joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403b653a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sar si, cl
push rdi
and sil, 0x83
add sil, 0x6a
shld si, r14w, 0x9b
push rbx
bsr rsi, rcx
shr sil, 0xc0
sub rsp, 0x20
movzx rsi, cx
bt si, r11w
bt esi, 0x96
mov rsi, rcx
mov qword [rcx + 8], 0
cmp dil, 0x19
clc
cmp r11w, r10w
cmp qword [rcx + 0x28], 0x10
jmp 0x1403b6585
jb 0x1403b6599
mov rax, qword [rsi + 0x10]
jmp 0x1403b6594
jmp 0x1403b65a1
lea rax, [rsi + 0x10]
cmc
cmp ch, 0x5a
mov qword [rsi + 0x20], 0
mov byte [rax], 0
cmp qword [rsi + 0x48], 0x10
jb 0x1403b65c0
mov rax, qword [rsi + 0x30]
jmp 0x1403b65c4
lea rax, [rsi + 0x30]
mov qword [rsi + 0x40], 0
test sil, spl
cmp r10b, 0x35
jmp 0x1403b65d8
mov byte [rax], 0
cmp bh, 0xb2
test dl, 0x83
cmp qword [rsi + 0x68], 0x10
jb 0x1403b65fa
mov rax, qword [rsi + 0x50]
jmp 0x1403b65f5
jmp 0x1403b6603
lea rax, [rsi + 0x50]
jmp 0x1403b6603
mov qword [rsi + 0x60], 0
jmp 0x1403b6610
mov byte [rax], 0
jmp 0x1403b6618
xorps xmm0, xmm0
movups xmmword [rsi + 0x7c], xmm0
sbb bx, r8w
test r11b, r12b
movups xmmword [rsi + 0x70], xmm0
mov rdi, qword [rsi + 0x90]
mov rbx, qword [rsi + 0x98]
clc
cmp bx, 0xc2f
cmp rdi, rbx
jmp 0x1403b6646
je 0x1403b66a0
nop word cs:[rax + rax]
movsx cx, spl
movzx rcx, r13w
movzx ecx, bx
mov rcx, rdi
jmp 0x1403b666c
call fcn.1403b6792
add rdi, 0x60
clc
jmp 0x1403b667b
cmp rdi, rbx
jmp 0x1403b6683
jne 0x1403b6664
mov rax, qword [rsi + 0x90]
jmp 0x1403b6699
mov qword [rsi + 0x98], rax
mov dword [rsi + 0xa8], 0
cmc
cmp qword [rsi + 0xc8], 0x10
jmp 0x1403b66b8
jb 0x1403b66cf
mov rax, qword [rsi + 0xb0]
jmp 0x1403b66ca
jmp 0x1403b66db
lea rax, [rsi + 0xb0]
test di, 0xd74
mov qword [rsi + 0xc0], 0
jmp 0x1403b66ec
mov byte [rax], 0
cmp qword [rsi + 0xe8], 0x10
jb 0x1403b670e
mov rax, qword [rsi + 0xd0]
jmp 0x1403b6709
jmp 0x1403b6716
lea rax, [rsi + 0xd0]
stc
mov qword [rsi + 0xe0], 0
test bpl, r14b
cmp r12b, r10b
mov byte [rax], 0
cmp r15, rbp
cmp rsp, 0x68a14850
cmp qword [rsi + 0x108], 0x10
jmp 0x1403b6741
jb 0x1403b6758
mov rax, qword [rsi + 0xf0]
jmp 0x1403b6753
jmp 0x1403b6765
lea rax, [rsi + 0xf0]
xor bh, cl
setl dil
mov qword [rsi + 0x100], 0
mov byte [rax], 0
add esi, 0x7f2a2c5a
add rsp, 0x20
sets bh
pop rbx
pop rdi
movzx esi, r14w
jmp 0x1403b678b
pop rsi
jmp 0x1403b6791
ret
Function at 0x1403b828e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bts eax, esi
push r14
rcr ax, 0x86
bts r14, r8
push r13
cmovle r14w, dx
sar r14b, cl
push r12
bts ax, r8w
sal ah, 0x9b
push rsi
push rdi
push rbx
shr rdi, cl
sub rsp, 0x20
btr esi, 0xca
rcl rax, cl
shl bx, 6
mov rsi, r8
mov rdi, rdx
movzx bx, r11b
and ebx, r11d
shr ax, 0xa8
mov r14, rcx
sar bl, 0x55
mov rbx, qword [rcx]
movzx eax, cx
movsx eax, r10w
xor eax, esp
mov rcx, qword [rcx + 0x10]
sub rcx, rbx
movzx rax, cx
sar rcx, 4
rol eax, cl
movabs rax, 0xf0f0f0f0f0f0f0f1
imul rcx, rax
cmp rcx, r8
jmp 0x1403b8311
jae 0x1403b8383
mov rcx, r14
mov dl, 0x8c
xchg dx, dx
movzx rdx, ax
mov rdx, rsi
call fcn.1403b8596
mov rbx, qword [r14]
cwd
jmp 0x1403b8339
nop word [rax + rax]
mov rcx, rbx
movsx rdx, bp
movsx edx, r8w
cmove edx, ebp
mov rdx, rdi
jmp 0x1403b8358
call fcn.1403b8d8e
add rbx, 0x110
add rdi, 0x110
jmp 0x1403b8370
dec rsi
jmp 0x1403b8378
jne 0x1403b8342
jmp 0x1403b8552
mov r13, qword [r14 + 8]
adc r12, rbp
sar r12b, cl
shr r12b, 0x27
mov r12, r13
neg r15b
sub r12, rbx
and r15b, r12b
cmovb r15w, r9w
mov r15b, 0xb
sar r12, 4
btc r15, 0x73
shr r15b, cl
mov r15b, 0x8b
imul r12, rax
adc r15b, 0x49
sar r15b, 0x52
mov r15, r12
sub r15, rsi
jmp 0x1403b83cb
jae 0x1403b8496
cmp rbx, r13
jmp 0x1403b83d9
je 0x1403b8433
nop word cs:[rax + rax]
movsxd rcx, r12d
movzx ecx, r14w
mov rcx, rbx
movsxd rdx, r9d
mov rdx, rdi
jmp 0x1403b8402
call fcn.1403b880f
add rbx, 0x110
test r9b, 0x1c
cmp cl, 5
test r10w, di
add rdi, 0x110
cmc
test si, cx
cmp rbx, qword [r14 + 8]
jmp 0x1403b842d
jne 0x1403b83f4
cmp rsi, r12
jmp 0x1403b843b
je 0x1403b8552
nop dword [rax + rax]
movzx cx, r11b
xchg ecx, edx
not dh
mov rcx, rbx
xchg dx, dx
movzx rdx, r9w
mov rdx, rdi
jmp 0x1403b8464
call fcn.1403b8d8e
add rbx, 0x110
test spl, dil
cmp r11b, 0xe4
add rdi, 0x110
jmp 0x1403b8483
inc r15
jmp 0x1403b848b
jne 0x1403b8452
jmp 0x1403b8552
imul r15, rsi, 0x110
add r15, rbx
test r14b, 0x25
jmp 0x1403b84aa
test rsi, rsi
jmp 0x1403b84b2
je 0x1403b8506
nop
cqo
not cl
mov rcx, rbx
movsx edx, si
movsx dx, r11b
bswap edx
mov rdx, rdi
jmp 0x1403b84d2
call fcn.1403b880f
add rbx, 0x110
cmc
jmp 0x1403b84e4
add rdi, 0x110
jmp 0x1403b84f0
dec rsi
jmp 0x1403b84f8
jne 0x1403b84bd
mov r13, qword [r14 + 8]
test spl, r14b
stc
cmp r15, r13
jmp 0x1403b850e
je 0x1403b854e
mov rsi, r15
movsx ecx, r11w
xchg ch, ch
movzx cx, bpl
nop word [rax + rax]
movzx rcx, bp
bswap cx
mov cl, 0x9f
mov rcx, rsi
jmp 0x1403b8539
call fcn.1403b2ca5
add rsi, 0x110
cmp rsi, r13
jne 0x1403b8531
mov rbx, r15
cmc
mov qword [r14 + 8], rbx
sar r12w, 0xdf
bt r15d, 0x25
rol dil, 0xf7
add rsp, 0x20
mov r12b, 0xbf
pop rbx
not sil
movsx r15d, cx
pop rdi
cmovo si, si
pop rsi
cmovge r15w, dx
bswap r13w
not r14b
pop r12
setne r15b
pop r13
pop r14
setle r15b
pop r15
ret
Function at 0x1403d2d49
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
movsx rax, dx
cmp si, 0x227f
push rsi
bt esi, 0x30
ror sil, 0x86
push rdi
shr sil, 0xa6
push rbx
sub rsp, 0x28
ror ax, 0xee
sar sil, cl
mov rsi, rcx
sal rax, cl
lea rax, fcn.140010f00
cmp dl, r13b
cmp r8d, 0x22dc1f46
mov qword [rcx], rax
movzx ax, r12b
or al, sil
lea rax, fcn.140010f00
test r10w, 0x7954
mov qword [rcx + 0x50], rax
test eax, 0x48fa4de8
cmp dil, spl
mov rcx, qword [rcx + 0xa0]
test r8b, r9b
cmp esi, r12d
clc
test rcx, rcx
jmp 0x1403d2dbf
je 0x1403d2e3b
mov rdx, qword [rsi + 0xb0]
sub rdx, rcx
cmp rdx, 0x1000
jmp 0x1403d2ddb
jb 0x1403d2e1b
mov rax, qword [rcx - 8]
jmp 0x1403d2dea
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jmp 0x1403d2dfa
jae 0x1403d2f39
add rdx, 0x27
movsx rdi, di
setle dil
movsxd rcx, ebx
mov rcx, rax
movsx edi, r10w
movsx di, r10b
lea rdi, [rsi + 0xa0]
jmp 0x1403d2e27
call fcn.1401fd7f8
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
cmc
mov qword [rdi + 0x10], 0
mov rdi, qword [rsi + 0x60]
cmp r11w, 0x1757
test bpl, r10b
test rdi, rdi
jmp 0x1403d2e50
je 0x1403d2f0f
lea r14, [rsi + 0x60]
bt rbx, r13
mov rbx, qword [rsi + 0x68]
cmp rdi, rbx
jmp 0x1403d2e6a
je 0x1403d2ea1
nop dword [rax]
movzx cx, sil
movsxd rcx, edi
movsx cx, bpl
mov rcx, rdi
jmp 0x1403d2e89
call fcn.1403b2ca5
add rdi, 0x110
cmp rdi, rbx
jne 0x1403d2e81
mov rdi, qword [r14]
mov rdx, qword [rsi + 0x70]
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403d2eb4
jb 0x1403d2ee2
mov rax, qword [rdi - 8]
clc
cmp r12w, 0x4f61
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jmp 0x1403d2ed5
jae 0x1403d2f39
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
jmp 0x1403d2eea
call fcn.1401fd7f8
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
movzx cx, dil
adc rcx, 0x9cf20c3
jmp 0x1403d2f0f
mov rcx, rsi
sal di, 0x7f
rcl bh, 0x33
add rsp, 0x28
movsxd rsi, r14d
mov rdi, 0x6c5b6f50
pop rbx
pop rdi
movsx esi, dx
pop rsi
pop r14
jmp 0x1403d2f34
jmp fcn.14043d3f1
call fcn.1404b256e
int3
Function at 0x1403dcab9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
shld r10, rdx, 0xb9
sub r10b, 0xe0
push rdi
push rbx
rcl r10d, cl
mov r9, rcx
bts r10d, r13d
xadd r10, r10
add r8, rdx
bswap r10d
shld r10, rdx, 0x31
sar r10w, 0x89
mov dword [rcx + 8], 0
xor eax, eax
or r10, 0x1d2a0c84
bts r10d, ecx
xor ecx, ecx
mov r10b, 0x7d
movzx r10w, r15b
nop word cs:[rax + rax]
dec r10w
lea r10, [rdx + 1]
cmp r10, r8
jmp 0x1403dcb1d
ja 0x1403dcda3
movzx edi, byte [rdx]
rcr dl, 0x23
add dl, r9b
mov edx, edi
cmc
jmp 0x1403dcb34
and edx, 0x7f
test spl, 0xc5
clc
shl rdx, cl
cmp r12, 0x56ac269e
test bx, ax
add rax, rdx
add rcx, 7
mov rdx, r10
cmp r8w, r15w
test al, r15b
test dil, dil
jmp 0x1403dcb62
js 0x1403dcb11
mov rcx, rax
cmp dil, r9b
and rcx, 0xfffffffffffffff8
clc
and eax, 7
cmc
test spl, 0x6d
cmp rcx, 8
jmp 0x1403dcb84
je 0x1403dccd0
cmp rax, 1
jmp 0x1403dcb93
jg 0x1403dcbc3
test rax, rax
jmp 0x1403dcba1
je 0x1403dcc85
cmp eax, 1
jmp 0x1403dcbaf
jne 0x1403dcda3
lea rdx, [r10 + 8]
jmp 0x1403dcbbe
jmp 0x1403dccc4
cmp eax, 5
jmp 0x1403dcbcb
je 0x1403dccbf
cmp eax, 2
jne 0x1403dcda3
mov rsi, r10
neg ah
sub edi, edi
movsx rax, r15w
xor ecx, ecx
nop word cs:[rax + rax]
not al
bsr eax, r14d
lea rax, [rsi + 1]
cmp rax, r8
jmp 0x1403dcc04
ja 0x1403dcda3
mov r11, rdi
btc rbx, r10
cmp r8b, dil
movzx ebx, byte [rsi]
movsx edx, dx
ror sil, cl
add rsi, 0x3c113307
mov edx, ebx
bswap si
rcr si, 0x7b
and edx, 0x7f
shl rdx, cl
bts si, r14w
sar esi, cl
add rdi, rdx
xor sil, r12b
shl sil, 0xf7
add rcx, 7
add esi, r10d
shr si, cl
bt rsi, rcx
mov rsi, rax
clc
test bl, bl
jmp 0x1403dcc5d
js 0x1403dcbf8
add rdx, r11
jmp 0x1403dcc6b
lea rdx, [rdx + rax]
cmp rdx, r8
jmp 0x1403dcc77
cmova rdx, rax
jmp 0x1403dcc80
jmp 0x1403dcaea
mov rax, r10
nop
bt dx, r11w
cmp dx, 0x1ae8
sub edx, ebp
lea rdx, [rax + 1]
stc
cmc
cmp r9b, 0x7d
cmp rdx, r8
jmp 0x1403dcca8
ja 0x1403dcda3
cmp byte [rax], 0
mov rax, rdx
js 0x1403dcc96
jmp 0x1403dcaea
lea rdx, [r10 + 4]
cmc
cmp rdx, r8
cmova rdx, r10
jmp 0x1403dcaea
cmp eax, 2
jne 0x1403dcda3
mov dword [r9 + 8], 2
xchg dl, dh
bt rdx, rsi
sal esi, 0x44
mov rsi, r10
and dx, 0x22d
movzx rdx, r11w
xor eax, eax
sbb edx, ecx
shl dl, 0x93
xor ecx, ecx
cdq
shl edx, 0x75
btc dx, r10w
nop word [rax + rax]
adc edx, 0x4e930add
cwd
shrd dx, r15w, 0xa
lea rdx, [rsi + 1]
stc
test r14b, r10b
cmc
cmp rdx, r8
jmp 0x1403dcd2d
ja 0x1403dcda3
movzx r11d, byte [rsi]
bswap rsi
btr di, 0x73
mov edi, r11d
ror sil, cl
adc rsi, rdx
and edi, 0x7f
shl rdi, cl
lea rax, [rax + rdi]
mov si, r10w
jmp 0x1403dcd5e
add rcx, 7
sar sil, 0x21
mov rsi, rdx
test r11b, r11b
jmp 0x1403dcd71
js 0x1403dcd1c
mov qword [r9 + 0x10], rdx
cmc
mov qword [r9 + 0x18], rax
test si, r11w
cmp r10b, cl
lea rdx, [rdx + rax]
cmp sil, 0xb3
test bx, 0x40b7
cmc
cmp rdx, r8
jmp 0x1403dcd9d
jbe 0x1403dcaea
cmp r10, r8
movzx si, sil
movsxd rdi, ecx
seta al
setae dil
bswap edi
pop rbx
mov dil, 0x4e
setge sil
cmovge di, si
pop rdi
pop rsi
jmp 0x1403dcdca
ret
Function at 0x1403f0986
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sub r15w, 0x7ea6
push r14
ror r15d, 0x38
push r13
not r14w
sar r14, 0x78
push r12
shl r13w, 0x12
push rsi
rcr r12b, 0xab
sar r12b, cl
neg r12b
push rdi
shl r13b, cl
push rbx
sal sil, 0x6e
movzx r13d, cx
bsf r14, rsi
sub rsp, 0x30
cmc
or r15b, 4
movaps xmmword [rsp + 0x20], xmm6
cmp r15b, dil
mov r15, r9
add r14d, 0x24ff32ff
mov r12w, 0x7f64
mov r12, r8
and r13b, 0xb5
mov r14, rdx
mov r13, rcx
and si, 0x46bd
sar esi, cl
mov rsi, qword [rcx]
cmc
test rsi, rsi
jmp 0x1403f0a01
je 0x1403f0b4a
mov rbx, qword [r13 + 8]
test di, dx
cmp rsi, rbx
jmp 0x1403f0a16
je 0x1403f0ae0
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f0a28
jmp 0x1403f0a59
call fcn.1401fd7f8
movups xmmword [rsi + 0x10], xmm6
cmp dl, 0x54
mov byte [rsi], 0
add rsi, 0x20
jmp 0x1403f0a4b
cmp rsi, rbx
jmp 0x1403f0a53
je 0x1403f0ad2
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jmp 0x1403f0a66
jb 0x1403f0a32
mov rcx, qword [rsi]
rol dh, cl
shr dl, 0x85
setne dh
lea rdx, [rax + 1]
cmp rdx, 0x1000
jmp 0x1403f0a87
jb 0x1403f0a2d
mov rdi, qword [rcx - 8]
jmp 0x1403f0a96
add rcx, 0xfffffffffffffff8
clc
test r11b, 0x86
sub rcx, rdi
cmp rcx, 0x20
jmp 0x1403f0aab
jae 0x1403f0bdb
add rax, 0x28
movzx dx, dil
mov rdx, rax
mov cl, bh
movsx cx, bh
mov cl, 0x8e
mov rcx, rdi
jmp 0x1403f0acd
jmp 0x1403f0a2d
mov rsi, qword [r13]
xor dx, r10w
shld dx, r11w, 0x6e
mov rdx, qword [r13 + 0x10]
cmp bpl, 0x40
sub rdx, rsi
cmc
clc
cmp rdx, 0x1000
jmp 0x1403f0af9
jb 0x1403f0b42
mov rax, qword [rsi - 8]
cmc
jmp 0x1403f0b09
add rsi, 0xfffffffffffffff8
clc
cmp sp, bx
test r14w, dx
sub rsi, rax
test dl, 0xc7
cmp rsi, 0x20
jmp 0x1403f0b24
jae 0x1403f0bdb
add rdx, 0x27
xchg sil, sil
mov sil, 0xa7
mov rsi, rax
movzx rcx, bx
mov rcx, rdi
movsx rcx, sp
mov rcx, rsi
call fcn.1401fd7f8
mov qword [r13], r14
shl r12, 5
adc rdi, 0x4c8754e9
add r12, r14
btc si, 0x23
mov bh, 0x50
add si, si
mov qword [r13 + 8], r12
adc dil, bl
mov di, 0x4978
movzx r12d, r8w
shl r15, 5
add r15, r14
movsx rbx, r11w
jmp 0x1403f0b86
mov qword [r13 + 0x10], r15
shr sil, cl
inc di
jmp 0x1403f0b95
movaps xmm6, xmmword [rsp + 0x20]
shld r14d, ecx, 0x56
movzx esi, bx
sal r12b, cl
add rsp, 0x30
movzx rbx, sp
mov di, r11w
pop rbx
pop rdi
jmp 0x1403f0bb8
pop rsi
seta r14b
movsx r15w, r13b
pop r12
movsx r14d, ax
movsxd r13, ebx
movzx r13d, r8w
pop r13
movsx r15w, spl
pop r14
pop r15
ret
call fcn.1404b256e
int3
Function at 0x1403f335e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
cmp rax, r15
test eax, r10d
push rsi
jmp 0x1403f336c
push rdi
ror dil, 0x36
push rbx
bt di, 0x90
sub rsp, 0x38
bsf di, r8w
bt rdi, 0x53
movaps xmmword [rsp + 0x20], xmm6
rol dil, cl
xchg di, di
movzx rdi, di
mov rdi, qword [rcx]
test rbx, rdx
test rdi, rdi
jmp 0x1403f33a2
je 0x1403f3501
mov r14, rcx
mov rbx, qword [rcx + 8]
cmp r15d, 0x21aa400f
stc
cmc
cmp rdi, rbx
jmp 0x1403f33c0
je 0x1403f3480
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403f33fb
call fcn.1401fd7f8
movups xmmword [rdi + 0x10], xmm6
mov byte [rdi], 0
test r12b, 0xe7
add rdi, 0x20
stc
cmp esp, 0x6e575fb6
cmp rdi, rbx
jmp 0x1403f33f5
je 0x1403f347d
mov rax, qword [rdi + 0x18]
jmp 0x1403f340b
cmp rax, 0x10
jmp 0x1403f3414
jb 0x1403f33d7
mov rcx, qword [rdi]
bts dx, dx
bsr rdx, rbx
lea rdx, [rax + 1]
clc
cmc
cmp rdx, 0x1000
jmp 0x1403f3437
jb 0x1403f33d2
mov rsi, qword [rcx - 8]
cmc
add rcx, 0xfffffffffffffff8
cmc
sub rcx, rsi
cmp r12w, 0x4c1e
stc
cmp rcx, 0x20
jmp 0x1403f345a
jae 0x1403f3544
add rax, 0x28
cwd
movsxd rdx, r13d
mov rdx, rax
movzx rcx, bp
mov rcx, rsi
jmp 0x1403f3478
jmp 0x1403f33d2
mov rdi, qword [r14]
mov rdx, qword [r14 + 0x10]
clc
cmc
cmp r14w, 0x2d1a
sub rdx, rdi
cmp rdx, 0x1000
jb 0x1403f34da
mov rax, qword [rdi - 8]
test r10, r14
jmp 0x1403f34a9
add rdi, 0xfffffffffffffff8
cmp r11, rbp
clc
sub rdi, rax
jmp 0x1403f34b9
cmp rdi, 0x20
jmp 0x1403f34c2
jae 0x1403f3544
add rdx, 0x27
mov di, r11w
movzx rdi, r15w
mov dil, 0xf2
mov rdi, rax
mov rcx, rdi
call fcn.1401fd7f8
xorps xmm0, xmm0
movups xmmword [r14], xmm0
or sil, 0x5e
xor bl, 2
mov qword [r14 + 0x10], 0
sbb bx, 0x2795
movsx r14, r8w
movaps xmm6, xmmword [rsp + 0x20]
bt r14, 0x24
test si, di
movzx r14d, r10w
add rsp, 0x38
mov rdi, rbp
movzx r14w, r12b
movsx r14d, sp
pop rbx
pop rdi
movzx si, spl
mov sil, spl
not r14b
pop rsi
cmovnp r14, rsp
movzx r14d, di
sete r14b
pop r14
jmp 0x1403f3543
ret
call fcn.1404b256e
int3
Function at 0x1403fa848
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
test r8, r8
jmp 0x1403fa854
je 0x1403fa8c8
movzx r9d, word [r8]
test r9w, r9w
je 0x1403fa90c
sub eax, eax
stc
mov r10, rcx
clc
nop dword [rax + rax]
cmc
stc
cmp rdx, rax
je 0x1403faa84
mov word [r10], r9w
shr r9b, cl
mov r9b, 6
add r10, 2
movsx r9d, r9w
movzx r9d, word [r8 + rax*2 + 2]
jmp 0x1403fa89f
inc rax
test bp, 0x5a46
cmp r15b, 0x6f
clc
test r9w, r9w
jmp 0x1403fa8b5
jne 0x1403fa879
sub rdx, rax
jmp 0x1403fa8c3
jmp 0x1403fa90f
movzx r9d, word [0x1400b8f10]
jmp 0x1403fa8d5
test r9w, r9w
jmp 0x1403fa8de
je 0x1403fa922
cmp rdx, 0x104
xchg r8w, r8w
not r8w
mov r8d, 0x104
jmp 0x1403fa8fe
cmovb r8, rdx
jmp 0x1403fa907
jmp 0x1403faa12
mov r10, rcx
test rdx, rdx
jmp 0x1403fa917
jne 0x1403faa84
jmp 0x1403faa97
mov rax, qword gs:[0x30]
stc
mov rax, qword [rax + 0x60]
movsx r10w, r10b
rcl r8b, 0x64
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
clc
movzx r8d, word [rax + 0x58]
cmp r8, rdx
cmovae r8, rdx
mov r9, qword [rax + 0x60]
sub r11w, 0x709
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
test r11w, r11w
je 0x1403fa9be
xor eax, eax
test dil, spl
nop word cs:[rax + rax]
cmp r8, rax
jmp 0x1403fa988
je 0x1403fa9cc
mov word [r10], r11w
add r10, 2
not r11b
cmovle r11w, bp
movzx r11d, word [r9 + rax*2 + 2]
inc rax
jmp 0x1403fa9ac
test r11w, r11w
jmp 0x1403fa9b5
jne 0x1403fa980
sub r8, rax
test r8, r8
jmp 0x1403fa9c6
je 0x1403fa9d6
mov word [r10], 0
bts r9d, edi
movzx r9d, word [0x1400b8f10]
movsx r10w, r9b
cmp rdx, 0x104
movzx r10d, r11w
mov r10b, spl
mov r8d, 0x104
cmovb r8, rdx
and r10w, cx
rcr r10w, cl
mov r10, rcx
clc
cmc
test r9w, r9w
je 0x1403faa76
sub edx, edx
cwde
bts eax, r10d
bts eax, ebx
lea rax, [0x1400b8f10]
mov r10, r11
movzx r10w, r13b
mov r10, rcx
clc
nop dword [rax + rax]
cmp r8, rdx
jmp 0x1403faa3f
je 0x1403faa84
mov word [r10], r9w
shr r9b, cl
add r9b, 0x35
add r10, 2
movzx r9d, word [rax + rdx*2 + 2]
jmp 0x1403faa5f
inc rdx
cmp bh, 0xf0
test r9w, r9w
jne 0x1403faa37
sub r8, rdx
test al, sil
cmc
test r8, r8
jmp 0x1403faa7e
je 0x1403faa97
mov word [r10], 0
jmp 0x1403faa97
movabs rax, 0xe039ec0d24fefd13
mov qword [rsp], rax
movzx ax, bh
movabs rax, 0x2247bce40ef3a5e6
movsx edx, r15w
mov qword [rsp + 8], rax
cmovne edx, edx
movabs rdx, 0xe05dec612491fd3d
mov qword [rsp + 0x10], rdx
jmp 0x1403faad3
mov qword [rsp + 0x18], rax
lea rax, [rsp + 0x10]
jmp 0x1403faae2
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rax]
movdqa xmmword [rsp], xmm0
movd eax, xmm0
add rcx, 0xfffffffffffffffe
test r9b, r10b
nop word cs:[rax + rax]
cmc
cmp word [rcx + 2], 0
jmp 0x1403fab10
lea rcx, [rcx + 2]
jmp 0x1403fab19
jne 0x1403fab06
test ax, ax
jmp 0x1403fab27
je 0x1403fab6f
lea rdx, [rsp + 2]
nop word cs:[rax + rax]
mov word [rcx], ax
rcr ax, 0xef
xadd al, ah
add rcx, 2
sal eax, 0xd9
sets al
movzx eax, word [rdx]
add rdx, 2
test r9b, r10b
test r14w, 0x672b
test ax, ax
jmp 0x1403fab69
jne 0x1403fab3d
mov word [rcx], 0
add rsp, 0x28
jmp 0x1403fab7d
ret
Function at 0x14041ec99
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
shrd r10d, r8d, 0xbe
bswap si
bsf r9, rcx
mov r10, qword [rcx]
mov sil, 0x32
shl r9d, cl
mov rsi, qword [rcx + 0x18]
add r9b, 0xab
rol r9, cl
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
cmp r8d, 2
jmp 0x14041eccb
jne 0x14041ee6d
test r9d, r9d
jmp 0x14041ecd9
je 0x14041ef03
lea ecx, [r9 - 1]
cmp ecx, 3
jmp 0x14041eceb
jb 0x14041ede9
mov r11d, r9d
and r10d, 0x3f3304fd
and r11d, 0xfffffffc
nop word cs:[rax + rax]
shr r10w, 8
bt r8w, 0xcd
movsxd r10, eax
movzx r8d, word [rsi]
rol r10b, 0x39
rcr r10b, cl
inc r10b
movzx r10d, word [rsi + 4]
sub ecx, ecx
sar cl, 0xcf
rcl cl, 0x5e
sbb cl, bpl
cmp r8w, word [rdx]
movsx r8w, r15b
setne cl
neg ecx
mov word [rsi + 2], cx
cmovns r8w, dx
rol r8, cl
xor ecx, ecx
cmp r10w, word [rdx]
movsx r8, r8w
setne cl
movzx r8w, dl
neg ecx
shr r8b, cl
rol r8w, cl
mov word [rsi + 6], cx
clc
and r8, r13
movsxd r8, esp
movzx r8d, word [rsi + 8]
xor ecx, ecx
cmp r8w, word [rdx]
setne cl
cmp esp, 0x6e6c18f8
shr r8d, 0xf2
neg ecx
btc r8w, 0x98
btr r8w, si
rol r8b, cl
mov word [rsi + 0xa], cx
shld r8w, r11w, 0x45
btr r8d, r9d
sal r8b, 0x56
movzx r8d, word [rsi + 0xc]
test spl, dil
xor ecx, ecx
cmp r8w, word [rdx]
setne cl
neg ecx
cmp r9b, 0xe8
mov word [rsi + 0xe], cx
clc
add rsi, 0x10
cmp r9b, 0x1a
test r9w, r12w
add r11d, 0xfffffffc
jmp 0x14041ede3
jne 0x14041ed1a
test r9b, 3
jmp 0x14041edf2
je 0x14041ef03
and r9d, 3
cmp r9b, 0x1b
mov r8b, sil
shrd r8w, r9w, 5
xor ecx, ecx
dec r8w
nop word cs:[rax + rax]
bt r8w, bp
sub r8b, r14b
adc r8w, 0x42e
movzx r8d, word [rsi + rcx*4]
jmp 0x14041ee32
xor eax, eax
xor al, r10b
ror al, 0xd2
cmp r8w, word [rdx]
setnp al
not al
setne al
neg eax
jmp 0x14041ee4d
mov word [rsi + rcx*4 + 2], ax
jmp 0x14041ee57
inc rcx
cmp r9d, ecx
jmp 0x14041ee62
jne 0x14041ee28
jmp 0x14041ef03
test r9d, r9d
jmp 0x14041ee75
je 0x14041ef03
movzx r10d, word [rdx]
xchg r8b, r8b
adc r8b, 0xa8
mov r8d, r9d
cmp r15b, r9b
jmp 0x14041ee91
sub ecx, ecx
jmp 0x14041eead
inc rcx
clc
test bl, r15b
cmp r8d, ecx
jmp 0x14041eea7
je 0x14041ef03
cmp word [rsi + rcx*8], r10w
jmp 0x14041eeb7
jne 0x14041ee98
movzx eax, word [rsi + rcx*8 + 2]
cmp ax, word [rdx + 2]
jne 0x14041ee98
movzx eax, word [rsi + rcx*8 + 4]
test r14w, 0x23a4
cmp ax, word [rdx + 4]
jmp 0x14041eee0
jne 0x14041ee98
mov word [rsi + rcx*8 + 6], 0
movsx r10w, bpl
mov r10b, 0x3f
movzx r10d, word [rdx]
jmp 0x14041eefe
jmp 0x14041ee98
pop rsi
jmp 0x14041ef09
ret
Function at 0x14042a80e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
movzx eax, r15w
push rdi
lahf
push rbx
movsx ax, r12b
btr si, 0x63
sub rsp, 0x20
sbb ax, ax
mov rsi, rcx
adc rax, 0x6c314aa
setno al
sub ah, 0xcf
movzx eax, byte [rcx + 0x4828]
cmc
cmp al, 0xff
jmp 0x14042a846
je 0x14042a858
mov byte [rsi + 0x4828], 0xff
jmp 0x14042a966
mov rbx, qword [rsi]
xor eax, 0x6b06631f
mov rax, qword [rbx + 0xc0]
cmc
cmp r9w, 0x6147
cmp rax, qword [rbx + 0xc8]
jmp 0x14042a87a
jae 0x14042a89f
lea rcx, [rax + 1]
jmp 0x14042a889
mov qword [rbx + 0xc0], rcx
not ch
movzx ecx, byte [rax]
jmp 0x14042a89a
jmp 0x14042a95b
cmp dword [rbx + 0x30], 0
je 0x14042a91d
mov r8d, dword [rbx + 0x34]
not dx
lea rdi, [rbx + 0x38]
movzx dx, bh
movsx rdx, r15w
mov rcx, qword [rbx + 0x28]
setnp dh
mov rdx, rdi
jmp 0x14042a8cb
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
test r12, 0x42060744
jmp 0x14042a8e0
sub ecx, dword [rbx + 0xd0]
cmp esp, 0x2933567e
add dword [rbx + 0xb8], ecx
cmp bpl, 0x5d
test eax, eax
jmp 0x14042a8fd
je 0x14042a924
cdqe
not rcx
shl cl, cl
add rax, rdi
seta cl
movzx ecx, byte [rdi]
jmp 0x14042a918
jmp 0x14042a945
mov al, 0xff
jmp 0x14042a966
mov dword [rbx + 0x30], 0
cmc
lea rax, [rbx + 0x39]
cmp r10w, 0x5dc5
mov byte [rbx + 0x38], 0
test r10b, al
sub ecx, ecx
cmp sp, 0x641d
stc
mov qword [rbx + 0xc8], rax
setl ah
lea rax, [rbx + 0x39]
clc
mov qword [rbx + 0xc0], rax
mov al, 0xff
cmp cl, 0xff
je 0x14042a9ac
add rsp, 0x20
jmp 0x14042a96f
pop rbx
bswap rsi
movzx rdi, r11w
movsx si, r15b
pop rdi
mov sil, sil
pop rsi
jmp 0x14042a986
ret
lea rcx, [rax + 1]
mov qword [rbx + 0xc0], rcx
movzx eax, byte [rax]
stc
jmp 0x14042a99f
cmp al, 0xff
jmp 0x14042a9a6
jne 0x14042a966
mov rbx, qword [rsi]
shld ax, r8w, 0xd2
cmc
sar ax, cl
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jmp 0x14042a9cc
jb 0x14042a987
cmp dword [rbx + 0x30], 0
jmp 0x14042a9db
je 0x14042aa9c
mov r8d, dword [rbx + 0x34]
bswap rcx
movsx rdx, cx
movsx di, r15b
lea rdi, [rbx + 0x38]
movsx rdx, cx
movzx rcx, si
mov rcx, qword [rbx + 0x28]
movsx dx, r11b
movsxd rdx, r13d
mov rdx, rdi
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
cmc
cmp dl, 0x18
stc
sub ecx, dword [rbx + 0xd0]
add dword [rbx + 0xb8], ecx
cmc
test r15w, r15w
test eax, eax
jmp 0x14042aa32
je 0x14042aa57
movsxd rcx, eax
add rcx, rdi
movsx eax, r9w
movsx rax, sp
movzx rax, di
movzx eax, byte [rdi]
jmp 0x14042aa52
jmp 0x14042aa70
mov dword [rbx + 0x30], 0
stc
mov rcx, 0x59df2393
lea rcx, [rbx + 0x39]
mov byte [rbx + 0x38], 0
sub eax, eax
mov qword [rbx + 0xc8], rcx
lea rcx, [rbx + 0x39]
test r8b, 0xc4
clc
cmp r12b, cl
mov qword [rbx + 0xc0], rcx
cmp al, 0xff
jmp 0x14042aa91
je 0x14042a9ac
jmp 0x14042a966
sub eax, eax
jmp 0x14042aaa3
jmp 0x14042a966