joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404610ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
dec eax
mov qword [rsp + 0x20], rbp
mov al, r10b
push rsi
cbw
push rdi
push r12
ror di, 0x41
push r14
setg dil
mov dil, r14b
stc
push r15
cdqe
sub rsp, 0x50
mov rax, qword [0x1400fa040]
rcl r15d, 0xcd
add di, 0xc75
xor rax, rsp
sal bp, cl
ror r15b, 0xce
cmp cl, r12b
mov qword [rsp + 0x48], rax
shr bp, cl
bts r15w, ax
sub r12d, r12d
mov r15, r8
movzx edi, r15w
setl bpl
movsx ebp, r9w
mov qword [rsp + 0x38], r12
mov rbp, rcx
movzx edi, r13w
mov rdi, 0x74454457
xchg dil, dil
mov rdi, 0xffffffffffffffff
jmp 0x140461153
nop word [rax + rax]
jmp 0x14046115e
inc rdi
cmp r12w, r13w
stc
cmp byte [rdi + rcx], r12b
jmp 0x14046116f
jne 0x14046115e
add rdi, 1
movsx bx, r9b
cmovo si, r15w
xchg r14w, bx
mov rbx, r12
xchg r14, rsi
movsx r14d, bp
mov rsi, rdi
jmp 0x140461199
mov r14, rcx
jmp 0x1404611a1
je 0x14046120c
nop dword [rax + rax]
movsxd r8, esi
movzx rcx, r13w
lea r9, [rsp + 0x38]
movsx r8d, dx
movsx r8w, r14b
mov qword [rsp + 0x20], r15
setge r8b
mov r8, rsi
lea rcx, [rsp + 0x30]
movsx rdx, di
movzx dx, bh
cmovns edx, r14d
mov rdx, r14
jmp 0x1404611e9
call fcn.14050173a
test eax, eax
jle 0x14046120c
cdqe
inc rbx
clc
cmc
test r13d, ebp
add r14, rax
sub rsi, rax
jne 0x1404611b6
inc rbx
bswap rcx
mov edx, 2
jmp 0x14046121f
mov rcx, rbx
jmp 0x140461227
call fcn.14009a970
mov r14, rax
jmp 0x140461237
test rax, rax
jmp 0x14046123f
je 0x140461334
mov qword [rsp + 0x40], r12
mov rsi, rax
jmp 0x140461252
test rbx, rbx
jmp 0x14046125a
je 0x1404612c3
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r15
movsxd rdx, esi
jmp 0x140461276
mov r8, rdi
cdq
movsx rdx, r13w
movzx cx, r13b
mov rdx, rbp
movzx rcx, r13w
xchg cl, ch
mov rcx, rsi
call fcn.14050173a
test eax, eax
jmp 0x14046129b
jle 0x1404612c3
cdqe
add rsi, 2
clc
cmp r12w, 0x7d1b
lea rbp, [rbp + rax]
cmc
sub rbx, 1
jmp 0x1404612bd
jne 0x140461260
mov word [rsi], r12w
cbw
mov rax, r14
test di, 0x69c5
btc cx, r9w
mov rcx, qword [rsp + 0x48]
test dil, al
stc
xor rcx, rsp
jmp 0x1404612e7
call fcn.140509caf
lea r11, [rsp + 0x50]
bswap r15w
movzx r15d, bp
mov rbx, qword [r11 + 0x38]
not r12b
bswap si
mov rbp, qword [r11 + 0x48]
movzx r15w, cl
mov rsp, r11
movzx edi, dx
mov di, si
movsxd r14, r9d
pop r15
movzx di, al
pop r14
movsx edi, r10w
movzx esi, cx
pop r12
pop rdi
mov sil, bl
pop rsi
jmp 0x140461333
ret
call fcn.140501608
jmp 0x1400043ad
Function at 0x1404629bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
cmc
sal bx, 0x6a
shr r9d, cl
sub rsp, 0x50
movzx r9w, al
mov rax, qword [0x1400fa040]
xor rax, rsp
movsx rbx, r8w
setbe r10b
mov qword [rsp + 0x40], rax
mov r8, rdx
mov rbx, rcx
cdq
mov qword [rsp + 0x20], rcx
movsx rdx, cx
cdqe
movzx r10, si
lea r9, [rsp + 0x3d]
rdtsc
cqo
movsx dx, bpl
movabs r10, 0xcccccccccccccccd
nop
inc edx
dec cl
dec r9
sar al, cl
mov rax, r10
bt rdx, rdx
btc cx, r12w
mul r8
add al, r12b
shr rdx, 3
movzx eax, dl
sbb cl, sil
sar ch, 0xeb
sal cx, 0x7e
shl al, 2
rol ch, cl
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
jmp 0x140462a53
add r8b, 0x30
cmp dl, r11b
mov byte [r9], r8b
cmp dil, r9b
movzx r8d, sp
mov r8, rdx
clc
test rdx, rdx
jmp 0x140462a70
jne 0x140462a19
sub eax, eax
test r11d, 0x4c4d5d1b
jmp 0x140462a84
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
cmp r13d, 0x70117920
mov qword [rbx + 0x18], 0xf
cmc
mov byte [rbx], al
bts ax, r15w
clc
lea rax, [rsp + 0x3d]
jmp 0x140462aad
cmp r9, rax
jmp 0x140462ab5
je 0x140462aed
lea r8, [rsp + 0x3d]
neg ecx
btr rdx, 0xff
cmp r15b, 0x5a
sub r8, r9
not rcx
cdq
mov rdx, r9
movzx cx, r8b
movzx ecx, bx
movsx ecx, bx
mov rcx, rbx
jmp 0x140462ae8
call fcn.14045e5cc
mov rax, rbx
rcl cl, 0xb4
xadd ecx, ecx
test r13d, 0x32192188
mov rcx, qword [rsp + 0x40]
cmp dx, 0x5be5
test r14b, 0x8e
xor rcx, rsp
call fcn.140509caf
add rsp, 0x50
pop rbx
jmp 0x140462b1d
ret
Function at 0x1404a14fa
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
btr bx, bx
push rdi
movsx rdi, bx
btr rdi, 0x50
sub rsp, 0x20
xor di, sp
shr ebx, cl
mov rdx, qword [rcx + 0x10]
add di, bp
mov rdi, rcx
sbb ebx, 0x35153416
bswap bx
add rdx, 1
bswap rbx
jmp 0x1404a1539
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1404a1550
cvtsi2ss xmm0, rdx
jmp 0x1404a1573
mov rax, rdx
cmp sil, 0xc6
jmp 0x1404a155c
and edx, 1
shr rax, 1
or rax, rdx
jmp 0x1404a156a
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1400bb15c
movss xmm1, dword [0x1400de758]
jmp 0x1404a1589
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1404a15b0
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1404a15b0
movabs rax, 0x8000000000000000
bswap ecx
mov rcx, rax
cvttss2si rax, xmm0
lea rax, [rax + rcx]
mov ecx, 8
test r12b, 0xef
jmp 0x1404a15c8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1404a160c
cmp rbx, 0x200
jmp 0x1404a15e4
jae 0x1404a1609
lea rbx, [rbx*8]
cmp sil, cl
test ecx, 0x17405817
cmp rbx, rcx
jmp 0x1404a1603
jae 0x1404a160c
mov rbx, rcx
mov rdx, rbx
shr bh, cl
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
movsxd rdi, ebp
pop rdi
jmp fcn.1404a1626
Function at 0x1404a1bfe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
btc r11w, 0xc9
dec r11w
ror dil, 0xd
mov rax, qword [rcx + 8]
mov r11, rdx
btc edi, ebx
rcr r10, 0x69
bts r10w, r11w
mov rdx, qword [rcx + 0x30]
and r10b, 0xfa
btr r10, 0x76
neg rdi
mov rdi, r8
xor r10w, r13w
rol r10b, cl
test r9w, 0x4b
and rdx, r9
not r10w
shl rdx, 4
sbb r10w, 0x4aa2
add r10b, r12b
add rdx, qword [rcx + 0x18]
bts r10d, ebx
neg r10d
sar r10d, 0xc3
mov r10, qword [rdx + 8]
test r13b, r13b
cmp r10, rax
jmp 0x1404a1c73
jne 0x1404a1ca1
mov qword [r11], rax
jmp 0x1404a1c85
mov rax, r11
movzx rdi, bx
not rdi
bswap di
mov qword [r11 + 8], 0
movzx edi, ax
not edi
pop rdi
ret
mov qword [rsp + 0x10], rbx
shld cx, sp, 0xff
dec ah
sete bh
mov rbx, qword [r8 + 0x10]
mov qword [rsp + 0x18], rbp
movzx ecx, cx
mov rbp, qword [r8 + 0x18]
mov qword [rsp + 0x20], rsi
shld cx, ax, 0xa3
mov rsi, qword [rdx]
nop
movsxd rax, esi
sbb cl, 0x21
xadd cx, cx
cmp qword [r10 + 0x28], 8
movsxd rax, edx
lea rax, [r10 + 0x10]
mov rcx, qword [rax + 0x10]
jmp 0x1404a1cee
jb 0x1404a1d00
mov rax, qword [rax]
sar r9, cl
not r9b
mov r9b, 0xf9
mov r9, rdi
stc
cmp rbp, 8
jmp 0x1404a1d0d
jb 0x1404a1d1c
mov r9, qword [rdi]
cmp ebx, 0x76cd0cb9
cmp rbx, rcx
jmp 0x1404a1d24
jne 0x1404a1da9
mov r8, rbx
test rbx, rbx
jmp 0x1404a1d35
je 0x1404a1dc5
movzx ecx, word [r9]
sar dh, 0x7c
shr dx, cl
cmc
movzx edx, word [rax]
cmp cx, dx
jmp 0x1404a1d51
jb 0x1404a1da9
sub r9, rax
cmp di, 0x561b
cmp cx, dx
jmp 0x1404a1d67
ja 0x1404a1da9
cmp r8, 1
jmp 0x1404a1d76
je 0x1404a1dc5
movzx ecx, word [r9 + rax + 2]
sal dx, cl
add rax, 2
dec r8
sub dx, 0x3ab1
movzx edx, word [rax]
cmp r14w, 0x697f
stc
cmp cx, dx
jmp 0x1404a1da3
jae 0x1404a1d67
cmp r10, rsi
jmp 0x1404a1db1
je 0x1404a1dde
mov r10, qword [r10 + 8]
jmp 0x1404a1dc0
jmp 0x1404a1cd9
mov rax, qword [r10]
mov qword [r11], rax
jmp 0x1404a1dd0
mov qword [r11 + 8], r10
jmp 0x1404a1dd9
jmp 0x1404a1df0
mov qword [r11], r10
movzx eax, di
movsx rbp, r11w
mov qword [r11 + 8], 0
mov rbp, qword [rsp + 0x18]
movzx eax, si
cbw
mov di, bp
mov rax, r11
movsx edi, r14w
movzx rdi, cx
movsx si, spl
mov rbx, qword [rsp + 0x10]
xchg sil, dil
mov rsi, qword [rsp + 0x20]
setle dil
movsx rdi, ax
not di
pop rdi
jmp 0x1404a1e2b
ret
Function at 0x1404a3bc1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
clc
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x20], rcx
btr cx, 0x4e
btc ecx, 0x54
movzx cx, dl
mov rcx, qword [rdx + 0x10]
test r13w, r9w
cmc
test rcx, rcx
jmp 0x1404a3bee
je 0x1404a3d9e
mov r8, rdx
movsx r9, si
mov r9, qword [rdx + 0x18]
cmc
test r11b, r15b
clc
cmp r9, 8
jmp 0x1404a3c0d
jb 0x1404a3c16
mov r8, qword [rdx]
dec rcx
btc r10w, r12w
lahf
dec rax
mov r10, 0xffffffffffffffff
mov rax, r10
cmp rcx, r10
movsx r11, r14w
cmovb rax, rcx
bts r11, r9
xor r11w, 0x6742
lea r11, [rax + rax]
lea rax, [r11 + r8]
cmp word [rax], 0x5c
je 0x1404a3c81
nop dword [rax]
test ebp, r13d
cmc
test si, 0x4873
cmp rax, r8
jmp 0x1404a3c67
je 0x1404a3ca1
sub rax, 2
stc
cmp word [rax], 0x5c
jmp 0x1404a3c7b
jne 0x1404a3c5f
sub rax, r8
stc
sar rax, 1
cmp al, 0x88
test r11w, dx
test di, 0x325b
cmp rax, r10
jmp 0x1404a3c9b
jne 0x1404a3d04
mov rcx, rdx
cmc
test r13b, 0xab
cmp r9, 8
jb 0x1404a3cc3
mov rcx, qword [rdx]
movsx rax, r15w
movzx rax, di
bsf ax, r12w
lea rax, [r11 + rcx]
cmp r10b, r8b
cmp word [rax], 0x2f
je 0x1404a3cf0
cmp rax, rcx
je 0x1404a3d9e
sub rax, 2
cmp word [rax], 0x2f
jmp 0x1404a3cea
jne 0x1404a3cd4
sub rax, rcx
sar rax, 1
cmp bl, r11b
stc
cmc
cmp rax, r10
je 0x1404a3d9e
lea rcx, [rax + 1]
clc
xor eax, eax
stc
mov qword [rbx], rax
cmc
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
test r8b, 4
mov word [rbx], ax
rcr eax, 0xb7
add al, spl
inc rax
mov rax, qword [rdx + 0x10]
cmp rax, rcx
jb 0x1404a3dc0
sub rax, rcx
test bp, 0x446d
cmp rax, 0xffffffffffffffff
cmovb r10, rax
cmp ch, ch
cmp qword [rdx + 0x18], 8
jb 0x1404a3d64
mov rdx, qword [rdx]
setb r8b
mov r8b, r10b
movzx r8d, r14w
lea rdx, [rdx + rcx*2]
mov r8b, dl
bswap rcx
mov r8, r10
not ecx
movsx rcx, bx
movzx rcx, dx
mov rcx, rbx
jmp 0x1404a3d83
call fcn.14045e2a9
mov rax, rbx
movzx rbx, di
clc
bswap bx
add rsp, 0x30
pop rbx
jmp 0x1404a3d9d
ret
mov rcx, rbx
jmp 0x1404a3da6
call fcn.14049f03e
mov rax, rbx
rcr ebx, 0xdf
cmovae rbx, rsi
add rsp, 0x30
pop rbx
jmp 0x1404a3dbf
ret
call fcn.14045e8e5
jmp 0x140027dce
Function at 0x1404aa674
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
test r9b, cl
cmp r10d, 0x19016b15
push rdi
sbb si, 0x259c
sub rsp, 0x90
sbb si, 0x6191
movsxd rbp, r8d
mov rax, qword [0x1400fa040]
rcr si, cl
and bp, r13w
xor rax, rsp
movsx bp, cl
cmovnp si, sp
mov qword [rsp + 0x88], rax
movsxd rbp, r8d
movsx si, r12b
not esi
mov rsi, rcx
movsxd rcx, r15d
jmp 0x1404aa6d0
lea rcx, [rsp + 0x40]
jmp 0x1404aa6da
call fcn.1404a3bc1
mov rdx, rax
xchg rcx, rcx
lea rcx, [rsp + 0x20]
jmp 0x1404aa6ef
call fcn.1404a49fe
movups xmm0, xmmword [rax]
not dl
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
sub dh, 0xaa
movups xmmword [rsp + 0x70], xmm1
movzx edx, di
sub ebx, ebx
test spl, 0xa4
mov qword [rax + 0x10], rbx
movsx dx, al
cmp dil, bpl
mov qword [rax + 0x18], 7
btc dx, ax
adc dl, 0x4a
movsxd rdx, r9d
mov word [rax], bx
and dh, 0xae
rol edx, 0x4b
movsxd rdx, ebp
mov dword [rsp + 0x80], ebp
mov rdx, qword [rsp + 0x38]
cmp cl, r9b
stc
cmc
cmp rdx, 8
jmp 0x1404aa756
jb 0x1404aa7c6
lea rdx, [rdx*2 + 2]
dec ch
sal al, cl
cmp r10b, 0x93
mov rcx, qword [rsp + 0x20]
rcr ah, cl
jmp 0x1404aa778
mov rax, rcx
cmp rdx, 0x1000
jmp 0x1404aa787
jb 0x1404aa7c1
add rdx, 0x27
cmc
cmp dil, 0x3d
stc
mov rcx, qword [rcx - 8]
cmp r11b, 0x13
jmp 0x1404aa7a4
sub rax, rcx
test r9w, 0x5fd2
stc
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jmp 0x1404aa7bb
ja 0x1404aa966
call fcn.140260db4
lea rdx, [rsp + 0x60]
clc
mov r10, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
cmp rdi, 8
mov cl, 0xc4
setle ch
movsx r8d, r9w
cmovae rdx, r10
shl r8b, 0x4c
sbb al, 0xd2
movabs rcx, 0xcbf29ce484222325
clc
mov rax, qword [rsp + 0x70]
bts r8, r10
lea r8, [rax + rax]
cmp r8d, 0x5b0302e5
test r12b, 0xb0
test r8, r8
jmp 0x1404aa818
je 0x1404aa851
movabs r9, 0x100000001b3
ror rax, 0x1a
rcr ah, cl
movzx eax, byte [rbx + rdx]
jmp 0x1404aa838
xor rcx, rax
stc
imul rcx, r9
jmp 0x1404aa845
inc rbx
cmp rbx, r8
jb 0x1404aa82e
mov r9, rbp
sar dl, 0x51
setge dh
xor r9, rcx
bswap dx
lea r8, [rsp + 0x60]
movzx rdx, dx
jmp 0x1404aa86e
lea rdx, [rsp + 0x20]
not cl
lea rcx, [rsi + 0x18]
jmp 0x1404aa87e
call fcn.1404ac2c8
cmp qword [rax + 8], 0
jmp 0x1404aa88d
je 0x1404aa8b3
lea rdx, [rsp + 0x60]
movzx ecx, bx
lea rcx, [rsi + 0x18]
jmp 0x1404aa8a4
call fcn.1404ab11c
mov rdi, qword [rsp + 0x78]
mov r10, qword [rsp + 0x60]
cmp rdi, 8
jmp 0x1404aa8bc
jb 0x1404aa90f
lea rdx, [rdi*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x1404aa907
add rdx, 0x27
jmp 0x1404aa8e3
mov r10, qword [r10 - 8]
test rdi, rcx
sub rax, r10
cmp r9w, r13w
add rax, 0xfffffffffffffff8
cmp bp, si
cmp rax, 0x1f
jmp 0x1404aa901
ja 0x1404aa95c
mov rcx, r10
call fcn.140260db4
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140509caf
mov rbx, qword [rsp + 0xc0]
rcl sil, cl
shl ebp, 0x18
add rsp, 0x90
mov si, bx
mov rdi, 0x1cc81740
pop rdi
bswap ebp
movsxd rsi, esi
mov bp, r12w
pop rsi
movsx rbp, ax
mov bp, r9w
movzx ebp, r8w
pop rbp
jmp 0x1404aa95b
ret
call fcn.14009a2e8
jmp 0x14002b66c
call fcn.14009a2e8
jmp 0x14002b672
Function at 0x1404ab11c
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub edi, 0x4c9f2b3f
sub rsp, 0x30
test r15, r10
btc r8d, r14d
cmp qword [rdx + 0x18], 8
movzx r8d, cx
movsx r8d, r11w
movzx r8w, al
mov r8, rdx
xchg dil, r10b
mov r10, qword [rdx + 0x10]
cmovnp r9, r13
bswap r9w
movzx r9d, r9w
mov rdi, rcx
movsx r9, r9w
movzx r9, cx
mov r9, rdx
jmp 0x1404ab16e
jb 0x1404ab180
mov r9, qword [rdx]
xor dl, sil
test bl, r15b
sbb dl, r13b
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r8w, 0xed4
add r10, r10
jmp 0x1404ab19a
je 0x1404ab1d8
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r9]
jmp 0x1404ab1b8
inc rcx
jmp 0x1404ab1c4
xor rdx, rax
cmp r11b, 0x82
imul rdx, r11
cmp rcx, r10
jb 0x1404ab1ae
movsxd r10, dword [r8 + 0x20]
mov rcx, rdi
xor r10, rdx
movsx rdx, r10w
seto r9b
lea rdx, [rsp + 0x20]
jmp 0x1404ab1f9
mov r9, r10
jmp 0x1404ab201
call fcn.1404ac2c8
mov rbx, qword [rax + 8]
cmp r13b, r9b
jmp 0x1404ab212
test rbx, rbx
jmp 0x1404ab21a
je 0x1404ab335
mov rcx, qword [rdi + 0x30]
rol edx, 0x7d
mov rdx, qword [rdi + 0x18]
bts eax, r15d
rcr ax, 0xb2
and rcx, r10
dec ax
shl rcx, 4
add rdx, rcx
sar ax, 0x2a
mov rax, qword [rdx]
cmc
cmp qword [rdx + 8], rbx
jmp 0x1404ab251
jne 0x1404ab291
cmp rax, rbx
jmp 0x1404ab25f
jne 0x1404ab27a
mov rax, qword [rdi + 8]
jmp 0x1404ab26e
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1404ab2a8
mov rax, qword [rbx + 8]
jmp 0x1404ab283
mov qword [rdx + 8], rax
jmp 0x1404ab28c
jmp 0x1404ab2a8
cmp rax, rbx
jne 0x1404ab2a8
mov rax, qword [rbx]
mov qword [rdx], rax
movsx rax, r8w
movsx eax, r15w
mov rdx, qword [rbx]
bswap rax
movzx cx, bl
lea rcx, [rbx + 0x10]
movsxd rax, ecx
not eax
inc ax
dec qword [rdi + 0x10]
movzx eax, r8w
xchg al, al
cmovge ax, r13w
mov rax, qword [rbx + 8]
jmp 0x1404ab2d6
mov qword [rax], rdx
jmp 0x1404ab2de
mov rax, qword [rbx + 8]
jmp 0x1404ab2e7
mov qword [rdx + 8], rax
jmp 0x1404ab2f0
call fcn.1404accae
mov edx, 0x48
movsx cx, r14b
sete ch
mov rcx, rbx
jmp 0x1404ab30a
call fcn.140260db4
mov eax, 1
mov rbx, qword [rsp + 0x50]
movsx di, r15b
add rsp, 0x30
movsx di, r14b
mov rdi, 0x23dd5617
pop rdi
jmp 0x1404ab334
ret
mov rbx, qword [rsp + 0x50]
cmc
sar rdi, cl
bt rdi, r12
sub eax, eax
add rsp, 0x30
mov di, 0x79db
movsxd rdi, r14d
pop rdi
jmp 0x1404ab355
ret
Function at 0x1404c6753
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
test r13w, 0x12a
movsx rax, r13w
mov qword [rsp + 0x20], rsi
dec sil
cmc
push rdi
sub rsp, 0x50
mov rsi, rdx
mov rbx, rcx
rol rdi, cl
mov rdi, qword [rcx]
sal ax, 0x2e
bsf ax, bp
movsx cx, r11b
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], rax
sal ch, 0xd8
bswap rcx
bts cx, bp
xor ebp, ebp
mov dword [rsp + 0x38], ebp
rcl ch, 4
mov rcx, rdi
stc
test rsi, 0x2e254148
cmp byte [rax + 0x19], bpl
jmp 0x1404c67be
jne 0x1404c680d
mov r8, qword [rdx]
nop dword [rax + rax]
mov qword [rsp + 0x30], rax
cmc
test r12b, al
cmp qword [rax + 0x20], r8
jae 0x1404c67ef
mov dword [rsp + 0x38], ebp
mov rax, qword [rax + 0x10]
jmp 0x1404c6803
mov dword [rsp + 0x38], 1
clc
mov rcx, rax
cmp si, 0x6f6c
mov rax, qword [rax]
cmp byte [rax + 0x19], bpl
je 0x1404c67cf
cmp byte [rcx + 0x19], bpl
jmp 0x1404c6816
jne 0x1404c6837
mov rax, qword [rcx + 0x20]
cmp r11w, 0x4748
cmp dil, dl
cmp qword [rdx], rax
jmp 0x1404c6831
jae 0x1404c68f6
movabs rax, 0x555555555555555
cmp r9b, 0xd7
test rcx, rbp
clc
cmp qword [rbx + 8], rax
jmp 0x1404c6852
je 0x1404c692e
mov qword [rsp + 0x20], rbx
movsx cx, bpl
movsx ecx, dx
movzx rcx, dx
mov qword [rsp + 0x28], rbp
mov ecx, 0x30
call fcn.14005cdc8
mov r8, rax
cmovp rcx, rbx
bswap cx
mov rax, qword [rsi]
movzx dx, ah
not cl
mov qword [r8 + 0x20], rax
mov edx, 0x64cc4496
bswap dx
mov qword [r8 + 0x28], rbp
bswap rdx
mov cl, spl
mov qword [r8], rdi
mov qword [r8 + 8], rdi
cdq
movsxd rcx, r8d
cwd
mov qword [r8 + 0x10], rdi
mov word [r8 + 0x18], 0
jmp 0x1404c68c3
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x20], xmm0
cdq
movzx ecx, r9w
bswap rdx
lea rdx, [rsp + 0x20]
movzx rcx, si
mov rcx, rbx
jmp 0x1404c68e6
call fcn.14048d1ac
mov rcx, rax
sal sil, 0xea
or dil, 0x5e
lea rax, [rcx + 0x28]
sub bpl, 0x74
mov rbx, qword [rsp + 0x68]
or sil, 0xca
add esi, r8d
mov rbp, qword [rsp + 0x70]
neg esi
and rsi, rcx
setl dil
mov rsi, qword [rsp + 0x78]
xor rdi, r9
bswap di
add rsp, 0x50
pop rdi
jmp 0x1404c692d
ret
call fcn.140462b1e
jmp 0x140039d34
Function at 0x1404d91fd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
jmp 0x1404d920b
push rsi
xor rsi, 0x4031123c
clc
push rdi
rcl rdi, cl
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
movzx rdi, bx
mov rbx, r8
movsx edi, bx
mov si, 0x2801
movzx rsi, r12w
mov rsi, rdx
mov rdi, rcx
jmp 0x1404d923e
jne 0x1404d92b1
nop dword [rax + rax]
movsx cx, dil
xchg dl, dh
movzx r8, sp
mov r8, qword [rbx + 0x10]
movzx dx, sil
movsx dx, r12b
movsxd rcx, r15d
mov rdx, rsi
bswap rcx
movsx rcx, r13w
movsx cx, dil
mov rcx, rdi
jmp 0x1404d927f
call fcn.1404d91fd
mov rcx, rbx
movsx rdx, r15w
mov edx, 0x6e0
jmp 0x1404d9295
mov rbx, qword [rbx]
jmp 0x1404d929d
call fcn.140260db4
cmp byte [rbx + 0x19], 0
jmp 0x1404d92ab
je 0x1404d9257
add rsp, 0x20
mov rbx, rax
pop rdi
cmovnp bx, di
movsxd rbx, eax
pop rsi
mov bl, r12b
pop rbx
ret
Function at 0x1404ef793
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, 0x3f5463c0
btr rbx, rcx
rcl ebx, 0x50
push rdi
bswap di
test bp, 0x12bd
sub rsp, 0x20
mov rbx, rdx
movsx di, dil
movsx rdi, r8w
bswap r9w
movzx r9d, r8b
movsx r8, r10w
movsx r8d, dx
mov rdx, qword [rdx]
movsxd rdi, r12d
seta r8b
mov rdi, rcx
movzx r8, cx
not r8w
mov r8, qword [rcx]
jmp 0x1404ef7eb
mov rdx, qword [rdx + 8]
jmp 0x1404ef7f4
call fcn.1404efd90
mov r8, qword [rdi]
clc
xor dl, r14b
mov qword [r8 + 8], rax
or ax, 0x1f9b
sbb rax, 0x4210668a
mov r8, qword [rdi]
mov rax, qword [rbx + 8]
test cl, r8b
rcr dx, 0xb
mov qword [rdi + 8], rax
mov rdx, qword [r8 + 8]
jmp 0x1404ef82c
cmp byte [rdx + 0x19], 0
jmp 0x1404ef835
jne 0x1404ef8e5
mov rcx, qword [rdx]
jmp 0x1404ef84b
cmp byte [rcx + 0x19], 0
jmp 0x1404ef854
jne 0x1404ef884
nop dword [rax + rax]
mov rax, qword [rcx]
mov rdx, rcx
mov rcx, rax
cmp rsi, rax
clc
cmp r9w, 0x4c1
cmp byte [rax + 0x19], 0
jmp 0x1404ef87e
je 0x1404ef862
mov qword [r8], rdx
movzx rax, sp
movsxd rdx, r15d
movsx rdx, r12w
mov rdx, qword [rdi]
mov rcx, qword [rdx + 8]
mov rax, qword [rcx + 0x10]
test r11w, 0x6461
cmp byte [rax + 0x19], 0
jmp 0x1404ef8ac
jne 0x1404ef8ca
mov rcx, rax
cmp r12w, r15w
mov rax, qword [rax + 0x10]
test r12b, dl
cmp byte [rax + 0x19], 0
je 0x1404ef8b2
mov qword [rdx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
mov edi, r11d
movzx edi, r13w
pop rdi
jmp 0x1404ef8e4
ret
mov rbx, qword [rsp + 0x30]
shld eax, eax, 0x1d
movsx ax, sil
mov qword [r8], r8
mov rax, qword [rdi]
rol di, cl
dec rdi
mov qword [rax + 0x10], rax
add rsp, 0x20
pop rdi
jmp 0x1404ef90d
ret
Function at 0x140502196
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rcx
setge r10b
movzx r10w, cl
push rbx
sub bl, 0xcf
xadd r10d, ebx
shrd bx, r8w, 0xc3
sub rsp, 0x20
shld ebx, r13d, 0x3d
mov r10, rdx
mov rbx, rcx
xor ecx, ecx
cmp r8w, 0x3391
clc
mov dword [rsp + 0x48], ecx
test r9d, r9d
je 0x140502232
lea rax, [0x1400c2cc8]
not dh
mov qword [rbx], rax
movzx ax, r12b
sbb rdx, r14
mov qword [rbx + 0x18], rcx
rdtsc
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], rcx
xor dl, sil
mov qword [rbx + 0x50], rcx
movsx edx, ax
ror rcx, cl
adc ecx, esp
lea rax, [0x1400c2cb0]
movsxd rdx, r12d
rcr cl, 0x22
mov qword [rbx + 0x10], rax
bts rdx, rsi
test bl, 0xc8
mov dword [rsp + 0x48], 1
rcl ax, cl
sbb rax, 0x40a11b82
mov rax, qword [rbx]
ror ecx, cl
movsxd rcx, dword [rax + 4]
dec dx
bt dx, r11w
rdtsc
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
adc dx, 0x635b
bt dx, 0xf3
mov qword [rcx + rbx], rax
mov rax, qword [rbx]
mov dl, r8b
cmc
movsxd rcx, dword [rax + 4]
btr ax, cx
rdtsc
clc
lea edx, [rcx - 0x10]
rol al, 0xdb
xor rax, 0xc27390e
rcl ax, 9
mov dword [rcx + rbx - 4], edx
add ch, 0x46
test eax, esp
mov rax, qword [rbx]
cmc
bsr dx, bp
movsxd rcx, r12d
movsxd rcx, dword [rax + 4]
rol dx, cl
cwd
add rcx, rbx
mov rdx, r10
jmp 0x1405022a5
call fcn.140502f88
nop
sar ax, cl
bsr eax, r13d
cbw
mov rax, rbx
and bl, sil
btr ebx, 0x35
sbb bh, cl
add rsp, 0x20
mov bh, dh
mov bl, 0xd2
movsx bx, dil
pop rbx
jmp 0x1405022d3
ret
Function at 0x1405027c7
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
rcl bh, 0xbf
rol bl, cl
cmovle ax, sp
push rdi
xor ebx, 0x44071a74
dec bx
shr bh, cl
sub rsp, 0x60
xadd al, bh
test dil, 0x69
mov rax, qword [0x1400fa040]
setnp bh
xor rax, rsp
sbb bx, r10w
xor bx, 0x649b
sar bh, 0xde
mov qword [rsp + 0x58], rax
or bl, r8b
cmp r15w, 0x42db
cmp qword [rcx + 0x68], 0
mov rbx, rcx
jmp 0x140502820
je 0x1405028d3
cmp byte [rcx + 0x71], 0
jmp 0x14050282f
je 0x1405028d3
mov rax, qword [rcx]
test r10d, esi
test r10w, 0x6666
or edx, 0xffffffff
jmp 0x140502849
mov rax, qword [rax + 0x18]
jmp 0x140502852
call qword [0x1400c2630]
cmp eax, 0xffffffff
jmp 0x140502860
je 0x140502984
mov rcx, qword [rbx + 0x68]
movzx r8, bp
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov dl, 0x95
lea rdx, [rbx + 0x74]
cbw
setae al
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
movsxd rax, r13d
mov rax, qword [rcx]
jmp 0x140502898
mov rax, qword [rax + 0x40]
call qword [0x1400c2630]
test eax, eax
jmp 0x1405028a9
je 0x140502911
sub eax, 1
je 0x140502915
cmp eax, 2
jmp 0x1405028c0
jne 0x140502984
mov byte [rbx + 0x71], 0
xadd cx, cx
and cx, 0x4ef5
mov al, 1
add ch, 0xb1
btc cx, r15w
ror cl, cl
mov rcx, qword [rsp + 0x58]
cmp bpl, 0x7e
jmp 0x1405028ee
xor rcx, rsp
jmp 0x1405028f6
call fcn.140509caf
mov rbx, qword [rsp + 0x78]
rcr dil, 0xf6
add rsp, 0x60
bswap edi
pop rdi
jmp 0x140502910
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
cmc
sub rdi, rax
jmp 0x140502928
je 0x140502973
mov r9, qword [rbx + 0x80]
cmovne rcx, rbp
lea rcx, [rsp + 0x38]
movsx dx, r13b
movzx r8, bp
jmp 0x14050294c
mov r8, rdi
mov rdx, 0x76805df9
mov dx, r10w
cdq
mov edx, 1
call fcn.1400a1808
cmp rdi, rax
jmp 0x14050296d
jne 0x140502984
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14050297f
jmp 0x1405028df
xor al, al
jmp 0x1405028df