joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406a0d5d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
xchg ah, al
movzx dx, bh
sub rsp, 0x68
shld eax, r15d, 0x18
mov rax, qword [0x1400ac760]
bswap cx
shld edx, r9d, 0xc
mov qword [rsp + 0x28], rax
xor eax, 0xaa3e6f0f
sal edx, cl
mov rax, qword [rsp + 0x28]
bsr ecx, r8d
movzx cx, r8b
add rax, 0x1a38
mov qword [rsp + 0x30], rax
cdqe
inc ecx
mov rax, qword [rsp + 0x30]
cqo
mov eax, dword [rax]
mov ecx, r15d
movzx ecx, r11w
dec eax
rcl dx, cl
cdqe
mov rcx, qword [rsp + 0x30]
cdq
mov rcx, qword [rcx + 8]
bts rdx, r9
sar dx, 0x9f
inc dh
mov rdx, qword [rsp + 0x70]
clc
cmp qword [rcx + rax*8], rdx
jmp 0x1406a0de3
jne 0x1406a0dee
jmp 0x1406a100a
mov rax, qword [rsp + 0x28]
cmp cx, bp
mov eax, dword [rax + 0x1a38]
sub eax, 2
jmp 0x1406a0e04
mov dword [rsp + 0x20], eax
jmp 0x1406a0e0d
jmp 0x1406a0e34
mov eax, dword [rsp + 0x20]
jmp 0x1406a0e1b
dec eax
jmp 0x1406a0e24
mov dword [rsp + 0x20], eax
jmp 0x1406a0e34
cmp dword [rsp + 0x20], 0
jmp 0x1406a0e3e
jl 0x1406a100a
mov rax, qword [rsp + 0x28]
btc rdx, r15
not edx
add rax, 0x1a38
btc dx, dx
bt rcx, rcx
mov qword [rsp + 0x38], rax
rcl cl, 0x14
shl ax, 0x20
bsf ax, bx
movsxd rax, dword [rsp + 0x20]
cmp rdx, 0x168e8283
inc ecx
shrd rdx, rbx, 0x30
mov rcx, qword [rsp + 0x38]
add dx, 0xf931
inc dx
cqo
mov rcx, qword [rcx + 8]
and dx, r11w
movzx dx, r15b
movsxd rdx, r9d
mov rdx, qword [rsp + 0x70]
cmp dil, 0x27
stc
cmp qword [rcx + rax*8], rdx
jmp 0x1406a0eb2
jne 0x1406a1005
mov rax, qword [rsp + 0x28]
add rax, 0x1a38
movzx rcx, si
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
add rax, 0x1a38
mov qword [rsp + 0x48], rax
cmovne dx, cx
movsxd rcx, edx
movzx cx, r9b
mov eax, dword [rsp + 0x20]
movzx edx, sp
inc eax
ror ch, cl
cdqe
bts r8d, edi
cmovge dx, bp
mov rcx, qword [rsp + 0x40]
rol r8b, 0x13
mov rcx, qword [rcx + 8]
adc r8b, 0x2c
cmovge edx, r12d
lea rax, [rcx + rax*8]
or r8b, dl
mov qword [rsp + 0x50], rax
btr r8w, 0xb8
inc r8b
rcl dl, cl
mov rax, qword [rsp + 0x28]
xor r8w, 0xbc0b
bts ecx, r8d
stc
mov ecx, dword [rsp + 0x20]
mov eax, dword [rax + 0x1a38]
movsx dx, bh
adc dx, r10w
rol dl, 0xb5
sub eax, ecx
dec eax
add r8b, 0x1b
cdqe
cmovae cx, r11w
shl rax, 3
mov cx, 0xf210
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx + 8]
mov r8b, spl
movsxd r8, r15d
lea rcx, [rdx + rcx*8]
movsxd rdx, ebx
movsx r8, r14w
bswap dx
mov r8, rax
cqo
cdq
mov rdx, qword [rsp + 0x50]
jmp 0x1406a0f97
call fcn.1406fc573
mov rax, qword [rsp + 0x28]
cmovl edx, esi
add rax, 0x1a38
mov rcx, r10
bswap cx
mov qword [rsp + 0x58], rax
cqo
movzx dx, bpl
mov rax, qword [rsp + 0x28]
mov rcx, r9
mov dh, 0x97
jmp 0x1406a0fcc
mov eax, dword [rax + 0x1a38]
cqo
movzx cx, r12b
dec eax
mov cl, bpl
cdqe
movzx rcx, r10w
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx + 8]
movzx dx, r8b
mov rdx, qword [rsp + 0x70]
jmp 0x1406a0ffc
mov qword [rcx + rax*8], rdx
jmp 0x1406a100a
jmp 0x1406a0e12
add rsp, 0x68
jmp 0x1406a1013
ret
Function at 0x1406a1014
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
movzx eax, sp
sub rsp, 0x78
cwde
sar rcx, cl
mov rax, qword [0x1400ac760]
mov qword [rsp + 0x28], rax
or ah, 0xbc
bswap rax
sar ax, 0xa1
mov rax, qword [rsp + 0x28]
cmovle cx, si
inc cx
bswap rcx
add rax, 0x1a28
movsx rcx, r10w
mov qword [rsp + 0x30], rax
movsx eax, r8w
movzx ecx, bp
mov rax, qword [rsp + 0x30]
movsx cx, r15b
mov eax, dword [rax]
not cx
dec eax
cdqe
seto cl
mov rcx, qword [rsp + 0x30]
test r10b, r15b
mov rcx, qword [rcx + 8]
cmc
test r9d, esp
mov rax, qword [rcx + rax*8]
clc
jmp 0x1406a108f
mov qword [rsp + 0x38], rax
movsx eax, r11w
bswap eax
shl eax, 0xc
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x38], rax
je 0x1406a10e4
mov rax, qword [rsp + 0x38]
rol cl, 0xa
bt cx, 0x88
xadd rcx, rcx
mov rcx, qword [rsp + 0x80]
test sil, 0x19
cmp r10b, 0x15
cmc
cmp qword [rax + 0x3a0], rcx
jmp 0x1406a10de
jne 0x1406a10e9
jmp 0x1406a12f9
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1a28]
sub eax, 2
mov dword [rsp + 0x20], eax
jmp 0x1406a1100
jmp 0x1406a1114
mov eax, dword [rsp + 0x20]
jmp 0x1406a110e
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jmp 0x1406a111e
jl 0x1406a12f9
mov rax, qword [rsp + 0x28]
and edx, 0xe9abaf09
add rax, 0x1a28
add dx, 0xd73e
bt rcx, 5
bsf dx, bx
mov qword [rsp + 0x40], rax
bsr dx, sp
mov ax, sp
ror ch, cl
movsxd rax, dword [rsp + 0x20]
xor cx, 0xc2b1
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 8]
and dh, 0x2d
mov rdx, qword [rsp + 0x80]
test dl, bl
cmc
cmp qword [rcx + rax*8], rdx
jmp 0x1406a117b
jne 0x1406a12f4
mov rax, qword [rsp + 0x28]
btc edx, 0x22
movzx r8, cx
cwd
add rax, 0x1a28
btc rdx, 0x32
inc r8d
btr rdx, 0xb4
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
add rax, 0x1a28
mov qword [rsp + 0x50], rax
cwde
mov eax, dword [rsp + 0x20]
inc ch
inc eax
cdqe
or cx, 0x88bf
shr cl, cl
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 8]
cmovne edx, ebx
btc r8w, 0x37
bsf dx, di
lea rax, [rcx + rax*8]
mov qword [rsp + 0x58], rax
adc r8b, 0x27
shl r8w, cl
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rax + 0x1a28]
sub eax, ecx
dec eax
shl ecx, cl
movzx dx, r9b
sbb rcx, 0xe940eb6
cdqe
test bpl, bpl
shl rax, 3
cwd
movzx rdx, r8w
movzx ecx, r12w
movsxd rcx, dword [rsp + 0x20]
jmp 0x1406a1236
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 8]
bswap r8
jmp 0x1406a124c
lea rcx, [rdx + rcx*8]
movzx dx, r15b
bswap dx
xchg r8b, r8b
mov r8, rax
not dl
movsx rdx, r15w
mov rdx, qword [rsp + 0x58]
jmp 0x1406a126e
call fcn.1406fc573
mov rax, qword [rsp + 0x28]
bt ecx, 0xa4
test rdx, rbx
bts dx, ax
add rax, 0x1a28
mov qword [rsp + 0x60], rax
cbw
movzx rdx, r12w
mov dx, 0xd324
mov rax, qword [rsp + 0x28]
movsx edx, r14w
cqo
xchg ecx, ecx
mov eax, dword [rax + 0x1a28]
cwd
movsx rcx, bp
mov cx, bx
dec eax
cdq
jmp 0x1406a12c0
cdqe
jmp 0x1406a12c7
mov rcx, qword [rsp + 0x60]
setnp dh
not dx
mov rcx, qword [rcx + 8]
mov dl, r12b
mov rdx, qword [rsp + 0x80]
jmp 0x1406a12e6
mov qword [rcx + rax*8], rdx
jmp 0x1406a12ef
jmp 0x1406a12f9
jmp 0x1406a1105
add rsp, 0x78
jmp 0x1406a1302
ret
Function at 0x1406b3463
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
bsf rax, r10
add dl, bh
push rdi
sub rsp, 0x98
mov rax, qword [0x1400ac760]
mov rcx, 0xffffffffc185313d
setno ch
movsx cx, bl
mov qword [rsp + 0x60], rax
cdq
movzx rdx, r11w
lea rdx, [0x1400a06c4]
mov cl, 0x97
mov rcx, qword [rsp + 0xb0]
jmp 0x1406b34ac
call fcn.1406fbff8
mov qword [rsp + 0x40], rax
cmp sil, 0x93
clc
test bpl, r11b
cmp qword [rsp + 0x40], 0
jmp 0x1406b34c9
je 0x1406b34e0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xb0], rax
movzx eax, r8w
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
inc qword [rsp + 0x28]
bsf eax, r15d
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
cmp byte [rax + rcx], 0
jmp 0x1406b3512
jne 0x1406b34f6
mov rax, qword [rsp + 0x28]
movsx rdx, r10w
shr dx, cl
dec cl
mov qword [rsp + 0x38], rax
movzx ax, spl
btr rcx, 0x98
mov rax, qword [rsp + 0x38]
and cx, 0x8c3d
sub cl, spl
mov dx, r14w
add rax, 0x11
cmc
mov qword [rsp + 0x68], rax
neg eax
mov rax, qword [rsp + 0x60]
xor dh, bh
btr ecx, 0xa0
add rax, 0x3038
jmp 0x1406b356b
mov qword [rsp + 0x70], rax
not cx
mov rdx, qword [rsp + 0x68]
movsx ecx, r15w
mov rcx, qword [rsp + 0x70]
jmp 0x1406b3586
call fcn.1406b4d9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
jmp 0x1406b359a
mov qword [rsp + 0x78], rax
shr ax, 0x1c
mov rax, qword [rsp + 0x30]
clc
mov qword [rsp + 0x48], rax
cmp spl, bpl
cmp qword [rsp + 0x48], 0
jmp 0x1406b35bc
je 0x1406b35e0
mov rcx, qword [rsp + 0x48]
jmp 0x1406b35cc
call fcn.14067d2e5
mov qword [rsp + 0x50], rax
jmp 0x1406b35db
jmp 0x1406b35f8
mov qword [rsp + 0x50], 0
bt rax, 0xa8
mov ah, pe_nt_image_headers64
add rax, 0xffffffffb630098e
mov rax, qword [rsp + 0x50]
bsr rcx, rbx
sar edx, cl
btc edx, 0x3c
mov qword [rsp + 0x80], rax
shl cl, cl
or dx, 0xf5be
cwd
sub r8d, r8d
not ch
mov edx, 0xffa00c1a
mov rdx, qword [rsp + 0x38]
not ch
movsx ecx, sp
mov rcx, qword [rsp + 0xb0]
jmp 0x1406b3639
call fcn.14068307c
mov rcx, qword [rsp + 0x30]
mov dword [rcx], eax
dec ecx
cdqe
movzx rdi, r8w
mov rax, qword [rsp + 0x38]
inc sil
mov di, 0xb63c
inc rax
shr rdi, 0x96
mov rcx, qword [rsp + 0x30]
add rcx, 0x10
movsxd rdi, edi
cmovb rdi, rcx
mov sil, 0x8f
mov rdi, rcx
movzx rcx, r9w
bswap rcx
movsxd rcx, r15d
mov rsi, qword [rsp + 0xb0]
mov cl, sil
mov rcx, rax
movsx ax, bl
rep movsb byte [rdi], byte [rsi]
or al, r12b
lahf
mov rax, qword [rsp + 0x30]
ror sil, cl
sbb sil, r8b
add rsp, 0x98
mov esi, 0xcbaf6288
pop rdi
movzx rsi, r11w
pop rsi
ret
Function at 0x1406c1a01
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
setns r8b
cmova r8w, bx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
xchg ecx, edx
sub rsp, 0x98
mov dword [rsp + 0x58], 1
cqo
movzx r8d, r15w
mov dword [rsp + 0x5c], 0
movzx edx, r13w
xchg rdx, rcx
xorps xmm0, xmm0
movzx cx, bpl
movzx ecx, dx
movss dword [rsp + 0x60], xmm0
movzx edx, dx
not dh
xorps xmm0, xmm0
bswap r8w
movzx r8d, cx
cmovae rdx, r8
movss dword [rsp + 0x64], xmm0
bswap cx
mov r8b, 0x81
xorps xmm0, xmm0
mov r8w, r14w
movss dword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movzx r8, si
bswap dx
movss dword [rsp + 0x6c], xmm0
movsxd r8, r11d
cqo
movzx cx, r14b
mov dword [rsp + 0x70], 0
xchg r8w, cx
bswap ecx
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x78], 0
cqo
movsxd r8, r13d
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x80], 0
movzx rdx, r13w
mov dword [rsp + 0x88], 0
movsx edx, r14w
movsx r8, r9w
mov dword [rsp + 0x20], 0
xchg dx, cx
movsx r8w, r14b
mov dword [rsp + 0x24], 0
xorps xmm0, xmm0
movsx rcx, r14w
bswap cx
movsx r8w, r10b
movss dword [rsp + 0x28], xmm0
cdq
cqo
xorps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
cdq
xorps xmm0, xmm0
cwd
movss dword [rsp + 0x30], xmm0
setno dh
xorps xmm0, xmm0
bswap r8w
movss dword [rsp + 0x34], xmm0
bswap edx
movsx r8, r15w
cwd
mov dword [rsp + 0x38], 0
movzx cx, ah
cdq
cwd
mov dword [rsp + 0x3c], 0
movsxd rdx, edi
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
movsxd rdx, edx
mov qword [rsp + 0x48], 0
bswap r8w
cwd
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0x58]
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
jmp 0x1406c1b9e
call fcn.1406bf713
test eax, eax
je 0x1406c1c61
movsxd rax, dword [rsp + 0x88]
imul rax, rax, 0xe
movzx cx, cl
jmp 0x1406c1bc0
mov rcx, rax
jmp 0x1406c1bc8
call fcn.14068a6a4
mov rcx, qword [rsp + 0xb0]
setge r8b
movsx edx, r10w
mov qword [rcx], rax
mov rax, qword [rsp + 0xb0]
not dx
mov rax, qword [rax]
cqo
mov qword [rsp + 0x48], rax
movzx r8d, r13w
movsx r8d, r15w
mov r8, 0xfffffffff02dbb29
lea r8, [rsp + 0x20]
movzx edx, sp
movzx rcx, r11w
cdq
mov edx, dword [rsp + 0xa8]
movzx ecx, r10w
xchg ch, ch
jmp 0x1406c1c23
mov rcx, qword [rsp + 0xa0]
jmp 0x1406c1c30
call fcn.1406bf713
test eax, eax
jmp 0x1406c1c3c
je 0x1406c1c61
xor eax, eax
jmp 0x1406c1c4b
test eax, eax
jne 0x1406c1c42
mov eax, dword [rsp + 0x50]
jmp 0x1406c1c5c
jmp 0x1406c1c72
mov rax, qword [rsp + 0xb0]
mov qword [rax], 0
xor eax, eax
add rsp, 0x98
jmp 0x1406c1c7e
ret
Function at 0x1406c1c7f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
sar dx, 0x36
rol r8b, 0xa0
mov qword [rsp + 8], rcx
ror r8w, 0x15
btc rcx, rdx
sub rsp, 0x78
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0
cqo
xorps xmm0, xmm0
movzx dx, r11b
xchg dh, dh
not r8w
movss dword [rsp + 0x40], xmm0
movsxd r8, ebx
cmovp cx, r11w
mov r8b, dl
xorps xmm0, xmm0
movsx r8d, bx
cmovs rcx, rsi
xchg edx, r8d
movss dword [rsp + 0x44], xmm0
xorps xmm0, xmm0
movsxd rdx, r14d
movss dword [rsp + 0x48], xmm0
cdq
xorps xmm0, xmm0
bswap rdx
movss dword [rsp + 0x4c], xmm0
mov dword [rsp + 0x50], 0
not r8
movzx rcx, r10w
mov r8b, 0xa8
mov dword [rsp + 0x54], 0
movsx rcx, r15w
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0
movzx rcx, ax
mov qword [rsp + 0x60], 0
movzx rcx, bx
cdq
mov dword [rsp + 0x68], 0
movzx rdx, dx
lea r8, [rsp + 0x38]
cwd
setns dl
movzx dx, r12b
mov edx, dword [rsp + 0x88]
bswap cx
mov cx, si
cmova cx, r9w
mov rcx, qword [rsp + 0x80]
jmp 0x1406c1d7f
call fcn.1406bf713
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x90], 0
jmp 0x1406c1d96
je 0x1406c1de5
cmp dword [rsp + 0x20], 0
jmp 0x1406c1da6
je 0x1406c1dc3
mov eax, dword [rsp + 0x50]
jmp 0x1406c1db5
mov dword [rsp + 0x24], eax
jmp 0x1406c1dbe
jmp 0x1406c1dd3
mov dword [rsp + 0x24], 0
add ax, r10w
xchg cx, ax
inc ecx
mov rax, qword [rsp + 0x90]
mov ecx, dword [rsp + 0x24]
cmp r9b, r10b
mov dword [rax], ecx
clc
cmp qword [rsp + 0x98], 0
je 0x1406c1e44
cmp dword [rsp + 0x20], 0
jmp 0x1406c1dfe
je 0x1406c1e1b
mov eax, dword [rsp + 0x58]
jmp 0x1406c1e0d
mov dword [rsp + 0x28], eax
jmp 0x1406c1e16
jmp 0x1406c1e2b
mov dword [rsp + 0x28], 0
sbb ah, 0xf
btr rax, 0x15
mov rax, qword [rsp + 0x98]
cmovae ecx, r15d
adc rcx, r9
bsr cx, sp
mov ecx, dword [rsp + 0x28]
mov dword [rax], ecx
cmp qword [rsp + 0xa0], 0
je 0x1406c1e90
cmp dword [rsp + 0x20], 0
je 0x1406c1e70
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x2c], eax
jmp 0x1406c1e6b
jmp 0x1406c1e7e
mov dword [rsp + 0x2c], 0
add ax, r11w
mov ecx, edi
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x2c]
test ah, 0x96
clc
mov dword [rax], ecx
cmp qword [rsp + 0xa8], 0
jmp 0x1406c1e9e
je 0x1406c1ee7
cmp dword [rsp + 0x20], 0
je 0x1406c1ec6
mov eax, dword [rsp + 0x5c]
jmp 0x1406c1eb8
mov dword [rsp + 0x30], eax
jmp 0x1406c1ec1
jmp 0x1406c1ed1
mov dword [rsp + 0x30], 0
dec rcx
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x30]
test r12b, 0x1d
mov dword [rax], ecx
test r13b, 0xa
cmp dword [rsp + 0x20], 0
jmp 0x1406c1ef1
je 0x1406c1f0e
mov eax, dword [rsp + 0x68]
jmp 0x1406c1f00
mov dword [rsp + 0x34], eax
jmp 0x1406c1f09
jmp 0x1406c1f18
mov dword [rsp + 0x34], 0
rcr eax, cl
mov eax, dword [rsp + 0x34]
test al, 0x94
cmp r12w, 0x3507
test cx, bx
add rsp, 0x78
jmp 0x1406c1f30
ret
Function at 0x1406d311d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
test bl, bh
movss dword [rsp + 0x18], xmm2
cmc
mov qword [rsp + 0x10], rdx
cmc
mov qword [rsp + 8], rcx
cmc
sub rsp, 0x68
movss xmm0, dword [rsp + 0x80]
jmp 0x1406d314a
ucomiss xmm0, dword [0x1400a4e28]
jne 0x1406d3193
mov rax, qword [rsp + 0x70]
shrd rdx, rbp, 0xb3
cmc
add rax, 0x80
mov qword [rsp + 0x40], rax
xchg dh, cl
mov rdx, qword [rsp + 0x78]
movzx ecx, r11w
mov rcx, 0xe2d0720
mov rcx, qword [rsp + 0x40]
jmp 0x1406d3189
call fcn.1406b5a98
jmp 0x1406d3384
mov rax, qword [rsp + 0x70]
shl dx, 2
sal dl, 0x20
bswap cx
add rax, 0x80
jmp 0x1406d31b6
mov qword [rsp + 0x48], rax
cqo
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x80]
mov ecx, dword [rsp + 0x98]
mov rdx, 0x27393234
movzx edx, di
lea eax, [rcx + rax + 1]
cwd
movzx dx, dh
mov edx, eax
setle cl
mov rcx, 0xfffffffff913a339
mov rcx, qword [rsp + 0x48]
jmp 0x1406d31f9
call fcn.1406b5c1a
mov dword [rsp + 0x20], 0
jmp 0x1406d320b
jmp 0x1406d3231
mov eax, dword [rsp + 0x20]
jmp 0x1406d3219
inc eax
test r11w, 0xf40e
clc
cmp r8w, ax
mov dword [rsp + 0x20], eax
sbb rax, 0xffffffffcfaf4dae
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x20], eax
jg 0x1406d3384
cvtsi2ss xmm0, dword [rsp + 0x20]
cvtsi2ss xmm1, dword [rsp + 0x98]
divss xmm0, xmm1
movss xmm1, dword [rsp + 0x90]
jmp 0x1406d3263
subss xmm1, dword [rsp + 0x88]
jmp 0x1406d3271
mulss xmm0, xmm1
movss xmm1, dword [rsp + 0x88]
addss xmm1, xmm0
movaps xmm0, xmm1
adc ax, 0xd18c
rol ax, cl
rol ah, 0xbb
movss dword [rsp + 0x24], xmm0
add rax, 0xffffffff8b338f0d
jmp 0x1406d32a1
mov rax, qword [rsp + 0x70]
add rax, 0x80
mov qword [rsp + 0x50], rax
jmp 0x1406d32b6
movss xmm0, dword [rsp + 0x24]
jmp 0x1406d32c1
call fcn.1400942b0
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
movss xmm1, dword [rax + 4]
addss xmm1, xmm0
jmp 0x1406d32e2
movaps xmm0, xmm1
jmp 0x1406d32ea
movss dword [rsp + 0x30], xmm0
jmp 0x1406d32f5
movss xmm0, dword [rsp + 0x24]
jmp 0x1406d3300
call fcn.140093af0
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
jmp 0x1406d331e
movss xmm1, dword [rax]
movsxd rdx, r10d
movzx cx, r15b
addss xmm1, xmm0
setg cl
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
movsxd rcx, esi
xchg rdx, rdx
cwd
movss xmm0, dword [rsp + 0x28]
bswap rdx
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x30]
xchg edx, ecx
movsxd rcx, edi
movss dword [rsp + 0x3c], xmm0
mov cx, 0x7a97
movzx cx, r15b
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
jmp 0x1406d337a
call fcn.1406b5a98
jmp 0x1406d3210
add rsp, 0x68
ret
Function at 0x1406d8b1b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
add eax, r13d
adc al, r10b
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
rcl rax, cl
and rax, rax
sub rsp, 0x18
cmc
bswap ax
test r12b, 0x9f
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
test ecx, edi
cmc
stc
lea rcx, [rcx + rax]
mov rax, rcx
rcl rcx, cl
shr ecx, cl
rol rcx, 0x16
mov ecx, dword [rsp + 0x38]
cmc
clc
imul ecx, dword [rsp + 0x50]
cmc
movsxd rcx, ecx
stc
test r15b, 0x99
add rax, rcx
jmp 0x1406d8b81
mov qword [rsp + 8], rax
cbw
movzx eax, r12w
mov eax, dword [rsp + 0x48]
jmp 0x1406d8b95
mov dword [rsp + 4], eax
jmp 0x1406d8be9
mov eax, dword [rsp + 4]
movsx cx, dl
inc cl
movsx ecx, dx
dec eax
ror cx, cl
mov dword [rsp + 4], eax
movsxd rax, dword [rsp + 0x50]
sal cx, cl
xor cl, r11b
shrd cx, cx, 0xbc
mov rcx, qword [rsp + 8]
cmp r8w, 0x7d08
add rcx, rax
sub ax, 0xe721
add al, 0x39
rcr ah, cl
mov rax, rcx
test sil, r9b
mov qword [rsp + 8], rax
cmp spl, 0x11
cmp dword [rsp + 4], 0
jle 0x1406d8c9b
mov dword [rsp], 0
jmp 0x1406d8c00
jmp 0x1406d8c27
mov eax, dword [rsp]
jmp 0x1406d8c0d
inc eax
jmp 0x1406d8c1a
mov dword [rsp], eax
movsx eax, r15w
bt eax, 0x8d
add al, 0x2a
mov eax, dword [rsp + 0x40]
cmp r15w, dx
cmp dword [rsp], eax
jmp 0x1406d8c37
jge 0x1406d8c96
movsxd rax, dword [rsp]
movsx r8d, r9w
mov rcx, qword [rsp + 8]
movzx r8d, r8w
movzx eax, byte [rcx + rax]
bswap r8d
movzx dx, r8b
movsxd rcx, dword [rsp]
movsx r8w, r13b
cdq
mov rdx, qword [rsp + 8]
jmp 0x1406d8c76
mov r8, qword [rsp + 0x20]
jmp 0x1406d8c80
mov al, byte [r8 + rax]
jmp 0x1406d8c89
mov byte [rdx + rcx], al
jmp 0x1406d8c91
jmp 0x1406d8c05
jmp 0x1406d8b9e
add rsp, 0x18
jmp 0x1406d8ca4
ret
Function at 0x1406f91da
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
rcl eax, cl
mov r8, rcx
mov eax, 0x5a4d
cmc
cmp word [0x140000000], ax
jmp 0x1406f91f5
jne 0x1406f9308
movsxd rcx, dword [0x14000003c]
btc dx, 0xbb
setno dl
lea rdx, [0x140000000]
test ax, 0xf500
lea rcx, [rcx + rdx]
stc
cmp dword [rcx], 0x4550
jne 0x1406f9308
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1406f9234
jne 0x1406f9308
sub r8, rdx
bsr rax, rsp
movzx eax, word [rcx + 0x14]
or dl, spl
bt r9w, 0xb8
lea rdx, [rcx + 0x18]
lea rdx, [rdx + rax]
movsx r9w, r9b
btc r9w, r15w
movzx eax, word [rcx + 6]
stc
bts r9d, r11d
cmovns ecx, esi
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp bpl, 4
cmp rdx, r9
jmp 0x1406f9284
je 0x1406f92c3
mov ecx, dword [rdx + 0xc]
cmc
jmp 0x1406f9293
cmp r8, rcx
jmp 0x1406f929b
jb 0x1406f92b5
mov eax, dword [rdx + 8]
cmc
add eax, ecx
cmp r8, rax
jmp 0x1406f92af
jb 0x1406f92c7
add rdx, 0x28
jmp 0x1406f92be
jmp 0x1406f9274
xor edx, edx
test eax, eax
test rdx, rdx
jmp 0x1406f92cf
jne 0x1406f92e1
xor al, al
jmp 0x1406f92dc
jmp 0x1406f9316
cmp dword [rdx + 0x24], 0
jmp 0x1406f92ea
jge 0x1406f92fc
sub al, al
jmp 0x1406f92f7
jmp 0x1406f9316
mov al, 1
jmp 0x1406f9303
jmp 0x1406f9316
xor al, al
jmp 0x1406f930f
jmp 0x1406f9316
add rsp, 0x18
ret
Function at 0x1406fd96d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
sbb r10b, 0xb8
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
sub r10d, 0x3ca8c21d
bts r10w, r13w
mov qword [rax + 0x20], r14
or rbx, 0x2c89f80c
cmp dword [rcx + 0x10], 0
xchg r10d, ebx
mov rbx, r8
jmp 0x1406fd9ac
mov r10, rdx
jmp 0x1406fd9b4
je 0x1406fdb66
movsxd r9, dword [rcx + 0x10]
lea r14, [0x140000000]
sar al, 0x96
stc
mov rdi, qword [rdx + 8]
or r11b, bpl
sub esi, esi
shr eax, 0xb0
adc ecx, edx
cbw
add r9, rdi
shrd r11d, edx, 0x16
shr r11b, 0x98
sbb ax, 0x308e
or edx, 0xffffffff
jmp 0x1406fd9f4
sub r8d, r8d
xor rax, 0xffffffffaeb2f89c
and al, bpl
movzx ecx, byte [r9]
sal ah, cl
shr r11b, 0x89
rcl ax, 0xab
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0x97a98]
or r11b, 0x3f
adc r11w, si
bt r11d, r15d
mov cl, byte [rcx + r14 + 0x97aa8]
movzx r11, r10w
sbb r11, r8
ror r11w, 0x8e
sub r9, rax
shl r11w, cl
mov r11d, dword [r9 - 4]
shr r11d, cl
jmp 0x1406fda4e
test r11d, r11d
jmp 0x1406fda56
je 0x1406fdb66
mov rax, qword [r10 + 0x10]
adc r10b, bl
setno r10b
mov r10b, r13b
mov r10d, dword [rax]
bt ax, 0xa3
movzx ecx, byte [r9]
mov rax, 0x4d232b1d
jmp 0x1406fda82
and ecx, 0xf
test r8d, 0xc49a200b
bsf rax, rbx
cbw
movsx rax, byte [rcx + r14 + 0x97a98]
mov cl, byte [rcx + r14 + 0x97aa8]
sub r9, rax
rol ah, cl
test si, 0x8e9d
sal al, cl
mov eax, dword [r9 - 4]
cmp dx, 0x42b1
shr eax, cl
cmp ax, 0x7884
add esi, eax
setno ah
rol al, cl
mov eax, esi
test sil, 0x21
cmp dx, r14w
add rax, r10
cmp bh, ah
clc
add rax, rdi
jmp 0x1406fdadd
cmp rbx, rax
jb 0x1406fdb4c
movzx ecx, byte [r9]
mov rax, r9
cmovnp edx, eax
bswap eax
inc r8d
and ecx, 0xf
xadd ah, dl
sal dl, cl
adc dl, bl
movsx rax, byte [rcx + r14 + 0x97a98]
mov dx, 0x9b2
inc dl
and rdx, 0xffffffffe2027712
mov cl, byte [rcx + r14 + 0x97aa8]
sub r9, rax
ror edx, 0x99
seta dh
mov edx, dword [r9 - 4]
test dx, 0x671e
shr edx, cl
dec edx
test cl, r11b
jmp 0x1406fdb3e
cmp r8d, r11d
jmp 0x1406fdb46
jb 0x1406fda72
test r8d, r8d
jmp 0x1406fdb54
je 0x1406fdb66
mov eax, edx
jmp 0x1406fdb61
jmp 0x1406fdb70
or eax, 0xffffffff
movsx r14, cx
movsxd rbx, r11d
mov rbx, qword [rsp + 8]
movsx esi, bp
xchg r14w, di
mov rsi, qword [rsp + 0x10]
cmove di, cx
movsx r14, bx
mov rdi, qword [rsp + 0x18]
movsx r14d, r13w
mov r14, qword [rsp + 0x20]
jmp 0x1406fdb9c
ret
Function at 0x140700b58
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
sbb al, r11b
shl rax, cl
mov qword [r11 + 0x18], rbx
sub rax, r10
add bx, 0x61bb
movzx ax, r10b
mov qword [r11 + 0x20], r9
cwde
shl al, cl
mov dword [rsp + 0x10], edx
xchg bl, bl
movzx bx, ah
rcr bl, cl
push rbp
movsx rbx, si
btr rbx, rsi
sbb bh, 0x81
push rsi
jmp 0x140700b9a
push rdi
jmp 0x140700ba7
push r12
push r13
push r14
shl r12, cl
push r15
bt r12w, 0xa
rcl si, cl
sub rsp, 0x20
cbw
xor r13w, r13w
cwde
mov rax, qword [rcx + 8]
add r13b, 0x9c
and sil, 0xb5
xor bpl, bpl
sub r14b, r14b
test dl, r15b
sub r13b, sil
xor bx, 0x2e8b
mov qword [r11 + 8], rax
and bl, 0x96
xchg sil, r13b
xor edi, edi
sar bh, 0xb0
mov r12, r9
btc r15, 0xa1
ror r13b, 0x25
bswap r15w
mov r13d, r8d
test rsp, 0xffffffffe998e98b
mov rbx, rcx
lea rsi, [rax - 1]
sal r15d, 0xb2
rcr r15w, 1
sar r15b, 0x90
mov r15, rsi
jmp 0x140700c2b
cmp dword [rcx], edi
jmp 0x140700c32
jle 0x140700cc8
mov r12d, dword [r11 + 0x10]
cmp edi, r12d
jmp 0x140700c44
jne 0x140700c54
mov rsi, rax
mov bpl, 1
clc
test spl, r11b
cmp edi, r13d
jne 0x140700c6b
mov r15, rax
test r8b, r9b
mov r14b, 1
jmp 0x140700c6b
test bpl, bpl
jmp 0x140700c73
je 0x140700c82
test r14b, r14b
jne 0x140700cbb
lea rdx, [rsp + 0x60]
movzx rcx, r9w
mov rcx, rbx
jmp 0x140700c93
call fcn.1403da744
inc edi
clc
test r9w, sp
cmp edi, dword [rbx]
jmp 0x140700ca6
jge 0x140700cbb
mov rax, qword [rsp + 0x60]
jmp 0x140700cb6
jmp 0x140700c3c
mov r12, qword [rsp + 0x78]
jmp 0x140700cc8
mov rax, qword [r12]
mov qword [r12 + 8], rsi
movups xmm0, xmmword [rbx]
and bpl, 0xac
sal r14b, cl
shr sil, 0x81
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
sal dil, cl
test r13b, 0x34
xchg di, bp
movups xmmword [rax + 0x10], xmm1
mov rax, qword [rsp + 0x80]
movsxd r14, r8d
movzx r12d, ax
rol bp, cl
mov rcx, qword [rax]
bts bp, ax
movsx r13d, r12w
mov qword [rax + 8], r15
btr r12w, 0xa0
shld r14w, r12w, 0xa7
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
sal esi, cl
movups xmm1, xmmword [rbx + 0x10]
mov rbx, qword [rsp + 0x70]
bsr si, r12w
movups xmmword [rcx + 0x10], xmm1
add rsp, 0x20
movzx ebp, bx
mov r15d, r10d
pop r15
movsx r12, r14w
seto r12b
pop r14
pop r13
pop r12
not bpl
pop rdi
xchg bpl, sil
pop rsi
movzx bp, r13b
movsxd rbp, ebx
pop rbp
ret