joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023cce0
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x14023154c
mov ecx, dword [rax + 8]
clc
add ecx, edx
test r8d, ebp
cmp r10, rcx
jmp 0x140231546
cmp r9d, r11d
jb 0x1402190b0
sub eax, eax
jmp 0x14027d558
je 0x14020666c
mov edx, dword [rax + 0xc]
cmp bl, 0xe6
cmp r10, rdx
jmp 0x1400e781f
jb 0x14027d558
inc r9d
add rax, 0x28
stc
jmp 0x140206663
movsxd r8, dword [rcx + 0x3c]
bts r10d, esi
and r10d, ecx
xor r9d, r9d
bts r11w, r8w
bsr r11w, r9w
lea r8, [r8 + rcx]
not r11b
sar r10w, cl
mov r10, rdx
rcr rax, cl
neg r11w
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
test dil, bl
cmp r12d, r11d
add rax, 0x18
cmp cl, 0x3c
add rax, r8
cmc
test r11d, r11d
jmp 0x1402190aa
ret

Function at 0x14025ac24
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b54b7
sub edx, edx
ror r8d, 0x4c
bsr r8w, ax
sub ecx, ecx
not r8w
lea r8d, [rdx + 1]
jmp 0x1401f2be0

Function at 0x14027bd2a
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
cmp cx, 0x8bc
sub edx, edx
jmp 0x14028302c
jmp 0x1404b54b7

Function at 0x14027e670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp fcn.1404c7e27
mov r8, qword [rdx]
jmp 0x1401b4d64

Function at 0x140289af2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x140212602
xor eax, eax
jmp 0x14020e3e7
jne 0x1401ff689
test r9d, r9d
je 0x1401ff689
sub r8, 1
jmp 0x1401ff683
cmova ecx, edx
stc
test rbx, rsi
sub eax, ecx
jmp 0x140104b5f
jne 0x140212602
ret
ret
movzx ecx, word [r10]
cdq
lea r10, [r10 + 2]
btc r9, 0x12
movzx edx, word [r11]
xor ax, sp
movzx eax, r13w
lea r11, [r11 + 2]
sal r9w, 0x80
sar al, cl
shr r9w, cl
lea eax, [rcx - 0x41]
dec r9b
clc
cmp eax, 0x19
movsx r9d, si
lea r9d, [rcx + 0x20]
lea eax, [rdx - 0x41]
cmova r9d, ecx
clc
bsr rcx, r11
cmp eax, 0x19
movzx rax, r14w
lea ecx, [rdx + 0x20]
mov rax, r11
movsx rax, r9w
mov eax, r9d
jmp 0x1401d9bd3
mov r11, rdx
shrd r10d, edi, 0x9b
movzx r10, dx
mov r10, rcx
stc
cmc
test r10d, r12d
test r8, r8
jmp 0x1400e79c0

Function at 0x1402940d8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jge 0x14021d9a3
sub eax, eax
jmp 0x140267d24
js 0x1400e83f2
mov r9d, edx
cmp r10, 0x2df51a9b
test r11b, 0xe7
test edx, edx
jmp 0x1401f4fd0
jmp fcn.140263850
je 0x140268ec7
mov eax, 0x7fffffff
test r8w, r9w
cmp ax, bx
sub edx, edx
test r14b, 0x7b
jmp 0x14027d4bf
add r9d, r8d
movzx ecx, r11w
movzx cx, r15b
movsxd rcx, r9d
jmp 0x1401f2f34
ret
jl 0x1400e83f2
imul r9d, ecx
mov eax, r8d
xor eax, 0x7fffffff
cmp eax, r9d
jmp 0x1400e83ec
idiv r9d
cmp eax, ecx
jmp 0x140268ec1
mov eax, edx
cmp r14b, r15b
or eax, ecx
jmp 0x1401216e2
Function at 0x1403c590a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
rcl al, 0x1d
push rbx
sub rsp, 0x20
mov rsi, rcx
bt ax, 0x94
xor al, 0xb1
sbb al, r11b
lea rax, [0x1400bdab0]
stc
mov qword [rcx], rax
or al, cl
sal eax, cl
sar ah, 0xae
mov rax, qword [rcx + 0x88]
cmp r10, 0x66d17eb8
stc
cmp rax, 8
jmp 0x1403c594b
jb 0x1403c59b2
mov rcx, qword [rsi + 0x70]
lea rdx, [rax + rax]
test ah, 0xb5
add rdx, 2
stc
cmp rdx, 0x1000
jmp 0x1403c596d
jb 0x1403c59ad
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp dl, r12b
sub rcx, rbx
cmc
clc
cmp rcx, 0x20
jmp 0x1403c598c
jae 0x1403c5b1a
lea rax, [rax + rax]
sal rcx, 0x54
add rax, 0x29
mov rdx, rax
movzx rcx, sp
mov rcx, rbx
jmp 0x1403c59ad
call fcn.14028ce60
movaps xmm0, xmmword [0x1400bd3f0]
rol di, cl
cbw
bts ebx, r8d
movups xmmword [rsi + 0x80], xmm0
bts edi, edx
btc eax, r15d
mov word [rsi + 0x70], 0
xadd dil, al
and al, r13b
lea rax, [0x1400bdb70]
mov rdi, 0x1bf457a5
mov qword [rsi], rax
movzx bx, r10b
mov rdi, qword [rsi + 0x40]
xor bx, 0x1f13
mov rbx, qword [rsi + 0x48]
cmp rdi, rbx
jmp 0x1403c5a08
jne 0x1403c5a25
jmp 0x1403c5a7b
add rdi, 8
cmp rdi, rbx
jmp 0x1403c5a1f
je 0x1403c5a65
mov rcx, qword [rdi]
jmp 0x1403c5a34
test rcx, rcx
jmp 0x1403c5a3c
je 0x1403c5a13
mov rax, qword [rcx]
movzx dx, r10b
movsx rdx, r8w
mov dl, 6
mov edx, 1
jmp 0x1403c5a5a
call qword [rax + 0xb8]
jmp 0x1403c5a13
mov rdi, qword [rsi + 0x40]
cmp spl, cl
cmc
cmp rdi, qword [rsi + 0x48]
je 0x1403c5a7b
mov qword [rsi + 0x48], rdi
test rdi, rdi
jmp 0x1403c5a83
je 0x1403c5afd
mov rdx, qword [rsi + 0x50]
clc
test r8b, cl
cmc
sub rdx, rdi
cmp rdx, 0x1000
jb 0x1403c5acd
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
stc
cmp al, 0x25
sub rdi, rax
test r8, r12
cmp rdi, 0x20
jmp 0x1403c5abc
jae 0x1403c5b1a
add rdx, 0x27
movzx rdi, r8w
mov rdi, rax
add rsi, 0x40
jmp 0x1403c5adc
mov rcx, rdi
call fcn.14028ce60
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
ror edi, 0xf7
mov qword [rsi + 0x10], 0
shrd di, dx, 0xd4
add bl, r9b
add rsp, 0x20
movsxd rbx, r9d
movzx esi, r8w
pop rbx
bswap si
pop rdi
movsx si, dl
mov sil, 0x1f
movzx rsi, bp
pop rsi
ret
call fcn.1404ba5a5
int3
Function at 0x1403c8da6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
sub sil, 0x15
add sil, r8b
rcr sil, cl
sub rsp, 0x50
not sil
movzx rsi, r14w
mov si, 0x1b32
movaps xmmword [rsp + 0x40], xmm6
mov rsi, rcx
jmp 0x1403c8dce
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
jmp 0x1403c8ddb
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 7
jmp 0x1403c8df2
call fcn.14020e3e8
movups xmmword [rsi + 0x40], xmm6
rdtsc
cwd
movsxd rcx, r13d
mov qword [rsi + 0x50], 0
movsxd rax, eax
rdtsc
movsx cx, r10b
lea rax, [0x1400be020]
mov ecx, ebx
mov qword [rsi], rax
movsx edx, r12w
xchg edx, ecx
setb cl
movups xmmword [rsi + 0x58], xmm6
cwd
bswap edx
mov qword [rsi + 0x68], 0
mov qword [rsi + 0x70], 7
movzx edx, r9w
mov qword [rsi + 0x78], 0
movzx edx, r14w
lea rdx, [rsp + 0x20]
movzx rcx, r13w
movsx cx, r14b
mov ecx, edx
mov rcx, rsi
jmp 0x1403c8e69
call fcn.1403c9e0d
mov rax, qword [rsp + 0x38]
cmp rax, 8
jmp 0x1403c8e7c
jb 0x1403c8f00
mov rcx, qword [rsp + 0x20]
cqo
bsr edx, r12d
movzx dx, r14b
lea rdx, [rax + rax]
add rdx, 2
test r9, r8
cmp r12b, dil
cmp rdx, 0x1000
jmp 0x1403c8eac
jb 0x1403c8efb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp si, 0x5f82
test r9d, ecx
clc
sub rcx, r8
test r8b, al
stc
cmp rcx, 0x20
jmp 0x1403c8ed3
jae 0x1403c8f37
add rax, rax
cqo
shrd cx, bp, 9
sal edx, 0x8a
add rax, 0x29
cdq
mov rdx, rax
bswap ecx
movsx ecx, di
mov rcx, r8
jmp 0x1403c8efb
call fcn.14028ce60
lea rax, [0x1400be020]
cmc
stc
mov qword [rsi], rax
sal ah, 0xfe
movzx eax, r13w
mov rax, rsi
test r10b, dl
movaps xmm6, xmmword [rsp + 0x40]
movzx esi, bx
add rsp, 0x50
mov sil, r15b
movsxd rsi, edi
movsx si, r15b
pop rsi
jmp 0x1403c8f36
ret
call fcn.1404ba5a5
int3
Function at 0x1403d693e
Capabilities:
Check for software breakpoints

Disassembly:
push rsi
push rdi
sub al, spl
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx eax, bp
cmp bh, 0x8e
xor al, r15b
lea rax, [0x1400be340]
jmp 0x1403d6965
mov qword [rcx], rax
jmp 0x1403d6971
mov rcx, qword [rcx + 0x90]
cmp cl, 0xb2
test rcx, rcx
jmp 0x1403d6983
je 0x1403d69a1
mov rax, qword [rcx]
jmp 0x1403d6991
call qword [rax + 0x10]
mov qword [rsi + 0x90], 0
sar cl, cl
mov rcx, qword [rsi + 0x88]
test dl, 2
cmp cl, 0x22
test rcx, rcx
jmp 0x1403d69b6
je 0x1403d69d2
mov rax, qword [rcx]
jmp 0x1403d69c4
call qword [rax + 0x10]
mov qword [rsi + 0x88], 0
mov rcx, qword [rsi + 0x80]
test rcx, rcx
jmp 0x1403d69e1
je 0x1403d6a04
mov rax, qword [rcx]
jmp 0x1403d69ef
call qword [rax + 0x10]
mov qword [rsi + 0x80], 0
sar dil, 0x17
shr rax, cl
lea rax, [0x1400bdb70]
or bh, 0xda
xor bx, sp
mov qword [rsi], rax
mov rdi, qword [rsi + 0x40]
ror bl, cl
mov rbx, qword [rsi + 0x48]
cmp rdi, rbx
jmp 0x1403d6a26
jne 0x1403d6a43
jmp 0x1403d6a99
add rdi, 8
cmp rdi, rbx
jmp 0x1403d6a3d
je 0x1403d6a80
mov rcx, qword [rdi]
cmp r13b, 0xcc
cmc
test bpl, 0xf
test rcx, rcx
jmp 0x1403d6a57
je 0x1403d6a31
mov rax, qword [rcx]
cmovl dx, ax
movzx edx, r10w
not dx
mov edx, 1
jmp 0x1403d6a75
call qword [rax + 0xb8]
jmp 0x1403d6a31
mov rdi, qword [rsi + 0x40]
test r14b, r8b
cmp r13b, r12b
cmp rdi, qword [rsi + 0x48]
je 0x1403d6a99
mov qword [rsi + 0x48], rdi
cmc
test rdi, rdi
je 0x1403d6b22
mov rdx, qword [rsi + 0x50]
jmp 0x1403d6aab
sub rdx, rdi
jmp 0x1403d6ab3
cmp rdx, 0x1000
jmp 0x1403d6abf
jb 0x1403d6afc
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
jmp 0x1403d6ad9
sub rdi, rax
clc
stc
cmp al, r9b
cmp rdi, 0x20
jae 0x1403d6b33
add rdx, 0x27
cmc
bt rcx, 0x9c
mov rdi, rax
btc rcx, r10
add rsi, 0x40
mov rcx, rdi
jmp 0x1403d6b08
call fcn.14028ce60
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
sets bh
rol dil, 0x31
mov qword [rsi + 0x10], 0
add rsp, 0x20
pop rbx
movzx rsi, r13w
pop rdi
pop rsi
jmp 0x1403d6b32
ret
call fcn.1404ba5a5
int3
Function at 0x1403e98f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sar r15b, cl
push r14
adc r15b, 0x60
push r13
sar r15, 0x41
push r12
movsx r13, si
rcl r15b, 0x8a
push rsi
xor r12, rax
push rdi
add r13w, bx
mov r12w, r12w
push rbp
and r14b, 0x5c
cmovo r12d, r12d
sal r14, cl
push rbx
btr r12d, 0x86
and r12w, bx
or r15b, dl
sub rsp, 0x38
xadd r14w, bx
or r14b, 0x73
sbb r13, 0xeda5627
movaps xmmword [rsp + 0x20], xmm6
and bx, 0x2ca5
jmp 0x1403e9955
mov r14, r9
xchg r12w, r12w
mov r15, r8
movzx bx, ah
bt ebx, 0x38
movsx r12, r15w
mov r12, rdx
stc
bsf ebx, ebx
sar r13, 0xba
mov r13, rcx
mov rbx, qword [rcx]
test rbx, rbx
jmp 0x1403e9984
je 0x1403e9aef
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403e9996
je 0x1403e9a7e
lea rbp, [0x1400bed30]
jmp 0x1403e99a8
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e99b4
jmp 0x1403e99dd
call fcn.14028ce60
movups xmmword [rbx + 0x20], xmm6
test r10b, dl
mov byte [rbx + 0x10], 0
stc
cmp r13d, ebp
add rbx, 0x38
cmp r15b, r12b
cmp rbx, rdi
je 0x1403e9a7a
mov qword [rbx], rbp
and al, 0x43
cmovge eax, r13d
mov rax, qword [rbx + 0x28]
cmp r13b, 5
test r13w, sp
cmp rax, 0x10
jmp 0x1403e99fb
jb 0x1403e99be
mov rcx, qword [rbx + 0x10]
and rdx, 0x5de05908
ror dh, cl
cmp spl, r10b
lea rdx, [rax + 1]
test r15b, 0xa3
cmp rdx, 0x1000
jmp 0x1403e9a25
jb 0x1403e99b9
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmc
jmp 0x1403e9a39
sub rcx, rsi
cmp r15w, 0x218d
test cx, 0x17c9
test bl, r13b
cmp rcx, 0x20
jmp 0x1403e9a53
jae 0x1403e9b9e
add rax, 0x28
movsxd rdx, r11d
bswap cx
movsx rdx, sp
mov rdx, rax
movzx ecx, si
mov rcx, rsi
jmp 0x1403e9a75
jmp 0x1403e99b9
mov rbx, qword [r13]
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403e9a91
jb 0x1403e9ae2
mov rax, qword [rbx - 8]
cmp al, 0xc0
jmp 0x1403e9aa5
add rbx, 0xfffffffffffffff8
cmc
test spl, 0xfb
sub rbx, rax
test r15b, 0xc1
clc
cmp rbx, 0x20
jmp 0x1403e9abf
jae 0x1403e9b9e
add rdx, 0x27
jmp 0x1403e9ad4
mov rbx, rax
mov ecx, 0x544414fd
movzx ecx, dx
movsxd rcx, ebp
mov rcx, rbx
jmp 0x1403e9aea
call fcn.14028ce60
mov qword [r13], r12
setl dil
and bx, si
imul rax, r15, 0x38
add rax, r12
mov r15b, 0x6e
mov rdi, r9
mov qword [r13 + 8], rax
cdqe
test dl, r15b
add bl, r10b
imul rax, r14, 0x38
shr bpl, 0x79
ror r14d, cl
rcl dil, cl
add rax, r12
btr r12d, 0xf6
btc di, bx
mov qword [r13 + 0x10], rax
shld ebp, edx, 0x35
shl r15b, 0x7c
rcl r13b, cl
movaps xmm6, xmmword [rsp + 0x20]
mov r13, 0x44183c2a
add rsp, 0x38
mov r13b, r11b
cmova rbx, r12
movzx r14, cx
pop rbx
movzx r12w, sil
movzx rsi, ax
movsxd r15, esi
pop rbp
pop rdi
movsx r13, si
mov r13w, 0x2203
movsx r15d, bx
pop rsi
setp r12b
jmp 0x1403e9b80
pop r12
movsxd r13, r14d
pop r13
xchg r14w, r15w
jmp 0x1403e9b94
pop r14
movsx r15w, r8b
pop r15
ret
call fcn.1404ba5a5
int3
Function at 0x1403f85c1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
xor r15w, r12w
sub r15b, bl
bts r15w, ax
push r14
movsx r14, bx
push r13
test cx, 0x6628
sal r15b, cl
btc r14d, 0x6e
push r12
push rsi
neg r15
shl r12b, cl
test dx, 0x4d6c
push rdi
add sil, r11b
xor r14w, 0x73eb
push rbx
and r14b, 0xa9
sub rsp, 0x30
sbb r15w, 0x6a60
neg r15b
sub r13b, r12b
movaps xmmword [rsp + 0x20], xmm6
movzx r12, r13w
movzx r15d, di
xchg r12b, r14b
mov r15, r9
mov sil, r13b
movsx r13w, r8b
btc r13d, 0x9b
mov r12, r8
test rdi, rsi
xchg r14, r13
mov r14, rdx
cmp cl, sil
sal esi, cl
sar r13d, 0xa8
mov r13, rcx
bsr si, r10w
adc sil, spl
mov rsi, qword [rcx]
test r10w, 0x2b91
test rsi, rsi
je 0x1403f8770
mov rbx, qword [r13 + 8]
cmp rsi, rbx
jmp 0x1403f866f
je 0x1403f871d
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f8681
jmp 0x1403f86a5
call fcn.14028ce60
movups xmmword [rsi + 0x10], xmm6
mov byte [rsi], 0
cmc
clc
add rsi, 0x20
cmp spl, 0xf
cmp rsi, rbx
je 0x1403f870e
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jmp 0x1403f86b2
jb 0x1403f868b
mov rcx, qword [rsi]
add dh, 0xa8
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403f86ce
jb 0x1403f8686
mov rdi, qword [rcx - 8]
jmp 0x1403f86dd
add rcx, 0xfffffffffffffff8
clc
sub rcx, rdi
clc
cmp rcx, 0x20
jmp 0x1403f86ef
jae 0x1403f87dd
add rax, 0x28
mov rdx, rax
cmovbe cx, r14w
mov rcx, rdi
jmp 0x1403f8709
jmp 0x1403f8686
mov rsi, qword [r13]
cmp esi, 0x157b098b
cmovnp dx, r10w
mov rdx, qword [r13 + 0x10]
sub rdx, rsi
stc
cmp rdx, 0x1000
jmp 0x1403f8731
jb 0x1403f8763
mov rax, qword [rsi - 8]
cmp al, 0x16
clc
add rsi, 0xfffffffffffffff8
sub rsi, rax
test sil, bpl
cmp rsi, 0x20
jmp 0x1403f8751
jae 0x1403f87dd
add rdx, 0x27
mov esi, r8d
xchg ch, cl
mov rsi, rax
mov rcx, rsi
jmp 0x1403f876b
call fcn.14028ce60
mov qword [r13], r14
shl r12, 5
lea r12, [r12 + r14]
bts esi, ecx
mov qword [r13 + 8], r12
dec bh
mov di, 0x3cd6
shl r15, 5
add r15, r14
btc edi, 0x87
clc
shr bl, 0xbb
mov qword [r13 + 0x10], r15
sub r15, 0x445d0db0
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
movzx r15w, dil
pop rbx
not r14b
movsxd r14, r11d
pop rdi
cmovle si, sp
mov si, ax
pop rsi
pop r12
movzx r15d, r15w
pop r13
movzx r15w, bpl
pop r14
movzx r15w, r14b
pop r15
jmp 0x1403f87dc
ret
call fcn.1404ba5a5
int3
Function at 0x1404269bd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
xadd r10b, r10b
mov r10, qword [rcx]
xor sil, r11b
btc r9w, si
mov rsi, qword [rcx + 0x18]
rcl r9w, 0xc9
bts r9d, eax
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
stc
cmp spl, r15b
cmp r8d, 2
jne 0x140426b56
test r9d, r9d
jmp 0x1404269f8
je 0x140426bee
lea ecx, [r9 - 1]
jmp 0x140426a07
cmp ecx, 3
jb 0x140426af1
mov r11d, r9d
shl r8b, 0xd3
btc r8w, r12w
and r8b, 4
and r11d, 0xfffffffc
bsf r8, r8
nop word cs:[rax + rax]
adc r8b, 0x4d
movzx r8d, word [rsi]
sar r10b, 0x22
movzx r10d, word [rsi + 4]
cmp bpl, 8
xor ecx, ecx
rol cl, 0x4d
cmp r8w, word [rdx]
movsx r8w, cl
setne cl
neg ecx
mov word [rsi + 2], cx
xor ecx, ecx
bsr r8w, cx
dec r8b
cmp r10w, word [rdx]
mov r8w, 0x5f9f
xchg r8d, r8d
setne cl
bts r8, rax
neg ecx
mov word [rsi + 6], cx
movzx r8d, word [rsi + 8]
cmc
stc
sub ecx, ecx
or cl, bl
sar cl, cl
cmp r8w, word [rdx]
setne cl
neg ecx
shl r8d, cl
movsxd r8, r14d
rol r8b, 0xbb
mov word [rsi + 0xa], cx
or r8d, 0x7abe5274
shld r8w, bx, 0x44
shl r8b, cl
movzx r8d, word [rsi + 0xc]
jmp 0x140426ac2
sub ecx, ecx
rol cl, 0xbb
cmp r8w, word [rdx]
mov cl, 0x6c
setne cl
cmp r8, rax
neg ecx
mov word [rsi + 0xe], cx
stc
add rsi, 0x10
test r11w, sp
add r11d, 0xfffffffc
jmp 0x140426aeb
jne 0x140426a39
test r9b, 3
jmp 0x140426afa
je 0x140426bee
and r9d, 3
xor ecx, ecx
nop word cs:[rax + rax]
xchg r8w, r8w
shl r8, cl
bts r8, r10
movzx r8d, word [rsi + rcx*4]
cmp r14b, r15b
xor eax, eax
mov al, al
cmp r8w, word [rdx]
setne al
neg eax
jmp 0x140426b36
mov word [rsi + rcx*4 + 2], ax
jmp 0x140426b40
inc rcx
cmp r9d, ecx
jmp 0x140426b4b
jne 0x140426b1c
jmp 0x140426bee
test r9d, r9d
je 0x140426bee
movzx r10d, word [rdx]
add r8b, dil
xadd r8d, r8d
stc
mov r8d, r9d
clc
test spl, 0x1a
test r10b, r14b
xor ecx, ecx
jmp 0x140426b93
inc rcx
jmp 0x140426b85
cmp r8d, ecx
jmp 0x140426b8d
je 0x140426bee
cmp word [rsi + rcx*8], r10w
jmp 0x140426b9d
jne 0x140426b7d
movzx eax, word [rsi + rcx*8 + 2]
test bx, dx
cmp ax, word [rdx + 2]
jmp 0x140426bb4
jne 0x140426b7d
movzx eax, word [rsi + rcx*8 + 4]
test r14w, di
cmp ax, word [rdx + 4]
jmp 0x140426bcc
jne 0x140426b7d
mov word [rsi + rcx*8 + 6], 0
movsxd r10, r14d
setl r10b
movzx r10d, word [rdx]
jmp 0x140426be9
jmp 0x140426b7d
pop rsi
jmp 0x140426bf4
ret
Function at 0x14044333c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
ror al, cl
rcl ah, 0x77
shr al, 0x79
push rsi
bt ax, r9w
push rdi
sal si, cl
push rbp
push rbx
cdqe
sub rsp, 0x78
lahf
movzx rax, r10w
jmp 0x140443364
movaps xmmword [rsp + 0x60], xmm8
movzx eax, r8w
not sil
movaps xmmword [rsp + 0x50], xmm7
cbw
cmovo si, di
movaps xmmword [rsp + 0x40], xmm6
movsx rsi, si
mov rax, qword [rcx]
movzx esi, r9w
mov esi, dword [rax + 0x10]
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
test ebx, esp
clc
test esi, esi
jmp 0x1404433ae
jle 0x140443589
movaps xmm7, xmm2
movaps xmm8, xmm1
mov r15d, 0x9117660
mov r15, rcx
jmp 0x1404433c9
xorps xmm6, xmm6
sub edi, edi
movsxd r8, ebp
xchg cx, dx
cwd
lea r14, [rsp + 0x28]
nop word cs:[rax + rax]
movsxd r8, edi
mov rcx, r14
mov rdx, r15
mov r8d, edi
jmp 0x1404433f9
call fcn.14044302c
mov ebx, dword [rsp + 0x3c]
cmc
stc
test ebx, ebx
jmp 0x14044340b
jle 0x140443589
test edi, edi
jmp 0x140443418
jne 0x140443436
movss xmm0, dword [rsp + 0x34]
jmp 0x140443429
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x14044357c
movss xmm0, dword [rsp + 0x38]
jmp 0x140443441
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x140443463
add edi, ebx
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jl 0x1404433eb
jmp 0x140443589
movss xmm6, dword [rsp + 0x28]
jmp 0x14044346e
ucomiss xmm6, xmm8
jbe 0x14044347f
mov esi, edi
jmp 0x140443589
movss xmm0, dword [rsp + 0x2c]
jmp 0x14044348a
ucomiss xmm0, xmm8
jbe 0x1404434fa
xor ebp, ebp
movzx rdx, sp
xchg si, dx
mov esi, edi
movaps xmm7, xmm6
not dl
jmp 0x1404434ac
nop word cs:[rax + rax]
mov rcx, r15
not dh
movsx rdx, r11w
mov r8w, r11w
mov edx, edi
not r8b
mov r8d, ebp
call fcn.140443856
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x1404435fa
inc ebp
inc esi
clc
test dh, 0xe7
movaps xmm6, xmm7
cmc
clc
cmp ebx, ebp
jmp 0x1404434f4
jne 0x1404434b8
test byte [r15 + 0x1c], 4
jmp 0x140443504
jne 0x14044356e
lea esi, [rbx + rdi]
movsx ax, r8b
nop
movsx rcx, r15w
dec esi
movzx cx, spl
lahf
mov rax, qword [r15]
movsx rcx, sp
shl cx, 0xc6
ror cl, 0xc6
movsxd rcx, esi
cmp qword [rax + 0x10], rcx
jmp 0x14044353a
jbe 0x14044361c
cmp qword [rax + 0x18], 8
jmp 0x14044354a
jb 0x14044355e
mov rax, qword [rax]
cmp bh, 0x68
test r10, 0x1061b05
stc
cmp word [rax + rcx*2], 0xa
jmp 0x140443568
je 0x140443589
add ebx, edi
mov esi, ebx
jmp 0x140443577
jmp 0x140443589
sub esi, esi
cmovns r14w, ax
btr r14w, 0xb1
mov eax, esi
ror di, 0x10
xadd bp, bp
movaps xmm6, xmmword [rsp + 0x40]
add bpl, 0x49
xor dil, 0x67
test r12b, 0xcb
movaps xmm7, xmmword [rsp + 0x50]
sub r15d, 0x3ccf4eda
cmovae ebx, eax
movaps xmm8, xmmword [rsp + 0x60]
sbb si, cx
shl r15w, cl
sal di, cl
add rsp, 0x78
setg r14b
pop rbx
movsx r14, si
movzx di, spl
pop rbp
bswap si
pop rdi
movsx r14w, r12b
cmovnp r14d, r15d
mov r14b, r14b
pop rsi
movzx r15d, cx
pop r14
jmp 0x1404435f2
pop r15
jmp 0x1404435f9
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x140443589
inc esi
jmp 0x140443617
jmp 0x140443589
call fcn.140443a1e
int3
Function at 0x14044436e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sal r15b, 0xcc
btr r15d, 9
ror r15b, 0x5f
push r14
add r15b, r9b
push rsi
add r15b, 0xfa
bts r14w, r8w
push rdi
dec r14b
rcr r14, 0xf
mov r15b, r8b
push rbp
push rbx
rcr r14, cl
xadd r15w, bp
sub rsp, 0x28
xadd bx, r15w
mov r15d, r9d
test r11b, r13b
mov ebp, r8d
rcl r14b, cl
shl rbx, cl
sub r14w, r12w
mov r14, rdx
mov rbx, rcx
bsr cx, r15w
shr ch, cl
lea rcx, [rdx + 0x20]
clc
mov edx, r8d
movzx r8, bx
mov r8, 0x77614765
movsx r8w, spl
mov r8d, r9d
test r13, 0x1a700c9b
sub r9d, r9d
jmp 0x1404443f4
call fcn.1404445c2
test r15d, r15d
jmp 0x140444401
jle 0x1404444b9
test rax, rax
jmp 0x14044440f
je 0x1404444b9
movsxd rsi, ebp
shl ecx, 0xdd
rcr rdx, 0xba
mov ecx, r15d
xchg dx, dx
add dl, r13b
dec edx
xor ebp, ebp
jmp 0x14044443a
mov rdx, rsi
jmp 0x140444442
jmp 0x140444479
movzx edi, word [rdi + rdx*2]
jmp 0x140444450
mov word [rax + rbp*2], di
jmp 0x140444459
inc rbp
jmp 0x140444461
inc rdx
clc
test r11w, 0x2e41
cmp rcx, rbp
jmp 0x140444473
je 0x1404444c2
mov di, 0x2a
test bl, 0x2e
test byte [rbx + 0x1c], 4
jne 0x140444450
mov rdi, qword [rbx]
cmp qword [rdi + 0x10], rdx
jmp 0x140444496
jbe 0x1404445b7
cmp qword [rdi + 0x18], 8
jmp 0x1404444a6
jb 0x140444447
mov rdi, qword [rdi]
jmp 0x1404444b4
jmp 0x140444447
movsxd rsi, ebp
or edi, 0x4bd9318b
mov rbx, qword [rbx]
sar ch, cl
mov rdi, qword [rbx + 0x10]
shld cx, bx, 0x76
mov rcx, rdi
clc
sub rcx, rsi
jmp 0x1404444dc
jb 0x1404445b7
movsxd rax, r15d
jmp 0x1404444ee
cmp rcx, rax
jmp 0x1404444f6
cmovb rax, rcx
sub ch, 0x9d
cmp qword [rbx + 0x18], 8
movzx cx, bpl
mov rcx, rbx
jmp 0x14044450f
jb 0x140444518
mov rcx, qword [rbx]
lea rcx, [rcx + rsi*2]
sub rdi, rax
sbb dl, r13b
bt dx, r14w
xor bpl, 0x98
mov rbp, rdi
btc r8w, r9w
bt r8w, 0x78
bsr r8d, r9d
sub rbp, rsi
test r9w, si
btr r8, rdi
mov r8w, 0x7254
lea rdx, [rcx + rax*2]
bts r8, r13
jmp 0x14044455a
lea r8, [rbp + 2]
cmp al, r11b
add r8, rbp
jmp 0x14044456d
call fcn.1404a79e3
mov qword [rbx + 0x10], rdi
sbb bl, r14b
mov byte [r14 + 0x16], 0
add rsp, 0x28
pop rbx
pop rbp
movzx rsi, r8w
movsx r15, r13w
cmovnp r14d, esi
pop rdi
movsx esi, r10w
movzx si, r14b
movzx r14d, r10w
pop rsi
xchg r14d, r14d
pop r14
movsx r15w, cl
movsxd r15, r8d
mov r15b, dl
pop r15
jmp 0x1404445b6
ret
call fcn.140443a1e
int3
Function at 0x140448564
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x14044856d
movzx ecx, cx
jmp 0x140448575
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp eax, 0x100
not al
setae al
stc
clc
add rsp, 0x28
jmp 0x140448593
ret

Function at 0x140449cb2
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx ax, ch
movsx ax, r12b
mov rax, qword [rcx]
jmp 0x140449cca
call qword [rax + 0x28]
test eax, eax
jmp 0x140449cd4
je 0x140449d0c
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
stc
sar r9w, 0x29
mov dl, 3
bts r9, rsp
rcl r9b, 0x67
mov r9d, 0x2a
stc
clc
add rsp, 0x28
jmp 0x140449d07
jmp fcn.1403b3f28
nop
test spl, 0xed
add rsp, 0x28
jmp 0x140449d1a
ret

Function at 0x14044b01d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
shl sil, cl
cbw
movsx ax, r10b
push rdi
movzx eax, si
bsr si, r8w
sub rsp, 0xa8
movsxd rsi, eax
movaps xmmword [rsp + 0x90], xmm10
movaps xmmword [rsp + 0x80], xmm9
movaps xmmword [rsp + 0x70], xmm8
movsx rdi, r13w
movsx di, r15b
lahf
movaps xmmword [rsp + 0x60], xmm7
movsxd rsi, r13d
movaps xmmword [rsp + 0x50], xmm6
mov ax, di
movzx di, r10b
movsx eax, sp
movaps xmm9, xmm3
movsx esi, ax
mov rdi, rdx
mov rsi, rcx
cqo
movsxd rax, edx
movss xmm8, dword [rsp + 0xe0]
movzx rax, r11w
setbe dh
mov ax, 0x200c
mov rcx, qword [rcx + 0x20]
not rax
jmp 0x14044b0ac
movups xmm0, xmmword [r8]
xchg dh, dl
setae ah
cdqe
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [rcx]
movzx rdx, bx
jmp 0x14044b0c8
lea rdx, [rsp + 0x30]
jmp 0x14044b0d2
call qword [rax + 0x40]
movsd xmm7, qword [rdi]
jmp 0x14044b0de
movaps xmm0, xmm7
jmp 0x14044b0e6
call fcn.1404bc93a
movaps xmm10, xmm0
jmp 0x14044b0f4
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404bc93a
unpcklps xmm10, xmm0
addps xmm10, xmmword [0x1400bd4e0]
movlps qword [rdi], xmm10
movlps qword [rsp + 0x30], xmm10
movsd xmm7, qword [rdi + 8]
jmp 0x14044b120
movaps xmm0, xmm7
jmp 0x14044b128
call fcn.1404bc93a
movaps xmm6, xmm0
jmp 0x14044b135
shufps xmm7, xmm7, 0x55
movaps xmm0, xmm7
call fcn.1404bc93a
movss dword [rdi + 8], xmm6
jmp 0x14044b14b
unpcklps xmm6, xmm0
movss dword [rdi + 0xc], xmm0
jmp 0x14044b158
addps xmm6, xmm10
movlps qword [rsp + 0x38], xmm6
movss dword [rsp + 0x40], xmm9
movzx eax, r8w
rdtsc
movss dword [rsp + 0x44], xmm9
rdtsc
movsxd rcx, esp
cdqe
mov rcx, qword [rsi + 0x18]
mov dl, 0x42
not r8b
mov r8, qword [rsi + 0x20]
movsx rax, r15w
not dh
movsxd rdx, r13d
mov rax, qword [rcx]
movsx rdx, bx
mov qword [rsp + 0x20], 0
cqo
mov dx, 0x87
lea rdx, [rsp + 0x30]
jmp 0x14044b1b2
movaps xmm3, xmm8
jmp 0x14044b1bb
call qword [rax + 0x90]
movaps xmm6, xmmword [rsp + 0x50]
setp sil
movzx esi, di
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x70]
ror di, 0x7b
movaps xmm9, xmmword [rsp + 0x80]
mov dil, 0x5e
test rbx, rbx
inc sil
movaps xmm10, xmmword [rsp + 0x90]
movsx rdi, r12w
rcl edi, cl
add rsp, 0xa8
setns dil
mov esi, eax
pop rdi
pop rsi
jmp 0x14044b211
ret