joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403c042f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sal ah, cl
push r14
xchg r14w, ax
add r14b, 0x10
push r13
lahf
push r12
sub r14b, cl
btc ax, r11w
mov r14, 0x76db2cc6
push rsi
push rdi
bts si, r11w
shr rsi, 0x67
push rbx
btc rsi, 0xf3
shr bx, 0x43
sub rsp, 0x20
dec bx
movzx rax, di
mov rsi, r8
jmp 0x1403c047e
mov rdi, rdx
sal r14b, cl
mov r14, rcx
rcl bh, 0xf
movsx ax, bpl
mov rbx, qword [rcx]
adc al, bpl
mov rcx, qword [rcx + 0x10]
sub rcx, rbx
sar rcx, 4
movzx eax, r12w
sal ah, 0xe3
movabs rax, 0xf0f0f0f0f0f0f0f1
cmp r14w, cx
stc
clc
imul rcx, rax
test r15w, r11w
cmp rcx, r8
jmp 0x1403c04c7
jae 0x1403c0533
mov rcx, r14
not dx
xchg dx, dx
mov rdx, rsi
jmp 0x1403c04de
call fcn.1403c06f9
mov rbx, qword [r14]
movsx rcx, bp
movsx cx, dil
nop word [rax + rax]
mov rcx, rbx
bswap edx
mov rdx, rdi
call fcn.1403c0f41
add rbx, 0x110
jmp 0x1403c0519
add rdi, 0x110
jmp 0x1403c0525
dec rsi
jne 0x1403c04f8
jmp 0x1403c06b3
mov r13, qword [r14 + 8]
mov r12, r13
cmovns r15d, ebp
not r15b
inc r15b
sub r12, rbx
xchg r15w, r15w
sar r12, 4
bsr r15w, dx
xor r15b, 0x18
rcl r15b, 1
imul r12, rax
shld r15, r15, 0x17
mov r15, r12
cmp r13b, 0xe5
sub r15, rsi
jmp 0x1403c0573
jae 0x1403c0618
cmp rbx, r13
jmp 0x1403c0581
je 0x1403c05cb
nop word cs:[rax + rax]
movzx rcx, di
mov rcx, rbx
setae dh
mov rdx, rdi
jmp 0x1403c05a7
call fcn.1403c0982
add rbx, 0x110
stc
clc
add rdi, 0x110
cmp rbx, qword [r14 + 8]
jmp 0x1403c05c5
jne 0x1403c0599
cmp rsi, r12
jmp 0x1403c05d3
je 0x1403c06b3
nop dword [rax + rax]
not cx
mov rcx, rbx
cdq
bswap dx
cmovo rdx, r11
mov rdx, rdi
call fcn.1403c0f41
add rbx, 0x110
add rdi, 0x110
jmp 0x1403c060a
inc r15
jne 0x1403c05e4
jmp 0x1403c06b3
imul r15, rsi, 0x110
add r15, rbx
jmp 0x1403c0627
test rsi, rsi
je 0x1403c0671
nop
mov cl, 0xeb
mov rcx, rbx
cqo
movsx edx, si
mov rdx, rdi
jmp 0x1403c0643
call fcn.1403c0982
add rbx, 0x110
cmp r12b, 0x2d
add rdi, 0x110
jmp 0x1403c065f
dec rsi
jmp 0x1403c0667
jne 0x1403c0633
mov r13, qword [r14 + 8]
cmp r15, r13
jmp 0x1403c0679
je 0x1403c06b0
mov rsi, r15
bswap cx
movzx cx, ah
movsxd rcx, ebx
nop word [rax + rax]
setnp ch
mov rcx, rsi
call fcn.1403bae24
add rsi, 0x110
cmp r8b, bl
cmp rsi, r13
jne 0x1403c0695
mov rbx, r15
mov qword [r14 + 8], rbx
rol esi, cl
xchg r15b, r14b
add rsp, 0x20
setnp r13b
pop rbx
movsx di, sil
movzx r15, r12w
pop rdi
movzx r15w, cl
pop rsi
pop r12
movsx r14d, ax
cmovno r13w, r12w
movsx r13, r9w
pop r13
not r14w
pop r14
bswap r15d
movzx r15, di
movsxd r15, r15d
pop r15
ret
Function at 0x1403c1d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
clc
push r14
push r12
cmovnp r12w, bx
cmp dx, 0x6dd3
sal r12b, cl
push rsi
push rdi
push rbx
or r12, 0x2b5c3597
rol r12w, 0xd0
sub rsp, 0x28
sal r12b, 0xfc
and r12w, r8w
mov r12w, 0x4de4
mov r12, r8
test rdx, rdx
je 0x1403c1fbb
mov r15, rdx
ror rbx, cl
mov rbx, rcx
sub esi, esi
jmp 0x1403c1da0
jmp 0x1403c1dff
mov rcx, rdi
movsx rdx, r9w
jmp 0x1403c1db4
mov rdx, r14
jmp 0x1403c1dbc
call fcn.1403bfab6
mov eax, dword [rbx + rsi + 0x58]
mov dword [r12 + rsi + 0x58], eax
cmp r10b, r9b
sbb ah, 0xf3
mov rax, qword [rbx + rsi + 0x50]
mov qword [r12 + rsi + 0x50], rax
jmp 0x1403c1de8
add rsi, 0x60
jmp 0x1403c1df1
dec r15
jmp 0x1403c1df9
je 0x1403c1faf
mov eax, dword [rbx + rsi + 8]
stc
clc
mov dword [r12 + rsi + 8], eax
cmp r12, rbx
jmp 0x1403c1e12
je 0x1403c1dc1
cmp qword [rbx + rsi + 0x28], 0x10
jmp 0x1403c1e23
jb 0x1403c1e38
mov r9, qword [rbx + rsi + 0x10]
jmp 0x1403c1e33
jmp 0x1403c1e56
lea r9, [rbx + rsi]
shld di, r10w, 0x78
neg r14b
add r9, 0x10
sbb ax, 0x7adf
and dil, 0xab
cmovne ax, r15w
lea r14, [r12 + rsi]
movzx edi, cx
or dil, al
adc di, bp
add r14, 0x10
mov rdi, qword [rbx + rsi + 0x20]
mov rax, qword [r12 + rsi + 0x28]
cmp rax, rdi
jmp 0x1403c1e79
jae 0x1403c1e9a
mov rcx, r14
mov dx, 0x58a1
bswap edx
mov rdx, rdi
jmp 0x1403c1e90
call fcn.1403bfab6
jmp 0x1403c1efd
cmp rax, 0x10
jmp 0x1403c1ea3
jb 0x1403c1eba
mov r14, qword [r12 + rsi + 0x10]
movsxd rdx, eax
movsx rcx, bx
jmp 0x1403c1eba
mov qword [r12 + rsi + 0x20], rdi
xchg r8b, dl
movzx edx, cx
movsx ecx, cx
mov rcx, r14
movsx r8w, r10b
not r8d
movzx rdx, r9w
mov rdx, r9
movsx r8d, r8w
movsx r8, r11w
not r8w
mov r8, rdi
call fcn.1404a81fb
mov byte [r14 + rdi], 0
xadd r14w, r14w
rol r14w, 0x1b
mov r14, qword [rbx + rsi + 0x40]
cmp qword [rbx + rsi + 0x48], 0x10
jb 0x1403c1f1d
mov r9, qword [rbx + rsi + 0x30]
jmp 0x1403c1f18
jmp 0x1403c1f35
lea r9, [rbx + rsi]
setb al
rcl ax, cl
shr eax, cl
add r9, 0x30
shl ah, 0x63
shrd ax, cx, 0xc9
lea rdi, [r12 + rsi]
movsx eax, di
add rdi, 0x30
add al, 0x37
sub rax, 0x4e300bb4
mov rax, qword [r12 + rsi + 0x48]
cmc
clc
cmp r9b, 0xea
cmp rax, r14
jmp 0x1403c1f5c
jb 0x1403c1da5
cmp rax, 0x10
jmp 0x1403c1f6b
jb 0x1403c1f7c
mov rdi, qword [r12 + rsi + 0x30]
movzx cx, ch
mov dl, 0xcb
mov qword [r12 + rsi + 0x40], r14
movsx r8, dx
mov rcx, rdi
mov rdx, r9
not r8
jmp 0x1403c1f93
mov r8, r14
jmp 0x1403c1f9b
call fcn.1404a81fb
mov byte [rdi + r14], 0
jmp 0x1403c1faa
jmp 0x1403c1dc1
add r12, rsi
sub bh, 0x55
movsx r15d, r15w
xor bl, dh
mov rax, r12
stc
cmova si, bp
add rsp, 0x28
setp bh
cmovb rbx, rsp
movzx ebx, si
pop rbx
pop rdi
jmp 0x1403c1fe0
pop rsi
bswap r15w
pop r12
movzx r15w, r11b
pop r14
movsx r15, r15w
pop r15
jmp 0x1403c1ff9
ret
Function at 0x1403d1e2f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
movsxd r15, edx
bswap r15d
rcl r15b, 0xa9
push r14
movzx r14, r10w
sal r14, 0xa6
push r13
movzx r13w, al
and r13b, sil
push r12
ror r12b, 0x3b
ror r14, cl
movzx r15, r13w
push rsi
shrd r12w, r9w, 0xb2
push rdi
rol sil, 0x94
btr r14, rdx
push rbx
sub rsp, 0x30
cmp r9, 0x5da15b0e
movsx esi, sp
sal r13w, cl
movaps xmmword [rsp + 0x20], xmm6
mov r15, r9
not r14w
mov r12, r8
dec r14w
xor r14b, r8b
btc r14d, esp
mov r14, rdx
shr si, cl
movzx rsi, cx
mov r13, rcx
adc sil, 0xe9
and rsi, rbp
mov rsi, qword [rcx]
test ch, 0xa6
test rsi, rsi
jmp 0x1403d1ebb
je 0x1403d1ff1
mov rbx, qword [r13 + 8]
jmp 0x1403d1ecd
cmp rsi, rbx
je 0x1403d1f8a
movaps xmm6, xmmword [0x1400bd3f0]
jmp 0x1403d1ee2
jmp 0x1403d1f17
call fcn.14015a7a7
movups xmmword [rsi + 0x10], xmm6
stc
test r14b, 0x1b
cmp r13d, 0x58d77e1d
mov word [rsi], 0
test ch, bh
cmp eax, ebp
add rsi, 0x20
jmp 0x1403d1f0e
cmp rsi, rbx
je 0x1403d1f86
mov rax, qword [rsi + 0x18]
clc
cmp rax, 8
jb 0x1403d1eec
mov rcx, qword [rsi]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x1403d1ee7
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
stc
cmp r12w, r12w
sub rcx, rdi
cmp r12b, 0x5e
stc
cmp rcx, 0x20
jmp 0x1403d1f5c
jae 0x1403d206d
lea rax, [rax + rax]
add rax, 0x29
cdq
mov rdx, rax
mov rcx, 0x5b18565c
movzx rcx, r13w
mov rcx, rdi
jmp 0x1403d1f81
jmp 0x1403d1ee7
mov rsi, qword [r13]
mov rdx, qword [r13 + 0x10]
cmc
test bh, 0x18
cmp r10w, 0x4620
sub rdx, rsi
cmp r15b, 0xa0
cmp rdx, 0x1000
jb 0x1403d1fe9
mov rax, qword [rsi - 8]
jmp 0x1403d1fb5
add rsi, 0xfffffffffffffff8
cmp sil, r11b
sub rsi, rax
cmp cl, r9b
cmp rsi, 0x20
jmp 0x1403d1fcb
jae 0x1403d206d
add rdx, 0x27
movsx rsi, bx
not sil
mov rsi, rax
mov cx, sp
movsxd rcx, r15d
movsx ecx, r14w
mov rcx, rsi
call fcn.14015a7a7
mov qword [r13], r14
shl r12, 5
add bx, sp
lea r12, [r12 + r14]
mov qword [r13 + 8], r12
movsx bx, sil
shr esi, cl
cmc
shl r15, 5
ror bh, cl
dec esi
add r15, r14
bt r14w, r8w
mov qword [r13 + 0x10], r15
cmp bl, spl
ror bh, 0xcb
sal r15b, 0xd9
movaps xmm6, xmmword [rsp + 0x20]
cmovs bx, r15w
movsxd r12, r10d
add rsp, 0x30
not r13
mov r15, 0x11b36edb
pop rbx
pop rdi
movzx r13d, r14w
pop rsi
pop r12
movzx r13, bx
pop r13
movsx r15, r14w
pop r14
movsx r15d, r12w
movzx r15d, r8w
xchg r15b, r15b
pop r15
jmp 0x1403d206c
ret
call fcn.1404bacb4
int3
Function at 0x1403e4c54
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
movzx r9, bp
xadd r9b, r10b
movsx r10d, r14w
push rdi
ror r9b, cl
sbb r9d, ebx
push rbx
mov r9, rcx
cmp bp, r12w
mov r10w, 0x5317
add r8, rdx
rcr r10b, 0xaa
sub r10, 0x4071316
or r10b, 0x1d
mov dword [rcx + 8], 0
bswap r10w
movsxd r10, esp
movzx r10d, r8w
sub eax, eax
xor ecx, ecx
xchg r10d, r10d
nop word cs:[rax + rax]
rol r10b, cl
bts r10d, edi
lea r10, [rdx + 1]
cmp dl, bpl
cmp r10, r8
jmp 0x1403e4cc2
ja 0x1403e4f1b
movzx edi, byte [rdx]
rcl dl, 0x4f
rol dh, cl
adc rdx, 0x17730a67
mov edx, edi
cmp r10b, 0xa6
and edx, 0x7f
shl rdx, cl
add rax, rdx
xor dl, dil
add rcx, 7
cmp r12b, r12b
mov rdx, r10
jmp 0x1403e4cfb
test dil, dil
jmp 0x1403e4d03
js 0x1403e4cb3
mov rcx, rax
cmp dil, 0x8c
and rcx, 0xfffffffffffffff8
test r8b, sil
jmp 0x1403e4d1c
and eax, 7
stc
cmp r15b, bl
cmp rcx, 8
je 0x1403e4e6a
cmp rax, 1
jg 0x1403e4d5c
test rax, rax
je 0x1403e4e08
cmp eax, 1
jmp 0x1403e4d48
jne 0x1403e4f1b
lea rdx, [r10 + 8]
jmp 0x1403e4d57
jmp 0x1403e4e59
cmp eax, 5
jmp 0x1403e4d64
je 0x1403e4e4f
cmp eax, 2
jne 0x1403e4f1b
mov rsi, r10
shld eax, ebp, 0xe2
rcl al, 0xcc
shrd eax, r15d, 0xc
sub edi, edi
clc
and al, 0xe7
sub ecx, ecx
neg rax
rcl eax, cl
nop word cs:[rax + rax]
movzx rax, r9w
or ah, ch
lea rax, [rsi + 1]
test r14, r10
cmp rax, r8
ja 0x1403e4f1b
mov r11, rdi
movzx ebx, byte [rsi]
adc dx, ax
sbb sil, r13b
mov edx, ebx
cmp sp, 0x7f22
stc
and edx, 0x7f
shl rdx, cl
shl esi, 0x81
add rsi, rdi
add rdi, rdx
add rcx, 7
ror sil, cl
mov rsi, rax
test bl, bl
jmp 0x1403e4de3
js 0x1403e4d9f
lea rdx, [rdx + r11]
cmc
stc
add rdx, rax
cmp rdx, r8
jmp 0x1403e4dfa
cmova rdx, rax
jmp 0x1403e4e03
jmp 0x1403e4c99
mov rax, r10
nop
ror dl, 0x86
btc dx, r12w
adc dh, 0xd8
lea rdx, [rax + 1]
test r10b, 0x81
clc
cmp rdx, r8
jmp 0x1403e4e29
ja 0x1403e4f1b
cmp byte [rax], 0
jmp 0x1403e4e3c
mov rax, rdx
jmp 0x1403e4e44
js 0x1403e4e18
jmp 0x1403e4c99
lea rdx, [r10 + 4]
cmc
jmp 0x1403e4e59
cmp rdx, r8
jmp 0x1403e4e61
cmova rdx, r10
jmp 0x1403e4c99
cmp eax, 2
jmp 0x1403e4e72
jne 0x1403e4f1b
mov dword [r9 + 8], 2
movsx esi, di
mov rsi, r10
rcr rdx, 0x79
sub eax, eax
sub ecx, ecx
nop word [rax + rax]
lea rdx, [rsi + 1]
jmp 0x1403e4e9e
cmp rdx, r8
ja 0x1403e4f1b
movzx r11d, byte [rsi]
rcl di, 0xf5
btr si, si
movsx rdi, r9w
mov edi, r11d
rcl sil, cl
or esi, 0x215c2f1e
and edi, 0x7f
and sil, 0xeb
mov si, di
movsx esi, r15w
shl rdi, cl
add rax, rdi
add rcx, 7
btr rsi, 0xf2
sbb sil, spl
add rsi, 0x5ff85a75
mov rsi, rdx
test r11b, r11b
js 0x1403e4e94
mov qword [r9 + 0x10], rdx
mov qword [r9 + 0x18], rax
cmp r11, 0x425b6c42
test dil, r14b
add rdx, rax
cmc
clc
cmp rdx, r8
jmp 0x1403e4f15
jbe 0x1403e4c99
cmp r10, r8
bswap rbx
seta al
mov di, r13w
not dil
xchg rsi, rbx
pop rbx
movzx si, spl
movzx edi, r11w
movsxd rsi, ebp
pop rdi
movzx rsi, dx
movsx esi, r11w
pop rsi
ret
Function at 0x1403eee9e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
jmp 0x1403eeeb2
push rsi
jmp 0x1403eeebc
push rdi
push rbx
sub rsp, 0x30
ror dil, 0xd
or dil, 0xb8
movaps xmmword [rsp + 0x20], xmm6
movzx di, r10b
or dil, bpl
mov rdi, qword [rcx]
test rdi, rdi
jmp 0x1403eeee2
je 0x1403ef05c
mov r14, rcx
sar bh, 0xd1
jmp 0x1403eeef6
mov rbx, qword [rcx + 8]
stc
cmp r11b, 0xdc
cmp rdi, rbx
je 0x1403eefce
lea r15, [0x1400beb30]
jmp 0x1403eef14
xorps xmm6, xmm6
jmp 0x1403eef4c
lea rsi, [rdi + 0x18]
call fcn.14015a7a7
movups xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
cmp ebp, 0x1c0b0a44
add rdi, 0x30
cmp r13b, sil
stc
cmp rdi, rbx
jmp 0x1403eef46
je 0x1403eefc0
mov qword [rdi], r15
mov rcx, qword [rdi + 0x18]
jmp 0x1403eef5d
test rcx, rcx
jmp 0x1403eef65
je 0x1403eef36
mov rdx, qword [rdi + 0x28]
cmp r15w, 0x5333
stc
sub rdx, rcx
stc
clc
cmp rdx, 0x1000
jmp 0x1403eef87
jb 0x1403eef1c
mov rax, qword [rcx - 8]
stc
add rcx, 0xfffffffffffffff8
test dl, r10b
cmp cx, 0x588f
sub rcx, rax
cmp rcx, 0x20
jae 0x1403ef09e
add rdx, 0x27
bswap rcx
movsxd rcx, ebx
movsx ecx, bp
mov rcx, rax
jmp 0x1403eef1c
mov rdi, qword [r14]
btc edx, 0xad
xor rdx, 0x3ef33532
mov rdx, qword [r14 + 0x10]
jmp 0x1403eefd7
sub rdx, rdi
cmp si, 0x7463
stc
jmp 0x1403eefe5
cmp rdx, 0x1000
jmp 0x1403eeff1
jb 0x1403ef031
mov rax, qword [rdi - 8]
cmp spl, r10b
jmp 0x1403ef003
add rdi, 0xfffffffffffffff8
cmp r9w, 0x1e35
sub rdi, rax
cmp rdi, 0x20
jae 0x1403ef09e
add rdx, 0x27
movzx ecx, r9w
mov rdi, rax
mov cl, r12b
movsx cx, spl
movzx ecx, r12w
mov rcx, rdi
call fcn.14015a7a7
xorps xmm0, xmm0
movups xmmword [r14], xmm0
and r15d, 0x6f3a2623
rcr dil, cl
shl bh, cl
mov qword [r14 + 0x10], 0
xadd bx, si
movsx di, cl
movaps xmm6, xmmword [rsp + 0x20]
and bh, 0x26
sar dil, cl
add rsp, 0x30
movsxd r15, r15d
cmovp r14w, r8w
movzx esi, bx
pop rbx
not r14w
setae r14b
movsx r15d, si
pop rdi
pop rsi
not r15b
bswap r14d
xchg r14w, r15w
pop r14
movsx r15w, al
jmp 0x1403ef09b
pop r15
ret
call fcn.1404bacb4
int3
Function at 0x1404307ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
rcl si, cl
push rdi
xadd rdi, rdi
sub rsp, 0x28
bswap edi
movsx si, bl
and rsi, r11
mov rsi, rcx
movzx edi, dx
bt rdx, 0x17
dec dh
cmp r11b, 0x15
movzx edx, word [rcx + rdi*4 + 0x834]
cmp rbp, 0x35f75852
cmp spl, r8b
test edx, 0x6cff0580
test dx, dx
jmp 0x1404307f4
js 0x140430807
mov rcx, rsi
jmp 0x140430802
call fcn.1404307ad
movsxd rcx, dword [rsi + 0x8860]
stc
test r14d, r10d
cmp ecx, dword [rsi + 0x8858]
jmp 0x14043081d
jge 0x1404309a5
movsxd rax, dword [rsi + 0x885c]
movzx edx, bp
shr r8d, 0x16
add rax, rcx
mov r8, qword [rsi + 8]
lea edx, [rax + 3]
bsf cx, dx
btr cx, si
test eax, eax
movsx ecx, cx
movsx rcx, r12w
mov cx, 0x7782
cmovns edx, eax
rcr ecx, 6
not cx
stc
mov rcx, qword [rsi + 0x18]
cmc
sar edx, 2
movsxd rdx, edx
test spl, cl
mov byte [rcx + rdx], 1
xor dx, 0x3033
shr dl, 0xeb
movsx edx, r10w
mov rdx, qword [rsi + 0x8838]
stc
clc
movzx edi, byte [rsi + rdi*4 + 0x837]
stc
cmp r15b, spl
cmp byte [rdx + rdi*4 + 3], 0x81
jb 0x1404308cb
movzx ecx, byte [rdx + rdi*4 + 2]
mov byte [r8 + rax], cl
movzx ecx, byte [rdx + rdi*4 + 1]
mov byte [r8 + rax + 1], cl
movzx ecx, byte [rdx + rdi*4]
stc
mov byte [r8 + rax + 2], cl
movzx ecx, byte [rdx + rdi*4 + 3]
clc
stc
test ebp, 0x3ccf014a
mov byte [r8 + rax + 3], cl
stc
bts eax, eax
mov eax, dword [rsi + 0x885c]
test ebp, ecx
stc
cmc
add eax, 4
mov dword [rsi + 0x885c], eax
cmp eax, dword [rsi + 0x8854]
jmp 0x1404308e9
jl 0x1404309a5
mov ecx, dword [rsi + 0x884c]
cwde
mov eax, dword [rsi + 0x8858]
cmp dx, 0xc1a
mov dword [rsi + 0x885c], ecx
clc
btc cx, 0xf8
mov ecx, dword [rsi + 0x8860]
cmp r10w, 0x39fa
cmp cx, di
add ecx, dword [rsi + 0x8844]
jmp 0x140430929
mov dword [rsi + 0x8860], ecx
cmp ecx, eax
jmp 0x140430936
jl 0x1404309a5
mov ecx, dword [rsi + 0x8840]
nop dword [rax]
clc
test di, 0x156b
test ecx, ecx
jmp 0x140430956
jle 0x1404309a5
mov edx, dword [rsi + 0x8864]
cmp r14b, cl
jmp 0x14043096a
shl edx, cl
mov dword [rsi + 0x8844], edx
sar edx, 1
clc
test rsp, 0x70c97eb4
add edx, dword [rsi + 0x8850]
mov dword [rsi + 0x8860], edx
dec ecx
cmp bpl, 0x48
test spl, 0x6b
mov dword [rsi + 0x8840], ecx
cmc
cmp r9w, r13w
cmp edx, eax
jge 0x14043094f
add rsp, 0x28
cmove edi, esi
pop rdi
pop rsi
ret
Function at 0x1404309af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
rcr r15b, cl
push r14
mov r14b, 0xc2
xor r14b, r13b
push r12
push rsi
bt r15w, 0x1e
rcl r14d, 0x7c
push rdi
rcr r14b, 0x4e
shl r15, 0x9b
stc
push rbp
push rbx
mov bx, 0x47a
inc r12b
sub rsp, 0x20
movsx r12, sp
sal r12w, 0xaa
mov r12, r8
mov edi, edx
mov rbx, rcx
movsx bp, sil
btr rbp, 0x21
lea r14, [rcx + 0x38]
mov r15, r15
rcl r15b, cl
lea r15, [rcx + 0x39]
btr ebp, 0x8c
mov ebp, 0x80
cmc
sub esi, esi
jmp 0x140430a1a
jmp 0x140430a5c
lea rcx, [rax + 1]
jmp 0x140430a28
mov qword [rbx + 0xc0], rcx
jmp 0x140430a34
movzx eax, byte [rax]
jmp 0x140430a3c
mov byte [r12 + rsi], al
inc rsi
shr ebp, 1
test rcx, 0x1d195c6a
cmc
cmp rsi, 4
jmp 0x140430a56
je 0x140430bbb
test ebp, edi
jmp 0x140430a63
je 0x140430a40
cmp qword [rbx + 0x10], 0
je 0x140430a97
mov rcx, qword [rbx + 0x28]
jmp 0x140430a7d
call qword [rbx + 0x20]
test eax, eax
je 0x140430b3a
cmp dword [rbx + 0x30], 0
jmp 0x140430a91
je 0x140430bac
mov rax, qword [rbx + 0xc0]
btr rcx, rsp
shrd ecx, esp, 0x9e
mov rcx, qword [rbx + 0xc8]
cmp rax, rcx
jmp 0x140430ab5
jae 0x140430bac
cmp rax, rcx
jmp 0x140430ac3
jb 0x140430a1f
cmp dword [rbx + 0x30], 0
jmp 0x140430ad2
je 0x140430b59
mov r8d, dword [rbx + 0x34]
cqo
movsx ecx, di
mov rcx, qword [rbx + 0x28]
jmp 0x140430aeb
mov rdx, r14
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
jmp 0x140430b00
sub ecx, dword [rbx + 0xd0]
stc
test dl, r10b
add dword [rbx + 0xb8], ecx
jmp 0x140430b18
test eax, eax
je 0x140430b65
movsxd rcx, eax
add rcx, r14
mov eax, 0x18af7708
cwde
movzx eax, byte [r14]
jmp 0x140430b35
jmp 0x140430b8f
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0xc8]
cmp sil, r9b
cmp rax, rcx
jae 0x140430ac9
jmp 0x140430a1f
xor eax, eax
jmp 0x140430b60
jmp 0x140430a3c
mov dword [rbx + 0x30], 0
bswap cx
bsr ecx, edi
mov byte [rbx + 0x38], 0
movzx cx, cl
ror rcx, 0x79
xor eax, eax
cmovnp ecx, r10d
mov ch, 0x86
mov rcx, r15
jmp 0x140430b8f
mov qword [rbx + 0xc8], rcx
jmp 0x140430b9b
mov qword [rbx + 0xc0], r15
jmp 0x140430ba7
jmp 0x140430a3c
sub r12d, r12d
and r14d, r12d
xadd bpl, r15b
adc si, 0x3ad9
mov rax, r12
and ebx, ebx
add rsp, 0x20
movsx r15, r14w
bswap bp
movsx r14w, spl
pop rbx
cmova r14w, r8w
pop rbp
sete sil
pop rdi
bswap si
mov r15d, r13d
pop rsi
bswap r12d
xchg r14d, r12d
movsx r15, r12w
pop r12
movsx r14, dx
bswap r15w
movzx r15w, bl
pop r14
not r15
pop r15
jmp 0x140430c08
ret
Function at 0x140432e27
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bts si, si
bts ax, r11w
push rdi
push rbx
shr sil, 3
dec ax
sub rsp, 0x20
adc ah, 0x9a
bts ax, r8w
mov rsi, rcx
movzx eax, byte [rcx + 0x4828]
cmc
cmp al, 0xff
jmp 0x140432e58
je 0x140432e6a
mov byte [rsi + 0x4828], 0xff
jmp 0x140432f6f
mov rbx, qword [rsi]
shr rax, 0x9c
shl al, cl
movsxd rax, edi
mov rax, qword [rbx + 0xc0]
clc
cmp rax, qword [rbx + 0xc8]
jae 0x140432ead
lea rcx, [rax + 1]
jmp 0x140432e94
mov qword [rbx + 0xc0], rcx
movzx cx, r15b
movzx ecx, byte [rax]
jmp 0x140432ea8
jmp 0x140432f5f
cmp dword [rbx + 0x30], 0
je 0x140432f18
mov r8d, dword [rbx + 0x34]
jmp 0x140432ec5
lea rdi, [rbx + 0x38]
cmovl dx, cx
mov rcx, qword [rbx + 0x28]
cdq
cwd
mov rdx, rdi
jmp 0x140432edc
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xd0]
clc
add dword [rbx + 0xb8], ecx
test eax, eax
jmp 0x140432ef9
je 0x140432f24
cdqe
bt rcx, r8
sbb cl, r8b
add rax, rdi
movzx ecx, byte [rdi]
jmp 0x140432f13
jmp 0x140432f43
mov al, 0xff
jmp 0x140432f1f
jmp 0x140432f6f
mov dword [rbx + 0x30], 0
cdqe
lea rax, [rbx + 0x39]
cmp r9w, r9w
mov byte [rbx + 0x38], 0
xor ecx, ecx
test di, 0x2e25
test r15d, ebp
mov qword [rbx + 0xc8], rax
rcl ah, cl
lea rax, [rbx + 0x39]
jmp 0x140432f55
mov qword [rbx + 0xc0], rax
or al, bpl
mov al, 0xff
cmp cl, 0xff
jmp 0x140432f69
je 0x140432fb5
add rsp, 0x20
setns bh
not di
movsxd rdi, ecx
pop rbx
movsx di, r10b
pop rdi
movsx rsi, r14w
cmova esi, r11d
mov sil, sil
pop rsi
jmp 0x140432f94
ret
lea rcx, [rax + 1]
mov qword [rbx + 0xc0], rcx
cmp r14b, r14b
movzx eax, byte [rax]
clc
stc
cmp al, 0xff
jmp 0x140432faf
jne 0x140432f6f
mov rbx, qword [rsi]
ror ah, cl
cwde
xor al, r15b
mov rax, qword [rbx + 0xc0]
cmc
cmp rax, qword [rbx + 0xc8]
jmp 0x140432fd2
jb 0x140432f95
cmp dword [rbx + 0x30], 0
je 0x14043309c
mov r8d, dword [rbx + 0x34]
lea rdi, [rbx + 0x38]
movzx dx, bl
xchg cx, dx
jmp 0x140432ff6
mov rcx, qword [rbx + 0x28]
movzx dx, bh
mov dx, r8w
cqo
mov rdx, rdi
jmp 0x14043300c
call qword [rbx + 0x10]
mov ecx, dword [rbx + 0xc0]
sub ecx, dword [rbx + 0xd0]
test r15b, spl
add dword [rbx + 0xb8], ecx
test eax, eax
je 0x140433050
movsxd rcx, eax
shrd rax, rax, 0x5b
add rcx, rdi
movzx eax, cx
jmp 0x140433043
movzx eax, byte [rdi]
jmp 0x14043304b
jmp 0x140433062
mov dword [rbx + 0x30], 0
lea rcx, [rbx + 0x39]
stc
mov byte [rbx + 0x38], 0
xor eax, eax
mov qword [rbx + 0xc8], rcx
stc
neg cl
lea rcx, [rbx + 0x39]
jmp 0x140433077
mov qword [rbx + 0xc0], rcx
jmp 0x14043308a
cmp al, 0xff
jmp 0x140433091
je 0x140432fb5
jmp 0x140432f6f
xor eax, eax
jmp 0x140432f6f
Function at 0x14044398e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
bt si, 0xe
shl rax, 0x55
test r12d, 0x74301852
push rdi
xor edi, r9d
shrd ax, r9w, 0x19
and rdi, rax
push rbx
sub rsp, 0x90
sar dil, cl
ror eax, 0x23
movaps xmmword [rsp + 0x80], xmm7
ror sil, 0x8a
movaps xmmword [rsp + 0x70], xmm6
mov rdi, rdx
mov rsi, rcx
cbw
cdqe
shr al, 0xf0
mov rax, qword [rdx]
cmp r14d, 0x2ca772ba
cmp qword [rax + 0x18], 8
jmp 0x1404439ee
jb 0x140443a00
mov rax, qword [rax]
btr r9d, 0x68
rol r9, 0xfb
movsxd rcx, r8d
jmp 0x140443a0d
lea r9, [rax + rcx*2]
jmp 0x140443a1b
sub ebx, ebx
bts eax, r8d
nop word cs:[rax + rax]
rcr ax, 0x83
shr eax, cl
movzx eax, word [r9 + rbx*2]
jmp 0x140443a42
cmp eax, 0xa
je 0x140443a60
test eax, eax
jmp 0x140443a52
je 0x140443a60
inc rbx
jmp 0x140443a34
test byte [rdi + 0x1c], 4
jne 0x140443bf3
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi + 8]
mov r8, rbp
xchg dl, dh
movsd xmm0, qword [rax + 8]
cmovnp r8w, r10w
movsd qword [rsp + 0x40], xmm0
movsx r8d, r14w
mov dword [rsp + 0x30], ebx
jmp 0x140443a9a
mov dword [rsp + 0x28], 2
mov dx, r14w
movzx rdx, bx
mov dword [rsp + 0x20], 0
xchg r8d, r8d
movsxd rdx, ebx
cwd
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x40]
jmp 0x140443ac9
call fcn.14044a69e
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movsx rcx, ax
movsx ecx, si
not cl
movaps xmmword [rsp + 0x40], xmm0
lahf
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x38]
mov eax, 0x1b247931
movsx rdx, bx
cmovl rdx, rbp
mov rax, qword [rcx]
cdq
movzx edx, bp
not rdx
lea rdx, [rsp + 0x40]
jmp 0x140443b13
call qword [rax + 0x1e0]
test eax, eax
je 0x140443b54
mov ecx, eax
jmp 0x140443b28
movabs r8, 0xe31b45c42a775183
mov dl, r13b
mov dl, 3
movsx r9w, r12b
movzx r9d, sp
movsx r9d, sp
mov r9d, 0x4f
jmp 0x140443b4f
call fcn.1403b3ff8
movss xmm6, dword [rsp + 0x4c]
movss xmm7, dword [rsp + 0x50]
lea rcx, [rsp + 0x38]
cmp esp, ebp
sal dx, cl
shr dh, 0x2b
lea rdx, [rsp + 0x40]
test bp, 0x5768
sub r8d, r8d
jmp 0x140443b7f
call fcn.140443f88
movss xmm0, dword [rdi + 0x18]
movss dword [rsi], xmm0
jmp 0x140443b92
addss xmm6, xmm0
movss dword [rsi + 4], xmm6
movsx cx, dl
movss xmm0, dword [rsp + 0x50]
clc
cmovle ecx, r10d
bswap rcx
movss dword [rsi + 8], xmm0
sbb ch, ch
mov cx, 0x6cbf
mov dword [rsi + 0xc], 0
clc
movss dword [rsi + 0x10], xmm7
inc rcx
movsx cx, r8b
mov dword [rsi + 0x14], ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jmp 0x140443bdd
je 0x140443c62
mov rax, qword [rcx]
jmp 0x140443beb
call qword [rax + 0x10]
jmp 0x140443c62
movss xmm0, dword [rdi + 0x18]
jmp 0x140443bfd
movss dword [rsi], xmm0
jmp 0x140443c06
cvtsi2ss xmm1, ebx
mulss xmm1, dword [0x1400bfc14]
addss xmm1, xmm0
movss dword [rsi + 4], xmm1
jmp 0x140443c20
movss xmm0, dword [0x1400bfc94]
movlps qword [rsi + 8], xmm0
mov rax, qword [rdi + 8]
jmp 0x140443c35
movss xmm0, dword [rax + 0xc]
jmp 0x140443c3f
addss xmm0, dword [0x1400bfbd0]
movss dword [rsi + 0x10], xmm0
shld rdi, rcx, 0x9b
add di, r9w
mov rdi, rsp
mov dword [rsi + 0x14], ebx
rcl bx, 0x45
mov bl, sil
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
adc sil, r9b
or dil, 0xb8
add rsp, 0x90
pop rbx
seto sil
not si
pop rdi
pop rsi
ret