joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140040d20
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp byte [rcx + 0xf1e], 0
movsxd r10, r9d
je 0x140040e44
cmp r8d, 0xff
jne 0x140040d81
lea eax, [r10 - 0xec]
cmp eax, 0x13
ja 0x140040d6b
lea r8, [0x140000000]
mov r9, qword [r8 + r10*8 + 0x610d0]
mov r8, rdx
lea rdx, str._s_IAC__s_n
add rsp, 0x38
jmp fcn.14001c7a0
mov r8, rdx
mov r9d, r10d
lea rdx, str._s_IAC__d_n
add rsp, 0x38
jmp fcn.14001c7a0
cmp r8d, 0xfb
jne 0x140040d93
lea r9, str.WILL
jmp 0x140040dd1
cmp r8d, 0xfc
jne 0x140040da5
lea r9, str.WONT
jmp 0x140040dd1
cmp r8d, 0xfd
jne 0x140040db7
lea r9, [0x140061af4]
jmp 0x140040dd1
xor r9d, r9d
lea rax, str.DONT
cmp r8d, 0xfe
cmove r9, rax
test r9, r9
je 0x140040e2d
cmp r10d, 0x27
jg 0x140040e04
lea r8, [0x140000000]
mov r8, qword [r8 + r10*8 + 0x616f0]
test r8, r8
jne 0x140040e14
mov r8, rdx
mov dword [rsp + 0x20], r10d
lea rdx, str._s__s__d_n
call fcn.14001c7a0
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x140040deb
lea r8, str.EXOPL
mov qword [rsp + 0x20], r8
mov r8, rdx
lea rdx, str._s__s__s_n
call fcn.14001c7a0
add rsp, 0x38
ret
mov r9d, r8d
mov dword [rsp + 0x20], r10d
mov r8, rdx
lea rdx, str._s__d__d_n
call fcn.14001c7a0
add rsp, 0x38
ret

Function at 0x140041190
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x4c0]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400411ef
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14001c620
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.140040d20
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400413a0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140041548
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x140041405
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x140041405
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140041405
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x14004143c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x140041492
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140041492
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140041492
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140041492
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140041492
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.140040e50
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400414f4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14001c620
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.140041220
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140041540
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14001c620
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140042cb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14006f008]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140042d45
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x140042da6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.14001c620
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140008a10
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x140042e61
sub ecx, 1
je 0x140042ed4
sub ecx, 1
je 0x140042e10
cmp ecx, 1
je 0x140042df3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14005f550]
call fcn.14001c620
jmp 0x140042ed4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1400429e0
test eax, eax
je 0x140042ed4
jmp 0x140042d7a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140042ed4
sub rax, rsi
cmp rax, rbp
jae 0x140042ed4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.14001c7a0
jmp 0x140042ed4
cmp r8d, 4
jle 0x140042ed4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140042ed4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14001c540
mov esi, eax
test eax, eax
je 0x140042eb3
mov edx, 5
mov rcx, rbx
call fcn.1400439a0
mov eax, esi
jmp 0x140042d7a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14002a660
mov rcx, r14
call fcn.14002a940
test eax, eax
je 0x140042d78
mov edx, 5
mov rcx, rbx
call fcn.1400439a0
mov eax, Ordinal_46
jmp 0x140042d7a
Function at 0x1400570d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140057112
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140057159
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400571b2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140057170
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400571f3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14006688a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14006688b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400571c0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403aa123

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403abca5

Function at 0x140191df9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmovne rdx, rcx
mov rcx, qword [rax]
movzx eax, r11w
bsf eax, r11d
jmp 0x140270317
cmp byte [r8 + rdx], 0x65
je 0x140222e68
mov rax, qword [r9]
cmovl r8w, cx
nop dword [rax + rax]
dec r8w
movzx r8d, byte [rcx + 1]
jmp 0x140222e5a
mov r9, qword [rdx]
or r8b, 0xa5
shr r8w, 0x7c
rcr dh, 0xf3
movzx r8d, byte [rcx]
xadd dl, dh
cmc
mov rdx, qword [r9 + 0x110]
jmp 0x1401213f0
jne 0x140270331
ret
inc rcx
test byte [rax + r8*2], 4
jne 0x14012140f
movzx eax, r8b
cmp r13d, edx
cmp byte [rax + rdx], 0x78
jmp 0x1402474db
jne 0x1402474ee
movzx r8d, byte [rcx + 2]
cdq
cmovp rdx, r8
movzx eax, di
mov rax, qword [r9 + 0xf8]
cdq
lea rdx, [rcx + 2]
jmp 0x14011eb00
movzx eax, byte [rcx]
mov byte [rdx], al
sbb ecx, r15d
lea rax, [rdx + 1]
nop dword [rax]
xor dh, 0xaf
clc
bts ecx, ecx
movzx ecx, byte [rax]
movzx edx, r8b
stc
test r10b, 0xb2
test r12w, r12w
mov byte [rax], r8b
and r8b, dil
or r8b, 0x79
lea rax, [rax + 1]
movzx r8d, cl
cmp bp, 0x11f2
test dl, dl
jmp 0x1401c3d6a

Function at 0x140193f2f
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
sub edx, edx
jmp 0x1401c8c17
jmp 0x1404ad7ac

Function at 0x14019a298
Capabilities:
Parse pe header

Disassembly:
jne 0x1402404df
sub eax, eax
xadd cx, cx
dec ecx
mov ecx, 0x20b
ror al, 0xd4
cmp word [rdx + 0x18], cx
xchg al, al
jmp 0x140275163
mov eax, 0x5a4d
test rdx, 0x2c3f3502
cmp r9b, 0x32
cmp word [rcx], ax
jmp 0x1401b1081
ret
jne 0x1402404df
movsxd rdx, dword [rcx + 0x3c]
stc
test bp, r12w
add rdx, rcx
cmp dword [rdx], 0x4550
jmp 0x140108901
ret
xor eax, eax
jmp 0x1401d23d6
sete al
jmp 0x14019dc24
Function at 0x1401c419d
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x1401d1c72
je 0x140180ec0
mov word [rcx], 0
jmp 0x140180ec0
ret
je 0x1401c1654
xor eax, eax
nop word [rax + rax]
cmp r8, rax
jmp 0x1401c1618
je 0x140224ab3
mov word [r10], r11w
movzx r11w, r10b
sub r11, rsp
sar r11w, 0xce
add r10, 2
not r11b
movsx r11, r12w
movzx r11d, word [r9 + rax*2 + 2]
inc rax
cmp dil, r11b
test r11w, r11w
jne 0x1401862e6
sub r8, rax
cmc
test r8, r8
jmp 0x140224aad
movzx eax, word [0x1400b8f10]
cmp r12w, 0x1e66
test ax, ax
jmp 0x1401ed5d1
je 0x14026f013
sub edx, edx
mov r9b, 0x3f
lea r9, [0x1400b8f10]
test r13b, spl
stc
cmp r8, rdx
je 0x1401705f6
mov word [rcx], ax
add rcx, 2
not eax
movzx eax, r8w
inc ax
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x14025dc2e
cmovb r8, rdx
jmp 0x14011f9a8
je 0x140206c0f
cmp rdx, 0x104
mov r8d, r13d
xchg r8b, r8b
not r8w
mov r8d, 0x104
jmp 0x1401da498
mov rax, qword gs:[0x30]
shr r9b, cl
movsx r9w, r11b
xor r8b, r8b
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
adc r9b, 0x99
shld r10, r15, 0x40
add r8w, r13w
movzx r8d, word [rax + 0x58]
and r11w, ax
sbb r11b, 0x73
movsx r11w, bl
cmp r8, rdx
jmp 0x140262cad
je 0x140224abb
mov word [r10], 0
cbw
movzx eax, word [0x1400b8f10]
mov r8b, sil
cmp rdx, 0x104
mov r8d, 0x104
cmovb r8, rdx
test ax, ax
jmp 0x1401d1c6c
inc rdx
test ax, ax
jmp 0x14026f00a
cmovae r8, rdx
movzx r11, dx
mov r9, qword [rax + 0x60]
dec r10b
movzx r11d, word [r9]
dec r10w
rcl r10, 0x19
lea r10, [0x1400b8f10]
test r15w, r12w
cmp edi, r14d
cmp r15d, 0x43621c1f
test r11w, r11w
jmp 0x1401862d8
jne 0x1401d1c82
sub r8, rdx
test r8, r8
jmp 0x1401705f0
Function at 0x14022a4d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x1401fcf56
movzx eax, byte [r11 + rcx*4 + 1]
cmc
cmp al, byte [rdx + 1]
jne 0x1401fcf56
movzx eax, byte [r11 + rcx*4 + 2]
cmp al, byte [rdx + 2]
jne 0x1401fcf56
mov byte [r11 + rcx*4 + 3], 0
movzx r10w, dl
movzx r10d, byte [rdx]
jmp 0x1401fcf56
jne 0x14011a3b4
test r9d, r9d
jmp 0x140119217
jb 0x140231db6
mov r8d, r9d
and r8d, 0xfffffffc
and r10w, di
movzx ecx, r9w
nop word cs:[rax + rax]
not cl
xchg r10b, r10b
movzx ecx, byte [r11]
cmp cl, byte [rdx]
movzx r10d, byte [r11 + 2]
setne cl
stc
cmp r11b, al
neg cl
jmp 0x140224cb6
je 0x1401fcf55
lea ecx, [r9 - 1]
clc
cmp ecx, 3
jmp 0x140113309
test r9d, r9d
jmp 0x14025560d
mov byte [r11 + 7], cl
add r11, 8
cmc
add r8d, 0xfffffffc
jmp 0x140231db0
neg cl
test bl, dil
mov byte [r11 + 5], cl
shld cx, r13w, 0x33
add cl, 0x80
movzx ecx, byte [r11 + 6]
stc
cmp cl, byte [rdx]
sete cl
mov cl, 0xe8
setne cl
test r12b, al
neg cl
jmp 0x14012417d
ret
inc rcx
test cx, 0x9e9
test r13d, r8d
cmp r8d, ecx
jmp 0x14028d157
jmp 0x14028d15d
mov byte [r11 + 1], cl
clc
and cl, 0x27
cmp r10b, byte [rdx]
mov cl, 0x87
setne cl
setne cl
test sp, 0x3013
test bpl, r11b
neg cl
stc
mov byte [r11 + 3], cl
movzx ecx, byte [r11 + 4]
test spl, 0x14
cmp cl, byte [rdx]
xchg cl, cl
setne cl
jmp 0x1401e9e27
mov r10, qword [rcx]
xor r9w, di
sal r11d, cl
bts r9w, ax
mov r11, qword [rcx + 0x18]
or r9w, 0xdec
dec r9w
mov r9d, dword [r10 + 4]
test r9b, r13b
cmc
imul r9d, dword [r10]
jmp 0x140239794
jne 0x140266593
jmp 0x1401fcf55
jne 0x140113331
test r9b, 3
jmp 0x140266578
cmp r8d, 2
jmp 0x140103879
je 0x1401fcf55
movzx r10d, byte [rdx]
mov r8d, r9d
clc
cmc
sub ecx, ecx
jmp 0x14021cb06
je 0x1401fcf55
and r9d, 3
rcr al, cl
xor ecx, ecx
cmc
nop word cs:[rax + rax]
rcl ah, cl
movzx eax, byte [r11 + rcx*2]
cmp al, byte [rdx]
setne al
clc
neg al
mov byte [r11 + rcx*2 + 1], al
jmp 0x14028e1f4
je 0x1401fcf55
cmp byte [r11 + rcx*4], r10b
jmp 0x1400eb888
inc rcx
clc
cmp r9d, ecx
jmp 0x14022eca0

Function at 0x14023b288
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x140442737
mov rcx, qword [rcx]
jmp 0x14015976f
push rsi
movzx si, al
cmc
test si, 0x4a43
push rdi
rcl sil, cl
jmp 0x14044274e
sub rsp, 0x28
sbb sil, 0x5c
movzx ax, r8b
cmp r13d, r9d
mov rsi, rcx
rcl ah, cl
and ax, dx
sbb al, 0xfe
mov rcx, qword [rcx + 0x18]
add ax, si
mov rax, qword [rcx]
sub edx, edx
stc
xor r8d, r8d
jmp 0x14044277d
call qword [rax + 0x188]
mov edi, eax
setbe cl
movsx rcx, r15w
lea rcx, [rsi + 0x30]
jmp 0x140442795
call fcn.14045632b
test edi, edi
jmp 0x1404427a1
je 0x1404427dc
cmp edi, 0x8899000c
jmp 0x1404427b2
jne 0x1404427ff
mov rcx, rsi
rcr sil, 0x4f
add rsp, 0x28
movzx rdi, r15w
jmp 0x1404427cc
pop rdi
cmovb si, sp
pop rsi
jmp 0x1404427d7
jmp fcn.1404423de
nop
or edi, 0x18b15862
clc
xadd dil, sil
add rsp, 0x28
movzx edi, r10w
pop rdi
not si
movsx rsi, si
pop rsi
jmp 0x1404427fe
ret
mov ecx, edi
bts r8w, bp
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
add dil, 0xfc
mov r9d, 0x54
add rsp, 0x28
pop rdi
setp sil
pop rsi
jmp 0x14044282b
jmp fcn.1403ac24d
Function at 0x140258515
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x140128ace
mov ecx, dword [rax + 8]
test r12b, r15b
test al, 0x5e
add ecx, edx
cmp sp, 0xb1d
test bpl, 0x39
cmp r10, rcx
jb 0x1401ec0e8
inc r9d
test r11w, r8w
add rax, 0x28
test r10b, r12b
stc
cmp r9d, r11d
jmp 0x1401c415f
je 0x1401c4165
mov edx, dword [rax + 0xc]
cmp r10, rdx
jmp 0x140128aac
test r11d, r11d
jmp 0x140197bb9
jb 0x140197bbf
sub eax, eax
jmp 0x1401ec0e8
ret
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
clc
or r11w, 0x770c
mov r10, rdx
movzx eax, word [r8 + 0x14]
sub r11b, bpl
movzx r11d, bx
dec r11b
movzx r11d, word [r8 + 6]
clc
add rax, 0x18
test r12, 0x4830194b
stc
lea rax, [rax + r8]
jmp 0x1401ab2fb

Function at 0x140279639
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec rcx
cmp r15b, r11b
cmp al, 0x30
jne 0x140169c33
movzx eax, byte [rcx - 1]
jmp 0x1401f8d28
je 0x1400e0b9c
cmp al, r9b
cwde
rdtsc
cbw
lea rdx, [rcx - 1]
cmovne rdx, rcx
cbw
add al, spl
nop dword [rax]
setns ah
and ax, 0x4677
cbw
movzx eax, byte [r8]
clc
cmp r11, 0x631454f9
lea rdx, [rdx + 1]
mov byte [rdx], al
stc
lea r8, [r8 + 1]
cmp r15w, 0x6259
test al, al
jne 0x140169c58
ret
dec rcx
test r12b, al
test sp, 0x2e01
clc
cmp al, 0x30
jmp 0x140169c2d
je 0x1402334aa
sub al, 0x45
clc
test bh, dh
cmp r15b, sil
test al, 0xdf
jmp 0x140233495
jne 0x14027967c
inc rcx
test al, al
je 0x140169c7d
movzx eax, byte [rcx]
cmc
test al, al
jmp 0x1401fa27c
je 0x1402334aa
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401fa282
movzx eax, byte [rcx - 1]
dec r8d
mov r8, rcx
jmp 0x1400e0b8e
je 0x14020aeee
movzx eax, byte [rcx + 1]
movzx edx, sp
inc rcx
shrd dx, r8w, 0x32
movsxd rdx, r8d
movzx edx, al
clc
test al, al
jmp 0x14020aee8
mov rax, qword [rdx]
mov rdx, qword [rax + 0xf8]
mov rax, qword [rdx]
sar r9b, cl
sar r9w, 8
movzx r9d, byte [rax]
shl ah, cl
sar al, 0x44
bts rax, r14
movzx eax, byte [rcx]
stc
test al, al
je 0x14020aeee
movzx edx, al
xor ax, 0x3060
nop dword [rax + rax]
sbb ah, 0x51
dec ax
movsx eax, dx
movzx eax, dl
clc
test bl, dil
stc
cmp dl, r9b
jmp 0x1402661ff
Function at 0x1403b8612
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bsr ax, sp
btc rax, 0xd6
mov ah, al
push r14
cwde
xor r14b, 0x2a
push r13
push r12
rcr ah, cl
inc r14
push rsi
jmp 0x1403b863e
push rdi
rcr di, 0xd9
movsxd rsi, eax
push rbx
shr sil, 4
sub rsp, 0x20
dec sil
jmp 0x1403b8657
mov rsi, r8
sub r14w, 0x510d
mov rdi, rdx
adc r14b, 0xfa
movzx ax, bpl
mov r14, rcx
xor al, spl
neg al
btc ax, 0xf0
mov rbx, qword [rcx]
mov rcx, qword [rcx + 0x10]
sub rcx, rbx
xadd eax, eax
rcr al, cl
sar rcx, 4
movabs rax, 0xf0f0f0f0f0f0f0f1
test r9, 0x14b4485e
cmp r15b, r9b
imul rcx, rax
stc
cmp rcx, r8
jmp 0x1403b86ad
jae 0x1403b8713
mov rcx, r14
mov dl, 0x75
cmovge edx, r15d
mov edx, esi
mov rdx, rsi
jmp 0x1403b86c6
call fcn.1403b8905
mov rbx, qword [r14]
nop word [rax + rax]
mov rcx, rbx
cwd
movsx dx, cl
mov rdx, rdi
jmp 0x1403b86e8
call fcn.1403b914e
add rbx, 0x110
add rdi, 0x110
jmp 0x1403b8700
dec rsi
jmp 0x1403b8708
jne 0x1403b86d7
jmp 0x1403b88d1
mov r13, qword [r14 + 8]
shr r15w, 0x74
not r12w
btc r15, 8
mov r12, r13
rcr r15w, cl
sar r15w, 0xe8
btr r15d, 0xaf
sub r12, rbx
sar r12, 4
rcl r15w, 2
rcr r15, cl
bt r15w, 7
imul r12, rax
mov r15, r12
cmp r11d, 0x4d6b2e2e
cmc
sub r15, rsi
jmp 0x1403b8762
jae 0x1403b881f
cmp rbx, r13
je 0x1403b87c1
nop word cs:[rax + rax]
movzx cx, r12b
movzx edx, r9w
mov rcx, rbx
movsxd rdx, ebx
movsx edx, r15w
bswap edx
mov rdx, rdi
jmp 0x1403b879c
call fcn.1403b8bb2
add rbx, 0x110
cmc
clc
add rdi, 0x110
cmc
cmp rbx, qword [r14 + 8]
jmp 0x1403b87bb
jne 0x1403b8788
cmp rsi, r12
jmp 0x1403b87c9
je 0x1403b88d1
nop dword [rax + rax]
movsx edx, r9w
cwd
seto ch
mov rcx, rbx
movsx rdx, sp
mov rdx, rdi
jmp 0x1403b87ef
call fcn.1403b914e
add rbx, 0x110
jmp 0x1403b8800
add rdi, 0x110
jmp 0x1403b880c
inc r15
jmp 0x1403b8814
jne 0x1403b87e0
jmp 0x1403b88d1
imul r15, rsi, 0x110
clc
add r15, rbx
cmp r15b, 0x66
test rsi, rsi
jmp 0x1403b8836
je 0x1403b887c
nop
mov rcx, rbx
not dl
jmp 0x1403b8849
mov rdx, rdi
jmp 0x1403b8851
call fcn.1403b8bb2
add rbx, 0x110
add rdi, 0x110
jmp 0x1403b8869
dec rsi
jmp 0x1403b8871
jne 0x1403b883d
mov r13, qword [r14 + 8]
clc
cmp r15, r13
jmp 0x1403b8884
je 0x1403b88c6
mov rsi, r15
movsx ecx, r8w
nop word [rax + rax]
movzx cx, spl
movsx ecx, r13w
mov rcx, rsi
jmp 0x1403b88a8
call fcn.1403b2fab
add rsi, 0x110
cmc
cmp ah, 0x72
cmp rsi, r13
jmp 0x1403b88c0
jne 0x1403b88a0
mov rbx, r15
shld si, sp, 0x28
mov dil, 0x79
mov qword [r14 + 8], rbx
cmc
add rsp, 0x20
pop rbx
jmp 0x1403b88e4
pop rdi
movsx r12w, r15b
mov r14d, ecx
movzx esi, r12w
pop rsi
jmp 0x1403b88f7
pop r12
pop r13
pop r14
pop r15
jmp 0x1403b8904
ret
Function at 0x1403bde1e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
test cl, r13b
mov sil, 0x9f
rcr rax, 0x37
push rdi
test di, bp
btr rsi, 0x13
and ah, 0xc9
push rbx
xadd esi, esi
bsr esi, r10d
bt ax, ax
sub rsp, 0x20
sbb al, al
mov rsi, rcx
lea rax, [0x1400bdab0]
test di, 0x7eb5
mov qword [rcx], rax
clc
xor al, bpl
mov rax, qword [rcx + 0x88]
stc
cmp r11b, 0x37
cmc
cmp rax, 8
jmp 0x1403bde73
jb 0x1403bdf01
mov rcx, qword [rsi + 0x70]
sal dh, 0x96
bts edx, r14d
adc dl, r10b
lea rdx, [rax + rax]
test r10b, r8b
add rdx, 2
clc
cmp rdx, 0x1000
jb 0x1403bdefc
mov rbx, qword [rcx - 8]
test si, 0x5dce
cmp spl, spl
add rcx, 0xfffffffffffffff8
jmp 0x1403bdeb8
sub rcx, rbx
cmc
stc
jmp 0x1403bdec2
cmp rcx, 0x20
jae 0x1403be05a
add rax, rax
btr ecx, 0x3d
adc rcx, r11
shld dx, r8w, 0x13
add rax, 0x29
movsxd rcx, esi
movzx rcx, sp
mov rdx, rax
jmp 0x1403bdef4
mov rcx, rbx
jmp 0x1403bdefc
call fcn.14022f308
movaps xmm0, xmmword [0x1400bd3f0]
movsx eax, r15w
movups xmmword [rsi + 0x80], xmm0
inc bx
jmp 0x1403bdf1b
mov word [rsi + 0x70], 0
lea rax, [0x1400bdb70]
shl bx, cl
rol dil, cl
mov qword [rsi], rax
movsx rdi, r12w
mov rdi, qword [rsi + 0x40]
test al, dil
cmp edi, 0x3b51758d
inc bh
mov rbx, qword [rsi + 0x48]
clc
cmp rdi, rbx
jmp 0x1403bdf51
jne 0x1403bdf70
jmp 0x1403bdfb8
add rdi, 8
stc
cmc
cmp rdi, rbx
jmp 0x1403bdf6a
je 0x1403bdf9d
mov rcx, qword [rdi]
test rcx, rcx
je 0x1403bdf5c
mov rax, qword [rcx]
movzx edx, r9w
movsx dx, r12b
mov edx, 1
jmp 0x1403bdf92
call qword [rax + 0xb8]
jmp 0x1403bdf5c
mov rdi, qword [rsi + 0x40]
cmp al, sil
clc
cmp rdi, qword [rsi + 0x48]
jmp 0x1403bdfae
je 0x1403bdfb8
mov qword [rsi + 0x48], rdi
test rdi, rdi
je 0x1403be036
mov rdx, qword [rsi + 0x50]
test r15b, bl
cmp bpl, 0x7b
sub rdx, rdi
clc
test r15b, 0x7d
cmp rdx, 0x1000
jmp 0x1403bdfe0
jb 0x1403be006
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x1403be05a
add rdx, 0x27
mov rdi, rax
test r15w, r10w
add rsi, 0x40
movzx ecx, r13w
mov rcx, rdi
jmp 0x1403be016
call fcn.14022f308
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
sbb si, 0x4716
or di, 0x5485
sar si, cl
add rsp, 0x20
jmp 0x1403be043
pop rbx
pop rdi
movzx rsi, r12w
movzx si, r15b
jmp 0x1403be053
pop rsi
jmp 0x1403be059
ret
call fcn.1404b2945
int3