.1401750f8
movups xmmword [rbx + 0x20], xmm6
mov byte [rbx + 0x10], 0
add rbx, 0x50
cmc
test dx, 0x1f01
cmp rbx, rdi
je 0x1403e9160
mov qword [rbx], rbp
movzx rcx, cx
jmp 0x1403e90f0
lea rcx, [rbx + 0x38]
call fcn.1403e64ca
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jb 0x1403e90c9
mov rcx, qword [rbx + 0x10]
sar dl, cl
lea rdx, [rax + 1]
cmc
stc
cmp rdx, 0x1000
jb 0x1403e90c4
mov rsi, qword [rcx - 8]
cmc
cmp dl, r12b
stc
add rcx, 0xfffffffffffffff8
clc
sub rcx, rsi
jmp 0x1403e9138
cmp rcx, 0x20
jmp 0x1403e9141
jae 0x1403e9247
add rax, 0x28
cqo
mov rdx, rax
movsx ecx, bp
mov rcx, rsi
jmp 0x1403e915b
jmp 0x1403e90c4
mov rbx, qword [r13]
xchg dh, dh
mov rdx, qword [r13 + 0x10]
cmc
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403e917a
jb 0x1403e91a9
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp rbx, 0x20
jae 0x1403e9247
add rdx, 0x27
not rcx
mov rbx, rax
bswap cx
movzx rcx, bp
movsx ecx, cx
mov rcx, rbx
jmp 0x1403e91b1
call fcn.1401750f8
mov qword [r13], r12
neg dil
lea rax, [r15 + r15*4]
add r15b, 0xf6
movsx rdi, sp
shl rax, 4
add rax, r12
rol bpl, cl
mov qword [r13 + 8], rax
test r8d, 0x53e63e79
lea rax, [r14 + r14*4]
movzx edi, r15w
shl rax, 4
mov sil, 0x2b
bswap ebx
add rax, r12
btc ebp, r14d
neg r14b
bswap r14d
mov qword [r13 + 0x10], rax
neg bx
xor edi, 0x497d24f6
ror r14d, 0x83
movaps xmm6, xmmword [rsp + 0x20]
inc r15d
add rsp, 0x38
setg r12b
not di
pop rbx
mov r12b, 0xe1
cmovg r12, r8
movzx esi, di
pop rbp
pop rdi
cmovle r12d, r10d
bswap r13d
pop rsi
pop r12
pop r13
movzx r14, dx
pop r14
movsx r15w, bl
pop r15
ret
call fcn.1404b84d5
int3
Function at 0x14042e008
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x28
jmp 0x14042e019
mov rsi, rcx
movzx edi, dx
or dh, ch
ror dx, 0xeb
movzx edx, word [rcx + rdi*4 + 0x834]
jmp 0x14042e033
test dx, dx
jmp 0x14042e03b
js 0x14042e04e
mov rcx, rsi
jmp 0x14042e049
call fcn.14042e008
movsxd rcx, dword [rsi + 0x8860]
cmp ecx, dword [rsi + 0x8858]
jmp 0x14042e060
jge 0x14042e213
movsxd rax, dword [rsi + 0x885c]
lea rax, [rax + rcx]
not r8
btc dx, 0xce
mov r8, qword [rsi + 8]
shr rdx, 0xbf
movsxd rcx, r14d
lea edx, [rax + 3]
xor cl, r13b
shl cx, 0xd7
bts cx, r14w
test eax, eax
cmovns edx, eax
mov rcx, rbx
inc cx
btc cx, 0x17
mov rcx, qword [rsi + 0x18]
sar edx, 2
jmp 0x14042e0b2
movsxd rdx, edx
test rax, 0x33193dab
mov byte [rcx + rdx], 1
mov dx, 0x5f37
adc dh, 0xf4
mov rdx, qword [rsi + 0x8838]
cmp r8w, 0x53d5
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp r11w, 0x63b3
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x14042e0eb
jb 0x14042e13d
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
rcl cl, 0x34
bt cx, 0x22
movzx ecx, byte [rdx + rdi*4 + 1]
mov byte [r8 + rax + 1], cl
adc cx, cx
movzx cx, ch
movzx ecx, byte [rdx + rdi*4]
test bx, 0x252a
mov byte [r8 + rax + 2], cl
cmovnp ecx, r8d
shl rcx, 0x6e
movzx ecx, byte [rdx + rdi*4 + 3]
cmc
stc
mov byte [r8 + rax + 3], cl
shl ah, cl
btr ax, 0x62
lahf
mov eax, dword [rsi + 0x885c]
cmc
stc
add eax, 4
test dil, 0xe9
test sil, cl
mov dword [rsi + 0x885c], eax
cmp bpl, dil
test sp, 0x4d24
cmp eax, dword [rsi + 0x8854]
jl 0x14042e213
mov ecx, dword [rsi + 0x884c]
mov eax, dword [rsi + 0x8858]
stc
cmp r13b, bpl
mov dword [rsi + 0x885c], ecx
bsr rcx, r12
mov ecx, dword [rsi + 0x8860]
cmp r13b, r8b
add ecx, dword [rsi + 0x8844]
cmp ch, 0xb6
test sil, 0x2c
stc
mov dword [rsi + 0x8860], ecx
test dl, r10b
clc
cmp ecx, eax
jl 0x14042e213
mov ecx, dword [rsi + 0x8840]
nop dword [rax]
cmc
test ecx, ecx
jle 0x14042e213
mov edx, dword [rsi + 0x8864]
shl edx, cl
mov dword [rsi + 0x8844], edx
jmp 0x14042e1d5
sar edx, 1
cmc
stc
add edx, dword [rsi + 0x8850]
jmp 0x14042e1e4
mov dword [rsi + 0x8860], edx
jmp 0x14042e1ef
dec ecx
test r9b, 0x5a
cmc
cmp r15w, ax
mov dword [rsi + 0x8840], ecx
test r14b, 0x18
cmc
clc
cmp edx, eax
jmp 0x14042e20d
jge 0x14042e1ba
add rsp, 0x28
xchg rdi, rsi
cmovo di, sp
setle dil
pop rdi
movsx si, r11b
bswap rsi
pop rsi
jmp 0x14042e231
ret
Function at 0x140440fdf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
btc edi, r12d
push rbx
add rdi, 0x3fc0001f
sub rsp, 0x90
add si, r8w
movaps xmmword [rsp + 0x80], xmm7
mov sil, 0xca
test r10, 0x17f44e7
sar dil, cl
movaps xmmword [rsp + 0x70], xmm6
mov rdi, rdx
sar rax, cl
bts esi, esi
and sil, cl
mov rsi, rcx
mov rax, qword [rdx]
clc
cmp qword [rax + 0x18], 8
jmp 0x140441031
jb 0x14044103a
mov rax, qword [rax]
movsxd rcx, r8d
shl r9w, 0xd4
cmp ax, 0x3481
lea r9, [rax + rcx*2]
xor al, spl
sub ebx, ebx
nop word cs:[rax + rax]
shr ax, cl
ror ah, 0xc2
cmp r11, r14
movzx eax, word [r9 + rbx*2]
cmp r10, rcx
cmp eax, 0xa
jmp 0x140441075
je 0x140441090
test eax, eax
je 0x140441090
inc rbx
jmp 0x14044108b
jmp 0x140441065
test byte [rdi + 0x1c], 4
jmp 0x140441099
jne 0x140441227
mov rcx, qword [rdi + 0x10]
movzx r8, cx
cdqe
movsx rax, r8w
mov rax, qword [rdi + 8]
cmovno dx, si
mov rdx, 0x50a30360
movsd xmm0, qword [rax + 8]
movsd qword [rsp + 0x40], xmm0
movsx edx, dx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 2
mov dx, r13w
jmp 0x1404410e4
mov dword [rsp + 0x20], 0
movzx edx, cx
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x40]
jmp 0x1404410fe
call fcn.140447c7b
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
cwd
mov dword [rsp + 0x60], 0
cwd
not dl
movzx cx, dil
mov rcx, qword [rsp + 0x38]
mov dh, 0xa7
bswap dx
movsx edx, bp
mov rax, qword [rcx]
movzx rdx, r13w
movsxd rdx, ebp
lea rdx, [rsp + 0x40]
jmp 0x140441145
call qword [rax + 0x1e0]
test eax, eax
jmp 0x140441152
je 0x14044117f
mov ecx, eax
movsxd r8, r15d
movabs r8, 0xe31b45c42a775183
mov dl, 3
not r9b
movsxd r9, edx
mov r9d, 0x4f
jmp 0x14044117a
call fcn.1403b19c1
movss xmm6, dword [rsp + 0x4c]
setp dh
movss xmm7, dword [rsp + 0x50]
bsf dx, di
lea rcx, [rsp + 0x38]
rcl dl, cl
inc dh
lea rdx, [rsp + 0x40]
cmp r8w, 0x7cd1
xor r8d, r8d
jmp 0x1404411ae
call fcn.1404415b2
movss xmm0, dword [rdi + 0x18]
jmp 0x1404411bd
movss dword [rsi], xmm0
jmp 0x1404411c6
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
cmove rcx, rax
movss xmm0, dword [rsp + 0x50]
movzx ecx, bx
sal ch, 0xad
movss dword [rsi + 8], xmm0
shld ecx, edx, 0x30
not cx
shl cx, cl
mov dword [rsi + 0xc], 0
shl cx, cl
movss dword [rsi + 0x10], xmm7
mov dword [rsi + 0x14], ebx
add cl, r10b
or ecx, 0x9b766c3
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140441287
mov rax, qword [rcx]
jmp 0x14044121f
call qword [rax + 0x10]
jmp 0x140441287
movss xmm0, dword [rdi + 0x18]
movss dword [rsi], xmm0
jmp 0x140441235
cvtsi2ss xmm1, ebx
mulss xmm1, dword [0x1400bfc14]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
jmp 0x14044124f
movss xmm0, dword [0x1400bfc94]
jmp 0x14044125c
movlps qword [rsi + 8], xmm0
mov rax, qword [rdi + 8]
jmp 0x140441269
movss xmm0, dword [rax + 0xc]
jmp 0x140441273
addss xmm0, dword [0x1400bfbd0]
movss dword [rsi + 0x10], xmm0
mov dword [rsi + 0x14], ebx
add rdi, rax
clc
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
shr si, cl
shr sil, 0xb5
add rsp, 0x90
pop rbx
setne sil
mov si, cx
movzx si, r15b
pop rdi
cmova si, r15w
mov sil, dil
pop rsi
jmp 0x1404412be
ret
Function at 0x1404412bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sar rax, cl
push r14
push rsi
sar rax, 0x85
sbb si, r8w
rcl ah, 0x41
push rdi
movsxd rsi, edx
push rbp
stc
shld ax, r14w, 5
push rbx
adc rax, 0x1b0a10bc
sal ax, 0x95
rcl si, 0xd1
sub rsp, 0x78
lahf
movzx si, dl
movaps xmmword [rsp + 0x60], xmm8
bswap eax
xchg sil, sil
movzx esi, di
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm6
setp sil
cdqe
cbw
mov rax, qword [rcx]
jmp 0x140441322
mov esi, dword [rax + 0x10]
jmp 0x14044132a
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
test esi, esi
jmp 0x140441346
jle 0x14044151a
movaps xmm7, xmm2
cmovge r15w, ax
movaps xmm8, xmm1
mov r15, rcx
jmp 0x140441360
xorps xmm6, xmm6
xor edi, edi
lea r14, [rsp + 0x28]
movzx edx, r12w
nop word cs:[rax + rax]
movzx rcx, di
mov dl, 0x19
movzx cx, cl
mov rcx, r14
movsx r8w, dl
movzx r8, r9w
mov rdx, r15
seto r8b
movsx r8w, r12b
movzx r8, si
mov r8d, edi
jmp 0x1404413a9
call fcn.140440fdf
mov ebx, dword [rsp + 0x3c]
test ah, 0x6c
test ebx, ebx
jmp 0x1404413bc
jle 0x14044151a
test edi, edi
jmp 0x1404413c9
jne 0x1404413e7
movss xmm0, dword [rsp + 0x34]
jmp 0x1404413da
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x140441518
movss xmm0, dword [rsp + 0x38]
jmp 0x1404413f2
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14044141e
add edi, ebx
jmp 0x140441406
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x140441413
jl 0x140441385
jmp 0x14044151a
movss xmm6, dword [rsp + 0x28]
jmp 0x140441429
ucomiss xmm6, xmm8
jbe 0x14044143f
mov esi, edi
jmp 0x14044143a
jmp 0x14044151a
movss xmm0, dword [rsp + 0x2c]
jmp 0x14044144a
ucomiss xmm0, xmm8
jbe 0x1404414b6
sub ebp, ebp
movsx rdx, r14w
mov esi, edi
movaps xmm7, xmm6
movzx r8, r13w
movsx dx, bl
nop word cs:[rax + rax]
mov rcx, r15
bswap dx
mov edx, edi
mov r8d, ebp
jmp 0x140441483
call fcn.1404417a6
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x140441585
inc ebp
jmp 0x14044149d
inc esi
cmp rsp, 0x7e743778
movaps xmm6, xmm7
cmp ebx, ebp
jmp 0x1404414b0
jne 0x140441473
test byte [r15 + 0x1c], 4
jmp 0x1404414c0
jne 0x140441507
lea esi, [rbx + rdi]
dec ax
dec esi
ror ch, cl
mov rax, qword [r15]
shld ecx, esi, 0x7b
movsxd rcx, esi
cmp qword [rax + 0x10], rcx
jbe 0x1404415a7
cmp qword [rax + 0x18], 8
jmp 0x1404414ee
jb 0x1404414f7
mov rax, qword [rax]
cmp word [rax + rcx*2], 0xa
jmp 0x140441501
je 0x14044151a
add ebx, edi
movsx esi, si
mov esi, ebx
jmp 0x140441513
jmp 0x14044151a
sub esi, esi
mov eax, esi
sal si, cl
adc r14b, r15b
movaps xmm6, xmmword [rsp + 0x40]
xor dil, 0xd6
shl r15b, cl
cmove bp, cx
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
bts di, r9w
mov r15w, dx
rcl sil, cl
add rsp, 0x78
movzx di, r10b
not r14
jmp 0x14044155a
pop rbx
movsx rbp, r14w
movzx r15w, r14b
not bpl
pop rbp
movsxd r15, r14d
bswap rsi
movsx rsi, r13w
pop rdi
movzx r15, r15w
pop rsi
movzx r14d, sp
pop r14
setb r15b
pop r15
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x14044151a
inc esi
jmp 0x1404415a2
jmp 0x14044151a
call fcn.140441962
int3
Function at 0x1404422e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
adc r15b, 0xc0
push rsi
push rdi
btc r14w, 0x4b
cmp esi, esi
push rbp
or r14b, dl
push rbx
sbb bpl, r9b
movsx ebx, r9w
xor r14, 0xcd9267d
sub rsp, 0x28
mov r15d, r9d
movzx bx, spl
mov ebp, r8d
neg bx
xchg r14b, bl
mov r14, rdx
xadd bx, bx
mov rbx, rcx
lea rcx, [rdx + 0x20]
xadd dx, dx
add dl, 0xe2
xchg edx, edx
mov edx, r8d
rcl r8b, cl
xadd r8b, r8b
xor r8b, 0x7b
mov r8d, r9d
test ebx, 0x4d0548a7
stc
sub r9d, r9d
jmp 0x140442355
call fcn.1404424df
test r15d, r15d
jmp 0x140442362
jle 0x1404423f8
test rax, rax
jmp 0x140442370
je 0x1404423f8
movsxd rsi, ebp
sub dl, r9b
bsf edx, ecx
sar cl, cl
mov ecx, r15d
sub ebp, ebp
mov rdx, rsi
jmp 0x14044238e
jmp 0x1404423b7
movzx edi, word [rdi + rdx*2]
jmp 0x14044239c
mov word [rax + rbp*2], di
jmp 0x1404423a5
inc rbp
inc rdx
cmp spl, cl
cmp rcx, rbp
je 0x1404423fb
mov di, 0x2a
test byte [rbx + 0x1c], 4
jne 0x14044239c
mov rdi, qword [rbx]
test bh, 0xb2
stc
cmp qword [rdi + 0x10], rdx
jmp 0x1404423d5
jbe 0x1404424d4
cmp qword [rdi + 0x18], 8
jmp 0x1404423e5
jb 0x140442393
mov rdi, qword [rdi]
jmp 0x1404423f3
jmp 0x140442393
movsxd rsi, ebp
mov rbx, qword [rbx]
mov rdi, qword [rbx + 0x10]
bt ecx, 0x46
bswap rcx
mov rcx, rdi
test bp, sp
jmp 0x140442414
sub rcx, rsi
jmp 0x14044241c
jb 0x1404424d4
movsxd rax, r15d
cmp rcx, rax
jmp 0x14044242d
cmovb rax, rcx
jmp 0x14044243a
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jmp 0x140442447
jb 0x140442450
mov rcx, qword [rbx]
lea rcx, [rcx + rsi*2]
btr r8d, r15d
ror dl, cl
sub rdi, rax
rcr r8b, cl
test di, r12w
mov rbp, rdi
sub dx, r12w
btr edx, 0x6e
sub rbp, rsi
cmovne r8, rsp
lea rdx, [rcx + rax*2]
movzx r8w, cl
lea r8, [rbp + 2]
cmp r12, rbp
add r8, rbp
jmp 0x140442492
call fcn.1404a5b19
mov qword [rbx + 0x10], rdi
mov byte [r14 + 0x16], 0
ror bh, cl
sets r15b
add rsp, 0x28
pop rbx
movsx ebp, r13w
pop rbp
movsxd r14, r14d
movsx esi, r11w
pop rdi
movzx esi, r13w
movzx r15, r8w
pop rsi
movsx r14w, r13b
movzx r14, r15w
pop r14
pop r15
jmp 0x1404424d3
ret
call fcn.140441962
int3
Function at 0x1404463e3
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x1404463ec
movzx ecx, cx
jmp 0x1404463f4
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
stc
cmp r12b, bl
cmp eax, 0x100
jmp 0x14044640d
setae al
jmp 0x140446419
add rsp, 0x28
jmp 0x140446422
ret

Function at 0x140447b71
Capabilities:
Encrypt data using speck

Disassembly:
sub rsp, 0x28
lahf
cwde
movsx eax, r9w
mov rcx, qword [rcx]
movzx rax, di
movsx ax, ah
mov rax, qword [rcx]
jmp 0x140447b8e
call qword [rax + 0x28]
test eax, eax
jmp 0x140447b98
je 0x140447bcb
mov ecx, eax
ror dl, cl
movabs r8, 0xcafa59766d7f94e
rcr r9b, cl
add dl, 0xc1
neg r9w
mov dl, 3
mov r9d, 0x2a
test sil, 0xbf
add rsp, 0x28
jmp fcn.1403b19c1
nop
add rsp, 0x28
jmp 0x140447bd5
ret
Function at 0x140448646
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
btc eax, r10d
xor ax, di
rcr rax, cl
push rsi
push rdi
movsx rax, bx
sbb r14w, 0x5a0
push rbx
test r10b, 0x40
sub rsp, 0x58
mov rax, r9
mov r14, rdx
movsx r9w, bl
mov r9d, dword [rsp + 0xa0]
movd xmm0, r8d
shr r8, 0x20
jmp 0x140448688
movd xmm1, r8d
mov qword [rdx], 0
jmp 0x140448699
cvttss2si r8d, xmm1
test r8d, r8d
jle 0x1404487cb
cvttss2si r10d, xmm0
xor r11d, r11d
movss xmm2, dword [0x1400bf4c0]
cmc
xor ebx, ebx
jmp 0x1404486cd
inc ebx
add r11d, r9d
cmp ebx, r8d
je 0x1404487cb
mov rsi, r10
bts dx, r14w
not rdx
cmp r10b, 0xb
mov edx, r11d
cmc
stc
test r10d, r10d
jmp 0x1404486e9
jg 0x140448780
jmp 0x1404486bf
movzx edi, dil
jmp 0x1404486fd
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
jmp 0x140448711
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
bswap edi
not di
movsx di, dil
movzx edi, byte [rax + rdx + 1]
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
movzx edi, byte [rax + rdx + 2]
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
test r14b, r13b
cmc
test r12w, 0x4c44
add edx, 4
jmp 0x140448772
dec rsi
jmp 0x14044877a
je 0x1404486bf
mov edx, edx
seta dil
and dil, r10b
movzx edi, byte [rax + rdx + 3]
jmp 0x140448798
cmp edi, 0xff
jmp 0x1404487a3
je 0x14044876a
test edi, edi
jmp 0x1404487b0
jne 0x1404486f4
mov byte [rax + rdx + 2], 0
mov word [rax + rdx], 0
jmp 0x1404487c6
jmp 0x14044876a
mov rcx, qword [rcx + 0x18]
movzx edx, r8w
mov dh, 0x6a
movabs rdx, 0x10000001c
jmp 0x1404487e5
mov qword [rsp + 0x38], rdx
jmp 0x1404487ef
movsd xmm2, qword [0x1400bfee0]
jmp 0x1404487fc
movsd qword [rsp + 0x40], xmm2
mov dword [rsp + 0x48], 0
jmp 0x14044880f
mov qword [rsp + 0x50], 0
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
bsf r8w, r10w
mov edx, edx
and dil, 0xe
sbb di, 0x259c
or rdx, rbx
cmova rdi, rbp
movsx bx, r8b
sets bh
mov rbx, qword [rcx]
mov dil, 0x5c
movzx rdi, r8w
movsxd r8, r13d
mov qword [rsp + 0x28], r14
movsxd rdi, eax
movzx rdi, sp
cmovnp r8, rsi
lea rdi, [rsp + 0x38]
movzx r8w, dl
jmp 0x140448871
mov qword [rsp + 0x20], rdi
movsx r8, r10w
movsxd r8, eax
movzx r8d, cx
mov r8, rax
call qword [rbx + 0x1c8]
test eax, eax
jmp 0x140448891
je 0x1404488c3
mov ecx, eax
movabs r8, 0xad4a5352d2edebd0
movsx r9d, dx
setge dl
mov dl, 3
movsxd r9, edx
movzx r9, di
movsx r9w, r8b
mov r9d, 0xd4
call fcn.1403b19c1
mov rax, r14
bswap ebx
add rsp, 0x58
pop rbx
cmovle r14d, ecx
pop rdi
movzx r14d, dx
pop rsi
pop r14
jmp 0x1404488de
ret
Function at 0x140448da7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
push rsi
movzx rax, r10w
sar rax, cl
btr r14, r13
push rdi
push rbp
add sil, r8b
xor bpl, 0x65
shrd r14, rsi, 0xb7
push rbx
sub rsp, 0x60
movsx rbp, r10w
cwde
movaps xmmword [rsp + 0x50], xmm6
movsx rbx, ax
movzx esi, di
mov r14, r9
movsxd rdi, r15d
mov rbx, r8
mov rdi, rdx
cdq
xchg rsi, rbp
mov rsi, rcx
movsx edx, di
movss xmm6, dword [rsp + 0xb0]
movzx dx, ah
cwd
movzx ebp, byte [rsp + 0xb8]
bswap ax
movzx rdx, r10w
cqo
mov qword [rsp + 0x38], 0
cdq
lahf
mov rcx, qword [rcx + 8]
cmova ax, r11w
mov dl, r12b
cdqe
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
jmp 0x140448e35
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x38]
nop
mov rax, qword [rcx]
movsxd rdx, r13d
lea rdx, [rsp + 0x30]
jmp 0x140448e58
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rdi]
cmovbe ax, cx
cdqe
setbe al
mov rax, qword [rcx]
bswap r8w
cmovne r8w, bp
mov r8d, 1
jmp 0x140448e86
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
movsx rax, bp
not ah
jmp 0x140448e99
mov rax, qword [rcx]
movsx r8d, sp
cwd
mov rdx, rdi
mov r8b, 0x5c
mov r8b, r14b
mov r8d, ebx
jmp 0x140448eb3
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
movsx rdx, r12w
mov dl, 0x63
cdq
movzx edx, bpl
cwde
mov rax, qword [rcx]
jmp 0x140448ecf
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
movsx rax, r9w
movsxd rax, esp
cdqe
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
movups xmm0, xmmword [r14]
rdtsc
mov rdx, r14
movaps xmmword [rsp + 0x40], xmm0
movzx rdx, bx
rdtsc
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
jmp 0x140448f0b
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
movsxd rdx, r12d
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsp + 0x38]
jmp 0x140448f29
mov rax, qword [rcx]
jmp 0x140448f31
mov qword [rsp + 0x20], 0
jmp 0x140448f3f
movaps xmm3, xmm6
jmp 0x140448f47
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
bswap rax
xchg al, ah
mov rax, qword [rcx]
jmp 0x140448f6a
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
xor r14, 0x17451d46
add rsp, 0x60
movsx ebp, ax
movzx r14d, di
bswap edi
pop rbx
pop rbp
bswap si
movsx r14d, si
pop rdi
pop rsi
pop r14
jmp 0x140448f98
ret
Function at 0x140449182
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
or esi, 0x36ce737b
cwde
push rdi
movsx eax, r8w
shld ax, r12w, 0xec
sub rsp, 0x88
cbw
movaps xmmword [rsp + 0x70], xmm9
movsxd rsi, edx
bswap esi
movaps xmmword [rsp + 0x60], xmm8
movaps xmmword [rsp + 0x50], xmm7
xchg rdi, rax
mov al, 0xb1
movaps xmmword [rsp + 0x40], xmm6
movaps xmm8, xmm3
mov rdi, rdx
movzx edx, r9w
rdtsc
mov rsi, rcx
rdtsc
lahf
mov rcx, qword [rcx + 0x20]
movups xmm0, xmmword [r8]
cdq
movsx rdx, r14w
movaps xmmword [rsp + 0x20], xmm0
movzx ax, r8b
lahf
rdtsc
mov rax, qword [rcx]
mov edx, 0x4cd21955
lea rdx, [rsp + 0x20]
jmp 0x140449200
call qword [rax + 0x40]
movsd xmm6, qword [rdi]
jmp 0x14044920c
movaps xmm0, xmm6
call fcn.1404ba91a
movaps xmm9, xmm0
jmp 0x14044921d
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x140449229
call fcn.1404ba91a
unpcklps xmm9, xmm0
addps xmm9, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm9
movlps qword [rsp + 0x20], xmm9
movsd xmm6, qword [rdi + 8]
jmp 0x14044924e
movaps xmm0, xmm6
jmp 0x140449256
call fcn.1404ba91a
movaps xmm7, xmm0
jmp 0x140449263
shufps xmm6, xmm6, 0x55
movaps xmm0, xmm6
jmp 0x14044926f
call fcn.1404ba91a
movss dword [rdi + 8], xmm7
jmp 0x14044927e
unpcklps xmm7, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x14044928b
addps xmm7, xmm9
movlps qword [rsp + 0x28], xmm7
movss dword [rsp + 0x30], xmm8
movzx rcx, dx
movss dword [rsp + 0x34], xmm8
jmp 0x1404492b2
mov rcx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
mov rax, qword [rcx]
movsx rdx, bp
jmp 0x1404492c6
lea rdx, [rsp + 0x20]
call qword [rax + 0x98]
movaps xmm6, xmmword [rsp + 0x40]
inc sil
clc
movaps xmm7, xmmword [rsp + 0x50]
jmp 0x1404492e9
movaps xmm8, xmmword [rsp + 0x60]
setg dil
movaps xmm9, xmmword [rsp + 0x70]
sbb si, 0x49b
shl di, cl
add rsp, 0x88
movsx rsi, di
movsx edi, r14w
movsx si, dl
pop rdi
not sil
movsxd rsi, esi
movzx esi, bp
pop rsi
jmp 0x140449324
ret
Function at 0x140449702
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
sub sil, r15b
sub rsp, 0x70
movsx si, sil
movaps xmmword [rsp + 0x60], xmm9
setns sil
movsx esi, bx
movaps xmmword [rsp + 0x50], xmm8
mov sil, r15b
movzx si, r10b
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm6
movzx si, r8b
bswap esi
movaps xmm8, xmm2
mov rsi, rcx
movd xmm7, edx
shr rdx, 0x20
jmp 0x140449752
movd xmm6, edx
mov rcx, qword [rcx + 0x20]
cqo
cbw
movups xmm0, xmmword [r9]
movzx rdx, r9w
lahf
cqo
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rcx]
movsx rdx, r12w
movsx edx, r8w
cqo
lea rdx, [rsp + 0x20]
call qword [rax + 0x40]
movdqa xmm0, xmm7
call fcn.1404ba91a
movdqa xmm7, xmm0
movss xmm9, dword [0x1400bd480]
jmp 0x14044979e
addss xmm7, xmm9
movdqa xmm0, xmm6
call fcn.1404ba91a
addss xmm0, xmm9
mov rcx, qword [rsi + 0x18]
movzx r8w, r8b
setge r8b
movsx r8, bp
mov r8, qword [rsi + 0x20]
jmp 0x1404497cb
movd eax, xmm7
movd edx, xmm0
shl rdx, 0x20
cmp r10, 0x4f15047a
or rax, rdx
mov qword [rsp + 0x20], rax
bswap dx
cwde
mov al, r12b
movss dword [rsp + 0x28], xmm8
rdtsc
lahf
cqo
movss dword [rsp + 0x2c], xmm8
cdq
rdtsc
movsx edx, r12w
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0xa8]
movaps xmm6, xmmword [rsp + 0x30]
movzx rsi, sp
movaps xmm7, xmmword [rsp + 0x40]
sbb sil, dl
seta sil
bts esi, esi
movaps xmm8, xmmword [rsp + 0x50]
movzx rsi, r15w
movaps xmm9, xmmword [rsp + 0x60]
xor rsi, 0x5f23423b
add rsp, 0x70
pop rsi
ret

Function at 0x14044ab44
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
sbb r8w, 0x21e0
bts ax, ax
mov r8, rcx
mov ah, 0x93
mov eax, 0x5a4d
jmp 0x14044ab64
cmp word [0x140000000], ax
jne 0x14044ac70
movsxd rcx, dword [0x14000003c]
sar dl, cl
jmp 0x14044ab7f
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jmp 0x14044ab94
jne 0x14044ac70
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14044ac70
sub r8, rdx
rol dx, cl
movzx edx, word [rcx + 0x14]
shld r9w, r11w, 0x3d
add rdx, 0x18
ror al, cl
btr r9w, bx
sbb ah, bl
lea rdx, [rdx + rcx]
movzx eax, word [rcx + 6]
test r8b, r9b
lea rcx, [rax + rax*4]
bswap r9d
sal r9b, 0x4a
cmovs r9, r13
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
jmp 0x14044abf1
cmp rdx, r9
jmp 0x14044abf9
je 0x14044ac2d
mov ecx, dword [rdx + 0xc]
test r11b, 0xb3
cmp r8, rcx
jb 0x14044ac24
mov eax, dword [rdx + 8]
cmp dh, bh
add eax, ecx
cmp r8, rax
jmp 0x14044ac1e
jb 0x14044ac34
add rdx, 0x28
jmp 0x14044abe4
xor edx, edx
test eax, 0x2b07b4
test rdx, rdx
jmp 0x14044ac3c
jne 0x14044ac4e
sub al, al
jmp 0x14044ac49
jmp 0x14044ac8c
cmp dword [rdx + 0x24], 0
jmp 0x14044ac57
jge 0x14044ac69
sub al, al
jmp 0x14044ac64
jmp 0x14044ac8c
mov al, 1
jmp 0x14044ac8c
xor al, al
jmp 0x14044ac77
jmp 0x14044ac8c
add rsp, 0x18
jmp 0x14044ac95
ret