joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403f7f42
Capabilities:
Encode data using xor

Disassembly:
setns r8b
add qword [rsp + r8*8 + 0x10643810], 0xffffffffbffd3c0c
lea r14, [r8 + riz - 0x51ecba46]
mov r8, qword [rsp + r14 + 0x53f9415e]
neg r14b
and r14b, r14b
shl r14b, 0x46
and r14, qword [rsp + r14 + 0x53f941a8]
mov r14, qword [rsp + 0x38]
mov byte [rsp + 0x28], 0xa6
cmp byte [rsp + 0x28], 0x16

Function at 0x1403fc736
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 0x38]
not r8
mov dword [rsp + 0x48], 0x1c8a409d
ja 0x1404c67e8
mov qword [rsp + 0x40], rdi
push rdi
movabs rsi, 0x2324a6a9e58600a8
sets r9b
lea rsi, [r9 + rsi*2 - 0x45e04141]
push r13
add qword [rsp + 0x48], 0x4882fd
mov qword [rsp + 8], rsi
push r11
not r9w
push rbp
mov r11, qword [rsp + r9 + 0x52485919]
mov rdi, qword [rsp + 0x58]
mov rdi, qword [rdi]
mov qword [rsp + 0x58], r11
neg sil
mov rbp, r9
xor r11w, word [rsp + 0x58]
jg 0x14004a0da
invalid
insb byte [rdi], dx
or eax, 0xa5348d65
mov cl, bl
movabs al, byte [0x830f1f182464c162]
adc byte [r14 + 0x748b48ff], sil
and al, 0x50
shl dword [rsp + 0x18], 0x1f
jae fcn.14002783e
mov rsi, qword [rsp + 0x50]
setns byte [rsp + 0x18]
or word [rsp + 0x18], 0x6103
setae byte [rsp + 0x18]
call fcn.1400bae7a
nop
xor dword [rsi - 0xa], eax
cmp bh, byte [rdx]
leave
xor al, 0xeb
ror byte [rdx + 0x74806d06], cl
in eax, 0x8e
jno 0x1404c67dd
jg 0x1404c67c0
leave
invalid

Function at 0x140402a60
Capabilities:
Encode data using base64

Disassembly:
jg 0x140431b4e
push rax
push rsi
pushfq
movabs rsi, 0x7605611da38ba61d
xor esi, 0x8a942614
call fcn.140064b22

Function at 0x140426f36
Capabilities:
Hash data with crc32

Disassembly:
lea rcx, [rcx + rsi + 0x17ef07b0]
seto sil
push rbp
mov r11, rsi
xchg qword [rsp + r11 + 0x57edf740], rcx
mov r11, qword [rsp + rsi + 0x57edf710]
jo 0x14002b0ed
call fcn.140374c50
scasd eax, dword [rdi]
wait
xchg edx, eax
or al, bl
invalid
push rdx
Function at 0x1404366ff
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x1f
fisttp word [rsp + rbp*4]
adc al, 0x1f
and byte [rdi - 0x55], cl
sti
fisubr word [rdi - 0x62]
cmpsd dword [rsi], dword [rdi]
stosd dword [rdi], eax
fist word fs:[rsi]
mov bh, 0xc1
and byte [rdx], ah
jns 0x1404366d5
wait
and byte [rcx], cl
sbb dword [rsi + 0x56], 0x7eb2fadf
shl byte [rax], 1
fbld tbyte [rdi + 0x20f4555e]
adc eax, 0x520bf46
xor eax, 0x43de99c2
loop 0x140436760
invalid
mov dh, 0x1c
fbstp tbyte [rsi - 0xa]
mov dh, 0x1c
and byte [0x155225f03], dl
add al, 0x4d
stosd dword [rdi], eax
add al, 0xdf
or r10b, 0x9e
and r10, r10
sub r10b, r10b
js 0x1400259eb
add qword [rsp], 0xffffffffffbea4d5
call fcn.1400651e7
je 0x1404366b6
cmp eax, 0xdd67e46b
mov ecx, dword [rbx - 0x1d6108d6]
movabs dword [0x66d7c816be9d6267], eax
invalid
cmp eax, 0x6bc3b3bf
fucom st(3)
xor esi, dword [rdx + 0x3be292d0]
xchg edx, eax
loop 0x14043679e
outsb dx, byte [rsi]
popfq
mov gs, word [rsi - 0x22950f60]
stosd dword [rdi], eax
jne 0x140436756
push 0x1d
xor byte [rdi + 0x222f42a1], 0xd4
xchg edi, eax
movabs byte [0x2fa17dbd661a225f], al
push 2
cdqe
adc al, 0x18
mov eax, 0xf7f99040
jmp 0x199947062
push rsi
pop rax
in al, dx
jae 0x14043676f
or byte [rdi - 0x28c98bb4], al
mov cl, 0x1e
scasd eax, dword [rdi]
cmp dh, byte [rdi]
lahf
jbe 0x14043681a
ret 0xbe14
shr byte [rsi], 0x1e
jmp 0x121d9e97a

Function at 0x14043f1ac
Capabilities:
Packed with generic packer

Disassembly:
mov r13, qword [rsp + r13*2 + 0x58]
jo 0x1404a3923
test qword [rsp + 0x60], 0x6d25cb16
js 0x140057091
call fcn.1403b4bcc

Function at 0x14045941a
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xffffffffffb9f0a9
shr bl, 0x61
mov r14, qword [rsp + rbx - 0x6b27b34]
push r13
and word [rsp + 0x30], r14w
mov r13, r9
jne 0x14039ea09
pushfq
add qword [rsp + 8], 0xffffffffbf8e3910
mov qword [rsp + 8], 0xffffffffabd86a27
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.14057450f

Function at 0x14047836a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.140049faa
invalid
mov r12, r13
jne 0x140323d78

Function at 0x14049711f
Capabilities:
Packed with generic packer

Disassembly:
sub word [rsp + 0x10], 0x1c11
mov qword [rsp + 0x30], rdx
sub dword [rsp + 0x10], 0x6e81b323
shl qword [rsp + 0x10], 0x57
sub word [rsp + 0x10], 0xc59d
add qword [rsp + 8], 0x448b5d
mov rdx, qword [rsp + 0x10]
sub dx, dx
mov byte [rsp + 0x10], 0x8f
sub word [rsp + 0x10], 0xe925
cmp word [rsp + 0x10], 0x8205
jle 0x1404da964
test edx, 0xcbaefba5
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx]
mov word [rsp + 0x10], 0xb623
jb 0x1403202e5
jo 0x1403b07c8
mov qword [rsp + 8], 0xffffffffe5157625
add qword [rsp + 8], 0xffffffffd7ab5bab
jae 0x140095a15
cmp dword [rsp], 0xa807e330
push r11
call fcn.1404ac174
or cl, 0x97
xor dword [rsp + rcx*2 - 0x3c346726], 0x40b76610
xchg qword [rsp + 0x68], rsi
mov r9, qword [rsp + 0x40]
call fcn.14030337e
setl byte [rsp + 0x10]
lea rdx, [rdx + 1]
jle 0x1403e71ae
jae 0x140057091
call fcn.14003dfc3
jmp 0x19dd84fb4
Function at 0x1404a787c
Capabilities:
Encode data using xor

Disassembly:
jae 0x1404be6f9
invalid
setns byte [rsp + 0x48]
shr r10w, 0xba
mov r10, qword [rsp + 0x30]
movzx r11, r11b
cmp qword [rsp + r11 - 0x3d], 0xffffffffd3835e2d
jg 0x140321751
call fcn.1400bcd3b
shr r8w, 0x18
lea r8, [r8*4 - 0x21715d5e]
push r11
mov r11, r8
call fcn.14006ce25

Function at 0x1404b75c9
Capabilities:
Encode data using xor

Disassembly:
not dword [rsp + 0x10]
add qword [rsp], 0xffffffffbff6de8f
sub byte [rsp + 0x10], 0x20
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
ret
jle 0x1404257d8

Function at 0x1404da8a0
Capabilities:
Packed with generic packer

Disassembly:
shl cx, cl
push rbx
mov rdi, qword [rsp + rdx - 0x6631]
mov rdi, qword [rdi]
movabs rbx, 0xa2b0b4b67a9b9c94
cmp r14b, 0xf
jne 0x140034351

Function at 0x1404da8c3
Capabilities:
Packed with generic packer

Disassembly:
jl 0x1403f79f0
mov dword [rsp + 0x30], 0xbd22528e
jle 0x14043f0cf
Function at 0x140663302
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
rcl eax, 2
cbw
bts ax, sp
mov qword [rsp + 0x10], rdx
inc ax
mov qword [rsp + 8], rcx
cdqe
sub rsp, 0x48
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
test eax, eax
jmp 0x140663334
je 0x140663566
mov rax, qword [rsp + 0x58]
clc
jmp 0x140663348
cmp qword [rsp + 0x50], rax
jmp 0x140663352
jne 0x140663367
mov rax, qword [rsp + 0x50]
jmp 0x140663362
jmp 0x140663590
mov byte [rsp + 0x20], 1
cdqe
cbw
mov rax, qword [rsp + 0x58]
jmp 0x14066337a
mov qword [rsp + 0x38], rax
jmp 0x140663384
jmp 0x14066339b
mov rax, qword [rsp + 0x38]
inc rax
rcr ch, cl
sal ch, 0x1a
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
clc
adc ecx, 0xac82e72e
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
test r15b, 0xe
cmp qword [rsp + 0x38], rax
jmp 0x1406633c0
je 0x1406633f7
mov rax, qword [rsp + 0x38]
cmp rbx, 0x3eabe631
cmc
cmp qword [rsp + 0x50], rax
jmp 0x1406633dd
jne 0x1406633f2
mov byte [rsp + 0x20], 0
jmp 0x1406633ed
jmp 0x1406633f7
jmp 0x140663389
movzx eax, byte [rsp + 0x20]
test si, si
jmp 0x140663404
test eax, eax
je 0x1406634ac
mov qword [rsp + 0x28], 0
jmp 0x14066341a
jmp 0x14066343b
mov rax, qword [rsp + 0x28]
jmp 0x140663429
inc rax
test al, r9b
test r12, 0xffffffff8c2f5d9c
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x28], rax
jae 0x1406634a7
mov rax, qword [rsp + 0x28]
btc edx, 0x23
movsxd rcx, r15d
mov rcx, qword [rsp + 0x50]
adc dx, 0xe03c
lea rcx, [rcx + rax]
mov dx, di
mov rax, rcx
stc
xor dx, si
mov ch, 0x8d
mov rcx, qword [rsp + 0x28]
xchg rdx, rdx
shl dh, cl
test dl, r9b
mov rdx, qword [rsp + 0x58]
stc
test r13w, cx
add rdx, rcx
mov rcx, rdx
jmp 0x140663494
mov cl, byte [rcx]
jmp 0x14066349b
mov byte [rax], cl
jmp 0x1406634a2
jmp 0x14066341f
jmp 0x140663557
mov qword [rsp + 0x30], 0
jmp 0x1406634ba
jmp 0x1406634df
mov rax, qword [rsp + 0x30]
jmp 0x1406634c9
inc rax
cmp r13b, 0x27
test di, r9w
mov qword [rsp + 0x30], rax
dec al
not ah
nop
mov rax, qword [rsp + 0x60]
jmp 0x1406634ec
cmp qword [rsp + 0x30], rax
jae 0x140663557
mov rax, qword [rsp + 0x60]
jmp 0x140663504
dec rax
not cx
adc rdx, r12
sub rax, qword [rsp + 0x30]
cdq
movzx dx, r8b
cmovne r8w, r10w
mov rcx, qword [rsp + 0x60]
dec rcx
btr dx, 0xba
cmova r8, rsp
bts edx, r11d
sub rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov al, byte [r8 + rax]
jmp 0x14066354a
mov byte [rdx + rcx], al
jmp 0x140663552
jmp 0x1406634bf
mov rax, qword [rsp + 0x50]
jmp 0x140663561
jmp 0x140663590
mov r8, qword [rsp + 0x60]
jmp 0x140663570
mov rdx, qword [rsp + 0x58]
movzx rcx, r13w
seto ch
mov rcx, qword [rsp + 0x50]
jmp 0x140663586
call fcn.1406ef82c
mov rax, qword [rsp + 0x50]
add rsp, 0x48
jmp 0x140663599
ret
Function at 0x14066dee1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
rcr rax, 5
sar ax, 0xba
ror eax, cl
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
shr eax, cl
sub rsp, 0x88
and rax, 0x6031e8a4
mov rax, qword [rsp + 0x90]
test r9, r9
mov qword [rsp + 0x28], rax
btc ax, dx
cmp ecx, ebx
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x30], rax
ror al, cl
cmp r13b, dil
bts ax, r12w
mov byte [rsp + 0x20], 0
xor eax, r10d
movzx eax, byte [rsp + 0x20]
cmc
test eax, eax
jne 0x14066dfe0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
movzx r8d, r10w
mov r8, qword [rsp + 0x50]
xchg dl, dh
movsx rdx, r12w
movsx ecx, ax
mov rdx, qword [rsp + 0x30]
cmovb ecx, ebp
movsx rcx, r10w
mov cx, 0x2793
mov rcx, qword [rsp + 0x28]
jmp 0x14066df8b
call fcn.14066e156
mov rax, qword [rsp + 0x28]
sbb rcx, 0xffffffff8bacee31
bt cx, 0x2d
mov rcx, qword [rsp + 0x30]
stc
sub rcx, rax
btc eax, 0xc
rcr ax, cl
adc al, r8b
mov rax, rcx
sar rax, 3
movsx ecx, bx
movsxd rcx, ecx
movsx rcx, ax
mov rcx, qword [rsp + 0xa0]
jmp 0x14066dfd2
lea rax, [rcx + rax*8]
jmp 0x14066dfdb
jmp 0x14066e0dc
mov rax, qword [rsp + 0xa0]
jmp 0x14066dfed
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
jmp 0x14066dfff
mov qword [rsp + 0x40], rax
movzx ax, al
nop
movzx eax, bp
mov rax, qword [rsp + 0xa8]
jmp 0x14066e01a
mov qword [rsp + 0x48], rax
jmp 0x14066e040
mov rax, qword [rsp + 0x28]
cmp cx, 0x8c39
test bpl, 0x8f
add rax, 8
mov qword [rsp + 0x28], rax
bts ax, r12w
mov rax, qword [rsp + 0x30]
cmc
stc
cmp dh, 0x88
cmp qword [rsp + 0x28], rax
je 0x14066e08e
mov rax, qword [rsp + 0x28]
movsxd rcx, r8d
mov ecx, 0xa7b540b7
movzx rdx, r14w
mov qword [rsp + 0x58], rax
movsx edx, r14w
not rdx
setp cl
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x38]
jmp 0x14066e084
call fcn.14066e2ff
jmp 0x14066e024
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
btr eax, 0xe
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
cwde
sal al, 0xc
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x68], rax
sbb al, r9b
mov rax, qword [rsp + 0x40]
cmp dl, r11b
cmc
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
cwde
movzx ax, r14b
mov rax, qword [rsp + 0x60]
add rsp, 0x88
jmp 0x14066e0e8
ret
Function at 0x140678f33
Capabilities:
Execute anti-debugging instructions

Disassembly:
movss dword [rsp + 0x20], xmm3
bt ax, 0x87
not ax
mov qword [rsp + 0x18], r8
rol ah, 0xe
jmp 0x140678f53
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
btc eax, r15d
bts ax, ax
mov ah, 0x38
sub rsp, 0x98
clc
lahf
sal ah, cl
mov rax, qword [0x1400b0840]
test r14b, r11b
stc
mov qword [rsp + 0x60], rax
sar ax, cl
bsf ax, r15w
mov rax, qword [rsp + 0x60]
cmc
mov rax, qword [rax + 0x1a80]
mov qword [rsp + 0x70], rax
cmp cl, r11b
test r8b, 0x94
cmc
cmp qword [rsp + 0xb0], 0
jne 0x140679048
mov rax, qword [rsp + 0xa8]
movzx ecx, r9w
movsx cx, bpl
mov qword [rsp + 0x68], rax
not cl
setb al
movsxd rax, r8d
mov qword [rsp + 0x58], 0xffffffffffffffff
movsxd rax, ecx
xchg ah, ah
inc qword [rsp + 0x58]
mov cx, r10w
ror ah, 0x28
shr ch, 0xe
mov rax, qword [rsp + 0x68]
add cx, 0x2c37
movsx rcx, bp
add cl, bh
mov rcx, qword [rsp + 0x58]
clc
cmp r8b, r15b
cmp byte [rax + rcx], 0
jmp 0x140679011
jne 0x140678fe0
mov rax, qword [rsp + 0x58]
shld ecx, esp, 0x9a
movsx cx, ah
mov rcx, qword [rsp + 0xa8]
lea rcx, [rcx + rax]
cmp r9w, ax
btc eax, 0x95
mov rax, rcx
cmp sil, 0x19
clc
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rsp + 0xa8], rax
jmp 0x14067905d
je 0x1406791e8
mov rax, qword [rsp + 0x70]
cmp ax, 0x9e85
cmp r14b, r13b
mov rax, qword [rax + 0x2b0]
cmp r8b, 0x8b
mov qword [rsp + 0x80], rax
clc
jmp 0x14067908c
movss xmm1, dword [0x1400a8edc]
test dx, 0x468d
test r13b, r8b
sub ecx, ecx
jmp 0x1406790a3
call fcn.140678397
mov dword [rsp + 0x50], eax
cmovb r9w, dx
mov cx, 0x4b3e
mov rax, qword [rsp + 0x60]
movss xmm0, dword [rax + 0x1928]
cmovnp rdx, rsi
movzx rdx, sp
movsx ecx, sp
movss dword [rsp + 0x54], xmm0
rdtsc
setb r9b
mov rax, qword [rsp + 0x60]
not dx
movsx rdx, r11w
movzx rcx, cx
mov rax, qword [rax + 0x1920]
xchg cx, dx
movsx r9, r13w
bswap r9d
mov qword [rsp + 0x78], rax
cbw
rdtsc
mov qword [rsp + 0x40], 0
not r9b
lahf
movss xmm0, dword [rsp + 0xb8]
cmovne dx, cx
not ch
movss dword [rsp + 0x38], xmm0
movsx ecx, r9w
mov rax, qword [rsp + 0xb0]
bswap cx
mov qword [rsp + 0x30], rax
mov dl, ah
bswap cx
mov rax, qword [rsp + 0xa8]
bswap dx
mov cx, dx
xchg dl, dh
mov qword [rsp + 0x28], rax
movsxd rcx, eax
mov r9b, 0xac
setl cl
mov eax, dword [rsp + 0x50]
cdq
cqo
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0xa0]
cdq
setnp ch
movss xmm2, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x78]
movsx rcx, r14w
movzx ecx, r13w
movsx cx, cl
mov rcx, qword [rsp + 0x80]
jmp 0x140679197
call fcn.1406c811f
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x3048]
test r12b, 0xe
cmp r12b, r9b
test eax, eax
jmp 0x1406791b6
je 0x1406791e8
mov r8, qword [rsp + 0xb0]
movsx dx, spl
mov rdx, qword [rsp + 0xa8]
cmovno cx, r11w
lea rcx, [rsp + 0xa0]
jmp 0x1406791e3
call fcn.1406a608c
add rsp, 0x98
jmp 0x1406791f4
ret
Function at 0x140679e93
Capabilities:
Execute anti-debugging instructions

Disassembly:
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
ror al, cl
rcr ax, 0xa3
sub rsp, 0xc8
movzx ax, r13b
mov eax, esi
mov rax, qword [0x1400b0840]
jmp 0x140679ec3
mov qword [rsp + 0x80], rax
cmovge rax, r15
mov rax, qword [rsp + 0x80]
jmp 0x140679edc
mov rax, qword [rax + 0x1a80]
mov qword [rsp + 0x98], rax
cdqe
mov rax, qword [rsp + 0x80]
movss xmm0, dword [rax + 0x15ac]
jmp 0x140679f02
movss dword [rsp + 0x40], xmm0
jmp 0x140679f0d
movss xmm0, dword [rsp + 0x40]
comiss xmm0, dword [0x1400a8dfc]
jbe 0x14067a1aa
mov rax, qword [rsp + 0x98]
movzx ecx, r10w
movsx ecx, bp
sete cl
mov rax, qword [rax + 0x2b0]
movsx rcx, cx
mov cl, dil
movzx rcx, r14w
mov qword [rsp + 0xb0], rax
movsx ecx, di
movss xmm1, dword [0x1400a8edc]
mov ecx, 6
jmp 0x140679f61
call fcn.140678397
mov dword [rsp + 0x68], eax
cwde
rdtsc
cdq
movss xmm0, dword [0x1400a8edc]
movss dword [rsp + 0x70], xmm0
setae dh
movzx rcx, r11w
cdq
movss xmm0, dword [0x1400a8edc]
movss dword [rsp + 0x74], xmm0
movss xmm0, dword [rsp + 0xdc]
bswap r9
addss xmm0, dword [rsp + 0x74]
movss dword [rsp + 0x50], xmm0
movss xmm0, dword [rsp + 0xd8]
movzx eax, cx
addss xmm0, dword [rsp + 0x70]
movss dword [rsp + 0x48], xmm0
rdtsc
cdqe
cdq
movss xmm0, dword [rsp + 0x48]
xchg r9w, cx
not cl
movss dword [rsp + 0x88], xmm0
movss xmm0, dword [rsp + 0x50]
movss dword [rsp + 0x8c], xmm0
lea rax, [rsp + 0x88]
mov qword [rsp + 0xa0], rax
movzx eax, r11w
cbw
movss xmm0, dword [0x1400a8edc]
cwde
movss dword [rsp + 0x78], xmm0
jmp 0x14067a01b
movss xmm0, dword [0x1400a8edc]
mov ax, r8w
cmovo edx, edi
cqo
movss dword [rsp + 0x7c], xmm0
jmp 0x14067a03c
movss xmm0, dword [rsp + 0xd4]
jmp 0x14067a04c
addss xmm0, dword [rsp + 0x7c]
movzx ecx, bx
movss dword [rsp + 0x60], xmm0
movss xmm0, dword [rsp + 0xd0]
addss xmm0, dword [rsp + 0x78]
movzx ecx, bp
not cx
movss dword [rsp + 0x58], xmm0
not r9b
movsxd rax, esi
movss xmm0, dword [rsp + 0x58]
lahf
movss dword [rsp + 0x90], xmm0
xchg ah, ah
movss xmm0, dword [rsp + 0x60]
mov r8d, ebx
movzx rdx, di
movss dword [rsp + 0x94], xmm0
lea rax, [rsp + 0x90]
mov qword [rsp + 0xa8], rax
movss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x30], xmm0
movsx rcx, bp
mov dword [rsp + 0x28], 0xf
movzx edx, r9w
movss xmm0, dword [rsp + 0xe0]
movss dword [rsp + 0x20], xmm0
xchg r8b, dl
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0xa0]
cwd
movzx dx, r12b
not dl
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
jmp 0x14067a10d
call fcn.1406c7356
mov rax, qword [rsp + 0x98]
movsxd rcx, esi
movsx ecx, r8w
mov rax, qword [rax + 0x2b0]
mov qword [rsp + 0xb8], rax
movss xmm1, dword [0x1400a8edc]
bswap rcx
mov ecx, 5
call fcn.140678397
mov dword [rsp + 0x6c], eax
movss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0xf
movsx cx, r9b
sets r8b
xchg dl, r8b
movss xmm0, dword [rsp + 0xe0]
movzx r8w, sil
movss dword [rsp + 0x20], xmm0
cwd
mov r9d, dword [rsp + 0x6c]
lea r8, [rsp + 0xd8]
cdq
mov dx, 0x2a33
lea rdx, [rsp + 0xd0]
movzx cx, al
mov rcx, qword [rsp + 0xb8]
call fcn.1406c7356
add rsp, 0xc8
jmp 0x14067a1b6
ret
Function at 0x1406a6773
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
cmove rax, r9
mov rax, qword [0x1400b0840]
setge dl
cmovo dx, r9w
movsx cx, bpl
mov qword [rsp + 0x60], rax
bswap cx
lea rdx, [0x1400a46bc]
movsx rcx, r8w
setns cl
mov rcx, qword [rsp + 0xb0]
jmp 0x1406a67bc
call fcn.1406ef29c
mov qword [rsp + 0x40], rax
cmc
clc
cmp qword [rsp + 0x40], 0
jmp 0x1406a67d3
je 0x1406a67e9
mov rax, qword [rsp + 0x40]
bswap cx
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
xchg ch, cl
mov qword [rsp + 0x58], rax
lahf
movsx eax, r8w
mov ecx, 0x7837cf2e
mov qword [rsp + 0x28], 0xffffffffffffffff
bswap eax
setge cl
inc qword [rsp + 0x28]
setp ah
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
clc
cmp byte [rax + rcx], 0
jne 0x1406a6810
mov rax, qword [rsp + 0x28]
or edx, eax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rax, 0x11
movzx dx, dh
mov dl, 0x30
mov qword [rsp + 0x68], rax
cmp r9b, 9
not rax
and cl, 0xb3
mov rax, qword [rsp + 0x60]
add rax, 0x3038
mov qword [rsp + 0x70], rax
movsx edx, r8w
movsx dx, r13b
mov rdx, qword [rsp + 0x68]
movzx cx, r12b
not cl
mov rcx, qword [rsp + 0x70]
call fcn.1406a817b
mov qword [rsp + 0x30], rax
shrd ax, sp, 0x2d
xor ax, 0x268c
lea rax, [rsp + 0x20]
cmc
test bp, di
cmp r9, 0x66259589
mov qword [rsp + 0x78], rax
ror ah, cl
sal ah, 0x18
adc ah, 0x1f
mov rax, qword [rsp + 0x30]
cmp r12b, 1
test r13w, dx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1406a68ed
mov rcx, qword [rsp + 0x48]
jmp 0x1406a68d9
call fcn.1406703c2
mov qword [rsp + 0x50], rax
jmp 0x1406a68e8
jmp 0x1406a68f6
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x50]
movzx rcx, r9w
mov qword [rsp + 0x80], rax
rcr ch, cl
mov ecx, 0x1aeca32
sub r8d, r8d
mov cl, 0x1c
not ch
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
jmp 0x1406a6927
call fcn.140676264
mov rcx, qword [rsp + 0x30]
dec sil
mov dword [rcx], eax
not dil
xchg ecx, ecx
mov rax, qword [rsp + 0x38]
bswap rcx
inc rax
movsx si, r11b
mov rcx, qword [rsp + 0x30]
movsx si, dil
add rcx, 0x10
movzx si, r11b
movsx rdi, ax
mov rdi, rcx
movsx esi, sp
movzx si, r14b
mov si, bp
mov rsi, qword [rsp + 0xb0]
mov ecx, 0x6a294f25
setp ch
movsx rcx, r11w
mov rcx, rax
jmp 0x1406a6991
rep movsb byte [rdi], byte [rsi]
rol si, 0x2c
cmove si, r12w
movzx rsi, ax
mov rax, qword [rsp + 0x30]
rcl si, cl
add di, 0x203e
add rsp, 0x98
movzx rsi, r12w
setl dil
pop rdi
pop rsi
ret
Function at 0x1406acaed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
shl ch, 0x3a
sal rcx, cl
rol cl, 0xa2
sub rsp, 0x38
setge cl
movsx cx, bl
mov cl, al
mov rcx, qword [rsp + 0x40]
jmp 0x1406acb12
call fcn.1406ac4d1
movzx eax, al
test si, 0xfa3c
mov dword [rsp + 0x20], eax
cmc
cmp dword [rsp + 0x20], 0x20
jmp 0x1406acb2e
jl 0x1406acb5f
cmp dword [rsp + 0x20], 0xf6
jmp 0x1406acb41
jg 0x1406acb5f
mov eax, dword [rsp + 0x20]
test bx, 0x4191
sub eax, 0x8b
jmp 0x1406acb5a
jmp 0x1406accc1
cmp dword [rsp + 0x20], 0xf7
jmp 0x1406acb6c
jl 0x1406acbe3
cmp dword [rsp + 0x20], 0xfa
jmp 0x1406acb7f
jg 0x1406acbe3
mov eax, dword [rsp + 0x20]
cmova cx, r10w
movzx cx, bpl
not ecx
sub eax, 0xf7
imul eax, eax, 0x100
movzx rcx, bx
movsx rcx, r15w
not cl
mov dword [rsp + 0x24], eax
mov ecx, edi
mov rcx, qword [rsp + 0x40]
jmp 0x1406acbba
call fcn.1406ac4d1
movzx eax, al
movzx rcx, r12w
mov ch, 2
movsx ecx, bx
mov ecx, dword [rsp + 0x24]
jmp 0x1406acbd5
lea eax, [rcx + rax + 0x6c]
jmp 0x1406acbde
jmp 0x1406accc1
cmp dword [rsp + 0x20], 0xfb
jl 0x1406acc59
cmp dword [rsp + 0x20], 0xfe
jmp 0x1406acbfe
jg 0x1406acc59
mov eax, dword [rsp + 0x20]
ror cx, cl
setnp cl
btr ecx, r11d
sub eax, 0xfb
shr ecx, cl
shl cl, cl
test r15w, r11w
neg eax
xor ch, bh
rcr ecx, cl
imul eax, eax, 0x100
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x40]
jmp 0x1406acc39
call fcn.1406ac4d1
movzx eax, al
shl rcx, cl
movsx ecx, r8w
mov ecx, dword [rsp + 0x28]
sub ecx, eax
stc
mov eax, ecx
sub eax, 0x6c
jmp 0x1406accc1
cmp dword [rsp + 0x20], 0x1c
jmp 0x1406acc63
jne 0x1406acc81
mov edx, 2
movsx rcx, r13w
mov rcx, qword [rsp + 0x40]
call fcn.1406ac673
jmp 0x1406accc1
cmp dword [rsp + 0x20], 0x1d
jmp 0x1406acc8b
jne 0x1406accb1
mov edx, 4
movzx ecx, bx
cmovno rcx, r13
mov rcx, qword [rsp + 0x40]
jmp 0x1406acca7
call fcn.1406ac673
jmp 0x1406accc1
xor eax, eax
test eax, eax
jne 0x1406accb1
xor eax, eax
cmp r12w, r9w
add rsp, 0x38
ret
Function at 0x1406b4e62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
btr r8w, 0x8f
rcl r8, 0x38
mov dword [rsp + 0x10], edx
sbb dx, ax
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov dl, 0x3b
cqo
movsx edx, r11w
mov dword [rsp + 0x58], 1
movsx rcx, bp
mov dword [rsp + 0x5c], 0
movzx r8, bp
xorps xmm0, xmm0
cdq
movss dword [rsp + 0x60], xmm0
xorps xmm0, xmm0
not r8b
cmovne edx, esi
movsx r8d, r13w
movss dword [rsp + 0x64], xmm0
movsxd r8, r9d
movsx r8w, r15b
xorps xmm0, xmm0
movsx rdx, r12w
not dh
mov cl, r12b
movss dword [rsp + 0x68], xmm0
movsx rdx, r12w
xorps xmm0, xmm0
movzx ecx, r11w
movss dword [rsp + 0x6c], xmm0
cqo
not dx
xchg cx, dx
mov dword [rsp + 0x70], 0
cmovno cx, r12w
cdq
mov dword [rsp + 0x74], 0
movsx cx, r15b
movsx rdx, bx
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
bswap dx
mov dword [rsp + 0x20], 0
movzx rcx, r10w
mov dword [rsp + 0x24], 0
movzx rcx, si
mov rdx, r10
xorps xmm0, xmm0
movss dword [rsp + 0x28], xmm0
xorps xmm0, xmm0
setno cl
movss dword [rsp + 0x2c], xmm0
xorps xmm0, xmm0
cmovs ecx, eax
movss dword [rsp + 0x30], xmm0
movzx rcx, di
xchg dh, dl
xorps xmm0, xmm0
movss dword [rsp + 0x34], xmm0
mov dword [rsp + 0x38], 0
setp dh
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
movsxd r8, esp
cdq
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
setbe cl
mov dh, 0xa
movsx rdx, sp
lea r8, [rsp + 0x58]
mov edx, dword [rsp + 0xa8]
movzx cx, r13b
movsx ecx, ax
not cx
mov rcx, qword [rsp + 0xa0]
jmp 0x1406b4fee
call fcn.1406b2b70
test eax, eax
jmp 0x1406b4ffa
je 0x1406b50c2
movsxd rax, dword [rsp + 0x88]
and cl, dil
ror ch, cl
dec cx
imul rax, rax, 0xe
cmovne rcx, rax
movsxd rcx, r13d
mov rcx, rax
jmp 0x1406b5023
call fcn.14067d82d
mov rcx, qword [rsp + 0xb0]
xchg r8w, r8w
cdq
mov r8b, 0x92
mov qword [rcx], rax
cwd
movsx eax, si
xchg r8d, r8d
mov rax, qword [rsp + 0xb0]
jmp 0x1406b5059
mov rax, qword [rax]
xchg ch, cl
mov qword [rsp + 0x48], rax
cqo
not ecx
lea r8, [rsp + 0x20]
cmovnp dx, bx
movsx dx, bl
movzx rcx, r14w
mov edx, dword [rsp + 0xa8]
not cx
movzx rcx, si
mov rcx, qword [rsp + 0xa0]
call fcn.1406b2b70
test eax, eax
jmp 0x1406b509a
je 0x1406b50c2
xor eax, eax
test bx, 0xad26
test eax, eax
jmp 0x1406b50ae
jne 0x1406b50a0
mov eax, dword [rsp + 0x50]
jmp 0x1406b50bd
jmp 0x1406b50e6
mov rax, qword [rsp + 0xb0]
cmp r12b, r8b
cmp r15b, 0x93
stc
mov qword [rax], 0
cmp rax, 0xfffffffff5aac3a1
test sil, 0x2b
xor eax, eax
add rsp, 0x98
ret