joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4b20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400c4b62
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400c4ba9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400c4c02
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400c4bc0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400c4c43
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400d8f42]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400d8f43]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400c4c10
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400c5bf8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c5c42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c5c42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c5c42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c5c42
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c5c42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c5c44
xor al, al
add rsp, 0x28
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403b26d5

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b42b1

Function at 0x1400f4869
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
cdq
bswap edx
movsx edx, r9w
lea edx, [r8 + 2]
jmp 0x140231f78
jmp 0x1404b5cf0
mov qword [rsp + 8], rbx
shr bl, cl
btr bx, bp
or bx, bp
mov dword [rsp + 0x18], r8d
movsx ebx, bx
mov dword [rsp + 0x10], edx
push rbp
not bpl
btc bx, 0xdf
cmp r8w, r13w
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jmp 0x1404b5d28
jne 0x1404b5db5
sub ecx, ecx
jmp 0x1404b5d35
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b5d43
je 0x1404b5db5
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1404b5db5
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp r8w, 0x46f7
jmp 0x1404b5d69
cmp dword [rcx], 0x4550
jmp 0x1404b5d74
jne 0x1404b5db5
mov eax, 0x20b
stc
cmp word [rcx + 0x18], ax
jmp 0x1404b5d89
jne 0x1404b5db5
cmp dword [rcx + 0x84], 0xe
jmp 0x1404b5d9b
jbe 0x1404b5db5
cmp dword [rcx + 0xf8], 0
je 0x1404b5db5
mov ecx, ebx
call fcn.1404b5bb1
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov r8w, r10w
movsx rcx, si
mov qword [rbp - 0x20], rax
setg cl
cdqe
movsxd r8, ebp
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov ch, 0xd5
movsx rcx, ax
setns dh
mov qword [rbp - 0x18], rax
movsx dx, r10b
lea r8, [rbp - 0x20]
jmp 0x1404b5df6
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
bswap rdx
lea rdx, [rbp - 0x28]
mov eax, 2
movsx rcx, dx
lea rcx, [rbp - 0x30]
jmp 0x1404b5e17
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
jmp 0x1404b5e22
call fcn.1404b5fed
cmp dword [rbp + 0x20], 0
jmp 0x1404b5e30
je 0x1404b5e4a
mov rbx, qword [rsp + 0x60]
mov ebp, r15d
add rsp, 0x50
movsx rbp, sp
bswap ebp
pop rbp
ret
mov ecx, ebx
jmp 0x1404b5e51
call fcn.1404b5c63
int3
Function at 0x1401ad944
Capabilities:
Parse pe header

Disassembly:
ret
jne 0x14023c0cc
xor eax, eax
mov ecx, 0x20b
shr al, cl
cmp word [rdx + 0x18], cx
sete al
ret
mov eax, 0x5a4d
cmp dx, di
cmp word [rcx], ax
jmp 0x14025bec1
sub eax, eax
jmp 0x1400fdde1
jne 0x14023c0cc
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
test dil, 0x37
cmp esp, r14d
cmp dword [rdx], 0x4550
jmp 0x140109780

Function at 0x1401d0a58
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14020ab0c
jmp 0x14044ac5f
push rsi
shr al, cl
rol sil, 0xa6
push rdi
cwde
xadd si, ax
sub rsp, 0x28
jmp 0x14044ac7b
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
xor eax, ecx
mov rax, qword [rcx]
xor edx, edx
stc
cmc
xor r8d, r8d
jmp 0x14044ac93
call qword [rax + 0x188]
mov edi, eax
movzx ecx, r12w
xchg cl, cl
lea rcx, [rsi + 0x30]
jmp 0x14044acaa
call fcn.14045eb3d
test edi, edi
jmp 0x14044acb6
je 0x14044acfa
cmp edi, 0x8899000c
jne 0x14044ad24
mov rcx, rsi
inc rdi
rcl sil, cl
test r9b, r10b
add rsp, 0x28
movzx si, dil
movsx rsi, bp
pop rdi
movzx rsi, ax
movsx rsi, cx
movsx si, dil
pop rsi
jmp 0x14044acf5
jmp fcn.14044a937
nop
movsx di, sil
add dil, 0x47
add rsp, 0x28
movsx si, bpl
cmovo si, cx
pop rdi
xchg sil, sil
bswap si
movsx si, r11b
pop rsi
jmp 0x14044ad23
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
bswap di
mov dl, 3
mov r9d, 0x54
adc sil, 0x5d
ror rdi, cl
test esp, 0x54891fb0
add rsp, 0x28
pop rdi
movsx si, sil
cmovs si, di
pop rsi
jmp 0x14044ad5c
jmp fcn.1403b48bb

Function at 0x1401f6e54
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
movzx r11d, bp
xor r11b, r11b
xor r9d, r9d
sbb al, r10b
or al, dil
add r8, rcx
add r11b, r9b
cmp spl, 0xe5
mov r10, rdx
sar r11b, cl
movzx eax, word [r8 + 0x14]
movsx r11, r11w
ror r11w, cl
shr r11b, 0xc3
movzx r11d, word [r8 + 6]
test spl, al
add rax, 0x18
cmp esi, edi
test cx, 0x7af5
stc
add rax, r8
test r11d, r11d
je 0x1401faf1a
mov edx, dword [rax + 0xc]
cmp dil, spl
cmp r10, rdx
jb 0x14021d9d2
mov ecx, dword [rax + 8]
jmp 0x14027cb37
jb 0x1401f6ea9
xor eax, eax
jmp 0x14026b2f5
jb 0x14026b2f5
inc r9d
test r11b, 0xd3
add rax, 0x28
test rbx, r9
cmp r9d, r11d
jmp 0x1401faf14
ret
add ecx, edx
test r9, rax
cmp r10, rcx
jmp 0x14021d9cc
Function at 0x140214a55
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx r8d, byte [rcx + 1]
inc rcx
cmp ah, dh
test byte [rax + r8*2], 4
jmp 0x14017c090
jne 0x1401676ed
movzx r8d, byte [rcx + 2]
cwde
cbw
mov al, dil
mov rax, qword [r9 + 0xf8]
movsxd rdx, ecx
movsx rdx, r10w
lea rdx, [rcx + 2]
jmp 0x1401832d0
jne 0x14011b5d2
movzx eax, r8b
cmp byte [rax + rdx], 0x78
jmp 0x1401676dc
cmovne rdx, rcx
and cx, 0x5d59
neg ch
mov rcx, qword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
shl ecx, cl
sar cx, 0x88
lea rax, [rdx + 1]
or cx, cx
nop dword [rax]
and dh, 0xd
btc cx, 0xa
movzx ecx, byte [rax]
rol dh, 0x24
bsf edx, esp
movzx edx, r8b
test cl, 0xf9
stc
cmp r10w, bp
mov byte [rax], r8b
xor r8, 0x3ba34f4b
bsf r8d, ebp
and r8w, dx
lea rax, [rax + 1]
bsf r8d, esi
movzx r8d, cl
test r15b, r8b
cmp ax, 0x575a
test dl, dl
jmp 0x140292d5c
mov r9, qword [rdx]
bts r8d, ecx
movzx r8d, byte [rcx]
shl dl, cl
and dh, 0xe6
mov rdx, qword [r9 + 0x110]
clc
cmp byte [r8 + rdx], 0x65
je 0x14017c096
mov rax, qword [r9]
nop dword [rax + rax]
cmovne r8w, si
jmp 0x14011b5d2
jne 0x1401832ff
ret

Function at 0x14024492d
Capabilities:
Access peb ldr_data

Disassembly:
cmovb r8, rdx
cmp r15b, r10b
test r15, rsp
test ax, ax
jmp 0x14024ee98
je 0x14010c30d
mov word [r10], 0
stc
rol r8b, cl
movzx eax, word [0x1400b8f10]
dec r8b
cmp rdx, 0x104
movsx r8, r8w
movzx r8, bp
mov r8b, 0xc2
mov r8d, 0x104
jmp 0x1400e8dc0
test r8, r8
jmp 0x14010c2fd
jne 0x14024eeaf
sub r8, rdx
cmp bpl, 0x6b
jmp 0x14021b81c
je 0x14018091e
mov word [rcx], ax
inc al
add rcx, 2
cbw
bswap eax
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x140266d13
test r11w, r11w
jmp 0x1401bed0f
inc rax
jmp 0x140272159
je 0x14026ddd7
mov word [rcx], 0
jmp 0x14026ddd7
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
btr r9d, 0xa
movzx r11d, r13w
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
shld r9d, ebp, 9
movsx r11, r8w
rcr r11w, cl
cmp r8, rdx
movsxd r11, eax
bswap r10w
movsx r11d, si
cmovae r8, rdx
movzx r9w, cl
bts r10w, r14w
cmp r10b, al
mov r9, qword [rax + 0x60]
sub r10d, 0x251d0989
rcl r10, 0x6c
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
jmp 0x14015e0be
je 0x14010c303
mov word [r10], r11w
cmp sp, 0x759d
add r10, 2
bswap r11d
not r11d
movzx r11d, r12w
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14017e891
je 0x14011f68f
sub eax, eax
nop word [rax + rax]
stc
cmp r8, rax
jmp 0x1401b3e00
jne 0x1401bed1e
sub r8, rax
jmp 0x14011f68f
jmp 0x14024ee9e
cmovb r8, rdx
jmp 0x1401f0a71
test r8, r8
jmp 0x140180918
test ax, ax
jmp 0x14012d89b
movzx eax, word [0x1400b8f10]
test r11, r14
clc
test ax, ax
je 0x1401b391f
cmp rdx, 0x104
movzx r8d, si
xchg r8w, r8w
mov r8b, spl
mov r8d, 0x104
jmp 0x1401f1b84
je 0x14021b81c
sub edx, edx
movzx r9d, r11w
rol r9, 0x40
lea r9, [0x1400b8f10]
cmp r8, rdx
jmp 0x1401551f7
inc rdx
test dil, 0xf6
jmp 0x140227860
ret
test r11w, r11w
jmp 0x1401c23fe

Function at 0x140247692
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
cmc
sub edx, edx
jmp 0x1404b5cf0
Function at 0x1403caa40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
movzx ax, r15b
push rdi
rcl dil, cl
push rbx
bts rsi, r14
sub rsp, 0x20
movzx esi, r10w
sub sil, sil
mov rsi, rcx
lea rax, [0x1400be020]
mov qword [rcx], rax
mov rdi, qword [rcx + 0x78]
clc
stc
test rdi, rdi
jmp 0x1403caa75
je 0x1403caa9d
mov rcx, rdi
call fcn.14022770a
mov rcx, rdi
jmp 0x1403caa8b
call fcn.1400e9ae4
mov qword [rsi + 0x78], 0
test bpl, 7
nop
mov rax, qword [rsi + 0x70]
cmp rax, 8
jmp 0x1403caaaa
jb 0x1403cab18
mov rcx, qword [rsi + 0x58]
lea rdx, [rax + rax]
test r11b, r11b
add rdx, 2
test rcx, r10
cmp rdx, 0x1000
jmp 0x1403caace
jb 0x1403cab13
mov rbx, qword [rcx - 8]
jmp 0x1403caadd
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1403cac8c
add rax, rax
or rdx, 0x111d497d
movsxd rdx, ebp
xor cx, 0x2322
add rax, 0x29
mov dl, bpl
cdq
cwd
mov rdx, rax
movsxd rcx, r14d
mov rcx, rbx
call fcn.1401a86e2
movaps xmm0, xmmword [0x1400bd3f0]
sal ebx, cl
sal rbx, 0xb2
movzx di, r15b
movups xmmword [rsi + 0x68], xmm0
bt rdi, 0x19
bt di, r11w
mov word [rsi + 0x58], 0
cmovle eax, edx
rcr dil, cl
lea rax, [0x1400bdb70]
rcr bh, 0x22
movzx rdi, r11w
shld edi, esp, 0xc3
mov qword [rsi], rax
clc
sar dil, cl
test r10d, 0x66c43eaf
mov rdi, qword [rsi + 0x40]
movsx ebx, r13w
mov rbx, qword [rsi + 0x48]
cmp rax, 0x2b0f74b5
cmp rdi, rbx
jne 0x1403cab99
jmp 0x1403cabe4
add rdi, 8
cmp bl, ch
cmp rdi, rbx
jmp 0x1403cab93
je 0x1403cabc4
mov rcx, qword [rdi]
test rcx, rcx
jmp 0x1403caba4
je 0x1403cab85
mov rax, qword [rcx]
not dl
mov edx, 1
jmp 0x1403cabb9
call qword [rax + 0xb8]
jmp 0x1403cab85
mov rdi, qword [rsi + 0x40]
stc
cmp rdi, qword [rsi + 0x48]
jmp 0x1403cabd2
je 0x1403cabe4
mov qword [rsi + 0x48], rdi
test r15b, r15b
jmp 0x1403cabe4
test rdi, rdi
jmp 0x1403cabec
je 0x1403cac70
mov rdx, qword [rsi + 0x50]
cmp ax, 0x5446
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403cac09
jb 0x1403cac4d
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
test r9b, r8b
cmp sp, ax
sub rdi, rax
clc
stc
cmp r12b, 0x2c
cmp rdi, 0x20
jmp 0x1403cac2f
jae 0x1403cac8c
add rdx, 0x27
not dil
btr ecx, r12d
bts cx, r14w
mov rdi, rax
jmp 0x1403cac4d
add rsi, 0x40
mov rcx, rdi
call fcn.1401a86e2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
inc bx
mov qword [rsi + 0x10], 0
shl dil, cl
sbb sil, r14b
add rsp, 0x20
movsx rbx, r14w
pop rbx
bswap rdi
movzx si, dl
pop rdi
setns sil
pop rsi
jmp 0x1403cac8b
ret
call fcn.1404bae88
int3
Function at 0x1403cf651
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
bt r8w, 0x35
push rdi
rol r8b, cl
sub rsp, 0x78
mov r8, rdx
and sil, 0x1a
rcr si, 0x11
shld rsi, r10, 0x38
mov rsi, rcx
cmp si, r9w
jmp 0x1403cf67c
xor edx, edx
call fcn.14043cc91
lea rax, [0x1400be640]
jmp 0x1403cf68f
mov qword [rsi], rax
xorps xmm0, xmm0
movups xmmword [rsi + 0x50], xmm0
xchg cx, cx
movsx rcx, r15w
movzx ecx, r14w
mov qword [rsi + 0x60], 0
mov ecx, 0x4a142041
mov qword [rsi + 0xa8], 0
movzx rcx, bp
cmovs cx, r9w
bswap cx
mov ecx, 0x18
jmp 0x1403cf6d2
call fcn.14044cac1
mov rdi, rax
rdtsc
movsx edx, r12w
movabs rax, 0x699f8472d420abd6
bswap rcx
movsxd rdx, r15d
mov qword [rsp + 0x30], rax
cwd
lahf
cqo
movabs rax, 0x111de33110e68edf
movzx edx, sp
setns ch
mov qword [rsp + 0x38], rax
sete dl
rdtsc
movzx edx, r13w
movabs rax, 0x4764a407847292c7
cwd
mov cl, bpl
mov qword [rsp + 0x40], rax
jmp 0x1403cf738
movabs rcx, 0x199eee0663371024
movsxd rdx, r11d
mov qword [rsp + 0x48], rcx
cmove dx, si
setg dl
bswap edx
movabs rdx, 0x69f08415d445ab85
jmp 0x1403cf762
mov qword [rsp + 0x50], rdx
movsxd rdx, edi
movsx rdx, cx
mov dx, 0x45e6
movabs rdx, 0x1154e36410c68eba
mov qword [rsp + 0x58], rdx
jmp 0x1403cf786
mov qword [rsp + 0x60], rax
not rax
cbw
mov qword [rsp + 0x68], rcx
mov ax, r11w
lea rax, [rsp + 0x50]
jmp 0x1403cf7a3
movaps xmm0, xmmword [rsp + 0x30]
jmp 0x1403cf7ad
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
jmp 0x1403cf7ba
movaps xmm0, xmmword [rsp + 0x40]
jmp 0x1403cf7c4
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
bswap dx
movsx ecx, cx
mov edx, 0x11642e44
mov dword [rsp + 0x20], 0
movzx rdx, sp
setns r9b
lea rdx, [rsp + 0x30]
xchg r9b, cl
jmp 0x1403cf7f5
movss xmm2, dword [0x1400bd7b0]
mov r9, 0x5c6a6b54
mov rcx, rdi
mov r9d, 0x190
jmp 0x1403cf812
call fcn.14044a35e
mov qword [rsi + 0x48], rdi
sbb cl, r11b
not cl
and rcx, rbp
mov dword [rsi + 0x68], 0xffffffff
add cl, r10b
movzx cx, r14b
movzx ecx, r8w
mov rcx, qword [rsi + 0xa8]
clc
stc
test rcx, rcx
jmp 0x1403cf847
je 0x1403cf870
lea rax, [rsi + 0x70]
not dl
ror dl, cl
cmp rcx, rax
not dl
setne dl
nop
mov rax, qword [rcx]
call qword [rax + 0x20]
mov qword [rsi + 0xa8], 0
mov rax, rsi
sub sil, 0xa8
rcr dil, cl
add rsp, 0x78
movzx esi, r15w
pop rdi
bswap esi
mov sil, 0x86
movsx rsi, di
pop rsi
ret
Function at 0x1403cfe8f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
adc sil, 0x9a
push rbx
cbw
rol si, cl
sub rsp, 0x28
neg ax
rcl si, cl
or ax, r11w
mov rsi, rcx
shl al, 0x44
neg al
test r12, r10
lea rax, [0x1400be400]
cmp r12d, r10d
test r14b, cl
mov qword [rcx], rax
cmc
test bl, r11b
mov rcx, qword [rcx + 0xa8]
test bl, r9b
jmp 0x1403cfedc
test rcx, rcx
jmp 0x1403cfee4
je 0x1403cff13
lea rax, [rsi + 0x70]
rcr dl, cl
xor dl, r11b
cmp rcx, rax
mov dl, 0x3b
cdqe
setne dl
mov rax, qword [rcx]
jmp 0x1403cff05
call qword [rax + 0x20]
mov qword [rsi + 0xa8], 0
mov rdi, qword [rsi + 0x58]
cmc
test rdi, rdi
jmp 0x1403cff20
je 0x1403cfffa
lea r14, [rsi + 0x58]
mov rbx, qword [rsi + 0x60]
cmp r13d, r8d
cmp rdi, rbx
jmp 0x1403cff39
je 0x1403cff77
nop word cs:[rax + rax]
cmovnp ecx, edx
mov rcx, rdi
jmp 0x1403cff57
call fcn.1403d0151
add rdi, 0x60
jmp 0x1403cff66
cmp rdi, rbx
jmp 0x1403cff6e
jne 0x1403cff4f
mov rdi, qword [r14]
mov rdx, qword [rsi + 0x68]
jmp 0x1403cff80
sub rdx, rdi
cmp rdx, 0x1000
jmp 0x1403cff8f
jb 0x1403cffc9
mov rax, qword [rdi - 8]
stc
clc
add rdi, 0xfffffffffffffff8
cmc
clc
sub rdi, rax
cmp bl, 0x37
cmp rdi, 0x20
jmp 0x1403cffb0
jae 0x1403d0146
add rdx, 0x27
jmp 0x1403cffc6
mov rdi, rax
mov rcx, rdi
jmp 0x1403cffd1
call fcn.1401a86e2
xorps xmm0, xmm0
movups xmmword [r14], xmm0
ror dil, cl
sub dil, bl
or ax, r15w
mov qword [r14 + 0x10], 0
mov eax, r12d
bts rdi, r14
or ax, r9w
lea rax, [0x1400bdb70]
mov qword [rsi], rax
or dil, bl
mov rdi, qword [rsi + 0x40]
sal rbx, 0x50
shl ebx, 0x80
sub bl, 0x17
mov rbx, qword [rsi + 0x48]
test bl, r15b
cmp rdi, rbx
jne 0x1403d003c
jmp 0x1403d0092
add rdi, 8
cmp rdi, rbx
jmp 0x1403d0036
je 0x1403d0070
mov rcx, qword [rdi]
jmp 0x1403d0046
test rcx, rcx
jmp 0x1403d004e
je 0x1403d002a
mov rax, qword [rcx]
movzx edx, r14w
movzx dx, r10b
mov edx, 1
call qword [rax + 0xb8]
jmp 0x1403d002a
mov rdi, qword [rsi + 0x40]
jmp 0x1403d007b
cmp rdi, qword [rsi + 0x48]
jmp 0x1403d0084
je 0x1403d0092
mov qword [rsi + 0x48], rdi
test bpl, bl
cmc
test rdi, rdi
jmp 0x1403d009a
je 0x1403d0121
mov rdx, qword [rsi + 0x50]
jmp 0x1403d00a9
sub rdx, rdi
cmp r12b, 0x22
cmc
stc
cmp rdx, 0x1000
jmp 0x1403d00be
jb 0x1403d00f3
mov rax, qword [rdi - 8]
test ebx, r15d
add rdi, 0xfffffffffffffff8
cmc
sub rdi, rax
cmp rdi, 0x20
jae 0x1403d0146
add rdx, 0x27
shld rdi, r8, 0x23
rcr dil, 0x9f
and dil, 0xa6
mov rdi, rax
not ch
add rsi, 0x40
movsxd rcx, ecx
mov rcx, rdi
jmp 0x1403d0102
call fcn.1401a86e2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
rcl bl, cl
bsf r14w, di
mov qword [rsi + 0x10], 0
jmp 0x1403d0121
add rsp, 0x28
movsx di, r10b
movsx rdi, r8w
movzx di, r8b
pop rbx
pop rdi
movsx r14w, sil
pop rsi
cmove r14, rbp
movzx r14, r15w
pop r14
ret
call fcn.1404bae88
int3
Function at 0x1403d232d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
sar r15b, 0x52
ror r15b, cl
movsx r14w, sil
push r13
rcr r15d, 0x9a
sal r15, cl
bswap r14w
push r12
sub r12w, si
push rsi
movzx r14w, dil
ror r12b, cl
push rdi
mov sil, 0xc1
xor si, r8w
push rbx
seto r13b
sub rsp, 0x30
and r15w, 0x5148
movaps xmmword [rsp + 0x20], xmm6
bsr r12w, r11w
xadd r13b, r14b
mov r15, r9
cmove r13, rsp
movzx r14w, r14b
mov r12, r8
sar r13b, cl
bts r13w, di
mov r14, rdx
mov r13, rcx
mov rsi, qword [rcx]
cmp bpl, 0x21
cmc
jmp 0x1403d23a8
test rsi, rsi
jmp 0x1403d23b0
je 0x1403d24e4
mov rbx, qword [r13 + 8]
stc
cmp rsi, rbx
je 0x1403d2487
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403d23d0
jmp 0x1403d23fd
call fcn.1401a86e2
movups xmmword [rsi + 0x10], xmm6
test dil, r10b
cmp r9d, edx
mov word [rsi], 0
cmp bp, sp
add rsi, 0x20
cmp r14b, 0x89
cmp rsi, rbx
je 0x1403d247f
mov rax, qword [rsi + 0x18]
cmp rax, 8
jmp 0x1403d240a
jb 0x1403d23da
mov rcx, qword [rsi]
bsr dx, di
ror dh, 0x6e
lea rdx, [rax + rax]
cmp r11, rsp
add rdx, 2
cmp rdx, 0x1000
jmp 0x1403d2431
jb 0x1403d23d5
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp r13w, 0x2e9d
stc
sub rcx, rdi
clc
test r14w, r9w
cmp rcx, 0x20
jae 0x1403d2582
lea rax, [rax + rax]
add rax, 0x29
bswap rcx
cdq
movzx dx, r13b
mov rdx, rax
movzx rcx, bx
bswap ecx
mov rcx, rdi
jmp 0x1403d247a
jmp 0x1403d23d5
mov rsi, qword [r13]
movsx edx, r9w
mov rdx, qword [r13 + 0x10]
jmp 0x1403d2491
sub rdx, rsi
jmp 0x1403d2499
cmp rdx, 0x1000
jmp 0x1403d24a5
jb 0x1403d24d7
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
clc
test bx, 0x54de
sub rsi, rax
jmp 0x1403d24c1
cmp rsi, 0x20
jmp 0x1403d24ca
jae 0x1403d2582
add rdx, 0x27
mov rsi, rax
mov rcx, rsi
jmp 0x1403d24df
call fcn.1401a86e2
mov qword [r13], r14
shl r12, 5
btc bx, 0x96
add r12, r14
stc
bswap ebx
mov qword [r13 + 8], r12
shl r15, 5
movzx edi, bx
shld r12w, ax, 0x63
btc di, ax
add r15, r14
movsx esi, dx
movsx rbx, bx
btc rbx, 0x1c
mov qword [r13 + 0x10], r15
movzx di, bpl
btr esi, 0xe
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
movzx r15, r9w
movzx r14w, sil
pop rbx
movsx r12w, r12b
xchg r15b, dil
pop rdi
movsx r12, bx
xchg r14w, si
movzx rsi, dx
pop rsi
xchg r12d, r12d
mov r15b, 0xa4
movzx r15w, r14b
pop r12
movsx r14w, r12b
movzx r14w, r10b
movsxd r13, r13d
pop r13
movsxd r14, r10d
movsx r14, bx
pop r14
setno r15b
pop r15
jmp 0x1403d2581
ret
call fcn.1404bae88
int3
Function at 0x1403f6944
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
movsx r14, sp
push rdi
push rbx
sal r14d, 0x79
bsf r14w, r10w
ror al, 0x40
sub rsp, 0x28
bswap r14w
mov rbx, rdx
and r14b, spl
mov r14, rcx
bswap ax
cmc
lea rsi, [rdx + r8]
sal ax, cl
clc
mov eax, dword [rcx + 8]
clc
cmp sp, 0x5b95
test al, 2
jmp 0x1403f6986
jne 0x1403f6a62
mov dil, 1
test r12, 0x192b5cfb
cmp dx, di
test al, 4
jmp 0x1403f69a0
je 0x1403f6bb1
lea rax, [rbx + 1]
cmp al, r13b
stc
test r10, 0x2a205cfe
cmp rax, rsi
jmp 0x1403f69bd
ja 0x1403f6ba2
mov byte [rbx], 0x12
or rcx, rsp
movzx ecx, r13w
mov rcx, qword [r14 + 0x40]
stc
cmp rcx, 0x80
jmp 0x1403f69de
jb 0x1403f6b55
nop word cs:[rax + rax]
sub edx, r9d
lea rdx, [rax + 1]
test bh, 0x36
cmp dx, 0x7449
stc
cmp rdx, rsi
jmp 0x1403f6a06
ja 0x1403f6ba2
mov ebx, ecx
test r11, 0x5252443a
cmp bpl, 0x7c
cmc
or bl, 0x80
stc
mov byte [rax], bl
movzx ax, ch
bsr rax, rsi
dec ax
mov rbx, rcx
clc
rol al, 0x97
movzx eax, r10w
shr rbx, 7
mov rax, rdx
test r14b, r8b
cmp rcx, 0x3fff
movsx ecx, bx
jmp 0x1403f6a4f
mov rcx, rbx
jmp 0x1403f6a57
ja 0x1403f69f1
jmp 0x1403f6b6a
test r8, r8
jle 0x1403f6ba2
mov byte [rbx], 0xa
seto ch
inc rbx
mov rcx, qword [r14 + 0x20]
cmp rcx, 0x80
jmp 0x1403f6a84
jb 0x1403f6aed
nop dword [rax + rax]
and ax, 0xb2b
bswap ax
lea rax, [rbx + 1]
cmp ch, 0x66
cmp rax, rsi
ja 0x1403f6ba2
mov edx, ecx
stc
cmp cx, 0x2074
or dl, 0x80
stc
mov byte [rbx], dl
sal bh, cl
movsx edx, r15w
mov rdx, rcx
cmovb bx, cx
shr rdx, 7
rcr bl, cl
cmc
movzx bx, spl
mov rbx, rax
cmp rcx, 0x3fff
mov rcx, rdx
jmp 0x1403f6ae2
ja 0x1403f6a99
jmp 0x1403f6b01
mov rax, rbx
btr dx, di
test r14b, al
mov rdx, rcx
add cl, r8b
movsx ecx, sp
clc
lea rcx, [rax + 1]
cmp rcx, rsi
jmp 0x1403f6b0d
ja 0x1403f6ba2
mov byte [rax], dl
mov bx, dx
cmc
sbb bl, bpl
mov r8, qword [r14 + 0x20]
btr bx, 0xba
lea rbx, [rcx + r8]
cmp dx, 0x3c2c
cmp rbx, rsi
ja 0x1403f6ba2
cmp qword [r14 + 0x28], 0x10
jmp 0x1403f6b41
jb 0x1403f6be5
mov rdx, qword [r14 + 0x10]
jmp 0x1403f6b50
jmp 0x1403f6bee
mov rdx, rax
bt bx, si
mov rbx, rcx
and rcx, rcx
shl cx, cl
bts cx, r8w
lea rcx, [rdx + 1]
jmp 0x1403f6b73
cmp rcx, rsi
jmp 0x1403f6b7b
ja 0x1403f6ba2
mov byte [rdx], bl
mov r8, qword [r14 + 0x40]
movzx ax, r8b
shrd eax, esi, 0xe8
lea rax, [rcx + r8]
cmp rax, rsi
jmp 0x1403f6b9c
jbe 0x1403f6c01
sub edi, edi
xor r14b, 0x51
mov eax, 0xe755a86
sal rax, 0x4e
mov eax, edi
inc di
add rsp, 0x28
movsxd rsi, edx
mov r14d, r12d
xchg rsi, r14
pop rbx
movsx edi, ax
movsx di, r9b
setae sil
pop rdi
not sil
pop rsi
movzx r14, r9w
bswap r14w
pop r14
jmp 0x1403f6be4
ret
lea rdx, [r14 + 0x10]
jmp 0x1403f6bee
call fcn.1404a8457
mov eax, dword [r14 + 8]
jmp 0x1403f6bfc
jmp 0x1403f698c
cmp qword [r14 + 0x48], 0x10
jmp 0x1403f6c0b
jb 0x1403f6c1a
mov r14, qword [r14 + 0x30]
jmp 0x1403f6c1e
add r14, 0x30
mov rdx, r14
call fcn.1404a8457
jmp 0x1403f6bb1