joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Check for software breakpoints
Encode data using base64
Encode data using xor
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403b0ce0

Function at 0x140008210
Capabilities:
Encrypt data using speck
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b285a

Function at 0x1400ee2a5
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
xor edx, edx
jmp 0x1404b4619

Function at 0x1400fb6ed
Capabilities:
Enumerate pe sections

Disassembly:
cmp r10, rdx
jmp 0x14011a5d2
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
test eax, 0x35a14fe2
bt rax, rax
add r10w, 0x529c
add r8, rcx
shld ax, r13w, 0x75
sub al, r14b
mov r10, rdx
and r11w, sp
bt ax, di
movzx eax, word [r8 + 0x14]
bt r11w, r14w
xadd r11, r11
and r11w, 0x10ac
movzx r11d, word [r8 + 6]
cmp r14, rdi
test r15b, r12b
cmp r15w, 0x3a8b
add rax, 0x18
cmc
add rax, r8
clc
test r11d, r11d
jmp 0x1402399f4
jb 0x1401cad3a
mov ecx, dword [rax + 8]
stc
add ecx, edx
cmp r10, rcx
jmp 0x1401cad34
jb 0x140262bec
inc r9d
stc
cmp dx, bp
cmc
add rax, 0x28
cmp r9d, r11d
jmp 0x140249d50
je 0x140249d56
mov edx, dword [rax + 0xc]
stc
jmp 0x1400ef3d5
jb 0x1402399fa
sub eax, eax
jmp 0x140262bec
ret
Function at 0x14010049e
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
cqo
cmovne edx, r13d
lea edx, [r8 + 2]
jmp 0x140240738
jmp 0x1404b4619
mov qword [rsp + 8], rbx
not bh
btc bx, 0xe6
sub bl, 0x8a
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
ror bl, cl
push rbp
mov rbp, rsp
shr bx, cl
cmp r9b, 0x3b
sub rsp, 0x50
bsf bx, di
movsx ebx, r14w
mov ebx, ecx
test r8d, r8d
jmp 0x1404b4654
jne 0x1404b46ea
sub ecx, ecx
jmp 0x1404b4661
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b466f
je 0x1404b46ea
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x1404b4682
jne 0x1404b46ea
movsxd rcx, dword [rax + 0x3c]
test dil, 0xf6
cmc
cmp sp, 0x54b6
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jne 0x1404b46ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1404b46b4
jne 0x1404b46ea
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b46c6
jbe 0x1404b46ea
cmp dword [rcx + 0xf8], 0
jmp 0x1404b46d8
je 0x1404b46ea
mov ecx, ebx
jmp 0x1404b46e5
call fcn.1404b44fd
lea rax, [rbp + 0x18]
cwd
mov r9, 0x4166376a
movzx rdx, cx
mov byte [rbp + 0x28], 0
cqo
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
mov dh, 0x41
cdq
movsx eax, bx
lea rax, [rbp + 0x20]
cmovg r8, r11
mov qword [rbp - 0x18], rax
bswap edx
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
movzx dx, dil
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
jmp 0x1404b4741
mov dword [rbp - 0x2c], eax
jmp 0x1404b4749
mov dword [rbp - 0x28], eax
call fcn.1404b48fc
cmp dword [rbp + 0x20], 0
je 0x1404b476e
mov rbx, qword [rsp + 0x60]
clc
inc ebp
add rsp, 0x50
pop rbp
jmp 0x1404b476d
ret
mov ecx, ebx
jmp 0x1404b4775
call fcn.1404b45a8
int3
Function at 0x1401beae3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movsd xmm0, qword [rsp + 8]
jmp 0x1401c2272
ret
je 0x1401d04a0
xor r9d, r9d
xchg cx, cx
movzx rcx, ax
movsx ecx, r9w
mov ecx, 0xfffffc03
jmp 0x1401c1780
movsd xmm0, qword [rsp + 0x10]
mov dword [r10], ecx
jmp 0x14012388c
movaps xmm1, xmm0
jmp 0x14020f4a2
mov rax, qword [rsp + 8]
xor r8d, edi
mov ecx, 0x7ff0
movsx r8w, r9b
rcr r8w, 0x73
mov r8, rax
cmc
cmp r12w, di
shr r8, 0x30
cmp r13w, 0x57ce
cmp dil, bpl
stc
test cx, r8w
jmp 0x140258985
comisd xmm0, xmm1
seta r9b
test r11b, 0x3e
test r8b, 0x10
jmp 0x1402724a4
jmp 0x1401bacf7
je 0x1402724ae
mov dword [rsp + 8], edx
movzx eax, word [rsp + 0xe]
ror rdx, cl
mov edx, 0xffef
and ax, dx
test dil, 0x69
stc
jmp 0x1402686ec
movzx ecx, word [rsp + 0xe]
mov edx, 0xbfef
and al, cl
rol eax, 0xa2
shr ecx, 4
test bpl, 0x1a
movsd qword [rsp + 0x10], xmm1
bsr eax, r13d
movzx eax, di
and ecx, 0x7ff
cmp r14b, dil
btc rax, 0x99
movsd qword [rsp + 0x18], xmm1
bts ax, dx
add ah, 0xba
dec ax
mov rax, qword [rsp + 0x18]
cmp rdx, 0x359c7212
stc
shr rax, 0x30
and ax, dx
movsx dx, dl
mov edx, 0x3fe0
or ax, dx
mov word [rsp + 0x16], ax
sub ecx, 0x3fe
jmp 0x1401bacf1
je 0x1401eb37c
mov edx, 0x8000
test r10w, 0x5c44
cmp r15b, 0x45
test r9b, cl
or ax, dx
mov word [rsp + 0xe], ax
movsd xmm0, qword [rsp + 8]
bts ax, r13w
movsx eax, dx
btr rdx, 0xd1
mov edx, 0xbfef
and rax, 0x211653d4
movsd qword [rsp + 0x10], xmm0
adc rax, 0x42a2f13
mov rax, qword [rsp + 0x10]
cmc
test r15d, ecx
test r9b, 0xba
shr rax, 0x30
and ax, dx
movsxd rdx, r12d
movsd qword [rsp + 8], xmm0
add dl, r15b
movzx edx, r9w
movzx rdx, bx
mov edx, 0x3fe0
cmc
stc
or ax, dx
jmp 0x14026c430
jne 0x1401aa368
test edx, edx
jmp 0x1401aa362
movsd qword [rsp + 8], xmm0
xorps xmm0, xmm0
mov r10, rdx
jmp 0x140284096
jmp 0x1401bacf7
jns 0x140231dc3
or eax, 1
cmp dx, dx
test r15b, dil
mov dword [rsp + 0xc], eax
test bpl, 0x34
add edx, edx
dec ecx
cmc
cmp rdx, rbp
test byte [rsp + 0xe], 0x10
jmp 0x1401c8b71
jne 0x1401d04a0
mov edx, dword [rsp + 8]
cmp edx, r13d
cmc
shr rax, 0x20
cmc
test eax, 0xfffff
jmp 0x140201632
mov word [rsp + 0xe], ax
test ebx, ecx
test r9d, r9d
jmp 0x1401eb35c
mov word [rsp + 0xe], ax
jmp 0x1400eb33a
jne 0x1401c8b7b
mov eax, dword [rsp + 0xc]
add eax, eax
stc
cmp dx, r10w
test cx, 0xaab
mov dword [rsp + 0xc], eax
stc
test edx, edx
jmp 0x140231dac
ucomisd xmm1, xmm0
jp 0x1401beaeb
jne 0x1401beaeb
xor ecx, ecx
jmp 0x1402180df
Function at 0x140216964
Capabilities:
Access peb ldr_data

Disassembly:
ret
cmovb r8, rdx
test ax, ax
je 0x1402991cf
xor edx, edx
movzx r9d, bx
inc r9w
bts r9w, di
lea r9, [0x1400b8f10]
cmp r10b, 0x94
cmp r8, rdx
jmp 0x140289c87
inc rax
test ebx, esi
jmp 0x1401793c3
test r11w, r11w
jne 0x140288a1b
sub r8, rax
stc
test r8, r8
jmp 0x14025a038
je 0x14025a03e
mov word [r10], r11w
and r11w, sp
xadd r11d, r11d
add r10, 2
mov r11d, r14d
cmovae r11d, r12d
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14017070d
jmp 0x140166297
inc rdx
test ah, 0
test ax, ax
jmp 0x1402991be
mov r8d, 0x104
cmovb r8, rdx
jmp 0x1401dda38
movzx eax, word [0x1400b8f10]
test ax, ax
je 0x14023b368
cmp rdx, 0x104
jmp 0x14020f0b4
mov rax, qword gs:[0x30]
bsr r11d, r8d
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
btr r9d, 0x2f
movsx r10, r15w
cmp r11b, 0x86
movzx r8d, word [rax + 0x58]
cmp r8, rdx
movzx r10, r9w
cmovae r9d, r10d
cmovae r8, rdx
rcr r9d, cl
shr r9b, 0x66
mov r9, qword [rax + 0x60]
cmp r15b, r14b
rol r11b, cl
movzx r11d, word [r9]
cmp r14b, r9b
btc r10w, 0x1e
bswap r10d
lea r10, [0x1400b8f10]
clc
test r11w, r11w
jmp 0x140288a0c
je 0x14025a04c
mov word [r10], 0
btc rax, 0xb1
sar ah, 0x7c
movzx eax, word [0x1400b8f10]
cmp rdx, 0x104
mov r8, r15
setl r8b
mov r8d, 0x104
jmp 0x14016628a
je 0x1401793d1
xor eax, eax
nop word [rax + rax]
cmc
cmp r8, rax
jmp 0x1401b370e
je 0x1402991d8
mov word [rcx], ax
shr al, 0xe6
add rcx, 2
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401fe755
jne 0x1401662b1
sub r8, rdx
clc
cmp r10d, 0x47265958
test r8, r8
je 0x14015ab96
mov word [rcx], 0
jmp 0x14015ab96
Function at 0x140246c81
Capabilities:
Parse pe header

Disassembly:
ret
ret
xor eax, eax
jmp 0x1401920d6
mov eax, 0x5a4d
test bh, 0x8f
cmc
cmp word [rcx], ax
jne 0x1401c43d2
movsxd rdx, dword [rcx + 0x3c]
stc
add rdx, rcx
cmp dword [rdx], 0x4550
jmp 0x140287f77
jne 0x1401c43d2
sub eax, eax
and rcx, 0x36d847e3
sbb cl, bl
add al, 0x82
mov ecx, 0x20b
rcl al, cl
cmp word [rdx + 0x18], cx
sete al
jmp 0x14018cf14

Function at 0x14025aac9
Capabilities:
Check for software breakpoints

Disassembly:
inc eax
jmp 0x14027145d
je 0x140112a6f
mov rdx, qword [rax - 8]
test rdx, rdx
jmp 0x1401c1550
add rax, 0x20
stc
sub r8, 1
jmp 0x140295bb0
je 0x14012d3ed
lock inc dword [rax]
neg ax
rcr al, cl
mov rax, qword [rcx + 0x100]
stc
cmp dil, 0xfc
test r13b, 0xbb
test rax, rax
je 0x14012d410
lock inc dword [rax]
mov dl, sil
movsx rdx, ax
lea rax, [rcx + 0x38]
dec dx
mov r8d, 6
neg rdx
sbb rdx, 0x7fea5b74
btc dx, r12w
lea rdx, [0x1400b75e8]
cmp r13w, ax
cmp qword [rax - 0x10], rdx
jmp 0x1401a2ddc
je 0x14012e3d4
lock inc dword [rax]
movzx rax, dx
test edi, 0x59ab19fc
mov rax, qword [rcx + 0xe8]
clc
test rax, rax
jmp 0x14012d3df
je 0x14027e615
mov rdx, qword [rax]
stc
test rdx, rdx
jmp 0x14027e603
test rax, rax
jmp 0x1402566ea
jmp 0x14027785b
je 0x140112a6f
lock inc dword [rdx]
jmp 0x140112a6f
je 0x1401e608b
lea rax, [0x1400c6040]
cmc
cmp rcx, rax
jmp 0x1402782e4
mov eax, 0x7fffffff
jmp 0x1401e62fa
ret
je 0x1402566f6
lock inc dword [rax]
rcr rax, cl
mov rax, qword [rcx + 0xf0]
clc
cmp r11w, cx
test rax, rax
jmp 0x14012e3c1
lock inc dword [rcx + 0x10]
cwde
cbw
rcr eax, 0x8e
mov rax, qword [rcx + 0xe0]
test r15b, bpl
cmc
jmp 0x1401a65ee
ret
test rcx, rcx
jmp 0x1401e327c
je 0x1401e608b
mov eax, 1
cmc
stc
lock xadd dword [rcx + 0x15c], eax
jmp 0x1400e021a
je 0x14027e615
lock inc dword [rdx]
cmc
test r8w, r14w
cmp r15b, 0xcc
cmp qword [rax - 0x18], 0
jmp 0x1400f7113
jne 0x14012d42c
mov rcx, qword [rcx + 0x120]
jmp 0x1401ad5e1

Function at 0x140296128
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x14044997e
mov rcx, qword [rcx]
jmp 0x1401d14a4
push rsi
push rdi
and esi, 0x412a4f76
sub rsp, 0x28
movsx rax, r12w
mov rsi, rcx
mov ah, dh
btc eax, 0xe
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
sub edx, edx
jmp 0x1404499ac
xor r8d, r8d
jmp 0x1404499b4
call qword [rax + 0x188]
mov edi, eax
movzx rcx, si
movzx ecx, r14w
not ecx
lea rcx, [rsi + 0x30]
jmp 0x1404499cf
call fcn.14045d7fb
test edi, edi
je 0x140449a11
cmp edi, 0x8899000c
jne 0x140449a35
mov rcx, rsi
btc di, 4
shr esi, 0x38
movzx si, r12b
add rsp, 0x28
pop rdi
movzx rsi, sp
not esi
xchg sil, sil
pop rsi
jmp 0x140449a0c
jmp fcn.140449629
nop
xadd dil, sil
movzx rdi, di
add rsp, 0x28
xchg dil, sil
pop rdi
movsxd rsi, ebp
jmp 0x140449a2e
pop rsi
jmp 0x140449a34
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
stc
mov r9b, 0xf4
mov dl, 3
mov r9d, 0x54
add rsp, 0x28
movzx esi, bp
pop rdi
movzx si, al
xchg si, si
pop rsi
jmp 0x140449a62
jmp fcn.1403b2e1b
Function at 0x140376915
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edx
test rdi, r8
cmp rbp, rbx
stc
push rbx
sar bx, cl
or bx, r11w
xor dword [rsp], edx
movsxd rbx, r11d
pop rbx
cmp r8b, r14b
movsxd rdx, edx
add r11, rdx
jmp 0x140373f7a
ror edx, 3
clc
cmc
neg edx
cmp r14b, 0x5f
test sil, 0xca
xor edx, 0x62b3b31
cmc
test r13w, di
not edx
cmp rdx, 0xc985ee5
jmp 0x1403296b8
inc edx
clc
jmp 0x1403384a1
jmp r11
push rax
push rbx
push r13
cdqe
push rsi
mov sil, 0xa2
movsx ax, r10b
cdqe
push r12
lahf
movsx bx, sil
push r8
push rdx
push r10
sete sil
mov dx, bx
not r10b
pushfq
rcr r10b, 0x69
not si
cdqe
push r9
cdq
ror sil, 0x61
push rdi
mov dx, 0x4c8a
rcr r10d, cl
cmc
push rbp
rdtsc
push r15
rol r10b, cl
rol bh, 0xd1
btc rbx, r13
push r14
btc dx, 0x62
movzx edx, bp
movzx r9, r8w
push r11
push rcx
rdtsc
movabs rax, 0
rcr r11b, 0x16
btc r10w, r15w
push rax
mov bh, 0xd9
mov r10, qword [rsp + 0x90]
rcl r9d, 0xee
cqo
rol r10d, 1
not r10d
mov r9b, dl
rol sil, 0xe0
rol r10d, 3
neg r11w
add r10d, 0x2c393e7d
sub dh, 0xc8
add r10, rax
stc
xchg r9b, dl
movabs r9, 0x100000000
shrd bx, r13w, 0xc6
test ah, dl
add r10, r9
cmc
setp r11b
movsxd r11, r9d
mov rsi, rsp
shl bh, cl
sbb r11w, r13w
btr rdx, r10
sub rsp, 0x180
xchg r11b, dl
and dx, 0x7d7a
cmova bx, bp
and rsp, 0xfffffffffffffff0
sal r11w, 0xec
bt ebx, 0x2f
mov rbx, r10
movabs rdx, 0
mov r11w, 0x4f32
cmp dil, 0x8a
cmc
sub rbx, rdx
lea r11, [0x140376a2b]
shl edx, 0x41
rol edx, cl
sal dx, cl
sub r10, 4
rcr dl, 0x60
mov edx, dword [r10]
test bpl, spl
clc
xor edx, ebx
jmp 0x1403584e8
Function at 0x1403d5df1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
shrd rsi, rdx, 9
rcr si, cl
push rdi
movsx si, bpl
seta sil
sal rsi, 0x42
push rbx
sub al, 0xe3
xor sil, sil
sub rsp, 0x20
shld esi, eax, 0x1d
xor si, bp
btr eax, esi
mov rsi, rcx
btc eax, r8d
lea rax, [0x1400be340]
test bl, 0x77
stc
test r13b, r14b
mov qword [rcx], rax
cmc
jmp 0x1403d5e3a
mov rcx, qword [rcx + 0x90]
cmp r8, r15
test rcx, rcx
jmp 0x1403d5e4c
je 0x1403d5e6f
mov rax, qword [rcx]
jmp 0x1403d5e5a
call qword [rax + 0x10]
mov qword [rsi + 0x90], 0
bt ecx, 0x9c
sbb cl, r11b
mov rcx, qword [rsi + 0x88]
stc
jmp 0x1403d5e81
test rcx, rcx
je 0x1403d5ea2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsi + 0x88], 0
movzx rcx, cx
shl cx, cl
mov rcx, qword [rsi + 0x80]
test rcx, rcx
je 0x1403d5ec8
mov rax, qword [rcx]
jmp 0x1403d5eba
call qword [rax + 0x10]
mov qword [rsi + 0x80], 0
lea rax, [0x1400bdb70]
rcl bl, cl
mov qword [rsi], rax
mov rdi, qword [rsi + 0x40]
stc
bts rbx, rbx
movzx rbx, ax
mov rbx, qword [rsi + 0x48]
clc
stc
cmp rdi, rbx
jne 0x1403d5f14
jmp 0x1403d5f59
add rdi, 8
test r9w, r10w
cmp r10b, 0x70
jmp 0x1403d5f06
cmp rdi, rbx
jmp 0x1403d5f0e
je 0x1403d5f42
mov rcx, qword [rdi]
test bp, r12w
test rcx, rcx
je 0x1403d5ef5
mov rax, qword [rcx]
movzx edx, r8w
seto dl
mov dx, 0x2def
mov edx, 1
call qword [rax + 0xb8]
jmp 0x1403d5ef5
mov rdi, qword [rsi + 0x40]
test dx, 0x3576
cmp rdi, qword [rsi + 0x48]
je 0x1403d5f59
mov qword [rsi + 0x48], rdi
test rdi, rdi
jmp 0x1403d5f61
je 0x1403d5fda
mov rdx, qword [rsi + 0x50]
stc
clc
sub rdx, rdi
test r15b, 0xeb
cmp rdx, 0x1000
jmp 0x1403d5f80
jb 0x1403d5fc0
mov rax, qword [rdi - 8]
stc
test r8b, 0x30
add rdi, 0xfffffffffffffff8
test sp, sp
stc
sub rdi, rax
clc
jmp 0x1403d5fa0
cmp rdi, 0x20
jmp 0x1403d5fa9
jae 0x1403d5ffd
add rdx, 0x27
rcr ch, 0x91
mov rdi, rax
rcl ch, 0xa2
setno cl
cmc
add rsi, 0x40
mov rcx, rdi
call fcn.14010a1e6
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
add rsp, 0x20
bswap edi
pop rbx
jmp 0x1403d5fed
pop rdi
movzx si, r9b
movsxd rsi, r9d
pop rsi
jmp 0x1403d5ffc
ret
call fcn.1404b973f
int3
Function at 0x1403ea81c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
inc r15d
sub r14d, 0x28366a3
push r13
not r15b
movsx r13, r10w
rcl r14b, cl
push r12
shl r13b, 0x58
push rsi
xchg r14, r12
movzx r14, r9w
push rdi
push rbp
mov r15b, 0x4a
adc r14w, sp
push rbx
bsr r12w, ax
movzx ebx, r13w
sal r12b, cl
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov r14, r9
sbb ebx, 0x433576b8
mov r15, r8
mov r12, rdx
sub r13, 0x6da34282
movzx bx, r9b
mov r13, rcx
rol bl, 0xf
mov rbx, qword [rcx]
test rbx, rbx
jmp 0x1403ea88f
je 0x1403ea9cc
mov rdi, qword [r13 + 8]
cmp sil, 0xaa
jmp 0x1403ea8a3
cmp rbx, rdi
jmp 0x1403ea8ab
je 0x1403ea97d
lea rbp, [0x1400bed10]
jmp 0x1403ea8bd
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403ea8c9
jmp 0x1403ea8ff
call fcn.14010a1e6
movups xmmword [rbx + 0x20], xmm6
jmp 0x1403ea8e2
mov byte [rbx + 0x10], 0
cmp rdx, 0x12f62ef8
add rbx, 0x50
cmp rbx, rdi
jmp 0x1403ea8f9
je 0x1403ea96e
mov qword [rbx], rbp
lea rcx, [rbx + 0x38]
call fcn.1403e7c76
mov rax, qword [rbx + 0x28]
cmp rax, 0x10
jb 0x1403ea8d3
mov rcx, qword [rbx + 0x10]
xor edx, ebp
btr edx, esi
lea rdx, [rax + 1]
test r10b, 0xa6
cmc
cmp rdx, 0x1000
jb 0x1403ea8ce
mov rsi, qword [rcx - 8]
test bl, 0x36
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jmp 0x1403ea94f
jae 0x1403eaa7f
add rax, 0x28
mov rdx, rax
movsx cx, r15b
mov rcx, rsi
jmp 0x1403ea969
jmp 0x1403ea8ce
mov rbx, qword [r13]
bts edx, r15d
movzx edx, r14w
shl dh, 0x74
mov rdx, qword [r13 + 0x10]
sub rdx, rbx
test cx, 0x4d4c
stc
cmp rdx, 0x1000
jb 0x1403ea9c4
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
test r9b, r12b
stc
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403ea9af
jae 0x1403eaa7f
add rdx, 0x27
mov rbx, rax
mov cl, bpl
mov cl, 0xdb
setno ch
mov rcx, rbx
call fcn.14010a1e6
mov qword [r13], r12
rcr ax, 0xbe
lea rax, [r15 + r15*4]
shl rax, 4
dec si
or r15, r11
add rax, r12
cmp bpl, 0xbd
mov qword [r13 + 8], rax
rcr bpl, cl
mov di, 0x6f43
lea rax, [r14 + r14*4]
shld r14d, edx, 0x1b
shl rax, 4
and r15w, r8w
add rax, r12
bt bx, r11w
movsxd rbx, r12d
neg r15b
mov qword [r13 + 0x10], rax
ror r13d, 0x1b
neg rdi
shr esi, cl
movaps xmm6, xmmword [rsp + 0x20]
neg sil
bsr rsi, rsp
add rsp, 0x38
pop rbx
mov r15w, ax
xchg dil, r12b
cmovne r14d, edi
pop rbp
seta r15b
movsxd rsi, eax
pop rdi
movzx r14, r12w
movzx esi, r12w
xchg r14b, r12b
pop rsi
movzx r14d, r9w
movsxd r15, r8d
movsx r13, cx
pop r12
xchg r13b, r15b
movzx r13d, di
movzx r14w, r15b
pop r13
mov r14b, r8b
pop r14
xchg r15d, r15d
not r15w
movsx r15, cx
pop r15
ret
call fcn.1404b973f
int3
Function at 0x14042f4dd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sar si, cl
movsx rsi, bx
push rdi
xor di, 0x2253
sub rsp, 0x28
cmp r8, rcx
shr dil, 0x96
mov rsi, rcx
adc dil, r11b
shld di, r11w, 0x4d
movzx edi, dx
inc dx
btr dx, 0x26
movzx edx, word [rcx + rdi*4 + 0x834]
test r11w, bx
cmc
test dx, dx
js 0x14042f52b
mov rcx, rsi
call fcn.14042f4dd
movsxd rcx, dword [rsi + 0x8860]
cmp bl, r14b
clc
cmp ecx, dword [rsi + 0x8858]
jmp 0x14042f541
jge 0x14042f6df
movsxd rax, dword [rsi + 0x885c]
or r8d, 0x44a57834
sal dl, 0xb5
sar r8b, cl
lea rax, [rax + rcx]
sbb dl, 0x61
and cx, ax
btr r8w, 0xd6
mov r8, qword [rsi + 8]
bt ecx, 8
lea edx, [rax + 3]
xor ch, 0xb0
test eax, eax
xchg ch, cl
movsx cx, spl
cmove cx, dx
cmovns edx, eax
setp cl
adc ecx, 0x4efd0bb6
mov rcx, qword [rsi + 0x18]
sar edx, 2
cmp cl, sil
clc
test ax, 0x2753
movsxd rdx, edx
test dil, 6
test r11, rcx
jmp 0x14042f5b0
mov byte [rcx + rdx], 1
xchg dl, dh
mov rdx, qword [rsi + 0x8838]
movzx edi, byte [rsi + rdi*4 + 0x837]
cmc
cmp byte [rdx + rdi*4 + 3], 0x81
jmp 0x14042f5d0
jb 0x14042f612
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
bts cx, r14w
movzx ecx, byte [rdx + rdi*4 + 1]
mov byte [r8 + rax + 1], cl
movzx ecx, byte [rdx + rdi*4]
cmp r11b, r11b
stc
mov byte [r8 + rax + 2], cl
movzx ecx, byte [rdx + rdi*4 + 3]
cmc
jmp 0x14042f606
mov byte [r8 + rax + 3], cl
test sp, r8w
clc
rcr al, cl
mov eax, dword [rsi + 0x885c]
stc
add eax, 4
stc
mov dword [rsi + 0x885c], eax
test dil, 0x6f
test ch, bl
cmp eax, dword [rsi + 0x8854]
jl 0x14042f6df
mov ecx, dword [rsi + 0x884c]
rcr rax, cl
mov eax, dword [rsi + 0x8858]
cmc
mov dword [rsi + 0x885c], ecx
mov ecx, dword [rsi + 0x8860]
jmp 0x14042f656
add ecx, dword [rsi + 0x8844]
stc
cmp spl, r12b
mov dword [rsi + 0x8860], ecx
cmp ecx, eax
jl 0x14042f6df
mov ecx, dword [rsi + 0x8840]
jmp 0x14042f67c
nop dword [rax]
stc
test ecx, ecx
jmp 0x14042f68b
jle 0x14042f6df
mov edx, dword [rsi + 0x8864]
cmc
shl edx, cl
test dl, 0x27
mov dword [rsi + 0x8844], edx
test bpl, 0xec
cmc
cmp r11w, ax
sar edx, 1
stc
cmp r9b, 0xae
add edx, dword [rsi + 0x8850]
mov dword [rsi + 0x8860], edx
jmp 0x14042f6c4
dec ecx
mov dword [rsi + 0x8840], ecx
test r10w, r12w
cmc
clc
cmp edx, eax
jmp 0x14042f6d9
jge 0x14042f684
add rsp, 0x28
mov sil, 0xa9
bswap rsi
pop rdi
movzx si, bl
not sil
movsxd rsi, eax
pop rsi
jmp 0x14042f6fa
ret
Function at 0x140438847
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
shl r15b, cl
test r12b, 0x66
xchg r15b, r15b
push r14
bswap r15d
setbe r15b
shl r15b, cl
push rsi
mov r15w, dx
rcr r15d, 0xac
rcr r15b, cl
push rdi
push rbx
sub rsp, 0x20
not r15
movsxd r15, r13d
movzx r15w, r10b
mov r15, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov rcx, qword [rdx + 8]
test bp, 0x1e28
xor bh, 0x8e
movzx rax, r8w
mov rax, qword [rdx]
sar bl, 0xe
mov rbx, rcx
stc
sub rbx, rax
jmp 0x1404388b3
sub rcx, rax
je 0x1404389c2
js 0x1404389ed
mov r14, rdx
sar rbx, 6
cmp rbp, 0x21b31037
clc
test r10b, dl
cmp rcx, 0xfc1
jmp 0x1404388e0
jb 0x140438913
or rcx, 0x27
jmp 0x1404388ef
call fcn.14044b825
lea rdi, [rax + 0x27]
test r9d, ebp
stc
and rdi, 0xffffffffffffffe0
jmp 0x140438905
mov qword [rdi - 8], rax
jmp 0x14043890e
jmp 0x140438925
call fcn.14044b825
mov rdi, rax
neg si
shr sil, cl
or sil, 0x8d
mov qword [r15], rdi
clc
shr si, 0xd8
mov qword [r15 + 8], rdi
shl rbx, 6
shl sil, 0x1f
add rbx, rdi
mov qword [r15 + 0x10], rbx
movsxd rsi, ecx
mov rbx, qword [r14]
setle sil
xchg si, si
mov rsi, 0x3d916517
mov rsi, qword [r14 + 8]
jmp 0x14043895d
jmp 0x14043896f
add rdi, 0x40
test dil, 0x25
clc
add rbx, 0x40
cmp rbx, rsi
jmp 0x140438977
je 0x1404389b3
mov qword [rdi + 0x38], 0
neg rcx
mov rcx, qword [rbx + 0x38]
test rcx, rcx
jmp 0x140438994
je 0x140438962
mov rax, qword [rcx]
movsxd rdx, r15d
mov rdx, rdi
call qword [rax]
mov qword [rdi + 0x38], rax
jmp 0x1404389ae
jmp 0x140438962
mov qword [r15 + 8], rdi
rcl eax, 0xf9
inc ax
shrd di, dx, 0x25
mov rax, r15
ror r15b, cl
jmp 0x1404389d1
add rsp, 0x20
pop rbx
movzx r14, bp
pop rdi
pop rsi
xchg r14w, r15w
pop r14
movzx r15, r9w
movzx r15d, r10w
pop r15
ret
call fcn.1403bf199
int3
Function at 0x1404428dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
adc ah, bl
test r8d, r14d
shl al, cl
push r14
push rsi
push rdi
shrd ax, r11w, 0x13
movsx ax, bl
movzx esi, sp
push rbp
shld ax, r11w, 0x50
clc
shl si, 0xda
push rbx
sar ah, cl
inc eax
sub rsp, 0x78
not ah
movzx rax, r9w
mov rsi, rdi
movaps xmmword [rsp + 0x60], xmm8
movsx si, r8b
movaps xmmword [rsp + 0x50], xmm7
movzx si, dil
movsx rax, cx
movaps xmmword [rsp + 0x40], xmm6
jmp 0x140442937
mov rax, qword [rcx]
movzx esi, bx
xchg si, si
movsx si, r10b
mov esi, dword [rax + 0x10]
xorps xmm0, xmm0
movlps qword [rsp + 0x28], xmm0
movlps qword [rsp + 0x34], xmm0
mov dword [rsp + 0x3c], 0
test esi, esi
jmp 0x140442964
jle 0x140442b48
movaps xmm7, xmm2
cmovge r15w, ax
movsxd r15, r10d
movaps xmm8, xmm1
movsx r15, r12w
movzx r15, si
mov r15, rcx
xorps xmm6, xmm6
sub edi, edi
movzx rdx, si
lea r14, [rsp + 0x28]
nop word cs:[rax + rax]
cmovns r8w, sp
mov rcx, r14
movsx dx, al
mov rdx, r15
jmp 0x1404429b3
mov r8d, edi
call fcn.1404425c5
mov ebx, dword [rsp + 0x3c]
test r13, 0x7233431f
stc
clc
test ebx, ebx
jmp 0x1404429cf
jle 0x140442b48
test edi, edi
jmp 0x1404429dc
jne 0x1404429fa
movss xmm0, dword [rsp + 0x34]
jmp 0x1404429ed
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x140442b46
movss xmm0, dword [rsp + 0x38]
jmp 0x140442a05
addss xmm0, xmm6
ucomiss xmm0, xmm7
ja 0x140442a31
add edi, ebx
jmp 0x140442a19
addss xmm6, dword [rsp + 0x30]
cmp edi, esi
jmp 0x140442a26
jl 0x1404429a4
jmp 0x140442b48
movss xmm6, dword [rsp + 0x28]
jmp 0x140442a3c
ucomiss xmm6, xmm8
jbe 0x140442a52
mov esi, edi
jmp 0x140442a4d
jmp 0x140442b48
movss xmm0, dword [rsp + 0x2c]
jmp 0x140442a5d
ucomiss xmm0, xmm8
jbe 0x140442ad6
sub ebp, ebp
mov esi, edi
bswap cx
movaps xmm7, xmm6
nop word cs:[rax + rax]
bswap rcx
movsxd r8, r13d
mov rcx, r15
cdq
cmovae r8, rsp
xchg dl, dl
mov edx, edi
movsx r8d, bx
jmp 0x140442a9c
mov r8d, ebp
jmp 0x140442aa4
call fcn.140442e17
addss xmm7, xmm0
ucomiss xmm7, xmm8
ja 0x140442ba5
inc ebp
jmp 0x140442abe
inc esi
cmc
jmp 0x140442ac6
movaps xmm6, xmm7
cmp ebx, ebp
jmp 0x140442ad0
jne 0x140442a83
test byte [r15 + 0x1c], 4
jmp 0x140442ae0
jne 0x140442b33
lea esi, [rbx + rdi]
dec esi
bsf eax, r8d
or ah, 0x7e
xor ax, 0x5a22
mov rax, qword [r15]
movsxd rcx, esi
cmp qword [rax + 0x10], rcx
jmp 0x140442b05
jbe 0x140442bc7
cmp qword [rax + 0x18], 8
jmp 0x140442b15
jb 0x140442b28
mov rax, qword [rax]
test dil, bpl
cmp r10d, 0x6fd7249a
cmp word [rax + rcx*2], 0xa
je 0x140442b48
add ebx, edi
jmp 0x140442b3a
mov esi, ebx
jmp 0x140442b41
jmp 0x140442b48
xor esi, esi
mov eax, esi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
movsx r14, r13w
xchg bpl, bpl
sar r15w, 0x2b
add rsp, 0x78
movsx ebp, r12w
pop rbx
movsxd r14, r11d
bswap r15
pop rbp
pop rdi
jmp 0x140442b85
pop rsi
movsx r14d, r9w
cmovae r14, r9
pop r14
xchg r15w, r15w
movsx r15w, cl
movsx r15, ax
pop r15
jmp 0x140442ba4
ret
mulss xmm0, dword [0x1400bd480]
addss xmm6, xmm0
ucomiss xmm6, xmm8
ja 0x140442b48
inc esi
jmp 0x140442bc2
jmp 0x140442b48
call fcn.140442fb0
int3