joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d8ab360
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8cc5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8ab4e8
mov rax, qword [0x6d8cc5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8ab3ac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8ab435
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8ab390
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8ab51d
mov rax, qword [0x6d8cc5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8cc5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8ab500
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8ab42e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8ab490
add dword [0x6d8cc5e4], 1
cmp edi, 8
jae 0x6d8ab463
test dil, 4
jne 0x6d8ab4d4
test edi, edi
je 0x6d8ab458
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8ab4ef
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8ab458
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8ab47c
jmp 0x6d8ab458
add rsi, qword [0x6d8cc5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8ab42e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8ab458
xor esi, esi
jmp 0x6d8ab3b7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8ab458
mov rax, qword [0x6d8cc5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8abc70
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8cc8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8cc8a0]
test rbx, rbx
je 0x6d8abcc4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8abcbb
test rsi, rsi
je 0x6d8abcbb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8abca0
lea rcx, [0x6d8cc8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d8abf00
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8abf10
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8abf20
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8abf61
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8abf58
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8abf63
add rax, 0x28
cmp rax, r9
jne 0x6d8abf44
xor eax, eax
ret

Function at 0x6d8ac000
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8c91f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8ac06d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8ac06d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8ac06d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8ac064
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8ac06f
add rax, 0x28
cmp rax, r9
jne 0x6d8ac050
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8ac170
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8c91f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8ac190
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8ac188
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8ac1ed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8ac1e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8ac1f4
add rax, 0x28
cmp rax, r9
jne 0x6d8ac1d0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8ac210
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8c91f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8ac27e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8ac27e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8ac27e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8ac27e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8ac275
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8ac285
add rcx, 0x28
cmp rcx, rax
jne 0x6d8ac260
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8ac298
jmp 0x6d8ac27e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8ac2a6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8ac27e
test r9d, r9d
jg 0x6d8ac290
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8ac610
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403abe2a

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403ada96

Function at 0x1400e0068
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp ax, 5
jmp 0x1400e034e
movzx edx, word [rcx]
cmc
cmp ecx, 0x320b77da
sub r10d, r10d
bswap r9w
seto r8b
mov r8d, r10d
not r9
movsx r9w, r13b
movzx r9, ax
mov r9, rcx
jmp 0x1400f9f50
ja 0x1400e0364
mov eax, 0xfff9
add dx, ax
sbb ch, 0xa5
bt rcx, rdx
clc
shl r8d, 4
clc
movzx ecx, dx
rcr dh, cl
bswap dx
cmove rdx, r13
add r8d, 0xffffffd0
bt rdx, 0x85
xor dh, 0x5f
movzx edx, word [r9]
test bpl, 0x5b
add r8d, ecx
jmp 0x1400f9f50
test dx, dx
jmp 0x1402776a2
lea eax, [rdx - 0x41]
jmp 0x1400e000c
ret
jmp 0x1400e0359
lea eax, [rdx - 0x61]
lea r9, [r9 + 2]
test r9, rdi
cmp ax, 5
jmp 0x140276e5e
ja 0x14021bbc2
mov eax, 0xffd9
jmp 0x14023c563
jne 0x140260876
mov eax, r8d
jmp 0x14023604d
Function at 0x1400fb82c
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x1401f6898
jmp 0x140444397
push rsi
add si, r10w
push rdi
test rsp, rbp
sub si, 0x5f69
rcl ax, cl
sub rsp, 0x28
sbb al, r14b
mov rsi, rcx
rol ah, cl
movsx rax, r10w
bt ax, 0x98
mov rcx, qword [rcx + 0x18]
btc eax, 0x7e
movsx eax, r14w
mov rax, qword [rcx]
jmp 0x1404443d1
sub edx, edx
sub r8d, r8d
jmp 0x1404443db
call qword [rax + 0x188]
mov edi, eax
lea rcx, [rsi + 0x30]
call fcn.140458137
test edi, edi
jmp 0x1404443f3
je 0x140444439
cmp edi, 0x8899000c
jmp 0x140444404
jne 0x14044445b
mov rcx, rsi
test spl, 0xc5
xadd di, si
add rsp, 0x28
movzx si, r8b
mov sil, 0xda
pop rdi
movsx rsi, r9w
jmp 0x14044442e
pop rsi
jmp 0x140444434
jmp fcn.140444062
nop
xchg esi, edi
btr di, bp
test eax, 0x11ab22ec
add rsp, 0x28
pop rdi
movzx si, bpl
jmp 0x140444454
pop rsi
jmp 0x14044445a
ret
mov ecx, edi
test r15b, 0xb2
stc
sbb si, r9w
movabs r8, 0xad4a5352d2edebd0
rol r9b, 0x23
mov dl, 3
rol r9d, cl
sar r9w, 0x56
mov r9d, 0x54
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1403ae073

Function at 0x14010800e
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, qword [r9 + 0xf8]
bswap dx
lea rdx, [rcx + 2]
jmp 0x1401eed8c
mov r9, qword [rdx]
inc r8b
sub dl, 0xb6
test ecx, eax
movzx r8d, byte [rcx]
cmovb edx, edi
mov rdx, qword [r9 + 0x110]
test di, 0x467
cmp byte [r8 + rdx], 0x65
jmp 0x1401fd34b
jne 0x1400e1e8c
movzx r8d, byte [rcx + 2]
jmp 0x1400e1e8c
cmovne rdx, rcx
mov rcx, qword [rax]
rcr al, 0xd0
cmp r11b, r8b
movzx eax, byte [rcx]
shld ecx, r10d, 0x6c
mov byte [rdx], al
movzx ecx, r9w
shl rcx, 0x7f
add cl, 0x28
lea rax, [rdx + 1]
nop dword [rax]
bsr edx, r13d
neg cl
mov rcx, 0x57c011cd
movzx ecx, byte [rax]
xor dx, 0x3941
cmp r9d, 0x55f5274c
movzx edx, r8b
test dx, 0x26e1
test dl, sil
mov byte [rax], r8b
rcl r8b, cl
btr r8w, r10w
test r9b, 0x6e
lea rax, [rax + 1]
shrd r8, rax, 0x1a
add r8b, 0xd1
sal r8b, 0x3b
movzx r8d, cl
test dl, dl
jne 0x1401eedc6
ret
je 0x140217fdc
mov rax, qword [r9]
movsx r8d, r10w
movzx r8, bx
nop dword [rax + rax]
movzx r8, r8w
movzx r8d, byte [rcx + 1]
inc rcx
stc
clc
test byte [rax + r8*2], 4
jmp 0x140217fd6
jne 0x1401fd368
movzx eax, r8b
cmc
cmp byte [rax + rdx], 0x78
jmp 0x14011eec3

Function at 0x140193f22
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
cmc
stc
sub edx, edx
jmp 0x140221725
jmp 0x1404af217

Function at 0x1401a1653
Capabilities:
Access peb ldr_data

Disassembly:
movzx eax, word [0x1400b8f10]
test dil, r11b
test ax, ax
je 0x1401aafea
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x1402635ea
mov rax, qword gs:[0x30]
jmp 0x140122e42
cmovb r8, rdx
jmp 0x1401d0549
Function at 0x14020fa97
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400ff0de
jne 0x1400ff0de
movzx eax, byte [r11 + rcx*4 + 2]
cmp al, byte [rdx + 2]
jne 0x1400ff0de
mov byte [r11 + rcx*4 + 3], 0
movsx r10, r9w
not r10d
cmovbe r10d, edi
movzx r10d, byte [rdx]
jmp 0x1400f8b90
ret
inc rcx
stc
cmp r8d, ecx
jmp 0x140268a8e
je 0x1400fd0fb
lea ecx, [r9 - 1]
test r14w, 0x6f19
cmc
test r9, rcx
cmp ecx, 3
jmp 0x14023604e
mov byte [r11 + 5], cl
mov cx, 0x3139
sar cx, 0x61
movzx ecx, byte [r11 + 6]
cmp cl, byte [rdx]
setne cl
neg cl
mov byte [r11 + 7], cl
cmp r11d, 0x77c90a32
test r9w, 0x46ba
add r11, 8
add r8d, 0xfffffffc
jne 0x140236082
test r9b, 3
jmp 0x14022f303
jne 0x140269cd2
test r9d, r9d
jmp 0x1401005e9
mov r10, qword [rcx]
rol r9b, cl
mov r11, qword [rcx + 0x18]
shrd r9w, r15w, 0x45
cmc
movsxd r9, r15d
mov r9d, dword [r10 + 4]
cmp spl, r8b
stc
imul r9d, dword [r10]
cmp r8d, 2
jmp 0x1401fbe83
je 0x1400fd0fb
and r9d, 3
sub ecx, ecx
add ax, sp
rcr al, cl
nop word cs:[rax + rax]
or ax, 0x250f
cwde
movzx eax, byte [r11 + rcx*2]
test esi, 0x1a7724c4
cmp al, sil
cmp bpl, 0x10
cmp al, byte [rdx]
setne al
cmp sil, 0x20
neg al
mov byte [r11 + rcx*2 + 1], al
jmp 0x14026eaa8
jb 0x140120e70
mov r8d, r9d
not r10b
and r8d, 0xfffffffc
xor cl, bh
movsxd rcx, esi
not r10d
nop word cs:[rax + rax]
cmovne r10, rcx
adc ecx, 0x12ef7ce7
mov cx, r11w
movzx ecx, byte [r11]
sbb r10b, r9b
and r10b, 0xba
bswap r10w
cmp cl, byte [rdx]
movsx r10d, si
movzx r10, r15w
movzx r10d, byte [r11 + 2]
mov cl, 0x89
setne cl
neg cl
cmp ch, 0x1a
mov byte [r11 + 1], cl
cmp r10b, byte [rdx]
mov cl, dl
setne cl
clc
test rbx, 0x2d6d5034
neg cl
clc
cmp rax, rbp
mov byte [r11 + 3], cl
rcr cl, cl
movzx ecx, byte [r11 + 4]
cmp cl, byte [rdx]
mov cl, 0x82
not cl
setne cl
stc
clc
neg cl
jmp 0x140120e39
je 0x1400fd0fb
cmp byte [r11 + rcx*4], r10b
jmp 0x14028aae4
test r9d, r9d
je 0x1400fd0fb
movzx r10d, byte [rdx]
xadd r8b, r8b
mov r8d, r9d
sub ecx, ecx
jmp 0x1402968bf
inc rcx
test r13d, 0x26cf500f
cmp r15b, 0xc6
cmp r9d, ecx
jne 0x14022f323
jmp 0x1400fd0fb
jne 0x1400ff0de
movzx eax, byte [r11 + rcx*4 + 1]
stc
clc
cmp al, byte [rdx + 1]
jmp 0x1400f8f2d
jmp 0x140268a94
Function at 0x1402219b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x1401a007d
movzx eax, byte [rcx + 1]
jmp 0x140208f94
dec rcx
cmp r9b, 0x76
test cx, 0x2890
cmp dil, r12b
cmp al, 0x30
jmp 0x140269c58
dec rcx
cmp bl, 0x3e
cmp al, 0x30
je 0x140269c5e
cmp al, r9b
cwde
lea rdx, [rcx - 1]
cmovle eax, r13d
xchg al, al
movzx ax, sil
cmovne rdx, rcx
nop dword [rax]
test r15, 0x7ec94696
or al, 0x7d
movzx eax, byte [r8]
clc
cmp ax, sp
cmp r15b, 0xa9
lea rdx, [rdx + 1]
mov byte [rdx], al
stc
lea r8, [r8 + 1]
cmp r12b, sil
test al, al
jmp 0x1402968b8
je 0x1401f4e4e
movzx edx, al
rcl eax, cl
cmp bx, r11w
bt rax, rsp
nop dword [rax + rax]
mov rax, 0x3b0f1ef3
movzx eax, dl
jmp 0x14018858a
cmp dl, r9b
je 0x1401f4e4e
movzx eax, byte [rcx + 1]
bswap dx
not dx
inc rcx
btr dx, 0x8c
movzx edx, al
stc
test al, al
jmp 0x1401f4e48
jne 0x140293be6
movzx eax, byte [rcx - 1]
cmovbe r8w, si
dec r8w
mov r8, rcx
jmp 0x140114f00
jne 0x140174c0f
inc rcx
test r14b, 0x92
test al, al
jmp 0x140238e00
inc rcx
cmp bx, 0x500f
cmc
test al, al
jmp 0x1401a0077
mov rax, qword [rdx]
mov rdx, qword [rax + 0xf8]
test r10w, r8w
mov rax, qword [rdx]
xor r9d, r15d
stc
xadd r9b, r9b
movzx r9d, byte [rax]
movzx eax, cx
bt ax, r9w
test bp, r11w
movzx eax, byte [rcx]
test al, al
jmp 0x140174bf0
je 0x1402968be
movzx eax, byte [rcx]
test al, al
jmp 0x140293be0
jne 0x14011a1c3
movzx eax, byte [rcx - 1]
jmp 0x14011a1b5
je 0x1401a007d
sub al, 0x45
test al, 0xdf
jmp 0x1400fd884
jne 0x14011a1ea
ret

Function at 0x14022d3fc
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x140234bcf
mov ecx, dword [rax + 8]
add ecx, edx
cmp ax, r13w
clc
cmp r10, rcx
jmp 0x140234bc9
jb 0x14022e87b
sub eax, eax
ret
lea r8, [r8 + rcx]
bswap r11w
stc
mov r10, rdx
cwde
movzx eax, word [r8 + 0x14]
btr r11d, 0x62
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
jmp 0x14022e875
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
jmp 0x140205410
je 0x140197392
mov edx, dword [rax + 0xc]
cmc
test r11d, r15d
cmp r10, rdx
jmp 0x1400f65fc
jb 0x140197394
inc r9d
cmp r14b, bl
add rax, 0x28
jmp 0x14024b880
cmp r9d, r11d
jmp 0x14019738c

Function at 0x140246684
Capabilities:
Parse pe header

Disassembly:
ret
ret
sub eax, eax
jmp 0x1401e19cf
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x140295cac
jne 0x1401fb22b
movsxd rdx, dword [rcx + 0x3c]
cmc
clc
cmp r12, 0x75d734d1
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401fb22b
xor eax, eax
mov cl, r12b
sal al, cl
mov ecx, 0x20b
shl al, cl
sbb al, 0x68
cmp word [rdx + 0x18], cx
sete al
jmp 0x14012075b
Function at 0x14026c484
Capabilities:
Parse pe header

Disassembly:
lea edx, [r8 + 2]
jmp 0x14028cb90
sub r8d, r8d
movsxd rdx, r8d
jmp 0x1401b13e1
jmp 0x1404af217
mov qword [rsp + 8], rbx
rcr bh, cl
mov dword [rsp + 0x18], r8d
bt rbx, 0xa6
mov dword [rsp + 0x10], edx
push rbp
not rbx
cmc
sal bp, cl
mov rbp, rsp
shr ebx, 0xc2
rcl bx, 0x35
sub rsp, 0x50
ror bl, 0x59
mov ebx, ecx
test r8d, r8d
jmp 0x1404af24f
jne 0x1404af2f5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404af265
je 0x1404af2f5
mov ecx, 0x5a4d
cmp r14d, 0x7ac87e25
test r12d, 0x5b920742
jmp 0x1404af283
cmp word [rax], cx
jmp 0x1404af28b
jne 0x1404af2f5
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
clc
jmp 0x1404af29f
cmp dword [rcx], 0x4550
jmp 0x1404af2aa
jne 0x1404af2f5
mov eax, 0x20b
stc
cmp word [rcx + 0x18], ax
jmp 0x1404af2bf
jne 0x1404af2f5
cmp dword [rcx + 0x84], 0xe
jmp 0x1404af2d1
jbe 0x1404af2f5
cmp dword [rcx + 0xf8], 0
jmp 0x1404af2e3
je 0x1404af2f5
mov ecx, ebx
jmp 0x1404af2f0
call fcn.1404af0db
lea rax, [rbp + 0x18]
mov r8w, r8w
seta r9b
mov byte [rbp + 0x28], 0
not r8w
movsx ecx, r13w
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
movsx rdx, r8w
movsxd rcx, r11d
mov qword [rbp - 0x18], rax
mov al, 0x4e
mov edx, r11d
cwd
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov dl, bpl
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov ax, 0x48af
cwde
mov eax, 2
xchg cl, cl
movsx rcx, dx
movsxd rcx, r15d
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
jmp 0x1404af35d
mov dword [rbp - 0x28], eax
call fcn.1404af501
cmp dword [rbp + 0x20], 0
jmp 0x1404af36e
je 0x1404af390
mov rbx, qword [rsp + 0x60]
adc bpl, 0x7b
bts rbp, r13
add rsp, 0x50
movsx rbp, ax
pop rbp
jmp 0x1404af38f
ret
mov ecx, ebx
call fcn.1404af184
int3
Function at 0x140322270
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdx
cwd
push rbp
push rbx
mov bl, r8b
push r13
movsx ebx, r8w
mov bx, r14w
pushfq
sbb edx, r11d
push r14
neg dl
push rcx
mov rbx, 0xcbe0b95
push rdi
adc di, r11w
mov bl, 0x2b
push r15
rcl dil, 0x30
push r10
rol edi, 0xd7
mov r10b, r13b
push r11
movsx rdi, r8w
rcr bl, 0x84
push r9
bsr r10, rsi
jmp 0x1402e9bb8
add r11, 4
clc
xor edx, r10d
add edx, 0x3ddc4928
rol edx, 1
cmc
stc
cmp dl, 0
sub edx, 0x3db31992
stc
clc
rol edx, 3
cmp al, r12b
push r10
xor dword [rsp], edx
shld r10d, eax, 0x2d
pop r10
test r12b, 0xb0
movsxd rdx, edx
test r8d, r8d
clc
add r9, rdx
jmp 0x1402e21d5
jmp r9
push rax
push r8
sal ah, 0x7d
test bx, sp
stc
movabs rax, 0
push rax
movzx r11, cx
sar dil, cl
mov r11, qword [rsp + 0x90]
shrd dx, r14w, 0x43
xchg r9w, di
bts rbx, rbx
xor r11d, 0x468a775e
setne dh
inc r11d
sal r9d, 0x5b
movzx r10d, r14w
not r11d
rol rdx, 0xe
xor r11d, 0x5b75613a
cqo
lea r11, [r11 + rax]
cdqe
ror dx, 0x83
movabs rbx, 0x100000000
movsxd rax, r10d
rdtsc
add r11, rbx
and r9b, cl
sbb r9b, 0xcb
mov rdi, rsp
cwd
rdtsc
sub rsp, 0x180
movsxd rdx, ebx
test r12b, 0xe1
sal r9b, 0xd6
and rsp, 0xfffffffffffffff0
mov r10, r11
movabs rax, 0
sar rdx, 0x35
xor r9b, spl
bt r9w, 0x66
sub r10, rax
clc
not r9
sbb edx, 0x5ddb75e3
lea r9, [0x1402e9c79]
adc dl, r9b
shl dx, cl
neg dl
mov edx, dword [r11]
cmp r11w, 0x7e8f
jmp 0x1402b50d1
push r12
push rsi
jmp 0x1402accbd
Function at 0x1403ba2b2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
xor al, r10b
push r12
push rsi
shrd si, r12w, 0x80
ror si, 0x43
test cl, 0x42
push rdi
movzx ax, ah
cmp r11, 0x43253a8d
sbb r14w, r12w
push rbx
movsxd rbx, r11d
sub rsp, 0x20
test spl, sil
mov rsi, r8
test ch, 0x4b
cbw
movzx di, r14b
mov rdi, rdx
cbw
mov r14, rcx
or bl, r10b
sub bx, si
mov rbx, qword [rcx]
ror rax, cl
sbb al, r15b
cmp r9b, 0xa6
mov rcx, qword [rcx + 0x10]
adc ax, 0x5180
rcr ax, cl
bts ax, r10w
sub rcx, rbx
movzx eax, r12w
setns ah
sar rcx, 4
movabs rax, 0xf0f0f0f0f0f0f0f1
imul rcx, rax
jmp 0x1403ba345
cmp rcx, r8
jmp 0x1403ba34d
jae 0x1403ba3b6
mov rcx, r14
cqo
xchg dx, dx
jmp 0x1403ba360
mov rdx, rsi
jmp 0x1403ba368
call fcn.1403ba598
mov rbx, qword [r14]
movsx ecx, r12w
nop word [rax + rax]
seta dh
mov rcx, rbx
mov rdx, rdi
jmp 0x1403ba38b
call fcn.1403bad86
add rbx, 0x110
add rdi, 0x110
jmp 0x1403ba3a3
dec rsi
jmp 0x1403ba3ab
jne 0x1403ba380
jmp 0x1403ba55e
mov r13, qword [r14 + 8]
mov r12, r13
rcr r15b, 0x60
btc r15w, r10w
rol r15, 0xf
sub r12, rbx
sar r12, 4
sar r15w, 0x6d
btc r15, 0x64
bsf r15w, bp
imul r12, rax
rol r15b, cl
mov r15, r12
sub r15, rsi
jmp 0x1403ba3f2
jae 0x1403ba4b8
cmp rbx, r13
jmp 0x1403ba400
je 0x1403ba45a
nop word cs:[rax + rax]
cmovp rdx, r11
movsx dx, dl
mov rcx, rbx
mov dh, 0x88
mov dx, si
cwd
mov rdx, rdi
jmp 0x1403ba42f
call fcn.1403ba834
add rbx, 0x110
test r8w, sp
cmp bx, 0x15a0
add rdi, 0x110
cmp rbx, qword [r14 + 8]
jmp 0x1403ba454
jne 0x1403ba41c
cmp rsi, r12
jmp 0x1403ba462
je 0x1403ba55e
nop dword [rax + rax]
movsx ecx, sp
bswap ecx
mov dx, 0x2919
mov rcx, rbx
mov rdx, rdi
jmp 0x1403ba484
call fcn.1403bad86
add rbx, 0x110
test cl, r11b
test r8w, 0x577d
add rdi, 0x110
jmp 0x1403ba4a5
inc r15
jmp 0x1403ba4ad
jne 0x1403ba479
jmp 0x1403ba55e
imul r15, rsi, 0x110
test r9d, edx
cmp r13b, r8b
lea r15, [r15 + rbx]
test rsi, rsi
jmp 0x1403ba4d1
je 0x1403ba51c
nop
mov ch, ah
movsx ecx, r13w
mov rcx, rbx
mov rdx, rdi
jmp 0x1403ba4e9
call fcn.1403ba834
add rbx, 0x110
cmc
jmp 0x1403ba4fb
add rdi, 0x110
jmp 0x1403ba507
dec rsi
jmp 0x1403ba50f
jne 0x1403ba4de
mov r13, qword [r14 + 8]
test r10b, dil
cmp r15, r13
je 0x1403ba55b
mov rsi, r15
xchg cl, cl
mov cx, 0x3b4
movzx rcx, r13w
nop word [rax + rax]
mov rcx, rsi
call fcn.1403b4d2c
add rsi, 0x110
test r10w, cx
test r13, 0x5b1d59b0
cmp rsi, r13
jne 0x1403ba538
mov rbx, r15
mov qword [r14 + 8], rbx
shl r15, cl
add rsp, 0x20
movsx edi, bp
bswap r13w
pop rbx
pop rdi
pop rsi
pop r12
movzx r13w, r13b
mov r14b, 0x9f
mov r15d, eax
pop r13
jmp 0x1403ba587
pop r14
mov r15b, cl
movsx r15d, cx
pop r15
jmp 0x1403ba597
ret
Function at 0x1403c408a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
clc
cmovp di, sp
sal al, 0x45
push rbx
shrd rsi, rbp, 0x5d
cmovg ax, r13w
sub rsp, 0x20
bt rdi, rdx
mov rsi, rcx
lea rax, [0x1400be020]
mov qword [rcx], rax
mov rdi, rbx
add dil, 0x7d
mov rdi, qword [rcx + 0x78]
clc
test rdi, rdi
je 0x1403c40f3
mov rcx, rdi
jmp 0x1403c40d1
call fcn.1400e935d
mov rcx, rdi
jmp 0x1403c40de
call fcn.1402892c9
mov qword [rsi + 0x78], 0
cmovge ax, ax
sal al, cl
rcr ah, cl
mov rax, qword [rsi + 0x70]
cmp rax, 8
jmp 0x1403c4100
jb 0x1403c4177
mov rcx, qword [rsi + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp ah, 0xad
stc
cmp rdx, 0x1000
jb 0x1403c4172
mov rbx, qword [rcx - 8]
test r15w, si
add rcx, 0xfffffffffffffff8
test r8, 0x13656d2d
clc
cmp r9b, sil
sub rcx, rbx
cmp r12b, r10b
cmp r9w, 0x115d
cmp rcx, 0x20
jmp 0x1403c414f
jae 0x1403c42c9
lea rax, [rax + rax]
xor ecx, r14d
add rax, 0x29
xchg rcx, rdx
cqo
movzx rcx, sp
mov rdx, rax
bswap rcx
mov rcx, rbx
call fcn.140102f68
movaps xmm0, xmmword [0x1400bd3f0]
movups xmmword [rsi + 0x68], xmm0
ror ebx, 0x61
ror rdi, cl
btr edi, 0xd5
mov word [rsi + 0x58], 0
adc al, r13b
bts edi, edx
lea rax, [0x1400bdb70]
xchg dil, dil
mov qword [rsi], rax
rcl edi, 0xf7
rcr bl, cl
mov rdi, 0x5240496e
mov rdi, qword [rsi + 0x40]
sal ebx, cl
mov rbx, qword [rsi + 0x48]
cmc
cmp rdi, rbx
jmp 0x1403c41c4
jne 0x1403c41e1
jmp 0x1403c4228
add rdi, 8
cmp rdi, rbx
jmp 0x1403c41db
je 0x1403c420b
mov rcx, qword [rdi]
test rcx, rcx
je 0x1403c41cf
mov rax, qword [rcx]
mov dh, 0xa3
cdq
cwd
mov edx, 1
jmp 0x1403c4200
call qword [rax + 0xb8]
jmp 0x1403c41cf
mov rdi, qword [rsi + 0x40]
jmp 0x1403c4215
cmp rdi, qword [rsi + 0x48]
jmp 0x1403c421e
je 0x1403c4228
mov qword [rsi + 0x48], rdi
test rdi, rdi
jmp 0x1403c4230
je 0x1403c42ab
mov rdx, qword [rsi + 0x50]
sub rdx, rdi
test edi, 0xcab1eb3
cmp rdx, 0x1000
jmp 0x1403c424f
jb 0x1403c4288
mov rax, qword [rdi - 8]
stc
cmp r11w, 0x62de
add rdi, 0xfffffffffffffff8
sub rdi, rax
jmp 0x1403c426e
cmp rdi, 0x20
jae 0x1403c42c9
add rdx, 0x27
mov rdi, rax
btr cx, 0xdf
btr cx, di
add rsi, 0x40
mov rcx, rdi
jmp 0x1403c4294
call fcn.140102f68
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
shl dil, 0xe1
add rsp, 0x20
jmp 0x1403c42b4
pop rbx
movzx edi, cx
movzx si, r10b
pop rdi
movsx esi, r8w
movzx si, r13b
pop rsi
ret
call fcn.1404b4343
int3