joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404040d6
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
test r8, r8
je 0x140404141
movzx r9d, word [r8]
test r9w, r9w
jmp 0x1404040f0
je 0x140404184
sub eax, eax
sub r10b, al
mov r10, rcx
clc
nop dword [rax + rax]
test ebx, esp
cmp rdx, rax
je 0x14040430f
mov word [r10], r9w
cmc
add r10, 2
movsxd r9, edi
setle r9b
bswap r9w
movzx r9d, word [r8 + rax*2 + 2]
inc rax
test r9w, r9w
jne 0x140404109
sub rdx, rax
jmp 0x140404188
movzx r9d, word [0x1400b8f10]
cmp dx, 0x3d8a
test r9w, r9w
jmp 0x140404157
je 0x14040419b
cmp rdx, 0x104
bswap r8w
movzx r8d, r8w
movzx r8, r10w
mov r8d, 0x104
jmp 0x14040417b
cmovb r8, rdx
jmp 0x14040429e
mov r10, rcx
clc
test rdx, rdx
jmp 0x140404190
jne 0x14040430f
jmp 0x140404317
mov rax, qword gs:[0x30]
sar r11w, 0xa2
mov rax, qword [rax + 0x60]
not r9b
mov rax, qword [rax + 0x18]
xor r9b, r11b
mov rax, qword [rax + 0x10]
jmp 0x1404041c8
movzx r8d, word [rax + 0x58]
bts r10w, si
cmp r8, rdx
movsx r10, r13w
cmovae r8, rdx
xor r9, r9
mov r9, qword [rax + 0x60]
mov r10b, 0x8c
sar r11b, 0x94
movzx r11d, word [r9]
rol r10b, cl
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x140404202
je 0x140404250
xor eax, eax
cmc
nop word cs:[rax + rax]
stc
jmp 0x14040421f
cmp r8, rax
jmp 0x140404227
je 0x14040425e
mov word [r10], r11w
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
inc rax
test r11w, r11w
jmp 0x140404247
jne 0x14040421f
sub r8, rax
test r8, r8
jmp 0x140404258
je 0x140404264
mov word [r10], 0
movzx r9d, word [0x1400b8f10]
cmp rdx, 0x104
mov r8w, 0xc02
mov r8d, 0x104
movsx r10, bx
cmovb r8, rdx
adc r10w, 0x5f9e
mov r10, rcx
test r9w, r9w
jmp 0x140404298
je 0x140404301
xor edx, edx
lea rax, [0x1400b8f10]
btc r10w, 0xcd
mov r10, rcx
cmp r8b, 0x52
nop dword [rax + rax]
cmp r8, rdx
jmp 0x1404042c4
je 0x14040430f
mov word [r10], r9w
shr r9, cl
cmp sp, 0x45c2
add r10, 2
bswap r9
cmovg r9, r8
movzx r9d, word [rax + rdx*2 + 2]
inc rdx
clc
test r9w, r9w
jmp 0x1404042f4
jne 0x1404042bc
sub r8, rdx
test r11b, 0xad
test r8, r8
jmp 0x140404309
je 0x140404317
mov word [r10], 0
cwd
movabs rax, 0xe039ec0d24fefd13
xchg edx, edx
mov qword [rsp], rax
movzx rdx, r14w
cbw
rdtsc
movabs rax, 0x2247bce40ef3a5e6
cmovno edx, eax
setno dl
bswap rdx
mov qword [rsp + 8], rax
movabs rdx, 0xe05dec612491fd3d
jmp 0x140404356
mov qword [rsp + 0x10], rdx
jmp 0x140404360
mov qword [rsp + 0x18], rax
mov rax, r9
lea rax, [rsp + 0x10]
jmp 0x140404372
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
test al, r8b
test r12b, 0x59
clc
nop word cs:[rax + rax]
clc
test r13w, 0x509
cmp word [rcx + 2], 0
jmp 0x1404043ab
lea rcx, [rcx + 2]
jmp 0x1404043b4
jne 0x1404043a1
test ax, ax
je 0x14040440f
lea rdx, [rsp + 2]
cmp dx, 0x22f6
nop word cs:[rax + rax]
test r13w, 0x5f2c
mov word [rcx], ax
movsx rax, sp
sub al, 0xe4
bt ax, r9w
add rcx, 2
movsx ax, r13b
and al, r11b
movzx eax, word [rdx]
add rdx, 2
clc
cmc
test ax, ax
jmp 0x140404409
jne 0x1404043de
mov word [rcx], 0
add rsp, 0x28
ret
Function at 0x14043ac87
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
cmovo r15, rdx
sal r15w, 0x31
rcr r15w, 0xa9
push rsi
shl r15w, cl
push rdi
sbb r15w, 0x4610
dec r15w
mov r15b, al
push rbx
movsx r15, cx
sbb r15d, ecx
sub rsp, 0x20
movzx r15w, sil
mov r15, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
or ah, 0x38
btc ax, r10w
mov qword [rcx + 0x10], 0
shl al, cl
sbb al, dil
movzx bx, r11b
mov rcx, qword [rdx + 8]
mov rax, qword [rdx]
shr bx, 0x34
mov rbx, rcx
stc
sub rbx, rax
cmp r12b, r15b
sub rcx, rax
jmp 0x14043acfd
je 0x14043ae14
js 0x14043ae4a
mov r14, rdx
clc
sar rbx, 6
cmp r13b, r12b
test si, 0x1d88
cmp rcx, 0xfc1
jmp 0x14043ad25
jb 0x14043ad5d
or rcx, 0x27
jmp 0x14043ad34
call fcn.14044dc41
lea rdi, [rax + 0x27]
test r9b, 0x14
test di, r15w
stc
and rdi, 0xffffffffffffffe0
jmp 0x14043ad4f
mov qword [rdi - 8], rax
jmp 0x14043ad58
jmp 0x14043ad65
call fcn.14044dc41
mov rdi, rax
mov qword [r15], rdi
rcl esi, cl
or esi, r9d
mov qword [r15 + 8], rdi
sub sil, 0x8b
shl rbx, 6
sal sil, cl
movsx si, r13b
bsr si, r11w
add rbx, rdi
movsx esi, r14w
bswap rsi
mov qword [r15 + 0x10], rbx
movsxd rbx, r9d
movzx ebx, r15w
mov rbx, qword [r14]
movzx si, r10b
mov rsi, qword [r14 + 8]
jmp 0x14043adb8
add rdi, 0x40
add rbx, 0x40
cmc
test al, r13b
cmp rbx, rsi
jmp 0x14043adc0
je 0x14043ae06
mov qword [rdi + 0x38], 0
or cx, 0x2998
sub ecx, 0x3b314458
mov rcx, qword [rbx + 0x38]
jmp 0x14043ade3
test rcx, rcx
jmp 0x14043adeb
je 0x14043adac
mov rax, qword [rcx]
movzx rdx, r11w
mov rdx, rdi
call qword [rax]
mov qword [rdi + 0x38], rax
jmp 0x14043adac
mov qword [r15 + 8], rdi
xor r14b, 0xfe
shrd si, r13w, 0xfe
mov rax, r15
or r15b, r9b
add rsp, 0x20
mov r14b, 0xa1
movzx bx, sil
movsx r14, r10w
pop rbx
pop rdi
movzx si, r10b
movzx r15, r8w
pop rsi
cmovg r15w, r12w
pop r14
mov r15w, 0x14d2
pop r15
jmp 0x14043ae49
ret
call fcn.1403c19cb
int3
Function at 0x14044a007
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044a010
movzx ecx, cx
jmp 0x14044a018
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
setae al
test r14, rax
add rsp, 0x28
jmp 0x14044a035
ret

Function at 0x14044b71a
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movsx eax, r15w
mov rcx, qword [rcx]
movzx rax, r12w
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jmp 0x14044b736
je 0x14044b770
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
and r9w, 0x6ef3
movsx r9w, bpl
mov dl, 3
add r9, r13
movsx r9, r10w
mov r9d, 0x2a
add rsp, 0x28
jmp 0x14044b76b
jmp fcn.1403b5675
nop
cmp r12w, 0x362b
add rsp, 0x28
jmp 0x14044b780
ret

Function at 0x14044c910
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r14
push rsi
btr esi, 0xe3
jmp 0x14044c922
push rdi
and si, sp
push rbp
xadd dil, al
push rbx
cmc
shl rax, 0x27
sar ax, cl
sub rsp, 0x60
movsx r14w, r13b
movaps xmmword [rsp + 0x50], xmm6
xchg al, dil
mov r14, r9
mov rbx, r8
mov rsi, r12
not rbp
mov rdi, rdx
cdq
movzx si, r14b
setb dl
mov rsi, rcx
movss xmm6, dword [rsp + 0xb0]
mov ax, 0x1eff
xchg ebp, ebp
movsx rdx, bx
movzx ebp, byte [rsp + 0xb8]
movsx dx, r9b
cdqe
bswap dx
mov qword [rsp + 0x38], 0
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov edx, edx
lea rdx, [rsp + 0x38]
call qword [rax + 0x50]
mov qword [rsp + 0x30], 0
xchg cx, cx
movsx edx, ax
rdtsc
mov rcx, qword [rsp + 0x38]
cqo
mov rax, qword [rcx]
movzx edx, r10w
lea rdx, [rsp + 0x30]
jmp 0x14044c9c8
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
setno ah
mov rdx, qword [rdi]
movsxd r8, ebp
movsx r8d, di
movsx r8, r13w
mov rax, qword [rcx]
mov r8d, 1
jmp 0x14044c9f2
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rdx, rdi
jmp 0x14044ca05
mov r8d, ebx
jmp 0x14044ca0d
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
movzx dx, spl
movzx edx, bpl
movzx eax, bp
xchg al, al
mov ax, 0x5903
mov rax, qword [rcx]
jmp 0x14044ca2f
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsi + 0x20]
cwd
movzx ax, bpl
movsx eax, r14w
movups xmm0, xmmword [r14]
rdtsc
not ah
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
jmp 0x14044ca66
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x18]
cwd
mov r8, qword [rsi + 0x20]
cwde
mov rdx, qword [rsp + 0x38]
movsxd rax, ecx
cwde
movzx eax, sp
mov rax, qword [rcx]
mov qword [rsp + 0x20], 0
jmp 0x14044ca91
movaps xmm3, xmm6
jmp 0x14044ca99
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x30]
movsx eax, bp
movzx rax, bx
not ax
mov rax, qword [rcx]
jmp 0x14044cab6
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
movzx rax, r11w
movsxd rax, r14d
jmp 0x14044caca
mov rax, qword [rcx]
jmp 0x14044cad2
call qword [rax + 0x10]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
movzx ebx, r8w
pop rbx
pop rbp
pop rdi
movzx si, r10b
seto r14b
pop rsi
pop r14
jmp 0x14044caf6
ret
Function at 0x14044e691
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
bts ax, cx
cmovae ax, r13w
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14044e7da
movsxd rcx, dword [0x14000003c]
btc edx, 0x4a
sub dl, 0xe0
lea rdx, [0x140000000]
add rcx, rdx
test eax, ecx
test r9w, 0x2647
cmp dword [rcx], 0x4550
jne 0x14044e7da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x14044e6ed
jne 0x14044e7da
sub r8, rdx
movzx edx, word [rcx + 0x14]
sar r9b, 0x3f
add rdx, 0x18
shrd r9w, sp, 0xd
xor ah, 0x29
lea rdx, [rdx + rcx]
rcr r9, cl
movsx eax, r10w
rcr r9d, 0xae
movzx eax, word [rcx + 6]
adc r9d, 0x4997623
lea rcx, [rax + rax*4]
btc r9d, 0x2b
btr r9w, 0xa2
shl r9, 0xa8
lea r9, [rdx + rcx*8]
jmp 0x14044e742
mov qword [rsp], rdx
stc
test r9b, 0x95
cmp rdx, r9
jmp 0x14044e753
je 0x14044e796
mov ecx, dword [rdx + 0xc]
test r12w, r10w
cmc
stc
cmp r8, rcx
jb 0x14044e788
mov eax, dword [rdx + 8]
cmp al, 0xd1
add eax, ecx
test sil, bl
jmp 0x14044e77a
cmp r8, rax
jmp 0x14044e782
jb 0x14044e79e
add rdx, 0x28
jmp 0x14044e791
jmp 0x14044e742
xor edx, edx
cmp si, 0x1cd1
clc
test rdx, rdx
jne 0x14044e7b3
sub al, al
jmp 0x14044e7ae
jmp 0x14044e7eb
cmp dword [rdx + 0x24], 0
jmp 0x14044e7bc
jge 0x14044e7ce
xor al, al
jmp 0x14044e7c9
jmp 0x14044e7eb
mov al, 1
jmp 0x14044e7d5
jmp 0x14044e7eb
xor al, al
jmp 0x14044e7e1
jmp 0x14044e7eb
add rsp, 0x18
jmp 0x14044e7f4
ret
Function at 0x14045fe57
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmovp rcx, r10
movzx rcx, bx
lea rcx, [rsp + 0x30]
jmp 0x14045fe6d
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
add rsp, 0x28
jmp 0x14045fe81
ret

Function at 0x14045ff31
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
or bl, 0xae
rcr bx, cl
cmovl ax, ax
push rbp
test r9d, 0x58f224a
mov rbp, rsp
sub rsp, 0x20
add ax, 0x1306
cdqe
mov rax, qword [0x1400b7288]
bts rbx, r8
shl bl, cl
movabs rbx, 0x2b992ddfa232
test dh, 0xe7
stc
test r10w, r11w
cmp rax, rbx
jne 0x14046004b
and qword [rbp + 0x18], 0
not ch
seto cl
movsx ecx, di
lea rcx, [rbp + 0x18]
jmp 0x14045ff93
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045ffa2
mov qword [rbp + 0x10], rax
jmp 0x14045ffab
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x14045ffbc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
sub ch, 0x35
shr ecx, 0xee
and cl, dh
lea rcx, [rbp + 0x20]
clc
xor qword [rbp + 0x10], rax
jmp 0x14045ffda
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
sal ch, 0x2c
lea rcx, [rbp + 0x10]
clc
shl rax, 0x20
xor rax, qword [rbp + 0x20]
test ch, 0xbb
jmp 0x14045fffb
xor rax, qword [rbp + 0x10]
sal bpl, cl
xor rax, rcx
bts rcx, r15
sub bp, r11w
bswap bp
movabs rcx, 0xffffffffffff
movsx ebp, r8w
and rax, rcx
clc
btr ebp, r12d
movabs rcx, 0x2b992ddfa233
bts ebp, ebx
cmp rax, rbx
bswap ebx
cmove rax, rcx
stc
bts ebp, r12d
mov qword [0x1400b7288], rax
cmc
or ebp, eax
mov rbx, qword [rsp + 0x48]
not rax
shl rbp, cl
xor bpl, cl
mov qword [0x1400b7280], rax
shld ebp, r12d, 0x1d
sal bpl, 0x4f
add rsp, 0x20
movsxd rbp, r11d
pop rbp
jmp 0x140460076
ret
Function at 0x140497972
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
shl bx, 0xcc
inc bl
mov qword [rax + 0x18], rsi
shld ebp, ecx, 0xd0
inc si
xor bp, 0x41b
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
ror esi, 8
mov rsi, r9
bts r14w, di
add r14b, 0x97
cmp ebx, ebx
mov r14, r8
test r14b, bpl
sbb bx, 0x5169
shl bp, cl
mov rbx, rdx
jmp 0x1404979c5
mov rbp, rcx
cmp rdx, r8
jmp 0x1404979d0
je 0x140497aa8
mov rdi, qword [r9 + 8]
stc
test rdi, rdi
jmp 0x1404979e3
je 0x140497a89
mov rax, qword [rdi + 0x40]
xor r8w, 0x4353
btr r8w, r13w
movzx r8d, word [rbx]
test al, r13b
cmp qword [rax], 0
jmp 0x140497a08
je 0x140497a3e
mov rax, qword [rdi + 0x58]
cmp dword [rax], 0
jmp 0x140497a1a
jle 0x140497a3e
dec dword [rax]
cwde
mov eax, r12d
mov rcx, qword [rdi + 0x40]
cdq
mov rdx, qword [rcx]
lea rax, [rdx + 2]
mov qword [rcx], rax
mov word [rdx], r8w
jmp 0x140497a6f
mov rax, qword [rdi]
setbe dh
movzx edx, r8w
movsx ecx, bp
mov ch, 0xf8
movzx rcx, bx
mov rcx, rdi
jmp 0x140497a5a
mov rax, qword [rax + 0x18]
jmp 0x140497a63
call qword [case.0x14044e461.0]
movzx r8d, ax
sal ah, cl
mov eax, 0xffff
test r12w, 0x9fd
cmp ax, r8w
jmp 0x140497a83
jne 0x140497a8f
mov byte [rsi], 1
test ch, 0x10
add rbx, 2
cmp r12b, cl
test r13b, 0x30
cmp rbx, r14
jmp 0x140497aa2
jne 0x1404979db
movups xmm0, xmmword [rsi]
shrd esi, ebx, 0x9e
rcl bh, 0xac
mov rbx, qword [rsp + 0x30]
sbb sil, r10b
setnp sil
xadd ax, si
mov rax, rbp
btr esi, 0x33
mov sil, r8b
btc r14d, 0xf1
mov rsi, qword [rsp + 0x40]
movzx r14d, r15w
mov rdi, qword [rsp + 0x48]
shr r14b, 0x67
inc r14d
movdqu xmmword [rbp], xmm0
add bpl, r13b
movsx r14, r8w
or r14b, 0xc3
mov rbp, qword [rsp + 0x38]
and r14b, 0x72
movzx r14d, dx
add rsp, 0x20
xchg r14b, r14b
pop r14
ret
Function at 0x1404a5efd
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test ah, 0x1e
cmp r10b, r14b
and dword [rsp + 0x30], 0
jmp 0x1404a5f11
call fcn.1404b02b3
mov r9d, 2
movsx cx, r14b
setle ch
lea r8, [rsp + 0x30]
movzx rdx, si
mov rcx, qword [rax + 0x28]
xchg dh, dl
movsx rdx, r13w
lea edx, [r9 + 0x20]
jmp 0x1404a5f40
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x1404a5f95
sub ecx, 1
jmp 0x1404a5f5c
je 0x1404a5f86
cmp ecx, 1
jmp 0x1404a5f6a
je 0x1404a5f7c
xor eax, eax
jmp 0x1404a5f77
jmp 0x1404a5f9a
mov eax, 3
jmp 0x1404a5f9a
mov eax, 1
jmp 0x1404a5f90
jmp 0x1404a5f9a
mov eax, 2
add rsp, 0x28
jmp 0x1404a5fa3
ret

Function at 0x1404b4b1e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
rcl bx, 0xf3
mov bx, 0x56d3
btr ebx, esp
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
movsx rbx, r10w
xor ebx, edx
test sil, 0xd5
push rdi
btr bx, 0x14
dec bl
sub rsp, 0x30
movsx bx, cl
xor ebp, ebp
bt bx, bp
bt bx, 0xfc
sal bh, cl
mov rbx, rcx
test r13w, si
cmp byte [rcx + 0x54], bpl
jmp 0x1404b4b6f
jne 0x1404b4c99
cmp dword [rcx + 0x50], ebp
jmp 0x1404b4b7d
jle 0x1404b4c99
mov rsi, qword [rcx + 0x48]
mov edi, ebp
bswap r9w
rdtsc
mov r9, qword [rbx + 8]
xchg cx, dx
cwde
lea rcx, [rsp + 0x40]
cmovno ax, ax
cwd
mov r8, r11
mov word [rsp + 0x40], bp
jmp 0x1404b4bb5
mov rdx, rsi
movzx rax, r11w
mov rax, qword [r9]
movsxd r8, dword [rax + 8]
call fcn.1404d640c
movsxd r8, eax
test eax, eax
jmp 0x1404b4bd2
jle 0x1404b4c90
mov rcx, qword [rbx + 0x468]
cmovo rax, r11
rcl eax, 0x7f
movzx edx, word [rsp + 0x40]
movzx ax, sil
cwde
movzx eax, cx
mov rax, qword [rcx + 8]
cmp qword [rcx + 0x10], rax
jmp 0x1404b4c01
jne 0x1404b4c31
cmp byte [rcx + 0x18], bpl
jmp 0x1404b4c10
je 0x1404b4c23
inc dword [rbx + 0x28]
jmp 0x1404b4c1e
jmp 0x1404b4c6d
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b4c2c
jmp 0x1404b4c6d
inc dword [rbx + 0x28]
inc qword [rcx + 0x10]
sbb ax, cx
shl ah, cl
movsx rax, r13w
mov rax, qword [rbx + 0x468]
movsx rcx, r15w
bts rcx, rsp
mov rcx, qword [rax]
lahf
mov word [rcx], dx
cwde
mov rax, qword [rbx + 0x468]
jmp 0x1404b4c65
add qword [rax], 2
cmp bpl, 0x13
add rsi, r8
jmp 0x1404b4c75
inc edi
clc
stc
test dil, 0xc2
cmp edi, dword [rbx + 0x50]
jmp 0x1404b4c85
jne 0x1404b4b8f
jmp 0x1404b4cd1
or dword [rbx + 0x28], 0xffffffff
jmp 0x1404b4cd1
mov r8d, dword [rbx + 0x50]
lea rax, [rcx + 0x10]
xchg edx, edx
ror r9w, cl
rcl r9b, cl
mov rdx, qword [rbx + 0x48]
movsx r9d, r14w
lea r9, [rcx + 0x28]
jmp 0x1404b4cbb
add rcx, 0x468
jmp 0x1404b4cc7
mov qword [rsp + 0x20], rax
call fcn.1404b2fcc
mov rbx, qword [rsp + 0x48]
adc dil, bl
mov al, 1
mov rbp, qword [rsp + 0x50]
btr rsi, r14
adc dil, r9b
bsr si, si
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
movzx di, dl
movsx rdi, r11w
pop rdi
ret
Function at 0x1404b55bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x1404b56d5
mov qword [rsp + 8], rbx
movsxd rax, ecx
ror r10w, cl
xor r10, r11
mov qword [rsp + 0x10], rdi
rcr dil, cl
mov r10d, dword [r9]
mov dil, dl
shrd bx, r13w, 0x31
movzx rdx, si
mov rbx, rcx
cqo
sar dh, cl
sub r11d, r11d
sets dh
movsxd rax, r13d
movzx eax, ax
mov rdx, qword [rbx]
mov rax, qword [rdx + 8]
cmp qword [rdx + 0x10], rax
jmp 0x1404b560f
jne 0x1404b5642
cmp byte [rdx + 0x18], 0
jmp 0x1404b561e
je 0x1404b562c
inc r10d
jmp 0x1404b5635
or r10d, 0xffffffff
jmp 0x1404b5635
mov dword [r9], r10d
jmp 0x1404b563d
jmp 0x1404b56a9
lea eax, [r10 + 1]
mov dword [r9], eax
mov r10, 0x39cb743e
jmp 0x1404b5659
mov rax, qword [rbx]
movzx r10, r13w
movsx r10w, r10b
cmovbe cx, r12w
inc qword [rax + 0x10]
mov rax, qword [rbx]
mov rcx, qword [rax]
movzx r10d, dx
bswap rax
mov byte [rcx], dil
bswap r10w
mov ah, 0x8a
inc r10b
mov rax, qword [rbx]
movsx r10, r11w
not r10d
inc qword [rax]
and r10, 0x7f7f369c
rcl r10d, 0x38
mov r10d, dword [r9]
clc
jmp 0x1404b56a9
cmp r10d, 0xffffffff
je 0x1404b56c4
inc r11d
cmp r11d, r8d
jmp 0x1404b56be
jl 0x1404b55ff
mov rbx, qword [rsp + 8]
bswap edi
mov rdi, qword [rsp + 0x10]
jmp 0x1404b56d5
ret

Function at 0x1404b67bc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
btr esi, 0x29
movzx rsi, r14w
sub rsp, 0x30
sub edi, ebx
mov edi, edx
cmp spl, r14b
shr sil, 0x7d
mov rsi, rcx
stc
test r8, r8
jne 0x1404b680c
call fcn.1404bb09a
mov dword [rax], 0x16
jmp 0x1404b67fb
call fcn.1404bbde4
xor eax, eax
jmp 0x1404b6807
jmp 0x1404b68f9
mov rdx, r9
mov rcx, r8
jmp 0x1404b6817
call fcn.1404b6968
mov rbx, rax
stc
cmp r14b, al
test rax, rax
jmp 0x1404b682b
je 0x1404b68a7
lea rax, [rsp + 0x50]
setb ch
cwd
mov rdx, rdi
movsx r8, sp
movsx r9w, sil
movsxd r8, r13d
mov qword [rsp + 0x28], rax
cbw
mov ax, di
lea r8, [0x140094b24]
movsx r9w, dil
cdqe
movsx rcx, r10w
mov eax, dword [rsp + 0x60]
mov r9, rbx
movzx cx, r13b
mov rcx, rsi
jmp 0x1404b687a
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jmp 0x1404b688f
jne 0x1404b6924
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1404b68a2
call fcn.1404bb115
sub edi, edi
test rbx, rbx
jmp 0x1404b68b1
je 0x1404b68ea
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1404b68ca
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1404b68dd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
jmp 0x1404b68e5
call fcn.1404cf14b
mov rax, rdi
movsx di, r15b
setnp bl
rcr si, 0x4c
mov rbx, qword [rsp + 0x40]
jmp 0x1404b6903
mov rsi, qword [rsp + 0x48]
rol dil, cl
stc
shrd di, bp, 0x39
add rsp, 0x30
cmovns di, r15w
jmp 0x1404b6922
pop rdi
ret
mov rcx, qword [rsp + 0x68]
cmp ch, 0x22
test rcx, rcx
jmp 0x1404b6934
je 0x1404b6952
mov eax, dword [rsp + 0x50]
cmp di, r14w
clc
cmp ebp, 0x5ee6536a
mov dword [rcx], eax
cmp r8d, 0x2dd708c8
sub ebx, ebx
jmp 0x1404b68a9
Function at 0x1404b6be2
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
xchg bl, bh
movzx bx, r11b
mov ebx, ecx
jmp 0x1404b6bf6
call fcn.1404d865b
cmp eax, 1
jmp 0x1404b6c03
je 0x1404b6c48
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
stc
shr edx, 8
test dl, 1
jmp 0x1404b6c24
jne 0x1404b6c48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsxd rdx, esi
mov dh, cl
movzx edx, bp
mov edx, ebx
jmp 0x1404b6c42
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x1404b6c4f
call fcn.1404b6b3a
mov ecx, ebx
jmp 0x1404b6c5b
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1404bbe6a
Capabilities:
Terminate process

Disassembly:
invalid
invalid
xchg rdi, rax
and eax, 0xe308a018
div ebp
mov ecx, 0x4a0b731b
sbb esi, dword [rbx + 0xb]
invalid
invalid
sbb esi, dword [rbx + 0xb]
invalid
popfq
mov edx, 0xb7e930f
fdiv dword [rcx + 0x6b2766fd]
leave
in eax, 0xa8
test al, 0x4a
mov edx, 0x41add06
add byte [rax], al
add byte [rcx - 0x5c1822b8], al
push rbx
jb 0x140177747
fidiv word [rsp + rdi*8 - 0x2c45f562]
sar dword [rdx - 0x25], 0x60
test al, 0x4a
mov edx, 0x41add06
add byte [rax], al
add byte [rcx - 0x5c1822b8], al
push rbx
jb 0x140177747
fidiv word [rsp + rdi*8 - 0x2c45f562]
sar dword [rdx - 0x25], 0x60
pop rbx
ret 0xb297
invalid
wait
mov bl, 0xc9
adc edi, eax
xlatb
hlt
insb byte [rdi], dx
movabs eax, dword [0x7f5571ffa45d1a41]
retfq 0xffffffffffffc045
xchg dword [rsi], esi
fld qword [rdi*4 - 0x73540680]
jno 0x1401777b0
ficomp word [rdx - 0x64027f5e]
push rcx
mov edx, 0x14ac40b9
invalid
movabs byte [0xac40b9ba519bfd80], al
adc al, 0xf3
invalid
sub rsp, 0x28
jmp 0x1404bbe77
mov ecx, 0x17
jmp 0x1404bbe81
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1404bbea0
mov ecx, 5
jmp 0x1404bbe99
int 0x29
jmp 0x1404bbea0
mov r8d, 1
movsx cx, dil
movsxd rcx, eax
cwd
mov edx, 0xc0000417
mov ch, 0x5b
lea ecx, [r8 + 1]
jmp 0x1404bbec1
call fcn.1404bbeec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
btr dx, r10w
mov edx, 0xc0000417
cmp r14b, al
add rsp, 0x28
jmp switch.0x1404bbee5
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1404bd6d7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
stc
sbb rcx, rsp
cmp bl, spl
mov qword [rsp + 0x20], r9
xchg cl, cl
shld cx, r9w, 0x15
push rsi
xadd sil, cl
add si, r14w
inc esi
push rdi
push r14
sub sil, 0x6a
rol sil, 0xb
sub rsp, 0x60
cmova di, si
setnp ch
mov rsi, r9
mov rdi, r8
mov ecx, dword [rdx]
jmp 0x1404bd71e
call fcn.140118a4e
nop
mov rbx, qword [0x1400ba160]
xor r14w, 0x6833
sbb r14w, r8w
bswap ax
movsxd rax, dword [0x1400ba158]
not r14w
lea r14, [rbx + rax*8]
stc
mov qword [rsp + 0x38], rbx
test cx, r12w
jmp 0x1404bd756
cmp rbx, r14
je 0x1404bd888
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
movzx rdx, ax
dec dh
mov rdx, qword [rdi]
test dil, 0x14
cmp cl, sil
test rax, rax
jmp 0x1404bd77f
je 0x1404bd7e9
mov ecx, dword [rax + 0x14]
mov rax, r10
add ax, r14w
mov eax, ecx
cmc
test bpl, spl
shr eax, 0xd
test al, 1
jmp 0x1404bd79f
je 0x1404bd7e9
mov eax, ecx
cmp r15w, dx
jmp 0x1404bd7b0
and al, 3
test ch, 0xf
cmp al, 2
jmp 0x1404bd7bc
jne 0x1404bd7d0
test cl, 0xc0
jmp 0x1404bd7ca
jne 0x1404bd7f2
bt ecx, 0xb
jmp 0x1404bd7d9
jb 0x1404bd7f2
inc dword [rdx]
cmp r9b, r12b
test r12w, r13w
stc
add rbx, 8
jmp 0x1404bd748
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
movsx r9, cx
movsx r9d, r13w
movzx r9, bx
mov qword [rsp + 0x40], r8
jmp 0x1404bd822
mov qword [rsp + 0x48], rax
movzx r9, r11w
jmp 0x1404bd830
mov qword [rsp + 0x50], rcx
jmp 0x1404bd83a
mov qword [rsp + 0x58], rdx
not dh
mov rax, qword [rsp + 0x20]
movsxd rcx, ebp
mov qword [rsp + 0x28], rax
setg r9b
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x40]
movzx rdx, r13w
jmp 0x1404bd86c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x88]
jmp 0x1404bd87e
call fcn.1404bd561
jmp 0x1404bd7e9
mov ecx, dword [rsi]
jmp 0x1404bd88f
call fcn.1401bed48
mov rbx, qword [rsp + 0x80]
movsxd r14, esi
add rsp, 0x60
pop r14
movsx rsi, di
pop rdi
pop rsi
jmp 0x1404bd8b0
ret