joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140282aef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
nop word [rax + rax]
cmp r8, rax
je 0x14028db9a
mov word [r10], r11w
sbb r11b, 0x9e
add r10, 2
movsx r11w, r9b
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1401a0cf5
mov rax, qword [rax + 0x10]
bsr r9d, esp
cmovg r11w, r9w
movzx r8d, word [rax + 0x58]
cmp r8, rdx
bswap r9
cmovae r8, rdx
mov r9, qword [rax + 0x60]
cmovnp r11w, di
mov r10b, r9b
movzx r11d, word [r9]
rol r10w, cl
test rsi, 0x6902de7
xor r10b, dl
lea r10, [0x1400b8f10]
test r11w, r11w
jmp 0x14025ddd4
jmp 0x140239f8c
jne 0x140239fa6
sub r8, rdx
test r8, r8
je 0x14028b044
mov word [rcx], 0
jmp 0x14028b044
je 0x1401b6bc3
cmp rdx, 0x104
movsx r8d, bx
mov r8d, 0x104
jmp 0x1401f8230
jne 0x1400ec267
sub r8, rax
clc
test dil, r13b
cmp r13w, ax
test r8, r8
jmp 0x14028db94
inc rax
test r11w, r11w
jmp 0x1401a0cdc
mov rax, qword gs:[0x30]
dec r10b
mov rax, qword [rax + 0x60]
sal r8d, cl
mov r10b, dl
mov rax, qword [rax + 0x18]
adc r9b, 0x6a
jmp 0x140141ac2
cmovb r8, rdx
jmp 0x140144360
je 0x14016254d
mov word [rcx], ax
add rcx, 2
movzx rax, di
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x14024d318
je 0x140162544
sub edx, edx
or r9b, 0xf0
btr r9, 0x63
cmove r9, r14
lea r9, [0x1400b8f10]
clc
cmp r8, r11
cmp r8, rdx
jmp 0x14022cb2c
inc rdx
test ax, ax
jmp 0x14016253b
je 0x1401a0ced
sub eax, eax
test r13b, 0xb
jmp 0x1400ec261
movzx eax, word [0x1400b8f10]
cmp r15, r13
test r13b, 4
test ax, ax
jmp 0x14016aaae
ret
je 0x14028dba8
mov word [r10], 0
cmp dx, 0x18a2
xchg r8b, al
movzx eax, word [0x1400b8f10]
sub r8b, al
cmp rdx, 0x104
mov r8d, 0x104
cmovb r8, rdx
test ax, ax
jmp 0x140239f86
Function at 0x1403e1a51
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
test ax, r8w
cmp spl, 0x2d
cmc
push rsi
push rdi
movzx rdi, r15w
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
rol dil, cl
inc dil
mov rdi, qword [rcx]
stc
jmp 0x1403e1a7d
test rdi, rdi
jmp 0x1403e1a85
je 0x1403e1bde
mov r14, rcx
movzx rbx, r12w
sal rbx, 0x8e
btc bx, bp
mov rbx, qword [rcx + 8]
cmp rdi, rbx
je 0x1403e1b68
lea r15, [0x1400bed30]
jmp 0x1403e1ab3
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e1aeb
call fcn.1402440d8
movups xmmword [rdi + 0x20], xmm6
test r14b, cl
cmp bpl, 0xb
mov byte [rdi + 0x10], 0
test r8w, 0x33d8
add rdi, 0x38
cmp rdi, rbx
jmp 0x1403e1ae5
je 0x1403e1b5f
mov qword [rdi], r15
mov rax, qword [rdi + 0x28]
cmp rax, 0x10
jmp 0x1403e1afb
jb 0x1403e1ac4
mov rcx, qword [rdi + 0x10]
xor rdx, rbx
lea rdx, [rax + 1]
cmp r8w, sp
cmp rdx, 0x1000
jmp 0x1403e1b1c
jb 0x1403e1abf
mov rsi, qword [rcx - 8]
clc
add rcx, 0xfffffffffffffff8
cmp ebx, eax
sub rcx, rsi
cmp r14w, 0x267b
cmp rcx, 0x20
jmp 0x1403e1b3f
jae 0x1403e1c0a
add rax, 0x28
movsxd rcx, r9d
cdq
cwd
mov rdx, rax
mov rcx, rsi
jmp 0x1403e1b5a
jmp 0x1403e1abf
mov rdi, qword [r14]
rcr edx, 0x27
add dx, sp
mov rdx, qword [r14 + 0x10]
test r12b, 0x3c
cmc
test bp, si
sub rdx, rdi
cmp rdx, 0x1000
jb 0x1403e1bbb
mov rax, qword [rdi - 8]
test r12b, 0x3a
clc
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmc
test al, 0xe3
cmp rdi, 0x20
jmp 0x1403e1ba0
jae 0x1403e1c0a
add rdx, 0x27
movsxd rdi, r14d
movzx rdi, r9w
mov rdi, rax
movzx rcx, ax
mov ecx, r10d
mov rcx, rdi
jmp 0x1403e1bc3
call fcn.1402440d8
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
xchg r15w, r15w
neg sil
movaps xmm6, xmmword [rsp + 0x20]
and r14, r13
add rsp, 0x30
movsx r15, r14w
pop rbx
movzx esi, cx
not sil
pop rdi
pop rsi
pop r14
movzx r15, r11w
movsx r15w, r9b
pop r15
jmp 0x1403e1c09
ret
call fcn.1404b3723
int3
Function at 0x1403ef49b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
stc
cdqe
push rsi
push rdi
btr r14, r15
ror ah, cl
add esi, r13d
push rbx
movsxd r14, edx
rcr esi, 0x35
sub rsp, 0x28
movzx esi, r11w
rcr r14b, cl
jmp 0x1403ef4c2
mov rbx, rdx
bswap rax
bts r14, r9
mov r14, rcx
lea rsi, [rdx + r8]
movsxd rax, esi
cbw
mov eax, dword [rcx + 8]
stc
test r8b, cl
cmp edx, ebp
test al, 2
jmp 0x1403ef4e8
jne 0x1403ef59d
mov dil, 1
test al, 4
jmp 0x1403ef4f8
je 0x1403ef6fe
lea rax, [rbx + 1]
cmp rdx, rsp
test r10b, 0xde
cmp rax, rsi
ja 0x1403ef6f5
mov byte [rbx], 0x12
shl ch, 0x4b
sar ch, 0x37
sal ch, 0x7d
mov rcx, qword [r14 + 0x40]
cmp rcx, 0x80
jb 0x1403ef6b3
nop word cs:[rax + rax]
cmovbe edx, ebp
lea rdx, [rax + 1]
clc
test al, r12b
cmp rdx, rsi
ja 0x1403ef6f5
mov ebx, ecx
stc
test r10b, 0x2f
or bl, 0x80
jmp 0x1403ef562
mov byte [rax], bl
bt rax, 8
bsf bx, ax
mov rbx, rcx
bt ax, r8w
sal ah, 0x5f
shr rbx, 7
mov rax, rdx
jmp 0x1403ef588
cmp rcx, 0x3fff
mov rcx, rbx
ja 0x1403ef53c
jmp 0x1403ef6ba
test r8, r8
jmp 0x1403ef5a5
jle 0x1403ef6f5
mov byte [rbx], 0xa
inc rbx
adc cl, spl
mov rcx, qword [r14 + 0x20]
test bl, 0xa1
cmp rcx, 0x80
jmp 0x1403ef5c7
jb 0x1403ef63c
nop dword [rax + rax]
lea rax, [rbx + 1]
cmc
cmp rax, rsi
jmp 0x1403ef5e2
ja 0x1403ef6f5
mov edx, ecx
or dl, 0x80
jmp 0x1403ef5f6
mov byte [rbx], dl
mov rdx, rcx
bsr bx, bx
sbb bl, bpl
shr rdx, 7
movsx bx, sil
mov rbx, rax
jmp 0x1403ef616
cmp rcx, 0x3fff
movzx cx, r12b
mov ch, 6
movsx rcx, dx
mov rcx, rdx
jmp 0x1403ef631
ja 0x1403ef5d5
jmp 0x1403ef656
mov rax, rbx
cmovo dx, cx
test spl, r8b
cmc
mov rdx, rcx
btc ecx, 0xa7
sub cx, 0x5e6f
xor cl, 0xa
lea rcx, [rax + 1]
cmp rcx, rsi
ja 0x1403ef6f5
mov byte [rax], dl
seto r8b
movzx ebx, r12w
movsx r8w, r9b
mov r8, qword [r14 + 0x20]
test dl, r11b
not bx
rcl bl, 0xa1
lea rbx, [rcx + r8]
cmp r10d, r14d
cmc
jmp 0x1403ef68c
cmp rbx, rsi
jmp 0x1403ef694
ja 0x1403ef6f5
cmp qword [r14 + 0x28], 0x10
jmp 0x1403ef6a4
jb 0x1403ef72f
mov rdx, qword [r14 + 0x10]
jmp 0x1403ef738
mov rdx, rax
mov rbx, rcx
clc
lea rcx, [rdx + 1]
test dil, 0x37
jmp 0x1403ef6c7
cmp rcx, rsi
jmp 0x1403ef6cf
ja 0x1403ef6f5
mov byte [rdx], bl
movzx r8w, dil
mov r8, qword [r14 + 0x40]
xor al, al
lea rax, [rcx + r8]
cmc
cmp rax, rsi
jmp 0x1403ef6ef
jbe 0x1403ef746
xor edi, edi
bsf r14d, edi
ror r14d, cl
mov eax, edi
and r14w, cx
cmp bpl, al
add rsp, 0x28
mov bl, al
movsx di, spl
movzx rsi, r14w
pop rbx
mov dil, 0x3a
pop rdi
not si
bswap r14w
pop rsi
movzx r14d, ax
pop r14
jmp 0x1403ef72e
ret
lea rdx, [r14 + 0x10]
jmp 0x1403ef738
call fcn.1404a0bfe
mov eax, dword [r14 + 8]
jmp 0x1403ef4ee
cmp qword [r14 + 0x48], 0x10
jmp 0x1403ef750
jb 0x1403ef75f
mov r14, qword [r14 + 0x30]
jmp 0x1403ef766
add r14, 0x30
movsx edx, dx
mov rdx, r14
jmp 0x1403ef76e
call fcn.1404a0bfe
jmp 0x1403ef6fe
Function at 0x14041fe07
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
test dx, 0x636f
movzx r9d, sp
xor r9, rdx
mov r10, qword [rcx]
movsx r9w, dl
mov rsi, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
clc
imul r9d, dword [r10]
cmc
cmp r8d, 2
jne 0x14041ffbf
test r9d, r9d
je 0x140420055
lea ecx, [r9 - 1]
cmp ecx, 3
jb 0x14041ff50
mov r11d, r9d
and r11d, 0xfffffffc
nop word cs:[rax + rax]
movzx r8d, word [rsi]
xadd r10w, r10w
movzx r10d, word [rsi + 4]
test r14w, cx
cmc
cmp spl, sil
xor ecx, ecx
ror cl, cl
cmp r8w, word [rdx]
movsx r8w, r9b
movzx r8w, r13b
setne cl
sbb r8b, cl
neg ecx
shr r8b, 0x64
xadd r8w, r8w
or r8w, 0x4005
mov word [rsi + 2], cx
bsr r8, r10
cmovns r8, rdx
sub ecx, ecx
shl r8, 0xab
ror cl, cl
cmp r10w, word [rdx]
setne cl
neg ecx
add r8, 0x111d5142
shr r8b, cl
test r15w, 0x3e12
mov word [rsi + 6], cx
movzx r8w, r8b
sbb r8b, al
movsx r8w, r12b
movzx r8d, word [rsi + 8]
sub ecx, ecx
cmp r8w, word [rdx]
movsx r8d, si
not r8b
cmovno r8, rsi
setne cl
bswap r8d
neg ecx
bt r8w, sp
jmp 0x14041ff06
mov word [rsi + 0xa], cx
add r8, rax
movzx r8d, word [rsi + 0xc]
xor ecx, ecx
mov cl, 0x10
stc
cmp r8w, word [rdx]
setne cl
neg ecx
test r8b, spl
cmp r15, 0x7ef71b17
mov word [rsi + 0xe], cx
test bp, 0x36b4
stc
jmp 0x14041ff39
add rsi, 0x10
test r9w, di
add r11d, 0xfffffffc
jmp 0x14041ff4a
jne 0x14041fe5e
test r9b, 3
jmp 0x14041ff59
je 0x140420055
and r9d, 3
xadd r8w, r8w
sub ecx, ecx
shld r8w, r9w, 0x5d
bswap r8
nop word cs:[rax + rax]
movzx r8d, word [rsi + rcx*4]
xor eax, eax
mov al, r14b
cmc
cmp r8w, word [rdx]
setne al
test r13b, 0xae
jmp 0x14041ff9a
neg eax
jmp 0x14041ffa1
mov word [rsi + rcx*4 + 2], ax
inc rcx
test r10b, r11b
cmp r9d, ecx
jmp 0x14041ffb4
jne 0x14041ff7e
jmp 0x140420055
test r9d, r9d
je 0x140420055
movzx r10d, word [rdx]
add r8d, ebp
movsx r8, r11w
mov r8d, r9d
cmp r15w, r12w
xor ecx, ecx
jmp 0x14041ffe1
jmp 0x14041fff7
inc rcx
cmp r8d, ecx
jmp 0x14041fff1
je 0x140420055
cmp word [rsi + rcx*8], r10w
jmp 0x140420001
jne 0x14041ffe6
movzx eax, word [rsi + rcx*8 + 2]
test ah, 0x18
test r9b, r11b
cmp ax, word [rdx + 2]
jmp 0x14042001b
jne 0x14041ffe6
movzx eax, word [rsi + rcx*8 + 4]
test r10w, dx
cmp ax, word [rdx + 4]
jne 0x14041ffe6
mov word [rsi + rcx*8 + 6], 0
xchg r10w, r10w
movsx r10w, r11b
mov r10b, sil
movzx r10d, word [rdx]
jmp 0x140420050
jmp 0x14041ffe6
pop rsi
jmp 0x14042005b
ret
Function at 0x14042943b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
seta sil
movsx rsi, r10w
sub rsp, 0x28
movsx rsi, bx
setns sil
mov rsi, rcx
test bx, r12w
movzx edi, dx
movzx edx, word [rcx + rdi*4 + 0x834]
test cx, r11w
test dx, dx
jmp 0x14042946f
js 0x140429482
mov rcx, rsi
jmp 0x14042947d
call fcn.14042943b
movsxd rcx, dword [rsi + 0x8860]
cmp ecx, dword [rsi + 0x8858]
jmp 0x140429494
jge 0x14042961d
movsxd rax, dword [rsi + 0x885c]
ror dh, 0x4e
add rax, rcx
and dl, 0x33
mov r8, qword [rsi + 8]
bsf cx, dx
xor ecx, 0x28766a79
shrd dx, r15w, 0xea
lea edx, [rax + 3]
inc rcx
test eax, eax
movsxd rcx, ebp
cmove cx, bx
not ch
cmovns edx, eax
shl cx, cl
mov rcx, qword [rsi + 0x18]
sar edx, 2
cmp spl, r15b
movsxd rdx, edx
mov byte [rcx + rdx], 1
mov rdx, qword [rsi + 0x8838]
cmc
movzx edi, byte [rsi + rdi*4 + 0x837]
cmp di, 0x58eb
cmp dil, r8b
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x140429508
jb 0x140429554
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
bsr cx, ax
cmc
movzx ecx, byte [rdx + rdi*4 + 1]
jmp 0x140429526
mov byte [r8 + rax + 1], cl
movzx ecx, di
bts rcx, rdi
movzx ecx, byte [rdx + rdi*4]
mov byte [r8 + rax + 2], cl
dec cx
movzx ecx, byte [rdx + rdi*4 + 3]
jmp 0x140429548
mov byte [r8 + rax + 3], cl
adc rax, 0x1d1b36b1
mov eax, dword [rsi + 0x885c]
clc
cmc
add eax, 4
cmc
mov dword [rsi + 0x885c], eax
jmp 0x14042956f
cmp eax, dword [rsi + 0x8854]
jl 0x14042961d
mov ecx, dword [rsi + 0x884c]
cmovo ax, r9w
cbw
mov eax, dword [rsi + 0x8858]
mov dword [rsi + 0x885c], ecx
sar cl, cl
mov ecx, dword [rsi + 0x8860]
add ecx, dword [rsi + 0x8844]
test cl, dil
mov dword [rsi + 0x8860], ecx
cmc
cmp ecx, eax
jmp 0x1404295b3
jl 0x14042961d
mov ecx, dword [rsi + 0x8840]
nop dword [rax]
test ecx, ecx
jle 0x14042961d
mov edx, dword [rsi + 0x8864]
cmc
shl edx, cl
test rdx, rdx
test r11b, 0x91
stc
mov dword [rsi + 0x8844], edx
cmc
sar edx, 1
stc
add edx, dword [rsi + 0x8850]
jmp 0x1404295f4
mov dword [rsi + 0x8860], edx
jmp 0x1404295ff
dec ecx
mov dword [rsi + 0x8840], ecx
cmp r11d, r8d
test esp, 0x48f94e04
cmp edx, eax
jmp 0x140429617
jge 0x1404295c6
add rsp, 0x28
bswap si
movsxd rsi, ecx
movsx rsi, ax
pop rdi
pop rsi
ret
Function at 0x14042bab9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
lahf
jmp 0x14042bac1
push rbx
cwde
sub rsp, 0x20
movsx si, r14b
rol ax, 0xd5
mov rsi, rcx
bsf rax, rdi
cdqe
shrd rax, r9, 0x5d
movzx eax, byte [rcx + 0x4828]
stc
cmp al, 0xff
jmp 0x14042baed
je 0x14042bb04
mov byte [rsi + 0x4828], 0xff
jmp 0x14042baff
jmp 0x14042bc24
mov rbx, qword [rsi]
rcl eax, 0xad
shl ax, 0x57
movsx ax, r15b
mov rax, qword [rbx + 0xc0]
clc
test r10b, bl
cmp rax, qword [rbx + 0xc8]
jmp 0x14042bb2a
jae 0x14042bb54
lea rcx, [rax + 1]
jmp 0x14042bb39
mov qword [rbx + 0xc0], rcx
movsx rcx, ax
not cx
movzx ecx, byte [rax]
jmp 0x14042bb4f
jmp 0x14042bc13
cmp dword [rbx + 0x30], 0
jmp 0x14042bb5d
je 0x14042bbcb
mov r8d, dword [rbx + 0x34]
movzx rdi, r11w
lea rdi, [rbx + 0x38]
movzx edx, ax
jmp 0x14042bb77
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
jmp 0x14042bb83
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
stc
sub ecx, dword [rbx + 0xd0]
stc
test al, 0x32
add dword [rbx + 0xb8], ecx
clc
test eax, eax
jmp 0x14042bba4
je 0x14042bbd2
cdqe
sar rcx, cl
shrd rcx, rax, 0xf8
add rax, rdi
movsx cx, r10b
bswap ecx
movzx ecx, byte [rdi]
jmp 0x14042bbc6
jmp 0x14042bbf2
mov al, 0xff
jmp 0x14042bc24
mov dword [rbx + 0x30], 0
sete al
cmc
lea rax, [rbx + 0x39]
cmc
jmp 0x14042bbe7
mov byte [rbx + 0x38], 0
cmc
test r10b, 0x6d
xor ecx, ecx
mov qword [rbx + 0xc8], rax
btr rax, 0xa2
and ax, 0x2ca7
lea rax, [rbx + 0x39]
mov qword [rbx + 0xc0], rax
or al, r12b
shl al, 0xd5
mov al, 0xff
cmc
cmp cl, 0xff
jmp 0x14042bc1e
je 0x14042bc5e
add rsp, 0x20
pop rbx
cmovl rdi, r15
movzx edi, ax
pop rdi
movsx si, dl
cmova si, cx
movzx esi, r14w
pop rsi
ret
lea rcx, [rax + 1]
stc
mov qword [rbx + 0xc0], rcx
test r15, r9
movzx eax, byte [rax]
cmp al, 0xff
jmp 0x14042bc58
jne 0x14042bc24
mov rbx, qword [rsi]
add ax, 0x641
lahf
mov rax, qword [rbx + 0xc0]
cmc
jmp 0x14042bc74
cmp rax, qword [rbx + 0xc8]
jb 0x14042bc3f
cmp dword [rbx + 0x30], 0
jmp 0x14042bc8a
je 0x14042bd57
mov r8d, dword [rbx + 0x34]
mov rdx, r12
cqo
lea rdi, [rbx + 0x38]
mov cl, r8b
xchg cl, ch
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
jmp 0x14042bcae
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
jmp 0x14042bcbd
sub ecx, dword [rbx + 0xd0]
stc
jmp 0x14042bcc9
add dword [rbx + 0xb8], ecx
test r12b, al
test r12w, 0x1043
test eax, eax
jmp 0x14042bcdf
je 0x14042bd04
movsxd rcx, eax
or eax, 0x423b3271
btc rax, 0
add rcx, rdi
lahf
nop
movzx eax, byte [rdi]
jmp 0x14042bcff
jmp 0x14042bd26
mov dword [rbx + 0x30], 0
lea rcx, [rbx + 0x39]
test rax, 0x4a996ed5
mov byte [rbx + 0x38], 0
test r14d, 0x22193225
cmc
cmp dh, 0x72
xor eax, eax
mov qword [rbx + 0xc8], rcx
xadd ch, cl
movzx ecx, cx
xor ecx, r9d
lea rcx, [rbx + 0x39]
test r15w, sp
mov qword [rbx + 0xc0], rcx
cmp al, 0xff
jmp 0x14042bd4c
je 0x14042bc5e
jmp 0x14042bc24
xor eax, eax
jmp 0x14042bc24
Function at 0x14043c594
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
cwde
movzx ax, bpl
xadd sil, al
push rdi
test dh, 0xf
sar esi, 0x13
push rbx
cwde
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm7
cmp r9b, 0xca
movaps xmmword [rsp + 0x70], xmm6
shrd rdi, r14, 0x69
dec esi
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx]
test r10b, 0x14
stc
cmp qword [rax + 0x18], 8
jmp 0x14043c5e1
jb 0x14043c5f1
mov rax, qword [rax]
dec r9
btc cx, di
movsxd rcx, r8d
bt r9, 0x19
sbb r9w, 0x7a5f
shld r9d, r12d, 0x87
lea r9, [rax + rcx*2]
bt ax, dx
add ax, r15w
cmc
sub ebx, ebx
shl rax, 0x29
sal rax, 0x9c
nop word cs:[rax + rax]
sub al, sil
shrd rax, rdi, 0xfe
cmc
movzx eax, word [r9 + rbx*2]
cmp eax, 0xa
jmp 0x14043c63e
je 0x14043c659
test eax, eax
je 0x14043c659
inc rbx
jmp 0x14043c654
jmp 0x14043c631
test byte [rdi + 0x1c], 4
jne 0x14043c7db
mov rcx, qword [rdi + 0x10]
movsx rax, bx
mov rax, qword [rdi + 8]
cmovo r8w, r8w
xchg r8w, r8w
movsd xmm0, qword [rax + 8]
movsd qword [rsp + 0x40], xmm0
movzx rdx, si
cmovbe r8w, r8w
mov dword [rsp + 0x30], ebx
movsx rdx, ax
movzx dx, bpl
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x38]
movsx r8d, r15w
setae r8b
lea r8, [rsp + 0x40]
jmp 0x14043c6c0
call fcn.1404433d6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movsx rdx, sp
cqo
mov dh, 0xda
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0
lahf
movsxd rdx, r12d
xchg cx, ax
mov rcx, qword [rsp + 0x38]
movsx eax, r10w
mov rax, qword [rcx]
movsx edx, r14w
cqo
lea rdx, [rsp + 0x40]
jmp 0x14043c705
call qword [rax + 0x1e0]
test eax, eax
jmp 0x14043c712
je 0x14043c73e
mov ecx, eax
movabs r8, 0xe31b45c42a775183
mov dl, spl
jmp 0x14043c72c
mov dl, 3
mov r9d, 0x4f
jmp 0x14043c739
call fcn.1403ad169
movss xmm6, dword [rsp + 0x4c]
movss xmm7, dword [rsp + 0x50]
lea rcx, [rsp + 0x38]
neg dh
lea rdx, [rsp + 0x40]
xor r8d, r8d
jmp 0x14043c75e
call fcn.14043cb5e
movss xmm0, dword [rdi + 0x18]
jmp 0x14043c76d
movss dword [rsi], xmm0
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
movss xmm0, dword [rsp + 0x50]
movsx ecx, r14w
shld cx, di, 0x7d
shl ch, cl
movss dword [rsi + 8], xmm0
test sil, r11b
btc cx, 0x22
sar ch, 0x7f
mov dword [rsi + 0xc], 0
sar cx, 0x76
movss dword [rsi + 0x10], xmm7
shr cx, cl
movzx rcx, sp
mov dword [rsi + 0x14], ebx
xor rcx, r9
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jmp 0x14043c7c5
je 0x14043c832
mov rax, qword [rcx]
jmp 0x14043c7d3
call qword [rax + 0x10]
jmp 0x14043c832
movss xmm0, dword [rdi + 0x18]
jmp 0x14043c7e5
movss dword [rsi], xmm0
cvtsi2ss xmm1, ebx
mulss xmm1, dword [0x1400bfc14]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
movss xmm0, dword [0x1400bfc94]
jmp 0x14043c80b
movlps qword [rsi + 8], xmm0
mov rax, qword [rdi + 8]
jmp 0x14043c818
movss xmm0, dword [rax + 0xc]
jmp 0x14043c822
addss xmm0, dword [0x1400bfbd0]
movss dword [rsi + 0x10], xmm0
mov dword [rsi + 0x14], ebx
movaps xmm6, xmmword [rsp + 0x70]
cmc
xadd di, bx
movaps xmm7, xmmword [rsp + 0x80]
sar bx, 0x38
add rsp, 0x90
movzx rbx, r11w
pop rbx
not sil
setbe sil
pop rdi
mov esi, 0x42bf3030
cmovg rsi, r12
movsxd rsi, eax
pop rsi
ret
Function at 0x14043d8d6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cmp spl, bpl
push r14
ror r15b, 0xc6
push rsi
rcl r15b, 0x8d
ror r15w, cl
push rdi
rcr r15, cl
clc
push rbp
push rbx
movzx ebx, di
movzx r14, r9w
sub rsp, 0x28
xor r15b, cl
bt r14d, r10d
mov r15d, r9d
rcl bpl, cl
mov ebp, r8d
neg r14w
rcl bl, cl
mov bh, 0xd0
mov r14, rdx
mov rbx, rcx
lea rcx, [rdx + 0x20]
sbb dh, ch
mov edx, r8d
rol r8, cl
or r8d, 0x7f4628e1
mov r8d, r9d
xor r9d, r9d
jmp 0x14043d939
call fcn.14043dafd
test r15d, r15d
jmp 0x14043d946
jle 0x14043d9ee
test rax, rax
je 0x14043d9ee
movsxd rsi, ebp
sub cl, bpl
rcl dh, 0x90
and dh, dh
mov ecx, r15d
btr edx, 0xc2
movzx dx, r13b
sub ebp, ebp
jmp 0x14043d973
mov rdx, rsi
jmp 0x14043d97b
jmp 0x14043d9a4
movzx edi, word [rdi + rdx*2]
jmp 0x14043d989
mov word [rax + rbp*2], di
inc rbp
jmp 0x14043d995
inc rdx
test r10b, r10b
cmp rcx, rbp
je 0x14043d9fb
mov di, 0x2a
cmp rsi, 0x3f914690
test r11b, 0x9d
stc
test byte [rbx + 0x1c], 4
jne 0x14043d989
mov rdi, qword [rbx]
cmc
cmp qword [rdi + 0x10], rdx
jmp 0x14043d9cb
jbe 0x14043daf2
cmp qword [rdi + 0x18], 8
jmp 0x14043d9db
jb 0x14043d980
mov rdi, qword [rdi]
jmp 0x14043d9e9
jmp 0x14043d980
movsxd rsi, ebp
jmp 0x14043d9fb
mov rbx, qword [rbx]
and cx, r12w
mov rdi, qword [rbx + 0x10]
cmp r15d, edi
and cl, 0x57
clc
mov rcx, rdi
cmp r14, 0x78db3caa
clc
jmp 0x14043da1d
sub rcx, rsi
jmp 0x14043da25
jb 0x14043daf2
movsxd rax, r15d
cmp spl, bpl
clc
jmp 0x14043da37
cmp rcx, rax
jmp 0x14043da3f
cmovb rax, rcx
cmp qword [rbx + 0x18], 8
movsx cx, dil
mov rcx, rbx
jb 0x14043da65
mov rcx, qword [rbx]
sar dl, cl
sar dh, 0x71
sub rbp, 0x6e1b1d0d
lea rcx, [rcx + rsi*2]
ror bp, 0x3b
shr bpl, cl
sub rdi, rax
mov rbp, rdi
rcl dl, 0x14
sub rbp, rsi
jmp 0x14043da85
lea rdx, [rcx + rax*2]
lea r8, [rbp + 2]
add r8, rbp
jmp 0x14043da99
call fcn.1404a0bfe
mov qword [rbx + 0x10], rdi
add si, di
shrd r15, rsp, 0x4f
test eax, 0x1b7c1818
mov byte [r14 + 0x16], 0
add rsp, 0x28
mov bx, cx
movzx r14, bp
pop rbx
movsxd r14, r15d
movsx r15d, sp
jmp 0x14043dacc
pop rbp
cmovl r14w, r15w
pop rdi
xchg r14w, r14w
pop rsi
jmp 0x14043dae0
pop r14
movzx r15, r14w
mov r15w, ax
pop r15
jmp 0x14043daf1
ret
call fcn.14043cf38
int3
Function at 0x140441b51
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x140441b5a
movzx ecx, cx
jmp 0x140441b62
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
clc
cmp eax, 0x100
setae al
jmp 0x140441b7b
add rsp, 0x28
jmp 0x140441b84
ret
Function at 0x1404432c2
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
cwde
cmovo ax, ax
mov rcx, qword [rcx]
cdqe
movsx eax, sp
mov rax, qword [rcx]
jmp 0x1404432db
call qword [rax + 0x28]
test eax, eax
jmp 0x1404432e5
je 0x140443322
mov ecx, eax
movabs r8, 0xcafa59766d7f94e
xchg r9b, r9b
mov dl, 3
rcl r9d, cl
sbb r9w, ax
bsr r9w, r8w
mov r9d, 0x2a
test edx, 0x3d8d139e
add rsp, 0x28
jmp 0x14044331d
jmp fcn.1403ad169
nop
stc
cmp si, 0x71ec
add rsp, 0x28
jmp 0x140443332
ret

Function at 0x140443d97
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
movzx r14d, r10w
bts ax, sp
not eax
push rsi
rcl ax, cl
push rdi
bsf r14w, r11w
push rbx
mov r14b, 0
sub rsp, 0x58
not al
movzx r14w, r8b
movzx rax, r10w
mov rax, r9
mov r14, rdx
mov r9d, dword [rsp + 0xa0]
jmp 0x140443dd3
movd xmm0, r8d
shr r8, 0x20
jmp 0x140443de1
movd xmm1, r8d
mov qword [rdx], 0
cvttss2si r8d, xmm1
test r8d, r8d
jmp 0x140443dfa
jle 0x140443f1b
cvttss2si r10d, xmm0
xor r11d, r11d
movss xmm2, dword [0x1400bf4c0]
cmp r11b, 0x6f
cmc
xor ebx, ebx
jmp 0x140443e3d
inc ebx
cmp r12b, 0x7b
test ah, 0x1e
stc
add r11d, r9d
test r15d, r9d
cmp r15d, esi
cmp ebx, r8d
jmp 0x140443e37
je 0x140443f1b
mov rsi, r10
mov edx, r11d
test bpl, 0x13
test r10d, r10d
jg 0x140443ed7
jmp 0x140443e1c
movzx edi, dil
jmp 0x140443e5e
xorps xmm3, xmm3
cvtsi2ss xmm3, edi
divss xmm3, xmm2
movzx edi, byte [rax + rdx]
jmp 0x140443e72
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx], dil
movzx edi, byte [rax + rdx + 1]
jmp 0x140443e8f
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 1], dil
movsx di, al
movzx edi, byte [rax + rdx + 2]
jmp 0x140443eb1
xorps xmm4, xmm4
cvtsi2ss xmm4, edi
mulss xmm4, xmm3
cvttss2si edi, xmm4
mov byte [rax + rdx + 2], dil
cmc
add edx, 4
dec rsi
jmp 0x140443ed1
je 0x140443e1c
mov edx, edx
btc rdi, 0xe2
dec edi
shr edi, 0x8e
movzx edi, byte [rax + rdx + 3]
cmp edi, 0xff
jmp 0x140443ef3
je 0x140443ec6
test edi, edi
jmp 0x140443f00
jne 0x140443e55
mov byte [rax + rdx + 2], 0
jmp 0x140443f10
mov word [rax + rdx], 0
jmp 0x140443ec6
mov rcx, qword [rcx + 0x18]
movsx dx, r13b
movabs rdx, 0x10000001c
jmp 0x140443f33
mov qword [rsp + 0x38], rdx
jmp 0x140443f3d
movsd xmm2, qword [0x1400bfee0]
movsd qword [rsp + 0x40], xmm2
mov dword [rsp + 0x48], 0
jmp 0x140443f58
mov qword [rsp + 0x50], 0
cvttss2si rbx, xmm1
cvttss2si rdx, xmm0
shl rbx, 0x20
sbb r8b, r15b
xor r8b, r14b
mov edx, edx
sar r8, 0xb3
xadd r8b, r8b
or rdx, rbx
setg r8b
xchg bl, dil
mov rbx, qword [rcx]
mov qword [rsp + 0x28], r14
not di
lea rdi, [rsp + 0x38]
jmp 0x140443fa7
mov qword [rsp + 0x20], rdi
movsx r8d, bx
movsxd r8, ebp
movsx r8w, r12b
mov r8, rax
call qword [rbx + 0x1c8]
test eax, eax
jmp 0x140443fc8
je 0x140443ff3
mov ecx, eax
movabs r8, 0xad4a5352d2edebd0
movsxd r9, r11d
mov dl, 3
movsx r9d, bp
mov r9d, 0xd4
jmp 0x140443fee
call fcn.1403ad169
mov rax, r14
btc edi, 0x94
shl r14b, cl
sub rdi, 0x536b7a1e
add rsp, 0x58
sete r14b
movsx si, bl
pop rbx
pop rdi
pop rsi
movsx r14, dx
pop r14
jmp 0x14044401e
ret
Function at 0x14044620e
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
movsxd rax, r13d
mov eax, 0x5a4d
cmc
stc
cmp word [0x140000000], ax
jne 0x14044633c
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
cmp sil, bl
stc
add rcx, rdx
cmp r11w, bp
cmp ah, 0x6a
cmp dword [rcx], 0x4550
jmp 0x140446253
jne 0x14044633c
mov eax, 0x20b
test r12b, r11b
cmc
cmp word [rcx + 0x18], ax
jmp 0x14044626b
jne 0x14044633c
sub r8, rdx
movzx edx, word [rcx + 0x14]
bts rax, rdi
stc
add rdx, 0x18
btc eax, r15d
lea rdx, [rdx + rcx]
ror r9b, 0x19
movzx eax, word [rcx + 6]
btr cx, 0x9e
lea rcx, [rax + rax*4]
sar r9w, 0xa7
setbe r9b
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
test sil, r13b
cmp rdx, r9
je 0x1404462fd
mov ecx, dword [rdx + 0xc]
test dil, 0x2b
jmp 0x1404462c3
cmp r8, rcx
jmp 0x1404462cb
jb 0x1404462f4
mov eax, dword [rdx + 8]
test rax, 0x430937c3
test esi, edi
add eax, ecx
test r10b, 0x33
clc
test rax, r11
cmp r8, rax
jmp 0x1404462ee
jb 0x140446300
add rdx, 0x28
jmp 0x1404462a7
xor edx, edx
stc
test rdx, rdx
jmp 0x140446308
jne 0x14044631a
xor al, al
jmp 0x140446315
jmp 0x140446351
cmp dword [rdx + 0x24], 0
jmp 0x140446323
jge 0x140446330
sub al, al
jmp 0x140446351
mov al, 1
jmp 0x140446337
jmp 0x140446351
xor al, al
jmp 0x140446343
jmp 0x140446351
add rsp, 0x18
jmp 0x14044635a
ret

Function at 0x140457bf1
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsx rcx, cx
mov rcx, 0x565127bd
lea rcx, [rsp + 0x30]
jmp 0x140457c0a
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
jmp 0x140457c1a
add rsp, 0x28
ret