joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014873
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r10, rax
mov r9, r10
mov r8, rdx
and r9, 0xfff
and r8, 0xfff
movdqa xmm4, xmmword [0x140038be0]
neg r9d
neg r8d
add r9d, 0x1000
add r8d, 0x1000
movdqa xmm3, xmmword [0x140038bf0]
cmp r9d, 0x10
jl 0x14001491d
cmp r8d, 0x10
jl 0x14001491d
mov qword [rsp + 0x30], rbx
movaps xmmword [rsp + 0x20], xmm6
movdqu xmm1, xmmword [r10]
movdqu xmm2, xmmword [rdx]
movdqa xmm0, xmmword [0x140038c00]
movdqa xmm5, xmm1
pcmpgtb xmm5, xmm3
pcmpgtb xmm0, xmm1
pand xmm5, xmm0
pand xmm5, xmm4
pxor xmm0, xmm0
movdqa xmm6, xmmword [0x140038c00]
paddb xmm1, xmm5
movdqa xmm5, xmm2
pcmpgtb xmm6, xmm2
pcmpgtb xmm5, xmm3
pcmpeqb xmm0, xmm1
pand xmm5, xmm6
pand xmm5, xmm4
paddb xmm2, xmm5
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
xor eax, 0xffff
jne 0x140014997
pmovmskb eax, xmm0
test eax, eax
jne 0x140014a08
add r9d, 0xfffffff0
add r10, 0x10
add rdx, 0x10
add r8d, 0xfffffff0
cmp r9d, 0x10
jl 0x14001490d
cmp r8d, 0x10
jge 0x14001487d
nop word [rax + rax]
movaps xmm6, xmmword [rsp + 0x20]
jmp 0x140014922
mov qword [rsp + 0x30], rbx
movzx eax, byte [r10]
lea ecx, [rax - 0x41]
cmp ecx, 0x19
lea ebx, [rax + 0x20]
movzx ecx, byte [rdx]
cmovbe eax, ebx
lea r11d, [rcx - 0x41]
cmp r11d, 0x19
lea ebx, [rcx + 0x20]
cmovbe ecx, ebx
cmp eax, ecx
jne 0x1400149fc
test eax, eax
je 0x1400149f0
inc r10
inc rdx
dec r8d
dec r9d
jne 0x140014978
mov r9d, 0x1000
test r8d, r8d
je 0x14001497d
cmp r8d, 0x10
jge 0x140014878
jmp 0x140014922
test r8d, r8d
jne 0x14001498f
mov r8d, 0x1000
cmp r9d, 0x10
jge 0x140014878
jmp 0x140014922
cmp r9d, 0x10
jge 0x14001496c
jmp 0x140014922
bsf r8d, eax
pmovmskb eax, xmm0
movaps xmm6, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
test eax, eax
mov ecx, r8d
je 0x1400149bf
bsf eax, eax
cmp r8d, eax
jbe 0x1400149bf
xor eax, eax
add rsp, 0x38
ret
movzx eax, byte [rcx + r10]
movzx r10d, byte [rcx + rdx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x38
ret
sub eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
movaps xmm6, xmmword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x140014878
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r10, rax
mov r9, r10
mov r8, rdx
and r9, 0xfff
and r8, 0xfff
movdqa xmm4, xmmword [0x140038be0]
neg r9d
neg r8d
add r9d, 0x1000
add r8d, 0x1000
movdqa xmm3, xmmword [0x140038bf0]
cmp r9d, 0x10
jl 0x14001491d
cmp r8d, 0x10
jl 0x14001491d
mov qword [rsp + 0x30], rbx
movaps xmmword [rsp + 0x20], xmm6
movdqu xmm1, xmmword [r10]
movdqu xmm2, xmmword [rdx]
movdqa xmm0, xmmword [0x140038c00]
movdqa xmm5, xmm1
pcmpgtb xmm5, xmm3
pcmpgtb xmm0, xmm1
pand xmm5, xmm0
pand xmm5, xmm4
pxor xmm0, xmm0
movdqa xmm6, xmmword [0x140038c00]
paddb xmm1, xmm5
movdqa xmm5, xmm2
pcmpgtb xmm6, xmm2
pcmpgtb xmm5, xmm3
pcmpeqb xmm0, xmm1
pand xmm5, xmm6
pand xmm5, xmm4
paddb xmm2, xmm5
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
xor eax, 0xffff
jne 0x140014997
pmovmskb eax, xmm0
test eax, eax
jne 0x140014a08
add r9d, 0xfffffff0
add r10, 0x10
add rdx, 0x10
add r8d, 0xfffffff0
cmp r9d, 0x10
jl 0x14001490d
cmp r8d, 0x10
jge 0x14001487d
nop word [rax + rax]
movaps xmm6, xmmword [rsp + 0x20]
jmp 0x140014922
mov qword [rsp + 0x30], rbx
movzx eax, byte [r10]
lea ecx, [rax - 0x41]
cmp ecx, 0x19
lea ebx, [rax + 0x20]
movzx ecx, byte [rdx]
cmovbe eax, ebx
lea r11d, [rcx - 0x41]
cmp r11d, 0x19
lea ebx, [rcx + 0x20]
cmovbe ecx, ebx
cmp eax, ecx
jne 0x1400149fc
test eax, eax
je 0x1400149f0
inc r10
inc rdx
dec r8d
dec r9d
jne 0x140014978
mov r9d, 0x1000
test r8d, r8d
je 0x14001497d
cmp r8d, 0x10
jge 0x140014878
jmp 0x140014922
test r8d, r8d
jne 0x14001498f
mov r8d, 0x1000
cmp r9d, 0x10
jge 0x140014878
jmp 0x140014922
cmp r9d, 0x10
jge 0x14001496c
jmp 0x140014922
bsf r8d, eax
pmovmskb eax, xmm0
movaps xmm6, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
test eax, eax
mov ecx, r8d
je 0x1400149bf
bsf eax, eax
cmp r8d, eax
jbe 0x1400149bf
xor eax, eax
add rsp, 0x38
ret
movzx eax, byte [rcx + r10]
movzx r10d, byte [rcx + rdx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x38
ret
sub eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
movaps xmm6, xmmword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x14001491d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r10, rax
mov r9, r10
mov r8, rdx
and r9, 0xfff
and r8, 0xfff
movdqa xmm4, xmmword [0x140038be0]
neg r9d
neg r8d
add r9d, 0x1000
add r8d, 0x1000
movdqa xmm3, xmmword [0x140038bf0]
cmp r9d, 0x10
jl 0x14001491d
cmp r8d, 0x10
jl 0x14001491d
mov qword [rsp + 0x30], rbx
movaps xmmword [rsp + 0x20], xmm6
movdqu xmm1, xmmword [r10]
movdqu xmm2, xmmword [rdx]
movdqa xmm0, xmmword [0x140038c00]
movdqa xmm5, xmm1
pcmpgtb xmm5, xmm3
pcmpgtb xmm0, xmm1
pand xmm5, xmm0
pand xmm5, xmm4
pxor xmm0, xmm0
movdqa xmm6, xmmword [0x140038c00]
paddb xmm1, xmm5
movdqa xmm5, xmm2
pcmpgtb xmm6, xmm2
pcmpgtb xmm5, xmm3
pcmpeqb xmm0, xmm1
pand xmm5, xmm6
pand xmm5, xmm4
paddb xmm2, xmm5
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
xor eax, 0xffff
jne 0x140014997
pmovmskb eax, xmm0
test eax, eax
jne 0x140014a08
add r9d, 0xfffffff0
add r10, 0x10
add rdx, 0x10
add r8d, 0xfffffff0
cmp r9d, 0x10
jl 0x14001490d
cmp r8d, 0x10
jge 0x14001487d
nop word [rax + rax]
movaps xmm6, xmmword [rsp + 0x20]
jmp 0x140014922
mov qword [rsp + 0x30], rbx
movzx eax, byte [r10]
lea ecx, [rax - 0x41]
cmp ecx, 0x19
lea ebx, [rax + 0x20]
movzx ecx, byte [rdx]
cmovbe eax, ebx
lea r11d, [rcx - 0x41]
cmp r11d, 0x19
lea ebx, [rcx + 0x20]
cmovbe ecx, ebx
cmp eax, ecx
jne 0x1400149fc
test eax, eax
je 0x1400149f0
inc r10
inc rdx
dec r8d
dec r9d
jne 0x140014978
mov r9d, 0x1000
test r8d, r8d
je 0x14001497d
cmp r8d, 0x10
jge 0x140014878
jmp 0x140014922
test r8d, r8d
jne 0x14001498f
mov r8d, 0x1000
cmp r9d, 0x10
jge 0x140014878
jmp 0x140014922
cmp r9d, 0x10
jge 0x14001496c
jmp 0x140014922
bsf r8d, eax
pmovmskb eax, xmm0
movaps xmm6, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
test eax, eax
mov ecx, r8d
je 0x1400149bf
bsf eax, eax
cmp r8d, eax
jbe 0x1400149bf
xor eax, eax
add rsp, 0x38
ret
movzx eax, byte [rcx + r10]
movzx r10d, byte [rcx + rdx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x38
ret
sub eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
movaps xmm6, xmmword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x140014a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r8, rdx
test r8, r8
je 0x140014bfa
mov r9, rax
mov rdx, rcx
and r9, 0xfff
and rdx, 0xfff
neg r9d
neg edx
add r9d, 0x1000
add edx, 0x1000
shr r9d, 4
shr edx, 4
test r9d, r9d
je 0x140014b40
test edx, edx
je 0x140014b30
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
movdqu xmm2, xmmword [rax]
movdqu xmm3, xmmword [rcx]
movdqa xmm0, xmmword [0x140038bf0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140038c00]
pcmpgtb xmm1, xmm0
pcmpgtb xmm4, xmm2
movdqa xmm5, xmmword [0x140038be0]
pand xmm1, xmm4
pand xmm1, xmm5
pxor xmm0, xmm0
movdqa xmm4, xmmword [0x140038bf0]
paddb xmm2, xmm1
movdqa xmm5, xmmword [0x140038c00]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm4
pcmpgtb xmm5, xmm3
movdqa xmm4, xmmword [0x140038be0]
pand xmm1, xmm5
pand xmm1, xmm4
pcmpeqb xmm0, xmm2
paddb xmm3, xmm1
pcmpeqb xmm2, xmm3
pmovmskb r10d, xmm2
xor r10d, 0xffff
jne 0x140014c01
pmovmskb ebp, xmm0
test ebp, ebp
jne 0x140014c7c
add r8, 0xfffffffffffffff0
add rax, 0x10
add rcx, 0x10
test r8d, r8d
jle 0x140014c7c
dec edx
dec r9d
je 0x140014b4a
test edx, edx
jne 0x140014a78
jmp 0x140014b3c
nop
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
xor ebp, ebp
jmp 0x140014b5e
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
mov ebp, eax
and ebp, 0xfff
neg ebp
add ebp, 0x1000
test edx, edx
jne 0x140014b79
mov r9d, ecx
and r9d, 0xfff
neg r9d
add r9d, 0x1000
cmp ebp, r9d
cmovb ebp, r9d
mov r9d, ebp
cmp r8, r9
jae 0x140014b87
movsxd r9, r8d
mov ebp, r8d
sub r8, r9
movzx r10d, byte [rax]
lea r9d, [r10 - 0x41]
cmp r9d, 0x19
lea r11d, [r10 + 0x20]
movzx r9d, byte [rcx]
cmovbe r10d, r11d
lea r15d, [r9 - 0x41]
cmp r15d, 0x19
lea r11d, [r9 + 0x20]
cmovbe r9d, r11d
cmp r10d, r9d
jne 0x140014c8d
test r10d, r10d
je 0x140014c7c
inc rax
inc rcx
dec ebp
jne 0x140014b8a
test r8, r8
je 0x140014c7c
mov r9, rax
and r9, 0xfff
neg r9d
add r9d, 0x1000
shr r9d, 4
test r9d, r9d
je 0x140014b4a
jmp 0x140014c5a
xor eax, eax
add rsp, 0x38
ret
bsf r9d, r10d
mov edx, r9d
mov r15, qword [rsp + 0x20]
cmp rdx, r8
mov rbp, qword [rsp + 0x28]
jae 0x140014bfa
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140014c2a
bsf r8d, r8d
cmp r9d, r8d
ja 0x140014bfa
movzx eax, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rdx, rcx
and rdx, 0xfff
neg edx
add edx, 0x1000
shr edx, 4
test edx, edx
je 0x140014b3c
jmp 0x140014a78
mov r15, qword [rsp + 0x20]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
sub r10d, r9d
mov r15, qword [rsp + 0x20]
mov eax, r10d
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x140014a6e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r8, rdx
test r8, r8
je 0x140014bfa
mov r9, rax
mov rdx, rcx
and r9, 0xfff
and rdx, 0xfff
neg r9d
neg edx
add r9d, 0x1000
add edx, 0x1000
shr r9d, 4
shr edx, 4
test r9d, r9d
je 0x140014b40
test edx, edx
je 0x140014b30
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
movdqu xmm2, xmmword [rax]
movdqu xmm3, xmmword [rcx]
movdqa xmm0, xmmword [0x140038bf0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140038c00]
pcmpgtb xmm1, xmm0
pcmpgtb xmm4, xmm2
movdqa xmm5, xmmword [0x140038be0]
pand xmm1, xmm4
pand xmm1, xmm5
pxor xmm0, xmm0
movdqa xmm4, xmmword [0x140038bf0]
paddb xmm2, xmm1
movdqa xmm5, xmmword [0x140038c00]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm4
pcmpgtb xmm5, xmm3
movdqa xmm4, xmmword [0x140038be0]
pand xmm1, xmm5
pand xmm1, xmm4
pcmpeqb xmm0, xmm2
paddb xmm3, xmm1
pcmpeqb xmm2, xmm3
pmovmskb r10d, xmm2
xor r10d, 0xffff
jne 0x140014c01
pmovmskb ebp, xmm0
test ebp, ebp
jne 0x140014c7c
add r8, 0xfffffffffffffff0
add rax, 0x10
add rcx, 0x10
test r8d, r8d
jle 0x140014c7c
dec edx
dec r9d
je 0x140014b4a
test edx, edx
jne 0x140014a78
jmp 0x140014b3c
nop
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
xor ebp, ebp
jmp 0x140014b5e
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
mov ebp, eax
and ebp, 0xfff
neg ebp
add ebp, 0x1000
test edx, edx
jne 0x140014b79
mov r9d, ecx
and r9d, 0xfff
neg r9d
add r9d, 0x1000
cmp ebp, r9d
cmovb ebp, r9d
mov r9d, ebp
cmp r8, r9
jae 0x140014b87
movsxd r9, r8d
mov ebp, r8d
sub r8, r9
movzx r10d, byte [rax]
lea r9d, [r10 - 0x41]
cmp r9d, 0x19
lea r11d, [r10 + 0x20]
movzx r9d, byte [rcx]
cmovbe r10d, r11d
lea r15d, [r9 - 0x41]
cmp r15d, 0x19
lea r11d, [r9 + 0x20]
cmovbe r9d, r11d
cmp r10d, r9d
jne 0x140014c8d
test r10d, r10d
je 0x140014c7c
inc rax
inc rcx
dec ebp
jne 0x140014b8a
test r8, r8
je 0x140014c7c
mov r9, rax
and r9, 0xfff
neg r9d
add r9d, 0x1000
shr r9d, 4
test r9d, r9d
je 0x140014b4a
jmp 0x140014c5a
xor eax, eax
add rsp, 0x38
ret
bsf r9d, r10d
mov edx, r9d
mov r15, qword [rsp + 0x20]
cmp rdx, r8
mov rbp, qword [rsp + 0x28]
jae 0x140014bfa
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140014c2a
bsf r8d, r8d
cmp r9d, r8d
ja 0x140014bfa
movzx eax, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rdx, rcx
and rdx, 0xfff
neg edx
add edx, 0x1000
shr edx, 4
test edx, edx
je 0x140014b3c
jmp 0x140014a78
mov r15, qword [rsp + 0x20]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
sub r10d, r9d
mov r15, qword [rsp + 0x20]
mov eax, r10d
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x140014b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r8, rdx
test r8, r8
je 0x140014bfa
mov r9, rax
mov rdx, rcx
and r9, 0xfff
and rdx, 0xfff
neg r9d
neg edx
add r9d, 0x1000
add edx, 0x1000
shr r9d, 4
shr edx, 4
test r9d, r9d
je 0x140014b40
test edx, edx
je 0x140014b30
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
movdqu xmm2, xmmword [rax]
movdqu xmm3, xmmword [rcx]
movdqa xmm0, xmmword [0x140038bf0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140038c00]
pcmpgtb xmm1, xmm0
pcmpgtb xmm4, xmm2
movdqa xmm5, xmmword [0x140038be0]
pand xmm1, xmm4
pand xmm1, xmm5
pxor xmm0, xmm0
movdqa xmm4, xmmword [0x140038bf0]
paddb xmm2, xmm1
movdqa xmm5, xmmword [0x140038c00]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm4
pcmpgtb xmm5, xmm3
movdqa xmm4, xmmword [0x140038be0]
pand xmm1, xmm5
pand xmm1, xmm4
pcmpeqb xmm0, xmm2
paddb xmm3, xmm1
pcmpeqb xmm2, xmm3
pmovmskb r10d, xmm2
xor r10d, 0xffff
jne 0x140014c01
pmovmskb ebp, xmm0
test ebp, ebp
jne 0x140014c7c
add r8, 0xfffffffffffffff0
add rax, 0x10
add rcx, 0x10
test r8d, r8d
jle 0x140014c7c
dec edx
dec r9d
je 0x140014b4a
test edx, edx
jne 0x140014a78
jmp 0x140014b3c
nop
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
xor ebp, ebp
jmp 0x140014b5e
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
mov ebp, eax
and ebp, 0xfff
neg ebp
add ebp, 0x1000
test edx, edx
jne 0x140014b79
mov r9d, ecx
and r9d, 0xfff
neg r9d
add r9d, 0x1000
cmp ebp, r9d
cmovb ebp, r9d
mov r9d, ebp
cmp r8, r9
jae 0x140014b87
movsxd r9, r8d
mov ebp, r8d
sub r8, r9
movzx r10d, byte [rax]
lea r9d, [r10 - 0x41]
cmp r9d, 0x19
lea r11d, [r10 + 0x20]
movzx r9d, byte [rcx]
cmovbe r10d, r11d
lea r15d, [r9 - 0x41]
cmp r15d, 0x19
lea r11d, [r9 + 0x20]
cmovbe r9d, r11d
cmp r10d, r9d
jne 0x140014c8d
test r10d, r10d
je 0x140014c7c
inc rax
inc rcx
dec ebp
jne 0x140014b8a
test r8, r8
je 0x140014c7c
mov r9, rax
and r9, 0xfff
neg r9d
add r9d, 0x1000
shr r9d, 4
test r9d, r9d
je 0x140014b4a
jmp 0x140014c5a
xor eax, eax
add rsp, 0x38
ret
bsf r9d, r10d
mov edx, r9d
mov r15, qword [rsp + 0x20]
cmp rdx, r8
mov rbp, qword [rsp + 0x28]
jae 0x140014bfa
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140014c2a
bsf r8d, r8d
cmp r9d, r8d
ja 0x140014bfa
movzx eax, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rdx, rcx
and rdx, 0xfff
neg edx
add edx, 0x1000
shr edx, 4
test edx, edx
je 0x140014b3c
jmp 0x140014a78
mov r15, qword [rsp + 0x20]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
sub r10d, r9d
mov r15, qword [rsp + 0x20]
mov eax, r10d
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x140014b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r8, rdx
test r8, r8
je 0x140014bfa
mov r9, rax
mov rdx, rcx
and r9, 0xfff
and rdx, 0xfff
neg r9d
neg edx
add r9d, 0x1000
add edx, 0x1000
shr r9d, 4
shr edx, 4
test r9d, r9d
je 0x140014b40
test edx, edx
je 0x140014b30
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
movdqu xmm2, xmmword [rax]
movdqu xmm3, xmmword [rcx]
movdqa xmm0, xmmword [0x140038bf0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140038c00]
pcmpgtb xmm1, xmm0
pcmpgtb xmm4, xmm2
movdqa xmm5, xmmword [0x140038be0]
pand xmm1, xmm4
pand xmm1, xmm5
pxor xmm0, xmm0
movdqa xmm4, xmmword [0x140038bf0]
paddb xmm2, xmm1
movdqa xmm5, xmmword [0x140038c00]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm4
pcmpgtb xmm5, xmm3
movdqa xmm4, xmmword [0x140038be0]
pand xmm1, xmm5
pand xmm1, xmm4
pcmpeqb xmm0, xmm2
paddb xmm3, xmm1
pcmpeqb xmm2, xmm3
pmovmskb r10d, xmm2
xor r10d, 0xffff
jne 0x140014c01
pmovmskb ebp, xmm0
test ebp, ebp
jne 0x140014c7c
add r8, 0xfffffffffffffff0
add rax, 0x10
add rcx, 0x10
test r8d, r8d
jle 0x140014c7c
dec edx
dec r9d
je 0x140014b4a
test edx, edx
jne 0x140014a78
jmp 0x140014b3c
nop
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
xor ebp, ebp
jmp 0x140014b5e
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
mov ebp, eax
and ebp, 0xfff
neg ebp
add ebp, 0x1000
test edx, edx
jne 0x140014b79
mov r9d, ecx
and r9d, 0xfff
neg r9d
add r9d, 0x1000
cmp ebp, r9d
cmovb ebp, r9d
mov r9d, ebp
cmp r8, r9
jae 0x140014b87
movsxd r9, r8d
mov ebp, r8d
sub r8, r9
movzx r10d, byte [rax]
lea r9d, [r10 - 0x41]
cmp r9d, 0x19
lea r11d, [r10 + 0x20]
movzx r9d, byte [rcx]
cmovbe r10d, r11d
lea r15d, [r9 - 0x41]
cmp r15d, 0x19
lea r11d, [r9 + 0x20]
cmovbe r9d, r11d
cmp r10d, r9d
jne 0x140014c8d
test r10d, r10d
je 0x140014c7c
inc rax
inc rcx
dec ebp
jne 0x140014b8a
test r8, r8
je 0x140014c7c
mov r9, rax
and r9, 0xfff
neg r9d
add r9d, 0x1000
shr r9d, 4
test r9d, r9d
je 0x140014b4a
jmp 0x140014c5a
xor eax, eax
add rsp, 0x38
ret
bsf r9d, r10d
mov edx, r9d
mov r15, qword [rsp + 0x20]
cmp rdx, r8
mov rbp, qword [rsp + 0x28]
jae 0x140014bfa
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140014c2a
bsf r8d, r8d
cmp r9d, r8d
ja 0x140014bfa
movzx eax, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rdx, rcx
and rdx, 0xfff
neg edx
add edx, 0x1000
shr edx, 4
test edx, edx
je 0x140014b3c
jmp 0x140014a78
mov r15, qword [rsp + 0x20]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
sub r10d, r9d
mov r15, qword [rsp + 0x20]
mov eax, r10d
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x140014c5a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r8, rdx
test r8, r8
je 0x140014bfa
mov r9, rax
mov rdx, rcx
and r9, 0xfff
and rdx, 0xfff
neg r9d
neg edx
add r9d, 0x1000
add edx, 0x1000
shr r9d, 4
shr edx, 4
test r9d, r9d
je 0x140014b40
test edx, edx
je 0x140014b30
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
movdqu xmm2, xmmword [rax]
movdqu xmm3, xmmword [rcx]
movdqa xmm0, xmmword [0x140038bf0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140038c00]
pcmpgtb xmm1, xmm0
pcmpgtb xmm4, xmm2
movdqa xmm5, xmmword [0x140038be0]
pand xmm1, xmm4
pand xmm1, xmm5
pxor xmm0, xmm0
movdqa xmm4, xmmword [0x140038bf0]
paddb xmm2, xmm1
movdqa xmm5, xmmword [0x140038c00]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm4
pcmpgtb xmm5, xmm3
movdqa xmm4, xmmword [0x140038be0]
pand xmm1, xmm5
pand xmm1, xmm4
pcmpeqb xmm0, xmm2
paddb xmm3, xmm1
pcmpeqb xmm2, xmm3
pmovmskb r10d, xmm2
xor r10d, 0xffff
jne 0x140014c01
pmovmskb ebp, xmm0
test ebp, ebp
jne 0x140014c7c
add r8, 0xfffffffffffffff0
add rax, 0x10
add rcx, 0x10
test r8d, r8d
jle 0x140014c7c
dec edx
dec r9d
je 0x140014b4a
test edx, edx
jne 0x140014a78
jmp 0x140014b3c
nop
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
xor ebp, ebp
jmp 0x140014b5e
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rbp
mov ebp, eax
and ebp, 0xfff
neg ebp
add ebp, 0x1000
test edx, edx
jne 0x140014b79
mov r9d, ecx
and r9d, 0xfff
neg r9d
add r9d, 0x1000
cmp ebp, r9d
cmovb ebp, r9d
mov r9d, ebp
cmp r8, r9
jae 0x140014b87
movsxd r9, r8d
mov ebp, r8d
sub r8, r9
movzx r10d, byte [rax]
lea r9d, [r10 - 0x41]
cmp r9d, 0x19
lea r11d, [r10 + 0x20]
movzx r9d, byte [rcx]
cmovbe r10d, r11d
lea r15d, [r9 - 0x41]
cmp r15d, 0x19
lea r11d, [r9 + 0x20]
cmovbe r9d, r11d
cmp r10d, r9d
jne 0x140014c8d
test r10d, r10d
je 0x140014c7c
inc rax
inc rcx
dec ebp
jne 0x140014b8a
test r8, r8
je 0x140014c7c
mov r9, rax
and r9, 0xfff
neg r9d
add r9d, 0x1000
shr r9d, 4
test r9d, r9d
je 0x140014b4a
jmp 0x140014c5a
xor eax, eax
add rsp, 0x38
ret
bsf r9d, r10d
mov edx, r9d
mov r15, qword [rsp + 0x20]
cmp rdx, r8
mov rbp, qword [rsp + 0x28]
jae 0x140014bfa
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140014c2a
bsf r8d, r8d
cmp r9d, r8d
ja 0x140014bfa
movzx eax, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
lea r8d, [rax - 0x41]
cmp r8d, 0x19
lea r9d, [rax + 0x20]
lea edx, [r10 - 0x41]
cmovbe eax, r9d
cmp edx, 0x19
lea ecx, [r10 + 0x20]
cmovbe r10d, ecx
sub eax, r10d
add rsp, 0x38
ret
mov rdx, rcx
and rdx, 0xfff
neg edx
add edx, 0x1000
shr edx, 4
test edx, edx
je 0x140014b3c
jmp 0x140014a78
mov r15, qword [rsp + 0x20]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
sub r10d, r9d
mov r15, qword [rsp + 0x20]
mov eax, r10d
mov rbp, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x1400154d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r14
push r15
sub rsp, 0xd8
mov r15d, ecx
mov dword [rsp + 0xf8], edx
test r15d, r15d
mov qword [rsp + 0x100], r8
mov qword [rsp + 0x108], r9
je 0x1400155f8
cmp dword [0x14003de40], 0
je 0x14001556b
mov dword [0x14003de40], 0
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rdx, str._lu__s
lea rcx, [rsp + 0x40]
mov r8d, eax
lea r9, str.irc_msg.dll
call fcn.1400190b4
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140045de0], rax
test rax, rax
je 0x14001556b
movsxd rdx, r15d
lea rax, [0x140002000]
shl rdx, 4
mov dword [0x14003de44], 0
mov r14, qword [rax + rdx + 0x35768]
jmp 0x14001558d
mov r9d, dword [0x14003de44]
movsxd rdx, r15d
lea rax, [0x140002000]
shl rdx, 4
test r9d, r9d
mov r14, qword [rax + rdx + 0x35768]
jne 0x1400155ff
mov r11, rsp
add r15d, 0x80000000
mov rdx, qword [0x140045de0]
mov ecx, 0x900
mov r8d, r15d
mov r9d, 0x409
lea r10, [rsp + 0xc0]
mov qword [r11 + 0x20], r10
mov dword [r11 + 0x28], 0x200
mov qword [r11 + 0x30], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x1400155ff
mov r14, qword [rsp + 0xc0]
mov rcx, r14
call fcn.14001e550
mov r15, rax
cmp r15, 1
jbe 0x1400155ff
lea r8, [r15 - 2]
cmp byte [r8 + r14], 0xd
je 0x14001565e
jmp 0x1400155ff
lea r14, [0x14002a518]
cmp dword [rsp + 0xf8], 0
jle 0x14001564f
lea r8, [rsp + 0x100]
mov qword [rsp + 0xc8], r8
lea rcx, [0x1400457e0]
mov rdx, r14
mov r8, qword [rsp + 0xc8]
call fcn.140019e4c
mov qword [rsp + 0xc8], 0
lea rax, [0x1400457e0]
add rsp, 0xd8
pop r15
pop r14
ret
mov rax, r14
add rsp, 0xd8
pop r15
pop r14
ret
cmp byte [r14 + r15 - 1], 0xa
jne 0x1400155ff
lea rcx, [0x1400459e0]
mov rdx, r14
call fcn.140028bf0
lea rax, [0x140002000]
lea r14, [0x1400459e0]
mov byte [rax + r15 + 0x439de], 0
jmp 0x1400155ff