joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026740
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push rbx
push r14
push r15
push rbp
sub rsp, 0xa8
xor ecx, ecx
mov r14, qword [str..lrb_bsd]
call fcn.140028090
mov rbp, qword [0x1403ce390]
lea rcx, [rsp + 0x68]
mov edx, 1
mov r8d, 0x40
mov r9, rbp
call fcn.1400b508c
cmp eax, 0x40
jne 0x14002689b
mov edx, 2
lea rcx, [rsp + 0x68]
call fcn.140028010
movsx rdx, ax
cmp edx, 0x5a4d
jne 0x14002689b
mov edx, 4
lea rcx, [rsp + 0xa4]
call fcn.140028010
mov r15d, eax
mov ecx, r15d
call fcn.140028090
mov edx, 1
lea rcx, [rsp + 0x5c]
mov r8d, 4
mov r9, rbp
call fcn.1400b508c
cmp dword [rsp + 0x5c], 0x4550
jne 0x14002689b
mov edx, 1
lea rcx, [rsp + 0x5c]
mov r8d, 4
mov r9, rbp
call fcn.1400b508c
lea ecx, [r15 + 4]
call fcn.140028090
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, 0x14
mov r9, rbp
call fcn.1400b508c
mov edx, 2
lea rcx, [rsp + 0x22]
call fcn.140028010
mov edx, 2
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.140028010
lea ecx, [r15 + rax + 0x18]
mov r15d, 1
test ebx, ebx
jle 0x14002689b
mov qword [rsp + 0x60], rsi
mov esi, ebx
mov ebx, ecx
mov ecx, ebx
call fcn.140028090
mov edx, 1
lea rcx, [rsp + 0x34]
mov r8d, 0x28
mov r9, rbp
call fcn.1400b508c
mov rcx, r14
lea rax, [rsp + 0x34]
mov edx, 8
call fcn.1400635e0
test eax, eax
je 0x1400268ab
inc r15d
add ebx, 0x28
cmp r15d, esi
jle 0x140026856
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0xa8
pop rbp
pop r15
pop r14
pop rbx
ret
mov rsi, qword [rsp + 0x60]
lea rcx, [rsp + 0x34]
call fcn.140027dc0
nop
add rsp, 0xa8
pop rbp
pop r15
pop r14
pop rbx
ret

Function at 0x14002684d
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
push rbp
sub rsp, 0xa8
xor ecx, ecx
mov r14, qword [str..lrb_bsd]
call fcn.140028090
mov rbp, qword [0x1403ce390]
lea rcx, [rsp + 0x68]
mov edx, 1
mov r8d, 0x40
mov r9, rbp
call fcn.1400b508c
cmp eax, 0x40
jne 0x14002689b
mov edx, 2
lea rcx, [rsp + 0x68]
call fcn.140028010
movsx rdx, ax
cmp edx, 0x5a4d
jne 0x14002689b
mov edx, 4
lea rcx, [rsp + 0xa4]
call fcn.140028010
mov r15d, eax
mov ecx, r15d
call fcn.140028090
mov edx, 1
lea rcx, [rsp + 0x5c]
mov r8d, 4
mov r9, rbp
call fcn.1400b508c
cmp dword [rsp + 0x5c], 0x4550
jne 0x14002689b
mov edx, 1
lea rcx, [rsp + 0x5c]
mov r8d, 4
mov r9, rbp
call fcn.1400b508c
lea ecx, [r15 + 4]
call fcn.140028090
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, 0x14
mov r9, rbp
call fcn.1400b508c
mov edx, 2
lea rcx, [rsp + 0x22]
call fcn.140028010
mov edx, 2
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.140028010
lea ecx, [r15 + rax + 0x18]
mov r15d, 1
test ebx, ebx
jle 0x14002689b
mov qword [rsp + 0x60], rsi
mov esi, ebx
mov ebx, ecx
mov ecx, ebx
call fcn.140028090
mov edx, 1
lea rcx, [rsp + 0x34]
mov r8d, 0x28
mov r9, rbp
call fcn.1400b508c
mov rcx, r14
lea rax, [rsp + 0x34]
mov edx, 8
call fcn.1400635e0
test eax, eax
je 0x1400268ab
inc r15d
add ebx, 0x28
cmp r15d, esi
jle 0x140026856
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0xa8
pop rbp
pop r15
pop r14
pop rbx
ret
mov rsi, qword [rsp + 0x60]
lea rcx, [rsp + 0x34]
call fcn.140027dc0
nop
add rsp, 0xa8
pop rbp
pop r15
pop r14
pop rbx
ret
Function at 0x140027c00
Capabilities:
Read file on windows

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x20
mov r12d, edx
movsxd r12, r12d
mov r13, rcx
mov rcx, r8
mov edx, 1
mov r8, r12
mov r9, r13
call fcn.1400b508c
mov rdi, rax
mov rcx, r13
call fcn.1400b3078
test eax, eax
jne 0x140027c5e
cmp edi, r12d
jne 0x140027c48
mov eax, 1
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov ecx, 2
call fcn.140084028
xor eax, eax
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
lea rcx, str.fread
call fcn.1400baac4
xor eax, eax
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x140027dc0
Capabilities:
Read file on windows

Disassembly:
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [0x1403ce3a0]
call fcn.140027ee0
mov edx, 4
lea rcx, [rbp + 0x10]
call fcn.140028010
add rbp, 0x14
mov edx, 4
mov rcx, rbp
mov r12d, eax
call fcn.140028010
add eax, 8
mov ecx, eax
call fcn.140028090
mov edx, 1
lea rcx, [rsp + 0x20]
mov r14, qword [0x1403ce390]
mov r8, rdx
mov r9, r14
call fcn.1400b508c
mov r13d, 9
cmp byte [rsp + 0x20], 0
je 0x140027e50
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8, rdx
mov r9, r14
call fcn.1400b508c
inc r13d
cmp byte [rsp + 0x20], 0
jne 0x140027e31
mov rbp, qword [0x1403ce398]
mov rcx, rbp
lea rdx, [0x1401a533c]
call fcn.1400b1fe8
mov r15, rax
mov qword [0x1403ce3a8], r15
test r15, r15
jne 0x140027ea1
mov ecx, 2
call fcn.140084028
mov rcx, rax
lea rdx, str.cannot_open_file__s_n
mov r8, rbp
call fcn.14003b2b0
xor eax, eax
add rsp, 0x30
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov rcx, rbp
call fcn.140086ae8
sub r12d, r13d
mov rcx, r14
mov rdx, r15
mov r8d, r12d
call fcn.140027f90
mov rcx, r15
call fcn.1400b3410
mov eax, 1
add rsp, 0x30
pop rbp
pop r15
pop r14
pop r13
pop r12
ret

Function at 0x140027f90
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
xor eax, eax
test r8d, r8d
jbe 0x140027fff
mov qword [rsp + 0x38], rbx
mov ebx, eax
mov qword [rsp + 0x30], rsi
mov rsi, rcx
mov qword [rsp + 0x28], rdi
mov rdi, rdx
mov qword [rsp + 0x20], r12
mov r12d, r8d
mov edx, 1
lea rcx, [rsp + 0x40]
mov r8, rdx
mov r9, rsi
call fcn.1400b508c
mov edx, 1
lea rcx, [rsp + 0x40]
mov r8, rdx
mov r9, rdi
call fcn.1400ba8e4
inc ebx
cmp ebx, r12d
jb 0x140027fba
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x140027f9b
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
xor eax, eax
test r8d, r8d
jbe 0x140027fff
mov qword [rsp + 0x38], rbx
mov ebx, eax
mov qword [rsp + 0x30], rsi
mov rsi, rcx
mov qword [rsp + 0x28], rdi
mov rdi, rdx
mov qword [rsp + 0x20], r12
mov r12d, r8d
mov edx, 1
lea rcx, [rsp + 0x40]
mov r8, rdx
mov r9, rsi
call fcn.1400b508c
mov edx, 1
lea rcx, [rsp + 0x40]
mov r8, rdx
mov r9, rdi
call fcn.1400ba8e4
inc ebx
cmp ebx, r12d
jb 0x140027fba
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x14002f5b0
Capabilities:
Create directory

Disassembly:
jmp 0x1400bae4c
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400bae6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400bc268
or eax, 0xffffffff
jmp 0x1400bae70
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400345a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push r14
push r15
sub rsp, 0x20
mov r13, rcx
xor r15d, r15d
test r13, r13
je 0x14003460d
mov rcx, r13
call fcn.14008c504
lea rcx, [rax + rax + 2]
call fcn.140018240
mov r14, rax
mov rcx, r14
mov rdx, r13
call fcn.140089fb4
mov rcx, r14
call fcn.140034650
test al, al
jne 0x14003461b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15d, eax
cmp r15d, 0xffffffff
je 0x1400345fd
and r15d, 0x10
shr r15d, 4
jmp 0x140034600
xor r15d, r15d
test r14, r14
je 0x14003460d
mov rcx, r14
call fcn.140086ae8
mov eax, r15d
add rsp, 0x20
pop r15
pop r14
pop r13
ret
mov rcx, r14
call fcn.14008c504
mov rdx, rax
cmp rdx, 1
jbe 0x1400345e1
movzx eax, word [r14 + rdx*2 - 4]
cmp eax, 0x3a
je 0x1400345e1
mov rcx, r14
xor eax, eax
mov word [r14 + rdx*2 - 2], ax
call fcn.140034650
jmp 0x1400345dd
Function at 0x14003bd80
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
mov eax, 0x2058
call fcn.140073490
sub rsp, 0x2058
mov r15d, r8d
mov r13, rdx
mov r12, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x1001
movzx edi, r9b
call fcn.140066240
xor edx, edx
lea rcx, [rsp + 0x1050]
mov r8d, 0x1001
call fcn.140066240
mov byte [rsp + 0x30], 0
xor ebx, ebx
test r12, r12
je 0x14003bfb3
test r13, r13
je 0x14003bf9c
mov rcx, r12
xor r14d, r14d
mov dword [rsp + 0x28], 0
call fcn.1400bd0e8
mov rcx, r12
mov ebp, eax
call fcn.1400b2e28
mov esi, eax
mov rcx, r12
call fcn.1400b2fa8
mov rcx, r12
call fcn.1400b2e28
neg eax
mov rcx, r12
add eax, esi
xor r8d, r8d
mov edx, eax
call fcn.1400b2558
mov ecx, ebp
lea rdx, [rsp + 0x1050]
mov r8d, 0x1000
call fcn.1400d55b4
mov ebp, eax
test ebp, ebp
je 0x14003be68
dec r15d
jmp 0x14003be54
inc edx
mov byte [rsp + r14 + 0x40], al
mov r14d, edx
mov al, byte [rsp + r14 + 0x1050]
test al, al
je 0x14003be68
mov edx, r14d
cmp edx, r15d
jb 0x14003be4a
mov byte [rsp + r14 + 0x40], 0
test edi, edi
je 0x14003bf8d
lea rcx, [rsp + 0x40]
call fcn.14003bfd0
mov r14, rax
test r14, r14
je 0x14003bee3
mov rcx, r14
xor r15d, r15d
call fcn.14008c504
test rax, rax
jbe 0x14003bee3
movzx r8d, word [r14]
test r8d, r8d
je 0x14003bee3
mov qword [rsp + 0x20], r13
mov r13b, byte [rsp + 0x30]
movzx r8d, word [r14 + r15*2]
cmp r8d, 0xa
je 0x14003bf71
cmp r8d, 0xffff
je 0x14003bf76
inc r15d
cmp r15, rax
jae 0x14003bede
movzx r8d, word [r14 + r15*2]
test r8d, r8d
je 0x14003bede
test r13b, r13b
je 0x14003beab
mov r13, qword [rsp + 0x20]
test r14, r14
je 0x14003bf6d
test edi, edi
je 0x14003bf63
mov rcx, r14
call fcn.14003c060
xor edx, edx
test rax, rax
je 0x14003bf1e
mov rcx, rax
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x14003bf1c
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x14003bf04
dec rax
mov edx, eax
add esi, ebx
mov rcx, r12
add edx, esi
xor r8d, r8d
call fcn.1400b2558
test ebp, ebp
jle 0x14003bf59
test r14, r14
je 0x14003bf41
mov rcx, r13
mov rdx, r14
call fcn.140089fb4
mov eax, dword [rsp + 0x28]
add rsp, 0x2058
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [rsp + 0x28], 0xffff
jmp 0x14003bf31
mov rcx, r14
call fcn.140047110
jmp 0x14003bef8
xor edx, edx
jmp 0x14003bf1e
mov ebx, 2
mov rcx, r14
xor eax, eax
mov word [r14 + r15*2], ax
mov r13b, 1
call fcn.14008c504
jmp 0x14003bec7
lea rcx, [rsp + 0x40]
call fcn.1400028a0
jmp 0x14003be80
lea rdx, [0x1401a3f9c]
mov ecx, 0x2728
mov r8d, 0x1bc
call fcn.140032820
lea rdx, [0x1401a3f9c]
mov ecx, 0x2728
mov r8d, 0x1bb
call fcn.140032820
nop
nop dword [rax + rax]
Function at 0x140044570
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push r13
push r14
push r15
push rbp
sub rsp, 0x858
mov rsi, r9
mov r14, qword [0x1403bc338]
mov rbp, r8
mov rbx, rdx
mov r13, rcx
test r14, r14
je 0x1400445dd
mov rdx, qword [0x1403bc340]
test rdx, rdx
je 0x1400445dd
mov rcx, r13
call fcn.140089fd0
test eax, eax
jne 0x1400445dd
mov edx, dword [0x1403bc348]
mov rax, r14
mov dword [rbx], edx
mov ecx, dword [0x1403bc34c]
mov ebx, dword [0x1403bc350]
mov dword [rbp], ecx
mov dword [rsi], ebx
add rsp, 0x858
pop rbp
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
mov rcx, r13
call fcn.140034330
mov rcx, r13
lea rdx, [rsp + 0x834]
mov qword [0x1403bc340], rax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r15d, eax
lea ecx, [r15 + 1]
add rcx, rcx
call fcn.140018240
mov r14, rax
mov rcx, r13
xor edx, edx
mov r8d, r15d
mov r9, r14
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140044752
mov rcx, r14
lea rdx, str.VarFileInfoTranslation
lea r8, [rsp + 0x838]
lea r9, [rsp + 0x848]
call sub.VERSION.dll_VerQueryValueW
mov rax, qword [rsp + 0x838]
mov r11, rsp
mov edx, 0x402
lea rcx, [rsp + 0x30]
lea r8, str.StringFileInfo_04x_04x_
movzx r10d, word [rax + 2]
movzx r9d, word [rax]
mov dword [r11 + 0x20], r10d
call fcn.140012910
mov rdx, qword [0x14030f838]
lea rcx, [rsp + 0x30]
call fcn.1400181c0
mov rcx, r14
mov rdx, rax
lea r8, [0x1403bc338]
lea r9, [rsp + 0x848]
call sub.VERSION.dll_VerQueryValueW
mov rcx, r14
lea rdx, [0x1401a4018]
lea r8, [rsp + 0x840]
lea r9, [rsp + 0x848]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400446f1
mov rcx, qword [rsp + 0x840]
mov edx, dword [rcx + 8]
mov eax, edx
shr eax, 0x10
mov dword [rbx], eax
movzx ebx, word [rcx + 0xe]
movzx edx, dl
mov dword [0x1403bc348], eax
mov dword [rbp], edx
mov dword [0x1403bc34c], edx
mov dword [rsi], ebx
mov dword [0x1403bc350], ebx
mov rdx, qword [0x1403bc338]
xor ebx, ebx
xor eax, eax
movzx ecx, word [rdx]
test ecx, ecx
je 0x14004472e
movzx ecx, word [rdx + rbx*2]
call fcn.14008aa24
mov rdx, qword [0x1403bc338]
test eax, eax
jne 0x140044720
movzx eax, word [rdx + rbx*2]
cmp eax, 0x2e
jne 0x14004474c
inc ebx
lea rax, [rbx + rbx]
movzx ecx, word [rdx + rax]
test ecx, ecx
jne 0x140044703
xor ecx, ecx
mov word [rdx + rax], cx
mov rax, qword [0x1403bc338]
add rsp, 0x858
pop rbp
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
lea rax, [rbx + rbx]
jmp 0x14004472e
xor eax, eax
add rsp, 0x858
pop rbp
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret

Function at 0x14005c120
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
call fcn.1400b2fa8
xor eax, eax
test rdi, rdi
jbe 0x14005c184
mov qword [rsp + 0x20], r12
mov r12, rdi
mov rdi, rsi
mov rsi, rbx
mov rbx, rax
mov edx, 1
lea rcx, [rsp + 0x28]
mov r8, rdx
mov r9, rsi
call fcn.1400b508c
mov edx, 1
lea rcx, [rsp + 0x28]
mov r8, rdx
mov r9, rdi
call fcn.1400ba8e4
inc rbx
cmp rbx, r12
jb 0x14005c14d
mov r12, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005c13c
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
call fcn.1400b2fa8
xor eax, eax
test rdi, rdi
jbe 0x14005c184
mov qword [rsp + 0x20], r12
mov r12, rdi
mov rdi, rsi
mov rsi, rbx
mov rbx, rax
mov edx, 1
lea rcx, [rsp + 0x28]
mov r8, rdx
mov r9, rsi
call fcn.1400b508c
mov edx, 1
lea rcx, [rsp + 0x28]
mov r8, rdx
mov r9, rdi
call fcn.1400ba8e4
inc rbx
cmp rbx, r12
jb 0x14005c14d
mov r12, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x14005d770
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
mov r12, rcx
mov r8, rdx
mov ecx, 1
mov rdx, r12
mov dword [rsp + 0x20], 0
call fcn.1400bcc58
mov qword [0x1403ce5a8], rax
test rax, rax
jle 0x14005d81c
imul edx, dword [0x1403ce898], 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x14005d7d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edx, 0x277c
mov r8, r12
mov r9d, eax
mov dword [rsp + 0x20], eax
call fcn.14003b7f0
jmp 0x14005d7fb
test eax, eax
jne 0x14005d7f4
mov rdi, qword [0x1403ce5a8]
mov rcx, rdi
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [rsp + 0x20]
jmp 0x14005d806
cmp eax, 0x102
je 0x14005d82f
mov esi, dword [rsp + 0x20]
mov rdi, qword [0x1403ce5a8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1403ce5a8], 0
jmp 0x14005d824
je 0x14005d889
mov esi, dword [rax]
mov dword [rsp + 0x20], esi
mov eax, esi
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
xor ecx, ecx
mov edx, 0x277b
mov r8, r12
mov r9d, dword [0x1403ce898]
call fcn.14003b7f0
mov esi, 0x2a
mov rdi, qword [0x1403ce5a8]
mov rcx, rdi
mov edx, esi
mov dword [rsp + 0x20], 0x2a
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14005d806
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edx, 0x277d
mov r8, r12
mov r9d, eax
mov dword [rsp + 0x20], eax
call fcn.14003b7f0
jmp 0x14005d7fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edx, 0x277e
mov r8, r12
mov r9d, eax
mov dword [rsp + 0x20], eax
call fcn.14003b7f0
mov esi, dword [rsp + 0x20]
jmp 0x14005d824
Function at 0x140063940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r8, rdx
test r8, r8
je 0x140063b14
mov rdx, rcx
mov r9, rax
and rdx, 0xfff
and r9, 0xfff
neg edx
neg r9d
add edx, 0x1000
add r9d, 0x1000
shr edx, 4
shr r9d, 4
je 0x140063a5d
test edx, edx
je 0x140063a4d
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
movdqu xmm2, xmmword [rax]
movdqu xmm3, xmmword [rcx]
movdqu xmm0, xmmword [section._RODATA__17]
movdqa xmm1, xmm2
movdqu xmm4, xmmword [section._RODATA__18]
pcmpgtb xmm1, xmm0
pcmpgtb xmm4, xmm2
movdqu xmm5, xmmword [section._RODATA__16]
pand xmm1, xmm4
pand xmm1, xmm5
pxor xmm0, xmm0
movdqu xmm4, xmmword [section._RODATA__17]
paddb xmm2, xmm1
movdqu xmm5, xmmword [section._RODATA__18]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm4
pcmpgtb xmm5, xmm3
movdqu xmm4, xmmword [section._RODATA__16]
pand xmm1, xmm5
pand xmm1, xmm4
pcmpeqb xmm0, xmm2
paddb xmm3, xmm1
pcmpeqb xmm2, xmm3
pmovmskb r10d, xmm2
xor r10d, 0xffff
jne 0x140063b1b
pmovmskb ebp, xmm0
test ebp, ebp
jne 0x140063b94
add r8, 0xfffffffffffffff0
add rax, 0x10
add rcx, 0x10
test r8d, r8d
jle 0x140063b94
dec edx
dec r9d
je 0x140063a67
test edx, edx
jne 0x140063995
jmp 0x140063a59
nop
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
xor ebp, ebp
jmp 0x140063a7b
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
mov ebp, eax
and ebp, 0xfff
neg ebp
add ebp, 0x1000
test edx, edx
jne 0x140063a96
mov r9d, ecx
and r9d, 0xfff
neg r9d
add r9d, 0x1000
cmp r9d, ebp
cmova ebp, r9d
mov r9d, ebp
cmp r8, r9
jae 0x140063aa4
movsxd r9, r8d
mov ebp, r8d
sub r8, r9
movzx r10d, byte [rax]
lea r9d, [r10 - 0x41]
cmp r9d, 0x19
lea r11d, [r10 + 0x20]
movzx r9d, byte [rcx]
cmovbe r10d, r11d
lea r15d, [r9 - 0x41]
cmp r15d, 0x19
lea r11d, [r9 + 0x20]
cmovbe r9d, r11d
cmp r10d, r9d
jne 0x140063ba5
test r10d, r10d
je 0x140063b94
inc rax
inc rcx
dec ebp
jne 0x140063aa7
test r8, r8
je 0x140063b94
mov r9, rax
and r9, 0xfff
neg r9d
add r9d, 0x1000
shr r9d, 4
je 0x140063a67
jmp 0x140063b74
xor eax, eax
add rsp, 0x38
ret
bsf r9d, r10d
mov edx, r9d
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
cmp rdx, r8
jae 0x140063b14
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140063b44
bsf r8d, r8d
cmp r8d, r9d
jb 0x140063b14
movzx eax, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rdx, rcx
and rdx, 0xfff
neg edx
add edx, 0x1000
shr edx, 4
je 0x140063a59
jmp 0x140063995
mov r15, qword [rsp + 0x20]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
sub r10d, r9d
mov r15, qword [rsp + 0x20]
mov eax, r10d
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x14006398b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r8, rdx
test r8, r8
je 0x140063b14
mov rdx, rcx
mov r9, rax
and rdx, 0xfff
and r9, 0xfff
neg edx
neg r9d
add edx, 0x1000
add r9d, 0x1000
shr edx, 4
shr r9d, 4
je 0x140063a5d
test edx, edx
je 0x140063a4d
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
movdqu xmm2, xmmword [rax]
movdqu xmm3, xmmword [rcx]
movdqu xmm0, xmmword [section._RODATA__17]
movdqa xmm1, xmm2
movdqu xmm4, xmmword [section._RODATA__18]
pcmpgtb xmm1, xmm0
pcmpgtb xmm4, xmm2
movdqu xmm5, xmmword [section._RODATA__16]
pand xmm1, xmm4
pand xmm1, xmm5
pxor xmm0, xmm0
movdqu xmm4, xmmword [section._RODATA__17]
paddb xmm2, xmm1
movdqu xmm5, xmmword [section._RODATA__18]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm4
pcmpgtb xmm5, xmm3
movdqu xmm4, xmmword [section._RODATA__16]
pand xmm1, xmm5
pand xmm1, xmm4
pcmpeqb xmm0, xmm2
paddb xmm3, xmm1
pcmpeqb xmm2, xmm3
pmovmskb r10d, xmm2
xor r10d, 0xffff
jne 0x140063b1b
pmovmskb ebp, xmm0
test ebp, ebp
jne 0x140063b94
add r8, 0xfffffffffffffff0
add rax, 0x10
add rcx, 0x10
test r8d, r8d
jle 0x140063b94
dec edx
dec r9d
je 0x140063a67
test edx, edx
jne 0x140063995
jmp 0x140063a59
nop
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
xor ebp, ebp
jmp 0x140063a7b
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
mov ebp, eax
and ebp, 0xfff
neg ebp
add ebp, 0x1000
test edx, edx
jne 0x140063a96
mov r9d, ecx
and r9d, 0xfff
neg r9d
add r9d, 0x1000
cmp r9d, ebp
cmova ebp, r9d
mov r9d, ebp
cmp r8, r9
jae 0x140063aa4
movsxd r9, r8d
mov ebp, r8d
sub r8, r9
movzx r10d, byte [rax]
lea r9d, [r10 - 0x41]
cmp r9d, 0x19
lea r11d, [r10 + 0x20]
movzx r9d, byte [rcx]
cmovbe r10d, r11d
lea r15d, [r9 - 0x41]
cmp r15d, 0x19
lea r11d, [r9 + 0x20]
cmovbe r9d, r11d
cmp r10d, r9d
jne 0x140063ba5
test r10d, r10d
je 0x140063b94
inc rax
inc rcx
dec ebp
jne 0x140063aa7
test r8, r8
je 0x140063b94
mov r9, rax
and r9, 0xfff
neg r9d
add r9d, 0x1000
shr r9d, 4
je 0x140063a67
jmp 0x140063b74
xor eax, eax
add rsp, 0x38
ret
bsf r9d, r10d
mov edx, r9d
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
cmp rdx, r8
jae 0x140063b14
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140063b44
bsf r8d, r8d
cmp r8d, r9d
jb 0x140063b14
movzx eax, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rdx, rcx
and rdx, 0xfff
neg edx
add edx, 0x1000
shr edx, 4
je 0x140063a59
jmp 0x140063995
mov r15, qword [rsp + 0x20]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
sub r10d, r9d
mov r15, qword [rsp + 0x20]
mov eax, r10d
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x140063a4d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r8, rdx
test r8, r8
je 0x140063b14
mov rdx, rcx
mov r9, rax
and rdx, 0xfff
and r9, 0xfff
neg edx
neg r9d
add edx, 0x1000
add r9d, 0x1000
shr edx, 4
shr r9d, 4
je 0x140063a5d
test edx, edx
je 0x140063a4d
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
movdqu xmm2, xmmword [rax]
movdqu xmm3, xmmword [rcx]
movdqu xmm0, xmmword [section._RODATA__17]
movdqa xmm1, xmm2
movdqu xmm4, xmmword [section._RODATA__18]
pcmpgtb xmm1, xmm0
pcmpgtb xmm4, xmm2
movdqu xmm5, xmmword [section._RODATA__16]
pand xmm1, xmm4
pand xmm1, xmm5
pxor xmm0, xmm0
movdqu xmm4, xmmword [section._RODATA__17]
paddb xmm2, xmm1
movdqu xmm5, xmmword [section._RODATA__18]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm4
pcmpgtb xmm5, xmm3
movdqu xmm4, xmmword [section._RODATA__16]
pand xmm1, xmm5
pand xmm1, xmm4
pcmpeqb xmm0, xmm2
paddb xmm3, xmm1
pcmpeqb xmm2, xmm3
pmovmskb r10d, xmm2
xor r10d, 0xffff
jne 0x140063b1b
pmovmskb ebp, xmm0
test ebp, ebp
jne 0x140063b94
add r8, 0xfffffffffffffff0
add rax, 0x10
add rcx, 0x10
test r8d, r8d
jle 0x140063b94
dec edx
dec r9d
je 0x140063a67
test edx, edx
jne 0x140063995
jmp 0x140063a59
nop
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
xor ebp, ebp
jmp 0x140063a7b
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
mov ebp, eax
and ebp, 0xfff
neg ebp
add ebp, 0x1000
test edx, edx
jne 0x140063a96
mov r9d, ecx
and r9d, 0xfff
neg r9d
add r9d, 0x1000
cmp r9d, ebp
cmova ebp, r9d
mov r9d, ebp
cmp r8, r9
jae 0x140063aa4
movsxd r9, r8d
mov ebp, r8d
sub r8, r9
movzx r10d, byte [rax]
lea r9d, [r10 - 0x41]
cmp r9d, 0x19
lea r11d, [r10 + 0x20]
movzx r9d, byte [rcx]
cmovbe r10d, r11d
lea r15d, [r9 - 0x41]
cmp r15d, 0x19
lea r11d, [r9 + 0x20]
cmovbe r9d, r11d
cmp r10d, r9d
jne 0x140063ba5
test r10d, r10d
je 0x140063b94
inc rax
inc rcx
dec ebp
jne 0x140063aa7
test r8, r8
je 0x140063b94
mov r9, rax
and r9, 0xfff
neg r9d
add r9d, 0x1000
shr r9d, 4
je 0x140063a67
jmp 0x140063b74
xor eax, eax
add rsp, 0x38
ret
bsf r9d, r10d
mov edx, r9d
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
cmp rdx, r8
jae 0x140063b14
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140063b44
bsf r8d, r8d
cmp r8d, r9d
jb 0x140063b14
movzx eax, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rdx, rcx
and rdx, 0xfff
neg edx
add edx, 0x1000
shr edx, 4
je 0x140063a59
jmp 0x140063995
mov r15, qword [rsp + 0x20]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
sub r10d, r9d
mov r15, qword [rsp + 0x20]
mov eax, r10d
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret