joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14041a8bc
Capabilities:
Encode data using xor

Disassembly:
invalid
mov edx, dword [rsp + rdx - 0x2c0820ba]
mov qword [rsp + 0x18], 0x40a59930
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.14052c430
mov r9, qword [rsp + r9*2 - 0x5d9350c0]
not dword [rsp + 0x40]
call fcn.14003c585
and dword [rdx + rdi*8 + 0x6bb6be27], ebx
movabs al, byte [0x6d2b4f3ff6820d94]
jne 0x14041a869
bnd jbe 0x14041a92d
lahf
test byte cs:[rsi], dh
test byte [rsi], dh
out 0xbe, eax
scasb al, byte [rdi]
jge 0x14041a877
scasb al, byte [rdi]
mov eax, dword [rbp + 0x69]
mov r10b, 0x11
out 0x6d, al
leave
push rbp
js 0x14041a931
cdq
fsub qword ss:[0x109a813d6]
movsd dword [rdi], dword [rsi]
adc al, 4
sahf
pop rsi
int1
xchg ebx, eax
mov dh, 0x70
pop rsp
jp 0x14041a91a
xchg edi, eax
sub dword ss:[rdx], 0xffffff8d
jbe 0x14041a8e7
mov ch, 0x8e
mov dh, 0xc6
punpckhwd mm7, qword [rcx + rcx*8 - 0x1a]
invalid
xchg ebp, eax
cld
fsub dword [rcx + 0x74419b3]
invalid
movabs eax, dword [0xda9bea66074419b3]
movsd dword [rdi], dword [rsi]
pop rdi
xchg ebx, edi
lea di, fs:[rcx]
xor byte [rdx + 0x5fa5da9a], ch
sub ebx, dword [rbx]
jnp 0x14041a93a
fst qword [rsp + rbp]
mov edi, 0xe198d8c3
invalid

Function at 0x1404238bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rax, [r8 + 4]
movzx ecx, r10w
movzx rcx, cx
mov ecx, ecx
mov ecx, dword [r8]
jmp 0x1404c96ef
neg dword [rsp + 0x48]
call fcn.1403353eb
test r11b, r13b
clc
shr eax, cl
xadd ecx, ecx
mov dword [r9 + 0x1c], eax
shr cx, cl
bts ecx, esp
movzx ecx, byte [r8]
sal ax, cl
and ecx, 0xf
or ax, 0x12a5
shr ax, 0x10
movsx rax, byte [rcx + r10 + 0xb3b18]
clc
mov cl, byte [rcx + r10 + 0xb3b28]
test r9b, 0x16
clc
stc
sub r8, rax
adc al, 0x18
bsr ax, r15w
mov eax, dword [r8 - 4]
shr eax, cl
rcl cx, cl
shld cx, di, 0x8e
btc cx, 0x82
cmp dword [rdx + 8], 0
bswap cx
mov qword [r9 + 8], r8
sete cl
mov dword [r9 + 0x20], eax
jmp 0x1400fc126
mov dword [r9 + 0x24], ecx
jmp 0x140431441
mov qword [r9 + 8], rax
jmp 0x14046ba7b

Function at 0x1404313ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], 0xffffffff85cd2cc9
lea rsp, [rsp + 8]
call fcn.1405dd4da
Function at 0x140431401
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret
call fcn.1400538f8
sub cl, byte [rsi]
invalid
mov eax, dword [rdx - 4]
test r10, r12
mov qword [r9 + 8], rdx
cmp rsi, 0x751a1b9e
cmc
test dil, r11b
shr eax, cl
and cl, 3
mov dword [r9 + 0x18], eax
lahf
cmp ebp, r11d
movzx ecx, byte [rdx]
shrd ax, r13w, 0x85
dec ax
and ecx, 0xf
bts ax, r15w
xor ax, 0xa48d
movsx rax, byte [rcx + r10 + 0xb3b18]
cmp spl, 0x99
test bpl, r15b
mov cl, byte [rcx + r10 + 0xb3b28]
cmc
sub rdx, rax
movsx ax, dl
rol ah, cl
cbw
mov eax, dword [rdx - 4]
cmp r8, 0x38beef06
mov qword [r9 + 8], rdx
shr eax, cl
stc
sub cx, cx
movzx rcx, r12w
mov dword [r9 + 0x1c], eax
rcr cl, 0xa2
movzx ecx, byte [rdx]
mov rax, 0x60c538d
btr ax, dx
setl ah
and ecx, 0xf
movsx rax, byte [rcx + r10 + 0xb3b18]
mov cl, byte [rcx + r10 + 0xb3b28]
cmp spl, sil
cmp sil, 0xb0
sub rdx, rax
mov eax, dword [rdx - 4]
clc
mov qword [r9 + 8], rdx
cmp sp, 0xf99e
test r9b, r9b
shr eax, cl
movzx ecx, sp
movsx rcx, bp
cmc
mov dword [r9 + 0x20], eax
movsx cx, dl
mov cl, 0xbd
sbb cl, r13b
mov eax, dword [rdx]
btr rcx, 1
add rdx, 4
shr ecx, cl
clc
mov dword [r9 + 0x24], eax
inc ch
stc
mov qword [r9 + 8], rdx
xadd cx, cx
inc ah
btc rax, 0x2d
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r10 + 0xb3b18]
mov cl, byte [rcx + r10 + 0xb3b28]
test bpl, 0x89
sub rdx, rax
add al, 0x28
mov eax, dword [rdx - 4]
test r15, r12
shr eax, cl
bsr ecx, ecx
sub cx, 0xc2a2
mov qword [r9 + 8], rdx
mov dword [r9 + 0x18], eax
dec ch
movsx rax, r15w
movzx ecx, byte [rdx]
rcl eax, cl
and ecx, 0xf
movsx rax, byte [rcx + r10 + 0xb3b18]
cmp bl, dil
test esi, r11d
mov cl, byte [rcx + r10 + 0xb3b28]
jmp fcn.14008d64d
shr r11d, 0x41
mov bpl, 0x8c
lea rax, [rax + r11 - 0x77cbcbd9]
sub qword [rsp + r11*2 - 0x69b49994], r11
jo 0x140349d2c
neg r11
setg bpl
not ebp
cmp rbp, qword [rsp + 0x28]
xchg qword [rsp + r11 + 0x34da4d16], rax
mov r11, qword [rsp + r11*2 + 0x69b499ec]
call fcn.14046ef1f
je 0x1400b1c7c
mov r8d, dword [rdx + 8]
and dh, 0xb4
cmovl dx, bp
mov rdx, qword [r9 + 8]
shrd ax, bp, 0x9a
movzx ecx, byte [rdx]
ror rax, cl
and ecx, 0xf
movsx rax, byte [rcx + r10 + 0xb3b18]
clc
cmc
test bh, 0x88
mov cl, byte [rcx + r10 + 0xb3b28]
sub rdx, rax
jmp 0x140428856

Function at 0x140466f04
Capabilities:
Packed with generic packer

Disassembly:
test rsi, 0xffffffff9cbc062c
lea rbp, [rbp + rbp*4 + 0x4ebffb35]
push rbp
bswap ebp
push r15
mov rbp, qword [rsp + rbp - 0x34f520bd]
mov rbp, qword [rbp + riz]
movabs r15, 0xb5b46327edb0a126
mov qword [rsp + 0x30], r15
jbe 0x14038b261

Function at 0x140466f5a
Capabilities:
Packed with generic packer

Disassembly:
mov qword [rsp + 0x38], rdi
neg rbp
sub bpl, 0xc
shl bpl, 0xf5
call fcn.1404b9bb1
invalid
shl ebp, 0x46
jbe 0x1400aa9d7
and bpl, 0x33
neg bp
shl ebp, 0xb2
ja 0x140362e3d
xor eax, 0xe427d8c9
cmpsb byte [rsi], byte [rdi]
invalid

Function at 0x1404682d5
Capabilities:
Encode data using xor

Disassembly:
cmovl r11d, r14d
mov r14, qword [rsp + 0x28]
jbe 0x14035597e
Function at 0x1404c03f7
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
js 0x14008d17d
movabs rcx, 0x41be0715bc1e31ba
mov rcx, qword [rsp + 0x18]
mov rcx, qword [rcx]
movzx edi, di
neg dil
cmp edi, 0x75922011
lea rdi, [rdi + rdi*8 - 0x1f4a78cd]
call fcn.140066b2f
or dword [rdx], eax
add byte [rax - 0x75], cl
mov rax, qword [0x1400cc768]
cmp r14b, 0x8f
add rax, 8
jmp loc.14000f4c6
ja 0x14005314d
jl 0x1404c03cc
add dword [r14], r10d
add al, byte [rax]
invalid

Function at 0x1404e090a
Capabilities:
Packed with generic packer

Disassembly:
ja fcn.140466f5a
neg si
shr r14b, 0x4b
sete r13b
neg r13
bswap r14
add qword [rsp + 0x18], 0x178f5
push r15
bswap r13
sub sil, 8
test r14, 0xffffffffd78d6d1c
mov rax, qword [rsp + 0x20]

Function at 0x1404e5b21
Capabilities:
Encode data using xor

Disassembly:
test word [rsp + rdi*4 + 0x7368b574], di
jns 0x14037b9ba
Function at 0x140696cad
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
sub al, 0xae
xadd al, ah
mov qword [rsp + 8], rcx
sal al, cl
bsf ax, r11w
or al, 0x11
sub rsp, 0x28
cmovae rax, r12
movsx rax, r10w
mov eax, dword [rsp + 0x40]
jmp 0x140696cdf
not eax
jmp 0x140696ce6
mov dword [rsp], eax
cbw
movzx ax, r8b
jmp 0x140696cf5
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
seta al
cwde
cmovg eax, ebx
lea rax, [0x1400bd3d0]
jmp 0x140696d12
mov qword [rsp + 0x18], rax
movsxd rax, esp
mov rax, qword [rsp + 0x38]
jmp 0x140696d24
mov qword [rsp + 0x10], rax
bswap rax
cdqe
mov al, r10b
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
test r10b, 0x8f
cmp rcx, 0x10977a5
cmp qword [rsp + 0x10], 0
jmp 0x140696d54
je 0x140696de3
mov eax, dword [rsp]
movsx rdx, sp
sub ch, 0xaf
adc cl, bpl
shr eax, 8
or dl, dil
mov ecx, dword [rsp]
movzx dx, r14b
cmp r11b, 0xa9
and ecx, 0xff
cqo
shr edx, cl
mov rdx, qword [rsp + 8]
cmp r8d, 0x31af6903
clc
movzx edx, byte [rdx]
test r11w, 0x8bd
cmp r15, 0x5eb5e7a9
xor ecx, edx
sal dl, 0xb2
or dh, dh
mov ecx, ecx
inc dl
movzx edx, r9w
and dx, 0x1680
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
jmp 0x140696dca
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
jmp 0x140696ddb
mov dword [rsp], eax
jmp 0x140696d1a
mov eax, dword [rsp]
clc
not eax
cmc
clc
add rsp, 0x28
jmp 0x140696df4
ret
Function at 0x1406997f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x20], r9b
cbw
sbb rax, rcx
shld ax, cx, 0x82
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
movsx ax, r12b
mov qword [rsp + 8], rcx
movsx rax, r13w
sbb eax, 0xd7821784
sub rsp, 0x98
rcr rax, 0x8a
mov rax, qword [0x1400cc768]
mov qword [rsp + 0x58], rax
sbb eax, eax
sbb al, 0xae
bt rax, 0x34
mov rax, qword [rsp + 0x58]
clc
mov rax, qword [rax + 0x1a80]
clc
test r10d, 0xee23c5b6
mov qword [rsp + 0x78], rax
ror rax, cl
movzx eax, byte [rsp + 0xb8]
jmp 0x14069986c
test eax, eax
jmp 0x140699873
je 0x1406998a3
mov rdx, qword [rsp + 0xb0]
mov cl, 0x23
movsx ecx, r15w
mov rcx, qword [rsp + 0xa8]
call fcn.1406996f6
mov qword [rsp + 0x60], rax
jmp 0x14069989e
jmp 0x140699948
cmp qword [rsp + 0xb0], 0
jmp 0x1406998b1
jne 0x140699932
mov rax, qword [rsp + 0xa8]
movzx ecx, r9w
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
cwde
movzx rcx, r11w
bswap cx
inc qword [rsp + 0x50]
sar cl, cl
inc ch
setns ah
mov rax, qword [rsp + 0x70]
bts rcx, rsp
mov rcx, qword [rsp + 0x50]
cmp esi, r12d
clc
cmp byte [rax + rcx], 0
jmp 0x140699900
jne 0x1406998d9
mov rax, qword [rsp + 0x50]
sbb ch, 0x9e
mov rcx, qword [rsp + 0xa8]
cmp bp, si
add rcx, rax
neg ah
xor rax, 0xffffffffa31cef31
mov rax, rcx
mov qword [rsp + 0xb0], rax
and al, 0xa0
mov rax, qword [rsp + 0xb0]
cmc
clc
mov qword [rsp + 0x60], rax
btr ax, dx
bts eax, edx
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0xa8], rax
jmp 0x14069995a
je 0x140699ab1
mov rax, qword [rsp + 0x78]
cmp r12w, bp
test sil, cl
test sil, 0xa9
mov rax, qword [rax + 0x2b0]
cmp r10b, 0x11
clc
mov qword [rsp + 0x88], rax
cmp dh, 0xb4
movss xmm1, dword [0x1400c1a58]
sub ecx, ecx
call fcn.140698ee3
mov dword [rsp + 0x68], eax
movsx r9, r11w
mov rax, qword [rsp + 0x58]
movss xmm0, dword [rax + 0x1928]
cbw
movss dword [rsp + 0x6c], xmm0
mov rax, qword [rsp + 0x58]
cmovs r9w, bx
not rdx
movzx ecx, sp
mov rax, qword [rax + 0x1920]
movzx r9w, r15b
mov qword [rsp + 0x80], rax
cdqe
mov qword [rsp + 0x40], 0
xorps xmm0, xmm0
cwd
cbw
movsxd rcx, ebp
movss dword [rsp + 0x38], xmm0
jmp 0x1406999fd
mov rax, qword [rsp + 0x60]
movsx dx, r10b
cmovb edx, edi
mov qword [rsp + 0x30], rax
cdq
mov rax, qword [rsp + 0xa8]
movsx rcx, si
cwd
xchg dl, dh
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x68]
mov r9d, r14d
movsxd r9, r13d
mov dword [rsp + 0x20], eax
movsx edx, di
movsxd r9, edx
lea r9, [rsp + 0xa0]
movsxd rdx, ebp
movss xmm2, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x80]
movsx cx, bl
mov rcx, qword [rsp + 0x88]
jmp 0x140699a63
call fcn.1406e8922
mov rax, qword [rsp + 0x58]
jmp 0x140699a72
movzx eax, byte [rax + 0x3048]
clc
test r10b, 0x17
cmp bh, bl
test eax, eax
jmp 0x140699a87
je 0x140699ab1
mov r8, qword [rsp + 0x60]
mov rdx, rax
not edx
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0xa0]
jmp 0x140699aac
call fcn.1406c6906
add rsp, 0x98
jmp 0x140699abd
ret
Function at 0x140699abe
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
movss dword [rsp + 0x20], xmm3
xor ah, bh
sar al, 0x2c
mov qword [rsp + 0x18], r8
shr eax, cl
mov qword [rsp + 0x10], rdx
clc
bswap ax
mov qword [rsp + 8], rcx
and al, bpl
movsx rax, r11w
movsxd rax, r10d
sub rsp, 0x98
movsx ax, dil
inc al
bt rax, r11
mov rax, qword [0x1400cc768]
mov qword [rsp + 0x60], rax
xadd ax, ax
bt rax, 0x92
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x1a80]
cmp r11b, 0x22
mov qword [rsp + 0x70], rax
test dil, dil
cmp qword [rsp + 0xb0], 0
jmp 0x140699b35
jne 0x140699bc6
mov rax, qword [rsp + 0xa8]
xchg ch, ch
movzx cx, r14b
mov qword [rsp + 0x68], rax
movsx eax, si
movzx eax, bx
inc cx
mov qword [rsp + 0x58], 0xffffffffffffffff
lahf
inc qword [rsp + 0x58]
shr ecx, cl
cmp al, dil
add cl, 0xd
mov rax, qword [rsp + 0x68]
setl ch
mov rcx, qword [rsp + 0x58]
test r8b, 0x31
cmp byte [rax + rcx], 0
jmp 0x140699b89
jne 0x140699b62
mov rax, qword [rsp + 0x58]
adc cx, r11w
mov rcx, qword [rsp + 0xa8]
jmp 0x140699ba5
add rcx, rax
movsx eax, r11w
clc
mov rax, rcx
cmp cx, 0x63b2
test r13w, 0x98b5
test rcx, r11
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rsp + 0xa8], rax
jmp 0x140699bdb
je 0x140699d4e
mov rax, qword [rsp + 0x70]
cmp bp, 0x7522
cmp r15b, cl
jmp 0x140699bf3
mov rax, qword [rax + 0x2b0]
cmc
mov qword [rsp + 0x80], rax
movss xmm1, dword [0x1400c1a58]
sub ecx, ecx
jmp 0x140699c12
call fcn.140698ee3
mov dword [rsp + 0x50], eax
bswap r9w
cwde
movzx eax, bp
mov rax, qword [rsp + 0x60]
movss xmm0, dword [rax + 0x1928]
movss dword [rsp + 0x54], xmm0
movsx rcx, di
cdq
mov rax, qword [rsp + 0x60]
cdq
mov rax, qword [rax + 0x1920]
cqo
mov qword [rsp + 0x78], rax
movzx r9w, bl
cqo
mov qword [rsp + 0x40], 0
movzx cx, r15b
mov r9b, r13b
rdtsc
movss xmm0, dword [rsp + 0xb8]
rdtsc
cmove rax, rdi
movss dword [rsp + 0x38], xmm0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa8]
movzx r9, r11w
mov dl, spl
movsx ecx, r13w
mov qword [rsp + 0x28], rax
movsx cx, bpl
bswap eax
mov eax, dword [rsp + 0x50]
cmovae r9d, eax
movzx r9, r8w
setne r9b
mov dword [rsp + 0x20], eax
xchg r9b, cl
movzx rdx, cx
lea r9, [rsp + 0xa0]
mov ch, dh
bswap dx
not cx
movss xmm2, dword [rsp + 0x54]
cmovne rcx, rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
jmp 0x140699cf1
call fcn.1406e8922
mov rax, qword [rsp + 0x60]
clc
jmp 0x140699d01
movzx eax, byte [rax + 0x3048]
jmp 0x140699d0d
test eax, eax
jmp 0x140699d14
je 0x140699d4e
mov r8, qword [rsp + 0xb0]
not dx
movzx ecx, cx
mov rdx, qword [rsp + 0xa8]
movsx rcx, r10w
movzx cx, r10b
movsx ecx, si
lea rcx, [rsp + 0xa0]
jmp 0x140699d49
call fcn.1406c6906
add rsp, 0x98
ret
Function at 0x1406a55ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [rsp + 0x18], r8b
jmp 0x1406a55d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
jmp 0x1406a55e6
mov rax, qword [0x1400cc768]
mov qword [rsp + 0x20], rax
sub ah, 0xa
or eax, 0x58a25d88
mov rax, qword [rsp + 0xb0]
clc
cmc
mov rax, qword [rax]
test rdx, r9
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xb8]
cmc
stc
mov rax, qword [rax]
clc
jmp 0x1406a5622
mov qword [rsp + 0x50], rax
setne al
movzx eax, byte [rsp + 0xc0]
test rbx, 0x9b5d42f
test eax, eax
jmp 0x1406a5640
je 0x1406a5671
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x1a80]
add rax, 0x258
mov cx, 0xa18d
mov rdx, rax
mov cl, spl
lea rcx, [rsp + 0x48]
jmp 0x1406a566c
call fcn.1406906ee
mov rax, qword [rsp + 0x20]
add rax, 0x15c0
stc
cmc
mov qword [rsp + 0x58], rax
xor cl, r9b
mov rax, qword [rsp + 0x58]
movzx rcx, r8w
movss xmm0, dword [rsp + 0x54]
ror edx, cl
addss xmm0, dword [rax + 4]
movss dword [rsp + 0x30], xmm0
sbb ax, 0xe79f
test r15, rax
mov rax, qword [rsp + 0x58]
neg dx
movss xmm0, dword [rsp + 0x50]
bsr cx, si
addss xmm0, dword [rax]
movss dword [rsp + 0x28], xmm0
sbb cx, 0xad3b
sar rdx, cl
movzx rcx, bx
movss xmm0, dword [rsp + 0x28]
movss dword [rsp + 0x60], xmm0
and ax, r8w
cmc
btr rdx, 0x11
movss xmm0, dword [rsp + 0x30]
btr dx, 0x9d
rcr cx, cl
movss dword [rsp + 0x64], xmm0
stc
rcr dl, 0xa4
sar dx, 0x96
lea rax, [rsp + 0x60]
sal dx, cl
movsx ecx, bp
dec cl
mov qword [rsp + 0x80], rax
cbw
rdtsc
mov rax, qword [rsp + 0x20]
add rax, 0x15c0
inc dh
mov qword [rsp + 0x68], rax
rdtsc
shrd dx, r15w, 0xab
mov rax, qword [rsp + 0x68]
movss xmm0, dword [rsp + 0x4c]
subss xmm0, dword [rax + 4]
or rdx, 0x36006385
movss dword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x68]
rcr edx, cl
movss xmm0, dword [rsp + 0x48]
subss xmm0, dword [rax]
bts rcx, rbp
rcl rax, 0x14
movsx ecx, si
movss dword [rsp + 0x38], xmm0
movsxd rcx, eax
rdtsc
stc
movss xmm0, dword [rsp + 0x38]
sbb rax, 0x52e0b2f
btr rax, r9
cmp r10, 0x4f06a2a1
movss dword [rsp + 0x70], xmm0
movsxd rcx, ecx
movss xmm0, dword [rsp + 0x40]
bts dx, r9w
movss dword [rsp + 0x74], xmm0
lea rax, [rsp + 0x70]
sar cl, 0xbf
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
movzx edx, cx
movsx ecx, r11w
mov rdx, 0x6394a7b5
mov qword [rsp + 0x88], rax
movsx rdx, r14w
btc dx, 0x85
mov rax, qword [rsp + 0x80]
cmc
mov rax, qword [rax]
adc cl, sil
mov qword [rsp + 0x90], rax
rcl dx, cl
xor cl, r9b
test r15b, 0xe
mov rax, qword [rsp + 0x20]
shr cx, 0xa3
add rax, 0x130
movzx edx, r11w
cqo
movsxd rdx, r9d
mov rdx, rax
jmp 0x1406a5825
lea rcx, [rsp + 0x88]
call fcn.14069046a
movzx eax, al
cmc
test edx, 0x1912a8b0
test eax, eax
jmp 0x1406a5843
jne 0x1406a5855
sub al, al
jmp 0x1406a5850
jmp 0x1406a5857
mov al, 1
add rsp, 0xa8
ret
Function at 0x1406b4a2b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400cc768]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movsx rdx, sp
add rax, 0x1a38
mov ch, 0x17
movsx ecx, r14w
mov qword [rsp + 0x30], rax
cdqe
xchg al, cl
movzx eax, r9w
mov rax, qword [rsp + 0x30]
inc rdx
mov eax, dword [rax]
movzx rdx, ax
dec eax
sar dx, 8
cdqe
rcr ch, cl
shr edx, cl
sar rdx, 0x1c
mov rcx, qword [rsp + 0x30]
adc dx, 0x72ad
bts dx, sp
mov rcx, qword [rcx + 8]
adc dl, dil
mov rdx, qword [rsp + 0x70]
stc
cmp qword [rcx + rax*8], rdx
jmp 0x1406b4aa5
jne 0x1406b4ab0
jmp 0x1406b4c83
mov rax, qword [rsp + 0x28]
cmp r13d, 0x9bbe4a0d
mov eax, dword [rax + 0x1a38]
sub eax, 2
jmp 0x1406b4aca
mov dword [rsp + 0x20], eax
jmp 0x1406b4ad3
jmp 0x1406b4aef
mov eax, dword [rsp + 0x20]
jmp 0x1406b4ae1
dec eax
test edx, eax
test r14b, 0x29
stc
mov dword [rsp + 0x20], eax
stc
cmp dword [rsp + 0x20], 0
jmp 0x1406b4af9
jl 0x1406b4c83
mov rax, qword [rsp + 0x28]
movsx ecx, di
bsf rdx, rbx
add rax, 0x1a38
shr dx, cl
mov qword [rsp + 0x38], rax
xor dl, 0xa9
add edx, r11d
movsxd rax, dword [rsp + 0x20]
btr dx, 0xb9
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
shld edx, r15d, 0x8d
movsx rdx, dx
mov rdx, qword [rsp + 0x70]
cmc
jmp 0x1406b4b46
cmp qword [rcx + rax*8], rdx
jmp 0x1406b4b4f
jne 0x1406b4c7e
mov rax, qword [rsp + 0x28]
add rax, 0x1a38
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
sal rcx, cl
add rax, 0x1a38
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x20]
setae r8b
movsxd r8, edx
jmp 0x1406b4b88
inc eax
cdqe
mov rcx, qword [rsp + 0x40]
sal r8b, 0x13
mov rcx, qword [rcx + 8]
lea rax, [rcx + rax*8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
bswap rdx
mov ecx, dword [rsp + 0x20]
cmc
cmp r15w, 0xe5a6
mov eax, dword [rax + 0x1a38]
sal r8d, cl
sub eax, ecx
inc rdx
bswap cx
dec eax
cdqe
sub cx, 0x142d
cdq
shl rax, 3
cwd
xchg r8b, r8b
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx + 8]
movsx r8d, di
not r8w
lea rcx, [rdx + rcx*8]
mov r8, rax
jmp 0x1406b4bff
mov rdx, qword [rsp + 0x50]
jmp 0x1406b4c09
call fcn.14070ffcf
mov rax, qword [rsp + 0x28]
add rax, 0x1a38
xchg rdx, rcx
movsx dx, sil
setne dh
mov qword [rsp + 0x58], rax
mov ax, 0x6fbe
rdtsc
movzx dx, r8b
mov rax, qword [rsp + 0x28]
bswap edx
movzx edx, sp
mov eax, dword [rax + 0x1a38]
movsxd rcx, esp
dec eax
movzx cx, ah
jmp 0x1406b4c54
cdqe
jmp 0x1406b4c5d
mov rcx, qword [rsp + 0x58]
bswap dx
mov rcx, qword [rcx + 8]
cwd
mov rdx, qword [rsp + 0x70]
jmp 0x1406b4c75
mov qword [rcx + rax*8], rdx
jmp 0x1406b4c83
jmp 0x1406b4ad8
add rsp, 0x68
jmp 0x1406b4c8c
ret
Function at 0x1406b4c8d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
sar rcx, 0x26
rcl eax, cl
sal al, 0x2c
sub rsp, 0x78
mov rax, qword [0x1400cc768]
cmc
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rax, 0x1a28
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov ch, 0x22
movzx ecx, bp
mov eax, dword [rax]
movzx cx, ch
dec eax
rcl cl, 0x82
ror ch, cl
cdqe
btr cx, bp
mov rcx, qword [rsp + 0x30]
cmp ah, 0
test r15b, sil
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8]
stc
jmp 0x1406b4cf3
mov qword [rsp + 0x38], rax
sub ax, 0x2d22
shrd ax, bx, 0x29
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x38], rax
jmp 0x1406b4d13
je 0x1406b4d38
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
cmp qword [rax + 0x3a0], rcx
jmp 0x1406b4d32
jne 0x1406b4d3d
jmp 0x1406b4f4f
mov rax, qword [rsp + 0x28]
cmp r12b, 0x85
jmp 0x1406b4d4b
mov eax, dword [rax + 0x1a28]
cmc
stc
sub eax, 2
jmp 0x1406b4d5b
mov dword [rsp + 0x20], eax
jmp 0x1406b4d78
mov eax, dword [rsp + 0x20]
jmp 0x1406b4d6d
dec eax
stc
cmp r9b, dil
mov dword [rsp + 0x20], eax
stc
cmp dword [rsp + 0x20], 0
jl 0x1406b4f4f
mov rax, qword [rsp + 0x28]
add dx, r10w
add rax, 0x1a28
test cx, r12w
xor dx, bx
mov qword [rsp + 0x40], rax
movsxd rax, dword [rsp + 0x20]
sub dl, r8b
mov rcx, qword [rsp + 0x40]
rcl dh, 0x9a
dec dx
rcr dx, cl
mov rcx, qword [rcx + 8]
btr rdx, rax
jmp 0x1406b4dc1
mov rdx, qword [rsp + 0x80]
cmp bpl, dil
test sp, ax
cmp qword [rcx + rax*8], rdx
jne 0x1406b4f4a
mov rax, qword [rsp + 0x28]
add rax, 0x1a28
bt edx, ebx
rcr r8b, cl
ror r8b, cl
mov qword [rsp + 0x48], rax
sbb cl, r13b
btc r8w, r9w
mov rax, qword [rsp + 0x28]
add rax, 0x1a28
xchg ecx, edx
mov qword [rsp + 0x50], rax
cdqe
cwd
seta r8b
mov eax, dword [rsp + 0x20]
movsxd r8, r8d
inc eax
movsxd rcx, r12d
shld r8w, bx, 0xb8
bt r8w, 0x25
cdqe
shr r8d, 0x18
bt rcx, r12
cmp r13w, dx
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 8]
lea rax, [rcx + rax*8]
movsx r8d, di
and dx, 0xd17
adc dh, 0x80
mov qword [rsp + 0x58], rax
shr ecx, 0xbb
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
stc
sbb r8d, 0x7b9eb2a2
mov eax, dword [rax + 0x1a28]
rcl rdx, cl
cmove r8w, r12w
sub eax, ecx
dec eax
btc dx, 0x82
bt cx, 0xa0
cdqe
shld dx, bx, 0x2c
add dl, r9b
btr r8, 0xba
shl rax, 3
cwd
movsxd rcx, dword [rsp + 0x20]
jmp 0x1406b4eae
mov rdx, qword [rsp + 0x50]
movzx r8d, r14w
mov rdx, qword [rdx + 8]
not r8w
movsx r8d, bp
lea rcx, [rdx + rcx*8]
mov r8, rax
movsx dx, r11b
bswap rdx
mov rdx, qword [rsp + 0x58]
jmp 0x1406b4edc
call fcn.14070ffcf
mov rax, qword [rsp + 0x28]
movsx rcx, r11w
cmp spl, 0x14
cdq
add rax, 0x1a28
mov ch, 0x2e
mov qword [rsp + 0x60], rax
cbw
movsx rax, bx
mov rax, qword [rsp + 0x28]
movsx cx, dl
mov eax, dword [rax + 0x1a28]
cwd
dec eax
cmovg edx, r13d
cdqe
movzx edx, r13w
cqo
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
movzx edx, r10w
mov rdx, qword [rsp + 0x80]
jmp 0x1406b4f3c
mov qword [rcx + rax*8], rdx
jmp 0x1406b4f45
jmp 0x1406b4f4f
jmp 0x1406b4d64
add rsp, 0x78
ret
Function at 0x1406d55bf
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
neg r8w
mov dword [rsp + 0x10], edx
cmovs r8, r15
clc
mov qword [rsp + 8], rcx
shrd dx, r14w, 0x39
sbb cl, r14b
xor edx, r11d
sub rsp, 0x98
movsxd r8, esp
mov dword [rsp + 0x58], 1
movsxd rcx, ecx
mov dword [rsp + 0x5c], 0
movzx r8d, r8w
xorps xmm0, xmm0
movsx r8, r10w
movzx edx, bx
jmp 0x1406d5612
movss dword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x64], xmm0
movzx rcx, r12w
mov dx, bx
xorps xmm0, xmm0
cwd
movzx edx, dx
cqo
movss dword [rsp + 0x68], xmm0
mov ecx, 0x1c029805
xorps xmm0, xmm0
cmovs cx, bx
movzx cx, sil
movss dword [rsp + 0x6c], xmm0
bswap dx
jmp 0x1406d565c
mov dword [rsp + 0x70], 0
movsxd r8, ebp
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x78], 0
cqo
cwd
mov r8b, 0x84
mov dword [rsp + 0x7c], 0
movsx ecx, di
movzx ecx, r13w
cmovp rcx, rdi
mov qword [rsp + 0x80], 0
mov dl, r8b
movsxd rcx, edi
not ch
mov dword [rsp + 0x88], 0
movsx rdx, di
movsx edx, cx
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
xorps xmm0, xmm0
movss dword [rsp + 0x28], xmm0
movzx dx, r13b
xchg dl, r8b
xorps xmm0, xmm0
movsx ecx, r15w
mov r8, r12
movzx ecx, r9w
movss dword [rsp + 0x2c], xmm0
setnp dl
movzx edx, bp
xorps xmm0, xmm0
bswap ecx
movss dword [rsp + 0x30], xmm0
xorps xmm0, xmm0
cqo
movss dword [rsp + 0x34], xmm0
cqo
mov dword [rsp + 0x38], 0
mov dx, 0x81ae
jmp 0x1406d571b
mov dword [rsp + 0x3c], 0
cmova r8w, r15w
cdq
cqo
mov dword [rsp + 0x40], 0
bswap dx
movsx dx, sil
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
movzx r8w, sil
cmovl rdx, rbp
bswap dx
lea r8, [rsp + 0x58]
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
jmp 0x1406d5779
call fcn.1406d320a
test eax, eax
jmp 0x1406d5785
je 0x1406d582e
movsxd rax, dword [rsp + 0x88]
bswap ecx
rcr rcx, 0x3f
imul rax, rax, 0xe
mov ch, 0x39
movsx cx, r9b
mov rcx, rax
jmp 0x1406d57ad
call fcn.14069e32c
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], rax
mov dl, 0xab
movzx ecx, r10w
mov rax, qword [rsp + 0xb0]
setl r8b
mov rax, qword [rax]
jmp 0x1406d57d7
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
cdq
mov edx, dword [rsp + 0xa8]
bswap ecx
mov cx, 0x5f96
mov cl, bl
mov rcx, qword [rsp + 0xa0]
jmp 0x1406d57fe
call fcn.1406d320a
test eax, eax
je 0x1406d582e
sub eax, eax
cmc
clc
cmp r13b, 0x9c
test eax, eax
jmp 0x1406d581a
jne 0x1406d580b
mov eax, dword [rsp + 0x50]
jmp 0x1406d5829
jmp 0x1406d5844
mov rax, qword [rsp + 0xb0]
cmc
mov qword [rax], 0
cmc
stc
xor eax, eax
stc
clc
add rsp, 0x98
jmp 0x1406d5850
ret