joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086180
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.140110a00
sub rsp, rax
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x1400861bf
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.14003bc50
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x1400861d2
mov dword [rdx], r8d
cmp r9, 1
jne 0x1400861f4
test r11, r11
je 0x1400861ea
movzx eax, byte [r10]
test r8d, r8d
je 0x1400861e8
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov eax, ebx
test cl, cl
jne 0x140086211
mov eax, 1
mov ebx, eax
jmp 0x1400862bf
cmp cl, 0xff
jne 0x1400862fd
mov eax, 1
lea rcx, [r9 - 1]
mov edx, ebx
cmp r9, rax
jbe 0x1400862af
cmp rcx, 8
jb 0x1400862a0
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
movd xmm1, dword [rax + r10]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm2, xmm1
movd xmm1, dword [rax + r10 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x140086243
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x1400862af
nop
movzx ecx, byte [rax + r10]
inc rax
or edx, ecx
cmp rax, r9
jb 0x1400862a0
test edx, edx
mov eax, ebx
setne al
test edx, edx
setne bl
test edx, edx
je 0x1400862fd
movzx ecx, byte [r10 + 1]
and ecx, 0x80
cmp r8d, ecx
jne 0x1400862fd
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, ntohs
lea r8d, [rdx - 5]
call fcn.14003bc50
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov ecx, eax
sub r9, rcx
test r11, r11
je 0x140086351
neg r8d
mov qword [rsp + 0x30], rdi
lea r8, [rbx + r10]
sbb edi, edi
add r8, r9
movzx edi, dil
mov ecx, edi
and ecx, 1
test r9, r9
je 0x14008634c
mov rdx, r8
sub rdx, rbx
sub rdx, r10
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, edi
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x140086330
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rax, r9
add rsp, 0x38
ret
Function at 0x1400b3540
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0xb0
call fcn.140110a00
sub rsp, rax
mov rax, qword [0x1401d3b98]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xf0]
mov rbp, r8
mov dword [rsp + 0x60], 0x61707865
mov rsi, rdx
mov dword [rsp + 0x64], 0x3320646e
mov rdi, rcx
mov dword [rsp + 0x68], 0x79622d32
mov dword [rsp + 0x6c], 0x6b206574
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x80], xmm1
movups xmmword [rsp + 0x90], xmm0
test r8, r8
je 0x1400b3721
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], r14
nop
mov ebx, 0x40
lea rdx, [rsp + 0x60]
cmp rbp, rbx
lea rcx, [rsp + 0x20]
cmovb rbx, rbp
call fcn.1400b3740
xor eax, eax
test rbx, rbx
je 0x1400b36fb
cmp rbx, 0x40
jb 0x1400b36c9
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rsp + rbx + 0x1f]
cmp rdi, rcx
ja 0x1400b361f
lea rcx, [rsp + 0x20]
cmp rdx, rcx
jae 0x1400b36c9
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x1400b3634
cmp rdx, rsi
jae 0x1400b36c9
mov r10, rbx
and r10, 0xffffffffffffffc0
mov rdx, rsi
lea r8, [rsp + 0x20]
lea r11, [rsp + 0x30]
sub rdx, rdi
sub r8, rdi
lea r14, [rsp + 0x40]
sub r11, rdi
lea rcx, [rdi + 0x10]
sub r14, rdi
nop dword [rax]
movdqu xmm0, xmmword [r8 + rcx - 0x10]
add rax, 0x40
movdqu xmm1, xmmword [rdx + rcx - 0x10]
movdqu xmm2, xmmword [rcx + r8]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x40]
movdqu xmmword [rcx - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x30]
movdqu xmm1, xmmword [rcx + r11 - 0x40]
movdqu xmmword [rcx - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x20]
movdqu xmm2, xmmword [rcx + r14 - 0x40]
movdqu xmmword [rcx - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x20], xmm2
cmp rax, r10
jb 0x1400b3660
cmp rax, rbx
jae 0x1400b36fb
lea rcx, [rsp + 0x20]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rsp + 0x20]
sub r9, rcx
nop
lea rdx, [rsp + 0x20]
add rdx, rax
inc rax
movzx ecx, byte [rdx + r8]
xor cl, byte [rdx]
mov byte [rdx + r9], cl
cmp rax, rbx
jb 0x1400b36e0
inc dword [rsp + 0x90]
add rdi, rbx
add rsi, rbx
sub rbp, rbx
jne 0x1400b35d0
mov r14, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14010fe10
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b6270
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.140110a00
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1400b6299
lea rax, [0x1400b48d0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1400411c0
lea rax, [0x1400b3a80]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140040f10
Function at 0x1400c1540
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x20
call fcn.140110a00
sub rsp, rax
mov rsi, r9
mov rbp, r9
shr rsi, 3
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp r8, r9
jb 0x1400c1600
nop
xor edx, edx
test rsi, rsi
je 0x1400c15f0
nop word [rax + rax]
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx]
shl rcx, 8
add rbx, 8
or rcx, rax
xor qword [r14 + rdx*8], rcx
inc rdx
cmp rdx, rsi
jb 0x1400c1590
mov rcx, r14
call fcn.1400c0d10
sub rdi, rbp
cmp rdi, rbp
jae 0x1400c1580
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140110390
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14012351c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140123348

Function at 0x14012fe14
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14012fe34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14011c464
or eax, 0xffffffff
jmp 0x14012fe36
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403adea7

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403af99f
Function at 0x140129e34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x140291c4e
test r9d, r9d
jmp 0x14026fcde
cmp r8d, ecx
jmp 0x1400e5a54
je 0x140104a61
cmp byte [r11 + rcx*4], r10b
jne 0x1401fce88
movzx eax, byte [r11 + rcx*4 + 1]
clc
cmp al, byte [rdx + 1]
jmp 0x140292e6f
ret
mov r10, qword [rcx]
mov r9d, 0x2fa556b5
rcr r9w, cl
sbb r11b, 0xd5
mov r11, qword [rcx + 0x18]
add r9b, 0x31
sar r9w, cl
mov r9d, dword [r10 + 4]
cmp bl, r11b
cmc
imul r9d, dword [r10]
cmc
cmp r8d, 2
jmp 0x1400e0e4a
neg al
mov byte [r11 + rcx*2 + 1], al
jmp 0x1402653a8
cmp ecx, 3
jmp 0x1401f2a1e
je 0x140104a61
and r9d, 3
xor ecx, ecx
sal eax, 0x4e
inc al
and ah, 0xaa
nop word cs:[rax + rax]
sbb al, dil
shl eax, cl
movzx eax, byte [r11 + rcx*2]
cmp r14b, dl
test bx, bx
cmp al, byte [rdx]
setne al
jmp 0x14012fff7
jb 0x140294182
mov r8d, r9d
not r10
xor rcx, 0x524500b3
and r8d, 0xfffffffc
nop word cs:[rax + rax]
movzx ecx, byte [r11]
bts r10, r9
cmp cl, byte [rdx]
movsx r10, r11w
movzx r10d, r9w
movzx r10d, byte [r11 + 2]
setne cl
setne cl
stc
neg cl
mov byte [r11 + 1], cl
mov cl, r12b
cmp r10b, byte [rdx]
setne cl
neg cl
mov byte [r11 + 3], cl
sar cx, cl
bts cx, sp
not rcx
movzx ecx, byte [r11 + 4]
cmp r13, 0x7dda15b8
cmp cl, byte [rdx]
not cl
xchg cl, cl
setne cl
cmc
jmp 0x14027b531
inc rcx
jmp 0x1400e4e44
jmp 0x1401fce88
inc rcx
stc
cmp r9d, ecx
jmp 0x140295b34
add r11, 8
add r8d, 0xfffffffc
jmp 0x14029417c
je 0x140104a61
lea ecx, [r9 - 1]
jmp 0x1401d8898
neg cl
mov byte [r11 + 5], cl
movsx cx, bpl
movzx ecx, byte [r11 + 6]
test bl, 0x30
test rcx, r14
cmp cl, byte [rdx]
not cl
xchg cl, cl
setne cl
cmc
test dl, r12b
neg cl
test r8b, r11b
cmc
mov byte [r11 + 7], cl
test r9b, cl
jmp 0x140268835
test r9d, r9d
je 0x140104a61
movzx r10d, byte [rdx]
movsx r8d, r15w
xadd r8d, r8d
mov r8d, r9d
clc
sub ecx, ecx
jmp 0x1400e5a5a
jne 0x1401fce88
movzx eax, byte [r11 + rcx*4 + 2]
cmp al, byte [rdx + 2]
jne 0x1401fce88
mov byte [r11 + rcx*4 + 3], 0
not r10b
movzx r10w, r14b
setne r10b
movzx r10d, byte [rdx]
jmp 0x140205b5b
jne 0x1401f2a43
test r9b, 3
jmp 0x1401e8090
jne 0x1401e80b3
jmp 0x140104a61
Function at 0x14015d67c
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x14019b6b7
jmp 0x14044675f
push rsi
push rdi
mov rsi, 0x4ed3ba0
neg sil
movsx si, sil
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
sub eax, eax
bt rax, 0x38
mov rax, qword [rcx]
sub edx, edx
cmp edi, 0x2d652522
stc
jmp 0x140446793
sub r8d, r8d
jmp 0x14044679b
call qword [rax + 0x188]
mov edi, eax
lea rcx, [rsi + 0x30]
jmp 0x1404467ac
call fcn.14045a565
test edi, edi
jmp 0x1404467b8
je 0x1404467fe
cmp edi, 0x8899000c
jmp 0x1404467c9
jne 0x140446816
mov rcx, rsi
and si, r9w
clc
add dil, 0xb5
add rsp, 0x28
cmovo rdi, rbx
movsx edi, r9w
bswap si
pop rdi
xchg sil, sil
movzx esi, bx
bswap esi
pop rsi
jmp 0x1404467f9
jmp fcn.140446441
nop
sub sil, 0xbc
add rsp, 0x28
pop rdi
movzx rsi, bx
jmp 0x140446814
pop rsi
ret
mov ecx, edi
movabs r8, 0xad4a5352d2edebd0
ror dl, 0x8b
movsxd r9, ebx
mov dl, 3
movzx rdi, si
sar sil, cl
xor sil, 0x1b
mov r9d, 0x54
or si, 0x79bd
add rsp, 0x28
mov sil, dil
xchg rdi, rdi
pop rdi
xchg si, si
jmp 0x140446853
pop rsi
jmp 0x140446859
jmp fcn.1403aff5a

Function at 0x1401c351d
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
cmovb r8, rdx
jmp 0x1401c6c50
inc rdx
test ax, ax
jmp 0x140239724
jne 0x140222ef7
sub r8, rax
test r8, r8
jmp 0x140271e84
inc rax
test r11w, r11w
jmp 0x14012c94a
je 0x14023972e
xor edx, edx
xor r9b, spl
and r9b, 0x86
lea r9, [0x1400b8f10]
test r14b, dl
cmc
cmp r8, rdx
jmp 0x140187144
test ax, ax
jmp 0x1401bed4a
ret
mov rax, qword gs:[0x30]
neg r9b
shl r9d, 0xbd
mov rax, qword [rax + 0x60]
bts r10w, r13w
ror r9b, cl
bswap r8
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
or r11b, 0xb0
ror r9b, cl
movzx r8d, word [rax + 0x58]
and r11, rcx
bts r9d, edi
cmp r8, rdx
movsx r11d, di
movzx r11, r12w
not r11b
cmovae r8, rdx
mov r9, qword [rax + 0x60]
sal r10w, cl
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
jmp 0x140214f62
je 0x1401de2be
mov word [rcx], ax
rcl ax, 0xae
rol rax, cl
sub al, r15b
add rcx, 2
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x14011d152
je 0x14017b831
cmp rdx, 0x104
movzx r8d, r10w
not r8d
mov r8d, 0x104
jmp 0x1400e0088
movzx eax, word [0x1400b8f10]
jmp 0x1401478fc
jmp 0x140146c2a
je 0x140161c78
mov word [rcx], 0
jmp 0x140161c78
test r11w, r11w
jmp 0x140222ee5
je 0x14012c953
sub eax, eax
test r12b, 0x35
nop word [rax + rax]
cmp r8, rax
je 0x140271e8a
mov word [r10], r11w
cmc
movsxd r11, r10d
bts r11w, r8w
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x140146028
jne 0x140146c3e
sub r8, rdx
clc
test r8, r8
jmp 0x1401de2b8
je 0x140271e98
mov word [r10], 0
and r8b, dl
rcr eax, cl
shr r8b, cl
movzx eax, word [0x1400b8f10]
cmp rdx, 0x104
movsx r8d, r12w
mov r8d, 0x104
cmovb r8, rdx
stc
test ax, ax
jmp 0x140146c24

Function at 0x1401cb627
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b1d7f
sub r8d, r8d
sub edx, edx
jmp 0x1401a562c

Function at 0x14023be54
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b1d7f
sub edx, edx
sub ecx, ecx
movsx r8, r12w
movsx r8d, r12w
lea r8d, [rdx + 1]
jmp 0x14019e6ed
Function at 0x140273dd9
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b1d7f
sub r8d, r8d
movsxd rdx, esi
bswap edx
mov dh, 3
lea edx, [r8 + 2]
jmp 0x1401fbef6
mov qword [rsp + 8], rbx
rcr bh, cl
xadd bh, bh
mov dword [rsp + 0x18], r8d
ror bl, cl
shr bx, 0xc0
sal bx, 0xe2
mov dword [rsp + 0x10], edx
push rbp
cmp dl, r8b
shl bpl, cl
bswap bx
mov rbp, rsp
sal bx, 0x59
ror bx, 3
sub rsp, 0x50
setb bl
rcr rbx, cl
mov ebx, ecx
test r8d, r8d
jne 0x1404b1e55
sub ecx, ecx
jmp 0x1404b1dcd
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1404b1e55
mov ecx, 0x5a4d
test spl, r11b
cmc
cmp word [rax], cx
jmp 0x1404b1ded
jne 0x1404b1e55
movsxd rcx, dword [rax + 0x3c]
test r8w, 0x5a46
clc
stc
lea rcx, [rcx + rax]
test r11d, r8d
stc
cmp rbp, rsp
cmp dword [rcx], 0x4550
jmp 0x1404b1e15
jne 0x1404b1e55
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x1404b1e29
jne 0x1404b1e55
cmp dword [rcx + 0x84], 0xe
jbe 0x1404b1e55
cmp dword [rcx + 0xf8], 0
jmp 0x1404b1e48
je 0x1404b1e55
mov ecx, ebx
call fcn.1404b1c40
lea rax, [rbp + 0x18]
mov ch, 0x98
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov dh, 0x4e
mov qword [rbp - 0x10], rax
cdq
cwd
movsxd rax, r9d
lea rdx, [rbp - 0x28]
mov eax, 2
setbe ch
xchg cx, cx
lea rcx, [rbp - 0x30]
jmp 0x1404b1e9d
mov dword [rbp - 0x2c], eax
jmp 0x1404b1ea5
mov dword [rbp - 0x28], eax
jmp 0x1404b1ead
call fcn.1404b2060
cmp dword [rbp + 0x20], 0
jmp 0x1404b1ebb
je 0x1404b1ecf
mov rbx, qword [rsp + 0x60]
dec bpl
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
jmp 0x1404b1ed6
call fcn.1404b1cfc
int3

Function at 0x14028b587
Capabilities:
Parse pe header

Disassembly:
jne 0x140233d75
movsxd rdx, dword [rcx + 0x3c]
stc
lea rdx, [rdx + rcx]
clc
test r11b, cl
cmp dword [rdx], 0x4550
jmp 0x14018fb88
jne 0x140233d75
xor eax, eax
shr al, 0xc7
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
setg al
mov al, r9b
mov al, 0xa7
sete al
jmp 0x14025da59
ret
xor eax, eax
jmp 0x14019d881
ret
mov eax, 0x5a4d
cmp r12b, 0xcf
cmp word [rcx], ax
jmp 0x14012a59f
Function at 0x1403bdb8f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
test r15b, 0xbc
push r14
stc
cmp spl, bl
push r12
or r12b, 0xb8
push rsi
shrd r12d, r9d, 0x8a
bswap r12w
movzx r12, cx
push rdi
xor r12b, r13b
stc
shr r12b, 0xd2
push rbx
bt r12d, 0x6d
sub rsp, 0x28
bsr r12w, r8w
mov r12, r8
test rdx, rdx
jmp 0x1403bdbd2
je 0x1403bdddf
mov r15, rdx
mov rbx, rcx
cmc
cmp r13b, 0x82
sub esi, esi
jmp 0x1403bdbea
jmp 0x1403bdc3b
mov rcx, rdi
cmovp dx, r9w
cwd
mov rdx, r14
jmp 0x1403bdc01
call fcn.1403bb94b
mov eax, dword [rbx + rsi + 0x58]
jmp 0x1403bdc12
mov dword [r12 + rsi + 0x58], eax
mov rax, qword [rbx + rsi + 0x50]
mov qword [r12 + rsi + 0x50], rax
cmp bl, r8b
add rsi, 0x60
jmp 0x1403bdc2d
dec r15
jmp 0x1403bdc35
je 0x1403bddd0
mov eax, dword [rbx + rsi + 8]
test ecx, 0x57bf1e10
mov dword [r12 + rsi + 8], eax
cmp r12, rbx
jmp 0x1403bdc52
je 0x1403bdc06
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403bdc63
jb 0x1403bdc78
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403bdc73
jmp 0x1403bdc90
lea r9, [rbx + rsi]
shr dil, cl
movsx rax, r13w
add di, 0x4832
add r9, 0x10
or r14b, 0x57
lea r14, [r12 + rsi]
add r14, 0x10
setb ah
mov rdi, qword [rbx + rsi + 0x20]
not ah
shr ax, 0x18
mov rax, qword [r12 + rsi + 0x28]
stc
cmp rax, rdi
jmp 0x1403bdcb4
jae 0x1403bdccf
mov rcx, r14
mov rdx, rdi
jmp 0x1403bdcc5
call fcn.1403bb94b
jmp 0x1403bdd23
cmp rax, 0x10
jmp 0x1403bdcd8
jb 0x1403bdced
mov r14, qword [r12 + rsi + 0x10]
bswap edx
setl r8b
cmovbe r8d, r15d
mov qword [r12 + rsi + 0x20], rdi
mov rcx, r14
movsx dx, bh
cwd
movzx rdx, r10w
mov rdx, r9
not r8b
mov r8b, 0x7a
movzx r8w, r12b
mov r8, rdi
jmp 0x1403bdd15
call fcn.1404a4307
mov byte [r14 + rdi], 0
stc
rcr r14b, cl
mov r14, qword [rbx + rsi + 0x40]
test bpl, 0xa7
cmp qword [rbx + rsi + 0x48], 0x10
jmp 0x1403bdd37
jb 0x1403bdd4c
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403bdd47
jmp 0x1403bdd54
lea r9, [rbx + rsi]
add r9, 0x30
lea rdi, [r12 + rsi]
add rdi, 0x30
rcr al, cl
seto ah
cbw
mov rax, qword [r12 + rsi + 0x48]
test rbx, r11
cmp rax, r14
jmp 0x1403bdd73
jb 0x1403bdbef
cmp rax, 0x10
jmp 0x1403bdd82
jb 0x1403bdd95
mov rdi, qword [r12 + rsi + 0x30]
cmovno rcx, rsi
movzx r8d, sp
mov qword [r12 + rsi + 0x40], r14
movzx rcx, dx
mov rcx, rdi
mov r8w, 0x239c
xchg r8w, dx
mov rdx, r9
movsx r8w, sil
movsx r8, r12w
xchg r8b, r8b
mov r8, r14
call fcn.1404a4307
mov byte [rdi + r14], 0
jmp 0x1403bddcb
jmp 0x1403bdc06
add r12, rsi
test r13b, 0x85
rol ah, 0xb6
bt ax, r11w
mov rax, r12
add rsp, 0x28
bswap r15w
xchg bl, r14b
pop rbx
movsx edi, r11w
pop rdi
setnp r14b
not r14d
cmovge r14w, r15w
pop rsi
cmovns r15w, r8w
movsxd r14, ecx
pop r12
bswap r15d
mov r15b, 0xc
mov r15d, r9d
pop r14
jmp 0x1403bde1a
pop r15
jmp 0x1403bde21
ret
Function at 0x1403dc7f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
cmovge r14w, r9w
push r12
push rsi
test r9, r11
push rdi
or r15b, spl
bsf r14, r10
push rbp
push rbx
sub rsp, 0x38
sub r15b, bpl
movaps xmmword [rsp + 0x20], xmm6
bts r14d, r8d
sar bl, 0xf4
bsr r15w, r14w
mov r14, r9
bts rbx, rbx
mov r15, r8
xadd r13w, r13w
movsx bx, spl
mov r12, rdx
mov r13, rcx
mov ebx, 0x6ff0a8f
and bx, sp
rcl rbx, cl
mov rbx, qword [rcx]
test bp, dx
test rbx, rbx
jmp 0x1403dc859
je 0x1403dc9c0
mov rdi, qword [r13 + 8]
cmp rbx, rdi
jmp 0x1403dc86b
je 0x1403dc93f
lea rsi, [0x1400beb30]
jmp 0x1403dc87d
xorps xmm6, xmm6
jmp 0x1403dc8ba
lea rbp, [rbx + 0x18]
call fcn.140198300
movups xmmword [rbp], xmm6
cmc
mov qword [rbp + 0x10], 0
jmp 0x1403dc8a0
add rbx, 0x30
jmp 0x1403dc8ac
cmp rbx, rdi
jmp 0x1403dc8b4
je 0x1403dc93b
mov qword [rbx], rsi
rol ch, 0x11
or cx, 0x7066
and ecx, 0x4a2b05ea
mov rcx, qword [rbx + 0x18]
stc
test rcx, rcx
jmp 0x1403dc8d8
je 0x1403dc8a0
mov rdx, qword [rbx + 0x28]
clc
sub rdx, rcx
clc
cmp rdx, 0x1000
jmp 0x1403dc8f3
jb 0x1403dc885
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
clc
jmp 0x1403dc907
sub rcx, rax
cmp rax, 0x6c821773
cmp rcx, 0x20
jmp 0x1403dc91a
jae 0x1403dca57
add rdx, 0x27
movsx ecx, cx
movsx cx, r11b
mov ecx, ecx
mov rcx, rax
jmp 0x1403dc936
jmp 0x1403dc885
mov rbx, qword [r13]
mov rdx, qword [r13 + 0x10]
cmc
clc
test esp, 0x55966d37
sub rdx, rbx
cmp r15, rbp
test r9b, 0xb6
cmp cx, 0x7f39
cmp rdx, 0x1000
jmp 0x1403dc966
jb 0x1403dc9b3
mov rax, qword [rbx - 8]
cmp r10, 0x3aea2cae
add rbx, 0xfffffffffffffff8
test r10d, ebx
cmp r10, 0x701b18d5
clc
sub rbx, rax
cmp rbx, 0x20
jmp 0x1403dc992
jae 0x1403dca57
add rdx, 0x27
cmovo bx, r12w
movzx bx, r11b
xchg bh, ch
mov rbx, rax
movsxd rcx, edx
movsx cx, r15b
mov rcx, rbx
jmp 0x1403dc9bb
call fcn.140198300
mov qword [r13], r12
adc bh, 0x12
lea rax, [r15 + r15*2]
shl rax, 4
or bpl, r9b
lea rax, [rax + r12]
bts r15w, cx
mov qword [r13 + 8], rax
lea rax, [r14 + r14*2]
shl rax, 4
test dl, spl
cmovae di, di
bsf edi, esp
add rax, r12
xor bp, 0x7214
mov qword [r13 + 0x10], rax
movsx rbp, r15w
movaps xmm6, xmmword [rsp + 0x20]
movzx esi, r15w
add rsp, 0x38
movsxd r13, ecx
mov r15b, 0x12
mov r15b, cl
pop rbx
bswap r15d
mov si, r14w
movzx ebp, r12w
pop rbp
pop rdi
bswap r12
movsx r14w, r14b
setnp sil
pop rsi
mov r12b, r13b
pop r12
not r13b
movzx r13w, r15b
movsx r15, r9w
pop r13
setns r15b
movzx r14, r14w
pop r14
pop r15
jmp 0x1403dca56
ret
call fcn.1404b6df5
int3
Function at 0x1403e9a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
bt ax, r12w
lahf
push r14
push rsi
xchg r14d, eax
ror ah, cl
push rdi
movzx rax, bp
shl r14w, cl
push rbx
sub rsp, 0x20
inc r14
mov r14, rcx
cbw
btr ax, 0xa3
stc
mov eax, dword [rcx + 8]
test al, 2
jmp 0x1403e9a55
jne 0x1403e9a67
xor esi, esi
jmp 0x1403e9a62
jmp 0x1403e9b18
mov rdi, qword [r14 + 0x10]
mov r15, qword [r14 + 0x18]
shl sil, 0x17
xor si, di
shrd esi, ebx, 0x99
mov rsi, r15
stc
cmp r12b, 0xa0
sub rsi, rdi
stc
cmc
sar rsi, 5
test rbx, 0x28425d1a
cmp r15, rdi
jmp 0x1403e9a9a
je 0x1403e9b18
mov rax, qword [rdi]
movsx ecx, bx
jmp 0x1403e9aaf
mov rcx, rdi
jmp 0x1403e9ab7
call qword [rax + 0x10]
or rax, 1
movzx rcx, r13w
bsf ecx, r15d
sar bh, 0x6c
bsr rax, rax
lea rbx, [rax + rax*8]
rcr ecx, 0x54
add rbx, 0x49
shr cl, 0xe0
bsr rax, r11
shr rbx, 6
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x1403e9aee
call qword [rax + 0x10]
add rsi, rax
test spl, al
test ah, 0x4b
add rsi, rbx
add rdi, 0x20
cmc
clc
cmp rdi, r15
jne 0x1403e9aa0
mov eax, dword [r14 + 8]
test ah, 0x60
jmp 0x1403e9b18
test al, 4
jmp 0x1403e9b1f
jne 0x1403e9b2d
mov rdi, rsi
jmp 0x1403e9bf4
mov rbx, qword [r14 + 0x28]
sar edi, 0xf3
not r15b
mov r15, qword [r14 + 0x30]
clc
mov rdi, r15
sub rdi, rbx
cmp bpl, 0xa1
stc
sar rdi, 5
clc
cmc
lea rdi, [rdi + rsi]
cmp r14b, r9b
stc
cmp r15, rbx
je 0x1403e9bf4
nop dword [rax]
not al
mov rax, qword [rbx]
xchg cl, ch
movsx ecx, r10w
sete ch
mov rcx, rbx
call qword [rax + 0x10]
or rax, 1
bsr rax, rax
shrd cx, r8w, 0x13
lea rsi, [rax + rax*8]
adc eax, 0xdf904e0
add rsi, 0x49
movsx ecx, r9w
shld cx, cx, 0x52
mov ecx, r10d
shr rsi, 6
movsx eax, bp
mov rax, qword [rbx]
movsx ecx, bx
not cx
bswap cx
mov rcx, rbx
jmp 0x1403e9bb8
call qword [rax + 0x10]
lea rdi, [rdi + rax]
stc
cmp bp, r12w
add rdi, rsi
cmp ecx, 0x58a52f21
add rbx, 0x20
cmp r14d, 0x2d5a3ccd
cmc
clc
cmp rbx, r15
jmp 0x1403e9be2
jne 0x1403e9b64
mov eax, dword [r14 + 8]
cmp bl, r8b
jmp 0x1403e9bf4
test al, 8
jmp 0x1403e9bfb
je 0x1403e9cd8
mov rbx, qword [r14 + 0x40]
or r15w, ax
adc r15b, 0x7a
shl r15b, cl
mov r14, qword [r14 + 0x48]
cmovp r15, rbp
mov r15, r14
test r13b, r11b
sub r15, rbx
sar r15, 5
lea r15, [r15 + rdi]
test r10w, r12w
clc
cmp r14, rbx
jmp 0x1403e9c36
je 0x1403e9ccf
nop word [rax + rax]
lahf
cdqe
cmovb rax, rax
mov rax, qword [rbx]
mov cx, r9w
mov rcx, rbx
jmp 0x1403e9c5b
call qword [rax + 0x10]
or rax, 1
bsr rax, rax
movsx si, bl
lea rsi, [rax + rax*8]
sal rax, 0xd3
adc ax, r14w
add rsi, 0x49
bt rcx, 0xe7
stc
shr rsi, 6
cdqe
not ecx
mov rax, qword [rbx]
bswap cx
not ecx
mov rcx, rbx
jmp 0x1403e9c98
call qword [rax + 0x10]
mov rdi, rax
cmc
cmp r12w, sp
add rdi, r15
btc r15, rbx
add rdi, rsi
add rbx, 0x20
mov r15, rdi
cmp r9d, 0xb542fe7
stc
cmp rbx, r14
jmp 0x1403e9cc4
jne 0x1403e9c4c
jmp 0x1403e9cd8
mov rdi, r15
or bx, dx
not ax
mov rax, rdi
or sil, 0x16
neg dil
add rsp, 0x20
movsx rdi, dx
pop rbx
cmovnp r15w, ax
pop rdi
mov r15b, 0xa9
pop rsi
movzx r14d, r10w
movzx r14, r9w
pop r14
movsx r15w, bpl
sete r15b
movzx r15w, r9b
pop r15
jmp 0x1403e9d14
ret