joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403caa4d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bt r15w, r8w
push r14
cmp rax, rax
test bl, 0x49
movzx r15w, bpl
push r13
push r12
push rsi
shr r15d, cl
push rdi
ror r14, 0x68
push rbx
and r14b, cl
not r12
sub rsp, 0x30
adc r13w, 0x4360
shl r14d, cl
inc r12b
movaps xmmword [rsp + 0x20], xmm6
movzx r12w, bpl
mov r15, r9
bt esi, 0x8d
mov r12, r8
sal r13w, 0xaa
movsx r13, r11w
xchg r14b, r13b
mov r14, rdx
xadd r13b, r13b
setg r13b
add r13b, dil
mov r13, rcx
bts si, ax
mov rsi, qword [rcx]
test rsi, rsi
jmp 0x1403caac5
je 0x1403cac0c
mov rbx, qword [r13 + 8]
jmp 0x1403caad4
cmp rsi, rbx
je 0x1403cabb5
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403caae9
jmp 0x1403cab0b
call fcn.14027cd22
movups xmmword [rsi + 0x10], xmm6
clc
mov word [rsi], 0
stc
add rsi, 0x20
cmp rsi, rbx
je 0x1403caba9
mov rax, qword [rsi + 0x18]
cmp rsi, 0x78e83d02
cmp rax, 8
jmp 0x1403cab1f
jb 0x1403caaf3
mov rcx, qword [rsi]
ror dl, cl
lea rdx, [rax + rax]
cmp dil, 0xa0
jmp 0x1403cab3a
add rdx, 2
test cl, spl
test dx, 0x6d25
cmp rdx, 0x1000
jmp 0x1403cab52
jb 0x1403caaee
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp spl, cl
test eax, edi
sub rcx, rdi
cmp bp, r9w
clc
cmp rcx, 0x20
jmp 0x1403cab76
jae 0x1403cac98
lea rax, [rax + rax]
add dh, dl
cqo
add rax, 0x29
not cl
cqo
movzx edx, sp
mov rdx, rax
movsx ecx, di
movzx rcx, r10w
movsxd rcx, eax
mov rcx, rdi
jmp 0x1403caba4
jmp 0x1403caaee
mov rsi, qword [r13]
test ch, 0xe6
btc dx, r15w
mov rdx, qword [r13 + 0x10]
cmp rbx, r10
test r15w, ax
sub rdx, rsi
stc
jmp 0x1403cabc9
cmp rdx, 0x1000
jb 0x1403cabff
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
cmp r15b, r8b
sub rsi, rax
test bl, 0xfa
cmp rsi, 0x20
jmp 0x1403cabf0
jae 0x1403cac98
add rdx, 0x27
mov rsi, rax
xchg cl, ch
mov rcx, rsi
jmp 0x1403cac07
call fcn.14027cd22
mov qword [r13], r14
shl bl, cl
btr esi, r8d
shl r12, 5
movsx rdi, r14w
add r12, r14
xor bx, 0x2ac0
mov qword [r13 + 8], r12
sal bh, 0xa1
xchg dil, sil
rol sil, 0xe5
shl r15, 5
bt edi, ebp
clc
shl rsi, cl
add r15, r14
sar rbx, 0x77
bswap si
mov qword [r13 + 0x10], r15
movaps xmm6, xmmword [rsp + 0x20]
or sil, 0xa6
cmovle r14w, r9w
shl r13b, cl
add rsp, 0x30
mov r14b, 0x97
pop rbx
mov r13b, r10b
xchg dil, r15b
setnp r13b
pop rdi
mov r14w, r14w
pop rsi
movzx r15, bx
xchg r13b, r13b
cmovl r14d, eax
pop r12
pop r13
pop r14
movsx r15w, r8b
movzx r15, r9w
pop r15
jmp 0x1403cac97
ret
call fcn.1404b346a
int3
Function at 0x1403e1610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r8w, 0x6790
push r14
cmp r8b, cl
stc
test r8b, dil
push rsi
clc
jmp 0x1403e1628
push rdi
test r12b, r12b
add dil, bl
push rbx
sub rsp, 0x30
sar dil, cl
movaps xmmword [rsp + 0x20], xmm6
and dil, 0xb7
sbb edi, 0x6fa37754
xor di, r15w
mov rdi, qword [rcx]
cmc
test rdi, rdi
jmp 0x1403e1656
je 0x1403e17ce
mov r14, rcx
bsr bx, r10w
xchg bl, bh
movsx rbx, r9w
mov rbx, qword [rcx + 8]
stc
cmp rdi, rbx
jmp 0x1403e1677
je 0x1403e175f
lea r15, [0x1400bed30]
jmp 0x1403e1689
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e1695
jmp 0x1403e16d8
call fcn.14027cd22
movups xmmword [rdi + 0x20], xmm6
cmp rbx, 0x101a41e1
clc
test rsp, 0x1a7a7b2f
mov byte [rdi + 0x10], 0
cmp dl, r8b
cmp r12d, 0x29d5412b
add rdi, 0x38
jmp 0x1403e16ca
cmp rdi, rbx
jmp 0x1403e16d2
je 0x1403e1754
mov qword [rdi], r15
jmp 0x1403e16e0
mov rax, qword [rdi + 0x28]
stc
test ebp, r8d
cmp rax, 0x10
jmp 0x1403e16f1
jb 0x1403e169f
mov rcx, qword [rdi + 0x10]
inc edx
shr edx, cl
lea rdx, [rax + 1]
stc
clc
cmp bx, r8w
cmp rdx, 0x1000
jmp 0x1403e1715
jb 0x1403e169a
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
jmp 0x1403e1729
sub rcx, rsi
cmp rcx, 0x20
jmp 0x1403e1735
jae 0x1403e1802
add rax, 0x28
mov rdx, rax
cmovg cx, r12w
mov cl, 0xa5
movzx ecx, sp
mov rcx, rsi
jmp 0x1403e169a
mov rdi, qword [r14]
movsx dx, r15b
rcl rdx, cl
mov rdx, qword [r14 + 0x10]
sub rdx, rdi
cmc
cmp rdx, 0x1000
jmp 0x1403e1773
jb 0x1403e17af
mov rax, qword [rdi - 8]
clc
add rdi, 0xfffffffffffffff8
test cx, 0x3598
cmc
sub rdi, rax
stc
cmp r13b, 0x62
cmp rdi, 0x20
jae 0x1403e1802
add rdx, 0x27
movsx di, r12b
sets dil
mov rdi, rax
movzx cx, bpl
mov rcx, rdi
jmp 0x1403e17b7
call fcn.14027cd22
xorps xmm0, xmm0
movups xmmword [r14], xmm0
sub r15b, dil
mov qword [r14 + 0x10], 0
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
movsx bx, spl
movsx edi, r11w
bswap r14w
pop rbx
movzx rdi, bp
movzx edi, r15w
xchg esi, esi
pop rdi
pop rsi
pop r14
movsx r15d, r8w
movsxd r15, r11d
pop r15
jmp 0x1403e1801
ret
call fcn.1404b346a
int3
Function at 0x1403e4265
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
shrd r15w, ax, 0xda
clc
movsx r15w, r9b
push r14
push r13
btr r13w, 0xaf
push r12
push rsi
push rdi
adc r14b, 0xc1
rcr r14b, 0xbf
shr r15b, cl
push rbp
shr r12b, 0x3e
movsxd r15, r9d
push rbx
clc
inc r14d
and r13b, r9b
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
bsr r14d, ecx
xchg bx, r14w
mov r14, r9
mov r15, r8
shr r13d, cl
sar r12, 0x74
mov r12, rdx
mov r13, rcx
cmp r10b, sil
xor bl, 0xc6
mov rbx, qword [rcx]
stc
test r14b, 0xac
test rbx, rbx
jmp 0x1403e42d6
je 0x1403e4414
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403e42e8
je 0x1403e43b2
lea rbp, [0x1400bed10]
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e4301
jmp 0x1403e4330
call fcn.14027cd22
movups xmmword [rbx + 0x20], xmm6
mov byte [rbx + 0x10], 0
cmc
add rbx, 0x50
cmp dil, 0x9b
jmp 0x1403e4322
cmp rbx, rdi
jmp 0x1403e432a
je 0x1403e43ac
mov qword [rbx], rbp
lea rcx, [rbx + 0x38]
jmp 0x1403e433c
call fcn.1403e1610
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jmp 0x1403e434e
jb 0x1403e430b
mov rcx, qword [rbx + 0x10]
bt edx, r14d
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403e436c
jb 0x1403e4306
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmc
sub rcx, rsi
test r14w, dx
cmp ch, 0xda
cmp rcx, 0x20
jae 0x1403e44c5
add rax, 0x28
mov ecx, 0x3351bb2
movzx ecx, r11w
mov rdx, rax
xchg cl, ch
movsx ecx, si
mov rcx, rsi
jmp 0x1403e4306
mov rbx, qword [r13]
shl dl, cl
mov rdx, qword [r13 + 0x10]
clc
cmc
sub rdx, rbx
test bl, 0x19
clc
cmp rdx, 0x1000
jmp 0x1403e43cb
jb 0x1403e4407
mov rax, qword [rbx - 8]
cmp r9w, 0x2c
add rbx, 0xfffffffffffffff8
test dx, 0x4959
cmp r8, rcx
stc
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403e43f4
jae 0x1403e44c5
add rdx, 0x27
movsx rbx, r10w
mov rbx, rax
not cl
mov rcx, rbx
jmp 0x1403e440f
call fcn.14027cd22
mov qword [r13], r12
dec dil
cdqe
lea rax, [r15 + r15*4]
shl rax, 4
bsf bp, r12w
rcr dil, 0x1e
shrd di, r10w, 0x87
add rax, r12
rcl rbx, 0xa0
sub sil, r13b
rcr dil, cl
mov qword [r13 + 8], rax
or al, r12b
sal edi, 0x88
shr bl, cl
lea rax, [r14 + r14*4]
movzx edi, r11w
shl rax, 4
not r14b
ror edi, 0xfa
add rax, r12
mov bp, r14w
adc di, 0xde6
movsxd r15, esp
mov qword [r13 + 0x10], rax
bt esi, r9d
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
mov r15b, 0x73
pop rbp
movsx r14d, sp
movzx r15w, sil
mov sil, r12b
pop rdi
movzx r12, r12w
pop rsi
movsx r12d, si
pop r12
movsxd r15, r12d
not r15
movsx r15, cx
pop r13
mov r15b, cl
movsx r15d, bp
movzx r15, r10w
pop r14
movzx r15d, r14w
bswap r15w
mov r15w, 0x58d1
pop r15
ret
call fcn.1404b346a
int3
Function at 0x1403f33ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
shr r14, cl
shrd r14, rcx, 0x13
push r12
push rsi
bts r14w, si
push rdi
mov r14d, 0xda93a76
movsxd r14, r11d
rcl r14b, 0x73
push rbx
or r14b, bpl
xchg r14b, r14b
dec r14b
sub rsp, 0x28
setae r14b
add r14w, 0x7c81
and r14b, 0x9b
mov r14, r8
test rdx, rdx
jmp 0x1403f3413
je 0x1403f360f
mov rdi, rdx
xadd r12b, r12b
ror r12, cl
shrd r12w, r15w, 0x62
mov r12, rcx
clc
stc
xor ebx, ebx
jmp 0x1403f3435
jmp 0x1403f3464
mov rcx, r15
mov dh, 0xd6
mov dx, r11w
cdq
mov rdx, rsi
call fcn.1403b8645
add rbx, 0x50
jmp 0x1403f3456
dec rdi
jmp 0x1403f345e
je 0x1403f3608
mov eax, dword [r12 + rbx + 8]
cmp r11w, 0x3de0
test al, bl
mov dword [r14 + rbx + 8], eax
cmp r14b, dil
jmp 0x1403f347e
cmp r14, r12
jmp 0x1403f3486
je 0x1403f344d
cmp qword [r12 + rbx + 0x28], 0x10
jb 0x1403f34a7
mov r9, qword [r12 + rbx + 0x10]
jmp 0x1403f34a2
jmp 0x1403f34c2
lea r9, [r12 + rbx]
bsr ax, bp
or sil, r15b
add r9, 0x10
bt ax, r9w
xor ax, 0x59be
add sil, al
lea r15, [r14 + rbx]
adc sil, r12b
add r15, 0x10
jmp 0x1403f34da
mov rsi, qword [r12 + rbx + 0x20]
mov rax, qword [r14 + rbx + 0x28]
stc
cmc
cmp rax, rsi
jmp 0x1403f34ee
jae 0x1403f3513
mov rcx, r15
jmp 0x1403f3501
mov rdx, rsi
jmp 0x1403f3509
call fcn.1403b8645
jmp 0x1403f3558
cmp rax, 0x10
jmp 0x1403f351c
jb 0x1403f352e
mov r15, qword [r14 + rbx + 0x10]
seto dl
movsx r8d, r15w
mov qword [r14 + rbx + 0x20], rsi
movsxd r8, r13d
mov rcx, r15
movsx r8w, r14b
mov rdx, r9
jmp 0x1403f3546
mov r8, rsi
call fcn.1404a0a3f
mov byte [r15 + rsi], 0
clc
movzx esi, r9w
mov rsi, qword [r12 + rbx + 0x40]
test r15b, cl
cmc
cmp qword [r12 + rbx + 0x48], 0x10
jmp 0x1403f356c
jb 0x1403f3581
mov r9, qword [r12 + rbx + 0x30]
jmp 0x1403f357c
jmp 0x1403f359a
lea r9, [r12 + rbx]
bt r15d, 0xfa
cdqe
rcr ax, cl
add r9, 0x30
sar ah, cl
shrd ax, cx, 0x8c
lea r15, [r14 + rbx]
btc ax, r14w
add r15, 0x30
mov rax, qword [r14 + rbx + 0x48]
cmc
clc
cmp rax, rsi
jmp 0x1403f35b6
jb 0x1403f343a
cmp rax, 0x10
jb 0x1403f35cb
mov r15, qword [r14 + rbx + 0x30]
mov qword [r14 + rbx + 0x40], rsi
movsxd r8, eax
mov rcx, r15
not dl
movsx r8, r9w
mov rdx, r9
mov r8w, 0xd64
movzx r8d, r13w
movsx r8d, r14w
mov r8, rsi
jmp 0x1403f35f4
call fcn.1404a0a3f
mov byte [r15 + rsi], 0
jmp 0x1403f3603
jmp 0x1403f344d
lea r14, [r14 + rbx]
rol rax, cl
mov rax, r14
cmovnp r15d, r11d
bts r12w, cx
shl r12b, 0x74
add rsp, 0x28
movsx r12, r11w
movzx r12, r9w
pop rbx
movzx r12w, r11b
movsx di, spl
mov r12b, 0x30
pop rdi
mov si, r9w
movzx r14, r14w
movzx r12d, bp
pop rsi
pop r12
movsx r15, si
bswap r14w
movzx r14, r12w
pop r14
movzx r15w, r10b
mov r15d, 0x6a2b560c
pop r15
jmp 0x1403f3669
ret
Function at 0x1403f42b5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
test r11b, bl
test r15b, 0x42
jmp 0x1403f42c4
push rdi
shrd edi, esp, 0x8d
movzx edi, bx
sar di, 0x72
push rbx
sub rsp, 0x38
cmp bpl, r8b
xadd di, di
movaps xmmword [rsp + 0x20], xmm6
mov rdi, qword [rcx]
test rdi, rdi
je 0x1403f4432
mov r14, rcx
adc bh, 0xfd
rol bh, cl
mov rbx, qword [rcx + 8]
cmp r11b, r11b
cmp rdi, rbx
jmp 0x1403f4304
je 0x1403f43ba
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f4316
jmp 0x1403f434d
call fcn.14027cd22
movups xmmword [rdi + 0x10], xmm6
test sp, 0x5e04
jmp 0x1403f4331
mov byte [rdi], 0
test ah, 0x96
add rdi, 0x20
test r11, rbp
cmc
cmp rdi, rbx
jmp 0x1403f4347
je 0x1403f43b7
mov rax, qword [rdi + 0x18]
cmp rax, 0x10
jmp 0x1403f435a
jb 0x1403f4320
mov rcx, qword [rdi]
lea rdx, [rax + 1]
cmp dl, dil
cmp rdx, 0x1000
jmp 0x1403f4376
jb 0x1403f431b
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
test dl, al
sub rcx, rsi
cmp r9b, 0x40
test r8d, 0x2ae760a3
cmp rcx, 0x20
jmp 0x1403f439d
jae 0x1403f446a
add rax, 0x28
mov rdx, rax
mov rcx, rsi
jmp 0x1403f43b2
jmp 0x1403f431b
mov rdi, qword [r14]
mov rdx, qword [r14 + 0x10]
stc
sub rdx, rdi
cmp r8d, edi
cmp rdx, 0x1000
jb 0x1403f440b
mov rax, qword [rdi - 8]
cmp r8b, bpl
jmp 0x1403f43de
add rdi, 0xfffffffffffffff8
test r12b, 0x35
sub rdi, rax
test al, 0x52
cmc
cmp rdi, 0x20
jae 0x1403f446a
add rdx, 0x27
mov rdi, rax
movsx cx, sil
movzx cx, r8b
movzx rcx, r8w
mov rcx, rdi
jmp 0x1403f4413
call fcn.14027cd22
xorps xmm0, xmm0
movups xmmword [r14], xmm0
xor dil, 0xf6
sub rbx, 0x8dc250b
mov qword [r14 + 0x10], 0
movaps xmm6, xmmword [rsp + 0x20]
neg dil
add rsp, 0x38
movzx edi, r12w
jmp 0x1403f444a
pop rbx
movzx si, bl
jmp 0x1403f4457
pop rdi
pop rsi
movzx r14w, dl
not r14w
pop r14
jmp 0x1403f4469
ret
call fcn.1404b346a
int3
Function at 0x140429428
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
clc
push r14
and r14b, bpl
push r12
cmp r14d, 0x59632597
shld r15w, r11w, 0x1d
sbb r14w, r13w
push rsi
btr r15, r14
push rdi
sbb dil, r8b
btc edi, 0x8c
bt rdi, 0xf3
push rbp
or r12w, r11w
push rbx
cmc
ror ebx, 0x3b
sub rsp, 0x20
cmp sil, sil
rcl r12, 0x19
mov r12, r8
add dil, 0x2b
movzx bx, dil
add ebp, r10d
mov edi, edx
inc r15
ror bl, cl
mov rbx, rcx
sbb r15w, sp
lea r14, [rcx + 0x38]
cmovge bp, bx
or bp, 0x4f2
lea r15, [rcx + 0x39]
shl bp, 0xe6
rcl bpl, cl
sal rbp, cl
mov ebp, 0x80
sub esi, esi
jmp 0x1404294ae
jmp 0x1404294ec
lea rcx, [rax + 1]
mov qword [rbx + 0xc0], rcx
jmp 0x1404294c3
movzx eax, byte [rax]
jmp 0x1404294cb
mov byte [r12 + rsi], al
jmp 0x1404294d4
inc rsi
clc
shr ebp, 1
cmp cl, spl
cmp rsi, 4
jmp 0x1404294e6
je 0x14042964f
test ebp, edi
jmp 0x1404294f3
je 0x1404294d4
cmp qword [rbx + 0x10], 0
jmp 0x140429503
je 0x14042952c
mov rcx, qword [rbx + 0x28]
jmp 0x140429512
call qword [rbx + 0x20]
test eax, eax
jmp 0x14042951c
je 0x1404295c4
cmp dword [rbx + 0x30], 0
je 0x140429645
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
cmp rax, rcx
jmp 0x140429542
jae 0x140429645
cmp rax, rcx
jmp 0x140429550
jb 0x1404294b3
cmp dword [rbx + 0x30], 0
jmp 0x14042955f
je 0x1404295ef
mov r8d, dword [rbx + 0x34]
not ecx
jmp 0x140429574
mov rcx, qword [rbx + 0x28]
mov rdx, r14
jmp 0x140429580
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
cmc
test spl, 0xe6
cmp rsp, r14
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
jmp 0x1404295a3
test eax, eax
je 0x1404295f6
movsxd rcx, eax
xor al, r13b
dec rax
inc ah
add rcx, r14
xchg al, ah
movzx eax, byte [r14]
jmp 0x140429628
mov rax, qword [rbx + 0xc0]
movsx rcx, cx
cmp cl, 0xad
sbb cl, r11b
mov rcx, qword [rbx + 0xc8]
cmp rax, rcx
jmp 0x1404295e4
jae 0x140429556
jmp 0x1404294b3
xor eax, eax
jmp 0x1404294cb
mov dword [rbx + 0x30], 0
rcl rcx, cl
rcl ecx, 0x52
shl ecx, 0x6c
mov byte [rbx + 0x38], 0
shr ch, 0x19
shrd cx, bx, 0xeb
xor eax, eax
jmp 0x140429620
mov rcx, r15
jmp 0x140429628
mov qword [rbx + 0xc8], rcx
jmp 0x140429634
mov qword [rbx + 0xc0], r15
jmp 0x140429640
jmp 0x1404294cb
sub r12d, r12d
movzx r14, di
mov di, sp
mov rax, r12
add rsp, 0x20
setle dil
pop rbx
movsxd r15, r9d
movzx bp, r8b
pop rbp
movsx r12d, cx
xchg r14b, r15b
movzx r12, r13w
pop rdi
movzx esi, r13w
mov r12b, r14b
pop rsi
mov r15b, 0x1f
xchg r14b, r14b
movsx r15, r11w
pop r12
pop r14
jmp 0x14042968b
pop r15
ret
Function at 0x140432675
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
shr r15, 0x6f
neg r15w
push rdi
bt r15d, 0x2c
movzx r15d, r11w
push rbx
sub rsp, 0x20
movsx r15d, bp
bswap r15w
movzx r15, r11w
mov r15, rcx
jmp 0x1404326a5
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
ror rbx, cl
xor al, 0xae
btr eax, 0x6d
mov rcx, qword [rdx + 8]
sbb bx, r13w
mov rax, qword [rdx]
ror bx, 0x46
movzx ebx, r13w
bt ebx, ecx
mov rbx, rcx
clc
sub rbx, rax
cmc
jmp 0x1404326df
sub rcx, rax
jmp 0x1404326e7
je 0x1404327f9
js 0x14043283d
mov r14, rdx
test r12b, r8b
jmp 0x1404326fe
sar rbx, 6
jmp 0x14043270c
cmp rcx, 0xfc1
jmp 0x140432718
jb 0x140432752
or rcx, 0x27
jmp 0x140432727
call fcn.140445336
lea rdi, [rax + 0x27]
test esp, 0x6544471
jmp 0x14043273b
and rdi, 0xffffffffffffffe0
jmp 0x140432744
mov qword [rdi - 8], rax
jmp 0x14043274d
jmp 0x14043275a
call fcn.140445336
mov rdi, rax
mov qword [r15], rdi
mov qword [r15 + 8], rdi
bts si, bx
shrd rsi, rdi, 0x97
shl rbx, 6
add rbx, rdi
mov qword [r15 + 0x10], rbx
movsx bx, dh
movsx esi, r8w
mov rbx, qword [r14]
movsx esi, r9w
mov rsi, qword [r14 + 8]
jmp 0x14043279d
add rdi, 0x40
test sp, 0xc95
add rbx, 0x40
test dl, spl
cmp rbx, rsi
jmp 0x1404327a5
je 0x1404327f2
mov qword [rdi + 0x38], 0
not rcx
movsx cx, r11b
shl cl, cl
mov rcx, qword [rbx + 0x38]
clc
test cl, r9b
test rcx, rcx
jmp 0x1404327cd
je 0x14043278d
mov rax, qword [rcx]
movsx rdx, r10w
mov rdx, rdi
jmp 0x1404327e2
call qword [rax]
mov qword [rdi + 0x38], rax
jmp 0x1404327ed
jmp 0x14043278d
mov qword [r15 + 8], rdi
shr eax, 0x12
mov rax, r15
rcl r15b, 0xcf
shl di, 0x4e
add rsp, 0x20
xchg dil, r14b
pop rbx
xchg r15b, sil
movsx r14d, r14w
pop rdi
not r14w
movzx rsi, di
movsx si, r8b
pop rsi
mov r15w, si
movsx r15w, dil
movsx r14d, r9w
pop r14
movzx r15d, r8w
pop r15
jmp 0x14043283c
ret
call fcn.1403b8f7f
int3
Function at 0x14043d5ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
clc
push r14
neg r14b
bsr r14w, r13w
cmp r14, 0x7a630635
push rsi
sal r15, 0xb5
movsx r15d, r9w
xchg r14, r15
push rdi
test al, r8b
inc r15b
movsx r14d, r11w
push rbp
or r14w, 0x491f
rcl bpl, cl
push rbx
rol r14b, 0x3e
xadd r15b, bl
xchg r15b, r15b
sub rsp, 0x28
mov r15d, r9d
mov ebp, r8d
mov r14, rdx
btc bx, r9w
btr ebx, 0xea
movsx rbx, r11w
mov rbx, rcx
sbb cl, 0x8e
or ecx, r12d
lea rcx, [rdx + 0x20]
mov edx, r8d
mov r8d, r9d
sub r9d, r9d
call fcn.14043d803
test r15d, r15d
jmp 0x14043d648
jle 0x14043d6ec
test rax, rax
jmp 0x14043d656
je 0x14043d6ec
movsxd rsi, ebp
bt edx, esi
test al, 0
mov ecx, r15d
adc dl, 0x57
adc dl, r10b
movsxd rdx, edi
sub ebp, ebp
cwd
mov rdx, rsi
jmp 0x14043d67c
jmp 0x14043d6a7
movzx edi, word [rdi + rdx*2]
mov word [rax + rbp*2], di
jmp 0x14043d68e
inc rbp
jmp 0x14043d696
inc rdx
cmp rcx, rbp
jmp 0x14043d6a1
je 0x14043d6f9
mov di, 0x2a
test byte [rbx + 0x1c], 4
jmp 0x14043d6b4
jne 0x14043d685
mov rdi, qword [rbx]
test esp, r13d
cmp qword [rdi + 0x10], rdx
jmp 0x14043d6c9
jbe 0x14043d7f8
cmp qword [rdi + 0x18], 8
jmp 0x14043d6d9
jb 0x14043d681
mov rdi, qword [rdi]
jmp 0x14043d6e7
jmp 0x14043d681
movsxd rsi, ebp
ror di, cl
xor rcx, 0x70177ff5
mov rbx, qword [rbx]
sar dil, cl
movzx ecx, cx
btr cx, r10w
mov rdi, qword [rbx + 0x10]
movsxd rcx, esp
mov rcx, rdi
cmp esi, 0x360b0b05
sub rcx, rsi
jmp 0x14043d71f
jb 0x14043d7f8
movsxd rax, r15d
cmp rcx, rax
jmp 0x14043d730
cmovb rax, rcx
bsf ecx, ecx
jmp 0x14043d73c
cmp qword [rbx + 0x18], 8
movsxd rcx, edi
mov rcx, rbx
jmp 0x14043d74c
jb 0x14043d761
mov rcx, qword [rbx]
xadd rdx, r8
movzx ebp, r8w
cmovp rdx, rsp
lea rcx, [rcx + rsi*2]
rcr dl, 0x7f
rol r8b, cl
shl dl, 0x72
sub rdi, rax
sbb r8b, cl
sal r8, cl
mov rbp, rdi
cwd
btr r8d, r13d
shl r8b, cl
sub rbp, rsi
ror dx, 0x4d
not dl
lea rdx, [rcx + rax*2]
bt r8w, bx
cmp r9w, 0x1925
sar r8b, cl
lea r8, [rbp + 2]
add r8, rbp
jmp 0x14043d7ae
call fcn.1404a0a3f
mov qword [rbx + 0x10], rdi
clc
adc bl, 0xc5
mov byte [r14 + 0x16], 0
add rsp, 0x28
jmp 0x14043d7d0
pop rbx
mov r15w, 0x7c59
movzx rdi, di
pop rbp
mov rsi, 0x57ba2eab
pop rdi
pop rsi
pop r14
movsx r15, dx
bswap r15d
mov r15b, r15b
pop r15
jmp 0x14043d7f7
ret
call fcn.14043ccbe
int3
Function at 0x140441749
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
movzx ecx, cx
jmp 0x140441755
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
test r13w, cx
jmp 0x140441767
cmp eax, 0x100
jmp 0x140441771
setae al
add rsp, 0x28
jmp 0x14044177d
ret

Function at 0x140442e45
Capabilities:
Access peb ldr_data
Encrypt data using speck
Execute syscall

Disassembly:
sub rsp, 0x28
nop
movsxd rax, edi
mov eax, eax
mov rcx, qword [rcx]
mov ax, ax
movzx rax, r8w
mov rax, qword [rcx]
jmp 0x140442e61
call qword [rax + 0x28]
test eax, eax
je 0x140442e9b
mov ecx, eax
sub r8w, r8w
sal dl, 8
movabs r8, 0xcafa59766d7f94e
rcl dl, 0xae
mov dl, 3
sbb r9w, r14w
movsx r9d, r15w
mov r9d, 0x2a
add rsp, 0x28
jmp fcn.1403acdbd
nop
test r14b, 0xa
clc
add rsp, 0x28
jmp 0x140442eaa
ret
Function at 0x140445dbf
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
shr r8, 0x47
cbw
sal al, 0x40
mov r8, rcx
xor al, 0xcb
mov eax, 0x5a4d
stc
test r9w, si
cmp r11w, 0x5d32
cmp word [0x140000000], ax
jmp 0x140445ded
jne 0x140445ef1
movsxd rcx, dword [0x14000003c]
test r9b, r10b
lea rdx, [0x140000000]
cmp r8w, di
lea rcx, [rcx + rdx]
cmp dword [rcx], 0x4550
jmp 0x140445e17
jne 0x140445ef1
mov eax, 0x20b
clc
cmp word [rcx + 0x18], ax
jmp 0x140445e2c
jne 0x140445ef1
sub r8, rdx
sar al, 0xd8
movzx edx, word [rcx + 0x14]
add rdx, 0x18
btc eax, 0x25
add rdx, rcx
movzx eax, cx
btc r9w, 0xba
movsx ax, dil
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
add r9d, esi
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
test r10b, 0xc
cmp r11b, 0x32
clc
cmp rdx, r9
jmp 0x140445e79
je 0x140445eb2
mov ecx, dword [rdx + 0xc]
stc
cmp al, r11b
cmp r8, rcx
jb 0x140445ea4
mov eax, dword [rdx + 8]
add eax, ecx
clc
jmp 0x140445e9b
cmp r8, rax
jb 0x140445eba
add rdx, 0x28
jmp 0x140445ead
jmp 0x140445e64
sub edx, edx
jmp 0x140445eba
test rdx, rdx
jne 0x140445ecf
sub al, al
jmp 0x140445eca
jmp 0x140445f01
cmp dword [rdx + 0x24], 0
jmp 0x140445ed8
jge 0x140445ee5
xor al, al
jmp 0x140445f01
mov al, 1
jmp 0x140445eec
jmp 0x140445f01
xor al, al
jmp 0x140445ef8
jmp 0x140445f01
add rsp, 0x18
jmp 0x140445f0a
ret

Function at 0x14044656d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test edx, r10d
mov qword [rsp + 0x10], rsi
push rdi
movsx edi, r12w
sub rsp, 0x20
movzx edi, r13w
btc edi, edx
mov rsi, rcx
mov rdi, rdx
jmp 0x140446595
mov rcx, qword [rcx]
cmp r10w, r15w
clc
cmp rcx, rdx
jmp 0x1404465a5
je 0x140446648
test rcx, rcx
jmp 0x1404465b3
je 0x1404465be
call fcn.140260abd
and qword [rsi], 0
clc
cmp bp, 0x4179
stc
test rdi, rdi
jmp 0x1404465d1
je 0x140446648
cmp byte [rdi], 0
bswap rbx
xchg bl, bl
movzx ebx, r12w
mov rbx, rdi
je 0x140446604
inc rbx
stc
clc
jmp 0x1404465f6
cmp byte [rbx], 0
jmp 0x1404465fe
jne 0x1404465ec
sub rbx, rdi
lea rcx, [rbx + 1]
jmp 0x140446610
call fcn.14025eb0c
mov qword [rsi], rax
test r13w, 0x7611
test rax, rax
jmp 0x140446626
je 0x140446648
lea r8, [rbx + 1]
movzx cx, r14b
xchg dx, dx
mov rdx, rdi
mov rcx, rax
jmp 0x140446643
call fcn.1404a0a3f
mov rbx, qword [rsp + 0x30]
xor al, 0xca
mov rax, rsi
mov rsi, qword [rsp + 0x38]
rcr dil, 0x7d
shl edi, cl
sbb edi, 0x202d45de
add rsp, 0x20
mov di, si
movzx di, r15b
pop rdi
jmp 0x140446675
ret
Function at 0x1404578a2
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
movsx rcx, bx
lea rcx, [rsp + 0x30]
jmp 0x1404578b4
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
cmp r12b, 0x32
add rsp, 0x28
jmp 0x1404578cc
ret

Function at 0x14045799b
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
shrd bx, r11w, 0xac
shld ebx, ecx, 0xb9
and ah, 0xdf
sub rsp, 0x20
bts rax, rsi
rol al, cl
rcr al, 0xd5
mov rax, qword [0x1400b7288]
btc bx, 0xe4
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x1404579dc
jne 0x140457abf
and qword [rbp + 0x18], 0
lea rcx, [rbp + 0x18]
jmp 0x1404579f0
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x1404579ff
mov qword [rbp + 0x10], rax
jmp 0x140457a08
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
clc
cmc
test sil, 0xba
xor qword [rbp + 0x10], rax
jmp 0x140457a1f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
cmovae rcx, rbp
lea rcx, [rbp + 0x20]
clc
jmp 0x140457a3b
xor qword [rbp + 0x10], rax
jmp 0x140457a44
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
rcr ch, 0x79
movsx rcx, r13w
setle cl
lea rcx, [rbp + 0x10]
shl rax, 0x20
test r11w, 0xea6
jmp 0x140457a71
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
xchg bp, bp
rcr bp, cl
xor rax, rcx
movabs rcx, 0xffffffffffff
and rax, rcx
cmp di, 0x65ce
movabs rcx, 0x2b992ddfa233
sar bp, 0x64
adc ebp, 0x5afb0f3f
btc bp, di
cmp rax, rbx
jmp 0x140457ab4
cmove rax, rcx
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
not rax
mov qword [0x1400b7280], rax
add rsp, 0x20
movzx rbp, sp
mov bp, ax
pop rbp
jmp 0x140457adf
ret

Function at 0x140457b64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
cmc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x140457b79
je 0x140457be8
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140457be8
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
clc
test r14d, 0x5a206512
cmp dword [rcx], 0x4550
jne 0x140457be8
mov eax, 0x20b
test r14b, 7
cmc
cmp word [rcx + 0x18], ax
jmp 0x140457bbc
jne 0x140457be8
cmp dword [rcx + 0x84], 0xe
jbe 0x140457be8
cmp dword [rcx + 0xf8], 0
xchg al, al
setle al
setne al
jmp 0x140457be3
jmp 0x140457bf2
xor al, al
clc
test r14d, 0x2b800e89
add rsp, 0x28
jmp 0x140457bfb
ret