joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403e5357
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
btr r13w, r11w
movsx r15d, r14w
push r12
btr r15d, 0xa0
push rsi
xor r13d, ebp
shl r15b, cl
shr r15b, cl
push rdi
bts r12w, r13w
sbb r13d, 0x171d268d
shr r13b, cl
push rbp
rol r12b, 0xa3
push rbx
rcl r15w, cl
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
btc ebx, 0x33
mov r14, r9
mov bl, r9b
movzx r12, r9w
bsr r12w, sp
mov r15, r8
rcl bh, 0x87
test edi, 0x51ce158c
and r12b, 0xab
mov r12, rdx
mov r13, rcx
stc
add bl, ch
mov rbx, qword [rcx]
stc
cmp r12d, 0x74e5691e
test rbx, rbx
jmp 0x1403e53d9
je 0x1403e5531
mov rdi, qword [r13 + 8]
test r13w, 0x3a55
cmp edi, esi
cmp rbx, rdi
jmp 0x1403e53f3
je 0x1403e54d8
lea rbp, [0x1400bed10]
jmp 0x1403e5405
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e5411
jmp 0x1403e5447
call fcn.140102f68
movups xmmword [rbx + 0x20], xmm6
stc
clc
mov byte [rbx + 0x10], 0
stc
test r10b, 5
cmp cl, r14b
add rbx, 0x50
cmp al, 0x7c
cmc
jmp 0x1403e5439
cmp rbx, rdi
jmp 0x1403e5441
je 0x1403e54d1
mov qword [rbx], rbp
cmovns rcx, rdi
movzx rcx, r12w
lea rcx, [rbx + 0x38]
call fcn.1403e2795
mov rax, qword [rbx + 0x28]
clc
test spl, spl
cmp rax, 0x10
jmp 0x1403e546c
jb 0x1403e541b
mov rcx, qword [rbx + 0x10]
lea rdx, [rax + 1]
cmp spl, 0xb7
cmp rdx, 0x1000
jmp 0x1403e548a
jb 0x1403e5416
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp dl, 0x42
test r9, 0x7d01337f
sub rcx, rsi
jmp 0x1403e54ab
cmp rcx, 0x20
jmp 0x1403e54b4
jae 0x1403e55e3
add rax, 0x28
mov rdx, rax
movzx ecx, bx
mov rcx, rsi
jmp 0x1403e54cc
jmp 0x1403e5416
mov rbx, qword [r13]
sbb dl, 0x6b
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
cmp rdx, 0x1000
jmp 0x1403e54eb
jb 0x1403e5529
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
clc
cmp r13, 0x5529178a
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403e550d
jae 0x1403e55e3
add rdx, 0x27
jmp 0x1403e551f
mov rbx, rax
cmovs ecx, edi
movsx ecx, r12w
mov rcx, rbx
call fcn.140102f68
mov qword [r13], r12
bswap ebp
and si, ax
lea rax, [r15 + r15*4]
shr bpl, 0x3a
shl rax, 4
add rax, r12
sub dil, r9b
movsxd r15, edi
movzx bx, r15b
mov qword [r13 + 8], rax
cdqe
bswap rbp
lea rax, [r14 + r14*4]
shl rax, 4
shl di, cl
lea rax, [rax + r12]
cmp ebp, eax
btc edi, 0x33
mov qword [r13 + 0x10], rax
bt rsi, 0x95
not bx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
movzx r12w, dil
mov dil, 0x26
pop rbx
movsx rdi, r10w
movzx rsi, r15w
mov r12b, al
pop rbp
movzx r15d, ax
movsx r14d, ax
movsxd r13, r12d
pop rdi
not r12w
pop rsi
movzx r14d, sp
not r14b
movsxd r14, esi
pop r12
mov r15b, 0x1a
cmovnp r14d, r10d
pop r13
bswap r14d
mov r14w, 0x1f2a
not r14w
pop r14
movzx r15, r14w
movsxd r15, r10d
xchg r15w, r15w
pop r15
jmp 0x1403e55e2
ret
call fcn.1404b4343
int3
Function at 0x1403e7900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
cwde
rol al, 0x83
xor ax, r11w
push r14
sar eax, 0xe
xchg r14b, r14b
push rsi
rcl ah, 0xa6
push rdi
bts r14w, dx
jmp 0x1403e7924
push rbx
sub rsp, 0x20
sbb ah, 0x92
movzx ax, bl
bts r14w, r12w
mov r14, rcx
xadd ax, ax
movzx eax, r9w
mov eax, dword [rcx + 8]
clc
test al, 2
jmp 0x1403e794b
jne 0x1403e795d
xor esi, esi
jmp 0x1403e7958
jmp 0x1403e79ff
mov rdi, qword [r14 + 0x10]
rcr r15, cl
sub sil, r14b
mov r15, qword [r14 + 0x18]
btr esi, eax
mov rsi, r15
test ax, r10w
stc
sub rsi, rdi
sar rsi, 5
cmp r13b, 0x3a
cmc
cmp r15, rdi
jmp 0x1403e798a
je 0x1403e79ff
mov rax, qword [rdi]
mov cl, r15b
mov rcx, rdi
call qword [rax + 0x10]
or rax, 1
btr bx, 0x97
bsr rax, rax
lea rbx, [rax + rax*8]
bt eax, 0x41
sar al, 0xaa
add rbx, 0x49
shr rbx, 6
cwde
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x1403e79c8
call qword [rax + 0x10]
lea rsi, [rsi + rax]
test r9b, r12b
test r15d, 0x12ac2bc2
lea rsi, [rsi + rbx]
add rdi, 0x20
test sp, bx
cmp r15d, 0x444e2dc9
cmp rdi, r15
jmp 0x1403e79f3
jne 0x1403e7990
mov eax, dword [r14 + 8]
cmc
stc
test al, 4
jmp 0x1403e7a06
jne 0x1403e7a14
mov rdi, rsi
jmp 0x1403e7ada
mov rbx, qword [r14 + 0x28]
movsx r15, bx
shr r15b, 0x6c
mov r15, qword [r14 + 0x30]
shr di, 0x78
sub di, 0x1e31
mov rdi, r15
jmp 0x1403e7a36
sub rdi, rbx
test ax, 0x2f88
cmp al, r13b
cmc
sar rdi, 5
test r8b, 0xa8
clc
lea rdi, [rdi + rsi]
jmp 0x1403e7a54
cmp r15, rbx
jmp 0x1403e7a5c
je 0x1403e7ada
nop dword [rax]
movsxd rcx, r15d
movsx ecx, ax
mov rax, qword [rbx]
mov rcx, 0x6bf912c5
xchg cl, ch
mov rcx, rbx
jmp 0x1403e7a80
call qword [rax + 0x10]
or rax, 1
btc ecx, 0xb5
bsr rax, rax
lea rsi, [rax + rax*8]
movsx ecx, sp
ror rcx, cl
add rsi, 0x49
bts ax, si
shr rsi, 6
mov rax, qword [rbx]
mov cl, r10b
mov rcx, rbx
call qword [rax + 0x10]
add rdi, rax
lea rdi, [rdi + rsi]
cmp dl, r10b
jmp 0x1403e7ac0
add rbx, 0x20
cmp rbx, r15
jmp 0x1403e7acc
jne 0x1403e7a6c
mov eax, dword [r14 + 8]
test r12w, r12w
test al, 8
jmp 0x1403e7ae1
je 0x1403e7bbe
mov rbx, qword [r14 + 0x40]
ror r15b, 0xf4
mov r14, qword [r14 + 0x48]
rol r15d, cl
mov r15, r14
test esp, esp
clc
stc
sub r15, rbx
cmp dil, r12b
sar r15, 5
cmp r10w, 0x7df0
add r15, rdi
test r9w, 0x5462
cmp r14, rbx
je 0x1403e7bb4
nop word [rax + rax]
mov rax, qword [rbx]
movzx rcx, ax
mov rcx, rbx
call qword [rax + 0x10]
or rax, 1
cmp dil, 0x47
bsr rax, rax
lea rsi, [rax + rax*8]
rcr ch, cl
adc rax, 0x5d440419
add rsi, 0x49
jmp 0x1403e7b5d
shr rsi, 6
cdqe
cmovae ecx, ecx
mov rax, qword [rbx]
mov cl, 0xad
mov rcx, rbx
jmp 0x1403e7b73
call qword [rax + 0x10]
mov rdi, rax
cmp r12w, 0xd0f
add rdi, r15
sets r15b
sbb r15w, r11w
add rdi, rsi
bswap r15d
add rbx, 0x20
bsr r15, rsp
btr r15w, 0xa7
mov r15, rdi
test sp, 0x6a8e
cmp rbx, r14
jne 0x1403e7b28
jmp 0x1403e7bbe
mov rdi, r15
test r11, rcx
not ebx
rol al, cl
mov rax, rdi
mov r15w, 0x3bb5
cmovge r15d, ebp
rcl dil, 0x49
add rsp, 0x20
movzx r15d, ax
mov bx, r11w
pop rbx
movsx si, r9b
mov r14d, esi
cmovb esi, esi
pop rdi
movzx r15w, r8b
movsx r14d, cx
pop rsi
bswap r14w
jmp 0x1403e7bfd
pop r14
pop r15
ret
Function at 0x1403fc850
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
cmp bl, bpl
cmp r14w, 0x6f98
cmc
test r8, r8
je 0x1403fc8d3
movzx r9d, word [r8]
test r9w, r9w
jmp 0x1403fc874
je 0x1403fc907
xor eax, eax
cmc
rcr r10b, 0xda
mov r10, rcx
nop dword [rax + rax]
cmp rdx, rax
jmp 0x1403fc894
je 0x1403fcac0
mov word [r10], r9w
rcl r9b, 0x33
or r9w, sp
rol r9, 0xea
add r10, 2
movzx r9d, word [r8 + rax*2 + 2]
inc rax
test r9w, r9w
jmp 0x1403fc8c0
jne 0x1403fc88c
sub rdx, rax
jmp 0x1403fc8ce
jmp 0x1403fc912
movzx r9d, word [0x1400b8f10]
test dl, cl
jmp 0x1403fc8e2
test r9w, r9w
je 0x1403fc925
cmp rdx, 0x104
mov r8d, 0x104
cmovb r8, rdx
jmp 0x1403fc902
jmp 0x1403fca4b
mov r10, rcx
test bl, 0x75
clc
cmp bpl, 0x8a
test rdx, rdx
jmp 0x1403fc91a
jne 0x1403fcac0
jmp 0x1403fcac6
mov rax, qword gs:[0x30]
movzx r11w, bpl
rcl r9b, 0x14
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
sub r8w, 0x6eb6
movsx r10, dx
movzx r8d, word [rax + 0x58]
bt r11, rdx
cmp r8, rdx
movsx r10, r12w
cmovae r8, rdx
test r11w, r8w
bt r10d, ebp
dec r11b
mov r9, qword [rax + 0x60]
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
test r11w, r11w
je 0x1403fc9e4
sub eax, eax
cmp rcx, rsi
nop word cs:[rax + rax]
jmp 0x1403fc9a1
cmp r8, rax
jmp 0x1403fc9a9
je 0x1403fc9f2
mov word [r10], r11w
cmp r15b, 0xd8
bt r11d, 0xd7
shr r11w, 0x8d
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
inc rax
test r11w, r11w
jmp 0x1403fc9d7
jne 0x1403fc9a1
sub r8, rax
test r14d, edi
cmc
test r8, r8
jmp 0x1403fc9ec
je 0x1403fc9fb
mov word [r10], 0
sal r9d, cl
movzx r9d, word [0x1400b8f10]
ror r8w, cl
bts r8w, r12w
cmp rdx, 0x104
movsx r10, r13w
movzx r10w, bl
xchg r10b, r10b
mov r8d, 0x104
cmovb r8, rdx
shld r10w, cx, 0xe6
rcl r10w, 0x56
bts r10w, dx
mov r10, rcx
clc
cmc
cmp r11, r14
test r9w, r9w
je 0x1403fcab2
sub edx, edx
movsxd rax, esp
add r10b, r9b
bts rax, r9
lea rax, [0x1400b8f10]
setne r10b
mov r10, rcx
nop dword [rax + rax]
test sil, 0x1b
clc
cmp r8, rdx
jmp 0x1403fca7a
je 0x1403fcac0
mov word [r10], r9w
test cl, 0x3c
add r10, 2
movsx r9, r11w
movzx r9d, word [rax + rdx*2 + 2]
jmp 0x1403fca9a
inc rdx
cmc
stc
test r9w, r9w
jmp 0x1403fcaa8
jne 0x1403fca72
sub r8, rdx
stc
test r8, r8
jmp 0x1403fcaba
je 0x1403fcac6
mov word [r10], 0
movabs rax, 0xe039ec0d24fefd13
movsx edx, cx
mov qword [rsp], rax
jmp 0x1403fcae4
movabs rax, 0x2247bce40ef3a5e6
cqo
mov qword [rsp + 8], rax
jmp 0x1403fcafa
movabs rdx, 0xe05dec612491fd3d
jmp 0x1403fcb09
mov qword [rsp + 0x10], rdx
jmp 0x1403fcb13
mov qword [rsp + 0x18], rax
not rax
lea rax, [rsp + 0x10]
jmp 0x1403fcb25
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
cmc
test r11, 0x5f2541dc
nop word cs:[rax + rax]
cmp r11b, 0x3c
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jmp 0x1403fcb5f
jne 0x1403fcb51
test ax, ax
jmp 0x1403fcb6d
je 0x1403fcba5
lea rdx, [rsp + 2]
test dil, spl
nop word cs:[rax + rax]
mov word [rcx], ax
lahf
movsx rax, r13w
mov al, spl
add rcx, 2
movzx eax, word [rdx]
add rdx, 2
test ax, ax
jne 0x1403fcb86
mov word [rcx], 0
jmp 0x1403fcbaf
add rsp, 0x28
ret
Function at 0x140420b05
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
rcl si, 0x78
mov r10w, 0x3af5
mov r10, qword [rcx]
mov rsi, qword [rcx + 0x18]
mov r9d, dword [r10 + 4]
clc
jmp 0x140420b21
imul r9d, dword [r10]
jmp 0x140420b2b
cmp r8d, 2
jmp 0x140420b34
jne 0x140420cbe
test r9d, r9d
jmp 0x140420b42
je 0x140420d59
lea ecx, [r9 - 1]
test ax, di
cmp r13d, edi
cmp ecx, 3
jmp 0x140420b5a
jb 0x140420c5d
mov r11d, r9d
and r11d, 0xfffffffc
or r8w, dx
rol r10b, cl
nop word cs:[rax + rax]
movzx r8w, dil
movsx r8w, r14b
adc r8b, cl
movzx r8d, word [rsi]
sbb r10b, 0xac
not r10w
movzx r10, r12w
movzx r10d, word [rsi + 4]
cmp al, 0x10
cmp dl, sil
clc
sub ecx, ecx
and cl, 8
cmp r8w, word [rdx]
xchg r8b, cl
setne cl
neg ecx
bts r8w, r11w
adc r8b, r9b
rcr r8b, 0x59
mov word [rsi + 2], cx
xor ecx, ecx
bts r8d, r11d
sub cl, dil
cmp r10w, word [rdx]
not cl
setne cl
neg ecx
mov word [rsi + 6], cx
movzx r8d, word [rsi + 8]
jmp 0x140420bec
xor ecx, ecx
test di, bx
inc cl
sbb cl, 0xf3
cmp r8w, word [rdx]
jmp 0x140420bff
setne cl
cmp r8b, 0xe3
clc
neg ecx
ror r8d, cl
btr r8d, r12d
sub r8b, 0xab
mov word [rsi + 0xa], cx
movzx r8d, word [rsi + 0xc]
cmp sil, r9b
sub ecx, ecx
sub cl, 0xa8
shl cl, cl
xor cl, r8b
cmp r8w, word [rdx]
mov cl, spl
setne cl
clc
cmp sp, r15w
neg ecx
stc
test rbx, 0x532d7fd1
clc
mov word [rsi + 0xe], cx
cmp sil, r14b
add rsi, 0x10
cmp r10w, r8w
add r11d, 0xfffffffc
jne 0x140420b88
test r9b, 3
jmp 0x140420c66
je 0x140420d59
and r9d, 3
mov r8d, ebp
sar r8b, cl
xor ecx, ecx
add r8b, r12b
nop word cs:[rax + rax]
clc
rcl r8b, 9
movzx r8d, word [rsi + rcx*4]
cmc
xor eax, eax
xchg al, al
cmp r8w, word [rdx]
setne al
neg eax
jmp 0x140420ca3
mov word [rsi + rcx*4 + 2], ax
jmp 0x140420cad
inc rcx
cmp r9d, ecx
jne 0x140420c8b
jmp 0x140420d59
test r9d, r9d
jmp 0x140420cc6
je 0x140420d59
movzx r10d, word [rdx]
rcr r8w, cl
xadd r8b, r8b
mov r8d, r9d
test cl, 0x75
sub ecx, ecx
jmp 0x140420ce5
jmp 0x140420cff
inc rcx
test bh, 0x2c
cmc
cmp r8d, ecx
jmp 0x140420cf9
je 0x140420d59
cmp word [rsi + rcx*8], r10w
jmp 0x140420d09
jne 0x140420cea
movzx eax, word [rsi + rcx*8 + 2]
cmp ax, word [rdx + 2]
jmp 0x140420d1d
jne 0x140420cea
movzx eax, word [rsi + rcx*8 + 4]
stc
cmp r15b, 0x43
test ch, 0x8c
cmp ax, word [rdx + 4]
jne 0x140420cea
mov word [rsi + rcx*8 + 6], 0
not r10b
xchg r10d, r10d
movzx r10, r8w
movzx r10d, word [rdx]
jmp 0x140420d54
jmp 0x140420cea
pop rsi
jmp 0x140420d5f
ret
Function at 0x14043e40f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
sbb r14b, dl
not r14b
push rsi
xor r14b, 0x9a
adc r14b, r12b
push rdi
sub r14b, 0xb7
adc r15b, r14b
push rbp
movsx r15d, di
push rbx
movzx bx, dl
bsr ebx, esp
sub rsp, 0x28
or ebx, r8d
mov r15d, r9d
inc r14w
mov ebp, r8d
not r14b
mov r14, rdx
btr bx, r9w
mov rbx, rcx
lea rcx, [rdx + 0x20]
adc dl, spl
mov edx, r8d
mov r8b, 0xf8
ror r8b, 0x2d
mov r8d, r9d
cmc
jmp 0x14043e46f
xor r9d, r9d
jmp 0x14043e477
call fcn.14043e664
test r15d, r15d
jmp 0x14043e484
jle 0x14043e53b
test rax, rax
jmp 0x14043e492
je 0x14043e53b
movsxd rsi, ebp
cdq
shld rdx, r15, 0x9d
mov ecx, r15d
movzx rdx, r15w
xor ebp, ebp
movsxd rdx, r15d
movzx edx, bx
cqo
mov rdx, rsi
jmp 0x14043e4ba
jmp 0x14043e4ea
movzx edi, word [rdi + rdx*2]
jmp 0x14043e4c8
mov word [rax + rbp*2], di
jmp 0x14043e4d1
inc rbp
jmp 0x14043e4d9
inc rdx
cmp rcx, rbp
jmp 0x14043e4e4
je 0x14043e54b
mov di, 0x2a
jmp 0x14043e4f3
test byte [rbx + 0x1c], 4
jmp 0x14043e4fc
jne 0x14043e4c8
mov rdi, qword [rbx]
stc
test r11, r9
test rax, 0x52a362f4
cmp qword [rdi + 0x10], rdx
jmp 0x14043e518
jbe 0x14043e659
cmp qword [rdi + 0x18], 8
jmp 0x14043e528
jb 0x14043e4bf
mov rdi, qword [rdi]
jmp 0x14043e536
jmp 0x14043e4bf
movsxd rsi, ebp
bts di, r11w
sub di, 0x595
or dil, cl
mov rbx, qword [rbx]
bt rcx, 0x24
mov rdi, qword [rbx + 0x10]
shl cl, cl
sal cx, cl
mov rcx, rdi
test r8w, r9w
sub rcx, rsi
jmp 0x14043e56b
jb 0x14043e659
movsxd rax, r15d
jmp 0x14043e580
cmp rcx, rax
jmp 0x14043e588
cmovb rax, rcx
shl ch, 0x79
cmp qword [rbx + 0x18], 8
movzx cx, al
movzx rcx, r8w
cmovo cx, ax
mov rcx, rbx
jmp 0x14043e5a8
jb 0x14043e5b7
mov rcx, qword [rbx]
shr r8, cl
shl bpl, cl
lea rcx, [rcx + rsi*2]
and r8, rdx
or bpl, r9b
sub rdi, rax
adc r8d, 0x25c73301
xor r8, 0x4a7c15ce
rcr dh, 0x33
mov rbp, rdi
sub rbp, rsi
bts r8w, sp
ror r8b, 0xd7
lea rdx, [rcx + rax*2]
not r8d
bts r8w, r15w
lea r8, [rbp + 2]
cmp r12w, r13w
cmc
add r8, rbp
jmp 0x14043e605
call fcn.1404a18a1
mov qword [rbx + 0x10], rdi
add sil, r8b
adc dil, 0x79
mov byte [r14 + 0x16], 0
neg bpl
add rsp, 0x28
movzx edi, cx
pop rbx
setnp r15b
pop rbp
movsx di, dil
pop rdi
cmovbe r14w, r8w
mov r14, 0x539b0759
movsx r15w, r12b
pop rsi
movsxd r14, esi
not r14b
cmovl r14, r15
pop r14
movsxd r15, r13d
pop r15
jmp 0x14043e658
ret
call fcn.14043dab7
int3
Function at 0x1404425d5
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
jmp 0x1404425de
movzx ecx, cx
jmp 0x1404425e6
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
test r8w, 0x1721
clc
jmp 0x1404425fb
cmp eax, 0x100
seto al
setae al
test bp, 0x2ab3
jmp 0x140442611
add rsp, 0x28
ret
Function at 0x140443d57
Capabilities:
Access peb ldr_data
Encrypt data using speck

Disassembly:
sub rsp, 0x28
movsxd rax, ecx
mov rcx, qword [rcx]
movzx rax, bp
mov rax, qword [rcx]
jmp 0x140443d6d
call qword [rax + 0x28]
test eax, eax
jmp 0x140443d77
je 0x140443da4
mov ecx, eax
adc r8d, 0x2f1e6442
movabs r8, 0xcafa59766d7f94e
mov dl, 3
mov r9b, r12b
mov r9d, 0x2a
add rsp, 0x28
jmp fcn.1403ae073
nop
cmc
add rsp, 0x28
jmp 0x140443daf
ret
Function at 0x140446cb7
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
shl eax, cl
movsx eax, sp
xor rax, 0x10773464
mov r8, rcx
or al, r14b
movsxd rax, ecx
mov eax, 0x5a4d
clc
cmp word [0x140000000], ax
jmp 0x140446ce2
jne 0x140446de1
movsxd rcx, dword [0x14000003c]
movsx dx, r9b
lea rdx, [0x140000000]
lea rcx, [rcx + rdx]
cmp al, r14b
cmp r12b, 0x1b
clc
cmp dword [rcx], 0x4550
jne 0x140446de1
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x140446d21
jne 0x140446de1
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
lea rdx, [rdx + rcx]
clc
sal eax, 0xb1
cdqe
movzx eax, word [rcx + 6]
sub r9b, cl
lea rcx, [rax + rax*4]
rcr r9w, cl
rol r9b, cl
ror r9w, 0x62
lea r9, [rdx + rcx*8]
cmp r15w, bp
mov qword [rsp], rdx
test r10b, 0xe2
cmp rdx, r9
je 0x140446da4
mov ecx, dword [rdx + 0xc]
test dil, r14b
stc
cmp r8, rcx
jb 0x140446d96
mov eax, dword [rdx + 8]
cmp r12d, esp
cmp bpl, 0x54
add eax, ecx
cmp r8, rax
jmp 0x140446d90
jb 0x140446daa
add rdx, 0x28
jmp 0x140446d9f
jmp 0x140446d5b
sub edx, edx
cmc
cmp r13, rsp
test rdx, rdx
jmp 0x140446db2
jne 0x140446dc4
xor al, al
jmp 0x140446dbf
jmp 0x140446df3
cmp dword [rdx + 0x24], 0
jmp 0x140446dcd
jge 0x140446dda
xor al, al
jmp 0x140446df3
mov al, 1
jmp 0x140446df3
xor al, al
jmp 0x140446de8
jmp 0x140446df3
add rsp, 0x18
jmp 0x140446dfc
ret

Function at 0x14044777d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmc
mov qword [rsp + 0x10], rbp
push rdi
cmovne rax, rdx
xor bpl, 0x49
btc ebp, 0x74
sub rsp, 0x20
shl dil, 0x90
and qword [rcx + 0x10], 0
lea rax, [0x1400bff98]
and qword [rcx + 0x18], 0
movsx bx, r14b
lea rbp, [0x1400ced94]
and bx, bp
and dword [rcx + 0x20], 0
sub edi, esp
xor dil, 0x60
rol rbx, 4
mov rbx, rcx
sar di, 0x40
mov qword [rcx], rax
mov rdi, rbp
mov dword [rcx + 8], 1
mov byte [rcx + 0x24], dl
cmc
and qword [rcx + 0x28], 0
mov byte [rcx + 0x30], 0
jmp 0x1404477f1
inc rdi
cmc
test al, r15b
cmp byte [rdi], 0
jmp 0x140447800
jne 0x1404477f1
sub rdi, rbp
movzx cx, bpl
lea rcx, [rdi + 1]
jmp 0x140447817
call fcn.1401f3ea3
mov qword [rbx + 0x28], rax
jmp 0x14044782f
test rax, rax
jmp 0x140447837
je 0x14044785c
lea r8, [rdi + 1]
movzx rdx, sp
mov rdx, rbp
movsx ecx, bp
movzx rcx, r9w
mov rcx, rax
jmp 0x140447857
call fcn.1404a18a1
mov rbp, qword [rsp + 0x38]
dec dil
bts ax, r14w
xchg al, ah
mov rax, rbx
mov rdi, 0x583a419c
rcr edi, cl
stc
mov rbx, qword [rsp + 0x30]
shr dil, cl
btr edi, 0x66
add rsp, 0x20
movzx rdi, di
pop rdi
ret
Function at 0x1404588b5
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
adc ax, 0x21b2
bsf ax, sp
add ebx, 0x7ff03a03
push rbp
shr bp, 0x4e
mov rbp, rsp
test sil, 0x81
shr rbx, cl
mov ax, 0x5829
sub rsp, 0x20
adc eax, 0x20e8665b
sbb bl, spl
mov rax, qword [0x1400b7288]
bt bx, 0xa6
movabs rbx, 0x2b992ddfa232
cmc
cmp dl, r14b
cmp rax, rbx
jmp 0x140458909
jne 0x1404589de
and qword [rbp + 0x18], 0
bswap cx
lea rcx, [rbp + 0x18]
jmp 0x140458920
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x14045892f
mov qword [rbp + 0x10], rax
jmp 0x140458938
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x140458949
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
btc cx, cx
movzx ecx, sp
lea rcx, [rbp + 0x20]
test rsp, 0x653741ae
xor qword [rbp + 0x10], rax
jmp 0x14045896c
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
sub ch, 0xfe
lea rcx, [rbp + 0x10]
test r10w, 0x4a25
shl rax, 0x20
xor rax, qword [rbp + 0x20]
cmp r13w, 0x3050
xor rax, qword [rbp + 0x10]
bt rbp, 0xfa
shr bp, cl
rol bpl, cl
xor rax, rcx
and cx, 0x93d
rcl bpl, cl
sub bpl, r11b
movabs rcx, 0xffffffffffff
bsr bp, r15w
and rax, rcx
sub bp, sp
test ax, 0x296f
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
cmove rax, rcx
mov qword [0x1400b7288], rax
mov rbx, qword [rsp + 0x48]
sar bpl, 0x5c
bsf ebp, r12d
not rax
sub bpl, 0xac
clc
cmp rsp, 0x34e013dd
mov qword [0x1400b7280], rax
test spl, 0xb4
add bpl, 0x99
add rsp, 0x20
movzx bp, r12b
movzx ebp, dx
pop rbp
jmp 0x140458a1b
ret
Function at 0x14045d2fa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
bts ebx, ebx
sbb eax, r11d
push rbp
add rbp, r12
rcr ax, 0x1b
movsx ebp, cx
mov rbp, rsp
cmc
sub rsp, 0x80
shr bx, cl
movzx rax, sp
mov rax, qword [0x1400b7288]
xor rax, rsp
adc bl, r12b
mov qword [rbp - 0x10], rax
sub ax, bx
bt ax, bp
mov rax, qword [rcx + 8]
mov rbx, rdx
mov qword [rbp - 0x58], rdx
cmp r9b, r12b
cmc
test rax, rax
je 0x14045d3e6
mov rdx, qword [rax + 0x28]
jmp 0x14045d366
test rdx, rdx
jmp 0x14045d36e
jne 0x14045d378
lea rdx, [rax + 0x30]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x30], xmm0
jmp 0x14045d387
or r8, 0xffffffffffffffff
jmp 0x14045d390
movdqu xmmword [rbp - 0x20], xmm1
inc r8
test r8b, r12b
cmp byte [rdx + r8], 0
jmp 0x14045d3a5
jne 0x14045d395
lea rcx, [rbp - 0x30]
call fcn.1404558ad
sub r8d, r8d
lea rax, [rbp - 0x30]
cmove dx, cx
movsxd rcx, r15d
lea rcx, [rbp - 0x20]
mov dil, r8b
lea rdx, [rbp - 0x18]
movsx rdi, bp
movzx rdi, ax
xchg dil, dil
lea edi, [r8 + 1]
jmp 0x14045d3e1
jmp 0x14045d43a
movdqa xmm1, xmmword [0x1400bd400]
lea rax, [rbp - 0x50]
sub edi, edi
movzx rcx, bp
movsx cx, r15b
mov cl, 0xff
lea rcx, [rbp - 0x40]
jmp 0x14045d408
xorps xmm0, xmm0
lea rdx, [rbp - 0x38]
movups xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x50], 0
movzx r8, dx
jmp 0x14045d420
lea r8d, [rdi + 2]
stc
test r13d, 0x57dd46a2
movdqu xmmword [rbp - 0x40], xmm1
cmp rdi, 0x72962dff
clc
stc
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
clc
test r11w, bp
movups xmmword [rbx], xmm0
test r13d, esi
movups xmmword [rbx + 0x10], xmm1
cmc
test r10, r8
jmp 0x14045d459
and qword [rcx], 0
cmp bl, 0x9b
mov qword [rdx], 0xf
mov byte [rax], 0
test spl, spl
clc
test r8d, r8d
jmp 0x14045d476
je 0x14045d4fd
mov rdx, qword [rbp - 0x38]
jmp 0x14045d488
cmp rdx, 0x10
jmp 0x14045d491
jb 0x14045d4fd
mov rcx, qword [rbp - 0x50]
inc rdx
or ax, 0x16cc
dec ax
mov rax, rcx
cmp rdx, 0x1000
jmp 0x14045d4b4
jb 0x14045d4f8
mov rcx, qword [rcx - 8]
test r13d, 0x275978ba
add rdx, 0x27
clc
cmp r12b, 0x73
sub rax, rcx
cmp rdi, 0x85d1384
cmc
cmp rbp, r9
add rax, 0xfffffffffffffff8
test eax, 0x376d4c60
cmp bpl, 0xcb
cmp rax, 0x1f
jmp 0x14045d4f2
ja 0x14045d5ab
call fcn.140102f68
test edi, edi
jmp 0x14045d504
je 0x14045d566
mov rdx, qword [rbp - 0x18]
clc
jmp 0x14045d514
cmp rdx, 0x10
jb 0x14045d566
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14045d561
mov rcx, qword [rcx - 8]
jmp 0x14045d53f
add rdx, 0x27
clc
cmp rdi, r10
sub rax, rcx
clc
test bl, 0x60
test rsi, r11
add rax, 0xfffffffffffffff8
clc
cmc
cmp rax, 0x1f
ja 0x14045d5ab
call fcn.140102f68
mov rax, rbx
adc ecx, eax
mov rcx, qword [rbp - 0x10]
cmc
cmp r8d, eax
xor rcx, rsp
jmp 0x14045d57b
call fcn.14049dc81
lea r11, [rsp + 0x80]
mov bl, r14b
mov rbx, qword [r11 + 0x20]
movsxd rbp, ebx
movzx rbp, r8w
mov rdi, qword [r11 + 0x28]
movzx bp, r15b
bswap ebp
mov rsp, r11
pop rbp
jmp 0x14045d5aa
ret
call fcn.1404b4343
int3
Function at 0x14046a58e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
jmp 0x14046a5ae
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
adc bp, bp
inc rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
bswap si
push r14
adc bpl, r10b
sub rsp, 0x20
test eax, 0x2fc06485
mov rsi, qword [rsp + 0x50]
movzx r14d, r9w
cmovbe rbp, r10
inc di
mov rdi, r8
shr bp, cl
mov rbp, rdx
test r8w, 0x2c2a
cmp r11b, spl
cmp ax, 0x26f
test rsi, rsi
jmp 0x14046a603
je 0x14046a6be
mov rbx, qword [r8 + 8]
test rbx, rbx
jmp 0x14046a615
je 0x14046a6ac
mov rax, qword [rbx + 0x40]
test bl, dil
cmp dil, 0x3d
cmp qword [rax], 0
jmp 0x14046a62f
je 0x14046a67c
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0
jmp 0x14046a641
jle 0x14046a67c
dec dword [rax]
bswap rax
mov rcx, qword [rbx + 0x40]
movzx eax, r13w
mov rdx, qword [rcx]
movzx rax, r13w
nop
mov al, dil
lea rax, [rdx + 2]
mov qword [rcx], rax
mov al, 0x8f
cbw
movzx eax, r14w
jmp 0x14046a673
mov word [rdx], r14w
jmp 0x14046a69d
mov rax, qword [rbx]
setg ch
movzx edx, r14w
jmp 0x14046a68b
mov rcx, rbx
mov rax, qword [rax + 0x18]
jmp 0x14046a697
call qword [0x1400b8d90]
mov ecx, 0xffff
stc
cmp cx, ax
jne 0x14046a6af
mov byte [rdi], 1
sub rsi, 1
jmp 0x14046a6b8
jne 0x14046a60d
movups xmm0, xmmword [rdi]
btc ax, r11w
rol rdi, 0xf4
bsf r14w, r14w
mov rbx, qword [rsp + 0x30]
setp dil
sbb rsi, r15
mov rax, rbp
sub r14b, r8b
mov rsi, qword [rsp + 0x40]
shr edi, 0xf7
mov rdi, qword [rsp + 0x48]
adc r14b, r9b
xor r14w, 0x5a32
or r14w, di
movdqu xmmword [rbp], xmm0
mov rbp, qword [rsp + 0x38]
btc r14w, 0x4b
sal r14b, cl
add rsp, 0x20
mov r14d, 0x4ef83e03
movzx r14w, r10b
pop r14
jmp 0x14046a724
ret