joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001da40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x14001da40
test rcx, rcx
je 0x14001dbd6
push rbp
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbp, rcx
je 0x14001dbd1
mov rcx, qword [rcx + 0x88]
test rcx, rcx
je 0x14001dbd1
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
call fcn.1400012ad
mov rsi, qword [rbp + 0x18]
mov edi, eax
test rsi, rsi
je 0x14001dacc
nop
mov rcx, qword [rsi + 0x28]
mov rbx, qword [rcx]
test rbx, rbx
je 0x14001dac3
nop dword [rax]
cmp byte [rbx + 0x3c], 4
jne 0x14001daba
mov rcx, qword [rbx + 0x20]
call fcn.1400012ad
movzx ecx, al
sub cl, dil
mov edi, eax
mov byte [rbx + 0x22], cl
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14001daa0
mov rsi, qword [rsi + 0x18]
test rsi, rsi
jne 0x14001da90
mov rsi, qword [rbp + 0x18]
xor edi, edi
test rsi, rsi
je 0x14001dbc2
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
test rbx, rbx
je 0x14001dbb5
movzx eax, byte [rbx + 0x3c]
sub eax, 3
je 0x14001dba6
sub eax, 1
je 0x14001db2e
cmp eax, 4
jne 0x14001dba8
test byte [rbx + 0x24], 1
jne 0x14001dba6
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov rdi, rbx
call fcn.140001564
mov byte [rbx + 0x20], al
jmp 0x14001dba8
test rdi, rdi
je 0x14001dba8
movzx r8d, byte [rdi + 0x20]
sub r8b, byte [rbx + 0x22]
cmp r8b, 3
jge 0x14001db69
mov eax, 2
sub al, r8b
movzx ecx, al
mov eax, 0x24924925
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 2
movsx eax, cl
imul ecx, eax, 7
add cl, 7
add r8b, cl
movzx ecx, byte [rbp + 0xa1]
cmp r8b, cl
jle 0x14001dba0
movzx eax, r8b
sub al, cl
dec al
movzx ecx, al
mov eax, 0x24924925
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 2
movsx eax, cl
imul ecx, eax, 7
mov eax, 0xfffffff9
sub al, cl
add r8b, al
mov byte [rdi + 0x20], r8b
jmp 0x14001dba8
xor edi, edi
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14001daf0
mov rsi, qword [rsi + 0x18]
test rsi, rsi
jne 0x14001dae0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
Function at 0x140031a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rdx, qword [rcx + 0x88]
test rdx, rdx
je 0x140031b26
mov rdx, qword [rdx]
mov rax, rdx
shr rax, 8
test al, al
jne 0x140031b26
mov rax, rdx
shr rax, 0x20
test al, 2
jne 0x140031b26
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140031b26
mov rax, qword [rax + 0x28]
test rax, rax
je 0x140031b26
mov rax, qword [rax]
test rax, rax
je 0x140031b26
cmp byte [rax + 0x3c], 3
jne 0x140031b26
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x140031b26
cmp byte [rcx + 0x2c], 2
jne 0x140031b26
movzx eax, byte [rcx + 0x1c]
add dl, 2
mov r8, qword [rcx + 0x10]
add dl, dl
mov r9, r8
sub eax, 0x11
je 0x140031af6
sub eax, 2
je 0x140031ae8
sub eax, 4
je 0x140031ae8
cmp eax, 1
jne 0x140031b01
mov rax, qword [r8 + 8]
test rax, rax
je 0x140031b01
mov r8, rax
jmp 0x140031b01
mov rax, qword [r8 + 8]
test rax, rax
cmovne r9, rax
movsx ecx, byte [r9 + 0x18]
movsx r10d, dl
lea eax, [r10 - 3]
cmp ecx, eax
jl 0x140031b23
movsx edx, byte [r8 + 0x18]
lea ecx, [r10 + 3]
xor eax, eax
cmp edx, ecx
setle al
ret
xor eax, eax
ret
mov eax, 1
ret

Function at 0x140033290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r13
sub rsp, 0x60
cmp byte [rdx + 0x3c], 4
mov r13, rdx
jne 0x140033384
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov r12d, dword [rdx + 0x24]
mov ebx, r12d
movzx edx, byte [rdx + 0x21]
mov r8d, r12d
mov qword [rax - 0x20], r14
mov r14d, r12d
shr r8d, 3
shr ebx, 2
and r8d, 1
and ebx, 1
mov qword [rax - 0x28], r15
mov ecx, ebx
call fcn.140030010
movzx edx, byte [r13 + 0x20]
mov r8d, r12d
movsx ebp, byte [r13 + 0x21]
mov r15d, 0x66
movsx esi, al
test ebx, ebx
mov eax, 0x63
mov edi, r15d
cmove edi, eax
shr r8d, 1
and r14d, 1
and r8d, 1
mov ecx, r14d
call fcn.140030010
movsx r9d, byte [r13 + 0x20]
lea rdx, str.GreSetLinesClef_c_d1_d_c_d_d___n
movsx ecx, al
test r12b, 1
mov dword [rsp + 0x38], esi
mov eax, 0x63
mov dword [rsp + 0x30], ebp
cmove r15d, eax
mov dword [rsp + 0x28], edi
mov r8d, r15d
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x70]
call fcn.1400017bc
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop r13
ret
Function at 0x1400406e0
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400406e0
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004072a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004072a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004072a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004072a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004072a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004072c
xor al, al
add rsp, 0x28
ret
Function at 0x140021c5c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140021a30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140021a30
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140021a30
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140021a30
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140021a30
cmp dword [rcx + 0x84], 0xe
jbe 0x140021a30
cmp dword [rcx + 0xf8], esi
je 0x140021a30
mov ecx, r14d
call fcn.140021b78
mov ecx, 2
call fcn.1400275d4
nop
cmp byte [0x14003e3c8], 0
jne 0x140021afa
mov r15d, 1
mov eax, r15d
xchg dword [0x14003e3b8], eax
test ebx, ebx
jne 0x140021aa3
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14003e3c0]
cmp rcx, rax
je 0x140021a9a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14001cc60]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14003e408]
jmp 0x140021aaf
cmp ebx, r15d
jne 0x140021ab5
lea rcx, [0x14003e420]
call fcn.1400222bc
nop
test ebx, ebx
jne 0x140021acc
lea rdx, [0x140031568]
lea rcx, [0x140031548]
call fcn.1400218f0
lea rdx, [0x140031578]
lea rcx, [0x140031570]
call fcn.1400218f0
movzx eax, byte [0x14003e3c8]
test esi, esi
cmove eax, r15d
mov byte [0x14003e3c8], al
jmp 0x140021afa
mov ecx, 2
call fcn.140027628
test esi, esi
jne 0x140021b11
mov ecx, r14d
call fcn.140021b2c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400219c0
Function at 0x140024f40
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140024de0
call fcn.140023418
mov dword [rax], socket
call fcn.1400232f8
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140024dc8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140024dc8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140024e12
lock or dword [rax + 0x14], 0x10
jmp 0x140024dc8
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140024e2f
mov rcx, qword [rbp + 0x10]
call fcn.14002bc20
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400242c0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140024818
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140024e86
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140024dc8
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140024ef2
mov rcx, qword [rbp + 0x10]
call fcn.1400242c0
cmp eax, 0xffffffff
je 0x140024ed9
mov rcx, qword [rbp + 0x10]
call fcn.1400242c0
cmp eax, 0xfffffffe
je 0x140024ed9
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400242c0
movsxd rdi, eax
lea rsi, [0x14003e480]
mov rcx, rbx
sar rdi, 6
call fcn.1400242c0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140024ee0
lea rax, [0x14003d3d0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140024ef2
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140024f28
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140024f24
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140024f24
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140024dcb
jmp 0x140024d98
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403aec33

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b0749

Function at 0x1400ec949
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401fd9c8
movsxd rdx, dword [rcx + 0x3c]
cmc
add rdx, rcx
cmp r14b, 0x5e
cmp dword [rdx], 0x4550
jmp 0x14020f2a4
ret
xor eax, eax
ret
jne 0x1401fd9c8
xor eax, eax
sbb cx, 0x2ce0
mov ecx, 0x20b
xor al, sil
test sp, 0x1bfb
or al, bl
cmp word [rdx + 0x18], cx
xchg al, al
seto al
sete al
jmp 0x1401bad95

Function at 0x1401ce4a6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x1402994be
jmp fcn.1404c50a8

Function at 0x1401e238e
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
cmp r15b, r14b
sub edx, edx
jmp 0x1404b299f

Function at 0x1401e71a0
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
movsx rdx, sp
cqo
lea edx, [r8 + 2]
jmp 0x140228fd6
jmp 0x1404b299f
mov qword [rsp + 8], rbx
bt ebx, r13d
sar bh, 0xd4
mov dword [rsp + 0x18], r8d
bsf bx, r12w
mov dword [rsp + 0x10], edx
push rbp
xadd bl, bpl
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
clc
cmp r15b, 0xc9
test r8d, r8d
jmp 0x1404b29d4
jne 0x1404b2a5d
sub ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1404b2a5d
mov ecx, 0x5a4d
stc
cmc
cmp word [rax], cx
jmp 0x1404b29fa
jne 0x1404b2a5d
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jmp 0x1404b2a13
jne 0x1404b2a5d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1404b2a27
jne 0x1404b2a5d
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b2a39
jbe 0x1404b2a5d
cmp dword [rcx + 0xf8], 0
jmp 0x1404b2a4b
je 0x1404b2a5d
mov ecx, ebx
jmp 0x1404b2a58
call fcn.1404b2874
lea rax, [rbp + 0x18]
movsx dx, r13b
movzx rcx, r11w
setno r8b
mov byte [rbp + 0x28], 0
cmovne r8w, si
cwd
xchg r8d, edx
mov qword [rbp - 0x20], rax
not r8b
lea r9, [rbp - 0x2c]
movsx dx, sil
lea rax, [rbp + 0x20]
movsx dx, bl
mov qword [rbp - 0x18], rax
jmp 0x1404b2aa4
lea r8, [rbp - 0x20]
mov eax, r8d
cbw
movzx edx, si
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
xchg dx, ax
lea rdx, [rbp - 0x28]
not ch
cwde
mov eax, 2
bswap cx
movsx ecx, bp
not ch
lea rcx, [rbp - 0x30]
jmp 0x1404b2ad7
mov dword [rbp - 0x2c], eax
jmp 0x1404b2adf
mov dword [rbp - 0x28], eax
jmp 0x1404b2ae7
call fcn.1404b2c83
cmp dword [rbp + 0x20], 0
jmp 0x1404b2af5
je 0x1404b2b11
mov rbx, qword [rsp + 0x60]
movzx ebp, cx
add rsp, 0x50
bswap bp
pop rbp
jmp 0x1404b2b10
ret
mov ecx, ebx
call fcn.1404b2921
int3
Function at 0x1401f6f50
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x140258d0e
jmp 0x14044767d
push rsi
sal si, cl
rcr al, cl
push rdi
sub rsp, 0x28
and al, dh
mov rsi, rcx
cmovg rax, rsp
mov rax, 0x32cb70a5
not rax
mov rcx, qword [rcx + 0x18]
sar ax, 0xa
cmovo rax, r15
mov rax, qword [rcx]
sub edx, edx
sub r8d, r8d
jmp 0x1404476b4
call qword [rax + 0x188]
mov edi, eax
movzx cx, r11b
xchg rcx, rcx
jmp 0x1404476c9
lea rcx, [rsi + 0x30]
jmp 0x1404476d2
call fcn.14045b37b
test edi, edi
jmp 0x1404476de
je 0x14044771e
cmp edi, 0x8899000c
jmp 0x1404476ef
jne 0x140447746
mov rcx, rsi
cmp r15b, dl
add rsp, 0x28
movsx rdi, dx
movsxd rdi, esp
cmovo rdi, r11
pop rdi
movsx si, sil
movsxd rsi, ebp
pop rsi
jmp 0x140447719
jmp fcn.14044732e
nop
btr rdi, rsp
jmp 0x140447728
add rsp, 0x28
movsxd rdi, edx
cmova di, bx
movsx rdi, cx
pop rdi
movsx rsi, r15w
not rsi
pop rsi
jmp 0x140447745
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
rcr di, 0x2d
rcl sil, 0x2b
mov dl, 3
jmp 0x140447763
mov r9d, 0x54
mov di, r9w
rcr dil, 0xab
add rsp, 0x28
setnp sil
movsx esi, r12w
not dil
pop rdi
pop rsi
jmp 0x140447787
jmp fcn.1403b0d5a
Function at 0x14028e92e
Capabilities:
Access peb ldr_data

Disassembly:
inc rax
cmp r8b, r13b
test al, r12b
test r11w, r11w
jmp 0x140227a48
test ax, ax
jmp 0x1401f681a
jmp 0x1401f6820
je 0x140166d03
mov word [r10], 0
adc ax, 0x159b
movzx r8d, r8w
cmp si, dx
movzx eax, word [0x1400b8f10]
xchg r8b, r8b
shr r8b, cl
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x140289b0f
jne 0x1401f682c
sub r8, rdx
cmc
test r9, 0x26656867
test r8, r8
jmp 0x14023da83
inc rdx
test si, r15w
cmp esp, 0x2442e51
cmp r14b, r15b
test ax, ax
jmp 0x1401b6533
mov rax, qword gs:[0x30]
shrd r8, r10, 0xcf
or r11b, 0x1c
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
rcl r11w, cl
mov rax, qword [rax + 0x10]
test si, 0x17da
movzx r8d, word [rax + 0x58]
cmovg r9w, r11w
shld r9, r11, 0xf6
bts r11w, r15w
cmp r8, rdx
movzx r11, r11w
movsx r10w, r15b
cmovae r8, rdx
sal r10w, 0x2f
mov r9, qword [rax + 0x60]
sar r11, 0x1a
shl r10b, cl
movsx r11, r15w
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
clc
stc
test r11w, r11w
je 0x140227a55
sub eax, eax
jmp 0x1401e6b3f
nop word [rax + rax]
test rbp, 0x352c57a3
cmp ebp, 0x286b3316
cmp r8, rax
jmp 0x1401f7774
je 0x1401b6544
xor edx, edx
test r11b, r15b
lea r9, [0x1400b8f10]
cmp r8, rdx
jmp 0x14021696d
je 0x140166cf2
mov word [r10], r11w
shr r11d, 0x35
cmovns r11w, r15w
sub r11w, 0x7467
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x1401300f9
ret
je 0x14023da89
mov word [rcx], ax
add rcx, 2
cmovno eax, r11d
movzx rax, r15w
nop
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401d32ac
jne 0x1401e6b52
sub r8, rax
test r10b, 0x66
test r8, r8
jmp 0x140166cec
je 0x14020b408
mov word [rcx], 0
jmp 0x14020b408
je 0x1401d7a30
cmp rdx, 0x104
not r8w
mov r8d, 0x104
cmovb r8, rdx
jmp 0x14013cb4d
cmovb r8, rdx
jmp 0x140135f74
movzx eax, word [0x1400b8f10]
stc
test r14w, r13w
test ax, ax
jmp 0x14024a131
Function at 0x1403bd009
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r8b, 0x15
shrd ax, dx, 0x44
push r14
test spl, 0xe
bsr rax, rbx
push r13
sbb r14b, 0x68
rcr rax, 0xf1
push r12
push rsi
rol r14b, cl
stc
sbb sil, r12b
push rdi
test spl, r11b
cmovge si, r9w
push rbx
bswap bx
rcr r14b, 0x80
adc si, 0x5ea
sub rsp, 0x20
jmp 0x1403bd05a
mov rsi, r8
add al, 0xe3
rcl r14b, 0xd2
bsf bx, cx
mov rdi, rdx
btc r14w, 0xfc
mov r14, rcx
rcr rax, cl
cmp r15b, r14b
mov rbx, qword [rcx]
setp ah
shl rax, 0xe
mov rcx, qword [rcx + 0x10]
xadd al, ah
shrd rax, r15, 0x85
sub rcx, rbx
jmp 0x1403bd09a
sar rcx, 4
movsx rax, r13w
rol al, cl
movabs rax, 0xf0f0f0f0f0f0f0f1
cmc
test r12b, 0x7d
test r8w, r8w
imul rcx, rax
jmp 0x1403bd0c1
cmp rcx, r8
jmp 0x1403bd0c9
jae 0x1403bd12d
mov rcx, r14
cdq
cwd
setne dl
mov rdx, rsi
call fcn.1403bd313
mov rbx, qword [r14]
cdq
nop word [rax + rax]
mov rcx, rbx
seta dl
cqo
mov rdx, rdi
jmp 0x1403bd0fd
call fcn.1403bdb31
add rbx, 0x110
jmp 0x1403bd10e
add rdi, 0x110
jmp 0x1403bd11a
dec rsi
jmp 0x1403bd122
jne 0x1403bd0ed
jmp 0x1403bd2cb
mov r13, qword [r14 + 8]
btc r12w, 0xfd
mov r12, r13
and r15b, 0xa2
sbb r15b, 0xa3
mov r15, 0x354e557b
sub r12, rbx
sar r12, 4
imul r12, rax
mov r15w, 0x10e5
stc
shr r15b, 0xa7
mov r15, r12
stc
sub r15, rsi
jmp 0x1403bd16a
jae 0x1403bd217
cmp rbx, r13
je 0x1403bd1c7
nop word cs:[rax + rax]
movsxd rcx, edi
movzx ecx, ax
jmp 0x1403bd192
mov rcx, rbx
xchg dh, dh
movsx rdx, r10w
mov rdx, rdi
call fcn.1403bd594
add rbx, 0x110
test r13b, bpl
cmp dil, 0x4d
add rdi, 0x110
cmp rbx, qword [r14 + 8]
jmp 0x1403bd1c1
jne 0x1403bd192
cmp rsi, r12
jmp 0x1403bd1cf
je 0x1403bd2cb
nop dword [rax + rax]
xchg ch, cl
mov rcx, rbx
mov rdx, rdi
jmp 0x1403bd1ea
call fcn.1403bdb31
add rbx, 0x110
cmp sil, r9b
test r12d, ecx
clc
add rdi, 0x110
jmp 0x1403bd209
inc r15
jne 0x1403bd1df
jmp 0x1403bd2cb
imul r15, rsi, 0x110
cmp bp, r10w
lea r15, [r15 + rbx]
test ax, sp
test al, 0xe8
test rsi, rsi
jmp 0x1403bd233
je 0x1403bd27a
nop
mov dx, r8w
mov rcx, rbx
bswap dx
mov rdx, rdi
jmp 0x1403bd24c
call fcn.1403bd594
add rbx, 0x110
jmp 0x1403bd261
add rdi, 0x110
jmp 0x1403bd26d
dec rsi
jne 0x1403bd23e
mov r13, qword [r14 + 8]
cmp r15, r13
jmp 0x1403bd282
je 0x1403bd2bb
mov rsi, r15
movsx cx, r12b
nop word [rax + rax]
mov rcx, rsi
jmp 0x1403bd29e
call fcn.1403b7ab3
add rsi, 0x110
test r8d, r15d
cmp rsi, r13
jmp 0x1403bd2b5
jne 0x1403bd296
mov rbx, r15
add si, 0x47a7
btr r15w, bx
and edi, r14d
mov qword [r14 + 8], rbx
shr r12b, cl
movzx r12d, si
xor r12b, r10b
add rsp, 0x20
pop rbx
xchg dil, dil
cmovno rsi, rdx
movsx r13d, ax
pop rdi
movzx r14d, sp
pop rsi
pop r12
movzx r13d, di
movzx r13, r9w
pop r13
movsx r15, r15w
mov r15b, al
mov r15b, 0xc3
pop r14
movzx r15d, r13w
pop r15
jmp 0x1403bd312
ret
Function at 0x1403d7bb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
add ax, 0x40c7
bts ax, bx
push rsi
test eax, 0x3675c96
add al, bh
cwde
push rdi
movsx eax, r8w
movzx si, al
movsx rsi, r14w
push rbx
movsx ax, bpl
sar al, cl
sub rsp, 0x28
sub al, 0x93
mov rsi, rcx
movsx rax, cx
stc
shrd ax, dx, 0x56
lea rax, fcn.140010f00
test r14w, r9w
jmp 0x1403d7c03
mov qword [rcx], rax
inc rax
lea rax, fcn.140010f00
mov qword [rcx + 0x50], rax
stc
clc
mov rcx, qword [rcx + 0xa0]
test rcx, rcx
jmp 0x1403d7c25
je 0x1403d7ca4
mov rdx, qword [rsi + 0xb0]
sub rdx, rcx
stc
test al, sil
cmp rdx, 0x1000
jmp 0x1403d7c45
jb 0x1403d7c83
mov rax, qword [rcx - 8]
cmc
jmp 0x1403d7c55
add rcx, 0xfffffffffffffff8
cmp r11b, 0x2e
sub rcx, rax
clc
test bx, 0x488b
jmp 0x1403d7c6b
cmp rcx, 0x20
jae 0x1403d7d95
add rdx, 0x27
mov rcx, rax
movsxd rdi, r9d
seto dil
lea rdi, [rsi + 0xa0]
call fcn.14011c953
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
not di
and dil, 0xb0
mov rdi, qword [rsi + 0x60]
test dil, al
jmp 0x1403d7cb0
test rdi, rdi
jmp 0x1403d7cb8
je 0x1403d7d6c
lea r14, [rsi + 0x60]
bts ebx, r15d
mov rbx, qword [rsi + 0x68]
cmp rdi, rbx
je 0x1403d7d07
nop dword [rax]
jmp 0x1403d7cdc
mov rcx, rdi
jmp 0x1403d7ce4
call fcn.1403b7ab3
add rdi, 0x110
cmp rdi, rbx
jmp 0x1403d7cf8
jne 0x1403d7cdc
mov rdi, qword [r14]
ror dl, cl
shr dx, 0xa3
mov rdx, qword [rsi + 0x70]
sub rdx, rdi
stc
cmc
cmp rdx, 0x1000
jmp 0x1403d7d1c
jb 0x1403d7d44
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
clc
cmc
cmp rdi, 0x20
jae 0x1403d7d95
add rdx, 0x27
movzx rdi, dx
mov rdi, rax
mov rcx, rdi
jmp 0x1403d7d4c
call fcn.14011c953
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov bl, r8b
test r12b, r10b
mov qword [r14 + 0x10], 0
clc
btc rcx, 0x1b
mov rcx, rsi
btr di, 0xca
add rsp, 0x28
movzx r14, dx
pop rbx
pop rdi
pop rsi
bswap r14
movzx r14d, r15w
movsxd r14, ecx
pop r14
jmp 0x1403d7d90
jmp fcn.1404422da
call fcn.1404b79e9
int3
Function at 0x1403e57a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
test bh, ch
push rdi
push rbx
sub rsp, 0x30
rcl rdi, cl
movaps xmmword [rsp + 0x20], xmm6
stc
not dil
bsf di, dx
mov rdi, qword [rcx]
test rdi, rdi
jmp 0x1403e57d1
je 0x1403e5911
mov r14, rcx
clc
mov rbx, qword [rcx + 8]
cmc
test r14d, r12d
cmp rdi, rbx
jmp 0x1403e57eb
je 0x1403e58b9
lea r15, [0x1400bed30]
jmp 0x1403e57fd
movaps xmm6, xmmword [0x1400bd400]
jmp 0x1403e5809
jmp 0x1403e5832
call fcn.14011c953
movups xmmword [rdi + 0x20], xmm6
stc
mov byte [rdi + 0x10], 0
add rdi, 0x38
test r10w, r12w
cmp rdi, rbx
jmp 0x1403e582c
je 0x1403e58aa
mov qword [rdi], r15
mov rax, qword [rdi + 0x28]
cmp bl, 0x9f
cmp rax, 0x10
jb 0x1403e5813
mov rcx, qword [rdi + 0x10]
setne dh
cmovo dx, dx
lea rdx, [rax + 1]
jmp 0x1403e585a
cmp rdx, 0x1000
jmp 0x1403e5866
jb 0x1403e580e
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
test r15d, 0x48945cba
jmp 0x1403e5884
sub rcx, rsi
cmc
stc
cmp rcx, 0x20
jae 0x1403e5967
add rax, 0x28
mov rdx, rax
movsxd rcx, r14d
movzx cx, r10b
mov rcx, rsi
jmp 0x1403e580e
mov rdi, qword [r14]
shrd dx, si, 9
xadd dh, dl
bts dx, ax
mov rdx, qword [r14 + 0x10]
sub rdx, rdi
cmc
cmp rdx, 0x1000
jmp 0x1403e58cd
jb 0x1403e58f4
mov rax, qword [rdi - 8]
cmp ah, 0x33
clc
add rdi, 0xfffffffffffffff8
cmc
sub rdi, rax
cmp rdi, 0x20
jae 0x1403e5967
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
call fcn.14011c953
xorps xmm0, xmm0
movups xmmword [r14], xmm0
or bx, ax
mov qword [r14 + 0x10], 0
rcl esi, 0x92
movaps xmm6, xmmword [rsp + 0x20]
xor bx, r15w
or r14w, 0x4a56
sar r14w, 0xd5
add rsp, 0x30
not ebx
movsxd rdi, r13d
pop rbx
xchg r14d, esi
jmp 0x1403e5937
pop rdi
movzx r14d, r12w
not sil
movsx r14, di
pop rsi
cmove r15w, r8w
movzx r15, r8w
mov r14b, cl
pop r14
setnp r15b
movzx r15d, cx
mov r15w, 0x532c
pop r15
jmp 0x1403e5966
ret
call fcn.1404b79e9
int3