joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4043c3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a1e0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4043a0
cmp byte [0x0062f00b], 0
je 0x468835
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x465a60
jmp 0x4043a0

Function at 0x468840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0062f300]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0062f00b], 0
je 0x468875
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0062f620]
aesenc xmm0, xmmword [0x0062f630]
aesenc xmm0, xmmword [0x0062f640]
movq rax, xmm0
ret
jmp 0x40a400

Function at 0x468880
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0062f300]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0062f00b], 0
je 0x4688b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0062f620]
aesenc xmm0, xmmword [0x0062f630]
aesenc xmm0, xmmword [0x0062f640]
movq rax, xmm0
ret
jmp 0x40a460

Function at 0x46a660
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46a694
mov rcx, 0x28
jmp 0x46a69f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0062f220], rcx
pop rbp
ret
Function at 0x484c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484cca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403920
xorps xmm15, xmm15
mov r14, qword [0x0062f220]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x484caf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004c4160]
xor ebx, ebx
mov rcx, rdx
call fcn.0044dcc0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00485a60
inc rbx
cmp rcx, rbx
jae 0x484c9e
mov edi, 1
lea rsi, [0x004c4160]
call fcn.0044dda0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0050b0f8]
lea rsi, [0x0050a8d8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00466a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00484c00

Function at 0x4a9660
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9d9f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4a968d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4a9911
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4a993d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x0050c6e0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004c4060]
lea rbx, [0x0050afd0]
call fcn.00437000
inc rax
cmp rax, r8
jge 0x4a9962
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4a9997
lea rdi, [0x004c40e0]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4a9683
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4a997b
jmp 0x4a9950
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00466a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004a9660

Function at 0x4a9f40
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4a9f57
inc rax
cmp rax, 4
jge 0x4a9f6f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4a9f54
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4a9f80
inc rax
cmp rax, 4
jge 0x4a9f8e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4a9fb7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4a9f9b
jmp 0x4a9f7d
Function at 0x2fc4d28e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d39c0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d32e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f5108]
test eax, eax
je 0x2fc4d337a
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f5110]
mov qword [rbp - 8], rax
jmp 0x2fc4d335e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d3352
cmp qword [rbp - 0x10], 0
je 0x2fc4d3352
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d3318
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d337b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d3480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d34a8
mov eax, 0
jmp 0x2fc4d34f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d34d1
mov eax, 0
jmp 0x2fc4d34f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d34f1
mov eax, 0
jmp 0x2fc4d34f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d34fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d357a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d3571
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d3571
mov rax, qword [rbp - 8]
jmp 0x2fc4d358f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d3544
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using base64
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403ad156

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403aed96

Function at 0x1400e0200
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
cwd
mov rdx, 0x66a23644
lea edx, [r8 + 2]
jmp 0x140171b36
jmp 0x1404b039b
mov qword [rsp + 8], rbx
cmc
mov dword [rsp + 0x18], r8d
rcr rbx, 0xe2
rcr bx, cl
or bx, 0x44a3
mov dword [rsp + 0x10], edx
neg bx
clc
push rbp
btc ebp, 0x1e
mov rbp, rsp
sub rsp, 0x50
rol bx, 0xa3
mov ebx, ecx
cmp r10b, dl
stc
test r8d, r8d
jmp 0x1404b03d8
jne 0x1404b0466
xor ecx, ecx
jmp 0x1404b03e5
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1404b03f3
je 0x1404b0466
mov ecx, 0x5a4d
jmp 0x1404b0406
cmp word [rax], cx
jne 0x1404b0466
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
jmp 0x1404b041b
cmp dword [rcx], 0x4550
jne 0x1404b0466
mov eax, 0x20b
jmp 0x1404b0431
cmp word [rcx + 0x18], ax
jne 0x1404b0466
cmp dword [rcx + 0x84], 0xe
jbe 0x1404b0466
cmp dword [rcx + 0xf8], 0
jmp 0x1404b0454
je 0x1404b0466
mov ecx, ebx
jmp 0x1404b0461
call fcn.1404b025a
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
jmp 0x1404b0473
mov qword [rbp - 0x20], rax
cwd
lea r9, [rbp - 0x2c]
cwd
lea rax, [rbp + 0x20]
movzx r8, r11w
mov qword [rbp - 0x18], rax
cwd
lea r8, [rbp - 0x20]
xchg dl, ch
cwd
cdq
lea rax, [rbp + 0x28]
movsx cx, r10b
cdq
mov cl, r12b
mov qword [rbp - 0x10], rax
bswap cx
lea rdx, [rbp - 0x28]
cbw
movsx eax, bx
nop
mov eax, 2
movzx rcx, bp
movsx ecx, cx
lea rcx, [rbp - 0x30]
jmp 0x1404b04ca
mov dword [rbp - 0x2c], eax
jmp 0x1404b04d2
mov dword [rbp - 0x28], eax
call fcn.1404b0679
cmp dword [rbp + 0x20], 0
jmp 0x1404b04e3
je 0x1404b0503
mov rbx, qword [rsp + 0x60]
cmovae bp, r13w
shl rbp, cl
add rsp, 0x50
not ebp
pop rbp
jmp 0x1404b0502
ret
mov ecx, ebx
jmp 0x1404b050a
call fcn.1404b030b
int3
Function at 0x1400fcf4e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub r8d, r8d
jmp 0x1401e2068
jmp 0x1404e491c
mov qword [rsp + 8], rbx
xor bx, 0x3d11
bts rbx, r12
push rdi
shl di, cl
sub rsp, 0x40
btc rbx, 0x2a
movzx edi, r9w
btc edi, edi
mov rbx, rdx
mov rdi, rcx
test r9b, al
cmp spl, 0xef
test rcx, rcx
jmp 0x1404e4953
jne 0x1404e4975
call fcn.1404b4780
mov dword [rax], 0x16
call fcn.1404b545c
xor eax, eax
jmp 0x1404e4970
jmp 0x1404e4a54
test rbx, rbx
jmp 0x1404e497d
je 0x1404e4959
cmp rdi, rbx
jmp 0x1404e498b
jae 0x1404e4969
mov rdx, r8
not ch
mov cl, r11b
movsx cx, al
lea rcx, [rsp + 0x20]
call fcn.1404a396d
mov rcx, qword [rsp + 0x30]
add dl, r9b
adc dl, r15b
lea rdx, [rbx - 1]
stc
cmp dword [rcx + 8], 0
jmp 0x1404e49c0
je 0x1404e4a24
dec rdx
cmp rdi, rdx
jmp 0x1404e49d1
ja 0x1404e49ed
movzx eax, byte [rdx]
stc
cmc
test r13w, 0x4301
test byte [rax + rcx + 0x19], 4
jne 0x1404e49c6
mov rcx, rbx
sub rcx, rdx
or dl, 0xc0
bt dx, 0xd8
shr rdx, cl
mov rdx, rbx
test r10, 0x6d2b168c
cmp r10b, 0x46
and ecx, 1
jmp 0x1404e4a15
sub rdx, rcx
dec rdx
jmp 0x1404e4a24
cmp byte [rsp + 0x38], 0
je 0x1404e4a4a
mov rcx, qword [rsp + 0x20]
movzx ebx, bp
rcl dil, cl
cmovb ax, r10w
and dword [rcx + 0x3a8], 0xfffffffd
movzx eax, r14w
mov rax, rdx
bsr rbx, rdx
sbb bl, 0xf8
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
mov dil, sil
bswap edi
pop rdi
jmp 0x1404e4a68
ret

Function at 0x140105eb6
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x1401f3a91
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jmp 0x1401f3a8b
movsxd r8, dword [rcx + 0x3c]
rcr r11w, 0x90
test r9d, 0x1f224e33
xor r9d, r9d
btr ax, bx
jmp 0x1401d5306
je 0x14024baa2
mov edx, dword [rax + 0xc]
stc
cmp r10, rdx
jmp 0x1400e4ed0
lea r8, [r8 + rcx]
test dx, 0x5337
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
stc
cmp spl, r15b
add rax, 0x18
clc
test sp, r11w
add rax, r8
test r11d, r11d
jmp 0x1401cbf0c
ret
jb 0x1401e01a1
inc r9d
test bx, 0x14d8
cmc
add rax, 0x28
test bh, 0x6e
cmp r9d, r11d
jmp 0x14024ba9c
jb 0x1401cbf12
xor eax, eax
jmp 0x1401e01a1

Function at 0x14011f2b7
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
test r12d, 0x704e71e9
cmp word [rcx], ax
jmp 0x14018cb6c
sub eax, eax
ret
jne 0x140126a15
movsxd rdx, dword [rcx + 0x3c]
cmc
add rdx, rcx
jmp 0x14026d684
ret
cmp dword [rdx], 0x4550
jne 0x140126a15
xor eax, eax
movsxd rcx, ebx
and al, 0x8b
mov ecx, 0x20b
adc al, spl
shl al, 0x2c
cmp word [rdx + 0x18], cx
sete al
jmp 0x1401f2c14

Function at 0x14017b32e
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
xchg r8b, r8b
ror r8b, 0xfd
rcl r8w, cl
xor ecx, ecx
mov r8b, bpl
mov r8b, 0xd1
lea r8d, [rdx + 1]
jmp 0x1404b039b

Function at 0x1401af3f4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
clc
cmc
test rsp, 0x18cc0d7e
xor edx, edx
jmp 0x1402799ac
jmp 0x1404b039b
Function at 0x1401d3c30
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
jmp 0x14044536a
mov rcx, qword [rcx]
jmp 0x140139571
push rsi
cmovle eax, edx
push rdi
not sil
sub rsp, 0x28
mov rsi, rcx
btc ax, 7
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
test r10b, dl
xor edx, edx
test sil, 0x89
sub r8d, r8d
call qword [rax + 0x188]
mov edi, eax
movzx rcx, r14w
xchg ecx, ecx
lea rcx, [rsi + 0x30]
jmp 0x1404453a8
call fcn.140458ecc
test edi, edi
jmp 0x1404453b4
je 0x1404453f7
cmp edi, 0x8899000c
jne 0x140445417
mov rcx, rsi
rol sil, 0xd3
movsxd rdi, r13d
bts esi, r13d
add rsp, 0x28
movsx di, al
not edi
movzx edi, r14w
pop rdi
movzx rsi, r9w
cmovae si, r14w
pop rsi
jmp 0x1404453f2
jmp fcn.140445024
nop
sar sil, cl
rcr sil, cl
add rsp, 0x28
movzx esi, cx
movsxd rsi, esp
sete sil
pop rdi
movsxd rsi, r13d
pop rsi
jmp 0x140445416
ret
mov ecx, edi
rol r8b, 0x73
add r9w, 0x4107
movabs r8, 0xad4a5352d2edebd0
mov dl, 3
cmc
mov r9d, 0x54
sub si, 0xb0f
add rsp, 0x28
pop rdi
mov si, 0x159e
movzx rsi, ax
jmp 0x14044544d
pop rsi
jmp 0x140445453
jmp fcn.1403af394
Function at 0x14027b3d2
Capabilities:
Access peb ldr_data

Disassembly:
cmovb r8, rdx
test r14b, cl
cmp edx, 0x531a3fd6
cmc
test ax, ax
jmp 0x1401b4efc
jne 0x1401a6b20
sub r8, rax
cmc
jmp 0x140134b46
test r8, r8
jmp 0x1401a19f4
je 0x140134b59
mov word [rcx], 0
ret
jmp 0x1401b4f02
je 0x1401a1a09
mov word [r10], 0
bt ax, 0x40
cmc
sal al, 0x51
movzx eax, word [0x1400b8f10]
ror r8b, 0xe4
shrd r8, rsp, 0xf9
sal r8b, cl
cmp rdx, 0x104
movsxd r8, r10d
cmove r8d, r14d
mov r8w, r13w
mov r8d, 0x104
jmp 0x1400ee569
mov rax, qword gs:[0x30]
movsxd r8, esi
mov rax, qword [rax + 0x60]
adc r8b, 0x8e
mov rax, qword [rax + 0x18]
test r15, rdi
mov rax, qword [rax + 0x10]
rcl r8b, 0x32
btr r10w, sp
shl r8b, cl
movzx r8d, word [rax + 0x58]
sar r10, 0xa7
bsr r11w, r15w
cmp r8, rdx
cmovae r8, rdx
test si, r14w
bsf r11w, r15w
movsxd r11, r11d
mov r9, qword [rax + 0x60]
setle r11b
movzx r11d, word [r9]
ror r10b, cl
lea r10, [0x1400b8f10]
test r11w, r11w
je 0x140134b46
xor eax, eax
nop word [rax + rax]
cmc
cmp r8, rax
jmp 0x1402439c7
je 0x14026c493
xor edx, edx
mov r9w, 0x1300
ror r9b, 0xe5
bt r9, 0xb5
lea r9, [0x1400b8f10]
test rdi, r15
cmp r8, rdx
jmp 0x140269f8f
inc rdx
test si, r12w
test ax, ax
jmp 0x14026c489
je 0x1401a19fa
mov word [r10], r11w
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
inc rax
test r11w, r11w
jmp 0x1400fcf3f
cmovb r8, rdx
jmp 0x14013ca43
mov r8d, 0x104
jmp 0x140258943
je 0x140134b54
mov word [rcx], ax
add rcx, 2
inc rax
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401d7164
jne 0x1401b4f1c
sub r8, rdx
clc
test r8, r8
jmp 0x140134b4e
movzx eax, word [0x1400b8f10]
cmp r11w, di
test ax, ax
je 0x1401a6aab
cmp rdx, 0x104
jmp 0x140269132

Function at 0x140296e06
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x14012de05
movzx eax, byte [rcx + 1]
jmp 0x14012ddf9
nop dword [rax]
movzx eax, byte [r8]
cmp r15, 0x1a696686
lea rdx, [rdx + 1]
clc
mov byte [rdx], al
cmc
lea r8, [r8 + 1]
clc
test al, al
jmp 0x1402648e0
inc rcx
stc
test al, al
jne 0x140271b75
movzx eax, byte [rcx - 1]
mov r8, rcx
dec rcx
test r10w, r13w
jmp 0x140241502
movzx eax, dl
test r11b, 3
cmp bpl, bl
cmc
cmp dl, r9b
jmp 0x14029345f
cmp al, 0x30
je 0x14024150a
cmp al, r9b
movzx dx, r11b
mov al, r9b
lea rdx, [rcx - 1]
cdqe
cbw
movsx ax, r10b
cmovne rdx, rcx
and al, r13b
sub ah, 0x64
jmp 0x14010001e
dec rcx
jmp 0x14019ec56
cmp al, 0x30
jne 0x14019ec5e
movzx eax, byte [rcx - 1]
jmp 0x1402140be
jne 0x140194049
inc rcx
test r14b, 0xf6
cmp r10b, r13b
test al, al
jmp 0x14024f17e
je 0x1402648e6
movzx eax, byte [rcx]
cmp r11b, 0x9f
test al, al
jmp 0x140271b6f
jne 0x140100025
ret
je 0x14012de05
sub al, 0x45
stc
test al, 0xdf
jmp 0x1400e172c
je 0x14024b636
movzx eax, byte [rcx + 1]
cdq
seta dh
cwd
inc rcx
cmc
shr rdx, cl
rol dl, cl
movzx edx, al
test r11b, bl
clc
test al, al
jmp 0x14024b630
mov rax, qword [rdx]
xor r9w, bp
mov rdx, qword [rax + 0xf8]
btr ax, 0x1f
mov rax, qword [rdx]
movzx r9d, byte [rax]
shr al, 0xf3
sal al, cl
movzx eax, byte [rcx]
test al, al
je 0x14024b636
movzx edx, al
mov ah, 0x65
movsxd rax, r10d
nop dword [rax + rax]
add rax, 0x50d7af3
jmp 0x140194049
Function at 0x1403bb7df
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
add eax, edi
push r14
movzx ax, bl
btc r14d, 0xc3
push r13
sbb eax, ebp
xchg al, r14b
push r12
push rsi
adc si, r14w
push rdi
or r14, rcx
xor al, r12b
rol sil, cl
push rbx
or r14b, r9b
sub rsp, 0x20
shl r14w, cl
mov rsi, r8
xor bh, 0x30
mov rdi, rdx
rcr bh, cl
mov r14, rcx
ror rbx, cl
mov eax, 0x302f0bc8
mov rbx, qword [rcx]
bts ax, cx
rol al, 0x1d
sbb ax, 0x704b
mov rcx, qword [rcx + 0x10]
sub rcx, rbx
rcl al, cl
bsr ax, si
sar rcx, 4
inc rax
movabs rax, 0xf0f0f0f0f0f0f0f1
cmp r11b, 3
test r15b, 0x8b
imul rcx, rax
test r15b, bl
cmp rcx, r8
jmp 0x1403bb86b
jae 0x1403bb8df
mov rcx, r14
mov rdx, rsi
jmp 0x1403bb87c
call fcn.1403bbabb
mov rbx, qword [r14]
mov rcx, 0x529657cf
movsx cx, r12b
nop word [rax + rax]
mov dl, r8b
movzx edx, r11w
movsx dx, r10b
mov rcx, rbx
movzx dx, r15b
cwd
mov rdx, rdi
call fcn.1403bc2ff
add rbx, 0x110
clc
cmp di, 0xabd
cmc
add rdi, 0x110
jmp 0x1403bb8d1
dec rsi
jne 0x1403bb8a5
jmp 0x1403bba83
mov r13, qword [r14 + 8]
mov r12, r13
bsf r15w, bp
sub r12, rbx
neg r15d
cmp sp, 0x3a0
sub r15b, 0x8e
sar r12, 4
rcr r15b, cl
cmovge r15w, bp
imul r12, rax
mov r15, r12
sub r15, rsi
jmp 0x1403bb915
jae 0x1403bb9c8
cmp rbx, r13
jmp 0x1403bb923
je 0x1403bb974
nop word cs:[rax + rax]
movsx dx, r14b
cwd
mov rcx, rbx
cwd
cmovbe rdx, rdi
mov rdx, rdi
jmp 0x1403bb94f
call fcn.1403bbd36
add rbx, 0x110
cmc
add rdi, 0x110
stc
cmc
cmp rbx, qword [r14 + 8]
jmp 0x1403bb96e
jne 0x1403bb93e
cmp rsi, r12
je 0x1403bba83
nop dword [rax + rax]
mov rcx, rbx
movsx dx, r14b
movsx rdx, dx
mov dh, 0xf8
mov rdx, rdi
call fcn.1403bc2ff
add rbx, 0x110
jmp 0x1403bb9ae
add rdi, 0x110
inc r15
jmp 0x1403bb9bd
jne 0x1403bb985
jmp 0x1403bba83
imul r15, rsi, 0x110
cmp rax, 0x39b270c
add r15, rbx
cmp di, r15w
test r14, r9
test rsi, rsi
je 0x1403bba34
nop
cwd
mov rcx, rbx
movsx dx, r9b
mov rdx, rdi
call fcn.1403bbd36
add rbx, 0x110
test rsi, 0x7dd508c8
clc
add rdi, 0x110
jmp 0x1403bba17
dec rsi
jmp 0x1403bba1f
jne 0x1403bb9ec
mov r13, qword [r14 + 8]
jmp 0x1403bba34
cmp r15, r13
jmp 0x1403bba3c
je 0x1403bba7c
mov rsi, r15
cmovo ecx, r9d
nop word [rax + rax]
not cl
mov cl, dil
mov rcx, rsi
jmp 0x1403bba5c
call fcn.1403b61e6
add rsi, 0x110
cmc
jmp 0x1403bba6e
cmp rsi, r13
jmp 0x1403bba76
jne 0x1403bba54
mov rbx, r15
neg r12w
mov qword [r14 + 8], rbx
or r14b, sil
add rsp, 0x20
movsxd r12, edi
movzx rsi, si
movsx r13, r13w
pop rbx
pop rdi
pop rsi
mov r13b, r10b
movzx r15w, r9b
pop r12
pop r13
mov r14, r8
pop r14
movsxd r15, r15d
movzx r15, r14w
movsx r15, cx
pop r15
ret
Function at 0x1403bd0ae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
rcl r12b, 0x4f
push rsi
push rdi
push rbx
sub rsp, 0x28
add r12d, 0x188b3c7b
mov r12, r8
test rax, r12
clc
test rdx, rdx
je 0x1403bd2d7
mov r15, rdx
sbb bl, sil
mov rbx, rcx
test r9, 0x19c4b0a
jmp 0x1403bd0eb
sub esi, esi
jmp 0x1403bd0f2
jmp 0x1403bd153
mov rcx, rdi
mov dx, 0x3bd3
movsx rdx, ax
not dx
mov rdx, r14
jmp 0x1403bd10d
call fcn.1403bae88
mov eax, dword [rbx + rsi + 0x58]
mov dword [r12 + rsi + 0x58], eax
mov rax, qword [rbx + rsi + 0x50]
cmp sil, r15b
stc
mov qword [r12 + rsi + 0x50], rax
cmp rbx, 0x62d13825
jmp 0x1403bd13c
add rsi, 0x60
jmp 0x1403bd145
dec r15
jmp 0x1403bd14d
je 0x1403bd2cc
mov eax, dword [rbx + rsi + 8]
mov dword [r12 + rsi + 8], eax
cmp r12, rbx
jmp 0x1403bd164
je 0x1403bd112
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403bd175
jb 0x1403bd18a
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403bd185
jmp 0x1403bd1a2
lea r9, [rbx + rsi]
rcl r14b, cl
movsx ax, bl
shl dil, 0x40
add r9, 0x10
shr r14w, 0xc9
lea r14, [r12 + rsi]
seto dil
sub ax, 0x7d91
add r14, 0x10
and dil, 0x6c
rol dil, cl
mov rdi, qword [rbx + rsi + 0x20]
lahf
cmovae ax, cx
mov rax, qword [r12 + rsi + 0x28]
test bl, 0x88
cmp rax, rdi
jmp 0x1403bd1d3
jae 0x1403bd1f6
mov rcx, r14
movsx edx, r12w
movzx dx, dh
mov rdx, rdi
jmp 0x1403bd1ec
call fcn.1403bae88
jmp 0x1403bd239
cmp rax, 0x10
jmp 0x1403bd1ff
jb 0x1403bd20a
mov r14, qword [r12 + rsi + 0x10]
mov qword [r12 + rsi + 0x20], rdi
movsx edx, r13w
cqo
mov rcx, r14
mov rdx, r9
movzx r8w, bpl
mov r8, rdi
jmp 0x1403bd228
call fcn.1404a29dd
mov byte [r14 + rdi], 0
mov r14, 0x62ac16b3
mov r14, qword [rbx + rsi + 0x40]
stc
cmp qword [rbx + rsi + 0x48], 0x10
jmp 0x1403bd24a
jb 0x1403bd25f
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403bd25a
jmp 0x1403bd26f
lea r9, [rbx + rsi]
sar dil, 0x6f
rol dil, 0x1d
add r9, 0x30
lea rdi, [r12 + rsi]
xor ax, r9w
rol rax, cl
add rdi, 0x30
mov rax, qword [r12 + rsi + 0x48]
test r8b, dl
cmp rax, r14
jmp 0x1403bd28e
jb 0x1403bd0f7
cmp rax, 0x10
jmp 0x1403bd29d
jb 0x1403bd2a8
mov rdi, qword [r12 + rsi + 0x30]
mov qword [r12 + rsi + 0x40], r14
mov ch, 0x28
mov rcx, rdi
mov rdx, r9
movsx r8, r13w
mov r8, r14
call fcn.1404a29dd
mov byte [rdi + r14], 0
jmp 0x1403bd112
lea r12, [r12 + rsi]
bswap ax
inc r15w
mov rax, r12
cmovns si, bx
adc r12b, 0x14
rcr r15, 0x16
add rsp, 0x28
mov dil, r14b
pop rbx
movsx rdi, cx
xchg rsi, r12
pop rdi
pop rsi
movsx r14d, r12w
mov r12w, 0x38c6
pop r12
cmovae r15, rbp
xchg r14w, r15w
movsx r15, r8w
pop r14
movsxd r15, esi
movzx r15, cx
movzx r15w, bl
pop r15
jmp 0x1403bd323
ret